xmrig | 39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
Size

1.9MB
MD5

add1afc67903e7b5e9a1eae3126bd180
SHA1

28eae62ca982656c18c7cf8ceff4b3c37420e30b
SHA256

39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4
SHA512

76ff57205f38ef5dfe6f0fa70b970646eea93df94fe3300177d4e7c2f50a54a063a0510e7707c970031a6328ea6387978f1f840cdb78cff484d3b4a8ddb9bc1f
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOk0t2MPnt4Jh/eFVHf+M:Lz071uv4BPMkFfdg6NsTt2MPTHfbhZ

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2828-86-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/1236-85-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2336-79-0x0000000003680000-0x0000000003A72000-memory.dmp	xmrig
behavioral1/memory/2604-78-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/2120-70-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/2336-63-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2128-61-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	xmrig
behavioral1/memory/2168-49-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2336-39-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2336-72-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2336-479-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2828-6562-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2408-6670-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2120-6701-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/2936-6738-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/3032-6739-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2604-6830-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/748-7663-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2336-8516-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2096	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2168	XndiATQ.exe
2128	ZzfpCkR.exe
2120	fZyDjOg.exe
2604	FfPQRBv.exe
1236	kjmFbKY.exe
2828	FHTYMiE.exe
2408	HdwVsCk.exe
3032	SNJPfDR.exe
748	RIbZreV.exe
2936	kWShHmA.exe
2756	AnBUFUQ.exe
1476	UNpdhRv.exe
2016	PGZuQGD.exe
2476	paDSpHl.exe
2796	PgjzXol.exe
1728	KpxUCPG.exe
2616	sYZcjsP.exe
1760	oYXPdtI.exe
2820	wwxQjsE.exe
772	dJZQjTt.exe
2388	DTzGnSo.exe
1736	SUeCuQp.exe
824	zlYKnpP.exe
2840	NvPsccz.exe
2288	WzQdFLA.exe
1784	LTBphEN.exe
1504	eoHlFrI.exe
924	AgRFkvj.exe
384	PvFMWbc.exe
656	AfbGVdP.exe
1272	pbweoDu.exe
1692	vAmCTUA.exe
2196	YYJQGSl.exe
2352	VkjnnWN.exe
2744	hfOCdYO.exe
1744	YPQakmn.exe
608	HJweJAd.exe
2200	GeDdKUH.exe
2764	imGUtQr.exe
1992	vGoNEXI.exe
2592	IbqVvSy.exe
2788	ECPIYuQ.exe
2712	xiKnIGX.exe
2152	TJvdaVX.exe
2332	ebMUWdb.exe
868	ODpEeDx.exe
980	YHEzafN.exe
2148	mQDoqGX.exe
1304	hAaFuaV.exe
2320	aMwtNgs.exe
1604	WtyruWu.exe
2132	WpaPfkR.exe
1496	LiaAFmR.exe
1120	QanYwGS.exe
1312	GgVzLSO.exe
1516	hDQfiYM.exe
1584	KqHBzuN.exe
1792	vUvWMWf.exe
1316	nilljxv.exe
572	SbZWIua.exe
1856	IdxlHdZ.exe
2372	KowmrQZ.exe
1716	QaEvqtB.exe
864	xTsulyi.exe

Loads dropped DLL 64 IoCs

pid	Process
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2336-0-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/files/0x0036000000014594-9.dat	upx
behavioral1/memory/2168-8-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/files/0x0007000000014857-12.dat	upx
behavioral1/files/0x0007000000004e76-31.dat	upx
behavioral1/files/0x0007000000014971-26.dat	upx
behavioral1/files/0x000a000000014b27-44.dat	upx
behavioral1/files/0x0009000000014b63-52.dat	upx
behavioral1/files/0x0006000000015d07-83.dat	upx
behavioral1/memory/2828-86-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2936-89-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/files/0x0006000000015d4a-98.dat	upx
behavioral1/files/0x0006000000015d9b-132.dat	upx
behavioral1/files/0x00060000000161e7-163.dat	upx
behavioral1/files/0x00060000000164b2-172.dat	upx
behavioral1/files/0x000600000001661c-177.dat	upx
behavioral1/files/0x0006000000016c63-191.dat	upx
behavioral1/files/0x0006000000016a9a-186.dat	upx
behavioral1/files/0x0006000000015d28-159.dat	upx
behavioral1/files/0x0006000000015fe9-157.dat	upx
behavioral1/files/0x0006000000015eaf-141.dat	upx
behavioral1/files/0x0006000000015d87-126.dat	upx
behavioral1/files/0x0006000000015d6f-114.dat	upx
behavioral1/files/0x0006000000015d5e-107.dat	upx
behavioral1/memory/748-88-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/3032-87-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/1236-85-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/files/0x0006000000015ce1-82.dat	upx
behavioral1/files/0x0006000000015cba-81.dat	upx
behavioral1/memory/2604-78-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/memory/2120-70-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/memory/2336-91-0x0000000003680000-0x0000000003A72000-memory.dmp	upx
behavioral1/memory/2128-61-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	upx
behavioral1/memory/2168-49-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2828-47-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/1236-41-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2096-40-0x0000000002970000-0x00000000029F0000-memory.dmp	upx
behavioral1/memory/2336-39-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2604-32-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/memory/2120-21-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/memory/2128-14-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	upx
behavioral1/files/0x000c00000001432c-6.dat	upx
behavioral1/files/0x0006000000015d56-99.dat	upx
behavioral1/files/0x0006000000015d79-118.dat	upx
behavioral1/files/0x0006000000015d8f-127.dat	upx
behavioral1/files/0x0008000000015ca6-121.dat	upx
behavioral1/files/0x0006000000015d67-109.dat	upx
behavioral1/files/0x0006000000015e3a-135.dat	upx
behavioral1/files/0x0006000000015ceb-71.dat	upx
behavioral1/files/0x000600000001630b-167.dat	upx
behavioral1/files/0x0006000000015cd5-64.dat	upx
behavioral1/memory/2408-55-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/files/0x0006000000016572-174.dat	upx
behavioral1/files/0x0006000000016c6b-195.dat	upx
behavioral1/files/0x0006000000016c4a-188.dat	upx
behavioral1/files/0x0006000000016843-181.dat	upx
behavioral1/files/0x0006000000016117-160.dat	upx
behavioral1/files/0x0006000000015f6d-144.dat	upx
behavioral1/memory/2828-6562-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2408-6670-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2120-6701-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/memory/2936-6738-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/3032-6739-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2604-6830-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wQlxRRe.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\sdUANlq.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\sXXPQzh.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\dLaINVv.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\uOnawAG.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\upZlXPK.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\tvNWHuj.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\hySMloC.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\goClEyq.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\JWNjJNJ.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\celccJz.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\eBYvjTv.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\NunKPZU.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\LKDbQdM.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\qrPNyHh.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\wedsCHF.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\GLPUGSC.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\FJpitNn.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\rOiMohu.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\COMdZRJ.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\PgjzXol.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\SXhgrwR.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\asaBpeJ.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\vxNFdvj.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\INMqOvh.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\OiAJzSY.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\sYynoHs.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\diThUcy.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\izeDnpY.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\kMDQTyh.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\YLVRYpL.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\salGLSF.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\WsRZaaI.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\ZkmEizk.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\cywrvGs.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\WtyruWu.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\lxmlRJL.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\qfkuJrk.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\HWSVGgb.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\pFpIwpO.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\ANSSHxK.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\lSsrSGG.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\DOPwDmR.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\marZNrI.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\cxomJmC.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\ykCNDQL.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\ePmfpGm.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\vbVcrIr.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\YEwDqDO.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\nrIdtwv.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\uyciMJq.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\yjlQlxY.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\WGIesVn.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\rzpeJSn.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\TTzaltU.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\lJjyqsS.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\HMJUXWl.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\ARVEHfa.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\cdzKhJR.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\QQUXKhA.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\TzexJLw.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\rAFKwkS.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\ZXAIpqT.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\mKoqkcr.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2096	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
Token: SeDebugPrivilege	2096	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2096	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	29
PID 2336 wrote to memory of 2096	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	29
PID 2336 wrote to memory of 2096	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	29
PID 2336 wrote to memory of 2168	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	30
PID 2336 wrote to memory of 2168	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	30
PID 2336 wrote to memory of 2168	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	30
PID 2336 wrote to memory of 2128	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	31
PID 2336 wrote to memory of 2128	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	31
PID 2336 wrote to memory of 2128	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	31
PID 2336 wrote to memory of 2120	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	32
PID 2336 wrote to memory of 2120	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	32
PID 2336 wrote to memory of 2120	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	32
PID 2336 wrote to memory of 2604	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	33
PID 2336 wrote to memory of 2604	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	33
PID 2336 wrote to memory of 2604	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	33
PID 2336 wrote to memory of 1236	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	34
PID 2336 wrote to memory of 1236	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	34
PID 2336 wrote to memory of 1236	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	34
PID 2336 wrote to memory of 2828	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	35
PID 2336 wrote to memory of 2828	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	35
PID 2336 wrote to memory of 2828	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	35
PID 2336 wrote to memory of 2408	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	36
PID 2336 wrote to memory of 2408	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	36
PID 2336 wrote to memory of 2408	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	36
PID 2336 wrote to memory of 2476	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	37
PID 2336 wrote to memory of 2476	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	37
PID 2336 wrote to memory of 2476	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	37
PID 2336 wrote to memory of 3032	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	38
PID 2336 wrote to memory of 3032	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	38
PID 2336 wrote to memory of 3032	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	38
PID 2336 wrote to memory of 2616	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	39
PID 2336 wrote to memory of 2616	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	39
PID 2336 wrote to memory of 2616	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	39
PID 2336 wrote to memory of 748	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	40
PID 2336 wrote to memory of 748	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	40
PID 2336 wrote to memory of 748	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	40
PID 2336 wrote to memory of 2820	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	41
PID 2336 wrote to memory of 2820	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	41
PID 2336 wrote to memory of 2820	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	41
PID 2336 wrote to memory of 2936	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	42
PID 2336 wrote to memory of 2936	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	42
PID 2336 wrote to memory of 2936	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	42
PID 2336 wrote to memory of 2388	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	43
PID 2336 wrote to memory of 2388	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	43
PID 2336 wrote to memory of 2388	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	43
PID 2336 wrote to memory of 2756	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	44
PID 2336 wrote to memory of 2756	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	44
PID 2336 wrote to memory of 2756	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	44
PID 2336 wrote to memory of 2196	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	45
PID 2336 wrote to memory of 2196	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	45
PID 2336 wrote to memory of 2196	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	45
PID 2336 wrote to memory of 1476	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	46
PID 2336 wrote to memory of 1476	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	46
PID 2336 wrote to memory of 1476	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	46
PID 2336 wrote to memory of 2744	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	47
PID 2336 wrote to memory of 2744	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	47
PID 2336 wrote to memory of 2744	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	47
PID 2336 wrote to memory of 2016	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	48
PID 2336 wrote to memory of 2016	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	48
PID 2336 wrote to memory of 2016	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	48
PID 2336 wrote to memory of 2764	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	49
PID 2336 wrote to memory of 2764	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	49
PID 2336 wrote to memory of 2764	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	49
PID 2336 wrote to memory of 2796	2336	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\System\XndiATQ.exe
  C:\Windows\System\XndiATQ.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\ZzfpCkR.exe
  C:\Windows\System\ZzfpCkR.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\fZyDjOg.exe
  C:\Windows\System\fZyDjOg.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\FfPQRBv.exe
  C:\Windows\System\FfPQRBv.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\kjmFbKY.exe
  C:\Windows\System\kjmFbKY.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\FHTYMiE.exe
  C:\Windows\System\FHTYMiE.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\HdwVsCk.exe
  C:\Windows\System\HdwVsCk.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\paDSpHl.exe
  C:\Windows\System\paDSpHl.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\SNJPfDR.exe
  C:\Windows\System\SNJPfDR.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\sYZcjsP.exe
  C:\Windows\System\sYZcjsP.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\RIbZreV.exe
  C:\Windows\System\RIbZreV.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\wwxQjsE.exe
  C:\Windows\System\wwxQjsE.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\kWShHmA.exe
  C:\Windows\System\kWShHmA.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\DTzGnSo.exe
  C:\Windows\System\DTzGnSo.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\AnBUFUQ.exe
  C:\Windows\System\AnBUFUQ.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\YYJQGSl.exe
  C:\Windows\System\YYJQGSl.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\UNpdhRv.exe
  C:\Windows\System\UNpdhRv.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\hfOCdYO.exe
  C:\Windows\System\hfOCdYO.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\PGZuQGD.exe
  C:\Windows\System\PGZuQGD.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\imGUtQr.exe
  C:\Windows\System\imGUtQr.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\PgjzXol.exe
  C:\Windows\System\PgjzXol.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\ECPIYuQ.exe
  C:\Windows\System\ECPIYuQ.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\KpxUCPG.exe
  C:\Windows\System\KpxUCPG.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\hAaFuaV.exe
  C:\Windows\System\hAaFuaV.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\oYXPdtI.exe
  C:\Windows\System\oYXPdtI.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\aMwtNgs.exe
  C:\Windows\System\aMwtNgs.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\dJZQjTt.exe
  C:\Windows\System\dJZQjTt.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\WtyruWu.exe
  C:\Windows\System\WtyruWu.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\SUeCuQp.exe
  C:\Windows\System\SUeCuQp.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\WpaPfkR.exe
  C:\Windows\System\WpaPfkR.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\zlYKnpP.exe
  C:\Windows\System\zlYKnpP.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\LiaAFmR.exe
  C:\Windows\System\LiaAFmR.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\NvPsccz.exe
  C:\Windows\System\NvPsccz.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\QanYwGS.exe
  C:\Windows\System\QanYwGS.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\WzQdFLA.exe
  C:\Windows\System\WzQdFLA.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\GgVzLSO.exe
  C:\Windows\System\GgVzLSO.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\LTBphEN.exe
  C:\Windows\System\LTBphEN.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\hDQfiYM.exe
  C:\Windows\System\hDQfiYM.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\eoHlFrI.exe
  C:\Windows\System\eoHlFrI.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\KqHBzuN.exe
  C:\Windows\System\KqHBzuN.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\AgRFkvj.exe
  C:\Windows\System\AgRFkvj.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\vUvWMWf.exe
  C:\Windows\System\vUvWMWf.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\PvFMWbc.exe
  C:\Windows\System\PvFMWbc.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\nilljxv.exe
  C:\Windows\System\nilljxv.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\AfbGVdP.exe
  C:\Windows\System\AfbGVdP.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\SbZWIua.exe
  C:\Windows\System\SbZWIua.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\pbweoDu.exe
  C:\Windows\System\pbweoDu.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\IdxlHdZ.exe
  C:\Windows\System\IdxlHdZ.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\vAmCTUA.exe
  C:\Windows\System\vAmCTUA.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\KowmrQZ.exe
  C:\Windows\System\KowmrQZ.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\VkjnnWN.exe
  C:\Windows\System\VkjnnWN.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\QaEvqtB.exe
  C:\Windows\System\QaEvqtB.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\YPQakmn.exe
  C:\Windows\System\YPQakmn.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\xTsulyi.exe
  C:\Windows\System\xTsulyi.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\HJweJAd.exe
  C:\Windows\System\HJweJAd.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\oKLFUja.exe
  C:\Windows\System\oKLFUja.exe
  2⤵
  PID:1704
- C:\Windows\System\GeDdKUH.exe
  C:\Windows\System\GeDdKUH.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\NunKPZU.exe
  C:\Windows\System\NunKPZU.exe
  2⤵
  PID:1576
- C:\Windows\System\vGoNEXI.exe
  C:\Windows\System\vGoNEXI.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\YhzzbKG.exe
  C:\Windows\System\YhzzbKG.exe
  2⤵
  PID:2184
- C:\Windows\System\IbqVvSy.exe
  C:\Windows\System\IbqVvSy.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\KVPlIgV.exe
  C:\Windows\System\KVPlIgV.exe
  2⤵
  PID:2660
- C:\Windows\System\xiKnIGX.exe
  C:\Windows\System\xiKnIGX.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\NaALpta.exe
  C:\Windows\System\NaALpta.exe
  2⤵
  PID:2456
- C:\Windows\System\TJvdaVX.exe
  C:\Windows\System\TJvdaVX.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\cqUzGRD.exe
  C:\Windows\System\cqUzGRD.exe
  2⤵
  PID:2848
- C:\Windows\System\ebMUWdb.exe
  C:\Windows\System\ebMUWdb.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\lxmlRJL.exe
  C:\Windows\System\lxmlRJL.exe
  2⤵
  PID:2572
- C:\Windows\System\ODpEeDx.exe
  C:\Windows\System\ODpEeDx.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\kIAiGbV.exe
  C:\Windows\System\kIAiGbV.exe
  2⤵
  PID:2072
- C:\Windows\System\YHEzafN.exe
  C:\Windows\System\YHEzafN.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\KJxpYMK.exe
  C:\Windows\System\KJxpYMK.exe
  2⤵
  PID:1868
- C:\Windows\System\mQDoqGX.exe
  C:\Windows\System\mQDoqGX.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\wKoSVzf.exe
  C:\Windows\System\wKoSVzf.exe
  2⤵
  PID:2124
- C:\Windows\System\MpgiMcu.exe
  C:\Windows\System\MpgiMcu.exe
  2⤵
  PID:1568
- C:\Windows\System\jUXIsfG.exe
  C:\Windows\System\jUXIsfG.exe
  2⤵
  PID:2448
- C:\Windows\System\dYPcryO.exe
  C:\Windows\System\dYPcryO.exe
  2⤵
  PID:300
- C:\Windows\System\UUXkAcq.exe
  C:\Windows\System\UUXkAcq.exe
  2⤵
  PID:2076
- C:\Windows\System\rJblZBr.exe
  C:\Windows\System\rJblZBr.exe
  2⤵
  PID:2180
- C:\Windows\System\PEcSUoq.exe
  C:\Windows\System\PEcSUoq.exe
  2⤵
  PID:1240
- C:\Windows\System\YdPxIhA.exe
  C:\Windows\System\YdPxIhA.exe
  2⤵
  PID:2380
- C:\Windows\System\qMaFavx.exe
  C:\Windows\System\qMaFavx.exe
  2⤵
  PID:2956
- C:\Windows\System\ilohLZB.exe
  C:\Windows\System\ilohLZB.exe
  2⤵
  PID:1644
- C:\Windows\System\bjifBEj.exe
  C:\Windows\System\bjifBEj.exe
  2⤵
  PID:612
- C:\Windows\System\edsbhHu.exe
  C:\Windows\System\edsbhHu.exe
  2⤵
  PID:2052
- C:\Windows\System\yQYXwhf.exe
  C:\Windows\System\yQYXwhf.exe
  2⤵
  PID:2696
- C:\Windows\System\XvKsbzj.exe
  C:\Windows\System\XvKsbzj.exe
  2⤵
  PID:2480
- C:\Windows\System\EpelBBb.exe
  C:\Windows\System\EpelBBb.exe
  2⤵
  PID:2044
- C:\Windows\System\cqNZbHZ.exe
  C:\Windows\System\cqNZbHZ.exe
  2⤵
  PID:2560
- C:\Windows\System\lgjRhyG.exe
  C:\Windows\System\lgjRhyG.exe
  2⤵
  PID:992
- C:\Windows\System\rtlvKBz.exe
  C:\Windows\System\rtlvKBz.exe
  2⤵
  PID:2980
- C:\Windows\System\lIVcakI.exe
  C:\Windows\System\lIVcakI.exe
  2⤵
  PID:2520
- C:\Windows\System\hQFDuqg.exe
  C:\Windows\System\hQFDuqg.exe
  2⤵
  PID:2824
- C:\Windows\System\DkmWwdb.exe
  C:\Windows\System\DkmWwdb.exe
  2⤵
  PID:3028
- C:\Windows\System\RgikyrU.exe
  C:\Windows\System\RgikyrU.exe
  2⤵
  PID:1308
- C:\Windows\System\PbKZnJi.exe
  C:\Windows\System\PbKZnJi.exe
  2⤵
  PID:668
- C:\Windows\System\nyzXYvp.exe
  C:\Windows\System\nyzXYvp.exe
  2⤵
  PID:2416
- C:\Windows\System\JkCTcJI.exe
  C:\Windows\System\JkCTcJI.exe
  2⤵
  PID:2672
- C:\Windows\System\ffVuktm.exe
  C:\Windows\System\ffVuktm.exe
  2⤵
  PID:2028
- C:\Windows\System\LuRbxwV.exe
  C:\Windows\System\LuRbxwV.exe
  2⤵
  PID:2800
- C:\Windows\System\hDKuJWk.exe
  C:\Windows\System\hDKuJWk.exe
  2⤵
  PID:412
- C:\Windows\System\NZrcSHn.exe
  C:\Windows\System\NZrcSHn.exe
  2⤵
  PID:284
- C:\Windows\System\vSfYvIH.exe
  C:\Windows\System\vSfYvIH.exe
  2⤵
  PID:1580
- C:\Windows\System\RXosFlm.exe
  C:\Windows\System\RXosFlm.exe
  2⤵
  PID:776
- C:\Windows\System\XCuvqne.exe
  C:\Windows\System\XCuvqne.exe
  2⤵
  PID:2220
- C:\Windows\System\vpsmrBw.exe
  C:\Windows\System\vpsmrBw.exe
  2⤵
  PID:1828
- C:\Windows\System\iYKbgSf.exe
  C:\Windows\System\iYKbgSf.exe
  2⤵
  PID:1832
- C:\Windows\System\lhbSMsO.exe
  C:\Windows\System\lhbSMsO.exe
  2⤵
  PID:2748
- C:\Windows\System\znbqUwo.exe
  C:\Windows\System\znbqUwo.exe
  2⤵
  PID:1520
- C:\Windows\System\SLEyiLB.exe
  C:\Windows\System\SLEyiLB.exe
  2⤵
  PID:760
- C:\Windows\System\VineqZn.exe
  C:\Windows\System\VineqZn.exe
  2⤵
  PID:2860
- C:\Windows\System\fBdFWkE.exe
  C:\Windows\System\fBdFWkE.exe
  2⤵
  PID:1928
- C:\Windows\System\QAepFhw.exe
  C:\Windows\System\QAepFhw.exe
  2⤵
  PID:2176
- C:\Windows\System\qzySnuX.exe
  C:\Windows\System\qzySnuX.exe
  2⤵
  PID:1144
- C:\Windows\System\SUQycYr.exe
  C:\Windows\System\SUQycYr.exe
  2⤵
  PID:1296
- C:\Windows\System\LXuqEqU.exe
  C:\Windows\System\LXuqEqU.exe
  2⤵
  PID:2280
- C:\Windows\System\ToqAEqO.exe
  C:\Windows\System\ToqAEqO.exe
  2⤵
  PID:2472
- C:\Windows\System\UyuMqrc.exe
  C:\Windows\System\UyuMqrc.exe
  2⤵
  PID:2908
- C:\Windows\System\EpMvqwb.exe
  C:\Windows\System\EpMvqwb.exe
  2⤵
  PID:2940
- C:\Windows\System\tJrpGxg.exe
  C:\Windows\System\tJrpGxg.exe
  2⤵
  PID:2960
- C:\Windows\System\RelEgul.exe
  C:\Windows\System\RelEgul.exe
  2⤵
  PID:1268
- C:\Windows\System\cSvQYPr.exe
  C:\Windows\System\cSvQYPr.exe
  2⤵
  PID:1864
- C:\Windows\System\ZGAXYlQ.exe
  C:\Windows\System\ZGAXYlQ.exe
  2⤵
  PID:2724
- C:\Windows\System\ybqiLUA.exe
  C:\Windows\System\ybqiLUA.exe
  2⤵
  PID:1028
- C:\Windows\System\ydgafCk.exe
  C:\Windows\System\ydgafCk.exe
  2⤵
  PID:1688
- C:\Windows\System\TrLuoxo.exe
  C:\Windows\System\TrLuoxo.exe
  2⤵
  PID:2040
- C:\Windows\System\QrlwxiC.exe
  C:\Windows\System\QrlwxiC.exe
  2⤵
  PID:604
- C:\Windows\System\xzBrMBF.exe
  C:\Windows\System\xzBrMBF.exe
  2⤵
  PID:844
- C:\Windows\System\lgNkjWj.exe
  C:\Windows\System\lgNkjWj.exe
  2⤵
  PID:2284
- C:\Windows\System\MWauNrQ.exe
  C:\Windows\System\MWauNrQ.exe
  2⤵
  PID:2924
- C:\Windows\System\lYHgsSp.exe
  C:\Windows\System\lYHgsSp.exe
  2⤵
  PID:1996
- C:\Windows\System\LQAJyAE.exe
  C:\Windows\System\LQAJyAE.exe
  2⤵
  PID:336
- C:\Windows\System\JTicLSe.exe
  C:\Windows\System\JTicLSe.exe
  2⤵
  PID:1948
- C:\Windows\System\RysHLMT.exe
  C:\Windows\System\RysHLMT.exe
  2⤵
  PID:2584
- C:\Windows\System\DsjcoMA.exe
  C:\Windows\System\DsjcoMA.exe
  2⤵
  PID:2424
- C:\Windows\System\zYxYNSz.exe
  C:\Windows\System\zYxYNSz.exe
  2⤵
  PID:3084
- C:\Windows\System\necHkdj.exe
  C:\Windows\System\necHkdj.exe
  2⤵
  PID:3100
- C:\Windows\System\MmmgVTe.exe
  C:\Windows\System\MmmgVTe.exe
  2⤵
  PID:3116
- C:\Windows\System\MGZDXES.exe
  C:\Windows\System\MGZDXES.exe
  2⤵
  PID:3132
- C:\Windows\System\YqUGRJi.exe
  C:\Windows\System\YqUGRJi.exe
  2⤵
  PID:3148
- C:\Windows\System\bOxkFbf.exe
  C:\Windows\System\bOxkFbf.exe
  2⤵
  PID:3164
- C:\Windows\System\Yryopty.exe
  C:\Windows\System\Yryopty.exe
  2⤵
  PID:3180
- C:\Windows\System\INopaFz.exe
  C:\Windows\System\INopaFz.exe
  2⤵
  PID:3196
- C:\Windows\System\SsYQRzT.exe
  C:\Windows\System\SsYQRzT.exe
  2⤵
  PID:3212
- C:\Windows\System\deNEoQf.exe
  C:\Windows\System\deNEoQf.exe
  2⤵
  PID:3228
- C:\Windows\System\slilxcb.exe
  C:\Windows\System\slilxcb.exe
  2⤵
  PID:3244
- C:\Windows\System\NebFDLe.exe
  C:\Windows\System\NebFDLe.exe
  2⤵
  PID:3320
- C:\Windows\System\riiGqjE.exe
  C:\Windows\System\riiGqjE.exe
  2⤵
  PID:3408
- C:\Windows\System\ZlKvinu.exe
  C:\Windows\System\ZlKvinu.exe
  2⤵
  PID:3424
- C:\Windows\System\LsNcYHr.exe
  C:\Windows\System\LsNcYHr.exe
  2⤵
  PID:3440
- C:\Windows\System\TdWHcfV.exe
  C:\Windows\System\TdWHcfV.exe
  2⤵
  PID:3456
- C:\Windows\System\TysZXOh.exe
  C:\Windows\System\TysZXOh.exe
  2⤵
  PID:3472
- C:\Windows\System\rafSQtc.exe
  C:\Windows\System\rafSQtc.exe
  2⤵
  PID:3488
- C:\Windows\System\IgLujdv.exe
  C:\Windows\System\IgLujdv.exe
  2⤵
  PID:3504
- C:\Windows\System\FVKTHIx.exe
  C:\Windows\System\FVKTHIx.exe
  2⤵
  PID:3520
- C:\Windows\System\PMCEiqb.exe
  C:\Windows\System\PMCEiqb.exe
  2⤵
  PID:3536
- C:\Windows\System\pcerFKG.exe
  C:\Windows\System\pcerFKG.exe
  2⤵
  PID:3552
- C:\Windows\System\EeeRgVi.exe
  C:\Windows\System\EeeRgVi.exe
  2⤵
  PID:3568
- C:\Windows\System\eliUsda.exe
  C:\Windows\System\eliUsda.exe
  2⤵
  PID:3584
- C:\Windows\System\jUrEDmT.exe
  C:\Windows\System\jUrEDmT.exe
  2⤵
  PID:3600
- C:\Windows\System\qbKoMCI.exe
  C:\Windows\System\qbKoMCI.exe
  2⤵
  PID:3616
- C:\Windows\System\nYbaZeQ.exe
  C:\Windows\System\nYbaZeQ.exe
  2⤵
  PID:3632
- C:\Windows\System\APzbJEU.exe
  C:\Windows\System\APzbJEU.exe
  2⤵
  PID:3648
- C:\Windows\System\qCpOIFU.exe
  C:\Windows\System\qCpOIFU.exe
  2⤵
  PID:3664
- C:\Windows\System\QbrRQmK.exe
  C:\Windows\System\QbrRQmK.exe
  2⤵
  PID:3680
- C:\Windows\System\QExQCts.exe
  C:\Windows\System\QExQCts.exe
  2⤵
  PID:3696
- C:\Windows\System\txqvtIa.exe
  C:\Windows\System\txqvtIa.exe
  2⤵
  PID:3716
- C:\Windows\System\IrBvmGv.exe
  C:\Windows\System\IrBvmGv.exe
  2⤵
  PID:3732
- C:\Windows\System\UCLYkqy.exe
  C:\Windows\System\UCLYkqy.exe
  2⤵
  PID:3748
- C:\Windows\System\MqxLFGZ.exe
  C:\Windows\System\MqxLFGZ.exe
  2⤵
  PID:3764
- C:\Windows\System\JtVHFDw.exe
  C:\Windows\System\JtVHFDw.exe
  2⤵
  PID:3784
- C:\Windows\System\hODFVLa.exe
  C:\Windows\System\hODFVLa.exe
  2⤵
  PID:3800
- C:\Windows\System\zzEapcF.exe
  C:\Windows\System\zzEapcF.exe
  2⤵
  PID:3816
- C:\Windows\System\hAfMfsx.exe
  C:\Windows\System\hAfMfsx.exe
  2⤵
  PID:3836
- C:\Windows\System\bvdNhHS.exe
  C:\Windows\System\bvdNhHS.exe
  2⤵
  PID:3856
- C:\Windows\System\zhVNgBC.exe
  C:\Windows\System\zhVNgBC.exe
  2⤵
  PID:3872
- C:\Windows\System\TSUUXux.exe
  C:\Windows\System\TSUUXux.exe
  2⤵
  PID:3888
- C:\Windows\System\JWNjJNJ.exe
  C:\Windows\System\JWNjJNJ.exe
  2⤵
  PID:3904
- C:\Windows\System\nrSbcQH.exe
  C:\Windows\System\nrSbcQH.exe
  2⤵
  PID:3920
- C:\Windows\System\zPXbvDY.exe
  C:\Windows\System\zPXbvDY.exe
  2⤵
  PID:3956
- C:\Windows\System\CVEWpWM.exe
  C:\Windows\System\CVEWpWM.exe
  2⤵
  PID:3972
- C:\Windows\System\KTohwnq.exe
  C:\Windows\System\KTohwnq.exe
  2⤵
  PID:3988
- C:\Windows\System\uvMvLPF.exe
  C:\Windows\System\uvMvLPF.exe
  2⤵
  PID:4004
- C:\Windows\System\iwzmzYe.exe
  C:\Windows\System\iwzmzYe.exe
  2⤵
  PID:4020
- C:\Windows\System\GZbjFUY.exe
  C:\Windows\System\GZbjFUY.exe
  2⤵
  PID:4040
- C:\Windows\System\kqMXfUm.exe
  C:\Windows\System\kqMXfUm.exe
  2⤵
  PID:4056
- C:\Windows\System\bOxZaWr.exe
  C:\Windows\System\bOxZaWr.exe
  2⤵
  PID:4072
- C:\Windows\System\TuXjXVP.exe
  C:\Windows\System\TuXjXVP.exe
  2⤵
  PID:4088
- C:\Windows\System\DjnTwJu.exe
  C:\Windows\System\DjnTwJu.exe
  2⤵
  PID:2776
- C:\Windows\System\WDjKUhX.exe
  C:\Windows\System\WDjKUhX.exe
  2⤵
  PID:2000
- C:\Windows\System\ixXMBWP.exe
  C:\Windows\System\ixXMBWP.exe
  2⤵
  PID:688
- C:\Windows\System\WUewFvT.exe
  C:\Windows\System\WUewFvT.exe
  2⤵
  PID:1588
- C:\Windows\System\VCdBtTp.exe
  C:\Windows\System\VCdBtTp.exe
  2⤵
  PID:2620
- C:\Windows\System\fgtCtrk.exe
  C:\Windows\System\fgtCtrk.exe
  2⤵
  PID:3156
- C:\Windows\System\QyoeMwP.exe
  C:\Windows\System\QyoeMwP.exe
  2⤵
  PID:3172
- C:\Windows\System\PNxnTnG.exe
  C:\Windows\System\PNxnTnG.exe
  2⤵
  PID:3240
- C:\Windows\System\frMICmi.exe
  C:\Windows\System\frMICmi.exe
  2⤵
  PID:3340
- C:\Windows\System\YSkGRUq.exe
  C:\Windows\System\YSkGRUq.exe
  2⤵
  PID:3356
- C:\Windows\System\pSiYisw.exe
  C:\Windows\System\pSiYisw.exe
  2⤵
  PID:3384
- C:\Windows\System\YypRAqn.exe
  C:\Windows\System\YypRAqn.exe
  2⤵
  PID:3400
- C:\Windows\System\PYNNPIX.exe
  C:\Windows\System\PYNNPIX.exe
  2⤵
  PID:3436
- C:\Windows\System\RfkTMgl.exe
  C:\Windows\System\RfkTMgl.exe
  2⤵
  PID:3500
- C:\Windows\System\XHAGhmV.exe
  C:\Windows\System\XHAGhmV.exe
  2⤵
  PID:3564
- C:\Windows\System\TuIfacu.exe
  C:\Windows\System\TuIfacu.exe
  2⤵
  PID:3096
- C:\Windows\System\YkoYdmT.exe
  C:\Windows\System\YkoYdmT.exe
  2⤵
  PID:3628
- C:\Windows\System\prQorGn.exe
  C:\Windows\System\prQorGn.exe
  2⤵
  PID:3704
- C:\Windows\System\DHosnFA.exe
  C:\Windows\System\DHosnFA.exe
  2⤵
  PID:3688
- C:\Windows\System\ZMZXMxe.exe
  C:\Windows\System\ZMZXMxe.exe
  2⤵
  PID:356
- C:\Windows\System\FRphgDz.exe
  C:\Windows\System\FRphgDz.exe
  2⤵
  PID:3220
- C:\Windows\System\FSceqqk.exe
  C:\Windows\System\FSceqqk.exe
  2⤵
  PID:3260
- C:\Windows\System\UboWmZu.exe
  C:\Windows\System\UboWmZu.exe
  2⤵
  PID:3296
- C:\Windows\System\ZqVbHKO.exe
  C:\Windows\System\ZqVbHKO.exe
  2⤵
  PID:3316
- C:\Windows\System\ZOFrlMS.exe
  C:\Windows\System\ZOFrlMS.exe
  2⤵
  PID:3676
- C:\Windows\System\VxoIDpJ.exe
  C:\Windows\System\VxoIDpJ.exe
  2⤵
  PID:3740
- C:\Windows\System\lmFsVaU.exe
  C:\Windows\System\lmFsVaU.exe
  2⤵
  PID:3644
- C:\Windows\System\OSjPPMe.exe
  C:\Windows\System\OSjPPMe.exe
  2⤵
  PID:3580
- C:\Windows\System\rvYuSrs.exe
  C:\Windows\System\rvYuSrs.exe
  2⤵
  PID:3516
- C:\Windows\System\DbVvbiL.exe
  C:\Windows\System\DbVvbiL.exe
  2⤵
  PID:3452
- C:\Windows\System\wtUzmyC.exe
  C:\Windows\System\wtUzmyC.exe
  2⤵
  PID:3824
- C:\Windows\System\aurqKrW.exe
  C:\Windows\System\aurqKrW.exe
  2⤵
  PID:3868
- C:\Windows\System\BEvRpDD.exe
  C:\Windows\System\BEvRpDD.exe
  2⤵
  PID:3932
- C:\Windows\System\uoRWtMK.exe
  C:\Windows\System\uoRWtMK.exe
  2⤵
  PID:3948
- C:\Windows\System\UUCADfJ.exe
  C:\Windows\System\UUCADfJ.exe
  2⤵
  PID:3864
- C:\Windows\System\sYlrhVi.exe
  C:\Windows\System\sYlrhVi.exe
  2⤵
  PID:4080
- C:\Windows\System\DBQEYhA.exe
  C:\Windows\System\DBQEYhA.exe
  2⤵
  PID:3808
- C:\Windows\System\RBdWNJs.exe
  C:\Windows\System\RBdWNJs.exe
  2⤵
  PID:3848
- C:\Windows\System\lWuxIlJ.exe
  C:\Windows\System\lWuxIlJ.exe
  2⤵
  PID:3884
- C:\Windows\System\rILsfmB.exe
  C:\Windows\System\rILsfmB.exe
  2⤵
  PID:2556
- C:\Windows\System\qCSLYjg.exe
  C:\Windows\System\qCSLYjg.exe
  2⤵
  PID:4036
- C:\Windows\System\odSPqPR.exe
  C:\Windows\System\odSPqPR.exe
  2⤵
  PID:3968
- C:\Windows\System\GyADbsT.exe
  C:\Windows\System\GyADbsT.exe
  2⤵
  PID:4068
- C:\Windows\System\jMccYBu.exe
  C:\Windows\System\jMccYBu.exe
  2⤵
  PID:3080
- C:\Windows\System\qAKDnUT.exe
  C:\Windows\System\qAKDnUT.exe
  2⤵
  PID:1720
- C:\Windows\System\kugEYhZ.exe
  C:\Windows\System\kugEYhZ.exe
  2⤵
  PID:3052
- C:\Windows\System\BZAMwqR.exe
  C:\Windows\System\BZAMwqR.exe
  2⤵
  PID:3348
- C:\Windows\System\btfHiZn.exe
  C:\Windows\System\btfHiZn.exe
  2⤵
  PID:3336
- C:\Windows\System\fOaeYhp.exe
  C:\Windows\System\fOaeYhp.exe
  2⤵
  PID:3396
- C:\Windows\System\iMxIVhL.exe
  C:\Windows\System\iMxIVhL.exe
  2⤵
  PID:3468
- C:\Windows\System\vZfPYRd.exe
  C:\Windows\System\vZfPYRd.exe
  2⤵
  PID:3268
- C:\Windows\System\CgaKAfz.exe
  C:\Windows\System\CgaKAfz.exe
  2⤵
  PID:3728
- C:\Windows\System\smGttnc.exe
  C:\Windows\System\smGttnc.exe
  2⤵
  PID:3532
- C:\Windows\System\VQBkRuJ.exe
  C:\Windows\System\VQBkRuJ.exe
  2⤵
  PID:3308
- C:\Windows\System\YeVMRWD.exe
  C:\Windows\System\YeVMRWD.exe
  2⤵
  PID:3596
- C:\Windows\System\GEQfaIQ.exe
  C:\Windows\System\GEQfaIQ.exe
  2⤵
  PID:3712
- C:\Windows\System\mFANFNh.exe
  C:\Windows\System\mFANFNh.exe
  2⤵
  PID:3608
- C:\Windows\System\qRcUqbO.exe
  C:\Windows\System\qRcUqbO.exe
  2⤵
  PID:3288
- C:\Windows\System\IeSuNeJ.exe
  C:\Windows\System\IeSuNeJ.exe
  2⤵
  PID:3672
- C:\Windows\System\DGQgCpa.exe
  C:\Windows\System\DGQgCpa.exe
  2⤵
  PID:3772
- C:\Windows\System\aNPQHSk.exe
  C:\Windows\System\aNPQHSk.exe
  2⤵
  PID:3792
- C:\Windows\System\LhOmFWz.exe
  C:\Windows\System\LhOmFWz.exe
  2⤵
  PID:4052
- C:\Windows\System\etofigp.exe
  C:\Windows\System\etofigp.exe
  2⤵
  PID:3928
- C:\Windows\System\KrcnDaU.exe
  C:\Windows\System\KrcnDaU.exe
  2⤵
  PID:3844
- C:\Windows\System\lorxgFD.exe
  C:\Windows\System\lorxgFD.exe
  2⤵
  PID:4032
- C:\Windows\System\vhdotIQ.exe
  C:\Windows\System\vhdotIQ.exe
  2⤵
  PID:3996
- C:\Windows\System\BAAratB.exe
  C:\Windows\System\BAAratB.exe
  2⤵
  PID:2080
- C:\Windows\System\asRJYvM.exe
  C:\Windows\System\asRJYvM.exe
  2⤵
  PID:1608
- C:\Windows\System\gNlcXcs.exe
  C:\Windows\System\gNlcXcs.exe
  2⤵
  PID:2136
- C:\Windows\System\fvqCwco.exe
  C:\Windows\System\fvqCwco.exe
  2⤵
  PID:2412
- C:\Windows\System\HzdMrwv.exe
  C:\Windows\System\HzdMrwv.exe
  2⤵
  PID:2780
- C:\Windows\System\WjxIgmx.exe
  C:\Windows\System\WjxIgmx.exe
  2⤵
  PID:1040
- C:\Windows\System\VqEBsks.exe
  C:\Windows\System\VqEBsks.exe
  2⤵
  PID:3144
- C:\Windows\System\qcKoHge.exe
  C:\Windows\System\qcKoHge.exe
  2⤵
  PID:4100
- C:\Windows\System\IKDCwEJ.exe
  C:\Windows\System\IKDCwEJ.exe
  2⤵
  PID:4120
- C:\Windows\System\xUzJtnn.exe
  C:\Windows\System\xUzJtnn.exe
  2⤵
  PID:4152
- C:\Windows\System\xtomCex.exe
  C:\Windows\System\xtomCex.exe
  2⤵
  PID:4168
- C:\Windows\System\JnPDFIq.exe
  C:\Windows\System\JnPDFIq.exe
  2⤵
  PID:4184
- C:\Windows\System\KnABNen.exe
  C:\Windows\System\KnABNen.exe
  2⤵
  PID:4260
- C:\Windows\System\BbAuDyo.exe
  C:\Windows\System\BbAuDyo.exe
  2⤵
  PID:4276
- C:\Windows\System\udZVbCv.exe
  C:\Windows\System\udZVbCv.exe
  2⤵
  PID:4292
- C:\Windows\System\pBtyRut.exe
  C:\Windows\System\pBtyRut.exe
  2⤵
  PID:4308
- C:\Windows\System\AePlEIq.exe
  C:\Windows\System\AePlEIq.exe
  2⤵
  PID:4324
- C:\Windows\System\dbDTVrp.exe
  C:\Windows\System\dbDTVrp.exe
  2⤵
  PID:4340
- C:\Windows\System\DJwFgOg.exe
  C:\Windows\System\DJwFgOg.exe
  2⤵
  PID:4356
- C:\Windows\System\LSWMyOU.exe
  C:\Windows\System\LSWMyOU.exe
  2⤵
  PID:4372
- C:\Windows\System\sgBHziR.exe
  C:\Windows\System\sgBHziR.exe
  2⤵
  PID:4388
- C:\Windows\System\BwbWApS.exe
  C:\Windows\System\BwbWApS.exe
  2⤵
  PID:4404
- C:\Windows\System\IaKMmMN.exe
  C:\Windows\System\IaKMmMN.exe
  2⤵
  PID:4420
- C:\Windows\System\uQKufTj.exe
  C:\Windows\System\uQKufTj.exe
  2⤵
  PID:4436
- C:\Windows\System\pYrUict.exe
  C:\Windows\System\pYrUict.exe
  2⤵
  PID:4452
- C:\Windows\System\diThUcy.exe
  C:\Windows\System\diThUcy.exe
  2⤵
  PID:4468
- C:\Windows\System\SiAwIYZ.exe
  C:\Windows\System\SiAwIYZ.exe
  2⤵
  PID:4484
- C:\Windows\System\HOIQxdK.exe
  C:\Windows\System\HOIQxdK.exe
  2⤵
  PID:4500
- C:\Windows\System\WUHNTNG.exe
  C:\Windows\System\WUHNTNG.exe
  2⤵
  PID:4516
- C:\Windows\System\USkYicf.exe
  C:\Windows\System\USkYicf.exe
  2⤵
  PID:4532
- C:\Windows\System\MzqPoug.exe
  C:\Windows\System\MzqPoug.exe
  2⤵
  PID:4548
- C:\Windows\System\qZnVBYL.exe
  C:\Windows\System\qZnVBYL.exe
  2⤵
  PID:4564
- C:\Windows\System\lRRdOtG.exe
  C:\Windows\System\lRRdOtG.exe
  2⤵
  PID:4580
- C:\Windows\System\AYFLelJ.exe
  C:\Windows\System\AYFLelJ.exe
  2⤵
  PID:4596
- C:\Windows\System\nBpnAfF.exe
  C:\Windows\System\nBpnAfF.exe
  2⤵
  PID:4612
- C:\Windows\System\uFcvDtX.exe
  C:\Windows\System\uFcvDtX.exe
  2⤵
  PID:4628
- C:\Windows\System\CJaPtEB.exe
  C:\Windows\System\CJaPtEB.exe
  2⤵
  PID:4644
- C:\Windows\System\zHNsyvW.exe
  C:\Windows\System\zHNsyvW.exe
  2⤵
  PID:4660
- C:\Windows\System\ZNmePtA.exe
  C:\Windows\System\ZNmePtA.exe
  2⤵
  PID:4676
- C:\Windows\System\CnyUFJU.exe
  C:\Windows\System\CnyUFJU.exe
  2⤵
  PID:4692
- C:\Windows\System\oNNbZYo.exe
  C:\Windows\System\oNNbZYo.exe
  2⤵
  PID:4708
- C:\Windows\System\SHdlUxV.exe
  C:\Windows\System\SHdlUxV.exe
  2⤵
  PID:4724
- C:\Windows\System\QLJRGKl.exe
  C:\Windows\System\QLJRGKl.exe
  2⤵
  PID:4740
- C:\Windows\System\oGseedU.exe
  C:\Windows\System\oGseedU.exe
  2⤵
  PID:4756
- C:\Windows\System\ohwFoid.exe
  C:\Windows\System\ohwFoid.exe
  2⤵
  PID:4772
- C:\Windows\System\ApSYTjt.exe
  C:\Windows\System\ApSYTjt.exe
  2⤵
  PID:4788
- C:\Windows\System\epdHhEY.exe
  C:\Windows\System\epdHhEY.exe
  2⤵
  PID:4804
- C:\Windows\System\cApfqFd.exe
  C:\Windows\System\cApfqFd.exe
  2⤵
  PID:4820
- C:\Windows\System\BxAADCO.exe
  C:\Windows\System\BxAADCO.exe
  2⤵
  PID:4836
- C:\Windows\System\mjhQmyQ.exe
  C:\Windows\System\mjhQmyQ.exe
  2⤵
  PID:4852
- C:\Windows\System\nDTofDz.exe
  C:\Windows\System\nDTofDz.exe
  2⤵
  PID:4868
- C:\Windows\System\tvTavtx.exe
  C:\Windows\System\tvTavtx.exe
  2⤵
  PID:4884
- C:\Windows\System\SJhpdha.exe
  C:\Windows\System\SJhpdha.exe
  2⤵
  PID:4900
- C:\Windows\System\TCzmZBu.exe
  C:\Windows\System\TCzmZBu.exe
  2⤵
  PID:4916
- C:\Windows\System\NthBwBl.exe
  C:\Windows\System\NthBwBl.exe
  2⤵
  PID:4932
- C:\Windows\System\ohEewaj.exe
  C:\Windows\System\ohEewaj.exe
  2⤵
  PID:4948
- C:\Windows\System\nvsXyVC.exe
  C:\Windows\System\nvsXyVC.exe
  2⤵
  PID:4964
- C:\Windows\System\kviSvYS.exe
  C:\Windows\System\kviSvYS.exe
  2⤵
  PID:4980
- C:\Windows\System\LODHNfl.exe
  C:\Windows\System\LODHNfl.exe
  2⤵
  PID:4996
- C:\Windows\System\rQZSwtw.exe
  C:\Windows\System\rQZSwtw.exe
  2⤵
  PID:5012
- C:\Windows\System\wYsDcIb.exe
  C:\Windows\System\wYsDcIb.exe
  2⤵
  PID:5032
- C:\Windows\System\DizdbjJ.exe
  C:\Windows\System\DizdbjJ.exe
  2⤵
  PID:5084
- C:\Windows\System\HZxTlqS.exe
  C:\Windows\System\HZxTlqS.exe
  2⤵
  PID:5100
- C:\Windows\System\XUrlGHa.exe
  C:\Windows\System\XUrlGHa.exe
  2⤵
  PID:5116
- C:\Windows\System\viZospE.exe
  C:\Windows\System\viZospE.exe
  2⤵
  PID:3432
- C:\Windows\System\DYFriQU.exe
  C:\Windows\System\DYFriQU.exe
  2⤵
  PID:3760
- C:\Windows\System\EpcCNoX.exe
  C:\Windows\System\EpcCNoX.exe
  2⤵
  PID:3548
- C:\Windows\System\nhzPZHm.exe
  C:\Windows\System\nhzPZHm.exe
  2⤵
  PID:4084
- C:\Windows\System\GHkvziP.exe
  C:\Windows\System\GHkvziP.exe
  2⤵
  PID:2704
- C:\Windows\System\inMLtwt.exe
  C:\Windows\System\inMLtwt.exe
  2⤵
  PID:736
- C:\Windows\System\kRYvEba.exe
  C:\Windows\System\kRYvEba.exe
  2⤵
  PID:4132
- C:\Windows\System\VHoklTX.exe
  C:\Windows\System\VHoklTX.exe
  2⤵
  PID:4148
- C:\Windows\System\GvgSaTE.exe
  C:\Windows\System\GvgSaTE.exe
  2⤵
  PID:3092
- C:\Windows\System\eGyXVyR.exe
  C:\Windows\System\eGyXVyR.exe
  2⤵
  PID:3256
- C:\Windows\System\VjWJoMH.exe
  C:\Windows\System\VjWJoMH.exe
  2⤵
  PID:3708
- C:\Windows\System\WzTTAVH.exe
  C:\Windows\System\WzTTAVH.exe
  2⤵
  PID:1344
- C:\Windows\System\WbNsKrh.exe
  C:\Windows\System\WbNsKrh.exe
  2⤵
  PID:1984
- C:\Windows\System\YuOIoHb.exe
  C:\Windows\System\YuOIoHb.exe
  2⤵
  PID:3880
- C:\Windows\System\MijyXUF.exe
  C:\Windows\System\MijyXUF.exe
  2⤵
  PID:3140
- C:\Windows\System\LNJemGg.exe
  C:\Windows\System\LNJemGg.exe
  2⤵
  PID:4160
- C:\Windows\System\rnNRBXV.exe
  C:\Windows\System\rnNRBXV.exe
  2⤵
  PID:4200
- C:\Windows\System\MqevsUn.exe
  C:\Windows\System\MqevsUn.exe
  2⤵
  PID:4216
- C:\Windows\System\bDTMYUi.exe
  C:\Windows\System\bDTMYUi.exe
  2⤵
  PID:4232
- C:\Windows\System\hCWuvjL.exe
  C:\Windows\System\hCWuvjL.exe
  2⤵
  PID:4244
- C:\Windows\System\rpwNlok.exe
  C:\Windows\System\rpwNlok.exe
  2⤵
  PID:2684
- C:\Windows\System\nvQgBXu.exe
  C:\Windows\System\nvQgBXu.exe
  2⤵
  PID:632
- C:\Windows\System\sZbWppu.exe
  C:\Windows\System\sZbWppu.exe
  2⤵
  PID:4320
- C:\Windows\System\BhYnzEG.exe
  C:\Windows\System\BhYnzEG.exe
  2⤵
  PID:4384
- C:\Windows\System\YsJKwHS.exe
  C:\Windows\System\YsJKwHS.exe
  2⤵
  PID:4480
- C:\Windows\System\lSsHYxJ.exe
  C:\Windows\System\lSsHYxJ.exe
  2⤵
  PID:4544
- C:\Windows\System\emoxqJT.exe
  C:\Windows\System\emoxqJT.exe
  2⤵
  PID:4608
- C:\Windows\System\alfLtuZ.exe
  C:\Windows\System\alfLtuZ.exe
  2⤵
  PID:4672
- C:\Windows\System\xfHqCBN.exe
  C:\Windows\System\xfHqCBN.exe
  2⤵
  PID:4736
- C:\Windows\System\sHLjmER.exe
  C:\Windows\System\sHLjmER.exe
  2⤵
  PID:4828
- C:\Windows\System\kCCVIuT.exe
  C:\Windows\System\kCCVIuT.exe
  2⤵
  PID:4960
- C:\Windows\System\NvMnunp.exe
  C:\Windows\System\NvMnunp.exe
  2⤵
  PID:3312
- C:\Windows\System\UfzSeqn.exe
  C:\Windows\System\UfzSeqn.exe
  2⤵
  PID:5132
- C:\Windows\System\hMFvAzr.exe
  C:\Windows\System\hMFvAzr.exe
  2⤵
  PID:5148
- C:\Windows\System\JuVpIdL.exe
  C:\Windows\System\JuVpIdL.exe
  2⤵
  PID:5164
- C:\Windows\System\MlYkOLt.exe
  C:\Windows\System\MlYkOLt.exe
  2⤵
  PID:5180
- C:\Windows\System\zvPmAVE.exe
  C:\Windows\System\zvPmAVE.exe
  2⤵
  PID:5196
- C:\Windows\System\AcCbdLN.exe
  C:\Windows\System\AcCbdLN.exe
  2⤵
  PID:5212
- C:\Windows\System\fMuaLGv.exe
  C:\Windows\System\fMuaLGv.exe
  2⤵
  PID:5228
- C:\Windows\System\vbNcqiE.exe
  C:\Windows\System\vbNcqiE.exe
  2⤵
  PID:5244
- C:\Windows\System\VtlBMjn.exe
  C:\Windows\System\VtlBMjn.exe
  2⤵
  PID:5260
- C:\Windows\System\BXiLPvP.exe
  C:\Windows\System\BXiLPvP.exe
  2⤵
  PID:5276
- C:\Windows\System\bkXClIM.exe
  C:\Windows\System\bkXClIM.exe
  2⤵
  PID:5292
- C:\Windows\System\FpZhibC.exe
  C:\Windows\System\FpZhibC.exe
  2⤵
  PID:5308
- C:\Windows\System\UdyXjof.exe
  C:\Windows\System\UdyXjof.exe
  2⤵
  PID:5328
- C:\Windows\System\mHcrlQI.exe
  C:\Windows\System\mHcrlQI.exe
  2⤵
  PID:5344
- C:\Windows\System\OQVRkBq.exe
  C:\Windows\System\OQVRkBq.exe
  2⤵
  PID:5360
- C:\Windows\System\dTtJIxd.exe
  C:\Windows\System\dTtJIxd.exe
  2⤵
  PID:5376
- C:\Windows\System\WjvnOfz.exe
  C:\Windows\System\WjvnOfz.exe
  2⤵
  PID:5392
- C:\Windows\System\pypvqAf.exe
  C:\Windows\System\pypvqAf.exe
  2⤵
  PID:5408
- C:\Windows\System\MFvGpDY.exe
  C:\Windows\System\MFvGpDY.exe
  2⤵
  PID:5424
- C:\Windows\System\NMNgwtE.exe
  C:\Windows\System\NMNgwtE.exe
  2⤵
  PID:5440
- C:\Windows\System\jsXvXOE.exe
  C:\Windows\System\jsXvXOE.exe
  2⤵
  PID:5460
- C:\Windows\System\mTmUoNq.exe
  C:\Windows\System\mTmUoNq.exe
  2⤵
  PID:5476
- C:\Windows\System\dkUpIHY.exe
  C:\Windows\System\dkUpIHY.exe
  2⤵
  PID:5492
- C:\Windows\System\QLDayRV.exe
  C:\Windows\System\QLDayRV.exe
  2⤵
  PID:5508
- C:\Windows\System\QiFmHDo.exe
  C:\Windows\System\QiFmHDo.exe
  2⤵
  PID:5528
- C:\Windows\System\uxaVKgM.exe
  C:\Windows\System\uxaVKgM.exe
  2⤵
  PID:5544
- C:\Windows\System\zKipXrM.exe
  C:\Windows\System\zKipXrM.exe
  2⤵
  PID:5560
- C:\Windows\System\iSCHFWU.exe
  C:\Windows\System\iSCHFWU.exe
  2⤵
  PID:5576
- C:\Windows\System\DbVfVps.exe
  C:\Windows\System\DbVfVps.exe
  2⤵
  PID:5592
- C:\Windows\System\KKOOLvY.exe
  C:\Windows\System\KKOOLvY.exe
  2⤵
  PID:5608
- C:\Windows\System\FCTKhhJ.exe
  C:\Windows\System\FCTKhhJ.exe
  2⤵
  PID:5624
- C:\Windows\System\IljdvSR.exe
  C:\Windows\System\IljdvSR.exe
  2⤵
  PID:5640
- C:\Windows\System\PJwTBgM.exe
  C:\Windows\System\PJwTBgM.exe
  2⤵
  PID:5656
- C:\Windows\System\fHKKVWY.exe
  C:\Windows\System\fHKKVWY.exe
  2⤵
  PID:5676
- C:\Windows\System\jPefUIM.exe
  C:\Windows\System\jPefUIM.exe
  2⤵
  PID:5692
- C:\Windows\System\vGaNcIM.exe
  C:\Windows\System\vGaNcIM.exe
  2⤵
  PID:5708
- C:\Windows\System\GITuNVO.exe
  C:\Windows\System\GITuNVO.exe
  2⤵
  PID:5724
- C:\Windows\System\JBLdueL.exe
  C:\Windows\System\JBLdueL.exe
  2⤵
  PID:5740
- C:\Windows\System\zTFRJYj.exe
  C:\Windows\System\zTFRJYj.exe
  2⤵
  PID:5756
- C:\Windows\System\noVDjGR.exe
  C:\Windows\System\noVDjGR.exe
  2⤵
  PID:5772
- C:\Windows\System\ymIexKj.exe
  C:\Windows\System\ymIexKj.exe
  2⤵
  PID:5788
- C:\Windows\System\EXdBObe.exe
  C:\Windows\System\EXdBObe.exe
  2⤵
  PID:5804
- C:\Windows\System\AykrrmT.exe
  C:\Windows\System\AykrrmT.exe
  2⤵
  PID:5820
- C:\Windows\System\jqZYNHP.exe
  C:\Windows\System\jqZYNHP.exe
  2⤵
  PID:5836
- C:\Windows\System\KKTcWNp.exe
  C:\Windows\System\KKTcWNp.exe
  2⤵
  PID:5852
- C:\Windows\System\CbwZSIu.exe
  C:\Windows\System\CbwZSIu.exe
  2⤵
  PID:5880
- C:\Windows\System\yfeAhQz.exe
  C:\Windows\System\yfeAhQz.exe
  2⤵
  PID:5904
- C:\Windows\System\naNhoGg.exe
  C:\Windows\System\naNhoGg.exe
  2⤵
  PID:5920
- C:\Windows\System\FxTbCqh.exe
  C:\Windows\System\FxTbCqh.exe
  2⤵
  PID:5936
- C:\Windows\System\MAKYlmY.exe
  C:\Windows\System\MAKYlmY.exe
  2⤵
  PID:5952
- C:\Windows\System\iqhGoOF.exe
  C:\Windows\System\iqhGoOF.exe
  2⤵
  PID:5968
- C:\Windows\System\PZvwqOC.exe
  C:\Windows\System\PZvwqOC.exe
  2⤵
  PID:5984
- C:\Windows\System\CFgASbN.exe
  C:\Windows\System\CFgASbN.exe
  2⤵
  PID:6000
- C:\Windows\System\Lgwxuxc.exe
  C:\Windows\System\Lgwxuxc.exe
  2⤵
  PID:6016
- C:\Windows\System\sZGEjnj.exe
  C:\Windows\System\sZGEjnj.exe
  2⤵
  PID:6040
- C:\Windows\System\OfgLklL.exe
  C:\Windows\System\OfgLklL.exe
  2⤵
  PID:6060
- C:\Windows\System\YZZjhRl.exe
  C:\Windows\System\YZZjhRl.exe
  2⤵
  PID:6076
- C:\Windows\System\QBGyDcj.exe
  C:\Windows\System\QBGyDcj.exe
  2⤵
  PID:6112
- C:\Windows\System\dkmkkJu.exe
  C:\Windows\System\dkmkkJu.exe
  2⤵
  PID:6132
- C:\Windows\System\afoakwi.exe
  C:\Windows\System\afoakwi.exe
  2⤵
  PID:2316
- C:\Windows\System\LRktEjn.exe
  C:\Windows\System\LRktEjn.exe
  2⤵
  PID:4196
- C:\Windows\System\nelOTcQ.exe
  C:\Windows\System\nelOTcQ.exe
  2⤵
  PID:4412
- C:\Windows\System\AEHwPYB.exe
  C:\Windows\System\AEHwPYB.exe
  2⤵
  PID:4448
- C:\Windows\System\FnIcnip.exe
  C:\Windows\System\FnIcnip.exe
  2⤵
  PID:4924
- C:\Windows\System\VXIFdum.exe
  C:\Windows\System\VXIFdum.exe
  2⤵
  PID:4992
- C:\Windows\System\SDbItyD.exe
  C:\Windows\System\SDbItyD.exe
  2⤵
  PID:4604
- C:\Windows\System\kpxBYTr.exe
  C:\Windows\System\kpxBYTr.exe
  2⤵
  PID:3724
- C:\Windows\System\moRmgyO.exe
  C:\Windows\System\moRmgyO.exe
  2⤵
  PID:4116
- C:\Windows\System\ZZNOOrv.exe
  C:\Windows\System\ZZNOOrv.exe
  2⤵
  PID:4732
- C:\Windows\System\gmeUojR.exe
  C:\Windows\System\gmeUojR.exe
  2⤵
  PID:3796
- C:\Windows\System\aSkneIO.exe
  C:\Windows\System\aSkneIO.exe
  2⤵
  PID:4220
- C:\Windows\System\ZVnSOTJ.exe
  C:\Windows\System\ZVnSOTJ.exe
  2⤵
  PID:2348
- C:\Windows\System\oaUxymH.exe
  C:\Windows\System\oaUxymH.exe
  2⤵
  PID:5124
- C:\Windows\System\dewhQLo.exe
  C:\Windows\System\dewhQLo.exe
  2⤵
  PID:5316
- C:\Windows\System\kqQtMVs.exe
  C:\Windows\System\kqQtMVs.exe
  2⤵
  PID:5284
- C:\Windows\System\WAXAECk.exe
  C:\Windows\System\WAXAECk.exe
  2⤵
  PID:5416
- C:\Windows\System\TwEVwDl.exe
  C:\Windows\System\TwEVwDl.exe
  2⤵
  PID:5516
- C:\Windows\System\bKNJuBB.exe
  C:\Windows\System\bKNJuBB.exe
  2⤵
  PID:5384
- C:\Windows\System\qvjrmwP.exe
  C:\Windows\System\qvjrmwP.exe
  2⤵
  PID:5556
- C:\Windows\System\QXQOyVC.exe
  C:\Windows\System\QXQOyVC.exe
  2⤵
  PID:5648
- C:\Windows\System\seitScK.exe
  C:\Windows\System\seitScK.exe
  2⤵
  PID:5616
- C:\Windows\System\VwdOEzG.exe
  C:\Windows\System\VwdOEzG.exe
  2⤵
  PID:5716
- C:\Windows\System\AObLrjq.exe
  C:\Windows\System\AObLrjq.exe
  2⤵
  PID:5812
- C:\Windows\System\tWcHqrq.exe
  C:\Windows\System\tWcHqrq.exe
  2⤵
  PID:5888
- C:\Windows\System\Vylybsh.exe
  C:\Windows\System\Vylybsh.exe
  2⤵
  PID:5932
- C:\Windows\System\IVYAjdq.exe
  C:\Windows\System\IVYAjdq.exe
  2⤵
  PID:6028
- C:\Windows\System\tLrBeWj.exe
  C:\Windows\System\tLrBeWj.exe
  2⤵
  PID:5992
- C:\Windows\System\uSGysEI.exe
  C:\Windows\System\uSGysEI.exe
  2⤵
  PID:6124
- C:\Windows\System\UmpNRAQ.exe
  C:\Windows\System\UmpNRAQ.exe
  2⤵
  PID:1656
- C:\Windows\System\DqLojWy.exe
  C:\Windows\System\DqLojWy.exe
  2⤵
  PID:4988
- C:\Windows\System\lHgCxUU.exe
  C:\Windows\System\lHgCxUU.exe
  2⤵
  PID:5192
- C:\Windows\System\ioHoNNX.exe
  C:\Windows\System\ioHoNNX.exe
  2⤵
  PID:5488
- C:\Windows\System\uxvQXEz.exe
  C:\Windows\System\uxvQXEz.exe
  2⤵
  PID:5684
- C:\Windows\System\LcAagPH.exe
  C:\Windows\System\LcAagPH.exe
  2⤵
  PID:5964
- C:\Windows\System\LWLhfKb.exe
  C:\Windows\System\LWLhfKb.exe
  2⤵
  PID:1684
- C:\Windows\System\wIzLwFl.exe
  C:\Windows\System\wIzLwFl.exe
  2⤵
  PID:5552
- C:\Windows\System\VVTWyix.exe
  C:\Windows\System\VVTWyix.exe
  2⤵
  PID:6148
- C:\Windows\System\snIVDLG.exe
  C:\Windows\System\snIVDLG.exe
  2⤵
  PID:6164
- C:\Windows\System\AvbWiPy.exe
  C:\Windows\System\AvbWiPy.exe
  2⤵
  PID:6180
- C:\Windows\System\bnqjhWM.exe
  C:\Windows\System\bnqjhWM.exe
  2⤵
  PID:6196
- C:\Windows\System\hIMuyCo.exe
  C:\Windows\System\hIMuyCo.exe
  2⤵
  PID:6212
- C:\Windows\System\BcoqjYx.exe
  C:\Windows\System\BcoqjYx.exe
  2⤵
  PID:6228
- C:\Windows\System\SlAsJXk.exe
  C:\Windows\System\SlAsJXk.exe
  2⤵
  PID:6244
- C:\Windows\System\iutZBBZ.exe
  C:\Windows\System\iutZBBZ.exe
  2⤵
  PID:6260
- C:\Windows\System\EuOgfdM.exe
  C:\Windows\System\EuOgfdM.exe
  2⤵
  PID:6276
- C:\Windows\System\VkeDCFf.exe
  C:\Windows\System\VkeDCFf.exe
  2⤵
  PID:6292
- C:\Windows\System\MQVTeDQ.exe
  C:\Windows\System\MQVTeDQ.exe
  2⤵
  PID:6308
- C:\Windows\System\PVMBYjF.exe
  C:\Windows\System\PVMBYjF.exe
  2⤵
  PID:6324
- C:\Windows\System\ttmtgyN.exe
  C:\Windows\System\ttmtgyN.exe
  2⤵
  PID:6340
- C:\Windows\System\ahtwLRb.exe
  C:\Windows\System\ahtwLRb.exe
  2⤵
  PID:6356
- C:\Windows\System\MvZnyRY.exe
  C:\Windows\System\MvZnyRY.exe
  2⤵
  PID:6372
- C:\Windows\System\FxTDiKq.exe
  C:\Windows\System\FxTDiKq.exe
  2⤵
  PID:6388
- C:\Windows\System\EBzwQMH.exe
  C:\Windows\System\EBzwQMH.exe
  2⤵
  PID:6404
- C:\Windows\System\wyHpkKd.exe
  C:\Windows\System\wyHpkKd.exe
  2⤵
  PID:6420
- C:\Windows\System\SANONfF.exe
  C:\Windows\System\SANONfF.exe
  2⤵
  PID:6436
- C:\Windows\System\lVBYgTL.exe
  C:\Windows\System\lVBYgTL.exe
  2⤵
  PID:6452
- C:\Windows\System\SdhDdBW.exe
  C:\Windows\System\SdhDdBW.exe
  2⤵
  PID:6468
- C:\Windows\System\lPUEMvL.exe
  C:\Windows\System\lPUEMvL.exe
  2⤵
  PID:6484
- C:\Windows\System\IQuXGjD.exe
  C:\Windows\System\IQuXGjD.exe
  2⤵
  PID:6500
- C:\Windows\System\NfUaMup.exe
  C:\Windows\System\NfUaMup.exe
  2⤵
  PID:6516
- C:\Windows\System\fQpzDqd.exe
  C:\Windows\System\fQpzDqd.exe
  2⤵
  PID:6532
- C:\Windows\System\cfxqjBl.exe
  C:\Windows\System\cfxqjBl.exe
  2⤵
  PID:6548
- C:\Windows\System\aQXPeiS.exe
  C:\Windows\System\aQXPeiS.exe
  2⤵
  PID:6564
- C:\Windows\System\uZepNHf.exe
  C:\Windows\System\uZepNHf.exe
  2⤵
  PID:6580
- C:\Windows\System\STHEDLo.exe
  C:\Windows\System\STHEDLo.exe
  2⤵
  PID:6596
- C:\Windows\System\jTzbTAN.exe
  C:\Windows\System\jTzbTAN.exe
  2⤵
  PID:6612
- C:\Windows\System\EaloAQL.exe
  C:\Windows\System\EaloAQL.exe
  2⤵
  PID:6628
- C:\Windows\System\cUkMIcK.exe
  C:\Windows\System\cUkMIcK.exe
  2⤵
  PID:6644
- C:\Windows\System\kwwDEXx.exe
  C:\Windows\System\kwwDEXx.exe
  2⤵
  PID:6660
- C:\Windows\System\euJlAgb.exe
  C:\Windows\System\euJlAgb.exe
  2⤵
  PID:6676
- C:\Windows\System\SurLNwT.exe
  C:\Windows\System\SurLNwT.exe
  2⤵
  PID:6692
- C:\Windows\System\YbLYVbK.exe
  C:\Windows\System\YbLYVbK.exe
  2⤵
  PID:6708
- C:\Windows\System\OjouNWM.exe
  C:\Windows\System\OjouNWM.exe
  2⤵
  PID:6724
- C:\Windows\System\GTJQviz.exe
  C:\Windows\System\GTJQviz.exe
  2⤵
  PID:6740
- C:\Windows\System\RQvAbrQ.exe
  C:\Windows\System\RQvAbrQ.exe
  2⤵
  PID:6756
- C:\Windows\System\KoBvyQT.exe
  C:\Windows\System\KoBvyQT.exe
  2⤵
  PID:6772
- C:\Windows\System\Zymhxsc.exe
  C:\Windows\System\Zymhxsc.exe
  2⤵
  PID:6788
- C:\Windows\System\wAMASgs.exe
  C:\Windows\System\wAMASgs.exe
  2⤵
  PID:6804
- C:\Windows\System\UCpTnGK.exe
  C:\Windows\System\UCpTnGK.exe
  2⤵
  PID:6820
- C:\Windows\System\XPKYkfM.exe
  C:\Windows\System\XPKYkfM.exe
  2⤵
  PID:6836
- C:\Windows\System\HrAcPFj.exe
  C:\Windows\System\HrAcPFj.exe
  2⤵
  PID:6852
- C:\Windows\System\ejGmoyW.exe
  C:\Windows\System\ejGmoyW.exe
  2⤵
  PID:6868
- C:\Windows\System\jxJWhAs.exe
  C:\Windows\System\jxJWhAs.exe
  2⤵
  PID:6888
- C:\Windows\System\ypeRAsA.exe
  C:\Windows\System\ypeRAsA.exe
  2⤵
  PID:6904
- C:\Windows\System\pngNJIS.exe
  C:\Windows\System\pngNJIS.exe
  2⤵
  PID:6920
- C:\Windows\System\JSTqUTI.exe
  C:\Windows\System\JSTqUTI.exe
  2⤵
  PID:6936
- C:\Windows\System\JERaeeJ.exe
  C:\Windows\System\JERaeeJ.exe
  2⤵
  PID:6952
- C:\Windows\System\JvBOTWL.exe
  C:\Windows\System\JvBOTWL.exe
  2⤵
  PID:6968
- C:\Windows\System\mXhahcV.exe
  C:\Windows\System\mXhahcV.exe
  2⤵
  PID:6984
- C:\Windows\System\HcNrzAb.exe
  C:\Windows\System\HcNrzAb.exe
  2⤵
  PID:7000
- C:\Windows\System\UCTPrvQ.exe
  C:\Windows\System\UCTPrvQ.exe
  2⤵
  PID:7020
- C:\Windows\System\SbrvLLx.exe
  C:\Windows\System\SbrvLLx.exe
  2⤵
  PID:7036
- C:\Windows\System\JfwZLOQ.exe
  C:\Windows\System\JfwZLOQ.exe
  2⤵
  PID:7052
- C:\Windows\System\lmFcapv.exe
  C:\Windows\System\lmFcapv.exe
  2⤵
  PID:7068
- C:\Windows\System\phhenbs.exe
  C:\Windows\System\phhenbs.exe
  2⤵
  PID:7084
- C:\Windows\System\WqtGXWl.exe
  C:\Windows\System\WqtGXWl.exe
  2⤵
  PID:7100
- C:\Windows\System\xLuhsgO.exe
  C:\Windows\System\xLuhsgO.exe
  2⤵
  PID:7116
- C:\Windows\System\uYZAhzs.exe
  C:\Windows\System\uYZAhzs.exe
  2⤵
  PID:7132
- C:\Windows\System\VaIdTNZ.exe
  C:\Windows\System\VaIdTNZ.exe
  2⤵
  PID:7148
- C:\Windows\System\JwuDdbu.exe
  C:\Windows\System\JwuDdbu.exe
  2⤵
  PID:7164
- C:\Windows\System\BcZfgUv.exe
  C:\Windows\System\BcZfgUv.exe
  2⤵
  PID:4428
- C:\Windows\System\tpHVntk.exe
  C:\Windows\System\tpHVntk.exe
  2⤵
  PID:6204
- C:\Windows\System\PRfcsui.exe
  C:\Windows\System\PRfcsui.exe
  2⤵
  PID:4848
- C:\Windows\System\LMeJUms.exe
  C:\Windows\System\LMeJUms.exe
  2⤵
  PID:4972
- C:\Windows\System\tjWncsl.exe
  C:\Windows\System\tjWncsl.exe
  2⤵
  PID:6240
- C:\Windows\System\EhBulNN.exe
  C:\Windows\System\EhBulNN.exe
  2⤵
  PID:6300
- C:\Windows\System\kHTDLYP.exe
  C:\Windows\System\kHTDLYP.exe
  2⤵
  PID:5144
- C:\Windows\System\UHoRsLW.exe
  C:\Windows\System\UHoRsLW.exe
  2⤵
  PID:6364
- C:\Windows\System\UhYIynV.exe
  C:\Windows\System\UhYIynV.exe
  2⤵
  PID:6400
- C:\Windows\System\XoNGwNH.exe
  C:\Windows\System\XoNGwNH.exe
  2⤵
  PID:5832
- C:\Windows\System\XDsaCwa.exe
  C:\Windows\System\XDsaCwa.exe
  2⤵
  PID:5876
- C:\Windows\System\kPnntxz.exe
  C:\Windows\System\kPnntxz.exe
  2⤵
  PID:5948
- C:\Windows\System\hIvfhMT.exe
  C:\Windows\System\hIvfhMT.exe
  2⤵
  PID:6052
- C:\Windows\System\AlBmxaJ.exe
  C:\Windows\System\AlBmxaJ.exe
  2⤵
  PID:6096
- C:\Windows\System\SHbGcoE.exe
  C:\Windows\System\SHbGcoE.exe
  2⤵
  PID:6496
- C:\Windows\System\myRkIhU.exe
  C:\Windows\System\myRkIhU.exe
  2⤵
  PID:6524
- C:\Windows\System\GPfEBWh.exe
  C:\Windows\System\GPfEBWh.exe
  2⤵
  PID:4912
- C:\Windows\System\ksOvhbs.exe
  C:\Windows\System\ksOvhbs.exe
  2⤵
  PID:5040
- C:\Windows\System\BjhUJsb.exe
  C:\Windows\System\BjhUJsb.exe
  2⤵
  PID:1108
- C:\Windows\System\fbQcwtM.exe
  C:\Windows\System\fbQcwtM.exe
  2⤵
  PID:5240
- C:\Windows\System\CUwbbwO.exe
  C:\Windows\System\CUwbbwO.exe
  2⤵
  PID:5872
- C:\Windows\System\BciSNIL.exe
  C:\Windows\System\BciSNIL.exe
  2⤵
  PID:5252
- C:\Windows\System\oyzroBO.exe
  C:\Windows\System\oyzroBO.exe
  2⤵
  PID:5080
- C:\Windows\System\LRXDAKI.exe
  C:\Windows\System\LRXDAKI.exe
  2⤵
  PID:4880
- C:\Windows\System\TgUtdLS.exe
  C:\Windows\System\TgUtdLS.exe
  2⤵
  PID:4688
- C:\Windows\System\jqJWlTN.exe
  C:\Windows\System\jqJWlTN.exe
  2⤵
  PID:4684
- C:\Windows\System\VlYLkdz.exe
  C:\Windows\System\VlYLkdz.exe
  2⤵
  PID:4784
- C:\Windows\System\mHRmbEL.exe
  C:\Windows\System\mHRmbEL.exe
  2⤵
  PID:4528
- C:\Windows\System\tNrzxUN.exe
  C:\Windows\System\tNrzxUN.exe
  2⤵
  PID:4432
- C:\Windows\System\ZBzyUQi.exe
  C:\Windows\System\ZBzyUQi.exe
  2⤵
  PID:4368
- C:\Windows\System\NwBpPtI.exe
  C:\Windows\System\NwBpPtI.exe
  2⤵
  PID:4272
- C:\Windows\System\FvyWtSP.exe
  C:\Windows\System\FvyWtSP.exe
  2⤵
  PID:1220
- C:\Windows\System\VrUbUeG.exe
  C:\Windows\System\VrUbUeG.exe
  2⤵
  PID:3372
- C:\Windows\System\bpBIBOT.exe
  C:\Windows\System\bpBIBOT.exe
  2⤵
  PID:4108
- C:\Windows\System\uEVZVJJ.exe
  C:\Windows\System\uEVZVJJ.exe
  2⤵
  PID:3360
- C:\Windows\System\XufbLSu.exe
  C:\Windows\System\XufbLSu.exe
  2⤵
  PID:4512
- C:\Windows\System\EQhPXEd.exe
  C:\Windows\System\EQhPXEd.exe
  2⤵
  PID:4796
- C:\Windows\System\mkcvDhB.exe
  C:\Windows\System\mkcvDhB.exe
  2⤵
  PID:5204
- C:\Windows\System\oVoiCsp.exe
  C:\Windows\System\oVoiCsp.exe
  2⤵
  PID:5272
- C:\Windows\System\FBCDvYS.exe
  C:\Windows\System\FBCDvYS.exe
  2⤵
  PID:5340
- C:\Windows\System\EXsXIyf.exe
  C:\Windows\System\EXsXIyf.exe
  2⤵
  PID:5404
- C:\Windows\System\krhLXCP.exe
  C:\Windows\System\krhLXCP.exe
  2⤵
  PID:5504
- C:\Windows\System\RUsjqDJ.exe
  C:\Windows\System\RUsjqDJ.exe
  2⤵
  PID:5572
- C:\Windows\System\kefYiec.exe
  C:\Windows\System\kefYiec.exe
  2⤵
  PID:5636
- C:\Windows\System\HxJctfX.exe
  C:\Windows\System\HxJctfX.exe
  2⤵
  PID:5704
- C:\Windows\System\TqBJGah.exe
  C:\Windows\System\TqBJGah.exe
  2⤵
  PID:5864
- C:\Windows\System\rWVebJv.exe
  C:\Windows\System\rWVebJv.exe
  2⤵
  PID:6100
- C:\Windows\System\BUgXfbv.exe
  C:\Windows\System\BUgXfbv.exe
  2⤵
  PID:6624
- C:\Windows\System\vFuwxkj.exe
  C:\Windows\System\vFuwxkj.exe
  2⤵
  PID:5024
- C:\Windows\System\VPqOfGh.exe
  C:\Windows\System\VPqOfGh.exe
  2⤵
  PID:3900
- C:\Windows\System\lsyUwRN.exe
  C:\Windows\System\lsyUwRN.exe
  2⤵
  PID:5352
- C:\Windows\System\NDHriPf.exe
  C:\Windows\System\NDHriPf.exe
  2⤵
  PID:5588
- C:\Windows\System\oUmWOWJ.exe
  C:\Windows\System\oUmWOWJ.exe
  2⤵
  PID:5848
- C:\Windows\System\IxJMiLG.exe
  C:\Windows\System\IxJMiLG.exe
  2⤵
  PID:6120
- C:\Windows\System\xkRFZCt.exe
  C:\Windows\System\xkRFZCt.exe
  2⤵
  PID:5256
- C:\Windows\System\oBHIlJK.exe
  C:\Windows\System\oBHIlJK.exe
  2⤵
  PID:5928
- C:\Windows\System\JnPNFzi.exe
  C:\Windows\System\JnPNFzi.exe
  2⤵
  PID:6156
- C:\Windows\System\jmDJIyz.exe
  C:\Windows\System\jmDJIyz.exe
  2⤵
  PID:6220
- C:\Windows\System\bhNohrS.exe
  C:\Windows\System\bhNohrS.exe
  2⤵
  PID:6316
- C:\Windows\System\iHFlmMv.exe
  C:\Windows\System\iHFlmMv.exe
  2⤵
  PID:6380
- C:\Windows\System\gweTfqs.exe
  C:\Windows\System\gweTfqs.exe
  2⤵
  PID:6444
- C:\Windows\System\cptZdGK.exe
  C:\Windows\System\cptZdGK.exe
  2⤵
  PID:6652
- C:\Windows\System\HdxGBZB.exe
  C:\Windows\System\HdxGBZB.exe
  2⤵
  PID:6540
- C:\Windows\System\dOAvOpV.exe
  C:\Windows\System\dOAvOpV.exe
  2⤵
  PID:6640
- C:\Windows\System\HTCrZyT.exe
  C:\Windows\System\HTCrZyT.exe
  2⤵
  PID:6688
- C:\Windows\System\CwLxpwc.exe
  C:\Windows\System\CwLxpwc.exe
  2⤵
  PID:6752
- C:\Windows\System\QQSxTRu.exe
  C:\Windows\System\QQSxTRu.exe
  2⤵
  PID:6700
- C:\Windows\System\vxNFdvj.exe
  C:\Windows\System\vxNFdvj.exe
  2⤵
  PID:3160
- C:\Windows\System\tCRQxNx.exe
  C:\Windows\System\tCRQxNx.exe
  2⤵
  PID:6732
- C:\Windows\System\NIlgiiq.exe
  C:\Windows\System\NIlgiiq.exe
  2⤵
  PID:6848
- C:\Windows\System\IIMkYSZ.exe
  C:\Windows\System\IIMkYSZ.exe
  2⤵
  PID:6860
- C:\Windows\System\MYKMClP.exe
  C:\Windows\System\MYKMClP.exe
  2⤵
  PID:6912
- C:\Windows\System\asFARpE.exe
  C:\Windows\System\asFARpE.exe
  2⤵
  PID:6928
- C:\Windows\System\lwIGYfO.exe
  C:\Windows\System\lwIGYfO.exe
  2⤵
  PID:6976
- C:\Windows\System\THvsdox.exe
  C:\Windows\System\THvsdox.exe
  2⤵
  PID:6964
- C:\Windows\System\BiYCcZl.exe
  C:\Windows\System\BiYCcZl.exe
  2⤵
  PID:7028
- C:\Windows\System\hyAJvPx.exe
  C:\Windows\System\hyAJvPx.exe
  2⤵
  PID:7076
- C:\Windows\System\AHHLjuJ.exe
  C:\Windows\System\AHHLjuJ.exe
  2⤵
  PID:7112
- C:\Windows\System\JGhyFwX.exe
  C:\Windows\System\JGhyFwX.exe
  2⤵
  PID:7144
- C:\Windows\System\wcKHzXM.exe
  C:\Windows\System\wcKHzXM.exe
  2⤵
  PID:7092
- C:\Windows\System\OOhWPwN.exe
  C:\Windows\System\OOhWPwN.exe
  2⤵
  PID:7128
- C:\Windows\System\ghhSFyq.exe
  C:\Windows\System\ghhSFyq.exe
  2⤵
  PID:4716
- C:\Windows\System\NrIyGBB.exe
  C:\Windows\System\NrIyGBB.exe
  2⤵
  PID:4940
- C:\Windows\System\yutEGFM.exe
  C:\Windows\System\yutEGFM.exe
  2⤵
  PID:6336
- C:\Windows\System\tXnfikF.exe
  C:\Windows\System\tXnfikF.exe
  2⤵
  PID:6428
- C:\Windows\System\YhYDPFs.exe
  C:\Windows\System\YhYDPFs.exe
  2⤵
  PID:5828
- C:\Windows\System\kotLnVQ.exe
  C:\Windows\System\kotLnVQ.exe
  2⤵
  PID:6140
- C:\Windows\System\KcNyRGw.exe
  C:\Windows\System\KcNyRGw.exe
  2⤵
  PID:4844
- C:\Windows\System\SvuSOog.exe
  C:\Windows\System\SvuSOog.exe
  2⤵
  PID:6588
- C:\Windows\System\nIXzOvV.exe
  C:\Windows\System\nIXzOvV.exe
  2⤵
  PID:2816
- C:\Windows\System\CYAbaBy.exe
  C:\Windows\System\CYAbaBy.exe
  2⤵
  PID:5108
- C:\Windows\System\uoJDITW.exe
  C:\Windows\System\uoJDITW.exe
  2⤵
  PID:4256
- C:\Windows\System\gGbXVLw.exe
  C:\Windows\System\gGbXVLw.exe
  2⤵
  PID:6056
- C:\Windows\System\SBDApPw.exe
  C:\Windows\System\SBDApPw.exe
  2⤵
  PID:4652
- C:\Windows\System\NqJSIYY.exe
  C:\Windows\System\NqJSIYY.exe
  2⤵
  PID:4336
- C:\Windows\System\sUoPTPC.exe
  C:\Windows\System\sUoPTPC.exe
  2⤵
  PID:4464
- C:\Windows\System\cMaeDag.exe
  C:\Windows\System\cMaeDag.exe
  2⤵
  PID:5400
- C:\Windows\System\YHOGorB.exe
  C:\Windows\System\YHOGorB.exe
  2⤵
  PID:4668
- C:\Windows\System\RIqtOic.exe
  C:\Windows\System\RIqtOic.exe
  2⤵
  PID:5672
- C:\Windows\System\pwXDjaY.exe
  C:\Windows\System\pwXDjaY.exe
  2⤵
  PID:5176
- C:\Windows\System\eJzJDjN.exe
  C:\Windows\System\eJzJDjN.exe
  2⤵
  PID:5336
- C:\Windows\System\osZQLoQ.exe
  C:\Windows\System\osZQLoQ.exe
  2⤵
  PID:4864
- C:\Windows\System\zyBYHTh.exe
  C:\Windows\System\zyBYHTh.exe
  2⤵
  PID:6108
- C:\Windows\System\SUFtfzW.exe
  C:\Windows\System\SUFtfzW.exe
  2⤵
  PID:5288
- C:\Windows\System\alxbeIq.exe
  C:\Windows\System\alxbeIq.exe
  2⤵
  PID:5844
- C:\Windows\System\UVyDmvq.exe
  C:\Windows\System\UVyDmvq.exe
  2⤵
  PID:4180
- C:\Windows\System\NTaOujE.exe
  C:\Windows\System\NTaOujE.exe
  2⤵
  PID:6412
- C:\Windows\System\RUshvGq.exe
  C:\Windows\System\RUshvGq.exe
  2⤵
  PID:6684
- C:\Windows\System\bwvEIQW.exe
  C:\Windows\System\bwvEIQW.exe
  2⤵
  PID:6796
- C:\Windows\System\qugroeR.exe
  C:\Windows\System\qugroeR.exe
  2⤵
  PID:2524
- C:\Windows\System\zTuGGJO.exe
  C:\Windows\System\zTuGGJO.exe
  2⤵
  PID:6900
- C:\Windows\System\zZwvVRr.exe
  C:\Windows\System\zZwvVRr.exe
  2⤵
  PID:6960
- C:\Windows\System\QVGqArO.exe
  C:\Windows\System\QVGqArO.exe
  2⤵
  PID:7156
- C:\Windows\System\FZHjDtd.exe
  C:\Windows\System\FZHjDtd.exe
  2⤵
  PID:7032
- C:\Windows\System\vlPxfjm.exe
  C:\Windows\System\vlPxfjm.exe
  2⤵
  PID:6748
- C:\Windows\System\KnecDii.exe
  C:\Windows\System\KnecDii.exe
  2⤵
  PID:5356
- C:\Windows\System\qdwOAaf.exe
  C:\Windows\System\qdwOAaf.exe
  2⤵
  PID:6048
- C:\Windows\System\oQkwKBC.exe
  C:\Windows\System\oQkwKBC.exe
  2⤵
  PID:2916
- C:\Windows\System\Vennumt.exe
  C:\Windows\System\Vennumt.exe
  2⤵
  PID:6348
- C:\Windows\System\FJnDoWt.exe
  C:\Windows\System\FJnDoWt.exe
  2⤵
  PID:5092
- C:\Windows\System\LgoXOzg.exe
  C:\Windows\System\LgoXOzg.exe
  2⤵
  PID:5800
- C:\Windows\System\FSYqnRW.exe
  C:\Windows\System\FSYqnRW.exe
  2⤵
  PID:6844
- C:\Windows\System\HHUwYmN.exe
  C:\Windows\System\HHUwYmN.exe
  2⤵
  PID:4304
- C:\Windows\System\msawIPL.exe
  C:\Windows\System\msawIPL.exe
  2⤵
  PID:2920
- C:\Windows\System\LFfxIix.exe
  C:\Windows\System\LFfxIix.exe
  2⤵
  PID:5076
- C:\Windows\System\vnZJKpJ.exe
  C:\Windows\System\vnZJKpJ.exe
  2⤵
  PID:4556
- C:\Windows\System\mdQMJeg.exe
  C:\Windows\System\mdQMJeg.exe
  2⤵
  PID:4364
- C:\Windows\System\XFxpMCU.exe
  C:\Windows\System\XFxpMCU.exe
  2⤵
  PID:4212
- C:\Windows\System\QZqhPDP.exe
  C:\Windows\System\QZqhPDP.exe
  2⤵
  PID:4588
- C:\Windows\System\XmdLBOk.exe
  C:\Windows\System\XmdLBOk.exe
  2⤵
  PID:6008
- C:\Windows\System\AIkEyEb.exe
  C:\Windows\System\AIkEyEb.exe
  2⤵
  PID:5632
- C:\Windows\System\ANMlFuB.exe
  C:\Windows\System\ANMlFuB.exe
  2⤵
  PID:6812
- C:\Windows\System\EBlGUis.exe
  C:\Windows\System\EBlGUis.exe
  2⤵
  PID:6288
- C:\Windows\System\wAYcsPY.exe
  C:\Windows\System\wAYcsPY.exe
  2⤵
  PID:6560
- C:\Windows\System\HRaUedv.exe
  C:\Windows\System\HRaUedv.exe
  2⤵
  PID:4816
- C:\Windows\System\aUrWZLW.exe
  C:\Windows\System\aUrWZLW.exe
  2⤵
  PID:4300
- C:\Windows\System\zSWZwbs.exe
  C:\Windows\System\zSWZwbs.exe
  2⤵
  PID:4524
- C:\Windows\System\XkMLeWI.exe
  C:\Windows\System\XkMLeWI.exe
  2⤵
  PID:4380
- C:\Windows\System\SVFslEu.exe
  C:\Windows\System\SVFslEu.exe
  2⤵
  PID:6576
- C:\Windows\System\XTedauN.exe
  C:\Windows\System\XTedauN.exe
  2⤵
  PID:6768
- C:\Windows\System\agvDvsy.exe
  C:\Windows\System\agvDvsy.exe
  2⤵
  PID:7172
- C:\Windows\System\SWmahGx.exe
  C:\Windows\System\SWmahGx.exe
  2⤵
  PID:7188
- C:\Windows\System\bZgjgmF.exe
  C:\Windows\System\bZgjgmF.exe
  2⤵
  PID:7204
- C:\Windows\System\FwaEhpQ.exe
  C:\Windows\System\FwaEhpQ.exe
  2⤵
  PID:7220
- C:\Windows\System\frDDFNi.exe
  C:\Windows\System\frDDFNi.exe
  2⤵
  PID:7236
- C:\Windows\System\wWiBevk.exe
  C:\Windows\System\wWiBevk.exe
  2⤵
  PID:7252
- C:\Windows\System\wRnWDpB.exe
  C:\Windows\System\wRnWDpB.exe
  2⤵
  PID:7268
- C:\Windows\System\MgGlKiW.exe
  C:\Windows\System\MgGlKiW.exe
  2⤵
  PID:7284
- C:\Windows\System\xirUvmX.exe
  C:\Windows\System\xirUvmX.exe
  2⤵
  PID:7300
- C:\Windows\System\gBhOcBO.exe
  C:\Windows\System\gBhOcBO.exe
  2⤵
  PID:7316
- C:\Windows\System\gaMstuG.exe
  C:\Windows\System\gaMstuG.exe
  2⤵
  PID:7332
- C:\Windows\System\cpOVSFt.exe
  C:\Windows\System\cpOVSFt.exe
  2⤵
  PID:7348
- C:\Windows\System\jnjJwVP.exe
  C:\Windows\System\jnjJwVP.exe
  2⤵
  PID:7364
- C:\Windows\System\nxxJcVz.exe
  C:\Windows\System\nxxJcVz.exe
  2⤵
  PID:7380
- C:\Windows\System\yZWZFYB.exe
  C:\Windows\System\yZWZFYB.exe
  2⤵
  PID:7396
- C:\Windows\System\ukLwvUw.exe
  C:\Windows\System\ukLwvUw.exe
  2⤵
  PID:7412
- C:\Windows\System\vbVcrIr.exe
  C:\Windows\System\vbVcrIr.exe
  2⤵
  PID:7428
- C:\Windows\System\wbSRudg.exe
  C:\Windows\System\wbSRudg.exe
  2⤵
  PID:7444
- C:\Windows\System\NCPMIID.exe
  C:\Windows\System\NCPMIID.exe
  2⤵
  PID:7460
- C:\Windows\System\FuIeQQa.exe
  C:\Windows\System\FuIeQQa.exe
  2⤵
  PID:7476
- C:\Windows\System\CWsTPJv.exe
  C:\Windows\System\CWsTPJv.exe
  2⤵
  PID:7492
- C:\Windows\System\WpUGVNK.exe
  C:\Windows\System\WpUGVNK.exe
  2⤵
  PID:7508
- C:\Windows\System\NxKLXCQ.exe
  C:\Windows\System\NxKLXCQ.exe
  2⤵
  PID:7524
- C:\Windows\System\QGtbSIi.exe
  C:\Windows\System\QGtbSIi.exe
  2⤵
  PID:7540
- C:\Windows\System\oaJDZnj.exe
  C:\Windows\System\oaJDZnj.exe
  2⤵
  PID:7556
- C:\Windows\System\YleEGWd.exe
  C:\Windows\System\YleEGWd.exe
  2⤵
  PID:7572
- C:\Windows\System\SDwfbQQ.exe
  C:\Windows\System\SDwfbQQ.exe
  2⤵
  PID:7588
- C:\Windows\System\hwAucXL.exe
  C:\Windows\System\hwAucXL.exe
  2⤵
  PID:7604
- C:\Windows\System\BmsaSBW.exe
  C:\Windows\System\BmsaSBW.exe
  2⤵
  PID:7620
- C:\Windows\System\celccJz.exe
  C:\Windows\System\celccJz.exe
  2⤵
  PID:7636
- C:\Windows\System\HgIMRHd.exe
  C:\Windows\System\HgIMRHd.exe
  2⤵
  PID:7652
- C:\Windows\System\qJPXBII.exe
  C:\Windows\System\qJPXBII.exe
  2⤵
  PID:7668
- C:\Windows\System\MFeVJKd.exe
  C:\Windows\System\MFeVJKd.exe
  2⤵
  PID:7684
- C:\Windows\System\TgRISZe.exe
  C:\Windows\System\TgRISZe.exe
  2⤵
  PID:7700
- C:\Windows\System\QcgHENE.exe
  C:\Windows\System\QcgHENE.exe
  2⤵
  PID:7716
- C:\Windows\System\OoviTLs.exe
  C:\Windows\System\OoviTLs.exe
  2⤵
  PID:7732
- C:\Windows\System\PPheIyF.exe
  C:\Windows\System\PPheIyF.exe
  2⤵
  PID:7748
- C:\Windows\System\VtQkKDk.exe
  C:\Windows\System\VtQkKDk.exe
  2⤵
  PID:7764
- C:\Windows\System\iofQKpA.exe
  C:\Windows\System\iofQKpA.exe
  2⤵
  PID:7780
- C:\Windows\System\yDWZmGZ.exe
  C:\Windows\System\yDWZmGZ.exe
  2⤵
  PID:7796
- C:\Windows\System\AmrkoqV.exe
  C:\Windows\System\AmrkoqV.exe
  2⤵
  PID:7812
- C:\Windows\System\OAWuOsO.exe
  C:\Windows\System\OAWuOsO.exe
  2⤵
  PID:7828
- C:\Windows\System\NsrGRwg.exe
  C:\Windows\System\NsrGRwg.exe
  2⤵
  PID:7844
- C:\Windows\System\zrRMiPs.exe
  C:\Windows\System\zrRMiPs.exe
  2⤵
  PID:7860
- C:\Windows\System\jbRcBAA.exe
  C:\Windows\System\jbRcBAA.exe
  2⤵
  PID:7876
- C:\Windows\System\rSBkRuc.exe
  C:\Windows\System\rSBkRuc.exe
  2⤵
  PID:7892
- C:\Windows\System\qqfcitO.exe
  C:\Windows\System\qqfcitO.exe
  2⤵
  PID:7908
- C:\Windows\System\zZsIUZX.exe
  C:\Windows\System\zZsIUZX.exe
  2⤵
  PID:7924
- C:\Windows\System\CaiknUK.exe
  C:\Windows\System\CaiknUK.exe
  2⤵
  PID:7940
- C:\Windows\System\tIzbbfV.exe
  C:\Windows\System\tIzbbfV.exe
  2⤵
  PID:7956
- C:\Windows\System\YjtSYez.exe
  C:\Windows\System\YjtSYez.exe
  2⤵
  PID:7972
- C:\Windows\System\ESNChrB.exe
  C:\Windows\System\ESNChrB.exe
  2⤵
  PID:7988
- C:\Windows\System\GklKhsJ.exe
  C:\Windows\System\GklKhsJ.exe
  2⤵
  PID:8004
- C:\Windows\System\AznMXIT.exe
  C:\Windows\System\AznMXIT.exe
  2⤵
  PID:8020
- C:\Windows\System\hfuucOu.exe
  C:\Windows\System\hfuucOu.exe
  2⤵
  PID:8036
- C:\Windows\System\IFcSinH.exe
  C:\Windows\System\IFcSinH.exe
  2⤵
  PID:8052
- C:\Windows\System\MfncVuC.exe
  C:\Windows\System\MfncVuC.exe
  2⤵
  PID:8068
- C:\Windows\System\miKHqHv.exe
  C:\Windows\System\miKHqHv.exe
  2⤵
  PID:8084
- C:\Windows\System\WptyWvL.exe
  C:\Windows\System\WptyWvL.exe
  2⤵
  PID:8100
- C:\Windows\System\OdcKkkm.exe
  C:\Windows\System\OdcKkkm.exe
  2⤵
  PID:8116
- C:\Windows\System\BlVObgR.exe
  C:\Windows\System\BlVObgR.exe
  2⤵
  PID:8132
- C:\Windows\System\RDyEKrl.exe
  C:\Windows\System\RDyEKrl.exe
  2⤵
  PID:8148
- C:\Windows\System\zVXnkMj.exe
  C:\Windows\System\zVXnkMj.exe
  2⤵
  PID:8164
- C:\Windows\System\kZyNtBA.exe
  C:\Windows\System\kZyNtBA.exe
  2⤵
  PID:8180
- C:\Windows\System\GmGnCrG.exe
  C:\Windows\System\GmGnCrG.exe
  2⤵
  PID:6592
- C:\Windows\System\SuDErtq.exe
  C:\Windows\System\SuDErtq.exe
  2⤵
  PID:7232
- C:\Windows\System\WsQQRWS.exe
  C:\Windows\System\WsQQRWS.exe
  2⤵
  PID:5584
- C:\Windows\System\HhFtwLy.exe
  C:\Windows\System\HhFtwLy.exe
  2⤵
  PID:6192
- C:\Windows\System\HZEOzqk.exe
  C:\Windows\System\HZEOzqk.exe
  2⤵
  PID:7356
- C:\Windows\System\UPExahp.exe
  C:\Windows\System\UPExahp.exe
  2⤵
  PID:7392
- C:\Windows\System\tFYkwxS.exe
  C:\Windows\System\tFYkwxS.exe
  2⤵
  PID:7456
- C:\Windows\System\bNpLsWo.exe
  C:\Windows\System\bNpLsWo.exe
  2⤵
  PID:7488
- C:\Windows\System\hUFyTaU.exe
  C:\Windows\System\hUFyTaU.exe
  2⤵
  PID:7580
- C:\Windows\System\TOccCFq.exe
  C:\Windows\System\TOccCFq.exe
  2⤵
  PID:7244
- C:\Windows\System\wbUKxkS.exe
  C:\Windows\System\wbUKxkS.exe
  2⤵
  PID:5044
- C:\Windows\System\ormxyIj.exe
  C:\Windows\System\ormxyIj.exe
  2⤵
  PID:5668
- C:\Windows\System\aArDndj.exe
  C:\Windows\System\aArDndj.exe
  2⤵
  PID:5472
- C:\Windows\System\TrJDZoh.exe
  C:\Windows\System\TrJDZoh.exe
  2⤵
  PID:2364
- C:\Windows\System\vvsdgmS.exe
  C:\Windows\System\vvsdgmS.exe
  2⤵
  PID:7712
- C:\Windows\System\LJtaIOF.exe
  C:\Windows\System\LJtaIOF.exe
  2⤵
  PID:7064
- C:\Windows\System\LXQijuJ.exe
  C:\Windows\System\LXQijuJ.exe
  2⤵
  PID:5052
- C:\Windows\System\FecVLfp.exe
  C:\Windows\System\FecVLfp.exe
  2⤵
  PID:6256
- C:\Windows\System\eDKmhLF.exe
  C:\Windows\System\eDKmhLF.exe
  2⤵
  PID:7776
- C:\Windows\System\cScsiRT.exe
  C:\Windows\System\cScsiRT.exe
  2⤵
  PID:6948
- C:\Windows\System\ZKBcXQX.exe
  C:\Windows\System\ZKBcXQX.exe
  2⤵
  PID:7504
- C:\Windows\System\LuDOYIT.exe
  C:\Windows\System\LuDOYIT.exe
  2⤵
  PID:7596
- C:\Windows\System\DBddvih.exe
  C:\Windows\System\DBddvih.exe
  2⤵
  PID:7628
- C:\Windows\System\mUYwuMj.exe
  C:\Windows\System\mUYwuMj.exe
  2⤵
  PID:4892
- C:\Windows\System\WuRKdxt.exe
  C:\Windows\System\WuRKdxt.exe
  2⤵
  PID:6352
- C:\Windows\System\aXhWikG.exe
  C:\Windows\System\aXhWikG.exe
  2⤵
  PID:7376
- C:\Windows\System\enfPsOe.exe
  C:\Windows\System\enfPsOe.exe
  2⤵
  PID:4832
- C:\Windows\System\CeyuBaa.exe
  C:\Windows\System\CeyuBaa.exe
  2⤵
  PID:7248
- C:\Windows\System\rvPcdao.exe
  C:\Windows\System\rvPcdao.exe
  2⤵
  PID:7340
- C:\Windows\System\MTlCjAM.exe
  C:\Windows\System\MTlCjAM.exe
  2⤵
  PID:7440
- C:\Windows\System\jPZgRTv.exe
  C:\Windows\System\jPZgRTv.exe
  2⤵
  PID:7692
- C:\Windows\System\MaLlWzd.exe
  C:\Windows\System\MaLlWzd.exe
  2⤵
  PID:7852
- C:\Windows\System\gzXfpxG.exe
  C:\Windows\System\gzXfpxG.exe
  2⤵
  PID:7888
- C:\Windows\System\acqnEog.exe
  C:\Windows\System\acqnEog.exe
  2⤵
  PID:7936
- C:\Windows\System\IlHFsgp.exe
  C:\Windows\System\IlHFsgp.exe
  2⤵
  PID:7952
- C:\Windows\System\YYuUGFr.exe
  C:\Windows\System\YYuUGFr.exe
  2⤵
  PID:8000
- C:\Windows\System\ASotsZS.exe
  C:\Windows\System\ASotsZS.exe
  2⤵
  PID:8060
- C:\Windows\System\KqePTqm.exe
  C:\Windows\System\KqePTqm.exe
  2⤵
  PID:8096
- C:\Windows\System\cwmSNLn.exe
  C:\Windows\System\cwmSNLn.exe
  2⤵
  PID:8044
- C:\Windows\System\PrHrzgi.exe
  C:\Windows\System\PrHrzgi.exe
  2⤵
  PID:8076
- C:\Windows\System\yarmzFB.exe
  C:\Windows\System\yarmzFB.exe
  2⤵
  PID:8144
- C:\Windows\System\lKIwZOI.exe
  C:\Windows\System\lKIwZOI.exe
  2⤵
  PID:7264
- C:\Windows\System\NpQeyfS.exe
  C:\Windows\System\NpQeyfS.exe
  2⤵
  PID:7228
- C:\Windows\System\AGLEdwB.exe
  C:\Windows\System\AGLEdwB.exe
  2⤵
  PID:7328
- C:\Windows\System\BXwfLkl.exe
  C:\Windows\System\BXwfLkl.exe
  2⤵
  PID:7388
- C:\Windows\System\dJXXloe.exe
  C:\Windows\System\dJXXloe.exe
  2⤵
  PID:7552
- C:\Windows\System\evoSpXP.exe
  C:\Windows\System\evoSpXP.exe
  2⤵
  PID:7708
- C:\Windows\System\zpfgLcd.exe
  C:\Windows\System\zpfgLcd.exe
  2⤵
  PID:6884
- C:\Windows\System\laFooHl.exe
  C:\Windows\System\laFooHl.exe
  2⤵
  PID:7212
- C:\Windows\System\tqdjAVv.exe
  C:\Windows\System\tqdjAVv.exe
  2⤵
  PID:7160
- C:\Windows\System\bSyIYvc.exe
  C:\Windows\System\bSyIYvc.exe
  2⤵
  PID:6996
- C:\Windows\System\upZlXPK.exe
  C:\Windows\System\upZlXPK.exe
  2⤵
  PID:6620
- C:\Windows\System\nVfJTBo.exe
  C:\Windows\System\nVfJTBo.exe
  2⤵
  PID:7616
- C:\Windows\System\qVrzwdN.exe
  C:\Windows\System\qVrzwdN.exe
  2⤵
  PID:8140
- C:\Windows\System\IbjnnPZ.exe
  C:\Windows\System\IbjnnPZ.exe
  2⤵
  PID:7016
- C:\Windows\System\tAVryOv.exe
  C:\Windows\System\tAVryOv.exe
  2⤵
  PID:8112
- C:\Windows\System\ttFzIvc.exe
  C:\Windows\System\ttFzIvc.exe
  2⤵
  PID:7980
- C:\Windows\System\tFDtMvT.exe
  C:\Windows\System\tFDtMvT.exe
  2⤵
  PID:7996
- C:\Windows\System\iBpMdln.exe
  C:\Windows\System\iBpMdln.exe
  2⤵
  PID:8092
- C:\Windows\System\YHnhXlH.exe
  C:\Windows\System\YHnhXlH.exe
  2⤵
  PID:7296
- C:\Windows\System\ymLdGof.exe
  C:\Windows\System\ymLdGof.exe
  2⤵
  PID:5020
- C:\Windows\System\XSExVRF.exe
  C:\Windows\System\XSExVRF.exe
  2⤵
  PID:6656
- C:\Windows\System\GuHpwHm.exe
  C:\Windows\System\GuHpwHm.exe
  2⤵
  PID:7680
- C:\Windows\System\lmOaPtD.exe
  C:\Windows\System\lmOaPtD.exe
  2⤵
  PID:7532
- C:\Windows\System\KXrLTwJ.exe
  C:\Windows\System\KXrLTwJ.exe
  2⤵
  PID:7868
- C:\Windows\System\cdnQJkh.exe
  C:\Windows\System\cdnQJkh.exe
  2⤵
  PID:7728
- C:\Windows\System\EOSuEbP.exe
  C:\Windows\System\EOSuEbP.exe
  2⤵
  PID:7948
- C:\Windows\System\UxHkqtN.exe
  C:\Windows\System\UxHkqtN.exe
  2⤵
  PID:8080
- C:\Windows\System\WZUJBrr.exe
  C:\Windows\System\WZUJBrr.exe
  2⤵
  PID:7836
- C:\Windows\System\FnXqwBR.exe
  C:\Windows\System\FnXqwBR.exe
  2⤵
  PID:7548
- C:\Windows\System\gWMRtoE.exe
  C:\Windows\System\gWMRtoE.exe
  2⤵
  PID:6828
- C:\Windows\System\uzMtsGO.exe
  C:\Windows\System\uzMtsGO.exe
  2⤵
  PID:7184
- C:\Windows\System\qWAwlDc.exe
  C:\Windows\System\qWAwlDc.exe
  2⤵
  PID:4496
- C:\Windows\System\QlnNUdG.exe
  C:\Windows\System\QlnNUdG.exe
  2⤵
  PID:7372
- C:\Windows\System\RMCMHly.exe
  C:\Windows\System\RMCMHly.exe
  2⤵
  PID:7788
- C:\Windows\System\xXtpHfv.exe
  C:\Windows\System\xXtpHfv.exe
  2⤵
  PID:7820
- C:\Windows\System\LjaYBsx.exe
  C:\Windows\System\LjaYBsx.exe
  2⤵
  PID:7900
- C:\Windows\System\XkSGAlK.exe
  C:\Windows\System\XkSGAlK.exe
  2⤵
  PID:7108
- C:\Windows\System\PnKBiME.exe
  C:\Windows\System\PnKBiME.exe
  2⤵
  PID:7564
- C:\Windows\System\ftJFYOd.exe
  C:\Windows\System\ftJFYOd.exe
  2⤵
  PID:7984
- C:\Windows\System\ersANCu.exe
  C:\Windows\System\ersANCu.exe
  2⤵
  PID:3624
- C:\Windows\System\MzZjgpT.exe
  C:\Windows\System\MzZjgpT.exe
  2⤵
  PID:6816
- C:\Windows\System\LbFFZWa.exe
  C:\Windows\System\LbFFZWa.exe
  2⤵
  PID:8260
- C:\Windows\System\NUvcAqa.exe
  C:\Windows\System\NUvcAqa.exe
  2⤵
  PID:8276
- C:\Windows\System\fApuHeB.exe
  C:\Windows\System\fApuHeB.exe
  2⤵
  PID:8296
- C:\Windows\System\lLzryaC.exe
  C:\Windows\System\lLzryaC.exe
  2⤵
  PID:8320
- C:\Windows\System\UpfYQpT.exe
  C:\Windows\System\UpfYQpT.exe
  2⤵
  PID:8380
- C:\Windows\System\ZlcORlr.exe
  C:\Windows\System\ZlcORlr.exe
  2⤵
  PID:8472
- C:\Windows\System\QeWxXZy.exe
  C:\Windows\System\QeWxXZy.exe
  2⤵
  PID:8524
- C:\Windows\System\qgoEOel.exe
  C:\Windows\System\qgoEOel.exe
  2⤵
  PID:8560
- C:\Windows\System\JDIXsyX.exe
  C:\Windows\System\JDIXsyX.exe
  2⤵
  PID:8576
- C:\Windows\System\lNTUOAq.exe
  C:\Windows\System\lNTUOAq.exe
  2⤵
  PID:8600
- C:\Windows\System\iDBVMvr.exe
  C:\Windows\System\iDBVMvr.exe
  2⤵
  PID:8624
- C:\Windows\System\kcOIAmI.exe
  C:\Windows\System\kcOIAmI.exe
  2⤵
  PID:8644
- C:\Windows\System\tDJzNOG.exe
  C:\Windows\System\tDJzNOG.exe
  2⤵
  PID:8660
- C:\Windows\System\hTcwFNV.exe
  C:\Windows\System\hTcwFNV.exe
  2⤵
  PID:8676
- C:\Windows\System\FogBDXb.exe
  C:\Windows\System\FogBDXb.exe
  2⤵
  PID:8692
- C:\Windows\System\UxCBebj.exe
  C:\Windows\System\UxCBebj.exe
  2⤵
  PID:8708
- C:\Windows\System\VFPruIN.exe
  C:\Windows\System\VFPruIN.exe
  2⤵
  PID:8724
- C:\Windows\System\YqAIJWe.exe
  C:\Windows\System\YqAIJWe.exe
  2⤵
  PID:8740
- C:\Windows\System\TnWugXP.exe
  C:\Windows\System\TnWugXP.exe
  2⤵
  PID:8756
- C:\Windows\System\GuqeqnY.exe
  C:\Windows\System\GuqeqnY.exe
  2⤵
  PID:8772
- C:\Windows\System\RLkiEAE.exe
  C:\Windows\System\RLkiEAE.exe
  2⤵
  PID:8788
- C:\Windows\System\wqdSGYf.exe
  C:\Windows\System\wqdSGYf.exe
  2⤵
  PID:8804
- C:\Windows\System\gSIAgpp.exe
  C:\Windows\System\gSIAgpp.exe
  2⤵
  PID:8820
- C:\Windows\System\PCAfqPT.exe
  C:\Windows\System\PCAfqPT.exe
  2⤵
  PID:8836
- C:\Windows\System\mCKvhQT.exe
  C:\Windows\System\mCKvhQT.exe
  2⤵
  PID:8852
- C:\Windows\System\nnsnkRL.exe
  C:\Windows\System\nnsnkRL.exe
  2⤵
  PID:8868
- C:\Windows\System\VVXalfP.exe
  C:\Windows\System\VVXalfP.exe
  2⤵
  PID:8888
- C:\Windows\System\zDaSfna.exe
  C:\Windows\System\zDaSfna.exe
  2⤵
  PID:8904
- C:\Windows\System\ZWteIld.exe
  C:\Windows\System\ZWteIld.exe
  2⤵
  PID:8920
- C:\Windows\System\MJPFLAj.exe
  C:\Windows\System\MJPFLAj.exe
  2⤵
  PID:8936
- C:\Windows\System\peeRfbo.exe
  C:\Windows\System\peeRfbo.exe
  2⤵
  PID:8952
- C:\Windows\System\nVdfSfp.exe
  C:\Windows\System\nVdfSfp.exe
  2⤵
  PID:8968
- C:\Windows\System\CcgMbht.exe
  C:\Windows\System\CcgMbht.exe
  2⤵
  PID:8984
- C:\Windows\System\WJnjYsB.exe
  C:\Windows\System\WJnjYsB.exe
  2⤵
  PID:9000
- C:\Windows\System\tzRXRFH.exe
  C:\Windows\System\tzRXRFH.exe
  2⤵
  PID:9016
- C:\Windows\System\PqUWyLO.exe
  C:\Windows\System\PqUWyLO.exe
  2⤵
  PID:9032
- C:\Windows\System\WcqKToS.exe
  C:\Windows\System\WcqKToS.exe
  2⤵
  PID:9048
- C:\Windows\System\WXgJQaS.exe
  C:\Windows\System\WXgJQaS.exe
  2⤵
  PID:9064
- C:\Windows\System\FLljGpJ.exe
  C:\Windows\System\FLljGpJ.exe
  2⤵
  PID:9080
- C:\Windows\System\yWbqiac.exe
  C:\Windows\System\yWbqiac.exe
  2⤵
  PID:9096
- C:\Windows\System\NxHCRWC.exe
  C:\Windows\System\NxHCRWC.exe
  2⤵
  PID:9112
- C:\Windows\System\xkGXuhZ.exe
  C:\Windows\System\xkGXuhZ.exe
  2⤵
  PID:9128
- C:\Windows\System\okhbWVT.exe
  C:\Windows\System\okhbWVT.exe
  2⤵
  PID:9144
- C:\Windows\System\lJgIxZo.exe
  C:\Windows\System\lJgIxZo.exe
  2⤵
  PID:9160
- C:\Windows\System\LRexIGx.exe
  C:\Windows\System\LRexIGx.exe
  2⤵
  PID:9176
- C:\Windows\System\LrfTTzU.exe
  C:\Windows\System\LrfTTzU.exe
  2⤵
  PID:9192
- C:\Windows\System\PERftuQ.exe
  C:\Windows\System\PERftuQ.exe
  2⤵
  PID:9208
- C:\Windows\System\FhrPTDl.exe
  C:\Windows\System\FhrPTDl.exe
  2⤵
  PID:7824
- C:\Windows\System\TYFopCK.exe
  C:\Windows\System\TYFopCK.exe
  2⤵
  PID:8196
- C:\Windows\System\TlMBlyN.exe
  C:\Windows\System\TlMBlyN.exe
  2⤵
  PID:8240
- C:\Windows\System\SbsVTTb.exe
  C:\Windows\System\SbsVTTb.exe
  2⤵
  PID:8188
- C:\Windows\System\ZbvbMyI.exe
  C:\Windows\System\ZbvbMyI.exe
  2⤵
  PID:8220
- C:\Windows\System\BBsBikX.exe
  C:\Windows\System\BBsBikX.exe
  2⤵
  PID:8244
- C:\Windows\System\BQpZqBW.exe
  C:\Windows\System\BQpZqBW.exe
  2⤵
  PID:8268
- C:\Windows\System\eAMvwWg.exe
  C:\Windows\System\eAMvwWg.exe
  2⤵
  PID:8316
- C:\Windows\System\zCakeIM.exe
  C:\Windows\System\zCakeIM.exe
  2⤵
  PID:8288
- C:\Windows\System\JhAbfDQ.exe
  C:\Windows\System\JhAbfDQ.exe
  2⤵
  PID:8392
- C:\Windows\System\dlkTsGr.exe
  C:\Windows\System\dlkTsGr.exe
  2⤵
  PID:8364
- C:\Windows\System\OEkgfwb.exe
  C:\Windows\System\OEkgfwb.exe
  2⤵
  PID:8352
- C:\Windows\System\UoYudnG.exe
  C:\Windows\System\UoYudnG.exe
  2⤵
  PID:8448
- C:\Windows\System\UoaKNWb.exe
  C:\Windows\System\UoaKNWb.exe
  2⤵
  PID:8428
- C:\Windows\System\sAhkpLY.exe
  C:\Windows\System\sAhkpLY.exe
  2⤵
  PID:8444
- C:\Windows\System\Wrabhby.exe
  C:\Windows\System\Wrabhby.exe
  2⤵
  PID:8464
- C:\Windows\System\JBtUJbe.exe
  C:\Windows\System\JBtUJbe.exe
  2⤵
  PID:8488
- C:\Windows\System\IfOcfsy.exe
  C:\Windows\System\IfOcfsy.exe
  2⤵
  PID:8504
- C:\Windows\System\lXNUBaB.exe
  C:\Windows\System\lXNUBaB.exe
  2⤵
  PID:8684
- C:\Windows\System\nrUMbkH.exe
  C:\Windows\System\nrUMbkH.exe
  2⤵
  PID:8844
- C:\Windows\System\msdsFRF.exe
  C:\Windows\System\msdsFRF.exe
  2⤵
  PID:8944
- C:\Windows\System\XgRnCAD.exe
  C:\Windows\System\XgRnCAD.exe
  2⤵
  PID:9008
- C:\Windows\System\MKJcGEG.exe
  C:\Windows\System\MKJcGEG.exe
  2⤵
  PID:9072
- C:\Windows\System\rdQdorv.exe
  C:\Windows\System\rdQdorv.exe
  2⤵
  PID:8828
- C:\Windows\System\FxSPaXd.exe
  C:\Windows\System\FxSPaXd.exe
  2⤵
  PID:9172
- C:\Windows\System\VbWMmvs.exe
  C:\Windows\System\VbWMmvs.exe
  2⤵
  PID:8700
- C:\Windows\System\bWDdbDq.exe
  C:\Windows\System\bWDdbDq.exe
  2⤵
  PID:8896
- C:\Windows\System\QQjYXzb.exe
  C:\Windows\System\QQjYXzb.exe
  2⤵
  PID:8996
- C:\Windows\System\tthCwcb.exe
  C:\Windows\System\tthCwcb.exe
  2⤵
  PID:8704
- C:\Windows\System\hdQgxcT.exe
  C:\Windows\System\hdQgxcT.exe
  2⤵
  PID:8800
- C:\Windows\System\vASnuXw.exe
  C:\Windows\System\vASnuXw.exe
  2⤵
  PID:8964
- C:\Windows\System\hgjgntr.exe
  C:\Windows\System\hgjgntr.exe
  2⤵
  PID:3304
- C:\Windows\System\fAJZwuT.exe
  C:\Windows\System\fAJZwuT.exe
  2⤵
  PID:8356
- C:\Windows\System\OlslbGw.exe
  C:\Windows\System\OlslbGw.exe
  2⤵
  PID:8480
- C:\Windows\System\WmJTwrX.exe
  C:\Windows\System\WmJTwrX.exe
  2⤵
  PID:8396
- C:\Windows\System\BqqOMxu.exe
  C:\Windows\System\BqqOMxu.exe
  2⤵
  PID:8456
- C:\Windows\System\vRmFXpE.exe
  C:\Windows\System\vRmFXpE.exe
  2⤵
  PID:8540
- C:\Windows\System\bqtRvJJ.exe
  C:\Windows\System\bqtRvJJ.exe
  2⤵
  PID:8552
- C:\Windows\System\RcEJUVz.exe
  C:\Windows\System\RcEJUVz.exe
  2⤵
  PID:8548
- C:\Windows\System\TdXIjXE.exe
  C:\Windows\System\TdXIjXE.exe
  2⤵
  PID:8584
- C:\Windows\System\nnQaqQg.exe
  C:\Windows\System\nnQaqQg.exe
  2⤵
  PID:8748
- C:\Windows\System\zqpESjX.exe
  C:\Windows\System\zqpESjX.exe
  2⤵
  PID:8640
- C:\Windows\System\cVYZzRe.exe
  C:\Windows\System\cVYZzRe.exe
  2⤵
  PID:8752
- C:\Windows\System\DMRycGW.exe
  C:\Windows\System\DMRycGW.exe
  2⤵
  PID:8688
- C:\Windows\System\iWnhzxO.exe
  C:\Windows\System\iWnhzxO.exe
  2⤵
  PID:9104
- C:\Windows\System\yKZpzrR.exe
  C:\Windows\System\yKZpzrR.exe
  2⤵
  PID:9204
- C:\Windows\System\MoszpSs.exe
  C:\Windows\System\MoszpSs.exe
  2⤵
  PID:8960
- C:\Windows\System\hOMScWV.exe
  C:\Windows\System\hOMScWV.exe
  2⤵
  PID:9056
- C:\Windows\System\jfthzwp.exe
  C:\Windows\System\jfthzwp.exe
  2⤵
  PID:8876
- C:\Windows\System\lVMkwCx.exe
  C:\Windows\System\lVMkwCx.exe
  2⤵
  PID:8916
- C:\Windows\System\xzFzWAt.exe
  C:\Windows\System\xzFzWAt.exe
  2⤵
  PID:9168
- C:\Windows\System\WjJMzpc.exe
  C:\Windows\System\WjJMzpc.exe
  2⤵
  PID:8928
- C:\Windows\System\VCqNHrH.exe
  C:\Windows\System\VCqNHrH.exe
  2⤵
  PID:8860
- C:\Windows\System\KLFMatA.exe
  C:\Windows\System\KLFMatA.exe
  2⤵
  PID:8200
- C:\Windows\System\fiILYnB.exe
  C:\Windows\System\fiILYnB.exe
  2⤵
  PID:8236
- C:\Windows\System\VMljlFM.exe
  C:\Windows\System\VMljlFM.exe
  2⤵
  PID:8252
- C:\Windows\System\yNnRoxT.exe
  C:\Windows\System\yNnRoxT.exe
  2⤵
  PID:8304
- C:\Windows\System\NgtCQAE.exe
  C:\Windows\System\NgtCQAE.exe
  2⤵
  PID:8368
- C:\Windows\System\LCkrdBZ.exe
  C:\Windows\System\LCkrdBZ.exe
  2⤵
  PID:8736
- C:\Windows\System\dEeDBBX.exe
  C:\Windows\System\dEeDBBX.exe
  2⤵
  PID:9188
- C:\Windows\System\UvBTIXn.exe
  C:\Windows\System\UvBTIXn.exe
  2⤵
  PID:8520
- C:\Windows\System\yyRMgle.exe
  C:\Windows\System\yyRMgle.exe
  2⤵
  PID:8372
- C:\Windows\System\tLWZpal.exe
  C:\Windows\System\tLWZpal.exe
  2⤵
  PID:8420
- C:\Windows\System\kZAwuxZ.exe
  C:\Windows\System\kZAwuxZ.exe
  2⤵
  PID:8532
- C:\Windows\System\DfVBBFe.exe
  C:\Windows\System\DfVBBFe.exe
  2⤵
  PID:9108
- C:\Windows\System\SGtLAPl.exe
  C:\Windows\System\SGtLAPl.exe
  2⤵
  PID:9140
- C:\Windows\System\IUhZcDb.exe
  C:\Windows\System\IUhZcDb.exe
  2⤵
  PID:8312
- C:\Windows\System\EbKxtSA.exe
  C:\Windows\System\EbKxtSA.exe
  2⤵
  PID:8544
- C:\Windows\System\SCscKWS.exe
  C:\Windows\System\SCscKWS.exe
  2⤵
  PID:8784
- C:\Windows\System\ROvnrmr.exe
  C:\Windows\System\ROvnrmr.exe
  2⤵
  PID:8652
- C:\Windows\System\wofszdJ.exe
  C:\Windows\System\wofszdJ.exe
  2⤵
  PID:9060
- C:\Windows\System\edBiKri.exe
  C:\Windows\System\edBiKri.exe
  2⤵
  PID:8672
- C:\Windows\System\cAHKULr.exe
  C:\Windows\System\cAHKULr.exe
  2⤵
  PID:8976
- C:\Windows\System\eBcauSu.exe
  C:\Windows\System\eBcauSu.exe
  2⤵
  PID:8388
- C:\Windows\System\XoBUSrp.exe
  C:\Windows\System\XoBUSrp.exe
  2⤵
  PID:8516
- C:\Windows\System\AmKGuDb.exe
  C:\Windows\System\AmKGuDb.exe
  2⤵
  PID:9228
- C:\Windows\System\koXmEba.exe
  C:\Windows\System\koXmEba.exe
  2⤵
  PID:9248
- C:\Windows\System\YXNjIgb.exe
  C:\Windows\System\YXNjIgb.exe
  2⤵
  PID:9268
- C:\Windows\System\hInIguD.exe
  C:\Windows\System\hInIguD.exe
  2⤵
  PID:9284
- C:\Windows\System\VCwOEip.exe
  C:\Windows\System\VCwOEip.exe
  2⤵
  PID:9300
- C:\Windows\System\kNNfvoC.exe
  C:\Windows\System\kNNfvoC.exe
  2⤵
  PID:9316
- C:\Windows\System\NvZFSvG.exe
  C:\Windows\System\NvZFSvG.exe
  2⤵
  PID:9332
- C:\Windows\System\mPLSztu.exe
  C:\Windows\System\mPLSztu.exe
  2⤵
  PID:9348
- C:\Windows\System\cQCoQCT.exe
  C:\Windows\System\cQCoQCT.exe
  2⤵
  PID:9364
- C:\Windows\System\ksnSnZv.exe
  C:\Windows\System\ksnSnZv.exe
  2⤵
  PID:9380
- C:\Windows\System\ckFQbnL.exe
  C:\Windows\System\ckFQbnL.exe
  2⤵
  PID:9396
- C:\Windows\System\zSHHBAo.exe
  C:\Windows\System\zSHHBAo.exe
  2⤵
  PID:9412
- C:\Windows\System\ZwoqOCG.exe
  C:\Windows\System\ZwoqOCG.exe
  2⤵
  PID:9428
- C:\Windows\System\yxXmqke.exe
  C:\Windows\System\yxXmqke.exe
  2⤵
  PID:9444
- C:\Windows\System\RuRKtWH.exe
  C:\Windows\System\RuRKtWH.exe
  2⤵
  PID:9460
- C:\Windows\System\qBbEgJk.exe
  C:\Windows\System\qBbEgJk.exe
  2⤵
  PID:9476
- C:\Windows\System\gHPRzno.exe
  C:\Windows\System\gHPRzno.exe
  2⤵
  PID:9492
- C:\Windows\System\xVwOVlh.exe
  C:\Windows\System\xVwOVlh.exe
  2⤵
  PID:9508
- C:\Windows\System\HMGcJfg.exe
  C:\Windows\System\HMGcJfg.exe
  2⤵
  PID:9524
- C:\Windows\System\lURMVcG.exe
  C:\Windows\System\lURMVcG.exe
  2⤵
  PID:9540
- C:\Windows\System\eRiQNyK.exe
  C:\Windows\System\eRiQNyK.exe
  2⤵
  PID:9556
- C:\Windows\System\lwTIPsh.exe
  C:\Windows\System\lwTIPsh.exe
  2⤵
  PID:9572
- C:\Windows\System\HUyFtlK.exe
  C:\Windows\System\HUyFtlK.exe
  2⤵
  PID:9588
- C:\Windows\System\SXhgrwR.exe
  C:\Windows\System\SXhgrwR.exe
  2⤵
  PID:9604
- C:\Windows\System\EqaNRvS.exe
  C:\Windows\System\EqaNRvS.exe
  2⤵
  PID:9624
- C:\Windows\System\EVwNKto.exe
  C:\Windows\System\EVwNKto.exe
  2⤵
  PID:9640
- C:\Windows\System\fsFfuWI.exe
  C:\Windows\System\fsFfuWI.exe
  2⤵
  PID:9656
- C:\Windows\System\ubBZPIy.exe
  C:\Windows\System\ubBZPIy.exe
  2⤵
  PID:9672
- C:\Windows\System\BYKfojy.exe
  C:\Windows\System\BYKfojy.exe
  2⤵
  PID:9688
- C:\Windows\System\GqLHWNl.exe
  C:\Windows\System\GqLHWNl.exe
  2⤵
  PID:9704
- C:\Windows\System\IqxRyQe.exe
  C:\Windows\System\IqxRyQe.exe
  2⤵
  PID:9720
- C:\Windows\System\fZHxHhC.exe
  C:\Windows\System\fZHxHhC.exe
  2⤵
  PID:9736
- C:\Windows\System\opKlOhO.exe
  C:\Windows\System\opKlOhO.exe
  2⤵
  PID:9752
- C:\Windows\System\oMROxbl.exe
  C:\Windows\System\oMROxbl.exe
  2⤵
  PID:9768
- C:\Windows\System\kYjzOYJ.exe
  C:\Windows\System\kYjzOYJ.exe
  2⤵
  PID:9784
- C:\Windows\System\VrndSqw.exe
  C:\Windows\System\VrndSqw.exe
  2⤵
  PID:9800
- C:\Windows\System\MlHjEWa.exe
  C:\Windows\System\MlHjEWa.exe
  2⤵
  PID:9820
- C:\Windows\System\BhACJdd.exe
  C:\Windows\System\BhACJdd.exe
  2⤵
  PID:9836
- C:\Windows\System\cvosjfA.exe
  C:\Windows\System\cvosjfA.exe
  2⤵
  PID:9856
- C:\Windows\System\BjmKMPe.exe
  C:\Windows\System\BjmKMPe.exe
  2⤵
  PID:9872
- C:\Windows\System\lVpbpQH.exe
  C:\Windows\System\lVpbpQH.exe
  2⤵
  PID:9888
- C:\Windows\System\PCdGpMG.exe
  C:\Windows\System\PCdGpMG.exe
  2⤵
  PID:9908
- C:\Windows\System\AwzIxOr.exe
  C:\Windows\System\AwzIxOr.exe
  2⤵
  PID:9928
- C:\Windows\System\woUiKrz.exe
  C:\Windows\System\woUiKrz.exe
  2⤵
  PID:9944
- C:\Windows\System\mZzobfb.exe
  C:\Windows\System\mZzobfb.exe
  2⤵
  PID:9960
- C:\Windows\System\kduzKwK.exe
  C:\Windows\System\kduzKwK.exe
  2⤵
  PID:9976
- C:\Windows\System\pfdhlgF.exe
  C:\Windows\System\pfdhlgF.exe
  2⤵
  PID:9992
- C:\Windows\System\MllCUxV.exe
  C:\Windows\System\MllCUxV.exe
  2⤵
  PID:10008
- C:\Windows\System\wJOSdlB.exe
  C:\Windows\System\wJOSdlB.exe
  2⤵
  PID:10028
- C:\Windows\System\KhPyxqI.exe
  C:\Windows\System\KhPyxqI.exe
  2⤵
  PID:10048
- C:\Windows\System\ksOWwPM.exe
  C:\Windows\System\ksOWwPM.exe
  2⤵
  PID:10064
- C:\Windows\System\rXOvpMx.exe
  C:\Windows\System\rXOvpMx.exe
  2⤵
  PID:10080
- C:\Windows\System\sxRudXR.exe
  C:\Windows\System\sxRudXR.exe
  2⤵
  PID:10096
- C:\Windows\System\YmTZATM.exe
  C:\Windows\System\YmTZATM.exe
  2⤵
  PID:10112
- C:\Windows\System\djBbhBz.exe
  C:\Windows\System\djBbhBz.exe
  2⤵
  PID:10128
- C:\Windows\System\DcMUfjJ.exe
  C:\Windows\System\DcMUfjJ.exe
  2⤵
  PID:10148
- C:\Windows\System\ZkvXPmr.exe
  C:\Windows\System\ZkvXPmr.exe
  2⤵
  PID:10164
- C:\Windows\System\zpPfmuX.exe
  C:\Windows\System\zpPfmuX.exe
  2⤵
  PID:10180
- C:\Windows\System\KQsBINt.exe
  C:\Windows\System\KQsBINt.exe
  2⤵
  PID:10200
- C:\Windows\System\voeYJGk.exe
  C:\Windows\System\voeYJGk.exe
  2⤵
  PID:10216
- C:\Windows\System\nCzTfpY.exe
  C:\Windows\System\nCzTfpY.exe
  2⤵
  PID:10236
- C:\Windows\System\UDXiDqe.exe
  C:\Windows\System\UDXiDqe.exe
  2⤵
  PID:9292
- C:\Windows\System\nJhaqTD.exe
  C:\Windows\System\nJhaqTD.exe
  2⤵
  PID:9356
- C:\Windows\System\kdizTJj.exe
  C:\Windows\System\kdizTJj.exe
  2⤵
  PID:9420
- C:\Windows\System\nSemQVQ.exe
  C:\Windows\System\nSemQVQ.exe
  2⤵
  PID:9484
- C:\Windows\System\psQqtJo.exe
  C:\Windows\System\psQqtJo.exe
  2⤵
  PID:9548
- C:\Windows\System\agEufto.exe
  C:\Windows\System\agEufto.exe
  2⤵
  PID:9616
- C:\Windows\System\iKiBePV.exe
  C:\Windows\System\iKiBePV.exe
  2⤵
  PID:8568
- C:\Windows\System\tBLuFbQ.exe
  C:\Windows\System\tBLuFbQ.exe
  2⤵
  PID:9652
- C:\Windows\System\aPzRMlb.exe
  C:\Windows\System\aPzRMlb.exe
  2⤵
  PID:9344
- C:\Windows\System\SCMWsLo.exe
  C:\Windows\System\SCMWsLo.exe
  2⤵
  PID:7500
- C:\Windows\System\eGriRFr.exe
  C:\Windows\System\eGriRFr.exe
  2⤵
  PID:9776
- C:\Windows\System\synHUrc.exe
  C:\Windows\System\synHUrc.exe
  2⤵
  PID:8816
- C:\Windows\System\yEDAzjQ.exe
  C:\Windows\System\yEDAzjQ.exe
  2⤵
  PID:9240
- C:\Windows\System\fNhIAZV.exe
  C:\Windows\System\fNhIAZV.exe
  2⤵
  PID:9536
- C:\Windows\System\aynuOGN.exe
  C:\Windows\System\aynuOGN.exe
  2⤵
  PID:9600
- C:\Windows\System\YTMnjOo.exe
  C:\Windows\System\YTMnjOo.exe
  2⤵
  PID:9632
- C:\Windows\System\oOPHPII.exe
  C:\Windows\System\oOPHPII.exe
  2⤵
  PID:9664
- C:\Windows\System\RxdUbiG.exe
  C:\Windows\System\RxdUbiG.exe
  2⤵
  PID:9764
- C:\Windows\System\oRBiVWf.exe
  C:\Windows\System\oRBiVWf.exe
  2⤵
  PID:9868
- C:\Windows\System\yjmNbSG.exe
  C:\Windows\System\yjmNbSG.exe
  2⤵
  PID:9952
- C:\Windows\System\WINdlne.exe
  C:\Windows\System\WINdlne.exe
  2⤵
  PID:10016
- C:\Windows\System\AqjrxRm.exe
  C:\Windows\System\AqjrxRm.exe
  2⤵
  PID:10060
- C:\Windows\System\jYBAOmk.exe
  C:\Windows\System\jYBAOmk.exe
  2⤵
  PID:9900
- C:\Windows\System\rBDkVYY.exe
  C:\Windows\System\rBDkVYY.exe
  2⤵
  PID:9936
- C:\Windows\System\BTZSVJL.exe
  C:\Windows\System\BTZSVJL.exe
  2⤵
  PID:10156
- C:\Windows\System\EfGNyGT.exe
  C:\Windows\System\EfGNyGT.exe
  2⤵
  PID:9972
- C:\Windows\System\AWoJekY.exe
  C:\Windows\System\AWoJekY.exe
  2⤵
  PID:10188
- C:\Windows\System\igRidEb.exe
  C:\Windows\System\igRidEb.exe
  2⤵
  PID:10076
- C:\Windows\System\AvHCzqD.exe
  C:\Windows\System\AvHCzqD.exe
  2⤵
  PID:10140
- C:\Windows\System\iPhAGqo.exe
  C:\Windows\System\iPhAGqo.exe
  2⤵
  PID:10172
- C:\Windows\System\PxjeVok.exe
  C:\Windows\System\PxjeVok.exe
  2⤵
  PID:9452
- C:\Windows\System\ourArUY.exe
  C:\Windows\System\ourArUY.exe
  2⤵
  PID:10212
- C:\Windows\System\iTdjaFD.exe
  C:\Windows\System\iTdjaFD.exe
  2⤵
  PID:8376
- C:\Windows\System\MWzgzWd.exe
  C:\Windows\System\MWzgzWd.exe
  2⤵
  PID:9520
- C:\Windows\System\sjlLyMU.exe
  C:\Windows\System\sjlLyMU.exe
  2⤵
  PID:9648
- C:\Windows\System\qoWbFLg.exe
  C:\Windows\System\qoWbFLg.exe
  2⤵
  PID:9748
- C:\Windows\System\npoLRUX.exe
  C:\Windows\System\npoLRUX.exe
  2⤵
  PID:9340
- C:\Windows\System\ZjpYNlL.exe
  C:\Windows\System\ZjpYNlL.exe
  2⤵
  PID:9088
- C:\Windows\System\uiqEtco.exe
  C:\Windows\System\uiqEtco.exe
  2⤵
  PID:9312
- C:\Windows\System\osLCyDm.exe
  C:\Windows\System\osLCyDm.exe
  2⤵
  PID:7612
- C:\Windows\System\qyCpumH.exe
  C:\Windows\System\qyCpumH.exe
  2⤵
  PID:9276
- C:\Windows\System\voCxoTC.exe
  C:\Windows\System\voCxoTC.exe
  2⤵
  PID:9376
- C:\Windows\System\kUWwCiY.exe
  C:\Windows\System\kUWwCiY.exe
  2⤵
  PID:9468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AnBUFUQ.exe

Filesize
1.9MB

MD5
2faaedb996ae53b8ceac71b30aec0d78

SHA1
80cf685a498313754a50c02c0653c20fd4839b1b

SHA256
ab2b161fd61bdafcc49a1256f1bf2a81a2e1d7a29fb563046e6bc5038b8756a2

SHA512
2984eccd495ae847b91418c410337adeb4f92dd26c7c3ae21373657cdd574aed6e476fbdc0b838ce213248a210d5d3e0eda294435696197ff1cf6c9964db5e07

Download Submit
C:\Windows\system\DTzGnSo.exe

Filesize
1.9MB

MD5
849423e7af072b2b6bc5f86024790389

SHA1
1d4e31e8793f5668b81e989a23c0e7c7d0b7facd

SHA256
5979558171508f1cd73b31ddd02df121fd86295a69cd0142baf894ff46fef841

SHA512
70bb7722958fc4a037f46f683507a252fab996caadb2f67330b09208a8a19c50b3f5c9bb82ea338c84411875310406a1e8f247a4c71bfbf18e489346126718bd

Download Submit
C:\Windows\system\FHTYMiE.exe

Filesize
1.9MB

MD5
05893369b03342983a988b730492e37f

SHA1
4af30040117f11770295600d7dfc7a40de62b06f

SHA256
7babbaa73c20a74b22a6df3f64b8aa871bb929e5d1c5af9ae562d42ebbc9be8a

SHA512
83d0ebc4d676643c82d5747e7ed1321546a336c92ca7dc03987a864740668b6baf4f7a79de4fbbbc6fa90be8ef285f650f366d970c8c63534e264c6a78dba588

Download Submit
C:\Windows\system\HdwVsCk.exe

Filesize
1.9MB

MD5
56b2e3bb1fabcce6378c49c28a1eec6d

SHA1
4f9ca51e34fa33bb12cb4b89c6bf614dfff3daa9

SHA256
1307848d9a00ad8e9d310639b2e3137df24a9050757e347070185861a5b322e0

SHA512
5e53be58e61097f15a20dfd23308c065ca4eeae1e0a9e1b7f39e4abe2c2b5db8b7fdf0a1ddb74760c6a6029eb89824e23c877371cfb7598c22b0113160dc1102

Download Submit
C:\Windows\system\KpxUCPG.exe

Filesize
1.9MB

MD5
fb2d9ee01fca09314e1bd5c79be1bd8a

SHA1
128f4e8d639246b0cc1f5f4a65d5c4869a7bf018

SHA256
fd948e0910239a4ca83134f685abab111623029c0155a9785686f65f89957a8b

SHA512
3b75ae7d245b3e8618776aa940b10a72a477b4bd4a9e1c2dd19615ef197b560b53530f721cc9dd523fe7289d4d3cc36d097c16da1cb518cfd1932164fbb0d76d

Download Submit
C:\Windows\system\PGZuQGD.exe

Filesize
1.9MB

MD5
2c9f2d3480fcdf95ee287663429f1897

SHA1
db4ef5c8fbb2a43fed8a2b98919ac775dd2feccf

SHA256
dbea89331bf80537c5cbd4a760a7ea5dc9616f0f31f6ee78f63e94b1e91c8bde

SHA512
f9e0e9575bee32c423852127c8219f34e569c71a5738e2125d113df80455afa362d49d963dfe7c08ad7c5f0929969be964d4b4f899d77c3f27357d95fea38091

Download Submit
C:\Windows\system\PgjzXol.exe

Filesize
1.9MB

MD5
c7e486be0b639c5e91f7c6d1f19b4105

SHA1
f5d2e165dab471c03a9b6daf4072de9b21eb155c

SHA256
969aeca29e7dcec3a41a394638a8f7b0d50dbad9a58d2644d344d5bced64c146

SHA512
4165b71ef47800837c950beb69bb0672f7839e1ad11c8dce08fe179d479a768f4f92dda81058b26c8cc6634ac1497ce8542d92e127c1a4487450f8680bec298c

Download Submit
C:\Windows\system\RIbZreV.exe

Filesize
1.9MB

MD5
0d09eca6cc9b7b0301bf76f19be88f6f

SHA1
db56847267d48829ba31c69cdf96dcdcaa5b7204

SHA256
620d80d9d9e0fa29066ba700d501d6a49d0a5a4a28e3e80190f29c87ce76e0d5

SHA512
91608d4200dbaf93edbe6081906f3b6fb880a5fb35ecf073fb5a56f44c7afdc3f4fb043ea59bb3eb1e4a7fca66b43270f0a135b5dbcf8c1b7078a8ec13c5b23a

Download Submit
C:\Windows\system\SNJPfDR.exe

Filesize
1.9MB

MD5
99a0156e91e63e6894729aea6acb1b9e

SHA1
8c5f34960e1ad7dc9564d71d8f844689d5489c25

SHA256
f94b69ce248bc417f12d176a091d0ff79b473e305001c0615f6dafff0170d1e4

SHA512
a1197082ae8cd0a5fcb7eab6d8203442fdc8188ada4c85489286a7471ed168ddfbaaecb15990fe9536746bad75b6778cb49144d9f2910aad49a14f6710098733

Download Submit
C:\Windows\system\UNpdhRv.exe

Filesize
1.9MB

MD5
eecb8784ff4faad34a4b28db2a83c579

SHA1
41c30b4853959ba54a432ce0f36ff4c7bde9adcc

SHA256
c81d1d7d7a4c0ee957e7d33de4215d89ecbabad12278026856fc5a199bd4c68b

SHA512
f94ba6816b49f6f3f932c8207a12a7af6c6561742f26df8e0a01ad14004e3679f9db4150bb328fd109b6430a2b95af08d421cb7bbeaf6646812d6e182d5a99ab

Download Submit
C:\Windows\system\WzQdFLA.exe

Filesize
1.9MB

MD5
239a4318fb8e2b0fcd29a9847406cccf

SHA1
db8d5b7c15a6cc5e1459238b0f6ffdf400fec245

SHA256
c70f1e11cdff94b94a3bc2da77b055d35f34ae195ec2c9390770bf4b620d156f

SHA512
78a47f325163853eab3a740e1a823996892c56b62cc87c9901d5f5172849013003a20cdaa021988b1116ba2f2db26b43233aa92b7fc5dd35625bbc860cf2965a

Download Submit
C:\Windows\system\XndiATQ.exe

Filesize
1.9MB

MD5
0b8d4e03710b95a87846cbbc409e65c7

SHA1
5f79d01344bc042a16cad8f5827da00987ebde40

SHA256
549f1109b18f718d0095bbb01fb9818e01ee0ee2b5a8dae0910eb631b04a55f9

SHA512
37c43fc8e3fb89248e430e015e1c935966873872ba41d031f51e0c192f68baf23852216a0f40e688b170eb6b33f2f56f1dd18c74413cb5d7db08e5fea14cd239

Download Submit
C:\Windows\system\dJZQjTt.exe

Filesize
1.9MB

MD5
8caf4042d411875d19882f718733ef22

SHA1
bead398512f3e56ab46f9f6a1107b5c8329a2660

SHA256
49517e7cc0fa45a39ea5411269cd76e45dbc0849a689165dba4799e80e615099

SHA512
38c6f04151042e233f0e566814488823bc9f4ac4e2da3e5c18095dccf6e6af7ab7679e842344917cd1c3cc19754ef8c724ed39f64c6a0427f98f052d64c024f6

Download Submit
C:\Windows\system\fZyDjOg.exe

Filesize
1.9MB

MD5
f2b47f29b7d8740415dd8fc17716e08f

SHA1
75ad83f318330fde815a5b49dda0edc01c1675b4

SHA256
de1e2dd0b835bafe6d44cbca965f98a4232c91855c8df6d1499c52650fbca34c

SHA512
e42a8ee0e1ef3d2130eb1f8ad7d1774e6bfd06e24334cc4bda20bf6b591128108468a2f4c06e7439294f3d7f56511ea9e88a7487a3070713bf268afd8f860f06

Download Submit
C:\Windows\system\kWShHmA.exe

Filesize
1.9MB

MD5
b0f24d65f781472a31d6bee4640b5821

SHA1
f14e20acc87f5c2a9dc693485e4ac790f2512c41

SHA256
5b835a61f6d239b729c9c2119254f6bce26cff92004383c79bc38e5a0d59e1ea

SHA512
8460ac59c8168e28caf38e28b081e5e31c8f731dffcdc700bc99313ee63dcb1656964d746ffe78ddb93b9f142d3350f15fc87cbe1128ffd42cce2b9244360a66

Download Submit
C:\Windows\system\paDSpHl.exe

Filesize
1.9MB

MD5
e0546cc22b5e06bc618caae3ee015db9

SHA1
923814676a45e5dd804999dc4d823c6e21c1404e

SHA256
b3f47c21ec7dc88681c71154444768f1252d1bbd99649c8bf959ea3b2b6b0fc8

SHA512
39c99a4eaf3186d468259c73d28d1bef2184cba97740c3ef09f0a8805d8687430b93a5257041ff9895166abdbd2022192ac8e68fa415cd3e81ffd83cf49bfdf1

Download Submit
C:\Windows\system\zlYKnpP.exe

Filesize
1.9MB

MD5
a2c55a6da1713486476ce22339fabba2

SHA1
e9a0a3387bef9d9cf74293ebb215d181bcc8b5fb

SHA256
41aebfc66a0088699ca54d0419a2243561d58f89840b1c7a13d4aac66f18b49b

SHA512
b55123f7ce2c286bb7703e6101312a99c0ff48444837b4cd7520107495c85b81c09de585a87d0317d72011909afd8a4a5b8e8d0e2eaee38767dc12df9a7d28f4

Download Submit
\Windows\system\ECPIYuQ.exe

Filesize
1.9MB

MD5
8d83ea781e2522bc6bdcd870c19884da

SHA1
0a9da6e9285e6b3d63fcb08bb6d998e73ae4a411

SHA256
a01995250edaf7a3669be76614a39ed4e36fb780eb0a25aae2e644aa788fb896

SHA512
6c0a4d936df9505e82b1daa97a6501ab0ba98f3210ee18f9a24c666c9f1073b4fd9ed4fc400a7802423a152c637451ae4eea72855e8c449e5c7ba5cf155e58e0

Download Submit
\Windows\system\FfPQRBv.exe

Filesize
1.9MB

MD5
77195277aa2d5970aeb9fe20b4c3c547

SHA1
cb0b2a25dd6627081f1268065a20e5e08ca4014b

SHA256
d0b093abd075067eb9959da2721d163ccfb648d18daf8d3fd346effbd0d904a0

SHA512
72ebe6f9d1ae155facefe02bb07f6247afbba673949852b2fc12fb2fda82682eecaa22c01a87e3783fc50467f615ff5935aa804f4a7d07fffe7256f72f774e2e

Download Submit
\Windows\system\GgVzLSO.exe

Filesize
1.9MB

MD5
b09d283e2cef3293e6826a1f508418a3

SHA1
035e2f62ad05251c00c434b3abed5398c0175eac

SHA256
ba280a8c791cfc4967922a3a5757ce8a6cc208f55c4ce424e87043444312bf29

SHA512
58103938a0a2f442fe4cfbd267de9c06cc7d284ad1ddef4cd5dee6463448ebf9670b4762918aafc6fd8818d6e07dfc50c2194e825ab263f570677a2c07f1214e

Download Submit
\Windows\system\LTBphEN.exe

Filesize
1.9MB

MD5
2dce954d2f3b121f977d3f5a1927a427

SHA1
063a4399df15ca7fcde05cbcd007dbcbc6b18d65

SHA256
2e9947e0dfb5664440564ce666324f29fe0a20b75e1723ac3e8b3d6a60cf383f

SHA512
a6e7cf7c738c602356f887019eb7f6e21741026cd4e37e59f8dce74e06813c63d846e8b9ae6dcf7764259b775b980b592a383b7aa721002748f254f0ad2c826f

Download Submit
\Windows\system\LiaAFmR.exe

Filesize
1.9MB

MD5
ee406fa03188ec869f35fead2126db8d

SHA1
4fb245fed2a3ecfc6e8217520ba567f60d2d4b18

SHA256
1b72286bce766015a59817df1031bac5ba5856e68b1c4f43b871fc70284704b2

SHA512
55d5e66832f77d681d4519548409e07d84f47a8ad9bb9f9404aca70a34361e42613ec020624d466aae93ac3341d81b82a75ec9ca2003e27fbc2b58f0ac74dd7b

Download Submit
\Windows\system\NvPsccz.exe

Filesize
1.9MB

MD5
8e93bf983b7fe53f36ccc966adbea3c0

SHA1
1a0dff5d176e5f047a42dc27b88b763f2943af72

SHA256
be831b3deb606894d0a1f3c667372b91ba475df12e1a106ea33dfc9e696d17bb

SHA512
76f19755a49c2828ce8479f8a0cc35d93fdf24cbc322610ac81c216296b26edfdc6ccdfc83547a6044f819ea3593dd5b41e0f4c62662c943961ab5e11f4a9322

Download Submit
\Windows\system\QanYwGS.exe

Filesize
1.9MB

MD5
bd992d5f9cdc1eeb9861ae2440987166

SHA1
983209ef4caedc978bcc371b3edcbc5055a1bdd5

SHA256
410ad904f10f8bd733bf2b7b6ce72ebfbe0f718b6a0fdaeeec565eea127c9980

SHA512
494a3b7dbabce7105f9503b4f73aab13a16e490106baf2baeb43dd4a4be5998665dd7808c5b21e916e0104b6f726094bcd37b91c9449d126526eefda89cd34cb

Download Submit
\Windows\system\SUeCuQp.exe

Filesize
1.9MB

MD5
9e5ada59e52b40d00cfb2484de08bdd8

SHA1
d26bf1b046ec8c7ce48e1345206add2661a705b3

SHA256
4cfb81b1b1f085fd746fc61605738ee28cb21ceb8df62066bd4f7a83a4fe89fb

SHA512
4001948f9addd99d9b3b1bc616499117d0388f0e15a1684b83a244dce8d013e3fed5e7119d8e8dad3fec582bbe85614de2679545194be7985bfdd64a136a8849

Download Submit
\Windows\system\WpaPfkR.exe

Filesize
1.9MB

MD5
50f0018af1f10305227403e4d15b4ae0

SHA1
60193d3d7bcc869d1b887a7b691783ad7f433434

SHA256
82cf59c80f4b765f96c1838c730300dd3b051d48bb37de9972f338e71cf6e3fe

SHA512
099703e55a460ab13168f9228522783f8191bab6b6273f4e63077cf4d8d4255b2368a41148daaf498e83cc209b5f685987ce154e83610592bf82ce021dc6f56e

Download Submit
\Windows\system\WtyruWu.exe

Filesize
1.9MB

MD5
4e8e4cf0a98392aff9566cf17ab4f622

SHA1
e8e669b04d8b3dd751428bfe67ebb85cafab9cb1

SHA256
8e376eea20ea06cacdfdf5829d0d95776c69fbe9eaaeb066a7ffc26ae0e9d526

SHA512
d1cf591cc2c1f3d9a1e021826957fd18c10510735ca9533224844eff00839d508fa1a746edd4621bfef422c4a250ed23cd6951c95b9e6c6a8debd4c7d292afcc

Download Submit
\Windows\system\YYJQGSl.exe

Filesize
1.9MB

MD5
ff33c3066e726b0350a4a63a2add4355

SHA1
10b350974bf63548bada3c4750d842662fd5c5c4

SHA256
286eeea319d61f21b56ac75b4fec4ba0865bd37ac2c7fc7baa08889393911b56

SHA512
05d0c127d5e16792db66bb24d32aca6c4f5947030390dcba94d9f089477b8470e696f293058d085713230846bda0d07f630d3fbfbbc864d30dac55686a4c1622

Download Submit
\Windows\system\ZzfpCkR.exe

Filesize
1.9MB

MD5
456a71614bb63128818ff1b2925dfe92

SHA1
3a5f436e5317c25846eb8337051c85d9dbf79922

SHA256
1471f52b752820b3c2f05dc2b1f64251e8a9c1f3b5a9ec6ecc02e12916895def

SHA512
a5b5f1c1f298173118fa59c7fc9db7573c46555f5741a1ed42c8b29a636e1dff16062deda5f167a6b242f53f1ac96b14742fab16e2629f7fa32cdcb97ccbea60

Download Submit
\Windows\system\aMwtNgs.exe

Filesize
1.9MB

MD5
646ff49c2fd44124b0ec06d884307dc1

SHA1
5f5fa247453d4468cf7e1221630d777ebbb7b5e4

SHA256
c80f768fa96b9be326cd419648bda32f858c07861a8c86098b9788fdd9e5fd03

SHA512
7dca3e87c2adf2be925d45ee54c329bcd9b0d561141fa69e5388f2799f0abf54f0cfcd9c95caed0be32a40130a251b3c4a5355e768d6a2c869dd19cea82a0db1

Download Submit
\Windows\system\hAaFuaV.exe

Filesize
1.9MB

MD5
3287179b501c6a9a2b1eae194044604d

SHA1
3a6d18079e2006cafdd9de6ad77824ad1c1720ef

SHA256
24ddf579d02a4f79be29831c3f51c7105ebdc7b81eedaf54b3724fa5bbd51f64

SHA512
4fb9f80f1d9626daec9f453815ddf797e463651fa437486e50f38b424607c524d0fbd610719df57d558a2521af265afee221e552519be46e57c33e12f1449272

Download Submit
\Windows\system\hDQfiYM.exe

Filesize
1.9MB

MD5
ef11c2af86e909060a8288f4799b7e5b

SHA1
02b9436521690f1fa28a819c6c77dc033e173c45

SHA256
f89236ce10d7cf3934cd243fb93cae63f20ec5d127016defcbac3789cede1c1f

SHA512
3341bf4ca503d1d2ee34e16829c3c21ce57803daa24c461b0d518674dd94f6f2d04c983579fe476be4bde0a89bca4f38dd74276c5925063b52a970e2a20c2f96

Download Submit
\Windows\system\hfOCdYO.exe

Filesize
1.9MB

MD5
1f5ebb65314485c47549d66c9f794c96

SHA1
50a4ce2bb35aded8269736e9987b9889a85f6590

SHA256
d564bd8a86fc269ba6b6a6b5bb8c4ed5228fa48bf72b3177a82bfdf30b026c9f

SHA512
9f8e132fa2646c9d9d1ab37915bf10bf70975f8119cd4b8fa26a0376bd4f82faf0c9bb127bd9ce27d1dd3c3e6bc7d84928ba9758569f44de910eb55c959d886c

Download Submit
\Windows\system\imGUtQr.exe

Filesize
1.9MB

MD5
e867e40e7742b6774dcec2a9f3642f6f

SHA1
0b51665bd4958ce698fd5c5a0a435c70e3746339

SHA256
ac20075b928042aac6ae5eab70c7b16e70cee589c0e6a919d9180186c3ddb706

SHA512
81e36fb4fd468a2b114cbc4343cb27aad793d13a1c741b0b97fe667a0abb4bd1795195d3cca6294ef33e31d1003b468e990d0720751648be52c354cac2142286

Download Submit
\Windows\system\kjmFbKY.exe

Filesize
1.9MB

MD5
d4a55137e5fb20a65747f65c3cdd7b1f

SHA1
f9f63e282f00555b9d62605950b5cce91ac16e31

SHA256
0e60f41ee6ceb0bd9cbfb52e10b4ff0b0b5f80921db32cdf22f976032b7a4475

SHA512
9f4130c4ad615c203cefcf0a5bd70d9ba0ed9bf1f81a4fc6501bece26becfcc2b01bdb30516f74fc390a9f158957139a03da8bf8805d71e9d7e3eb4ff4d22c9a

Download Submit
\Windows\system\oYXPdtI.exe

Filesize
1.9MB

MD5
ce926c32a093fb43de5948fd54a4a14e

SHA1
e23734c16c44376852ae29bada7392bf1ac73b81

SHA256
bce4b1cfc63861294e63ebccca3ab9fdb3cf08bfbd3e8f7bda290bf5bd05ff08

SHA512
90209604e0a5aae75c2af9ade8ae08bb027704c2dd5bde1cb30d9160a8b99891947a69ea920c8f5df1ba5621922a50314c8967dc98d0517e5243e4cabc6d4880

Download Submit
\Windows\system\sYZcjsP.exe

Filesize
1.9MB

MD5
b45c754cafd856ee2d9bf17a4f510081

SHA1
547df5c12b58bf6b828eab2df7b8b9c0f063d37f

SHA256
b8faccbcbbaf3c3b11aa60216e5b55d76622cbda6906291519c0210e5fa4623d

SHA512
0efb9a704da4dcae61a6a28f4e3f79fa302e46fbd654bd65e85554def9dad1ca46e87c6610147b69e702a3976406dd1acdb5c784745dadc7747ad437e748a5b6

Download Submit
\Windows\system\wwxQjsE.exe

Filesize
1.9MB

MD5
fefce1bb9573926e15543ac574939a2d

SHA1
8548befc8852b08b263bf669f3939fc1f301c4e8

SHA256
9b229283edc722d8df98342f330e3194e5a8864d4334f863a0493a891e1d588d

SHA512
9e87fcd4d4593e225ccb6e2e2895be7150608dab175a334a0561856faa8e2d8ac02bd9c91eca1bda5b90ffa2826a5968b770edbe2573d7466be2278af1ed902c

Download Submit
memory/748-88-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/748-7663-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/1236-41-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/1236-85-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2096-40-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2096-149-0x000000001B4D0000-0x000000001B7B2000-memory.dmp

Filesize
2.9MB

Download
memory/2096-152-0x00000000022E0000-0x00000000022E8000-memory.dmp

Filesize
32KB

Download
memory/2096-84-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2120-6701-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-21-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-70-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-61-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-14-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-8-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2168-49-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2336-222-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2336-17-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/2336-91-0x0000000003680000-0x0000000003A72000-memory.dmp

Filesize
3.9MB

Download
memory/2336-63-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2336-13601-0x0000000003680000-0x0000000003A72000-memory.dmp

Filesize
3.9MB

Download
memory/2336-73-0x0000000003680000-0x0000000003A72000-memory.dmp

Filesize
3.9MB

Download
memory/2336-72-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-13380-0x0000000003680000-0x0000000003A72000-memory.dmp

Filesize
3.9MB

Download
memory/2336-79-0x0000000003680000-0x0000000003A72000-memory.dmp

Filesize
3.9MB

Download
memory/2336-33-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2336-56-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2336-8516-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-1-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2336-479-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2336-39-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-0-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-10-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-7-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2336-29-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/2408-6670-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2408-55-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-32-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2604-6830-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2604-78-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2828-6562-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2828-86-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2828-47-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-89-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2936-6738-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/3032-6739-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/3032-87-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download