xmrig | 66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0

Analysis

max time kernel
31s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 22:31

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
Size

1.4MB
MD5

0dc13f86d8abf79162fd257299036469
SHA1

f8a47825c7bb65ad18be1ad0dd1e57c1b274039a
SHA256

66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0
SHA512

5a3eefe1fbba30a54d5dc7b15b25037630e51e0e287ed01f3c94abe907ac9e829f72aebeae8d2a82916709a54bd98492537ecd5b27f734b32b4b13a27ceefdc2
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727f8UhNnXIhz24Gtd8SLiCOaOZwfXKfAnkHWBnzwT/M:ROdWCCi7/rahUUvXjVTZLVOaOxGnsT/M

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral2/memory/1916-317-0x00007FF6A8320000-0x00007FF6A8671000-memory.dmp	xmrig
behavioral2/memory/2384-320-0x00007FF6A3D10000-0x00007FF6A4061000-memory.dmp	xmrig
behavioral2/memory/2808-324-0x00007FF717E80000-0x00007FF7181D1000-memory.dmp	xmrig
behavioral2/memory/1360-329-0x00007FF6CB0D0000-0x00007FF6CB421000-memory.dmp	xmrig
behavioral2/memory/2848-343-0x00007FF759AE0000-0x00007FF759E31000-memory.dmp	xmrig
behavioral2/memory/1232-345-0x00007FF620A80000-0x00007FF620DD1000-memory.dmp	xmrig
behavioral2/memory/1924-361-0x00007FF720A70000-0x00007FF720DC1000-memory.dmp	xmrig
behavioral2/memory/4856-365-0x00007FF6715A0000-0x00007FF6718F1000-memory.dmp	xmrig
behavioral2/memory/348-344-0x00007FF7B3630000-0x00007FF7B3981000-memory.dmp	xmrig
behavioral2/memory/5060-340-0x00007FF614D30000-0x00007FF615081000-memory.dmp	xmrig
behavioral2/memory/1928-334-0x00007FF6F4D70000-0x00007FF6F50C1000-memory.dmp	xmrig
behavioral2/memory/1968-325-0x00007FF75B220000-0x00007FF75B571000-memory.dmp	xmrig
behavioral2/memory/3468-316-0x00007FF748160000-0x00007FF7484B1000-memory.dmp	xmrig
behavioral2/memory/788-314-0x00007FF70A9D0000-0x00007FF70AD21000-memory.dmp	xmrig
behavioral2/memory/3948-73-0x00007FF78F040000-0x00007FF78F391000-memory.dmp	xmrig
behavioral2/memory/2028-66-0x00007FF6395D0000-0x00007FF639921000-memory.dmp	xmrig
behavioral2/memory/5100-27-0x00007FF60B660000-0x00007FF60B9B1000-memory.dmp	xmrig
behavioral2/memory/1484-1907-0x00007FF7C9080000-0x00007FF7C93D1000-memory.dmp	xmrig
behavioral2/memory/816-1914-0x00007FF6CC020000-0x00007FF6CC371000-memory.dmp	xmrig
behavioral2/memory/5072-1910-0x00007FF637BA0000-0x00007FF637EF1000-memory.dmp	xmrig
behavioral2/memory/1600-2197-0x00007FF7FDC30000-0x00007FF7FDF81000-memory.dmp	xmrig
behavioral2/memory/3004-2198-0x00007FF681C40000-0x00007FF681F91000-memory.dmp	xmrig
behavioral2/memory/3052-2199-0x00007FF73F430000-0x00007FF73F781000-memory.dmp	xmrig
behavioral2/memory/3236-2200-0x00007FF643710000-0x00007FF643A61000-memory.dmp	xmrig
behavioral2/memory/4792-2201-0x00007FF7C4E40000-0x00007FF7C5191000-memory.dmp	xmrig
behavioral2/memory/2028-2202-0x00007FF6395D0000-0x00007FF639921000-memory.dmp	xmrig
behavioral2/memory/4820-2203-0x00007FF6B7240000-0x00007FF6B7591000-memory.dmp	xmrig
behavioral2/memory/2844-2213-0x00007FF7B32C0000-0x00007FF7B3611000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5072	adoNgXo.exe
5100	vclYDHl.exe
816	gFHryHR.exe
1900	FETESXm.exe
3052	tryDROs.exe
1600	DjOKMJF.exe
3004	bIVzedL.exe
3236	VaixobI.exe
3948	dfRnqad.exe
2028	LTJgVXQ.exe
4792	DaHuBxq.exe
4820	XcNoWRM.exe
1636	lJVXBeA.exe
2844	OMBIgYS.exe
1496	lDEAoxh.exe
788	ATpHYfO.exe
3468	TYYZnhS.exe
1916	gCEUwCZ.exe
2384	qjADIFF.exe
2808	tTafqtg.exe
1968	SkeozaW.exe
1360	OuMOZYp.exe
1928	NhrFIOl.exe
5060	HWoJUAq.exe
2848	fTBOkEo.exe
348	bYdBzJH.exe
1232	rCvmHzB.exe
1924	ufElZYt.exe
4856	emAnzpg.exe
1960	TsXQRHf.exe
4620	tPqfCvb.exe
4476	JVCWQvK.exe
4440	TFbunVe.exe
1988	qGxogVk.exe
1004	LLvqOlc.exe
2216	PPahpro.exe
2008	lEPDeIm.exe
3596	DqVWBba.exe
640	KmDuPCf.exe
540	eDXtVPB.exe
2212	PEyhmnK.exe
4228	LaZqANl.exe
2040	nzhbIOm.exe
516	vsGNqoU.exe
4088	dpyRjrx.exe
3260	nJKpmZn.exe
2208	sXEVYdO.exe
2852	vpJtdLx.exe
1416	DYKrkil.exe
3084	tOBJdAn.exe
1296	fkyASYU.exe
3888	jqBiQYt.exe
3592	zgDTISu.exe
3416	NpvDYgb.exe
3264	wWWTbri.exe
3932	yaWmJIS.exe
2680	qwRIwzh.exe
4084	zGgwhYl.exe
5076	QyVoeIF.exe
5040	UwfYyah.exe
1524	MUmSrWP.exe
2400	jQNNudc.exe
3916	nXKFbRs.exe
1572	aPHHNdX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1484-0-0x00007FF7C9080000-0x00007FF7C93D1000-memory.dmp	upx
behavioral2/files/0x0008000000023455-5.dat	upx
behavioral2/files/0x000700000002345c-8.dat	upx
behavioral2/files/0x000800000002345b-10.dat	upx
behavioral2/files/0x000700000002345d-21.dat	upx
behavioral2/files/0x000700000002345e-31.dat	upx
behavioral2/memory/3004-39-0x00007FF681C40000-0x00007FF681F91000-memory.dmp	upx
behavioral2/files/0x000700000002345f-42.dat	upx
behavioral2/files/0x0007000000023462-53.dat	upx
behavioral2/files/0x0007000000023464-60.dat	upx
behavioral2/files/0x0007000000023466-74.dat	upx
behavioral2/files/0x0007000000023468-85.dat	upx
behavioral2/files/0x0008000000023459-104.dat	upx
behavioral2/files/0x000700000002346b-114.dat	upx
behavioral2/files/0x000700000002346e-131.dat	upx
behavioral2/files/0x0007000000023471-138.dat	upx
behavioral2/files/0x0007000000023472-151.dat	upx
behavioral2/files/0x0007000000023474-161.dat	upx
behavioral2/files/0x0007000000023476-171.dat	upx
behavioral2/memory/1916-317-0x00007FF6A8320000-0x00007FF6A8671000-memory.dmp	upx
behavioral2/memory/2384-320-0x00007FF6A3D10000-0x00007FF6A4061000-memory.dmp	upx
behavioral2/memory/2808-324-0x00007FF717E80000-0x00007FF7181D1000-memory.dmp	upx
behavioral2/memory/1360-329-0x00007FF6CB0D0000-0x00007FF6CB421000-memory.dmp	upx
behavioral2/memory/2848-343-0x00007FF759AE0000-0x00007FF759E31000-memory.dmp	upx
behavioral2/memory/1232-345-0x00007FF620A80000-0x00007FF620DD1000-memory.dmp	upx
behavioral2/memory/1924-361-0x00007FF720A70000-0x00007FF720DC1000-memory.dmp	upx
behavioral2/memory/4856-365-0x00007FF6715A0000-0x00007FF6718F1000-memory.dmp	upx
behavioral2/memory/348-344-0x00007FF7B3630000-0x00007FF7B3981000-memory.dmp	upx
behavioral2/memory/5060-340-0x00007FF614D30000-0x00007FF615081000-memory.dmp	upx
behavioral2/memory/1928-334-0x00007FF6F4D70000-0x00007FF6F50C1000-memory.dmp	upx
behavioral2/memory/1968-325-0x00007FF75B220000-0x00007FF75B571000-memory.dmp	upx
behavioral2/memory/3468-316-0x00007FF748160000-0x00007FF7484B1000-memory.dmp	upx
behavioral2/memory/788-314-0x00007FF70A9D0000-0x00007FF70AD21000-memory.dmp	upx
behavioral2/files/0x0007000000023479-178.dat	upx
behavioral2/files/0x0007000000023477-176.dat	upx
behavioral2/files/0x0007000000023478-173.dat	upx
behavioral2/files/0x0007000000023475-166.dat	upx
behavioral2/files/0x0007000000023473-156.dat	upx
behavioral2/files/0x0007000000023470-141.dat	upx
behavioral2/files/0x000700000002346f-136.dat	upx
behavioral2/files/0x000700000002346d-124.dat	upx
behavioral2/files/0x000700000002346c-119.dat	upx
behavioral2/files/0x000700000002346a-109.dat	upx
behavioral2/files/0x0007000000023469-96.dat	upx
behavioral2/memory/1496-90-0x00007FF7AD540000-0x00007FF7AD891000-memory.dmp	upx
behavioral2/files/0x0007000000023467-88.dat	upx
behavioral2/memory/2844-87-0x00007FF7B32C0000-0x00007FF7B3611000-memory.dmp	upx
behavioral2/memory/1636-83-0x00007FF751F00000-0x00007FF752251000-memory.dmp	upx
behavioral2/files/0x0007000000023465-79.dat	upx
behavioral2/memory/4820-77-0x00007FF6B7240000-0x00007FF6B7591000-memory.dmp	upx
behavioral2/memory/3948-73-0x00007FF78F040000-0x00007FF78F391000-memory.dmp	upx
behavioral2/memory/4792-72-0x00007FF7C4E40000-0x00007FF7C5191000-memory.dmp	upx
behavioral2/memory/2028-66-0x00007FF6395D0000-0x00007FF639921000-memory.dmp	upx
behavioral2/files/0x0007000000023463-62.dat	upx
behavioral2/files/0x0007000000023461-56.dat	upx
behavioral2/memory/3236-55-0x00007FF643710000-0x00007FF643A61000-memory.dmp	upx
behavioral2/memory/3052-40-0x00007FF73F430000-0x00007FF73F781000-memory.dmp	upx
behavioral2/files/0x0007000000023460-43.dat	upx
behavioral2/memory/1600-35-0x00007FF7FDC30000-0x00007FF7FDF81000-memory.dmp	upx
behavioral2/memory/1900-34-0x00007FF603890000-0x00007FF603BE1000-memory.dmp	upx
behavioral2/memory/5100-27-0x00007FF60B660000-0x00007FF60B9B1000-memory.dmp	upx
behavioral2/memory/816-20-0x00007FF6CC020000-0x00007FF6CC371000-memory.dmp	upx
behavioral2/memory/5072-16-0x00007FF637BA0000-0x00007FF637EF1000-memory.dmp	upx
behavioral2/memory/1484-1907-0x00007FF7C9080000-0x00007FF7C93D1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xrntlkt.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\DTsDKGB.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\wVnTJCP.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\fsiSeim.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\TaFRurh.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\TsXQRHf.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\sXEVYdO.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\oMuqdki.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\BrlUvjx.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\fnKwLZe.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\KMFsEoJ.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\iSnpJMe.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\LWTaBbE.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\SPOANNX.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\GKNDQFR.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\LUJCBZq.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\WSsHGpC.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\vxZuuEJ.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\FvanzBE.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\MHbFrfj.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\TGvZUIr.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\VXNyHMk.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\iOqlZCm.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\qjADIFF.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\xZjdmBU.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\kvBFNal.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\xYLKgnt.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\qCpUcfw.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\luhOpLW.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\uWxyrob.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\WXvclEV.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\PLswlrM.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\cfMtpRq.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\EBInAow.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\wNdovJW.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\AREkWXg.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\SZBYglE.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\yaWmJIS.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\UwfYyah.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\htITECc.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\JOHKSPq.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\xRrfQIQ.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\shDQnMM.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\GTfXFrf.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\dEwPqyZ.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\owSQqsZ.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\qeooApb.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\VbIqzfx.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\lMzpfTv.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\wgCTaDW.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\SEQxryi.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\QUHJXdg.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\NAIhKCJ.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\dmcUXhc.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\jkSFZbx.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\sQpedaX.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\YnHzDtj.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\vAtGFrm.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\wnXfKbn.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\wvdUJkd.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\ECjbDRk.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\rVaylot.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\FooDbDg.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
File created	C:\Windows\System\GwJJNmC.exe	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 5072	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	84
PID 1484 wrote to memory of 5072	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	84
PID 1484 wrote to memory of 5100	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	85
PID 1484 wrote to memory of 5100	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	85
PID 1484 wrote to memory of 816	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	86
PID 1484 wrote to memory of 816	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	86
PID 1484 wrote to memory of 1900	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	87
PID 1484 wrote to memory of 1900	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	87
PID 1484 wrote to memory of 3052	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	88
PID 1484 wrote to memory of 3052	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	88
PID 1484 wrote to memory of 1600	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	89
PID 1484 wrote to memory of 1600	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	89
PID 1484 wrote to memory of 3004	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	90
PID 1484 wrote to memory of 3004	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	90
PID 1484 wrote to memory of 3236	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	91
PID 1484 wrote to memory of 3236	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	91
PID 1484 wrote to memory of 3948	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	92
PID 1484 wrote to memory of 3948	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	92
PID 1484 wrote to memory of 2028	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	93
PID 1484 wrote to memory of 2028	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	93
PID 1484 wrote to memory of 4792	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	94
PID 1484 wrote to memory of 4792	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	94
PID 1484 wrote to memory of 4820	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	95
PID 1484 wrote to memory of 4820	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	95
PID 1484 wrote to memory of 1636	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	96
PID 1484 wrote to memory of 1636	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	96
PID 1484 wrote to memory of 2844	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	97
PID 1484 wrote to memory of 2844	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	97
PID 1484 wrote to memory of 1496	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	98
PID 1484 wrote to memory of 1496	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	98
PID 1484 wrote to memory of 788	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	99
PID 1484 wrote to memory of 788	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	99
PID 1484 wrote to memory of 3468	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	100
PID 1484 wrote to memory of 3468	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	100
PID 1484 wrote to memory of 1916	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	101
PID 1484 wrote to memory of 1916	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	101
PID 1484 wrote to memory of 2384	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	102
PID 1484 wrote to memory of 2384	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	102
PID 1484 wrote to memory of 2808	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	103
PID 1484 wrote to memory of 2808	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	103
PID 1484 wrote to memory of 1968	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	104
PID 1484 wrote to memory of 1968	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	104
PID 1484 wrote to memory of 1360	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	105
PID 1484 wrote to memory of 1360	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	105
PID 1484 wrote to memory of 1928	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	106
PID 1484 wrote to memory of 1928	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	106
PID 1484 wrote to memory of 5060	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	107
PID 1484 wrote to memory of 5060	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	107
PID 1484 wrote to memory of 2848	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	108
PID 1484 wrote to memory of 2848	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	108
PID 1484 wrote to memory of 348	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	109
PID 1484 wrote to memory of 348	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	109
PID 1484 wrote to memory of 1232	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	110
PID 1484 wrote to memory of 1232	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	110
PID 1484 wrote to memory of 1924	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	111
PID 1484 wrote to memory of 1924	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	111
PID 1484 wrote to memory of 4856	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	112
PID 1484 wrote to memory of 4856	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	112
PID 1484 wrote to memory of 1960	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	113
PID 1484 wrote to memory of 1960	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	113
PID 1484 wrote to memory of 4620	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	114
PID 1484 wrote to memory of 4620	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	114
PID 1484 wrote to memory of 4476	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	115
PID 1484 wrote to memory of 4476	1484	66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe	115

C:\Users\Admin\AppData\Local\Temp\66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe
"C:\Users\Admin\AppData\Local\Temp\66ace83af6cbdad44e6c13552e80925bea8e455d04b416e7feb8047fc76423e0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\System\adoNgXo.exe
  C:\Windows\System\adoNgXo.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\vclYDHl.exe
  C:\Windows\System\vclYDHl.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\gFHryHR.exe
  C:\Windows\System\gFHryHR.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\FETESXm.exe
  C:\Windows\System\FETESXm.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\tryDROs.exe
  C:\Windows\System\tryDROs.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\DjOKMJF.exe
  C:\Windows\System\DjOKMJF.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\bIVzedL.exe
  C:\Windows\System\bIVzedL.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\VaixobI.exe
  C:\Windows\System\VaixobI.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\dfRnqad.exe
  C:\Windows\System\dfRnqad.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\LTJgVXQ.exe
  C:\Windows\System\LTJgVXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\DaHuBxq.exe
  C:\Windows\System\DaHuBxq.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\XcNoWRM.exe
  C:\Windows\System\XcNoWRM.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\lJVXBeA.exe
  C:\Windows\System\lJVXBeA.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\OMBIgYS.exe
  C:\Windows\System\OMBIgYS.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\lDEAoxh.exe
  C:\Windows\System\lDEAoxh.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\ATpHYfO.exe
  C:\Windows\System\ATpHYfO.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\TYYZnhS.exe
  C:\Windows\System\TYYZnhS.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\gCEUwCZ.exe
  C:\Windows\System\gCEUwCZ.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\qjADIFF.exe
  C:\Windows\System\qjADIFF.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\tTafqtg.exe
  C:\Windows\System\tTafqtg.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\SkeozaW.exe
  C:\Windows\System\SkeozaW.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\OuMOZYp.exe
  C:\Windows\System\OuMOZYp.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\NhrFIOl.exe
  C:\Windows\System\NhrFIOl.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\HWoJUAq.exe
  C:\Windows\System\HWoJUAq.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\fTBOkEo.exe
  C:\Windows\System\fTBOkEo.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\bYdBzJH.exe
  C:\Windows\System\bYdBzJH.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\rCvmHzB.exe
  C:\Windows\System\rCvmHzB.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\ufElZYt.exe
  C:\Windows\System\ufElZYt.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\emAnzpg.exe
  C:\Windows\System\emAnzpg.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\TsXQRHf.exe
  C:\Windows\System\TsXQRHf.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\tPqfCvb.exe
  C:\Windows\System\tPqfCvb.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\JVCWQvK.exe
  C:\Windows\System\JVCWQvK.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\TFbunVe.exe
  C:\Windows\System\TFbunVe.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\qGxogVk.exe
  C:\Windows\System\qGxogVk.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\LLvqOlc.exe
  C:\Windows\System\LLvqOlc.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\PPahpro.exe
  C:\Windows\System\PPahpro.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\lEPDeIm.exe
  C:\Windows\System\lEPDeIm.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\DqVWBba.exe
  C:\Windows\System\DqVWBba.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\KmDuPCf.exe
  C:\Windows\System\KmDuPCf.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\eDXtVPB.exe
  C:\Windows\System\eDXtVPB.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\PEyhmnK.exe
  C:\Windows\System\PEyhmnK.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\LaZqANl.exe
  C:\Windows\System\LaZqANl.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\nzhbIOm.exe
  C:\Windows\System\nzhbIOm.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\vsGNqoU.exe
  C:\Windows\System\vsGNqoU.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\dpyRjrx.exe
  C:\Windows\System\dpyRjrx.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\nJKpmZn.exe
  C:\Windows\System\nJKpmZn.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\sXEVYdO.exe
  C:\Windows\System\sXEVYdO.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\vpJtdLx.exe
  C:\Windows\System\vpJtdLx.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\DYKrkil.exe
  C:\Windows\System\DYKrkil.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\tOBJdAn.exe
  C:\Windows\System\tOBJdAn.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\fkyASYU.exe
  C:\Windows\System\fkyASYU.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\jqBiQYt.exe
  C:\Windows\System\jqBiQYt.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\zgDTISu.exe
  C:\Windows\System\zgDTISu.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\NpvDYgb.exe
  C:\Windows\System\NpvDYgb.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\wWWTbri.exe
  C:\Windows\System\wWWTbri.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\yaWmJIS.exe
  C:\Windows\System\yaWmJIS.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\qwRIwzh.exe
  C:\Windows\System\qwRIwzh.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\zGgwhYl.exe
  C:\Windows\System\zGgwhYl.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\QyVoeIF.exe
  C:\Windows\System\QyVoeIF.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\UwfYyah.exe
  C:\Windows\System\UwfYyah.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\MUmSrWP.exe
  C:\Windows\System\MUmSrWP.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\jQNNudc.exe
  C:\Windows\System\jQNNudc.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\nXKFbRs.exe
  C:\Windows\System\nXKFbRs.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\aPHHNdX.exe
  C:\Windows\System\aPHHNdX.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\HCqHyuH.exe
  C:\Windows\System\HCqHyuH.exe
  2⤵
  PID:2376
- C:\Windows\System\KMFsEoJ.exe
  C:\Windows\System\KMFsEoJ.exe
  2⤵
  PID:2636
- C:\Windows\System\qmCpltg.exe
  C:\Windows\System\qmCpltg.exe
  2⤵
  PID:4284
- C:\Windows\System\ImetBZd.exe
  C:\Windows\System\ImetBZd.exe
  2⤵
  PID:3400
- C:\Windows\System\kRJVlSE.exe
  C:\Windows\System\kRJVlSE.exe
  2⤵
  PID:2720
- C:\Windows\System\BeEcTvK.exe
  C:\Windows\System\BeEcTvK.exe
  2⤵
  PID:4068
- C:\Windows\System\bAWXXSc.exe
  C:\Windows\System\bAWXXSc.exe
  2⤵
  PID:3076
- C:\Windows\System\aRRyqrq.exe
  C:\Windows\System\aRRyqrq.exe
  2⤵
  PID:1940
- C:\Windows\System\FChyvyX.exe
  C:\Windows\System\FChyvyX.exe
  2⤵
  PID:1816
- C:\Windows\System\BLUVLKq.exe
  C:\Windows\System\BLUVLKq.exe
  2⤵
  PID:1656
- C:\Windows\System\vAtGFrm.exe
  C:\Windows\System\vAtGFrm.exe
  2⤵
  PID:1272
- C:\Windows\System\EcaLqYD.exe
  C:\Windows\System\EcaLqYD.exe
  2⤵
  PID:724
- C:\Windows\System\pbDexun.exe
  C:\Windows\System\pbDexun.exe
  2⤵
  PID:4748
- C:\Windows\System\HMRmupv.exe
  C:\Windows\System\HMRmupv.exe
  2⤵
  PID:4380
- C:\Windows\System\ffaeKgA.exe
  C:\Windows\System\ffaeKgA.exe
  2⤵
  PID:4076
- C:\Windows\System\lexHhaa.exe
  C:\Windows\System\lexHhaa.exe
  2⤵
  PID:760
- C:\Windows\System\DTrWTvN.exe
  C:\Windows\System\DTrWTvN.exe
  2⤵
  PID:3564
- C:\Windows\System\htITECc.exe
  C:\Windows\System\htITECc.exe
  2⤵
  PID:1568
- C:\Windows\System\vxZuuEJ.exe
  C:\Windows\System\vxZuuEJ.exe
  2⤵
  PID:3504
- C:\Windows\System\BQwSAnC.exe
  C:\Windows\System\BQwSAnC.exe
  2⤵
  PID:4560
- C:\Windows\System\uHYNaND.exe
  C:\Windows\System\uHYNaND.exe
  2⤵
  PID:4260
- C:\Windows\System\PfYAigi.exe
  C:\Windows\System\PfYAigi.exe
  2⤵
  PID:1996
- C:\Windows\System\iEHFPfr.exe
  C:\Windows\System\iEHFPfr.exe
  2⤵
  PID:3972
- C:\Windows\System\JfLtdXe.exe
  C:\Windows\System\JfLtdXe.exe
  2⤵
  PID:784
- C:\Windows\System\XFsQAfH.exe
  C:\Windows\System\XFsQAfH.exe
  2⤵
  PID:1664
- C:\Windows\System\fkpymhw.exe
  C:\Windows\System\fkpymhw.exe
  2⤵
  PID:1012
- C:\Windows\System\CAOzFQY.exe
  C:\Windows\System\CAOzFQY.exe
  2⤵
  PID:4904
- C:\Windows\System\sfLNYDh.exe
  C:\Windows\System\sfLNYDh.exe
  2⤵
  PID:2176
- C:\Windows\System\MzmmgDy.exe
  C:\Windows\System\MzmmgDy.exe
  2⤵
  PID:1020
- C:\Windows\System\YzmmePI.exe
  C:\Windows\System\YzmmePI.exe
  2⤵
  PID:264
- C:\Windows\System\CBRVhpZ.exe
  C:\Windows\System\CBRVhpZ.exe
  2⤵
  PID:620
- C:\Windows\System\idBmAMs.exe
  C:\Windows\System\idBmAMs.exe
  2⤵
  PID:4548
- C:\Windows\System\kRtZbUz.exe
  C:\Windows\System\kRtZbUz.exe
  2⤵
  PID:220
- C:\Windows\System\HlDyLWY.exe
  C:\Windows\System\HlDyLWY.exe
  2⤵
  PID:5032
- C:\Windows\System\mycyjzC.exe
  C:\Windows\System\mycyjzC.exe
  2⤵
  PID:2836
- C:\Windows\System\ObKUWAS.exe
  C:\Windows\System\ObKUWAS.exe
  2⤵
  PID:2936
- C:\Windows\System\XnWkqWi.exe
  C:\Windows\System\XnWkqWi.exe
  2⤵
  PID:1084
- C:\Windows\System\WjIhXAu.exe
  C:\Windows\System\WjIhXAu.exe
  2⤵
  PID:4836
- C:\Windows\System\OiPVnsU.exe
  C:\Windows\System\OiPVnsU.exe
  2⤵
  PID:3668
- C:\Windows\System\tBYvRoG.exe
  C:\Windows\System\tBYvRoG.exe
  2⤵
  PID:3340
- C:\Windows\System\hHxevHA.exe
  C:\Windows\System\hHxevHA.exe
  2⤵
  PID:3372
- C:\Windows\System\oLIHvKI.exe
  C:\Windows\System\oLIHvKI.exe
  2⤵
  PID:1396
- C:\Windows\System\WKzPcpX.exe
  C:\Windows\System\WKzPcpX.exe
  2⤵
  PID:2644
- C:\Windows\System\rhmrXQf.exe
  C:\Windows\System\rhmrXQf.exe
  2⤵
  PID:4720
- C:\Windows\System\PDKyayn.exe
  C:\Windows\System\PDKyayn.exe
  2⤵
  PID:2288
- C:\Windows\System\uWxyrob.exe
  C:\Windows\System\uWxyrob.exe
  2⤵
  PID:956
- C:\Windows\System\mFCQKrr.exe
  C:\Windows\System\mFCQKrr.exe
  2⤵
  PID:2580
- C:\Windows\System\YxtuqQi.exe
  C:\Windows\System\YxtuqQi.exe
  2⤵
  PID:3440
- C:\Windows\System\rVaylot.exe
  C:\Windows\System\rVaylot.exe
  2⤵
  PID:4640
- C:\Windows\System\gInqoNJ.exe
  C:\Windows\System\gInqoNJ.exe
  2⤵
  PID:3712
- C:\Windows\System\uBlqCgu.exe
  C:\Windows\System\uBlqCgu.exe
  2⤵
  PID:1488
- C:\Windows\System\HWlqEJo.exe
  C:\Windows\System\HWlqEJo.exe
  2⤵
  PID:872
- C:\Windows\System\eZpLvjA.exe
  C:\Windows\System\eZpLvjA.exe
  2⤵
  PID:2364
- C:\Windows\System\nwodncn.exe
  C:\Windows\System\nwodncn.exe
  2⤵
  PID:3224
- C:\Windows\System\AVpvOZA.exe
  C:\Windows\System\AVpvOZA.exe
  2⤵
  PID:3760
- C:\Windows\System\WXvclEV.exe
  C:\Windows\System\WXvclEV.exe
  2⤵
  PID:5144
- C:\Windows\System\tCSiUsE.exe
  C:\Windows\System\tCSiUsE.exe
  2⤵
  PID:5160
- C:\Windows\System\fzktxKn.exe
  C:\Windows\System\fzktxKn.exe
  2⤵
  PID:5180
- C:\Windows\System\ONQBgsm.exe
  C:\Windows\System\ONQBgsm.exe
  2⤵
  PID:5200
- C:\Windows\System\ospGJet.exe
  C:\Windows\System\ospGJet.exe
  2⤵
  PID:5228
- C:\Windows\System\nVaGtEc.exe
  C:\Windows\System\nVaGtEc.exe
  2⤵
  PID:5248
- C:\Windows\System\anauNfi.exe
  C:\Windows\System\anauNfi.exe
  2⤵
  PID:5272
- C:\Windows\System\BniEPXd.exe
  C:\Windows\System\BniEPXd.exe
  2⤵
  PID:5288
- C:\Windows\System\fwiKyQx.exe
  C:\Windows\System\fwiKyQx.exe
  2⤵
  PID:5312
- C:\Windows\System\McWSgkZ.exe
  C:\Windows\System\McWSgkZ.exe
  2⤵
  PID:5356
- C:\Windows\System\ErUXxis.exe
  C:\Windows\System\ErUXxis.exe
  2⤵
  PID:5380
- C:\Windows\System\LBBSVvu.exe
  C:\Windows\System\LBBSVvu.exe
  2⤵
  PID:5396
- C:\Windows\System\DcndnVx.exe
  C:\Windows\System\DcndnVx.exe
  2⤵
  PID:5428
- C:\Windows\System\myAmtLy.exe
  C:\Windows\System\myAmtLy.exe
  2⤵
  PID:5508
- C:\Windows\System\lWJheQQ.exe
  C:\Windows\System\lWJheQQ.exe
  2⤵
  PID:5528
- C:\Windows\System\NAIhKCJ.exe
  C:\Windows\System\NAIhKCJ.exe
  2⤵
  PID:5584
- C:\Windows\System\aOgKFtF.exe
  C:\Windows\System\aOgKFtF.exe
  2⤵
  PID:5604
- C:\Windows\System\aenisEe.exe
  C:\Windows\System\aenisEe.exe
  2⤵
  PID:5632
- C:\Windows\System\eGfdSql.exe
  C:\Windows\System\eGfdSql.exe
  2⤵
  PID:5660
- C:\Windows\System\eNLumhw.exe
  C:\Windows\System\eNLumhw.exe
  2⤵
  PID:5676
- C:\Windows\System\zCZwaBW.exe
  C:\Windows\System\zCZwaBW.exe
  2⤵
  PID:5700
- C:\Windows\System\FgYcCFk.exe
  C:\Windows\System\FgYcCFk.exe
  2⤵
  PID:5720
- C:\Windows\System\MJbmbJT.exe
  C:\Windows\System\MJbmbJT.exe
  2⤵
  PID:5748
- C:\Windows\System\CnRTWyj.exe
  C:\Windows\System\CnRTWyj.exe
  2⤵
  PID:5764
- C:\Windows\System\hbhAnJk.exe
  C:\Windows\System\hbhAnJk.exe
  2⤵
  PID:5788
- C:\Windows\System\UbQhuQD.exe
  C:\Windows\System\UbQhuQD.exe
  2⤵
  PID:5804
- C:\Windows\System\JOHKSPq.exe
  C:\Windows\System\JOHKSPq.exe
  2⤵
  PID:5832
- C:\Windows\System\kgCiMfH.exe
  C:\Windows\System\kgCiMfH.exe
  2⤵
  PID:5848
- C:\Windows\System\OjMSujM.exe
  C:\Windows\System\OjMSujM.exe
  2⤵
  PID:5896
- C:\Windows\System\sCCJFIj.exe
  C:\Windows\System\sCCJFIj.exe
  2⤵
  PID:5948
- C:\Windows\System\qpuTDcA.exe
  C:\Windows\System\qpuTDcA.exe
  2⤵
  PID:5964
- C:\Windows\System\gEgXqux.exe
  C:\Windows\System\gEgXqux.exe
  2⤵
  PID:5984
- C:\Windows\System\HDmNwUt.exe
  C:\Windows\System\HDmNwUt.exe
  2⤵
  PID:6004
- C:\Windows\System\YkMpLpX.exe
  C:\Windows\System\YkMpLpX.exe
  2⤵
  PID:6032
- C:\Windows\System\HWpTzJX.exe
  C:\Windows\System\HWpTzJX.exe
  2⤵
  PID:6048
- C:\Windows\System\YcZjXrK.exe
  C:\Windows\System\YcZjXrK.exe
  2⤵
  PID:6072
- C:\Windows\System\rUgTPEN.exe
  C:\Windows\System\rUgTPEN.exe
  2⤵
  PID:6088
- C:\Windows\System\hWfoBuS.exe
  C:\Windows\System\hWfoBuS.exe
  2⤵
  PID:6108
- C:\Windows\System\izKWlnx.exe
  C:\Windows\System\izKWlnx.exe
  2⤵
  PID:5196
- C:\Windows\System\FnOtPKs.exe
  C:\Windows\System\FnOtPKs.exe
  2⤵
  PID:5140
- C:\Windows\System\HIxJRBQ.exe
  C:\Windows\System\HIxJRBQ.exe
  2⤵
  PID:5368
- C:\Windows\System\ClOiCxv.exe
  C:\Windows\System\ClOiCxv.exe
  2⤵
  PID:5392
- C:\Windows\System\fPUDTAm.exe
  C:\Windows\System\fPUDTAm.exe
  2⤵
  PID:5460
- C:\Windows\System\NlpJKan.exe
  C:\Windows\System\NlpJKan.exe
  2⤵
  PID:5540
- C:\Windows\System\PLswlrM.exe
  C:\Windows\System\PLswlrM.exe
  2⤵
  PID:5616
- C:\Windows\System\hJxNbKl.exe
  C:\Windows\System\hJxNbKl.exe
  2⤵
  PID:5648
- C:\Windows\System\qhOCrMJ.exe
  C:\Windows\System\qhOCrMJ.exe
  2⤵
  PID:5732
- C:\Windows\System\WjlyuJd.exe
  C:\Windows\System\WjlyuJd.exe
  2⤵
  PID:5772
- C:\Windows\System\mGRCSdM.exe
  C:\Windows\System\mGRCSdM.exe
  2⤵
  PID:5888
- C:\Windows\System\ZfKVeTz.exe
  C:\Windows\System\ZfKVeTz.exe
  2⤵
  PID:5960
- C:\Windows\System\xLDTHpB.exe
  C:\Windows\System\xLDTHpB.exe
  2⤵
  PID:6020
- C:\Windows\System\FYOLCKm.exe
  C:\Windows\System\FYOLCKm.exe
  2⤵
  PID:6080
- C:\Windows\System\wnXfKbn.exe
  C:\Windows\System\wnXfKbn.exe
  2⤵
  PID:6104
- C:\Windows\System\HbVeVOj.exe
  C:\Windows\System\HbVeVOj.exe
  2⤵
  PID:5348
- C:\Windows\System\KaGFnhj.exe
  C:\Windows\System\KaGFnhj.exe
  2⤵
  PID:5468
- C:\Windows\System\CYzlEpI.exe
  C:\Windows\System\CYzlEpI.exe
  2⤵
  PID:5596
- C:\Windows\System\APSOZVB.exe
  C:\Windows\System\APSOZVB.exe
  2⤵
  PID:5756
- C:\Windows\System\ZbEyuji.exe
  C:\Windows\System\ZbEyuji.exe
  2⤵
  PID:5812
- C:\Windows\System\pownIWC.exe
  C:\Windows\System\pownIWC.exe
  2⤵
  PID:6084
- C:\Windows\System\FooDbDg.exe
  C:\Windows\System\FooDbDg.exe
  2⤵
  PID:5268
- C:\Windows\System\FvanzBE.exe
  C:\Windows\System\FvanzBE.exe
  2⤵
  PID:5308
- C:\Windows\System\xRrfQIQ.exe
  C:\Windows\System\xRrfQIQ.exe
  2⤵
  PID:5840
- C:\Windows\System\OkPWVDm.exe
  C:\Windows\System\OkPWVDm.exe
  2⤵
  PID:5304
- C:\Windows\System\YJtHoaa.exe
  C:\Windows\System\YJtHoaa.exe
  2⤵
  PID:6156
- C:\Windows\System\ZqhOTVm.exe
  C:\Windows\System\ZqhOTVm.exe
  2⤵
  PID:6172
- C:\Windows\System\tpCVqbX.exe
  C:\Windows\System\tpCVqbX.exe
  2⤵
  PID:6200
- C:\Windows\System\XzMmaoc.exe
  C:\Windows\System\XzMmaoc.exe
  2⤵
  PID:6248
- C:\Windows\System\cTjdvYM.exe
  C:\Windows\System\cTjdvYM.exe
  2⤵
  PID:6268
- C:\Windows\System\mtxLPoN.exe
  C:\Windows\System\mtxLPoN.exe
  2⤵
  PID:6296
- C:\Windows\System\qANzpkX.exe
  C:\Windows\System\qANzpkX.exe
  2⤵
  PID:6316
- C:\Windows\System\TPetAbf.exe
  C:\Windows\System\TPetAbf.exe
  2⤵
  PID:6344
- C:\Windows\System\UYoojyi.exe
  C:\Windows\System\UYoojyi.exe
  2⤵
  PID:6368
- C:\Windows\System\jUKynMm.exe
  C:\Windows\System\jUKynMm.exe
  2⤵
  PID:6396
- C:\Windows\System\zWHcopw.exe
  C:\Windows\System\zWHcopw.exe
  2⤵
  PID:6416
- C:\Windows\System\agrqPUR.exe
  C:\Windows\System\agrqPUR.exe
  2⤵
  PID:6448
- C:\Windows\System\TLgfeiN.exe
  C:\Windows\System\TLgfeiN.exe
  2⤵
  PID:6480
- C:\Windows\System\MLipEDd.exe
  C:\Windows\System\MLipEDd.exe
  2⤵
  PID:6524
- C:\Windows\System\XJTfvVR.exe
  C:\Windows\System\XJTfvVR.exe
  2⤵
  PID:6540
- C:\Windows\System\xOLqoHi.exe
  C:\Windows\System\xOLqoHi.exe
  2⤵
  PID:6568
- C:\Windows\System\MaicdVq.exe
  C:\Windows\System\MaicdVq.exe
  2⤵
  PID:6584
- C:\Windows\System\xmjCJev.exe
  C:\Windows\System\xmjCJev.exe
  2⤵
  PID:6608
- C:\Windows\System\IOvkjQY.exe
  C:\Windows\System\IOvkjQY.exe
  2⤵
  PID:6624
- C:\Windows\System\CPKwrer.exe
  C:\Windows\System\CPKwrer.exe
  2⤵
  PID:6692
- C:\Windows\System\gsqFhQU.exe
  C:\Windows\System\gsqFhQU.exe
  2⤵
  PID:6708
- C:\Windows\System\jwSTWdl.exe
  C:\Windows\System\jwSTWdl.exe
  2⤵
  PID:6732
- C:\Windows\System\TAlvguX.exe
  C:\Windows\System\TAlvguX.exe
  2⤵
  PID:6752
- C:\Windows\System\rGPHanv.exe
  C:\Windows\System\rGPHanv.exe
  2⤵
  PID:6828
- C:\Windows\System\DUfQZTK.exe
  C:\Windows\System\DUfQZTK.exe
  2⤵
  PID:6844
- C:\Windows\System\wHacTgN.exe
  C:\Windows\System\wHacTgN.exe
  2⤵
  PID:6872
- C:\Windows\System\qvfOtDO.exe
  C:\Windows\System\qvfOtDO.exe
  2⤵
  PID:6892
- C:\Windows\System\AiqZQVF.exe
  C:\Windows\System\AiqZQVF.exe
  2⤵
  PID:6916
- C:\Windows\System\MHbFrfj.exe
  C:\Windows\System\MHbFrfj.exe
  2⤵
  PID:6940
- C:\Windows\System\MaeQDDi.exe
  C:\Windows\System\MaeQDDi.exe
  2⤵
  PID:6956
- C:\Windows\System\qyAJKQc.exe
  C:\Windows\System\qyAJKQc.exe
  2⤵
  PID:6976
- C:\Windows\System\CnKRjmC.exe
  C:\Windows\System\CnKRjmC.exe
  2⤵
  PID:7004
- C:\Windows\System\kYUjDAv.exe
  C:\Windows\System\kYUjDAv.exe
  2⤵
  PID:7024
- C:\Windows\System\gmORpBp.exe
  C:\Windows\System\gmORpBp.exe
  2⤵
  PID:7072
- C:\Windows\System\nTPzFRm.exe
  C:\Windows\System\nTPzFRm.exe
  2⤵
  PID:7120
- C:\Windows\System\uDiQAll.exe
  C:\Windows\System\uDiQAll.exe
  2⤵
  PID:7140
- C:\Windows\System\mjlzDht.exe
  C:\Windows\System\mjlzDht.exe
  2⤵
  PID:6000
- C:\Windows\System\DBsOFvJ.exe
  C:\Windows\System\DBsOFvJ.exe
  2⤵
  PID:5932
- C:\Windows\System\ZpQmLxT.exe
  C:\Windows\System\ZpQmLxT.exe
  2⤵
  PID:6224
- C:\Windows\System\lnhEAlX.exe
  C:\Windows\System\lnhEAlX.exe
  2⤵
  PID:6192
- C:\Windows\System\dmxmkNr.exe
  C:\Windows\System\dmxmkNr.exe
  2⤵
  PID:6280
- C:\Windows\System\PdgcYre.exe
  C:\Windows\System\PdgcYre.exe
  2⤵
  PID:6364
- C:\Windows\System\eppIgFg.exe
  C:\Windows\System\eppIgFg.exe
  2⤵
  PID:6408
- C:\Windows\System\iomMQem.exe
  C:\Windows\System\iomMQem.exe
  2⤵
  PID:6444
- C:\Windows\System\HCekGJp.exe
  C:\Windows\System\HCekGJp.exe
  2⤵
  PID:6604
- C:\Windows\System\cMoJYVW.exe
  C:\Windows\System\cMoJYVW.exe
  2⤵
  PID:6660
- C:\Windows\System\VhUiVVm.exe
  C:\Windows\System\VhUiVVm.exe
  2⤵
  PID:6724
- C:\Windows\System\LAhVrnl.exe
  C:\Windows\System\LAhVrnl.exe
  2⤵
  PID:6772
- C:\Windows\System\QcpMkRy.exe
  C:\Windows\System\QcpMkRy.exe
  2⤵
  PID:6816
- C:\Windows\System\DSCPAUB.exe
  C:\Windows\System\DSCPAUB.exe
  2⤵
  PID:6884
- C:\Windows\System\aXeGltB.exe
  C:\Windows\System\aXeGltB.exe
  2⤵
  PID:6928
- C:\Windows\System\omeuTbY.exe
  C:\Windows\System\omeuTbY.exe
  2⤵
  PID:6984
- C:\Windows\System\DFwWuPz.exe
  C:\Windows\System\DFwWuPz.exe
  2⤵
  PID:7104
- C:\Windows\System\iSnpJMe.exe
  C:\Windows\System\iSnpJMe.exe
  2⤵
  PID:6220
- C:\Windows\System\DqFmaDd.exe
  C:\Windows\System\DqFmaDd.exe
  2⤵
  PID:6288
- C:\Windows\System\jIZBbwQ.exe
  C:\Windows\System\jIZBbwQ.exe
  2⤵
  PID:6536
- C:\Windows\System\wvdUJkd.exe
  C:\Windows\System\wvdUJkd.exe
  2⤵
  PID:6388
- C:\Windows\System\KgGytzH.exe
  C:\Windows\System\KgGytzH.exe
  2⤵
  PID:6656
- C:\Windows\System\nGJjamH.exe
  C:\Windows\System\nGJjamH.exe
  2⤵
  PID:6836
- C:\Windows\System\KAWUqPY.exe
  C:\Windows\System\KAWUqPY.exe
  2⤵
  PID:6792
- C:\Windows\System\qGwAtoL.exe
  C:\Windows\System\qGwAtoL.exe
  2⤵
  PID:7040
- C:\Windows\System\IwxmBAU.exe
  C:\Windows\System\IwxmBAU.exe
  2⤵
  PID:6644
- C:\Windows\System\WHpTZSG.exe
  C:\Windows\System\WHpTZSG.exe
  2⤵
  PID:6184
- C:\Windows\System\SpAIrgi.exe
  C:\Windows\System\SpAIrgi.exe
  2⤵
  PID:7184
- C:\Windows\System\GCEiFek.exe
  C:\Windows\System\GCEiFek.exe
  2⤵
  PID:7204
- C:\Windows\System\wgCTaDW.exe
  C:\Windows\System\wgCTaDW.exe
  2⤵
  PID:7220
- C:\Windows\System\yRoqkJv.exe
  C:\Windows\System\yRoqkJv.exe
  2⤵
  PID:7248
- C:\Windows\System\JJBXJbe.exe
  C:\Windows\System\JJBXJbe.exe
  2⤵
  PID:7264
- C:\Windows\System\ZfbhQON.exe
  C:\Windows\System\ZfbhQON.exe
  2⤵
  PID:7284
- C:\Windows\System\cfMtpRq.exe
  C:\Windows\System\cfMtpRq.exe
  2⤵
  PID:7332
- C:\Windows\System\LJNvOnc.exe
  C:\Windows\System\LJNvOnc.exe
  2⤵
  PID:7352
- C:\Windows\System\lgHVOPV.exe
  C:\Windows\System\lgHVOPV.exe
  2⤵
  PID:7376
- C:\Windows\System\kCkKGdz.exe
  C:\Windows\System\kCkKGdz.exe
  2⤵
  PID:7400
- C:\Windows\System\rfZUXQZ.exe
  C:\Windows\System\rfZUXQZ.exe
  2⤵
  PID:7416
- C:\Windows\System\jVnyQcH.exe
  C:\Windows\System\jVnyQcH.exe
  2⤵
  PID:7440
- C:\Windows\System\OoPtPzY.exe
  C:\Windows\System\OoPtPzY.exe
  2⤵
  PID:7460
- C:\Windows\System\TrzEJSL.exe
  C:\Windows\System\TrzEJSL.exe
  2⤵
  PID:7480
- C:\Windows\System\uvHwQMt.exe
  C:\Windows\System\uvHwQMt.exe
  2⤵
  PID:7512
- C:\Windows\System\TjnHRjD.exe
  C:\Windows\System\TjnHRjD.exe
  2⤵
  PID:7584
- C:\Windows\System\ujsySNQ.exe
  C:\Windows\System\ujsySNQ.exe
  2⤵
  PID:7604
- C:\Windows\System\BLFRrGM.exe
  C:\Windows\System\BLFRrGM.exe
  2⤵
  PID:7628
- C:\Windows\System\QRqJOVD.exe
  C:\Windows\System\QRqJOVD.exe
  2⤵
  PID:7648
- C:\Windows\System\rCejpsP.exe
  C:\Windows\System\rCejpsP.exe
  2⤵
  PID:7684
- C:\Windows\System\xPuYssU.exe
  C:\Windows\System\xPuYssU.exe
  2⤵
  PID:7720
- C:\Windows\System\OGMYlDL.exe
  C:\Windows\System\OGMYlDL.exe
  2⤵
  PID:7740
- C:\Windows\System\UTlMIEN.exe
  C:\Windows\System\UTlMIEN.exe
  2⤵
  PID:7760
- C:\Windows\System\QmXQHvh.exe
  C:\Windows\System\QmXQHvh.exe
  2⤵
  PID:7784
- C:\Windows\System\HcByJgo.exe
  C:\Windows\System\HcByJgo.exe
  2⤵
  PID:7800
- C:\Windows\System\wVaQAeB.exe
  C:\Windows\System\wVaQAeB.exe
  2⤵
  PID:7820
- C:\Windows\System\zBXQvZD.exe
  C:\Windows\System\zBXQvZD.exe
  2⤵
  PID:7852
- C:\Windows\System\FApUydl.exe
  C:\Windows\System\FApUydl.exe
  2⤵
  PID:7872
- C:\Windows\System\fFqYkyX.exe
  C:\Windows\System\fFqYkyX.exe
  2⤵
  PID:7928
- C:\Windows\System\jkxPMcq.exe
  C:\Windows\System\jkxPMcq.exe
  2⤵
  PID:7992
- C:\Windows\System\shDQnMM.exe
  C:\Windows\System\shDQnMM.exe
  2⤵
  PID:8024
- C:\Windows\System\TGvZUIr.exe
  C:\Windows\System\TGvZUIr.exe
  2⤵
  PID:8040
- C:\Windows\System\qOgzySc.exe
  C:\Windows\System\qOgzySc.exe
  2⤵
  PID:8064
- C:\Windows\System\UlVQolO.exe
  C:\Windows\System\UlVQolO.exe
  2⤵
  PID:8112
- C:\Windows\System\kMdNKWw.exe
  C:\Windows\System\kMdNKWw.exe
  2⤵
  PID:8132
- C:\Windows\System\KLInWUG.exe
  C:\Windows\System\KLInWUG.exe
  2⤵
  PID:8160
- C:\Windows\System\YTewTzA.exe
  C:\Windows\System\YTewTzA.exe
  2⤵
  PID:8176
- C:\Windows\System\qNMrIpT.exe
  C:\Windows\System\qNMrIpT.exe
  2⤵
  PID:6164
- C:\Windows\System\MrZfSyy.exe
  C:\Windows\System\MrZfSyy.exe
  2⤵
  PID:6852
- C:\Windows\System\wyqwGaj.exe
  C:\Windows\System\wyqwGaj.exe
  2⤵
  PID:7196
- C:\Windows\System\JYRDlZk.exe
  C:\Windows\System\JYRDlZk.exe
  2⤵
  PID:7276
- C:\Windows\System\WGLoMDC.exe
  C:\Windows\System\WGLoMDC.exe
  2⤵
  PID:7368
- C:\Windows\System\fVYngOC.exe
  C:\Windows\System\fVYngOC.exe
  2⤵
  PID:7468
- C:\Windows\System\WeekBgN.exe
  C:\Windows\System\WeekBgN.exe
  2⤵
  PID:7408
- C:\Windows\System\kLjkitI.exe
  C:\Windows\System\kLjkitI.exe
  2⤵
  PID:7560
- C:\Windows\System\sGzbrNi.exe
  C:\Windows\System\sGzbrNi.exe
  2⤵
  PID:7624
- C:\Windows\System\fuKhdVA.exe
  C:\Windows\System\fuKhdVA.exe
  2⤵
  PID:7696
- C:\Windows\System\lkXPQaN.exe
  C:\Windows\System\lkXPQaN.exe
  2⤵
  PID:7796
- C:\Windows\System\xrntlkt.exe
  C:\Windows\System\xrntlkt.exe
  2⤵
  PID:7868
- C:\Windows\System\rKkMZLv.exe
  C:\Windows\System\rKkMZLv.exe
  2⤵
  PID:7912
- C:\Windows\System\DEgBgGE.exe
  C:\Windows\System\DEgBgGE.exe
  2⤵
  PID:6600
- C:\Windows\System\kAzUrNk.exe
  C:\Windows\System\kAzUrNk.exe
  2⤵
  PID:8096
- C:\Windows\System\PPeBdjp.exe
  C:\Windows\System\PPeBdjp.exe
  2⤵
  PID:8168
- C:\Windows\System\YkDQaNT.exe
  C:\Windows\System\YkDQaNT.exe
  2⤵
  PID:7216
- C:\Windows\System\aptkrYp.exe
  C:\Windows\System\aptkrYp.exe
  2⤵
  PID:6744
- C:\Windows\System\SgImDty.exe
  C:\Windows\System\SgImDty.exe
  2⤵
  PID:7728
- C:\Windows\System\qOLmtrg.exe
  C:\Windows\System\qOLmtrg.exe
  2⤵
  PID:7524
- C:\Windows\System\GnuMZLW.exe
  C:\Windows\System\GnuMZLW.exe
  2⤵
  PID:7680
- C:\Windows\System\kMDleeK.exe
  C:\Windows\System\kMDleeK.exe
  2⤵
  PID:7900
- C:\Windows\System\zqLCBrI.exe
  C:\Windows\System\zqLCBrI.exe
  2⤵
  PID:7984
- C:\Windows\System\ayMNQap.exe
  C:\Windows\System\ayMNQap.exe
  2⤵
  PID:8088
- C:\Windows\System\nabYURA.exe
  C:\Windows\System\nabYURA.exe
  2⤵
  PID:7532
- C:\Windows\System\ECjbDRk.exe
  C:\Windows\System\ECjbDRk.exe
  2⤵
  PID:8128
- C:\Windows\System\nDQqMhP.exe
  C:\Windows\System\nDQqMhP.exe
  2⤵
  PID:7676
- C:\Windows\System\zabHbcC.exe
  C:\Windows\System\zabHbcC.exe
  2⤵
  PID:8032
- C:\Windows\System\uvJidAb.exe
  C:\Windows\System\uvJidAb.exe
  2⤵
  PID:8212
- C:\Windows\System\NxnBtgn.exe
  C:\Windows\System\NxnBtgn.exe
  2⤵
  PID:8228
- C:\Windows\System\kNQJoNi.exe
  C:\Windows\System\kNQJoNi.exe
  2⤵
  PID:8264
- C:\Windows\System\ealbInz.exe
  C:\Windows\System\ealbInz.exe
  2⤵
  PID:8300
- C:\Windows\System\BiWtdAA.exe
  C:\Windows\System\BiWtdAA.exe
  2⤵
  PID:8332
- C:\Windows\System\cFMIZFm.exe
  C:\Windows\System\cFMIZFm.exe
  2⤵
  PID:8356
- C:\Windows\System\oisaYMT.exe
  C:\Windows\System\oisaYMT.exe
  2⤵
  PID:8372
- C:\Windows\System\rJHnwVW.exe
  C:\Windows\System\rJHnwVW.exe
  2⤵
  PID:8392
- C:\Windows\System\yIitbuw.exe
  C:\Windows\System\yIitbuw.exe
  2⤵
  PID:8412
- C:\Windows\System\eIBbTxm.exe
  C:\Windows\System\eIBbTxm.exe
  2⤵
  PID:8460
- C:\Windows\System\AxhDXiu.exe
  C:\Windows\System\AxhDXiu.exe
  2⤵
  PID:8484
- C:\Windows\System\iHvzsWx.exe
  C:\Windows\System\iHvzsWx.exe
  2⤵
  PID:8524
- C:\Windows\System\JyfdgCT.exe
  C:\Windows\System\JyfdgCT.exe
  2⤵
  PID:8552
- C:\Windows\System\NDqMrcV.exe
  C:\Windows\System\NDqMrcV.exe
  2⤵
  PID:8580
- C:\Windows\System\bjesxKj.exe
  C:\Windows\System\bjesxKj.exe
  2⤵
  PID:8596
- C:\Windows\System\BMLPGxd.exe
  C:\Windows\System\BMLPGxd.exe
  2⤵
  PID:8620
- C:\Windows\System\muWsIpB.exe
  C:\Windows\System\muWsIpB.exe
  2⤵
  PID:8640
- C:\Windows\System\xCmhwMx.exe
  C:\Windows\System\xCmhwMx.exe
  2⤵
  PID:8684
- C:\Windows\System\PoqUHCN.exe
  C:\Windows\System\PoqUHCN.exe
  2⤵
  PID:8708
- C:\Windows\System\DahzvtC.exe
  C:\Windows\System\DahzvtC.exe
  2⤵
  PID:8752
- C:\Windows\System\GTfXFrf.exe
  C:\Windows\System\GTfXFrf.exe
  2⤵
  PID:8780
- C:\Windows\System\iTOeZtE.exe
  C:\Windows\System\iTOeZtE.exe
  2⤵
  PID:8804
- C:\Windows\System\VXNyHMk.exe
  C:\Windows\System\VXNyHMk.exe
  2⤵
  PID:8844
- C:\Windows\System\kSimHIV.exe
  C:\Windows\System\kSimHIV.exe
  2⤵
  PID:8860
- C:\Windows\System\Pksttcg.exe
  C:\Windows\System\Pksttcg.exe
  2⤵
  PID:8900
- C:\Windows\System\gunnRSM.exe
  C:\Windows\System\gunnRSM.exe
  2⤵
  PID:8916
- C:\Windows\System\dmcUXhc.exe
  C:\Windows\System\dmcUXhc.exe
  2⤵
  PID:8944
- C:\Windows\System\YSaedhW.exe
  C:\Windows\System\YSaedhW.exe
  2⤵
  PID:8964
- C:\Windows\System\mcuuiCq.exe
  C:\Windows\System\mcuuiCq.exe
  2⤵
  PID:8992
- C:\Windows\System\cGaiOde.exe
  C:\Windows\System\cGaiOde.exe
  2⤵
  PID:9032
- C:\Windows\System\EAVgwtl.exe
  C:\Windows\System\EAVgwtl.exe
  2⤵
  PID:9060
- C:\Windows\System\ASgAAxi.exe
  C:\Windows\System\ASgAAxi.exe
  2⤵
  PID:9084
- C:\Windows\System\CbVnMJY.exe
  C:\Windows\System\CbVnMJY.exe
  2⤵
  PID:9104
- C:\Windows\System\TUhgIhw.exe
  C:\Windows\System\TUhgIhw.exe
  2⤵
  PID:9132
- C:\Windows\System\fLnYamR.exe
  C:\Windows\System\fLnYamR.exe
  2⤵
  PID:9192
- C:\Windows\System\NNGQzkq.exe
  C:\Windows\System\NNGQzkq.exe
  2⤵
  PID:8204
- C:\Windows\System\NxknaNz.exe
  C:\Windows\System\NxknaNz.exe
  2⤵
  PID:8256
- C:\Windows\System\PihRuDC.exe
  C:\Windows\System\PihRuDC.exe
  2⤵
  PID:8320
- C:\Windows\System\TFYNfGd.exe
  C:\Windows\System\TFYNfGd.exe
  2⤵
  PID:8400
- C:\Windows\System\fmsYKlG.exe
  C:\Windows\System\fmsYKlG.exe
  2⤵
  PID:8368
- C:\Windows\System\Aiypvni.exe
  C:\Windows\System\Aiypvni.exe
  2⤵
  PID:8452
- C:\Windows\System\xIIJghE.exe
  C:\Windows\System\xIIJghE.exe
  2⤵
  PID:8504
- C:\Windows\System\YcVReFS.exe
  C:\Windows\System\YcVReFS.exe
  2⤵
  PID:8548
- C:\Windows\System\xdpYdJI.exe
  C:\Windows\System\xdpYdJI.exe
  2⤵
  PID:8576
- C:\Windows\System\cwltdpN.exe
  C:\Windows\System\cwltdpN.exe
  2⤵
  PID:8660
- C:\Windows\System\SxOyiAi.exe
  C:\Windows\System\SxOyiAi.exe
  2⤵
  PID:8632
- C:\Windows\System\wGbbhTG.exe
  C:\Windows\System\wGbbhTG.exe
  2⤵
  PID:8896
- C:\Windows\System\oPfDfAt.exe
  C:\Windows\System\oPfDfAt.exe
  2⤵
  PID:8936
- C:\Windows\System\DFohCsd.exe
  C:\Windows\System\DFohCsd.exe
  2⤵
  PID:9028
- C:\Windows\System\GwJJNmC.exe
  C:\Windows\System\GwJJNmC.exe
  2⤵
  PID:9144
- C:\Windows\System\mKzQchv.exe
  C:\Windows\System\mKzQchv.exe
  2⤵
  PID:7548
- C:\Windows\System\BHZItPp.exe
  C:\Windows\System\BHZItPp.exe
  2⤵
  PID:8348
- C:\Windows\System\MWBfDnQ.exe
  C:\Windows\System\MWBfDnQ.exe
  2⤵
  PID:9112
- C:\Windows\System\fIiRgjB.exe
  C:\Windows\System\fIiRgjB.exe
  2⤵
  PID:8292
- C:\Windows\System\wsMVCOE.exe
  C:\Windows\System\wsMVCOE.exe
  2⤵
  PID:8388
- C:\Windows\System\aFaynkp.exe
  C:\Windows\System\aFaynkp.exe
  2⤵
  PID:8728
- C:\Windows\System\VDNmAAT.exe
  C:\Windows\System\VDNmAAT.exe
  2⤵
  PID:8456
- C:\Windows\System\KSUMINs.exe
  C:\Windows\System\KSUMINs.exe
  2⤵
  PID:8836
- C:\Windows\System\YSArEnp.exe
  C:\Windows\System\YSArEnp.exe
  2⤵
  PID:8912
- C:\Windows\System\VaZFcZQ.exe
  C:\Windows\System\VaZFcZQ.exe
  2⤵
  PID:8220
- C:\Windows\System\PpWENKg.exe
  C:\Windows\System\PpWENKg.exe
  2⤵
  PID:8244
- C:\Windows\System\ZlnNgwR.exe
  C:\Windows\System\ZlnNgwR.exe
  2⤵
  PID:9056
- C:\Windows\System\OLqtcoF.exe
  C:\Windows\System\OLqtcoF.exe
  2⤵
  PID:9244
- C:\Windows\System\SEQxryi.exe
  C:\Windows\System\SEQxryi.exe
  2⤵
  PID:9268
- C:\Windows\System\ypYUIkd.exe
  C:\Windows\System\ypYUIkd.exe
  2⤵
  PID:9288
- C:\Windows\System\GUNOubb.exe
  C:\Windows\System\GUNOubb.exe
  2⤵
  PID:9316
- C:\Windows\System\DamRMMW.exe
  C:\Windows\System\DamRMMW.exe
  2⤵
  PID:9360
- C:\Windows\System\PeuWMHe.exe
  C:\Windows\System\PeuWMHe.exe
  2⤵
  PID:9400
- C:\Windows\System\ALaIQmB.exe
  C:\Windows\System\ALaIQmB.exe
  2⤵
  PID:9420
- C:\Windows\System\lozClvf.exe
  C:\Windows\System\lozClvf.exe
  2⤵
  PID:9436
- C:\Windows\System\QRsdnNQ.exe
  C:\Windows\System\QRsdnNQ.exe
  2⤵
  PID:9508
- C:\Windows\System\rvlHUJA.exe
  C:\Windows\System\rvlHUJA.exe
  2⤵
  PID:9528
- C:\Windows\System\oyfbsWO.exe
  C:\Windows\System\oyfbsWO.exe
  2⤵
  PID:9544
- C:\Windows\System\AgdpsKm.exe
  C:\Windows\System\AgdpsKm.exe
  2⤵
  PID:9564
- C:\Windows\System\qRNtdOt.exe
  C:\Windows\System\qRNtdOt.exe
  2⤵
  PID:9584
- C:\Windows\System\dcHpCmN.exe
  C:\Windows\System\dcHpCmN.exe
  2⤵
  PID:9632
- C:\Windows\System\jkSFZbx.exe
  C:\Windows\System\jkSFZbx.exe
  2⤵
  PID:9648
- C:\Windows\System\OXLOSSS.exe
  C:\Windows\System\OXLOSSS.exe
  2⤵
  PID:9680
- C:\Windows\System\ViaYGRl.exe
  C:\Windows\System\ViaYGRl.exe
  2⤵
  PID:9708
- C:\Windows\System\xbAKNoI.exe
  C:\Windows\System\xbAKNoI.exe
  2⤵
  PID:9740
- C:\Windows\System\tFaYgsn.exe
  C:\Windows\System\tFaYgsn.exe
  2⤵
  PID:9776
- C:\Windows\System\BOVznEW.exe
  C:\Windows\System\BOVznEW.exe
  2⤵
  PID:9804
- C:\Windows\System\JOxDfqk.exe
  C:\Windows\System\JOxDfqk.exe
  2⤵
  PID:9832
- C:\Windows\System\AzxFHcS.exe
  C:\Windows\System\AzxFHcS.exe
  2⤵
  PID:9856
- C:\Windows\System\KmmdzUy.exe
  C:\Windows\System\KmmdzUy.exe
  2⤵
  PID:9876
- C:\Windows\System\VLRBmdU.exe
  C:\Windows\System\VLRBmdU.exe
  2⤵
  PID:9896
- C:\Windows\System\ArmPVjy.exe
  C:\Windows\System\ArmPVjy.exe
  2⤵
  PID:9944
- C:\Windows\System\SlIQgWq.exe
  C:\Windows\System\SlIQgWq.exe
  2⤵
  PID:9968
- C:\Windows\System\bawjScb.exe
  C:\Windows\System\bawjScb.exe
  2⤵
  PID:9988
- C:\Windows\System\FxMaDnb.exe
  C:\Windows\System\FxMaDnb.exe
  2⤵
  PID:10016
- C:\Windows\System\bsSGjYH.exe
  C:\Windows\System\bsSGjYH.exe
  2⤵
  PID:10056
- C:\Windows\System\lKewjks.exe
  C:\Windows\System\lKewjks.exe
  2⤵
  PID:10084
- C:\Windows\System\PmgolkZ.exe
  C:\Windows\System\PmgolkZ.exe
  2⤵
  PID:10112
- C:\Windows\System\FTaRcAQ.exe
  C:\Windows\System\FTaRcAQ.exe
  2⤵
  PID:10160
- C:\Windows\System\TMoeMjI.exe
  C:\Windows\System\TMoeMjI.exe
  2⤵
  PID:10176
- C:\Windows\System\LWTaBbE.exe
  C:\Windows\System\LWTaBbE.exe
  2⤵
  PID:10192
- C:\Windows\System\NBPEWjz.exe
  C:\Windows\System\NBPEWjz.exe
  2⤵
  PID:10212
- C:\Windows\System\WGEqYIT.exe
  C:\Windows\System\WGEqYIT.exe
  2⤵
  PID:10236
- C:\Windows\System\dEwPqyZ.exe
  C:\Windows\System\dEwPqyZ.exe
  2⤵
  PID:9200
- C:\Windows\System\hCXPQHK.exe
  C:\Windows\System\hCXPQHK.exe
  2⤵
  PID:9220
- C:\Windows\System\AYQqOmZ.exe
  C:\Windows\System\AYQqOmZ.exe
  2⤵
  PID:9300
- C:\Windows\System\eVvBmaj.exe
  C:\Windows\System\eVvBmaj.exe
  2⤵
  PID:9408
- C:\Windows\System\oMuqdki.exe
  C:\Windows\System\oMuqdki.exe
  2⤵
  PID:9444
- C:\Windows\System\FUNbujs.exe
  C:\Windows\System\FUNbujs.exe
  2⤵
  PID:9516
- C:\Windows\System\DTsDKGB.exe
  C:\Windows\System\DTsDKGB.exe
  2⤵
  PID:9612
- C:\Windows\System\yBMbWgM.exe
  C:\Windows\System\yBMbWgM.exe
  2⤵
  PID:9688
- C:\Windows\System\SPOANNX.exe
  C:\Windows\System\SPOANNX.exe
  2⤵
  PID:9704
- C:\Windows\System\tdfQNJv.exe
  C:\Windows\System\tdfQNJv.exe
  2⤵
  PID:9784
- C:\Windows\System\PZCfgmq.exe
  C:\Windows\System\PZCfgmq.exe
  2⤵
  PID:9796
- C:\Windows\System\nIpcKiQ.exe
  C:\Windows\System\nIpcKiQ.exe
  2⤵
  PID:9844
- C:\Windows\System\yCzaCJV.exe
  C:\Windows\System\yCzaCJV.exe
  2⤵
  PID:9940
- C:\Windows\System\YIVHATB.exe
  C:\Windows\System\YIVHATB.exe
  2⤵
  PID:10032
- C:\Windows\System\AQjQFAX.exe
  C:\Windows\System\AQjQFAX.exe
  2⤵
  PID:10144
- C:\Windows\System\IEPeDeZ.exe
  C:\Windows\System\IEPeDeZ.exe
  2⤵
  PID:10204
- C:\Windows\System\TwARgiu.exe
  C:\Windows\System\TwARgiu.exe
  2⤵
  PID:10228
- C:\Windows\System\CSpXFQa.exe
  C:\Windows\System\CSpXFQa.exe
  2⤵
  PID:8344
- C:\Windows\System\IXcRGqQ.exe
  C:\Windows\System\IXcRGqQ.exe
  2⤵
  PID:9380
- C:\Windows\System\EBInAow.exe
  C:\Windows\System\EBInAow.exe
  2⤵
  PID:3756
- C:\Windows\System\ZXYsepR.exe
  C:\Windows\System\ZXYsepR.exe
  2⤵
  PID:9576
- C:\Windows\System\qMQDLba.exe
  C:\Windows\System\qMQDLba.exe
  2⤵
  PID:9812
- C:\Windows\System\JJihCkA.exe
  C:\Windows\System\JJihCkA.exe
  2⤵
  PID:9952
- C:\Windows\System\iLpLTRI.exe
  C:\Windows\System\iLpLTRI.exe
  2⤵
  PID:10104
- C:\Windows\System\iOqlZCm.exe
  C:\Windows\System\iOqlZCm.exe
  2⤵
  PID:9180
- C:\Windows\System\TJXYkcV.exe
  C:\Windows\System\TJXYkcV.exe
  2⤵
  PID:9556
- C:\Windows\System\KHqcStp.exe
  C:\Windows\System\KHqcStp.exe
  2⤵
  PID:9864
- C:\Windows\System\zcZZLLx.exe
  C:\Windows\System\zcZZLLx.exe
  2⤵
  PID:10220
- C:\Windows\System\VJZgkoO.exe
  C:\Windows\System\VJZgkoO.exe
  2⤵
  PID:9736
- C:\Windows\System\trwQKTi.exe
  C:\Windows\System\trwQKTi.exe
  2⤵
  PID:10260
- C:\Windows\System\LXpDizc.exe
  C:\Windows\System\LXpDizc.exe
  2⤵
  PID:10288
- C:\Windows\System\mibSlWB.exe
  C:\Windows\System\mibSlWB.exe
  2⤵
  PID:10308
- C:\Windows\System\XHajjRq.exe
  C:\Windows\System\XHajjRq.exe
  2⤵
  PID:10328
- C:\Windows\System\HIHWWsr.exe
  C:\Windows\System\HIHWWsr.exe
  2⤵
  PID:10364
- C:\Windows\System\ysqrENA.exe
  C:\Windows\System\ysqrENA.exe
  2⤵
  PID:10380
- C:\Windows\System\bQEQsUH.exe
  C:\Windows\System\bQEQsUH.exe
  2⤵
  PID:10436
- C:\Windows\System\PiYgPLf.exe
  C:\Windows\System\PiYgPLf.exe
  2⤵
  PID:10468
- C:\Windows\System\wNdovJW.exe
  C:\Windows\System\wNdovJW.exe
  2⤵
  PID:10488
- C:\Windows\System\MuhZwUz.exe
  C:\Windows\System\MuhZwUz.exe
  2⤵
  PID:10544
- C:\Windows\System\ZTNXXMz.exe
  C:\Windows\System\ZTNXXMz.exe
  2⤵
  PID:10564
- C:\Windows\System\xZjdmBU.exe
  C:\Windows\System\xZjdmBU.exe
  2⤵
  PID:10592
- C:\Windows\System\HcvSkfi.exe
  C:\Windows\System\HcvSkfi.exe
  2⤵
  PID:10612
- C:\Windows\System\owSQqsZ.exe
  C:\Windows\System\owSQqsZ.exe
  2⤵
  PID:10632
- C:\Windows\System\HJipLLu.exe
  C:\Windows\System\HJipLLu.exe
  2⤵
  PID:10676
- C:\Windows\System\nghLRCW.exe
  C:\Windows\System\nghLRCW.exe
  2⤵
  PID:10704
- C:\Windows\System\CpPeUKG.exe
  C:\Windows\System\CpPeUKG.exe
  2⤵
  PID:10732
- C:\Windows\System\QUHJXdg.exe
  C:\Windows\System\QUHJXdg.exe
  2⤵
  PID:10752
- C:\Windows\System\hxdCPgc.exe
  C:\Windows\System\hxdCPgc.exe
  2⤵
  PID:10776
- C:\Windows\System\EAmDzJL.exe
  C:\Windows\System\EAmDzJL.exe
  2⤵
  PID:10800
- C:\Windows\System\BrlUvjx.exe
  C:\Windows\System\BrlUvjx.exe
  2⤵
  PID:10840
- C:\Windows\System\tURHGZG.exe
  C:\Windows\System\tURHGZG.exe
  2⤵
  PID:10864
- C:\Windows\System\lzXPJED.exe
  C:\Windows\System\lzXPJED.exe
  2⤵
  PID:10896
- C:\Windows\System\XNMTzuu.exe
  C:\Windows\System\XNMTzuu.exe
  2⤵
  PID:10920
- C:\Windows\System\uNFEQrS.exe
  C:\Windows\System\uNFEQrS.exe
  2⤵
  PID:10940
- C:\Windows\System\AmOPGjb.exe
  C:\Windows\System\AmOPGjb.exe
  2⤵
  PID:10964
- C:\Windows\System\xkBgnhj.exe
  C:\Windows\System\xkBgnhj.exe
  2⤵
  PID:10988
- C:\Windows\System\FLmVmyi.exe
  C:\Windows\System\FLmVmyi.exe
  2⤵
  PID:11012
- C:\Windows\System\oUuRmYo.exe
  C:\Windows\System\oUuRmYo.exe
  2⤵
  PID:11056
- C:\Windows\System\kvBFNal.exe
  C:\Windows\System\kvBFNal.exe
  2⤵
  PID:11088
- C:\Windows\System\sQpedaX.exe
  C:\Windows\System\sQpedaX.exe
  2⤵
  PID:11136
- C:\Windows\System\ZYClFZu.exe
  C:\Windows\System\ZYClFZu.exe
  2⤵
  PID:11168
- C:\Windows\System\MDwadPW.exe
  C:\Windows\System\MDwadPW.exe
  2⤵
  PID:11192
- C:\Windows\System\xYLKgnt.exe
  C:\Windows\System\xYLKgnt.exe
  2⤵
  PID:11208
- C:\Windows\System\zbExpnQ.exe
  C:\Windows\System\zbExpnQ.exe
  2⤵
  PID:11232
- C:\Windows\System\beXUght.exe
  C:\Windows\System\beXUght.exe
  2⤵
  PID:11256
- C:\Windows\System\waAiuuc.exe
  C:\Windows\System\waAiuuc.exe
  2⤵
  PID:10256
- C:\Windows\System\tKgFiDp.exe
  C:\Windows\System\tKgFiDp.exe
  2⤵
  PID:10296
- C:\Windows\System\DlDHkFk.exe
  C:\Windows\System\DlDHkFk.exe
  2⤵
  PID:10496
- C:\Windows\System\VEQrMOo.exe
  C:\Windows\System\VEQrMOo.exe
  2⤵
  PID:10444
- C:\Windows\System\RnkzBze.exe
  C:\Windows\System\RnkzBze.exe
  2⤵
  PID:10572
- C:\Windows\System\jtjSkAo.exe
  C:\Windows\System\jtjSkAo.exe
  2⤵
  PID:10604
- C:\Windows\System\XFwwVtX.exe
  C:\Windows\System\XFwwVtX.exe
  2⤵
  PID:10672
- C:\Windows\System\qCpUcfw.exe
  C:\Windows\System\qCpUcfw.exe
  2⤵
  PID:10748
- C:\Windows\System\BsVEbmX.exe
  C:\Windows\System\BsVEbmX.exe
  2⤵
  PID:10796
- C:\Windows\System\BhAQksS.exe
  C:\Windows\System\BhAQksS.exe
  2⤵
  PID:10908
- C:\Windows\System\tDlkhyb.exe
  C:\Windows\System\tDlkhyb.exe
  2⤵
  PID:10948
- C:\Windows\System\DJCmhfi.exe
  C:\Windows\System\DJCmhfi.exe
  2⤵
  PID:11036
- C:\Windows\System\mVpwYsB.exe
  C:\Windows\System\mVpwYsB.exe
  2⤵
  PID:11084
- C:\Windows\System\SkjgMiI.exe
  C:\Windows\System\SkjgMiI.exe
  2⤵
  PID:11144
- C:\Windows\System\luhOpLW.exe
  C:\Windows\System\luhOpLW.exe
  2⤵
  PID:11152
- C:\Windows\System\EvgIIDN.exe
  C:\Windows\System\EvgIIDN.exe
  2⤵
  PID:11200
- C:\Windows\System\irdhKZS.exe
  C:\Windows\System\irdhKZS.exe
  2⤵
  PID:10252
- C:\Windows\System\KWXCNqd.exe
  C:\Windows\System\KWXCNqd.exe
  2⤵
  PID:10404
- C:\Windows\System\rqNfPsc.exe
  C:\Windows\System\rqNfPsc.exe
  2⤵
  PID:10628
- C:\Windows\System\qFYyHww.exe
  C:\Windows\System\qFYyHww.exe
  2⤵
  PID:10784
- C:\Windows\System\QwvdzNj.exe
  C:\Windows\System\QwvdzNj.exe
  2⤵
  PID:11040
- C:\Windows\System\HqJykqu.exe
  C:\Windows\System\HqJykqu.exe
  2⤵
  PID:9384
- C:\Windows\System\pjSyXhm.exe
  C:\Windows\System\pjSyXhm.exe
  2⤵
  PID:10284
- C:\Windows\System\VPfVdbX.exe
  C:\Windows\System\VPfVdbX.exe
  2⤵
  PID:10720
- C:\Windows\System\srBzOsY.exe
  C:\Windows\System\srBzOsY.exe
  2⤵
  PID:11124
- C:\Windows\System\YLGHQQx.exe
  C:\Windows\System\YLGHQQx.exe
  2⤵
  PID:11228
- C:\Windows\System\mYpzGQe.exe
  C:\Windows\System\mYpzGQe.exe
  2⤵
  PID:11276
- C:\Windows\System\DpgWeBh.exe
  C:\Windows\System\DpgWeBh.exe
  2⤵
  PID:11296
- C:\Windows\System\qaWgMHn.exe
  C:\Windows\System\qaWgMHn.exe
  2⤵
  PID:11316
- C:\Windows\System\qeooApb.exe
  C:\Windows\System\qeooApb.exe
  2⤵
  PID:11332
- C:\Windows\System\VHsqUid.exe
  C:\Windows\System\VHsqUid.exe
  2⤵
  PID:11372
- C:\Windows\System\dtkiFFa.exe
  C:\Windows\System\dtkiFFa.exe
  2⤵
  PID:11400
- C:\Windows\System\SVnpFtC.exe
  C:\Windows\System\SVnpFtC.exe
  2⤵
  PID:11444
- C:\Windows\System\rvKiMtF.exe
  C:\Windows\System\rvKiMtF.exe
  2⤵
  PID:11472
- C:\Windows\System\iADVCYw.exe
  C:\Windows\System\iADVCYw.exe
  2⤵
  PID:11496
- C:\Windows\System\xSICBZQ.exe
  C:\Windows\System\xSICBZQ.exe
  2⤵
  PID:11512
- C:\Windows\System\qsnPWSw.exe
  C:\Windows\System\qsnPWSw.exe
  2⤵
  PID:11536
- C:\Windows\System\NKSSgFh.exe
  C:\Windows\System\NKSSgFh.exe
  2⤵
  PID:11564
- C:\Windows\System\hAVcyfX.exe
  C:\Windows\System\hAVcyfX.exe
  2⤵
  PID:11612
- C:\Windows\System\qrUqLrr.exe
  C:\Windows\System\qrUqLrr.exe
  2⤵
  PID:11636
- C:\Windows\System\gzfIVsO.exe
  C:\Windows\System\gzfIVsO.exe
  2⤵
  PID:11656
- C:\Windows\System\wXWHNij.exe
  C:\Windows\System\wXWHNij.exe
  2⤵
  PID:11676
- C:\Windows\System\aDcyAzD.exe
  C:\Windows\System\aDcyAzD.exe
  2⤵
  PID:11744
- C:\Windows\System\YoBqoWI.exe
  C:\Windows\System\YoBqoWI.exe
  2⤵
  PID:11768
- C:\Windows\System\AREkWXg.exe
  C:\Windows\System\AREkWXg.exe
  2⤵
  PID:11784
- C:\Windows\System\BNrNJAG.exe
  C:\Windows\System\BNrNJAG.exe
  2⤵
  PID:11808
- C:\Windows\System\outsBhk.exe
  C:\Windows\System\outsBhk.exe
  2⤵
  PID:11844
- C:\Windows\System\fYAlCzq.exe
  C:\Windows\System\fYAlCzq.exe
  2⤵
  PID:11876
- C:\Windows\System\ZyBNtOV.exe
  C:\Windows\System\ZyBNtOV.exe
  2⤵
  PID:11900
- C:\Windows\System\fJcEzfl.exe
  C:\Windows\System\fJcEzfl.exe
  2⤵
  PID:11920
- C:\Windows\System\ixmtAxj.exe
  C:\Windows\System\ixmtAxj.exe
  2⤵
  PID:11948
- C:\Windows\System\xKCITVI.exe
  C:\Windows\System\xKCITVI.exe
  2⤵
  PID:11972
- C:\Windows\System\mhTWgqk.exe
  C:\Windows\System\mhTWgqk.exe
  2⤵
  PID:12020
- C:\Windows\System\mabpJhC.exe
  C:\Windows\System\mabpJhC.exe
  2⤵
  PID:12044
- C:\Windows\System\vEWTcwb.exe
  C:\Windows\System\vEWTcwb.exe
  2⤵
  PID:12068
- C:\Windows\System\RbAScnR.exe
  C:\Windows\System\RbAScnR.exe
  2⤵
  PID:12084
- C:\Windows\System\bduCHFv.exe
  C:\Windows\System\bduCHFv.exe
  2⤵
  PID:12104
- C:\Windows\System\vGHiixM.exe
  C:\Windows\System\vGHiixM.exe
  2⤵
  PID:12128
- C:\Windows\System\wuqkyyl.exe
  C:\Windows\System\wuqkyyl.exe
  2⤵
  PID:12152
- C:\Windows\System\XJhXsIe.exe
  C:\Windows\System\XJhXsIe.exe
  2⤵
  PID:12172
- C:\Windows\System\NBuHpzA.exe
  C:\Windows\System\NBuHpzA.exe
  2⤵
  PID:12204
- C:\Windows\System\SzKKlCU.exe
  C:\Windows\System\SzKKlCU.exe
  2⤵
  PID:12232
- C:\Windows\System\TPgGmnP.exe
  C:\Windows\System\TPgGmnP.exe
  2⤵
  PID:12284
- C:\Windows\System\IQlyyGV.exe
  C:\Windows\System\IQlyyGV.exe
  2⤵
  PID:11292
- C:\Windows\System\PEVxxCk.exe
  C:\Windows\System\PEVxxCk.exe
  2⤵
  PID:11304
- C:\Windows\System\eqQLnaI.exe
  C:\Windows\System\eqQLnaI.exe
  2⤵
  PID:11384
- C:\Windows\System\gNFqJeZ.exe
  C:\Windows\System\gNFqJeZ.exe
  2⤵
  PID:11424
- C:\Windows\System\oIKXLpE.exe
  C:\Windows\System\oIKXLpE.exe
  2⤵
  PID:11488
- C:\Windows\System\JauFHKM.exe
  C:\Windows\System\JauFHKM.exe
  2⤵
  PID:11504
- C:\Windows\System\VrlkoAM.exe
  C:\Windows\System\VrlkoAM.exe
  2⤵
  PID:11556
- C:\Windows\System\LcQlaqD.exe
  C:\Windows\System\LcQlaqD.exe
  2⤵
  PID:11624
- C:\Windows\System\LBbDyQK.exe
  C:\Windows\System\LBbDyQK.exe
  2⤵
  PID:11720
- C:\Windows\System\nCjKZUu.exe
  C:\Windows\System\nCjKZUu.exe
  2⤵
  PID:11792
- C:\Windows\System\nTiltnr.exe
  C:\Windows\System\nTiltnr.exe
  2⤵
  PID:11916
- C:\Windows\System\QckWPRm.exe
  C:\Windows\System\QckWPRm.exe
  2⤵
  PID:12040
- C:\Windows\System\sPiopOy.exe
  C:\Windows\System\sPiopOy.exe
  2⤵
  PID:12076
- C:\Windows\System\EanmIry.exe
  C:\Windows\System\EanmIry.exe
  2⤵
  PID:12184
- C:\Windows\System\lBSzOPK.exe
  C:\Windows\System\lBSzOPK.exe
  2⤵
  PID:12252
- C:\Windows\System\xGuaawS.exe
  C:\Windows\System\xGuaawS.exe
  2⤵
  PID:12276
- C:\Windows\System\GyGtWGE.exe
  C:\Windows\System\GyGtWGE.exe
  2⤵
  PID:11356
- C:\Windows\System\djBmhfP.exe
  C:\Windows\System\djBmhfP.exe
  2⤵
  PID:11272
- C:\Windows\System\wcaciWp.exe
  C:\Windows\System\wcaciWp.exe
  2⤵
  PID:11436
- C:\Windows\System\rkTtZnM.exe
  C:\Windows\System\rkTtZnM.exe
  2⤵
  PID:11620
- C:\Windows\System\dBMIlop.exe
  C:\Windows\System\dBMIlop.exe
  2⤵
  PID:11752
- C:\Windows\System\HIdlSuw.exe
  C:\Windows\System\HIdlSuw.exe
  2⤵
  PID:12012
- C:\Windows\System\OteRIjo.exe
  C:\Windows\System\OteRIjo.exe
  2⤵
  PID:12164
- C:\Windows\System\QdPwtWC.exe
  C:\Windows\System\QdPwtWC.exe
  2⤵
  PID:9280
- C:\Windows\System\lNuLJKg.exe
  C:\Windows\System\lNuLJKg.exe
  2⤵
  PID:11532
- C:\Windows\System\xroCVVt.exe
  C:\Windows\System\xroCVVt.exe
  2⤵
  PID:12016
- C:\Windows\System\ZmOWQrf.exe
  C:\Windows\System\ZmOWQrf.exe
  2⤵
  PID:12140
- C:\Windows\System\CsbKsTm.exe
  C:\Windows\System\CsbKsTm.exe
  2⤵
  PID:12120
- C:\Windows\System\oYLQZOu.exe
  C:\Windows\System\oYLQZOu.exe
  2⤵
  PID:12196
- C:\Windows\System\cGpqZmj.exe
  C:\Windows\System\cGpqZmj.exe
  2⤵
  PID:12304
- C:\Windows\System\JiBHdyG.exe
  C:\Windows\System\JiBHdyG.exe
  2⤵
  PID:12324
- C:\Windows\System\TmWqELX.exe
  C:\Windows\System\TmWqELX.exe
  2⤵
  PID:12344
- C:\Windows\System\XcRPjEG.exe
  C:\Windows\System\XcRPjEG.exe
  2⤵
  PID:12368
- C:\Windows\System\MwAXsYP.exe
  C:\Windows\System\MwAXsYP.exe
  2⤵
  PID:12392
- C:\Windows\System\vwigzJF.exe
  C:\Windows\System\vwigzJF.exe
  2⤵
  PID:12420
- C:\Windows\System\yZMTrCN.exe
  C:\Windows\System\yZMTrCN.exe
  2⤵
  PID:12440
- C:\Windows\System\uhkAvwk.exe
  C:\Windows\System\uhkAvwk.exe
  2⤵
  PID:12516
- C:\Windows\System\aAgggzO.exe
  C:\Windows\System\aAgggzO.exe
  2⤵
  PID:12552
- C:\Windows\System\jihIKRG.exe
  C:\Windows\System\jihIKRG.exe
  2⤵
  PID:12580
- C:\Windows\System\kcJhbSI.exe
  C:\Windows\System\kcJhbSI.exe
  2⤵
  PID:12600
- C:\Windows\System\vtylenT.exe
  C:\Windows\System\vtylenT.exe
  2⤵
  PID:12628
- C:\Windows\System\wMnEuCg.exe
  C:\Windows\System\wMnEuCg.exe
  2⤵
  PID:12648
- C:\Windows\System\rsNuRVI.exe
  C:\Windows\System\rsNuRVI.exe
  2⤵
  PID:12672
- C:\Windows\System\xxkRgNv.exe
  C:\Windows\System\xxkRgNv.exe
  2⤵
  PID:12716
- C:\Windows\System\bvpxYUA.exe
  C:\Windows\System\bvpxYUA.exe
  2⤵
  PID:12740
- C:\Windows\System\jNTPnKq.exe
  C:\Windows\System\jNTPnKq.exe
  2⤵
  PID:12760
- C:\Windows\System\rutCrKM.exe
  C:\Windows\System\rutCrKM.exe
  2⤵
  PID:12796
- C:\Windows\System\KilNzfH.exe
  C:\Windows\System\KilNzfH.exe
  2⤵
  PID:12816
- C:\Windows\System\ozlswsF.exe
  C:\Windows\System\ozlswsF.exe
  2⤵
  PID:12868
- C:\Windows\System\TPdzADk.exe
  C:\Windows\System\TPdzADk.exe
  2⤵
  PID:12900
- C:\Windows\System\coPlkKK.exe
  C:\Windows\System\coPlkKK.exe
  2⤵
  PID:12924
- C:\Windows\System\BnYWaBH.exe
  C:\Windows\System\BnYWaBH.exe
  2⤵
  PID:12944
- C:\Windows\System\SZBYglE.exe
  C:\Windows\System\SZBYglE.exe
  2⤵
  PID:12964
- C:\Windows\System\PiIdGhx.exe
  C:\Windows\System\PiIdGhx.exe
  2⤵
  PID:12992
- C:\Windows\System\mLNdzRi.exe
  C:\Windows\System\mLNdzRi.exe
  2⤵
  PID:13016
- C:\Windows\System\dcXcCAI.exe
  C:\Windows\System\dcXcCAI.exe
  2⤵
  PID:13064
- C:\Windows\System\KLUEBKt.exe
  C:\Windows\System\KLUEBKt.exe
  2⤵
  PID:13088
- C:\Windows\System\JBKfYeD.exe
  C:\Windows\System\JBKfYeD.exe
  2⤵
  PID:13132
- C:\Windows\System\mlxXUtl.exe
  C:\Windows\System\mlxXUtl.exe
  2⤵
  PID:13152
- C:\Windows\System\hhystFs.exe
  C:\Windows\System\hhystFs.exe
  2⤵
  PID:13172
- C:\Windows\System\HKYIvLw.exe
  C:\Windows\System\HKYIvLw.exe
  2⤵
  PID:13188
- C:\Windows\System\jTfGzYj.exe
  C:\Windows\System\jTfGzYj.exe
  2⤵
  PID:13220
- C:\Windows\System\AjyzeYT.exe
  C:\Windows\System\AjyzeYT.exe
  2⤵
  PID:12296
- C:\Windows\System\XikMlAE.exe
  C:\Windows\System\XikMlAE.exe
  2⤵
  PID:12336
- C:\Windows\System\VbIqzfx.exe
  C:\Windows\System\VbIqzfx.exe
  2⤵
  PID:12360
- C:\Windows\System\gxuvyCj.exe
  C:\Windows\System\gxuvyCj.exe
  2⤵
  PID:12416
- C:\Windows\System\CNsVeck.exe
  C:\Windows\System\CNsVeck.exe
  2⤵
  PID:12500
- C:\Windows\System\vWxfKRm.exe
  C:\Windows\System\vWxfKRm.exe
  2⤵
  PID:12528
- C:\Windows\System\jWQjxEn.exe
  C:\Windows\System\jWQjxEn.exe
  2⤵
  PID:12624
- C:\Windows\System\fqJIwEW.exe
  C:\Windows\System\fqJIwEW.exe
  2⤵
  PID:12640
- C:\Windows\System\veVTkTw.exe
  C:\Windows\System\veVTkTw.exe
  2⤵
  PID:12700
- C:\Windows\System\RJgGnPu.exe
  C:\Windows\System\RJgGnPu.exe
  2⤵
  PID:12808
- C:\Windows\System\FWmfrkz.exe
  C:\Windows\System\FWmfrkz.exe
  2⤵
  PID:12880
- C:\Windows\System\dXCdlin.exe
  C:\Windows\System\dXCdlin.exe
  2⤵
  PID:12932
- C:\Windows\System\zwMOouW.exe
  C:\Windows\System\zwMOouW.exe
  2⤵
  PID:12980
- C:\Windows\System\kcMFJzQ.exe
  C:\Windows\System\kcMFJzQ.exe
  2⤵
  PID:13012
- C:\Windows\System\LHuDGyT.exe
  C:\Windows\System\LHuDGyT.exe
  2⤵
  PID:13200
- C:\Windows\System\sJsPiyO.exe
  C:\Windows\System\sJsPiyO.exe
  2⤵
  PID:13216
- C:\Windows\System\mGfmbPw.exe
  C:\Windows\System\mGfmbPw.exe
  2⤵
  PID:13248
- C:\Windows\System\NFQNfCM.exe
  C:\Windows\System\NFQNfCM.exe
  2⤵
  PID:4224
- C:\Windows\System\mXmDEYb.exe
  C:\Windows\System\mXmDEYb.exe
  2⤵
  PID:12332
- C:\Windows\System\zZJTMNb.exe
  C:\Windows\System\zZJTMNb.exe
  2⤵
  PID:12484
- C:\Windows\System\oQZQAvb.exe
  C:\Windows\System\oQZQAvb.exe
  2⤵
  PID:12620
- C:\Windows\System\oWUwvIA.exe
  C:\Windows\System\oWUwvIA.exe
  2⤵
  PID:12596
- C:\Windows\System\MswOpZs.exe
  C:\Windows\System\MswOpZs.exe
  2⤵
  PID:12748
- C:\Windows\System\XChvYKx.exe
  C:\Windows\System\XChvYKx.exe
  2⤵
  PID:13008
- C:\Windows\System\CwmdsaF.exe
  C:\Windows\System\CwmdsaF.exe
  2⤵
  PID:4488
- C:\Windows\System\dycBbAc.exe
  C:\Windows\System\dycBbAc.exe
  2⤵
  PID:3480
- C:\Windows\System\mwfeIte.exe
  C:\Windows\System\mwfeIte.exe
  2⤵
  PID:12560
- C:\Windows\System\AfqhRSM.exe
  C:\Windows\System\AfqhRSM.exe
  2⤵
  PID:12844
- C:\Windows\System\KbaddXn.exe
  C:\Windows\System\KbaddXn.exe
  2⤵
  PID:12788
- C:\Windows\System\wVnTJCP.exe
  C:\Windows\System\wVnTJCP.exe
  2⤵
  PID:13108
- C:\Windows\System\AqGNikV.exe
  C:\Windows\System\AqGNikV.exe
  2⤵
  PID:13180
- C:\Windows\System\fXLaJTv.exe
  C:\Windows\System\fXLaJTv.exe
  2⤵
  PID:13316
- C:\Windows\System\GKNDQFR.exe
  C:\Windows\System\GKNDQFR.exe
  2⤵
  PID:13352
- C:\Windows\System\QIoZmYT.exe
  C:\Windows\System\QIoZmYT.exe
  2⤵
  PID:13372
- C:\Windows\System\TvPGLun.exe
  C:\Windows\System\TvPGLun.exe
  2⤵
  PID:13404
- C:\Windows\System\xuxmJer.exe
  C:\Windows\System\xuxmJer.exe
  2⤵
  PID:13476
- C:\Windows\System\fsiSeim.exe
  C:\Windows\System\fsiSeim.exe
  2⤵
  PID:13504
- C:\Windows\System\PSzDXjq.exe
  C:\Windows\System\PSzDXjq.exe
  2⤵
  PID:13528
- C:\Windows\System\LqdyfkJ.exe
  C:\Windows\System\LqdyfkJ.exe
  2⤵
  PID:13544
- C:\Windows\System\WBGagCY.exe
  C:\Windows\System\WBGagCY.exe
  2⤵
  PID:13596
- C:\Windows\System\iPiAPLQ.exe
  C:\Windows\System\iPiAPLQ.exe
  2⤵
  PID:13620
- C:\Windows\System\qKVBxyw.exe
  C:\Windows\System\qKVBxyw.exe
  2⤵
  PID:13644
- C:\Windows\System\ioXeoaK.exe
  C:\Windows\System\ioXeoaK.exe
  2⤵
  PID:13664
- C:\Windows\System\TbTBQVM.exe
  C:\Windows\System\TbTBQVM.exe
  2⤵
  PID:13688
- C:\Windows\System\tpZZOkC.exe
  C:\Windows\System\tpZZOkC.exe
  2⤵
  PID:13708
- C:\Windows\System\GBZFWqA.exe
  C:\Windows\System\GBZFWqA.exe
  2⤵
  PID:13732
- C:\Windows\System\eAxLipv.exe
  C:\Windows\System\eAxLipv.exe
  2⤵
  PID:13764
- C:\Windows\System\TaFRurh.exe
  C:\Windows\System\TaFRurh.exe
  2⤵
  PID:13788
- C:\Windows\System\ePForTC.exe
  C:\Windows\System\ePForTC.exe
  2⤵
  PID:13812
- C:\Windows\System\nQRHTBg.exe
  C:\Windows\System\nQRHTBg.exe
  2⤵
  PID:13864
- C:\Windows\System\usVlVLp.exe
  C:\Windows\System\usVlVLp.exe
  2⤵
  PID:13896
- C:\Windows\System\tfBkJLJ.exe
  C:\Windows\System\tfBkJLJ.exe
  2⤵
  PID:13928
- C:\Windows\System\MtayKlh.exe
  C:\Windows\System\MtayKlh.exe
  2⤵
  PID:13964
- C:\Windows\System\NNfoTHr.exe
  C:\Windows\System\NNfoTHr.exe
  2⤵
  PID:13984
- C:\Windows\System\ejfHVGK.exe
  C:\Windows\System\ejfHVGK.exe
  2⤵
  PID:14008
- C:\Windows\System\qjHlQVi.exe
  C:\Windows\System\qjHlQVi.exe
  2⤵
  PID:14028
- C:\Windows\System\mstiQYe.exe
  C:\Windows\System\mstiQYe.exe
  2⤵
  PID:14052
- C:\Windows\System\bixKhUT.exe
  C:\Windows\System\bixKhUT.exe
  2⤵
  PID:14072
- C:\Windows\System\MouQFPI.exe
  C:\Windows\System\MouQFPI.exe
  2⤵
  PID:14112
- C:\Windows\System\SEDnvnt.exe
  C:\Windows\System\SEDnvnt.exe
  2⤵
  PID:14140
- C:\Windows\System\EVnvXOg.exe
  C:\Windows\System\EVnvXOg.exe
  2⤵
  PID:14164
- C:\Windows\System\zkTOQWX.exe
  C:\Windows\System\zkTOQWX.exe
  2⤵
  PID:14184
- C:\Windows\System\nNHyQfI.exe
  C:\Windows\System\nNHyQfI.exe
  2⤵
  PID:14208
- C:\Windows\System\jWOXxZR.exe
  C:\Windows\System\jWOXxZR.exe
  2⤵
  PID:14268
- C:\Windows\System\LUJCBZq.exe
  C:\Windows\System\LUJCBZq.exe
  2⤵
  PID:14292
- C:\Windows\System\SjItBFw.exe
  C:\Windows\System\SjItBFw.exe
  2⤵
  PID:14320
- C:\Windows\System\fnKwLZe.exe
  C:\Windows\System\fnKwLZe.exe
  2⤵
  PID:13324
- C:\Windows\System\lMzpfTv.exe
  C:\Windows\System\lMzpfTv.exe
  2⤵
  PID:12320
- C:\Windows\System\VmsqqgH.exe
  C:\Windows\System\VmsqqgH.exe
  2⤵
  PID:13348
- C:\Windows\System\jcPWiLL.exe
  C:\Windows\System\jcPWiLL.exe
  2⤵
  PID:13448
- C:\Windows\System\xryOTcQ.exe
  C:\Windows\System\xryOTcQ.exe
  2⤵
  PID:13496
- C:\Windows\System\Wvnxckt.exe
  C:\Windows\System\Wvnxckt.exe
  2⤵
  PID:13516
- C:\Windows\System\jiDbfkY.exe
  C:\Windows\System\jiDbfkY.exe
  2⤵
  PID:13616
- C:\Windows\System\LoguxGr.exe
  C:\Windows\System\LoguxGr.exe
  2⤵
  PID:13756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ATpHYfO.exe

Filesize
1.4MB

MD5
33a839e5e6aa6c5948a458bbe29259da

SHA1
875c9b60b61751c670e0a7f53fe5d41fdfd1a64c

SHA256
c1621c57e9e4e8f5038280824b5259ed05af836f9d10999d5bce2dd32ad99e04

SHA512
2013ab1bcdd52a57c5b3c10df549f898ceaa224415b13a46c20b79feb1b98e08faa5e54fa0866fa88ed3146515bf5ddd6d4acdc994221aa2654bf0f3f0959a4e

Download Submit
C:\Windows\System\DaHuBxq.exe

Filesize
1.4MB

MD5
7864e7ae02eb365471a2d0ae322872f4

SHA1
9841e62f4ee1057fe018def534aab7ba3d834fb4

SHA256
2dfd1593a1a4aaa457bde741c65387e96b0eaeb3005dd59ce16b25e115d0ba09

SHA512
b2b5f374e05e4b0b722c750d7ad33014b9362899e3282cd3a38aede219c2370d855cb2f87b01cdab2358ac48446baf2d2f68a2b807cf7faa43207e989ded266e

Download Submit
C:\Windows\System\DjOKMJF.exe

Filesize
1.4MB

MD5
a008aa514c1b5f1a3b71294dd6a3209c

SHA1
2933893053c25d53df5d4d59312e93f1f20c8dba

SHA256
64ef4f767091ea8a354c9036a65d987d3680933bf43de0c105a09713b0f76779

SHA512
aa57bee2757644a0fbc5065d07527cc80a9dbd979a4d6f2873752d5eccb708276bc7ccc5f51e33881f928385ee275ec8bbbcff59382dbcdaf7297dd1731fceb0

Download Submit
C:\Windows\System\FETESXm.exe

Filesize
1.4MB

MD5
fdae117a9245af6c19beec0c0291b1ed

SHA1
24a7eb444fb236a08388b1265331d62c521f2009

SHA256
ce32c48be2ca0fecfb6be66ff8e2a37ad1287ac0511657a59ca3187e71933fee

SHA512
3245bab657a473d4110a564ebc3c559432814c30fa74f05c4a0700731908dd4f4cd4079cbb7b18ba4c42275f2c42d3bd307cca91d0cbc8982a31e4796f31c164

Download Submit
C:\Windows\System\HWoJUAq.exe

Filesize
1.4MB

MD5
68d68ac1cdb0436968735a6a027403d5

SHA1
d9760c06858d628a3aec4db922b998b64c3e5d61

SHA256
e2dabf055b5a3c416303a0da6880ace7c13280e6ff2db0b7072d835e01a3c72c

SHA512
ad0470025ae75a1cb2bce0697839d7289bfec9051f752b132232a88535fc5403f21395499192b4012002f8f47de3f905fe1a24a971353df00a35c3959afb8f8a

Download Submit
C:\Windows\System\JVCWQvK.exe

Filesize
1.4MB

MD5
b7f68e2525e5da048c3e415b29b2a9a8

SHA1
89388953102c84b9189e791944046b69588c9111

SHA256
01eb815b5f5a506ffb5b9096fa51b6917fffddf81d6c3f4cfb47e7e6aca7fe86

SHA512
76a5c441d43a876935096cee0b7bd9bc4b4d9cd188ac6d1cbfd96b610891a66c20080dd85322eb1523a3ff73a8d87399080c986d99c414379a270d13ad345172

Download Submit
C:\Windows\System\LTJgVXQ.exe

Filesize
1.4MB

MD5
4c1ffa3592cf06c0bad6973b66cc48ec

SHA1
31babc62d288906fb0302d05465e3fef529286d4

SHA256
5a675e73c2e15d1087826fe689d63a5050641fb3840475db706545f3baa598e6

SHA512
286bc683d4c253580f949a920c501e9f072a940b2f7e0888d1de2fb891fbe54da0329a8d63a963408404d1a80368db06ff7631558760dfca880aa29c2d6bf37e

Download Submit
C:\Windows\System\NhrFIOl.exe

Filesize
1.4MB

MD5
0b6b6d7427eaa970af9bd8353f5833f0

SHA1
c87d5097ec24ae0f74113ec0946d58e878054f53

SHA256
cd429a0da125f3ff79500583a2aa0a2c8de40ec206a3c67c914ca1d6e4908615

SHA512
f6a6d4c47d8bc8cf074382ce9047e91c8c5403fe2174217923f9a26e7556d13b045be141ead1f75a8448d3db8f95b5d1aad8308b5398ac78292cfe0445ba90ad

Download Submit
C:\Windows\System\OMBIgYS.exe

Filesize
1.4MB

MD5
125c2654c120fd78ff894b3bc9534175

SHA1
f0e3566271df9eea496de01001a3065ad9dd14b5

SHA256
28b19bcc13ffa1efda49ac879a07748f20e8aba2200cf4af0ac9e6ef705c6aab

SHA512
c4ec9389cbce67ee3c60e8be9278a3529d176310cf6615db06199d8b1cebf68cc89072e47934fdac4e53814d6d1fbfbfe74e7b8176eb5bf0e1d7b0ae77c4bb68

Download Submit
C:\Windows\System\OuMOZYp.exe

Filesize
1.4MB

MD5
75e7980fe7a6fcd74588b840152134d4

SHA1
a87426f9d063ea506e7e896a3b8e4cf70fa4881e

SHA256
de35b3f58424676be1a01fac7ec7e0e8804dac21d7f743289c2a004904416e93

SHA512
9eb29f8355047f72ed475882837a42a4b0fc8fc78835fd8770d4c62a408154d0c73251c8f089869085e875cdad6cc7d907a5269135ce5121a5dfca9a7dea581f

Download Submit
C:\Windows\System\SkeozaW.exe

Filesize
1.4MB

MD5
dab4d52053509486d460fb823954ec86

SHA1
010b4d2aaacaf459017ca0aa9f82287637cce55c

SHA256
f82203a1cb347a15b96b9e203514b55b7bd426b99c87b9b32ea223e72226cf00

SHA512
58a042c7267bb7afc440ab543ad58ae1db181a15acc22f9b084fd1e71011a31aee886e63a90e12ed807737703c18beb5b72fc78e307535937c15b884dab636ef

Download Submit
C:\Windows\System\TFbunVe.exe

Filesize
1.4MB

MD5
09facd177e2da5f08afeadfb7444a5e9

SHA1
45a716651195b559e5b73ad70c5601d0c7b4f1c7

SHA256
54d99e5142b48191e6c806c2c2bf24a5c21e3e83eb5ed03510ea1d403d91cbbd

SHA512
7d409239bccfa23dfef5ec9dcc74763591731a864b5e8907d3a90c253775c3cf762319669effc01371e2f3c7501be87d9520b6a1b583774223c96595b1ae3224

Download Submit
C:\Windows\System\TYYZnhS.exe

Filesize
1.4MB

MD5
dd11bb3f4ba238648032cb9e5acf120a

SHA1
e5367b61037a972d4fd22cf700d130a7be2f1de2

SHA256
d2d7206e58608e6a6707315537398774c43021e45ad4bed2821a5a1c50544ecc

SHA512
4209a0deaa179388ed2f4d2f2d43d1f77a01a23331033cb8646b5993fba8d569f47f02c828f5872215b7222ddb636ffb72e87f37df4852c3435abd01f89e7d57

Download Submit
C:\Windows\System\TsXQRHf.exe

Filesize
1.4MB

MD5
f55bdfdcda345d115413051f87d14781

SHA1
527742c4f8f02979ff571e690f9710a62d1c1ce2

SHA256
c6285f1599c64a07b1468633a82cae44050e7747d9a1dd5c18051ca54a2fc96f

SHA512
2d2fb4930cd7a6fce35b3ac64dc1fb6fac22b7a6457dd7fb8f1d25f63d6654ca2ccd49c444aad04562bbfe0b3ad91a0dc700bc431be5940682938d403f65399c

Download Submit
C:\Windows\System\VaixobI.exe

Filesize
1.4MB

MD5
d0bd916901e6b97532990b26d2fa1f3a

SHA1
ae7c72ae2044166a358b97a28c50dd2a90957e2e

SHA256
17152a1697983db5ece9b0bb45dc2578756b6d41095da646ccab462287e9878f

SHA512
7c527f46f3e2f2dc13920d8575d9af8e102786b634a2e8052127658a3520012ed49381fdf67dedd353df0109197a1e4ece8c79d0f672e718227f7cb4a2aa8a95

Download Submit
C:\Windows\System\XcNoWRM.exe

Filesize
1.4MB

MD5
bd363f884521b0efb8cc35f9c40f7346

SHA1
21b2119e60ade3407785bacc120da1b14b7bca44

SHA256
a3a3cbad4da924a21f9832b1c8fee605e1ed644393f99dc0a493029eca5e70f5

SHA512
83009bb5f140926a8b9ff0cace3c2b1c5cd03f32b338552e04d81c4b0ddceff922bb987d2724c0ffc85b8bc79bec1b993443d0905b647066a484776d938fada9

Download Submit
C:\Windows\System\adoNgXo.exe

Filesize
1.4MB

MD5
452ed8bcd5f42df644af1e70b1df3457

SHA1
6a95267d9107f85f9b1e7bc563924a6401c36cab

SHA256
21180bcfa5159589d4518e79bbc211febcf9afce0cd6b5a933797875646b4ce7

SHA512
7d816e51c6bd1e6c672e466d9fcd71ee1400d8bc0a1a90adc17223b9e2246bf59c808124b61e587e2878d1fd0063c32e370ffa7cdcd2c05469eeac6257cef056

Download Submit
C:\Windows\System\bIVzedL.exe

Filesize
1.4MB

MD5
ff3fd67e420eba579b74de90f2561b5c

SHA1
452b97ff9a04884e02671740832afc3d5f832da8

SHA256
571325385241e31ce444168f87cd6d20aa137c20cf553c1317672fe6c1caf4e5

SHA512
9b1e179df30c22a4de1766b4278a1eb74064a43624eddf154be7838645d6fcf848d1b1a9ef9ce598a2aaf95fa6332596037f82777c8204d84c7b2f072bee8298

Download Submit
C:\Windows\System\bYdBzJH.exe

Filesize
1.4MB

MD5
986b09dcb632b966ed1ae2fb8b4dedfd

SHA1
c53d0694d629691cb45f8056f5ee57e681d5be9b

SHA256
1da5a6d216c7e17fbff6d463f338ed39ef9c7adc3492c5a25775f094a26a2635

SHA512
6a1a947f1bb95aa4378bdbe750ef207cabbc77126c43279fca3e762320884f8a010d054f6d944e47cca6732b97839253404710cb0182e10a36b95ea527f0ae9c

Download Submit
C:\Windows\System\dfRnqad.exe

Filesize
1.4MB

MD5
de0f5ffe2298cb57c49bd4b0d074ff9b

SHA1
94470ec088b59be08adb1202abab2375946c1f53

SHA256
05d2c2c72fcdc50b34b1e537d911e13c1bf752e5d6bc78de471cb894e366a899

SHA512
398d1e20d81f93d17662b0d307336162dd1934d30ca2fda80fa2a18b2f655149fcb734b9268a18845181d0af4b17c50192f93276f143e2084a3e0199d5ecf557

Download Submit
C:\Windows\System\emAnzpg.exe

Filesize
1.4MB

MD5
20daf9e36f353c5fcf162e878654729b

SHA1
df6c98698fc848657b1cbd7c787db301e5aa84a9

SHA256
d6e4691077d5d084dc17ef6a1aa084238d0821a45086561c23cf7e1258fcaeee

SHA512
c2c2f85c9165a91b727a87071297fbc4c66fdce762d93510f570d5a5870cd807dd005a98c1f339df4f3ed19c16ac3ee1cc0519fff343ac9fcd31433cc89857e4

Download Submit
C:\Windows\System\fTBOkEo.exe

Filesize
1.4MB

MD5
6f4935e9235d98c27b9f67a1c7c65aac

SHA1
c0844a4221dcc04c879fc42d5a93fd0e817f300d

SHA256
e689628135d0adbba10a89c13eadaa6701e1fd50ccf2020eb994d2849b8c0793

SHA512
9287c4277593ec2faed6facbed875c313cfd3dfc29f6cbbafb5f065a36277306e7298b65666afc30d74ec1b1b863a6052b9f4a18f3cc74500b1a4b82d20f911c

Download Submit
C:\Windows\System\gCEUwCZ.exe

Filesize
1.4MB

MD5
1c95dd5379faee26a620f4392bc1aed0

SHA1
0db91108668c7f1701408c754a3ec71776f3f7d9

SHA256
a5c56cb66f8360e6c1a0d10dd1b62fddd3ffe89efa675607e17b0cb842a81899

SHA512
7ce7a72b877bb4b74abc9cd986caf3ae65365691bcdd705ea394c9e19e642d52d3246e89c8955ffaf58db3e0c618dbeeb093aa23ca3a44ff7d37e0a46f161332

Download Submit
C:\Windows\System\gFHryHR.exe

Filesize
1.4MB

MD5
573f606082a60a73bad9b03ef85771c9

SHA1
df4e7e9a5afbc46c898cd224ff37efabee11978a

SHA256
e6e0f8ef9348fe2d351da01b5f08e614d279973158040fcbb5a9ea7c5c2a7d87

SHA512
848a76ac95db11641866a1cfb7b7baf88b48f0c699c3817c66f68c8b92767cd8fa6f22dcdbb794b11590686d5d79082a7378ac964f241808416408ea8cd9cfa3

Download Submit
C:\Windows\System\lDEAoxh.exe

Filesize
1.4MB

MD5
f2b997a3ea3f76ad1dad737067ae8103

SHA1
d8f8740a30a2664fa03e8ec9413148417365b055

SHA256
cadb58256a0ee52edc7cb37ea3e41d58354f10bafbc05fd8bf939c2ae5e6d7fd

SHA512
e038e7a5b6e9acc6f3b439015a4c08e0f42ad85aae538346098834aae139625c02bc291b40c91ec08385ce6054bc0ee57261b75d2f659d7ca7694f8f2b5efe32

Download Submit
C:\Windows\System\lJVXBeA.exe

Filesize
1.4MB

MD5
3af521b1711d791c321cf593a97d341c

SHA1
df793a0377c4ad1bcf77564d1250c6053b44a1e8

SHA256
758a99bfb07fab5e5bb7a92909e0c1926a07e10eae99516227e82887670b168d

SHA512
907de77eb8d64929e0c0f0eded6322d1ba45b3f06c2855202efd8237b84f5ad52773280048e5f4030600f12f1aed049d9be62ee7605ca4bef6e82d79b2925576

Download Submit
C:\Windows\System\qjADIFF.exe

Filesize
1.4MB

MD5
3a83fce38f5dd45e139bce16abff320c

SHA1
86b997347fbe3c93262cadc72542fbc61ef54a0c

SHA256
a3bec1db4996e1fd9938a908807bbb55759ad8bf5dc643a00ccf916f5fa84cb1

SHA512
b1d6cf8cfd6890bbd1b77f340116a4388d580b2aeebb776d475dc9f26b37226730d55c4446d2f170b2096b2544612261aad041b3d9dee43de95c3f6402c3b471

Download Submit
C:\Windows\System\rCvmHzB.exe

Filesize
1.4MB

MD5
854b85948f068255c246cebed15c8f86

SHA1
d499fa7acc5450d6a951edd17b567de0297df2be

SHA256
6068f5b799277ae86dd91bfe7c61f68971a9febc207be41ea839035f55a52c32

SHA512
7a72bb8246e3c40925280a1a8bd2dd8d462819823fe011b791e451dbcdc21179e68fa7fd5d80e1137e44b8ae58eb12359e865836a2f49017156d549f78c5d53c

Download Submit
C:\Windows\System\tPqfCvb.exe

Filesize
1.4MB

MD5
a11d46d9892e0d8e21f7d28280eade20

SHA1
5cd1552e4b4830748e25afb50efeca637a3fe817

SHA256
d2c3452e992145b7fe60ae8b2fb115338b3f92b89e2e7cba0b289b6d4abcb79c

SHA512
a7aa953f1a745bd7eaea1dd2084185d444f66aa622585ea9e183c5943cf0f51916d7461892f33b55dae397d59725ca98fefa11874408bd46c852ebced4f770d0

Download Submit
C:\Windows\System\tTafqtg.exe

Filesize
1.4MB

MD5
968d84d0075132cb1413401626c4f0a4

SHA1
118e9b1c2ddd368759c563039967edfcbc920bcd

SHA256
3ee6cee00d7def8569344b7e4212b1472096fdf9d681b2b532b6dfb509c148b0

SHA512
2ae169d5acb21e507ada85a5314352a3d9f3900946df188e126f208478dfcf9929f8b27324fe132a0b3c83b159d0f859fc4add78a521a6842413ee484911f624

Download Submit
C:\Windows\System\tryDROs.exe

Filesize
1.4MB

MD5
e447abaa533a7cbaa6d72746cc2f1509

SHA1
e10fb9afdec3088494178f7ec168b06f2a5de06b

SHA256
bf058e1eefbf6274e9454ffb152ed23cf83eef92289fcae430dc5d455feba52f

SHA512
152904504d0a8667c32237e7409ecf17c81d4ef96a4e345ce42f8963c0adbe6903ac361ada191a2ecb3a7f60204a601ff62181b050ed7ff55c82c92c4bd61c1a

Download Submit
C:\Windows\System\ufElZYt.exe

Filesize
1.4MB

MD5
2b7ed4b2d18f5ab1fc454f6c63c11990

SHA1
00fae6ede66c3a22716b9f9a96e62a4e1919ada4

SHA256
72bb779783db7a6b9ad4960f5fbf6ecf8461c0c0657b1d53b8e7a22d96df72ba

SHA512
a7a93eaa6e67077efae772db0b83bf6cfc29bdf101b4ab2ce3585cdb87a288d38bef806a8d85db32582ab06d967f74365df8302a10c606d1fa5d71b04d0983fa

Download Submit
C:\Windows\System\vclYDHl.exe

Filesize
1.4MB

MD5
637d3f84de8bad6b5700cfc5f41ac13a

SHA1
f78fb96610d7fbc6304e1f1d246e200815b65479

SHA256
c70646341656544ece48460d43f550bcef221e72a79c3ba0bfd08c6c7f55196c

SHA512
68db37b5cfe64a3176539eae96ef97b40374f3937bbc37c8b6323409d380e116c1ef76d6a1eae6bd790bb16bb16ae4cea26249cd4136eb14f00181421dbbd660

Download Submit
memory/348-344-0x00007FF7B3630000-0x00007FF7B3981000-memory.dmp

Filesize
3.3MB

Download
memory/788-314-0x00007FF70A9D0000-0x00007FF70AD21000-memory.dmp

Filesize
3.3MB

Download
memory/816-1914-0x00007FF6CC020000-0x00007FF6CC371000-memory.dmp

Filesize
3.3MB

Download
memory/816-20-0x00007FF6CC020000-0x00007FF6CC371000-memory.dmp

Filesize
3.3MB

Download
memory/1232-345-0x00007FF620A80000-0x00007FF620DD1000-memory.dmp

Filesize
3.3MB

Download
memory/1360-329-0x00007FF6CB0D0000-0x00007FF6CB421000-memory.dmp

Filesize
3.3MB

Download
memory/1484-1-0x0000024D91720000-0x0000024D91730000-memory.dmp

Filesize
64KB

Download
memory/1484-1907-0x00007FF7C9080000-0x00007FF7C93D1000-memory.dmp

Filesize
3.3MB

Download
memory/1484-0-0x00007FF7C9080000-0x00007FF7C93D1000-memory.dmp

Filesize
3.3MB

Download
memory/1496-90-0x00007FF7AD540000-0x00007FF7AD891000-memory.dmp

Filesize
3.3MB

Download
memory/1600-35-0x00007FF7FDC30000-0x00007FF7FDF81000-memory.dmp

Filesize
3.3MB

Download
memory/1600-2197-0x00007FF7FDC30000-0x00007FF7FDF81000-memory.dmp

Filesize
3.3MB

Download
memory/1636-83-0x00007FF751F00000-0x00007FF752251000-memory.dmp

Filesize
3.3MB

Download
memory/1900-34-0x00007FF603890000-0x00007FF603BE1000-memory.dmp

Filesize
3.3MB

Download
memory/1916-317-0x00007FF6A8320000-0x00007FF6A8671000-memory.dmp

Filesize
3.3MB

Download
memory/1924-361-0x00007FF720A70000-0x00007FF720DC1000-memory.dmp

Filesize
3.3MB

Download
memory/1928-334-0x00007FF6F4D70000-0x00007FF6F50C1000-memory.dmp

Filesize
3.3MB

Download
memory/1968-325-0x00007FF75B220000-0x00007FF75B571000-memory.dmp

Filesize
3.3MB

Download
memory/2028-2202-0x00007FF6395D0000-0x00007FF639921000-memory.dmp

Filesize
3.3MB

Download
memory/2028-66-0x00007FF6395D0000-0x00007FF639921000-memory.dmp

Filesize
3.3MB

Download
memory/2384-320-0x00007FF6A3D10000-0x00007FF6A4061000-memory.dmp

Filesize
3.3MB

Download
memory/2808-324-0x00007FF717E80000-0x00007FF7181D1000-memory.dmp

Filesize
3.3MB

Download
memory/2844-2213-0x00007FF7B32C0000-0x00007FF7B3611000-memory.dmp

Filesize
3.3MB

Download
memory/2844-87-0x00007FF7B32C0000-0x00007FF7B3611000-memory.dmp

Filesize
3.3MB

Download
memory/2848-343-0x00007FF759AE0000-0x00007FF759E31000-memory.dmp

Filesize
3.3MB

Download
memory/3004-2198-0x00007FF681C40000-0x00007FF681F91000-memory.dmp

Filesize
3.3MB

Download
memory/3004-39-0x00007FF681C40000-0x00007FF681F91000-memory.dmp

Filesize
3.3MB

Download
memory/3052-40-0x00007FF73F430000-0x00007FF73F781000-memory.dmp

Filesize
3.3MB

Download
memory/3052-2199-0x00007FF73F430000-0x00007FF73F781000-memory.dmp

Filesize
3.3MB

Download
memory/3236-2200-0x00007FF643710000-0x00007FF643A61000-memory.dmp

Filesize
3.3MB

Download
memory/3236-55-0x00007FF643710000-0x00007FF643A61000-memory.dmp

Filesize
3.3MB

Download
memory/3468-316-0x00007FF748160000-0x00007FF7484B1000-memory.dmp

Filesize
3.3MB

Download
memory/3948-73-0x00007FF78F040000-0x00007FF78F391000-memory.dmp

Filesize
3.3MB

Download
memory/4792-2201-0x00007FF7C4E40000-0x00007FF7C5191000-memory.dmp

Filesize
3.3MB

Download
memory/4792-72-0x00007FF7C4E40000-0x00007FF7C5191000-memory.dmp

Filesize
3.3MB

Download
memory/4820-77-0x00007FF6B7240000-0x00007FF6B7591000-memory.dmp

Filesize
3.3MB

Download
memory/4820-2203-0x00007FF6B7240000-0x00007FF6B7591000-memory.dmp

Filesize
3.3MB

Download
memory/4856-365-0x00007FF6715A0000-0x00007FF6718F1000-memory.dmp

Filesize
3.3MB

Download
memory/5060-340-0x00007FF614D30000-0x00007FF615081000-memory.dmp

Filesize
3.3MB

Download
memory/5072-1910-0x00007FF637BA0000-0x00007FF637EF1000-memory.dmp

Filesize
3.3MB

Download
memory/5072-16-0x00007FF637BA0000-0x00007FF637EF1000-memory.dmp

Filesize
3.3MB

Download
memory/5100-27-0x00007FF60B660000-0x00007FF60B9B1000-memory.dmp

Filesize
3.3MB

Download