xmrig | 9e5aaac71729ca548834209a8fb42fa9c9781e9c8a60d7c6d710f68651819441

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66c0feabc09ecc94c618fa164813c500_NEAS.exe
Size

2.9MB
MD5

66c0feabc09ecc94c618fa164813c500
SHA1

857659e29066835c06d1068425e4d5da4af29516
SHA256

9e5aaac71729ca548834209a8fb42fa9c9781e9c8a60d7c6d710f68651819441
SHA512

f8dbb7b8423b9b120a40a0011396485428fd8d4bb827d34534cf2c5c5c9c0641bea2e72693e36d2c98ee6536250e250be406f597073459fbd0de07b3be76d550
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfLv3zQXtH:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ri

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 54 IoCs

miner

resource	yara_rule
behavioral1/memory/2392-1-0x000000013FC50000-0x0000000140046000-memory.dmp	xmrig
behavioral1/files/0x000d000000014323-3.dat	xmrig
behavioral1/files/0x0038000000014502-7.dat	xmrig
behavioral1/files/0x0008000000014702-16.dat	xmrig
behavioral1/files/0x00070000000149e1-28.dat	xmrig
behavioral1/files/0x0007000000014b36-43.dat	xmrig
behavioral1/files/0x0006000000015cce-68.dat	xmrig
behavioral1/memory/2472-88-0x000000013FCF0000-0x00000001400E6000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d44-94.dat	xmrig
behavioral1/memory/3000-133-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	xmrig
behavioral1/files/0x0006000000016c1d-168.dat	xmrig
behavioral1/memory/2580-169-0x000000013F540000-0x000000013F936000-memory.dmp	xmrig
behavioral1/files/0x00060000000161b3-189.dat	xmrig
behavioral1/files/0x0006000000015fa7-187.dat	xmrig
behavioral1/files/0x0006000000015e6d-185.dat	xmrig
behavioral1/files/0x0006000000015d4c-183.dat	xmrig
behavioral1/files/0x0006000000015d24-181.dat	xmrig
behavioral1/files/0x0006000000015cf5-179.dat	xmrig
behavioral1/memory/2640-172-0x000000013F340000-0x000000013F736000-memory.dmp	xmrig
behavioral1/memory/2496-171-0x000000013F250000-0x000000013F646000-memory.dmp	xmrig
behavioral1/files/0x0006000000016c3a-170.dat	xmrig
behavioral1/files/0x0006000000016a6f-147.dat	xmrig
behavioral1/files/0x0006000000015cd9-143.dat	xmrig
behavioral1/files/0x00060000000165f0-140.dat	xmrig
behavioral1/files/0x0006000000016476-134.dat	xmrig
behavioral1/files/0x00060000000160cc-128.dat	xmrig
behavioral1/memory/2616-122-0x000000013F8A0000-0x000000013FC96000-memory.dmp	xmrig
behavioral1/files/0x0006000000015f3c-120.dat	xmrig
behavioral1/files/0x0006000000015e09-119.dat	xmrig
behavioral1/files/0x0006000000015d0c-93.dat	xmrig
behavioral1/files/0x0006000000015ce3-92.dat	xmrig
behavioral1/files/0x0006000000015c9c-83.dat	xmrig
behavioral1/files/0x001800000000558a-75.dat	xmrig
behavioral1/memory/2260-161-0x000000013F1E0000-0x000000013F5D6000-memory.dmp	xmrig
behavioral1/files/0x0006000000016813-156.dat	xmrig
behavioral1/files/0x000600000001654a-155.dat	xmrig
behavioral1/files/0x00060000000162c9-154.dat	xmrig
behavioral1/files/0x0006000000015cb0-67.dat	xmrig
behavioral1/files/0x0006000000015cbd-97.dat	xmrig
behavioral1/files/0x0007000000015c93-66.dat	xmrig
behavioral1/files/0x0007000000014b10-53.dat	xmrig
behavioral1/files/0x000700000001480e-37.dat	xmrig
behavioral1/memory/2612-31-0x000000013F7E0000-0x000000013FBD6000-memory.dmp	xmrig
behavioral1/memory/2036-23-0x000000013F980000-0x000000013FD76000-memory.dmp	xmrig
behavioral1/memory/2648-19-0x000000013FF50000-0x0000000140346000-memory.dmp	xmrig
behavioral1/memory/2036-7378-0x000000013F980000-0x000000013FD76000-memory.dmp	xmrig
behavioral1/memory/2648-7383-0x000000013FF50000-0x0000000140346000-memory.dmp	xmrig
behavioral1/memory/2260-7395-0x000000013F1E0000-0x000000013F5D6000-memory.dmp	xmrig
behavioral1/memory/2580-7393-0x000000013F540000-0x000000013F936000-memory.dmp	xmrig
behavioral1/memory/2640-7392-0x000000013F340000-0x000000013F736000-memory.dmp	xmrig
behavioral1/memory/2616-7390-0x000000013F8A0000-0x000000013FC96000-memory.dmp	xmrig
behavioral1/memory/2496-7405-0x000000013F250000-0x000000013F646000-memory.dmp	xmrig
behavioral1/memory/3000-7389-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	xmrig
behavioral1/memory/2472-7388-0x000000013FCF0000-0x00000001400E6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1420	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2648	uGxVxbT.exe
2036	lliCnPc.exe
2612	wCQAQqU.exe
2472	CwjWZqh.exe
2616	osNALwi.exe
3000	AAueQVg.exe
2580	cHJvBFw.exe
2496	pUKinXE.exe
2260	LKlMtmY.exe
2640	rIVssFW.exe
2468	qSWGwWS.exe
2232	dbEacxN.exe
2836	HitlOsd.exe
2932	xxzkRUC.exe
1992	HHjWDAM.exe
2176	NZNHVuH.exe
1604	EIMwzdS.exe
2768	ZdYUXZl.exe
1524	FkDjRaf.exe
2824	EIWhfVW.exe
1356	GEyfUUS.exe
2280	zlDOYMS.exe
2716	wdXvzxf.exe
1516	eONJwXj.exe
2960	rPbSHiG.exe
816	URgFlVI.exe
1676	wadffKG.exe
1724	ILAPrna.exe
2772	rkntbNN.exe
2248	OBKIriR.exe
1704	iiVbNUn.exe
2444	oclsevp.exe
536	GQMdIgc.exe
1344	OpngosZ.exe
1792	PsvkWHn.exe
1360	MUoIkpJ.exe
1068	NgGYXvM.exe
1576	pCwCUjS.exe
1572	tlxrKlF.exe
1848	gfUzIxK.exe
568	VoIsYmS.exe
1736	YfIrzVk.exe
1996	KvapIlz.exe
1776	iUELBKq.exe
1276	bPLUClJ.exe
2300	jTPNdGo.exe
2400	VXJbRkO.exe
1528	abhpFgA.exe
2188	tlPMywj.exe
2568	PFlFKJW.exe
2736	nJBWsaY.exe
1620	OrNAsFK.exe
2628	TcopWWT.exe
2516	BWZGIci.exe
2764	VMdbhRD.exe
812	eFXoCQj.exe
1644	rLOEvss.exe
1944	qYuQOWc.exe
2236	oUdWBcq.exe
1748	afaptKk.exe
2096	qVorhQp.exe
2196	QhvxIED.exe
3044	bpFlBTP.exe
1560	bgiQLoN.exe

Loads dropped DLL 64 IoCs

pid	Process
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2392-1-0x000000013FC50000-0x0000000140046000-memory.dmp	upx
behavioral1/files/0x000d000000014323-3.dat	upx
behavioral1/files/0x0038000000014502-7.dat	upx
behavioral1/files/0x0008000000014702-16.dat	upx
behavioral1/files/0x00070000000149e1-28.dat	upx
behavioral1/files/0x0007000000014b36-43.dat	upx
behavioral1/files/0x0006000000015cce-68.dat	upx
behavioral1/memory/2472-88-0x000000013FCF0000-0x00000001400E6000-memory.dmp	upx
behavioral1/files/0x0006000000015d44-94.dat	upx
behavioral1/memory/3000-133-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	upx
behavioral1/files/0x0006000000016c1d-168.dat	upx
behavioral1/memory/2580-169-0x000000013F540000-0x000000013F936000-memory.dmp	upx
behavioral1/files/0x00060000000161b3-189.dat	upx
behavioral1/files/0x0006000000015fa7-187.dat	upx
behavioral1/files/0x0006000000015e6d-185.dat	upx
behavioral1/files/0x0006000000015d4c-183.dat	upx
behavioral1/files/0x0006000000015d24-181.dat	upx
behavioral1/files/0x0006000000015cf5-179.dat	upx
behavioral1/memory/2640-172-0x000000013F340000-0x000000013F736000-memory.dmp	upx
behavioral1/memory/2496-171-0x000000013F250000-0x000000013F646000-memory.dmp	upx
behavioral1/files/0x0006000000016c3a-170.dat	upx
behavioral1/files/0x0006000000016a6f-147.dat	upx
behavioral1/files/0x0006000000015cd9-143.dat	upx
behavioral1/files/0x00060000000165f0-140.dat	upx
behavioral1/files/0x0006000000016476-134.dat	upx
behavioral1/files/0x00060000000160cc-128.dat	upx
behavioral1/memory/2616-122-0x000000013F8A0000-0x000000013FC96000-memory.dmp	upx
behavioral1/files/0x0006000000015f3c-120.dat	upx
behavioral1/files/0x0006000000015e09-119.dat	upx
behavioral1/files/0x0006000000015d0c-93.dat	upx
behavioral1/files/0x0006000000015ce3-92.dat	upx
behavioral1/files/0x0006000000015c9c-83.dat	upx
behavioral1/files/0x001800000000558a-75.dat	upx
behavioral1/memory/2260-161-0x000000013F1E0000-0x000000013F5D6000-memory.dmp	upx
behavioral1/files/0x0006000000016813-156.dat	upx
behavioral1/files/0x000600000001654a-155.dat	upx
behavioral1/files/0x00060000000162c9-154.dat	upx
behavioral1/files/0x0006000000015cb0-67.dat	upx
behavioral1/files/0x0006000000015cbd-97.dat	upx
behavioral1/files/0x0007000000015c93-66.dat	upx
behavioral1/files/0x0007000000014b10-53.dat	upx
behavioral1/files/0x000700000001480e-37.dat	upx
behavioral1/memory/2612-31-0x000000013F7E0000-0x000000013FBD6000-memory.dmp	upx
behavioral1/memory/2036-23-0x000000013F980000-0x000000013FD76000-memory.dmp	upx
behavioral1/memory/2648-19-0x000000013FF50000-0x0000000140346000-memory.dmp	upx
behavioral1/memory/2036-7378-0x000000013F980000-0x000000013FD76000-memory.dmp	upx
behavioral1/memory/2648-7383-0x000000013FF50000-0x0000000140346000-memory.dmp	upx
behavioral1/memory/2260-7395-0x000000013F1E0000-0x000000013F5D6000-memory.dmp	upx
behavioral1/memory/2580-7393-0x000000013F540000-0x000000013F936000-memory.dmp	upx
behavioral1/memory/2640-7392-0x000000013F340000-0x000000013F736000-memory.dmp	upx
behavioral1/memory/2616-7390-0x000000013F8A0000-0x000000013FC96000-memory.dmp	upx
behavioral1/memory/2496-7405-0x000000013F250000-0x000000013F646000-memory.dmp	upx
behavioral1/memory/3000-7389-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	upx
behavioral1/memory/2472-7388-0x000000013FCF0000-0x00000001400E6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EsPKAJK.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\EyVBOGn.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\qWttyEH.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\ZvXzAQq.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\Bzwzcvw.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\RqWVCac.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\vZKpchh.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\FoHhqxM.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\rAyxIYg.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\eZipldZ.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\akISINp.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\KNNpsJx.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\BgCpWYB.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\CtDqpbt.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\RcYgvGS.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\mXtuBQQ.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\NcsdQWD.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\bOBBJTS.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\UAgPtcH.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\rUaNAWB.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\mwcePEK.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\DcsPSbZ.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\IMtrFNK.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\cjeFemr.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\xGvhBuI.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\CPYqnSw.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\IKpPKid.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\YasOyaa.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\hfYhHnM.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\jMQofBd.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\LvZHxpF.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\rfYBDMn.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\VSIbzBa.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\nBinbkf.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\iZlyIeD.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\VVnautC.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\tMquJVc.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\qQWpFSv.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\zQLzGRh.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\ytDdXNN.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\fzJzecI.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\kdCvtmU.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\CYkygaA.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\qqadwLu.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\PjdHYqO.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\ZRaHhzS.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\oDwjspc.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\MFmeVQr.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\mDBMvpp.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\fesBMLy.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\diIVLkx.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\zTpNQZo.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\BOZnJVM.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\rWjDocY.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\UpTGnFg.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\XtlDToq.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\TOHdwMP.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\dNMSUSc.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\ruSmuzD.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\zQSOTBI.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\thwjrld.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\hAoupNH.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\GTRnNti.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe
File created	C:\Windows\System\ynauitu.exe	66c0feabc09ecc94c618fa164813c500_NEAS.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1420	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
Token: SeLockMemoryPrivilege	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe
Token: SeDebugPrivilege	1420	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1420	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	29
PID 2392 wrote to memory of 1420	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	29
PID 2392 wrote to memory of 1420	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	29
PID 2392 wrote to memory of 2648	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	30
PID 2392 wrote to memory of 2648	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	30
PID 2392 wrote to memory of 2648	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	30
PID 2392 wrote to memory of 2036	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	31
PID 2392 wrote to memory of 2036	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	31
PID 2392 wrote to memory of 2036	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	31
PID 2392 wrote to memory of 2612	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	32
PID 2392 wrote to memory of 2612	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	32
PID 2392 wrote to memory of 2612	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	32
PID 2392 wrote to memory of 2616	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	33
PID 2392 wrote to memory of 2616	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	33
PID 2392 wrote to memory of 2616	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	33
PID 2392 wrote to memory of 2472	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	34
PID 2392 wrote to memory of 2472	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	34
PID 2392 wrote to memory of 2472	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	34
PID 2392 wrote to memory of 2580	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	35
PID 2392 wrote to memory of 2580	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	35
PID 2392 wrote to memory of 2580	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	35
PID 2392 wrote to memory of 3000	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	36
PID 2392 wrote to memory of 3000	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	36
PID 2392 wrote to memory of 3000	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	36
PID 2392 wrote to memory of 2468	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	37
PID 2392 wrote to memory of 2468	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	37
PID 2392 wrote to memory of 2468	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	37
PID 2392 wrote to memory of 2496	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	38
PID 2392 wrote to memory of 2496	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	38
PID 2392 wrote to memory of 2496	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	38
PID 2392 wrote to memory of 2232	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	39
PID 2392 wrote to memory of 2232	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	39
PID 2392 wrote to memory of 2232	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	39
PID 2392 wrote to memory of 2260	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	40
PID 2392 wrote to memory of 2260	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	40
PID 2392 wrote to memory of 2260	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	40
PID 2392 wrote to memory of 1992	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	41
PID 2392 wrote to memory of 1992	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	41
PID 2392 wrote to memory of 1992	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	41
PID 2392 wrote to memory of 2640	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	42
PID 2392 wrote to memory of 2640	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	42
PID 2392 wrote to memory of 2640	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	42
PID 2392 wrote to memory of 2824	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	43
PID 2392 wrote to memory of 2824	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	43
PID 2392 wrote to memory of 2824	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	43
PID 2392 wrote to memory of 2836	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	44
PID 2392 wrote to memory of 2836	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	44
PID 2392 wrote to memory of 2836	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	44
PID 2392 wrote to memory of 2960	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	45
PID 2392 wrote to memory of 2960	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	45
PID 2392 wrote to memory of 2960	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	45
PID 2392 wrote to memory of 2932	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	46
PID 2392 wrote to memory of 2932	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	46
PID 2392 wrote to memory of 2932	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	46
PID 2392 wrote to memory of 816	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	47
PID 2392 wrote to memory of 816	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	47
PID 2392 wrote to memory of 816	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	47
PID 2392 wrote to memory of 2176	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	48
PID 2392 wrote to memory of 2176	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	48
PID 2392 wrote to memory of 2176	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	48
PID 2392 wrote to memory of 1676	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	49
PID 2392 wrote to memory of 1676	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	49
PID 2392 wrote to memory of 1676	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	49
PID 2392 wrote to memory of 1604	2392	66c0feabc09ecc94c618fa164813c500_NEAS.exe	50

C:\Users\Admin\AppData\Local\Temp\66c0feabc09ecc94c618fa164813c500_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\66c0feabc09ecc94c618fa164813c500_NEAS.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1420
- C:\Windows\System\uGxVxbT.exe
  C:\Windows\System\uGxVxbT.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\lliCnPc.exe
  C:\Windows\System\lliCnPc.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\wCQAQqU.exe
  C:\Windows\System\wCQAQqU.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\osNALwi.exe
  C:\Windows\System\osNALwi.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\CwjWZqh.exe
  C:\Windows\System\CwjWZqh.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\cHJvBFw.exe
  C:\Windows\System\cHJvBFw.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\AAueQVg.exe
  C:\Windows\System\AAueQVg.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\qSWGwWS.exe
  C:\Windows\System\qSWGwWS.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\pUKinXE.exe
  C:\Windows\System\pUKinXE.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\dbEacxN.exe
  C:\Windows\System\dbEacxN.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\LKlMtmY.exe
  C:\Windows\System\LKlMtmY.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\HHjWDAM.exe
  C:\Windows\System\HHjWDAM.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\rIVssFW.exe
  C:\Windows\System\rIVssFW.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\EIWhfVW.exe
  C:\Windows\System\EIWhfVW.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\HitlOsd.exe
  C:\Windows\System\HitlOsd.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\rPbSHiG.exe
  C:\Windows\System\rPbSHiG.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\xxzkRUC.exe
  C:\Windows\System\xxzkRUC.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\URgFlVI.exe
  C:\Windows\System\URgFlVI.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\NZNHVuH.exe
  C:\Windows\System\NZNHVuH.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\wadffKG.exe
  C:\Windows\System\wadffKG.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\EIMwzdS.exe
  C:\Windows\System\EIMwzdS.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\ILAPrna.exe
  C:\Windows\System\ILAPrna.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\ZdYUXZl.exe
  C:\Windows\System\ZdYUXZl.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\rkntbNN.exe
  C:\Windows\System\rkntbNN.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\FkDjRaf.exe
  C:\Windows\System\FkDjRaf.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\OBKIriR.exe
  C:\Windows\System\OBKIriR.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\GEyfUUS.exe
  C:\Windows\System\GEyfUUS.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\iiVbNUn.exe
  C:\Windows\System\iiVbNUn.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\zlDOYMS.exe
  C:\Windows\System\zlDOYMS.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\oclsevp.exe
  C:\Windows\System\oclsevp.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\wdXvzxf.exe
  C:\Windows\System\wdXvzxf.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\GQMdIgc.exe
  C:\Windows\System\GQMdIgc.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\eONJwXj.exe
  C:\Windows\System\eONJwXj.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\OpngosZ.exe
  C:\Windows\System\OpngosZ.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\PsvkWHn.exe
  C:\Windows\System\PsvkWHn.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\pCwCUjS.exe
  C:\Windows\System\pCwCUjS.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\MUoIkpJ.exe
  C:\Windows\System\MUoIkpJ.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\tlxrKlF.exe
  C:\Windows\System\tlxrKlF.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\NgGYXvM.exe
  C:\Windows\System\NgGYXvM.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\gfUzIxK.exe
  C:\Windows\System\gfUzIxK.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\VoIsYmS.exe
  C:\Windows\System\VoIsYmS.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\YfIrzVk.exe
  C:\Windows\System\YfIrzVk.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\KvapIlz.exe
  C:\Windows\System\KvapIlz.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\iUELBKq.exe
  C:\Windows\System\iUELBKq.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\bPLUClJ.exe
  C:\Windows\System\bPLUClJ.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\jTPNdGo.exe
  C:\Windows\System\jTPNdGo.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\VXJbRkO.exe
  C:\Windows\System\VXJbRkO.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\abhpFgA.exe
  C:\Windows\System\abhpFgA.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\tlPMywj.exe
  C:\Windows\System\tlPMywj.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\bpFlBTP.exe
  C:\Windows\System\bpFlBTP.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\PFlFKJW.exe
  C:\Windows\System\PFlFKJW.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\jFdlvWa.exe
  C:\Windows\System\jFdlvWa.exe
  2⤵
  PID:2124
- C:\Windows\System\nJBWsaY.exe
  C:\Windows\System\nJBWsaY.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\lBAScsn.exe
  C:\Windows\System\lBAScsn.exe
  2⤵
  PID:320
- C:\Windows\System\OrNAsFK.exe
  C:\Windows\System\OrNAsFK.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\zpmzZWI.exe
  C:\Windows\System\zpmzZWI.exe
  2⤵
  PID:2756
- C:\Windows\System\TcopWWT.exe
  C:\Windows\System\TcopWWT.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\hRHoHjN.exe
  C:\Windows\System\hRHoHjN.exe
  2⤵
  PID:2588
- C:\Windows\System\BWZGIci.exe
  C:\Windows\System\BWZGIci.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\YPowCvj.exe
  C:\Windows\System\YPowCvj.exe
  2⤵
  PID:2636
- C:\Windows\System\VMdbhRD.exe
  C:\Windows\System\VMdbhRD.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\Itrxtri.exe
  C:\Windows\System\Itrxtri.exe
  2⤵
  PID:2944
- C:\Windows\System\eFXoCQj.exe
  C:\Windows\System\eFXoCQj.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\COFUPUj.exe
  C:\Windows\System\COFUPUj.exe
  2⤵
  PID:2820
- C:\Windows\System\rLOEvss.exe
  C:\Windows\System\rLOEvss.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\LjNbnUE.exe
  C:\Windows\System\LjNbnUE.exe
  2⤵
  PID:1548
- C:\Windows\System\qYuQOWc.exe
  C:\Windows\System\qYuQOWc.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\gNbHxTq.exe
  C:\Windows\System\gNbHxTq.exe
  2⤵
  PID:624
- C:\Windows\System\oUdWBcq.exe
  C:\Windows\System\oUdWBcq.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\PMGTNTW.exe
  C:\Windows\System\PMGTNTW.exe
  2⤵
  PID:2964
- C:\Windows\System\afaptKk.exe
  C:\Windows\System\afaptKk.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\kqpegxT.exe
  C:\Windows\System\kqpegxT.exe
  2⤵
  PID:2356
- C:\Windows\System\qVorhQp.exe
  C:\Windows\System\qVorhQp.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\HFrHCrb.exe
  C:\Windows\System\HFrHCrb.exe
  2⤵
  PID:852
- C:\Windows\System\QhvxIED.exe
  C:\Windows\System\QhvxIED.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\NBdYBYj.exe
  C:\Windows\System\NBdYBYj.exe
  2⤵
  PID:780
- C:\Windows\System\bgiQLoN.exe
  C:\Windows\System\bgiQLoN.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\QvjSGKP.exe
  C:\Windows\System\QvjSGKP.exe
  2⤵
  PID:1044
- C:\Windows\System\yzkXVak.exe
  C:\Windows\System\yzkXVak.exe
  2⤵
  PID:1064
- C:\Windows\System\WWjtJRM.exe
  C:\Windows\System\WWjtJRM.exe
  2⤵
  PID:1728
- C:\Windows\System\RUSRoct.exe
  C:\Windows\System\RUSRoct.exe
  2⤵
  PID:868
- C:\Windows\System\zhPwUdn.exe
  C:\Windows\System\zhPwUdn.exe
  2⤵
  PID:1656
- C:\Windows\System\BwGCgfB.exe
  C:\Windows\System\BwGCgfB.exe
  2⤵
  PID:2148
- C:\Windows\System\cvUlMtw.exe
  C:\Windows\System\cvUlMtw.exe
  2⤵
  PID:892
- C:\Windows\System\eZipldZ.exe
  C:\Windows\System\eZipldZ.exe
  2⤵
  PID:1004
- C:\Windows\System\hWnILQR.exe
  C:\Windows\System\hWnILQR.exe
  2⤵
  PID:2680
- C:\Windows\System\uHQlOkc.exe
  C:\Windows\System\uHQlOkc.exe
  2⤵
  PID:2696
- C:\Windows\System\unnvFkl.exe
  C:\Windows\System\unnvFkl.exe
  2⤵
  PID:1544
- C:\Windows\System\hIhGhay.exe
  C:\Windows\System\hIhGhay.exe
  2⤵
  PID:1608
- C:\Windows\System\zGOvwgD.exe
  C:\Windows\System\zGOvwgD.exe
  2⤵
  PID:2664
- C:\Windows\System\cLOOTiR.exe
  C:\Windows\System\cLOOTiR.exe
  2⤵
  PID:2144
- C:\Windows\System\TOivUME.exe
  C:\Windows\System\TOivUME.exe
  2⤵
  PID:2676
- C:\Windows\System\RfUIzat.exe
  C:\Windows\System\RfUIzat.exe
  2⤵
  PID:684
- C:\Windows\System\supSvjT.exe
  C:\Windows\System\supSvjT.exe
  2⤵
  PID:560
- C:\Windows\System\dLUKaxi.exe
  C:\Windows\System\dLUKaxi.exe
  2⤵
  PID:2068
- C:\Windows\System\sNthIlk.exe
  C:\Windows\System\sNthIlk.exe
  2⤵
  PID:1984
- C:\Windows\System\alcotXl.exe
  C:\Windows\System\alcotXl.exe
  2⤵
  PID:2092
- C:\Windows\System\UmGPUKR.exe
  C:\Windows\System\UmGPUKR.exe
  2⤵
  PID:1696
- C:\Windows\System\gVBVQnb.exe
  C:\Windows\System\gVBVQnb.exe
  2⤵
  PID:528
- C:\Windows\System\cQMFyVt.exe
  C:\Windows\System\cQMFyVt.exe
  2⤵
  PID:1628
- C:\Windows\System\bMYcOld.exe
  C:\Windows\System\bMYcOld.exe
  2⤵
  PID:640
- C:\Windows\System\qooDoOm.exe
  C:\Windows\System\qooDoOm.exe
  2⤵
  PID:1712
- C:\Windows\System\sSPVNQq.exe
  C:\Windows\System\sSPVNQq.exe
  2⤵
  PID:1660
- C:\Windows\System\BJTgnBE.exe
  C:\Windows\System\BJTgnBE.exe
  2⤵
  PID:1464
- C:\Windows\System\lQaLOIZ.exe
  C:\Windows\System\lQaLOIZ.exe
  2⤵
  PID:696
- C:\Windows\System\jFYDHYe.exe
  C:\Windows\System\jFYDHYe.exe
  2⤵
  PID:2020
- C:\Windows\System\IEShtUM.exe
  C:\Windows\System\IEShtUM.exe
  2⤵
  PID:1312
- C:\Windows\System\JKHoTHf.exe
  C:\Windows\System\JKHoTHf.exe
  2⤵
  PID:1204
- C:\Windows\System\PCslCsI.exe
  C:\Windows\System\PCslCsI.exe
  2⤵
  PID:600
- C:\Windows\System\siYkdYa.exe
  C:\Windows\System\siYkdYa.exe
  2⤵
  PID:3032
- C:\Windows\System\PlKRTdk.exe
  C:\Windows\System\PlKRTdk.exe
  2⤵
  PID:1836
- C:\Windows\System\SAXjFls.exe
  C:\Windows\System\SAXjFls.exe
  2⤵
  PID:2788
- C:\Windows\System\bJVpLPF.exe
  C:\Windows\System\bJVpLPF.exe
  2⤵
  PID:2724
- C:\Windows\System\RIAxwkO.exe
  C:\Windows\System\RIAxwkO.exe
  2⤵
  PID:1888
- C:\Windows\System\qOCtGiQ.exe
  C:\Windows\System\qOCtGiQ.exe
  2⤵
  PID:1796
- C:\Windows\System\NnmMWwc.exe
  C:\Windows\System\NnmMWwc.exe
  2⤵
  PID:2708
- C:\Windows\System\qbEiwAK.exe
  C:\Windows\System\qbEiwAK.exe
  2⤵
  PID:2816
- C:\Windows\System\cCZIYLg.exe
  C:\Windows\System\cCZIYLg.exe
  2⤵
  PID:1692
- C:\Windows\System\MZFPYFe.exe
  C:\Windows\System\MZFPYFe.exe
  2⤵
  PID:2352
- C:\Windows\System\MKVqcUB.exe
  C:\Windows\System\MKVqcUB.exe
  2⤵
  PID:3084
- C:\Windows\System\XQqHqfQ.exe
  C:\Windows\System\XQqHqfQ.exe
  2⤵
  PID:3100
- C:\Windows\System\GDleSej.exe
  C:\Windows\System\GDleSej.exe
  2⤵
  PID:3116
- C:\Windows\System\kKPxZME.exe
  C:\Windows\System\kKPxZME.exe
  2⤵
  PID:3132
- C:\Windows\System\FQXrSLa.exe
  C:\Windows\System\FQXrSLa.exe
  2⤵
  PID:3148
- C:\Windows\System\qxeTgjP.exe
  C:\Windows\System\qxeTgjP.exe
  2⤵
  PID:3164
- C:\Windows\System\oXTOnIm.exe
  C:\Windows\System\oXTOnIm.exe
  2⤵
  PID:3180
- C:\Windows\System\BazzZAR.exe
  C:\Windows\System\BazzZAR.exe
  2⤵
  PID:3196
- C:\Windows\System\aojjaSe.exe
  C:\Windows\System\aojjaSe.exe
  2⤵
  PID:3212
- C:\Windows\System\FwQtPjh.exe
  C:\Windows\System\FwQtPjh.exe
  2⤵
  PID:3232
- C:\Windows\System\cOPnsVk.exe
  C:\Windows\System\cOPnsVk.exe
  2⤵
  PID:3248
- C:\Windows\System\akISINp.exe
  C:\Windows\System\akISINp.exe
  2⤵
  PID:3264
- C:\Windows\System\MhTvaXw.exe
  C:\Windows\System\MhTvaXw.exe
  2⤵
  PID:3280
- C:\Windows\System\ZtilFqJ.exe
  C:\Windows\System\ZtilFqJ.exe
  2⤵
  PID:3296
- C:\Windows\System\OVQfXfm.exe
  C:\Windows\System\OVQfXfm.exe
  2⤵
  PID:3312
- C:\Windows\System\JtTswrz.exe
  C:\Windows\System\JtTswrz.exe
  2⤵
  PID:3328
- C:\Windows\System\MoPpvsh.exe
  C:\Windows\System\MoPpvsh.exe
  2⤵
  PID:3344
- C:\Windows\System\feTcJaS.exe
  C:\Windows\System\feTcJaS.exe
  2⤵
  PID:3360
- C:\Windows\System\EkJyTsv.exe
  C:\Windows\System\EkJyTsv.exe
  2⤵
  PID:3380
- C:\Windows\System\vOQwTZP.exe
  C:\Windows\System\vOQwTZP.exe
  2⤵
  PID:3396
- C:\Windows\System\YOxyJGl.exe
  C:\Windows\System\YOxyJGl.exe
  2⤵
  PID:3412
- C:\Windows\System\CxFjjbq.exe
  C:\Windows\System\CxFjjbq.exe
  2⤵
  PID:3428
- C:\Windows\System\JjMrvVa.exe
  C:\Windows\System\JjMrvVa.exe
  2⤵
  PID:3468
- C:\Windows\System\STUtiqB.exe
  C:\Windows\System\STUtiqB.exe
  2⤵
  PID:3524
- C:\Windows\System\zwzjswg.exe
  C:\Windows\System\zwzjswg.exe
  2⤵
  PID:3544
- C:\Windows\System\tCXicVG.exe
  C:\Windows\System\tCXicVG.exe
  2⤵
  PID:3564
- C:\Windows\System\NmCxkxK.exe
  C:\Windows\System\NmCxkxK.exe
  2⤵
  PID:3588
- C:\Windows\System\XEzEjcP.exe
  C:\Windows\System\XEzEjcP.exe
  2⤵
  PID:3604
- C:\Windows\System\lXDQneS.exe
  C:\Windows\System\lXDQneS.exe
  2⤵
  PID:3624
- C:\Windows\System\qLHFLhu.exe
  C:\Windows\System\qLHFLhu.exe
  2⤵
  PID:3644
- C:\Windows\System\WRLOmCG.exe
  C:\Windows\System\WRLOmCG.exe
  2⤵
  PID:3668
- C:\Windows\System\cEEKWRt.exe
  C:\Windows\System\cEEKWRt.exe
  2⤵
  PID:3688
- C:\Windows\System\mzGHken.exe
  C:\Windows\System\mzGHken.exe
  2⤵
  PID:3708
- C:\Windows\System\tULaiwh.exe
  C:\Windows\System\tULaiwh.exe
  2⤵
  PID:3732
- C:\Windows\System\psGVNxf.exe
  C:\Windows\System\psGVNxf.exe
  2⤵
  PID:3752
- C:\Windows\System\xjQMiUV.exe
  C:\Windows\System\xjQMiUV.exe
  2⤵
  PID:3772
- C:\Windows\System\Jnxwtto.exe
  C:\Windows\System\Jnxwtto.exe
  2⤵
  PID:3792
- C:\Windows\System\wvtcGUx.exe
  C:\Windows\System\wvtcGUx.exe
  2⤵
  PID:3812
- C:\Windows\System\bwaNJVp.exe
  C:\Windows\System\bwaNJVp.exe
  2⤵
  PID:3828
- C:\Windows\System\WxPVbbU.exe
  C:\Windows\System\WxPVbbU.exe
  2⤵
  PID:3844
- C:\Windows\System\BDVIYlS.exe
  C:\Windows\System\BDVIYlS.exe
  2⤵
  PID:3860
- C:\Windows\System\WwZJcMh.exe
  C:\Windows\System\WwZJcMh.exe
  2⤵
  PID:3876
- C:\Windows\System\IALchnZ.exe
  C:\Windows\System\IALchnZ.exe
  2⤵
  PID:3900
- C:\Windows\System\PwmQSax.exe
  C:\Windows\System\PwmQSax.exe
  2⤵
  PID:3916
- C:\Windows\System\KOypVsD.exe
  C:\Windows\System\KOypVsD.exe
  2⤵
  PID:3932
- C:\Windows\System\FSbytla.exe
  C:\Windows\System\FSbytla.exe
  2⤵
  PID:3952
- C:\Windows\System\vykQtpe.exe
  C:\Windows\System\vykQtpe.exe
  2⤵
  PID:3972
- C:\Windows\System\CwgKBrv.exe
  C:\Windows\System\CwgKBrv.exe
  2⤵
  PID:3988
- C:\Windows\System\UulMTMP.exe
  C:\Windows\System\UulMTMP.exe
  2⤵
  PID:4008
- C:\Windows\System\KByzYvc.exe
  C:\Windows\System\KByzYvc.exe
  2⤵
  PID:4028
- C:\Windows\System\FtgCmfU.exe
  C:\Windows\System\FtgCmfU.exe
  2⤵
  PID:4048
- C:\Windows\System\JesfioD.exe
  C:\Windows\System\JesfioD.exe
  2⤵
  PID:4064
- C:\Windows\System\IrbYEyP.exe
  C:\Windows\System\IrbYEyP.exe
  2⤵
  PID:4080
- C:\Windows\System\pCPKOzp.exe
  C:\Windows\System\pCPKOzp.exe
  2⤵
  PID:2420
- C:\Windows\System\hlePnDT.exe
  C:\Windows\System\hlePnDT.exe
  2⤵
  PID:3076
- C:\Windows\System\sPxcjbR.exe
  C:\Windows\System\sPxcjbR.exe
  2⤵
  PID:3144
- C:\Windows\System\dyEkRau.exe
  C:\Windows\System\dyEkRau.exe
  2⤵
  PID:3240
- C:\Windows\System\VmgGHKi.exe
  C:\Windows\System\VmgGHKi.exe
  2⤵
  PID:3304
- C:\Windows\System\SYugjfa.exe
  C:\Windows\System\SYugjfa.exe
  2⤵
  PID:3620
- C:\Windows\System\jNtENWf.exe
  C:\Windows\System\jNtENWf.exe
  2⤵
  PID:3700
- C:\Windows\System\ghIjonJ.exe
  C:\Windows\System\ghIjonJ.exe
  2⤵
  PID:3256
- C:\Windows\System\PqvRBuu.exe
  C:\Windows\System\PqvRBuu.exe
  2⤵
  PID:3324
- C:\Windows\System\nGTCRAV.exe
  C:\Windows\System\nGTCRAV.exe
  2⤵
  PID:3392
- C:\Windows\System\euejFXx.exe
  C:\Windows\System\euejFXx.exe
  2⤵
  PID:3484
- C:\Windows\System\EBQAClX.exe
  C:\Windows\System\EBQAClX.exe
  2⤵
  PID:3928
- C:\Windows\System\DTsYNeI.exe
  C:\Windows\System\DTsYNeI.exe
  2⤵
  PID:3176
- C:\Windows\System\yOaUaRN.exe
  C:\Windows\System\yOaUaRN.exe
  2⤵
  PID:3208
- C:\Windows\System\OTjWmju.exe
  C:\Windows\System\OTjWmju.exe
  2⤵
  PID:4040
- C:\Windows\System\bQmGZNk.exe
  C:\Windows\System\bQmGZNk.exe
  2⤵
  PID:3996
- C:\Windows\System\IEikXcv.exe
  C:\Windows\System\IEikXcv.exe
  2⤵
  PID:2380
- C:\Windows\System\jdEHKzR.exe
  C:\Windows\System\jdEHKzR.exe
  2⤵
  PID:2852
- C:\Windows\System\tZQPlFn.exe
  C:\Windows\System\tZQPlFn.exe
  2⤵
  PID:1536
- C:\Windows\System\QnNoERS.exe
  C:\Windows\System\QnNoERS.exe
  2⤵
  PID:448
- C:\Windows\System\boDpVTJ.exe
  C:\Windows\System\boDpVTJ.exe
  2⤵
  PID:2660
- C:\Windows\System\TPIhguB.exe
  C:\Windows\System\TPIhguB.exe
  2⤵
  PID:1132
- C:\Windows\System\Llcnztj.exe
  C:\Windows\System\Llcnztj.exe
  2⤵
  PID:3948
- C:\Windows\System\lxXPINq.exe
  C:\Windows\System\lxXPINq.exe
  2⤵
  PID:3352
- C:\Windows\System\LXuqFQQ.exe
  C:\Windows\System\LXuqFQQ.exe
  2⤵
  PID:4092
- C:\Windows\System\NpuovIa.exe
  C:\Windows\System\NpuovIa.exe
  2⤵
  PID:3436
- C:\Windows\System\UjJItfm.exe
  C:\Windows\System\UjJItfm.exe
  2⤵
  PID:3452
- C:\Windows\System\GzoSbnN.exe
  C:\Windows\System\GzoSbnN.exe
  2⤵
  PID:1364
- C:\Windows\System\nqjCHTq.exe
  C:\Windows\System\nqjCHTq.exe
  2⤵
  PID:3536
- C:\Windows\System\bFzEwlk.exe
  C:\Windows\System\bFzEwlk.exe
  2⤵
  PID:3584
- C:\Windows\System\gZIiCzI.exe
  C:\Windows\System\gZIiCzI.exe
  2⤵
  PID:1568
- C:\Windows\System\Pjiybdr.exe
  C:\Windows\System\Pjiybdr.exe
  2⤵
  PID:308
- C:\Windows\System\skQRbJX.exe
  C:\Windows\System\skQRbJX.exe
  2⤵
  PID:968
- C:\Windows\System\amjAKdx.exe
  C:\Windows\System\amjAKdx.exe
  2⤵
  PID:1952
- C:\Windows\System\WDdsZPu.exe
  C:\Windows\System\WDdsZPu.exe
  2⤵
  PID:2520
- C:\Windows\System\ruSTCiY.exe
  C:\Windows\System\ruSTCiY.exe
  2⤵
  PID:2328
- C:\Windows\System\pxEwDTT.exe
  C:\Windows\System\pxEwDTT.exe
  2⤵
  PID:2600
- C:\Windows\System\QmMVrZL.exe
  C:\Windows\System\QmMVrZL.exe
  2⤵
  PID:1780
- C:\Windows\System\gleYbAT.exe
  C:\Windows\System\gleYbAT.exe
  2⤵
  PID:3128
- C:\Windows\System\FugkYgy.exe
  C:\Windows\System\FugkYgy.exe
  2⤵
  PID:3192
- C:\Windows\System\QvfXBZA.exe
  C:\Windows\System\QvfXBZA.exe
  2⤵
  PID:4060
- C:\Windows\System\HLAECJa.exe
  C:\Windows\System\HLAECJa.exe
  2⤵
  PID:3140
- C:\Windows\System\yJFsBwF.exe
  C:\Windows\System\yJFsBwF.exe
  2⤵
  PID:3500
- C:\Windows\System\NJlySfR.exe
  C:\Windows\System\NJlySfR.exe
  2⤵
  PID:3372
- C:\Windows\System\pPOOSEj.exe
  C:\Windows\System\pPOOSEj.exe
  2⤵
  PID:3556
- C:\Windows\System\VYNurSE.exe
  C:\Windows\System\VYNurSE.exe
  2⤵
  PID:3632
- C:\Windows\System\YxKFplz.exe
  C:\Windows\System\YxKFplz.exe
  2⤵
  PID:3680
- C:\Windows\System\zGJpRYE.exe
  C:\Windows\System\zGJpRYE.exe
  2⤵
  PID:3724
- C:\Windows\System\mQtfVhJ.exe
  C:\Windows\System\mQtfVhJ.exe
  2⤵
  PID:3768
- C:\Windows\System\zCYxqVR.exe
  C:\Windows\System\zCYxqVR.exe
  2⤵
  PID:3836
- C:\Windows\System\UzaWfva.exe
  C:\Windows\System\UzaWfva.exe
  2⤵
  PID:3908
- C:\Windows\System\MvDVleU.exe
  C:\Windows\System\MvDVleU.exe
  2⤵
  PID:3824
- C:\Windows\System\amTehfs.exe
  C:\Windows\System\amTehfs.exe
  2⤵
  PID:3660
- C:\Windows\System\OXYLhnL.exe
  C:\Windows\System\OXYLhnL.exe
  2⤵
  PID:3852
- C:\Windows\System\rguyxdI.exe
  C:\Windows\System\rguyxdI.exe
  2⤵
  PID:3292
- C:\Windows\System\ZoRynwh.exe
  C:\Windows\System\ZoRynwh.exe
  2⤵
  PID:1948
- C:\Windows\System\cZFivMQ.exe
  C:\Windows\System\cZFivMQ.exe
  2⤵
  PID:2080
- C:\Windows\System\MIKphVZ.exe
  C:\Windows\System\MIKphVZ.exe
  2⤵
  PID:1872
- C:\Windows\System\xqLsTTX.exe
  C:\Windows\System\xqLsTTX.exe
  2⤵
  PID:3496
- C:\Windows\System\BcmvrKf.exe
  C:\Windows\System\BcmvrKf.exe
  2⤵
  PID:3480
- C:\Windows\System\fZzPLEO.exe
  C:\Windows\System\fZzPLEO.exe
  2⤵
  PID:2488
- C:\Windows\System\FHubSKH.exe
  C:\Windows\System\FHubSKH.exe
  2⤵
  PID:2536
- C:\Windows\System\LVusLKe.exe
  C:\Windows\System\LVusLKe.exe
  2⤵
  PID:3404
- C:\Windows\System\rnBmzuC.exe
  C:\Windows\System\rnBmzuC.exe
  2⤵
  PID:3340
- C:\Windows\System\BMmYupz.exe
  C:\Windows\System\BMmYupz.exe
  2⤵
  PID:704
- C:\Windows\System\mwOOzwU.exe
  C:\Windows\System\mwOOzwU.exe
  2⤵
  PID:900
- C:\Windows\System\mxILVDF.exe
  C:\Windows\System\mxILVDF.exe
  2⤵
  PID:3580
- C:\Windows\System\qFtgyGh.exe
  C:\Windows\System\qFtgyGh.exe
  2⤵
  PID:2216
- C:\Windows\System\LGoRgoy.exe
  C:\Windows\System\LGoRgoy.exe
  2⤵
  PID:1084
- C:\Windows\System\AKMlfbr.exe
  C:\Windows\System\AKMlfbr.exe
  2⤵
  PID:2936
- C:\Windows\System\eRkSoyP.exe
  C:\Windows\System\eRkSoyP.exe
  2⤵
  PID:4100
- C:\Windows\System\CPrHhwN.exe
  C:\Windows\System\CPrHhwN.exe
  2⤵
  PID:4116
- C:\Windows\System\uDxmNPi.exe
  C:\Windows\System\uDxmNPi.exe
  2⤵
  PID:4136
- C:\Windows\System\nCXcdap.exe
  C:\Windows\System\nCXcdap.exe
  2⤵
  PID:4152
- C:\Windows\System\UHknFbG.exe
  C:\Windows\System\UHknFbG.exe
  2⤵
  PID:4172
- C:\Windows\System\xONcdPO.exe
  C:\Windows\System\xONcdPO.exe
  2⤵
  PID:4188
- C:\Windows\System\faQDeWA.exe
  C:\Windows\System\faQDeWA.exe
  2⤵
  PID:4204
- C:\Windows\System\fHrMVgF.exe
  C:\Windows\System\fHrMVgF.exe
  2⤵
  PID:4220
- C:\Windows\System\ieTJMWC.exe
  C:\Windows\System\ieTJMWC.exe
  2⤵
  PID:4236
- C:\Windows\System\tnjNiVI.exe
  C:\Windows\System\tnjNiVI.exe
  2⤵
  PID:4252
- C:\Windows\System\RUhRyCc.exe
  C:\Windows\System\RUhRyCc.exe
  2⤵
  PID:4268
- C:\Windows\System\nTzdwDw.exe
  C:\Windows\System\nTzdwDw.exe
  2⤵
  PID:4284
- C:\Windows\System\IpaEIvA.exe
  C:\Windows\System\IpaEIvA.exe
  2⤵
  PID:4300
- C:\Windows\System\ocdVCfL.exe
  C:\Windows\System\ocdVCfL.exe
  2⤵
  PID:4316
- C:\Windows\System\WEsnRFU.exe
  C:\Windows\System\WEsnRFU.exe
  2⤵
  PID:4332
- C:\Windows\System\sNEOgaE.exe
  C:\Windows\System\sNEOgaE.exe
  2⤵
  PID:4348
- C:\Windows\System\rAoyZUj.exe
  C:\Windows\System\rAoyZUj.exe
  2⤵
  PID:4364
- C:\Windows\System\mYlQBVL.exe
  C:\Windows\System\mYlQBVL.exe
  2⤵
  PID:4380
- C:\Windows\System\ocqaeVJ.exe
  C:\Windows\System\ocqaeVJ.exe
  2⤵
  PID:4396
- C:\Windows\System\UNKaJHJ.exe
  C:\Windows\System\UNKaJHJ.exe
  2⤵
  PID:4412
- C:\Windows\System\LFxIELI.exe
  C:\Windows\System\LFxIELI.exe
  2⤵
  PID:4428
- C:\Windows\System\CUlOfFR.exe
  C:\Windows\System\CUlOfFR.exe
  2⤵
  PID:4444
- C:\Windows\System\oxwlvkp.exe
  C:\Windows\System\oxwlvkp.exe
  2⤵
  PID:4460
- C:\Windows\System\UzHxWKC.exe
  C:\Windows\System\UzHxWKC.exe
  2⤵
  PID:4476
- C:\Windows\System\kmDGlPC.exe
  C:\Windows\System\kmDGlPC.exe
  2⤵
  PID:4492
- C:\Windows\System\aUsJjqr.exe
  C:\Windows\System\aUsJjqr.exe
  2⤵
  PID:4508
- C:\Windows\System\ztvtoPy.exe
  C:\Windows\System\ztvtoPy.exe
  2⤵
  PID:4524
- C:\Windows\System\roHegHf.exe
  C:\Windows\System\roHegHf.exe
  2⤵
  PID:4540
- C:\Windows\System\BqXIOKG.exe
  C:\Windows\System\BqXIOKG.exe
  2⤵
  PID:4556
- C:\Windows\System\pDhekYp.exe
  C:\Windows\System\pDhekYp.exe
  2⤵
  PID:4572
- C:\Windows\System\VXjLnUX.exe
  C:\Windows\System\VXjLnUX.exe
  2⤵
  PID:4592
- C:\Windows\System\GOBwuAc.exe
  C:\Windows\System\GOBwuAc.exe
  2⤵
  PID:4608
- C:\Windows\System\mtUDGwr.exe
  C:\Windows\System\mtUDGwr.exe
  2⤵
  PID:4624
- C:\Windows\System\SOmEDAm.exe
  C:\Windows\System\SOmEDAm.exe
  2⤵
  PID:4640
- C:\Windows\System\YVLPcgH.exe
  C:\Windows\System\YVLPcgH.exe
  2⤵
  PID:4656
- C:\Windows\System\ZVCLxrO.exe
  C:\Windows\System\ZVCLxrO.exe
  2⤵
  PID:4672
- C:\Windows\System\cmgvxAF.exe
  C:\Windows\System\cmgvxAF.exe
  2⤵
  PID:4688
- C:\Windows\System\FcaXZEB.exe
  C:\Windows\System\FcaXZEB.exe
  2⤵
  PID:4704
- C:\Windows\System\pZXDIRX.exe
  C:\Windows\System\pZXDIRX.exe
  2⤵
  PID:4720
- C:\Windows\System\keflFLO.exe
  C:\Windows\System\keflFLO.exe
  2⤵
  PID:4736
- C:\Windows\System\NxUYNlh.exe
  C:\Windows\System\NxUYNlh.exe
  2⤵
  PID:4752
- C:\Windows\System\ZmzLrIG.exe
  C:\Windows\System\ZmzLrIG.exe
  2⤵
  PID:4768
- C:\Windows\System\SkUBcyX.exe
  C:\Windows\System\SkUBcyX.exe
  2⤵
  PID:4784
- C:\Windows\System\vsDBVGx.exe
  C:\Windows\System\vsDBVGx.exe
  2⤵
  PID:4800
- C:\Windows\System\GAfPhYf.exe
  C:\Windows\System\GAfPhYf.exe
  2⤵
  PID:4816
- C:\Windows\System\ydlExaU.exe
  C:\Windows\System\ydlExaU.exe
  2⤵
  PID:4832
- C:\Windows\System\iUKsocL.exe
  C:\Windows\System\iUKsocL.exe
  2⤵
  PID:4848
- C:\Windows\System\aQYCtzO.exe
  C:\Windows\System\aQYCtzO.exe
  2⤵
  PID:4864
- C:\Windows\System\GpRDnkc.exe
  C:\Windows\System\GpRDnkc.exe
  2⤵
  PID:4880
- C:\Windows\System\kVdTWjV.exe
  C:\Windows\System\kVdTWjV.exe
  2⤵
  PID:4896
- C:\Windows\System\qjOGtDr.exe
  C:\Windows\System\qjOGtDr.exe
  2⤵
  PID:4912
- C:\Windows\System\eSkrWyQ.exe
  C:\Windows\System\eSkrWyQ.exe
  2⤵
  PID:4928
- C:\Windows\System\IYrHjdz.exe
  C:\Windows\System\IYrHjdz.exe
  2⤵
  PID:4944
- C:\Windows\System\tYSkycU.exe
  C:\Windows\System\tYSkycU.exe
  2⤵
  PID:4960
- C:\Windows\System\AMIwMHW.exe
  C:\Windows\System\AMIwMHW.exe
  2⤵
  PID:4976
- C:\Windows\System\ruYXFML.exe
  C:\Windows\System\ruYXFML.exe
  2⤵
  PID:4992
- C:\Windows\System\XSrMVJX.exe
  C:\Windows\System\XSrMVJX.exe
  2⤵
  PID:5008
- C:\Windows\System\KkbMZcs.exe
  C:\Windows\System\KkbMZcs.exe
  2⤵
  PID:5024
- C:\Windows\System\ccvyvHn.exe
  C:\Windows\System\ccvyvHn.exe
  2⤵
  PID:5040
- C:\Windows\System\Dmurxnz.exe
  C:\Windows\System\Dmurxnz.exe
  2⤵
  PID:5056
- C:\Windows\System\UuNzpJU.exe
  C:\Windows\System\UuNzpJU.exe
  2⤵
  PID:5072
- C:\Windows\System\EfJWiCt.exe
  C:\Windows\System\EfJWiCt.exe
  2⤵
  PID:5088
- C:\Windows\System\maFwcfR.exe
  C:\Windows\System\maFwcfR.exe
  2⤵
  PID:5104
- C:\Windows\System\NeIFOey.exe
  C:\Windows\System\NeIFOey.exe
  2⤵
  PID:3964
- C:\Windows\System\gDaGYyo.exe
  C:\Windows\System\gDaGYyo.exe
  2⤵
  PID:3448
- C:\Windows\System\RQXTLrY.exe
  C:\Windows\System\RQXTLrY.exe
  2⤵
  PID:2180
- C:\Windows\System\jVVCFQo.exe
  C:\Windows\System\jVVCFQo.exe
  2⤵
  PID:3096
- C:\Windows\System\qqwIffx.exe
  C:\Windows\System\qqwIffx.exe
  2⤵
  PID:3520
- C:\Windows\System\mffEzcP.exe
  C:\Windows\System\mffEzcP.exe
  2⤵
  PID:4056
- C:\Windows\System\pMCHAke.exe
  C:\Windows\System\pMCHAke.exe
  2⤵
  PID:3868
- C:\Windows\System\rAtCMIC.exe
  C:\Windows\System\rAtCMIC.exe
  2⤵
  PID:3808
- C:\Windows\System\HWaStmN.exe
  C:\Windows\System\HWaStmN.exe
  2⤵
  PID:1968
- C:\Windows\System\MjdcFwA.exe
  C:\Windows\System\MjdcFwA.exe
  2⤵
  PID:3696
- C:\Windows\System\jGxCcqU.exe
  C:\Windows\System\jGxCcqU.exe
  2⤵
  PID:3068
- C:\Windows\System\kGQcWqH.exe
  C:\Windows\System\kGQcWqH.exe
  2⤵
  PID:2888
- C:\Windows\System\bkbYQWd.exe
  C:\Windows\System\bkbYQWd.exe
  2⤵
  PID:2060
- C:\Windows\System\wolpFfh.exe
  C:\Windows\System\wolpFfh.exe
  2⤵
  PID:2804
- C:\Windows\System\avIMFZS.exe
  C:\Windows\System\avIMFZS.exe
  2⤵
  PID:4144
- C:\Windows\System\AIZlTAW.exe
  C:\Windows\System\AIZlTAW.exe
  2⤵
  PID:4212
- C:\Windows\System\XxbGdKL.exe
  C:\Windows\System\XxbGdKL.exe
  2⤵
  PID:4276
- C:\Windows\System\ZMLYYLb.exe
  C:\Windows\System\ZMLYYLb.exe
  2⤵
  PID:4340
- C:\Windows\System\LfbuMWv.exe
  C:\Windows\System\LfbuMWv.exe
  2⤵
  PID:3388
- C:\Windows\System\DyAxmOX.exe
  C:\Windows\System\DyAxmOX.exe
  2⤵
  PID:1072
- C:\Windows\System\wQzZSPH.exe
  C:\Windows\System\wQzZSPH.exe
  2⤵
  PID:1032
- C:\Windows\System\ybhpliw.exe
  C:\Windows\System\ybhpliw.exe
  2⤵
  PID:4160
- C:\Windows\System\drxFaHj.exe
  C:\Windows\System\drxFaHj.exe
  2⤵
  PID:4228
- C:\Windows\System\xBjchgw.exe
  C:\Windows\System\xBjchgw.exe
  2⤵
  PID:3612
- C:\Windows\System\vrWgAyl.exe
  C:\Windows\System\vrWgAyl.exe
  2⤵
  PID:2672
- C:\Windows\System\hcCJdIu.exe
  C:\Windows\System\hcCJdIu.exe
  2⤵
  PID:4404
- C:\Windows\System\hgDGJFD.exe
  C:\Windows\System\hgDGJFD.exe
  2⤵
  PID:4468
- C:\Windows\System\wYwIMRe.exe
  C:\Windows\System\wYwIMRe.exe
  2⤵
  PID:4532
- C:\Windows\System\oyLJPiE.exe
  C:\Windows\System\oyLJPiE.exe
  2⤵
  PID:4388
- C:\Windows\System\FlXgyfh.exe
  C:\Windows\System\FlXgyfh.exe
  2⤵
  PID:4424
- C:\Windows\System\ktmIXSU.exe
  C:\Windows\System\ktmIXSU.exe
  2⤵
  PID:3228
- C:\Windows\System\hgvCued.exe
  C:\Windows\System\hgvCued.exe
  2⤵
  PID:3676
- C:\Windows\System\VJNVCzb.exe
  C:\Windows\System\VJNVCzb.exe
  2⤵
  PID:4548
- C:\Windows\System\bWqpSQt.exe
  C:\Windows\System\bWqpSQt.exe
  2⤵
  PID:4984
- C:\Windows\System\zwoUkhF.exe
  C:\Windows\System\zwoUkhF.exe
  2⤵
  PID:4664
- C:\Windows\System\TYdvGDH.exe
  C:\Windows\System\TYdvGDH.exe
  2⤵
  PID:4728
- C:\Windows\System\yKlrCmp.exe
  C:\Windows\System\yKlrCmp.exe
  2⤵
  PID:4824
- C:\Windows\System\CmsKkiH.exe
  C:\Windows\System\CmsKkiH.exe
  2⤵
  PID:4892
- C:\Windows\System\cxugQpq.exe
  C:\Windows\System\cxugQpq.exe
  2⤵
  PID:4952
- C:\Windows\System\tAApswo.exe
  C:\Windows\System\tAApswo.exe
  2⤵
  PID:5020
- C:\Windows\System\hOYjaLG.exe
  C:\Windows\System\hOYjaLG.exe
  2⤵
  PID:5080
- C:\Windows\System\ErkpoOl.exe
  C:\Windows\System\ErkpoOl.exe
  2⤵
  PID:3040
- C:\Windows\System\nVNuzCj.exe
  C:\Windows\System\nVNuzCj.exe
  2⤵
  PID:4124
- C:\Windows\System\LQidvCa.exe
  C:\Windows\System\LQidvCa.exe
  2⤵
  PID:4128
- C:\Windows\System\TNrmZBs.exe
  C:\Windows\System\TNrmZBs.exe
  2⤵
  PID:4260
- C:\Windows\System\cVkAxHy.exe
  C:\Windows\System\cVkAxHy.exe
  2⤵
  PID:4580
- C:\Windows\System\ZxeXqhF.exe
  C:\Windows\System\ZxeXqhF.exe
  2⤵
  PID:4616
- C:\Windows\System\nhyGiux.exe
  C:\Windows\System\nhyGiux.exe
  2⤵
  PID:4744
- C:\Windows\System\AnazOba.exe
  C:\Windows\System\AnazOba.exe
  2⤵
  PID:4808
- C:\Windows\System\nFkayfJ.exe
  C:\Windows\System\nFkayfJ.exe
  2⤵
  PID:4940
- C:\Windows\System\CiuhIfp.exe
  C:\Windows\System\CiuhIfp.exe
  2⤵
  PID:5004
- C:\Windows\System\SlKQwmE.exe
  C:\Windows\System\SlKQwmE.exe
  2⤵
  PID:5068
- C:\Windows\System\DDQitiB.exe
  C:\Windows\System\DDQitiB.exe
  2⤵
  PID:5112
- C:\Windows\System\TlAeSQJ.exe
  C:\Windows\System\TlAeSQJ.exe
  2⤵
  PID:2184
- C:\Windows\System\KVlgSiy.exe
  C:\Windows\System\KVlgSiy.exe
  2⤵
  PID:3940
- C:\Windows\System\lrbGPnS.exe
  C:\Windows\System\lrbGPnS.exe
  2⤵
  PID:3272
- C:\Windows\System\oTFGBGt.exe
  C:\Windows\System\oTFGBGt.exe
  2⤵
  PID:3740
- C:\Windows\System\yNXuSfd.exe
  C:\Windows\System\yNXuSfd.exe
  2⤵
  PID:3716
- C:\Windows\System\ZsjrUvd.exe
  C:\Windows\System\ZsjrUvd.exe
  2⤵
  PID:1760
- C:\Windows\System\kRkOPgH.exe
  C:\Windows\System\kRkOPgH.exe
  2⤵
  PID:4308
- C:\Windows\System\MUHIxbq.exe
  C:\Windows\System\MUHIxbq.exe
  2⤵
  PID:3512
- C:\Windows\System\hnnYPIv.exe
  C:\Windows\System\hnnYPIv.exe
  2⤵
  PID:4112
- C:\Windows\System\VSIbzBa.exe
  C:\Windows\System\VSIbzBa.exe
  2⤵
  PID:4504
- C:\Windows\System\ANPPiMU.exe
  C:\Windows\System\ANPPiMU.exe
  2⤵
  PID:4600
- C:\Windows\System\YnMYidp.exe
  C:\Windows\System\YnMYidp.exe
  2⤵
  PID:4700
- C:\Windows\System\vXUdstr.exe
  C:\Windows\System\vXUdstr.exe
  2⤵
  PID:1624
- C:\Windows\System\gINwvbT.exe
  C:\Windows\System\gINwvbT.exe
  2⤵
  PID:3872
- C:\Windows\System\nSpJuQa.exe
  C:\Windows\System\nSpJuQa.exe
  2⤵
  PID:4844
- C:\Windows\System\xlSMnEP.exe
  C:\Windows\System\xlSMnEP.exe
  2⤵
  PID:4680
- C:\Windows\System\oTvprng.exe
  C:\Windows\System\oTvprng.exe
  2⤵
  PID:5036
- C:\Windows\System\fcSlXlY.exe
  C:\Windows\System\fcSlXlY.exe
  2⤵
  PID:3420
- C:\Windows\System\HfgGpoU.exe
  C:\Windows\System\HfgGpoU.exe
  2⤵
  PID:4180
- C:\Windows\System\FqRrZwv.exe
  C:\Windows\System\FqRrZwv.exe
  2⤵
  PID:4244
- C:\Windows\System\AxDFeem.exe
  C:\Windows\System\AxDFeem.exe
  2⤵
  PID:3460
- C:\Windows\System\FhLTxZb.exe
  C:\Windows\System\FhLTxZb.exe
  2⤵
  PID:4328
- C:\Windows\System\FiBmJuq.exe
  C:\Windows\System\FiBmJuq.exe
  2⤵
  PID:4564
- C:\Windows\System\oNHbqZh.exe
  C:\Windows\System\oNHbqZh.exe
  2⤵
  PID:4632
- C:\Windows\System\kbFrsRY.exe
  C:\Windows\System\kbFrsRY.exe
  2⤵
  PID:4488
- C:\Windows\System\iTTloSp.exe
  C:\Windows\System\iTTloSp.exe
  2⤵
  PID:5096
- C:\Windows\System\mDAsQBv.exe
  C:\Windows\System\mDAsQBv.exe
  2⤵
  PID:4716
- C:\Windows\System\EXBEVyM.exe
  C:\Windows\System\EXBEVyM.exe
  2⤵
  PID:4620
- C:\Windows\System\ZDRMOZZ.exe
  C:\Windows\System\ZDRMOZZ.exe
  2⤵
  PID:5000
- C:\Windows\System\jdjwkdS.exe
  C:\Windows\System\jdjwkdS.exe
  2⤵
  PID:3276
- C:\Windows\System\cBKyzLS.exe
  C:\Windows\System\cBKyzLS.exe
  2⤵
  PID:4000
- C:\Windows\System\frZQkew.exe
  C:\Windows\System\frZQkew.exe
  2⤵
  PID:3376
- C:\Windows\System\tHDbhKE.exe
  C:\Windows\System\tHDbhKE.exe
  2⤵
  PID:2040
- C:\Windows\System\BrXeqFN.exe
  C:\Windows\System\BrXeqFN.exe
  2⤵
  PID:5136
- C:\Windows\System\OYGkelZ.exe
  C:\Windows\System\OYGkelZ.exe
  2⤵
  PID:5152
- C:\Windows\System\ZBVOOaZ.exe
  C:\Windows\System\ZBVOOaZ.exe
  2⤵
  PID:5168
- C:\Windows\System\ZvXzAQq.exe
  C:\Windows\System\ZvXzAQq.exe
  2⤵
  PID:5184
- C:\Windows\System\IYzHaRK.exe
  C:\Windows\System\IYzHaRK.exe
  2⤵
  PID:5200
- C:\Windows\System\IEstEen.exe
  C:\Windows\System\IEstEen.exe
  2⤵
  PID:5216
- C:\Windows\System\RsWQgrR.exe
  C:\Windows\System\RsWQgrR.exe
  2⤵
  PID:5232
- C:\Windows\System\FcLlHVD.exe
  C:\Windows\System\FcLlHVD.exe
  2⤵
  PID:5248
- C:\Windows\System\WNCsKPD.exe
  C:\Windows\System\WNCsKPD.exe
  2⤵
  PID:5264
- C:\Windows\System\ihIefZQ.exe
  C:\Windows\System\ihIefZQ.exe
  2⤵
  PID:5280
- C:\Windows\System\DFARWyb.exe
  C:\Windows\System\DFARWyb.exe
  2⤵
  PID:5296
- C:\Windows\System\FwnBaLk.exe
  C:\Windows\System\FwnBaLk.exe
  2⤵
  PID:5312
- C:\Windows\System\YrRSYJi.exe
  C:\Windows\System\YrRSYJi.exe
  2⤵
  PID:5328
- C:\Windows\System\LVTZtlZ.exe
  C:\Windows\System\LVTZtlZ.exe
  2⤵
  PID:5344
- C:\Windows\System\EXmbliP.exe
  C:\Windows\System\EXmbliP.exe
  2⤵
  PID:5360
- C:\Windows\System\IaZapyt.exe
  C:\Windows\System\IaZapyt.exe
  2⤵
  PID:5376
- C:\Windows\System\FEKPfio.exe
  C:\Windows\System\FEKPfio.exe
  2⤵
  PID:5392
- C:\Windows\System\xtzrWAz.exe
  C:\Windows\System\xtzrWAz.exe
  2⤵
  PID:5408
- C:\Windows\System\PjdHYqO.exe
  C:\Windows\System\PjdHYqO.exe
  2⤵
  PID:5424
- C:\Windows\System\liTWQVe.exe
  C:\Windows\System\liTWQVe.exe
  2⤵
  PID:5440
- C:\Windows\System\JMgFsew.exe
  C:\Windows\System\JMgFsew.exe
  2⤵
  PID:5456
- C:\Windows\System\HzbcnCv.exe
  C:\Windows\System\HzbcnCv.exe
  2⤵
  PID:5472
- C:\Windows\System\ACYbgGO.exe
  C:\Windows\System\ACYbgGO.exe
  2⤵
  PID:5488
- C:\Windows\System\qGPKLAJ.exe
  C:\Windows\System\qGPKLAJ.exe
  2⤵
  PID:5504
- C:\Windows\System\yWTgDsD.exe
  C:\Windows\System\yWTgDsD.exe
  2⤵
  PID:5520
- C:\Windows\System\LibBVOV.exe
  C:\Windows\System\LibBVOV.exe
  2⤵
  PID:5536
- C:\Windows\System\QMkODjg.exe
  C:\Windows\System\QMkODjg.exe
  2⤵
  PID:5552
- C:\Windows\System\TqVsBtT.exe
  C:\Windows\System\TqVsBtT.exe
  2⤵
  PID:5568
- C:\Windows\System\mKxzMYf.exe
  C:\Windows\System\mKxzMYf.exe
  2⤵
  PID:5584
- C:\Windows\System\EGpYTYd.exe
  C:\Windows\System\EGpYTYd.exe
  2⤵
  PID:5600
- C:\Windows\System\VANFzHm.exe
  C:\Windows\System\VANFzHm.exe
  2⤵
  PID:5616
- C:\Windows\System\GCmqiNb.exe
  C:\Windows\System\GCmqiNb.exe
  2⤵
  PID:5632
- C:\Windows\System\RZfCSDl.exe
  C:\Windows\System\RZfCSDl.exe
  2⤵
  PID:5648
- C:\Windows\System\yebUxRZ.exe
  C:\Windows\System\yebUxRZ.exe
  2⤵
  PID:5664
- C:\Windows\System\SNVzBUE.exe
  C:\Windows\System\SNVzBUE.exe
  2⤵
  PID:5680
- C:\Windows\System\bmeTkhY.exe
  C:\Windows\System\bmeTkhY.exe
  2⤵
  PID:5696
- C:\Windows\System\MbvyicJ.exe
  C:\Windows\System\MbvyicJ.exe
  2⤵
  PID:5712
- C:\Windows\System\TYklglc.exe
  C:\Windows\System\TYklglc.exe
  2⤵
  PID:5728
- C:\Windows\System\xKCGYpE.exe
  C:\Windows\System\xKCGYpE.exe
  2⤵
  PID:5744
- C:\Windows\System\fIiFEtw.exe
  C:\Windows\System\fIiFEtw.exe
  2⤵
  PID:5760
- C:\Windows\System\IyurogI.exe
  C:\Windows\System\IyurogI.exe
  2⤵
  PID:5776
- C:\Windows\System\rYfvaKN.exe
  C:\Windows\System\rYfvaKN.exe
  2⤵
  PID:5792
- C:\Windows\System\AyCRNfa.exe
  C:\Windows\System\AyCRNfa.exe
  2⤵
  PID:5808
- C:\Windows\System\hBMjPoe.exe
  C:\Windows\System\hBMjPoe.exe
  2⤵
  PID:5824
- C:\Windows\System\rxniaBQ.exe
  C:\Windows\System\rxniaBQ.exe
  2⤵
  PID:5844
- C:\Windows\System\IDJunti.exe
  C:\Windows\System\IDJunti.exe
  2⤵
  PID:5860
- C:\Windows\System\loloFAQ.exe
  C:\Windows\System\loloFAQ.exe
  2⤵
  PID:5876
- C:\Windows\System\ajVQhLP.exe
  C:\Windows\System\ajVQhLP.exe
  2⤵
  PID:5892
- C:\Windows\System\rlxdyVj.exe
  C:\Windows\System\rlxdyVj.exe
  2⤵
  PID:5908
- C:\Windows\System\zsnTcBo.exe
  C:\Windows\System\zsnTcBo.exe
  2⤵
  PID:5924
- C:\Windows\System\RofXpSe.exe
  C:\Windows\System\RofXpSe.exe
  2⤵
  PID:5940
- C:\Windows\System\OpUAokR.exe
  C:\Windows\System\OpUAokR.exe
  2⤵
  PID:5956
- C:\Windows\System\EMvwUZJ.exe
  C:\Windows\System\EMvwUZJ.exe
  2⤵
  PID:5972
- C:\Windows\System\gzyyhmb.exe
  C:\Windows\System\gzyyhmb.exe
  2⤵
  PID:5988
- C:\Windows\System\QeNbeXl.exe
  C:\Windows\System\QeNbeXl.exe
  2⤵
  PID:6004
- C:\Windows\System\cNOahwq.exe
  C:\Windows\System\cNOahwq.exe
  2⤵
  PID:6020
- C:\Windows\System\VJlRuPe.exe
  C:\Windows\System\VJlRuPe.exe
  2⤵
  PID:6036
- C:\Windows\System\dmMvqEr.exe
  C:\Windows\System\dmMvqEr.exe
  2⤵
  PID:6052
- C:\Windows\System\AKzhqFO.exe
  C:\Windows\System\AKzhqFO.exe
  2⤵
  PID:6068
- C:\Windows\System\EaOYhPg.exe
  C:\Windows\System\EaOYhPg.exe
  2⤵
  PID:6084
- C:\Windows\System\xkMrQVs.exe
  C:\Windows\System\xkMrQVs.exe
  2⤵
  PID:6100
- C:\Windows\System\jDbSUzO.exe
  C:\Windows\System\jDbSUzO.exe
  2⤵
  PID:6116
- C:\Windows\System\nKFTFlE.exe
  C:\Windows\System\nKFTFlE.exe
  2⤵
  PID:6132
- C:\Windows\System\YoOxCov.exe
  C:\Windows\System\YoOxCov.exe
  2⤵
  PID:4856
- C:\Windows\System\jtxCCid.exe
  C:\Windows\System\jtxCCid.exe
  2⤵
  PID:4936
- C:\Windows\System\Mubxljy.exe
  C:\Windows\System\Mubxljy.exe
  2⤵
  PID:3320
- C:\Windows\System\EsPKAJK.exe
  C:\Windows\System\EsPKAJK.exe
  2⤵
  PID:4764
- C:\Windows\System\bEwvsPU.exe
  C:\Windows\System\bEwvsPU.exe
  2⤵
  PID:4780
- C:\Windows\System\InAosLw.exe
  C:\Windows\System\InAosLw.exe
  2⤵
  PID:3764
- C:\Windows\System\FxghlHV.exe
  C:\Windows\System\FxghlHV.exe
  2⤵
  PID:4440
- C:\Windows\System\DGNgcSc.exe
  C:\Windows\System\DGNgcSc.exe
  2⤵
  PID:5272
- C:\Windows\System\teFjLlw.exe
  C:\Windows\System\teFjLlw.exe
  2⤵
  PID:5340
- C:\Windows\System\aOSXNgY.exe
  C:\Windows\System\aOSXNgY.exe
  2⤵
  PID:5372
- C:\Windows\System\uuSrqud.exe
  C:\Windows\System\uuSrqud.exe
  2⤵
  PID:4044
- C:\Windows\System\fjuIREo.exe
  C:\Windows\System\fjuIREo.exe
  2⤵
  PID:4356
- C:\Windows\System\yAbARCc.exe
  C:\Windows\System\yAbARCc.exe
  2⤵
  PID:4200
- C:\Windows\System\BNuEZNg.exe
  C:\Windows\System\BNuEZNg.exe
  2⤵
  PID:5500
- C:\Windows\System\qoTJADj.exe
  C:\Windows\System\qoTJADj.exe
  2⤵
  PID:5628
- C:\Windows\System\pYLzScE.exe
  C:\Windows\System\pYLzScE.exe
  2⤵
  PID:4920
- C:\Windows\System\OlriQzS.exe
  C:\Windows\System\OlriQzS.exe
  2⤵
  PID:5656
- C:\Windows\System\AMBcOuv.exe
  C:\Windows\System\AMBcOuv.exe
  2⤵
  PID:5560
- C:\Windows\System\dvjCqOV.exe
  C:\Windows\System\dvjCqOV.exe
  2⤵
  PID:5692
- C:\Windows\System\QlwfSCz.exe
  C:\Windows\System\QlwfSCz.exe
  2⤵
  PID:5128
- C:\Windows\System\syCZLlQ.exe
  C:\Windows\System\syCZLlQ.exe
  2⤵
  PID:5752
- C:\Windows\System\UiNZRnP.exe
  C:\Windows\System\UiNZRnP.exe
  2⤵
  PID:5160
- C:\Windows\System\ynnSOeo.exe
  C:\Windows\System\ynnSOeo.exe
  2⤵
  PID:5224
- C:\Windows\System\QiXaWcL.exe
  C:\Windows\System\QiXaWcL.exe
  2⤵
  PID:5288
- C:\Windows\System\YSzlTyH.exe
  C:\Windows\System\YSzlTyH.exe
  2⤵
  PID:5352
- C:\Windows\System\mtqnHne.exe
  C:\Windows\System\mtqnHne.exe
  2⤵
  PID:5416
- C:\Windows\System\grVRPzl.exe
  C:\Windows\System\grVRPzl.exe
  2⤵
  PID:5480
- C:\Windows\System\TuNpwSS.exe
  C:\Windows\System\TuNpwSS.exe
  2⤵
  PID:5544
- C:\Windows\System\scCAsnr.exe
  C:\Windows\System\scCAsnr.exe
  2⤵
  PID:5816
- C:\Windows\System\hGoGmYp.exe
  C:\Windows\System\hGoGmYp.exe
  2⤵
  PID:5888
- C:\Windows\System\IQoUCOQ.exe
  C:\Windows\System\IQoUCOQ.exe
  2⤵
  PID:5608
- C:\Windows\System\CVSxOxS.exe
  C:\Windows\System\CVSxOxS.exe
  2⤵
  PID:5672
- C:\Windows\System\KyBLZkX.exe
  C:\Windows\System\KyBLZkX.exe
  2⤵
  PID:5736
- C:\Windows\System\XtlDToq.exe
  C:\Windows\System\XtlDToq.exe
  2⤵
  PID:5948
- C:\Windows\System\npJPhQH.exe
  C:\Windows\System\npJPhQH.exe
  2⤵
  PID:5856
- C:\Windows\System\qBVbBFT.exe
  C:\Windows\System\qBVbBFT.exe
  2⤵
  PID:6048
- C:\Windows\System\pIpbhKV.exe
  C:\Windows\System\pIpbhKV.exe
  2⤵
  PID:6112
- C:\Windows\System\LmtOFDV.exe
  C:\Windows\System\LmtOFDV.exe
  2⤵
  PID:1720
- C:\Windows\System\PEXikqn.exe
  C:\Windows\System\PEXikqn.exe
  2⤵
  PID:5832
- C:\Windows\System\OvugtFB.exe
  C:\Windows\System\OvugtFB.exe
  2⤵
  PID:2760
- C:\Windows\System\mkWbbIx.exe
  C:\Windows\System\mkWbbIx.exe
  2⤵
  PID:5336
- C:\Windows\System\BALZVTg.exe
  C:\Windows\System\BALZVTg.exe
  2⤵
  PID:5900
- C:\Windows\System\NXvMcGy.exe
  C:\Windows\System\NXvMcGy.exe
  2⤵
  PID:5968
- C:\Windows\System\LvExhZv.exe
  C:\Windows\System\LvExhZv.exe
  2⤵
  PID:6000
- C:\Windows\System\dQfnjrf.exe
  C:\Windows\System\dQfnjrf.exe
  2⤵
  PID:6092
- C:\Windows\System\aALcaBl.exe
  C:\Windows\System\aALcaBl.exe
  2⤵
  PID:4876
- C:\Windows\System\sjTKcEL.exe
  C:\Windows\System\sjTKcEL.exe
  2⤵
  PID:4456
- C:\Windows\System\cqRBtld.exe
  C:\Windows\System\cqRBtld.exe
  2⤵
  PID:4168
- C:\Windows\System\cOXmVtF.exe
  C:\Windows\System\cOXmVtF.exe
  2⤵
  PID:5240
- C:\Windows\System\pAwcRRe.exe
  C:\Windows\System\pAwcRRe.exe
  2⤵
  PID:5368
- C:\Windows\System\XWLUecs.exe
  C:\Windows\System\XWLUecs.exe
  2⤵
  PID:5496
- C:\Windows\System\rjQOZvK.exe
  C:\Windows\System\rjQOZvK.exe
  2⤵
  PID:5564
- C:\Windows\System\SiEXSZW.exe
  C:\Windows\System\SiEXSZW.exe
  2⤵
  PID:5720
- C:\Windows\System\WuVWZnb.exe
  C:\Windows\System\WuVWZnb.exe
  2⤵
  PID:5768
- C:\Windows\System\pWiVkqN.exe
  C:\Windows\System\pWiVkqN.exe
  2⤵
  PID:5384
- C:\Windows\System\ASEzkxE.exe
  C:\Windows\System\ASEzkxE.exe
  2⤵
  PID:5452
- C:\Windows\System\gvJtEFY.exe
  C:\Windows\System\gvJtEFY.exe
  2⤵
  PID:5884
- C:\Windows\System\mYCYlIX.exe
  C:\Windows\System\mYCYlIX.exe
  2⤵
  PID:5324
- C:\Windows\System\XJcHrsb.exe
  C:\Windows\System\XJcHrsb.exe
  2⤵
  PID:5708
- C:\Windows\System\lXsFTIt.exe
  C:\Windows\System\lXsFTIt.exe
  2⤵
  PID:5576
- C:\Windows\System\IEGWUQU.exe
  C:\Windows\System\IEGWUQU.exe
  2⤵
  PID:5920
- C:\Windows\System\KqqWpru.exe
  C:\Windows\System\KqqWpru.exe
  2⤵
  PID:1820
- C:\Windows\System\wFDVlrr.exe
  C:\Windows\System\wFDVlrr.exe
  2⤵
  PID:5308
- C:\Windows\System\vppsoTL.exe
  C:\Windows\System\vppsoTL.exe
  2⤵
  PID:6012
- C:\Windows\System\gQhEWba.exe
  C:\Windows\System\gQhEWba.exe
  2⤵
  PID:5872
- C:\Windows\System\YVGsXHO.exe
  C:\Windows\System\YVGsXHO.exe
  2⤵
  PID:6064
- C:\Windows\System\RtZSFwZ.exe
  C:\Windows\System\RtZSFwZ.exe
  2⤵
  PID:3476
- C:\Windows\System\BdrBeAM.exe
  C:\Windows\System\BdrBeAM.exe
  2⤵
  PID:4584
- C:\Windows\System\TvwqYOL.exe
  C:\Windows\System\TvwqYOL.exe
  2⤵
  PID:5468
- C:\Windows\System\vSaDdfF.exe
  C:\Windows\System\vSaDdfF.exe
  2⤵
  PID:4376
- C:\Windows\System\pJKfhTs.exe
  C:\Windows\System\pJKfhTs.exe
  2⤵
  PID:5256
- C:\Windows\System\sHNBueW.exe
  C:\Windows\System\sHNBueW.exe
  2⤵
  PID:2792
- C:\Windows\System\ZYbNUGE.exe
  C:\Windows\System\ZYbNUGE.exe
  2⤵
  PID:5644
- C:\Windows\System\RhspEVO.exe
  C:\Windows\System\RhspEVO.exe
  2⤵
  PID:5916
- C:\Windows\System\LfBckVd.exe
  C:\Windows\System\LfBckVd.exe
  2⤵
  PID:1744
- C:\Windows\System\JGoRtmX.exe
  C:\Windows\System\JGoRtmX.exe
  2⤵
  PID:5788
- C:\Windows\System\BKqRFUN.exe
  C:\Windows\System\BKqRFUN.exe
  2⤵
  PID:6124
- C:\Windows\System\jfcmtYc.exe
  C:\Windows\System\jfcmtYc.exe
  2⤵
  PID:4652
- C:\Windows\System\DwrkHRv.exe
  C:\Windows\System\DwrkHRv.exe
  2⤵
  PID:6148
- C:\Windows\System\joitVkQ.exe
  C:\Windows\System\joitVkQ.exe
  2⤵
  PID:6164
- C:\Windows\System\JdSsWiy.exe
  C:\Windows\System\JdSsWiy.exe
  2⤵
  PID:6180
- C:\Windows\System\KSSkOSs.exe
  C:\Windows\System\KSSkOSs.exe
  2⤵
  PID:6196
- C:\Windows\System\qMwVMGG.exe
  C:\Windows\System\qMwVMGG.exe
  2⤵
  PID:6212
- C:\Windows\System\LWvwBtu.exe
  C:\Windows\System\LWvwBtu.exe
  2⤵
  PID:6228
- C:\Windows\System\Bljybgv.exe
  C:\Windows\System\Bljybgv.exe
  2⤵
  PID:6244
- C:\Windows\System\mknNXqi.exe
  C:\Windows\System\mknNXqi.exe
  2⤵
  PID:6260
- C:\Windows\System\OJDKOOi.exe
  C:\Windows\System\OJDKOOi.exe
  2⤵
  PID:6276
- C:\Windows\System\leaYBIH.exe
  C:\Windows\System\leaYBIH.exe
  2⤵
  PID:6292
- C:\Windows\System\mCAABiI.exe
  C:\Windows\System\mCAABiI.exe
  2⤵
  PID:6308
- C:\Windows\System\YNgxMOC.exe
  C:\Windows\System\YNgxMOC.exe
  2⤵
  PID:6324
- C:\Windows\System\cnRdXuw.exe
  C:\Windows\System\cnRdXuw.exe
  2⤵
  PID:6340
- C:\Windows\System\XCKdsku.exe
  C:\Windows\System\XCKdsku.exe
  2⤵
  PID:6356
- C:\Windows\System\nBinbkf.exe
  C:\Windows\System\nBinbkf.exe
  2⤵
  PID:6372
- C:\Windows\System\guBuHMm.exe
  C:\Windows\System\guBuHMm.exe
  2⤵
  PID:6388
- C:\Windows\System\ujttxoM.exe
  C:\Windows\System\ujttxoM.exe
  2⤵
  PID:6404
- C:\Windows\System\YhZKkqN.exe
  C:\Windows\System\YhZKkqN.exe
  2⤵
  PID:6420
- C:\Windows\System\VaawBED.exe
  C:\Windows\System\VaawBED.exe
  2⤵
  PID:6436
- C:\Windows\System\jfhrfxH.exe
  C:\Windows\System\jfhrfxH.exe
  2⤵
  PID:6452
- C:\Windows\System\BjPHmuY.exe
  C:\Windows\System\BjPHmuY.exe
  2⤵
  PID:6468
- C:\Windows\System\djPtmiA.exe
  C:\Windows\System\djPtmiA.exe
  2⤵
  PID:6484
- C:\Windows\System\qHGlXHG.exe
  C:\Windows\System\qHGlXHG.exe
  2⤵
  PID:6500
- C:\Windows\System\HdcHDnf.exe
  C:\Windows\System\HdcHDnf.exe
  2⤵
  PID:6516
- C:\Windows\System\uaNupOX.exe
  C:\Windows\System\uaNupOX.exe
  2⤵
  PID:6532
- C:\Windows\System\ssfTDqp.exe
  C:\Windows\System\ssfTDqp.exe
  2⤵
  PID:6548
- C:\Windows\System\srkeTkt.exe
  C:\Windows\System\srkeTkt.exe
  2⤵
  PID:6564
- C:\Windows\System\VILuOFA.exe
  C:\Windows\System\VILuOFA.exe
  2⤵
  PID:6580
- C:\Windows\System\YdhBBzq.exe
  C:\Windows\System\YdhBBzq.exe
  2⤵
  PID:6596
- C:\Windows\System\VZlsxuG.exe
  C:\Windows\System\VZlsxuG.exe
  2⤵
  PID:6612
- C:\Windows\System\ncSiYNo.exe
  C:\Windows\System\ncSiYNo.exe
  2⤵
  PID:6628
- C:\Windows\System\GUATNGo.exe
  C:\Windows\System\GUATNGo.exe
  2⤵
  PID:6644
- C:\Windows\System\eAYgFQp.exe
  C:\Windows\System\eAYgFQp.exe
  2⤵
  PID:6660
- C:\Windows\System\okqzvnN.exe
  C:\Windows\System\okqzvnN.exe
  2⤵
  PID:6676
- C:\Windows\System\jxnCDZD.exe
  C:\Windows\System\jxnCDZD.exe
  2⤵
  PID:6696
- C:\Windows\System\RVldQgL.exe
  C:\Windows\System\RVldQgL.exe
  2⤵
  PID:6712
- C:\Windows\System\srxdtBb.exe
  C:\Windows\System\srxdtBb.exe
  2⤵
  PID:6728
- C:\Windows\System\TAUfVnL.exe
  C:\Windows\System\TAUfVnL.exe
  2⤵
  PID:6744
- C:\Windows\System\RRnUIqr.exe
  C:\Windows\System\RRnUIqr.exe
  2⤵
  PID:6760
- C:\Windows\System\VYDBRHT.exe
  C:\Windows\System\VYDBRHT.exe
  2⤵
  PID:6776
- C:\Windows\System\UPxCQZg.exe
  C:\Windows\System\UPxCQZg.exe
  2⤵
  PID:6792
- C:\Windows\System\ZyoUEKu.exe
  C:\Windows\System\ZyoUEKu.exe
  2⤵
  PID:6808
- C:\Windows\System\xdAoZkA.exe
  C:\Windows\System\xdAoZkA.exe
  2⤵
  PID:6824
- C:\Windows\System\YWeChEG.exe
  C:\Windows\System\YWeChEG.exe
  2⤵
  PID:6840
- C:\Windows\System\SDivmuq.exe
  C:\Windows\System\SDivmuq.exe
  2⤵
  PID:6856
- C:\Windows\System\NKXfgex.exe
  C:\Windows\System\NKXfgex.exe
  2⤵
  PID:6872
- C:\Windows\System\erpaHRZ.exe
  C:\Windows\System\erpaHRZ.exe
  2⤵
  PID:6888
- C:\Windows\System\vrBmcDW.exe
  C:\Windows\System\vrBmcDW.exe
  2⤵
  PID:6904
- C:\Windows\System\XWOGuOW.exe
  C:\Windows\System\XWOGuOW.exe
  2⤵
  PID:6920
- C:\Windows\System\qqvEIyi.exe
  C:\Windows\System\qqvEIyi.exe
  2⤵
  PID:6936
- C:\Windows\System\Xcmcgpn.exe
  C:\Windows\System\Xcmcgpn.exe
  2⤵
  PID:6952
- C:\Windows\System\naSNLzt.exe
  C:\Windows\System\naSNLzt.exe
  2⤵
  PID:6968
- C:\Windows\System\vXTQQKU.exe
  C:\Windows\System\vXTQQKU.exe
  2⤵
  PID:6984
- C:\Windows\System\xsvfUTM.exe
  C:\Windows\System\xsvfUTM.exe
  2⤵
  PID:7000
- C:\Windows\System\FIjEUZD.exe
  C:\Windows\System\FIjEUZD.exe
  2⤵
  PID:7016
- C:\Windows\System\TBmGkMN.exe
  C:\Windows\System\TBmGkMN.exe
  2⤵
  PID:7032
- C:\Windows\System\TeURers.exe
  C:\Windows\System\TeURers.exe
  2⤵
  PID:7048
- C:\Windows\System\uPGqioQ.exe
  C:\Windows\System\uPGqioQ.exe
  2⤵
  PID:7064
- C:\Windows\System\einMINU.exe
  C:\Windows\System\einMINU.exe
  2⤵
  PID:7080
- C:\Windows\System\Vtuxrdp.exe
  C:\Windows\System\Vtuxrdp.exe
  2⤵
  PID:7096
- C:\Windows\System\MvhxrdM.exe
  C:\Windows\System\MvhxrdM.exe
  2⤵
  PID:7112
- C:\Windows\System\lfkBVDK.exe
  C:\Windows\System\lfkBVDK.exe
  2⤵
  PID:7128
- C:\Windows\System\SikNSGk.exe
  C:\Windows\System\SikNSGk.exe
  2⤵
  PID:7144
- C:\Windows\System\YELGzEP.exe
  C:\Windows\System\YELGzEP.exe
  2⤵
  PID:7160
- C:\Windows\System\dmKOSaT.exe
  C:\Windows\System\dmKOSaT.exe
  2⤵
  PID:1800
- C:\Windows\System\RMGLfmn.exe
  C:\Windows\System\RMGLfmn.exe
  2⤵
  PID:5192
- C:\Windows\System\HbitxeV.exe
  C:\Windows\System\HbitxeV.exe
  2⤵
  PID:2732
- C:\Windows\System\lRHnBBF.exe
  C:\Windows\System\lRHnBBF.exe
  2⤵
  PID:2832
- C:\Windows\System\uxmdgrX.exe
  C:\Windows\System\uxmdgrX.exe
  2⤵
  PID:6236
- C:\Windows\System\tUYpfzO.exe
  C:\Windows\System\tUYpfzO.exe
  2⤵
  PID:6304
- C:\Windows\System\VMkuLrL.exe
  C:\Windows\System\VMkuLrL.exe
  2⤵
  PID:2968
- C:\Windows\System\NlFivbI.exe
  C:\Windows\System\NlFivbI.exe
  2⤵
  PID:6364
- C:\Windows\System\woBVype.exe
  C:\Windows\System\woBVype.exe
  2⤵
  PID:6400
- C:\Windows\System\ZOfUahT.exe
  C:\Windows\System\ZOfUahT.exe
  2⤵
  PID:844
- C:\Windows\System\wFuZlrE.exe
  C:\Windows\System\wFuZlrE.exe
  2⤵
  PID:5800
- C:\Windows\System\ALGiqoP.exe
  C:\Windows\System\ALGiqoP.exe
  2⤵
  PID:2476
- C:\Windows\System\xvhGxvz.exe
  C:\Windows\System\xvhGxvz.exe
  2⤵
  PID:6188
- C:\Windows\System\WDJlSTe.exe
  C:\Windows\System\WDJlSTe.exe
  2⤵
  PID:6464
- C:\Windows\System\xilBmFJ.exe
  C:\Windows\System\xilBmFJ.exe
  2⤵
  PID:1580
- C:\Windows\System\XJHfJna.exe
  C:\Windows\System\XJHfJna.exe
  2⤵
  PID:6556
- C:\Windows\System\fhaiwVZ.exe
  C:\Windows\System\fhaiwVZ.exe
  2⤵
  PID:6592
- C:\Windows\System\SxVHMnX.exe
  C:\Windows\System\SxVHMnX.exe
  2⤵
  PID:6624
- C:\Windows\System\RSLKEem.exe
  C:\Windows\System\RSLKEem.exe
  2⤵
  PID:6684
- C:\Windows\System\lrpCPZW.exe
  C:\Windows\System\lrpCPZW.exe
  2⤵
  PID:6320
- C:\Windows\System\XsejewR.exe
  C:\Windows\System\XsejewR.exe
  2⤵
  PID:6384
- C:\Windows\System\eTcuizG.exe
  C:\Windows\System\eTcuizG.exe
  2⤵
  PID:6416
- C:\Windows\System\dxXaFEh.exe
  C:\Windows\System\dxXaFEh.exe
  2⤵
  PID:6480
- C:\Windows\System\XoMwTtZ.exe
  C:\Windows\System\XoMwTtZ.exe
  2⤵
  PID:6544
- C:\Windows\System\TGbcWGg.exe
  C:\Windows\System\TGbcWGg.exe
  2⤵
  PID:6576
- C:\Windows\System\aRFqMJU.exe
  C:\Windows\System\aRFqMJU.exe
  2⤵
  PID:6752
- C:\Windows\System\KvitqCw.exe
  C:\Windows\System\KvitqCw.exe
  2⤵
  PID:6704
- C:\Windows\System\idONXXO.exe
  C:\Windows\System\idONXXO.exe
  2⤵
  PID:6708
- C:\Windows\System\TLUjTvR.exe
  C:\Windows\System\TLUjTvR.exe
  2⤵
  PID:6772
- C:\Windows\System\IVBNpIO.exe
  C:\Windows\System\IVBNpIO.exe
  2⤵
  PID:6820
- C:\Windows\System\fXovUvX.exe
  C:\Windows\System\fXovUvX.exe
  2⤵
  PID:6848
- C:\Windows\System\RnuvyFX.exe
  C:\Windows\System\RnuvyFX.exe
  2⤵
  PID:6864
- C:\Windows\System\yDBhOXw.exe
  C:\Windows\System\yDBhOXw.exe
  2⤵
  PID:1224
- C:\Windows\System\oqENnbT.exe
  C:\Windows\System\oqENnbT.exe
  2⤵
  PID:592
- C:\Windows\System\WYQuDir.exe
  C:\Windows\System\WYQuDir.exe
  2⤵
  PID:7008
- C:\Windows\System\QLdVUQh.exe
  C:\Windows\System\QLdVUQh.exe
  2⤵
  PID:6980
- C:\Windows\System\wPsgijx.exe
  C:\Windows\System\wPsgijx.exe
  2⤵
  PID:6992
- C:\Windows\System\trPKCUS.exe
  C:\Windows\System\trPKCUS.exe
  2⤵
  PID:7056
- C:\Windows\System\mGWjhny.exe
  C:\Windows\System\mGWjhny.exe
  2⤵
  PID:7072
- C:\Windows\System\LlyYSsm.exe
  C:\Windows\System\LlyYSsm.exe
  2⤵
  PID:7108
- C:\Windows\System\ixDbUAA.exe
  C:\Windows\System\ixDbUAA.exe
  2⤵
  PID:7140
- C:\Windows\System\CZKGvkD.exe
  C:\Windows\System\CZKGvkD.exe
  2⤵
  PID:1140
- C:\Windows\System\NyhBNEI.exe
  C:\Windows\System\NyhBNEI.exe
  2⤵
  PID:6208
- C:\Windows\System\hoJScUC.exe
  C:\Windows\System\hoJScUC.exe
  2⤵
  PID:6332
- C:\Windows\System\pBpEzib.exe
  C:\Windows\System\pBpEzib.exe
  2⤵
  PID:2644
- C:\Windows\System\DCSgppa.exe
  C:\Windows\System\DCSgppa.exe
  2⤵
  PID:6160
- C:\Windows\System\LfYtbCz.exe
  C:\Windows\System\LfYtbCz.exe
  2⤵
  PID:352
- C:\Windows\System\BURLBka.exe
  C:\Windows\System\BURLBka.exe
  2⤵
  PID:6656
- C:\Windows\System\dkoOjBZ.exe
  C:\Windows\System\dkoOjBZ.exe
  2⤵
  PID:6336
- C:\Windows\System\yUByzif.exe
  C:\Windows\System\yUByzif.exe
  2⤵
  PID:7156
- C:\Windows\System\vMBsIrT.exe
  C:\Windows\System\vMBsIrT.exe
  2⤵
  PID:6108
- C:\Windows\System\IkSNIPU.exe
  C:\Windows\System\IkSNIPU.exe
  2⤵
  PID:6572
- C:\Windows\System\AEbTNJK.exe
  C:\Windows\System\AEbTNJK.exe
  2⤵
  PID:6768
- C:\Windows\System\nwuvnFI.exe
  C:\Windows\System\nwuvnFI.exe
  2⤵
  PID:6880
- C:\Windows\System\NiNwQMQ.exe
  C:\Windows\System\NiNwQMQ.exe
  2⤵
  PID:6272
- C:\Windows\System\TDvlEGY.exe
  C:\Windows\System\TDvlEGY.exe
  2⤵
  PID:6016
- C:\Windows\System\zItlfjN.exe
  C:\Windows\System\zItlfjN.exe
  2⤵
  PID:6976
- C:\Windows\System\ksZEgIJ.exe
  C:\Windows\System\ksZEgIJ.exe
  2⤵
  PID:5836
- C:\Windows\System\GPkoSmW.exe
  C:\Windows\System\GPkoSmW.exe
  2⤵
  PID:2840
- C:\Windows\System\robjqxN.exe
  C:\Windows\System\robjqxN.exe
  2⤵
  PID:6928
- C:\Windows\System\RiWgpXT.exe
  C:\Windows\System\RiWgpXT.exe
  2⤵
  PID:7044
- C:\Windows\System\ASgTZAW.exe
  C:\Windows\System\ASgTZAW.exe
  2⤵
  PID:7028
- C:\Windows\System\pfhEuMf.exe
  C:\Windows\System\pfhEuMf.exe
  2⤵
  PID:6288
- C:\Windows\System\VtIOvWt.exe
  C:\Windows\System\VtIOvWt.exe
  2⤵
  PID:6496
- C:\Windows\System\HZULNPF.exe
  C:\Windows\System\HZULNPF.exe
  2⤵
  PID:1740
- C:\Windows\System\vTjiOxZ.exe
  C:\Windows\System\vTjiOxZ.exe
  2⤵
  PID:6788
- C:\Windows\System\OSPoGcr.exe
  C:\Windows\System\OSPoGcr.exe
  2⤵
  PID:7104
- C:\Windows\System\avnYIkY.exe
  C:\Windows\System\avnYIkY.exe
  2⤵
  PID:2604
- C:\Windows\System\PxaODOz.exe
  C:\Windows\System\PxaODOz.exe
  2⤵
  PID:6380
- C:\Windows\System\MPdYlVL.exe
  C:\Windows\System\MPdYlVL.exe
  2⤵
  PID:6476
- C:\Windows\System\nCkFDZJ.exe
  C:\Windows\System\nCkFDZJ.exe
  2⤵
  PID:6432
- C:\Windows\System\QDZkSth.exe
  C:\Windows\System\QDZkSth.exe
  2⤵
  PID:6740
- C:\Windows\System\ptvjybW.exe
  C:\Windows\System\ptvjybW.exe
  2⤵
  PID:6900
- C:\Windows\System\ylxwykF.exe
  C:\Windows\System\ylxwykF.exe
  2⤵
  PID:6300
- C:\Windows\System\vIhVAik.exe
  C:\Windows\System\vIhVAik.exe
  2⤵
  PID:2432
- C:\Windows\System\KirBrpe.exe
  C:\Windows\System\KirBrpe.exe
  2⤵
  PID:1768
- C:\Windows\System\OjnPZSg.exe
  C:\Windows\System\OjnPZSg.exe
  2⤵
  PID:6836
- C:\Windows\System\veHfzIk.exe
  C:\Windows\System\veHfzIk.exe
  2⤵
  PID:6688
- C:\Windows\System\dCveZhD.exe
  C:\Windows\System\dCveZhD.exe
  2⤵
  PID:6352
- C:\Windows\System\jMdAtXJ.exe
  C:\Windows\System\jMdAtXJ.exe
  2⤵
  PID:7176
- C:\Windows\System\FIOJTOb.exe
  C:\Windows\System\FIOJTOb.exe
  2⤵
  PID:7192
- C:\Windows\System\YUnZebo.exe
  C:\Windows\System\YUnZebo.exe
  2⤵
  PID:7208
- C:\Windows\System\lJWBRRI.exe
  C:\Windows\System\lJWBRRI.exe
  2⤵
  PID:7224
- C:\Windows\System\lBYfMZe.exe
  C:\Windows\System\lBYfMZe.exe
  2⤵
  PID:7240
- C:\Windows\System\YaDkEds.exe
  C:\Windows\System\YaDkEds.exe
  2⤵
  PID:7256
- C:\Windows\System\BXZmGHd.exe
  C:\Windows\System\BXZmGHd.exe
  2⤵
  PID:7272
- C:\Windows\System\jcWFXcI.exe
  C:\Windows\System\jcWFXcI.exe
  2⤵
  PID:7288
- C:\Windows\System\SSFSRgO.exe
  C:\Windows\System\SSFSRgO.exe
  2⤵
  PID:7304
- C:\Windows\System\KjLRrSi.exe
  C:\Windows\System\KjLRrSi.exe
  2⤵
  PID:7320
- C:\Windows\System\XREaLNe.exe
  C:\Windows\System\XREaLNe.exe
  2⤵
  PID:7336
- C:\Windows\System\VuupLdy.exe
  C:\Windows\System\VuupLdy.exe
  2⤵
  PID:7352
- C:\Windows\System\tkJfABw.exe
  C:\Windows\System\tkJfABw.exe
  2⤵
  PID:7368
- C:\Windows\System\ydEuUDb.exe
  C:\Windows\System\ydEuUDb.exe
  2⤵
  PID:7384
- C:\Windows\System\tOJxqoL.exe
  C:\Windows\System\tOJxqoL.exe
  2⤵
  PID:7400
- C:\Windows\System\pWQTUdz.exe
  C:\Windows\System\pWQTUdz.exe
  2⤵
  PID:7416
- C:\Windows\System\ZKpbhSp.exe
  C:\Windows\System\ZKpbhSp.exe
  2⤵
  PID:7432
- C:\Windows\System\YPodfeF.exe
  C:\Windows\System\YPodfeF.exe
  2⤵
  PID:7448
- C:\Windows\System\IHAkiNV.exe
  C:\Windows\System\IHAkiNV.exe
  2⤵
  PID:7464
- C:\Windows\System\AGeTOJv.exe
  C:\Windows\System\AGeTOJv.exe
  2⤵
  PID:7480
- C:\Windows\System\kDRgzOA.exe
  C:\Windows\System\kDRgzOA.exe
  2⤵
  PID:7496
- C:\Windows\System\lHUbiyn.exe
  C:\Windows\System\lHUbiyn.exe
  2⤵
  PID:7512
- C:\Windows\System\VHCNOgh.exe
  C:\Windows\System\VHCNOgh.exe
  2⤵
  PID:7528
- C:\Windows\System\wgfBgre.exe
  C:\Windows\System\wgfBgre.exe
  2⤵
  PID:7544
- C:\Windows\System\iyDcarZ.exe
  C:\Windows\System\iyDcarZ.exe
  2⤵
  PID:7560
- C:\Windows\System\ZYkdkKJ.exe
  C:\Windows\System\ZYkdkKJ.exe
  2⤵
  PID:7576
- C:\Windows\System\SIUALIz.exe
  C:\Windows\System\SIUALIz.exe
  2⤵
  PID:7592
- C:\Windows\System\SXLeGqf.exe
  C:\Windows\System\SXLeGqf.exe
  2⤵
  PID:7608
- C:\Windows\System\gpfxzzv.exe
  C:\Windows\System\gpfxzzv.exe
  2⤵
  PID:7628
- C:\Windows\System\ciSGyXc.exe
  C:\Windows\System\ciSGyXc.exe
  2⤵
  PID:7644
- C:\Windows\System\nIsrCeU.exe
  C:\Windows\System\nIsrCeU.exe
  2⤵
  PID:7660
- C:\Windows\System\iSJvuDa.exe
  C:\Windows\System\iSJvuDa.exe
  2⤵
  PID:7676
- C:\Windows\System\iRTwpDF.exe
  C:\Windows\System\iRTwpDF.exe
  2⤵
  PID:7692
- C:\Windows\System\oEegccG.exe
  C:\Windows\System\oEegccG.exe
  2⤵
  PID:7708
- C:\Windows\System\CdFUopQ.exe
  C:\Windows\System\CdFUopQ.exe
  2⤵
  PID:7724
- C:\Windows\System\fboZScT.exe
  C:\Windows\System\fboZScT.exe
  2⤵
  PID:7740
- C:\Windows\System\XVsjYzQ.exe
  C:\Windows\System\XVsjYzQ.exe
  2⤵
  PID:7756
- C:\Windows\System\iZlyIeD.exe
  C:\Windows\System\iZlyIeD.exe
  2⤵
  PID:7772
- C:\Windows\System\HaUypHe.exe
  C:\Windows\System\HaUypHe.exe
  2⤵
  PID:7788
- C:\Windows\System\bCivAWC.exe
  C:\Windows\System\bCivAWC.exe
  2⤵
  PID:7804
- C:\Windows\System\yBgxczO.exe
  C:\Windows\System\yBgxczO.exe
  2⤵
  PID:7820
- C:\Windows\System\JcVvwSk.exe
  C:\Windows\System\JcVvwSk.exe
  2⤵
  PID:7836
- C:\Windows\System\RspqwxF.exe
  C:\Windows\System\RspqwxF.exe
  2⤵
  PID:7852
- C:\Windows\System\LUKwCAI.exe
  C:\Windows\System\LUKwCAI.exe
  2⤵
  PID:7868
- C:\Windows\System\sfntBMz.exe
  C:\Windows\System\sfntBMz.exe
  2⤵
  PID:7884
- C:\Windows\System\qqJDIbl.exe
  C:\Windows\System\qqJDIbl.exe
  2⤵
  PID:7900
- C:\Windows\System\MSLUONY.exe
  C:\Windows\System\MSLUONY.exe
  2⤵
  PID:7916
- C:\Windows\System\CRRluxY.exe
  C:\Windows\System\CRRluxY.exe
  2⤵
  PID:7932
- C:\Windows\System\HqGutdP.exe
  C:\Windows\System\HqGutdP.exe
  2⤵
  PID:7948
- C:\Windows\System\urlSIzA.exe
  C:\Windows\System\urlSIzA.exe
  2⤵
  PID:7964
- C:\Windows\System\FmtxERv.exe
  C:\Windows\System\FmtxERv.exe
  2⤵
  PID:7980
- C:\Windows\System\pMinWss.exe
  C:\Windows\System\pMinWss.exe
  2⤵
  PID:7996
- C:\Windows\System\CdroAHH.exe
  C:\Windows\System\CdroAHH.exe
  2⤵
  PID:8012
- C:\Windows\System\UNKnsjt.exe
  C:\Windows\System\UNKnsjt.exe
  2⤵
  PID:8028
- C:\Windows\System\pYxVYLh.exe
  C:\Windows\System\pYxVYLh.exe
  2⤵
  PID:8044
- C:\Windows\System\iZrXjzL.exe
  C:\Windows\System\iZrXjzL.exe
  2⤵
  PID:8060
- C:\Windows\System\nzuKWMp.exe
  C:\Windows\System\nzuKWMp.exe
  2⤵
  PID:8076
- C:\Windows\System\rLIDChU.exe
  C:\Windows\System\rLIDChU.exe
  2⤵
  PID:8092
- C:\Windows\System\LMksTBn.exe
  C:\Windows\System\LMksTBn.exe
  2⤵
  PID:8108
- C:\Windows\System\ljWuAnm.exe
  C:\Windows\System\ljWuAnm.exe
  2⤵
  PID:8124
- C:\Windows\System\ekmXYbl.exe
  C:\Windows\System\ekmXYbl.exe
  2⤵
  PID:8140
- C:\Windows\System\XGuVHKY.exe
  C:\Windows\System\XGuVHKY.exe
  2⤵
  PID:8156
- C:\Windows\System\qjVAIeb.exe
  C:\Windows\System\qjVAIeb.exe
  2⤵
  PID:8172
- C:\Windows\System\CPQtxWr.exe
  C:\Windows\System\CPQtxWr.exe
  2⤵
  PID:8188
- C:\Windows\System\nipJsBc.exe
  C:\Windows\System\nipJsBc.exe
  2⤵
  PID:7220
- C:\Windows\System\WMFvyuC.exe
  C:\Windows\System\WMFvyuC.exe
  2⤵
  PID:7284
- C:\Windows\System\OntTiAA.exe
  C:\Windows\System\OntTiAA.exe
  2⤵
  PID:7348
- C:\Windows\System\lEqQQKR.exe
  C:\Windows\System\lEqQQKR.exe
  2⤵
  PID:2828
- C:\Windows\System\LECyQJH.exe
  C:\Windows\System\LECyQJH.exe
  2⤵
  PID:7472
- C:\Windows\System\qPxlVfn.exe
  C:\Windows\System\qPxlVfn.exe
  2⤵
  PID:5448
- C:\Windows\System\aOREfmW.exe
  C:\Windows\System\aOREfmW.exe
  2⤵
  PID:7136
- C:\Windows\System\SIBnNAZ.exe
  C:\Windows\System\SIBnNAZ.exe
  2⤵
  PID:7640
- C:\Windows\System\CcAsBKK.exe
  C:\Windows\System\CcAsBKK.exe
  2⤵
  PID:7300
- C:\Windows\System\fKfJMtl.exe
  C:\Windows\System\fKfJMtl.exe
  2⤵
  PID:6412
- C:\Windows\System\ZQUvhHQ.exe
  C:\Windows\System\ZQUvhHQ.exe
  2⤵
  PID:7364
- C:\Windows\System\XwKpiir.exe
  C:\Windows\System\XwKpiir.exe
  2⤵
  PID:7456
- C:\Windows\System\PROwCug.exe
  C:\Windows\System\PROwCug.exe
  2⤵
  PID:7524
- C:\Windows\System\tWZZKKw.exe
  C:\Windows\System\tWZZKKw.exe
  2⤵
  PID:4588
- C:\Windows\System\xZzzaFR.exe
  C:\Windows\System\xZzzaFR.exe
  2⤵
  PID:7236
- C:\Windows\System\ZEUWtmo.exe
  C:\Windows\System\ZEUWtmo.exe
  2⤵
  PID:6816
- C:\Windows\System\gIZnSwW.exe
  C:\Windows\System\gIZnSwW.exe
  2⤵
  PID:6668
- C:\Windows\System\cpHwgUq.exe
  C:\Windows\System\cpHwgUq.exe
  2⤵
  PID:7688
- C:\Windows\System\UgxofJi.exe
  C:\Windows\System\UgxofJi.exe
  2⤵
  PID:7732
- C:\Windows\System\DURkvKu.exe
  C:\Windows\System\DURkvKu.exe
  2⤵
  PID:6224
- C:\Windows\System\vtMlPhw.exe
  C:\Windows\System\vtMlPhw.exe
  2⤵
  PID:7172
- C:\Windows\System\yLJmYwv.exe
  C:\Windows\System\yLJmYwv.exe
  2⤵
  PID:7624
- C:\Windows\System\AtrSDoe.exe
  C:\Windows\System\AtrSDoe.exe
  2⤵
  PID:7332
- C:\Windows\System\NkwGGrj.exe
  C:\Windows\System\NkwGGrj.exe
  2⤵
  PID:7748
- C:\Windows\System\FLUxnEH.exe
  C:\Windows\System\FLUxnEH.exe
  2⤵
  PID:7796
- C:\Windows\System\buhnscM.exe
  C:\Windows\System\buhnscM.exe
  2⤵
  PID:7860
- C:\Windows\System\TDAXWxC.exe
  C:\Windows\System\TDAXWxC.exe
  2⤵
  PID:7780
- C:\Windows\System\mwCneFR.exe
  C:\Windows\System\mwCneFR.exe
  2⤵
  PID:7812
- C:\Windows\System\xjluXHl.exe
  C:\Windows\System\xjluXHl.exe
  2⤵
  PID:7880
- C:\Windows\System\rLTJjqM.exe
  C:\Windows\System\rLTJjqM.exe
  2⤵
  PID:7924
- C:\Windows\System\dzNNcMk.exe
  C:\Windows\System\dzNNcMk.exe
  2⤵
  PID:7960
- C:\Windows\System\TmKPhXv.exe
  C:\Windows\System\TmKPhXv.exe
  2⤵
  PID:7944
- C:\Windows\System\wBFOrMD.exe
  C:\Windows\System\wBFOrMD.exe
  2⤵
  PID:8084
- C:\Windows\System\WtWlxeX.exe
  C:\Windows\System\WtWlxeX.exe
  2⤵
  PID:8180
- C:\Windows\System\rGqTAZg.exe
  C:\Windows\System\rGqTAZg.exe
  2⤵
  PID:7280
- C:\Windows\System\LJEyamm.exe
  C:\Windows\System\LJEyamm.exe
  2⤵
  PID:8004
- C:\Windows\System\MDeoxCW.exe
  C:\Windows\System\MDeoxCW.exe
  2⤵
  PID:7316
- C:\Windows\System\ECbVpBj.exe
  C:\Windows\System\ECbVpBj.exe
  2⤵
  PID:8008
- C:\Windows\System\pBWYQJN.exe
  C:\Windows\System\pBWYQJN.exe
  2⤵
  PID:8040
- C:\Windows\System\Dbvgood.exe
  C:\Windows\System\Dbvgood.exe
  2⤵
  PID:8132
- C:\Windows\System\eOPKllg.exe
  C:\Windows\System\eOPKllg.exe
  2⤵
  PID:7216
- C:\Windows\System\xaMohhs.exe
  C:\Windows\System\xaMohhs.exe
  2⤵
  PID:7604
- C:\Windows\System\HLNZWwI.exe
  C:\Windows\System\HLNZWwI.exe
  2⤵
  PID:7672
- C:\Windows\System\nEWVAEZ.exe
  C:\Windows\System\nEWVAEZ.exe
  2⤵
  PID:6316
- C:\Windows\System\bhaBRvt.exe
  C:\Windows\System\bhaBRvt.exe
  2⤵
  PID:2244
- C:\Windows\System\nxAeaYt.exe
  C:\Windows\System\nxAeaYt.exe
  2⤵
  PID:7736
- C:\Windows\System\PcJwCdz.exe
  C:\Windows\System\PcJwCdz.exe
  2⤵
  PID:7832
- C:\Windows\System\maBZHex.exe
  C:\Windows\System\maBZHex.exe
  2⤵
  PID:7620
- C:\Windows\System\ZykjZeM.exe
  C:\Windows\System\ZykjZeM.exe
  2⤵
  PID:7552
- C:\Windows\System\XpFvsco.exe
  C:\Windows\System\XpFvsco.exe
  2⤵
  PID:8148
- C:\Windows\System\bdsVrEI.exe
  C:\Windows\System\bdsVrEI.exe
  2⤵
  PID:7668
- C:\Windows\System\ctuqkyV.exe
  C:\Windows\System\ctuqkyV.exe
  2⤵
  PID:7764
- C:\Windows\System\MilbsVg.exe
  C:\Windows\System\MilbsVg.exe
  2⤵
  PID:7892
- C:\Windows\System\JlwtShP.exe
  C:\Windows\System\JlwtShP.exe
  2⤵
  PID:7584
- C:\Windows\System\hXYqDVk.exe
  C:\Windows\System\hXYqDVk.exe
  2⤵
  PID:7428
- C:\Windows\System\kehHfRD.exe
  C:\Windows\System\kehHfRD.exe
  2⤵
  PID:7656
- C:\Windows\System\iwBpZWJ.exe
  C:\Windows\System\iwBpZWJ.exe
  2⤵
  PID:7956
- C:\Windows\System\gYzKafv.exe
  C:\Windows\System\gYzKafv.exe
  2⤵
  PID:8120
- C:\Windows\System\saseXzA.exe
  C:\Windows\System\saseXzA.exe
  2⤵
  PID:7976
- C:\Windows\System\sNrwvVg.exe
  C:\Windows\System\sNrwvVg.exe
  2⤵
  PID:7328
- C:\Windows\System\cHFUOUS.exe
  C:\Windows\System\cHFUOUS.exe
  2⤵
  PID:7232
- C:\Windows\System\QVyMHTI.exe
  C:\Windows\System\QVyMHTI.exe
  2⤵
  PID:8020
- C:\Windows\System\bZyrGzX.exe
  C:\Windows\System\bZyrGzX.exe
  2⤵
  PID:8104
- C:\Windows\System\iikKIWo.exe
  C:\Windows\System\iikKIWo.exe
  2⤵
  PID:8056
- C:\Windows\System\KZqbxUJ.exe
  C:\Windows\System\KZqbxUJ.exe
  2⤵
  PID:6608
- C:\Windows\System\diXDGGi.exe
  C:\Windows\System\diXDGGi.exe
  2⤵
  PID:7784
- C:\Windows\System\gyQKoHM.exe
  C:\Windows\System\gyQKoHM.exe
  2⤵
  PID:2920
- C:\Windows\System\JfTgqBt.exe
  C:\Windows\System\JfTgqBt.exe
  2⤵
  PID:7828
- C:\Windows\System\vdTsRkl.exe
  C:\Windows\System\vdTsRkl.exe
  2⤵
  PID:7408
- C:\Windows\System\wrvPPmk.exe
  C:\Windows\System\wrvPPmk.exe
  2⤵
  PID:7188
- C:\Windows\System\xmApQeP.exe
  C:\Windows\System\xmApQeP.exe
  2⤵
  PID:7424
- C:\Windows\System\jajUQkf.exe
  C:\Windows\System\jajUQkf.exe
  2⤵
  PID:7848
- C:\Windows\System\uFfDfEJ.exe
  C:\Windows\System\uFfDfEJ.exe
  2⤵
  PID:7940
- C:\Windows\System\vjRUVXl.exe
  C:\Windows\System\vjRUVXl.exe
  2⤵
  PID:8168
- C:\Windows\System\fsJFMno.exe
  C:\Windows\System\fsJFMno.exe
  2⤵
  PID:2996
- C:\Windows\System\eDgGQds.exe
  C:\Windows\System\eDgGQds.exe
  2⤵
  PID:8204
- C:\Windows\System\brvzPnt.exe
  C:\Windows\System\brvzPnt.exe
  2⤵
  PID:8220
- C:\Windows\System\gDvxnyE.exe
  C:\Windows\System\gDvxnyE.exe
  2⤵
  PID:8236
- C:\Windows\System\SSVIWJx.exe
  C:\Windows\System\SSVIWJx.exe
  2⤵
  PID:8252
- C:\Windows\System\YznfpKz.exe
  C:\Windows\System\YznfpKz.exe
  2⤵
  PID:8268
- C:\Windows\System\oKvppYP.exe
  C:\Windows\System\oKvppYP.exe
  2⤵
  PID:8284
- C:\Windows\System\SQlhmmF.exe
  C:\Windows\System\SQlhmmF.exe
  2⤵
  PID:8300
- C:\Windows\System\tpKAOCb.exe
  C:\Windows\System\tpKAOCb.exe
  2⤵
  PID:8316
- C:\Windows\System\WlpiVQs.exe
  C:\Windows\System\WlpiVQs.exe
  2⤵
  PID:8332
- C:\Windows\System\oIqBnfO.exe
  C:\Windows\System\oIqBnfO.exe
  2⤵
  PID:8348
- C:\Windows\System\DnbTonu.exe
  C:\Windows\System\DnbTonu.exe
  2⤵
  PID:8364
- C:\Windows\System\htQRDbr.exe
  C:\Windows\System\htQRDbr.exe
  2⤵
  PID:8380
- C:\Windows\System\AqjZkOp.exe
  C:\Windows\System\AqjZkOp.exe
  2⤵
  PID:8396
- C:\Windows\System\sDfCDGU.exe
  C:\Windows\System\sDfCDGU.exe
  2⤵
  PID:8412
- C:\Windows\System\TJUXIaX.exe
  C:\Windows\System\TJUXIaX.exe
  2⤵
  PID:8428
- C:\Windows\System\UxcPLYM.exe
  C:\Windows\System\UxcPLYM.exe
  2⤵
  PID:8444
- C:\Windows\System\jcKGILy.exe
  C:\Windows\System\jcKGILy.exe
  2⤵
  PID:8460
- C:\Windows\System\JPhiqZA.exe
  C:\Windows\System\JPhiqZA.exe
  2⤵
  PID:8476
- C:\Windows\System\PoygTKP.exe
  C:\Windows\System\PoygTKP.exe
  2⤵
  PID:8492
- C:\Windows\System\tMquJVc.exe
  C:\Windows\System\tMquJVc.exe
  2⤵
  PID:8508
- C:\Windows\System\mTiGpqM.exe
  C:\Windows\System\mTiGpqM.exe
  2⤵
  PID:8524
- C:\Windows\System\SxdZSOo.exe
  C:\Windows\System\SxdZSOo.exe
  2⤵
  PID:8540
- C:\Windows\System\CsuFLoW.exe
  C:\Windows\System\CsuFLoW.exe
  2⤵
  PID:8556
- C:\Windows\System\DrkSpmj.exe
  C:\Windows\System\DrkSpmj.exe
  2⤵
  PID:8572
- C:\Windows\System\PMCQAVb.exe
  C:\Windows\System\PMCQAVb.exe
  2⤵
  PID:8588
- C:\Windows\System\HqGkuRs.exe
  C:\Windows\System\HqGkuRs.exe
  2⤵
  PID:8604
- C:\Windows\System\yuGyNie.exe
  C:\Windows\System\yuGyNie.exe
  2⤵
  PID:8620
- C:\Windows\System\lKqwbqZ.exe
  C:\Windows\System\lKqwbqZ.exe
  2⤵
  PID:8636
- C:\Windows\System\aeeYAJu.exe
  C:\Windows\System\aeeYAJu.exe
  2⤵
  PID:8652
- C:\Windows\System\rzDPMol.exe
  C:\Windows\System\rzDPMol.exe
  2⤵
  PID:8668
- C:\Windows\System\sNiEroA.exe
  C:\Windows\System\sNiEroA.exe
  2⤵
  PID:8684
- C:\Windows\System\pCXpCAu.exe
  C:\Windows\System\pCXpCAu.exe
  2⤵
  PID:8700
- C:\Windows\System\gMqyFNN.exe
  C:\Windows\System\gMqyFNN.exe
  2⤵
  PID:8716
- C:\Windows\System\XMZvUep.exe
  C:\Windows\System\XMZvUep.exe
  2⤵
  PID:8732
- C:\Windows\System\QvtqqbJ.exe
  C:\Windows\System\QvtqqbJ.exe
  2⤵
  PID:8748
- C:\Windows\System\PfyinhT.exe
  C:\Windows\System\PfyinhT.exe
  2⤵
  PID:8764
- C:\Windows\System\XwQcbvI.exe
  C:\Windows\System\XwQcbvI.exe
  2⤵
  PID:8780
- C:\Windows\System\ficpzQL.exe
  C:\Windows\System\ficpzQL.exe
  2⤵
  PID:8796
- C:\Windows\System\yiNUPzJ.exe
  C:\Windows\System\yiNUPzJ.exe
  2⤵
  PID:8812
- C:\Windows\System\ZEwpxAD.exe
  C:\Windows\System\ZEwpxAD.exe
  2⤵
  PID:8828
- C:\Windows\System\TLGCAIc.exe
  C:\Windows\System\TLGCAIc.exe
  2⤵
  PID:8844
- C:\Windows\System\ToeokLq.exe
  C:\Windows\System\ToeokLq.exe
  2⤵
  PID:8860
- C:\Windows\System\uoKPPRU.exe
  C:\Windows\System\uoKPPRU.exe
  2⤵
  PID:8876
- C:\Windows\System\rUapRuo.exe
  C:\Windows\System\rUapRuo.exe
  2⤵
  PID:8892
- C:\Windows\System\UcumcOn.exe
  C:\Windows\System\UcumcOn.exe
  2⤵
  PID:8908
- C:\Windows\System\VYkdmlX.exe
  C:\Windows\System\VYkdmlX.exe
  2⤵
  PID:8924
- C:\Windows\System\rFPvzBr.exe
  C:\Windows\System\rFPvzBr.exe
  2⤵
  PID:8940
- C:\Windows\System\BUtTprH.exe
  C:\Windows\System\BUtTprH.exe
  2⤵
  PID:8956
- C:\Windows\System\HDGfERB.exe
  C:\Windows\System\HDGfERB.exe
  2⤵
  PID:8972
- C:\Windows\System\grvHLAQ.exe
  C:\Windows\System\grvHLAQ.exe
  2⤵
  PID:8988
- C:\Windows\System\qLvsFbH.exe
  C:\Windows\System\qLvsFbH.exe
  2⤵
  PID:9004
- C:\Windows\System\mxelzss.exe
  C:\Windows\System\mxelzss.exe
  2⤵
  PID:9020
- C:\Windows\System\YGoDEFC.exe
  C:\Windows\System\YGoDEFC.exe
  2⤵
  PID:9036
- C:\Windows\System\KmhCfJm.exe
  C:\Windows\System\KmhCfJm.exe
  2⤵
  PID:9052
- C:\Windows\System\uSUuBGg.exe
  C:\Windows\System\uSUuBGg.exe
  2⤵
  PID:9068
- C:\Windows\System\XgxyhzS.exe
  C:\Windows\System\XgxyhzS.exe
  2⤵
  PID:9084
- C:\Windows\System\lxtshhk.exe
  C:\Windows\System\lxtshhk.exe
  2⤵
  PID:9100
- C:\Windows\System\trjZuDU.exe
  C:\Windows\System\trjZuDU.exe
  2⤵
  PID:9116
- C:\Windows\System\uXDeXfF.exe
  C:\Windows\System\uXDeXfF.exe
  2⤵
  PID:9132
- C:\Windows\System\msSNQFu.exe
  C:\Windows\System\msSNQFu.exe
  2⤵
  PID:9148
- C:\Windows\System\jawvqDC.exe
  C:\Windows\System\jawvqDC.exe
  2⤵
  PID:9164
- C:\Windows\System\fKoDHNH.exe
  C:\Windows\System\fKoDHNH.exe
  2⤵
  PID:9180
- C:\Windows\System\kVLpWia.exe
  C:\Windows\System\kVLpWia.exe
  2⤵
  PID:9200
- C:\Windows\System\SnULVkA.exe
  C:\Windows\System\SnULVkA.exe
  2⤵
  PID:8196
- C:\Windows\System\toLwrRD.exe
  C:\Windows\System\toLwrRD.exe
  2⤵
  PID:8260
- C:\Windows\System\hfHNVQz.exe
  C:\Windows\System\hfHNVQz.exe
  2⤵
  PID:9016
- C:\Windows\System\zvzueQM.exe
  C:\Windows\System\zvzueQM.exe
  2⤵
  PID:8420
- C:\Windows\System\GEBEXJJ.exe
  C:\Windows\System\GEBEXJJ.exe
  2⤵
  PID:8404
- C:\Windows\System\YEmzSLe.exe
  C:\Windows\System\YEmzSLe.exe
  2⤵
  PID:8488
- C:\Windows\System\IsJDDhi.exe
  C:\Windows\System\IsJDDhi.exe
  2⤵
  PID:8536
- C:\Windows\System\LtWkAwJ.exe
  C:\Windows\System\LtWkAwJ.exe
  2⤵
  PID:8568
- C:\Windows\System\hlddupC.exe
  C:\Windows\System\hlddupC.exe
  2⤵
  PID:8644
- C:\Windows\System\RGSQiUR.exe
  C:\Windows\System\RGSQiUR.exe
  2⤵
  PID:8856
- C:\Windows\System\bhrjTBY.exe
  C:\Windows\System\bhrjTBY.exe
  2⤵
  PID:9144
- C:\Windows\System\gSmHtLV.exe
  C:\Windows\System\gSmHtLV.exe
  2⤵
  PID:8356
- C:\Windows\System\fuIcQuq.exe
  C:\Windows\System\fuIcQuq.exe
  2⤵
  PID:8312
- C:\Windows\System\NhObLhd.exe
  C:\Windows\System\NhObLhd.exe
  2⤵
  PID:8484
- C:\Windows\System\PXPAxmg.exe
  C:\Windows\System\PXPAxmg.exe
  2⤵
  PID:8584
- C:\Windows\System\ZxnGFzw.exe
  C:\Windows\System\ZxnGFzw.exe
  2⤵
  PID:8840
- C:\Windows\System\WfePeFC.exe
  C:\Windows\System\WfePeFC.exe
  2⤵
  PID:8968
- C:\Windows\System\wYfEgBX.exe
  C:\Windows\System\wYfEgBX.exe
  2⤵
  PID:8660
- C:\Windows\System\awFxCwZ.exe
  C:\Windows\System\awFxCwZ.exe
  2⤵
  PID:8308
- C:\Windows\System\qwBjsMy.exe
  C:\Windows\System\qwBjsMy.exe
  2⤵
  PID:8216
- C:\Windows\System\bDVxDtq.exe
  C:\Windows\System\bDVxDtq.exe
  2⤵
  PID:7568
- C:\Windows\System\PixoZyP.exe
  C:\Windows\System\PixoZyP.exe
  2⤵
  PID:8328
- C:\Windows\System\sNCsMCE.exe
  C:\Windows\System\sNCsMCE.exe
  2⤵
  PID:9096
- C:\Windows\System\QVVDpxm.exe
  C:\Windows\System\QVVDpxm.exe
  2⤵
  PID:9188
- C:\Windows\System\PPvuUFp.exe
  C:\Windows\System\PPvuUFp.exe
  2⤵
  PID:8792
- C:\Windows\System\HiQXZGU.exe
  C:\Windows\System\HiQXZGU.exe
  2⤵
  PID:8248
- C:\Windows\System\ZwmWLIU.exe
  C:\Windows\System\ZwmWLIU.exe
  2⤵
  PID:9208
- C:\Windows\System\oSrTaAB.exe
  C:\Windows\System\oSrTaAB.exe
  2⤵
  PID:9108
- C:\Windows\System\bRCvxXa.exe
  C:\Windows\System\bRCvxXa.exe
  2⤵
  PID:8344
- C:\Windows\System\mfZLFKD.exe
  C:\Windows\System\mfZLFKD.exe
  2⤵
  PID:8712
- C:\Windows\System\DABdZmQ.exe
  C:\Windows\System\DABdZmQ.exe
  2⤵
  PID:8776
- C:\Windows\System\ETEWEOW.exe
  C:\Windows\System\ETEWEOW.exe
  2⤵
  PID:9092
- C:\Windows\System\MpCZVqP.exe
  C:\Windows\System\MpCZVqP.exe
  2⤵
  PID:8628
- C:\Windows\System\RUAAbdY.exe
  C:\Windows\System\RUAAbdY.exe
  2⤵
  PID:8468
- C:\Windows\System\WFWdEYh.exe
  C:\Windows\System\WFWdEYh.exe
  2⤵
  PID:9048
- C:\Windows\System\WpvjYPw.exe
  C:\Windows\System\WpvjYPw.exe
  2⤵
  PID:9172
- C:\Windows\System\WIuHXwU.exe
  C:\Windows\System\WIuHXwU.exe
  2⤵
  PID:8548
- C:\Windows\System\PbJZgnU.exe
  C:\Windows\System\PbJZgnU.exe
  2⤵
  PID:8532
- C:\Windows\System\JtFHcRq.exe
  C:\Windows\System\JtFHcRq.exe
  2⤵
  PID:8728
- C:\Windows\System\Ycvnznf.exe
  C:\Windows\System\Ycvnznf.exe
  2⤵
  PID:8324
- C:\Windows\System\sSurRFW.exe
  C:\Windows\System\sSurRFW.exe
  2⤵
  PID:8276
- C:\Windows\System\KPYHWhz.exe
  C:\Windows\System\KPYHWhz.exe
  2⤵
  PID:9060
- C:\Windows\System\pzTYkkl.exe
  C:\Windows\System\pzTYkkl.exe
  2⤵
  PID:8600
- C:\Windows\System\TDOjeqA.exe
  C:\Windows\System\TDOjeqA.exe
  2⤵
  PID:8372
- C:\Windows\System\CacKQKx.exe
  C:\Windows\System\CacKQKx.exe
  2⤵
  PID:8472
- C:\Windows\System\eEvfYzp.exe
  C:\Windows\System\eEvfYzp.exe
  2⤵
  PID:8724
- C:\Windows\System\woQlRal.exe
  C:\Windows\System\woQlRal.exe
  2⤵
  PID:9128
- C:\Windows\System\stxPfOg.exe
  C:\Windows\System\stxPfOg.exe
  2⤵
  PID:8888
- C:\Windows\System\OmriBgS.exe
  C:\Windows\System\OmriBgS.exe
  2⤵
  PID:8808
- C:\Windows\System\ydaWrzw.exe
  C:\Windows\System\ydaWrzw.exe
  2⤵
  PID:8772
- C:\Windows\System\nNpFBgv.exe
  C:\Windows\System\nNpFBgv.exe
  2⤵
  PID:8580
- C:\Windows\System\Pqpwefc.exe
  C:\Windows\System\Pqpwefc.exe
  2⤵
  PID:8936
- C:\Windows\System\QmtGxMC.exe
  C:\Windows\System\QmtGxMC.exe
  2⤵
  PID:9044
- C:\Windows\System\IomdEIm.exe
  C:\Windows\System\IomdEIm.exe
  2⤵
  PID:8916
- C:\Windows\System\iUUmEMh.exe
  C:\Windows\System\iUUmEMh.exe
  2⤵
  PID:8980
- C:\Windows\System\FjYUpZK.exe
  C:\Windows\System\FjYUpZK.exe
  2⤵
  PID:8744
- C:\Windows\System\JSLeXRc.exe
  C:\Windows\System\JSLeXRc.exe
  2⤵
  PID:8296
- C:\Windows\System\hvoVbfv.exe
  C:\Windows\System\hvoVbfv.exe
  2⤵
  PID:8676
- C:\Windows\System\qDbZPto.exe
  C:\Windows\System\qDbZPto.exe
  2⤵
  PID:8824
- C:\Windows\System\AjgBiSR.exe
  C:\Windows\System\AjgBiSR.exe
  2⤵
  PID:8408
- C:\Windows\System\dcLzRvV.exe
  C:\Windows\System\dcLzRvV.exe
  2⤵
  PID:9156
- C:\Windows\System\RkAFhmu.exe
  C:\Windows\System\RkAFhmu.exe
  2⤵
  PID:8244
- C:\Windows\System\LLmvaXI.exe
  C:\Windows\System\LLmvaXI.exe
  2⤵
  PID:9160
- C:\Windows\System\gRwQwIt.exe
  C:\Windows\System\gRwQwIt.exe
  2⤵
  PID:9224
- C:\Windows\System\ImfBdnr.exe
  C:\Windows\System\ImfBdnr.exe
  2⤵
  PID:9240
- C:\Windows\System\AyfGRve.exe
  C:\Windows\System\AyfGRve.exe
  2⤵
  PID:9260
- C:\Windows\System\FpGmzAL.exe
  C:\Windows\System\FpGmzAL.exe
  2⤵
  PID:9276
- C:\Windows\System\DzrrPTu.exe
  C:\Windows\System\DzrrPTu.exe
  2⤵
  PID:9292
- C:\Windows\System\QcVSAsz.exe
  C:\Windows\System\QcVSAsz.exe
  2⤵
  PID:9308
- C:\Windows\System\niryzDb.exe
  C:\Windows\System\niryzDb.exe
  2⤵
  PID:9324
- C:\Windows\System\QNxSScI.exe
  C:\Windows\System\QNxSScI.exe
  2⤵
  PID:9340
- C:\Windows\System\xIeyhdt.exe
  C:\Windows\System\xIeyhdt.exe
  2⤵
  PID:9356
- C:\Windows\System\CZpyhRM.exe
  C:\Windows\System\CZpyhRM.exe
  2⤵
  PID:9372
- C:\Windows\System\VfJHJtK.exe
  C:\Windows\System\VfJHJtK.exe
  2⤵
  PID:9388
- C:\Windows\System\cfrFzKM.exe
  C:\Windows\System\cfrFzKM.exe
  2⤵
  PID:9404
- C:\Windows\System\uBGpKKX.exe
  C:\Windows\System\uBGpKKX.exe
  2⤵
  PID:9420
- C:\Windows\System\sJLgxEy.exe
  C:\Windows\System\sJLgxEy.exe
  2⤵
  PID:9436
- C:\Windows\System\wioYpAN.exe
  C:\Windows\System\wioYpAN.exe
  2⤵
  PID:9452
- C:\Windows\System\HuEPJTD.exe
  C:\Windows\System\HuEPJTD.exe
  2⤵
  PID:9468
- C:\Windows\System\ZAgnpUZ.exe
  C:\Windows\System\ZAgnpUZ.exe
  2⤵
  PID:9484
- C:\Windows\System\TpVIPfu.exe
  C:\Windows\System\TpVIPfu.exe
  2⤵
  PID:9500
- C:\Windows\System\ZHGwmay.exe
  C:\Windows\System\ZHGwmay.exe
  2⤵
  PID:9516
- C:\Windows\System\CDLyOuS.exe
  C:\Windows\System\CDLyOuS.exe
  2⤵
  PID:9532
- C:\Windows\System\dMCMwYX.exe
  C:\Windows\System\dMCMwYX.exe
  2⤵
  PID:9548
- C:\Windows\System\zzEHdRl.exe
  C:\Windows\System\zzEHdRl.exe
  2⤵
  PID:9564
- C:\Windows\System\eDHQZID.exe
  C:\Windows\System\eDHQZID.exe
  2⤵
  PID:9580
- C:\Windows\System\iAUsMTD.exe
  C:\Windows\System\iAUsMTD.exe
  2⤵
  PID:9596
- C:\Windows\System\gvKoSaH.exe
  C:\Windows\System\gvKoSaH.exe
  2⤵
  PID:9612
- C:\Windows\System\wHEXemC.exe
  C:\Windows\System\wHEXemC.exe
  2⤵
  PID:9628
- C:\Windows\System\DnwiDVA.exe
  C:\Windows\System\DnwiDVA.exe
  2⤵
  PID:9652
- C:\Windows\System\UPlDEed.exe
  C:\Windows\System\UPlDEed.exe
  2⤵
  PID:9668
- C:\Windows\System\bawoyzi.exe
  C:\Windows\System\bawoyzi.exe
  2⤵
  PID:9684
- C:\Windows\System\IhUxYbc.exe
  C:\Windows\System\IhUxYbc.exe
  2⤵
  PID:9700
- C:\Windows\System\JNyYuXm.exe
  C:\Windows\System\JNyYuXm.exe
  2⤵
  PID:9716
- C:\Windows\System\flXQphL.exe
  C:\Windows\System\flXQphL.exe
  2⤵
  PID:9732
- C:\Windows\System\LxYbKAV.exe
  C:\Windows\System\LxYbKAV.exe
  2⤵
  PID:9748
- C:\Windows\System\KMLqRyb.exe
  C:\Windows\System\KMLqRyb.exe
  2⤵
  PID:9764
- C:\Windows\System\iTSzMxO.exe
  C:\Windows\System\iTSzMxO.exe
  2⤵
  PID:9780
- C:\Windows\System\LTfZgqH.exe
  C:\Windows\System\LTfZgqH.exe
  2⤵
  PID:9796
- C:\Windows\System\nTWdQqW.exe
  C:\Windows\System\nTWdQqW.exe
  2⤵
  PID:9812
- C:\Windows\System\vnZDkre.exe
  C:\Windows\System\vnZDkre.exe
  2⤵
  PID:9828
- C:\Windows\System\hlmBxDp.exe
  C:\Windows\System\hlmBxDp.exe
  2⤵
  PID:9844
- C:\Windows\System\TssSCjc.exe
  C:\Windows\System\TssSCjc.exe
  2⤵
  PID:9896
- C:\Windows\System\nHhUnqj.exe
  C:\Windows\System\nHhUnqj.exe
  2⤵
  PID:9912
- C:\Windows\System\bXwErwQ.exe
  C:\Windows\System\bXwErwQ.exe
  2⤵
  PID:9928
- C:\Windows\System\ZUjlaLt.exe
  C:\Windows\System\ZUjlaLt.exe
  2⤵
  PID:9944
- C:\Windows\System\pVbWcBV.exe
  C:\Windows\System\pVbWcBV.exe
  2⤵
  PID:9960
- C:\Windows\System\UGDeLBI.exe
  C:\Windows\System\UGDeLBI.exe
  2⤵
  PID:9976
- C:\Windows\System\QZsCXHU.exe
  C:\Windows\System\QZsCXHU.exe
  2⤵
  PID:9992
- C:\Windows\System\DOKHlwQ.exe
  C:\Windows\System\DOKHlwQ.exe
  2⤵
  PID:10008
- C:\Windows\System\gTepKAR.exe
  C:\Windows\System\gTepKAR.exe
  2⤵
  PID:10024
- C:\Windows\System\DmyGkfb.exe
  C:\Windows\System\DmyGkfb.exe
  2⤵
  PID:10040
- C:\Windows\System\UDzVbXt.exe
  C:\Windows\System\UDzVbXt.exe
  2⤵
  PID:10056
- C:\Windows\System\FerKguz.exe
  C:\Windows\System\FerKguz.exe
  2⤵
  PID:10072
- C:\Windows\System\HJlCnoj.exe
  C:\Windows\System\HJlCnoj.exe
  2⤵
  PID:10088
- C:\Windows\System\VXEYdml.exe
  C:\Windows\System\VXEYdml.exe
  2⤵
  PID:10104
- C:\Windows\System\zyjpfQC.exe
  C:\Windows\System\zyjpfQC.exe
  2⤵
  PID:10120
- C:\Windows\System\DAUfAve.exe
  C:\Windows\System\DAUfAve.exe
  2⤵
  PID:10136
- C:\Windows\System\mVoKkoU.exe
  C:\Windows\System\mVoKkoU.exe
  2⤵
  PID:10152
- C:\Windows\System\WawcZIa.exe
  C:\Windows\System\WawcZIa.exe
  2⤵
  PID:10168
- C:\Windows\System\sgmDcgZ.exe
  C:\Windows\System\sgmDcgZ.exe
  2⤵
  PID:10184
- C:\Windows\System\xsYfKPJ.exe
  C:\Windows\System\xsYfKPJ.exe
  2⤵
  PID:10200
- C:\Windows\System\othTALi.exe
  C:\Windows\System\othTALi.exe
  2⤵
  PID:10216
- C:\Windows\System\DfrdHrw.exe
  C:\Windows\System\DfrdHrw.exe
  2⤵
  PID:10232
- C:\Windows\System\fRTMbui.exe
  C:\Windows\System\fRTMbui.exe
  2⤵
  PID:9176
- C:\Windows\System\EbDmfsz.exe
  C:\Windows\System\EbDmfsz.exe
  2⤵
  PID:8900
- C:\Windows\System\HLQgPLt.exe
  C:\Windows\System\HLQgPLt.exe
  2⤵
  PID:9248
- C:\Windows\System\hTwXaFY.exe
  C:\Windows\System\hTwXaFY.exe
  2⤵
  PID:9288
- C:\Windows\System\SQclGUB.exe
  C:\Windows\System\SQclGUB.exe
  2⤵
  PID:9352
- C:\Windows\System\rPYdwDo.exe
  C:\Windows\System\rPYdwDo.exe
  2⤵
  PID:9412
- C:\Windows\System\bkwZgPj.exe
  C:\Windows\System\bkwZgPj.exe
  2⤵
  PID:9480
- C:\Windows\System\PTptOkA.exe
  C:\Windows\System\PTptOkA.exe
  2⤵
  PID:9556
- C:\Windows\System\cyEXtDV.exe
  C:\Windows\System\cyEXtDV.exe
  2⤵
  PID:9300
- C:\Windows\System\AiPXoqU.exe
  C:\Windows\System\AiPXoqU.exe
  2⤵
  PID:9364
- C:\Windows\System\AeSlYxy.exe
  C:\Windows\System\AeSlYxy.exe
  2⤵
  PID:9428
- C:\Windows\System\ehNTnuP.exe
  C:\Windows\System\ehNTnuP.exe
  2⤵
  PID:9608
- C:\Windows\System\msGwbHO.exe
  C:\Windows\System\msGwbHO.exe
  2⤵
  PID:9640
- C:\Windows\System\oHULeQd.exe
  C:\Windows\System\oHULeQd.exe
  2⤵
  PID:9836
- C:\Windows\System\nTWsXfd.exe
  C:\Windows\System\nTWsXfd.exe
  2⤵
  PID:9692
- C:\Windows\System\PrUXsSk.exe
  C:\Windows\System\PrUXsSk.exe
  2⤵
  PID:9760
- C:\Windows\System\faxYeGP.exe
  C:\Windows\System\faxYeGP.exe
  2⤵
  PID:9824
- C:\Windows\System\uoRTMie.exe
  C:\Windows\System\uoRTMie.exe
  2⤵
  PID:9868
- C:\Windows\System\WhOyHPp.exe
  C:\Windows\System\WhOyHPp.exe
  2⤵
  PID:9888
- C:\Windows\System\TchfWdM.exe
  C:\Windows\System\TchfWdM.exe
  2⤵
  PID:9940
- C:\Windows\System\sqZRiLC.exe
  C:\Windows\System\sqZRiLC.exe
  2⤵
  PID:10000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AAueQVg.exe

Filesize
2.9MB

MD5
2f31692ee93b7e190a805af2a0d7c4f3

SHA1
fa8262d89b5d73e01f8882a7dce1c0db65635d27

SHA256
cafd36971243c26f1b000bfaba15556890eb60d066e08032fbf9056c01208a19

SHA512
dc24022b07fd21d7aee7470206b2c41821239793f71b420b97a7f3f4358bc89f3b7f959c751f0aee4d4a6dab5f5d8fa523bd46cf69040d94d0bae92bd38d3cd0

Download Submit
C:\Windows\system\CwjWZqh.exe

Filesize
2.9MB

MD5
a84c0a01814009e2cdd53cbb7abaa4b8

SHA1
bc7853ae6549cae633b47085ebc4580ed9b85324

SHA256
fef6ca8ae71e18f663accc3a9a7ba77fe99613496e455115d7dbaa3f4f4defaf

SHA512
62f13f6cc5ec338222d228ddf9d32cb670077d300e17690acde30ece26f0b8e79b539d08f2cd09bb1ca762da02ff3780d9624a30a4b05ab5d69cc52cb8021fe5

Download Submit
C:\Windows\system\EIMwzdS.exe

Filesize
2.9MB

MD5
808201254894f5548cfcd537a10dc0bb

SHA1
238955d5b2c4d8bec133fcc09cecdb26832b9c10

SHA256
07d213ca6c1e9b1ddf5907ae99e15df3f6d5cf76e4f5618b59bba439f78f9634

SHA512
c728672c01818fb93dc3ef3358b068d82857e942999a5542c04c86b704e0ed7fd06d40dcc2d120670c10d2ad906b12c40d6f3ca22a8a0dc754541476e20ad8f9

Download Submit
C:\Windows\system\EIWhfVW.exe

Filesize
2.9MB

MD5
0f369902447364edee5a3e2b4a497f43

SHA1
0ce850e81a725c83d12b03957c802b5bf5f96d78

SHA256
e1f3fde0c00ee311003a6be06543136c32f52596346ad43e33c769aaa88d7d95

SHA512
fee6611feebcbb3d25685657b366a85362938c492cd655619baebfadaf15c19aea0a724267e30b3ecaa04d95a83ba395a9ee00806df92c0bbc1f311546d4a834

Download Submit
C:\Windows\system\FkDjRaf.exe

Filesize
2.9MB

MD5
301fbcdccea685e1c41d2652257130b3

SHA1
a0e8001a8932b22a64d1dc6b3595fa1662c556f6

SHA256
04ad4c41082becd09fb20d50260df9e30cc6d77472115021e4fcea7577a3f490

SHA512
ba455a99251a032a154c748ce74680ad12e5c7fc18e20fdbb3194a73a26d9a1c7d90d18aaa093ac281374a57f53cccf07c78b589acdcf5e4862afacfa74dbb09

Download Submit
C:\Windows\system\GEyfUUS.exe

Filesize
2.9MB

MD5
ba1832f4344b7e91f73baa6cc12aa6c6

SHA1
ebd15bd48fd5600a4ddf6ff1f25d981b0358da17

SHA256
027e795fa4f9851454abd5b0309e37622b2e872692de7c53dcc7a784a1d01a2b

SHA512
03ba61af17b6207035fe89d435f83f69900b47038d3bc83696291eca42cef0505e7f45e46c9e9d003cf212170d92a8e9e7b9082ecf85f17b40025a6d8bad6ccd

Download Submit
C:\Windows\system\HHjWDAM.exe

Filesize
2.9MB

MD5
2e529d053a418bcec921166056a7a72a

SHA1
140efea201216a6ff21365a0b6d6f65a7afc32be

SHA256
7a3306d70ce8d8bbde2be56bafcbbe25a18e4586937ea1fcc3d2a589017033e6

SHA512
d271217746f756332e40abde3db5397dbf51593dc25dd183d4014dc92b7d8cb0c858012803f4df66687ac109efe9bf0825b43d457ec02de8314db6c799aca6bf

Download Submit
C:\Windows\system\HitlOsd.exe

Filesize
2.9MB

MD5
b28c2ce333627add15b5066bf6579a21

SHA1
bd9c26021c297e09b36bb6e3593fa4f404cd0588

SHA256
edd14b176088e648407ad7c4591cbb3677a399f6aa442e8f0342c8e4853e949a

SHA512
a6fa6630306aab35fa908b25f5b55e9c6d9726c2326adc79015c6049c8b38991be9bde56114adfa3025bff61c17a7c7e759d6484b4eb6f4b6daec0ca41bde4bb

Download Submit
C:\Windows\system\ILAPrna.exe

Filesize
2.9MB

MD5
b0dff682a8350bb79a69bdbb761aa417

SHA1
de68ec845221932312a3474a51bac37de7eaeb3e

SHA256
66da65f645ef37c58e4410e04003c0504e416d2a99af071b409ae25a6de9e1c5

SHA512
24bbfddcd422266b6b4805212e7349f89600d3d57c4259b5a20fe2476375c0090169c7cc4b1b3a02e3e2ef585c487f0241067587e8b385441d906f19bff15cb6

Download Submit
C:\Windows\system\LKlMtmY.exe

Filesize
2.9MB

MD5
89e329ef428f56eb366218ab8d4f0ef6

SHA1
952ce26fd85c5452bf8bc29f251a55e3889b2c77

SHA256
89a1e7f01be45d3696d4a8c4e43e4cb042bd8a677acd2d4d8541cd7ff5fd6eee

SHA512
5d46b348094b97c11eb6d98eabb3e64f0afaec04c70c2b5e4e0a2658ae1d31ee1d8f78bdfc26bf00616cde3b6f59eedf7b19127a06554adc2f9c14761eab78ce

Download Submit
C:\Windows\system\OBKIriR.exe

Filesize
2.9MB

MD5
3491e3c5fcf9f54a2256206d4f8eb8e1

SHA1
03a028da518ebfe7255982fa414ef4480792d66b

SHA256
52f8bb5a4b525afa1bb74085b36771fa336651da903c744ad2cdef2a0cc6e7c7

SHA512
26e22c3a4898f89e6a6e7029d548a8b2b84645348f52872b206b0358f1f5df4ff1214cbecb203c38dc8ec83983dd9f1cdd642927f704be62ee7f7b069d616dd4

Download Submit
C:\Windows\system\URgFlVI.exe

Filesize
2.9MB

MD5
50bc5b71f55c15d340fd61c299fb4f95

SHA1
f6b8431b08abdbc6d9b99666a0979f84046faa84

SHA256
24e555a53c71182d107be68bfd6046535a5f72fbe881e64b19437e1f4167bed3

SHA512
ca15fe3edd8f127a1d8c49d5b217e0990ee6c3c15dbc24c11241fc4321d3351dafccab29ebf15a426eb3c1b1590f35c456c18f10ca23155341a8c4841ca58306

Download Submit
C:\Windows\system\ZdYUXZl.exe

Filesize
2.9MB

MD5
5b9f9668d034c179d414896e7f13176b

SHA1
d22eb21a9c588b70d4347219c5773cf3f82813d5

SHA256
33a62f05a1b4d2b07ddb51d1d98db84022fc10ce651595e57a9857cb904cdc6f

SHA512
cb65f19afd214cf6c2cd50c4292a77c8435bcf68bee8dd9aafb46a64cde35214b8eb43a6456e2a80092ba7d9c69396f724fcb5bd472a5bc9b6d466a6eb474d0b

Download Submit
C:\Windows\system\cHJvBFw.exe

Filesize
2.9MB

MD5
f7cb88957461c2823629a87f141303d1

SHA1
20369ab2b78af06e42c7a67600eb0a18db760f7c

SHA256
ffd07f9982bfe5b015d70174c1a4d447b906e5a42e0a6b7306777c5d4a506084

SHA512
a0000f139e01af54a435b354115d0bfdece912fba0f1a165ef95ef86dd5d552b5747bb8a3ebb25e928119f40928e756bbad7d111e2a7e24ecc644c1deedc0c88

Download Submit
C:\Windows\system\dbEacxN.exe

Filesize
2.9MB

MD5
bf978e0d14e4ebfdddf0bf87cea1957a

SHA1
191ab7cffcbe4e1f1c6846763413a62f193eeaf8

SHA256
69688866ed72525d678f54497b9768746d062cdf39c2d0d8456f7e662ad71db1

SHA512
797126720da26ec3dc4ae27ef06f7f5c0adb939155d99aea130b9e62b3601eaba21b6afccd1499d7d91c2179169099e09df8f762f44838c65ba88cccb9718f4d

Download Submit
C:\Windows\system\eONJwXj.exe

Filesize
2.9MB

MD5
2a5fa2910d9a67b415f30f6dc0d477c2

SHA1
cbfed478c100a10b7d47384c5a9faa25a05eee2f

SHA256
32346371590484ec75cf1dd08482749fe90acbbd2f6503a9dd6cfceeaab56880

SHA512
fa41354979bef98e299cdf18b1af008c9c4b8de21872e6af09d0abd7b676c1503028f40e130ece08cbebe9c25de08bc7f0ea022b37757c922f3e77aaf87e9801

Download Submit
C:\Windows\system\osNALwi.exe

Filesize
2.9MB

MD5
37189e0ce53dff85abc3777717365cec

SHA1
0bbd619d4efff51b0f393ef585bc2f60da02bc83

SHA256
3ff8532ae45fe27ca0fcbac232425f8959edce4dce7a6df49100eb0f40f5846f

SHA512
b6fa1c84682d346b0a7758612cdc9727e9581eaa9d8e4ae0a10b1c4b6ec66cba4f8db528978922cdc59a83bc079914dd31ddac7eb9984644372bf00ac2b8ce60

Download Submit
C:\Windows\system\pUKinXE.exe

Filesize
2.9MB

MD5
531359a1ef42f07256f6d472db193286

SHA1
869361d210fb61e70ccaa503b3b6d26e21ccf8d6

SHA256
67e3afb090b132bfd72f3976ecaa862412b4dc7f91cc4ef669da04a8dcd36918

SHA512
8882435a5e1a75e0e77219bffc603bc85f02c39e86b96c69f7fdd6ed214e6d6714c5566d9098ddbaaa1cde0b585359bbefbaacdc0c29db2c1e2d26cf44e3a4d7

Download Submit
C:\Windows\system\qSWGwWS.exe

Filesize
2.9MB

MD5
45ab027041a681df8ed18e79452a5306

SHA1
9229de7bf31621f9ad90c136c50a7fb502675471

SHA256
c6113422736ea3e8c030d489dc04656cfcccc89c677d99ec87db8e25627706fc

SHA512
143ea80fd0d2fcf15de7dbf5d93571d10f89bd467244f76231f3829aaa4d7383c07ccff9359ab174d55c0f0b1e6b59dcf0b9499283284ed2c7cda7f1c51b3440

Download Submit
C:\Windows\system\rPbSHiG.exe

Filesize
2.9MB

MD5
62cdc7702ea7ea49dacdb522e59d4253

SHA1
48d54d90619d97c16065f24db33ba7cf27a15596

SHA256
6433da1736d43aee18d8ce7d72b142413b8929e2e2c16ce4418bc0a741cbbe6b

SHA512
01491d59f754b8e67d88a0ca429a931ffef99f4c77c96ecea4a82eb7078af16f6c34dcdf40ed9813596e5a7656958bf4b4ca35e56ee9f4b7bad267b624de47d4

Download Submit
C:\Windows\system\rkntbNN.exe

Filesize
2.9MB

MD5
99decc1ede23ce0b70695219ad51e4db

SHA1
6982265bf007c1432cef73febdc4d16b4f10655b

SHA256
2843c226029c311739fb01dd77e154a76115c87fe0565753ab955b89c4e7a360

SHA512
0f537d7d0092ab904922c5150481b2687cf56159b9d2a8a07d7ded8322e84588d2a8425577838c307e9ea83d86c71b6ac912572bdd2d37837cc85ed854a46153

Download Submit
C:\Windows\system\wCQAQqU.exe

Filesize
2.9MB

MD5
b6e2c111ceb681d09697e28365d7222c

SHA1
73e3a0b7a826b368e5a0ef6f4ae1e94804d28cc8

SHA256
3eaeb46c20722326ce8568815378f7919dec4b4aabb8b9e413ef1dc578d62cd0

SHA512
de12a2a2f13494cc574f88ca1e5ed9b2e197697bf77bd65660bb96e39529c9c672acdde3296012324d311583294de6342c789f64e1adc9ab2bb510b0188f54a4

Download Submit
C:\Windows\system\wadffKG.exe

Filesize
2.9MB

MD5
f78c000db7b23af2c54b04bcc9021030

SHA1
dc83e66d7ae0b946b63a9757e33a5fe98c50b27c

SHA256
cb26df56b2c97eff209f23068706b42e38fd3c18d5ba9a3f80407416ec6bb9cf

SHA512
bf0e633b8c276cf34fbf8ded949f2f5ee64e3053b8462d00ab3e556211db1fa6d96472f9c83d5d9705196c1d980cb79d2811fc9f36f81d98c28a2e3dddcbc722

Download Submit
C:\Windows\system\wdXvzxf.exe

Filesize
2.9MB

MD5
26fc06f2b8cf1e4b505031f4a1b07aa9

SHA1
456e779995083eb90bfa0eaa49acd27e2b545dd2

SHA256
e797fa71c0db99e2c3b7c2bc50e23c99111fbfb339d4c01de9ab4135f9076f3b

SHA512
9a927d1865f525480b97c64520e623f0269c43ce5fd9a7451621968c178a8890a516512fa70115e2e58b490159d0698116850854443d559d65630f6e92bae1c6

Download Submit
C:\Windows\system\xxzkRUC.exe

Filesize
2.9MB

MD5
0e46f53647200a72ffac37425f4c2f84

SHA1
4e2bfd61bab8b07fae8e7972d3c995122cb78c3b

SHA256
923e8fc8e4e8f81e07476d09448a48f4a3dbe1c5520a8aefd970c6a1510e699d

SHA512
4e11e63bfa84ad9f2353629101b7c1f1e7ac5ca5f4cd5b5387e2b22d87097fb782f04e7412e4f5f541ee631afa41a995fc6b5f4ee0101a4c1f4d21a28a4d0f76

Download Submit
C:\Windows\system\zlDOYMS.exe

Filesize
2.9MB

MD5
4e73a90904d61d48074176e06b3ab9b0

SHA1
0708fed8e34def7184b5fe3d66903305fb966c7c

SHA256
dc541ad4c3978f6b0f8a39af844366538fd1ffd641ccf24f27aa98643c6df08c

SHA512
1137349b311081a798bb3946166ed1dc2c66c21bd2e097084ef207f737d4954f194964265420092ab1b3ac88c5faa489acd9435645d136cd81f57df66e3f5263

Download Submit
\Windows\system\GQMdIgc.exe

Filesize
2.9MB

MD5
2038755b4fd6e29f214df5646b711327

SHA1
e0050c963516ee0b98c0fda1d80db470777e72db

SHA256
b2d96e575ddff22d06ac6796db0004f4d54aa0b237929c11c96a84b612e84f8e

SHA512
af9f9bb67e6ebd336d7bd2ce89a0b56853fdbab09b89fe9707ae8b59d03417be6b1396b2e4b756092f967dec257131ec0119ce478294f744f47ac211a77bc856

Download Submit
\Windows\system\NZNHVuH.exe

Filesize
2.9MB

MD5
3d8e84722d72be436ed421eeba03e16e

SHA1
89839f04de85c3f7be1ac77cf290b81960175346

SHA256
97bc4566218cdc0f0893955b834ec439478937be048b4ae0fb7a471c5966329f

SHA512
b89639f52f0a4308a1121b82f4bd600c42327a501f27fda8e0cb2b387e8ba3908b492ed017288ab447c5dc291cc8b8548b1f11d7210ab81202733f8e062a145a

Download Submit
\Windows\system\OpngosZ.exe

Filesize
2.9MB

MD5
ff9baea6ab2b072d1862a33f2e088db2

SHA1
72b287cd28142e6390f4eb4287691728325843e1

SHA256
cc436e67be0b5e6f0166467b83591386415cf649cd9e1d34fa76d078d53a4eb8

SHA512
2f5e7e015918048a687ca988af388f43214dbc635f16a8c05a0c029c80b4dbbb70160343ee4ac39e86cbf58319a19deb4fd0bd258c48882e1fffe629679c9a89

Download Submit
\Windows\system\iiVbNUn.exe

Filesize
2.9MB

MD5
4693aae29a63f0179eca7ef3e9746668

SHA1
24c5da99aa1679af647a79abe69671f39d616717

SHA256
45d5b6386cb8e6a3d8eaa60ea72e7970e9beb27b89dca24f9069222536bb284e

SHA512
f807b3f0da364ba54c22f8798a801fcc837965b70ad9669864b5a1d58412c9ecfcc7254049eaf25c4ee6cf3ade6a0a91e834391d313e080f38269547a70376b3

Download Submit
\Windows\system\lliCnPc.exe

Filesize
2.9MB

MD5
57b36a24aef5e297124dc0f3d6da4000

SHA1
987e7ad676945213eda954d2f20d7bd48187e153

SHA256
5381e16166c51ec49f6fc665f56dd201a23ded9e875cf0364da614892541e54f

SHA512
0e04cb5eeeb22404868a9418690f64c25d41745128e4b2e3069d90d3a57daf7f7b523e58a1eba136d175fe2710af04adff1ff73f15360f5a5e8f73a5443b5f03

Download Submit
\Windows\system\oclsevp.exe

Filesize
2.9MB

MD5
85977b53fde63fc2e41a81291abee619

SHA1
996ae2f52a1113739fe9c29337402f4e4998fa0d

SHA256
2d2bb0bc4db47ea0dca1df49e2b104b7b5addb5952b2d21d6f21e2c04d8b6905

SHA512
084b3bf9968323ca500c3132424bda75f5d658be5e65a3ac4955c5e5a56a0d337a78b1149b9f383353cb9b82a04fde23a4a41655b6434ac104d3535b8108655d

Download Submit
\Windows\system\rIVssFW.exe

Filesize
2.9MB

MD5
dc9a052cc19fe0f0698073a18737cbd5

SHA1
dbb05589a5402384187c20087f445a13338f9ff7

SHA256
558ea48e1781a79f48081a5244afe845342fbeb64712ffda9d77cd9d182973fa

SHA512
2ab418f40144c5f2f2986b4071c1a086706a4a6034293df7bc22822dad40aafff68f84e012a01c50f537ddc82adabc125403ad7d48dead6aa84538e01b03effb

Download Submit
\Windows\system\uGxVxbT.exe

Filesize
2.9MB

MD5
39abfe4a1f8dd519895ea86780fcd3a7

SHA1
819f4fe52b8eb40144b8bf285c5d15cbe4459a4a

SHA256
287efcb7afd59ac85579d8f0dfb6ea1640771a4eec7ffd184f1a5fd810f8d49f

SHA512
5ff455c5ccb1694fed5c88972c4763d6f2dc49f987d88d6a3b6be450e47a5f0d250cec89ae408abdded0ce04034dddc6f598a6d32d129e70808020f3ab6a05a5

Download Submit
memory/1420-234-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/1420-237-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2036-23-0x000000013F980000-0x000000013FD76000-memory.dmp

Filesize
4.0MB

Download
memory/2036-7378-0x000000013F980000-0x000000013FD76000-memory.dmp

Filesize
4.0MB

Download
memory/2260-161-0x000000013F1E0000-0x000000013F5D6000-memory.dmp

Filesize
4.0MB

Download
memory/2260-7395-0x000000013F1E0000-0x000000013F5D6000-memory.dmp

Filesize
4.0MB

Download
memory/2392-164-0x0000000002FA0000-0x0000000003396000-memory.dmp

Filesize
4.0MB

Download
memory/2392-62-0x0000000002FA0000-0x0000000003396000-memory.dmp

Filesize
4.0MB

Download
memory/2392-7892-0x000000013F1E0000-0x000000013F5D6000-memory.dmp

Filesize
4.0MB

Download
memory/2392-158-0x000000013F1E0000-0x000000013F5D6000-memory.dmp

Filesize
4.0MB

Download
memory/2392-11-0x0000000002FA0000-0x0000000003396000-memory.dmp

Filesize
4.0MB

Download
memory/2392-7014-0x000000013F4C0000-0x000000013F8B6000-memory.dmp

Filesize
4.0MB

Download
memory/2392-1-0x000000013FC50000-0x0000000140046000-memory.dmp

Filesize
4.0MB

Download
memory/2392-27-0x000000013F7E0000-0x000000013FBD6000-memory.dmp

Filesize
4.0MB

Download
memory/2392-162-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download
memory/2392-159-0x000000013F470000-0x000000013F866000-memory.dmp

Filesize
4.0MB

Download
memory/2392-50-0x0000000002FA0000-0x0000000003396000-memory.dmp

Filesize
4.0MB

Download
memory/2392-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2392-157-0x000000013F290000-0x000000013F686000-memory.dmp

Filesize
4.0MB

Download
memory/2392-44-0x000000013F4C0000-0x000000013F8B6000-memory.dmp

Filesize
4.0MB

Download
memory/2392-42-0x000000013F540000-0x000000013F936000-memory.dmp

Filesize
4.0MB

Download
memory/2392-163-0x000000013F250000-0x000000013F646000-memory.dmp

Filesize
4.0MB

Download
memory/2472-88-0x000000013FCF0000-0x00000001400E6000-memory.dmp

Filesize
4.0MB

Download
memory/2472-7388-0x000000013FCF0000-0x00000001400E6000-memory.dmp

Filesize
4.0MB

Download
memory/2496-7405-0x000000013F250000-0x000000013F646000-memory.dmp

Filesize
4.0MB

Download
memory/2496-171-0x000000013F250000-0x000000013F646000-memory.dmp

Filesize
4.0MB

Download
memory/2580-169-0x000000013F540000-0x000000013F936000-memory.dmp

Filesize
4.0MB

Download
memory/2580-7393-0x000000013F540000-0x000000013F936000-memory.dmp

Filesize
4.0MB

Download
memory/2612-31-0x000000013F7E0000-0x000000013FBD6000-memory.dmp

Filesize
4.0MB

Download
memory/2616-7390-0x000000013F8A0000-0x000000013FC96000-memory.dmp

Filesize
4.0MB

Download
memory/2616-122-0x000000013F8A0000-0x000000013FC96000-memory.dmp

Filesize
4.0MB

Download
memory/2640-7392-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download
memory/2640-172-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download
memory/2648-7383-0x000000013FF50000-0x0000000140346000-memory.dmp

Filesize
4.0MB

Download
memory/2648-19-0x000000013FF50000-0x0000000140346000-memory.dmp

Filesize
4.0MB

Download
memory/3000-133-0x000000013F4C0000-0x000000013F8B6000-memory.dmp

Filesize
4.0MB

Download
memory/3000-7389-0x000000013F4C0000-0x000000013F8B6000-memory.dmp

Filesize
4.0MB

Download