xmrig | 0c511b6e894c1f871ab251443cbc5437bff11711cb84d223b93472da615c6b94

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
Size

2.0MB
MD5

7aaa5ac20f238a6214e56308e4439940
SHA1

6603b7dbfafbb54685a33b11de510088c879f9f3
SHA256

0c511b6e894c1f871ab251443cbc5437bff11711cb84d223b93472da615c6b94
SHA512

6af4727aae9bdad9ebd24006266f6c9892d1166b26ca386cc45ce575e14aa8ef9796613ec66ae7ca063d1daef6faf891c888d78426c8455f6fcc4b7341d4f49d
SSDEEP

24576:BezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbEwlKjpv3OBC6y90Xli7w4/eBVDr:BezaTF8FcNkNdfE0pZ9ozt4wISK7ykHe

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 60 IoCs

miner

resource	yara_rule
behavioral1/memory/3000-1-0x000000013F060000-0x000000013F3B4000-memory.dmp	xmrig
behavioral1/files/0x000d000000012674-3.dat	xmrig
behavioral1/files/0x00070000000143e5-18.dat	xmrig
behavioral1/memory/2592-83-0x000000013F130000-0x000000013F484000-memory.dmp	xmrig
behavioral1/files/0x0006000000015c87-114.dat	xmrig
behavioral1/files/0x0006000000015cff-135.dat	xmrig
behavioral1/files/0x0006000000015e32-185.dat	xmrig
behavioral1/files/0x0006000000015d93-180.dat	xmrig
behavioral1/files/0x0006000000015d87-175.dat	xmrig
behavioral1/files/0x0006000000015d7f-170.dat	xmrig
behavioral1/files/0x0006000000015d5f-160.dat	xmrig
behavioral1/files/0x0006000000015d6b-165.dat	xmrig
behavioral1/files/0x0006000000015d56-155.dat	xmrig
behavioral1/files/0x0006000000015d4e-151.dat	xmrig
behavioral1/files/0x0006000000015d20-140.dat	xmrig
behavioral1/files/0x0006000000015d42-145.dat	xmrig
behavioral1/files/0x0006000000015ce3-130.dat	xmrig
behavioral1/files/0x0006000000015cd9-125.dat	xmrig
behavioral1/files/0x0006000000015ccd-120.dat	xmrig
behavioral1/files/0x0006000000015653-104.dat	xmrig
behavioral1/files/0x000600000001535e-103.dat	xmrig
behavioral1/memory/2392-102-0x000000013F2D0000-0x000000013F624000-memory.dmp	xmrig
behavioral1/memory/2892-100-0x000000013FBD0000-0x000000013FF24000-memory.dmp	xmrig
behavioral1/memory/2432-97-0x000000013FC50000-0x000000013FFA4000-memory.dmp	xmrig
behavioral1/files/0x0009000000014597-95.dat	xmrig
behavioral1/memory/2536-94-0x000000013F2B0000-0x000000013F604000-memory.dmp	xmrig
behavioral1/memory/2560-90-0x000000013F410000-0x000000013F764000-memory.dmp	xmrig
behavioral1/memory/2448-88-0x000000013FE40000-0x0000000140194000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cae-86.dat	xmrig
behavioral1/memory/3000-63-0x0000000001F20000-0x0000000002274000-memory.dmp	xmrig
behavioral1/files/0x000600000001565d-62.dat	xmrig
behavioral1/files/0x000600000001564f-61.dat	xmrig
behavioral1/memory/2564-58-0x000000013F670000-0x000000013F9C4000-memory.dmp	xmrig
behavioral1/files/0x0006000000015677-57.dat	xmrig
behavioral1/files/0x0006000000015cb6-107.dat	xmrig
behavioral1/files/0x000800000001469d-42.dat	xmrig
behavioral1/files/0x00070000000144e8-41.dat	xmrig
behavioral1/memory/2476-40-0x000000013F070000-0x000000013F3C4000-memory.dmp	xmrig
behavioral1/memory/2496-79-0x000000013F630000-0x000000013F984000-memory.dmp	xmrig
behavioral1/files/0x0006000000015c9e-78.dat	xmrig
behavioral1/files/0x0006000000015684-77.dat	xmrig
behavioral1/memory/2524-67-0x000000013F920000-0x000000013FC74000-memory.dmp	xmrig
behavioral1/memory/2528-55-0x000000013FF80000-0x00000001402D4000-memory.dmp	xmrig
behavioral1/files/0x000700000001443b-46.dat	xmrig
behavioral1/files/0x0030000000014207-17.dat	xmrig
behavioral1/files/0x0007000000014358-24.dat	xmrig
behavioral1/memory/3000-3078-0x000000013F060000-0x000000013F3B4000-memory.dmp	xmrig
behavioral1/memory/2392-3989-0x000000013F2D0000-0x000000013F624000-memory.dmp	xmrig
behavioral1/memory/2476-3990-0x000000013F070000-0x000000013F3C4000-memory.dmp	xmrig
behavioral1/memory/2528-3992-0x000000013FF80000-0x00000001402D4000-memory.dmp	xmrig
behavioral1/memory/2564-3991-0x000000013F670000-0x000000013F9C4000-memory.dmp	xmrig
behavioral1/memory/2524-3993-0x000000013F920000-0x000000013FC74000-memory.dmp	xmrig
behavioral1/memory/2496-3995-0x000000013F630000-0x000000013F984000-memory.dmp	xmrig
behavioral1/memory/2592-3994-0x000000013F130000-0x000000013F484000-memory.dmp	xmrig
behavioral1/memory/2448-3996-0x000000013FE40000-0x0000000140194000-memory.dmp	xmrig
behavioral1/memory/2432-3998-0x000000013FC50000-0x000000013FFA4000-memory.dmp	xmrig
behavioral1/memory/2536-3997-0x000000013F2B0000-0x000000013F604000-memory.dmp	xmrig
behavioral1/memory/2560-3999-0x000000013F410000-0x000000013F764000-memory.dmp	xmrig
behavioral1/memory/2892-4000-0x000000013FBD0000-0x000000013FF24000-memory.dmp	xmrig
behavioral1/memory/2392-4001-0x000000013F2D0000-0x000000013F624000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2476	EiGfLsB.exe
2528	jGPqwJJ.exe
2564	tYiwVNt.exe
2524	XxjXuYA.exe
2536	OrnJmRf.exe
2496	LddgjmP.exe
2592	BYzkbin.exe
2432	xSDzbrP.exe
2448	nXBUvTr.exe
2892	jACEbLG.exe
2560	BGHkJDD.exe
2392	pAhzYVc.exe
2752	WHOaQTE.exe
2552	NXUeqXm.exe
840	NyIZWKO.exe
2880	dnGdndf.exe
2012	nCbITGC.exe
2716	haoPzzI.exe
2196	SRUPyTd.exe
2300	XmeXewg.exe
2016	pDVjhgO.exe
2164	irXXdMW.exe
1656	tjDshJK.exe
1696	apMndpp.exe
1580	efyOsbl.exe
384	vQOTDFy.exe
480	dvjyPwA.exe
1348	ptUCHST.exe
1600	HZalzhP.exe
1488	fEFXMHP.exe
1844	fszzsFx.exe
1664	ViIngcq.exe
1008	iLlJjGl.exe
2312	wYnBuCT.exe
2612	aUVMMre.exe
2340	ijXhxIv.exe
356	BJYQWBb.exe
1484	LxeSuAq.exe
1352	gmfvVzc.exe
1732	ZTtblha.exe
1724	VvUymxG.exe
1704	BNlaYJc.exe
3064	jXQJUEs.exe
1772	DsUggLz.exe
2152	blDXhQg.exe
2136	hteXcFp.exe
1592	vYRyfLN.exe
1004	jmznHmq.exe
1124	ksHixjT.exe
1636	hzkNnQK.exe
672	mFJuCaf.exe
1588	SbyltfW.exe
2292	hJcMBgL.exe
2240	KMWbeDn.exe
280	sowxCNF.exe
1676	wjLXUXC.exe
2872	XKohFFX.exe
2952	Dnpokin.exe
2568	znHmZpi.exe
2440	qaRRKxN.exe
2896	JGmczTy.exe
2704	FORvuPu.exe
2776	JpfXkRn.exe
1960	TTFMgEW.exe

Loads dropped DLL 64 IoCs

pid	Process
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3000-1-0x000000013F060000-0x000000013F3B4000-memory.dmp	upx
behavioral1/files/0x000d000000012674-3.dat	upx
behavioral1/files/0x00070000000143e5-18.dat	upx
behavioral1/memory/2592-83-0x000000013F130000-0x000000013F484000-memory.dmp	upx
behavioral1/files/0x0006000000015c87-114.dat	upx
behavioral1/files/0x0006000000015cff-135.dat	upx
behavioral1/files/0x0006000000015e32-185.dat	upx
behavioral1/files/0x0006000000015d93-180.dat	upx
behavioral1/files/0x0006000000015d87-175.dat	upx
behavioral1/files/0x0006000000015d7f-170.dat	upx
behavioral1/files/0x0006000000015d5f-160.dat	upx
behavioral1/files/0x0006000000015d6b-165.dat	upx
behavioral1/files/0x0006000000015d56-155.dat	upx
behavioral1/files/0x0006000000015d4e-151.dat	upx
behavioral1/files/0x0006000000015d20-140.dat	upx
behavioral1/files/0x0006000000015d42-145.dat	upx
behavioral1/files/0x0006000000015ce3-130.dat	upx
behavioral1/files/0x0006000000015cd9-125.dat	upx
behavioral1/files/0x0006000000015ccd-120.dat	upx
behavioral1/files/0x0006000000015653-104.dat	upx
behavioral1/files/0x000600000001535e-103.dat	upx
behavioral1/memory/2392-102-0x000000013F2D0000-0x000000013F624000-memory.dmp	upx
behavioral1/memory/2892-100-0x000000013FBD0000-0x000000013FF24000-memory.dmp	upx
behavioral1/memory/2432-97-0x000000013FC50000-0x000000013FFA4000-memory.dmp	upx
behavioral1/files/0x0009000000014597-95.dat	upx
behavioral1/memory/2536-94-0x000000013F2B0000-0x000000013F604000-memory.dmp	upx
behavioral1/memory/2560-90-0x000000013F410000-0x000000013F764000-memory.dmp	upx
behavioral1/memory/2448-88-0x000000013FE40000-0x0000000140194000-memory.dmp	upx
behavioral1/files/0x0006000000015cae-86.dat	upx
behavioral1/files/0x000600000001565d-62.dat	upx
behavioral1/files/0x000600000001564f-61.dat	upx
behavioral1/memory/2564-58-0x000000013F670000-0x000000013F9C4000-memory.dmp	upx
behavioral1/files/0x0006000000015677-57.dat	upx
behavioral1/files/0x0006000000015cb6-107.dat	upx
behavioral1/files/0x000800000001469d-42.dat	upx
behavioral1/files/0x00070000000144e8-41.dat	upx
behavioral1/memory/2476-40-0x000000013F070000-0x000000013F3C4000-memory.dmp	upx
behavioral1/memory/2496-79-0x000000013F630000-0x000000013F984000-memory.dmp	upx
behavioral1/files/0x0006000000015c9e-78.dat	upx
behavioral1/files/0x0006000000015684-77.dat	upx
behavioral1/memory/2524-67-0x000000013F920000-0x000000013FC74000-memory.dmp	upx
behavioral1/memory/2528-55-0x000000013FF80000-0x00000001402D4000-memory.dmp	upx
behavioral1/files/0x000700000001443b-46.dat	upx
behavioral1/files/0x0030000000014207-17.dat	upx
behavioral1/files/0x0007000000014358-24.dat	upx
behavioral1/memory/3000-3078-0x000000013F060000-0x000000013F3B4000-memory.dmp	upx
behavioral1/memory/2392-3989-0x000000013F2D0000-0x000000013F624000-memory.dmp	upx
behavioral1/memory/2476-3990-0x000000013F070000-0x000000013F3C4000-memory.dmp	upx
behavioral1/memory/2528-3992-0x000000013FF80000-0x00000001402D4000-memory.dmp	upx
behavioral1/memory/2564-3991-0x000000013F670000-0x000000013F9C4000-memory.dmp	upx
behavioral1/memory/2524-3993-0x000000013F920000-0x000000013FC74000-memory.dmp	upx
behavioral1/memory/2496-3995-0x000000013F630000-0x000000013F984000-memory.dmp	upx
behavioral1/memory/2592-3994-0x000000013F130000-0x000000013F484000-memory.dmp	upx
behavioral1/memory/2448-3996-0x000000013FE40000-0x0000000140194000-memory.dmp	upx
behavioral1/memory/2432-3998-0x000000013FC50000-0x000000013FFA4000-memory.dmp	upx
behavioral1/memory/2536-3997-0x000000013F2B0000-0x000000013F604000-memory.dmp	upx
behavioral1/memory/2560-3999-0x000000013F410000-0x000000013F764000-memory.dmp	upx
behavioral1/memory/2892-4000-0x000000013FBD0000-0x000000013FF24000-memory.dmp	upx
behavioral1/memory/2392-4001-0x000000013F2D0000-0x000000013F624000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jmznHmq.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\tJUsaIU.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\CHglcEi.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\cUmVwvZ.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\whwSjwA.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\QhrthnB.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\nzaNQJT.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\RVDRBmy.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\ziQfueb.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\aSwbFvi.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\rkXxyPa.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\IWCEpeF.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\UzgPlit.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\xFOAaRM.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\AWhMIqf.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\ofVsHNY.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\jeQFJyN.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\dViBuNn.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\FKkTVnu.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\ZGxzSGP.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\HCQNVPN.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\XZILClu.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\IoKsjjU.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\oOUFYQb.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\kgThkAw.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\diuHNQL.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\LiKDqiu.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\ZNaYyGj.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\NGZVoJo.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\RDGebjw.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\DsUggLz.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\uSKUKxb.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\jhOkenY.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\oXUBOtJ.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\dANtiYD.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\rTelwHp.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\OJohtSc.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\oszIbgc.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\jiHaXrD.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\BuCnvaB.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\ZZfBZcn.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\bwlZJhB.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\xVbqgLd.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\naRbOTi.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\GwzVZuT.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\WuwXaJe.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\JYDEzYx.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\KlTzoSL.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\EQvtrUN.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\BzQSagC.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\pzfARNc.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\OkSFidT.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\UlFvZgc.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\xnccNwn.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\cOFIvOo.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\CPVpPKl.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\MoEeYzS.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\XAERsFb.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\dVWUfua.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\TEFDPKl.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\HhABqzf.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\tJwdRHD.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\kygsAHN.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
File created	C:\Windows\System\WIwsVTx.exe	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2564	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	29
PID 3000 wrote to memory of 2564	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	29
PID 3000 wrote to memory of 2564	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	29
PID 3000 wrote to memory of 2476	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	30
PID 3000 wrote to memory of 2476	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	30
PID 3000 wrote to memory of 2476	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	30
PID 3000 wrote to memory of 2524	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	31
PID 3000 wrote to memory of 2524	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	31
PID 3000 wrote to memory of 2524	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	31
PID 3000 wrote to memory of 2528	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	32
PID 3000 wrote to memory of 2528	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	32
PID 3000 wrote to memory of 2528	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	32
PID 3000 wrote to memory of 2592	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	33
PID 3000 wrote to memory of 2592	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	33
PID 3000 wrote to memory of 2592	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	33
PID 3000 wrote to memory of 2536	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	34
PID 3000 wrote to memory of 2536	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	34
PID 3000 wrote to memory of 2536	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	34
PID 3000 wrote to memory of 2392	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	35
PID 3000 wrote to memory of 2392	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	35
PID 3000 wrote to memory of 2392	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	35
PID 3000 wrote to memory of 2496	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	36
PID 3000 wrote to memory of 2496	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	36
PID 3000 wrote to memory of 2496	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	36
PID 3000 wrote to memory of 2752	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	37
PID 3000 wrote to memory of 2752	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	37
PID 3000 wrote to memory of 2752	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	37
PID 3000 wrote to memory of 2432	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	38
PID 3000 wrote to memory of 2432	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	38
PID 3000 wrote to memory of 2432	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	38
PID 3000 wrote to memory of 2552	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	39
PID 3000 wrote to memory of 2552	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	39
PID 3000 wrote to memory of 2552	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	39
PID 3000 wrote to memory of 2448	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	40
PID 3000 wrote to memory of 2448	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	40
PID 3000 wrote to memory of 2448	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	40
PID 3000 wrote to memory of 2880	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	41
PID 3000 wrote to memory of 2880	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	41
PID 3000 wrote to memory of 2880	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	41
PID 3000 wrote to memory of 2892	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	42
PID 3000 wrote to memory of 2892	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	42
PID 3000 wrote to memory of 2892	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	42
PID 3000 wrote to memory of 2012	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	43
PID 3000 wrote to memory of 2012	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	43
PID 3000 wrote to memory of 2012	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	43
PID 3000 wrote to memory of 2560	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	44
PID 3000 wrote to memory of 2560	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	44
PID 3000 wrote to memory of 2560	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	44
PID 3000 wrote to memory of 2716	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	45
PID 3000 wrote to memory of 2716	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	45
PID 3000 wrote to memory of 2716	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	45
PID 3000 wrote to memory of 840	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	46
PID 3000 wrote to memory of 840	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	46
PID 3000 wrote to memory of 840	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	46
PID 3000 wrote to memory of 2196	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	47
PID 3000 wrote to memory of 2196	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	47
PID 3000 wrote to memory of 2196	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	47
PID 3000 wrote to memory of 2300	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	48
PID 3000 wrote to memory of 2300	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	48
PID 3000 wrote to memory of 2300	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	48
PID 3000 wrote to memory of 2016	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	49
PID 3000 wrote to memory of 2016	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	49
PID 3000 wrote to memory of 2016	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	49
PID 3000 wrote to memory of 2164	3000	7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7aaa5ac20f238a6214e56308e4439940_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\System\tYiwVNt.exe
  C:\Windows\System\tYiwVNt.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\EiGfLsB.exe
  C:\Windows\System\EiGfLsB.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\XxjXuYA.exe
  C:\Windows\System\XxjXuYA.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\jGPqwJJ.exe
  C:\Windows\System\jGPqwJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\BYzkbin.exe
  C:\Windows\System\BYzkbin.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\OrnJmRf.exe
  C:\Windows\System\OrnJmRf.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\pAhzYVc.exe
  C:\Windows\System\pAhzYVc.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\LddgjmP.exe
  C:\Windows\System\LddgjmP.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\WHOaQTE.exe
  C:\Windows\System\WHOaQTE.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\xSDzbrP.exe
  C:\Windows\System\xSDzbrP.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\NXUeqXm.exe
  C:\Windows\System\NXUeqXm.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\nXBUvTr.exe
  C:\Windows\System\nXBUvTr.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\dnGdndf.exe
  C:\Windows\System\dnGdndf.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\jACEbLG.exe
  C:\Windows\System\jACEbLG.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\nCbITGC.exe
  C:\Windows\System\nCbITGC.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\BGHkJDD.exe
  C:\Windows\System\BGHkJDD.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\haoPzzI.exe
  C:\Windows\System\haoPzzI.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\NyIZWKO.exe
  C:\Windows\System\NyIZWKO.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\SRUPyTd.exe
  C:\Windows\System\SRUPyTd.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\XmeXewg.exe
  C:\Windows\System\XmeXewg.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\pDVjhgO.exe
  C:\Windows\System\pDVjhgO.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\irXXdMW.exe
  C:\Windows\System\irXXdMW.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\tjDshJK.exe
  C:\Windows\System\tjDshJK.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\apMndpp.exe
  C:\Windows\System\apMndpp.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\efyOsbl.exe
  C:\Windows\System\efyOsbl.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\vQOTDFy.exe
  C:\Windows\System\vQOTDFy.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\dvjyPwA.exe
  C:\Windows\System\dvjyPwA.exe
  2⤵
  - Executes dropped EXE
  PID:480
- C:\Windows\System\ptUCHST.exe
  C:\Windows\System\ptUCHST.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\HZalzhP.exe
  C:\Windows\System\HZalzhP.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\fEFXMHP.exe
  C:\Windows\System\fEFXMHP.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\fszzsFx.exe
  C:\Windows\System\fszzsFx.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\ViIngcq.exe
  C:\Windows\System\ViIngcq.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\iLlJjGl.exe
  C:\Windows\System\iLlJjGl.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\wYnBuCT.exe
  C:\Windows\System\wYnBuCT.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\aUVMMre.exe
  C:\Windows\System\aUVMMre.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\ijXhxIv.exe
  C:\Windows\System\ijXhxIv.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\BJYQWBb.exe
  C:\Windows\System\BJYQWBb.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\LxeSuAq.exe
  C:\Windows\System\LxeSuAq.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\gmfvVzc.exe
  C:\Windows\System\gmfvVzc.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\ZTtblha.exe
  C:\Windows\System\ZTtblha.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\VvUymxG.exe
  C:\Windows\System\VvUymxG.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\BNlaYJc.exe
  C:\Windows\System\BNlaYJc.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\jXQJUEs.exe
  C:\Windows\System\jXQJUEs.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\DsUggLz.exe
  C:\Windows\System\DsUggLz.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\blDXhQg.exe
  C:\Windows\System\blDXhQg.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\hteXcFp.exe
  C:\Windows\System\hteXcFp.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\vYRyfLN.exe
  C:\Windows\System\vYRyfLN.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\jmznHmq.exe
  C:\Windows\System\jmznHmq.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\ksHixjT.exe
  C:\Windows\System\ksHixjT.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\hzkNnQK.exe
  C:\Windows\System\hzkNnQK.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\mFJuCaf.exe
  C:\Windows\System\mFJuCaf.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\SbyltfW.exe
  C:\Windows\System\SbyltfW.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\hJcMBgL.exe
  C:\Windows\System\hJcMBgL.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\KMWbeDn.exe
  C:\Windows\System\KMWbeDn.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\sowxCNF.exe
  C:\Windows\System\sowxCNF.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\wjLXUXC.exe
  C:\Windows\System\wjLXUXC.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\XKohFFX.exe
  C:\Windows\System\XKohFFX.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\Dnpokin.exe
  C:\Windows\System\Dnpokin.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\znHmZpi.exe
  C:\Windows\System\znHmZpi.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\qaRRKxN.exe
  C:\Windows\System\qaRRKxN.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\JGmczTy.exe
  C:\Windows\System\JGmczTy.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\FORvuPu.exe
  C:\Windows\System\FORvuPu.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\JpfXkRn.exe
  C:\Windows\System\JpfXkRn.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\TTFMgEW.exe
  C:\Windows\System\TTFMgEW.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\JZIfRLv.exe
  C:\Windows\System\JZIfRLv.exe
  2⤵
  PID:2416
- C:\Windows\System\FZSvWZe.exe
  C:\Windows\System\FZSvWZe.exe
  2⤵
  PID:2008
- C:\Windows\System\WuwXaJe.exe
  C:\Windows\System\WuwXaJe.exe
  2⤵
  PID:2744
- C:\Windows\System\pDXKYXT.exe
  C:\Windows\System\pDXKYXT.exe
  2⤵
  PID:2920
- C:\Windows\System\OwOhwXd.exe
  C:\Windows\System\OwOhwXd.exe
  2⤵
  PID:1612
- C:\Windows\System\fOBascq.exe
  C:\Windows\System\fOBascq.exe
  2⤵
  PID:2160
- C:\Windows\System\pDXgSvx.exe
  C:\Windows\System\pDXgSvx.exe
  2⤵
  PID:1760
- C:\Windows\System\CzGCMSz.exe
  C:\Windows\System\CzGCMSz.exe
  2⤵
  PID:1248
- C:\Windows\System\YCFZDgS.exe
  C:\Windows\System\YCFZDgS.exe
  2⤵
  PID:576
- C:\Windows\System\FgvmmDn.exe
  C:\Windows\System\FgvmmDn.exe
  2⤵
  PID:1316
- C:\Windows\System\jFYWxwW.exe
  C:\Windows\System\jFYWxwW.exe
  2⤵
  PID:1628
- C:\Windows\System\egNKOWQ.exe
  C:\Windows\System\egNKOWQ.exe
  2⤵
  PID:3068
- C:\Windows\System\TvTxXuO.exe
  C:\Windows\System\TvTxXuO.exe
  2⤵
  PID:1132
- C:\Windows\System\cBDsnEz.exe
  C:\Windows\System\cBDsnEz.exe
  2⤵
  PID:1152
- C:\Windows\System\XyfIGFp.exe
  C:\Windows\System\XyfIGFp.exe
  2⤵
  PID:1736
- C:\Windows\System\AbdZnpG.exe
  C:\Windows\System\AbdZnpG.exe
  2⤵
  PID:1904
- C:\Windows\System\RuDFKFS.exe
  C:\Windows\System\RuDFKFS.exe
  2⤵
  PID:1712
- C:\Windows\System\kNXROwo.exe
  C:\Windows\System\kNXROwo.exe
  2⤵
  PID:932
- C:\Windows\System\aNJhszG.exe
  C:\Windows\System\aNJhszG.exe
  2⤵
  PID:748
- C:\Windows\System\mRFoXIn.exe
  C:\Windows\System\mRFoXIn.exe
  2⤵
  PID:328
- C:\Windows\System\rvCmbRx.exe
  C:\Windows\System\rvCmbRx.exe
  2⤵
  PID:2192
- C:\Windows\System\DyNziLM.exe
  C:\Windows\System\DyNziLM.exe
  2⤵
  PID:3052
- C:\Windows\System\OkSFidT.exe
  C:\Windows\System\OkSFidT.exe
  2⤵
  PID:3044
- C:\Windows\System\HXQBvKa.exe
  C:\Windows\System\HXQBvKa.exe
  2⤵
  PID:1460
- C:\Windows\System\VnhdiJP.exe
  C:\Windows\System\VnhdiJP.exe
  2⤵
  PID:1784
- C:\Windows\System\zHayUaM.exe
  C:\Windows\System\zHayUaM.exe
  2⤵
  PID:1560
- C:\Windows\System\jjWXcPa.exe
  C:\Windows\System\jjWXcPa.exe
  2⤵
  PID:2504
- C:\Windows\System\QTlkVxQ.exe
  C:\Windows\System\QTlkVxQ.exe
  2⤵
  PID:2512
- C:\Windows\System\nxFVFyr.exe
  C:\Windows\System\nxFVFyr.exe
  2⤵
  PID:2676
- C:\Windows\System\JGjzohw.exe
  C:\Windows\System\JGjzohw.exe
  2⤵
  PID:2956
- C:\Windows\System\OgHSpwf.exe
  C:\Windows\System\OgHSpwf.exe
  2⤵
  PID:2404
- C:\Windows\System\OODSXaR.exe
  C:\Windows\System\OODSXaR.exe
  2⤵
  PID:2436
- C:\Windows\System\oOPoSrj.exe
  C:\Windows\System\oOPoSrj.exe
  2⤵
  PID:860
- C:\Windows\System\YFTnhjl.exe
  C:\Windows\System\YFTnhjl.exe
  2⤵
  PID:2772
- C:\Windows\System\wURtLTh.exe
  C:\Windows\System\wURtLTh.exe
  2⤵
  PID:112
- C:\Windows\System\mleVohB.exe
  C:\Windows\System\mleVohB.exe
  2⤵
  PID:604
- C:\Windows\System\LuxIOUj.exe
  C:\Windows\System\LuxIOUj.exe
  2⤵
  PID:1896
- C:\Windows\System\OyKrLug.exe
  C:\Windows\System\OyKrLug.exe
  2⤵
  PID:1228
- C:\Windows\System\guxyPqf.exe
  C:\Windows\System\guxyPqf.exe
  2⤵
  PID:1112
- C:\Windows\System\acSrNNm.exe
  C:\Windows\System\acSrNNm.exe
  2⤵
  PID:1304
- C:\Windows\System\XKfUnDJ.exe
  C:\Windows\System\XKfUnDJ.exe
  2⤵
  PID:2924
- C:\Windows\System\qTLcuar.exe
  C:\Windows\System\qTLcuar.exe
  2⤵
  PID:2928
- C:\Windows\System\ipgtJzH.exe
  C:\Windows\System\ipgtJzH.exe
  2⤵
  PID:1160
- C:\Windows\System\uBJYESG.exe
  C:\Windows\System\uBJYESG.exe
  2⤵
  PID:556
- C:\Windows\System\gckhasY.exe
  C:\Windows\System\gckhasY.exe
  2⤵
  PID:1528
- C:\Windows\System\fafdtvM.exe
  C:\Windows\System\fafdtvM.exe
  2⤵
  PID:2940
- C:\Windows\System\YafmgZU.exe
  C:\Windows\System\YafmgZU.exe
  2⤵
  PID:1268
- C:\Windows\System\PsimQyE.exe
  C:\Windows\System\PsimQyE.exe
  2⤵
  PID:2172
- C:\Windows\System\DiYBOAw.exe
  C:\Windows\System\DiYBOAw.exe
  2⤵
  PID:2396
- C:\Windows\System\MwTWXFF.exe
  C:\Windows\System\MwTWXFF.exe
  2⤵
  PID:2428
- C:\Windows\System\dXyBslM.exe
  C:\Windows\System\dXyBslM.exe
  2⤵
  PID:1668
- C:\Windows\System\HUUvcWo.exe
  C:\Windows\System\HUUvcWo.exe
  2⤵
  PID:684
- C:\Windows\System\opaHJvQ.exe
  C:\Windows\System\opaHJvQ.exe
  2⤵
  PID:2364
- C:\Windows\System\pluPmRZ.exe
  C:\Windows\System\pluPmRZ.exe
  2⤵
  PID:2808
- C:\Windows\System\sgkEERU.exe
  C:\Windows\System\sgkEERU.exe
  2⤵
  PID:852
- C:\Windows\System\wgGmZUz.exe
  C:\Windows\System\wgGmZUz.exe
  2⤵
  PID:2788
- C:\Windows\System\KmlfBcf.exe
  C:\Windows\System\KmlfBcf.exe
  2⤵
  PID:624
- C:\Windows\System\cKiKPOY.exe
  C:\Windows\System\cKiKPOY.exe
  2⤵
  PID:1096
- C:\Windows\System\tDDrkaP.exe
  C:\Windows\System\tDDrkaP.exe
  2⤵
  PID:1520
- C:\Windows\System\SMyhCKj.exe
  C:\Windows\System\SMyhCKj.exe
  2⤵
  PID:2484
- C:\Windows\System\hZZddUD.exe
  C:\Windows\System\hZZddUD.exe
  2⤵
  PID:1284
- C:\Windows\System\EwLpqSA.exe
  C:\Windows\System\EwLpqSA.exe
  2⤵
  PID:1652
- C:\Windows\System\CDCaUbE.exe
  C:\Windows\System\CDCaUbE.exe
  2⤵
  PID:2680
- C:\Windows\System\BcyGsgg.exe
  C:\Windows\System\BcyGsgg.exe
  2⤵
  PID:948
- C:\Windows\System\uFAywnp.exe
  C:\Windows\System\uFAywnp.exe
  2⤵
  PID:3084
- C:\Windows\System\khOeZBI.exe
  C:\Windows\System\khOeZBI.exe
  2⤵
  PID:3104
- C:\Windows\System\nJASlqh.exe
  C:\Windows\System\nJASlqh.exe
  2⤵
  PID:3124
- C:\Windows\System\KrlSaOt.exe
  C:\Windows\System\KrlSaOt.exe
  2⤵
  PID:3140
- C:\Windows\System\laRBnrU.exe
  C:\Windows\System\laRBnrU.exe
  2⤵
  PID:3156
- C:\Windows\System\EhnTMcM.exe
  C:\Windows\System\EhnTMcM.exe
  2⤵
  PID:3176
- C:\Windows\System\BKeGBXK.exe
  C:\Windows\System\BKeGBXK.exe
  2⤵
  PID:3196
- C:\Windows\System\ObqvZKD.exe
  C:\Windows\System\ObqvZKD.exe
  2⤵
  PID:3216
- C:\Windows\System\DhpZFyf.exe
  C:\Windows\System\DhpZFyf.exe
  2⤵
  PID:3236
- C:\Windows\System\XLtjKDg.exe
  C:\Windows\System\XLtjKDg.exe
  2⤵
  PID:3252
- C:\Windows\System\WwKqoRT.exe
  C:\Windows\System\WwKqoRT.exe
  2⤵
  PID:3272
- C:\Windows\System\xFOAaRM.exe
  C:\Windows\System\xFOAaRM.exe
  2⤵
  PID:3292
- C:\Windows\System\boTDASa.exe
  C:\Windows\System\boTDASa.exe
  2⤵
  PID:3308
- C:\Windows\System\OGYouiQ.exe
  C:\Windows\System\OGYouiQ.exe
  2⤵
  PID:3324
- C:\Windows\System\qGscCWe.exe
  C:\Windows\System\qGscCWe.exe
  2⤵
  PID:3376
- C:\Windows\System\VhWoWEf.exe
  C:\Windows\System\VhWoWEf.exe
  2⤵
  PID:3392
- C:\Windows\System\aKfMrRm.exe
  C:\Windows\System\aKfMrRm.exe
  2⤵
  PID:3416
- C:\Windows\System\mJeYqpo.exe
  C:\Windows\System\mJeYqpo.exe
  2⤵
  PID:3436
- C:\Windows\System\XeaOGSd.exe
  C:\Windows\System\XeaOGSd.exe
  2⤵
  PID:3456
- C:\Windows\System\CMtShaB.exe
  C:\Windows\System\CMtShaB.exe
  2⤵
  PID:3472
- C:\Windows\System\DIacdmc.exe
  C:\Windows\System\DIacdmc.exe
  2⤵
  PID:3496
- C:\Windows\System\gNMjlYx.exe
  C:\Windows\System\gNMjlYx.exe
  2⤵
  PID:3512
- C:\Windows\System\ngiHRmb.exe
  C:\Windows\System\ngiHRmb.exe
  2⤵
  PID:3536
- C:\Windows\System\CsnmMes.exe
  C:\Windows\System\CsnmMes.exe
  2⤵
  PID:3552
- C:\Windows\System\VHypjVb.exe
  C:\Windows\System\VHypjVb.exe
  2⤵
  PID:3572
- C:\Windows\System\dTYotAj.exe
  C:\Windows\System\dTYotAj.exe
  2⤵
  PID:3592
- C:\Windows\System\mTAfxyt.exe
  C:\Windows\System\mTAfxyt.exe
  2⤵
  PID:3612
- C:\Windows\System\gZcSRPY.exe
  C:\Windows\System\gZcSRPY.exe
  2⤵
  PID:3636
- C:\Windows\System\mbwzGPo.exe
  C:\Windows\System\mbwzGPo.exe
  2⤵
  PID:3656
- C:\Windows\System\gIOQyxd.exe
  C:\Windows\System\gIOQyxd.exe
  2⤵
  PID:3672
- C:\Windows\System\CYMFkWc.exe
  C:\Windows\System\CYMFkWc.exe
  2⤵
  PID:3692
- C:\Windows\System\sIKcVle.exe
  C:\Windows\System\sIKcVle.exe
  2⤵
  PID:3712
- C:\Windows\System\TEFDPKl.exe
  C:\Windows\System\TEFDPKl.exe
  2⤵
  PID:3736
- C:\Windows\System\CkCDITs.exe
  C:\Windows\System\CkCDITs.exe
  2⤵
  PID:3752
- C:\Windows\System\whwSjwA.exe
  C:\Windows\System\whwSjwA.exe
  2⤵
  PID:3776
- C:\Windows\System\SArSJjS.exe
  C:\Windows\System\SArSJjS.exe
  2⤵
  PID:3792
- C:\Windows\System\DxFHSyF.exe
  C:\Windows\System\DxFHSyF.exe
  2⤵
  PID:3812
- C:\Windows\System\sHctDxu.exe
  C:\Windows\System\sHctDxu.exe
  2⤵
  PID:3828
- C:\Windows\System\IVhuMiy.exe
  C:\Windows\System\IVhuMiy.exe
  2⤵
  PID:3844
- C:\Windows\System\ynuZigv.exe
  C:\Windows\System\ynuZigv.exe
  2⤵
  PID:3864
- C:\Windows\System\epLmhqk.exe
  C:\Windows\System\epLmhqk.exe
  2⤵
  PID:3880
- C:\Windows\System\mnfJjQi.exe
  C:\Windows\System\mnfJjQi.exe
  2⤵
  PID:3896
- C:\Windows\System\ztgkSCS.exe
  C:\Windows\System\ztgkSCS.exe
  2⤵
  PID:3920
- C:\Windows\System\BWCJdXj.exe
  C:\Windows\System\BWCJdXj.exe
  2⤵
  PID:3936
- C:\Windows\System\MUbISIc.exe
  C:\Windows\System\MUbISIc.exe
  2⤵
  PID:3952
- C:\Windows\System\JuCPBGa.exe
  C:\Windows\System\JuCPBGa.exe
  2⤵
  PID:3968
- C:\Windows\System\CgeeUNJ.exe
  C:\Windows\System\CgeeUNJ.exe
  2⤵
  PID:3984
- C:\Windows\System\tPIVkan.exe
  C:\Windows\System\tPIVkan.exe
  2⤵
  PID:4000
- C:\Windows\System\OQDPuPM.exe
  C:\Windows\System\OQDPuPM.exe
  2⤵
  PID:4016
- C:\Windows\System\IrQujSR.exe
  C:\Windows\System\IrQujSR.exe
  2⤵
  PID:4032
- C:\Windows\System\yzqXGcz.exe
  C:\Windows\System\yzqXGcz.exe
  2⤵
  PID:4048
- C:\Windows\System\BsqVGbW.exe
  C:\Windows\System\BsqVGbW.exe
  2⤵
  PID:4064
- C:\Windows\System\RoshBBp.exe
  C:\Windows\System\RoshBBp.exe
  2⤵
  PID:4080
- C:\Windows\System\IdUoAtN.exe
  C:\Windows\System\IdUoAtN.exe
  2⤵
  PID:288
- C:\Windows\System\lMNkoPi.exe
  C:\Windows\System\lMNkoPi.exe
  2⤵
  PID:1888
- C:\Windows\System\ufNULcO.exe
  C:\Windows\System\ufNULcO.exe
  2⤵
  PID:776
- C:\Windows\System\mlqdflJ.exe
  C:\Windows\System\mlqdflJ.exe
  2⤵
  PID:2184
- C:\Windows\System\GjCATFh.exe
  C:\Windows\System\GjCATFh.exe
  2⤵
  PID:3300
- C:\Windows\System\dcHyHLp.exe
  C:\Windows\System\dcHyHLp.exe
  2⤵
  PID:3348
- C:\Windows\System\qFdqjco.exe
  C:\Windows\System\qFdqjco.exe
  2⤵
  PID:2056
- C:\Windows\System\HyHpiNV.exe
  C:\Windows\System\HyHpiNV.exe
  2⤵
  PID:2648
- C:\Windows\System\mVfEpqa.exe
  C:\Windows\System\mVfEpqa.exe
  2⤵
  PID:2820
- C:\Windows\System\swtaqzx.exe
  C:\Windows\System\swtaqzx.exe
  2⤵
  PID:3096
- C:\Windows\System\lOCDpUE.exe
  C:\Windows\System\lOCDpUE.exe
  2⤵
  PID:3136
- C:\Windows\System\HtBCEEq.exe
  C:\Windows\System\HtBCEEq.exe
  2⤵
  PID:3208
- C:\Windows\System\RCFfwBw.exe
  C:\Windows\System\RCFfwBw.exe
  2⤵
  PID:3280
- C:\Windows\System\LZbsweJ.exe
  C:\Windows\System\LZbsweJ.exe
  2⤵
  PID:2660
- C:\Windows\System\UvwDuXl.exe
  C:\Windows\System\UvwDuXl.exe
  2⤵
  PID:3404
- C:\Windows\System\auuvVjl.exe
  C:\Windows\System\auuvVjl.exe
  2⤵
  PID:3408
- C:\Windows\System\dcPYHSK.exe
  C:\Windows\System\dcPYHSK.exe
  2⤵
  PID:3484
- C:\Windows\System\lVKcfUO.exe
  C:\Windows\System\lVKcfUO.exe
  2⤵
  PID:3432
- C:\Windows\System\JclTxll.exe
  C:\Windows\System\JclTxll.exe
  2⤵
  PID:2624
- C:\Windows\System\xopBkzT.exe
  C:\Windows\System\xopBkzT.exe
  2⤵
  PID:3468
- C:\Windows\System\PHXfhuy.exe
  C:\Windows\System\PHXfhuy.exe
  2⤵
  PID:2684
- C:\Windows\System\ENErPmF.exe
  C:\Windows\System\ENErPmF.exe
  2⤵
  PID:3544
- C:\Windows\System\AVQzxTf.exe
  C:\Windows\System\AVQzxTf.exe
  2⤵
  PID:3644
- C:\Windows\System\qYuEVCv.exe
  C:\Windows\System\qYuEVCv.exe
  2⤵
  PID:3648
- C:\Windows\System\kODFWSH.exe
  C:\Windows\System\kODFWSH.exe
  2⤵
  PID:3720
- C:\Windows\System\yyuoNtQ.exe
  C:\Windows\System\yyuoNtQ.exe
  2⤵
  PID:3768
- C:\Windows\System\IBipIiV.exe
  C:\Windows\System\IBipIiV.exe
  2⤵
  PID:3808
- C:\Windows\System\zmYruLe.exe
  C:\Windows\System\zmYruLe.exe
  2⤵
  PID:3700
- C:\Windows\System\GzzJKeZ.exe
  C:\Windows\System\GzzJKeZ.exe
  2⤵
  PID:3904
- C:\Windows\System\jxWZdRU.exe
  C:\Windows\System\jxWZdRU.exe
  2⤵
  PID:3788
- C:\Windows\System\uSKUKxb.exe
  C:\Windows\System\uSKUKxb.exe
  2⤵
  PID:3888
- C:\Windows\System\ijlVTaM.exe
  C:\Windows\System\ijlVTaM.exe
  2⤵
  PID:2900
- C:\Windows\System\JvJcKyR.exe
  C:\Windows\System\JvJcKyR.exe
  2⤵
  PID:3944
- C:\Windows\System\kojZmdr.exe
  C:\Windows\System\kojZmdr.exe
  2⤵
  PID:3976
- C:\Windows\System\oRlpyOD.exe
  C:\Windows\System\oRlpyOD.exe
  2⤵
  PID:3992
- C:\Windows\System\duYWqnX.exe
  C:\Windows\System\duYWqnX.exe
  2⤵
  PID:4012
- C:\Windows\System\dhSJLpv.exe
  C:\Windows\System\dhSJLpv.exe
  2⤵
  PID:4040
- C:\Windows\System\LGttqBm.exe
  C:\Windows\System\LGttqBm.exe
  2⤵
  PID:4056
- C:\Windows\System\UCrFzdr.exe
  C:\Windows\System\UCrFzdr.exe
  2⤵
  PID:4092
- C:\Windows\System\rmOUoMX.exe
  C:\Windows\System\rmOUoMX.exe
  2⤵
  PID:2764
- C:\Windows\System\TFKtCSA.exe
  C:\Windows\System\TFKtCSA.exe
  2⤵
  PID:1768
- C:\Windows\System\FPattZn.exe
  C:\Windows\System\FPattZn.exe
  2⤵
  PID:1752
- C:\Windows\System\trIEUfg.exe
  C:\Windows\System\trIEUfg.exe
  2⤵
  PID:3036
- C:\Windows\System\mascrWR.exe
  C:\Windows\System\mascrWR.exe
  2⤵
  PID:3152
- C:\Windows\System\qcVCLrs.exe
  C:\Windows\System\qcVCLrs.exe
  2⤵
  PID:544
- C:\Windows\System\nVrVSIJ.exe
  C:\Windows\System\nVrVSIJ.exe
  2⤵
  PID:3112
- C:\Windows\System\FKkTVnu.exe
  C:\Windows\System\FKkTVnu.exe
  2⤵
  PID:3264
- C:\Windows\System\tJUsaIU.exe
  C:\Windows\System\tJUsaIU.exe
  2⤵
  PID:3224
- C:\Windows\System\QEeTYiX.exe
  C:\Windows\System\QEeTYiX.exe
  2⤵
  PID:3340
- C:\Windows\System\IvivbFX.exe
  C:\Windows\System\IvivbFX.exe
  2⤵
  PID:3344
- C:\Windows\System\IPlWDbt.exe
  C:\Windows\System\IPlWDbt.exe
  2⤵
  PID:1864
- C:\Windows\System\pLQgCTu.exe
  C:\Windows\System\pLQgCTu.exe
  2⤵
  PID:2180
- C:\Windows\System\jciQMtq.exe
  C:\Windows\System\jciQMtq.exe
  2⤵
  PID:2932
- C:\Windows\System\GfkpXVv.exe
  C:\Windows\System\GfkpXVv.exe
  2⤵
  PID:2188
- C:\Windows\System\AGZidZM.exe
  C:\Windows\System\AGZidZM.exe
  2⤵
  PID:2584
- C:\Windows\System\JWSTTQm.exe
  C:\Windows\System\JWSTTQm.exe
  2⤵
  PID:3168
- C:\Windows\System\aqtjOfr.exe
  C:\Windows\System\aqtjOfr.exe
  2⤵
  PID:964
- C:\Windows\System\fFTjxSW.exe
  C:\Windows\System\fFTjxSW.exe
  2⤵
  PID:3372
- C:\Windows\System\RPOiNeE.exe
  C:\Windows\System\RPOiNeE.exe
  2⤵
  PID:1064
- C:\Windows\System\ZmGbAfQ.exe
  C:\Windows\System\ZmGbAfQ.exe
  2⤵
  PID:2604
- C:\Windows\System\bYlcTXm.exe
  C:\Windows\System\bYlcTXm.exe
  2⤵
  PID:1596
- C:\Windows\System\VZhUdPH.exe
  C:\Windows\System\VZhUdPH.exe
  2⤵
  PID:1860
- C:\Windows\System\rQGfqlz.exe
  C:\Windows\System\rQGfqlz.exe
  2⤵
  PID:1996
- C:\Windows\System\hcRdNDB.exe
  C:\Windows\System\hcRdNDB.exe
  2⤵
  PID:2692
- C:\Windows\System\vejJIyh.exe
  C:\Windows\System\vejJIyh.exe
  2⤵
  PID:3532
- C:\Windows\System\qfmhyrT.exe
  C:\Windows\System\qfmhyrT.exe
  2⤵
  PID:3464
- C:\Windows\System\zDbpxUh.exe
  C:\Windows\System\zDbpxUh.exe
  2⤵
  PID:3608
- C:\Windows\System\WBFwLnS.exe
  C:\Windows\System\WBFwLnS.exe
  2⤵
  PID:3620
- C:\Windows\System\HOCkewY.exe
  C:\Windows\System\HOCkewY.exe
  2⤵
  PID:3624
- C:\Windows\System\gLmYeUY.exe
  C:\Windows\System\gLmYeUY.exe
  2⤵
  PID:3732
- C:\Windows\System\ibBsKPl.exe
  C:\Windows\System\ibBsKPl.exe
  2⤵
  PID:3836
- C:\Windows\System\TARnktL.exe
  C:\Windows\System\TARnktL.exe
  2⤵
  PID:3872
- C:\Windows\System\NGTbqsD.exe
  C:\Windows\System\NGTbqsD.exe
  2⤵
  PID:3748
- C:\Windows\System\WJiGydM.exe
  C:\Windows\System\WJiGydM.exe
  2⤵
  PID:3824
- C:\Windows\System\qOqTZgk.exe
  C:\Windows\System\qOqTZgk.exe
  2⤵
  PID:3932
- C:\Windows\System\sNnvbzy.exe
  C:\Windows\System\sNnvbzy.exe
  2⤵
  PID:2516
- C:\Windows\System\xWWHfRc.exe
  C:\Windows\System\xWWHfRc.exe
  2⤵
  PID:1684
- C:\Windows\System\sXpIIhW.exe
  C:\Windows\System\sXpIIhW.exe
  2⤵
  PID:2020
- C:\Windows\System\WfgdMOJ.exe
  C:\Windows\System\WfgdMOJ.exe
  2⤵
  PID:2124
- C:\Windows\System\hvzvrfm.exe
  C:\Windows\System\hvzvrfm.exe
  2⤵
  PID:2388
- C:\Windows\System\OOEPPae.exe
  C:\Windows\System\OOEPPae.exe
  2⤵
  PID:1816
- C:\Windows\System\xULPPAB.exe
  C:\Windows\System\xULPPAB.exe
  2⤵
  PID:1564
- C:\Windows\System\eXEpisk.exe
  C:\Windows\System\eXEpisk.exe
  2⤵
  PID:3132
- C:\Windows\System\cqzqycD.exe
  C:\Windows\System\cqzqycD.exe
  2⤵
  PID:3444
- C:\Windows\System\qtYWZNF.exe
  C:\Windows\System\qtYWZNF.exe
  2⤵
  PID:2220
- C:\Windows\System\AYMkTjU.exe
  C:\Windows\System\AYMkTjU.exe
  2⤵
  PID:3428
- C:\Windows\System\rRwPiWi.exe
  C:\Windows\System\rRwPiWi.exe
  2⤵
  PID:3632
- C:\Windows\System\OQQUGRZ.exe
  C:\Windows\System\OQQUGRZ.exe
  2⤵
  PID:3860
- C:\Windows\System\RuDXBAm.exe
  C:\Windows\System\RuDXBAm.exe
  2⤵
  PID:2408
- C:\Windows\System\SpRxKJo.exe
  C:\Windows\System\SpRxKJo.exe
  2⤵
  PID:1504
- C:\Windows\System\JeFSjzc.exe
  C:\Windows\System\JeFSjzc.exe
  2⤵
  PID:240
- C:\Windows\System\cuCLXSF.exe
  C:\Windows\System\cuCLXSF.exe
  2⤵
  PID:1208
- C:\Windows\System\ErARHGK.exe
  C:\Windows\System\ErARHGK.exe
  2⤵
  PID:1688
- C:\Windows\System\pSdnvAt.exe
  C:\Windows\System\pSdnvAt.exe
  2⤵
  PID:4100
- C:\Windows\System\xcwflSf.exe
  C:\Windows\System\xcwflSf.exe
  2⤵
  PID:4116
- C:\Windows\System\TcAIdVq.exe
  C:\Windows\System\TcAIdVq.exe
  2⤵
  PID:4132
- C:\Windows\System\qtytdPJ.exe
  C:\Windows\System\qtytdPJ.exe
  2⤵
  PID:4208
- C:\Windows\System\RLygpCC.exe
  C:\Windows\System\RLygpCC.exe
  2⤵
  PID:4232
- C:\Windows\System\rRWjAKP.exe
  C:\Windows\System\rRWjAKP.exe
  2⤵
  PID:4248
- C:\Windows\System\gtDLDye.exe
  C:\Windows\System\gtDLDye.exe
  2⤵
  PID:4264
- C:\Windows\System\jRikMmY.exe
  C:\Windows\System\jRikMmY.exe
  2⤵
  PID:4280
- C:\Windows\System\nCmCEXT.exe
  C:\Windows\System\nCmCEXT.exe
  2⤵
  PID:4296
- C:\Windows\System\hXERLeW.exe
  C:\Windows\System\hXERLeW.exe
  2⤵
  PID:4312
- C:\Windows\System\yzjnusO.exe
  C:\Windows\System\yzjnusO.exe
  2⤵
  PID:4328
- C:\Windows\System\OWXvgtq.exe
  C:\Windows\System\OWXvgtq.exe
  2⤵
  PID:4344
- C:\Windows\System\pCRtRlO.exe
  C:\Windows\System\pCRtRlO.exe
  2⤵
  PID:4360
- C:\Windows\System\MgMrCgj.exe
  C:\Windows\System\MgMrCgj.exe
  2⤵
  PID:4488
- C:\Windows\System\dLVNIbh.exe
  C:\Windows\System\dLVNIbh.exe
  2⤵
  PID:4512
- C:\Windows\System\BuCnvaB.exe
  C:\Windows\System\BuCnvaB.exe
  2⤵
  PID:4532
- C:\Windows\System\fisCSrX.exe
  C:\Windows\System\fisCSrX.exe
  2⤵
  PID:4548
- C:\Windows\System\tEmteAq.exe
  C:\Windows\System\tEmteAq.exe
  2⤵
  PID:4564
- C:\Windows\System\ZvCwPJL.exe
  C:\Windows\System\ZvCwPJL.exe
  2⤵
  PID:4580
- C:\Windows\System\fDWRwpP.exe
  C:\Windows\System\fDWRwpP.exe
  2⤵
  PID:4620
- C:\Windows\System\MSrsrRU.exe
  C:\Windows\System\MSrsrRU.exe
  2⤵
  PID:4636
- C:\Windows\System\khjZcah.exe
  C:\Windows\System\khjZcah.exe
  2⤵
  PID:4652
- C:\Windows\System\PVysQey.exe
  C:\Windows\System\PVysQey.exe
  2⤵
  PID:4672
- C:\Windows\System\jHBuOeQ.exe
  C:\Windows\System\jHBuOeQ.exe
  2⤵
  PID:4688
- C:\Windows\System\bjWIxPE.exe
  C:\Windows\System\bjWIxPE.exe
  2⤵
  PID:4708
- C:\Windows\System\PehoftQ.exe
  C:\Windows\System\PehoftQ.exe
  2⤵
  PID:4728
- C:\Windows\System\ZOQUdzV.exe
  C:\Windows\System\ZOQUdzV.exe
  2⤵
  PID:4744
- C:\Windows\System\cuefudn.exe
  C:\Windows\System\cuefudn.exe
  2⤵
  PID:4760
- C:\Windows\System\NGkQBBZ.exe
  C:\Windows\System\NGkQBBZ.exe
  2⤵
  PID:4780
- C:\Windows\System\YmuNmJZ.exe
  C:\Windows\System\YmuNmJZ.exe
  2⤵
  PID:4796
- C:\Windows\System\EDDXMdO.exe
  C:\Windows\System\EDDXMdO.exe
  2⤵
  PID:4816
- C:\Windows\System\svGRgbV.exe
  C:\Windows\System\svGRgbV.exe
  2⤵
  PID:4836
- C:\Windows\System\ykoLgaU.exe
  C:\Windows\System\ykoLgaU.exe
  2⤵
  PID:4860
- C:\Windows\System\lUXiLNH.exe
  C:\Windows\System\lUXiLNH.exe
  2⤵
  PID:4876
- C:\Windows\System\HlZoOch.exe
  C:\Windows\System\HlZoOch.exe
  2⤵
  PID:4896
- C:\Windows\System\eqPqmdE.exe
  C:\Windows\System\eqPqmdE.exe
  2⤵
  PID:4912
- C:\Windows\System\vHeGDpg.exe
  C:\Windows\System\vHeGDpg.exe
  2⤵
  PID:4928
- C:\Windows\System\xqfIXka.exe
  C:\Windows\System\xqfIXka.exe
  2⤵
  PID:4944
- C:\Windows\System\dAAjtvr.exe
  C:\Windows\System\dAAjtvr.exe
  2⤵
  PID:4960
- C:\Windows\System\aqgaOGQ.exe
  C:\Windows\System\aqgaOGQ.exe
  2⤵
  PID:4976
- C:\Windows\System\AMYwiUI.exe
  C:\Windows\System\AMYwiUI.exe
  2⤵
  PID:4992
- C:\Windows\System\nbmavVJ.exe
  C:\Windows\System\nbmavVJ.exe
  2⤵
  PID:5008
- C:\Windows\System\JMBETJs.exe
  C:\Windows\System\JMBETJs.exe
  2⤵
  PID:5036
- C:\Windows\System\AnxbOgb.exe
  C:\Windows\System\AnxbOgb.exe
  2⤵
  PID:5056
- C:\Windows\System\smwXdgS.exe
  C:\Windows\System\smwXdgS.exe
  2⤵
  PID:5076
- C:\Windows\System\mAgtWfi.exe
  C:\Windows\System\mAgtWfi.exe
  2⤵
  PID:5092
- C:\Windows\System\JkCQzHl.exe
  C:\Windows\System\JkCQzHl.exe
  2⤵
  PID:5112
- C:\Windows\System\OaXuyAy.exe
  C:\Windows\System\OaXuyAy.exe
  2⤵
  PID:2000
- C:\Windows\System\UXajcVA.exe
  C:\Windows\System\UXajcVA.exe
  2⤵
  PID:1856
- C:\Windows\System\oXJMxWY.exe
  C:\Windows\System\oXJMxWY.exe
  2⤵
  PID:3188
- C:\Windows\System\qSKvBDQ.exe
  C:\Windows\System\qSKvBDQ.exe
  2⤵
  PID:3524
- C:\Windows\System\jgvuCbi.exe
  C:\Windows\System\jgvuCbi.exe
  2⤵
  PID:3628
- C:\Windows\System\diuHNQL.exe
  C:\Windows\System\diuHNQL.exe
  2⤵
  PID:3876
- C:\Windows\System\lEZGrys.exe
  C:\Windows\System\lEZGrys.exe
  2⤵
  PID:3928
- C:\Windows\System\Xcacdkl.exe
  C:\Windows\System\Xcacdkl.exe
  2⤵
  PID:4060
- C:\Windows\System\mVsvkDB.exe
  C:\Windows\System\mVsvkDB.exe
  2⤵
  PID:1824
- C:\Windows\System\CswLmnM.exe
  C:\Windows\System\CswLmnM.exe
  2⤵
  PID:2644
- C:\Windows\System\ORsjZin.exe
  C:\Windows\System\ORsjZin.exe
  2⤵
  PID:3688
- C:\Windows\System\VLNPHEd.exe
  C:\Windows\System\VLNPHEd.exe
  2⤵
  PID:592
- C:\Windows\System\HhABqzf.exe
  C:\Windows\System\HhABqzf.exe
  2⤵
  PID:4108
- C:\Windows\System\GwlLkbf.exe
  C:\Windows\System\GwlLkbf.exe
  2⤵
  PID:1792
- C:\Windows\System\NZLdZIw.exe
  C:\Windows\System\NZLdZIw.exe
  2⤵
  PID:3400
- C:\Windows\System\tlOzaTT.exe
  C:\Windows\System\tlOzaTT.exe
  2⤵
  PID:1988
- C:\Windows\System\YQbnLSp.exe
  C:\Windows\System\YQbnLSp.exe
  2⤵
  PID:4256
- C:\Windows\System\JUnEmCW.exe
  C:\Windows\System\JUnEmCW.exe
  2⤵
  PID:4320
- C:\Windows\System\JJDGuhD.exe
  C:\Windows\System\JJDGuhD.exe
  2⤵
  PID:1280
- C:\Windows\System\ZTNKgoF.exe
  C:\Windows\System\ZTNKgoF.exe
  2⤵
  PID:4376
- C:\Windows\System\jnYcDEz.exe
  C:\Windows\System\jnYcDEz.exe
  2⤵
  PID:4396
- C:\Windows\System\GexwTUM.exe
  C:\Windows\System\GexwTUM.exe
  2⤵
  PID:4408
- C:\Windows\System\RqKnexR.exe
  C:\Windows\System\RqKnexR.exe
  2⤵
  PID:1236
- C:\Windows\System\IssNnKw.exe
  C:\Windows\System\IssNnKw.exe
  2⤵
  PID:4456
- C:\Windows\System\nmSWWun.exe
  C:\Windows\System\nmSWWun.exe
  2⤵
  PID:4476
- C:\Windows\System\MvpGhBK.exe
  C:\Windows\System\MvpGhBK.exe
  2⤵
  PID:4480
- C:\Windows\System\dANtiYD.exe
  C:\Windows\System\dANtiYD.exe
  2⤵
  PID:4572
- C:\Windows\System\fGzZtcX.exe
  C:\Windows\System\fGzZtcX.exe
  2⤵
  PID:1968
- C:\Windows\System\VWpxkaY.exe
  C:\Windows\System\VWpxkaY.exe
  2⤵
  PID:2748
- C:\Windows\System\pRmeyPs.exe
  C:\Windows\System\pRmeyPs.exe
  2⤵
  PID:4556
- C:\Windows\System\hiEYFJc.exe
  C:\Windows\System\hiEYFJc.exe
  2⤵
  PID:4596
- C:\Windows\System\QAGOYSc.exe
  C:\Windows\System\QAGOYSc.exe
  2⤵
  PID:4628
- C:\Windows\System\tuajuxD.exe
  C:\Windows\System\tuajuxD.exe
  2⤵
  PID:4668
- C:\Windows\System\CIFnKSe.exe
  C:\Windows\System\CIFnKSe.exe
  2⤵
  PID:4740
- C:\Windows\System\NpicRjM.exe
  C:\Windows\System\NpicRjM.exe
  2⤵
  PID:4808
- C:\Windows\System\XvTXDvE.exe
  C:\Windows\System\XvTXDvE.exe
  2⤵
  PID:4644
- C:\Windows\System\qnzUGxm.exe
  C:\Windows\System\qnzUGxm.exe
  2⤵
  PID:4828
- C:\Windows\System\EASGGWr.exe
  C:\Windows\System\EASGGWr.exe
  2⤵
  PID:4888
- C:\Windows\System\uIcLxom.exe
  C:\Windows\System\uIcLxom.exe
  2⤵
  PID:4952
- C:\Windows\System\ijGfpKS.exe
  C:\Windows\System\ijGfpKS.exe
  2⤵
  PID:4904
- C:\Windows\System\MUSTYWr.exe
  C:\Windows\System\MUSTYWr.exe
  2⤵
  PID:4972
- C:\Windows\System\ekzTWlv.exe
  C:\Windows\System\ekzTWlv.exe
  2⤵
  PID:4936
- C:\Windows\System\PGaDHiH.exe
  C:\Windows\System\PGaDHiH.exe
  2⤵
  PID:4788
- C:\Windows\System\jzRYCKd.exe
  C:\Windows\System\jzRYCKd.exe
  2⤵
  PID:5020
- C:\Windows\System\uNvfEdH.exe
  C:\Windows\System\uNvfEdH.exe
  2⤵
  PID:5004
- C:\Windows\System\fGPCXGw.exe
  C:\Windows\System\fGPCXGw.exe
  2⤵
  PID:5052
- C:\Windows\System\sWKgmYT.exe
  C:\Windows\System\sWKgmYT.exe
  2⤵
  PID:2024
- C:\Windows\System\LIpczRQ.exe
  C:\Windows\System\LIpczRQ.exe
  2⤵
  PID:2548
- C:\Windows\System\zntJwrw.exe
  C:\Windows\System\zntJwrw.exe
  2⤵
  PID:3260
- C:\Windows\System\lFtBeQr.exe
  C:\Windows\System\lFtBeQr.exe
  2⤵
  PID:1216
- C:\Windows\System\DvpmHCv.exe
  C:\Windows\System\DvpmHCv.exe
  2⤵
  PID:1808
- C:\Windows\System\ysYBmZa.exe
  C:\Windows\System\ysYBmZa.exe
  2⤵
  PID:2068
- C:\Windows\System\WtoRGFu.exe
  C:\Windows\System\WtoRGFu.exe
  2⤵
  PID:4292
- C:\Windows\System\JZGUxUf.exe
  C:\Windows\System\JZGUxUf.exe
  2⤵
  PID:4224
- C:\Windows\System\qCzixjg.exe
  C:\Windows\System\qCzixjg.exe
  2⤵
  PID:3148
- C:\Windows\System\FWxHpFP.exe
  C:\Windows\System\FWxHpFP.exe
  2⤵
  PID:2696
- C:\Windows\System\HMhcuBN.exe
  C:\Windows\System\HMhcuBN.exe
  2⤵
  PID:584
- C:\Windows\System\vHBTlkN.exe
  C:\Windows\System\vHBTlkN.exe
  2⤵
  PID:4200
- C:\Windows\System\jghcDEQ.exe
  C:\Windows\System\jghcDEQ.exe
  2⤵
  PID:4244
- C:\Windows\System\FmlDRBp.exe
  C:\Windows\System\FmlDRBp.exe
  2⤵
  PID:4356
- C:\Windows\System\DjYsnqi.exe
  C:\Windows\System\DjYsnqi.exe
  2⤵
  PID:4404
- C:\Windows\System\WLrAJlQ.exe
  C:\Windows\System\WLrAJlQ.exe
  2⤵
  PID:4388
- C:\Windows\System\UvqiLaB.exe
  C:\Windows\System\UvqiLaB.exe
  2⤵
  PID:4440
- C:\Windows\System\uXWGCFo.exe
  C:\Windows\System\uXWGCFo.exe
  2⤵
  PID:4524
- C:\Windows\System\KtTjqDh.exe
  C:\Windows\System\KtTjqDh.exe
  2⤵
  PID:4700
- C:\Windows\System\hpeRAkw.exe
  C:\Windows\System\hpeRAkw.exe
  2⤵
  PID:4956
- C:\Windows\System\SKPLXsK.exe
  C:\Windows\System\SKPLXsK.exe
  2⤵
  PID:4872
- C:\Windows\System\tjFFoyc.exe
  C:\Windows\System\tjFFoyc.exe
  2⤵
  PID:4508
- C:\Windows\System\oVOdvGE.exe
  C:\Windows\System\oVOdvGE.exe
  2⤵
  PID:5000
- C:\Windows\System\NfVXJfo.exe
  C:\Windows\System\NfVXJfo.exe
  2⤵
  PID:4772
- C:\Windows\System\qeCZAEx.exe
  C:\Windows\System\qeCZAEx.exe
  2⤵
  PID:1344
- C:\Windows\System\CpSyfVW.exe
  C:\Windows\System\CpSyfVW.exe
  2⤵
  PID:3728
- C:\Windows\System\ZDDrQly.exe
  C:\Windows\System\ZDDrQly.exe
  2⤵
  PID:3584
- C:\Windows\System\iSDoCaS.exe
  C:\Windows\System\iSDoCaS.exe
  2⤵
  PID:4276
- C:\Windows\System\xwSUSpQ.exe
  C:\Windows\System\xwSUSpQ.exe
  2⤵
  PID:4368
- C:\Windows\System\GPywQXh.exe
  C:\Windows\System\GPywQXh.exe
  2⤵
  PID:5028
- C:\Windows\System\OgmAYkE.exe
  C:\Windows\System\OgmAYkE.exe
  2⤵
  PID:5100
- C:\Windows\System\SanaCid.exe
  C:\Windows\System\SanaCid.exe
  2⤵
  PID:5088
- C:\Windows\System\ymcqQlx.exe
  C:\Windows\System\ymcqQlx.exe
  2⤵
  PID:3212
- C:\Windows\System\mTSMbxQ.exe
  C:\Windows\System\mTSMbxQ.exe
  2⤵
  PID:4576
- C:\Windows\System\OXqQMaa.exe
  C:\Windows\System\OXqQMaa.exe
  2⤵
  PID:4428
- C:\Windows\System\EocvtUp.exe
  C:\Windows\System\EocvtUp.exe
  2⤵
  PID:4432
- C:\Windows\System\WugeJNy.exe
  C:\Windows\System\WugeJNy.exe
  2⤵
  PID:2276
- C:\Windows\System\CqKzqHd.exe
  C:\Windows\System\CqKzqHd.exe
  2⤵
  PID:928
- C:\Windows\System\hYUiegR.exe
  C:\Windows\System\hYUiegR.exe
  2⤵
  PID:4416
- C:\Windows\System\DBGUOYN.exe
  C:\Windows\System\DBGUOYN.exe
  2⤵
  PID:4696
- C:\Windows\System\wVqWYMX.exe
  C:\Windows\System\wVqWYMX.exe
  2⤵
  PID:4988
- C:\Windows\System\wWVLklC.exe
  C:\Windows\System\wWVLklC.exe
  2⤵
  PID:4484
- C:\Windows\System\FNlXUOu.exe
  C:\Windows\System\FNlXUOu.exe
  2⤵
  PID:4128
- C:\Windows\System\UXsUvXN.exe
  C:\Windows\System\UXsUvXN.exe
  2⤵
  PID:4716
- C:\Windows\System\JAMmjYf.exe
  C:\Windows\System\JAMmjYf.exe
  2⤵
  PID:3528
- C:\Windows\System\bneSLQN.exe
  C:\Windows\System\bneSLQN.exe
  2⤵
  PID:2756
- C:\Windows\System\cmJUrwd.exe
  C:\Windows\System\cmJUrwd.exe
  2⤵
  PID:4340
- C:\Windows\System\JnzEWzO.exe
  C:\Windows\System\JnzEWzO.exe
  2⤵
  PID:824
- C:\Windows\System\kubpEyV.exe
  C:\Windows\System\kubpEyV.exe
  2⤵
  PID:4756
- C:\Windows\System\MslQiry.exe
  C:\Windows\System\MslQiry.exe
  2⤵
  PID:2712
- C:\Windows\System\EPCCuQD.exe
  C:\Windows\System\EPCCuQD.exe
  2⤵
  PID:3504
- C:\Windows\System\TEhReRi.exe
  C:\Windows\System\TEhReRi.exe
  2⤵
  PID:3228
- C:\Windows\System\iubbbUm.exe
  C:\Windows\System\iubbbUm.exe
  2⤵
  PID:4204
- C:\Windows\System\ooQYwfT.exe
  C:\Windows\System\ooQYwfT.exe
  2⤵
  PID:5068
- C:\Windows\System\tGgMWXt.exe
  C:\Windows\System\tGgMWXt.exe
  2⤵
  PID:4448
- C:\Windows\System\EZGVrSe.exe
  C:\Windows\System\EZGVrSe.exe
  2⤵
  PID:340
- C:\Windows\System\uNAkaaz.exe
  C:\Windows\System\uNAkaaz.exe
  2⤵
  PID:4792
- C:\Windows\System\FAbYsUh.exe
  C:\Windows\System\FAbYsUh.exe
  2⤵
  PID:2060
- C:\Windows\System\IanSOqz.exe
  C:\Windows\System\IanSOqz.exe
  2⤵
  PID:4308
- C:\Windows\System\jSwEAfP.exe
  C:\Windows\System\jSwEAfP.exe
  2⤵
  PID:5048
- C:\Windows\System\yxEGVJp.exe
  C:\Windows\System\yxEGVJp.exe
  2⤵
  PID:4856
- C:\Windows\System\HyFSjMy.exe
  C:\Windows\System\HyFSjMy.exe
  2⤵
  PID:4588
- C:\Windows\System\VUyQsrF.exe
  C:\Windows\System\VUyQsrF.exe
  2⤵
  PID:3664
- C:\Windows\System\pzzZHkC.exe
  C:\Windows\System\pzzZHkC.exe
  2⤵
  PID:4884
- C:\Windows\System\HbxMXTf.exe
  C:\Windows\System\HbxMXTf.exe
  2⤵
  PID:4260
- C:\Windows\System\ioMZLGE.exe
  C:\Windows\System\ioMZLGE.exe
  2⤵
  PID:3448
- C:\Windows\System\VwPbZTR.exe
  C:\Windows\System\VwPbZTR.exe
  2⤵
  PID:5136
- C:\Windows\System\agmudGK.exe
  C:\Windows\System\agmudGK.exe
  2⤵
  PID:5172
- C:\Windows\System\JekXeFN.exe
  C:\Windows\System\JekXeFN.exe
  2⤵
  PID:5192
- C:\Windows\System\gRihXSs.exe
  C:\Windows\System\gRihXSs.exe
  2⤵
  PID:5208
- C:\Windows\System\dcOkhvH.exe
  C:\Windows\System\dcOkhvH.exe
  2⤵
  PID:5224
- C:\Windows\System\GwDbqYC.exe
  C:\Windows\System\GwDbqYC.exe
  2⤵
  PID:5240
- C:\Windows\System\sHCGLuD.exe
  C:\Windows\System\sHCGLuD.exe
  2⤵
  PID:5256
- C:\Windows\System\JYDEzYx.exe
  C:\Windows\System\JYDEzYx.exe
  2⤵
  PID:5272
- C:\Windows\System\fMKASyH.exe
  C:\Windows\System\fMKASyH.exe
  2⤵
  PID:5296
- C:\Windows\System\wDqNRDD.exe
  C:\Windows\System\wDqNRDD.exe
  2⤵
  PID:5312
- C:\Windows\System\sIYkRAS.exe
  C:\Windows\System\sIYkRAS.exe
  2⤵
  PID:5332
- C:\Windows\System\sRwNjNn.exe
  C:\Windows\System\sRwNjNn.exe
  2⤵
  PID:5356
- C:\Windows\System\ezEVXFE.exe
  C:\Windows\System\ezEVXFE.exe
  2⤵
  PID:5372
- C:\Windows\System\IDreQEp.exe
  C:\Windows\System\IDreQEp.exe
  2⤵
  PID:5392
- C:\Windows\System\BwWJQFQ.exe
  C:\Windows\System\BwWJQFQ.exe
  2⤵
  PID:5432
- C:\Windows\System\sdHtHZN.exe
  C:\Windows\System\sdHtHZN.exe
  2⤵
  PID:5448
- C:\Windows\System\UhPLuxN.exe
  C:\Windows\System\UhPLuxN.exe
  2⤵
  PID:5472
- C:\Windows\System\pAKJQWU.exe
  C:\Windows\System\pAKJQWU.exe
  2⤵
  PID:5496
- C:\Windows\System\AJCasHP.exe
  C:\Windows\System\AJCasHP.exe
  2⤵
  PID:5512
- C:\Windows\System\bNPxusF.exe
  C:\Windows\System\bNPxusF.exe
  2⤵
  PID:5528
- C:\Windows\System\qyeNaSu.exe
  C:\Windows\System\qyeNaSu.exe
  2⤵
  PID:5552
- C:\Windows\System\qxqkHfx.exe
  C:\Windows\System\qxqkHfx.exe
  2⤵
  PID:5568
- C:\Windows\System\xmuPWKc.exe
  C:\Windows\System\xmuPWKc.exe
  2⤵
  PID:5588
- C:\Windows\System\JGvlXXX.exe
  C:\Windows\System\JGvlXXX.exe
  2⤵
  PID:5612
- C:\Windows\System\WSGZorM.exe
  C:\Windows\System\WSGZorM.exe
  2⤵
  PID:5628
- C:\Windows\System\ZxhVZOg.exe
  C:\Windows\System\ZxhVZOg.exe
  2⤵
  PID:5648
- C:\Windows\System\lTIZptM.exe
  C:\Windows\System\lTIZptM.exe
  2⤵
  PID:5668
- C:\Windows\System\dQlriJD.exe
  C:\Windows\System\dQlriJD.exe
  2⤵
  PID:5684
- C:\Windows\System\MLmQxCY.exe
  C:\Windows\System\MLmQxCY.exe
  2⤵
  PID:5700
- C:\Windows\System\yUVZpnD.exe
  C:\Windows\System\yUVZpnD.exe
  2⤵
  PID:5720
- C:\Windows\System\ipdCTaT.exe
  C:\Windows\System\ipdCTaT.exe
  2⤵
  PID:5744
- C:\Windows\System\MuESbBs.exe
  C:\Windows\System\MuESbBs.exe
  2⤵
  PID:5764
- C:\Windows\System\HjkUMSD.exe
  C:\Windows\System\HjkUMSD.exe
  2⤵
  PID:5784
- C:\Windows\System\YhUpQVR.exe
  C:\Windows\System\YhUpQVR.exe
  2⤵
  PID:5804
- C:\Windows\System\OrNfOno.exe
  C:\Windows\System\OrNfOno.exe
  2⤵
  PID:5824
- C:\Windows\System\RgVaJmC.exe
  C:\Windows\System\RgVaJmC.exe
  2⤵
  PID:5840
- C:\Windows\System\uhtiPMZ.exe
  C:\Windows\System\uhtiPMZ.exe
  2⤵
  PID:5864
- C:\Windows\System\FzcFQZh.exe
  C:\Windows\System\FzcFQZh.exe
  2⤵
  PID:5880
- C:\Windows\System\OVMseXz.exe
  C:\Windows\System\OVMseXz.exe
  2⤵
  PID:5896
- C:\Windows\System\JQkiDdy.exe
  C:\Windows\System\JQkiDdy.exe
  2⤵
  PID:5912
- C:\Windows\System\JCXqSKL.exe
  C:\Windows\System\JCXqSKL.exe
  2⤵
  PID:5928
- C:\Windows\System\ejmtkIm.exe
  C:\Windows\System\ejmtkIm.exe
  2⤵
  PID:5944
- C:\Windows\System\OssclZX.exe
  C:\Windows\System\OssclZX.exe
  2⤵
  PID:5960
- C:\Windows\System\IRJpJzU.exe
  C:\Windows\System\IRJpJzU.exe
  2⤵
  PID:5976
- C:\Windows\System\bKOgnsA.exe
  C:\Windows\System\bKOgnsA.exe
  2⤵
  PID:5996
- C:\Windows\System\dpmSjgu.exe
  C:\Windows\System\dpmSjgu.exe
  2⤵
  PID:6012
- C:\Windows\System\hMKvLan.exe
  C:\Windows\System\hMKvLan.exe
  2⤵
  PID:6032
- C:\Windows\System\XRNbeWr.exe
  C:\Windows\System\XRNbeWr.exe
  2⤵
  PID:6052
- C:\Windows\System\ZGxzSGP.exe
  C:\Windows\System\ZGxzSGP.exe
  2⤵
  PID:6072
- C:\Windows\System\mmIryIj.exe
  C:\Windows\System\mmIryIj.exe
  2⤵
  PID:6088
- C:\Windows\System\aWdHnWP.exe
  C:\Windows\System\aWdHnWP.exe
  2⤵
  PID:6104
- C:\Windows\System\qLrYMwK.exe
  C:\Windows\System\qLrYMwK.exe
  2⤵
  PID:6120
- C:\Windows\System\RJTJQee.exe
  C:\Windows\System\RJTJQee.exe
  2⤵
  PID:6140
- C:\Windows\System\dGDYTqI.exe
  C:\Windows\System\dGDYTqI.exe
  2⤵
  PID:4124
- C:\Windows\System\sYrDXsi.exe
  C:\Windows\System\sYrDXsi.exe
  2⤵
  PID:5124
- C:\Windows\System\tJwdRHD.exe
  C:\Windows\System\tJwdRHD.exe
  2⤵
  PID:5132
- C:\Windows\System\uKrYQND.exe
  C:\Windows\System\uKrYQND.exe
  2⤵
  PID:5168
- C:\Windows\System\jrrzCoI.exe
  C:\Windows\System\jrrzCoI.exe
  2⤵
  PID:5236
- C:\Windows\System\mjvOdyj.exe
  C:\Windows\System\mjvOdyj.exe
  2⤵
  PID:5184
- C:\Windows\System\VCMLJCQ.exe
  C:\Windows\System\VCMLJCQ.exe
  2⤵
  PID:5388
- C:\Windows\System\XeOWuWP.exe
  C:\Windows\System\XeOWuWP.exe
  2⤵
  PID:5416
- C:\Windows\System\EiEdGsz.exe
  C:\Windows\System\EiEdGsz.exe
  2⤵
  PID:5408
- C:\Windows\System\oGPgYhM.exe
  C:\Windows\System\oGPgYhM.exe
  2⤵
  PID:5428
- C:\Windows\System\ecIjKlg.exe
  C:\Windows\System\ecIjKlg.exe
  2⤵
  PID:5488
- C:\Windows\System\coNAmCr.exe
  C:\Windows\System\coNAmCr.exe
  2⤵
  PID:5524
- C:\Windows\System\JEqlovS.exe
  C:\Windows\System\JEqlovS.exe
  2⤵
  PID:5504
- C:\Windows\System\AAIseif.exe
  C:\Windows\System\AAIseif.exe
  2⤵
  PID:5604
- C:\Windows\System\oPLzoWs.exe
  C:\Windows\System\oPLzoWs.exe
  2⤵
  PID:5584
- C:\Windows\System\JXNbOHv.exe
  C:\Windows\System\JXNbOHv.exe
  2⤵
  PID:5676
- C:\Windows\System\rqdmJyD.exe
  C:\Windows\System\rqdmJyD.exe
  2⤵
  PID:5716
- C:\Windows\System\FOMhuIz.exe
  C:\Windows\System\FOMhuIz.exe
  2⤵
  PID:5792
- C:\Windows\System\WSuVEdT.exe
  C:\Windows\System\WSuVEdT.exe
  2⤵
  PID:5620
- C:\Windows\System\cNOiCIq.exe
  C:\Windows\System\cNOiCIq.exe
  2⤵
  PID:5876
- C:\Windows\System\rEVFhym.exe
  C:\Windows\System\rEVFhym.exe
  2⤵
  PID:5940
- C:\Windows\System\ccJPomH.exe
  C:\Windows\System\ccJPomH.exe
  2⤵
  PID:6080
- C:\Windows\System\gWqeiYz.exe
  C:\Windows\System\gWqeiYz.exe
  2⤵
  PID:4352
- C:\Windows\System\GCNjsJJ.exe
  C:\Windows\System\GCNjsJJ.exe
  2⤵
  PID:3564
- C:\Windows\System\GfscRwl.exe
  C:\Windows\System\GfscRwl.exe
  2⤵
  PID:5200
- C:\Windows\System\TPifBfa.exe
  C:\Windows\System\TPifBfa.exe
  2⤵
  PID:5348
- C:\Windows\System\RDesaWe.exe
  C:\Windows\System\RDesaWe.exe
  2⤵
  PID:5852
- C:\Windows\System\AbBuBbu.exe
  C:\Windows\System\AbBuBbu.exe
  2⤵
  PID:5860
- C:\Windows\System\XoIAARS.exe
  C:\Windows\System\XoIAARS.exe
  2⤵
  PID:5292
- C:\Windows\System\bDSuHAU.exe
  C:\Windows\System\bDSuHAU.exe
  2⤵
  PID:6096
- C:\Windows\System\GhAhlWm.exe
  C:\Windows\System\GhAhlWm.exe
  2⤵
  PID:4824
- C:\Windows\System\TPAyPhL.exe
  C:\Windows\System\TPAyPhL.exe
  2⤵
  PID:5164
- C:\Windows\System\aeTpXNU.exe
  C:\Windows\System\aeTpXNU.exe
  2⤵
  PID:5728
- C:\Windows\System\SXNoPvv.exe
  C:\Windows\System\SXNoPvv.exe
  2⤵
  PID:5820
- C:\Windows\System\UHCslYL.exe
  C:\Windows\System\UHCslYL.exe
  2⤵
  PID:5368
- C:\Windows\System\VWvKsgs.exe
  C:\Windows\System\VWvKsgs.exe
  2⤵
  PID:5308
- C:\Windows\System\dWKPhNM.exe
  C:\Windows\System\dWKPhNM.exe
  2⤵
  PID:5924
- C:\Windows\System\JqwHWuv.exe
  C:\Windows\System\JqwHWuv.exe
  2⤵
  PID:5992
- C:\Windows\System\KMYibDu.exe
  C:\Windows\System\KMYibDu.exe
  2⤵
  PID:6064
- C:\Windows\System\OamwlWc.exe
  C:\Windows\System\OamwlWc.exe
  2⤵
  PID:5468
- C:\Windows\System\qeJxiqY.exe
  C:\Windows\System\qeJxiqY.exe
  2⤵
  PID:5564
- C:\Windows\System\wtYlDaW.exe
  C:\Windows\System\wtYlDaW.exe
  2⤵
  PID:5636
- C:\Windows\System\xICYoDY.exe
  C:\Windows\System\xICYoDY.exe
  2⤵
  PID:5600
- C:\Windows\System\helixFR.exe
  C:\Windows\System\helixFR.exe
  2⤵
  PID:5800
- C:\Windows\System\Scftbma.exe
  C:\Windows\System\Scftbma.exe
  2⤵
  PID:5936
- C:\Windows\System\ObUdRaV.exe
  C:\Windows\System\ObUdRaV.exe
  2⤵
  PID:5180
- C:\Windows\System\KvosAUs.exe
  C:\Windows\System\KvosAUs.exe
  2⤵
  PID:5288
- C:\Windows\System\oejiDTh.exe
  C:\Windows\System\oejiDTh.exe
  2⤵
  PID:5328
- C:\Windows\System\GxfDgkk.exe
  C:\Windows\System\GxfDgkk.exe
  2⤵
  PID:5892
- C:\Windows\System\eLGtNBw.exe
  C:\Windows\System\eLGtNBw.exe
  2⤵
  PID:6160
- C:\Windows\System\JmHCFnW.exe
  C:\Windows\System\JmHCFnW.exe
  2⤵
  PID:6180
- C:\Windows\System\MshIsZp.exe
  C:\Windows\System\MshIsZp.exe
  2⤵
  PID:6200
- C:\Windows\System\OuzcSBI.exe
  C:\Windows\System\OuzcSBI.exe
  2⤵
  PID:6220
- C:\Windows\System\bHxSKkO.exe
  C:\Windows\System\bHxSKkO.exe
  2⤵
  PID:6240
- C:\Windows\System\kEiTsSQ.exe
  C:\Windows\System\kEiTsSQ.exe
  2⤵
  PID:6256
- C:\Windows\System\nFfUapL.exe
  C:\Windows\System\nFfUapL.exe
  2⤵
  PID:6272
- C:\Windows\System\ynCRzjV.exe
  C:\Windows\System\ynCRzjV.exe
  2⤵
  PID:6288
- C:\Windows\System\NUXdmWT.exe
  C:\Windows\System\NUXdmWT.exe
  2⤵
  PID:6312
- C:\Windows\System\ugGTIqn.exe
  C:\Windows\System\ugGTIqn.exe
  2⤵
  PID:6332
- C:\Windows\System\sHTzlwp.exe
  C:\Windows\System\sHTzlwp.exe
  2⤵
  PID:6348
- C:\Windows\System\LiKDqiu.exe
  C:\Windows\System\LiKDqiu.exe
  2⤵
  PID:6368
- C:\Windows\System\uesQdCO.exe
  C:\Windows\System\uesQdCO.exe
  2⤵
  PID:6384
- C:\Windows\System\zoerpgq.exe
  C:\Windows\System\zoerpgq.exe
  2⤵
  PID:6408
- C:\Windows\System\twUmobn.exe
  C:\Windows\System\twUmobn.exe
  2⤵
  PID:6424
- C:\Windows\System\hvmzEpl.exe
  C:\Windows\System\hvmzEpl.exe
  2⤵
  PID:6440
- C:\Windows\System\gMOullO.exe
  C:\Windows\System\gMOullO.exe
  2⤵
  PID:6464
- C:\Windows\System\cxrDgUN.exe
  C:\Windows\System\cxrDgUN.exe
  2⤵
  PID:6480
- C:\Windows\System\aLOsqsq.exe
  C:\Windows\System\aLOsqsq.exe
  2⤵
  PID:6496
- C:\Windows\System\shCZMBT.exe
  C:\Windows\System\shCZMBT.exe
  2⤵
  PID:6516
- C:\Windows\System\ViAeUxb.exe
  C:\Windows\System\ViAeUxb.exe
  2⤵
  PID:6532
- C:\Windows\System\tMOPKcT.exe
  C:\Windows\System\tMOPKcT.exe
  2⤵
  PID:6548
- C:\Windows\System\hdrwOXf.exe
  C:\Windows\System\hdrwOXf.exe
  2⤵
  PID:6564
- C:\Windows\System\CuCVCxk.exe
  C:\Windows\System\CuCVCxk.exe
  2⤵
  PID:6580
- C:\Windows\System\vHceqrG.exe
  C:\Windows\System\vHceqrG.exe
  2⤵
  PID:6596
- C:\Windows\System\eQKOuWP.exe
  C:\Windows\System\eQKOuWP.exe
  2⤵
  PID:6612
- C:\Windows\System\iByMHlu.exe
  C:\Windows\System\iByMHlu.exe
  2⤵
  PID:6628
- C:\Windows\System\TOxGEYU.exe
  C:\Windows\System\TOxGEYU.exe
  2⤵
  PID:6648
- C:\Windows\System\aTNZkwn.exe
  C:\Windows\System\aTNZkwn.exe
  2⤵
  PID:6664
- C:\Windows\System\WnEZgGx.exe
  C:\Windows\System\WnEZgGx.exe
  2⤵
  PID:6680
- C:\Windows\System\QlZccwD.exe
  C:\Windows\System\QlZccwD.exe
  2⤵
  PID:6696
- C:\Windows\System\RTVSFWQ.exe
  C:\Windows\System\RTVSFWQ.exe
  2⤵
  PID:6712
- C:\Windows\System\cXarUqg.exe
  C:\Windows\System\cXarUqg.exe
  2⤵
  PID:6728
- C:\Windows\System\qAqrDPx.exe
  C:\Windows\System\qAqrDPx.exe
  2⤵
  PID:6744
- C:\Windows\System\IksPSZD.exe
  C:\Windows\System\IksPSZD.exe
  2⤵
  PID:6760
- C:\Windows\System\IMAMxBb.exe
  C:\Windows\System\IMAMxBb.exe
  2⤵
  PID:6776
- C:\Windows\System\BLKkGSv.exe
  C:\Windows\System\BLKkGSv.exe
  2⤵
  PID:6792
- C:\Windows\System\jovRYyz.exe
  C:\Windows\System\jovRYyz.exe
  2⤵
  PID:6808
- C:\Windows\System\thweggS.exe
  C:\Windows\System\thweggS.exe
  2⤵
  PID:6824
- C:\Windows\System\oOzMXSk.exe
  C:\Windows\System\oOzMXSk.exe
  2⤵
  PID:6840
- C:\Windows\System\LrVAaUw.exe
  C:\Windows\System\LrVAaUw.exe
  2⤵
  PID:6856
- C:\Windows\System\DpqsPRW.exe
  C:\Windows\System\DpqsPRW.exe
  2⤵
  PID:6872
- C:\Windows\System\yKWLpVI.exe
  C:\Windows\System\yKWLpVI.exe
  2⤵
  PID:6888
- C:\Windows\System\rTelwHp.exe
  C:\Windows\System\rTelwHp.exe
  2⤵
  PID:6904
- C:\Windows\System\lhgXUbv.exe
  C:\Windows\System\lhgXUbv.exe
  2⤵
  PID:6920
- C:\Windows\System\wqULMsJ.exe
  C:\Windows\System\wqULMsJ.exe
  2⤵
  PID:6936
- C:\Windows\System\hDzgyAH.exe
  C:\Windows\System\hDzgyAH.exe
  2⤵
  PID:6952
- C:\Windows\System\vumDysH.exe
  C:\Windows\System\vumDysH.exe
  2⤵
  PID:6968
- C:\Windows\System\iHrEdAQ.exe
  C:\Windows\System\iHrEdAQ.exe
  2⤵
  PID:6984
- C:\Windows\System\MQFFxxq.exe
  C:\Windows\System\MQFFxxq.exe
  2⤵
  PID:7000
- C:\Windows\System\uVMWEdQ.exe
  C:\Windows\System\uVMWEdQ.exe
  2⤵
  PID:7016
- C:\Windows\System\QhrthnB.exe
  C:\Windows\System\QhrthnB.exe
  2⤵
  PID:7032
- C:\Windows\System\cUVSqlp.exe
  C:\Windows\System\cUVSqlp.exe
  2⤵
  PID:7048
- C:\Windows\System\RNKbpZN.exe
  C:\Windows\System\RNKbpZN.exe
  2⤵
  PID:7064
- C:\Windows\System\VccYGgS.exe
  C:\Windows\System\VccYGgS.exe
  2⤵
  PID:7080
- C:\Windows\System\PfxNRqv.exe
  C:\Windows\System\PfxNRqv.exe
  2⤵
  PID:7096
- C:\Windows\System\ouXDWRf.exe
  C:\Windows\System\ouXDWRf.exe
  2⤵
  PID:7116
- C:\Windows\System\rpCXsuu.exe
  C:\Windows\System\rpCXsuu.exe
  2⤵
  PID:7132
- C:\Windows\System\SVqbKvd.exe
  C:\Windows\System\SVqbKvd.exe
  2⤵
  PID:7148
- C:\Windows\System\jhOkenY.exe
  C:\Windows\System\jhOkenY.exe
  2⤵
  PID:7164
- C:\Windows\System\vnkHXrJ.exe
  C:\Windows\System\vnkHXrJ.exe
  2⤵
  PID:6024
- C:\Windows\System\RIWFyeL.exe
  C:\Windows\System\RIWFyeL.exe
  2⤵
  PID:5536
- C:\Windows\System\WemWhns.exe
  C:\Windows\System\WemWhns.exe
  2⤵
  PID:5464
- C:\Windows\System\sezBCRL.exe
  C:\Windows\System\sezBCRL.exe
  2⤵
  PID:5908
- C:\Windows\System\oKHjDPl.exe
  C:\Windows\System\oKHjDPl.exe
  2⤵
  PID:5252
- C:\Windows\System\JzMyFOY.exe
  C:\Windows\System\JzMyFOY.exe
  2⤵
  PID:6248
- C:\Windows\System\YrlcWgM.exe
  C:\Windows\System\YrlcWgM.exe
  2⤵
  PID:6172
- C:\Windows\System\waDPIBn.exe
  C:\Windows\System\waDPIBn.exe
  2⤵
  PID:6216
- C:\Windows\System\rKENFYI.exe
  C:\Windows\System\rKENFYI.exe
  2⤵
  PID:6328
- C:\Windows\System\OOfAHIF.exe
  C:\Windows\System\OOfAHIF.exe
  2⤵
  PID:6300
- C:\Windows\System\iQSFeJJ.exe
  C:\Windows\System\iQSFeJJ.exe
  2⤵
  PID:5696
- C:\Windows\System\WoPsFsA.exe
  C:\Windows\System\WoPsFsA.exe
  2⤵
  PID:5740
- C:\Windows\System\OJohtSc.exe
  C:\Windows\System\OJohtSc.exe
  2⤵
  PID:5988
- C:\Windows\System\eoMXoUS.exe
  C:\Windows\System\eoMXoUS.exe
  2⤵
  PID:5540
- C:\Windows\System\hlEhNGg.exe
  C:\Windows\System\hlEhNGg.exe
  2⤵
  PID:5576
- C:\Windows\System\ufTmCLJ.exe
  C:\Windows\System\ufTmCLJ.exe
  2⤵
  PID:6100
- C:\Windows\System\HCQNVPN.exe
  C:\Windows\System\HCQNVPN.exe
  2⤵
  PID:6188
- C:\Windows\System\qmMoiDM.exe
  C:\Windows\System\qmMoiDM.exe
  2⤵
  PID:6236
- C:\Windows\System\FCFwCNu.exe
  C:\Windows\System\FCFwCNu.exe
  2⤵
  PID:6268
- C:\Windows\System\WHxYXlF.exe
  C:\Windows\System\WHxYXlF.exe
  2⤵
  PID:6376
- C:\Windows\System\DCoSaKv.exe
  C:\Windows\System\DCoSaKv.exe
  2⤵
  PID:4924
- C:\Windows\System\bCjlFnx.exe
  C:\Windows\System\bCjlFnx.exe
  2⤵
  PID:5772
- C:\Windows\System\kygsAHN.exe
  C:\Windows\System\kygsAHN.exe
  2⤵
  PID:4044
- C:\Windows\System\soMimlO.exe
  C:\Windows\System\soMimlO.exe
  2⤵
  PID:6392
- C:\Windows\System\pMlXskz.exe
  C:\Windows\System\pMlXskz.exe
  2⤵
  PID:6432
- C:\Windows\System\XQshQWU.exe
  C:\Windows\System\XQshQWU.exe
  2⤵
  PID:6504
- C:\Windows\System\AWhMIqf.exe
  C:\Windows\System\AWhMIqf.exe
  2⤵
  PID:6456
- C:\Windows\System\IRyNIoL.exe
  C:\Windows\System\IRyNIoL.exe
  2⤵
  PID:6492
- C:\Windows\System\sycTnZt.exe
  C:\Windows\System\sycTnZt.exe
  2⤵
  PID:6448
- C:\Windows\System\JzwdxYp.exe
  C:\Windows\System\JzwdxYp.exe
  2⤵
  PID:6576
- C:\Windows\System\pjlKErq.exe
  C:\Windows\System\pjlKErq.exe
  2⤵
  PID:6528
- C:\Windows\System\jlLvXgD.exe
  C:\Windows\System\jlLvXgD.exe
  2⤵
  PID:6592
- C:\Windows\System\hIkEdgz.exe
  C:\Windows\System\hIkEdgz.exe
  2⤵
  PID:6676
- C:\Windows\System\XhLFpiP.exe
  C:\Windows\System\XhLFpiP.exe
  2⤵
  PID:6736
- C:\Windows\System\YrDtpXV.exe
  C:\Windows\System\YrDtpXV.exe
  2⤵
  PID:6692
- C:\Windows\System\XdKnogM.exe
  C:\Windows\System\XdKnogM.exe
  2⤵
  PID:6768
- C:\Windows\System\lVGLbgz.exe
  C:\Windows\System\lVGLbgz.exe
  2⤵
  PID:6816
- C:\Windows\System\jdUuErV.exe
  C:\Windows\System\jdUuErV.exe
  2⤵
  PID:6804
- C:\Windows\System\JtCjeyQ.exe
  C:\Windows\System\JtCjeyQ.exe
  2⤵
  PID:6864
- C:\Windows\System\XdxJtvJ.exe
  C:\Windows\System\XdxJtvJ.exe
  2⤵
  PID:6932
- C:\Windows\System\OmRJizL.exe
  C:\Windows\System\OmRJizL.exe
  2⤵
  PID:6884
- C:\Windows\System\McLLvJt.exe
  C:\Windows\System\McLLvJt.exe
  2⤵
  PID:6948
- C:\Windows\System\tknxCYm.exe
  C:\Windows\System\tknxCYm.exe
  2⤵
  PID:6996
- C:\Windows\System\XxCrtxG.exe
  C:\Windows\System\XxCrtxG.exe
  2⤵
  PID:7060
- C:\Windows\System\KlTzoSL.exe
  C:\Windows\System\KlTzoSL.exe
  2⤵
  PID:7040
- C:\Windows\System\JiugnGQ.exe
  C:\Windows\System\JiugnGQ.exe
  2⤵
  PID:6976
- C:\Windows\System\uDHXZjw.exe
  C:\Windows\System\uDHXZjw.exe
  2⤵
  PID:7012
- C:\Windows\System\CWDpEMV.exe
  C:\Windows\System\CWDpEMV.exe
  2⤵
  PID:5712
- C:\Windows\System\wbPVPHS.exe
  C:\Windows\System\wbPVPHS.exe
  2⤵
  PID:5248
- C:\Windows\System\Ypsnzme.exe
  C:\Windows\System\Ypsnzme.exe
  2⤵
  PID:5644
- C:\Windows\System\HPGeYOf.exe
  C:\Windows\System\HPGeYOf.exe
  2⤵
  PID:6048
- C:\Windows\System\LiGOmRh.exe
  C:\Windows\System\LiGOmRh.exe
  2⤵
  PID:5280
- C:\Windows\System\oXUBOtJ.exe
  C:\Windows\System\oXUBOtJ.exe
  2⤵
  PID:6136
- C:\Windows\System\nzaNQJT.exe
  C:\Windows\System\nzaNQJT.exe
  2⤵
  PID:5816
- C:\Windows\System\RVDRBmy.exe
  C:\Windows\System\RVDRBmy.exe
  2⤵
  PID:6324
- C:\Windows\System\cJaRhdD.exe
  C:\Windows\System\cJaRhdD.exe
  2⤵
  PID:6196
- C:\Windows\System\AuvlDWy.exe
  C:\Windows\System\AuvlDWy.exe
  2⤵
  PID:5776
- C:\Windows\System\yLzGryy.exe
  C:\Windows\System\yLzGryy.exe
  2⤵
  PID:5956
- C:\Windows\System\XFzqNUf.exe
  C:\Windows\System\XFzqNUf.exe
  2⤵
  PID:6264
- C:\Windows\System\XIjKPwe.exe
  C:\Windows\System\XIjKPwe.exe
  2⤵
  PID:4612
- C:\Windows\System\alNPdNo.exe
  C:\Windows\System\alNPdNo.exe
  2⤵
  PID:6472
- C:\Windows\System\BaTvmfY.exe
  C:\Windows\System\BaTvmfY.exe
  2⤵
  PID:6452
- C:\Windows\System\QfFCXCh.exe
  C:\Windows\System\QfFCXCh.exe
  2⤵
  PID:6708
- C:\Windows\System\KrXqegQ.exe
  C:\Windows\System\KrXqegQ.exe
  2⤵
  PID:6832
- C:\Windows\System\EiVBemd.exe
  C:\Windows\System\EiVBemd.exe
  2⤵
  PID:6540
- C:\Windows\System\nPnwxnH.exe
  C:\Windows\System\nPnwxnH.exe
  2⤵
  PID:7028
- C:\Windows\System\wyWHRZS.exe
  C:\Windows\System\wyWHRZS.exe
  2⤵
  PID:6672
- C:\Windows\System\qLskKHM.exe
  C:\Windows\System\qLskKHM.exe
  2⤵
  PID:6916
- C:\Windows\System\QMnpaJg.exe
  C:\Windows\System\QMnpaJg.exe
  2⤵
  PID:6556
- C:\Windows\System\KEObznC.exe
  C:\Windows\System\KEObznC.exe
  2⤵
  PID:7128
- C:\Windows\System\nRUHlqc.exe
  C:\Windows\System\nRUHlqc.exe
  2⤵
  PID:5460
- C:\Windows\System\QEOfLWj.exe
  C:\Windows\System\QEOfLWj.exe
  2⤵
  PID:5384
- C:\Windows\System\YVXwiDg.exe
  C:\Windows\System\YVXwiDg.exe
  2⤵
  PID:7108
- C:\Windows\System\KtfHNrD.exe
  C:\Windows\System\KtfHNrD.exe
  2⤵
  PID:7156
- C:\Windows\System\eiOKFJm.exe
  C:\Windows\System\eiOKFJm.exe
  2⤵
  PID:5440
- C:\Windows\System\nBJVBGq.exe
  C:\Windows\System\nBJVBGq.exe
  2⤵
  PID:5872
- C:\Windows\System\KnTYdJC.exe
  C:\Windows\System\KnTYdJC.exe
  2⤵
  PID:6752
- C:\Windows\System\OnbIDPo.exe
  C:\Windows\System\OnbIDPo.exe
  2⤵
  PID:6608
- C:\Windows\System\MhIzJTU.exe
  C:\Windows\System\MhIzJTU.exe
  2⤵
  PID:6944
- C:\Windows\System\XZILClu.exe
  C:\Windows\System\XZILClu.exe
  2⤵
  PID:6836
- C:\Windows\System\IClbbLf.exe
  C:\Windows\System\IClbbLf.exe
  2⤵
  PID:7072
- C:\Windows\System\CWdgfPT.exe
  C:\Windows\System\CWdgfPT.exe
  2⤵
  PID:6980
- C:\Windows\System\ITnGvip.exe
  C:\Windows\System\ITnGvip.exe
  2⤵
  PID:6380
- C:\Windows\System\rbmNJDF.exe
  C:\Windows\System\rbmNJDF.exe
  2⤵
  PID:6004
- C:\Windows\System\kqchgiG.exe
  C:\Windows\System\kqchgiG.exe
  2⤵
  PID:5444
- C:\Windows\System\Hpogtnh.exe
  C:\Windows\System\Hpogtnh.exe
  2⤵
  PID:5232
- C:\Windows\System\ILZNmld.exe
  C:\Windows\System\ILZNmld.exe
  2⤵
  PID:6928
- C:\Windows\System\mJJCIRi.exe
  C:\Windows\System\mJJCIRi.exe
  2⤵
  PID:5608
- C:\Windows\System\dRYkvqG.exe
  C:\Windows\System\dRYkvqG.exe
  2⤵
  PID:6400
- C:\Windows\System\TBsWmTx.exe
  C:\Windows\System\TBsWmTx.exe
  2⤵
  PID:6152
- C:\Windows\System\nEgXdGq.exe
  C:\Windows\System\nEgXdGq.exe
  2⤵
  PID:5984
- C:\Windows\System\bkSrpNF.exe
  C:\Windows\System\bkSrpNF.exe
  2⤵
  PID:6320
- C:\Windows\System\feguACR.exe
  C:\Windows\System\feguACR.exe
  2⤵
  PID:6364
- C:\Windows\System\BKsRSoa.exe
  C:\Windows\System\BKsRSoa.exe
  2⤵
  PID:6512
- C:\Windows\System\HLsLxGr.exe
  C:\Windows\System\HLsLxGr.exe
  2⤵
  PID:6788
- C:\Windows\System\YDEaKJb.exe
  C:\Windows\System\YDEaKJb.exe
  2⤵
  PID:6340
- C:\Windows\System\vajvjmi.exe
  C:\Windows\System\vajvjmi.exe
  2⤵
  PID:5888
- C:\Windows\System\RAOrLtB.exe
  C:\Windows\System\RAOrLtB.exe
  2⤵
  PID:7184
- C:\Windows\System\oxiKIMf.exe
  C:\Windows\System\oxiKIMf.exe
  2⤵
  PID:7200
- C:\Windows\System\NOXwCfL.exe
  C:\Windows\System\NOXwCfL.exe
  2⤵
  PID:7216
- C:\Windows\System\gFuSFhq.exe
  C:\Windows\System\gFuSFhq.exe
  2⤵
  PID:7232
- C:\Windows\System\jlqlyJA.exe
  C:\Windows\System\jlqlyJA.exe
  2⤵
  PID:7248
- C:\Windows\System\VzPFCKX.exe
  C:\Windows\System\VzPFCKX.exe
  2⤵
  PID:7264
- C:\Windows\System\AXCphdb.exe
  C:\Windows\System\AXCphdb.exe
  2⤵
  PID:7280
- C:\Windows\System\DYlrNKx.exe
  C:\Windows\System\DYlrNKx.exe
  2⤵
  PID:7296
- C:\Windows\System\DGiQCWs.exe
  C:\Windows\System\DGiQCWs.exe
  2⤵
  PID:7312
- C:\Windows\System\FyQtyNY.exe
  C:\Windows\System\FyQtyNY.exe
  2⤵
  PID:7332
- C:\Windows\System\KwncMzT.exe
  C:\Windows\System\KwncMzT.exe
  2⤵
  PID:7352
- C:\Windows\System\uEIlpff.exe
  C:\Windows\System\uEIlpff.exe
  2⤵
  PID:7368
- C:\Windows\System\CHglcEi.exe
  C:\Windows\System\CHglcEi.exe
  2⤵
  PID:7384
- C:\Windows\System\QyfhugU.exe
  C:\Windows\System\QyfhugU.exe
  2⤵
  PID:7400
- C:\Windows\System\CwHsNxq.exe
  C:\Windows\System\CwHsNxq.exe
  2⤵
  PID:7416
- C:\Windows\System\iUWfoBz.exe
  C:\Windows\System\iUWfoBz.exe
  2⤵
  PID:7436
- C:\Windows\System\iiCGqrX.exe
  C:\Windows\System\iiCGqrX.exe
  2⤵
  PID:7456
- C:\Windows\System\ZbjgDZF.exe
  C:\Windows\System\ZbjgDZF.exe
  2⤵
  PID:7480
- C:\Windows\System\YyXVdri.exe
  C:\Windows\System\YyXVdri.exe
  2⤵
  PID:7496
- C:\Windows\System\PmgWMBY.exe
  C:\Windows\System\PmgWMBY.exe
  2⤵
  PID:7540
- C:\Windows\System\bzfbAet.exe
  C:\Windows\System\bzfbAet.exe
  2⤵
  PID:7580
- C:\Windows\System\GSamhqF.exe
  C:\Windows\System\GSamhqF.exe
  2⤵
  PID:7636
- C:\Windows\System\XPxoWba.exe
  C:\Windows\System\XPxoWba.exe
  2⤵
  PID:7652
- C:\Windows\System\ELCJPgu.exe
  C:\Windows\System\ELCJPgu.exe
  2⤵
  PID:7668
- C:\Windows\System\GPDFlrt.exe
  C:\Windows\System\GPDFlrt.exe
  2⤵
  PID:7684
- C:\Windows\System\aqeUvhI.exe
  C:\Windows\System\aqeUvhI.exe
  2⤵
  PID:7700
- C:\Windows\System\IoKsjjU.exe
  C:\Windows\System\IoKsjjU.exe
  2⤵
  PID:7716
- C:\Windows\System\GaKlNIP.exe
  C:\Windows\System\GaKlNIP.exe
  2⤵
  PID:7732
- C:\Windows\System\fbZDyyh.exe
  C:\Windows\System\fbZDyyh.exe
  2⤵
  PID:7748
- C:\Windows\System\BGXYAXf.exe
  C:\Windows\System\BGXYAXf.exe
  2⤵
  PID:7764
- C:\Windows\System\PPImRUw.exe
  C:\Windows\System\PPImRUw.exe
  2⤵
  PID:7780
- C:\Windows\System\UGnAAPj.exe
  C:\Windows\System\UGnAAPj.exe
  2⤵
  PID:7796
- C:\Windows\System\qbEChsB.exe
  C:\Windows\System\qbEChsB.exe
  2⤵
  PID:7812
- C:\Windows\System\CtfNzRj.exe
  C:\Windows\System\CtfNzRj.exe
  2⤵
  PID:7828
- C:\Windows\System\gcjTsLB.exe
  C:\Windows\System\gcjTsLB.exe
  2⤵
  PID:7844
- C:\Windows\System\yWSJtCw.exe
  C:\Windows\System\yWSJtCw.exe
  2⤵
  PID:7860
- C:\Windows\System\GNdofhD.exe
  C:\Windows\System\GNdofhD.exe
  2⤵
  PID:7876
- C:\Windows\System\EQvtrUN.exe
  C:\Windows\System\EQvtrUN.exe
  2⤵
  PID:7896
- C:\Windows\System\rXBTlRp.exe
  C:\Windows\System\rXBTlRp.exe
  2⤵
  PID:7912
- C:\Windows\System\tjfUdWp.exe
  C:\Windows\System\tjfUdWp.exe
  2⤵
  PID:7928
- C:\Windows\System\HtJRssG.exe
  C:\Windows\System\HtJRssG.exe
  2⤵
  PID:7952
- C:\Windows\System\msHxKEb.exe
  C:\Windows\System\msHxKEb.exe
  2⤵
  PID:7968
- C:\Windows\System\vRAhIKu.exe
  C:\Windows\System\vRAhIKu.exe
  2⤵
  PID:7984
- C:\Windows\System\gvGlcQc.exe
  C:\Windows\System\gvGlcQc.exe
  2⤵
  PID:8000
- C:\Windows\System\iSElTka.exe
  C:\Windows\System\iSElTka.exe
  2⤵
  PID:8016
- C:\Windows\System\SqPGSIx.exe
  C:\Windows\System\SqPGSIx.exe
  2⤵
  PID:8032
- C:\Windows\System\manDjmT.exe
  C:\Windows\System\manDjmT.exe
  2⤵
  PID:8048
- C:\Windows\System\glrxvfV.exe
  C:\Windows\System\glrxvfV.exe
  2⤵
  PID:8064
- C:\Windows\System\FohKMym.exe
  C:\Windows\System\FohKMym.exe
  2⤵
  PID:8080
- C:\Windows\System\ZZfBZcn.exe
  C:\Windows\System\ZZfBZcn.exe
  2⤵
  PID:8096
- C:\Windows\System\sDziZGn.exe
  C:\Windows\System\sDziZGn.exe
  2⤵
  PID:8112
- C:\Windows\System\SngniqJ.exe
  C:\Windows\System\SngniqJ.exe
  2⤵
  PID:8128
- C:\Windows\System\XdXQOpf.exe
  C:\Windows\System\XdXQOpf.exe
  2⤵
  PID:8144
- C:\Windows\System\DumOZAe.exe
  C:\Windows\System\DumOZAe.exe
  2⤵
  PID:8172
- C:\Windows\System\esJMWNc.exe
  C:\Windows\System\esJMWNc.exe
  2⤵
  PID:8188
- C:\Windows\System\RzfbwhU.exe
  C:\Windows\System\RzfbwhU.exe
  2⤵
  PID:7344
- C:\Windows\System\OogCsrI.exe
  C:\Windows\System\OogCsrI.exe
  2⤵
  PID:6992
- C:\Windows\System\ytlUbAc.exe
  C:\Windows\System\ytlUbAc.exe
  2⤵
  PID:7320
- C:\Windows\System\KKotgzL.exe
  C:\Windows\System\KKotgzL.exe
  2⤵
  PID:7376
- C:\Windows\System\IHGAmjq.exe
  C:\Windows\System\IHGAmjq.exe
  2⤵
  PID:7428
- C:\Windows\System\Zxwpdpb.exe
  C:\Windows\System\Zxwpdpb.exe
  2⤵
  PID:7452
- C:\Windows\System\bRWWWzu.exe
  C:\Windows\System\bRWWWzu.exe
  2⤵
  PID:7464
- C:\Windows\System\IZUUWRA.exe
  C:\Windows\System\IZUUWRA.exe
  2⤵
  PID:7472
- C:\Windows\System\ybYOUtA.exe
  C:\Windows\System\ybYOUtA.exe
  2⤵
  PID:7516
- C:\Windows\System\iVooQwC.exe
  C:\Windows\System\iVooQwC.exe
  2⤵
  PID:7548
- C:\Windows\System\YuFcJWL.exe
  C:\Windows\System\YuFcJWL.exe
  2⤵
  PID:7564
- C:\Windows\System\vOmypIy.exe
  C:\Windows\System\vOmypIy.exe
  2⤵
  PID:7588
- C:\Windows\System\ZDgboOr.exe
  C:\Windows\System\ZDgboOr.exe
  2⤵
  PID:7600
- C:\Windows\System\QOSNnwa.exe
  C:\Windows\System\QOSNnwa.exe
  2⤵
  PID:7624
- C:\Windows\System\TLXKjCK.exe
  C:\Windows\System\TLXKjCK.exe
  2⤵
  PID:7632
- C:\Windows\System\IrWIhTX.exe
  C:\Windows\System\IrWIhTX.exe
  2⤵
  PID:7712
- C:\Windows\System\cCidBDL.exe
  C:\Windows\System\cCidBDL.exe
  2⤵
  PID:7776
- C:\Windows\System\UlFvZgc.exe
  C:\Windows\System\UlFvZgc.exe
  2⤵
  PID:7696
- C:\Windows\System\oMdlAxK.exe
  C:\Windows\System\oMdlAxK.exe
  2⤵
  PID:7760
- C:\Windows\System\ouVNxln.exe
  C:\Windows\System\ouVNxln.exe
  2⤵
  PID:7840
- C:\Windows\System\hBYeXwN.exe
  C:\Windows\System\hBYeXwN.exe
  2⤵
  PID:7664
- C:\Windows\System\cnfrggj.exe
  C:\Windows\System\cnfrggj.exe
  2⤵
  PID:7872
- C:\Windows\System\FaZueYS.exe
  C:\Windows\System\FaZueYS.exe
  2⤵
  PID:7940
- C:\Windows\System\sLKBJiR.exe
  C:\Windows\System\sLKBJiR.exe
  2⤵
  PID:8008
- C:\Windows\System\VJTKLVA.exe
  C:\Windows\System\VJTKLVA.exe
  2⤵
  PID:8040
- C:\Windows\System\WIwsVTx.exe
  C:\Windows\System\WIwsVTx.exe
  2⤵
  PID:8108
- C:\Windows\System\ryRAhOj.exe
  C:\Windows\System\ryRAhOj.exe
  2⤵
  PID:7924
- C:\Windows\System\pOBFxjW.exe
  C:\Windows\System\pOBFxjW.exe
  2⤵
  PID:7996
- C:\Windows\System\lGABupA.exe
  C:\Windows\System\lGABupA.exe
  2⤵
  PID:8124
- C:\Windows\System\HuapDJN.exe
  C:\Windows\System\HuapDJN.exe
  2⤵
  PID:8164
- C:\Windows\System\KpgZGuF.exe
  C:\Windows\System\KpgZGuF.exe
  2⤵
  PID:7992
- C:\Windows\System\gXSNCdS.exe
  C:\Windows\System\gXSNCdS.exe
  2⤵
  PID:8060
- C:\Windows\System\QEjGptK.exe
  C:\Windows\System\QEjGptK.exe
  2⤵
  PID:7212
- C:\Windows\System\gpSBzTk.exe
  C:\Windows\System\gpSBzTk.exe
  2⤵
  PID:7276
- C:\Windows\System\JPjWWjP.exe
  C:\Windows\System\JPjWWjP.exe
  2⤵
  PID:7272
- C:\Windows\System\NkSasgN.exe
  C:\Windows\System\NkSasgN.exe
  2⤵
  PID:7196
- C:\Windows\System\RVeLcCv.exe
  C:\Windows\System\RVeLcCv.exe
  2⤵
  PID:7224
- C:\Windows\System\FYlsMid.exe
  C:\Windows\System\FYlsMid.exe
  2⤵
  PID:7328
- C:\Windows\System\YCpdOpy.exe
  C:\Windows\System\YCpdOpy.exe
  2⤵
  PID:7392
- C:\Windows\System\qpEtdvJ.exe
  C:\Windows\System\qpEtdvJ.exe
  2⤵
  PID:7448
- C:\Windows\System\ZkiUEVl.exe
  C:\Windows\System\ZkiUEVl.exe
  2⤵
  PID:7536
- C:\Windows\System\wcXKcVT.exe
  C:\Windows\System\wcXKcVT.exe
  2⤵
  PID:7512
- C:\Windows\System\gINoruj.exe
  C:\Windows\System\gINoruj.exe
  2⤵
  PID:7560
- C:\Windows\System\WESncJV.exe
  C:\Windows\System\WESncJV.exe
  2⤵
  PID:7556
- C:\Windows\System\KPMEAHu.exe
  C:\Windows\System\KPMEAHu.exe
  2⤵
  PID:7708
- C:\Windows\System\rFNmlqX.exe
  C:\Windows\System\rFNmlqX.exe
  2⤵
  PID:7772
- C:\Windows\System\DEtlKOz.exe
  C:\Windows\System\DEtlKOz.exe
  2⤵
  PID:7728
- C:\Windows\System\zsKhblP.exe
  C:\Windows\System\zsKhblP.exe
  2⤵
  PID:7852
- C:\Windows\System\GRpFfYM.exe
  C:\Windows\System\GRpFfYM.exe
  2⤵
  PID:7976
- C:\Windows\System\IDTxbeH.exe
  C:\Windows\System\IDTxbeH.exe
  2⤵
  PID:8140
- C:\Windows\System\JeSXeEW.exe
  C:\Windows\System\JeSXeEW.exe
  2⤵
  PID:8072
- C:\Windows\System\QlNvMga.exe
  C:\Windows\System\QlNvMga.exe
  2⤵
  PID:8092
- C:\Windows\System\kdMZoet.exe
  C:\Windows\System\kdMZoet.exe
  2⤵
  PID:7244
- C:\Windows\System\CIJXCrj.exe
  C:\Windows\System\CIJXCrj.exe
  2⤵
  PID:7208
- C:\Windows\System\ZttxmQr.exe
  C:\Windows\System\ZttxmQr.exe
  2⤵
  PID:7508
- C:\Windows\System\wsOawOe.exe
  C:\Windows\System\wsOawOe.exe
  2⤵
  PID:7744
- C:\Windows\System\RLPIhOt.exe
  C:\Windows\System\RLPIhOt.exe
  2⤵
  PID:8160
- C:\Windows\System\fzwfukP.exe
  C:\Windows\System\fzwfukP.exe
  2⤵
  PID:7620
- C:\Windows\System\xeHlKfA.exe
  C:\Windows\System\xeHlKfA.exe
  2⤵
  PID:7240
- C:\Windows\System\tOaoHDR.exe
  C:\Windows\System\tOaoHDR.exe
  2⤵
  PID:7808
- C:\Windows\System\PmDYUOZ.exe
  C:\Windows\System\PmDYUOZ.exe
  2⤵
  PID:7304
- C:\Windows\System\WgaYyRJ.exe
  C:\Windows\System\WgaYyRJ.exe
  2⤵
  PID:7936
- C:\Windows\System\HetdTFV.exe
  C:\Windows\System\HetdTFV.exe
  2⤵
  PID:7412
- C:\Windows\System\UUEQhYX.exe
  C:\Windows\System\UUEQhYX.exe
  2⤵
  PID:7960
- C:\Windows\System\qIMKSax.exe
  C:\Windows\System\qIMKSax.exe
  2⤵
  PID:8056
- C:\Windows\System\TFDkeXQ.exe
  C:\Windows\System\TFDkeXQ.exe
  2⤵
  PID:5480
- C:\Windows\System\oZOAULF.exe
  C:\Windows\System\oZOAULF.exe
  2⤵
  PID:7836
- C:\Windows\System\ZMSDlXA.exe
  C:\Windows\System\ZMSDlXA.exe
  2⤵
  PID:7528
- C:\Windows\System\MXMNQXk.exe
  C:\Windows\System\MXMNQXk.exe
  2⤵
  PID:7964
- C:\Windows\System\dPqSywu.exe
  C:\Windows\System\dPqSywu.exe
  2⤵
  PID:7292
- C:\Windows\System\dRLczdx.exe
  C:\Windows\System\dRLczdx.exe
  2⤵
  PID:7596
- C:\Windows\System\eaTkKsW.exe
  C:\Windows\System\eaTkKsW.exe
  2⤵
  PID:7692
- C:\Windows\System\RnpPvaF.exe
  C:\Windows\System\RnpPvaF.exe
  2⤵
  PID:8260
- C:\Windows\System\gcZUleP.exe
  C:\Windows\System\gcZUleP.exe
  2⤵
  PID:8524
- C:\Windows\System\IjmzgWb.exe
  C:\Windows\System\IjmzgWb.exe
  2⤵
  PID:8644
- C:\Windows\System\VKKkauP.exe
  C:\Windows\System\VKKkauP.exe
  2⤵
  PID:8684
- C:\Windows\System\tGyETTZ.exe
  C:\Windows\System\tGyETTZ.exe
  2⤵
  PID:8716
- C:\Windows\System\Zqmxrtk.exe
  C:\Windows\System\Zqmxrtk.exe
  2⤵
  PID:8732
- C:\Windows\System\XIvOUpL.exe
  C:\Windows\System\XIvOUpL.exe
  2⤵
  PID:8752
- C:\Windows\System\hxhxugU.exe
  C:\Windows\System\hxhxugU.exe
  2⤵
  PID:8768
- C:\Windows\System\JYYMDtE.exe
  C:\Windows\System\JYYMDtE.exe
  2⤵
  PID:8784
- C:\Windows\System\jCOtsBR.exe
  C:\Windows\System\jCOtsBR.exe
  2⤵
  PID:8800
- C:\Windows\System\EqIOgVP.exe
  C:\Windows\System\EqIOgVP.exe
  2⤵
  PID:8816
- C:\Windows\System\TkEjQyf.exe
  C:\Windows\System\TkEjQyf.exe
  2⤵
  PID:8832
- C:\Windows\System\uggJFEM.exe
  C:\Windows\System\uggJFEM.exe
  2⤵
  PID:8848
- C:\Windows\System\vwvxhpQ.exe
  C:\Windows\System\vwvxhpQ.exe
  2⤵
  PID:8864
- C:\Windows\System\DcnGGMZ.exe
  C:\Windows\System\DcnGGMZ.exe
  2⤵
  PID:8904
- C:\Windows\System\FwspGag.exe
  C:\Windows\System\FwspGag.exe
  2⤵
  PID:8960
- C:\Windows\System\wptpFuU.exe
  C:\Windows\System\wptpFuU.exe
  2⤵
  PID:8984
- C:\Windows\System\skJsJMB.exe
  C:\Windows\System\skJsJMB.exe
  2⤵
  PID:9000
- C:\Windows\System\lQpIVMP.exe
  C:\Windows\System\lQpIVMP.exe
  2⤵
  PID:9032
- C:\Windows\System\zZdtYJZ.exe
  C:\Windows\System\zZdtYJZ.exe
  2⤵
  PID:9048
- C:\Windows\System\RrCbsJd.exe
  C:\Windows\System\RrCbsJd.exe
  2⤵
  PID:9084
- C:\Windows\System\GNyrUBs.exe
  C:\Windows\System\GNyrUBs.exe
  2⤵
  PID:8372
- C:\Windows\System\jaNYape.exe
  C:\Windows\System\jaNYape.exe
  2⤵
  PID:8432
- C:\Windows\System\zkndCKj.exe
  C:\Windows\System\zkndCKj.exe
  2⤵
  PID:8448
- C:\Windows\System\FtMDZiI.exe
  C:\Windows\System\FtMDZiI.exe
  2⤵
  PID:8468
- C:\Windows\System\zgNJVTs.exe
  C:\Windows\System\zgNJVTs.exe
  2⤵
  PID:8484
- C:\Windows\System\IQlWUHi.exe
  C:\Windows\System\IQlWUHi.exe
  2⤵
  PID:8504
- C:\Windows\System\SQXFofm.exe
  C:\Windows\System\SQXFofm.exe
  2⤵
  PID:8532
- C:\Windows\System\xRNqooQ.exe
  C:\Windows\System\xRNqooQ.exe
  2⤵
  PID:7504
- C:\Windows\System\XQtNgMM.exe
  C:\Windows\System\XQtNgMM.exe
  2⤵
  PID:8668
- C:\Windows\System\dVWUfua.exe
  C:\Windows\System\dVWUfua.exe
  2⤵
  PID:8696
- C:\Windows\System\fsHPAPo.exe
  C:\Windows\System\fsHPAPo.exe
  2⤵
  PID:8556
- C:\Windows\System\SLalmoh.exe
  C:\Windows\System\SLalmoh.exe
  2⤵
  PID:8612
- C:\Windows\System\gcddDxP.exe
  C:\Windows\System\gcddDxP.exe
  2⤵
  PID:8628
- C:\Windows\System\KjBrJor.exe
  C:\Windows\System\KjBrJor.exe
  2⤵
  PID:8824
- C:\Windows\System\oszIbgc.exe
  C:\Windows\System\oszIbgc.exe
  2⤵
  PID:8608
- C:\Windows\System\RJSOLnY.exe
  C:\Windows\System\RJSOLnY.exe
  2⤵
  PID:8844
- C:\Windows\System\opCdtPy.exe
  C:\Windows\System\opCdtPy.exe
  2⤵
  PID:8776
- C:\Windows\System\gCGAAYD.exe
  C:\Windows\System\gCGAAYD.exe
  2⤵
  PID:8876
- C:\Windows\System\yHzGicb.exe
  C:\Windows\System\yHzGicb.exe
  2⤵
  PID:8892
- C:\Windows\System\kvwreLS.exe
  C:\Windows\System\kvwreLS.exe
  2⤵
  PID:8920
- C:\Windows\System\mTlZvHt.exe
  C:\Windows\System\mTlZvHt.exe
  2⤵
  PID:8944
- C:\Windows\System\qDVbPhl.exe
  C:\Windows\System\qDVbPhl.exe
  2⤵
  PID:8992
- C:\Windows\System\ddqdevB.exe
  C:\Windows\System\ddqdevB.exe
  2⤵
  PID:8972
- C:\Windows\System\eNdLsQS.exe
  C:\Windows\System\eNdLsQS.exe
  2⤵
  PID:8976
- C:\Windows\System\yuoRzXW.exe
  C:\Windows\System\yuoRzXW.exe
  2⤵
  PID:9028
- C:\Windows\System\PmbWGIa.exe
  C:\Windows\System\PmbWGIa.exe
  2⤵
  PID:9080
- C:\Windows\System\DbsnUqy.exe
  C:\Windows\System\DbsnUqy.exe
  2⤵
  PID:9100
- C:\Windows\System\GaLYmix.exe
  C:\Windows\System\GaLYmix.exe
  2⤵
  PID:9124
- C:\Windows\System\moaXHWN.exe
  C:\Windows\System\moaXHWN.exe
  2⤵
  PID:9140
- C:\Windows\System\tKltpMw.exe
  C:\Windows\System\tKltpMw.exe
  2⤵
  PID:9160
- C:\Windows\System\ilifzKi.exe
  C:\Windows\System\ilifzKi.exe
  2⤵
  PID:9176
- C:\Windows\System\umdjGJb.exe
  C:\Windows\System\umdjGJb.exe
  2⤵
  PID:8272
- C:\Windows\System\KKzdIaa.exe
  C:\Windows\System\KKzdIaa.exe
  2⤵
  PID:8204
- C:\Windows\System\SDcqieh.exe
  C:\Windows\System\SDcqieh.exe
  2⤵
  PID:8252
- C:\Windows\System\QqrMfLH.exe
  C:\Windows\System\QqrMfLH.exe
  2⤵
  PID:8236
- C:\Windows\System\yYWpnVd.exe
  C:\Windows\System\yYWpnVd.exe
  2⤵
  PID:8212
- C:\Windows\System\xzIdIzB.exe
  C:\Windows\System\xzIdIzB.exe
  2⤵
  PID:8296
- C:\Windows\System\YaByPoW.exe
  C:\Windows\System\YaByPoW.exe
  2⤵
  PID:8312
- C:\Windows\System\wtmmsNw.exe
  C:\Windows\System\wtmmsNw.exe
  2⤵
  PID:8340
- C:\Windows\System\ZLBUefI.exe
  C:\Windows\System\ZLBUefI.exe
  2⤵
  PID:8336
- C:\Windows\System\hJBsuNB.exe
  C:\Windows\System\hJBsuNB.exe
  2⤵
  PID:8364
- C:\Windows\System\JmMdNGm.exe
  C:\Windows\System\JmMdNGm.exe
  2⤵
  PID:8392
- C:\Windows\System\LIqnBrp.exe
  C:\Windows\System\LIqnBrp.exe
  2⤵
  PID:8408
- C:\Windows\System\IXoPUQl.exe
  C:\Windows\System\IXoPUQl.exe
  2⤵
  PID:8428
- C:\Windows\System\xcZafYR.exe
  C:\Windows\System\xcZafYR.exe
  2⤵
  PID:8456
- C:\Windows\System\BzQSagC.exe
  C:\Windows\System\BzQSagC.exe
  2⤵
  PID:8476
- C:\Windows\System\ziQfueb.exe
  C:\Windows\System\ziQfueb.exe
  2⤵
  PID:8656
- C:\Windows\System\GPfCuvY.exe
  C:\Windows\System\GPfCuvY.exe
  2⤵
  PID:8676
- C:\Windows\System\SlMaIkR.exe
  C:\Windows\System\SlMaIkR.exe
  2⤵
  PID:8724
- C:\Windows\System\xrFIkBR.exe
  C:\Windows\System\xrFIkBR.exe
  2⤵
  PID:8632
- C:\Windows\System\tVfVaki.exe
  C:\Windows\System\tVfVaki.exe
  2⤵
  PID:8744
- C:\Windows\System\aysksRH.exe
  C:\Windows\System\aysksRH.exe
  2⤵
  PID:8708
- C:\Windows\System\kNnVXGL.exe
  C:\Windows\System\kNnVXGL.exe
  2⤵
  PID:8884
- C:\Windows\System\RPAoioz.exe
  C:\Windows\System\RPAoioz.exe
  2⤵
  PID:8912
- C:\Windows\System\KtclKAa.exe
  C:\Windows\System\KtclKAa.exe
  2⤵
  PID:8952
- C:\Windows\System\ZUqrmgb.exe
  C:\Windows\System\ZUqrmgb.exe
  2⤵
  PID:9016
- C:\Windows\System\xnccNwn.exe
  C:\Windows\System\xnccNwn.exe
  2⤵
  PID:9132
- C:\Windows\System\ATkwTkY.exe
  C:\Windows\System\ATkwTkY.exe
  2⤵
  PID:8424
- C:\Windows\System\cOFIvOo.exe
  C:\Windows\System\cOFIvOo.exe
  2⤵
  PID:9076
- C:\Windows\System\kpNJoRH.exe
  C:\Windows\System\kpNJoRH.exe
  2⤵
  PID:9024
- C:\Windows\System\UWUPQUh.exe
  C:\Windows\System\UWUPQUh.exe
  2⤵
  PID:9188
- C:\Windows\System\MrRAqkn.exe
  C:\Windows\System\MrRAqkn.exe
  2⤵
  PID:9204
- C:\Windows\System\oDpKlJr.exe
  C:\Windows\System\oDpKlJr.exe
  2⤵
  PID:8256
- C:\Windows\System\XzwImEz.exe
  C:\Windows\System\XzwImEz.exe
  2⤵
  PID:8284
- C:\Windows\System\iADKqvr.exe
  C:\Windows\System\iADKqvr.exe
  2⤵
  PID:8320
- C:\Windows\System\nBxIvsB.exe
  C:\Windows\System\nBxIvsB.exe
  2⤵
  PID:8200
- C:\Windows\System\hTPYPnF.exe
  C:\Windows\System\hTPYPnF.exe
  2⤵
  PID:8400
- C:\Windows\System\pJfJDRy.exe
  C:\Windows\System\pJfJDRy.exe
  2⤵
  PID:8436
- C:\Windows\System\FBCvDLy.exe
  C:\Windows\System\FBCvDLy.exe
  2⤵
  PID:8332
- C:\Windows\System\bsxeMRY.exe
  C:\Windows\System\bsxeMRY.exe
  2⤵
  PID:8500
- C:\Windows\System\vkygmjp.exe
  C:\Windows\System\vkygmjp.exe
  2⤵
  PID:8828
- C:\Windows\System\cbrtcyO.exe
  C:\Windows\System\cbrtcyO.exe
  2⤵
  PID:8592
- C:\Windows\System\BPyPqPi.exe
  C:\Windows\System\BPyPqPi.exe
  2⤵
  PID:8812
- C:\Windows\System\UgBmlTb.exe
  C:\Windows\System\UgBmlTb.exe
  2⤵
  PID:9044
- C:\Windows\System\WNZLIJY.exe
  C:\Windows\System\WNZLIJY.exe
  2⤵
  PID:8916
- C:\Windows\System\nBoCaFR.exe
  C:\Windows\System\nBoCaFR.exe
  2⤵
  PID:9168
- C:\Windows\System\phTjfpI.exe
  C:\Windows\System\phTjfpI.exe
  2⤵
  PID:9192
- C:\Windows\System\cFZGuZt.exe
  C:\Windows\System\cFZGuZt.exe
  2⤵
  PID:8344
- C:\Windows\System\OwNZDRm.exe
  C:\Windows\System\OwNZDRm.exe
  2⤵
  PID:9148
- C:\Windows\System\iBieKTf.exe
  C:\Windows\System\iBieKTf.exe
  2⤵
  PID:8292
- C:\Windows\System\hcFcrXw.exe
  C:\Windows\System\hcFcrXw.exe
  2⤵
  PID:9012
- C:\Windows\System\rauurtr.exe
  C:\Windows\System\rauurtr.exe
  2⤵
  PID:8624
- C:\Windows\System\KDudMOf.exe
  C:\Windows\System\KDudMOf.exe
  2⤵
  PID:8536
- C:\Windows\System\RgwpszY.exe
  C:\Windows\System\RgwpszY.exe
  2⤵
  PID:8792
- C:\Windows\System\eAtWOPz.exe
  C:\Windows\System\eAtWOPz.exe
  2⤵
  PID:9208
- C:\Windows\System\WkZPiBu.exe
  C:\Windows\System\WkZPiBu.exe
  2⤵
  PID:8600
- C:\Windows\System\ykxffYQ.exe
  C:\Windows\System\ykxffYQ.exe
  2⤵
  PID:9120
- C:\Windows\System\eadxwyY.exe
  C:\Windows\System\eadxwyY.exe
  2⤵
  PID:8740
- C:\Windows\System\moARKVZ.exe
  C:\Windows\System\moARKVZ.exe
  2⤵
  PID:8280
- C:\Windows\System\LMkxPwP.exe
  C:\Windows\System\LMkxPwP.exe
  2⤵
  PID:8304
- C:\Windows\System\xBJvlmD.exe
  C:\Windows\System\xBJvlmD.exe
  2⤵
  PID:8244
- C:\Windows\System\IINUoXT.exe
  C:\Windows\System\IINUoXT.exe
  2⤵
  PID:8492
- C:\Windows\System\jyblRME.exe
  C:\Windows\System\jyblRME.exe
  2⤵
  PID:8680
- C:\Windows\System\hWoyerU.exe
  C:\Windows\System\hWoyerU.exe
  2⤵
  PID:9104
- C:\Windows\System\cDzDVSl.exe
  C:\Windows\System\cDzDVSl.exe
  2⤵
  PID:8240
- C:\Windows\System\TEnFIoK.exe
  C:\Windows\System\TEnFIoK.exe
  2⤵
  PID:8872
- C:\Windows\System\HFcvIdm.exe
  C:\Windows\System\HFcvIdm.exe
  2⤵
  PID:8384
- C:\Windows\System\DSKelzy.exe
  C:\Windows\System\DSKelzy.exe
  2⤵
  PID:8512
- C:\Windows\System\iOAWSRw.exe
  C:\Windows\System\iOAWSRw.exe
  2⤵
  PID:9040
- C:\Windows\System\KcFVXdE.exe
  C:\Windows\System\KcFVXdE.exe
  2⤵
  PID:8932
- C:\Windows\System\iDmYSHX.exe
  C:\Windows\System\iDmYSHX.exe
  2⤵
  PID:9156
- C:\Windows\System\LyFwIPl.exe
  C:\Windows\System\LyFwIPl.exe
  2⤵
  PID:8660
- C:\Windows\System\XLjWdkL.exe
  C:\Windows\System\XLjWdkL.exe
  2⤵
  PID:8356
- C:\Windows\System\ZuRmorN.exe
  C:\Windows\System\ZuRmorN.exe
  2⤵
  PID:8416
- C:\Windows\System\ePtnjLa.exe
  C:\Windows\System\ePtnjLa.exe
  2⤵
  PID:9228
- C:\Windows\System\fVHAHez.exe
  C:\Windows\System\fVHAHez.exe
  2⤵
  PID:9244
- C:\Windows\System\hPcUFWh.exe
  C:\Windows\System\hPcUFWh.exe
  2⤵
  PID:9272
- C:\Windows\System\svItnUp.exe
  C:\Windows\System\svItnUp.exe
  2⤵
  PID:9288
- C:\Windows\System\MKUbMGI.exe
  C:\Windows\System\MKUbMGI.exe
  2⤵
  PID:9308
- C:\Windows\System\dkwmhbg.exe
  C:\Windows\System\dkwmhbg.exe
  2⤵
  PID:9328
- C:\Windows\System\xyijXUX.exe
  C:\Windows\System\xyijXUX.exe
  2⤵
  PID:9344
- C:\Windows\System\KCrUKjw.exe
  C:\Windows\System\KCrUKjw.exe
  2⤵
  PID:9384
- C:\Windows\System\zMPYjYd.exe
  C:\Windows\System\zMPYjYd.exe
  2⤵
  PID:9400
- C:\Windows\System\KAvJpjo.exe
  C:\Windows\System\KAvJpjo.exe
  2⤵
  PID:9416
- C:\Windows\System\TGgoPpy.exe
  C:\Windows\System\TGgoPpy.exe
  2⤵
  PID:9436
- C:\Windows\System\AHwMyaK.exe
  C:\Windows\System\AHwMyaK.exe
  2⤵
  PID:9456
- C:\Windows\System\wxPAvye.exe
  C:\Windows\System\wxPAvye.exe
  2⤵
  PID:9480
- C:\Windows\System\NkJjDYG.exe
  C:\Windows\System\NkJjDYG.exe
  2⤵
  PID:9500
- C:\Windows\System\RyZwxPj.exe
  C:\Windows\System\RyZwxPj.exe
  2⤵
  PID:9520
- C:\Windows\System\eSUEQLw.exe
  C:\Windows\System\eSUEQLw.exe
  2⤵
  PID:9536
- C:\Windows\System\HfPjjlh.exe
  C:\Windows\System\HfPjjlh.exe
  2⤵
  PID:9556
- C:\Windows\System\bcZxzkx.exe
  C:\Windows\System\bcZxzkx.exe
  2⤵
  PID:9572
- C:\Windows\System\ceCFUGy.exe
  C:\Windows\System\ceCFUGy.exe
  2⤵
  PID:9588
- C:\Windows\System\PVhVWVp.exe
  C:\Windows\System\PVhVWVp.exe
  2⤵
  PID:9608
- C:\Windows\System\rJztMHn.exe
  C:\Windows\System\rJztMHn.exe
  2⤵
  PID:9624
- C:\Windows\System\aNmteFG.exe
  C:\Windows\System\aNmteFG.exe
  2⤵
  PID:9660
- C:\Windows\System\tKjYlig.exe
  C:\Windows\System\tKjYlig.exe
  2⤵
  PID:9676
- C:\Windows\System\LElTcue.exe
  C:\Windows\System\LElTcue.exe
  2⤵
  PID:9700
- C:\Windows\System\zeeerzA.exe
  C:\Windows\System\zeeerzA.exe
  2⤵
  PID:9716
- C:\Windows\System\lhZIcvw.exe
  C:\Windows\System\lhZIcvw.exe
  2⤵
  PID:9744
- C:\Windows\System\cUmVwvZ.exe
  C:\Windows\System\cUmVwvZ.exe
  2⤵
  PID:9760
- C:\Windows\System\SJevHuD.exe
  C:\Windows\System\SJevHuD.exe
  2⤵
  PID:9780
- C:\Windows\System\RkzclOM.exe
  C:\Windows\System\RkzclOM.exe
  2⤵
  PID:9796
- C:\Windows\System\KLVeiNx.exe
  C:\Windows\System\KLVeiNx.exe
  2⤵
  PID:9816
- C:\Windows\System\ofVsHNY.exe
  C:\Windows\System\ofVsHNY.exe
  2⤵
  PID:9832
- C:\Windows\System\YSdaIcR.exe
  C:\Windows\System\YSdaIcR.exe
  2⤵
  PID:9852
- C:\Windows\System\PTJWXsb.exe
  C:\Windows\System\PTJWXsb.exe
  2⤵
  PID:9872
- C:\Windows\System\KWsvunW.exe
  C:\Windows\System\KWsvunW.exe
  2⤵
  PID:9888
- C:\Windows\System\vLGWEEd.exe
  C:\Windows\System\vLGWEEd.exe
  2⤵
  PID:9928
- C:\Windows\System\VKKcksg.exe
  C:\Windows\System\VKKcksg.exe
  2⤵
  PID:9948
- C:\Windows\System\tnkXLUm.exe
  C:\Windows\System\tnkXLUm.exe
  2⤵
  PID:9964
- C:\Windows\System\jHLjIHn.exe
  C:\Windows\System\jHLjIHn.exe
  2⤵
  PID:9984
- C:\Windows\System\VrPDSPL.exe
  C:\Windows\System\VrPDSPL.exe
  2⤵
  PID:10000
- C:\Windows\System\AiOdxPA.exe
  C:\Windows\System\AiOdxPA.exe
  2⤵
  PID:10016
- C:\Windows\System\uPogkMy.exe
  C:\Windows\System\uPogkMy.exe
  2⤵
  PID:10044
- C:\Windows\System\cUFSyJN.exe
  C:\Windows\System\cUFSyJN.exe
  2⤵
  PID:10060
- C:\Windows\System\JZJbbYZ.exe
  C:\Windows\System\JZJbbYZ.exe
  2⤵
  PID:10088
- C:\Windows\System\nhlbEiQ.exe
  C:\Windows\System\nhlbEiQ.exe
  2⤵
  PID:10108
- C:\Windows\System\xjEbxPH.exe
  C:\Windows\System\xjEbxPH.exe
  2⤵
  PID:10124
- C:\Windows\System\qlvTciP.exe
  C:\Windows\System\qlvTciP.exe
  2⤵
  PID:10140
- C:\Windows\System\DbRPSax.exe
  C:\Windows\System\DbRPSax.exe
  2⤵
  PID:10156
- C:\Windows\System\chEkoPQ.exe
  C:\Windows\System\chEkoPQ.exe
  2⤵
  PID:10172
- C:\Windows\System\fVZInEj.exe
  C:\Windows\System\fVZInEj.exe
  2⤵
  PID:10188
- C:\Windows\System\YYXcYDU.exe
  C:\Windows\System\YYXcYDU.exe
  2⤵
  PID:10204
- C:\Windows\System\FzJtOaF.exe
  C:\Windows\System\FzJtOaF.exe
  2⤵
  PID:10232
- C:\Windows\System\FRMBhnx.exe
  C:\Windows\System\FRMBhnx.exe
  2⤵
  PID:9252
- C:\Windows\System\bCoaWqB.exe
  C:\Windows\System\bCoaWqB.exe
  2⤵
  PID:9284
- C:\Windows\System\aSwbFvi.exe
  C:\Windows\System\aSwbFvi.exe
  2⤵
  PID:9316
- C:\Windows\System\BOpzJMA.exe
  C:\Windows\System\BOpzJMA.exe
  2⤵
  PID:9368
- C:\Windows\System\rkXxyPa.exe
  C:\Windows\System\rkXxyPa.exe
  2⤵
  PID:9392
- C:\Windows\System\HPLlCFl.exe
  C:\Windows\System\HPLlCFl.exe
  2⤵
  PID:9412
- C:\Windows\System\pbDVwkf.exe
  C:\Windows\System\pbDVwkf.exe
  2⤵
  PID:9448
- C:\Windows\System\SXRaJfa.exe
  C:\Windows\System\SXRaJfa.exe
  2⤵
  PID:9492
- C:\Windows\System\jwCmImq.exe
  C:\Windows\System\jwCmImq.exe
  2⤵
  PID:9516
- C:\Windows\System\xwOSxWK.exe
  C:\Windows\System\xwOSxWK.exe
  2⤵
  PID:9616
- C:\Windows\System\CFGLvfk.exe
  C:\Windows\System\CFGLvfk.exe
  2⤵
  PID:9656
- C:\Windows\System\SPdXcFF.exe
  C:\Windows\System\SPdXcFF.exe
  2⤵
  PID:9532
- C:\Windows\System\nOEiOGy.exe
  C:\Windows\System\nOEiOGy.exe
  2⤵
  PID:9668
- C:\Windows\System\OQChSbH.exe
  C:\Windows\System\OQChSbH.exe
  2⤵
  PID:9684
- C:\Windows\System\clWeAyK.exe
  C:\Windows\System\clWeAyK.exe
  2⤵
  PID:9708
- C:\Windows\System\pAogVkv.exe
  C:\Windows\System\pAogVkv.exe
  2⤵
  PID:9736
- C:\Windows\System\TrlHtKv.exe
  C:\Windows\System\TrlHtKv.exe
  2⤵
  PID:9792
- C:\Windows\System\tNyDyDd.exe
  C:\Windows\System\tNyDyDd.exe
  2⤵
  PID:9868
- C:\Windows\System\WHwjjUd.exe
  C:\Windows\System\WHwjjUd.exe
  2⤵
  PID:9884
- C:\Windows\System\QdZDbnG.exe
  C:\Windows\System\QdZDbnG.exe
  2⤵
  PID:9844
- C:\Windows\System\IWCEpeF.exe
  C:\Windows\System\IWCEpeF.exe
  2⤵
  PID:9804
- C:\Windows\System\UrrqNyz.exe
  C:\Windows\System\UrrqNyz.exe
  2⤵
  PID:9940
- C:\Windows\System\wCzIqSB.exe
  C:\Windows\System\wCzIqSB.exe
  2⤵
  PID:9972
- C:\Windows\System\HdVhApC.exe
  C:\Windows\System\HdVhApC.exe
  2⤵
  PID:9996
- C:\Windows\System\CPVpPKl.exe
  C:\Windows\System\CPVpPKl.exe
  2⤵
  PID:10036
- C:\Windows\System\hDqqKqz.exe
  C:\Windows\System\hDqqKqz.exe
  2⤵
  PID:10080
- C:\Windows\System\pQTBVOB.exe
  C:\Windows\System\pQTBVOB.exe
  2⤵
  PID:10104
- C:\Windows\System\xbfgDkk.exe
  C:\Windows\System\xbfgDkk.exe
  2⤵
  PID:10180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BGHkJDD.exe

Filesize
2.0MB

MD5
cfa3cd2d36c85810ac7b52c28186eb4f

SHA1
fb5ce5bd3a266c34cabfd7f816361c63c1259f47

SHA256
64ce6b2365ac06eee30cadcf61d919d24c25d10656978eb7a41c044ffe6789d8

SHA512
fece4894af1f029013fa93c3a2dad464328bc63cf1bbdda0936efd677f64328f07838ab32ec109012e0870755659d77c7a6b083b1c42b8d98762015650d604bc

Download Submit
C:\Windows\system\BYzkbin.exe

Filesize
2.0MB

MD5
ae22d8e1249f4729263c33d4bca8574c

SHA1
835fc2ccc59366ae543a4ba3da5aa61c2f58db81

SHA256
c96ab99fe5b9fa56d93b22ad69f43933c2c7df1827e71c17d971e9eea72f14b9

SHA512
c62d50763bd671c336156beacd62319c375eccac6074acb9a2da93eef36bbc1a3f4b9661e7e742c3fb743d1b5f3a2534cb7e8eb99aeecad331066db64378ae4f

Download Submit
C:\Windows\system\EiGfLsB.exe

Filesize
2.0MB

MD5
e84961c6dc396613fadc3d5d86b126f1

SHA1
a1188277c7e9b04db49be93daf78af3b1f74f8b0

SHA256
4481bfaadaebf482f5f61f8920fc2a6afbd8c91b16e672df0b712c1855a344c0

SHA512
901499aeb200e180d906d3693e223a22ad08fd2325be2d04f4cdaaf2584e28a8b18f3e60247eca67ea61498f4063112571cf76eed7701b9325efe56e38869433

Download Submit
C:\Windows\system\HZalzhP.exe

Filesize
2.0MB

MD5
4de488d479a63ba920e102f6c4c1c1c0

SHA1
6278cd49af103fe6c6ea83f6a0e238796d02bdc3

SHA256
888427a12a2d8aa8c5f4f47d1f0a407191cff6ce93648bccaca3cd44645081ed

SHA512
2b2f6f195bba3a694a210c9913562ead833f669c326b3074d2e3878cd882cdd87baddc04400e1cac562de544aff4b9eceb6a8c99f3cb3e3c376a9ec827fd6fc5

Download Submit
C:\Windows\system\LddgjmP.exe

Filesize
2.0MB

MD5
56febbd328435665486d1c59b4daaddd

SHA1
726769d323b04b09041f2bbafab8667d8f2b98a4

SHA256
b0ece03f40a6e38a1573d9e2e4c728138a2e9307c6574ec50c97b2af360635ad

SHA512
9ac4a178c405f855fb920abe9698119a27ec86fec6a0c9181b0ef1f9d0c1d3016922236339d60822a9d5d5660e0fc626994da9dd6cfd87ebfe64d225dc5724ac

Download Submit
C:\Windows\system\NXUeqXm.exe

Filesize
2.0MB

MD5
821638152ce16efa30c9f804190c4ef7

SHA1
dedfafdfc5b96fa28239a77aafb9ef269b17040a

SHA256
12222e8348d308a2808aeddf42c103d3ff459a4d18350926d98d825489667459

SHA512
f8d1ed1ad459ee35e89657ee2bfdc006a58aa6e59b8de1825c217783283d6ceee90d726344d510dbe9428ab2e423778b778b76874fc35565496a1d9ee8756e66

Download Submit
C:\Windows\system\NyIZWKO.exe

Filesize
2.0MB

MD5
87d543acc10223081bf39dab5e4ed872

SHA1
bb6d62fdc35d231eaf2abc4628dbab387a6e377a

SHA256
8c0ce48d733e835f1becbaceba2a26112c3f97713cb2bc39bbbacb33e1c2abb9

SHA512
a5b46a8003eb5724070637a6913c4af5caf21708c83b29228b692208263a223b931f8546c297ec1df6bb36992308d8595bbf283dc5a88d594b0d435ed43c3f32

Download Submit
C:\Windows\system\OrnJmRf.exe

Filesize
2.0MB

MD5
43c7f986b643dd7c0095f6f5979f7a02

SHA1
145136c7d7b53b70795cb8d2cf8389d87a669ba9

SHA256
94fdbbc8a23b59bde6342fd26f3d781933ac91ce2753b773f537aee7485f1ed2

SHA512
b2bf8bd0dc3b465c2ae9e2417caaec8892753bd84d8418318067487a8a21234a1ad7bc575351d898e3a5a8a9bf90e0c1375bda3b90d083b21508986dfcf2abe4

Download Submit
C:\Windows\system\SRUPyTd.exe

Filesize
2.0MB

MD5
e4e125bc012cafca3df6bd1525e1e958

SHA1
448f831d37c3fbd80dba398f8f8e2a3114d5bf85

SHA256
5f4ce0a6b3436e722ac2a985f9fc2d57058bbc92e9d8cb81e23581df4320a830

SHA512
f84d6e22cb4b81a99f3ddd4edd632d6be0effa382f89e8fad75b1c3ed4a69f15fc75829bae6f3d5a4aef5b954fceb5d529f9f093ef897f67f1f6821848a246c2

Download Submit
C:\Windows\system\ViIngcq.exe

Filesize
2.0MB

MD5
e436801924cf7ebcae2317a11808b791

SHA1
37743d054dcaea44f21e66fcbe7abf02b2323fef

SHA256
4ab7b14ecb7f3ac47b4413742cf2106f965c0c2ce3a9c0725f5dbea5d09e2068

SHA512
aca41dc3f8b3a66cf9daa6b3db9ed46a79c36f355f67c2a63a196d896a4f96833b0d911f6a1292347f60bedea93533bf932c6178ec70283d86991b6f7902cf24

Download Submit
C:\Windows\system\WHOaQTE.exe

Filesize
2.0MB

MD5
2ad49813e8e44c4be3ead18bb69704a3

SHA1
22ab966f0da12866b9b0e6fe41a14e6c02ddf089

SHA256
22117d55234502f3fd91aa26b9334ddc6e44c7100ca7a1e7bc419cd54c20f3db

SHA512
7f4b524f263935cf57663e839fcd3df0a101a4284b9010b9082aceb13c8d06d6d857ae3fa299d1dc6326de65aca1c2fdeff88499ef170ef9da0b298d976fcbf8

Download Submit
C:\Windows\system\XmeXewg.exe

Filesize
2.0MB

MD5
90d7f048a1759b08a023dbff74e27964

SHA1
eb7558107ae13fb004b15d6dea398ca30e7360f7

SHA256
8c5ca209aa5ab26bcbf8dc0f5f6116a9778476e888741d2d538e6148e3bb3b00

SHA512
530d234e29b7d89008ec1c6a537b055ea9122f356fc235ac11ad2e2eb4763d2402a2b0c906618780494d6729e17c17a23dfb07f8e09cf36a47a003d95a754974

Download Submit
C:\Windows\system\XxjXuYA.exe

Filesize
2.0MB

MD5
10589e7494ffa7507628e6b70fb34b10

SHA1
8eb8d0e6e4b64f077fb00c4da13f829f60695224

SHA256
48baada32f97285400967ef000b49724db8d217bde19174c480f2941ea8ccf92

SHA512
27a944e60d036db247ddf44a2678777be50076c4928a70f836b3d739b87c25819c3da61dc693cb64f991eb009ea542a023886beebc6ebbc5bcaff7d2a43b2119

Download Submit
C:\Windows\system\apMndpp.exe

Filesize
2.0MB

MD5
137b0e2a821acb87a09e6377bdc2dcee

SHA1
f286b7fa973dd056414d5b8b2773f27aa4e37782

SHA256
537b9d6b08868fa294fa5a7951a490d652c8ef4662bd14e4c8389467f1aeb3c6

SHA512
df36b2eb73cb4d1e064934b3684cd7c857cd321d2bc0068777552d9d882caa5b10f8d7e20fb4052b67214d37cc29a505dc1224cd8029b5b79d240d8a99b9e6ca

Download Submit
C:\Windows\system\dvjyPwA.exe

Filesize
2.0MB

MD5
ed3951cf2c3cf4cc3c6ad98c100c06c1

SHA1
00eab4fbe08247de446264d59d3b42393f64eb78

SHA256
cd4a2043095f19856436da3acb4e73da2835f838c6af722ce9a1771ce072f705

SHA512
2a9924c1899d27115d745e0cc200e51f1185bd31b1b3211b070a88c3839b1305629b3d6bd34dce3b36d1285b075f42d5e869f332571179fa77a4a14a23cffdde

Download Submit
C:\Windows\system\efyOsbl.exe

Filesize
2.0MB

MD5
cd504b81231efdb6d11d870a46c679ab

SHA1
579d15896f696ad78b8dfa7c53bdd97064e66538

SHA256
dbfb86a52c6e7b410f8aee3b43f910d52c26012c738f61d8309d5eef6ee63249

SHA512
12335848d424654b42b28e081c796b64c1600e4c33cb2315989ff87af45c3610e2a89e002ec9cecccac1fe9090f69810c41e35839d3b2fd921d3cf878def0f42

Download Submit
C:\Windows\system\fEFXMHP.exe

Filesize
2.0MB

MD5
b38d54eb56cb2d58e9bd449a760861cf

SHA1
f0c3b0462de708c78f1d247f34b1da45fa3222b4

SHA256
205a5f88fcebb00439569a34d06e467e7352e3d88706e7619629de791590a459

SHA512
27df2435967f24883e0b96611f00f3bb5a2357ab83101a47e795f3e44f965e5de9e48977dd6a393bd40b05927ea8651781997601c62e1f6ff399a2b57952c081

Download Submit
C:\Windows\system\fszzsFx.exe

Filesize
2.0MB

MD5
ebe78fc035064cbc16cbf8f6b4258515

SHA1
6b719de562f5789af21a882dc5206769309f79af

SHA256
f07ebe3dbcb1b3f8721637db59e1072c21cfee17dca4e992dd5780b03042ad40

SHA512
3f6fbe64f858e095a5ea5ad06911d80c47bcf79d7ac382f55cae8b5874234ee8c208f78c3d85e3010192ba0da31e0b5b0983f48a2a2bc5d0c3c6d64b1086e192

Download Submit
C:\Windows\system\irXXdMW.exe

Filesize
2.0MB

MD5
b85ece838656f23580a1dc81b41ed5ce

SHA1
1563c4292ba05105d580aba4331991fdaf88c5fe

SHA256
8dcda67a0eb3ac029f676033b3ed31aaaec951cd0307d7e1d90e15e923a4a782

SHA512
4ce4d71c6191c14408d865e50495bed08dc47ae539604aa7c575399a1d9b12c756c46fe086ea19ac779b1efa8da8ba59861f4104f6b6d94355a8343fb7f2b613

Download Submit
C:\Windows\system\jACEbLG.exe

Filesize
2.0MB

MD5
50e5044d109c1a0039f27d2f053af215

SHA1
09018e0e9433d1a483b29dadd1ff86b5c1e8bc29

SHA256
dbb3d17924e384c381fb7dc6d8886ff39795abf210847d78d4cc84594a74102b

SHA512
b3c4542111f6f2a12c57a5b83e2767bc232bad3f79c1e4d8eb250fd8eafb8ef80312908055015956470a2942958295ab194f6fad3bd5769e0a7d46593c7774be

Download Submit
C:\Windows\system\jGPqwJJ.exe

Filesize
2.0MB

MD5
239d57e71fc4613de41c9312152d080b

SHA1
37a69675b0a9e765f5b8df6d832ee1d2d5ac5d72

SHA256
d137516cf0a277922b3b3a3cf96910f202e7419b0416e826034a8dfb0785bcb0

SHA512
32b7b76cacf853fb0056bdaa787822f9e4be483b4165930ce1ed3801920e9ab5a9f73faa07cb15dfc0e28e3f5fc59d5dfa85a65ab16fb1f8ee9fede51d6ef1e4

Download Submit
C:\Windows\system\nCbITGC.exe

Filesize
2.0MB

MD5
7c7b261a44a57167c94c0bd336b940dc

SHA1
e024da4e35e3113a3f6ff8f3a9722731c772c34d

SHA256
8ff2a859fabb66e6e14caa9e65d7306a0eabc3e672d533d33775ae71f896dc88

SHA512
059ecd5a6421d837d0451bfece7a011a4165ae405e0df879327ee779ad54cf388ef23b76e10d7b406cadbb80a70bd7df922fd162b281a72d925b9bf2b2aace9b

Download Submit
C:\Windows\system\nXBUvTr.exe

Filesize
2.0MB

MD5
eeed37282f4d6d657b1380ae151b4b77

SHA1
47aeb963f15ec2bf2fa247d435e6f10c0ecaae07

SHA256
34d5188472c0baee9f8237a68a1cb62483d1a120644da140848b6109886cce26

SHA512
44734803d9ca9125dc7781f3fe77c4933a9f6dd6a8f93ad48ef978adf9b1077c9c2ac4d752b5686e1c92cc5d061e992bcc4e5e83d8185c6dd202e1dec5eb1a47

Download Submit
C:\Windows\system\pAhzYVc.exe

Filesize
2.0MB

MD5
05b731a71076a1ed82f26d72b0c37b52

SHA1
aa452a136d64d56da21cca62b9a1e886c2f31f6d

SHA256
ed9147207eec3e04d4c367ef34c387191dd98599c43ff3426745b34e5b966087

SHA512
1522f70751788dd09ce1fc43717d6739c7440b9d6a13642a7cbf24602e3adb32812ea0905174cf514854fc6a7075366f7b6e14a171b119ed69d7cfc26eb370ff

Download Submit
C:\Windows\system\pDVjhgO.exe

Filesize
2.0MB

MD5
e6138f17bd1a02ab1558a76988737c8a

SHA1
4f427652cda4694250aa95d9ae2ab68a1568e15c

SHA256
c37a75e131598ce6a6731cd0ed2b2e7dc679aae52590a4aca732e080eaa8052d

SHA512
2b072a9464f35f4ca1a28070e7b68f986c34bbb14222c6e04a8a32b5a88344b82d78c9219a863962f8af322c8a76542fed578bf22213c8233fc2669aebab1988

Download Submit
C:\Windows\system\ptUCHST.exe

Filesize
2.0MB

MD5
a9a9d80b49fdc157fc057fb93f917d26

SHA1
99045b6d7434975225c3a305836c322d21b8ccb9

SHA256
966bcc9e5716e2f0ec7ea9889ba495c038a164dda5a2874b4b61a9d51c9fc997

SHA512
e4225ff313d132c0fc28a904f8515864a5fb7c7a76bf18bffb4771750218162cf278ede51a4719b133cae0afa1a9c743c6d1993c4fc4e6c8bd239d4020beb225

Download Submit
C:\Windows\system\tjDshJK.exe

Filesize
2.0MB

MD5
3c22751ddce22eab25949b822ffcc199

SHA1
4c470b76ff92a4aeb16ef44867347c480a191be3

SHA256
4e5cec1b2a3dea93db701d0d6c1600f483c54a0e93719cc651354493b7e83a32

SHA512
2ffaef5f7b9f6366c241148b3c2ff69c8fdfaadaa3eb0e7a6fb21cf2f3b748d67acf75cd7676ba32f8d5e6e48c0ffd152817672588df5143a9a6fb35c02c4131

Download Submit
C:\Windows\system\vQOTDFy.exe

Filesize
2.0MB

MD5
6674cc4d378f0b95d4965757610e7ad5

SHA1
e9aa397a894542d89ae158b36075dd14e0e4d6b0

SHA256
af054463eec4c0920ed1423d8203dd14bf7434a7d1e4369bb7a27628a47fc65c

SHA512
013e8e577b8924ca4ede91be979b36005d84131d15f8b073994a887f4ee84ed272fa44b8ef46184279a885622e538cf9496b61a10930c159f435d0623cd6d3b3

Download Submit
C:\Windows\system\xSDzbrP.exe

Filesize
2.0MB

MD5
91476204827bba333ebc090baba5eb00

SHA1
d1c7075d5acd8d57dff419a8d38fc0eb151e044e

SHA256
9593c1705cf9d63970f19cdd355a5942cda2d4bc080c8be6483b6249ac2819eb

SHA512
89395749796491e0446b7152ccf02d7c1b80ce45ecbcd8d65e1f481223b4d0c245829e7388d35cc938146bf60bea253b33180caf2206245ac2eaf66e0344cdf8

Download Submit
\Windows\system\dnGdndf.exe

Filesize
2.0MB

MD5
7e39f892f5a3a71b0e9887b3ab340384

SHA1
1ab39e4c43faf6df787f3c67e9905385e6d4a63f

SHA256
ebcb4fdaba8ae83073bf8106b5cc54394ef3f1e841530d5f1839e95487afcd3a

SHA512
f4124f70b92dc4045f984f2e6faf783f3040b5c60d31b13929811131fd9dd5b402d5b8e0a045299afe854a9ca5658beceec1ad032384eaf914f0a92462ec5dab

Download Submit
\Windows\system\haoPzzI.exe

Filesize
2.0MB

MD5
9d40f70c2f7b824bb0b534c19ff8667c

SHA1
d4d3b4a56eabf23c8275933aee77cbc11dbe85a9

SHA256
ba6c828cc25838bac0b99cc9ebbe83d95fd71175f9365f98a457f4b64aa36f4a

SHA512
124993a69f527981240be940f40e595c83b5c079c20bf6c0c71f2fb290744ce5f3e344fb89ee3be7df64ab692ff0eaeaec94ba8a4d8650b36cdad7d10fe70307

Download Submit
\Windows\system\tYiwVNt.exe

Filesize
2.0MB

MD5
dfc2390d89c8d40fbb47846c7262db62

SHA1
87a7bfbbe675d48bf83eb2ab2579e8e738cacc81

SHA256
a30cbe45a2a9567480c2b2e65188055364199973c123be7dc99b13a1a6826c1c

SHA512
3218148e87a3fef1d9445abd66abc265016c34e2050007605af87aa9806f7b2f3bcaa0fde3ecba6a6eba148e7eb6b399ef8ff4bc799e7226a912f413d48ddb76

Download Submit
memory/2392-3989-0x000000013F2D0000-0x000000013F624000-memory.dmp

Filesize
3.3MB

Download
memory/2392-102-0x000000013F2D0000-0x000000013F624000-memory.dmp

Filesize
3.3MB

Download
memory/2392-4001-0x000000013F2D0000-0x000000013F624000-memory.dmp

Filesize
3.3MB

Download
memory/2432-97-0x000000013FC50000-0x000000013FFA4000-memory.dmp

Filesize
3.3MB

Download
memory/2432-3998-0x000000013FC50000-0x000000013FFA4000-memory.dmp

Filesize
3.3MB

Download
memory/2448-3996-0x000000013FE40000-0x0000000140194000-memory.dmp

Filesize
3.3MB

Download
memory/2448-88-0x000000013FE40000-0x0000000140194000-memory.dmp

Filesize
3.3MB

Download
memory/2476-3990-0x000000013F070000-0x000000013F3C4000-memory.dmp

Filesize
3.3MB

Download
memory/2476-40-0x000000013F070000-0x000000013F3C4000-memory.dmp

Filesize
3.3MB

Download
memory/2496-3995-0x000000013F630000-0x000000013F984000-memory.dmp

Filesize
3.3MB

Download
memory/2496-79-0x000000013F630000-0x000000013F984000-memory.dmp

Filesize
3.3MB

Download
memory/2524-67-0x000000013F920000-0x000000013FC74000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3993-0x000000013F920000-0x000000013FC74000-memory.dmp

Filesize
3.3MB

Download
memory/2528-3992-0x000000013FF80000-0x00000001402D4000-memory.dmp

Filesize
3.3MB

Download
memory/2528-55-0x000000013FF80000-0x00000001402D4000-memory.dmp

Filesize
3.3MB

Download
memory/2536-3997-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/2536-94-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/2560-90-0x000000013F410000-0x000000013F764000-memory.dmp

Filesize
3.3MB

Download
memory/2560-3999-0x000000013F410000-0x000000013F764000-memory.dmp

Filesize
3.3MB

Download
memory/2564-3991-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/2564-58-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/2592-3994-0x000000013F130000-0x000000013F484000-memory.dmp

Filesize
3.3MB

Download
memory/2592-83-0x000000013F130000-0x000000013F484000-memory.dmp

Filesize
3.3MB

Download
memory/2892-4000-0x000000013FBD0000-0x000000013FF24000-memory.dmp

Filesize
3.3MB

Download
memory/2892-100-0x000000013FBD0000-0x000000013FF24000-memory.dmp

Filesize
3.3MB

Download
memory/3000-1-0x000000013F060000-0x000000013F3B4000-memory.dmp

Filesize
3.3MB

Download
memory/3000-80-0x000000013FC50000-0x000000013FFA4000-memory.dmp

Filesize
3.3MB

Download
memory/3000-9-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/3000-3078-0x000000013F060000-0x000000013F3B4000-memory.dmp

Filesize
3.3MB

Download
memory/3000-3342-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/3000-3987-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/3000-3988-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/3000-96-0x000000013FE30000-0x0000000140184000-memory.dmp

Filesize
3.3MB

Download
memory/3000-98-0x000000013FBD0000-0x000000013FF24000-memory.dmp

Filesize
3.3MB

Download
memory/3000-75-0x000000013F630000-0x000000013F984000-memory.dmp

Filesize
3.3MB

Download
memory/3000-63-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/3000-93-0x000000013FF20000-0x0000000140274000-memory.dmp

Filesize
3.3MB

Download
memory/3000-92-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/3000-36-0x000000013FF80000-0x00000001402D4000-memory.dmp

Filesize
3.3MB

Download
memory/3000-99-0x000000013FF50000-0x00000001402A4000-memory.dmp

Filesize
3.3MB

Download
memory/3000-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/3000-85-0x000000013FE40000-0x0000000140194000-memory.dmp

Filesize
3.3MB

Download
memory/3000-91-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/3000-84-0x000000013F680000-0x000000013F9D4000-memory.dmp

Filesize
3.3MB

Download
memory/3000-101-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download