xmrig | 13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
02/02/2025, 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
Size

1.6MB
MD5

4450b3931eec52bc8b9322b5a6a9155f
SHA1

ac8ba87a12af40230a65152b1720e5ac6c358d40
SHA256

13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f
SHA512

49e936b5fbae8a4bce14440235679db94382b02d349d1cdcdb5dc25ccba3b233e08bde11fc9516c9ff8a667ab67b83e4c20b16289c75c7dbf8640155c10357db
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5ybqqtsX2:GemTLkNdfE0pZy+

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c00000001202b-2.dat	xmrig
behavioral1/files/0x0009000000015cc8-9.dat	xmrig
behavioral1/files/0x0008000000015cd1-10.dat	xmrig
behavioral1/files/0x0008000000015cee-19.dat	xmrig
behavioral1/files/0x0007000000015d0e-28.dat	xmrig
behavioral1/files/0x0009000000015d41-44.dat	xmrig
behavioral1/files/0x0007000000015d2a-40.dat	xmrig
behavioral1/files/0x0006000000016c66-49.dat	xmrig
behavioral1/files/0x0006000000016c80-54.dat	xmrig
behavioral1/files/0x0006000000016cd7-64.dat	xmrig
behavioral1/files/0x0006000000016d3a-77.dat	xmrig
behavioral1/files/0x0006000000016d4b-90.dat	xmrig
behavioral1/files/0x0006000000016d77-119.dat	xmrig
behavioral1/files/0x0006000000016dea-134.dat	xmrig
behavioral1/files/0x0006000000017049-149.dat	xmrig
behavioral1/files/0x000600000001749c-159.dat	xmrig
behavioral1/files/0x0006000000017497-154.dat	xmrig
behavioral1/files/0x0006000000016ecf-144.dat	xmrig
behavioral1/files/0x0006000000016df3-139.dat	xmrig
behavioral1/files/0x0006000000016de8-130.dat	xmrig
behavioral1/files/0x0006000000016d9f-124.dat	xmrig
behavioral1/files/0x0006000000016d6f-114.dat	xmrig
behavioral1/files/0x0006000000016d6b-108.dat	xmrig
behavioral1/files/0x0006000000016d67-104.dat	xmrig
behavioral1/files/0x0006000000016d54-99.dat	xmrig
behavioral1/files/0x0034000000015c8b-94.dat	xmrig
behavioral1/files/0x0006000000016d43-84.dat	xmrig
behavioral1/files/0x0006000000016d2a-74.dat	xmrig
behavioral1/files/0x0006000000016cf5-69.dat	xmrig
behavioral1/files/0x0006000000016c88-59.dat	xmrig
behavioral1/files/0x0007000000015d18-35.dat	xmrig
behavioral1/files/0x0007000000015cfc-24.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2796	vXNBobE.exe
3008	AqGAnOk.exe
2956	DFzLuNj.exe
2868	tLqRLUt.exe
2936	QQqILBk.exe
1192	EdzDIaS.exe
2720	HwEQpxW.exe
2160	OHcITYN.exe
2472	JscLYBa.exe
768	UohplCm.exe
1036	qGsKZmC.exe
1108	CYbMCQN.exe
2064	catgyfe.exe
2908	oXWGCvr.exe
2904	wIgiKaf.exe
2268	jFsptfg.exe
2220	jlRWOmP.exe
760	nVxIsfk.exe
2432	byHauZR.exe
1304	glTcrPZ.exe
400	JFbYdHe.exe
3028	OSXNmjP.exe
1344	FaSMmBI.exe
1672	iYxjBQn.exe
2264	caNzrrj.exe
1828	fJSjGam.exe
2460	eDybVqS.exe
2320	eNPybwn.exe
1028	fpnuuiB.exe
1060	TVURrDe.exe
1088	dYUXXVI.exe
1040	nuDwgeF.exe
2504	IzNvavL.exe
2624	rEhOJmk.exe
952	seKezzS.exe
1824	LscewPo.exe
1956	pxSdetN.exe
2228	TyfjEkJ.exe
1544	KhryiBO.exe
1764	nbWovXZ.exe
1776	FZwwHVL.exe
744	IeTQZJl.exe
3048	QXDZIDW.exe
2008	bANdZDM.exe
1156	rFuHPUg.exe
3060	ABfXBDx.exe
2400	FVxxugL.exe
3064	riDBcCS.exe
2608	fYffYBa.exe
3056	OOUmjYX.exe
1720	VKvSBmT.exe
1712	zLAreKJ.exe
1896	cIlsmYC.exe
2996	liFErfO.exe
2960	zzZdxEC.exe
2972	oiPGWxh.exe
2916	hhXAncB.exe
2800	IEotbFB.exe
2828	plWQNkl.exe
2408	Mucgzsr.exe
2780	ibsBgpB.exe
2788	qzNiNmz.exe
264	uQrgslV.exe
352	VpQUsjj.exe

Loads dropped DLL 64 IoCs

pid	Process
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EKQEUVL.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\vRxfKeF.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\Mucgzsr.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\hjFTggQ.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\QiXxtYg.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\avyHNNm.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\iJpGTsg.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\DLocynD.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\JIejjxn.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\bdtyJPW.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\eqpDURA.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\MamfVdG.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\LubSJDY.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\ARpireF.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\ivoydqb.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\DYMuTlR.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\dBGlGZN.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\QVAQZti.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\iDeTXlO.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\YoxKdsB.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\FWFQjKZ.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\fUUpEsG.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\ZdBXWls.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\wyqTyLg.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\fkrgOPM.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\GUWNfFw.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\wvDUNBz.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\knAEaxQ.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\iwLDEjc.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\XntfuPD.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\gREYlfv.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\IEotbFB.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\nOuBPZw.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\eXNPilz.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\sqpHsuM.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\lpivksQ.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\NIbaxVM.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\WUNrYmF.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\EhYOKoa.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\UyFOasX.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\SnTRjmp.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\tJHOTLr.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\VnQKlEm.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\iYxjBQn.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\SzIlRKb.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\ZSxSaBn.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\HwXHEuu.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\utEidZw.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\ExMPkHb.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\VpQUsjj.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\cfLVnLn.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\VpEqOMf.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\PTtuimg.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\NhsgEoQ.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\onOSOwQ.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\fdYvjYu.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\OmrgEDp.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\DOmhQyi.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\ZuUIoZd.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\kKLUHxi.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\MVrOEAa.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\riuYLwf.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\CVfNBgK.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
File created	C:\Windows\System\RdHmMBp.exe	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2796	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	31
PID 2928 wrote to memory of 2796	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	31
PID 2928 wrote to memory of 2796	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	31
PID 2928 wrote to memory of 3008	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	32
PID 2928 wrote to memory of 3008	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	32
PID 2928 wrote to memory of 3008	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	32
PID 2928 wrote to memory of 2956	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	33
PID 2928 wrote to memory of 2956	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	33
PID 2928 wrote to memory of 2956	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	33
PID 2928 wrote to memory of 2868	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	34
PID 2928 wrote to memory of 2868	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	34
PID 2928 wrote to memory of 2868	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	34
PID 2928 wrote to memory of 2936	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	35
PID 2928 wrote to memory of 2936	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	35
PID 2928 wrote to memory of 2936	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	35
PID 2928 wrote to memory of 1192	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	36
PID 2928 wrote to memory of 1192	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	36
PID 2928 wrote to memory of 1192	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	36
PID 2928 wrote to memory of 2720	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	37
PID 2928 wrote to memory of 2720	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	37
PID 2928 wrote to memory of 2720	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	37
PID 2928 wrote to memory of 2160	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	38
PID 2928 wrote to memory of 2160	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	38
PID 2928 wrote to memory of 2160	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	38
PID 2928 wrote to memory of 2472	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	39
PID 2928 wrote to memory of 2472	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	39
PID 2928 wrote to memory of 2472	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	39
PID 2928 wrote to memory of 768	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	40
PID 2928 wrote to memory of 768	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	40
PID 2928 wrote to memory of 768	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	40
PID 2928 wrote to memory of 1036	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	41
PID 2928 wrote to memory of 1036	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	41
PID 2928 wrote to memory of 1036	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	41
PID 2928 wrote to memory of 1108	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	42
PID 2928 wrote to memory of 1108	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	42
PID 2928 wrote to memory of 1108	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	42
PID 2928 wrote to memory of 2064	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	43
PID 2928 wrote to memory of 2064	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	43
PID 2928 wrote to memory of 2064	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	43
PID 2928 wrote to memory of 2908	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	44
PID 2928 wrote to memory of 2908	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	44
PID 2928 wrote to memory of 2908	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	44
PID 2928 wrote to memory of 2904	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	45
PID 2928 wrote to memory of 2904	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	45
PID 2928 wrote to memory of 2904	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	45
PID 2928 wrote to memory of 2268	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	46
PID 2928 wrote to memory of 2268	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	46
PID 2928 wrote to memory of 2268	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	46
PID 2928 wrote to memory of 2220	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	47
PID 2928 wrote to memory of 2220	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	47
PID 2928 wrote to memory of 2220	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	47
PID 2928 wrote to memory of 760	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	48
PID 2928 wrote to memory of 760	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	48
PID 2928 wrote to memory of 760	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	48
PID 2928 wrote to memory of 2432	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	49
PID 2928 wrote to memory of 2432	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	49
PID 2928 wrote to memory of 2432	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	49
PID 2928 wrote to memory of 1304	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	50
PID 2928 wrote to memory of 1304	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	50
PID 2928 wrote to memory of 1304	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	50
PID 2928 wrote to memory of 400	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	51
PID 2928 wrote to memory of 400	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	51
PID 2928 wrote to memory of 400	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	51
PID 2928 wrote to memory of 3028	2928	13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe	52

C:\Users\Admin\AppData\Local\Temp\13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe
"C:\Users\Admin\AppData\Local\Temp\13693bad36975c010ca82a420dac91e9129fd7b075e3edd43d30ffe1ea7a164f.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\System\vXNBobE.exe
  C:\Windows\System\vXNBobE.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\AqGAnOk.exe
  C:\Windows\System\AqGAnOk.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\DFzLuNj.exe
  C:\Windows\System\DFzLuNj.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\tLqRLUt.exe
  C:\Windows\System\tLqRLUt.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\QQqILBk.exe
  C:\Windows\System\QQqILBk.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\EdzDIaS.exe
  C:\Windows\System\EdzDIaS.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\HwEQpxW.exe
  C:\Windows\System\HwEQpxW.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\OHcITYN.exe
  C:\Windows\System\OHcITYN.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\JscLYBa.exe
  C:\Windows\System\JscLYBa.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\UohplCm.exe
  C:\Windows\System\UohplCm.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\qGsKZmC.exe
  C:\Windows\System\qGsKZmC.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\CYbMCQN.exe
  C:\Windows\System\CYbMCQN.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\catgyfe.exe
  C:\Windows\System\catgyfe.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\oXWGCvr.exe
  C:\Windows\System\oXWGCvr.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\wIgiKaf.exe
  C:\Windows\System\wIgiKaf.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\jFsptfg.exe
  C:\Windows\System\jFsptfg.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\jlRWOmP.exe
  C:\Windows\System\jlRWOmP.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\nVxIsfk.exe
  C:\Windows\System\nVxIsfk.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\byHauZR.exe
  C:\Windows\System\byHauZR.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\glTcrPZ.exe
  C:\Windows\System\glTcrPZ.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\JFbYdHe.exe
  C:\Windows\System\JFbYdHe.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\OSXNmjP.exe
  C:\Windows\System\OSXNmjP.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\FaSMmBI.exe
  C:\Windows\System\FaSMmBI.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\iYxjBQn.exe
  C:\Windows\System\iYxjBQn.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\caNzrrj.exe
  C:\Windows\System\caNzrrj.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\fJSjGam.exe
  C:\Windows\System\fJSjGam.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\eDybVqS.exe
  C:\Windows\System\eDybVqS.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\eNPybwn.exe
  C:\Windows\System\eNPybwn.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\fpnuuiB.exe
  C:\Windows\System\fpnuuiB.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\TVURrDe.exe
  C:\Windows\System\TVURrDe.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\dYUXXVI.exe
  C:\Windows\System\dYUXXVI.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\nuDwgeF.exe
  C:\Windows\System\nuDwgeF.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\IzNvavL.exe
  C:\Windows\System\IzNvavL.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\rEhOJmk.exe
  C:\Windows\System\rEhOJmk.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\seKezzS.exe
  C:\Windows\System\seKezzS.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\LscewPo.exe
  C:\Windows\System\LscewPo.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\pxSdetN.exe
  C:\Windows\System\pxSdetN.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\TyfjEkJ.exe
  C:\Windows\System\TyfjEkJ.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\KhryiBO.exe
  C:\Windows\System\KhryiBO.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\nbWovXZ.exe
  C:\Windows\System\nbWovXZ.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\FZwwHVL.exe
  C:\Windows\System\FZwwHVL.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\IeTQZJl.exe
  C:\Windows\System\IeTQZJl.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\QXDZIDW.exe
  C:\Windows\System\QXDZIDW.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\bANdZDM.exe
  C:\Windows\System\bANdZDM.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\rFuHPUg.exe
  C:\Windows\System\rFuHPUg.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\ABfXBDx.exe
  C:\Windows\System\ABfXBDx.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\FVxxugL.exe
  C:\Windows\System\FVxxugL.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\riDBcCS.exe
  C:\Windows\System\riDBcCS.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\fYffYBa.exe
  C:\Windows\System\fYffYBa.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\OOUmjYX.exe
  C:\Windows\System\OOUmjYX.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\VKvSBmT.exe
  C:\Windows\System\VKvSBmT.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\zLAreKJ.exe
  C:\Windows\System\zLAreKJ.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\cIlsmYC.exe
  C:\Windows\System\cIlsmYC.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\liFErfO.exe
  C:\Windows\System\liFErfO.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\zzZdxEC.exe
  C:\Windows\System\zzZdxEC.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\oiPGWxh.exe
  C:\Windows\System\oiPGWxh.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\hhXAncB.exe
  C:\Windows\System\hhXAncB.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\IEotbFB.exe
  C:\Windows\System\IEotbFB.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\plWQNkl.exe
  C:\Windows\System\plWQNkl.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\Mucgzsr.exe
  C:\Windows\System\Mucgzsr.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\ibsBgpB.exe
  C:\Windows\System\ibsBgpB.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\qzNiNmz.exe
  C:\Windows\System\qzNiNmz.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\uQrgslV.exe
  C:\Windows\System\uQrgslV.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\VpQUsjj.exe
  C:\Windows\System\VpQUsjj.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\xvlgNtn.exe
  C:\Windows\System\xvlgNtn.exe
  2⤵
  PID:1844
- C:\Windows\System\blBJliW.exe
  C:\Windows\System\blBJliW.exe
  2⤵
  PID:1784
- C:\Windows\System\OliuveG.exe
  C:\Windows\System\OliuveG.exe
  2⤵
  PID:2476
- C:\Windows\System\bhacMkR.exe
  C:\Windows\System\bhacMkR.exe
  2⤵
  PID:2204
- C:\Windows\System\PfXVCIe.exe
  C:\Windows\System\PfXVCIe.exe
  2⤵
  PID:296
- C:\Windows\System\bTDFCzU.exe
  C:\Windows\System\bTDFCzU.exe
  2⤵
  PID:780
- C:\Windows\System\acyycrr.exe
  C:\Windows\System\acyycrr.exe
  2⤵
  PID:1272
- C:\Windows\System\RWHiIxA.exe
  C:\Windows\System\RWHiIxA.exe
  2⤵
  PID:1796
- C:\Windows\System\fnkglrS.exe
  C:\Windows\System\fnkglrS.exe
  2⤵
  PID:3040
- C:\Windows\System\CDixYZH.exe
  C:\Windows\System\CDixYZH.exe
  2⤵
  PID:2212
- C:\Windows\System\TxLDURj.exe
  C:\Windows\System\TxLDURj.exe
  2⤵
  PID:2296
- C:\Windows\System\RiAHZbI.exe
  C:\Windows\System\RiAHZbI.exe
  2⤵
  PID:2232
- C:\Windows\System\cHsyqPM.exe
  C:\Windows\System\cHsyqPM.exe
  2⤵
  PID:812
- C:\Windows\System\WQBQDvq.exe
  C:\Windows\System\WQBQDvq.exe
  2⤵
  PID:1068
- C:\Windows\System\RqUrqmP.exe
  C:\Windows\System\RqUrqmP.exe
  2⤵
  PID:1400
- C:\Windows\System\CFtSaoq.exe
  C:\Windows\System\CFtSaoq.exe
  2⤵
  PID:944
- C:\Windows\System\HlroOYs.exe
  C:\Windows\System\HlroOYs.exe
  2⤵
  PID:1376
- C:\Windows\System\RPzWucR.exe
  C:\Windows\System\RPzWucR.exe
  2⤵
  PID:2604
- C:\Windows\System\rTiNYSx.exe
  C:\Windows\System\rTiNYSx.exe
  2⤵
  PID:1756
- C:\Windows\System\CWLbRth.exe
  C:\Windows\System\CWLbRth.exe
  2⤵
  PID:2080
- C:\Windows\System\qPxyuPZ.exe
  C:\Windows\System\qPxyuPZ.exe
  2⤵
  PID:2424
- C:\Windows\System\vUxPrzU.exe
  C:\Windows\System\vUxPrzU.exe
  2⤵
  PID:1880
- C:\Windows\System\fkvpUXL.exe
  C:\Windows\System\fkvpUXL.exe
  2⤵
  PID:2148
- C:\Windows\System\geWiaix.exe
  C:\Windows\System\geWiaix.exe
  2⤵
  PID:1644
- C:\Windows\System\pnwvABj.exe
  C:\Windows\System\pnwvABj.exe
  2⤵
  PID:876
- C:\Windows\System\iofaRQQ.exe
  C:\Windows\System\iofaRQQ.exe
  2⤵
  PID:3012
- C:\Windows\System\XuYaEkn.exe
  C:\Windows\System\XuYaEkn.exe
  2⤵
  PID:2016
- C:\Windows\System\JYLJuoF.exe
  C:\Windows\System\JYLJuoF.exe
  2⤵
  PID:2616
- C:\Windows\System\iFIOmkC.exe
  C:\Windows\System\iFIOmkC.exe
  2⤵
  PID:2784
- C:\Windows\System\JQZsIfh.exe
  C:\Windows\System\JQZsIfh.exe
  2⤵
  PID:1576
- C:\Windows\System\kHurirD.exe
  C:\Windows\System\kHurirD.exe
  2⤵
  PID:2860
- C:\Windows\System\kBFCvAp.exe
  C:\Windows\System\kBFCvAp.exe
  2⤵
  PID:2744
- C:\Windows\System\kOSnCig.exe
  C:\Windows\System\kOSnCig.exe
  2⤵
  PID:584
- C:\Windows\System\Vwbscvl.exe
  C:\Windows\System\Vwbscvl.exe
  2⤵
  PID:1920
- C:\Windows\System\CTUmleE.exe
  C:\Windows\System\CTUmleE.exe
  2⤵
  PID:2672
- C:\Windows\System\QRJxFcf.exe
  C:\Windows\System\QRJxFcf.exe
  2⤵
  PID:1296
- C:\Windows\System\mGvZEDg.exe
  C:\Windows\System\mGvZEDg.exe
  2⤵
  PID:1852
- C:\Windows\System\hQYGClR.exe
  C:\Windows\System\hQYGClR.exe
  2⤵
  PID:1316
- C:\Windows\System\KvpaWyL.exe
  C:\Windows\System\KvpaWyL.exe
  2⤵
  PID:2648
- C:\Windows\System\ivoydqb.exe
  C:\Windows\System\ivoydqb.exe
  2⤵
  PID:656
- C:\Windows\System\rKznyBo.exe
  C:\Windows\System\rKznyBo.exe
  2⤵
  PID:1588
- C:\Windows\System\wbcLjXI.exe
  C:\Windows\System\wbcLjXI.exe
  2⤵
  PID:2196
- C:\Windows\System\mQiVSmc.exe
  C:\Windows\System\mQiVSmc.exe
  2⤵
  PID:1556
- C:\Windows\System\ADaraxc.exe
  C:\Windows\System\ADaraxc.exe
  2⤵
  PID:1772
- C:\Windows\System\bbkKsKm.exe
  C:\Windows\System\bbkKsKm.exe
  2⤵
  PID:2804
- C:\Windows\System\HzJIcNJ.exe
  C:\Windows\System\HzJIcNJ.exe
  2⤵
  PID:544
- C:\Windows\System\UeSdakG.exe
  C:\Windows\System\UeSdakG.exe
  2⤵
  PID:2388
- C:\Windows\System\TgwFPve.exe
  C:\Windows\System\TgwFPve.exe
  2⤵
  PID:1724
- C:\Windows\System\mzSJgwp.exe
  C:\Windows\System\mzSJgwp.exe
  2⤵
  PID:1668
- C:\Windows\System\XJgtaDO.exe
  C:\Windows\System\XJgtaDO.exe
  2⤵
  PID:1612
- C:\Windows\System\tIJuYZS.exe
  C:\Windows\System\tIJuYZS.exe
  2⤵
  PID:2980
- C:\Windows\System\hjFTggQ.exe
  C:\Windows\System\hjFTggQ.exe
  2⤵
  PID:2940
- C:\Windows\System\qEvNKvH.exe
  C:\Windows\System\qEvNKvH.exe
  2⤵
  PID:2176
- C:\Windows\System\pYoxwoV.exe
  C:\Windows\System\pYoxwoV.exe
  2⤵
  PID:1948
- C:\Windows\System\WuattdO.exe
  C:\Windows\System\WuattdO.exe
  2⤵
  PID:2836
- C:\Windows\System\WdXWwhn.exe
  C:\Windows\System\WdXWwhn.exe
  2⤵
  PID:2116
- C:\Windows\System\aocbFAl.exe
  C:\Windows\System\aocbFAl.exe
  2⤵
  PID:888
- C:\Windows\System\hqliFKb.exe
  C:\Windows\System\hqliFKb.exe
  2⤵
  PID:2392
- C:\Windows\System\DPQvrmD.exe
  C:\Windows\System\DPQvrmD.exe
  2⤵
  PID:1700
- C:\Windows\System\QCDKffi.exe
  C:\Windows\System\QCDKffi.exe
  2⤵
  PID:1884
- C:\Windows\System\trUFAxh.exe
  C:\Windows\System\trUFAxh.exe
  2⤵
  PID:772
- C:\Windows\System\NQxzkcK.exe
  C:\Windows\System\NQxzkcK.exe
  2⤵
  PID:1684
- C:\Windows\System\QmxkbIi.exe
  C:\Windows\System\QmxkbIi.exe
  2⤵
  PID:3052
- C:\Windows\System\nOuBPZw.exe
  C:\Windows\System\nOuBPZw.exe
  2⤵
  PID:2988
- C:\Windows\System\UlkrNxu.exe
  C:\Windows\System\UlkrNxu.exe
  2⤵
  PID:2352
- C:\Windows\System\BqBUCty.exe
  C:\Windows\System\BqBUCty.exe
  2⤵
  PID:1496
- C:\Windows\System\oSurCGM.exe
  C:\Windows\System\oSurCGM.exe
  2⤵
  PID:712
- C:\Windows\System\mGZvgKS.exe
  C:\Windows\System\mGZvgKS.exe
  2⤵
  PID:2932
- C:\Windows\System\ybYYLSK.exe
  C:\Windows\System\ybYYLSK.exe
  2⤵
  PID:1488
- C:\Windows\System\YAqMAKb.exe
  C:\Windows\System\YAqMAKb.exe
  2⤵
  PID:808
- C:\Windows\System\fIbbZWc.exe
  C:\Windows\System\fIbbZWc.exe
  2⤵
  PID:1872
- C:\Windows\System\LLXaaNO.exe
  C:\Windows\System\LLXaaNO.exe
  2⤵
  PID:2880
- C:\Windows\System\OWnxdfk.exe
  C:\Windows\System\OWnxdfk.exe
  2⤵
  PID:2544
- C:\Windows\System\xvkHVXH.exe
  C:\Windows\System\xvkHVXH.exe
  2⤵
  PID:2992
- C:\Windows\System\jtSmFPS.exe
  C:\Windows\System\jtSmFPS.exe
  2⤵
  PID:2012
- C:\Windows\System\iKgDEAU.exe
  C:\Windows\System\iKgDEAU.exe
  2⤵
  PID:2168
- C:\Windows\System\MpQvgWh.exe
  C:\Windows\System\MpQvgWh.exe
  2⤵
  PID:848
- C:\Windows\System\aMXjAfi.exe
  C:\Windows\System\aMXjAfi.exe
  2⤵
  PID:1032
- C:\Windows\System\fYbYOyo.exe
  C:\Windows\System\fYbYOyo.exe
  2⤵
  PID:1440
- C:\Windows\System\sfyycYU.exe
  C:\Windows\System\sfyycYU.exe
  2⤵
  PID:1052
- C:\Windows\System\RskOtzR.exe
  C:\Windows\System\RskOtzR.exe
  2⤵
  PID:2688
- C:\Windows\System\eXNPilz.exe
  C:\Windows\System\eXNPilz.exe
  2⤵
  PID:1504
- C:\Windows\System\LxmFgGP.exe
  C:\Windows\System\LxmFgGP.exe
  2⤵
  PID:2412
- C:\Windows\System\CZCTngK.exe
  C:\Windows\System\CZCTngK.exe
  2⤵
  PID:2488
- C:\Windows\System\qVUVyuL.exe
  C:\Windows\System\qVUVyuL.exe
  2⤵
  PID:2892
- C:\Windows\System\PSaokxJ.exe
  C:\Windows\System\PSaokxJ.exe
  2⤵
  PID:2500
- C:\Windows\System\LhmjCuI.exe
  C:\Windows\System\LhmjCuI.exe
  2⤵
  PID:1664
- C:\Windows\System\BGYDggq.exe
  C:\Windows\System\BGYDggq.exe
  2⤵
  PID:2200
- C:\Windows\System\oMhAoJb.exe
  C:\Windows\System\oMhAoJb.exe
  2⤵
  PID:832
- C:\Windows\System\UUwGeAr.exe
  C:\Windows\System\UUwGeAr.exe
  2⤵
  PID:1520
- C:\Windows\System\LGeEBqu.exe
  C:\Windows\System\LGeEBqu.exe
  2⤵
  PID:1732
- C:\Windows\System\Badhsho.exe
  C:\Windows\System\Badhsho.exe
  2⤵
  PID:304
- C:\Windows\System\oiCYLVd.exe
  C:\Windows\System\oiCYLVd.exe
  2⤵
  PID:2288
- C:\Windows\System\MOVXtnQ.exe
  C:\Windows\System\MOVXtnQ.exe
  2⤵
  PID:2864
- C:\Windows\System\RdWPJXS.exe
  C:\Windows\System\RdWPJXS.exe
  2⤵
  PID:2020
- C:\Windows\System\gYsjUdo.exe
  C:\Windows\System\gYsjUdo.exe
  2⤵
  PID:2340
- C:\Windows\System\WIbimTV.exe
  C:\Windows\System\WIbimTV.exe
  2⤵
  PID:2224
- C:\Windows\System\nZhUtIE.exe
  C:\Windows\System\nZhUtIE.exe
  2⤵
  PID:2820
- C:\Windows\System\BMqkdQC.exe
  C:\Windows\System\BMqkdQC.exe
  2⤵
  PID:844
- C:\Windows\System\eGZUFOi.exe
  C:\Windows\System\eGZUFOi.exe
  2⤵
  PID:3036
- C:\Windows\System\ThKfrZJ.exe
  C:\Windows\System\ThKfrZJ.exe
  2⤵
  PID:2480
- C:\Windows\System\tQNsMkX.exe
  C:\Windows\System\tQNsMkX.exe
  2⤵
  PID:3004
- C:\Windows\System\jjZmSTl.exe
  C:\Windows\System\jjZmSTl.exe
  2⤵
  PID:448
- C:\Windows\System\ccezIvN.exe
  C:\Windows\System\ccezIvN.exe
  2⤵
  PID:3092
- C:\Windows\System\XCtVsft.exe
  C:\Windows\System\XCtVsft.exe
  2⤵
  PID:3108
- C:\Windows\System\ZanoqoS.exe
  C:\Windows\System\ZanoqoS.exe
  2⤵
  PID:3124
- C:\Windows\System\EnOTVcd.exe
  C:\Windows\System\EnOTVcd.exe
  2⤵
  PID:3140
- C:\Windows\System\VBtAWIU.exe
  C:\Windows\System\VBtAWIU.exe
  2⤵
  PID:3156
- C:\Windows\System\GSWDmHu.exe
  C:\Windows\System\GSWDmHu.exe
  2⤵
  PID:3172
- C:\Windows\System\AViJfst.exe
  C:\Windows\System\AViJfst.exe
  2⤵
  PID:3196
- C:\Windows\System\ejqieBJ.exe
  C:\Windows\System\ejqieBJ.exe
  2⤵
  PID:3244
- C:\Windows\System\rUWMFWF.exe
  C:\Windows\System\rUWMFWF.exe
  2⤵
  PID:3264
- C:\Windows\System\DaEADbt.exe
  C:\Windows\System\DaEADbt.exe
  2⤵
  PID:3284
- C:\Windows\System\IBVnqqg.exe
  C:\Windows\System\IBVnqqg.exe
  2⤵
  PID:3300
- C:\Windows\System\ArfLpSg.exe
  C:\Windows\System\ArfLpSg.exe
  2⤵
  PID:3320
- C:\Windows\System\jSBzhwb.exe
  C:\Windows\System\jSBzhwb.exe
  2⤵
  PID:3340
- C:\Windows\System\pFSEgKG.exe
  C:\Windows\System\pFSEgKG.exe
  2⤵
  PID:3360
- C:\Windows\System\XtOLwCw.exe
  C:\Windows\System\XtOLwCw.exe
  2⤵
  PID:3380
- C:\Windows\System\zkEIBXf.exe
  C:\Windows\System\zkEIBXf.exe
  2⤵
  PID:3400
- C:\Windows\System\rlTgekq.exe
  C:\Windows\System\rlTgekq.exe
  2⤵
  PID:3416
- C:\Windows\System\GaxiYuh.exe
  C:\Windows\System\GaxiYuh.exe
  2⤵
  PID:3436
- C:\Windows\System\BELRFiU.exe
  C:\Windows\System\BELRFiU.exe
  2⤵
  PID:3452
- C:\Windows\System\FxavnTv.exe
  C:\Windows\System\FxavnTv.exe
  2⤵
  PID:3472
- C:\Windows\System\FWFQjKZ.exe
  C:\Windows\System\FWFQjKZ.exe
  2⤵
  PID:3488
- C:\Windows\System\jtYUGzU.exe
  C:\Windows\System\jtYUGzU.exe
  2⤵
  PID:3508
- C:\Windows\System\xrVoXAG.exe
  C:\Windows\System\xrVoXAG.exe
  2⤵
  PID:3524
- C:\Windows\System\YcLANNr.exe
  C:\Windows\System\YcLANNr.exe
  2⤵
  PID:3544
- C:\Windows\System\BAhkipt.exe
  C:\Windows\System\BAhkipt.exe
  2⤵
  PID:3568
- C:\Windows\System\dfyTRWO.exe
  C:\Windows\System\dfyTRWO.exe
  2⤵
  PID:3588
- C:\Windows\System\znSdbDJ.exe
  C:\Windows\System\znSdbDJ.exe
  2⤵
  PID:3608
- C:\Windows\System\vYzSCCl.exe
  C:\Windows\System\vYzSCCl.exe
  2⤵
  PID:3632
- C:\Windows\System\jiCaQVL.exe
  C:\Windows\System\jiCaQVL.exe
  2⤵
  PID:3648
- C:\Windows\System\ZhDFlfN.exe
  C:\Windows\System\ZhDFlfN.exe
  2⤵
  PID:3668
- C:\Windows\System\DkwDORL.exe
  C:\Windows\System\DkwDORL.exe
  2⤵
  PID:3688
- C:\Windows\System\dmLVreK.exe
  C:\Windows\System\dmLVreK.exe
  2⤵
  PID:3708
- C:\Windows\System\JhkDicv.exe
  C:\Windows\System\JhkDicv.exe
  2⤵
  PID:3724
- C:\Windows\System\fsQhpnx.exe
  C:\Windows\System\fsQhpnx.exe
  2⤵
  PID:3748
- C:\Windows\System\zIfWngG.exe
  C:\Windows\System\zIfWngG.exe
  2⤵
  PID:3764
- C:\Windows\System\zyBYfFY.exe
  C:\Windows\System\zyBYfFY.exe
  2⤵
  PID:3788
- C:\Windows\System\dKiTxep.exe
  C:\Windows\System\dKiTxep.exe
  2⤵
  PID:3812
- C:\Windows\System\LMxNbQA.exe
  C:\Windows\System\LMxNbQA.exe
  2⤵
  PID:3828
- C:\Windows\System\oPTOphy.exe
  C:\Windows\System\oPTOphy.exe
  2⤵
  PID:3844
- C:\Windows\System\DscFGki.exe
  C:\Windows\System\DscFGki.exe
  2⤵
  PID:3896
- C:\Windows\System\VlksIfs.exe
  C:\Windows\System\VlksIfs.exe
  2⤵
  PID:3916
- C:\Windows\System\AWDVIIf.exe
  C:\Windows\System\AWDVIIf.exe
  2⤵
  PID:3932
- C:\Windows\System\DYMuTlR.exe
  C:\Windows\System\DYMuTlR.exe
  2⤵
  PID:3948
- C:\Windows\System\eAXYGJk.exe
  C:\Windows\System\eAXYGJk.exe
  2⤵
  PID:3964
- C:\Windows\System\QwHAoEz.exe
  C:\Windows\System\QwHAoEz.exe
  2⤵
  PID:3984
- C:\Windows\System\ilnrWIf.exe
  C:\Windows\System\ilnrWIf.exe
  2⤵
  PID:4000
- C:\Windows\System\juhGofD.exe
  C:\Windows\System\juhGofD.exe
  2⤵
  PID:4016
- C:\Windows\System\NpQRrjw.exe
  C:\Windows\System\NpQRrjw.exe
  2⤵
  PID:4032
- C:\Windows\System\iPXKrFl.exe
  C:\Windows\System\iPXKrFl.exe
  2⤵
  PID:4048
- C:\Windows\System\kTZBAtk.exe
  C:\Windows\System\kTZBAtk.exe
  2⤵
  PID:4064
- C:\Windows\System\mZCIxEq.exe
  C:\Windows\System\mZCIxEq.exe
  2⤵
  PID:4080
- C:\Windows\System\OvFYoCM.exe
  C:\Windows\System\OvFYoCM.exe
  2⤵
  PID:2512
- C:\Windows\System\jTHtybg.exe
  C:\Windows\System\jTHtybg.exe
  2⤵
  PID:3132
- C:\Windows\System\ORlcOdT.exe
  C:\Windows\System\ORlcOdT.exe
  2⤵
  PID:3168
- C:\Windows\System\xbQuVJD.exe
  C:\Windows\System\xbQuVJD.exe
  2⤵
  PID:1288
- C:\Windows\System\oidXYMt.exe
  C:\Windows\System\oidXYMt.exe
  2⤵
  PID:3088
- C:\Windows\System\jFnteVm.exe
  C:\Windows\System\jFnteVm.exe
  2⤵
  PID:3080
- C:\Windows\System\KNuKekb.exe
  C:\Windows\System\KNuKekb.exe
  2⤵
  PID:3216
- C:\Windows\System\JEwacAm.exe
  C:\Windows\System\JEwacAm.exe
  2⤵
  PID:3192
- C:\Windows\System\rXxNqRN.exe
  C:\Windows\System\rXxNqRN.exe
  2⤵
  PID:3236
- C:\Windows\System\uxsXJSN.exe
  C:\Windows\System\uxsXJSN.exe
  2⤵
  PID:3272
- C:\Windows\System\nBUjAaZ.exe
  C:\Windows\System\nBUjAaZ.exe
  2⤵
  PID:3348
- C:\Windows\System\GPTjVsR.exe
  C:\Windows\System\GPTjVsR.exe
  2⤵
  PID:3428
- C:\Windows\System\SzIlRKb.exe
  C:\Windows\System\SzIlRKb.exe
  2⤵
  PID:3464
- C:\Windows\System\qqxOJME.exe
  C:\Windows\System\qqxOJME.exe
  2⤵
  PID:3504
- C:\Windows\System\FCBoyin.exe
  C:\Windows\System\FCBoyin.exe
  2⤵
  PID:3540
- C:\Windows\System\xllPDhS.exe
  C:\Windows\System\xllPDhS.exe
  2⤵
  PID:3372
- C:\Windows\System\yiWATFM.exe
  C:\Windows\System\yiWATFM.exe
  2⤵
  PID:3444
- C:\Windows\System\VGreqwd.exe
  C:\Windows\System\VGreqwd.exe
  2⤵
  PID:3616
- C:\Windows\System\NBhrCjU.exe
  C:\Windows\System\NBhrCjU.exe
  2⤵
  PID:3656
- C:\Windows\System\iZxOtMW.exe
  C:\Windows\System\iZxOtMW.exe
  2⤵
  PID:3704
- C:\Windows\System\szJrSLd.exe
  C:\Windows\System\szJrSLd.exe
  2⤵
  PID:3744
- C:\Windows\System\Glkxnxy.exe
  C:\Windows\System\Glkxnxy.exe
  2⤵
  PID:3784
- C:\Windows\System\lcJyxIV.exe
  C:\Windows\System\lcJyxIV.exe
  2⤵
  PID:3760
- C:\Windows\System\dvCbMrR.exe
  C:\Windows\System\dvCbMrR.exe
  2⤵
  PID:3328
- C:\Windows\System\Dyyfgfo.exe
  C:\Windows\System\Dyyfgfo.exe
  2⤵
  PID:3892
- C:\Windows\System\ckPEqZz.exe
  C:\Windows\System\ckPEqZz.exe
  2⤵
  PID:3520
- C:\Windows\System\HYCYkvr.exe
  C:\Windows\System\HYCYkvr.exe
  2⤵
  PID:3808
- C:\Windows\System\vRXtIhN.exe
  C:\Windows\System\vRXtIhN.exe
  2⤵
  PID:3924
- C:\Windows\System\VKGwYiw.exe
  C:\Windows\System\VKGwYiw.exe
  2⤵
  PID:3960
- C:\Windows\System\LDoNzah.exe
  C:\Windows\System\LDoNzah.exe
  2⤵
  PID:4056
- C:\Windows\System\PrQlZlS.exe
  C:\Windows\System\PrQlZlS.exe
  2⤵
  PID:756
- C:\Windows\System\hEtuKuw.exe
  C:\Windows\System\hEtuKuw.exe
  2⤵
  PID:3208
- C:\Windows\System\bdtyJPW.exe
  C:\Windows\System\bdtyJPW.exe
  2⤵
  PID:3312
- C:\Windows\System\EteCPeN.exe
  C:\Windows\System\EteCPeN.exe
  2⤵
  PID:3432
- C:\Windows\System\dBGlGZN.exe
  C:\Windows\System\dBGlGZN.exe
  2⤵
  PID:3624
- C:\Windows\System\exjZBoy.exe
  C:\Windows\System\exjZBoy.exe
  2⤵
  PID:3260
- C:\Windows\System\tIPoUyB.exe
  C:\Windows\System\tIPoUyB.exe
  2⤵
  PID:3412
- C:\Windows\System\WIoBUls.exe
  C:\Windows\System\WIoBUls.exe
  2⤵
  PID:4012
- C:\Windows\System\sMebMsO.exe
  C:\Windows\System\sMebMsO.exe
  2⤵
  PID:4076
- C:\Windows\System\BSnYPpW.exe
  C:\Windows\System\BSnYPpW.exe
  2⤵
  PID:2248
- C:\Windows\System\ADUMQcU.exe
  C:\Windows\System\ADUMQcU.exe
  2⤵
  PID:3356
- C:\Windows\System\uxGRIRd.exe
  C:\Windows\System\uxGRIRd.exe
  2⤵
  PID:3940
- C:\Windows\System\XnSpBkG.exe
  C:\Windows\System\XnSpBkG.exe
  2⤵
  PID:2508
- C:\Windows\System\XHYyXFr.exe
  C:\Windows\System\XHYyXFr.exe
  2⤵
  PID:3148
- C:\Windows\System\MfxLUnA.exe
  C:\Windows\System\MfxLUnA.exe
  2⤵
  PID:3496
- C:\Windows\System\CnxvYeq.exe
  C:\Windows\System\CnxvYeq.exe
  2⤵
  PID:3580
- C:\Windows\System\ZdIGFoo.exe
  C:\Windows\System\ZdIGFoo.exe
  2⤵
  PID:3696
- C:\Windows\System\dOmwrwc.exe
  C:\Windows\System\dOmwrwc.exe
  2⤵
  PID:3800
- C:\Windows\System\yUCDjVp.exe
  C:\Windows\System\yUCDjVp.exe
  2⤵
  PID:3888
- C:\Windows\System\FtgDLMa.exe
  C:\Windows\System\FtgDLMa.exe
  2⤵
  PID:4088
- C:\Windows\System\FBPJkKG.exe
  C:\Windows\System\FBPJkKG.exe
  2⤵
  PID:3308
- C:\Windows\System\PVOldgX.exe
  C:\Windows\System\PVOldgX.exe
  2⤵
  PID:3604
- C:\Windows\System\JMgqxzQ.exe
  C:\Windows\System\JMgqxzQ.exe
  2⤵
  PID:3296
- C:\Windows\System\nNrUStz.exe
  C:\Windows\System\nNrUStz.exe
  2⤵
  PID:3100
- C:\Windows\System\lExMmNS.exe
  C:\Windows\System\lExMmNS.exe
  2⤵
  PID:3584
- C:\Windows\System\rCTrCUx.exe
  C:\Windows\System\rCTrCUx.exe
  2⤵
  PID:3884
- C:\Windows\System\UNUVpYk.exe
  C:\Windows\System\UNUVpYk.exe
  2⤵
  PID:3180
- C:\Windows\System\XWPoBRJ.exe
  C:\Windows\System\XWPoBRJ.exe
  2⤵
  PID:3240
- C:\Windows\System\qujTJVi.exe
  C:\Windows\System\qujTJVi.exe
  2⤵
  PID:3872
- C:\Windows\System\OmrgEDp.exe
  C:\Windows\System\OmrgEDp.exe
  2⤵
  PID:3912
- C:\Windows\System\QElvYgq.exe
  C:\Windows\System\QElvYgq.exe
  2⤵
  PID:4112
- C:\Windows\System\flCkEZv.exe
  C:\Windows\System\flCkEZv.exe
  2⤵
  PID:4128
- C:\Windows\System\KKzaoXp.exe
  C:\Windows\System\KKzaoXp.exe
  2⤵
  PID:4148
- C:\Windows\System\kkQIlTj.exe
  C:\Windows\System\kkQIlTj.exe
  2⤵
  PID:4164
- C:\Windows\System\iGoigRE.exe
  C:\Windows\System\iGoigRE.exe
  2⤵
  PID:4184
- C:\Windows\System\vgWZzOE.exe
  C:\Windows\System\vgWZzOE.exe
  2⤵
  PID:4200
- C:\Windows\System\XtdWOAD.exe
  C:\Windows\System\XtdWOAD.exe
  2⤵
  PID:4224
- C:\Windows\System\kvqtFpY.exe
  C:\Windows\System\kvqtFpY.exe
  2⤵
  PID:4240
- C:\Windows\System\IrGHyaG.exe
  C:\Windows\System\IrGHyaG.exe
  2⤵
  PID:4268
- C:\Windows\System\SraFCYu.exe
  C:\Windows\System\SraFCYu.exe
  2⤵
  PID:4288
- C:\Windows\System\DKfeNLi.exe
  C:\Windows\System\DKfeNLi.exe
  2⤵
  PID:4308
- C:\Windows\System\DjYvArz.exe
  C:\Windows\System\DjYvArz.exe
  2⤵
  PID:4324
- C:\Windows\System\IWwPNdM.exe
  C:\Windows\System\IWwPNdM.exe
  2⤵
  PID:4344
- C:\Windows\System\QoOWFWJ.exe
  C:\Windows\System\QoOWFWJ.exe
  2⤵
  PID:4364
- C:\Windows\System\vuIuLWY.exe
  C:\Windows\System\vuIuLWY.exe
  2⤵
  PID:4380
- C:\Windows\System\ZSxSaBn.exe
  C:\Windows\System\ZSxSaBn.exe
  2⤵
  PID:4396
- C:\Windows\System\DOmhQyi.exe
  C:\Windows\System\DOmhQyi.exe
  2⤵
  PID:4416
- C:\Windows\System\XZQPUHD.exe
  C:\Windows\System\XZQPUHD.exe
  2⤵
  PID:4432
- C:\Windows\System\Ikcnzee.exe
  C:\Windows\System\Ikcnzee.exe
  2⤵
  PID:4456
- C:\Windows\System\kaFvKcw.exe
  C:\Windows\System\kaFvKcw.exe
  2⤵
  PID:4480
- C:\Windows\System\fvGKdJa.exe
  C:\Windows\System\fvGKdJa.exe
  2⤵
  PID:4496
- C:\Windows\System\SWIUdun.exe
  C:\Windows\System\SWIUdun.exe
  2⤵
  PID:4512
- C:\Windows\System\IKVEIiK.exe
  C:\Windows\System\IKVEIiK.exe
  2⤵
  PID:4532
- C:\Windows\System\CRwvfWr.exe
  C:\Windows\System\CRwvfWr.exe
  2⤵
  PID:4552
- C:\Windows\System\ZiKYtam.exe
  C:\Windows\System\ZiKYtam.exe
  2⤵
  PID:4568
- C:\Windows\System\yAfQgTq.exe
  C:\Windows\System\yAfQgTq.exe
  2⤵
  PID:4588
- C:\Windows\System\FpsRjae.exe
  C:\Windows\System\FpsRjae.exe
  2⤵
  PID:4608
- C:\Windows\System\lNANAcg.exe
  C:\Windows\System\lNANAcg.exe
  2⤵
  PID:4624
- C:\Windows\System\yTBWAjf.exe
  C:\Windows\System\yTBWAjf.exe
  2⤵
  PID:4640
- C:\Windows\System\KqxgzSH.exe
  C:\Windows\System\KqxgzSH.exe
  2⤵
  PID:4656
- C:\Windows\System\lPLQlgk.exe
  C:\Windows\System\lPLQlgk.exe
  2⤵
  PID:4672
- C:\Windows\System\MxKHwht.exe
  C:\Windows\System\MxKHwht.exe
  2⤵
  PID:4688
- C:\Windows\System\tXSszui.exe
  C:\Windows\System\tXSszui.exe
  2⤵
  PID:4728
- C:\Windows\System\kxOTFEW.exe
  C:\Windows\System\kxOTFEW.exe
  2⤵
  PID:4748
- C:\Windows\System\OvKYzuA.exe
  C:\Windows\System\OvKYzuA.exe
  2⤵
  PID:4764
- C:\Windows\System\ApPyBQW.exe
  C:\Windows\System\ApPyBQW.exe
  2⤵
  PID:4788
- C:\Windows\System\sqpHsuM.exe
  C:\Windows\System\sqpHsuM.exe
  2⤵
  PID:4804
- C:\Windows\System\QvlUuUq.exe
  C:\Windows\System\QvlUuUq.exe
  2⤵
  PID:4820
- C:\Windows\System\GdrwvWB.exe
  C:\Windows\System\GdrwvWB.exe
  2⤵
  PID:4840
- C:\Windows\System\erwarCO.exe
  C:\Windows\System\erwarCO.exe
  2⤵
  PID:4856
- C:\Windows\System\ggyYiNc.exe
  C:\Windows\System\ggyYiNc.exe
  2⤵
  PID:4876
- C:\Windows\System\TEYFXrN.exe
  C:\Windows\System\TEYFXrN.exe
  2⤵
  PID:4900
- C:\Windows\System\IzNiInn.exe
  C:\Windows\System\IzNiInn.exe
  2⤵
  PID:4924
- C:\Windows\System\GKJqshW.exe
  C:\Windows\System\GKJqshW.exe
  2⤵
  PID:4944
- C:\Windows\System\WUNrYmF.exe
  C:\Windows\System\WUNrYmF.exe
  2⤵
  PID:4960
- C:\Windows\System\rjRJkqH.exe
  C:\Windows\System\rjRJkqH.exe
  2⤵
  PID:4976
- C:\Windows\System\EzNznfe.exe
  C:\Windows\System\EzNznfe.exe
  2⤵
  PID:4996
- C:\Windows\System\ZZrYPbM.exe
  C:\Windows\System\ZZrYPbM.exe
  2⤵
  PID:5012
- C:\Windows\System\SUuxIOP.exe
  C:\Windows\System\SUuxIOP.exe
  2⤵
  PID:5032
- C:\Windows\System\cfLVnLn.exe
  C:\Windows\System\cfLVnLn.exe
  2⤵
  PID:5052
- C:\Windows\System\GNbjkzT.exe
  C:\Windows\System\GNbjkzT.exe
  2⤵
  PID:5072
- C:\Windows\System\eVaIAjg.exe
  C:\Windows\System\eVaIAjg.exe
  2⤵
  PID:5088
- C:\Windows\System\dPrdtRE.exe
  C:\Windows\System\dPrdtRE.exe
  2⤵
  PID:5108
- C:\Windows\System\fHTTwAQ.exe
  C:\Windows\System\fHTTwAQ.exe
  2⤵
  PID:4100
- C:\Windows\System\YWEMvDj.exe
  C:\Windows\System\YWEMvDj.exe
  2⤵
  PID:4140
- C:\Windows\System\zGbspnt.exe
  C:\Windows\System\zGbspnt.exe
  2⤵
  PID:4220
- C:\Windows\System\EOGvAuv.exe
  C:\Windows\System\EOGvAuv.exe
  2⤵
  PID:4252
- C:\Windows\System\faqqVmM.exe
  C:\Windows\System\faqqVmM.exe
  2⤵
  PID:4264
- C:\Windows\System\sdFeozt.exe
  C:\Windows\System\sdFeozt.exe
  2⤵
  PID:4336
- C:\Windows\System\HdzSWjH.exe
  C:\Windows\System\HdzSWjH.exe
  2⤵
  PID:4404
- C:\Windows\System\Pmioyxq.exe
  C:\Windows\System\Pmioyxq.exe
  2⤵
  PID:4452
- C:\Windows\System\YblYxgE.exe
  C:\Windows\System\YblYxgE.exe
  2⤵
  PID:4528
- C:\Windows\System\ikgBRdQ.exe
  C:\Windows\System\ikgBRdQ.exe
  2⤵
  PID:3736
- C:\Windows\System\mRYWEsZ.exe
  C:\Windows\System\mRYWEsZ.exe
  2⤵
  PID:3556
- C:\Windows\System\cuVporo.exe
  C:\Windows\System\cuVporo.exe
  2⤵
  PID:3864
- C:\Windows\System\rQWjXcb.exe
  C:\Windows\System\rQWjXcb.exe
  2⤵
  PID:3084
- C:\Windows\System\GsADrKL.exe
  C:\Windows\System\GsADrKL.exe
  2⤵
  PID:4604
- C:\Windows\System\JDPjjFn.exe
  C:\Windows\System\JDPjjFn.exe
  2⤵
  PID:4696
- C:\Windows\System\VpEqOMf.exe
  C:\Windows\System\VpEqOMf.exe
  2⤵
  PID:4720
- C:\Windows\System\kYddgmx.exe
  C:\Windows\System\kYddgmx.exe
  2⤵
  PID:4796
- C:\Windows\System\FxFmEjb.exe
  C:\Windows\System\FxFmEjb.exe
  2⤵
  PID:4832
- C:\Windows\System\kWOoVZh.exe
  C:\Windows\System\kWOoVZh.exe
  2⤵
  PID:4192
- C:\Windows\System\pmKfQJf.exe
  C:\Windows\System\pmKfQJf.exe
  2⤵
  PID:3336
- C:\Windows\System\dKDQEOJ.exe
  C:\Windows\System\dKDQEOJ.exe
  2⤵
  PID:4912
- C:\Windows\System\iFXRkWi.exe
  C:\Windows\System\iFXRkWi.exe
  2⤵
  PID:2540
- C:\Windows\System\svspKFO.exe
  C:\Windows\System\svspKFO.exe
  2⤵
  PID:4316
- C:\Windows\System\hLMElQl.exe
  C:\Windows\System\hLMElQl.exe
  2⤵
  PID:5064
- C:\Windows\System\HCClsMa.exe
  C:\Windows\System\HCClsMa.exe
  2⤵
  PID:4108
- C:\Windows\System\GgQrchV.exe
  C:\Windows\System\GgQrchV.exe
  2⤵
  PID:4300
- C:\Windows\System\esFVzTH.exe
  C:\Windows\System\esFVzTH.exe
  2⤵
  PID:4440
- C:\Windows\System\hYWRCTl.exe
  C:\Windows\System\hYWRCTl.exe
  2⤵
  PID:3424
- C:\Windows\System\QykCIyM.exe
  C:\Windows\System\QykCIyM.exe
  2⤵
  PID:3976
- C:\Windows\System\VWyCkXZ.exe
  C:\Windows\System\VWyCkXZ.exe
  2⤵
  PID:4712
- C:\Windows\System\fsJfmvm.exe
  C:\Windows\System\fsJfmvm.exe
  2⤵
  PID:3224
- C:\Windows\System\IIfTKJG.exe
  C:\Windows\System\IIfTKJG.exe
  2⤵
  PID:4028
- C:\Windows\System\ZmDCIoh.exe
  C:\Windows\System\ZmDCIoh.exe
  2⤵
  PID:4892
- C:\Windows\System\CARowUB.exe
  C:\Windows\System\CARowUB.exe
  2⤵
  PID:4248
- C:\Windows\System\vooRBkR.exe
  C:\Windows\System\vooRBkR.exe
  2⤵
  PID:4564
- C:\Windows\System\jhVivPj.exe
  C:\Windows\System\jhVivPj.exe
  2⤵
  PID:4600
- C:\Windows\System\ATulWsp.exe
  C:\Windows\System\ATulWsp.exe
  2⤵
  PID:4236
- C:\Windows\System\OiyklVs.exe
  C:\Windows\System\OiyklVs.exe
  2⤵
  PID:4932
- C:\Windows\System\pNeJtsC.exe
  C:\Windows\System\pNeJtsC.exe
  2⤵
  PID:3820
- C:\Windows\System\oelqqGt.exe
  C:\Windows\System\oelqqGt.exe
  2⤵
  PID:4388
- C:\Windows\System\pGMcvxg.exe
  C:\Windows\System\pGMcvxg.exe
  2⤵
  PID:4468
- C:\Windows\System\qzolIoP.exe
  C:\Windows\System\qzolIoP.exe
  2⤵
  PID:4548
- C:\Windows\System\LDUhUvn.exe
  C:\Windows\System\LDUhUvn.exe
  2⤵
  PID:4352
- C:\Windows\System\irRIRzN.exe
  C:\Windows\System\irRIRzN.exe
  2⤵
  PID:4504
- C:\Windows\System\MRQcMIe.exe
  C:\Windows\System\MRQcMIe.exe
  2⤵
  PID:4260
- C:\Windows\System\infLMfn.exe
  C:\Windows\System\infLMfn.exe
  2⤵
  PID:4280
- C:\Windows\System\PXzQqxL.exe
  C:\Windows\System\PXzQqxL.exe
  2⤵
  PID:5136
- C:\Windows\System\VQyjhwY.exe
  C:\Windows\System\VQyjhwY.exe
  2⤵
  PID:5160
- C:\Windows\System\upLGBbr.exe
  C:\Windows\System\upLGBbr.exe
  2⤵
  PID:5196
- C:\Windows\System\zeWmGSY.exe
  C:\Windows\System\zeWmGSY.exe
  2⤵
  PID:5212
- C:\Windows\System\zgLgoFr.exe
  C:\Windows\System\zgLgoFr.exe
  2⤵
  PID:5228
- C:\Windows\System\gPHwLAz.exe
  C:\Windows\System\gPHwLAz.exe
  2⤵
  PID:5244
- C:\Windows\System\IitTHNG.exe
  C:\Windows\System\IitTHNG.exe
  2⤵
  PID:5260
- C:\Windows\System\iWyymLV.exe
  C:\Windows\System\iWyymLV.exe
  2⤵
  PID:5276
- C:\Windows\System\LzUFqxV.exe
  C:\Windows\System\LzUFqxV.exe
  2⤵
  PID:5292
- C:\Windows\System\LtDllXG.exe
  C:\Windows\System\LtDllXG.exe
  2⤵
  PID:5308
- C:\Windows\System\xUTkrEa.exe
  C:\Windows\System\xUTkrEa.exe
  2⤵
  PID:5332
- C:\Windows\System\pzeyGqZ.exe
  C:\Windows\System\pzeyGqZ.exe
  2⤵
  PID:5348
- C:\Windows\System\IKgoQla.exe
  C:\Windows\System\IKgoQla.exe
  2⤵
  PID:5396
- C:\Windows\System\dHiHlKH.exe
  C:\Windows\System\dHiHlKH.exe
  2⤵
  PID:5412
- C:\Windows\System\MwRZAUY.exe
  C:\Windows\System\MwRZAUY.exe
  2⤵
  PID:5428
- C:\Windows\System\rQEcTaG.exe
  C:\Windows\System\rQEcTaG.exe
  2⤵
  PID:5448
- C:\Windows\System\XWeOPlq.exe
  C:\Windows\System\XWeOPlq.exe
  2⤵
  PID:5464
- C:\Windows\System\IXIVoIy.exe
  C:\Windows\System\IXIVoIy.exe
  2⤵
  PID:5492
- C:\Windows\System\fwSPpNG.exe
  C:\Windows\System\fwSPpNG.exe
  2⤵
  PID:5512
- C:\Windows\System\atTVLqC.exe
  C:\Windows\System\atTVLqC.exe
  2⤵
  PID:5528
- C:\Windows\System\SXPEYgg.exe
  C:\Windows\System\SXPEYgg.exe
  2⤵
  PID:5544
- C:\Windows\System\ZsDMvHa.exe
  C:\Windows\System\ZsDMvHa.exe
  2⤵
  PID:5564
- C:\Windows\System\MoRCOvY.exe
  C:\Windows\System\MoRCOvY.exe
  2⤵
  PID:5584
- C:\Windows\System\sshViTp.exe
  C:\Windows\System\sshViTp.exe
  2⤵
  PID:5600
- C:\Windows\System\nRUjkIU.exe
  C:\Windows\System\nRUjkIU.exe
  2⤵
  PID:5640
- C:\Windows\System\NFcChCv.exe
  C:\Windows\System\NFcChCv.exe
  2⤵
  PID:5656
- C:\Windows\System\CnqZFzD.exe
  C:\Windows\System\CnqZFzD.exe
  2⤵
  PID:5672
- C:\Windows\System\VTaKrRs.exe
  C:\Windows\System\VTaKrRs.exe
  2⤵
  PID:5692
- C:\Windows\System\MrjwfyM.exe
  C:\Windows\System\MrjwfyM.exe
  2⤵
  PID:5716
- C:\Windows\System\zgPnZDf.exe
  C:\Windows\System\zgPnZDf.exe
  2⤵
  PID:5736
- C:\Windows\System\CxvRQiO.exe
  C:\Windows\System\CxvRQiO.exe
  2⤵
  PID:5756
- C:\Windows\System\rJcouWS.exe
  C:\Windows\System\rJcouWS.exe
  2⤵
  PID:5772
- C:\Windows\System\ukLsiCJ.exe
  C:\Windows\System\ukLsiCJ.exe
  2⤵
  PID:5788
- C:\Windows\System\DepdeVE.exe
  C:\Windows\System\DepdeVE.exe
  2⤵
  PID:5804
- C:\Windows\System\veqelPH.exe
  C:\Windows\System\veqelPH.exe
  2⤵
  PID:5824
- C:\Windows\System\WDaEswg.exe
  C:\Windows\System\WDaEswg.exe
  2⤵
  PID:5844
- C:\Windows\System\asYEJOy.exe
  C:\Windows\System\asYEJOy.exe
  2⤵
  PID:5860
- C:\Windows\System\VdhQZig.exe
  C:\Windows\System\VdhQZig.exe
  2⤵
  PID:5884
- C:\Windows\System\EaHpsfP.exe
  C:\Windows\System\EaHpsfP.exe
  2⤵
  PID:5904
- C:\Windows\System\jYqxvXa.exe
  C:\Windows\System\jYqxvXa.exe
  2⤵
  PID:5920
- C:\Windows\System\odtSFiw.exe
  C:\Windows\System\odtSFiw.exe
  2⤵
  PID:5936
- C:\Windows\System\GJkfzeI.exe
  C:\Windows\System\GJkfzeI.exe
  2⤵
  PID:5952
- C:\Windows\System\cTgZzGw.exe
  C:\Windows\System\cTgZzGw.exe
  2⤵
  PID:5972
- C:\Windows\System\tMwpCHJ.exe
  C:\Windows\System\tMwpCHJ.exe
  2⤵
  PID:5988
- C:\Windows\System\YRgMXSC.exe
  C:\Windows\System\YRgMXSC.exe
  2⤵
  PID:6004
- C:\Windows\System\pxdBAVF.exe
  C:\Windows\System\pxdBAVF.exe
  2⤵
  PID:6024
- C:\Windows\System\RLRzuwD.exe
  C:\Windows\System\RLRzuwD.exe
  2⤵
  PID:6040
- C:\Windows\System\AuHOdZV.exe
  C:\Windows\System\AuHOdZV.exe
  2⤵
  PID:6076
- C:\Windows\System\mzOUIti.exe
  C:\Windows\System\mzOUIti.exe
  2⤵
  PID:6108
- C:\Windows\System\lTVCIfm.exe
  C:\Windows\System\lTVCIfm.exe
  2⤵
  PID:6132
- C:\Windows\System\xEwhfcU.exe
  C:\Windows\System\xEwhfcU.exe
  2⤵
  PID:4508
- C:\Windows\System\fwGShFE.exe
  C:\Windows\System\fwGShFE.exe
  2⤵
  PID:4680
- C:\Windows\System\nqomKkg.exe
  C:\Windows\System\nqomKkg.exe
  2⤵
  PID:4772
- C:\Windows\System\LGgzGMl.exe
  C:\Windows\System\LGgzGMl.exe
  2⤵
  PID:4816
- C:\Windows\System\nUDwyQy.exe
  C:\Windows\System\nUDwyQy.exe
  2⤵
  PID:4972
- C:\Windows\System\NRyPTly.exe
  C:\Windows\System\NRyPTly.exe
  2⤵
  PID:5044
- C:\Windows\System\dqxjovr.exe
  C:\Windows\System\dqxjovr.exe
  2⤵
  PID:5116
- C:\Windows\System\phSENQl.exe
  C:\Windows\System\phSENQl.exe
  2⤵
  PID:3292
- C:\Windows\System\PyzBvJa.exe
  C:\Windows\System\PyzBvJa.exe
  2⤵
  PID:4216
- C:\Windows\System\LFeExnw.exe
  C:\Windows\System\LFeExnw.exe
  2⤵
  PID:4620
- C:\Windows\System\gloTLdd.exe
  C:\Windows\System\gloTLdd.exe
  2⤵
  PID:4524
- C:\Windows\System\iKqAHGE.exe
  C:\Windows\System\iKqAHGE.exe
  2⤵
  PID:3600
- C:\Windows\System\zWfaCEM.exe
  C:\Windows\System\zWfaCEM.exe
  2⤵
  PID:4668
- C:\Windows\System\oRqWoqa.exe
  C:\Windows\System\oRqWoqa.exe
  2⤵
  PID:3780
- C:\Windows\System\mavPsuX.exe
  C:\Windows\System\mavPsuX.exe
  2⤵
  PID:4992
- C:\Windows\System\dTncHFz.exe
  C:\Windows\System\dTncHFz.exe
  2⤵
  PID:4448
- C:\Windows\System\yBbowXp.exe
  C:\Windows\System\yBbowXp.exe
  2⤵
  PID:4232
- C:\Windows\System\sxthGxN.exe
  C:\Windows\System\sxthGxN.exe
  2⤵
  PID:4024
- C:\Windows\System\tDVVGlZ.exe
  C:\Windows\System\tDVVGlZ.exe
  2⤵
  PID:4464
- C:\Windows\System\GyXdVhD.exe
  C:\Windows\System\GyXdVhD.exe
  2⤵
  PID:3904
- C:\Windows\System\owuyxOF.exe
  C:\Windows\System\owuyxOF.exe
  2⤵
  PID:5156
- C:\Windows\System\thvKppA.exe
  C:\Windows\System\thvKppA.exe
  2⤵
  PID:5124
- C:\Windows\System\jhzjvUe.exe
  C:\Windows\System\jhzjvUe.exe
  2⤵
  PID:5300
- C:\Windows\System\ccalMLM.exe
  C:\Windows\System\ccalMLM.exe
  2⤵
  PID:5240
- C:\Windows\System\YRvkmjK.exe
  C:\Windows\System\YRvkmjK.exe
  2⤵
  PID:5340
- C:\Windows\System\GdzwbAK.exe
  C:\Windows\System\GdzwbAK.exe
  2⤵
  PID:5284
- C:\Windows\System\JLErwZY.exe
  C:\Windows\System\JLErwZY.exe
  2⤵
  PID:5324
- C:\Windows\System\VWMldmj.exe
  C:\Windows\System\VWMldmj.exe
  2⤵
  PID:5364
- C:\Windows\System\xOEUHXP.exe
  C:\Windows\System\xOEUHXP.exe
  2⤵
  PID:5380
- C:\Windows\System\fyzeybu.exe
  C:\Windows\System\fyzeybu.exe
  2⤵
  PID:5436
- C:\Windows\System\gDDfgWo.exe
  C:\Windows\System\gDDfgWo.exe
  2⤵
  PID:5420
- C:\Windows\System\ShLbxuC.exe
  C:\Windows\System\ShLbxuC.exe
  2⤵
  PID:5520
- C:\Windows\System\QITfibR.exe
  C:\Windows\System\QITfibR.exe
  2⤵
  PID:5456
- C:\Windows\System\TZaolBI.exe
  C:\Windows\System\TZaolBI.exe
  2⤵
  PID:5596
- C:\Windows\System\yqqznvr.exe
  C:\Windows\System\yqqznvr.exe
  2⤵
  PID:5572
- C:\Windows\System\cNbmNmG.exe
  C:\Windows\System\cNbmNmG.exe
  2⤵
  PID:5576
- C:\Windows\System\sLKAJTO.exe
  C:\Windows\System\sLKAJTO.exe
  2⤵
  PID:5632
- C:\Windows\System\ePucHvK.exe
  C:\Windows\System\ePucHvK.exe
  2⤵
  PID:5648
- C:\Windows\System\ujeiIJk.exe
  C:\Windows\System\ujeiIJk.exe
  2⤵
  PID:5688
- C:\Windows\System\KBjRhpD.exe
  C:\Windows\System\KBjRhpD.exe
  2⤵
  PID:5728
- C:\Windows\System\ybeNlLv.exe
  C:\Windows\System\ybeNlLv.exe
  2⤵
  PID:5768
- C:\Windows\System\MbUsmnz.exe
  C:\Windows\System\MbUsmnz.exe
  2⤵
  PID:5744
- C:\Windows\System\zhleidR.exe
  C:\Windows\System\zhleidR.exe
  2⤵
  PID:5712
- C:\Windows\System\fUUpEsG.exe
  C:\Windows\System\fUUpEsG.exe
  2⤵
  PID:5880
- C:\Windows\System\uqUpiHc.exe
  C:\Windows\System\uqUpiHc.exe
  2⤵
  PID:5944
- C:\Windows\System\OJTFYrR.exe
  C:\Windows\System\OJTFYrR.exe
  2⤵
  PID:6012
- C:\Windows\System\PuXGPCq.exe
  C:\Windows\System\PuXGPCq.exe
  2⤵
  PID:6052
- C:\Windows\System\eIuhDKc.exe
  C:\Windows\System\eIuhDKc.exe
  2⤵
  PID:6068
- C:\Windows\System\HwaOBpJ.exe
  C:\Windows\System\HwaOBpJ.exe
  2⤵
  PID:5856
- C:\Windows\System\yefEBVJ.exe
  C:\Windows\System\yefEBVJ.exe
  2⤵
  PID:6100
- C:\Windows\System\lpivksQ.exe
  C:\Windows\System\lpivksQ.exe
  2⤵
  PID:6128
- C:\Windows\System\yWuMiPX.exe
  C:\Windows\System\yWuMiPX.exe
  2⤵
  PID:4812
- C:\Windows\System\uYZINIv.exe
  C:\Windows\System\uYZINIv.exe
  2⤵
  PID:4852
- C:\Windows\System\hVwGdRG.exe
  C:\Windows\System\hVwGdRG.exe
  2⤵
  PID:3388
- C:\Windows\System\sPztyux.exe
  C:\Windows\System\sPztyux.exe
  2⤵
  PID:3996
- C:\Windows\System\fwasfYm.exe
  C:\Windows\System\fwasfYm.exe
  2⤵
  PID:4936
- C:\Windows\System\WnypeiO.exe
  C:\Windows\System\WnypeiO.exe
  2⤵
  PID:3676
- C:\Windows\System\MMpiesA.exe
  C:\Windows\System\MMpiesA.exe
  2⤵
  PID:5080
- C:\Windows\System\gFZzCDf.exe
  C:\Windows\System\gFZzCDf.exe
  2⤵
  PID:5060
- C:\Windows\System\eGSCqld.exe
  C:\Windows\System\eGSCqld.exe
  2⤵
  PID:4888
- C:\Windows\System\Nazzttm.exe
  C:\Windows\System\Nazzttm.exe
  2⤵
  PID:4780
- C:\Windows\System\gCChyhy.exe
  C:\Windows\System\gCChyhy.exe
  2⤵
  PID:4360
- C:\Windows\System\xbTzAWA.exe
  C:\Windows\System\xbTzAWA.exe
  2⤵
  PID:4120
- C:\Windows\System\FTELHhf.exe
  C:\Windows\System\FTELHhf.exe
  2⤵
  PID:5172
- C:\Windows\System\nyxnxIn.exe
  C:\Windows\System\nyxnxIn.exe
  2⤵
  PID:5084
- C:\Windows\System\JgsOvOd.exe
  C:\Windows\System\JgsOvOd.exe
  2⤵
  PID:3972
- C:\Windows\System\HLaQLpX.exe
  C:\Windows\System\HLaQLpX.exe
  2⤵
  PID:5152
- C:\Windows\System\AaBJEjb.exe
  C:\Windows\System\AaBJEjb.exe
  2⤵
  PID:5272
- C:\Windows\System\hBfmvXW.exe
  C:\Windows\System\hBfmvXW.exe
  2⤵
  PID:5148
- C:\Windows\System\CnRWAGR.exe
  C:\Windows\System\CnRWAGR.exe
  2⤵
  PID:4160
- C:\Windows\System\ssFoAdC.exe
  C:\Windows\System\ssFoAdC.exe
  2⤵
  PID:5872
- C:\Windows\System\XRTBKto.exe
  C:\Windows\System\XRTBKto.exe
  2⤵
  PID:5812
- C:\Windows\System\WhDariI.exe
  C:\Windows\System\WhDariI.exe
  2⤵
  PID:5984
- C:\Windows\System\ksQyHlk.exe
  C:\Windows\System\ksQyHlk.exe
  2⤵
  PID:5392
- C:\Windows\System\CmntdFn.exe
  C:\Windows\System\CmntdFn.exe
  2⤵
  PID:5616
- C:\Windows\System\qsDdlmH.exe
  C:\Windows\System\qsDdlmH.exe
  2⤵
  PID:5708
- C:\Windows\System\ekDbsPN.exe
  C:\Windows\System\ekDbsPN.exe
  2⤵
  PID:5748
- C:\Windows\System\sTnpllZ.exe
  C:\Windows\System\sTnpllZ.exe
  2⤵
  PID:5896
- C:\Windows\System\JzTRMCx.exe
  C:\Windows\System\JzTRMCx.exe
  2⤵
  PID:5964
- C:\Windows\System\ZjcgDpw.exe
  C:\Windows\System\ZjcgDpw.exe
  2⤵
  PID:6036
- C:\Windows\System\LlyrKgI.exe
  C:\Windows\System\LlyrKgI.exe
  2⤵
  PID:6096
- C:\Windows\System\MUkCoPp.exe
  C:\Windows\System\MUkCoPp.exe
  2⤵
  PID:5668
- C:\Windows\System\ROOXuGk.exe
  C:\Windows\System\ROOXuGk.exe
  2⤵
  PID:6032
- C:\Windows\System\efqxBzs.exe
  C:\Windows\System\efqxBzs.exe
  2⤵
  PID:5168
- C:\Windows\System\QoIkFie.exe
  C:\Windows\System\QoIkFie.exe
  2⤵
  PID:4372
- C:\Windows\System\vixbfLH.exe
  C:\Windows\System\vixbfLH.exe
  2⤵
  PID:4492
- C:\Windows\System\HwXHEuu.exe
  C:\Windows\System\HwXHEuu.exe
  2⤵
  PID:4920
- C:\Windows\System\AvmHwOW.exe
  C:\Windows\System\AvmHwOW.exe
  2⤵
  PID:4736
- C:\Windows\System\iBNcoHS.exe
  C:\Windows\System\iBNcoHS.exe
  2⤵
  PID:5104
- C:\Windows\System\TEAAqYq.exe
  C:\Windows\System\TEAAqYq.exe
  2⤵
  PID:5360
- C:\Windows\System\wvjmfCv.exe
  C:\Windows\System\wvjmfCv.exe
  2⤵
  PID:5444
- C:\Windows\System\PoEbMok.exe
  C:\Windows\System\PoEbMok.exe
  2⤵
  PID:5916
- C:\Windows\System\tOwADmk.exe
  C:\Windows\System\tOwADmk.exe
  2⤵
  PID:5504
- C:\Windows\System\knOjstz.exe
  C:\Windows\System\knOjstz.exe
  2⤵
  PID:4652
- C:\Windows\System\Iitdqzw.exe
  C:\Windows\System\Iitdqzw.exe
  2⤵
  PID:4868
- C:\Windows\System\UrVPLfh.exe
  C:\Windows\System\UrVPLfh.exe
  2⤵
  PID:5536
- C:\Windows\System\KPeAObh.exe
  C:\Windows\System\KPeAObh.exe
  2⤵
  PID:5176
- C:\Windows\System\USeJcfs.exe
  C:\Windows\System\USeJcfs.exe
  2⤵
  PID:5316
- C:\Windows\System\XlDfaCC.exe
  C:\Windows\System\XlDfaCC.exe
  2⤵
  PID:5224
- C:\Windows\System\wVJzrxr.exe
  C:\Windows\System\wVJzrxr.exe
  2⤵
  PID:5144
- C:\Windows\System\YzzppZY.exe
  C:\Windows\System\YzzppZY.exe
  2⤵
  PID:4580
- C:\Windows\System\dtngUJX.exe
  C:\Windows\System\dtngUJX.exe
  2⤵
  PID:5832
- C:\Windows\System\lpUQhYL.exe
  C:\Windows\System\lpUQhYL.exe
  2⤵
  PID:5472
- C:\Windows\System\TmbnjMh.exe
  C:\Windows\System\TmbnjMh.exe
  2⤵
  PID:5552
- C:\Windows\System\cBQmENo.exe
  C:\Windows\System\cBQmENo.exe
  2⤵
  PID:6092
- C:\Windows\System\GUWNfFw.exe
  C:\Windows\System\GUWNfFw.exe
  2⤵
  PID:5404
- C:\Windows\System\AxdkoVe.exe
  C:\Windows\System\AxdkoVe.exe
  2⤵
  PID:4044
- C:\Windows\System\ckfnICq.exe
  C:\Windows\System\ckfnICq.exe
  2⤵
  PID:5592
- C:\Windows\System\pYyvxEg.exe
  C:\Windows\System\pYyvxEg.exe
  2⤵
  PID:4636
- C:\Windows\System\WUczKdJ.exe
  C:\Windows\System\WUczKdJ.exe
  2⤵
  PID:4760
- C:\Windows\System\vRwXGZx.exe
  C:\Windows\System\vRwXGZx.exe
  2⤵
  PID:5480
- C:\Windows\System\QusgOuj.exe
  C:\Windows\System\QusgOuj.exe
  2⤵
  PID:6000
- C:\Windows\System\utEidZw.exe
  C:\Windows\System\utEidZw.exe
  2⤵
  PID:4376
- C:\Windows\System\eqpDURA.exe
  C:\Windows\System\eqpDURA.exe
  2⤵
  PID:5188
- C:\Windows\System\Wqqjakn.exe
  C:\Windows\System\Wqqjakn.exe
  2⤵
  PID:6140
- C:\Windows\System\QXapHGK.exe
  C:\Windows\System\QXapHGK.exe
  2⤵
  PID:5820
- C:\Windows\System\bCXVbLi.exe
  C:\Windows\System\bCXVbLi.exe
  2⤵
  PID:5368
- C:\Windows\System\BGwGnQQ.exe
  C:\Windows\System\BGwGnQQ.exe
  2⤵
  PID:5752
- C:\Windows\System\sbhGJWg.exe
  C:\Windows\System\sbhGJWg.exe
  2⤵
  PID:5320
- C:\Windows\System\nQHXIkD.exe
  C:\Windows\System\nQHXIkD.exe
  2⤵
  PID:5684
- C:\Windows\System\eqdYovk.exe
  C:\Windows\System\eqdYovk.exe
  2⤵
  PID:3396
- C:\Windows\System\OSvVzhB.exe
  C:\Windows\System\OSvVzhB.exe
  2⤵
  PID:5840
- C:\Windows\System\hIJzWcE.exe
  C:\Windows\System\hIJzWcE.exe
  2⤵
  PID:6160
- C:\Windows\System\lxqSvRT.exe
  C:\Windows\System\lxqSvRT.exe
  2⤵
  PID:6180
- C:\Windows\System\hqhkGuP.exe
  C:\Windows\System\hqhkGuP.exe
  2⤵
  PID:6208
- C:\Windows\System\SNPgGpr.exe
  C:\Windows\System\SNPgGpr.exe
  2⤵
  PID:6224
- C:\Windows\System\bQpFdqN.exe
  C:\Windows\System\bQpFdqN.exe
  2⤵
  PID:6248
- C:\Windows\System\NIbaxVM.exe
  C:\Windows\System\NIbaxVM.exe
  2⤵
  PID:6264
- C:\Windows\System\yHEajOT.exe
  C:\Windows\System\yHEajOT.exe
  2⤵
  PID:6292
- C:\Windows\System\ClGAcpF.exe
  C:\Windows\System\ClGAcpF.exe
  2⤵
  PID:6308
- C:\Windows\System\WgiBsCj.exe
  C:\Windows\System\WgiBsCj.exe
  2⤵
  PID:6328
- C:\Windows\System\bqwOdLO.exe
  C:\Windows\System\bqwOdLO.exe
  2⤵
  PID:6348
- C:\Windows\System\mEpBztA.exe
  C:\Windows\System\mEpBztA.exe
  2⤵
  PID:6376
- C:\Windows\System\MRztUsI.exe
  C:\Windows\System\MRztUsI.exe
  2⤵
  PID:6392
- C:\Windows\System\PTtuimg.exe
  C:\Windows\System\PTtuimg.exe
  2⤵
  PID:6412
- C:\Windows\System\kbNbFiC.exe
  C:\Windows\System\kbNbFiC.exe
  2⤵
  PID:6428
- C:\Windows\System\CXLyuIn.exe
  C:\Windows\System\CXLyuIn.exe
  2⤵
  PID:6452
- C:\Windows\System\wonBeej.exe
  C:\Windows\System\wonBeej.exe
  2⤵
  PID:6472
- C:\Windows\System\GmpgrWf.exe
  C:\Windows\System\GmpgrWf.exe
  2⤵
  PID:6496
- C:\Windows\System\BNJtaKk.exe
  C:\Windows\System\BNJtaKk.exe
  2⤵
  PID:6520
- C:\Windows\System\xLzSpRA.exe
  C:\Windows\System\xLzSpRA.exe
  2⤵
  PID:6536
- C:\Windows\System\hUcxZyy.exe
  C:\Windows\System\hUcxZyy.exe
  2⤵
  PID:6552
- C:\Windows\System\jMMlxNm.exe
  C:\Windows\System\jMMlxNm.exe
  2⤵
  PID:6568
- C:\Windows\System\FtXhlxB.exe
  C:\Windows\System\FtXhlxB.exe
  2⤵
  PID:6588
- C:\Windows\System\mnQhsSz.exe
  C:\Windows\System\mnQhsSz.exe
  2⤵
  PID:6608
- C:\Windows\System\YpBSENb.exe
  C:\Windows\System\YpBSENb.exe
  2⤵
  PID:6624
- C:\Windows\System\PgRonsb.exe
  C:\Windows\System\PgRonsb.exe
  2⤵
  PID:6648
- C:\Windows\System\wDTGOKV.exe
  C:\Windows\System\wDTGOKV.exe
  2⤵
  PID:6664
- C:\Windows\System\cpbUjVu.exe
  C:\Windows\System\cpbUjVu.exe
  2⤵
  PID:6684
- C:\Windows\System\BeDjAfu.exe
  C:\Windows\System\BeDjAfu.exe
  2⤵
  PID:6704
- C:\Windows\System\HkMNonU.exe
  C:\Windows\System\HkMNonU.exe
  2⤵
  PID:6724
- C:\Windows\System\goOnzYC.exe
  C:\Windows\System\goOnzYC.exe
  2⤵
  PID:6740
- C:\Windows\System\ZbubCVX.exe
  C:\Windows\System\ZbubCVX.exe
  2⤵
  PID:6768
- C:\Windows\System\HIWuOgI.exe
  C:\Windows\System\HIWuOgI.exe
  2⤵
  PID:6784
- C:\Windows\System\EhYOKoa.exe
  C:\Windows\System\EhYOKoa.exe
  2⤵
  PID:6804
- C:\Windows\System\fZgWrXt.exe
  C:\Windows\System\fZgWrXt.exe
  2⤵
  PID:6824
- C:\Windows\System\NOcPpwB.exe
  C:\Windows\System\NOcPpwB.exe
  2⤵
  PID:6844
- C:\Windows\System\iYzliUt.exe
  C:\Windows\System\iYzliUt.exe
  2⤵
  PID:6860
- C:\Windows\System\EtDmibW.exe
  C:\Windows\System\EtDmibW.exe
  2⤵
  PID:6884
- C:\Windows\System\mHhFHvD.exe
  C:\Windows\System\mHhFHvD.exe
  2⤵
  PID:6900
- C:\Windows\System\HqJExHR.exe
  C:\Windows\System\HqJExHR.exe
  2⤵
  PID:6924
- C:\Windows\System\JQvctoj.exe
  C:\Windows\System\JQvctoj.exe
  2⤵
  PID:6940
- C:\Windows\System\zDzPciG.exe
  C:\Windows\System\zDzPciG.exe
  2⤵
  PID:6964
- C:\Windows\System\KNqtwlJ.exe
  C:\Windows\System\KNqtwlJ.exe
  2⤵
  PID:6980
- C:\Windows\System\LgVjHXj.exe
  C:\Windows\System\LgVjHXj.exe
  2⤵
  PID:7000
- C:\Windows\System\XmSzxcN.exe
  C:\Windows\System\XmSzxcN.exe
  2⤵
  PID:7016
- C:\Windows\System\YRiLYPo.exe
  C:\Windows\System\YRiLYPo.exe
  2⤵
  PID:7040
- C:\Windows\System\UsLifKu.exe
  C:\Windows\System\UsLifKu.exe
  2⤵
  PID:7056
- C:\Windows\System\PTZTvsR.exe
  C:\Windows\System\PTZTvsR.exe
  2⤵
  PID:7076
- C:\Windows\System\sGCDxOR.exe
  C:\Windows\System\sGCDxOR.exe
  2⤵
  PID:7112
- C:\Windows\System\TRsjymv.exe
  C:\Windows\System\TRsjymv.exe
  2⤵
  PID:7128
- C:\Windows\System\MPROfiT.exe
  C:\Windows\System\MPROfiT.exe
  2⤵
  PID:7148
- C:\Windows\System\zkZTbfT.exe
  C:\Windows\System\zkZTbfT.exe
  2⤵
  PID:7164
- C:\Windows\System\kSHcMIy.exe
  C:\Windows\System\kSHcMIy.exe
  2⤵
  PID:6048
- C:\Windows\System\vxdmeAA.exe
  C:\Windows\System\vxdmeAA.exe
  2⤵
  PID:6152
- C:\Windows\System\BejQXlR.exe
  C:\Windows\System\BejQXlR.exe
  2⤵
  PID:6192
- C:\Windows\System\pKpjJmc.exe
  C:\Windows\System\pKpjJmc.exe
  2⤵
  PID:6200
- C:\Windows\System\ekcQRHS.exe
  C:\Windows\System\ekcQRHS.exe
  2⤵
  PID:6300
- C:\Windows\System\VOQzodz.exe
  C:\Windows\System\VOQzodz.exe
  2⤵
  PID:6236
- C:\Windows\System\srNlXdh.exe
  C:\Windows\System\srNlXdh.exe
  2⤵
  PID:6280
- C:\Windows\System\ZiasTub.exe
  C:\Windows\System\ZiasTub.exe
  2⤵
  PID:6320
- C:\Windows\System\zOrCwAW.exe
  C:\Windows\System\zOrCwAW.exe
  2⤵
  PID:6388
- C:\Windows\System\oUQJhUa.exe
  C:\Windows\System\oUQJhUa.exe
  2⤵
  PID:6356
- C:\Windows\System\mKqIvQz.exe
  C:\Windows\System\mKqIvQz.exe
  2⤵
  PID:6468
- C:\Windows\System\sMIQyFA.exe
  C:\Windows\System\sMIQyFA.exe
  2⤵
  PID:6444
- C:\Windows\System\AYiDuMV.exe
  C:\Windows\System\AYiDuMV.exe
  2⤵
  PID:6492
- C:\Windows\System\AmkWNbW.exe
  C:\Windows\System\AmkWNbW.exe
  2⤵
  PID:6544
- C:\Windows\System\GwtTQLg.exe
  C:\Windows\System\GwtTQLg.exe
  2⤵
  PID:6584
- C:\Windows\System\svrQtZi.exe
  C:\Windows\System\svrQtZi.exe
  2⤵
  PID:6600
- C:\Windows\System\JfsYZnl.exe
  C:\Windows\System\JfsYZnl.exe
  2⤵
  PID:6632
- C:\Windows\System\ZuUIoZd.exe
  C:\Windows\System\ZuUIoZd.exe
  2⤵
  PID:5932
- C:\Windows\System\kbzjMBv.exe
  C:\Windows\System\kbzjMBv.exe
  2⤵
  PID:6700
- C:\Windows\System\wDFkpJw.exe
  C:\Windows\System\wDFkpJw.exe
  2⤵
  PID:6812
- C:\Windows\System\HgxkKkH.exe
  C:\Windows\System\HgxkKkH.exe
  2⤵
  PID:6676
- C:\Windows\System\uLWjsZg.exe
  C:\Windows\System\uLWjsZg.exe
  2⤵
  PID:7012
- C:\Windows\System\kRXwegC.exe
  C:\Windows\System\kRXwegC.exe
  2⤵
  PID:6748
- C:\Windows\System\XkvXPHV.exe
  C:\Windows\System\XkvXPHV.exe
  2⤵
  PID:6908
- C:\Windows\System\QiXxtYg.exe
  C:\Windows\System\QiXxtYg.exe
  2⤵
  PID:7024
- C:\Windows\System\VnyjOnY.exe
  C:\Windows\System\VnyjOnY.exe
  2⤵
  PID:6796
- C:\Windows\System\QVAQZti.exe
  C:\Windows\System\QVAQZti.exe
  2⤵
  PID:6840
- C:\Windows\System\cUxfMYO.exe
  C:\Windows\System\cUxfMYO.exe
  2⤵
  PID:6952
- C:\Windows\System\gRCbQTB.exe
  C:\Windows\System\gRCbQTB.exe
  2⤵
  PID:6996
- C:\Windows\System\ApFCtnb.exe
  C:\Windows\System\ApFCtnb.exe
  2⤵
  PID:7064
- C:\Windows\System\xSferYV.exe
  C:\Windows\System\xSferYV.exe
  2⤵
  PID:7096
- C:\Windows\System\PHMnzqr.exe
  C:\Windows\System\PHMnzqr.exe
  2⤵
  PID:7108
- C:\Windows\System\YvjVoQv.exe
  C:\Windows\System\YvjVoQv.exe
  2⤵
  PID:6124
- C:\Windows\System\wvafpDK.exe
  C:\Windows\System\wvafpDK.exe
  2⤵
  PID:6176
- C:\Windows\System\UbadYTD.exe
  C:\Windows\System\UbadYTD.exe
  2⤵
  PID:6220
- C:\Windows\System\bNwcpxr.exe
  C:\Windows\System\bNwcpxr.exe
  2⤵
  PID:6344
- C:\Windows\System\kfyoRVY.exe
  C:\Windows\System\kfyoRVY.exe
  2⤵
  PID:5724
- C:\Windows\System\SyTuXnf.exe
  C:\Windows\System\SyTuXnf.exe
  2⤵
  PID:6576
- C:\Windows\System\XrnXynb.exe
  C:\Windows\System\XrnXynb.exe
  2⤵
  PID:6244
- C:\Windows\System\PbaSqzl.exe
  C:\Windows\System\PbaSqzl.exe
  2⤵
  PID:6820
- C:\Windows\System\yKnLGky.exe
  C:\Windows\System\yKnLGky.exe
  2⤵
  PID:6892
- C:\Windows\System\bKZVFjB.exe
  C:\Windows\System\bKZVFjB.exe
  2⤵
  PID:6288
- C:\Windows\System\ryzhqpB.exe
  C:\Windows\System\ryzhqpB.exe
  2⤵
  PID:6460
- C:\Windows\System\xxmDsbN.exe
  C:\Windows\System\xxmDsbN.exe
  2⤵
  PID:6712
- C:\Windows\System\DCxWcYx.exe
  C:\Windows\System\DCxWcYx.exe
  2⤵
  PID:6512
- C:\Windows\System\mfQVJTW.exe
  C:\Windows\System\mfQVJTW.exe
  2⤵
  PID:6560
- C:\Windows\System\VJOQuvI.exe
  C:\Windows\System\VJOQuvI.exe
  2⤵
  PID:6960
- C:\Windows\System\MoBjtBP.exe
  C:\Windows\System\MoBjtBP.exe
  2⤵
  PID:7092
- C:\Windows\System\fPKGjgf.exe
  C:\Windows\System\fPKGjgf.exe
  2⤵
  PID:6072
- C:\Windows\System\oqeIcFn.exe
  C:\Windows\System\oqeIcFn.exe
  2⤵
  PID:4864
- C:\Windows\System\PQJFdrf.exe
  C:\Windows\System\PQJFdrf.exe
  2⤵
  PID:6384
- C:\Windows\System\JPKVFxm.exe
  C:\Windows\System\JPKVFxm.exe
  2⤵
  PID:6484
- C:\Windows\System\qHsNARd.exe
  C:\Windows\System\qHsNARd.exe
  2⤵
  PID:6716
- C:\Windows\System\rcGyWsH.exe
  C:\Windows\System\rcGyWsH.exe
  2⤵
  PID:7036
- C:\Windows\System\BPGflzm.exe
  C:\Windows\System\BPGflzm.exe
  2⤵
  PID:7120
- C:\Windows\System\mfbYTsK.exe
  C:\Windows\System\mfbYTsK.exe
  2⤵
  PID:6896
- C:\Windows\System\BXQGdUn.exe
  C:\Windows\System\BXQGdUn.exe
  2⤵
  PID:6232
- C:\Windows\System\yVWZBRM.exe
  C:\Windows\System\yVWZBRM.exe
  2⤵
  PID:6448
- C:\Windows\System\pTogYfl.exe
  C:\Windows\System\pTogYfl.exe
  2⤵
  PID:6440
- C:\Windows\System\YfQoeIS.exe
  C:\Windows\System\YfQoeIS.exe
  2⤵
  PID:6368
- C:\Windows\System\SqOMOKr.exe
  C:\Windows\System\SqOMOKr.exe
  2⤵
  PID:6780
- C:\Windows\System\fDeGYpt.exe
  C:\Windows\System\fDeGYpt.exe
  2⤵
  PID:6948
- C:\Windows\System\YFawqWo.exe
  C:\Windows\System\YFawqWo.exe
  2⤵
  PID:6596
- C:\Windows\System\CtYBeqs.exe
  C:\Windows\System\CtYBeqs.exe
  2⤵
  PID:6360
- C:\Windows\System\IYCephX.exe
  C:\Windows\System\IYCephX.exe
  2⤵
  PID:6172
- C:\Windows\System\qCHkEBg.exe
  C:\Windows\System\qCHkEBg.exe
  2⤵
  PID:6764
- C:\Windows\System\qvSXFXJ.exe
  C:\Windows\System\qvSXFXJ.exe
  2⤵
  PID:6336
- C:\Windows\System\zpAsYXo.exe
  C:\Windows\System\zpAsYXo.exe
  2⤵
  PID:7124
- C:\Windows\System\lajqTqy.exe
  C:\Windows\System\lajqTqy.exe
  2⤵
  PID:7032
- C:\Windows\System\NQCGuTn.exe
  C:\Windows\System\NQCGuTn.exe
  2⤵
  PID:4940
- C:\Windows\System\OqKuXOp.exe
  C:\Windows\System\OqKuXOp.exe
  2⤵
  PID:6880
- C:\Windows\System\ayhhZgT.exe
  C:\Windows\System\ayhhZgT.exe
  2⤵
  PID:6604
- C:\Windows\System\ulUDhaQ.exe
  C:\Windows\System\ulUDhaQ.exe
  2⤵
  PID:6204
- C:\Windows\System\TKrenCe.exe
  C:\Windows\System\TKrenCe.exe
  2⤵
  PID:7068
- C:\Windows\System\SAdLITh.exe
  C:\Windows\System\SAdLITh.exe
  2⤵
  PID:6792
- C:\Windows\System\nStIbIw.exe
  C:\Windows\System\nStIbIw.exe
  2⤵
  PID:6756
- C:\Windows\System\OYpWDTD.exe
  C:\Windows\System\OYpWDTD.exe
  2⤵
  PID:7180
- C:\Windows\System\lwByrGo.exe
  C:\Windows\System\lwByrGo.exe
  2⤵
  PID:7196
- C:\Windows\System\IqSTRRP.exe
  C:\Windows\System\IqSTRRP.exe
  2⤵
  PID:7212
- C:\Windows\System\UpCBlXs.exe
  C:\Windows\System\UpCBlXs.exe
  2⤵
  PID:7232
- C:\Windows\System\GkLIxFn.exe
  C:\Windows\System\GkLIxFn.exe
  2⤵
  PID:7248
- C:\Windows\System\yCjqoXE.exe
  C:\Windows\System\yCjqoXE.exe
  2⤵
  PID:7264
- C:\Windows\System\LmLyQMZ.exe
  C:\Windows\System\LmLyQMZ.exe
  2⤵
  PID:7284
- C:\Windows\System\umGPath.exe
  C:\Windows\System\umGPath.exe
  2⤵
  PID:7300
- C:\Windows\System\rQUSNmM.exe
  C:\Windows\System\rQUSNmM.exe
  2⤵
  PID:7352
- C:\Windows\System\rmrBsOp.exe
  C:\Windows\System\rmrBsOp.exe
  2⤵
  PID:7372
- C:\Windows\System\qbkGXWG.exe
  C:\Windows\System\qbkGXWG.exe
  2⤵
  PID:7388
- C:\Windows\System\gRxXZbd.exe
  C:\Windows\System\gRxXZbd.exe
  2⤵
  PID:7408
- C:\Windows\System\GZOEFJJ.exe
  C:\Windows\System\GZOEFJJ.exe
  2⤵
  PID:7432
- C:\Windows\System\joMRvWL.exe
  C:\Windows\System\joMRvWL.exe
  2⤵
  PID:7456
- C:\Windows\System\BZfLHQh.exe
  C:\Windows\System\BZfLHQh.exe
  2⤵
  PID:7472
- C:\Windows\System\cQuwnka.exe
  C:\Windows\System\cQuwnka.exe
  2⤵
  PID:7488
- C:\Windows\System\DTvjfyN.exe
  C:\Windows\System\DTvjfyN.exe
  2⤵
  PID:7504
- C:\Windows\System\zHAdDiX.exe
  C:\Windows\System\zHAdDiX.exe
  2⤵
  PID:7520
- C:\Windows\System\GhzabjK.exe
  C:\Windows\System\GhzabjK.exe
  2⤵
  PID:7540
- C:\Windows\System\SdtLfGj.exe
  C:\Windows\System\SdtLfGj.exe
  2⤵
  PID:7560
- C:\Windows\System\kSIQrTY.exe
  C:\Windows\System\kSIQrTY.exe
  2⤵
  PID:7580
- C:\Windows\System\dOtvdMQ.exe
  C:\Windows\System\dOtvdMQ.exe
  2⤵
  PID:7600
- C:\Windows\System\zLZXRpZ.exe
  C:\Windows\System\zLZXRpZ.exe
  2⤵
  PID:7616
- C:\Windows\System\lybXyVT.exe
  C:\Windows\System\lybXyVT.exe
  2⤵
  PID:7632
- C:\Windows\System\zSDMYRI.exe
  C:\Windows\System\zSDMYRI.exe
  2⤵
  PID:7648
- C:\Windows\System\AeogfPr.exe
  C:\Windows\System\AeogfPr.exe
  2⤵
  PID:7664
- C:\Windows\System\fZykikN.exe
  C:\Windows\System\fZykikN.exe
  2⤵
  PID:7680
- C:\Windows\System\yXlXSMW.exe
  C:\Windows\System\yXlXSMW.exe
  2⤵
  PID:7696
- C:\Windows\System\oMugCOT.exe
  C:\Windows\System\oMugCOT.exe
  2⤵
  PID:7716
- C:\Windows\System\iALPACN.exe
  C:\Windows\System\iALPACN.exe
  2⤵
  PID:7736
- C:\Windows\System\KJEKQBW.exe
  C:\Windows\System\KJEKQBW.exe
  2⤵
  PID:7756
- C:\Windows\System\juBztXH.exe
  C:\Windows\System\juBztXH.exe
  2⤵
  PID:7772
- C:\Windows\System\iAUZjCx.exe
  C:\Windows\System\iAUZjCx.exe
  2⤵
  PID:7792
- C:\Windows\System\VwPVDQT.exe
  C:\Windows\System\VwPVDQT.exe
  2⤵
  PID:7808
- C:\Windows\System\gpOTJNm.exe
  C:\Windows\System\gpOTJNm.exe
  2⤵
  PID:7828
- C:\Windows\System\HirymFR.exe
  C:\Windows\System\HirymFR.exe
  2⤵
  PID:7852
- C:\Windows\System\xuJgZOV.exe
  C:\Windows\System\xuJgZOV.exe
  2⤵
  PID:7924
- C:\Windows\System\foCtDbn.exe
  C:\Windows\System\foCtDbn.exe
  2⤵
  PID:7940
- C:\Windows\System\MamfVdG.exe
  C:\Windows\System\MamfVdG.exe
  2⤵
  PID:7956
- C:\Windows\System\wolOojo.exe
  C:\Windows\System\wolOojo.exe
  2⤵
  PID:7976
- C:\Windows\System\ijZMtAh.exe
  C:\Windows\System\ijZMtAh.exe
  2⤵
  PID:7992
- C:\Windows\System\usDasjp.exe
  C:\Windows\System\usDasjp.exe
  2⤵
  PID:8016
- C:\Windows\System\iMUpaVN.exe
  C:\Windows\System\iMUpaVN.exe
  2⤵
  PID:8040
- C:\Windows\System\piGXUkf.exe
  C:\Windows\System\piGXUkf.exe
  2⤵
  PID:8060
- C:\Windows\System\CqUGlpe.exe
  C:\Windows\System\CqUGlpe.exe
  2⤵
  PID:8076
- C:\Windows\System\AftBXGO.exe
  C:\Windows\System\AftBXGO.exe
  2⤵
  PID:8092
- C:\Windows\System\VbRgPvw.exe
  C:\Windows\System\VbRgPvw.exe
  2⤵
  PID:8108
- C:\Windows\System\DbCpMpR.exe
  C:\Windows\System\DbCpMpR.exe
  2⤵
  PID:8128
- C:\Windows\System\zPOPzZl.exe
  C:\Windows\System\zPOPzZl.exe
  2⤵
  PID:8144
- C:\Windows\System\hZCYpUM.exe
  C:\Windows\System\hZCYpUM.exe
  2⤵
  PID:8160
- C:\Windows\System\jyRzsHe.exe
  C:\Windows\System\jyRzsHe.exe
  2⤵
  PID:8176
- C:\Windows\System\vfjFaEA.exe
  C:\Windows\System\vfjFaEA.exe
  2⤵
  PID:6148
- C:\Windows\System\pESoGKJ.exe
  C:\Windows\System\pESoGKJ.exe
  2⤵
  PID:6912
- C:\Windows\System\RgWPgqk.exe
  C:\Windows\System\RgWPgqk.exe
  2⤵
  PID:7280
- C:\Windows\System\remosdn.exe
  C:\Windows\System\remosdn.exe
  2⤵
  PID:7316
- C:\Windows\System\eXfxDmU.exe
  C:\Windows\System\eXfxDmU.exe
  2⤵
  PID:7332
- C:\Windows\System\oKnniPB.exe
  C:\Windows\System\oKnniPB.exe
  2⤵
  PID:6776
- C:\Windows\System\nWlSMpf.exe
  C:\Windows\System\nWlSMpf.exe
  2⤵
  PID:7292
- C:\Windows\System\qkaryQO.exe
  C:\Windows\System\qkaryQO.exe
  2⤵
  PID:7188
- C:\Windows\System\aEWQRRy.exe
  C:\Windows\System\aEWQRRy.exe
  2⤵
  PID:7428
- C:\Windows\System\THkDGEr.exe
  C:\Windows\System\THkDGEr.exe
  2⤵
  PID:7468
- C:\Windows\System\uJbJHHV.exe
  C:\Windows\System\uJbJHHV.exe
  2⤵
  PID:7536
- C:\Windows\System\tENZqhm.exe
  C:\Windows\System\tENZqhm.exe
  2⤵
  PID:7608
- C:\Windows\System\oqBYgBI.exe
  C:\Windows\System\oqBYgBI.exe
  2⤵
  PID:7368
- C:\Windows\System\rpQnlRw.exe
  C:\Windows\System\rpQnlRw.exe
  2⤵
  PID:7640
- C:\Windows\System\LElWtjf.exe
  C:\Windows\System\LElWtjf.exe
  2⤵
  PID:7712
- C:\Windows\System\gjmkxVi.exe
  C:\Windows\System\gjmkxVi.exe
  2⤵
  PID:7440
- C:\Windows\System\aomlbZN.exe
  C:\Windows\System\aomlbZN.exe
  2⤵
  PID:7784
- C:\Windows\System\FhooTJe.exe
  C:\Windows\System\FhooTJe.exe
  2⤵
  PID:7396
- C:\Windows\System\TejGSFp.exe
  C:\Windows\System\TejGSFp.exe
  2⤵
  PID:7628
- C:\Windows\System\CqIoeCN.exe
  C:\Windows\System\CqIoeCN.exe
  2⤵
  PID:7556
- C:\Windows\System\roZOWKz.exe
  C:\Windows\System\roZOWKz.exe
  2⤵
  PID:7480
- C:\Windows\System\jBcHCfA.exe
  C:\Windows\System\jBcHCfA.exe
  2⤵
  PID:7836
- C:\Windows\System\zHEfPzb.exe
  C:\Windows\System\zHEfPzb.exe
  2⤵
  PID:7840
- C:\Windows\System\KgfEYJP.exe
  C:\Windows\System\KgfEYJP.exe
  2⤵
  PID:7872
- C:\Windows\System\NrIQRPP.exe
  C:\Windows\System\NrIQRPP.exe
  2⤵
  PID:7888
- C:\Windows\System\lYgQsuO.exe
  C:\Windows\System\lYgQsuO.exe
  2⤵
  PID:7908
- C:\Windows\System\RfCGGth.exe
  C:\Windows\System\RfCGGth.exe
  2⤵
  PID:7936
- C:\Windows\System\kKLUHxi.exe
  C:\Windows\System\kKLUHxi.exe
  2⤵
  PID:7952
- C:\Windows\System\JMKOxiT.exe
  C:\Windows\System\JMKOxiT.exe
  2⤵
  PID:8056
- C:\Windows\System\mmMVLxP.exe
  C:\Windows\System\mmMVLxP.exe
  2⤵
  PID:8136
- C:\Windows\System\LIWEgOk.exe
  C:\Windows\System\LIWEgOk.exe
  2⤵
  PID:8084
- C:\Windows\System\ykdTobp.exe
  C:\Windows\System\ykdTobp.exe
  2⤵
  PID:8088
- C:\Windows\System\LHbQEWr.exe
  C:\Windows\System\LHbQEWr.exe
  2⤵
  PID:6856
- C:\Windows\System\XpIoyXW.exe
  C:\Windows\System\XpIoyXW.exe
  2⤵
  PID:7208
- C:\Windows\System\GfAmwER.exe
  C:\Windows\System\GfAmwER.exe
  2⤵
  PID:7172
- C:\Windows\System\mIRHjyh.exe
  C:\Windows\System\mIRHjyh.exe
  2⤵
  PID:7312
- C:\Windows\System\NawiLfo.exe
  C:\Windows\System\NawiLfo.exe
  2⤵
  PID:7416
- C:\Windows\System\eadqlPC.exe
  C:\Windows\System\eadqlPC.exe
  2⤵
  PID:7464
- C:\Windows\System\yxbCaxE.exe
  C:\Windows\System\yxbCaxE.exe
  2⤵
  PID:7612
- C:\Windows\System\tPXttGg.exe
  C:\Windows\System\tPXttGg.exe
  2⤵
  PID:7732
- C:\Windows\System\QvChxhi.exe
  C:\Windows\System\QvChxhi.exe
  2⤵
  PID:7220
- C:\Windows\System\vSXVzpN.exe
  C:\Windows\System\vSXVzpN.exe
  2⤵
  PID:7596
- C:\Windows\System\cAdwIsr.exe
  C:\Windows\System\cAdwIsr.exe
  2⤵
  PID:7688
- C:\Windows\System\JJOMvpu.exe
  C:\Windows\System\JJOMvpu.exe
  2⤵
  PID:7800
- C:\Windows\System\XWWcKMa.exe
  C:\Windows\System\XWWcKMa.exe
  2⤵
  PID:7848
- C:\Windows\System\RAUVwTo.exe
  C:\Windows\System\RAUVwTo.exe
  2⤵
  PID:7904
- C:\Windows\System\CkEJtBQ.exe
  C:\Windows\System\CkEJtBQ.exe
  2⤵
  PID:7788
- C:\Windows\System\QTqWnbG.exe
  C:\Windows\System\QTqWnbG.exe
  2⤵
  PID:8072
- C:\Windows\System\WOxXJId.exe
  C:\Windows\System\WOxXJId.exe
  2⤵
  PID:8168
- C:\Windows\System\UsJaZsJ.exe
  C:\Windows\System\UsJaZsJ.exe
  2⤵
  PID:8000
- C:\Windows\System\qfCIYoV.exe
  C:\Windows\System\qfCIYoV.exe
  2⤵
  PID:7884
- C:\Windows\System\IxzUZvg.exe
  C:\Windows\System\IxzUZvg.exe
  2⤵
  PID:8124
- C:\Windows\System\WcfnWXi.exe
  C:\Windows\System\WcfnWXi.exe
  2⤵
  PID:6504
- C:\Windows\System\lUIWzXY.exe
  C:\Windows\System\lUIWzXY.exe
  2⤵
  PID:7364
- C:\Windows\System\WPbmJOz.exe
  C:\Windows\System\WPbmJOz.exe
  2⤵
  PID:7424
- C:\Windows\System\ZdBXWls.exe
  C:\Windows\System\ZdBXWls.exe
  2⤵
  PID:7676
- C:\Windows\System\nPlwHof.exe
  C:\Windows\System\nPlwHof.exe
  2⤵
  PID:7224
- C:\Windows\System\MVrOEAa.exe
  C:\Windows\System\MVrOEAa.exe
  2⤵
  PID:7656
- C:\Windows\System\eqeqieX.exe
  C:\Windows\System\eqeqieX.exe
  2⤵
  PID:7244
- C:\Windows\System\oFgOjic.exe
  C:\Windows\System\oFgOjic.exe
  2⤵
  PID:7860
- C:\Windows\System\LubSJDY.exe
  C:\Windows\System\LubSJDY.exe
  2⤵
  PID:7972
- C:\Windows\System\gYnsLLl.exe
  C:\Windows\System\gYnsLLl.exe
  2⤵
  PID:8004
- C:\Windows\System\taFPKlM.exe
  C:\Windows\System\taFPKlM.exe
  2⤵
  PID:7932
- C:\Windows\System\TeHqaKp.exe
  C:\Windows\System\TeHqaKp.exe
  2⤵
  PID:7880
- C:\Windows\System\hyYYBZj.exe
  C:\Windows\System\hyYYBZj.exe
  2⤵
  PID:6640
- C:\Windows\System\YYWuvNs.exe
  C:\Windows\System\YYWuvNs.exe
  2⤵
  PID:7308
- C:\Windows\System\kfBsNOO.exe
  C:\Windows\System\kfBsNOO.exe
  2⤵
  PID:7420
- C:\Windows\System\XBbvOFR.exe
  C:\Windows\System\XBbvOFR.exe
  2⤵
  PID:7548
- C:\Windows\System\mhkKiay.exe
  C:\Windows\System\mhkKiay.exe
  2⤵
  PID:7448
- C:\Windows\System\XGbqUbn.exe
  C:\Windows\System\XGbqUbn.exe
  2⤵
  PID:7532
- C:\Windows\System\CLMnZmB.exe
  C:\Windows\System\CLMnZmB.exe
  2⤵
  PID:8200
- C:\Windows\System\baMgOLn.exe
  C:\Windows\System\baMgOLn.exe
  2⤵
  PID:8220
- C:\Windows\System\ujeuitf.exe
  C:\Windows\System\ujeuitf.exe
  2⤵
  PID:8240
- C:\Windows\System\tNywycn.exe
  C:\Windows\System\tNywycn.exe
  2⤵
  PID:8256
- C:\Windows\System\ExMPkHb.exe
  C:\Windows\System\ExMPkHb.exe
  2⤵
  PID:8308
- C:\Windows\System\vxFoCWF.exe
  C:\Windows\System\vxFoCWF.exe
  2⤵
  PID:8328
- C:\Windows\System\LKbZxWV.exe
  C:\Windows\System\LKbZxWV.exe
  2⤵
  PID:8348
- C:\Windows\System\IHxvNSk.exe
  C:\Windows\System\IHxvNSk.exe
  2⤵
  PID:8364
- C:\Windows\System\TUwaLFf.exe
  C:\Windows\System\TUwaLFf.exe
  2⤵
  PID:8384
- C:\Windows\System\VvldtCK.exe
  C:\Windows\System\VvldtCK.exe
  2⤵
  PID:8400
- C:\Windows\System\BUPXzep.exe
  C:\Windows\System\BUPXzep.exe
  2⤵
  PID:8428
- C:\Windows\System\esssWey.exe
  C:\Windows\System\esssWey.exe
  2⤵
  PID:8448
- C:\Windows\System\kMgQaJd.exe
  C:\Windows\System\kMgQaJd.exe
  2⤵
  PID:8468
- C:\Windows\System\YceDKjo.exe
  C:\Windows\System\YceDKjo.exe
  2⤵
  PID:8492
- C:\Windows\System\RCuFvJN.exe
  C:\Windows\System\RCuFvJN.exe
  2⤵
  PID:8508
- C:\Windows\System\imFlBvm.exe
  C:\Windows\System\imFlBvm.exe
  2⤵
  PID:8524
- C:\Windows\System\YoDpadl.exe
  C:\Windows\System\YoDpadl.exe
  2⤵
  PID:8540
- C:\Windows\System\zAtWYtV.exe
  C:\Windows\System\zAtWYtV.exe
  2⤵
  PID:8560
- C:\Windows\System\pSAULmo.exe
  C:\Windows\System\pSAULmo.exe
  2⤵
  PID:8576
- C:\Windows\System\mKEwolA.exe
  C:\Windows\System\mKEwolA.exe
  2⤵
  PID:8592
- C:\Windows\System\auptLjJ.exe
  C:\Windows\System\auptLjJ.exe
  2⤵
  PID:8612
- C:\Windows\System\oYbPgSe.exe
  C:\Windows\System\oYbPgSe.exe
  2⤵
  PID:8628
- C:\Windows\System\kawbOJE.exe
  C:\Windows\System\kawbOJE.exe
  2⤵
  PID:8644
- C:\Windows\System\VGZpWuh.exe
  C:\Windows\System\VGZpWuh.exe
  2⤵
  PID:8660
- C:\Windows\System\mJKfpwu.exe
  C:\Windows\System\mJKfpwu.exe
  2⤵
  PID:8676
- C:\Windows\System\riuYLwf.exe
  C:\Windows\System\riuYLwf.exe
  2⤵
  PID:8692
- C:\Windows\System\MbuMbwB.exe
  C:\Windows\System\MbuMbwB.exe
  2⤵
  PID:8712
- C:\Windows\System\qePwRIl.exe
  C:\Windows\System\qePwRIl.exe
  2⤵
  PID:8736
- C:\Windows\System\DhXWMzg.exe
  C:\Windows\System\DhXWMzg.exe
  2⤵
  PID:8764
- C:\Windows\System\wiiZEKD.exe
  C:\Windows\System\wiiZEKD.exe
  2⤵
  PID:8784
- C:\Windows\System\eRYpDRi.exe
  C:\Windows\System\eRYpDRi.exe
  2⤵
  PID:8800
- C:\Windows\System\ArgOXtf.exe
  C:\Windows\System\ArgOXtf.exe
  2⤵
  PID:8824
- C:\Windows\System\XIBohvW.exe
  C:\Windows\System\XIBohvW.exe
  2⤵
  PID:8840
- C:\Windows\System\VgnqQmA.exe
  C:\Windows\System\VgnqQmA.exe
  2⤵
  PID:8856
- C:\Windows\System\aFzSZVN.exe
  C:\Windows\System\aFzSZVN.exe
  2⤵
  PID:8912
- C:\Windows\System\MrLtrtL.exe
  C:\Windows\System\MrLtrtL.exe
  2⤵
  PID:8932
- C:\Windows\System\GtMuaWE.exe
  C:\Windows\System\GtMuaWE.exe
  2⤵
  PID:8948
- C:\Windows\System\sOpFHfR.exe
  C:\Windows\System\sOpFHfR.exe
  2⤵
  PID:8972
- C:\Windows\System\oCNUOKS.exe
  C:\Windows\System\oCNUOKS.exe
  2⤵
  PID:8992
- C:\Windows\System\UsFozEg.exe
  C:\Windows\System\UsFozEg.exe
  2⤵
  PID:9008
- C:\Windows\System\drIdXXa.exe
  C:\Windows\System\drIdXXa.exe
  2⤵
  PID:9028
- C:\Windows\System\HxndMWa.exe
  C:\Windows\System\HxndMWa.exe
  2⤵
  PID:9044
- C:\Windows\System\ITgexyM.exe
  C:\Windows\System\ITgexyM.exe
  2⤵
  PID:9068
- C:\Windows\System\BFFsSXl.exe
  C:\Windows\System\BFFsSXl.exe
  2⤵
  PID:9084
- C:\Windows\System\YkDhCMe.exe
  C:\Windows\System\YkDhCMe.exe
  2⤵
  PID:9108
- C:\Windows\System\FVpjQsw.exe
  C:\Windows\System\FVpjQsw.exe
  2⤵
  PID:9124
- C:\Windows\System\tecAosN.exe
  C:\Windows\System\tecAosN.exe
  2⤵
  PID:9144
- C:\Windows\System\BbjemUy.exe
  C:\Windows\System\BbjemUy.exe
  2⤵
  PID:9164
- C:\Windows\System\ACpXibG.exe
  C:\Windows\System\ACpXibG.exe
  2⤵
  PID:9180
- C:\Windows\System\dlQpKKo.exe
  C:\Windows\System\dlQpKKo.exe
  2⤵
  PID:6656
- C:\Windows\System\ZEBLPel.exe
  C:\Windows\System\ZEBLPel.exe
  2⤵
  PID:8184
- C:\Windows\System\fmgSXfu.exe
  C:\Windows\System\fmgSXfu.exe
  2⤵
  PID:8172
- C:\Windows\System\zCvesmH.exe
  C:\Windows\System\zCvesmH.exe
  2⤵
  PID:8188
- C:\Windows\System\YLWKRFE.exe
  C:\Windows\System\YLWKRFE.exe
  2⤵
  PID:7328
- C:\Windows\System\lYnsbGg.exe
  C:\Windows\System\lYnsbGg.exe
  2⤵
  PID:7988
- C:\Windows\System\FnpzIEr.exe
  C:\Windows\System\FnpzIEr.exe
  2⤵
  PID:8036
- C:\Windows\System\uSmanbQ.exe
  C:\Windows\System\uSmanbQ.exe
  2⤵
  PID:8284
- C:\Windows\System\ZGPlcOY.exe
  C:\Windows\System\ZGPlcOY.exe
  2⤵
  PID:8292
- C:\Windows\System\qGJsUNE.exe
  C:\Windows\System\qGJsUNE.exe
  2⤵
  PID:8296
- C:\Windows\System\pbQIHRv.exe
  C:\Windows\System\pbQIHRv.exe
  2⤵
  PID:8320
- C:\Windows\System\egNAAdn.exe
  C:\Windows\System\egNAAdn.exe
  2⤵
  PID:8344
- C:\Windows\System\TlMUhZE.exe
  C:\Windows\System\TlMUhZE.exe
  2⤵
  PID:8372
- C:\Windows\System\VyvvIcA.exe
  C:\Windows\System\VyvvIcA.exe
  2⤵
  PID:8416
- C:\Windows\System\VUsAfKD.exe
  C:\Windows\System\VUsAfKD.exe
  2⤵
  PID:8440
- C:\Windows\System\XntfuPD.exe
  C:\Windows\System\XntfuPD.exe
  2⤵
  PID:8464
- C:\Windows\System\pGVGszl.exe
  C:\Windows\System\pGVGszl.exe
  2⤵
  PID:8516
- C:\Windows\System\SbABVIr.exe
  C:\Windows\System\SbABVIr.exe
  2⤵
  PID:8548
- C:\Windows\System\hFMVmAs.exe
  C:\Windows\System\hFMVmAs.exe
  2⤵
  PID:8536
- C:\Windows\System\CjhavOP.exe
  C:\Windows\System\CjhavOP.exe
  2⤵
  PID:8776
- C:\Windows\System\KbKefyP.exe
  C:\Windows\System\KbKefyP.exe
  2⤵
  PID:8748
- C:\Windows\System\fZohtBr.exe
  C:\Windows\System\fZohtBr.exe
  2⤵
  PID:8848
- C:\Windows\System\giWxium.exe
  C:\Windows\System\giWxium.exe
  2⤵
  PID:8852
- C:\Windows\System\JHlyVQb.exe
  C:\Windows\System\JHlyVQb.exe
  2⤵
  PID:8744
- C:\Windows\System\QSumxsm.exe
  C:\Windows\System\QSumxsm.exe
  2⤵
  PID:8568
- C:\Windows\System\HGofUNX.exe
  C:\Windows\System\HGofUNX.exe
  2⤵
  PID:8836
- C:\Windows\System\UrfYMYO.exe
  C:\Windows\System\UrfYMYO.exe
  2⤵
  PID:8872
- C:\Windows\System\QvBUbdL.exe
  C:\Windows\System\QvBUbdL.exe
  2⤵
  PID:8892
- C:\Windows\System\mjwJTwt.exe
  C:\Windows\System\mjwJTwt.exe
  2⤵
  PID:7916
- C:\Windows\System\laiYHgM.exe
  C:\Windows\System\laiYHgM.exe
  2⤵
  PID:8956
- C:\Windows\System\FOeqyKP.exe
  C:\Windows\System\FOeqyKP.exe
  2⤵
  PID:8988
- C:\Windows\System\qUhLpVk.exe
  C:\Windows\System\qUhLpVk.exe
  2⤵
  PID:9024
- C:\Windows\System\KbGQPzD.exe
  C:\Windows\System\KbGQPzD.exe
  2⤵
  PID:9080
- C:\Windows\System\ReZaqoY.exe
  C:\Windows\System\ReZaqoY.exe
  2⤵
  PID:9120
- C:\Windows\System\sIPPKdD.exe
  C:\Windows\System\sIPPKdD.exe
  2⤵
  PID:9100
- C:\Windows\System\PPkCtbA.exe
  C:\Windows\System\PPkCtbA.exe
  2⤵
  PID:9188
- C:\Windows\System\jTEIjGF.exe
  C:\Windows\System\jTEIjGF.exe
  2⤵
  PID:9200
- C:\Windows\System\JIgAfUi.exe
  C:\Windows\System\JIgAfUi.exe
  2⤵
  PID:8100
- C:\Windows\System\fULnmTh.exe
  C:\Windows\System\fULnmTh.exe
  2⤵
  PID:7512
- C:\Windows\System\SYNOpKl.exe
  C:\Windows\System\SYNOpKl.exe
  2⤵
  PID:7400
- C:\Windows\System\pqeNnTL.exe
  C:\Windows\System\pqeNnTL.exe
  2⤵
  PID:8268
- C:\Windows\System\JUZVIaG.exe
  C:\Windows\System\JUZVIaG.exe
  2⤵
  PID:8252
- C:\Windows\System\kapdzal.exe
  C:\Windows\System\kapdzal.exe
  2⤵
  PID:8380
- C:\Windows\System\XsYJpuW.exe
  C:\Windows\System\XsYJpuW.exe
  2⤵
  PID:8968
- C:\Windows\System\ydDxdBs.exe
  C:\Windows\System\ydDxdBs.exe
  2⤵
  PID:8620
- C:\Windows\System\dvLkHZo.exe
  C:\Windows\System\dvLkHZo.exe
  2⤵
  PID:7804
- C:\Windows\System\OxUMzCC.exe
  C:\Windows\System\OxUMzCC.exe
  2⤵
  PID:8476
- C:\Windows\System\cOFjAXk.exe
  C:\Windows\System\cOFjAXk.exe
  2⤵
  PID:8684
- C:\Windows\System\DYJHLjE.exe
  C:\Windows\System\DYJHLjE.exe
  2⤵
  PID:8808
- C:\Windows\System\gDgUKre.exe
  C:\Windows\System\gDgUKre.exe
  2⤵
  PID:8752
- C:\Windows\System\zPFyLiS.exe
  C:\Windows\System\zPFyLiS.exe
  2⤵
  PID:8672
- C:\Windows\System\wDErejY.exe
  C:\Windows\System\wDErejY.exe
  2⤵
  PID:8900
- C:\Windows\System\iJcMKtC.exe
  C:\Windows\System\iJcMKtC.exe
  2⤵
  PID:8984
- C:\Windows\System\wQcYqFG.exe
  C:\Windows\System\wQcYqFG.exe
  2⤵
  PID:9056
- C:\Windows\System\GiKpHzw.exe
  C:\Windows\System\GiKpHzw.exe
  2⤵
  PID:9004
- C:\Windows\System\muTNsHp.exe
  C:\Windows\System\muTNsHp.exe
  2⤵
  PID:9116
- C:\Windows\System\rRAwerC.exe
  C:\Windows\System\rRAwerC.exe
  2⤵
  PID:8928
- C:\Windows\System\mxHTnTF.exe
  C:\Windows\System\mxHTnTF.exe
  2⤵
  PID:9160
- C:\Windows\System\YxjGeQp.exe
  C:\Windows\System\YxjGeQp.exe
  2⤵
  PID:9208
- C:\Windows\System\aJVEvsq.exe
  C:\Windows\System\aJVEvsq.exe
  2⤵
  PID:8236
- C:\Windows\System\YKbjcwX.exe
  C:\Windows\System\YKbjcwX.exe
  2⤵
  PID:8304
- C:\Windows\System\JgAFmqM.exe
  C:\Windows\System\JgAFmqM.exe
  2⤵
  PID:8392
- C:\Windows\System\IjGPPle.exe
  C:\Windows\System\IjGPPle.exe
  2⤵
  PID:8488
- C:\Windows\System\PXGvTJp.exe
  C:\Windows\System\PXGvTJp.exe
  2⤵
  PID:8196
- C:\Windows\System\rnKohYR.exe
  C:\Windows\System\rnKohYR.exe
  2⤵
  PID:868
- C:\Windows\System\zvSIdYe.exe
  C:\Windows\System\zvSIdYe.exe
  2⤵
  PID:8724
- C:\Windows\System\BvhZWTH.exe
  C:\Windows\System\BvhZWTH.exe
  2⤵
  PID:8820
- C:\Windows\System\oAFxnUd.exe
  C:\Windows\System\oAFxnUd.exe
  2⤵
  PID:8964
- C:\Windows\System\bHaglix.exe
  C:\Windows\System\bHaglix.exe
  2⤵
  PID:8980
- C:\Windows\System\QdZlAzQ.exe
  C:\Windows\System\QdZlAzQ.exe
  2⤵
  PID:9076
- C:\Windows\System\JnrgbQZ.exe
  C:\Windows\System\JnrgbQZ.exe
  2⤵
  PID:9092
- C:\Windows\System\hdSVjWc.exe
  C:\Windows\System\hdSVjWc.exe
  2⤵
  PID:9196
- C:\Windows\System\UYrUlLI.exe
  C:\Windows\System\UYrUlLI.exe
  2⤵
  PID:8104
- C:\Windows\System\jHuzGAI.exe
  C:\Windows\System\jHuzGAI.exe
  2⤵
  PID:8216
- C:\Windows\System\bQxCfSj.exe
  C:\Windows\System\bQxCfSj.exe
  2⤵
  PID:8360
- C:\Windows\System\oieygbS.exe
  C:\Windows\System\oieygbS.exe
  2⤵
  PID:8356
- C:\Windows\System\bvdXRjX.exe
  C:\Windows\System\bvdXRjX.exe
  2⤵
  PID:8760
- C:\Windows\System\RlJYJWq.exe
  C:\Windows\System\RlJYJWq.exe
  2⤵
  PID:8412
- C:\Windows\System\rDOjExG.exe
  C:\Windows\System\rDOjExG.exe
  2⤵
  PID:8600
- C:\Windows\System\GnZPKFJ.exe
  C:\Windows\System\GnZPKFJ.exe
  2⤵
  PID:9052
- C:\Windows\System\eipHzZU.exe
  C:\Windows\System\eipHzZU.exe
  2⤵
  PID:9132
- C:\Windows\System\SsRHFmm.exe
  C:\Windows\System\SsRHFmm.exe
  2⤵
  PID:8264
- C:\Windows\System\nNPuyqR.exe
  C:\Windows\System\nNPuyqR.exe
  2⤵
  PID:8532
- C:\Windows\System\MlfgjYG.exe
  C:\Windows\System\MlfgjYG.exe
  2⤵
  PID:8888
- C:\Windows\System\HFfaKRr.exe
  C:\Windows\System\HFfaKRr.exe
  2⤵
  PID:8652
- C:\Windows\System\VnQKlEm.exe
  C:\Windows\System\VnQKlEm.exe
  2⤵
  PID:9176
- C:\Windows\System\wvDUNBz.exe
  C:\Windows\System\wvDUNBz.exe
  2⤵
  PID:8588
- C:\Windows\System\QpxqyAo.exe
  C:\Windows\System\QpxqyAo.exe
  2⤵
  PID:8048
- C:\Windows\System\hYKLALv.exe
  C:\Windows\System\hYKLALv.exe
  2⤵
  PID:8584
- C:\Windows\System\UISOLkD.exe
  C:\Windows\System\UISOLkD.exe
  2⤵
  PID:9136
- C:\Windows\System\fIFsmrD.exe
  C:\Windows\System\fIFsmrD.exe
  2⤵
  PID:8444
- C:\Windows\System\onOSOwQ.exe
  C:\Windows\System\onOSOwQ.exe
  2⤵
  PID:9220
- C:\Windows\System\svjlyLF.exe
  C:\Windows\System\svjlyLF.exe
  2⤵
  PID:9248
- C:\Windows\System\KCNcCxI.exe
  C:\Windows\System\KCNcCxI.exe
  2⤵
  PID:9264
- C:\Windows\System\EWwFMhe.exe
  C:\Windows\System\EWwFMhe.exe
  2⤵
  PID:9284
- C:\Windows\System\mvVuHJE.exe
  C:\Windows\System\mvVuHJE.exe
  2⤵
  PID:9312
- C:\Windows\System\zJtHjey.exe
  C:\Windows\System\zJtHjey.exe
  2⤵
  PID:9328
- C:\Windows\System\EcyHHFG.exe
  C:\Windows\System\EcyHHFG.exe
  2⤵
  PID:9344
- C:\Windows\System\QQpwVCy.exe
  C:\Windows\System\QQpwVCy.exe
  2⤵
  PID:9376
- C:\Windows\System\cVJGFjd.exe
  C:\Windows\System\cVJGFjd.exe
  2⤵
  PID:9392
- C:\Windows\System\iDeTXlO.exe
  C:\Windows\System\iDeTXlO.exe
  2⤵
  PID:9408
- C:\Windows\System\fEsSQRx.exe
  C:\Windows\System\fEsSQRx.exe
  2⤵
  PID:9424
- C:\Windows\System\tWinzbj.exe
  C:\Windows\System\tWinzbj.exe
  2⤵
  PID:9440
- C:\Windows\System\nzOddSE.exe
  C:\Windows\System\nzOddSE.exe
  2⤵
  PID:9460
- C:\Windows\System\FORyuKn.exe
  C:\Windows\System\FORyuKn.exe
  2⤵
  PID:9500
- C:\Windows\System\WJplqDp.exe
  C:\Windows\System\WJplqDp.exe
  2⤵
  PID:9520
- C:\Windows\System\rathciN.exe
  C:\Windows\System\rathciN.exe
  2⤵
  PID:9540
- C:\Windows\System\foNyBMr.exe
  C:\Windows\System\foNyBMr.exe
  2⤵
  PID:9556
- C:\Windows\System\XFuXlTE.exe
  C:\Windows\System\XFuXlTE.exe
  2⤵
  PID:9572
- C:\Windows\System\WlFzneb.exe
  C:\Windows\System\WlFzneb.exe
  2⤵
  PID:9600
- C:\Windows\System\kRYIICR.exe
  C:\Windows\System\kRYIICR.exe
  2⤵
  PID:9616
- C:\Windows\System\gOsNucL.exe
  C:\Windows\System\gOsNucL.exe
  2⤵
  PID:9632
- C:\Windows\System\qHGJhVh.exe
  C:\Windows\System\qHGJhVh.exe
  2⤵
  PID:9652
- C:\Windows\System\RjjJitW.exe
  C:\Windows\System\RjjJitW.exe
  2⤵
  PID:9684
- C:\Windows\System\omSrGQJ.exe
  C:\Windows\System\omSrGQJ.exe
  2⤵
  PID:9700
- C:\Windows\System\muoqrSy.exe
  C:\Windows\System\muoqrSy.exe
  2⤵
  PID:9716
- C:\Windows\System\LoocNCa.exe
  C:\Windows\System\LoocNCa.exe
  2⤵
  PID:9736
- C:\Windows\System\QlRJCOP.exe
  C:\Windows\System\QlRJCOP.exe
  2⤵
  PID:9752
- C:\Windows\System\IxYclWy.exe
  C:\Windows\System\IxYclWy.exe
  2⤵
  PID:9772
- C:\Windows\System\YjkBFgE.exe
  C:\Windows\System\YjkBFgE.exe
  2⤵
  PID:9792
- C:\Windows\System\sBPrLJs.exe
  C:\Windows\System\sBPrLJs.exe
  2⤵
  PID:9808
- C:\Windows\System\HQryXsp.exe
  C:\Windows\System\HQryXsp.exe
  2⤵
  PID:9836
- C:\Windows\System\lcAFFaK.exe
  C:\Windows\System\lcAFFaK.exe
  2⤵
  PID:9864
- C:\Windows\System\ATTBsWo.exe
  C:\Windows\System\ATTBsWo.exe
  2⤵
  PID:9880
- C:\Windows\System\stfWanB.exe
  C:\Windows\System\stfWanB.exe
  2⤵
  PID:9896
- C:\Windows\System\LimvMhM.exe
  C:\Windows\System\LimvMhM.exe
  2⤵
  PID:9920
- C:\Windows\System\KnGLGRB.exe
  C:\Windows\System\KnGLGRB.exe
  2⤵
  PID:9936
- C:\Windows\System\AYajbsN.exe
  C:\Windows\System\AYajbsN.exe
  2⤵
  PID:9952
- C:\Windows\System\SxjSgnW.exe
  C:\Windows\System\SxjSgnW.exe
  2⤵
  PID:9988
- C:\Windows\System\cTsvMoJ.exe
  C:\Windows\System\cTsvMoJ.exe
  2⤵
  PID:10004
- C:\Windows\System\DPHKkVc.exe
  C:\Windows\System\DPHKkVc.exe
  2⤵
  PID:10024
- C:\Windows\System\UmDZwKG.exe
  C:\Windows\System\UmDZwKG.exe
  2⤵
  PID:10040
- C:\Windows\System\pECFKLi.exe
  C:\Windows\System\pECFKLi.exe
  2⤵
  PID:10056
- C:\Windows\System\thZTZYB.exe
  C:\Windows\System\thZTZYB.exe
  2⤵
  PID:10084
- C:\Windows\System\ZJeEXgN.exe
  C:\Windows\System\ZJeEXgN.exe
  2⤵
  PID:10112
- C:\Windows\System\tHxknyG.exe
  C:\Windows\System\tHxknyG.exe
  2⤵
  PID:10128
- C:\Windows\System\BWYDShw.exe
  C:\Windows\System\BWYDShw.exe
  2⤵
  PID:10144
- C:\Windows\System\XuxYxGv.exe
  C:\Windows\System\XuxYxGv.exe
  2⤵
  PID:10160
- C:\Windows\System\LiIonMD.exe
  C:\Windows\System\LiIonMD.exe
  2⤵
  PID:10184
- C:\Windows\System\qozxrwA.exe
  C:\Windows\System\qozxrwA.exe
  2⤵
  PID:10200
- C:\Windows\System\eigVUdI.exe
  C:\Windows\System\eigVUdI.exe
  2⤵
  PID:10228
- C:\Windows\System\KMmlXhm.exe
  C:\Windows\System\KMmlXhm.exe
  2⤵
  PID:8728
- C:\Windows\System\IvcUiHX.exe
  C:\Windows\System\IvcUiHX.exe
  2⤵
  PID:9244
- C:\Windows\System\SBDEqMQ.exe
  C:\Windows\System\SBDEqMQ.exe
  2⤵
  PID:9372
- C:\Windows\System\gREYlfv.exe
  C:\Windows\System\gREYlfv.exe
  2⤵
  PID:9432
- C:\Windows\System\JPUffMf.exe
  C:\Windows\System\JPUffMf.exe
  2⤵
  PID:9420
- C:\Windows\System\avyHNNm.exe
  C:\Windows\System\avyHNNm.exe
  2⤵
  PID:9456
- C:\Windows\System\VBaQtRw.exe
  C:\Windows\System\VBaQtRw.exe
  2⤵
  PID:9304
- C:\Windows\System\ZWWoXcH.exe
  C:\Windows\System\ZWWoXcH.exe
  2⤵
  PID:9528
- C:\Windows\System\NcyyRNR.exe
  C:\Windows\System\NcyyRNR.exe
  2⤵
  PID:9568
- C:\Windows\System\wkdCqfW.exe
  C:\Windows\System\wkdCqfW.exe
  2⤵
  PID:9592
- C:\Windows\System\ZebuHuZ.exe
  C:\Windows\System\ZebuHuZ.exe
  2⤵
  PID:9640
- C:\Windows\System\IlwkGUF.exe
  C:\Windows\System\IlwkGUF.exe
  2⤵
  PID:9668
- C:\Windows\System\ykkirqX.exe
  C:\Windows\System\ykkirqX.exe
  2⤵
  PID:9696
- C:\Windows\System\ABNgzsY.exe
  C:\Windows\System\ABNgzsY.exe
  2⤵
  PID:9708
- C:\Windows\System\HQRquCU.exe
  C:\Windows\System\HQRquCU.exe
  2⤵
  PID:9800
- C:\Windows\System\lYyvviA.exe
  C:\Windows\System\lYyvviA.exe
  2⤵
  PID:9788
- C:\Windows\System\dIerajk.exe
  C:\Windows\System\dIerajk.exe
  2⤵
  PID:9848
- C:\Windows\System\TrGGDWF.exe
  C:\Windows\System\TrGGDWF.exe
  2⤵
  PID:9856
- C:\Windows\System\wJwAdvs.exe
  C:\Windows\System\wJwAdvs.exe
  2⤵
  PID:9892
- C:\Windows\System\BXfhGdV.exe
  C:\Windows\System\BXfhGdV.exe
  2⤵
  PID:9960
- C:\Windows\System\XODpZhX.exe
  C:\Windows\System\XODpZhX.exe
  2⤵
  PID:9968
- C:\Windows\System\uzxAroK.exe
  C:\Windows\System\uzxAroK.exe
  2⤵
  PID:9996
- C:\Windows\System\IgprGDC.exe
  C:\Windows\System\IgprGDC.exe
  2⤵
  PID:10048
- C:\Windows\System\ApVRVTq.exe
  C:\Windows\System\ApVRVTq.exe
  2⤵
  PID:10072
- C:\Windows\System\jAebJzc.exe
  C:\Windows\System\jAebJzc.exe
  2⤵
  PID:10096
- C:\Windows\System\TONeaew.exe
  C:\Windows\System\TONeaew.exe
  2⤵
  PID:10136
- C:\Windows\System\jheMtuT.exe
  C:\Windows\System\jheMtuT.exe
  2⤵
  PID:10180
- C:\Windows\System\byOTAHQ.exe
  C:\Windows\System\byOTAHQ.exe
  2⤵
  PID:10196
- C:\Windows\System\SQpXaWj.exe
  C:\Windows\System\SQpXaWj.exe
  2⤵
  PID:10220
- C:\Windows\System\zQTpKXR.exe
  C:\Windows\System\zQTpKXR.exe
  2⤵
  PID:9260
- C:\Windows\System\OKCVCcm.exe
  C:\Windows\System\OKCVCcm.exe
  2⤵
  PID:9980
- C:\Windows\System\ImMEGdj.exe
  C:\Windows\System\ImMEGdj.exe
  2⤵
  PID:9472
- C:\Windows\System\xlZLOse.exe
  C:\Windows\System\xlZLOse.exe
  2⤵
  PID:9488
- C:\Windows\System\BGwrEWl.exe
  C:\Windows\System\BGwrEWl.exe
  2⤵
  PID:9564
- C:\Windows\System\hCyAIKi.exe
  C:\Windows\System\hCyAIKi.exe
  2⤵
  PID:9608
- C:\Windows\System\bGemjUT.exe
  C:\Windows\System\bGemjUT.exe
  2⤵
  PID:9664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AqGAnOk.exe

Filesize
1.6MB

MD5
93d18d4366488192ab26b0e6eae87bff

SHA1
63812671e4a966b23b9b793cf5f3ea7050982630

SHA256
ff8ab32970eccdd9fb239c28fa31c7e7adcbba08248eb8952e0f815d6996e59d

SHA512
7210adf60d4eb4b81c672b4809f682cdceddd7a82e1f521cc63cc568c2805e6497fff23b8c212ea1a91fe87c18fb8e487ad1652c8677cc64ae184817b694ffda

Download Submit
C:\Windows\system\CYbMCQN.exe

Filesize
1.6MB

MD5
254dd7579050fd7cc937ff6f24209143

SHA1
ebdbbc925ee3a5dd21e7da5b42f96fa00141f0da

SHA256
2ec7497cb5d07538a3138478beb5e47652e68f8d648659d2bf67f7932fde170b

SHA512
784ffa3c114440553127f10ab57d0787ab7b8111efd6b20bedbd16139bde4110701c414db52a61a4c847d2e2432ccffaf7438a25b4bdfc205fe9deca283a160a

Download Submit
C:\Windows\system\DFzLuNj.exe

Filesize
1.6MB

MD5
f2dfd5fa04c0d690fd58334d473dc4f5

SHA1
6cc0a9c8186b67b3d2930beb9657c7009ea2fe47

SHA256
146754bbcfa7fa6708ec3705c47c6b7684185dee1fd0935ba4805b8114e11aca

SHA512
173982cce34d757303a6366faba09840838faae3f09cb8da8147ad95455d0f13880a9141c1eec6e1a747270b0487b81a57278f1020f43d48964e17bb5b27fd0a

Download Submit
C:\Windows\system\EdzDIaS.exe

Filesize
1.6MB

MD5
4993575f7e8826ae8665836ecbf17f68

SHA1
9bbc03ea774166c1610c1c8d177f17e978b6e4aa

SHA256
011aa4b8c9d4917b53cfe842cf0b63a270cc3aaf76580838bde48fcb4f7fd4ad

SHA512
43a3c064f90be38b627eeb8376e5698d4abc0bf727d32e534d965986e62397dc88337b5d5f3f10a5201a70470c4926fec0b66bc5a771c818b79dd720e0951cb2

Download Submit
C:\Windows\system\FaSMmBI.exe

Filesize
1.6MB

MD5
30ef122b206b5aae5557c478cb348823

SHA1
bc79cca83be15030804c552bbefd0b74ceac1993

SHA256
2eb4057deb3137834a8577e717a05b38e16db9778eb66b557f11dae2e143639d

SHA512
a5f52ba0550afec66efec2d8eb21fa4930d9adb398289a6edd6edf7eb8e90c2061bb4a73f00e39144ff179fb73acac4e35d3c8483d68106112d1998a83abe007

Download Submit
C:\Windows\system\HwEQpxW.exe

Filesize
1.6MB

MD5
26b6dd7beb220659a1718d173f055b14

SHA1
b8e8b6fe4756043577f856459775de5c4e927451

SHA256
b043a557937c51336be2ab1cba9dee72f29b4cc4e0f1b19e67b52305bbdd238f

SHA512
ffd91c15361b4c99e98f06a70c839adf8ffabcc39258c3fec36fb427fc81b091bbeb71115f30cdb7dbb1b4d96b27aba316fac103f52d8ccee4c4f1c3ae558917

Download Submit
C:\Windows\system\JFbYdHe.exe

Filesize
1.6MB

MD5
a18e219c02945bb4034750cecd74fd84

SHA1
bd59102263e4b1910a584f6380ac4b0ab3edb9f9

SHA256
9d8bbb545f3a9772cf1a9a345e060a482569e9ecae256449bc7e60f019417fc5

SHA512
460b9ee2b1616a27b7959c28bd133d9140b8b7c55f5364e35a3c498fcb56dbbcfbaf4fcd055833ac6dd6452681a35df3e0161abea7b27d758f11d0b6c3a33062

Download Submit
C:\Windows\system\JscLYBa.exe

Filesize
1.6MB

MD5
6f1f8c217f43f5d84077fa699f9fbc99

SHA1
8c7e06833c82b9ff3e69b572605991ed6324a570

SHA256
949b18e2f587eca591ead95eb0d5217827b8cd003d44fc636ada9a927205631b

SHA512
59d2e15c701e56b1821b01ba30dea0a68d1e94ec3632410f40ffc5715c1ba01a1b0f96454f23a888abcd25989f3217c24b71d24b195c68955ceeb170b0ad2d39

Download Submit
C:\Windows\system\OHcITYN.exe

Filesize
1.6MB

MD5
8fa0baf52336cd05d605e41d0c10ffb2

SHA1
84b61cc2c53ac2631584f767cda60e49349c99e2

SHA256
4e71b5270f7b5f5c6bb4d6ea48b4a7f44676be0798177011fd58e04215ca3df8

SHA512
ddaecca7eeeeb01448d9d81216f15066aa0970117d4dec0118956826dae139ce42edfcb125457d4c805fdd455fd5597c427a39b1f792098dbf2d8e02bf7eb684

Download Submit
C:\Windows\system\OSXNmjP.exe

Filesize
1.6MB

MD5
ec333e6c8a78fc38d94badaeb7fb9b13

SHA1
7e3d415abfc918984bf1682dda72e32712825bfa

SHA256
c3fdd66727687b19c8eca428e6ff2dfdd4e249e077baf905f8e38702bf548ec1

SHA512
447e0910f613e00291f8dc90e3fb8b52badbc9db86b3cb788786d5a363d9d88a1e99f725369c457ef326920829d0d81a345ddce895da9fc92553e8a839f7d3cf

Download Submit
C:\Windows\system\QQqILBk.exe

Filesize
1.6MB

MD5
c6aa403a540996c922c3f3306732644a

SHA1
7b27f4705684d3e33322a952be341937868f7f2c

SHA256
0a807454737d4e0a5654d673e3cfbc804ad887b8fb74592cdd89b05ddd6ffebb

SHA512
dfdc78fa62acdda9cb57ba92f3de546e7b81a8b028edf99636886c1ab49d93754edb08cc46704258e86a414a1d6599d019ea04690d288bf10a200080f827615b

Download Submit
C:\Windows\system\TVURrDe.exe

Filesize
1.6MB

MD5
2a98a6b417ab6078a6a8916de6209243

SHA1
28fb6a3f9564ad97d9aeb3b7758c97f1ae791610

SHA256
f846168f41e5d0a3c3c65742abe0dd6f32b969293bb3c77282da2220c09888bd

SHA512
ed9fa533bd00ce4eaf6fe6918b32c294718a511202a283141b068a43c2668651433f079eff7eb340b719fa900e42a76045527d5ffcf19d2e9cce29aa36c52e70

Download Submit
C:\Windows\system\UohplCm.exe

Filesize
1.6MB

MD5
b649d4cc30b9457a5f779e066cad777f

SHA1
b199652a18646d5939874cffe431d3f7b5b87b4e

SHA256
000706c52063b67e3564d1e51bcd1713819d01202a9d783ac45e1083f9d2d77f

SHA512
ad5897dad0a3bc3503a6e97543f0b8a8d8559e26e13ec163401c5a600515ef0f13bd3361cea811e1feccae0b1d1d86a47d749e26ad55e667fec3e0afc7e8538f

Download Submit
C:\Windows\system\byHauZR.exe

Filesize
1.6MB

MD5
411d28e2cd1f757df3fa6fce4966f2c0

SHA1
ae1a2bdc8b0dacbb43b1a1935dc0355a45ce5576

SHA256
07aa8317160263a60ea8dca72538010333626969439aa55f8ba440d07cb02615

SHA512
9912cf653b2c82f34660072d6d8dfb0445f5695607d8cc8d356667fc58f6c48a8481d955421f527cbee9104a866e61331f2f539e3ce818f22ec305d3982549a1

Download Submit
C:\Windows\system\caNzrrj.exe

Filesize
1.6MB

MD5
f8866e55dab93eea5bb084be4fa80f3b

SHA1
624a28bd81e10050560a6b4c4353f290012313c0

SHA256
b51798b49c72564153f3d5ba8dc958cf065a11965ad868fac04af1327cf6defa

SHA512
922839819f0f403281269eb03a1f66193921489b423d5732b6c0b624db6c049e1822029605e30a5a3933a8fe877d7542f8632205a45dc96cc8bb41672cf4fe13

Download Submit
C:\Windows\system\catgyfe.exe

Filesize
1.6MB

MD5
f14aafb57b406dbdae9fcfe5da7a9009

SHA1
013567b79dcf8a1f7d0cfaf234118c4fbec083ce

SHA256
b31807d17556c004aa2aef6d7f54eae313e5c5c7dbfe66d851a7e2c84456df3a

SHA512
386bd47bcfa7e5f7e44154abeecf008e9534edaa2e07398efa242da7e054f46a94cfce8c4f5be93dcf4f6e54d39f2b8319442b206b6aa347a3764141bc2e3bf5

Download Submit
C:\Windows\system\dYUXXVI.exe

Filesize
1.6MB

MD5
7a19187ef738fa268a847dc3ab688119

SHA1
688ed8f6e01520f7bf9a157ee895d8cab958015c

SHA256
7f7449a9ef775d93f676becccc2f0800fd8ca6133c850c63fac5ce41df2fe8f6

SHA512
6e0a95f5fb21879399ef4470653b0ab047d7db6e540904e5d4bafac1e58b5d6410160fab71c1ede4cd50f5569da446611c0da044bc82f7311ff2dc734ba55605

Download Submit
C:\Windows\system\eDybVqS.exe

Filesize
1.6MB

MD5
b7254594d84d289a12adb9a348267e96

SHA1
93110404c8fe08492627452827b19389fe6106d2

SHA256
836dde7141c55bc35345f0f19f3297e24aa362ec74403707eb998c143d9b47db

SHA512
0aae1bd27f7ada186cef73e654d3408c0a5fec38e758be5ddf24376b094e2f61eed07786d25df1f8cd42f7c0b58505f69ae2cb50d247ef3121dfef9731454523

Download Submit
C:\Windows\system\eNPybwn.exe

Filesize
1.6MB

MD5
eec115732ccab2300f9b70dfb08e7e83

SHA1
0e6817576b06fa2b664c294145cfe038dfcd30c2

SHA256
5e8561502131b15622ee652b4e2c45ee05c126cd5b5f937bafb311851f479034

SHA512
670e778f90f906b1fd4924f7c09fcfa6512bd4c36f81124a66bdb6b749a9bb2ba56ed39e2c6611343abb18f6b10f1bcf99264c35e50a8dae496b50a4ff14d142

Download Submit
C:\Windows\system\fJSjGam.exe

Filesize
1.6MB

MD5
641c235d981b3f9c2be6e05a31b1fd29

SHA1
27de51e0aadc3de30314e928ae8804d2a86a4b88

SHA256
59acc7ce0e9f96e2a27e40d31b4d9ea080e69bbc900e47b471f69d04143c8d2c

SHA512
d20e53b7b992ca81a0b85f74b0facb456c017112c8fddc5ea8b826b8f6f79fd719760ee22ccf66f87ba48a72f5e7e9b47f58145953ce7111e47eb39207f1a5f3

Download Submit
C:\Windows\system\fpnuuiB.exe

Filesize
1.6MB

MD5
01eab02a4ae96e7cf4caf24505b7f00f

SHA1
f02c63252d75f7184d7e4eeda3ea4bc247838f65

SHA256
57de19d71eca00143aa07b218c5d2d10845f48b23a6d67468f1c51b51a108fec

SHA512
7136acc4915eba2e5689dbae3f58b529208efa2606e92f3b055499e5e6f0e07a1edcc3bae991011a116c6b23f1fcde4bdedb2ba5750ed5c776183fb9f04cafec

Download Submit
C:\Windows\system\glTcrPZ.exe

Filesize
1.6MB

MD5
506045ebe6c6dfb5c23df45b798a2053

SHA1
5f52bfd639f2750e7ed8f4f29d4b32795310835e

SHA256
ffaf9d7d32253451a50320bae3c5188827a034db1c6ac7da3e2c9533a92f2c57

SHA512
59ed308c52d2b7051c706321c227b76041d87a7b4af497ed9978d26d933229dc62ceae3b433891f867eb80e75b65628e053f9b4934db992dbb088a4960a2134a

Download Submit
C:\Windows\system\iYxjBQn.exe

Filesize
1.6MB

MD5
70e09ec8a0699b4a4e2739f5b0546e2e

SHA1
fbb7f473ae8c8d800350a0260ed24bb6390c2b1b

SHA256
eaa67243a1cc28bb0a15342e28ad577e9b3bfc4a91976cf57d3dc189a7318449

SHA512
8fafe823d172996214a666b7e28461547c5ee01e000ea1ed944767d4b405f8eb6091c7b9469fdc339070738e3dd9e384bde53294eccf1788c55e4038f408a5e2

Download Submit
C:\Windows\system\jlRWOmP.exe

Filesize
1.6MB

MD5
9f4ad2c92de14c7a54f1f86861d30748

SHA1
a2a44d5a3769ab70af2e196e05682c3854c1b408

SHA256
cf1c4ca8623cafd854f4926cdd1e764411a918ffb99069907b1ea509a1b63c59

SHA512
8719d2b225edcb11b3454bd55c46e4890d95dc4543db9efcc8fe012f032d1851a68575ca94d0e736d94b6e925417c6d4cc1fa5be66d668974957ff69c1d7a225

Download Submit
C:\Windows\system\nVxIsfk.exe

Filesize
1.6MB

MD5
d4a6a9f1953dd6045655a9221450d0b7

SHA1
4ca8221633020964614ad16097fac8e3682f3684

SHA256
9a4882bb90aadfeda960b1950a692143ff72913882b97c49d484e8fe84d06e9c

SHA512
018ac951c927c6dc2c51ef866acd987a9256479840c87ea11ad2f8bb55b40e65b38feb1b0658f8d5b52dd439afe6af6595ff59d057573de201f2ccac91250b0c

Download Submit
C:\Windows\system\nuDwgeF.exe

Filesize
1.6MB

MD5
06cf33e4c2244916c1ce36f94d9c62ac

SHA1
06c9c6c0363af940a62bc6246e3e4bbb6281cf18

SHA256
7ab605755549680a7d2a311cd3814029f86aefe43755d38192f257d6ef5d0bf1

SHA512
694aba8b17994f134ac23cdf05aeb9157b6d42d0282e86198bec249c7ba5f184c5dc6e8a92c0c2394690ba4d3c0cad7ca05d71d9f3e8a8a0155f460e8c240d80

Download Submit
C:\Windows\system\oXWGCvr.exe

Filesize
1.6MB

MD5
b0c1233c89c1a7c9c3a9bbc8d6c5d534

SHA1
e1a24d12a7b536d88ccdf13a61e9dc4a4da8623c

SHA256
9666eb12a66a8eece4a92f186691d20798fdeb68c149a926c2d311db89b13252

SHA512
09963f1700f00f6997ff3d1a64137641af8763bd8aaed80a45b03f3961ea457eaf36c437508672e1b97495500431f1b9580a0dd6a8028eb4485b8cbf2f56cec7

Download Submit
C:\Windows\system\qGsKZmC.exe

Filesize
1.6MB

MD5
2b27037d5b338ee850b2fbc3e79e7aa1

SHA1
7687ece0017b7ccdfd3acf81568daab808ffb118

SHA256
1bbff0fa04bb41bd098efc21c141006a9d3545ffaa45531adb3a6ff0666f7a7c

SHA512
b8668253450cbe6c5e8ec7e8731de266c00f92d1894f172583eaf1b602d979b8779eb71bd95f687e7440e22665c8dda4ad34f2ee57c95c381b0c1868878e22fa

Download Submit
C:\Windows\system\tLqRLUt.exe

Filesize
1.6MB

MD5
94af28cfa99a1b62b64af14290e6a305

SHA1
51c7d38bebd858ddd70fc0e150331aadcd7b9e96

SHA256
75b51e3a7f76849ade85db7bb9707f33654485886e41831e57228ecb9deb64c5

SHA512
65985710afd2b3e48b17240788dfeb4fe6a96939f6e5e91e0717c74bd04d8393a643eaed4d5f0a542e7232e620633b77b624437fef5ee871168a7969904f792b

Download Submit
C:\Windows\system\wIgiKaf.exe

Filesize
1.6MB

MD5
2f8ca72a69201d2f51bad0f55baa570e

SHA1
f95a5379d61cbd9abe5417b132e4f854620a77d6

SHA256
8edf95c349d1811e41567a194dca62f07bdda5c419d13ec9c0528807b6029d22

SHA512
fe3b48ed9b75458114d78bebda2cbc6ef8741a6bca2cfcb9d2bfa72bba0070859b82cd3b0080450f22a6148c271a6f81c453c77d239f9728095721071acbd366

Download Submit
\Windows\system\jFsptfg.exe

Filesize
1.6MB

MD5
9daf9c70d0142cc813fc6afdc8e908d2

SHA1
401d327c94c4b3b4cd3332c4ceb81672c9178bff

SHA256
0080f8ab583a9b44edd8feb51197124544ceac6b4084d0e0bec429ed81f40fed

SHA512
2cd6aa9654a5795c8d558c267a6554afa7dc84cf084323b27dbfc12b7555c874344aa89f92853ba79bdd97bbbc318839674d593ec31fa9abaa3a0c6b73a6b84e

Download Submit
\Windows\system\vXNBobE.exe

Filesize
1.6MB

MD5
ba5f5240fd6f97b679bd3fdcedb0201a

SHA1
de4d7954cb5ce251033b42420808543f80444a35

SHA256
82166c96ae7632dc872138ec8f8e6e02c96df06ff3aea25088b48791004786cd

SHA512
3eb1027045be7188ebb09b8387ca0b4e845df654956c0ec48b37df9d51bbfa9fac552e5ac71811d8faa32688b7c205de2e18cd2f8b53658fe7ca214572b568bc

Download Submit
memory/2928-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download