xmrig | 1d8fcc325cd4088ab9206c332610c388bbc11521fc6369c50fcd4be6bd07d104

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
Size

1.6MB
MD5

8f71eff5abf9e137fc688fbe1b8d6900
SHA1

0749fd00741c5cfb5ccd2c52b30be992e8e50f57
SHA256

1d8fcc325cd4088ab9206c332610c388bbc11521fc6369c50fcd4be6bd07d104
SHA512

8b0d83d015e28c156cb7c91942ab32a44e8913ee4b8bc77484af26a8b3830b1d04b8308fcd2c1ce31bc024f30446495202ba0c73ca763143897c7e11dde175e8
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoCSxnhvuqAP9dbWmbOt0BXdnyrf:Lz071uv4BPMkHC0I6GCInhG1dtdF2f

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 14 IoCs

miner

resource	yara_rule
behavioral1/memory/2604-113-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2576-121-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2468-116-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/2736-115-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2724-114-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig
behavioral1/memory/2700-112-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/2336-111-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/2576-5210-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2336-5212-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/2724-5213-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig
behavioral1/memory/2468-5214-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/2604-5215-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2700-5217-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/2736-5218-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2564	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2576	pFmbhWs.exe
2336	xXFGOPN.exe
2700	jzkIGHz.exe
2604	BFJvfWA.exe
2724	hjkiJDp.exe
2736	yBJabGH.exe
2468	HFkbtNm.exe
2624	xUvQEac.exe
2588	Ncrgtwu.exe
2492	UQHqPTH.exe
2916	dPxEJFJ.exe
1564	zYFKCnL.exe
1484	Hxwdxer.exe
2456	ZRONUTz.exe
1912	eCefXVZ.exe
2188	YJcplMh.exe
2696	RWVsNlR.exe
2796	tKsTweW.exe
2488	FePkwRJ.exe
2240	ltxWrGu.exe
780	JAInnot.exe
2928	opzytbl.exe
964	FXQwGoo.exe
1808	KAsNLNb.exe
772	EHPrVLs.exe
356	MAAiAIq.exe
2764	uLqKybM.exe
1960	ZALoBiK.exe
2380	QhmAEFP.exe
1340	QdaBGLe.exe
3048	NNvbJXY.exe
2860	jJXchZF.exe
1252	GNWTiaX.exe
1320	TNLZbjW.exe
3004	BVzIkdh.exe
536	nAbxuVh.exe
916	dMMJDAs.exe
644	RQwmjBJ.exe
2852	GsXieIF.exe
952	KYdZKLX.exe
1100	NddyGaP.exe
1672	CBsrGDs.exe
1280	BKGxBPv.exe
1804	hNcjMgh.exe
1272	sGEuvbK.exe
1656	sUpknyu.exe
1688	NyhdOnq.exe
380	huYTSmI.exe
2220	lLicAhA.exe
1940	mAJrVne.exe
2436	RBETTiP.exe
2184	NSwEBFI.exe
2004	MnUpGof.exe
2676	rwBSgpT.exe
2600	txZbqTh.exe
2272	DzSOvCp.exe
2248	ldsrrha.exe
2484	pBUWtjq.exe
2756	UISdgKf.exe
2716	OCHcmfV.exe
2396	KWitIjP.exe
2440	WdrvdBU.exe
872	mmrdbGu.exe
1944	DXYxdEY.exe

Loads dropped DLL 64 IoCs

pid	Process
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1576-0-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/files/0x000c0000000122ee-3.dat	upx
behavioral1/files/0x0006000000016d7d-33.dat	upx
behavioral1/files/0x0007000000016d73-93.dat	upx
behavioral1/memory/2604-113-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/files/0x0006000000017577-173.dat	upx
behavioral1/files/0x0006000000016d79-46.dat	upx
behavioral1/files/0x00060000000175fd-77.dat	upx
behavioral1/files/0x000500000001937a-181.dat	upx
behavioral1/files/0x000500000001927b-174.dat	upx
behavioral1/files/0x0006000000017436-166.dat	upx
behavioral1/files/0x00060000000173e2-162.dat	upx
behavioral1/files/0x000500000001925a-160.dat	upx
behavioral1/files/0x000600000001738e-155.dat	upx
behavioral1/files/0x000600000001902f-150.dat	upx
behavioral1/files/0x0005000000018749-142.dat	upx
behavioral1/files/0x000600000001708c-137.dat	upx
behavioral1/files/0x00050000000186a2-132.dat	upx
behavioral1/files/0x000500000001870e-130.dat	upx
behavioral1/files/0x000d000000018689-123.dat	upx
behavioral1/files/0x0006000000016fa9-47.dat	upx
behavioral1/files/0x0008000000016ccd-44.dat	upx
behavioral1/files/0x0007000000016c5b-43.dat	upx
behavioral1/files/0x0007000000016c3a-42.dat	upx
behavioral1/files/0x000500000001928e-180.dat	upx
behavioral1/files/0x0005000000019276-169.dat	upx
behavioral1/files/0x0005000000019254-158.dat	upx
behavioral1/files/0x000500000001878f-149.dat	upx
behavioral1/files/0x000500000001871c-140.dat	upx
behavioral1/memory/2576-121-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2468-116-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/memory/2736-115-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2724-114-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/memory/2700-112-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/memory/2336-111-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/files/0x0006000000017603-100.dat	upx
behavioral1/files/0x00060000000175f7-99.dat	upx
behavioral1/files/0x00060000000174ef-98.dat	upx
behavioral1/files/0x00060000000173e5-96.dat	upx
behavioral1/files/0x000600000001738f-95.dat	upx
behavioral1/files/0x00060000000171ad-94.dat	upx
behavioral1/files/0x0009000000016ca1-84.dat	upx
behavioral1/files/0x0007000000016c57-75.dat	upx
behavioral1/files/0x003700000001640f-9.dat	upx
behavioral1/memory/2576-5210-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2336-5212-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/memory/2724-5213-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/memory/2468-5214-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/memory/2604-5215-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2700-5217-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/memory/2736-5218-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bsuuUYo.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\SUXHmdv.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\TIQOhjQ.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\hqRGtVG.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\sjZRtfq.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\CXDklbX.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\AMfVbWj.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\uPDtzJz.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\zPqLsuy.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\fAFSLXq.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\TnYbTlI.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\SLNgDlS.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\AnpskBH.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\OzhcLgJ.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\EgyoIbt.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\mNinLDo.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\mxWVVJh.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\XaTTfqR.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\ZxENDww.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\Jzystgd.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\ugptjBo.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\RsDbnsw.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\uEmPwdb.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\wYZFHhf.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\dWKXAXd.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\nbktGxy.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\cKbYqjO.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\kbjDbgO.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\KHKEHHC.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\NyhdOnq.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\ZPGsIkc.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\lScwshJ.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\QePyjNz.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\OsktebR.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\mAyNsqp.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\Rrilovd.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\BoPJTkd.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\rIimGJd.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\ZJBELpd.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\HaVIsTE.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\PVVnMML.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\WwLZFLi.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\BJAmczp.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\TMCjTWk.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\jWLPFTT.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\IYikvpD.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\tkNEWkk.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\imgtNzT.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\jPyuUCY.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\vqPUgfG.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\KkKLVyj.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\EYspDfJ.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\qylHGIg.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\UQcbUeD.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\XLyDtys.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\DneRsoJ.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\NoKplBv.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\mCsNNPJ.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\zdkxyEc.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\fJHhMgK.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\HgBEnXF.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\CRrzoQj.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\fMvppPr.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
File created	C:\Windows\System\WZWVTsy.exe	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2564	powershell.exe
2564	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
Token: SeDebugPrivilege	2564	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2564	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	29
PID 1576 wrote to memory of 2564	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	29
PID 1576 wrote to memory of 2564	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	29
PID 1576 wrote to memory of 2336	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	30
PID 1576 wrote to memory of 2336	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	30
PID 1576 wrote to memory of 2336	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	30
PID 1576 wrote to memory of 2576	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	31
PID 1576 wrote to memory of 2576	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	31
PID 1576 wrote to memory of 2576	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	31
PID 1576 wrote to memory of 2700	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	32
PID 1576 wrote to memory of 2700	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	32
PID 1576 wrote to memory of 2700	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	32
PID 1576 wrote to memory of 2624	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	33
PID 1576 wrote to memory of 2624	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	33
PID 1576 wrote to memory of 2624	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	33
PID 1576 wrote to memory of 2604	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	34
PID 1576 wrote to memory of 2604	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	34
PID 1576 wrote to memory of 2604	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	34
PID 1576 wrote to memory of 2588	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	35
PID 1576 wrote to memory of 2588	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	35
PID 1576 wrote to memory of 2588	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	35
PID 1576 wrote to memory of 2724	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	36
PID 1576 wrote to memory of 2724	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	36
PID 1576 wrote to memory of 2724	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	36
PID 1576 wrote to memory of 2492	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	37
PID 1576 wrote to memory of 2492	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	37
PID 1576 wrote to memory of 2492	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	37
PID 1576 wrote to memory of 2736	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	38
PID 1576 wrote to memory of 2736	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	38
PID 1576 wrote to memory of 2736	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	38
PID 1576 wrote to memory of 2696	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	39
PID 1576 wrote to memory of 2696	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	39
PID 1576 wrote to memory of 2696	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	39
PID 1576 wrote to memory of 2468	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	40
PID 1576 wrote to memory of 2468	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	40
PID 1576 wrote to memory of 2468	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	40
PID 1576 wrote to memory of 2488	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	41
PID 1576 wrote to memory of 2488	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	41
PID 1576 wrote to memory of 2488	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	41
PID 1576 wrote to memory of 2916	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	42
PID 1576 wrote to memory of 2916	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	42
PID 1576 wrote to memory of 2916	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	42
PID 1576 wrote to memory of 2928	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	43
PID 1576 wrote to memory of 2928	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	43
PID 1576 wrote to memory of 2928	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	43
PID 1576 wrote to memory of 1564	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	44
PID 1576 wrote to memory of 1564	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	44
PID 1576 wrote to memory of 1564	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	44
PID 1576 wrote to memory of 1808	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	45
PID 1576 wrote to memory of 1808	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	45
PID 1576 wrote to memory of 1808	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	45
PID 1576 wrote to memory of 1484	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	46
PID 1576 wrote to memory of 1484	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	46
PID 1576 wrote to memory of 1484	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	46
PID 1576 wrote to memory of 772	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	47
PID 1576 wrote to memory of 772	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	47
PID 1576 wrote to memory of 772	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	47
PID 1576 wrote to memory of 2456	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	48
PID 1576 wrote to memory of 2456	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	48
PID 1576 wrote to memory of 2456	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	48
PID 1576 wrote to memory of 2764	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	49
PID 1576 wrote to memory of 2764	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	49
PID 1576 wrote to memory of 2764	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	49
PID 1576 wrote to memory of 1912	1576	8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8f71eff5abf9e137fc688fbe1b8d6900_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\System\xXFGOPN.exe
  C:\Windows\System\xXFGOPN.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\pFmbhWs.exe
  C:\Windows\System\pFmbhWs.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\jzkIGHz.exe
  C:\Windows\System\jzkIGHz.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\xUvQEac.exe
  C:\Windows\System\xUvQEac.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\BFJvfWA.exe
  C:\Windows\System\BFJvfWA.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\Ncrgtwu.exe
  C:\Windows\System\Ncrgtwu.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\hjkiJDp.exe
  C:\Windows\System\hjkiJDp.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\UQHqPTH.exe
  C:\Windows\System\UQHqPTH.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\yBJabGH.exe
  C:\Windows\System\yBJabGH.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\RWVsNlR.exe
  C:\Windows\System\RWVsNlR.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\HFkbtNm.exe
  C:\Windows\System\HFkbtNm.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\FePkwRJ.exe
  C:\Windows\System\FePkwRJ.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\dPxEJFJ.exe
  C:\Windows\System\dPxEJFJ.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\opzytbl.exe
  C:\Windows\System\opzytbl.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\zYFKCnL.exe
  C:\Windows\System\zYFKCnL.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\KAsNLNb.exe
  C:\Windows\System\KAsNLNb.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\Hxwdxer.exe
  C:\Windows\System\Hxwdxer.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\EHPrVLs.exe
  C:\Windows\System\EHPrVLs.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\ZRONUTz.exe
  C:\Windows\System\ZRONUTz.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\uLqKybM.exe
  C:\Windows\System\uLqKybM.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\eCefXVZ.exe
  C:\Windows\System\eCefXVZ.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\QhmAEFP.exe
  C:\Windows\System\QhmAEFP.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\YJcplMh.exe
  C:\Windows\System\YJcplMh.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\QdaBGLe.exe
  C:\Windows\System\QdaBGLe.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\tKsTweW.exe
  C:\Windows\System\tKsTweW.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\GNWTiaX.exe
  C:\Windows\System\GNWTiaX.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\ltxWrGu.exe
  C:\Windows\System\ltxWrGu.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\nAbxuVh.exe
  C:\Windows\System\nAbxuVh.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\JAInnot.exe
  C:\Windows\System\JAInnot.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\RQwmjBJ.exe
  C:\Windows\System\RQwmjBJ.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\FXQwGoo.exe
  C:\Windows\System\FXQwGoo.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\GsXieIF.exe
  C:\Windows\System\GsXieIF.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\MAAiAIq.exe
  C:\Windows\System\MAAiAIq.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\KYdZKLX.exe
  C:\Windows\System\KYdZKLX.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\ZALoBiK.exe
  C:\Windows\System\ZALoBiK.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\NddyGaP.exe
  C:\Windows\System\NddyGaP.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\NNvbJXY.exe
  C:\Windows\System\NNvbJXY.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\CBsrGDs.exe
  C:\Windows\System\CBsrGDs.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\jJXchZF.exe
  C:\Windows\System\jJXchZF.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\BKGxBPv.exe
  C:\Windows\System\BKGxBPv.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\TNLZbjW.exe
  C:\Windows\System\TNLZbjW.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\hNcjMgh.exe
  C:\Windows\System\hNcjMgh.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\BVzIkdh.exe
  C:\Windows\System\BVzIkdh.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\sGEuvbK.exe
  C:\Windows\System\sGEuvbK.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\dMMJDAs.exe
  C:\Windows\System\dMMJDAs.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\sUpknyu.exe
  C:\Windows\System\sUpknyu.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\NyhdOnq.exe
  C:\Windows\System\NyhdOnq.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\huYTSmI.exe
  C:\Windows\System\huYTSmI.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\lLicAhA.exe
  C:\Windows\System\lLicAhA.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\mAJrVne.exe
  C:\Windows\System\mAJrVne.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\RBETTiP.exe
  C:\Windows\System\RBETTiP.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\NSwEBFI.exe
  C:\Windows\System\NSwEBFI.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\MnUpGof.exe
  C:\Windows\System\MnUpGof.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\DzSOvCp.exe
  C:\Windows\System\DzSOvCp.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\rwBSgpT.exe
  C:\Windows\System\rwBSgpT.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\ldsrrha.exe
  C:\Windows\System\ldsrrha.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\txZbqTh.exe
  C:\Windows\System\txZbqTh.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\UISdgKf.exe
  C:\Windows\System\UISdgKf.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\pBUWtjq.exe
  C:\Windows\System\pBUWtjq.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\OCHcmfV.exe
  C:\Windows\System\OCHcmfV.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\KWitIjP.exe
  C:\Windows\System\KWitIjP.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\WdrvdBU.exe
  C:\Windows\System\WdrvdBU.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\mmrdbGu.exe
  C:\Windows\System\mmrdbGu.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\DXYxdEY.exe
  C:\Windows\System\DXYxdEY.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\ueGNsVg.exe
  C:\Windows\System\ueGNsVg.exe
  2⤵
  PID:2072
- C:\Windows\System\GYHMSiy.exe
  C:\Windows\System\GYHMSiy.exe
  2⤵
  PID:2364
- C:\Windows\System\KyJzoTR.exe
  C:\Windows\System\KyJzoTR.exe
  2⤵
  PID:2688
- C:\Windows\System\XwyCGdy.exe
  C:\Windows\System\XwyCGdy.exe
  2⤵
  PID:2856
- C:\Windows\System\isrDZct.exe
  C:\Windows\System\isrDZct.exe
  2⤵
  PID:2008
- C:\Windows\System\lEdEWTb.exe
  C:\Windows\System\lEdEWTb.exe
  2⤵
  PID:1604
- C:\Windows\System\LDgzerH.exe
  C:\Windows\System\LDgzerH.exe
  2⤵
  PID:3040
- C:\Windows\System\zDunQbp.exe
  C:\Windows\System\zDunQbp.exe
  2⤵
  PID:2528
- C:\Windows\System\rntYbhF.exe
  C:\Windows\System\rntYbhF.exe
  2⤵
  PID:1496
- C:\Windows\System\RBNjXuG.exe
  C:\Windows\System\RBNjXuG.exe
  2⤵
  PID:2376
- C:\Windows\System\mwVIpit.exe
  C:\Windows\System\mwVIpit.exe
  2⤵
  PID:856
- C:\Windows\System\BlHRbMp.exe
  C:\Windows\System\BlHRbMp.exe
  2⤵
  PID:1556
- C:\Windows\System\cJPlEKm.exe
  C:\Windows\System\cJPlEKm.exe
  2⤵
  PID:572
- C:\Windows\System\PHeIYxg.exe
  C:\Windows\System\PHeIYxg.exe
  2⤵
  PID:540
- C:\Windows\System\ngOzzlf.exe
  C:\Windows\System\ngOzzlf.exe
  2⤵
  PID:3068
- C:\Windows\System\PpyKQDI.exe
  C:\Windows\System\PpyKQDI.exe
  2⤵
  PID:968
- C:\Windows\System\CLFavyn.exe
  C:\Windows\System\CLFavyn.exe
  2⤵
  PID:2044
- C:\Windows\System\dLhpXPb.exe
  C:\Windows\System\dLhpXPb.exe
  2⤵
  PID:1488
- C:\Windows\System\mHFUstd.exe
  C:\Windows\System\mHFUstd.exe
  2⤵
  PID:1928
- C:\Windows\System\VIEtamJ.exe
  C:\Windows\System\VIEtamJ.exe
  2⤵
  PID:1756
- C:\Windows\System\KFjANGK.exe
  C:\Windows\System\KFjANGK.exe
  2⤵
  PID:788
- C:\Windows\System\ncwLGhJ.exe
  C:\Windows\System\ncwLGhJ.exe
  2⤵
  PID:1628
- C:\Windows\System\KohSGKS.exe
  C:\Windows\System\KohSGKS.exe
  2⤵
  PID:2212
- C:\Windows\System\SBvEzSu.exe
  C:\Windows\System\SBvEzSu.exe
  2⤵
  PID:2632
- C:\Windows\System\aABIOfa.exe
  C:\Windows\System\aABIOfa.exe
  2⤵
  PID:2940
- C:\Windows\System\jyIfREv.exe
  C:\Windows\System\jyIfREv.exe
  2⤵
  PID:2672
- C:\Windows\System\ZbAdsPL.exe
  C:\Windows\System\ZbAdsPL.exe
  2⤵
  PID:2444
- C:\Windows\System\fjImmCO.exe
  C:\Windows\System\fjImmCO.exe
  2⤵
  PID:1632
- C:\Windows\System\EqyFHaL.exe
  C:\Windows\System\EqyFHaL.exe
  2⤵
  PID:544
- C:\Windows\System\kaoMXJu.exe
  C:\Windows\System\kaoMXJu.exe
  2⤵
  PID:1680
- C:\Windows\System\oCRJKDx.exe
  C:\Windows\System\oCRJKDx.exe
  2⤵
  PID:1532
- C:\Windows\System\atRALum.exe
  C:\Windows\System\atRALum.exe
  2⤵
  PID:1540
- C:\Windows\System\BSPlXvV.exe
  C:\Windows\System\BSPlXvV.exe
  2⤵
  PID:1228
- C:\Windows\System\BDqiNEt.exe
  C:\Windows\System\BDqiNEt.exe
  2⤵
  PID:2428
- C:\Windows\System\ZgLTpfd.exe
  C:\Windows\System\ZgLTpfd.exe
  2⤵
  PID:2644
- C:\Windows\System\AVTEKlK.exe
  C:\Windows\System\AVTEKlK.exe
  2⤵
  PID:2192
- C:\Windows\System\wuKCozI.exe
  C:\Windows\System\wuKCozI.exe
  2⤵
  PID:2112
- C:\Windows\System\mEAjFyp.exe
  C:\Windows\System\mEAjFyp.exe
  2⤵
  PID:680
- C:\Windows\System\LioeIfd.exe
  C:\Windows\System\LioeIfd.exe
  2⤵
  PID:2332
- C:\Windows\System\RChPAsS.exe
  C:\Windows\System\RChPAsS.exe
  2⤵
  PID:2864
- C:\Windows\System\awvVXYm.exe
  C:\Windows\System\awvVXYm.exe
  2⤵
  PID:2040
- C:\Windows\System\pyyALIs.exe
  C:\Windows\System\pyyALIs.exe
  2⤵
  PID:2052
- C:\Windows\System\UymYAZb.exe
  C:\Windows\System\UymYAZb.exe
  2⤵
  PID:1168
- C:\Windows\System\bqkhdET.exe
  C:\Windows\System\bqkhdET.exe
  2⤵
  PID:1444
- C:\Windows\System\CuBqVvq.exe
  C:\Windows\System\CuBqVvq.exe
  2⤵
  PID:1720
- C:\Windows\System\ZQkURyL.exe
  C:\Windows\System\ZQkURyL.exe
  2⤵
  PID:3084
- C:\Windows\System\hqRGtVG.exe
  C:\Windows\System\hqRGtVG.exe
  2⤵
  PID:3100
- C:\Windows\System\tFgHXAg.exe
  C:\Windows\System\tFgHXAg.exe
  2⤵
  PID:3120
- C:\Windows\System\oIqZbNo.exe
  C:\Windows\System\oIqZbNo.exe
  2⤵
  PID:3136
- C:\Windows\System\doXVFni.exe
  C:\Windows\System\doXVFni.exe
  2⤵
  PID:3152
- C:\Windows\System\jDsOlAZ.exe
  C:\Windows\System\jDsOlAZ.exe
  2⤵
  PID:3172
- C:\Windows\System\lyBubsp.exe
  C:\Windows\System\lyBubsp.exe
  2⤵
  PID:3188
- C:\Windows\System\PYHgwnz.exe
  C:\Windows\System\PYHgwnz.exe
  2⤵
  PID:3204
- C:\Windows\System\HcfQRGe.exe
  C:\Windows\System\HcfQRGe.exe
  2⤵
  PID:3220
- C:\Windows\System\rgrUQlJ.exe
  C:\Windows\System\rgrUQlJ.exe
  2⤵
  PID:3244
- C:\Windows\System\puhGHhG.exe
  C:\Windows\System\puhGHhG.exe
  2⤵
  PID:3260
- C:\Windows\System\NAjmfKa.exe
  C:\Windows\System\NAjmfKa.exe
  2⤵
  PID:3276
- C:\Windows\System\wYWlkYR.exe
  C:\Windows\System\wYWlkYR.exe
  2⤵
  PID:3292
- C:\Windows\System\otlsare.exe
  C:\Windows\System\otlsare.exe
  2⤵
  PID:3316
- C:\Windows\System\EWROZDQ.exe
  C:\Windows\System\EWROZDQ.exe
  2⤵
  PID:3332
- C:\Windows\System\rhwHmhC.exe
  C:\Windows\System\rhwHmhC.exe
  2⤵
  PID:3352
- C:\Windows\System\wnAiIHS.exe
  C:\Windows\System\wnAiIHS.exe
  2⤵
  PID:3368
- C:\Windows\System\hkPuxVf.exe
  C:\Windows\System\hkPuxVf.exe
  2⤵
  PID:3388
- C:\Windows\System\ayYNWQM.exe
  C:\Windows\System\ayYNWQM.exe
  2⤵
  PID:3408
- C:\Windows\System\jMQLtkj.exe
  C:\Windows\System\jMQLtkj.exe
  2⤵
  PID:3424
- C:\Windows\System\PzcRolJ.exe
  C:\Windows\System\PzcRolJ.exe
  2⤵
  PID:3440
- C:\Windows\System\QyNECBR.exe
  C:\Windows\System\QyNECBR.exe
  2⤵
  PID:3460
- C:\Windows\System\yDHIHtd.exe
  C:\Windows\System\yDHIHtd.exe
  2⤵
  PID:3476
- C:\Windows\System\tTIYUwf.exe
  C:\Windows\System\tTIYUwf.exe
  2⤵
  PID:3496
- C:\Windows\System\lSbbCuP.exe
  C:\Windows\System\lSbbCuP.exe
  2⤵
  PID:3516
- C:\Windows\System\RJKysnq.exe
  C:\Windows\System\RJKysnq.exe
  2⤵
  PID:3532
- C:\Windows\System\oetieth.exe
  C:\Windows\System\oetieth.exe
  2⤵
  PID:3552
- C:\Windows\System\oseZfgL.exe
  C:\Windows\System\oseZfgL.exe
  2⤵
  PID:3568
- C:\Windows\System\gUFCWGA.exe
  C:\Windows\System\gUFCWGA.exe
  2⤵
  PID:3584
- C:\Windows\System\QPqWJxm.exe
  C:\Windows\System\QPqWJxm.exe
  2⤵
  PID:3604
- C:\Windows\System\qzYdAEA.exe
  C:\Windows\System\qzYdAEA.exe
  2⤵
  PID:3620
- C:\Windows\System\PLnfECt.exe
  C:\Windows\System\PLnfECt.exe
  2⤵
  PID:3640
- C:\Windows\System\PjTOWsO.exe
  C:\Windows\System\PjTOWsO.exe
  2⤵
  PID:3660
- C:\Windows\System\EHRUvEr.exe
  C:\Windows\System\EHRUvEr.exe
  2⤵
  PID:3756
- C:\Windows\System\DuodTQy.exe
  C:\Windows\System\DuodTQy.exe
  2⤵
  PID:3772
- C:\Windows\System\rfQnDBH.exe
  C:\Windows\System\rfQnDBH.exe
  2⤵
  PID:3788
- C:\Windows\System\ZfLbNAH.exe
  C:\Windows\System\ZfLbNAH.exe
  2⤵
  PID:3804
- C:\Windows\System\NCEngxE.exe
  C:\Windows\System\NCEngxE.exe
  2⤵
  PID:3820
- C:\Windows\System\tMbrdgO.exe
  C:\Windows\System\tMbrdgO.exe
  2⤵
  PID:3836
- C:\Windows\System\XUMtvMl.exe
  C:\Windows\System\XUMtvMl.exe
  2⤵
  PID:3852
- C:\Windows\System\OErlFhW.exe
  C:\Windows\System\OErlFhW.exe
  2⤵
  PID:3868
- C:\Windows\System\UiUKJIO.exe
  C:\Windows\System\UiUKJIO.exe
  2⤵
  PID:3884
- C:\Windows\System\vWyYRXz.exe
  C:\Windows\System\vWyYRXz.exe
  2⤵
  PID:3900
- C:\Windows\System\gAbNtsm.exe
  C:\Windows\System\gAbNtsm.exe
  2⤵
  PID:3916
- C:\Windows\System\PQeBZoI.exe
  C:\Windows\System\PQeBZoI.exe
  2⤵
  PID:3932
- C:\Windows\System\fMvppPr.exe
  C:\Windows\System\fMvppPr.exe
  2⤵
  PID:3960
- C:\Windows\System\sQvlgUv.exe
  C:\Windows\System\sQvlgUv.exe
  2⤵
  PID:3976
- C:\Windows\System\mZsEPVL.exe
  C:\Windows\System\mZsEPVL.exe
  2⤵
  PID:3992
- C:\Windows\System\YFydKZO.exe
  C:\Windows\System\YFydKZO.exe
  2⤵
  PID:4020
- C:\Windows\System\EUkEqPR.exe
  C:\Windows\System\EUkEqPR.exe
  2⤵
  PID:4036
- C:\Windows\System\sumewVV.exe
  C:\Windows\System\sumewVV.exe
  2⤵
  PID:4068
- C:\Windows\System\Pboqtlg.exe
  C:\Windows\System\Pboqtlg.exe
  2⤵
  PID:2516
- C:\Windows\System\jeisyvN.exe
  C:\Windows\System\jeisyvN.exe
  2⤵
  PID:2136
- C:\Windows\System\ULHEOOZ.exe
  C:\Windows\System\ULHEOOZ.exe
  2⤵
  PID:1704
- C:\Windows\System\LvapohU.exe
  C:\Windows\System\LvapohU.exe
  2⤵
  PID:2216
- C:\Windows\System\fLZivqK.exe
  C:\Windows\System\fLZivqK.exe
  2⤵
  PID:3112
- C:\Windows\System\bmShmpl.exe
  C:\Windows\System\bmShmpl.exe
  2⤵
  PID:3212
- C:\Windows\System\IgKAmKB.exe
  C:\Windows\System\IgKAmKB.exe
  2⤵
  PID:3284
- C:\Windows\System\EZcaNnW.exe
  C:\Windows\System\EZcaNnW.exe
  2⤵
  PID:3328
- C:\Windows\System\WGFMSlN.exe
  C:\Windows\System\WGFMSlN.exe
  2⤵
  PID:2464
- C:\Windows\System\rPkuiTO.exe
  C:\Windows\System\rPkuiTO.exe
  2⤵
  PID:2148
- C:\Windows\System\NfhUknz.exe
  C:\Windows\System\NfhUknz.exe
  2⤵
  PID:3468
- C:\Windows\System\qwyGlCw.exe
  C:\Windows\System\qwyGlCw.exe
  2⤵
  PID:3508
- C:\Windows\System\GoOBHsV.exe
  C:\Windows\System\GoOBHsV.exe
  2⤵
  PID:3544
- C:\Windows\System\vNSGuyv.exe
  C:\Windows\System\vNSGuyv.exe
  2⤵
  PID:2684
- C:\Windows\System\moKHFoy.exe
  C:\Windows\System\moKHFoy.exe
  2⤵
  PID:1464
- C:\Windows\System\UQEcusy.exe
  C:\Windows\System\UQEcusy.exe
  2⤵
  PID:1516
- C:\Windows\System\xfXpgQL.exe
  C:\Windows\System\xfXpgQL.exe
  2⤵
  PID:276
- C:\Windows\System\GMIYtKn.exe
  C:\Windows\System\GMIYtKn.exe
  2⤵
  PID:3652
- C:\Windows\System\cOzGAtF.exe
  C:\Windows\System\cOzGAtF.exe
  2⤵
  PID:352
- C:\Windows\System\NdrofrW.exe
  C:\Windows\System\NdrofrW.exe
  2⤵
  PID:1864
- C:\Windows\System\clCQyhJ.exe
  C:\Windows\System\clCQyhJ.exe
  2⤵
  PID:3832
- C:\Windows\System\aAFWSeT.exe
  C:\Windows\System\aAFWSeT.exe
  2⤵
  PID:3924
- C:\Windows\System\IqTGXNY.exe
  C:\Windows\System\IqTGXNY.exe
  2⤵
  PID:2352
- C:\Windows\System\fGIyfcE.exe
  C:\Windows\System\fGIyfcE.exe
  2⤵
  PID:3968
- C:\Windows\System\gNqtOlo.exe
  C:\Windows\System\gNqtOlo.exe
  2⤵
  PID:3064
- C:\Windows\System\XTFRAPJ.exe
  C:\Windows\System\XTFRAPJ.exe
  2⤵
  PID:1420
- C:\Windows\System\eQprcqA.exe
  C:\Windows\System\eQprcqA.exe
  2⤵
  PID:3972
- C:\Windows\System\LEMAueX.exe
  C:\Windows\System\LEMAueX.exe
  2⤵
  PID:4016
- C:\Windows\System\SwibxSv.exe
  C:\Windows\System\SwibxSv.exe
  2⤵
  PID:4056
- C:\Windows\System\GszFpyB.exe
  C:\Windows\System\GszFpyB.exe
  2⤵
  PID:1728
- C:\Windows\System\dNBBtAv.exe
  C:\Windows\System\dNBBtAv.exe
  2⤵
  PID:3096
- C:\Windows\System\TdzfwzO.exe
  C:\Windows\System\TdzfwzO.exe
  2⤵
  PID:3164
- C:\Windows\System\kbYsovN.exe
  C:\Windows\System\kbYsovN.exe
  2⤵
  PID:3228
- C:\Windows\System\pmcbiNF.exe
  C:\Windows\System\pmcbiNF.exe
  2⤵
  PID:3272
- C:\Windows\System\spxVIhy.exe
  C:\Windows\System\spxVIhy.exe
  2⤵
  PID:3312
- C:\Windows\System\eoxYDlf.exe
  C:\Windows\System\eoxYDlf.exe
  2⤵
  PID:3376
- C:\Windows\System\PGVOweg.exe
  C:\Windows\System\PGVOweg.exe
  2⤵
  PID:3452
- C:\Windows\System\KXIxtRb.exe
  C:\Windows\System\KXIxtRb.exe
  2⤵
  PID:3492
- C:\Windows\System\UANFGXY.exe
  C:\Windows\System\UANFGXY.exe
  2⤵
  PID:3564
- C:\Windows\System\kKIxMBK.exe
  C:\Windows\System\kKIxMBK.exe
  2⤵
  PID:3632
- C:\Windows\System\uydJEHY.exe
  C:\Windows\System\uydJEHY.exe
  2⤵
  PID:3676
- C:\Windows\System\FrcnpIE.exe
  C:\Windows\System\FrcnpIE.exe
  2⤵
  PID:3680
- C:\Windows\System\IaeJKbQ.exe
  C:\Windows\System\IaeJKbQ.exe
  2⤵
  PID:3696
- C:\Windows\System\vqPUgfG.exe
  C:\Windows\System\vqPUgfG.exe
  2⤵
  PID:3712
- C:\Windows\System\IdILVwd.exe
  C:\Windows\System\IdILVwd.exe
  2⤵
  PID:3736
- C:\Windows\System\zhdeKCI.exe
  C:\Windows\System\zhdeKCI.exe
  2⤵
  PID:3752
- C:\Windows\System\dkZdBqm.exe
  C:\Windows\System\dkZdBqm.exe
  2⤵
  PID:108
- C:\Windows\System\RDJkVbO.exe
  C:\Windows\System\RDJkVbO.exe
  2⤵
  PID:640
- C:\Windows\System\zhYviJi.exe
  C:\Windows\System\zhYviJi.exe
  2⤵
  PID:3880
- C:\Windows\System\ELYrHgF.exe
  C:\Windows\System\ELYrHgF.exe
  2⤵
  PID:3944
- C:\Windows\System\HwjsFWl.exe
  C:\Windows\System\HwjsFWl.exe
  2⤵
  PID:1000
- C:\Windows\System\qBwFCff.exe
  C:\Windows\System\qBwFCff.exe
  2⤵
  PID:4084
- C:\Windows\System\UDZEhZy.exe
  C:\Windows\System\UDZEhZy.exe
  2⤵
  PID:1592
- C:\Windows\System\zncagBX.exe
  C:\Windows\System\zncagBX.exe
  2⤵
  PID:1104
- C:\Windows\System\LZFMXyO.exe
  C:\Windows\System\LZFMXyO.exe
  2⤵
  PID:3036
- C:\Windows\System\afKRoLJ.exe
  C:\Windows\System\afKRoLJ.exe
  2⤵
  PID:3108
- C:\Windows\System\uaAJYFh.exe
  C:\Windows\System\uaAJYFh.exe
  2⤵
  PID:2268
- C:\Windows\System\tRYoFrG.exe
  C:\Windows\System\tRYoFrG.exe
  2⤵
  PID:2660
- C:\Windows\System\IpJqrhT.exe
  C:\Windows\System\IpJqrhT.exe
  2⤵
  PID:3404
- C:\Windows\System\uXfcAhU.exe
  C:\Windows\System\uXfcAhU.exe
  2⤵
  PID:2356
- C:\Windows\System\PcpNYTF.exe
  C:\Windows\System\PcpNYTF.exe
  2⤵
  PID:2732
- C:\Windows\System\RvKhjmq.exe
  C:\Windows\System\RvKhjmq.exe
  2⤵
  PID:1896
- C:\Windows\System\pThjzKp.exe
  C:\Windows\System\pThjzKp.exe
  2⤵
  PID:1856
- C:\Windows\System\UcHqKre.exe
  C:\Windows\System\UcHqKre.exe
  2⤵
  PID:4004
- C:\Windows\System\ARvnpcm.exe
  C:\Windows\System\ARvnpcm.exe
  2⤵
  PID:3648
- C:\Windows\System\nRSjuBe.exe
  C:\Windows\System\nRSjuBe.exe
  2⤵
  PID:1112
- C:\Windows\System\yLWyTvw.exe
  C:\Windows\System\yLWyTvw.exe
  2⤵
  PID:2728
- C:\Windows\System\XvLttlR.exe
  C:\Windows\System\XvLttlR.exe
  2⤵
  PID:3436
- C:\Windows\System\cgbzzMN.exe
  C:\Windows\System\cgbzzMN.exe
  2⤵
  PID:2616
- C:\Windows\System\AtJzLBY.exe
  C:\Windows\System\AtJzLBY.exe
  2⤵
  PID:3800
- C:\Windows\System\htmUzkN.exe
  C:\Windows\System\htmUzkN.exe
  2⤵
  PID:3000
- C:\Windows\System\pluXBAZ.exe
  C:\Windows\System\pluXBAZ.exe
  2⤵
  PID:4052
- C:\Windows\System\yxhtvuA.exe
  C:\Windows\System\yxhtvuA.exe
  2⤵
  PID:3200
- C:\Windows\System\DZuZhcN.exe
  C:\Windows\System\DZuZhcN.exe
  2⤵
  PID:3420
- C:\Windows\System\VoXiuko.exe
  C:\Windows\System\VoXiuko.exe
  2⤵
  PID:3668
- C:\Windows\System\VViLNAA.exe
  C:\Windows\System\VViLNAA.exe
  2⤵
  PID:3724
- C:\Windows\System\EmmZubu.exe
  C:\Windows\System\EmmZubu.exe
  2⤵
  PID:3816
- C:\Windows\System\qwxcOTT.exe
  C:\Windows\System\qwxcOTT.exe
  2⤵
  PID:3956
- C:\Windows\System\ULlyVWp.exe
  C:\Windows\System\ULlyVWp.exe
  2⤵
  PID:2260
- C:\Windows\System\VgHWhGx.exe
  C:\Windows\System\VgHWhGx.exe
  2⤵
  PID:1732
- C:\Windows\System\mYaQEky.exe
  C:\Windows\System\mYaQEky.exe
  2⤵
  PID:2168
- C:\Windows\System\CUyMuXq.exe
  C:\Windows\System\CUyMuXq.exe
  2⤵
  PID:3432
- C:\Windows\System\vFNbfUb.exe
  C:\Windows\System\vFNbfUb.exe
  2⤵
  PID:4044
- C:\Windows\System\CyqZOKn.exe
  C:\Windows\System\CyqZOKn.exe
  2⤵
  PID:3384
- C:\Windows\System\jfAtVpw.exe
  C:\Windows\System\jfAtVpw.exe
  2⤵
  PID:1880
- C:\Windows\System\rakqOik.exe
  C:\Windows\System\rakqOik.exe
  2⤵
  PID:2720
- C:\Windows\System\dyEmEFx.exe
  C:\Windows\System\dyEmEFx.exe
  2⤵
  PID:324
- C:\Windows\System\srcgkNX.exe
  C:\Windows\System\srcgkNX.exe
  2⤵
  PID:1876
- C:\Windows\System\NYXesMh.exe
  C:\Windows\System\NYXesMh.exe
  2⤵
  PID:2204
- C:\Windows\System\AOljokS.exe
  C:\Windows\System\AOljokS.exe
  2⤵
  PID:4112
- C:\Windows\System\WHmHvDU.exe
  C:\Windows\System\WHmHvDU.exe
  2⤵
  PID:4128
- C:\Windows\System\PcZQeGl.exe
  C:\Windows\System\PcZQeGl.exe
  2⤵
  PID:4144
- C:\Windows\System\MjPokcB.exe
  C:\Windows\System\MjPokcB.exe
  2⤵
  PID:4160
- C:\Windows\System\BvHWyFu.exe
  C:\Windows\System\BvHWyFu.exe
  2⤵
  PID:4176
- C:\Windows\System\OPIbcQb.exe
  C:\Windows\System\OPIbcQb.exe
  2⤵
  PID:4192
- C:\Windows\System\nRChyQu.exe
  C:\Windows\System\nRChyQu.exe
  2⤵
  PID:4208
- C:\Windows\System\fJdASev.exe
  C:\Windows\System\fJdASev.exe
  2⤵
  PID:4224
- C:\Windows\System\LNkLhfA.exe
  C:\Windows\System\LNkLhfA.exe
  2⤵
  PID:4272
- C:\Windows\System\rFkzooJ.exe
  C:\Windows\System\rFkzooJ.exe
  2⤵
  PID:4332
- C:\Windows\System\yItcidQ.exe
  C:\Windows\System\yItcidQ.exe
  2⤵
  PID:4348
- C:\Windows\System\vNdywyN.exe
  C:\Windows\System\vNdywyN.exe
  2⤵
  PID:4364
- C:\Windows\System\IRSrrEu.exe
  C:\Windows\System\IRSrrEu.exe
  2⤵
  PID:4380
- C:\Windows\System\byiIavW.exe
  C:\Windows\System\byiIavW.exe
  2⤵
  PID:4400
- C:\Windows\System\XKWuILl.exe
  C:\Windows\System\XKWuILl.exe
  2⤵
  PID:4416
- C:\Windows\System\xfxhVOd.exe
  C:\Windows\System\xfxhVOd.exe
  2⤵
  PID:4436
- C:\Windows\System\xXAZVcK.exe
  C:\Windows\System\xXAZVcK.exe
  2⤵
  PID:4452
- C:\Windows\System\nKmqAus.exe
  C:\Windows\System\nKmqAus.exe
  2⤵
  PID:4468
- C:\Windows\System\pEjzjzJ.exe
  C:\Windows\System\pEjzjzJ.exe
  2⤵
  PID:4488
- C:\Windows\System\vnMfThH.exe
  C:\Windows\System\vnMfThH.exe
  2⤵
  PID:4588
- C:\Windows\System\wKFKhhm.exe
  C:\Windows\System\wKFKhhm.exe
  2⤵
  PID:4604
- C:\Windows\System\DDqEhJZ.exe
  C:\Windows\System\DDqEhJZ.exe
  2⤵
  PID:4620
- C:\Windows\System\JJWFddQ.exe
  C:\Windows\System\JJWFddQ.exe
  2⤵
  PID:4636
- C:\Windows\System\NqCusBl.exe
  C:\Windows\System\NqCusBl.exe
  2⤵
  PID:4652
- C:\Windows\System\JvhjWOZ.exe
  C:\Windows\System\JvhjWOZ.exe
  2⤵
  PID:4668
- C:\Windows\System\QbVJais.exe
  C:\Windows\System\QbVJais.exe
  2⤵
  PID:4684
- C:\Windows\System\rheBmWY.exe
  C:\Windows\System\rheBmWY.exe
  2⤵
  PID:4700
- C:\Windows\System\LPdodUk.exe
  C:\Windows\System\LPdodUk.exe
  2⤵
  PID:4716
- C:\Windows\System\zEWKNxf.exe
  C:\Windows\System\zEWKNxf.exe
  2⤵
  PID:4732
- C:\Windows\System\fiDuwRK.exe
  C:\Windows\System\fiDuwRK.exe
  2⤵
  PID:4796
- C:\Windows\System\pDhHXRG.exe
  C:\Windows\System\pDhHXRG.exe
  2⤵
  PID:4816
- C:\Windows\System\pnlIBCs.exe
  C:\Windows\System\pnlIBCs.exe
  2⤵
  PID:4832
- C:\Windows\System\ReJwafS.exe
  C:\Windows\System\ReJwafS.exe
  2⤵
  PID:4848
- C:\Windows\System\MXPpGtG.exe
  C:\Windows\System\MXPpGtG.exe
  2⤵
  PID:4864
- C:\Windows\System\cUJjUXg.exe
  C:\Windows\System\cUJjUXg.exe
  2⤵
  PID:4880
- C:\Windows\System\WoWumnU.exe
  C:\Windows\System\WoWumnU.exe
  2⤵
  PID:4896
- C:\Windows\System\uLzACiG.exe
  C:\Windows\System\uLzACiG.exe
  2⤵
  PID:4912
- C:\Windows\System\uILtoOV.exe
  C:\Windows\System\uILtoOV.exe
  2⤵
  PID:4928
- C:\Windows\System\YpMjNak.exe
  C:\Windows\System\YpMjNak.exe
  2⤵
  PID:4944
- C:\Windows\System\jWLPFTT.exe
  C:\Windows\System\jWLPFTT.exe
  2⤵
  PID:4960
- C:\Windows\System\mouzkUx.exe
  C:\Windows\System\mouzkUx.exe
  2⤵
  PID:4976
- C:\Windows\System\GHKRkjf.exe
  C:\Windows\System\GHKRkjf.exe
  2⤵
  PID:4992
- C:\Windows\System\TeqghJL.exe
  C:\Windows\System\TeqghJL.exe
  2⤵
  PID:5008
- C:\Windows\System\YKxpXLl.exe
  C:\Windows\System\YKxpXLl.exe
  2⤵
  PID:5024
- C:\Windows\System\WLaMJow.exe
  C:\Windows\System\WLaMJow.exe
  2⤵
  PID:5040
- C:\Windows\System\zcocOqR.exe
  C:\Windows\System\zcocOqR.exe
  2⤵
  PID:5056
- C:\Windows\System\plksfzU.exe
  C:\Windows\System\plksfzU.exe
  2⤵
  PID:5072
- C:\Windows\System\nbWGrXv.exe
  C:\Windows\System\nbWGrXv.exe
  2⤵
  PID:5088
- C:\Windows\System\rGPSVrF.exe
  C:\Windows\System\rGPSVrF.exe
  2⤵
  PID:5104
- C:\Windows\System\zOBJgKP.exe
  C:\Windows\System\zOBJgKP.exe
  2⤵
  PID:1164
- C:\Windows\System\ZUnDGas.exe
  C:\Windows\System\ZUnDGas.exe
  2⤵
  PID:2208
- C:\Windows\System\ZQiqqhx.exe
  C:\Windows\System\ZQiqqhx.exe
  2⤵
  PID:3240
- C:\Windows\System\ZWelkEG.exe
  C:\Windows\System\ZWelkEG.exe
  2⤵
  PID:2800
- C:\Windows\System\ypdRjdH.exe
  C:\Windows\System\ypdRjdH.exe
  2⤵
  PID:3160
- C:\Windows\System\JTqVVah.exe
  C:\Windows\System\JTqVVah.exe
  2⤵
  PID:3828
- C:\Windows\System\QvzXrst.exe
  C:\Windows\System\QvzXrst.exe
  2⤵
  PID:808
- C:\Windows\System\oJyZAiH.exe
  C:\Windows\System\oJyZAiH.exe
  2⤵
  PID:4136
- C:\Windows\System\hzjFnta.exe
  C:\Windows\System\hzjFnta.exe
  2⤵
  PID:4200
- C:\Windows\System\cMjRrBj.exe
  C:\Windows\System\cMjRrBj.exe
  2⤵
  PID:4244
- C:\Windows\System\iQzvoCa.exe
  C:\Windows\System\iQzvoCa.exe
  2⤵
  PID:3348
- C:\Windows\System\gGuKsXw.exe
  C:\Windows\System\gGuKsXw.exe
  2⤵
  PID:3628
- C:\Windows\System\HFHaYRX.exe
  C:\Windows\System\HFHaYRX.exe
  2⤵
  PID:3704
- C:\Windows\System\UkzCObU.exe
  C:\Windows\System\UkzCObU.exe
  2⤵
  PID:1384
- C:\Windows\System\ShSHoAW.exe
  C:\Windows\System\ShSHoAW.exe
  2⤵
  PID:2180
- C:\Windows\System\UmAFOYt.exe
  C:\Windows\System\UmAFOYt.exe
  2⤵
  PID:3008
- C:\Windows\System\FnJMqix.exe
  C:\Windows\System\FnJMqix.exe
  2⤵
  PID:3528
- C:\Windows\System\cvwcJKT.exe
  C:\Windows\System\cvwcJKT.exe
  2⤵
  PID:3988
- C:\Windows\System\EiXnodR.exe
  C:\Windows\System\EiXnodR.exe
  2⤵
  PID:2164
- C:\Windows\System\sACTszc.exe
  C:\Windows\System\sACTszc.exe
  2⤵
  PID:3580
- C:\Windows\System\rjtVmMT.exe
  C:\Windows\System\rjtVmMT.exe
  2⤵
  PID:4280
- C:\Windows\System\yoNdlTz.exe
  C:\Windows\System\yoNdlTz.exe
  2⤵
  PID:4300
- C:\Windows\System\iBQTqJc.exe
  C:\Windows\System\iBQTqJc.exe
  2⤵
  PID:4412
- C:\Windows\System\DUYbJEP.exe
  C:\Windows\System\DUYbJEP.exe
  2⤵
  PID:4444
- C:\Windows\System\ERbvQdq.exe
  C:\Windows\System\ERbvQdq.exe
  2⤵
  PID:4480
- C:\Windows\System\PRLvXdh.exe
  C:\Windows\System\PRLvXdh.exe
  2⤵
  PID:3060
- C:\Windows\System\GZZDpxV.exe
  C:\Windows\System\GZZDpxV.exe
  2⤵
  PID:4508
- C:\Windows\System\SmanfEV.exe
  C:\Windows\System\SmanfEV.exe
  2⤵
  PID:696
- C:\Windows\System\AqMBZkv.exe
  C:\Windows\System\AqMBZkv.exe
  2⤵
  PID:1260
- C:\Windows\System\UWUETvS.exe
  C:\Windows\System\UWUETvS.exe
  2⤵
  PID:2536
- C:\Windows\System\oGvXchO.exe
  C:\Windows\System\oGvXchO.exe
  2⤵
  PID:4532
- C:\Windows\System\YWWgmyV.exe
  C:\Windows\System\YWWgmyV.exe
  2⤵
  PID:4556
- C:\Windows\System\dFavewS.exe
  C:\Windows\System\dFavewS.exe
  2⤵
  PID:1268
- C:\Windows\System\HMdQQXC.exe
  C:\Windows\System\HMdQQXC.exe
  2⤵
  PID:4584
- C:\Windows\System\lZcgxXT.exe
  C:\Windows\System\lZcgxXT.exe
  2⤵
  PID:4712
- C:\Windows\System\KBDsTEn.exe
  C:\Windows\System\KBDsTEn.exe
  2⤵
  PID:4628
- C:\Windows\System\BkeCkDf.exe
  C:\Windows\System\BkeCkDf.exe
  2⤵
  PID:4692
- C:\Windows\System\daKzpwQ.exe
  C:\Windows\System\daKzpwQ.exe
  2⤵
  PID:4752
- C:\Windows\System\DYBAwJv.exe
  C:\Windows\System\DYBAwJv.exe
  2⤵
  PID:4780
- C:\Windows\System\AUJJiii.exe
  C:\Windows\System\AUJJiii.exe
  2⤵
  PID:4812
- C:\Windows\System\LafcoVQ.exe
  C:\Windows\System\LafcoVQ.exe
  2⤵
  PID:4824
- C:\Windows\System\NbmJZZU.exe
  C:\Windows\System\NbmJZZU.exe
  2⤵
  PID:4920
- C:\Windows\System\suhYYZo.exe
  C:\Windows\System\suhYYZo.exe
  2⤵
  PID:5016
- C:\Windows\System\VAWWcyX.exe
  C:\Windows\System\VAWWcyX.exe
  2⤵
  PID:5068
- C:\Windows\System\Tqfjsrl.exe
  C:\Windows\System\Tqfjsrl.exe
  2⤵
  PID:5100
- C:\Windows\System\uUIOfps.exe
  C:\Windows\System\uUIOfps.exe
  2⤵
  PID:5032
- C:\Windows\System\oBNfJQj.exe
  C:\Windows\System\oBNfJQj.exe
  2⤵
  PID:3360
- C:\Windows\System\RwJOAyQ.exe
  C:\Windows\System\RwJOAyQ.exe
  2⤵
  PID:4172
- C:\Windows\System\WkhJaPW.exe
  C:\Windows\System\WkhJaPW.exe
  2⤵
  PID:4240
- C:\Windows\System\OEUcZtL.exe
  C:\Windows\System\OEUcZtL.exe
  2⤵
  PID:4048
- C:\Windows\System\LjjNMwF.exe
  C:\Windows\System\LjjNMwF.exe
  2⤵
  PID:1508
- C:\Windows\System\cWmLoHh.exe
  C:\Windows\System\cWmLoHh.exe
  2⤵
  PID:2016
- C:\Windows\System\Hgbnutl.exe
  C:\Windows\System\Hgbnutl.exe
  2⤵
  PID:2888
- C:\Windows\System\SrVdYMc.exe
  C:\Windows\System\SrVdYMc.exe
  2⤵
  PID:1520
- C:\Windows\System\KZNuSGp.exe
  C:\Windows\System\KZNuSGp.exe
  2⤵
  PID:3132
- C:\Windows\System\vIKkqyu.exe
  C:\Windows\System\vIKkqyu.exe
  2⤵
  PID:4216
- C:\Windows\System\ZzUBClZ.exe
  C:\Windows\System\ZzUBClZ.exe
  2⤵
  PID:1216
- C:\Windows\System\QeHjkRk.exe
  C:\Windows\System\QeHjkRk.exe
  2⤵
  PID:2592
- C:\Windows\System\ObXEgwo.exe
  C:\Windows\System\ObXEgwo.exe
  2⤵
  PID:4324
- C:\Windows\System\xORUjgm.exe
  C:\Windows\System\xORUjgm.exe
  2⤵
  PID:4376
- C:\Windows\System\BtPjopc.exe
  C:\Windows\System\BtPjopc.exe
  2⤵
  PID:4408
- C:\Windows\System\EZqmlsG.exe
  C:\Windows\System\EZqmlsG.exe
  2⤵
  PID:2808
- C:\Windows\System\UbpWpcm.exe
  C:\Windows\System\UbpWpcm.exe
  2⤵
  PID:4464
- C:\Windows\System\VwPjCYL.exe
  C:\Windows\System\VwPjCYL.exe
  2⤵
  PID:2404
- C:\Windows\System\QQiFiTQ.exe
  C:\Windows\System\QQiFiTQ.exe
  2⤵
  PID:2388
- C:\Windows\System\ChiSzAc.exe
  C:\Windows\System\ChiSzAc.exe
  2⤵
  PID:4516
- C:\Windows\System\wCNkfEd.exe
  C:\Windows\System\wCNkfEd.exe
  2⤵
  PID:2908
- C:\Windows\System\BCsmBEd.exe
  C:\Windows\System\BCsmBEd.exe
  2⤵
  PID:4568
- C:\Windows\System\ZiwbXcm.exe
  C:\Windows\System\ZiwbXcm.exe
  2⤵
  PID:4552
- C:\Windows\System\sbIipdg.exe
  C:\Windows\System\sbIipdg.exe
  2⤵
  PID:4616
- C:\Windows\System\GkNBdYH.exe
  C:\Windows\System\GkNBdYH.exe
  2⤵
  PID:4728
- C:\Windows\System\hpbMKrh.exe
  C:\Windows\System\hpbMKrh.exe
  2⤵
  PID:4760
- C:\Windows\System\NSBNTUX.exe
  C:\Windows\System\NSBNTUX.exe
  2⤵
  PID:4648
- C:\Windows\System\ahiwEIb.exe
  C:\Windows\System\ahiwEIb.exe
  2⤵
  PID:4776
- C:\Windows\System\DaYXtqc.exe
  C:\Windows\System\DaYXtqc.exe
  2⤵
  PID:4856
- C:\Windows\System\SgRdNLI.exe
  C:\Windows\System\SgRdNLI.exe
  2⤵
  PID:4984
- C:\Windows\System\SWkcbWc.exe
  C:\Windows\System\SWkcbWc.exe
  2⤵
  PID:5048
- C:\Windows\System\yxBScIv.exe
  C:\Windows\System\yxBScIv.exe
  2⤵
  PID:2816
- C:\Windows\System\oFyXbzW.exe
  C:\Windows\System\oFyXbzW.exe
  2⤵
  PID:2360
- C:\Windows\System\DlqhMhy.exe
  C:\Windows\System\DlqhMhy.exe
  2⤵
  PID:3196
- C:\Windows\System\TzFqCjI.exe
  C:\Windows\System\TzFqCjI.exe
  2⤵
  PID:4292
- C:\Windows\System\JTgGemN.exe
  C:\Windows\System\JTgGemN.exe
  2⤵
  PID:4428
- C:\Windows\System\XGMStsf.exe
  C:\Windows\System\XGMStsf.exe
  2⤵
  PID:4232
- C:\Windows\System\QPKviCJ.exe
  C:\Windows\System\QPKviCJ.exe
  2⤵
  PID:4032
- C:\Windows\System\dikqSvy.exe
  C:\Windows\System\dikqSvy.exe
  2⤵
  PID:3784
- C:\Windows\System\bkLRBvZ.exe
  C:\Windows\System\bkLRBvZ.exe
  2⤵
  PID:4632
- C:\Windows\System\xPRKtgJ.exe
  C:\Windows\System\xPRKtgJ.exe
  2⤵
  PID:4840
- C:\Windows\System\eIbhdmV.exe
  C:\Windows\System\eIbhdmV.exe
  2⤵
  PID:4908
- C:\Windows\System\BBmfcPY.exe
  C:\Windows\System\BBmfcPY.exe
  2⤵
  PID:2124
- C:\Windows\System\kwixPte.exe
  C:\Windows\System\kwixPte.exe
  2⤵
  PID:5132
- C:\Windows\System\cowIGZK.exe
  C:\Windows\System\cowIGZK.exe
  2⤵
  PID:5148
- C:\Windows\System\RkbzpHo.exe
  C:\Windows\System\RkbzpHo.exe
  2⤵
  PID:5164
- C:\Windows\System\YlMNKkg.exe
  C:\Windows\System\YlMNKkg.exe
  2⤵
  PID:5184
- C:\Windows\System\QCZXMuU.exe
  C:\Windows\System\QCZXMuU.exe
  2⤵
  PID:5200
- C:\Windows\System\EzDNaQm.exe
  C:\Windows\System\EzDNaQm.exe
  2⤵
  PID:5216
- C:\Windows\System\pSxofWO.exe
  C:\Windows\System\pSxofWO.exe
  2⤵
  PID:5232
- C:\Windows\System\lhlapUl.exe
  C:\Windows\System\lhlapUl.exe
  2⤵
  PID:5248
- C:\Windows\System\LSxpQbM.exe
  C:\Windows\System\LSxpQbM.exe
  2⤵
  PID:5268
- C:\Windows\System\GrXbTjg.exe
  C:\Windows\System\GrXbTjg.exe
  2⤵
  PID:5284
- C:\Windows\System\QBKWXaM.exe
  C:\Windows\System\QBKWXaM.exe
  2⤵
  PID:5304
- C:\Windows\System\sPLsSay.exe
  C:\Windows\System\sPLsSay.exe
  2⤵
  PID:5320
- C:\Windows\System\PELiiBF.exe
  C:\Windows\System\PELiiBF.exe
  2⤵
  PID:5336
- C:\Windows\System\eEStaxV.exe
  C:\Windows\System\eEStaxV.exe
  2⤵
  PID:5352
- C:\Windows\System\jECMzkN.exe
  C:\Windows\System\jECMzkN.exe
  2⤵
  PID:5368
- C:\Windows\System\ZJRcHlC.exe
  C:\Windows\System\ZJRcHlC.exe
  2⤵
  PID:5384
- C:\Windows\System\PXYvHFP.exe
  C:\Windows\System\PXYvHFP.exe
  2⤵
  PID:5404
- C:\Windows\System\BeICFYm.exe
  C:\Windows\System\BeICFYm.exe
  2⤵
  PID:5420
- C:\Windows\System\DxYkrzn.exe
  C:\Windows\System\DxYkrzn.exe
  2⤵
  PID:5436
- C:\Windows\System\IwUoCiL.exe
  C:\Windows\System\IwUoCiL.exe
  2⤵
  PID:5452
- C:\Windows\System\hpGTIrf.exe
  C:\Windows\System\hpGTIrf.exe
  2⤵
  PID:5468
- C:\Windows\System\ENiMbVh.exe
  C:\Windows\System\ENiMbVh.exe
  2⤵
  PID:5484
- C:\Windows\System\fiCgGCb.exe
  C:\Windows\System\fiCgGCb.exe
  2⤵
  PID:5500
- C:\Windows\System\jeSBGDM.exe
  C:\Windows\System\jeSBGDM.exe
  2⤵
  PID:5516
- C:\Windows\System\mpxICvv.exe
  C:\Windows\System\mpxICvv.exe
  2⤵
  PID:5536
- C:\Windows\System\kmnhTAL.exe
  C:\Windows\System\kmnhTAL.exe
  2⤵
  PID:5552
- C:\Windows\System\mWrkdMU.exe
  C:\Windows\System\mWrkdMU.exe
  2⤵
  PID:5568
- C:\Windows\System\ViQbwFg.exe
  C:\Windows\System\ViQbwFg.exe
  2⤵
  PID:5584
- C:\Windows\System\GhptAMq.exe
  C:\Windows\System\GhptAMq.exe
  2⤵
  PID:5600
- C:\Windows\System\aGIATRm.exe
  C:\Windows\System\aGIATRm.exe
  2⤵
  PID:5616
- C:\Windows\System\frFmUyI.exe
  C:\Windows\System\frFmUyI.exe
  2⤵
  PID:5636
- C:\Windows\System\bDHWlos.exe
  C:\Windows\System\bDHWlos.exe
  2⤵
  PID:5652
- C:\Windows\System\mwdQFGc.exe
  C:\Windows\System\mwdQFGc.exe
  2⤵
  PID:5668
- C:\Windows\System\XVVweEs.exe
  C:\Windows\System\XVVweEs.exe
  2⤵
  PID:5688
- C:\Windows\System\ocpfnHh.exe
  C:\Windows\System\ocpfnHh.exe
  2⤵
  PID:5704
- C:\Windows\System\xwUZBvS.exe
  C:\Windows\System\xwUZBvS.exe
  2⤵
  PID:5736
- C:\Windows\System\RBrWccJ.exe
  C:\Windows\System\RBrWccJ.exe
  2⤵
  PID:5752
- C:\Windows\System\rltemqI.exe
  C:\Windows\System\rltemqI.exe
  2⤵
  PID:5768
- C:\Windows\System\hdriQjn.exe
  C:\Windows\System\hdriQjn.exe
  2⤵
  PID:5784
- C:\Windows\System\bFDeOum.exe
  C:\Windows\System\bFDeOum.exe
  2⤵
  PID:5804
- C:\Windows\System\QsGoemD.exe
  C:\Windows\System\QsGoemD.exe
  2⤵
  PID:5824
- C:\Windows\System\eRkPzWv.exe
  C:\Windows\System\eRkPzWv.exe
  2⤵
  PID:5840
- C:\Windows\System\efkVJNw.exe
  C:\Windows\System\efkVJNw.exe
  2⤵
  PID:5856
- C:\Windows\System\cAXsuyT.exe
  C:\Windows\System\cAXsuyT.exe
  2⤵
  PID:5872
- C:\Windows\System\NPOPGRA.exe
  C:\Windows\System\NPOPGRA.exe
  2⤵
  PID:5888
- C:\Windows\System\hcdGxst.exe
  C:\Windows\System\hcdGxst.exe
  2⤵
  PID:5904
- C:\Windows\System\pZPrRCI.exe
  C:\Windows\System\pZPrRCI.exe
  2⤵
  PID:5920
- C:\Windows\System\INyJMui.exe
  C:\Windows\System\INyJMui.exe
  2⤵
  PID:5936
- C:\Windows\System\JoSWuTG.exe
  C:\Windows\System\JoSWuTG.exe
  2⤵
  PID:5952
- C:\Windows\System\OvKnxQN.exe
  C:\Windows\System\OvKnxQN.exe
  2⤵
  PID:5968
- C:\Windows\System\UBBLFUf.exe
  C:\Windows\System\UBBLFUf.exe
  2⤵
  PID:6052
- C:\Windows\System\NkWuQLk.exe
  C:\Windows\System\NkWuQLk.exe
  2⤵
  PID:6096
- C:\Windows\System\fOzTrPo.exe
  C:\Windows\System\fOzTrPo.exe
  2⤵
  PID:3940
- C:\Windows\System\qSAeJGW.exe
  C:\Windows\System\qSAeJGW.exe
  2⤵
  PID:600
- C:\Windows\System\gtMGmZI.exe
  C:\Windows\System\gtMGmZI.exe
  2⤵
  PID:1676
- C:\Windows\System\rrIqarh.exe
  C:\Windows\System\rrIqarh.exe
  2⤵
  PID:2176
- C:\Windows\System\SmSMiqu.exe
  C:\Windows\System\SmSMiqu.exe
  2⤵
  PID:4952
- C:\Windows\System\VpQyKda.exe
  C:\Windows\System\VpQyKda.exe
  2⤵
  PID:5680
- C:\Windows\System\RRjKOJB.exe
  C:\Windows\System\RRjKOJB.exe
  2⤵
  PID:2368
- C:\Windows\System\cHwSlTN.exe
  C:\Windows\System\cHwSlTN.exe
  2⤵
  PID:1172
- C:\Windows\System\bIRrxCy.exe
  C:\Windows\System\bIRrxCy.exe
  2⤵
  PID:3892
- C:\Windows\System\trvrTbS.exe
  C:\Windows\System\trvrTbS.exe
  2⤵
  PID:4564
- C:\Windows\System\jHuoGzI.exe
  C:\Windows\System\jHuoGzI.exe
  2⤵
  PID:4888
- C:\Windows\System\zdkxyEc.exe
  C:\Windows\System\zdkxyEc.exe
  2⤵
  PID:5000
- C:\Windows\System\OizCRSz.exe
  C:\Windows\System\OizCRSz.exe
  2⤵
  PID:5084
- C:\Windows\System\QssbEQd.exe
  C:\Windows\System\QssbEQd.exe
  2⤵
  PID:3236
- C:\Windows\System\tlCtyrS.exe
  C:\Windows\System\tlCtyrS.exe
  2⤵
  PID:4340
- C:\Windows\System\uRKVGxE.exe
  C:\Windows\System\uRKVGxE.exe
  2⤵
  PID:4892
- C:\Windows\System\KmTztOQ.exe
  C:\Windows\System\KmTztOQ.exe
  2⤵
  PID:5156
- C:\Windows\System\QOQZCgq.exe
  C:\Windows\System\QOQZCgq.exe
  2⤵
  PID:5224
- C:\Windows\System\xKrFtUN.exe
  C:\Windows\System\xKrFtUN.exe
  2⤵
  PID:5392
- C:\Windows\System\MhgFYmi.exe
  C:\Windows\System\MhgFYmi.exe
  2⤵
  PID:5728
- C:\Windows\System\ymKUmHd.exe
  C:\Windows\System\ymKUmHd.exe
  2⤵
  PID:5800
- C:\Windows\System\BaGrPiG.exe
  C:\Windows\System\BaGrPiG.exe
  2⤵
  PID:5932
- C:\Windows\System\vAHfKBR.exe
  C:\Windows\System\vAHfKBR.exe
  2⤵
  PID:5836
- C:\Windows\System\swxtLBD.exe
  C:\Windows\System\swxtLBD.exe
  2⤵
  PID:5792
- C:\Windows\System\nuuKLNk.exe
  C:\Windows\System\nuuKLNk.exe
  2⤵
  PID:5312
- C:\Windows\System\JfpqcOX.exe
  C:\Windows\System\JfpqcOX.exe
  2⤵
  PID:5576
- C:\Windows\System\chBtEBK.exe
  C:\Windows\System\chBtEBK.exe
  2⤵
  PID:5376
- C:\Windows\System\tIulLrl.exe
  C:\Windows\System\tIulLrl.exe
  2⤵
  PID:5380
- C:\Windows\System\KVvhrYr.exe
  C:\Windows\System\KVvhrYr.exe
  2⤵
  PID:5480
- C:\Windows\System\UKUuKNB.exe
  C:\Windows\System\UKUuKNB.exe
  2⤵
  PID:5612
- C:\Windows\System\mYXOYXu.exe
  C:\Windows\System\mYXOYXu.exe
  2⤵
  PID:5364
- C:\Windows\System\aTYPOQG.exe
  C:\Windows\System\aTYPOQG.exe
  2⤵
  PID:5496
- C:\Windows\System\bqQgNzU.exe
  C:\Windows\System\bqQgNzU.exe
  2⤵
  PID:5524
- C:\Windows\System\pQMQYjr.exe
  C:\Windows\System\pQMQYjr.exe
  2⤵
  PID:5292
- C:\Windows\System\XMmktZQ.exe
  C:\Windows\System\XMmktZQ.exe
  2⤵
  PID:5776
- C:\Windows\System\PUbHSWv.exe
  C:\Windows\System\PUbHSWv.exe
  2⤵
  PID:5816
- C:\Windows\System\qRUsVZC.exe
  C:\Windows\System\qRUsVZC.exe
  2⤵
  PID:5460
- C:\Windows\System\zuTqSbb.exe
  C:\Windows\System\zuTqSbb.exe
  2⤵
  PID:5912
- C:\Windows\System\tcJpllq.exe
  C:\Windows\System\tcJpllq.exe
  2⤵
  PID:5648
- C:\Windows\System\smTSYFK.exe
  C:\Windows\System\smTSYFK.exe
  2⤵
  PID:5296
- C:\Windows\System\lLlhkyt.exe
  C:\Windows\System\lLlhkyt.exe
  2⤵
  PID:5988
- C:\Windows\System\PdFxKpq.exe
  C:\Windows\System\PdFxKpq.exe
  2⤵
  PID:5592
- C:\Windows\System\qTTqnfY.exe
  C:\Windows\System\qTTqnfY.exe
  2⤵
  PID:6004
- C:\Windows\System\rPFstih.exe
  C:\Windows\System\rPFstih.exe
  2⤵
  PID:6012
- C:\Windows\System\sBUlESx.exe
  C:\Windows\System\sBUlESx.exe
  2⤵
  PID:6028
- C:\Windows\System\ynGBMRl.exe
  C:\Windows\System\ynGBMRl.exe
  2⤵
  PID:6044
- C:\Windows\System\wQWqNjz.exe
  C:\Windows\System\wQWqNjz.exe
  2⤵
  PID:6104
- C:\Windows\System\EumycSd.exe
  C:\Windows\System\EumycSd.exe
  2⤵
  PID:6080
- C:\Windows\System\JtcXvtd.exe
  C:\Windows\System\JtcXvtd.exe
  2⤵
  PID:888
- C:\Windows\System\dpfkGfm.exe
  C:\Windows\System\dpfkGfm.exe
  2⤵
  PID:4484
- C:\Windows\System\kbzyGBY.exe
  C:\Windows\System\kbzyGBY.exe
  2⤵
  PID:6128
- C:\Windows\System\qzUMlfK.exe
  C:\Windows\System\qzUMlfK.exe
  2⤵
  PID:4956
- C:\Windows\System\CpQBYky.exe
  C:\Windows\System\CpQBYky.exe
  2⤵
  PID:1040
- C:\Windows\System\PTHrZlu.exe
  C:\Windows\System\PTHrZlu.exe
  2⤵
  PID:5180
- C:\Windows\System\LDmDraG.exe
  C:\Windows\System\LDmDraG.exe
  2⤵
  PID:1432
- C:\Windows\System\AoJdURZ.exe
  C:\Windows\System\AoJdURZ.exe
  2⤵
  PID:5064
- C:\Windows\System\JPcKwUh.exe
  C:\Windows\System\JPcKwUh.exe
  2⤵
  PID:4580
- C:\Windows\System\NCvFQdm.exe
  C:\Windows\System\NCvFQdm.exe
  2⤵
  PID:4156
- C:\Windows\System\LOmMwEa.exe
  C:\Windows\System\LOmMwEa.exe
  2⤵
  PID:4748
- C:\Windows\System\CtzLeRK.exe
  C:\Windows\System\CtzLeRK.exe
  2⤵
  PID:2280
- C:\Windows\System\wJpIkLV.exe
  C:\Windows\System\wJpIkLV.exe
  2⤵
  PID:3876
- C:\Windows\System\lJOdfwv.exe
  C:\Windows\System\lJOdfwv.exe
  2⤵
  PID:344
- C:\Windows\System\vrjEDRS.exe
  C:\Windows\System\vrjEDRS.exe
  2⤵
  PID:5264
- C:\Windows\System\lFaPYnE.exe
  C:\Windows\System\lFaPYnE.exe
  2⤵
  PID:4064
- C:\Windows\System\OXBlycm.exe
  C:\Windows\System\OXBlycm.exe
  2⤵
  PID:1888
- C:\Windows\System\xmTQFya.exe
  C:\Windows\System\xmTQFya.exe
  2⤵
  PID:5864
- C:\Windows\System\cxqgVrc.exe
  C:\Windows\System\cxqgVrc.exe
  2⤵
  PID:5196
- C:\Windows\System\yuqyrMj.exe
  C:\Windows\System\yuqyrMj.exe
  2⤵
  PID:5928
- C:\Windows\System\ECytECL.exe
  C:\Windows\System\ECytECL.exe
  2⤵
  PID:5764
- C:\Windows\System\VZLEkkn.exe
  C:\Windows\System\VZLEkkn.exe
  2⤵
  PID:5476
- C:\Windows\System\eIeBlsK.exe
  C:\Windows\System\eIeBlsK.exe
  2⤵
  PID:5412
- C:\Windows\System\nGqFmLH.exe
  C:\Windows\System\nGqFmLH.exe
  2⤵
  PID:5512
- C:\Windows\System\NwHWyUU.exe
  C:\Windows\System\NwHWyUU.exe
  2⤵
  PID:5624
- C:\Windows\System\OVnkfaO.exe
  C:\Windows\System\OVnkfaO.exe
  2⤵
  PID:5596
- C:\Windows\System\ffgUASh.exe
  C:\Windows\System\ffgUASh.exe
  2⤵
  PID:5396
- C:\Windows\System\lxeQbri.exe
  C:\Windows\System\lxeQbri.exe
  2⤵
  PID:5548
- C:\Windows\System\oOROCGf.exe
  C:\Windows\System\oOROCGf.exe
  2⤵
  PID:5980
- C:\Windows\System\rMGHLMF.exe
  C:\Windows\System\rMGHLMF.exe
  2⤵
  PID:6008
- C:\Windows\System\JQqPWLk.exe
  C:\Windows\System\JQqPWLk.exe
  2⤵
  PID:5448
- C:\Windows\System\wPRvYyc.exe
  C:\Windows\System\wPRvYyc.exe
  2⤵
  PID:6020
- C:\Windows\System\fCDxKdZ.exe
  C:\Windows\System\fCDxKdZ.exe
  2⤵
  PID:6072
- C:\Windows\System\yzbZNYO.exe
  C:\Windows\System\yzbZNYO.exe
  2⤵
  PID:6124
- C:\Windows\System\gOlADxB.exe
  C:\Windows\System\gOlADxB.exe
  2⤵
  PID:5212
- C:\Windows\System\VFXaJCF.exe
  C:\Windows\System\VFXaJCF.exe
  2⤵
  PID:5052
- C:\Windows\System\nQVTHre.exe
  C:\Windows\System\nQVTHre.exe
  2⤵
  PID:5172
- C:\Windows\System\XdIYbLD.exe
  C:\Windows\System\XdIYbLD.exe
  2⤵
  PID:2132
- C:\Windows\System\LZizzNR.exe
  C:\Windows\System\LZizzNR.exe
  2⤵
  PID:4680
- C:\Windows\System\UwGcOUJ.exe
  C:\Windows\System\UwGcOUJ.exe
  2⤵
  PID:5868
- C:\Windows\System\eYuPRjc.exe
  C:\Windows\System\eYuPRjc.exe
  2⤵
  PID:5276
- C:\Windows\System\xIJxciw.exe
  C:\Windows\System\xIJxciw.exe
  2⤵
  PID:5880
- C:\Windows\System\TxVeJzE.exe
  C:\Windows\System\TxVeJzE.exe
  2⤵
  PID:5328
- C:\Windows\System\UjCHvgy.exe
  C:\Windows\System\UjCHvgy.exe
  2⤵
  PID:4968
- C:\Windows\System\iRoGJgq.exe
  C:\Windows\System\iRoGJgq.exe
  2⤵
  PID:5256
- C:\Windows\System\lGSaMEy.exe
  C:\Windows\System\lGSaMEy.exe
  2⤵
  PID:5124
- C:\Windows\System\FqAWPwZ.exe
  C:\Windows\System\FqAWPwZ.exe
  2⤵
  PID:5508
- C:\Windows\System\kpYRdnw.exe
  C:\Windows\System\kpYRdnw.exe
  2⤵
  PID:5884
- C:\Windows\System\QUuLnZL.exe
  C:\Windows\System\QUuLnZL.exe
  2⤵
  PID:5428
- C:\Windows\System\mFlYcQU.exe
  C:\Windows\System\mFlYcQU.exe
  2⤵
  PID:6092
- C:\Windows\System\KeREwCn.exe
  C:\Windows\System\KeREwCn.exe
  2⤵
  PID:4496
- C:\Windows\System\tmHqEOg.exe
  C:\Windows\System\tmHqEOg.exe
  2⤵
  PID:6156
- C:\Windows\System\CSQenYw.exe
  C:\Windows\System\CSQenYw.exe
  2⤵
  PID:6172
- C:\Windows\System\AuawaDF.exe
  C:\Windows\System\AuawaDF.exe
  2⤵
  PID:6188
- C:\Windows\System\hZBVneo.exe
  C:\Windows\System\hZBVneo.exe
  2⤵
  PID:6204
- C:\Windows\System\QrQFDlU.exe
  C:\Windows\System\QrQFDlU.exe
  2⤵
  PID:6220
- C:\Windows\System\zFEWZLu.exe
  C:\Windows\System\zFEWZLu.exe
  2⤵
  PID:6236
- C:\Windows\System\UGIlMkO.exe
  C:\Windows\System\UGIlMkO.exe
  2⤵
  PID:6256
- C:\Windows\System\bLWOnvq.exe
  C:\Windows\System\bLWOnvq.exe
  2⤵
  PID:6272
- C:\Windows\System\efDYFCj.exe
  C:\Windows\System\efDYFCj.exe
  2⤵
  PID:6288
- C:\Windows\System\fkxJbHc.exe
  C:\Windows\System\fkxJbHc.exe
  2⤵
  PID:6304
- C:\Windows\System\htusfdh.exe
  C:\Windows\System\htusfdh.exe
  2⤵
  PID:6320
- C:\Windows\System\IqyvOfR.exe
  C:\Windows\System\IqyvOfR.exe
  2⤵
  PID:6336
- C:\Windows\System\ZVOOmJr.exe
  C:\Windows\System\ZVOOmJr.exe
  2⤵
  PID:6352
- C:\Windows\System\flJNPxY.exe
  C:\Windows\System\flJNPxY.exe
  2⤵
  PID:6368
- C:\Windows\System\hDfVIln.exe
  C:\Windows\System\hDfVIln.exe
  2⤵
  PID:6384
- C:\Windows\System\WxLrwgc.exe
  C:\Windows\System\WxLrwgc.exe
  2⤵
  PID:6400
- C:\Windows\System\qxtzqqf.exe
  C:\Windows\System\qxtzqqf.exe
  2⤵
  PID:6416
- C:\Windows\System\psoaAOI.exe
  C:\Windows\System\psoaAOI.exe
  2⤵
  PID:6432
- C:\Windows\System\yOJgnnf.exe
  C:\Windows\System\yOJgnnf.exe
  2⤵
  PID:6448
- C:\Windows\System\ZBVtQIU.exe
  C:\Windows\System\ZBVtQIU.exe
  2⤵
  PID:6464
- C:\Windows\System\pzQcNJO.exe
  C:\Windows\System\pzQcNJO.exe
  2⤵
  PID:6480
- C:\Windows\System\LHpaOhg.exe
  C:\Windows\System\LHpaOhg.exe
  2⤵
  PID:6496
- C:\Windows\System\RdyENVf.exe
  C:\Windows\System\RdyENVf.exe
  2⤵
  PID:6512
- C:\Windows\System\EXxOUfR.exe
  C:\Windows\System\EXxOUfR.exe
  2⤵
  PID:6528
- C:\Windows\System\zQgCkXU.exe
  C:\Windows\System\zQgCkXU.exe
  2⤵
  PID:6544
- C:\Windows\System\otIEgOs.exe
  C:\Windows\System\otIEgOs.exe
  2⤵
  PID:6560
- C:\Windows\System\pvbItXO.exe
  C:\Windows\System\pvbItXO.exe
  2⤵
  PID:6576
- C:\Windows\System\rkzUoCt.exe
  C:\Windows\System\rkzUoCt.exe
  2⤵
  PID:6592
- C:\Windows\System\qAPTeAI.exe
  C:\Windows\System\qAPTeAI.exe
  2⤵
  PID:6644
- C:\Windows\System\gsLwawR.exe
  C:\Windows\System\gsLwawR.exe
  2⤵
  PID:6664
- C:\Windows\System\EQddAeR.exe
  C:\Windows\System\EQddAeR.exe
  2⤵
  PID:6684
- C:\Windows\System\GtsYBrR.exe
  C:\Windows\System\GtsYBrR.exe
  2⤵
  PID:6700
- C:\Windows\System\LzRsZMv.exe
  C:\Windows\System\LzRsZMv.exe
  2⤵
  PID:6716
- C:\Windows\System\zhzuJib.exe
  C:\Windows\System\zhzuJib.exe
  2⤵
  PID:6732
- C:\Windows\System\QgXDCGi.exe
  C:\Windows\System\QgXDCGi.exe
  2⤵
  PID:6748
- C:\Windows\System\cGrWmfd.exe
  C:\Windows\System\cGrWmfd.exe
  2⤵
  PID:6764
- C:\Windows\System\zHBPODd.exe
  C:\Windows\System\zHBPODd.exe
  2⤵
  PID:6780
- C:\Windows\System\mggOfbv.exe
  C:\Windows\System\mggOfbv.exe
  2⤵
  PID:6804
- C:\Windows\System\zlhsKmy.exe
  C:\Windows\System\zlhsKmy.exe
  2⤵
  PID:6820
- C:\Windows\System\OfvhCzb.exe
  C:\Windows\System\OfvhCzb.exe
  2⤵
  PID:6844
- C:\Windows\System\VRnIWMB.exe
  C:\Windows\System\VRnIWMB.exe
  2⤵
  PID:6860
- C:\Windows\System\EzddaXu.exe
  C:\Windows\System\EzddaXu.exe
  2⤵
  PID:6876
- C:\Windows\System\IYpUGrT.exe
  C:\Windows\System\IYpUGrT.exe
  2⤵
  PID:6892
- C:\Windows\System\WlgkdPC.exe
  C:\Windows\System\WlgkdPC.exe
  2⤵
  PID:6908
- C:\Windows\System\LEmFCrM.exe
  C:\Windows\System\LEmFCrM.exe
  2⤵
  PID:6924
- C:\Windows\System\PasrAuA.exe
  C:\Windows\System\PasrAuA.exe
  2⤵
  PID:6940
- C:\Windows\System\LCoUSrV.exe
  C:\Windows\System\LCoUSrV.exe
  2⤵
  PID:6956
- C:\Windows\System\piWLCzv.exe
  C:\Windows\System\piWLCzv.exe
  2⤵
  PID:6972
- C:\Windows\System\pZFsVAF.exe
  C:\Windows\System\pZFsVAF.exe
  2⤵
  PID:6988
- C:\Windows\System\QNeNLwW.exe
  C:\Windows\System\QNeNLwW.exe
  2⤵
  PID:7004
- C:\Windows\System\UvKqfKd.exe
  C:\Windows\System\UvKqfKd.exe
  2⤵
  PID:7020
- C:\Windows\System\bsuuUYo.exe
  C:\Windows\System\bsuuUYo.exe
  2⤵
  PID:7036
- C:\Windows\System\RVQLsvi.exe
  C:\Windows\System\RVQLsvi.exe
  2⤵
  PID:7052
- C:\Windows\System\EiVlHSe.exe
  C:\Windows\System\EiVlHSe.exe
  2⤵
  PID:7068
- C:\Windows\System\lbvQTnt.exe
  C:\Windows\System\lbvQTnt.exe
  2⤵
  PID:7084
- C:\Windows\System\OmUQIQk.exe
  C:\Windows\System\OmUQIQk.exe
  2⤵
  PID:7100
- C:\Windows\System\KrzWrSZ.exe
  C:\Windows\System\KrzWrSZ.exe
  2⤵
  PID:7116
- C:\Windows\System\roymXfI.exe
  C:\Windows\System\roymXfI.exe
  2⤵
  PID:7132
- C:\Windows\System\RuFzutg.exe
  C:\Windows\System\RuFzutg.exe
  2⤵
  PID:7152
- C:\Windows\System\ZVnSVhX.exe
  C:\Windows\System\ZVnSVhX.exe
  2⤵
  PID:5720
- C:\Windows\System\HRHjDWe.exe
  C:\Windows\System\HRHjDWe.exe
  2⤵
  PID:5812
- C:\Windows\System\LdDCNdk.exe
  C:\Windows\System\LdDCNdk.exe
  2⤵
  PID:5080
- C:\Windows\System\MsPPmSB.exe
  C:\Windows\System\MsPPmSB.exe
  2⤵
  PID:6148
- C:\Windows\System\QMtqANz.exe
  C:\Windows\System\QMtqANz.exe
  2⤵
  PID:6212
- C:\Windows\System\eczXaRv.exe
  C:\Windows\System\eczXaRv.exe
  2⤵
  PID:5832
- C:\Windows\System\IimETev.exe
  C:\Windows\System\IimETev.exe
  2⤵
  PID:5176
- C:\Windows\System\NJhYTlJ.exe
  C:\Windows\System\NJhYTlJ.exe
  2⤵
  PID:5580
- C:\Windows\System\VHPoALG.exe
  C:\Windows\System\VHPoALG.exe
  2⤵
  PID:4548
- C:\Windows\System\gwebACq.exe
  C:\Windows\System\gwebACq.exe
  2⤵
  PID:5116
- C:\Windows\System\gzHlHdQ.exe
  C:\Windows\System\gzHlHdQ.exe
  2⤵
  PID:6200
- C:\Windows\System\NmNgYcS.exe
  C:\Windows\System\NmNgYcS.exe
  2⤵
  PID:6300
- C:\Windows\System\XiswcJt.exe
  C:\Windows\System\XiswcJt.exe
  2⤵
  PID:6364
- C:\Windows\System\vUcQGRf.exe
  C:\Windows\System\vUcQGRf.exe
  2⤵
  PID:6428
- C:\Windows\System\HtYbcrY.exe
  C:\Windows\System\HtYbcrY.exe
  2⤵
  PID:6492
- C:\Windows\System\JLjELHF.exe
  C:\Windows\System\JLjELHF.exe
  2⤵
  PID:6552
- C:\Windows\System\JGvYSzm.exe
  C:\Windows\System\JGvYSzm.exe
  2⤵
  PID:6280
- C:\Windows\System\KHMZHAo.exe
  C:\Windows\System\KHMZHAo.exe
  2⤵
  PID:6344
- C:\Windows\System\QGVMPrP.exe
  C:\Windows\System\QGVMPrP.exe
  2⤵
  PID:6412
- C:\Windows\System\JEAWdLk.exe
  C:\Windows\System\JEAWdLk.exe
  2⤵
  PID:6476
- C:\Windows\System\LDmlcyk.exe
  C:\Windows\System\LDmlcyk.exe
  2⤵
  PID:6588
- C:\Windows\System\moZUrHq.exe
  C:\Windows\System\moZUrHq.exe
  2⤵
  PID:6252
- C:\Windows\System\caNVbJH.exe
  C:\Windows\System\caNVbJH.exe
  2⤵
  PID:6616
- C:\Windows\System\oNvPeXW.exe
  C:\Windows\System\oNvPeXW.exe
  2⤵
  PID:6636
- C:\Windows\System\XaKCPta.exe
  C:\Windows\System\XaKCPta.exe
  2⤵
  PID:6660
- C:\Windows\System\yzVqUEH.exe
  C:\Windows\System\yzVqUEH.exe
  2⤵
  PID:6708
- C:\Windows\System\MnaORIl.exe
  C:\Windows\System\MnaORIl.exe
  2⤵
  PID:6696
- C:\Windows\System\ufiPlqw.exe
  C:\Windows\System\ufiPlqw.exe
  2⤵
  PID:6760
- C:\Windows\System\oYMxVZx.exe
  C:\Windows\System\oYMxVZx.exe
  2⤵
  PID:6792
- C:\Windows\System\KDIBLaz.exe
  C:\Windows\System\KDIBLaz.exe
  2⤵
  PID:6816
- C:\Windows\System\JuFMiyW.exe
  C:\Windows\System\JuFMiyW.exe
  2⤵
  PID:6888
- C:\Windows\System\VNbgwLX.exe
  C:\Windows\System\VNbgwLX.exe
  2⤵
  PID:6948
- C:\Windows\System\PmQUfbL.exe
  C:\Windows\System\PmQUfbL.exe
  2⤵
  PID:6932
- C:\Windows\System\DBaqIZw.exe
  C:\Windows\System\DBaqIZw.exe
  2⤵
  PID:6964
- C:\Windows\System\NOgZvdH.exe
  C:\Windows\System\NOgZvdH.exe
  2⤵
  PID:6840
- C:\Windows\System\hUTxRKY.exe
  C:\Windows\System\hUTxRKY.exe
  2⤵
  PID:6868
- C:\Windows\System\TRtoCxQ.exe
  C:\Windows\System\TRtoCxQ.exe
  2⤵
  PID:6936
- C:\Windows\System\wPHjvds.exe
  C:\Windows\System\wPHjvds.exe
  2⤵
  PID:7028
- C:\Windows\System\Hmtxdrb.exe
  C:\Windows\System\Hmtxdrb.exe
  2⤵
  PID:5984
- C:\Windows\System\KsWvxpi.exe
  C:\Windows\System\KsWvxpi.exe
  2⤵
  PID:6996
- C:\Windows\System\vmRyuTx.exe
  C:\Windows\System\vmRyuTx.exe
  2⤵
  PID:5608
- C:\Windows\System\DGGoFoz.exe
  C:\Windows\System\DGGoFoz.exe
  2⤵
  PID:2392
- C:\Windows\System\CsNHNoJ.exe
  C:\Windows\System\CsNHNoJ.exe
  2⤵
  PID:5660
- C:\Windows\System\pcADUqO.exe
  C:\Windows\System\pcADUqO.exe
  2⤵
  PID:7096
- C:\Windows\System\PyYvNKn.exe
  C:\Windows\System\PyYvNKn.exe
  2⤵
  PID:6396
- C:\Windows\System\sSEZpPi.exe
  C:\Windows\System\sSEZpPi.exe
  2⤵
  PID:4804
- C:\Windows\System\APfAoYN.exe
  C:\Windows\System\APfAoYN.exe
  2⤵
  PID:4152
- C:\Windows\System\QoryGQL.exe
  C:\Windows\System\QoryGQL.exe
  2⤵
  PID:6332
- C:\Windows\System\HdocSnf.exe
  C:\Windows\System\HdocSnf.exe
  2⤵
  PID:6540
- C:\Windows\System\GShKlsD.exe
  C:\Windows\System\GShKlsD.exe
  2⤵
  PID:6444
- C:\Windows\System\WjcXPVt.exe
  C:\Windows\System\WjcXPVt.exe
  2⤵
  PID:6624
- C:\Windows\System\SQqaLLE.exe
  C:\Windows\System\SQqaLLE.exe
  2⤵
  PID:6380
- C:\Windows\System\BGfEJUr.exe
  C:\Windows\System\BGfEJUr.exe
  2⤵
  PID:6728
- C:\Windows\System\EdHbfQW.exe
  C:\Windows\System\EdHbfQW.exe
  2⤵
  PID:6916
- C:\Windows\System\eHMOVwW.exe
  C:\Windows\System\eHMOVwW.exe
  2⤵
  PID:6692
- C:\Windows\System\nqgRIfU.exe
  C:\Windows\System\nqgRIfU.exe
  2⤵
  PID:7080
- C:\Windows\System\DWXcens.exe
  C:\Windows\System\DWXcens.exe
  2⤵
  PID:6772
- C:\Windows\System\fRzpgHu.exe
  C:\Windows\System\fRzpgHu.exe
  2⤵
  PID:6584
- C:\Windows\System\gBsRPMu.exe
  C:\Windows\System\gBsRPMu.exe
  2⤵
  PID:6232
- C:\Windows\System\TkXBIDx.exe
  C:\Windows\System\TkXBIDx.exe
  2⤵
  PID:6612
- C:\Windows\System\ijvMLyJ.exe
  C:\Windows\System\ijvMLyJ.exe
  2⤵
  PID:6656
- C:\Windows\System\meHXYTV.exe
  C:\Windows\System\meHXYTV.exe
  2⤵
  PID:6836
- C:\Windows\System\IQyFiPa.exe
  C:\Windows\System\IQyFiPa.exe
  2⤵
  PID:6268
- C:\Windows\System\gmnuFtU.exe
  C:\Windows\System\gmnuFtU.exe
  2⤵
  PID:6248
- C:\Windows\System\WHrpiCV.exe
  C:\Windows\System\WHrpiCV.exe
  2⤵
  PID:6312
- C:\Windows\System\ykyIglz.exe
  C:\Windows\System\ykyIglz.exe
  2⤵
  PID:6800
- C:\Windows\System\hHMzMIm.exe
  C:\Windows\System\hHMzMIm.exe
  2⤵
  PID:6408
- C:\Windows\System\WZWVTsy.exe
  C:\Windows\System\WZWVTsy.exe
  2⤵
  PID:6980
- C:\Windows\System\YuMlRjp.exe
  C:\Windows\System\YuMlRjp.exe
  2⤵
  PID:7128
- C:\Windows\System\tavwIWn.exe
  C:\Windows\System\tavwIWn.exe
  2⤵
  PID:6376
- C:\Windows\System\VoJJSNt.exe
  C:\Windows\System\VoJJSNt.exe
  2⤵
  PID:6488
- C:\Windows\System\kFcUAGe.exe
  C:\Windows\System\kFcUAGe.exe
  2⤵
  PID:6460
- C:\Windows\System\CAemDNb.exe
  C:\Windows\System\CAemDNb.exe
  2⤵
  PID:6832
- C:\Windows\System\JeaTUaU.exe
  C:\Windows\System\JeaTUaU.exe
  2⤵
  PID:7140
- C:\Windows\System\TVOBRJE.exe
  C:\Windows\System\TVOBRJE.exe
  2⤵
  PID:5896
- C:\Windows\System\UjLTLbZ.exe
  C:\Windows\System\UjLTLbZ.exe
  2⤵
  PID:7160
- C:\Windows\System\Vitnpua.exe
  C:\Windows\System\Vitnpua.exe
  2⤵
  PID:6196
- C:\Windows\System\zoJKDxF.exe
  C:\Windows\System\zoJKDxF.exe
  2⤵
  PID:6140
- C:\Windows\System\HUdZXMz.exe
  C:\Windows\System\HUdZXMz.exe
  2⤵
  PID:6348
- C:\Windows\System\hxaAHPA.exe
  C:\Windows\System\hxaAHPA.exe
  2⤵
  PID:5948
- C:\Windows\System\nMhHxzX.exe
  C:\Windows\System\nMhHxzX.exe
  2⤵
  PID:7184
- C:\Windows\System\LrbUarG.exe
  C:\Windows\System\LrbUarG.exe
  2⤵
  PID:7200
- C:\Windows\System\wGwEYnZ.exe
  C:\Windows\System\wGwEYnZ.exe
  2⤵
  PID:7216
- C:\Windows\System\hyvJANp.exe
  C:\Windows\System\hyvJANp.exe
  2⤵
  PID:7236
- C:\Windows\System\uGdgTiS.exe
  C:\Windows\System\uGdgTiS.exe
  2⤵
  PID:7256
- C:\Windows\System\oSIxFqn.exe
  C:\Windows\System\oSIxFqn.exe
  2⤵
  PID:7272
- C:\Windows\System\gxEIJzM.exe
  C:\Windows\System\gxEIJzM.exe
  2⤵
  PID:7288
- C:\Windows\System\UwdHmdL.exe
  C:\Windows\System\UwdHmdL.exe
  2⤵
  PID:7304
- C:\Windows\System\ScVaxmD.exe
  C:\Windows\System\ScVaxmD.exe
  2⤵
  PID:7320
- C:\Windows\System\ACrEZjz.exe
  C:\Windows\System\ACrEZjz.exe
  2⤵
  PID:7336
- C:\Windows\System\QPOAEtY.exe
  C:\Windows\System\QPOAEtY.exe
  2⤵
  PID:7352
- C:\Windows\System\LLZIDfQ.exe
  C:\Windows\System\LLZIDfQ.exe
  2⤵
  PID:7368
- C:\Windows\System\OdjlClE.exe
  C:\Windows\System\OdjlClE.exe
  2⤵
  PID:7388
- C:\Windows\System\fDcSngt.exe
  C:\Windows\System\fDcSngt.exe
  2⤵
  PID:7404
- C:\Windows\System\eWoPXWU.exe
  C:\Windows\System\eWoPXWU.exe
  2⤵
  PID:7420
- C:\Windows\System\vkrFXmy.exe
  C:\Windows\System\vkrFXmy.exe
  2⤵
  PID:7436
- C:\Windows\System\EjDKmsl.exe
  C:\Windows\System\EjDKmsl.exe
  2⤵
  PID:7452
- C:\Windows\System\FhbAvCL.exe
  C:\Windows\System\FhbAvCL.exe
  2⤵
  PID:7468
- C:\Windows\System\kXguIhO.exe
  C:\Windows\System\kXguIhO.exe
  2⤵
  PID:7488
- C:\Windows\System\NewpOWb.exe
  C:\Windows\System\NewpOWb.exe
  2⤵
  PID:7504
- C:\Windows\System\XSJhnxl.exe
  C:\Windows\System\XSJhnxl.exe
  2⤵
  PID:7520
- C:\Windows\System\ubQDWRX.exe
  C:\Windows\System\ubQDWRX.exe
  2⤵
  PID:7536
- C:\Windows\System\nJGDHXH.exe
  C:\Windows\System\nJGDHXH.exe
  2⤵
  PID:7552
- C:\Windows\System\iQMAtXk.exe
  C:\Windows\System\iQMAtXk.exe
  2⤵
  PID:7568
- C:\Windows\System\iTtSpuM.exe
  C:\Windows\System\iTtSpuM.exe
  2⤵
  PID:7588
- C:\Windows\System\QLRknMQ.exe
  C:\Windows\System\QLRknMQ.exe
  2⤵
  PID:7604
- C:\Windows\System\ZFZCcgU.exe
  C:\Windows\System\ZFZCcgU.exe
  2⤵
  PID:7620
- C:\Windows\System\QEdVkdN.exe
  C:\Windows\System\QEdVkdN.exe
  2⤵
  PID:7636
- C:\Windows\System\PmKrIwt.exe
  C:\Windows\System\PmKrIwt.exe
  2⤵
  PID:7656
- C:\Windows\System\NKRjhRp.exe
  C:\Windows\System\NKRjhRp.exe
  2⤵
  PID:7672
- C:\Windows\System\cVCRlEE.exe
  C:\Windows\System\cVCRlEE.exe
  2⤵
  PID:7688
- C:\Windows\System\zVVieLY.exe
  C:\Windows\System\zVVieLY.exe
  2⤵
  PID:7708
- C:\Windows\System\JimoubY.exe
  C:\Windows\System\JimoubY.exe
  2⤵
  PID:7724
- C:\Windows\System\GDpGklG.exe
  C:\Windows\System\GDpGklG.exe
  2⤵
  PID:7748
- C:\Windows\System\ioPPXyL.exe
  C:\Windows\System\ioPPXyL.exe
  2⤵
  PID:7764
- C:\Windows\System\JThbpfa.exe
  C:\Windows\System\JThbpfa.exe
  2⤵
  PID:7784
- C:\Windows\System\jSgymzM.exe
  C:\Windows\System\jSgymzM.exe
  2⤵
  PID:7800
- C:\Windows\System\GmkfxWK.exe
  C:\Windows\System\GmkfxWK.exe
  2⤵
  PID:7816
- C:\Windows\System\MsXiCtq.exe
  C:\Windows\System\MsXiCtq.exe
  2⤵
  PID:7836
- C:\Windows\System\tlqNayZ.exe
  C:\Windows\System\tlqNayZ.exe
  2⤵
  PID:7852
- C:\Windows\System\tRbaQDv.exe
  C:\Windows\System\tRbaQDv.exe
  2⤵
  PID:7872
- C:\Windows\System\JPQSnOi.exe
  C:\Windows\System\JPQSnOi.exe
  2⤵
  PID:7892
- C:\Windows\System\InudSEP.exe
  C:\Windows\System\InudSEP.exe
  2⤵
  PID:7908
- C:\Windows\System\gHEqUEF.exe
  C:\Windows\System\gHEqUEF.exe
  2⤵
  PID:7924
- C:\Windows\System\SoZkWPI.exe
  C:\Windows\System\SoZkWPI.exe
  2⤵
  PID:7944
- C:\Windows\System\dyDEGmH.exe
  C:\Windows\System\dyDEGmH.exe
  2⤵
  PID:7960
- C:\Windows\System\dLYItHs.exe
  C:\Windows\System\dLYItHs.exe
  2⤵
  PID:7976
- C:\Windows\System\ZuYhJSy.exe
  C:\Windows\System\ZuYhJSy.exe
  2⤵
  PID:7992
- C:\Windows\System\DTtrysz.exe
  C:\Windows\System\DTtrysz.exe
  2⤵
  PID:8008
- C:\Windows\System\OgMfLkU.exe
  C:\Windows\System\OgMfLkU.exe
  2⤵
  PID:8024
- C:\Windows\System\mAxxUIW.exe
  C:\Windows\System\mAxxUIW.exe
  2⤵
  PID:8040
- C:\Windows\System\eMrOKqi.exe
  C:\Windows\System\eMrOKqi.exe
  2⤵
  PID:8064
- C:\Windows\System\IcyNHeJ.exe
  C:\Windows\System\IcyNHeJ.exe
  2⤵
  PID:8080
- C:\Windows\System\XRKeQAF.exe
  C:\Windows\System\XRKeQAF.exe
  2⤵
  PID:8096
- C:\Windows\System\IAPVoDu.exe
  C:\Windows\System\IAPVoDu.exe
  2⤵
  PID:8112
- C:\Windows\System\VxWtKsY.exe
  C:\Windows\System\VxWtKsY.exe
  2⤵
  PID:8128
- C:\Windows\System\znrzVys.exe
  C:\Windows\System\znrzVys.exe
  2⤵
  PID:8144
- C:\Windows\System\yiULLqV.exe
  C:\Windows\System\yiULLqV.exe
  2⤵
  PID:8160
- C:\Windows\System\UfQSQcG.exe
  C:\Windows\System\UfQSQcG.exe
  2⤵
  PID:8176
- C:\Windows\System\zfWhMrE.exe
  C:\Windows\System\zfWhMrE.exe
  2⤵
  PID:6316
- C:\Windows\System\qfiHLEw.exe
  C:\Windows\System\qfiHLEw.exe
  2⤵
  PID:6724
- C:\Windows\System\qptNpLg.exe
  C:\Windows\System\qptNpLg.exe
  2⤵
  PID:7228
- C:\Windows\System\MlTuJdy.exe
  C:\Windows\System\MlTuJdy.exe
  2⤵
  PID:7296
- C:\Windows\System\DTOmUNg.exe
  C:\Windows\System\DTOmUNg.exe
  2⤵
  PID:7332
- C:\Windows\System\FtWGePU.exe
  C:\Windows\System\FtWGePU.exe
  2⤵
  PID:7400
- C:\Windows\System\JAwhMCq.exe
  C:\Windows\System\JAwhMCq.exe
  2⤵
  PID:7464
- C:\Windows\System\CPMJuJE.exe
  C:\Windows\System\CPMJuJE.exe
  2⤵
  PID:7284
- C:\Windows\System\HrMUGLp.exe
  C:\Windows\System\HrMUGLp.exe
  2⤵
  PID:7344
- C:\Windows\System\kofYQvO.exe
  C:\Windows\System\kofYQvO.exe
  2⤵
  PID:7212
- C:\Windows\System\pMgAvEF.exe
  C:\Windows\System\pMgAvEF.exe
  2⤵
  PID:7632
- C:\Windows\System\ZTFatmu.exe
  C:\Windows\System\ZTFatmu.exe
  2⤵
  PID:7252
- C:\Windows\System\MDyfmlN.exe
  C:\Windows\System\MDyfmlN.exe
  2⤵
  PID:7700
- C:\Windows\System\yotxSUk.exe
  C:\Windows\System\yotxSUk.exe
  2⤵
  PID:7348
- C:\Windows\System\PPrFibD.exe
  C:\Windows\System\PPrFibD.exe
  2⤵
  PID:7448
- C:\Windows\System\DMCYQUk.exe
  C:\Windows\System\DMCYQUk.exe
  2⤵
  PID:7512
- C:\Windows\System\hdxwJTA.exe
  C:\Windows\System\hdxwJTA.exe
  2⤵
  PID:7612
- C:\Windows\System\zqxCUCk.exe
  C:\Windows\System\zqxCUCk.exe
  2⤵
  PID:7652
- C:\Windows\System\QbDRPUn.exe
  C:\Windows\System\QbDRPUn.exe
  2⤵
  PID:7740
- C:\Windows\System\ELlFvuK.exe
  C:\Windows\System\ELlFvuK.exe
  2⤵
  PID:7772
- C:\Windows\System\gCGjrmr.exe
  C:\Windows\System\gCGjrmr.exe
  2⤵
  PID:7812
- C:\Windows\System\mWgAahz.exe
  C:\Windows\System\mWgAahz.exe
  2⤵
  PID:7916
- C:\Windows\System\XKlNeAC.exe
  C:\Windows\System\XKlNeAC.exe
  2⤵
  PID:7792
- C:\Windows\System\KRVIiiS.exe
  C:\Windows\System\KRVIiiS.exe
  2⤵
  PID:7988
- C:\Windows\System\rCqjsSp.exe
  C:\Windows\System\rCqjsSp.exe
  2⤵
  PID:8016
- C:\Windows\System\KCmcRUs.exe
  C:\Windows\System\KCmcRUs.exe
  2⤵
  PID:8052
- C:\Windows\System\YjBIBLo.exe
  C:\Windows\System\YjBIBLo.exe
  2⤵
  PID:7760
- C:\Windows\System\kmwhYUi.exe
  C:\Windows\System\kmwhYUi.exe
  2⤵
  PID:7888
- C:\Windows\System\lYOKNWH.exe
  C:\Windows\System\lYOKNWH.exe
  2⤵
  PID:8000
- C:\Windows\System\CTDtyun.exe
  C:\Windows\System\CTDtyun.exe
  2⤵
  PID:8076
- C:\Windows\System\ezlkqxt.exe
  C:\Windows\System\ezlkqxt.exe
  2⤵
  PID:8060
- C:\Windows\System\KZlVHSg.exe
  C:\Windows\System\KZlVHSg.exe
  2⤵
  PID:8124
- C:\Windows\System\vbTajRM.exe
  C:\Windows\System\vbTajRM.exe
  2⤵
  PID:8188
- C:\Windows\System\tTbjgLQ.exe
  C:\Windows\System\tTbjgLQ.exe
  2⤵
  PID:7328
- C:\Windows\System\VPabZwN.exe
  C:\Windows\System\VPabZwN.exe
  2⤵
  PID:8140
- C:\Windows\System\hSPCYRb.exe
  C:\Windows\System\hSPCYRb.exe
  2⤵
  PID:7064
- C:\Windows\System\ENWWnZv.exe
  C:\Windows\System\ENWWnZv.exe
  2⤵
  PID:7416
- C:\Windows\System\QNhuIEU.exe
  C:\Windows\System\QNhuIEU.exe
  2⤵
  PID:7952
- C:\Windows\System\GiHtJSB.exe
  C:\Windows\System\GiHtJSB.exe
  2⤵
  PID:7904
- C:\Windows\System\qsmlDVj.exe
  C:\Windows\System\qsmlDVj.exe
  2⤵
  PID:7648
- C:\Windows\System\spbYvHs.exe
  C:\Windows\System\spbYvHs.exe
  2⤵
  PID:7312
- C:\Windows\System\ILowDEm.exe
  C:\Windows\System\ILowDEm.exe
  2⤵
  PID:7644
- C:\Windows\System\GaKUcjb.exe
  C:\Windows\System\GaKUcjb.exe
  2⤵
  PID:7744
- C:\Windows\System\rqdKSGZ.exe
  C:\Windows\System\rqdKSGZ.exe
  2⤵
  PID:7880
- C:\Windows\System\dcnmtjU.exe
  C:\Windows\System\dcnmtjU.exe
  2⤵
  PID:7940
- C:\Windows\System\jqwOAaZ.exe
  C:\Windows\System\jqwOAaZ.exe
  2⤵
  PID:8156
- C:\Windows\System\cPXfZRu.exe
  C:\Windows\System\cPXfZRu.exe
  2⤵
  PID:7560
- C:\Windows\System\pGsrLbi.exe
  C:\Windows\System\pGsrLbi.exe
  2⤵
  PID:8036
- C:\Windows\System\zULKytZ.exe
  C:\Windows\System\zULKytZ.exe
  2⤵
  PID:8172
- C:\Windows\System\oxHGCCZ.exe
  C:\Windows\System\oxHGCCZ.exe
  2⤵
  PID:8108
- C:\Windows\System\rVaPxrq.exe
  C:\Windows\System\rVaPxrq.exe
  2⤵
  PID:7264
- C:\Windows\System\YDjJKzW.exe
  C:\Windows\System\YDjJKzW.exe
  2⤵
  PID:7268
- C:\Windows\System\WPSiFWZ.exe
  C:\Windows\System\WPSiFWZ.exe
  2⤵
  PID:7720
- C:\Windows\System\hdAscNQ.exe
  C:\Windows\System\hdAscNQ.exe
  2⤵
  PID:7500
- C:\Windows\System\DWPCNsM.exe
  C:\Windows\System\DWPCNsM.exe
  2⤵
  PID:7732
- C:\Windows\System\Rihggbn.exe
  C:\Windows\System\Rihggbn.exe
  2⤵
  PID:7180
- C:\Windows\System\lVuSQkq.exe
  C:\Windows\System\lVuSQkq.exe
  2⤵
  PID:7176
- C:\Windows\System\ljkKpHe.exe
  C:\Windows\System\ljkKpHe.exe
  2⤵
  PID:7684
- C:\Windows\System\gHdyruo.exe
  C:\Windows\System\gHdyruo.exe
  2⤵
  PID:7984
- C:\Windows\System\XfRIIGr.exe
  C:\Windows\System\XfRIIGr.exe
  2⤵
  PID:8208
- C:\Windows\System\JCkgZlI.exe
  C:\Windows\System\JCkgZlI.exe
  2⤵
  PID:8224
- C:\Windows\System\FgRzigY.exe
  C:\Windows\System\FgRzigY.exe
  2⤵
  PID:8240
- C:\Windows\System\olLecTK.exe
  C:\Windows\System\olLecTK.exe
  2⤵
  PID:8256
- C:\Windows\System\VymwkpV.exe
  C:\Windows\System\VymwkpV.exe
  2⤵
  PID:8272
- C:\Windows\System\ORjVJLj.exe
  C:\Windows\System\ORjVJLj.exe
  2⤵
  PID:8292
- C:\Windows\System\SzPAJIB.exe
  C:\Windows\System\SzPAJIB.exe
  2⤵
  PID:8308
- C:\Windows\System\vBOlAMV.exe
  C:\Windows\System\vBOlAMV.exe
  2⤵
  PID:8324
- C:\Windows\System\RcPXGGQ.exe
  C:\Windows\System\RcPXGGQ.exe
  2⤵
  PID:8340
- C:\Windows\System\MSplpNm.exe
  C:\Windows\System\MSplpNm.exe
  2⤵
  PID:8356
- C:\Windows\System\svXAlIY.exe
  C:\Windows\System\svXAlIY.exe
  2⤵
  PID:8372
- C:\Windows\System\ooTGwdX.exe
  C:\Windows\System\ooTGwdX.exe
  2⤵
  PID:8388
- C:\Windows\System\LcLLtJp.exe
  C:\Windows\System\LcLLtJp.exe
  2⤵
  PID:8404
- C:\Windows\System\tiqmbht.exe
  C:\Windows\System\tiqmbht.exe
  2⤵
  PID:8420
- C:\Windows\System\ACdKxPk.exe
  C:\Windows\System\ACdKxPk.exe
  2⤵
  PID:8436
- C:\Windows\System\AzmcWvZ.exe
  C:\Windows\System\AzmcWvZ.exe
  2⤵
  PID:8452
- C:\Windows\System\CavqslL.exe
  C:\Windows\System\CavqslL.exe
  2⤵
  PID:8468
- C:\Windows\System\VOXNzTI.exe
  C:\Windows\System\VOXNzTI.exe
  2⤵
  PID:8484
- C:\Windows\System\STvTpSA.exe
  C:\Windows\System\STvTpSA.exe
  2⤵
  PID:8504
- C:\Windows\System\yOQRViz.exe
  C:\Windows\System\yOQRViz.exe
  2⤵
  PID:8520
- C:\Windows\System\PsKQhJe.exe
  C:\Windows\System\PsKQhJe.exe
  2⤵
  PID:8536
- C:\Windows\System\cefoBAE.exe
  C:\Windows\System\cefoBAE.exe
  2⤵
  PID:8552
- C:\Windows\System\WDHoiWB.exe
  C:\Windows\System\WDHoiWB.exe
  2⤵
  PID:8572
- C:\Windows\System\nWSAQqE.exe
  C:\Windows\System\nWSAQqE.exe
  2⤵
  PID:8588
- C:\Windows\System\LzbCWSz.exe
  C:\Windows\System\LzbCWSz.exe
  2⤵
  PID:8608
- C:\Windows\System\rgOKTBJ.exe
  C:\Windows\System\rgOKTBJ.exe
  2⤵
  PID:8624
- C:\Windows\System\APCUyfQ.exe
  C:\Windows\System\APCUyfQ.exe
  2⤵
  PID:8640
- C:\Windows\System\WpJCnhw.exe
  C:\Windows\System\WpJCnhw.exe
  2⤵
  PID:8656
- C:\Windows\System\DLNUJiA.exe
  C:\Windows\System\DLNUJiA.exe
  2⤵
  PID:8672
- C:\Windows\System\FUBZaOq.exe
  C:\Windows\System\FUBZaOq.exe
  2⤵
  PID:8688
- C:\Windows\System\XCqYDgn.exe
  C:\Windows\System\XCqYDgn.exe
  2⤵
  PID:8704
- C:\Windows\System\YEuuBDO.exe
  C:\Windows\System\YEuuBDO.exe
  2⤵
  PID:8720
- C:\Windows\System\xNLtEdF.exe
  C:\Windows\System\xNLtEdF.exe
  2⤵
  PID:8736
- C:\Windows\System\WJENaQk.exe
  C:\Windows\System\WJENaQk.exe
  2⤵
  PID:8756
- C:\Windows\System\KlSzWVF.exe
  C:\Windows\System\KlSzWVF.exe
  2⤵
  PID:8772
- C:\Windows\System\sgLTlJq.exe
  C:\Windows\System\sgLTlJq.exe
  2⤵
  PID:8788
- C:\Windows\System\VKRxnpu.exe
  C:\Windows\System\VKRxnpu.exe
  2⤵
  PID:8808
- C:\Windows\System\PUDyphC.exe
  C:\Windows\System\PUDyphC.exe
  2⤵
  PID:8824
- C:\Windows\System\SnHttpZ.exe
  C:\Windows\System\SnHttpZ.exe
  2⤵
  PID:8840
- C:\Windows\System\LQCHCKq.exe
  C:\Windows\System\LQCHCKq.exe
  2⤵
  PID:8856
- C:\Windows\System\LsumLrl.exe
  C:\Windows\System\LsumLrl.exe
  2⤵
  PID:8872
- C:\Windows\System\EdHgpQI.exe
  C:\Windows\System\EdHgpQI.exe
  2⤵
  PID:8888
- C:\Windows\System\bHRghEY.exe
  C:\Windows\System\bHRghEY.exe
  2⤵
  PID:8904
- C:\Windows\System\fzyQlUj.exe
  C:\Windows\System\fzyQlUj.exe
  2⤵
  PID:8936
- C:\Windows\System\QJhMIWJ.exe
  C:\Windows\System\QJhMIWJ.exe
  2⤵
  PID:8952
- C:\Windows\System\AtazzcO.exe
  C:\Windows\System\AtazzcO.exe
  2⤵
  PID:8968
- C:\Windows\System\AzYIMXT.exe
  C:\Windows\System\AzYIMXT.exe
  2⤵
  PID:8988
- C:\Windows\System\gneXXNa.exe
  C:\Windows\System\gneXXNa.exe
  2⤵
  PID:9004
- C:\Windows\System\iXMwUTQ.exe
  C:\Windows\System\iXMwUTQ.exe
  2⤵
  PID:9024
- C:\Windows\System\EovBQWh.exe
  C:\Windows\System\EovBQWh.exe
  2⤵
  PID:9040
- C:\Windows\System\ZaqKKiQ.exe
  C:\Windows\System\ZaqKKiQ.exe
  2⤵
  PID:9056
- C:\Windows\System\UlTaFRa.exe
  C:\Windows\System\UlTaFRa.exe
  2⤵
  PID:9076
- C:\Windows\System\NYRWoPP.exe
  C:\Windows\System\NYRWoPP.exe
  2⤵
  PID:9092
- C:\Windows\System\ynfBPmp.exe
  C:\Windows\System\ynfBPmp.exe
  2⤵
  PID:9108
- C:\Windows\System\NrMZrfX.exe
  C:\Windows\System\NrMZrfX.exe
  2⤵
  PID:9124
- C:\Windows\System\DBdnMKL.exe
  C:\Windows\System\DBdnMKL.exe
  2⤵
  PID:9140
- C:\Windows\System\CiwGGHr.exe
  C:\Windows\System\CiwGGHr.exe
  2⤵
  PID:9160
- C:\Windows\System\EzmUyMO.exe
  C:\Windows\System\EzmUyMO.exe
  2⤵
  PID:9180
- C:\Windows\System\HdFkIvt.exe
  C:\Windows\System\HdFkIvt.exe
  2⤵
  PID:9196
- C:\Windows\System\wjMclzZ.exe
  C:\Windows\System\wjMclzZ.exe
  2⤵
  PID:7532
- C:\Windows\System\rkYQlsW.exe
  C:\Windows\System\rkYQlsW.exe
  2⤵
  PID:8216
- C:\Windows\System\WwLZFLi.exe
  C:\Windows\System\WwLZFLi.exe
  2⤵
  PID:8280
- C:\Windows\System\KJypTPl.exe
  C:\Windows\System\KJypTPl.exe
  2⤵
  PID:7884
- C:\Windows\System\veQHsxd.exe
  C:\Windows\System\veQHsxd.exe
  2⤵
  PID:8072
- C:\Windows\System\brmGTtM.exe
  C:\Windows\System\brmGTtM.exe
  2⤵
  PID:7576
- C:\Windows\System\sKSoEkm.exe
  C:\Windows\System\sKSoEkm.exe
  2⤵
  PID:7496
- C:\Windows\System\sLdrRWp.exe
  C:\Windows\System\sLdrRWp.exe
  2⤵
  PID:6508
- C:\Windows\System\fJHhMgK.exe
  C:\Windows\System\fJHhMgK.exe
  2⤵
  PID:8236
- C:\Windows\System\IdHngoa.exe
  C:\Windows\System\IdHngoa.exe
  2⤵
  PID:8304
- C:\Windows\System\GZOxjjV.exe
  C:\Windows\System\GZOxjjV.exe
  2⤵
  PID:8320
- C:\Windows\System\NrgaUrS.exe
  C:\Windows\System\NrgaUrS.exe
  2⤵
  PID:8384
- C:\Windows\System\HeFiLCw.exe
  C:\Windows\System\HeFiLCw.exe
  2⤵
  PID:8444
- C:\Windows\System\bJUSiHi.exe
  C:\Windows\System\bJUSiHi.exe
  2⤵
  PID:8396
- C:\Windows\System\HsMlHUN.exe
  C:\Windows\System\HsMlHUN.exe
  2⤵
  PID:8548
- C:\Windows\System\wkrtQsQ.exe
  C:\Windows\System\wkrtQsQ.exe
  2⤵
  PID:8616
- C:\Windows\System\QePyjNz.exe
  C:\Windows\System\QePyjNz.exe
  2⤵
  PID:8680
- C:\Windows\System\KpizUUv.exe
  C:\Windows\System\KpizUUv.exe
  2⤵
  PID:8460
- C:\Windows\System\rLKDHfk.exe
  C:\Windows\System\rLKDHfk.exe
  2⤵
  PID:8600
- C:\Windows\System\LdTozqD.exe
  C:\Windows\System\LdTozqD.exe
  2⤵
  PID:8748
- C:\Windows\System\qBxFSRO.exe
  C:\Windows\System\qBxFSRO.exe
  2⤵
  PID:8632
- C:\Windows\System\AUPeSQE.exe
  C:\Windows\System\AUPeSQE.exe
  2⤵
  PID:8696
- C:\Windows\System\yRIkwkm.exe
  C:\Windows\System\yRIkwkm.exe
  2⤵
  PID:8492
- C:\Windows\System\rcSELHQ.exe
  C:\Windows\System\rcSELHQ.exe
  2⤵
  PID:8500
- C:\Windows\System\qDcHSWi.exe
  C:\Windows\System\qDcHSWi.exe
  2⤵
  PID:8764
- C:\Windows\System\XBVhvIV.exe
  C:\Windows\System\XBVhvIV.exe
  2⤵
  PID:8848
- C:\Windows\System\IEefDyz.exe
  C:\Windows\System\IEefDyz.exe
  2⤵
  PID:8912
- C:\Windows\System\sYgkZFw.exe
  C:\Windows\System\sYgkZFw.exe
  2⤵
  PID:8900
- C:\Windows\System\sqVAhOV.exe
  C:\Windows\System\sqVAhOV.exe
  2⤵
  PID:8864
- C:\Windows\System\iRbijms.exe
  C:\Windows\System\iRbijms.exe
  2⤵
  PID:8960
- C:\Windows\System\xzsPxmp.exe
  C:\Windows\System\xzsPxmp.exe
  2⤵
  PID:9036
- C:\Windows\System\GrGgsEt.exe
  C:\Windows\System\GrGgsEt.exe
  2⤵
  PID:8944
- C:\Windows\System\OfzyzSm.exe
  C:\Windows\System\OfzyzSm.exe
  2⤵
  PID:9084
- C:\Windows\System\WlgdsIg.exe
  C:\Windows\System\WlgdsIg.exe
  2⤵
  PID:8980
- C:\Windows\System\kBiqmOU.exe
  C:\Windows\System\kBiqmOU.exe
  2⤵
  PID:9052
- C:\Windows\System\ufJpyrZ.exe
  C:\Windows\System\ufJpyrZ.exe
  2⤵
  PID:9168
- C:\Windows\System\WZvJGCK.exe
  C:\Windows\System\WZvJGCK.exe
  2⤵
  PID:9208
- C:\Windows\System\zLRROSU.exe
  C:\Windows\System\zLRROSU.exe
  2⤵
  PID:8252
- C:\Windows\System\edptTQb.exe
  C:\Windows\System\edptTQb.exe
  2⤵
  PID:8056
- C:\Windows\System\DSvoVFX.exe
  C:\Windows\System\DSvoVFX.exe
  2⤵
  PID:9188
- C:\Windows\System\bQDEeme.exe
  C:\Windows\System\bQDEeme.exe
  2⤵
  PID:7824
- C:\Windows\System\gbIHjzK.exe
  C:\Windows\System\gbIHjzK.exe
  2⤵
  PID:1504
- C:\Windows\System\IbJOZhE.exe
  C:\Windows\System\IbJOZhE.exe
  2⤵
  PID:8004
- C:\Windows\System\KzUPeYU.exe
  C:\Windows\System\KzUPeYU.exe
  2⤵
  PID:8352
- C:\Windows\System\JdZFAiK.exe
  C:\Windows\System\JdZFAiK.exe
  2⤵
  PID:8332
- C:\Windows\System\hEOArMf.exe
  C:\Windows\System\hEOArMf.exe
  2⤵
  PID:8364
- C:\Windows\System\bGwebZm.exe
  C:\Windows\System\bGwebZm.exe
  2⤵
  PID:8368
- C:\Windows\System\PzIEJZI.exe
  C:\Windows\System\PzIEJZI.exe
  2⤵
  PID:8932
- C:\Windows\System\JyLBDZd.exe
  C:\Windows\System\JyLBDZd.exe
  2⤵
  PID:9308
- C:\Windows\System\laMsdeo.exe
  C:\Windows\System\laMsdeo.exe
  2⤵
  PID:9328
- C:\Windows\System\VHWimor.exe
  C:\Windows\System\VHWimor.exe
  2⤵
  PID:9344
- C:\Windows\System\yIrSCQt.exe
  C:\Windows\System\yIrSCQt.exe
  2⤵
  PID:9360
- C:\Windows\System\lvzqfWy.exe
  C:\Windows\System\lvzqfWy.exe
  2⤵
  PID:9376
- C:\Windows\System\SKdiJkq.exe
  C:\Windows\System\SKdiJkq.exe
  2⤵
  PID:9392
- C:\Windows\System\mjowzQj.exe
  C:\Windows\System\mjowzQj.exe
  2⤵
  PID:9408
- C:\Windows\System\pcvlLWO.exe
  C:\Windows\System\pcvlLWO.exe
  2⤵
  PID:9620
- C:\Windows\System\AJFNUJF.exe
  C:\Windows\System\AJFNUJF.exe
  2⤵
  PID:9648
- C:\Windows\System\gnHWqdx.exe
  C:\Windows\System\gnHWqdx.exe
  2⤵
  PID:9668
- C:\Windows\System\ypWcDXw.exe
  C:\Windows\System\ypWcDXw.exe
  2⤵
  PID:9684
- C:\Windows\System\EgxptCn.exe
  C:\Windows\System\EgxptCn.exe
  2⤵
  PID:9700
- C:\Windows\System\qtbAAja.exe
  C:\Windows\System\qtbAAja.exe
  2⤵
  PID:9716
- C:\Windows\System\iPLyUrL.exe
  C:\Windows\System\iPLyUrL.exe
  2⤵
  PID:9732
- C:\Windows\System\VovvTMN.exe
  C:\Windows\System\VovvTMN.exe
  2⤵
  PID:9748
- C:\Windows\System\aDIsEgq.exe
  C:\Windows\System\aDIsEgq.exe
  2⤵
  PID:9764
- C:\Windows\System\eOylkLU.exe
  C:\Windows\System\eOylkLU.exe
  2⤵
  PID:9784
- C:\Windows\System\bWcWKfv.exe
  C:\Windows\System\bWcWKfv.exe
  2⤵
  PID:9800
- C:\Windows\System\rGhAUpp.exe
  C:\Windows\System\rGhAUpp.exe
  2⤵
  PID:9816
- C:\Windows\System\EQDMrNt.exe
  C:\Windows\System\EQDMrNt.exe
  2⤵
  PID:9864
- C:\Windows\System\JdaUNuQ.exe
  C:\Windows\System\JdaUNuQ.exe
  2⤵
  PID:9884
- C:\Windows\System\vhcLsEs.exe
  C:\Windows\System\vhcLsEs.exe
  2⤵
  PID:9904
- C:\Windows\System\xejNgNe.exe
  C:\Windows\System\xejNgNe.exe
  2⤵
  PID:9920
- C:\Windows\System\YVrNTMA.exe
  C:\Windows\System\YVrNTMA.exe
  2⤵
  PID:9936
- C:\Windows\System\CEuivcO.exe
  C:\Windows\System\CEuivcO.exe
  2⤵
  PID:9952
- C:\Windows\System\FIgvZZt.exe
  C:\Windows\System\FIgvZZt.exe
  2⤵
  PID:9968
- C:\Windows\System\rXfwZrX.exe
  C:\Windows\System\rXfwZrX.exe
  2⤵
  PID:9984
- C:\Windows\System\mgkJvMy.exe
  C:\Windows\System\mgkJvMy.exe
  2⤵
  PID:10000
- C:\Windows\System\BrVwrLE.exe
  C:\Windows\System\BrVwrLE.exe
  2⤵
  PID:10016
- C:\Windows\System\StjBwgA.exe
  C:\Windows\System\StjBwgA.exe
  2⤵
  PID:10036
- C:\Windows\System\RnafCMu.exe
  C:\Windows\System\RnafCMu.exe
  2⤵
  PID:10052
- C:\Windows\System\gnQphFk.exe
  C:\Windows\System\gnQphFk.exe
  2⤵
  PID:10068
- C:\Windows\System\gPBpxpb.exe
  C:\Windows\System\gPBpxpb.exe
  2⤵
  PID:10092
- C:\Windows\System\gyMzbMv.exe
  C:\Windows\System\gyMzbMv.exe
  2⤵
  PID:10112
- C:\Windows\System\mSXfZqv.exe
  C:\Windows\System\mSXfZqv.exe
  2⤵
  PID:10128
- C:\Windows\System\EEMQdeQ.exe
  C:\Windows\System\EEMQdeQ.exe
  2⤵
  PID:10144
- C:\Windows\System\PkjPaFp.exe
  C:\Windows\System\PkjPaFp.exe
  2⤵
  PID:10160
- C:\Windows\System\uwweirs.exe
  C:\Windows\System\uwweirs.exe
  2⤵
  PID:10176
- C:\Windows\System\xNIReGg.exe
  C:\Windows\System\xNIReGg.exe
  2⤵
  PID:10192
- C:\Windows\System\hCnAHNg.exe
  C:\Windows\System\hCnAHNg.exe
  2⤵
  PID:10208
- C:\Windows\System\yywGfqd.exe
  C:\Windows\System\yywGfqd.exe
  2⤵
  PID:10224
- C:\Windows\System\NmAkRSW.exe
  C:\Windows\System\NmAkRSW.exe
  2⤵
  PID:8652
- C:\Windows\System\QtncEnW.exe
  C:\Windows\System\QtncEnW.exe
  2⤵
  PID:8560
- C:\Windows\System\RiBMxtZ.exe
  C:\Windows\System\RiBMxtZ.exe
  2⤵
  PID:8784
- C:\Windows\System\wqzSPVB.exe
  C:\Windows\System\wqzSPVB.exe
  2⤵
  PID:8896
- C:\Windows\System\mpMJjfl.exe
  C:\Windows\System\mpMJjfl.exe
  2⤵
  PID:8996
- C:\Windows\System\eyjYmZe.exe
  C:\Windows\System\eyjYmZe.exe
  2⤵
  PID:9048
- C:\Windows\System\mEwDAup.exe
  C:\Windows\System\mEwDAup.exe
  2⤵
  PID:9176
- C:\Windows\System\OXCclwk.exe
  C:\Windows\System\OXCclwk.exe
  2⤵
  PID:7668
- C:\Windows\System\MzvfMcd.exe
  C:\Windows\System\MzvfMcd.exe
  2⤵
  PID:8480
- C:\Windows\System\jbZKdDp.exe
  C:\Windows\System\jbZKdDp.exe
  2⤵
  PID:8752
- C:\Windows\System\owcPlIo.exe
  C:\Windows\System\owcPlIo.exe
  2⤵
  PID:8496
- C:\Windows\System\DGjJIuT.exe
  C:\Windows\System\DGjJIuT.exe
  2⤵
  PID:8832
- C:\Windows\System\eGoEbTO.exe
  C:\Windows\System\eGoEbTO.exe
  2⤵
  PID:9224
- C:\Windows\System\RaCjSin.exe
  C:\Windows\System\RaCjSin.exe
  2⤵
  PID:9244
- C:\Windows\System\RAJguxF.exe
  C:\Windows\System\RAJguxF.exe
  2⤵
  PID:9260
- C:\Windows\System\nlAVajC.exe
  C:\Windows\System\nlAVajC.exe
  2⤵
  PID:9276
- C:\Windows\System\EHTKEvH.exe
  C:\Windows\System\EHTKEvH.exe
  2⤵
  PID:9296
- C:\Windows\System\xkMtkei.exe
  C:\Windows\System\xkMtkei.exe
  2⤵
  PID:9404
- C:\Windows\System\MwQPkWU.exe
  C:\Windows\System\MwQPkWU.exe
  2⤵
  PID:9228
- C:\Windows\System\cSIIWHz.exe
  C:\Windows\System\cSIIWHz.exe
  2⤵
  PID:7600
- C:\Windows\System\obIufto.exe
  C:\Windows\System\obIufto.exe
  2⤵
  PID:9432
- C:\Windows\System\oTgqmxB.exe
  C:\Windows\System\oTgqmxB.exe
  2⤵
  PID:9416
- C:\Windows\System\YZooLBD.exe
  C:\Windows\System\YZooLBD.exe
  2⤵
  PID:9352
- C:\Windows\System\kcuZwvH.exe
  C:\Windows\System\kcuZwvH.exe
  2⤵
  PID:8300
- C:\Windows\System\VfShnLZ.exe
  C:\Windows\System\VfShnLZ.exe
  2⤵
  PID:7780
- C:\Windows\System\PXBsTNQ.exe
  C:\Windows\System\PXBsTNQ.exe
  2⤵
  PID:7932
- C:\Windows\System\HxikdDg.exe
  C:\Windows\System\HxikdDg.exe
  2⤵
  PID:9580
- C:\Windows\System\hgKzfJk.exe
  C:\Windows\System\hgKzfJk.exe
  2⤵
  PID:9136
- C:\Windows\System\jHzykZw.exe
  C:\Windows\System\jHzykZw.exe
  2⤵
  PID:9068
- C:\Windows\System\avcFgby.exe
  C:\Windows\System\avcFgby.exe
  2⤵
  PID:9448
- C:\Windows\System\NQtufGv.exe
  C:\Windows\System\NQtufGv.exe
  2⤵
  PID:9468
- C:\Windows\System\orRuKhI.exe
  C:\Windows\System\orRuKhI.exe
  2⤵
  PID:9488
- C:\Windows\System\CmnzAys.exe
  C:\Windows\System\CmnzAys.exe
  2⤵
  PID:9504
- C:\Windows\System\yYJNGIa.exe
  C:\Windows\System\yYJNGIa.exe
  2⤵
  PID:9528
- C:\Windows\System\OSKyXkl.exe
  C:\Windows\System\OSKyXkl.exe
  2⤵
  PID:9552
- C:\Windows\System\fhZioDO.exe
  C:\Windows\System\fhZioDO.exe
  2⤵
  PID:9576
- C:\Windows\System\WuvIdUs.exe
  C:\Windows\System\WuvIdUs.exe
  2⤵
  PID:9600
- C:\Windows\System\BFPLCuZ.exe
  C:\Windows\System\BFPLCuZ.exe
  2⤵
  PID:9612
- C:\Windows\System\OcIeWyy.exe
  C:\Windows\System\OcIeWyy.exe
  2⤵
  PID:9640
- C:\Windows\System\hqXGlGY.exe
  C:\Windows\System\hqXGlGY.exe
  2⤵
  PID:9680
- C:\Windows\System\XIDUQEF.exe
  C:\Windows\System\XIDUQEF.exe
  2⤵
  PID:9708
- C:\Windows\System\MdkdasE.exe
  C:\Windows\System\MdkdasE.exe
  2⤵
  PID:9744
- C:\Windows\System\qfMAmcf.exe
  C:\Windows\System\qfMAmcf.exe
  2⤵
  PID:9792
- C:\Windows\System\yQQfjNI.exe
  C:\Windows\System\yQQfjNI.exe
  2⤵
  PID:9796
- C:\Windows\System\wCMcUvA.exe
  C:\Windows\System\wCMcUvA.exe
  2⤵
  PID:9824
- C:\Windows\System\xfQTEcv.exe
  C:\Windows\System\xfQTEcv.exe
  2⤵
  PID:9844
- C:\Windows\System\UUWrzCU.exe
  C:\Windows\System\UUWrzCU.exe
  2⤵
  PID:9860
- C:\Windows\System\SFGmwdu.exe
  C:\Windows\System\SFGmwdu.exe
  2⤵
  PID:9900
- C:\Windows\System\FydomgN.exe
  C:\Windows\System\FydomgN.exe
  2⤵
  PID:9912
- C:\Windows\System\tjlWlUt.exe
  C:\Windows\System\tjlWlUt.exe
  2⤵
  PID:9976
- C:\Windows\System\lEvGIrz.exe
  C:\Windows\System\lEvGIrz.exe
  2⤵
  PID:10044
- C:\Windows\System\yREbMKu.exe
  C:\Windows\System\yREbMKu.exe
  2⤵
  PID:10084
- C:\Windows\System\xmsqMiV.exe
  C:\Windows\System\xmsqMiV.exe
  2⤵
  PID:9960
- C:\Windows\System\VWcNJnA.exe
  C:\Windows\System\VWcNJnA.exe
  2⤵
  PID:9996
- C:\Windows\System\BYjhYGD.exe
  C:\Windows\System\BYjhYGD.exe
  2⤵
  PID:10064
- C:\Windows\System\dNJjREm.exe
  C:\Windows\System\dNJjREm.exe
  2⤵
  PID:10172
- C:\Windows\System\Rrilovd.exe
  C:\Windows\System\Rrilovd.exe
  2⤵
  PID:10236
- C:\Windows\System\SbODNkG.exe
  C:\Windows\System\SbODNkG.exe
  2⤵
  PID:9172
- C:\Windows\System\ljhlUUW.exe
  C:\Windows\System\ljhlUUW.exe
  2⤵
  PID:8432
- C:\Windows\System\aDRGnzW.exe
  C:\Windows\System\aDRGnzW.exe
  2⤵
  PID:8728
- C:\Windows\System\tawUhak.exe
  C:\Windows\System\tawUhak.exe
  2⤵
  PID:8820
- C:\Windows\System\GZrOBjN.exe
  C:\Windows\System\GZrOBjN.exe
  2⤵
  PID:8924
- C:\Windows\System\XDyEbbT.exe
  C:\Windows\System\XDyEbbT.exe
  2⤵
  PID:9544
- C:\Windows\System\vAXvtuQ.exe
  C:\Windows\System\vAXvtuQ.exe
  2⤵
  PID:10188
- C:\Windows\System\ezPLTCk.exe
  C:\Windows\System\ezPLTCk.exe
  2⤵
  PID:9424
- C:\Windows\System\APhxgkQ.exe
  C:\Windows\System\APhxgkQ.exe
  2⤵
  PID:9152
- C:\Windows\System\EMtORfT.exe
  C:\Windows\System\EMtORfT.exe
  2⤵
  PID:7936
- C:\Windows\System\fjRcGZC.exe
  C:\Windows\System\fjRcGZC.exe
  2⤵
  PID:9088
- C:\Windows\System\mjfrBrd.exe
  C:\Windows\System\mjfrBrd.exe
  2⤵
  PID:9464
- C:\Windows\System\tFoLdOF.exe
  C:\Windows\System\tFoLdOF.exe
  2⤵
  PID:9540
- C:\Windows\System\mbLNLkF.exe
  C:\Windows\System\mbLNLkF.exe
  2⤵
  PID:9596
- C:\Windows\System\DNPCKqR.exe
  C:\Windows\System\DNPCKqR.exe
  2⤵
  PID:9728
- C:\Windows\System\MZKCMCB.exe
  C:\Windows\System\MZKCMCB.exe
  2⤵
  PID:9876
- C:\Windows\System\vIipWjm.exe
  C:\Windows\System\vIipWjm.exe
  2⤵
  PID:9932
- C:\Windows\System\xBjqSjZ.exe
  C:\Windows\System\xBjqSjZ.exe
  2⤵
  PID:9608
- C:\Windows\System\DLeHqkv.exe
  C:\Windows\System\DLeHqkv.exe
  2⤵
  PID:9740
- C:\Windows\System\NQgKmsQ.exe
  C:\Windows\System\NQgKmsQ.exe
  2⤵
  PID:10204
- C:\Windows\System\CafBEeh.exe
  C:\Windows\System\CafBEeh.exe
  2⤵
  PID:9516
- C:\Windows\System\nkJvyBC.exe
  C:\Windows\System\nkJvyBC.exe
  2⤵
  PID:9896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BFJvfWA.exe

Filesize
1.6MB

MD5
9e3e5ae15882b2ca6b7c364a883a9c72

SHA1
6826cfdec480b37d9b4fc5f779b2830176222ebf

SHA256
826371b1fbc9b36dcb92c3a8eaaf046e9b187a8fc79c825f1b384fabc75bf728

SHA512
2b146386bac44df79fdb9b4912984675af5be101f8163ead0d9ee2667d93fcf69c25edabc4a90b5977d83d673a19200e9d38027018a46243fc71c54520bd803f

Download Submit
C:\Windows\system\EHPrVLs.exe

Filesize
1.7MB

MD5
5324a7f94cb21c045523277bef753b3b

SHA1
71b03f191dc8eaa4a878b2150b73f4d0edb2d9b8

SHA256
d8b9677da3251fd0e8aa2b41f8bb32ccc4aebe0117c631d4874e55d37ed7eb65

SHA512
ceff26cebb1e9de1ba7e279e61e5d9332297da83262f78bfe724635133c2a1523f1b9dae17f627e4eed84021f484a20968020fb19347b9b7bbb47d72d7d3dba2

Download Submit
C:\Windows\system\FXQwGoo.exe

Filesize
1.7MB

MD5
8bb2f8d90d4735007f8d9b93caa1be50

SHA1
4079cf0c6115e09a19d089dec7c3c379ed6e1fe6

SHA256
54a5230fd6c9b3ea29d1bd73ae13da9c44d4898c83c7e3c06334ec94c3e8f6af

SHA512
865e7ca4993a95df877d1914d5d090deac83eb821ab210e143d64758f215ff69ba899fbe1f880e6829b1209473d5cef7877f328a2d93afd60ee4c24f97696087

Download Submit
C:\Windows\system\FePkwRJ.exe

Filesize
1.6MB

MD5
88fcf4711d11abb58ba4e3d3fdf67ae5

SHA1
1810100236db36e82c32214b45f7abd5d5fe4318

SHA256
7edde05e06f4513e24c1c5583b9a1572f4de79910bcd3b7aaad2febd083de6c1

SHA512
14fbdea15a43c2aba8fd0ad54ce9fbf837e162c75637db89bedc24b3e5b60b524be22b5974a71f0d8bd82fc169742a21057eea7051e4ec9d19f00681886c817b

Download Submit
C:\Windows\system\HFkbtNm.exe

Filesize
1.6MB

MD5
15801be2a9e8632283dd6a8908c5671d

SHA1
e651257cf417821a3cf69cc8e99a1a09960428d5

SHA256
13f17e15b95474a41f16ff11b55f38a75524091832b97dcf89421bcd8f1f9e67

SHA512
8b89ea2be04d3d5a25f3b9ae0feb64bfa4807cd0c8d180ca1399f1ff9d09c048fe8f821aa014eed912075b82930d878fb18fb9c75061e274db67c081794c1583

Download Submit
C:\Windows\system\Hxwdxer.exe

Filesize
1.7MB

MD5
85e1634c20290dfcf8234c91126ecd8c

SHA1
eda50ae381e965772b7b3d8df7e7435d9131593e

SHA256
d23694e16af44b327a66970dfec1683b6b4563bd39e0077ddf9c86a53a6635a2

SHA512
c21c653c4162f9e1bdf326b93dd23419cf711f61b803b815944ba4cc6cea859702b0d5ff04baa2130e98a048be0da71d45781925d978fa70ac7d8f19f4b4a84a

Download Submit
C:\Windows\system\JAInnot.exe

Filesize
1.7MB

MD5
6d341d1234558ddccda3769e36f1ae04

SHA1
69d82bf6da09dd592216b007e96f4d92a81fb3ac

SHA256
d6349ed7bbe3dbfd0f27bb6007df87709cba60ce12585e03365c14deb2d1cde7

SHA512
b2a15359f7bb8688911a87cd97ffd6edf976b6911bc5025958c0a399038aab9d258f3412e692bfc4a6241f27760e4f1698b08f47e53c0acbb8e16e676b2814d8

Download Submit
C:\Windows\system\KAsNLNb.exe

Filesize
1.7MB

MD5
f86a0638305f357170234146f5c2ff0f

SHA1
af5744caa460eb81b7848066172b1bb3da98f76f

SHA256
7c40c05567018f25abd02fc74ee823a20c84dbb3ea2f9baf16f26ba6629b74e5

SHA512
c97b5a416f072ba90a70a26424dea74b60a273fe7c3ec349a1e40025d5b0a7410fb811d07bb1da3ddee6d070b3bdd7aadd861f32ec91914309bde7f03ad55ae6

Download Submit
C:\Windows\system\MAAiAIq.exe

Filesize
1.7MB

MD5
a204852579bd9fb7faa28330aec8c7dc

SHA1
6ef6fb03ffe6af58f1e33f0ee2b1d8fe49293f8f

SHA256
2a8fd5330d0a06038e8e482b37bd4e4ce67f1d35382ec1a98112c9c0ea7f28a5

SHA512
327c8e311f4aa79c1b10c8b32265d1d0abb58d17094ddb5034e0b2e9410ef6eac76938c631ef63153d41607fecf59eb3925d89482cf1f55a2056fc08d99e33e6

Download Submit
C:\Windows\system\Ncrgtwu.exe

Filesize
1.6MB

MD5
b075ae7396c1769acb8ea03c4d58906c

SHA1
446f4bf05a3fd81f134a4550d6ff28443fff22ee

SHA256
41876a189831cba6a9d187cb21416970346a18ef6a07f167c98862a8ad95e216

SHA512
b44d31cf32e93e4566c9e89b523f424ce5023fff679c7b1365cada054b4b3bc3b5f5fe8e0ca4367bbf59ff12c72251ff46dd8b120f29ca05fcf4eab3e45cdb5e

Download Submit
C:\Windows\system\UQHqPTH.exe

Filesize
1.6MB

MD5
3f63e2f9137331aa76f066e134ccdf48

SHA1
423e7407ed569900dfd52c5a9dfd5d0c0062c241

SHA256
c4831eb4b61590e08441eb31485d205b56ca299acb1fb3df71437b3d6125b5d2

SHA512
15caf2ef4c63e3c9554f9411d346d4d8beebf53b9eade42a4fcc02f3e7baac341479e9f464ea126d48528af15e9d4933370d6831a3241c84fdf3bdb79cb9882f

Download Submit
C:\Windows\system\YJcplMh.exe

Filesize
1.7MB

MD5
7938a00ea7a3be323f5de7a94208f49e

SHA1
d9f90cf1829473ba554fa286cafb8fe8368a981e

SHA256
cbbcc971b24a9c5ddd08b3ceec9cd475f728fa2b05093fb5e77203806c291a89

SHA512
6e9106bdb60ad47e83529c4c5c505ecd87c3437ee93019a9050a506c9c7425c862ac9df863794d3ec37e874aaab26b990a8bfd9a13cba075abf8382e2babe090

Download Submit
C:\Windows\system\ZALoBiK.exe

Filesize
1.7MB

MD5
6ca8cf2f2febb1d5dfe312f94879a646

SHA1
3776e7d3d1ca30ec41d6e1bb4055cbf625063ad2

SHA256
04a424ebc0184df1d93cebacece4045b49761263d9860384ecaa4dd93f6f7f31

SHA512
53f55fb399af5c5ca403cdca22d23335d5a1ad4e17af7ccf6b1cf030c57bc8d97446cfe3e3d08ad69d92a776fb376b7a913f084b60bb7b13e29f7dc65e19f21e

Download Submit
C:\Windows\system\ZRONUTz.exe

Filesize
1.7MB

MD5
02e89ae22b9c78ea77a5bfdcb8ce682b

SHA1
a6640a224a167464a507810324a0198a56c4638b

SHA256
a0923bbc0868fffeaa8eee7c336508d6dc04ed337af296c165bc944636d732bd

SHA512
cd8f2ee6084341f34d17b32f363b4a1fe019dd3b810336a748d28b8dd022a5baab5d11705120c79c8ba4596d6f8672e7209d350df5750daae0018f20271ac5ea

Download Submit
C:\Windows\system\dPxEJFJ.exe

Filesize
1.6MB

MD5
5cc38828467e5280a5f69c0c1a937d3e

SHA1
fb74d86f035b82675bdeb0f1b685b921786bc2ee

SHA256
62ef9c96c8adbb4c5515ba5d1beb79f8c630e009bebce10860720053769b3ea3

SHA512
138d1d733aa2f339e1fc510c13949e40388e3f47772a65fd852899216448d3a692b652fc4d6eacac02ec6b4b738caa5e785de1fa178a6c07c2c5b6509d67b8c7

Download Submit
C:\Windows\system\eCefXVZ.exe

Filesize
1.7MB

MD5
83f6f859054bf06a4be44888ebd5bc8d

SHA1
b918da4f8e412b0a7e8947854c9843c5b4137d6f

SHA256
a808cc6f0484f7bfa7fea0f80fdb95a51fe22510723e038cbc7caf541d52d7a7

SHA512
00116d68b9ee4dd5fd3353a15f0d91bc24f600cd2e2c95571201d0f0641b86a7e6ef3248261cdb53b92ac1812437f591c7ea552a083ebc86628c7376d5291999

Download Submit
C:\Windows\system\hjkiJDp.exe

Filesize
1.6MB

MD5
44786b0d5b2a873098d66e4943d2251c

SHA1
d56b92c1c72343c898532ccd737abea2ecb7db86

SHA256
ec672cfcf85a4e79069971bfd5c2c25e7bca2cb57c2b667d2acd556a0d12c441

SHA512
a2f2470e7e7b26c2d9a5aacf4dc6d5c951b9ac8020b241dac2fa587f5bc6606e92bb10e043545859aec72435bd2d197fce209015709b4097083b0cdacedad2ba

Download Submit
C:\Windows\system\iVAdOJH.exe

Filesize
8B

MD5
b4264996759d988d82730e6958cf8074

SHA1
7bbc1f74a3ce00994d790da4622d87f15f45b523

SHA256
8ec7039187958fcd27e56e585c4d65242972777fffc8821de830bc1ff1727bca

SHA512
90e2f3e49d27ab4d11cbf031af514cf6fc3a8851362bc0086d9e25b2d97c3341159ec901fb19a665474ceb995371e4f69eda62c3d14f844ace445c61339d139c

Download Submit
C:\Windows\system\jzkIGHz.exe

Filesize
1.6MB

MD5
0222f8f6db14a59764e78e9b51ac8e64

SHA1
8d6e4702a1a2417d8d347ec57491dce85bf0044b

SHA256
569a41902944bc8724fd6601bc9dfa503f4265142cd4c0611b312cf3bfd13e82

SHA512
350a115ec75005aa526987602c84bdd1b9760aa9c22c7015fb7f23087b4d4961285d64f7ab400d8e8ab3fdd789c5fe58b661c3b195bb1dfe662edf9b0a909168

Download Submit
C:\Windows\system\ltxWrGu.exe

Filesize
1.7MB

MD5
c98254aac5527ed4f8bfec4d403a23bb

SHA1
06a62b3f1910c5ed90bb6d7233fc1869a89019f2

SHA256
9c63b88c2f80df2ed8825ec89ee2d6956a593922d6de35a241dbfa2d100ab49b

SHA512
7e7ec3612b5659e7384f4de91c9656ab06faa4910a175bc3a4fca1dc5c1f91f75fb88f45076ddd1ffd0c107be06191b7c923f45e7397a3e436ef0bb818f1f722

Download Submit
C:\Windows\system\opzytbl.exe

Filesize
1.6MB

MD5
23af5f266612c915c9b9ff720dd04007

SHA1
631acf2a493634ce8777597a6f76b026a9077d4d

SHA256
24321dee8fe606f8bf593e98154209d31693e328cc8c8239271cc08246511c86

SHA512
f027b1ece61e5a82f33d2be9bada726888d882be7ae4c8bb50190f31533532df65f5031f7a9ed7a912253f8d14dd08d7c05b18b4e932dc9843ee6289975e39e9

Download Submit
C:\Windows\system\pFmbhWs.exe

Filesize
1.6MB

MD5
566e8bbae5db1ab07790d88246e11773

SHA1
f35ba626b955b8c6018d47c5373740916a23a740

SHA256
81fed5053f4124e464d2ea1645ac25c60c676fca28ff77facccefde363250095

SHA512
c48b49a4887f9b4cc67a3946fb778e17681cf3efc1c545fee04b0f5a5ba19e2e0cb543b08f0b03dfef91a4d9aa80945a0d5627118b54048589da920766b8b777

Download Submit
C:\Windows\system\tKsTweW.exe

Filesize
1.7MB

MD5
217ee050ffb8d892bf884cfa49fce326

SHA1
f5a43edc910c7b68fbff1bc127f56c70586ddc50

SHA256
868caa53f84d68154836967604b3a941113a5be710fbd06bb9292e64449af2d9

SHA512
0fd411658441a401247b9cbda1675316de174f3faffe89f152aea4c8811bdd554223440af9b669bab69b01ed904e262f8bacc5e6cef230bde0e9d9d65702ffb9

Download Submit
C:\Windows\system\uLqKybM.exe

Filesize
1.7MB

MD5
5a0b08aa521294339971d55d4a0d9e03

SHA1
6b945bb073f61b420ec188db9cfa10458de97026

SHA256
54882a3c178525dd40221f5f02134b3466fe1fef43d7f270176c30e959c84a4a

SHA512
30b545f91077e38da7f0ac0da3c01438fbca33b18f5b5fcd68fd753a6dbbdaba81b029513234f1dd47a2996a397cb655dc3b6883d82a9784d827a1fc2149cd61

Download Submit
C:\Windows\system\xUvQEac.exe

Filesize
1.6MB

MD5
1ffd1d2fd24cfe8155b95b85fe70cfca

SHA1
220bc095380a09e68c4c1403e75e48cd963e1d83

SHA256
4b75bb43195c0ea77200753dd86ffb707d9c61cea22d71676169f3d2f5a26570

SHA512
f1b300adb073484da971f794660cc9830b646f64632b0764fc55a020b0dd317b6d6fcbe0740270d2d06fe12c1df39a56d642c4d55128c24d229476a3b5496462

Download Submit
C:\Windows\system\yBJabGH.exe

Filesize
1.6MB

MD5
5f5277acd082a75924d4baac40b01028

SHA1
07f6fd02635e4c83ded2179ce3423e3f70eb7cc4

SHA256
07aaf993d4f0f5cf8dfff2f7ea24d23f169cd763a64c20692dec001d586b47d5

SHA512
1a1a3cee2c0a782cd0a00b015c98a3ad86b0162b81402cc7b1a10afa402dcda522d1803de684d47f870cf735122770ca1b31a335f6872e4c0a589bdf875ef130

Download Submit
C:\Windows\system\zYFKCnL.exe

Filesize
1.6MB

MD5
789e9cd4bd3cab31239a83592c225f7a

SHA1
400c21406f67696bfa9124ede26d409023835cfe

SHA256
b2b19b3fa87518675918519b1bd551ffc178743fffec30da8734232d2076b9a7

SHA512
db95f590b28d6944a2b993f4c80b25416fa663b8d1be3bb9e96e25f7a0fa18a9e57f0ca75fa061b87fac1d942c56ca67648360f8b3f07e2fe98eeec5e1dd7a0d

Download Submit
\Windows\system\GNWTiaX.exe

Filesize
1.7MB

MD5
3a3722e339c0d37571891bf5a0fe9786

SHA1
6d2e267e44df2db2d9f594c4f1f025e1e4acdb58

SHA256
1ee5c6b4d3b84ce054f62f026380290d9610e6266c9ce6a7c89ba06ff3e1d2bf

SHA512
f638161a361cdbb2ad4542cda6856297a02e5564600095afdd8c470d919d14dda3a02be20b1cfa4d83073fefa0720bdad41a62760122f3bfd30bd0983ab2b674

Download Submit
\Windows\system\GsXieIF.exe

Filesize
1.7MB

MD5
5688b6f89fde2d24cd6eb7610ce62fdd

SHA1
2c1454905c99fe8ca751f64faef802adabdd6f7b

SHA256
b17eb97750bbef026f1fb2fdf5208dd70f3ca2fc81e5d63d2d10952902bcbc1f

SHA512
6d855a449d7a8ecfb6e655505541415c08222952147ae1bf9384a4a0ef14afced1569db1f05a66d6d469f042a4666be21ae0f0221fb63ccbe8e56c78f34eb0c2

Download Submit
\Windows\system\KYdZKLX.exe

Filesize
1.7MB

MD5
7c0075acbd18c92db134bea2cf19dc14

SHA1
fb3dd5e6f55c56961499d32259bd3afc2f36c7e6

SHA256
f137055c04b1bf0c25162647c961c62bac278e33f1fa4331b9b5e6e3d8117407

SHA512
a271bc6b90ce085e048bdb0a05b3db788ed76d099cdc0d1c71747fa7331bb94733ad1effa093ee8db8652334ee373fada1976e4c79ab1b70507d680c8036c69a

Download Submit
\Windows\system\NddyGaP.exe

Filesize
1.7MB

MD5
772caa651e67fa6aee23567b530a79d6

SHA1
d7f17d7ccc6be0721ee539d7ae57628f2efc2b34

SHA256
6b9b2c243a09ce0f1c3f35fe27bd4a8f316509efda6afe5e54debd16561aa012

SHA512
36ecdb3ed0f22269ca117170fec3227b89a47396c0cae09d0b65cb5b1149e5a04a31054bb5b946398a75286570024e1326006fc86cecfe1344a0268b93b2bc8f

Download Submit
\Windows\system\QdaBGLe.exe

Filesize
1.7MB

MD5
38e0509a7d98d75832b3138b5a214b8f

SHA1
775738a8373ce247f41666468ef12dd6ea9b14b8

SHA256
d4aaac5874b47070a445e7b5fde74823ed841f2ce501ce32738324a021b268a9

SHA512
e8ad86028afcb72b58c804640f27a5b559f22e85cc7361ea37f81ea472996077a4d4cadc29cb7e30d715344d2774049fc89aa9647582b93e97066fbccd94b101

Download Submit
\Windows\system\QhmAEFP.exe

Filesize
1.7MB

MD5
eff88568f298240752257fd720cb3613

SHA1
4429760d00ca1fe283131654f8e7552ecf5cbbcf

SHA256
d7c922c38540921ace9d0a86be559ee5b18fffa877f08da952bd254a118c738d

SHA512
2e327842c121a7c87d3da2d4aa33a5ce21b076c2a62a1a1d3a9debc65c9c9c604be0b66696e9f7f569944e8729f9a8f03c36936ae71a310f5cf1243bc82de83f

Download Submit
\Windows\system\RQwmjBJ.exe

Filesize
1.7MB

MD5
ccde46e68222676f7e714e534b1daf32

SHA1
13a1a21504e22164a047ed9f97f350e8d1f6f8da

SHA256
8f24cf5cbd46471f756778f2377c0e8d7842c4c1955a3eb9cb51f438dd70da6c

SHA512
3dde7aaa90a73f4ef692906d6970f986a60fdbaf982213e4d10d81c2f87e1ffea44feea265a5694ae93ac9c9eb6b800369b1dc0a3d3a8dae7f444fe29f9b1c75

Download Submit
\Windows\system\RWVsNlR.exe

Filesize
1.6MB

MD5
5c69aeced81f65ab327381822ff9c4a9

SHA1
92133f1baa79f122e141482f35364b8ed86a8b70

SHA256
136e1343f1d256f92a5ab9eca337c7176b90da60f10b639ed1239a41d908ca7b

SHA512
8cddc953bf9608f33e445dd0421753ccc0605718c8ca4602dee71193b6f9f9adce148452500178dc66aef242d620a8becfd3e956551048c8847984391ba66116

Download Submit
\Windows\system\nAbxuVh.exe

Filesize
1.7MB

MD5
b3762d154ed9fa0a365bbe5072702451

SHA1
c6038e34981e0e3d4d5a40424a0d880b78a6654a

SHA256
8c847b3e5163983ab6b9181d84028d94462e27413b704d13b01ee8c510312b7d

SHA512
3cc105d721cb3f211a90aa48b0da3c8e7a9923200729271f1f1515942abaa454be9a9d3a6394a374a20b18bcc96cf8015d6c0f867e39db3798bfe1b312a85fff

Download Submit
\Windows\system\xXFGOPN.exe

Filesize
1.6MB

MD5
086bf59ec55d442cbac08c8eef960440

SHA1
da24ac7ef74fd40ca0ee6ad3f3fe3d817c6af980

SHA256
393666dbe69b58b27a3a59fd70f55c04024a8711b627e1218897318bd75249b0

SHA512
07167331e14b444d4959eb0e2ddf8309ea0066174f533ab973d8d519ce91083c9be9f79c0a3a45975b3998766c073d121a83d04697c4f070868fe3b743c60931

Download Submit
memory/1576-131-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/1576-133-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/1576-118-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/1576-117-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/1576-57-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/1576-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1576-119-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/1576-25-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/1576-92-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/1576-122-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/1576-108-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/1576-120-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/1576-126-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/1576-0-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/1576-110-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2336-111-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-5212-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-5214-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2468-116-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2564-1079-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/2564-1463-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download
memory/2576-121-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-5210-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-113-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2604-5215-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2700-112-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-5217-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-5213-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2724-114-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2736-5218-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2736-115-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download