xmrig | 89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
Size

1019KB
MD5

f68832f6850bc9f42ec2bd0c2b9ae440
SHA1

34921a6653df32afe1ae5381735cc4a4e021d74f
SHA256

89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77
SHA512

222197c06750eb6710343626be9b8fccc8b5e85c66ea232adaead3d8e5e91afb97ac28b8d264bd383247f125b37be3a08d14128852ff146d30fe9564190764ed
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHDM8lx5chBqD:GezaTF8FcNkNdfE0pZ9oztFwIRLDch2

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x00090000000122d6-2.dat	xmrig
behavioral1/files/0x000a0000000144a4-6.dat	xmrig
behavioral1/files/0x000700000001459f-13.dat	xmrig
behavioral1/files/0x000700000001462d-14.dat	xmrig
behavioral1/files/0x00070000000146d4-21.dat	xmrig
behavioral1/files/0x0007000000014713-24.dat	xmrig
behavioral1/files/0x0006000000016cbb-36.dat	xmrig
behavioral1/files/0x0006000000016d16-68.dat	xmrig
behavioral1/files/0x0006000000016d2f-80.dat	xmrig
behavioral1/files/0x0006000000016d4a-88.dat	xmrig
behavioral1/files/0x000600000001705e-100.dat	xmrig
behavioral1/files/0x0006000000017362-110.dat	xmrig
behavioral1/files/0x0006000000017464-128.dat	xmrig
behavioral1/files/0x0006000000017404-124.dat	xmrig
behavioral1/files/0x00060000000173b7-120.dat	xmrig
behavioral1/files/0x0006000000017371-116.dat	xmrig
behavioral1/files/0x00060000000171b9-108.dat	xmrig
behavioral1/files/0x000600000001708b-105.dat	xmrig
behavioral1/files/0x0006000000016d52-96.dat	xmrig
behavioral1/files/0x0006000000016d4e-92.dat	xmrig
behavioral1/files/0x0006000000016d43-84.dat	xmrig
behavioral1/files/0x0006000000016d27-76.dat	xmrig
behavioral1/files/0x0006000000016d1f-72.dat	xmrig
behavioral1/files/0x0006000000016d0e-64.dat	xmrig
behavioral1/files/0x0006000000016d05-60.dat	xmrig
behavioral1/files/0x0006000000016cfd-56.dat	xmrig
behavioral1/files/0x0006000000016cf1-52.dat	xmrig
behavioral1/files/0x0006000000016ce9-48.dat	xmrig
behavioral1/files/0x0006000000016cda-44.dat	xmrig
behavioral1/files/0x0006000000016cd1-40.dat	xmrig
behavioral1/files/0x0006000000016c9c-32.dat	xmrig
behavioral1/files/0x0006000000016c30-28.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2100	qecoIph.exe
2968	SJgXlwg.exe
2024	oRrwyyZ.exe
2580	FRRMWgI.exe
2692	prasDAb.exe
2328	meNlqwn.exe
3032	HulrOfx.exe
2744	GMGapDE.exe
2776	NzWtiOM.exe
2648	fKfZkts.exe
2880	rvgyKfB.exe
2508	ZTkfByn.exe
2660	WgRNifA.exe
2792	DXEayIE.exe
2392	PUwUSsP.exe
2544	HbQbNNa.exe
2496	mLpKliN.exe
2564	qlhuXGA.exe
2956	dvDGlBL.exe
2148	nFOHexN.exe
1736	wKIzavV.exe
2160	oQuxkdi.exe
1516	PDTeNiq.exe
1796	jwpFlxf.exe
2212	hTbgGYL.exe
2408	RiCYTvL.exe
1572	zTGiWlx.exe
108	XgsXYYB.exe
2568	bdenhBX.exe
2712	zRGOYXR.exe
2488	jUYvfQw.exe
2372	DxckNZH.exe
1628	jHLXtUg.exe
2232	FFROLUV.exe
2836	jMnYSEk.exe
2848	lWhUbZd.exe
684	CuTXYcF.exe
572	JPsXTxv.exe
576	KmmvNZE.exe
1380	inObzJy.exe
1468	rRfactP.exe
1900	zXTGxXU.exe
1304	qEhcOUN.exe
1944	mdkxXwp.exe
1760	ovwsTgT.exe
1280	hJCbdpo.exe
408	CGlAQYa.exe
1108	tYzGLOR.exe
2236	HuwcWOx.exe
2072	dLrQgmS.exe
1780	AAeTulT.exe
2276	vraXDwp.exe
1548	umolNHV.exe
1200	qzsbIvr.exe
1364	ANSGCOV.exe
1084	bYWVHXx.exe
816	YpsKICr.exe
3004	yDszhbr.exe
2476	fiwiqgV.exe
904	QKQqvhA.exe
696	VNeilLG.exe
708	PNSeJRx.exe
2316	NYoGdNJ.exe
1644	PWVbRiH.exe

Loads dropped DLL 64 IoCs

pid	Process
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZdgyOIH.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\VhPzvUz.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\gIfVruc.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\jHLXtUg.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\RNUwUfj.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\QXdjeMM.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\fkGbDJP.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\bZcblRe.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\FIGUuFn.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\CrmZEIR.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\LrrZLdD.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\iBcKrPI.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\ocohLFv.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\eJsufiu.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\LvxjWzA.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\kRGgRVv.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\yKMhDaa.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\ssqnDvB.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\RtGtyOm.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\fEBnIvD.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\FRRMWgI.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\imHIcYk.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\LTquosn.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\dsGdeVl.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\bdrZeSB.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\VWYZnpu.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\hKgxuBS.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\qnkWxKA.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\UbzXcWn.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\GMUmxRT.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\ODXdsfp.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\HfJmUiZ.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\IvKjHyb.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\alqazHg.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\CrNspAF.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\ozgzoqt.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\QNpCgiM.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\hUbnuBg.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\YjuDCDb.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\UbDrorL.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\JCSUNfh.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\biSuSSY.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\JRCUxUM.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\WhiOFCC.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\Wzeocnw.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\Fovazlt.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\EEUXGEI.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\loaqvqB.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\gbildWk.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\isEZgOs.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\LHDPEAZ.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\uqFZqVz.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\xJiqgVc.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\UgtQHTp.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\AFFTxmc.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\lEAXDxl.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\gTIyZsA.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\oLZISZB.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\sYVRMyh.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\RQbllRc.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\tlQHxpI.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\ChvkntM.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\CulFjdj.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
File created	C:\Windows\System\qecoIph.exe	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2100	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	29
PID 1844 wrote to memory of 2100	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	29
PID 1844 wrote to memory of 2100	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	29
PID 1844 wrote to memory of 2968	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	30
PID 1844 wrote to memory of 2968	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	30
PID 1844 wrote to memory of 2968	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	30
PID 1844 wrote to memory of 2024	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	31
PID 1844 wrote to memory of 2024	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	31
PID 1844 wrote to memory of 2024	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	31
PID 1844 wrote to memory of 2580	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	32
PID 1844 wrote to memory of 2580	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	32
PID 1844 wrote to memory of 2580	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	32
PID 1844 wrote to memory of 2692	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	33
PID 1844 wrote to memory of 2692	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	33
PID 1844 wrote to memory of 2692	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	33
PID 1844 wrote to memory of 2328	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	34
PID 1844 wrote to memory of 2328	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	34
PID 1844 wrote to memory of 2328	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	34
PID 1844 wrote to memory of 3032	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	35
PID 1844 wrote to memory of 3032	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	35
PID 1844 wrote to memory of 3032	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	35
PID 1844 wrote to memory of 2744	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	36
PID 1844 wrote to memory of 2744	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	36
PID 1844 wrote to memory of 2744	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	36
PID 1844 wrote to memory of 2776	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	37
PID 1844 wrote to memory of 2776	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	37
PID 1844 wrote to memory of 2776	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	37
PID 1844 wrote to memory of 2648	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	38
PID 1844 wrote to memory of 2648	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	38
PID 1844 wrote to memory of 2648	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	38
PID 1844 wrote to memory of 2880	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	39
PID 1844 wrote to memory of 2880	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	39
PID 1844 wrote to memory of 2880	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	39
PID 1844 wrote to memory of 2508	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	40
PID 1844 wrote to memory of 2508	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	40
PID 1844 wrote to memory of 2508	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	40
PID 1844 wrote to memory of 2660	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	41
PID 1844 wrote to memory of 2660	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	41
PID 1844 wrote to memory of 2660	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	41
PID 1844 wrote to memory of 2792	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	42
PID 1844 wrote to memory of 2792	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	42
PID 1844 wrote to memory of 2792	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	42
PID 1844 wrote to memory of 2392	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	43
PID 1844 wrote to memory of 2392	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	43
PID 1844 wrote to memory of 2392	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	43
PID 1844 wrote to memory of 2544	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	44
PID 1844 wrote to memory of 2544	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	44
PID 1844 wrote to memory of 2544	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	44
PID 1844 wrote to memory of 2496	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	45
PID 1844 wrote to memory of 2496	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	45
PID 1844 wrote to memory of 2496	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	45
PID 1844 wrote to memory of 2564	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	46
PID 1844 wrote to memory of 2564	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	46
PID 1844 wrote to memory of 2564	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	46
PID 1844 wrote to memory of 2956	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	47
PID 1844 wrote to memory of 2956	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	47
PID 1844 wrote to memory of 2956	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	47
PID 1844 wrote to memory of 2148	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	48
PID 1844 wrote to memory of 2148	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	48
PID 1844 wrote to memory of 2148	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	48
PID 1844 wrote to memory of 1736	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	49
PID 1844 wrote to memory of 1736	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	49
PID 1844 wrote to memory of 1736	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	49
PID 1844 wrote to memory of 2160	1844	89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\89adf47598f0eeb3d87741bf1373c847fcbc7ae789bbe5044355cfa6b6c42f77_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\System\qecoIph.exe
  C:\Windows\System\qecoIph.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\SJgXlwg.exe
  C:\Windows\System\SJgXlwg.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\oRrwyyZ.exe
  C:\Windows\System\oRrwyyZ.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\FRRMWgI.exe
  C:\Windows\System\FRRMWgI.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\prasDAb.exe
  C:\Windows\System\prasDAb.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\meNlqwn.exe
  C:\Windows\System\meNlqwn.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\HulrOfx.exe
  C:\Windows\System\HulrOfx.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\GMGapDE.exe
  C:\Windows\System\GMGapDE.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\NzWtiOM.exe
  C:\Windows\System\NzWtiOM.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\fKfZkts.exe
  C:\Windows\System\fKfZkts.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\rvgyKfB.exe
  C:\Windows\System\rvgyKfB.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\ZTkfByn.exe
  C:\Windows\System\ZTkfByn.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\WgRNifA.exe
  C:\Windows\System\WgRNifA.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\DXEayIE.exe
  C:\Windows\System\DXEayIE.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\PUwUSsP.exe
  C:\Windows\System\PUwUSsP.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\HbQbNNa.exe
  C:\Windows\System\HbQbNNa.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\mLpKliN.exe
  C:\Windows\System\mLpKliN.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\qlhuXGA.exe
  C:\Windows\System\qlhuXGA.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\dvDGlBL.exe
  C:\Windows\System\dvDGlBL.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\nFOHexN.exe
  C:\Windows\System\nFOHexN.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\wKIzavV.exe
  C:\Windows\System\wKIzavV.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\oQuxkdi.exe
  C:\Windows\System\oQuxkdi.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\PDTeNiq.exe
  C:\Windows\System\PDTeNiq.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\jwpFlxf.exe
  C:\Windows\System\jwpFlxf.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\hTbgGYL.exe
  C:\Windows\System\hTbgGYL.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\RiCYTvL.exe
  C:\Windows\System\RiCYTvL.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\zTGiWlx.exe
  C:\Windows\System\zTGiWlx.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\XgsXYYB.exe
  C:\Windows\System\XgsXYYB.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\bdenhBX.exe
  C:\Windows\System\bdenhBX.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\zRGOYXR.exe
  C:\Windows\System\zRGOYXR.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\jUYvfQw.exe
  C:\Windows\System\jUYvfQw.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\DxckNZH.exe
  C:\Windows\System\DxckNZH.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\jHLXtUg.exe
  C:\Windows\System\jHLXtUg.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\FFROLUV.exe
  C:\Windows\System\FFROLUV.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\jMnYSEk.exe
  C:\Windows\System\jMnYSEk.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\lWhUbZd.exe
  C:\Windows\System\lWhUbZd.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\CuTXYcF.exe
  C:\Windows\System\CuTXYcF.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\JPsXTxv.exe
  C:\Windows\System\JPsXTxv.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\KmmvNZE.exe
  C:\Windows\System\KmmvNZE.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\inObzJy.exe
  C:\Windows\System\inObzJy.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\rRfactP.exe
  C:\Windows\System\rRfactP.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\zXTGxXU.exe
  C:\Windows\System\zXTGxXU.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\qEhcOUN.exe
  C:\Windows\System\qEhcOUN.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\mdkxXwp.exe
  C:\Windows\System\mdkxXwp.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\ovwsTgT.exe
  C:\Windows\System\ovwsTgT.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\hJCbdpo.exe
  C:\Windows\System\hJCbdpo.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\CGlAQYa.exe
  C:\Windows\System\CGlAQYa.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\tYzGLOR.exe
  C:\Windows\System\tYzGLOR.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\HuwcWOx.exe
  C:\Windows\System\HuwcWOx.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\dLrQgmS.exe
  C:\Windows\System\dLrQgmS.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\AAeTulT.exe
  C:\Windows\System\AAeTulT.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\vraXDwp.exe
  C:\Windows\System\vraXDwp.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\umolNHV.exe
  C:\Windows\System\umolNHV.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\qzsbIvr.exe
  C:\Windows\System\qzsbIvr.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\ANSGCOV.exe
  C:\Windows\System\ANSGCOV.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\bYWVHXx.exe
  C:\Windows\System\bYWVHXx.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\YpsKICr.exe
  C:\Windows\System\YpsKICr.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\yDszhbr.exe
  C:\Windows\System\yDszhbr.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\fiwiqgV.exe
  C:\Windows\System\fiwiqgV.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\QKQqvhA.exe
  C:\Windows\System\QKQqvhA.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\VNeilLG.exe
  C:\Windows\System\VNeilLG.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\PNSeJRx.exe
  C:\Windows\System\PNSeJRx.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\NYoGdNJ.exe
  C:\Windows\System\NYoGdNJ.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\PWVbRiH.exe
  C:\Windows\System\PWVbRiH.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\kFuRexz.exe
  C:\Windows\System\kFuRexz.exe
  2⤵
  PID:2884
- C:\Windows\System\kNRlCBv.exe
  C:\Windows\System\kNRlCBv.exe
  2⤵
  PID:832
- C:\Windows\System\RCbBbXI.exe
  C:\Windows\System\RCbBbXI.exe
  2⤵
  PID:2896
- C:\Windows\System\ESBQQNu.exe
  C:\Windows\System\ESBQQNu.exe
  2⤵
  PID:2096
- C:\Windows\System\BrnhqUQ.exe
  C:\Windows\System\BrnhqUQ.exe
  2⤵
  PID:1048
- C:\Windows\System\sBmlnFG.exe
  C:\Windows\System\sBmlnFG.exe
  2⤵
  PID:1496
- C:\Windows\System\cFlFjJJ.exe
  C:\Windows\System\cFlFjJJ.exe
  2⤵
  PID:1520
- C:\Windows\System\JOcWser.exe
  C:\Windows\System\JOcWser.exe
  2⤵
  PID:2324
- C:\Windows\System\OIVbPIK.exe
  C:\Windows\System\OIVbPIK.exe
  2⤵
  PID:2120
- C:\Windows\System\QvLNcYJ.exe
  C:\Windows\System\QvLNcYJ.exe
  2⤵
  PID:1540
- C:\Windows\System\RBlxdNP.exe
  C:\Windows\System\RBlxdNP.exe
  2⤵
  PID:1720
- C:\Windows\System\yOiAwEd.exe
  C:\Windows\System\yOiAwEd.exe
  2⤵
  PID:1568
- C:\Windows\System\iAWIhjv.exe
  C:\Windows\System\iAWIhjv.exe
  2⤵
  PID:2928
- C:\Windows\System\XPJfBuM.exe
  C:\Windows\System\XPJfBuM.exe
  2⤵
  PID:2944
- C:\Windows\System\CvktwFP.exe
  C:\Windows\System\CvktwFP.exe
  2⤵
  PID:2864
- C:\Windows\System\xRdLOfF.exe
  C:\Windows\System\xRdLOfF.exe
  2⤵
  PID:2628
- C:\Windows\System\ZncyAGM.exe
  C:\Windows\System\ZncyAGM.exe
  2⤵
  PID:2772
- C:\Windows\System\eNWtNWF.exe
  C:\Windows\System\eNWtNWF.exe
  2⤵
  PID:2696
- C:\Windows\System\FuKeKjF.exe
  C:\Windows\System\FuKeKjF.exe
  2⤵
  PID:2536
- C:\Windows\System\BlgoTMe.exe
  C:\Windows\System\BlgoTMe.exe
  2⤵
  PID:2976
- C:\Windows\System\ldwOuFe.exe
  C:\Windows\System\ldwOuFe.exe
  2⤵
  PID:2504
- C:\Windows\System\SAYxCpB.exe
  C:\Windows\System\SAYxCpB.exe
  2⤵
  PID:2948
- C:\Windows\System\qIxhkBw.exe
  C:\Windows\System\qIxhkBw.exe
  2⤵
  PID:1884
- C:\Windows\System\oiwqKXr.exe
  C:\Windows\System\oiwqKXr.exe
  2⤵
  PID:2188
- C:\Windows\System\lyIKxiG.exe
  C:\Windows\System\lyIKxiG.exe
  2⤵
  PID:1696
- C:\Windows\System\RRorORy.exe
  C:\Windows\System\RRorORy.exe
  2⤵
  PID:1712
- C:\Windows\System\gZQULyZ.exe
  C:\Windows\System\gZQULyZ.exe
  2⤵
  PID:112
- C:\Windows\System\RdQsePh.exe
  C:\Windows\System\RdQsePh.exe
  2⤵
  PID:2684
- C:\Windows\System\RZwYFHf.exe
  C:\Windows\System\RZwYFHf.exe
  2⤵
  PID:2856
- C:\Windows\System\ZbkLSxz.exe
  C:\Windows\System\ZbkLSxz.exe
  2⤵
  PID:1616
- C:\Windows\System\nRYgTut.exe
  C:\Windows\System\nRYgTut.exe
  2⤵
  PID:2832
- C:\Windows\System\CFwlsUn.exe
  C:\Windows\System\CFwlsUn.exe
  2⤵
  PID:532
- C:\Windows\System\VWYZnpu.exe
  C:\Windows\System\VWYZnpu.exe
  2⤵
  PID:2784
- C:\Windows\System\oXRlBcy.exe
  C:\Windows\System\oXRlBcy.exe
  2⤵
  PID:2244
- C:\Windows\System\ZPartMn.exe
  C:\Windows\System\ZPartMn.exe
  2⤵
  PID:556
- C:\Windows\System\kjMhaof.exe
  C:\Windows\System\kjMhaof.exe
  2⤵
  PID:1912
- C:\Windows\System\lGhoLlV.exe
  C:\Windows\System\lGhoLlV.exe
  2⤵
  PID:1864
- C:\Windows\System\ODXdsfp.exe
  C:\Windows\System\ODXdsfp.exe
  2⤵
  PID:2460
- C:\Windows\System\usjgkPt.exe
  C:\Windows\System\usjgkPt.exe
  2⤵
  PID:3036
- C:\Windows\System\CKwkknJ.exe
  C:\Windows\System\CKwkknJ.exe
  2⤵
  PID:2352
- C:\Windows\System\uRnrASy.exe
  C:\Windows\System\uRnrASy.exe
  2⤵
  PID:3020
- C:\Windows\System\jIUuNLw.exe
  C:\Windows\System\jIUuNLw.exe
  2⤵
  PID:1612
- C:\Windows\System\nJfbAqY.exe
  C:\Windows\System\nJfbAqY.exe
  2⤵
  PID:1756
- C:\Windows\System\EumhhON.exe
  C:\Windows\System\EumhhON.exe
  2⤵
  PID:2728
- C:\Windows\System\RNUwUfj.exe
  C:\Windows\System\RNUwUfj.exe
  2⤵
  PID:1312
- C:\Windows\System\OXsKbuC.exe
  C:\Windows\System\OXsKbuC.exe
  2⤵
  PID:2292
- C:\Windows\System\cffvXkS.exe
  C:\Windows\System\cffvXkS.exe
  2⤵
  PID:1248
- C:\Windows\System\udtGgBX.exe
  C:\Windows\System\udtGgBX.exe
  2⤵
  PID:348
- C:\Windows\System\hSVFJTo.exe
  C:\Windows\System\hSVFJTo.exe
  2⤵
  PID:1956
- C:\Windows\System\RorOtxT.exe
  C:\Windows\System\RorOtxT.exe
  2⤵
  PID:3028
- C:\Windows\System\pAgdtdx.exe
  C:\Windows\System\pAgdtdx.exe
  2⤵
  PID:2868
- C:\Windows\System\qsmaaFF.exe
  C:\Windows\System\qsmaaFF.exe
  2⤵
  PID:2808
- C:\Windows\System\llWgxxE.exe
  C:\Windows\System\llWgxxE.exe
  2⤵
  PID:2612
- C:\Windows\System\IQYPDxZ.exe
  C:\Windows\System\IQYPDxZ.exe
  2⤵
  PID:1684
- C:\Windows\System\SBUfkxH.exe
  C:\Windows\System\SBUfkxH.exe
  2⤵
  PID:2264
- C:\Windows\System\JgNtZIh.exe
  C:\Windows\System\JgNtZIh.exe
  2⤵
  PID:1576
- C:\Windows\System\QXdjeMM.exe
  C:\Windows\System\QXdjeMM.exe
  2⤵
  PID:2980
- C:\Windows\System\FFmDciN.exe
  C:\Windows\System\FFmDciN.exe
  2⤵
  PID:984
- C:\Windows\System\uMosjKT.exe
  C:\Windows\System\uMosjKT.exe
  2⤵
  PID:1320
- C:\Windows\System\ItAyncy.exe
  C:\Windows\System\ItAyncy.exe
  2⤵
  PID:2960
- C:\Windows\System\HmfccDa.exe
  C:\Windows\System\HmfccDa.exe
  2⤵
  PID:2644
- C:\Windows\System\CKYiCnc.exe
  C:\Windows\System\CKYiCnc.exe
  2⤵
  PID:1764
- C:\Windows\System\VamgRZZ.exe
  C:\Windows\System\VamgRZZ.exe
  2⤵
  PID:268
- C:\Windows\System\QmjUzWu.exe
  C:\Windows\System\QmjUzWu.exe
  2⤵
  PID:1840
- C:\Windows\System\NMmrRcE.exe
  C:\Windows\System\NMmrRcE.exe
  2⤵
  PID:1704
- C:\Windows\System\EEUXGEI.exe
  C:\Windows\System\EEUXGEI.exe
  2⤵
  PID:1632
- C:\Windows\System\wutRbeb.exe
  C:\Windows\System\wutRbeb.exe
  2⤵
  PID:2796
- C:\Windows\System\MAKawtn.exe
  C:\Windows\System\MAKawtn.exe
  2⤵
  PID:2676
- C:\Windows\System\vXWvgiV.exe
  C:\Windows\System\vXWvgiV.exe
  2⤵
  PID:2664
- C:\Windows\System\NtzjOFr.exe
  C:\Windows\System\NtzjOFr.exe
  2⤵
  PID:2720
- C:\Windows\System\adThJHb.exe
  C:\Windows\System\adThJHb.exe
  2⤵
  PID:2920
- C:\Windows\System\mcSCCvS.exe
  C:\Windows\System\mcSCCvS.exe
  2⤵
  PID:2756
- C:\Windows\System\vaxbONi.exe
  C:\Windows\System\vaxbONi.exe
  2⤵
  PID:1600
- C:\Windows\System\sRyqEoz.exe
  C:\Windows\System\sRyqEoz.exe
  2⤵
  PID:2716
- C:\Windows\System\tHggfgh.exe
  C:\Windows\System\tHggfgh.exe
  2⤵
  PID:1508
- C:\Windows\System\eRhTBhn.exe
  C:\Windows\System\eRhTBhn.exe
  2⤵
  PID:2940
- C:\Windows\System\csBGXQz.exe
  C:\Windows\System\csBGXQz.exe
  2⤵
  PID:2752
- C:\Windows\System\uhzGufE.exe
  C:\Windows\System\uhzGufE.exe
  2⤵
  PID:2876
- C:\Windows\System\dEQVsvD.exe
  C:\Windows\System\dEQVsvD.exe
  2⤵
  PID:2724
- C:\Windows\System\YFVTsCG.exe
  C:\Windows\System\YFVTsCG.exe
  2⤵
  PID:1816
- C:\Windows\System\PEcoNdu.exe
  C:\Windows\System\PEcoNdu.exe
  2⤵
  PID:2204
- C:\Windows\System\PwWZDHf.exe
  C:\Windows\System\PwWZDHf.exe
  2⤵
  PID:888
- C:\Windows\System\fQLDWCD.exe
  C:\Windows\System\fQLDWCD.exe
  2⤵
  PID:2224
- C:\Windows\System\URGsuGx.exe
  C:\Windows\System\URGsuGx.exe
  2⤵
  PID:2032
- C:\Windows\System\HcAAlcQ.exe
  C:\Windows\System\HcAAlcQ.exe
  2⤵
  PID:2428
- C:\Windows\System\MhunyNH.exe
  C:\Windows\System\MhunyNH.exe
  2⤵
  PID:1504
- C:\Windows\System\uzPRlsk.exe
  C:\Windows\System\uzPRlsk.exe
  2⤵
  PID:2344
- C:\Windows\System\uwesCiI.exe
  C:\Windows\System\uwesCiI.exe
  2⤵
  PID:2384
- C:\Windows\System\PLBWyUo.exe
  C:\Windows\System\PLBWyUo.exe
  2⤵
  PID:2860
- C:\Windows\System\vTszlES.exe
  C:\Windows\System\vTszlES.exe
  2⤵
  PID:2748
- C:\Windows\System\ubFmMEp.exe
  C:\Windows\System\ubFmMEp.exe
  2⤵
  PID:2528
- C:\Windows\System\bmUItxY.exe
  C:\Windows\System\bmUItxY.exe
  2⤵
  PID:2732
- C:\Windows\System\whIIqbw.exe
  C:\Windows\System\whIIqbw.exe
  2⤵
  PID:2604
- C:\Windows\System\uDvLxns.exe
  C:\Windows\System\uDvLxns.exe
  2⤵
  PID:2052
- C:\Windows\System\DbwTwTt.exe
  C:\Windows\System\DbwTwTt.exe
  2⤵
  PID:3068
- C:\Windows\System\qhAeWpD.exe
  C:\Windows\System\qhAeWpD.exe
  2⤵
  PID:2500
- C:\Windows\System\OjeQTGn.exe
  C:\Windows\System\OjeQTGn.exe
  2⤵
  PID:608
- C:\Windows\System\ZEDVrGH.exe
  C:\Windows\System\ZEDVrGH.exe
  2⤵
  PID:2308
- C:\Windows\System\ocohLFv.exe
  C:\Windows\System\ocohLFv.exe
  2⤵
  PID:2376
- C:\Windows\System\bpnoyyn.exe
  C:\Windows\System\bpnoyyn.exe
  2⤵
  PID:2448
- C:\Windows\System\hZqqVjJ.exe
  C:\Windows\System\hZqqVjJ.exe
  2⤵
  PID:2220
- C:\Windows\System\LjbkkVR.exe
  C:\Windows\System\LjbkkVR.exe
  2⤵
  PID:1952
- C:\Windows\System\FvhvdoE.exe
  C:\Windows\System\FvhvdoE.exe
  2⤵
  PID:2524
- C:\Windows\System\MJliUqZ.exe
  C:\Windows\System\MJliUqZ.exe
  2⤵
  PID:1876
- C:\Windows\System\oBgqRDb.exe
  C:\Windows\System\oBgqRDb.exe
  2⤵
  PID:3024
- C:\Windows\System\GBAHZvI.exe
  C:\Windows\System\GBAHZvI.exe
  2⤵
  PID:2192
- C:\Windows\System\uSsJdCh.exe
  C:\Windows\System\uSsJdCh.exe
  2⤵
  PID:1044
- C:\Windows\System\KImDMjH.exe
  C:\Windows\System\KImDMjH.exe
  2⤵
  PID:3076
- C:\Windows\System\nWONAOe.exe
  C:\Windows\System\nWONAOe.exe
  2⤵
  PID:3104
- C:\Windows\System\XnuUXPm.exe
  C:\Windows\System\XnuUXPm.exe
  2⤵
  PID:3120
- C:\Windows\System\jgizsmN.exe
  C:\Windows\System\jgizsmN.exe
  2⤵
  PID:3136
- C:\Windows\System\IRCGmJa.exe
  C:\Windows\System\IRCGmJa.exe
  2⤵
  PID:3152
- C:\Windows\System\gkbsnQp.exe
  C:\Windows\System\gkbsnQp.exe
  2⤵
  PID:3168
- C:\Windows\System\zRWflRF.exe
  C:\Windows\System\zRWflRF.exe
  2⤵
  PID:3184
- C:\Windows\System\AoBgPWo.exe
  C:\Windows\System\AoBgPWo.exe
  2⤵
  PID:3212
- C:\Windows\System\olXeOkk.exe
  C:\Windows\System\olXeOkk.exe
  2⤵
  PID:3228
- C:\Windows\System\CqaGctJ.exe
  C:\Windows\System\CqaGctJ.exe
  2⤵
  PID:3244
- C:\Windows\System\eJsufiu.exe
  C:\Windows\System\eJsufiu.exe
  2⤵
  PID:3260
- C:\Windows\System\XCPDTWB.exe
  C:\Windows\System\XCPDTWB.exe
  2⤵
  PID:3280
- C:\Windows\System\DSWVjpy.exe
  C:\Windows\System\DSWVjpy.exe
  2⤵
  PID:3296
- C:\Windows\System\FqDrmFr.exe
  C:\Windows\System\FqDrmFr.exe
  2⤵
  PID:3312
- C:\Windows\System\piYzCuH.exe
  C:\Windows\System\piYzCuH.exe
  2⤵
  PID:3352
- C:\Windows\System\bSaKnct.exe
  C:\Windows\System\bSaKnct.exe
  2⤵
  PID:3384
- C:\Windows\System\cNolZKW.exe
  C:\Windows\System\cNolZKW.exe
  2⤵
  PID:3416
- C:\Windows\System\PgyzyJv.exe
  C:\Windows\System\PgyzyJv.exe
  2⤵
  PID:3436
- C:\Windows\System\BwzlMcP.exe
  C:\Windows\System\BwzlMcP.exe
  2⤵
  PID:3456
- C:\Windows\System\AstoHnR.exe
  C:\Windows\System\AstoHnR.exe
  2⤵
  PID:3472
- C:\Windows\System\DxIdlDE.exe
  C:\Windows\System\DxIdlDE.exe
  2⤵
  PID:3488
- C:\Windows\System\LlSgSqE.exe
  C:\Windows\System\LlSgSqE.exe
  2⤵
  PID:3504
- C:\Windows\System\WzCZOFB.exe
  C:\Windows\System\WzCZOFB.exe
  2⤵
  PID:3520
- C:\Windows\System\FlTGYRD.exe
  C:\Windows\System\FlTGYRD.exe
  2⤵
  PID:3540
- C:\Windows\System\ayzGhpi.exe
  C:\Windows\System\ayzGhpi.exe
  2⤵
  PID:3564
- C:\Windows\System\aOVgqkg.exe
  C:\Windows\System\aOVgqkg.exe
  2⤵
  PID:3580
- C:\Windows\System\qGSEiIb.exe
  C:\Windows\System\qGSEiIb.exe
  2⤵
  PID:3616
- C:\Windows\System\HfBfNDQ.exe
  C:\Windows\System\HfBfNDQ.exe
  2⤵
  PID:3632
- C:\Windows\System\Agyiwxu.exe
  C:\Windows\System\Agyiwxu.exe
  2⤵
  PID:3648
- C:\Windows\System\HeqpKsx.exe
  C:\Windows\System\HeqpKsx.exe
  2⤵
  PID:3664
- C:\Windows\System\FZaCUFC.exe
  C:\Windows\System\FZaCUFC.exe
  2⤵
  PID:3680
- C:\Windows\System\uXyXIgQ.exe
  C:\Windows\System\uXyXIgQ.exe
  2⤵
  PID:3696
- C:\Windows\System\ZSsIbaa.exe
  C:\Windows\System\ZSsIbaa.exe
  2⤵
  PID:3712
- C:\Windows\System\vHPFteH.exe
  C:\Windows\System\vHPFteH.exe
  2⤵
  PID:3732
- C:\Windows\System\JnZLxaC.exe
  C:\Windows\System\JnZLxaC.exe
  2⤵
  PID:3748
- C:\Windows\System\jexviTN.exe
  C:\Windows\System\jexviTN.exe
  2⤵
  PID:3768
- C:\Windows\System\JJMrlqb.exe
  C:\Windows\System\JJMrlqb.exe
  2⤵
  PID:3784
- C:\Windows\System\SSAwfLi.exe
  C:\Windows\System\SSAwfLi.exe
  2⤵
  PID:3800
- C:\Windows\System\iLhpZGJ.exe
  C:\Windows\System\iLhpZGJ.exe
  2⤵
  PID:3816
- C:\Windows\System\bUXgDBa.exe
  C:\Windows\System\bUXgDBa.exe
  2⤵
  PID:3832
- C:\Windows\System\tMOlrrT.exe
  C:\Windows\System\tMOlrrT.exe
  2⤵
  PID:3848
- C:\Windows\System\jpazUMS.exe
  C:\Windows\System\jpazUMS.exe
  2⤵
  PID:3864
- C:\Windows\System\iYAzjMv.exe
  C:\Windows\System\iYAzjMv.exe
  2⤵
  PID:3880
- C:\Windows\System\hHrgPFa.exe
  C:\Windows\System\hHrgPFa.exe
  2⤵
  PID:3900
- C:\Windows\System\RouieaR.exe
  C:\Windows\System\RouieaR.exe
  2⤵
  PID:3916
- C:\Windows\System\ioDVVtB.exe
  C:\Windows\System\ioDVVtB.exe
  2⤵
  PID:3932
- C:\Windows\System\jIKKcgf.exe
  C:\Windows\System\jIKKcgf.exe
  2⤵
  PID:3948
- C:\Windows\System\GIIAVfu.exe
  C:\Windows\System\GIIAVfu.exe
  2⤵
  PID:3964
- C:\Windows\System\BVgRqON.exe
  C:\Windows\System\BVgRqON.exe
  2⤵
  PID:3988
- C:\Windows\System\cfeFqjd.exe
  C:\Windows\System\cfeFqjd.exe
  2⤵
  PID:4012
- C:\Windows\System\zoeYiHg.exe
  C:\Windows\System\zoeYiHg.exe
  2⤵
  PID:4028
- C:\Windows\System\OKdcnqA.exe
  C:\Windows\System\OKdcnqA.exe
  2⤵
  PID:4072
- C:\Windows\System\bfWDkiF.exe
  C:\Windows\System\bfWDkiF.exe
  2⤵
  PID:4092
- C:\Windows\System\TkgiZSW.exe
  C:\Windows\System\TkgiZSW.exe
  2⤵
  PID:2768
- C:\Windows\System\TckNhBg.exe
  C:\Windows\System\TckNhBg.exe
  2⤵
  PID:2780
- C:\Windows\System\GdxUJnz.exe
  C:\Windows\System\GdxUJnz.exe
  2⤵
  PID:884
- C:\Windows\System\OoyZtPZ.exe
  C:\Windows\System\OoyZtPZ.exe
  2⤵
  PID:3148
- C:\Windows\System\DsmPXqN.exe
  C:\Windows\System\DsmPXqN.exe
  2⤵
  PID:3252
- C:\Windows\System\sJMaMiQ.exe
  C:\Windows\System\sJMaMiQ.exe
  2⤵
  PID:3268
- C:\Windows\System\YffcIkP.exe
  C:\Windows\System\YffcIkP.exe
  2⤵
  PID:304
- C:\Windows\System\jXkcDii.exe
  C:\Windows\System\jXkcDii.exe
  2⤵
  PID:3160
- C:\Windows\System\DLJHEyA.exe
  C:\Windows\System\DLJHEyA.exe
  2⤵
  PID:3088
- C:\Windows\System\iMmUElZ.exe
  C:\Windows\System\iMmUElZ.exe
  2⤵
  PID:3332
- C:\Windows\System\qOjpvam.exe
  C:\Windows\System\qOjpvam.exe
  2⤵
  PID:3348
- C:\Windows\System\LvxjWzA.exe
  C:\Windows\System\LvxjWzA.exe
  2⤵
  PID:3364
- C:\Windows\System\PnceYHv.exe
  C:\Windows\System\PnceYHv.exe
  2⤵
  PID:3380
- C:\Windows\System\AIQcsuB.exe
  C:\Windows\System\AIQcsuB.exe
  2⤵
  PID:3468
- C:\Windows\System\VCdmysS.exe
  C:\Windows\System\VCdmysS.exe
  2⤵
  PID:3532
- C:\Windows\System\ohuvatp.exe
  C:\Windows\System\ohuvatp.exe
  2⤵
  PID:3452
- C:\Windows\System\pTiFqDN.exe
  C:\Windows\System\pTiFqDN.exe
  2⤵
  PID:3596
- C:\Windows\System\vJsRUiU.exe
  C:\Windows\System\vJsRUiU.exe
  2⤵
  PID:3756
- C:\Windows\System\RKArxsj.exe
  C:\Windows\System\RKArxsj.exe
  2⤵
  PID:3484
- C:\Windows\System\BUxxXvp.exe
  C:\Windows\System\BUxxXvp.exe
  2⤵
  PID:3556
- C:\Windows\System\YIKFSBt.exe
  C:\Windows\System\YIKFSBt.exe
  2⤵
  PID:3608
- C:\Windows\System\QQVniPe.exe
  C:\Windows\System\QQVniPe.exe
  2⤵
  PID:3672
- C:\Windows\System\LkfBELh.exe
  C:\Windows\System\LkfBELh.exe
  2⤵
  PID:3740
- C:\Windows\System\oEKRZkU.exe
  C:\Windows\System\oEKRZkU.exe
  2⤵
  PID:3808
- C:\Windows\System\liplfuh.exe
  C:\Windows\System\liplfuh.exe
  2⤵
  PID:3872
- C:\Windows\System\gvEaBry.exe
  C:\Windows\System\gvEaBry.exe
  2⤵
  PID:3796
- C:\Windows\System\imHIcYk.exe
  C:\Windows\System\imHIcYk.exe
  2⤵
  PID:3860
- C:\Windows\System\bvxZsHh.exe
  C:\Windows\System\bvxZsHh.exe
  2⤵
  PID:3764
- C:\Windows\System\kogiAsJ.exe
  C:\Windows\System\kogiAsJ.exe
  2⤵
  PID:3924
- C:\Windows\System\gzvVsgb.exe
  C:\Windows\System\gzvVsgb.exe
  2⤵
  PID:3940
- C:\Windows\System\nMFqndn.exe
  C:\Windows\System\nMFqndn.exe
  2⤵
  PID:3980
- C:\Windows\System\HHDufBU.exe
  C:\Windows\System\HHDufBU.exe
  2⤵
  PID:4008
- C:\Windows\System\LTquosn.exe
  C:\Windows\System\LTquosn.exe
  2⤵
  PID:4048
- C:\Windows\System\phjPxuf.exe
  C:\Windows\System\phjPxuf.exe
  2⤵
  PID:1744
- C:\Windows\System\DnqfIyX.exe
  C:\Windows\System\DnqfIyX.exe
  2⤵
  PID:780
- C:\Windows\System\RygUEHA.exe
  C:\Windows\System\RygUEHA.exe
  2⤵
  PID:2228
- C:\Windows\System\TrKSzka.exe
  C:\Windows\System\TrKSzka.exe
  2⤵
  PID:4052
- C:\Windows\System\ioRuwid.exe
  C:\Windows\System\ioRuwid.exe
  2⤵
  PID:1532
- C:\Windows\System\PZkDLvQ.exe
  C:\Windows\System\PZkDLvQ.exe
  2⤵
  PID:3344
- C:\Windows\System\UwkGybL.exe
  C:\Windows\System\UwkGybL.exe
  2⤵
  PID:3272
- C:\Windows\System\jubRETj.exe
  C:\Windows\System\jubRETj.exe
  2⤵
  PID:4084
- C:\Windows\System\MUWLXXp.exe
  C:\Windows\System\MUWLXXp.exe
  2⤵
  PID:2540
- C:\Windows\System\ZeKqldD.exe
  C:\Windows\System\ZeKqldD.exe
  2⤵
  PID:3144
- C:\Windows\System\lEAXDxl.exe
  C:\Windows\System\lEAXDxl.exe
  2⤵
  PID:3208
- C:\Windows\System\chwIfBz.exe
  C:\Windows\System\chwIfBz.exe
  2⤵
  PID:3292
- C:\Windows\System\YzYWBBi.exe
  C:\Windows\System\YzYWBBi.exe
  2⤵
  PID:3308
- C:\Windows\System\NtziVqp.exe
  C:\Windows\System\NtziVqp.exe
  2⤵
  PID:3412
- C:\Windows\System\IYpsOLc.exe
  C:\Windows\System\IYpsOLc.exe
  2⤵
  PID:3660
- C:\Windows\System\rBBGvAB.exe
  C:\Windows\System\rBBGvAB.exe
  2⤵
  PID:3592
- C:\Windows\System\XEaJKBs.exe
  C:\Windows\System\XEaJKBs.exe
  2⤵
  PID:3844
- C:\Windows\System\FoKpHiO.exe
  C:\Windows\System\FoKpHiO.exe
  2⤵
  PID:3692
- C:\Windows\System\jnilGYQ.exe
  C:\Windows\System\jnilGYQ.exe
  2⤵
  PID:2516
- C:\Windows\System\cGWFfZt.exe
  C:\Windows\System\cGWFfZt.exe
  2⤵
  PID:3724
- C:\Windows\System\XXHNWSi.exe
  C:\Windows\System\XXHNWSi.exe
  2⤵
  PID:3776
- C:\Windows\System\XLTZPVj.exe
  C:\Windows\System\XLTZPVj.exe
  2⤵
  PID:3164
- C:\Windows\System\XTBkdzb.exe
  C:\Windows\System\XTBkdzb.exe
  2⤵
  PID:3780
- C:\Windows\System\zLqiZYQ.exe
  C:\Windows\System\zLqiZYQ.exe
  2⤵
  PID:3896
- C:\Windows\System\QwEmedU.exe
  C:\Windows\System\QwEmedU.exe
  2⤵
  PID:2404
- C:\Windows\System\vESyNsg.exe
  C:\Windows\System\vESyNsg.exe
  2⤵
  PID:3392
- C:\Windows\System\etOBobW.exe
  C:\Windows\System\etOBobW.exe
  2⤵
  PID:3204
- C:\Windows\System\upnqVRb.exe
  C:\Windows\System\upnqVRb.exe
  2⤵
  PID:3840
- C:\Windows\System\UOCINTC.exe
  C:\Windows\System\UOCINTC.exe
  2⤵
  PID:3340
- C:\Windows\System\ZSzfrqZ.exe
  C:\Windows\System\ZSzfrqZ.exe
  2⤵
  PID:3604
- C:\Windows\System\rhPZOpu.exe
  C:\Windows\System\rhPZOpu.exe
  2⤵
  PID:3084
- C:\Windows\System\kCjOwpn.exe
  C:\Windows\System\kCjOwpn.exe
  2⤵
  PID:3516
- C:\Windows\System\LUcFyEa.exe
  C:\Windows\System\LUcFyEa.exe
  2⤵
  PID:3644
- C:\Windows\System\YFETnuA.exe
  C:\Windows\System\YFETnuA.exe
  2⤵
  PID:1472
- C:\Windows\System\wBGNQzG.exe
  C:\Windows\System\wBGNQzG.exe
  2⤵
  PID:4024
- C:\Windows\System\jVYtQXn.exe
  C:\Windows\System\jVYtQXn.exe
  2⤵
  PID:3708
- C:\Windows\System\AAJZfGm.exe
  C:\Windows\System\AAJZfGm.exe
  2⤵
  PID:3548
- C:\Windows\System\uQKLpIv.exe
  C:\Windows\System\uQKLpIv.exe
  2⤵
  PID:3092
- C:\Windows\System\ABiKfUX.exe
  C:\Windows\System\ABiKfUX.exe
  2⤵
  PID:4068
- C:\Windows\System\FCKztpe.exe
  C:\Windows\System\FCKztpe.exe
  2⤵
  PID:3856
- C:\Windows\System\nvzsfHO.exe
  C:\Windows\System\nvzsfHO.exe
  2⤵
  PID:3424
- C:\Windows\System\UQVUIcg.exe
  C:\Windows\System\UQVUIcg.exe
  2⤵
  PID:3640
- C:\Windows\System\cIKRcSs.exe
  C:\Windows\System\cIKRcSs.exe
  2⤵
  PID:4104
- C:\Windows\System\RWfrXVw.exe
  C:\Windows\System\RWfrXVw.exe
  2⤵
  PID:4120
- C:\Windows\System\JKbHXVz.exe
  C:\Windows\System\JKbHXVz.exe
  2⤵
  PID:4140
- C:\Windows\System\naFHqdu.exe
  C:\Windows\System\naFHqdu.exe
  2⤵
  PID:4156
- C:\Windows\System\qncvXfZ.exe
  C:\Windows\System\qncvXfZ.exe
  2⤵
  PID:4176
- C:\Windows\System\DLZYuyr.exe
  C:\Windows\System\DLZYuyr.exe
  2⤵
  PID:4208
- C:\Windows\System\NsBcnoD.exe
  C:\Windows\System\NsBcnoD.exe
  2⤵
  PID:4232
- C:\Windows\System\LYiqjYv.exe
  C:\Windows\System\LYiqjYv.exe
  2⤵
  PID:4248
- C:\Windows\System\yEzGatx.exe
  C:\Windows\System\yEzGatx.exe
  2⤵
  PID:4268
- C:\Windows\System\VIsUhTX.exe
  C:\Windows\System\VIsUhTX.exe
  2⤵
  PID:4288
- C:\Windows\System\tcyDSzt.exe
  C:\Windows\System\tcyDSzt.exe
  2⤵
  PID:4304
- C:\Windows\System\YIvxTLr.exe
  C:\Windows\System\YIvxTLr.exe
  2⤵
  PID:4328
- C:\Windows\System\GdJNiMO.exe
  C:\Windows\System\GdJNiMO.exe
  2⤵
  PID:4344
- C:\Windows\System\xXEhCpF.exe
  C:\Windows\System\xXEhCpF.exe
  2⤵
  PID:4364
- C:\Windows\System\cbquCJK.exe
  C:\Windows\System\cbquCJK.exe
  2⤵
  PID:4384
- C:\Windows\System\qeKyEVw.exe
  C:\Windows\System\qeKyEVw.exe
  2⤵
  PID:4400
- C:\Windows\System\KpestvH.exe
  C:\Windows\System\KpestvH.exe
  2⤵
  PID:4416
- C:\Windows\System\XLkZaEr.exe
  C:\Windows\System\XLkZaEr.exe
  2⤵
  PID:4432
- C:\Windows\System\TwXsxEP.exe
  C:\Windows\System\TwXsxEP.exe
  2⤵
  PID:4448
- C:\Windows\System\mZFnUZf.exe
  C:\Windows\System\mZFnUZf.exe
  2⤵
  PID:4492
- C:\Windows\System\RsRnJkY.exe
  C:\Windows\System\RsRnJkY.exe
  2⤵
  PID:4512
- C:\Windows\System\weTzYsc.exe
  C:\Windows\System\weTzYsc.exe
  2⤵
  PID:4528
- C:\Windows\System\qxCpIMO.exe
  C:\Windows\System\qxCpIMO.exe
  2⤵
  PID:4544
- C:\Windows\System\apdovLB.exe
  C:\Windows\System\apdovLB.exe
  2⤵
  PID:4560
- C:\Windows\System\nbbAxFZ.exe
  C:\Windows\System\nbbAxFZ.exe
  2⤵
  PID:4576
- C:\Windows\System\SYloVNq.exe
  C:\Windows\System\SYloVNq.exe
  2⤵
  PID:4592
- C:\Windows\System\SfwTDgG.exe
  C:\Windows\System\SfwTDgG.exe
  2⤵
  PID:4608
- C:\Windows\System\URvhKCi.exe
  C:\Windows\System\URvhKCi.exe
  2⤵
  PID:4624
- C:\Windows\System\KfpOPPZ.exe
  C:\Windows\System\KfpOPPZ.exe
  2⤵
  PID:4640
- C:\Windows\System\zHiEfaL.exe
  C:\Windows\System\zHiEfaL.exe
  2⤵
  PID:4664
- C:\Windows\System\AeEISCV.exe
  C:\Windows\System\AeEISCV.exe
  2⤵
  PID:4684
- C:\Windows\System\qVJFiHr.exe
  C:\Windows\System\qVJFiHr.exe
  2⤵
  PID:4704
- C:\Windows\System\zXFNZAi.exe
  C:\Windows\System\zXFNZAi.exe
  2⤵
  PID:4728
- C:\Windows\System\umHvJmN.exe
  C:\Windows\System\umHvJmN.exe
  2⤵
  PID:4768
- C:\Windows\System\aDnTDAd.exe
  C:\Windows\System\aDnTDAd.exe
  2⤵
  PID:4792
- C:\Windows\System\WddMBAU.exe
  C:\Windows\System\WddMBAU.exe
  2⤵
  PID:4808
- C:\Windows\System\pyNECSH.exe
  C:\Windows\System\pyNECSH.exe
  2⤵
  PID:4828
- C:\Windows\System\NyubMIv.exe
  C:\Windows\System\NyubMIv.exe
  2⤵
  PID:4848
- C:\Windows\System\JxBZTSI.exe
  C:\Windows\System\JxBZTSI.exe
  2⤵
  PID:4868
- C:\Windows\System\AfPeqge.exe
  C:\Windows\System\AfPeqge.exe
  2⤵
  PID:4888
- C:\Windows\System\YjuDCDb.exe
  C:\Windows\System\YjuDCDb.exe
  2⤵
  PID:4904
- C:\Windows\System\PSuAZrl.exe
  C:\Windows\System\PSuAZrl.exe
  2⤵
  PID:4948
- C:\Windows\System\UgzNrkQ.exe
  C:\Windows\System\UgzNrkQ.exe
  2⤵
  PID:4964
- C:\Windows\System\RRrQNlP.exe
  C:\Windows\System\RRrQNlP.exe
  2⤵
  PID:4980
- C:\Windows\System\eiDOwtx.exe
  C:\Windows\System\eiDOwtx.exe
  2⤵
  PID:4996
- C:\Windows\System\JvxpTPy.exe
  C:\Windows\System\JvxpTPy.exe
  2⤵
  PID:5012
- C:\Windows\System\XzTaTIq.exe
  C:\Windows\System\XzTaTIq.exe
  2⤵
  PID:5032
- C:\Windows\System\ywTckNq.exe
  C:\Windows\System\ywTckNq.exe
  2⤵
  PID:5048
- C:\Windows\System\zLvLkSo.exe
  C:\Windows\System\zLvLkSo.exe
  2⤵
  PID:5064
- C:\Windows\System\aafTxjt.exe
  C:\Windows\System\aafTxjt.exe
  2⤵
  PID:5100
- C:\Windows\System\EZrGpqr.exe
  C:\Windows\System\EZrGpqr.exe
  2⤵
  PID:5116
- C:\Windows\System\LQNlJIh.exe
  C:\Windows\System\LQNlJIh.exe
  2⤵
  PID:3576
- C:\Windows\System\oZKOnQx.exe
  C:\Windows\System\oZKOnQx.exe
  2⤵
  PID:4080
- C:\Windows\System\oOrkNHo.exe
  C:\Windows\System\oOrkNHo.exe
  2⤵
  PID:4112
- C:\Windows\System\tCfhrZl.exe
  C:\Windows\System\tCfhrZl.exe
  2⤵
  PID:4128
- C:\Windows\System\VnGyAuF.exe
  C:\Windows\System\VnGyAuF.exe
  2⤵
  PID:4172
- C:\Windows\System\uKnmSym.exe
  C:\Windows\System\uKnmSym.exe
  2⤵
  PID:4200
- C:\Windows\System\YCZPRwx.exe
  C:\Windows\System\YCZPRwx.exe
  2⤵
  PID:4196
- C:\Windows\System\UnDfbtu.exe
  C:\Windows\System\UnDfbtu.exe
  2⤵
  PID:4336
- C:\Windows\System\sSGRfiT.exe
  C:\Windows\System\sSGRfiT.exe
  2⤵
  PID:4424
- C:\Windows\System\ORmgCGc.exe
  C:\Windows\System\ORmgCGc.exe
  2⤵
  PID:4352
- C:\Windows\System\KGRkrCU.exe
  C:\Windows\System\KGRkrCU.exe
  2⤵
  PID:4256
- C:\Windows\System\qBGVaHw.exe
  C:\Windows\System\qBGVaHw.exe
  2⤵
  PID:4340
- C:\Windows\System\nGtzMLG.exe
  C:\Windows\System\nGtzMLG.exe
  2⤵
  PID:4444
- C:\Windows\System\pVrKFoz.exe
  C:\Windows\System\pVrKFoz.exe
  2⤵
  PID:4464
- C:\Windows\System\IZSYrEu.exe
  C:\Windows\System\IZSYrEu.exe
  2⤵
  PID:4476
- C:\Windows\System\RmrbQGY.exe
  C:\Windows\System\RmrbQGY.exe
  2⤵
  PID:4556
- C:\Windows\System\MvieTBJ.exe
  C:\Windows\System\MvieTBJ.exe
  2⤵
  PID:4568
- C:\Windows\System\pEBfPmG.exe
  C:\Windows\System\pEBfPmG.exe
  2⤵
  PID:4508
- C:\Windows\System\gTIyZsA.exe
  C:\Windows\System\gTIyZsA.exe
  2⤵
  PID:4604
- C:\Windows\System\oOAyubb.exe
  C:\Windows\System\oOAyubb.exe
  2⤵
  PID:4716
- C:\Windows\System\LUuxwcs.exe
  C:\Windows\System\LUuxwcs.exe
  2⤵
  PID:4652
- C:\Windows\System\nlitnmP.exe
  C:\Windows\System\nlitnmP.exe
  2⤵
  PID:4720
- C:\Windows\System\anMKnCt.exe
  C:\Windows\System\anMKnCt.exe
  2⤵
  PID:4740
- C:\Windows\System\aJRAjeW.exe
  C:\Windows\System\aJRAjeW.exe
  2⤵
  PID:4756
- C:\Windows\System\gUIHEKM.exe
  C:\Windows\System\gUIHEKM.exe
  2⤵
  PID:4804
- C:\Windows\System\GtKRPcR.exe
  C:\Windows\System\GtKRPcR.exe
  2⤵
  PID:4880
- C:\Windows\System\YSQizvA.exe
  C:\Windows\System\YSQizvA.exe
  2⤵
  PID:4816
- C:\Windows\System\ZdHSsgq.exe
  C:\Windows\System\ZdHSsgq.exe
  2⤵
  PID:4940
- C:\Windows\System\sNMlbTR.exe
  C:\Windows\System\sNMlbTR.exe
  2⤵
  PID:4856
- C:\Windows\System\URxhMmn.exe
  C:\Windows\System\URxhMmn.exe
  2⤵
  PID:4788
- C:\Windows\System\YmwsTui.exe
  C:\Windows\System\YmwsTui.exe
  2⤵
  PID:5004
- C:\Windows\System\htQRImx.exe
  C:\Windows\System\htQRImx.exe
  2⤵
  PID:5040
- C:\Windows\System\QTxdHZi.exe
  C:\Windows\System\QTxdHZi.exe
  2⤵
  PID:5024
- C:\Windows\System\dsGdeVl.exe
  C:\Windows\System\dsGdeVl.exe
  2⤵
  PID:5072
- C:\Windows\System\gCdiSYH.exe
  C:\Windows\System\gCdiSYH.exe
  2⤵
  PID:5096
- C:\Windows\System\kNTvLYp.exe
  C:\Windows\System\kNTvLYp.exe
  2⤵
  PID:3572
- C:\Windows\System\EhWpzGO.exe
  C:\Windows\System\EhWpzGO.exe
  2⤵
  PID:4132
- C:\Windows\System\pRKCviM.exe
  C:\Windows\System\pRKCviM.exe
  2⤵
  PID:4280
- C:\Windows\System\uksWVvm.exe
  C:\Windows\System\uksWVvm.exe
  2⤵
  PID:4168
- C:\Windows\System\mUNWMQO.exe
  C:\Windows\System\mUNWMQO.exe
  2⤵
  PID:4228
- C:\Windows\System\MibKbQH.exe
  C:\Windows\System\MibKbQH.exe
  2⤵
  PID:5112
- C:\Windows\System\NctykZT.exe
  C:\Windows\System\NctykZT.exe
  2⤵
  PID:4536
- C:\Windows\System\iOYkNvi.exe
  C:\Windows\System\iOYkNvi.exe
  2⤵
  PID:4184
- C:\Windows\System\GABtoSJ.exe
  C:\Windows\System\GABtoSJ.exe
  2⤵
  PID:4764
- C:\Windows\System\YWvJWWE.exe
  C:\Windows\System\YWvJWWE.exe
  2⤵
  PID:4920
- C:\Windows\System\GfXQYSa.exe
  C:\Windows\System\GfXQYSa.exe
  2⤵
  PID:4972
- C:\Windows\System\SSVGeDz.exe
  C:\Windows\System\SSVGeDz.exe
  2⤵
  PID:4924
- C:\Windows\System\YFrimtz.exe
  C:\Windows\System\YFrimtz.exe
  2⤵
  PID:4960
- C:\Windows\System\fWgsoKS.exe
  C:\Windows\System\fWgsoKS.exe
  2⤵
  PID:5184
- C:\Windows\System\vXPxCBG.exe
  C:\Windows\System\vXPxCBG.exe
  2⤵
  PID:5200
- C:\Windows\System\uzoZfYj.exe
  C:\Windows\System\uzoZfYj.exe
  2⤵
  PID:5216
- C:\Windows\System\RUwJUUg.exe
  C:\Windows\System\RUwJUUg.exe
  2⤵
  PID:5232
- C:\Windows\System\ZGfXJcr.exe
  C:\Windows\System\ZGfXJcr.exe
  2⤵
  PID:5248
- C:\Windows\System\REbvHdN.exe
  C:\Windows\System\REbvHdN.exe
  2⤵
  PID:5268
- C:\Windows\System\fgHzqfZ.exe
  C:\Windows\System\fgHzqfZ.exe
  2⤵
  PID:5284
- C:\Windows\System\BtjnGgV.exe
  C:\Windows\System\BtjnGgV.exe
  2⤵
  PID:5304
- C:\Windows\System\blwBkcS.exe
  C:\Windows\System\blwBkcS.exe
  2⤵
  PID:5320
- C:\Windows\System\yQgdDtt.exe
  C:\Windows\System\yQgdDtt.exe
  2⤵
  PID:5336
- C:\Windows\System\CMhKmVK.exe
  C:\Windows\System\CMhKmVK.exe
  2⤵
  PID:5356
- C:\Windows\System\PCuaZgx.exe
  C:\Windows\System\PCuaZgx.exe
  2⤵
  PID:5376
- C:\Windows\System\LyffIEB.exe
  C:\Windows\System\LyffIEB.exe
  2⤵
  PID:5392
- C:\Windows\System\vdmLeta.exe
  C:\Windows\System\vdmLeta.exe
  2⤵
  PID:5412
- C:\Windows\System\sGOAAXF.exe
  C:\Windows\System\sGOAAXF.exe
  2⤵
  PID:5428
- C:\Windows\System\kZMWfQe.exe
  C:\Windows\System\kZMWfQe.exe
  2⤵
  PID:5448
- C:\Windows\System\dSkMpBs.exe
  C:\Windows\System\dSkMpBs.exe
  2⤵
  PID:5464
- C:\Windows\System\WhAwMlM.exe
  C:\Windows\System\WhAwMlM.exe
  2⤵
  PID:5480
- C:\Windows\System\UnTUDcD.exe
  C:\Windows\System\UnTUDcD.exe
  2⤵
  PID:5496
- C:\Windows\System\EjkaHrg.exe
  C:\Windows\System\EjkaHrg.exe
  2⤵
  PID:5516
- C:\Windows\System\nyyVhkz.exe
  C:\Windows\System\nyyVhkz.exe
  2⤵
  PID:5536
- C:\Windows\System\EdkNdId.exe
  C:\Windows\System\EdkNdId.exe
  2⤵
  PID:5552
- C:\Windows\System\vJhtyPj.exe
  C:\Windows\System\vJhtyPj.exe
  2⤵
  PID:5572
- C:\Windows\System\rsRPxfh.exe
  C:\Windows\System\rsRPxfh.exe
  2⤵
  PID:5588
- C:\Windows\System\GRqheLx.exe
  C:\Windows\System\GRqheLx.exe
  2⤵
  PID:5608
- C:\Windows\System\KpRLQiL.exe
  C:\Windows\System\KpRLQiL.exe
  2⤵
  PID:5624
- C:\Windows\System\TXEgbPM.exe
  C:\Windows\System\TXEgbPM.exe
  2⤵
  PID:5640
- C:\Windows\System\jWcbAIb.exe
  C:\Windows\System\jWcbAIb.exe
  2⤵
  PID:5728
- C:\Windows\System\ZkUekep.exe
  C:\Windows\System\ZkUekep.exe
  2⤵
  PID:5744
- C:\Windows\System\VEUgTqQ.exe
  C:\Windows\System\VEUgTqQ.exe
  2⤵
  PID:5760
- C:\Windows\System\xzrVtcs.exe
  C:\Windows\System\xzrVtcs.exe
  2⤵
  PID:5780
- C:\Windows\System\sSzpiTD.exe
  C:\Windows\System\sSzpiTD.exe
  2⤵
  PID:5796
- C:\Windows\System\lAzjiMG.exe
  C:\Windows\System\lAzjiMG.exe
  2⤵
  PID:5812
- C:\Windows\System\mFdAPCP.exe
  C:\Windows\System\mFdAPCP.exe
  2⤵
  PID:5836
- C:\Windows\System\VdBJsdM.exe
  C:\Windows\System\VdBJsdM.exe
  2⤵
  PID:5852
- C:\Windows\System\hDeQIbY.exe
  C:\Windows\System\hDeQIbY.exe
  2⤵
  PID:5868
- C:\Windows\System\hwZYNit.exe
  C:\Windows\System\hwZYNit.exe
  2⤵
  PID:5888
- C:\Windows\System\wLSmWCI.exe
  C:\Windows\System\wLSmWCI.exe
  2⤵
  PID:5908
- C:\Windows\System\qyjFUiz.exe
  C:\Windows\System\qyjFUiz.exe
  2⤵
  PID:5924
- C:\Windows\System\GQXbSzF.exe
  C:\Windows\System\GQXbSzF.exe
  2⤵
  PID:5940
- C:\Windows\System\HKxzetE.exe
  C:\Windows\System\HKxzetE.exe
  2⤵
  PID:5960
- C:\Windows\System\bRZlMKs.exe
  C:\Windows\System\bRZlMKs.exe
  2⤵
  PID:5976
- C:\Windows\System\bZcblRe.exe
  C:\Windows\System\bZcblRe.exe
  2⤵
  PID:5996
- C:\Windows\System\QbzCtYz.exe
  C:\Windows\System\QbzCtYz.exe
  2⤵
  PID:6012
- C:\Windows\System\HjpDiGK.exe
  C:\Windows\System\HjpDiGK.exe
  2⤵
  PID:6032
- C:\Windows\System\zubEBAx.exe
  C:\Windows\System\zubEBAx.exe
  2⤵
  PID:6052
- C:\Windows\System\GHRjLgx.exe
  C:\Windows\System\GHRjLgx.exe
  2⤵
  PID:6068
- C:\Windows\System\SQOsNgS.exe
  C:\Windows\System\SQOsNgS.exe
  2⤵
  PID:6084
- C:\Windows\System\WSLCwMo.exe
  C:\Windows\System\WSLCwMo.exe
  2⤵
  PID:6104
- C:\Windows\System\bUxTqKm.exe
  C:\Windows\System\bUxTqKm.exe
  2⤵
  PID:6120
- C:\Windows\System\Akkvlfy.exe
  C:\Windows\System\Akkvlfy.exe
  2⤵
  PID:6140
- C:\Windows\System\RUQRhUU.exe
  C:\Windows\System\RUQRhUU.exe
  2⤵
  PID:4780
- C:\Windows\System\XtOWZCN.exe
  C:\Windows\System\XtOWZCN.exe
  2⤵
  PID:4836
- C:\Windows\System\yZiTXam.exe
  C:\Windows\System\yZiTXam.exe
  2⤵
  PID:4320
- C:\Windows\System\QcUkmPf.exe
  C:\Windows\System\QcUkmPf.exe
  2⤵
  PID:4440
- C:\Windows\System\RhdDycs.exe
  C:\Windows\System\RhdDycs.exe
  2⤵
  PID:5124
- C:\Windows\System\DsIVtdO.exe
  C:\Windows\System\DsIVtdO.exe
  2⤵
  PID:4520
- C:\Windows\System\axTekjp.exe
  C:\Windows\System\axTekjp.exe
  2⤵
  PID:5152
- C:\Windows\System\FqQrXzr.exe
  C:\Windows\System\FqQrXzr.exe
  2⤵
  PID:4672
- C:\Windows\System\CpAiacq.exe
  C:\Windows\System\CpAiacq.exe
  2⤵
  PID:5176
- C:\Windows\System\YPkYyDl.exe
  C:\Windows\System\YPkYyDl.exe
  2⤵
  PID:5240
- C:\Windows\System\wQpahrY.exe
  C:\Windows\System\wQpahrY.exe
  2⤵
  PID:5312
- C:\Windows\System\YeVFeqx.exe
  C:\Windows\System\YeVFeqx.exe
  2⤵
  PID:5384
- C:\Windows\System\agUkzpD.exe
  C:\Windows\System\agUkzpD.exe
  2⤵
  PID:5456
- C:\Windows\System\QJHjMDL.exe
  C:\Windows\System\QJHjMDL.exe
  2⤵
  PID:5524
- C:\Windows\System\TnkZuSB.exe
  C:\Windows\System\TnkZuSB.exe
  2⤵
  PID:5596
- C:\Windows\System\GyPCAiK.exe
  C:\Windows\System\GyPCAiK.exe
  2⤵
  PID:5632
- C:\Windows\System\HfJmUiZ.exe
  C:\Windows\System\HfJmUiZ.exe
  2⤵
  PID:4356
- C:\Windows\System\vDxsMAF.exe
  C:\Windows\System\vDxsMAF.exe
  2⤵
  PID:4488
- C:\Windows\System\dfFBjvK.exe
  C:\Windows\System\dfFBjvK.exe
  2⤵
  PID:4680
- C:\Windows\System\paMacHy.exe
  C:\Windows\System\paMacHy.exe
  2⤵
  PID:4876
- C:\Windows\System\FsYUCAr.exe
  C:\Windows\System\FsYUCAr.exe
  2⤵
  PID:5328
- C:\Windows\System\kRGgRVv.exe
  C:\Windows\System\kRGgRVv.exe
  2⤵
  PID:4988
- C:\Windows\System\ZMbjxlM.exe
  C:\Windows\System\ZMbjxlM.exe
  2⤵
  PID:3224
- C:\Windows\System\TOZRcWV.exe
  C:\Windows\System\TOZRcWV.exe
  2⤵
  PID:4224
- C:\Windows\System\ZHDWVEs.exe
  C:\Windows\System\ZHDWVEs.exe
  2⤵
  PID:4152
- C:\Windows\System\tfUhvLE.exe
  C:\Windows\System\tfUhvLE.exe
  2⤵
  PID:4700
- C:\Windows\System\XcZlNXC.exe
  C:\Windows\System\XcZlNXC.exe
  2⤵
  PID:4956
- C:\Windows\System\bhfiqUI.exe
  C:\Windows\System\bhfiqUI.exe
  2⤵
  PID:5720
- C:\Windows\System\DGScmJc.exe
  C:\Windows\System\DGScmJc.exe
  2⤵
  PID:5192
- C:\Windows\System\XmciaSN.exe
  C:\Windows\System\XmciaSN.exe
  2⤵
  PID:5296
- C:\Windows\System\qcxdNbH.exe
  C:\Windows\System\qcxdNbH.exe
  2⤵
  PID:5372
- C:\Windows\System\jtYeTcM.exe
  C:\Windows\System\jtYeTcM.exe
  2⤵
  PID:1240
- C:\Windows\System\NkbGEms.exe
  C:\Windows\System\NkbGEms.exe
  2⤵
  PID:5740
- C:\Windows\System\nDVkOOC.exe
  C:\Windows\System\nDVkOOC.exe
  2⤵
  PID:5776
- C:\Windows\System\pROneSO.exe
  C:\Windows\System\pROneSO.exe
  2⤵
  PID:5876
- C:\Windows\System\okzvWPS.exe
  C:\Windows\System\okzvWPS.exe
  2⤵
  PID:5848
- C:\Windows\System\fbVVgsz.exe
  C:\Windows\System\fbVVgsz.exe
  2⤵
  PID:5984
- C:\Windows\System\jKTygIm.exe
  C:\Windows\System\jKTygIm.exe
  2⤵
  PID:5952
- C:\Windows\System\YHLhjzC.exe
  C:\Windows\System\YHLhjzC.exe
  2⤵
  PID:6100
- C:\Windows\System\IazZtfr.exe
  C:\Windows\System\IazZtfr.exe
  2⤵
  PID:5132
- C:\Windows\System\mvRgyeq.exe
  C:\Windows\System\mvRgyeq.exe
  2⤵
  PID:4712
- C:\Windows\System\jcaaIjI.exe
  C:\Windows\System\jcaaIjI.exe
  2⤵
  PID:5348
- C:\Windows\System\xbfxeGf.exe
  C:\Windows\System\xbfxeGf.exe
  2⤵
  PID:4220
- C:\Windows\System\PoTrUZz.exe
  C:\Windows\System\PoTrUZz.exe
  2⤵
  PID:4752
- C:\Windows\System\kcAGmnh.exe
  C:\Windows\System\kcAGmnh.exe
  2⤵
  PID:5544
- C:\Windows\System\VrBWTGV.exe
  C:\Windows\System\VrBWTGV.exe
  2⤵
  PID:5292
- C:\Windows\System\hdndGXA.exe
  C:\Windows\System\hdndGXA.exe
  2⤵
  PID:5264
- C:\Windows\System\NZGbWhW.exe
  C:\Windows\System\NZGbWhW.exe
  2⤵
  PID:4276
- C:\Windows\System\XoizSFx.exe
  C:\Windows\System\XoizSFx.exe
  2⤵
  PID:5584
- C:\Windows\System\kbLTytD.exe
  C:\Windows\System\kbLTytD.exe
  2⤵
  PID:5472
- C:\Windows\System\AKCJGpQ.exe
  C:\Windows\System\AKCJGpQ.exe
  2⤵
  PID:5676
- C:\Windows\System\nblZdnv.exe
  C:\Windows\System\nblZdnv.exe
  2⤵
  PID:4860
- C:\Windows\System\ijrZDBP.exe
  C:\Windows\System\ijrZDBP.exe
  2⤵
  PID:5140
- C:\Windows\System\TRvVNKy.exe
  C:\Windows\System\TRvVNKy.exe
  2⤵
  PID:5560
- C:\Windows\System\WHsOQmt.exe
  C:\Windows\System\WHsOQmt.exe
  2⤵
  PID:5820
- C:\Windows\System\uSZxFaj.exe
  C:\Windows\System\uSZxFaj.exe
  2⤵
  PID:5056
- C:\Windows\System\pMGrSlc.exe
  C:\Windows\System\pMGrSlc.exe
  2⤵
  PID:5896
- C:\Windows\System\cAEKhXQ.exe
  C:\Windows\System\cAEKhXQ.exe
  2⤵
  PID:1740
- C:\Windows\System\cAjtLpL.exe
  C:\Windows\System\cAjtLpL.exe
  2⤵
  PID:5440
- C:\Windows\System\OoGvgPO.exe
  C:\Windows\System\OoGvgPO.exe
  2⤵
  PID:5828
- C:\Windows\System\njAJbtN.exe
  C:\Windows\System\njAJbtN.exe
  2⤵
  PID:5904
- C:\Windows\System\ziRpKWV.exe
  C:\Windows\System\ziRpKWV.exe
  2⤵
  PID:6048
- C:\Windows\System\uCDcjEU.exe
  C:\Windows\System\uCDcjEU.exe
  2⤵
  PID:6116
- C:\Windows\System\jCvTeAz.exe
  C:\Windows\System\jCvTeAz.exe
  2⤵
  PID:4784
- C:\Windows\System\uPnonyl.exe
  C:\Windows\System\uPnonyl.exe
  2⤵
  PID:4676
- C:\Windows\System\nDgYkwQ.exe
  C:\Windows\System\nDgYkwQ.exe
  2⤵
  PID:4148
- C:\Windows\System\TBielZu.exe
  C:\Windows\System\TBielZu.exe
  2⤵
  PID:5332
- C:\Windows\System\jCIyqnM.exe
  C:\Windows\System\jCIyqnM.exe
  2⤵
  PID:6020
- C:\Windows\System\cETazLp.exe
  C:\Windows\System\cETazLp.exe
  2⤵
  PID:5736
- C:\Windows\System\WLxdOVs.exe
  C:\Windows\System\WLxdOVs.exe
  2⤵
  PID:6028
- C:\Windows\System\AecrkGo.exe
  C:\Windows\System\AecrkGo.exe
  2⤵
  PID:5208
- C:\Windows\System\UbDrorL.exe
  C:\Windows\System\UbDrorL.exe
  2⤵
  PID:6092
- C:\Windows\System\PpXfwyg.exe
  C:\Windows\System\PpXfwyg.exe
  2⤵
  PID:4588
- C:\Windows\System\Wrugesv.exe
  C:\Windows\System\Wrugesv.exe
  2⤵
  PID:5408
- C:\Windows\System\amLNHrp.exe
  C:\Windows\System\amLNHrp.exe
  2⤵
  PID:5160
- C:\Windows\System\vkURGtB.exe
  C:\Windows\System\vkURGtB.exe
  2⤵
  PID:5604
- C:\Windows\System\nYVbuJu.exe
  C:\Windows\System\nYVbuJu.exe
  2⤵
  PID:5436
- C:\Windows\System\wQnjJGW.exe
  C:\Windows\System\wQnjJGW.exe
  2⤵
  PID:5548
- C:\Windows\System\oSvqBsx.exe
  C:\Windows\System\oSvqBsx.exe
  2⤵
  PID:4840
- C:\Windows\System\feSFaUY.exe
  C:\Windows\System\feSFaUY.exe
  2⤵
  PID:5696
- C:\Windows\System\CxZCYGH.exe
  C:\Windows\System\CxZCYGH.exe
  2⤵
  PID:5708
- C:\Windows\System\LYCJmVf.exe
  C:\Windows\System\LYCJmVf.exe
  2⤵
  PID:6076
- C:\Windows\System\BrolvkB.exe
  C:\Windows\System\BrolvkB.exe
  2⤵
  PID:5972
- C:\Windows\System\RQbllRc.exe
  C:\Windows\System\RQbllRc.exe
  2⤵
  PID:5172
- C:\Windows\System\loaqvqB.exe
  C:\Windows\System\loaqvqB.exe
  2⤵
  PID:5948
- C:\Windows\System\yKMhDaa.exe
  C:\Windows\System\yKMhDaa.exe
  2⤵
  PID:4800
- C:\Windows\System\MkYZnjx.exe
  C:\Windows\System\MkYZnjx.exe
  2⤵
  PID:5792
- C:\Windows\System\gxWOSPX.exe
  C:\Windows\System\gxWOSPX.exe
  2⤵
  PID:5256
- C:\Windows\System\xwjDOWY.exe
  C:\Windows\System\xwjDOWY.exe
  2⤵
  PID:5580
- C:\Windows\System\VoJIRsE.exe
  C:\Windows\System\VoJIRsE.exe
  2⤵
  PID:6156
- C:\Windows\System\TRltisQ.exe
  C:\Windows\System\TRltisQ.exe
  2⤵
  PID:6176
- C:\Windows\System\gzivoCJ.exe
  C:\Windows\System\gzivoCJ.exe
  2⤵
  PID:6192
- C:\Windows\System\aEYITCB.exe
  C:\Windows\System\aEYITCB.exe
  2⤵
  PID:6208
- C:\Windows\System\ojgOllg.exe
  C:\Windows\System\ojgOllg.exe
  2⤵
  PID:6224
- C:\Windows\System\gSwLhSI.exe
  C:\Windows\System\gSwLhSI.exe
  2⤵
  PID:6240
- C:\Windows\System\bcVetkd.exe
  C:\Windows\System\bcVetkd.exe
  2⤵
  PID:6256
- C:\Windows\System\ssqnDvB.exe
  C:\Windows\System\ssqnDvB.exe
  2⤵
  PID:6272
- C:\Windows\System\ETvkWKG.exe
  C:\Windows\System\ETvkWKG.exe
  2⤵
  PID:6288
- C:\Windows\System\euFbMOu.exe
  C:\Windows\System\euFbMOu.exe
  2⤵
  PID:6304
- C:\Windows\System\OuXlGwO.exe
  C:\Windows\System\OuXlGwO.exe
  2⤵
  PID:6320
- C:\Windows\System\RuktBFf.exe
  C:\Windows\System\RuktBFf.exe
  2⤵
  PID:6340
- C:\Windows\System\IsNubEd.exe
  C:\Windows\System\IsNubEd.exe
  2⤵
  PID:6360
- C:\Windows\System\TRjQwlB.exe
  C:\Windows\System\TRjQwlB.exe
  2⤵
  PID:6388
- C:\Windows\System\sxMZIag.exe
  C:\Windows\System\sxMZIag.exe
  2⤵
  PID:6412
- C:\Windows\System\imVpfpm.exe
  C:\Windows\System\imVpfpm.exe
  2⤵
  PID:6428
- C:\Windows\System\gHCiQJZ.exe
  C:\Windows\System\gHCiQJZ.exe
  2⤵
  PID:6448
- C:\Windows\System\BICDsWW.exe
  C:\Windows\System\BICDsWW.exe
  2⤵
  PID:6468
- C:\Windows\System\gQNIOjz.exe
  C:\Windows\System\gQNIOjz.exe
  2⤵
  PID:6488
- C:\Windows\System\vaiJPiR.exe
  C:\Windows\System\vaiJPiR.exe
  2⤵
  PID:6508
- C:\Windows\System\lLLcCns.exe
  C:\Windows\System\lLLcCns.exe
  2⤵
  PID:6528
- C:\Windows\System\dwgNhWH.exe
  C:\Windows\System\dwgNhWH.exe
  2⤵
  PID:6544
- C:\Windows\System\CxTXpoj.exe
  C:\Windows\System\CxTXpoj.exe
  2⤵
  PID:6564
- C:\Windows\System\nfldAnT.exe
  C:\Windows\System\nfldAnT.exe
  2⤵
  PID:6584
- C:\Windows\System\NBjzWhR.exe
  C:\Windows\System\NBjzWhR.exe
  2⤵
  PID:6600
- C:\Windows\System\AODOPcr.exe
  C:\Windows\System\AODOPcr.exe
  2⤵
  PID:6616
- C:\Windows\System\FIGUuFn.exe
  C:\Windows\System\FIGUuFn.exe
  2⤵
  PID:6632
- C:\Windows\System\KAydaJs.exe
  C:\Windows\System\KAydaJs.exe
  2⤵
  PID:6648
- C:\Windows\System\lZKlTSj.exe
  C:\Windows\System\lZKlTSj.exe
  2⤵
  PID:6664
- C:\Windows\System\vRFGHSl.exe
  C:\Windows\System\vRFGHSl.exe
  2⤵
  PID:6680
- C:\Windows\System\cXehDZy.exe
  C:\Windows\System\cXehDZy.exe
  2⤵
  PID:6696
- C:\Windows\System\gpjfWEa.exe
  C:\Windows\System\gpjfWEa.exe
  2⤵
  PID:6712
- C:\Windows\System\jwScvAi.exe
  C:\Windows\System\jwScvAi.exe
  2⤵
  PID:6732
- C:\Windows\System\enjEaCv.exe
  C:\Windows\System\enjEaCv.exe
  2⤵
  PID:6748
- C:\Windows\System\EIFOwQi.exe
  C:\Windows\System\EIFOwQi.exe
  2⤵
  PID:6768
- C:\Windows\System\wkrMncb.exe
  C:\Windows\System\wkrMncb.exe
  2⤵
  PID:6792
- C:\Windows\System\ErralTw.exe
  C:\Windows\System\ErralTw.exe
  2⤵
  PID:6812
- C:\Windows\System\GwYuTsK.exe
  C:\Windows\System\GwYuTsK.exe
  2⤵
  PID:6828
- C:\Windows\System\GCPsAJq.exe
  C:\Windows\System\GCPsAJq.exe
  2⤵
  PID:6848
- C:\Windows\System\GUAjphS.exe
  C:\Windows\System\GUAjphS.exe
  2⤵
  PID:6868
- C:\Windows\System\elJVemr.exe
  C:\Windows\System\elJVemr.exe
  2⤵
  PID:6888
- C:\Windows\System\ITruMHp.exe
  C:\Windows\System\ITruMHp.exe
  2⤵
  PID:6904
- C:\Windows\System\UEWIGQK.exe
  C:\Windows\System\UEWIGQK.exe
  2⤵
  PID:6924
- C:\Windows\System\fkhroBh.exe
  C:\Windows\System\fkhroBh.exe
  2⤵
  PID:6944
- C:\Windows\System\NDTATox.exe
  C:\Windows\System\NDTATox.exe
  2⤵
  PID:7116
- C:\Windows\System\QNQvkjQ.exe
  C:\Windows\System\QNQvkjQ.exe
  2⤵
  PID:7132
- C:\Windows\System\qZAKGpG.exe
  C:\Windows\System\qZAKGpG.exe
  2⤵
  PID:7148
- C:\Windows\System\KnLhZOG.exe
  C:\Windows\System\KnLhZOG.exe
  2⤵
  PID:7164
- C:\Windows\System\tmUcBDF.exe
  C:\Windows\System\tmUcBDF.exe
  2⤵
  PID:6040
- C:\Windows\System\fCWXTvB.exe
  C:\Windows\System\fCWXTvB.exe
  2⤵
  PID:6152
- C:\Windows\System\IyywGuV.exe
  C:\Windows\System\IyywGuV.exe
  2⤵
  PID:6220
- C:\Windows\System\wFPZKLQ.exe
  C:\Windows\System\wFPZKLQ.exe
  2⤵
  PID:6284
- C:\Windows\System\ABApMBo.exe
  C:\Windows\System\ABApMBo.exe
  2⤵
  PID:6356
- C:\Windows\System\DparkGm.exe
  C:\Windows\System\DparkGm.exe
  2⤵
  PID:6408
- C:\Windows\System\WTaaeNE.exe
  C:\Windows\System\WTaaeNE.exe
  2⤵
  PID:6476
- C:\Windows\System\rKTjXEp.exe
  C:\Windows\System\rKTjXEp.exe
  2⤵
  PID:6524
- C:\Windows\System\pHObMsG.exe
  C:\Windows\System\pHObMsG.exe
  2⤵
  PID:6592
- C:\Windows\System\wcrQuca.exe
  C:\Windows\System\wcrQuca.exe
  2⤵
  PID:6660
- C:\Windows\System\PEZwBUW.exe
  C:\Windows\System\PEZwBUW.exe
  2⤵
  PID:6724
- C:\Windows\System\ghkPSsV.exe
  C:\Windows\System\ghkPSsV.exe
  2⤵
  PID:6764
- C:\Windows\System\aFPRYOx.exe
  C:\Windows\System\aFPRYOx.exe
  2⤵
  PID:6840
- C:\Windows\System\mPxAxKu.exe
  C:\Windows\System\mPxAxKu.exe
  2⤵
  PID:6880
- C:\Windows\System\QRAJveP.exe
  C:\Windows\System\QRAJveP.exe
  2⤵
  PID:6920
- C:\Windows\System\qDBzOdU.exe
  C:\Windows\System\qDBzOdU.exe
  2⤵
  PID:6964
- C:\Windows\System\vwAffaV.exe
  C:\Windows\System\vwAffaV.exe
  2⤵
  PID:6984
- C:\Windows\System\aDpDEQW.exe
  C:\Windows\System\aDpDEQW.exe
  2⤵
  PID:5352
- C:\Windows\System\KJhtmBC.exe
  C:\Windows\System\KJhtmBC.exe
  2⤵
  PID:7004
- C:\Windows\System\lALiqZM.exe
  C:\Windows\System\lALiqZM.exe
  2⤵
  PID:5692
- C:\Windows\System\ZBtgWsH.exe
  C:\Windows\System\ZBtgWsH.exe
  2⤵
  PID:6168
- C:\Windows\System\gbildWk.exe
  C:\Windows\System\gbildWk.exe
  2⤵
  PID:6232
- C:\Windows\System\xsfQIic.exe
  C:\Windows\System\xsfQIic.exe
  2⤵
  PID:7040
- C:\Windows\System\EPDvrUC.exe
  C:\Windows\System\EPDvrUC.exe
  2⤵
  PID:6336
- C:\Windows\System\bmDHWLW.exe
  C:\Windows\System\bmDHWLW.exe
  2⤵
  PID:7052
- C:\Windows\System\isEZgOs.exe
  C:\Windows\System\isEZgOs.exe
  2⤵
  PID:6456
- C:\Windows\System\GHnXdie.exe
  C:\Windows\System\GHnXdie.exe
  2⤵
  PID:7060
- C:\Windows\System\AGRPowS.exe
  C:\Windows\System\AGRPowS.exe
  2⤵
  PID:6536
- C:\Windows\System\VOTAzvT.exe
  C:\Windows\System\VOTAzvT.exe
  2⤵
  PID:6644
- C:\Windows\System\ciGWWUe.exe
  C:\Windows\System\ciGWWUe.exe
  2⤵
  PID:7084
- C:\Windows\System\oxxTxwc.exe
  C:\Windows\System\oxxTxwc.exe
  2⤵
  PID:6776
- C:\Windows\System\LpjXoxv.exe
  C:\Windows\System\LpjXoxv.exe
  2⤵
  PID:6820
- C:\Windows\System\yqdVPtN.exe
  C:\Windows\System\yqdVPtN.exe
  2⤵
  PID:6864
- C:\Windows\System\MuJsPxn.exe
  C:\Windows\System\MuJsPxn.exe
  2⤵
  PID:6936
- C:\Windows\System\NXWeEzn.exe
  C:\Windows\System\NXWeEzn.exe
  2⤵
  PID:5508
- C:\Windows\System\NagJOYs.exe
  C:\Windows\System\NagJOYs.exe
  2⤵
  PID:6372
- C:\Windows\System\BIanKkx.exe
  C:\Windows\System\BIanKkx.exe
  2⤵
  PID:5716
- C:\Windows\System\HicqItW.exe
  C:\Windows\System\HicqItW.exe
  2⤵
  PID:6216
- C:\Windows\System\JSZROaz.exe
  C:\Windows\System\JSZROaz.exe
  2⤵
  PID:5900
- C:\Windows\System\JCSUNfh.exe
  C:\Windows\System\JCSUNfh.exe
  2⤵
  PID:5920
- C:\Windows\System\biSuSSY.exe
  C:\Windows\System\biSuSSY.exe
  2⤵
  PID:5656
- C:\Windows\System\DvkZLhc.exe
  C:\Windows\System\DvkZLhc.exe
  2⤵
  PID:6064
- C:\Windows\System\pQZDOxb.exe
  C:\Windows\System\pQZDOxb.exe
  2⤵
  PID:5512
- C:\Windows\System\RNTSusk.exe
  C:\Windows\System\RNTSusk.exe
  2⤵
  PID:5420
- C:\Windows\System\ECdYyGr.exe
  C:\Windows\System\ECdYyGr.exe
  2⤵
  PID:4264
- C:\Windows\System\phwrLnD.exe
  C:\Windows\System\phwrLnD.exe
  2⤵
  PID:5404
- C:\Windows\System\uyIDKYn.exe
  C:\Windows\System\uyIDKYn.exe
  2⤵
  PID:6268
- C:\Windows\System\EoyPSzV.exe
  C:\Windows\System\EoyPSzV.exe
  2⤵
  PID:6352
- C:\Windows\System\UTjnJKt.exe
  C:\Windows\System\UTjnJKt.exe
  2⤵
  PID:6440
- C:\Windows\System\XTIGQaN.exe
  C:\Windows\System\XTIGQaN.exe
  2⤵
  PID:6692
- C:\Windows\System\PfaePKQ.exe
  C:\Windows\System\PfaePKQ.exe
  2⤵
  PID:6836
- C:\Windows\System\RWWmwfY.exe
  C:\Windows\System\RWWmwfY.exe
  2⤵
  PID:6972
- C:\Windows\System\JuuVzTh.exe
  C:\Windows\System\JuuVzTh.exe
  2⤵
  PID:7020
- C:\Windows\System\kJHIyZq.exe
  C:\Windows\System\kJHIyZq.exe
  2⤵
  PID:6608
- C:\Windows\System\BmnbZex.exe
  C:\Windows\System\BmnbZex.exe
  2⤵
  PID:6740
- C:\Windows\System\fsthmNv.exe
  C:\Windows\System\fsthmNv.exe
  2⤵
  PID:6900
- C:\Windows\System\tCRzoRU.exe
  C:\Windows\System\tCRzoRU.exe
  2⤵
  PID:2132
- C:\Windows\System\IFUFwsP.exe
  C:\Windows\System\IFUFwsP.exe
  2⤵
  PID:7072
- C:\Windows\System\PUvblbx.exe
  C:\Windows\System\PUvblbx.exe
  2⤵
  PID:6860
- C:\Windows\System\txAKoaH.exe
  C:\Windows\System\txAKoaH.exe
  2⤵
  PID:4932
- C:\Windows\System\nJxNnvI.exe
  C:\Windows\System\nJxNnvI.exe
  2⤵
  PID:4736
- C:\Windows\System\qPyEzlR.exe
  C:\Windows\System\qPyEzlR.exe
  2⤵
  PID:7016
- C:\Windows\System\MYhHpjX.exe
  C:\Windows\System\MYhHpjX.exe
  2⤵
  PID:6280
- C:\Windows\System\yRzeefJ.exe
  C:\Windows\System\yRzeefJ.exe
  2⤵
  PID:6540
- C:\Windows\System\GokfIHZ.exe
  C:\Windows\System\GokfIHZ.exe
  2⤵
  PID:5444
- C:\Windows\System\EKGDdVP.exe
  C:\Windows\System\EKGDdVP.exe
  2⤵
  PID:5476
- C:\Windows\System\rTOMWol.exe
  C:\Windows\System\rTOMWol.exe
  2⤵
  PID:7128
- C:\Windows\System\ssBNkhE.exe
  C:\Windows\System\ssBNkhE.exe
  2⤵
  PID:7160
- C:\Windows\System\guZqlDc.exe
  C:\Windows\System\guZqlDc.exe
  2⤵
  PID:6808
- C:\Windows\System\QKiYWnL.exe
  C:\Windows\System\QKiYWnL.exe
  2⤵
  PID:5652
- C:\Windows\System\KtOBMVj.exe
  C:\Windows\System\KtOBMVj.exe
  2⤵
  PID:6672
- C:\Windows\System\ZiEIGCT.exe
  C:\Windows\System\ZiEIGCT.exe
  2⤵
  PID:1804
- C:\Windows\System\weItSwd.exe
  C:\Windows\System\weItSwd.exe
  2⤵
  PID:7080
- C:\Windows\System\gBKYinz.exe
  C:\Windows\System\gBKYinz.exe
  2⤵
  PID:7104
- C:\Windows\System\CrNspAF.exe
  C:\Windows\System\CrNspAF.exe
  2⤵
  PID:6628
- C:\Windows\System\QXvWrlM.exe
  C:\Windows\System\QXvWrlM.exe
  2⤵
  PID:6956
- C:\Windows\System\XojqNSe.exe
  C:\Windows\System\XojqNSe.exe
  2⤵
  PID:6556
- C:\Windows\System\tWEfWSU.exe
  C:\Windows\System\tWEfWSU.exe
  2⤵
  PID:6916
- C:\Windows\System\bCWrVpe.exe
  C:\Windows\System\bCWrVpe.exe
  2⤵
  PID:5916
- C:\Windows\System\ByWYSFN.exe
  C:\Windows\System\ByWYSFN.exe
  2⤵
  PID:5424
- C:\Windows\System\ifqKpNG.exe
  C:\Windows\System\ifqKpNG.exe
  2⤵
  PID:6960
- C:\Windows\System\NumQUPK.exe
  C:\Windows\System\NumQUPK.exe
  2⤵
  PID:6784
- C:\Windows\System\WpiqzVg.exe
  C:\Windows\System\WpiqzVg.exe
  2⤵
  PID:6252
- C:\Windows\System\bYfiaMK.exe
  C:\Windows\System\bYfiaMK.exe
  2⤵
  PID:6380
- C:\Windows\System\tgrYkWU.exe
  C:\Windows\System\tgrYkWU.exe
  2⤵
  PID:6804
- C:\Windows\System\Voivowm.exe
  C:\Windows\System\Voivowm.exe
  2⤵
  PID:6332
- C:\Windows\System\AlGpdkR.exe
  C:\Windows\System\AlGpdkR.exe
  2⤵
  PID:7012
- C:\Windows\System\GdiQyjE.exe
  C:\Windows\System\GdiQyjE.exe
  2⤵
  PID:6300
- C:\Windows\System\odSzahK.exe
  C:\Windows\System\odSzahK.exe
  2⤵
  PID:6624
- C:\Windows\System\KPoZRxx.exe
  C:\Windows\System\KPoZRxx.exe
  2⤵
  PID:7028
- C:\Windows\System\rnNqMRb.exe
  C:\Windows\System\rnNqMRb.exe
  2⤵
  PID:6204
- C:\Windows\System\qsOkIXI.exe
  C:\Windows\System\qsOkIXI.exe
  2⤵
  PID:4460
- C:\Windows\System\dSmoVRA.exe
  C:\Windows\System\dSmoVRA.exe
  2⤵
  PID:7036
- C:\Windows\System\uCoFXQO.exe
  C:\Windows\System\uCoFXQO.exe
  2⤵
  PID:7068
- C:\Windows\System\IvKjHyb.exe
  C:\Windows\System\IvKjHyb.exe
  2⤵
  PID:7156
- C:\Windows\System\zGvUNDM.exe
  C:\Windows\System\zGvUNDM.exe
  2⤵
  PID:6932
- C:\Windows\System\hwmJaJX.exe
  C:\Windows\System\hwmJaJX.exe
  2⤵
  PID:5824
- C:\Windows\System\HpNTPvu.exe
  C:\Windows\System\HpNTPvu.exe
  2⤵
  PID:6060
- C:\Windows\System\xhqDhjg.exe
  C:\Windows\System\xhqDhjg.exe
  2⤵
  PID:6760
- C:\Windows\System\bjLYPSR.exe
  C:\Windows\System\bjLYPSR.exe
  2⤵
  PID:6404
- C:\Windows\System\NnuFToR.exe
  C:\Windows\System\NnuFToR.exe
  2⤵
  PID:6856
- C:\Windows\System\KnGDWaK.exe
  C:\Windows\System\KnGDWaK.exe
  2⤵
  PID:4900
- C:\Windows\System\JpYBcEB.exe
  C:\Windows\System\JpYBcEB.exe
  2⤵
  PID:6580
- C:\Windows\System\EEvTawA.exe
  C:\Windows\System\EEvTawA.exe
  2⤵
  PID:6520
- C:\Windows\System\LucCFMU.exe
  C:\Windows\System\LucCFMU.exe
  2⤵
  PID:7184
- C:\Windows\System\OeSfgqr.exe
  C:\Windows\System\OeSfgqr.exe
  2⤵
  PID:7200
- C:\Windows\System\bbKHilY.exe
  C:\Windows\System\bbKHilY.exe
  2⤵
  PID:7216
- C:\Windows\System\cQManbS.exe
  C:\Windows\System\cQManbS.exe
  2⤵
  PID:7232
- C:\Windows\System\WQlsGNt.exe
  C:\Windows\System\WQlsGNt.exe
  2⤵
  PID:7248
- C:\Windows\System\NhGEmeB.exe
  C:\Windows\System\NhGEmeB.exe
  2⤵
  PID:7264
- C:\Windows\System\cOzoTKz.exe
  C:\Windows\System\cOzoTKz.exe
  2⤵
  PID:7280
- C:\Windows\System\lChAGop.exe
  C:\Windows\System\lChAGop.exe
  2⤵
  PID:7296
- C:\Windows\System\OqqCvqw.exe
  C:\Windows\System\OqqCvqw.exe
  2⤵
  PID:7312
- C:\Windows\System\cZRdfEH.exe
  C:\Windows\System\cZRdfEH.exe
  2⤵
  PID:7328
- C:\Windows\System\kJiGLsu.exe
  C:\Windows\System\kJiGLsu.exe
  2⤵
  PID:7344
- C:\Windows\System\BCitUdv.exe
  C:\Windows\System\BCitUdv.exe
  2⤵
  PID:7360
- C:\Windows\System\tFeyOjy.exe
  C:\Windows\System\tFeyOjy.exe
  2⤵
  PID:7376
- C:\Windows\System\slBWhPZ.exe
  C:\Windows\System\slBWhPZ.exe
  2⤵
  PID:7392
- C:\Windows\System\foAFyRl.exe
  C:\Windows\System\foAFyRl.exe
  2⤵
  PID:7408
- C:\Windows\System\JgPobCt.exe
  C:\Windows\System\JgPobCt.exe
  2⤵
  PID:7424
- C:\Windows\System\nyPAxSB.exe
  C:\Windows\System\nyPAxSB.exe
  2⤵
  PID:7440
- C:\Windows\System\QJuOrJL.exe
  C:\Windows\System\QJuOrJL.exe
  2⤵
  PID:7456
- C:\Windows\System\TkahkDY.exe
  C:\Windows\System\TkahkDY.exe
  2⤵
  PID:7472
- C:\Windows\System\PnjIJqk.exe
  C:\Windows\System\PnjIJqk.exe
  2⤵
  PID:7488
- C:\Windows\System\lDIFwQe.exe
  C:\Windows\System\lDIFwQe.exe
  2⤵
  PID:7504
- C:\Windows\System\FNTVSnG.exe
  C:\Windows\System\FNTVSnG.exe
  2⤵
  PID:7520
- C:\Windows\System\dMziakn.exe
  C:\Windows\System\dMziakn.exe
  2⤵
  PID:7536
- C:\Windows\System\oLZISZB.exe
  C:\Windows\System\oLZISZB.exe
  2⤵
  PID:7552
- C:\Windows\System\UNDjnMA.exe
  C:\Windows\System\UNDjnMA.exe
  2⤵
  PID:7572
- C:\Windows\System\RMfZcXw.exe
  C:\Windows\System\RMfZcXw.exe
  2⤵
  PID:7588
- C:\Windows\System\riVMBbO.exe
  C:\Windows\System\riVMBbO.exe
  2⤵
  PID:7604
- C:\Windows\System\UDtLIeD.exe
  C:\Windows\System\UDtLIeD.exe
  2⤵
  PID:7620
- C:\Windows\System\blnNEpb.exe
  C:\Windows\System\blnNEpb.exe
  2⤵
  PID:7636
- C:\Windows\System\CrmZEIR.exe
  C:\Windows\System\CrmZEIR.exe
  2⤵
  PID:7652
- C:\Windows\System\xIHCbQh.exe
  C:\Windows\System\xIHCbQh.exe
  2⤵
  PID:7668
- C:\Windows\System\pmzpJNr.exe
  C:\Windows\System\pmzpJNr.exe
  2⤵
  PID:7684
- C:\Windows\System\BMxaXIV.exe
  C:\Windows\System\BMxaXIV.exe
  2⤵
  PID:7700
- C:\Windows\System\SZzrshi.exe
  C:\Windows\System\SZzrshi.exe
  2⤵
  PID:7716
- C:\Windows\System\GaEXRpd.exe
  C:\Windows\System\GaEXRpd.exe
  2⤵
  PID:7732
- C:\Windows\System\aTfDaxq.exe
  C:\Windows\System\aTfDaxq.exe
  2⤵
  PID:7748
- C:\Windows\System\aZTilMt.exe
  C:\Windows\System\aZTilMt.exe
  2⤵
  PID:7764
- C:\Windows\System\uDVGfPO.exe
  C:\Windows\System\uDVGfPO.exe
  2⤵
  PID:7780
- C:\Windows\System\DlJLIKM.exe
  C:\Windows\System\DlJLIKM.exe
  2⤵
  PID:7796
- C:\Windows\System\NMCsdnj.exe
  C:\Windows\System\NMCsdnj.exe
  2⤵
  PID:7812
- C:\Windows\System\ftbBfNY.exe
  C:\Windows\System\ftbBfNY.exe
  2⤵
  PID:7828
- C:\Windows\System\TSAailY.exe
  C:\Windows\System\TSAailY.exe
  2⤵
  PID:7844
- C:\Windows\System\IdpUBbW.exe
  C:\Windows\System\IdpUBbW.exe
  2⤵
  PID:7860
- C:\Windows\System\ZWTBYhr.exe
  C:\Windows\System\ZWTBYhr.exe
  2⤵
  PID:7876
- C:\Windows\System\lMFywXv.exe
  C:\Windows\System\lMFywXv.exe
  2⤵
  PID:7892
- C:\Windows\System\TTtZDuY.exe
  C:\Windows\System\TTtZDuY.exe
  2⤵
  PID:7908
- C:\Windows\System\iwpggBN.exe
  C:\Windows\System\iwpggBN.exe
  2⤵
  PID:7924
- C:\Windows\System\JesFkmn.exe
  C:\Windows\System\JesFkmn.exe
  2⤵
  PID:7940
- C:\Windows\System\yGoXpIj.exe
  C:\Windows\System\yGoXpIj.exe
  2⤵
  PID:7956
- C:\Windows\System\uzszFXV.exe
  C:\Windows\System\uzszFXV.exe
  2⤵
  PID:7972
- C:\Windows\System\CiuoPFl.exe
  C:\Windows\System\CiuoPFl.exe
  2⤵
  PID:7988
- C:\Windows\System\jOfGSlI.exe
  C:\Windows\System\jOfGSlI.exe
  2⤵
  PID:8004
- C:\Windows\System\ZbFWRCv.exe
  C:\Windows\System\ZbFWRCv.exe
  2⤵
  PID:8020
- C:\Windows\System\qZgcEuQ.exe
  C:\Windows\System\qZgcEuQ.exe
  2⤵
  PID:8036
- C:\Windows\System\viwtTKM.exe
  C:\Windows\System\viwtTKM.exe
  2⤵
  PID:8052
- C:\Windows\System\jDmaVJu.exe
  C:\Windows\System\jDmaVJu.exe
  2⤵
  PID:8072
- C:\Windows\System\TkjxwbF.exe
  C:\Windows\System\TkjxwbF.exe
  2⤵
  PID:8088
- C:\Windows\System\piiIFcI.exe
  C:\Windows\System\piiIFcI.exe
  2⤵
  PID:8104
- C:\Windows\System\GzEhOZV.exe
  C:\Windows\System\GzEhOZV.exe
  2⤵
  PID:8120
- C:\Windows\System\RtGtyOm.exe
  C:\Windows\System\RtGtyOm.exe
  2⤵
  PID:8136
- C:\Windows\System\YuGViyL.exe
  C:\Windows\System\YuGViyL.exe
  2⤵
  PID:8152
- C:\Windows\System\HjrdUUq.exe
  C:\Windows\System\HjrdUUq.exe
  2⤵
  PID:8168
- C:\Windows\System\UxYvUce.exe
  C:\Windows\System\UxYvUce.exe
  2⤵
  PID:8184
- C:\Windows\System\hxRCnWw.exe
  C:\Windows\System\hxRCnWw.exe
  2⤵
  PID:7208
- C:\Windows\System\FeUyUol.exe
  C:\Windows\System\FeUyUol.exe
  2⤵
  PID:7240
- C:\Windows\System\VNFnGpa.exe
  C:\Windows\System\VNFnGpa.exe
  2⤵
  PID:5788
- C:\Windows\System\PFbaCTu.exe
  C:\Windows\System\PFbaCTu.exe
  2⤵
  PID:7308
- C:\Windows\System\WMeMDYf.exe
  C:\Windows\System\WMeMDYf.exe
  2⤵
  PID:7224
- C:\Windows\System\gvGvhXy.exe
  C:\Windows\System\gvGvhXy.exe
  2⤵
  PID:7400
- C:\Windows\System\fUbVEJz.exe
  C:\Windows\System\fUbVEJz.exe
  2⤵
  PID:7404
- C:\Windows\System\pLWnhkm.exe
  C:\Windows\System\pLWnhkm.exe
  2⤵
  PID:7432
- C:\Windows\System\dARtJqJ.exe
  C:\Windows\System\dARtJqJ.exe
  2⤵
  PID:7388
- C:\Windows\System\dnAFQbd.exe
  C:\Windows\System\dnAFQbd.exe
  2⤵
  PID:7452
- C:\Windows\System\sHvrbOi.exe
  C:\Windows\System\sHvrbOi.exe
  2⤵
  PID:7500
- C:\Windows\System\iCdaVsg.exe
  C:\Windows\System\iCdaVsg.exe
  2⤵
  PID:7564
- C:\Windows\System\ZqvXEXt.exe
  C:\Windows\System\ZqvXEXt.exe
  2⤵
  PID:7632
- C:\Windows\System\hyKJvRl.exe
  C:\Windows\System\hyKJvRl.exe
  2⤵
  PID:7724
- C:\Windows\System\qMlIMGa.exe
  C:\Windows\System\qMlIMGa.exe
  2⤵
  PID:7760
- C:\Windows\System\BDudmfd.exe
  C:\Windows\System\BDudmfd.exe
  2⤵
  PID:7612
- C:\Windows\System\SOpPzgc.exe
  C:\Windows\System\SOpPzgc.exe
  2⤵
  PID:7484
- C:\Windows\System\CxQWmLy.exe
  C:\Windows\System\CxQWmLy.exe
  2⤵
  PID:7512
- C:\Windows\System\MSRWfIu.exe
  C:\Windows\System\MSRWfIu.exe
  2⤵
  PID:7480
- C:\Windows\System\NfsgCsI.exe
  C:\Windows\System\NfsgCsI.exe
  2⤵
  PID:7648
- C:\Windows\System\gSHfMuf.exe
  C:\Windows\System\gSHfMuf.exe
  2⤵
  PID:7984
- C:\Windows\System\DzEiOJC.exe
  C:\Windows\System\DzEiOJC.exe
  2⤵
  PID:8048
- C:\Windows\System\aeHykfc.exe
  C:\Windows\System\aeHykfc.exe
  2⤵
  PID:8116
- C:\Windows\System\WFJsZQV.exe
  C:\Windows\System\WFJsZQV.exe
  2⤵
  PID:8148
- C:\Windows\System\UXZqukR.exe
  C:\Windows\System\UXZqukR.exe
  2⤵
  PID:7772
- C:\Windows\System\AVBwBWl.exe
  C:\Windows\System\AVBwBWl.exe
  2⤵
  PID:7776
- C:\Windows\System\FrgtRDs.exe
  C:\Windows\System\FrgtRDs.exe
  2⤵
  PID:7808
- C:\Windows\System\ttGgUEQ.exe
  C:\Windows\System\ttGgUEQ.exe
  2⤵
  PID:7712
- C:\Windows\System\wsIjtat.exe
  C:\Windows\System\wsIjtat.exe
  2⤵
  PID:7872
- C:\Windows\System\ylihYFd.exe
  C:\Windows\System\ylihYFd.exe
  2⤵
  PID:8096
- C:\Windows\System\erUSGOM.exe
  C:\Windows\System\erUSGOM.exe
  2⤵
  PID:7996
- C:\Windows\System\sYVRMyh.exe
  C:\Windows\System\sYVRMyh.exe
  2⤵
  PID:8064
- C:\Windows\System\fYZCDCn.exe
  C:\Windows\System\fYZCDCn.exe
  2⤵
  PID:8132
- C:\Windows\System\DplosiW.exe
  C:\Windows\System\DplosiW.exe
  2⤵
  PID:7180
- C:\Windows\System\xJsfPav.exe
  C:\Windows\System\xJsfPav.exe
  2⤵
  PID:7228
- C:\Windows\System\lfufNfl.exe
  C:\Windows\System\lfufNfl.exe
  2⤵
  PID:7324
- C:\Windows\System\VffWawC.exe
  C:\Windows\System\VffWawC.exe
  2⤵
  PID:7436
- C:\Windows\System\aLYMWRD.exe
  C:\Windows\System\aLYMWRD.exe
  2⤵
  PID:7788
- C:\Windows\System\gPlxzFp.exe
  C:\Windows\System\gPlxzFp.exe
  2⤵
  PID:7740
- C:\Windows\System\OFdEaHg.exe
  C:\Windows\System\OFdEaHg.exe
  2⤵
  PID:8016
- C:\Windows\System\QlkJUtF.exe
  C:\Windows\System\QlkJUtF.exe
  2⤵
  PID:7792
- C:\Windows\System\dCuEwTL.exe
  C:\Windows\System\dCuEwTL.exe
  2⤵
  PID:7904
- C:\Windows\System\mfKjJDl.exe
  C:\Windows\System\mfKjJDl.exe
  2⤵
  PID:7448
- C:\Windows\System\zwTutVx.exe
  C:\Windows\System\zwTutVx.exe
  2⤵
  PID:8028
- C:\Windows\System\HloGkKq.exe
  C:\Windows\System\HloGkKq.exe
  2⤵
  PID:8164
- C:\Windows\System\RZTzJbS.exe
  C:\Windows\System\RZTzJbS.exe
  2⤵
  PID:7276
- C:\Windows\System\wWHIqSv.exe
  C:\Windows\System\wWHIqSv.exe
  2⤵
  PID:7496
- C:\Windows\System\zDhoUko.exe
  C:\Windows\System\zDhoUko.exe
  2⤵
  PID:7256
- C:\Windows\System\yqtuTrK.exe
  C:\Windows\System\yqtuTrK.exe
  2⤵
  PID:7260
- C:\Windows\System\qfYDMkx.exe
  C:\Windows\System\qfYDMkx.exe
  2⤵
  PID:7868
- C:\Windows\System\FdZrVwv.exe
  C:\Windows\System\FdZrVwv.exe
  2⤵
  PID:7340
- C:\Windows\System\TBZDxaP.exe
  C:\Windows\System\TBZDxaP.exe
  2⤵
  PID:7932
- C:\Windows\System\diuTSmy.exe
  C:\Windows\System\diuTSmy.exe
  2⤵
  PID:7416
- C:\Windows\System\kdRvHKZ.exe
  C:\Windows\System\kdRvHKZ.exe
  2⤵
  PID:7756
- C:\Windows\System\QfjjcMS.exe
  C:\Windows\System\QfjjcMS.exe
  2⤵
  PID:7884
- C:\Windows\System\CejhReU.exe
  C:\Windows\System\CejhReU.exe
  2⤵
  PID:7952
- C:\Windows\System\WfgctpR.exe
  C:\Windows\System\WfgctpR.exe
  2⤵
  PID:8180
- C:\Windows\System\lAdCiNA.exe
  C:\Windows\System\lAdCiNA.exe
  2⤵
  PID:8044
- C:\Windows\System\bLEktoh.exe
  C:\Windows\System\bLEktoh.exe
  2⤵
  PID:7804
- C:\Windows\System\EnxzOUL.exe
  C:\Windows\System\EnxzOUL.exe
  2⤵
  PID:8204
- C:\Windows\System\PAbZmCI.exe
  C:\Windows\System\PAbZmCI.exe
  2⤵
  PID:8220
- C:\Windows\System\ezvXXEo.exe
  C:\Windows\System\ezvXXEo.exe
  2⤵
  PID:8236
- C:\Windows\System\WGmGeLj.exe
  C:\Windows\System\WGmGeLj.exe
  2⤵
  PID:8252
- C:\Windows\System\CVUjGQN.exe
  C:\Windows\System\CVUjGQN.exe
  2⤵
  PID:8268
- C:\Windows\System\DFHpDBQ.exe
  C:\Windows\System\DFHpDBQ.exe
  2⤵
  PID:8284
- C:\Windows\System\UMDKzwm.exe
  C:\Windows\System\UMDKzwm.exe
  2⤵
  PID:8300
- C:\Windows\System\HGgcHIq.exe
  C:\Windows\System\HGgcHIq.exe
  2⤵
  PID:8316
- C:\Windows\System\MOuyNBo.exe
  C:\Windows\System\MOuyNBo.exe
  2⤵
  PID:8332
- C:\Windows\System\JhYhAZy.exe
  C:\Windows\System\JhYhAZy.exe
  2⤵
  PID:8348
- C:\Windows\System\RQPgMMd.exe
  C:\Windows\System\RQPgMMd.exe
  2⤵
  PID:8364
- C:\Windows\System\myzKXKn.exe
  C:\Windows\System\myzKXKn.exe
  2⤵
  PID:8380
- C:\Windows\System\JRCUxUM.exe
  C:\Windows\System\JRCUxUM.exe
  2⤵
  PID:8396
- C:\Windows\System\qMVekRh.exe
  C:\Windows\System\qMVekRh.exe
  2⤵
  PID:8412
- C:\Windows\System\fYUwltu.exe
  C:\Windows\System\fYUwltu.exe
  2⤵
  PID:8428
- C:\Windows\System\UzmDBjh.exe
  C:\Windows\System\UzmDBjh.exe
  2⤵
  PID:8444
- C:\Windows\System\uyPCAqz.exe
  C:\Windows\System\uyPCAqz.exe
  2⤵
  PID:8460
- C:\Windows\System\ALAWDLl.exe
  C:\Windows\System\ALAWDLl.exe
  2⤵
  PID:8476
- C:\Windows\System\pkTPBLq.exe
  C:\Windows\System\pkTPBLq.exe
  2⤵
  PID:8492
- C:\Windows\System\NqojTGv.exe
  C:\Windows\System\NqojTGv.exe
  2⤵
  PID:8508
- C:\Windows\System\GvkOTlP.exe
  C:\Windows\System\GvkOTlP.exe
  2⤵
  PID:8524
- C:\Windows\System\IARCvjw.exe
  C:\Windows\System\IARCvjw.exe
  2⤵
  PID:8540
- C:\Windows\System\bcfkiiA.exe
  C:\Windows\System\bcfkiiA.exe
  2⤵
  PID:8556
- C:\Windows\System\fEBnIvD.exe
  C:\Windows\System\fEBnIvD.exe
  2⤵
  PID:8572
- C:\Windows\System\cRYvhep.exe
  C:\Windows\System\cRYvhep.exe
  2⤵
  PID:8588
- C:\Windows\System\FGgtAQx.exe
  C:\Windows\System\FGgtAQx.exe
  2⤵
  PID:8604
- C:\Windows\System\cDtZuhq.exe
  C:\Windows\System\cDtZuhq.exe
  2⤵
  PID:8620
- C:\Windows\System\FRtbnEy.exe
  C:\Windows\System\FRtbnEy.exe
  2⤵
  PID:8636
- C:\Windows\System\jkQTuHn.exe
  C:\Windows\System\jkQTuHn.exe
  2⤵
  PID:8652
- C:\Windows\System\hiIQCcK.exe
  C:\Windows\System\hiIQCcK.exe
  2⤵
  PID:8668
- C:\Windows\System\uZhwnpW.exe
  C:\Windows\System\uZhwnpW.exe
  2⤵
  PID:8684
- C:\Windows\System\ljyQkTG.exe
  C:\Windows\System\ljyQkTG.exe
  2⤵
  PID:8700
- C:\Windows\System\YYXMGFm.exe
  C:\Windows\System\YYXMGFm.exe
  2⤵
  PID:8716
- C:\Windows\System\rJBZYRd.exe
  C:\Windows\System\rJBZYRd.exe
  2⤵
  PID:8732
- C:\Windows\System\celgtAN.exe
  C:\Windows\System\celgtAN.exe
  2⤵
  PID:8748
- C:\Windows\System\wyJcsVv.exe
  C:\Windows\System\wyJcsVv.exe
  2⤵
  PID:8764
- C:\Windows\System\WlAGSbb.exe
  C:\Windows\System\WlAGSbb.exe
  2⤵
  PID:8780
- C:\Windows\System\aSSjRDv.exe
  C:\Windows\System\aSSjRDv.exe
  2⤵
  PID:8796
- C:\Windows\System\PBbugRv.exe
  C:\Windows\System\PBbugRv.exe
  2⤵
  PID:8812
- C:\Windows\System\XGZGUTn.exe
  C:\Windows\System\XGZGUTn.exe
  2⤵
  PID:8828
- C:\Windows\System\NEajEmR.exe
  C:\Windows\System\NEajEmR.exe
  2⤵
  PID:8844
- C:\Windows\System\PxLPkyo.exe
  C:\Windows\System\PxLPkyo.exe
  2⤵
  PID:8860
- C:\Windows\System\JiykAaQ.exe
  C:\Windows\System\JiykAaQ.exe
  2⤵
  PID:8876
- C:\Windows\System\oHQIvYM.exe
  C:\Windows\System\oHQIvYM.exe
  2⤵
  PID:8892
- C:\Windows\System\kRJkYnH.exe
  C:\Windows\System\kRJkYnH.exe
  2⤵
  PID:8908
- C:\Windows\System\jxdmvxc.exe
  C:\Windows\System\jxdmvxc.exe
  2⤵
  PID:8924
- C:\Windows\System\RGULYZO.exe
  C:\Windows\System\RGULYZO.exe
  2⤵
  PID:8940
- C:\Windows\System\HBNOGnl.exe
  C:\Windows\System\HBNOGnl.exe
  2⤵
  PID:8956
- C:\Windows\System\kOkgxxg.exe
  C:\Windows\System\kOkgxxg.exe
  2⤵
  PID:8976
- C:\Windows\System\sBekBCn.exe
  C:\Windows\System\sBekBCn.exe
  2⤵
  PID:8992
- C:\Windows\System\tnjNlWv.exe
  C:\Windows\System\tnjNlWv.exe
  2⤵
  PID:9008
- C:\Windows\System\KcIysue.exe
  C:\Windows\System\KcIysue.exe
  2⤵
  PID:9024
- C:\Windows\System\hYOfCkF.exe
  C:\Windows\System\hYOfCkF.exe
  2⤵
  PID:9044
- C:\Windows\System\NhhwAdW.exe
  C:\Windows\System\NhhwAdW.exe
  2⤵
  PID:9060
- C:\Windows\System\QLXHydo.exe
  C:\Windows\System\QLXHydo.exe
  2⤵
  PID:9076
- C:\Windows\System\IYPZoUA.exe
  C:\Windows\System\IYPZoUA.exe
  2⤵
  PID:9092
- C:\Windows\System\tWnKXli.exe
  C:\Windows\System\tWnKXli.exe
  2⤵
  PID:9108
- C:\Windows\System\RjtWHiQ.exe
  C:\Windows\System\RjtWHiQ.exe
  2⤵
  PID:9124
- C:\Windows\System\LdupeVR.exe
  C:\Windows\System\LdupeVR.exe
  2⤵
  PID:9140
- C:\Windows\System\EMsyUgt.exe
  C:\Windows\System\EMsyUgt.exe
  2⤵
  PID:9156
- C:\Windows\System\ULeAEcO.exe
  C:\Windows\System\ULeAEcO.exe
  2⤵
  PID:9172
- C:\Windows\System\qqBWBCk.exe
  C:\Windows\System\qqBWBCk.exe
  2⤵
  PID:9188
- C:\Windows\System\OjjKbdD.exe
  C:\Windows\System\OjjKbdD.exe
  2⤵
  PID:9204
- C:\Windows\System\RFqZOcl.exe
  C:\Windows\System\RFqZOcl.exe
  2⤵
  PID:8144
- C:\Windows\System\FLAxfwa.exe
  C:\Windows\System\FLAxfwa.exe
  2⤵
  PID:7468
- C:\Windows\System\UkfCvse.exe
  C:\Windows\System\UkfCvse.exe
  2⤵
  PID:7696
- C:\Windows\System\NAsbSJL.exe
  C:\Windows\System\NAsbSJL.exe
  2⤵
  PID:8212
- C:\Windows\System\SNErzHE.exe
  C:\Windows\System\SNErzHE.exe
  2⤵
  PID:8260
- C:\Windows\System\QfIGdrP.exe
  C:\Windows\System\QfIGdrP.exe
  2⤵
  PID:8324
- C:\Windows\System\LcHoHhh.exe
  C:\Windows\System\LcHoHhh.exe
  2⤵
  PID:8276
- C:\Windows\System\BacCNiv.exe
  C:\Windows\System\BacCNiv.exe
  2⤵
  PID:8388
- C:\Windows\System\BIMkkqu.exe
  C:\Windows\System\BIMkkqu.exe
  2⤵
  PID:8452
- C:\Windows\System\zCHyghT.exe
  C:\Windows\System\zCHyghT.exe
  2⤵
  PID:8376
- C:\Windows\System\KDwHSpo.exe
  C:\Windows\System\KDwHSpo.exe
  2⤵
  PID:8516
- C:\Windows\System\OBNDmoU.exe
  C:\Windows\System\OBNDmoU.exe
  2⤵
  PID:8552
- C:\Windows\System\vrVjhse.exe
  C:\Windows\System\vrVjhse.exe
  2⤵
  PID:8616
- C:\Windows\System\alqazHg.exe
  C:\Windows\System\alqazHg.exe
  2⤵
  PID:8312
- C:\Windows\System\goTvyJm.exe
  C:\Windows\System\goTvyJm.exe
  2⤵
  PID:8436
- C:\Windows\System\lUDcKoX.exe
  C:\Windows\System\lUDcKoX.exe
  2⤵
  PID:8468
- C:\Windows\System\UgxplXi.exe
  C:\Windows\System\UgxplXi.exe
  2⤵
  PID:8568
- C:\Windows\System\UyfeiEj.exe
  C:\Windows\System\UyfeiEj.exe
  2⤵
  PID:8500
- C:\Windows\System\vauUrzY.exe
  C:\Windows\System\vauUrzY.exe
  2⤵
  PID:8712
- C:\Windows\System\gjxCZIP.exe
  C:\Windows\System\gjxCZIP.exe
  2⤵
  PID:8692
- C:\Windows\System\armdFjt.exe
  C:\Windows\System\armdFjt.exe
  2⤵
  PID:8772
- C:\Windows\System\PxDytJU.exe
  C:\Windows\System\PxDytJU.exe
  2⤵
  PID:8868
- C:\Windows\System\DBoKjoQ.exe
  C:\Windows\System\DBoKjoQ.exe
  2⤵
  PID:8904
- C:\Windows\System\BhqSDmv.exe
  C:\Windows\System\BhqSDmv.exe
  2⤵
  PID:8760
- C:\Windows\System\artGIZA.exe
  C:\Windows\System\artGIZA.exe
  2⤵
  PID:8696
- C:\Windows\System\hKgxuBS.exe
  C:\Windows\System\hKgxuBS.exe
  2⤵
  PID:8972
- C:\Windows\System\uUNpOSC.exe
  C:\Windows\System\uUNpOSC.exe
  2⤵
  PID:8920
- C:\Windows\System\ZhmrsYT.exe
  C:\Windows\System\ZhmrsYT.exe
  2⤵
  PID:9032
- C:\Windows\System\NkNkQSd.exe
  C:\Windows\System\NkNkQSd.exe
  2⤵
  PID:9016
- C:\Windows\System\bPIIsFK.exe
  C:\Windows\System\bPIIsFK.exe
  2⤵
  PID:8984
- C:\Windows\System\YtyWWez.exe
  C:\Windows\System\YtyWWez.exe
  2⤵
  PID:9100
- C:\Windows\System\tnrQIRj.exe
  C:\Windows\System\tnrQIRj.exe
  2⤵
  PID:9052
- C:\Windows\System\MYAYMGG.exe
  C:\Windows\System\MYAYMGG.exe
  2⤵
  PID:9120
- C:\Windows\System\xpBgQMl.exe
  C:\Windows\System\xpBgQMl.exe
  2⤵
  PID:9148
- C:\Windows\System\awyuEHo.exe
  C:\Windows\System\awyuEHo.exe
  2⤵
  PID:9152
- C:\Windows\System\LRZJZjI.exe
  C:\Windows\System\LRZJZjI.exe
  2⤵
  PID:8196
- C:\Windows\System\HMMRZSP.exe
  C:\Windows\System\HMMRZSP.exe
  2⤵
  PID:8080
- C:\Windows\System\wIHWyjp.exe
  C:\Windows\System\wIHWyjp.exe
  2⤵
  PID:8228
- C:\Windows\System\fmawHmx.exe
  C:\Windows\System\fmawHmx.exe
  2⤵
  PID:8248
- C:\Windows\System\NUIwweJ.exe
  C:\Windows\System\NUIwweJ.exe
  2⤵
  PID:8424
- C:\Windows\System\lATPnCS.exe
  C:\Windows\System\lATPnCS.exe
  2⤵
  PID:8372
- C:\Windows\System\iIpTCWX.exe
  C:\Windows\System\iIpTCWX.exe
  2⤵
  PID:8648
- C:\Windows\System\gMtjLMy.exe
  C:\Windows\System\gMtjLMy.exe
  2⤵
  PID:8344
- C:\Windows\System\AOICNSc.exe
  C:\Windows\System\AOICNSc.exe
  2⤵
  PID:8596
- C:\Windows\System\GSlPbBZ.exe
  C:\Windows\System\GSlPbBZ.exe
  2⤵
  PID:8660
- C:\Windows\System\iveqluE.exe
  C:\Windows\System\iveqluE.exe
  2⤵
  PID:8808
- C:\Windows\System\tlQHxpI.exe
  C:\Windows\System\tlQHxpI.exe
  2⤵
  PID:8936
- C:\Windows\System\XJoLdNF.exe
  C:\Windows\System\XJoLdNF.exe
  2⤵
  PID:8820
- C:\Windows\System\xIBHVzc.exe
  C:\Windows\System\xIBHVzc.exe
  2⤵
  PID:8952
- C:\Windows\System\qnkWxKA.exe
  C:\Windows\System\qnkWxKA.exe
  2⤵
  PID:9040
- C:\Windows\System\BaspIxU.exe
  C:\Windows\System\BaspIxU.exe
  2⤵
  PID:9088
- C:\Windows\System\fXbONUC.exe
  C:\Windows\System\fXbONUC.exe
  2⤵
  PID:9168
- C:\Windows\System\RQqhScW.exe
  C:\Windows\System\RQqhScW.exe
  2⤵
  PID:9212
- C:\Windows\System\OuXgdup.exe
  C:\Windows\System\OuXgdup.exe
  2⤵
  PID:7920
- C:\Windows\System\mIvFiEe.exe
  C:\Windows\System\mIvFiEe.exe
  2⤵
  PID:8484
- C:\Windows\System\jmkrYgv.exe
  C:\Windows\System\jmkrYgv.exe
  2⤵
  PID:8612
- C:\Windows\System\vzBCQsP.exe
  C:\Windows\System\vzBCQsP.exe
  2⤵
  PID:8532
- C:\Windows\System\xvPlJhl.exe
  C:\Windows\System\xvPlJhl.exe
  2⤵
  PID:8776
- C:\Windows\System\SpEjmpg.exe
  C:\Windows\System\SpEjmpg.exe
  2⤵
  PID:8728
- C:\Windows\System\GBHSCYk.exe
  C:\Windows\System\GBHSCYk.exe
  2⤵
  PID:8888
- C:\Windows\System\BtgZokQ.exe
  C:\Windows\System\BtgZokQ.exe
  2⤵
  PID:8824
- C:\Windows\System\fhiQFeb.exe
  C:\Windows\System\fhiQFeb.exe
  2⤵
  PID:7272
- C:\Windows\System\gQwEAAP.exe
  C:\Windows\System\gQwEAAP.exe
  2⤵
  PID:7568
- C:\Windows\System\IhDiJOv.exe
  C:\Windows\System\IhDiJOv.exe
  2⤵
  PID:8472
- C:\Windows\System\OpYtVeD.exe
  C:\Windows\System\OpYtVeD.exe
  2⤵
  PID:8900
- C:\Windows\System\TCeEupF.exe
  C:\Windows\System\TCeEupF.exe
  2⤵
  PID:9072
- C:\Windows\System\FaFViyi.exe
  C:\Windows\System\FaFViyi.exe
  2⤵
  PID:9136
- C:\Windows\System\urKZeRW.exe
  C:\Windows\System\urKZeRW.exe
  2⤵
  PID:8600
- C:\Windows\System\IelFYAn.exe
  C:\Windows\System\IelFYAn.exe
  2⤵
  PID:9228
- C:\Windows\System\uGSCiRE.exe
  C:\Windows\System\uGSCiRE.exe
  2⤵
  PID:9244
- C:\Windows\System\JyCYmia.exe
  C:\Windows\System\JyCYmia.exe
  2⤵
  PID:9260
- C:\Windows\System\wTdGzld.exe
  C:\Windows\System\wTdGzld.exe
  2⤵
  PID:9276
- C:\Windows\System\qLUqQTE.exe
  C:\Windows\System\qLUqQTE.exe
  2⤵
  PID:9292
- C:\Windows\System\fSTqDCX.exe
  C:\Windows\System\fSTqDCX.exe
  2⤵
  PID:9308
- C:\Windows\System\USbXCEF.exe
  C:\Windows\System\USbXCEF.exe
  2⤵
  PID:9324
- C:\Windows\System\robkdjA.exe
  C:\Windows\System\robkdjA.exe
  2⤵
  PID:9344
- C:\Windows\System\pTqomHv.exe
  C:\Windows\System\pTqomHv.exe
  2⤵
  PID:9360
- C:\Windows\System\CdUEGyv.exe
  C:\Windows\System\CdUEGyv.exe
  2⤵
  PID:9376
- C:\Windows\System\hPwYUKU.exe
  C:\Windows\System\hPwYUKU.exe
  2⤵
  PID:9392
- C:\Windows\System\qTBjeEx.exe
  C:\Windows\System\qTBjeEx.exe
  2⤵
  PID:9408
- C:\Windows\System\HaRdevO.exe
  C:\Windows\System\HaRdevO.exe
  2⤵
  PID:9424
- C:\Windows\System\fYSWMzw.exe
  C:\Windows\System\fYSWMzw.exe
  2⤵
  PID:9440
- C:\Windows\System\iJMoURK.exe
  C:\Windows\System\iJMoURK.exe
  2⤵
  PID:9456
- C:\Windows\System\zXjYGwd.exe
  C:\Windows\System\zXjYGwd.exe
  2⤵
  PID:9476
- C:\Windows\System\sgusbiD.exe
  C:\Windows\System\sgusbiD.exe
  2⤵
  PID:9492
- C:\Windows\System\AXKcqJP.exe
  C:\Windows\System\AXKcqJP.exe
  2⤵
  PID:9508
- C:\Windows\System\AxxJmZU.exe
  C:\Windows\System\AxxJmZU.exe
  2⤵
  PID:9524
- C:\Windows\System\Buihynf.exe
  C:\Windows\System\Buihynf.exe
  2⤵
  PID:9540
- C:\Windows\System\kEhQwZC.exe
  C:\Windows\System\kEhQwZC.exe
  2⤵
  PID:9556
- C:\Windows\System\MeBMwlk.exe
  C:\Windows\System\MeBMwlk.exe
  2⤵
  PID:9576
- C:\Windows\System\CGzPqzh.exe
  C:\Windows\System\CGzPqzh.exe
  2⤵
  PID:9592
- C:\Windows\System\iQLrMmc.exe
  C:\Windows\System\iQLrMmc.exe
  2⤵
  PID:9608
- C:\Windows\System\TedOWGh.exe
  C:\Windows\System\TedOWGh.exe
  2⤵
  PID:9624
- C:\Windows\System\fEUoPLN.exe
  C:\Windows\System\fEUoPLN.exe
  2⤵
  PID:9640
- C:\Windows\System\NHvsBAZ.exe
  C:\Windows\System\NHvsBAZ.exe
  2⤵
  PID:9660
- C:\Windows\System\mxlpNPK.exe
  C:\Windows\System\mxlpNPK.exe
  2⤵
  PID:9676
- C:\Windows\System\vWnHawC.exe
  C:\Windows\System\vWnHawC.exe
  2⤵
  PID:9692
- C:\Windows\System\ohjYirh.exe
  C:\Windows\System\ohjYirh.exe
  2⤵
  PID:9708
- C:\Windows\System\AsQgmpd.exe
  C:\Windows\System\AsQgmpd.exe
  2⤵
  PID:9724
- C:\Windows\System\EURlqdd.exe
  C:\Windows\System\EURlqdd.exe
  2⤵
  PID:9740
- C:\Windows\System\zNmDNMj.exe
  C:\Windows\System\zNmDNMj.exe
  2⤵
  PID:9760
- C:\Windows\System\qLafQXB.exe
  C:\Windows\System\qLafQXB.exe
  2⤵
  PID:9776
- C:\Windows\System\auAakSy.exe
  C:\Windows\System\auAakSy.exe
  2⤵
  PID:9792
- C:\Windows\System\BmjncDU.exe
  C:\Windows\System\BmjncDU.exe
  2⤵
  PID:9808
- C:\Windows\System\OsOWjdA.exe
  C:\Windows\System\OsOWjdA.exe
  2⤵
  PID:9824
- C:\Windows\System\BPavJIV.exe
  C:\Windows\System\BPavJIV.exe
  2⤵
  PID:9840
- C:\Windows\System\xPjwgoG.exe
  C:\Windows\System\xPjwgoG.exe
  2⤵
  PID:9856
- C:\Windows\System\WHDSPQu.exe
  C:\Windows\System\WHDSPQu.exe
  2⤵
  PID:9872
- C:\Windows\System\FYBHueB.exe
  C:\Windows\System\FYBHueB.exe
  2⤵
  PID:9888
- C:\Windows\System\YizaLkg.exe
  C:\Windows\System\YizaLkg.exe
  2⤵
  PID:9904
- C:\Windows\System\wrihnHE.exe
  C:\Windows\System\wrihnHE.exe
  2⤵
  PID:9920
- C:\Windows\System\acTqlRS.exe
  C:\Windows\System\acTqlRS.exe
  2⤵
  PID:9936
- C:\Windows\System\udBexCl.exe
  C:\Windows\System\udBexCl.exe
  2⤵
  PID:9952
- C:\Windows\System\mfWZtcl.exe
  C:\Windows\System\mfWZtcl.exe
  2⤵
  PID:9968
- C:\Windows\System\VwnwgXr.exe
  C:\Windows\System\VwnwgXr.exe
  2⤵
  PID:9984
- C:\Windows\System\ejnkoOk.exe
  C:\Windows\System\ejnkoOk.exe
  2⤵
  PID:10000
- C:\Windows\System\ywQDXfv.exe
  C:\Windows\System\ywQDXfv.exe
  2⤵
  PID:10016
- C:\Windows\System\GRdHuLU.exe
  C:\Windows\System\GRdHuLU.exe
  2⤵
  PID:10036
- C:\Windows\System\zxnWTYT.exe
  C:\Windows\System\zxnWTYT.exe
  2⤵
  PID:10072
- C:\Windows\System\oQwLWwz.exe
  C:\Windows\System\oQwLWwz.exe
  2⤵
  PID:10088
- C:\Windows\System\lQwoWyV.exe
  C:\Windows\System\lQwoWyV.exe
  2⤵
  PID:10104
- C:\Windows\System\PnekWOi.exe
  C:\Windows\System\PnekWOi.exe
  2⤵
  PID:10120
- C:\Windows\System\KQAmqDG.exe
  C:\Windows\System\KQAmqDG.exe
  2⤵
  PID:10140
- C:\Windows\System\EzdxRlW.exe
  C:\Windows\System\EzdxRlW.exe
  2⤵
  PID:10156
- C:\Windows\System\fkrdzOU.exe
  C:\Windows\System\fkrdzOU.exe
  2⤵
  PID:10172
- C:\Windows\System\EwjfTHD.exe
  C:\Windows\System\EwjfTHD.exe
  2⤵
  PID:10196
- C:\Windows\System\HNqaDfs.exe
  C:\Windows\System\HNqaDfs.exe
  2⤵
  PID:10212
- C:\Windows\System\gbJbOgr.exe
  C:\Windows\System\gbJbOgr.exe
  2⤵
  PID:10228
- C:\Windows\System\reACucr.exe
  C:\Windows\System\reACucr.exe
  2⤵
  PID:8744
- C:\Windows\System\mQveeDV.exe
  C:\Windows\System\mQveeDV.exe
  2⤵
  PID:9268
- C:\Windows\System\VELrHLt.exe
  C:\Windows\System\VELrHLt.exe
  2⤵
  PID:9256
- C:\Windows\System\YTdVwVG.exe
  C:\Windows\System\YTdVwVG.exe
  2⤵
  PID:9300
- C:\Windows\System\ozgzoqt.exe
  C:\Windows\System\ozgzoqt.exe
  2⤵
  PID:9332
- C:\Windows\System\AnohkWn.exe
  C:\Windows\System\AnohkWn.exe
  2⤵
  PID:9368
- C:\Windows\System\grrfVhF.exe
  C:\Windows\System\grrfVhF.exe
  2⤵
  PID:9388
- C:\Windows\System\cLnCMwk.exe
  C:\Windows\System\cLnCMwk.exe
  2⤵
  PID:9420
- C:\Windows\System\TztOZoV.exe
  C:\Windows\System\TztOZoV.exe
  2⤵
  PID:9468
- C:\Windows\System\RAKGRkH.exe
  C:\Windows\System\RAKGRkH.exe
  2⤵
  PID:9504
- C:\Windows\System\lbAqkKE.exe
  C:\Windows\System\lbAqkKE.exe
  2⤵
  PID:9800
- C:\Windows\System\TMycuuU.exe
  C:\Windows\System\TMycuuU.exe
  2⤵
  PID:9928
- C:\Windows\System\FfJuTHw.exe
  C:\Windows\System\FfJuTHw.exe
  2⤵
  PID:10052
- C:\Windows\System\aHBvPkk.exe
  C:\Windows\System\aHBvPkk.exe
  2⤵
  PID:10204
- C:\Windows\System\iNDpeYT.exe
  C:\Windows\System\iNDpeYT.exe
  2⤵
  PID:9416
- C:\Windows\System\ohtnpZw.exe
  C:\Windows\System\ohtnpZw.exe
  2⤵
  PID:9564
- C:\Windows\System\ippnBRI.exe
  C:\Windows\System\ippnBRI.exe
  2⤵
  PID:9572
- C:\Windows\System\QKDWtYZ.exe
  C:\Windows\System\QKDWtYZ.exe
  2⤵
  PID:9604
- C:\Windows\System\EqrCAze.exe
  C:\Windows\System\EqrCAze.exe
  2⤵
  PID:9668
- C:\Windows\System\BYGEhHT.exe
  C:\Windows\System\BYGEhHT.exe
  2⤵
  PID:9672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DXEayIE.exe

Filesize
1022KB

MD5
144d7856558139c4642b7921014b3250

SHA1
89d6b33c832cbb7f310b75632b28fc291569238b

SHA256
bcc304bd5de31ae443530f382bb7ab28e3d42d1af0dc37da424eef8a9993fd05

SHA512
20666b3d62145681e083e09206506a3daf353a7b1c70fd736e306dbaf0eb5866810ff8fecb0f2f8b67bedbd3e63059d468e23d960a8f986c7f457e097d498c23

Download Submit
C:\Windows\system\DxckNZH.exe

Filesize
1.0MB

MD5
93b33fe3621d9f34bc98b6842d1d6371

SHA1
1b815727aaa1cccb91e6cadae1f04ac068fa1c74

SHA256
c5359a08a1d5bfbf70314ee51c482f75afe105744779d912e52cc113babeeb38

SHA512
a84c9572150417e697c142e43005a91d8355bca3d4d31b91027b816ceaaebcf83ef30afa270d2b167a3f174dc4edf66c38853ae9321a4fa2511fe1fe2f0e42e8

Download Submit
C:\Windows\system\GMGapDE.exe

Filesize
1021KB

MD5
9471976c748eed446e23673051a3bcf4

SHA1
c1057556b9dcfc4079e396b52c73781d8686ad24

SHA256
d70df505678dc25611949be91025cd7c38cd07a511b3066580ba1d369983d108

SHA512
2a2f004e0ce4132a783dbf5dac738df183cd0f5c67591201bdfbe0f862d04ad56422d61daee10fe5c33f82fd995eb950ff3b6d375ec20ccd63ae8336881f69fb

Download Submit
C:\Windows\system\HbQbNNa.exe

Filesize
1023KB

MD5
cb4ce8600b4df60e4d97f1b89096c41b

SHA1
958c4b80bcc57fb1c27f5f37a47f2f8bee8939cd

SHA256
149662d391287b376bd87154a032e9c9781b91cd17432b32a6e55e680606dd9e

SHA512
d4c9d85dfeea500829ab1491db9126cca25c01c0acbcca20d311a6543d4f04d9b2d8970bb9471fd9508e16ec2e7a2bab0f4cad60281af795b5ead14821da6a63

Download Submit
C:\Windows\system\HulrOfx.exe

Filesize
1021KB

MD5
e6a4bb42aef2e22560bbc87d55f4ac7e

SHA1
38708ccec07a40f335ef0342926ba11b61e83392

SHA256
b154e8a47c943dd0aee0ed292152021c89f83c10e5fab4d503b7f2ef656a973a

SHA512
a0227660516851ed64303fe37778930556e5a3541d88229ac8b72b944814e83247e94490eccb44c33dbbaed5e0173327dc9a635d0d10be61fbafff758e49cc3f

Download Submit
C:\Windows\system\NzWtiOM.exe

Filesize
1021KB

MD5
8d549b1ccd3ffb51cc3a1932bfe12223

SHA1
278c8cc6bc7e2529ee91e518e2e6124a578bb42d

SHA256
ed5aacffa35da7fbefb32e6df529fb887476c6c4203fa2a9c31724543f82b498

SHA512
6e3d2486a6344c72acc15518ad135d42868e7ebdf536beabe68b2046a4f86ef61e50f845882591dbc330ccc76bbc2653e415d78c185a34f65fcc118dcd3e07b7

Download Submit
C:\Windows\system\PDTeNiq.exe

Filesize
1.0MB

MD5
c23ad10502d8e2152e74942c92227ac2

SHA1
d336b1d19614219de42225df27a66c8c0bc5788e

SHA256
89075e500bb1852d78ac081999db6e57d5e78e515c30eeaa3918752f9b636979

SHA512
335986e4e78c470020f0559a740c818d04b6f62254127bee679d228b03208efb05259d7e0ff6cc074168863fe44edf1f9314dbd4bf44fd10bc15cd137df1dfdd

Download Submit
C:\Windows\system\PUwUSsP.exe

Filesize
1023KB

MD5
d76440e51680ab4f183b3fb5f33b9f08

SHA1
0d1531ae0278784dc8662be799fbbd3bdcc9b162

SHA256
25c4d6bf0d5d5fc9c7bf9f704fb61d8cacc83dcb1c4a3cabad67d3445516f6e0

SHA512
9688a231cf383dea95faa72e5c084f756580c81d13d26f3129395f9b9efb9526879c7923db8f75540a5787e6c64f749be8aa2e7cab310273e1ac629abe78b5a4

Download Submit
C:\Windows\system\RiCYTvL.exe

Filesize
1.0MB

MD5
60915804a630b8dd33eb34049478759d

SHA1
5e9ceecbb35e48dc116b359e602789d427ab0b8a

SHA256
135e44ae5f2741e05ff65266b4ad3767e2533654b0a4b0ffa75160628284a0df

SHA512
e32e1db19b2ed3eba31d9db348bba60c79c8f2c7bece8e37ad8c432fb4c34d9999dc76ea93b0b34717f4956504e87ea68754076fb3211838305642288784bd55

Download Submit
C:\Windows\system\WgRNifA.exe

Filesize
1022KB

MD5
8a315b68c1dbbc5a96f6915e1423176e

SHA1
d3cfe7477861820910de9172b1d16b01f0fd4388

SHA256
0f5398c25e36a4ea6d36ee25bf585232df07b4f9126dc0a32a06b0de5d8e46c1

SHA512
62f99494b40eec51054e8a0f6239c002298bc602426e566cd77a6ac105b1ffbfced847f720d37edac3e6986338a24a475b550fc830b3222f8a9d420d0f3c5233

Download Submit
C:\Windows\system\ZTkfByn.exe

Filesize
1022KB

MD5
f8888abff8bbba54cf61b0308fb8bacd

SHA1
663a04d374b7e9a26ab1ed9bb1238fdaa11ec21f

SHA256
9a4a839af2c4a0ecbd87f02c32a0d1ba3cc6b1ad027f8988b6d3a9cce9643d2d

SHA512
d31a65eb29bfa168b06716c319f238a3e956442f279df6c3cae33281ecc029549cd9d330bb554cc81e8cd2154d01b76acead134fb090c9b6365c37a1543a93f3

Download Submit
C:\Windows\system\bdenhBX.exe

Filesize
1.0MB

MD5
11a07fe88e5ecd98c3c79e037b8bd587

SHA1
2ea19f6485c880cfd10e9ee65df3a7b7c672d464

SHA256
3d2c1bb6da4741b2377445a1d5583519d81626a7734587c6bebb4be4a6ed0675

SHA512
a515ebc7e537de4f333a6019e07c7386f1f1da9c50c8c74062606917ae7bf32c0b39a36b7824607f8e42d27474823faa1853627e829ad945ff60cf2184f893cc

Download Submit
C:\Windows\system\dvDGlBL.exe

Filesize
1.0MB

MD5
a554c0739ed31c93564470782f454c35

SHA1
103446eb678b6df5a3d6848096f77c872efc6111

SHA256
433c257a8c8a67a29b279814d30245e20de10d362d20779dc168bbaeb10e0ac6

SHA512
f74f7eb6be0ad65e6961bbb09ace7467b0347a4c71ce8928c5ac003942855070e0be748d22b414da8196a3301458e38ac329fd438f068b7eed14aca9a3c62fbc

Download Submit
C:\Windows\system\fKfZkts.exe

Filesize
1021KB

MD5
bb6ecc1e0833931619e873154042f0c7

SHA1
42135eac4e4757acd0f4652721009b972dee0eba

SHA256
ef43bcfd3fd98cc51609681d27b9fd67c4e7c451971753b852b10cad8c8a0dd2

SHA512
9ea5688981b2e1a27e0cf069f501a3c1e16195988bdfd4d65707341cbe6b13ab0a7a227a3d271f21411eb0bca121e8c209d9720e7fedfe7be8ae1d8ba4483bec

Download Submit
C:\Windows\system\hTbgGYL.exe

Filesize
1.0MB

MD5
6017a9db338a5f5f03b04cd806646891

SHA1
c218697feb7df4bf64224c537a90534e48bba6fd

SHA256
5857836d24205ca7ddd710d3ca188a20adc8d864633903597c9051aa244f639d

SHA512
a6764eb73ad262212ff2f5a47b1813c074e0c722869c09cb06674c134bc9a12b7a2d62400fd6607f5e4cc67c47c4d0dcbcd218c117a9094ae03780d585d093d1

Download Submit
C:\Windows\system\jUYvfQw.exe

Filesize
1.0MB

MD5
aa919495bb05e61b42a680b81d6c2417

SHA1
0170a4396b8d7223b85bb031d1a7c425b8a53308

SHA256
4bf7e9ef83689cef6ed3c0f806f96fd3c92f0f5f5402b2a55fc3362488d18a51

SHA512
27112f019c3f33844290f089836f4cec9763ebc9f16e363b6593ade1905cc8dd57c00ee5955f38919bbed3f34d7fde87ca0823ed4a842cc41cfe6136fc117538

Download Submit
C:\Windows\system\jwpFlxf.exe

Filesize
1.0MB

MD5
e39e99271ea13ea61cde3e48c1bb8483

SHA1
ed4aa82fa499f0e2d9cf715f987aded5ea88fd44

SHA256
00c71a580d678019b7d72d6e018d0aec1f17011d21c3affd1e68df5f310acf8a

SHA512
a1c264c3946f7b7f9dddf1e6557a8bc18f417a434088bce288925e4f0eb0c69509347d532477c15a062a6874f666185fa43336ff55cdf4ae8e89a857b8b0ee39

Download Submit
C:\Windows\system\mLpKliN.exe

Filesize
1023KB

MD5
6af96dc7419a79eef0b87851976b8adf

SHA1
3f8fea656e3555de2308ad196c5a080ad4b9bd50

SHA256
a9880755508d2fee31496ec9cf6331457475ac2dd1e54b86bfa297b842f26d72

SHA512
ad4559be079670edab997be6fbacad6cf55d695a5b3b6cee7360199a12942efa9f2bf8c67e95003c60b33734514368c41202c6827e661542e0a8514134064e59

Download Submit
C:\Windows\system\meNlqwn.exe

Filesize
1020KB

MD5
0dc80645dd988ce68da4268e0e1e76fc

SHA1
6a46cf3b01645a4cc4372f960397f95f83285c38

SHA256
dad69a59f5d8cdb2eb30a5f51b4a90ce02685387f903192c1aa79e660e10fbd5

SHA512
6fc9ab7f06152c8350b7f623cdd7d830e03256433dfb41d4cf6376f5ddcc4c0e339b87ce0409e00369fb4dc6cf708b1cdb41efb5c7f05a25fdaaaf63fe75ce4f

Download Submit
C:\Windows\system\nFOHexN.exe

Filesize
1.0MB

MD5
73a998cbc0c7b83501a92b1ce60562b5

SHA1
40d04bed96adf9d0b7a04684209f87e5f6cc658b

SHA256
d6af5b0d6e6439c6d48d6d9fdd7ac556b265c2c4461ae3ea4652294aee5fccfd

SHA512
79fb35417f4068d5c61f3e584c97b1dd3f8adc27f60cd4065a6326acb7027629ceae06c2670a464bae7c606df1360c2694c79e6ec9ce1df01f47af0df8b6f1fa

Download Submit
C:\Windows\system\oQuxkdi.exe

Filesize
1.0MB

MD5
f79915752b391603db2a098d4cf4b28e

SHA1
bda89b10dd30d6e3b104e4f1e29526270e09c0d2

SHA256
f936f002b49b14ea3b4258ad791371e73f81b851df4c60bb0e5a93fe7358c369

SHA512
8be9872401a03109130641fc769c30e00037941618c1b6aab5a035eb35f0550a2b69abde8986b1a382e32d0685adf05995abb6dfff047bca03e670507e94a3a3

Download Submit
C:\Windows\system\oRrwyyZ.exe

Filesize
1020KB

MD5
84c3cd4362d54c6bdfb98d97a70d2860

SHA1
a15d8dd1b61f0769432e8450574298d382cfcc71

SHA256
a3b54a7343670d86e2c55a52f1491408eb87a9464fe4b8ada048fe3d9315b3c7

SHA512
420898daf1afb25dc223bbb096e7d32304e24e74915fe5214b77e35f33b27b61839cf4dd196a5471ea894775a5a486a6b6db9cc3b1066e5378723df4ce6bbc2e

Download Submit
C:\Windows\system\prasDAb.exe

Filesize
1020KB

MD5
4cbaebca7b91423ed7d74e34dffed797

SHA1
ee990e8e1cf4b29f13e3d78bb3b68d3c44332eac

SHA256
8258a465a585247c512b0a514a69e0d21295d14ec309db1dd6042f501c24bb3b

SHA512
b25674f26cbe388aaf61813279e76ffe9e1eb173c87dd91cf1cb58e4349156c9f530488db4dd0809f72f19688ebdd007e8712c7363968bd0ff9647dbe6ffb99b

Download Submit
C:\Windows\system\qlhuXGA.exe

Filesize
1023KB

MD5
1fb1b65ba5e5def03177f7d751ed82db

SHA1
02dab8c2d4a1dc8c0270437b9fc12e7bda0f80cd

SHA256
31d3ec000ed1b1b2282c5beac671915ff71a9ab85c1fd28608654401a982dda6

SHA512
ad5681aa2a81797166b72ce243d4032ae73c245924f0f8f13e6a90218e80b92e9eb4c37649b4362eb5265f1161e76c608f4513cfa1efed65ab14be8ca7e05cbb

Download Submit
C:\Windows\system\rvgyKfB.exe

Filesize
1022KB

MD5
ef7a25d163e2a129534817a56388a458

SHA1
38b7aa0ef0c31989cffde95477ce25cb0929c0ed

SHA256
ea73155f44421f39943cd07dc020e2e13def01a4769be2757bc0e5c95ed707f9

SHA512
77fd036ba28a3588fcf9c3e781d9638f6a0f372436206e4c3dea5e2955d09a06aaeddc7b472d2a6cc6e0c08585dbc7cb73d450a094a75073a6cfe46da10bfefc

Download Submit
C:\Windows\system\wKIzavV.exe

Filesize
1.0MB

MD5
d455d63eb7607519c6c3dbc576b55001

SHA1
1e8c82033914f28a71e85a86c8fe8947f59db0fb

SHA256
05c697639ccec6903181c2a1d60958e402174cbcfaab7b1d0be5ae3b33bd4cac

SHA512
5c747dca54062acc7c2d0babad393a4d068f2849bbd486da39de16a81810514688d8724171cb21f1311ff962d1b2e61b3cb1abb45c5d9cc717df00590005d8cc

Download Submit
C:\Windows\system\zRGOYXR.exe

Filesize
1.0MB

MD5
8554d14e1a4e28fd4abe3eef973276b9

SHA1
be85c0012e2019b86bf43f1048adf222f9031003

SHA256
168b05b4ab31f71b86afcbba2fcc2a2cac45461962441ae237b43b1adb0b5da6

SHA512
1e6299ca1ec4d1af75b4544b1bb109b62124c792b518d1ce0e3f88ad6b15a07e1fbd116e304a7ca5615e325b9da18c4f897256f7f2bcbf45a87dc072750a0a53

Download Submit
C:\Windows\system\zTGiWlx.exe

Filesize
1.0MB

MD5
863d5e0284ee3e46cd6121493a2b23dd

SHA1
1961d406821995d315e7c0a0b2fba3a7017e6b00

SHA256
ab184957bf57cd66b3d1b1e29f48a419fa171263db0639271e67d5ce08d0bb8c

SHA512
e183dcfe1ab1ee47676f49fe90198413647ea4d26e0c7165f80e9ab5c57acd4ce8a6c2b268cfed2d244aad44b7f35f815587fee499ecee3cd08b5f5399225ae1

Download Submit
\Windows\system\FRRMWgI.exe

Filesize
1020KB

MD5
9e2c8e095130417fa04f7731eecfce6e

SHA1
a723b4327422c24c75a7566c443131bb806a5945

SHA256
8bd4a30f1623acab454963f00f50100689c6878334e0a4e6a4d269a55ae9ec18

SHA512
4ccf44aa7e7d0192c25861806d744a68bed507056a09425fbca3329f8956e499e00aaf061014725d7b64cc678ad808a4f8df6f95a61a3b35b87001591f15a484

Download Submit
\Windows\system\SJgXlwg.exe

Filesize
1019KB

MD5
4947fecdbbf185205b1e32000a6c7f04

SHA1
5d3c02cd2619d75b6efecb181f22df81a0c13345

SHA256
31366047a11bea9cd444d487bb62e4ca3c519ac8d48ced2cae1e920dd05344db

SHA512
2929ba726c5d32b467dc667649c60ad0b6bdf282f8ab1de27438c027297ec1613c2a598a901141e3e2e924ef22ca759aa741a171e4c11a79b291e1a9f7f7b297

Download Submit
\Windows\system\XgsXYYB.exe

Filesize
1.0MB

MD5
bc98f5fae96d3d1b0efb88d5e1a8abdf

SHA1
0f87863513cd95ab9486cf125f19e0da8f3245c2

SHA256
280c04edc52b00675ac98307d30932b5aaabd7916d4c8a7fd36091505f8169c8

SHA512
b6a43c3541a6e1958263d715fd3ae7579fb9d3c261a4fc07f3672f632c79f00a7d92384cafee813c890954ff6b431da1460191eccc3510d8a386c9114a7b441e

Download Submit
\Windows\system\qecoIph.exe

Filesize
1019KB

MD5
dc6059c229896070a19c6aeba1551b29

SHA1
76e7ebed8c52595f4c06ed7b8b0d8da2c82a96c9

SHA256
a5ec90cdd15011c039bcdb59436d73df955a480bb5a988991ad9a1e48abbf418

SHA512
61059a0fa941cc86b0eb625bdff17779c8a43557e998d27132f822125dcecfaba5e25129d3bdd4037c4b328e497d63a9c1bf3aa29c21ca0350423a72a8e4320e

Download Submit
memory/1844-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download