xmrig | 84bfb4053a234f3f63cfce4107295e4ca39e3da62ae062bff8b4a951d7e51b1b

Analysis

max time kernel
150s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
Size

2.3MB
MD5

225832657beee50bd66a1d85460c1d40
SHA1

5d41fcc76e74db768c2ca6e0e0125a9c49333cf7
SHA256

84bfb4053a234f3f63cfce4107295e4ca39e3da62ae062bff8b4a951d7e51b1b
SHA512

fe4c7eea3e36fe1cdaa917e1e71668ede030827ab0de45874b4efb70becedfd2636ca3a490cf1891407f1fae837a209a35bdf1f4907821c1255a4e1b059265c3
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQHxlUyfL:oemTLkNdfE0pZrQ5

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 63 IoCs

miner

resource	yara_rule
behavioral1/memory/2724-0-0x000000013FE90000-0x00000001401E4000-memory.dmp	xmrig
behavioral1/files/0x0009000000015c23-3.dat	xmrig
behavioral1/files/0x000f000000015c7c-8.dat	xmrig
behavioral1/files/0x0008000000015db4-12.dat	xmrig
behavioral1/files/0x0009000000015e5b-22.dat	xmrig
behavioral1/files/0x0007000000015e02-21.dat	xmrig
behavioral1/files/0x0007000000016b5e-29.dat	xmrig
behavioral1/files/0x0006000000018b33-44.dat	xmrig
behavioral1/files/0x0006000000018b37-49.dat	xmrig
behavioral1/files/0x0006000000018b42-54.dat	xmrig
behavioral1/files/0x0006000000018b6a-64.dat	xmrig
behavioral1/files/0x0006000000018b73-69.dat	xmrig
behavioral1/files/0x0006000000018d06-84.dat	xmrig
behavioral1/files/0x000500000001931b-99.dat	xmrig
behavioral1/files/0x0005000000019368-109.dat	xmrig
behavioral1/files/0x000500000001939b-119.dat	xmrig
behavioral1/files/0x000500000001946f-139.dat	xmrig
behavioral1/files/0x00040000000194d6-159.dat	xmrig
behavioral1/memory/2552-476-0x000000013F3A0000-0x000000013F6F4000-memory.dmp	xmrig
behavioral1/memory/2452-488-0x000000013F5D0000-0x000000013F924000-memory.dmp	xmrig
behavioral1/memory/1048-490-0x000000013F050000-0x000000013F3A4000-memory.dmp	xmrig
behavioral1/memory/2320-486-0x000000013F2D0000-0x000000013F624000-memory.dmp	xmrig
behavioral1/memory/2428-484-0x000000013FA80000-0x000000013FDD4000-memory.dmp	xmrig
behavioral1/memory/2748-482-0x000000013F940000-0x000000013FC94000-memory.dmp	xmrig
behavioral1/memory/2608-480-0x000000013F870000-0x000000013FBC4000-memory.dmp	xmrig
behavioral1/memory/2708-478-0x000000013FA50000-0x000000013FDA4000-memory.dmp	xmrig
behavioral1/memory/2716-473-0x000000013F340000-0x000000013F694000-memory.dmp	xmrig
behavioral1/memory/2664-471-0x000000013F970000-0x000000013FCC4000-memory.dmp	xmrig
behavioral1/memory/2516-469-0x000000013F290000-0x000000013F5E4000-memory.dmp	xmrig
behavioral1/memory/2924-467-0x000000013F320000-0x000000013F674000-memory.dmp	xmrig
behavioral1/memory/2724-466-0x000000013F320000-0x000000013F674000-memory.dmp	xmrig
behavioral1/memory/1636-465-0x000000013F2D0000-0x000000013F624000-memory.dmp	xmrig
behavioral1/memory/2984-463-0x000000013F2E0000-0x000000013F634000-memory.dmp	xmrig
behavioral1/files/0x0005000000019485-150.dat	xmrig
behavioral1/files/0x00050000000194a4-153.dat	xmrig
behavioral1/files/0x0005000000019473-143.dat	xmrig
behavioral1/files/0x0005000000019410-129.dat	xmrig
behavioral1/files/0x000500000001946b-134.dat	xmrig
behavioral1/files/0x00050000000193b0-123.dat	xmrig
behavioral1/files/0x0005000000019377-114.dat	xmrig
behavioral1/files/0x0005000000019333-104.dat	xmrig
behavioral1/files/0x00050000000192c9-89.dat	xmrig
behavioral1/files/0x00050000000192f4-94.dat	xmrig
behavioral1/files/0x0006000000018ba2-78.dat	xmrig
behavioral1/files/0x0006000000018b96-74.dat	xmrig
behavioral1/files/0x0006000000018b4a-59.dat	xmrig
behavioral1/files/0x0006000000018b15-39.dat	xmrig
behavioral1/files/0x0006000000018ae8-34.dat	xmrig
behavioral1/memory/2552-2573-0x000000013F3A0000-0x000000013F6F4000-memory.dmp	xmrig
behavioral1/memory/2608-2552-0x000000013F870000-0x000000013FBC4000-memory.dmp	xmrig
behavioral1/memory/1636-2593-0x000000013F2D0000-0x000000013F624000-memory.dmp	xmrig
behavioral1/memory/2924-2591-0x000000013F320000-0x000000013F674000-memory.dmp	xmrig
behavioral1/memory/2708-3211-0x000000013FA50000-0x000000013FDA4000-memory.dmp	xmrig
behavioral1/memory/2664-3302-0x000000013F970000-0x000000013FCC4000-memory.dmp	xmrig
behavioral1/memory/2428-3306-0x000000013FA80000-0x000000013FDD4000-memory.dmp	xmrig
behavioral1/memory/2984-3305-0x000000013F2E0000-0x000000013F634000-memory.dmp	xmrig
behavioral1/memory/2716-3304-0x000000013F340000-0x000000013F694000-memory.dmp	xmrig
behavioral1/memory/2452-3303-0x000000013F5D0000-0x000000013F924000-memory.dmp	xmrig
behavioral1/memory/2748-3314-0x000000013F940000-0x000000013FC94000-memory.dmp	xmrig
behavioral1/memory/2320-3331-0x000000013F2D0000-0x000000013F624000-memory.dmp	xmrig
behavioral1/memory/2516-3380-0x000000013F290000-0x000000013F5E4000-memory.dmp	xmrig
behavioral1/memory/1048-3351-0x000000013F050000-0x000000013F3A4000-memory.dmp	xmrig
behavioral1/memory/2724-5811-0x000000013FE90000-0x00000001401E4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2984	egnofpW.exe
1636	hfdGftR.exe
2924	cTpliuS.exe
2516	UFkInBI.exe
2664	QLPQlAS.exe
2716	cUNxvLI.exe
2552	gJvGvMS.exe
2708	FtRcWVL.exe
2608	MQaWwxK.exe
2748	kvGszGH.exe
2428	NVEvBfG.exe
2320	wSXiRQJ.exe
2452	ZpvRPxX.exe
1048	cNaXaQV.exe
1080	jCNpmyS.exe
2388	rryKVLM.exe
1800	BQiqHkA.exe
1840	vAlLPAW.exe
2468	ssxWGGF.exe
2616	kytZizb.exe
1928	JQWcOMM.exe
1968	PUtkzoq.exe
1332	rxkdPWn.exe
1944	sBSjzmO.exe
2316	yDvFlnG.exe
2368	UHVpsld.exe
2740	ZdvWzif.exe
2380	PRbrouy.exe
1724	cIhpjRM.exe
1020	DFTOczo.exe
2844	afOpURH.exe
2116	rPZMUeJ.exe
2248	glIFeGB.exe
2812	KLNaUus.exe
1704	nigtYwQ.exe
2992	kcrWgHU.exe
924	kiAWqXX.exe
744	igbImqp.exe
2060	HvmcuIf.exe
440	eQDOgls.exe
3064	riLFiXe.exe
600	DAQGNpF.exe
1328	zeUlmRx.exe
1192	dEcKVpq.exe
240	HrDpaFQ.exe
684	JUBHmhr.exe
1364	aFLyvgX.exe
2364	gpaXaEv.exe
2328	xuMkfmh.exe
900	tBncqgr.exe
1516	ahJVTro.exe
1316	FYsEXFx.exe
2236	tcpfgRi.exe
948	zIWJZnv.exe
2136	zvMpryN.exe
1816	SQarpZW.exe
1484	pAviHyf.exe
1904	DBMKZEx.exe
2996	HXLVHXk.exe
740	iToDOfo.exe
1488	QxjAMvY.exe
2840	YepoXLl.exe
1592	mfDcpoD.exe
2960	QvewZXr.exe

Loads dropped DLL 64 IoCs

pid	Process
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2724-0-0x000000013FE90000-0x00000001401E4000-memory.dmp	upx
behavioral1/files/0x0009000000015c23-3.dat	upx
behavioral1/files/0x000f000000015c7c-8.dat	upx
behavioral1/files/0x0008000000015db4-12.dat	upx
behavioral1/files/0x0009000000015e5b-22.dat	upx
behavioral1/files/0x0007000000015e02-21.dat	upx
behavioral1/files/0x0007000000016b5e-29.dat	upx
behavioral1/files/0x0006000000018b33-44.dat	upx
behavioral1/files/0x0006000000018b37-49.dat	upx
behavioral1/files/0x0006000000018b42-54.dat	upx
behavioral1/files/0x0006000000018b6a-64.dat	upx
behavioral1/files/0x0006000000018b73-69.dat	upx
behavioral1/files/0x0006000000018d06-84.dat	upx
behavioral1/files/0x000500000001931b-99.dat	upx
behavioral1/files/0x0005000000019368-109.dat	upx
behavioral1/files/0x000500000001939b-119.dat	upx
behavioral1/files/0x000500000001946f-139.dat	upx
behavioral1/files/0x00040000000194d6-159.dat	upx
behavioral1/memory/2552-476-0x000000013F3A0000-0x000000013F6F4000-memory.dmp	upx
behavioral1/memory/2452-488-0x000000013F5D0000-0x000000013F924000-memory.dmp	upx
behavioral1/memory/1048-490-0x000000013F050000-0x000000013F3A4000-memory.dmp	upx
behavioral1/memory/2320-486-0x000000013F2D0000-0x000000013F624000-memory.dmp	upx
behavioral1/memory/2428-484-0x000000013FA80000-0x000000013FDD4000-memory.dmp	upx
behavioral1/memory/2748-482-0x000000013F940000-0x000000013FC94000-memory.dmp	upx
behavioral1/memory/2608-480-0x000000013F870000-0x000000013FBC4000-memory.dmp	upx
behavioral1/memory/2708-478-0x000000013FA50000-0x000000013FDA4000-memory.dmp	upx
behavioral1/memory/2716-473-0x000000013F340000-0x000000013F694000-memory.dmp	upx
behavioral1/memory/2664-471-0x000000013F970000-0x000000013FCC4000-memory.dmp	upx
behavioral1/memory/2516-469-0x000000013F290000-0x000000013F5E4000-memory.dmp	upx
behavioral1/memory/2924-467-0x000000013F320000-0x000000013F674000-memory.dmp	upx
behavioral1/memory/1636-465-0x000000013F2D0000-0x000000013F624000-memory.dmp	upx
behavioral1/memory/2984-463-0x000000013F2E0000-0x000000013F634000-memory.dmp	upx
behavioral1/files/0x0005000000019485-150.dat	upx
behavioral1/files/0x00050000000194a4-153.dat	upx
behavioral1/files/0x0005000000019473-143.dat	upx
behavioral1/files/0x0005000000019410-129.dat	upx
behavioral1/files/0x000500000001946b-134.dat	upx
behavioral1/files/0x00050000000193b0-123.dat	upx
behavioral1/files/0x0005000000019377-114.dat	upx
behavioral1/files/0x0005000000019333-104.dat	upx
behavioral1/files/0x00050000000192c9-89.dat	upx
behavioral1/files/0x00050000000192f4-94.dat	upx
behavioral1/files/0x0006000000018ba2-78.dat	upx
behavioral1/files/0x0006000000018b96-74.dat	upx
behavioral1/files/0x0006000000018b4a-59.dat	upx
behavioral1/files/0x0006000000018b15-39.dat	upx
behavioral1/files/0x0006000000018ae8-34.dat	upx
behavioral1/memory/2552-2573-0x000000013F3A0000-0x000000013F6F4000-memory.dmp	upx
behavioral1/memory/2608-2552-0x000000013F870000-0x000000013FBC4000-memory.dmp	upx
behavioral1/memory/1636-2593-0x000000013F2D0000-0x000000013F624000-memory.dmp	upx
behavioral1/memory/2924-2591-0x000000013F320000-0x000000013F674000-memory.dmp	upx
behavioral1/memory/2708-3211-0x000000013FA50000-0x000000013FDA4000-memory.dmp	upx
behavioral1/memory/2664-3302-0x000000013F970000-0x000000013FCC4000-memory.dmp	upx
behavioral1/memory/2428-3306-0x000000013FA80000-0x000000013FDD4000-memory.dmp	upx
behavioral1/memory/2984-3305-0x000000013F2E0000-0x000000013F634000-memory.dmp	upx
behavioral1/memory/2716-3304-0x000000013F340000-0x000000013F694000-memory.dmp	upx
behavioral1/memory/2452-3303-0x000000013F5D0000-0x000000013F924000-memory.dmp	upx
behavioral1/memory/2748-3314-0x000000013F940000-0x000000013FC94000-memory.dmp	upx
behavioral1/memory/2320-3331-0x000000013F2D0000-0x000000013F624000-memory.dmp	upx
behavioral1/memory/2516-3380-0x000000013F290000-0x000000013F5E4000-memory.dmp	upx
behavioral1/memory/1048-3351-0x000000013F050000-0x000000013F3A4000-memory.dmp	upx
behavioral1/memory/2724-5811-0x000000013FE90000-0x00000001401E4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LoeSgXV.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\gLSfDGQ.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\GwhkhjP.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\Svwywed.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\OBTkLhk.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\QYoQFKI.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\nnPAcDp.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\dDXrqLq.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\WurxnBJ.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\RifnuSm.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\eByuHYB.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\hoXMRKi.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\SJrlMsU.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\EKrMurQ.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\aLGNbnJ.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\WNVaRoi.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\QxjAMvY.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\FiSmvdo.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\MlFTVTR.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\fcghYjM.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\USxyJLN.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\vKOnrDt.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\sgIjtOJ.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\oxSRzoW.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\cGIJXpf.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\nYqNpJj.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\jCNpmyS.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\kjsncPU.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\OfJwQMn.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\urIHmaa.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\ofeMOVq.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\iJyQFVP.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\etCyMcA.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\gZbJWys.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\Vuwbqwg.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\LCwUnHX.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\rUqRZov.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\kZWolsq.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\SNivtlO.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\PfHYXPC.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\LMxzaDc.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\yAWTeHI.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\HbbSIUw.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\FmgcluW.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\kZxXgUN.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\HwgbzHv.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\uxZYclc.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\bSAdNDK.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\lasRsSw.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\CGYmWsd.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\RtaIScU.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\yBtQrhu.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\VzeepjI.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\tLBRjvN.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\cfDORZU.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\TJWlqRo.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\pBdGXCE.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\NHygFcV.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\oXCUOZd.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\zejnIEG.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\WSbCGQR.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\kzoUPEM.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\ILBJIXh.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
File created	C:\Windows\System\IkToVuV.exe	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2984	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	29
PID 2724 wrote to memory of 2984	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	29
PID 2724 wrote to memory of 2984	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	29
PID 2724 wrote to memory of 1636	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	30
PID 2724 wrote to memory of 1636	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	30
PID 2724 wrote to memory of 1636	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	30
PID 2724 wrote to memory of 2924	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	31
PID 2724 wrote to memory of 2924	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	31
PID 2724 wrote to memory of 2924	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	31
PID 2724 wrote to memory of 2516	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	32
PID 2724 wrote to memory of 2516	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	32
PID 2724 wrote to memory of 2516	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	32
PID 2724 wrote to memory of 2664	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	33
PID 2724 wrote to memory of 2664	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	33
PID 2724 wrote to memory of 2664	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	33
PID 2724 wrote to memory of 2716	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	34
PID 2724 wrote to memory of 2716	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	34
PID 2724 wrote to memory of 2716	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	34
PID 2724 wrote to memory of 2552	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	35
PID 2724 wrote to memory of 2552	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	35
PID 2724 wrote to memory of 2552	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	35
PID 2724 wrote to memory of 2708	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	36
PID 2724 wrote to memory of 2708	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	36
PID 2724 wrote to memory of 2708	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	36
PID 2724 wrote to memory of 2608	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	37
PID 2724 wrote to memory of 2608	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	37
PID 2724 wrote to memory of 2608	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	37
PID 2724 wrote to memory of 2748	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	38
PID 2724 wrote to memory of 2748	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	38
PID 2724 wrote to memory of 2748	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	38
PID 2724 wrote to memory of 2428	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	39
PID 2724 wrote to memory of 2428	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	39
PID 2724 wrote to memory of 2428	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	39
PID 2724 wrote to memory of 2320	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	40
PID 2724 wrote to memory of 2320	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	40
PID 2724 wrote to memory of 2320	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	40
PID 2724 wrote to memory of 2452	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	41
PID 2724 wrote to memory of 2452	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	41
PID 2724 wrote to memory of 2452	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	41
PID 2724 wrote to memory of 1048	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	42
PID 2724 wrote to memory of 1048	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	42
PID 2724 wrote to memory of 1048	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	42
PID 2724 wrote to memory of 1080	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	43
PID 2724 wrote to memory of 1080	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	43
PID 2724 wrote to memory of 1080	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	43
PID 2724 wrote to memory of 2388	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	44
PID 2724 wrote to memory of 2388	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	44
PID 2724 wrote to memory of 2388	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	44
PID 2724 wrote to memory of 1800	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	45
PID 2724 wrote to memory of 1800	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	45
PID 2724 wrote to memory of 1800	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	45
PID 2724 wrote to memory of 1840	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	46
PID 2724 wrote to memory of 1840	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	46
PID 2724 wrote to memory of 1840	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	46
PID 2724 wrote to memory of 2468	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	47
PID 2724 wrote to memory of 2468	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	47
PID 2724 wrote to memory of 2468	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	47
PID 2724 wrote to memory of 2616	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	48
PID 2724 wrote to memory of 2616	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	48
PID 2724 wrote to memory of 2616	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	48
PID 2724 wrote to memory of 1928	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	49
PID 2724 wrote to memory of 1928	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	49
PID 2724 wrote to memory of 1928	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	49
PID 2724 wrote to memory of 1968	2724	225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\225832657beee50bd66a1d85460c1d40_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\System\egnofpW.exe
  C:\Windows\System\egnofpW.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\hfdGftR.exe
  C:\Windows\System\hfdGftR.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\cTpliuS.exe
  C:\Windows\System\cTpliuS.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\UFkInBI.exe
  C:\Windows\System\UFkInBI.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\QLPQlAS.exe
  C:\Windows\System\QLPQlAS.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\cUNxvLI.exe
  C:\Windows\System\cUNxvLI.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\gJvGvMS.exe
  C:\Windows\System\gJvGvMS.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\FtRcWVL.exe
  C:\Windows\System\FtRcWVL.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\MQaWwxK.exe
  C:\Windows\System\MQaWwxK.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\kvGszGH.exe
  C:\Windows\System\kvGszGH.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\NVEvBfG.exe
  C:\Windows\System\NVEvBfG.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\wSXiRQJ.exe
  C:\Windows\System\wSXiRQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\ZpvRPxX.exe
  C:\Windows\System\ZpvRPxX.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\cNaXaQV.exe
  C:\Windows\System\cNaXaQV.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\jCNpmyS.exe
  C:\Windows\System\jCNpmyS.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\rryKVLM.exe
  C:\Windows\System\rryKVLM.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\BQiqHkA.exe
  C:\Windows\System\BQiqHkA.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\vAlLPAW.exe
  C:\Windows\System\vAlLPAW.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\ssxWGGF.exe
  C:\Windows\System\ssxWGGF.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\kytZizb.exe
  C:\Windows\System\kytZizb.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\JQWcOMM.exe
  C:\Windows\System\JQWcOMM.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\PUtkzoq.exe
  C:\Windows\System\PUtkzoq.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\rxkdPWn.exe
  C:\Windows\System\rxkdPWn.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\sBSjzmO.exe
  C:\Windows\System\sBSjzmO.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\yDvFlnG.exe
  C:\Windows\System\yDvFlnG.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\UHVpsld.exe
  C:\Windows\System\UHVpsld.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\ZdvWzif.exe
  C:\Windows\System\ZdvWzif.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\PRbrouy.exe
  C:\Windows\System\PRbrouy.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\cIhpjRM.exe
  C:\Windows\System\cIhpjRM.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\DFTOczo.exe
  C:\Windows\System\DFTOczo.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\afOpURH.exe
  C:\Windows\System\afOpURH.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\rPZMUeJ.exe
  C:\Windows\System\rPZMUeJ.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\glIFeGB.exe
  C:\Windows\System\glIFeGB.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\KLNaUus.exe
  C:\Windows\System\KLNaUus.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\nigtYwQ.exe
  C:\Windows\System\nigtYwQ.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\kcrWgHU.exe
  C:\Windows\System\kcrWgHU.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\kiAWqXX.exe
  C:\Windows\System\kiAWqXX.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\igbImqp.exe
  C:\Windows\System\igbImqp.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\HvmcuIf.exe
  C:\Windows\System\HvmcuIf.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\eQDOgls.exe
  C:\Windows\System\eQDOgls.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\riLFiXe.exe
  C:\Windows\System\riLFiXe.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\DAQGNpF.exe
  C:\Windows\System\DAQGNpF.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\zeUlmRx.exe
  C:\Windows\System\zeUlmRx.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\dEcKVpq.exe
  C:\Windows\System\dEcKVpq.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\HrDpaFQ.exe
  C:\Windows\System\HrDpaFQ.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\aFLyvgX.exe
  C:\Windows\System\aFLyvgX.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\JUBHmhr.exe
  C:\Windows\System\JUBHmhr.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\gpaXaEv.exe
  C:\Windows\System\gpaXaEv.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\xuMkfmh.exe
  C:\Windows\System\xuMkfmh.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\FYsEXFx.exe
  C:\Windows\System\FYsEXFx.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\tBncqgr.exe
  C:\Windows\System\tBncqgr.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\zIWJZnv.exe
  C:\Windows\System\zIWJZnv.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\ahJVTro.exe
  C:\Windows\System\ahJVTro.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\zvMpryN.exe
  C:\Windows\System\zvMpryN.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\tcpfgRi.exe
  C:\Windows\System\tcpfgRi.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\SQarpZW.exe
  C:\Windows\System\SQarpZW.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\pAviHyf.exe
  C:\Windows\System\pAviHyf.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\DBMKZEx.exe
  C:\Windows\System\DBMKZEx.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\HXLVHXk.exe
  C:\Windows\System\HXLVHXk.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\QxjAMvY.exe
  C:\Windows\System\QxjAMvY.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\iToDOfo.exe
  C:\Windows\System\iToDOfo.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\YepoXLl.exe
  C:\Windows\System\YepoXLl.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\mfDcpoD.exe
  C:\Windows\System\mfDcpoD.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\QvewZXr.exe
  C:\Windows\System\QvewZXr.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\DngylaU.exe
  C:\Windows\System\DngylaU.exe
  2⤵
  PID:1532
- C:\Windows\System\WhzGiag.exe
  C:\Windows\System\WhzGiag.exe
  2⤵
  PID:2920
- C:\Windows\System\pAvpkVV.exe
  C:\Windows\System\pAvpkVV.exe
  2⤵
  PID:2712
- C:\Windows\System\YwVbUTe.exe
  C:\Windows\System\YwVbUTe.exe
  2⤵
  PID:1548
- C:\Windows\System\uepnMwD.exe
  C:\Windows\System\uepnMwD.exe
  2⤵
  PID:2408
- C:\Windows\System\VzzDIGf.exe
  C:\Windows\System\VzzDIGf.exe
  2⤵
  PID:2472
- C:\Windows\System\HyvAUpl.exe
  C:\Windows\System\HyvAUpl.exe
  2⤵
  PID:3028
- C:\Windows\System\ITgxtiz.exe
  C:\Windows\System\ITgxtiz.exe
  2⤵
  PID:2392
- C:\Windows\System\ofrFcQJ.exe
  C:\Windows\System\ofrFcQJ.exe
  2⤵
  PID:1792
- C:\Windows\System\foFhvIM.exe
  C:\Windows\System\foFhvIM.exe
  2⤵
  PID:2980
- C:\Windows\System\kVfpIEn.exe
  C:\Windows\System\kVfpIEn.exe
  2⤵
  PID:832
- C:\Windows\System\aKvwQiz.exe
  C:\Windows\System\aKvwQiz.exe
  2⤵
  PID:2668
- C:\Windows\System\cQBpGKI.exe
  C:\Windows\System\cQBpGKI.exe
  2⤵
  PID:1500
- C:\Windows\System\aooJAkI.exe
  C:\Windows\System\aooJAkI.exe
  2⤵
  PID:1956
- C:\Windows\System\ztqbDjQ.exe
  C:\Windows\System\ztqbDjQ.exe
  2⤵
  PID:1648
- C:\Windows\System\JjLsDIX.exe
  C:\Windows\System\JjLsDIX.exe
  2⤵
  PID:1964
- C:\Windows\System\MNngZQB.exe
  C:\Windows\System\MNngZQB.exe
  2⤵
  PID:1036
- C:\Windows\System\xpCjgqu.exe
  C:\Windows\System\xpCjgqu.exe
  2⤵
  PID:2504
- C:\Windows\System\oiEUqDL.exe
  C:\Windows\System\oiEUqDL.exe
  2⤵
  PID:2448
- C:\Windows\System\cJXWdum.exe
  C:\Windows\System\cJXWdum.exe
  2⤵
  PID:768
- C:\Windows\System\nxiKfaF.exe
  C:\Windows\System\nxiKfaF.exe
  2⤵
  PID:528
- C:\Windows\System\ChISMGb.exe
  C:\Windows\System\ChISMGb.exe
  2⤵
  PID:2112
- C:\Windows\System\pZpstjJ.exe
  C:\Windows\System\pZpstjJ.exe
  2⤵
  PID:972
- C:\Windows\System\TOfJpbH.exe
  C:\Windows\System\TOfJpbH.exe
  2⤵
  PID:2148
- C:\Windows\System\thtpOzV.exe
  C:\Windows\System\thtpOzV.exe
  2⤵
  PID:2384
- C:\Windows\System\kzoUPEM.exe
  C:\Windows\System\kzoUPEM.exe
  2⤵
  PID:1656
- C:\Windows\System\uhRZWry.exe
  C:\Windows\System\uhRZWry.exe
  2⤵
  PID:1856
- C:\Windows\System\MQkeEfg.exe
  C:\Windows\System\MQkeEfg.exe
  2⤵
  PID:2792
- C:\Windows\System\XquehSG.exe
  C:\Windows\System\XquehSG.exe
  2⤵
  PID:1128
- C:\Windows\System\kLZtTgH.exe
  C:\Windows\System\kLZtTgH.exe
  2⤵
  PID:2888
- C:\Windows\System\AIcCNRc.exe
  C:\Windows\System\AIcCNRc.exe
  2⤵
  PID:1640
- C:\Windows\System\IgvxPOF.exe
  C:\Windows\System\IgvxPOF.exe
  2⤵
  PID:1684
- C:\Windows\System\nnfVLPK.exe
  C:\Windows\System\nnfVLPK.exe
  2⤵
  PID:1012
- C:\Windows\System\mZCiGFP.exe
  C:\Windows\System\mZCiGFP.exe
  2⤵
  PID:1744
- C:\Windows\System\vXVzWYr.exe
  C:\Windows\System\vXVzWYr.exe
  2⤵
  PID:2848
- C:\Windows\System\JxlXstO.exe
  C:\Windows\System\JxlXstO.exe
  2⤵
  PID:2264
- C:\Windows\System\vXDavKS.exe
  C:\Windows\System\vXDavKS.exe
  2⤵
  PID:1588
- C:\Windows\System\MXzcZxD.exe
  C:\Windows\System\MXzcZxD.exe
  2⤵
  PID:2092
- C:\Windows\System\aBOPkDT.exe
  C:\Windows\System\aBOPkDT.exe
  2⤵
  PID:2560
- C:\Windows\System\DCcaGMA.exe
  C:\Windows\System\DCcaGMA.exe
  2⤵
  PID:2788
- C:\Windows\System\LmMIKQG.exe
  C:\Windows\System\LmMIKQG.exe
  2⤵
  PID:2072
- C:\Windows\System\XmkQTqk.exe
  C:\Windows\System\XmkQTqk.exe
  2⤵
  PID:2540
- C:\Windows\System\fdgjSJp.exe
  C:\Windows\System\fdgjSJp.exe
  2⤵
  PID:2868
- C:\Windows\System\eZgzBZJ.exe
  C:\Windows\System\eZgzBZJ.exe
  2⤵
  PID:1372
- C:\Windows\System\YiUlxXF.exe
  C:\Windows\System\YiUlxXF.exe
  2⤵
  PID:2484
- C:\Windows\System\wNgsRrz.exe
  C:\Windows\System\wNgsRrz.exe
  2⤵
  PID:2672
- C:\Windows\System\vltbhSg.exe
  C:\Windows\System\vltbhSg.exe
  2⤵
  PID:2304
- C:\Windows\System\WjcuJIV.exe
  C:\Windows\System\WjcuJIV.exe
  2⤵
  PID:2628
- C:\Windows\System\eboQMuo.exe
  C:\Windows\System\eboQMuo.exe
  2⤵
  PID:1700
- C:\Windows\System\hZDkoTE.exe
  C:\Windows\System\hZDkoTE.exe
  2⤵
  PID:2152
- C:\Windows\System\czBVJih.exe
  C:\Windows\System\czBVJih.exe
  2⤵
  PID:1812
- C:\Windows\System\MSiEnit.exe
  C:\Windows\System\MSiEnit.exe
  2⤵
  PID:1852
- C:\Windows\System\slacaFf.exe
  C:\Windows\System\slacaFf.exe
  2⤵
  PID:748
- C:\Windows\System\fsgxydN.exe
  C:\Windows\System\fsgxydN.exe
  2⤵
  PID:2104
- C:\Windows\System\LFuKuQy.exe
  C:\Windows\System\LFuKuQy.exe
  2⤵
  PID:1692
- C:\Windows\System\YpKoisH.exe
  C:\Windows\System\YpKoisH.exe
  2⤵
  PID:1912
- C:\Windows\System\MLRFgAT.exe
  C:\Windows\System\MLRFgAT.exe
  2⤵
  PID:2220
- C:\Windows\System\wXnheSu.exe
  C:\Windows\System\wXnheSu.exe
  2⤵
  PID:1352
- C:\Windows\System\smWlMMu.exe
  C:\Windows\System\smWlMMu.exe
  2⤵
  PID:1720
- C:\Windows\System\VOwHhjL.exe
  C:\Windows\System\VOwHhjL.exe
  2⤵
  PID:2952
- C:\Windows\System\kZbmUxj.exe
  C:\Windows\System\kZbmUxj.exe
  2⤵
  PID:3020
- C:\Windows\System\ZlrjKeV.exe
  C:\Windows\System\ZlrjKeV.exe
  2⤵
  PID:2648
- C:\Windows\System\CrjTUgq.exe
  C:\Windows\System\CrjTUgq.exe
  2⤵
  PID:2024
- C:\Windows\System\WLmqKfN.exe
  C:\Windows\System\WLmqKfN.exe
  2⤵
  PID:2260
- C:\Windows\System\cwqMsHF.exe
  C:\Windows\System\cwqMsHF.exe
  2⤵
  PID:2312
- C:\Windows\System\YUigkvK.exe
  C:\Windows\System\YUigkvK.exe
  2⤵
  PID:676
- C:\Windows\System\VNUqSyJ.exe
  C:\Windows\System\VNUqSyJ.exe
  2⤵
  PID:2444
- C:\Windows\System\PRhafSa.exe
  C:\Windows\System\PRhafSa.exe
  2⤵
  PID:2480
- C:\Windows\System\SWmEziv.exe
  C:\Windows\System\SWmEziv.exe
  2⤵
  PID:2956
- C:\Windows\System\ZMmpmWQ.exe
  C:\Windows\System\ZMmpmWQ.exe
  2⤵
  PID:2004
- C:\Windows\System\yAvvCeG.exe
  C:\Windows\System\yAvvCeG.exe
  2⤵
  PID:1468
- C:\Windows\System\PhlBvqz.exe
  C:\Windows\System\PhlBvqz.exe
  2⤵
  PID:2156
- C:\Windows\System\fIBPNcm.exe
  C:\Windows\System\fIBPNcm.exe
  2⤵
  PID:840
- C:\Windows\System\bwSgqNx.exe
  C:\Windows\System\bwSgqNx.exe
  2⤵
  PID:2588
- C:\Windows\System\RuAgWgJ.exe
  C:\Windows\System\RuAgWgJ.exe
  2⤵
  PID:2164
- C:\Windows\System\DBXRIIA.exe
  C:\Windows\System\DBXRIIA.exe
  2⤵
  PID:964
- C:\Windows\System\YCdDxCu.exe
  C:\Windows\System\YCdDxCu.exe
  2⤵
  PID:476
- C:\Windows\System\Qwlvqdh.exe
  C:\Windows\System\Qwlvqdh.exe
  2⤵
  PID:1960
- C:\Windows\System\COoAspU.exe
  C:\Windows\System\COoAspU.exe
  2⤵
  PID:2080
- C:\Windows\System\QDPIbAX.exe
  C:\Windows\System\QDPIbAX.exe
  2⤵
  PID:1668
- C:\Windows\System\OMBaEIL.exe
  C:\Windows\System\OMBaEIL.exe
  2⤵
  PID:2460
- C:\Windows\System\TusCZud.exe
  C:\Windows\System\TusCZud.exe
  2⤵
  PID:2180
- C:\Windows\System\pMdLwmO.exe
  C:\Windows\System\pMdLwmO.exe
  2⤵
  PID:2760
- C:\Windows\System\GjCjqWD.exe
  C:\Windows\System\GjCjqWD.exe
  2⤵
  PID:552
- C:\Windows\System\OLseIHS.exe
  C:\Windows\System\OLseIHS.exe
  2⤵
  PID:1860
- C:\Windows\System\oeqcWcj.exe
  C:\Windows\System\oeqcWcj.exe
  2⤵
  PID:1788
- C:\Windows\System\nPSgsIR.exe
  C:\Windows\System\nPSgsIR.exe
  2⤵
  PID:2988
- C:\Windows\System\PHuBhfs.exe
  C:\Windows\System\PHuBhfs.exe
  2⤵
  PID:2536
- C:\Windows\System\TWfMVnN.exe
  C:\Windows\System\TWfMVnN.exe
  2⤵
  PID:1044
- C:\Windows\System\VQokyRn.exe
  C:\Windows\System\VQokyRn.exe
  2⤵
  PID:1504
- C:\Windows\System\LjCqcMW.exe
  C:\Windows\System\LjCqcMW.exe
  2⤵
  PID:2344
- C:\Windows\System\fSJcxmI.exe
  C:\Windows\System\fSJcxmI.exe
  2⤵
  PID:488
- C:\Windows\System\XMYEadF.exe
  C:\Windows\System\XMYEadF.exe
  2⤵
  PID:2860
- C:\Windows\System\hzcXgFj.exe
  C:\Windows\System\hzcXgFj.exe
  2⤵
  PID:1732
- C:\Windows\System\tMSTfaS.exe
  C:\Windows\System\tMSTfaS.exe
  2⤵
  PID:1932
- C:\Windows\System\mOEtWBc.exe
  C:\Windows\System\mOEtWBc.exe
  2⤵
  PID:1984
- C:\Windows\System\hDnlRVB.exe
  C:\Windows\System\hDnlRVB.exe
  2⤵
  PID:3088
- C:\Windows\System\KYlqnXW.exe
  C:\Windows\System\KYlqnXW.exe
  2⤵
  PID:3104
- C:\Windows\System\VZZDfHf.exe
  C:\Windows\System\VZZDfHf.exe
  2⤵
  PID:3124
- C:\Windows\System\KtMsFgF.exe
  C:\Windows\System\KtMsFgF.exe
  2⤵
  PID:3160
- C:\Windows\System\rWRzLkU.exe
  C:\Windows\System\rWRzLkU.exe
  2⤵
  PID:3180
- C:\Windows\System\GIcMedj.exe
  C:\Windows\System\GIcMedj.exe
  2⤵
  PID:3196
- C:\Windows\System\FBKFGeh.exe
  C:\Windows\System\FBKFGeh.exe
  2⤵
  PID:3220
- C:\Windows\System\xIMwzFM.exe
  C:\Windows\System\xIMwzFM.exe
  2⤵
  PID:3240
- C:\Windows\System\eEBScnx.exe
  C:\Windows\System\eEBScnx.exe
  2⤵
  PID:3260
- C:\Windows\System\suSQLLn.exe
  C:\Windows\System\suSQLLn.exe
  2⤵
  PID:3280
- C:\Windows\System\ExKQyoU.exe
  C:\Windows\System\ExKQyoU.exe
  2⤵
  PID:3300
- C:\Windows\System\fNIsRVj.exe
  C:\Windows\System\fNIsRVj.exe
  2⤵
  PID:3316
- C:\Windows\System\zFMFaIz.exe
  C:\Windows\System\zFMFaIz.exe
  2⤵
  PID:3336
- C:\Windows\System\qfupoey.exe
  C:\Windows\System\qfupoey.exe
  2⤵
  PID:3352
- C:\Windows\System\kqdtpET.exe
  C:\Windows\System\kqdtpET.exe
  2⤵
  PID:3376
- C:\Windows\System\iZErPUW.exe
  C:\Windows\System\iZErPUW.exe
  2⤵
  PID:3396
- C:\Windows\System\OCzsify.exe
  C:\Windows\System\OCzsify.exe
  2⤵
  PID:3416
- C:\Windows\System\ijRNIYQ.exe
  C:\Windows\System\ijRNIYQ.exe
  2⤵
  PID:3436
- C:\Windows\System\IhpPHXA.exe
  C:\Windows\System\IhpPHXA.exe
  2⤵
  PID:3452
- C:\Windows\System\AfTreWI.exe
  C:\Windows\System\AfTreWI.exe
  2⤵
  PID:3468
- C:\Windows\System\jVlpYhK.exe
  C:\Windows\System\jVlpYhK.exe
  2⤵
  PID:3488
- C:\Windows\System\jXJIjIk.exe
  C:\Windows\System\jXJIjIk.exe
  2⤵
  PID:3504
- C:\Windows\System\oYnRSwT.exe
  C:\Windows\System\oYnRSwT.exe
  2⤵
  PID:3524
- C:\Windows\System\mjkqmxc.exe
  C:\Windows\System\mjkqmxc.exe
  2⤵
  PID:3540
- C:\Windows\System\JhMFbOV.exe
  C:\Windows\System\JhMFbOV.exe
  2⤵
  PID:3556
- C:\Windows\System\iXxGGfT.exe
  C:\Windows\System\iXxGGfT.exe
  2⤵
  PID:3572
- C:\Windows\System\jmUjzjr.exe
  C:\Windows\System\jmUjzjr.exe
  2⤵
  PID:3592
- C:\Windows\System\sKFJeoY.exe
  C:\Windows\System\sKFJeoY.exe
  2⤵
  PID:3608
- C:\Windows\System\vnNUgOt.exe
  C:\Windows\System\vnNUgOt.exe
  2⤵
  PID:3648
- C:\Windows\System\dPOZbtu.exe
  C:\Windows\System\dPOZbtu.exe
  2⤵
  PID:3664
- C:\Windows\System\warSBpD.exe
  C:\Windows\System\warSBpD.exe
  2⤵
  PID:3680
- C:\Windows\System\VLLmSkL.exe
  C:\Windows\System\VLLmSkL.exe
  2⤵
  PID:3696
- C:\Windows\System\rTvhodD.exe
  C:\Windows\System\rTvhodD.exe
  2⤵
  PID:3712
- C:\Windows\System\MzkUtBV.exe
  C:\Windows\System\MzkUtBV.exe
  2⤵
  PID:3728
- C:\Windows\System\tLbgvHN.exe
  C:\Windows\System\tLbgvHN.exe
  2⤵
  PID:3744
- C:\Windows\System\JoWBWtd.exe
  C:\Windows\System\JoWBWtd.exe
  2⤵
  PID:3760
- C:\Windows\System\GPMudEM.exe
  C:\Windows\System\GPMudEM.exe
  2⤵
  PID:3776
- C:\Windows\System\UxBiZOL.exe
  C:\Windows\System\UxBiZOL.exe
  2⤵
  PID:3792
- C:\Windows\System\DOXJRgV.exe
  C:\Windows\System\DOXJRgV.exe
  2⤵
  PID:3808
- C:\Windows\System\sAvZQNb.exe
  C:\Windows\System\sAvZQNb.exe
  2⤵
  PID:3824
- C:\Windows\System\yIWBzca.exe
  C:\Windows\System\yIWBzca.exe
  2⤵
  PID:3840
- C:\Windows\System\gKpRosG.exe
  C:\Windows\System\gKpRosG.exe
  2⤵
  PID:3856
- C:\Windows\System\yEwBjaO.exe
  C:\Windows\System\yEwBjaO.exe
  2⤵
  PID:3872
- C:\Windows\System\TSYuJXD.exe
  C:\Windows\System\TSYuJXD.exe
  2⤵
  PID:3888
- C:\Windows\System\paXHKEg.exe
  C:\Windows\System\paXHKEg.exe
  2⤵
  PID:3904
- C:\Windows\System\xgSEWCw.exe
  C:\Windows\System\xgSEWCw.exe
  2⤵
  PID:3920
- C:\Windows\System\ApiEnzO.exe
  C:\Windows\System\ApiEnzO.exe
  2⤵
  PID:3936
- C:\Windows\System\orUVfjr.exe
  C:\Windows\System\orUVfjr.exe
  2⤵
  PID:3952
- C:\Windows\System\sbnfxyc.exe
  C:\Windows\System\sbnfxyc.exe
  2⤵
  PID:3968
- C:\Windows\System\bFRKMEx.exe
  C:\Windows\System\bFRKMEx.exe
  2⤵
  PID:3984
- C:\Windows\System\MTxIiwx.exe
  C:\Windows\System\MTxIiwx.exe
  2⤵
  PID:4000
- C:\Windows\System\EbpPwyu.exe
  C:\Windows\System\EbpPwyu.exe
  2⤵
  PID:4016
- C:\Windows\System\GaJorTf.exe
  C:\Windows\System\GaJorTf.exe
  2⤵
  PID:4036
- C:\Windows\System\ocVOCbU.exe
  C:\Windows\System\ocVOCbU.exe
  2⤵
  PID:4052
- C:\Windows\System\vccqEyM.exe
  C:\Windows\System\vccqEyM.exe
  2⤵
  PID:4068
- C:\Windows\System\EJEaBxx.exe
  C:\Windows\System\EJEaBxx.exe
  2⤵
  PID:4084
- C:\Windows\System\ExmHELU.exe
  C:\Windows\System\ExmHELU.exe
  2⤵
  PID:2852
- C:\Windows\System\ciWugle.exe
  C:\Windows\System\ciWugle.exe
  2⤵
  PID:1224
- C:\Windows\System\ipkwtfZ.exe
  C:\Windows\System\ipkwtfZ.exe
  2⤵
  PID:3060
- C:\Windows\System\ejmmvZv.exe
  C:\Windows\System\ejmmvZv.exe
  2⤵
  PID:2644
- C:\Windows\System\UGBYOjk.exe
  C:\Windows\System\UGBYOjk.exe
  2⤵
  PID:1296
- C:\Windows\System\UyiVxii.exe
  C:\Windows\System\UyiVxii.exe
  2⤵
  PID:1948
- C:\Windows\System\JyEgijS.exe
  C:\Windows\System\JyEgijS.exe
  2⤵
  PID:2732
- C:\Windows\System\CZrtzqs.exe
  C:\Windows\System\CZrtzqs.exe
  2⤵
  PID:2864
- C:\Windows\System\uGrkbfe.exe
  C:\Windows\System\uGrkbfe.exe
  2⤵
  PID:1620
- C:\Windows\System\cYaBsTp.exe
  C:\Windows\System\cYaBsTp.exe
  2⤵
  PID:2288
- C:\Windows\System\cHOpAdf.exe
  C:\Windows\System\cHOpAdf.exe
  2⤵
  PID:3076
- C:\Windows\System\xcDQPfK.exe
  C:\Windows\System\xcDQPfK.exe
  2⤵
  PID:3144
- C:\Windows\System\UlRrnhz.exe
  C:\Windows\System\UlRrnhz.exe
  2⤵
  PID:3188
- C:\Windows\System\PzYnzhV.exe
  C:\Windows\System\PzYnzhV.exe
  2⤵
  PID:3168
- C:\Windows\System\mMmitKJ.exe
  C:\Windows\System\mMmitKJ.exe
  2⤵
  PID:3176
- C:\Windows\System\hjuEoRM.exe
  C:\Windows\System\hjuEoRM.exe
  2⤵
  PID:3268
- C:\Windows\System\ABbwiBV.exe
  C:\Windows\System\ABbwiBV.exe
  2⤵
  PID:3272
- C:\Windows\System\FxeFjVO.exe
  C:\Windows\System\FxeFjVO.exe
  2⤵
  PID:3348
- C:\Windows\System\atiqBOk.exe
  C:\Windows\System\atiqBOk.exe
  2⤵
  PID:3384
- C:\Windows\System\DvFZuqr.exe
  C:\Windows\System\DvFZuqr.exe
  2⤵
  PID:3424
- C:\Windows\System\CJVErPp.exe
  C:\Windows\System\CJVErPp.exe
  2⤵
  PID:3288
- C:\Windows\System\GjbCVaa.exe
  C:\Windows\System\GjbCVaa.exe
  2⤵
  PID:3328
- C:\Windows\System\oodEHeI.exe
  C:\Windows\System\oodEHeI.exe
  2⤵
  PID:3496
- C:\Windows\System\HMbBJmo.exe
  C:\Windows\System\HMbBJmo.exe
  2⤵
  PID:3148
- C:\Windows\System\ZfzDllq.exe
  C:\Windows\System\ZfzDllq.exe
  2⤵
  PID:3568
- C:\Windows\System\VqgMAYQ.exe
  C:\Windows\System\VqgMAYQ.exe
  2⤵
  PID:3476
- C:\Windows\System\xhDHAir.exe
  C:\Windows\System\xhDHAir.exe
  2⤵
  PID:3404
- C:\Windows\System\rKQpiem.exe
  C:\Windows\System\rKQpiem.exe
  2⤵
  PID:3600
- C:\Windows\System\smPTdlN.exe
  C:\Windows\System\smPTdlN.exe
  2⤵
  PID:3520
- C:\Windows\System\VlmAdnA.exe
  C:\Windows\System\VlmAdnA.exe
  2⤵
  PID:3616
- C:\Windows\System\oTwgmUD.exe
  C:\Windows\System\oTwgmUD.exe
  2⤵
  PID:3692
- C:\Windows\System\uJpiyUB.exe
  C:\Windows\System\uJpiyUB.exe
  2⤵
  PID:3704
- C:\Windows\System\GmCgnRs.exe
  C:\Windows\System\GmCgnRs.exe
  2⤵
  PID:3756
- C:\Windows\System\VPRdqKA.exe
  C:\Windows\System\VPRdqKA.exe
  2⤵
  PID:3784
- C:\Windows\System\OikWCOF.exe
  C:\Windows\System\OikWCOF.exe
  2⤵
  PID:3816
- C:\Windows\System\HwLilRk.exe
  C:\Windows\System\HwLilRk.exe
  2⤵
  PID:3832
- C:\Windows\System\juhKodw.exe
  C:\Windows\System\juhKodw.exe
  2⤵
  PID:3880
- C:\Windows\System\ULMjRZm.exe
  C:\Windows\System\ULMjRZm.exe
  2⤵
  PID:3912
- C:\Windows\System\uUTYKTH.exe
  C:\Windows\System\uUTYKTH.exe
  2⤵
  PID:3868
- C:\Windows\System\BEXvdpg.exe
  C:\Windows\System\BEXvdpg.exe
  2⤵
  PID:3976
- C:\Windows\System\KaNiFUD.exe
  C:\Windows\System\KaNiFUD.exe
  2⤵
  PID:3932
- C:\Windows\System\snphlXI.exe
  C:\Windows\System\snphlXI.exe
  2⤵
  PID:3992
- C:\Windows\System\yWXQmlt.exe
  C:\Windows\System\yWXQmlt.exe
  2⤵
  PID:4032
- C:\Windows\System\iWvbbgd.exe
  C:\Windows\System\iWvbbgd.exe
  2⤵
  PID:4060
- C:\Windows\System\MwBiibh.exe
  C:\Windows\System\MwBiibh.exe
  2⤵
  PID:1772
- C:\Windows\System\iofntvF.exe
  C:\Windows\System\iofntvF.exe
  2⤵
  PID:1796
- C:\Windows\System\QOXeZqS.exe
  C:\Windows\System\QOXeZqS.exe
  2⤵
  PID:1028
- C:\Windows\System\ebgsEWP.exe
  C:\Windows\System\ebgsEWP.exe
  2⤵
  PID:2744
- C:\Windows\System\LCcvatf.exe
  C:\Windows\System\LCcvatf.exe
  2⤵
  PID:3136
- C:\Windows\System\zciTVen.exe
  C:\Windows\System\zciTVen.exe
  2⤵
  PID:3140
- C:\Windows\System\dvxkQDY.exe
  C:\Windows\System\dvxkQDY.exe
  2⤵
  PID:2496
- C:\Windows\System\CCcizjA.exe
  C:\Windows\System\CCcizjA.exe
  2⤵
  PID:3212
- C:\Windows\System\XSIIyRR.exe
  C:\Windows\System\XSIIyRR.exe
  2⤵
  PID:3208
- C:\Windows\System\tuwBgUq.exe
  C:\Windows\System\tuwBgUq.exe
  2⤵
  PID:3292
- C:\Windows\System\avMIHmO.exe
  C:\Windows\System\avMIHmO.exe
  2⤵
  PID:3464
- C:\Windows\System\mxwEVAP.exe
  C:\Windows\System\mxwEVAP.exe
  2⤵
  PID:2216
- C:\Windows\System\gYpICkb.exe
  C:\Windows\System\gYpICkb.exe
  2⤵
  PID:3364
- C:\Windows\System\cIHrbFp.exe
  C:\Windows\System\cIHrbFp.exe
  2⤵
  PID:3408
- C:\Windows\System\nrSTyxc.exe
  C:\Windows\System\nrSTyxc.exe
  2⤵
  PID:3584
- C:\Windows\System\ZOEYPbD.exe
  C:\Windows\System\ZOEYPbD.exe
  2⤵
  PID:3660
- C:\Windows\System\nWnzaaA.exe
  C:\Windows\System\nWnzaaA.exe
  2⤵
  PID:3708
- C:\Windows\System\cKcLqfs.exe
  C:\Windows\System\cKcLqfs.exe
  2⤵
  PID:3820
- C:\Windows\System\HAlhtRY.exe
  C:\Windows\System\HAlhtRY.exe
  2⤵
  PID:3852
- C:\Windows\System\bArVYWq.exe
  C:\Windows\System\bArVYWq.exe
  2⤵
  PID:3944
- C:\Windows\System\gjoKIsN.exe
  C:\Windows\System\gjoKIsN.exe
  2⤵
  PID:4044
- C:\Windows\System\oMvSlYZ.exe
  C:\Windows\System\oMvSlYZ.exe
  2⤵
  PID:4028
- C:\Windows\System\WrBsict.exe
  C:\Windows\System\WrBsict.exe
  2⤵
  PID:1768
- C:\Windows\System\QbvjTVn.exe
  C:\Windows\System\QbvjTVn.exe
  2⤵
  PID:1032
- C:\Windows\System\blQmBYX.exe
  C:\Windows\System\blQmBYX.exe
  2⤵
  PID:3100
- C:\Windows\System\HsdHjIb.exe
  C:\Windows\System\HsdHjIb.exe
  2⤵
  PID:3120
- C:\Windows\System\oXCUOZd.exe
  C:\Windows\System\oXCUOZd.exe
  2⤵
  PID:3388
- C:\Windows\System\zBkUICA.exe
  C:\Windows\System\zBkUICA.exe
  2⤵
  PID:3536
- C:\Windows\System\rTOXHiC.exe
  C:\Windows\System\rTOXHiC.exe
  2⤵
  PID:3412
- C:\Windows\System\sgFRXyM.exe
  C:\Windows\System\sgFRXyM.exe
  2⤵
  PID:3676
- C:\Windows\System\ASOIjRz.exe
  C:\Windows\System\ASOIjRz.exe
  2⤵
  PID:3804
- C:\Windows\System\wiWFSbi.exe
  C:\Windows\System\wiWFSbi.exe
  2⤵
  PID:3928
- C:\Windows\System\ucnnlwT.exe
  C:\Windows\System\ucnnlwT.exe
  2⤵
  PID:2016
- C:\Windows\System\aNRuCie.exe
  C:\Windows\System\aNRuCie.exe
  2⤵
  PID:2944
- C:\Windows\System\CdjQWHj.exe
  C:\Windows\System\CdjQWHj.exe
  2⤵
  PID:3040
- C:\Windows\System\VTWFXXA.exe
  C:\Windows\System\VTWFXXA.exe
  2⤵
  PID:1104
- C:\Windows\System\sZViOhr.exe
  C:\Windows\System\sZViOhr.exe
  2⤵
  PID:1040
- C:\Windows\System\AucwxLe.exe
  C:\Windows\System\AucwxLe.exe
  2⤵
  PID:1672
- C:\Windows\System\aRIBbGT.exe
  C:\Windows\System\aRIBbGT.exe
  2⤵
  PID:2020
- C:\Windows\System\lYNhVUl.exe
  C:\Windows\System\lYNhVUl.exe
  2⤵
  PID:1624
- C:\Windows\System\zNYAnia.exe
  C:\Windows\System\zNYAnia.exe
  2⤵
  PID:1524
- C:\Windows\System\RzRrvyk.exe
  C:\Windows\System\RzRrvyk.exe
  2⤵
  PID:824
- C:\Windows\System\HGxiJtP.exe
  C:\Windows\System\HGxiJtP.exe
  2⤵
  PID:3344
- C:\Windows\System\hoXMRKi.exe
  C:\Windows\System\hoXMRKi.exe
  2⤵
  PID:3252
- C:\Windows\System\jHnydTc.exe
  C:\Windows\System\jHnydTc.exe
  2⤵
  PID:3996
- C:\Windows\System\IZycerw.exe
  C:\Windows\System\IZycerw.exe
  2⤵
  PID:2836
- C:\Windows\System\TlsIsAi.exe
  C:\Windows\System\TlsIsAi.exe
  2⤵
  PID:3752
- C:\Windows\System\ewRnwYi.exe
  C:\Windows\System\ewRnwYi.exe
  2⤵
  PID:3900
- C:\Windows\System\eoSzJOs.exe
  C:\Windows\System\eoSzJOs.exe
  2⤵
  PID:3580
- C:\Windows\System\jmrWsIn.exe
  C:\Windows\System\jmrWsIn.exe
  2⤵
  PID:3428
- C:\Windows\System\TEaGgls.exe
  C:\Windows\System\TEaGgls.exe
  2⤵
  PID:1820
- C:\Windows\System\bgDQYiq.exe
  C:\Windows\System\bgDQYiq.exe
  2⤵
  PID:3236
- C:\Windows\System\iRlewli.exe
  C:\Windows\System\iRlewli.exe
  2⤵
  PID:660
- C:\Windows\System\NHqhcEl.exe
  C:\Windows\System\NHqhcEl.exe
  2⤵
  PID:2964
- C:\Windows\System\fPlnwvy.exe
  C:\Windows\System\fPlnwvy.exe
  2⤵
  PID:4108
- C:\Windows\System\MQIzRPd.exe
  C:\Windows\System\MQIzRPd.exe
  2⤵
  PID:4124
- C:\Windows\System\gZLXTbL.exe
  C:\Windows\System\gZLXTbL.exe
  2⤵
  PID:4140
- C:\Windows\System\OmzdklI.exe
  C:\Windows\System\OmzdklI.exe
  2⤵
  PID:4156
- C:\Windows\System\rkjmxhl.exe
  C:\Windows\System\rkjmxhl.exe
  2⤵
  PID:4172
- C:\Windows\System\iKymrYW.exe
  C:\Windows\System\iKymrYW.exe
  2⤵
  PID:4188
- C:\Windows\System\YzHHAba.exe
  C:\Windows\System\YzHHAba.exe
  2⤵
  PID:4204
- C:\Windows\System\WbnAArL.exe
  C:\Windows\System\WbnAArL.exe
  2⤵
  PID:4220
- C:\Windows\System\ApyehHd.exe
  C:\Windows\System\ApyehHd.exe
  2⤵
  PID:4236
- C:\Windows\System\eLploBY.exe
  C:\Windows\System\eLploBY.exe
  2⤵
  PID:4252
- C:\Windows\System\PaYnmaH.exe
  C:\Windows\System\PaYnmaH.exe
  2⤵
  PID:4268
- C:\Windows\System\PRGILQg.exe
  C:\Windows\System\PRGILQg.exe
  2⤵
  PID:4284
- C:\Windows\System\QpUDuBt.exe
  C:\Windows\System\QpUDuBt.exe
  2⤵
  PID:4300
- C:\Windows\System\JPkIjiP.exe
  C:\Windows\System\JPkIjiP.exe
  2⤵
  PID:4316
- C:\Windows\System\AvdluLS.exe
  C:\Windows\System\AvdluLS.exe
  2⤵
  PID:4332
- C:\Windows\System\KPJGNLZ.exe
  C:\Windows\System\KPJGNLZ.exe
  2⤵
  PID:4348
- C:\Windows\System\VeQwoPW.exe
  C:\Windows\System\VeQwoPW.exe
  2⤵
  PID:4364
- C:\Windows\System\cUYGCvT.exe
  C:\Windows\System\cUYGCvT.exe
  2⤵
  PID:4380
- C:\Windows\System\yqGneJn.exe
  C:\Windows\System\yqGneJn.exe
  2⤵
  PID:4396
- C:\Windows\System\ceutCfx.exe
  C:\Windows\System\ceutCfx.exe
  2⤵
  PID:4412
- C:\Windows\System\OsiocFk.exe
  C:\Windows\System\OsiocFk.exe
  2⤵
  PID:4428
- C:\Windows\System\cbZVncy.exe
  C:\Windows\System\cbZVncy.exe
  2⤵
  PID:4444
- C:\Windows\System\kvXxViw.exe
  C:\Windows\System\kvXxViw.exe
  2⤵
  PID:4460
- C:\Windows\System\SLweZhJ.exe
  C:\Windows\System\SLweZhJ.exe
  2⤵
  PID:4480
- C:\Windows\System\gvxnycr.exe
  C:\Windows\System\gvxnycr.exe
  2⤵
  PID:4496
- C:\Windows\System\pvMjHci.exe
  C:\Windows\System\pvMjHci.exe
  2⤵
  PID:4512
- C:\Windows\System\diwMobl.exe
  C:\Windows\System\diwMobl.exe
  2⤵
  PID:4528
- C:\Windows\System\zejnIEG.exe
  C:\Windows\System\zejnIEG.exe
  2⤵
  PID:4544
- C:\Windows\System\OSbvUIr.exe
  C:\Windows\System\OSbvUIr.exe
  2⤵
  PID:4560
- C:\Windows\System\unBGOZr.exe
  C:\Windows\System\unBGOZr.exe
  2⤵
  PID:4576
- C:\Windows\System\XoLAamE.exe
  C:\Windows\System\XoLAamE.exe
  2⤵
  PID:4592
- C:\Windows\System\JHyvpad.exe
  C:\Windows\System\JHyvpad.exe
  2⤵
  PID:4608
- C:\Windows\System\PyQyZdB.exe
  C:\Windows\System\PyQyZdB.exe
  2⤵
  PID:4624
- C:\Windows\System\yBtQrhu.exe
  C:\Windows\System\yBtQrhu.exe
  2⤵
  PID:4640
- C:\Windows\System\ShhpoDW.exe
  C:\Windows\System\ShhpoDW.exe
  2⤵
  PID:4656
- C:\Windows\System\BAzsrLq.exe
  C:\Windows\System\BAzsrLq.exe
  2⤵
  PID:4672
- C:\Windows\System\aikDfYa.exe
  C:\Windows\System\aikDfYa.exe
  2⤵
  PID:4688
- C:\Windows\System\kRLnPIk.exe
  C:\Windows\System\kRLnPIk.exe
  2⤵
  PID:4704
- C:\Windows\System\mvutgaH.exe
  C:\Windows\System\mvutgaH.exe
  2⤵
  PID:4720
- C:\Windows\System\owaWCTL.exe
  C:\Windows\System\owaWCTL.exe
  2⤵
  PID:4736
- C:\Windows\System\dSccGwr.exe
  C:\Windows\System\dSccGwr.exe
  2⤵
  PID:4752
- C:\Windows\System\uSCQuUw.exe
  C:\Windows\System\uSCQuUw.exe
  2⤵
  PID:4768
- C:\Windows\System\WsXKzuu.exe
  C:\Windows\System\WsXKzuu.exe
  2⤵
  PID:4784
- C:\Windows\System\leCBqAc.exe
  C:\Windows\System\leCBqAc.exe
  2⤵
  PID:4800
- C:\Windows\System\SJrlMsU.exe
  C:\Windows\System\SJrlMsU.exe
  2⤵
  PID:4816
- C:\Windows\System\jsIIGwM.exe
  C:\Windows\System\jsIIGwM.exe
  2⤵
  PID:4832
- C:\Windows\System\pLOjDZI.exe
  C:\Windows\System\pLOjDZI.exe
  2⤵
  PID:4848
- C:\Windows\System\tLBRjvN.exe
  C:\Windows\System\tLBRjvN.exe
  2⤵
  PID:4864
- C:\Windows\System\SDBulBP.exe
  C:\Windows\System\SDBulBP.exe
  2⤵
  PID:4884
- C:\Windows\System\LcyppXt.exe
  C:\Windows\System\LcyppXt.exe
  2⤵
  PID:4900
- C:\Windows\System\dWiuDSs.exe
  C:\Windows\System\dWiuDSs.exe
  2⤵
  PID:4916
- C:\Windows\System\kdfbJnZ.exe
  C:\Windows\System\kdfbJnZ.exe
  2⤵
  PID:4932
- C:\Windows\System\ZqxHhlg.exe
  C:\Windows\System\ZqxHhlg.exe
  2⤵
  PID:4948
- C:\Windows\System\AIGmMdk.exe
  C:\Windows\System\AIGmMdk.exe
  2⤵
  PID:4964
- C:\Windows\System\QWLwuSs.exe
  C:\Windows\System\QWLwuSs.exe
  2⤵
  PID:4980
- C:\Windows\System\xBGSnIo.exe
  C:\Windows\System\xBGSnIo.exe
  2⤵
  PID:4996
- C:\Windows\System\GamzwkR.exe
  C:\Windows\System\GamzwkR.exe
  2⤵
  PID:5012
- C:\Windows\System\vlvJnhd.exe
  C:\Windows\System\vlvJnhd.exe
  2⤵
  PID:5028
- C:\Windows\System\UWoZRDD.exe
  C:\Windows\System\UWoZRDD.exe
  2⤵
  PID:5048
- C:\Windows\System\XCUtpAc.exe
  C:\Windows\System\XCUtpAc.exe
  2⤵
  PID:5064
- C:\Windows\System\mcvgbGk.exe
  C:\Windows\System\mcvgbGk.exe
  2⤵
  PID:5080
- C:\Windows\System\tsADuHQ.exe
  C:\Windows\System\tsADuHQ.exe
  2⤵
  PID:5096
- C:\Windows\System\Mbwgydb.exe
  C:\Windows\System\Mbwgydb.exe
  2⤵
  PID:5112
- C:\Windows\System\rAmriBn.exe
  C:\Windows\System\rAmriBn.exe
  2⤵
  PID:4008
- C:\Windows\System\EdtCJuw.exe
  C:\Windows\System\EdtCJuw.exe
  2⤵
  PID:2568
- C:\Windows\System\JMqwmCN.exe
  C:\Windows\System\JMqwmCN.exe
  2⤵
  PID:992
- C:\Windows\System\ylLVdEy.exe
  C:\Windows\System\ylLVdEy.exe
  2⤵
  PID:4148
- C:\Windows\System\bfGGQqY.exe
  C:\Windows\System\bfGGQqY.exe
  2⤵
  PID:4180
- C:\Windows\System\rScIlMt.exe
  C:\Windows\System\rScIlMt.exe
  2⤵
  PID:4196
- C:\Windows\System\hhWLYSc.exe
  C:\Windows\System\hhWLYSc.exe
  2⤵
  PID:4232
- C:\Windows\System\dqVfnLa.exe
  C:\Windows\System\dqVfnLa.exe
  2⤵
  PID:4296
- C:\Windows\System\lYfsmmX.exe
  C:\Windows\System\lYfsmmX.exe
  2⤵
  PID:4328
- C:\Windows\System\sNXuonR.exe
  C:\Windows\System\sNXuonR.exe
  2⤵
  PID:4420
- C:\Windows\System\aaKqzah.exe
  C:\Windows\System\aaKqzah.exe
  2⤵
  PID:4248
- C:\Windows\System\jMNmBzA.exe
  C:\Windows\System\jMNmBzA.exe
  2⤵
  PID:4452
- C:\Windows\System\QtxwtWK.exe
  C:\Windows\System\QtxwtWK.exe
  2⤵
  PID:4372
- C:\Windows\System\zCwcMtr.exe
  C:\Windows\System\zCwcMtr.exe
  2⤵
  PID:4408
- C:\Windows\System\OQhGhYv.exe
  C:\Windows\System\OQhGhYv.exe
  2⤵
  PID:4472
- C:\Windows\System\bybyYlY.exe
  C:\Windows\System\bybyYlY.exe
  2⤵
  PID:4508
- C:\Windows\System\PWjosuK.exe
  C:\Windows\System\PWjosuK.exe
  2⤵
  PID:4536
- C:\Windows\System\SdeOKBQ.exe
  C:\Windows\System\SdeOKBQ.exe
  2⤵
  PID:4616
- C:\Windows\System\iJdOakA.exe
  C:\Windows\System\iJdOakA.exe
  2⤵
  PID:4652
- C:\Windows\System\rUjAFTe.exe
  C:\Windows\System\rUjAFTe.exe
  2⤵
  PID:4716
- C:\Windows\System\SRMpFen.exe
  C:\Windows\System\SRMpFen.exe
  2⤵
  PID:4664
- C:\Windows\System\mnRYyVE.exe
  C:\Windows\System\mnRYyVE.exe
  2⤵
  PID:4728
- C:\Windows\System\MVJfgmX.exe
  C:\Windows\System\MVJfgmX.exe
  2⤵
  PID:4780
- C:\Windows\System\fJxFVFP.exe
  C:\Windows\System\fJxFVFP.exe
  2⤵
  PID:4840
- C:\Windows\System\dDXrqLq.exe
  C:\Windows\System\dDXrqLq.exe
  2⤵
  PID:4880
- C:\Windows\System\OUbBVBm.exe
  C:\Windows\System\OUbBVBm.exe
  2⤵
  PID:4896
- C:\Windows\System\onrDcqb.exe
  C:\Windows\System\onrDcqb.exe
  2⤵
  PID:4940
- C:\Windows\System\suSaRyu.exe
  C:\Windows\System\suSaRyu.exe
  2⤵
  PID:4824
- C:\Windows\System\SBuffly.exe
  C:\Windows\System\SBuffly.exe
  2⤵
  PID:4928
- C:\Windows\System\DLEJrsk.exe
  C:\Windows\System\DLEJrsk.exe
  2⤵
  PID:4976
- C:\Windows\System\jzlIrvw.exe
  C:\Windows\System\jzlIrvw.exe
  2⤵
  PID:4988
- C:\Windows\System\KXGmZxZ.exe
  C:\Windows\System\KXGmZxZ.exe
  2⤵
  PID:5024
- C:\Windows\System\vPTqEWI.exe
  C:\Windows\System\vPTqEWI.exe
  2⤵
  PID:5072
- C:\Windows\System\GmRNwTl.exe
  C:\Windows\System\GmRNwTl.exe
  2⤵
  PID:5108
- C:\Windows\System\aRzxVav.exe
  C:\Windows\System\aRzxVav.exe
  2⤵
  PID:5092
- C:\Windows\System\reYmFRt.exe
  C:\Windows\System\reYmFRt.exe
  2⤵
  PID:1564
- C:\Windows\System\iHeZgbv.exe
  C:\Windows\System\iHeZgbv.exe
  2⤵
  PID:4164
- C:\Windows\System\AcyzGDx.exe
  C:\Windows\System\AcyzGDx.exe
  2⤵
  PID:4360
- C:\Windows\System\jqZRyZg.exe
  C:\Windows\System\jqZRyZg.exe
  2⤵
  PID:4468
- C:\Windows\System\FizkGan.exe
  C:\Windows\System\FizkGan.exe
  2⤵
  PID:4132
- C:\Windows\System\lGSFgTK.exe
  C:\Windows\System\lGSFgTK.exe
  2⤵
  PID:4212
- C:\Windows\System\jmIqPhv.exe
  C:\Windows\System\jmIqPhv.exe
  2⤵
  PID:4392
- C:\Windows\System\PppAURv.exe
  C:\Windows\System\PppAURv.exe
  2⤵
  PID:4712
- C:\Windows\System\ypZxPCJ.exe
  C:\Windows\System\ypZxPCJ.exe
  2⤵
  PID:4440
- C:\Windows\System\XODvbGd.exe
  C:\Windows\System\XODvbGd.exe
  2⤵
  PID:4584
- C:\Windows\System\szwdSfC.exe
  C:\Windows\System\szwdSfC.exe
  2⤵
  PID:4808
- C:\Windows\System\OFlloMg.exe
  C:\Windows\System\OFlloMg.exe
  2⤵
  PID:4860
- C:\Windows\System\sMkUlxb.exe
  C:\Windows\System\sMkUlxb.exe
  2⤵
  PID:4972
- C:\Windows\System\SdDLUxd.exe
  C:\Windows\System\SdDLUxd.exe
  2⤵
  PID:5104
- C:\Windows\System\PtzVRzn.exe
  C:\Windows\System\PtzVRzn.exe
  2⤵
  PID:4876
- C:\Windows\System\kuuJdWg.exe
  C:\Windows\System\kuuJdWg.exe
  2⤵
  PID:4792
- C:\Windows\System\osadFqT.exe
  C:\Windows\System\osadFqT.exe
  2⤵
  PID:5044
- C:\Windows\System\FdIvtFT.exe
  C:\Windows\System\FdIvtFT.exe
  2⤵
  PID:4292
- C:\Windows\System\eZeZphM.exe
  C:\Windows\System\eZeZphM.exe
  2⤵
  PID:4136
- C:\Windows\System\cdPJrXi.exe
  C:\Windows\System\cdPJrXi.exe
  2⤵
  PID:4632
- C:\Windows\System\UALmcdG.exe
  C:\Windows\System\UALmcdG.exe
  2⤵
  PID:4344
- C:\Windows\System\quIegoZ.exe
  C:\Windows\System\quIegoZ.exe
  2⤵
  PID:4520
- C:\Windows\System\fzjcKHA.exe
  C:\Windows\System\fzjcKHA.exe
  2⤵
  PID:4552
- C:\Windows\System\MVUmKwh.exe
  C:\Windows\System\MVUmKwh.exe
  2⤵
  PID:5004
- C:\Windows\System\wdbQvyz.exe
  C:\Windows\System\wdbQvyz.exe
  2⤵
  PID:4828
- C:\Windows\System\LEVrayA.exe
  C:\Windows\System\LEVrayA.exe
  2⤵
  PID:4312
- C:\Windows\System\PCllXRK.exe
  C:\Windows\System\PCllXRK.exe
  2⤵
  PID:5040
- C:\Windows\System\UELAuud.exe
  C:\Windows\System\UELAuud.exe
  2⤵
  PID:4216
- C:\Windows\System\KUeOJSR.exe
  C:\Windows\System\KUeOJSR.exe
  2⤵
  PID:4748
- C:\Windows\System\Vuwbqwg.exe
  C:\Windows\System\Vuwbqwg.exe
  2⤵
  PID:5088
- C:\Windows\System\XDkuxkm.exe
  C:\Windows\System\XDkuxkm.exe
  2⤵
  PID:4648
- C:\Windows\System\xOfBwFH.exe
  C:\Windows\System\xOfBwFH.exe
  2⤵
  PID:4104
- C:\Windows\System\lWtxmTF.exe
  C:\Windows\System\lWtxmTF.exe
  2⤵
  PID:5132
- C:\Windows\System\MwhbJoi.exe
  C:\Windows\System\MwhbJoi.exe
  2⤵
  PID:5148
- C:\Windows\System\eQwdGQK.exe
  C:\Windows\System\eQwdGQK.exe
  2⤵
  PID:5164
- C:\Windows\System\YcgJtPf.exe
  C:\Windows\System\YcgJtPf.exe
  2⤵
  PID:5180
- C:\Windows\System\loLLksZ.exe
  C:\Windows\System\loLLksZ.exe
  2⤵
  PID:5196
- C:\Windows\System\tGOCfjS.exe
  C:\Windows\System\tGOCfjS.exe
  2⤵
  PID:5212
- C:\Windows\System\VlGnxiZ.exe
  C:\Windows\System\VlGnxiZ.exe
  2⤵
  PID:5228
- C:\Windows\System\okbIPTc.exe
  C:\Windows\System\okbIPTc.exe
  2⤵
  PID:5244
- C:\Windows\System\kbhXzTp.exe
  C:\Windows\System\kbhXzTp.exe
  2⤵
  PID:5260
- C:\Windows\System\PARsFEV.exe
  C:\Windows\System\PARsFEV.exe
  2⤵
  PID:5276
- C:\Windows\System\daRQbBO.exe
  C:\Windows\System\daRQbBO.exe
  2⤵
  PID:5292
- C:\Windows\System\LFkdfRA.exe
  C:\Windows\System\LFkdfRA.exe
  2⤵
  PID:5308
- C:\Windows\System\epRCqsU.exe
  C:\Windows\System\epRCqsU.exe
  2⤵
  PID:5324
- C:\Windows\System\hyyTbwI.exe
  C:\Windows\System\hyyTbwI.exe
  2⤵
  PID:5340
- C:\Windows\System\QxlmsWO.exe
  C:\Windows\System\QxlmsWO.exe
  2⤵
  PID:5356
- C:\Windows\System\bIeaTVA.exe
  C:\Windows\System\bIeaTVA.exe
  2⤵
  PID:5376
- C:\Windows\System\UKGGbEY.exe
  C:\Windows\System\UKGGbEY.exe
  2⤵
  PID:5392
- C:\Windows\System\jjRpyCy.exe
  C:\Windows\System\jjRpyCy.exe
  2⤵
  PID:5408
- C:\Windows\System\VlXHeuv.exe
  C:\Windows\System\VlXHeuv.exe
  2⤵
  PID:5424
- C:\Windows\System\tknrQvT.exe
  C:\Windows\System\tknrQvT.exe
  2⤵
  PID:5440
- C:\Windows\System\NufBBpE.exe
  C:\Windows\System\NufBBpE.exe
  2⤵
  PID:5456
- C:\Windows\System\BswSGwi.exe
  C:\Windows\System\BswSGwi.exe
  2⤵
  PID:5472
- C:\Windows\System\tWOorWh.exe
  C:\Windows\System\tWOorWh.exe
  2⤵
  PID:5488
- C:\Windows\System\neCmWVH.exe
  C:\Windows\System\neCmWVH.exe
  2⤵
  PID:5504
- C:\Windows\System\cfDORZU.exe
  C:\Windows\System\cfDORZU.exe
  2⤵
  PID:5520
- C:\Windows\System\XeVzGzM.exe
  C:\Windows\System\XeVzGzM.exe
  2⤵
  PID:5536
- C:\Windows\System\IPyGIUX.exe
  C:\Windows\System\IPyGIUX.exe
  2⤵
  PID:5552
- C:\Windows\System\sofTHwK.exe
  C:\Windows\System\sofTHwK.exe
  2⤵
  PID:5568
- C:\Windows\System\rxFwgIN.exe
  C:\Windows\System\rxFwgIN.exe
  2⤵
  PID:5584
- C:\Windows\System\qfimuIQ.exe
  C:\Windows\System\qfimuIQ.exe
  2⤵
  PID:5600
- C:\Windows\System\dzAqRBl.exe
  C:\Windows\System\dzAqRBl.exe
  2⤵
  PID:5616
- C:\Windows\System\ZFMNPnS.exe
  C:\Windows\System\ZFMNPnS.exe
  2⤵
  PID:5632
- C:\Windows\System\ZvipuBk.exe
  C:\Windows\System\ZvipuBk.exe
  2⤵
  PID:5648
- C:\Windows\System\WBdOpjO.exe
  C:\Windows\System\WBdOpjO.exe
  2⤵
  PID:5664
- C:\Windows\System\lpFalbu.exe
  C:\Windows\System\lpFalbu.exe
  2⤵
  PID:5680
- C:\Windows\System\vTsMUdg.exe
  C:\Windows\System\vTsMUdg.exe
  2⤵
  PID:5696
- C:\Windows\System\noPFhjR.exe
  C:\Windows\System\noPFhjR.exe
  2⤵
  PID:5712
- C:\Windows\System\gALCNOO.exe
  C:\Windows\System\gALCNOO.exe
  2⤵
  PID:5728
- C:\Windows\System\CfGCYZv.exe
  C:\Windows\System\CfGCYZv.exe
  2⤵
  PID:5744
- C:\Windows\System\nCNLWHR.exe
  C:\Windows\System\nCNLWHR.exe
  2⤵
  PID:5760
- C:\Windows\System\QuNDLhR.exe
  C:\Windows\System\QuNDLhR.exe
  2⤵
  PID:5776
- C:\Windows\System\MwFZWNn.exe
  C:\Windows\System\MwFZWNn.exe
  2⤵
  PID:5792
- C:\Windows\System\GddNuBT.exe
  C:\Windows\System\GddNuBT.exe
  2⤵
  PID:5808
- C:\Windows\System\GCTPReV.exe
  C:\Windows\System\GCTPReV.exe
  2⤵
  PID:5824
- C:\Windows\System\iwGkguc.exe
  C:\Windows\System\iwGkguc.exe
  2⤵
  PID:5840
- C:\Windows\System\cjMzoTk.exe
  C:\Windows\System\cjMzoTk.exe
  2⤵
  PID:5856
- C:\Windows\System\GfItcrb.exe
  C:\Windows\System\GfItcrb.exe
  2⤵
  PID:5872
- C:\Windows\System\hnLATFY.exe
  C:\Windows\System\hnLATFY.exe
  2⤵
  PID:5888
- C:\Windows\System\cCvqSwl.exe
  C:\Windows\System\cCvqSwl.exe
  2⤵
  PID:5904
- C:\Windows\System\WwqKSHE.exe
  C:\Windows\System\WwqKSHE.exe
  2⤵
  PID:5920
- C:\Windows\System\KSSKrOl.exe
  C:\Windows\System\KSSKrOl.exe
  2⤵
  PID:5936
- C:\Windows\System\yzeNVbQ.exe
  C:\Windows\System\yzeNVbQ.exe
  2⤵
  PID:5952
- C:\Windows\System\MsEkgdC.exe
  C:\Windows\System\MsEkgdC.exe
  2⤵
  PID:5968
- C:\Windows\System\VTQDoOF.exe
  C:\Windows\System\VTQDoOF.exe
  2⤵
  PID:5984
- C:\Windows\System\EhuOcVQ.exe
  C:\Windows\System\EhuOcVQ.exe
  2⤵
  PID:6000
- C:\Windows\System\ErOLDrw.exe
  C:\Windows\System\ErOLDrw.exe
  2⤵
  PID:6016
- C:\Windows\System\BlRFFfK.exe
  C:\Windows\System\BlRFFfK.exe
  2⤵
  PID:6032
- C:\Windows\System\mleNsUh.exe
  C:\Windows\System\mleNsUh.exe
  2⤵
  PID:6048
- C:\Windows\System\YbXCtvC.exe
  C:\Windows\System\YbXCtvC.exe
  2⤵
  PID:6064
- C:\Windows\System\IxsCyUS.exe
  C:\Windows\System\IxsCyUS.exe
  2⤵
  PID:6080
- C:\Windows\System\kHGvujZ.exe
  C:\Windows\System\kHGvujZ.exe
  2⤵
  PID:6096
- C:\Windows\System\FhAIOWi.exe
  C:\Windows\System\FhAIOWi.exe
  2⤵
  PID:6112
- C:\Windows\System\vdokUZg.exe
  C:\Windows\System\vdokUZg.exe
  2⤵
  PID:6128
- C:\Windows\System\wKVpLRL.exe
  C:\Windows\System\wKVpLRL.exe
  2⤵
  PID:4684
- C:\Windows\System\FLeqCMl.exe
  C:\Windows\System\FLeqCMl.exe
  2⤵
  PID:5124
- C:\Windows\System\XGoXgbz.exe
  C:\Windows\System\XGoXgbz.exe
  2⤵
  PID:5144
- C:\Windows\System\wsNSEYf.exe
  C:\Windows\System\wsNSEYf.exe
  2⤵
  PID:5220
- C:\Windows\System\BfNdQSJ.exe
  C:\Windows\System\BfNdQSJ.exe
  2⤵
  PID:5236
- C:\Windows\System\JpOXilO.exe
  C:\Windows\System\JpOXilO.exe
  2⤵
  PID:5204
- C:\Windows\System\OYSyUnN.exe
  C:\Windows\System\OYSyUnN.exe
  2⤵
  PID:5288
- C:\Windows\System\PqAZxLa.exe
  C:\Windows\System\PqAZxLa.exe
  2⤵
  PID:5348
- C:\Windows\System\yxZkQdd.exe
  C:\Windows\System\yxZkQdd.exe
  2⤵
  PID:5304
- C:\Windows\System\uDyRUVr.exe
  C:\Windows\System\uDyRUVr.exe
  2⤵
  PID:5336
- C:\Windows\System\KpcsmwP.exe
  C:\Windows\System\KpcsmwP.exe
  2⤵
  PID:5420
- C:\Windows\System\fECIcqA.exe
  C:\Windows\System\fECIcqA.exe
  2⤵
  PID:5400
- C:\Windows\System\hnGiXlg.exe
  C:\Windows\System\hnGiXlg.exe
  2⤵
  PID:5432
- C:\Windows\System\gpjXOsS.exe
  C:\Windows\System\gpjXOsS.exe
  2⤵
  PID:5544
- C:\Windows\System\AXIDVhu.exe
  C:\Windows\System\AXIDVhu.exe
  2⤵
  PID:5464
- C:\Windows\System\vCvbhBc.exe
  C:\Windows\System\vCvbhBc.exe
  2⤵
  PID:5592
- C:\Windows\System\ODSVqLB.exe
  C:\Windows\System\ODSVqLB.exe
  2⤵
  PID:5564
- C:\Windows\System\zQfqgrq.exe
  C:\Windows\System\zQfqgrq.exe
  2⤵
  PID:5672
- C:\Windows\System\TEAkLfg.exe
  C:\Windows\System\TEAkLfg.exe
  2⤵
  PID:5708
- C:\Windows\System\fWKJGLn.exe
  C:\Windows\System\fWKJGLn.exe
  2⤵
  PID:5688
- C:\Windows\System\PsbokfP.exe
  C:\Windows\System\PsbokfP.exe
  2⤵
  PID:5720
- C:\Windows\System\uxZYclc.exe
  C:\Windows\System\uxZYclc.exe
  2⤵
  PID:5772
- C:\Windows\System\GeDutQn.exe
  C:\Windows\System\GeDutQn.exe
  2⤵
  PID:5852
- C:\Windows\System\RAgtwBM.exe
  C:\Windows\System\RAgtwBM.exe
  2⤵
  PID:6120
- C:\Windows\System\sPiddkA.exe
  C:\Windows\System\sPiddkA.exe
  2⤵
  PID:5160
- C:\Windows\System\ixmYYuC.exe
  C:\Windows\System\ixmYYuC.exe
  2⤵
  PID:5224
- C:\Windows\System\IyMHMZJ.exe
  C:\Windows\System\IyMHMZJ.exe
  2⤵
  PID:5364
- C:\Windows\System\ptoHKRU.exe
  C:\Windows\System\ptoHKRU.exe
  2⤵
  PID:5480
- C:\Windows\System\DxnNPvb.exe
  C:\Windows\System\DxnNPvb.exe
  2⤵
  PID:5416
- C:\Windows\System\cqgZRLa.exe
  C:\Windows\System\cqgZRLa.exe
  2⤵
  PID:5788
- C:\Windows\System\qAbgDRA.exe
  C:\Windows\System\qAbgDRA.exe
  2⤵
  PID:5964
- C:\Windows\System\NMmJSpl.exe
  C:\Windows\System\NMmJSpl.exe
  2⤵
  PID:5884
- C:\Windows\System\oKuJHpr.exe
  C:\Windows\System\oKuJHpr.exe
  2⤵
  PID:6024
- C:\Windows\System\gEhxegH.exe
  C:\Windows\System\gEhxegH.exe
  2⤵
  PID:6008
- C:\Windows\System\VZQiMoo.exe
  C:\Windows\System\VZQiMoo.exe
  2⤵
  PID:6060
- C:\Windows\System\sIvIyzJ.exe
  C:\Windows\System\sIvIyzJ.exe
  2⤵
  PID:6012
- C:\Windows\System\sRWVxAF.exe
  C:\Windows\System\sRWVxAF.exe
  2⤵
  PID:5188
- C:\Windows\System\rErDSBV.exe
  C:\Windows\System\rErDSBV.exe
  2⤵
  PID:5172
- C:\Windows\System\fOLddDx.exe
  C:\Windows\System\fOLddDx.exe
  2⤵
  PID:6136
- C:\Windows\System\uUPEMgc.exe
  C:\Windows\System\uUPEMgc.exe
  2⤵
  PID:4700
- C:\Windows\System\OKsdKuF.exe
  C:\Windows\System\OKsdKuF.exe
  2⤵
  PID:5580
- C:\Windows\System\HMIySrM.exe
  C:\Windows\System\HMIySrM.exe
  2⤵
  PID:5316
- C:\Windows\System\VxKKxds.exe
  C:\Windows\System\VxKKxds.exe
  2⤵
  PID:5528
- C:\Windows\System\jZtZjUl.exe
  C:\Windows\System\jZtZjUl.exe
  2⤵
  PID:5500
- C:\Windows\System\DhQrRDF.exe
  C:\Windows\System\DhQrRDF.exe
  2⤵
  PID:5676
- C:\Windows\System\smgpAQL.exe
  C:\Windows\System\smgpAQL.exe
  2⤵
  PID:5660
- C:\Windows\System\oiSEQPk.exe
  C:\Windows\System\oiSEQPk.exe
  2⤵
  PID:5832
- C:\Windows\System\GTvzfGU.exe
  C:\Windows\System\GTvzfGU.exe
  2⤵
  PID:5932
- C:\Windows\System\IrInfuf.exe
  C:\Windows\System\IrInfuf.exe
  2⤵
  PID:5980
- C:\Windows\System\VFzVDtH.exe
  C:\Windows\System\VFzVDtH.exe
  2⤵
  PID:5256
- C:\Windows\System\qqJtRyT.exe
  C:\Windows\System\qqJtRyT.exe
  2⤵
  PID:5784
- C:\Windows\System\eCbCqkx.exe
  C:\Windows\System\eCbCqkx.exe
  2⤵
  PID:5996
- C:\Windows\System\MZXgmKr.exe
  C:\Windows\System\MZXgmKr.exe
  2⤵
  PID:5800
- C:\Windows\System\aqgBEuN.exe
  C:\Windows\System\aqgBEuN.exe
  2⤵
  PID:6152
- C:\Windows\System\tJeeLbS.exe
  C:\Windows\System\tJeeLbS.exe
  2⤵
  PID:6168
- C:\Windows\System\vXCGkVH.exe
  C:\Windows\System\vXCGkVH.exe
  2⤵
  PID:6184
- C:\Windows\System\bHfTxmY.exe
  C:\Windows\System\bHfTxmY.exe
  2⤵
  PID:6200
- C:\Windows\System\rZtwScq.exe
  C:\Windows\System\rZtwScq.exe
  2⤵
  PID:6216
- C:\Windows\System\UwsaYfc.exe
  C:\Windows\System\UwsaYfc.exe
  2⤵
  PID:6232
- C:\Windows\System\PqNvjnQ.exe
  C:\Windows\System\PqNvjnQ.exe
  2⤵
  PID:6248
- C:\Windows\System\JXDnpJg.exe
  C:\Windows\System\JXDnpJg.exe
  2⤵
  PID:6264
- C:\Windows\System\spFAbxY.exe
  C:\Windows\System\spFAbxY.exe
  2⤵
  PID:6280
- C:\Windows\System\qwCzhHA.exe
  C:\Windows\System\qwCzhHA.exe
  2⤵
  PID:6296
- C:\Windows\System\odefndP.exe
  C:\Windows\System\odefndP.exe
  2⤵
  PID:6312
- C:\Windows\System\GNbBHJN.exe
  C:\Windows\System\GNbBHJN.exe
  2⤵
  PID:6328
- C:\Windows\System\jlEFOpk.exe
  C:\Windows\System\jlEFOpk.exe
  2⤵
  PID:6348
- C:\Windows\System\CIXnLut.exe
  C:\Windows\System\CIXnLut.exe
  2⤵
  PID:6364
- C:\Windows\System\BCdKXNF.exe
  C:\Windows\System\BCdKXNF.exe
  2⤵
  PID:6380
- C:\Windows\System\TovzDzf.exe
  C:\Windows\System\TovzDzf.exe
  2⤵
  PID:6396
- C:\Windows\System\jocShzF.exe
  C:\Windows\System\jocShzF.exe
  2⤵
  PID:6412
- C:\Windows\System\sndHbKp.exe
  C:\Windows\System\sndHbKp.exe
  2⤵
  PID:6428
- C:\Windows\System\BILSNLe.exe
  C:\Windows\System\BILSNLe.exe
  2⤵
  PID:6444
- C:\Windows\System\HkHlLYs.exe
  C:\Windows\System\HkHlLYs.exe
  2⤵
  PID:6460
- C:\Windows\System\GzKtVGZ.exe
  C:\Windows\System\GzKtVGZ.exe
  2⤵
  PID:6476
- C:\Windows\System\UFXTngL.exe
  C:\Windows\System\UFXTngL.exe
  2⤵
  PID:6492
- C:\Windows\System\vynUBoH.exe
  C:\Windows\System\vynUBoH.exe
  2⤵
  PID:6508
- C:\Windows\System\hWFJbHZ.exe
  C:\Windows\System\hWFJbHZ.exe
  2⤵
  PID:6524
- C:\Windows\System\NBayHga.exe
  C:\Windows\System\NBayHga.exe
  2⤵
  PID:6544
- C:\Windows\System\ckAqlkU.exe
  C:\Windows\System\ckAqlkU.exe
  2⤵
  PID:6560
- C:\Windows\System\rQDadTK.exe
  C:\Windows\System\rQDadTK.exe
  2⤵
  PID:6576
- C:\Windows\System\NUTzZet.exe
  C:\Windows\System\NUTzZet.exe
  2⤵
  PID:6596
- C:\Windows\System\jbqTMVt.exe
  C:\Windows\System\jbqTMVt.exe
  2⤵
  PID:6612
- C:\Windows\System\fnKLawM.exe
  C:\Windows\System\fnKLawM.exe
  2⤵
  PID:6628
- C:\Windows\System\QxFckJu.exe
  C:\Windows\System\QxFckJu.exe
  2⤵
  PID:6676
- C:\Windows\System\ydVTmVo.exe
  C:\Windows\System\ydVTmVo.exe
  2⤵
  PID:6728
- C:\Windows\System\GnQnPWh.exe
  C:\Windows\System\GnQnPWh.exe
  2⤵
  PID:6744
- C:\Windows\System\ZUkvgOH.exe
  C:\Windows\System\ZUkvgOH.exe
  2⤵
  PID:6760
- C:\Windows\System\WXUgIbs.exe
  C:\Windows\System\WXUgIbs.exe
  2⤵
  PID:6776
- C:\Windows\System\cXKfuko.exe
  C:\Windows\System\cXKfuko.exe
  2⤵
  PID:6792
- C:\Windows\System\FgngetT.exe
  C:\Windows\System\FgngetT.exe
  2⤵
  PID:6812
- C:\Windows\System\nNMGawr.exe
  C:\Windows\System\nNMGawr.exe
  2⤵
  PID:6828
- C:\Windows\System\gKyfhTb.exe
  C:\Windows\System\gKyfhTb.exe
  2⤵
  PID:6844
- C:\Windows\System\TbNcFJd.exe
  C:\Windows\System\TbNcFJd.exe
  2⤵
  PID:6860
- C:\Windows\System\QBHeroS.exe
  C:\Windows\System\QBHeroS.exe
  2⤵
  PID:6876
- C:\Windows\System\bpOskVz.exe
  C:\Windows\System\bpOskVz.exe
  2⤵
  PID:6892
- C:\Windows\System\blZFysV.exe
  C:\Windows\System\blZFysV.exe
  2⤵
  PID:6916
- C:\Windows\System\uLYAAAu.exe
  C:\Windows\System\uLYAAAu.exe
  2⤵
  PID:6936
- C:\Windows\System\oXHbdqj.exe
  C:\Windows\System\oXHbdqj.exe
  2⤵
  PID:6972
- C:\Windows\System\nsQeoNn.exe
  C:\Windows\System\nsQeoNn.exe
  2⤵
  PID:6992
- C:\Windows\System\zuyjEUW.exe
  C:\Windows\System\zuyjEUW.exe
  2⤵
  PID:7008
- C:\Windows\System\vTNwdFN.exe
  C:\Windows\System\vTNwdFN.exe
  2⤵
  PID:7024
- C:\Windows\System\LCwUnHX.exe
  C:\Windows\System\LCwUnHX.exe
  2⤵
  PID:7040
- C:\Windows\System\wKJBcDp.exe
  C:\Windows\System\wKJBcDp.exe
  2⤵
  PID:7056
- C:\Windows\System\seFLftE.exe
  C:\Windows\System\seFLftE.exe
  2⤵
  PID:7076
- C:\Windows\System\AosDzxw.exe
  C:\Windows\System\AosDzxw.exe
  2⤵
  PID:7092
- C:\Windows\System\vzwnMfM.exe
  C:\Windows\System\vzwnMfM.exe
  2⤵
  PID:7112
- C:\Windows\System\MMsrFpv.exe
  C:\Windows\System\MMsrFpv.exe
  2⤵
  PID:7128
- C:\Windows\System\rPmZuMC.exe
  C:\Windows\System\rPmZuMC.exe
  2⤵
  PID:7144
- C:\Windows\System\lcbYdry.exe
  C:\Windows\System\lcbYdry.exe
  2⤵
  PID:7160
- C:\Windows\System\kXTQGjA.exe
  C:\Windows\System\kXTQGjA.exe
  2⤵
  PID:5912
- C:\Windows\System\ApfDqlk.exe
  C:\Windows\System\ApfDqlk.exe
  2⤵
  PID:5820
- C:\Windows\System\ryULdjs.exe
  C:\Windows\System\ryULdjs.exe
  2⤵
  PID:6224
- C:\Windows\System\GpBxbPM.exe
  C:\Windows\System\GpBxbPM.exe
  2⤵
  PID:6292
- C:\Windows\System\AQidTAu.exe
  C:\Windows\System\AQidTAu.exe
  2⤵
  PID:6360
- C:\Windows\System\VinsgdE.exe
  C:\Windows\System\VinsgdE.exe
  2⤵
  PID:5896
- C:\Windows\System\VYUOGaH.exe
  C:\Windows\System\VYUOGaH.exe
  2⤵
  PID:6088
- C:\Windows\System\gcarhgh.exe
  C:\Windows\System\gcarhgh.exe
  2⤵
  PID:5140
- C:\Windows\System\EcsqmrV.exe
  C:\Windows\System\EcsqmrV.exe
  2⤵
  PID:5640
- C:\Windows\System\OfyiJjn.exe
  C:\Windows\System\OfyiJjn.exe
  2⤵
  PID:6124
- C:\Windows\System\OfJwQMn.exe
  C:\Windows\System\OfJwQMn.exe
  2⤵
  PID:6208
- C:\Windows\System\pylowzz.exe
  C:\Windows\System\pylowzz.exe
  2⤵
  PID:6484
- C:\Windows\System\eKjQazO.exe
  C:\Windows\System\eKjQazO.exe
  2⤵
  PID:6180
- C:\Windows\System\lOhjVqC.exe
  C:\Windows\System\lOhjVqC.exe
  2⤵
  PID:6488
- C:\Windows\System\qcPfqHp.exe
  C:\Windows\System\qcPfqHp.exe
  2⤵
  PID:6556
- C:\Windows\System\UhswTYG.exe
  C:\Windows\System\UhswTYG.exe
  2⤵
  PID:6244
- C:\Windows\System\bZwlOcY.exe
  C:\Windows\System\bZwlOcY.exe
  2⤵
  PID:6336
- C:\Windows\System\jQPjXSe.exe
  C:\Windows\System\jQPjXSe.exe
  2⤵
  PID:6440
- C:\Windows\System\CRvsont.exe
  C:\Windows\System\CRvsont.exe
  2⤵
  PID:6504
- C:\Windows\System\frJstOV.exe
  C:\Windows\System\frJstOV.exe
  2⤵
  PID:6572
- C:\Windows\System\agRCUQk.exe
  C:\Windows\System\agRCUQk.exe
  2⤵
  PID:6672
- C:\Windows\System\sAqHUZS.exe
  C:\Windows\System\sAqHUZS.exe
  2⤵
  PID:6704
- C:\Windows\System\qouaoGZ.exe
  C:\Windows\System\qouaoGZ.exe
  2⤵
  PID:6784
- C:\Windows\System\RQcyEMK.exe
  C:\Windows\System\RQcyEMK.exe
  2⤵
  PID:6852
- C:\Windows\System\AmHlJVS.exe
  C:\Windows\System\AmHlJVS.exe
  2⤵
  PID:6800
- C:\Windows\System\faeievt.exe
  C:\Windows\System\faeievt.exe
  2⤵
  PID:6716
- C:\Windows\System\BKlYTeH.exe
  C:\Windows\System\BKlYTeH.exe
  2⤵
  PID:6740
- C:\Windows\System\SWYpGgZ.exe
  C:\Windows\System\SWYpGgZ.exe
  2⤵
  PID:6836
- C:\Windows\System\ewbPpBP.exe
  C:\Windows\System\ewbPpBP.exe
  2⤵
  PID:6900
- C:\Windows\System\VQHuyQp.exe
  C:\Windows\System\VQHuyQp.exe
  2⤵
  PID:6956
- C:\Windows\System\PBIzMux.exe
  C:\Windows\System\PBIzMux.exe
  2⤵
  PID:7036
- C:\Windows\System\KpntuUS.exe
  C:\Windows\System\KpntuUS.exe
  2⤵
  PID:7048
- C:\Windows\System\pbQCVtw.exe
  C:\Windows\System\pbQCVtw.exe
  2⤵
  PID:7068
- C:\Windows\System\ZGBONGO.exe
  C:\Windows\System\ZGBONGO.exe
  2⤵
  PID:7088
- C:\Windows\System\hCxWJAp.exe
  C:\Windows\System\hCxWJAp.exe
  2⤵
  PID:7140
- C:\Windows\System\zfYpOND.exe
  C:\Windows\System\zfYpOND.exe
  2⤵
  PID:6056
- C:\Windows\System\QzvGjOz.exe
  C:\Windows\System\QzvGjOz.exe
  2⤵
  PID:5300
- C:\Windows\System\FtQtKSW.exe
  C:\Windows\System\FtQtKSW.exe
  2⤵
  PID:6424
- C:\Windows\System\ojTyiob.exe
  C:\Windows\System\ojTyiob.exe
  2⤵
  PID:6520
- C:\Windows\System\uKVUAqs.exe
  C:\Windows\System\uKVUAqs.exe
  2⤵
  PID:6160
- C:\Windows\System\lIGWbch.exe
  C:\Windows\System\lIGWbch.exe
  2⤵
  PID:5756
- C:\Windows\System\FGITNvg.exe
  C:\Windows\System\FGITNvg.exe
  2⤵
  PID:5656
- C:\Windows\System\QWuVkDo.exe
  C:\Windows\System\QWuVkDo.exe
  2⤵
  PID:6404
- C:\Windows\System\stGZkVh.exe
  C:\Windows\System\stGZkVh.exe
  2⤵
  PID:6164
- C:\Windows\System\cDqxwMN.exe
  C:\Windows\System\cDqxwMN.exe
  2⤵
  PID:108
- C:\Windows\System\SqPtJEE.exe
  C:\Windows\System\SqPtJEE.exe
  2⤵
  PID:6500
- C:\Windows\System\aVwnFmF.exe
  C:\Windows\System\aVwnFmF.exe
  2⤵
  PID:6752
- C:\Windows\System\cVJILWL.exe
  C:\Windows\System\cVJILWL.exe
  2⤵
  PID:6884
- C:\Windows\System\zKHuDVH.exe
  C:\Windows\System\zKHuDVH.exe
  2⤵
  PID:6696
- C:\Windows\System\qnMJUcL.exe
  C:\Windows\System\qnMJUcL.exe
  2⤵
  PID:6568
- C:\Windows\System\CAHPdtG.exe
  C:\Windows\System\CAHPdtG.exe
  2⤵
  PID:7020
- C:\Windows\System\CqCfaEb.exe
  C:\Windows\System\CqCfaEb.exe
  2⤵
  PID:6928
- C:\Windows\System\xSyjHqv.exe
  C:\Windows\System\xSyjHqv.exe
  2⤵
  PID:6872
- C:\Windows\System\YhDhmDt.exe
  C:\Windows\System\YhDhmDt.exe
  2⤵
  PID:6952
- C:\Windows\System\xfJMTmG.exe
  C:\Windows\System\xfJMTmG.exe
  2⤵
  PID:7176
- C:\Windows\System\SfrIgUa.exe
  C:\Windows\System\SfrIgUa.exe
  2⤵
  PID:7192
- C:\Windows\System\WgMgmyb.exe
  C:\Windows\System\WgMgmyb.exe
  2⤵
  PID:7208
- C:\Windows\System\iVxneyF.exe
  C:\Windows\System\iVxneyF.exe
  2⤵
  PID:7224
- C:\Windows\System\WpaQxNJ.exe
  C:\Windows\System\WpaQxNJ.exe
  2⤵
  PID:7240
- C:\Windows\System\OikxoYM.exe
  C:\Windows\System\OikxoYM.exe
  2⤵
  PID:7256
- C:\Windows\System\AybZuCE.exe
  C:\Windows\System\AybZuCE.exe
  2⤵
  PID:7272
- C:\Windows\System\juBkjyc.exe
  C:\Windows\System\juBkjyc.exe
  2⤵
  PID:7288
- C:\Windows\System\CQwQxJR.exe
  C:\Windows\System\CQwQxJR.exe
  2⤵
  PID:7304
- C:\Windows\System\oPrTLlv.exe
  C:\Windows\System\oPrTLlv.exe
  2⤵
  PID:7320
- C:\Windows\System\sqdMAmP.exe
  C:\Windows\System\sqdMAmP.exe
  2⤵
  PID:7336
- C:\Windows\System\SmmwzSI.exe
  C:\Windows\System\SmmwzSI.exe
  2⤵
  PID:7352
- C:\Windows\System\tLXoVfg.exe
  C:\Windows\System\tLXoVfg.exe
  2⤵
  PID:7368
- C:\Windows\System\UWejMYS.exe
  C:\Windows\System\UWejMYS.exe
  2⤵
  PID:7384
- C:\Windows\System\jUqPKmI.exe
  C:\Windows\System\jUqPKmI.exe
  2⤵
  PID:7400
- C:\Windows\System\PJxXklD.exe
  C:\Windows\System\PJxXklD.exe
  2⤵
  PID:7416
- C:\Windows\System\SyYSHhv.exe
  C:\Windows\System\SyYSHhv.exe
  2⤵
  PID:7436
- C:\Windows\System\MPvBFME.exe
  C:\Windows\System\MPvBFME.exe
  2⤵
  PID:7452
- C:\Windows\System\pERTxBs.exe
  C:\Windows\System\pERTxBs.exe
  2⤵
  PID:7468
- C:\Windows\System\kSxgWln.exe
  C:\Windows\System\kSxgWln.exe
  2⤵
  PID:7484
- C:\Windows\System\runPnaH.exe
  C:\Windows\System\runPnaH.exe
  2⤵
  PID:7500
- C:\Windows\System\qULnIsU.exe
  C:\Windows\System\qULnIsU.exe
  2⤵
  PID:7516
- C:\Windows\System\fTAytUC.exe
  C:\Windows\System\fTAytUC.exe
  2⤵
  PID:7532
- C:\Windows\System\dfbbvCF.exe
  C:\Windows\System\dfbbvCF.exe
  2⤵
  PID:7548
- C:\Windows\System\sNpXzYX.exe
  C:\Windows\System\sNpXzYX.exe
  2⤵
  PID:7564
- C:\Windows\System\YXMEEmI.exe
  C:\Windows\System\YXMEEmI.exe
  2⤵
  PID:7580
- C:\Windows\System\WAnNyfz.exe
  C:\Windows\System\WAnNyfz.exe
  2⤵
  PID:7596
- C:\Windows\System\PIVZNUg.exe
  C:\Windows\System\PIVZNUg.exe
  2⤵
  PID:7612
- C:\Windows\System\FBNPRDc.exe
  C:\Windows\System\FBNPRDc.exe
  2⤵
  PID:7628
- C:\Windows\System\DErTgsQ.exe
  C:\Windows\System\DErTgsQ.exe
  2⤵
  PID:7644
- C:\Windows\System\FjvgChP.exe
  C:\Windows\System\FjvgChP.exe
  2⤵
  PID:7660
- C:\Windows\System\RXGGSuo.exe
  C:\Windows\System\RXGGSuo.exe
  2⤵
  PID:7676
- C:\Windows\System\RvvSRQo.exe
  C:\Windows\System\RvvSRQo.exe
  2⤵
  PID:7692
- C:\Windows\System\tyLLRHF.exe
  C:\Windows\System\tyLLRHF.exe
  2⤵
  PID:7708
- C:\Windows\System\pTBrGMF.exe
  C:\Windows\System\pTBrGMF.exe
  2⤵
  PID:7724
- C:\Windows\System\EzVDgrl.exe
  C:\Windows\System\EzVDgrl.exe
  2⤵
  PID:7740
- C:\Windows\System\vNEvdDs.exe
  C:\Windows\System\vNEvdDs.exe
  2⤵
  PID:7756
- C:\Windows\System\lTqxuAQ.exe
  C:\Windows\System\lTqxuAQ.exe
  2⤵
  PID:7772
- C:\Windows\System\sSfyTww.exe
  C:\Windows\System\sSfyTww.exe
  2⤵
  PID:7788
- C:\Windows\System\VpLAHVZ.exe
  C:\Windows\System\VpLAHVZ.exe
  2⤵
  PID:7804
- C:\Windows\System\BIVWsVR.exe
  C:\Windows\System\BIVWsVR.exe
  2⤵
  PID:7820
- C:\Windows\System\cxjHUDX.exe
  C:\Windows\System\cxjHUDX.exe
  2⤵
  PID:7836
- C:\Windows\System\cUeNMuY.exe
  C:\Windows\System\cUeNMuY.exe
  2⤵
  PID:7852
- C:\Windows\System\DUFDAeA.exe
  C:\Windows\System\DUFDAeA.exe
  2⤵
  PID:7868
- C:\Windows\System\XdNITPH.exe
  C:\Windows\System\XdNITPH.exe
  2⤵
  PID:7884
- C:\Windows\System\gtqXkhD.exe
  C:\Windows\System\gtqXkhD.exe
  2⤵
  PID:7900
- C:\Windows\System\qwWriFy.exe
  C:\Windows\System\qwWriFy.exe
  2⤵
  PID:7916
- C:\Windows\System\rhXUjEa.exe
  C:\Windows\System\rhXUjEa.exe
  2⤵
  PID:7932
- C:\Windows\System\nUSLCPq.exe
  C:\Windows\System\nUSLCPq.exe
  2⤵
  PID:7948
- C:\Windows\System\LTACYap.exe
  C:\Windows\System\LTACYap.exe
  2⤵
  PID:7964
- C:\Windows\System\fzZcQaT.exe
  C:\Windows\System\fzZcQaT.exe
  2⤵
  PID:7980
- C:\Windows\System\RiRwWzd.exe
  C:\Windows\System\RiRwWzd.exe
  2⤵
  PID:7996
- C:\Windows\System\UyeLmCE.exe
  C:\Windows\System\UyeLmCE.exe
  2⤵
  PID:8012
- C:\Windows\System\fvxnmmh.exe
  C:\Windows\System\fvxnmmh.exe
  2⤵
  PID:8028
- C:\Windows\System\hvHnYwn.exe
  C:\Windows\System\hvHnYwn.exe
  2⤵
  PID:8052
- C:\Windows\System\AOvHhYO.exe
  C:\Windows\System\AOvHhYO.exe
  2⤵
  PID:8068
- C:\Windows\System\ogurSxk.exe
  C:\Windows\System\ogurSxk.exe
  2⤵
  PID:8084
- C:\Windows\System\SwPjQth.exe
  C:\Windows\System\SwPjQth.exe
  2⤵
  PID:8108
- C:\Windows\System\NzOaDKj.exe
  C:\Windows\System\NzOaDKj.exe
  2⤵
  PID:8124
- C:\Windows\System\lCPkGJE.exe
  C:\Windows\System\lCPkGJE.exe
  2⤵
  PID:8140
- C:\Windows\System\erOCnBG.exe
  C:\Windows\System\erOCnBG.exe
  2⤵
  PID:8156
- C:\Windows\System\qABKNoH.exe
  C:\Windows\System\qABKNoH.exe
  2⤵
  PID:8172
- C:\Windows\System\TNAokxm.exe
  C:\Windows\System\TNAokxm.exe
  2⤵
  PID:8188
- C:\Windows\System\JByAcZE.exe
  C:\Windows\System\JByAcZE.exe
  2⤵
  PID:5768
- C:\Windows\System\CasyPov.exe
  C:\Windows\System\CasyPov.exe
  2⤵
  PID:6392
- C:\Windows\System\XXLFPyu.exe
  C:\Windows\System\XXLFPyu.exe
  2⤵
  PID:6196
- C:\Windows\System\RsNdhlx.exe
  C:\Windows\System\RsNdhlx.exe
  2⤵
  PID:6260
- C:\Windows\System\FujiYvR.exe
  C:\Windows\System\FujiYvR.exe
  2⤵
  PID:7344
- C:\Windows\System\CIkiLQu.exe
  C:\Windows\System\CIkiLQu.exe
  2⤵
  PID:6108
- C:\Windows\System\mNQzYRO.exe
  C:\Windows\System\mNQzYRO.exe
  2⤵
  PID:7236
- C:\Windows\System\COslqfE.exe
  C:\Windows\System\COslqfE.exe
  2⤵
  PID:7508
- C:\Windows\System\EKrMurQ.exe
  C:\Windows\System\EKrMurQ.exe
  2⤵
  PID:7268
- C:\Windows\System\UwdCZmG.exe
  C:\Windows\System\UwdCZmG.exe
  2⤵
  PID:7328
- C:\Windows\System\dbWAxSA.exe
  C:\Windows\System\dbWAxSA.exe
  2⤵
  PID:7392
- C:\Windows\System\HMozYuc.exe
  C:\Windows\System\HMozYuc.exe
  2⤵
  PID:7492
- C:\Windows\System\NmTuYuQ.exe
  C:\Windows\System\NmTuYuQ.exe
  2⤵
  PID:7576
- C:\Windows\System\sgIjtOJ.exe
  C:\Windows\System\sgIjtOJ.exe
  2⤵
  PID:7424
- C:\Windows\System\xBjdCen.exe
  C:\Windows\System\xBjdCen.exe
  2⤵
  PID:7652
- C:\Windows\System\wlwPcDv.exe
  C:\Windows\System\wlwPcDv.exe
  2⤵
  PID:7656
- C:\Windows\System\VrMNSOw.exe
  C:\Windows\System\VrMNSOw.exe
  2⤵
  PID:7768
- C:\Windows\System\DVJBuEV.exe
  C:\Windows\System\DVJBuEV.exe
  2⤵
  PID:7828
- C:\Windows\System\ujzsPrz.exe
  C:\Windows\System\ujzsPrz.exe
  2⤵
  PID:7752
- C:\Windows\System\JiCTxDF.exe
  C:\Windows\System\JiCTxDF.exe
  2⤵
  PID:7924
- C:\Windows\System\sOdsGSA.exe
  C:\Windows\System\sOdsGSA.exe
  2⤵
  PID:7940
- C:\Windows\System\lvaEdyy.exe
  C:\Windows\System\lvaEdyy.exe
  2⤵
  PID:8008
- C:\Windows\System\SpFbGFD.exe
  C:\Windows\System\SpFbGFD.exe
  2⤵
  PID:8024
- C:\Windows\System\oxSRzoW.exe
  C:\Windows\System\oxSRzoW.exe
  2⤵
  PID:8044
- C:\Windows\System\VydsiSj.exe
  C:\Windows\System\VydsiSj.exe
  2⤵
  PID:8080
- C:\Windows\System\RVTHJBU.exe
  C:\Windows\System\RVTHJBU.exe
  2⤵
  PID:8100
- C:\Windows\System\AnBpxiS.exe
  C:\Windows\System\AnBpxiS.exe
  2⤵
  PID:8104
- C:\Windows\System\TyjNnPw.exe
  C:\Windows\System\TyjNnPw.exe
  2⤵
  PID:6592
- C:\Windows\System\blWxZMa.exe
  C:\Windows\System\blWxZMa.exe
  2⤵
  PID:6372
- C:\Windows\System\WjSrxDC.exe
  C:\Windows\System\WjSrxDC.exe
  2⤵
  PID:6148
- C:\Windows\System\fPGqLOY.exe
  C:\Windows\System\fPGqLOY.exe
  2⤵
  PID:7172
- C:\Windows\System\GrokCuz.exe
  C:\Windows\System\GrokCuz.exe
  2⤵
  PID:7188
- C:\Windows\System\NQdxMip.exe
  C:\Windows\System\NQdxMip.exe
  2⤵
  PID:7376
- C:\Windows\System\sKcFwPI.exe
  C:\Windows\System\sKcFwPI.exe
  2⤵
  PID:7100
- C:\Windows\System\aEMuZgX.exe
  C:\Windows\System\aEMuZgX.exe
  2⤵
  PID:7300
- C:\Windows\System\pOIxskf.exe
  C:\Windows\System\pOIxskf.exe
  2⤵
  PID:7428
- C:\Windows\System\ZbapxmJ.exe
  C:\Windows\System\ZbapxmJ.exe
  2⤵
  PID:7152
- C:\Windows\System\RZCNGPs.exe
  C:\Windows\System\RZCNGPs.exe
  2⤵
  PID:7220
- C:\Windows\System\AusckMW.exe
  C:\Windows\System\AusckMW.exe
  2⤵
  PID:7316
- C:\Windows\System\zMJnhEj.exe
  C:\Windows\System\zMJnhEj.exe
  2⤵
  PID:7200
- C:\Windows\System\sZaeYDc.exe
  C:\Windows\System\sZaeYDc.exe
  2⤵
  PID:7544
- C:\Windows\System\bxrctAP.exe
  C:\Windows\System\bxrctAP.exe
  2⤵
  PID:7608
- C:\Windows\System\TKxyhlc.exe
  C:\Windows\System\TKxyhlc.exe
  2⤵
  PID:7560
- C:\Windows\System\rHVgYkD.exe
  C:\Windows\System\rHVgYkD.exe
  2⤵
  PID:7684
- C:\Windows\System\HYMmapq.exe
  C:\Windows\System\HYMmapq.exe
  2⤵
  PID:7800
- C:\Windows\System\nkkQZRu.exe
  C:\Windows\System\nkkQZRu.exe
  2⤵
  PID:7736
- C:\Windows\System\lWfVPxF.exe
  C:\Windows\System\lWfVPxF.exe
  2⤵
  PID:7848
- C:\Windows\System\BNEtPjt.exe
  C:\Windows\System\BNEtPjt.exe
  2⤵
  PID:7976
- C:\Windows\System\AodpFPB.exe
  C:\Windows\System\AodpFPB.exe
  2⤵
  PID:8148
- C:\Windows\System\yPCojGf.exe
  C:\Windows\System\yPCojGf.exe
  2⤵
  PID:7512
- C:\Windows\System\ZyQCMMa.exe
  C:\Windows\System\ZyQCMMa.exe
  2⤵
  PID:6912
- C:\Windows\System\FtAOnlX.exe
  C:\Windows\System\FtAOnlX.exe
  2⤵
  PID:6736
- C:\Windows\System\zSBaiVy.exe
  C:\Windows\System\zSBaiVy.exe
  2⤵
  PID:6256
- C:\Windows\System\MfdOcPr.exe
  C:\Windows\System\MfdOcPr.exe
  2⤵
  PID:6540
- C:\Windows\System\hyuwCYz.exe
  C:\Windows\System\hyuwCYz.exe
  2⤵
  PID:7620
- C:\Windows\System\nbrUAsN.exe
  C:\Windows\System\nbrUAsN.exe
  2⤵
  PID:7636
- C:\Windows\System\xJntvVj.exe
  C:\Windows\System\xJntvVj.exe
  2⤵
  PID:7624
- C:\Windows\System\IYsXQoa.exe
  C:\Windows\System\IYsXQoa.exe
  2⤵
  PID:7816
- C:\Windows\System\OoMvszX.exe
  C:\Windows\System\OoMvszX.exe
  2⤵
  PID:7052
- C:\Windows\System\yWCegkh.exe
  C:\Windows\System\yWCegkh.exe
  2⤵
  PID:7880
- C:\Windows\System\uFlkAJM.exe
  C:\Windows\System\uFlkAJM.exe
  2⤵
  PID:8132
- C:\Windows\System\XmAglkj.exe
  C:\Windows\System\XmAglkj.exe
  2⤵
  PID:8060
- C:\Windows\System\FczNeMk.exe
  C:\Windows\System\FczNeMk.exe
  2⤵
  PID:7956
- C:\Windows\System\vhYuxLK.exe
  C:\Windows\System\vhYuxLK.exe
  2⤵
  PID:8064
- C:\Windows\System\oMaPfBq.exe
  C:\Windows\System\oMaPfBq.exe
  2⤵
  PID:6304
- C:\Windows\System\uYjDQLv.exe
  C:\Windows\System\uYjDQLv.exe
  2⤵
  PID:7216
- C:\Windows\System\QftFwHb.exe
  C:\Windows\System\QftFwHb.exe
  2⤵
  PID:7640
- C:\Windows\System\GWCZSFa.exe
  C:\Windows\System\GWCZSFa.exe
  2⤵
  PID:7032
- C:\Windows\System\hrPvIPV.exe
  C:\Windows\System\hrPvIPV.exe
  2⤵
  PID:7120
- C:\Windows\System\PkFabdX.exe
  C:\Windows\System\PkFabdX.exe
  2⤵
  PID:7780
- C:\Windows\System\GEkIAGb.exe
  C:\Windows\System\GEkIAGb.exe
  2⤵
  PID:7844
- C:\Windows\System\xDjndXc.exe
  C:\Windows\System\xDjndXc.exe
  2⤵
  PID:7992
- C:\Windows\System\BetYFpl.exe
  C:\Windows\System\BetYFpl.exe
  2⤵
  PID:8096
- C:\Windows\System\GGihvcB.exe
  C:\Windows\System\GGihvcB.exe
  2⤵
  PID:7528
- C:\Windows\System\WcjOhaJ.exe
  C:\Windows\System\WcjOhaJ.exe
  2⤵
  PID:7184
- C:\Windows\System\BlCNUaA.exe
  C:\Windows\System\BlCNUaA.exe
  2⤵
  PID:7572
- C:\Windows\System\tAKiUAF.exe
  C:\Windows\System\tAKiUAF.exe
  2⤵
  PID:7408
- C:\Windows\System\QyHHkvi.exe
  C:\Windows\System\QyHHkvi.exe
  2⤵
  PID:7204
- C:\Windows\System\QzFWWdG.exe
  C:\Windows\System\QzFWWdG.exe
  2⤵
  PID:8204
- C:\Windows\System\ZWgAJqC.exe
  C:\Windows\System\ZWgAJqC.exe
  2⤵
  PID:8220
- C:\Windows\System\VzeepjI.exe
  C:\Windows\System\VzeepjI.exe
  2⤵
  PID:8236
- C:\Windows\System\HkjwxpB.exe
  C:\Windows\System\HkjwxpB.exe
  2⤵
  PID:8252
- C:\Windows\System\VYcBkZa.exe
  C:\Windows\System\VYcBkZa.exe
  2⤵
  PID:8268
- C:\Windows\System\YAvnKTQ.exe
  C:\Windows\System\YAvnKTQ.exe
  2⤵
  PID:8284
- C:\Windows\System\UeEaZNV.exe
  C:\Windows\System\UeEaZNV.exe
  2⤵
  PID:8300
- C:\Windows\System\RQjevFu.exe
  C:\Windows\System\RQjevFu.exe
  2⤵
  PID:8316
- C:\Windows\System\SszSMro.exe
  C:\Windows\System\SszSMro.exe
  2⤵
  PID:8332
- C:\Windows\System\HEimsLm.exe
  C:\Windows\System\HEimsLm.exe
  2⤵
  PID:8348
- C:\Windows\System\zEKTqYb.exe
  C:\Windows\System\zEKTqYb.exe
  2⤵
  PID:8364
- C:\Windows\System\lbKiknS.exe
  C:\Windows\System\lbKiknS.exe
  2⤵
  PID:8380
- C:\Windows\System\mLhssqA.exe
  C:\Windows\System\mLhssqA.exe
  2⤵
  PID:8396
- C:\Windows\System\wCblJTH.exe
  C:\Windows\System\wCblJTH.exe
  2⤵
  PID:8412
- C:\Windows\System\USxyJLN.exe
  C:\Windows\System\USxyJLN.exe
  2⤵
  PID:8428
- C:\Windows\System\HdJJTcZ.exe
  C:\Windows\System\HdJJTcZ.exe
  2⤵
  PID:8444
- C:\Windows\System\VwQIoVL.exe
  C:\Windows\System\VwQIoVL.exe
  2⤵
  PID:8460
- C:\Windows\System\ggLCmgL.exe
  C:\Windows\System\ggLCmgL.exe
  2⤵
  PID:8476
- C:\Windows\System\sEJzwwk.exe
  C:\Windows\System\sEJzwwk.exe
  2⤵
  PID:8492
- C:\Windows\System\SDFcIGX.exe
  C:\Windows\System\SDFcIGX.exe
  2⤵
  PID:8508
- C:\Windows\System\dzLGQcG.exe
  C:\Windows\System\dzLGQcG.exe
  2⤵
  PID:8524
- C:\Windows\System\IMLHvoW.exe
  C:\Windows\System\IMLHvoW.exe
  2⤵
  PID:8540
- C:\Windows\System\sxxVdTV.exe
  C:\Windows\System\sxxVdTV.exe
  2⤵
  PID:8556
- C:\Windows\System\kJOTKlx.exe
  C:\Windows\System\kJOTKlx.exe
  2⤵
  PID:8572
- C:\Windows\System\pIDTDqR.exe
  C:\Windows\System\pIDTDqR.exe
  2⤵
  PID:8588
- C:\Windows\System\aTBqGEd.exe
  C:\Windows\System\aTBqGEd.exe
  2⤵
  PID:8604
- C:\Windows\System\bEeEiRA.exe
  C:\Windows\System\bEeEiRA.exe
  2⤵
  PID:8620
- C:\Windows\System\IwYLnob.exe
  C:\Windows\System\IwYLnob.exe
  2⤵
  PID:8640
- C:\Windows\System\fTBLZWd.exe
  C:\Windows\System\fTBLZWd.exe
  2⤵
  PID:8656
- C:\Windows\System\YxMqhbL.exe
  C:\Windows\System\YxMqhbL.exe
  2⤵
  PID:8672
- C:\Windows\System\kjsncPU.exe
  C:\Windows\System\kjsncPU.exe
  2⤵
  PID:8688
- C:\Windows\System\YoUNBah.exe
  C:\Windows\System\YoUNBah.exe
  2⤵
  PID:8704
- C:\Windows\System\wZIuPaR.exe
  C:\Windows\System\wZIuPaR.exe
  2⤵
  PID:8720
- C:\Windows\System\dGDpAfg.exe
  C:\Windows\System\dGDpAfg.exe
  2⤵
  PID:8736
- C:\Windows\System\gScjhDt.exe
  C:\Windows\System\gScjhDt.exe
  2⤵
  PID:8752
- C:\Windows\System\TlRVZnq.exe
  C:\Windows\System\TlRVZnq.exe
  2⤵
  PID:8768
- C:\Windows\System\lRDcHZD.exe
  C:\Windows\System\lRDcHZD.exe
  2⤵
  PID:8784
- C:\Windows\System\amDgXMl.exe
  C:\Windows\System\amDgXMl.exe
  2⤵
  PID:8800
- C:\Windows\System\aCvqJaz.exe
  C:\Windows\System\aCvqJaz.exe
  2⤵
  PID:8816
- C:\Windows\System\CBBXpLv.exe
  C:\Windows\System\CBBXpLv.exe
  2⤵
  PID:8832
- C:\Windows\System\aByRLyc.exe
  C:\Windows\System\aByRLyc.exe
  2⤵
  PID:8848
- C:\Windows\System\TsMlDmH.exe
  C:\Windows\System\TsMlDmH.exe
  2⤵
  PID:8868
- C:\Windows\System\ZqDbGGO.exe
  C:\Windows\System\ZqDbGGO.exe
  2⤵
  PID:8884
- C:\Windows\System\owzqjoe.exe
  C:\Windows\System\owzqjoe.exe
  2⤵
  PID:8900
- C:\Windows\System\CQnALvp.exe
  C:\Windows\System\CQnALvp.exe
  2⤵
  PID:8916
- C:\Windows\System\aLGNbnJ.exe
  C:\Windows\System\aLGNbnJ.exe
  2⤵
  PID:8932
- C:\Windows\System\QxRPFrs.exe
  C:\Windows\System\QxRPFrs.exe
  2⤵
  PID:8948
- C:\Windows\System\ZKUOpls.exe
  C:\Windows\System\ZKUOpls.exe
  2⤵
  PID:8964
- C:\Windows\System\PDRfDuA.exe
  C:\Windows\System\PDRfDuA.exe
  2⤵
  PID:8980
- C:\Windows\System\XuKvErm.exe
  C:\Windows\System\XuKvErm.exe
  2⤵
  PID:8996
- C:\Windows\System\rNqhAoq.exe
  C:\Windows\System\rNqhAoq.exe
  2⤵
  PID:9012
- C:\Windows\System\WseYybU.exe
  C:\Windows\System\WseYybU.exe
  2⤵
  PID:9028
- C:\Windows\System\vYFmdXA.exe
  C:\Windows\System\vYFmdXA.exe
  2⤵
  PID:9044
- C:\Windows\System\SLDooOI.exe
  C:\Windows\System\SLDooOI.exe
  2⤵
  PID:9060
- C:\Windows\System\iRdGExd.exe
  C:\Windows\System\iRdGExd.exe
  2⤵
  PID:9076
- C:\Windows\System\RcsIPdc.exe
  C:\Windows\System\RcsIPdc.exe
  2⤵
  PID:9092
- C:\Windows\System\NZoBpvu.exe
  C:\Windows\System\NZoBpvu.exe
  2⤵
  PID:9108
- C:\Windows\System\uYQecig.exe
  C:\Windows\System\uYQecig.exe
  2⤵
  PID:9124
- C:\Windows\System\ZbHTCgE.exe
  C:\Windows\System\ZbHTCgE.exe
  2⤵
  PID:9140
- C:\Windows\System\urIHmaa.exe
  C:\Windows\System\urIHmaa.exe
  2⤵
  PID:9156
- C:\Windows\System\dePWZkC.exe
  C:\Windows\System\dePWZkC.exe
  2⤵
  PID:9176
- C:\Windows\System\KExHenh.exe
  C:\Windows\System\KExHenh.exe
  2⤵
  PID:9192
- C:\Windows\System\OiwQWFZ.exe
  C:\Windows\System\OiwQWFZ.exe
  2⤵
  PID:9208
- C:\Windows\System\aQxtbXz.exe
  C:\Windows\System\aQxtbXz.exe
  2⤵
  PID:7908
- C:\Windows\System\vkSbjRM.exe
  C:\Windows\System\vkSbjRM.exe
  2⤵
  PID:7912
- C:\Windows\System\scLSpEJ.exe
  C:\Windows\System\scLSpEJ.exe
  2⤵
  PID:8216
- C:\Windows\System\QGxPVZF.exe
  C:\Windows\System\QGxPVZF.exe
  2⤵
  PID:8228
- C:\Windows\System\iNEbyVT.exe
  C:\Windows\System\iNEbyVT.exe
  2⤵
  PID:8392
- C:\Windows\System\dpojsJR.exe
  C:\Windows\System\dpojsJR.exe
  2⤵
  PID:8408
- C:\Windows\System\Svwywed.exe
  C:\Windows\System\Svwywed.exe
  2⤵
  PID:8452
- C:\Windows\System\NHBhgHT.exe
  C:\Windows\System\NHBhgHT.exe
  2⤵
  PID:8500
- C:\Windows\System\dirSvKj.exe
  C:\Windows\System\dirSvKj.exe
  2⤵
  PID:8488
- C:\Windows\System\UulIcuf.exe
  C:\Windows\System\UulIcuf.exe
  2⤵
  PID:8564
- C:\Windows\System\XftNAYy.exe
  C:\Windows\System\XftNAYy.exe
  2⤵
  PID:8600
- C:\Windows\System\NAQXbFZ.exe
  C:\Windows\System\NAQXbFZ.exe
  2⤵
  PID:8668
- C:\Windows\System\cXYBAxb.exe
  C:\Windows\System\cXYBAxb.exe
  2⤵
  PID:8552
- C:\Windows\System\pfmwbfO.exe
  C:\Windows\System\pfmwbfO.exe
  2⤵
  PID:8696
- C:\Windows\System\YxaYwwc.exe
  C:\Windows\System\YxaYwwc.exe
  2⤵
  PID:8812
- C:\Windows\System\uJlFrBH.exe
  C:\Windows\System\uJlFrBH.exe
  2⤵
  PID:8892
- C:\Windows\System\aLKEhxc.exe
  C:\Windows\System\aLKEhxc.exe
  2⤵
  PID:8956
- C:\Windows\System\PVDGqdL.exe
  C:\Windows\System\PVDGqdL.exe
  2⤵
  PID:8880
- C:\Windows\System\LNcVRCz.exe
  C:\Windows\System\LNcVRCz.exe
  2⤵
  PID:8988
- C:\Windows\System\SOZJSql.exe
  C:\Windows\System\SOZJSql.exe
  2⤵
  PID:9024
- C:\Windows\System\zvPmkaw.exe
  C:\Windows\System\zvPmkaw.exe
  2⤵
  PID:9036
- C:\Windows\System\kagATXF.exe
  C:\Windows\System\kagATXF.exe
  2⤵
  PID:9084
- C:\Windows\System\SQakUps.exe
  C:\Windows\System\SQakUps.exe
  2⤵
  PID:9120
- C:\Windows\System\IXjKUCl.exe
  C:\Windows\System\IXjKUCl.exe
  2⤵
  PID:9136
- C:\Windows\System\pCoAdiv.exe
  C:\Windows\System\pCoAdiv.exe
  2⤵
  PID:9152
- C:\Windows\System\tIpdjvb.exe
  C:\Windows\System\tIpdjvb.exe
  2⤵
  PID:9200
- C:\Windows\System\vaXWGqr.exe
  C:\Windows\System\vaXWGqr.exe
  2⤵
  PID:7748
- C:\Windows\System\gluRmMC.exe
  C:\Windows\System\gluRmMC.exe
  2⤵
  PID:8196
- C:\Windows\System\ofeMOVq.exe
  C:\Windows\System\ofeMOVq.exe
  2⤵
  PID:8276
- C:\Windows\System\glLaViG.exe
  C:\Windows\System\glLaViG.exe
  2⤵
  PID:8280
- C:\Windows\System\ZpyQgGW.exe
  C:\Windows\System\ZpyQgGW.exe
  2⤵
  PID:8324
- C:\Windows\System\ZAKRMXP.exe
  C:\Windows\System\ZAKRMXP.exe
  2⤵
  PID:8372
- C:\Windows\System\iJyQFVP.exe
  C:\Windows\System\iJyQFVP.exe
  2⤵
  PID:8424
- C:\Windows\System\afezEQr.exe
  C:\Windows\System\afezEQr.exe
  2⤵
  PID:8484
- C:\Windows\System\jMFfoWj.exe
  C:\Windows\System\jMFfoWj.exe
  2⤵
  PID:8472
- C:\Windows\System\buzoBLU.exe
  C:\Windows\System\buzoBLU.exe
  2⤵
  PID:8636
- C:\Windows\System\ItAGMME.exe
  C:\Windows\System\ItAGMME.exe
  2⤵
  PID:8680
- C:\Windows\System\GEUrxFw.exe
  C:\Windows\System\GEUrxFw.exe
  2⤵
  PID:8728
- C:\Windows\System\FpyRXNh.exe
  C:\Windows\System\FpyRXNh.exe
  2⤵
  PID:8716
- C:\Windows\System\yAjIXBw.exe
  C:\Windows\System\yAjIXBw.exe
  2⤵
  PID:8744
- C:\Windows\System\ZfAaZuI.exe
  C:\Windows\System\ZfAaZuI.exe
  2⤵
  PID:8808
- C:\Windows\System\CWSFxOC.exe
  C:\Windows\System\CWSFxOC.exe
  2⤵
  PID:8860
- C:\Windows\System\bSAdNDK.exe
  C:\Windows\System\bSAdNDK.exe
  2⤵
  PID:8840
- C:\Windows\System\gGHcBxf.exe
  C:\Windows\System\gGHcBxf.exe
  2⤵
  PID:9004
- C:\Windows\System\HauMAVr.exe
  C:\Windows\System\HauMAVr.exe
  2⤵
  PID:8296
- C:\Windows\System\jtHnlms.exe
  C:\Windows\System\jtHnlms.exe
  2⤵
  PID:8020
- C:\Windows\System\xLhQTjj.exe
  C:\Windows\System\xLhQTjj.exe
  2⤵
  PID:7972
- C:\Windows\System\LdreGcN.exe
  C:\Windows\System\LdreGcN.exe
  2⤵
  PID:9072
- C:\Windows\System\gPGzFJZ.exe
  C:\Windows\System\gPGzFJZ.exe
  2⤵
  PID:8092
- C:\Windows\System\txMYdvu.exe
  C:\Windows\System\txMYdvu.exe
  2⤵
  PID:8360
- C:\Windows\System\doGhjWa.exe
  C:\Windows\System\doGhjWa.exe
  2⤵
  PID:8548
- C:\Windows\System\ltyvlFU.exe
  C:\Windows\System\ltyvlFU.exe
  2⤵
  PID:8792
- C:\Windows\System\ALCwiDM.exe
  C:\Windows\System\ALCwiDM.exe
  2⤵
  PID:9020
- C:\Windows\System\nSUwNNN.exe
  C:\Windows\System\nSUwNNN.exe
  2⤵
  PID:9164
- C:\Windows\System\ObwbPbl.exe
  C:\Windows\System\ObwbPbl.exe
  2⤵
  PID:9184
- C:\Windows\System\JzCOPGZ.exe
  C:\Windows\System\JzCOPGZ.exe
  2⤵
  PID:8652
- C:\Windows\System\MlFTVTR.exe
  C:\Windows\System\MlFTVTR.exe
  2⤵
  PID:8328
- C:\Windows\System\idNJjGi.exe
  C:\Windows\System\idNJjGi.exe
  2⤵
  PID:8700
- C:\Windows\System\neTHGzJ.exe
  C:\Windows\System\neTHGzJ.exe
  2⤵
  PID:8468
- C:\Windows\System\oQJGIbW.exe
  C:\Windows\System\oQJGIbW.exe
  2⤵
  PID:8232
- C:\Windows\System\evRsqxy.exe
  C:\Windows\System\evRsqxy.exe
  2⤵
  PID:8388
- C:\Windows\System\tcgPcAM.exe
  C:\Windows\System\tcgPcAM.exe
  2⤵
  PID:9056
- C:\Windows\System\iyoFZxd.exe
  C:\Windows\System\iyoFZxd.exe
  2⤵
  PID:9008
- C:\Windows\System\NdTbMNS.exe
  C:\Windows\System\NdTbMNS.exe
  2⤵
  PID:9188
- C:\Windows\System\UHNhkpj.exe
  C:\Windows\System\UHNhkpj.exe
  2⤵
  PID:9228
- C:\Windows\System\NzwYxlX.exe
  C:\Windows\System\NzwYxlX.exe
  2⤵
  PID:9244
- C:\Windows\System\oXAXcIE.exe
  C:\Windows\System\oXAXcIE.exe
  2⤵
  PID:9260
- C:\Windows\System\HsUsKAt.exe
  C:\Windows\System\HsUsKAt.exe
  2⤵
  PID:9276
- C:\Windows\System\BFhxAfg.exe
  C:\Windows\System\BFhxAfg.exe
  2⤵
  PID:9292
- C:\Windows\System\evSXwIQ.exe
  C:\Windows\System\evSXwIQ.exe
  2⤵
  PID:9308
- C:\Windows\System\fCllgfk.exe
  C:\Windows\System\fCllgfk.exe
  2⤵
  PID:9324
- C:\Windows\System\YAUNREc.exe
  C:\Windows\System\YAUNREc.exe
  2⤵
  PID:9340
- C:\Windows\System\eQocinj.exe
  C:\Windows\System\eQocinj.exe
  2⤵
  PID:9356
- C:\Windows\System\ySQDAxA.exe
  C:\Windows\System\ySQDAxA.exe
  2⤵
  PID:9372
- C:\Windows\System\LPKNAUP.exe
  C:\Windows\System\LPKNAUP.exe
  2⤵
  PID:9388
- C:\Windows\System\mzHiBsp.exe
  C:\Windows\System\mzHiBsp.exe
  2⤵
  PID:9404
- C:\Windows\System\beHnRFO.exe
  C:\Windows\System\beHnRFO.exe
  2⤵
  PID:9420
- C:\Windows\System\lEumlwR.exe
  C:\Windows\System\lEumlwR.exe
  2⤵
  PID:9436
- C:\Windows\System\LbCqkKr.exe
  C:\Windows\System\LbCqkKr.exe
  2⤵
  PID:9452
- C:\Windows\System\qvAaxhi.exe
  C:\Windows\System\qvAaxhi.exe
  2⤵
  PID:9468
- C:\Windows\System\WiZpfov.exe
  C:\Windows\System\WiZpfov.exe
  2⤵
  PID:9484
- C:\Windows\System\IwJXNRa.exe
  C:\Windows\System\IwJXNRa.exe
  2⤵
  PID:9500
- C:\Windows\System\ATMuYCX.exe
  C:\Windows\System\ATMuYCX.exe
  2⤵
  PID:9516
- C:\Windows\System\wMtvMlw.exe
  C:\Windows\System\wMtvMlw.exe
  2⤵
  PID:9532
- C:\Windows\System\TJIRGaj.exe
  C:\Windows\System\TJIRGaj.exe
  2⤵
  PID:9548
- C:\Windows\System\xCgfwxh.exe
  C:\Windows\System\xCgfwxh.exe
  2⤵
  PID:9564
- C:\Windows\System\TvtBSLI.exe
  C:\Windows\System\TvtBSLI.exe
  2⤵
  PID:9584
- C:\Windows\System\RaiFLVt.exe
  C:\Windows\System\RaiFLVt.exe
  2⤵
  PID:9600
- C:\Windows\System\fDIOPWw.exe
  C:\Windows\System\fDIOPWw.exe
  2⤵
  PID:9616
- C:\Windows\System\dbvcwOj.exe
  C:\Windows\System\dbvcwOj.exe
  2⤵
  PID:9632
- C:\Windows\System\WanzunW.exe
  C:\Windows\System\WanzunW.exe
  2⤵
  PID:9648
- C:\Windows\System\lpXKOUT.exe
  C:\Windows\System\lpXKOUT.exe
  2⤵
  PID:9668
- C:\Windows\System\bIrKbLe.exe
  C:\Windows\System\bIrKbLe.exe
  2⤵
  PID:9684
- C:\Windows\System\ujQmnEs.exe
  C:\Windows\System\ujQmnEs.exe
  2⤵
  PID:9700
- C:\Windows\System\dhhWnKL.exe
  C:\Windows\System\dhhWnKL.exe
  2⤵
  PID:9716
- C:\Windows\System\sRTZYSx.exe
  C:\Windows\System\sRTZYSx.exe
  2⤵
  PID:9732
- C:\Windows\System\JuTdAPf.exe
  C:\Windows\System\JuTdAPf.exe
  2⤵
  PID:9748
- C:\Windows\System\AocrfOf.exe
  C:\Windows\System\AocrfOf.exe
  2⤵
  PID:9764
- C:\Windows\System\xLEeTcq.exe
  C:\Windows\System\xLEeTcq.exe
  2⤵
  PID:9780
- C:\Windows\System\RtaIScU.exe
  C:\Windows\System\RtaIScU.exe
  2⤵
  PID:9796
- C:\Windows\System\wgoaImD.exe
  C:\Windows\System\wgoaImD.exe
  2⤵
  PID:9812
- C:\Windows\System\rcrkKzJ.exe
  C:\Windows\System\rcrkKzJ.exe
  2⤵
  PID:9828
- C:\Windows\System\MXxKFtX.exe
  C:\Windows\System\MXxKFtX.exe
  2⤵
  PID:9844
- C:\Windows\System\fVhwYHK.exe
  C:\Windows\System\fVhwYHK.exe
  2⤵
  PID:9860
- C:\Windows\System\RVQPMss.exe
  C:\Windows\System\RVQPMss.exe
  2⤵
  PID:9876
- C:\Windows\System\RuzhVBK.exe
  C:\Windows\System\RuzhVBK.exe
  2⤵
  PID:9892
- C:\Windows\System\UsKmGSY.exe
  C:\Windows\System\UsKmGSY.exe
  2⤵
  PID:9908
- C:\Windows\System\OMzNWfn.exe
  C:\Windows\System\OMzNWfn.exe
  2⤵
  PID:9924
- C:\Windows\System\pqYjuvX.exe
  C:\Windows\System\pqYjuvX.exe
  2⤵
  PID:9940
- C:\Windows\System\iOCwOMW.exe
  C:\Windows\System\iOCwOMW.exe
  2⤵
  PID:9956
- C:\Windows\System\AmlbXLI.exe
  C:\Windows\System\AmlbXLI.exe
  2⤵
  PID:9972
- C:\Windows\System\brrUdYZ.exe
  C:\Windows\System\brrUdYZ.exe
  2⤵
  PID:9988
- C:\Windows\System\YZSkfnW.exe
  C:\Windows\System\YZSkfnW.exe
  2⤵
  PID:10004
- C:\Windows\System\BlvidKy.exe
  C:\Windows\System\BlvidKy.exe
  2⤵
  PID:10020
- C:\Windows\System\Auhkgzb.exe
  C:\Windows\System\Auhkgzb.exe
  2⤵
  PID:10036
- C:\Windows\System\mDmNwaw.exe
  C:\Windows\System\mDmNwaw.exe
  2⤵
  PID:10052
- C:\Windows\System\aRlECIi.exe
  C:\Windows\System\aRlECIi.exe
  2⤵
  PID:10068
- C:\Windows\System\wMAEsmv.exe
  C:\Windows\System\wMAEsmv.exe
  2⤵
  PID:10084
- C:\Windows\System\pNxurhk.exe
  C:\Windows\System\pNxurhk.exe
  2⤵
  PID:10100
- C:\Windows\System\IucsxKB.exe
  C:\Windows\System\IucsxKB.exe
  2⤵
  PID:10116
- C:\Windows\System\wngQLUP.exe
  C:\Windows\System\wngQLUP.exe
  2⤵
  PID:10132
- C:\Windows\System\gPlxDNZ.exe
  C:\Windows\System\gPlxDNZ.exe
  2⤵
  PID:10152
- C:\Windows\System\WAAiKPJ.exe
  C:\Windows\System\WAAiKPJ.exe
  2⤵
  PID:10168
- C:\Windows\System\qfXVwbG.exe
  C:\Windows\System\qfXVwbG.exe
  2⤵
  PID:10184
- C:\Windows\System\xFLVexf.exe
  C:\Windows\System\xFLVexf.exe
  2⤵
  PID:10200
- C:\Windows\System\SuLuaMJ.exe
  C:\Windows\System\SuLuaMJ.exe
  2⤵
  PID:10220
- C:\Windows\System\xGLzVjf.exe
  C:\Windows\System\xGLzVjf.exe
  2⤵
  PID:10236
- C:\Windows\System\okRgFzO.exe
  C:\Windows\System\okRgFzO.exe
  2⤵
  PID:9220
- C:\Windows\System\ILKOYuJ.exe
  C:\Windows\System\ILKOYuJ.exe
  2⤵
  PID:9288
- C:\Windows\System\XBKMTNM.exe
  C:\Windows\System\XBKMTNM.exe
  2⤵
  PID:9348
- C:\Windows\System\xWPpPDM.exe
  C:\Windows\System\xWPpPDM.exe
  2⤵
  PID:8796
- C:\Windows\System\pgnpQXv.exe
  C:\Windows\System\pgnpQXv.exe
  2⤵
  PID:9268
- C:\Windows\System\STrTetW.exe
  C:\Windows\System\STrTetW.exe
  2⤵
  PID:9304
- C:\Windows\System\NlqdrRz.exe
  C:\Windows\System\NlqdrRz.exe
  2⤵
  PID:9396
- C:\Windows\System\gHGMkAi.exe
  C:\Windows\System\gHGMkAi.exe
  2⤵
  PID:9412
- C:\Windows\System\sWpIanF.exe
  C:\Windows\System\sWpIanF.exe
  2⤵
  PID:9496
- C:\Windows\System\FbsTplH.exe
  C:\Windows\System\FbsTplH.exe
  2⤵
  PID:9508
- C:\Windows\System\TJWlqRo.exe
  C:\Windows\System\TJWlqRo.exe
  2⤵
  PID:9512
- C:\Windows\System\NwFXCbb.exe
  C:\Windows\System\NwFXCbb.exe
  2⤵
  PID:9544
- C:\Windows\System\OpNIFPD.exe
  C:\Windows\System\OpNIFPD.exe
  2⤵
  PID:9612
- C:\Windows\System\YoKODIT.exe
  C:\Windows\System\YoKODIT.exe
  2⤵
  PID:9628
- C:\Windows\System\SKIVFHz.exe
  C:\Windows\System\SKIVFHz.exe
  2⤵
  PID:9624
- C:\Windows\System\VTuVdJh.exe
  C:\Windows\System\VTuVdJh.exe
  2⤵
  PID:9708
- C:\Windows\System\nTJkiYI.exe
  C:\Windows\System\nTJkiYI.exe
  2⤵
  PID:9756
- C:\Windows\System\nGywzGu.exe
  C:\Windows\System\nGywzGu.exe
  2⤵
  PID:9808
- C:\Windows\System\oJAoJaH.exe
  C:\Windows\System\oJAoJaH.exe
  2⤵
  PID:9804
- C:\Windows\System\pxNYtdg.exe
  C:\Windows\System\pxNYtdg.exe
  2⤵
  PID:9824
- C:\Windows\System\kHRgHIJ.exe
  C:\Windows\System\kHRgHIJ.exe
  2⤵
  PID:9888
- C:\Windows\System\OyKCesE.exe
  C:\Windows\System\OyKCesE.exe
  2⤵
  PID:9948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BQiqHkA.exe

Filesize
2.3MB

MD5
7ae3628cac91c367c314a74f128d56af

SHA1
269afc692fb9d9e930c5c7a643021962d16c8812

SHA256
5b90ab9fe4225b3974abe58961c340d2b0eddeeee52632ddc255a8b043d36aa5

SHA512
9c1f5f4344c56f2d10f95aebb236cc85eca56b9d2ee7fe4ab666e1ff66b5aede34aba6eb82baa92784a3180c6d976c0443803f03907486c607760986feea2b4b

Download Submit
C:\Windows\system\DFTOczo.exe

Filesize
2.3MB

MD5
a75b5791c7ca561a0ba44c6f124d17d6

SHA1
277879448c921220f0429a29dda30e5ecc189eab

SHA256
fb3a408067517e4a3c83a35db8cb2489d91d7529af0c567a7fc29dad78061ba0

SHA512
c2bf7c3728cd4f1f6b025a0c4231491c62bfe911b595bdf861cf2fca386b448f28f49e84ac63d88e5f95ff46e80125ba4c448fbb0b4186743d4a3edbb473031a

Download Submit
C:\Windows\system\FtRcWVL.exe

Filesize
2.3MB

MD5
314440a22efda44b21653c0373fade46

SHA1
fa6bb9d93947dd355d140998a21282da87166237

SHA256
de7b94e9b9eb67af4f925fd4640258348c0c349645128a9789360e43f3b74a39

SHA512
94cb9980874acc3690f8cda3fa65001ce48ae82678b2b2ed6f56e0941decf7c56fca956793daa487195b2950ef494ef2c4afa3885191660d91d725a5dfa78d7e

Download Submit
C:\Windows\system\JQWcOMM.exe

Filesize
2.3MB

MD5
6abeaade4871fb2ab7269432cfb4f4f3

SHA1
368658cd61e0a656dfcf887d6c6f4737086c3a2e

SHA256
0a4a3b6365445ed722bcfc47b84cd00bff3c91bff13d07a58ab63c64c44ee50a

SHA512
b463b2ad8f25ba2a0822a0ed37857d98a6b73a7c34fd8bd8d0628ea60e411d4c87bb2961a6b44a27f524ec5276f8fafe587d81a0c82b1287c126d7cfa852fe1b

Download Submit
C:\Windows\system\MQaWwxK.exe

Filesize
2.3MB

MD5
62787e2deae213482486c0bf22e0b3df

SHA1
b38d3f9303a62e839f2eb922296118b4e442a973

SHA256
0e48e093e302141746f47c3c0c320ffc5456abdcd238dcc4d0022065669d3387

SHA512
d11a6225f495ac9d1bb8fe88b62b30d3cab7aa9bd0f31cbaf3a605e68e610ad9693c0ec5989cb77aa7098aa6f36bae1def5414567ff8ba3b155b211f352a9aa7

Download Submit
C:\Windows\system\NVEvBfG.exe

Filesize
2.3MB

MD5
fd10797c74a7d96013c2d4766df122f3

SHA1
ff152244ea768f47a829f75f8f709870afca7411

SHA256
046a5bcf7487959f90c972f330b3f79182f489e580db65c21111a4369f278c75

SHA512
0c615b7a3b9c63777b3e4e357bc6ce294e127975de774496f3893a634e5075fcc737e7963b662930f0b6896ca4211bda20b33e3913176435eb75a57761e1a5e8

Download Submit
C:\Windows\system\PRbrouy.exe

Filesize
2.3MB

MD5
895d14af3049357c0f3e3394540c7acf

SHA1
bf4e88e02909433cfb63139ee83333db48984fa0

SHA256
fa5a784e049c9c79fa36c4515b9e0a59192da7325fe2de86ecbae76d329567a9

SHA512
7a538497fec914d953e3033f5aa6a723ea39cd009de62a209297abdbb8e6248257da97b52b298f58c0c433f1d1b3fe2ba169565b17a378c1322f217bc78bbe72

Download Submit
C:\Windows\system\PUtkzoq.exe

Filesize
2.3MB

MD5
f642f59f01cd55cc5a8bafcd659ccac1

SHA1
6f3091b22af07e99f036bef4ed8a78c899856a06

SHA256
2135006cf623e2c1cd0817f5fd3dd65f80243a3f8391b5565669b7bf96ad09d1

SHA512
53263b704c179991317ab56aba95aab6f7fff44c975e4bc1dea994716d993bb00891079419be4947b4a61eaa276df9e35c43dc783b661b348032ef8640c171d1

Download Submit
C:\Windows\system\UFkInBI.exe

Filesize
2.3MB

MD5
f16272fddb04f2f6476b4a8047ae0363

SHA1
64c51d3de39912bdb2363ce18a3ebf3acbd7213b

SHA256
15a8a06f036307657d73813b9f8078ed457bb1e7e5c11b08502a9b6aeba521bd

SHA512
3e6683f3757bea562146908da662cae953b9bdc5ccb24394993a6b5ba0eba491aa0b32540eb0420a7717d616ce869cec58ba54d5e9a3de4e00f8d6251888801f

Download Submit
C:\Windows\system\UHVpsld.exe

Filesize
2.3MB

MD5
522d9757659b3dc8a2c01b5fc08a52ad

SHA1
abee07b9964ca007da3795797566cf1c988cdbb3

SHA256
207388ad18bd313e2c55fa0ff0ac3e116466cb0b809864fc88872ffd38cd9c69

SHA512
72aaad0da8b85f87be160f2ce8dcc1c69a355ee1eafa31ed58954ce9bb776a6b332f757d7fc03b5a212c297fa9180f95abc5b8abdd3fe0dd9435b770f28f3971

Download Submit
C:\Windows\system\ZdvWzif.exe

Filesize
2.3MB

MD5
a4de532cd4905739601d6f6f2301728d

SHA1
dd5bf4c3e088feb5d1a2f27a59269a39404eb33e

SHA256
38946aba01335ea6a412136ca0dd770c79ce622311cb4ae69114dd54b77846f7

SHA512
aa23445c7558572e07d16536b708b422dba695d97873f91841603da659e07f02a8ce79b0fa7c546677f78dfcbebedd6e4e762b6ce33bb44d2a6796b193d35fb4

Download Submit
C:\Windows\system\ZpvRPxX.exe

Filesize
2.3MB

MD5
9d3518e6d51e5058881276e27a3dfde4

SHA1
b4f689be9a3ea71dbbeb3d3bd381159494426f7b

SHA256
b334f6efe9b32c0409504d83412138d30e4828666e62bf2cdaee97b41d9709ea

SHA512
2ae87dbe3292c7cd10f48b7fad1464cdcfcf9885f36e04aa8ddeae737dfbc11f60dfd4bc3251e286d73ca4370978ca048cb90ec348dfbde3f500412d7763c184

Download Submit
C:\Windows\system\afOpURH.exe

Filesize
2.3MB

MD5
cdecc54d750f50045c3cfe6b949d371f

SHA1
855bcf54df7d0f0d8b8dc55451c1b8e23ae07e84

SHA256
b605c88b43efc2cafbc9dec5d0beb3ad9e8ac0d06f57c6b195fbef9507934920

SHA512
7a2749956ae9d825363850cb38ee2fcccc6b14619e855c04f2a5ee5b08667d404927ce694ca59b920b7358ee45b0b8ec52c9005379157cc34c4f7bd069bafe80

Download Submit
C:\Windows\system\cIhpjRM.exe

Filesize
2.3MB

MD5
7fb3e6ec2eaecc6f33ed8aef8a3f55a6

SHA1
4e2db693e170e8d320dcdad4c59d97502201c9cf

SHA256
8deefbab23327b3e07c36eb696906801f6fb2faec552f3d793b5dad2ddf6f829

SHA512
b3ffa81701c00f9a23c7783afe9ddac32c264349aad95b2fc5d377bedf7331bd4d62835404237797dcbf0fb7b1aa901df15c3201992bc2bd59fd7c324060fc0f

Download Submit
C:\Windows\system\cNaXaQV.exe

Filesize
2.3MB

MD5
2dfc0aa68aaa7215e112dbcd6f8043e7

SHA1
fe758911ac8c4f12fc86fa742f2a475912d67816

SHA256
c6bc12d32ab74152e77ba00e6db556453eb48779154148c67499c11a1b0d4f4e

SHA512
a997fa2ac99046c6cd39eae04bbbd8325f41f1e8c91fdaa9e5fbb0c138610aeac7343bf98ccbc7dca04f9011e516c537a6c192a154dcf660efe757289535ea8e

Download Submit
C:\Windows\system\cUNxvLI.exe

Filesize
2.3MB

MD5
55262074c18a74c708bc11ed92625d68

SHA1
afd4b8600ce7aad4428387068b99745600000d84

SHA256
43c6a3d3541de6d8451e70925cee91c471eafb6634249e049601a593d8391437

SHA512
d3c3440da3a08fe3bde99edb29ddc1745e1ded30b9ae509d4eaaf51d0ee470cd852b92b56c30036f05aedf3e2bcceabb3a6ab4601a5703b17a2705770532ee27

Download Submit
C:\Windows\system\gJvGvMS.exe

Filesize
2.3MB

MD5
6ededb3b7cf3e217b5c7459adb991d11

SHA1
37dc9a606172d93226890343f3da8516ea5c710f

SHA256
bc9cbc1bd9d50a4a0233252a45525a908ed4b0274b26cc9a0033d61db09da0a2

SHA512
075ac670ba7cb96daef5d31eb0f753499c8218da18e396d002e698081b26c002f5add188689fc6e011d47961e32f7132093027c84a9272ebe311bff9a2a28c0c

Download Submit
C:\Windows\system\jCNpmyS.exe

Filesize
2.3MB

MD5
43f4a4f34e32d2bd93570194caadc84c

SHA1
3be7cc5a6d2a84b133a4c1d07a79b8741697c821

SHA256
d1d54d7e89adf631953a2b154b89da9cb20463a4fad291817622d8c70f47f40c

SHA512
779af945881a1b26d0e251035077a143694ba4f68fb6cbaeade575db75b3b8529b0d6cc3afd6228b64270589de51ae0c2f66859e486d96b3bfced35b49482e28

Download Submit
C:\Windows\system\kvGszGH.exe

Filesize
2.3MB

MD5
98bc2cd83d3e0b6decef712ee867421d

SHA1
c26c277f151cbe1f26acb07933ca2ddc0d6c8aa3

SHA256
83e1b0d9f611ecc86165d2b570a9f2bc210515f71aeab205d637eb2ee270f774

SHA512
a1956c0bb9a83d2a7f1c558bed6916d8ee0086da9f87eccda9e53774b24b4b3f14ece0382fafa8a30c81a8eabb30e62dd7cf1ec425245943d29b3cc2b695a245

Download Submit
C:\Windows\system\kytZizb.exe

Filesize
2.3MB

MD5
7fc2b5e8d2f7042b1e1d19eeb8f65225

SHA1
05366f3a9c3b0bb8a51bf5d02416ee14d845671d

SHA256
a4d5f66a38045ce431736f9b6132cbf35301c374896c89e033d6457fae0cc77d

SHA512
ccd5ecf581259be9f484aa98149dede51d5f8c632c405817097cdad92521844be9b66f7389590ce03c2d1bd7826359d698ab18c71f33d5503e116abe85a47230

Download Submit
C:\Windows\system\rPZMUeJ.exe

Filesize
2.3MB

MD5
0eb067e8db4c13eabeb0660e1abf88af

SHA1
e8d7d8ff5794415e728d7fcf972b107c75c4d00a

SHA256
c08245649e520774af22366b67e543e9f57021cc3cf6a7660505c46a14d39047

SHA512
600ca31c9115a9dea350d659ceaa01f153f6b47b782c6c2785e6a4af1ce121b373d88d12bd3754cff9184b9f97d90246d9cdfab25f44109c794a145a5ad860db

Download Submit
C:\Windows\system\rryKVLM.exe

Filesize
2.3MB

MD5
8714b1efc6a07e8cb60de2fb13ca16c4

SHA1
f0c85989ed097a91cf18d9233cfa563ff0b166ed

SHA256
bd110ac522b8764782594cee2a1d0077167aac28dd730adcf06ee818f8374100

SHA512
d603da0d40a40600623e394918129ff8b97afd8278c40cb3a09babdaa2839da27bf1512a36c49a0f0d7db611393edd7c4582067e9a089f7f8b1e65dba693617f

Download Submit
C:\Windows\system\rxkdPWn.exe

Filesize
2.3MB

MD5
04a87fd86fdaeda242c718ac6a27d10b

SHA1
0eaa33183157b9c47e607054e501286114ed02d1

SHA256
6a00b486211a2278d0f3ad1b886a6e2f7b4230551a4a80e35664ca8e27bce79a

SHA512
715e076d571874970b6ef662517608b432fb675478dc7fdc2927d9b1e855b6c47a991eed8f6dcc96737542eb6cef96652057f8e919a5ae4b94977780acfdbf5a

Download Submit
C:\Windows\system\sBSjzmO.exe

Filesize
2.3MB

MD5
d465492a661e82513e9676f51e3683bc

SHA1
3296e6665594d68e25edd4b03fa134eb2dfec38e

SHA256
3738f1d0418d36478e35d81d6cf87bfcc938c5076b3b18c32cd874d0358e7442

SHA512
b79066e0dcdb9b200a1876b6f18af97165f93a536ada63d7f57cf92f843edf9617b93e53862ba129a0e21a3ac656b4adfd43b80412188917e54d5e2bb4a6c711

Download Submit
C:\Windows\system\ssxWGGF.exe

Filesize
2.3MB

MD5
0110f1a2fb0da0ca3fc13122592dca02

SHA1
00b39aa38e2b31260de6f9870d2ac1764b6308b6

SHA256
bdc3c71c825b54e792bd0a4c0d8f7fb0e5a250160ff5fec70a4bcfcb15c9f80c

SHA512
35ffe8af62245e04ff24798cc6ed4efda5d1d4b2d76336f2f91020bccc6ce275ee15baa82a7ffb8032493723f8d67ab1a25d96c85e2672c7d1a0a5820da91a0f

Download Submit
C:\Windows\system\vAlLPAW.exe

Filesize
2.3MB

MD5
2dcb4f5576a21852055284a3fb98ab33

SHA1
5a7b700423581563dde229c3bf8ab519534d9671

SHA256
90198a95536f7df0ffa08a8609fde36487d57bd11f603aee72f1c67838ac906c

SHA512
19cc5fa32edd1de67dfde2fc7094a60e36e1dc45464220af61209a665fa69fe677f68f0017f01207a0577c5158733781179eda0aeca06074b84509df46abda64

Download Submit
C:\Windows\system\wSXiRQJ.exe

Filesize
2.3MB

MD5
0e3350d000f5e388b25401b0b4c41657

SHA1
6928e2172a10d7655829a2b5aeedfed331353008

SHA256
e187ea88e62b062eb73d0c79b0604329d79ad20b79277e2f03f8875eca97db52

SHA512
a84e53fdd83cf746bad96a739174b7d4981e27d9a72c918c9eb8ce91a4f997dbd2be87638e14be99cd4e83af659bce7c5b63cbd7ca77b58e236920e764b5e3b5

Download Submit
C:\Windows\system\yDvFlnG.exe

Filesize
2.3MB

MD5
16cbce710f10f4ec771b6ffc174ee8d8

SHA1
a726c3367c01bd4c210b6110934582f5b8583bbe

SHA256
08d2ae87af49ac149daa4c12397a316a1e363881348b961e70c61648aa614141

SHA512
54a2d873e3666ee29c024fa8b6a72cd9501b8db222414f893fab5fc0a62ca9fb3ad802e2c88c2cc3423dbb1d56640d2bb4061cf364d133f8a1d95d25cc4849c8

Download Submit
\Windows\system\QLPQlAS.exe

Filesize
2.3MB

MD5
4d3b3cb6d7d4f67be5240c6f21627113

SHA1
a3f62c7ce9f64a73650997824891d9307f3e5206

SHA256
a20e7abeef614199a3c2a4717c1ba2d352e22fa7c670cb8c487a9922d72dcc5c

SHA512
acd24b882437cc86cd5c7830be042c846cab29f93ae2315c0eedf0a5b930d7f62e9d6ce1991bab7de30ad1149d29b195f9b59435b36502ce6a2b0c1af7ec1bf8

Download Submit
\Windows\system\cTpliuS.exe

Filesize
2.3MB

MD5
98fecf4e093ebb876a0b858bb76a6d04

SHA1
69d7ccdd24d8063b19b271da66f80d1e397a6393

SHA256
5f5d65c63487775806c7b3cc6f800f194cf634ce580319af3a2762df3787eadf

SHA512
3c34a75de74b2e1edcf75c10b172cf2de2cf84f3761aa81d7a4c37bcfba61c5f2a487ebb25e1352dfed507e314a328b4016e38d59250070d4e758a346b237ad0

Download Submit
\Windows\system\egnofpW.exe

Filesize
2.3MB

MD5
858675510bc5c108b963b3dc507d2fd2

SHA1
95df998462d9668202fbead31f9042b182af60d5

SHA256
02807d32560c025051cb8c610d8f5bef3bd2cb691090fa5724c9b41a1435ef85

SHA512
745338d846493584cebe9292ea252d56b887d984b6cb14d4d5b2d255642c0843776a8baf5d660626aa5ad82c2102681522013d331314cc80b9dc92ca76e761d0

Download Submit
\Windows\system\hfdGftR.exe

Filesize
2.3MB

MD5
0b8c5996a998eb9f1db474b3475dface

SHA1
7c830c9c6c656c305ce820453bcf7319fc4c8c55

SHA256
dc307d26d4c40146464054b6ec327c12b55ff7ad12ba830486400323f78b2470

SHA512
46bb2e21231b769bd0245523d101a830836350815a241f857e6a828e7a296b476096b8279162d19bffabc2d1afe24fa92d22642e7c96e635eec3add8e56fc2f6

Download Submit
memory/1048-3351-0x000000013F050000-0x000000013F3A4000-memory.dmp

Filesize
3.3MB

Download
memory/1048-490-0x000000013F050000-0x000000013F3A4000-memory.dmp

Filesize
3.3MB

Download
memory/1636-465-0x000000013F2D0000-0x000000013F624000-memory.dmp

Filesize
3.3MB

Download
memory/1636-2593-0x000000013F2D0000-0x000000013F624000-memory.dmp

Filesize
3.3MB

Download
memory/2320-3331-0x000000013F2D0000-0x000000013F624000-memory.dmp

Filesize
3.3MB

Download
memory/2320-486-0x000000013F2D0000-0x000000013F624000-memory.dmp

Filesize
3.3MB

Download
memory/2428-484-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Filesize
3.3MB

Download
memory/2428-3306-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Filesize
3.3MB

Download
memory/2452-488-0x000000013F5D0000-0x000000013F924000-memory.dmp

Filesize
3.3MB

Download
memory/2452-3303-0x000000013F5D0000-0x000000013F924000-memory.dmp

Filesize
3.3MB

Download
memory/2516-469-0x000000013F290000-0x000000013F5E4000-memory.dmp

Filesize
3.3MB

Download
memory/2516-3380-0x000000013F290000-0x000000013F5E4000-memory.dmp

Filesize
3.3MB

Download
memory/2552-476-0x000000013F3A0000-0x000000013F6F4000-memory.dmp

Filesize
3.3MB

Download
memory/2552-2573-0x000000013F3A0000-0x000000013F6F4000-memory.dmp

Filesize
3.3MB

Download
memory/2608-480-0x000000013F870000-0x000000013FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/2608-2552-0x000000013F870000-0x000000013FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-3302-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-471-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/2708-3211-0x000000013FA50000-0x000000013FDA4000-memory.dmp

Filesize
3.3MB

Download
memory/2708-478-0x000000013FA50000-0x000000013FDA4000-memory.dmp

Filesize
3.3MB

Download
memory/2716-473-0x000000013F340000-0x000000013F694000-memory.dmp

Filesize
3.3MB

Download
memory/2716-3304-0x000000013F340000-0x000000013F694000-memory.dmp

Filesize
3.3MB

Download
memory/2724-474-0x000000013F3A0000-0x000000013F6F4000-memory.dmp

Filesize
3.3MB

Download
memory/2724-479-0x000000013F870000-0x000000013FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/2724-468-0x000000013F290000-0x000000013F5E4000-memory.dmp

Filesize
3.3MB

Download
memory/2724-470-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/2724-0-0x000000013FE90000-0x00000001401E4000-memory.dmp

Filesize
3.3MB

Download
memory/2724-5811-0x000000013FE90000-0x00000001401E4000-memory.dmp

Filesize
3.3MB

Download
memory/2724-487-0x000000013F5D0000-0x000000013F924000-memory.dmp

Filesize
3.3MB

Download
memory/2724-481-0x000000013F940000-0x000000013FC94000-memory.dmp

Filesize
3.3MB

Download
memory/2724-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2724-483-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Filesize
3.3MB

Download
memory/2724-455-0x000000013F2E0000-0x000000013F634000-memory.dmp

Filesize
3.3MB

Download
memory/2724-485-0x000000013F2D0000-0x000000013F624000-memory.dmp

Filesize
3.3MB

Download
memory/2724-472-0x000000013F340000-0x000000013F694000-memory.dmp

Filesize
3.3MB

Download
memory/2724-489-0x000000013F050000-0x000000013F3A4000-memory.dmp

Filesize
3.3MB

Download
memory/2724-491-0x000000013F060000-0x000000013F3B4000-memory.dmp

Filesize
3.3MB

Download
memory/2724-492-0x000000013F2D0000-0x000000013F624000-memory.dmp

Filesize
3.3MB

Download
memory/2724-477-0x000000013FA50000-0x000000013FDA4000-memory.dmp

Filesize
3.3MB

Download
memory/2724-466-0x000000013F320000-0x000000013F674000-memory.dmp

Filesize
3.3MB

Download
memory/2748-3314-0x000000013F940000-0x000000013FC94000-memory.dmp

Filesize
3.3MB

Download
memory/2748-482-0x000000013F940000-0x000000013FC94000-memory.dmp

Filesize
3.3MB

Download
memory/2924-2591-0x000000013F320000-0x000000013F674000-memory.dmp

Filesize
3.3MB

Download
memory/2924-467-0x000000013F320000-0x000000013F674000-memory.dmp

Filesize
3.3MB

Download
memory/2984-3305-0x000000013F2E0000-0x000000013F634000-memory.dmp

Filesize
3.3MB

Download
memory/2984-463-0x000000013F2E0000-0x000000013F634000-memory.dmp

Filesize
3.3MB

Download