xmrig | 0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348

Analysis

max time kernel
130s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
Size

941KB
MD5

43a52a47b4c315abfb0e029c22a7c1c0
SHA1

0d68b1e94860b12e93f63aadbae0704a5794f30b
SHA256

0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348
SHA512

80c709057da10f997feed3b69eaa2784132a4c933ee67f9781bf183201392e6168a52e4754d8abe8b5c2b5feb4c21c089c2d0f904c13cc975805a9aa24be7788
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenABWelqLBG:GezaTF8FcNkNdfE0pZ9oztFwIKTLQ

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0009000000012281-2.dat	xmrig
behavioral1/files/0x002b000000015561-6.dat	xmrig
behavioral1/files/0x0009000000015c2f-17.dat	xmrig
behavioral1/files/0x002c000000015602-14.dat	xmrig
behavioral1/files/0x0007000000015c58-21.dat	xmrig
behavioral1/files/0x0007000000015c60-29.dat	xmrig
behavioral1/files/0x0007000000015c68-31.dat	xmrig
behavioral1/files/0x0009000000015c79-37.dat	xmrig
behavioral1/files/0x0008000000015c83-43.dat	xmrig
behavioral1/files/0x000600000001644e-49.dat	xmrig
behavioral1/files/0x00060000000165fd-58.dat	xmrig
behavioral1/files/0x0006000000016812-65.dat	xmrig
behavioral1/files/0x0006000000016af1-70.dat	xmrig
behavioral1/files/0x0006000000016c07-73.dat	xmrig
behavioral1/files/0x0006000000016c21-79.dat	xmrig
behavioral1/files/0x0006000000016c2a-83.dat	xmrig
behavioral1/files/0x0006000000016c9d-91.dat	xmrig
behavioral1/files/0x0006000000016ccb-95.dat	xmrig
behavioral1/files/0x0006000000016cfe-115.dat	xmrig
behavioral1/files/0x0006000000016d0a-119.dat	xmrig
behavioral1/files/0x0006000000016d0f-123.dat	xmrig
behavioral1/files/0x0006000000016d4c-135.dat	xmrig
behavioral1/files/0x0006000000016d94-144.dat	xmrig
behavioral1/files/0x0006000000016d5b-139.dat	xmrig
behavioral1/files/0x0006000000016d3c-131.dat	xmrig
behavioral1/files/0x0006000000016d2b-128.dat	xmrig
behavioral1/files/0x0006000000016cf8-111.dat	xmrig
behavioral1/files/0x0006000000016cec-107.dat	xmrig
behavioral1/files/0x0006000000016ce4-103.dat	xmrig
behavioral1/files/0x0006000000016cdc-99.dat	xmrig
behavioral1/files/0x0006000000016c76-87.dat	xmrig
behavioral1/files/0x000600000001657c-54.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1228	uLBopwc.exe
2680	yMAkcjI.exe
2020	xZYtHLA.exe
2712	hkxvRop.exe
2740	lTrFQyq.exe
2612	pNRSinb.exe
2696	iThQoTP.exe
2604	ZaucqtD.exe
1636	ERcvkwQ.exe
2500	NsFhDHB.exe
2564	CeQUQwT.exe
2900	cybjbIX.exe
2200	VEGYerx.exe
764	taXiutd.exe
2040	erZUUtQ.exe
516	aboQJYW.exe
1712	weqAUXI.exe
1716	OylOKLM.exe
752	EWEvAlx.exe
1688	DLojold.exe
1604	ukRJSKW.exe
1008	fXAgsCx.exe
1640	KvbPGWB.exe
1276	MfSWXnV.exe
2428	mTlvtYJ.exe
2416	qXPUfjp.exe
748	rpUtdmU.exe
928	DHjjJos.exe
1112	UIPDFWc.exe
1436	UrwhlXT.exe
1132	zcSYlnH.exe
1232	QvUBkOI.exe
1512	OdtTJca.exe
1188	vrzaCMp.exe
2776	adMyuIB.exe
2672	mepHsKm.exe
2792	BDTJfTK.exe
2664	achoORg.exe
3064	XFNxpho.exe
1984	kwfwxuH.exe
396	YtBYEjA.exe
2332	vGXzcap.exe
1124	QruWpdn.exe
964	yudsPZy.exe
1324	MrrCciE.exe
2556	PHYuLhq.exe
1052	cVzhTUB.exe
1576	nfYyqCh.exe
1320	RLhQYrp.exe
1032	sWqAixx.exe
2872	tIDWfsy.exe
892	eeRwjGR.exe
2148	tTPHiHb.exe
2376	eeKMXYc.exe
2220	bJLxhNM.exe
2944	jtiCMWw.exe
1304	cpxAdml.exe
2888	cRHwAyV.exe
2828	autzsDT.exe
1736	rZLVpQa.exe
2224	noDpivq.exe
1928	uXrjFUQ.exe
1940	nhymIDv.exe
2000	DLNjBCY.exe

Loads dropped DLL 64 IoCs

pid	Process
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bKeLgox.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\GxoCfpb.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\bMMPxux.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\tqKsmdt.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\IbGZjBX.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\fbqDXIw.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\orsRUyv.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\bUNLgVK.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\AFlJtfP.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\RcbvMHK.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\BZyJeTO.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\glZIdMO.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\QQIfHXd.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\qICrhWW.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\LUTQINz.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\MkJrvrc.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\dVvrFgW.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\bGHDxhb.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\kLoFSou.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\XCVRCTb.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\GtEEuBV.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\nmNEnul.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\pJZAPVb.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\xISMcHe.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\eiAMdji.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\ElGwjVy.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\RwbKRsd.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\UTYyHtF.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\BWzmjjO.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\fmtqdym.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\VuXPMDb.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\YPJMFiI.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\eBYOvNh.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\GpGSpVS.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\ZlwHciL.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\aVFzAjK.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\jlZiVCk.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\QzDTljo.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\gGKwjHM.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\xqGpQPw.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\tlUkIdF.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\ZjxxWRU.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\tkSOCmO.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\UupNcle.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\aProGNF.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\Sudahuu.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\gsYopKa.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\TwoYJqX.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\mMsxfWD.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\YMRRhaX.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\JDufLKE.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\vuBwDUP.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\xtLebFY.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\CywHiXE.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\DFBbIqc.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\qPIvEAP.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\FkQLhxS.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\xQJSNez.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\TEEUSDO.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\DEThYif.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\wiCAhwk.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\IFPrWKa.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\KIwZhyy.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\DoznOJE.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1228	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	29
PID 2244 wrote to memory of 1228	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	29
PID 2244 wrote to memory of 1228	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	29
PID 2244 wrote to memory of 2680	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	30
PID 2244 wrote to memory of 2680	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	30
PID 2244 wrote to memory of 2680	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	30
PID 2244 wrote to memory of 2020	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	31
PID 2244 wrote to memory of 2020	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	31
PID 2244 wrote to memory of 2020	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	31
PID 2244 wrote to memory of 2712	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	32
PID 2244 wrote to memory of 2712	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	32
PID 2244 wrote to memory of 2712	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	32
PID 2244 wrote to memory of 2740	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	33
PID 2244 wrote to memory of 2740	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	33
PID 2244 wrote to memory of 2740	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	33
PID 2244 wrote to memory of 2612	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	34
PID 2244 wrote to memory of 2612	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	34
PID 2244 wrote to memory of 2612	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	34
PID 2244 wrote to memory of 2696	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	35
PID 2244 wrote to memory of 2696	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	35
PID 2244 wrote to memory of 2696	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	35
PID 2244 wrote to memory of 2604	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	36
PID 2244 wrote to memory of 2604	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	36
PID 2244 wrote to memory of 2604	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	36
PID 2244 wrote to memory of 1636	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	37
PID 2244 wrote to memory of 1636	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	37
PID 2244 wrote to memory of 1636	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	37
PID 2244 wrote to memory of 2500	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	38
PID 2244 wrote to memory of 2500	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	38
PID 2244 wrote to memory of 2500	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	38
PID 2244 wrote to memory of 2564	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	39
PID 2244 wrote to memory of 2564	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	39
PID 2244 wrote to memory of 2564	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	39
PID 2244 wrote to memory of 2900	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	40
PID 2244 wrote to memory of 2900	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	40
PID 2244 wrote to memory of 2900	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	40
PID 2244 wrote to memory of 2200	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	41
PID 2244 wrote to memory of 2200	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	41
PID 2244 wrote to memory of 2200	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	41
PID 2244 wrote to memory of 764	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	42
PID 2244 wrote to memory of 764	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	42
PID 2244 wrote to memory of 764	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	42
PID 2244 wrote to memory of 2040	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	43
PID 2244 wrote to memory of 2040	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	43
PID 2244 wrote to memory of 2040	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	43
PID 2244 wrote to memory of 516	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	44
PID 2244 wrote to memory of 516	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	44
PID 2244 wrote to memory of 516	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	44
PID 2244 wrote to memory of 1712	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	45
PID 2244 wrote to memory of 1712	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	45
PID 2244 wrote to memory of 1712	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	45
PID 2244 wrote to memory of 1716	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	46
PID 2244 wrote to memory of 1716	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	46
PID 2244 wrote to memory of 1716	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	46
PID 2244 wrote to memory of 752	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	47
PID 2244 wrote to memory of 752	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	47
PID 2244 wrote to memory of 752	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	47
PID 2244 wrote to memory of 1688	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	48
PID 2244 wrote to memory of 1688	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	48
PID 2244 wrote to memory of 1688	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	48
PID 2244 wrote to memory of 1604	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	49
PID 2244 wrote to memory of 1604	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	49
PID 2244 wrote to memory of 1604	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	49
PID 2244 wrote to memory of 1008	2244	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\System\uLBopwc.exe
  C:\Windows\System\uLBopwc.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\yMAkcjI.exe
  C:\Windows\System\yMAkcjI.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\xZYtHLA.exe
  C:\Windows\System\xZYtHLA.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\hkxvRop.exe
  C:\Windows\System\hkxvRop.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\lTrFQyq.exe
  C:\Windows\System\lTrFQyq.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\pNRSinb.exe
  C:\Windows\System\pNRSinb.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\iThQoTP.exe
  C:\Windows\System\iThQoTP.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\ZaucqtD.exe
  C:\Windows\System\ZaucqtD.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\ERcvkwQ.exe
  C:\Windows\System\ERcvkwQ.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\NsFhDHB.exe
  C:\Windows\System\NsFhDHB.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\CeQUQwT.exe
  C:\Windows\System\CeQUQwT.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\cybjbIX.exe
  C:\Windows\System\cybjbIX.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\VEGYerx.exe
  C:\Windows\System\VEGYerx.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\taXiutd.exe
  C:\Windows\System\taXiutd.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\erZUUtQ.exe
  C:\Windows\System\erZUUtQ.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\aboQJYW.exe
  C:\Windows\System\aboQJYW.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\weqAUXI.exe
  C:\Windows\System\weqAUXI.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\OylOKLM.exe
  C:\Windows\System\OylOKLM.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\EWEvAlx.exe
  C:\Windows\System\EWEvAlx.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\DLojold.exe
  C:\Windows\System\DLojold.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\ukRJSKW.exe
  C:\Windows\System\ukRJSKW.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\fXAgsCx.exe
  C:\Windows\System\fXAgsCx.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\KvbPGWB.exe
  C:\Windows\System\KvbPGWB.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\MfSWXnV.exe
  C:\Windows\System\MfSWXnV.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\mTlvtYJ.exe
  C:\Windows\System\mTlvtYJ.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\qXPUfjp.exe
  C:\Windows\System\qXPUfjp.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\rpUtdmU.exe
  C:\Windows\System\rpUtdmU.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\DHjjJos.exe
  C:\Windows\System\DHjjJos.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\UIPDFWc.exe
  C:\Windows\System\UIPDFWc.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\UrwhlXT.exe
  C:\Windows\System\UrwhlXT.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\zcSYlnH.exe
  C:\Windows\System\zcSYlnH.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\QvUBkOI.exe
  C:\Windows\System\QvUBkOI.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\OdtTJca.exe
  C:\Windows\System\OdtTJca.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\vrzaCMp.exe
  C:\Windows\System\vrzaCMp.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\adMyuIB.exe
  C:\Windows\System\adMyuIB.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\BDTJfTK.exe
  C:\Windows\System\BDTJfTK.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\mepHsKm.exe
  C:\Windows\System\mepHsKm.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\achoORg.exe
  C:\Windows\System\achoORg.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\XFNxpho.exe
  C:\Windows\System\XFNxpho.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\kwfwxuH.exe
  C:\Windows\System\kwfwxuH.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\YtBYEjA.exe
  C:\Windows\System\YtBYEjA.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\vGXzcap.exe
  C:\Windows\System\vGXzcap.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\QruWpdn.exe
  C:\Windows\System\QruWpdn.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\yudsPZy.exe
  C:\Windows\System\yudsPZy.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\MrrCciE.exe
  C:\Windows\System\MrrCciE.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\PHYuLhq.exe
  C:\Windows\System\PHYuLhq.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\cVzhTUB.exe
  C:\Windows\System\cVzhTUB.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\nfYyqCh.exe
  C:\Windows\System\nfYyqCh.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\RLhQYrp.exe
  C:\Windows\System\RLhQYrp.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\sWqAixx.exe
  C:\Windows\System\sWqAixx.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\tIDWfsy.exe
  C:\Windows\System\tIDWfsy.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\eeRwjGR.exe
  C:\Windows\System\eeRwjGR.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\tTPHiHb.exe
  C:\Windows\System\tTPHiHb.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\eeKMXYc.exe
  C:\Windows\System\eeKMXYc.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\bJLxhNM.exe
  C:\Windows\System\bJLxhNM.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\jtiCMWw.exe
  C:\Windows\System\jtiCMWw.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\cpxAdml.exe
  C:\Windows\System\cpxAdml.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\cRHwAyV.exe
  C:\Windows\System\cRHwAyV.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\autzsDT.exe
  C:\Windows\System\autzsDT.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\rZLVpQa.exe
  C:\Windows\System\rZLVpQa.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\noDpivq.exe
  C:\Windows\System\noDpivq.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\uXrjFUQ.exe
  C:\Windows\System\uXrjFUQ.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\nhymIDv.exe
  C:\Windows\System\nhymIDv.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\DLNjBCY.exe
  C:\Windows\System\DLNjBCY.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\rKXJBWS.exe
  C:\Windows\System\rKXJBWS.exe
  2⤵
  PID:1648
- C:\Windows\System\pUAVqiC.exe
  C:\Windows\System\pUAVqiC.exe
  2⤵
  PID:2144
- C:\Windows\System\qGeCTNt.exe
  C:\Windows\System\qGeCTNt.exe
  2⤵
  PID:2616
- C:\Windows\System\byuDGNw.exe
  C:\Windows\System\byuDGNw.exe
  2⤵
  PID:2724
- C:\Windows\System\PNsvlCU.exe
  C:\Windows\System\PNsvlCU.exe
  2⤵
  PID:2716
- C:\Windows\System\obWyqUG.exe
  C:\Windows\System\obWyqUG.exe
  2⤵
  PID:2692
- C:\Windows\System\QhRgxMb.exe
  C:\Windows\System\QhRgxMb.exe
  2⤵
  PID:2668
- C:\Windows\System\RJMvfNj.exe
  C:\Windows\System\RJMvfNj.exe
  2⤵
  PID:2512
- C:\Windows\System\QaIqeNg.exe
  C:\Windows\System\QaIqeNg.exe
  2⤵
  PID:2600
- C:\Windows\System\acDgwqZ.exe
  C:\Windows\System\acDgwqZ.exe
  2⤵
  PID:2492
- C:\Windows\System\iKiGXmc.exe
  C:\Windows\System\iKiGXmc.exe
  2⤵
  PID:2652
- C:\Windows\System\vhnwjsS.exe
  C:\Windows\System\vhnwjsS.exe
  2⤵
  PID:2552
- C:\Windows\System\BwKxTWe.exe
  C:\Windows\System\BwKxTWe.exe
  2⤵
  PID:524
- C:\Windows\System\uFlnmIp.exe
  C:\Windows\System\uFlnmIp.exe
  2⤵
  PID:2468
- C:\Windows\System\YAIIxXj.exe
  C:\Windows\System\YAIIxXj.exe
  2⤵
  PID:364
- C:\Windows\System\fPYKZOU.exe
  C:\Windows\System\fPYKZOU.exe
  2⤵
  PID:2188
- C:\Windows\System\ZhXWOIp.exe
  C:\Windows\System\ZhXWOIp.exe
  2⤵
  PID:1684
- C:\Windows\System\omXyevC.exe
  C:\Windows\System\omXyevC.exe
  2⤵
  PID:1616
- C:\Windows\System\wJbaFmQ.exe
  C:\Windows\System\wJbaFmQ.exe
  2⤵
  PID:2396
- C:\Windows\System\wnNWhzt.exe
  C:\Windows\System\wnNWhzt.exe
  2⤵
  PID:924
- C:\Windows\System\FIcRlyP.exe
  C:\Windows\System\FIcRlyP.exe
  2⤵
  PID:1260
- C:\Windows\System\ExUWJWf.exe
  C:\Windows\System\ExUWJWf.exe
  2⤵
  PID:1796
- C:\Windows\System\NKloqnV.exe
  C:\Windows\System\NKloqnV.exe
  2⤵
  PID:1396
- C:\Windows\System\eWXYWRt.exe
  C:\Windows\System\eWXYWRt.exe
  2⤵
  PID:2780
- C:\Windows\System\AtJEdZN.exe
  C:\Windows\System\AtJEdZN.exe
  2⤵
  PID:1668
- C:\Windows\System\yfczccy.exe
  C:\Windows\System\yfczccy.exe
  2⤵
  PID:2996
- C:\Windows\System\OmlYqiK.exe
  C:\Windows\System\OmlYqiK.exe
  2⤵
  PID:1704
- C:\Windows\System\YTSfonC.exe
  C:\Windows\System\YTSfonC.exe
  2⤵
  PID:1804
- C:\Windows\System\KLyUtTx.exe
  C:\Windows\System\KLyUtTx.exe
  2⤵
  PID:3020
- C:\Windows\System\ofqxEyj.exe
  C:\Windows\System\ofqxEyj.exe
  2⤵
  PID:1772
- C:\Windows\System\jeUIflt.exe
  C:\Windows\System\jeUIflt.exe
  2⤵
  PID:2508
- C:\Windows\System\uVORKhR.exe
  C:\Windows\System\uVORKhR.exe
  2⤵
  PID:2192
- C:\Windows\System\jWfPqBg.exe
  C:\Windows\System\jWfPqBg.exe
  2⤵
  PID:824
- C:\Windows\System\owizGwk.exe
  C:\Windows\System\owizGwk.exe
  2⤵
  PID:1040
- C:\Windows\System\gyKtWDj.exe
  C:\Windows\System\gyKtWDj.exe
  2⤵
  PID:1428
- C:\Windows\System\YUrdxod.exe
  C:\Windows\System\YUrdxod.exe
  2⤵
  PID:1336
- C:\Windows\System\fyXwyCn.exe
  C:\Windows\System\fyXwyCn.exe
  2⤵
  PID:2276
- C:\Windows\System\OJMMqib.exe
  C:\Windows\System\OJMMqib.exe
  2⤵
  PID:2004
- C:\Windows\System\zTxNVEa.exe
  C:\Windows\System\zTxNVEa.exe
  2⤵
  PID:616
- C:\Windows\System\tPuztMI.exe
  C:\Windows\System\tPuztMI.exe
  2⤵
  PID:1272
- C:\Windows\System\CvqhteH.exe
  C:\Windows\System\CvqhteH.exe
  2⤵
  PID:2260
- C:\Windows\System\LousKgl.exe
  C:\Windows\System\LousKgl.exe
  2⤵
  PID:2132
- C:\Windows\System\rluIoiX.exe
  C:\Windows\System\rluIoiX.exe
  2⤵
  PID:1844
- C:\Windows\System\ryOAevz.exe
  C:\Windows\System\ryOAevz.exe
  2⤵
  PID:2832
- C:\Windows\System\SzPogOS.exe
  C:\Windows\System\SzPogOS.exe
  2⤵
  PID:2852
- C:\Windows\System\fjXVXGI.exe
  C:\Windows\System\fjXVXGI.exe
  2⤵
  PID:1028
- C:\Windows\System\PJpwOul.exe
  C:\Windows\System\PJpwOul.exe
  2⤵
  PID:1816
- C:\Windows\System\oKXyyYe.exe
  C:\Windows\System\oKXyyYe.exe
  2⤵
  PID:2300
- C:\Windows\System\ztcFGsK.exe
  C:\Windows\System\ztcFGsK.exe
  2⤵
  PID:2064
- C:\Windows\System\eGAdFaD.exe
  C:\Windows\System\eGAdFaD.exe
  2⤵
  PID:3060
- C:\Windows\System\niueazi.exe
  C:\Windows\System\niueazi.exe
  2⤵
  PID:2568
- C:\Windows\System\QJlmVAJ.exe
  C:\Windows\System\QJlmVAJ.exe
  2⤵
  PID:884
- C:\Windows\System\LtvehrC.exe
  C:\Windows\System\LtvehrC.exe
  2⤵
  PID:2920
- C:\Windows\System\TjwdSoK.exe
  C:\Windows\System\TjwdSoK.exe
  2⤵
  PID:1532
- C:\Windows\System\YkeUQEh.exe
  C:\Windows\System\YkeUQEh.exe
  2⤵
  PID:1564
- C:\Windows\System\iAPdStY.exe
  C:\Windows\System\iAPdStY.exe
  2⤵
  PID:3044
- C:\Windows\System\UAOCkNz.exe
  C:\Windows\System\UAOCkNz.exe
  2⤵
  PID:2820
- C:\Windows\System\DLbOtug.exe
  C:\Windows\System\DLbOtug.exe
  2⤵
  PID:1312
- C:\Windows\System\kkVdaWY.exe
  C:\Windows\System\kkVdaWY.exe
  2⤵
  PID:2940
- C:\Windows\System\CuICTyO.exe
  C:\Windows\System\CuICTyO.exe
  2⤵
  PID:2364
- C:\Windows\System\fmpbYtr.exe
  C:\Windows\System\fmpbYtr.exe
  2⤵
  PID:112
- C:\Windows\System\ANFdHRe.exe
  C:\Windows\System\ANFdHRe.exe
  2⤵
  PID:2580
- C:\Windows\System\XuOuXEZ.exe
  C:\Windows\System\XuOuXEZ.exe
  2⤵
  PID:2772
- C:\Windows\System\IUdZHMj.exe
  C:\Windows\System\IUdZHMj.exe
  2⤵
  PID:836
- C:\Windows\System\kiDZDDY.exe
  C:\Windows\System\kiDZDDY.exe
  2⤵
  PID:1976
- C:\Windows\System\wVLcMSe.exe
  C:\Windows\System\wVLcMSe.exe
  2⤵
  PID:1080
- C:\Windows\System\OMcFtVo.exe
  C:\Windows\System\OMcFtVo.exe
  2⤵
  PID:788
- C:\Windows\System\RdROGez.exe
  C:\Windows\System\RdROGez.exe
  2⤵
  PID:1748
- C:\Windows\System\oXoifhw.exe
  C:\Windows\System\oXoifhw.exe
  2⤵
  PID:2784
- C:\Windows\System\ImMSExh.exe
  C:\Windows\System\ImMSExh.exe
  2⤵
  PID:2272
- C:\Windows\System\BYBudVK.exe
  C:\Windows\System\BYBudVK.exe
  2⤵
  PID:1956
- C:\Windows\System\AlzbtQV.exe
  C:\Windows\System\AlzbtQV.exe
  2⤵
  PID:1676
- C:\Windows\System\txDdJSU.exe
  C:\Windows\System\txDdJSU.exe
  2⤵
  PID:1268
- C:\Windows\System\OUsUOjE.exe
  C:\Windows\System\OUsUOjE.exe
  2⤵
  PID:2436
- C:\Windows\System\QarqNeH.exe
  C:\Windows\System\QarqNeH.exe
  2⤵
  PID:1568
- C:\Windows\System\TaOpZjd.exe
  C:\Windows\System\TaOpZjd.exe
  2⤵
  PID:1104
- C:\Windows\System\wYtESHJ.exe
  C:\Windows\System\wYtESHJ.exe
  2⤵
  PID:2236
- C:\Windows\System\NOEEFDp.exe
  C:\Windows\System\NOEEFDp.exe
  2⤵
  PID:2956
- C:\Windows\System\nnFipZr.exe
  C:\Windows\System\nnFipZr.exe
  2⤵
  PID:3028
- C:\Windows\System\iQkxWrg.exe
  C:\Windows\System\iQkxWrg.exe
  2⤵
  PID:2760
- C:\Windows\System\MnJLOEa.exe
  C:\Windows\System\MnJLOEa.exe
  2⤵
  PID:2368
- C:\Windows\System\TuZEiJZ.exe
  C:\Windows\System\TuZEiJZ.exe
  2⤵
  PID:2052
- C:\Windows\System\IbyGPiI.exe
  C:\Windows\System\IbyGPiI.exe
  2⤵
  PID:1932
- C:\Windows\System\KJkoIZl.exe
  C:\Windows\System\KJkoIZl.exe
  2⤵
  PID:1756
- C:\Windows\System\iceWwZp.exe
  C:\Windows\System\iceWwZp.exe
  2⤵
  PID:1740
- C:\Windows\System\VydupSs.exe
  C:\Windows\System\VydupSs.exe
  2⤵
  PID:1656
- C:\Windows\System\JbNwwAA.exe
  C:\Windows\System\JbNwwAA.exe
  2⤵
  PID:2304
- C:\Windows\System\aURQOKi.exe
  C:\Windows\System\aURQOKi.exe
  2⤵
  PID:2592
- C:\Windows\System\HCbMjNu.exe
  C:\Windows\System\HCbMjNu.exe
  2⤵
  PID:2964
- C:\Windows\System\FjKjhwc.exe
  C:\Windows\System\FjKjhwc.exe
  2⤵
  PID:2748
- C:\Windows\System\jarsIcV.exe
  C:\Windows\System\jarsIcV.exe
  2⤵
  PID:2976
- C:\Windows\System\yiUKpTp.exe
  C:\Windows\System\yiUKpTp.exe
  2⤵
  PID:1584
- C:\Windows\System\uWkaGej.exe
  C:\Windows\System\uWkaGej.exe
  2⤵
  PID:672
- C:\Windows\System\YlNDVxe.exe
  C:\Windows\System\YlNDVxe.exe
  2⤵
  PID:948
- C:\Windows\System\buvjsyw.exe
  C:\Windows\System\buvjsyw.exe
  2⤵
  PID:2544
- C:\Windows\System\eHByIGv.exe
  C:\Windows\System\eHByIGv.exe
  2⤵
  PID:480
- C:\Windows\System\deVzZrG.exe
  C:\Windows\System\deVzZrG.exe
  2⤵
  PID:1300
- C:\Windows\System\QBZSnyJ.exe
  C:\Windows\System\QBZSnyJ.exe
  2⤵
  PID:1824
- C:\Windows\System\xgYoSEn.exe
  C:\Windows\System\xgYoSEn.exe
  2⤵
  PID:1036
- C:\Windows\System\zGEYqNT.exe
  C:\Windows\System\zGEYqNT.exe
  2⤵
  PID:1744
- C:\Windows\System\jqeJozS.exe
  C:\Windows\System\jqeJozS.exe
  2⤵
  PID:2484
- C:\Windows\System\ePKgaLR.exe
  C:\Windows\System\ePKgaLR.exe
  2⤵
  PID:580
- C:\Windows\System\XnatMHT.exe
  C:\Windows\System\XnatMHT.exe
  2⤵
  PID:2644
- C:\Windows\System\pHgkBbe.exe
  C:\Windows\System\pHgkBbe.exe
  2⤵
  PID:2296
- C:\Windows\System\dXlBQxN.exe
  C:\Windows\System\dXlBQxN.exe
  2⤵
  PID:1968
- C:\Windows\System\SmNbhYS.exe
  C:\Windows\System\SmNbhYS.exe
  2⤵
  PID:2884
- C:\Windows\System\RwZWTVx.exe
  C:\Windows\System\RwZWTVx.exe
  2⤵
  PID:2908
- C:\Windows\System\dtFeEZU.exe
  C:\Windows\System\dtFeEZU.exe
  2⤵
  PID:2932
- C:\Windows\System\WnanBle.exe
  C:\Windows\System\WnanBle.exe
  2⤵
  PID:800
- C:\Windows\System\DZfYxrR.exe
  C:\Windows\System\DZfYxrR.exe
  2⤵
  PID:1864
- C:\Windows\System\WjAWKho.exe
  C:\Windows\System\WjAWKho.exe
  2⤵
  PID:692
- C:\Windows\System\roVPccN.exe
  C:\Windows\System\roVPccN.exe
  2⤵
  PID:2584
- C:\Windows\System\mSKKwsj.exe
  C:\Windows\System\mSKKwsj.exe
  2⤵
  PID:2936
- C:\Windows\System\buyHfqn.exe
  C:\Windows\System\buyHfqn.exe
  2⤵
  PID:2520
- C:\Windows\System\fdtbfjz.exe
  C:\Windows\System\fdtbfjz.exe
  2⤵
  PID:1308
- C:\Windows\System\KynoWiB.exe
  C:\Windows\System\KynoWiB.exe
  2⤵
  PID:2016
- C:\Windows\System\ILkypFH.exe
  C:\Windows\System\ILkypFH.exe
  2⤵
  PID:2896
- C:\Windows\System\EGIVTwf.exe
  C:\Windows\System\EGIVTwf.exe
  2⤵
  PID:2464
- C:\Windows\System\virWmLe.exe
  C:\Windows\System\virWmLe.exe
  2⤵
  PID:2088
- C:\Windows\System\vrURAeq.exe
  C:\Windows\System\vrURAeq.exe
  2⤵
  PID:1484
- C:\Windows\System\xekAGLl.exe
  C:\Windows\System\xekAGLl.exe
  2⤵
  PID:2596
- C:\Windows\System\dpuNyZS.exe
  C:\Windows\System\dpuNyZS.exe
  2⤵
  PID:1664
- C:\Windows\System\YfAnYAq.exe
  C:\Windows\System\YfAnYAq.exe
  2⤵
  PID:1012
- C:\Windows\System\Suiuknu.exe
  C:\Windows\System\Suiuknu.exe
  2⤵
  PID:2768
- C:\Windows\System\ZJnBzhS.exe
  C:\Windows\System\ZJnBzhS.exe
  2⤵
  PID:1548
- C:\Windows\System\LoZxoXX.exe
  C:\Windows\System\LoZxoXX.exe
  2⤵
  PID:1960
- C:\Windows\System\EtQIGCY.exe
  C:\Windows\System\EtQIGCY.exe
  2⤵
  PID:3000
- C:\Windows\System\MYZFVcM.exe
  C:\Windows\System\MYZFVcM.exe
  2⤵
  PID:1184
- C:\Windows\System\WtZMoFK.exe
  C:\Windows\System\WtZMoFK.exe
  2⤵
  PID:2044
- C:\Windows\System\pylfrFL.exe
  C:\Windows\System\pylfrFL.exe
  2⤵
  PID:3008
- C:\Windows\System\MuKhHfN.exe
  C:\Windows\System\MuKhHfN.exe
  2⤵
  PID:3084
- C:\Windows\System\UTxlIXi.exe
  C:\Windows\System\UTxlIXi.exe
  2⤵
  PID:3104
- C:\Windows\System\nBIuyxF.exe
  C:\Windows\System\nBIuyxF.exe
  2⤵
  PID:3120
- C:\Windows\System\MEFRBqb.exe
  C:\Windows\System\MEFRBqb.exe
  2⤵
  PID:3136
- C:\Windows\System\gVEjvKY.exe
  C:\Windows\System\gVEjvKY.exe
  2⤵
  PID:3156
- C:\Windows\System\hFhgPxY.exe
  C:\Windows\System\hFhgPxY.exe
  2⤵
  PID:3176
- C:\Windows\System\iSaigLA.exe
  C:\Windows\System\iSaigLA.exe
  2⤵
  PID:3196
- C:\Windows\System\QkBtVCL.exe
  C:\Windows\System\QkBtVCL.exe
  2⤵
  PID:3212
- C:\Windows\System\qGIrFQM.exe
  C:\Windows\System\qGIrFQM.exe
  2⤵
  PID:3228
- C:\Windows\System\vqxaabH.exe
  C:\Windows\System\vqxaabH.exe
  2⤵
  PID:3248
- C:\Windows\System\VkYwBCV.exe
  C:\Windows\System\VkYwBCV.exe
  2⤵
  PID:3268
- C:\Windows\System\YEJkKeU.exe
  C:\Windows\System\YEJkKeU.exe
  2⤵
  PID:3288
- C:\Windows\System\TNDonwx.exe
  C:\Windows\System\TNDonwx.exe
  2⤵
  PID:3304
- C:\Windows\System\JwwVAmx.exe
  C:\Windows\System\JwwVAmx.exe
  2⤵
  PID:3320
- C:\Windows\System\vKGrIFz.exe
  C:\Windows\System\vKGrIFz.exe
  2⤵
  PID:3340
- C:\Windows\System\uGnvUJe.exe
  C:\Windows\System\uGnvUJe.exe
  2⤵
  PID:3360
- C:\Windows\System\eiAMdji.exe
  C:\Windows\System\eiAMdji.exe
  2⤵
  PID:3388
- C:\Windows\System\gJtdCXs.exe
  C:\Windows\System\gJtdCXs.exe
  2⤵
  PID:3408
- C:\Windows\System\yMYAESQ.exe
  C:\Windows\System\yMYAESQ.exe
  2⤵
  PID:3424
- C:\Windows\System\aALKLiJ.exe
  C:\Windows\System\aALKLiJ.exe
  2⤵
  PID:3472
- C:\Windows\System\JuDXFty.exe
  C:\Windows\System\JuDXFty.exe
  2⤵
  PID:3492
- C:\Windows\System\xvKsrsN.exe
  C:\Windows\System\xvKsrsN.exe
  2⤵
  PID:3508
- C:\Windows\System\GceLMWZ.exe
  C:\Windows\System\GceLMWZ.exe
  2⤵
  PID:3524
- C:\Windows\System\yQKEDVd.exe
  C:\Windows\System\yQKEDVd.exe
  2⤵
  PID:3552
- C:\Windows\System\PuQinFy.exe
  C:\Windows\System\PuQinFy.exe
  2⤵
  PID:3568
- C:\Windows\System\wrTQNfr.exe
  C:\Windows\System\wrTQNfr.exe
  2⤵
  PID:3584
- C:\Windows\System\FBKJzvi.exe
  C:\Windows\System\FBKJzvi.exe
  2⤵
  PID:3604
- C:\Windows\System\FFxZNpd.exe
  C:\Windows\System\FFxZNpd.exe
  2⤵
  PID:3628
- C:\Windows\System\wATJsEJ.exe
  C:\Windows\System\wATJsEJ.exe
  2⤵
  PID:3644
- C:\Windows\System\NimRKCX.exe
  C:\Windows\System\NimRKCX.exe
  2⤵
  PID:3660
- C:\Windows\System\zgiKrZo.exe
  C:\Windows\System\zgiKrZo.exe
  2⤵
  PID:3676
- C:\Windows\System\SusuwFT.exe
  C:\Windows\System\SusuwFT.exe
  2⤵
  PID:3692
- C:\Windows\System\QGtNazp.exe
  C:\Windows\System\QGtNazp.exe
  2⤵
  PID:3712
- C:\Windows\System\CDMqiiW.exe
  C:\Windows\System\CDMqiiW.exe
  2⤵
  PID:3756
- C:\Windows\System\ymUcbPq.exe
  C:\Windows\System\ymUcbPq.exe
  2⤵
  PID:3772
- C:\Windows\System\fwFyYAT.exe
  C:\Windows\System\fwFyYAT.exe
  2⤵
  PID:3788
- C:\Windows\System\wuxAOGn.exe
  C:\Windows\System\wuxAOGn.exe
  2⤵
  PID:3808
- C:\Windows\System\MPipFZD.exe
  C:\Windows\System\MPipFZD.exe
  2⤵
  PID:3836
- C:\Windows\System\QRiIygf.exe
  C:\Windows\System\QRiIygf.exe
  2⤵
  PID:3852
- C:\Windows\System\wRQmUeQ.exe
  C:\Windows\System\wRQmUeQ.exe
  2⤵
  PID:3876
- C:\Windows\System\GScajmw.exe
  C:\Windows\System\GScajmw.exe
  2⤵
  PID:3892
- C:\Windows\System\UpekhXL.exe
  C:\Windows\System\UpekhXL.exe
  2⤵
  PID:3916
- C:\Windows\System\xHxvWpb.exe
  C:\Windows\System\xHxvWpb.exe
  2⤵
  PID:3932
- C:\Windows\System\ddBCZRu.exe
  C:\Windows\System\ddBCZRu.exe
  2⤵
  PID:3956
- C:\Windows\System\mwJbaHf.exe
  C:\Windows\System\mwJbaHf.exe
  2⤵
  PID:3972
- C:\Windows\System\gznqGlp.exe
  C:\Windows\System\gznqGlp.exe
  2⤵
  PID:3996
- C:\Windows\System\aQZFsZP.exe
  C:\Windows\System\aQZFsZP.exe
  2⤵
  PID:4012
- C:\Windows\System\TSfbfjV.exe
  C:\Windows\System\TSfbfjV.exe
  2⤵
  PID:4036
- C:\Windows\System\TkvJzSi.exe
  C:\Windows\System\TkvJzSi.exe
  2⤵
  PID:4056
- C:\Windows\System\JZWFZgc.exe
  C:\Windows\System\JZWFZgc.exe
  2⤵
  PID:4076
- C:\Windows\System\vdsWplh.exe
  C:\Windows\System\vdsWplh.exe
  2⤵
  PID:4092
- C:\Windows\System\KHiAvcE.exe
  C:\Windows\System\KHiAvcE.exe
  2⤵
  PID:3112
- C:\Windows\System\ZKWuKSO.exe
  C:\Windows\System\ZKWuKSO.exe
  2⤵
  PID:3152
- C:\Windows\System\QKJanai.exe
  C:\Windows\System\QKJanai.exe
  2⤵
  PID:3188
- C:\Windows\System\HxAlyKD.exe
  C:\Windows\System\HxAlyKD.exe
  2⤵
  PID:3264
- C:\Windows\System\qzYANel.exe
  C:\Windows\System\qzYANel.exe
  2⤵
  PID:3328
- C:\Windows\System\oFrvrTi.exe
  C:\Windows\System\oFrvrTi.exe
  2⤵
  PID:3384
- C:\Windows\System\LQGiDFq.exe
  C:\Windows\System\LQGiDFq.exe
  2⤵
  PID:3128
- C:\Windows\System\xIFZuzL.exe
  C:\Windows\System\xIFZuzL.exe
  2⤵
  PID:3280
- C:\Windows\System\WduIngQ.exe
  C:\Windows\System\WduIngQ.exe
  2⤵
  PID:3208
- C:\Windows\System\lqEqHMl.exe
  C:\Windows\System\lqEqHMl.exe
  2⤵
  PID:3236
- C:\Windows\System\yZUKwHj.exe
  C:\Windows\System\yZUKwHj.exe
  2⤵
  PID:3452
- C:\Windows\System\kiAbsrv.exe
  C:\Windows\System\kiAbsrv.exe
  2⤵
  PID:3480
- C:\Windows\System\ALMEOyy.exe
  C:\Windows\System\ALMEOyy.exe
  2⤵
  PID:3460
- C:\Windows\System\RMzrmvb.exe
  C:\Windows\System\RMzrmvb.exe
  2⤵
  PID:3516
- C:\Windows\System\ITDapsQ.exe
  C:\Windows\System\ITDapsQ.exe
  2⤵
  PID:3592
- C:\Windows\System\ZUorhUw.exe
  C:\Windows\System\ZUorhUw.exe
  2⤵
  PID:3540
- C:\Windows\System\uwaTEId.exe
  C:\Windows\System\uwaTEId.exe
  2⤵
  PID:3620
- C:\Windows\System\nBgUdvb.exe
  C:\Windows\System\nBgUdvb.exe
  2⤵
  PID:3580
- C:\Windows\System\ZRnqqwB.exe
  C:\Windows\System\ZRnqqwB.exe
  2⤵
  PID:3704
- C:\Windows\System\EdwqlUw.exe
  C:\Windows\System\EdwqlUw.exe
  2⤵
  PID:3724
- C:\Windows\System\pwSroIl.exe
  C:\Windows\System\pwSroIl.exe
  2⤵
  PID:3764
- C:\Windows\System\OHtpxoq.exe
  C:\Windows\System\OHtpxoq.exe
  2⤵
  PID:3804
- C:\Windows\System\PbzdWjt.exe
  C:\Windows\System\PbzdWjt.exe
  2⤵
  PID:3828
- C:\Windows\System\mYfFggP.exe
  C:\Windows\System\mYfFggP.exe
  2⤵
  PID:3848
- C:\Windows\System\HtowSyL.exe
  C:\Windows\System\HtowSyL.exe
  2⤵
  PID:3888
- C:\Windows\System\gQbEPKY.exe
  C:\Windows\System\gQbEPKY.exe
  2⤵
  PID:3904
- C:\Windows\System\qNgmOns.exe
  C:\Windows\System\qNgmOns.exe
  2⤵
  PID:3944
- C:\Windows\System\eMzWmOn.exe
  C:\Windows\System\eMzWmOn.exe
  2⤵
  PID:3988
- C:\Windows\System\neYHFvx.exe
  C:\Windows\System\neYHFvx.exe
  2⤵
  PID:4020
- C:\Windows\System\upmyMbm.exe
  C:\Windows\System\upmyMbm.exe
  2⤵
  PID:4052
- C:\Windows\System\XTnyWlP.exe
  C:\Windows\System\XTnyWlP.exe
  2⤵
  PID:3080
- C:\Windows\System\NIqUghW.exe
  C:\Windows\System\NIqUghW.exe
  2⤵
  PID:3144
- C:\Windows\System\FkTpZmW.exe
  C:\Windows\System\FkTpZmW.exe
  2⤵
  PID:3220
- C:\Windows\System\nDfilnR.exe
  C:\Windows\System\nDfilnR.exe
  2⤵
  PID:3372
- C:\Windows\System\DaXRoIl.exe
  C:\Windows\System\DaXRoIl.exe
  2⤵
  PID:3348
- C:\Windows\System\ORvBMLF.exe
  C:\Windows\System\ORvBMLF.exe
  2⤵
  PID:3352
- C:\Windows\System\hcTSWNn.exe
  C:\Windows\System\hcTSWNn.exe
  2⤵
  PID:3436
- C:\Windows\System\efVsWXl.exe
  C:\Windows\System\efVsWXl.exe
  2⤵
  PID:3404
- C:\Windows\System\LigFfvt.exe
  C:\Windows\System\LigFfvt.exe
  2⤵
  PID:3440
- C:\Windows\System\XUnpBmr.exe
  C:\Windows\System\XUnpBmr.exe
  2⤵
  PID:3532
- C:\Windows\System\nUjawog.exe
  C:\Windows\System\nUjawog.exe
  2⤵
  PID:3596
- C:\Windows\System\SYWHmxf.exe
  C:\Windows\System\SYWHmxf.exe
  2⤵
  PID:3652
- C:\Windows\System\rBMESLw.exe
  C:\Windows\System\rBMESLw.exe
  2⤵
  PID:3640
- C:\Windows\System\iogvEml.exe
  C:\Windows\System\iogvEml.exe
  2⤵
  PID:3688
- C:\Windows\System\XnusSHT.exe
  C:\Windows\System\XnusSHT.exe
  2⤵
  PID:3844
- C:\Windows\System\fbqDXIw.exe
  C:\Windows\System\fbqDXIw.exe
  2⤵
  PID:3884
- C:\Windows\System\Hakjcfk.exe
  C:\Windows\System\Hakjcfk.exe
  2⤵
  PID:3928
- C:\Windows\System\kWFLLQz.exe
  C:\Windows\System\kWFLLQz.exe
  2⤵
  PID:3968
- C:\Windows\System\crlQpFM.exe
  C:\Windows\System\crlQpFM.exe
  2⤵
  PID:3752
- C:\Windows\System\VuWaPen.exe
  C:\Windows\System\VuWaPen.exe
  2⤵
  PID:4064
- C:\Windows\System\tnsAepw.exe
  C:\Windows\System\tnsAepw.exe
  2⤵
  PID:4044
- C:\Windows\System\YtwWivQ.exe
  C:\Windows\System\YtwWivQ.exe
  2⤵
  PID:3100
- C:\Windows\System\UHKzbHR.exe
  C:\Windows\System\UHKzbHR.exe
  2⤵
  PID:3336
- C:\Windows\System\ZVbintl.exe
  C:\Windows\System\ZVbintl.exe
  2⤵
  PID:3276
- C:\Windows\System\PTQlMQb.exe
  C:\Windows\System\PTQlMQb.exe
  2⤵
  PID:3500
- C:\Windows\System\DrLxgMd.exe
  C:\Windows\System\DrLxgMd.exe
  2⤵
  PID:3636
- C:\Windows\System\zzJOhaf.exe
  C:\Windows\System\zzJOhaf.exe
  2⤵
  PID:3564
- C:\Windows\System\nekvvaV.exe
  C:\Windows\System\nekvvaV.exe
  2⤵
  PID:3356
- C:\Windows\System\VaQycpi.exe
  C:\Windows\System\VaQycpi.exe
  2⤵
  PID:3456
- C:\Windows\System\Bldwuin.exe
  C:\Windows\System\Bldwuin.exe
  2⤵
  PID:3796
- C:\Windows\System\qKozHug.exe
  C:\Windows\System\qKozHug.exe
  2⤵
  PID:3952
- C:\Windows\System\YulYkqy.exe
  C:\Windows\System\YulYkqy.exe
  2⤵
  PID:2540
- C:\Windows\System\ofYpzCi.exe
  C:\Windows\System\ofYpzCi.exe
  2⤵
  PID:3908
- C:\Windows\System\NLvEuXV.exe
  C:\Windows\System\NLvEuXV.exe
  2⤵
  PID:4084
- C:\Windows\System\hnBLtoQ.exe
  C:\Windows\System\hnBLtoQ.exe
  2⤵
  PID:3164
- C:\Windows\System\BYGOhWi.exe
  C:\Windows\System\BYGOhWi.exe
  2⤵
  PID:3684
- C:\Windows\System\OJSIqvP.exe
  C:\Windows\System\OJSIqvP.exe
  2⤵
  PID:4100
- C:\Windows\System\hbKQmNc.exe
  C:\Windows\System\hbKQmNc.exe
  2⤵
  PID:4116
- C:\Windows\System\BueFTRq.exe
  C:\Windows\System\BueFTRq.exe
  2⤵
  PID:4132
- C:\Windows\System\CoZkTFY.exe
  C:\Windows\System\CoZkTFY.exe
  2⤵
  PID:4148
- C:\Windows\System\kcIYNzm.exe
  C:\Windows\System\kcIYNzm.exe
  2⤵
  PID:4168
- C:\Windows\System\EvOiWbt.exe
  C:\Windows\System\EvOiWbt.exe
  2⤵
  PID:4196
- C:\Windows\System\CllzxKx.exe
  C:\Windows\System\CllzxKx.exe
  2⤵
  PID:4216
- C:\Windows\System\nxpjOZm.exe
  C:\Windows\System\nxpjOZm.exe
  2⤵
  PID:4236
- C:\Windows\System\jdQMoHH.exe
  C:\Windows\System\jdQMoHH.exe
  2⤵
  PID:4252
- C:\Windows\System\EyKsuIk.exe
  C:\Windows\System\EyKsuIk.exe
  2⤵
  PID:4272
- C:\Windows\System\SYKWHtz.exe
  C:\Windows\System\SYKWHtz.exe
  2⤵
  PID:4288
- C:\Windows\System\JFgRZdz.exe
  C:\Windows\System\JFgRZdz.exe
  2⤵
  PID:4308
- C:\Windows\System\lVrboBl.exe
  C:\Windows\System\lVrboBl.exe
  2⤵
  PID:4328
- C:\Windows\System\CWEtdIA.exe
  C:\Windows\System\CWEtdIA.exe
  2⤵
  PID:4348
- C:\Windows\System\LuKcipC.exe
  C:\Windows\System\LuKcipC.exe
  2⤵
  PID:4364
- C:\Windows\System\muhrYhZ.exe
  C:\Windows\System\muhrYhZ.exe
  2⤵
  PID:4380
- C:\Windows\System\HNwCKlM.exe
  C:\Windows\System\HNwCKlM.exe
  2⤵
  PID:4400
- C:\Windows\System\aiDOZVH.exe
  C:\Windows\System\aiDOZVH.exe
  2⤵
  PID:4424
- C:\Windows\System\ZtuycLs.exe
  C:\Windows\System\ZtuycLs.exe
  2⤵
  PID:4452
- C:\Windows\System\AghlaWy.exe
  C:\Windows\System\AghlaWy.exe
  2⤵
  PID:4472
- C:\Windows\System\hGCLdbe.exe
  C:\Windows\System\hGCLdbe.exe
  2⤵
  PID:4488
- C:\Windows\System\gQBjhQG.exe
  C:\Windows\System\gQBjhQG.exe
  2⤵
  PID:4508
- C:\Windows\System\joQCZqG.exe
  C:\Windows\System\joQCZqG.exe
  2⤵
  PID:4524
- C:\Windows\System\ESxUydW.exe
  C:\Windows\System\ESxUydW.exe
  2⤵
  PID:4540
- C:\Windows\System\RSjAtCE.exe
  C:\Windows\System\RSjAtCE.exe
  2⤵
  PID:4560
- C:\Windows\System\TrjYiyf.exe
  C:\Windows\System\TrjYiyf.exe
  2⤵
  PID:4580
- C:\Windows\System\fuNkwYN.exe
  C:\Windows\System\fuNkwYN.exe
  2⤵
  PID:4596
- C:\Windows\System\pAgeQYT.exe
  C:\Windows\System\pAgeQYT.exe
  2⤵
  PID:4620
- C:\Windows\System\DYfpZDm.exe
  C:\Windows\System\DYfpZDm.exe
  2⤵
  PID:4640
- C:\Windows\System\bdbUFiU.exe
  C:\Windows\System\bdbUFiU.exe
  2⤵
  PID:4660
- C:\Windows\System\oDdvoSe.exe
  C:\Windows\System\oDdvoSe.exe
  2⤵
  PID:4676
- C:\Windows\System\wqQzbMT.exe
  C:\Windows\System\wqQzbMT.exe
  2⤵
  PID:4696
- C:\Windows\System\TdLUljX.exe
  C:\Windows\System\TdLUljX.exe
  2⤵
  PID:4808
- C:\Windows\System\TLFTXFw.exe
  C:\Windows\System\TLFTXFw.exe
  2⤵
  PID:4824
- C:\Windows\System\MxDWtrq.exe
  C:\Windows\System\MxDWtrq.exe
  2⤵
  PID:4840
- C:\Windows\System\XYNkCEx.exe
  C:\Windows\System\XYNkCEx.exe
  2⤵
  PID:4856
- C:\Windows\System\yTTFgrW.exe
  C:\Windows\System\yTTFgrW.exe
  2⤵
  PID:4876
- C:\Windows\System\Insrznu.exe
  C:\Windows\System\Insrznu.exe
  2⤵
  PID:4892
- C:\Windows\System\loruFEn.exe
  C:\Windows\System\loruFEn.exe
  2⤵
  PID:4908
- C:\Windows\System\cWSfDTg.exe
  C:\Windows\System\cWSfDTg.exe
  2⤵
  PID:4924
- C:\Windows\System\XHVRyjr.exe
  C:\Windows\System\XHVRyjr.exe
  2⤵
  PID:4940
- C:\Windows\System\VKMQosi.exe
  C:\Windows\System\VKMQosi.exe
  2⤵
  PID:4956
- C:\Windows\System\yQbyUXB.exe
  C:\Windows\System\yQbyUXB.exe
  2⤵
  PID:4972
- C:\Windows\System\AxzKVHF.exe
  C:\Windows\System\AxzKVHF.exe
  2⤵
  PID:4988
- C:\Windows\System\XnvzRhV.exe
  C:\Windows\System\XnvzRhV.exe
  2⤵
  PID:5004
- C:\Windows\System\YLDEbIr.exe
  C:\Windows\System\YLDEbIr.exe
  2⤵
  PID:5020
- C:\Windows\System\zgkQAHN.exe
  C:\Windows\System\zgkQAHN.exe
  2⤵
  PID:5036
- C:\Windows\System\rtpTqdX.exe
  C:\Windows\System\rtpTqdX.exe
  2⤵
  PID:5052
- C:\Windows\System\VbxworY.exe
  C:\Windows\System\VbxworY.exe
  2⤵
  PID:5068
- C:\Windows\System\xnwDlSF.exe
  C:\Windows\System\xnwDlSF.exe
  2⤵
  PID:5084
- C:\Windows\System\vOkogtb.exe
  C:\Windows\System\vOkogtb.exe
  2⤵
  PID:5100
- C:\Windows\System\nIpYMDs.exe
  C:\Windows\System\nIpYMDs.exe
  2⤵
  PID:5116
- C:\Windows\System\mswsSTG.exe
  C:\Windows\System\mswsSTG.exe
  2⤵
  PID:3284
- C:\Windows\System\HbVfnMV.exe
  C:\Windows\System\HbVfnMV.exe
  2⤵
  PID:3504
- C:\Windows\System\ZLaazks.exe
  C:\Windows\System\ZLaazks.exe
  2⤵
  PID:4176
- C:\Windows\System\gPEngBH.exe
  C:\Windows\System\gPEngBH.exe
  2⤵
  PID:4192
- C:\Windows\System\DZFevnq.exe
  C:\Windows\System\DZFevnq.exe
  2⤵
  PID:3940
- C:\Windows\System\KfQmrzn.exe
  C:\Windows\System\KfQmrzn.exe
  2⤵
  PID:4108
- C:\Windows\System\vyVVPMJ.exe
  C:\Windows\System\vyVVPMJ.exe
  2⤵
  PID:4460
- C:\Windows\System\dhCUmNR.exe
  C:\Windows\System\dhCUmNR.exe
  2⤵
  PID:4372
- C:\Windows\System\caKgPZV.exe
  C:\Windows\System\caKgPZV.exe
  2⤵
  PID:4420
- C:\Windows\System\KuKfTnX.exe
  C:\Windows\System\KuKfTnX.exe
  2⤵
  PID:4604
- C:\Windows\System\kEJIqlQ.exe
  C:\Windows\System\kEJIqlQ.exe
  2⤵
  PID:4532
- C:\Windows\System\BUUBnly.exe
  C:\Windows\System\BUUBnly.exe
  2⤵
  PID:4572
- C:\Windows\System\QYuHaXS.exe
  C:\Windows\System\QYuHaXS.exe
  2⤵
  PID:4652
- C:\Windows\System\QPpLrpN.exe
  C:\Windows\System\QPpLrpN.exe
  2⤵
  PID:3096
- C:\Windows\System\qYIfPSE.exe
  C:\Windows\System\qYIfPSE.exe
  2⤵
  PID:4124
- C:\Windows\System\SvbKPdz.exe
  C:\Windows\System\SvbKPdz.exe
  2⤵
  PID:3784
- C:\Windows\System\KODuJaV.exe
  C:\Windows\System\KODuJaV.exe
  2⤵
  PID:2816
- C:\Windows\System\CrvcDew.exe
  C:\Windows\System\CrvcDew.exe
  2⤵
  PID:2152
- C:\Windows\System\jamQNzV.exe
  C:\Windows\System\jamQNzV.exe
  2⤵
  PID:4160
- C:\Windows\System\FGsnxnH.exe
  C:\Windows\System\FGsnxnH.exe
  2⤵
  PID:4212
- C:\Windows\System\aeaXoON.exe
  C:\Windows\System\aeaXoON.exe
  2⤵
  PID:4284
- C:\Windows\System\bPMRTyt.exe
  C:\Windows\System\bPMRTyt.exe
  2⤵
  PID:4356
- C:\Windows\System\HiXtvSh.exe
  C:\Windows\System\HiXtvSh.exe
  2⤵
  PID:4396
- C:\Windows\System\TQUpadN.exe
  C:\Windows\System\TQUpadN.exe
  2⤵
  PID:4444
- C:\Windows\System\GJgXWqv.exe
  C:\Windows\System\GJgXWqv.exe
  2⤵
  PID:4516
- C:\Windows\System\tEXouDG.exe
  C:\Windows\System\tEXouDG.exe
  2⤵
  PID:4556
- C:\Windows\System\qGzwDPX.exe
  C:\Windows\System\qGzwDPX.exe
  2⤵
  PID:4668
- C:\Windows\System\rCJaCGK.exe
  C:\Windows\System\rCJaCGK.exe
  2⤵
  PID:4692
- C:\Windows\System\wthWyos.exe
  C:\Windows\System\wthWyos.exe
  2⤵
  PID:4744
- C:\Windows\System\NhTNDiC.exe
  C:\Windows\System\NhTNDiC.exe
  2⤵
  PID:4756
- C:\Windows\System\TtxqlFF.exe
  C:\Windows\System\TtxqlFF.exe
  2⤵
  PID:4776
- C:\Windows\System\CVmxnCL.exe
  C:\Windows\System\CVmxnCL.exe
  2⤵
  PID:4820
- C:\Windows\System\XguVaLj.exe
  C:\Windows\System\XguVaLj.exe
  2⤵
  PID:4848
- C:\Windows\System\WoHaumz.exe
  C:\Windows\System\WoHaumz.exe
  2⤵
  PID:5012
- C:\Windows\System\UeWTmNw.exe
  C:\Windows\System\UeWTmNw.exe
  2⤵
  PID:4796
- C:\Windows\System\yqQvEME.exe
  C:\Windows\System\yqQvEME.exe
  2⤵
  PID:5076
- C:\Windows\System\TzaUgDn.exe
  C:\Windows\System\TzaUgDn.exe
  2⤵
  PID:4872
- C:\Windows\System\ExUpgHq.exe
  C:\Windows\System\ExUpgHq.exe
  2⤵
  PID:4936
- C:\Windows\System\lrtuvuO.exe
  C:\Windows\System\lrtuvuO.exe
  2⤵
  PID:5032
- C:\Windows\System\brVrYcK.exe
  C:\Windows\System\brVrYcK.exe
  2⤵
  PID:5112
- C:\Windows\System\PmRwPKE.exe
  C:\Windows\System\PmRwPKE.exe
  2⤵
  PID:4188
- C:\Windows\System\fRkuvKd.exe
  C:\Windows\System\fRkuvKd.exe
  2⤵
  PID:3468
- C:\Windows\System\DvZgHjK.exe
  C:\Windows\System\DvZgHjK.exe
  2⤵
  PID:4004
- C:\Windows\System\nziUgio.exe
  C:\Windows\System\nziUgio.exe
  2⤵
  PID:3368
- C:\Windows\System\iYTEAnP.exe
  C:\Windows\System\iYTEAnP.exe
  2⤵
  PID:4300
- C:\Windows\System\YARvoqu.exe
  C:\Windows\System\YARvoqu.exe
  2⤵
  PID:4408
- C:\Windows\System\JRmCNrL.exe
  C:\Windows\System\JRmCNrL.exe
  2⤵
  PID:4608
- C:\Windows\System\TFFEWnT.exe
  C:\Windows\System\TFFEWnT.exe
  2⤵
  PID:3316
- C:\Windows\System\imbsczH.exe
  C:\Windows\System\imbsczH.exe
  2⤵
  PID:4128
- C:\Windows\System\XCVRCTb.exe
  C:\Windows\System\XCVRCTb.exe
  2⤵
  PID:4324
- C:\Windows\System\ojJJpMF.exe
  C:\Windows\System\ojJJpMF.exe
  2⤵
  PID:4548
- C:\Windows\System\rCXzbBt.exe
  C:\Windows\System\rCXzbBt.exe
  2⤵
  PID:4752
- C:\Windows\System\GqpmyEg.exe
  C:\Windows\System\GqpmyEg.exe
  2⤵
  PID:4632
- C:\Windows\System\dPOceOi.exe
  C:\Windows\System\dPOceOi.exe
  2⤵
  PID:4248
- C:\Windows\System\IlFlYBE.exe
  C:\Windows\System\IlFlYBE.exe
  2⤵
  PID:4484
- C:\Windows\System\LUXSDwf.exe
  C:\Windows\System\LUXSDwf.exe
  2⤵
  PID:4768
- C:\Windows\System\diLKUKa.exe
  C:\Windows\System\diLKUKa.exe
  2⤵
  PID:4904
- C:\Windows\System\WvcaUmT.exe
  C:\Windows\System\WvcaUmT.exe
  2⤵
  PID:4836
- C:\Windows\System\pHooCwm.exe
  C:\Windows\System\pHooCwm.exe
  2⤵
  PID:4968
- C:\Windows\System\BmBEfVX.exe
  C:\Windows\System\BmBEfVX.exe
  2⤵
  PID:5000
- C:\Windows\System\XHWNTHp.exe
  C:\Windows\System\XHWNTHp.exe
  2⤵
  PID:5044
- C:\Windows\System\HQtPPVB.exe
  C:\Windows\System\HQtPPVB.exe
  2⤵
  PID:4264
- C:\Windows\System\xMaDNeG.exe
  C:\Windows\System\xMaDNeG.exe
  2⤵
  PID:4468
- C:\Windows\System\onjPmeQ.exe
  C:\Windows\System\onjPmeQ.exe
  2⤵
  PID:4144
- C:\Windows\System\CLxLepN.exe
  C:\Windows\System\CLxLepN.exe
  2⤵
  PID:4068
- C:\Windows\System\FfCPSLn.exe
  C:\Windows\System\FfCPSLn.exe
  2⤵
  PID:4232
- C:\Windows\System\UFhhDuE.exe
  C:\Windows\System\UFhhDuE.exe
  2⤵
  PID:4028
- C:\Windows\System\uiWJDMB.exe
  C:\Windows\System\uiWJDMB.exe
  2⤵
  PID:4576
- C:\Windows\System\hodIHEX.exe
  C:\Windows\System\hodIHEX.exe
  2⤵
  PID:4440
- C:\Windows\System\rYYnfEK.exe
  C:\Windows\System\rYYnfEK.exe
  2⤵
  PID:4392
- C:\Windows\System\KrJbtTM.exe
  C:\Windows\System\KrJbtTM.exe
  2⤵
  PID:4864
- C:\Windows\System\EtXRxWs.exe
  C:\Windows\System\EtXRxWs.exe
  2⤵
  PID:5048
- C:\Windows\System\gorCWvf.exe
  C:\Windows\System\gorCWvf.exe
  2⤵
  PID:4868
- C:\Windows\System\FktnVOi.exe
  C:\Windows\System\FktnVOi.exe
  2⤵
  PID:5096
- C:\Windows\System\IMQZuNw.exe
  C:\Windows\System\IMQZuNw.exe
  2⤵
  PID:4340
- C:\Windows\System\OnLbfFp.exe
  C:\Windows\System\OnLbfFp.exe
  2⤵
  PID:4684
- C:\Windows\System\ozODzcu.exe
  C:\Windows\System\ozODzcu.exe
  2⤵
  PID:3616
- C:\Windows\System\fYWFkch.exe
  C:\Windows\System\fYWFkch.exe
  2⤵
  PID:4208
- C:\Windows\System\rfKivlQ.exe
  C:\Windows\System\rfKivlQ.exe
  2⤵
  PID:3980
- C:\Windows\System\tqlloDL.exe
  C:\Windows\System\tqlloDL.exe
  2⤵
  PID:1620
- C:\Windows\System\MeEPNQQ.exe
  C:\Windows\System\MeEPNQQ.exe
  2⤵
  PID:4952
- C:\Windows\System\aavfpeZ.exe
  C:\Windows\System\aavfpeZ.exe
  2⤵
  PID:4616
- C:\Windows\System\sislVpZ.exe
  C:\Windows\System\sislVpZ.exe
  2⤵
  PID:5140
- C:\Windows\System\sSIqlhc.exe
  C:\Windows\System\sSIqlhc.exe
  2⤵
  PID:5156
- C:\Windows\System\tTRzRKo.exe
  C:\Windows\System\tTRzRKo.exe
  2⤵
  PID:5172
- C:\Windows\System\kOIkSBx.exe
  C:\Windows\System\kOIkSBx.exe
  2⤵
  PID:5188
- C:\Windows\System\arARBdN.exe
  C:\Windows\System\arARBdN.exe
  2⤵
  PID:5204
- C:\Windows\System\EmkhOEk.exe
  C:\Windows\System\EmkhOEk.exe
  2⤵
  PID:5220
- C:\Windows\System\wDTyrIE.exe
  C:\Windows\System\wDTyrIE.exe
  2⤵
  PID:5236
- C:\Windows\System\jXVpPQa.exe
  C:\Windows\System\jXVpPQa.exe
  2⤵
  PID:5252
- C:\Windows\System\ZQGMSEo.exe
  C:\Windows\System\ZQGMSEo.exe
  2⤵
  PID:5268
- C:\Windows\System\XstAzUc.exe
  C:\Windows\System\XstAzUc.exe
  2⤵
  PID:5284
- C:\Windows\System\ElGwjVy.exe
  C:\Windows\System\ElGwjVy.exe
  2⤵
  PID:5300
- C:\Windows\System\ZPdiMbM.exe
  C:\Windows\System\ZPdiMbM.exe
  2⤵
  PID:5316
- C:\Windows\System\gapsWgX.exe
  C:\Windows\System\gapsWgX.exe
  2⤵
  PID:5332
- C:\Windows\System\RqZfNlS.exe
  C:\Windows\System\RqZfNlS.exe
  2⤵
  PID:5348
- C:\Windows\System\NYBZKrw.exe
  C:\Windows\System\NYBZKrw.exe
  2⤵
  PID:5364
- C:\Windows\System\acgrnCq.exe
  C:\Windows\System\acgrnCq.exe
  2⤵
  PID:5380
- C:\Windows\System\RBOQCda.exe
  C:\Windows\System\RBOQCda.exe
  2⤵
  PID:5396
- C:\Windows\System\kjFRlbJ.exe
  C:\Windows\System\kjFRlbJ.exe
  2⤵
  PID:5412
- C:\Windows\System\gEoooyK.exe
  C:\Windows\System\gEoooyK.exe
  2⤵
  PID:5428
- C:\Windows\System\tNvWxJi.exe
  C:\Windows\System\tNvWxJi.exe
  2⤵
  PID:5444
- C:\Windows\System\OvxVanO.exe
  C:\Windows\System\OvxVanO.exe
  2⤵
  PID:5460
- C:\Windows\System\geeslqD.exe
  C:\Windows\System\geeslqD.exe
  2⤵
  PID:5476
- C:\Windows\System\YXEmnka.exe
  C:\Windows\System\YXEmnka.exe
  2⤵
  PID:5492
- C:\Windows\System\lOBMhbr.exe
  C:\Windows\System\lOBMhbr.exe
  2⤵
  PID:5508
- C:\Windows\System\QmSoIwO.exe
  C:\Windows\System\QmSoIwO.exe
  2⤵
  PID:5524
- C:\Windows\System\OjzDQEV.exe
  C:\Windows\System\OjzDQEV.exe
  2⤵
  PID:5540
- C:\Windows\System\TQqlHaU.exe
  C:\Windows\System\TQqlHaU.exe
  2⤵
  PID:5556
- C:\Windows\System\GvHTXjB.exe
  C:\Windows\System\GvHTXjB.exe
  2⤵
  PID:5572
- C:\Windows\System\ECqUdmS.exe
  C:\Windows\System\ECqUdmS.exe
  2⤵
  PID:5588
- C:\Windows\System\pqgKAsX.exe
  C:\Windows\System\pqgKAsX.exe
  2⤵
  PID:5604
- C:\Windows\System\TjECDfz.exe
  C:\Windows\System\TjECDfz.exe
  2⤵
  PID:5620
- C:\Windows\System\gKppugJ.exe
  C:\Windows\System\gKppugJ.exe
  2⤵
  PID:5640
- C:\Windows\System\EEYwEkC.exe
  C:\Windows\System\EEYwEkC.exe
  2⤵
  PID:5656
- C:\Windows\System\GlnqJzp.exe
  C:\Windows\System\GlnqJzp.exe
  2⤵
  PID:5672
- C:\Windows\System\fxOxEIa.exe
  C:\Windows\System\fxOxEIa.exe
  2⤵
  PID:5688
- C:\Windows\System\mttgzFu.exe
  C:\Windows\System\mttgzFu.exe
  2⤵
  PID:5704
- C:\Windows\System\VHuSDeN.exe
  C:\Windows\System\VHuSDeN.exe
  2⤵
  PID:5720
- C:\Windows\System\ZifPSAv.exe
  C:\Windows\System\ZifPSAv.exe
  2⤵
  PID:5736
- C:\Windows\System\HsEFScz.exe
  C:\Windows\System\HsEFScz.exe
  2⤵
  PID:5752
- C:\Windows\System\AMIBWyu.exe
  C:\Windows\System\AMIBWyu.exe
  2⤵
  PID:5768
- C:\Windows\System\dZxPXmj.exe
  C:\Windows\System\dZxPXmj.exe
  2⤵
  PID:5784
- C:\Windows\System\hRqjnpq.exe
  C:\Windows\System\hRqjnpq.exe
  2⤵
  PID:5800
- C:\Windows\System\IPqHyxv.exe
  C:\Windows\System\IPqHyxv.exe
  2⤵
  PID:5820
- C:\Windows\System\dmoCnAW.exe
  C:\Windows\System\dmoCnAW.exe
  2⤵
  PID:5836
- C:\Windows\System\JnDHiZf.exe
  C:\Windows\System\JnDHiZf.exe
  2⤵
  PID:5852
- C:\Windows\System\jaUPIXK.exe
  C:\Windows\System\jaUPIXK.exe
  2⤵
  PID:5868
- C:\Windows\System\XbRuRbw.exe
  C:\Windows\System\XbRuRbw.exe
  2⤵
  PID:5884
- C:\Windows\System\HYIYKcL.exe
  C:\Windows\System\HYIYKcL.exe
  2⤵
  PID:5900
- C:\Windows\System\ctevKsD.exe
  C:\Windows\System\ctevKsD.exe
  2⤵
  PID:5916
- C:\Windows\System\VLqPNLq.exe
  C:\Windows\System\VLqPNLq.exe
  2⤵
  PID:5932
- C:\Windows\System\ZDpvnmV.exe
  C:\Windows\System\ZDpvnmV.exe
  2⤵
  PID:5948
- C:\Windows\System\xbZnmNF.exe
  C:\Windows\System\xbZnmNF.exe
  2⤵
  PID:5964
- C:\Windows\System\pLVHflc.exe
  C:\Windows\System\pLVHflc.exe
  2⤵
  PID:5980
- C:\Windows\System\KoEwkNi.exe
  C:\Windows\System\KoEwkNi.exe
  2⤵
  PID:5996
- C:\Windows\System\SQJrkOB.exe
  C:\Windows\System\SQJrkOB.exe
  2⤵
  PID:6012
- C:\Windows\System\fLAFwOz.exe
  C:\Windows\System\fLAFwOz.exe
  2⤵
  PID:6028
- C:\Windows\System\tiApoeb.exe
  C:\Windows\System\tiApoeb.exe
  2⤵
  PID:6044
- C:\Windows\System\jLEAmZw.exe
  C:\Windows\System\jLEAmZw.exe
  2⤵
  PID:6060
- C:\Windows\System\vyNYQMA.exe
  C:\Windows\System\vyNYQMA.exe
  2⤵
  PID:6076
- C:\Windows\System\AwMjznd.exe
  C:\Windows\System\AwMjznd.exe
  2⤵
  PID:6092
- C:\Windows\System\amPHIqS.exe
  C:\Windows\System\amPHIqS.exe
  2⤵
  PID:6108
- C:\Windows\System\DVPWdvy.exe
  C:\Windows\System\DVPWdvy.exe
  2⤵
  PID:6128
- C:\Windows\System\zAXLOaO.exe
  C:\Windows\System\zAXLOaO.exe
  2⤵
  PID:5092
- C:\Windows\System\dBHjjlE.exe
  C:\Windows\System\dBHjjlE.exe
  2⤵
  PID:4416
- C:\Windows\System\uMkBjLx.exe
  C:\Windows\System\uMkBjLx.exe
  2⤵
  PID:5180
- C:\Windows\System\oLyhBHE.exe
  C:\Windows\System\oLyhBHE.exe
  2⤵
  PID:5164
- C:\Windows\System\ZhzwTZF.exe
  C:\Windows\System\ZhzwTZF.exe
  2⤵
  PID:5276
- C:\Windows\System\ZQyvczJ.exe
  C:\Windows\System\ZQyvczJ.exe
  2⤵
  PID:5132
- C:\Windows\System\gtVOjin.exe
  C:\Windows\System\gtVOjin.exe
  2⤵
  PID:5228
- C:\Windows\System\nYTPokp.exe
  C:\Windows\System\nYTPokp.exe
  2⤵
  PID:5232
- C:\Windows\System\WDvgimY.exe
  C:\Windows\System\WDvgimY.exe
  2⤵
  PID:5292
- C:\Windows\System\UykaBbz.exe
  C:\Windows\System\UykaBbz.exe
  2⤵
  PID:5344
- C:\Windows\System\hNyekCI.exe
  C:\Windows\System\hNyekCI.exe
  2⤵
  PID:5376
- C:\Windows\System\dEQNTGI.exe
  C:\Windows\System\dEQNTGI.exe
  2⤵
  PID:5404
- C:\Windows\System\bKeLgox.exe
  C:\Windows\System\bKeLgox.exe
  2⤵
  PID:5468
- C:\Windows\System\FOVfUhC.exe
  C:\Windows\System\FOVfUhC.exe
  2⤵
  PID:5452
- C:\Windows\System\MnESUeT.exe
  C:\Windows\System\MnESUeT.exe
  2⤵
  PID:5536
- C:\Windows\System\orsRUyv.exe
  C:\Windows\System\orsRUyv.exe
  2⤵
  PID:5568
- C:\Windows\System\lCxFAcY.exe
  C:\Windows\System\lCxFAcY.exe
  2⤵
  PID:5632
- C:\Windows\System\glZIdMO.exe
  C:\Windows\System\glZIdMO.exe
  2⤵
  PID:5580
- C:\Windows\System\bGHDxhb.exe
  C:\Windows\System\bGHDxhb.exe
  2⤵
  PID:5584
- C:\Windows\System\zLHaIOb.exe
  C:\Windows\System\zLHaIOb.exe
  2⤵
  PID:5652
- C:\Windows\System\AFamFnY.exe
  C:\Windows\System\AFamFnY.exe
  2⤵
  PID:5696
- C:\Windows\System\vTLBxaQ.exe
  C:\Windows\System\vTLBxaQ.exe
  2⤵
  PID:5732
- C:\Windows\System\WkFaquj.exe
  C:\Windows\System\WkFaquj.exe
  2⤵
  PID:5748
- C:\Windows\System\HOWvWSF.exe
  C:\Windows\System\HOWvWSF.exe
  2⤵
  PID:5808
- C:\Windows\System\CuNuWHr.exe
  C:\Windows\System\CuNuWHr.exe
  2⤵
  PID:5792
- C:\Windows\System\CHZgszX.exe
  C:\Windows\System\CHZgszX.exe
  2⤵
  PID:5832
- C:\Windows\System\AzlbzAB.exe
  C:\Windows\System\AzlbzAB.exe
  2⤵
  PID:5064
- C:\Windows\System\JgFeiNy.exe
  C:\Windows\System\JgFeiNy.exe
  2⤵
  PID:5896
- C:\Windows\System\LzZTKPL.exe
  C:\Windows\System\LzZTKPL.exe
  2⤵
  PID:5956
- C:\Windows\System\QUOFKRj.exe
  C:\Windows\System\QUOFKRj.exe
  2⤵
  PID:5988
- C:\Windows\System\Wbdbiqj.exe
  C:\Windows\System\Wbdbiqj.exe
  2⤵
  PID:6004
- C:\Windows\System\DzEdVnE.exe
  C:\Windows\System\DzEdVnE.exe
  2⤵
  PID:6052
- C:\Windows\System\Jaooksc.exe
  C:\Windows\System\Jaooksc.exe
  2⤵
  PID:6100
- C:\Windows\System\dFdyOoQ.exe
  C:\Windows\System\dFdyOoQ.exe
  2⤵
  PID:6116
- C:\Windows\System\wPYFxoQ.exe
  C:\Windows\System\wPYFxoQ.exe
  2⤵
  PID:4320
- C:\Windows\System\GtEEuBV.exe
  C:\Windows\System\GtEEuBV.exe
  2⤵
  PID:5212
- C:\Windows\System\jBpZOWu.exe
  C:\Windows\System\jBpZOWu.exe
  2⤵
  PID:5248
- C:\Windows\System\HmVCefS.exe
  C:\Windows\System\HmVCefS.exe
  2⤵
  PID:5312
- C:\Windows\System\gZCEIAz.exe
  C:\Windows\System\gZCEIAz.exe
  2⤵
  PID:4792
- C:\Windows\System\ucShaGB.exe
  C:\Windows\System\ucShaGB.exe
  2⤵
  PID:5392
- C:\Windows\System\SbMGjyT.exe
  C:\Windows\System\SbMGjyT.exe
  2⤵
  PID:5436
- C:\Windows\System\wlAlIgS.exe
  C:\Windows\System\wlAlIgS.exe
  2⤵
  PID:5564
- C:\Windows\System\lMAFaYL.exe
  C:\Windows\System\lMAFaYL.exe
  2⤵
  PID:5616
- C:\Windows\System\AamOuxs.exe
  C:\Windows\System\AamOuxs.exe
  2⤵
  PID:5648
- C:\Windows\System\MUaqBKY.exe
  C:\Windows\System\MUaqBKY.exe
  2⤵
  PID:5860
- C:\Windows\System\DLZNKYG.exe
  C:\Windows\System\DLZNKYG.exe
  2⤵
  PID:5760
- C:\Windows\System\wGoAQWe.exe
  C:\Windows\System\wGoAQWe.exe
  2⤵
  PID:5880
- C:\Windows\System\tBxgjfi.exe
  C:\Windows\System\tBxgjfi.exe
  2⤵
  PID:6024
- C:\Windows\System\JiZXziW.exe
  C:\Windows\System\JiZXziW.exe
  2⤵
  PID:5244
- C:\Windows\System\vYsCuHM.exe
  C:\Windows\System\vYsCuHM.exe
  2⤵
  PID:5488
- C:\Windows\System\MQgsQSm.exe
  C:\Windows\System\MQgsQSm.exe
  2⤵
  PID:5976
- C:\Windows\System\MmHzZeH.exe
  C:\Windows\System\MmHzZeH.exe
  2⤵
  PID:5912
- C:\Windows\System\UuBHQum.exe
  C:\Windows\System\UuBHQum.exe
  2⤵
  PID:5356
- C:\Windows\System\YwMSfGH.exe
  C:\Windows\System\YwMSfGH.exe
  2⤵
  PID:5484
- C:\Windows\System\uEggNVy.exe
  C:\Windows\System\uEggNVy.exe
  2⤵
  PID:5928
- C:\Windows\System\KvYXAGl.exe
  C:\Windows\System\KvYXAGl.exe
  2⤵
  PID:5612
- C:\Windows\System\QiZYAcG.exe
  C:\Windows\System\QiZYAcG.exe
  2⤵
  PID:5684
- C:\Windows\System\AGiLbpy.exe
  C:\Windows\System\AGiLbpy.exe
  2⤵
  PID:4948
- C:\Windows\System\eSVnRLa.exe
  C:\Windows\System\eSVnRLa.exe
  2⤵
  PID:6124
- C:\Windows\System\tSzRfZz.exe
  C:\Windows\System\tSzRfZz.exe
  2⤵
  PID:5388
- C:\Windows\System\ASErOic.exe
  C:\Windows\System\ASErOic.exe
  2⤵
  PID:6084
- C:\Windows\System\kfwHMvx.exe
  C:\Windows\System\kfwHMvx.exe
  2⤵
  PID:5876
- C:\Windows\System\XhHEpRx.exe
  C:\Windows\System\XhHEpRx.exe
  2⤵
  PID:5260
- C:\Windows\System\MEcTIlu.exe
  C:\Windows\System\MEcTIlu.exe
  2⤵
  PID:5340
- C:\Windows\System\DRzuHRU.exe
  C:\Windows\System\DRzuHRU.exe
  2⤵
  PID:5500
- C:\Windows\System\jBHMhxV.exe
  C:\Windows\System\jBHMhxV.exe
  2⤵
  PID:6148
- C:\Windows\System\BsBUfFU.exe
  C:\Windows\System\BsBUfFU.exe
  2⤵
  PID:6164
- C:\Windows\System\gTSWHaE.exe
  C:\Windows\System\gTSWHaE.exe
  2⤵
  PID:6180
- C:\Windows\System\dutPBio.exe
  C:\Windows\System\dutPBio.exe
  2⤵
  PID:6196
- C:\Windows\System\yrelZRs.exe
  C:\Windows\System\yrelZRs.exe
  2⤵
  PID:6212
- C:\Windows\System\ZeiEqOO.exe
  C:\Windows\System\ZeiEqOO.exe
  2⤵
  PID:6228
- C:\Windows\System\VSjqBLP.exe
  C:\Windows\System\VSjqBLP.exe
  2⤵
  PID:6244
- C:\Windows\System\xqGpQPw.exe
  C:\Windows\System\xqGpQPw.exe
  2⤵
  PID:6260
- C:\Windows\System\fNelLQO.exe
  C:\Windows\System\fNelLQO.exe
  2⤵
  PID:6280
- C:\Windows\System\xLoIkkg.exe
  C:\Windows\System\xLoIkkg.exe
  2⤵
  PID:6296
- C:\Windows\System\HuIptoh.exe
  C:\Windows\System\HuIptoh.exe
  2⤵
  PID:6312
- C:\Windows\System\UyuKyur.exe
  C:\Windows\System\UyuKyur.exe
  2⤵
  PID:6328
- C:\Windows\System\SEbzuqs.exe
  C:\Windows\System\SEbzuqs.exe
  2⤵
  PID:6348
- C:\Windows\System\CwCWPmV.exe
  C:\Windows\System\CwCWPmV.exe
  2⤵
  PID:6364
- C:\Windows\System\JkDJbYK.exe
  C:\Windows\System\JkDJbYK.exe
  2⤵
  PID:6380
- C:\Windows\System\wiCAhwk.exe
  C:\Windows\System\wiCAhwk.exe
  2⤵
  PID:6396
- C:\Windows\System\WiSXgoE.exe
  C:\Windows\System\WiSXgoE.exe
  2⤵
  PID:6416
- C:\Windows\System\uGCiKhc.exe
  C:\Windows\System\uGCiKhc.exe
  2⤵
  PID:6432
- C:\Windows\System\HSHuSOr.exe
  C:\Windows\System\HSHuSOr.exe
  2⤵
  PID:6448
- C:\Windows\System\GqPIWPj.exe
  C:\Windows\System\GqPIWPj.exe
  2⤵
  PID:6464
- C:\Windows\System\OztgjDr.exe
  C:\Windows\System\OztgjDr.exe
  2⤵
  PID:6480
- C:\Windows\System\QQIfHXd.exe
  C:\Windows\System\QQIfHXd.exe
  2⤵
  PID:6500
- C:\Windows\System\IxGwIkB.exe
  C:\Windows\System\IxGwIkB.exe
  2⤵
  PID:6516
- C:\Windows\System\MzgqIqs.exe
  C:\Windows\System\MzgqIqs.exe
  2⤵
  PID:6532
- C:\Windows\System\eMVZMco.exe
  C:\Windows\System\eMVZMco.exe
  2⤵
  PID:6548
- C:\Windows\System\uKZKpFz.exe
  C:\Windows\System\uKZKpFz.exe
  2⤵
  PID:6564
- C:\Windows\System\GsQEbjy.exe
  C:\Windows\System\GsQEbjy.exe
  2⤵
  PID:6584
- C:\Windows\System\GPoeKKj.exe
  C:\Windows\System\GPoeKKj.exe
  2⤵
  PID:6600
- C:\Windows\System\MjDTPWg.exe
  C:\Windows\System\MjDTPWg.exe
  2⤵
  PID:6616
- C:\Windows\System\jsvbUAN.exe
  C:\Windows\System\jsvbUAN.exe
  2⤵
  PID:6632
- C:\Windows\System\Wkqxwgn.exe
  C:\Windows\System\Wkqxwgn.exe
  2⤵
  PID:6648
- C:\Windows\System\vQZcLoj.exe
  C:\Windows\System\vQZcLoj.exe
  2⤵
  PID:6680
- C:\Windows\System\IFljrtC.exe
  C:\Windows\System\IFljrtC.exe
  2⤵
  PID:6696
- C:\Windows\System\RwbKRsd.exe
  C:\Windows\System\RwbKRsd.exe
  2⤵
  PID:6712
- C:\Windows\System\OkeVVAB.exe
  C:\Windows\System\OkeVVAB.exe
  2⤵
  PID:6728
- C:\Windows\System\uYBqAOf.exe
  C:\Windows\System\uYBqAOf.exe
  2⤵
  PID:6744
- C:\Windows\System\tlUkIdF.exe
  C:\Windows\System\tlUkIdF.exe
  2⤵
  PID:6760
- C:\Windows\System\CqnDxwj.exe
  C:\Windows\System\CqnDxwj.exe
  2⤵
  PID:6776
- C:\Windows\System\ZjxxWRU.exe
  C:\Windows\System\ZjxxWRU.exe
  2⤵
  PID:6792
- C:\Windows\System\xstfOLn.exe
  C:\Windows\System\xstfOLn.exe
  2⤵
  PID:6808
- C:\Windows\System\KJYyrIw.exe
  C:\Windows\System\KJYyrIw.exe
  2⤵
  PID:6824
- C:\Windows\System\hWhnoyK.exe
  C:\Windows\System\hWhnoyK.exe
  2⤵
  PID:6840
- C:\Windows\System\hlHbEZT.exe
  C:\Windows\System\hlHbEZT.exe
  2⤵
  PID:6856
- C:\Windows\System\GpifOEi.exe
  C:\Windows\System\GpifOEi.exe
  2⤵
  PID:6872
- C:\Windows\System\zaDjQcR.exe
  C:\Windows\System\zaDjQcR.exe
  2⤵
  PID:6888
- C:\Windows\System\mpwXPNL.exe
  C:\Windows\System\mpwXPNL.exe
  2⤵
  PID:6908
- C:\Windows\System\ZMOLnxP.exe
  C:\Windows\System\ZMOLnxP.exe
  2⤵
  PID:6924
- C:\Windows\System\vTQjTYb.exe
  C:\Windows\System\vTQjTYb.exe
  2⤵
  PID:6940
- C:\Windows\System\JlpZrFL.exe
  C:\Windows\System\JlpZrFL.exe
  2⤵
  PID:6956
- C:\Windows\System\BMfhlwN.exe
  C:\Windows\System\BMfhlwN.exe
  2⤵
  PID:6972
- C:\Windows\System\LzKrQtn.exe
  C:\Windows\System\LzKrQtn.exe
  2⤵
  PID:6988
- C:\Windows\System\ZhhpeNs.exe
  C:\Windows\System\ZhhpeNs.exe
  2⤵
  PID:7004
- C:\Windows\System\PghYicW.exe
  C:\Windows\System\PghYicW.exe
  2⤵
  PID:7020
- C:\Windows\System\FpASIvF.exe
  C:\Windows\System\FpASIvF.exe
  2⤵
  PID:7036
- C:\Windows\System\pHoQwlp.exe
  C:\Windows\System\pHoQwlp.exe
  2⤵
  PID:7052
- C:\Windows\System\COSLHbf.exe
  C:\Windows\System\COSLHbf.exe
  2⤵
  PID:7068
- C:\Windows\System\jpTTTGG.exe
  C:\Windows\System\jpTTTGG.exe
  2⤵
  PID:7084
- C:\Windows\System\skkhgEV.exe
  C:\Windows\System\skkhgEV.exe
  2⤵
  PID:7100
- C:\Windows\System\omnoYxd.exe
  C:\Windows\System\omnoYxd.exe
  2⤵
  PID:7116
- C:\Windows\System\glXbkqZ.exe
  C:\Windows\System\glXbkqZ.exe
  2⤵
  PID:7132
- C:\Windows\System\GzWmxDU.exe
  C:\Windows\System\GzWmxDU.exe
  2⤵
  PID:7148
- C:\Windows\System\rcMyfXi.exe
  C:\Windows\System\rcMyfXi.exe
  2⤵
  PID:7164
- C:\Windows\System\TLkuitf.exe
  C:\Windows\System\TLkuitf.exe
  2⤵
  PID:6040
- C:\Windows\System\DvdcebO.exe
  C:\Windows\System\DvdcebO.exe
  2⤵
  PID:5504
- C:\Windows\System\jFSTUQf.exe
  C:\Windows\System\jFSTUQf.exe
  2⤵
  PID:6204
- C:\Windows\System\EKQWScH.exe
  C:\Windows\System\EKQWScH.exe
  2⤵
  PID:6176
- C:\Windows\System\tYnnAQb.exe
  C:\Windows\System\tYnnAQb.exe
  2⤵
  PID:6220
- C:\Windows\System\fbaykFo.exe
  C:\Windows\System\fbaykFo.exe
  2⤵
  PID:5812
- C:\Windows\System\tpXmYgz.exe
  C:\Windows\System\tpXmYgz.exe
  2⤵
  PID:6320
- C:\Windows\System\MQirhff.exe
  C:\Windows\System\MQirhff.exe
  2⤵
  PID:6340
- C:\Windows\System\CVNqAIj.exe
  C:\Windows\System\CVNqAIj.exe
  2⤵
  PID:6388
- C:\Windows\System\FzltUNQ.exe
  C:\Windows\System\FzltUNQ.exe
  2⤵
  PID:6428
- C:\Windows\System\RnzlCYz.exe
  C:\Windows\System\RnzlCYz.exe
  2⤵
  PID:6408
- C:\Windows\System\KoflUij.exe
  C:\Windows\System\KoflUij.exe
  2⤵
  PID:6508
- C:\Windows\System\yyqYyiZ.exe
  C:\Windows\System\yyqYyiZ.exe
  2⤵
  PID:6524
- C:\Windows\System\TPCHFtV.exe
  C:\Windows\System\TPCHFtV.exe
  2⤵
  PID:6512
- C:\Windows\System\gMeXXEV.exe
  C:\Windows\System\gMeXXEV.exe
  2⤵
  PID:6576
- C:\Windows\System\DFFHyIc.exe
  C:\Windows\System\DFFHyIc.exe
  2⤵
  PID:6640
- C:\Windows\System\xZmmLle.exe
  C:\Windows\System\xZmmLle.exe
  2⤵
  PID:6624
- C:\Windows\System\JcZyNtc.exe
  C:\Windows\System\JcZyNtc.exe
  2⤵
  PID:6644
- C:\Windows\System\GGyuHCk.exe
  C:\Windows\System\GGyuHCk.exe
  2⤵
  PID:6672
- C:\Windows\System\NfzwJyx.exe
  C:\Windows\System\NfzwJyx.exe
  2⤵
  PID:6720
- C:\Windows\System\juNGyVg.exe
  C:\Windows\System\juNGyVg.exe
  2⤵
  PID:6784
- C:\Windows\System\yTpYQcY.exe
  C:\Windows\System\yTpYQcY.exe
  2⤵
  PID:6772
- C:\Windows\System\JWYeUZB.exe
  C:\Windows\System\JWYeUZB.exe
  2⤵
  PID:6804
- C:\Windows\System\ZFDWFSx.exe
  C:\Windows\System\ZFDWFSx.exe
  2⤵
  PID:6848
- C:\Windows\System\plyRPly.exe
  C:\Windows\System\plyRPly.exe
  2⤵
  PID:6820
- C:\Windows\System\HugeUpJ.exe
  C:\Windows\System\HugeUpJ.exe
  2⤵
  PID:6884
- C:\Windows\System\VBcHEMz.exe
  C:\Windows\System\VBcHEMz.exe
  2⤵
  PID:6920
- C:\Windows\System\QXvrOuO.exe
  C:\Windows\System\QXvrOuO.exe
  2⤵
  PID:6984
- C:\Windows\System\feRtqmi.exe
  C:\Windows\System\feRtqmi.exe
  2⤵
  PID:7140
- C:\Windows\System\jOLeHzJ.exe
  C:\Windows\System\jOLeHzJ.exe
  2⤵
  PID:5552
- C:\Windows\System\PFBUKoJ.exe
  C:\Windows\System\PFBUKoJ.exe
  2⤵
  PID:6996
- C:\Windows\System\zVtcytE.exe
  C:\Windows\System\zVtcytE.exe
  2⤵
  PID:6156
- C:\Windows\System\pFZafgL.exe
  C:\Windows\System\pFZafgL.exe
  2⤵
  PID:7160
- C:\Windows\System\VwTIGNX.exe
  C:\Windows\System\VwTIGNX.exe
  2⤵
  PID:7096
- C:\Windows\System\tFkuFll.exe
  C:\Windows\System\tFkuFll.exe
  2⤵
  PID:6304
- C:\Windows\System\mvThnAJ.exe
  C:\Windows\System\mvThnAJ.exe
  2⤵
  PID:6336
- C:\Windows\System\YdqVzOY.exe
  C:\Windows\System\YdqVzOY.exe
  2⤵
  PID:6404
- C:\Windows\System\nnssnoq.exe
  C:\Windows\System\nnssnoq.exe
  2⤵
  PID:6276
- C:\Windows\System\EVUwdAY.exe
  C:\Windows\System\EVUwdAY.exe
  2⤵
  PID:6496
- C:\Windows\System\HkqzKnp.exe
  C:\Windows\System\HkqzKnp.exe
  2⤵
  PID:6612
- C:\Windows\System\LVcFvLd.exe
  C:\Windows\System\LVcFvLd.exe
  2⤵
  PID:6664
- C:\Windows\System\lUnjcZz.exe
  C:\Windows\System\lUnjcZz.exe
  2⤵
  PID:6704
- C:\Windows\System\jnbNuCD.exe
  C:\Windows\System\jnbNuCD.exe
  2⤵
  PID:6836
- C:\Windows\System\bVHLMgK.exe
  C:\Windows\System\bVHLMgK.exe
  2⤵
  PID:6868
- C:\Windows\System\mWdQQxY.exe
  C:\Windows\System\mWdQQxY.exe
  2⤵
  PID:6800
- C:\Windows\System\XtVMnVd.exe
  C:\Windows\System\XtVMnVd.exe
  2⤵
  PID:6932
- C:\Windows\System\KmzDMEk.exe
  C:\Windows\System\KmzDMEk.exe
  2⤵
  PID:6160
- C:\Windows\System\OkwKfWN.exe
  C:\Windows\System\OkwKfWN.exe
  2⤵
  PID:7044
- C:\Windows\System\gjLyTtG.exe
  C:\Windows\System\gjLyTtG.exe
  2⤵
  PID:6572
- C:\Windows\System\GLkLGTt.exe
  C:\Windows\System\GLkLGTt.exe
  2⤵
  PID:6272
- C:\Windows\System\XGBeVIT.exe
  C:\Windows\System\XGBeVIT.exe
  2⤵
  PID:6544
- C:\Windows\System\vLdcQyE.exe
  C:\Windows\System\vLdcQyE.exe
  2⤵
  PID:6880
- C:\Windows\System\QavyuZA.exe
  C:\Windows\System\QavyuZA.exe
  2⤵
  PID:6688
- C:\Windows\System\ZlwHciL.exe
  C:\Windows\System\ZlwHciL.exe
  2⤵
  PID:6900
- C:\Windows\System\qNPVNqD.exe
  C:\Windows\System\qNPVNqD.exe
  2⤵
  PID:7012
- C:\Windows\System\bmuywHS.exe
  C:\Windows\System\bmuywHS.exe
  2⤵
  PID:5908
- C:\Windows\System\PuwmtLg.exe
  C:\Windows\System\PuwmtLg.exe
  2⤵
  PID:7060
- C:\Windows\System\xkhGomb.exe
  C:\Windows\System\xkhGomb.exe
  2⤵
  PID:7032
- C:\Windows\System\doAjkFg.exe
  C:\Windows\System\doAjkFg.exe
  2⤵
  PID:6372
- C:\Windows\System\GIlviJX.exe
  C:\Windows\System\GIlviJX.exe
  2⤵
  PID:6444
- C:\Windows\System\TVNzuxj.exe
  C:\Windows\System\TVNzuxj.exe
  2⤵
  PID:6864
- C:\Windows\System\HBBsHkY.exe
  C:\Windows\System\HBBsHkY.exe
  2⤵
  PID:6708
- C:\Windows\System\wttdsTn.exe
  C:\Windows\System\wttdsTn.exe
  2⤵
  PID:6440
- C:\Windows\System\qrwiunE.exe
  C:\Windows\System\qrwiunE.exe
  2⤵
  PID:7172
- C:\Windows\System\ozgOOgj.exe
  C:\Windows\System\ozgOOgj.exe
  2⤵
  PID:7188
- C:\Windows\System\UwENTSf.exe
  C:\Windows\System\UwENTSf.exe
  2⤵
  PID:7204
- C:\Windows\System\isFSgZX.exe
  C:\Windows\System\isFSgZX.exe
  2⤵
  PID:7220
- C:\Windows\System\IatDQyZ.exe
  C:\Windows\System\IatDQyZ.exe
  2⤵
  PID:7236
- C:\Windows\System\PgyfnWW.exe
  C:\Windows\System\PgyfnWW.exe
  2⤵
  PID:7252
- C:\Windows\System\cxDbfue.exe
  C:\Windows\System\cxDbfue.exe
  2⤵
  PID:7268
- C:\Windows\System\zRWWOya.exe
  C:\Windows\System\zRWWOya.exe
  2⤵
  PID:7284
- C:\Windows\System\OiVApvd.exe
  C:\Windows\System\OiVApvd.exe
  2⤵
  PID:7300
- C:\Windows\System\ZwEjXLd.exe
  C:\Windows\System\ZwEjXLd.exe
  2⤵
  PID:7316
- C:\Windows\System\FRLpMnM.exe
  C:\Windows\System\FRLpMnM.exe
  2⤵
  PID:7332
- C:\Windows\System\ZrceeNd.exe
  C:\Windows\System\ZrceeNd.exe
  2⤵
  PID:7348
- C:\Windows\System\LzVRJES.exe
  C:\Windows\System\LzVRJES.exe
  2⤵
  PID:7364
- C:\Windows\System\lxZPJYp.exe
  C:\Windows\System\lxZPJYp.exe
  2⤵
  PID:7380
- C:\Windows\System\NEphgfa.exe
  C:\Windows\System\NEphgfa.exe
  2⤵
  PID:7396
- C:\Windows\System\mujdbyC.exe
  C:\Windows\System\mujdbyC.exe
  2⤵
  PID:7416
- C:\Windows\System\aCGhadZ.exe
  C:\Windows\System\aCGhadZ.exe
  2⤵
  PID:7432
- C:\Windows\System\fnoQMIv.exe
  C:\Windows\System\fnoQMIv.exe
  2⤵
  PID:7448
- C:\Windows\System\akOXPqP.exe
  C:\Windows\System\akOXPqP.exe
  2⤵
  PID:7464
- C:\Windows\System\ELWPvLl.exe
  C:\Windows\System\ELWPvLl.exe
  2⤵
  PID:7480
- C:\Windows\System\NnhpUix.exe
  C:\Windows\System\NnhpUix.exe
  2⤵
  PID:7496
- C:\Windows\System\XUsUxMP.exe
  C:\Windows\System\XUsUxMP.exe
  2⤵
  PID:7512
- C:\Windows\System\aFJFbEm.exe
  C:\Windows\System\aFJFbEm.exe
  2⤵
  PID:7528
- C:\Windows\System\BmSPoKq.exe
  C:\Windows\System\BmSPoKq.exe
  2⤵
  PID:7544
- C:\Windows\System\wqKSzbv.exe
  C:\Windows\System\wqKSzbv.exe
  2⤵
  PID:7560
- C:\Windows\System\owhTLrB.exe
  C:\Windows\System\owhTLrB.exe
  2⤵
  PID:7576
- C:\Windows\System\mDqUfEZ.exe
  C:\Windows\System\mDqUfEZ.exe
  2⤵
  PID:7592
- C:\Windows\System\GGHutKU.exe
  C:\Windows\System\GGHutKU.exe
  2⤵
  PID:7608
- C:\Windows\System\HvnUuIU.exe
  C:\Windows\System\HvnUuIU.exe
  2⤵
  PID:7624
- C:\Windows\System\MuAtMIe.exe
  C:\Windows\System\MuAtMIe.exe
  2⤵
  PID:7640
- C:\Windows\System\PONfwWF.exe
  C:\Windows\System\PONfwWF.exe
  2⤵
  PID:7656
- C:\Windows\System\ocNEcuC.exe
  C:\Windows\System\ocNEcuC.exe
  2⤵
  PID:7672
- C:\Windows\System\ZmLqNwO.exe
  C:\Windows\System\ZmLqNwO.exe
  2⤵
  PID:7688
- C:\Windows\System\ODfEzZR.exe
  C:\Windows\System\ODfEzZR.exe
  2⤵
  PID:7704
- C:\Windows\System\IFPrWKa.exe
  C:\Windows\System\IFPrWKa.exe
  2⤵
  PID:7720
- C:\Windows\System\uMPOHvJ.exe
  C:\Windows\System\uMPOHvJ.exe
  2⤵
  PID:7736
- C:\Windows\System\MwsAsNN.exe
  C:\Windows\System\MwsAsNN.exe
  2⤵
  PID:7752
- C:\Windows\System\yMYYUhv.exe
  C:\Windows\System\yMYYUhv.exe
  2⤵
  PID:7768
- C:\Windows\System\fLbDDQH.exe
  C:\Windows\System\fLbDDQH.exe
  2⤵
  PID:7784
- C:\Windows\System\nUhYITW.exe
  C:\Windows\System\nUhYITW.exe
  2⤵
  PID:7800
- C:\Windows\System\qGOEtsU.exe
  C:\Windows\System\qGOEtsU.exe
  2⤵
  PID:7816
- C:\Windows\System\AQinlfr.exe
  C:\Windows\System\AQinlfr.exe
  2⤵
  PID:7832
- C:\Windows\System\BinaQbC.exe
  C:\Windows\System\BinaQbC.exe
  2⤵
  PID:7848
- C:\Windows\System\zgSEKvk.exe
  C:\Windows\System\zgSEKvk.exe
  2⤵
  PID:7864
- C:\Windows\System\djLqzSB.exe
  C:\Windows\System\djLqzSB.exe
  2⤵
  PID:7880
- C:\Windows\System\gKxEbti.exe
  C:\Windows\System\gKxEbti.exe
  2⤵
  PID:7896
- C:\Windows\System\uWcngwK.exe
  C:\Windows\System\uWcngwK.exe
  2⤵
  PID:7912
- C:\Windows\System\jNFnPzv.exe
  C:\Windows\System\jNFnPzv.exe
  2⤵
  PID:7928
- C:\Windows\System\UTYyHtF.exe
  C:\Windows\System\UTYyHtF.exe
  2⤵
  PID:7944
- C:\Windows\System\yDTnsTO.exe
  C:\Windows\System\yDTnsTO.exe
  2⤵
  PID:7960
- C:\Windows\System\xoVRTCW.exe
  C:\Windows\System\xoVRTCW.exe
  2⤵
  PID:7976
- C:\Windows\System\TXpHfyl.exe
  C:\Windows\System\TXpHfyl.exe
  2⤵
  PID:7992
- C:\Windows\System\FkQLhxS.exe
  C:\Windows\System\FkQLhxS.exe
  2⤵
  PID:8008
- C:\Windows\System\tUdUOkX.exe
  C:\Windows\System\tUdUOkX.exe
  2⤵
  PID:8024
- C:\Windows\System\IYKjnYU.exe
  C:\Windows\System\IYKjnYU.exe
  2⤵
  PID:8040
- C:\Windows\System\vpLiGPp.exe
  C:\Windows\System\vpLiGPp.exe
  2⤵
  PID:8056
- C:\Windows\System\gvRGlKJ.exe
  C:\Windows\System\gvRGlKJ.exe
  2⤵
  PID:8072
- C:\Windows\System\LqvdDug.exe
  C:\Windows\System\LqvdDug.exe
  2⤵
  PID:7260
- C:\Windows\System\BweQgpT.exe
  C:\Windows\System\BweQgpT.exe
  2⤵
  PID:7404
- C:\Windows\System\xzBVNeL.exe
  C:\Windows\System\xzBVNeL.exe
  2⤵
  PID:7444
- C:\Windows\System\hnXbLaV.exe
  C:\Windows\System\hnXbLaV.exe
  2⤵
  PID:7460
- C:\Windows\System\XuJkkOo.exe
  C:\Windows\System\XuJkkOo.exe
  2⤵
  PID:7508
- C:\Windows\System\klHlLlN.exe
  C:\Windows\System\klHlLlN.exe
  2⤵
  PID:7680
- C:\Windows\System\faGilXW.exe
  C:\Windows\System\faGilXW.exe
  2⤵
  PID:7732
- C:\Windows\System\bajLxsg.exe
  C:\Windows\System\bajLxsg.exe
  2⤵
  PID:7712
- C:\Windows\System\BqMeGMv.exe
  C:\Windows\System\BqMeGMv.exe
  2⤵
  PID:7792
- C:\Windows\System\mvtyvFw.exe
  C:\Windows\System\mvtyvFw.exe
  2⤵
  PID:7844
- C:\Windows\System\EQgPpQk.exe
  C:\Windows\System\EQgPpQk.exe
  2⤵
  PID:8016
- C:\Windows\System\EVscQdn.exe
  C:\Windows\System\EVscQdn.exe
  2⤵
  PID:8052
- C:\Windows\System\tOfVRdh.exe
  C:\Windows\System\tOfVRdh.exe
  2⤵
  PID:8068
- C:\Windows\System\bKHVvOx.exe
  C:\Windows\System\bKHVvOx.exe
  2⤵
  PID:8112
- C:\Windows\System\zbuNbhA.exe
  C:\Windows\System\zbuNbhA.exe
  2⤵
  PID:8132
- C:\Windows\System\WsdOJJZ.exe
  C:\Windows\System\WsdOJJZ.exe
  2⤵
  PID:8144
- C:\Windows\System\XqihzUo.exe
  C:\Windows\System\XqihzUo.exe
  2⤵
  PID:8168
- C:\Windows\System\aGqnlRP.exe
  C:\Windows\System\aGqnlRP.exe
  2⤵
  PID:8180
- C:\Windows\System\smxsOsV.exe
  C:\Windows\System\smxsOsV.exe
  2⤵
  PID:7184
- C:\Windows\System\aHvkqSt.exe
  C:\Windows\System\aHvkqSt.exe
  2⤵
  PID:7212
- C:\Windows\System\BVWAzzw.exe
  C:\Windows\System\BVWAzzw.exe
  2⤵
  PID:7124
- C:\Windows\System\adwFkXs.exe
  C:\Windows\System\adwFkXs.exe
  2⤵
  PID:7276
- C:\Windows\System\JGNqdYW.exe
  C:\Windows\System\JGNqdYW.exe
  2⤵
  PID:7028
- C:\Windows\System\MYUQevv.exe
  C:\Windows\System\MYUQevv.exe
  2⤵
  PID:6356
- C:\Windows\System\kYinptf.exe
  C:\Windows\System\kYinptf.exe
  2⤵
  PID:7232
- C:\Windows\System\oChnkXR.exe
  C:\Windows\System\oChnkXR.exe
  2⤵
  PID:8084
- C:\Windows\System\hsNlEpM.exe
  C:\Windows\System\hsNlEpM.exe
  2⤵
  PID:7344
- C:\Windows\System\OxttBvp.exe
  C:\Windows\System\OxttBvp.exe
  2⤵
  PID:7372
- C:\Windows\System\lhZyjID.exe
  C:\Windows\System\lhZyjID.exe
  2⤵
  PID:7440
- C:\Windows\System\oPKPKeu.exe
  C:\Windows\System\oPKPKeu.exe
  2⤵
  PID:7520
- C:\Windows\System\yVIPqcb.exe
  C:\Windows\System\yVIPqcb.exe
  2⤵
  PID:7552
- C:\Windows\System\DrIrpLP.exe
  C:\Windows\System\DrIrpLP.exe
  2⤵
  PID:7616
- C:\Windows\System\lYYPikK.exe
  C:\Windows\System\lYYPikK.exe
  2⤵
  PID:7600
- C:\Windows\System\uTFJsvJ.exe
  C:\Windows\System\uTFJsvJ.exe
  2⤵
  PID:7648
- C:\Windows\System\mTWPbye.exe
  C:\Windows\System\mTWPbye.exe
  2⤵
  PID:7728
- C:\Windows\System\qUEkcZx.exe
  C:\Windows\System\qUEkcZx.exe
  2⤵
  PID:7668
- C:\Windows\System\yYsAVWh.exe
  C:\Windows\System\yYsAVWh.exe
  2⤵
  PID:7716
- C:\Windows\System\huCeLQn.exe
  C:\Windows\System\huCeLQn.exe
  2⤵
  PID:7860
- C:\Windows\System\tmvbloz.exe
  C:\Windows\System\tmvbloz.exe
  2⤵
  PID:8128
- C:\Windows\System\CIodJRQ.exe
  C:\Windows\System\CIodJRQ.exe
  2⤵
  PID:7984
- C:\Windows\System\dYZgbZB.exe
  C:\Windows\System\dYZgbZB.exe
  2⤵
  PID:7872
- C:\Windows\System\EdJRmPw.exe
  C:\Windows\System\EdJRmPw.exe
  2⤵
  PID:7936
- C:\Windows\System\EAlIWTQ.exe
  C:\Windows\System\EAlIWTQ.exe
  2⤵
  PID:8020
- C:\Windows\System\PUfaINt.exe
  C:\Windows\System\PUfaINt.exe
  2⤵
  PID:8036
- C:\Windows\System\sBDGrvB.exe
  C:\Windows\System\sBDGrvB.exe
  2⤵
  PID:8104
- C:\Windows\System\WrtUzrZ.exe
  C:\Windows\System\WrtUzrZ.exe
  2⤵
  PID:8136
- C:\Windows\System\TyELOZU.exe
  C:\Windows\System\TyELOZU.exe
  2⤵
  PID:8172
- C:\Windows\System\cERiTbR.exe
  C:\Windows\System\cERiTbR.exe
  2⤵
  PID:7248
- C:\Windows\System\XTIeXpX.exe
  C:\Windows\System\XTIeXpX.exe
  2⤵
  PID:7180
- C:\Windows\System\nmNEnul.exe
  C:\Windows\System\nmNEnul.exe
  2⤵
  PID:6952
- C:\Windows\System\lJdpHmT.exe
  C:\Windows\System\lJdpHmT.exe
  2⤵
  PID:7016
- C:\Windows\System\fbtJJQD.exe
  C:\Windows\System\fbtJJQD.exe
  2⤵
  PID:7664
- C:\Windows\System\uvjfUun.exe
  C:\Windows\System\uvjfUun.exe
  2⤵
  PID:7584
- C:\Windows\System\FrHnDNd.exe
  C:\Windows\System\FrHnDNd.exe
  2⤵
  PID:7632
- C:\Windows\System\wDgKVcZ.exe
  C:\Windows\System\wDgKVcZ.exe
  2⤵
  PID:7744
- C:\Windows\System\KLnInaa.exe
  C:\Windows\System\KLnInaa.exe
  2⤵
  PID:7920
- C:\Windows\System\miOouXg.exe
  C:\Windows\System\miOouXg.exe
  2⤵
  PID:7904
- C:\Windows\System\RPIbkle.exe
  C:\Windows\System\RPIbkle.exe
  2⤵
  PID:8100
- C:\Windows\System\JoEFeVV.exe
  C:\Windows\System\JoEFeVV.exe
  2⤵
  PID:7200
- C:\Windows\System\QzMlqzU.exe
  C:\Windows\System\QzMlqzU.exe
  2⤵
  PID:7296
- C:\Windows\System\bTptpkz.exe
  C:\Windows\System\bTptpkz.exe
  2⤵
  PID:6740
- C:\Windows\System\xkNTzdv.exe
  C:\Windows\System\xkNTzdv.exe
  2⤵
  PID:7292
- C:\Windows\System\ceRSphy.exe
  C:\Windows\System\ceRSphy.exe
  2⤵
  PID:7428
- C:\Windows\System\AovMamx.exe
  C:\Windows\System\AovMamx.exe
  2⤵
  PID:7572
- C:\Windows\System\GyahVkR.exe
  C:\Windows\System\GyahVkR.exe
  2⤵
  PID:7808
- C:\Windows\System\VLMgzxz.exe
  C:\Windows\System\VLMgzxz.exe
  2⤵
  PID:7908
- C:\Windows\System\UyCcLNk.exe
  C:\Windows\System\UyCcLNk.exe
  2⤵
  PID:7128
- C:\Windows\System\lHfersi.exe
  C:\Windows\System\lHfersi.exe
  2⤵
  PID:8120
- C:\Windows\System\rxCZIet.exe
  C:\Windows\System\rxCZIet.exe
  2⤵
  PID:8208
- C:\Windows\System\QNkILjD.exe
  C:\Windows\System\QNkILjD.exe
  2⤵
  PID:8228
- C:\Windows\System\WQFrNPs.exe
  C:\Windows\System\WQFrNPs.exe
  2⤵
  PID:8248
- C:\Windows\System\juWNNQO.exe
  C:\Windows\System\juWNNQO.exe
  2⤵
  PID:8264
- C:\Windows\System\wKcoufC.exe
  C:\Windows\System\wKcoufC.exe
  2⤵
  PID:8284
- C:\Windows\System\okoNeAk.exe
  C:\Windows\System\okoNeAk.exe
  2⤵
  PID:8300
- C:\Windows\System\ExGRSRn.exe
  C:\Windows\System\ExGRSRn.exe
  2⤵
  PID:8316
- C:\Windows\System\RtUrHbx.exe
  C:\Windows\System\RtUrHbx.exe
  2⤵
  PID:8332
- C:\Windows\System\EOFHWQj.exe
  C:\Windows\System\EOFHWQj.exe
  2⤵
  PID:8348
- C:\Windows\System\VUUQIzq.exe
  C:\Windows\System\VUUQIzq.exe
  2⤵
  PID:8364
- C:\Windows\System\XvIMmgi.exe
  C:\Windows\System\XvIMmgi.exe
  2⤵
  PID:8380
- C:\Windows\System\FOvsXVD.exe
  C:\Windows\System\FOvsXVD.exe
  2⤵
  PID:8396
- C:\Windows\System\nRYQDzF.exe
  C:\Windows\System\nRYQDzF.exe
  2⤵
  PID:8412
- C:\Windows\System\HpCdOAt.exe
  C:\Windows\System\HpCdOAt.exe
  2⤵
  PID:8428
- C:\Windows\System\OZuPPev.exe
  C:\Windows\System\OZuPPev.exe
  2⤵
  PID:8444
- C:\Windows\System\VOEiVdv.exe
  C:\Windows\System\VOEiVdv.exe
  2⤵
  PID:8460
- C:\Windows\System\OoVVYhr.exe
  C:\Windows\System\OoVVYhr.exe
  2⤵
  PID:8480
- C:\Windows\System\iaiRsFz.exe
  C:\Windows\System\iaiRsFz.exe
  2⤵
  PID:8496
- C:\Windows\System\cMZbqab.exe
  C:\Windows\System\cMZbqab.exe
  2⤵
  PID:8512
- C:\Windows\System\RJRMPbw.exe
  C:\Windows\System\RJRMPbw.exe
  2⤵
  PID:8528
- C:\Windows\System\IGzziMX.exe
  C:\Windows\System\IGzziMX.exe
  2⤵
  PID:8544
- C:\Windows\System\GfBKTww.exe
  C:\Windows\System\GfBKTww.exe
  2⤵
  PID:8560
- C:\Windows\System\RhhQtSY.exe
  C:\Windows\System\RhhQtSY.exe
  2⤵
  PID:8576
- C:\Windows\System\vFKdELd.exe
  C:\Windows\System\vFKdELd.exe
  2⤵
  PID:8592
- C:\Windows\System\PDkqnoS.exe
  C:\Windows\System\PDkqnoS.exe
  2⤵
  PID:8612
- C:\Windows\System\QgiTmOn.exe
  C:\Windows\System\QgiTmOn.exe
  2⤵
  PID:8628
- C:\Windows\System\HRlazyQ.exe
  C:\Windows\System\HRlazyQ.exe
  2⤵
  PID:8644
- C:\Windows\System\bdSBBUk.exe
  C:\Windows\System\bdSBBUk.exe
  2⤵
  PID:8660
- C:\Windows\System\NoTLvLV.exe
  C:\Windows\System\NoTLvLV.exe
  2⤵
  PID:8676
- C:\Windows\System\TMGukqV.exe
  C:\Windows\System\TMGukqV.exe
  2⤵
  PID:8692
- C:\Windows\System\YodwNNq.exe
  C:\Windows\System\YodwNNq.exe
  2⤵
  PID:8712
- C:\Windows\System\KILXcOL.exe
  C:\Windows\System\KILXcOL.exe
  2⤵
  PID:8736
- C:\Windows\System\VIWrcFw.exe
  C:\Windows\System\VIWrcFw.exe
  2⤵
  PID:8752
- C:\Windows\System\nesVZDW.exe
  C:\Windows\System\nesVZDW.exe
  2⤵
  PID:8772
- C:\Windows\System\WmzaNyP.exe
  C:\Windows\System\WmzaNyP.exe
  2⤵
  PID:8792
- C:\Windows\System\hxBqFcJ.exe
  C:\Windows\System\hxBqFcJ.exe
  2⤵
  PID:8808
- C:\Windows\System\MyScYri.exe
  C:\Windows\System\MyScYri.exe
  2⤵
  PID:8824
- C:\Windows\System\NnhWcIv.exe
  C:\Windows\System\NnhWcIv.exe
  2⤵
  PID:8844
- C:\Windows\System\WNbCpWz.exe
  C:\Windows\System\WNbCpWz.exe
  2⤵
  PID:8864
- C:\Windows\System\yBQPyGV.exe
  C:\Windows\System\yBQPyGV.exe
  2⤵
  PID:8880
- C:\Windows\System\fQkMRqL.exe
  C:\Windows\System\fQkMRqL.exe
  2⤵
  PID:8900
- C:\Windows\System\nffhsLF.exe
  C:\Windows\System\nffhsLF.exe
  2⤵
  PID:8916
- C:\Windows\System\zJBlLkq.exe
  C:\Windows\System\zJBlLkq.exe
  2⤵
  PID:8932
- C:\Windows\System\wjIVjoj.exe
  C:\Windows\System\wjIVjoj.exe
  2⤵
  PID:8948
- C:\Windows\System\BuxpVWd.exe
  C:\Windows\System\BuxpVWd.exe
  2⤵
  PID:8964
- C:\Windows\System\kgtGBIY.exe
  C:\Windows\System\kgtGBIY.exe
  2⤵
  PID:8980
- C:\Windows\System\GSDGIiP.exe
  C:\Windows\System\GSDGIiP.exe
  2⤵
  PID:8996
- C:\Windows\System\eRYTNDl.exe
  C:\Windows\System\eRYTNDl.exe
  2⤵
  PID:9012
- C:\Windows\System\tDjxkqE.exe
  C:\Windows\System\tDjxkqE.exe
  2⤵
  PID:9032
- C:\Windows\System\pclwpAG.exe
  C:\Windows\System\pclwpAG.exe
  2⤵
  PID:9048
- C:\Windows\System\qWAspYv.exe
  C:\Windows\System\qWAspYv.exe
  2⤵
  PID:9064
- C:\Windows\System\KaaLxCt.exe
  C:\Windows\System\KaaLxCt.exe
  2⤵
  PID:9080
- C:\Windows\System\BiVzYlQ.exe
  C:\Windows\System\BiVzYlQ.exe
  2⤵
  PID:9096
- C:\Windows\System\qFREGEy.exe
  C:\Windows\System\qFREGEy.exe
  2⤵
  PID:9112
- C:\Windows\System\CVvtWjK.exe
  C:\Windows\System\CVvtWjK.exe
  2⤵
  PID:9148
- C:\Windows\System\ngClBSt.exe
  C:\Windows\System\ngClBSt.exe
  2⤵
  PID:9176
- C:\Windows\System\hJuaDkC.exe
  C:\Windows\System\hJuaDkC.exe
  2⤵
  PID:9192
- C:\Windows\System\dgGlbAP.exe
  C:\Windows\System\dgGlbAP.exe
  2⤵
  PID:9212
- C:\Windows\System\JGcgbvm.exe
  C:\Windows\System\JGcgbvm.exe
  2⤵
  PID:7968
- C:\Windows\System\GxoCfpb.exe
  C:\Windows\System\GxoCfpb.exe
  2⤵
  PID:8196
- C:\Windows\System\juMKAAM.exe
  C:\Windows\System\juMKAAM.exe
  2⤵
  PID:7504
- C:\Windows\System\mTQERgf.exe
  C:\Windows\System\mTQERgf.exe
  2⤵
  PID:7264
- C:\Windows\System\qSykxqH.exe
  C:\Windows\System\qSykxqH.exe
  2⤵
  PID:7196
- C:\Windows\System\VGtBNpj.exe
  C:\Windows\System\VGtBNpj.exe
  2⤵
  PID:8224
- C:\Windows\System\IvNlufq.exe
  C:\Windows\System\IvNlufq.exe
  2⤵
  PID:8244
- C:\Windows\System\SxhxUIX.exe
  C:\Windows\System\SxhxUIX.exe
  2⤵
  PID:8312
- C:\Windows\System\aVFzAjK.exe
  C:\Windows\System\aVFzAjK.exe
  2⤵
  PID:8404
- C:\Windows\System\GdRwxiV.exe
  C:\Windows\System\GdRwxiV.exe
  2⤵
  PID:8436
- C:\Windows\System\JSrjngm.exe
  C:\Windows\System\JSrjngm.exe
  2⤵
  PID:8452
- C:\Windows\System\zTswcnw.exe
  C:\Windows\System\zTswcnw.exe
  2⤵
  PID:8392
- C:\Windows\System\vlYwkoQ.exe
  C:\Windows\System\vlYwkoQ.exe
  2⤵
  PID:8468
- C:\Windows\System\nIZqxiC.exe
  C:\Windows\System\nIZqxiC.exe
  2⤵
  PID:8508
- C:\Windows\System\ftZcZjN.exe
  C:\Windows\System\ftZcZjN.exe
  2⤵
  PID:8524
- C:\Windows\System\FWHUlzB.exe
  C:\Windows\System\FWHUlzB.exe
  2⤵
  PID:8568
- C:\Windows\System\QWcZgjc.exe
  C:\Windows\System\QWcZgjc.exe
  2⤵
  PID:8608
- C:\Windows\System\rpiEATW.exe
  C:\Windows\System\rpiEATW.exe
  2⤵
  PID:8668
- C:\Windows\System\bsBdREw.exe
  C:\Windows\System\bsBdREw.exe
  2⤵
  PID:8584
- C:\Windows\System\SewydaU.exe
  C:\Windows\System\SewydaU.exe
  2⤵
  PID:8728
- C:\Windows\System\WFaXlem.exe
  C:\Windows\System\WFaXlem.exe
  2⤵
  PID:8720
- C:\Windows\System\EQaLTrl.exe
  C:\Windows\System\EQaLTrl.exe
  2⤵
  PID:8652
- C:\Windows\System\nMhkvAe.exe
  C:\Windows\System\nMhkvAe.exe
  2⤵
  PID:8780
- C:\Windows\System\wzkmlFY.exe
  C:\Windows\System\wzkmlFY.exe
  2⤵
  PID:8852
- C:\Windows\System\oAOrREe.exe
  C:\Windows\System\oAOrREe.exe
  2⤵
  PID:8872
- C:\Windows\System\QTKllKJ.exe
  C:\Windows\System\QTKllKJ.exe
  2⤵
  PID:8888
- C:\Windows\System\KIwZhyy.exe
  C:\Windows\System\KIwZhyy.exe
  2⤵
  PID:8928
- C:\Windows\System\lpOxJRS.exe
  C:\Windows\System\lpOxJRS.exe
  2⤵
  PID:9020
- C:\Windows\System\kLrIbNW.exe
  C:\Windows\System\kLrIbNW.exe
  2⤵
  PID:9056
- C:\Windows\System\NLBbjAI.exe
  C:\Windows\System\NLBbjAI.exe
  2⤵
  PID:8908
- C:\Windows\System\FwcOeEt.exe
  C:\Windows\System\FwcOeEt.exe
  2⤵
  PID:8912
- C:\Windows\System\rWuLKcL.exe
  C:\Windows\System\rWuLKcL.exe
  2⤵
  PID:9072
- C:\Windows\System\RUPIDIx.exe
  C:\Windows\System\RUPIDIx.exe
  2⤵
  PID:9128
- C:\Windows\System\nynIJEb.exe
  C:\Windows\System\nynIJEb.exe
  2⤵
  PID:9124
- C:\Windows\System\AYptsvR.exe
  C:\Windows\System\AYptsvR.exe
  2⤵
  PID:9188
- C:\Windows\System\oMVNjmQ.exe
  C:\Windows\System\oMVNjmQ.exe
  2⤵
  PID:6188
- C:\Windows\System\FabvvdQ.exe
  C:\Windows\System\FabvvdQ.exe
  2⤵
  PID:9208
- C:\Windows\System\vZDNAog.exe
  C:\Windows\System\vZDNAog.exe
  2⤵
  PID:8372
- C:\Windows\System\RmyYOMb.exe
  C:\Windows\System\RmyYOMb.exe
  2⤵
  PID:7812
- C:\Windows\System\uidmQJm.exe
  C:\Windows\System\uidmQJm.exe
  2⤵
  PID:8408
- C:\Windows\System\gvMfzZi.exe
  C:\Windows\System\gvMfzZi.exe
  2⤵
  PID:8360
- C:\Windows\System\jDaTGRL.exe
  C:\Windows\System\jDaTGRL.exe
  2⤵
  PID:8476
- C:\Windows\System\NETeNaB.exe
  C:\Windows\System\NETeNaB.exe
  2⤵
  PID:8572
- C:\Windows\System\CDKmZBF.exe
  C:\Windows\System\CDKmZBF.exe
  2⤵
  PID:8552
- C:\Windows\System\eNdOZal.exe
  C:\Windows\System\eNdOZal.exe
  2⤵
  PID:8624
- C:\Windows\System\WdzTTHQ.exe
  C:\Windows\System\WdzTTHQ.exe
  2⤵
  PID:8656
- C:\Windows\System\zJvNFxR.exe
  C:\Windows\System\zJvNFxR.exe
  2⤵
  PID:8860
- C:\Windows\System\DThgSOz.exe
  C:\Windows\System\DThgSOz.exe
  2⤵
  PID:8960
- C:\Windows\System\saQeKTj.exe
  C:\Windows\System\saQeKTj.exe
  2⤵
  PID:8944
- C:\Windows\System\HZiunjP.exe
  C:\Windows\System\HZiunjP.exe
  2⤵
  PID:8972
- C:\Windows\System\RhDuFUF.exe
  C:\Windows\System\RhDuFUF.exe
  2⤵
  PID:8976
- C:\Windows\System\bYuWRmy.exe
  C:\Windows\System\bYuWRmy.exe
  2⤵
  PID:7312
- C:\Windows\System\eEFVWtx.exe
  C:\Windows\System\eEFVWtx.exe
  2⤵
  PID:8344
- C:\Windows\System\KBlwUaD.exe
  C:\Windows\System\KBlwUaD.exe
  2⤵
  PID:8420
- C:\Windows\System\IJciGLI.exe
  C:\Windows\System\IJciGLI.exe
  2⤵
  PID:8556
- C:\Windows\System\dZHmpRo.exe
  C:\Windows\System\dZHmpRo.exe
  2⤵
  PID:8488
- C:\Windows\System\gnPmrkJ.exe
  C:\Windows\System\gnPmrkJ.exe
  2⤵
  PID:8816
- C:\Windows\System\gmRHjYJ.exe
  C:\Windows\System\gmRHjYJ.exe
  2⤵
  PID:9008
- C:\Windows\System\vOAbOOV.exe
  C:\Windows\System\vOAbOOV.exe
  2⤵
  PID:9040
- C:\Windows\System\fMcscfe.exe
  C:\Windows\System\fMcscfe.exe
  2⤵
  PID:9104
- C:\Windows\System\yGmCeLl.exe
  C:\Windows\System\yGmCeLl.exe
  2⤵
  PID:8292
- C:\Windows\System\rbyFmpq.exe
  C:\Windows\System\rbyFmpq.exe
  2⤵
  PID:9244
- C:\Windows\System\UJBhvQY.exe
  C:\Windows\System\UJBhvQY.exe
  2⤵
  PID:9260
- C:\Windows\System\wsMMoJR.exe
  C:\Windows\System\wsMMoJR.exe
  2⤵
  PID:9276
- C:\Windows\System\vEliYxH.exe
  C:\Windows\System\vEliYxH.exe
  2⤵
  PID:9292
- C:\Windows\System\OrWWmZH.exe
  C:\Windows\System\OrWWmZH.exe
  2⤵
  PID:9308
- C:\Windows\System\POmMgSN.exe
  C:\Windows\System\POmMgSN.exe
  2⤵
  PID:9416
- C:\Windows\System\USJUlwq.exe
  C:\Windows\System\USJUlwq.exe
  2⤵
  PID:9432
- C:\Windows\System\qBalMZb.exe
  C:\Windows\System\qBalMZb.exe
  2⤵
  PID:9448
- C:\Windows\System\eagilnU.exe
  C:\Windows\System\eagilnU.exe
  2⤵
  PID:9464
- C:\Windows\System\qySswnm.exe
  C:\Windows\System\qySswnm.exe
  2⤵
  PID:9492
- C:\Windows\System\PySuyKU.exe
  C:\Windows\System\PySuyKU.exe
  2⤵
  PID:9508
- C:\Windows\System\CEPeNrs.exe
  C:\Windows\System\CEPeNrs.exe
  2⤵
  PID:9524
- C:\Windows\System\jhIQmvm.exe
  C:\Windows\System\jhIQmvm.exe
  2⤵
  PID:9552
- C:\Windows\System\RxqsxTE.exe
  C:\Windows\System\RxqsxTE.exe
  2⤵
  PID:9568
- C:\Windows\System\OgeeEWI.exe
  C:\Windows\System\OgeeEWI.exe
  2⤵
  PID:9584
- C:\Windows\System\ApiEmKa.exe
  C:\Windows\System\ApiEmKa.exe
  2⤵
  PID:9604
- C:\Windows\System\ZBAwBpv.exe
  C:\Windows\System\ZBAwBpv.exe
  2⤵
  PID:9632
- C:\Windows\System\DpSRDav.exe
  C:\Windows\System\DpSRDav.exe
  2⤵
  PID:9652
- C:\Windows\System\wEHtnsG.exe
  C:\Windows\System\wEHtnsG.exe
  2⤵
  PID:9672
- C:\Windows\System\NWFKIid.exe
  C:\Windows\System\NWFKIid.exe
  2⤵
  PID:9692
- C:\Windows\System\sbYxDjH.exe
  C:\Windows\System\sbYxDjH.exe
  2⤵
  PID:9708
- C:\Windows\System\UUaWmgk.exe
  C:\Windows\System\UUaWmgk.exe
  2⤵
  PID:9756
- C:\Windows\System\sRYmWBG.exe
  C:\Windows\System\sRYmWBG.exe
  2⤵
  PID:9784
- C:\Windows\System\hMNpXca.exe
  C:\Windows\System\hMNpXca.exe
  2⤵
  PID:9812
- C:\Windows\System\wrSQjeT.exe
  C:\Windows\System\wrSQjeT.exe
  2⤵
  PID:9828
- C:\Windows\System\tznvxPw.exe
  C:\Windows\System\tznvxPw.exe
  2⤵
  PID:9844
- C:\Windows\System\pQKJvjX.exe
  C:\Windows\System\pQKJvjX.exe
  2⤵
  PID:9864
- C:\Windows\System\VHetHzS.exe
  C:\Windows\System\VHetHzS.exe
  2⤵
  PID:9880
- C:\Windows\System\ywGXnHp.exe
  C:\Windows\System\ywGXnHp.exe
  2⤵
  PID:9896
- C:\Windows\System\vyFvQJG.exe
  C:\Windows\System\vyFvQJG.exe
  2⤵
  PID:9912
- C:\Windows\System\hKGyyGP.exe
  C:\Windows\System\hKGyyGP.exe
  2⤵
  PID:9928
- C:\Windows\System\tkSOCmO.exe
  C:\Windows\System\tkSOCmO.exe
  2⤵
  PID:9948
- C:\Windows\System\fAmxnVL.exe
  C:\Windows\System\fAmxnVL.exe
  2⤵
  PID:9964
- C:\Windows\System\sPGpzQv.exe
  C:\Windows\System\sPGpzQv.exe
  2⤵
  PID:9980
- C:\Windows\System\pMpkngz.exe
  C:\Windows\System\pMpkngz.exe
  2⤵
  PID:9996
- C:\Windows\System\oJfKNmB.exe
  C:\Windows\System\oJfKNmB.exe
  2⤵
  PID:10012
- C:\Windows\System\hLgAVlb.exe
  C:\Windows\System\hLgAVlb.exe
  2⤵
  PID:10028
- C:\Windows\System\FYbgyam.exe
  C:\Windows\System\FYbgyam.exe
  2⤵
  PID:10044
- C:\Windows\System\iaBwwJz.exe
  C:\Windows\System\iaBwwJz.exe
  2⤵
  PID:10060
- C:\Windows\System\hMMbLHL.exe
  C:\Windows\System\hMMbLHL.exe
  2⤵
  PID:10076
- C:\Windows\System\ANpmWWw.exe
  C:\Windows\System\ANpmWWw.exe
  2⤵
  PID:10204
- C:\Windows\System\darxbOt.exe
  C:\Windows\System\darxbOt.exe
  2⤵
  PID:10228
- C:\Windows\System\RztgApE.exe
  C:\Windows\System\RztgApE.exe
  2⤵
  PID:8788
- C:\Windows\System\nvegcTS.exe
  C:\Windows\System\nvegcTS.exe
  2⤵
  PID:8124
- C:\Windows\System\HkSKzov.exe
  C:\Windows\System\HkSKzov.exe
  2⤵
  PID:9236
- C:\Windows\System\kSIpbkK.exe
  C:\Windows\System\kSIpbkK.exe
  2⤵
  PID:8800
- C:\Windows\System\gqNekKm.exe
  C:\Windows\System\gqNekKm.exe
  2⤵
  PID:7972
- C:\Windows\System\FBGmGoA.exe
  C:\Windows\System\FBGmGoA.exe
  2⤵
  PID:8768
- C:\Windows\System\HbXbiIb.exe
  C:\Windows\System\HbXbiIb.exe
  2⤵
  PID:9288
- C:\Windows\System\zwfgAoe.exe
  C:\Windows\System\zwfgAoe.exe
  2⤵
  PID:8272
- C:\Windows\System\hrOscXq.exe
  C:\Windows\System\hrOscXq.exe
  2⤵
  PID:9140
- C:\Windows\System\iecCIiU.exe
  C:\Windows\System\iecCIiU.exe
  2⤵
  PID:7216
- C:\Windows\System\ZEcTMIh.exe
  C:\Windows\System\ZEcTMIh.exe
  2⤵
  PID:9328
- C:\Windows\System\UkvBhMu.exe
  C:\Windows\System\UkvBhMu.exe
  2⤵
  PID:9344
- C:\Windows\System\GOcdoFX.exe
  C:\Windows\System\GOcdoFX.exe
  2⤵
  PID:9352
- C:\Windows\System\UybdIuh.exe
  C:\Windows\System\UybdIuh.exe
  2⤵
  PID:9376
- C:\Windows\System\ugAbmog.exe
  C:\Windows\System\ugAbmog.exe
  2⤵
  PID:9392
- C:\Windows\System\RZLXskA.exe
  C:\Windows\System\RZLXskA.exe
  2⤵
  PID:9456
- C:\Windows\System\fHcdlkn.exe
  C:\Windows\System\fHcdlkn.exe
  2⤵
  PID:9480
- C:\Windows\System\jLjidsy.exe
  C:\Windows\System\jLjidsy.exe
  2⤵
  PID:9444
- C:\Windows\System\OanYhnA.exe
  C:\Windows\System\OanYhnA.exe
  2⤵
  PID:9500
- C:\Windows\System\PmTYuIM.exe
  C:\Windows\System\PmTYuIM.exe
  2⤵
  PID:9560
- C:\Windows\System\BuorEyq.exe
  C:\Windows\System\BuorEyq.exe
  2⤵
  PID:9564
- C:\Windows\System\IwYALJh.exe
  C:\Windows\System\IwYALJh.exe
  2⤵
  PID:9580
- C:\Windows\System\QkUtSYD.exe
  C:\Windows\System\QkUtSYD.exe
  2⤵
  PID:9624
- C:\Windows\System\zzKIGcG.exe
  C:\Windows\System\zzKIGcG.exe
  2⤵
  PID:9704
- C:\Windows\System\ZQlMpBR.exe
  C:\Windows\System\ZQlMpBR.exe
  2⤵
  PID:9684
- C:\Windows\System\yIMHEzL.exe
  C:\Windows\System\yIMHEzL.exe
  2⤵
  PID:9724
- C:\Windows\System\igKvkoY.exe
  C:\Windows\System\igKvkoY.exe
  2⤵
  PID:9640
- C:\Windows\System\KXcosec.exe
  C:\Windows\System\KXcosec.exe
  2⤵
  PID:9748
- C:\Windows\System\WzEmTjg.exe
  C:\Windows\System\WzEmTjg.exe
  2⤵
  PID:7620
- C:\Windows\System\FxJTUjd.exe
  C:\Windows\System\FxJTUjd.exe
  2⤵
  PID:9796
- C:\Windows\System\AJNDlMU.exe
  C:\Windows\System\AJNDlMU.exe
  2⤵
  PID:9840
- C:\Windows\System\MTMKsUC.exe
  C:\Windows\System\MTMKsUC.exe
  2⤵
  PID:9908
- C:\Windows\System\zWiYELL.exe
  C:\Windows\System\zWiYELL.exe
  2⤵
  PID:9920
- C:\Windows\System\nxWMZcV.exe
  C:\Windows\System\nxWMZcV.exe
  2⤵
  PID:9972
- C:\Windows\System\fZmRoRR.exe
  C:\Windows\System\fZmRoRR.exe
  2⤵
  PID:10036
- C:\Windows\System\glwBQEv.exe
  C:\Windows\System\glwBQEv.exe
  2⤵
  PID:9960
- C:\Windows\System\WUpbGuz.exe
  C:\Windows\System\WUpbGuz.exe
  2⤵
  PID:10024
- C:\Windows\System\smzNhha.exe
  C:\Windows\System\smzNhha.exe
  2⤵
  PID:10084
- C:\Windows\System\EfhFwgD.exe
  C:\Windows\System\EfhFwgD.exe
  2⤵
  PID:10108
- C:\Windows\System\kvVYnVk.exe
  C:\Windows\System\kvVYnVk.exe
  2⤵
  PID:10140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CeQUQwT.exe

Filesize
943KB

MD5
99faa2c4e4dea236898d175dbea2cb3c

SHA1
042e64fd1dde8fe54c42d0e094a8fbb2b5db36f0

SHA256
62d043441250844fbff822795e3f5e127dc0c64b00b8e45fb5c0de11fb50f906

SHA512
80b3701f0cf654167ab0ac971e86e09722bb7aaa42a54cbb540a4a722bfbb93d94a5b0d48683b37c0b68e829d66fedfc4208275a63dac65af4ec3be6aa251f61

Download Submit
C:\Windows\system\DHjjJos.exe

Filesize
948KB

MD5
d9236b7672f7e4b044e26153136f39ff

SHA1
f1145c1ff6e3a0a528af74fb70fefa7f8c705ab4

SHA256
4b871464357919dbfe832c3dd8874c2f84897807356e95f5e24806cc9ba6496e

SHA512
b95cbb8eed7bd6779fad66b0c4ed77e9f5d80474975bee5564c980db0a18602504cabba65e4d913fbd8d841942786a65512ccb86e67e924decb69ef796356e87

Download Submit
C:\Windows\system\DLojold.exe

Filesize
946KB

MD5
4fe10f86c3f1fb16ab8b67a86239ab6b

SHA1
c5339476798d8f691371223892924fa8053a8f4e

SHA256
7d4fda8979163ef317ec37dd99348708341401318a740bfcd1ee07feefc246fc

SHA512
d93da1d22f4e7d6b279ce232154b8d032c9fe2991fac92499e164eeb0a75f53a2415e204f0d9f90a0da26b7d7cb508bb08505d81f17b2656a6e2df5f6f2fc6f8

Download Submit
C:\Windows\system\ERcvkwQ.exe

Filesize
943KB

MD5
1cda74a2596a608734bb7fdc5cfac4fc

SHA1
540c93597d4a5be919196a63ca5d46485ea91c5b

SHA256
3318c6e1cc221b5c91920f6d3cb34dceca455437f0ce8da4ad01061befb758ad

SHA512
6e7bed78565a6ac1ac7cc71b8ee74481558ef1d574e2b1348ac4dad75aac2f183f7c77d7c269b6e3cc6201cd5df2781bc16eb9633c2908812aa2ee90391a728d

Download Submit
C:\Windows\system\EWEvAlx.exe

Filesize
945KB

MD5
482378ff1597679ca9e4e86ae46aa0cd

SHA1
c5947c93853a7f50a6d5a16197c7aeb6d1a4cb64

SHA256
0bc6510ae5dc9e317261f4f3a832c7e8ab84c0c0136c633ee0f2834e23a0ff6b

SHA512
e87930c1c1911fad21a15d93b7abed3cdedbd4d4662163618c12c71704ac1d0b68d7787a257abf4bcda0c6450b77991298a2aedd27867765ec17dae4ada0dbe3

Download Submit
C:\Windows\system\KvbPGWB.exe

Filesize
946KB

MD5
d6fd85799c1ca1564f0e0a81b103c306

SHA1
44e1faa8215046e1aeb3fbb535654baefcfc1641

SHA256
23c82a3e6f006ef6186bf1d3c921e68237910623deea9c4bb328c1723c39f2d3

SHA512
2342648bec08483bf35a354f0e7776ff1ee9c1b0b4502a2ff834b29750fdf0e2cd8505269b8c56fb8ce2666f4d9b9d03990a509ba3f389860a61e78ca9064aca

Download Submit
C:\Windows\system\MfSWXnV.exe

Filesize
947KB

MD5
01734ae4bdf0b14eba593b5e0675cf67

SHA1
4881f5272d04f6101da595db8d4fd9e1c3fb7c91

SHA256
540e48dfd9ef69454fad1d37376ada3a318e545a2cd63323d0ed124e766b996b

SHA512
b2a3d5775e87f72199cea6436471d1354fb91b02f3ac31d085eb9b842311eef25721bb699f1acd09e60800993f620790895b7ffaf846d68d36fa7fbcd6360550

Download Submit
C:\Windows\system\NsFhDHB.exe

Filesize
943KB

MD5
4821ac67c946847fc1bd8037a61a354b

SHA1
86928e07c170bc9ef5ce698ee45c85e3245df4d2

SHA256
505c830af4de00ba49dbae04066ad32dc4140ac09dadc4dfdca6e2d4a902159f

SHA512
fe12b60ee9450105b6228cdb587c90da5232999785c58d18a35110f2bc544cd82ffba68427f2a897626b8a67e99b7ef70e012fb7a313acaed0ef4935ea249014

Download Submit
C:\Windows\system\OylOKLM.exe

Filesize
945KB

MD5
652d4244c68b395059e46d41486767d0

SHA1
e9db224df40b09eca2a1a9d06737f84c64f97a39

SHA256
163c0b53b96f85dde6ab9fa328baa562bac5e43b087a9a83d9922c49d8fb265c

SHA512
f15f49c61a29c1c160e430efcccec93186c2dbd90ea5b78201f26c983687b2f5afb8559124566bf54bab6032b0b77d5cdcd58f1ad75d421577433831bf7bfb8c

Download Submit
C:\Windows\system\QvUBkOI.exe

Filesize
949KB

MD5
cbd6f4f87d1948d39c6024b0ead6d1dc

SHA1
02513c068ce5261d3af8fe34fa39164afe6fc154

SHA256
1991436072151fa20e52af235fe84a1718cd5856bd31796135c76bad5a6b14a9

SHA512
99151f4cfa6c3609a33c01df95daabd32db56522dc2e05b0ae3bc1d81b31b0999d9bbef3cdf18f9fe1726a6e2916bc96ffca35c64443259bc07f8b150cd8b277

Download Submit
C:\Windows\system\UIPDFWc.exe

Filesize
948KB

MD5
60bd1960c4a2c1758339dacfd7005f8b

SHA1
7f8b8b01540e458fa12fb63c423868debe70bdeb

SHA256
b03e51a01f0be08d62f6a9a7076e88a5c1bda1394ee96f82d32d10345c020cd1

SHA512
2bac17c668282f2bb08c2f22c381548555024feb18837f671b29b16cc1e267123f599e163724dbc661c49bfc2cb16ec17826f5863f068b22ae88a10935218810

Download Submit
C:\Windows\system\UrwhlXT.exe

Filesize
948KB

MD5
5e2612c57e2dd68fac53ab4c2ab201da

SHA1
54f4a423e77d093894741bd0be10282b2be96bb4

SHA256
36a7c148d2604b1646529f6843f02e75a41235cbf6a0a56416b8ec21fc38fe3a

SHA512
24aa1acda4f48f05b572af455f4d6037c04de14c0b472159b75ef3138233dac50139317badd784fb90013f5f9831dc3e16f28f0de11a67cdce554f3137591398

Download Submit
C:\Windows\system\VEGYerx.exe

Filesize
944KB

MD5
edd8c1490c91d4949005246ea51e32ba

SHA1
a7e3b5c63daf4a8e43f5812de34b658c004d1470

SHA256
8438a8371db7a0013dde7dfcabacde44520bbdb75aa08ee5846126a2b2456282

SHA512
de099a021f2809aa52800e545675d669b0f86c20f6561ce631cd923294e021a3cf308680b9c6c61b58d327f6d23c9a344ec2792d872676360fc6f4dffa48dd6a

Download Submit
C:\Windows\system\aboQJYW.exe

Filesize
945KB

MD5
ef9a3e086ea622306e8a89cd9df9d0d8

SHA1
68091d1fc94e4e1abb7eb2bad9c22190c869e7fa

SHA256
c76951e1b6912f9bb736e511a2717ef53b18b8f95932e78582901da39f310e28

SHA512
b2e07b0b5d49eee409da02d855217c37d3c20c24bbbaefeec89f815c1e09707d65d81f1177936a06110ed871059091dba4204d4b4fabe210b870dd28ae3a1fd2

Download Submit
C:\Windows\system\cybjbIX.exe

Filesize
944KB

MD5
a4137941386d564448e45dacdf04143f

SHA1
7b6f12503d543e9f97a3c7529877aaf587378476

SHA256
de92f6f40bb501bcdb2ee74f173501be540167523228089275cb3a9ef214f474

SHA512
fa62a71d085fd061d1515dab83c1526fdd1c8b761908f2e80e8adf552797df80957e6773cdb5d4afe64de663d985e7f337dcef80efddb7d5b2662fe68c683a0d

Download Submit
C:\Windows\system\erZUUtQ.exe

Filesize
944KB

MD5
cace2c8cc3b10fc8e862d957380150db

SHA1
4067980303d4866d778a8266a468f145652016b9

SHA256
58b3d07b54903936b6d601d25c27ac278f04642e0b331c83db3a5ec5c15e889d

SHA512
a11157023366a16acd9a30ccd4f402252d55b208885871f09f98fea1b3b6256e29e36dbaa72a12af5c4b851914f1b6e1890fa489b7114cc904ddce1a9ade9e82

Download Submit
C:\Windows\system\fXAgsCx.exe

Filesize
946KB

MD5
61b9a1e6a719ceb3045715769ede8619

SHA1
e4a3684a4ec5dc7bd6eb85dbdd0aa5c03ebf26ca

SHA256
1a12bb1d2f76bb08c9427b4ba8f44b04654c18efc94be381ac89d4df0449e671

SHA512
a18f84a6a772962a0a66729739c9ed2dbe88c34e40ac95669ca10d7df6ac4626280cbd1564249bdf6bd6f65d19af83dc240ca9948705b69b0a3ca55919ea1bc1

Download Submit
C:\Windows\system\mTlvtYJ.exe

Filesize
947KB

MD5
104400cde542d4e4910bceed946ed5da

SHA1
55d512b9afec694d2f749f0feb45ececb2e69a04

SHA256
16b098d5f496beffc341de7b2c272392fd20b98b288cda9152b47e99e7c7a8a1

SHA512
3d1bf9db6807e92c5e7a9539d5c60b6c1318e5ce2bd7d4c57dd82dbf1135fcfae68cb9555eddc7c679c3d1028403aae73448699be2e37c25d0adfb268b4baec3

Download Submit
C:\Windows\system\pNRSinb.exe

Filesize
942KB

MD5
ff382d433447d863602e6d464c052c8e

SHA1
85f3884ec3e7acd986a08e4ac5a0054978156666

SHA256
72a5840313fec0e7483684c5993d2147e7fbf950844995f628b555b20d3fb978

SHA512
17a778e9df183347c927731b87c114b53eca82c38396b011d4503c67290d1215f8deddcfa7e121d999e1518c5e9b41a554d81e772146824d94d2e0539b35082f

Download Submit
C:\Windows\system\qXPUfjp.exe

Filesize
947KB

MD5
f374137f3b9ec3b2b3d981b57a84a842

SHA1
4cc219d0b116c384685b56aa2ab1876b89d55ca5

SHA256
778c3ecdac6e47748701dff3bffa441d415a91f8b7f9f4264d9bee1703279cca

SHA512
a185c3b954ba64a2e989e858d353566fdb147adb43919b9b49150e6ebcdb2f95df7a3a94a250b04d679ca50a955afdf4f2f2177a99303e4cf733e34b21fce0fe

Download Submit
C:\Windows\system\rpUtdmU.exe

Filesize
947KB

MD5
599d32a1f748afbcd03d8ec5a01326d5

SHA1
5ba62dea7e4a8d4b5ef460bdd6d2997caf07d456

SHA256
3aee35f6ffe6a51a417520b6af55c40f889a7b6638fd557d99e681583bb6fba0

SHA512
6de1c96030053380359861ecd47b2cf0bd8a25866fc5f581acbe84c60f201bd1de49fbc775ca2a055b71f32a5b8c5e995b925ee5cf0e0ad23137bb2ea55d665f

Download Submit
C:\Windows\system\taXiutd.exe

Filesize
944KB

MD5
9c644c4e630811b756e726e66ac34529

SHA1
1532886ce40acec26edda5350eb0d2193cbbc611

SHA256
660b03969c4cec070b2e8b365197515532f4517ab0894888faf2183af4155857

SHA512
1557bd03d164077a98fc7bf2fb9b07c6341859ed00879f07b0d7284c5ccf11fc98bc82941aadeccb262dc868ed2c2daa441ba0e805a05940987ab710ecd0a55d

Download Submit
C:\Windows\system\ukRJSKW.exe

Filesize
946KB

MD5
dad47e256583e0b6def0c0677fc7f412

SHA1
159a4675a3b248c864c247f6fc364cfb64193777

SHA256
19d8152c9478b13a3e3e40cb661b373b0a1538948e5b56b2ad7603e403969c8b

SHA512
b5dc5e627c0d148ce30e993a1ce6165ce638ef79c9f9dfc57b7ca3aac1079f81a79c4a8d9ee7afc60b322758b732c5b8ba1c0584f2e4d2d52b87e88dc081be43

Download Submit
C:\Windows\system\weqAUXI.exe

Filesize
945KB

MD5
ce94136448a38a8a320f39952051a385

SHA1
a89bb286c413d92fdc4319fd43d606fed888cd76

SHA256
8f8f585e1a845fd4100ca39b32ce5ad6759d2ee610b1b1218fecb65da37fa724

SHA512
1ddfee5c3146d56a2076462aeb7665f606862bd01970a0b4fc22f6381e33d1c0f8859d1cdc0e3e7c59a28191869a3026df4a3666b62ef0f6a58dd2dc2f3a29c7

Download Submit
C:\Windows\system\xZYtHLA.exe

Filesize
941KB

MD5
b93601bab24f5417799df01c1ae65007

SHA1
b16d59d65c9b768364b878e8288282b85c339d22

SHA256
4175f7939557c8a7c07297b458d7afc55cdebd4cb3c63ef871108369990e9e8f

SHA512
57e08ae83c3688494233e04827ea208537b5942889c90c4a7b08cc2563d2a4ece23cbe2cd381b37002a11f5ebd2687f36089af3d3e37a8a1080115d597b547c2

Download Submit
C:\Windows\system\zcSYlnH.exe

Filesize
948KB

MD5
267e9a949cc89335a8982772b7acaa10

SHA1
3e4ea52b38c7d49be85295c114d29250e4266b0e

SHA256
463a13ea119a123a0e46bbde5e6e67730f8b890f786ab70ee15fa4e1b1d8d002

SHA512
9ceacb4f4188f586945ebbb369fc596a91400f03c17a77a20a3e8a7a9c97b81ec095057fed554d6216a16ca7b26781c32ff4b7805ded8c3e9f9e05b746d52499

Download Submit
\Windows\system\ZaucqtD.exe

Filesize
943KB

MD5
93df9f77a5c1941221270c4612ad6875

SHA1
38cf7234407f3caf234e2a511b51b567f7821737

SHA256
0a6104456971d5943a0b695e3cdb50cf8f630820c2367f2ca0b2fb4934ed01c8

SHA512
f8cf04c22eee5f8747a7f34bc6158d5bc6c914f99d153e3aa3860e0738b461ab67766bb0ed9e9dbbfe44de3b648749425d0d24fe0e9876a93ed3118b06354944

Download Submit
\Windows\system\hkxvRop.exe

Filesize
942KB

MD5
ea0c0b194082dccb18905957ea409e24

SHA1
04115efef2945e26e4d0eefc7b1b426dedbe4793

SHA256
8aa2b031286bfb09aa4e719c1245cf1ce7f64bb35ceeaea33188059033bab56b

SHA512
5a9e036cb3d8b9e0592321e540619d070d1d782a632c58c66694883cf0507e862c1fee7ce876ca91cd6b822d37f7bbe868f7c060b2134be110ab35a506bfc4aa

Download Submit
\Windows\system\iThQoTP.exe

Filesize
942KB

MD5
ab61781adb99a86433f2f60ff20fde24

SHA1
1a1605564fe19b693b5a1eddd6ba1c2a2ac2c6a8

SHA256
e635f3e187c14473ffeaf4faeb1da9d7c62604d9bbdafd9867cbb376a9bceb3d

SHA512
91a5de5fdfa59c194e886fd404100187b7dd2df2ef69aa47c87d7e0566e0b47ef80f1ad23bd3f535d10c03c6e85f577a11804801649478cd0e6ea0f0fb66cf54

Download Submit
\Windows\system\lTrFQyq.exe

Filesize
942KB

MD5
dd76bdca6954adf67b13e6c4cc87a122

SHA1
80e1a0f919069a17b95a1a8a491e9ee640b349d7

SHA256
78166b3bb8811ff8d883174ba5ddba82665f8ee5155c6427a728a9a83143c213

SHA512
b110662c156665b6dbdf9e4af9d9eaee50fe3095879e332754ec30afa6996faccdde5e8c0098abcbb58345eedc95cd75485b967019c0933f2b5780e00329c646

Download Submit
\Windows\system\uLBopwc.exe

Filesize
941KB

MD5
fc6e497dca42e8f1c20792a2d446849f

SHA1
82c6ad81c39a0a3cfff1b9b6e97e56fd9653d7c7

SHA256
f57e4bdbc3d9f0d1d2cc45ad0380ceb5eceef4dc2c489c7bfeb107f60f02c94b

SHA512
d28ecf26cc482b4cfb471473aa02edef35d730d3d82a0131bdb988a86c5771fdc051fccb49c6cae600eeb48f01920378444525a20b7adcfadc6eb2f2cf1e1ee9

Download Submit
\Windows\system\yMAkcjI.exe

Filesize
941KB

MD5
937711a25ba2a1ca148f2f338cb29d0f

SHA1
28ffa1e0566bb120266e65bf2bb66167da25599d

SHA256
ca740453a1f6198903a5472be37b8b213c2f7f1d3402650560ef5c5fc4dfe623

SHA512
79513fa6927d3e8f8cc291696e78760fa429c12ab211c461f293781beac4ad5b64ed4bf5f2a324e3b7221c963a30f982153850aa4ed5f57895495863b58327f3

Download Submit
memory/2244-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download