xmrig | 2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc

Analysis

max time kernel
145s
max time network
143s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 20:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
Size

1.7MB
MD5

ba7dee3d8dd76a059d29ecf2f1e51d4a
SHA1

f81430c32548003e9d5041da564b381f224fc74a
SHA256

2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc
SHA512

5b2e2faf0a58617aba4330f29f191af7ff0f66507907963df8ff2d27194473aad0bdbd9362d054bf94f7ea13358bd2af58dbb9990a9b8f01578a5c04df5bd97b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDilK3uPpHbcMfOoFxc:Lz071uv4BPMkFfdg6NsOkc26b

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2132-9-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2204-149-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2572-153-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/2824-168-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2820-166-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2084-165-0x0000000003640000-0x0000000003A32000-memory.dmp	xmrig
behavioral1/memory/1948-164-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2404-159-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2904-157-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2620-155-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig
behavioral1/memory/2740-151-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2940-25-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/2620-3584-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig
behavioral1/memory/2856-4811-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2740-5029-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2572-5033-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/2824-5037-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/1948-5038-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2904-5041-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2820-5050-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2132-5077-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2404-5071-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2940-5062-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2920	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2132	GXIYscb.exe
2856	wcIAwZM.exe
2940	IUfpEWY.exe
2204	pFMsIWP.exe
2740	wxIgJHT.exe
2572	uqFqQcp.exe
2620	BqPrRPO.exe
2904	dyNfFIq.exe
2404	AlulHwn.exe
1948	XEGwAUq.exe
2820	RUgIYtZ.exe
2824	gWOKdlS.exe
3036	lwOwmMQ.exe
2412	KxrdXxB.exe
1968	NMiFaAz.exe
1552	vglEqtR.exe
2468	CzoQirm.exe
1512	VrHufwV.exe
1856	KiUiPTm.exe
1148	QmltEiI.exe
1936	NFHVRth.exe
1068	tjduWqD.exe
1412	jHifGXC.exe
316	TTVkCif.exe
2064	qbLVCpX.exe
668	RpREYUm.exe
1108	FjyZGEy.exe
632	hfwqgyt.exe
1096	Myufdbh.exe
1820	slZcocb.exe
1056	cwGxvUr.exe
1940	ICaripm.exe
940	ucFxmhu.exe
1344	EJcNQUO.exe
2200	jYavPhk.exe
2324	BbSxIrw.exe
608	GyjZXGH.exe
868	ihnnKMP.exe
912	iayznlv.exe
568	RSVsQvz.exe
864	MmGUxFE.exe
1768	ocGafMr.exe
1800	twJYwrQ.exe
2240	vyWyWub.exe
2280	VhdIaNW.exe
1716	ANBJIhS.exe
2100	OWixaiv.exe
1604	ObbKdVm.exe
560	elzSsco.exe
2876	yrryCJA.exe
2584	gcGbjdl.exe
3024	aimmnzL.exe
2812	VwogfPE.exe
1860	LvkCIdh.exe
1928	UNAsaum.exe
2348	dhWkbhF.exe
1772	jRzmJqw.exe
2120	aSskovQ.exe
1088	puYXiMC.exe
2472	xfKqiIw.exe
1256	luyYwQO.exe
2528	lHtzooj.exe
2136	NnyRnyL.exe
2644	mJlRpYr.exe

Loads dropped DLL 64 IoCs

pid	Process
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2084-0-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/files/0x000500000000b309-6.dat	upx
behavioral1/memory/2132-9-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/files/0x004b0000000131b0-13.dat	upx
behavioral1/memory/2856-14-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/files/0x0021000000013400-12.dat	upx
behavioral1/files/0x000d0000000054aa-35.dat	upx
behavioral1/files/0x0008000000013404-31.dat	upx
behavioral1/files/0x00090000000134c5-40.dat	upx
behavioral1/files/0x0006000000015d48-54.dat	upx
behavioral1/files/0x0007000000014400-50.dat	upx
behavioral1/files/0x0006000000015d79-75.dat	upx
behavioral1/files/0x0006000000015e3c-84.dat	upx
behavioral1/files/0x0006000000016820-132.dat	upx
behavioral1/files/0x0006000000016493-129.dat	upx
behavioral1/memory/2204-149-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2572-153-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/files/0x0006000000016c46-180.dat	upx
behavioral1/files/0x0006000000016c9c-190.dat	upx
behavioral1/files/0x0006000000016cf0-186.dat	upx
behavioral1/files/0x0006000000016d01-192.dat	upx
behavioral1/memory/2824-168-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2820-166-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/1948-164-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/files/0x0006000000016cc7-184.dat	upx
behavioral1/files/0x0006000000016c4f-176.dat	upx
behavioral1/files/0x0006000000016a74-140.dat	upx
behavioral1/memory/2404-159-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2904-157-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/2620-155-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/memory/2740-151-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/files/0x0006000000016c2d-146.dat	upx
behavioral1/files/0x00060000000165f9-124.dat	upx
behavioral1/files/0x00060000000161c1-119.dat	upx
behavioral1/files/0x004c0000000132e9-109.dat	upx
behavioral1/files/0x0006000000015fc4-96.dat	upx
behavioral1/files/0x0006000000015f4b-91.dat	upx
behavioral1/files/0x0006000000016557-122.dat	upx
behavioral1/files/0x00060000000162d1-113.dat	upx
behavioral1/files/0x0006000000015de2-80.dat	upx
behavioral1/files/0x00060000000160f5-101.dat	upx
behavioral1/files/0x0006000000015d71-70.dat	upx
behavioral1/files/0x0006000000015d65-65.dat	upx
behavioral1/files/0x0006000000015d55-60.dat	upx
behavioral1/files/0x00090000000143a0-46.dat	upx
behavioral1/memory/2940-25-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/memory/2620-3584-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/memory/2856-4811-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/memory/2740-5029-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2572-5033-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/memory/2824-5037-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/1948-5038-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2904-5041-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/2820-5050-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2132-5077-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2404-5071-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2940-5062-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JCYHuwR.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\ZdzkdQT.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\iuEMtPB.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\QbVsdkb.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\wonUrMp.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\tHdVzwf.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\ypECBKn.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\NnmKRPp.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\gXkIQgN.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\ZFUeDDk.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\aSskovQ.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\DBYUMFT.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\fftKAcy.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\EYyIXHE.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\ZTsRFrq.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\eaXuGyy.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\uXyawtg.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\gnLffUj.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\ZWTidBS.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\viSJvrg.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\YtVmpEL.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\rrJotyt.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\LAGQtmC.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\tiwDsow.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\MxnjWEY.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\gduSUji.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\DGwjZEO.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\wZMqaFH.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\JXbBrpI.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\lozeUdr.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\kdqPIpb.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\uchBwvP.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\MegxWVy.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\mgNIhDj.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\NjhoeQu.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\slvtTxp.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\oEhOGBg.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\ZeYJpHP.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\jREAigW.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\tEOTksC.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\zVyKdZU.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\buOuEMR.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\IqztoLT.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\XWzyGTx.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\sqUHMMU.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\XgHLRmI.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\dzQOGzS.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\dZcWfTx.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\uGmnqwX.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\rNhfCan.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\yyfYZCN.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\VaVwfwn.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\hjQeHEq.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\EktPytu.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\AGCcHrq.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\tGfkpzo.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\pukoNZB.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\OIfWZmo.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\IPQAHgn.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\XcusdDV.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\MgJcRHf.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\PXazavL.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\XmIlQPa.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
File created	C:\Windows\System\ENKObkE.exe	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2920	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
Token: SeLockMemoryPrivilege	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
Token: SeDebugPrivilege	2920	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2920	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	29
PID 2084 wrote to memory of 2920	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	29
PID 2084 wrote to memory of 2920	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	29
PID 2084 wrote to memory of 2132	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	30
PID 2084 wrote to memory of 2132	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	30
PID 2084 wrote to memory of 2132	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	30
PID 2084 wrote to memory of 2856	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	31
PID 2084 wrote to memory of 2856	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	31
PID 2084 wrote to memory of 2856	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	31
PID 2084 wrote to memory of 2940	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	32
PID 2084 wrote to memory of 2940	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	32
PID 2084 wrote to memory of 2940	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	32
PID 2084 wrote to memory of 2204	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	33
PID 2084 wrote to memory of 2204	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	33
PID 2084 wrote to memory of 2204	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	33
PID 2084 wrote to memory of 2740	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	34
PID 2084 wrote to memory of 2740	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	34
PID 2084 wrote to memory of 2740	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	34
PID 2084 wrote to memory of 2572	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	35
PID 2084 wrote to memory of 2572	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	35
PID 2084 wrote to memory of 2572	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	35
PID 2084 wrote to memory of 2620	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	36
PID 2084 wrote to memory of 2620	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	36
PID 2084 wrote to memory of 2620	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	36
PID 2084 wrote to memory of 2904	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	37
PID 2084 wrote to memory of 2904	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	37
PID 2084 wrote to memory of 2904	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	37
PID 2084 wrote to memory of 2404	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	38
PID 2084 wrote to memory of 2404	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	38
PID 2084 wrote to memory of 2404	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	38
PID 2084 wrote to memory of 1948	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	39
PID 2084 wrote to memory of 1948	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	39
PID 2084 wrote to memory of 1948	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	39
PID 2084 wrote to memory of 2820	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	40
PID 2084 wrote to memory of 2820	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	40
PID 2084 wrote to memory of 2820	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	40
PID 2084 wrote to memory of 2824	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	41
PID 2084 wrote to memory of 2824	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	41
PID 2084 wrote to memory of 2824	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	41
PID 2084 wrote to memory of 3036	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	42
PID 2084 wrote to memory of 3036	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	42
PID 2084 wrote to memory of 3036	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	42
PID 2084 wrote to memory of 2412	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	43
PID 2084 wrote to memory of 2412	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	43
PID 2084 wrote to memory of 2412	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	43
PID 2084 wrote to memory of 1968	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	44
PID 2084 wrote to memory of 1968	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	44
PID 2084 wrote to memory of 1968	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	44
PID 2084 wrote to memory of 1552	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	45
PID 2084 wrote to memory of 1552	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	45
PID 2084 wrote to memory of 1552	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	45
PID 2084 wrote to memory of 2468	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	46
PID 2084 wrote to memory of 2468	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	46
PID 2084 wrote to memory of 2468	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	46
PID 2084 wrote to memory of 1856	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	47
PID 2084 wrote to memory of 1856	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	47
PID 2084 wrote to memory of 1856	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	47
PID 2084 wrote to memory of 1512	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	48
PID 2084 wrote to memory of 1512	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	48
PID 2084 wrote to memory of 1512	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	48
PID 2084 wrote to memory of 1936	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	49
PID 2084 wrote to memory of 1936	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	49
PID 2084 wrote to memory of 1936	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	49
PID 2084 wrote to memory of 1148	2084	2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe	50

C:\Users\Admin\AppData\Local\Temp\2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe
"C:\Users\Admin\AppData\Local\Temp\2da582749cf2676e17b8d83fe56438d9937c04834b8871272654f5d71cc9e6fc.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\System\GXIYscb.exe
  C:\Windows\System\GXIYscb.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\wcIAwZM.exe
  C:\Windows\System\wcIAwZM.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\IUfpEWY.exe
  C:\Windows\System\IUfpEWY.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\pFMsIWP.exe
  C:\Windows\System\pFMsIWP.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\wxIgJHT.exe
  C:\Windows\System\wxIgJHT.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\uqFqQcp.exe
  C:\Windows\System\uqFqQcp.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\BqPrRPO.exe
  C:\Windows\System\BqPrRPO.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\dyNfFIq.exe
  C:\Windows\System\dyNfFIq.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\AlulHwn.exe
  C:\Windows\System\AlulHwn.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\XEGwAUq.exe
  C:\Windows\System\XEGwAUq.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\RUgIYtZ.exe
  C:\Windows\System\RUgIYtZ.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\gWOKdlS.exe
  C:\Windows\System\gWOKdlS.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\lwOwmMQ.exe
  C:\Windows\System\lwOwmMQ.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\KxrdXxB.exe
  C:\Windows\System\KxrdXxB.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\NMiFaAz.exe
  C:\Windows\System\NMiFaAz.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\vglEqtR.exe
  C:\Windows\System\vglEqtR.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\CzoQirm.exe
  C:\Windows\System\CzoQirm.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\KiUiPTm.exe
  C:\Windows\System\KiUiPTm.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\VrHufwV.exe
  C:\Windows\System\VrHufwV.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\NFHVRth.exe
  C:\Windows\System\NFHVRth.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\QmltEiI.exe
  C:\Windows\System\QmltEiI.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\jHifGXC.exe
  C:\Windows\System\jHifGXC.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\tjduWqD.exe
  C:\Windows\System\tjduWqD.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\qbLVCpX.exe
  C:\Windows\System\qbLVCpX.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\TTVkCif.exe
  C:\Windows\System\TTVkCif.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\RpREYUm.exe
  C:\Windows\System\RpREYUm.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\FjyZGEy.exe
  C:\Windows\System\FjyZGEy.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\Myufdbh.exe
  C:\Windows\System\Myufdbh.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\hfwqgyt.exe
  C:\Windows\System\hfwqgyt.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\cwGxvUr.exe
  C:\Windows\System\cwGxvUr.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\slZcocb.exe
  C:\Windows\System\slZcocb.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\ucFxmhu.exe
  C:\Windows\System\ucFxmhu.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\ICaripm.exe
  C:\Windows\System\ICaripm.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\BbSxIrw.exe
  C:\Windows\System\BbSxIrw.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\EJcNQUO.exe
  C:\Windows\System\EJcNQUO.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\GyjZXGH.exe
  C:\Windows\System\GyjZXGH.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\jYavPhk.exe
  C:\Windows\System\jYavPhk.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\ihnnKMP.exe
  C:\Windows\System\ihnnKMP.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\iayznlv.exe
  C:\Windows\System\iayznlv.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\RSVsQvz.exe
  C:\Windows\System\RSVsQvz.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\MmGUxFE.exe
  C:\Windows\System\MmGUxFE.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\ocGafMr.exe
  C:\Windows\System\ocGafMr.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\twJYwrQ.exe
  C:\Windows\System\twJYwrQ.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\MiLTIrW.exe
  C:\Windows\System\MiLTIrW.exe
  2⤵
  PID:2992
- C:\Windows\System\vyWyWub.exe
  C:\Windows\System\vyWyWub.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\ozgoUEk.exe
  C:\Windows\System\ozgoUEk.exe
  2⤵
  PID:2288
- C:\Windows\System\VhdIaNW.exe
  C:\Windows\System\VhdIaNW.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\UImPnNU.exe
  C:\Windows\System\UImPnNU.exe
  2⤵
  PID:1816
- C:\Windows\System\ANBJIhS.exe
  C:\Windows\System\ANBJIhS.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\WanVONg.exe
  C:\Windows\System\WanVONg.exe
  2⤵
  PID:2884
- C:\Windows\System\OWixaiv.exe
  C:\Windows\System\OWixaiv.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\kqrBNmW.exe
  C:\Windows\System\kqrBNmW.exe
  2⤵
  PID:1572
- C:\Windows\System\ObbKdVm.exe
  C:\Windows\System\ObbKdVm.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\AtwmsYQ.exe
  C:\Windows\System\AtwmsYQ.exe
  2⤵
  PID:2304
- C:\Windows\System\elzSsco.exe
  C:\Windows\System\elzSsco.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\FMlgEzC.exe
  C:\Windows\System\FMlgEzC.exe
  2⤵
  PID:2868
- C:\Windows\System\yrryCJA.exe
  C:\Windows\System\yrryCJA.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\sPjkxwU.exe
  C:\Windows\System\sPjkxwU.exe
  2⤵
  PID:2704
- C:\Windows\System\gcGbjdl.exe
  C:\Windows\System\gcGbjdl.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\nGZeGDB.exe
  C:\Windows\System\nGZeGDB.exe
  2⤵
  PID:2600
- C:\Windows\System\aimmnzL.exe
  C:\Windows\System\aimmnzL.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\rnmHMCL.exe
  C:\Windows\System\rnmHMCL.exe
  2⤵
  PID:2816
- C:\Windows\System\VwogfPE.exe
  C:\Windows\System\VwogfPE.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\rPmXlSi.exe
  C:\Windows\System\rPmXlSi.exe
  2⤵
  PID:1524
- C:\Windows\System\LvkCIdh.exe
  C:\Windows\System\LvkCIdh.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\iNHcrtZ.exe
  C:\Windows\System\iNHcrtZ.exe
  2⤵
  PID:2916
- C:\Windows\System\UNAsaum.exe
  C:\Windows\System\UNAsaum.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\GuGXrYy.exe
  C:\Windows\System\GuGXrYy.exe
  2⤵
  PID:2788
- C:\Windows\System\dhWkbhF.exe
  C:\Windows\System\dhWkbhF.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\bzecoMg.exe
  C:\Windows\System\bzecoMg.exe
  2⤵
  PID:2672
- C:\Windows\System\jRzmJqw.exe
  C:\Windows\System\jRzmJqw.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\woeQkYD.exe
  C:\Windows\System\woeQkYD.exe
  2⤵
  PID:2960
- C:\Windows\System\aSskovQ.exe
  C:\Windows\System\aSskovQ.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\mYJBuab.exe
  C:\Windows\System\mYJBuab.exe
  2⤵
  PID:1080
- C:\Windows\System\puYXiMC.exe
  C:\Windows\System\puYXiMC.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\RFGAzjQ.exe
  C:\Windows\System\RFGAzjQ.exe
  2⤵
  PID:688
- C:\Windows\System\xfKqiIw.exe
  C:\Windows\System\xfKqiIw.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\wpJInLy.exe
  C:\Windows\System\wpJInLy.exe
  2⤵
  PID:1748
- C:\Windows\System\luyYwQO.exe
  C:\Windows\System\luyYwQO.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\bUXqjhU.exe
  C:\Windows\System\bUXqjhU.exe
  2⤵
  PID:1372
- C:\Windows\System\lHtzooj.exe
  C:\Windows\System\lHtzooj.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\BnCLiIs.exe
  C:\Windows\System\BnCLiIs.exe
  2⤵
  PID:2116
- C:\Windows\System\NnyRnyL.exe
  C:\Windows\System\NnyRnyL.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\abEfvZF.exe
  C:\Windows\System\abEfvZF.exe
  2⤵
  PID:2880
- C:\Windows\System\mJlRpYr.exe
  C:\Windows\System\mJlRpYr.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\cssTYLf.exe
  C:\Windows\System\cssTYLf.exe
  2⤵
  PID:2448
- C:\Windows\System\mCzrPrR.exe
  C:\Windows\System\mCzrPrR.exe
  2⤵
  PID:2328
- C:\Windows\System\dhEQxpa.exe
  C:\Windows\System\dhEQxpa.exe
  2⤵
  PID:2864
- C:\Windows\System\FtFCpvR.exe
  C:\Windows\System\FtFCpvR.exe
  2⤵
  PID:3080
- C:\Windows\System\XjIkIju.exe
  C:\Windows\System\XjIkIju.exe
  2⤵
  PID:3096
- C:\Windows\System\kqmicgn.exe
  C:\Windows\System\kqmicgn.exe
  2⤵
  PID:3112
- C:\Windows\System\hNYGeCL.exe
  C:\Windows\System\hNYGeCL.exe
  2⤵
  PID:3128
- C:\Windows\System\euMRbac.exe
  C:\Windows\System\euMRbac.exe
  2⤵
  PID:3144
- C:\Windows\System\KVCVZzY.exe
  C:\Windows\System\KVCVZzY.exe
  2⤵
  PID:3160
- C:\Windows\System\baCfjJW.exe
  C:\Windows\System\baCfjJW.exe
  2⤵
  PID:3176
- C:\Windows\System\fgRcGlL.exe
  C:\Windows\System\fgRcGlL.exe
  2⤵
  PID:3192
- C:\Windows\System\oPierwp.exe
  C:\Windows\System\oPierwp.exe
  2⤵
  PID:3208
- C:\Windows\System\onyGZHr.exe
  C:\Windows\System\onyGZHr.exe
  2⤵
  PID:3224
- C:\Windows\System\VALpsDi.exe
  C:\Windows\System\VALpsDi.exe
  2⤵
  PID:3240
- C:\Windows\System\GAlkGmf.exe
  C:\Windows\System\GAlkGmf.exe
  2⤵
  PID:3256
- C:\Windows\System\igEdQVO.exe
  C:\Windows\System\igEdQVO.exe
  2⤵
  PID:3272
- C:\Windows\System\nHsVrPi.exe
  C:\Windows\System\nHsVrPi.exe
  2⤵
  PID:3288
- C:\Windows\System\YFsUdVH.exe
  C:\Windows\System\YFsUdVH.exe
  2⤵
  PID:3304
- C:\Windows\System\cLwbNOu.exe
  C:\Windows\System\cLwbNOu.exe
  2⤵
  PID:3320
- C:\Windows\System\jWbCAtw.exe
  C:\Windows\System\jWbCAtw.exe
  2⤵
  PID:3336
- C:\Windows\System\iNkuJoR.exe
  C:\Windows\System\iNkuJoR.exe
  2⤵
  PID:3352
- C:\Windows\System\MOYZxPx.exe
  C:\Windows\System\MOYZxPx.exe
  2⤵
  PID:3368
- C:\Windows\System\zEZzNKT.exe
  C:\Windows\System\zEZzNKT.exe
  2⤵
  PID:3384
- C:\Windows\System\jDgtYaf.exe
  C:\Windows\System\jDgtYaf.exe
  2⤵
  PID:3400
- C:\Windows\System\nfIkaOQ.exe
  C:\Windows\System\nfIkaOQ.exe
  2⤵
  PID:3416
- C:\Windows\System\doZqVAi.exe
  C:\Windows\System\doZqVAi.exe
  2⤵
  PID:3432
- C:\Windows\System\bpbAvGz.exe
  C:\Windows\System\bpbAvGz.exe
  2⤵
  PID:3448
- C:\Windows\System\ziSYGIU.exe
  C:\Windows\System\ziSYGIU.exe
  2⤵
  PID:3464
- C:\Windows\System\XiHAyFo.exe
  C:\Windows\System\XiHAyFo.exe
  2⤵
  PID:3480
- C:\Windows\System\eMqcsMS.exe
  C:\Windows\System\eMqcsMS.exe
  2⤵
  PID:3496
- C:\Windows\System\FRAfsRX.exe
  C:\Windows\System\FRAfsRX.exe
  2⤵
  PID:3512
- C:\Windows\System\CyrpwsZ.exe
  C:\Windows\System\CyrpwsZ.exe
  2⤵
  PID:3528
- C:\Windows\System\szyNWvX.exe
  C:\Windows\System\szyNWvX.exe
  2⤵
  PID:3544
- C:\Windows\System\QrnBUxR.exe
  C:\Windows\System\QrnBUxR.exe
  2⤵
  PID:3560
- C:\Windows\System\eRjQZjj.exe
  C:\Windows\System\eRjQZjj.exe
  2⤵
  PID:3576
- C:\Windows\System\JkedjCY.exe
  C:\Windows\System\JkedjCY.exe
  2⤵
  PID:3592
- C:\Windows\System\UVOrIlo.exe
  C:\Windows\System\UVOrIlo.exe
  2⤵
  PID:3608
- C:\Windows\System\VXCehbO.exe
  C:\Windows\System\VXCehbO.exe
  2⤵
  PID:3624
- C:\Windows\System\yUlfSCS.exe
  C:\Windows\System\yUlfSCS.exe
  2⤵
  PID:3640
- C:\Windows\System\EjPGMDU.exe
  C:\Windows\System\EjPGMDU.exe
  2⤵
  PID:3656
- C:\Windows\System\WQlWtCb.exe
  C:\Windows\System\WQlWtCb.exe
  2⤵
  PID:3672
- C:\Windows\System\zbFSDGs.exe
  C:\Windows\System\zbFSDGs.exe
  2⤵
  PID:3688
- C:\Windows\System\OTOxITD.exe
  C:\Windows\System\OTOxITD.exe
  2⤵
  PID:3704
- C:\Windows\System\TSsROSE.exe
  C:\Windows\System\TSsROSE.exe
  2⤵
  PID:3720
- C:\Windows\System\qngCdpi.exe
  C:\Windows\System\qngCdpi.exe
  2⤵
  PID:3736
- C:\Windows\System\ObLFUcT.exe
  C:\Windows\System\ObLFUcT.exe
  2⤵
  PID:3752
- C:\Windows\System\NlwBija.exe
  C:\Windows\System\NlwBija.exe
  2⤵
  PID:3768
- C:\Windows\System\nFXBjOz.exe
  C:\Windows\System\nFXBjOz.exe
  2⤵
  PID:3784
- C:\Windows\System\oHDuRNM.exe
  C:\Windows\System\oHDuRNM.exe
  2⤵
  PID:3800
- C:\Windows\System\TyDZeyI.exe
  C:\Windows\System\TyDZeyI.exe
  2⤵
  PID:3816
- C:\Windows\System\HjKXbCY.exe
  C:\Windows\System\HjKXbCY.exe
  2⤵
  PID:3832
- C:\Windows\System\jpqMGsT.exe
  C:\Windows\System\jpqMGsT.exe
  2⤵
  PID:3848
- C:\Windows\System\GpmYUql.exe
  C:\Windows\System\GpmYUql.exe
  2⤵
  PID:3864
- C:\Windows\System\uYybuUk.exe
  C:\Windows\System\uYybuUk.exe
  2⤵
  PID:3880
- C:\Windows\System\ximJjuX.exe
  C:\Windows\System\ximJjuX.exe
  2⤵
  PID:3896
- C:\Windows\System\WuQZEvK.exe
  C:\Windows\System\WuQZEvK.exe
  2⤵
  PID:3912
- C:\Windows\System\loYSvKl.exe
  C:\Windows\System\loYSvKl.exe
  2⤵
  PID:3928
- C:\Windows\System\ECjNcpj.exe
  C:\Windows\System\ECjNcpj.exe
  2⤵
  PID:3944
- C:\Windows\System\MpPWOoc.exe
  C:\Windows\System\MpPWOoc.exe
  2⤵
  PID:3960
- C:\Windows\System\MJuufmy.exe
  C:\Windows\System\MJuufmy.exe
  2⤵
  PID:3976
- C:\Windows\System\LGLzncL.exe
  C:\Windows\System\LGLzncL.exe
  2⤵
  PID:3992
- C:\Windows\System\WOTSSPM.exe
  C:\Windows\System\WOTSSPM.exe
  2⤵
  PID:4008
- C:\Windows\System\HIWEiRn.exe
  C:\Windows\System\HIWEiRn.exe
  2⤵
  PID:4024
- C:\Windows\System\kgAHowm.exe
  C:\Windows\System\kgAHowm.exe
  2⤵
  PID:4040
- C:\Windows\System\DbqiLML.exe
  C:\Windows\System\DbqiLML.exe
  2⤵
  PID:4056
- C:\Windows\System\CYpEHwl.exe
  C:\Windows\System\CYpEHwl.exe
  2⤵
  PID:4072
- C:\Windows\System\iEPgPwK.exe
  C:\Windows\System\iEPgPwK.exe
  2⤵
  PID:4088
- C:\Windows\System\OBhQFsd.exe
  C:\Windows\System\OBhQFsd.exe
  2⤵
  PID:1972
- C:\Windows\System\VtRZqOr.exe
  C:\Windows\System\VtRZqOr.exe
  2⤵
  PID:1548
- C:\Windows\System\kpZshmv.exe
  C:\Windows\System\kpZshmv.exe
  2⤵
  PID:3052
- C:\Windows\System\ZPKJHaD.exe
  C:\Windows\System\ZPKJHaD.exe
  2⤵
  PID:2800
- C:\Windows\System\UZKSqVP.exe
  C:\Windows\System\UZKSqVP.exe
  2⤵
  PID:3092
- C:\Windows\System\DoHlkLc.exe
  C:\Windows\System\DoHlkLc.exe
  2⤵
  PID:3156
- C:\Windows\System\NyQiQaD.exe
  C:\Windows\System\NyQiQaD.exe
  2⤵
  PID:3220
- C:\Windows\System\gElIcbn.exe
  C:\Windows\System\gElIcbn.exe
  2⤵
  PID:3284
- C:\Windows\System\jfOUNMy.exe
  C:\Windows\System\jfOUNMy.exe
  2⤵
  PID:3348
- C:\Windows\System\lTglAui.exe
  C:\Windows\System\lTglAui.exe
  2⤵
  PID:3412
- C:\Windows\System\LYXTvMe.exe
  C:\Windows\System\LYXTvMe.exe
  2⤵
  PID:3472
- C:\Windows\System\JMLyLmY.exe
  C:\Windows\System\JMLyLmY.exe
  2⤵
  PID:3508
- C:\Windows\System\jULJIDo.exe
  C:\Windows\System\jULJIDo.exe
  2⤵
  PID:3568
- C:\Windows\System\TEKPZqw.exe
  C:\Windows\System\TEKPZqw.exe
  2⤵
  PID:3604
- C:\Windows\System\aBiJxSj.exe
  C:\Windows\System\aBiJxSj.exe
  2⤵
  PID:3696
- C:\Windows\System\sMUmJYV.exe
  C:\Windows\System\sMUmJYV.exe
  2⤵
  PID:3760
- C:\Windows\System\CZvHlam.exe
  C:\Windows\System\CZvHlam.exe
  2⤵
  PID:3824
- C:\Windows\System\kCjEfWP.exe
  C:\Windows\System\kCjEfWP.exe
  2⤵
  PID:3888
- C:\Windows\System\QIegBNz.exe
  C:\Windows\System\QIegBNz.exe
  2⤵
  PID:3952
- C:\Windows\System\clPKXFx.exe
  C:\Windows\System\clPKXFx.exe
  2⤵
  PID:4016
- C:\Windows\System\VBThgLu.exe
  C:\Windows\System\VBThgLu.exe
  2⤵
  PID:4080
- C:\Windows\System\RBosGqO.exe
  C:\Windows\System\RBosGqO.exe
  2⤵
  PID:980
- C:\Windows\System\sxWzZLZ.exe
  C:\Windows\System\sxWzZLZ.exe
  2⤵
  PID:4104
- C:\Windows\System\LWDKuur.exe
  C:\Windows\System\LWDKuur.exe
  2⤵
  PID:4120
- C:\Windows\System\JCYHuwR.exe
  C:\Windows\System\JCYHuwR.exe
  2⤵
  PID:4136
- C:\Windows\System\pukoNZB.exe
  C:\Windows\System\pukoNZB.exe
  2⤵
  PID:4152
- C:\Windows\System\YmMWpsi.exe
  C:\Windows\System\YmMWpsi.exe
  2⤵
  PID:4168
- C:\Windows\System\ZnBUzXK.exe
  C:\Windows\System\ZnBUzXK.exe
  2⤵
  PID:4184
- C:\Windows\System\LGdiDOY.exe
  C:\Windows\System\LGdiDOY.exe
  2⤵
  PID:4200
- C:\Windows\System\nHEIqjI.exe
  C:\Windows\System\nHEIqjI.exe
  2⤵
  PID:4216
- C:\Windows\System\KdvvePd.exe
  C:\Windows\System\KdvvePd.exe
  2⤵
  PID:4232
- C:\Windows\System\faXZVdF.exe
  C:\Windows\System\faXZVdF.exe
  2⤵
  PID:4248
- C:\Windows\System\jnwtuoX.exe
  C:\Windows\System\jnwtuoX.exe
  2⤵
  PID:4264
- C:\Windows\System\JLiHetR.exe
  C:\Windows\System\JLiHetR.exe
  2⤵
  PID:4280
- C:\Windows\System\jDgcGmv.exe
  C:\Windows\System\jDgcGmv.exe
  2⤵
  PID:4296
- C:\Windows\System\HNZUKqF.exe
  C:\Windows\System\HNZUKqF.exe
  2⤵
  PID:4312
- C:\Windows\System\bpqQwRN.exe
  C:\Windows\System\bpqQwRN.exe
  2⤵
  PID:4328
- C:\Windows\System\oDzsPSq.exe
  C:\Windows\System\oDzsPSq.exe
  2⤵
  PID:4344
- C:\Windows\System\ZgyNsBm.exe
  C:\Windows\System\ZgyNsBm.exe
  2⤵
  PID:4360
- C:\Windows\System\CvAICbY.exe
  C:\Windows\System\CvAICbY.exe
  2⤵
  PID:4376
- C:\Windows\System\efUjJxT.exe
  C:\Windows\System\efUjJxT.exe
  2⤵
  PID:4392
- C:\Windows\System\TKfJebL.exe
  C:\Windows\System\TKfJebL.exe
  2⤵
  PID:4408
- C:\Windows\System\otRscZR.exe
  C:\Windows\System\otRscZR.exe
  2⤵
  PID:4424
- C:\Windows\System\wPrLLex.exe
  C:\Windows\System\wPrLLex.exe
  2⤵
  PID:4440
- C:\Windows\System\eNlALSp.exe
  C:\Windows\System\eNlALSp.exe
  2⤵
  PID:4456
- C:\Windows\System\INoIMTa.exe
  C:\Windows\System\INoIMTa.exe
  2⤵
  PID:4472
- C:\Windows\System\CqnvPPW.exe
  C:\Windows\System\CqnvPPW.exe
  2⤵
  PID:4488
- C:\Windows\System\YivEELq.exe
  C:\Windows\System\YivEELq.exe
  2⤵
  PID:4504
- C:\Windows\System\nbVjZJJ.exe
  C:\Windows\System\nbVjZJJ.exe
  2⤵
  PID:4520
- C:\Windows\System\kvBNVWX.exe
  C:\Windows\System\kvBNVWX.exe
  2⤵
  PID:4536
- C:\Windows\System\RLvYGgC.exe
  C:\Windows\System\RLvYGgC.exe
  2⤵
  PID:4552
- C:\Windows\System\IdDiLRx.exe
  C:\Windows\System\IdDiLRx.exe
  2⤵
  PID:4568
- C:\Windows\System\cCZyqET.exe
  C:\Windows\System\cCZyqET.exe
  2⤵
  PID:4584
- C:\Windows\System\FymgBBi.exe
  C:\Windows\System\FymgBBi.exe
  2⤵
  PID:4600
- C:\Windows\System\XpjTovv.exe
  C:\Windows\System\XpjTovv.exe
  2⤵
  PID:4616
- C:\Windows\System\TneEdRc.exe
  C:\Windows\System\TneEdRc.exe
  2⤵
  PID:4636
- C:\Windows\System\qLrVPAM.exe
  C:\Windows\System\qLrVPAM.exe
  2⤵
  PID:4652
- C:\Windows\System\hMWPMvS.exe
  C:\Windows\System\hMWPMvS.exe
  2⤵
  PID:4668
- C:\Windows\System\oXJsQzG.exe
  C:\Windows\System\oXJsQzG.exe
  2⤵
  PID:4684
- C:\Windows\System\ijTGSKb.exe
  C:\Windows\System\ijTGSKb.exe
  2⤵
  PID:4700
- C:\Windows\System\sohCOkJ.exe
  C:\Windows\System\sohCOkJ.exe
  2⤵
  PID:4716
- C:\Windows\System\qZUYHSt.exe
  C:\Windows\System\qZUYHSt.exe
  2⤵
  PID:4732
- C:\Windows\System\JBfIzKg.exe
  C:\Windows\System\JBfIzKg.exe
  2⤵
  PID:4748
- C:\Windows\System\cPYSpZB.exe
  C:\Windows\System\cPYSpZB.exe
  2⤵
  PID:4764
- C:\Windows\System\OnOFraT.exe
  C:\Windows\System\OnOFraT.exe
  2⤵
  PID:4780
- C:\Windows\System\loMhQeg.exe
  C:\Windows\System\loMhQeg.exe
  2⤵
  PID:4796
- C:\Windows\System\AlOAOvw.exe
  C:\Windows\System\AlOAOvw.exe
  2⤵
  PID:4812
- C:\Windows\System\wzQECLK.exe
  C:\Windows\System\wzQECLK.exe
  2⤵
  PID:4828
- C:\Windows\System\syuMPPK.exe
  C:\Windows\System\syuMPPK.exe
  2⤵
  PID:4844
- C:\Windows\System\OPzxoEJ.exe
  C:\Windows\System\OPzxoEJ.exe
  2⤵
  PID:4860
- C:\Windows\System\HkxEFom.exe
  C:\Windows\System\HkxEFom.exe
  2⤵
  PID:4876
- C:\Windows\System\zxaSRgE.exe
  C:\Windows\System\zxaSRgE.exe
  2⤵
  PID:4892
- C:\Windows\System\GuWdokV.exe
  C:\Windows\System\GuWdokV.exe
  2⤵
  PID:4908
- C:\Windows\System\eMRpngx.exe
  C:\Windows\System\eMRpngx.exe
  2⤵
  PID:4924
- C:\Windows\System\GNpGlxJ.exe
  C:\Windows\System\GNpGlxJ.exe
  2⤵
  PID:4940
- C:\Windows\System\oHKAckY.exe
  C:\Windows\System\oHKAckY.exe
  2⤵
  PID:4956
- C:\Windows\System\xJJPEoK.exe
  C:\Windows\System\xJJPEoK.exe
  2⤵
  PID:4972
- C:\Windows\System\zEvlkqQ.exe
  C:\Windows\System\zEvlkqQ.exe
  2⤵
  PID:4988
- C:\Windows\System\jRgNJLc.exe
  C:\Windows\System\jRgNJLc.exe
  2⤵
  PID:5004
- C:\Windows\System\CNXkYUB.exe
  C:\Windows\System\CNXkYUB.exe
  2⤵
  PID:5020
- C:\Windows\System\UiYYrTT.exe
  C:\Windows\System\UiYYrTT.exe
  2⤵
  PID:5036
- C:\Windows\System\cUdkbOw.exe
  C:\Windows\System\cUdkbOw.exe
  2⤵
  PID:5052
- C:\Windows\System\JPZcUiB.exe
  C:\Windows\System\JPZcUiB.exe
  2⤵
  PID:5068
- C:\Windows\System\hspZzgi.exe
  C:\Windows\System\hspZzgi.exe
  2⤵
  PID:5084
- C:\Windows\System\QvRrvQl.exe
  C:\Windows\System\QvRrvQl.exe
  2⤵
  PID:5100
- C:\Windows\System\jexoqxm.exe
  C:\Windows\System\jexoqxm.exe
  2⤵
  PID:5116
- C:\Windows\System\WdCMpnO.exe
  C:\Windows\System\WdCMpnO.exe
  2⤵
  PID:2112
- C:\Windows\System\MoFTQYH.exe
  C:\Windows\System\MoFTQYH.exe
  2⤵
  PID:3380
- C:\Windows\System\WcZmCdP.exe
  C:\Windows\System\WcZmCdP.exe
  2⤵
  PID:3600
- C:\Windows\System\jgQBozG.exe
  C:\Windows\System\jgQBozG.exe
  2⤵
  PID:3856
- C:\Windows\System\apMkhby.exe
  C:\Windows\System\apMkhby.exe
  2⤵
  PID:4084
- C:\Windows\System\YcntwLQ.exe
  C:\Windows\System\YcntwLQ.exe
  2⤵
  PID:4144
- C:\Windows\System\lWZsNyn.exe
  C:\Windows\System\lWZsNyn.exe
  2⤵
  PID:4208
- C:\Windows\System\ZivWmHP.exe
  C:\Windows\System\ZivWmHP.exe
  2⤵
  PID:4244
- C:\Windows\System\vZoxdxf.exe
  C:\Windows\System\vZoxdxf.exe
  2⤵
  PID:4308
- C:\Windows\System\SolcQVi.exe
  C:\Windows\System\SolcQVi.exe
  2⤵
  PID:4368
- C:\Windows\System\tpbYuvR.exe
  C:\Windows\System\tpbYuvR.exe
  2⤵
  PID:4400
- C:\Windows\System\vSIGrrO.exe
  C:\Windows\System\vSIGrrO.exe
  2⤵
  PID:4464
- C:\Windows\System\vLIWelE.exe
  C:\Windows\System\vLIWelE.exe
  2⤵
  PID:1588
- C:\Windows\System\opVFUny.exe
  C:\Windows\System\opVFUny.exe
  2⤵
  PID:4560
- C:\Windows\System\zbzDzee.exe
  C:\Windows\System\zbzDzee.exe
  2⤵
  PID:4596
- C:\Windows\System\RYuNOXi.exe
  C:\Windows\System\RYuNOXi.exe
  2⤵
  PID:1900
- C:\Windows\System\CPcjOhO.exe
  C:\Windows\System\CPcjOhO.exe
  2⤵
  PID:4696
- C:\Windows\System\YApVnBg.exe
  C:\Windows\System\YApVnBg.exe
  2⤵
  PID:1652
- C:\Windows\System\AbIksPH.exe
  C:\Windows\System\AbIksPH.exe
  2⤵
  PID:4788
- C:\Windows\System\tNdmnkw.exe
  C:\Windows\System\tNdmnkw.exe
  2⤵
  PID:4824
- C:\Windows\System\YkcEwoz.exe
  C:\Windows\System\YkcEwoz.exe
  2⤵
  PID:4856
- C:\Windows\System\hzxZBtJ.exe
  C:\Windows\System\hzxZBtJ.exe
  2⤵
  PID:4920
- C:\Windows\System\nHihKcv.exe
  C:\Windows\System\nHihKcv.exe
  2⤵
  PID:4980
- C:\Windows\System\LlCZANj.exe
  C:\Windows\System\LlCZANj.exe
  2⤵
  PID:5044
- C:\Windows\System\VVrVmYv.exe
  C:\Windows\System\VVrVmYv.exe
  2⤵
  PID:5108
- C:\Windows\System\KGPWNqz.exe
  C:\Windows\System\KGPWNqz.exe
  2⤵
  PID:3728
- C:\Windows\System\jIXyVSt.exe
  C:\Windows\System\jIXyVSt.exe
  2⤵
  PID:2808
- C:\Windows\System\WBuwNvM.exe
  C:\Windows\System\WBuwNvM.exe
  2⤵
  PID:2792
- C:\Windows\System\JKpIpqk.exe
  C:\Windows\System\JKpIpqk.exe
  2⤵
  PID:4528
- C:\Windows\System\rgnCVhd.exe
  C:\Windows\System\rgnCVhd.exe
  2⤵
  PID:2636
- C:\Windows\System\nzbIHjo.exe
  C:\Windows\System\nzbIHjo.exe
  2⤵
  PID:5124
- C:\Windows\System\ECRthhl.exe
  C:\Windows\System\ECRthhl.exe
  2⤵
  PID:5140
- C:\Windows\System\RGrQddB.exe
  C:\Windows\System\RGrQddB.exe
  2⤵
  PID:5156
- C:\Windows\System\zBDjTpT.exe
  C:\Windows\System\zBDjTpT.exe
  2⤵
  PID:5172
- C:\Windows\System\LyBsYjY.exe
  C:\Windows\System\LyBsYjY.exe
  2⤵
  PID:5188
- C:\Windows\System\gcjCUpx.exe
  C:\Windows\System\gcjCUpx.exe
  2⤵
  PID:5204
- C:\Windows\System\rMWkyhc.exe
  C:\Windows\System\rMWkyhc.exe
  2⤵
  PID:5220
- C:\Windows\System\hpVCMYl.exe
  C:\Windows\System\hpVCMYl.exe
  2⤵
  PID:5236
- C:\Windows\System\IsNfQdI.exe
  C:\Windows\System\IsNfQdI.exe
  2⤵
  PID:5252
- C:\Windows\System\fJPaQRG.exe
  C:\Windows\System\fJPaQRG.exe
  2⤵
  PID:5268
- C:\Windows\System\PddvwIp.exe
  C:\Windows\System\PddvwIp.exe
  2⤵
  PID:5284
- C:\Windows\System\frwqJBF.exe
  C:\Windows\System\frwqJBF.exe
  2⤵
  PID:5300
- C:\Windows\System\hZqdppn.exe
  C:\Windows\System\hZqdppn.exe
  2⤵
  PID:5316
- C:\Windows\System\dDeuAiI.exe
  C:\Windows\System\dDeuAiI.exe
  2⤵
  PID:5332
- C:\Windows\System\yRZihny.exe
  C:\Windows\System\yRZihny.exe
  2⤵
  PID:5348
- C:\Windows\System\Wezbfgu.exe
  C:\Windows\System\Wezbfgu.exe
  2⤵
  PID:5364
- C:\Windows\System\QSokYzd.exe
  C:\Windows\System\QSokYzd.exe
  2⤵
  PID:5380
- C:\Windows\System\hnIceBN.exe
  C:\Windows\System\hnIceBN.exe
  2⤵
  PID:5396
- C:\Windows\System\rdvyUOc.exe
  C:\Windows\System\rdvyUOc.exe
  2⤵
  PID:5412
- C:\Windows\System\fONueoV.exe
  C:\Windows\System\fONueoV.exe
  2⤵
  PID:5428
- C:\Windows\System\kTeTlpD.exe
  C:\Windows\System\kTeTlpD.exe
  2⤵
  PID:5444
- C:\Windows\System\VCrrVkU.exe
  C:\Windows\System\VCrrVkU.exe
  2⤵
  PID:5460
- C:\Windows\System\XnqPCIp.exe
  C:\Windows\System\XnqPCIp.exe
  2⤵
  PID:5476
- C:\Windows\System\JhteDem.exe
  C:\Windows\System\JhteDem.exe
  2⤵
  PID:5492
- C:\Windows\System\wvguKfU.exe
  C:\Windows\System\wvguKfU.exe
  2⤵
  PID:5508
- C:\Windows\System\ZqNqATt.exe
  C:\Windows\System\ZqNqATt.exe
  2⤵
  PID:5524
- C:\Windows\System\sbKwfQj.exe
  C:\Windows\System\sbKwfQj.exe
  2⤵
  PID:5540
- C:\Windows\System\oMsHCio.exe
  C:\Windows\System\oMsHCio.exe
  2⤵
  PID:5556
- C:\Windows\System\gmUpORO.exe
  C:\Windows\System\gmUpORO.exe
  2⤵
  PID:5576
- C:\Windows\System\tmxduxO.exe
  C:\Windows\System\tmxduxO.exe
  2⤵
  PID:5592
- C:\Windows\System\nryWXdH.exe
  C:\Windows\System\nryWXdH.exe
  2⤵
  PID:5608
- C:\Windows\System\xmUHjYl.exe
  C:\Windows\System\xmUHjYl.exe
  2⤵
  PID:5624
- C:\Windows\System\DCNWSDM.exe
  C:\Windows\System\DCNWSDM.exe
  2⤵
  PID:5640
- C:\Windows\System\giGXMWE.exe
  C:\Windows\System\giGXMWE.exe
  2⤵
  PID:5656
- C:\Windows\System\DEzFPoY.exe
  C:\Windows\System\DEzFPoY.exe
  2⤵
  PID:5672
- C:\Windows\System\HLpNGKW.exe
  C:\Windows\System\HLpNGKW.exe
  2⤵
  PID:5688
- C:\Windows\System\vRSogqU.exe
  C:\Windows\System\vRSogqU.exe
  2⤵
  PID:5704
- C:\Windows\System\LBGJJoz.exe
  C:\Windows\System\LBGJJoz.exe
  2⤵
  PID:5720
- C:\Windows\System\udqxspd.exe
  C:\Windows\System\udqxspd.exe
  2⤵
  PID:5736
- C:\Windows\System\unwmOzX.exe
  C:\Windows\System\unwmOzX.exe
  2⤵
  PID:5752
- C:\Windows\System\BnUwCZG.exe
  C:\Windows\System\BnUwCZG.exe
  2⤵
  PID:5768
- C:\Windows\System\ywtggYF.exe
  C:\Windows\System\ywtggYF.exe
  2⤵
  PID:5784
- C:\Windows\System\nAAPxMr.exe
  C:\Windows\System\nAAPxMr.exe
  2⤵
  PID:5800
- C:\Windows\System\diBAWlg.exe
  C:\Windows\System\diBAWlg.exe
  2⤵
  PID:5816
- C:\Windows\System\OqduHWk.exe
  C:\Windows\System\OqduHWk.exe
  2⤵
  PID:5832
- C:\Windows\System\rGBxnwb.exe
  C:\Windows\System\rGBxnwb.exe
  2⤵
  PID:5848
- C:\Windows\System\LoOflKF.exe
  C:\Windows\System\LoOflKF.exe
  2⤵
  PID:5864
- C:\Windows\System\zjlFHcJ.exe
  C:\Windows\System\zjlFHcJ.exe
  2⤵
  PID:5880
- C:\Windows\System\UiaHimc.exe
  C:\Windows\System\UiaHimc.exe
  2⤵
  PID:5896
- C:\Windows\System\uEpKedl.exe
  C:\Windows\System\uEpKedl.exe
  2⤵
  PID:5912
- C:\Windows\System\emJdWiU.exe
  C:\Windows\System\emJdWiU.exe
  2⤵
  PID:5928
- C:\Windows\System\uSnrvSl.exe
  C:\Windows\System\uSnrvSl.exe
  2⤵
  PID:5944
- C:\Windows\System\RmhdCDV.exe
  C:\Windows\System\RmhdCDV.exe
  2⤵
  PID:5960
- C:\Windows\System\ghENWnd.exe
  C:\Windows\System\ghENWnd.exe
  2⤵
  PID:5976
- C:\Windows\System\NcCOzDd.exe
  C:\Windows\System\NcCOzDd.exe
  2⤵
  PID:5992
- C:\Windows\System\aWIDYdw.exe
  C:\Windows\System\aWIDYdw.exe
  2⤵
  PID:6008
- C:\Windows\System\IdhfIxF.exe
  C:\Windows\System\IdhfIxF.exe
  2⤵
  PID:6024
- C:\Windows\System\pVHCJMC.exe
  C:\Windows\System\pVHCJMC.exe
  2⤵
  PID:6040
- C:\Windows\System\zSgannx.exe
  C:\Windows\System\zSgannx.exe
  2⤵
  PID:6056
- C:\Windows\System\NHtKFwR.exe
  C:\Windows\System\NHtKFwR.exe
  2⤵
  PID:6072
- C:\Windows\System\hneEfYi.exe
  C:\Windows\System\hneEfYi.exe
  2⤵
  PID:6088
- C:\Windows\System\CcBYoEO.exe
  C:\Windows\System\CcBYoEO.exe
  2⤵
  PID:6104
- C:\Windows\System\muJZfvS.exe
  C:\Windows\System\muJZfvS.exe
  2⤵
  PID:6120
- C:\Windows\System\YtvLcOr.exe
  C:\Windows\System\YtvLcOr.exe
  2⤵
  PID:6136
- C:\Windows\System\QcIArGG.exe
  C:\Windows\System\QcIArGG.exe
  2⤵
  PID:5012
- C:\Windows\System\ypECBKn.exe
  C:\Windows\System\ypECBKn.exe
  2⤵
  PID:3280
- C:\Windows\System\GqswYgR.exe
  C:\Windows\System\GqswYgR.exe
  2⤵
  PID:4628
- C:\Windows\System\EYmIgPb.exe
  C:\Windows\System\EYmIgPb.exe
  2⤵
  PID:5164
- C:\Windows\System\TRyKWip.exe
  C:\Windows\System\TRyKWip.exe
  2⤵
  PID:5200
- C:\Windows\System\dEeGnVB.exe
  C:\Windows\System\dEeGnVB.exe
  2⤵
  PID:444
- C:\Windows\System\LalhGSu.exe
  C:\Windows\System\LalhGSu.exe
  2⤵
  PID:2072
- C:\Windows\System\GqWTCjN.exe
  C:\Windows\System\GqWTCjN.exe
  2⤵
  PID:5328
- C:\Windows\System\qRuShyT.exe
  C:\Windows\System\qRuShyT.exe
  2⤵
  PID:5392
- C:\Windows\System\IgVAyAA.exe
  C:\Windows\System\IgVAyAA.exe
  2⤵
  PID:5452
- C:\Windows\System\lrUXGYc.exe
  C:\Windows\System\lrUXGYc.exe
  2⤵
  PID:5516
- C:\Windows\System\AEVvJgQ.exe
  C:\Windows\System\AEVvJgQ.exe
  2⤵
  PID:5584
- C:\Windows\System\DtDGtoa.exe
  C:\Windows\System\DtDGtoa.exe
  2⤵
  PID:5648
- C:\Windows\System\vjZMMoB.exe
  C:\Windows\System\vjZMMoB.exe
  2⤵
  PID:5712
- C:\Windows\System\WXGNMeL.exe
  C:\Windows\System\WXGNMeL.exe
  2⤵
  PID:5776
- C:\Windows\System\HwxBERs.exe
  C:\Windows\System\HwxBERs.exe
  2⤵
  PID:5840
- C:\Windows\System\eQpBQeJ.exe
  C:\Windows\System\eQpBQeJ.exe
  2⤵
  PID:5904
- C:\Windows\System\DXlXEDT.exe
  C:\Windows\System\DXlXEDT.exe
  2⤵
  PID:5968
- C:\Windows\System\DBYUMFT.exe
  C:\Windows\System\DBYUMFT.exe
  2⤵
  PID:6032
- C:\Windows\System\AIyDqeq.exe
  C:\Windows\System\AIyDqeq.exe
  2⤵
  PID:6096
- C:\Windows\System\YnjcOPm.exe
  C:\Windows\System\YnjcOPm.exe
  2⤵
  PID:3252
- C:\Windows\System\cgEnuTX.exe
  C:\Windows\System\cgEnuTX.exe
  2⤵
  PID:5228
- C:\Windows\System\sYYeuVR.exe
  C:\Windows\System\sYYeuVR.exe
  2⤵
  PID:5424
- C:\Windows\System\dNvrOca.exe
  C:\Windows\System\dNvrOca.exe
  2⤵
  PID:5684
- C:\Windows\System\AtaPnRS.exe
  C:\Windows\System\AtaPnRS.exe
  2⤵
  PID:1504
- C:\Windows\System\HWqWeYx.exe
  C:\Windows\System\HWqWeYx.exe
  2⤵
  PID:648
- C:\Windows\System\rQVbWLw.exe
  C:\Windows\System\rQVbWLw.exe
  2⤵
  PID:1496
- C:\Windows\System\UvfcsrI.exe
  C:\Windows\System\UvfcsrI.exe
  2⤵
  PID:5936
- C:\Windows\System\kMthakP.exe
  C:\Windows\System\kMthakP.exe
  2⤵
  PID:6068
- C:\Windows\System\DdMIZvI.exe
  C:\Windows\System\DdMIZvI.exe
  2⤵
  PID:1640
- C:\Windows\System\LPqiYvu.exe
  C:\Windows\System\LPqiYvu.exe
  2⤵
  PID:976
- C:\Windows\System\IWKthZW.exe
  C:\Windows\System\IWKthZW.exe
  2⤵
  PID:2848
- C:\Windows\System\QWefXwQ.exe
  C:\Windows\System\QWefXwQ.exe
  2⤵
  PID:2872
- C:\Windows\System\DUbOnbF.exe
  C:\Windows\System\DUbOnbF.exe
  2⤵
  PID:5552
- C:\Windows\System\UlbOrpd.exe
  C:\Windows\System\UlbOrpd.exe
  2⤵
  PID:1532
- C:\Windows\System\aKOUedi.exe
  C:\Windows\System\aKOUedi.exe
  2⤵
  PID:6148
- C:\Windows\System\HRweDEn.exe
  C:\Windows\System\HRweDEn.exe
  2⤵
  PID:6164
- C:\Windows\System\kMviCHl.exe
  C:\Windows\System\kMviCHl.exe
  2⤵
  PID:6180
- C:\Windows\System\HdWPipd.exe
  C:\Windows\System\HdWPipd.exe
  2⤵
  PID:6196
- C:\Windows\System\TFOupwE.exe
  C:\Windows\System\TFOupwE.exe
  2⤵
  PID:6212
- C:\Windows\System\tsAlfLS.exe
  C:\Windows\System\tsAlfLS.exe
  2⤵
  PID:6228
- C:\Windows\System\OwMGylQ.exe
  C:\Windows\System\OwMGylQ.exe
  2⤵
  PID:6244
- C:\Windows\System\SVIcivI.exe
  C:\Windows\System\SVIcivI.exe
  2⤵
  PID:6260
- C:\Windows\System\qNYnnym.exe
  C:\Windows\System\qNYnnym.exe
  2⤵
  PID:6276
- C:\Windows\System\FRUcWRh.exe
  C:\Windows\System\FRUcWRh.exe
  2⤵
  PID:6292
- C:\Windows\System\bqQznzM.exe
  C:\Windows\System\bqQznzM.exe
  2⤵
  PID:6308
- C:\Windows\System\JNKpvKS.exe
  C:\Windows\System\JNKpvKS.exe
  2⤵
  PID:6324
- C:\Windows\System\qgCRyDf.exe
  C:\Windows\System\qgCRyDf.exe
  2⤵
  PID:6340
- C:\Windows\System\uKMGvIt.exe
  C:\Windows\System\uKMGvIt.exe
  2⤵
  PID:6356
- C:\Windows\System\pbYLnra.exe
  C:\Windows\System\pbYLnra.exe
  2⤵
  PID:6372
- C:\Windows\System\lyPqCbl.exe
  C:\Windows\System\lyPqCbl.exe
  2⤵
  PID:6388
- C:\Windows\System\SYXjuhe.exe
  C:\Windows\System\SYXjuhe.exe
  2⤵
  PID:6404
- C:\Windows\System\WzhqUHl.exe
  C:\Windows\System\WzhqUHl.exe
  2⤵
  PID:6420
- C:\Windows\System\NCeRwli.exe
  C:\Windows\System\NCeRwli.exe
  2⤵
  PID:6436
- C:\Windows\System\HYhqNDT.exe
  C:\Windows\System\HYhqNDT.exe
  2⤵
  PID:6452
- C:\Windows\System\mnnQZGx.exe
  C:\Windows\System\mnnQZGx.exe
  2⤵
  PID:6468
- C:\Windows\System\jPdjlsz.exe
  C:\Windows\System\jPdjlsz.exe
  2⤵
  PID:6484
- C:\Windows\System\STRbTrv.exe
  C:\Windows\System\STRbTrv.exe
  2⤵
  PID:6500
- C:\Windows\System\MCgXQZB.exe
  C:\Windows\System\MCgXQZB.exe
  2⤵
  PID:6516
- C:\Windows\System\ZklUQBP.exe
  C:\Windows\System\ZklUQBP.exe
  2⤵
  PID:6532
- C:\Windows\System\XBROlne.exe
  C:\Windows\System\XBROlne.exe
  2⤵
  PID:6548
- C:\Windows\System\OjuiKbc.exe
  C:\Windows\System\OjuiKbc.exe
  2⤵
  PID:6564
- C:\Windows\System\ADcrYqV.exe
  C:\Windows\System\ADcrYqV.exe
  2⤵
  PID:6580
- C:\Windows\System\plwawfj.exe
  C:\Windows\System\plwawfj.exe
  2⤵
  PID:1756
- C:\Windows\System\henCmrb.exe
  C:\Windows\System\henCmrb.exe
  2⤵
  PID:3428
- C:\Windows\System\ruDPSYW.exe
  C:\Windows\System\ruDPSYW.exe
  2⤵
  PID:3492
- C:\Windows\System\GlZRIrj.exe
  C:\Windows\System\GlZRIrj.exe
  2⤵
  PID:3648
- C:\Windows\System\mQDCUEz.exe
  C:\Windows\System\mQDCUEz.exe
  2⤵
  PID:3584
- C:\Windows\System\uykrKbF.exe
  C:\Windows\System\uykrKbF.exe
  2⤵
  PID:3776
- C:\Windows\System\iFfwOsI.exe
  C:\Windows\System\iFfwOsI.exe
  2⤵
  PID:3840
- C:\Windows\System\FEbUueY.exe
  C:\Windows\System\FEbUueY.exe
  2⤵
  PID:3904
- C:\Windows\System\LZwXOys.exe
  C:\Windows\System\LZwXOys.exe
  2⤵
  PID:3968
- C:\Windows\System\ZnBWEpi.exe
  C:\Windows\System\ZnBWEpi.exe
  2⤵
  PID:4004
- C:\Windows\System\UVgZNrk.exe
  C:\Windows\System\UVgZNrk.exe
  2⤵
  PID:1012
- C:\Windows\System\SrqymnV.exe
  C:\Windows\System\SrqymnV.exe
  2⤵
  PID:2728
- C:\Windows\System\FhFmUdo.exe
  C:\Windows\System\FhFmUdo.exe
  2⤵
  PID:3344
- C:\Windows\System\gDAhGkW.exe
  C:\Windows\System\gDAhGkW.exe
  2⤵
  PID:2460
- C:\Windows\System\KPPIPFL.exe
  C:\Windows\System\KPPIPFL.exe
  2⤵
  PID:4776
- C:\Windows\System\WgJKujg.exe
  C:\Windows\System\WgJKujg.exe
  2⤵
  PID:4964
- C:\Windows\System\osMuGwN.exe
  C:\Windows\System\osMuGwN.exe
  2⤵
  PID:4592
- C:\Windows\System\liDlzkB.exe
  C:\Windows\System\liDlzkB.exe
  2⤵
  PID:3124
- C:\Windows\System\EJOywhH.exe
  C:\Windows\System\EJOywhH.exe
  2⤵
  PID:4164
- C:\Windows\System\ynSxBNV.exe
  C:\Windows\System\ynSxBNV.exe
  2⤵
  PID:6396
- C:\Windows\System\HnKGNXb.exe
  C:\Windows\System\HnKGNXb.exe
  2⤵
  PID:5152
- C:\Windows\System\wusEZGv.exe
  C:\Windows\System\wusEZGv.exe
  2⤵
  PID:4436
- C:\Windows\System\FbfcSsW.exe
  C:\Windows\System\FbfcSsW.exe
  2⤵
  PID:5180
- C:\Windows\System\HTFCqdt.exe
  C:\Windows\System\HTFCqdt.exe
  2⤵
  PID:5312
- C:\Windows\System\FcWgHLo.exe
  C:\Windows\System\FcWgHLo.exe
  2⤵
  PID:5436
- C:\Windows\System\RgKyoGh.exe
  C:\Windows\System\RgKyoGh.exe
  2⤵
  PID:5472
- C:\Windows\System\HhgXkmL.exe
  C:\Windows\System\HhgXkmL.exe
  2⤵
  PID:5536
- C:\Windows\System\xvPadus.exe
  C:\Windows\System\xvPadus.exe
  2⤵
  PID:5604
- C:\Windows\System\UGIWYXQ.exe
  C:\Windows\System\UGIWYXQ.exe
  2⤵
  PID:5668
- C:\Windows\System\beiUzfd.exe
  C:\Windows\System\beiUzfd.exe
  2⤵
  PID:5792
- C:\Windows\System\nlglzET.exe
  C:\Windows\System\nlglzET.exe
  2⤵
  PID:5856
- C:\Windows\System\nEUDJIw.exe
  C:\Windows\System\nEUDJIw.exe
  2⤵
  PID:5956
- C:\Windows\System\ipJXDzd.exe
  C:\Windows\System\ipJXDzd.exe
  2⤵
  PID:6020
- C:\Windows\System\vyGGUBo.exe
  C:\Windows\System\vyGGUBo.exe
  2⤵
  PID:6084
- C:\Windows\System\ytwpvZv.exe
  C:\Windows\System\ytwpvZv.exe
  2⤵
  PID:5168
- C:\Windows\System\vpEGDro.exe
  C:\Windows\System\vpEGDro.exe
  2⤵
  PID:5488
- C:\Windows\System\fmDSqcv.exe
  C:\Windows\System\fmDSqcv.exe
  2⤵
  PID:5872
- C:\Windows\System\xfyPbKQ.exe
  C:\Windows\System\xfyPbKQ.exe
  2⤵
  PID:1528
- C:\Windows\System\iXVMiNO.exe
  C:\Windows\System\iXVMiNO.exe
  2⤵
  PID:6116
- C:\Windows\System\lpYrroC.exe
  C:\Windows\System\lpYrroC.exe
  2⤵
  PID:6496
- C:\Windows\System\nGUGFBQ.exe
  C:\Windows\System\nGUGFBQ.exe
  2⤵
  PID:5876
- C:\Windows\System\GayUOXR.exe
  C:\Windows\System\GayUOXR.exe
  2⤵
  PID:5620
- C:\Windows\System\GvDPqDh.exe
  C:\Windows\System\GvDPqDh.exe
  2⤵
  PID:1228
- C:\Windows\System\YpllMAx.exe
  C:\Windows\System\YpllMAx.exe
  2⤵
  PID:672
- C:\Windows\System\sdcSTPE.exe
  C:\Windows\System\sdcSTPE.exe
  2⤵
  PID:2580
- C:\Windows\System\wzLuBWR.exe
  C:\Windows\System\wzLuBWR.exe
  2⤵
  PID:6444
- C:\Windows\System\BfcWVJN.exe
  C:\Windows\System\BfcWVJN.exe
  2⤵
  PID:6380
- C:\Windows\System\cTAlgIM.exe
  C:\Windows\System\cTAlgIM.exe
  2⤵
  PID:6540
- C:\Windows\System\EwfxrtG.exe
  C:\Windows\System\EwfxrtG.exe
  2⤵
  PID:1668
- C:\Windows\System\NiLakVn.exe
  C:\Windows\System\NiLakVn.exe
  2⤵
  PID:2312
- C:\Windows\System\YtLAJSx.exe
  C:\Windows\System\YtLAJSx.exe
  2⤵
  PID:1724
- C:\Windows\System\ImBTIpv.exe
  C:\Windows\System\ImBTIpv.exe
  2⤵
  PID:6208
- C:\Windows\System\LPOJtzc.exe
  C:\Windows\System\LPOJtzc.exe
  2⤵
  PID:6600
- C:\Windows\System\pbSCfvE.exe
  C:\Windows\System\pbSCfvE.exe
  2⤵
  PID:6616
- C:\Windows\System\yzmDWew.exe
  C:\Windows\System\yzmDWew.exe
  2⤵
  PID:6636
- C:\Windows\System\GtPrOPl.exe
  C:\Windows\System\GtPrOPl.exe
  2⤵
  PID:6652
- C:\Windows\System\VMqEWgg.exe
  C:\Windows\System\VMqEWgg.exe
  2⤵
  PID:6668
- C:\Windows\System\nisgFGS.exe
  C:\Windows\System\nisgFGS.exe
  2⤵
  PID:6684
- C:\Windows\System\iHTvuEa.exe
  C:\Windows\System\iHTvuEa.exe
  2⤵
  PID:6700
- C:\Windows\System\YFxgmgg.exe
  C:\Windows\System\YFxgmgg.exe
  2⤵
  PID:6716
- C:\Windows\System\yhLXqwZ.exe
  C:\Windows\System\yhLXqwZ.exe
  2⤵
  PID:6732
- C:\Windows\System\jqAoJvc.exe
  C:\Windows\System\jqAoJvc.exe
  2⤵
  PID:6748
- C:\Windows\System\YjFZrdz.exe
  C:\Windows\System\YjFZrdz.exe
  2⤵
  PID:6760
- C:\Windows\System\DQBrAAr.exe
  C:\Windows\System\DQBrAAr.exe
  2⤵
  PID:6780
- C:\Windows\System\JHNOmtZ.exe
  C:\Windows\System\JHNOmtZ.exe
  2⤵
  PID:6796
- C:\Windows\System\UlsqZOd.exe
  C:\Windows\System\UlsqZOd.exe
  2⤵
  PID:6812
- C:\Windows\System\oyuLVGc.exe
  C:\Windows\System\oyuLVGc.exe
  2⤵
  PID:6828
- C:\Windows\System\pWCtooH.exe
  C:\Windows\System\pWCtooH.exe
  2⤵
  PID:6844
- C:\Windows\System\hAuLfog.exe
  C:\Windows\System\hAuLfog.exe
  2⤵
  PID:6860
- C:\Windows\System\URVNuDj.exe
  C:\Windows\System\URVNuDj.exe
  2⤵
  PID:6876
- C:\Windows\System\FaHLLRP.exe
  C:\Windows\System\FaHLLRP.exe
  2⤵
  PID:6892
- C:\Windows\System\rcCUtwW.exe
  C:\Windows\System\rcCUtwW.exe
  2⤵
  PID:6908
- C:\Windows\System\HniqSxU.exe
  C:\Windows\System\HniqSxU.exe
  2⤵
  PID:6924
- C:\Windows\System\RRHQPDe.exe
  C:\Windows\System\RRHQPDe.exe
  2⤵
  PID:6940
- C:\Windows\System\nqnSCMv.exe
  C:\Windows\System\nqnSCMv.exe
  2⤵
  PID:6956
- C:\Windows\System\NvBADMQ.exe
  C:\Windows\System\NvBADMQ.exe
  2⤵
  PID:6972
- C:\Windows\System\oTyrKdU.exe
  C:\Windows\System\oTyrKdU.exe
  2⤵
  PID:6988
- C:\Windows\System\dUFRMVt.exe
  C:\Windows\System\dUFRMVt.exe
  2⤵
  PID:7004
- C:\Windows\System\ydnKVQA.exe
  C:\Windows\System\ydnKVQA.exe
  2⤵
  PID:7020
- C:\Windows\System\XLWhzKC.exe
  C:\Windows\System\XLWhzKC.exe
  2⤵
  PID:7036
- C:\Windows\System\PzPIevX.exe
  C:\Windows\System\PzPIevX.exe
  2⤵
  PID:7052
- C:\Windows\System\RYUZJAk.exe
  C:\Windows\System\RYUZJAk.exe
  2⤵
  PID:7068
- C:\Windows\System\MWjctIN.exe
  C:\Windows\System\MWjctIN.exe
  2⤵
  PID:7084
- C:\Windows\System\AgguXZs.exe
  C:\Windows\System\AgguXZs.exe
  2⤵
  PID:7100
- C:\Windows\System\SGYXPWY.exe
  C:\Windows\System\SGYXPWY.exe
  2⤵
  PID:7116
- C:\Windows\System\sTkltxP.exe
  C:\Windows\System\sTkltxP.exe
  2⤵
  PID:7132
- C:\Windows\System\DGwjZEO.exe
  C:\Windows\System\DGwjZEO.exe
  2⤵
  PID:7148
- C:\Windows\System\eiYUcsx.exe
  C:\Windows\System\eiYUcsx.exe
  2⤵
  PID:7164
- C:\Windows\System\oipltro.exe
  C:\Windows\System\oipltro.exe
  2⤵
  PID:836
- C:\Windows\System\kTYOAZD.exe
  C:\Windows\System\kTYOAZD.exe
  2⤵
  PID:1288
- C:\Windows\System\rXCrIAX.exe
  C:\Windows\System\rXCrIAX.exe
  2⤵
  PID:892
- C:\Windows\System\HtilmdC.exe
  C:\Windows\System\HtilmdC.exe
  2⤵
  PID:6300
- C:\Windows\System\qOjKsyk.exe
  C:\Windows\System\qOjKsyk.exe
  2⤵
  PID:2768
- C:\Windows\System\etncRPj.exe
  C:\Windows\System\etncRPj.exe
  2⤵
  PID:2548
- C:\Windows\System\nSWjfXZ.exe
  C:\Windows\System\nSWjfXZ.exe
  2⤵
  PID:2592
- C:\Windows\System\huMmpLe.exe
  C:\Windows\System\huMmpLe.exe
  2⤵
  PID:400
- C:\Windows\System\saQQTtO.exe
  C:\Windows\System\saQQTtO.exe
  2⤵
  PID:1252
- C:\Windows\System\OXseUMH.exe
  C:\Windows\System\OXseUMH.exe
  2⤵
  PID:2360
- C:\Windows\System\cwpbcnE.exe
  C:\Windows\System\cwpbcnE.exe
  2⤵
  PID:1764
- C:\Windows\System\KDldQFu.exe
  C:\Windows\System\KDldQFu.exe
  2⤵
  PID:832
- C:\Windows\System\kChNZlD.exe
  C:\Windows\System\kChNZlD.exe
  2⤵
  PID:6428
- C:\Windows\System\fcjQkBn.exe
  C:\Windows\System\fcjQkBn.exe
  2⤵
  PID:2928
- C:\Windows\System\KPBUJGU.exe
  C:\Windows\System\KPBUJGU.exe
  2⤵
  PID:3680
- C:\Windows\System\wjsUjNi.exe
  C:\Windows\System\wjsUjNi.exe
  2⤵
  PID:4032
- C:\Windows\System\DNSxaDW.exe
  C:\Windows\System\DNSxaDW.exe
  2⤵
  PID:4512
- C:\Windows\System\ddntFuV.exe
  C:\Windows\System\ddntFuV.exe
  2⤵
  PID:4676
- C:\Windows\System\hlZUXWp.exe
  C:\Windows\System\hlZUXWp.exe
  2⤵
  PID:5028
- C:\Windows\System\hIaxTMr.exe
  C:\Windows\System\hIaxTMr.exe
  2⤵
  PID:4176
- C:\Windows\System\LNDIPGO.exe
  C:\Windows\System\LNDIPGO.exe
  2⤵
  PID:1732
- C:\Windows\System\iDCfNni.exe
  C:\Windows\System\iDCfNni.exe
  2⤵
  PID:2308
- C:\Windows\System\jZvGnKK.exe
  C:\Windows\System\jZvGnKK.exe
  2⤵
  PID:1876
- C:\Windows\System\gSkOBxV.exe
  C:\Windows\System\gSkOBxV.exe
  2⤵
  PID:4632
- C:\Windows\System\hKbwFgI.exe
  C:\Windows\System\hKbwFgI.exe
  2⤵
  PID:2352
- C:\Windows\System\KHBPzFR.exe
  C:\Windows\System\KHBPzFR.exe
  2⤵
  PID:6524
- C:\Windows\System\CNWoApa.exe
  C:\Windows\System\CNWoApa.exe
  2⤵
  PID:6220
- C:\Windows\System\VwLsOoM.exe
  C:\Windows\System\VwLsOoM.exe
  2⤵
  PID:2564
- C:\Windows\System\BzDkvYN.exe
  C:\Windows\System\BzDkvYN.exe
  2⤵
  PID:6188
- C:\Windows\System\suzWvxU.exe
  C:\Windows\System\suzWvxU.exe
  2⤵
  PID:6588
- C:\Windows\System\tlEvPZh.exe
  C:\Windows\System\tlEvPZh.exe
  2⤵
  PID:6288
- C:\Windows\System\rjfmKRL.exe
  C:\Windows\System\rjfmKRL.exe
  2⤵
  PID:5700
- C:\Windows\System\QuZVwyW.exe
  C:\Windows\System\QuZVwyW.exe
  2⤵
  PID:6160
- C:\Windows\System\gSGjgzo.exe
  C:\Windows\System\gSGjgzo.exe
  2⤵
  PID:6352
- C:\Windows\System\qaVnqIP.exe
  C:\Windows\System\qaVnqIP.exe
  2⤵
  PID:2860
- C:\Windows\System\feewGcp.exe
  C:\Windows\System\feewGcp.exe
  2⤵
  PID:3104
- C:\Windows\System\FoXPzKv.exe
  C:\Windows\System\FoXPzKv.exe
  2⤵
  PID:3168
- C:\Windows\System\zNzlCLw.exe
  C:\Windows\System\zNzlCLw.exe
  2⤵
  PID:3424
- C:\Windows\System\XQDejhh.exe
  C:\Windows\System\XQDejhh.exe
  2⤵
  PID:3616
- C:\Windows\System\TqktvFO.exe
  C:\Windows\System\TqktvFO.exe
  2⤵
  PID:3744
- C:\Windows\System\kIGhwDd.exe
  C:\Windows\System\kIGhwDd.exe
  2⤵
  PID:1992
- C:\Windows\System\sMjfWcD.exe
  C:\Windows\System\sMjfWcD.exe
  2⤵
  PID:3016
- C:\Windows\System\PFVzcoT.exe
  C:\Windows\System\PFVzcoT.exe
  2⤵
  PID:1332
- C:\Windows\System\vKDwqAJ.exe
  C:\Windows\System\vKDwqAJ.exe
  2⤵
  PID:760
- C:\Windows\System\VADESTM.exe
  C:\Windows\System\VADESTM.exe
  2⤵
  PID:2248
- C:\Windows\System\aDzeUpX.exe
  C:\Windows\System\aDzeUpX.exe
  2⤵
  PID:4160
- C:\Windows\System\dwccPhT.exe
  C:\Windows\System\dwccPhT.exe
  2⤵
  PID:3792
- C:\Windows\System\LTHDnkB.exe
  C:\Windows\System\LTHDnkB.exe
  2⤵
  PID:3536
- C:\Windows\System\aAQqEFf.exe
  C:\Windows\System\aAQqEFf.exe
  2⤵
  PID:1956
- C:\Windows\System\ekrvhPh.exe
  C:\Windows\System\ekrvhPh.exe
  2⤵
  PID:3748
- C:\Windows\System\qVmjDhk.exe
  C:\Windows\System\qVmjDhk.exe
  2⤵
  PID:4356
- C:\Windows\System\sUzLIFd.exe
  C:\Windows\System\sUzLIFd.exe
  2⤵
  PID:5468
- C:\Windows\System\viSJvrg.exe
  C:\Windows\System\viSJvrg.exe
  2⤵
  PID:5600
- C:\Windows\System\EomsfKZ.exe
  C:\Windows\System\EomsfKZ.exe
  2⤵
  PID:5764
- C:\Windows\System\PiNyKWt.exe
  C:\Windows\System\PiNyKWt.exe
  2⤵
  PID:5920
- C:\Windows\System\aiqpPBH.exe
  C:\Windows\System\aiqpPBH.exe
  2⤵
  PID:5748
- C:\Windows\System\exxJWGQ.exe
  C:\Windows\System\exxJWGQ.exe
  2⤵
  PID:1416
- C:\Windows\System\aUmomLw.exe
  C:\Windows\System\aUmomLw.exe
  2⤵
  PID:5484
- C:\Windows\System\stISzEh.exe
  C:\Windows\System\stISzEh.exe
  2⤵
  PID:5420
- C:\Windows\System\VHmSaiq.exe
  C:\Windows\System\VHmSaiq.exe
  2⤵
  PID:6528
- C:\Windows\System\raHBcsG.exe
  C:\Windows\System\raHBcsG.exe
  2⤵
  PID:6664
- C:\Windows\System\SrxIaYR.exe
  C:\Windows\System\SrxIaYR.exe
  2⤵
  PID:2748
- C:\Windows\System\yjLHTri.exe
  C:\Windows\System\yjLHTri.exe
  2⤵
  PID:6728
- C:\Windows\System\vWxEWpW.exe
  C:\Windows\System\vWxEWpW.exe
  2⤵
  PID:6448
- C:\Windows\System\NKolMfC.exe
  C:\Windows\System\NKolMfC.exe
  2⤵
  PID:6236
- C:\Windows\System\DHUQzLm.exe
  C:\Windows\System\DHUQzLm.exe
  2⤵
  PID:6648
- C:\Windows\System\KwIyJnN.exe
  C:\Windows\System\KwIyJnN.exe
  2⤵
  PID:6740
- C:\Windows\System\XFRXMGp.exe
  C:\Windows\System\XFRXMGp.exe
  2⤵
  PID:6772
- C:\Windows\System\BrAzHLY.exe
  C:\Windows\System\BrAzHLY.exe
  2⤵
  PID:1976
- C:\Windows\System\XownczW.exe
  C:\Windows\System\XownczW.exe
  2⤵
  PID:6840
- C:\Windows\System\hXbHrQD.exe
  C:\Windows\System\hXbHrQD.exe
  2⤵
  PID:6868
- C:\Windows\System\kEijfNZ.exe
  C:\Windows\System\kEijfNZ.exe
  2⤵
  PID:6788
- C:\Windows\System\oTStQwR.exe
  C:\Windows\System\oTStQwR.exe
  2⤵
  PID:6904
- C:\Windows\System\ikNcHdH.exe
  C:\Windows\System\ikNcHdH.exe
  2⤵
  PID:6968
- C:\Windows\System\haiVGyi.exe
  C:\Windows\System\haiVGyi.exe
  2⤵
  PID:7032
- C:\Windows\System\MleBbYJ.exe
  C:\Windows\System\MleBbYJ.exe
  2⤵
  PID:7124
- C:\Windows\System\nDRNbhD.exe
  C:\Windows\System\nDRNbhD.exe
  2⤵
  PID:7012
- C:\Windows\System\ozlFmRs.exe
  C:\Windows\System\ozlFmRs.exe
  2⤵
  PID:7048
- C:\Windows\System\mrYezVp.exe
  C:\Windows\System\mrYezVp.exe
  2⤵
  PID:7112
- C:\Windows\System\YdfvfhW.exe
  C:\Windows\System\YdfvfhW.exe
  2⤵
  PID:2364
- C:\Windows\System\xzowgxR.exe
  C:\Windows\System\xzowgxR.exe
  2⤵
  PID:1612
- C:\Windows\System\lEiDyoA.exe
  C:\Windows\System\lEiDyoA.exe
  2⤵
  PID:6592
- C:\Windows\System\GFMQpZL.exe
  C:\Windows\System\GFMQpZL.exe
  2⤵
  PID:6336
- C:\Windows\System\WVCFDan.exe
  C:\Windows\System\WVCFDan.exe
  2⤵
  PID:2268
- C:\Windows\System\wWUbxIw.exe
  C:\Windows\System\wWUbxIw.exe
  2⤵
  PID:2164
- C:\Windows\System\LrxEXUq.exe
  C:\Windows\System\LrxEXUq.exe
  2⤵
  PID:3044
- C:\Windows\System\zPktPtk.exe
  C:\Windows\System\zPktPtk.exe
  2⤵
  PID:2724
- C:\Windows\System\pdPtQdD.exe
  C:\Windows\System\pdPtQdD.exe
  2⤵
  PID:3716
- C:\Windows\System\JbgDVcY.exe
  C:\Windows\System\JbgDVcY.exe
  2⤵
  PID:4648
- C:\Windows\System\IplHGLf.exe
  C:\Windows\System\IplHGLf.exe
  2⤵
  PID:2624
- C:\Windows\System\boBXlxK.exe
  C:\Windows\System\boBXlxK.exe
  2⤵
  PID:5340
- C:\Windows\System\qFFsmTH.exe
  C:\Windows\System\qFFsmTH.exe
  2⤵
  PID:5360
- C:\Windows\System\svudzne.exe
  C:\Windows\System\svudzne.exe
  2⤵
  PID:6316
- C:\Windows\System\GDsqBTj.exe
  C:\Windows\System\GDsqBTj.exe
  2⤵
  PID:1648
- C:\Windows\System\wfMwHPH.exe
  C:\Windows\System\wfMwHPH.exe
  2⤵
  PID:2492
- C:\Windows\System\shFSJKF.exe
  C:\Windows\System\shFSJKF.exe
  2⤵
  PID:3540
- C:\Windows\System\JgkJwkl.exe
  C:\Windows\System\JgkJwkl.exe
  2⤵
  PID:4740
- C:\Windows\System\uWVcjuX.exe
  C:\Windows\System\uWVcjuX.exe
  2⤵
  PID:4692
- C:\Windows\System\YsrmbOe.exe
  C:\Windows\System\YsrmbOe.exe
  2⤵
  PID:2764
- C:\Windows\System\JaSIalo.exe
  C:\Windows\System\JaSIalo.exe
  2⤵
  PID:4224
- C:\Windows\System\YbKCPGt.exe
  C:\Windows\System\YbKCPGt.exe
  2⤵
  PID:4416
- C:\Windows\System\qrOassj.exe
  C:\Windows\System\qrOassj.exe
  2⤵
  PID:5096
- C:\Windows\System\HZyZHoo.exe
  C:\Windows\System\HZyZHoo.exe
  2⤵
  PID:2320
- C:\Windows\System\wshUVcI.exe
  C:\Windows\System\wshUVcI.exe
  2⤵
  PID:2368
- C:\Windows\System\ebyATiP.exe
  C:\Windows\System\ebyATiP.exe
  2⤵
  PID:4712
- C:\Windows\System\ZrZBClN.exe
  C:\Windows\System\ZrZBClN.exe
  2⤵
  PID:4608
- C:\Windows\System\OnsDBrh.exe
  C:\Windows\System\OnsDBrh.exe
  2⤵
  PID:4480
- C:\Windows\System\sYYPJqx.exe
  C:\Windows\System\sYYPJqx.exe
  2⤵
  PID:4820
- C:\Windows\System\eOfsnck.exe
  C:\Windows\System\eOfsnck.exe
  2⤵
  PID:5296
- C:\Windows\System\KMhKbzm.exe
  C:\Windows\System\KMhKbzm.exe
  2⤵
  PID:6836
- C:\Windows\System\WPsvnjT.exe
  C:\Windows\System\WPsvnjT.exe
  2⤵
  PID:6964
- C:\Windows\System\bsTawMz.exe
  C:\Windows\System\bsTawMz.exe
  2⤵
  PID:6492
- C:\Windows\System\MDqcPig.exe
  C:\Windows\System\MDqcPig.exe
  2⤵
  PID:1924
- C:\Windows\System\FkEIfON.exe
  C:\Windows\System\FkEIfON.exe
  2⤵
  PID:6936
- C:\Windows\System\nGlTGGa.exe
  C:\Windows\System\nGlTGGa.exe
  2⤵
  PID:2668
- C:\Windows\System\GxaoPbt.exe
  C:\Windows\System\GxaoPbt.exe
  2⤵
  PID:6824
- C:\Windows\System\UFwpnkE.exe
  C:\Windows\System\UFwpnkE.exe
  2⤵
  PID:2196
- C:\Windows\System\rXTrzcY.exe
  C:\Windows\System\rXTrzcY.exe
  2⤵
  PID:6080
- C:\Windows\System\aNRbyrL.exe
  C:\Windows\System\aNRbyrL.exe
  2⤵
  PID:6980
- C:\Windows\System\pNjiiGl.exe
  C:\Windows\System\pNjiiGl.exe
  2⤵
  PID:6888
- C:\Windows\System\INUlkuD.exe
  C:\Windows\System\INUlkuD.exe
  2⤵
  PID:7080
- C:\Windows\System\wUPELhs.exe
  C:\Windows\System\wUPELhs.exe
  2⤵
  PID:6332
- C:\Windows\System\KIZkGRv.exe
  C:\Windows\System\KIZkGRv.exe
  2⤵
  PID:1076
- C:\Windows\System\FRkOyEW.exe
  C:\Windows\System\FRkOyEW.exe
  2⤵
  PID:4372
- C:\Windows\System\MDZtUlb.exe
  C:\Windows\System\MDZtUlb.exe
  2⤵
  PID:7160
- C:\Windows\System\naaooIU.exe
  C:\Windows\System\naaooIU.exe
  2⤵
  PID:1420
- C:\Windows\System\DLwVZIx.exe
  C:\Windows\System\DLwVZIx.exe
  2⤵
  PID:796
- C:\Windows\System\RHohzZm.exe
  C:\Windows\System\RHohzZm.exe
  2⤵
  PID:6112
- C:\Windows\System\epfJsNS.exe
  C:\Windows\System\epfJsNS.exe
  2⤵
  PID:6348
- C:\Windows\System\MwXMhgR.exe
  C:\Windows\System\MwXMhgR.exe
  2⤵
  PID:2932
- C:\Windows\System\IDqVHbK.exe
  C:\Windows\System\IDqVHbK.exe
  2⤵
  PID:3460
- C:\Windows\System\PtrVEWj.exe
  C:\Windows\System\PtrVEWj.exe
  2⤵
  PID:2260
- C:\Windows\System\twIPNfo.exe
  C:\Windows\System\twIPNfo.exe
  2⤵
  PID:3876
- C:\Windows\System\YtVmpEL.exe
  C:\Windows\System\YtVmpEL.exe
  2⤵
  PID:1616
- C:\Windows\System\zkywqBi.exe
  C:\Windows\System\zkywqBi.exe
  2⤵
  PID:3780
- C:\Windows\System\oXyJhmk.exe
  C:\Windows\System\oXyJhmk.exe
  2⤵
  PID:1744
- C:\Windows\System\cpBZijX.exe
  C:\Windows\System\cpBZijX.exe
  2⤵
  PID:3524
- C:\Windows\System\UGPrllP.exe
  C:\Windows\System\UGPrllP.exe
  2⤵
  PID:3984
- C:\Windows\System\OHPiNFz.exe
  C:\Windows\System\OHPiNFz.exe
  2⤵
  PID:5080
- C:\Windows\System\hQbMecS.exe
  C:\Windows\System\hQbMecS.exe
  2⤵
  PID:1868
- C:\Windows\System\vhcXQTM.exe
  C:\Windows\System\vhcXQTM.exe
  2⤵
  PID:7172
- C:\Windows\System\UWXxKes.exe
  C:\Windows\System\UWXxKes.exe
  2⤵
  PID:7188
- C:\Windows\System\IUtqsHH.exe
  C:\Windows\System\IUtqsHH.exe
  2⤵
  PID:7204
- C:\Windows\System\pjjwpAz.exe
  C:\Windows\System\pjjwpAz.exe
  2⤵
  PID:7220
- C:\Windows\System\PDXTQED.exe
  C:\Windows\System\PDXTQED.exe
  2⤵
  PID:7236
- C:\Windows\System\KkjLfsY.exe
  C:\Windows\System\KkjLfsY.exe
  2⤵
  PID:7252
- C:\Windows\System\bgMQotD.exe
  C:\Windows\System\bgMQotD.exe
  2⤵
  PID:7300
- C:\Windows\System\FNrRxEu.exe
  C:\Windows\System\FNrRxEu.exe
  2⤵
  PID:7316
- C:\Windows\System\ZbzzDgi.exe
  C:\Windows\System\ZbzzDgi.exe
  2⤵
  PID:7332
- C:\Windows\System\kgZFmaM.exe
  C:\Windows\System\kgZFmaM.exe
  2⤵
  PID:7352
- C:\Windows\System\MdkgrnN.exe
  C:\Windows\System\MdkgrnN.exe
  2⤵
  PID:7368
- C:\Windows\System\zNTxPrp.exe
  C:\Windows\System\zNTxPrp.exe
  2⤵
  PID:7384
- C:\Windows\System\NOthpJO.exe
  C:\Windows\System\NOthpJO.exe
  2⤵
  PID:7400
- C:\Windows\System\iPSoosV.exe
  C:\Windows\System\iPSoosV.exe
  2⤵
  PID:7416
- C:\Windows\System\rNhfCan.exe
  C:\Windows\System\rNhfCan.exe
  2⤵
  PID:7432
- C:\Windows\System\pkzsPng.exe
  C:\Windows\System\pkzsPng.exe
  2⤵
  PID:7448
- C:\Windows\System\UQzovdw.exe
  C:\Windows\System\UQzovdw.exe
  2⤵
  PID:7464
- C:\Windows\System\iTBpkZk.exe
  C:\Windows\System\iTBpkZk.exe
  2⤵
  PID:7480
- C:\Windows\System\BfizGcZ.exe
  C:\Windows\System\BfizGcZ.exe
  2⤵
  PID:7496
- C:\Windows\System\vkZoPRo.exe
  C:\Windows\System\vkZoPRo.exe
  2⤵
  PID:7512
- C:\Windows\System\pUXsJIS.exe
  C:\Windows\System\pUXsJIS.exe
  2⤵
  PID:7528
- C:\Windows\System\hbKCEsq.exe
  C:\Windows\System\hbKCEsq.exe
  2⤵
  PID:7544
- C:\Windows\System\KhVNmsw.exe
  C:\Windows\System\KhVNmsw.exe
  2⤵
  PID:7560
- C:\Windows\System\eFbUYSV.exe
  C:\Windows\System\eFbUYSV.exe
  2⤵
  PID:7576
- C:\Windows\System\hfaKPtD.exe
  C:\Windows\System\hfaKPtD.exe
  2⤵
  PID:7596
- C:\Windows\System\YvySTtH.exe
  C:\Windows\System\YvySTtH.exe
  2⤵
  PID:7612
- C:\Windows\System\ArkpiGS.exe
  C:\Windows\System\ArkpiGS.exe
  2⤵
  PID:7628
- C:\Windows\System\znkRHav.exe
  C:\Windows\System\znkRHav.exe
  2⤵
  PID:7644
- C:\Windows\System\nRoGEyk.exe
  C:\Windows\System\nRoGEyk.exe
  2⤵
  PID:7660
- C:\Windows\System\PQAlexj.exe
  C:\Windows\System\PQAlexj.exe
  2⤵
  PID:7676
- C:\Windows\System\AzAGrnF.exe
  C:\Windows\System\AzAGrnF.exe
  2⤵
  PID:7696
- C:\Windows\System\BhtuxgU.exe
  C:\Windows\System\BhtuxgU.exe
  2⤵
  PID:7712
- C:\Windows\System\hsItwvd.exe
  C:\Windows\System\hsItwvd.exe
  2⤵
  PID:7732
- C:\Windows\System\qMnuzCW.exe
  C:\Windows\System\qMnuzCW.exe
  2⤵
  PID:7748
- C:\Windows\System\sCKruFH.exe
  C:\Windows\System\sCKruFH.exe
  2⤵
  PID:7764
- C:\Windows\System\ZQJAsiS.exe
  C:\Windows\System\ZQJAsiS.exe
  2⤵
  PID:7780
- C:\Windows\System\pEdzXQz.exe
  C:\Windows\System\pEdzXQz.exe
  2⤵
  PID:7796
- C:\Windows\System\wkUDbXZ.exe
  C:\Windows\System\wkUDbXZ.exe
  2⤵
  PID:7812
- C:\Windows\System\vWkTlsD.exe
  C:\Windows\System\vWkTlsD.exe
  2⤵
  PID:7828
- C:\Windows\System\TgBKPVO.exe
  C:\Windows\System\TgBKPVO.exe
  2⤵
  PID:7844
- C:\Windows\System\qBUeeIV.exe
  C:\Windows\System\qBUeeIV.exe
  2⤵
  PID:7860
- C:\Windows\System\twNtgbB.exe
  C:\Windows\System\twNtgbB.exe
  2⤵
  PID:7876
- C:\Windows\System\NEsKGSE.exe
  C:\Windows\System\NEsKGSE.exe
  2⤵
  PID:7892
- C:\Windows\System\yCfCYRL.exe
  C:\Windows\System\yCfCYRL.exe
  2⤵
  PID:7908
- C:\Windows\System\NIziLHU.exe
  C:\Windows\System\NIziLHU.exe
  2⤵
  PID:7924
- C:\Windows\System\rkCWGdQ.exe
  C:\Windows\System\rkCWGdQ.exe
  2⤵
  PID:7940
- C:\Windows\System\cYTVOCo.exe
  C:\Windows\System\cYTVOCo.exe
  2⤵
  PID:7956
- C:\Windows\System\MGWiQWU.exe
  C:\Windows\System\MGWiQWU.exe
  2⤵
  PID:7972
- C:\Windows\System\PYteIwJ.exe
  C:\Windows\System\PYteIwJ.exe
  2⤵
  PID:7988
- C:\Windows\System\cvXDvRa.exe
  C:\Windows\System\cvXDvRa.exe
  2⤵
  PID:8004
- C:\Windows\System\IJHlZcR.exe
  C:\Windows\System\IJHlZcR.exe
  2⤵
  PID:8020
- C:\Windows\System\AspUPQT.exe
  C:\Windows\System\AspUPQT.exe
  2⤵
  PID:8036
- C:\Windows\System\yyfYZCN.exe
  C:\Windows\System\yyfYZCN.exe
  2⤵
  PID:8052
- C:\Windows\System\tpTtKDn.exe
  C:\Windows\System\tpTtKDn.exe
  2⤵
  PID:8068
- C:\Windows\System\ihkcKPg.exe
  C:\Windows\System\ihkcKPg.exe
  2⤵
  PID:8084
- C:\Windows\System\imqOQEX.exe
  C:\Windows\System\imqOQEX.exe
  2⤵
  PID:8100
- C:\Windows\System\OGpbutR.exe
  C:\Windows\System\OGpbutR.exe
  2⤵
  PID:8116
- C:\Windows\System\DVzoCCn.exe
  C:\Windows\System\DVzoCCn.exe
  2⤵
  PID:8136
- C:\Windows\System\zqaQpUF.exe
  C:\Windows\System\zqaQpUF.exe
  2⤵
  PID:8160
- C:\Windows\System\paENOxP.exe
  C:\Windows\System\paENOxP.exe
  2⤵
  PID:8176
- C:\Windows\System\KLpRRzK.exe
  C:\Windows\System\KLpRRzK.exe
  2⤵
  PID:5212
- C:\Windows\System\aJAQigk.exe
  C:\Windows\System\aJAQigk.exe
  2⤵
  PID:5988
- C:\Windows\System\BeJTKNe.exe
  C:\Windows\System\BeJTKNe.exe
  2⤵
  PID:6884
- C:\Windows\System\tfZOvQK.exe
  C:\Windows\System\tfZOvQK.exe
  2⤵
  PID:6920
- C:\Windows\System\wXwvocQ.exe
  C:\Windows\System\wXwvocQ.exe
  2⤵
  PID:3060
- C:\Windows\System\sGtNmPR.exe
  C:\Windows\System\sGtNmPR.exe
  2⤵
  PID:2208
- C:\Windows\System\aljbocZ.exe
  C:\Windows\System\aljbocZ.exe
  2⤵
  PID:5860
- C:\Windows\System\kXmCPln.exe
  C:\Windows\System\kXmCPln.exe
  2⤵
  PID:6620
- C:\Windows\System\gKhVAAb.exe
  C:\Windows\System\gKhVAAb.exe
  2⤵
  PID:2852
- C:\Windows\System\EUOQvrE.exe
  C:\Windows\System\EUOQvrE.exe
  2⤵
  PID:904
- C:\Windows\System\vBDAFxB.exe
  C:\Windows\System\vBDAFxB.exe
  2⤵
  PID:6432
- C:\Windows\System\sPQAniS.exe
  C:\Windows\System\sPQAniS.exe
  2⤵
  PID:6460
- C:\Windows\System\nGgFMzp.exe
  C:\Windows\System\nGgFMzp.exe
  2⤵
  PID:1092
- C:\Windows\System\jJUZqpo.exe
  C:\Windows\System\jJUZqpo.exe
  2⤵
  PID:2720
- C:\Windows\System\iRxmaUP.exe
  C:\Windows\System\iRxmaUP.exe
  2⤵
  PID:6544
- C:\Windows\System\qSuoFYj.exe
  C:\Windows\System\qSuoFYj.exe
  2⤵
  PID:4388
- C:\Windows\System\LJLjCaC.exe
  C:\Windows\System\LJLjCaC.exe
  2⤵
  PID:5568
- C:\Windows\System\KeuOdDn.exe
  C:\Windows\System\KeuOdDn.exe
  2⤵
  PID:1376
- C:\Windows\System\CZgiNDy.exe
  C:\Windows\System\CZgiNDy.exe
  2⤵
  PID:3364
- C:\Windows\System\IHuHBzD.exe
  C:\Windows\System\IHuHBzD.exe
  2⤵
  PID:7228
- C:\Windows\System\NKWcaqx.exe
  C:\Windows\System\NKWcaqx.exe
  2⤵
  PID:7272
- C:\Windows\System\mVKsPMr.exe
  C:\Windows\System\mVKsPMr.exe
  2⤵
  PID:7296
- C:\Windows\System\Dmfrovv.exe
  C:\Windows\System\Dmfrovv.exe
  2⤵
  PID:7364
- C:\Windows\System\CXncZnD.exe
  C:\Windows\System\CXncZnD.exe
  2⤵
  PID:7424
- C:\Windows\System\hjTYHQW.exe
  C:\Windows\System\hjTYHQW.exe
  2⤵
  PID:7492
- C:\Windows\System\tJGqhwt.exe
  C:\Windows\System\tJGqhwt.exe
  2⤵
  PID:7556
- C:\Windows\System\fEfcOuv.exe
  C:\Windows\System\fEfcOuv.exe
  2⤵
  PID:7624
- C:\Windows\System\zuNLzYc.exe
  C:\Windows\System\zuNLzYc.exe
  2⤵
  PID:7688
- C:\Windows\System\uLloxri.exe
  C:\Windows\System\uLloxri.exe
  2⤵
  PID:7756
- C:\Windows\System\Netejbi.exe
  C:\Windows\System\Netejbi.exe
  2⤵
  PID:7820
- C:\Windows\System\vOknTid.exe
  C:\Windows\System\vOknTid.exe
  2⤵
  PID:7888
- C:\Windows\System\GTlkEHC.exe
  C:\Windows\System\GTlkEHC.exe
  2⤵
  PID:7952
- C:\Windows\System\PaZAmCq.exe
  C:\Windows\System\PaZAmCq.exe
  2⤵
  PID:8012
- C:\Windows\System\WNaTRfl.exe
  C:\Windows\System\WNaTRfl.exe
  2⤵
  PID:8080
- C:\Windows\System\FhrROgT.exe
  C:\Windows\System\FhrROgT.exe
  2⤵
  PID:8132
- C:\Windows\System\UdqgHSU.exe
  C:\Windows\System\UdqgHSU.exe
  2⤵
  PID:8188
- C:\Windows\System\puITAhK.exe
  C:\Windows\System\puITAhK.exe
  2⤵
  PID:7140
- C:\Windows\System\ZmyqQBV.exe
  C:\Windows\System\ZmyqQBV.exe
  2⤵
  PID:6948
- C:\Windows\System\riSBUQr.exe
  C:\Windows\System\riSBUQr.exe
  2⤵
  PID:4904
- C:\Windows\System\suQbjyg.exe
  C:\Windows\System\suQbjyg.exe
  2⤵
  PID:4952
- C:\Windows\System\qdHJUCA.exe
  C:\Windows\System\qdHJUCA.exe
  2⤵
  PID:7488
- C:\Windows\System\pRWHOTd.exe
  C:\Windows\System\pRWHOTd.exe
  2⤵
  PID:6400
- C:\Windows\System\fFYfWnm.exe
  C:\Windows\System\fFYfWnm.exe
  2⤵
  PID:6808
- C:\Windows\System\DWUTBoO.exe
  C:\Windows\System\DWUTBoO.exe
  2⤵
  PID:3032
- C:\Windows\System\dZmZYWl.exe
  C:\Windows\System\dZmZYWl.exe
  2⤵
  PID:6852
- C:\Windows\System\iTSjfSQ.exe
  C:\Windows\System\iTSjfSQ.exe
  2⤵
  PID:2560
- C:\Windows\System\yoECcEa.exe
  C:\Windows\System\yoECcEa.exe
  2⤵
  PID:5760
- C:\Windows\System\szlfiDt.exe
  C:\Windows\System\szlfiDt.exe
  2⤵
  PID:1660
- C:\Windows\System\dhvhbpD.exe
  C:\Windows\System\dhvhbpD.exe
  2⤵
  PID:1536
- C:\Windows\System\wNrNlTJ.exe
  C:\Windows\System\wNrNlTJ.exe
  2⤵
  PID:7184
- C:\Windows\System\prYZfPf.exe
  C:\Windows\System\prYZfPf.exe
  2⤵
  PID:7248
- C:\Windows\System\aKdFuAg.exe
  C:\Windows\System\aKdFuAg.exe
  2⤵
  PID:7376
- C:\Windows\System\TZwNuOK.exe
  C:\Windows\System\TZwNuOK.exe
  2⤵
  PID:7444
- C:\Windows\System\TmNGADm.exe
  C:\Windows\System\TmNGADm.exe
  2⤵
  PID:7936
- C:\Windows\System\WHxahWV.exe
  C:\Windows\System\WHxahWV.exe
  2⤵
  PID:8000
- C:\Windows\System\xBgkaBk.exe
  C:\Windows\System\xBgkaBk.exe
  2⤵
  PID:8064
- C:\Windows\System\FGGngYS.exe
  C:\Windows\System\FGGngYS.exe
  2⤵
  PID:5732
- C:\Windows\System\QTizGpP.exe
  C:\Windows\System\QTizGpP.exe
  2⤵
  PID:3936
- C:\Windows\System\KRmfSYB.exe
  C:\Windows\System\KRmfSYB.exe
  2⤵
  PID:3488
- C:\Windows\System\cHenBiW.exe
  C:\Windows\System\cHenBiW.exe
  2⤵
  PID:7196
- C:\Windows\System\pthGaux.exe
  C:\Windows\System\pthGaux.exe
  2⤵
  PID:7428
- C:\Windows\System\OvkKRso.exe
  C:\Windows\System\OvkKRso.exe
  2⤵
  PID:6712
- C:\Windows\System\IJdoSNr.exe
  C:\Windows\System\IJdoSNr.exe
  2⤵
  PID:3556
- C:\Windows\System\vuwCzDG.exe
  C:\Windows\System\vuwCzDG.exe
  2⤵
  PID:7340
- C:\Windows\System\UHsNqzs.exe
  C:\Windows\System\UHsNqzs.exe
  2⤵
  PID:7744
- C:\Windows\System\CICffVc.exe
  C:\Windows\System\CICffVc.exe
  2⤵
  PID:8124
- C:\Windows\System\kEGIHij.exe
  C:\Windows\System\kEGIHij.exe
  2⤵
  PID:7156
- C:\Windows\System\QIupZNA.exe
  C:\Windows\System\QIupZNA.exe
  2⤵
  PID:5244
- C:\Windows\System\aODBrAZ.exe
  C:\Windows\System\aODBrAZ.exe
  2⤵
  PID:7656
- C:\Windows\System\CSMxwsl.exe
  C:\Windows\System\CSMxwsl.exe
  2⤵
  PID:7852
- C:\Windows\System\OIkVYXj.exe
  C:\Windows\System\OIkVYXj.exe
  2⤵
  PID:8076
- C:\Windows\System\TvTqwVA.exe
  C:\Windows\System\TvTqwVA.exe
  2⤵
  PID:7980
- C:\Windows\System\IwHPeJG.exe
  C:\Windows\System\IwHPeJG.exe
  2⤵
  PID:6724
- C:\Windows\System\rdzUOFs.exe
  C:\Windows\System\rdzUOFs.exe
  2⤵
  PID:7260
- C:\Windows\System\ilOIWSl.exe
  C:\Windows\System\ilOIWSl.exe
  2⤵
  PID:4836
- C:\Windows\System\mMmznOF.exe
  C:\Windows\System\mMmznOF.exe
  2⤵
  PID:7016
- C:\Windows\System\zcLRkVf.exe
  C:\Windows\System\zcLRkVf.exe
  2⤵
  PID:4932
- C:\Windows\System\qgMhrJm.exe
  C:\Windows\System\qgMhrJm.exe
  2⤵
  PID:2340
- C:\Windows\System\ZpItAzp.exe
  C:\Windows\System\ZpItAzp.exe
  2⤵
  PID:1944
- C:\Windows\System\jnDfyzp.exe
  C:\Windows\System\jnDfyzp.exe
  2⤵
  PID:7216
- C:\Windows\System\RJANZck.exe
  C:\Windows\System\RJANZck.exe
  2⤵
  PID:7536
- C:\Windows\System\jGNSdtB.exe
  C:\Windows\System\jGNSdtB.exe
  2⤵
  PID:7604
- C:\Windows\System\kQEslls.exe
  C:\Windows\System\kQEslls.exe
  2⤵
  PID:7640
- C:\Windows\System\OrIvQhw.exe
  C:\Windows\System\OrIvQhw.exe
  2⤵
  PID:7772
- C:\Windows\System\cUHhMRD.exe
  C:\Windows\System\cUHhMRD.exe
  2⤵
  PID:7776
- C:\Windows\System\GWPjgks.exe
  C:\Windows\System\GWPjgks.exe
  2⤵
  PID:7288
- C:\Windows\System\SzVZlpF.exe
  C:\Windows\System\SzVZlpF.exe
  2⤵
  PID:8044
- C:\Windows\System\nTMdVHN.exe
  C:\Windows\System\nTMdVHN.exe
  2⤵
  PID:6464
- C:\Windows\System\IEGuOww.exe
  C:\Windows\System\IEGuOww.exe
  2⤵
  PID:3796
- C:\Windows\System\jnfQREo.exe
  C:\Windows\System\jnfQREo.exe
  2⤵
  PID:4192
- C:\Windows\System\zRqyCCl.exe
  C:\Windows\System\zRqyCCl.exe
  2⤵
  PID:4968
- C:\Windows\System\yyayTGF.exe
  C:\Windows\System\yyayTGF.exe
  2⤵
  PID:7636
- C:\Windows\System\RkmvTnA.exe
  C:\Windows\System\RkmvTnA.exe
  2⤵
  PID:7704
- C:\Windows\System\JkpmcKW.exe
  C:\Windows\System\JkpmcKW.exe
  2⤵
  PID:7180
- C:\Windows\System\upOjcNA.exe
  C:\Windows\System\upOjcNA.exe
  2⤵
  PID:1580
- C:\Windows\System\jbJcXmV.exe
  C:\Windows\System\jbJcXmV.exe
  2⤵
  PID:7856
- C:\Windows\System\qKCJdPT.exe
  C:\Windows\System\qKCJdPT.exe
  2⤵
  PID:7836
- C:\Windows\System\mSdTDEI.exe
  C:\Windows\System\mSdTDEI.exe
  2⤵
  PID:7904
- C:\Windows\System\pjnTydz.exe
  C:\Windows\System\pjnTydz.exe
  2⤵
  PID:8060
- C:\Windows\System\XHUPNCr.exe
  C:\Windows\System\XHUPNCr.exe
  2⤵
  PID:6804
- C:\Windows\System\RqFvXOy.exe
  C:\Windows\System\RqFvXOy.exe
  2⤵
  PID:7684
- C:\Windows\System\LCEaupN.exe
  C:\Windows\System\LCEaupN.exe
  2⤵
  PID:8156
- C:\Windows\System\feMkhzb.exe
  C:\Windows\System\feMkhzb.exe
  2⤵
  PID:7672
- C:\Windows\System\EYesiCX.exe
  C:\Windows\System\EYesiCX.exe
  2⤵
  PID:7292
- C:\Windows\System\dMqrGto.exe
  C:\Windows\System\dMqrGto.exe
  2⤵
  PID:2628
- C:\Windows\System\WWLBFGd.exe
  C:\Windows\System\WWLBFGd.exe
  2⤵
  PID:7028
- C:\Windows\System\OyfiMjs.exe
  C:\Windows\System\OyfiMjs.exe
  2⤵
  PID:7504
- C:\Windows\System\fOsgDMb.exe
  C:\Windows\System\fOsgDMb.exe
  2⤵
  PID:4448
- C:\Windows\System\FfKmOrK.exe
  C:\Windows\System\FfKmOrK.exe
  2⤵
  PID:7804
- C:\Windows\System\qyoRSeF.exe
  C:\Windows\System\qyoRSeF.exe
  2⤵
  PID:476
- C:\Windows\System\EgqoWdY.exe
  C:\Windows\System\EgqoWdY.exe
  2⤵
  PID:8204
- C:\Windows\System\HwhGSAL.exe
  C:\Windows\System\HwhGSAL.exe
  2⤵
  PID:8220
- C:\Windows\System\IJSZATh.exe
  C:\Windows\System\IJSZATh.exe
  2⤵
  PID:8236
- C:\Windows\System\pDaSSth.exe
  C:\Windows\System\pDaSSth.exe
  2⤵
  PID:8252
- C:\Windows\System\phOiChz.exe
  C:\Windows\System\phOiChz.exe
  2⤵
  PID:8268
- C:\Windows\System\UQLgWEX.exe
  C:\Windows\System\UQLgWEX.exe
  2⤵
  PID:8284
- C:\Windows\System\AosGoXM.exe
  C:\Windows\System\AosGoXM.exe
  2⤵
  PID:8360
- C:\Windows\System\OZGMhlx.exe
  C:\Windows\System\OZGMhlx.exe
  2⤵
  PID:8376
- C:\Windows\System\iBslUXp.exe
  C:\Windows\System\iBslUXp.exe
  2⤵
  PID:8392
- C:\Windows\System\KAeeQdg.exe
  C:\Windows\System\KAeeQdg.exe
  2⤵
  PID:8408
- C:\Windows\System\UVCKbXs.exe
  C:\Windows\System\UVCKbXs.exe
  2⤵
  PID:8424
- C:\Windows\System\wSfchxi.exe
  C:\Windows\System\wSfchxi.exe
  2⤵
  PID:8444
- C:\Windows\System\ZoNhbCE.exe
  C:\Windows\System\ZoNhbCE.exe
  2⤵
  PID:8460
- C:\Windows\System\tuZUglO.exe
  C:\Windows\System\tuZUglO.exe
  2⤵
  PID:8480
- C:\Windows\System\QoLWxSK.exe
  C:\Windows\System\QoLWxSK.exe
  2⤵
  PID:8496
- C:\Windows\System\MUCTJfA.exe
  C:\Windows\System\MUCTJfA.exe
  2⤵
  PID:8512
- C:\Windows\System\WRGziZq.exe
  C:\Windows\System\WRGziZq.exe
  2⤵
  PID:8528
- C:\Windows\System\ObLxunJ.exe
  C:\Windows\System\ObLxunJ.exe
  2⤵
  PID:8544
- C:\Windows\System\JOrgjRs.exe
  C:\Windows\System\JOrgjRs.exe
  2⤵
  PID:8560
- C:\Windows\System\nQXfChE.exe
  C:\Windows\System\nQXfChE.exe
  2⤵
  PID:8576
- C:\Windows\System\ZxwwyEf.exe
  C:\Windows\System\ZxwwyEf.exe
  2⤵
  PID:8592
- C:\Windows\System\SLgSQff.exe
  C:\Windows\System\SLgSQff.exe
  2⤵
  PID:8608
- C:\Windows\System\WOYwyyS.exe
  C:\Windows\System\WOYwyyS.exe
  2⤵
  PID:8632
- C:\Windows\System\nQSAqPr.exe
  C:\Windows\System\nQSAqPr.exe
  2⤵
  PID:8652
- C:\Windows\System\XqHiqFV.exe
  C:\Windows\System\XqHiqFV.exe
  2⤵
  PID:8668
- C:\Windows\System\MjyboAN.exe
  C:\Windows\System\MjyboAN.exe
  2⤵
  PID:8684
- C:\Windows\System\XMiplme.exe
  C:\Windows\System\XMiplme.exe
  2⤵
  PID:8700
- C:\Windows\System\bryAIdY.exe
  C:\Windows\System\bryAIdY.exe
  2⤵
  PID:8724
- C:\Windows\System\pkGSNIP.exe
  C:\Windows\System\pkGSNIP.exe
  2⤵
  PID:8740
- C:\Windows\System\jUragGe.exe
  C:\Windows\System\jUragGe.exe
  2⤵
  PID:8756
- C:\Windows\System\cIoznpG.exe
  C:\Windows\System\cIoznpG.exe
  2⤵
  PID:8772
- C:\Windows\System\blPYRNi.exe
  C:\Windows\System\blPYRNi.exe
  2⤵
  PID:8788
- C:\Windows\System\dRCSypL.exe
  C:\Windows\System\dRCSypL.exe
  2⤵
  PID:8812
- C:\Windows\System\oVeVGxr.exe
  C:\Windows\System\oVeVGxr.exe
  2⤵
  PID:8828
- C:\Windows\System\yFlidSd.exe
  C:\Windows\System\yFlidSd.exe
  2⤵
  PID:8844
- C:\Windows\System\deBswqE.exe
  C:\Windows\System\deBswqE.exe
  2⤵
  PID:8860
- C:\Windows\System\StgieoQ.exe
  C:\Windows\System\StgieoQ.exe
  2⤵
  PID:8876
- C:\Windows\System\bePNsOT.exe
  C:\Windows\System\bePNsOT.exe
  2⤵
  PID:8892
- C:\Windows\System\zqCppHR.exe
  C:\Windows\System\zqCppHR.exe
  2⤵
  PID:8908
- C:\Windows\System\sqtRWNA.exe
  C:\Windows\System\sqtRWNA.exe
  2⤵
  PID:8928
- C:\Windows\System\uwqNddv.exe
  C:\Windows\System\uwqNddv.exe
  2⤵
  PID:8944
- C:\Windows\System\twGMpjs.exe
  C:\Windows\System\twGMpjs.exe
  2⤵
  PID:8964
- C:\Windows\System\iACpmGg.exe
  C:\Windows\System\iACpmGg.exe
  2⤵
  PID:8984
- C:\Windows\System\lmzvwFT.exe
  C:\Windows\System\lmzvwFT.exe
  2⤵
  PID:9000
- C:\Windows\System\WaMQcaJ.exe
  C:\Windows\System\WaMQcaJ.exe
  2⤵
  PID:9016
- C:\Windows\System\BcbUURU.exe
  C:\Windows\System\BcbUURU.exe
  2⤵
  PID:9040
- C:\Windows\System\xttcciz.exe
  C:\Windows\System\xttcciz.exe
  2⤵
  PID:9056
- C:\Windows\System\FUUKfth.exe
  C:\Windows\System\FUUKfth.exe
  2⤵
  PID:9076
- C:\Windows\System\fJaQMOX.exe
  C:\Windows\System\fJaQMOX.exe
  2⤵
  PID:9100
- C:\Windows\System\lEaWusI.exe
  C:\Windows\System\lEaWusI.exe
  2⤵
  PID:9116
- C:\Windows\System\xMzXNlO.exe
  C:\Windows\System\xMzXNlO.exe
  2⤵
  PID:9132
- C:\Windows\System\MdrswTK.exe
  C:\Windows\System\MdrswTK.exe
  2⤵
  PID:9152
- C:\Windows\System\YCjpzbS.exe
  C:\Windows\System\YCjpzbS.exe
  2⤵
  PID:9168
- C:\Windows\System\pcKIFVM.exe
  C:\Windows\System\pcKIFVM.exe
  2⤵
  PID:9184
- C:\Windows\System\DaNxMCz.exe
  C:\Windows\System\DaNxMCz.exe
  2⤵
  PID:9200
- C:\Windows\System\cqGlphk.exe
  C:\Windows\System\cqGlphk.exe
  2⤵
  PID:7620
- C:\Windows\System\psUeNMH.exe
  C:\Windows\System\psUeNMH.exe
  2⤵
  PID:6064
- C:\Windows\System\mziybjO.exe
  C:\Windows\System\mziybjO.exe
  2⤵
  PID:3664
- C:\Windows\System\UZkYSkF.exe
  C:\Windows\System\UZkYSkF.exe
  2⤵
  PID:8096
- C:\Windows\System\NkVRjsN.exe
  C:\Windows\System\NkVRjsN.exe
  2⤵
  PID:8032
- C:\Windows\System\IqztoLT.exe
  C:\Windows\System\IqztoLT.exe
  2⤵
  PID:8232
- C:\Windows\System\tBjcCQX.exe
  C:\Windows\System\tBjcCQX.exe
  2⤵
  PID:4420
- C:\Windows\System\qYZYfrH.exe
  C:\Windows\System\qYZYfrH.exe
  2⤵
  PID:7740
- C:\Windows\System\xXSyjaV.exe
  C:\Windows\System\xXSyjaV.exe
  2⤵
  PID:5308
- C:\Windows\System\OxzXXkm.exe
  C:\Windows\System\OxzXXkm.exe
  2⤵
  PID:8276
- C:\Windows\System\XWzyGTx.exe
  C:\Windows\System\XWzyGTx.exe
  2⤵
  PID:8312
- C:\Windows\System\OMKYKec.exe
  C:\Windows\System\OMKYKec.exe
  2⤵
  PID:3872
- C:\Windows\System\sRoozJe.exe
  C:\Windows\System\sRoozJe.exe
  2⤵
  PID:8324
- C:\Windows\System\bmEWZAi.exe
  C:\Windows\System\bmEWZAi.exe
  2⤵
  PID:8348
- C:\Windows\System\xAiDvgj.exe
  C:\Windows\System\xAiDvgj.exe
  2⤵
  PID:8368
- C:\Windows\System\GzOklqO.exe
  C:\Windows\System\GzOklqO.exe
  2⤵
  PID:8384
- C:\Windows\System\MmMOgHJ.exe
  C:\Windows\System\MmMOgHJ.exe
  2⤵
  PID:8420
- C:\Windows\System\PZCimXu.exe
  C:\Windows\System\PZCimXu.exe
  2⤵
  PID:8472
- C:\Windows\System\VTlyFcZ.exe
  C:\Windows\System\VTlyFcZ.exe
  2⤵
  PID:8536
- C:\Windows\System\lGOscDp.exe
  C:\Windows\System\lGOscDp.exe
  2⤵
  PID:8600
- C:\Windows\System\JNZeocx.exe
  C:\Windows\System\JNZeocx.exe
  2⤵
  PID:8648
- C:\Windows\System\kSvmZwQ.exe
  C:\Windows\System\kSvmZwQ.exe
  2⤵
  PID:8716
- C:\Windows\System\VUQUEcM.exe
  C:\Windows\System\VUQUEcM.exe
  2⤵
  PID:8748
- C:\Windows\System\FwnQcAv.exe
  C:\Windows\System\FwnQcAv.exe
  2⤵
  PID:8488
- C:\Windows\System\hIoxOTK.exe
  C:\Windows\System\hIoxOTK.exe
  2⤵
  PID:8852
- C:\Windows\System\phKXOox.exe
  C:\Windows\System\phKXOox.exe
  2⤵
  PID:8736
- C:\Windows\System\jIvOMCE.exe
  C:\Windows\System\jIvOMCE.exe
  2⤵
  PID:8664
- C:\Windows\System\lLjnOvO.exe
  C:\Windows\System\lLjnOvO.exe
  2⤵
  PID:8624
- C:\Windows\System\hceVJcN.exe
  C:\Windows\System\hceVJcN.exe
  2⤵
  PID:8524
- C:\Windows\System\GcaQymI.exe
  C:\Windows\System\GcaQymI.exe
  2⤵
  PID:8796
- C:\Windows\System\IOlQAxF.exe
  C:\Windows\System\IOlQAxF.exe
  2⤵
  PID:8916
- C:\Windows\System\uGDoLLn.exe
  C:\Windows\System\uGDoLLn.exe
  2⤵
  PID:8868
- C:\Windows\System\EktPytu.exe
  C:\Windows\System\EktPytu.exe
  2⤵
  PID:8904
- C:\Windows\System\NCdgslA.exe
  C:\Windows\System\NCdgslA.exe
  2⤵
  PID:8960
- C:\Windows\System\WsLPHNS.exe
  C:\Windows\System\WsLPHNS.exe
  2⤵
  PID:9028
- C:\Windows\System\dnxCNnQ.exe
  C:\Windows\System\dnxCNnQ.exe
  2⤵
  PID:9008
- C:\Windows\System\sZnHxvx.exe
  C:\Windows\System\sZnHxvx.exe
  2⤵
  PID:8972
- C:\Windows\System\eZtxtbn.exe
  C:\Windows\System\eZtxtbn.exe
  2⤵
  PID:7996
- C:\Windows\System\jqEESSh.exe
  C:\Windows\System\jqEESSh.exe
  2⤵
  PID:9092
- C:\Windows\System\hwEOZMY.exe
  C:\Windows\System\hwEOZMY.exe
  2⤵
  PID:9112
- C:\Windows\System\IFHrsNl.exe
  C:\Windows\System\IFHrsNl.exe
  2⤵
  PID:9176
- C:\Windows\System\fTuUyuJ.exe
  C:\Windows\System\fTuUyuJ.exe
  2⤵
  PID:7568
- C:\Windows\System\XoXIdeF.exe
  C:\Windows\System\XoXIdeF.exe
  2⤵
  PID:6612
- C:\Windows\System\BbvDudL.exe
  C:\Windows\System\BbvDudL.exe
  2⤵
  PID:8244
- C:\Windows\System\RKjLvhy.exe
  C:\Windows\System\RKjLvhy.exe
  2⤵
  PID:8316
- C:\Windows\System\WtvksXW.exe
  C:\Windows\System\WtvksXW.exe
  2⤵
  PID:8228
- C:\Windows\System\LcVEyhx.exe
  C:\Windows\System\LcVEyhx.exe
  2⤵
  PID:2840
- C:\Windows\System\cGwqKAz.exe
  C:\Windows\System\cGwqKAz.exe
  2⤵
  PID:9192
- C:\Windows\System\dMSHhKV.exe
  C:\Windows\System\dMSHhKV.exe
  2⤵
  PID:4000
- C:\Windows\System\gREqdQp.exe
  C:\Windows\System\gREqdQp.exe
  2⤵
  PID:8332
- C:\Windows\System\wNLBMkD.exe
  C:\Windows\System\wNLBMkD.exe
  2⤵
  PID:8416
- C:\Windows\System\HrqHzbC.exe
  C:\Windows\System\HrqHzbC.exe
  2⤵
  PID:8640
- C:\Windows\System\hONsieL.exe
  C:\Windows\System\hONsieL.exe
  2⤵
  PID:8820
- C:\Windows\System\YVDhHuD.exe
  C:\Windows\System\YVDhHuD.exe
  2⤵
  PID:8696
- C:\Windows\System\bdhjztO.exe
  C:\Windows\System\bdhjztO.exe
  2⤵
  PID:8800
- C:\Windows\System\qIWeUUy.exe
  C:\Windows\System\qIWeUUy.exe
  2⤵
  PID:8996
- C:\Windows\System\HHINWJK.exe
  C:\Windows\System\HHINWJK.exe
  2⤵
  PID:8936
- C:\Windows\System\sVozPnW.exe
  C:\Windows\System\sVozPnW.exe
  2⤵
  PID:6696
- C:\Windows\System\QmONcgE.exe
  C:\Windows\System\QmONcgE.exe
  2⤵
  PID:8780
- C:\Windows\System\OMxLuzL.exe
  C:\Windows\System\OMxLuzL.exe
  2⤵
  PID:8620
- C:\Windows\System\GfvPcJp.exe
  C:\Windows\System\GfvPcJp.exe
  2⤵
  PID:8952
- C:\Windows\System\jFXPWRm.exe
  C:\Windows\System\jFXPWRm.exe
  2⤵
  PID:9052
- C:\Windows\System\iEvlNiL.exe
  C:\Windows\System\iEvlNiL.exe
  2⤵
  PID:9144
- C:\Windows\System\GOrhuog.exe
  C:\Windows\System\GOrhuog.exe
  2⤵
  PID:784
- C:\Windows\System\YoZDevJ.exe
  C:\Windows\System\YoZDevJ.exe
  2⤵
  PID:9108
- C:\Windows\System\LlSUwML.exe
  C:\Windows\System\LlSUwML.exe
  2⤵
  PID:8372
- C:\Windows\System\IKFKYgZ.exe
  C:\Windows\System\IKFKYgZ.exe
  2⤵
  PID:8552
- C:\Windows\System\WCvtuYw.exe
  C:\Windows\System\WCvtuYw.exe
  2⤵
  PID:7552
- C:\Windows\System\lvtGvcO.exe
  C:\Windows\System\lvtGvcO.exe
  2⤵
  PID:4612
- C:\Windows\System\pJiroDc.exe
  C:\Windows\System\pJiroDc.exe
  2⤵
  PID:8352
- C:\Windows\System\DXvQLhR.exe
  C:\Windows\System\DXvQLhR.exe
  2⤵
  PID:8504
- C:\Windows\System\ljZcGRD.exe
  C:\Windows\System\ljZcGRD.exe
  2⤵
  PID:8404
- C:\Windows\System\LukvBPq.exe
  C:\Windows\System\LukvBPq.exe
  2⤵
  PID:8764
- C:\Windows\System\GLOhbmw.exe
  C:\Windows\System\GLOhbmw.exe
  2⤵
  PID:8436
- C:\Windows\System\wZHgteT.exe
  C:\Windows\System\wZHgteT.exe
  2⤵
  PID:7948
- C:\Windows\System\jJBrKBK.exe
  C:\Windows\System\jJBrKBK.exe
  2⤵
  PID:9072
- C:\Windows\System\kIrxzjK.exe
  C:\Windows\System\kIrxzjK.exe
  2⤵
  PID:8584
- C:\Windows\System\SBWZioP.exe
  C:\Windows\System\SBWZioP.exe
  2⤵
  PID:8680
- C:\Windows\System\MnZVRdV.exe
  C:\Windows\System\MnZVRdV.exe
  2⤵
  PID:8732
- C:\Windows\System\VDzQVAY.exe
  C:\Windows\System\VDzQVAY.exe
  2⤵
  PID:7932
- C:\Windows\System\hNZIrTz.exe
  C:\Windows\System\hNZIrTz.exe
  2⤵
  PID:7788
- C:\Windows\System\RFqEvBC.exe
  C:\Windows\System\RFqEvBC.exe
  2⤵
  PID:8980
- C:\Windows\System\cyXkCly.exe
  C:\Windows\System\cyXkCly.exe
  2⤵
  PID:2832
- C:\Windows\System\auiaqPc.exe
  C:\Windows\System\auiaqPc.exe
  2⤵
  PID:9224
- C:\Windows\System\AVaGVSo.exe
  C:\Windows\System\AVaGVSo.exe
  2⤵
  PID:9240
- C:\Windows\System\eSisprD.exe
  C:\Windows\System\eSisprD.exe
  2⤵
  PID:9256
- C:\Windows\System\dQcQdUR.exe
  C:\Windows\System\dQcQdUR.exe
  2⤵
  PID:9272
- C:\Windows\System\mchDRBQ.exe
  C:\Windows\System\mchDRBQ.exe
  2⤵
  PID:9288
- C:\Windows\System\RqCJIbW.exe
  C:\Windows\System\RqCJIbW.exe
  2⤵
  PID:9304
- C:\Windows\System\FCTgxSw.exe
  C:\Windows\System\FCTgxSw.exe
  2⤵
  PID:9320
- C:\Windows\System\cOKEqof.exe
  C:\Windows\System\cOKEqof.exe
  2⤵
  PID:9336
- C:\Windows\System\gPailxW.exe
  C:\Windows\System\gPailxW.exe
  2⤵
  PID:9352
- C:\Windows\System\ACzlSdh.exe
  C:\Windows\System\ACzlSdh.exe
  2⤵
  PID:9368
- C:\Windows\System\WmMfnEX.exe
  C:\Windows\System\WmMfnEX.exe
  2⤵
  PID:9384
- C:\Windows\System\kLrNZUp.exe
  C:\Windows\System\kLrNZUp.exe
  2⤵
  PID:9400
- C:\Windows\System\UfEKoWs.exe
  C:\Windows\System\UfEKoWs.exe
  2⤵
  PID:9416
- C:\Windows\System\QknmPNo.exe
  C:\Windows\System\QknmPNo.exe
  2⤵
  PID:9432
- C:\Windows\System\YiwPVUS.exe
  C:\Windows\System\YiwPVUS.exe
  2⤵
  PID:9448
- C:\Windows\System\puqTtpf.exe
  C:\Windows\System\puqTtpf.exe
  2⤵
  PID:9464
- C:\Windows\System\eFUXmSZ.exe
  C:\Windows\System\eFUXmSZ.exe
  2⤵
  PID:9480
- C:\Windows\System\DwDrqtx.exe
  C:\Windows\System\DwDrqtx.exe
  2⤵
  PID:9496
- C:\Windows\System\rptbhim.exe
  C:\Windows\System\rptbhim.exe
  2⤵
  PID:9512
- C:\Windows\System\OrCpNvq.exe
  C:\Windows\System\OrCpNvq.exe
  2⤵
  PID:9528
- C:\Windows\System\UEFfuWb.exe
  C:\Windows\System\UEFfuWb.exe
  2⤵
  PID:9544
- C:\Windows\System\IInexvF.exe
  C:\Windows\System\IInexvF.exe
  2⤵
  PID:9560
- C:\Windows\System\ZxQIdRn.exe
  C:\Windows\System\ZxQIdRn.exe
  2⤵
  PID:9576
- C:\Windows\System\rPHZsyn.exe
  C:\Windows\System\rPHZsyn.exe
  2⤵
  PID:9592
- C:\Windows\System\QrkbPtc.exe
  C:\Windows\System\QrkbPtc.exe
  2⤵
  PID:9608
- C:\Windows\System\FgsEIbF.exe
  C:\Windows\System\FgsEIbF.exe
  2⤵
  PID:9624
- C:\Windows\System\WXDOXnu.exe
  C:\Windows\System\WXDOXnu.exe
  2⤵
  PID:9640
- C:\Windows\System\jhoSwAN.exe
  C:\Windows\System\jhoSwAN.exe
  2⤵
  PID:9656
- C:\Windows\System\SyLtxLx.exe
  C:\Windows\System\SyLtxLx.exe
  2⤵
  PID:9672
- C:\Windows\System\uJYEmbY.exe
  C:\Windows\System\uJYEmbY.exe
  2⤵
  PID:9688
- C:\Windows\System\yblRnOc.exe
  C:\Windows\System\yblRnOc.exe
  2⤵
  PID:9704
- C:\Windows\System\MbSPuxz.exe
  C:\Windows\System\MbSPuxz.exe
  2⤵
  PID:9720
- C:\Windows\System\fcORBmq.exe
  C:\Windows\System\fcORBmq.exe
  2⤵
  PID:9736
- C:\Windows\System\GWdGzFO.exe
  C:\Windows\System\GWdGzFO.exe
  2⤵
  PID:9752
- C:\Windows\System\hiGmTPj.exe
  C:\Windows\System\hiGmTPj.exe
  2⤵
  PID:9768
- C:\Windows\System\AxyEqFZ.exe
  C:\Windows\System\AxyEqFZ.exe
  2⤵
  PID:9788
- C:\Windows\System\hydWfUQ.exe
  C:\Windows\System\hydWfUQ.exe
  2⤵
  PID:9804
- C:\Windows\System\lsQvbdx.exe
  C:\Windows\System\lsQvbdx.exe
  2⤵
  PID:9820
- C:\Windows\System\DaxPWlZ.exe
  C:\Windows\System\DaxPWlZ.exe
  2⤵
  PID:9836
- C:\Windows\System\YkkPyXL.exe
  C:\Windows\System\YkkPyXL.exe
  2⤵
  PID:9852
- C:\Windows\System\HzfwsBS.exe
  C:\Windows\System\HzfwsBS.exe
  2⤵
  PID:9868
- C:\Windows\System\eLFPXtT.exe
  C:\Windows\System\eLFPXtT.exe
  2⤵
  PID:9884
- C:\Windows\System\sSnMVgA.exe
  C:\Windows\System\sSnMVgA.exe
  2⤵
  PID:9900
- C:\Windows\System\WmFOrvw.exe
  C:\Windows\System\WmFOrvw.exe
  2⤵
  PID:9916
- C:\Windows\System\Grvumha.exe
  C:\Windows\System\Grvumha.exe
  2⤵
  PID:9932
- C:\Windows\System\TQQqzYw.exe
  C:\Windows\System\TQQqzYw.exe
  2⤵
  PID:9948
- C:\Windows\System\XwWlLyo.exe
  C:\Windows\System\XwWlLyo.exe
  2⤵
  PID:9964
- C:\Windows\System\bfRLIDI.exe
  C:\Windows\System\bfRLIDI.exe
  2⤵
  PID:9980
- C:\Windows\System\bsWKAdy.exe
  C:\Windows\System\bsWKAdy.exe
  2⤵
  PID:9996
- C:\Windows\System\KCAxTOK.exe
  C:\Windows\System\KCAxTOK.exe
  2⤵
  PID:10012
- C:\Windows\System\BaOlRdI.exe
  C:\Windows\System\BaOlRdI.exe
  2⤵
  PID:10028
- C:\Windows\System\ILuEFea.exe
  C:\Windows\System\ILuEFea.exe
  2⤵
  PID:10044
- C:\Windows\System\AFoetOI.exe
  C:\Windows\System\AFoetOI.exe
  2⤵
  PID:10060
- C:\Windows\System\hkawABu.exe
  C:\Windows\System\hkawABu.exe
  2⤵
  PID:10076
- C:\Windows\System\EFTvGee.exe
  C:\Windows\System\EFTvGee.exe
  2⤵
  PID:10092
- C:\Windows\System\zIhHnqO.exe
  C:\Windows\System\zIhHnqO.exe
  2⤵
  PID:10108
- C:\Windows\System\QNtxStl.exe
  C:\Windows\System\QNtxStl.exe
  2⤵
  PID:10124
- C:\Windows\System\VsNyapf.exe
  C:\Windows\System\VsNyapf.exe
  2⤵
  PID:10140
- C:\Windows\System\zDEFMcS.exe
  C:\Windows\System\zDEFMcS.exe
  2⤵
  PID:10156
- C:\Windows\System\jpAbouG.exe
  C:\Windows\System\jpAbouG.exe
  2⤵
  PID:10172
- C:\Windows\System\KnNVYAr.exe
  C:\Windows\System\KnNVYAr.exe
  2⤵
  PID:10188
- C:\Windows\System\Jwfhgrs.exe
  C:\Windows\System\Jwfhgrs.exe
  2⤵
  PID:10204
- C:\Windows\System\sJvrjuf.exe
  C:\Windows\System\sJvrjuf.exe
  2⤵
  PID:10220
- C:\Windows\System\lPfbFdA.exe
  C:\Windows\System\lPfbFdA.exe
  2⤵
  PID:10236
- C:\Windows\System\hwqzRsy.exe
  C:\Windows\System\hwqzRsy.exe
  2⤵
  PID:9264
- C:\Windows\System\bxZzeyg.exe
  C:\Windows\System\bxZzeyg.exe
  2⤵
  PID:9300
- C:\Windows\System\DBxVObo.exe
  C:\Windows\System\DBxVObo.exe
  2⤵
  PID:9364
- C:\Windows\System\HfkvzFj.exe
  C:\Windows\System\HfkvzFj.exe
  2⤵
  PID:9428
- C:\Windows\System\JxpQiEh.exe
  C:\Windows\System\JxpQiEh.exe
  2⤵
  PID:9524
- C:\Windows\System\AfgiLEA.exe
  C:\Windows\System\AfgiLEA.exe
  2⤵
  PID:9520
- C:\Windows\System\PfenymY.exe
  C:\Windows\System\PfenymY.exe
  2⤵
  PID:9648
- C:\Windows\System\DRzUvRz.exe
  C:\Windows\System\DRzUvRz.exe
  2⤵
  PID:8628
- C:\Windows\System\LmGkCQw.exe
  C:\Windows\System\LmGkCQw.exe
  2⤵
  PID:9680
- C:\Windows\System\UPuaXNC.exe
  C:\Windows\System\UPuaXNC.exe
  2⤵
  PID:9012
- C:\Windows\System\tWiONMN.exe
  C:\Windows\System\tWiONMN.exe
  2⤵
  PID:9316
- C:\Windows\System\oKpSPnk.exe
  C:\Windows\System\oKpSPnk.exe
  2⤵
  PID:9380
- C:\Windows\System\GIXWMIZ.exe
  C:\Windows\System\GIXWMIZ.exe
  2⤵
  PID:9444
- C:\Windows\System\vuagthN.exe
  C:\Windows\System\vuagthN.exe
  2⤵
  PID:9508
- C:\Windows\System\EjdoNCN.exe
  C:\Windows\System\EjdoNCN.exe
  2⤵
  PID:9572
- C:\Windows\System\dcUWLDY.exe
  C:\Windows\System\dcUWLDY.exe
  2⤵
  PID:9636
- C:\Windows\System\XhfnkRQ.exe
  C:\Windows\System\XhfnkRQ.exe
  2⤵
  PID:9732
- C:\Windows\System\bwEwhJu.exe
  C:\Windows\System\bwEwhJu.exe
  2⤵
  PID:9760
- C:\Windows\System\OsBFjFr.exe
  C:\Windows\System\OsBFjFr.exe
  2⤵
  PID:9744
- C:\Windows\System\EbYnxZV.exe
  C:\Windows\System\EbYnxZV.exe
  2⤵
  PID:9748
- C:\Windows\System\kGBRnCq.exe
  C:\Windows\System\kGBRnCq.exe
  2⤵
  PID:9832
- C:\Windows\System\beLYyJk.exe
  C:\Windows\System\beLYyJk.exe
  2⤵
  PID:9876
- C:\Windows\System\lzMWsui.exe
  C:\Windows\System\lzMWsui.exe
  2⤵
  PID:9880
- C:\Windows\System\kmMTBQu.exe
  C:\Windows\System\kmMTBQu.exe
  2⤵
  PID:9972
- C:\Windows\System\mmSzHxO.exe
  C:\Windows\System\mmSzHxO.exe
  2⤵
  PID:9928
- C:\Windows\System\jaiThQs.exe
  C:\Windows\System\jaiThQs.exe
  2⤵
  PID:9976
- C:\Windows\System\NsAzPXU.exe
  C:\Windows\System\NsAzPXU.exe
  2⤵
  PID:9992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AlulHwn.exe

Filesize
1.7MB

MD5
4eee06763fd0d5acdab32a17df43ba64

SHA1
5afbaae5f2936aa0532d970c6ce69a66bbadeb9e

SHA256
a16d001d9a25852ad81290f4e02e61a59ca4a56e78a12c278813bfd1c9058c4f

SHA512
f6194ce2909c1708c44c8a3c38d00cb8059982f064c9b140aca1a241d7827eed86afc0aa83cc828169235e44219c206c5df1b1a3abb6de878573bcd7833d23c6

Download Submit
C:\Windows\system\BqPrRPO.exe

Filesize
1.7MB

MD5
56f64855bc1fec6dde6604a0575ba0c1

SHA1
a98d21cc4637123e46ab402badb506c8e7f0bd32

SHA256
37c4dd8c9ce3100c8c5a3e01f1e1f5e7a0698773a9ed8ca9d3a548e86d1378c8

SHA512
59a35f8134bab4a59f62baca7f72436c3b745b8dd7e241c79421751870de28bb2ffa05749676eb3a3e1b13866289ae99ec3262e016b813314fba455764bb4180

Download Submit
C:\Windows\system\CzoQirm.exe

Filesize
1.7MB

MD5
f19a920215b271952fb481593a4dc8cc

SHA1
b3363c356b489595cf79a00b9fbe70a373bba78a

SHA256
70d5ceab18a17ec0cbbf3b9153a4b413f2b061c70a1ff101377bc6728c316a46

SHA512
6e42bea2ba16b11d01e584d8e53f0e87771ed306448e70472be87571ae95bc377ca74964bcb0c74ccf1e56b05a52eb006fe4da9b2b111afedfafcf853bdf8371

Download Submit
C:\Windows\system\FjyZGEy.exe

Filesize
1.8MB

MD5
fc148ee4e0401f229e27d2702585979b

SHA1
adae76d5d4c16bd0322b5eb4c01c55b4bfae07c5

SHA256
2a5e51db630cb9af85a7fcd4247dd1699f2d11ae57f023be183810d7d76a3743

SHA512
19cc81426569c6df085dae7e8f63a754ab9c74d3967d2d59a7acb85424331386c839547b8e320a0f3b527b292cab84c4b0285e7efaf788f9721f87202b0e0640

Download Submit
C:\Windows\system\GXIYscb.exe

Filesize
1.7MB

MD5
72a52e5e98c62c5fe2796c69df165a97

SHA1
b6b1d00ab03aadd2c0afb853f7e9f8dca1c8eb79

SHA256
8a079fed0aadc53aa158071b634463face86f6c747a89da6e8bd3d77a20800b6

SHA512
c61622308967ae2410ce5e94e60909e90d83fd7a953afb11a460aefc7b1abc0d04ece91415884c04edeb31e251d8aedb448974a1937c2bf00a7c9b2b1961683d

Download Submit
C:\Windows\system\IUfpEWY.exe

Filesize
1.7MB

MD5
611e198b75bba451b3e6be0523a339b6

SHA1
4343d67e7c25694e01484135f0efce5e08786fcf

SHA256
843501c2c0d3655c7b4fec1717c748a69ca0a76b6418dd94eed04f0c5644861c

SHA512
d5c0b3121b561e204a75d2878944406c3af376723227490928e0a22f7a9f2a4591913a94d3a783baa0701a3ac589dd171eb18d61816ece9c51dbd29d90f485dc

Download Submit
C:\Windows\system\KiUiPTm.exe

Filesize
1.7MB

MD5
ca88f62ed8c60bbe4190bf6d500d0d60

SHA1
0380fb4ec1d27f841921c9ca8596ed560513cb88

SHA256
fe2d3d9a41548bef7c577571a07da5ea21a4240252c0c43f8f885a4359785143

SHA512
3870ff4628c6c5db939cf0a210f801e45732855af3ea100c80edef3653eefe04b42066cd6ca74fb450b8f4a5f4844ff490cebb22d6b068c29e32a09aeeb11a8e

Download Submit
C:\Windows\system\KxrdXxB.exe

Filesize
1.7MB

MD5
509bcdfc88c8ed7efaaa17700e097119

SHA1
d788ca6ccce666c8e5db42f985daefc3242b84a6

SHA256
12e562bf0a10f890891123725b6bafea869748b0a657acd1489aa86b333c5a8b

SHA512
b626e166755a701aa27ad3237615876edb65db17647dfff4ded5946d5f0b2282e0a944dcc8e8bd2c0e4af4dba98b526d0ad6e028ee21adc7ff87ce2914a91dec

Download Submit
C:\Windows\system\Myufdbh.exe

Filesize
1.8MB

MD5
03bfd135f5d4fa5da186c9ab32933111

SHA1
68e003434bf1c6e9d31fb45b4b5ad1c69ecd82e9

SHA256
5c38cebf93944d13065122aeafe3b070febeb3bb8466347f911565d09e238c93

SHA512
b31ba5b9fa4d44729f51762cf422503fcf043d1f8d800de3f15aac0ba66aaefb68ccb93f060dd771514b2521a82ad42fc238579d674a9d8bd6b71b32370f89cc

Download Submit
C:\Windows\system\NFHVRth.exe

Filesize
1.7MB

MD5
37059d145ef7a775d23a7f728765eba2

SHA1
ee9dc26f19fadbc03c828fa71c2c0b516c78bc63

SHA256
af965e9afd1d7bf9169851b2385dda7be584b6db10b8d597f5b0e58efd1715e0

SHA512
a634122b91b03633a56fb78c31595b63d88e261b8a3e6519a51671f443da22a7a64fee216962e04b39e0d27b715802baa7de04c96f9ca4e1b4b47d7330ccf464

Download Submit
C:\Windows\system\NMiFaAz.exe

Filesize
1.7MB

MD5
26e0e02d3157deb931a687805f4768cd

SHA1
94338f0363e8642ced42a52602635cb03f3f2691

SHA256
1336e678c8738779ad3771d5f48f39f25093772990212db93ddf36e0cf762450

SHA512
502181e3858ba94b39685c3b7f82929e96b8aeb6250c9c95395a9a4c642c3ef6492cf09a924fd5949ebe8add62c1a11128d174f3ae212eb5a0d3af4f3ff36d2d

Download Submit
C:\Windows\system\QmltEiI.exe

Filesize
1.7MB

MD5
cdd6da6e83db796939cf0fe22fd64795

SHA1
0e132adda186e61b9d9e6248640c40495bb5bbab

SHA256
a533cca33fae4b666ea50ba0a1e71a8ae182e44fc8fbfe3fd76a1f044ce743bd

SHA512
3811168bce260d3b35fd3a633649af87bd0cf62007864e6331d8740e6930a4c74edc0cae62b1cf736f6fdb58b1fde2d6ee952249bfc99b87fbbd7df6dbd76213

Download Submit
C:\Windows\system\RUgIYtZ.exe

Filesize
1.7MB

MD5
922ed742f07ac5d37909c17e913e0b9f

SHA1
847e883097dbd5f45083997eec06112820ee7e8c

SHA256
60053a0714a0f04760997e0ebf8663d21960694b932e165ea54369a785ec7575

SHA512
df747e0daeeb834bed062f773e6eee96b32f2c417284d41a794642a5230c36a37e6c55ac29473ef29f51de944a0f0028856caa88a7b0383bfcaf202bcab89bad

Download Submit
C:\Windows\system\RpREYUm.exe

Filesize
1.7MB

MD5
d9a1160d3dffdef30ba132c882e3c097

SHA1
f4bbc4548b4f79fa9f3c5d0761cadeacc79d92c2

SHA256
524464ead4e68d6ea4176375edcdbc1441963da192dab90f265eb9f0f5a7c762

SHA512
a96cd7e7eea638b79095b1272144749778431eb04fad630e03bcd120684b0610879b320dd0569d00e743185e38af8e4834fdf6f97204cafca25051d85ee85a20

Download Submit
C:\Windows\system\TTVkCif.exe

Filesize
1.7MB

MD5
71ab0ea4eeaa5d8af9a80041dd91a3cb

SHA1
a587e68b285e51e214245873ba23ac403e0d9f7f

SHA256
fe375a973627282f3cbe47d97c27b8a72ef99e977946836365810182906f073a

SHA512
316a85e348e5a96606be62a09c13b3c08a4f2cdb9a913f615d1f1de4dfff4c2e3cdfeeabf6bacc2f2eb12736ad2e2fa5c6764041f9bdb36b524cf4cd4a74ff3a

Download Submit
C:\Windows\system\VrHufwV.exe

Filesize
1.7MB

MD5
8dc16602dd08a6bb18c191101a6a18e1

SHA1
d0b8b2a19074bd39269ba32f78d2a2f91d3128eb

SHA256
e56cb6e7aea2497748cb5e89908665b61f3eb4f0c0e41a29bfbb632d7295ed36

SHA512
20a3ba282a08145499c4c2da79865999a62c05ceff10c29b797136e5624b509406837d1e277483f7166c6108bc284800bd506cb201a4b7555f74c9bcae37192b

Download Submit
C:\Windows\system\XEGwAUq.exe

Filesize
1.7MB

MD5
7d812737385ac1708d4d9868b578b0ea

SHA1
dfc05fbc23ac18b3487070db1ab81b0714abaabb

SHA256
7b6c630c15a2e4c905586c56536367b25294b7b338dd7c477025f442c074515f

SHA512
e9ba05f5781befdfe708752bb10180fc03962e0cb5a7eaf442414bd8975dd4fef31bc1e73c2b6fe299da30721e9e4accd8504c946e4d98062fa1b84fbc34b13d

Download Submit
C:\Windows\system\cwGxvUr.exe

Filesize
1.8MB

MD5
82814eee51ca68e6f560dc19b62a081c

SHA1
6602daa0b961ee33b7f08f0587a893968a5c1383

SHA256
3431dbbffa1673913b4a43a7fd3998d58e8f8bbc53928663373a8e38e303c1bb

SHA512
efdc157468248028ebeb48eff1b30aba750cac2c19e0d5c9a2537621e5ce57c4a0773c3c46e424799f722e57a59c55a8d6afb827c77cfafbd1ed4c179e6e8bf6

Download Submit
C:\Windows\system\dyNfFIq.exe

Filesize
1.7MB

MD5
a4119165254b1b7d1e276a9cce9edc33

SHA1
ade925e694ac445fcc25c06242750de4e0052687

SHA256
ea879fff51637255a4f45ac48364289973c792d3548a35efd85a987e99c74530

SHA512
810e909bc09d532a7837f2082debfd8bae82f333ed74c8cdfccb4ad637b043314ae6a28511c07ab74a13487f88b799c015eca20102d2d74eea7036aa8956aaa7

Download Submit
C:\Windows\system\gWOKdlS.exe

Filesize
1.7MB

MD5
123b345dac2764884538b7a99fb4c6ee

SHA1
f79cf7df90bd1d6a99882187a8c71114e1a59f0b

SHA256
9f99d64142a5ef68624a0352f6f0b84411402eeb257ed6be06343f87cbff7680

SHA512
b98a3b9e3ca2552f2d46ba7c391e65ea13ea0065aea751cf5e545669d16b2fdabc7d729a9cf6edb9ee26bc1ae262532a83a3fe65d1034ea4a3264e2462e5baea

Download Submit
C:\Windows\system\hfwqgyt.exe

Filesize
1.8MB

MD5
acea7cdd60a7b5453ca5d524728ab4c7

SHA1
db599ed9781ce76571fb274e415ecb5c58de4467

SHA256
8d329921b2ae8ae961baf7d4efd67ac1a8efb154b2e05da67ab4c7b4e3751ee0

SHA512
6d31823bb9417f6183d071c349340aad5579d6d87c6d08d519aced4654865ef2c10803342081dbe97c2a20683ce1aa358961719aca46583db9c56bf2e9dc0abc

Download Submit
C:\Windows\system\jHifGXC.exe

Filesize
1.7MB

MD5
db50c6e3804dbe84c21483cfdc9936bc

SHA1
7f3ee0b191269d239ec28f652c386f971710c64c

SHA256
adfa2cee33c346452e6a33c2b0a57456f178604ee43d70913e005a11aa582fcf

SHA512
1fe1c32ae2446e1ccd322ae949561c8061c3e4a0702573ec3bc595be786a9fb44babc7baa2d05b477087a6838818181de40add3fae4b4544c994a7380c2d5077

Download Submit
C:\Windows\system\lwOwmMQ.exe

Filesize
1.7MB

MD5
48b808201431fa566c3499eeb96c882d

SHA1
32e0da30a12daf09d1c73bc700244ba63ce3a7b7

SHA256
0feb78c4f96472d11a08931f181065c1b6f005bf7149c3cfb623b71f487184cc

SHA512
ba0abbfca92a9fd6f8e7f23f294dca5648165a705b896faf897785cf6bdb22c6932d3b9b4982b8cd7e2dae7a6949f223dc897ec70fc7801f65a2d216ef57f493

Download Submit
C:\Windows\system\pFMsIWP.exe

Filesize
1.7MB

MD5
9469fa0b0bbda33345219aaebb3a1811

SHA1
14f0e27004e366cdce12d72c4f5dbcdfeadd5f8f

SHA256
cb4ffa7096558e3d4bdc376f51ea4d9b901a6c2ed0da197266caac01454228d3

SHA512
17edb9948c03ec90b5be17452ea61ee9bb5115f316b520719048e7a57b4c246ce8332c9d21a1f7f302836109f498fda3898cd28491c1ec6f8b6f5a1fdc33b2fc

Download Submit
C:\Windows\system\slZcocb.exe

Filesize
1.8MB

MD5
7c75eb80c37a04afb634a247cd2079b1

SHA1
0257009ce6af8660a624d1df933020427aa24f8e

SHA256
c9114850f3ce8da4e4d0415321d72ea492ed9a0849e58c3771bfc39bbf2f0371

SHA512
aab5ffbf403930a5413fc1054899f317730b749cface53f6c91e0e8492a6a53f62f7313a15400c7bad6d39d06e704fb95b93daf5ac40c35a5e0af957c9254298

Download Submit
C:\Windows\system\tjduWqD.exe

Filesize
1.7MB

MD5
adf5933cf7a03806aa1be90e174b3467

SHA1
3d73b5cbb833317660a45d312c5539585d084949

SHA256
455ee6b81994d7754ed1052b68745c76238d51e52238437b6fc95b23d1bc3c35

SHA512
e9fd7d4063f8e7775d082294eac715b204d90117322369e2281db86995acf58b36c479bf61ff0899f87b47f63f4e0591ce987b0e0205d3329746c9eb6dfdfda4

Download Submit
C:\Windows\system\uqFqQcp.exe

Filesize
1.7MB

MD5
3099d64198f0b37402db1f2fff187753

SHA1
7512a87be5d0f92c5ee804c798b988e612517fb8

SHA256
9237a521cf5d19109ea969da450763371b6baacd84409db91920e3e80f70b338

SHA512
43b94f9bc67217a24997efc9628d1b4fac7eb4b71e9e6412d4ad94cf7fb748919073f549efc9949f4b62e604f5a736e17d886c2d49954367ad625c54caa20f10

Download Submit
C:\Windows\system\vglEqtR.exe

Filesize
1.7MB

MD5
bc90ad5f1e3ffc9b8c786e961ef0baa4

SHA1
45d06d10c880aece442444700795779f3851f7b8

SHA256
8a0f6a3f4aec4a41a903fef0d5e88e84e70bf7e25f89daa902a9f0dccb6a0c64

SHA512
0349c50ad5c38bd768cc0e5704a496155d3c069a31a61e2d94dca7871398769233c0ab665e1e46fbcb3627f892a22345e0c88b94c980ec64164a77aabbfa2fd6

Download Submit
C:\Windows\system\wcIAwZM.exe

Filesize
1.7MB

MD5
c7425754e06ea84db1a67c2c80d4e6c1

SHA1
42a805676d85a3f2521f6e79490030f4e20761eb

SHA256
e4e64dd7764578036b7a7f5d1a1c6381d22550b2ecfbf8ee65e85e6268f19b67

SHA512
e7ef093ad45f1e6ce52fe9e84ed7d648a69095f796309855ab15a29c8e6b773251ffcba58b23f937356f9f78806a22ff2cb01410c1fc94da1c217698d3b4ddda

Download Submit
C:\Windows\system\wxIgJHT.exe

Filesize
1.7MB

MD5
b67da008602f7c5f91780a5c78fc4dd2

SHA1
58d9c77b9f75c3ca18c581f878a99e9952fd8728

SHA256
2991bd0df265a304b2a89f26d0f1eac8d6cb149ea7f8e00170fa597349626210

SHA512
c239de1da9f3e33ebe4ebf9663411bbb74f90a73d00a58ac825fc2ca377f68395235ad6c6d71dba6467d6b1db1d69401bbeb1d448f574b11a50c3a8dd45a5edd

Download Submit
\Windows\system\ICaripm.exe

Filesize
1.8MB

MD5
1710ae6047f4181660a74a3f8c00bda0

SHA1
1649805bc87459ff7aa7fd009ac7cff01699d101

SHA256
d78e9901a85ad4488d5af43029288aeb70ff9aed7182708bd05d65011e260975

SHA512
d710bf682d8e82978b024a91fa6abbf83972dc4b5f183665cc5b1a15fdf024ba7935a94b54c8de4d36b3e824f236085f9b74f0c73361d1da3135360396049687

Download Submit
\Windows\system\qbLVCpX.exe

Filesize
1.7MB

MD5
e97075fa0a47040de0696cfbdacb54a6

SHA1
906360f2c58d617b28f22e5bbcdfbe39f850a694

SHA256
1746dac1ad184983eef51084676249d76e95c2ca559a382e8f3f16ea07211cb2

SHA512
3cf8a753abb0baf00cd8c67cfa1d908d0890c24c7b773f8aa9cd4cdcdd7362d84ca3bb446077230058d7ce6e09897a14bc260019162c1d7bad49770c3c07b2cc

Download Submit
\Windows\system\ucFxmhu.exe

Filesize
1.8MB

MD5
b119cd12a7abf16246f535fd593bb908

SHA1
f07feac12b4f281d6cd066e571ac8ddba4659508

SHA256
8b1e6ed5839d140c70e746c1a502e6fca23d7dfacf351712358a7f12ef636601

SHA512
cdb0e02494b4a8cefd2efaefb0a25694ff4ccbe071a4a6dec125fce8472bd0f5dc2944c964a997ba93f013620bd32b574a85eddc751eb6d30307024c917e7e47

Download Submit
memory/1948-164-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/1948-5038-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2084-160-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2084-8-0x00000000031A0000-0x0000000003592000-memory.dmp

Filesize
3.9MB

Download
memory/2084-0-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2084-167-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2084-158-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2084-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2084-156-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2084-24-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2084-154-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2084-152-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2084-165-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2084-150-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2084-10876-0x00000000031A0000-0x0000000003592000-memory.dmp

Filesize
3.9MB

Download
memory/2084-170-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2132-9-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2132-5077-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2204-149-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2404-5071-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2404-159-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2572-153-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-5033-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-155-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2620-3584-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2740-151-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-5029-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-5050-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-166-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-5037-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2824-168-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2856-14-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2856-4811-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2904-5041-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-157-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-143-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2920-2291-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2920-26-0x0000000002D80000-0x0000000002E00000-memory.dmp

Filesize
512KB

Download
memory/2920-27-0x000007FEF600E000-0x000007FEF600F000-memory.dmp

Filesize
4KB

Download
memory/2920-172-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2920-169-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2920-148-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2940-25-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-5062-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download