xmrig | 03653fde53a203d14c9391b76b18649da3b42ab062863912341d15506c2cac69

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efdd5405ba012bc1bc269c43bea30130_NEAS.exe
Size

2.9MB
MD5

efdd5405ba012bc1bc269c43bea30130
SHA1

46e976281f9675f131fc3f26aaf5b6816226289c
SHA256

03653fde53a203d14c9391b76b18649da3b42ab062863912341d15506c2cac69
SHA512

e0bf495458afde9d4c77c7c9ccf4d7363ceb90deddb946b29e40bd6f237c290215977d28ac6436b39854493b1a6589b51d6a36080721468e32f464ceb33e54cf
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsIRh4HEx:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RA

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 54 IoCs

miner

resource	yara_rule
behavioral1/memory/2740-1-0x000000013F3A0000-0x000000013F796000-memory.dmp	xmrig
behavioral1/files/0x000c000000015cb0-6.dat	xmrig
behavioral1/files/0x0032000000015d0c-9.dat	xmrig
behavioral1/files/0x0008000000015e6d-23.dat	xmrig
behavioral1/memory/2600-19-0x000000013F0A0000-0x000000013F496000-memory.dmp	xmrig
behavioral1/memory/2884-17-0x000000013F330000-0x000000013F726000-memory.dmp	xmrig
behavioral1/files/0x0008000000015fa7-37.dat	xmrig
behavioral1/files/0x00070000000160cc-40.dat	xmrig
behavioral1/files/0x00070000000161b3-46.dat	xmrig
behavioral1/files/0x0008000000016d05-50.dat	xmrig
behavioral1/files/0x0006000000016d36-74.dat	xmrig
behavioral1/files/0x0006000000016db3-105.dat	xmrig
behavioral1/memory/2472-112-0x000000013FE20000-0x0000000140216000-memory.dmp	xmrig
behavioral1/files/0x00060000000175b8-133.dat	xmrig
behavioral1/files/0x0009000000018640-138.dat	xmrig
behavioral1/memory/2480-186-0x000000013F420000-0x000000013F816000-memory.dmp	xmrig
behavioral1/files/0x00050000000191ed-185.dat	xmrig
behavioral1/files/0x0006000000018bba-179.dat	xmrig
behavioral1/files/0x0006000000016da4-163.dat	xmrig
behavioral1/files/0x000500000001874a-158.dat	xmrig
behavioral1/files/0x00050000000186c1-154.dat	xmrig
behavioral1/memory/2740-3469-0x000000013F3A0000-0x000000013F796000-memory.dmp	xmrig
behavioral1/files/0x00050000000191eb-189.dat	xmrig
behavioral1/files/0x00050000000186d3-150.dat	xmrig
behavioral1/files/0x000500000001865a-141.dat	xmrig
behavioral1/memory/2712-137-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	xmrig
behavioral1/files/0x001500000001863c-134.dat	xmrig
behavioral1/files/0x00060000000175b2-121.dat	xmrig
behavioral1/files/0x000600000001744c-114.dat	xmrig
behavioral1/files/0x0006000000016fe8-108.dat	xmrig
behavioral1/files/0x000600000001739d-106.dat	xmrig
behavioral1/memory/1036-193-0x000000013FB40000-0x000000013FF36000-memory.dmp	xmrig
behavioral1/memory/2056-192-0x000000013F070000-0x000000013F466000-memory.dmp	xmrig
behavioral1/files/0x0005000000019223-190.dat	xmrig
behavioral1/files/0x000500000001874c-174.dat	xmrig
behavioral1/files/0x0005000000018700-173.dat	xmrig
behavioral1/memory/2704-172-0x000000013FB60000-0x000000013FF56000-memory.dmp	xmrig
behavioral1/files/0x0006000000016e78-169.dat	xmrig
behavioral1/files/0x0006000000016d32-95.dat	xmrig
behavioral1/files/0x0006000000016d3a-147.dat	xmrig
behavioral1/files/0x00060000000175ac-131.dat	xmrig
behavioral1/files/0x00060000000173e5-130.dat	xmrig
behavioral1/files/0x0006000000016d16-80.dat	xmrig
behavioral1/files/0x0006000000016d9f-104.dat	xmrig
behavioral1/files/0x0006000000016d1f-73.dat	xmrig
behavioral1/files/0x0006000000016d0e-72.dat	xmrig
behavioral1/memory/2744-64-0x000000013F230000-0x000000013F626000-memory.dmp	xmrig
behavioral1/memory/2800-57-0x000000013F110000-0x000000013F506000-memory.dmp	xmrig
behavioral1/files/0x001800000000558a-30.dat	xmrig
behavioral1/memory/2480-7758-0x000000013F420000-0x000000013F816000-memory.dmp	xmrig
behavioral1/memory/2712-7771-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	xmrig
behavioral1/memory/2800-7757-0x000000013F110000-0x000000013F506000-memory.dmp	xmrig
behavioral1/memory/2056-7814-0x000000013F070000-0x000000013F466000-memory.dmp	xmrig
behavioral1/memory/1036-7820-0x000000013FB40000-0x000000013FF36000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2200	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2884	DjBmXDh.exe
2600	KxxYRkA.exe
2800	TpVpFfv.exe
2744	aDfpDSt.exe
2472	NQTolVx.exe
2712	qTRCauP.exe
2704	TqBGOpS.exe
2480	qIzzBQX.exe
2056	MHojqWB.exe
1036	pDTsOXw.exe
1992	oPLppTK.exe
2752	EvqECKK.exe
2776	ozrlQUq.exe
2768	bGnKdAt.exe
2364	pcphYZY.exe
2040	cNVZVSV.exe
776	UMBSZYs.exe
1432	tOzGGpk.exe
1736	PUEGHws.exe
3044	DWZbqaY.exe
1168	YYqOFTm.exe
3012	XhNVTVo.exe
2184	SKPTzSQ.exe
1964	yYMcPtM.exe
788	psRefgm.exe
2100	bbHcMra.exe
800	JFKfAli.exe
1388	nHcLzrS.exe
1820	dbTjPPl.exe
1884	cleQRYf.exe
2272	BWTVeRe.exe
2344	optSWwe.exe
1776	omtxKtx.exe
2088	ReLLHZh.exe
2300	bEtTOIJ.exe
1488	ztEDkjr.exe
2196	MQeEJoY.exe
2848	zrrAnIl.exe
2152	pkKogbE.exe
2360	GlGVtbu.exe
632	OrzbToy.exe
1996	zUClYrS.exe
2536	aAJqMDT.exe
1384	hJaCgou.exe
2232	QTNaTal.exe
2836	pUNOtnM.exe
576	wjaepsm.exe
2820	klHqXpU.exe
1100	FfcUtkB.exe
2856	ptHevDe.exe
1608	WHpfuQP.exe
2288	vIpzeUp.exe
1248	ZCdHLHm.exe
2588	tghZdDl.exe
2572	tpcWIhK.exe
2912	JJSjBju.exe
1972	hbGFVRt.exe
2380	lddFglH.exe
272	CRMvyKa.exe
1400	oeEnYyY.exe
908	eqfAKUg.exe
1888	RFWuooB.exe
704	rSGgvjS.exe
1536	VYWubaM.exe

Loads dropped DLL 64 IoCs

pid	Process
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2740-1-0x000000013F3A0000-0x000000013F796000-memory.dmp	upx
behavioral1/files/0x000c000000015cb0-6.dat	upx
behavioral1/files/0x0032000000015d0c-9.dat	upx
behavioral1/files/0x0008000000015e6d-23.dat	upx
behavioral1/memory/2600-19-0x000000013F0A0000-0x000000013F496000-memory.dmp	upx
behavioral1/memory/2884-17-0x000000013F330000-0x000000013F726000-memory.dmp	upx
behavioral1/files/0x0008000000015fa7-37.dat	upx
behavioral1/files/0x00070000000160cc-40.dat	upx
behavioral1/files/0x00070000000161b3-46.dat	upx
behavioral1/files/0x0008000000016d05-50.dat	upx
behavioral1/files/0x0006000000016d36-74.dat	upx
behavioral1/files/0x0006000000016db3-105.dat	upx
behavioral1/memory/2472-112-0x000000013FE20000-0x0000000140216000-memory.dmp	upx
behavioral1/files/0x00060000000175b8-133.dat	upx
behavioral1/files/0x0009000000018640-138.dat	upx
behavioral1/memory/2480-186-0x000000013F420000-0x000000013F816000-memory.dmp	upx
behavioral1/files/0x00050000000191ed-185.dat	upx
behavioral1/files/0x0006000000018bba-179.dat	upx
behavioral1/files/0x0006000000016da4-163.dat	upx
behavioral1/files/0x000500000001874a-158.dat	upx
behavioral1/files/0x00050000000186c1-154.dat	upx
behavioral1/memory/2740-3469-0x000000013F3A0000-0x000000013F796000-memory.dmp	upx
behavioral1/files/0x00050000000191eb-189.dat	upx
behavioral1/files/0x00050000000186d3-150.dat	upx
behavioral1/files/0x000500000001865a-141.dat	upx
behavioral1/memory/2712-137-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	upx
behavioral1/files/0x001500000001863c-134.dat	upx
behavioral1/files/0x00060000000175b2-121.dat	upx
behavioral1/files/0x000600000001744c-114.dat	upx
behavioral1/files/0x0006000000016fe8-108.dat	upx
behavioral1/files/0x000600000001739d-106.dat	upx
behavioral1/memory/1036-193-0x000000013FB40000-0x000000013FF36000-memory.dmp	upx
behavioral1/memory/2056-192-0x000000013F070000-0x000000013F466000-memory.dmp	upx
behavioral1/files/0x0005000000019223-190.dat	upx
behavioral1/files/0x000500000001874c-174.dat	upx
behavioral1/files/0x0005000000018700-173.dat	upx
behavioral1/memory/2704-172-0x000000013FB60000-0x000000013FF56000-memory.dmp	upx
behavioral1/files/0x0006000000016e78-169.dat	upx
behavioral1/files/0x0006000000016d32-95.dat	upx
behavioral1/files/0x0006000000016d3a-147.dat	upx
behavioral1/files/0x00060000000175ac-131.dat	upx
behavioral1/files/0x00060000000173e5-130.dat	upx
behavioral1/files/0x0006000000016d16-80.dat	upx
behavioral1/files/0x0006000000016d9f-104.dat	upx
behavioral1/files/0x0006000000016d1f-73.dat	upx
behavioral1/files/0x0006000000016d0e-72.dat	upx
behavioral1/memory/2744-64-0x000000013F230000-0x000000013F626000-memory.dmp	upx
behavioral1/memory/2800-57-0x000000013F110000-0x000000013F506000-memory.dmp	upx
behavioral1/files/0x001800000000558a-30.dat	upx
behavioral1/memory/2480-7758-0x000000013F420000-0x000000013F816000-memory.dmp	upx
behavioral1/memory/2712-7771-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	upx
behavioral1/memory/2800-7757-0x000000013F110000-0x000000013F506000-memory.dmp	upx
behavioral1/memory/2056-7814-0x000000013F070000-0x000000013F466000-memory.dmp	upx
behavioral1/memory/1036-7820-0x000000013FB40000-0x000000013FF36000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\utMTWPp.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\zHunBFt.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\mBdkcXZ.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\GWhPORS.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\HrDTiNw.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\PaSiPgW.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\pkvwNcH.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\CHSdGFB.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\ZnAhUhN.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\vTqYoXc.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\hVIWPpn.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\yYbBfNg.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\RytNrGq.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\qYzmRhN.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\cCfbKLf.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\yiGwZqw.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\gfQDAqN.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\IPXEtxL.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\aMKRUyS.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\JuPHfsh.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\yEYYpVg.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\ywumqUV.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\tVZnoOC.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\iNnrSKB.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\AtDZluX.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\YcRRHVo.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\MiVvEpa.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\XNsEXma.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\gZmcDCI.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\pwIufdY.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\AJzXGCU.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\JWorkuo.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\KYjCYzI.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\aUWfrBG.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\eASpqco.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\uIxfdPM.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\gChzZdy.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\RlcvMVF.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\XfiGsDY.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\EhaQKHw.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\AClpLGl.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\TOsUikl.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\LrhTRjT.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\sfjUujx.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\fZTfSDD.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\RbfBJND.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\UkMcasx.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\WWFEafi.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\tnWIJYK.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\OyqIjza.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\moSoFso.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\xlBFKRU.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\WDdxJxu.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\nILTwcI.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\TvSqqJb.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\uqMFQEl.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\kvKPVQU.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\yZHWXPm.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\YGKUlYC.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\hWUeTmu.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\FuwZMuH.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\rZSMVlD.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\AKCNQDn.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
File created	C:\Windows\System\FAnZmxS.exe	efdd5405ba012bc1bc269c43bea30130_NEAS.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2200	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
Token: SeLockMemoryPrivilege	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe
Token: SeDebugPrivilege	2200	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2200	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	29
PID 2740 wrote to memory of 2200	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	29
PID 2740 wrote to memory of 2200	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	29
PID 2740 wrote to memory of 2884	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	30
PID 2740 wrote to memory of 2884	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	30
PID 2740 wrote to memory of 2884	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	30
PID 2740 wrote to memory of 2600	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	31
PID 2740 wrote to memory of 2600	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	31
PID 2740 wrote to memory of 2600	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	31
PID 2740 wrote to memory of 2800	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	32
PID 2740 wrote to memory of 2800	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	32
PID 2740 wrote to memory of 2800	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	32
PID 2740 wrote to memory of 2744	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	33
PID 2740 wrote to memory of 2744	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	33
PID 2740 wrote to memory of 2744	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	33
PID 2740 wrote to memory of 2472	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	34
PID 2740 wrote to memory of 2472	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	34
PID 2740 wrote to memory of 2472	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	34
PID 2740 wrote to memory of 2712	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	35
PID 2740 wrote to memory of 2712	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	35
PID 2740 wrote to memory of 2712	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	35
PID 2740 wrote to memory of 2704	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	36
PID 2740 wrote to memory of 2704	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	36
PID 2740 wrote to memory of 2704	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	36
PID 2740 wrote to memory of 2480	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	37
PID 2740 wrote to memory of 2480	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	37
PID 2740 wrote to memory of 2480	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	37
PID 2740 wrote to memory of 2056	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	38
PID 2740 wrote to memory of 2056	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	38
PID 2740 wrote to memory of 2056	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	38
PID 2740 wrote to memory of 1992	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	39
PID 2740 wrote to memory of 1992	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	39
PID 2740 wrote to memory of 1992	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	39
PID 2740 wrote to memory of 1036	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	40
PID 2740 wrote to memory of 1036	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	40
PID 2740 wrote to memory of 1036	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	40
PID 2740 wrote to memory of 2752	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	41
PID 2740 wrote to memory of 2752	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	41
PID 2740 wrote to memory of 2752	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	41
PID 2740 wrote to memory of 2776	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	42
PID 2740 wrote to memory of 2776	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	42
PID 2740 wrote to memory of 2776	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	42
PID 2740 wrote to memory of 3044	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	43
PID 2740 wrote to memory of 3044	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	43
PID 2740 wrote to memory of 3044	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	43
PID 2740 wrote to memory of 2768	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	44
PID 2740 wrote to memory of 2768	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	44
PID 2740 wrote to memory of 2768	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	44
PID 2740 wrote to memory of 2184	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	45
PID 2740 wrote to memory of 2184	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	45
PID 2740 wrote to memory of 2184	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	45
PID 2740 wrote to memory of 2364	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	46
PID 2740 wrote to memory of 2364	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	46
PID 2740 wrote to memory of 2364	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	46
PID 2740 wrote to memory of 1964	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	47
PID 2740 wrote to memory of 1964	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	47
PID 2740 wrote to memory of 1964	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	47
PID 2740 wrote to memory of 2040	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	48
PID 2740 wrote to memory of 2040	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	48
PID 2740 wrote to memory of 2040	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	48
PID 2740 wrote to memory of 1820	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	49
PID 2740 wrote to memory of 1820	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	49
PID 2740 wrote to memory of 1820	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	49
PID 2740 wrote to memory of 776	2740	efdd5405ba012bc1bc269c43bea30130_NEAS.exe	50

C:\Users\Admin\AppData\Local\Temp\efdd5405ba012bc1bc269c43bea30130_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\efdd5405ba012bc1bc269c43bea30130_NEAS.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\System\DjBmXDh.exe
  C:\Windows\System\DjBmXDh.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\KxxYRkA.exe
  C:\Windows\System\KxxYRkA.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\TpVpFfv.exe
  C:\Windows\System\TpVpFfv.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\aDfpDSt.exe
  C:\Windows\System\aDfpDSt.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\NQTolVx.exe
  C:\Windows\System\NQTolVx.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\qTRCauP.exe
  C:\Windows\System\qTRCauP.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\TqBGOpS.exe
  C:\Windows\System\TqBGOpS.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\qIzzBQX.exe
  C:\Windows\System\qIzzBQX.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\MHojqWB.exe
  C:\Windows\System\MHojqWB.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\oPLppTK.exe
  C:\Windows\System\oPLppTK.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\pDTsOXw.exe
  C:\Windows\System\pDTsOXw.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\EvqECKK.exe
  C:\Windows\System\EvqECKK.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\ozrlQUq.exe
  C:\Windows\System\ozrlQUq.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\DWZbqaY.exe
  C:\Windows\System\DWZbqaY.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\bGnKdAt.exe
  C:\Windows\System\bGnKdAt.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\SKPTzSQ.exe
  C:\Windows\System\SKPTzSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\pcphYZY.exe
  C:\Windows\System\pcphYZY.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\yYMcPtM.exe
  C:\Windows\System\yYMcPtM.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\cNVZVSV.exe
  C:\Windows\System\cNVZVSV.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\dbTjPPl.exe
  C:\Windows\System\dbTjPPl.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\UMBSZYs.exe
  C:\Windows\System\UMBSZYs.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\BWTVeRe.exe
  C:\Windows\System\BWTVeRe.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\tOzGGpk.exe
  C:\Windows\System\tOzGGpk.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\optSWwe.exe
  C:\Windows\System\optSWwe.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\PUEGHws.exe
  C:\Windows\System\PUEGHws.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\omtxKtx.exe
  C:\Windows\System\omtxKtx.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\YYqOFTm.exe
  C:\Windows\System\YYqOFTm.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\ReLLHZh.exe
  C:\Windows\System\ReLLHZh.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\XhNVTVo.exe
  C:\Windows\System\XhNVTVo.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\bEtTOIJ.exe
  C:\Windows\System\bEtTOIJ.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\psRefgm.exe
  C:\Windows\System\psRefgm.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\ztEDkjr.exe
  C:\Windows\System\ztEDkjr.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\bbHcMra.exe
  C:\Windows\System\bbHcMra.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\pkKogbE.exe
  C:\Windows\System\pkKogbE.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\JFKfAli.exe
  C:\Windows\System\JFKfAli.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\OrzbToy.exe
  C:\Windows\System\OrzbToy.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\nHcLzrS.exe
  C:\Windows\System\nHcLzrS.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\hJaCgou.exe
  C:\Windows\System\hJaCgou.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\cleQRYf.exe
  C:\Windows\System\cleQRYf.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\QTNaTal.exe
  C:\Windows\System\QTNaTal.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\MQeEJoY.exe
  C:\Windows\System\MQeEJoY.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\pUNOtnM.exe
  C:\Windows\System\pUNOtnM.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\zrrAnIl.exe
  C:\Windows\System\zrrAnIl.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\wjaepsm.exe
  C:\Windows\System\wjaepsm.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\GlGVtbu.exe
  C:\Windows\System\GlGVtbu.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\klHqXpU.exe
  C:\Windows\System\klHqXpU.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\zUClYrS.exe
  C:\Windows\System\zUClYrS.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\FfcUtkB.exe
  C:\Windows\System\FfcUtkB.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\aAJqMDT.exe
  C:\Windows\System\aAJqMDT.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\ptHevDe.exe
  C:\Windows\System\ptHevDe.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\WHpfuQP.exe
  C:\Windows\System\WHpfuQP.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\EgBBDQN.exe
  C:\Windows\System\EgBBDQN.exe
  2⤵
  PID:1708
- C:\Windows\System\vIpzeUp.exe
  C:\Windows\System\vIpzeUp.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\xhmgDxz.exe
  C:\Windows\System\xhmgDxz.exe
  2⤵
  PID:2700
- C:\Windows\System\ZCdHLHm.exe
  C:\Windows\System\ZCdHLHm.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\hWxOrdO.exe
  C:\Windows\System\hWxOrdO.exe
  2⤵
  PID:2724
- C:\Windows\System\tghZdDl.exe
  C:\Windows\System\tghZdDl.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\VvKqgby.exe
  C:\Windows\System\VvKqgby.exe
  2⤵
  PID:2444
- C:\Windows\System\tpcWIhK.exe
  C:\Windows\System\tpcWIhK.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\WxUGzEb.exe
  C:\Windows\System\WxUGzEb.exe
  2⤵
  PID:2020
- C:\Windows\System\JJSjBju.exe
  C:\Windows\System\JJSjBju.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\oUwGdmR.exe
  C:\Windows\System\oUwGdmR.exe
  2⤵
  PID:2488
- C:\Windows\System\hbGFVRt.exe
  C:\Windows\System\hbGFVRt.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\qbwSSQE.exe
  C:\Windows\System\qbwSSQE.exe
  2⤵
  PID:1284
- C:\Windows\System\lddFglH.exe
  C:\Windows\System\lddFglH.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\UQHVrGB.exe
  C:\Windows\System\UQHVrGB.exe
  2⤵
  PID:780
- C:\Windows\System\CRMvyKa.exe
  C:\Windows\System\CRMvyKa.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\KFbLDHo.exe
  C:\Windows\System\KFbLDHo.exe
  2⤵
  PID:2396
- C:\Windows\System\oeEnYyY.exe
  C:\Windows\System\oeEnYyY.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\IzfpNzG.exe
  C:\Windows\System\IzfpNzG.exe
  2⤵
  PID:1984
- C:\Windows\System\eqfAKUg.exe
  C:\Windows\System\eqfAKUg.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\kdmXgyZ.exe
  C:\Windows\System\kdmXgyZ.exe
  2⤵
  PID:1988
- C:\Windows\System\RFWuooB.exe
  C:\Windows\System\RFWuooB.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\vWKBmnx.exe
  C:\Windows\System\vWKBmnx.exe
  2⤵
  PID:1040
- C:\Windows\System\rSGgvjS.exe
  C:\Windows\System\rSGgvjS.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\dkoRozl.exe
  C:\Windows\System\dkoRozl.exe
  2⤵
  PID:1688
- C:\Windows\System\VYWubaM.exe
  C:\Windows\System\VYWubaM.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\GcLpJaB.exe
  C:\Windows\System\GcLpJaB.exe
  2⤵
  PID:1032
- C:\Windows\System\vPMdFiH.exe
  C:\Windows\System\vPMdFiH.exe
  2⤵
  PID:2668
- C:\Windows\System\JejPRjg.exe
  C:\Windows\System\JejPRjg.exe
  2⤵
  PID:2504
- C:\Windows\System\gFTgKsw.exe
  C:\Windows\System\gFTgKsw.exe
  2⤵
  PID:2684
- C:\Windows\System\RxQACDf.exe
  C:\Windows\System\RxQACDf.exe
  2⤵
  PID:284
- C:\Windows\System\FpULJXc.exe
  C:\Windows\System\FpULJXc.exe
  2⤵
  PID:412
- C:\Windows\System\kixvhYc.exe
  C:\Windows\System\kixvhYc.exe
  2⤵
  PID:2340
- C:\Windows\System\bLmmIQJ.exe
  C:\Windows\System\bLmmIQJ.exe
  2⤵
  PID:1664
- C:\Windows\System\KdqwiUL.exe
  C:\Windows\System\KdqwiUL.exe
  2⤵
  PID:2612
- C:\Windows\System\lrcRcHy.exe
  C:\Windows\System\lrcRcHy.exe
  2⤵
  PID:3088
- C:\Windows\System\vkqMzir.exe
  C:\Windows\System\vkqMzir.exe
  2⤵
  PID:3104
- C:\Windows\System\qeNmDBj.exe
  C:\Windows\System\qeNmDBj.exe
  2⤵
  PID:3120
- C:\Windows\System\kVUEByv.exe
  C:\Windows\System\kVUEByv.exe
  2⤵
  PID:3136
- C:\Windows\System\HTTxZUE.exe
  C:\Windows\System\HTTxZUE.exe
  2⤵
  PID:3152
- C:\Windows\System\LUDxHtu.exe
  C:\Windows\System\LUDxHtu.exe
  2⤵
  PID:3168
- C:\Windows\System\JBywqbA.exe
  C:\Windows\System\JBywqbA.exe
  2⤵
  PID:3184
- C:\Windows\System\THFSTMQ.exe
  C:\Windows\System\THFSTMQ.exe
  2⤵
  PID:3200
- C:\Windows\System\cBgmvnq.exe
  C:\Windows\System\cBgmvnq.exe
  2⤵
  PID:3216
- C:\Windows\System\VREgmzg.exe
  C:\Windows\System\VREgmzg.exe
  2⤵
  PID:3240
- C:\Windows\System\HyMcEjO.exe
  C:\Windows\System\HyMcEjO.exe
  2⤵
  PID:3256
- C:\Windows\System\uARPqck.exe
  C:\Windows\System\uARPqck.exe
  2⤵
  PID:3272
- C:\Windows\System\niPMBmr.exe
  C:\Windows\System\niPMBmr.exe
  2⤵
  PID:3288
- C:\Windows\System\NCrTiWX.exe
  C:\Windows\System\NCrTiWX.exe
  2⤵
  PID:3304
- C:\Windows\System\IdUOgpP.exe
  C:\Windows\System\IdUOgpP.exe
  2⤵
  PID:3320
- C:\Windows\System\RTwXLrP.exe
  C:\Windows\System\RTwXLrP.exe
  2⤵
  PID:3336
- C:\Windows\System\zNfuvnx.exe
  C:\Windows\System\zNfuvnx.exe
  2⤵
  PID:3364
- C:\Windows\System\lepDHaG.exe
  C:\Windows\System\lepDHaG.exe
  2⤵
  PID:3384
- C:\Windows\System\SBXDsrA.exe
  C:\Windows\System\SBXDsrA.exe
  2⤵
  PID:3404
- C:\Windows\System\lzRzdvQ.exe
  C:\Windows\System\lzRzdvQ.exe
  2⤵
  PID:3428
- C:\Windows\System\yzdhutA.exe
  C:\Windows\System\yzdhutA.exe
  2⤵
  PID:3444
- C:\Windows\System\ZrGXZZU.exe
  C:\Windows\System\ZrGXZZU.exe
  2⤵
  PID:3460
- C:\Windows\System\ThHfQAH.exe
  C:\Windows\System\ThHfQAH.exe
  2⤵
  PID:3480
- C:\Windows\System\vHYTMtw.exe
  C:\Windows\System\vHYTMtw.exe
  2⤵
  PID:3496
- C:\Windows\System\lvFqHbi.exe
  C:\Windows\System\lvFqHbi.exe
  2⤵
  PID:3512
- C:\Windows\System\OScYmKh.exe
  C:\Windows\System\OScYmKh.exe
  2⤵
  PID:3528
- C:\Windows\System\DLjjFxN.exe
  C:\Windows\System\DLjjFxN.exe
  2⤵
  PID:3580
- C:\Windows\System\aPhEvwc.exe
  C:\Windows\System\aPhEvwc.exe
  2⤵
  PID:3596
- C:\Windows\System\mROXSMV.exe
  C:\Windows\System\mROXSMV.exe
  2⤵
  PID:3612
- C:\Windows\System\NpUGdXW.exe
  C:\Windows\System\NpUGdXW.exe
  2⤵
  PID:3628
- C:\Windows\System\sHGLzuL.exe
  C:\Windows\System\sHGLzuL.exe
  2⤵
  PID:3644
- C:\Windows\System\oiFtPSO.exe
  C:\Windows\System\oiFtPSO.exe
  2⤵
  PID:3660
- C:\Windows\System\uWEGStP.exe
  C:\Windows\System\uWEGStP.exe
  2⤵
  PID:3676
- C:\Windows\System\QjwTYaR.exe
  C:\Windows\System\QjwTYaR.exe
  2⤵
  PID:3692
- C:\Windows\System\YtUkfUM.exe
  C:\Windows\System\YtUkfUM.exe
  2⤵
  PID:3708
- C:\Windows\System\naRiadl.exe
  C:\Windows\System\naRiadl.exe
  2⤵
  PID:3728
- C:\Windows\System\FchaCIM.exe
  C:\Windows\System\FchaCIM.exe
  2⤵
  PID:3768
- C:\Windows\System\wCMzAcs.exe
  C:\Windows\System\wCMzAcs.exe
  2⤵
  PID:3784
- C:\Windows\System\yXYQhsN.exe
  C:\Windows\System\yXYQhsN.exe
  2⤵
  PID:3808
- C:\Windows\System\AznYoFk.exe
  C:\Windows\System\AznYoFk.exe
  2⤵
  PID:3828
- C:\Windows\System\rqGlJfL.exe
  C:\Windows\System\rqGlJfL.exe
  2⤵
  PID:3852
- C:\Windows\System\mPpvilt.exe
  C:\Windows\System\mPpvilt.exe
  2⤵
  PID:3868
- C:\Windows\System\gBzPoeR.exe
  C:\Windows\System\gBzPoeR.exe
  2⤵
  PID:3884
- C:\Windows\System\suBnqlo.exe
  C:\Windows\System\suBnqlo.exe
  2⤵
  PID:3904
- C:\Windows\System\cNjiXTa.exe
  C:\Windows\System\cNjiXTa.exe
  2⤵
  PID:3936
- C:\Windows\System\bODUprP.exe
  C:\Windows\System\bODUprP.exe
  2⤵
  PID:3952
- C:\Windows\System\LUUSHGx.exe
  C:\Windows\System\LUUSHGx.exe
  2⤵
  PID:3984
- C:\Windows\System\ZRKkbEp.exe
  C:\Windows\System\ZRKkbEp.exe
  2⤵
  PID:4004
- C:\Windows\System\BJPhuGi.exe
  C:\Windows\System\BJPhuGi.exe
  2⤵
  PID:4028
- C:\Windows\System\NqkHAlV.exe
  C:\Windows\System\NqkHAlV.exe
  2⤵
  PID:4044
- C:\Windows\System\XIlQxXd.exe
  C:\Windows\System\XIlQxXd.exe
  2⤵
  PID:4060
- C:\Windows\System\wOmvQoG.exe
  C:\Windows\System\wOmvQoG.exe
  2⤵
  PID:4076
- C:\Windows\System\XPEmlte.exe
  C:\Windows\System\XPEmlte.exe
  2⤵
  PID:4092
- C:\Windows\System\ffkSNwf.exe
  C:\Windows\System\ffkSNwf.exe
  2⤵
  PID:1068
- C:\Windows\System\NKYbCCf.exe
  C:\Windows\System\NKYbCCf.exe
  2⤵
  PID:3096
- C:\Windows\System\tROKIOQ.exe
  C:\Windows\System\tROKIOQ.exe
  2⤵
  PID:2728
- C:\Windows\System\ffnwLvI.exe
  C:\Windows\System\ffnwLvI.exe
  2⤵
  PID:2368
- C:\Windows\System\HxfvAJx.exe
  C:\Windows\System\HxfvAJx.exe
  2⤵
  PID:792
- C:\Windows\System\TxiCywU.exe
  C:\Windows\System\TxiCywU.exe
  2⤵
  PID:1728
- C:\Windows\System\ihooazo.exe
  C:\Windows\System\ihooazo.exe
  2⤵
  PID:916
- C:\Windows\System\plvfhCZ.exe
  C:\Windows\System\plvfhCZ.exe
  2⤵
  PID:3224
- C:\Windows\System\PUWCmgb.exe
  C:\Windows\System\PUWCmgb.exe
  2⤵
  PID:3264
- C:\Windows\System\huAnXjb.exe
  C:\Windows\System\huAnXjb.exe
  2⤵
  PID:1592
- C:\Windows\System\AHfWhbs.exe
  C:\Windows\System\AHfWhbs.exe
  2⤵
  PID:2756
- C:\Windows\System\OhSGRxK.exe
  C:\Windows\System\OhSGRxK.exe
  2⤵
  PID:580
- C:\Windows\System\APmvkJJ.exe
  C:\Windows\System\APmvkJJ.exe
  2⤵
  PID:3020
- C:\Windows\System\ceCdBnZ.exe
  C:\Windows\System\ceCdBnZ.exe
  2⤵
  PID:3332
- C:\Windows\System\UDKMmyk.exe
  C:\Windows\System\UDKMmyk.exe
  2⤵
  PID:3412
- C:\Windows\System\NqZStsX.exe
  C:\Windows\System\NqZStsX.exe
  2⤵
  PID:3452
- C:\Windows\System\mjBOVtc.exe
  C:\Windows\System\mjBOVtc.exe
  2⤵
  PID:3520
- C:\Windows\System\JAqjazK.exe
  C:\Windows\System\JAqjazK.exe
  2⤵
  PID:3620
- C:\Windows\System\kETMTbv.exe
  C:\Windows\System\kETMTbv.exe
  2⤵
  PID:868
- C:\Windows\System\ZYdgWLh.exe
  C:\Windows\System\ZYdgWLh.exe
  2⤵
  PID:3944
- C:\Windows\System\qBVqNxz.exe
  C:\Windows\System\qBVqNxz.exe
  2⤵
  PID:3996
- C:\Windows\System\oXfEzvJ.exe
  C:\Windows\System\oXfEzvJ.exe
  2⤵
  PID:4072
- C:\Windows\System\mpVMNCl.exe
  C:\Windows\System\mpVMNCl.exe
  2⤵
  PID:3128
- C:\Windows\System\EMEJqOW.exe
  C:\Windows\System\EMEJqOW.exe
  2⤵
  PID:2616
- C:\Windows\System\NjwRolU.exe
  C:\Windows\System\NjwRolU.exe
  2⤵
  PID:3232
- C:\Windows\System\wzkDJVk.exe
  C:\Windows\System\wzkDJVk.exe
  2⤵
  PID:628
- C:\Windows\System\lmUXseU.exe
  C:\Windows\System\lmUXseU.exe
  2⤵
  PID:1288
- C:\Windows\System\eOKWnaT.exe
  C:\Windows\System\eOKWnaT.exe
  2⤵
  PID:2796
- C:\Windows\System\qdVKLpI.exe
  C:\Windows\System\qdVKLpI.exe
  2⤵
  PID:3688
- C:\Windows\System\orlsqdz.exe
  C:\Windows\System\orlsqdz.exe
  2⤵
  PID:2248
- C:\Windows\System\AqURpeG.exe
  C:\Windows\System\AqURpeG.exe
  2⤵
  PID:3080
- C:\Windows\System\bbPDfkI.exe
  C:\Windows\System\bbPDfkI.exe
  2⤵
  PID:3144
- C:\Windows\System\LBJDzyi.exe
  C:\Windows\System\LBJDzyi.exe
  2⤵
  PID:1132
- C:\Windows\System\KoDjPHd.exe
  C:\Windows\System\KoDjPHd.exe
  2⤵
  PID:1692
- C:\Windows\System\jGOAsmb.exe
  C:\Windows\System\jGOAsmb.exe
  2⤵
  PID:4100
- C:\Windows\System\TYRDJnB.exe
  C:\Windows\System\TYRDJnB.exe
  2⤵
  PID:4120
- C:\Windows\System\AendnCb.exe
  C:\Windows\System\AendnCb.exe
  2⤵
  PID:4136
- C:\Windows\System\IvoahCG.exe
  C:\Windows\System\IvoahCG.exe
  2⤵
  PID:4152
- C:\Windows\System\rSWDPkQ.exe
  C:\Windows\System\rSWDPkQ.exe
  2⤵
  PID:4168
- C:\Windows\System\WHjNDuE.exe
  C:\Windows\System\WHjNDuE.exe
  2⤵
  PID:4188
- C:\Windows\System\qsFeptj.exe
  C:\Windows\System\qsFeptj.exe
  2⤵
  PID:4204
- C:\Windows\System\vCLpVpy.exe
  C:\Windows\System\vCLpVpy.exe
  2⤵
  PID:4232
- C:\Windows\System\lYClxPJ.exe
  C:\Windows\System\lYClxPJ.exe
  2⤵
  PID:4260
- C:\Windows\System\WEZPkDM.exe
  C:\Windows\System\WEZPkDM.exe
  2⤵
  PID:4276
- C:\Windows\System\QUqMRsK.exe
  C:\Windows\System\QUqMRsK.exe
  2⤵
  PID:4296
- C:\Windows\System\HhVnGua.exe
  C:\Windows\System\HhVnGua.exe
  2⤵
  PID:4312
- C:\Windows\System\HALLcFq.exe
  C:\Windows\System\HALLcFq.exe
  2⤵
  PID:4336
- C:\Windows\System\UjKgdJY.exe
  C:\Windows\System\UjKgdJY.exe
  2⤵
  PID:4352
- C:\Windows\System\TEZYYoZ.exe
  C:\Windows\System\TEZYYoZ.exe
  2⤵
  PID:4372
- C:\Windows\System\WIzGxTO.exe
  C:\Windows\System\WIzGxTO.exe
  2⤵
  PID:4392
- C:\Windows\System\xTfZdlC.exe
  C:\Windows\System\xTfZdlC.exe
  2⤵
  PID:4408
- C:\Windows\System\euDGXUM.exe
  C:\Windows\System\euDGXUM.exe
  2⤵
  PID:4428
- C:\Windows\System\ZANSkYN.exe
  C:\Windows\System\ZANSkYN.exe
  2⤵
  PID:4444
- C:\Windows\System\cXvYaQC.exe
  C:\Windows\System\cXvYaQC.exe
  2⤵
  PID:4464
- C:\Windows\System\rpCCFPY.exe
  C:\Windows\System\rpCCFPY.exe
  2⤵
  PID:4480
- C:\Windows\System\IdSqlyo.exe
  C:\Windows\System\IdSqlyo.exe
  2⤵
  PID:4496
- C:\Windows\System\poCNCAC.exe
  C:\Windows\System\poCNCAC.exe
  2⤵
  PID:4512
- C:\Windows\System\DCkzKbc.exe
  C:\Windows\System\DCkzKbc.exe
  2⤵
  PID:4532
- C:\Windows\System\sBrFAFk.exe
  C:\Windows\System\sBrFAFk.exe
  2⤵
  PID:4548
- C:\Windows\System\ulsZTVY.exe
  C:\Windows\System\ulsZTVY.exe
  2⤵
  PID:4568
- C:\Windows\System\knClBOf.exe
  C:\Windows\System\knClBOf.exe
  2⤵
  PID:4588
- C:\Windows\System\FinBoBc.exe
  C:\Windows\System\FinBoBc.exe
  2⤵
  PID:4616
- C:\Windows\System\cFRNzQo.exe
  C:\Windows\System\cFRNzQo.exe
  2⤵
  PID:4632
- C:\Windows\System\qjiAImz.exe
  C:\Windows\System\qjiAImz.exe
  2⤵
  PID:4648
- C:\Windows\System\VlZBsRB.exe
  C:\Windows\System\VlZBsRB.exe
  2⤵
  PID:4668
- C:\Windows\System\bbOlZvs.exe
  C:\Windows\System\bbOlZvs.exe
  2⤵
  PID:4684
- C:\Windows\System\WEfqNzg.exe
  C:\Windows\System\WEfqNzg.exe
  2⤵
  PID:4708
- C:\Windows\System\kpQykxh.exe
  C:\Windows\System\kpQykxh.exe
  2⤵
  PID:4724
- C:\Windows\System\jsuRvuo.exe
  C:\Windows\System\jsuRvuo.exe
  2⤵
  PID:4740
- C:\Windows\System\evPTNAz.exe
  C:\Windows\System\evPTNAz.exe
  2⤵
  PID:4760
- C:\Windows\System\VmbyyJj.exe
  C:\Windows\System\VmbyyJj.exe
  2⤵
  PID:4784
- C:\Windows\System\gAGraAz.exe
  C:\Windows\System\gAGraAz.exe
  2⤵
  PID:4800
- C:\Windows\System\jsIMNxO.exe
  C:\Windows\System\jsIMNxO.exe
  2⤵
  PID:4824
- C:\Windows\System\dRcNbUj.exe
  C:\Windows\System\dRcNbUj.exe
  2⤵
  PID:4844
- C:\Windows\System\bbBsziZ.exe
  C:\Windows\System\bbBsziZ.exe
  2⤵
  PID:4864
- C:\Windows\System\bKujoDj.exe
  C:\Windows\System\bKujoDj.exe
  2⤵
  PID:4880
- C:\Windows\System\IueXGDR.exe
  C:\Windows\System\IueXGDR.exe
  2⤵
  PID:4916
- C:\Windows\System\EtKvuwr.exe
  C:\Windows\System\EtKvuwr.exe
  2⤵
  PID:4936
- C:\Windows\System\ldwWynN.exe
  C:\Windows\System\ldwWynN.exe
  2⤵
  PID:4956
- C:\Windows\System\humoyiH.exe
  C:\Windows\System\humoyiH.exe
  2⤵
  PID:4976
- C:\Windows\System\xNxaWRg.exe
  C:\Windows\System\xNxaWRg.exe
  2⤵
  PID:4996
- C:\Windows\System\IHWUHJF.exe
  C:\Windows\System\IHWUHJF.exe
  2⤵
  PID:5016
- C:\Windows\System\dHjVKbd.exe
  C:\Windows\System\dHjVKbd.exe
  2⤵
  PID:5036
- C:\Windows\System\WGLuLjM.exe
  C:\Windows\System\WGLuLjM.exe
  2⤵
  PID:5052
- C:\Windows\System\ymRSlmr.exe
  C:\Windows\System\ymRSlmr.exe
  2⤵
  PID:5068
- C:\Windows\System\SuHrZmE.exe
  C:\Windows\System\SuHrZmE.exe
  2⤵
  PID:5084
- C:\Windows\System\gakmpPo.exe
  C:\Windows\System\gakmpPo.exe
  2⤵
  PID:5100
- C:\Windows\System\EChsMYj.exe
  C:\Windows\System\EChsMYj.exe
  2⤵
  PID:5116
- C:\Windows\System\BLoHkot.exe
  C:\Windows\System\BLoHkot.exe
  2⤵
  PID:3344
- C:\Windows\System\iZMMnTw.exe
  C:\Windows\System\iZMMnTw.exe
  2⤵
  PID:3360
- C:\Windows\System\mnJislF.exe
  C:\Windows\System\mnJislF.exe
  2⤵
  PID:1824
- C:\Windows\System\HFeWahw.exe
  C:\Windows\System\HFeWahw.exe
  2⤵
  PID:3392
- C:\Windows\System\kJtLYpg.exe
  C:\Windows\System\kJtLYpg.exe
  2⤵
  PID:1568
- C:\Windows\System\GkFVHrS.exe
  C:\Windows\System\GkFVHrS.exe
  2⤵
  PID:3652
- C:\Windows\System\RaTjeSR.exe
  C:\Windows\System\RaTjeSR.exe
  2⤵
  PID:1976
- C:\Windows\System\rHFikWC.exe
  C:\Windows\System\rHFikWC.exe
  2⤵
  PID:3476
- C:\Windows\System\dqRRkXc.exe
  C:\Windows\System\dqRRkXc.exe
  2⤵
  PID:3208
- C:\Windows\System\EbbwHoJ.exe
  C:\Windows\System\EbbwHoJ.exe
  2⤵
  PID:2244
- C:\Windows\System\sgCcGTT.exe
  C:\Windows\System\sgCcGTT.exe
  2⤵
  PID:2592
- C:\Windows\System\mjyKpPQ.exe
  C:\Windows\System\mjyKpPQ.exe
  2⤵
  PID:4200
- C:\Windows\System\CticRoP.exe
  C:\Windows\System\CticRoP.exe
  2⤵
  PID:4252
- C:\Windows\System\iCmlLQn.exe
  C:\Windows\System\iCmlLQn.exe
  2⤵
  PID:4292
- C:\Windows\System\yVvsEti.exe
  C:\Windows\System\yVvsEti.exe
  2⤵
  PID:3920
- C:\Windows\System\khoYMXp.exe
  C:\Windows\System\khoYMXp.exe
  2⤵
  PID:3964
- C:\Windows\System\ERwKAsc.exe
  C:\Windows\System\ERwKAsc.exe
  2⤵
  PID:3980
- C:\Windows\System\RKoXnzH.exe
  C:\Windows\System\RKoXnzH.exe
  2⤵
  PID:4056
- C:\Windows\System\SdNAysE.exe
  C:\Windows\System\SdNAysE.exe
  2⤵
  PID:2392
- C:\Windows\System\QMUkpFk.exe
  C:\Windows\System\QMUkpFk.exe
  2⤵
  PID:4368
- C:\Windows\System\clrSbxR.exe
  C:\Windows\System\clrSbxR.exe
  2⤵
  PID:4440
- C:\Windows\System\jKHUZXo.exe
  C:\Windows\System\jKHUZXo.exe
  2⤵
  PID:4540
- C:\Windows\System\GPBRbPN.exe
  C:\Windows\System\GPBRbPN.exe
  2⤵
  PID:4624
- C:\Windows\System\yeTWYcJ.exe
  C:\Windows\System\yeTWYcJ.exe
  2⤵
  PID:2160
- C:\Windows\System\LtnIOAK.exe
  C:\Windows\System\LtnIOAK.exe
  2⤵
  PID:896
- C:\Windows\System\UuoBKFg.exe
  C:\Windows\System\UuoBKFg.exe
  2⤵
  PID:4660
- C:\Windows\System\HVqONdo.exe
  C:\Windows\System\HVqONdo.exe
  2⤵
  PID:4700
- C:\Windows\System\BUjVMCN.exe
  C:\Windows\System\BUjVMCN.exe
  2⤵
  PID:4896
- C:\Windows\System\asZqaeO.exe
  C:\Windows\System\asZqaeO.exe
  2⤵
  PID:1772
- C:\Windows\System\UgMNXev.exe
  C:\Windows\System\UgMNXev.exe
  2⤵
  PID:3820
- C:\Windows\System\BszDFLy.exe
  C:\Windows\System\BszDFLy.exe
  2⤵
  PID:2324
- C:\Windows\System\fdYTgnf.exe
  C:\Windows\System\fdYTgnf.exe
  2⤵
  PID:1516
- C:\Windows\System\fQusCdI.exe
  C:\Windows\System\fQusCdI.exe
  2⤵
  PID:2028
- C:\Windows\System\rUAZDqA.exe
  C:\Windows\System\rUAZDqA.exe
  2⤵
  PID:2632
- C:\Windows\System\bUlCAav.exe
  C:\Windows\System\bUlCAav.exe
  2⤵
  PID:3132
- C:\Windows\System\CLrJMtR.exe
  C:\Windows\System\CLrJMtR.exe
  2⤵
  PID:1500
- C:\Windows\System\yNjUaCC.exe
  C:\Windows\System\yNjUaCC.exe
  2⤵
  PID:3724
- C:\Windows\System\kyZxSYe.exe
  C:\Windows\System\kyZxSYe.exe
  2⤵
  PID:3116
- C:\Windows\System\nVIIqSo.exe
  C:\Windows\System\nVIIqSo.exe
  2⤵
  PID:3992
- C:\Windows\System\vvIUzMu.exe
  C:\Windows\System\vvIUzMu.exe
  2⤵
  PID:4148
- C:\Windows\System\LkoIqmz.exe
  C:\Windows\System\LkoIqmz.exe
  2⤵
  PID:3284
- C:\Windows\System\YNQoNLv.exe
  C:\Windows\System\YNQoNLv.exe
  2⤵
  PID:4224
- C:\Windows\System\KRypkQz.exe
  C:\Windows\System\KRypkQz.exe
  2⤵
  PID:4304
- C:\Windows\System\aBvrDHO.exe
  C:\Windows\System\aBvrDHO.exe
  2⤵
  PID:3440
- C:\Windows\System\RkMdvRA.exe
  C:\Windows\System\RkMdvRA.exe
  2⤵
  PID:4416
- C:\Windows\System\ynGEzge.exe
  C:\Windows\System\ynGEzge.exe
  2⤵
  PID:4452
- C:\Windows\System\wrOJXaY.exe
  C:\Windows\System\wrOJXaY.exe
  2⤵
  PID:4492
- C:\Windows\System\etMJAXf.exe
  C:\Windows\System\etMJAXf.exe
  2⤵
  PID:4556
- C:\Windows\System\jWDRcGY.exe
  C:\Windows\System\jWDRcGY.exe
  2⤵
  PID:4644
- C:\Windows\System\NoZQozB.exe
  C:\Windows\System\NoZQozB.exe
  2⤵
  PID:4748
- C:\Windows\System\WBconpZ.exe
  C:\Windows\System\WBconpZ.exe
  2⤵
  PID:4792
- C:\Windows\System\FJoQyVX.exe
  C:\Windows\System\FJoQyVX.exe
  2⤵
  PID:3840
- C:\Windows\System\zhBERrG.exe
  C:\Windows\System\zhBERrG.exe
  2⤵
  PID:2840
- C:\Windows\System\wtnbemQ.exe
  C:\Windows\System\wtnbemQ.exe
  2⤵
  PID:2080
- C:\Windows\System\VwORoeN.exe
  C:\Windows\System\VwORoeN.exe
  2⤵
  PID:3540
- C:\Windows\System\kpqXXWy.exe
  C:\Windows\System\kpqXXWy.exe
  2⤵
  PID:3560
- C:\Windows\System\dpTxeBJ.exe
  C:\Windows\System\dpTxeBJ.exe
  2⤵
  PID:3604
- C:\Windows\System\mHCJYmy.exe
  C:\Windows\System\mHCJYmy.exe
  2⤵
  PID:3880
- C:\Windows\System\TpYpzTX.exe
  C:\Windows\System\TpYpzTX.exe
  2⤵
  PID:4928
- C:\Windows\System\wVLvobD.exe
  C:\Windows\System\wVLvobD.exe
  2⤵
  PID:5012
- C:\Windows\System\UWVqNgd.exe
  C:\Windows\System\UWVqNgd.exe
  2⤵
  PID:3356
- C:\Windows\System\MQCBVSj.exe
  C:\Windows\System\MQCBVSj.exe
  2⤵
  PID:4132
- C:\Windows\System\BDvRxiF.exe
  C:\Windows\System\BDvRxiF.exe
  2⤵
  PID:1628
- C:\Windows\System\iYhsHUN.exe
  C:\Windows\System\iYhsHUN.exe
  2⤵
  PID:3300
- C:\Windows\System\RkREvrh.exe
  C:\Windows\System\RkREvrh.exe
  2⤵
  PID:3860
- C:\Windows\System\GADPiQJ.exe
  C:\Windows\System\GADPiQJ.exe
  2⤵
  PID:4020
- C:\Windows\System\jHhBHQh.exe
  C:\Windows\System\jHhBHQh.exe
  2⤵
  PID:4504
- C:\Windows\System\kncxEgl.exe
  C:\Windows\System\kncxEgl.exe
  2⤵
  PID:3804
- C:\Windows\System\qENkGke.exe
  C:\Windows\System\qENkGke.exe
  2⤵
  PID:3752
- C:\Windows\System\JHbpeOF.exe
  C:\Windows\System\JHbpeOF.exe
  2⤵
  PID:3740
- C:\Windows\System\dZqrPRG.exe
  C:\Windows\System\dZqrPRG.exe
  2⤵
  PID:3876
- C:\Windows\System\CzTKlFW.exe
  C:\Windows\System\CzTKlFW.exe
  2⤵
  PID:1512
- C:\Windows\System\AQTvPdl.exe
  C:\Windows\System\AQTvPdl.exe
  2⤵
  PID:2052
- C:\Windows\System\UrOKwDy.exe
  C:\Windows\System\UrOKwDy.exe
  2⤵
  PID:2156
- C:\Windows\System\BMkjvPu.exe
  C:\Windows\System\BMkjvPu.exe
  2⤵
  PID:4580
- C:\Windows\System\SwihsHv.exe
  C:\Windows\System\SwihsHv.exe
  2⤵
  PID:4696
- C:\Windows\System\mNxUDEA.exe
  C:\Windows\System\mNxUDEA.exe
  2⤵
  PID:4944
- C:\Windows\System\MLxjIeo.exe
  C:\Windows\System\MLxjIeo.exe
  2⤵
  PID:4992
- C:\Windows\System\PQwRdEx.exe
  C:\Windows\System\PQwRdEx.exe
  2⤵
  PID:4932
- C:\Windows\System\BLEZyBo.exe
  C:\Windows\System\BLEZyBo.exe
  2⤵
  PID:5076
- C:\Windows\System\TAQtNwI.exe
  C:\Windows\System\TAQtNwI.exe
  2⤵
  PID:3376
- C:\Windows\System\dNEHujF.exe
  C:\Windows\System\dNEHujF.exe
  2⤵
  PID:4364
- C:\Windows\System\vcymtFi.exe
  C:\Windows\System\vcymtFi.exe
  2⤵
  PID:4772
- C:\Windows\System\mScvEXk.exe
  C:\Windows\System\mScvEXk.exe
  2⤵
  PID:4816
- C:\Windows\System\KqliaNN.exe
  C:\Windows\System\KqliaNN.exe
  2⤵
  PID:4892
- C:\Windows\System\jFXxVFR.exe
  C:\Windows\System\jFXxVFR.exe
  2⤵
  PID:2464
- C:\Windows\System\EhipfQN.exe
  C:\Windows\System\EhipfQN.exe
  2⤵
  PID:536
- C:\Windows\System\byDCMdo.exe
  C:\Windows\System\byDCMdo.exe
  2⤵
  PID:2672
- C:\Windows\System\ntDKjMi.exe
  C:\Windows\System\ntDKjMi.exe
  2⤵
  PID:3588
- C:\Windows\System\VPOlIIw.exe
  C:\Windows\System\VPOlIIw.exe
  2⤵
  PID:2992
- C:\Windows\System\laaJcRG.exe
  C:\Windows\System\laaJcRG.exe
  2⤵
  PID:4220
- C:\Windows\System\ZZLnHsW.exe
  C:\Windows\System\ZZLnHsW.exe
  2⤵
  PID:1292
- C:\Windows\System\JNYbkZh.exe
  C:\Windows\System\JNYbkZh.exe
  2⤵
  PID:2284
- C:\Windows\System\sujxiIM.exe
  C:\Windows\System\sujxiIM.exe
  2⤵
  PID:1788
- C:\Windows\System\ZnspRRu.exe
  C:\Windows\System\ZnspRRu.exe
  2⤵
  PID:4272
- C:\Windows\System\kdKubiU.exe
  C:\Windows\System\kdKubiU.exe
  2⤵
  PID:4564
- C:\Windows\System\CjQGIvC.exe
  C:\Windows\System\CjQGIvC.exe
  2⤵
  PID:4600
- C:\Windows\System\ZXfEEUW.exe
  C:\Windows\System\ZXfEEUW.exe
  2⤵
  PID:3280
- C:\Windows\System\CEFaKjR.exe
  C:\Windows\System\CEFaKjR.exe
  2⤵
  PID:1740
- C:\Windows\System\TIAvTQG.exe
  C:\Windows\System\TIAvTQG.exe
  2⤵
  PID:3684
- C:\Windows\System\TitvMDm.exe
  C:\Windows\System\TitvMDm.exe
  2⤵
  PID:1836
- C:\Windows\System\LwGIvDN.exe
  C:\Windows\System\LwGIvDN.exe
  2⤵
  PID:3576
- C:\Windows\System\MEexGKC.exe
  C:\Windows\System\MEexGKC.exe
  2⤵
  PID:3736
- C:\Windows\System\nnpZrlK.exe
  C:\Windows\System\nnpZrlK.exe
  2⤵
  PID:4344
- C:\Windows\System\viFhXQc.exe
  C:\Windows\System\viFhXQc.exe
  2⤵
  PID:4680
- C:\Windows\System\LfhhWdX.exe
  C:\Windows\System\LfhhWdX.exe
  2⤵
  PID:1876
- C:\Windows\System\kYrAuBq.exe
  C:\Windows\System\kYrAuBq.exe
  2⤵
  PID:3316
- C:\Windows\System\gTLzqNf.exe
  C:\Windows\System\gTLzqNf.exe
  2⤵
  PID:2424
- C:\Windows\System\ukPRkKe.exe
  C:\Windows\System\ukPRkKe.exe
  2⤵
  PID:2652
- C:\Windows\System\rBaPTEN.exe
  C:\Windows\System\rBaPTEN.exe
  2⤵
  PID:4360
- C:\Windows\System\oYpVxMK.exe
  C:\Windows\System\oYpVxMK.exe
  2⤵
  PID:4716
- C:\Windows\System\StyYClw.exe
  C:\Windows\System\StyYClw.exe
  2⤵
  PID:3836
- C:\Windows\System\UisBAIS.exe
  C:\Windows\System\UisBAIS.exe
  2⤵
  PID:3552
- C:\Windows\System\GkJhxsw.exe
  C:\Windows\System\GkJhxsw.exe
  2⤵
  PID:4308
- C:\Windows\System\SZagWYN.exe
  C:\Windows\System\SZagWYN.exe
  2⤵
  PID:4576
- C:\Windows\System\jyXfXHX.exe
  C:\Windows\System\jyXfXHX.exe
  2⤵
  PID:1620
- C:\Windows\System\YlhuQdJ.exe
  C:\Windows\System\YlhuQdJ.exe
  2⤵
  PID:3196
- C:\Windows\System\UwSokkO.exe
  C:\Windows\System\UwSokkO.exe
  2⤵
  PID:4856
- C:\Windows\System\UnTdSsu.exe
  C:\Windows\System\UnTdSsu.exe
  2⤵
  PID:1520
- C:\Windows\System\ikuXtAl.exe
  C:\Windows\System\ikuXtAl.exe
  2⤵
  PID:4732
- C:\Windows\System\NfenESd.exe
  C:\Windows\System\NfenESd.exe
  2⤵
  PID:1832
- C:\Windows\System\KbRQOkJ.exe
  C:\Windows\System\KbRQOkJ.exe
  2⤵
  PID:3192
- C:\Windows\System\KInUjHd.exe
  C:\Windows\System\KInUjHd.exe
  2⤵
  PID:2060
- C:\Windows\System\yvoKGLx.exe
  C:\Windows\System\yvoKGLx.exe
  2⤵
  PID:1360
- C:\Windows\System\hXAEypJ.exe
  C:\Windows\System\hXAEypJ.exe
  2⤵
  PID:4912
- C:\Windows\System\HfhvMqB.exe
  C:\Windows\System\HfhvMqB.exe
  2⤵
  PID:4988
- C:\Windows\System\MUZxqPs.exe
  C:\Windows\System\MUZxqPs.exe
  2⤵
  PID:3488
- C:\Windows\System\fCdhDjF.exe
  C:\Windows\System\fCdhDjF.exe
  2⤵
  PID:4488
- C:\Windows\System\fgHcknt.exe
  C:\Windows\System\fgHcknt.exe
  2⤵
  PID:4756
- C:\Windows\System\mWmmVOU.exe
  C:\Windows\System\mWmmVOU.exe
  2⤵
  PID:1280
- C:\Windows\System\JUJCcjx.exe
  C:\Windows\System\JUJCcjx.exe
  2⤵
  PID:5044
- C:\Windows\System\trQDhri.exe
  C:\Windows\System\trQDhri.exe
  2⤵
  PID:4180
- C:\Windows\System\ujwiooe.exe
  C:\Windows\System\ujwiooe.exe
  2⤵
  PID:5092
- C:\Windows\System\BgenAVn.exe
  C:\Windows\System\BgenAVn.exe
  2⤵
  PID:1612
- C:\Windows\System\UBQEZak.exe
  C:\Windows\System\UBQEZak.exe
  2⤵
  PID:4268
- C:\Windows\System\rkAAUHj.exe
  C:\Windows\System\rkAAUHj.exe
  2⤵
  PID:4324
- C:\Windows\System\gpCdFGj.exe
  C:\Windows\System\gpCdFGj.exe
  2⤵
  PID:5108
- C:\Windows\System\TnVpdkm.exe
  C:\Windows\System\TnVpdkm.exe
  2⤵
  PID:4052
- C:\Windows\System\XirlWsw.exe
  C:\Windows\System\XirlWsw.exe
  2⤵
  PID:4836
- C:\Windows\System\LXXCNrh.exe
  C:\Windows\System\LXXCNrh.exe
  2⤵
  PID:5112
- C:\Windows\System\cJroGin.exe
  C:\Windows\System\cJroGin.exe
  2⤵
  PID:4656
- C:\Windows\System\bCiYfos.exe
  C:\Windows\System\bCiYfos.exe
  2⤵
  PID:3756
- C:\Windows\System\LbAgHaq.exe
  C:\Windows\System\LbAgHaq.exe
  2⤵
  PID:4768
- C:\Windows\System\QtnSZWk.exe
  C:\Windows\System\QtnSZWk.exe
  2⤵
  PID:5032
- C:\Windows\System\nxOSdrs.exe
  C:\Windows\System\nxOSdrs.exe
  2⤵
  PID:3972
- C:\Windows\System\EFwIZNt.exe
  C:\Windows\System\EFwIZNt.exe
  2⤵
  PID:5048
- C:\Windows\System\VxULfKY.exe
  C:\Windows\System\VxULfKY.exe
  2⤵
  PID:5128
- C:\Windows\System\tGGmzWL.exe
  C:\Windows\System\tGGmzWL.exe
  2⤵
  PID:5160
- C:\Windows\System\KcWXOuL.exe
  C:\Windows\System\KcWXOuL.exe
  2⤵
  PID:5200
- C:\Windows\System\kbdctXC.exe
  C:\Windows\System\kbdctXC.exe
  2⤵
  PID:5220
- C:\Windows\System\oArZjCb.exe
  C:\Windows\System\oArZjCb.exe
  2⤵
  PID:5248
- C:\Windows\System\NpHDYkd.exe
  C:\Windows\System\NpHDYkd.exe
  2⤵
  PID:5264
- C:\Windows\System\UiZgbVG.exe
  C:\Windows\System\UiZgbVG.exe
  2⤵
  PID:5280
- C:\Windows\System\VhXzqyy.exe
  C:\Windows\System\VhXzqyy.exe
  2⤵
  PID:5304
- C:\Windows\System\oMbElxs.exe
  C:\Windows\System\oMbElxs.exe
  2⤵
  PID:5336
- C:\Windows\System\aUyVdum.exe
  C:\Windows\System\aUyVdum.exe
  2⤵
  PID:5376
- C:\Windows\System\XGHZQDB.exe
  C:\Windows\System\XGHZQDB.exe
  2⤵
  PID:5392
- C:\Windows\System\GPgbsOs.exe
  C:\Windows\System\GPgbsOs.exe
  2⤵
  PID:5480
- C:\Windows\System\gOUDvhL.exe
  C:\Windows\System\gOUDvhL.exe
  2⤵
  PID:5508
- C:\Windows\System\RhgxWnX.exe
  C:\Windows\System\RhgxWnX.exe
  2⤵
  PID:5524
- C:\Windows\System\icbcUQI.exe
  C:\Windows\System\icbcUQI.exe
  2⤵
  PID:5540
- C:\Windows\System\dCFhNrK.exe
  C:\Windows\System\dCFhNrK.exe
  2⤵
  PID:5560
- C:\Windows\System\vnSNvAu.exe
  C:\Windows\System\vnSNvAu.exe
  2⤵
  PID:5580
- C:\Windows\System\pTGFBPq.exe
  C:\Windows\System\pTGFBPq.exe
  2⤵
  PID:5596
- C:\Windows\System\ycGMbXZ.exe
  C:\Windows\System\ycGMbXZ.exe
  2⤵
  PID:5616
- C:\Windows\System\HoMXOVv.exe
  C:\Windows\System\HoMXOVv.exe
  2⤵
  PID:5632
- C:\Windows\System\UkYeSgp.exe
  C:\Windows\System\UkYeSgp.exe
  2⤵
  PID:5652
- C:\Windows\System\KkeHIgE.exe
  C:\Windows\System\KkeHIgE.exe
  2⤵
  PID:5668
- C:\Windows\System\XyryeNZ.exe
  C:\Windows\System\XyryeNZ.exe
  2⤵
  PID:5688
- C:\Windows\System\iYqHgCJ.exe
  C:\Windows\System\iYqHgCJ.exe
  2⤵
  PID:5708
- C:\Windows\System\Kpptfms.exe
  C:\Windows\System\Kpptfms.exe
  2⤵
  PID:5724
- C:\Windows\System\nvNaGfP.exe
  C:\Windows\System\nvNaGfP.exe
  2⤵
  PID:5740
- C:\Windows\System\qnpauCK.exe
  C:\Windows\System\qnpauCK.exe
  2⤵
  PID:5760
- C:\Windows\System\ZBoKygP.exe
  C:\Windows\System\ZBoKygP.exe
  2⤵
  PID:5776
- C:\Windows\System\slXSzRt.exe
  C:\Windows\System\slXSzRt.exe
  2⤵
  PID:5792
- C:\Windows\System\ZVMjBtb.exe
  C:\Windows\System\ZVMjBtb.exe
  2⤵
  PID:5808
- C:\Windows\System\eoLIoNk.exe
  C:\Windows\System\eoLIoNk.exe
  2⤵
  PID:5824
- C:\Windows\System\mHYabTl.exe
  C:\Windows\System\mHYabTl.exe
  2⤵
  PID:5840
- C:\Windows\System\yftuvfR.exe
  C:\Windows\System\yftuvfR.exe
  2⤵
  PID:5856
- C:\Windows\System\mCLpXOe.exe
  C:\Windows\System\mCLpXOe.exe
  2⤵
  PID:5876
- C:\Windows\System\AwjxwKq.exe
  C:\Windows\System\AwjxwKq.exe
  2⤵
  PID:5892
- C:\Windows\System\iQqfhiv.exe
  C:\Windows\System\iQqfhiv.exe
  2⤵
  PID:5912
- C:\Windows\System\uGgOwbo.exe
  C:\Windows\System\uGgOwbo.exe
  2⤵
  PID:5928
- C:\Windows\System\CwSoopD.exe
  C:\Windows\System\CwSoopD.exe
  2⤵
  PID:5944
- C:\Windows\System\KEeFxet.exe
  C:\Windows\System\KEeFxet.exe
  2⤵
  PID:5960
- C:\Windows\System\xbIwFlB.exe
  C:\Windows\System\xbIwFlB.exe
  2⤵
  PID:5984
- C:\Windows\System\NaTCpfu.exe
  C:\Windows\System\NaTCpfu.exe
  2⤵
  PID:6000
- C:\Windows\System\hrLxIDv.exe
  C:\Windows\System\hrLxIDv.exe
  2⤵
  PID:6016
- C:\Windows\System\RorGgwa.exe
  C:\Windows\System\RorGgwa.exe
  2⤵
  PID:6036
- C:\Windows\System\LRLbVyQ.exe
  C:\Windows\System\LRLbVyQ.exe
  2⤵
  PID:6052
- C:\Windows\System\PRTnnKU.exe
  C:\Windows\System\PRTnnKU.exe
  2⤵
  PID:6076
- C:\Windows\System\SNMPTHu.exe
  C:\Windows\System\SNMPTHu.exe
  2⤵
  PID:6096
- C:\Windows\System\RCzTYWw.exe
  C:\Windows\System\RCzTYWw.exe
  2⤵
  PID:6116
- C:\Windows\System\cNNnNDU.exe
  C:\Windows\System\cNNnNDU.exe
  2⤵
  PID:6136
- C:\Windows\System\UAcOtio.exe
  C:\Windows\System\UAcOtio.exe
  2⤵
  PID:3932
- C:\Windows\System\owRYUbi.exe
  C:\Windows\System\owRYUbi.exe
  2⤵
  PID:1044
- C:\Windows\System\ETemPLH.exe
  C:\Windows\System\ETemPLH.exe
  2⤵
  PID:3352
- C:\Windows\System\SsrFwcM.exe
  C:\Windows\System\SsrFwcM.exe
  2⤵
  PID:1676
- C:\Windows\System\BhercWM.exe
  C:\Windows\System\BhercWM.exe
  2⤵
  PID:4692
- C:\Windows\System\DkUenbG.exe
  C:\Windows\System\DkUenbG.exe
  2⤵
  PID:3976
- C:\Windows\System\YMEtOoz.exe
  C:\Windows\System\YMEtOoz.exe
  2⤵
  PID:3900
- C:\Windows\System\QDgFDLi.exe
  C:\Windows\System\QDgFDLi.exe
  2⤵
  PID:4216
- C:\Windows\System\NPgWkJa.exe
  C:\Windows\System\NPgWkJa.exe
  2⤵
  PID:4036
- C:\Windows\System\kkhflHv.exe
  C:\Windows\System\kkhflHv.exe
  2⤵
  PID:4524
- C:\Windows\System\hQReSmc.exe
  C:\Windows\System\hQReSmc.exe
  2⤵
  PID:4528
- C:\Windows\System\zctQhWM.exe
  C:\Windows\System\zctQhWM.exe
  2⤵
  PID:2952
- C:\Windows\System\qikbqKg.exe
  C:\Windows\System\qikbqKg.exe
  2⤵
  PID:5124
- C:\Windows\System\CwDUsli.exe
  C:\Windows\System\CwDUsli.exe
  2⤵
  PID:5180
- C:\Windows\System\XoePwWb.exe
  C:\Windows\System\XoePwWb.exe
  2⤵
  PID:5196
- C:\Windows\System\ycvmZOX.exe
  C:\Windows\System\ycvmZOX.exe
  2⤵
  PID:2132
- C:\Windows\System\wdYjckV.exe
  C:\Windows\System\wdYjckV.exe
  2⤵
  PID:5244
- C:\Windows\System\YNWkXEy.exe
  C:\Windows\System\YNWkXEy.exe
  2⤵
  PID:4284
- C:\Windows\System\OCORKlL.exe
  C:\Windows\System\OCORKlL.exe
  2⤵
  PID:1880
- C:\Windows\System\OjEbTJH.exe
  C:\Windows\System\OjEbTJH.exe
  2⤵
  PID:5152
- C:\Windows\System\PPYGgXG.exe
  C:\Windows\System\PPYGgXG.exe
  2⤵
  PID:5328
- C:\Windows\System\PdLQZCX.exe
  C:\Windows\System\PdLQZCX.exe
  2⤵
  PID:5260
- C:\Windows\System\JNxdpSK.exe
  C:\Windows\System\JNxdpSK.exe
  2⤵
  PID:5344
- C:\Windows\System\bPYRlap.exe
  C:\Windows\System\bPYRlap.exe
  2⤵
  PID:5364
- C:\Windows\System\QhKWBBB.exe
  C:\Windows\System\QhKWBBB.exe
  2⤵
  PID:5400
- C:\Windows\System\jJuNOwK.exe
  C:\Windows\System\jJuNOwK.exe
  2⤵
  PID:5516
- C:\Windows\System\oiWYkHL.exe
  C:\Windows\System\oiWYkHL.exe
  2⤵
  PID:5436
- C:\Windows\System\AKiJtUc.exe
  C:\Windows\System\AKiJtUc.exe
  2⤵
  PID:5504
- C:\Windows\System\ZtgbQnG.exe
  C:\Windows\System\ZtgbQnG.exe
  2⤵
  PID:5536
- C:\Windows\System\rSluXej.exe
  C:\Windows\System\rSluXej.exe
  2⤵
  PID:5452
- C:\Windows\System\ObstoZx.exe
  C:\Windows\System\ObstoZx.exe
  2⤵
  PID:5464
- C:\Windows\System\lcwugxH.exe
  C:\Windows\System\lcwugxH.exe
  2⤵
  PID:5608
- C:\Windows\System\IANvCiU.exe
  C:\Windows\System\IANvCiU.exe
  2⤵
  PID:5612
- C:\Windows\System\soGmxfy.exe
  C:\Windows\System\soGmxfy.exe
  2⤵
  PID:5648
- C:\Windows\System\ANejCdJ.exe
  C:\Windows\System\ANejCdJ.exe
  2⤵
  PID:5664
- C:\Windows\System\wDfMQks.exe
  C:\Windows\System\wDfMQks.exe
  2⤵
  PID:5628
- C:\Windows\System\mgtZrAy.exe
  C:\Windows\System\mgtZrAy.exe
  2⤵
  PID:5720
- C:\Windows\System\nhXeVRI.exe
  C:\Windows\System\nhXeVRI.exe
  2⤵
  PID:5820
- C:\Windows\System\XLHeQnR.exe
  C:\Windows\System\XLHeQnR.exe
  2⤵
  PID:5832
- C:\Windows\System\qaTtioN.exe
  C:\Windows\System\qaTtioN.exe
  2⤵
  PID:5904
- C:\Windows\System\JQQSDrC.exe
  C:\Windows\System\JQQSDrC.exe
  2⤵
  PID:5976
- C:\Windows\System\qiMhCVf.exe
  C:\Windows\System\qiMhCVf.exe
  2⤵
  PID:5920
- C:\Windows\System\hrjdwDs.exe
  C:\Windows\System\hrjdwDs.exe
  2⤵
  PID:5992
- C:\Windows\System\jXMvvMt.exe
  C:\Windows\System\jXMvvMt.exe
  2⤵
  PID:6032
- C:\Windows\System\WmtgOkz.exe
  C:\Windows\System\WmtgOkz.exe
  2⤵
  PID:6104
- C:\Windows\System\qmdgtrc.exe
  C:\Windows\System\qmdgtrc.exe
  2⤵
  PID:4112
- C:\Windows\System\oRnPKWJ.exe
  C:\Windows\System\oRnPKWJ.exe
  2⤵
  PID:3960
- C:\Windows\System\ZnUptoc.exe
  C:\Windows\System\ZnUptoc.exe
  2⤵
  PID:1804
- C:\Windows\System\njhovTw.exe
  C:\Windows\System\njhovTw.exe
  2⤵
  PID:4184
- C:\Windows\System\iTOHJkZ.exe
  C:\Windows\System\iTOHJkZ.exe
  2⤵
  PID:6044
- C:\Windows\System\TQqtEwU.exe
  C:\Windows\System\TQqtEwU.exe
  2⤵
  PID:6084
- C:\Windows\System\gvcZwsX.exe
  C:\Windows\System\gvcZwsX.exe
  2⤵
  PID:4116
- C:\Windows\System\aFIQMpJ.exe
  C:\Windows\System\aFIQMpJ.exe
  2⤵
  PID:3064
- C:\Windows\System\xoRzLLa.exe
  C:\Windows\System\xoRzLLa.exe
  2⤵
  PID:4924
- C:\Windows\System\IaFiZHU.exe
  C:\Windows\System\IaFiZHU.exe
  2⤵
  PID:3760
- C:\Windows\System\DTypAUT.exe
  C:\Windows\System\DTypAUT.exe
  2⤵
  PID:2940
- C:\Windows\System\JmZcXvP.exe
  C:\Windows\System\JmZcXvP.exe
  2⤵
  PID:5968
- C:\Windows\System\YhIgwHp.exe
  C:\Windows\System\YhIgwHp.exe
  2⤵
  PID:5144
- C:\Windows\System\XVJiKIJ.exe
  C:\Windows\System\XVJiKIJ.exe
  2⤵
  PID:6088
- C:\Windows\System\DxCyRnJ.exe
  C:\Windows\System\DxCyRnJ.exe
  2⤵
  PID:5404
- C:\Windows\System\XmBdtYV.exe
  C:\Windows\System\XmBdtYV.exe
  2⤵
  PID:5208
- C:\Windows\System\cbjCnRx.exe
  C:\Windows\System\cbjCnRx.exe
  2⤵
  PID:5312
- C:\Windows\System\jiBFXlX.exe
  C:\Windows\System\jiBFXlX.exe
  2⤵
  PID:5388
- C:\Windows\System\QMvliWC.exe
  C:\Windows\System\QMvliWC.exe
  2⤵
  PID:5476
- C:\Windows\System\fyACnKw.exe
  C:\Windows\System\fyACnKw.exe
  2⤵
  PID:5588
- C:\Windows\System\SwbRBGS.exe
  C:\Windows\System\SwbRBGS.exe
  2⤵
  PID:6024
- C:\Windows\System\GjdWTse.exe
  C:\Windows\System\GjdWTse.exe
  2⤵
  PID:6008
- C:\Windows\System\rpZPsve.exe
  C:\Windows\System\rpZPsve.exe
  2⤵
  PID:5296
- C:\Windows\System\JRvykji.exe
  C:\Windows\System\JRvykji.exe
  2⤵
  PID:5428
- C:\Windows\System\GdBmSVH.exe
  C:\Windows\System\GdBmSVH.exe
  2⤵
  PID:5500
- C:\Windows\System\dliAtuD.exe
  C:\Windows\System\dliAtuD.exe
  2⤵
  PID:5460
- C:\Windows\System\wTuzxIB.exe
  C:\Windows\System\wTuzxIB.exe
  2⤵
  PID:5680
- C:\Windows\System\sViupjQ.exe
  C:\Windows\System\sViupjQ.exe
  2⤵
  PID:5772
- C:\Windows\System\pUBnkbp.exe
  C:\Windows\System\pUBnkbp.exe
  2⤵
  PID:2788
- C:\Windows\System\VsuBKlS.exe
  C:\Windows\System\VsuBKlS.exe
  2⤵
  PID:5736
- C:\Windows\System\kXVzKBM.exe
  C:\Windows\System\kXVzKBM.exe
  2⤵
  PID:4972
- C:\Windows\System\zpMoxLU.exe
  C:\Windows\System\zpMoxLU.exe
  2⤵
  PID:4400
- C:\Windows\System\rqOQAOZ.exe
  C:\Windows\System\rqOQAOZ.exe
  2⤵
  PID:5356
- C:\Windows\System\rWrHpmy.exe
  C:\Windows\System\rWrHpmy.exe
  2⤵
  PID:5784
- C:\Windows\System\OAmWKge.exe
  C:\Windows\System\OAmWKge.exe
  2⤵
  PID:5804
- C:\Windows\System\XyFurhu.exe
  C:\Windows\System\XyFurhu.exe
  2⤵
  PID:5956
- C:\Windows\System\UtfJvbZ.exe
  C:\Windows\System\UtfJvbZ.exe
  2⤵
  PID:3848
- C:\Windows\System\EzCHuuc.exe
  C:\Windows\System\EzCHuuc.exe
  2⤵
  PID:5216
- C:\Windows\System\MVBtofL.exe
  C:\Windows\System\MVBtofL.exe
  2⤵
  PID:2416
- C:\Windows\System\cKwxCuX.exe
  C:\Windows\System\cKwxCuX.exe
  2⤵
  PID:5292
- C:\Windows\System\rBGDXpn.exe
  C:\Windows\System\rBGDXpn.exe
  2⤵
  PID:5324
- C:\Windows\System\HHOeqql.exe
  C:\Windows\System\HHOeqql.exe
  2⤵
  PID:5888
- C:\Windows\System\YZgxpAq.exe
  C:\Windows\System\YZgxpAq.exe
  2⤵
  PID:6124
- C:\Windows\System\MMvrXFN.exe
  C:\Windows\System\MMvrXFN.exe
  2⤵
  PID:2556
- C:\Windows\System\NjTtJHR.exe
  C:\Windows\System\NjTtJHR.exe
  2⤵
  PID:1704
- C:\Windows\System\kbtQoVb.exe
  C:\Windows\System\kbtQoVb.exe
  2⤵
  PID:5532
- C:\Windows\System\WOqutmf.exe
  C:\Windows\System\WOqutmf.exe
  2⤵
  PID:6012
- C:\Windows\System\BojwLXG.exe
  C:\Windows\System\BojwLXG.exe
  2⤵
  PID:5256
- C:\Windows\System\hKOEMYN.exe
  C:\Windows\System\hKOEMYN.exe
  2⤵
  PID:5788
- C:\Windows\System\DsGlCHq.exe
  C:\Windows\System\DsGlCHq.exe
  2⤵
  PID:5940
- C:\Windows\System\LjGNDRW.exe
  C:\Windows\System\LjGNDRW.exe
  2⤵
  PID:5236
- C:\Windows\System\FSuAEXU.exe
  C:\Windows\System\FSuAEXU.exe
  2⤵
  PID:5800
- C:\Windows\System\HrYpMKW.exe
  C:\Windows\System\HrYpMKW.exe
  2⤵
  PID:4144
- C:\Windows\System\hDOyutS.exe
  C:\Windows\System\hDOyutS.exe
  2⤵
  PID:5288
- C:\Windows\System\xjxJYbN.exe
  C:\Windows\System\xjxJYbN.exe
  2⤵
  PID:6132
- C:\Windows\System\jIbxlmo.exe
  C:\Windows\System\jIbxlmo.exe
  2⤵
  PID:4460
- C:\Windows\System\zxDOXwV.exe
  C:\Windows\System\zxDOXwV.exe
  2⤵
  PID:2560
- C:\Windows\System\kjRhNVh.exe
  C:\Windows\System\kjRhNVh.exe
  2⤵
  PID:3572
- C:\Windows\System\KYfdYkW.exe
  C:\Windows\System\KYfdYkW.exe
  2⤵
  PID:6072
- C:\Windows\System\INlqlkI.exe
  C:\Windows\System\INlqlkI.exe
  2⤵
  PID:1160
- C:\Windows\System\Cytuowe.exe
  C:\Windows\System\Cytuowe.exe
  2⤵
  PID:5644
- C:\Windows\System\eAoIKbj.exe
  C:\Windows\System\eAoIKbj.exe
  2⤵
  PID:4812
- C:\Windows\System\FPxITAm.exe
  C:\Windows\System\FPxITAm.exe
  2⤵
  PID:2252
- C:\Windows\System\LcGLSlS.exe
  C:\Windows\System\LcGLSlS.exe
  2⤵
  PID:5756
- C:\Windows\System\WieDBfS.exe
  C:\Windows\System\WieDBfS.exe
  2⤵
  PID:5576
- C:\Windows\System\jvxpiga.exe
  C:\Windows\System\jvxpiga.exe
  2⤵
  PID:1636
- C:\Windows\System\jjqZEAY.exe
  C:\Windows\System\jjqZEAY.exe
  2⤵
  PID:5704
- C:\Windows\System\xCjlamz.exe
  C:\Windows\System\xCjlamz.exe
  2⤵
  PID:5140
- C:\Windows\System\fKmXVvn.exe
  C:\Windows\System\fKmXVvn.exe
  2⤵
  PID:6160
- C:\Windows\System\cUonFcY.exe
  C:\Windows\System\cUonFcY.exe
  2⤵
  PID:6176
- C:\Windows\System\SsQHuGn.exe
  C:\Windows\System\SsQHuGn.exe
  2⤵
  PID:6192
- C:\Windows\System\RUwXrNu.exe
  C:\Windows\System\RUwXrNu.exe
  2⤵
  PID:6208
- C:\Windows\System\GPwOXgb.exe
  C:\Windows\System\GPwOXgb.exe
  2⤵
  PID:6228
- C:\Windows\System\CzUVHAj.exe
  C:\Windows\System\CzUVHAj.exe
  2⤵
  PID:6244
- C:\Windows\System\rHcvotX.exe
  C:\Windows\System\rHcvotX.exe
  2⤵
  PID:6260
- C:\Windows\System\RchQiPY.exe
  C:\Windows\System\RchQiPY.exe
  2⤵
  PID:6276
- C:\Windows\System\UJDhHcO.exe
  C:\Windows\System\UJDhHcO.exe
  2⤵
  PID:6292
- C:\Windows\System\TCkjNwF.exe
  C:\Windows\System\TCkjNwF.exe
  2⤵
  PID:6308
- C:\Windows\System\QHiBUbn.exe
  C:\Windows\System\QHiBUbn.exe
  2⤵
  PID:6324
- C:\Windows\System\PwSBMjt.exe
  C:\Windows\System\PwSBMjt.exe
  2⤵
  PID:6340
- C:\Windows\System\hqWvRmy.exe
  C:\Windows\System\hqWvRmy.exe
  2⤵
  PID:6356
- C:\Windows\System\qcoHgxu.exe
  C:\Windows\System\qcoHgxu.exe
  2⤵
  PID:6372
- C:\Windows\System\njJYPrq.exe
  C:\Windows\System\njJYPrq.exe
  2⤵
  PID:6388
- C:\Windows\System\jqNptti.exe
  C:\Windows\System\jqNptti.exe
  2⤵
  PID:6404
- C:\Windows\System\muUEJSJ.exe
  C:\Windows\System\muUEJSJ.exe
  2⤵
  PID:6420
- C:\Windows\System\BbHEPTa.exe
  C:\Windows\System\BbHEPTa.exe
  2⤵
  PID:6436
- C:\Windows\System\wsJvRif.exe
  C:\Windows\System\wsJvRif.exe
  2⤵
  PID:6452
- C:\Windows\System\vFUHACp.exe
  C:\Windows\System\vFUHACp.exe
  2⤵
  PID:6468
- C:\Windows\System\bqpnOdt.exe
  C:\Windows\System\bqpnOdt.exe
  2⤵
  PID:6484
- C:\Windows\System\mwPXzwH.exe
  C:\Windows\System\mwPXzwH.exe
  2⤵
  PID:6500
- C:\Windows\System\fHUxAMZ.exe
  C:\Windows\System\fHUxAMZ.exe
  2⤵
  PID:6516
- C:\Windows\System\MByRFMC.exe
  C:\Windows\System\MByRFMC.exe
  2⤵
  PID:6532
- C:\Windows\System\YtvWtca.exe
  C:\Windows\System\YtvWtca.exe
  2⤵
  PID:6548
- C:\Windows\System\YZzyPpi.exe
  C:\Windows\System\YZzyPpi.exe
  2⤵
  PID:6564
- C:\Windows\System\RgUeyvH.exe
  C:\Windows\System\RgUeyvH.exe
  2⤵
  PID:6580
- C:\Windows\System\kRHGFXK.exe
  C:\Windows\System\kRHGFXK.exe
  2⤵
  PID:6596
- C:\Windows\System\yhQJUpa.exe
  C:\Windows\System\yhQJUpa.exe
  2⤵
  PID:6612
- C:\Windows\System\FJuTVVR.exe
  C:\Windows\System\FJuTVVR.exe
  2⤵
  PID:6628
- C:\Windows\System\JsFOPUL.exe
  C:\Windows\System\JsFOPUL.exe
  2⤵
  PID:6644
- C:\Windows\System\fmMttLz.exe
  C:\Windows\System\fmMttLz.exe
  2⤵
  PID:6660
- C:\Windows\System\VQaRAlY.exe
  C:\Windows\System\VQaRAlY.exe
  2⤵
  PID:6676
- C:\Windows\System\Mpqkcyr.exe
  C:\Windows\System\Mpqkcyr.exe
  2⤵
  PID:6692
- C:\Windows\System\DpnmTNP.exe
  C:\Windows\System\DpnmTNP.exe
  2⤵
  PID:6708
- C:\Windows\System\INklgTO.exe
  C:\Windows\System\INklgTO.exe
  2⤵
  PID:6724
- C:\Windows\System\iUBDZrF.exe
  C:\Windows\System\iUBDZrF.exe
  2⤵
  PID:6744
- C:\Windows\System\WqthhDE.exe
  C:\Windows\System\WqthhDE.exe
  2⤵
  PID:6760
- C:\Windows\System\HAARtsI.exe
  C:\Windows\System\HAARtsI.exe
  2⤵
  PID:6776
- C:\Windows\System\NhaLwVK.exe
  C:\Windows\System\NhaLwVK.exe
  2⤵
  PID:6792
- C:\Windows\System\TpaMvts.exe
  C:\Windows\System\TpaMvts.exe
  2⤵
  PID:6808
- C:\Windows\System\ehHaVtI.exe
  C:\Windows\System\ehHaVtI.exe
  2⤵
  PID:6824
- C:\Windows\System\ZhfLXRD.exe
  C:\Windows\System\ZhfLXRD.exe
  2⤵
  PID:6840
- C:\Windows\System\AkObqyk.exe
  C:\Windows\System\AkObqyk.exe
  2⤵
  PID:6856
- C:\Windows\System\ETrnlkw.exe
  C:\Windows\System\ETrnlkw.exe
  2⤵
  PID:6872
- C:\Windows\System\hrnEOgb.exe
  C:\Windows\System\hrnEOgb.exe
  2⤵
  PID:6888
- C:\Windows\System\fqrYSfa.exe
  C:\Windows\System\fqrYSfa.exe
  2⤵
  PID:6904
- C:\Windows\System\bEBMhhV.exe
  C:\Windows\System\bEBMhhV.exe
  2⤵
  PID:6920
- C:\Windows\System\vUXECid.exe
  C:\Windows\System\vUXECid.exe
  2⤵
  PID:6936
- C:\Windows\System\UBOOSPd.exe
  C:\Windows\System\UBOOSPd.exe
  2⤵
  PID:6952
- C:\Windows\System\fRYljXa.exe
  C:\Windows\System\fRYljXa.exe
  2⤵
  PID:6968
- C:\Windows\System\PhHGrjc.exe
  C:\Windows\System\PhHGrjc.exe
  2⤵
  PID:6984
- C:\Windows\System\OiSUVdI.exe
  C:\Windows\System\OiSUVdI.exe
  2⤵
  PID:7000
- C:\Windows\System\eZQfMKJ.exe
  C:\Windows\System\eZQfMKJ.exe
  2⤵
  PID:7016
- C:\Windows\System\Yjrqkrh.exe
  C:\Windows\System\Yjrqkrh.exe
  2⤵
  PID:7032
- C:\Windows\System\oNshhih.exe
  C:\Windows\System\oNshhih.exe
  2⤵
  PID:7048
- C:\Windows\System\nFMXJOh.exe
  C:\Windows\System\nFMXJOh.exe
  2⤵
  PID:7064
- C:\Windows\System\GkhRqgX.exe
  C:\Windows\System\GkhRqgX.exe
  2⤵
  PID:7080
- C:\Windows\System\BaAoGRz.exe
  C:\Windows\System\BaAoGRz.exe
  2⤵
  PID:7096
- C:\Windows\System\CtbAmUO.exe
  C:\Windows\System\CtbAmUO.exe
  2⤵
  PID:7112
- C:\Windows\System\lbiSely.exe
  C:\Windows\System\lbiSely.exe
  2⤵
  PID:7128
- C:\Windows\System\fEJtiay.exe
  C:\Windows\System\fEJtiay.exe
  2⤵
  PID:7144
- C:\Windows\System\PbVGYNW.exe
  C:\Windows\System\PbVGYNW.exe
  2⤵
  PID:7160
- C:\Windows\System\jmjRLKV.exe
  C:\Windows\System\jmjRLKV.exe
  2⤵
  PID:2656
- C:\Windows\System\nQXLUmC.exe
  C:\Windows\System\nQXLUmC.exe
  2⤵
  PID:6204
- C:\Windows\System\EkFdyre.exe
  C:\Windows\System\EkFdyre.exe
  2⤵
  PID:4128
- C:\Windows\System\lrxjjUz.exe
  C:\Windows\System\lrxjjUz.exe
  2⤵
  PID:2692
- C:\Windows\System\qHwHIrK.exe
  C:\Windows\System\qHwHIrK.exe
  2⤵
  PID:6240
- C:\Windows\System\jDrjcDZ.exe
  C:\Windows\System\jDrjcDZ.exe
  2⤵
  PID:6184
- C:\Windows\System\FRyEIFi.exe
  C:\Windows\System\FRyEIFi.exe
  2⤵
  PID:6320
- C:\Windows\System\qvqvEos.exe
  C:\Windows\System\qvqvEos.exe
  2⤵
  PID:6300
- C:\Windows\System\moSoFso.exe
  C:\Windows\System\moSoFso.exe
  2⤵
  PID:6332
- C:\Windows\System\FjLNMED.exe
  C:\Windows\System\FjLNMED.exe
  2⤵
  PID:2508
- C:\Windows\System\vTWNkBb.exe
  C:\Windows\System\vTWNkBb.exe
  2⤵
  PID:6380
- C:\Windows\System\KvRXNwX.exe
  C:\Windows\System\KvRXNwX.exe
  2⤵
  PID:6428
- C:\Windows\System\phDufkW.exe
  C:\Windows\System\phDufkW.exe
  2⤵
  PID:6464
- C:\Windows\System\oJQkOhE.exe
  C:\Windows\System\oJQkOhE.exe
  2⤵
  PID:6480
- C:\Windows\System\iMBjApo.exe
  C:\Windows\System\iMBjApo.exe
  2⤵
  PID:6508
- C:\Windows\System\FCGFVmP.exe
  C:\Windows\System\FCGFVmP.exe
  2⤵
  PID:6512
- C:\Windows\System\nIAPMdh.exe
  C:\Windows\System\nIAPMdh.exe
  2⤵
  PID:6556
- C:\Windows\System\mOCbceh.exe
  C:\Windows\System\mOCbceh.exe
  2⤵
  PID:2552
- C:\Windows\System\sHULcgs.exe
  C:\Windows\System\sHULcgs.exe
  2⤵
  PID:6668
- C:\Windows\System\PuXOStL.exe
  C:\Windows\System\PuXOStL.exe
  2⤵
  PID:6732
- C:\Windows\System\QmJcUYG.exe
  C:\Windows\System\QmJcUYG.exe
  2⤵
  PID:6772
- C:\Windows\System\rPIZPvM.exe
  C:\Windows\System\rPIZPvM.exe
  2⤵
  PID:6832
- C:\Windows\System\QhFBPpL.exe
  C:\Windows\System\QhFBPpL.exe
  2⤵
  PID:6868
- C:\Windows\System\hHudkRb.exe
  C:\Windows\System\hHudkRb.exe
  2⤵
  PID:6620
- C:\Windows\System\IckoTuL.exe
  C:\Windows\System\IckoTuL.exe
  2⤵
  PID:6684
- C:\Windows\System\TpfkVwP.exe
  C:\Windows\System\TpfkVwP.exe
  2⤵
  PID:6716
- C:\Windows\System\xlAHJwL.exe
  C:\Windows\System\xlAHJwL.exe
  2⤵
  PID:6784
- C:\Windows\System\WULbwWu.exe
  C:\Windows\System\WULbwWu.exe
  2⤵
  PID:6848
- C:\Windows\System\awClhtC.exe
  C:\Windows\System\awClhtC.exe
  2⤵
  PID:6912
- C:\Windows\System\YonWpWd.exe
  C:\Windows\System\YonWpWd.exe
  2⤵
  PID:6932
- C:\Windows\System\bjGxkZz.exe
  C:\Windows\System\bjGxkZz.exe
  2⤵
  PID:6976
- C:\Windows\System\CYzslTe.exe
  C:\Windows\System\CYzslTe.exe
  2⤵
  PID:7012
- C:\Windows\System\EDZPiEP.exe
  C:\Windows\System\EDZPiEP.exe
  2⤵
  PID:7024
- C:\Windows\System\uoGZlMO.exe
  C:\Windows\System\uoGZlMO.exe
  2⤵
  PID:7060
- C:\Windows\System\DHORagz.exe
  C:\Windows\System\DHORagz.exe
  2⤵
  PID:6156
- C:\Windows\System\abvaqPX.exe
  C:\Windows\System\abvaqPX.exe
  2⤵
  PID:7104
- C:\Windows\System\vxQWbuq.exe
  C:\Windows\System\vxQWbuq.exe
  2⤵
  PID:5884
- C:\Windows\System\sMXJgHQ.exe
  C:\Windows\System\sMXJgHQ.exe
  2⤵
  PID:6220
- C:\Windows\System\ZopPUsC.exe
  C:\Windows\System\ZopPUsC.exe
  2⤵
  PID:6288
- C:\Windows\System\BCrbyes.exe
  C:\Windows\System\BCrbyes.exe
  2⤵
  PID:6272
- C:\Windows\System\yAizYWe.exe
  C:\Windows\System\yAizYWe.exe
  2⤵
  PID:7124
- C:\Windows\System\qMzqEwX.exe
  C:\Windows\System\qMzqEwX.exe
  2⤵
  PID:1648
- C:\Windows\System\feMkHfb.exe
  C:\Windows\System\feMkHfb.exe
  2⤵
  PID:6384
- C:\Windows\System\dziyrLp.exe
  C:\Windows\System\dziyrLp.exe
  2⤵
  PID:6416
- C:\Windows\System\JPditzo.exe
  C:\Windows\System\JPditzo.exe
  2⤵
  PID:6704
- C:\Windows\System\XPHDAtV.exe
  C:\Windows\System\XPHDAtV.exe
  2⤵
  PID:6592
- C:\Windows\System\vkIOeib.exe
  C:\Windows\System\vkIOeib.exe
  2⤵
  PID:6928
- C:\Windows\System\qJNpKvY.exe
  C:\Windows\System\qJNpKvY.exe
  2⤵
  PID:6864
- C:\Windows\System\WXFgkql.exe
  C:\Windows\System\WXFgkql.exe
  2⤵
  PID:7008
- C:\Windows\System\XrkjWCo.exe
  C:\Windows\System\XrkjWCo.exe
  2⤵
  PID:6476
- C:\Windows\System\aDREPXy.exe
  C:\Windows\System\aDREPXy.exe
  2⤵
  PID:6636
- C:\Windows\System\mSoIJmv.exe
  C:\Windows\System\mSoIJmv.exe
  2⤵
  PID:6656
- C:\Windows\System\ixIcSFS.exe
  C:\Windows\System\ixIcSFS.exe
  2⤵
  PID:6880
- C:\Windows\System\znmGYEx.exe
  C:\Windows\System\znmGYEx.exe
  2⤵
  PID:6996
- C:\Windows\System\gKBQihh.exe
  C:\Windows\System\gKBQihh.exe
  2⤵
  PID:7136
- C:\Windows\System\tdGlQYN.exe
  C:\Windows\System\tdGlQYN.exe
  2⤵
  PID:324
- C:\Windows\System\NPtrtjG.exe
  C:\Windows\System\NPtrtjG.exe
  2⤵
  PID:2540
- C:\Windows\System\YtsfsJc.exe
  C:\Windows\System\YtsfsJc.exe
  2⤵
  PID:6256
- C:\Windows\System\oklfuQF.exe
  C:\Windows\System\oklfuQF.exe
  2⤵
  PID:6948
- C:\Windows\System\lTNXTNI.exe
  C:\Windows\System\lTNXTNI.exe
  2⤵
  PID:496
- C:\Windows\System\ojAlbtY.exe
  C:\Windows\System\ojAlbtY.exe
  2⤵
  PID:308
- C:\Windows\System\moGmjpH.exe
  C:\Windows\System\moGmjpH.exe
  2⤵
  PID:6820
- C:\Windows\System\zHSxYsC.exe
  C:\Windows\System\zHSxYsC.exe
  2⤵
  PID:6768
- C:\Windows\System\WXbcsJp.exe
  C:\Windows\System\WXbcsJp.exe
  2⤵
  PID:644
- C:\Windows\System\KBZtjiI.exe
  C:\Windows\System\KBZtjiI.exe
  2⤵
  PID:320
- C:\Windows\System\tkGmWVX.exe
  C:\Windows\System\tkGmWVX.exe
  2⤵
  PID:6756
- C:\Windows\System\uoLVZMB.exe
  C:\Windows\System\uoLVZMB.exe
  2⤵
  PID:6316
- C:\Windows\System\VkAjDKm.exe
  C:\Windows\System\VkAjDKm.exe
  2⤵
  PID:6364
- C:\Windows\System\einxxLv.exe
  C:\Windows\System\einxxLv.exe
  2⤵
  PID:6944
- C:\Windows\System\JoxBVfV.exe
  C:\Windows\System\JoxBVfV.exe
  2⤵
  PID:7152
- C:\Windows\System\JaBuoeo.exe
  C:\Windows\System\JaBuoeo.exe
  2⤵
  PID:6608
- C:\Windows\System\LYPPJFH.exe
  C:\Windows\System\LYPPJFH.exe
  2⤵
  PID:3508
- C:\Windows\System\YuRfGco.exe
  C:\Windows\System\YuRfGco.exe
  2⤵
  PID:392
- C:\Windows\System\nnoBoZc.exe
  C:\Windows\System\nnoBoZc.exe
  2⤵
  PID:6448
- C:\Windows\System\JFfcVkH.exe
  C:\Windows\System\JFfcVkH.exe
  2⤵
  PID:6172
- C:\Windows\System\cphkFYI.exe
  C:\Windows\System\cphkFYI.exe
  2⤵
  PID:1960
- C:\Windows\System\ZzEjfwk.exe
  C:\Windows\System\ZzEjfwk.exe
  2⤵
  PID:2548
- C:\Windows\System\yfmLdGU.exe
  C:\Windows\System\yfmLdGU.exe
  2⤵
  PID:7176
- C:\Windows\System\WSMzDdC.exe
  C:\Windows\System\WSMzDdC.exe
  2⤵
  PID:7192
- C:\Windows\System\yZHWXPm.exe
  C:\Windows\System\yZHWXPm.exe
  2⤵
  PID:7208
- C:\Windows\System\MIxwTRH.exe
  C:\Windows\System\MIxwTRH.exe
  2⤵
  PID:7224
- C:\Windows\System\zxFkmOH.exe
  C:\Windows\System\zxFkmOH.exe
  2⤵
  PID:7240
- C:\Windows\System\VHdzRIs.exe
  C:\Windows\System\VHdzRIs.exe
  2⤵
  PID:7256
- C:\Windows\System\qqzVNVo.exe
  C:\Windows\System\qqzVNVo.exe
  2⤵
  PID:7272
- C:\Windows\System\gGRfiXg.exe
  C:\Windows\System\gGRfiXg.exe
  2⤵
  PID:7288
- C:\Windows\System\xQvkYkO.exe
  C:\Windows\System\xQvkYkO.exe
  2⤵
  PID:7304
- C:\Windows\System\bUQJjAW.exe
  C:\Windows\System\bUQJjAW.exe
  2⤵
  PID:7320
- C:\Windows\System\tUXmUlW.exe
  C:\Windows\System\tUXmUlW.exe
  2⤵
  PID:7336
- C:\Windows\System\ZdrJHHL.exe
  C:\Windows\System\ZdrJHHL.exe
  2⤵
  PID:7352
- C:\Windows\System\WzEOcRv.exe
  C:\Windows\System\WzEOcRv.exe
  2⤵
  PID:7368
- C:\Windows\System\MNJFvJW.exe
  C:\Windows\System\MNJFvJW.exe
  2⤵
  PID:7384
- C:\Windows\System\YGgYEYM.exe
  C:\Windows\System\YGgYEYM.exe
  2⤵
  PID:7400
- C:\Windows\System\DEQNqpj.exe
  C:\Windows\System\DEQNqpj.exe
  2⤵
  PID:7416
- C:\Windows\System\hDhxjyp.exe
  C:\Windows\System\hDhxjyp.exe
  2⤵
  PID:7432
- C:\Windows\System\tnISRJd.exe
  C:\Windows\System\tnISRJd.exe
  2⤵
  PID:7448
- C:\Windows\System\yEBewgS.exe
  C:\Windows\System\yEBewgS.exe
  2⤵
  PID:7464
- C:\Windows\System\RPPfNiv.exe
  C:\Windows\System\RPPfNiv.exe
  2⤵
  PID:7480
- C:\Windows\System\QDQbkHH.exe
  C:\Windows\System\QDQbkHH.exe
  2⤵
  PID:7496
- C:\Windows\System\xVxjckl.exe
  C:\Windows\System\xVxjckl.exe
  2⤵
  PID:7512
- C:\Windows\System\qDpRqie.exe
  C:\Windows\System\qDpRqie.exe
  2⤵
  PID:7528
- C:\Windows\System\EsnYeDc.exe
  C:\Windows\System\EsnYeDc.exe
  2⤵
  PID:7544
- C:\Windows\System\sVVnbRB.exe
  C:\Windows\System\sVVnbRB.exe
  2⤵
  PID:7560
- C:\Windows\System\VUDFcVg.exe
  C:\Windows\System\VUDFcVg.exe
  2⤵
  PID:7576
- C:\Windows\System\iEqejyi.exe
  C:\Windows\System\iEqejyi.exe
  2⤵
  PID:7592
- C:\Windows\System\wtYxizd.exe
  C:\Windows\System\wtYxizd.exe
  2⤵
  PID:7608
- C:\Windows\System\uRWDrnJ.exe
  C:\Windows\System\uRWDrnJ.exe
  2⤵
  PID:7624
- C:\Windows\System\mjGUtXX.exe
  C:\Windows\System\mjGUtXX.exe
  2⤵
  PID:7640
- C:\Windows\System\ZCHkPGY.exe
  C:\Windows\System\ZCHkPGY.exe
  2⤵
  PID:7656
- C:\Windows\System\BDwquZS.exe
  C:\Windows\System\BDwquZS.exe
  2⤵
  PID:7672
- C:\Windows\System\ooncPNY.exe
  C:\Windows\System\ooncPNY.exe
  2⤵
  PID:7688
- C:\Windows\System\FPUfEIL.exe
  C:\Windows\System\FPUfEIL.exe
  2⤵
  PID:7704
- C:\Windows\System\AAqbrmc.exe
  C:\Windows\System\AAqbrmc.exe
  2⤵
  PID:7720
- C:\Windows\System\VQueukh.exe
  C:\Windows\System\VQueukh.exe
  2⤵
  PID:7736
- C:\Windows\System\AgSoNKO.exe
  C:\Windows\System\AgSoNKO.exe
  2⤵
  PID:7756
- C:\Windows\System\GFIKxxJ.exe
  C:\Windows\System\GFIKxxJ.exe
  2⤵
  PID:7776
- C:\Windows\System\RFuSRqn.exe
  C:\Windows\System\RFuSRqn.exe
  2⤵
  PID:7792
- C:\Windows\System\jJIkyqJ.exe
  C:\Windows\System\jJIkyqJ.exe
  2⤵
  PID:7808
- C:\Windows\System\LthOQWD.exe
  C:\Windows\System\LthOQWD.exe
  2⤵
  PID:7824
- C:\Windows\System\sQPoqTr.exe
  C:\Windows\System\sQPoqTr.exe
  2⤵
  PID:7840
- C:\Windows\System\IYdskmA.exe
  C:\Windows\System\IYdskmA.exe
  2⤵
  PID:7868
- C:\Windows\System\mensXlm.exe
  C:\Windows\System\mensXlm.exe
  2⤵
  PID:7884
- C:\Windows\System\CQaFikS.exe
  C:\Windows\System\CQaFikS.exe
  2⤵
  PID:7900
- C:\Windows\System\pQiqWaB.exe
  C:\Windows\System\pQiqWaB.exe
  2⤵
  PID:7916
- C:\Windows\System\RSLdbSw.exe
  C:\Windows\System\RSLdbSw.exe
  2⤵
  PID:7932
- C:\Windows\System\pYUcwoo.exe
  C:\Windows\System\pYUcwoo.exe
  2⤵
  PID:7948
- C:\Windows\System\eRCAFgv.exe
  C:\Windows\System\eRCAFgv.exe
  2⤵
  PID:7964
- C:\Windows\System\wPxosBG.exe
  C:\Windows\System\wPxosBG.exe
  2⤵
  PID:7980
- C:\Windows\System\zflrJTu.exe
  C:\Windows\System\zflrJTu.exe
  2⤵
  PID:7996
- C:\Windows\System\SeQzFax.exe
  C:\Windows\System\SeQzFax.exe
  2⤵
  PID:8012
- C:\Windows\System\HmnMfkR.exe
  C:\Windows\System\HmnMfkR.exe
  2⤵
  PID:8028
- C:\Windows\System\AsTGUTW.exe
  C:\Windows\System\AsTGUTW.exe
  2⤵
  PID:8044
- C:\Windows\System\lkFiNBZ.exe
  C:\Windows\System\lkFiNBZ.exe
  2⤵
  PID:8060
- C:\Windows\System\xuODrpi.exe
  C:\Windows\System\xuODrpi.exe
  2⤵
  PID:8076
- C:\Windows\System\XUrTjGT.exe
  C:\Windows\System\XUrTjGT.exe
  2⤵
  PID:8092
- C:\Windows\System\NJajiDC.exe
  C:\Windows\System\NJajiDC.exe
  2⤵
  PID:8108
- C:\Windows\System\TcAdzBQ.exe
  C:\Windows\System\TcAdzBQ.exe
  2⤵
  PID:8124
- C:\Windows\System\bahZdxz.exe
  C:\Windows\System\bahZdxz.exe
  2⤵
  PID:8140
- C:\Windows\System\teovKio.exe
  C:\Windows\System\teovKio.exe
  2⤵
  PID:8156
- C:\Windows\System\mWwABZo.exe
  C:\Windows\System\mWwABZo.exe
  2⤵
  PID:8172
- C:\Windows\System\KZGckRw.exe
  C:\Windows\System\KZGckRw.exe
  2⤵
  PID:8188
- C:\Windows\System\wYwiIyM.exe
  C:\Windows\System\wYwiIyM.exe
  2⤵
  PID:2772
- C:\Windows\System\KyMvEVC.exe
  C:\Windows\System\KyMvEVC.exe
  2⤵
  PID:7184
- C:\Windows\System\bPEysRs.exe
  C:\Windows\System\bPEysRs.exe
  2⤵
  PID:7264
- C:\Windows\System\RAEFeza.exe
  C:\Windows\System\RAEFeza.exe
  2⤵
  PID:7220
- C:\Windows\System\WaQEQxI.exe
  C:\Windows\System\WaQEQxI.exe
  2⤵
  PID:7284
- C:\Windows\System\AVfRqOm.exe
  C:\Windows\System\AVfRqOm.exe
  2⤵
  PID:7312
- C:\Windows\System\pfKQfRJ.exe
  C:\Windows\System\pfKQfRJ.exe
  2⤵
  PID:7360
- C:\Windows\System\BgLeuAE.exe
  C:\Windows\System\BgLeuAE.exe
  2⤵
  PID:7364
- C:\Windows\System\WrlfjtR.exe
  C:\Windows\System\WrlfjtR.exe
  2⤵
  PID:1700
- C:\Windows\System\OpCAemd.exe
  C:\Windows\System\OpCAemd.exe
  2⤵
  PID:7488
- C:\Windows\System\GalRcOd.exe
  C:\Windows\System\GalRcOd.exe
  2⤵
  PID:7440
- C:\Windows\System\rAYARfH.exe
  C:\Windows\System\rAYARfH.exe
  2⤵
  PID:7520
- C:\Windows\System\rMEKnFY.exe
  C:\Windows\System\rMEKnFY.exe
  2⤵
  PID:7536
- C:\Windows\System\KjSyVOH.exe
  C:\Windows\System\KjSyVOH.exe
  2⤵
  PID:7568
- C:\Windows\System\fSRhiIz.exe
  C:\Windows\System\fSRhiIz.exe
  2⤵
  PID:7616
- C:\Windows\System\nOrsTLL.exe
  C:\Windows\System\nOrsTLL.exe
  2⤵
  PID:7648
- C:\Windows\System\HEOicIp.exe
  C:\Windows\System\HEOicIp.exe
  2⤵
  PID:7712
- C:\Windows\System\IaaFRzX.exe
  C:\Windows\System\IaaFRzX.exe
  2⤵
  PID:7696
- C:\Windows\System\URsPZRS.exe
  C:\Windows\System\URsPZRS.exe
  2⤵
  PID:7668
- C:\Windows\System\VhzCnXs.exe
  C:\Windows\System\VhzCnXs.exe
  2⤵
  PID:7764
- C:\Windows\System\ndPXbwO.exe
  C:\Windows\System\ndPXbwO.exe
  2⤵
  PID:7784
- C:\Windows\System\vQYVWWI.exe
  C:\Windows\System\vQYVWWI.exe
  2⤵
  PID:1732
- C:\Windows\System\ysPizGd.exe
  C:\Windows\System\ysPizGd.exe
  2⤵
  PID:7852
- C:\Windows\System\LNgQqgs.exe
  C:\Windows\System\LNgQqgs.exe
  2⤵
  PID:7836
- C:\Windows\System\AoGfSyc.exe
  C:\Windows\System\AoGfSyc.exe
  2⤵
  PID:7896
- C:\Windows\System\PZHmMtf.exe
  C:\Windows\System\PZHmMtf.exe
  2⤵
  PID:7880
- C:\Windows\System\FaKOAvS.exe
  C:\Windows\System\FaKOAvS.exe
  2⤵
  PID:7940
- C:\Windows\System\VvxThEZ.exe
  C:\Windows\System\VvxThEZ.exe
  2⤵
  PID:7988
- C:\Windows\System\fRXGDPR.exe
  C:\Windows\System\fRXGDPR.exe
  2⤵
  PID:7972
- C:\Windows\System\CpKLFdf.exe
  C:\Windows\System\CpKLFdf.exe
  2⤵
  PID:8036
- C:\Windows\System\MVSZwKN.exe
  C:\Windows\System\MVSZwKN.exe
  2⤵
  PID:8056
- C:\Windows\System\GDdqYxm.exe
  C:\Windows\System\GDdqYxm.exe
  2⤵
  PID:8120
- C:\Windows\System\IXKceih.exe
  C:\Windows\System\IXKceih.exe
  2⤵
  PID:8184
- C:\Windows\System\sRifCLJ.exe
  C:\Windows\System\sRifCLJ.exe
  2⤵
  PID:7232
- C:\Windows\System\NdhnYiq.exe
  C:\Windows\System\NdhnYiq.exe
  2⤵
  PID:1812
- C:\Windows\System\AEWmAuN.exe
  C:\Windows\System\AEWmAuN.exe
  2⤵
  PID:7772
- C:\Windows\System\KvdwuqI.exe
  C:\Windows\System\KvdwuqI.exe
  2⤵
  PID:7332
- C:\Windows\System\WgWEWGJ.exe
  C:\Windows\System\WgWEWGJ.exe
  2⤵
  PID:7492
- C:\Windows\System\FwXqnyx.exe
  C:\Windows\System\FwXqnyx.exe
  2⤵
  PID:7928
- C:\Windows\System\JuunIxW.exe
  C:\Windows\System\JuunIxW.exe
  2⤵
  PID:7636
- C:\Windows\System\GuUkKlG.exe
  C:\Windows\System\GuUkKlG.exe
  2⤵
  PID:7408
- C:\Windows\System\BmXygJn.exe
  C:\Windows\System\BmXygJn.exe
  2⤵
  PID:7664
- C:\Windows\System\bFbAZtO.exe
  C:\Windows\System\bFbAZtO.exe
  2⤵
  PID:8004
- C:\Windows\System\KSAAZjr.exe
  C:\Windows\System\KSAAZjr.exe
  2⤵
  PID:7800
- C:\Windows\System\YELQDjH.exe
  C:\Windows\System\YELQDjH.exe
  2⤵
  PID:8104
- C:\Windows\System\kRNTKPc.exe
  C:\Windows\System\kRNTKPc.exe
  2⤵
  PID:8168
- C:\Windows\System\xtRCTqL.exe
  C:\Windows\System\xtRCTqL.exe
  2⤵
  PID:7504
- C:\Windows\System\qeybVno.exe
  C:\Windows\System\qeybVno.exe
  2⤵
  PID:7816
- C:\Windows\System\YqgQCtm.exe
  C:\Windows\System\YqgQCtm.exe
  2⤵
  PID:2620
- C:\Windows\System\IWdqAEz.exe
  C:\Windows\System\IWdqAEz.exe
  2⤵
  PID:3024
- C:\Windows\System\amReLcp.exe
  C:\Windows\System\amReLcp.exe
  2⤵
  PID:7300
- C:\Windows\System\rAWjund.exe
  C:\Windows\System\rAWjund.exe
  2⤵
  PID:7556
- C:\Windows\System\uVkMyGX.exe
  C:\Windows\System\uVkMyGX.exe
  2⤵
  PID:876
- C:\Windows\System\ySepCPi.exe
  C:\Windows\System\ySepCPi.exe
  2⤵
  PID:7328
- C:\Windows\System\DIwIjUt.exe
  C:\Windows\System\DIwIjUt.exe
  2⤵
  PID:7216
- C:\Windows\System\epjYpUE.exe
  C:\Windows\System\epjYpUE.exe
  2⤵
  PID:7728
- C:\Windows\System\KmpzdCG.exe
  C:\Windows\System\KmpzdCG.exe
  2⤵
  PID:7412
- C:\Windows\System\vcNLFXa.exe
  C:\Windows\System\vcNLFXa.exe
  2⤵
  PID:7820
- C:\Windows\System\qykUywL.exe
  C:\Windows\System\qykUywL.exe
  2⤵
  PID:2720
- C:\Windows\System\GhFMSaa.exe
  C:\Windows\System\GhFMSaa.exe
  2⤵
  PID:8088
- C:\Windows\System\aBsujGS.exe
  C:\Windows\System\aBsujGS.exe
  2⤵
  PID:7604
- C:\Windows\System\nKIxomQ.exe
  C:\Windows\System\nKIxomQ.exe
  2⤵
  PID:8152
- C:\Windows\System\ZwlajZD.exe
  C:\Windows\System\ZwlajZD.exe
  2⤵
  PID:8180
- C:\Windows\System\aEBzxec.exe
  C:\Windows\System\aEBzxec.exe
  2⤵
  PID:7424
- C:\Windows\System\aqEPVyK.exe
  C:\Windows\System\aqEPVyK.exe
  2⤵
  PID:8024
- C:\Windows\System\ZmdYgSp.exe
  C:\Windows\System\ZmdYgSp.exe
  2⤵
  PID:8196
- C:\Windows\System\phSkodt.exe
  C:\Windows\System\phSkodt.exe
  2⤵
  PID:8212
- C:\Windows\System\XnEgCYg.exe
  C:\Windows\System\XnEgCYg.exe
  2⤵
  PID:8228
- C:\Windows\System\EzoDEVB.exe
  C:\Windows\System\EzoDEVB.exe
  2⤵
  PID:8244
- C:\Windows\System\WQZNNyc.exe
  C:\Windows\System\WQZNNyc.exe
  2⤵
  PID:8312
- C:\Windows\System\XzWDidA.exe
  C:\Windows\System\XzWDidA.exe
  2⤵
  PID:8328
- C:\Windows\System\hwCrPMD.exe
  C:\Windows\System\hwCrPMD.exe
  2⤵
  PID:8344
- C:\Windows\System\bTwUytu.exe
  C:\Windows\System\bTwUytu.exe
  2⤵
  PID:8360
- C:\Windows\System\ejINNTx.exe
  C:\Windows\System\ejINNTx.exe
  2⤵
  PID:8376
- C:\Windows\System\yRQglYL.exe
  C:\Windows\System\yRQglYL.exe
  2⤵
  PID:8392
- C:\Windows\System\BZxHinB.exe
  C:\Windows\System\BZxHinB.exe
  2⤵
  PID:8416
- C:\Windows\System\lxPmUnA.exe
  C:\Windows\System\lxPmUnA.exe
  2⤵
  PID:8436
- C:\Windows\System\rhXWxHn.exe
  C:\Windows\System\rhXWxHn.exe
  2⤵
  PID:8456
- C:\Windows\System\sSgxepd.exe
  C:\Windows\System\sSgxepd.exe
  2⤵
  PID:8472
- C:\Windows\System\ToQytWQ.exe
  C:\Windows\System\ToQytWQ.exe
  2⤵
  PID:8488
- C:\Windows\System\mAYNmsB.exe
  C:\Windows\System\mAYNmsB.exe
  2⤵
  PID:8512
- C:\Windows\System\KljLEDr.exe
  C:\Windows\System\KljLEDr.exe
  2⤵
  PID:8528
- C:\Windows\System\Qhlvflv.exe
  C:\Windows\System\Qhlvflv.exe
  2⤵
  PID:8544
- C:\Windows\System\mBEbHYU.exe
  C:\Windows\System\mBEbHYU.exe
  2⤵
  PID:8560
- C:\Windows\System\ipgCDCC.exe
  C:\Windows\System\ipgCDCC.exe
  2⤵
  PID:8580
- C:\Windows\System\yDFpexd.exe
  C:\Windows\System\yDFpexd.exe
  2⤵
  PID:8596
- C:\Windows\System\ViyfTei.exe
  C:\Windows\System\ViyfTei.exe
  2⤵
  PID:8612
- C:\Windows\System\kGRNfrT.exe
  C:\Windows\System\kGRNfrT.exe
  2⤵
  PID:8676
- C:\Windows\System\zLUrTsp.exe
  C:\Windows\System\zLUrTsp.exe
  2⤵
  PID:8692
- C:\Windows\System\gpgHwPb.exe
  C:\Windows\System\gpgHwPb.exe
  2⤵
  PID:8708
- C:\Windows\System\eaIBKMz.exe
  C:\Windows\System\eaIBKMz.exe
  2⤵
  PID:8724
- C:\Windows\System\fGkYcBm.exe
  C:\Windows\System\fGkYcBm.exe
  2⤵
  PID:8740
- C:\Windows\System\uakHHIP.exe
  C:\Windows\System\uakHHIP.exe
  2⤵
  PID:8756
- C:\Windows\System\zawiWYp.exe
  C:\Windows\System\zawiWYp.exe
  2⤵
  PID:8772
- C:\Windows\System\dvTPsSN.exe
  C:\Windows\System\dvTPsSN.exe
  2⤵
  PID:8796
- C:\Windows\System\cTBalEH.exe
  C:\Windows\System\cTBalEH.exe
  2⤵
  PID:8816
- C:\Windows\System\tbXKQdB.exe
  C:\Windows\System\tbXKQdB.exe
  2⤵
  PID:8832
- C:\Windows\System\XTNSSwP.exe
  C:\Windows\System\XTNSSwP.exe
  2⤵
  PID:8852
- C:\Windows\System\BQsnTwZ.exe
  C:\Windows\System\BQsnTwZ.exe
  2⤵
  PID:8868
- C:\Windows\System\nfiemdw.exe
  C:\Windows\System\nfiemdw.exe
  2⤵
  PID:8892
- C:\Windows\System\CBetBhX.exe
  C:\Windows\System\CBetBhX.exe
  2⤵
  PID:8908
- C:\Windows\System\oZooima.exe
  C:\Windows\System\oZooima.exe
  2⤵
  PID:8924
- C:\Windows\System\jyZnexi.exe
  C:\Windows\System\jyZnexi.exe
  2⤵
  PID:8940
- C:\Windows\System\ShjvyNe.exe
  C:\Windows\System\ShjvyNe.exe
  2⤵
  PID:8956
- C:\Windows\System\oLrOnSd.exe
  C:\Windows\System\oLrOnSd.exe
  2⤵
  PID:8972
- C:\Windows\System\SfJgxnI.exe
  C:\Windows\System\SfJgxnI.exe
  2⤵
  PID:8992
- C:\Windows\System\fvZaHLU.exe
  C:\Windows\System\fvZaHLU.exe
  2⤵
  PID:9012
- C:\Windows\System\LVGKbyV.exe
  C:\Windows\System\LVGKbyV.exe
  2⤵
  PID:9036
- C:\Windows\System\WwogaNy.exe
  C:\Windows\System\WwogaNy.exe
  2⤵
  PID:9096
- C:\Windows\System\zMupdit.exe
  C:\Windows\System\zMupdit.exe
  2⤵
  PID:9112
- C:\Windows\System\DqRPBAi.exe
  C:\Windows\System\DqRPBAi.exe
  2⤵
  PID:9128
- C:\Windows\System\MNkjTAz.exe
  C:\Windows\System\MNkjTAz.exe
  2⤵
  PID:9144
- C:\Windows\System\KsTFZlt.exe
  C:\Windows\System\KsTFZlt.exe
  2⤵
  PID:9160
- C:\Windows\System\NDYWbvi.exe
  C:\Windows\System\NDYWbvi.exe
  2⤵
  PID:9176
- C:\Windows\System\UUDApec.exe
  C:\Windows\System\UUDApec.exe
  2⤵
  PID:9192
- C:\Windows\System\SYjBAZt.exe
  C:\Windows\System\SYjBAZt.exe
  2⤵
  PID:9208
- C:\Windows\System\bGvNaqo.exe
  C:\Windows\System\bGvNaqo.exe
  2⤵
  PID:7804
- C:\Windows\System\OkOFkmX.exe
  C:\Windows\System\OkOFkmX.exe
  2⤵
  PID:8240
- C:\Windows\System\SpobPnd.exe
  C:\Windows\System\SpobPnd.exe
  2⤵
  PID:7684
- C:\Windows\System\ohzBkem.exe
  C:\Windows\System\ohzBkem.exe
  2⤵
  PID:1936
- C:\Windows\System\itrUgMo.exe
  C:\Windows\System\itrUgMo.exe
  2⤵
  PID:8252
- C:\Windows\System\CBONYLP.exe
  C:\Windows\System\CBONYLP.exe
  2⤵
  PID:8288
- C:\Windows\System\vNITayF.exe
  C:\Windows\System\vNITayF.exe
  2⤵
  PID:8268
- C:\Windows\System\bRBHgOK.exe
  C:\Windows\System\bRBHgOK.exe
  2⤵
  PID:8304
- C:\Windows\System\VZjWYTx.exe
  C:\Windows\System\VZjWYTx.exe
  2⤵
  PID:8340
- C:\Windows\System\TdrufXD.exe
  C:\Windows\System\TdrufXD.exe
  2⤵
  PID:8404
- C:\Windows\System\nZFoRnX.exe
  C:\Windows\System\nZFoRnX.exe
  2⤵
  PID:8448
- C:\Windows\System\KUOZFTb.exe
  C:\Windows\System\KUOZFTb.exe
  2⤵
  PID:8520
- C:\Windows\System\fQDUzIG.exe
  C:\Windows\System\fQDUzIG.exe
  2⤵
  PID:8588
- C:\Windows\System\TheywFi.exe
  C:\Windows\System\TheywFi.exe
  2⤵
  PID:8500
- C:\Windows\System\bKihSta.exe
  C:\Windows\System\bKihSta.exe
  2⤵
  PID:8388
- C:\Windows\System\DPghewM.exe
  C:\Windows\System\DPghewM.exe
  2⤵
  PID:8624
- C:\Windows\System\TlFBexe.exe
  C:\Windows\System\TlFBexe.exe
  2⤵
  PID:8664
- C:\Windows\System\RYigGGV.exe
  C:\Windows\System\RYigGGV.exe
  2⤵
  PID:8656
- C:\Windows\System\MwmGBCg.exe
  C:\Windows\System\MwmGBCg.exe
  2⤵
  PID:8704
- C:\Windows\System\qyGjCkS.exe
  C:\Windows\System\qyGjCkS.exe
  2⤵
  PID:8768
- C:\Windows\System\jMjCpLS.exe
  C:\Windows\System\jMjCpLS.exe
  2⤵
  PID:8804
- C:\Windows\System\oYyUomo.exe
  C:\Windows\System\oYyUomo.exe
  2⤵
  PID:8880
- C:\Windows\System\vLZWMLN.exe
  C:\Windows\System\vLZWMLN.exe
  2⤵
  PID:8920
- C:\Windows\System\UStbMxh.exe
  C:\Windows\System\UStbMxh.exe
  2⤵
  PID:8984
- C:\Windows\System\YQrJNxv.exe
  C:\Windows\System\YQrJNxv.exe
  2⤵
  PID:9028
- C:\Windows\System\tJJwHEK.exe
  C:\Windows\System\tJJwHEK.exe
  2⤵
  PID:9008
- C:\Windows\System\rTrTWUp.exe
  C:\Windows\System\rTrTWUp.exe
  2⤵
  PID:8824
- C:\Windows\System\joKAqxK.exe
  C:\Windows\System\joKAqxK.exe
  2⤵
  PID:8784
- C:\Windows\System\HEdsZfn.exe
  C:\Windows\System\HEdsZfn.exe
  2⤵
  PID:8864
- C:\Windows\System\OYcNEls.exe
  C:\Windows\System\OYcNEls.exe
  2⤵
  PID:8936
- C:\Windows\System\hPUdIBA.exe
  C:\Windows\System\hPUdIBA.exe
  2⤵
  PID:2976
- C:\Windows\System\KCBxzHl.exe
  C:\Windows\System\KCBxzHl.exe
  2⤵
  PID:9064
- C:\Windows\System\FvfofFg.exe
  C:\Windows\System\FvfofFg.exe
  2⤵
  PID:9080
- C:\Windows\System\eMoVJpy.exe
  C:\Windows\System\eMoVJpy.exe
  2⤵
  PID:9104
- C:\Windows\System\ihAdoIZ.exe
  C:\Windows\System\ihAdoIZ.exe
  2⤵
  PID:9172
- C:\Windows\System\mJUOUyR.exe
  C:\Windows\System\mJUOUyR.exe
  2⤵
  PID:8236
- C:\Windows\System\AnaBITU.exe
  C:\Windows\System\AnaBITU.exe
  2⤵
  PID:9152
- C:\Windows\System\IehZaHB.exe
  C:\Windows\System\IehZaHB.exe
  2⤵
  PID:7832
- C:\Windows\System\kwLgmek.exe
  C:\Windows\System\kwLgmek.exe
  2⤵
  PID:7376
- C:\Windows\System\MIquHUN.exe
  C:\Windows\System\MIquHUN.exe
  2⤵
  PID:7892
- C:\Windows\System\GyGvNVK.exe
  C:\Windows\System\GyGvNVK.exe
  2⤵
  PID:2064
- C:\Windows\System\RObFNwi.exe
  C:\Windows\System\RObFNwi.exe
  2⤵
  PID:8504
- C:\Windows\System\sYjukti.exe
  C:\Windows\System\sYjukti.exe
  2⤵
  PID:8260
- C:\Windows\System\KYjCYzI.exe
  C:\Windows\System\KYjCYzI.exe
  2⤵
  PID:8300
- C:\Windows\System\JrUOaGY.exe
  C:\Windows\System\JrUOaGY.exe
  2⤵
  PID:8352
- C:\Windows\System\YkcjbSm.exe
  C:\Windows\System\YkcjbSm.exe
  2⤵
  PID:8428
- C:\Windows\System\JCANtLM.exe
  C:\Windows\System\JCANtLM.exe
  2⤵
  PID:8552
- C:\Windows\System\dDCkNVs.exe
  C:\Windows\System\dDCkNVs.exe
  2⤵
  PID:8356
- C:\Windows\System\bJxxjPS.exe
  C:\Windows\System\bJxxjPS.exe
  2⤵
  PID:8540
- C:\Windows\System\ndbWVLM.exe
  C:\Windows\System\ndbWVLM.exe
  2⤵
  PID:8604
- C:\Windows\System\Hlvlytm.exe
  C:\Windows\System\Hlvlytm.exe
  2⤵
  PID:8932
- C:\Windows\System\DaWqadh.exe
  C:\Windows\System\DaWqadh.exe
  2⤵
  PID:9168
- C:\Windows\System\NQmAAVd.exe
  C:\Windows\System\NQmAAVd.exe
  2⤵
  PID:8916
- C:\Windows\System\yZvPjrD.exe
  C:\Windows\System\yZvPjrD.exe
  2⤵
  PID:7280
- C:\Windows\System\IkYsXeW.exe
  C:\Windows\System\IkYsXeW.exe
  2⤵
  PID:8296
- C:\Windows\System\GQkZaYY.exe
  C:\Windows\System\GQkZaYY.exe
  2⤵
  PID:8484
- C:\Windows\System\NbzqQzW.exe
  C:\Windows\System\NbzqQzW.exe
  2⤵
  PID:8384
- C:\Windows\System\zuJJLBq.exe
  C:\Windows\System\zuJJLBq.exe
  2⤵
  PID:8556
- C:\Windows\System\crICcUz.exe
  C:\Windows\System\crICcUz.exe
  2⤵
  PID:8220
- C:\Windows\System\HvnzyFr.exe
  C:\Windows\System\HvnzyFr.exe
  2⤵
  PID:8444
- C:\Windows\System\KCzDQGV.exe
  C:\Windows\System\KCzDQGV.exe
  2⤵
  PID:8572
- C:\Windows\System\ZMnfjgi.exe
  C:\Windows\System\ZMnfjgi.exe
  2⤵
  PID:8844
- C:\Windows\System\vDHotIv.exe
  C:\Windows\System\vDHotIv.exe
  2⤵
  PID:8652
- C:\Windows\System\PdcTntX.exe
  C:\Windows\System\PdcTntX.exe
  2⤵
  PID:9024
- C:\Windows\System\AJrRVek.exe
  C:\Windows\System\AJrRVek.exe
  2⤵
  PID:8752
- C:\Windows\System\OQvZEpb.exe
  C:\Windows\System\OQvZEpb.exe
  2⤵
  PID:9056
- C:\Windows\System\rZsTAYK.exe
  C:\Windows\System\rZsTAYK.exe
  2⤵
  PID:9076
- C:\Windows\System\qCMtylo.exe
  C:\Windows\System\qCMtylo.exe
  2⤵
  PID:8412
- C:\Windows\System\JJdaQRA.exe
  C:\Windows\System\JJdaQRA.exe
  2⤵
  PID:8208
- C:\Windows\System\rJSrosl.exe
  C:\Windows\System\rJSrosl.exe
  2⤵
  PID:8276
- C:\Windows\System\ZSyekbR.exe
  C:\Windows\System\ZSyekbR.exe
  2⤵
  PID:2876
- C:\Windows\System\LytkgzP.exe
  C:\Windows\System\LytkgzP.exe
  2⤵
  PID:7552
- C:\Windows\System\eEVRUMr.exe
  C:\Windows\System\eEVRUMr.exe
  2⤵
  PID:8888
- C:\Windows\System\jiHiilG.exe
  C:\Windows\System\jiHiilG.exe
  2⤵
  PID:8792
- C:\Windows\System\DLRwHSS.exe
  C:\Windows\System\DLRwHSS.exe
  2⤵
  PID:8736
- C:\Windows\System\aDUCrYe.exe
  C:\Windows\System\aDUCrYe.exe
  2⤵
  PID:8968
- C:\Windows\System\GXCStgj.exe
  C:\Windows\System\GXCStgj.exe
  2⤵
  PID:9188
- C:\Windows\System\kwmJRqE.exe
  C:\Windows\System\kwmJRqE.exe
  2⤵
  PID:8620
- C:\Windows\System\aVrlfVu.exe
  C:\Windows\System\aVrlfVu.exe
  2⤵
  PID:9004
- C:\Windows\System\SfgLLBx.exe
  C:\Windows\System\SfgLLBx.exe
  2⤵
  PID:9224
- C:\Windows\System\vWlvjab.exe
  C:\Windows\System\vWlvjab.exe
  2⤵
  PID:9244
- C:\Windows\System\IXESOnS.exe
  C:\Windows\System\IXESOnS.exe
  2⤵
  PID:9260
- C:\Windows\System\MsmLhmy.exe
  C:\Windows\System\MsmLhmy.exe
  2⤵
  PID:9280
- C:\Windows\System\IawGnoh.exe
  C:\Windows\System\IawGnoh.exe
  2⤵
  PID:9300
- C:\Windows\System\RdWJxrv.exe
  C:\Windows\System\RdWJxrv.exe
  2⤵
  PID:9316
- C:\Windows\System\huwHouk.exe
  C:\Windows\System\huwHouk.exe
  2⤵
  PID:9336
- C:\Windows\System\MDPYRRv.exe
  C:\Windows\System\MDPYRRv.exe
  2⤵
  PID:9352
- C:\Windows\System\bXtQzpH.exe
  C:\Windows\System\bXtQzpH.exe
  2⤵
  PID:9368
- C:\Windows\System\fxUDMfG.exe
  C:\Windows\System\fxUDMfG.exe
  2⤵
  PID:9388
- C:\Windows\System\XTwCZNx.exe
  C:\Windows\System\XTwCZNx.exe
  2⤵
  PID:9404
- C:\Windows\System\ZQmGGVH.exe
  C:\Windows\System\ZQmGGVH.exe
  2⤵
  PID:9424
- C:\Windows\System\UCmOBUz.exe
  C:\Windows\System\UCmOBUz.exe
  2⤵
  PID:9440
- C:\Windows\System\bsqdNDX.exe
  C:\Windows\System\bsqdNDX.exe
  2⤵
  PID:9456
- C:\Windows\System\xHcoQFT.exe
  C:\Windows\System\xHcoQFT.exe
  2⤵
  PID:9472
- C:\Windows\System\abIPcCE.exe
  C:\Windows\System\abIPcCE.exe
  2⤵
  PID:9488
- C:\Windows\System\VWpYAoM.exe
  C:\Windows\System\VWpYAoM.exe
  2⤵
  PID:9508
- C:\Windows\System\EfMacjD.exe
  C:\Windows\System\EfMacjD.exe
  2⤵
  PID:9524
- C:\Windows\System\WAcknMW.exe
  C:\Windows\System\WAcknMW.exe
  2⤵
  PID:9540
- C:\Windows\System\HjZMJgN.exe
  C:\Windows\System\HjZMJgN.exe
  2⤵
  PID:9556
- C:\Windows\System\hVIWPpn.exe
  C:\Windows\System\hVIWPpn.exe
  2⤵
  PID:9572
- C:\Windows\System\MjAnGlA.exe
  C:\Windows\System\MjAnGlA.exe
  2⤵
  PID:9592
- C:\Windows\System\DKmbAWM.exe
  C:\Windows\System\DKmbAWM.exe
  2⤵
  PID:9700
- C:\Windows\System\usDyubJ.exe
  C:\Windows\System\usDyubJ.exe
  2⤵
  PID:9716
- C:\Windows\System\TDbqLgJ.exe
  C:\Windows\System\TDbqLgJ.exe
  2⤵
  PID:9732
- C:\Windows\System\TwzilWA.exe
  C:\Windows\System\TwzilWA.exe
  2⤵
  PID:9748
- C:\Windows\System\fYQyHfH.exe
  C:\Windows\System\fYQyHfH.exe
  2⤵
  PID:9772
- C:\Windows\System\KGfGpal.exe
  C:\Windows\System\KGfGpal.exe
  2⤵
  PID:9792
- C:\Windows\System\hUKZiCh.exe
  C:\Windows\System\hUKZiCh.exe
  2⤵
  PID:9808
- C:\Windows\System\TvxvBlP.exe
  C:\Windows\System\TvxvBlP.exe
  2⤵
  PID:9824
- C:\Windows\System\LxeoAOr.exe
  C:\Windows\System\LxeoAOr.exe
  2⤵
  PID:9840
- C:\Windows\System\aeirtpy.exe
  C:\Windows\System\aeirtpy.exe
  2⤵
  PID:9856
- C:\Windows\System\VKluYYq.exe
  C:\Windows\System\VKluYYq.exe
  2⤵
  PID:9872
- C:\Windows\System\pCpAzRc.exe
  C:\Windows\System\pCpAzRc.exe
  2⤵
  PID:9888
- C:\Windows\System\rPMkCbx.exe
  C:\Windows\System\rPMkCbx.exe
  2⤵
  PID:9908
- C:\Windows\System\ifgMSwP.exe
  C:\Windows\System\ifgMSwP.exe
  2⤵
  PID:9928
- C:\Windows\System\BFLtlhr.exe
  C:\Windows\System\BFLtlhr.exe
  2⤵
  PID:9948
- C:\Windows\System\BxwMLCT.exe
  C:\Windows\System\BxwMLCT.exe
  2⤵
  PID:9968
- C:\Windows\System\YvhrJlg.exe
  C:\Windows\System\YvhrJlg.exe
  2⤵
  PID:9988
- C:\Windows\System\mrlVqJg.exe
  C:\Windows\System\mrlVqJg.exe
  2⤵
  PID:10004
- C:\Windows\System\wvKUJjM.exe
  C:\Windows\System\wvKUJjM.exe
  2⤵
  PID:10036
- C:\Windows\System\pfLEphR.exe
  C:\Windows\System\pfLEphR.exe
  2⤵
  PID:10076
- C:\Windows\System\LReAUsj.exe
  C:\Windows\System\LReAUsj.exe
  2⤵
  PID:10096
- C:\Windows\System\sLGFzfF.exe
  C:\Windows\System\sLGFzfF.exe
  2⤵
  PID:10116
- C:\Windows\System\SGbhJOR.exe
  C:\Windows\System\SGbhJOR.exe
  2⤵
  PID:10132
- C:\Windows\System\VRFKAqE.exe
  C:\Windows\System\VRFKAqE.exe
  2⤵
  PID:10148
- C:\Windows\System\PGtRfrL.exe
  C:\Windows\System\PGtRfrL.exe
  2⤵
  PID:10164
- C:\Windows\System\Kccbgap.exe
  C:\Windows\System\Kccbgap.exe
  2⤵
  PID:10184
- C:\Windows\System\jGwLfTq.exe
  C:\Windows\System\jGwLfTq.exe
  2⤵
  PID:10200
- C:\Windows\System\eGkzCjE.exe
  C:\Windows\System\eGkzCjE.exe
  2⤵
  PID:10220
- C:\Windows\System\WPvLzRf.exe
  C:\Windows\System\WPvLzRf.exe
  2⤵
  PID:2644
- C:\Windows\System\aSzxxUy.exe
  C:\Windows\System\aSzxxUy.exe
  2⤵
  PID:9296
- C:\Windows\System\difEboB.exe
  C:\Windows\System\difEboB.exe
  2⤵
  PID:9360
- C:\Windows\System\mFKFwcx.exe
  C:\Windows\System\mFKFwcx.exe
  2⤵
  PID:9436
- C:\Windows\System\feXWZwF.exe
  C:\Windows\System\feXWZwF.exe
  2⤵
  PID:9532
- C:\Windows\System\MiVvEpa.exe
  C:\Windows\System\MiVvEpa.exe
  2⤵
  PID:9604
- C:\Windows\System\RbAmYTK.exe
  C:\Windows\System\RbAmYTK.exe
  2⤵
  PID:9624
- C:\Windows\System\ahgAOpp.exe
  C:\Windows\System\ahgAOpp.exe
  2⤵
  PID:7472
- C:\Windows\System\XIxpnGx.exe
  C:\Windows\System\XIxpnGx.exe
  2⤵
  PID:8480
- C:\Windows\System\bJRdmwN.exe
  C:\Windows\System\bJRdmwN.exe
  2⤵
  PID:8876
- C:\Windows\System\koEjYlR.exe
  C:\Windows\System\koEjYlR.exe
  2⤵
  PID:9000
- C:\Windows\System\INFiVKF.exe
  C:\Windows\System\INFiVKF.exe
  2⤵
  PID:8828
- C:\Windows\System\rAOhXWo.exe
  C:\Windows\System\rAOhXWo.exe
  2⤵
  PID:9240
- C:\Windows\System\iupUHiu.exe
  C:\Windows\System\iupUHiu.exe
  2⤵
  PID:9312
- C:\Windows\System\jCXaIhk.exe
  C:\Windows\System\jCXaIhk.exe
  2⤵
  PID:9376
- C:\Windows\System\TRafruj.exe
  C:\Windows\System\TRafruj.exe
  2⤵
  PID:9420
- C:\Windows\System\kAIThTn.exe
  C:\Windows\System\kAIThTn.exe
  2⤵
  PID:9516
- C:\Windows\System\KFhwykG.exe
  C:\Windows\System\KFhwykG.exe
  2⤵
  PID:9664
- C:\Windows\System\WgokHgX.exe
  C:\Windows\System\WgokHgX.exe
  2⤵
  PID:9724
- C:\Windows\System\qWdqNyV.exe
  C:\Windows\System\qWdqNyV.exe
  2⤵
  PID:9756
- C:\Windows\System\hUVUVFd.exe
  C:\Windows\System\hUVUVFd.exe
  2⤵
  PID:9780
- C:\Windows\System\etmwKAo.exe
  C:\Windows\System\etmwKAo.exe
  2⤵
  PID:9836
- C:\Windows\System\Aosuiwz.exe
  C:\Windows\System\Aosuiwz.exe
  2⤵
  PID:9896
- C:\Windows\System\zEwUSJV.exe
  C:\Windows\System\zEwUSJV.exe
  2⤵
  PID:9940
- C:\Windows\System\hYVrgeI.exe
  C:\Windows\System\hYVrgeI.exe
  2⤵
  PID:9788
- C:\Windows\System\GNlKMRy.exe
  C:\Windows\System\GNlKMRy.exe
  2⤵
  PID:9852
- C:\Windows\System\ZebOjAT.exe
  C:\Windows\System\ZebOjAT.exe
  2⤵
  PID:9920
- C:\Windows\System\BgvqhuA.exe
  C:\Windows\System\BgvqhuA.exe
  2⤵
  PID:9964
- C:\Windows\System\nPYNZTH.exe
  C:\Windows\System\nPYNZTH.exe
  2⤵
  PID:10028
- C:\Windows\System\jaXQGyk.exe
  C:\Windows\System\jaXQGyk.exe
  2⤵
  PID:10044
- C:\Windows\System\urdAWTQ.exe
  C:\Windows\System\urdAWTQ.exe
  2⤵
  PID:10160
- C:\Windows\System\dOTSRqh.exe
  C:\Windows\System\dOTSRqh.exe
  2⤵
  PID:10232
- C:\Windows\System\XtjOHAW.exe
  C:\Windows\System\XtjOHAW.exe
  2⤵
  PID:10056
- C:\Windows\System\xmWjeLv.exe
  C:\Windows\System\xmWjeLv.exe
  2⤵
  PID:10112
- C:\Windows\System\YwmFVkI.exe
  C:\Windows\System\YwmFVkI.exe
  2⤵
  PID:10176
- C:\Windows\System\SXZTRBO.exe
  C:\Windows\System\SXZTRBO.exe
  2⤵
  PID:10216
- C:\Windows\System\YbqviOx.exe
  C:\Windows\System\YbqviOx.exe
  2⤵
  PID:9396
- C:\Windows\System\xrpssxR.exe
  C:\Windows\System\xrpssxR.exe
  2⤵
  PID:8952
- C:\Windows\System\pONmgbr.exe
  C:\Windows\System\pONmgbr.exe
  2⤵
  PID:9564
- C:\Windows\System\QkkwZAe.exe
  C:\Windows\System\QkkwZAe.exe
  2⤵
  PID:9612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DWZbqaY.exe

Filesize
2.9MB

MD5
66871c469346b38533d7613890ce362d

SHA1
1f29dc36b954b6a627d2236370db02ab6cdb76af

SHA256
c3527a9285991221d976c21c1f10070d36e927174eb1b1e2a0e6a8f3b9c957a8

SHA512
8778b6201ea1456e525439f1c5a2cc8b561543ef246157682da1af3b15d47ee263d9ca347b673ddd5b1928d5dcd9d0b25c02c7056f574935b0417fb2e9e7c0d0

Download Submit
C:\Windows\system\DjBmXDh.exe

Filesize
2.9MB

MD5
a9344cb5ab61de3a5f164930d1b67760

SHA1
be7c430fe115b5697d1091fd348323a949a8e33b

SHA256
920efedd8e2b414aaf8d3483eea4f7bda54d33297de33858ca9227f45c372c5d

SHA512
c22c43701769141c5d7eef84c8c9df55503f1213a5e4b6def580b9100a84068408281b8e1237d03a042a9d5a695ccd8c1096dc773583f2b137c6dbbf064b7465

Download Submit
C:\Windows\system\EvqECKK.exe

Filesize
2.9MB

MD5
6ff7b959df75301a886f7f1cf8826030

SHA1
253d3e37ccfb8979b6f4003076133d2d8b6de00d

SHA256
d77a67734bfd984d3c2b3af1a6fcf187954c94c705b5763a054266eb89606f45

SHA512
09b1d61cb4f9c683f753eab7eee5a7f9fc8661853bd16919e1a442bcd5ef40c23d154c58bb21d251d52c21dcde62fafc77cda8f50883d6dec135069dd29f1eb7

Download Submit
C:\Windows\system\JFKfAli.exe

Filesize
2.9MB

MD5
0e9c8f8378d81695b243d059b5215146

SHA1
92382c7173dcb0eb7b76c44b4a26538ada0f6c72

SHA256
020eff2e67e2f9353ccce690e408181eac1a6270012978d13e34631ff32c17ee

SHA512
817de9d3328b61b2cc80f6c51303ebafc894ad4c2dd865940bdeee57bf2c3c1c87d80759477e790ca8040f77616736f76083c350a4e40c6f8c92cc24d83cd570

Download Submit
C:\Windows\system\MHojqWB.exe

Filesize
2.9MB

MD5
9d44fa38f694642530eab4441b43b653

SHA1
71158f0806c2c749554b18988533e647cf2db56f

SHA256
48894cdfa567fe7e3436fe0a90f7a154a8d37fded9e4c38cf7f847770a90a1b9

SHA512
cd468e61be72392574090969cd0d9d5801bff7b287f9d0f35549948f605d257963d1ef0e338571fa2d658bcc17626aa6abe531975e9e8f5170d211989937bd27

Download Submit
C:\Windows\system\NQTolVx.exe

Filesize
2.9MB

MD5
e2f0f4d205ef02ae1ab1be96755a5d18

SHA1
acd5ec4cc1b56969050fb29d0941de9e7044ab13

SHA256
6d8c1048de122a991c2ec9d265d944e07e072e60256e64d4ae1e4a39ddd625f8

SHA512
e894d19348f59ae3ee8adb7e35ed999f8388affbc97d0caafd731623a940d54b90627ff96639f36fdc3ab89827ed64e9e182c3854375a51e14969caf61a564f0

Download Submit
C:\Windows\system\PUEGHws.exe

Filesize
2.9MB

MD5
5684a9e40bbd973b60e287f14b296ae6

SHA1
50a0d01cf13abc72560bfdfdf4ba1b65d489408a

SHA256
b23f696d36318fc6196ed429e4acfd191c03f993b0dcd72684d49a483da3daf7

SHA512
578e82d5f32e9e645268e78d1378878f8133eb8d67babd13e1dcee5d5bc22cfb8f8fbbaeb5d1767326dda6de20ce0d275cd6157693dade274d8868b284fd0cf3

Download Submit
C:\Windows\system\SKPTzSQ.exe

Filesize
2.9MB

MD5
8757b09f06455faf2cf4bcfb0e9184c3

SHA1
b188efc936dbba33281b91ea77f80cada137958b

SHA256
f70b1ab20972b4e6203939ba506c217a793fd9e5b8da7aa2ea45b44a1a516ff5

SHA512
344cba0950ac17e285d2b9b0ccc11cc40fa1282a10d6015b4f06a3b31c762b0f5cd6a3278d8a8dd5b2507220c4dbb7052264581eb2ac338b73a9487fc04bdad3

Download Submit
C:\Windows\system\TqBGOpS.exe

Filesize
2.9MB

MD5
af7a0714ff559afe1dd7419a33e9b0ba

SHA1
0e3ceec8abd238783d92c61e65809b252d1e1ac8

SHA256
dc63659fe4a56c46d66574c80298223b0ca1728be73efb44274f95a87c3cd83d

SHA512
1c169ae593148c9d007845a5a2ee95a275565f8c735ecc51d3ae69bb2ac5b40e9cbe9c3dcd8081225c8e6c94227ebdd4783b980c7acbf037a89189ee87267acf

Download Submit
C:\Windows\system\UMBSZYs.exe

Filesize
2.9MB

MD5
b830ddfb6cb4a3a6f37d54e3b6730ac7

SHA1
aff24a32ddf8fd8c290da26613d3ff966848ad2d

SHA256
095b685d2d07cb28da11dc98799755dc54c837470c052173b1b8a9751f469f36

SHA512
8cd23bc74470c38930074a021af61df03595a497871cf08d4219bfd1d9beda5a19b150dfa60adbab165aa2954a508a5445f6f812d22126c4ffb9404f8469f035

Download Submit
C:\Windows\system\XhNVTVo.exe

Filesize
2.9MB

MD5
bdad89464991e4645e737702d4e13249

SHA1
3984a88daef53a79a718a1cb38f1da7e3da651e0

SHA256
82f3d539810e23fe7d9fce06f80c83bf75f63afda5044165682a2f2d7902b1e1

SHA512
ca34f6d6ecaf32c4d50e7af87c2dbde591d4437dde0dc54317ad26e6780835a7e568797c3a2c08399b818e4877ce7efb70f908cf9c3dd0589f1a0780a2678839

Download Submit
C:\Windows\system\aDfpDSt.exe

Filesize
2.9MB

MD5
9270a7634d581c7fde0647c244077a00

SHA1
054cb053c46e7bfe9a3def5b4c4d78f1c436b045

SHA256
5714bf2eff65d66a909affa412783e9ff415a815a4adb54a08160ebf67fd7ca6

SHA512
d3e6e766b3669865cb1259e7fa2e14988cdb412fac44c527cb3e609875ab5af9a452a62bfd2439bcb04217d6c238413aae7c69cf77d93693056174346e156fda

Download Submit
C:\Windows\system\bGnKdAt.exe

Filesize
2.9MB

MD5
88882c083c7ab83617c43e7388aa0311

SHA1
c5181517c7f035d2e73de1f9209a84280d3b5830

SHA256
4ca3fb30f5d23f8cda48ad11534bad9b3f55822ef7cfe75188b30a60d9c66128

SHA512
eac8df13e67a4aa93994421dcd23b5075d1e161eb76a4c3c239cedc17f352255e88d045a43f4c4ed0372edffe1d96bc2cec2f37e407139b6f2ccee694344d418

Download Submit
C:\Windows\system\bbHcMra.exe

Filesize
2.9MB

MD5
6057b7df8572a85126d0a4989e2e5b1f

SHA1
32e02aa0b8b24fd40d087147d81240d42e5df9c3

SHA256
c0d255e5ec7994f83faa72001546472262d994705729c0874fb7190daf67eee7

SHA512
15bd75de15f5b71a76be8a4e75ea078f040a2dd47022219079e8a6cc31f40123d509234e0ce82f83e664fb0f8107ee6184cfbd6bf36715f99b5efc5e3fa08ff9

Download Submit
C:\Windows\system\cNVZVSV.exe

Filesize
2.9MB

MD5
29f46ac669c2149e4abec30b78ffb697

SHA1
705c51fc5b95619f6e0017ebd14047c47b2ce093

SHA256
de11f96b72bae88469268d02a8a6e7fae813483551b6fa0bf7ab342b69f2af49

SHA512
e62ecc055f17ea87844886b54633b8c9b5dd50d73491bd260fa58b4f82ba7db4a7a1d5b8816da11da060f8c32452bc38b95b7207f6d5cdef4d7a4a0d8215fc6a

Download Submit
C:\Windows\system\oPLppTK.exe

Filesize
2.9MB

MD5
29a730b27142afed8a46305defa44bcd

SHA1
30e2fe88e86108cf4ffec29dcfd8133378ba50d3

SHA256
c44f77874cee5a453feb007b76ce705a4b43bfa249d2fa1840305e2c7e07fba4

SHA512
25f9ddcbcc466d29b2840294286a5a848a1b42b1a88d813352d4cd19d05ebd1c7e790a270ac08f907ca1d090b3b1e3ed64e6b5672bbe1b6b3723c781ee4c90e4

Download Submit
C:\Windows\system\pDTsOXw.exe

Filesize
2.9MB

MD5
68c0266fb533e5b6a7c1c959d014bd56

SHA1
2b6eda5a81c8012d8a3e704ac661be5cb1d63d29

SHA256
85eef129f48ca38d1033904fdd0e6a805a5223e65ba9319e88ffa6dba9709841

SHA512
e1c81272c53c09be9f35721fb0563e7dcb2126451760a61ad8d344f433fd2b651bf11ce0b99e50c2842519f307d9a8c2c14d4210fedbc124d8d26fc20eec7ad0

Download Submit
C:\Windows\system\pcphYZY.exe

Filesize
2.9MB

MD5
7b1fad2bbbce689e7c44d967d65a91a4

SHA1
80dcbce7fe9befcf9deb2bf6b685c050aca53e2b

SHA256
8ae88f20fcf7ec9fd687899ae9761bab14016466fa6ec0007038567c182b34fa

SHA512
d881cd130781a202f94f79eb7427615aef326b1ef571a664543cddaeb3eaa61381ee88599029dfac617ccfc8f90292d048060acae1ad8b0264311a417d8c648e

Download Submit
C:\Windows\system\psRefgm.exe

Filesize
2.9MB

MD5
69cb327d82cdcf9985833a385194d60b

SHA1
af8b9f06daa32df3958ecee7a70267f9d62af5b7

SHA256
88c9cef855b509da422ec66b3d8a4d049e7ae411d6c22339c216dab0c1deeebf

SHA512
4553b48f8a1cf5e4d6dd94c3bb577eda6abe9d2c48d7e6f6dc0bd4f1c735d979747056421964409bf645f1cee9b7c1834d7de1c86da9399a3e3bede1ac47673c

Download Submit
C:\Windows\system\qIzzBQX.exe

Filesize
2.9MB

MD5
c3a1964a5d725d5397138282a138766b

SHA1
fdf6a7fe7e0f100ca9d535610c1d50722baca329

SHA256
6d1af87e75d51a08ba7fee4b297b5f46c0340631388ac5c00f25d8708b2fd27c

SHA512
416dee1dbcd4f653a20cf123f56001df0213f555c66c1627ca6eb0fbf45b6bca11e6132ba2b91f90c7e891aff7605823a68a55c28e96f0faa595980dc98e891f

Download Submit
C:\Windows\system\qTRCauP.exe

Filesize
2.9MB

MD5
aa13c33e628b38d569f060ef383ba36a

SHA1
72e3c66f21b9c990cd694412901bab90c8019157

SHA256
8760df47688cec645526a92762028dae93724389dae84fbc3b86cc5e26a7e0d6

SHA512
1691241d169bdedfc9a1ad2b27ebf53f0066dcdf52219803bfb4c9a4dd8464bf28ef23394268df7c7e7f395c0a10a99cb63ef49feac5e82e845acfc722658379

Download Submit
C:\Windows\system\tOzGGpk.exe

Filesize
2.9MB

MD5
54c5a6af297f1c6ae07dfa3b550fdb27

SHA1
2928ae401dcc509632c8058db50a9e4b4507662d

SHA256
65880c0039556919cb29d5114aae510feaee40e010e700eb079f01a3dfe8cb4c

SHA512
c38f6a072938f20b216a489fde4f48aa71765d6f5a6f923d7cf89397af58f6619eeb593fac22af695abd81bb896df6cd089c9ebdaf41d3123db91b11a22f0224

Download Submit
C:\Windows\system\yYMcPtM.exe

Filesize
2.9MB

MD5
ddd97e7a23a97fed91c11b4116550d23

SHA1
f5bb984be2cbb8242aba89058ce9cea8e8760bba

SHA256
38c46c302aed4ed3999acf2031b9a64bbc102881f42a014742c1d65b29927b5e

SHA512
a631882f150a7ea03db6d10748d20793c959b53eddf0c796bc1e871581828cc42afe587242c8699258c12aa08a0e28135d8b73fbf70510a13361105de138e4fc

Download Submit
\Windows\system\BWTVeRe.exe

Filesize
2.9MB

MD5
3955a9bd5236a557dae6adaea65e4545

SHA1
1f2a3a246d928e96f511c979e7a4f9757232791c

SHA256
a97b4e39d84c14b32de168746a54f025cbbb07f508f603d03f603f9f2163bef6

SHA512
86dfd1abf63860342b1a3d8b20ad2a42834be3394fe47c69dc34ba92376909d24b1b87e8cf0396e0ca14232eac977a5eec71a1271e39706eb20a0318f07adc6f

Download Submit
\Windows\system\KxxYRkA.exe

Filesize
2.9MB

MD5
c9238b37d6c77075039314ff121bed26

SHA1
2cf6bc05757c6521cc41e8b991232ae66ca75e4b

SHA256
8b3781dffa1d63bebf7b6f728fa50de4599cb4ff1b8a4ceade0af674b92d7e67

SHA512
ad87cf429574792d3d8cef51f14ea41fbabd3d366a0c7f2239672578831b9fe8a7bafce9bf7a8d8386cce9ee41dd638aec25032e4b5631e0d6ebc18e7440cc7c

Download Submit
\Windows\system\OrzbToy.exe

Filesize
2.9MB

MD5
81cd0bd12141886047dffdb5cb63fa4d

SHA1
3d8d20f03b701cbd378bea71d598aa9542361a72

SHA256
2d7e693f3a13adba504db0b5f276d21c916ae5de059deb29e8a10f6ae0b36bfe

SHA512
339144988a1a21991c7ba2b8d4c7fb321645184c985e76dd40348c76e88e8170b60fd41335002285788c65762ea0d8f6189d89e9566aa29b8235dddcb92bbfb8

Download Submit
\Windows\system\ReLLHZh.exe

Filesize
2.9MB

MD5
617f8ab0dd94bdd4b1890c18522efc88

SHA1
81ce2cfe96665e2ff179263fbbc2c2b747e4c74c

SHA256
a2faca58360d5e7533ba14b6166efe26fff4b1cf2321dca33c40234b08948c22

SHA512
c36bdb6283daba9459fb7e9955bc63b54365fe0f8a3c5b2da1a2fb877eb131412f4f43cce62be0d20b05fee229bfaba6e3752098d576ecffe50e8b4c97902f41

Download Submit
\Windows\system\TpVpFfv.exe

Filesize
2.9MB

MD5
6d7f8464647cfde6c07c5996dcb80b11

SHA1
bce95f004363cb5fc322fa7481a2fdeb18924984

SHA256
8721c3978c5dfe32cf2e7950a21c2e966e52d94d22687354480205104a04a29a

SHA512
cbb9395fafb9b0fbc3e4f082b0ce41125a449d28e7efead659bc7c148c38f8796c1df2417320b413502cc3220e6e8f0d35f453468ce06a4b548f87c93f7a4ee7

Download Submit
\Windows\system\YYqOFTm.exe

Filesize
2.9MB

MD5
2b317696066c751eb2caf049a44bacb1

SHA1
a54303aed69e42f00c4a3b5ac52137823e0f16c3

SHA256
a4bb30f3677fd3766747de2c1a5c99a170b21412f10148ae2da120d9a2bc651a

SHA512
46853898f2f098191e802c7ec9a31acbf351e4f39f2e934886c67fe2322cda7ce400e218545630e200d1b1c45e8887877da8566fd690f3464c9c6a5e5b4a6ead

Download Submit
\Windows\system\bEtTOIJ.exe

Filesize
2.9MB

MD5
77e802c191ea954cacd80387c0dd5ba5

SHA1
ac1a0d32045b4ecdd15093dc135a4570ef4f0a47

SHA256
592745234f4cb19a5e37814b91d51ef0619170df2fe32f750c82968258b73ec2

SHA512
b964c916d166979cdaec2cbf9834caa96fce208ebb68a396339a4ceb4e6f49d72be2757391e8add24941c01a7ec9a5a8dd62d265bf4ca4a0e91e64b71e2877ce

Download Submit
\Windows\system\dbTjPPl.exe

Filesize
2.9MB

MD5
8df4b283b64cb0ada7f9e92e89629285

SHA1
bc2ed20a3784794926aa374a20fdc5dd1adcbdf3

SHA256
94337092e4b216b9fabfc3fffcc7098d8eac39d5e8a12bbd683b9a2fc67ab5cf

SHA512
cbd818ebb73433924bf645c2c2a04f84045018f0e76d7a65f44de7bf556b768485b6f35fd5691b0bef72b51173c7965e0ad84d155c7f9e0893c3aaec6338f3ff

Download Submit
\Windows\system\nHcLzrS.exe

Filesize
2.9MB

MD5
25d05b19c9e66dc9fda5d2ee356f542f

SHA1
affd3ab21e0622ccc2efc5d8db9dae1764c207a3

SHA256
1ac54ab888933793a73d52af0aca25a66686e341a727a7932ecbd2be05162644

SHA512
4e3dc61647a6933d35ba111b235025dd6e1b422a28393b97fe28cbb66233438d2dc86e74eab7cf76a7afb06ba0bd6d1987581659a3de2a59d45f9d2e6fb0551b

Download Submit
\Windows\system\omtxKtx.exe

Filesize
2.9MB

MD5
c4475384e4f01bd2e6d3ed714eea6210

SHA1
bbabcc2370fffb1978164dd89b50d5681a4d3d8b

SHA256
de0992192382fff86648deb899e4d9e1b71ef420c692518dce9236281c8170e5

SHA512
fda0d76ee2f34115462fe48ae6a0eaa53df68ad8e065105eb6bc60b34c1aca00b476e59e08435548b2047a55e1bd0dc8111d47babbcdc8d029729bd4a36554ca

Download Submit
\Windows\system\optSWwe.exe

Filesize
2.9MB

MD5
b6b138cb408f559767a4872265beef4a

SHA1
cf109585dee76ae5f2aad36e2077384e5a99d391

SHA256
1fc281582f805f1628cc6649331327a02b8f095fa090b0a7df5c8b5be7b83d9a

SHA512
c91b3116fe4040d5c10af6041c545ae5ec091f18ac8df38a5f13e1a26651f3249cc2174a5e5efac4121d04325992d98886876602b4e5b941c9b9971ff07e74d4

Download Submit
\Windows\system\ozrlQUq.exe

Filesize
2.9MB

MD5
1871005be875ca63ad8eb1cdaa463e61

SHA1
6ac14438aec88edf2024b2ee4ea5753f5ae7b2c8

SHA256
4c3869e65d0dc6bd9227cbe2100dc04030046f9606d76061a69e3e8851f82f66

SHA512
d16471cb9dba955094ab00abab0ad7e4623180d598f09dece831d4de014397b48cbef854407b91f17bc8c0bdfbd4b0f828f8977bd95ef45e360611ba8000483f

Download Submit
\Windows\system\pkKogbE.exe

Filesize
2.9MB

MD5
c216b761982e25c59b76b1965b92e7d9

SHA1
a3b4d81fff717dc603bb3225e6432c5083bdbdf2

SHA256
c2623b187604ce9e9692a4f73c2d11afb09be38ef5c777c722e3ee9731aecf45

SHA512
f79004c4c1b7f274ad24d480a527143428abb9f20c56f5a81bb4a2cc3dd37ed6e9ad3d112b306e1ca0039f2a94af679e68211cc4093001ab2999445883fa47d5

Download Submit
\Windows\system\ztEDkjr.exe

Filesize
2.9MB

MD5
64d67e474b0590c4cd35eaeb5affe125

SHA1
6ab129d72e5687d33a8cebd6df1914e1e40aa7e7

SHA256
049c47684563e71f881f717cc0a132ec8d97076730dad398d5e22c04fdaa3551

SHA512
03d0c76af2f1ef21adac6f58e6c274023238b07b2e96ddde347fbfbf3aadcd59829a54f037de73726c50710150b11d224e41a22239f6b7395beed11d5f919f9b

Download Submit
memory/1036-7820-0x000000013FB40000-0x000000013FF36000-memory.dmp

Filesize
4.0MB

Download
memory/1036-193-0x000000013FB40000-0x000000013FF36000-memory.dmp

Filesize
4.0MB

Download
memory/2056-7814-0x000000013F070000-0x000000013F466000-memory.dmp

Filesize
4.0MB

Download
memory/2056-192-0x000000013F070000-0x000000013F466000-memory.dmp

Filesize
4.0MB

Download
memory/2200-56-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/2200-22-0x000007FEF565E000-0x000007FEF565F000-memory.dmp

Filesize
4KB

Download
memory/2200-31-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2200-77-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/2200-1302-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/2200-55-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/2200-20-0x0000000002D80000-0x0000000002E00000-memory.dmp

Filesize
512KB

Download
memory/2200-54-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2472-112-0x000000013FE20000-0x0000000140216000-memory.dmp

Filesize
4.0MB

Download
memory/2480-186-0x000000013F420000-0x000000013F816000-memory.dmp

Filesize
4.0MB

Download
memory/2480-7758-0x000000013F420000-0x000000013F816000-memory.dmp

Filesize
4.0MB

Download
memory/2600-19-0x000000013F0A0000-0x000000013F496000-memory.dmp

Filesize
4.0MB

Download
memory/2704-172-0x000000013FB60000-0x000000013FF56000-memory.dmp

Filesize
4.0MB

Download
memory/2712-137-0x000000013F1B0000-0x000000013F5A6000-memory.dmp

Filesize
4.0MB

Download
memory/2712-7771-0x000000013F1B0000-0x000000013F5A6000-memory.dmp

Filesize
4.0MB

Download
memory/2740-199-0x0000000003990000-0x0000000003D86000-memory.dmp

Filesize
4.0MB

Download
memory/2740-197-0x0000000003990000-0x0000000003D86000-memory.dmp

Filesize
4.0MB

Download
memory/2740-21-0x0000000003140000-0x0000000003536000-memory.dmp

Filesize
4.0MB

Download
memory/2740-3469-0x000000013F3A0000-0x000000013F796000-memory.dmp

Filesize
4.0MB

Download
memory/2740-98-0x000000013FE20000-0x0000000140216000-memory.dmp

Filesize
4.0MB

Download
memory/2740-8-0x0000000003140000-0x0000000003536000-memory.dmp

Filesize
4.0MB

Download
memory/2740-144-0x000000013FB60000-0x000000013FF56000-memory.dmp

Filesize
4.0MB

Download
memory/2740-1-0x000000013F3A0000-0x000000013F796000-memory.dmp

Filesize
4.0MB

Download
memory/2740-58-0x0000000003990000-0x0000000003D86000-memory.dmp

Filesize
4.0MB

Download
memory/2740-202-0x000000013F940000-0x000000013FD36000-memory.dmp

Filesize
4.0MB

Download
memory/2740-176-0x0000000003990000-0x0000000003D86000-memory.dmp

Filesize
4.0MB

Download
memory/2740-191-0x000000013F7E0000-0x000000013FBD6000-memory.dmp

Filesize
4.0MB

Download
memory/2740-194-0x000000013F8A0000-0x000000013FC96000-memory.dmp

Filesize
4.0MB

Download
memory/2740-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2740-4525-0x0000000003990000-0x0000000003D86000-memory.dmp

Filesize
4.0MB

Download
memory/2740-5727-0x0000000003990000-0x0000000003D86000-memory.dmp

Filesize
4.0MB

Download
memory/2740-129-0x0000000003990000-0x0000000003D86000-memory.dmp

Filesize
4.0MB

Download
memory/2744-64-0x000000013F230000-0x000000013F626000-memory.dmp

Filesize
4.0MB

Download
memory/2800-57-0x000000013F110000-0x000000013F506000-memory.dmp

Filesize
4.0MB

Download
memory/2800-7757-0x000000013F110000-0x000000013F506000-memory.dmp

Filesize
4.0MB

Download
memory/2884-17-0x000000013F330000-0x000000013F726000-memory.dmp

Filesize
4.0MB

Download