xmrig | aac7d384c1d141f37f9f716512f233f9150a76f6a86f277cf6aa0cf73bd41fde

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
Size

2.1MB
MD5

88850942e07639149e41f1733c21c9a0
SHA1

35884ea963d24820a3fa30339d006f1d3196d3da
SHA256

aac7d384c1d141f37f9f716512f233f9150a76f6a86f277cf6aa0cf73bd41fde
SHA512

2066e7900b21173b3c15e35de76c18cda15b5fe1329883f80d8551d3c3c51812d2a3b687502b6df09637f069958a16598ab02f12758da7f966dd9e2df479488b
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIXGv4rzq6c2HzZ+3/gij4s:BemTLkNdfE0pZrG

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2288-0-0x000000013FC30000-0x000000013FF84000-memory.dmp	xmrig
behavioral1/files/0x000c000000012339-3.dat	xmrig
behavioral1/files/0x00070000000153cf-9.dat	xmrig
behavioral1/files/0x000c00000001470b-17.dat	xmrig
behavioral1/files/0x00070000000155e3-19.dat	xmrig
behavioral1/files/0x0007000000015642-16.dat	xmrig
behavioral1/memory/2600-35-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/memory/2288-34-0x000000013FFD0000-0x0000000140324000-memory.dmp	xmrig
behavioral1/memory/3056-33-0x000000013FFD0000-0x0000000140324000-memory.dmp	xmrig
behavioral1/memory/2728-32-0x000000013F750000-0x000000013FAA4000-memory.dmp	xmrig
behavioral1/memory/2496-31-0x000000013F6C0000-0x000000013FA14000-memory.dmp	xmrig
behavioral1/memory/2288-30-0x0000000002090000-0x00000000023E4000-memory.dmp	xmrig
behavioral1/memory/2128-28-0x000000013FAD0000-0x000000013FE24000-memory.dmp	xmrig
behavioral1/files/0x0007000000015b13-36.dat	xmrig
behavioral1/files/0x0009000000015bb9-45.dat	xmrig
behavioral1/files/0x0032000000015023-41.dat	xmrig
behavioral1/files/0x0007000000015cf7-49.dat	xmrig
behavioral1/memory/2608-57-0x000000013FDA0000-0x00000001400F4000-memory.dmp	xmrig
behavioral1/memory/2436-63-0x000000013FDD0000-0x0000000140124000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d06-64.dat	xmrig
behavioral1/memory/2432-59-0x000000013F4F0000-0x000000013F844000-memory.dmp	xmrig
behavioral1/memory/780-70-0x000000013F960000-0x000000013FCB4000-memory.dmp	xmrig
behavioral1/memory/2288-58-0x000000013F4F0000-0x000000013F844000-memory.dmp	xmrig
behavioral1/memory/2768-55-0x000000013F8F0000-0x000000013FC44000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d5d-71.dat	xmrig
behavioral1/memory/2636-76-0x000000013FED0000-0x0000000140224000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d6e-77.dat	xmrig
behavioral1/memory/2288-78-0x000000013FC30000-0x000000013FF84000-memory.dmp	xmrig
behavioral1/memory/2748-83-0x000000013F720000-0x000000013FA74000-memory.dmp	xmrig
behavioral1/files/0x0006000000015f1b-91.dat	xmrig
behavioral1/files/0x0006000000015f9e-92.dat	xmrig
behavioral1/files/0x0006000000016056-101.dat	xmrig
behavioral1/files/0x00060000000160f8-103.dat	xmrig
behavioral1/memory/2768-111-0x000000013F8F0000-0x000000013FC44000-memory.dmp	xmrig
behavioral1/memory/1604-102-0x000000013FC10000-0x000000013FF64000-memory.dmp	xmrig
behavioral1/memory/2288-97-0x0000000002090000-0x00000000023E4000-memory.dmp	xmrig
behavioral1/memory/2884-96-0x000000013F960000-0x000000013FCB4000-memory.dmp	xmrig
behavioral1/files/0x0006000000016277-114.dat	xmrig
behavioral1/files/0x0006000000016411-118.dat	xmrig
behavioral1/files/0x0006000000016525-121.dat	xmrig
behavioral1/files/0x0006000000016597-126.dat	xmrig
behavioral1/files/0x00060000000167ef-133.dat	xmrig
behavioral1/files/0x0006000000016a45-138.dat	xmrig
behavioral1/files/0x0006000000016c17-144.dat	xmrig
behavioral1/files/0x0006000000016ce1-173.dat	xmrig
behavioral1/files/0x0006000000016ced-178.dat	xmrig
behavioral1/files/0x0006000000016cfe-189.dat	xmrig
behavioral1/files/0x0006000000016cf5-184.dat	xmrig
behavioral1/files/0x0006000000016cc9-168.dat	xmrig
behavioral1/files/0x0006000000016cab-163.dat	xmrig
behavioral1/files/0x0006000000016c7a-158.dat	xmrig
behavioral1/files/0x0006000000016c2e-153.dat	xmrig
behavioral1/files/0x0006000000016c26-148.dat	xmrig
behavioral1/memory/2288-3494-0x000000013FFA0000-0x00000001402F4000-memory.dmp	xmrig
behavioral1/memory/2496-4001-0x000000013F6C0000-0x000000013FA14000-memory.dmp	xmrig
behavioral1/memory/2128-4003-0x000000013FAD0000-0x000000013FE24000-memory.dmp	xmrig
behavioral1/memory/2728-4002-0x000000013F750000-0x000000013FAA4000-memory.dmp	xmrig
behavioral1/memory/3056-4004-0x000000013FFD0000-0x0000000140324000-memory.dmp	xmrig
behavioral1/memory/2600-4005-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/memory/2432-4006-0x000000013F4F0000-0x000000013F844000-memory.dmp	xmrig
behavioral1/memory/2608-4007-0x000000013FDA0000-0x00000001400F4000-memory.dmp	xmrig
behavioral1/memory/2768-4008-0x000000013F8F0000-0x000000013FC44000-memory.dmp	xmrig
behavioral1/memory/2436-4009-0x000000013FDD0000-0x0000000140124000-memory.dmp	xmrig
behavioral1/memory/780-4010-0x000000013F960000-0x000000013FCB4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2128	CnfyBwK.exe
2496	tmJCwyv.exe
2728	FZzvZXn.exe
3056	YwsjJVh.exe
2600	RaXtcCl.exe
2768	tvnBqWe.exe
2608	ZJdoknO.exe
2432	owciHVA.exe
2436	pUgflPz.exe
780	XSYKejD.exe
2636	krNyMfc.exe
2748	nuHaNQY.exe
2884	oxCKjrI.exe
1604	HFAgICa.exe
1568	qoCZBEP.exe
320	FmJKmpR.exe
356	agCBczM.exe
1516	sGIlTmi.exe
2632	imbuLol.exe
1600	WQPAIdz.exe
1492	XYhTsjl.exe
1464	zNnTPDT.exe
2268	EfEPvMk.exe
2132	rFdrTSi.exe
1248	WgLxApS.exe
2252	NqjlosB.exe
2188	iBBTYOW.exe
2024	XdZwJII.exe
488	GOJFWub.exe
580	CMEwTtd.exe
2796	mthyMYm.exe
1884	raONeld.exe
648	jmjYKih.exe
3052	cqiIWfo.exe
1244	URTjZSP.exe
1108	bUjdJiq.exe
2984	DSPUeBL.exe
2972	UFtYuZk.exe
772	kNFIgot.exe
2372	VrBirGU.exe
1980	SlOGMQY.exe
1324	MLVbvDu.exe
1056	PLVpIjl.exe
1756	kOOnBVB.exe
2368	HmnRcxR.exe
920	AlbHuxT.exe
1052	eXuMdBi.exe
328	ldoDIZb.exe
1964	hNQMWRp.exe
1368	rAuQbHt.exe
2344	PaaYDLM.exe
2084	CwpWfeK.exe
1764	lRspykE.exe
2076	vEjAIZB.exe
1592	NfTGMqu.exe
2300	UGOMDUr.exe
2312	SuBZKpt.exe
1644	lPWUrCf.exe
1788	EgzEDXm.exe
2520	THVHAka.exe
2536	uxlSYtx.exe
2696	VvKCxpW.exe
1376	jQMmVkV.exe
2688	UCEhycD.exe

Loads dropped DLL 64 IoCs

pid	Process
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2288-0-0x000000013FC30000-0x000000013FF84000-memory.dmp	upx
behavioral1/files/0x000c000000012339-3.dat	upx
behavioral1/files/0x00070000000153cf-9.dat	upx
behavioral1/files/0x000c00000001470b-17.dat	upx
behavioral1/files/0x00070000000155e3-19.dat	upx
behavioral1/files/0x0007000000015642-16.dat	upx
behavioral1/memory/2600-35-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/memory/3056-33-0x000000013FFD0000-0x0000000140324000-memory.dmp	upx
behavioral1/memory/2728-32-0x000000013F750000-0x000000013FAA4000-memory.dmp	upx
behavioral1/memory/2496-31-0x000000013F6C0000-0x000000013FA14000-memory.dmp	upx
behavioral1/memory/2128-28-0x000000013FAD0000-0x000000013FE24000-memory.dmp	upx
behavioral1/files/0x0007000000015b13-36.dat	upx
behavioral1/files/0x0009000000015bb9-45.dat	upx
behavioral1/files/0x0032000000015023-41.dat	upx
behavioral1/files/0x0007000000015cf7-49.dat	upx
behavioral1/memory/2608-57-0x000000013FDA0000-0x00000001400F4000-memory.dmp	upx
behavioral1/memory/2436-63-0x000000013FDD0000-0x0000000140124000-memory.dmp	upx
behavioral1/files/0x0006000000015d06-64.dat	upx
behavioral1/memory/2432-59-0x000000013F4F0000-0x000000013F844000-memory.dmp	upx
behavioral1/memory/780-70-0x000000013F960000-0x000000013FCB4000-memory.dmp	upx
behavioral1/memory/2768-55-0x000000013F8F0000-0x000000013FC44000-memory.dmp	upx
behavioral1/files/0x0006000000015d5d-71.dat	upx
behavioral1/memory/2636-76-0x000000013FED0000-0x0000000140224000-memory.dmp	upx
behavioral1/files/0x0006000000015d6e-77.dat	upx
behavioral1/memory/2288-78-0x000000013FC30000-0x000000013FF84000-memory.dmp	upx
behavioral1/memory/2748-83-0x000000013F720000-0x000000013FA74000-memory.dmp	upx
behavioral1/files/0x0006000000015f1b-91.dat	upx
behavioral1/files/0x0006000000015f9e-92.dat	upx
behavioral1/files/0x0006000000016056-101.dat	upx
behavioral1/files/0x00060000000160f8-103.dat	upx
behavioral1/memory/2768-111-0x000000013F8F0000-0x000000013FC44000-memory.dmp	upx
behavioral1/memory/1604-102-0x000000013FC10000-0x000000013FF64000-memory.dmp	upx
behavioral1/memory/2884-96-0x000000013F960000-0x000000013FCB4000-memory.dmp	upx
behavioral1/files/0x0006000000016277-114.dat	upx
behavioral1/files/0x0006000000016411-118.dat	upx
behavioral1/files/0x0006000000016525-121.dat	upx
behavioral1/files/0x0006000000016597-126.dat	upx
behavioral1/files/0x00060000000167ef-133.dat	upx
behavioral1/files/0x0006000000016a45-138.dat	upx
behavioral1/files/0x0006000000016c17-144.dat	upx
behavioral1/files/0x0006000000016ce1-173.dat	upx
behavioral1/files/0x0006000000016ced-178.dat	upx
behavioral1/files/0x0006000000016cfe-189.dat	upx
behavioral1/files/0x0006000000016cf5-184.dat	upx
behavioral1/files/0x0006000000016cc9-168.dat	upx
behavioral1/files/0x0006000000016cab-163.dat	upx
behavioral1/files/0x0006000000016c7a-158.dat	upx
behavioral1/files/0x0006000000016c2e-153.dat	upx
behavioral1/files/0x0006000000016c26-148.dat	upx
behavioral1/memory/2496-4001-0x000000013F6C0000-0x000000013FA14000-memory.dmp	upx
behavioral1/memory/2128-4003-0x000000013FAD0000-0x000000013FE24000-memory.dmp	upx
behavioral1/memory/2728-4002-0x000000013F750000-0x000000013FAA4000-memory.dmp	upx
behavioral1/memory/3056-4004-0x000000013FFD0000-0x0000000140324000-memory.dmp	upx
behavioral1/memory/2600-4005-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/memory/2432-4006-0x000000013F4F0000-0x000000013F844000-memory.dmp	upx
behavioral1/memory/2608-4007-0x000000013FDA0000-0x00000001400F4000-memory.dmp	upx
behavioral1/memory/2768-4008-0x000000013F8F0000-0x000000013FC44000-memory.dmp	upx
behavioral1/memory/2436-4009-0x000000013FDD0000-0x0000000140124000-memory.dmp	upx
behavioral1/memory/780-4010-0x000000013F960000-0x000000013FCB4000-memory.dmp	upx
behavioral1/memory/2636-4011-0x000000013FED0000-0x0000000140224000-memory.dmp	upx
behavioral1/memory/2748-4012-0x000000013F720000-0x000000013FA74000-memory.dmp	upx
behavioral1/memory/1604-4013-0x000000013FC10000-0x000000013FF64000-memory.dmp	upx
behavioral1/memory/2884-4014-0x000000013F960000-0x000000013FCB4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nMLQets.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\tESowcl.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\pTPMkHL.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\MlpqcPd.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\LLkvrcc.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\wtbDlVz.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\AUooUYR.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZrklSOe.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\QqkogGp.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\EFyoYZw.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\SMwhJrY.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\gDCqSyA.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\uEKVLKu.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\jBgNmNM.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\XgYSKTX.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\MtjxWrz.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ViUvfeb.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ubQAjGN.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\GyFPCBn.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\kOOnBVB.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\EgzEDXm.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\BMZzHgv.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\YUNfyDE.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\OlzWNzu.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\AyppZcD.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\rbmwJDo.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\fmrApsO.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\BZsAmzJ.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\VKlrkzv.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZgnlafO.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\SlOGMQY.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\JpptWXz.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\RMkHAOK.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\Rhcnpzw.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\icUtqxF.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\VxgVxTK.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\rFdrTSi.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ldoDIZb.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\JHumkCa.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\LiojwKu.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\CzpmDSa.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\XarWxzA.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\tFshcCY.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ManJSVD.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\AYGfeOG.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\rkgElfE.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\gaTAtJS.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ahsPokP.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\wuvWcYU.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\tjEcERR.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\CimSzsW.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\LLfTWlm.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\XtzaCDc.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\NKFwyMp.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\DhwUbjU.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\SAPGdaB.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\obZYDsl.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\UTPpPYJ.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ieippur.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ytIodVA.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\SUtQpFE.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\uOpaZpR.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\yCYKRWn.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
File created	C:\Windows\System\zfGTUPH.exe	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2728	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	29
PID 2288 wrote to memory of 2728	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	29
PID 2288 wrote to memory of 2728	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	29
PID 2288 wrote to memory of 2128	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	30
PID 2288 wrote to memory of 2128	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	30
PID 2288 wrote to memory of 2128	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	30
PID 2288 wrote to memory of 3056	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	31
PID 2288 wrote to memory of 3056	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	31
PID 2288 wrote to memory of 3056	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	31
PID 2288 wrote to memory of 2496	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	32
PID 2288 wrote to memory of 2496	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	32
PID 2288 wrote to memory of 2496	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	32
PID 2288 wrote to memory of 2600	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	33
PID 2288 wrote to memory of 2600	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	33
PID 2288 wrote to memory of 2600	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	33
PID 2288 wrote to memory of 2768	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	34
PID 2288 wrote to memory of 2768	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	34
PID 2288 wrote to memory of 2768	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	34
PID 2288 wrote to memory of 2608	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	35
PID 2288 wrote to memory of 2608	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	35
PID 2288 wrote to memory of 2608	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	35
PID 2288 wrote to memory of 2432	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	36
PID 2288 wrote to memory of 2432	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	36
PID 2288 wrote to memory of 2432	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	36
PID 2288 wrote to memory of 2436	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	37
PID 2288 wrote to memory of 2436	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	37
PID 2288 wrote to memory of 2436	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	37
PID 2288 wrote to memory of 780	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	38
PID 2288 wrote to memory of 780	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	38
PID 2288 wrote to memory of 780	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	38
PID 2288 wrote to memory of 2636	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	39
PID 2288 wrote to memory of 2636	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	39
PID 2288 wrote to memory of 2636	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	39
PID 2288 wrote to memory of 2748	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	40
PID 2288 wrote to memory of 2748	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	40
PID 2288 wrote to memory of 2748	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	40
PID 2288 wrote to memory of 2884	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	41
PID 2288 wrote to memory of 2884	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	41
PID 2288 wrote to memory of 2884	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	41
PID 2288 wrote to memory of 1604	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	42
PID 2288 wrote to memory of 1604	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	42
PID 2288 wrote to memory of 1604	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	42
PID 2288 wrote to memory of 1568	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	43
PID 2288 wrote to memory of 1568	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	43
PID 2288 wrote to memory of 1568	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	43
PID 2288 wrote to memory of 320	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	44
PID 2288 wrote to memory of 320	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	44
PID 2288 wrote to memory of 320	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	44
PID 2288 wrote to memory of 356	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	45
PID 2288 wrote to memory of 356	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	45
PID 2288 wrote to memory of 356	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	45
PID 2288 wrote to memory of 1516	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	46
PID 2288 wrote to memory of 1516	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	46
PID 2288 wrote to memory of 1516	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	46
PID 2288 wrote to memory of 2632	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	47
PID 2288 wrote to memory of 2632	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	47
PID 2288 wrote to memory of 2632	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	47
PID 2288 wrote to memory of 1600	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	48
PID 2288 wrote to memory of 1600	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	48
PID 2288 wrote to memory of 1600	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	48
PID 2288 wrote to memory of 1492	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	49
PID 2288 wrote to memory of 1492	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	49
PID 2288 wrote to memory of 1492	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	49
PID 2288 wrote to memory of 1464	2288	88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\88850942e07639149e41f1733c21c9a0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\System\FZzvZXn.exe
  C:\Windows\System\FZzvZXn.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\CnfyBwK.exe
  C:\Windows\System\CnfyBwK.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\YwsjJVh.exe
  C:\Windows\System\YwsjJVh.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\tmJCwyv.exe
  C:\Windows\System\tmJCwyv.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\RaXtcCl.exe
  C:\Windows\System\RaXtcCl.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\tvnBqWe.exe
  C:\Windows\System\tvnBqWe.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\ZJdoknO.exe
  C:\Windows\System\ZJdoknO.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\owciHVA.exe
  C:\Windows\System\owciHVA.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\pUgflPz.exe
  C:\Windows\System\pUgflPz.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\XSYKejD.exe
  C:\Windows\System\XSYKejD.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\krNyMfc.exe
  C:\Windows\System\krNyMfc.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\nuHaNQY.exe
  C:\Windows\System\nuHaNQY.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\oxCKjrI.exe
  C:\Windows\System\oxCKjrI.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\HFAgICa.exe
  C:\Windows\System\HFAgICa.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\qoCZBEP.exe
  C:\Windows\System\qoCZBEP.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\FmJKmpR.exe
  C:\Windows\System\FmJKmpR.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\agCBczM.exe
  C:\Windows\System\agCBczM.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\sGIlTmi.exe
  C:\Windows\System\sGIlTmi.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\imbuLol.exe
  C:\Windows\System\imbuLol.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\WQPAIdz.exe
  C:\Windows\System\WQPAIdz.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\XYhTsjl.exe
  C:\Windows\System\XYhTsjl.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\zNnTPDT.exe
  C:\Windows\System\zNnTPDT.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\EfEPvMk.exe
  C:\Windows\System\EfEPvMk.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\rFdrTSi.exe
  C:\Windows\System\rFdrTSi.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\WgLxApS.exe
  C:\Windows\System\WgLxApS.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\NqjlosB.exe
  C:\Windows\System\NqjlosB.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\iBBTYOW.exe
  C:\Windows\System\iBBTYOW.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\XdZwJII.exe
  C:\Windows\System\XdZwJII.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\GOJFWub.exe
  C:\Windows\System\GOJFWub.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\CMEwTtd.exe
  C:\Windows\System\CMEwTtd.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\mthyMYm.exe
  C:\Windows\System\mthyMYm.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\raONeld.exe
  C:\Windows\System\raONeld.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\jmjYKih.exe
  C:\Windows\System\jmjYKih.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\cqiIWfo.exe
  C:\Windows\System\cqiIWfo.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\URTjZSP.exe
  C:\Windows\System\URTjZSP.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\bUjdJiq.exe
  C:\Windows\System\bUjdJiq.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\DSPUeBL.exe
  C:\Windows\System\DSPUeBL.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\UFtYuZk.exe
  C:\Windows\System\UFtYuZk.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\kNFIgot.exe
  C:\Windows\System\kNFIgot.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\VrBirGU.exe
  C:\Windows\System\VrBirGU.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\SlOGMQY.exe
  C:\Windows\System\SlOGMQY.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\MLVbvDu.exe
  C:\Windows\System\MLVbvDu.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\PLVpIjl.exe
  C:\Windows\System\PLVpIjl.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\kOOnBVB.exe
  C:\Windows\System\kOOnBVB.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\HmnRcxR.exe
  C:\Windows\System\HmnRcxR.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\AlbHuxT.exe
  C:\Windows\System\AlbHuxT.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\eXuMdBi.exe
  C:\Windows\System\eXuMdBi.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\ldoDIZb.exe
  C:\Windows\System\ldoDIZb.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\hNQMWRp.exe
  C:\Windows\System\hNQMWRp.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\rAuQbHt.exe
  C:\Windows\System\rAuQbHt.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\PaaYDLM.exe
  C:\Windows\System\PaaYDLM.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\CwpWfeK.exe
  C:\Windows\System\CwpWfeK.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\lRspykE.exe
  C:\Windows\System\lRspykE.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\vEjAIZB.exe
  C:\Windows\System\vEjAIZB.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\NfTGMqu.exe
  C:\Windows\System\NfTGMqu.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\UGOMDUr.exe
  C:\Windows\System\UGOMDUr.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\SuBZKpt.exe
  C:\Windows\System\SuBZKpt.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\lPWUrCf.exe
  C:\Windows\System\lPWUrCf.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\EgzEDXm.exe
  C:\Windows\System\EgzEDXm.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\THVHAka.exe
  C:\Windows\System\THVHAka.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\uxlSYtx.exe
  C:\Windows\System\uxlSYtx.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\VvKCxpW.exe
  C:\Windows\System\VvKCxpW.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\jQMmVkV.exe
  C:\Windows\System\jQMmVkV.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\UCEhycD.exe
  C:\Windows\System\UCEhycD.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\hdpoNDL.exe
  C:\Windows\System\hdpoNDL.exe
  2⤵
  PID:2400
- C:\Windows\System\hAMxout.exe
  C:\Windows\System\hAMxout.exe
  2⤵
  PID:2544
- C:\Windows\System\iYKGNyK.exe
  C:\Windows\System\iYKGNyK.exe
  2⤵
  PID:2560
- C:\Windows\System\AZPEMSe.exe
  C:\Windows\System\AZPEMSe.exe
  2⤵
  PID:2456
- C:\Windows\System\egrqRSL.exe
  C:\Windows\System\egrqRSL.exe
  2⤵
  PID:1888
- C:\Windows\System\mxsTkzr.exe
  C:\Windows\System\mxsTkzr.exe
  2⤵
  PID:2000
- C:\Windows\System\RbVVdSa.exe
  C:\Windows\System\RbVVdSa.exe
  2⤵
  PID:2528
- C:\Windows\System\dCAgVjl.exe
  C:\Windows\System\dCAgVjl.exe
  2⤵
  PID:2204
- C:\Windows\System\DSKtXsO.exe
  C:\Windows\System\DSKtXsO.exe
  2⤵
  PID:2872
- C:\Windows\System\LjjiFXl.exe
  C:\Windows\System\LjjiFXl.exe
  2⤵
  PID:2844
- C:\Windows\System\nxUrkAc.exe
  C:\Windows\System\nxUrkAc.exe
  2⤵
  PID:2852
- C:\Windows\System\kASeuXk.exe
  C:\Windows\System\kASeuXk.exe
  2⤵
  PID:2576
- C:\Windows\System\dJDVSaI.exe
  C:\Windows\System\dJDVSaI.exe
  2⤵
  PID:1620
- C:\Windows\System\ZcFmqLA.exe
  C:\Windows\System\ZcFmqLA.exe
  2⤵
  PID:1812
- C:\Windows\System\LSWFVeb.exe
  C:\Windows\System\LSWFVeb.exe
  2⤵
  PID:240
- C:\Windows\System\kpUkfWY.exe
  C:\Windows\System\kpUkfWY.exe
  2⤵
  PID:2904
- C:\Windows\System\SvaXUvx.exe
  C:\Windows\System\SvaXUvx.exe
  2⤵
  PID:1720
- C:\Windows\System\KCiBfgx.exe
  C:\Windows\System\KCiBfgx.exe
  2⤵
  PID:1608
- C:\Windows\System\NvYPODY.exe
  C:\Windows\System\NvYPODY.exe
  2⤵
  PID:1724
- C:\Windows\System\sMOdBMs.exe
  C:\Windows\System\sMOdBMs.exe
  2⤵
  PID:2236
- C:\Windows\System\qplcpOu.exe
  C:\Windows\System\qplcpOu.exe
  2⤵
  PID:2572
- C:\Windows\System\ACHdknJ.exe
  C:\Windows\System\ACHdknJ.exe
  2⤵
  PID:2072
- C:\Windows\System\GJABYYi.exe
  C:\Windows\System\GJABYYi.exe
  2⤵
  PID:696
- C:\Windows\System\vTKZXoz.exe
  C:\Windows\System\vTKZXoz.exe
  2⤵
  PID:1416
- C:\Windows\System\lyNQezL.exe
  C:\Windows\System\lyNQezL.exe
  2⤵
  PID:1424
- C:\Windows\System\FoYTaxU.exe
  C:\Windows\System\FoYTaxU.exe
  2⤵
  PID:1188
- C:\Windows\System\QzmWfAO.exe
  C:\Windows\System\QzmWfAO.exe
  2⤵
  PID:1332
- C:\Windows\System\NEMGqrG.exe
  C:\Windows\System\NEMGqrG.exe
  2⤵
  PID:1016
- C:\Windows\System\uFPxLtr.exe
  C:\Windows\System\uFPxLtr.exe
  2⤵
  PID:2360
- C:\Windows\System\dsgDMOh.exe
  C:\Windows\System\dsgDMOh.exe
  2⤵
  PID:332
- C:\Windows\System\HmTiPCE.exe
  C:\Windows\System\HmTiPCE.exe
  2⤵
  PID:1800
- C:\Windows\System\JsyQmRO.exe
  C:\Windows\System\JsyQmRO.exe
  2⤵
  PID:968
- C:\Windows\System\VywEPXV.exe
  C:\Windows\System\VywEPXV.exe
  2⤵
  PID:1692
- C:\Windows\System\TRvGxXw.exe
  C:\Windows\System\TRvGxXw.exe
  2⤵
  PID:308
- C:\Windows\System\GuAlWFp.exe
  C:\Windows\System\GuAlWFp.exe
  2⤵
  PID:1020
- C:\Windows\System\BUkqFsh.exe
  C:\Windows\System\BUkqFsh.exe
  2⤵
  PID:2308
- C:\Windows\System\aYGriJs.exe
  C:\Windows\System\aYGriJs.exe
  2⤵
  PID:1960
- C:\Windows\System\wfxBHvO.exe
  C:\Windows\System\wfxBHvO.exe
  2⤵
  PID:1192
- C:\Windows\System\pJaOnqz.exe
  C:\Windows\System\pJaOnqz.exe
  2⤵
  PID:1388
- C:\Windows\System\mPRsmyO.exe
  C:\Windows\System\mPRsmyO.exe
  2⤵
  PID:2104
- C:\Windows\System\kVSJAQA.exe
  C:\Windows\System\kVSJAQA.exe
  2⤵
  PID:2148
- C:\Windows\System\KEqlpbw.exe
  C:\Windows\System\KEqlpbw.exe
  2⤵
  PID:2980
- C:\Windows\System\IYisXYB.exe
  C:\Windows\System\IYisXYB.exe
  2⤵
  PID:2460
- C:\Windows\System\ecuNXqj.exe
  C:\Windows\System\ecuNXqj.exe
  2⤵
  PID:2584
- C:\Windows\System\MHgUVWm.exe
  C:\Windows\System\MHgUVWm.exe
  2⤵
  PID:2704
- C:\Windows\System\XDCilMD.exe
  C:\Windows\System\XDCilMD.exe
  2⤵
  PID:2992
- C:\Windows\System\VZtnVjT.exe
  C:\Windows\System\VZtnVjT.exe
  2⤵
  PID:1480
- C:\Windows\System\aPOTHSk.exe
  C:\Windows\System\aPOTHSk.exe
  2⤵
  PID:2408
- C:\Windows\System\QITYRum.exe
  C:\Windows\System\QITYRum.exe
  2⤵
  PID:2680
- C:\Windows\System\sxocAel.exe
  C:\Windows\System\sxocAel.exe
  2⤵
  PID:2712
- C:\Windows\System\CFfVUhI.exe
  C:\Windows\System\CFfVUhI.exe
  2⤵
  PID:1752
- C:\Windows\System\fBDObuI.exe
  C:\Windows\System\fBDObuI.exe
  2⤵
  PID:2664
- C:\Windows\System\FxjUKjU.exe
  C:\Windows\System\FxjUKjU.exe
  2⤵
  PID:1668
- C:\Windows\System\fZCFYzb.exe
  C:\Windows\System\fZCFYzb.exe
  2⤵
  PID:1520
- C:\Windows\System\LCsJfJC.exe
  C:\Windows\System\LCsJfJC.exe
  2⤵
  PID:2468
- C:\Windows\System\HyfTfAN.exe
  C:\Windows\System\HyfTfAN.exe
  2⤵
  PID:2620
- C:\Windows\System\yvRCKmn.exe
  C:\Windows\System\yvRCKmn.exe
  2⤵
  PID:2916
- C:\Windows\System\eIhYvfe.exe
  C:\Windows\System\eIhYvfe.exe
  2⤵
  PID:1664
- C:\Windows\System\QiGZIaW.exe
  C:\Windows\System\QiGZIaW.exe
  2⤵
  PID:2380
- C:\Windows\System\akFGSey.exe
  C:\Windows\System\akFGSey.exe
  2⤵
  PID:2888
- C:\Windows\System\tWTGpqS.exe
  C:\Windows\System\tWTGpqS.exe
  2⤵
  PID:2264
- C:\Windows\System\sdguspM.exe
  C:\Windows\System\sdguspM.exe
  2⤵
  PID:1616
- C:\Windows\System\CalaIWi.exe
  C:\Windows\System\CalaIWi.exe
  2⤵
  PID:412
- C:\Windows\System\DDWhxUv.exe
  C:\Windows\System\DDWhxUv.exe
  2⤵
  PID:784
- C:\Windows\System\dtNrpOr.exe
  C:\Windows\System\dtNrpOr.exe
  2⤵
  PID:2116
- C:\Windows\System\XoVUfMm.exe
  C:\Windows\System\XoVUfMm.exe
  2⤵
  PID:1936
- C:\Windows\System\cqXIjjO.exe
  C:\Windows\System\cqXIjjO.exe
  2⤵
  PID:2996
- C:\Windows\System\xJjwUdI.exe
  C:\Windows\System\xJjwUdI.exe
  2⤵
  PID:2444
- C:\Windows\System\SSMfTKH.exe
  C:\Windows\System\SSMfTKH.exe
  2⤵
  PID:2276
- C:\Windows\System\ZIoysGo.exe
  C:\Windows\System\ZIoysGo.exe
  2⤵
  PID:600
- C:\Windows\System\zNckJAq.exe
  C:\Windows\System\zNckJAq.exe
  2⤵
  PID:952
- C:\Windows\System\ZEUVNqk.exe
  C:\Windows\System\ZEUVNqk.exe
  2⤵
  PID:900
- C:\Windows\System\KcDNsAE.exe
  C:\Windows\System\KcDNsAE.exe
  2⤵
  PID:2220
- C:\Windows\System\fEaSWEe.exe
  C:\Windows\System\fEaSWEe.exe
  2⤵
  PID:1560
- C:\Windows\System\VdzAaPm.exe
  C:\Windows\System\VdzAaPm.exe
  2⤵
  PID:400
- C:\Windows\System\yoPxyUU.exe
  C:\Windows\System\yoPxyUU.exe
  2⤵
  PID:2760
- C:\Windows\System\xPBnsVL.exe
  C:\Windows\System\xPBnsVL.exe
  2⤵
  PID:2596
- C:\Windows\System\twdOLOP.exe
  C:\Windows\System\twdOLOP.exe
  2⤵
  PID:2532
- C:\Windows\System\kwUydas.exe
  C:\Windows\System\kwUydas.exe
  2⤵
  PID:2604
- C:\Windows\System\LaAmEPc.exe
  C:\Windows\System\LaAmEPc.exe
  2⤵
  PID:2112
- C:\Windows\System\rqUmnie.exe
  C:\Windows\System\rqUmnie.exe
  2⤵
  PID:2032
- C:\Windows\System\XdEoAiV.exe
  C:\Windows\System\XdEoAiV.exe
  2⤵
  PID:1632
- C:\Windows\System\nTMtTXh.exe
  C:\Windows\System\nTMtTXh.exe
  2⤵
  PID:2732
- C:\Windows\System\rtPDxAp.exe
  C:\Windows\System\rtPDxAp.exe
  2⤵
  PID:2740
- C:\Windows\System\EdOVApB.exe
  C:\Windows\System\EdOVApB.exe
  2⤵
  PID:1588
- C:\Windows\System\vAddfSX.exe
  C:\Windows\System\vAddfSX.exe
  2⤵
  PID:1528
- C:\Windows\System\xzqmIac.exe
  C:\Windows\System\xzqmIac.exe
  2⤵
  PID:2208
- C:\Windows\System\CoHwcHa.exe
  C:\Windows\System\CoHwcHa.exe
  2⤵
  PID:704
- C:\Windows\System\hplxHXn.exe
  C:\Windows\System\hplxHXn.exe
  2⤵
  PID:620
- C:\Windows\System\EtdAwAp.exe
  C:\Windows\System\EtdAwAp.exe
  2⤵
  PID:1708
- C:\Windows\System\asvVrUp.exe
  C:\Windows\System\asvVrUp.exe
  2⤵
  PID:1780
- C:\Windows\System\EwEKetw.exe
  C:\Windows\System\EwEKetw.exe
  2⤵
  PID:2056
- C:\Windows\System\Fvaxeph.exe
  C:\Windows\System\Fvaxeph.exe
  2⤵
  PID:1316
- C:\Windows\System\eEbQJSm.exe
  C:\Windows\System\eEbQJSm.exe
  2⤵
  PID:2092
- C:\Windows\System\MDnIGtF.exe
  C:\Windows\System\MDnIGtF.exe
  2⤵
  PID:3036
- C:\Windows\System\dcWaEFx.exe
  C:\Windows\System\dcWaEFx.exe
  2⤵
  PID:1548
- C:\Windows\System\JmbRavR.exe
  C:\Windows\System\JmbRavR.exe
  2⤵
  PID:2164
- C:\Windows\System\YRkhSQj.exe
  C:\Windows\System\YRkhSQj.exe
  2⤵
  PID:2516
- C:\Windows\System\rCiDcNt.exe
  C:\Windows\System\rCiDcNt.exe
  2⤵
  PID:2828
- C:\Windows\System\QEARwtn.exe
  C:\Windows\System\QEARwtn.exe
  2⤵
  PID:2488
- C:\Windows\System\wlUpPlg.exe
  C:\Windows\System\wlUpPlg.exe
  2⤵
  PID:1744
- C:\Windows\System\xyMrfMD.exe
  C:\Windows\System\xyMrfMD.exe
  2⤵
  PID:1252
- C:\Windows\System\jNaZYzB.exe
  C:\Windows\System\jNaZYzB.exe
  2⤵
  PID:1456
- C:\Windows\System\JpptWXz.exe
  C:\Windows\System\JpptWXz.exe
  2⤵
  PID:2756
- C:\Windows\System\TakCSXF.exe
  C:\Windows\System\TakCSXF.exe
  2⤵
  PID:2848
- C:\Windows\System\OfPPktM.exe
  C:\Windows\System\OfPPktM.exe
  2⤵
  PID:2216
- C:\Windows\System\ronrzPi.exe
  C:\Windows\System\ronrzPi.exe
  2⤵
  PID:272
- C:\Windows\System\QtcEVDV.exe
  C:\Windows\System\QtcEVDV.exe
  2⤵
  PID:2244
- C:\Windows\System\UixuKcG.exe
  C:\Windows\System\UixuKcG.exe
  2⤵
  PID:3092
- C:\Windows\System\TtKOszU.exe
  C:\Windows\System\TtKOszU.exe
  2⤵
  PID:3108
- C:\Windows\System\ZTiLUtv.exe
  C:\Windows\System\ZTiLUtv.exe
  2⤵
  PID:3128
- C:\Windows\System\TAInbrY.exe
  C:\Windows\System\TAInbrY.exe
  2⤵
  PID:3148
- C:\Windows\System\noRiIKH.exe
  C:\Windows\System\noRiIKH.exe
  2⤵
  PID:3172
- C:\Windows\System\hSmvKnW.exe
  C:\Windows\System\hSmvKnW.exe
  2⤵
  PID:3192
- C:\Windows\System\kirGFba.exe
  C:\Windows\System\kirGFba.exe
  2⤵
  PID:3208
- C:\Windows\System\QWzzHkh.exe
  C:\Windows\System\QWzzHkh.exe
  2⤵
  PID:3224
- C:\Windows\System\RdqmTXq.exe
  C:\Windows\System\RdqmTXq.exe
  2⤵
  PID:3248
- C:\Windows\System\UfLgjXx.exe
  C:\Windows\System\UfLgjXx.exe
  2⤵
  PID:3268
- C:\Windows\System\PbzeovG.exe
  C:\Windows\System\PbzeovG.exe
  2⤵
  PID:3288
- C:\Windows\System\qwYRlZJ.exe
  C:\Windows\System\qwYRlZJ.exe
  2⤵
  PID:3304
- C:\Windows\System\icSIARy.exe
  C:\Windows\System\icSIARy.exe
  2⤵
  PID:3320
- C:\Windows\System\XABYwqK.exe
  C:\Windows\System\XABYwqK.exe
  2⤵
  PID:3340
- C:\Windows\System\DOFuWuo.exe
  C:\Windows\System\DOFuWuo.exe
  2⤵
  PID:3356
- C:\Windows\System\KCmvcji.exe
  C:\Windows\System\KCmvcji.exe
  2⤵
  PID:3372
- C:\Windows\System\Qpqtkod.exe
  C:\Windows\System\Qpqtkod.exe
  2⤵
  PID:3388
- C:\Windows\System\VUIIKYT.exe
  C:\Windows\System\VUIIKYT.exe
  2⤵
  PID:3408
- C:\Windows\System\KbAvhPz.exe
  C:\Windows\System\KbAvhPz.exe
  2⤵
  PID:3428
- C:\Windows\System\dCwdqgh.exe
  C:\Windows\System\dCwdqgh.exe
  2⤵
  PID:3444
- C:\Windows\System\XaHLEDk.exe
  C:\Windows\System\XaHLEDk.exe
  2⤵
  PID:3468
- C:\Windows\System\UyiycPq.exe
  C:\Windows\System\UyiycPq.exe
  2⤵
  PID:3484
- C:\Windows\System\QvYWdGv.exe
  C:\Windows\System\QvYWdGv.exe
  2⤵
  PID:3508
- C:\Windows\System\rxKWmPa.exe
  C:\Windows\System\rxKWmPa.exe
  2⤵
  PID:3528
- C:\Windows\System\aesDmSC.exe
  C:\Windows\System\aesDmSC.exe
  2⤵
  PID:3544
- C:\Windows\System\QnRbAQh.exe
  C:\Windows\System\QnRbAQh.exe
  2⤵
  PID:3564
- C:\Windows\System\pXAQpYW.exe
  C:\Windows\System\pXAQpYW.exe
  2⤵
  PID:3588
- C:\Windows\System\xXoyuha.exe
  C:\Windows\System\xXoyuha.exe
  2⤵
  PID:3604
- C:\Windows\System\JHumkCa.exe
  C:\Windows\System\JHumkCa.exe
  2⤵
  PID:3624
- C:\Windows\System\tCeFnGB.exe
  C:\Windows\System\tCeFnGB.exe
  2⤵
  PID:3640
- C:\Windows\System\OcvhYZL.exe
  C:\Windows\System\OcvhYZL.exe
  2⤵
  PID:3660
- C:\Windows\System\FUehZQg.exe
  C:\Windows\System\FUehZQg.exe
  2⤵
  PID:3676
- C:\Windows\System\AAitqFz.exe
  C:\Windows\System\AAitqFz.exe
  2⤵
  PID:3692
- C:\Windows\System\pRiXvHN.exe
  C:\Windows\System\pRiXvHN.exe
  2⤵
  PID:3712
- C:\Windows\System\jHDaboQ.exe
  C:\Windows\System\jHDaboQ.exe
  2⤵
  PID:3732
- C:\Windows\System\ZOUEjov.exe
  C:\Windows\System\ZOUEjov.exe
  2⤵
  PID:3756
- C:\Windows\System\JOdDtjj.exe
  C:\Windows\System\JOdDtjj.exe
  2⤵
  PID:3776
- C:\Windows\System\mHijSFo.exe
  C:\Windows\System\mHijSFo.exe
  2⤵
  PID:3792
- C:\Windows\System\AyppZcD.exe
  C:\Windows\System\AyppZcD.exe
  2⤵
  PID:3812
- C:\Windows\System\bbavZYL.exe
  C:\Windows\System\bbavZYL.exe
  2⤵
  PID:3828
- C:\Windows\System\FobpTpC.exe
  C:\Windows\System\FobpTpC.exe
  2⤵
  PID:3844
- C:\Windows\System\LjVvesS.exe
  C:\Windows\System\LjVvesS.exe
  2⤵
  PID:3864
- C:\Windows\System\ZCPrbPO.exe
  C:\Windows\System\ZCPrbPO.exe
  2⤵
  PID:3884
- C:\Windows\System\oTlVGub.exe
  C:\Windows\System\oTlVGub.exe
  2⤵
  PID:3908
- C:\Windows\System\OAMASWD.exe
  C:\Windows\System\OAMASWD.exe
  2⤵
  PID:3928
- C:\Windows\System\CcDqMao.exe
  C:\Windows\System\CcDqMao.exe
  2⤵
  PID:3948
- C:\Windows\System\PAAgEYC.exe
  C:\Windows\System\PAAgEYC.exe
  2⤵
  PID:3964
- C:\Windows\System\MMPYxJy.exe
  C:\Windows\System\MMPYxJy.exe
  2⤵
  PID:3980
- C:\Windows\System\zIcsNRt.exe
  C:\Windows\System\zIcsNRt.exe
  2⤵
  PID:4000
- C:\Windows\System\rNgTQQG.exe
  C:\Windows\System\rNgTQQG.exe
  2⤵
  PID:4020
- C:\Windows\System\LpSkDoK.exe
  C:\Windows\System\LpSkDoK.exe
  2⤵
  PID:4040
- C:\Windows\System\RamXXue.exe
  C:\Windows\System\RamXXue.exe
  2⤵
  PID:4056
- C:\Windows\System\pfQNpGq.exe
  C:\Windows\System\pfQNpGq.exe
  2⤵
  PID:4076
- C:\Windows\System\hVhPbJX.exe
  C:\Windows\System\hVhPbJX.exe
  2⤵
  PID:4092
- C:\Windows\System\HQThfin.exe
  C:\Windows\System\HQThfin.exe
  2⤵
  PID:3084
- C:\Windows\System\MEOyyQC.exe
  C:\Windows\System\MEOyyQC.exe
  2⤵
  PID:700
- C:\Windows\System\dkXEBCJ.exe
  C:\Windows\System\dkXEBCJ.exe
  2⤵
  PID:3164
- C:\Windows\System\aGsjnbw.exe
  C:\Windows\System\aGsjnbw.exe
  2⤵
  PID:3200
- C:\Windows\System\yCYKRWn.exe
  C:\Windows\System\yCYKRWn.exe
  2⤵
  PID:2752
- C:\Windows\System\MOKqrty.exe
  C:\Windows\System\MOKqrty.exe
  2⤵
  PID:3280
- C:\Windows\System\AUooUYR.exe
  C:\Windows\System\AUooUYR.exe
  2⤵
  PID:3380
- C:\Windows\System\OhpIvjy.exe
  C:\Windows\System\OhpIvjy.exe
  2⤵
  PID:3464
- C:\Windows\System\uStVQWF.exe
  C:\Windows\System\uStVQWF.exe
  2⤵
  PID:3496
- C:\Windows\System\UQtRmmr.exe
  C:\Windows\System\UQtRmmr.exe
  2⤵
  PID:3572
- C:\Windows\System\WZbolKb.exe
  C:\Windows\System\WZbolKb.exe
  2⤵
  PID:2648
- C:\Windows\System\bkFEVgM.exe
  C:\Windows\System\bkFEVgM.exe
  2⤵
  PID:3808
- C:\Windows\System\qXEJSVr.exe
  C:\Windows\System\qXEJSVr.exe
  2⤵
  PID:3872
- C:\Windows\System\iDWCwxV.exe
  C:\Windows\System\iDWCwxV.exe
  2⤵
  PID:3956
- C:\Windows\System\wkcyBMR.exe
  C:\Windows\System\wkcyBMR.exe
  2⤵
  PID:2564
- C:\Windows\System\gJcmwAC.exe
  C:\Windows\System\gJcmwAC.exe
  2⤵
  PID:4068
- C:\Windows\System\RyMPrmq.exe
  C:\Windows\System\RyMPrmq.exe
  2⤵
  PID:3216
- C:\Windows\System\bwViuoi.exe
  C:\Windows\System\bwViuoi.exe
  2⤵
  PID:1436
- C:\Windows\System\EzswBrG.exe
  C:\Windows\System\EzswBrG.exe
  2⤵
  PID:2876
- C:\Windows\System\qKOAVuw.exe
  C:\Windows\System\qKOAVuw.exe
  2⤵
  PID:3352
- C:\Windows\System\PQJBhfn.exe
  C:\Windows\System\PQJBhfn.exe
  2⤵
  PID:2348
- C:\Windows\System\DdJuDrP.exe
  C:\Windows\System\DdJuDrP.exe
  2⤵
  PID:3612
- C:\Windows\System\IxKnSzw.exe
  C:\Windows\System\IxKnSzw.exe
  2⤵
  PID:3620
- C:\Windows\System\ejMfmxo.exe
  C:\Windows\System\ejMfmxo.exe
  2⤵
  PID:3600
- C:\Windows\System\mRMOaeo.exe
  C:\Windows\System\mRMOaeo.exe
  2⤵
  PID:3684
- C:\Windows\System\zNKtkTL.exe
  C:\Windows\System\zNKtkTL.exe
  2⤵
  PID:996
- C:\Windows\System\BfgMIGG.exe
  C:\Windows\System\BfgMIGG.exe
  2⤵
  PID:3136
- C:\Windows\System\EjWsXmp.exe
  C:\Windows\System\EjWsXmp.exe
  2⤵
  PID:1124
- C:\Windows\System\YuppKbl.exe
  C:\Windows\System\YuppKbl.exe
  2⤵
  PID:1792
- C:\Windows\System\mQmUzCV.exe
  C:\Windows\System\mQmUzCV.exe
  2⤵
  PID:3244
- C:\Windows\System\yrrJXPY.exe
  C:\Windows\System\yrrJXPY.exe
  2⤵
  PID:3396
- C:\Windows\System\wakoGmb.exe
  C:\Windows\System\wakoGmb.exe
  2⤵
  PID:3440
- C:\Windows\System\YDOQRpi.exe
  C:\Windows\System\YDOQRpi.exe
  2⤵
  PID:3556
- C:\Windows\System\JynVkDx.exe
  C:\Windows\System\JynVkDx.exe
  2⤵
  PID:3840
- C:\Windows\System\ZYxLOQO.exe
  C:\Windows\System\ZYxLOQO.exe
  2⤵
  PID:3180
- C:\Windows\System\QvVWTZD.exe
  C:\Windows\System\QvVWTZD.exe
  2⤵
  PID:3300
- C:\Windows\System\NybqfXP.exe
  C:\Windows\System\NybqfXP.exe
  2⤵
  PID:3520
- C:\Windows\System\HCFrftq.exe
  C:\Windows\System\HCFrftq.exe
  2⤵
  PID:3744
- C:\Windows\System\uXXKTuF.exe
  C:\Windows\System\uXXKTuF.exe
  2⤵
  PID:3788
- C:\Windows\System\GQNUxwe.exe
  C:\Windows\System\GQNUxwe.exe
  2⤵
  PID:3892
- C:\Windows\System\yqeZclZ.exe
  C:\Windows\System\yqeZclZ.exe
  2⤵
  PID:3940
- C:\Windows\System\hFHTHGN.exe
  C:\Windows\System\hFHTHGN.exe
  2⤵
  PID:4052
- C:\Windows\System\SMEzlKa.exe
  C:\Windows\System\SMEzlKa.exe
  2⤵
  PID:3120
- C:\Windows\System\OCiaCkM.exe
  C:\Windows\System\OCiaCkM.exe
  2⤵
  PID:3312
- C:\Windows\System\mSZHdWh.exe
  C:\Windows\System\mSZHdWh.exe
  2⤵
  PID:3536
- C:\Windows\System\eYQheCH.exe
  C:\Windows\System\eYQheCH.exe
  2⤵
  PID:3800
- C:\Windows\System\ILvOhas.exe
  C:\Windows\System\ILvOhas.exe
  2⤵
  PID:3988
- C:\Windows\System\ysMSxZt.exe
  C:\Windows\System\ysMSxZt.exe
  2⤵
  PID:3492
- C:\Windows\System\ZLReAto.exe
  C:\Windows\System\ZLReAto.exe
  2⤵
  PID:3656
- C:\Windows\System\cVrRPGM.exe
  C:\Windows\System\cVrRPGM.exe
  2⤵
  PID:3104
- C:\Windows\System\pxztYZJ.exe
  C:\Windows\System\pxztYZJ.exe
  2⤵
  PID:3064
- C:\Windows\System\fanGIAM.exe
  C:\Windows\System\fanGIAM.exe
  2⤵
  PID:1828
- C:\Windows\System\ihdDeyA.exe
  C:\Windows\System\ihdDeyA.exe
  2⤵
  PID:3332
- C:\Windows\System\dpavlvy.exe
  C:\Windows\System\dpavlvy.exe
  2⤵
  PID:3784
- C:\Windows\System\UIZByzA.exe
  C:\Windows\System\UIZByzA.exe
  2⤵
  PID:3904
- C:\Windows\System\LiojwKu.exe
  C:\Windows\System\LiojwKu.exe
  2⤵
  PID:3420
- C:\Windows\System\jOyOiAl.exe
  C:\Windows\System\jOyOiAl.exe
  2⤵
  PID:3960
- C:\Windows\System\apsvvQM.exe
  C:\Windows\System\apsvvQM.exe
  2⤵
  PID:3260
- C:\Windows\System\kjnGqlH.exe
  C:\Windows\System\kjnGqlH.exe
  2⤵
  PID:3584
- C:\Windows\System\WqPLPBj.exe
  C:\Windows\System\WqPLPBj.exe
  2⤵
  PID:4048
- C:\Windows\System\zYCuTdQ.exe
  C:\Windows\System\zYCuTdQ.exe
  2⤵
  PID:3296
- C:\Windows\System\kDGEnDK.exe
  C:\Windows\System\kDGEnDK.exe
  2⤵
  PID:3856
- C:\Windows\System\jFbmKPq.exe
  C:\Windows\System\jFbmKPq.exe
  2⤵
  PID:1196
- C:\Windows\System\BTaYamm.exe
  C:\Windows\System\BTaYamm.exe
  2⤵
  PID:3772
- C:\Windows\System\KVNewTA.exe
  C:\Windows\System\KVNewTA.exe
  2⤵
  PID:1688
- C:\Windows\System\imaEcFk.exe
  C:\Windows\System\imaEcFk.exe
  2⤵
  PID:3616
- C:\Windows\System\dOWuYwx.exe
  C:\Windows\System\dOWuYwx.exe
  2⤵
  PID:4036
- C:\Windows\System\KWnthRG.exe
  C:\Windows\System\KWnthRG.exe
  2⤵
  PID:664
- C:\Windows\System\KIQFuVx.exe
  C:\Windows\System\KIQFuVx.exe
  2⤵
  PID:964
- C:\Windows\System\ySOCazz.exe
  C:\Windows\System\ySOCazz.exe
  2⤵
  PID:3504
- C:\Windows\System\ZeysJIi.exe
  C:\Windows\System\ZeysJIi.exe
  2⤵
  PID:3752
- C:\Windows\System\BmSZgFC.exe
  C:\Windows\System\BmSZgFC.exe
  2⤵
  PID:2192
- C:\Windows\System\UPevDWr.exe
  C:\Windows\System\UPevDWr.exe
  2⤵
  PID:1848
- C:\Windows\System\Vnjnyot.exe
  C:\Windows\System\Vnjnyot.exe
  2⤵
  PID:4016
- C:\Windows\System\AeMWxBn.exe
  C:\Windows\System\AeMWxBn.exe
  2⤵
  PID:3972
- C:\Windows\System\JQtYWjh.exe
  C:\Windows\System\JQtYWjh.exe
  2⤵
  PID:3460
- C:\Windows\System\sOthDfw.exe
  C:\Windows\System\sOthDfw.exe
  2⤵
  PID:3700
- C:\Windows\System\txwNKol.exe
  C:\Windows\System\txwNKol.exe
  2⤵
  PID:4064
- C:\Windows\System\mRafiZK.exe
  C:\Windows\System\mRafiZK.exe
  2⤵
  PID:3100
- C:\Windows\System\DHOwAuc.exe
  C:\Windows\System\DHOwAuc.exe
  2⤵
  PID:4104
- C:\Windows\System\VRNbfVc.exe
  C:\Windows\System\VRNbfVc.exe
  2⤵
  PID:4120
- C:\Windows\System\amZuEEs.exe
  C:\Windows\System\amZuEEs.exe
  2⤵
  PID:4140
- C:\Windows\System\SXrSsAU.exe
  C:\Windows\System\SXrSsAU.exe
  2⤵
  PID:4156
- C:\Windows\System\COzmese.exe
  C:\Windows\System\COzmese.exe
  2⤵
  PID:4172
- C:\Windows\System\ViApRZn.exe
  C:\Windows\System\ViApRZn.exe
  2⤵
  PID:4192
- C:\Windows\System\AcLAfdI.exe
  C:\Windows\System\AcLAfdI.exe
  2⤵
  PID:4212
- C:\Windows\System\WEkBeMT.exe
  C:\Windows\System\WEkBeMT.exe
  2⤵
  PID:4232
- C:\Windows\System\RYQJWYN.exe
  C:\Windows\System\RYQJWYN.exe
  2⤵
  PID:4248
- C:\Windows\System\vLEWaPC.exe
  C:\Windows\System\vLEWaPC.exe
  2⤵
  PID:4272
- C:\Windows\System\xgoZQBH.exe
  C:\Windows\System\xgoZQBH.exe
  2⤵
  PID:4292
- C:\Windows\System\SAPGdaB.exe
  C:\Windows\System\SAPGdaB.exe
  2⤵
  PID:4308
- C:\Windows\System\rreRcGw.exe
  C:\Windows\System\rreRcGw.exe
  2⤵
  PID:4336
- C:\Windows\System\KpVJGNb.exe
  C:\Windows\System\KpVJGNb.exe
  2⤵
  PID:4364
- C:\Windows\System\CQcXCfw.exe
  C:\Windows\System\CQcXCfw.exe
  2⤵
  PID:4380
- C:\Windows\System\KlFRUeo.exe
  C:\Windows\System\KlFRUeo.exe
  2⤵
  PID:4400
- C:\Windows\System\DCRZxOr.exe
  C:\Windows\System\DCRZxOr.exe
  2⤵
  PID:4416
- C:\Windows\System\jBgNmNM.exe
  C:\Windows\System\jBgNmNM.exe
  2⤵
  PID:4436
- C:\Windows\System\tPKahCA.exe
  C:\Windows\System\tPKahCA.exe
  2⤵
  PID:4452
- C:\Windows\System\ytCbwOV.exe
  C:\Windows\System\ytCbwOV.exe
  2⤵
  PID:4472
- C:\Windows\System\KseLFgs.exe
  C:\Windows\System\KseLFgs.exe
  2⤵
  PID:4488
- C:\Windows\System\SeweZcj.exe
  C:\Windows\System\SeweZcj.exe
  2⤵
  PID:4560
- C:\Windows\System\RfxbaWs.exe
  C:\Windows\System\RfxbaWs.exe
  2⤵
  PID:4580
- C:\Windows\System\IUXaiZY.exe
  C:\Windows\System\IUXaiZY.exe
  2⤵
  PID:4596
- C:\Windows\System\fUxvduV.exe
  C:\Windows\System\fUxvduV.exe
  2⤵
  PID:4612
- C:\Windows\System\CWqlJVG.exe
  C:\Windows\System\CWqlJVG.exe
  2⤵
  PID:4628
- C:\Windows\System\rKfypvl.exe
  C:\Windows\System\rKfypvl.exe
  2⤵
  PID:4648
- C:\Windows\System\EWBwhrP.exe
  C:\Windows\System\EWBwhrP.exe
  2⤵
  PID:4668
- C:\Windows\System\pInqEqL.exe
  C:\Windows\System\pInqEqL.exe
  2⤵
  PID:4688
- C:\Windows\System\LvVFSKh.exe
  C:\Windows\System\LvVFSKh.exe
  2⤵
  PID:4704
- C:\Windows\System\aFsarNW.exe
  C:\Windows\System\aFsarNW.exe
  2⤵
  PID:4720
- C:\Windows\System\tQsWtda.exe
  C:\Windows\System\tQsWtda.exe
  2⤵
  PID:4736
- C:\Windows\System\IPzRStI.exe
  C:\Windows\System\IPzRStI.exe
  2⤵
  PID:4752
- C:\Windows\System\YbeGkXv.exe
  C:\Windows\System\YbeGkXv.exe
  2⤵
  PID:4768
- C:\Windows\System\CnXIReO.exe
  C:\Windows\System\CnXIReO.exe
  2⤵
  PID:4784
- C:\Windows\System\tJoEmKn.exe
  C:\Windows\System\tJoEmKn.exe
  2⤵
  PID:4800
- C:\Windows\System\defXYbv.exe
  C:\Windows\System\defXYbv.exe
  2⤵
  PID:4816
- C:\Windows\System\IpmcnIH.exe
  C:\Windows\System\IpmcnIH.exe
  2⤵
  PID:4832
- C:\Windows\System\xCboZTs.exe
  C:\Windows\System\xCboZTs.exe
  2⤵
  PID:4848
- C:\Windows\System\nEnnIrZ.exe
  C:\Windows\System\nEnnIrZ.exe
  2⤵
  PID:4904
- C:\Windows\System\bTuzyGO.exe
  C:\Windows\System\bTuzyGO.exe
  2⤵
  PID:4920
- C:\Windows\System\CTHUdpS.exe
  C:\Windows\System\CTHUdpS.exe
  2⤵
  PID:4936
- C:\Windows\System\Bbjwoqb.exe
  C:\Windows\System\Bbjwoqb.exe
  2⤵
  PID:4952
- C:\Windows\System\ItNIrPD.exe
  C:\Windows\System\ItNIrPD.exe
  2⤵
  PID:4972
- C:\Windows\System\uohNBlQ.exe
  C:\Windows\System\uohNBlQ.exe
  2⤵
  PID:4988
- C:\Windows\System\obZYDsl.exe
  C:\Windows\System\obZYDsl.exe
  2⤵
  PID:5008
- C:\Windows\System\qvKxkdP.exe
  C:\Windows\System\qvKxkdP.exe
  2⤵
  PID:5024
- C:\Windows\System\BMsEbHf.exe
  C:\Windows\System\BMsEbHf.exe
  2⤵
  PID:5044
- C:\Windows\System\kocKZtW.exe
  C:\Windows\System\kocKZtW.exe
  2⤵
  PID:5104
- C:\Windows\System\lcXjBFe.exe
  C:\Windows\System\lcXjBFe.exe
  2⤵
  PID:708
- C:\Windows\System\UDvzwqn.exe
  C:\Windows\System\UDvzwqn.exe
  2⤵
  PID:4180
- C:\Windows\System\kqhvcyr.exe
  C:\Windows\System\kqhvcyr.exe
  2⤵
  PID:4228
- C:\Windows\System\abkkLqL.exe
  C:\Windows\System\abkkLqL.exe
  2⤵
  PID:4268
- C:\Windows\System\giSVFlY.exe
  C:\Windows\System\giSVFlY.exe
  2⤵
  PID:4344
- C:\Windows\System\jUymteJ.exe
  C:\Windows\System\jUymteJ.exe
  2⤵
  PID:4352
- C:\Windows\System\oFGpZnL.exe
  C:\Windows\System\oFGpZnL.exe
  2⤵
  PID:4424
- C:\Windows\System\TNkRvgk.exe
  C:\Windows\System\TNkRvgk.exe
  2⤵
  PID:4464
- C:\Windows\System\ZrklSOe.exe
  C:\Windows\System\ZrklSOe.exe
  2⤵
  PID:4512
- C:\Windows\System\bPfjxUA.exe
  C:\Windows\System\bPfjxUA.exe
  2⤵
  PID:4524
- C:\Windows\System\FlujadF.exe
  C:\Windows\System\FlujadF.exe
  2⤵
  PID:4536
- C:\Windows\System\sEEhhBG.exe
  C:\Windows\System\sEEhhBG.exe
  2⤵
  PID:3976
- C:\Windows\System\LfQPQlJ.exe
  C:\Windows\System\LfQPQlJ.exe
  2⤵
  PID:3852
- C:\Windows\System\aFqAavj.exe
  C:\Windows\System\aFqAavj.exe
  2⤵
  PID:2448
- C:\Windows\System\FTqatdP.exe
  C:\Windows\System\FTqatdP.exe
  2⤵
  PID:4008
- C:\Windows\System\AnBTlQl.exe
  C:\Windows\System\AnBTlQl.exe
  2⤵
  PID:3348
- C:\Windows\System\oKaboNI.exe
  C:\Windows\System\oKaboNI.exe
  2⤵
  PID:4132
- C:\Windows\System\fVocBFC.exe
  C:\Windows\System\fVocBFC.exe
  2⤵
  PID:4204
- C:\Windows\System\TmuTNtx.exe
  C:\Windows\System\TmuTNtx.exe
  2⤵
  PID:4324
- C:\Windows\System\iWSqXYZ.exe
  C:\Windows\System\iWSqXYZ.exe
  2⤵
  PID:4408
- C:\Windows\System\bMaXYLD.exe
  C:\Windows\System\bMaXYLD.exe
  2⤵
  PID:4484
- C:\Windows\System\YCkAIYG.exe
  C:\Windows\System\YCkAIYG.exe
  2⤵
  PID:4620
- C:\Windows\System\uiggOnO.exe
  C:\Windows\System\uiggOnO.exe
  2⤵
  PID:4660
- C:\Windows\System\nMLQets.exe
  C:\Windows\System\nMLQets.exe
  2⤵
  PID:4576
- C:\Windows\System\EXjeksq.exe
  C:\Windows\System\EXjeksq.exe
  2⤵
  PID:4676
- C:\Windows\System\gAsnLio.exe
  C:\Windows\System\gAsnLio.exe
  2⤵
  PID:4732
- C:\Windows\System\aHywoBa.exe
  C:\Windows\System\aHywoBa.exe
  2⤵
  PID:4824
- C:\Windows\System\XzIfjpj.exe
  C:\Windows\System\XzIfjpj.exe
  2⤵
  PID:4868
- C:\Windows\System\awOXieQ.exe
  C:\Windows\System\awOXieQ.exe
  2⤵
  PID:4892
- C:\Windows\System\KPTSyes.exe
  C:\Windows\System\KPTSyes.exe
  2⤵
  PID:4932
- C:\Windows\System\kYBzwjR.exe
  C:\Windows\System\kYBzwjR.exe
  2⤵
  PID:4968
- C:\Windows\System\eAamSfg.exe
  C:\Windows\System\eAamSfg.exe
  2⤵
  PID:5040
- C:\Windows\System\RGOaUln.exe
  C:\Windows\System\RGOaUln.exe
  2⤵
  PID:5084
- C:\Windows\System\fmrApsO.exe
  C:\Windows\System\fmrApsO.exe
  2⤵
  PID:4808
- C:\Windows\System\zVDeLQS.exe
  C:\Windows\System\zVDeLQS.exe
  2⤵
  PID:4984
- C:\Windows\System\xNSxiie.exe
  C:\Windows\System\xNSxiie.exe
  2⤵
  PID:5080
- C:\Windows\System\APHzmQr.exe
  C:\Windows\System\APHzmQr.exe
  2⤵
  PID:5112
- C:\Windows\System\NmOvXPA.exe
  C:\Windows\System\NmOvXPA.exe
  2⤵
  PID:4220
- C:\Windows\System\jlYBXTH.exe
  C:\Windows\System\jlYBXTH.exe
  2⤵
  PID:5100
- C:\Windows\System\OaYhqOa.exe
  C:\Windows\System\OaYhqOa.exe
  2⤵
  PID:4392
- C:\Windows\System\MhZoLRM.exe
  C:\Windows\System\MhZoLRM.exe
  2⤵
  PID:4528
- C:\Windows\System\JskviDu.exe
  C:\Windows\System\JskviDu.exe
  2⤵
  PID:4428
- C:\Windows\System\QXPNvdm.exe
  C:\Windows\System\QXPNvdm.exe
  2⤵
  PID:3740
- C:\Windows\System\oTHQawG.exe
  C:\Windows\System\oTHQawG.exe
  2⤵
  PID:4280
- C:\Windows\System\BzXlKoy.exe
  C:\Windows\System\BzXlKoy.exe
  2⤵
  PID:4316
- C:\Windows\System\BBhjRhv.exe
  C:\Windows\System\BBhjRhv.exe
  2⤵
  PID:4640
- C:\Windows\System\mGzsJqf.exe
  C:\Windows\System\mGzsJqf.exe
  2⤵
  PID:4796
- C:\Windows\System\xgZmXRe.exe
  C:\Windows\System\xgZmXRe.exe
  2⤵
  PID:4888
- C:\Windows\System\TWbOeFd.exe
  C:\Windows\System\TWbOeFd.exe
  2⤵
  PID:4520
- C:\Windows\System\uXoNqRY.exe
  C:\Windows\System\uXoNqRY.exe
  2⤵
  PID:4240
- C:\Windows\System\gnqUlgq.exe
  C:\Windows\System\gnqUlgq.exe
  2⤵
  PID:4372
- C:\Windows\System\cKpGAJh.exe
  C:\Windows\System\cKpGAJh.exe
  2⤵
  PID:4636
- C:\Windows\System\rasisll.exe
  C:\Windows\System\rasisll.exe
  2⤵
  PID:4860
- C:\Windows\System\wJFVjpn.exe
  C:\Windows\System\wJFVjpn.exe
  2⤵
  PID:4900
- C:\Windows\System\AGITJVS.exe
  C:\Windows\System\AGITJVS.exe
  2⤵
  PID:4712
- C:\Windows\System\jSkjhaT.exe
  C:\Windows\System\jSkjhaT.exe
  2⤵
  PID:4748
- C:\Windows\System\ZbFBlPN.exe
  C:\Windows\System\ZbFBlPN.exe
  2⤵
  PID:4812
- C:\Windows\System\wxYGUix.exe
  C:\Windows\System\wxYGUix.exe
  2⤵
  PID:5092
- C:\Windows\System\DKMaeBO.exe
  C:\Windows\System\DKMaeBO.exe
  2⤵
  PID:4780
- C:\Windows\System\nfYQKDp.exe
  C:\Windows\System\nfYQKDp.exe
  2⤵
  PID:4188
- C:\Windows\System\qjZNGvP.exe
  C:\Windows\System\qjZNGvP.exe
  2⤵
  PID:4508
- C:\Windows\System\XNutCMn.exe
  C:\Windows\System\XNutCMn.exe
  2⤵
  PID:4540
- C:\Windows\System\FXEALiH.exe
  C:\Windows\System\FXEALiH.exe
  2⤵
  PID:5000
- C:\Windows\System\CzdaewF.exe
  C:\Windows\System\CzdaewF.exe
  2⤵
  PID:3116
- C:\Windows\System\OPhYkoz.exe
  C:\Windows\System\OPhYkoz.exe
  2⤵
  PID:4432
- C:\Windows\System\saUtHoi.exe
  C:\Windows\System\saUtHoi.exe
  2⤵
  PID:4876
- C:\Windows\System\jqwIdVL.exe
  C:\Windows\System\jqwIdVL.exe
  2⤵
  PID:4700
- C:\Windows\System\DpaRIhV.exe
  C:\Windows\System\DpaRIhV.exe
  2⤵
  PID:4348
- C:\Windows\System\atyLHha.exe
  C:\Windows\System\atyLHha.exe
  2⤵
  PID:4100
- C:\Windows\System\zpnuKRD.exe
  C:\Windows\System\zpnuKRD.exe
  2⤵
  PID:4128
- C:\Windows\System\zMZkMEE.exe
  C:\Windows\System\zMZkMEE.exe
  2⤵
  PID:4912
- C:\Windows\System\EfGNSUY.exe
  C:\Windows\System\EfGNSUY.exe
  2⤵
  PID:4880
- C:\Windows\System\tdeqfLw.exe
  C:\Windows\System\tdeqfLw.exe
  2⤵
  PID:4776
- C:\Windows\System\CXChvPG.exe
  C:\Windows\System\CXChvPG.exe
  2⤵
  PID:3936
- C:\Windows\System\tjEcERR.exe
  C:\Windows\System\tjEcERR.exe
  2⤵
  PID:4556
- C:\Windows\System\VJxcIuX.exe
  C:\Windows\System\VJxcIuX.exe
  2⤵
  PID:5020
- C:\Windows\System\IQCiXlV.exe
  C:\Windows\System\IQCiXlV.exe
  2⤵
  PID:5072
- C:\Windows\System\XgYSKTX.exe
  C:\Windows\System\XgYSKTX.exe
  2⤵
  PID:4592
- C:\Windows\System\ZpojUjd.exe
  C:\Windows\System\ZpojUjd.exe
  2⤵
  PID:4644
- C:\Windows\System\RWnwncX.exe
  C:\Windows\System\RWnwncX.exe
  2⤵
  PID:4844
- C:\Windows\System\yCTeOqu.exe
  C:\Windows\System\yCTeOqu.exe
  2⤵
  PID:4264
- C:\Windows\System\hxUIeec.exe
  C:\Windows\System\hxUIeec.exe
  2⤵
  PID:4948
- C:\Windows\System\HsCYmDj.exe
  C:\Windows\System\HsCYmDj.exe
  2⤵
  PID:4856
- C:\Windows\System\ICQbijk.exe
  C:\Windows\System\ICQbijk.exe
  2⤵
  PID:1896
- C:\Windows\System\XHRqybg.exe
  C:\Windows\System\XHRqybg.exe
  2⤵
  PID:5004
- C:\Windows\System\DTiFCIP.exe
  C:\Windows\System\DTiFCIP.exe
  2⤵
  PID:5124
- C:\Windows\System\LWqAZBB.exe
  C:\Windows\System\LWqAZBB.exe
  2⤵
  PID:5140
- C:\Windows\System\oivGUqN.exe
  C:\Windows\System\oivGUqN.exe
  2⤵
  PID:5160
- C:\Windows\System\YeTRHqQ.exe
  C:\Windows\System\YeTRHqQ.exe
  2⤵
  PID:5176
- C:\Windows\System\FAmKVOQ.exe
  C:\Windows\System\FAmKVOQ.exe
  2⤵
  PID:5204
- C:\Windows\System\FVhSbWO.exe
  C:\Windows\System\FVhSbWO.exe
  2⤵
  PID:5220
- C:\Windows\System\tMwwOGC.exe
  C:\Windows\System\tMwwOGC.exe
  2⤵
  PID:5240
- C:\Windows\System\KNqWIKe.exe
  C:\Windows\System\KNqWIKe.exe
  2⤵
  PID:5268
- C:\Windows\System\gtlAqBv.exe
  C:\Windows\System\gtlAqBv.exe
  2⤵
  PID:5284
- C:\Windows\System\aboaQrO.exe
  C:\Windows\System\aboaQrO.exe
  2⤵
  PID:5300
- C:\Windows\System\MlcvbEo.exe
  C:\Windows\System\MlcvbEo.exe
  2⤵
  PID:5316
- C:\Windows\System\uSYKcGt.exe
  C:\Windows\System\uSYKcGt.exe
  2⤵
  PID:5332
- C:\Windows\System\tESowcl.exe
  C:\Windows\System\tESowcl.exe
  2⤵
  PID:5352
- C:\Windows\System\vcwhunJ.exe
  C:\Windows\System\vcwhunJ.exe
  2⤵
  PID:5372
- C:\Windows\System\BDUdjPs.exe
  C:\Windows\System\BDUdjPs.exe
  2⤵
  PID:5388
- C:\Windows\System\PURyivI.exe
  C:\Windows\System\PURyivI.exe
  2⤵
  PID:5404
- C:\Windows\System\RRaeIJi.exe
  C:\Windows\System\RRaeIJi.exe
  2⤵
  PID:5420
- C:\Windows\System\kWokcUm.exe
  C:\Windows\System\kWokcUm.exe
  2⤵
  PID:5436
- C:\Windows\System\tDIHjOx.exe
  C:\Windows\System\tDIHjOx.exe
  2⤵
  PID:5464
- C:\Windows\System\SDJbmyR.exe
  C:\Windows\System\SDJbmyR.exe
  2⤵
  PID:5484
- C:\Windows\System\ZrYiNVC.exe
  C:\Windows\System\ZrYiNVC.exe
  2⤵
  PID:5508
- C:\Windows\System\sTRWmIb.exe
  C:\Windows\System\sTRWmIb.exe
  2⤵
  PID:5524
- C:\Windows\System\ZehEqod.exe
  C:\Windows\System\ZehEqod.exe
  2⤵
  PID:5544
- C:\Windows\System\kpPXNxv.exe
  C:\Windows\System\kpPXNxv.exe
  2⤵
  PID:5560
- C:\Windows\System\kfNHopm.exe
  C:\Windows\System\kfNHopm.exe
  2⤵
  PID:5576
- C:\Windows\System\dwkTPVd.exe
  C:\Windows\System\dwkTPVd.exe
  2⤵
  PID:5592
- C:\Windows\System\BZsAmzJ.exe
  C:\Windows\System\BZsAmzJ.exe
  2⤵
  PID:5608
- C:\Windows\System\VrYNAUo.exe
  C:\Windows\System\VrYNAUo.exe
  2⤵
  PID:5628
- C:\Windows\System\KXkkiXW.exe
  C:\Windows\System\KXkkiXW.exe
  2⤵
  PID:5648
- C:\Windows\System\mVPydyc.exe
  C:\Windows\System\mVPydyc.exe
  2⤵
  PID:5664
- C:\Windows\System\oPGCbJs.exe
  C:\Windows\System\oPGCbJs.exe
  2⤵
  PID:5684
- C:\Windows\System\kHpPvEw.exe
  C:\Windows\System\kHpPvEw.exe
  2⤵
  PID:5704
- C:\Windows\System\nHLxFPl.exe
  C:\Windows\System\nHLxFPl.exe
  2⤵
  PID:5724
- C:\Windows\System\VrzkdnD.exe
  C:\Windows\System\VrzkdnD.exe
  2⤵
  PID:5740
- C:\Windows\System\RYGzZXz.exe
  C:\Windows\System\RYGzZXz.exe
  2⤵
  PID:5756
- C:\Windows\System\yFzumFC.exe
  C:\Windows\System\yFzumFC.exe
  2⤵
  PID:5836
- C:\Windows\System\VnraoZs.exe
  C:\Windows\System\VnraoZs.exe
  2⤵
  PID:5856
- C:\Windows\System\KhrsazK.exe
  C:\Windows\System\KhrsazK.exe
  2⤵
  PID:5876
- C:\Windows\System\RyZZLsq.exe
  C:\Windows\System\RyZZLsq.exe
  2⤵
  PID:5892
- C:\Windows\System\WwATIzx.exe
  C:\Windows\System\WwATIzx.exe
  2⤵
  PID:5908
- C:\Windows\System\fejuKnE.exe
  C:\Windows\System\fejuKnE.exe
  2⤵
  PID:5924
- C:\Windows\System\yituCzM.exe
  C:\Windows\System\yituCzM.exe
  2⤵
  PID:5940
- C:\Windows\System\vVXXwfW.exe
  C:\Windows\System\vVXXwfW.exe
  2⤵
  PID:5956
- C:\Windows\System\bbfcUfy.exe
  C:\Windows\System\bbfcUfy.exe
  2⤵
  PID:5984
- C:\Windows\System\VdGESaV.exe
  C:\Windows\System\VdGESaV.exe
  2⤵
  PID:6016
- C:\Windows\System\UTPpPYJ.exe
  C:\Windows\System\UTPpPYJ.exe
  2⤵
  PID:6036
- C:\Windows\System\KLXgPjD.exe
  C:\Windows\System\KLXgPjD.exe
  2⤵
  PID:6056
- C:\Windows\System\ucMvxjl.exe
  C:\Windows\System\ucMvxjl.exe
  2⤵
  PID:6072
- C:\Windows\System\DJMxwpW.exe
  C:\Windows\System\DJMxwpW.exe
  2⤵
  PID:6088
- C:\Windows\System\wglJCQp.exe
  C:\Windows\System\wglJCQp.exe
  2⤵
  PID:6108
- C:\Windows\System\ZzEBycK.exe
  C:\Windows\System\ZzEBycK.exe
  2⤵
  PID:6124
- C:\Windows\System\gWnXkwM.exe
  C:\Windows\System\gWnXkwM.exe
  2⤵
  PID:4460
- C:\Windows\System\qEfVMZF.exe
  C:\Windows\System\qEfVMZF.exe
  2⤵
  PID:5168
- C:\Windows\System\AAOgHif.exe
  C:\Windows\System\AAOgHif.exe
  2⤵
  PID:4256
- C:\Windows\System\yGYEuGw.exe
  C:\Windows\System\yGYEuGw.exe
  2⤵
  PID:5216
- C:\Windows\System\JaNOCzO.exe
  C:\Windows\System\JaNOCzO.exe
  2⤵
  PID:5248
- C:\Windows\System\DOfMoTJ.exe
  C:\Windows\System\DOfMoTJ.exe
  2⤵
  PID:5296
- C:\Windows\System\iwIhWMT.exe
  C:\Windows\System\iwIhWMT.exe
  2⤵
  PID:5360
- C:\Windows\System\tUiKDHz.exe
  C:\Windows\System\tUiKDHz.exe
  2⤵
  PID:5232
- C:\Windows\System\PkcGFvq.exe
  C:\Windows\System\PkcGFvq.exe
  2⤵
  PID:5156
- C:\Windows\System\gRfBlxu.exe
  C:\Windows\System\gRfBlxu.exe
  2⤵
  PID:5236
- C:\Windows\System\XBFhFGo.exe
  C:\Windows\System\XBFhFGo.exe
  2⤵
  PID:5552
- C:\Windows\System\ConmFYD.exe
  C:\Windows\System\ConmFYD.exe
  2⤵
  PID:5620
- C:\Windows\System\sCHXLdN.exe
  C:\Windows\System\sCHXLdN.exe
  2⤵
  PID:5700
- C:\Windows\System\ZewxxAm.exe
  C:\Windows\System\ZewxxAm.exe
  2⤵
  PID:5768
- C:\Windows\System\hCuyPiY.exe
  C:\Windows\System\hCuyPiY.exe
  2⤵
  PID:5776
- C:\Windows\System\cYPLung.exe
  C:\Windows\System\cYPLung.exe
  2⤵
  PID:5788
- C:\Windows\System\HszozNU.exe
  C:\Windows\System\HszozNU.exe
  2⤵
  PID:5604
- C:\Windows\System\OuSPegx.exe
  C:\Windows\System\OuSPegx.exe
  2⤵
  PID:5636
- C:\Windows\System\vNYbcPT.exe
  C:\Windows\System\vNYbcPT.exe
  2⤵
  PID:5680
- C:\Windows\System\XeDpYXl.exe
  C:\Windows\System\XeDpYXl.exe
  2⤵
  PID:5808
- C:\Windows\System\YWwTJAI.exe
  C:\Windows\System\YWwTJAI.exe
  2⤵
  PID:5832
- C:\Windows\System\eRQigEX.exe
  C:\Windows\System\eRQigEX.exe
  2⤵
  PID:5348
- C:\Windows\System\eHUiSWy.exe
  C:\Windows\System\eHUiSWy.exe
  2⤵
  PID:5452
- C:\Windows\System\AYGfeOG.exe
  C:\Windows\System\AYGfeOG.exe
  2⤵
  PID:5932
- C:\Windows\System\SICWMrh.exe
  C:\Windows\System\SICWMrh.exe
  2⤵
  PID:5968
- C:\Windows\System\wEvmGLg.exe
  C:\Windows\System\wEvmGLg.exe
  2⤵
  PID:5572
- C:\Windows\System\uFWMLPy.exe
  C:\Windows\System\uFWMLPy.exe
  2⤵
  PID:5884
- C:\Windows\System\KpYOSOq.exe
  C:\Windows\System\KpYOSOq.exe
  2⤵
  PID:5496
- C:\Windows\System\nVIfZsZ.exe
  C:\Windows\System\nVIfZsZ.exe
  2⤵
  PID:5996
- C:\Windows\System\kezJSze.exe
  C:\Windows\System\kezJSze.exe
  2⤵
  PID:6008
- C:\Windows\System\lFpaczJ.exe
  C:\Windows\System\lFpaczJ.exe
  2⤵
  PID:6032
- C:\Windows\System\HHgUCbj.exe
  C:\Windows\System\HHgUCbj.exe
  2⤵
  PID:6068
- C:\Windows\System\vPlOSgQ.exe
  C:\Windows\System\vPlOSgQ.exe
  2⤵
  PID:4608
- C:\Windows\System\xCimsOn.exe
  C:\Windows\System\xCimsOn.exe
  2⤵
  PID:5188
- C:\Windows\System\jpfKhve.exe
  C:\Windows\System\jpfKhve.exe
  2⤵
  PID:5264
- C:\Windows\System\XSBtWXc.exe
  C:\Windows\System\XSBtWXc.exe
  2⤵
  PID:6120
- C:\Windows\System\oDSvnFI.exe
  C:\Windows\System\oDSvnFI.exe
  2⤵
  PID:5328
- C:\Windows\System\xAaKpmw.exe
  C:\Windows\System\xAaKpmw.exe
  2⤵
  PID:4496
- C:\Windows\System\pTPMkHL.exe
  C:\Windows\System\pTPMkHL.exe
  2⤵
  PID:5480
- C:\Windows\System\xIyFCdS.exe
  C:\Windows\System\xIyFCdS.exe
  2⤵
  PID:5396
- C:\Windows\System\mHRYwkF.exe
  C:\Windows\System\mHRYwkF.exe
  2⤵
  PID:5432
- C:\Windows\System\ATqgpYQ.exe
  C:\Windows\System\ATqgpYQ.exe
  2⤵
  PID:5428
- C:\Windows\System\aAkViBb.exe
  C:\Windows\System\aAkViBb.exe
  2⤵
  PID:5600
- C:\Windows\System\StAQWIn.exe
  C:\Windows\System\StAQWIn.exe
  2⤵
  PID:5672
- C:\Windows\System\hBEwaqf.exe
  C:\Windows\System\hBEwaqf.exe
  2⤵
  PID:5800
- C:\Windows\System\Vncllxl.exe
  C:\Windows\System\Vncllxl.exe
  2⤵
  PID:5752
- C:\Windows\System\YKIbxCQ.exe
  C:\Windows\System\YKIbxCQ.exe
  2⤵
  PID:5344
- C:\Windows\System\PFcLftJ.exe
  C:\Windows\System\PFcLftJ.exe
  2⤵
  PID:5448
- C:\Windows\System\LaVnZUi.exe
  C:\Windows\System\LaVnZUi.exe
  2⤵
  PID:5872
- C:\Windows\System\PHYgfDD.exe
  C:\Windows\System\PHYgfDD.exe
  2⤵
  PID:5276
- C:\Windows\System\vfuhbrl.exe
  C:\Windows\System\vfuhbrl.exe
  2⤵
  PID:5920
- C:\Windows\System\MKZYSXn.exe
  C:\Windows\System\MKZYSXn.exe
  2⤵
  PID:6140
- C:\Windows\System\eZpfFbH.exe
  C:\Windows\System\eZpfFbH.exe
  2⤵
  PID:5152
- C:\Windows\System\CeHVevU.exe
  C:\Windows\System\CeHVevU.exe
  2⤵
  PID:5980
- C:\Windows\System\krdKQLV.exe
  C:\Windows\System\krdKQLV.exe
  2⤵
  PID:5368
- C:\Windows\System\zVhnvrd.exe
  C:\Windows\System\zVhnvrd.exe
  2⤵
  PID:5200
- C:\Windows\System\qbFggbf.exe
  C:\Windows\System\qbFggbf.exe
  2⤵
  PID:6064
- C:\Windows\System\fNaEEOY.exe
  C:\Windows\System\fNaEEOY.exe
  2⤵
  PID:5400
- C:\Windows\System\NwXdDgJ.exe
  C:\Windows\System\NwXdDgJ.exe
  2⤵
  PID:5676
- C:\Windows\System\xKXkGIx.exe
  C:\Windows\System\xKXkGIx.exe
  2⤵
  PID:5828
- C:\Windows\System\rkgElfE.exe
  C:\Windows\System\rkgElfE.exe
  2⤵
  PID:5720
- C:\Windows\System\RDdIHWX.exe
  C:\Windows\System\RDdIHWX.exe
  2⤵
  PID:5992
- C:\Windows\System\eZgnUmO.exe
  C:\Windows\System\eZgnUmO.exe
  2⤵
  PID:6044
- C:\Windows\System\ETCIIhD.exe
  C:\Windows\System\ETCIIhD.exe
  2⤵
  PID:6052
- C:\Windows\System\SKVYzay.exe
  C:\Windows\System\SKVYzay.exe
  2⤵
  PID:6048
- C:\Windows\System\rZJOBVk.exe
  C:\Windows\System\rZJOBVk.exe
  2⤵
  PID:4152
- C:\Windows\System\bEEkwbL.exe
  C:\Windows\System\bEEkwbL.exe
  2⤵
  PID:6132
- C:\Windows\System\QohCIgx.exe
  C:\Windows\System\QohCIgx.exe
  2⤵
  PID:6080
- C:\Windows\System\AwCUUML.exe
  C:\Windows\System\AwCUUML.exe
  2⤵
  PID:5568
- C:\Windows\System\CimSzsW.exe
  C:\Windows\System\CimSzsW.exe
  2⤵
  PID:6100
- C:\Windows\System\xbiRrMR.exe
  C:\Windows\System\xbiRrMR.exe
  2⤵
  PID:5764
- C:\Windows\System\MstnLwK.exe
  C:\Windows\System\MstnLwK.exe
  2⤵
  PID:6160
- C:\Windows\System\oadExhh.exe
  C:\Windows\System\oadExhh.exe
  2⤵
  PID:6180
- C:\Windows\System\NiMgYjM.exe
  C:\Windows\System\NiMgYjM.exe
  2⤵
  PID:6196
- C:\Windows\System\NAoFsdq.exe
  C:\Windows\System\NAoFsdq.exe
  2⤵
  PID:6220
- C:\Windows\System\eylXSZm.exe
  C:\Windows\System\eylXSZm.exe
  2⤵
  PID:6240
- C:\Windows\System\OXDeoOS.exe
  C:\Windows\System\OXDeoOS.exe
  2⤵
  PID:6256
- C:\Windows\System\ughhJxa.exe
  C:\Windows\System\ughhJxa.exe
  2⤵
  PID:6276
- C:\Windows\System\lrECwdb.exe
  C:\Windows\System\lrECwdb.exe
  2⤵
  PID:6296
- C:\Windows\System\XHnpuNx.exe
  C:\Windows\System\XHnpuNx.exe
  2⤵
  PID:6312
- C:\Windows\System\VIXTosL.exe
  C:\Windows\System\VIXTosL.exe
  2⤵
  PID:6332
- C:\Windows\System\NjtJepe.exe
  C:\Windows\System\NjtJepe.exe
  2⤵
  PID:6348
- C:\Windows\System\wkzwVMT.exe
  C:\Windows\System\wkzwVMT.exe
  2⤵
  PID:6368
- C:\Windows\System\DgMJdZo.exe
  C:\Windows\System\DgMJdZo.exe
  2⤵
  PID:6392
- C:\Windows\System\XDgaKVy.exe
  C:\Windows\System\XDgaKVy.exe
  2⤵
  PID:6408
- C:\Windows\System\LUaPHIu.exe
  C:\Windows\System\LUaPHIu.exe
  2⤵
  PID:6436
- C:\Windows\System\icvoQnn.exe
  C:\Windows\System\icvoQnn.exe
  2⤵
  PID:6460
- C:\Windows\System\AeYnhMq.exe
  C:\Windows\System\AeYnhMq.exe
  2⤵
  PID:6484
- C:\Windows\System\FUAuFZP.exe
  C:\Windows\System\FUAuFZP.exe
  2⤵
  PID:6504
- C:\Windows\System\JImSPcv.exe
  C:\Windows\System\JImSPcv.exe
  2⤵
  PID:6524
- C:\Windows\System\tIXKhIR.exe
  C:\Windows\System\tIXKhIR.exe
  2⤵
  PID:6548
- C:\Windows\System\cMCtFIs.exe
  C:\Windows\System\cMCtFIs.exe
  2⤵
  PID:6584
- C:\Windows\System\VclxPAq.exe
  C:\Windows\System\VclxPAq.exe
  2⤵
  PID:6600
- C:\Windows\System\mpAwiKA.exe
  C:\Windows\System\mpAwiKA.exe
  2⤵
  PID:6628
- C:\Windows\System\sIhBnho.exe
  C:\Windows\System\sIhBnho.exe
  2⤵
  PID:6644
- C:\Windows\System\cqoRyML.exe
  C:\Windows\System\cqoRyML.exe
  2⤵
  PID:6660
- C:\Windows\System\zONdvnV.exe
  C:\Windows\System\zONdvnV.exe
  2⤵
  PID:6680
- C:\Windows\System\TCyEaNA.exe
  C:\Windows\System\TCyEaNA.exe
  2⤵
  PID:6696
- C:\Windows\System\VddimTX.exe
  C:\Windows\System\VddimTX.exe
  2⤵
  PID:6716
- C:\Windows\System\KWDQQMP.exe
  C:\Windows\System\KWDQQMP.exe
  2⤵
  PID:6736
- C:\Windows\System\NaCMYUh.exe
  C:\Windows\System\NaCMYUh.exe
  2⤵
  PID:6752
- C:\Windows\System\KMbqCrz.exe
  C:\Windows\System\KMbqCrz.exe
  2⤵
  PID:6768
- C:\Windows\System\uTBDVEZ.exe
  C:\Windows\System\uTBDVEZ.exe
  2⤵
  PID:6788
- C:\Windows\System\AZtGHjO.exe
  C:\Windows\System\AZtGHjO.exe
  2⤵
  PID:6804
- C:\Windows\System\KxDjZcV.exe
  C:\Windows\System\KxDjZcV.exe
  2⤵
  PID:6824
- C:\Windows\System\jAauHvm.exe
  C:\Windows\System\jAauHvm.exe
  2⤵
  PID:6840
- C:\Windows\System\CLqjkRx.exe
  C:\Windows\System\CLqjkRx.exe
  2⤵
  PID:6860
- C:\Windows\System\EbJjDCa.exe
  C:\Windows\System\EbJjDCa.exe
  2⤵
  PID:6880
- C:\Windows\System\YLpsYLZ.exe
  C:\Windows\System\YLpsYLZ.exe
  2⤵
  PID:6896
- C:\Windows\System\pXGZacv.exe
  C:\Windows\System\pXGZacv.exe
  2⤵
  PID:6924
- C:\Windows\System\YlkIcVF.exe
  C:\Windows\System\YlkIcVF.exe
  2⤵
  PID:6940
- C:\Windows\System\cwSmVkp.exe
  C:\Windows\System\cwSmVkp.exe
  2⤵
  PID:6956
- C:\Windows\System\GZrPIoY.exe
  C:\Windows\System\GZrPIoY.exe
  2⤵
  PID:6976
- C:\Windows\System\ejkDMXu.exe
  C:\Windows\System\ejkDMXu.exe
  2⤵
  PID:6992
- C:\Windows\System\srOixbW.exe
  C:\Windows\System\srOixbW.exe
  2⤵
  PID:7012
- C:\Windows\System\MTnAEhE.exe
  C:\Windows\System\MTnAEhE.exe
  2⤵
  PID:7036
- C:\Windows\System\ETcpZZt.exe
  C:\Windows\System\ETcpZZt.exe
  2⤵
  PID:7052
- C:\Windows\System\RYYkQAS.exe
  C:\Windows\System\RYYkQAS.exe
  2⤵
  PID:7068
- C:\Windows\System\nfrnSOe.exe
  C:\Windows\System\nfrnSOe.exe
  2⤵
  PID:7088
- C:\Windows\System\TpvPoAq.exe
  C:\Windows\System\TpvPoAq.exe
  2⤵
  PID:7104
- C:\Windows\System\NBLciPW.exe
  C:\Windows\System\NBLciPW.exe
  2⤵
  PID:7120
- C:\Windows\System\SRYSRBD.exe
  C:\Windows\System\SRYSRBD.exe
  2⤵
  PID:7136
- C:\Windows\System\dTCdHVP.exe
  C:\Windows\System\dTCdHVP.exe
  2⤵
  PID:7152
- C:\Windows\System\edYOFLL.exe
  C:\Windows\System\edYOFLL.exe
  2⤵
  PID:5136
- C:\Windows\System\xFjrlyz.exe
  C:\Windows\System\xFjrlyz.exe
  2⤵
  PID:6176
- C:\Windows\System\iACmjbG.exe
  C:\Windows\System\iACmjbG.exe
  2⤵
  PID:6248
- C:\Windows\System\VKlrkzv.exe
  C:\Windows\System\VKlrkzv.exe
  2⤵
  PID:6292
- C:\Windows\System\zgcPajq.exe
  C:\Windows\System\zgcPajq.exe
  2⤵
  PID:6356
- C:\Windows\System\oQsgzRG.exe
  C:\Windows\System\oQsgzRG.exe
  2⤵
  PID:5948
- C:\Windows\System\yQOogsf.exe
  C:\Windows\System\yQOogsf.exe
  2⤵
  PID:6024
- C:\Windows\System\gaTAtJS.exe
  C:\Windows\System\gaTAtJS.exe
  2⤵
  PID:6156
- C:\Windows\System\ULkCYwm.exe
  C:\Windows\System\ULkCYwm.exe
  2⤵
  PID:6496
- C:\Windows\System\EjWMZMF.exe
  C:\Windows\System\EjWMZMF.exe
  2⤵
  PID:6304
- C:\Windows\System\YtwzHiA.exe
  C:\Windows\System\YtwzHiA.exe
  2⤵
  PID:6540
- C:\Windows\System\YznmTij.exe
  C:\Windows\System\YznmTij.exe
  2⤵
  PID:6188
- C:\Windows\System\Lvgrpov.exe
  C:\Windows\System\Lvgrpov.exe
  2⤵
  PID:6344
- C:\Windows\System\vxKfWkq.exe
  C:\Windows\System\vxKfWkq.exe
  2⤵
  PID:6564
- C:\Windows\System\CbLRJbi.exe
  C:\Windows\System\CbLRJbi.exe
  2⤵
  PID:6636
- C:\Windows\System\nxwhptz.exe
  C:\Windows\System\nxwhptz.exe
  2⤵
  PID:6708
- C:\Windows\System\volRLbR.exe
  C:\Windows\System\volRLbR.exe
  2⤵
  PID:6232
- C:\Windows\System\CzpmDSa.exe
  C:\Windows\System\CzpmDSa.exe
  2⤵
  PID:6784
- C:\Windows\System\qgMgqfd.exe
  C:\Windows\System\qgMgqfd.exe
  2⤵
  PID:6856
- C:\Windows\System\RMkHAOK.exe
  C:\Windows\System\RMkHAOK.exe
  2⤵
  PID:6376
- C:\Windows\System\VOIxjIQ.exe
  C:\Windows\System\VOIxjIQ.exe
  2⤵
  PID:6932
- C:\Windows\System\ynblOcM.exe
  C:\Windows\System\ynblOcM.exe
  2⤵
  PID:7000
- C:\Windows\System\YWtdpJD.exe
  C:\Windows\System\YWtdpJD.exe
  2⤵
  PID:6692
- C:\Windows\System\MWKRkit.exe
  C:\Windows\System\MWKRkit.exe
  2⤵
  PID:7084
- C:\Windows\System\cDSWJPM.exe
  C:\Windows\System\cDSWJPM.exe
  2⤵
  PID:7148
- C:\Windows\System\TleCaIg.exe
  C:\Windows\System\TleCaIg.exe
  2⤵
  PID:6324
- C:\Windows\System\XidowRP.exe
  C:\Windows\System\XidowRP.exe
  2⤵
  PID:6764
- C:\Windows\System\sVEUNrU.exe
  C:\Windows\System\sVEUNrU.exe
  2⤵
  PID:6268
- C:\Windows\System\zmmrWDo.exe
  C:\Windows\System\zmmrWDo.exe
  2⤵
  PID:6388
- C:\Windows\System\nojZksb.exe
  C:\Windows\System\nojZksb.exe
  2⤵
  PID:6904
- C:\Windows\System\ahsPokP.exe
  C:\Windows\System\ahsPokP.exe
  2⤵
  PID:6916
- C:\Windows\System\iLRrNZD.exe
  C:\Windows\System\iLRrNZD.exe
  2⤵
  PID:6384
- C:\Windows\System\nYzyuEC.exe
  C:\Windows\System\nYzyuEC.exe
  2⤵
  PID:7028
- C:\Windows\System\TPRggWL.exe
  C:\Windows\System\TPRggWL.exe
  2⤵
  PID:6704
- C:\Windows\System\HPlaWid.exe
  C:\Windows\System\HPlaWid.exe
  2⤵
  PID:7100
- C:\Windows\System\XTXGZNX.exe
  C:\Windows\System\XTXGZNX.exe
  2⤵
  PID:6968
- C:\Windows\System\wrJyouU.exe
  C:\Windows\System\wrJyouU.exe
  2⤵
  PID:7080
- C:\Windows\System\KPdTiSQ.exe
  C:\Windows\System\KPdTiSQ.exe
  2⤵
  PID:6284
- C:\Windows\System\SaIrPHt.exe
  C:\Windows\System\SaIrPHt.exe
  2⤵
  PID:6876
- C:\Windows\System\mpMKcfv.exe
  C:\Windows\System\mpMKcfv.exe
  2⤵
  PID:7096
- C:\Windows\System\KvQJqcX.exe
  C:\Windows\System\KvQJqcX.exe
  2⤵
  PID:7160
- C:\Windows\System\gJVmVJi.exe
  C:\Windows\System\gJVmVJi.exe
  2⤵
  PID:5816
- C:\Windows\System\manBtBp.exe
  C:\Windows\System\manBtBp.exe
  2⤵
  PID:6948
- C:\Windows\System\sIkbBgL.exe
  C:\Windows\System\sIkbBgL.exe
  2⤵
  PID:7064
- C:\Windows\System\Rhcnpzw.exe
  C:\Windows\System\Rhcnpzw.exe
  2⤵
  PID:6216
- C:\Windows\System\VaYNSJH.exe
  C:\Windows\System\VaYNSJH.exe
  2⤵
  PID:6852
- C:\Windows\System\CWwlAxE.exe
  C:\Windows\System\CWwlAxE.exe
  2⤵
  PID:6172
- C:\Windows\System\SkTNwNx.exe
  C:\Windows\System\SkTNwNx.exe
  2⤵
  PID:6456
- C:\Windows\System\QqkogGp.exe
  C:\Windows\System\QqkogGp.exe
  2⤵
  PID:6536
- C:\Windows\System\cWENNSM.exe
  C:\Windows\System\cWENNSM.exe
  2⤵
  PID:5308
- C:\Windows\System\ZMZYwMj.exe
  C:\Windows\System\ZMZYwMj.exe
  2⤵
  PID:5476
- C:\Windows\System\NxJeGKq.exe
  C:\Windows\System\NxJeGKq.exe
  2⤵
  PID:6780
- C:\Windows\System\wKccgTc.exe
  C:\Windows\System\wKccgTc.exe
  2⤵
  PID:7116
- C:\Windows\System\JHhrdwH.exe
  C:\Windows\System\JHhrdwH.exe
  2⤵
  PID:6984
- C:\Windows\System\rIlQdKd.exe
  C:\Windows\System\rIlQdKd.exe
  2⤵
  PID:6444
- C:\Windows\System\EaZiVPB.exe
  C:\Windows\System\EaZiVPB.exe
  2⤵
  PID:6572
- C:\Windows\System\egHSaiy.exe
  C:\Windows\System\egHSaiy.exe
  2⤵
  PID:6560
- C:\Windows\System\qhpMcaT.exe
  C:\Windows\System\qhpMcaT.exe
  2⤵
  PID:6656
- C:\Windows\System\utNrjdu.exe
  C:\Windows\System\utNrjdu.exe
  2⤵
  PID:6748
- C:\Windows\System\MtjxWrz.exe
  C:\Windows\System\MtjxWrz.exe
  2⤵
  PID:7132
- C:\Windows\System\ReZSZBN.exe
  C:\Windows\System\ReZSZBN.exe
  2⤵
  PID:5916
- C:\Windows\System\XxqrqkP.exe
  C:\Windows\System\XxqrqkP.exe
  2⤵
  PID:6672
- C:\Windows\System\ueVGZyq.exe
  C:\Windows\System\ueVGZyq.exe
  2⤵
  PID:6920
- C:\Windows\System\kkiJdCA.exe
  C:\Windows\System\kkiJdCA.exe
  2⤵
  PID:2140
- C:\Windows\System\wFntWIV.exe
  C:\Windows\System\wFntWIV.exe
  2⤵
  PID:6812
- C:\Windows\System\EOgwwMC.exe
  C:\Windows\System\EOgwwMC.exe
  2⤵
  PID:6208
- C:\Windows\System\LfrMYJA.exe
  C:\Windows\System\LfrMYJA.exe
  2⤵
  PID:6568
- C:\Windows\System\OggBQfQ.exe
  C:\Windows\System\OggBQfQ.exe
  2⤵
  PID:6616
- C:\Windows\System\glGSSRi.exe
  C:\Windows\System\glGSSRi.exe
  2⤵
  PID:6404
- C:\Windows\System\EFyoYZw.exe
  C:\Windows\System\EFyoYZw.exe
  2⤵
  PID:6340
- C:\Windows\System\lWZIjtW.exe
  C:\Windows\System\lWZIjtW.exe
  2⤵
  PID:6420
- C:\Windows\System\RGdTwUi.exe
  C:\Windows\System\RGdTwUi.exe
  2⤵
  PID:7060
- C:\Windows\System\lGqUnkY.exe
  C:\Windows\System\lGqUnkY.exe
  2⤵
  PID:7184
- C:\Windows\System\tnUuVia.exe
  C:\Windows\System\tnUuVia.exe
  2⤵
  PID:7204
- C:\Windows\System\mHnIsYh.exe
  C:\Windows\System\mHnIsYh.exe
  2⤵
  PID:7224
- C:\Windows\System\dcFteOV.exe
  C:\Windows\System\dcFteOV.exe
  2⤵
  PID:7240
- C:\Windows\System\IQzwHCt.exe
  C:\Windows\System\IQzwHCt.exe
  2⤵
  PID:7260
- C:\Windows\System\SMwhJrY.exe
  C:\Windows\System\SMwhJrY.exe
  2⤵
  PID:7284
- C:\Windows\System\spMfeKR.exe
  C:\Windows\System\spMfeKR.exe
  2⤵
  PID:7308
- C:\Windows\System\vdgFrBG.exe
  C:\Windows\System\vdgFrBG.exe
  2⤵
  PID:7324
- C:\Windows\System\JHTFnNQ.exe
  C:\Windows\System\JHTFnNQ.exe
  2⤵
  PID:7352
- C:\Windows\System\mtFIGdE.exe
  C:\Windows\System\mtFIGdE.exe
  2⤵
  PID:7372
- C:\Windows\System\OrSXBZa.exe
  C:\Windows\System\OrSXBZa.exe
  2⤵
  PID:7400
- C:\Windows\System\fCHnYjy.exe
  C:\Windows\System\fCHnYjy.exe
  2⤵
  PID:7416
- C:\Windows\System\fngmZHp.exe
  C:\Windows\System\fngmZHp.exe
  2⤵
  PID:7436
- C:\Windows\System\nUfyFVS.exe
  C:\Windows\System\nUfyFVS.exe
  2⤵
  PID:7456
- C:\Windows\System\txMLgPQ.exe
  C:\Windows\System\txMLgPQ.exe
  2⤵
  PID:7480
- C:\Windows\System\TLiFcpN.exe
  C:\Windows\System\TLiFcpN.exe
  2⤵
  PID:7496
- C:\Windows\System\ijvZMnD.exe
  C:\Windows\System\ijvZMnD.exe
  2⤵
  PID:7512
- C:\Windows\System\JkCMsaH.exe
  C:\Windows\System\JkCMsaH.exe
  2⤵
  PID:7540
- C:\Windows\System\OWkltvu.exe
  C:\Windows\System\OWkltvu.exe
  2⤵
  PID:7556
- C:\Windows\System\XvfWVVu.exe
  C:\Windows\System\XvfWVVu.exe
  2⤵
  PID:7572
- C:\Windows\System\FFEesrp.exe
  C:\Windows\System\FFEesrp.exe
  2⤵
  PID:7588
- C:\Windows\System\ZGpoEkS.exe
  C:\Windows\System\ZGpoEkS.exe
  2⤵
  PID:7612
- C:\Windows\System\JuQhIHi.exe
  C:\Windows\System\JuQhIHi.exe
  2⤵
  PID:7636
- C:\Windows\System\DwipJOe.exe
  C:\Windows\System\DwipJOe.exe
  2⤵
  PID:7652
- C:\Windows\System\jxRIvXU.exe
  C:\Windows\System\jxRIvXU.exe
  2⤵
  PID:7676
- C:\Windows\System\XarWxzA.exe
  C:\Windows\System\XarWxzA.exe
  2⤵
  PID:7692
- C:\Windows\System\rIOYAGs.exe
  C:\Windows\System\rIOYAGs.exe
  2⤵
  PID:7712
- C:\Windows\System\QbzBCUD.exe
  C:\Windows\System\QbzBCUD.exe
  2⤵
  PID:7736
- C:\Windows\System\DqZvOMU.exe
  C:\Windows\System\DqZvOMU.exe
  2⤵
  PID:7752
- C:\Windows\System\UjVwZWu.exe
  C:\Windows\System\UjVwZWu.exe
  2⤵
  PID:7768
- C:\Windows\System\iwQAHYi.exe
  C:\Windows\System\iwQAHYi.exe
  2⤵
  PID:7796
- C:\Windows\System\yTehkEA.exe
  C:\Windows\System\yTehkEA.exe
  2⤵
  PID:7812
- C:\Windows\System\wNGfTvy.exe
  C:\Windows\System\wNGfTvy.exe
  2⤵
  PID:7828
- C:\Windows\System\nRqHUhE.exe
  C:\Windows\System\nRqHUhE.exe
  2⤵
  PID:7852
- C:\Windows\System\pXMjgQs.exe
  C:\Windows\System\pXMjgQs.exe
  2⤵
  PID:7876
- C:\Windows\System\rdWJLWl.exe
  C:\Windows\System\rdWJLWl.exe
  2⤵
  PID:7904
- C:\Windows\System\SYPnkDM.exe
  C:\Windows\System\SYPnkDM.exe
  2⤵
  PID:7924
- C:\Windows\System\PGGjZbm.exe
  C:\Windows\System\PGGjZbm.exe
  2⤵
  PID:7940
- C:\Windows\System\ThQWAJz.exe
  C:\Windows\System\ThQWAJz.exe
  2⤵
  PID:7956
- C:\Windows\System\grdmsmb.exe
  C:\Windows\System\grdmsmb.exe
  2⤵
  PID:7980
- C:\Windows\System\QZJLTQl.exe
  C:\Windows\System\QZJLTQl.exe
  2⤵
  PID:8000
- C:\Windows\System\leRUKcc.exe
  C:\Windows\System\leRUKcc.exe
  2⤵
  PID:8020
- C:\Windows\System\MBzvbVB.exe
  C:\Windows\System\MBzvbVB.exe
  2⤵
  PID:8036
- C:\Windows\System\zBRePlo.exe
  C:\Windows\System\zBRePlo.exe
  2⤵
  PID:8056
- C:\Windows\System\LGfXZis.exe
  C:\Windows\System\LGfXZis.exe
  2⤵
  PID:8076
- C:\Windows\System\DMTnbtt.exe
  C:\Windows\System\DMTnbtt.exe
  2⤵
  PID:8092
- C:\Windows\System\cFtehXc.exe
  C:\Windows\System\cFtehXc.exe
  2⤵
  PID:8108
- C:\Windows\System\DAFKlwS.exe
  C:\Windows\System\DAFKlwS.exe
  2⤵
  PID:8124
- C:\Windows\System\MCVWjhg.exe
  C:\Windows\System\MCVWjhg.exe
  2⤵
  PID:8144
- C:\Windows\System\StIwvty.exe
  C:\Windows\System\StIwvty.exe
  2⤵
  PID:8164
- C:\Windows\System\HpKanjw.exe
  C:\Windows\System\HpKanjw.exe
  2⤵
  PID:8180
- C:\Windows\System\dvJOOfw.exe
  C:\Windows\System\dvJOOfw.exe
  2⤵
  PID:6264
- C:\Windows\System\XnfhEHH.exe
  C:\Windows\System\XnfhEHH.exe
  2⤵
  PID:6744
- C:\Windows\System\wFkauSa.exe
  C:\Windows\System\wFkauSa.exe
  2⤵
  PID:7200
- C:\Windows\System\HwoIEqi.exe
  C:\Windows\System\HwoIEqi.exe
  2⤵
  PID:7268
- C:\Windows\System\qZaUYAu.exe
  C:\Windows\System\qZaUYAu.exe
  2⤵
  PID:6516
- C:\Windows\System\HidCaJf.exe
  C:\Windows\System\HidCaJf.exe
  2⤵
  PID:7128
- C:\Windows\System\wAuqaZl.exe
  C:\Windows\System\wAuqaZl.exe
  2⤵
  PID:6468
- C:\Windows\System\TloGSQo.exe
  C:\Windows\System\TloGSQo.exe
  2⤵
  PID:6428
- C:\Windows\System\HCdIKxm.exe
  C:\Windows\System\HCdIKxm.exe
  2⤵
  PID:7216
- C:\Windows\System\tMZoDIl.exe
  C:\Windows\System\tMZoDIl.exe
  2⤵
  PID:7332
- C:\Windows\System\oskLKlQ.exe
  C:\Windows\System\oskLKlQ.exe
  2⤵
  PID:7172
- C:\Windows\System\qOzeNBW.exe
  C:\Windows\System\qOzeNBW.exe
  2⤵
  PID:7336
- C:\Windows\System\lSbiMHR.exe
  C:\Windows\System\lSbiMHR.exe
  2⤵
  PID:7408
- C:\Windows\System\rWFriOy.exe
  C:\Windows\System\rWFriOy.exe
  2⤵
  PID:7452
- C:\Windows\System\XLbNMHT.exe
  C:\Windows\System\XLbNMHT.exe
  2⤵
  PID:7468
- C:\Windows\System\mfGwqvj.exe
  C:\Windows\System\mfGwqvj.exe
  2⤵
  PID:7476
- C:\Windows\System\KBuaNCv.exe
  C:\Windows\System\KBuaNCv.exe
  2⤵
  PID:7564
- C:\Windows\System\IIiEfIu.exe
  C:\Windows\System\IIiEfIu.exe
  2⤵
  PID:7608
- C:\Windows\System\MlpqcPd.exe
  C:\Windows\System\MlpqcPd.exe
  2⤵
  PID:7552
- C:\Windows\System\wAvDCEH.exe
  C:\Windows\System\wAvDCEH.exe
  2⤵
  PID:7584
- C:\Windows\System\vYbQeWb.exe
  C:\Windows\System\vYbQeWb.exe
  2⤵
  PID:7720
- C:\Windows\System\RLrGjtb.exe
  C:\Windows\System\RLrGjtb.exe
  2⤵
  PID:7632
- C:\Windows\System\HXYgAGN.exe
  C:\Windows\System\HXYgAGN.exe
  2⤵
  PID:7808
- C:\Windows\System\RRUqssq.exe
  C:\Windows\System\RRUqssq.exe
  2⤵
  PID:7708
- C:\Windows\System\VxTjeeR.exe
  C:\Windows\System\VxTjeeR.exe
  2⤵
  PID:7748
- C:\Windows\System\jHgGEfp.exe
  C:\Windows\System\jHgGEfp.exe
  2⤵
  PID:7884
- C:\Windows\System\KAkwqSz.exe
  C:\Windows\System\KAkwqSz.exe
  2⤵
  PID:7896
- C:\Windows\System\nkdOVXt.exe
  C:\Windows\System\nkdOVXt.exe
  2⤵
  PID:7892
- C:\Windows\System\GulhRpz.exe
  C:\Windows\System\GulhRpz.exe
  2⤵
  PID:7952
- C:\Windows\System\BjWxeND.exe
  C:\Windows\System\BjWxeND.exe
  2⤵
  PID:7968
- C:\Windows\System\jDIkifd.exe
  C:\Windows\System\jDIkifd.exe
  2⤵
  PID:8048
- C:\Windows\System\gVruDVg.exe
  C:\Windows\System\gVruDVg.exe
  2⤵
  PID:8052
- C:\Windows\System\LZERkmz.exe
  C:\Windows\System\LZERkmz.exe
  2⤵
  PID:8116
- C:\Windows\System\XTWBTXT.exe
  C:\Windows\System\XTWBTXT.exe
  2⤵
  PID:6732
- C:\Windows\System\hOoTsYS.exe
  C:\Windows\System\hOoTsYS.exe
  2⤵
  PID:6936
- C:\Windows\System\xIxRCYm.exe
  C:\Windows\System\xIxRCYm.exe
  2⤵
  PID:7212
- C:\Windows\System\WroGKpc.exe
  C:\Windows\System\WroGKpc.exe
  2⤵
  PID:6480
- C:\Windows\System\ZueEndf.exe
  C:\Windows\System\ZueEndf.exe
  2⤵
  PID:6580
- C:\Windows\System\UHXhUXt.exe
  C:\Windows\System\UHXhUXt.exe
  2⤵
  PID:7248
- C:\Windows\System\rHUWfTo.exe
  C:\Windows\System\rHUWfTo.exe
  2⤵
  PID:7256
- C:\Windows\System\aAFZema.exe
  C:\Windows\System\aAFZema.exe
  2⤵
  PID:7232
- C:\Windows\System\mlurlgq.exe
  C:\Windows\System\mlurlgq.exe
  2⤵
  PID:8136
- C:\Windows\System\pmKNGqd.exe
  C:\Windows\System\pmKNGqd.exe
  2⤵
  PID:6432
- C:\Windows\System\gdCbrwk.exe
  C:\Windows\System\gdCbrwk.exe
  2⤵
  PID:6892
- C:\Windows\System\ZHpHcRU.exe
  C:\Windows\System\ZHpHcRU.exe
  2⤵
  PID:7412
- C:\Windows\System\ObzLLcW.exe
  C:\Windows\System\ObzLLcW.exe
  2⤵
  PID:7528
- C:\Windows\System\wVtVfjp.exe
  C:\Windows\System\wVtVfjp.exe
  2⤵
  PID:7428
- C:\Windows\System\DCxaZTe.exe
  C:\Windows\System\DCxaZTe.exe
  2⤵
  PID:7724
- C:\Windows\System\rmlhJrk.exe
  C:\Windows\System\rmlhJrk.exe
  2⤵
  PID:7628
- C:\Windows\System\qhvqEvq.exe
  C:\Windows\System\qhvqEvq.exe
  2⤵
  PID:7728
- C:\Windows\System\UcPAChQ.exe
  C:\Windows\System\UcPAChQ.exe
  2⤵
  PID:7744
- C:\Windows\System\KQqJgcp.exe
  C:\Windows\System\KQqJgcp.exe
  2⤵
  PID:7784
- C:\Windows\System\NxjTOXj.exe
  C:\Windows\System\NxjTOXj.exe
  2⤵
  PID:7776
- C:\Windows\System\CpYXyis.exe
  C:\Windows\System\CpYXyis.exe
  2⤵
  PID:7872
- C:\Windows\System\zLxQhcf.exe
  C:\Windows\System\zLxQhcf.exe
  2⤵
  PID:7988
- C:\Windows\System\XYBxfyR.exe
  C:\Windows\System\XYBxfyR.exe
  2⤵
  PID:8008
- C:\Windows\System\SmeDbIe.exe
  C:\Windows\System\SmeDbIe.exe
  2⤵
  PID:8028
- C:\Windows\System\dpNcPDT.exe
  C:\Windows\System\dpNcPDT.exe
  2⤵
  PID:8188
- C:\Windows\System\scuSWnF.exe
  C:\Windows\System\scuSWnF.exe
  2⤵
  PID:7304
- C:\Windows\System\XvvykbY.exe
  C:\Windows\System\XvvykbY.exe
  2⤵
  PID:7048
- C:\Windows\System\dMgGbeV.exe
  C:\Windows\System\dMgGbeV.exe
  2⤵
  PID:7492
- C:\Windows\System\wYJzPjx.exe
  C:\Windows\System\wYJzPjx.exe
  2⤵
  PID:8068
- C:\Windows\System\boifcvo.exe
  C:\Windows\System\boifcvo.exe
  2⤵
  PID:8172
- C:\Windows\System\DXfsEhc.exe
  C:\Windows\System\DXfsEhc.exe
  2⤵
  PID:7532
- C:\Windows\System\EaZsABq.exe
  C:\Windows\System\EaZsABq.exe
  2⤵
  PID:7176
- C:\Windows\System\EmdIXiq.exe
  C:\Windows\System\EmdIXiq.exe
  2⤵
  PID:7508
- C:\Windows\System\onLYzkk.exe
  C:\Windows\System\onLYzkk.exe
  2⤵
  PID:7600
- C:\Windows\System\mKhvaVe.exe
  C:\Windows\System\mKhvaVe.exe
  2⤵
  PID:7764
- C:\Windows\System\zfGTUPH.exe
  C:\Windows\System\zfGTUPH.exe
  2⤵
  PID:7824
- C:\Windows\System\bjkRCky.exe
  C:\Windows\System\bjkRCky.exe
  2⤵
  PID:8120
- C:\Windows\System\pSLqLIE.exe
  C:\Windows\System\pSLqLIE.exe
  2⤵
  PID:7868
- C:\Windows\System\emubqLy.exe
  C:\Windows\System\emubqLy.exe
  2⤵
  PID:8044
- C:\Windows\System\tFshcCY.exe
  C:\Windows\System\tFshcCY.exe
  2⤵
  PID:5228
- C:\Windows\System\hpLadTy.exe
  C:\Windows\System\hpLadTy.exe
  2⤵
  PID:7644
- C:\Windows\System\rufSdxr.exe
  C:\Windows\System\rufSdxr.exe
  2⤵
  PID:7664
- C:\Windows\System\giSCqYt.exe
  C:\Windows\System\giSCqYt.exe
  2⤵
  PID:7660
- C:\Windows\System\PwORcrt.exe
  C:\Windows\System\PwORcrt.exe
  2⤵
  PID:7972
- C:\Windows\System\CbjTbGH.exe
  C:\Windows\System\CbjTbGH.exe
  2⤵
  PID:7180
- C:\Windows\System\KEhOSnF.exe
  C:\Windows\System\KEhOSnF.exe
  2⤵
  PID:7668
- C:\Windows\System\eyxMpXc.exe
  C:\Windows\System\eyxMpXc.exe
  2⤵
  PID:7340
- C:\Windows\System\VDQEOYu.exe
  C:\Windows\System\VDQEOYu.exe
  2⤵
  PID:6512
- C:\Windows\System\snZXQPB.exe
  C:\Windows\System\snZXQPB.exe
  2⤵
  PID:7520
- C:\Windows\System\FETAhIQ.exe
  C:\Windows\System\FETAhIQ.exe
  2⤵
  PID:7936
- C:\Windows\System\ZYgEFYi.exe
  C:\Windows\System\ZYgEFYi.exe
  2⤵
  PID:7580
- C:\Windows\System\qGnXrkf.exe
  C:\Windows\System\qGnXrkf.exe
  2⤵
  PID:8132
- C:\Windows\System\NgppZbD.exe
  C:\Windows\System\NgppZbD.exe
  2⤵
  PID:7396
- C:\Windows\System\imcJxiy.exe
  C:\Windows\System\imcJxiy.exe
  2⤵
  PID:7392
- C:\Windows\System\GNestPD.exe
  C:\Windows\System\GNestPD.exe
  2⤵
  PID:6592
- C:\Windows\System\dQSJQvp.exe
  C:\Windows\System\dQSJQvp.exe
  2⤵
  PID:7236
- C:\Windows\System\fJNixEW.exe
  C:\Windows\System\fJNixEW.exe
  2⤵
  PID:7432
- C:\Windows\System\JvgxXQi.exe
  C:\Windows\System\JvgxXQi.exe
  2⤵
  PID:8204
- C:\Windows\System\eoLXWHD.exe
  C:\Windows\System\eoLXWHD.exe
  2⤵
  PID:8220
- C:\Windows\System\jXhEvhr.exe
  C:\Windows\System\jXhEvhr.exe
  2⤵
  PID:8240
- C:\Windows\System\BbHvoWr.exe
  C:\Windows\System\BbHvoWr.exe
  2⤵
  PID:8268
- C:\Windows\System\mHhRfik.exe
  C:\Windows\System\mHhRfik.exe
  2⤵
  PID:8288
- C:\Windows\System\uqChHDD.exe
  C:\Windows\System\uqChHDD.exe
  2⤵
  PID:8312
- C:\Windows\System\QFnqCKM.exe
  C:\Windows\System\QFnqCKM.exe
  2⤵
  PID:8332
- C:\Windows\System\LLkvrcc.exe
  C:\Windows\System\LLkvrcc.exe
  2⤵
  PID:8352
- C:\Windows\System\JSrZugQ.exe
  C:\Windows\System\JSrZugQ.exe
  2⤵
  PID:8372
- C:\Windows\System\WGVngEh.exe
  C:\Windows\System\WGVngEh.exe
  2⤵
  PID:8388
- C:\Windows\System\dNqLRXw.exe
  C:\Windows\System\dNqLRXw.exe
  2⤵
  PID:8412
- C:\Windows\System\wPklSBl.exe
  C:\Windows\System\wPklSBl.exe
  2⤵
  PID:8428
- C:\Windows\System\uHhtnSS.exe
  C:\Windows\System\uHhtnSS.exe
  2⤵
  PID:8452
- C:\Windows\System\lVBjDET.exe
  C:\Windows\System\lVBjDET.exe
  2⤵
  PID:8480
- C:\Windows\System\ZxVaxOS.exe
  C:\Windows\System\ZxVaxOS.exe
  2⤵
  PID:8496
- C:\Windows\System\XqqKePe.exe
  C:\Windows\System\XqqKePe.exe
  2⤵
  PID:8512
- C:\Windows\System\JXeOMTG.exe
  C:\Windows\System\JXeOMTG.exe
  2⤵
  PID:8528
- C:\Windows\System\icOrpaF.exe
  C:\Windows\System\icOrpaF.exe
  2⤵
  PID:8564
- C:\Windows\System\XjbSNYq.exe
  C:\Windows\System\XjbSNYq.exe
  2⤵
  PID:8580
- C:\Windows\System\pmlsmIW.exe
  C:\Windows\System\pmlsmIW.exe
  2⤵
  PID:8596
- C:\Windows\System\aqeUFAf.exe
  C:\Windows\System\aqeUFAf.exe
  2⤵
  PID:8628
- C:\Windows\System\oknwLrK.exe
  C:\Windows\System\oknwLrK.exe
  2⤵
  PID:8644
- C:\Windows\System\tsbCmOe.exe
  C:\Windows\System\tsbCmOe.exe
  2⤵
  PID:8668
- C:\Windows\System\tlmOeIa.exe
  C:\Windows\System\tlmOeIa.exe
  2⤵
  PID:8684
- C:\Windows\System\xVpVHYU.exe
  C:\Windows\System\xVpVHYU.exe
  2⤵
  PID:8700
- C:\Windows\System\doStyNc.exe
  C:\Windows\System\doStyNc.exe
  2⤵
  PID:8716
- C:\Windows\System\SKBjlFF.exe
  C:\Windows\System\SKBjlFF.exe
  2⤵
  PID:8732
- C:\Windows\System\dChhYeo.exe
  C:\Windows\System\dChhYeo.exe
  2⤵
  PID:8752
- C:\Windows\System\yECijLu.exe
  C:\Windows\System\yECijLu.exe
  2⤵
  PID:8772
- C:\Windows\System\caAfcDA.exe
  C:\Windows\System\caAfcDA.exe
  2⤵
  PID:8792
- C:\Windows\System\KcaWWNL.exe
  C:\Windows\System\KcaWWNL.exe
  2⤵
  PID:8812
- C:\Windows\System\yPQSKcH.exe
  C:\Windows\System\yPQSKcH.exe
  2⤵
  PID:8832
- C:\Windows\System\AagVKxX.exe
  C:\Windows\System\AagVKxX.exe
  2⤵
  PID:8848
- C:\Windows\System\elzozuf.exe
  C:\Windows\System\elzozuf.exe
  2⤵
  PID:8864
- C:\Windows\System\mTQVaYe.exe
  C:\Windows\System\mTQVaYe.exe
  2⤵
  PID:8884
- C:\Windows\System\NkHiSgr.exe
  C:\Windows\System\NkHiSgr.exe
  2⤵
  PID:8904
- C:\Windows\System\JppLVQD.exe
  C:\Windows\System\JppLVQD.exe
  2⤵
  PID:8920
- C:\Windows\System\CoIKmQb.exe
  C:\Windows\System\CoIKmQb.exe
  2⤵
  PID:8936
- C:\Windows\System\MdbLSmX.exe
  C:\Windows\System\MdbLSmX.exe
  2⤵
  PID:8956
- C:\Windows\System\cQTWwhY.exe
  C:\Windows\System\cQTWwhY.exe
  2⤵
  PID:8972
- C:\Windows\System\oTOeuvw.exe
  C:\Windows\System\oTOeuvw.exe
  2⤵
  PID:8992
- C:\Windows\System\dNHvACh.exe
  C:\Windows\System\dNHvACh.exe
  2⤵
  PID:9016
- C:\Windows\System\EdWlhGC.exe
  C:\Windows\System\EdWlhGC.exe
  2⤵
  PID:9036
- C:\Windows\System\AtupYFJ.exe
  C:\Windows\System\AtupYFJ.exe
  2⤵
  PID:9056
- C:\Windows\System\AqybsJT.exe
  C:\Windows\System\AqybsJT.exe
  2⤵
  PID:9072
- C:\Windows\System\gljUSXx.exe
  C:\Windows\System\gljUSXx.exe
  2⤵
  PID:9088
- C:\Windows\System\BdVEJCN.exe
  C:\Windows\System\BdVEJCN.exe
  2⤵
  PID:9108
- C:\Windows\System\cmqbAbe.exe
  C:\Windows\System\cmqbAbe.exe
  2⤵
  PID:9128
- C:\Windows\System\pLppqzY.exe
  C:\Windows\System\pLppqzY.exe
  2⤵
  PID:9148
- C:\Windows\System\TnPXGJA.exe
  C:\Windows\System\TnPXGJA.exe
  2⤵
  PID:9168
- C:\Windows\System\lkRzWUA.exe
  C:\Windows\System\lkRzWUA.exe
  2⤵
  PID:9184
- C:\Windows\System\qsOBwSh.exe
  C:\Windows\System\qsOBwSh.exe
  2⤵
  PID:9200
- C:\Windows\System\qxNUwFC.exe
  C:\Windows\System\qxNUwFC.exe
  2⤵
  PID:8200
- C:\Windows\System\lPJgKPf.exe
  C:\Windows\System\lPJgKPf.exe
  2⤵
  PID:7300
- C:\Windows\System\tyVQPxE.exe
  C:\Windows\System\tyVQPxE.exe
  2⤵
  PID:2200
- C:\Windows\System\vAxiaer.exe
  C:\Windows\System\vAxiaer.exe
  2⤵
  PID:8260
- C:\Windows\System\leRhvtV.exe
  C:\Windows\System\leRhvtV.exe
  2⤵
  PID:8320
- C:\Windows\System\mgsXbjp.exe
  C:\Windows\System\mgsXbjp.exe
  2⤵
  PID:8296
- C:\Windows\System\ECbVkzY.exe
  C:\Windows\System\ECbVkzY.exe
  2⤵
  PID:8424
- C:\Windows\System\KJJSqpa.exe
  C:\Windows\System\KJJSqpa.exe
  2⤵
  PID:8492
- C:\Windows\System\yhXoZUb.exe
  C:\Windows\System\yhXoZUb.exe
  2⤵
  PID:8524
- C:\Windows\System\HIRmHbn.exe
  C:\Windows\System\HIRmHbn.exe
  2⤵
  PID:7992
- C:\Windows\System\iQvlpQl.exe
  C:\Windows\System\iQvlpQl.exe
  2⤵
  PID:8552
- C:\Windows\System\qyeRWhe.exe
  C:\Windows\System\qyeRWhe.exe
  2⤵
  PID:8608
- C:\Windows\System\msBxieT.exe
  C:\Windows\System\msBxieT.exe
  2⤵
  PID:8624
- C:\Windows\System\jFkieNc.exe
  C:\Windows\System\jFkieNc.exe
  2⤵
  PID:8660
- C:\Windows\System\kbxoaNW.exe
  C:\Windows\System\kbxoaNW.exe
  2⤵
  PID:8696
- C:\Windows\System\LRTjEqD.exe
  C:\Windows\System\LRTjEqD.exe
  2⤵
  PID:8708
- C:\Windows\System\jkjoksi.exe
  C:\Windows\System\jkjoksi.exe
  2⤵
  PID:8760
- C:\Windows\System\qqFVILQ.exe
  C:\Windows\System\qqFVILQ.exe
  2⤵
  PID:8804
- C:\Windows\System\KoFoEYW.exe
  C:\Windows\System\KoFoEYW.exe
  2⤵
  PID:8788
- C:\Windows\System\GCXpJmH.exe
  C:\Windows\System\GCXpJmH.exe
  2⤵
  PID:8876
- C:\Windows\System\UANXVSR.exe
  C:\Windows\System\UANXVSR.exe
  2⤵
  PID:8916
- C:\Windows\System\UFLftTx.exe
  C:\Windows\System\UFLftTx.exe
  2⤵
  PID:8984
- C:\Windows\System\bKwnIHK.exe
  C:\Windows\System\bKwnIHK.exe
  2⤵
  PID:9064
- C:\Windows\System\vFxcUAE.exe
  C:\Windows\System\vFxcUAE.exe
  2⤵
  PID:9104
- C:\Windows\System\ZBNXNHo.exe
  C:\Windows\System\ZBNXNHo.exe
  2⤵
  PID:9180
- C:\Windows\System\nKngYbM.exe
  C:\Windows\System\nKngYbM.exe
  2⤵
  PID:9156
- C:\Windows\System\BDgSIpK.exe
  C:\Windows\System\BDgSIpK.exe
  2⤵
  PID:9080
- C:\Windows\System\odLOsoN.exe
  C:\Windows\System\odLOsoN.exe
  2⤵
  PID:9012
- C:\Windows\System\Vznjfhq.exe
  C:\Windows\System\Vznjfhq.exe
  2⤵
  PID:8968
- C:\Windows\System\GvRxjqT.exe
  C:\Windows\System\GvRxjqT.exe
  2⤵
  PID:8396
- C:\Windows\System\FdiIULm.exe
  C:\Windows\System\FdiIULm.exe
  2⤵
  PID:7780
- C:\Windows\System\uyuzhLG.exe
  C:\Windows\System\uyuzhLG.exe
  2⤵
  PID:9164
- C:\Windows\System\ZshhiTI.exe
  C:\Windows\System\ZshhiTI.exe
  2⤵
  PID:8308
- C:\Windows\System\YJgdGPE.exe
  C:\Windows\System\YJgdGPE.exe
  2⤵
  PID:8404
- C:\Windows\System\PzLgXkR.exe
  C:\Windows\System\PzLgXkR.exe
  2⤵
  PID:8420
- C:\Windows\System\wMShQas.exe
  C:\Windows\System\wMShQas.exe
  2⤵
  PID:8544
- C:\Windows\System\dkjqVnr.exe
  C:\Windows\System\dkjqVnr.exe
  2⤵
  PID:8508
- C:\Windows\System\lEZXMuf.exe
  C:\Windows\System\lEZXMuf.exe
  2⤵
  PID:8652
- C:\Windows\System\OifMZIS.exe
  C:\Windows\System\OifMZIS.exe
  2⤵
  PID:8744
- C:\Windows\System\tQREdoz.exe
  C:\Windows\System\tQREdoz.exe
  2⤵
  PID:8676
- C:\Windows\System\WdaSRRO.exe
  C:\Windows\System\WdaSRRO.exe
  2⤵
  PID:8820
- C:\Windows\System\oOGhaGM.exe
  C:\Windows\System\oOGhaGM.exe
  2⤵
  PID:8912
- C:\Windows\System\wyELIEh.exe
  C:\Windows\System\wyELIEh.exe
  2⤵
  PID:8844
- C:\Windows\System\LLfTWlm.exe
  C:\Windows\System\LLfTWlm.exe
  2⤵
  PID:8980
- C:\Windows\System\UmLLrQX.exe
  C:\Windows\System\UmLLrQX.exe
  2⤵
  PID:8160
- C:\Windows\System\Tsljcnn.exe
  C:\Windows\System\Tsljcnn.exe
  2⤵
  PID:8216
- C:\Windows\System\KNEspsW.exe
  C:\Windows\System\KNEspsW.exe
  2⤵
  PID:8324
- C:\Windows\System\zLTuQbF.exe
  C:\Windows\System\zLTuQbF.exe
  2⤵
  PID:8824
- C:\Windows\System\MaLAsbe.exe
  C:\Windows\System\MaLAsbe.exe
  2⤵
  PID:9084
- C:\Windows\System\EfePNgP.exe
  C:\Windows\System\EfePNgP.exe
  2⤵
  PID:9004
- C:\Windows\System\AhkszaF.exe
  C:\Windows\System\AhkszaF.exe
  2⤵
  PID:8892
- C:\Windows\System\rwqIadc.exe
  C:\Windows\System\rwqIadc.exe
  2⤵
  PID:8252
- C:\Windows\System\mWhYVXV.exe
  C:\Windows\System\mWhYVXV.exe
  2⤵
  PID:8436
- C:\Windows\System\GcdyYid.exe
  C:\Windows\System\GcdyYid.exe
  2⤵
  PID:8348
- C:\Windows\System\jtaTPyn.exe
  C:\Windows\System\jtaTPyn.exe
  2⤵
  PID:8472
- C:\Windows\System\qUKrGeP.exe
  C:\Windows\System\qUKrGeP.exe
  2⤵
  PID:8476
- C:\Windows\System\oVfGvWn.exe
  C:\Windows\System\oVfGvWn.exe
  2⤵
  PID:8560
- C:\Windows\System\hbtxQfA.exe
  C:\Windows\System\hbtxQfA.exe
  2⤵
  PID:8952
- C:\Windows\System\OpVoxsX.exe
  C:\Windows\System\OpVoxsX.exe
  2⤵
  PID:8800
- C:\Windows\System\XZZhEcz.exe
  C:\Windows\System\XZZhEcz.exe
  2⤵
  PID:8780
- C:\Windows\System\yaQXTFa.exe
  C:\Windows\System\yaQXTFa.exe
  2⤵
  PID:8460
- C:\Windows\System\HsPeZxs.exe
  C:\Windows\System\HsPeZxs.exe
  2⤵
  PID:9236
- C:\Windows\System\icUtqxF.exe
  C:\Windows\System\icUtqxF.exe
  2⤵
  PID:9324
- C:\Windows\System\DywFsnP.exe
  C:\Windows\System\DywFsnP.exe
  2⤵
  PID:9340
- C:\Windows\System\YbfUMOk.exe
  C:\Windows\System\YbfUMOk.exe
  2⤵
  PID:9356
- C:\Windows\System\SLMDXso.exe
  C:\Windows\System\SLMDXso.exe
  2⤵
  PID:9372
- C:\Windows\System\GpUOKwT.exe
  C:\Windows\System\GpUOKwT.exe
  2⤵
  PID:9396
- C:\Windows\System\cEotpKW.exe
  C:\Windows\System\cEotpKW.exe
  2⤵
  PID:9416
- C:\Windows\System\cfzFKbl.exe
  C:\Windows\System\cfzFKbl.exe
  2⤵
  PID:9432
- C:\Windows\System\pUxolZn.exe
  C:\Windows\System\pUxolZn.exe
  2⤵
  PID:9456
- C:\Windows\System\aJfHzqT.exe
  C:\Windows\System\aJfHzqT.exe
  2⤵
  PID:9492
- C:\Windows\System\RSzsPZm.exe
  C:\Windows\System\RSzsPZm.exe
  2⤵
  PID:9508
- C:\Windows\System\DRXAYZR.exe
  C:\Windows\System\DRXAYZR.exe
  2⤵
  PID:9532
- C:\Windows\System\LGkUuws.exe
  C:\Windows\System\LGkUuws.exe
  2⤵
  PID:9548
- C:\Windows\System\QNiHIGF.exe
  C:\Windows\System\QNiHIGF.exe
  2⤵
  PID:9564
- C:\Windows\System\AFWMgTI.exe
  C:\Windows\System\AFWMgTI.exe
  2⤵
  PID:9588
- C:\Windows\System\bAiCyxf.exe
  C:\Windows\System\bAiCyxf.exe
  2⤵
  PID:9612
- C:\Windows\System\IjwKptS.exe
  C:\Windows\System\IjwKptS.exe
  2⤵
  PID:9628
- C:\Windows\System\UeVWjXK.exe
  C:\Windows\System\UeVWjXK.exe
  2⤵
  PID:9648
- C:\Windows\System\VDEsAVH.exe
  C:\Windows\System\VDEsAVH.exe
  2⤵
  PID:9664
- C:\Windows\System\FlooDhd.exe
  C:\Windows\System\FlooDhd.exe
  2⤵
  PID:9680
- C:\Windows\System\iNhQyjk.exe
  C:\Windows\System\iNhQyjk.exe
  2⤵
  PID:9696
- C:\Windows\System\uVIAcBo.exe
  C:\Windows\System\uVIAcBo.exe
  2⤵
  PID:9716
- C:\Windows\System\BMZzHgv.exe
  C:\Windows\System\BMZzHgv.exe
  2⤵
  PID:9740
- C:\Windows\System\iQwQunE.exe
  C:\Windows\System\iQwQunE.exe
  2⤵
  PID:9764
- C:\Windows\System\XdzYFQx.exe
  C:\Windows\System\XdzYFQx.exe
  2⤵
  PID:9788
- C:\Windows\System\gKyvNTK.exe
  C:\Windows\System\gKyvNTK.exe
  2⤵
  PID:9804
- C:\Windows\System\AAElOOT.exe
  C:\Windows\System\AAElOOT.exe
  2⤵
  PID:9824
- C:\Windows\System\ZfjTeKF.exe
  C:\Windows\System\ZfjTeKF.exe
  2⤵
  PID:9840
- C:\Windows\System\jdFYiNb.exe
  C:\Windows\System\jdFYiNb.exe
  2⤵
  PID:9856
- C:\Windows\System\eOAneuG.exe
  C:\Windows\System\eOAneuG.exe
  2⤵
  PID:9876
- C:\Windows\System\AIIYmtZ.exe
  C:\Windows\System\AIIYmtZ.exe
  2⤵
  PID:9892
- C:\Windows\System\AuIvLHk.exe
  C:\Windows\System\AuIvLHk.exe
  2⤵
  PID:9920
- C:\Windows\System\qiypwis.exe
  C:\Windows\System\qiypwis.exe
  2⤵
  PID:9936
- C:\Windows\System\OFVpfOg.exe
  C:\Windows\System\OFVpfOg.exe
  2⤵
  PID:9960
- C:\Windows\System\smFQKMK.exe
  C:\Windows\System\smFQKMK.exe
  2⤵
  PID:9992
- C:\Windows\System\JPisqae.exe
  C:\Windows\System\JPisqae.exe
  2⤵
  PID:10008
- C:\Windows\System\vhFaiII.exe
  C:\Windows\System\vhFaiII.exe
  2⤵
  PID:10024
- C:\Windows\System\HLFRyYT.exe
  C:\Windows\System\HLFRyYT.exe
  2⤵
  PID:10048
- C:\Windows\System\BlVvUEA.exe
  C:\Windows\System\BlVvUEA.exe
  2⤵
  PID:10068
- C:\Windows\System\DvBChzf.exe
  C:\Windows\System\DvBChzf.exe
  2⤵
  PID:10088
- C:\Windows\System\XByfNda.exe
  C:\Windows\System\XByfNda.exe
  2⤵
  PID:10112
- C:\Windows\System\YUNfyDE.exe
  C:\Windows\System\YUNfyDE.exe
  2⤵
  PID:10136
- C:\Windows\System\ieippur.exe
  C:\Windows\System\ieippur.exe
  2⤵
  PID:10152
- C:\Windows\System\fjTreNN.exe
  C:\Windows\System\fjTreNN.exe
  2⤵
  PID:10168
- C:\Windows\System\IpByWJX.exe
  C:\Windows\System\IpByWJX.exe
  2⤵
  PID:10188
- C:\Windows\System\KdktCCD.exe
  C:\Windows\System\KdktCCD.exe
  2⤵
  PID:10208
- C:\Windows\System\uapMXPr.exe
  C:\Windows\System\uapMXPr.exe
  2⤵
  PID:10228
- C:\Windows\System\SNeVuLa.exe
  C:\Windows\System\SNeVuLa.exe
  2⤵
  PID:9160
- C:\Windows\System\lMxotTO.exe
  C:\Windows\System\lMxotTO.exe
  2⤵
  PID:8284
- C:\Windows\System\ihQKqbX.exe
  C:\Windows\System\ihQKqbX.exe
  2⤵
  PID:8400
- C:\Windows\System\SkiRpFT.exe
  C:\Windows\System\SkiRpFT.exe
  2⤵
  PID:9024
- C:\Windows\System\RHDrPpR.exe
  C:\Windows\System\RHDrPpR.exe
  2⤵
  PID:9100
- C:\Windows\System\hhbMFQi.exe
  C:\Windows\System\hhbMFQi.exe
  2⤵
  PID:8860
- C:\Windows\System\mWuLfAX.exe
  C:\Windows\System\mWuLfAX.exe
  2⤵
  PID:9044
- C:\Windows\System\tvplVea.exe
  C:\Windows\System\tvplVea.exe
  2⤵
  PID:8360
- C:\Windows\System\wEIhqHB.exe
  C:\Windows\System\wEIhqHB.exe
  2⤵
  PID:9264
- C:\Windows\System\sckiAIF.exe
  C:\Windows\System\sckiAIF.exe
  2⤵
  PID:9284
- C:\Windows\System\qYGdKyO.exe
  C:\Windows\System\qYGdKyO.exe
  2⤵
  PID:9296
- C:\Windows\System\SfgKDhi.exe
  C:\Windows\System\SfgKDhi.exe
  2⤵
  PID:9320
- C:\Windows\System\QKHfFhf.exe
  C:\Windows\System\QKHfFhf.exe
  2⤵
  PID:9380
- C:\Windows\System\VkylDRI.exe
  C:\Windows\System\VkylDRI.exe
  2⤵
  PID:9428
- C:\Windows\System\AqeqVNh.exe
  C:\Windows\System\AqeqVNh.exe
  2⤵
  PID:9364
- C:\Windows\System\kKYRuaG.exe
  C:\Windows\System\kKYRuaG.exe
  2⤵
  PID:9452
- C:\Windows\System\qoDhODf.exe
  C:\Windows\System\qoDhODf.exe
  2⤵
  PID:9228
- C:\Windows\System\IClGLsQ.exe
  C:\Windows\System\IClGLsQ.exe
  2⤵
  PID:9504
- C:\Windows\System\XtzaCDc.exe
  C:\Windows\System\XtzaCDc.exe
  2⤵
  PID:9560
- C:\Windows\System\BtsXfoR.exe
  C:\Windows\System\BtsXfoR.exe
  2⤵
  PID:9580
- C:\Windows\System\nOImgOC.exe
  C:\Windows\System\nOImgOC.exe
  2⤵
  PID:9620
- C:\Windows\System\bOEeaFH.exe
  C:\Windows\System\bOEeaFH.exe
  2⤵
  PID:9676
- C:\Windows\System\BFpdZmK.exe
  C:\Windows\System\BFpdZmK.exe
  2⤵
  PID:9732
- C:\Windows\System\NPwUBzz.exe
  C:\Windows\System\NPwUBzz.exe
  2⤵
  PID:9688
- C:\Windows\System\zLxdeNq.exe
  C:\Windows\System\zLxdeNq.exe
  2⤵
  PID:9752
- C:\Windows\System\VKhfdNK.exe
  C:\Windows\System\VKhfdNK.exe
  2⤵
  PID:9800
- C:\Windows\System\CyEBaxt.exe
  C:\Windows\System\CyEBaxt.exe
  2⤵
  PID:9836
- C:\Windows\System\plUcqby.exe
  C:\Windows\System\plUcqby.exe
  2⤵
  PID:9888
- C:\Windows\System\VNeKStf.exe
  C:\Windows\System\VNeKStf.exe
  2⤵
  PID:9884
- C:\Windows\System\yWWBmFc.exe
  C:\Windows\System\yWWBmFc.exe
  2⤵
  PID:9956
- C:\Windows\System\jKPqfwB.exe
  C:\Windows\System\jKPqfwB.exe
  2⤵
  PID:9984
- C:\Windows\System\VUrLsaE.exe
  C:\Windows\System\VUrLsaE.exe
  2⤵
  PID:10004
- C:\Windows\System\TqvZntM.exe
  C:\Windows\System\TqvZntM.exe
  2⤵
  PID:10044
- C:\Windows\System\uBRwrtk.exe
  C:\Windows\System\uBRwrtk.exe
  2⤵
  PID:10060
- C:\Windows\System\fINBQtZ.exe
  C:\Windows\System\fINBQtZ.exe
  2⤵
  PID:10096
- C:\Windows\System\ViUvfeb.exe
  C:\Windows\System\ViUvfeb.exe
  2⤵
  PID:10128
- C:\Windows\System\UjnShIQ.exe
  C:\Windows\System\UjnShIQ.exe
  2⤵
  PID:10204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CMEwTtd.exe

Filesize
2.1MB

MD5
e044b41bc1c8bf10ea59fdfa3ecb9f76

SHA1
556b6552f348efe9fb49637686532810a4f193c4

SHA256
6ef06f5933792a7139c83c7a19f5f25a3c86a70ebde91b1794be67995ab2bf2b

SHA512
b9e17daa025b81eaffd90182f081dafcd6d4d10144e78431543f7117215b0ad18b48b93cb85e91372a2cb7baa560ea3f6e0ac12234581f59265aec8f3ef9436d

Download Submit
C:\Windows\system\CnfyBwK.exe

Filesize
2.1MB

MD5
3de2e440ef9ddb6cca4e8924edbfb51d

SHA1
ef9c243eb160b1b7310f8905914cbe376709b096

SHA256
9fafdc44ebfc6b66fd98d30f8550adae431af92b4f9ce3fa1ee8ef49d1497cdc

SHA512
4ca3bf86d2c6294b80d1183a43157d37377531b280c12bdeb752abbdb98c20e563fcd113289d5efdc0bdfe42ce3bd2598d010e3647d23968040e99ab9d5e4f84

Download Submit
C:\Windows\system\EfEPvMk.exe

Filesize
2.1MB

MD5
7c5237216a6a580db98977edb105365a

SHA1
c45362503a330d5fbc95fbf895877661cfc09855

SHA256
3f2c83df03c940b232af2518da0e7bfcc6f12d278af3d1cbbe6f9b42b3451e91

SHA512
92798ba49702dea5ed2f2d787c7580aced17e3ca14ed84f719623e1fcf07928776fd892d6ffacbf8a147da81923566572eb5c7c55ffff7238746deb716eb56a8

Download Submit
C:\Windows\system\GOJFWub.exe

Filesize
2.1MB

MD5
bbe7cb8929c7f7d3238e6aef8192dda4

SHA1
dd1a72b34471fb92547a47a98251693e0e611e84

SHA256
8e82f6c9a6faadabca95eb4c0dc8ba0ea0641627a2eb1aeb449d3fb5debefa40

SHA512
35911cfc59d53d6a7ac1fa9d7e116ddfa7714fb16d96f0b64992e5fdc12ffc4d82327b9810ade70dc7e900e84c502cb3e07fdf25d267376014883cf9706682ba

Download Submit
C:\Windows\system\HFAgICa.exe

Filesize
2.1MB

MD5
d1e5a7a343b0a2395ba98f89cf6c83c5

SHA1
08363ba2a711a320e37c3371cb84372653ddd603

SHA256
38fdbc6577c5d30c4d979f2cb6979a84ed4502a45ce90e0b956197dc6af8fda8

SHA512
4f27ac3e18617910bf54310400db0ccb5617f5bccb531f9ddbaf52f5ce08fa9644867653d440d6d35142a011a53558b01dfb7c5d0703847c3398b11156378bbe

Download Submit
C:\Windows\system\NqjlosB.exe

Filesize
2.1MB

MD5
163de4a8dc8e3f22ad81653cb8fea772

SHA1
38f7d1f6f4a49b8fc7734ece9e7d3524195ed7fd

SHA256
8932ae4dc83fbfe30c0df0105bddcf93d8cb4bbd66d62024c9830a5df833e98c

SHA512
44adbd34c664bf2337d7f0defffc5af99fffc75cce6d349ec7e236003aa7f7c581cd672cb973510cb94f7197172e2cf54d42cf722fe49511657987f296919629

Download Submit
C:\Windows\system\WgLxApS.exe

Filesize
2.1MB

MD5
98fa577071169798000e8f790f6e36de

SHA1
5deb7fcacfe9cfc44ef5a62bd5593bd7026645f0

SHA256
0190c6644255fb91416d06176cddbbf69598a8a19a4082b4e590e1bc53b01fd5

SHA512
7d4c827fd3775b701e725eea064cae1c7b25f0e762ed3e73353f053a95e59f2d5a8a00820e0744a662f99df3312abf31bca16dbb1216e27a0ae986230fd47707

Download Submit
C:\Windows\system\XYhTsjl.exe

Filesize
2.1MB

MD5
b424e78e5ca122ebe8b635279dcd6ccd

SHA1
bbe2df0d3a2d225e8a6a9ab1a3a417a0061839f1

SHA256
620496c4c22f4e1e45326f89d19c71e77ab73cbe223e1e363b509b2d7dccbe7a

SHA512
88a4039fcb07e3937bbdd3833001e9e0021a085ea2849316d4653c62b494f0c8628be751977798eb0b61d997de3f5590debf1d275f3f4c176a1f14c6a4f57e71

Download Submit
C:\Windows\system\XdZwJII.exe

Filesize
2.1MB

MD5
a05c4b7925e100d381830a50ce1b3c6d

SHA1
ec01fa1311c91037671fd30430d354f428d1541e

SHA256
9a0cb13d966f88be6b2bada15caeecffb13f022ff057e3b3456a8d2d7277bbab

SHA512
5fe59493491159a49830ff06b58918e173d526e8655e1572b3eeb8342591399bfdabf099ba23727774844383df1f96fba47d8eb5a727a3a8b0bd8e1df30d9f88

Download Submit
C:\Windows\system\agCBczM.exe

Filesize
2.1MB

MD5
aee46a07198ef6cdc7b8bf78f826ff6a

SHA1
cbe947e063f68e99ebe2d2d5f760eae76bbe41bd

SHA256
ab1fcfd049a9a9a0a7668caf0507e143a5dcfa590048b30a12e140bab66e617d

SHA512
4d31cf3c341f2ef7f3679b8fc99be0fde95cfd15d3120ba388d6d70ec09731c7d73da026236974e127df4c08ee97fdf2379792290259c5f9dcdca8de36afb07a

Download Submit
C:\Windows\system\iBBTYOW.exe

Filesize
2.1MB

MD5
e12928504e6dc59d811cf4797a401608

SHA1
4abbf97bc8c3ebd95ecd677a31234e2aa6ea4ea4

SHA256
c38f7b3c93c4e17c8e629129a78d24b2e84918e1e089694e8d21c6095a1baae6

SHA512
f5be45e6f2a7b9d5a83af33ce7bdb3ca55a498fa59c6a13cdd10b54fee4bd557670dc8160543951e53bd16a666f8e0476fec8d16e3512ba75fec88037ed8b27a

Download Submit
C:\Windows\system\mthyMYm.exe

Filesize
2.1MB

MD5
a7be98a095aa236ab5cd575d6798114e

SHA1
91fd86d3ad956e7a4b3e09be63a77634d5de3ff9

SHA256
52a9083d7f12c5b56cc2024878785e3069d92e02a8769459291d1a0a96bc325b

SHA512
0ba22e35777b95a1b3a40b7a9daad402e7c9af4c67df84139059ab9a1dd59e279283ec1f44ca773541b0ddc74abcf1d70633aa93f4cfeec02899900d5c7c72e2

Download Submit
C:\Windows\system\oxCKjrI.exe

Filesize
2.1MB

MD5
c4d122d9f7bc526e1ba7b71ecaa8c651

SHA1
b9f58c5529bd62e07c73cedb9d5c4930ae5bb211

SHA256
4217d5a07ce612aa185f50f77733273ef1d4080da543c88d22b572d0351832f1

SHA512
6d9ad3662be70f042482e74d4fe6be51cf1bd6aa3e2ca052f5eaed41313968a23b59088a8a2bb18988ed4baa20dd7b8ef41c023a52208b6bddde681bdaec106d

Download Submit
C:\Windows\system\qoCZBEP.exe

Filesize
2.1MB

MD5
13b138cd006e8897fe18a5f1decfeca9

SHA1
cddd641b04124d6516912b0e0b659b0b80011d8c

SHA256
81059f852e1eafe0367caa40a0049bda25901067c49d8f727335f357b1e01f88

SHA512
265bf066a0639945b6e429e06711f026d8ea824fae2b0aff038759a8ef02e5198a7b6b366e08e23fa74ba622a5c10014e2ede9610df2f79beedfed0e2cb4ff34

Download Submit
C:\Windows\system\rFdrTSi.exe

Filesize
2.1MB

MD5
f2ca914dc9709c4b13d2c6f3451e82fd

SHA1
444217682d3eba6d24e451569ca0d6621f01b34f

SHA256
13f1fe5a553b98c7db4694d54a2df0049bf3f87bcd8b6c5a2d250d203a52cbd9

SHA512
19fb33363f3c4c8cdb1608aefdbd2c42a9cc91e3154dc8843b54ec8c26aa2efa2534ace1652e12c0c46c839dd8642f8c7983f2ac1b050ec788f962d102d15fe7

Download Submit
C:\Windows\system\raONeld.exe

Filesize
2.1MB

MD5
c3259a2561912cf3c217b48ed7ec7308

SHA1
f3f522a6657b0a975282c1643125e30d2dce5efd

SHA256
1599f3239d4630d513d6c427bc6735fc3d04908ffb695f362ed01556ecac683e

SHA512
e0a20bd5653bc06e6147a1c1a142d8ea426e35ea072e83b1bc6d790b1261c7795b1531e912680981c12e606ea22d074285751245b66e2d71619ee00ac0da52d4

Download Submit
C:\Windows\system\sGIlTmi.exe

Filesize
2.1MB

MD5
ec2b7ebdc626388e24cc4dd2094c5ee5

SHA1
56ae0f60859f73b0471bbd51156fe0af3167a20e

SHA256
b5991bf0d7ee5a69ba8aca3e52cccdfc26ace564671b18866b06479125207c50

SHA512
4eca293f13af45c13af51071d74db4d364cf6ba36ed5c5817caa73e8ff696d7e648be39c592372efcee1424c7a2fc3e5bdbf825301afb914626ea4e0fbcf771c

Download Submit
C:\Windows\system\tmJCwyv.exe

Filesize
2.1MB

MD5
282b85ab8351c0fe89efe06796e505a7

SHA1
4adac84de5a2557e9bd7b481b728e6b1a8a94527

SHA256
1efd340c5a092fde563ab29e8e80325282348333ec7e006c326cb16400acfe5d

SHA512
a55840d8fa326f7a779f366d01e088476efd8c2eebb8cb4a2adfa51aaa3c0df41d0a749879e580b52f9374862b6dec5527f77226739e4125460bb491c357ca13

Download Submit
C:\Windows\system\zNnTPDT.exe

Filesize
2.1MB

MD5
be23dc263590acebb049578e80aa1048

SHA1
e39096763306bd570a27da2392ef4b23f7ea0e1c

SHA256
c700bbfaef8241989043b1909f59fbab194febac2930dd60df0ea0a12abba3d5

SHA512
342bad1d616230b3259e38ce35f0fb087fcf1d991c933ba5f420636cc24c3c886e101bc58087a7795af38f546db5113ea4d1d23596a38b1bc227756f5d05e3d1

Download Submit
\Windows\system\FZzvZXn.exe

Filesize
2.1MB

MD5
bdb09a03acdbfa3aae16bd13b63b46bb

SHA1
2c0eba162f7ce68be42515fb98b24314ac5169e4

SHA256
7eea0b012527cb5ef27c93df0b61a205df97145728f7c4575fc7679a8445f56d

SHA512
16644e0c6a8b3b530bc9c061ccc1f8e4497220b73729c71eeb681fe07230309bdd6429afe94e860fbfc6c4b177f060567ea7741f786533110b1eace4c0d4ad41

Download Submit
\Windows\system\FmJKmpR.exe

Filesize
2.1MB

MD5
62ff4b6d696a016b7661a4e7564776f8

SHA1
d36ca4a2dd93a2141a6069a726077429ee10edbf

SHA256
9b905b69ceed6852ce92f5b9a80921056ba50dd5b82a6a1c775c9919079d4a4b

SHA512
90e58abefa931339615f63c3e020e390c0c9e7fdde4084f5fbc572964652d618afdbb9dd73f938123722690e92ad7299aa6ec380aad070649a2e1960f685dc21

Download Submit
\Windows\system\RaXtcCl.exe

Filesize
2.1MB

MD5
6d3d1f0922c0484483812dbbf59bbf24

SHA1
04a100133fd8e35ef6c44c98febd1b676464969d

SHA256
8e4c104f9483f52b7376bb92c94565a58d0c757119925b17af5683c8f1955155

SHA512
b31890159b469b59dbb19531658ab1d1bf27d69f0ae144b61bcc468e1228381f968306401feb07a64fb7de13b00f0def7cc0135d86752c0d1364f8a904476a9b

Download Submit
\Windows\system\WQPAIdz.exe

Filesize
2.1MB

MD5
45a96b04aaa581a3bb7a73570e8df1b6

SHA1
765188103c6b942eb82d1871fc510e2c05120353

SHA256
d9f7cf195f23b431d03d195f8580f498069cb0041863c98fc58f729a75dd700b

SHA512
cbc3f7dbcfe44430a6114989b0c5c8d5250a2435f874e7c21389ad04ac393814f080d9d05fa838d645da045957a69d58541d2d9b902a9f35023c5f60829d7489

Download Submit
\Windows\system\XSYKejD.exe

Filesize
2.1MB

MD5
c37273d6354228de921c95f174d8fad6

SHA1
39959c04b9ff9e5f4caecb49096e82c17f3e08cc

SHA256
935626bd32688901e214aa7ff4215e3102f30ca65e50d1a2b601bc2749051070

SHA512
a9ba5c96e4e4e06f33394b67023cf9f83da6452600e71f2ea6cfda7ecc23c2a2bfbd5d53b3b56a788e6c79d026e76067a28f76da30f4b9176e4297f5445fd1e3

Download Submit
\Windows\system\YwsjJVh.exe

Filesize
2.1MB

MD5
566c156de06fe4865fe9642ec43c8ca1

SHA1
4d234527ecce2701bb496a650f9a4a5a0fa2c4b9

SHA256
a629ccc2663af6cf95b0185dced4c1c739006c31a1c7e413b7271b20f1c89605

SHA512
cdb1abedbc998910aa4aeaa9d3e232d202d2d603376dba0e1922aae1bb9f1bc3d49a493f8924ea8bed05b7b17e328a4391ed1c0a2c0e4c42697f957f64a05c2a

Download Submit
\Windows\system\ZJdoknO.exe

Filesize
2.1MB

MD5
82dd1d3ac8fa3d0847309f5ea81a839c

SHA1
0b37f6ad60650e8eeb773b0e28147f245e09e72d

SHA256
b08c09118fdb77bcdee89420c9aa749521d864e642ef83ef4e8014540cc6e59c

SHA512
53aa582e226473e50aaff604daef873587189538f68ecd9db9cdd99c1e0b3550621f3ba3c400c27cc1c1ce5e449e43788e28456de92de601cb35548b41349235

Download Submit
\Windows\system\imbuLol.exe

Filesize
2.1MB

MD5
029fad093386374ad21f19bcf1ffdda8

SHA1
a9d8bcea2512b934e1df40089dd397ab15268895

SHA256
1304e2b8d147dcd8c4f3ca22519ab605ff3c57f6457d4d50d551ee6b5ea559de

SHA512
127b5e8b658528ba77bfd8ec4a61b0dd8a20dcfa61141dcae38617d4f34eec4ca0ba0deed87dae95f521de94bc2dc2a0f842882ab3ff7fb8ec93a92ce7f38803

Download Submit
\Windows\system\krNyMfc.exe

Filesize
2.1MB

MD5
9b17320abcf3d011b3d6a85dd791162c

SHA1
376b9de486cb982df393180578c836e61a17c523

SHA256
7c1b2525b01955655d3aa3898c2ee6cfc3ad20cf064240e32dead52b21110597

SHA512
17c8902fa58792cebc4a98eb05cabbb2e951a28596b66e07f4d14e17b7fa30e9b13139a783fd621499ae22860a56ab37ce3d071c6c74950434055338236f3f08

Download Submit
\Windows\system\nuHaNQY.exe

Filesize
2.1MB

MD5
b2792851feacfe327636e900d6aca71d

SHA1
0037db9d26472329104b2a9980668d2b20ac4a13

SHA256
28e8b8a5d8964baf4401975c057c4d56e3eac382a8d92f91c5561259d238c191

SHA512
d56d75a5d98edf83d7f9a90c26002c7640bb0d815ec11dd7f8cc059c26022176d92db71e616c46c8f40867156a3cf42d2f8bc845e42d29e7915103bba4fef72c

Download Submit
\Windows\system\owciHVA.exe

Filesize
2.1MB

MD5
37b168163391ef5275ad3e649583712d

SHA1
de969ee922953b2bfbfb1531ef3fa58d3f3b6ff5

SHA256
fba3ad48ee61e3c96ee0a83e24930b417e34d79d6503c1cf5e7851f91393aa8b

SHA512
7e9a9953d59d58380977c5aaa66f929fc11df139934ab3282f74c397003e43e4dae69a769c52645183afc6753e95459f122d751b204e318f3bc529ef47c347b8

Download Submit
\Windows\system\pUgflPz.exe

Filesize
2.1MB

MD5
5734d021f1b05826e985415d37496647

SHA1
ad350b8489e20cc298d38bfe8a841b007f9f673c

SHA256
b718c8de08ca33561b7952f2363ca24f0b03633469c95ba47746833dfda400ab

SHA512
ce36c944cd5a909f68b12667e58c9bbc0e84a46bfd85534a15d35c879a5b91a51143574c637f439a0587e05ee142a48aee97c5458dc4471f070e3a4dc6633b6f

Download Submit
\Windows\system\tvnBqWe.exe

Filesize
2.1MB

MD5
1bd66de708f6e87f1f3408bc8b0eec28

SHA1
c704081d83fe49cf69287ea756f6a9d7454de412

SHA256
11d017145541e628798d7dadea3ef681a06eead733bf975fd960361dd6b3c8bb

SHA512
38aea40b086d9281cb99a2d63d0d07028e58a6d20344de452f3bf3295d6955e48c979b962551c1f9afc3f21452e3d9b2c0d1f017ac265fed2d90285db12cdb99

Download Submit
memory/780-70-0x000000013F960000-0x000000013FCB4000-memory.dmp

Filesize
3.3MB

Download
memory/780-4010-0x000000013F960000-0x000000013FCB4000-memory.dmp

Filesize
3.3MB

Download
memory/1604-102-0x000000013FC10000-0x000000013FF64000-memory.dmp

Filesize
3.3MB

Download
memory/1604-4013-0x000000013FC10000-0x000000013FF64000-memory.dmp

Filesize
3.3MB

Download
memory/2128-28-0x000000013FAD0000-0x000000013FE24000-memory.dmp

Filesize
3.3MB

Download
memory/2128-4003-0x000000013FAD0000-0x000000013FE24000-memory.dmp

Filesize
3.3MB

Download
memory/2288-110-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-1184-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-0-0x000000013FC30000-0x000000013FF84000-memory.dmp

Filesize
3.3MB

Download
memory/2288-3494-0x000000013FFA0000-0x00000001402F4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-15-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-108-0x000000013FFA0000-0x00000001402F4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-97-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-3251-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-95-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-78-0x000000013FC30000-0x000000013FF84000-memory.dmp

Filesize
3.3MB

Download
memory/2288-3136-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-2632-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-56-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-58-0x000000013F4F0000-0x000000013F844000-memory.dmp

Filesize
3.3MB

Download
memory/2288-69-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-2442-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-62-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-34-0x000000013FFD0000-0x0000000140324000-memory.dmp

Filesize
3.3MB

Download
memory/2288-87-0x000000013F6C0000-0x000000013FA14000-memory.dmp

Filesize
3.3MB

Download
memory/2288-39-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2288-30-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/2432-59-0x000000013F4F0000-0x000000013F844000-memory.dmp

Filesize
3.3MB

Download
memory/2432-4006-0x000000013F4F0000-0x000000013F844000-memory.dmp

Filesize
3.3MB

Download
memory/2436-63-0x000000013FDD0000-0x0000000140124000-memory.dmp

Filesize
3.3MB

Download
memory/2436-4009-0x000000013FDD0000-0x0000000140124000-memory.dmp

Filesize
3.3MB

Download
memory/2496-31-0x000000013F6C0000-0x000000013FA14000-memory.dmp

Filesize
3.3MB

Download
memory/2496-4001-0x000000013F6C0000-0x000000013FA14000-memory.dmp

Filesize
3.3MB

Download
memory/2600-4005-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2600-35-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2608-57-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/2608-4007-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/2636-76-0x000000013FED0000-0x0000000140224000-memory.dmp

Filesize
3.3MB

Download
memory/2636-4011-0x000000013FED0000-0x0000000140224000-memory.dmp

Filesize
3.3MB

Download
memory/2728-32-0x000000013F750000-0x000000013FAA4000-memory.dmp

Filesize
3.3MB

Download
memory/2728-4002-0x000000013F750000-0x000000013FAA4000-memory.dmp

Filesize
3.3MB

Download
memory/2748-83-0x000000013F720000-0x000000013FA74000-memory.dmp

Filesize
3.3MB

Download
memory/2748-4012-0x000000013F720000-0x000000013FA74000-memory.dmp

Filesize
3.3MB

Download
memory/2768-55-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Filesize
3.3MB

Download
memory/2768-4008-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Filesize
3.3MB

Download
memory/2768-111-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Filesize
3.3MB

Download
memory/2884-4014-0x000000013F960000-0x000000013FCB4000-memory.dmp

Filesize
3.3MB

Download
memory/2884-96-0x000000013F960000-0x000000013FCB4000-memory.dmp

Filesize
3.3MB

Download
memory/3056-33-0x000000013FFD0000-0x0000000140324000-memory.dmp

Filesize
3.3MB

Download
memory/3056-4004-0x000000013FFD0000-0x0000000140324000-memory.dmp

Filesize
3.3MB

Download