xmrig | 68f20687f211b46d8ca2c6da31e996c4e6df811f150dfd7c3f1c011a6b2fbc86

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.cf054fce672f33520529e9074bd817f0.exe
Size

1.9MB
MD5

cf054fce672f33520529e9074bd817f0
SHA1

321c1559160a80a133ec27af3af0345705092ee2
SHA256

68f20687f211b46d8ca2c6da31e996c4e6df811f150dfd7c3f1c011a6b2fbc86
SHA512

11f8321e223a542ed1a02306f2ffcbf6f900be368b98e2e63f4492249a282fc8dd3b9f6477ef52bff213b00b325ff0524ea27df65880b8852c315ede4f543ca2
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wICbbnlD5/xFVg:BemTLkNdfE0pZrp

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2876-0-0x00007FF7418C0000-0x00007FF741C14000-memory.dmp	xmrig
behavioral2/files/0x000800000002320a-12.dat	xmrig
behavioral2/files/0x0007000000023211-24.dat	xmrig
behavioral2/files/0x000700000002320f-26.dat	xmrig
behavioral2/files/0x0007000000023213-38.dat	xmrig
behavioral2/files/0x0007000000023215-50.dat	xmrig
behavioral2/memory/2652-52-0x00007FF626760000-0x00007FF626AB4000-memory.dmp	xmrig
behavioral2/memory/4640-55-0x00007FF6E1E70000-0x00007FF6E21C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023217-58.dat	xmrig
behavioral2/files/0x0007000000023219-64.dat	xmrig
behavioral2/memory/2564-71-0x00007FF64BC70000-0x00007FF64BFC4000-memory.dmp	xmrig
behavioral2/memory/2284-77-0x00007FF673D20000-0x00007FF674074000-memory.dmp	xmrig
behavioral2/files/0x000700000002321c-80.dat	xmrig
behavioral2/memory/4788-82-0x00007FF7B5270000-0x00007FF7B55C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002321c-83.dat	xmrig
behavioral2/memory/2684-85-0x00007FF7377D0000-0x00007FF737B24000-memory.dmp	xmrig
behavioral2/memory/1748-86-0x00007FF7CCE70000-0x00007FF7CD1C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002321b-76.dat	xmrig
behavioral2/files/0x000700000002321a-74.dat	xmrig
behavioral2/files/0x0007000000023219-72.dat	xmrig
behavioral2/files/0x000700000002321b-70.dat	xmrig
behavioral2/files/0x000700000002321a-69.dat	xmrig
behavioral2/files/0x0007000000023217-62.dat	xmrig
behavioral2/memory/3884-59-0x00007FF640290000-0x00007FF6405E4000-memory.dmp	xmrig
behavioral2/memory/1204-90-0x00007FF7DC2D0000-0x00007FF7DC624000-memory.dmp	xmrig
behavioral2/files/0x000700000002321e-95.dat	xmrig
behavioral2/files/0x000700000002321e-97.dat	xmrig
behavioral2/memory/2252-96-0x00007FF7BDCF0000-0x00007FF7BE044000-memory.dmp	xmrig
behavioral2/files/0x000700000002321d-91.dat	xmrig
behavioral2/files/0x000700000002321d-89.dat	xmrig
behavioral2/memory/2876-109-0x00007FF7418C0000-0x00007FF741C14000-memory.dmp	xmrig
behavioral2/memory/4652-112-0x00007FF6E7D70000-0x00007FF6E80C4000-memory.dmp	xmrig
behavioral2/memory/2128-115-0x00007FF7FBBD0000-0x00007FF7FBF24000-memory.dmp	xmrig
behavioral2/memory/3896-117-0x00007FF618670000-0x00007FF6189C4000-memory.dmp	xmrig
behavioral2/memory/332-116-0x00007FF675930000-0x00007FF675C84000-memory.dmp	xmrig
behavioral2/files/0x0007000000023222-114.dat	xmrig
behavioral2/files/0x0007000000023221-113.dat	xmrig
behavioral2/files/0x0007000000023222-111.dat	xmrig
behavioral2/files/0x0007000000023221-106.dat	xmrig
behavioral2/files/0x0007000000023220-105.dat	xmrig
behavioral2/memory/1188-104-0x00007FF7B1000000-0x00007FF7B1354000-memory.dmp	xmrig
behavioral2/files/0x0007000000023220-101.dat	xmrig
behavioral2/files/0x0007000000023215-53.dat	xmrig
behavioral2/memory/4304-49-0x00007FF6799E0000-0x00007FF679D34000-memory.dmp	xmrig
behavioral2/files/0x0007000000023214-48.dat	xmrig
behavioral2/memory/4424-42-0x00007FF7108C0000-0x00007FF710C14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023214-41.dat	xmrig
behavioral2/files/0x0007000000023213-43.dat	xmrig
behavioral2/files/0x0007000000023212-37.dat	xmrig
behavioral2/memory/1456-36-0x00007FF6D08B0000-0x00007FF6D0C04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023212-33.dat	xmrig
behavioral2/memory/4416-32-0x00007FF7C61D0000-0x00007FF7C6524000-memory.dmp	xmrig
behavioral2/files/0x0007000000023211-30.dat	xmrig
behavioral2/files/0x0007000000023223-126.dat	xmrig
behavioral2/files/0x0007000000023226-128.dat	xmrig
behavioral2/files/0x0007000000023225-127.dat	xmrig
behavioral2/files/0x0007000000023227-137.dat	xmrig
behavioral2/files/0x0007000000023228-145.dat	xmrig
behavioral2/files/0x0007000000023228-144.dat	xmrig
behavioral2/files/0x0007000000023229-149.dat	xmrig
behavioral2/files/0x0007000000023229-152.dat	xmrig
behavioral2/files/0x000700000002322b-168.dat	xmrig
behavioral2/memory/1152-173-0x00007FF7816F0000-0x00007FF781A44000-memory.dmp	xmrig
behavioral2/memory/4964-178-0x00007FF683C00000-0x00007FF683F54000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4652	gKTRenQ.exe
3896	cgtEolU.exe
4424	SUvNgcV.exe
4416	rdgAzuv.exe
1456	TfAbeNJ.exe
4304	ULQsxap.exe
2652	XmCGzTo.exe
4640	quFZDFg.exe
3884	cWnatZB.exe
2564	JTSkkzf.exe
2284	kImMTkb.exe
2684	JHkeAyr.exe
4788	hkaKFrY.exe
1748	ZktydVw.exe
1204	GLupIny.exe
2252	rPgOnei.exe
1188	qsAjkNG.exe
2128	UvAGDMR.exe
332	KvpXyDY.exe
4964	XDJiaDy.exe
4072	IetCGwZ.exe
1032	NDoTeen.exe
2212	SXYNTZh.exe
896	oYYaMmX.exe
2488	NVuczRg.exe
2072	yRlxeTg.exe
1524	tueLjzV.exe
1152	yoCmcyY.exe
5076	mMfeKGu.exe
2472	btLWmti.exe
2744	vRcWxJA.exe
3572	HoFHcPy.exe
4812	VKqpxvV.exe
2804	cjvygyy.exe
2188	MdheCiZ.exe
3148	GOBTyDz.exe
2948	erfBUob.exe
4184	xAbUSmq.exe
3840	kmLxBft.exe
1472	QQdiQsH.exe
3364	jPwRxxB.exe
1608	qybUoiP.exe
4740	emdqvka.exe
3116	RxMZsQw.exe
2888	NMuMXzi.exe
2344	ZNfrxAx.exe
1040	NZHQWGP.exe
1172	XfZllVW.exe
4012	DiHfuRV.exe
3612	YnDgjgu.exe
496	dyqJFyU.exe
416	jTCVhpU.exe
3872	EjaoRLA.exe
4644	qGJyLbd.exe
4928	xJTzHqZ.exe
716	SvUyKFa.exe
2060	AqzgwhG.exe
2132	zTgLfov.exe
1300	sjXnweU.exe
384	XTLzMHz.exe
320	xlCrPFr.exe
1484	KhsUWgr.exe
1356	pshcUSF.exe
456	sUoJner.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2876-0-0x00007FF7418C0000-0x00007FF741C14000-memory.dmp	upx
behavioral2/files/0x000800000002320a-12.dat	upx
behavioral2/files/0x0007000000023211-24.dat	upx
behavioral2/files/0x000700000002320f-26.dat	upx
behavioral2/files/0x0007000000023213-38.dat	upx
behavioral2/files/0x0007000000023215-50.dat	upx
behavioral2/memory/2652-52-0x00007FF626760000-0x00007FF626AB4000-memory.dmp	upx
behavioral2/memory/4640-55-0x00007FF6E1E70000-0x00007FF6E21C4000-memory.dmp	upx
behavioral2/files/0x0007000000023217-58.dat	upx
behavioral2/files/0x0007000000023219-64.dat	upx
behavioral2/memory/2564-71-0x00007FF64BC70000-0x00007FF64BFC4000-memory.dmp	upx
behavioral2/memory/2284-77-0x00007FF673D20000-0x00007FF674074000-memory.dmp	upx
behavioral2/files/0x000700000002321c-80.dat	upx
behavioral2/memory/4788-82-0x00007FF7B5270000-0x00007FF7B55C4000-memory.dmp	upx
behavioral2/files/0x000700000002321c-83.dat	upx
behavioral2/memory/2684-85-0x00007FF7377D0000-0x00007FF737B24000-memory.dmp	upx
behavioral2/memory/1748-86-0x00007FF7CCE70000-0x00007FF7CD1C4000-memory.dmp	upx
behavioral2/files/0x000700000002321b-76.dat	upx
behavioral2/files/0x000700000002321a-74.dat	upx
behavioral2/files/0x0007000000023219-72.dat	upx
behavioral2/files/0x000700000002321b-70.dat	upx
behavioral2/files/0x000700000002321a-69.dat	upx
behavioral2/files/0x0007000000023217-62.dat	upx
behavioral2/memory/3884-59-0x00007FF640290000-0x00007FF6405E4000-memory.dmp	upx
behavioral2/memory/1204-90-0x00007FF7DC2D0000-0x00007FF7DC624000-memory.dmp	upx
behavioral2/files/0x000700000002321e-95.dat	upx
behavioral2/files/0x000700000002321e-97.dat	upx
behavioral2/memory/2252-96-0x00007FF7BDCF0000-0x00007FF7BE044000-memory.dmp	upx
behavioral2/files/0x000700000002321d-91.dat	upx
behavioral2/files/0x000700000002321d-89.dat	upx
behavioral2/memory/2876-109-0x00007FF7418C0000-0x00007FF741C14000-memory.dmp	upx
behavioral2/memory/4652-112-0x00007FF6E7D70000-0x00007FF6E80C4000-memory.dmp	upx
behavioral2/memory/2128-115-0x00007FF7FBBD0000-0x00007FF7FBF24000-memory.dmp	upx
behavioral2/memory/3896-117-0x00007FF618670000-0x00007FF6189C4000-memory.dmp	upx
behavioral2/memory/332-116-0x00007FF675930000-0x00007FF675C84000-memory.dmp	upx
behavioral2/files/0x0007000000023222-114.dat	upx
behavioral2/files/0x0007000000023221-113.dat	upx
behavioral2/files/0x0007000000023222-111.dat	upx
behavioral2/files/0x0007000000023221-106.dat	upx
behavioral2/files/0x0007000000023220-105.dat	upx
behavioral2/memory/1188-104-0x00007FF7B1000000-0x00007FF7B1354000-memory.dmp	upx
behavioral2/files/0x0007000000023220-101.dat	upx
behavioral2/files/0x0007000000023215-53.dat	upx
behavioral2/memory/4304-49-0x00007FF6799E0000-0x00007FF679D34000-memory.dmp	upx
behavioral2/files/0x0007000000023214-48.dat	upx
behavioral2/memory/4424-42-0x00007FF7108C0000-0x00007FF710C14000-memory.dmp	upx
behavioral2/files/0x0007000000023214-41.dat	upx
behavioral2/files/0x0007000000023213-43.dat	upx
behavioral2/files/0x0007000000023212-37.dat	upx
behavioral2/memory/1456-36-0x00007FF6D08B0000-0x00007FF6D0C04000-memory.dmp	upx
behavioral2/files/0x0007000000023212-33.dat	upx
behavioral2/memory/4416-32-0x00007FF7C61D0000-0x00007FF7C6524000-memory.dmp	upx
behavioral2/files/0x0007000000023211-30.dat	upx
behavioral2/files/0x0007000000023223-126.dat	upx
behavioral2/files/0x0007000000023226-128.dat	upx
behavioral2/files/0x0007000000023225-127.dat	upx
behavioral2/files/0x0007000000023227-137.dat	upx
behavioral2/files/0x0007000000023228-145.dat	upx
behavioral2/files/0x0007000000023228-144.dat	upx
behavioral2/files/0x0007000000023229-149.dat	upx
behavioral2/files/0x0007000000023229-152.dat	upx
behavioral2/files/0x000700000002322b-168.dat	upx
behavioral2/memory/1152-173-0x00007FF7816F0000-0x00007FF781A44000-memory.dmp	upx
behavioral2/memory/4964-178-0x00007FF683C00000-0x00007FF683F54000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZNfrxAx.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\shLqala.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\cGmwVrN.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\sjXnweU.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\PWoIQgz.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\IaCZLjQ.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\MOEebzW.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\DaiCECR.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\cTXGNhO.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\BlmIsGA.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\xwIgSkx.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\eziNlUv.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\duMGQJF.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\tlZZvpB.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\qowLqvE.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\KCkNLvG.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\cKffwvF.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\wWuEcxL.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\blKiaXS.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\GsMBSpI.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\FvbtZJD.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\fXgHXKk.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\fNqFIAj.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\ASofiap.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\WDSurPq.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\YBpEEVP.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\ecUmEoQ.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\oRwAGLl.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\UGulZdq.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\awjGzqZ.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\xDNgYHG.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\AoZvdNl.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\dtWTmXB.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\mNMWzDV.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\yCyxQOD.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\FikWjVq.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\eUjugdH.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\TPMrEjV.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\ICFpsfP.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\FjkBPhf.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\hoPGEfq.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\KnDaJuk.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\heRjkXd.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\okkXpMU.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\uUtwjch.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\viGNXqe.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\DttiSeL.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\xeAulPC.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\fhmmjny.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\nrJRrkf.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\TRgzmfL.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\EDWZHsw.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\EDvPbfT.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\CBMbeyL.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\LswpYfs.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\pEFMDxY.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\aHLYoTO.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\wIsFSth.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\spiMKVq.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\eLWxGwl.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\SZheloO.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\qwffobE.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\yvaAVVv.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe
File created	C:\Windows\System\QnrDqVX.exe	NEAS.cf054fce672f33520529e9074bd817f0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 4652	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	22
PID 2876 wrote to memory of 4652	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	22
PID 2876 wrote to memory of 3896	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	23
PID 2876 wrote to memory of 3896	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	23
PID 2876 wrote to memory of 4424	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	24
PID 2876 wrote to memory of 4424	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	24
PID 2876 wrote to memory of 4416	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	348
PID 2876 wrote to memory of 4416	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	348
PID 2876 wrote to memory of 1456	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	25
PID 2876 wrote to memory of 1456	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	25
PID 2876 wrote to memory of 4304	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	347
PID 2876 wrote to memory of 4304	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	347
PID 2876 wrote to memory of 2652	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	346
PID 2876 wrote to memory of 2652	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	346
PID 2876 wrote to memory of 4640	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	26
PID 2876 wrote to memory of 4640	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	26
PID 2876 wrote to memory of 3884	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	39
PID 2876 wrote to memory of 3884	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	39
PID 2876 wrote to memory of 2564	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	27
PID 2876 wrote to memory of 2564	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	27
PID 2876 wrote to memory of 2284	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	38
PID 2876 wrote to memory of 2284	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	38
PID 2876 wrote to memory of 2684	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	34
PID 2876 wrote to memory of 2684	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	34
PID 2876 wrote to memory of 4788	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	28
PID 2876 wrote to memory of 4788	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	28
PID 2876 wrote to memory of 1748	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	30
PID 2876 wrote to memory of 1748	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	30
PID 2876 wrote to memory of 1204	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	29
PID 2876 wrote to memory of 1204	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	29
PID 2876 wrote to memory of 2252	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	31
PID 2876 wrote to memory of 2252	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	31
PID 2876 wrote to memory of 1188	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	33
PID 2876 wrote to memory of 1188	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	33
PID 2876 wrote to memory of 2128	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	37
PID 2876 wrote to memory of 2128	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	37
PID 2876 wrote to memory of 332	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	35
PID 2876 wrote to memory of 332	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	35
PID 2876 wrote to memory of 4964	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	36
PID 2876 wrote to memory of 4964	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	36
PID 2876 wrote to memory of 4072	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	345
PID 2876 wrote to memory of 4072	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	345
PID 2876 wrote to memory of 1032	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	40
PID 2876 wrote to memory of 1032	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	40
PID 2876 wrote to memory of 2212	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	41
PID 2876 wrote to memory of 2212	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	41
PID 2876 wrote to memory of 896	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	42
PID 2876 wrote to memory of 896	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	42
PID 2876 wrote to memory of 2488	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	43
PID 2876 wrote to memory of 2488	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	43
PID 2876 wrote to memory of 2072	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	69
PID 2876 wrote to memory of 2072	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	69
PID 2876 wrote to memory of 1524	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	68
PID 2876 wrote to memory of 1524	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	68
PID 2876 wrote to memory of 1152	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	47
PID 2876 wrote to memory of 1152	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	47
PID 2876 wrote to memory of 5076	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	46
PID 2876 wrote to memory of 5076	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	46
PID 2876 wrote to memory of 2472	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	44
PID 2876 wrote to memory of 2472	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	44
PID 2876 wrote to memory of 2744	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	45
PID 2876 wrote to memory of 2744	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	45
PID 2876 wrote to memory of 3572	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	48
PID 2876 wrote to memory of 3572	2876	NEAS.cf054fce672f33520529e9074bd817f0.exe	48

C:\Users\Admin\AppData\Local\Temp\NEAS.cf054fce672f33520529e9074bd817f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.cf054fce672f33520529e9074bd817f0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\System\gKTRenQ.exe
  C:\Windows\System\gKTRenQ.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\cgtEolU.exe
  C:\Windows\System\cgtEolU.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\SUvNgcV.exe
  C:\Windows\System\SUvNgcV.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\TfAbeNJ.exe
  C:\Windows\System\TfAbeNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\quFZDFg.exe
  C:\Windows\System\quFZDFg.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\JTSkkzf.exe
  C:\Windows\System\JTSkkzf.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\hkaKFrY.exe
  C:\Windows\System\hkaKFrY.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\GLupIny.exe
  C:\Windows\System\GLupIny.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\ZktydVw.exe
  C:\Windows\System\ZktydVw.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\rPgOnei.exe
  C:\Windows\System\rPgOnei.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\qsAjkNG.exe
  C:\Windows\System\qsAjkNG.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\JHkeAyr.exe
  C:\Windows\System\JHkeAyr.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\KvpXyDY.exe
  C:\Windows\System\KvpXyDY.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\XDJiaDy.exe
  C:\Windows\System\XDJiaDy.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\UvAGDMR.exe
  C:\Windows\System\UvAGDMR.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\kImMTkb.exe
  C:\Windows\System\kImMTkb.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\cWnatZB.exe
  C:\Windows\System\cWnatZB.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\NDoTeen.exe
  C:\Windows\System\NDoTeen.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\SXYNTZh.exe
  C:\Windows\System\SXYNTZh.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\oYYaMmX.exe
  C:\Windows\System\oYYaMmX.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\NVuczRg.exe
  C:\Windows\System\NVuczRg.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\btLWmti.exe
  C:\Windows\System\btLWmti.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\vRcWxJA.exe
  C:\Windows\System\vRcWxJA.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\mMfeKGu.exe
  C:\Windows\System\mMfeKGu.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\yoCmcyY.exe
  C:\Windows\System\yoCmcyY.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\HoFHcPy.exe
  C:\Windows\System\HoFHcPy.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\cjvygyy.exe
  C:\Windows\System\cjvygyy.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\MdheCiZ.exe
  C:\Windows\System\MdheCiZ.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\GOBTyDz.exe
  C:\Windows\System\GOBTyDz.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\erfBUob.exe
  C:\Windows\System\erfBUob.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\xAbUSmq.exe
  C:\Windows\System\xAbUSmq.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\kmLxBft.exe
  C:\Windows\System\kmLxBft.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\QQdiQsH.exe
  C:\Windows\System\QQdiQsH.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\jPwRxxB.exe
  C:\Windows\System\jPwRxxB.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\emdqvka.exe
  C:\Windows\System\emdqvka.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\RxMZsQw.exe
  C:\Windows\System\RxMZsQw.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\ZNfrxAx.exe
  C:\Windows\System\ZNfrxAx.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\NMuMXzi.exe
  C:\Windows\System\NMuMXzi.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\qybUoiP.exe
  C:\Windows\System\qybUoiP.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\XfZllVW.exe
  C:\Windows\System\XfZllVW.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\YnDgjgu.exe
  C:\Windows\System\YnDgjgu.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\dyqJFyU.exe
  C:\Windows\System\dyqJFyU.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\DiHfuRV.exe
  C:\Windows\System\DiHfuRV.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\NZHQWGP.exe
  C:\Windows\System\NZHQWGP.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\VKqpxvV.exe
  C:\Windows\System\VKqpxvV.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\tueLjzV.exe
  C:\Windows\System\tueLjzV.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\yRlxeTg.exe
  C:\Windows\System\yRlxeTg.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\jTCVhpU.exe
  C:\Windows\System\jTCVhpU.exe
  2⤵
  - Executes dropped EXE
  PID:416
- C:\Windows\System\EjaoRLA.exe
  C:\Windows\System\EjaoRLA.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\qGJyLbd.exe
  C:\Windows\System\qGJyLbd.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\xJTzHqZ.exe
  C:\Windows\System\xJTzHqZ.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\SvUyKFa.exe
  C:\Windows\System\SvUyKFa.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\AqzgwhG.exe
  C:\Windows\System\AqzgwhG.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\sjXnweU.exe
  C:\Windows\System\sjXnweU.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\XTLzMHz.exe
  C:\Windows\System\XTLzMHz.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\pshcUSF.exe
  C:\Windows\System\pshcUSF.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\KhsUWgr.exe
  C:\Windows\System\KhsUWgr.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\sUoJner.exe
  C:\Windows\System\sUoJner.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\HSAdcVF.exe
  C:\Windows\System\HSAdcVF.exe
  2⤵
  PID:1328
- C:\Windows\System\AsIUWor.exe
  C:\Windows\System\AsIUWor.exe
  2⤵
  PID:3920
- C:\Windows\System\mYmMpSy.exe
  C:\Windows\System\mYmMpSy.exe
  2⤵
  PID:576
- C:\Windows\System\oxIwdfY.exe
  C:\Windows\System\oxIwdfY.exe
  2⤵
  PID:1268
- C:\Windows\System\WNwcQFR.exe
  C:\Windows\System\WNwcQFR.exe
  2⤵
  PID:3288
- C:\Windows\System\xlCrPFr.exe
  C:\Windows\System\xlCrPFr.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\HuYnXwr.exe
  C:\Windows\System\HuYnXwr.exe
  2⤵
  PID:4832
- C:\Windows\System\UtLNixN.exe
  C:\Windows\System\UtLNixN.exe
  2⤵
  PID:3336
- C:\Windows\System\zTgLfov.exe
  C:\Windows\System\zTgLfov.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\wulJRmg.exe
  C:\Windows\System\wulJRmg.exe
  2⤵
  PID:2784
- C:\Windows\System\NRxjKac.exe
  C:\Windows\System\NRxjKac.exe
  2⤵
  PID:2996
- C:\Windows\System\kpHtopx.exe
  C:\Windows\System\kpHtopx.exe
  2⤵
  PID:3352
- C:\Windows\System\GsJFanT.exe
  C:\Windows\System\GsJFanT.exe
  2⤵
  PID:2704
- C:\Windows\System\PKScRVb.exe
  C:\Windows\System\PKScRVb.exe
  2⤵
  PID:3732
- C:\Windows\System\dOzecDH.exe
  C:\Windows\System\dOzecDH.exe
  2⤵
  PID:4808
- C:\Windows\System\KiObfvI.exe
  C:\Windows\System\KiObfvI.exe
  2⤵
  PID:2408
- C:\Windows\System\xwIgSkx.exe
  C:\Windows\System\xwIgSkx.exe
  2⤵
  PID:4504
- C:\Windows\System\tNRgPAY.exe
  C:\Windows\System\tNRgPAY.exe
  2⤵
  PID:3724
- C:\Windows\System\wrclurV.exe
  C:\Windows\System\wrclurV.exe
  2⤵
  PID:5152
- C:\Windows\System\oErFtAf.exe
  C:\Windows\System\oErFtAf.exe
  2⤵
  PID:5180
- C:\Windows\System\pKOiMCq.exe
  C:\Windows\System\pKOiMCq.exe
  2⤵
  PID:5232
- C:\Windows\System\NUpuTEd.exe
  C:\Windows\System\NUpuTEd.exe
  2⤵
  PID:5292
- C:\Windows\System\YCLOICd.exe
  C:\Windows\System\YCLOICd.exe
  2⤵
  PID:5336
- C:\Windows\System\RlQEXCi.exe
  C:\Windows\System\RlQEXCi.exe
  2⤵
  PID:5400
- C:\Windows\System\cuCHUiR.exe
  C:\Windows\System\cuCHUiR.exe
  2⤵
  PID:5448
- C:\Windows\System\mNMWzDV.exe
  C:\Windows\System\mNMWzDV.exe
  2⤵
  PID:5544
- C:\Windows\System\OwlDzdv.exe
  C:\Windows\System\OwlDzdv.exe
  2⤵
  PID:5596
- C:\Windows\System\zUXeJIL.exe
  C:\Windows\System\zUXeJIL.exe
  2⤵
  PID:5676
- C:\Windows\System\IYTXZJu.exe
  C:\Windows\System\IYTXZJu.exe
  2⤵
  PID:5716
- C:\Windows\System\vBgmVkR.exe
  C:\Windows\System\vBgmVkR.exe
  2⤵
  PID:5784
- C:\Windows\System\UczdwNC.exe
  C:\Windows\System\UczdwNC.exe
  2⤵
  PID:5840
- C:\Windows\System\LswpYfs.exe
  C:\Windows\System\LswpYfs.exe
  2⤵
  PID:5816
- C:\Windows\System\PhapHtc.exe
  C:\Windows\System\PhapHtc.exe
  2⤵
  PID:5888
- C:\Windows\System\TOJNiGB.exe
  C:\Windows\System\TOJNiGB.exe
  2⤵
  PID:5928
- C:\Windows\System\yvMXEWv.exe
  C:\Windows\System\yvMXEWv.exe
  2⤵
  PID:5756
- C:\Windows\System\PWoIQgz.exe
  C:\Windows\System\PWoIQgz.exe
  2⤵
  PID:5656
- C:\Windows\System\YkZgNEP.exe
  C:\Windows\System\YkZgNEP.exe
  2⤵
  PID:5568
- C:\Windows\System\VWtYQEm.exe
  C:\Windows\System\VWtYQEm.exe
  2⤵
  PID:5520
- C:\Windows\System\poKCgFF.exe
  C:\Windows\System\poKCgFF.exe
  2⤵
  PID:5500
- C:\Windows\System\vQSoLRu.exe
  C:\Windows\System\vQSoLRu.exe
  2⤵
  PID:6012
- C:\Windows\System\YxkMvUl.exe
  C:\Windows\System\YxkMvUl.exe
  2⤵
  PID:6064
- C:\Windows\System\ByVdOeT.exe
  C:\Windows\System\ByVdOeT.exe
  2⤵
  PID:6044
- C:\Windows\System\UfnOlba.exe
  C:\Windows\System\UfnOlba.exe
  2⤵
  PID:6120
- C:\Windows\System\NFiKEFl.exe
  C:\Windows\System\NFiKEFl.exe
  2⤵
  PID:2572
- C:\Windows\System\BOXpfoF.exe
  C:\Windows\System\BOXpfoF.exe
  2⤵
  PID:5164
- C:\Windows\System\IaCZLjQ.exe
  C:\Windows\System\IaCZLjQ.exe
  2⤵
  PID:5192
- C:\Windows\System\qZUyTIn.exe
  C:\Windows\System\qZUyTIn.exe
  2⤵
  PID:5072
- C:\Windows\System\WEUkwvl.exe
  C:\Windows\System\WEUkwvl.exe
  2⤵
  PID:5392
- C:\Windows\System\GFovcwL.exe
  C:\Windows\System\GFovcwL.exe
  2⤵
  PID:2860
- C:\Windows\System\VrmHMKR.exe
  C:\Windows\System\VrmHMKR.exe
  2⤵
  PID:4752
- C:\Windows\System\NqIPFoS.exe
  C:\Windows\System\NqIPFoS.exe
  2⤵
  PID:5540
- C:\Windows\System\ceTPtTl.exe
  C:\Windows\System\ceTPtTl.exe
  2⤵
  PID:5608
- C:\Windows\System\QknGAQc.exe
  C:\Windows\System\QknGAQc.exe
  2⤵
  PID:5796
- C:\Windows\System\QRhrnqM.exe
  C:\Windows\System\QRhrnqM.exe
  2⤵
  PID:5968
- C:\Windows\System\BWpXbIL.exe
  C:\Windows\System\BWpXbIL.exe
  2⤵
  PID:5936
- C:\Windows\System\TSnJVQU.exe
  C:\Windows\System\TSnJVQU.exe
  2⤵
  PID:6132
- C:\Windows\System\YNvGbeR.exe
  C:\Windows\System\YNvGbeR.exe
  2⤵
  PID:652
- C:\Windows\System\sAbvcDr.exe
  C:\Windows\System\sAbvcDr.exe
  2⤵
  PID:5328
- C:\Windows\System\hSOtHmN.exe
  C:\Windows\System\hSOtHmN.exe
  2⤵
  PID:4196
- C:\Windows\System\xuvOkST.exe
  C:\Windows\System\xuvOkST.exe
  2⤵
  PID:5488
- C:\Windows\System\NFgxNLZ.exe
  C:\Windows\System\NFgxNLZ.exe
  2⤵
  PID:5948
- C:\Windows\System\sxsGxMh.exe
  C:\Windows\System\sxsGxMh.exe
  2⤵
  PID:5792
- C:\Windows\System\THaItXB.exe
  C:\Windows\System\THaItXB.exe
  2⤵
  PID:5084
- C:\Windows\System\YvDimwB.exe
  C:\Windows\System\YvDimwB.exe
  2⤵
  PID:2956
- C:\Windows\System\oxlxDcG.exe
  C:\Windows\System\oxlxDcG.exe
  2⤵
  PID:5484
- C:\Windows\System\hoPGEfq.exe
  C:\Windows\System\hoPGEfq.exe
  2⤵
  PID:5980
- C:\Windows\System\mfmLNaH.exe
  C:\Windows\System\mfmLNaH.exe
  2⤵
  PID:5876
- C:\Windows\System\SWXCfeu.exe
  C:\Windows\System\SWXCfeu.exe
  2⤵
  PID:5648
- C:\Windows\System\zSxAfVG.exe
  C:\Windows\System\zSxAfVG.exe
  2⤵
  PID:1148
- C:\Windows\System\TLyXZPA.exe
  C:\Windows\System\TLyXZPA.exe
  2⤵
  PID:6164
- C:\Windows\System\EAykhxz.exe
  C:\Windows\System\EAykhxz.exe
  2⤵
  PID:6204
- C:\Windows\System\ggoFvnJ.exe
  C:\Windows\System\ggoFvnJ.exe
  2⤵
  PID:6280
- C:\Windows\System\bDiZHLv.exe
  C:\Windows\System\bDiZHLv.exe
  2⤵
  PID:6260
- C:\Windows\System\FjYjUwO.exe
  C:\Windows\System\FjYjUwO.exe
  2⤵
  PID:5324
- C:\Windows\System\ZJGudhX.exe
  C:\Windows\System\ZJGudhX.exe
  2⤵
  PID:1036
- C:\Windows\System\aIYwNgA.exe
  C:\Windows\System\aIYwNgA.exe
  2⤵
  PID:5148
- C:\Windows\System\MfImaSG.exe
  C:\Windows\System\MfImaSG.exe
  2⤵
  PID:6008
- C:\Windows\System\PyGesMu.exe
  C:\Windows\System\PyGesMu.exe
  2⤵
  PID:5536
- C:\Windows\System\oRwAGLl.exe
  C:\Windows\System\oRwAGLl.exe
  2⤵
  PID:5016
- C:\Windows\System\QGIlexc.exe
  C:\Windows\System\QGIlexc.exe
  2⤵
  PID:6052
- C:\Windows\System\PqHxAit.exe
  C:\Windows\System\PqHxAit.exe
  2⤵
  PID:5880
- C:\Windows\System\WasCjgR.exe
  C:\Windows\System\WasCjgR.exe
  2⤵
  PID:6428
- C:\Windows\System\nKoHuXY.exe
  C:\Windows\System\nKoHuXY.exe
  2⤵
  PID:6484
- C:\Windows\System\OthaFCn.exe
  C:\Windows\System\OthaFCn.exe
  2⤵
  PID:6528
- C:\Windows\System\yCyxQOD.exe
  C:\Windows\System\yCyxQOD.exe
  2⤵
  PID:6600
- C:\Windows\System\TfxgJRc.exe
  C:\Windows\System\TfxgJRc.exe
  2⤵
  PID:6640
- C:\Windows\System\EheCKGp.exe
  C:\Windows\System\EheCKGp.exe
  2⤵
  PID:6620
- C:\Windows\System\MPGGjCQ.exe
  C:\Windows\System\MPGGjCQ.exe
  2⤵
  PID:6584
- C:\Windows\System\wqcYLRz.exe
  C:\Windows\System\wqcYLRz.exe
  2⤵
  PID:6560
- C:\Windows\System\ugACxOe.exe
  C:\Windows\System\ugACxOe.exe
  2⤵
  PID:6760
- C:\Windows\System\WHrfNPi.exe
  C:\Windows\System\WHrfNPi.exe
  2⤵
  PID:6836
- C:\Windows\System\fhmmjny.exe
  C:\Windows\System\fhmmjny.exe
  2⤵
  PID:6876
- C:\Windows\System\EpImRHz.exe
  C:\Windows\System\EpImRHz.exe
  2⤵
  PID:6976
- C:\Windows\System\FHXcBYp.exe
  C:\Windows\System\FHXcBYp.exe
  2⤵
  PID:6960
- C:\Windows\System\kieShnt.exe
  C:\Windows\System\kieShnt.exe
  2⤵
  PID:7068
- C:\Windows\System\KKjnwyq.exe
  C:\Windows\System\KKjnwyq.exe
  2⤵
  PID:7128
- C:\Windows\System\eznrvXK.exe
  C:\Windows\System\eznrvXK.exe
  2⤵
  PID:7108
- C:\Windows\System\RjKRKRn.exe
  C:\Windows\System\RjKRKRn.exe
  2⤵
  PID:5908
- C:\Windows\System\DQCoyPK.exe
  C:\Windows\System\DQCoyPK.exe
  2⤵
  PID:6272
- C:\Windows\System\rWNfpyo.exe
  C:\Windows\System\rWNfpyo.exe
  2⤵
  PID:4760
- C:\Windows\System\YvIkUzM.exe
  C:\Windows\System\YvIkUzM.exe
  2⤵
  PID:6400
- C:\Windows\System\PgpAHWm.exe
  C:\Windows\System\PgpAHWm.exe
  2⤵
  PID:6504
- C:\Windows\System\SBevgCZ.exe
  C:\Windows\System\SBevgCZ.exe
  2⤵
  PID:6516
- C:\Windows\System\vvcaHPK.exe
  C:\Windows\System\vvcaHPK.exe
  2⤵
  PID:6576
- C:\Windows\System\zQbiUUb.exe
  C:\Windows\System\zQbiUUb.exe
  2⤵
  PID:6612
- C:\Windows\System\ASofiap.exe
  C:\Windows\System\ASofiap.exe
  2⤵
  PID:6756
- C:\Windows\System\FikWjVq.exe
  C:\Windows\System\FikWjVq.exe
  2⤵
  PID:6844
- C:\Windows\System\kHyIbEP.exe
  C:\Windows\System\kHyIbEP.exe
  2⤵
  PID:6896
- C:\Windows\System\bksHQtS.exe
  C:\Windows\System\bksHQtS.exe
  2⤵
  PID:7056
- C:\Windows\System\jEnpMAH.exe
  C:\Windows\System\jEnpMAH.exe
  2⤵
  PID:7104
- C:\Windows\System\qohpciW.exe
  C:\Windows\System\qohpciW.exe
  2⤵
  PID:5592
- C:\Windows\System\UcbhATY.exe
  C:\Windows\System\UcbhATY.exe
  2⤵
  PID:6408
- C:\Windows\System\kbjryGL.exe
  C:\Windows\System\kbjryGL.exe
  2⤵
  PID:6304
- C:\Windows\System\TolalUs.exe
  C:\Windows\System\TolalUs.exe
  2⤵
  PID:6672
- C:\Windows\System\cDbMlOe.exe
  C:\Windows\System\cDbMlOe.exe
  2⤵
  PID:6800
- C:\Windows\System\YCCgODn.exe
  C:\Windows\System\YCCgODn.exe
  2⤵
  PID:7136
- C:\Windows\System\cKRIrFJ.exe
  C:\Windows\System\cKRIrFJ.exe
  2⤵
  PID:6152
- C:\Windows\System\wMHEJXW.exe
  C:\Windows\System\wMHEJXW.exe
  2⤵
  PID:6740
- C:\Windows\System\cvfCCxo.exe
  C:\Windows\System\cvfCCxo.exe
  2⤵
  PID:6688
- C:\Windows\System\mMmpIrJ.exe
  C:\Windows\System\mMmpIrJ.exe
  2⤵
  PID:3432
- C:\Windows\System\etMzLuK.exe
  C:\Windows\System\etMzLuK.exe
  2⤵
  PID:7216
- C:\Windows\System\dxLfNDT.exe
  C:\Windows\System\dxLfNDT.exe
  2⤵
  PID:7276
- C:\Windows\System\FizodGW.exe
  C:\Windows\System\FizodGW.exe
  2⤵
  PID:7256
- C:\Windows\System\eGsYqLi.exe
  C:\Windows\System\eGsYqLi.exe
  2⤵
  PID:7348
- C:\Windows\System\ntufyIW.exe
  C:\Windows\System\ntufyIW.exe
  2⤵
  PID:7400
- C:\Windows\System\OmitcMr.exe
  C:\Windows\System\OmitcMr.exe
  2⤵
  PID:7448
- C:\Windows\System\IfQdvzK.exe
  C:\Windows\System\IfQdvzK.exe
  2⤵
  PID:7488
- C:\Windows\System\inCgCIW.exe
  C:\Windows\System\inCgCIW.exe
  2⤵
  PID:7544
- C:\Windows\System\dqmSvLO.exe
  C:\Windows\System\dqmSvLO.exe
  2⤵
  PID:7564
- C:\Windows\System\iXFQtia.exe
  C:\Windows\System\iXFQtia.exe
  2⤵
  PID:7648
- C:\Windows\System\blKiaXS.exe
  C:\Windows\System\blKiaXS.exe
  2⤵
  PID:7688
- C:\Windows\System\gauUoKp.exe
  C:\Windows\System\gauUoKp.exe
  2⤵
  PID:7720
- C:\Windows\System\ZgKQghq.exe
  C:\Windows\System\ZgKQghq.exe
  2⤵
  PID:7744
- C:\Windows\System\wWuEcxL.exe
  C:\Windows\System\wWuEcxL.exe
  2⤵
  PID:7668
- C:\Windows\System\MOEebzW.exe
  C:\Windows\System\MOEebzW.exe
  2⤵
  PID:7796
- C:\Windows\System\CbWuIFi.exe
  C:\Windows\System\CbWuIFi.exe
  2⤵
  PID:7888
- C:\Windows\System\SatnjHs.exe
  C:\Windows\System\SatnjHs.exe
  2⤵
  PID:7932
- C:\Windows\System\MmhKwGh.exe
  C:\Windows\System\MmhKwGh.exe
  2⤵
  PID:7964
- C:\Windows\System\wQOXCDf.exe
  C:\Windows\System\wQOXCDf.exe
  2⤵
  PID:8012
- C:\Windows\System\QuXaRYc.exe
  C:\Windows\System\QuXaRYc.exe
  2⤵
  PID:8048
- C:\Windows\System\koAeJNM.exe
  C:\Windows\System\koAeJNM.exe
  2⤵
  PID:8104
- C:\Windows\System\LEkitYS.exe
  C:\Windows\System\LEkitYS.exe
  2⤵
  PID:7992
- C:\Windows\System\sDPLYjb.exe
  C:\Windows\System\sDPLYjb.exe
  2⤵
  PID:3760
- C:\Windows\System\qwNNlRL.exe
  C:\Windows\System\qwNNlRL.exe
  2⤵
  PID:7180
- C:\Windows\System\gVYJRlx.exe
  C:\Windows\System\gVYJRlx.exe
  2⤵
  PID:7388
- C:\Windows\System\bZstDuG.exe
  C:\Windows\System\bZstDuG.exe
  2⤵
  PID:7636
- C:\Windows\System\GgIOBlz.exe
  C:\Windows\System\GgIOBlz.exe
  2⤵
  PID:7860
- C:\Windows\System\pbxhsLs.exe
  C:\Windows\System\pbxhsLs.exe
  2⤵
  PID:7792
- C:\Windows\System\AmRrQOB.exe
  C:\Windows\System\AmRrQOB.exe
  2⤵
  PID:7952
- C:\Windows\System\JZXPBgH.exe
  C:\Windows\System\JZXPBgH.exe
  2⤵
  PID:8100
- C:\Windows\System\NCFPHKA.exe
  C:\Windows\System\NCFPHKA.exe
  2⤵
  PID:7620
- C:\Windows\System\ytPQScO.exe
  C:\Windows\System\ytPQScO.exe
  2⤵
  PID:7252
- C:\Windows\System\BoZbXju.exe
  C:\Windows\System\BoZbXju.exe
  2⤵
  PID:6780
- C:\Windows\System\EiHTpVI.exe
  C:\Windows\System\EiHTpVI.exe
  2⤵
  PID:7540
- C:\Windows\System\GbjLCtT.exe
  C:\Windows\System\GbjLCtT.exe
  2⤵
  PID:7444
- C:\Windows\System\XNXvIiq.exe
  C:\Windows\System\XNXvIiq.exe
  2⤵
  PID:7560
- C:\Windows\System\yASHmGC.exe
  C:\Windows\System\yASHmGC.exe
  2⤵
  PID:7524
- C:\Windows\System\qXafbYa.exe
  C:\Windows\System\qXafbYa.exe
  2⤵
  PID:7736
- C:\Windows\System\eNzTpFk.exe
  C:\Windows\System\eNzTpFk.exe
  2⤵
  PID:7288
- C:\Windows\System\VPrClbp.exe
  C:\Windows\System\VPrClbp.exe
  2⤵
  PID:2848
- C:\Windows\System\aqFFBWe.exe
  C:\Windows\System\aqFFBWe.exe
  2⤵
  PID:8264
- C:\Windows\System\vZBkpAa.exe
  C:\Windows\System\vZBkpAa.exe
  2⤵
  PID:8348
- C:\Windows\System\DWmhgxs.exe
  C:\Windows\System\DWmhgxs.exe
  2⤵
  PID:8324
- C:\Windows\System\jqDCcvv.exe
  C:\Windows\System\jqDCcvv.exe
  2⤵
  PID:8420
- C:\Windows\System\JkBjjLn.exe
  C:\Windows\System\JkBjjLn.exe
  2⤵
  PID:8396
- C:\Windows\System\LqbMMhh.exe
  C:\Windows\System\LqbMMhh.exe
  2⤵
  PID:8492
- C:\Windows\System\tdRoiTQ.exe
  C:\Windows\System\tdRoiTQ.exe
  2⤵
  PID:8468
- C:\Windows\System\PunlVfc.exe
  C:\Windows\System\PunlVfc.exe
  2⤵
  PID:8660
- C:\Windows\System\YUAwHbW.exe
  C:\Windows\System\YUAwHbW.exe
  2⤵
  PID:8640
- C:\Windows\System\KwFcsoi.exe
  C:\Windows\System\KwFcsoi.exe
  2⤵
  PID:8744
- C:\Windows\System\ZbEjOSO.exe
  C:\Windows\System\ZbEjOSO.exe
  2⤵
  PID:8712
- C:\Windows\System\vRZLZQD.exe
  C:\Windows\System\vRZLZQD.exe
  2⤵
  PID:8848
- C:\Windows\System\FgxtXad.exe
  C:\Windows\System\FgxtXad.exe
  2⤵
  PID:8936
- C:\Windows\System\pYMbiUw.exe
  C:\Windows\System\pYMbiUw.exe
  2⤵
  PID:9020
- C:\Windows\System\elLzamU.exe
  C:\Windows\System\elLzamU.exe
  2⤵
  PID:9100
- C:\Windows\System\rrfZgzn.exe
  C:\Windows\System\rrfZgzn.exe
  2⤵
  PID:9080
- C:\Windows\System\PckHhGf.exe
  C:\Windows\System\PckHhGf.exe
  2⤵
  PID:9200
- C:\Windows\System\dRgSYRm.exe
  C:\Windows\System\dRgSYRm.exe
  2⤵
  PID:8196
- C:\Windows\System\qbdWYAB.exe
  C:\Windows\System\qbdWYAB.exe
  2⤵
  PID:8456
- C:\Windows\System\mKyxRbe.exe
  C:\Windows\System\mKyxRbe.exe
  2⤵
  PID:8428
- C:\Windows\System\WaQudjJ.exe
  C:\Windows\System\WaQudjJ.exe
  2⤵
  PID:8344
- C:\Windows\System\AHqPEJM.exe
  C:\Windows\System\AHqPEJM.exe
  2⤵
  PID:8216
- C:\Windows\System\RlMzQft.exe
  C:\Windows\System\RlMzQft.exe
  2⤵
  PID:8320
- C:\Windows\System\LqmXjjJ.exe
  C:\Windows\System\LqmXjjJ.exe
  2⤵
  PID:7588
- C:\Windows\System\OzOeElS.exe
  C:\Windows\System\OzOeElS.exe
  2⤵
  PID:8256
- C:\Windows\System\TuIqBOP.exe
  C:\Windows\System\TuIqBOP.exe
  2⤵
  PID:7956
- C:\Windows\System\AfKuxCz.exe
  C:\Windows\System\AfKuxCz.exe
  2⤵
  PID:9124
- C:\Windows\System\DoZEtvt.exe
  C:\Windows\System\DoZEtvt.exe
  2⤵
  PID:8912
- C:\Windows\System\xVegjzc.exe
  C:\Windows\System\xVegjzc.exe
  2⤵
  PID:8824
- C:\Windows\System\LJayiEC.exe
  C:\Windows\System\LJayiEC.exe
  2⤵
  PID:8808
- C:\Windows\System\JWAWufj.exe
  C:\Windows\System\JWAWufj.exe
  2⤵
  PID:8784
- C:\Windows\System\pMyqqdS.exe
  C:\Windows\System\pMyqqdS.exe
  2⤵
  PID:8764
- C:\Windows\System\pJHLajM.exe
  C:\Windows\System\pJHLajM.exe
  2⤵
  PID:8692
- C:\Windows\System\oLOtlnU.exe
  C:\Windows\System\oLOtlnU.exe
  2⤵
  PID:8624
- C:\Windows\System\OnxepYk.exe
  C:\Windows\System\OnxepYk.exe
  2⤵
  PID:8600
- C:\Windows\System\PPXAsks.exe
  C:\Windows\System\PPXAsks.exe
  2⤵
  PID:8576
- C:\Windows\System\BWxPHoT.exe
  C:\Windows\System\BWxPHoT.exe
  2⤵
  PID:8556
- C:\Windows\System\mlDeCyH.exe
  C:\Windows\System\mlDeCyH.exe
  2⤵
  PID:8528
- C:\Windows\System\ILkRnuv.exe
  C:\Windows\System\ILkRnuv.exe
  2⤵
  PID:8308
- C:\Windows\System\cTrAeNR.exe
  C:\Windows\System\cTrAeNR.exe
  2⤵
  PID:8288
- C:\Windows\System\UGulZdq.exe
  C:\Windows\System\UGulZdq.exe
  2⤵
  PID:8244
- C:\Windows\System\SDAEyrC.exe
  C:\Windows\System\SDAEyrC.exe
  2⤵
  PID:8228
- C:\Windows\System\GsMBSpI.exe
  C:\Windows\System\GsMBSpI.exe
  2⤵
  PID:8208
- C:\Windows\System\tsZKVZc.exe
  C:\Windows\System\tsZKVZc.exe
  2⤵
  PID:7828
- C:\Windows\System\pXVgaFI.exe
  C:\Windows\System\pXVgaFI.exe
  2⤵
  PID:7304
- C:\Windows\System\sOeNjWR.exe
  C:\Windows\System\sOeNjWR.exe
  2⤵
  PID:8140
- C:\Windows\System\ukixrnu.exe
  C:\Windows\System\ukixrnu.exe
  2⤵
  PID:8072
- C:\Windows\System\rgpKxbf.exe
  C:\Windows\System\rgpKxbf.exe
  2⤵
  PID:7228
- C:\Windows\System\gDBlTvU.exe
  C:\Windows\System\gDBlTvU.exe
  2⤵
  PID:1260
- C:\Windows\System\ASqzdPT.exe
  C:\Windows\System\ASqzdPT.exe
  2⤵
  PID:7476
- C:\Windows\System\duMGQJF.exe
  C:\Windows\System\duMGQJF.exe
  2⤵
  PID:7376
- C:\Windows\System\SUflbzv.exe
  C:\Windows\System\SUflbzv.exe
  2⤵
  PID:7320
- C:\Windows\System\QojZIqo.exe
  C:\Windows\System\QojZIqo.exe
  2⤵
  PID:7268
- C:\Windows\System\nhvkQFM.exe
  C:\Windows\System\nhvkQFM.exe
  2⤵
  PID:1072
- C:\Windows\System\frwineu.exe
  C:\Windows\System\frwineu.exe
  2⤵
  PID:8184
- C:\Windows\System\FEeFego.exe
  C:\Windows\System\FEeFego.exe
  2⤵
  PID:8164
- C:\Windows\System\SqvUfxu.exe
  C:\Windows\System\SqvUfxu.exe
  2⤵
  PID:7864
- C:\Windows\System\IsAzVYI.exe
  C:\Windows\System\IsAzVYI.exe
  2⤵
  PID:7848
- C:\Windows\System\ZxvRfsZ.exe
  C:\Windows\System\ZxvRfsZ.exe
  2⤵
  PID:7624
- C:\Windows\System\iefTFFm.exe
  C:\Windows\System\iefTFFm.exe
  2⤵
  PID:7528
- C:\Windows\System\dwGRNLf.exe
  C:\Windows\System\dwGRNLf.exe
  2⤵
  PID:7424
- C:\Windows\System\cULrfay.exe
  C:\Windows\System\cULrfay.exe
  2⤵
  PID:7328
- C:\Windows\System\hgDbiRg.exe
  C:\Windows\System\hgDbiRg.exe
  2⤵
  PID:7192
- C:\Windows\System\sfXivRN.exe
  C:\Windows\System\sfXivRN.exe
  2⤵
  PID:7120
- C:\Windows\System\jzLMODe.exe
  C:\Windows\System\jzLMODe.exe
  2⤵
  PID:7040
- C:\Windows\System\lEvvwKB.exe
  C:\Windows\System\lEvvwKB.exe
  2⤵
  PID:6556
- C:\Windows\System\sqJYBon.exe
  C:\Windows\System\sqJYBon.exe
  2⤵
  PID:6492
- C:\Windows\System\UtgBTHy.exe
  C:\Windows\System\UtgBTHy.exe
  2⤵
  PID:7088
- C:\Windows\System\nGGuBDr.exe
  C:\Windows\System\nGGuBDr.exe
  2⤵
  PID:7044
- C:\Windows\System\GpNJPde.exe
  C:\Windows\System\GpNJPde.exe
  2⤵
  PID:6860
- C:\Windows\System\WFTxGVB.exe
  C:\Windows\System\WFTxGVB.exe
  2⤵
  PID:6216
- C:\Windows\System\WdCrklr.exe
  C:\Windows\System\WdCrklr.exe
  2⤵
  PID:6200
- C:\Windows\System\VjdTFgb.exe
  C:\Windows\System\VjdTFgb.exe
  2⤵
  PID:7164
- C:\Windows\System\LnTVLfX.exe
  C:\Windows\System\LnTVLfX.exe
  2⤵
  PID:7092
- C:\Windows\System\BiiknOT.exe
  C:\Windows\System\BiiknOT.exe
  2⤵
  PID:7048
- C:\Windows\System\mRuIKCl.exe
  C:\Windows\System\mRuIKCl.exe
  2⤵
  PID:6932
- C:\Windows\System\VSKEaDE.exe
  C:\Windows\System\VSKEaDE.exe
  2⤵
  PID:6852
- C:\Windows\System\VAfVuUV.exe
  C:\Windows\System\VAfVuUV.exe
  2⤵
  PID:6812
- C:\Windows\System\AiiXbfw.exe
  C:\Windows\System\AiiXbfw.exe
  2⤵
  PID:6792
- C:\Windows\System\eziNlUv.exe
  C:\Windows\System\eziNlUv.exe
  2⤵
  PID:6732
- C:\Windows\System\EhxEMfp.exe
  C:\Windows\System\EhxEMfp.exe
  2⤵
  PID:6708
- C:\Windows\System\fixjEEb.exe
  C:\Windows\System\fixjEEb.exe
  2⤵
  PID:6468
- C:\Windows\System\nxILtWx.exe
  C:\Windows\System\nxILtWx.exe
  2⤵
  PID:6448
- C:\Windows\System\GcaGkBk.exe
  C:\Windows\System\GcaGkBk.exe
  2⤵
  PID:6412
- C:\Windows\System\ghHewnB.exe
  C:\Windows\System\ghHewnB.exe
  2⤵
  PID:5740
- C:\Windows\System\JcDAnLP.exe
  C:\Windows\System\JcDAnLP.exe
  2⤵
  PID:5652
- C:\Windows\System\xeAulPC.exe
  C:\Windows\System\xeAulPC.exe
  2⤵
  PID:5444
- C:\Windows\System\EkULbBY.exe
  C:\Windows\System\EkULbBY.exe
  2⤵
  PID:5368
- C:\Windows\System\FjkBPhf.exe
  C:\Windows\System\FjkBPhf.exe
  2⤵
  PID:6140
- C:\Windows\System\uVPshPi.exe
  C:\Windows\System\uVPshPi.exe
  2⤵
  PID:6028
- C:\Windows\System\UFaQkLZ.exe
  C:\Windows\System\UFaQkLZ.exe
  2⤵
  PID:5472
- C:\Windows\System\dWLsOND.exe
  C:\Windows\System\dWLsOND.exe
  2⤵
  PID:5420
- C:\Windows\System\yEImsLX.exe
  C:\Windows\System\yEImsLX.exe
  2⤵
  PID:5376
- C:\Windows\System\ozjwFLO.exe
  C:\Windows\System\ozjwFLO.exe
  2⤵
  PID:5312
- C:\Windows\System\YYqODhW.exe
  C:\Windows\System\YYqODhW.exe
  2⤵
  PID:5264
- C:\Windows\System\YgYsgKE.exe
  C:\Windows\System\YgYsgKE.exe
  2⤵
  PID:5208
- C:\Windows\System\RXgwSsx.exe
  C:\Windows\System\RXgwSsx.exe
  2⤵
  PID:2720
- C:\Windows\System\iKkGSMW.exe
  C:\Windows\System\iKkGSMW.exe
  2⤵
  PID:3816
- C:\Windows\System\yfpUVMR.exe
  C:\Windows\System\yfpUVMR.exe
  2⤵
  PID:4756
- C:\Windows\System\EDvPbfT.exe
  C:\Windows\System\EDvPbfT.exe
  2⤵
  PID:780
- C:\Windows\System\aJdEydq.exe
  C:\Windows\System\aJdEydq.exe
  2⤵
  PID:824
- C:\Windows\System\IetCGwZ.exe
  C:\Windows\System\IetCGwZ.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\XmCGzTo.exe
  C:\Windows\System\XmCGzTo.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\ULQsxap.exe
  C:\Windows\System\ULQsxap.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\rdgAzuv.exe
  C:\Windows\System\rdgAzuv.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\wZiJHrK.exe
  C:\Windows\System\wZiJHrK.exe
  2⤵
  PID:8760
- C:\Windows\System\qYvkBTp.exe
  C:\Windows\System\qYvkBTp.exe
  2⤵
  PID:8280
- C:\Windows\System\OktlVVF.exe
  C:\Windows\System\OktlVVF.exe
  2⤵
  PID:8372
- C:\Windows\System\tKuMApJ.exe
  C:\Windows\System\tKuMApJ.exe
  2⤵
  PID:9252
- C:\Windows\System\XlxZAdM.exe
  C:\Windows\System\XlxZAdM.exe
  2⤵
  PID:9236
- C:\Windows\System\KPveBKn.exe
  C:\Windows\System\KPveBKn.exe
  2⤵
  PID:9268
- C:\Windows\System\idNtrgN.exe
  C:\Windows\System\idNtrgN.exe
  2⤵
  PID:9548
- C:\Windows\System\aNjckvy.exe
  C:\Windows\System\aNjckvy.exe
  2⤵
  PID:9520
- C:\Windows\System\kUmyGSW.exe
  C:\Windows\System\kUmyGSW.exe
  2⤵
  PID:9480
- C:\Windows\System\UtrMdug.exe
  C:\Windows\System\UtrMdug.exe
  2⤵
  PID:9696
- C:\Windows\System\buWbQLq.exe
  C:\Windows\System\buWbQLq.exe
  2⤵
  PID:9672
- C:\Windows\System\EiDgntD.exe
  C:\Windows\System\EiDgntD.exe
  2⤵
  PID:9728
- C:\Windows\System\ULjsYZY.exe
  C:\Windows\System\ULjsYZY.exe
  2⤵
  PID:9648
- C:\Windows\System\QqpmRbS.exe
  C:\Windows\System\QqpmRbS.exe
  2⤵
  PID:9628
- C:\Windows\System\ULklGLi.exe
  C:\Windows\System\ULklGLi.exe
  2⤵
  PID:9612
- C:\Windows\System\AfRsdfV.exe
  C:\Windows\System\AfRsdfV.exe
  2⤵
  PID:9460
- C:\Windows\System\CmfRplv.exe
  C:\Windows\System\CmfRplv.exe
  2⤵
  PID:9440
- C:\Windows\System\ICetily.exe
  C:\Windows\System\ICetily.exe
  2⤵
  PID:9416
- C:\Windows\System\GygbAQG.exe
  C:\Windows\System\GygbAQG.exe
  2⤵
  PID:9400
- C:\Windows\System\qxvxfqp.exe
  C:\Windows\System\qxvxfqp.exe
  2⤵
  PID:9372
- C:\Windows\System\SQEHRmN.exe
  C:\Windows\System\SQEHRmN.exe
  2⤵
  PID:7496
- C:\Windows\System\gsgvwjl.exe
  C:\Windows\System\gsgvwjl.exe
  2⤵
  PID:8944
- C:\Windows\System\CXNdXBH.exe
  C:\Windows\System\CXNdXBH.exe
  2⤵
  PID:8860
- C:\Windows\System\UwEsaoS.exe
  C:\Windows\System\UwEsaoS.exe
  2⤵
  PID:8504
- C:\Windows\System\ouAEhdD.exe
  C:\Windows\System\ouAEhdD.exe
  2⤵
  PID:8508
- C:\Windows\System\NQzPCEL.exe
  C:\Windows\System\NQzPCEL.exe
  2⤵
  PID:8336
- C:\Windows\System\SbeWRjz.exe
  C:\Windows\System\SbeWRjz.exe
  2⤵
  PID:9172
- C:\Windows\System\GVIiYmp.exe
  C:\Windows\System\GVIiYmp.exe
  2⤵
  PID:9140
- C:\Windows\System\VnNnUyS.exe
  C:\Windows\System\VnNnUyS.exe
  2⤵
  PID:9092
- C:\Windows\System\zhfIAwZ.exe
  C:\Windows\System\zhfIAwZ.exe
  2⤵
  PID:9076
- C:\Windows\System\ccrssWQ.exe
  C:\Windows\System\ccrssWQ.exe
  2⤵
  PID:9040
- C:\Windows\System\VxHjgqk.exe
  C:\Windows\System\VxHjgqk.exe
  2⤵
  PID:8960
- C:\Windows\System\qjFUSpS.exe
  C:\Windows\System\qjFUSpS.exe
  2⤵
  PID:9060
- C:\Windows\System\eUjugdH.exe
  C:\Windows\System\eUjugdH.exe
  2⤵
  PID:8908
- C:\Windows\System\SkAtlcx.exe
  C:\Windows\System\SkAtlcx.exe
  2⤵
  PID:9012
- C:\Windows\System\OCoqscw.exe
  C:\Windows\System\OCoqscw.exe
  2⤵
  PID:8836
- C:\Windows\System\ieUaOru.exe
  C:\Windows\System\ieUaOru.exe
  2⤵
  PID:8816
- C:\Windows\System\vrkPKGx.exe
  C:\Windows\System\vrkPKGx.exe
  2⤵
  PID:10060
- C:\Windows\System\lHpHyDO.exe
  C:\Windows\System\lHpHyDO.exe
  2⤵
  PID:10040
- C:\Windows\System\tMMIlwR.exe
  C:\Windows\System\tMMIlwR.exe
  2⤵
  PID:10132
- C:\Windows\System\cOGTCsx.exe
  C:\Windows\System\cOGTCsx.exe
  2⤵
  PID:10104
- C:\Windows\System\VAXnvRi.exe
  C:\Windows\System\VAXnvRi.exe
  2⤵
  PID:10084
- C:\Windows\System\hZuHyrM.exe
  C:\Windows\System\hZuHyrM.exe
  2⤵
  PID:10020
- C:\Windows\System\BINpfar.exe
  C:\Windows\System\BINpfar.exe
  2⤵
  PID:10176
- C:\Windows\System\ASyrxPQ.exe
  C:\Windows\System\ASyrxPQ.exe
  2⤵
  PID:9064
- C:\Windows\System\dfyzWpk.exe
  C:\Windows\System\dfyzWpk.exe
  2⤵
  PID:9244
- C:\Windows\System\wvwzjyd.exe
  C:\Windows\System\wvwzjyd.exe
  2⤵
  PID:8704
- C:\Windows\System\OnFtDKY.exe
  C:\Windows\System\OnFtDKY.exe
  2⤵
  PID:9192
- C:\Windows\System\IpFHuiG.exe
  C:\Windows\System\IpFHuiG.exe
  2⤵
  PID:8776
- C:\Windows\System\hTwesNf.exe
  C:\Windows\System\hTwesNf.exe
  2⤵
  PID:4076
- C:\Windows\System\LrlrlGd.exe
  C:\Windows\System\LrlrlGd.exe
  2⤵
  PID:10220
- C:\Windows\System\aRmcJhQ.exe
  C:\Windows\System\aRmcJhQ.exe
  2⤵
  PID:10204
- C:\Windows\System\hXBughX.exe
  C:\Windows\System\hXBughX.exe
  2⤵
  PID:9948
- C:\Windows\System\YCyfLPX.exe
  C:\Windows\System\YCyfLPX.exe
  2⤵
  PID:9900
- C:\Windows\System\OogyoTk.exe
  C:\Windows\System\OogyoTk.exe
  2⤵
  PID:9880
- C:\Windows\System\zBrKrss.exe
  C:\Windows\System\zBrKrss.exe
  2⤵
  PID:9328
- C:\Windows\System\kuQmFem.exe
  C:\Windows\System\kuQmFem.exe
  2⤵
  PID:9504
- C:\Windows\System\wxykuCn.exe
  C:\Windows\System\wxykuCn.exe
  2⤵
  PID:9456
- C:\Windows\System\Pyoxsva.exe
  C:\Windows\System\Pyoxsva.exe
  2⤵
  PID:9604
- C:\Windows\System\yOtMeWJ.exe
  C:\Windows\System\yOtMeWJ.exe
  2⤵
  PID:9572
- C:\Windows\System\BrNSgPL.exe
  C:\Windows\System\BrNSgPL.exe
  2⤵
  PID:9448
- C:\Windows\System\jExpUhX.exe
  C:\Windows\System\jExpUhX.exe
  2⤵
  PID:9756
- C:\Windows\System\YbHTRDh.exe
  C:\Windows\System\YbHTRDh.exe
  2⤵
  PID:984
- C:\Windows\System\GHmUfML.exe
  C:\Windows\System\GHmUfML.exe
  2⤵
  PID:9940
- C:\Windows\System\UUIiYES.exe
  C:\Windows\System\UUIiYES.exe
  2⤵
  PID:9984
- C:\Windows\System\FRJAAOy.exe
  C:\Windows\System\FRJAAOy.exe
  2⤵
  PID:9944
- C:\Windows\System\rObfWhP.exe
  C:\Windows\System\rObfWhP.exe
  2⤵
  PID:9908
- C:\Windows\System\rvZMcmu.exe
  C:\Windows\System\rvZMcmu.exe
  2⤵
  PID:2296
- C:\Windows\System\PDrlWrX.exe
  C:\Windows\System\PDrlWrX.exe
  2⤵
  PID:9872
- C:\Windows\System\tlZZvpB.exe
  C:\Windows\System\tlZZvpB.exe
  2⤵
  PID:9976
- C:\Windows\System\sXjmLCc.exe
  C:\Windows\System\sXjmLCc.exe
  2⤵
  PID:4864
- C:\Windows\System\OSrKhbJ.exe
  C:\Windows\System\OSrKhbJ.exe
  2⤵
  PID:9784
- C:\Windows\System\xXLUFru.exe
  C:\Windows\System\xXLUFru.exe
  2⤵
  PID:10048
- C:\Windows\System\PgGhogl.exe
  C:\Windows\System\PgGhogl.exe
  2⤵
  PID:1940
- C:\Windows\System\OwuIOEq.exe
  C:\Windows\System\OwuIOEq.exe
  2⤵
  PID:10188
- C:\Windows\System\uxBtWtT.exe
  C:\Windows\System\uxBtWtT.exe
  2⤵
  PID:2024
- C:\Windows\System\FUuEPUS.exe
  C:\Windows\System\FUuEPUS.exe
  2⤵
  PID:2528
- C:\Windows\System\wYrYNfc.exe
  C:\Windows\System\wYrYNfc.exe
  2⤵
  PID:9968
- C:\Windows\System\DRTShxP.exe
  C:\Windows\System\DRTShxP.exe
  2⤵
  PID:9292
- C:\Windows\System\UafzzUO.exe
  C:\Windows\System\UafzzUO.exe
  2⤵
  PID:3484
- C:\Windows\System\FJcbqEN.exe
  C:\Windows\System\FJcbqEN.exe
  2⤵
  PID:9164
- C:\Windows\System\lrdQLAa.exe
  C:\Windows\System\lrdQLAa.exe
  2⤵
  PID:2196
- C:\Windows\System\oGXMUNG.exe
  C:\Windows\System\oGXMUNG.exe
  2⤵
  PID:9748
- C:\Windows\System\LhZoCNv.exe
  C:\Windows\System\LhZoCNv.exe
  2⤵
  PID:9624
- C:\Windows\System\ICFpsfP.exe
  C:\Windows\System\ICFpsfP.exe
  2⤵
  PID:9956
- C:\Windows\System\WTRvdsE.exe
  C:\Windows\System\WTRvdsE.exe
  2⤵
  PID:10000
- C:\Windows\System\wJHKRWK.exe
  C:\Windows\System\wJHKRWK.exe
  2⤵
  PID:2484
- C:\Windows\System\PqVdfMN.exe
  C:\Windows\System\PqVdfMN.exe
  2⤵
  PID:9988
- C:\Windows\System\VEIaiKs.exe
  C:\Windows\System\VEIaiKs.exe
  2⤵
  PID:4624
- C:\Windows\System\aqelcsJ.exe
  C:\Windows\System\aqelcsJ.exe
  2⤵
  PID:740
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 740 -s 252
    3⤵
    PID:10452
- C:\Windows\System\awjGzqZ.exe
  C:\Windows\System\awjGzqZ.exe
  2⤵
  PID:10100
- C:\Windows\System\gPTNqzf.exe
  C:\Windows\System\gPTNqzf.exe
  2⤵
  PID:4260
- C:\Windows\System\uDVNpSH.exe
  C:\Windows\System\uDVNpSH.exe
  2⤵
  PID:9688
- C:\Windows\System\aHRqYsc.exe
  C:\Windows\System\aHRqYsc.exe
  2⤵
  PID:9660
- C:\Windows\System\ohLjCRh.exe
  C:\Windows\System\ohLjCRh.exe
  2⤵
  PID:9364
- C:\Windows\System\pEFMDxY.exe
  C:\Windows\System\pEFMDxY.exe
  2⤵
  PID:792
- C:\Windows\System\JylYDLR.exe
  C:\Windows\System\JylYDLR.exe
  2⤵
  PID:7244
- C:\Windows\System\attEHGx.exe
  C:\Windows\System\attEHGx.exe
  2⤵
  PID:1396
- C:\Windows\System\baxrbJn.exe
  C:\Windows\System\baxrbJn.exe
  2⤵
  PID:9996
- C:\Windows\System\qnLjchs.exe
  C:\Windows\System\qnLjchs.exe
  2⤵
  PID:9936
- C:\Windows\System\NWOdiNK.exe
  C:\Windows\System\NWOdiNK.exe
  2⤵
  PID:1988
- C:\Windows\System\tiuPWCC.exe
  C:\Windows\System\tiuPWCC.exe
  2⤵
  PID:10316
- C:\Windows\System\vCgtIPW.exe
  C:\Windows\System\vCgtIPW.exe
  2⤵
  PID:10380
- C:\Windows\System\zBqiVVh.exe
  C:\Windows\System\zBqiVVh.exe
  2⤵
  PID:10412
- C:\Windows\System\GncxOyC.exe
  C:\Windows\System\GncxOyC.exe
  2⤵
  PID:10508
- C:\Windows\System\uWYiKwW.exe
  C:\Windows\System\uWYiKwW.exe
  2⤵
  PID:10612
- C:\Windows\System\OxpAuBO.exe
  C:\Windows\System\OxpAuBO.exe
  2⤵
  PID:10636
- C:\Windows\System\mRHZslB.exe
  C:\Windows\System\mRHZslB.exe
  2⤵
  PID:10656
- C:\Windows\System\ddUfBJg.exe
  C:\Windows\System\ddUfBJg.exe
  2⤵
  PID:10692
- C:\Windows\System\PVytlVl.exe
  C:\Windows\System\PVytlVl.exe
  2⤵
  PID:10748
- C:\Windows\System\sqDqwsE.exe
  C:\Windows\System\sqDqwsE.exe
  2⤵
  PID:10852
- C:\Windows\System\ngtZNVV.exe
  C:\Windows\System\ngtZNVV.exe
  2⤵
  PID:10828
- C:\Windows\System\EPADhKV.exe
  C:\Windows\System\EPADhKV.exe
  2⤵
  PID:10884
- C:\Windows\System\iXKtNXS.exe
  C:\Windows\System\iXKtNXS.exe
  2⤵
  PID:10916
- C:\Windows\System\bIxLThX.exe
  C:\Windows\System\bIxLThX.exe
  2⤵
  PID:10900
- C:\Windows\System\ISFBKxu.exe
  C:\Windows\System\ISFBKxu.exe
  2⤵
  PID:10932
- C:\Windows\System\jRxZUhy.exe
  C:\Windows\System\jRxZUhy.exe
  2⤵
  PID:11016
- C:\Windows\System\tmhcCVo.exe
  C:\Windows\System\tmhcCVo.exe
  2⤵
  PID:11096
- C:\Windows\System\HLMTmQE.exe
  C:\Windows\System\HLMTmQE.exe
  2⤵
  PID:11072
- C:\Windows\System\UssyGbP.exe
  C:\Windows\System\UssyGbP.exe
  2⤵
  PID:10996
- C:\Windows\System\qwfEPfv.exe
  C:\Windows\System\qwfEPfv.exe
  2⤵
  PID:10976
- C:\Windows\System\AQzaArE.exe
  C:\Windows\System\AQzaArE.exe
  2⤵
  PID:10808
- C:\Windows\System\edUbmlK.exe
  C:\Windows\System\edUbmlK.exe
  2⤵
  PID:11176
- C:\Windows\System\jYhuyCA.exe
  C:\Windows\System\jYhuyCA.exe
  2⤵
  PID:11144
- C:\Windows\System\ZdluuhO.exe
  C:\Windows\System\ZdluuhO.exe
  2⤵
  PID:10784
- C:\Windows\System\jUeoGXo.exe
  C:\Windows\System\jUeoGXo.exe
  2⤵
  PID:10768
- C:\Windows\System\BJQOqPT.exe
  C:\Windows\System\BJQOqPT.exe
  2⤵
  PID:10728
- C:\Windows\System\UfONDtq.exe
  C:\Windows\System\UfONDtq.exe
  2⤵
  PID:9892
- C:\Windows\System\CrPkiMF.exe
  C:\Windows\System\CrPkiMF.exe
  2⤵
  PID:10300
- C:\Windows\System\sbPIsrk.exe
  C:\Windows\System\sbPIsrk.exe
  2⤵
  PID:10368
- C:\Windows\System\yQddpry.exe
  C:\Windows\System\yQddpry.exe
  2⤵
  PID:10312
- C:\Windows\System\xrqkeMZ.exe
  C:\Windows\System\xrqkeMZ.exe
  2⤵
  PID:10244
- C:\Windows\System\RNfkiAq.exe
  C:\Windows\System\RNfkiAq.exe
  2⤵
  PID:10444
- C:\Windows\System\hOkCWXT.exe
  C:\Windows\System\hOkCWXT.exe
  2⤵
  PID:4468
- C:\Windows\System\HyZFrSS.exe
  C:\Windows\System\HyZFrSS.exe
  2⤵
  PID:10516
- C:\Windows\System\aBtltrO.exe
  C:\Windows\System\aBtltrO.exe
  2⤵
  PID:10560
- C:\Windows\System\aZBXTRR.exe
  C:\Windows\System\aZBXTRR.exe
  2⤵
  PID:10756
- C:\Windows\System\gXFMkxt.exe
  C:\Windows\System\gXFMkxt.exe
  2⤵
  PID:10712
- C:\Windows\System\zHhKLyP.exe
  C:\Windows\System\zHhKLyP.exe
  2⤵
  PID:10940
- C:\Windows\System\bIluKgz.exe
  C:\Windows\System\bIluKgz.exe
  2⤵
  PID:11008
- C:\Windows\System\yynqmsx.exe
  C:\Windows\System\yynqmsx.exe
  2⤵
  PID:11068
- C:\Windows\System\zTpYdAV.exe
  C:\Windows\System\zTpYdAV.exe
  2⤵
  PID:11200
- C:\Windows\System\DAQKOna.exe
  C:\Windows\System\DAQKOna.exe
  2⤵
  PID:11140
- C:\Windows\System\ZtxkIwi.exe
  C:\Windows\System\ZtxkIwi.exe
  2⤵
  PID:11252
- C:\Windows\System\bKXqOCF.exe
  C:\Windows\System\bKXqOCF.exe
  2⤵
  PID:5200
- C:\Windows\System\XrpMEwA.exe
  C:\Windows\System\XrpMEwA.exe
  2⤵
  PID:10360
- C:\Windows\System\OYGFuzH.exe
  C:\Windows\System\OYGFuzH.exe
  2⤵
  PID:532
- C:\Windows\System\pRWdgoL.exe
  C:\Windows\System\pRWdgoL.exe
  2⤵
  PID:11216
- C:\Windows\System\qmlQrzs.exe
  C:\Windows\System\qmlQrzs.exe
  2⤵
  PID:11164
- C:\Windows\System\tojEWoX.exe
  C:\Windows\System\tojEWoX.exe
  2⤵
  PID:10460
- C:\Windows\System\VkKACgr.exe
  C:\Windows\System\VkKACgr.exe
  2⤵
  PID:3440
- C:\Windows\System\JsBSyAk.exe
  C:\Windows\System\JsBSyAk.exe
  2⤵
  PID:4992
- C:\Windows\System\GyzAvKf.exe
  C:\Windows\System\GyzAvKf.exe
  2⤵
  PID:10720
- C:\Windows\System\TADanLf.exe
  C:\Windows\System\TADanLf.exe
  2⤵
  PID:4228
- C:\Windows\System\NSbfYNH.exe
  C:\Windows\System\NSbfYNH.exe
  2⤵
  PID:10676
- C:\Windows\System\ximHukS.exe
  C:\Windows\System\ximHukS.exe
  2⤵
  PID:4532
- C:\Windows\System\WhvHSrB.exe
  C:\Windows\System\WhvHSrB.exe
  2⤵
  PID:4488
- C:\Windows\System\NQFDdYO.exe
  C:\Windows\System\NQFDdYO.exe
  2⤵
  PID:10596
- C:\Windows\System\qxkgjMO.exe
  C:\Windows\System\qxkgjMO.exe
  2⤵
  PID:10984
- C:\Windows\System\kMVChGr.exe
  C:\Windows\System\kMVChGr.exe
  2⤵
  PID:10824
- C:\Windows\System\wjGXtLg.exe
  C:\Windows\System\wjGXtLg.exe
  2⤵
  PID:552
- C:\Windows\System\NmcgHZR.exe
  C:\Windows\System\NmcgHZR.exe
  2⤵
  PID:10860
- C:\Windows\System\VPBQeru.exe
  C:\Windows\System\VPBQeru.exe
  2⤵
  PID:11124
- C:\Windows\System\mzsBgjS.exe
  C:\Windows\System\mzsBgjS.exe
  2⤵
  PID:11212
- C:\Windows\System\rHOEbkW.exe
  C:\Windows\System\rHOEbkW.exe
  2⤵
  PID:2880
- C:\Windows\System\Qyhqfsa.exe
  C:\Windows\System\Qyhqfsa.exe
  2⤵
  PID:3396
- C:\Windows\System\BUmxWzJ.exe
  C:\Windows\System\BUmxWzJ.exe
  2⤵
  PID:4128
- C:\Windows\System\FdPuVUB.exe
  C:\Windows\System\FdPuVUB.exe
  2⤵
  PID:11088
- C:\Windows\System\SeoBdIG.exe
  C:\Windows\System\SeoBdIG.exe
  2⤵
  PID:4248
- C:\Windows\System\EIrqGSy.exe
  C:\Windows\System\EIrqGSy.exe
  2⤵
  PID:1276
- C:\Windows\System\vkIabFW.exe
  C:\Windows\System\vkIabFW.exe
  2⤵
  PID:5144
- C:\Windows\System\FiIAsOm.exe
  C:\Windows\System\FiIAsOm.exe
  2⤵
  PID:11032
- C:\Windows\System\fdscxem.exe
  C:\Windows\System\fdscxem.exe
  2⤵
  PID:1412
- C:\Windows\System\lJAVLRi.exe
  C:\Windows\System\lJAVLRi.exe
  2⤵
  PID:3264
- C:\Windows\System\zIrnhgE.exe
  C:\Windows\System\zIrnhgE.exe
  2⤵
  PID:10504
- C:\Windows\System\sCionLf.exe
  C:\Windows\System\sCionLf.exe
  2⤵
  PID:11244
- C:\Windows\System\ovNQUxp.exe
  C:\Windows\System\ovNQUxp.exe
  2⤵
  PID:4140
- C:\Windows\System\CYSaqhJ.exe
  C:\Windows\System\CYSaqhJ.exe
  2⤵
  PID:10816
- C:\Windows\System\CCmTCjx.exe
  C:\Windows\System\CCmTCjx.exe
  2⤵
  PID:10804
- C:\Windows\System\nXahIbr.exe
  C:\Windows\System\nXahIbr.exe
  2⤵
  PID:2136
- C:\Windows\System\uoOExCA.exe
  C:\Windows\System\uoOExCA.exe
  2⤵
  PID:692
- C:\Windows\System\BEUTqDX.exe
  C:\Windows\System\BEUTqDX.exe
  2⤵
  PID:10644
- C:\Windows\System\jwLDZqD.exe
  C:\Windows\System\jwLDZqD.exe
  2⤵
  PID:10604
- C:\Windows\System\CqtObmg.exe
  C:\Windows\System\CqtObmg.exe
  2⤵
  PID:11224
- C:\Windows\System\cmDaukb.exe
  C:\Windows\System\cmDaukb.exe
  2⤵
  PID:1240
- C:\Windows\System\oPSNPPq.exe
  C:\Windows\System\oPSNPPq.exe
  2⤵
  PID:1096
- C:\Windows\System\xDWuWTp.exe
  C:\Windows\System\xDWuWTp.exe
  2⤵
  PID:1476
- C:\Windows\System\IkXUbjl.exe
  C:\Windows\System\IkXUbjl.exe
  2⤵
  PID:5616
- C:\Windows\System\ZtUZMiV.exe
  C:\Windows\System\ZtUZMiV.exe
  2⤵
  PID:5528
- C:\Windows\System\fIItkFY.exe
  C:\Windows\System\fIItkFY.exe
  2⤵
  PID:2992
- C:\Windows\System\dCBMUDb.exe
  C:\Windows\System\dCBMUDb.exe
  2⤵
  PID:6744
- C:\Windows\System\wLgCFmP.exe
  C:\Windows\System\wLgCFmP.exe
  2⤵
  PID:6920
- C:\Windows\System\OsRwWDF.exe
  C:\Windows\System\OsRwWDF.exe
  2⤵
  PID:4996
- C:\Windows\System\efCJfSs.exe
  C:\Windows\System\efCJfSs.exe
  2⤵
  PID:6752
- C:\Windows\System\KFpImxs.exe
  C:\Windows\System\KFpImxs.exe
  2⤵
  PID:5852
- C:\Windows\System\BIzSOPs.exe
  C:\Windows\System\BIzSOPs.exe
  2⤵
  PID:6060
- C:\Windows\System\kEFZOtQ.exe
  C:\Windows\System\kEFZOtQ.exe
  2⤵
  PID:4544
- C:\Windows\System\bVIIyGX.exe
  C:\Windows\System\bVIIyGX.exe
  2⤵
  PID:6864
- C:\Windows\System\LjUXjur.exe
  C:\Windows\System\LjUXjur.exe
  2⤵
  PID:7036
- C:\Windows\System\bUmFVlV.exe
  C:\Windows\System\bUmFVlV.exe
  2⤵
  PID:7212
- C:\Windows\System\pFVfmZn.exe
  C:\Windows\System\pFVfmZn.exe
  2⤵
  PID:6944
- C:\Windows\System\mDoOfSM.exe
  C:\Windows\System\mDoOfSM.exe
  2⤵
  PID:7608
- C:\Windows\System\hicfWht.exe
  C:\Windows\System\hicfWht.exe
  2⤵
  PID:6116
- C:\Windows\System\gQqqTZN.exe
  C:\Windows\System\gQqqTZN.exe
  2⤵
  PID:5300
- C:\Windows\System\mKFjvYf.exe
  C:\Windows\System\mKFjvYf.exe
  2⤵
  PID:9864
- C:\Windows\System\BWwcViH.exe
  C:\Windows\System\BWwcViH.exe
  2⤵
  PID:6904
- C:\Windows\System\vETRmht.exe
  C:\Windows\System\vETRmht.exe
  2⤵
  PID:7824
- C:\Windows\System\FzAGGQD.exe
  C:\Windows\System\FzAGGQD.exe
  2⤵
  PID:5712
- C:\Windows\System\WtiYjaM.exe
  C:\Windows\System\WtiYjaM.exe
  2⤵
  PID:1772
- C:\Windows\System\VjfZQdr.exe
  C:\Windows\System\VjfZQdr.exe
  2⤵
  PID:5564
- C:\Windows\System\SEUlKId.exe
  C:\Windows\System\SEUlKId.exe
  2⤵
  PID:5900
- C:\Windows\System\CAcRGZi.exe
  C:\Windows\System\CAcRGZi.exe
  2⤵
  PID:5728
- C:\Windows\System\wnSBYCP.exe
  C:\Windows\System\wnSBYCP.exe
  2⤵
  PID:6324
- C:\Windows\System\maAoiWd.exe
  C:\Windows\System\maAoiWd.exe
  2⤵
  PID:8056
- C:\Windows\System\UzvsyjJ.exe
  C:\Windows\System\UzvsyjJ.exe
  2⤵
  PID:3668
- C:\Windows\System\ZkyFxhk.exe
  C:\Windows\System\ZkyFxhk.exe
  2⤵
  PID:3976
- C:\Windows\System\EHQOGqz.exe
  C:\Windows\System\EHQOGqz.exe
  2⤵
  PID:5580
- C:\Windows\System\shLqala.exe
  C:\Windows\System\shLqala.exe
  2⤵
  PID:3992
- C:\Windows\System\xhgHEkB.exe
  C:\Windows\System\xhgHEkB.exe
  2⤵
  PID:3656
- C:\Windows\System\DAPcBeA.exe
  C:\Windows\System\DAPcBeA.exe
  2⤵
  PID:7924
- C:\Windows\System\okkXpMU.exe
  C:\Windows\System\okkXpMU.exe
  2⤵
  PID:6332
- C:\Windows\System\CoCDLkb.exe
  C:\Windows\System\CoCDLkb.exe
  2⤵
  PID:8160
- C:\Windows\System\TrnnZpS.exe
  C:\Windows\System\TrnnZpS.exe
  2⤵
  PID:10928
- C:\Windows\System\JgBQKhu.exe
  C:\Windows\System\JgBQKhu.exe
  2⤵
  PID:2548
- C:\Windows\System\EVvoaNm.exe
  C:\Windows\System\EVvoaNm.exe
  2⤵
  PID:6520
- C:\Windows\System\ejBVWdB.exe
  C:\Windows\System\ejBVWdB.exe
  2⤵
  PID:5436
- C:\Windows\System\DDHJsTk.exe
  C:\Windows\System\DDHJsTk.exe
  2⤵
  PID:7520
- C:\Windows\System\IxrXbpz.exe
  C:\Windows\System\IxrXbpz.exe
  2⤵
  PID:8040
- C:\Windows\System\jZhXhwQ.exe
  C:\Windows\System\jZhXhwQ.exe
  2⤵
  PID:5352
- C:\Windows\System\pTAaeeh.exe
  C:\Windows\System\pTAaeeh.exe
  2⤵
  PID:6908
- C:\Windows\System\OYLcurD.exe
  C:\Windows\System\OYLcurD.exe
  2⤵
  PID:8156
- C:\Windows\System\kweDZEg.exe
  C:\Windows\System\kweDZEg.exe
  2⤵
  PID:6772
- C:\Windows\System\YcmcDMZ.exe
  C:\Windows\System\YcmcDMZ.exe
  2⤵
  PID:8020
- C:\Windows\System\QPUpdNj.exe
  C:\Windows\System\QPUpdNj.exe
  2⤵
  PID:7612
- C:\Windows\System\xbYKDrR.exe
  C:\Windows\System\xbYKDrR.exe
  2⤵
  PID:6832
- C:\Windows\System\LAdLRoE.exe
  C:\Windows\System\LAdLRoE.exe
  2⤵
  PID:7900
- C:\Windows\System\YgFuinp.exe
  C:\Windows\System\YgFuinp.exe
  2⤵
  PID:4360
- C:\Windows\System\igKIUmM.exe
  C:\Windows\System\igKIUmM.exe
  2⤵
  PID:7284
- C:\Windows\System\vksDezg.exe
  C:\Windows\System\vksDezg.exe
  2⤵
  PID:5248
- C:\Windows\System\SVPpSbU.exe
  C:\Windows\System\SVPpSbU.exe
  2⤵
  PID:5776
- C:\Windows\System\XrBtLAR.exe
  C:\Windows\System\XrBtLAR.exe
  2⤵
  PID:6348
- C:\Windows\System\vzjmFgW.exe
  C:\Windows\System\vzjmFgW.exe
  2⤵
  PID:6596
- C:\Windows\System\FeJhGMm.exe
  C:\Windows\System\FeJhGMm.exe
  2⤵
  PID:5416
- C:\Windows\System\fxFdgcj.exe
  C:\Windows\System\fxFdgcj.exe
  2⤵
  PID:6072
- C:\Windows\System\ISmRSRH.exe
  C:\Windows\System\ISmRSRH.exe
  2⤵
  PID:4932
- C:\Windows\System\OmWKqwW.exe
  C:\Windows\System\OmWKqwW.exe
  2⤵
  PID:6716
- C:\Windows\System\glssQtL.exe
  C:\Windows\System\glssQtL.exe
  2⤵
  PID:8084
- C:\Windows\System\PGyFziJ.exe
  C:\Windows\System\PGyFziJ.exe
  2⤵
  PID:7880
- C:\Windows\System\vayTZxY.exe
  C:\Windows\System\vayTZxY.exe
  2⤵
  PID:5240
- C:\Windows\System\QjYzAsQ.exe
  C:\Windows\System\QjYzAsQ.exe
  2⤵
  PID:7032
- C:\Windows\System\MYISqOu.exe
  C:\Windows\System\MYISqOu.exe
  2⤵
  PID:8448
- C:\Windows\System\MMDJmxr.exe
  C:\Windows\System\MMDJmxr.exe
  2⤵
  PID:8476
- C:\Windows\System\iKuyuNv.exe
  C:\Windows\System\iKuyuNv.exe
  2⤵
  PID:8376
- C:\Windows\System\IFUxsZW.exe
  C:\Windows\System\IFUxsZW.exe
  2⤵
  PID:7788
- C:\Windows\System\tvuECGM.exe
  C:\Windows\System\tvuECGM.exe
  2⤵
  PID:7144
- C:\Windows\System\fvcSGLO.exe
  C:\Windows\System\fvcSGLO.exe
  2⤵
  PID:8440
- C:\Windows\System\pMCtVnR.exe
  C:\Windows\System\pMCtVnR.exe
  2⤵
  PID:7784
- C:\Windows\System\OUHKUiw.exe
  C:\Windows\System\OUHKUiw.exe
  2⤵
  PID:6112
- C:\Windows\System\YkHIqTD.exe
  C:\Windows\System\YkHIqTD.exe
  2⤵
  PID:8792
- C:\Windows\System\aDHjjvY.exe
  C:\Windows\System\aDHjjvY.exe
  2⤵
  PID:8876
- C:\Windows\System\OTQGlqp.exe
  C:\Windows\System\OTQGlqp.exe
  2⤵
  PID:10404
- C:\Windows\System\QeBTxLU.exe
  C:\Windows\System\QeBTxLU.exe
  2⤵
  PID:8992
- C:\Windows\System\bKUXSSF.exe
  C:\Windows\System\bKUXSSF.exe
  2⤵
  PID:8756
- C:\Windows\System\dJMFfDo.exe
  C:\Windows\System\dJMFfDo.exe
  2⤵
  PID:5172
- C:\Windows\System\JkMxRyc.exe
  C:\Windows\System\JkMxRyc.exe
  2⤵
  PID:9148
- C:\Windows\System\avdMELP.exe
  C:\Windows\System\avdMELP.exe
  2⤵
  PID:8892
- C:\Windows\System\estujyu.exe
  C:\Windows\System\estujyu.exe
  2⤵
  PID:5732
- C:\Windows\System\bHxdoOh.exe
  C:\Windows\System\bHxdoOh.exe
  2⤵
  PID:8388
- C:\Windows\System\KjpXMlc.exe
  C:\Windows\System\KjpXMlc.exe
  2⤵
  PID:5372
- C:\Windows\System\AbzBxQv.exe
  C:\Windows\System\AbzBxQv.exe
  2⤵
  PID:9792
- C:\Windows\System\gJAIfIa.exe
  C:\Windows\System\gJAIfIa.exe
  2⤵
  PID:8540
- C:\Windows\System\PrcPtcO.exe
  C:\Windows\System\PrcPtcO.exe
  2⤵
  PID:5584
- C:\Windows\System\QXZfuZZ.exe
  C:\Windows\System\QXZfuZZ.exe
  2⤵
  PID:7816
- C:\Windows\System\htBfdcL.exe
  C:\Windows\System\htBfdcL.exe
  2⤵
  PID:2176
- C:\Windows\System\RxOOILZ.exe
  C:\Windows\System\RxOOILZ.exe
  2⤵
  PID:6384
- C:\Windows\System\vcKlusm.exe
  C:\Windows\System\vcKlusm.exe
  2⤵
  PID:3552
- C:\Windows\System\UhTCEoH.exe
  C:\Windows\System\UhTCEoH.exe
  2⤵
  PID:5628
- C:\Windows\System\mgijXfJ.exe
  C:\Windows\System\mgijXfJ.exe
  2⤵
  PID:5252
- C:\Windows\System\YBpEEVP.exe
  C:\Windows\System\YBpEEVP.exe
  2⤵
  PID:7384
- C:\Windows\System\XqXYXzf.exe
  C:\Windows\System\XqXYXzf.exe
  2⤵
  PID:8008
- C:\Windows\System\jnjlLYJ.exe
  C:\Windows\System\jnjlLYJ.exe
  2⤵
  PID:6868
- C:\Windows\System\FyJFViY.exe
  C:\Windows\System\FyJFViY.exe
  2⤵
  PID:8088
- C:\Windows\System\FziokOT.exe
  C:\Windows\System\FziokOT.exe
  2⤵
  PID:6680
- C:\Windows\System\wmznSLt.exe
  C:\Windows\System\wmznSLt.exe
  2⤵
  PID:7960
- C:\Windows\System\TXkAQjf.exe
  C:\Windows\System\TXkAQjf.exe
  2⤵
  PID:5320
- C:\Windows\System\eOWxYRF.exe
  C:\Windows\System\eOWxYRF.exe
  2⤵
  PID:7684
- C:\Windows\System\toPSxmK.exe
  C:\Windows\System\toPSxmK.exe
  2⤵
  PID:8720
- C:\Windows\System\Dezysua.exe
  C:\Windows\System\Dezysua.exe
  2⤵
  PID:7732
- C:\Windows\System\EDgZwJa.exe
  C:\Windows\System\EDgZwJa.exe
  2⤵
  PID:7300
- C:\Windows\System\nqEPpLI.exe
  C:\Windows\System\nqEPpLI.exe
  2⤵
  PID:4036
- C:\Windows\System\TOwSLcX.exe
  C:\Windows\System\TOwSLcX.exe
  2⤵
  PID:6652
- C:\Windows\System\yonHgaK.exe
  C:\Windows\System\yonHgaK.exe
  2⤵
  PID:1728
- C:\Windows\System\hOgoSAp.exe
  C:\Windows\System\hOgoSAp.exe
  2⤵
  PID:9016
- C:\Windows\System\qKamLfr.exe
  C:\Windows\System\qKamLfr.exe
  2⤵
  PID:8552
- C:\Windows\System\wIsFSth.exe
  C:\Windows\System\wIsFSth.exe
  2⤵
  PID:8436
- C:\Windows\System\zfodoLd.exe
  C:\Windows\System\zfodoLd.exe
  2⤵
  PID:5612
- C:\Windows\System\FvbtZJD.exe
  C:\Windows\System\FvbtZJD.exe
  2⤵
  PID:8656
- C:\Windows\System\IqRsxjB.exe
  C:\Windows\System\IqRsxjB.exe
  2⤵
  PID:10708
- C:\Windows\System\NdMgrYa.exe
  C:\Windows\System\NdMgrYa.exe
  2⤵
  PID:5288
- C:\Windows\System\whxfAfD.exe
  C:\Windows\System\whxfAfD.exe
  2⤵
  PID:7632
- C:\Windows\System\sxhvTuC.exe
  C:\Windows\System\sxhvTuC.exe
  2⤵
  PID:8332
- C:\Windows\System\rOEgzMT.exe
  C:\Windows\System\rOEgzMT.exe
  2⤵
  PID:5856
- C:\Windows\System\LlPqLpB.exe
  C:\Windows\System\LlPqLpB.exe
  2⤵
  PID:6632
- C:\Windows\System\gRIBDeI.exe
  C:\Windows\System\gRIBDeI.exe
  2⤵
  PID:8888
- C:\Windows\System\hxwATZM.exe
  C:\Windows\System\hxwATZM.exe
  2⤵
  PID:9308
- C:\Windows\System\eLWxGwl.exe
  C:\Windows\System\eLWxGwl.exe
  2⤵
  PID:9232
- C:\Windows\System\qwffobE.exe
  C:\Windows\System\qwffobE.exe
  2⤵
  PID:9036
- C:\Windows\System\FVmdTbq.exe
  C:\Windows\System\FVmdTbq.exe
  2⤵
  PID:5708
- C:\Windows\System\gVxaVHj.exe
  C:\Windows\System\gVxaVHj.exe
  2⤵
  PID:9008
- C:\Windows\System\wxuTuPi.exe
  C:\Windows\System\wxuTuPi.exe
  2⤵
  PID:7572
- C:\Windows\System\spiMKVq.exe
  C:\Windows\System\spiMKVq.exe
  2⤵
  PID:7344
- C:\Windows\System\tDXFjQE.exe
  C:\Windows\System\tDXFjQE.exe
  2⤵
  PID:9184
- C:\Windows\System\BmhLspc.exe
  C:\Windows\System\BmhLspc.exe
  2⤵
  PID:3772
- C:\Windows\System\tVzDhaK.exe
  C:\Windows\System\tVzDhaK.exe
  2⤵
  PID:9600
- C:\Windows\System\jSEhgnk.exe
  C:\Windows\System\jSEhgnk.exe
  2⤵
  PID:9564
- C:\Windows\System\uXlyRaB.exe
  C:\Windows\System\uXlyRaB.exe
  2⤵
  PID:2088
- C:\Windows\System\XwwDIXp.exe
  C:\Windows\System\XwwDIXp.exe
  2⤵
  PID:3428
- C:\Windows\System\gYDJSCr.exe
  C:\Windows\System\gYDJSCr.exe
  2⤵
  PID:5260
- C:\Windows\System\VGnTrys.exe
  C:\Windows\System\VGnTrys.exe
  2⤵
  PID:8732
- C:\Windows\System\ytxidSD.exe
  C:\Windows\System\ytxidSD.exe
  2⤵
  PID:9512
- C:\Windows\System\uuLkBkt.exe
  C:\Windows\System\uuLkBkt.exe
  2⤵
  PID:9500
- C:\Windows\System\McjZrXu.exe
  C:\Windows\System\McjZrXu.exe
  2⤵
  PID:7124
- C:\Windows\System\RlemyXK.exe
  C:\Windows\System\RlemyXK.exe
  2⤵
  PID:7884
- C:\Windows\System\crwJYTR.exe
  C:\Windows\System\crwJYTR.exe
  2⤵
  PID:3296
- C:\Windows\System\CGwgSId.exe
  C:\Windows\System\CGwgSId.exe
  2⤵
  PID:10840
- C:\Windows\System\xCEKoJX.exe
  C:\Windows\System\xCEKoJX.exe
  2⤵
  PID:6300
- C:\Windows\System\iLdPYGa.exe
  C:\Windows\System\iLdPYGa.exe
  2⤵
  PID:9692
- C:\Windows\System\lgbbdps.exe
  C:\Windows\System\lgbbdps.exe
  2⤵
  PID:11268
- C:\Windows\System\nAVjDWz.exe
  C:\Windows\System\nAVjDWz.exe
  2⤵
  PID:11392
- C:\Windows\System\QVZhsqX.exe
  C:\Windows\System\QVZhsqX.exe
  2⤵
  PID:11368
- C:\Windows\System\HciaJCa.exe
  C:\Windows\System\HciaJCa.exe
  2⤵
  PID:11524
- C:\Windows\System\uokdzka.exe
  C:\Windows\System\uokdzka.exe
  2⤵
  PID:11740
- C:\Windows\System\eRWjABj.exe
  C:\Windows\System\eRWjABj.exe
  2⤵
  PID:11720
- C:\Windows\System\XAMvSjr.exe
  C:\Windows\System\XAMvSjr.exe
  2⤵
  PID:11696
- C:\Windows\System\YzcQclF.exe
  C:\Windows\System\YzcQclF.exe
  2⤵
  PID:11676
- C:\Windows\System\KYqxokG.exe
  C:\Windows\System\KYqxokG.exe
  2⤵
  PID:11656
- C:\Windows\System\vykRaBF.exe
  C:\Windows\System\vykRaBF.exe
  2⤵
  PID:11632
- C:\Windows\System\XFzqTeH.exe
  C:\Windows\System\XFzqTeH.exe
  2⤵
  PID:11612
- C:\Windows\System\XERBkOU.exe
  C:\Windows\System\XERBkOU.exe
  2⤵
  PID:11592
- C:\Windows\System\NckYswd.exe
  C:\Windows\System\NckYswd.exe
  2⤵
  PID:11568
- C:\Windows\System\bjEQKjR.exe
  C:\Windows\System\bjEQKjR.exe
  2⤵
  PID:11544
- C:\Windows\System\PSOJeQP.exe
  C:\Windows\System\PSOJeQP.exe
  2⤵
  PID:11500
- C:\Windows\System\DnXMJDw.exe
  C:\Windows\System\DnXMJDw.exe
  2⤵
  PID:11484
- C:\Windows\System\JgJOLCD.exe
  C:\Windows\System\JgJOLCD.exe
  2⤵
  PID:11452
- C:\Windows\System\VIbnPNI.exe
  C:\Windows\System\VIbnPNI.exe
  2⤵
  PID:11436
- C:\Windows\System\YXCfcoR.exe
  C:\Windows\System\YXCfcoR.exe
  2⤵
  PID:11412
- C:\Windows\System\YNHYFeg.exe
  C:\Windows\System\YNHYFeg.exe
  2⤵
  PID:11352
- C:\Windows\System\LwDoClk.exe
  C:\Windows\System\LwDoClk.exe
  2⤵
  PID:11320
- C:\Windows\System\ElxTRtW.exe
  C:\Windows\System\ElxTRtW.exe
  2⤵
  PID:9736
- C:\Windows\System\BctZwUB.exe
  C:\Windows\System\BctZwUB.exe
  2⤵
  PID:9312
- C:\Windows\System\trmMlTu.exe
  C:\Windows\System\trmMlTu.exe
  2⤵
  PID:9780
- C:\Windows\System\uGAMwKf.exe
  C:\Windows\System\uGAMwKf.exe
  2⤵
  PID:9656
- C:\Windows\System\WAdiZdh.exe
  C:\Windows\System\WAdiZdh.exe
  2⤵
  PID:12156
- C:\Windows\System\cZYsmsu.exe
  C:\Windows\System\cZYsmsu.exe
  2⤵
  PID:12264
- C:\Windows\System\TRgzmfL.exe
  C:\Windows\System\TRgzmfL.exe
  2⤵
  PID:9592
- C:\Windows\System\NbNjzAa.exe
  C:\Windows\System\NbNjzAa.exe
  2⤵
  PID:10184
- C:\Windows\System\CiOGCCm.exe
  C:\Windows\System\CiOGCCm.exe
  2⤵
  PID:11380
- C:\Windows\System\xDNgYHG.exe
  C:\Windows\System\xDNgYHG.exe
  2⤵
  PID:9804
- C:\Windows\System\nXPiTca.exe
  C:\Windows\System\nXPiTca.exe
  2⤵
  PID:6848
- C:\Windows\System\HYikcWt.exe
  C:\Windows\System\HYikcWt.exe
  2⤵
  PID:9800
- C:\Windows\System\DttiSeL.exe
  C:\Windows\System\DttiSeL.exe
  2⤵
  PID:10492
- C:\Windows\System\nQpmvgU.exe
  C:\Windows\System\nQpmvgU.exe
  2⤵
  PID:9860
- C:\Windows\System\vjkquFt.exe
  C:\Windows\System\vjkquFt.exe
  2⤵
  PID:9844
- C:\Windows\System\mBmbWud.exe
  C:\Windows\System\mBmbWud.exe
  2⤵
  PID:12244
- C:\Windows\System\WpLKWGm.exe
  C:\Windows\System\WpLKWGm.exe
  2⤵
  PID:12216
- C:\Windows\System\VFBWfKh.exe
  C:\Windows\System\VFBWfKh.exe
  2⤵
  PID:12196
- C:\Windows\System\zySmlgs.exe
  C:\Windows\System\zySmlgs.exe
  2⤵
  PID:11580
- C:\Windows\System\usmqOQT.exe
  C:\Windows\System\usmqOQT.exe
  2⤵
  PID:11712
- C:\Windows\System\QnrDqVX.exe
  C:\Windows\System\QnrDqVX.exe
  2⤵
  PID:11876
- C:\Windows\System\wZNEyqB.exe
  C:\Windows\System\wZNEyqB.exe
  2⤵
  PID:708
- C:\Windows\System\jToUFpg.exe
  C:\Windows\System\jToUFpg.exe
  2⤵
  PID:11780
- C:\Windows\System\mNrIxQG.exe
  C:\Windows\System\mNrIxQG.exe
  2⤵
  PID:11668
- C:\Windows\System\zRWGhTR.exe
  C:\Windows\System\zRWGhTR.exe
  2⤵
  PID:10156
- C:\Windows\System\vKgLLmo.exe
  C:\Windows\System\vKgLLmo.exe
  2⤵
  PID:12172
- C:\Windows\System\lxroXDb.exe
  C:\Windows\System\lxroXDb.exe
  2⤵
  PID:12100
- C:\Windows\System\MXvToYh.exe
  C:\Windows\System\MXvToYh.exe
  2⤵
  PID:12076
- C:\Windows\System\leGfQOc.exe
  C:\Windows\System\leGfQOc.exe
  2⤵
  PID:11964
- C:\Windows\System\YPtJxUx.exe
  C:\Windows\System\YPtJxUx.exe
  2⤵
  PID:11936
- C:\Windows\System\viGNXqe.exe
  C:\Windows\System\viGNXqe.exe
  2⤵
  PID:11916
- C:\Windows\System\ElhTaqd.exe
  C:\Windows\System\ElhTaqd.exe
  2⤵
  PID:11836
- C:\Windows\System\mxnjbeu.exe
  C:\Windows\System\mxnjbeu.exe
  2⤵
  PID:11812
- C:\Windows\System\aODiXGX.exe
  C:\Windows\System\aODiXGX.exe
  2⤵
  PID:11792
- C:\Windows\System\CUxHlIY.exe
  C:\Windows\System\CUxHlIY.exe
  2⤵
  PID:11856
- C:\Windows\System\zFNzxrl.exe
  C:\Windows\System\zFNzxrl.exe
  2⤵
  PID:11764
- C:\Windows\System\KrOaErk.exe
  C:\Windows\System\KrOaErk.exe
  2⤵
  PID:9896
- C:\Windows\System\PKsHCTv.exe
  C:\Windows\System\PKsHCTv.exe
  2⤵
  PID:12060
- C:\Windows\System\oJXqsxZ.exe
  C:\Windows\System\oJXqsxZ.exe
  2⤵
  PID:9260
- C:\Windows\System\YYYrbrQ.exe
  C:\Windows\System\YYYrbrQ.exe
  2⤵
  PID:12120
- C:\Windows\System\yNlNMTq.exe
  C:\Windows\System\yNlNMTq.exe
  2⤵
  PID:12164
- C:\Windows\System\uHcXHmQ.exe
  C:\Windows\System\uHcXHmQ.exe
  2⤵
  PID:8636
- C:\Windows\System\BlmIsGA.exe
  C:\Windows\System\BlmIsGA.exe
  2⤵
  PID:4956
- C:\Windows\System\OyRMYNw.exe
  C:\Windows\System\OyRMYNw.exe
  2⤵
  PID:1264
- C:\Windows\System\AsLRhnD.exe
  C:\Windows\System\AsLRhnD.exe
  2⤵
  PID:12188
- C:\Windows\System\aYQKXJg.exe
  C:\Windows\System\aYQKXJg.exe
  2⤵
  PID:8004
- C:\Windows\System\yvaAVVv.exe
  C:\Windows\System\yvaAVVv.exe
  2⤵
  PID:9540
- C:\Windows\System\MruBiYq.exe
  C:\Windows\System\MruBiYq.exe
  2⤵
  PID:11644
- C:\Windows\System\rxZKdEX.exe
  C:\Windows\System\rxZKdEX.exe
  2⤵
  PID:11316
- C:\Windows\System\HbEmara.exe
  C:\Windows\System\HbEmara.exe
  2⤵
  PID:11424
- C:\Windows\System\yNNFkpw.exe
  C:\Windows\System\yNNFkpw.exe
  2⤵
  PID:10568
- C:\Windows\System\XocHvNQ.exe
  C:\Windows\System\XocHvNQ.exe
  2⤵
  PID:11688
- C:\Windows\System\pPGpaDq.exe
  C:\Windows\System\pPGpaDq.exe
  2⤵
  PID:3276
- C:\Windows\System\WRWaefg.exe
  C:\Windows\System\WRWaefg.exe
  2⤵
  PID:11832
- C:\Windows\System\jUaCJLh.exe
  C:\Windows\System\jUaCJLh.exe
  2⤵
  PID:11892
- C:\Windows\System\cAIQUAp.exe
  C:\Windows\System\cAIQUAp.exe
  2⤵
  PID:11620
- C:\Windows\System\qrXtPuM.exe
  C:\Windows\System\qrXtPuM.exe
  2⤵
  PID:11444
- C:\Windows\System\qAYvwCx.exe
  C:\Windows\System\qAYvwCx.exe
  2⤵
  PID:12040
- C:\Windows\System\QYoDkxn.exe
  C:\Windows\System\QYoDkxn.exe
  2⤵
  PID:11956
- C:\Windows\System\OTGxnEw.exe
  C:\Windows\System\OTGxnEw.exe
  2⤵
  PID:11468
- C:\Windows\System\oVZKUqO.exe
  C:\Windows\System\oVZKUqO.exe
  2⤵
  PID:11408
- C:\Windows\System\deprMvX.exe
  C:\Windows\System\deprMvX.exe
  2⤵
  PID:3060
- C:\Windows\System\wHDnGbI.exe
  C:\Windows\System\wHDnGbI.exe
  2⤵
  PID:9228
- C:\Windows\System\DMLFXWW.exe
  C:\Windows\System\DMLFXWW.exe
  2⤵
  PID:11804
- C:\Windows\System\IAqoQDD.exe
  C:\Windows\System\IAqoQDD.exe
  2⤵
  PID:9532
- C:\Windows\System\FwSKzSi.exe
  C:\Windows\System\FwSKzSi.exe
  2⤵
  PID:8968
- C:\Windows\System\blIdPed.exe
  C:\Windows\System\blIdPed.exe
  2⤵
  PID:2748
- C:\Windows\System\YmcFSPN.exe
  C:\Windows\System\YmcFSPN.exe
  2⤵
  PID:2260
- C:\Windows\System\cSLlRta.exe
  C:\Windows\System\cSLlRta.exe
  2⤵
  PID:9836
- C:\Windows\System\jzfViEp.exe
  C:\Windows\System\jzfViEp.exe
  2⤵
  PID:12300
- C:\Windows\System\qgKTwcH.exe
  C:\Windows\System\qgKTwcH.exe
  2⤵
  PID:8316
- C:\Windows\System\LeOWTQR.exe
  C:\Windows\System\LeOWTQR.exe
  2⤵
  PID:12348
- C:\Windows\System\srFXRRS.exe
  C:\Windows\System\srFXRRS.exe
  2⤵
  PID:12328
- C:\Windows\System\beTsZpn.exe
  C:\Windows\System\beTsZpn.exe
  2⤵
  PID:12464
- C:\Windows\System\wuqDaDc.exe
  C:\Windows\System\wuqDaDc.exe
  2⤵
  PID:12484
- C:\Windows\System\uBtDPTf.exe
  C:\Windows\System\uBtDPTf.exe
  2⤵
  PID:12500
- C:\Windows\System\dKoUeqr.exe
  C:\Windows\System\dKoUeqr.exe
  2⤵
  PID:12528
- C:\Windows\System\XsNkqLP.exe
  C:\Windows\System\XsNkqLP.exe
  2⤵
  PID:12656
- C:\Windows\System\hRwoAAd.exe
  C:\Windows\System\hRwoAAd.exe
  2⤵
  PID:12684
- C:\Windows\System\WgmMoiJ.exe
  C:\Windows\System\WgmMoiJ.exe
  2⤵
  PID:12700
- C:\Windows\System\nxaeIQi.exe
  C:\Windows\System\nxaeIQi.exe
  2⤵
  PID:12752
- C:\Windows\System\qmsKlFw.exe
  C:\Windows\System\qmsKlFw.exe
  2⤵
  PID:12796
- C:\Windows\System\ayEJzXI.exe
  C:\Windows\System\ayEJzXI.exe
  2⤵
  PID:12820
- C:\Windows\System\MCIJaMd.exe
  C:\Windows\System\MCIJaMd.exe
  2⤵
  PID:12776
- C:\Windows\System\MjHgjUP.exe
  C:\Windows\System\MjHgjUP.exe
  2⤵
  PID:12888
- C:\Windows\System\JCwXYge.exe
  C:\Windows\System\JCwXYge.exe
  2⤵
  PID:12916
- C:\Windows\System\ySFILZz.exe
  C:\Windows\System\ySFILZz.exe
  2⤵
  PID:13156
- C:\Windows\System\bZuTRWT.exe
  C:\Windows\System\bZuTRWT.exe
  2⤵
  PID:13136
- C:\Windows\System\hIozcbu.exe
  C:\Windows\System\hIozcbu.exe
  2⤵
  PID:13216
- C:\Windows\System\vpsfVvd.exe
  C:\Windows\System\vpsfVvd.exe
  2⤵
  PID:13260
- C:\Windows\System\fLZTVbV.exe
  C:\Windows\System\fLZTVbV.exe
  2⤵
  PID:11496
- C:\Windows\System\yddJPqk.exe
  C:\Windows\System\yddJPqk.exe
  2⤵
  PID:12412
- C:\Windows\System\nWUUGTl.exe
  C:\Windows\System\nWUUGTl.exe
  2⤵
  PID:12608
- C:\Windows\System\zpshSVU.exe
  C:\Windows\System\zpshSVU.exe
  2⤵
  PID:12588
- C:\Windows\System\kVwKGdh.exe
  C:\Windows\System\kVwKGdh.exe
  2⤵
  PID:12576
- C:\Windows\System\zAAFttX.exe
  C:\Windows\System\zAAFttX.exe
  2⤵
  PID:12376
- C:\Windows\System\rfFiLBH.exe
  C:\Windows\System\rfFiLBH.exe
  2⤵
  PID:12356
- C:\Windows\System\txzHYbF.exe
  C:\Windows\System\txzHYbF.exe
  2⤵
  PID:12312
- C:\Windows\System\uUhjpyZ.exe
  C:\Windows\System\uUhjpyZ.exe
  2⤵
  PID:9412
- C:\Windows\System\FAaLabL.exe
  C:\Windows\System\FAaLabL.exe
  2⤵
  PID:13296
- C:\Windows\System\rqgNvWJ.exe
  C:\Windows\System\rqgNvWJ.exe
  2⤵
  PID:13196
- C:\Windows\System\cMunJsk.exe
  C:\Windows\System\cMunJsk.exe
  2⤵
  PID:13176
- C:\Windows\System\DqJtAfz.exe
  C:\Windows\System\DqJtAfz.exe
  2⤵
  PID:13116
- C:\Windows\System\Mdxygux.exe
  C:\Windows\System\Mdxygux.exe
  2⤵
  PID:12788
- C:\Windows\System\ASqPOYz.exe
  C:\Windows\System\ASqPOYz.exe
  2⤵
  PID:12900
- C:\Windows\System\qNwPlXY.exe
  C:\Windows\System\qNwPlXY.exe
  2⤵
  PID:12720
- C:\Windows\System\VInYHUp.exe
  C:\Windows\System\VInYHUp.exe
  2⤵
  PID:12624
- C:\Windows\System\ceZovam.exe
  C:\Windows\System\ceZovam.exe
  2⤵
  PID:12984
- C:\Windows\System\VIDvWvU.exe
  C:\Windows\System\VIDvWvU.exe
  2⤵
  PID:12964
- C:\Windows\System\HtiBBtO.exe
  C:\Windows\System\HtiBBtO.exe
  2⤵
  PID:1644
- C:\Windows\System\kgDLmmQ.exe
  C:\Windows\System\kgDLmmQ.exe
  2⤵
  PID:13100
- C:\Windows\System\GnxBuek.exe
  C:\Windows\System\GnxBuek.exe
  2⤵
  PID:13084
- C:\Windows\System\YmonZoE.exe
  C:\Windows\System\YmonZoE.exe
  2⤵
  PID:13064
- C:\Windows\System\UmcPnBG.exe
  C:\Windows\System\UmcPnBG.exe
  2⤵
  PID:8928
- C:\Windows\System\WOmRXxb.exe
  C:\Windows\System\WOmRXxb.exe
  2⤵
  PID:13204
- C:\Windows\System\mbPdOll.exe
  C:\Windows\System\mbPdOll.exe
  2⤵
  PID:13272
- C:\Windows\System\rrJQXJF.exe
  C:\Windows\System\rrJQXJF.exe
  2⤵
  PID:3512
- C:\Windows\System\oJbgvdm.exe
  C:\Windows\System\oJbgvdm.exe
  2⤵
  PID:12472
- C:\Windows\System\LvECdbv.exe
  C:\Windows\System\LvECdbv.exe
  2⤵
  PID:12600
- C:\Windows\System\wcLUNmn.exe
  C:\Windows\System\wcLUNmn.exe
  2⤵
  PID:12840
- C:\Windows\System\OYfOmJS.exe
  C:\Windows\System\OYfOmJS.exe
  2⤵
  PID:12632
- C:\Windows\System\HQwZHHx.exe
  C:\Windows\System\HQwZHHx.exe
  2⤵
  PID:12552
- C:\Windows\System\XxnrETB.exe
  C:\Windows\System\XxnrETB.exe
  2⤵
  PID:4852
- C:\Windows\System\MetUXyx.exe
  C:\Windows\System\MetUXyx.exe
  2⤵
  PID:12340
- C:\Windows\System\agwKlPW.exe
  C:\Windows\System\agwKlPW.exe
  2⤵
  PID:12256
- C:\Windows\System\HimXdfi.exe
  C:\Windows\System\HimXdfi.exe
  2⤵
  PID:3420
- C:\Windows\System\uDEQITY.exe
  C:\Windows\System\uDEQITY.exe
  2⤵
  PID:10744
- C:\Windows\System\vdrEkEM.exe
  C:\Windows\System\vdrEkEM.exe
  2⤵
  PID:12664
- C:\Windows\System\AoZvdNl.exe
  C:\Windows\System\AoZvdNl.exe
  2⤵
  PID:12596
- C:\Windows\System\LhFbeTK.exe
  C:\Windows\System\LhFbeTK.exe
  2⤵
  PID:1464
- C:\Windows\System\Ljfgeua.exe
  C:\Windows\System\Ljfgeua.exe
  2⤵
  PID:13168
- C:\Windows\System\GksjDtY.exe
  C:\Windows\System\GksjDtY.exe
  2⤵
  PID:2396
- C:\Windows\System\cGmwVrN.exe
  C:\Windows\System\cGmwVrN.exe
  2⤵
  PID:13340
- C:\Windows\System\fXgHXKk.exe
  C:\Windows\System\fXgHXKk.exe
  2⤵
  PID:13316
- C:\Windows\System\qxYfHVH.exe
  C:\Windows\System\qxYfHVH.exe
  2⤵
  PID:12620
- C:\Windows\System\cOZWpkG.exe
  C:\Windows\System\cOZWpkG.exe
  2⤵
  PID:11184
- C:\Windows\System\eiZZfQf.exe
  C:\Windows\System\eiZZfQf.exe
  2⤵
  PID:1044
- C:\Windows\System\zrteCXl.exe
  C:\Windows\System\zrteCXl.exe
  2⤵
  PID:13128
- C:\Windows\System\IunRPbm.exe
  C:\Windows\System\IunRPbm.exe
  2⤵
  PID:13568
- C:\Windows\System\wfNYcWk.exe
  C:\Windows\System\wfNYcWk.exe
  2⤵
  PID:13584
- C:\Windows\System\fCpxcZj.exe
  C:\Windows\System\fCpxcZj.exe
  2⤵
  PID:13732
- C:\Windows\System\CiRwgrv.exe
  C:\Windows\System\CiRwgrv.exe
  2⤵
  PID:13632
- C:\Windows\System\PrcjGgA.exe
  C:\Windows\System\PrcjGgA.exe
  2⤵
  PID:13540
- C:\Windows\System\ABTwMpG.exe
  C:\Windows\System\ABTwMpG.exe
  2⤵
  PID:13516
- C:\Windows\System\sqblTpx.exe
  C:\Windows\System\sqblTpx.exe
  2⤵
  PID:13476
- C:\Windows\System\KdkUsrU.exe
  C:\Windows\System\KdkUsrU.exe
  2⤵
  PID:13456
- C:\Windows\System\cQGjkqD.exe
  C:\Windows\System\cQGjkqD.exe
  2⤵
  PID:14024
- C:\Windows\System\QShItYj.exe
  C:\Windows\System\QShItYj.exe
  2⤵
  PID:14068
- C:\Windows\System\WghJiFG.exe
  C:\Windows\System\WghJiFG.exe
  2⤵
  PID:10944
- C:\Windows\System\NyrAxim.exe
  C:\Windows\System\NyrAxim.exe
  2⤵
  PID:13048
- C:\Windows\System\oiZSnsf.exe
  C:\Windows\System\oiZSnsf.exe
  2⤵
  PID:13208
- C:\Windows\System\JBAqBRf.exe
  C:\Windows\System\JBAqBRf.exe
  2⤵
  PID:13684
- C:\Windows\System\UDYVPyq.exe
  C:\Windows\System\UDYVPyq.exe
  2⤵
  PID:13580
- C:\Windows\System\ujDmAjT.exe
  C:\Windows\System\ujDmAjT.exe
  2⤵
  PID:13932
- C:\Windows\System\SCxXEhj.exe
  C:\Windows\System\SCxXEhj.exe
  2⤵
  PID:13812
- C:\Windows\System\UITUzsF.exe
  C:\Windows\System\UITUzsF.exe
  2⤵
  PID:10468
- C:\Windows\System\echSJCi.exe
  C:\Windows\System\echSJCi.exe
  2⤵
  PID:4528
- C:\Windows\System\uGavncj.exe
  C:\Windows\System\uGavncj.exe
  2⤵
  PID:14308
- C:\Windows\System\UalEaJw.exe
  C:\Windows\System\UalEaJw.exe
  2⤵
  PID:3904
- C:\Windows\System\JLTQDku.exe
  C:\Windows\System\JLTQDku.exe
  2⤵
  PID:11056
- C:\Windows\System\VLleKCZ.exe
  C:\Windows\System\VLleKCZ.exe
  2⤵
  PID:14256
- C:\Windows\System\yAklVDu.exe
  C:\Windows\System\yAklVDu.exe
  2⤵
  PID:14272
- C:\Windows\System\YavcyHL.exe
  C:\Windows\System\YavcyHL.exe
  2⤵
  PID:14128
- C:\Windows\System\wKeZExl.exe
  C:\Windows\System\wKeZExl.exe
  2⤵
  PID:14032
- C:\Windows\System\HFLdZdv.exe
  C:\Windows\System\HFLdZdv.exe
  2⤵
  PID:14056
- C:\Windows\System\crIQnKk.exe
  C:\Windows\System\crIQnKk.exe
  2⤵
  PID:13984
- C:\Windows\System\HfQbBjl.exe
  C:\Windows\System\HfQbBjl.exe
  2⤵
  PID:13956
- C:\Windows\System\rUgsPNV.exe
  C:\Windows\System\rUgsPNV.exe
  2⤵
  PID:13672
- C:\Windows\System\ZrxJhMJ.exe
  C:\Windows\System\ZrxJhMJ.exe
  2⤵
  PID:13484
- C:\Windows\System\MupBudQ.exe
  C:\Windows\System\MupBudQ.exe
  2⤵
  PID:13448
- C:\Windows\System\oxwVxaD.exe
  C:\Windows\System\oxwVxaD.exe
  2⤵
  PID:13432
- C:\Windows\System\lowKsWA.exe
  C:\Windows\System\lowKsWA.exe
  2⤵
  PID:13532
- C:\Windows\System\NCBFDIS.exe
  C:\Windows\System\NCBFDIS.exe
  2⤵
  PID:10252
- C:\Windows\System\EQurmbr.exe
  C:\Windows\System\EQurmbr.exe
  2⤵
  PID:12296
- C:\Windows\System\qXZXnIQ.exe
  C:\Windows\System\qXZXnIQ.exe
  2⤵
  PID:7740
- C:\Windows\System\mdhnsaZ.exe
  C:\Windows\System\mdhnsaZ.exe
  2⤵
  PID:7780
- C:\Windows\System\ZrAqAbr.exe
  C:\Windows\System\ZrAqAbr.exe
  2⤵
  PID:14284
- C:\Windows\System\eTJdxtn.exe
  C:\Windows\System\eTJdxtn.exe
  2⤵
  PID:14244
- C:\Windows\System\NGTkqUI.exe
  C:\Windows\System\NGTkqUI.exe
  2⤵
  PID:14156
- C:\Windows\System\QfqWvIK.exe
  C:\Windows\System\QfqWvIK.exe
  2⤵
  PID:14132
- C:\Windows\System\YKvcGDd.exe
  C:\Windows\System\YKvcGDd.exe
  2⤵
  PID:14108
- C:\Windows\System\dtWTmXB.exe
  C:\Windows\System\dtWTmXB.exe
  2⤵
  PID:14008
- C:\Windows\System\WWnDwKN.exe
  C:\Windows\System\WWnDwKN.exe
  2⤵
  PID:13988
- C:\Windows\System\kuxCsrj.exe
  C:\Windows\System\kuxCsrj.exe
  2⤵
  PID:13968
- C:\Windows\System\RLOjOMw.exe
  C:\Windows\System\RLOjOMw.exe
  2⤵
  PID:13944
- C:\Windows\System\fNqFIAj.exe
  C:\Windows\System\fNqFIAj.exe
  2⤵
  PID:13924
- C:\Windows\System\wDGvQtl.exe
  C:\Windows\System\wDGvQtl.exe
  2⤵
  PID:13900
- C:\Windows\System\VGOSqzL.exe
  C:\Windows\System\VGOSqzL.exe
  2⤵
  PID:13840
- C:\Windows\System\skXOVJP.exe
  C:\Windows\System\skXOVJP.exe
  2⤵
  PID:13816
- C:\Windows\System\vFbyFbW.exe
  C:\Windows\System\vFbyFbW.exe
  2⤵
  PID:13440
- C:\Windows\System\RdIAlgX.exe
  C:\Windows\System\RdIAlgX.exe
  2⤵
  PID:13384
- C:\Windows\System\BYwKjTU.exe
  C:\Windows\System\BYwKjTU.exe
  2⤵
  PID:13360
- C:\Windows\System\IqRFTBQ.exe
  C:\Windows\System\IqRFTBQ.exe
  2⤵
  PID:13256
- C:\Windows\System\hmFebWK.exe
  C:\Windows\System\hmFebWK.exe
  2⤵
  PID:10972
- C:\Windows\System\nIYgqFL.exe
  C:\Windows\System\nIYgqFL.exe
  2⤵
  PID:13104
- C:\Windows\System\juHgwlY.exe
  C:\Windows\System\juHgwlY.exe
  2⤵
  PID:11036
- C:\Windows\System\PWhqrGX.exe
  C:\Windows\System\PWhqrGX.exe
  2⤵
  PID:13236
- C:\Windows\System\ecUmEoQ.exe
  C:\Windows\System\ecUmEoQ.exe
  2⤵
  PID:10652
- C:\Windows\System\VpMmTLm.exe
  C:\Windows\System\VpMmTLm.exe
  2⤵
  PID:13020
- C:\Windows\System\lmKJxgl.exe
  C:\Windows\System\lmKJxgl.exe
  2⤵
  PID:13052
- C:\Windows\System\rOAjSld.exe
  C:\Windows\System\rOAjSld.exe
  2⤵
  PID:13224
- C:\Windows\System\uUtwjch.exe
  C:\Windows\System\uUtwjch.exe
  2⤵
  PID:13148
- C:\Windows\System\dFKTtwb.exe
  C:\Windows\System\dFKTtwb.exe
  2⤵
  PID:4452
- C:\Windows\System\ojOlgdr.exe
  C:\Windows\System\ojOlgdr.exe
  2⤵
  PID:13108
- C:\Windows\System\RHcesJX.exe
  C:\Windows\System\RHcesJX.exe
  2⤵
  PID:10116
- C:\Windows\System\AAICbOX.exe
  C:\Windows\System\AAICbOX.exe
  2⤵
  PID:14088
- C:\Windows\System\YBdjSep.exe
  C:\Windows\System\YBdjSep.exe
  2⤵
  PID:5460
- C:\Windows\System\SXLwTkX.exe
  C:\Windows\System\SXLwTkX.exe
  2⤵
  PID:2980
- C:\Windows\System\dKsYukK.exe
  C:\Windows\System\dKsYukK.exe
  2⤵
  PID:10448
- C:\Windows\System\ABywkwm.exe
  C:\Windows\System\ABywkwm.exe
  2⤵
  PID:2672
- C:\Windows\System\eCHNfbk.exe
  C:\Windows\System\eCHNfbk.exe
  2⤵
  PID:3808
- C:\Windows\System\ivuJoBn.exe
  C:\Windows\System\ivuJoBn.exe
  2⤵
  PID:13500
- C:\Windows\System\AyJsYiQ.exe
  C:\Windows\System\AyJsYiQ.exe
  2⤵
  PID:13468
- C:\Windows\System\cKffwvF.exe
  C:\Windows\System\cKffwvF.exe
  2⤵
  PID:11260
- C:\Windows\System\rcTshVI.exe
  C:\Windows\System\rcTshVI.exe
  2⤵
  PID:2160
- C:\Windows\System\gGaUPoo.exe
  C:\Windows\System\gGaUPoo.exe
  2⤵
  PID:10664
- C:\Windows\System\EDWZHsw.exe
  C:\Windows\System\EDWZHsw.exe
  2⤵
  PID:3820
- C:\Windows\System\vNwLejz.exe
  C:\Windows\System\vNwLejz.exe
  2⤵
  PID:12452
- C:\Windows\System\bhlRujf.exe
  C:\Windows\System\bhlRujf.exe
  2⤵
  PID:14152
- C:\Windows\System\sogsJLg.exe
  C:\Windows\System\sogsJLg.exe
  2⤵
  PID:12928
- C:\Windows\System\UqWUOty.exe
  C:\Windows\System\UqWUOty.exe
  2⤵
  PID:14084
- C:\Windows\System\kJctIPR.exe
  C:\Windows\System\kJctIPR.exe
  2⤵
  PID:2140
- C:\Windows\System\DbwTJbz.exe
  C:\Windows\System\DbwTJbz.exe
  2⤵
  PID:12696
- C:\Windows\System\KtHpYbO.exe
  C:\Windows\System\KtHpYbO.exe
  2⤵
  PID:4988
- C:\Windows\System\QwBVBqY.exe
  C:\Windows\System\QwBVBqY.exe
  2⤵
  PID:5384
- C:\Windows\System\QeUuVwy.exe
  C:\Windows\System\QeUuVwy.exe
  2⤵
  PID:1980
- C:\Windows\System\IuHZQnZ.exe
  C:\Windows\System\IuHZQnZ.exe
  2⤵
  PID:1792
- C:\Windows\System\FYVFdqp.exe
  C:\Windows\System\FYVFdqp.exe
  2⤵
  PID:12440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\GLupIny.exe

Filesize
1.9MB

MD5
5750f37ecd277cb1e92a3820167201df

SHA1
8d42ff171d9f30dab8cc1f842496f445c9a0d00d

SHA256
528f741fe8aa3192142cf8929314615d8fc9f2515adf4fae643b5e8539d704eb

SHA512
de7ca5b7626e93e1ad746186d5b86bf8a3b017ae62c60bf587e3e8224f48eb8018a2640c70aed45036427edb5c2cd4f3ab2941d1c8dc365e6c34a5d57388f830

Download Submit
C:\Windows\System\GLupIny.exe

Filesize
1.9MB

MD5
5750f37ecd277cb1e92a3820167201df

SHA1
8d42ff171d9f30dab8cc1f842496f445c9a0d00d

SHA256
528f741fe8aa3192142cf8929314615d8fc9f2515adf4fae643b5e8539d704eb

SHA512
de7ca5b7626e93e1ad746186d5b86bf8a3b017ae62c60bf587e3e8224f48eb8018a2640c70aed45036427edb5c2cd4f3ab2941d1c8dc365e6c34a5d57388f830

Download Submit
C:\Windows\System\HoFHcPy.exe

Filesize
1.9MB

MD5
3f61e6d49c25bb3e60f6820d6148c5f7

SHA1
7d82cffda1018fde3adbb4c6b2d9f2abf1830f80

SHA256
ba9bd41b5d8f22d2f274bceed82e66269b7cf8fe59de2362a6673b117323a429

SHA512
4c644019db2cfb2e9871fa8cb455c48ce33426a9cc7658b870a631624371a8a88e00dcfabc44584ce7944be391a12e1ba642b27cf00ea7c32b7fdc703eca0f58

Download Submit
C:\Windows\System\IetCGwZ.exe

Filesize
1.9MB

MD5
c8a16326dae669c4145c964c7b5e235c

SHA1
6ba07db9431b525f0628a8aa694310b6f6686168

SHA256
2c4ba8dbcd270f3bd97e7e3fd7f3b77fb0b214b8178d3b29a8a05eaade92149a

SHA512
d5fcafcb3eb24d5ac91c872b38267c83ae0a44d0485123bd0eec63576cb36760a69af62dacaf5b973d890705f8be038e781cae1167828f14abb10ee9cb956a45

Download Submit
C:\Windows\System\IetCGwZ.exe

Filesize
1.9MB

MD5
c8a16326dae669c4145c964c7b5e235c

SHA1
6ba07db9431b525f0628a8aa694310b6f6686168

SHA256
2c4ba8dbcd270f3bd97e7e3fd7f3b77fb0b214b8178d3b29a8a05eaade92149a

SHA512
d5fcafcb3eb24d5ac91c872b38267c83ae0a44d0485123bd0eec63576cb36760a69af62dacaf5b973d890705f8be038e781cae1167828f14abb10ee9cb956a45

Download Submit
C:\Windows\System\JHkeAyr.exe

Filesize
1.9MB

MD5
ee704febbcbe8680f6b8eda922edd146

SHA1
bcc08e079b10ced8fb18e09a74cd163a7c695f3b

SHA256
2764d0e4e5ac90abf9071a74890ea029c2649e2e74a543ae353b38c6103ef1f1

SHA512
3b56c20fda2781fa238e3c28dcf850c247072cf3870b580ccf2ad3e63308931759b3f4cd6faa877b624e4825cbed610b90f12eb1c4b62c330834bde6ccfd2e9b

Download Submit
C:\Windows\System\JHkeAyr.exe

Filesize
1.9MB

MD5
ee704febbcbe8680f6b8eda922edd146

SHA1
bcc08e079b10ced8fb18e09a74cd163a7c695f3b

SHA256
2764d0e4e5ac90abf9071a74890ea029c2649e2e74a543ae353b38c6103ef1f1

SHA512
3b56c20fda2781fa238e3c28dcf850c247072cf3870b580ccf2ad3e63308931759b3f4cd6faa877b624e4825cbed610b90f12eb1c4b62c330834bde6ccfd2e9b

Download Submit
C:\Windows\System\JTSkkzf.exe

Filesize
1.9MB

MD5
2847461e7dbe4b83949ae5b6d146a518

SHA1
c90431066f2d9c91d670b944e080686b8208f9be

SHA256
a76db1c370c7671010ac2405ba9ffb79e6b5d931831bc4de57d3a7157e695c89

SHA512
75a734b422773e325cc9a04aeab9f96ba36a583ead29a525ed9f1cfe239aa2908fe8711ee9633024ddfbf5fd570190034bf36fac0fc8428f21e826959099b384

Download Submit
C:\Windows\System\JTSkkzf.exe

Filesize
1.9MB

MD5
2847461e7dbe4b83949ae5b6d146a518

SHA1
c90431066f2d9c91d670b944e080686b8208f9be

SHA256
a76db1c370c7671010ac2405ba9ffb79e6b5d931831bc4de57d3a7157e695c89

SHA512
75a734b422773e325cc9a04aeab9f96ba36a583ead29a525ed9f1cfe239aa2908fe8711ee9633024ddfbf5fd570190034bf36fac0fc8428f21e826959099b384

Download Submit
C:\Windows\System\KvpXyDY.exe

Filesize
1.9MB

MD5
48c5a6ddbe6633e11f4c09ca03c40962

SHA1
d5190ef0884231d21d9301ecfcf55126174bf75d

SHA256
a80343771be542987310a33873c0041501cfdb9ef09a5470053ec57a6b8394dd

SHA512
05f415c74445521474aeca23b117d0dc6f7e72426b00ebc0676b20c60f73550c4e492549e58a05119b089144538f1d759b694919885193d3741a76d70e02d769

Download Submit
C:\Windows\System\KvpXyDY.exe

Filesize
1.9MB

MD5
48c5a6ddbe6633e11f4c09ca03c40962

SHA1
d5190ef0884231d21d9301ecfcf55126174bf75d

SHA256
a80343771be542987310a33873c0041501cfdb9ef09a5470053ec57a6b8394dd

SHA512
05f415c74445521474aeca23b117d0dc6f7e72426b00ebc0676b20c60f73550c4e492549e58a05119b089144538f1d759b694919885193d3741a76d70e02d769

Download Submit
C:\Windows\System\NDoTeen.exe

Filesize
1.9MB

MD5
ae514f43b9990768aa88501939250b18

SHA1
add1bb4ec4b8694b5db1c8626c5cf435b5b622b7

SHA256
cf103d45d874c545320439ec64f5ff94d46dc2d78f994f29ec9d46fb9f86796f

SHA512
03b5dd1ea33dc702ee18a5eb2562dc3dd86903cfb41c4185c75d61f2f9504a958ecdd867a8f5f149d4c8d42b4d02479295d071c2e0e48cf99d21936693549026

Download Submit
C:\Windows\System\NDoTeen.exe

Filesize
1.9MB

MD5
ae514f43b9990768aa88501939250b18

SHA1
add1bb4ec4b8694b5db1c8626c5cf435b5b622b7

SHA256
cf103d45d874c545320439ec64f5ff94d46dc2d78f994f29ec9d46fb9f86796f

SHA512
03b5dd1ea33dc702ee18a5eb2562dc3dd86903cfb41c4185c75d61f2f9504a958ecdd867a8f5f149d4c8d42b4d02479295d071c2e0e48cf99d21936693549026

Download Submit
C:\Windows\System\NVuczRg.exe

Filesize
1.9MB

MD5
278467158e6140b2b27b1a9b5fdc31da

SHA1
eb344648d73573c177536189a13780247632b10d

SHA256
d525771e6894da542cc5aa4f0df8e06bbaaa89b0ceca8887fd35f6fe778c339d

SHA512
f1c67f65a0116af23693716e186f9520c6645ffc99610f549fa92e99d0bca4cdf4a455fcb712ee5ed25468d586a173a63f0d685a6c715508e2e0ce35627adb85

Download Submit
C:\Windows\System\NVuczRg.exe

Filesize
1.9MB

MD5
278467158e6140b2b27b1a9b5fdc31da

SHA1
eb344648d73573c177536189a13780247632b10d

SHA256
d525771e6894da542cc5aa4f0df8e06bbaaa89b0ceca8887fd35f6fe778c339d

SHA512
f1c67f65a0116af23693716e186f9520c6645ffc99610f549fa92e99d0bca4cdf4a455fcb712ee5ed25468d586a173a63f0d685a6c715508e2e0ce35627adb85

Download Submit
C:\Windows\System\SUvNgcV.exe

Filesize
1.9MB

MD5
36d7c20264d9cfedf9048e38386223f8

SHA1
eaf284b00894c3da0e29af9b463f9d343cfa1bda

SHA256
45a1c3a2b4790f42dbf3d0e1dcdfa3d5c1360505fc1d1c29ec63cbfc5e4c6560

SHA512
e851c7dfb65f572aeda7dbc5841ad7cf78876195236468e8f11e2d53c9059d4bd134037f15333712e8f12cc814c75725c173f83f5ae852647e7edc605a7e37d7

Download Submit
C:\Windows\System\SUvNgcV.exe

Filesize
1.9MB

MD5
36d7c20264d9cfedf9048e38386223f8

SHA1
eaf284b00894c3da0e29af9b463f9d343cfa1bda

SHA256
45a1c3a2b4790f42dbf3d0e1dcdfa3d5c1360505fc1d1c29ec63cbfc5e4c6560

SHA512
e851c7dfb65f572aeda7dbc5841ad7cf78876195236468e8f11e2d53c9059d4bd134037f15333712e8f12cc814c75725c173f83f5ae852647e7edc605a7e37d7

Download Submit
C:\Windows\System\SUvNgcV.exe

Filesize
1.9MB

MD5
36d7c20264d9cfedf9048e38386223f8

SHA1
eaf284b00894c3da0e29af9b463f9d343cfa1bda

SHA256
45a1c3a2b4790f42dbf3d0e1dcdfa3d5c1360505fc1d1c29ec63cbfc5e4c6560

SHA512
e851c7dfb65f572aeda7dbc5841ad7cf78876195236468e8f11e2d53c9059d4bd134037f15333712e8f12cc814c75725c173f83f5ae852647e7edc605a7e37d7

Download Submit
C:\Windows\System\SXYNTZh.exe

Filesize
1.9MB

MD5
179d128da2bce6f7f34f348598ad4aa9

SHA1
3cdee8a6fd567083e41730e2722e5cee57db81ab

SHA256
552b4d45040c91ba05e1fcb6d0c3ff3b4ff9b943cda21235826b651b3b0dd461

SHA512
fc56a9ec5db70883814a516fe5d9efe9e5cf89f8795bcc9cff24f523914b7d14d5bb53a6a82654d77bf88e42912c14d5f20a8d407be523c12b0b37059ceb4c2e

Download Submit
C:\Windows\System\SXYNTZh.exe

Filesize
1.9MB

MD5
179d128da2bce6f7f34f348598ad4aa9

SHA1
3cdee8a6fd567083e41730e2722e5cee57db81ab

SHA256
552b4d45040c91ba05e1fcb6d0c3ff3b4ff9b943cda21235826b651b3b0dd461

SHA512
fc56a9ec5db70883814a516fe5d9efe9e5cf89f8795bcc9cff24f523914b7d14d5bb53a6a82654d77bf88e42912c14d5f20a8d407be523c12b0b37059ceb4c2e

Download Submit
C:\Windows\System\TfAbeNJ.exe

Filesize
1.9MB

MD5
ab8a1c42d39137a46bf7e8fce8795807

SHA1
e118b8c6187c146fc6f4b26600ebb33a9102172e

SHA256
48e2ee0e3c28960eed29c86d3cd765a85cd57c2670d6727c6db65a2f8f49b574

SHA512
1db44901448f0362d2a1602515a560d4f690f1cda13ca65958949b8a76a26dc9788ad130c1594a6d9b8cbda3bf8854fc07af7fac10d124fc5fa32125839bdf95

Download Submit
C:\Windows\System\TfAbeNJ.exe

Filesize
1.9MB

MD5
ab8a1c42d39137a46bf7e8fce8795807

SHA1
e118b8c6187c146fc6f4b26600ebb33a9102172e

SHA256
48e2ee0e3c28960eed29c86d3cd765a85cd57c2670d6727c6db65a2f8f49b574

SHA512
1db44901448f0362d2a1602515a560d4f690f1cda13ca65958949b8a76a26dc9788ad130c1594a6d9b8cbda3bf8854fc07af7fac10d124fc5fa32125839bdf95

Download Submit
C:\Windows\System\ULQsxap.exe

Filesize
1.9MB

MD5
fe1ea681d7ab0cef18923ce85e6a9f68

SHA1
ae95401cd3a8b1ad73385de9d0f0c62e06357afb

SHA256
0ae826e5a151fe9d88d00f0cde48ada61a1076678e95e899b31bc217550a8b4c

SHA512
ac1b88c61efc5dc4c7871b240868adb369162b0f2327d0c2f1533be7ae3149d5b92d4a1470c1b97c3de9a6a0a0e9487a9133480b5b71eea5de6c0b971cf684f3

Download Submit
C:\Windows\System\ULQsxap.exe

Filesize
1.9MB

MD5
fe1ea681d7ab0cef18923ce85e6a9f68

SHA1
ae95401cd3a8b1ad73385de9d0f0c62e06357afb

SHA256
0ae826e5a151fe9d88d00f0cde48ada61a1076678e95e899b31bc217550a8b4c

SHA512
ac1b88c61efc5dc4c7871b240868adb369162b0f2327d0c2f1533be7ae3149d5b92d4a1470c1b97c3de9a6a0a0e9487a9133480b5b71eea5de6c0b971cf684f3

Download Submit
C:\Windows\System\UvAGDMR.exe

Filesize
1.9MB

MD5
c2b847ed8689e6e7868cf4b413136992

SHA1
264a61d5950bacee1cc1c0646c854608d64fcdf2

SHA256
f7865b0c674b315c5acd633ceaff0842c28ce173b731cb09540a3600582d733d

SHA512
e4834ffac6d708ce110dc00f3cfcf9638f555f650bdffb5af8e8d0c1875a1e07137141d6ce9f720563b2587ad90505b6596354166be869c9744a29d9c7412848

Download Submit
C:\Windows\System\UvAGDMR.exe

Filesize
1.9MB

MD5
c2b847ed8689e6e7868cf4b413136992

SHA1
264a61d5950bacee1cc1c0646c854608d64fcdf2

SHA256
f7865b0c674b315c5acd633ceaff0842c28ce173b731cb09540a3600582d733d

SHA512
e4834ffac6d708ce110dc00f3cfcf9638f555f650bdffb5af8e8d0c1875a1e07137141d6ce9f720563b2587ad90505b6596354166be869c9744a29d9c7412848

Download Submit
C:\Windows\System\VKqpxvV.exe

Filesize
1.9MB

MD5
0fb66b84a0131dce21d3c8ec9c45d535

SHA1
015f39092b48180728982b267df16191e3397eb9

SHA256
a7356fce69986111ee69ad19400ffa72cf699337f7fcbb43a157cfef64a1d51b

SHA512
cc9003d126f3810d15d2faadf68a4b11e70f07ed5d31be2edb428a39c4bc74132d45f232fcfa07fe2a45a293b12b67ea156a9bccf043b826381e991dacf3aa60

Download Submit
C:\Windows\System\XDJiaDy.exe

Filesize
1.9MB

MD5
5d5b13474503d9936ddae3b5725ec09e

SHA1
27a955bcf214d0d58211d30816678991b8ab6b43

SHA256
b26a2a346e1e8a6e91648f52b5e0a8ed6386c734dcb1b2cd50a5da3df420f9b4

SHA512
0bd7eb2ede036ae3b2232bf869d984bfdc598b06a0b16399dbba09c2cd2ace5505173e134b1369df1af84ec4dee51c88e4df1fd786daec735c3d4e34a6029c38

Download Submit
C:\Windows\System\XDJiaDy.exe

Filesize
1.9MB

MD5
5d5b13474503d9936ddae3b5725ec09e

SHA1
27a955bcf214d0d58211d30816678991b8ab6b43

SHA256
b26a2a346e1e8a6e91648f52b5e0a8ed6386c734dcb1b2cd50a5da3df420f9b4

SHA512
0bd7eb2ede036ae3b2232bf869d984bfdc598b06a0b16399dbba09c2cd2ace5505173e134b1369df1af84ec4dee51c88e4df1fd786daec735c3d4e34a6029c38

Download Submit
C:\Windows\System\XmCGzTo.exe

Filesize
1.9MB

MD5
885bd76edd078fd9603f54688c2d53e6

SHA1
d1204c876e7fb877618d09241810b5c2f77ef7d5

SHA256
e15bb284d0ea9c7492db7335f5d8375c60b43ef3984288ba94ef21eb66cf4fd7

SHA512
b821711256f6e36fac1aa00bb2840d70b78390695b26a6b2884b9f8cd262f4bfad78932a686e0b1a4a8d2178819d308f05b8dbe8e5c4bdb440b5be1fa42ceaf5

Download Submit
C:\Windows\System\XmCGzTo.exe

Filesize
1.9MB

MD5
885bd76edd078fd9603f54688c2d53e6

SHA1
d1204c876e7fb877618d09241810b5c2f77ef7d5

SHA256
e15bb284d0ea9c7492db7335f5d8375c60b43ef3984288ba94ef21eb66cf4fd7

SHA512
b821711256f6e36fac1aa00bb2840d70b78390695b26a6b2884b9f8cd262f4bfad78932a686e0b1a4a8d2178819d308f05b8dbe8e5c4bdb440b5be1fa42ceaf5

Download Submit
C:\Windows\System\ZktydVw.exe

Filesize
1.9MB

MD5
ebcca23d47fad28a0bf1a6665456ffa3

SHA1
f5db58706b5253117766fa62914ff615de2d7a8d

SHA256
2c93e98055b533f6e32ffec329385116191015dfb100c9789767c1bbb1ce4e49

SHA512
40f76b5f26f6d1f0e2c9acbd86eecc0c13a5f1e2178a288e19cd387e08be6b21c45f457d16d7544c3be4f687cc22a5dd45020b5bf9699ff3b4de71690d912d99

Download Submit
C:\Windows\System\ZktydVw.exe

Filesize
1.9MB

MD5
ebcca23d47fad28a0bf1a6665456ffa3

SHA1
f5db58706b5253117766fa62914ff615de2d7a8d

SHA256
2c93e98055b533f6e32ffec329385116191015dfb100c9789767c1bbb1ce4e49

SHA512
40f76b5f26f6d1f0e2c9acbd86eecc0c13a5f1e2178a288e19cd387e08be6b21c45f457d16d7544c3be4f687cc22a5dd45020b5bf9699ff3b4de71690d912d99

Download Submit
C:\Windows\System\btLWmti.exe

Filesize
1.9MB

MD5
2aae8b56db79edc49e721b3c6fa6a96c

SHA1
c3ddc1c8447c9f579a126000c34244229fbfa066

SHA256
1f949dcd5b5e7681ec57b76dd9c3d317823ffd11840be301e544bc4465d6186f

SHA512
5056a374e0c27320ce9c245c0947dd12896d2c2cd73e0500bf2562930ce27bbaed3eb8026ab928ea2ac719548cfa0164be94f623dbd20a27f882da51ea4b3761

Download Submit
C:\Windows\System\btLWmti.exe

Filesize
1.9MB

MD5
2aae8b56db79edc49e721b3c6fa6a96c

SHA1
c3ddc1c8447c9f579a126000c34244229fbfa066

SHA256
1f949dcd5b5e7681ec57b76dd9c3d317823ffd11840be301e544bc4465d6186f

SHA512
5056a374e0c27320ce9c245c0947dd12896d2c2cd73e0500bf2562930ce27bbaed3eb8026ab928ea2ac719548cfa0164be94f623dbd20a27f882da51ea4b3761

Download Submit
C:\Windows\System\cWnatZB.exe

Filesize
1.9MB

MD5
6033a30cd320b85ba028d57b8a0cf68f

SHA1
3972b81004bd1a56e2a49fbb2ac8b5a8d323ba2d

SHA256
1e057c266b1d0c2bfe1a5e6e51b5b767f321ea2b923434e5e2047a24e407bd99

SHA512
64c6481244bb49874a8033c152334300f0029a3dd7100e4e3bb574574735df02ac0b96621dee58e991d98f541efe26a79ffb4485db1c483a1ca72250280b062c

Download Submit
C:\Windows\System\cWnatZB.exe

Filesize
1.9MB

MD5
6033a30cd320b85ba028d57b8a0cf68f

SHA1
3972b81004bd1a56e2a49fbb2ac8b5a8d323ba2d

SHA256
1e057c266b1d0c2bfe1a5e6e51b5b767f321ea2b923434e5e2047a24e407bd99

SHA512
64c6481244bb49874a8033c152334300f0029a3dd7100e4e3bb574574735df02ac0b96621dee58e991d98f541efe26a79ffb4485db1c483a1ca72250280b062c

Download Submit
C:\Windows\System\cgtEolU.exe

Filesize
1.9MB

MD5
8f09c6664395502399bf3b5908043d4b

SHA1
5d29090e74f11e8518a20cbd7ba2fd71e1019fff

SHA256
206b6660fba99b69d443c48c649ecb41601d1b35dff70c50e61573e64a513dda

SHA512
fb827a1bfb9737b79a28818a7b11c61399bcdbc0385f7995c626aa0c4245506283ec4891c6e670538fbb32e6d1db9de1c8791dbebb8bfa6551a62e6d69cdf36b

Download Submit
C:\Windows\System\cgtEolU.exe

Filesize
1.9MB

MD5
8f09c6664395502399bf3b5908043d4b

SHA1
5d29090e74f11e8518a20cbd7ba2fd71e1019fff

SHA256
206b6660fba99b69d443c48c649ecb41601d1b35dff70c50e61573e64a513dda

SHA512
fb827a1bfb9737b79a28818a7b11c61399bcdbc0385f7995c626aa0c4245506283ec4891c6e670538fbb32e6d1db9de1c8791dbebb8bfa6551a62e6d69cdf36b

Download Submit
C:\Windows\System\gKTRenQ.exe

Filesize
1.9MB

MD5
82986579bc50245d27bbec487a120f81

SHA1
9412ebb57a8972413530e671654ffd3a964e3ce4

SHA256
add6dc383a99541860edf7c9e413371c3791b83669c1d67cf0f155c032ae1f94

SHA512
ade57c0b68a9dc51e4cba729e0c429d7c5d8cb136214438b64ca971e6473e37f62c7dfd2ee3e48d3dc1a6d50af062139e28e096e2c3a64cdbf9dd83ad7b2af39

Download Submit
C:\Windows\System\gKTRenQ.exe

Filesize
1.9MB

MD5
82986579bc50245d27bbec487a120f81

SHA1
9412ebb57a8972413530e671654ffd3a964e3ce4

SHA256
add6dc383a99541860edf7c9e413371c3791b83669c1d67cf0f155c032ae1f94

SHA512
ade57c0b68a9dc51e4cba729e0c429d7c5d8cb136214438b64ca971e6473e37f62c7dfd2ee3e48d3dc1a6d50af062139e28e096e2c3a64cdbf9dd83ad7b2af39

Download Submit
C:\Windows\System\hkaKFrY.exe

Filesize
1.9MB

MD5
23794cc2415133264d3339102cb76317

SHA1
15056c4702c583290ad6d98edaf9fee00863e926

SHA256
21d5c9947fe0c02edcdf148ec8040433804e12ff0ea58c642c87f10aaccc6741

SHA512
3518241e46496f1c0f6d05a21c9b7835490ed76fcdd2f9ca60504eafe0dfc3cb5a019c3f3f25bd812c3658368bc0395509a1a0db96df81f7568d38fbf5130f10

Download Submit
C:\Windows\System\hkaKFrY.exe

Filesize
1.9MB

MD5
23794cc2415133264d3339102cb76317

SHA1
15056c4702c583290ad6d98edaf9fee00863e926

SHA256
21d5c9947fe0c02edcdf148ec8040433804e12ff0ea58c642c87f10aaccc6741

SHA512
3518241e46496f1c0f6d05a21c9b7835490ed76fcdd2f9ca60504eafe0dfc3cb5a019c3f3f25bd812c3658368bc0395509a1a0db96df81f7568d38fbf5130f10

Download Submit
C:\Windows\System\kImMTkb.exe

Filesize
1.9MB

MD5
bcc86fce2f81d5e70e574ba98975c414

SHA1
af564a66f842cc57af2d7a2b8923a28285678e76

SHA256
9c342fc12c80e65502ad540a04c65505c396d5a9cde7f0ffbae72175b6c77f62

SHA512
5c5f89cf6cc51d81300ef96695f0b5f8f6656b2ddf45a5d4a4129384e8fd023b9cb970c7318d09e7c815779f3496f3430362967b3291e7e849c35a894f9a3204

Download Submit
C:\Windows\System\kImMTkb.exe

Filesize
1.9MB

MD5
bcc86fce2f81d5e70e574ba98975c414

SHA1
af564a66f842cc57af2d7a2b8923a28285678e76

SHA256
9c342fc12c80e65502ad540a04c65505c396d5a9cde7f0ffbae72175b6c77f62

SHA512
5c5f89cf6cc51d81300ef96695f0b5f8f6656b2ddf45a5d4a4129384e8fd023b9cb970c7318d09e7c815779f3496f3430362967b3291e7e849c35a894f9a3204

Download Submit
C:\Windows\System\mMfeKGu.exe

Filesize
1.9MB

MD5
c9e56adca05bc733f2fd1091d920ec9f

SHA1
cff17efa5d75c83c11fbe85e0fb2aba63edb95c0

SHA256
5a121dc48d7bcf71958ea5e16601ffbd9a92b43aa732eba7f20bcdbe38336b7d

SHA512
f3e22b9699022d3ac5960347ccdba96790e1cf061acdbb2848e13e2774abb6eb3f479e7b26f839b3569d5e58b0e39501c1005e96545b9875062b4afc8d3d11df

Download Submit
C:\Windows\System\mMfeKGu.exe

Filesize
1.9MB

MD5
c9e56adca05bc733f2fd1091d920ec9f

SHA1
cff17efa5d75c83c11fbe85e0fb2aba63edb95c0

SHA256
5a121dc48d7bcf71958ea5e16601ffbd9a92b43aa732eba7f20bcdbe38336b7d

SHA512
f3e22b9699022d3ac5960347ccdba96790e1cf061acdbb2848e13e2774abb6eb3f479e7b26f839b3569d5e58b0e39501c1005e96545b9875062b4afc8d3d11df

Download Submit
C:\Windows\System\oYYaMmX.exe

Filesize
1.9MB

MD5
aa52efdf1f017364e11af3bbc7c47c94

SHA1
39a1b6403f894963dce590b65278a36c2af61eb4

SHA256
52e500263c4e76cc7db38cc169f60295c590c3d314ce7a0d903a1a1d9ed5207a

SHA512
1ff8a3378eefe0d676c42fbc9a37ecb5a034fc5441075bfa89a4b172820285fe332dff977c6651188b36cf64c2bcd47ee2b3e7d5dbf50790b4e2a5f990261e0a

Download Submit
C:\Windows\System\oYYaMmX.exe

Filesize
1.9MB

MD5
aa52efdf1f017364e11af3bbc7c47c94

SHA1
39a1b6403f894963dce590b65278a36c2af61eb4

SHA256
52e500263c4e76cc7db38cc169f60295c590c3d314ce7a0d903a1a1d9ed5207a

SHA512
1ff8a3378eefe0d676c42fbc9a37ecb5a034fc5441075bfa89a4b172820285fe332dff977c6651188b36cf64c2bcd47ee2b3e7d5dbf50790b4e2a5f990261e0a

Download Submit
C:\Windows\System\qsAjkNG.exe

Filesize
1.9MB

MD5
f96701b959e686cba2b0c6ff02f3b510

SHA1
17b17403cb46887d64efe797324b0a7d14519be1

SHA256
4c140bccc7ee53979a05e4db7fc789e2a31977be34f08cdcee91532967e0674c

SHA512
660e8d5243aec18e16eb95997831bb6d55c7e8cbbfc62d095f6a8789513c99e51bc76d7e4ec1ad2730f0fb0f4a3301af20af7d15fb01e7c32616fda195ccc20c

Download Submit
C:\Windows\System\qsAjkNG.exe

Filesize
1.9MB

MD5
f96701b959e686cba2b0c6ff02f3b510

SHA1
17b17403cb46887d64efe797324b0a7d14519be1

SHA256
4c140bccc7ee53979a05e4db7fc789e2a31977be34f08cdcee91532967e0674c

SHA512
660e8d5243aec18e16eb95997831bb6d55c7e8cbbfc62d095f6a8789513c99e51bc76d7e4ec1ad2730f0fb0f4a3301af20af7d15fb01e7c32616fda195ccc20c

Download Submit
C:\Windows\System\quFZDFg.exe

Filesize
1.9MB

MD5
f420bf3f1d2e974455da0aa1fe4819f7

SHA1
a272161dbaa7c5c27fcd79ca32fb644e2b3bff1d

SHA256
c4b6b020cc591ed3265c59b1b795697d67949c2264ae6197209f40deff6ab5dd

SHA512
07f78563822ca8e1032707917db705383f6033ad8141c497679386c92c4372365c20c033449b98f7b5d250621467c106022609b59980c6cc223212767c333b2e

Download Submit
C:\Windows\System\quFZDFg.exe

Filesize
1.9MB

MD5
f420bf3f1d2e974455da0aa1fe4819f7

SHA1
a272161dbaa7c5c27fcd79ca32fb644e2b3bff1d

SHA256
c4b6b020cc591ed3265c59b1b795697d67949c2264ae6197209f40deff6ab5dd

SHA512
07f78563822ca8e1032707917db705383f6033ad8141c497679386c92c4372365c20c033449b98f7b5d250621467c106022609b59980c6cc223212767c333b2e

Download Submit
C:\Windows\System\rPgOnei.exe

Filesize
1.9MB

MD5
34e6c7af0ad4f533bf601dce956ae898

SHA1
e8ebc5a2ab3a4f313b4b7dbb62e7a72a29b91d87

SHA256
5dce84e668bea92334ad1c041ea080aa3d4730fa53f370314865481ae9d9bebf

SHA512
dbc4719762ea3fd47dd835d90d058736c0f35d5a5eb888d21055d75e6844ec566d9e7c8081b7c6a5433ce47f03b615d64605ebf34b10826ac19d97f7fe188cb3

Download Submit
C:\Windows\System\rPgOnei.exe

Filesize
1.9MB

MD5
34e6c7af0ad4f533bf601dce956ae898

SHA1
e8ebc5a2ab3a4f313b4b7dbb62e7a72a29b91d87

SHA256
5dce84e668bea92334ad1c041ea080aa3d4730fa53f370314865481ae9d9bebf

SHA512
dbc4719762ea3fd47dd835d90d058736c0f35d5a5eb888d21055d75e6844ec566d9e7c8081b7c6a5433ce47f03b615d64605ebf34b10826ac19d97f7fe188cb3

Download Submit
C:\Windows\System\rdgAzuv.exe

Filesize
1.9MB

MD5
a8729e02c880a2e6da7f74eab07e0971

SHA1
c0d16a4d1fb1d47510433605efe714e1bcb9af9f

SHA256
0ac6e338c95238e4a5314461adf1134392a360465ae429d02ec51a1e2c418b2e

SHA512
223747a1264f8502190e6dba0277d3fef5ac543724cab1a648168e5d4fb5a5e8efbf7692327a7eb62dd139783e7ccda920d0cfb27f24afef09865d726c6d4965

Download Submit
C:\Windows\System\rdgAzuv.exe

Filesize
1.9MB

MD5
a8729e02c880a2e6da7f74eab07e0971

SHA1
c0d16a4d1fb1d47510433605efe714e1bcb9af9f

SHA256
0ac6e338c95238e4a5314461adf1134392a360465ae429d02ec51a1e2c418b2e

SHA512
223747a1264f8502190e6dba0277d3fef5ac543724cab1a648168e5d4fb5a5e8efbf7692327a7eb62dd139783e7ccda920d0cfb27f24afef09865d726c6d4965

Download Submit
C:\Windows\System\tueLjzV.exe

Filesize
1.9MB

MD5
05a06b821065e14d25b1af57cae30802

SHA1
389b09257150b3dc15b68badb0a2a3b4de6cea13

SHA256
f346ab1369af3860c729700449c19a32a577ff4a3986c0748da16244989d32e5

SHA512
d5e0133ecbdd823bab6ea6b36c20e8ef98ef3fb3883809df178d054fe2e82e3c58981591a8e9e246fa6314a4b351dc7f41e4a0186ff1fb8f252df363400e4fd3

Download Submit
C:\Windows\System\tueLjzV.exe

Filesize
1.9MB

MD5
05a06b821065e14d25b1af57cae30802

SHA1
389b09257150b3dc15b68badb0a2a3b4de6cea13

SHA256
f346ab1369af3860c729700449c19a32a577ff4a3986c0748da16244989d32e5

SHA512
d5e0133ecbdd823bab6ea6b36c20e8ef98ef3fb3883809df178d054fe2e82e3c58981591a8e9e246fa6314a4b351dc7f41e4a0186ff1fb8f252df363400e4fd3

Download Submit
C:\Windows\System\vRcWxJA.exe

Filesize
1.9MB

MD5
175534d44f00b17467ec56f330e61d1b

SHA1
83deecee15981d286fd3682b680bd6c47782186f

SHA256
04403a8ad10feb0ccaf4cbb35f01f9cfdca469e1e3f13da043065d7272c67584

SHA512
22c319f2ca76dbdfb8187aee39b916247a6a6be6da7e745a73b4fae3dc0456c284cf30014b29f9d0d04c4b3e7e3933de8ca29ce0ee3cc6cca9c11de0575cc448

Download Submit
C:\Windows\System\vRcWxJA.exe

Filesize
1.9MB

MD5
175534d44f00b17467ec56f330e61d1b

SHA1
83deecee15981d286fd3682b680bd6c47782186f

SHA256
04403a8ad10feb0ccaf4cbb35f01f9cfdca469e1e3f13da043065d7272c67584

SHA512
22c319f2ca76dbdfb8187aee39b916247a6a6be6da7e745a73b4fae3dc0456c284cf30014b29f9d0d04c4b3e7e3933de8ca29ce0ee3cc6cca9c11de0575cc448

Download Submit
C:\Windows\System\yRlxeTg.exe

Filesize
1.9MB

MD5
2b644afa4ca9f098e964c4cc9f08c399

SHA1
3ab94fd009934f78765cffce5abf7b79012243cb

SHA256
1c543036b44afa265850a8e9023361fb088e3938c92564c5dffc02ed846662b2

SHA512
c84eb8b8326fdc679642af52f4daa44c2c2ec27146444c49ee848ffbdb833e6c792935cb4afd5ac32f15de1e47c2206c3dea6dcba0638722e878c22b9abce57f

Download Submit
C:\Windows\System\yRlxeTg.exe

Filesize
1.9MB

MD5
2b644afa4ca9f098e964c4cc9f08c399

SHA1
3ab94fd009934f78765cffce5abf7b79012243cb

SHA256
1c543036b44afa265850a8e9023361fb088e3938c92564c5dffc02ed846662b2

SHA512
c84eb8b8326fdc679642af52f4daa44c2c2ec27146444c49ee848ffbdb833e6c792935cb4afd5ac32f15de1e47c2206c3dea6dcba0638722e878c22b9abce57f

Download Submit
C:\Windows\System\yoCmcyY.exe

Filesize
1.9MB

MD5
16003a88f5e41a9dd7f0315ee371a647

SHA1
c5f8052aeedd655d0c1e3bb3da2a66fba1bc4e7e

SHA256
9e5e0e2ccec52415e87dd3fb45d6504d0b7d7a7a94afb94e77f401e53270fc19

SHA512
0d69b8dac377d5ab75cffe934b0e697c59804cfc3eb26493a19204d3066d0f715f1cb5d61154f088f7dc8c842a4e1b97125dc6d10fb1a72bbe5ab00cdc8d59f9

Download Submit
C:\Windows\System\yoCmcyY.exe

Filesize
1.9MB

MD5
16003a88f5e41a9dd7f0315ee371a647

SHA1
c5f8052aeedd655d0c1e3bb3da2a66fba1bc4e7e

SHA256
9e5e0e2ccec52415e87dd3fb45d6504d0b7d7a7a94afb94e77f401e53270fc19

SHA512
0d69b8dac377d5ab75cffe934b0e697c59804cfc3eb26493a19204d3066d0f715f1cb5d61154f088f7dc8c842a4e1b97125dc6d10fb1a72bbe5ab00cdc8d59f9

Download Submit
memory/332-116-0x00007FF675930000-0x00007FF675C84000-memory.dmp

Filesize
3.3MB

Download
memory/496-282-0x00007FF6A8190000-0x00007FF6A84E4000-memory.dmp

Filesize
3.3MB

Download
memory/896-182-0x00007FF637880000-0x00007FF637BD4000-memory.dmp

Filesize
3.3MB

Download
memory/1032-147-0x00007FF6B7F00000-0x00007FF6B8254000-memory.dmp

Filesize
3.3MB

Download
memory/1040-279-0x00007FF714CD0000-0x00007FF715024000-memory.dmp

Filesize
3.3MB

Download
memory/1152-173-0x00007FF7816F0000-0x00007FF781A44000-memory.dmp

Filesize
3.3MB

Download
memory/1172-275-0x00007FF7AA0D0000-0x00007FF7AA424000-memory.dmp

Filesize
3.3MB

Download
memory/1188-104-0x00007FF7B1000000-0x00007FF7B1354000-memory.dmp

Filesize
3.3MB

Download
memory/1188-236-0x00007FF7B1000000-0x00007FF7B1354000-memory.dmp

Filesize
3.3MB

Download
memory/1204-90-0x00007FF7DC2D0000-0x00007FF7DC624000-memory.dmp

Filesize
3.3MB

Download
memory/1204-218-0x00007FF7DC2D0000-0x00007FF7DC624000-memory.dmp

Filesize
3.3MB

Download
memory/1456-36-0x00007FF6D08B0000-0x00007FF6D0C04000-memory.dmp

Filesize
3.3MB

Download
memory/1472-247-0x00007FF7A7A00000-0x00007FF7A7D54000-memory.dmp

Filesize
3.3MB

Download
memory/1524-183-0x00007FF6059A0000-0x00007FF605CF4000-memory.dmp

Filesize
3.3MB

Download
memory/1608-260-0x00007FF6D9550000-0x00007FF6D98A4000-memory.dmp

Filesize
3.3MB

Download
memory/1748-86-0x00007FF7CCE70000-0x00007FF7CD1C4000-memory.dmp

Filesize
3.3MB

Download
memory/2072-166-0x00007FF748E00000-0x00007FF749154000-memory.dmp

Filesize
3.3MB

Download
memory/2128-115-0x00007FF7FBBD0000-0x00007FF7FBF24000-memory.dmp

Filesize
3.3MB

Download
memory/2128-278-0x00007FF7FBBD0000-0x00007FF7FBF24000-memory.dmp

Filesize
3.3MB

Download
memory/2188-212-0x00007FF6F83E0000-0x00007FF6F8734000-memory.dmp

Filesize
3.3MB

Download
memory/2212-181-0x00007FF7C6CD0000-0x00007FF7C7024000-memory.dmp

Filesize
3.3MB

Download
memory/2252-235-0x00007FF7BDCF0000-0x00007FF7BE044000-memory.dmp

Filesize
3.3MB

Download
memory/2252-96-0x00007FF7BDCF0000-0x00007FF7BE044000-memory.dmp

Filesize
3.3MB

Download
memory/2284-77-0x00007FF673D20000-0x00007FF674074000-memory.dmp

Filesize
3.3MB

Download
memory/2284-201-0x00007FF673D20000-0x00007FF674074000-memory.dmp

Filesize
3.3MB

Download
memory/2344-277-0x00007FF799F80000-0x00007FF79A2D4000-memory.dmp

Filesize
3.3MB

Download
memory/2472-185-0x00007FF6BA680000-0x00007FF6BA9D4000-memory.dmp

Filesize
3.3MB

Download
memory/2488-281-0x00007FF7CD320000-0x00007FF7CD674000-memory.dmp

Filesize
3.3MB

Download
memory/2488-162-0x00007FF7CD320000-0x00007FF7CD674000-memory.dmp

Filesize
3.3MB

Download
memory/2564-71-0x00007FF64BC70000-0x00007FF64BFC4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-52-0x00007FF626760000-0x00007FF626AB4000-memory.dmp

Filesize
3.3MB

Download
memory/2684-85-0x00007FF7377D0000-0x00007FF737B24000-memory.dmp

Filesize
3.3MB

Download
memory/2684-210-0x00007FF7377D0000-0x00007FF737B24000-memory.dmp

Filesize
3.3MB

Download
memory/2744-204-0x00007FF7BDCF0000-0x00007FF7BE044000-memory.dmp

Filesize
3.3MB

Download
memory/2804-211-0x00007FF73D6D0000-0x00007FF73DA24000-memory.dmp

Filesize
3.3MB

Download
memory/2876-1-0x0000022B0A200000-0x0000022B0A210000-memory.dmp

Filesize
64KB

Download
memory/2876-0-0x00007FF7418C0000-0x00007FF741C14000-memory.dmp

Filesize
3.3MB

Download
memory/2876-109-0x00007FF7418C0000-0x00007FF741C14000-memory.dmp

Filesize
3.3MB

Download
memory/2888-274-0x00007FF6F0540000-0x00007FF6F0894000-memory.dmp

Filesize
3.3MB

Download
memory/2948-234-0x00007FF632510000-0x00007FF632864000-memory.dmp

Filesize
3.3MB

Download
memory/3116-272-0x00007FF7AE9C0000-0x00007FF7AED14000-memory.dmp

Filesize
3.3MB

Download
memory/3148-225-0x00007FF7B8670000-0x00007FF7B89C4000-memory.dmp

Filesize
3.3MB

Download
memory/3364-254-0x00007FF794530000-0x00007FF794884000-memory.dmp

Filesize
3.3MB

Download
memory/3572-208-0x00007FF75E8C0000-0x00007FF75EC14000-memory.dmp

Filesize
3.3MB

Download
memory/3612-276-0x00007FF6C4150000-0x00007FF6C44A4000-memory.dmp

Filesize
3.3MB

Download
memory/3840-227-0x00007FF7E0770000-0x00007FF7E0AC4000-memory.dmp

Filesize
3.3MB

Download
memory/3884-59-0x00007FF640290000-0x00007FF6405E4000-memory.dmp

Filesize
3.3MB

Download
memory/3896-21-0x00007FF618670000-0x00007FF6189C4000-memory.dmp

Filesize
3.3MB

Download
memory/3896-117-0x00007FF618670000-0x00007FF6189C4000-memory.dmp

Filesize
3.3MB

Download
memory/4012-280-0x00007FF6E5D80000-0x00007FF6E60D4000-memory.dmp

Filesize
3.3MB

Download
memory/4072-140-0x00007FF725B60000-0x00007FF725EB4000-memory.dmp

Filesize
3.3MB

Download
memory/4184-243-0x00007FF7EBD80000-0x00007FF7EC0D4000-memory.dmp

Filesize
3.3MB

Download
memory/4304-49-0x00007FF6799E0000-0x00007FF679D34000-memory.dmp

Filesize
3.3MB

Download
memory/4304-133-0x00007FF6799E0000-0x00007FF679D34000-memory.dmp

Filesize
3.3MB

Download
memory/4416-32-0x00007FF7C61D0000-0x00007FF7C6524000-memory.dmp

Filesize
3.3MB

Download
memory/4424-42-0x00007FF7108C0000-0x00007FF710C14000-memory.dmp

Filesize
3.3MB

Download
memory/4640-55-0x00007FF6E1E70000-0x00007FF6E21C4000-memory.dmp

Filesize
3.3MB

Download
memory/4652-7-0x00007FF6E7D70000-0x00007FF6E80C4000-memory.dmp

Filesize
3.3MB

Download
memory/4652-112-0x00007FF6E7D70000-0x00007FF6E80C4000-memory.dmp

Filesize
3.3MB

Download
memory/4740-267-0x00007FF606540000-0x00007FF606894000-memory.dmp

Filesize
3.3MB

Download
memory/4788-190-0x00007FF7B5270000-0x00007FF7B55C4000-memory.dmp

Filesize
3.3MB

Download
memory/4788-82-0x00007FF7B5270000-0x00007FF7B55C4000-memory.dmp

Filesize
3.3MB

Download
memory/4812-209-0x00007FF789230000-0x00007FF789584000-memory.dmp

Filesize
3.3MB

Download
memory/4964-178-0x00007FF683C00000-0x00007FF683F54000-memory.dmp

Filesize
3.3MB

Download
memory/5076-184-0x00007FF616F50000-0x00007FF6172A4000-memory.dmp

Filesize
3.3MB

Download