xmrig | c900f9c2116c888a5c347197ca5f22005fb46eef871aa5ad02025f90a3a5b270

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8545c1341a66b0f997d5de027d721e80_NEAS.exe
Size

1.7MB
MD5

8545c1341a66b0f997d5de027d721e80
SHA1

86e40767a9582308d0e366a69beea03137814c07
SHA256

c900f9c2116c888a5c347197ca5f22005fb46eef871aa5ad02025f90a3a5b270
SHA512

3dca52d8bc41a405142c5cf9d8f8a148a98b81e403e5ce041f8d7f5b0b3d90e0eebe9311aad9e116d6691df2e501a5bb685fe977311ede378e15e8d9bf826853
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptKquT:Lz071uv4BPMkiFGlObO1EquT

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2356-13-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2780-218-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2612-204-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/1316-239-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2576-237-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2468-236-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2496-234-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2628-233-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2476-224-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/2696-216-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2684-214-0x000000013FD20000-0x0000000140112000-memory.dmp	xmrig
behavioral1/memory/2564-212-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2496-6054-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2684-6070-0x000000013FD20000-0x0000000140112000-memory.dmp	xmrig
behavioral1/memory/2612-6058-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2564-6131-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2356-6157-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2628-6392-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/1316-6403-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2468-6133-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2780-6057-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2476-6919-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/2912-12285-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1976	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2356	eBEIwzm.exe
2612	MuaAxfa.exe
2564	TodeExP.exe
2684	CQBCFkr.exe
2696	YvRXEyU.exe
2780	JfywHDQ.exe
2476	KUNfxjP.exe
2628	hjEbCZY.exe
2496	ddhocfg.exe
2468	fRnEniE.exe
2576	IxIgJQp.exe
1316	mHauOMz.exe
2340	WhtfNcB.exe
2760	pfMZmnI.exe
2860	OfxUizz.exe
2172	eOEHLnc.exe
1436	WkrBxHl.exe
1032	YgVtCDD.exe
332	QrmPmfM.exe
1256	VqEaVkV.exe
308	NhuCobB.exe
1424	sKfvTeh.exe
2228	PthsHUe.exe
2232	YgJqebt.exe
2248	FmiList.exe
2812	dNWoZRq.exe
2240	bcwmgbl.exe
1048	LJCywTB.exe
1644	XvhPDeW.exe
1836	AIzMBXL.exe
2440	dgDrIBj.exe
2072	GfSQJrv.exe
1556	pqaojPk.exe
1328	ZpmtvAq.exe
2316	LiVisWI.exe
1548	EoXQjPm.exe
2260	CeDYPoP.exe
2160	iYUGgpc.exe
1616	rzsOeWB.exe
1652	vbHIXQz.exe
548	BYIWeHx.exe
1776	dwpevFY.exe
1624	GkYYIVl.exe
1904	hqsSBXA.exe
1852	OSXSJLW.exe
1868	NtpHyMl.exe
2176	pZbtLlp.exe
1860	fXmGOoq.exe
2212	CWYfUuL.exe
2056	ifxkrNK.exe
1588	LqywPbm.exe
2372	nojOUoY.exe
2836	DDbPDFn.exe
564	lFVPDdI.exe
1272	TFVwkIN.exe
2600	HzfHbil.exe
2756	riCdPPo.exe
2464	ubTRsim.exe
2484	ePWiheQ.exe
2884	dUuuuuZ.exe
2888	WNqLkBD.exe
1156	yZlirgJ.exe
2752	QVVycXU.exe
1760	msDKlqd.exe

Loads dropped DLL 64 IoCs

pid	Process
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2912-1-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/files/0x000b00000001267a-3.dat	upx
behavioral1/memory/2356-13-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/files/0x002b000000012721-19.dat	upx
behavioral1/files/0x000e0000000054ab-18.dat	upx
behavioral1/files/0x000900000001322b-28.dat	upx
behavioral1/files/0x000800000001332e-33.dat	upx
behavioral1/files/0x000800000001340b-38.dat	upx
behavioral1/files/0x000900000001341c-56.dat	upx
behavioral1/files/0x0006000000014228-55.dat	upx
behavioral1/files/0x0006000000014312-62.dat	upx
behavioral1/files/0x0006000000014246-61.dat	upx
behavioral1/files/0x0006000000014326-70.dat	upx
behavioral1/files/0x0006000000014358-74.dat	upx
behavioral1/files/0x00060000000146fc-115.dat	upx
behavioral1/files/0x000600000001471a-123.dat	upx
behavioral1/files/0x0006000000014b18-137.dat	upx
behavioral1/files/0x000600000001565d-165.dat	upx
behavioral1/files/0x0006000000014712-117.dat	upx
behavioral1/memory/2780-218-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/files/0x000600000001535e-153.dat	upx
behavioral1/memory/2612-204-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/1316-239-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2576-237-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2468-236-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2496-234-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2628-233-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2476-224-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/2696-216-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/2684-214-0x000000013FD20000-0x0000000140112000-memory.dmp	upx
behavioral1/memory/2564-212-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/files/0x0006000000015677-167.dat	upx
behavioral1/files/0x0006000000015653-160.dat	upx
behavioral1/files/0x0006000000014e71-146.dat	upx
behavioral1/files/0x0006000000014b4c-139.dat	upx
behavioral1/files/0x0006000000014826-125.dat	upx
behavioral1/files/0x0006000000014a9a-132.dat	upx
behavioral1/files/0x000600000001564f-158.dat	upx
behavioral1/files/0x0006000000014fa2-151.dat	upx
behavioral1/files/0x0006000000014bbc-144.dat	upx
behavioral1/files/0x000600000001487f-130.dat	upx
behavioral1/files/0x00060000000146f4-111.dat	upx
behavioral1/files/0x0006000000014597-104.dat	upx
behavioral1/files/0x00060000000144e8-102.dat	upx
behavioral1/files/0x000600000001469d-101.dat	upx
behavioral1/files/0x000600000001458c-100.dat	upx
behavioral1/files/0x000600000001443b-99.dat	upx
behavioral1/files/0x00060000000143e5-83.dat	upx
behavioral1/files/0x000a000000013413-43.dat	upx
behavioral1/memory/2496-6054-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2684-6070-0x000000013FD20000-0x0000000140112000-memory.dmp	upx
behavioral1/memory/2612-6058-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2564-6131-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2356-6157-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2628-6392-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/1316-6403-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2468-6133-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2780-6057-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2476-6919-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/2912-12285-0x000000013F770000-0x000000013FB62000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QrJpKTg.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\fCCLMzv.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\KpzZngX.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\WPSOJvJ.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\vDMAGxG.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\mFxXpuS.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\Sprwzlr.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\ZLyCBKV.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\UCkXKBY.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\vbHIXQz.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\FomknQl.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\vtNHQJB.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\wgWtdzW.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\fJAdtfj.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\lCADrWO.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\lyhUXWS.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\KugaHFG.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\CQROLVV.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\nmMnWpX.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\naTBCqS.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\TgeFmiD.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\MkYShGg.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\cRsAdMm.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\doGdRXP.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\ZqcwDsn.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\oZxteJN.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\fqLxRGg.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\XsnSgyM.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\IkwidRl.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\QlovAnf.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\BySjYQd.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\xPiVqlW.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\jzgtOyi.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\KaaiCwH.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\IBjmeVr.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\zocUMaK.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\APDSYwL.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\QLmPZzm.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\FLbKaYa.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\WAELapS.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\BfutGnQ.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\znIEeCM.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\tsPiCRH.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\UHvYAxe.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\VjkWzvU.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\ktAlhrP.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\GOvRTfQ.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\JcdrbYu.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\TjQtjrE.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\IGFatxH.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\EqpXvsF.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\iVDnFhQ.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\YpGOjPn.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\poeAGoT.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\iZioodH.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\XEilcSJ.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\qomENwu.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\HQrZzmC.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\wrVnqEY.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\cZvRmGv.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\KYQSVEY.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\pfPFGNR.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\KbaxXJA.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe
File created	C:\Windows\System\GxfSVqd.exe	8545c1341a66b0f997d5de027d721e80_NEAS.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1976	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
Token: SeLockMemoryPrivilege	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe
Token: SeDebugPrivilege	1976	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 1976	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	29
PID 2912 wrote to memory of 1976	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	29
PID 2912 wrote to memory of 1976	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	29
PID 2912 wrote to memory of 2356	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	30
PID 2912 wrote to memory of 2356	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	30
PID 2912 wrote to memory of 2356	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	30
PID 2912 wrote to memory of 2612	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	31
PID 2912 wrote to memory of 2612	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	31
PID 2912 wrote to memory of 2612	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	31
PID 2912 wrote to memory of 2564	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	32
PID 2912 wrote to memory of 2564	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	32
PID 2912 wrote to memory of 2564	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	32
PID 2912 wrote to memory of 2684	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	33
PID 2912 wrote to memory of 2684	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	33
PID 2912 wrote to memory of 2684	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	33
PID 2912 wrote to memory of 2696	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	34
PID 2912 wrote to memory of 2696	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	34
PID 2912 wrote to memory of 2696	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	34
PID 2912 wrote to memory of 2780	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	35
PID 2912 wrote to memory of 2780	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	35
PID 2912 wrote to memory of 2780	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	35
PID 2912 wrote to memory of 2476	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	36
PID 2912 wrote to memory of 2476	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	36
PID 2912 wrote to memory of 2476	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	36
PID 2912 wrote to memory of 2496	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	37
PID 2912 wrote to memory of 2496	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	37
PID 2912 wrote to memory of 2496	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	37
PID 2912 wrote to memory of 2628	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	38
PID 2912 wrote to memory of 2628	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	38
PID 2912 wrote to memory of 2628	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	38
PID 2912 wrote to memory of 2468	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	39
PID 2912 wrote to memory of 2468	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	39
PID 2912 wrote to memory of 2468	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	39
PID 2912 wrote to memory of 2576	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	40
PID 2912 wrote to memory of 2576	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	40
PID 2912 wrote to memory of 2576	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	40
PID 2912 wrote to memory of 1316	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	41
PID 2912 wrote to memory of 1316	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	41
PID 2912 wrote to memory of 1316	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	41
PID 2912 wrote to memory of 2340	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	42
PID 2912 wrote to memory of 2340	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	42
PID 2912 wrote to memory of 2340	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	42
PID 2912 wrote to memory of 2760	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	43
PID 2912 wrote to memory of 2760	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	43
PID 2912 wrote to memory of 2760	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	43
PID 2912 wrote to memory of 2860	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	44
PID 2912 wrote to memory of 2860	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	44
PID 2912 wrote to memory of 2860	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	44
PID 2912 wrote to memory of 1032	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	45
PID 2912 wrote to memory of 1032	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	45
PID 2912 wrote to memory of 1032	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	45
PID 2912 wrote to memory of 2172	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	46
PID 2912 wrote to memory of 2172	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	46
PID 2912 wrote to memory of 2172	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	46
PID 2912 wrote to memory of 332	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	47
PID 2912 wrote to memory of 332	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	47
PID 2912 wrote to memory of 332	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	47
PID 2912 wrote to memory of 1436	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	48
PID 2912 wrote to memory of 1436	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	48
PID 2912 wrote to memory of 1436	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	48
PID 2912 wrote to memory of 1256	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	49
PID 2912 wrote to memory of 1256	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	49
PID 2912 wrote to memory of 1256	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	49
PID 2912 wrote to memory of 308	2912	8545c1341a66b0f997d5de027d721e80_NEAS.exe	50

C:\Users\Admin\AppData\Local\Temp\8545c1341a66b0f997d5de027d721e80_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\8545c1341a66b0f997d5de027d721e80_NEAS.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1976
- C:\Windows\System\eBEIwzm.exe
  C:\Windows\System\eBEIwzm.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\MuaAxfa.exe
  C:\Windows\System\MuaAxfa.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\TodeExP.exe
  C:\Windows\System\TodeExP.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\CQBCFkr.exe
  C:\Windows\System\CQBCFkr.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\YvRXEyU.exe
  C:\Windows\System\YvRXEyU.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\JfywHDQ.exe
  C:\Windows\System\JfywHDQ.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\KUNfxjP.exe
  C:\Windows\System\KUNfxjP.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\ddhocfg.exe
  C:\Windows\System\ddhocfg.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\hjEbCZY.exe
  C:\Windows\System\hjEbCZY.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\fRnEniE.exe
  C:\Windows\System\fRnEniE.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\IxIgJQp.exe
  C:\Windows\System\IxIgJQp.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\mHauOMz.exe
  C:\Windows\System\mHauOMz.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\WhtfNcB.exe
  C:\Windows\System\WhtfNcB.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\pfMZmnI.exe
  C:\Windows\System\pfMZmnI.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\OfxUizz.exe
  C:\Windows\System\OfxUizz.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\YgVtCDD.exe
  C:\Windows\System\YgVtCDD.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\eOEHLnc.exe
  C:\Windows\System\eOEHLnc.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\QrmPmfM.exe
  C:\Windows\System\QrmPmfM.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\WkrBxHl.exe
  C:\Windows\System\WkrBxHl.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\VqEaVkV.exe
  C:\Windows\System\VqEaVkV.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\NhuCobB.exe
  C:\Windows\System\NhuCobB.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\dgDrIBj.exe
  C:\Windows\System\dgDrIBj.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\sKfvTeh.exe
  C:\Windows\System\sKfvTeh.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\GfSQJrv.exe
  C:\Windows\System\GfSQJrv.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\PthsHUe.exe
  C:\Windows\System\PthsHUe.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\pqaojPk.exe
  C:\Windows\System\pqaojPk.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\YgJqebt.exe
  C:\Windows\System\YgJqebt.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\ZpmtvAq.exe
  C:\Windows\System\ZpmtvAq.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\FmiList.exe
  C:\Windows\System\FmiList.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\LiVisWI.exe
  C:\Windows\System\LiVisWI.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\dNWoZRq.exe
  C:\Windows\System\dNWoZRq.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\CeDYPoP.exe
  C:\Windows\System\CeDYPoP.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\bcwmgbl.exe
  C:\Windows\System\bcwmgbl.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\iYUGgpc.exe
  C:\Windows\System\iYUGgpc.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\LJCywTB.exe
  C:\Windows\System\LJCywTB.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\BYIWeHx.exe
  C:\Windows\System\BYIWeHx.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\XvhPDeW.exe
  C:\Windows\System\XvhPDeW.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\dwpevFY.exe
  C:\Windows\System\dwpevFY.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\AIzMBXL.exe
  C:\Windows\System\AIzMBXL.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\GkYYIVl.exe
  C:\Windows\System\GkYYIVl.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\EoXQjPm.exe
  C:\Windows\System\EoXQjPm.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\OSXSJLW.exe
  C:\Windows\System\OSXSJLW.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\rzsOeWB.exe
  C:\Windows\System\rzsOeWB.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\NtpHyMl.exe
  C:\Windows\System\NtpHyMl.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\vbHIXQz.exe
  C:\Windows\System\vbHIXQz.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\fXmGOoq.exe
  C:\Windows\System\fXmGOoq.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\hqsSBXA.exe
  C:\Windows\System\hqsSBXA.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\CWYfUuL.exe
  C:\Windows\System\CWYfUuL.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\pZbtLlp.exe
  C:\Windows\System\pZbtLlp.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\ifxkrNK.exe
  C:\Windows\System\ifxkrNK.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\LqywPbm.exe
  C:\Windows\System\LqywPbm.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\DDbPDFn.exe
  C:\Windows\System\DDbPDFn.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\nojOUoY.exe
  C:\Windows\System\nojOUoY.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\TFVwkIN.exe
  C:\Windows\System\TFVwkIN.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\lFVPDdI.exe
  C:\Windows\System\lFVPDdI.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\HzfHbil.exe
  C:\Windows\System\HzfHbil.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\riCdPPo.exe
  C:\Windows\System\riCdPPo.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\ubTRsim.exe
  C:\Windows\System\ubTRsim.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\ePWiheQ.exe
  C:\Windows\System\ePWiheQ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\dUuuuuZ.exe
  C:\Windows\System\dUuuuuZ.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\WNqLkBD.exe
  C:\Windows\System\WNqLkBD.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\QVVycXU.exe
  C:\Windows\System\QVVycXU.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\yZlirgJ.exe
  C:\Windows\System\yZlirgJ.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\XeHzhJD.exe
  C:\Windows\System\XeHzhJD.exe
  2⤵
  PID:2008
- C:\Windows\System\msDKlqd.exe
  C:\Windows\System\msDKlqd.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\gOiPvpo.exe
  C:\Windows\System\gOiPvpo.exe
  2⤵
  PID:1900
- C:\Windows\System\bEDkchH.exe
  C:\Windows\System\bEDkchH.exe
  2⤵
  PID:1964
- C:\Windows\System\heNjMYV.exe
  C:\Windows\System\heNjMYV.exe
  2⤵
  PID:384
- C:\Windows\System\FkNDdPG.exe
  C:\Windows\System\FkNDdPG.exe
  2⤵
  PID:1804
- C:\Windows\System\DjOAvWs.exe
  C:\Windows\System\DjOAvWs.exe
  2⤵
  PID:2984
- C:\Windows\System\QRXOUIX.exe
  C:\Windows\System\QRXOUIX.exe
  2⤵
  PID:2224
- C:\Windows\System\WYZtagH.exe
  C:\Windows\System\WYZtagH.exe
  2⤵
  PID:1552
- C:\Windows\System\CzaqSsm.exe
  C:\Windows\System\CzaqSsm.exe
  2⤵
  PID:568
- C:\Windows\System\KyRrqRh.exe
  C:\Windows\System\KyRrqRh.exe
  2⤵
  PID:2428
- C:\Windows\System\hCvUQSf.exe
  C:\Windows\System\hCvUQSf.exe
  2⤵
  PID:2672
- C:\Windows\System\dXtDTaP.exe
  C:\Windows\System\dXtDTaP.exe
  2⤵
  PID:2808
- C:\Windows\System\AsqLMvs.exe
  C:\Windows\System\AsqLMvs.exe
  2⤵
  PID:3000
- C:\Windows\System\DCHlnFS.exe
  C:\Windows\System\DCHlnFS.exe
  2⤵
  PID:1336
- C:\Windows\System\zVRbiao.exe
  C:\Windows\System\zVRbiao.exe
  2⤵
  PID:752
- C:\Windows\System\BGhxhNi.exe
  C:\Windows\System\BGhxhNi.exe
  2⤵
  PID:1908
- C:\Windows\System\RUKuyiJ.exe
  C:\Windows\System\RUKuyiJ.exe
  2⤵
  PID:932
- C:\Windows\System\CzbVBUS.exe
  C:\Windows\System\CzbVBUS.exe
  2⤵
  PID:1916
- C:\Windows\System\eRULWdc.exe
  C:\Windows\System\eRULWdc.exe
  2⤵
  PID:892
- C:\Windows\System\RNyjsmP.exe
  C:\Windows\System\RNyjsmP.exe
  2⤵
  PID:288
- C:\Windows\System\fdWkMWD.exe
  C:\Windows\System\fdWkMWD.exe
  2⤵
  PID:992
- C:\Windows\System\yuLRmHp.exe
  C:\Windows\System\yuLRmHp.exe
  2⤵
  PID:1596
- C:\Windows\System\ajOhVnk.exe
  C:\Windows\System\ajOhVnk.exe
  2⤵
  PID:2580
- C:\Windows\System\MtMwXQq.exe
  C:\Windows\System\MtMwXQq.exe
  2⤵
  PID:2324
- C:\Windows\System\scUiJAm.exe
  C:\Windows\System\scUiJAm.exe
  2⤵
  PID:1296
- C:\Windows\System\SXjyfyK.exe
  C:\Windows\System\SXjyfyK.exe
  2⤵
  PID:2668
- C:\Windows\System\tCMZhCc.exe
  C:\Windows\System\tCMZhCc.exe
  2⤵
  PID:2448
- C:\Windows\System\sBVVrPR.exe
  C:\Windows\System\sBVVrPR.exe
  2⤵
  PID:2136
- C:\Windows\System\hQdqASP.exe
  C:\Windows\System\hQdqASP.exe
  2⤵
  PID:2492
- C:\Windows\System\lFEWEQI.exe
  C:\Windows\System\lFEWEQI.exe
  2⤵
  PID:1756
- C:\Windows\System\dXBFiTd.exe
  C:\Windows\System\dXBFiTd.exe
  2⤵
  PID:2516
- C:\Windows\System\QzAytgx.exe
  C:\Windows\System\QzAytgx.exe
  2⤵
  PID:2708
- C:\Windows\System\jvUiazy.exe
  C:\Windows\System\jvUiazy.exe
  2⤵
  PID:2432
- C:\Windows\System\ItRdlQt.exe
  C:\Windows\System\ItRdlQt.exe
  2⤵
  PID:2036
- C:\Windows\System\DaJDOJA.exe
  C:\Windows\System\DaJDOJA.exe
  2⤵
  PID:2104
- C:\Windows\System\vmExmIZ.exe
  C:\Windows\System\vmExmIZ.exe
  2⤵
  PID:2288
- C:\Windows\System\HDMUICx.exe
  C:\Windows\System\HDMUICx.exe
  2⤵
  PID:1684
- C:\Windows\System\DsSUjFK.exe
  C:\Windows\System\DsSUjFK.exe
  2⤵
  PID:2100
- C:\Windows\System\sKoIXSS.exe
  C:\Windows\System\sKoIXSS.exe
  2⤵
  PID:2344
- C:\Windows\System\kPRwchv.exe
  C:\Windows\System\kPRwchv.exe
  2⤵
  PID:1536
- C:\Windows\System\ztYHqBX.exe
  C:\Windows\System\ztYHqBX.exe
  2⤵
  PID:1884
- C:\Windows\System\wxNGXan.exe
  C:\Windows\System\wxNGXan.exe
  2⤵
  PID:2524
- C:\Windows\System\DjDGhAD.exe
  C:\Windows\System\DjDGhAD.exe
  2⤵
  PID:1848
- C:\Windows\System\KnOYLFp.exe
  C:\Windows\System\KnOYLFp.exe
  2⤵
  PID:1744
- C:\Windows\System\evlocYk.exe
  C:\Windows\System\evlocYk.exe
  2⤵
  PID:2084
- C:\Windows\System\fXnXqNH.exe
  C:\Windows\System\fXnXqNH.exe
  2⤵
  PID:2192
- C:\Windows\System\iFdrKCu.exe
  C:\Windows\System\iFdrKCu.exe
  2⤵
  PID:1808
- C:\Windows\System\GnodSUR.exe
  C:\Windows\System\GnodSUR.exe
  2⤵
  PID:2548
- C:\Windows\System\MbuPPkQ.exe
  C:\Windows\System\MbuPPkQ.exe
  2⤵
  PID:540
- C:\Windows\System\xvMpkAw.exe
  C:\Windows\System\xvMpkAw.exe
  2⤵
  PID:1752
- C:\Windows\System\rkNWXrr.exe
  C:\Windows\System\rkNWXrr.exe
  2⤵
  PID:1708
- C:\Windows\System\rzBLXEi.exe
  C:\Windows\System\rzBLXEi.exe
  2⤵
  PID:2776
- C:\Windows\System\JLvFwgu.exe
  C:\Windows\System\JLvFwgu.exe
  2⤵
  PID:2712
- C:\Windows\System\QrJpKTg.exe
  C:\Windows\System\QrJpKTg.exe
  2⤵
  PID:2872
- C:\Windows\System\BnDtAUm.exe
  C:\Windows\System\BnDtAUm.exe
  2⤵
  PID:344
- C:\Windows\System\rWSCyBX.exe
  C:\Windows\System\rWSCyBX.exe
  2⤵
  PID:2944
- C:\Windows\System\mTTjISI.exe
  C:\Windows\System\mTTjISI.exe
  2⤵
  PID:2900
- C:\Windows\System\OrvFflM.exe
  C:\Windows\System\OrvFflM.exe
  2⤵
  PID:2152
- C:\Windows\System\dAAyRxE.exe
  C:\Windows\System\dAAyRxE.exe
  2⤵
  PID:584
- C:\Windows\System\KyMuZTD.exe
  C:\Windows\System\KyMuZTD.exe
  2⤵
  PID:2604
- C:\Windows\System\rMGRlAF.exe
  C:\Windows\System\rMGRlAF.exe
  2⤵
  PID:1628
- C:\Windows\System\QmvengI.exe
  C:\Windows\System\QmvengI.exe
  2⤵
  PID:3012
- C:\Windows\System\vnAxKnx.exe
  C:\Windows\System\vnAxKnx.exe
  2⤵
  PID:2664
- C:\Windows\System\oFECvON.exe
  C:\Windows\System\oFECvON.exe
  2⤵
  PID:1716
- C:\Windows\System\WTvTonv.exe
  C:\Windows\System\WTvTonv.exe
  2⤵
  PID:3040
- C:\Windows\System\znIEeCM.exe
  C:\Windows\System\znIEeCM.exe
  2⤵
  PID:2400
- C:\Windows\System\kNIAfAJ.exe
  C:\Windows\System\kNIAfAJ.exe
  2⤵
  PID:2388
- C:\Windows\System\zMaVFzS.exe
  C:\Windows\System\zMaVFzS.exe
  2⤵
  PID:2264
- C:\Windows\System\tEsytot.exe
  C:\Windows\System\tEsytot.exe
  2⤵
  PID:1520
- C:\Windows\System\tCUxhCc.exe
  C:\Windows\System\tCUxhCc.exe
  2⤵
  PID:2456
- C:\Windows\System\SxvOCVO.exe
  C:\Windows\System\SxvOCVO.exe
  2⤵
  PID:2724
- C:\Windows\System\FEEcPqP.exe
  C:\Windows\System\FEEcPqP.exe
  2⤵
  PID:300
- C:\Windows\System\vuiyApu.exe
  C:\Windows\System\vuiyApu.exe
  2⤵
  PID:2592
- C:\Windows\System\rUmcgSS.exe
  C:\Windows\System\rUmcgSS.exe
  2⤵
  PID:2832
- C:\Windows\System\xBGBPMK.exe
  C:\Windows\System\xBGBPMK.exe
  2⤵
  PID:1992
- C:\Windows\System\MLlViOj.exe
  C:\Windows\System\MLlViOj.exe
  2⤵
  PID:1044
- C:\Windows\System\JIqKzMj.exe
  C:\Windows\System\JIqKzMj.exe
  2⤵
  PID:1392
- C:\Windows\System\CMrDmRL.exe
  C:\Windows\System\CMrDmRL.exe
  2⤵
  PID:780
- C:\Windows\System\RYOaYWr.exe
  C:\Windows\System\RYOaYWr.exe
  2⤵
  PID:2280
- C:\Windows\System\UCpcIWh.exe
  C:\Windows\System\UCpcIWh.exe
  2⤵
  PID:2680
- C:\Windows\System\kKaqnWt.exe
  C:\Windows\System\kKaqnWt.exe
  2⤵
  PID:2960
- C:\Windows\System\yIfZUdS.exe
  C:\Windows\System\yIfZUdS.exe
  2⤵
  PID:1476
- C:\Windows\System\bvBQQyE.exe
  C:\Windows\System\bvBQQyE.exe
  2⤵
  PID:852
- C:\Windows\System\IwYecuk.exe
  C:\Windows\System\IwYecuk.exe
  2⤵
  PID:1896
- C:\Windows\System\ojdUcSN.exe
  C:\Windows\System\ojdUcSN.exe
  2⤵
  PID:2964
- C:\Windows\System\vcwkxrS.exe
  C:\Windows\System\vcwkxrS.exe
  2⤵
  PID:2988
- C:\Windows\System\ofGUNJy.exe
  C:\Windows\System\ofGUNJy.exe
  2⤵
  PID:1508
- C:\Windows\System\dlNeIxi.exe
  C:\Windows\System\dlNeIxi.exe
  2⤵
  PID:2236
- C:\Windows\System\iDcFyuG.exe
  C:\Windows\System\iDcFyuG.exe
  2⤵
  PID:2200
- C:\Windows\System\yNXoatV.exe
  C:\Windows\System\yNXoatV.exe
  2⤵
  PID:804
- C:\Windows\System\XFtCRdY.exe
  C:\Windows\System\XFtCRdY.exe
  2⤵
  PID:2688
- C:\Windows\System\opqttXn.exe
  C:\Windows\System\opqttXn.exe
  2⤵
  PID:912
- C:\Windows\System\bgGgbUr.exe
  C:\Windows\System\bgGgbUr.exe
  2⤵
  PID:1380
- C:\Windows\System\MHsmWcQ.exe
  C:\Windows\System\MHsmWcQ.exe
  2⤵
  PID:2620
- C:\Windows\System\WgiaumG.exe
  C:\Windows\System\WgiaumG.exe
  2⤵
  PID:3076
- C:\Windows\System\ftoTrVk.exe
  C:\Windows\System\ftoTrVk.exe
  2⤵
  PID:3100
- C:\Windows\System\XJJWnpy.exe
  C:\Windows\System\XJJWnpy.exe
  2⤵
  PID:3116
- C:\Windows\System\XMpNWPj.exe
  C:\Windows\System\XMpNWPj.exe
  2⤵
  PID:3132
- C:\Windows\System\mgLrAGV.exe
  C:\Windows\System\mgLrAGV.exe
  2⤵
  PID:3168
- C:\Windows\System\VoeKszU.exe
  C:\Windows\System\VoeKszU.exe
  2⤵
  PID:3184
- C:\Windows\System\OhfYdbQ.exe
  C:\Windows\System\OhfYdbQ.exe
  2⤵
  PID:3200
- C:\Windows\System\ZzArmVH.exe
  C:\Windows\System\ZzArmVH.exe
  2⤵
  PID:3220
- C:\Windows\System\JZaccWx.exe
  C:\Windows\System\JZaccWx.exe
  2⤵
  PID:3236
- C:\Windows\System\gMyTznt.exe
  C:\Windows\System\gMyTznt.exe
  2⤵
  PID:3252
- C:\Windows\System\CpPzbVT.exe
  C:\Windows\System\CpPzbVT.exe
  2⤵
  PID:3268
- C:\Windows\System\AKSxKbB.exe
  C:\Windows\System\AKSxKbB.exe
  2⤵
  PID:3284
- C:\Windows\System\eNxhERb.exe
  C:\Windows\System\eNxhERb.exe
  2⤵
  PID:3300
- C:\Windows\System\kYVGNks.exe
  C:\Windows\System\kYVGNks.exe
  2⤵
  PID:3316
- C:\Windows\System\AMrGRjm.exe
  C:\Windows\System\AMrGRjm.exe
  2⤵
  PID:3332
- C:\Windows\System\MwClsEQ.exe
  C:\Windows\System\MwClsEQ.exe
  2⤵
  PID:3348
- C:\Windows\System\bPGpJfU.exe
  C:\Windows\System\bPGpJfU.exe
  2⤵
  PID:3368
- C:\Windows\System\MmDBZZy.exe
  C:\Windows\System\MmDBZZy.exe
  2⤵
  PID:3384
- C:\Windows\System\PQmhRtd.exe
  C:\Windows\System\PQmhRtd.exe
  2⤵
  PID:3484
- C:\Windows\System\SFaUpfS.exe
  C:\Windows\System\SFaUpfS.exe
  2⤵
  PID:3500
- C:\Windows\System\dvnGWym.exe
  C:\Windows\System\dvnGWym.exe
  2⤵
  PID:3516
- C:\Windows\System\qNMftsN.exe
  C:\Windows\System\qNMftsN.exe
  2⤵
  PID:3532
- C:\Windows\System\oHKqYPt.exe
  C:\Windows\System\oHKqYPt.exe
  2⤵
  PID:3548
- C:\Windows\System\xBnObXP.exe
  C:\Windows\System\xBnObXP.exe
  2⤵
  PID:3564
- C:\Windows\System\uZlMQFo.exe
  C:\Windows\System\uZlMQFo.exe
  2⤵
  PID:3580
- C:\Windows\System\UCFbCIB.exe
  C:\Windows\System\UCFbCIB.exe
  2⤵
  PID:3596
- C:\Windows\System\OUiuHTX.exe
  C:\Windows\System\OUiuHTX.exe
  2⤵
  PID:3612
- C:\Windows\System\tonvTXk.exe
  C:\Windows\System\tonvTXk.exe
  2⤵
  PID:3628
- C:\Windows\System\qiZJhAZ.exe
  C:\Windows\System\qiZJhAZ.exe
  2⤵
  PID:3644
- C:\Windows\System\ozLPOuB.exe
  C:\Windows\System\ozLPOuB.exe
  2⤵
  PID:3660
- C:\Windows\System\uENqOIP.exe
  C:\Windows\System\uENqOIP.exe
  2⤵
  PID:3680
- C:\Windows\System\wiWnkak.exe
  C:\Windows\System\wiWnkak.exe
  2⤵
  PID:3696
- C:\Windows\System\fstpHsE.exe
  C:\Windows\System\fstpHsE.exe
  2⤵
  PID:3712
- C:\Windows\System\PbIYxuZ.exe
  C:\Windows\System\PbIYxuZ.exe
  2⤵
  PID:3728
- C:\Windows\System\uxJaKFB.exe
  C:\Windows\System\uxJaKFB.exe
  2⤵
  PID:3804
- C:\Windows\System\MSKwdXt.exe
  C:\Windows\System\MSKwdXt.exe
  2⤵
  PID:3828
- C:\Windows\System\kMILXXc.exe
  C:\Windows\System\kMILXXc.exe
  2⤵
  PID:3844
- C:\Windows\System\SCwkwKO.exe
  C:\Windows\System\SCwkwKO.exe
  2⤵
  PID:3868
- C:\Windows\System\TlNPSgF.exe
  C:\Windows\System\TlNPSgF.exe
  2⤵
  PID:3884
- C:\Windows\System\DRbCEHy.exe
  C:\Windows\System\DRbCEHy.exe
  2⤵
  PID:3904
- C:\Windows\System\cxPuCFg.exe
  C:\Windows\System\cxPuCFg.exe
  2⤵
  PID:3920
- C:\Windows\System\GxfSVqd.exe
  C:\Windows\System\GxfSVqd.exe
  2⤵
  PID:3948
- C:\Windows\System\ckPWvce.exe
  C:\Windows\System\ckPWvce.exe
  2⤵
  PID:3964
- C:\Windows\System\OrbRrQZ.exe
  C:\Windows\System\OrbRrQZ.exe
  2⤵
  PID:3988
- C:\Windows\System\fuoqKRu.exe
  C:\Windows\System\fuoqKRu.exe
  2⤵
  PID:4004
- C:\Windows\System\IPKvXQJ.exe
  C:\Windows\System\IPKvXQJ.exe
  2⤵
  PID:4024
- C:\Windows\System\wGsoypw.exe
  C:\Windows\System\wGsoypw.exe
  2⤵
  PID:4044
- C:\Windows\System\oygVEGX.exe
  C:\Windows\System\oygVEGX.exe
  2⤵
  PID:4064
- C:\Windows\System\yOUGsMa.exe
  C:\Windows\System\yOUGsMa.exe
  2⤵
  PID:4084
- C:\Windows\System\poYRrPC.exe
  C:\Windows\System\poYRrPC.exe
  2⤵
  PID:2904
- C:\Windows\System\jTWnGgU.exe
  C:\Windows\System\jTWnGgU.exe
  2⤵
  PID:2676
- C:\Windows\System\NePYreD.exe
  C:\Windows\System\NePYreD.exe
  2⤵
  PID:304
- C:\Windows\System\SEwYuXx.exe
  C:\Windows\System\SEwYuXx.exe
  2⤵
  PID:2020
- C:\Windows\System\sjQlHXY.exe
  C:\Windows\System\sjQlHXY.exe
  2⤵
  PID:3124
- C:\Windows\System\mqsHnVl.exe
  C:\Windows\System\mqsHnVl.exe
  2⤵
  PID:3228
- C:\Windows\System\weqXvUn.exe
  C:\Windows\System\weqXvUn.exe
  2⤵
  PID:3296
- C:\Windows\System\WXrfQtH.exe
  C:\Windows\System\WXrfQtH.exe
  2⤵
  PID:3208
- C:\Windows\System\seSyeCU.exe
  C:\Windows\System\seSyeCU.exe
  2⤵
  PID:3364
- C:\Windows\System\HNdowtJ.exe
  C:\Windows\System\HNdowtJ.exe
  2⤵
  PID:3248
- C:\Windows\System\MZWEmwt.exe
  C:\Windows\System\MZWEmwt.exe
  2⤵
  PID:3344
- C:\Windows\System\nbCydby.exe
  C:\Windows\System\nbCydby.exe
  2⤵
  PID:3232
- C:\Windows\System\DQLrIJI.exe
  C:\Windows\System\DQLrIJI.exe
  2⤵
  PID:3440
- C:\Windows\System\ABzsGZA.exe
  C:\Windows\System\ABzsGZA.exe
  2⤵
  PID:3404
- C:\Windows\System\aFRvSKj.exe
  C:\Windows\System\aFRvSKj.exe
  2⤵
  PID:3428
- C:\Windows\System\edntEkT.exe
  C:\Windows\System\edntEkT.exe
  2⤵
  PID:3572
- C:\Windows\System\VZkaZtQ.exe
  C:\Windows\System\VZkaZtQ.exe
  2⤵
  PID:3528
- C:\Windows\System\jrrXFoI.exe
  C:\Windows\System\jrrXFoI.exe
  2⤵
  PID:3620
- C:\Windows\System\hgQdveu.exe
  C:\Windows\System\hgQdveu.exe
  2⤵
  PID:3688
- C:\Windows\System\zzlJZLO.exe
  C:\Windows\System\zzlJZLO.exe
  2⤵
  PID:3676
- C:\Windows\System\MiZnlIC.exe
  C:\Windows\System\MiZnlIC.exe
  2⤵
  PID:3576
- C:\Windows\System\nxcDaPR.exe
  C:\Windows\System\nxcDaPR.exe
  2⤵
  PID:3752
- C:\Windows\System\vFzmrcH.exe
  C:\Windows\System\vFzmrcH.exe
  2⤵
  PID:3768
- C:\Windows\System\JKyATRf.exe
  C:\Windows\System\JKyATRf.exe
  2⤵
  PID:3784
- C:\Windows\System\TrqoHyx.exe
  C:\Windows\System\TrqoHyx.exe
  2⤵
  PID:3800
- C:\Windows\System\WmODSzH.exe
  C:\Windows\System\WmODSzH.exe
  2⤵
  PID:3820
- C:\Windows\System\qEKngFB.exe
  C:\Windows\System\qEKngFB.exe
  2⤵
  PID:1876
- C:\Windows\System\HBXnzvU.exe
  C:\Windows\System\HBXnzvU.exe
  2⤵
  PID:1720
- C:\Windows\System\pCVAtVW.exe
  C:\Windows\System\pCVAtVW.exe
  2⤵
  PID:3840
- C:\Windows\System\MmLMyCl.exe
  C:\Windows\System\MmLMyCl.exe
  2⤵
  PID:3876
- C:\Windows\System\UMxPVXP.exe
  C:\Windows\System\UMxPVXP.exe
  2⤵
  PID:3900
- C:\Windows\System\VhJDGSQ.exe
  C:\Windows\System\VhJDGSQ.exe
  2⤵
  PID:3936
- C:\Windows\System\gKaEMFL.exe
  C:\Windows\System\gKaEMFL.exe
  2⤵
  PID:3956
- C:\Windows\System\WJngVgW.exe
  C:\Windows\System\WJngVgW.exe
  2⤵
  PID:3984
- C:\Windows\System\SgDTaqG.exe
  C:\Windows\System\SgDTaqG.exe
  2⤵
  PID:4000
- C:\Windows\System\yocpaZG.exe
  C:\Windows\System\yocpaZG.exe
  2⤵
  PID:4036
- C:\Windows\System\WMMRsOy.exe
  C:\Windows\System\WMMRsOy.exe
  2⤵
  PID:4060
- C:\Windows\System\tVImXSF.exe
  C:\Windows\System\tVImXSF.exe
  2⤵
  PID:4076
- C:\Windows\System\HrtgdpB.exe
  C:\Windows\System\HrtgdpB.exe
  2⤵
  PID:2820
- C:\Windows\System\WDpkxUV.exe
  C:\Windows\System\WDpkxUV.exe
  2⤵
  PID:3148
- C:\Windows\System\MEvLpqq.exe
  C:\Windows\System\MEvLpqq.exe
  2⤵
  PID:3192
- C:\Windows\System\dMOuhxy.exe
  C:\Windows\System\dMOuhxy.exe
  2⤵
  PID:3292
- C:\Windows\System\ivFVvSg.exe
  C:\Windows\System\ivFVvSg.exe
  2⤵
  PID:3176
- C:\Windows\System\yOlOBmT.exe
  C:\Windows\System\yOlOBmT.exe
  2⤵
  PID:3396
- C:\Windows\System\hEfIlvO.exe
  C:\Windows\System\hEfIlvO.exe
  2⤵
  PID:3376
- C:\Windows\System\YWnSIPW.exe
  C:\Windows\System\YWnSIPW.exe
  2⤵
  PID:3328
- C:\Windows\System\BmikXLC.exe
  C:\Windows\System\BmikXLC.exe
  2⤵
  PID:3460
- C:\Windows\System\YdnVWCb.exe
  C:\Windows\System\YdnVWCb.exe
  2⤵
  PID:3420
- C:\Windows\System\EZfwyRh.exe
  C:\Windows\System\EZfwyRh.exe
  2⤵
  PID:3544
- C:\Windows\System\uLjFNdx.exe
  C:\Windows\System\uLjFNdx.exe
  2⤵
  PID:3524
- C:\Windows\System\XzzbUYT.exe
  C:\Windows\System\XzzbUYT.exe
  2⤵
  PID:3916
- C:\Windows\System\OVPRzyY.exe
  C:\Windows\System\OVPRzyY.exe
  2⤵
  PID:4012
- C:\Windows\System\cHEzCUa.exe
  C:\Windows\System\cHEzCUa.exe
  2⤵
  PID:1116
- C:\Windows\System\TLWHPLT.exe
  C:\Windows\System\TLWHPLT.exe
  2⤵
  PID:3892
- C:\Windows\System\BoTkfbE.exe
  C:\Windows\System\BoTkfbE.exe
  2⤵
  PID:3824
- C:\Windows\System\jhxbTqW.exe
  C:\Windows\System\jhxbTqW.exe
  2⤵
  PID:3960
- C:\Windows\System\ChxjWrP.exe
  C:\Windows\System\ChxjWrP.exe
  2⤵
  PID:4072
- C:\Windows\System\aOdzxVV.exe
  C:\Windows\System\aOdzxVV.exe
  2⤵
  PID:2740
- C:\Windows\System\opeEqZx.exe
  C:\Windows\System\opeEqZx.exe
  2⤵
  PID:3096
- C:\Windows\System\XddZNiv.exe
  C:\Windows\System\XddZNiv.exe
  2⤵
  PID:3280
- C:\Windows\System\XKQdznL.exe
  C:\Windows\System\XKQdznL.exe
  2⤵
  PID:3356
- C:\Windows\System\FRaVRaW.exe
  C:\Windows\System\FRaVRaW.exe
  2⤵
  PID:3432
- C:\Windows\System\nUOPjlu.exe
  C:\Windows\System\nUOPjlu.exe
  2⤵
  PID:3416
- C:\Windows\System\sgXXbEJ.exe
  C:\Windows\System\sgXXbEJ.exe
  2⤵
  PID:3656
- C:\Windows\System\pnhGugg.exe
  C:\Windows\System\pnhGugg.exe
  2⤵
  PID:3048
- C:\Windows\System\aUkETXq.exe
  C:\Windows\System\aUkETXq.exe
  2⤵
  PID:3744
- C:\Windows\System\ZPmZqKu.exe
  C:\Windows\System\ZPmZqKu.exe
  2⤵
  PID:1980
- C:\Windows\System\QqvKwAn.exe
  C:\Windows\System\QqvKwAn.exe
  2⤵
  PID:3780
- C:\Windows\System\ENcMIyb.exe
  C:\Windows\System\ENcMIyb.exe
  2⤵
  PID:1492
- C:\Windows\System\ajFoPbd.exe
  C:\Windows\System\ajFoPbd.exe
  2⤵
  PID:3944
- C:\Windows\System\RgFDSqy.exe
  C:\Windows\System\RgFDSqy.exe
  2⤵
  PID:4040
- C:\Windows\System\QCtLAic.exe
  C:\Windows\System\QCtLAic.exe
  2⤵
  PID:1996
- C:\Windows\System\dMluoaL.exe
  C:\Windows\System\dMluoaL.exe
  2⤵
  PID:3756
- C:\Windows\System\ALnQpau.exe
  C:\Windows\System\ALnQpau.exe
  2⤵
  PID:1236
- C:\Windows\System\szQuuii.exe
  C:\Windows\System\szQuuii.exe
  2⤵
  PID:2016
- C:\Windows\System\ilKlqJA.exe
  C:\Windows\System\ilKlqJA.exe
  2⤵
  PID:3604
- C:\Windows\System\CTSkilB.exe
  C:\Windows\System\CTSkilB.exe
  2⤵
  PID:3720
- C:\Windows\System\aoPzWaW.exe
  C:\Windows\System\aoPzWaW.exe
  2⤵
  PID:4020
- C:\Windows\System\VfIpkth.exe
  C:\Windows\System\VfIpkth.exe
  2⤵
  PID:592
- C:\Windows\System\DuSfUuP.exe
  C:\Windows\System\DuSfUuP.exe
  2⤵
  PID:1632
- C:\Windows\System\xbSozkZ.exe
  C:\Windows\System\xbSozkZ.exe
  2⤵
  PID:3772
- C:\Windows\System\PNeEOZO.exe
  C:\Windows\System\PNeEOZO.exe
  2⤵
  PID:2656
- C:\Windows\System\xhXDYoT.exe
  C:\Windows\System\xhXDYoT.exe
  2⤵
  PID:756
- C:\Windows\System\mVtCnoY.exe
  C:\Windows\System\mVtCnoY.exe
  2⤵
  PID:3672
- C:\Windows\System\jXhVHer.exe
  C:\Windows\System\jXhVHer.exe
  2⤵
  PID:2088
- C:\Windows\System\mGEEvGT.exe
  C:\Windows\System\mGEEvGT.exe
  2⤵
  PID:3776
- C:\Windows\System\hAAmGQC.exe
  C:\Windows\System\hAAmGQC.exe
  2⤵
  PID:3160
- C:\Windows\System\BAitUIE.exe
  C:\Windows\System\BAitUIE.exe
  2⤵
  PID:904
- C:\Windows\System\TrOQfUm.exe
  C:\Windows\System\TrOQfUm.exe
  2⤵
  PID:4112
- C:\Windows\System\tKGdXqR.exe
  C:\Windows\System\tKGdXqR.exe
  2⤵
  PID:4128
- C:\Windows\System\jcZXrSZ.exe
  C:\Windows\System\jcZXrSZ.exe
  2⤵
  PID:4156
- C:\Windows\System\auIEucm.exe
  C:\Windows\System\auIEucm.exe
  2⤵
  PID:4172
- C:\Windows\System\CLCroXf.exe
  C:\Windows\System\CLCroXf.exe
  2⤵
  PID:4196
- C:\Windows\System\KHPHXpa.exe
  C:\Windows\System\KHPHXpa.exe
  2⤵
  PID:4224
- C:\Windows\System\VfSCPpy.exe
  C:\Windows\System\VfSCPpy.exe
  2⤵
  PID:4240
- C:\Windows\System\zDxWmqI.exe
  C:\Windows\System\zDxWmqI.exe
  2⤵
  PID:4256
- C:\Windows\System\jYHafOR.exe
  C:\Windows\System\jYHafOR.exe
  2⤵
  PID:4272
- C:\Windows\System\JCVTvku.exe
  C:\Windows\System\JCVTvku.exe
  2⤵
  PID:4288
- C:\Windows\System\rtHDLAv.exe
  C:\Windows\System\rtHDLAv.exe
  2⤵
  PID:4304
- C:\Windows\System\UjFLisu.exe
  C:\Windows\System\UjFLisu.exe
  2⤵
  PID:4320
- C:\Windows\System\ieVjiuz.exe
  C:\Windows\System\ieVjiuz.exe
  2⤵
  PID:4336
- C:\Windows\System\JJRFvQu.exe
  C:\Windows\System\JJRFvQu.exe
  2⤵
  PID:4356
- C:\Windows\System\EkVaiAK.exe
  C:\Windows\System\EkVaiAK.exe
  2⤵
  PID:4372
- C:\Windows\System\ichNAUw.exe
  C:\Windows\System\ichNAUw.exe
  2⤵
  PID:4388
- C:\Windows\System\urEaRhj.exe
  C:\Windows\System\urEaRhj.exe
  2⤵
  PID:4404
- C:\Windows\System\dsWigMj.exe
  C:\Windows\System\dsWigMj.exe
  2⤵
  PID:4420
- C:\Windows\System\NsPcrQi.exe
  C:\Windows\System\NsPcrQi.exe
  2⤵
  PID:4436
- C:\Windows\System\vopumMe.exe
  C:\Windows\System\vopumMe.exe
  2⤵
  PID:4452
- C:\Windows\System\TlgLCGG.exe
  C:\Windows\System\TlgLCGG.exe
  2⤵
  PID:4472
- C:\Windows\System\bmptNVb.exe
  C:\Windows\System\bmptNVb.exe
  2⤵
  PID:4488
- C:\Windows\System\eBfOIZw.exe
  C:\Windows\System\eBfOIZw.exe
  2⤵
  PID:4504
- C:\Windows\System\EJOreio.exe
  C:\Windows\System\EJOreio.exe
  2⤵
  PID:4588
- C:\Windows\System\fuJTFND.exe
  C:\Windows\System\fuJTFND.exe
  2⤵
  PID:4604
- C:\Windows\System\ShbUnvZ.exe
  C:\Windows\System\ShbUnvZ.exe
  2⤵
  PID:4620
- C:\Windows\System\ASfNXIK.exe
  C:\Windows\System\ASfNXIK.exe
  2⤵
  PID:4636
- C:\Windows\System\SLZtrhB.exe
  C:\Windows\System\SLZtrhB.exe
  2⤵
  PID:4652
- C:\Windows\System\TwoLhzA.exe
  C:\Windows\System\TwoLhzA.exe
  2⤵
  PID:4668
- C:\Windows\System\JTCFUnR.exe
  C:\Windows\System\JTCFUnR.exe
  2⤵
  PID:4684
- C:\Windows\System\IiwmzMM.exe
  C:\Windows\System\IiwmzMM.exe
  2⤵
  PID:4700
- C:\Windows\System\lcYoXkW.exe
  C:\Windows\System\lcYoXkW.exe
  2⤵
  PID:4724
- C:\Windows\System\vNpyAfq.exe
  C:\Windows\System\vNpyAfq.exe
  2⤵
  PID:4768
- C:\Windows\System\DAokmTr.exe
  C:\Windows\System\DAokmTr.exe
  2⤵
  PID:4784
- C:\Windows\System\rIddFOe.exe
  C:\Windows\System\rIddFOe.exe
  2⤵
  PID:4800
- C:\Windows\System\ZNmzBXS.exe
  C:\Windows\System\ZNmzBXS.exe
  2⤵
  PID:4816
- C:\Windows\System\TcYJcYs.exe
  C:\Windows\System\TcYJcYs.exe
  2⤵
  PID:4832
- C:\Windows\System\kWgEVDl.exe
  C:\Windows\System\kWgEVDl.exe
  2⤵
  PID:4848
- C:\Windows\System\ypCbdRc.exe
  C:\Windows\System\ypCbdRc.exe
  2⤵
  PID:4864
- C:\Windows\System\NdzErVu.exe
  C:\Windows\System\NdzErVu.exe
  2⤵
  PID:4880
- C:\Windows\System\OIiQVkT.exe
  C:\Windows\System\OIiQVkT.exe
  2⤵
  PID:4896
- C:\Windows\System\JMPemxE.exe
  C:\Windows\System\JMPemxE.exe
  2⤵
  PID:4916
- C:\Windows\System\oRjRFHV.exe
  C:\Windows\System\oRjRFHV.exe
  2⤵
  PID:4932
- C:\Windows\System\bVFDKMv.exe
  C:\Windows\System\bVFDKMv.exe
  2⤵
  PID:4992
- C:\Windows\System\QrewDaO.exe
  C:\Windows\System\QrewDaO.exe
  2⤵
  PID:5012
- C:\Windows\System\FeeNnZP.exe
  C:\Windows\System\FeeNnZP.exe
  2⤵
  PID:5028
- C:\Windows\System\PZJoQzg.exe
  C:\Windows\System\PZJoQzg.exe
  2⤵
  PID:5072
- C:\Windows\System\rxtMaNf.exe
  C:\Windows\System\rxtMaNf.exe
  2⤵
  PID:3360
- C:\Windows\System\kpYEhWu.exe
  C:\Windows\System\kpYEhWu.exe
  2⤵
  PID:4100
- C:\Windows\System\udfxrEP.exe
  C:\Windows\System\udfxrEP.exe
  2⤵
  PID:4124
- C:\Windows\System\SqajScU.exe
  C:\Windows\System\SqajScU.exe
  2⤵
  PID:4148
- C:\Windows\System\OGZeWyk.exe
  C:\Windows\System\OGZeWyk.exe
  2⤵
  PID:4180
- C:\Windows\System\GyBXSSw.exe
  C:\Windows\System\GyBXSSw.exe
  2⤵
  PID:4184
- C:\Windows\System\PcqtBWR.exe
  C:\Windows\System\PcqtBWR.exe
  2⤵
  PID:2328
- C:\Windows\System\zocUMaK.exe
  C:\Windows\System\zocUMaK.exe
  2⤵
  PID:4248
- C:\Windows\System\wmhHiPS.exe
  C:\Windows\System\wmhHiPS.exe
  2⤵
  PID:4312
- C:\Windows\System\bGggRfb.exe
  C:\Windows\System\bGggRfb.exe
  2⤵
  PID:4384
- C:\Windows\System\HDOCcbP.exe
  C:\Windows\System\HDOCcbP.exe
  2⤵
  PID:4448
- C:\Windows\System\vNQEJWw.exe
  C:\Windows\System\vNQEJWw.exe
  2⤵
  PID:4236
- C:\Windows\System\TkRupYc.exe
  C:\Windows\System\TkRupYc.exe
  2⤵
  PID:4396
- C:\Windows\System\OIeDYer.exe
  C:\Windows\System\OIeDYer.exe
  2⤵
  PID:4496
- C:\Windows\System\jdgrANS.exe
  C:\Windows\System\jdgrANS.exe
  2⤵
  PID:2156
- C:\Windows\System\cWZbkWY.exe
  C:\Windows\System\cWZbkWY.exe
  2⤵
  PID:4540
- C:\Windows\System\mhQPfWQ.exe
  C:\Windows\System\mhQPfWQ.exe
  2⤵
  PID:4552
- C:\Windows\System\ipoLjyE.exe
  C:\Windows\System\ipoLjyE.exe
  2⤵
  PID:4568
- C:\Windows\System\xFoWKjX.exe
  C:\Windows\System\xFoWKjX.exe
  2⤵
  PID:4584
- C:\Windows\System\JqPiquz.exe
  C:\Windows\System\JqPiquz.exe
  2⤵
  PID:4616
- C:\Windows\System\LZfbZkB.exe
  C:\Windows\System\LZfbZkB.exe
  2⤵
  PID:4632
- C:\Windows\System\oXDPUyI.exe
  C:\Windows\System\oXDPUyI.exe
  2⤵
  PID:4664
- C:\Windows\System\axpiFwb.exe
  C:\Windows\System\axpiFwb.exe
  2⤵
  PID:4720
- C:\Windows\System\hWsKIQg.exe
  C:\Windows\System\hWsKIQg.exe
  2⤵
  PID:4824
- C:\Windows\System\QYqenoL.exe
  C:\Windows\System\QYqenoL.exe
  2⤵
  PID:4888
- C:\Windows\System\PIHGmip.exe
  C:\Windows\System\PIHGmip.exe
  2⤵
  PID:4812
- C:\Windows\System\JzNTvyw.exe
  C:\Windows\System\JzNTvyw.exe
  2⤵
  PID:4904
- C:\Windows\System\vgynwCV.exe
  C:\Windows\System\vgynwCV.exe
  2⤵
  PID:4940
- C:\Windows\System\BQErSOU.exe
  C:\Windows\System\BQErSOU.exe
  2⤵
  PID:4944
- C:\Windows\System\dMjlHzX.exe
  C:\Windows\System\dMjlHzX.exe
  2⤵
  PID:4964
- C:\Windows\System\juJbcqZ.exe
  C:\Windows\System\juJbcqZ.exe
  2⤵
  PID:2304
- C:\Windows\System\WhetYKK.exe
  C:\Windows\System\WhetYKK.exe
  2⤵
  PID:5000
- C:\Windows\System\jdPueaH.exe
  C:\Windows\System\jdPueaH.exe
  2⤵
  PID:5024
- C:\Windows\System\WQUXdOh.exe
  C:\Windows\System\WQUXdOh.exe
  2⤵
  PID:1692
- C:\Windows\System\MLcTuiX.exe
  C:\Windows\System\MLcTuiX.exe
  2⤵
  PID:560
- C:\Windows\System\WqQjrRN.exe
  C:\Windows\System\WqQjrRN.exe
  2⤵
  PID:5052
- C:\Windows\System\DzPJGBm.exe
  C:\Windows\System\DzPJGBm.exe
  2⤵
  PID:1636
- C:\Windows\System\sueFtuZ.exe
  C:\Windows\System\sueFtuZ.exe
  2⤵
  PID:5100
- C:\Windows\System\hvlyusR.exe
  C:\Windows\System\hvlyusR.exe
  2⤵
  PID:4120
- C:\Windows\System\KolxAoQ.exe
  C:\Windows\System\KolxAoQ.exe
  2⤵
  PID:4280
- C:\Windows\System\BJTwSrN.exe
  C:\Windows\System\BJTwSrN.exe
  2⤵
  PID:3912
- C:\Windows\System\gsiFTkR.exe
  C:\Windows\System\gsiFTkR.exe
  2⤵
  PID:4296
- C:\Windows\System\mWUtrub.exe
  C:\Windows\System\mWUtrub.exe
  2⤵
  PID:4468
- C:\Windows\System\nCKZuMq.exe
  C:\Windows\System\nCKZuMq.exe
  2⤵
  PID:4352
- C:\Windows\System\pvmMbfL.exe
  C:\Windows\System\pvmMbfL.exe
  2⤵
  PID:4556
- C:\Windows\System\qJewXzy.exe
  C:\Windows\System\qJewXzy.exe
  2⤵
  PID:4364
- C:\Windows\System\FFlapaV.exe
  C:\Windows\System\FFlapaV.exe
  2⤵
  PID:4580
- C:\Windows\System\moaVJuA.exe
  C:\Windows\System\moaVJuA.exe
  2⤵
  PID:4560
- C:\Windows\System\ETgOeNK.exe
  C:\Windows\System\ETgOeNK.exe
  2⤵
  PID:4232
- C:\Windows\System\HQFEWCL.exe
  C:\Windows\System\HQFEWCL.exe
  2⤵
  PID:4460
- C:\Windows\System\JSUqETZ.exe
  C:\Windows\System\JSUqETZ.exe
  2⤵
  PID:4612
- C:\Windows\System\hUHdcjw.exe
  C:\Windows\System\hUHdcjw.exe
  2⤵
  PID:4648
- C:\Windows\System\RvlvojJ.exe
  C:\Windows\System\RvlvojJ.exe
  2⤵
  PID:4752
- C:\Windows\System\nTohwaz.exe
  C:\Windows\System\nTohwaz.exe
  2⤵
  PID:4764
- C:\Windows\System\NREJAXZ.exe
  C:\Windows\System\NREJAXZ.exe
  2⤵
  PID:2164
- C:\Windows\System\YiOXlLS.exe
  C:\Windows\System\YiOXlLS.exe
  2⤵
  PID:2992
- C:\Windows\System\vuVqWLq.exe
  C:\Windows\System\vuVqWLq.exe
  2⤵
  PID:4928
- C:\Windows\System\aDCiQEX.exe
  C:\Windows\System\aDCiQEX.exe
  2⤵
  PID:5008
- C:\Windows\System\hRDcTLw.exe
  C:\Windows\System\hRDcTLw.exe
  2⤵
  PID:5124
- C:\Windows\System\QMEIgyh.exe
  C:\Windows\System\QMEIgyh.exe
  2⤵
  PID:5144
- C:\Windows\System\tmCuUsf.exe
  C:\Windows\System\tmCuUsf.exe
  2⤵
  PID:5160
- C:\Windows\System\LMJdoEn.exe
  C:\Windows\System\LMJdoEn.exe
  2⤵
  PID:5176
- C:\Windows\System\SeyrUrC.exe
  C:\Windows\System\SeyrUrC.exe
  2⤵
  PID:5192
- C:\Windows\System\sZTtIVK.exe
  C:\Windows\System\sZTtIVK.exe
  2⤵
  PID:5208
- C:\Windows\System\CsllTiV.exe
  C:\Windows\System\CsllTiV.exe
  2⤵
  PID:5224
- C:\Windows\System\lnhwHZj.exe
  C:\Windows\System\lnhwHZj.exe
  2⤵
  PID:5256
- C:\Windows\System\APDSYwL.exe
  C:\Windows\System\APDSYwL.exe
  2⤵
  PID:5272
- C:\Windows\System\mjefaFo.exe
  C:\Windows\System\mjefaFo.exe
  2⤵
  PID:5288
- C:\Windows\System\NAHeGIh.exe
  C:\Windows\System\NAHeGIh.exe
  2⤵
  PID:5304
- C:\Windows\System\OgqqtFT.exe
  C:\Windows\System\OgqqtFT.exe
  2⤵
  PID:5320
- C:\Windows\System\aboeVKm.exe
  C:\Windows\System\aboeVKm.exe
  2⤵
  PID:5440
- C:\Windows\System\CpRnncS.exe
  C:\Windows\System\CpRnncS.exe
  2⤵
  PID:5456
- C:\Windows\System\geevqpg.exe
  C:\Windows\System\geevqpg.exe
  2⤵
  PID:5480
- C:\Windows\System\ofNTTCq.exe
  C:\Windows\System\ofNTTCq.exe
  2⤵
  PID:5496
- C:\Windows\System\csjoJDo.exe
  C:\Windows\System\csjoJDo.exe
  2⤵
  PID:5512
- C:\Windows\System\jeFDGAT.exe
  C:\Windows\System\jeFDGAT.exe
  2⤵
  PID:5532
- C:\Windows\System\vggIMgd.exe
  C:\Windows\System\vggIMgd.exe
  2⤵
  PID:5552
- C:\Windows\System\tIkOTrG.exe
  C:\Windows\System\tIkOTrG.exe
  2⤵
  PID:5572
- C:\Windows\System\nSHSVEi.exe
  C:\Windows\System\nSHSVEi.exe
  2⤵
  PID:5592
- C:\Windows\System\jbgMXlR.exe
  C:\Windows\System\jbgMXlR.exe
  2⤵
  PID:5608
- C:\Windows\System\KtKOUNP.exe
  C:\Windows\System\KtKOUNP.exe
  2⤵
  PID:5624
- C:\Windows\System\jMFojnP.exe
  C:\Windows\System\jMFojnP.exe
  2⤵
  PID:5640
- C:\Windows\System\MhXhXOw.exe
  C:\Windows\System\MhXhXOw.exe
  2⤵
  PID:5656
- C:\Windows\System\mqEHdPl.exe
  C:\Windows\System\mqEHdPl.exe
  2⤵
  PID:5672
- C:\Windows\System\jNKkFoN.exe
  C:\Windows\System\jNKkFoN.exe
  2⤵
  PID:5688
- C:\Windows\System\ifHbXkP.exe
  C:\Windows\System\ifHbXkP.exe
  2⤵
  PID:5708
- C:\Windows\System\pYrvueC.exe
  C:\Windows\System\pYrvueC.exe
  2⤵
  PID:5724
- C:\Windows\System\SpDePxR.exe
  C:\Windows\System\SpDePxR.exe
  2⤵
  PID:5740
- C:\Windows\System\uhgGbXc.exe
  C:\Windows\System\uhgGbXc.exe
  2⤵
  PID:5756
- C:\Windows\System\eRPZRdZ.exe
  C:\Windows\System\eRPZRdZ.exe
  2⤵
  PID:5772
- C:\Windows\System\gqFMiFG.exe
  C:\Windows\System\gqFMiFG.exe
  2⤵
  PID:5788
- C:\Windows\System\MplxFXw.exe
  C:\Windows\System\MplxFXw.exe
  2⤵
  PID:5808
- C:\Windows\System\ACvVugX.exe
  C:\Windows\System\ACvVugX.exe
  2⤵
  PID:5912
- C:\Windows\System\CZHEduS.exe
  C:\Windows\System\CZHEduS.exe
  2⤵
  PID:5928
- C:\Windows\System\LhFzYQA.exe
  C:\Windows\System\LhFzYQA.exe
  2⤵
  PID:5944
- C:\Windows\System\PasMVoJ.exe
  C:\Windows\System\PasMVoJ.exe
  2⤵
  PID:5960
- C:\Windows\System\nmmHilF.exe
  C:\Windows\System\nmmHilF.exe
  2⤵
  PID:5976
- C:\Windows\System\FXjjFYZ.exe
  C:\Windows\System\FXjjFYZ.exe
  2⤵
  PID:5996
- C:\Windows\System\cTjFOhH.exe
  C:\Windows\System\cTjFOhH.exe
  2⤵
  PID:6012
- C:\Windows\System\VGcEXKh.exe
  C:\Windows\System\VGcEXKh.exe
  2⤵
  PID:6028
- C:\Windows\System\NcVGvmI.exe
  C:\Windows\System\NcVGvmI.exe
  2⤵
  PID:6044
- C:\Windows\System\iaVJGkT.exe
  C:\Windows\System\iaVJGkT.exe
  2⤵
  PID:6060
- C:\Windows\System\hKVZUSc.exe
  C:\Windows\System\hKVZUSc.exe
  2⤵
  PID:6076
- C:\Windows\System\TLpUtuk.exe
  C:\Windows\System\TLpUtuk.exe
  2⤵
  PID:6092
- C:\Windows\System\qlUXHWM.exe
  C:\Windows\System\qlUXHWM.exe
  2⤵
  PID:6108
- C:\Windows\System\XQbydCZ.exe
  C:\Windows\System\XQbydCZ.exe
  2⤵
  PID:6124
- C:\Windows\System\rrKiwDl.exe
  C:\Windows\System\rrKiwDl.exe
  2⤵
  PID:6140
- C:\Windows\System\kYRXBfn.exe
  C:\Windows\System\kYRXBfn.exe
  2⤵
  PID:4108
- C:\Windows\System\dgmNfhm.exe
  C:\Windows\System\dgmNfhm.exe
  2⤵
  PID:4140
- C:\Windows\System\JBtZjpb.exe
  C:\Windows\System\JBtZjpb.exe
  2⤵
  PID:4856
- C:\Windows\System\QwIeDMG.exe
  C:\Windows\System\QwIeDMG.exe
  2⤵
  PID:5020
- C:\Windows\System\pVtVpWb.exe
  C:\Windows\System\pVtVpWb.exe
  2⤵
  PID:4600
- C:\Windows\System\ixyZmHV.exe
  C:\Windows\System\ixyZmHV.exe
  2⤵
  PID:4528
- C:\Windows\System\hUUUsWR.exe
  C:\Windows\System\hUUUsWR.exe
  2⤵
  PID:5088
- C:\Windows\System\rXFZIIR.exe
  C:\Windows\System\rXFZIIR.exe
  2⤵
  PID:5184
- C:\Windows\System\JGMcXvD.exe
  C:\Windows\System\JGMcXvD.exe
  2⤵
  PID:4332
- C:\Windows\System\oeDmjrO.exe
  C:\Windows\System\oeDmjrO.exe
  2⤵
  PID:4484
- C:\Windows\System\aZSZODW.exe
  C:\Windows\System\aZSZODW.exe
  2⤵
  PID:4480
- C:\Windows\System\JWfaAHq.exe
  C:\Windows\System\JWfaAHq.exe
  2⤵
  PID:5136
- C:\Windows\System\LjsLnPC.exe
  C:\Windows\System\LjsLnPC.exe
  2⤵
  PID:1664
- C:\Windows\System\JTjpPUq.exe
  C:\Windows\System\JTjpPUq.exe
  2⤵
  PID:5040
- C:\Windows\System\UjFuTHk.exe
  C:\Windows\System\UjFuTHk.exe
  2⤵
  PID:5092
- C:\Windows\System\UccDCEA.exe
  C:\Windows\System\UccDCEA.exe
  2⤵
  PID:4268
- C:\Windows\System\HpoFDVz.exe
  C:\Windows\System\HpoFDVz.exe
  2⤵
  PID:4716
- C:\Windows\System\xxawSgB.exe
  C:\Windows\System\xxawSgB.exe
  2⤵
  PID:4976
- C:\Windows\System\sWVaoko.exe
  C:\Windows\System\sWVaoko.exe
  2⤵
  PID:5168
- C:\Windows\System\hYJVgVy.exe
  C:\Windows\System\hYJVgVy.exe
  2⤵
  PID:5244
- C:\Windows\System\yahPiwL.exe
  C:\Windows\System\yahPiwL.exe
  2⤵
  PID:5328
- C:\Windows\System\oWGDSMT.exe
  C:\Windows\System\oWGDSMT.exe
  2⤵
  PID:5284
- C:\Windows\System\YyebmVd.exe
  C:\Windows\System\YyebmVd.exe
  2⤵
  PID:5348
- C:\Windows\System\hoJUzWT.exe
  C:\Windows\System\hoJUzWT.exe
  2⤵
  PID:5368
- C:\Windows\System\gaWiSaA.exe
  C:\Windows\System\gaWiSaA.exe
  2⤵
  PID:5372
- C:\Windows\System\aYplvcr.exe
  C:\Windows\System\aYplvcr.exe
  2⤵
  PID:5384
- C:\Windows\System\mGUalCh.exe
  C:\Windows\System\mGUalCh.exe
  2⤵
  PID:5400
- C:\Windows\System\DOFdAez.exe
  C:\Windows\System\DOFdAez.exe
  2⤵
  PID:5428
- C:\Windows\System\ViSSngu.exe
  C:\Windows\System\ViSSngu.exe
  2⤵
  PID:5472
- C:\Windows\System\RWAAAhB.exe
  C:\Windows\System\RWAAAhB.exe
  2⤵
  PID:5540
- C:\Windows\System\GuhNNYb.exe
  C:\Windows\System\GuhNNYb.exe
  2⤵
  PID:5468
- C:\Windows\System\AISoYRT.exe
  C:\Windows\System\AISoYRT.exe
  2⤵
  PID:5652
- C:\Windows\System\OUBtAVr.exe
  C:\Windows\System\OUBtAVr.exe
  2⤵
  PID:5752
- C:\Windows\System\AmGIyYb.exe
  C:\Windows\System\AmGIyYb.exe
  2⤵
  PID:5548
- C:\Windows\System\kcjJHOh.exe
  C:\Windows\System\kcjJHOh.exe
  2⤵
  PID:5680
- C:\Windows\System\MAkTmWQ.exe
  C:\Windows\System\MAkTmWQ.exe
  2⤵
  PID:5848
- C:\Windows\System\hFYWcmu.exe
  C:\Windows\System\hFYWcmu.exe
  2⤵
  PID:5864
- C:\Windows\System\DKaFLie.exe
  C:\Windows\System\DKaFLie.exe
  2⤵
  PID:5632
- C:\Windows\System\NBeAnQo.exe
  C:\Windows\System\NBeAnQo.exe
  2⤵
  PID:5888
- C:\Windows\System\QoKEHyg.exe
  C:\Windows\System\QoKEHyg.exe
  2⤵
  PID:5904
- C:\Windows\System\tflbcHR.exe
  C:\Windows\System\tflbcHR.exe
  2⤵
  PID:5664
- C:\Windows\System\AMMFQwi.exe
  C:\Windows\System\AMMFQwi.exe
  2⤵
  PID:6008
- C:\Windows\System\AvjIwja.exe
  C:\Windows\System\AvjIwja.exe
  2⤵
  PID:6072
- C:\Windows\System\hRkyULh.exe
  C:\Windows\System\hRkyULh.exe
  2⤵
  PID:5972
- C:\Windows\System\rowHkwJ.exe
  C:\Windows\System\rowHkwJ.exe
  2⤵
  PID:4220
- C:\Windows\System\cBTXBpd.exe
  C:\Windows\System\cBTXBpd.exe
  2⤵
  PID:5220
- C:\Windows\System\PUWKVxH.exe
  C:\Windows\System\PUWKVxH.exe
  2⤵
  PID:5240
- C:\Windows\System\cGbZeeA.exe
  C:\Windows\System\cGbZeeA.exe
  2⤵
  PID:4520
- C:\Windows\System\savWDpw.exe
  C:\Windows\System\savWDpw.exe
  2⤵
  PID:5332
- C:\Windows\System\FNszbFH.exe
  C:\Windows\System\FNszbFH.exe
  2⤵
  PID:5956
- C:\Windows\System\yubgxqd.exe
  C:\Windows\System\yubgxqd.exe
  2⤵
  PID:6020
- C:\Windows\System\ASLJwld.exe
  C:\Windows\System\ASLJwld.exe
  2⤵
  PID:6084
- C:\Windows\System\xGjwYVH.exe
  C:\Windows\System\xGjwYVH.exe
  2⤵
  PID:4876
- C:\Windows\System\oamJnOa.exe
  C:\Windows\System\oamJnOa.exe
  2⤵
  PID:4512
- C:\Windows\System\pQuldJl.exe
  C:\Windows\System\pQuldJl.exe
  2⤵
  PID:5316
- C:\Windows\System\ABnvUZW.exe
  C:\Windows\System\ABnvUZW.exe
  2⤵
  PID:5352
- C:\Windows\System\Drggrnm.exe
  C:\Windows\System\Drggrnm.exe
  2⤵
  PID:5156
- C:\Windows\System\hzSmTna.exe
  C:\Windows\System\hzSmTna.exe
  2⤵
  PID:4748
- C:\Windows\System\UJOJxTE.exe
  C:\Windows\System\UJOJxTE.exe
  2⤵
  PID:4984
- C:\Windows\System\fPorJHg.exe
  C:\Windows\System\fPorJHg.exe
  2⤵
  PID:4464
- C:\Windows\System\oFBUNNj.exe
  C:\Windows\System\oFBUNNj.exe
  2⤵
  PID:5296
- C:\Windows\System\DgSyyOv.exe
  C:\Windows\System\DgSyyOv.exe
  2⤵
  PID:5344
- C:\Windows\System\ctatgAq.exe
  C:\Windows\System\ctatgAq.exe
  2⤵
  PID:2856
- C:\Windows\System\gABroaa.exe
  C:\Windows\System\gABroaa.exe
  2⤵
  PID:5412
- C:\Windows\System\fvuFhyy.exe
  C:\Windows\System\fvuFhyy.exe
  2⤵
  PID:5416
- C:\Windows\System\jfOtcOT.exe
  C:\Windows\System\jfOtcOT.exe
  2⤵
  PID:5784
- C:\Windows\System\JJtTBJL.exe
  C:\Windows\System\JJtTBJL.exe
  2⤵
  PID:5436
- C:\Windows\System\othEAuU.exe
  C:\Windows\System\othEAuU.exe
  2⤵
  PID:5828
- C:\Windows\System\cCxhcIN.exe
  C:\Windows\System\cCxhcIN.exe
  2⤵
  PID:5824
- C:\Windows\System\ZTABYiL.exe
  C:\Windows\System\ZTABYiL.exe
  2⤵
  PID:5832
- C:\Windows\System\ZmGLWUM.exe
  C:\Windows\System\ZmGLWUM.exe
  2⤵
  PID:5884
- C:\Windows\System\FbLkjft.exe
  C:\Windows\System\FbLkjft.exe
  2⤵
  PID:5696
- C:\Windows\System\aSoxeqz.exe
  C:\Windows\System\aSoxeqz.exe
  2⤵
  PID:5452
- C:\Windows\System\svRwjvc.exe
  C:\Windows\System\svRwjvc.exe
  2⤵
  PID:5560
- C:\Windows\System\KSBWBwx.exe
  C:\Windows\System\KSBWBwx.exe
  2⤵
  PID:5604
- C:\Windows\System\GcqBLuM.exe
  C:\Windows\System\GcqBLuM.exe
  2⤵
  PID:5936
- C:\Windows\System\CrLUXgC.exe
  C:\Windows\System\CrLUXgC.exe
  2⤵
  PID:6004
- C:\Windows\System\LHXopmg.exe
  C:\Windows\System\LHXopmg.exe
  2⤵
  PID:6104
- C:\Windows\System\cVEpTeW.exe
  C:\Windows\System\cVEpTeW.exe
  2⤵
  PID:3088
- C:\Windows\System\EwejoGu.exe
  C:\Windows\System\EwejoGu.exe
  2⤵
  PID:5232
- C:\Windows\System\MkAJPoS.exe
  C:\Windows\System\MkAJPoS.exe
  2⤵
  PID:5920
- C:\Windows\System\jOpVMfH.exe
  C:\Windows\System\jOpVMfH.exe
  2⤵
  PID:6052
- C:\Windows\System\cqCYpNM.exe
  C:\Windows\System\cqCYpNM.exe
  2⤵
  PID:5364
- C:\Windows\System\infBNSv.exe
  C:\Windows\System\infBNSv.exe
  2⤵
  PID:4216
- C:\Windows\System\gKxBOFv.exe
  C:\Windows\System\gKxBOFv.exe
  2⤵
  PID:4792
- C:\Windows\System\nEpKfUA.exe
  C:\Windows\System\nEpKfUA.exe
  2⤵
  PID:5992
- C:\Windows\System\yvihAnw.exe
  C:\Windows\System\yvihAnw.exe
  2⤵
  PID:5408
- C:\Windows\System\nYDSQSV.exe
  C:\Windows\System\nYDSQSV.exe
  2⤵
  PID:5504
- C:\Windows\System\haVjCzu.exe
  C:\Windows\System\haVjCzu.exe
  2⤵
  PID:2268
- C:\Windows\System\VZVyExa.exe
  C:\Windows\System\VZVyExa.exe
  2⤵
  PID:5420
- C:\Windows\System\SnzSTwm.exe
  C:\Windows\System\SnzSTwm.exe
  2⤵
  PID:5720
- C:\Windows\System\GotyAFq.exe
  C:\Windows\System\GotyAFq.exe
  2⤵
  PID:5588
- C:\Windows\System\oCyrquc.exe
  C:\Windows\System\oCyrquc.exe
  2⤵
  PID:5860
- C:\Windows\System\PVnlMWe.exe
  C:\Windows\System\PVnlMWe.exe
  2⤵
  PID:1700
- C:\Windows\System\mCUBMyk.exe
  C:\Windows\System\mCUBMyk.exe
  2⤵
  PID:4956
- C:\Windows\System\BxBvRUp.exe
  C:\Windows\System\BxBvRUp.exe
  2⤵
  PID:5152
- C:\Windows\System\uksqhGA.exe
  C:\Windows\System\uksqhGA.exe
  2⤵
  PID:2852
- C:\Windows\System\gaXUMPG.exe
  C:\Windows\System\gaXUMPG.exe
  2⤵
  PID:4760
- C:\Windows\System\fYYquTy.exe
  C:\Windows\System\fYYquTy.exe
  2⤵
  PID:5108
- C:\Windows\System\AAJjwwq.exe
  C:\Windows\System\AAJjwwq.exe
  2⤵
  PID:5236
- C:\Windows\System\YxVNUti.exe
  C:\Windows\System\YxVNUti.exe
  2⤵
  PID:5820
- C:\Windows\System\ItfANgf.exe
  C:\Windows\System\ItfANgf.exe
  2⤵
  PID:5524
- C:\Windows\System\OnyODZF.exe
  C:\Windows\System\OnyODZF.exe
  2⤵
  PID:5736
- C:\Windows\System\YGjHEUz.exe
  C:\Windows\System\YGjHEUz.exe
  2⤵
  PID:5840
- C:\Windows\System\WhMqsiq.exe
  C:\Windows\System\WhMqsiq.exe
  2⤵
  PID:4912
- C:\Windows\System\kHesELA.exe
  C:\Windows\System\kHesELA.exe
  2⤵
  PID:6156
- C:\Windows\System\mqsFDbj.exe
  C:\Windows\System\mqsFDbj.exe
  2⤵
  PID:6172
- C:\Windows\System\MgYxWEO.exe
  C:\Windows\System\MgYxWEO.exe
  2⤵
  PID:6188
- C:\Windows\System\hyFMPsd.exe
  C:\Windows\System\hyFMPsd.exe
  2⤵
  PID:6204
- C:\Windows\System\SNsABTG.exe
  C:\Windows\System\SNsABTG.exe
  2⤵
  PID:6220
- C:\Windows\System\aIzeQcq.exe
  C:\Windows\System\aIzeQcq.exe
  2⤵
  PID:6236
- C:\Windows\System\QpCbFBE.exe
  C:\Windows\System\QpCbFBE.exe
  2⤵
  PID:6252
- C:\Windows\System\uuXVINp.exe
  C:\Windows\System\uuXVINp.exe
  2⤵
  PID:6268
- C:\Windows\System\cCFrXep.exe
  C:\Windows\System\cCFrXep.exe
  2⤵
  PID:6284
- C:\Windows\System\mzhIQUu.exe
  C:\Windows\System\mzhIQUu.exe
  2⤵
  PID:6300
- C:\Windows\System\psZfxeG.exe
  C:\Windows\System\psZfxeG.exe
  2⤵
  PID:6316
- C:\Windows\System\PSrpybR.exe
  C:\Windows\System\PSrpybR.exe
  2⤵
  PID:6332
- C:\Windows\System\FCLwjdL.exe
  C:\Windows\System\FCLwjdL.exe
  2⤵
  PID:6352
- C:\Windows\System\HObydtr.exe
  C:\Windows\System\HObydtr.exe
  2⤵
  PID:6368
- C:\Windows\System\EkUCgnA.exe
  C:\Windows\System\EkUCgnA.exe
  2⤵
  PID:6388
- C:\Windows\System\CyiyPQs.exe
  C:\Windows\System\CyiyPQs.exe
  2⤵
  PID:6404
- C:\Windows\System\jvmtITu.exe
  C:\Windows\System\jvmtITu.exe
  2⤵
  PID:6420
- C:\Windows\System\WpfCHIp.exe
  C:\Windows\System\WpfCHIp.exe
  2⤵
  PID:6436
- C:\Windows\System\vZiQXop.exe
  C:\Windows\System\vZiQXop.exe
  2⤵
  PID:6452
- C:\Windows\System\RTzBGtZ.exe
  C:\Windows\System\RTzBGtZ.exe
  2⤵
  PID:6468
- C:\Windows\System\oLOSbNZ.exe
  C:\Windows\System\oLOSbNZ.exe
  2⤵
  PID:6484
- C:\Windows\System\EMZOqCI.exe
  C:\Windows\System\EMZOqCI.exe
  2⤵
  PID:6500
- C:\Windows\System\sgxJzyS.exe
  C:\Windows\System\sgxJzyS.exe
  2⤵
  PID:6516
- C:\Windows\System\NoaZFxd.exe
  C:\Windows\System\NoaZFxd.exe
  2⤵
  PID:6532
- C:\Windows\System\EcgQYHc.exe
  C:\Windows\System\EcgQYHc.exe
  2⤵
  PID:6548
- C:\Windows\System\wVylFPC.exe
  C:\Windows\System\wVylFPC.exe
  2⤵
  PID:6564
- C:\Windows\System\bEVJKsv.exe
  C:\Windows\System\bEVJKsv.exe
  2⤵
  PID:6580
- C:\Windows\System\fjPShUz.exe
  C:\Windows\System\fjPShUz.exe
  2⤵
  PID:6596
- C:\Windows\System\UJvlUbw.exe
  C:\Windows\System\UJvlUbw.exe
  2⤵
  PID:6612
- C:\Windows\System\XBUBJHg.exe
  C:\Windows\System\XBUBJHg.exe
  2⤵
  PID:6628
- C:\Windows\System\jMPMfMn.exe
  C:\Windows\System\jMPMfMn.exe
  2⤵
  PID:6644
- C:\Windows\System\esPGBSV.exe
  C:\Windows\System\esPGBSV.exe
  2⤵
  PID:6660
- C:\Windows\System\fhyorKH.exe
  C:\Windows\System\fhyorKH.exe
  2⤵
  PID:6676
- C:\Windows\System\eXtYvMG.exe
  C:\Windows\System\eXtYvMG.exe
  2⤵
  PID:6692
- C:\Windows\System\KzLGLpU.exe
  C:\Windows\System\KzLGLpU.exe
  2⤵
  PID:6708
- C:\Windows\System\SzqyJbB.exe
  C:\Windows\System\SzqyJbB.exe
  2⤵
  PID:6724
- C:\Windows\System\JHIgmFu.exe
  C:\Windows\System\JHIgmFu.exe
  2⤵
  PID:6740
- C:\Windows\System\uUxCCBm.exe
  C:\Windows\System\uUxCCBm.exe
  2⤵
  PID:6756
- C:\Windows\System\cHOvQRo.exe
  C:\Windows\System\cHOvQRo.exe
  2⤵
  PID:6772
- C:\Windows\System\LMScXPm.exe
  C:\Windows\System\LMScXPm.exe
  2⤵
  PID:6788
- C:\Windows\System\XAYcbOD.exe
  C:\Windows\System\XAYcbOD.exe
  2⤵
  PID:6804
- C:\Windows\System\QPcPlMv.exe
  C:\Windows\System\QPcPlMv.exe
  2⤵
  PID:6820
- C:\Windows\System\hQBHdPC.exe
  C:\Windows\System\hQBHdPC.exe
  2⤵
  PID:6836
- C:\Windows\System\SFCAEAO.exe
  C:\Windows\System\SFCAEAO.exe
  2⤵
  PID:6852
- C:\Windows\System\mClRiaY.exe
  C:\Windows\System\mClRiaY.exe
  2⤵
  PID:6868
- C:\Windows\System\tKlpeCh.exe
  C:\Windows\System\tKlpeCh.exe
  2⤵
  PID:6884
- C:\Windows\System\akHBXru.exe
  C:\Windows\System\akHBXru.exe
  2⤵
  PID:6900
- C:\Windows\System\HIXiSTF.exe
  C:\Windows\System\HIXiSTF.exe
  2⤵
  PID:6916
- C:\Windows\System\ikduUZO.exe
  C:\Windows\System\ikduUZO.exe
  2⤵
  PID:6932
- C:\Windows\System\uxrbMgq.exe
  C:\Windows\System\uxrbMgq.exe
  2⤵
  PID:6948
- C:\Windows\System\rvVuUIN.exe
  C:\Windows\System\rvVuUIN.exe
  2⤵
  PID:6964
- C:\Windows\System\YFCAKpm.exe
  C:\Windows\System\YFCAKpm.exe
  2⤵
  PID:6980
- C:\Windows\System\MMHrPpF.exe
  C:\Windows\System\MMHrPpF.exe
  2⤵
  PID:6996
- C:\Windows\System\poeAGoT.exe
  C:\Windows\System\poeAGoT.exe
  2⤵
  PID:7012
- C:\Windows\System\iZioodH.exe
  C:\Windows\System\iZioodH.exe
  2⤵
  PID:7028
- C:\Windows\System\JqWdTCq.exe
  C:\Windows\System\JqWdTCq.exe
  2⤵
  PID:7044
- C:\Windows\System\ZYfqvuW.exe
  C:\Windows\System\ZYfqvuW.exe
  2⤵
  PID:7060
- C:\Windows\System\TXNunxv.exe
  C:\Windows\System\TXNunxv.exe
  2⤵
  PID:7076
- C:\Windows\System\tSBxGuK.exe
  C:\Windows\System\tSBxGuK.exe
  2⤵
  PID:7092
- C:\Windows\System\TezYCho.exe
  C:\Windows\System\TezYCho.exe
  2⤵
  PID:7108
- C:\Windows\System\tNVZskA.exe
  C:\Windows\System\tNVZskA.exe
  2⤵
  PID:7124
- C:\Windows\System\dwETXlU.exe
  C:\Windows\System\dwETXlU.exe
  2⤵
  PID:7140
- C:\Windows\System\wYycwTt.exe
  C:\Windows\System\wYycwTt.exe
  2⤵
  PID:7156
- C:\Windows\System\dKXgbJU.exe
  C:\Windows\System\dKXgbJU.exe
  2⤵
  PID:5312
- C:\Windows\System\ZdeVoiI.exe
  C:\Windows\System\ZdeVoiI.exe
  2⤵
  PID:6148
- C:\Windows\System\sRPfAqA.exe
  C:\Windows\System\sRPfAqA.exe
  2⤵
  PID:5796
- C:\Windows\System\kVzhcNM.exe
  C:\Windows\System\kVzhcNM.exe
  2⤵
  PID:836
- C:\Windows\System\yPPaVZX.exe
  C:\Windows\System\yPPaVZX.exe
  2⤵
  PID:5896
- C:\Windows\System\xhpnHAt.exe
  C:\Windows\System\xhpnHAt.exe
  2⤵
  PID:6180
- C:\Windows\System\TjctouC.exe
  C:\Windows\System\TjctouC.exe
  2⤵
  PID:6216
- C:\Windows\System\gsCSJhf.exe
  C:\Windows\System\gsCSJhf.exe
  2⤵
  PID:6276
- C:\Windows\System\GnzjqOY.exe
  C:\Windows\System\GnzjqOY.exe
  2⤵
  PID:6340
- C:\Windows\System\lhtFkbL.exe
  C:\Windows\System\lhtFkbL.exe
  2⤵
  PID:6324
- C:\Windows\System\yvElIwm.exe
  C:\Windows\System\yvElIwm.exe
  2⤵
  PID:6412
- C:\Windows\System\nICrdfR.exe
  C:\Windows\System\nICrdfR.exe
  2⤵
  PID:6444
- C:\Windows\System\RlljpOR.exe
  C:\Windows\System\RlljpOR.exe
  2⤵
  PID:6508
- C:\Windows\System\KpWMtxS.exe
  C:\Windows\System\KpWMtxS.exe
  2⤵
  PID:6296
- C:\Windows\System\MJEueha.exe
  C:\Windows\System\MJEueha.exe
  2⤵
  PID:6544
- C:\Windows\System\QCjheDF.exe
  C:\Windows\System\QCjheDF.exe
  2⤵
  PID:6572
- C:\Windows\System\IPwzEcj.exe
  C:\Windows\System\IPwzEcj.exe
  2⤵
  PID:6428
- C:\Windows\System\XVBCBzf.exe
  C:\Windows\System\XVBCBzf.exe
  2⤵
  PID:6608
- C:\Windows\System\obePazY.exe
  C:\Windows\System\obePazY.exe
  2⤵
  PID:6496
- C:\Windows\System\xxrEJNb.exe
  C:\Windows\System\xxrEJNb.exe
  2⤵
  PID:6624
- C:\Windows\System\jpieuLq.exe
  C:\Windows\System\jpieuLq.exe
  2⤵
  PID:6668
- C:\Windows\System\JCfePAm.exe
  C:\Windows\System\JCfePAm.exe
  2⤵
  PID:6732
- C:\Windows\System\BFLLxPc.exe
  C:\Windows\System\BFLLxPc.exe
  2⤵
  PID:6768
- C:\Windows\System\FomknQl.exe
  C:\Windows\System\FomknQl.exe
  2⤵
  PID:6780
- C:\Windows\System\BDmTgDe.exe
  C:\Windows\System\BDmTgDe.exe
  2⤵
  PID:6752
- C:\Windows\System\rKSpRnr.exe
  C:\Windows\System\rKSpRnr.exe
  2⤵
  PID:6832
- C:\Windows\System\zIwZPSc.exe
  C:\Windows\System\zIwZPSc.exe
  2⤵
  PID:6844
- C:\Windows\System\MIhdrOz.exe
  C:\Windows\System\MIhdrOz.exe
  2⤵
  PID:6876
- C:\Windows\System\qXmQkln.exe
  C:\Windows\System\qXmQkln.exe
  2⤵
  PID:6928
- C:\Windows\System\zOIJjeg.exe
  C:\Windows\System\zOIJjeg.exe
  2⤵
  PID:6880
- C:\Windows\System\HGolnNx.exe
  C:\Windows\System\HGolnNx.exe
  2⤵
  PID:6940
- C:\Windows\System\JszBCSJ.exe
  C:\Windows\System\JszBCSJ.exe
  2⤵
  PID:6944
- C:\Windows\System\pzRQJtT.exe
  C:\Windows\System\pzRQJtT.exe
  2⤵
  PID:7036
- C:\Windows\System\kGqPjVD.exe
  C:\Windows\System\kGqPjVD.exe
  2⤵
  PID:7084
- C:\Windows\System\DYyLclG.exe
  C:\Windows\System\DYyLclG.exe
  2⤵
  PID:7148
- C:\Windows\System\YEQmbUw.exe
  C:\Windows\System\YEQmbUw.exe
  2⤵
  PID:7100
- C:\Windows\System\BqokRDP.exe
  C:\Windows\System\BqokRDP.exe
  2⤵
  PID:7164
- C:\Windows\System\AKCENnH.exe
  C:\Windows\System\AKCENnH.exe
  2⤵
  PID:5600
- C:\Windows\System\uxquene.exe
  C:\Windows\System\uxquene.exe
  2⤵
  PID:5584
- C:\Windows\System\oxyEBqF.exe
  C:\Windows\System\oxyEBqF.exe
  2⤵
  PID:6196
- C:\Windows\System\szHlGNj.exe
  C:\Windows\System\szHlGNj.exe
  2⤵
  PID:6348
- C:\Windows\System\qDdGOtM.exe
  C:\Windows\System\qDdGOtM.exe
  2⤵
  PID:6360
- C:\Windows\System\NvkeOYF.exe
  C:\Windows\System\NvkeOYF.exe
  2⤵
  PID:6384
- C:\Windows\System\GPhxCzV.exe
  C:\Windows\System\GPhxCzV.exe
  2⤵
  PID:6396
- C:\Windows\System\owgwYJg.exe
  C:\Windows\System\owgwYJg.exe
  2⤵
  PID:6264
- C:\Windows\System\JTixXhK.exe
  C:\Windows\System\JTixXhK.exe
  2⤵
  PID:6704
- C:\Windows\System\vfrchQW.exe
  C:\Windows\System\vfrchQW.exe
  2⤵
  PID:6540
- C:\Windows\System\YsURJVL.exe
  C:\Windows\System\YsURJVL.exe
  2⤵
  PID:6812
- C:\Windows\System\crcBTnA.exe
  C:\Windows\System\crcBTnA.exe
  2⤵
  PID:6576
- C:\Windows\System\WNrZxZY.exe
  C:\Windows\System\WNrZxZY.exe
  2⤵
  PID:6748
- C:\Windows\System\ClIZfhl.exe
  C:\Windows\System\ClIZfhl.exe
  2⤵
  PID:6924
- C:\Windows\System\ijnFILu.exe
  C:\Windows\System\ijnFILu.exe
  2⤵
  PID:7056
- C:\Windows\System\vFTZFSH.exe
  C:\Windows\System\vFTZFSH.exe
  2⤵
  PID:7116
- C:\Windows\System\RmxSESw.exe
  C:\Windows\System\RmxSESw.exe
  2⤵
  PID:6912
- C:\Windows\System\WvbWJlP.exe
  C:\Windows\System\WvbWJlP.exe
  2⤵
  PID:7132
- C:\Windows\System\vgABmEg.exe
  C:\Windows\System\vgABmEg.exe
  2⤵
  PID:6168
- C:\Windows\System\xmPHxDt.exe
  C:\Windows\System\xmPHxDt.exe
  2⤵
  PID:6232
- C:\Windows\System\lfiWiMn.exe
  C:\Windows\System\lfiWiMn.exe
  2⤵
  PID:6040
- C:\Windows\System\qmAUjxv.exe
  C:\Windows\System\qmAUjxv.exe
  2⤵
  PID:6620
- C:\Windows\System\dFFOnTK.exe
  C:\Windows\System\dFFOnTK.exe
  2⤵
  PID:6492
- C:\Windows\System\yqKMqHe.exe
  C:\Windows\System\yqKMqHe.exe
  2⤵
  PID:6864
- C:\Windows\System\aQgOqds.exe
  C:\Windows\System\aQgOqds.exe
  2⤵
  PID:6400
- C:\Windows\System\ruePYhX.exe
  C:\Windows\System\ruePYhX.exe
  2⤵
  PID:6784
- C:\Windows\System\daRkKgz.exe
  C:\Windows\System\daRkKgz.exe
  2⤵
  PID:5568
- C:\Windows\System\KvJvPoj.exe
  C:\Windows\System\KvJvPoj.exe
  2⤵
  PID:6464
- C:\Windows\System\pEtpwRo.exe
  C:\Windows\System\pEtpwRo.exe
  2⤵
  PID:6228
- C:\Windows\System\WkqarBM.exe
  C:\Windows\System\WkqarBM.exe
  2⤵
  PID:7180
- C:\Windows\System\TrKxGWH.exe
  C:\Windows\System\TrKxGWH.exe
  2⤵
  PID:7196
- C:\Windows\System\PNbZsRR.exe
  C:\Windows\System\PNbZsRR.exe
  2⤵
  PID:7212
- C:\Windows\System\HQopDGn.exe
  C:\Windows\System\HQopDGn.exe
  2⤵
  PID:7228
- C:\Windows\System\iilyIAP.exe
  C:\Windows\System\iilyIAP.exe
  2⤵
  PID:7244
- C:\Windows\System\UHfNwTq.exe
  C:\Windows\System\UHfNwTq.exe
  2⤵
  PID:7260
- C:\Windows\System\ouKzcev.exe
  C:\Windows\System\ouKzcev.exe
  2⤵
  PID:7280
- C:\Windows\System\hqojFnr.exe
  C:\Windows\System\hqojFnr.exe
  2⤵
  PID:7296
- C:\Windows\System\LbQLjpq.exe
  C:\Windows\System\LbQLjpq.exe
  2⤵
  PID:7312
- C:\Windows\System\zmaFSft.exe
  C:\Windows\System\zmaFSft.exe
  2⤵
  PID:7328
- C:\Windows\System\XojpuIt.exe
  C:\Windows\System\XojpuIt.exe
  2⤵
  PID:7344
- C:\Windows\System\LoZImbd.exe
  C:\Windows\System\LoZImbd.exe
  2⤵
  PID:7360
- C:\Windows\System\bSvQede.exe
  C:\Windows\System\bSvQede.exe
  2⤵
  PID:7380
- C:\Windows\System\sYClKtF.exe
  C:\Windows\System\sYClKtF.exe
  2⤵
  PID:7396
- C:\Windows\System\kpQTwgQ.exe
  C:\Windows\System\kpQTwgQ.exe
  2⤵
  PID:7412
- C:\Windows\System\CgPqSWR.exe
  C:\Windows\System\CgPqSWR.exe
  2⤵
  PID:7428
- C:\Windows\System\jKKhsjz.exe
  C:\Windows\System\jKKhsjz.exe
  2⤵
  PID:7444
- C:\Windows\System\imriTlu.exe
  C:\Windows\System\imriTlu.exe
  2⤵
  PID:7460
- C:\Windows\System\QiCQIHL.exe
  C:\Windows\System\QiCQIHL.exe
  2⤵
  PID:7476
- C:\Windows\System\TwVDdqa.exe
  C:\Windows\System\TwVDdqa.exe
  2⤵
  PID:7492
- C:\Windows\System\dXLlIBg.exe
  C:\Windows\System\dXLlIBg.exe
  2⤵
  PID:7508
- C:\Windows\System\yvIvVnX.exe
  C:\Windows\System\yvIvVnX.exe
  2⤵
  PID:7524
- C:\Windows\System\WjhdURo.exe
  C:\Windows\System\WjhdURo.exe
  2⤵
  PID:7540
- C:\Windows\System\QOjNaQX.exe
  C:\Windows\System\QOjNaQX.exe
  2⤵
  PID:7556
- C:\Windows\System\DGzsDOy.exe
  C:\Windows\System\DGzsDOy.exe
  2⤵
  PID:7572
- C:\Windows\System\eCUzJHI.exe
  C:\Windows\System\eCUzJHI.exe
  2⤵
  PID:7588
- C:\Windows\System\dLduczW.exe
  C:\Windows\System\dLduczW.exe
  2⤵
  PID:7604
- C:\Windows\System\uDiykKT.exe
  C:\Windows\System\uDiykKT.exe
  2⤵
  PID:7620
- C:\Windows\System\RZEUCTn.exe
  C:\Windows\System\RZEUCTn.exe
  2⤵
  PID:7636
- C:\Windows\System\zvBOzWq.exe
  C:\Windows\System\zvBOzWq.exe
  2⤵
  PID:7652
- C:\Windows\System\NLSVsHL.exe
  C:\Windows\System\NLSVsHL.exe
  2⤵
  PID:7668
- C:\Windows\System\eDNoDbM.exe
  C:\Windows\System\eDNoDbM.exe
  2⤵
  PID:7684
- C:\Windows\System\DJcWGDm.exe
  C:\Windows\System\DJcWGDm.exe
  2⤵
  PID:7700
- C:\Windows\System\QvQBbaC.exe
  C:\Windows\System\QvQBbaC.exe
  2⤵
  PID:7716
- C:\Windows\System\MuWfMlA.exe
  C:\Windows\System\MuWfMlA.exe
  2⤵
  PID:7732
- C:\Windows\System\eqhOnZD.exe
  C:\Windows\System\eqhOnZD.exe
  2⤵
  PID:7748
- C:\Windows\System\szJoOtM.exe
  C:\Windows\System\szJoOtM.exe
  2⤵
  PID:7764
- C:\Windows\System\IkwidRl.exe
  C:\Windows\System\IkwidRl.exe
  2⤵
  PID:7780
- C:\Windows\System\bmoVOnN.exe
  C:\Windows\System\bmoVOnN.exe
  2⤵
  PID:7796
- C:\Windows\System\uJeTsLa.exe
  C:\Windows\System\uJeTsLa.exe
  2⤵
  PID:7812
- C:\Windows\System\tHoGCKe.exe
  C:\Windows\System\tHoGCKe.exe
  2⤵
  PID:7828
- C:\Windows\System\uPhQzra.exe
  C:\Windows\System\uPhQzra.exe
  2⤵
  PID:7844
- C:\Windows\System\SDTEPbd.exe
  C:\Windows\System\SDTEPbd.exe
  2⤵
  PID:7860
- C:\Windows\System\oIUNWCB.exe
  C:\Windows\System\oIUNWCB.exe
  2⤵
  PID:7876
- C:\Windows\System\npkSXGB.exe
  C:\Windows\System\npkSXGB.exe
  2⤵
  PID:7892
- C:\Windows\System\ikKqICX.exe
  C:\Windows\System\ikKqICX.exe
  2⤵
  PID:7908
- C:\Windows\System\ztEOYid.exe
  C:\Windows\System\ztEOYid.exe
  2⤵
  PID:7924
- C:\Windows\System\zXdqGYW.exe
  C:\Windows\System\zXdqGYW.exe
  2⤵
  PID:7940
- C:\Windows\System\eWvXTgX.exe
  C:\Windows\System\eWvXTgX.exe
  2⤵
  PID:7956
- C:\Windows\System\IyxnIdQ.exe
  C:\Windows\System\IyxnIdQ.exe
  2⤵
  PID:7972
- C:\Windows\System\isqzuVv.exe
  C:\Windows\System\isqzuVv.exe
  2⤵
  PID:7988
- C:\Windows\System\rgLtGcq.exe
  C:\Windows\System\rgLtGcq.exe
  2⤵
  PID:8004
- C:\Windows\System\YwIawqz.exe
  C:\Windows\System\YwIawqz.exe
  2⤵
  PID:8020
- C:\Windows\System\AXrjlQX.exe
  C:\Windows\System\AXrjlQX.exe
  2⤵
  PID:8036
- C:\Windows\System\EXDofmm.exe
  C:\Windows\System\EXDofmm.exe
  2⤵
  PID:8052
- C:\Windows\System\HHdyNGx.exe
  C:\Windows\System\HHdyNGx.exe
  2⤵
  PID:8068
- C:\Windows\System\OZoqYOW.exe
  C:\Windows\System\OZoqYOW.exe
  2⤵
  PID:8084
- C:\Windows\System\vJrdtws.exe
  C:\Windows\System\vJrdtws.exe
  2⤵
  PID:8100
- C:\Windows\System\WabJEWj.exe
  C:\Windows\System\WabJEWj.exe
  2⤵
  PID:8116
- C:\Windows\System\LLNTVxi.exe
  C:\Windows\System\LLNTVxi.exe
  2⤵
  PID:8136
- C:\Windows\System\OtzdFBU.exe
  C:\Windows\System\OtzdFBU.exe
  2⤵
  PID:8152
- C:\Windows\System\dXdqafP.exe
  C:\Windows\System\dXdqafP.exe
  2⤵
  PID:8168
- C:\Windows\System\NvieOXj.exe
  C:\Windows\System\NvieOXj.exe
  2⤵
  PID:8184
- C:\Windows\System\rgYAsfa.exe
  C:\Windows\System\rgYAsfa.exe
  2⤵
  PID:7120
- C:\Windows\System\RiXqEjT.exe
  C:\Windows\System\RiXqEjT.exe
  2⤵
  PID:7192
- C:\Windows\System\MenXcmA.exe
  C:\Windows\System\MenXcmA.exe
  2⤵
  PID:7252
- C:\Windows\System\ZVkIBqh.exe
  C:\Windows\System\ZVkIBqh.exe
  2⤵
  PID:7288
- C:\Windows\System\KXPFRBV.exe
  C:\Windows\System\KXPFRBV.exe
  2⤵
  PID:7324
- C:\Windows\System\kEUKsux.exe
  C:\Windows\System\kEUKsux.exe
  2⤵
  PID:7208
- C:\Windows\System\IdxBRrv.exe
  C:\Windows\System\IdxBRrv.exe
  2⤵
  PID:7304
- C:\Windows\System\FzIrqls.exe
  C:\Windows\System\FzIrqls.exe
  2⤵
  PID:6476
- C:\Windows\System\OgqbNnD.exe
  C:\Windows\System\OgqbNnD.exe
  2⤵
  PID:7276
- C:\Windows\System\YCZVoER.exe
  C:\Windows\System\YCZVoER.exe
  2⤵
  PID:7388
- C:\Windows\System\uRlaLbS.exe
  C:\Windows\System\uRlaLbS.exe
  2⤵
  PID:7452
- C:\Windows\System\tfDHyHo.exe
  C:\Windows\System\tfDHyHo.exe
  2⤵
  PID:7516
- C:\Windows\System\NrGNYLC.exe
  C:\Windows\System\NrGNYLC.exe
  2⤵
  PID:7408
- C:\Windows\System\YNSZvRf.exe
  C:\Windows\System\YNSZvRf.exe
  2⤵
  PID:7436
- C:\Windows\System\FFrKxkE.exe
  C:\Windows\System\FFrKxkE.exe
  2⤵
  PID:7552
- C:\Windows\System\JpIRtvt.exe
  C:\Windows\System\JpIRtvt.exe
  2⤵
  PID:7564
- C:\Windows\System\GxZsryY.exe
  C:\Windows\System\GxZsryY.exe
  2⤵
  PID:7600
- C:\Windows\System\NgfTUht.exe
  C:\Windows\System\NgfTUht.exe
  2⤵
  PID:7648
- C:\Windows\System\wpqbdxD.exe
  C:\Windows\System\wpqbdxD.exe
  2⤵
  PID:7680
- C:\Windows\System\qnDDogG.exe
  C:\Windows\System\qnDDogG.exe
  2⤵
  PID:7744
- C:\Windows\System\IWoEBBi.exe
  C:\Windows\System\IWoEBBi.exe
  2⤵
  PID:7728
- C:\Windows\System\LDHXnVF.exe
  C:\Windows\System\LDHXnVF.exe
  2⤵
  PID:8076
- C:\Windows\System\AukPCwt.exe
  C:\Windows\System\AukPCwt.exe
  2⤵
  PID:6700
- C:\Windows\System\qhjYUGn.exe
  C:\Windows\System\qhjYUGn.exe
  2⤵
  PID:7224
- C:\Windows\System\TTvQSIb.exe
  C:\Windows\System\TTvQSIb.exe
  2⤵
  PID:7320
- C:\Windows\System\bVndhdq.exe
  C:\Windows\System\bVndhdq.exe
  2⤵
  PID:7336
- C:\Windows\System\POaoXve.exe
  C:\Windows\System\POaoXve.exe
  2⤵
  PID:6656
- C:\Windows\System\gyWFoMl.exe
  C:\Windows\System\gyWFoMl.exe
  2⤵
  PID:7468
- C:\Windows\System\iPZcTwm.exe
  C:\Windows\System\iPZcTwm.exe
  2⤵
  PID:7204
- C:\Windows\System\JVOCkka.exe
  C:\Windows\System\JVOCkka.exe
  2⤵
  PID:7484
- C:\Windows\System\mCgsarS.exe
  C:\Windows\System\mCgsarS.exe
  2⤵
  PID:6972
- C:\Windows\System\rGbVMmo.exe
  C:\Windows\System\rGbVMmo.exe
  2⤵
  PID:7532
- C:\Windows\System\DLDxPxP.exe
  C:\Windows\System\DLDxPxP.exe
  2⤵
  PID:7712
- C:\Windows\System\jBbiqco.exe
  C:\Windows\System\jBbiqco.exe
  2⤵
  PID:7696
- C:\Windows\System\KcTjXQx.exe
  C:\Windows\System\KcTjXQx.exe
  2⤵
  PID:7788
- C:\Windows\System\UUhPsZU.exe
  C:\Windows\System\UUhPsZU.exe
  2⤵
  PID:7804
- C:\Windows\System\poqvWea.exe
  C:\Windows\System\poqvWea.exe
  2⤵
  PID:7868
- C:\Windows\System\NQAemva.exe
  C:\Windows\System\NQAemva.exe
  2⤵
  PID:7900
- C:\Windows\System\kuLcHmE.exe
  C:\Windows\System\kuLcHmE.exe
  2⤵
  PID:7936
- C:\Windows\System\pnrQeQg.exe
  C:\Windows\System\pnrQeQg.exe
  2⤵
  PID:7996
- C:\Windows\System\BTCujNW.exe
  C:\Windows\System\BTCujNW.exe
  2⤵
  PID:7984
- C:\Windows\System\OyyzgmS.exe
  C:\Windows\System\OyyzgmS.exe
  2⤵
  PID:8060
- C:\Windows\System\PVTDUjD.exe
  C:\Windows\System\PVTDUjD.exe
  2⤵
  PID:8092
- C:\Windows\System\ZmfJbHJ.exe
  C:\Windows\System\ZmfJbHJ.exe
  2⤵
  PID:8016
- C:\Windows\System\QQPWHYG.exe
  C:\Windows\System\QQPWHYG.exe
  2⤵
  PID:8148
- C:\Windows\System\hYFCCHI.exe
  C:\Windows\System\hYFCCHI.exe
  2⤵
  PID:8144
- C:\Windows\System\dbxHBzp.exe
  C:\Windows\System\dbxHBzp.exe
  2⤵
  PID:7424
- C:\Windows\System\gzHFYBg.exe
  C:\Windows\System\gzHFYBg.exe
  2⤵
  PID:7292
- C:\Windows\System\PrOeDDy.exe
  C:\Windows\System\PrOeDDy.exe
  2⤵
  PID:7236
- C:\Windows\System\nmyielV.exe
  C:\Windows\System\nmyielV.exe
  2⤵
  PID:7176
- C:\Windows\System\fCCLMzv.exe
  C:\Windows\System\fCCLMzv.exe
  2⤵
  PID:7760
- C:\Windows\System\KXtyBxa.exe
  C:\Windows\System\KXtyBxa.exe
  2⤵
  PID:7024
- C:\Windows\System\gObxrcy.exe
  C:\Windows\System\gObxrcy.exe
  2⤵
  PID:7884
- C:\Windows\System\hXPNPaW.exe
  C:\Windows\System\hXPNPaW.exe
  2⤵
  PID:7724
- C:\Windows\System\heXJLOe.exe
  C:\Windows\System\heXJLOe.exe
  2⤵
  PID:7964
- C:\Windows\System\dRLXVqf.exe
  C:\Windows\System\dRLXVqf.exe
  2⤵
  PID:8096
- C:\Windows\System\fyOTHMp.exe
  C:\Windows\System\fyOTHMp.exe
  2⤵
  PID:6764
- C:\Windows\System\OTBtnao.exe
  C:\Windows\System\OTBtnao.exe
  2⤵
  PID:8032
- C:\Windows\System\zYYkvNf.exe
  C:\Windows\System\zYYkvNf.exe
  2⤵
  PID:8012
- C:\Windows\System\xRkGwYX.exe
  C:\Windows\System\xRkGwYX.exe
  2⤵
  PID:7676
- C:\Windows\System\dhmmvKA.exe
  C:\Windows\System\dhmmvKA.exe
  2⤵
  PID:7840
- C:\Windows\System\XugqlcC.exe
  C:\Windows\System\XugqlcC.exe
  2⤵
  PID:7916
- C:\Windows\System\agjwonD.exe
  C:\Windows\System\agjwonD.exe
  2⤵
  PID:7792
- C:\Windows\System\zsynixF.exe
  C:\Windows\System\zsynixF.exe
  2⤵
  PID:8108
- C:\Windows\System\nrmusVZ.exe
  C:\Windows\System\nrmusVZ.exe
  2⤵
  PID:7020
- C:\Windows\System\zEBqced.exe
  C:\Windows\System\zEBqced.exe
  2⤵
  PID:7776
- C:\Windows\System\rYQgChV.exe
  C:\Windows\System\rYQgChV.exe
  2⤵
  PID:7616
- C:\Windows\System\eymwNUZ.exe
  C:\Windows\System\eymwNUZ.exe
  2⤵
  PID:8212
- C:\Windows\System\AKUZGDt.exe
  C:\Windows\System\AKUZGDt.exe
  2⤵
  PID:8228
- C:\Windows\System\fzCMgPY.exe
  C:\Windows\System\fzCMgPY.exe
  2⤵
  PID:8244
- C:\Windows\System\cOBeAUc.exe
  C:\Windows\System\cOBeAUc.exe
  2⤵
  PID:8260
- C:\Windows\System\LRRoEsR.exe
  C:\Windows\System\LRRoEsR.exe
  2⤵
  PID:8276
- C:\Windows\System\OLkJOnx.exe
  C:\Windows\System\OLkJOnx.exe
  2⤵
  PID:8292
- C:\Windows\System\wNDkPpi.exe
  C:\Windows\System\wNDkPpi.exe
  2⤵
  PID:8308
- C:\Windows\System\KBHSUqJ.exe
  C:\Windows\System\KBHSUqJ.exe
  2⤵
  PID:8324
- C:\Windows\System\odsrTvK.exe
  C:\Windows\System\odsrTvK.exe
  2⤵
  PID:8340
- C:\Windows\System\KxvyMwD.exe
  C:\Windows\System\KxvyMwD.exe
  2⤵
  PID:8360
- C:\Windows\System\LqQRUwV.exe
  C:\Windows\System\LqQRUwV.exe
  2⤵
  PID:8376
- C:\Windows\System\tGZrmZO.exe
  C:\Windows\System\tGZrmZO.exe
  2⤵
  PID:8392
- C:\Windows\System\trjWeWc.exe
  C:\Windows\System\trjWeWc.exe
  2⤵
  PID:8408
- C:\Windows\System\twBWYMI.exe
  C:\Windows\System\twBWYMI.exe
  2⤵
  PID:8428
- C:\Windows\System\QaRqmwG.exe
  C:\Windows\System\QaRqmwG.exe
  2⤵
  PID:8444
- C:\Windows\System\dyQqYlh.exe
  C:\Windows\System\dyQqYlh.exe
  2⤵
  PID:8460
- C:\Windows\System\XDhmOTR.exe
  C:\Windows\System\XDhmOTR.exe
  2⤵
  PID:8476
- C:\Windows\System\OvkfOKY.exe
  C:\Windows\System\OvkfOKY.exe
  2⤵
  PID:8492
- C:\Windows\System\zcLTuBM.exe
  C:\Windows\System\zcLTuBM.exe
  2⤵
  PID:8508
- C:\Windows\System\JpoYgzh.exe
  C:\Windows\System\JpoYgzh.exe
  2⤵
  PID:8524
- C:\Windows\System\YUsnUYT.exe
  C:\Windows\System\YUsnUYT.exe
  2⤵
  PID:8540
- C:\Windows\System\IuudvHG.exe
  C:\Windows\System\IuudvHG.exe
  2⤵
  PID:8556
- C:\Windows\System\uHBOSVS.exe
  C:\Windows\System\uHBOSVS.exe
  2⤵
  PID:8572
- C:\Windows\System\eTvglsa.exe
  C:\Windows\System\eTvglsa.exe
  2⤵
  PID:8588
- C:\Windows\System\QGEIpev.exe
  C:\Windows\System\QGEIpev.exe
  2⤵
  PID:8604
- C:\Windows\System\ZoJzkIz.exe
  C:\Windows\System\ZoJzkIz.exe
  2⤵
  PID:8624
- C:\Windows\System\IPQSzxP.exe
  C:\Windows\System\IPQSzxP.exe
  2⤵
  PID:8640
- C:\Windows\System\YdQezKJ.exe
  C:\Windows\System\YdQezKJ.exe
  2⤵
  PID:8660
- C:\Windows\System\YiDQEXy.exe
  C:\Windows\System\YiDQEXy.exe
  2⤵
  PID:8676
- C:\Windows\System\TQMXHju.exe
  C:\Windows\System\TQMXHju.exe
  2⤵
  PID:8692
- C:\Windows\System\wlbGJuW.exe
  C:\Windows\System\wlbGJuW.exe
  2⤵
  PID:8708
- C:\Windows\System\KyVXcmo.exe
  C:\Windows\System\KyVXcmo.exe
  2⤵
  PID:8724
- C:\Windows\System\UvVXXHc.exe
  C:\Windows\System\UvVXXHc.exe
  2⤵
  PID:8740
- C:\Windows\System\sPrGIww.exe
  C:\Windows\System\sPrGIww.exe
  2⤵
  PID:8760
- C:\Windows\System\DWqpicu.exe
  C:\Windows\System\DWqpicu.exe
  2⤵
  PID:8776
- C:\Windows\System\gvXzDce.exe
  C:\Windows\System\gvXzDce.exe
  2⤵
  PID:8792
- C:\Windows\System\oCqhWJY.exe
  C:\Windows\System\oCqhWJY.exe
  2⤵
  PID:8812
- C:\Windows\System\xEJQKyW.exe
  C:\Windows\System\xEJQKyW.exe
  2⤵
  PID:8828
- C:\Windows\System\jhlsUTm.exe
  C:\Windows\System\jhlsUTm.exe
  2⤵
  PID:8848
- C:\Windows\System\ztdIVKq.exe
  C:\Windows\System\ztdIVKq.exe
  2⤵
  PID:8864
- C:\Windows\System\DIgbOot.exe
  C:\Windows\System\DIgbOot.exe
  2⤵
  PID:8880
- C:\Windows\System\TgDMjsK.exe
  C:\Windows\System\TgDMjsK.exe
  2⤵
  PID:8896
- C:\Windows\System\piUBNcF.exe
  C:\Windows\System\piUBNcF.exe
  2⤵
  PID:8916
- C:\Windows\System\jutgJzL.exe
  C:\Windows\System\jutgJzL.exe
  2⤵
  PID:8932
- C:\Windows\System\LUufNEj.exe
  C:\Windows\System\LUufNEj.exe
  2⤵
  PID:8948
- C:\Windows\System\ksmspSK.exe
  C:\Windows\System\ksmspSK.exe
  2⤵
  PID:8964
- C:\Windows\System\ktPpHXN.exe
  C:\Windows\System\ktPpHXN.exe
  2⤵
  PID:8984
- C:\Windows\System\drWFosH.exe
  C:\Windows\System\drWFosH.exe
  2⤵
  PID:9000
- C:\Windows\System\GVKhrjc.exe
  C:\Windows\System\GVKhrjc.exe
  2⤵
  PID:9016
- C:\Windows\System\CLjBiiq.exe
  C:\Windows\System\CLjBiiq.exe
  2⤵
  PID:9032
- C:\Windows\System\gbuSamh.exe
  C:\Windows\System\gbuSamh.exe
  2⤵
  PID:9052
- C:\Windows\System\flQguqo.exe
  C:\Windows\System\flQguqo.exe
  2⤵
  PID:9068
- C:\Windows\System\IexFjsy.exe
  C:\Windows\System\IexFjsy.exe
  2⤵
  PID:9084
- C:\Windows\System\lybEvlK.exe
  C:\Windows\System\lybEvlK.exe
  2⤵
  PID:9100
- C:\Windows\System\xpjcNyx.exe
  C:\Windows\System\xpjcNyx.exe
  2⤵
  PID:9120
- C:\Windows\System\hoRsVRP.exe
  C:\Windows\System\hoRsVRP.exe
  2⤵
  PID:9136
- C:\Windows\System\hAzcyOH.exe
  C:\Windows\System\hAzcyOH.exe
  2⤵
  PID:9152
- C:\Windows\System\GfBATcS.exe
  C:\Windows\System\GfBATcS.exe
  2⤵
  PID:9168
- C:\Windows\System\fNrSunt.exe
  C:\Windows\System\fNrSunt.exe
  2⤵
  PID:9188
- C:\Windows\System\OJNXYRx.exe
  C:\Windows\System\OJNXYRx.exe
  2⤵
  PID:9204
- C:\Windows\System\SbpzKGT.exe
  C:\Windows\System\SbpzKGT.exe
  2⤵
  PID:7596
- C:\Windows\System\tXWyAyN.exe
  C:\Windows\System\tXWyAyN.exe
  2⤵
  PID:8128
- C:\Windows\System\yaUelHz.exe
  C:\Windows\System\yaUelHz.exe
  2⤵
  PID:8200
- C:\Windows\System\JDEHcpn.exe
  C:\Windows\System\JDEHcpn.exe
  2⤵
  PID:8208
- C:\Windows\System\USkpbEU.exe
  C:\Windows\System\USkpbEU.exe
  2⤵
  PID:8256
- C:\Windows\System\XEilcSJ.exe
  C:\Windows\System\XEilcSJ.exe
  2⤵
  PID:8300
- C:\Windows\System\lMQBssx.exe
  C:\Windows\System\lMQBssx.exe
  2⤵
  PID:8304
- C:\Windows\System\EQdXhPo.exe
  C:\Windows\System\EQdXhPo.exe
  2⤵
  PID:8384
- C:\Windows\System\AQeJOTc.exe
  C:\Windows\System\AQeJOTc.exe
  2⤵
  PID:8332
- C:\Windows\System\rtAKDus.exe
  C:\Windows\System\rtAKDus.exe
  2⤵
  PID:8456
- C:\Windows\System\psDvQnn.exe
  C:\Windows\System\psDvQnn.exe
  2⤵
  PID:8372
- C:\Windows\System\tUJRhBY.exe
  C:\Windows\System\tUJRhBY.exe
  2⤵
  PID:8472
- C:\Windows\System\anFTDRn.exe
  C:\Windows\System\anFTDRn.exe
  2⤵
  PID:8500
- C:\Windows\System\ErqkvXP.exe
  C:\Windows\System\ErqkvXP.exe
  2⤵
  PID:8532
- C:\Windows\System\UkxjJro.exe
  C:\Windows\System\UkxjJro.exe
  2⤵
  PID:8612
- C:\Windows\System\GmQBMjY.exe
  C:\Windows\System\GmQBMjY.exe
  2⤵
  PID:8684
- C:\Windows\System\nSFmbEE.exe
  C:\Windows\System\nSFmbEE.exe
  2⤵
  PID:8600
- C:\Windows\System\VYZVlvd.exe
  C:\Windows\System\VYZVlvd.exe
  2⤵
  PID:8752
- C:\Windows\System\aHUuGWq.exe
  C:\Windows\System\aHUuGWq.exe
  2⤵
  PID:8704
- C:\Windows\System\PxaMmsX.exe
  C:\Windows\System\PxaMmsX.exe
  2⤵
  PID:8772
- C:\Windows\System\VDQJWEW.exe
  C:\Windows\System\VDQJWEW.exe
  2⤵
  PID:8992
- C:\Windows\System\gotdzwe.exe
  C:\Windows\System\gotdzwe.exe
  2⤵
  PID:8844
- C:\Windows\System\VPdudBA.exe
  C:\Windows\System\VPdudBA.exe
  2⤵
  PID:8972
- C:\Windows\System\uLehFHp.exe
  C:\Windows\System\uLehFHp.exe
  2⤵
  PID:9012
- C:\Windows\System\IhMcZMk.exe
  C:\Windows\System\IhMcZMk.exe
  2⤵
  PID:9044
- C:\Windows\System\PHkppaV.exe
  C:\Windows\System\PHkppaV.exe
  2⤵
  PID:9096
- C:\Windows\System\GgTXxCh.exe
  C:\Windows\System\GgTXxCh.exe
  2⤵
  PID:9076
- C:\Windows\System\AaPenIn.exe
  C:\Windows\System\AaPenIn.exe
  2⤵
  PID:9144
- C:\Windows\System\jYvwwdn.exe
  C:\Windows\System\jYvwwdn.exe
  2⤵
  PID:9132
- C:\Windows\System\dLmejFI.exe
  C:\Windows\System\dLmejFI.exe
  2⤵
  PID:7932
- C:\Windows\System\dbtxWGV.exe
  C:\Windows\System\dbtxWGV.exe
  2⤵
  PID:8240
- C:\Windows\System\TIBWSrj.exe
  C:\Windows\System\TIBWSrj.exe
  2⤵
  PID:7740
- C:\Windows\System\CDtZABN.exe
  C:\Windows\System\CDtZABN.exe
  2⤵
  PID:8356
- C:\Windows\System\kvQRUYX.exe
  C:\Windows\System\kvQRUYX.exe
  2⤵
  PID:8320
- C:\Windows\System\BYRHlFj.exe
  C:\Windows\System\BYRHlFj.exe
  2⤵
  PID:8368
- C:\Windows\System\wuXxcTq.exe
  C:\Windows\System\wuXxcTq.exe
  2⤵
  PID:8720
- C:\Windows\System\kRLUgSq.exe
  C:\Windows\System\kRLUgSq.exe
  2⤵
  PID:8536
- C:\Windows\System\qtJtvwF.exe
  C:\Windows\System\qtJtvwF.exe
  2⤵
  PID:8584
- C:\Windows\System\YRvECxD.exe
  C:\Windows\System\YRvECxD.exe
  2⤵
  PID:8468
- C:\Windows\System\hosaOTU.exe
  C:\Windows\System\hosaOTU.exe
  2⤵
  PID:8788
- C:\Windows\System\yTExzeu.exe
  C:\Windows\System\yTExzeu.exe
  2⤵
  PID:8888
- C:\Windows\System\EuXMerb.exe
  C:\Windows\System\EuXMerb.exe
  2⤵
  PID:8924
- C:\Windows\System\svleSCk.exe
  C:\Windows\System\svleSCk.exe
  2⤵
  PID:8876
- C:\Windows\System\sKOAeJi.exe
  C:\Windows\System\sKOAeJi.exe
  2⤵
  PID:8904
- C:\Windows\System\eFjJjTX.exe
  C:\Windows\System\eFjJjTX.exe
  2⤵
  PID:8768
- C:\Windows\System\jklqYyG.exe
  C:\Windows\System\jklqYyG.exe
  2⤵
  PID:8996
- C:\Windows\System\XFLLEEH.exe
  C:\Windows\System\XFLLEEH.exe
  2⤵
  PID:9112
- C:\Windows\System\ScDmDwg.exe
  C:\Windows\System\ScDmDwg.exe
  2⤵
  PID:8028
- C:\Windows\System\kirsmWb.exe
  C:\Windows\System\kirsmWb.exe
  2⤵
  PID:9212
- C:\Windows\System\YnVlCgk.exe
  C:\Windows\System\YnVlCgk.exe
  2⤵
  PID:7188
- C:\Windows\System\wIJBnXV.exe
  C:\Windows\System\wIJBnXV.exe
  2⤵
  PID:8268
- C:\Windows\System\dWtvRlN.exe
  C:\Windows\System\dWtvRlN.exe
  2⤵
  PID:8316
- C:\Windows\System\yjwKiGd.exe
  C:\Windows\System\yjwKiGd.exe
  2⤵
  PID:8732
- C:\Windows\System\YcljntS.exe
  C:\Windows\System\YcljntS.exe
  2⤵
  PID:8648
- C:\Windows\System\ydgCRmF.exe
  C:\Windows\System\ydgCRmF.exe
  2⤵
  PID:8784
- C:\Windows\System\MLewoHy.exe
  C:\Windows\System\MLewoHy.exe
  2⤵
  PID:8656
- C:\Windows\System\xUTVNPi.exe
  C:\Windows\System\xUTVNPi.exe
  2⤵
  PID:8960
- C:\Windows\System\yrnnmWr.exe
  C:\Windows\System\yrnnmWr.exe
  2⤵
  PID:8840
- C:\Windows\System\lKCgNhF.exe
  C:\Windows\System\lKCgNhF.exe
  2⤵
  PID:7980
- C:\Windows\System\iNRsTxE.exe
  C:\Windows\System\iNRsTxE.exe
  2⤵
  PID:8352
- C:\Windows\System\YDmqmLl.exe
  C:\Windows\System\YDmqmLl.exe
  2⤵
  PID:8596
- C:\Windows\System\wZssFEG.exe
  C:\Windows\System\wZssFEG.exe
  2⤵
  PID:8940
- C:\Windows\System\pVhsjFl.exe
  C:\Windows\System\pVhsjFl.exe
  2⤵
  PID:9180
- C:\Windows\System\PRRmaNL.exe
  C:\Windows\System\PRRmaNL.exe
  2⤵
  PID:9040
- C:\Windows\System\cPrqGgz.exe
  C:\Windows\System\cPrqGgz.exe
  2⤵
  PID:9108
- C:\Windows\System\qomENwu.exe
  C:\Windows\System\qomENwu.exe
  2⤵
  PID:8564
- C:\Windows\System\lrEEFxP.exe
  C:\Windows\System\lrEEFxP.exe
  2⤵
  PID:8824
- C:\Windows\System\gnqpHkr.exe
  C:\Windows\System\gnqpHkr.exe
  2⤵
  PID:8288
- C:\Windows\System\meZaLKC.exe
  C:\Windows\System\meZaLKC.exe
  2⤵
  PID:8668
- C:\Windows\System\CGlLBCA.exe
  C:\Windows\System\CGlLBCA.exe
  2⤵
  PID:8220
- C:\Windows\System\kiQBQNS.exe
  C:\Windows\System\kiQBQNS.exe
  2⤵
  PID:9232
- C:\Windows\System\xVbYlsL.exe
  C:\Windows\System\xVbYlsL.exe
  2⤵
  PID:9248
- C:\Windows\System\LWVQoOY.exe
  C:\Windows\System\LWVQoOY.exe
  2⤵
  PID:9264
- C:\Windows\System\DUwOZdU.exe
  C:\Windows\System\DUwOZdU.exe
  2⤵
  PID:9280
- C:\Windows\System\iaPvTvr.exe
  C:\Windows\System\iaPvTvr.exe
  2⤵
  PID:9296
- C:\Windows\System\SMNaDkY.exe
  C:\Windows\System\SMNaDkY.exe
  2⤵
  PID:9312
- C:\Windows\System\ZEwTtVb.exe
  C:\Windows\System\ZEwTtVb.exe
  2⤵
  PID:9328
- C:\Windows\System\VACvbMK.exe
  C:\Windows\System\VACvbMK.exe
  2⤵
  PID:9344
- C:\Windows\System\jIuwiZl.exe
  C:\Windows\System\jIuwiZl.exe
  2⤵
  PID:9360
- C:\Windows\System\jWIgVrd.exe
  C:\Windows\System\jWIgVrd.exe
  2⤵
  PID:9376
- C:\Windows\System\IXeYYfF.exe
  C:\Windows\System\IXeYYfF.exe
  2⤵
  PID:9392
- C:\Windows\System\kOfMTho.exe
  C:\Windows\System\kOfMTho.exe
  2⤵
  PID:9408
- C:\Windows\System\ZIJHkwZ.exe
  C:\Windows\System\ZIJHkwZ.exe
  2⤵
  PID:9424
- C:\Windows\System\oIOVpnP.exe
  C:\Windows\System\oIOVpnP.exe
  2⤵
  PID:9440
- C:\Windows\System\ffomVWP.exe
  C:\Windows\System\ffomVWP.exe
  2⤵
  PID:9456
- C:\Windows\System\KNnZhgK.exe
  C:\Windows\System\KNnZhgK.exe
  2⤵
  PID:9472
- C:\Windows\System\msWfglt.exe
  C:\Windows\System\msWfglt.exe
  2⤵
  PID:9488
- C:\Windows\System\AJlvIRr.exe
  C:\Windows\System\AJlvIRr.exe
  2⤵
  PID:9504
- C:\Windows\System\HAfIBZT.exe
  C:\Windows\System\HAfIBZT.exe
  2⤵
  PID:9520
- C:\Windows\System\sKqXWpt.exe
  C:\Windows\System\sKqXWpt.exe
  2⤵
  PID:9536
- C:\Windows\System\miHudqX.exe
  C:\Windows\System\miHudqX.exe
  2⤵
  PID:9552
- C:\Windows\System\XOqyabM.exe
  C:\Windows\System\XOqyabM.exe
  2⤵
  PID:9568
- C:\Windows\System\zPoZVCT.exe
  C:\Windows\System\zPoZVCT.exe
  2⤵
  PID:9584
- C:\Windows\System\sHgGwkQ.exe
  C:\Windows\System\sHgGwkQ.exe
  2⤵
  PID:9600
- C:\Windows\System\LodGFSn.exe
  C:\Windows\System\LodGFSn.exe
  2⤵
  PID:9616
- C:\Windows\System\amAhsVN.exe
  C:\Windows\System\amAhsVN.exe
  2⤵
  PID:9632
- C:\Windows\System\rLzpcGp.exe
  C:\Windows\System\rLzpcGp.exe
  2⤵
  PID:9648
- C:\Windows\System\DHwxkZU.exe
  C:\Windows\System\DHwxkZU.exe
  2⤵
  PID:9664
- C:\Windows\System\afUsceT.exe
  C:\Windows\System\afUsceT.exe
  2⤵
  PID:9680
- C:\Windows\System\svLnVwU.exe
  C:\Windows\System\svLnVwU.exe
  2⤵
  PID:9696
- C:\Windows\System\kuGiTWc.exe
  C:\Windows\System\kuGiTWc.exe
  2⤵
  PID:9712
- C:\Windows\System\VSFUhRO.exe
  C:\Windows\System\VSFUhRO.exe
  2⤵
  PID:9732
- C:\Windows\System\XSrNuVh.exe
  C:\Windows\System\XSrNuVh.exe
  2⤵
  PID:9748
- C:\Windows\System\ZZmOuds.exe
  C:\Windows\System\ZZmOuds.exe
  2⤵
  PID:9764
- C:\Windows\System\qNlPrWI.exe
  C:\Windows\System\qNlPrWI.exe
  2⤵
  PID:9780
- C:\Windows\System\hCkztUO.exe
  C:\Windows\System\hCkztUO.exe
  2⤵
  PID:9796
- C:\Windows\System\tpygnrO.exe
  C:\Windows\System\tpygnrO.exe
  2⤵
  PID:9812
- C:\Windows\System\ctSSvLH.exe
  C:\Windows\System\ctSSvLH.exe
  2⤵
  PID:9828
- C:\Windows\System\krqQeTx.exe
  C:\Windows\System\krqQeTx.exe
  2⤵
  PID:9844
- C:\Windows\System\XHjhUFI.exe
  C:\Windows\System\XHjhUFI.exe
  2⤵
  PID:9860
- C:\Windows\System\rdpfDcq.exe
  C:\Windows\System\rdpfDcq.exe
  2⤵
  PID:9876
- C:\Windows\System\pGtdnXp.exe
  C:\Windows\System\pGtdnXp.exe
  2⤵
  PID:9892
- C:\Windows\System\nZEwkQh.exe
  C:\Windows\System\nZEwkQh.exe
  2⤵
  PID:9908
- C:\Windows\System\uUzVoib.exe
  C:\Windows\System\uUzVoib.exe
  2⤵
  PID:9924
- C:\Windows\System\RPUqsRM.exe
  C:\Windows\System\RPUqsRM.exe
  2⤵
  PID:9940
- C:\Windows\System\OLnrNeD.exe
  C:\Windows\System\OLnrNeD.exe
  2⤵
  PID:9956
- C:\Windows\System\qQXaXrp.exe
  C:\Windows\System\qQXaXrp.exe
  2⤵
  PID:9972
- C:\Windows\System\ygcsbBk.exe
  C:\Windows\System\ygcsbBk.exe
  2⤵
  PID:9988
- C:\Windows\System\tcxZlKC.exe
  C:\Windows\System\tcxZlKC.exe
  2⤵
  PID:10004
- C:\Windows\System\SceEUVe.exe
  C:\Windows\System\SceEUVe.exe
  2⤵
  PID:10024
- C:\Windows\System\JXoIoFv.exe
  C:\Windows\System\JXoIoFv.exe
  2⤵
  PID:10040
- C:\Windows\System\kKWZhLq.exe
  C:\Windows\System\kKWZhLq.exe
  2⤵
  PID:10056
- C:\Windows\System\ePWsOJN.exe
  C:\Windows\System\ePWsOJN.exe
  2⤵
  PID:10072
- C:\Windows\System\ctnqisb.exe
  C:\Windows\System\ctnqisb.exe
  2⤵
  PID:10092
- C:\Windows\System\AlrNRJa.exe
  C:\Windows\System\AlrNRJa.exe
  2⤵
  PID:10112
- C:\Windows\System\iqFYiuF.exe
  C:\Windows\System\iqFYiuF.exe
  2⤵
  PID:10128
- C:\Windows\System\NfHFQnn.exe
  C:\Windows\System\NfHFQnn.exe
  2⤵
  PID:10144
- C:\Windows\System\ItmGnqM.exe
  C:\Windows\System\ItmGnqM.exe
  2⤵
  PID:10160
- C:\Windows\System\AhtDyoY.exe
  C:\Windows\System\AhtDyoY.exe
  2⤵
  PID:10176
- C:\Windows\System\YPBiNIc.exe
  C:\Windows\System\YPBiNIc.exe
  2⤵
  PID:10192
- C:\Windows\System\YMZxDRb.exe
  C:\Windows\System\YMZxDRb.exe
  2⤵
  PID:10208
- C:\Windows\System\txQKWek.exe
  C:\Windows\System\txQKWek.exe
  2⤵
  PID:10224
- C:\Windows\System\AZCEFWn.exe
  C:\Windows\System\AZCEFWn.exe
  2⤵
  PID:9116
- C:\Windows\System\VjxVHki.exe
  C:\Windows\System\VjxVHki.exe
  2⤵
  PID:9244
- C:\Windows\System\musnhBh.exe
  C:\Windows\System\musnhBh.exe
  2⤵
  PID:9260
- C:\Windows\System\aJRrmCZ.exe
  C:\Windows\System\aJRrmCZ.exe
  2⤵
  PID:9256
- C:\Windows\System\vlISHYu.exe
  C:\Windows\System\vlISHYu.exe
  2⤵
  PID:9336
- C:\Windows\System\pcHYaXd.exe
  C:\Windows\System\pcHYaXd.exe
  2⤵
  PID:9324
- C:\Windows\System\ckpgwcj.exe
  C:\Windows\System\ckpgwcj.exe
  2⤵
  PID:9372
- C:\Windows\System\VtZRwqS.exe
  C:\Windows\System\VtZRwqS.exe
  2⤵
  PID:9404
- C:\Windows\System\sZlcZSm.exe
  C:\Windows\System\sZlcZSm.exe
  2⤵
  PID:9464
- C:\Windows\System\rBHiuCw.exe
  C:\Windows\System\rBHiuCw.exe
  2⤵
  PID:9532
- C:\Windows\System\UhNzjPq.exe
  C:\Windows\System\UhNzjPq.exe
  2⤵
  PID:9596
- C:\Windows\System\IaBfwQI.exe
  C:\Windows\System\IaBfwQI.exe
  2⤵
  PID:9660
- C:\Windows\System\aVqcZsn.exe
  C:\Windows\System\aVqcZsn.exe
  2⤵
  PID:9728
- C:\Windows\System\xyBppmb.exe
  C:\Windows\System\xyBppmb.exe
  2⤵
  PID:9792
- C:\Windows\System\opKwdFU.exe
  C:\Windows\System\opKwdFU.exe
  2⤵
  PID:9804
- C:\Windows\System\POqoruk.exe
  C:\Windows\System\POqoruk.exe
  2⤵
  PID:9484
- C:\Windows\System\FqSLliP.exe
  C:\Windows\System\FqSLliP.exe
  2⤵
  PID:9416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CQBCFkr.exe

Filesize
1.7MB

MD5
a5dc8d518e777e6c145a3cf66ac5c4d7

SHA1
788138a6ace766aec8fc2fe07542f5b3ddd03331

SHA256
3aa5cbc95e4a4700aff2935a1ec9154635777f5909f8d3ec287f5b388ab1437c

SHA512
ce7b4b2065031298227436aa1393c508f628ccaa7e50cc34d97727613910147bb42325e58856705e58bc74bc6c00d846dc5f4ea0bd65cbe39c09fa122f20ff3a

Download Submit
C:\Windows\system\FmiList.exe

Filesize
1.7MB

MD5
0896f79744f509b95043767fbd2ac26f

SHA1
646504736d281d6030ac0b59d3b96f55cf9fd424

SHA256
fb3d22117b1dd4106ce008619ee7542a0091d09493a2ecf5ebcfe69ddf90b2b1

SHA512
2276ee36d86dd2388ba140e5126758794bce1a6a45e5efc12566760fb828824932800addf9f80025c57ebef7132f5b174f06a611f5b07d6ae6040096c7d4c7f4

Download Submit
C:\Windows\system\IxIgJQp.exe

Filesize
1.7MB

MD5
ec2bdbe7ed4d4ef6ee20fb3cb209af36

SHA1
17a79bd3ccc690d77875559a8a0277d82fcbfc20

SHA256
a63dd9fd84ec490c28b55e7b70bc5ca42d5097224fb1b45287d891ec3da89948

SHA512
24ce27b93935d8733c27ab2aabbdab89865b95c8bed8dc0962e4dd81886df2f6f15188ad15b5336f982a5af95cd989df1795c3a55cf121f6cda4c743142d613b

Download Submit
C:\Windows\system\JfywHDQ.exe

Filesize
1.7MB

MD5
41876d62532190862c4f30bea1beee12

SHA1
1099c7698fd2091dc4288cb30381d8244c24d3d6

SHA256
b5f5809ff48bc6b37847a993457dede23537eec99db0a951686ff5ec6205e835

SHA512
6c0d2d2f405b169194b99af27232ac561edc0c93e4601e3582e16a9f0905b6fc477244c52ee44d950415d6109a86480dd48acfa467d104060bb932710806d334

Download Submit
C:\Windows\system\KUNfxjP.exe

Filesize
1.7MB

MD5
d861ef7983f7668ab677fc4d199e0c73

SHA1
b87cf24dd08b80cfa029dc03a2e2e674f297fa2d

SHA256
e658b2d7bc95868684df2cd7fda34e1da7eb6fd1e761749dd8fd55cfc73f4825

SHA512
bf308d427f614a89fb2061df4bf13c0e291146e0051be59ee96a502009aec276e57347e789a613921a0756183e5264d10f8658d409fa2705166d5134271d1f8b

Download Submit
C:\Windows\system\LJCywTB.exe

Filesize
1.7MB

MD5
49e82e8fd68fd1fb356481915cb133d8

SHA1
757042a5d816c6babfecb267d19076bdd8c124d2

SHA256
31f896a5f7bbdf85ef1a9fb66a1b9e10f98a249e1f39d64fe2b5017cbe8d457a

SHA512
e75d477461d1261d300e053b4ab5b4331e2b1e7bf180719cb2141cb18773e6d7ba822f051ceb788b3280c2206550bc3ef323415e20bd78444011549d172dbddd

Download Submit
C:\Windows\system\MuaAxfa.exe

Filesize
1.7MB

MD5
e665227c6f5885fa22f10c762e6bf5fb

SHA1
537394f6db7d790a76784be6d4cd355d07439b6f

SHA256
428d18e6f69b7ba4c959ca10d2609f2b24993a9cb8b7c4a278f19c6296e286bb

SHA512
ee753fd7eb119aa90ba52ee631ef14513dd3a1f83f1c6458e8f1af1487a1bc321b497262496c685eb46a7cd68f661172103df528342cf0cdead71a44dc72519e

Download Submit
C:\Windows\system\NhuCobB.exe

Filesize
1.7MB

MD5
f752844f5de3ead1e54d9b1a35886ad2

SHA1
468b60eb9ea9edf6cafda7f70eb75fd82c36e4af

SHA256
e3c67f001a1d484564285e95372bea4fe6eedb082905febec261f410f190baf4

SHA512
5be5db0fe945cece30f125afdb0acf2edadae362f748efcc3550023e760cbadaa1bad2bac0a906acd60500871270829639dab1bf8eae6c700f3583741c975ecd

Download Submit
C:\Windows\system\OfxUizz.exe

Filesize
1.7MB

MD5
0911ea9d8536eec6a77904fae6a698a9

SHA1
983b7543716ba588b50d7c0d54456c56ea92501c

SHA256
48e3f7444e83851920d34c878a89232055eeb9d9e418863bee3ba89667cd8271

SHA512
facd7a69d44d98d08254ebb0669e39f8c097db3b26542abc24a5192fd00f015cf0c79a6f1f14ec3fc3dc755d49574676b4b3672e76d1c26a589d1f4c99461b43

Download Submit
C:\Windows\system\PthsHUe.exe

Filesize
1.7MB

MD5
438d430953345d2e5b87113665d46fdc

SHA1
2a6a7d0ab8cd9af6e34498707dfa3b2c4099762c

SHA256
8bcefc91a728dcd7096a22ffb62d8b971026b2710105bfb33d1086df7cd34850

SHA512
79cb1da8a7aaafae63be9979241d3c0eefc2b45f000d1b1ba5a70a2e82e1566813223896f9d8292e00fc94ee35cc18a66c3792a093d0d12da32b1e791d085ea7

Download Submit
C:\Windows\system\QrmPmfM.exe

Filesize
1.7MB

MD5
cd7fa7d1e7c8631724e508e2a85005bc

SHA1
863678f6013160f19bffc190b0268108823aded8

SHA256
15c3795a6820f748d3a4d58f31ee4925141b3448b09e73eb75adb2653ab6fccf

SHA512
4dd19794638c1ad2d001650490d654e7ce02ec0db45c965e763bf41ad8f07c8316879eb6452af6b988b338ad3938bba2655ff276bf32be6b68183fc1dbe2046d

Download Submit
C:\Windows\system\TodeExP.exe

Filesize
1.7MB

MD5
31a7b6c0b9fba4877200b5e81a41b142

SHA1
d3c50894860dd91f92cdd8ced59bcfb88bc7be46

SHA256
8daf50bfeb6843250dd562fb71a5741b97545e8c8cd0b99d7bfe604b8a2fece3

SHA512
62cd77c6ca2102f2796ceeb0f5755a8b16a28e0942811facc8ebc5e0528ec0f00ba21e5c5b986b5415b2886af82eb4e8b873e52b49c61d966f5c8c6891bfdb15

Download Submit
C:\Windows\system\VqEaVkV.exe

Filesize
1.7MB

MD5
76ad3e38c9b79602705b7cbb2cceee30

SHA1
360ff81fd25a89eb3e5e8ca29b29408df530eb79

SHA256
e823cc6ad0773831f1cef70f8a4436addcc3dd293acd98dc19dcdff6c9025c31

SHA512
719b76bab91f551ddbe3db38a7eed2c2926228455594324ae65af3f6f928619ea88cee9b552088587c914bd8d2739e8db4271f46b39b4e0a2a9cd482d0d31f9b

Download Submit
C:\Windows\system\WhtfNcB.exe

Filesize
1.7MB

MD5
e6560fc767b209286919c2bbacbf83f7

SHA1
d1ac3a3cb99ebc17050f05edbe7480e0db3590a5

SHA256
563da36229220aae497e71d5a56018b15e33bafffb616f2d536c27c15d097889

SHA512
fe06184f39d26710ee44f6265cd7ca143ed8b237fe59e65cbe96e14e0328b5cd260ba95fd7c58073e24994421bdfac18fedc703afeb7c4f4486b10b08eae9fc0

Download Submit
C:\Windows\system\WkrBxHl.exe

Filesize
1.7MB

MD5
3ec35ad6ca4be172151ae4c459018853

SHA1
8a4fe82a20ddda37f23635f7402936144e20ec56

SHA256
1231587da8a9fade0914abf27e77578b2b0ef1e613e6fd5de6f4e573f9857742

SHA512
6f16ce49e56e543e52d83bf2f6342975982a8b7f0c274d6a5b676400950518e2e1b2a78430c298987b032006afb913770c868aafb897609a5a0b448e0809cca3

Download Submit
C:\Windows\system\YgJqebt.exe

Filesize
1.7MB

MD5
795f700b70e0411c4c8438cec9bda32e

SHA1
03d1a0913ef55605b5af83a6520580695a852fea

SHA256
16b3e87c70da408cb6f9fc5353c467cc168680f4414fe0fcf8e01412b402dd6d

SHA512
24882b471cc673983c63c74fa3ef7848d24b207013ca2e882cb0f045bef0073ffb2c599e600f64e1da8971b17d6177c323ce504e7d1402b5d71adcbf78cd44aa

Download Submit
C:\Windows\system\YgVtCDD.exe

Filesize
1.7MB

MD5
ac78588dafc66db39d3bf1580734b67b

SHA1
4ba0d9d1b88bfb98031bda42c7c20e944b5ca903

SHA256
e498bf508941d605604266f46bb87076aa500cf7b9aad0a01a08a292137a56e3

SHA512
898aadff59cf00bf4cd2c3d548a94c16076ca2cbaf99e7e46d5885e9fe2b20218949a1368a1f171959e59a9aae48365bcb3b1ad69fd062085c4d1e1bcd72c156

Download Submit
C:\Windows\system\YvRXEyU.exe

Filesize
1.7MB

MD5
d7987fcdd2a7cb7eb0c3d1c578e10c48

SHA1
36ef56843eb776836950e4a4534f9e7fa6d32b9a

SHA256
d18d1900fa9c642a1c34032d694663875a33f0b009c32bd8e4a9b9657d26075a

SHA512
6486f16fa077ad24d9348d4c9704dc54d3f71d41f4aae0f9e7d5a34f98365e0fb818209bf319620991e6c05087e3f8b686e3214f48042f18ed1143b2def88001

Download Submit
C:\Windows\system\bcwmgbl.exe

Filesize
1.7MB

MD5
257dddaf2480c252ad47ca27fb4a0dba

SHA1
a7b15fc134ccb1a7d5e6af8cc7a844fd271fd230

SHA256
21942cdb8bf32431f938f7624d59d45ba8de012d60ffe24eed1bdf26485a4d34

SHA512
b29803bfcbfa6c638111b042697900ea3a9e797f85102a0f68f061aba6a9d7d56f4b38a94fbdef9ed58c3bcce1a5ae9b86c62ca2c38f68231bc3536adf29481d

Download Submit
C:\Windows\system\dNWoZRq.exe

Filesize
1.7MB

MD5
82c4ffdd6fd1beac328da1afdec1e80b

SHA1
f5e476c3f93fa5d51abd60ac4d5c50f1c9308c67

SHA256
27d7cadaca686eb47b91a180334a6df0716913bc1cfc7ffa6941f85708a8e18a

SHA512
68dff2e7d0745b80273b948349706fe807104b429a5ec7f12fa52dfa42cefab864e1e35efaba327a7546d25f65988f85044d7fb786a92089ca1ccc881967ab4a

Download Submit
C:\Windows\system\ddhocfg.exe

Filesize
1.7MB

MD5
1b25a219105d70d52863856b7b161752

SHA1
958b742b8fb266eebf54b4e1d38cfb55d129db41

SHA256
80d23787abffa3a280397a7cf7a041e0342cce0d117cf92467096cf37caafcbc

SHA512
decccff3105d007e54e3a60c72d02e605a4a4245041bcf538c7246dfa82724ae427565860ea7657e24126174f2f4b22bb98d4a78e11b0e8259eef93b5262154c

Download Submit
C:\Windows\system\eOEHLnc.exe

Filesize
1.7MB

MD5
f7958522fc50a76ab874affa9fed0af4

SHA1
56ff72da43f940975dd0360c15b8ef5d352cc1b9

SHA256
ccfd02d6582081c15ffd6cfc144d26bcb2175c02b291b81500c96a62bd9b3bf8

SHA512
adf1675755a516e8f2086d586521b2d49743723f38ada6b4300be37f249ecec72430a75f92eca441d8d77ff621ac3772e86d1a8eda3edb3922c233abcd014a6e

Download Submit
C:\Windows\system\fRnEniE.exe

Filesize
1.7MB

MD5
b186edc4ad87fe9735c61cd6bba94f69

SHA1
1a977e07b9981847f345fc1532bea0e82787bbe1

SHA256
47d2ac3887145925e44d93623182e4645f6a5ab48ee8221960c89b8e47a22212

SHA512
a261adf8c1e38e4c19381979ef0e61e960d7956ceeab23fe72336797b49c087e46be13423bf4f7a28e0226d9daea193f72c94a776f6e25d4d3ebb1b8aee158fa

Download Submit
C:\Windows\system\hjEbCZY.exe

Filesize
1.7MB

MD5
9118cc147632fbdaa4941eb0d20d7f97

SHA1
26824ed74bea65ee8eab706575ac51ac3e9acd13

SHA256
c4fdfd1f8fc1b7d3275541d6db030844a96c4baef4d609745137a8cc5c1163e8

SHA512
ced2d7c3571a9630d0d91d8a2088c19db76043e1ab3712c438595740a67a66c7ab4fcfce2b5a7e650c8ec08d6e2f3846d624eb987e8f3cf6fcd7d15b59e315f7

Download Submit
C:\Windows\system\mHauOMz.exe

Filesize
1.7MB

MD5
ac550601fbec18313e066d8a39bcfbb6

SHA1
aa8213338a495f04368fb1802301a8493548d650

SHA256
f6505c1e02de636bf3123dd44d9c2fcb93d9cbccd44fda649c01302fb9c7ab15

SHA512
b26edb22b8b1657a1f9089fa349c217b55521d4719797b9b5dbdc70e9e6fd2355d05ac4e1fbdf936c4947774b44a22da39407edeee078e4949f868cbe9d4a635

Download Submit
C:\Windows\system\nGHRDdn.exe

Filesize
18B

MD5
72202a47c0a1055c1d340a1934528a9e

SHA1
e0a67fcd84380d0c13f863cbe94e9cf40156ee7f

SHA256
c3fcdf24a2739237371e5b68882267ca82969bf6b5bb9b8b0918034aed92784a

SHA512
5fcd889c2f024a3ac930614d6b5a285414c85c90362b65b6c964594eda7dba0f5f1aa73194304ef4e4a4c2b28b5dbc59124d2eddcd04650d4450dba1bce9bb35

Download Submit
C:\Windows\system\pfMZmnI.exe

Filesize
1.7MB

MD5
c95659ba525d595a0a8ff3ba45fe5c44

SHA1
052d8604d345d342241de3777fbdf51dc2c0aab4

SHA256
4e3816b5a054b390b3a5c96c1386a9d12b8fb70eac3d5eda81532a90e32d5e77

SHA512
e452e2a6e4d7e926faeef38a592396163ad92e2f3ab8c8cef916cecac8ad84787fc85484fc541f07e9653605683689484791b8db4572653ce6d200d12bc6d9a2

Download Submit
C:\Windows\system\sKfvTeh.exe

Filesize
1.7MB

MD5
c9b99ba93c7c9e29854aa17a73636009

SHA1
7210dfee45d1c96b85beaa32327dd136e6153bb0

SHA256
97b168e7bd21ed298295db91137e0fb80afb11c881088591726856518f91c3f1

SHA512
5d9575b0d8033f85d619bcefaa22b7000f08dac58b15a77c61e6570a5f37fc087bcd30c8ff44f18febbfe5e87abb76fce28063b97471d3adf35975c99e947bd2

Download Submit
\Windows\system\BYIWeHx.exe

Filesize
1.7MB

MD5
1bda4de26503b3809396d8c4077a3aeb

SHA1
223cc5eb548c20044e035754a64294cd10b31b6c

SHA256
9cd1922f093905c3f17fc03321cc58831b975ee0f3ca88f6fdbab9bf06d301e3

SHA512
7d476987f0f4ce9452e7442b836c524cda2d10a65227dea131ff2bf1ee5887131ae4ce073d072a5c9a80339b6a0a07b8ecb83f9773fe108ed46f0656f8e683a3

Download Submit
\Windows\system\CeDYPoP.exe

Filesize
1.7MB

MD5
f991e069e4b475c3bea9694cb41e8d9b

SHA1
0ef2b99c4532617dbc9e12fd1a0d0945e6184329

SHA256
2e09e126928e82ed66bc1fd7c772aa3b97fd8d3ad78fa2bf21f7d69f7021bc24

SHA512
3bd69dec42dad13aad6371fe37cb5e8d233f15f8e8da119fba4db834070b516ced12ecfcc05395891d3ac12c2abd129af4a199719da011b2733b956764486c45

Download Submit
\Windows\system\GfSQJrv.exe

Filesize
1.7MB

MD5
799c9c8a95dce5eb5bb0681ee9369ddd

SHA1
bbd40489199e08747e00facd69e1589c370aa672

SHA256
780d913c0a9e22e5aec561bb1f2e6204fdcdc2c62b495c747af53c8bcd76afa1

SHA512
9f9dc02d8634cb99a0d64f8435b05bd57380242b480e0e3814581b788d0df84e909f672bae09fd0eadeafeb28ebed90def6668f959c7082b6536804b5c845608

Download Submit
\Windows\system\LiVisWI.exe

Filesize
1.7MB

MD5
a5f008329c0cb7d95df3462b446cf624

SHA1
dd58d238ee04e084066da7a3bb02f7a1a4a1c825

SHA256
382c17dd0bb7041abf4293552ba81b0e31140e2ba1e9d1d791acbdcb1252cde7

SHA512
e2220bb349416b438e57e8fe7637bf34d95f50d619eb014521bc5c16eb221df4186bca9d715357c7773400818d3c613f16f7e1780c5459fca03d45881287ca80

Download Submit
\Windows\system\ZpmtvAq.exe

Filesize
1.7MB

MD5
304d92c570e6cf6d1d940697eccbf412

SHA1
fdcb7a2417304ddeed4bccb4f33897dbabbac720

SHA256
70e16751ac32cdca11cd7ccf04c2921452c7debeae38911ccba6d0031d01ce03

SHA512
f3e22a14a0aefa390130b7d7be5104e7614ece4fbab356a246693f4852562b5e23a120b0376c5b35d39d565710852323a4f8e068743b14ad30a6c7253f3b6d34

Download Submit
\Windows\system\dgDrIBj.exe

Filesize
1.7MB

MD5
0500532c9b7031a792aa9e12159ec40f

SHA1
6655c8b79af8ff42521675102a59628f26bad4e9

SHA256
79ac8b98f1645e3ef70f29fd8cde9bc8825c3b3ceed2e38c8828cfe94f49ead1

SHA512
2b992f7e4ebbbafb7a2596c164fd42a98c0734252add57b2180634aaa3e9e9b15ce5f7dd9c05818efbed3a15fc4e4474cb283850b72ff422e7d659f4cb048bb3

Download Submit
\Windows\system\eBEIwzm.exe

Filesize
1.7MB

MD5
2295405181edd49bed3daa7c21acbbc0

SHA1
1fea1683129f6236fdbe013bd6bbf9fcf48e9d60

SHA256
9875491fb9a53acf303820b8c9859f5e1f69b527d05fa5e3d7d60e0dfb307d9c

SHA512
f13c3e7a678abb8c129adbcf3b3c4145fffa00eec6bfa7f8a4d1dad2bbc70f05214bc847daa2fde9758f7288752011bc3662d3c4a0f4783809d5eb999c6e218e

Download Submit
\Windows\system\iYUGgpc.exe

Filesize
1.7MB

MD5
f74ced784e261bd47d5ddd1ec08ce28b

SHA1
1e79fc345e9f1143b3101c9af9d1598a8ccc1ae6

SHA256
d23fff7c86a2c6e8731766449bc8c3a666791764b2ea5170cbd9094049c54cce

SHA512
12f6414bfeb9e6ef49c2769fef27d5436112fb65335caa11694c975c37756574a9103502eeee842259e3538be54cd173ec8b64201f530c752d913dc721f4ed9e

Download Submit
\Windows\system\pqaojPk.exe

Filesize
1.7MB

MD5
1a6b92f59572555959a92605f005dadf

SHA1
0fd79ed6aa605f231c706abfd628b94aa94df0fe

SHA256
1c8f527d35b098f0f2c9c270659b95a7d22473ceac1808985217a25436833856

SHA512
c4f1ea0728d1c718af761f1e11d1a7f58ed47cad67d8b257720fa06f72533231f06e4521879fe6bdd0d788164418a4848b200b0f9c313580f3a5088e8c34e089

Download Submit
memory/1316-6403-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/1316-239-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/1976-98-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/1976-230-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/1976-47-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/1976-66-0x00000000022E0000-0x00000000022E8000-memory.dmp

Filesize
32KB

Download
memory/1976-15-0x000007FEF5ECE000-0x000007FEF5ECF000-memory.dmp

Filesize
4KB

Download
memory/1976-14-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/1976-179-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/1976-246-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2356-13-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2356-6157-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2468-236-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-6133-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-6919-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2476-224-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2496-6054-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2496-234-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2564-6131-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2564-212-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2576-237-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2612-204-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2612-6058-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2628-233-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2628-6392-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2684-214-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2684-6070-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2696-216-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-218-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-6057-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-213-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2912-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2912-231-0x0000000003310000-0x0000000003702000-memory.dmp

Filesize
3.9MB

Download
memory/2912-217-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-1-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2912-219-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2912-12-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2912-215-0x0000000003310000-0x0000000003702000-memory.dmp

Filesize
3.9MB

Download
memory/2912-205-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2912-232-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-238-0x0000000003310000-0x0000000003702000-memory.dmp

Filesize
3.9MB

Download
memory/2912-243-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2912-235-0x0000000003310000-0x0000000003702000-memory.dmp

Filesize
3.9MB

Download
memory/2912-12285-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download