xmrig | f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
Size

3.2MB
MD5

6011ea3ac15a89b7fa589e9198c87b49
SHA1

7c9237e0a377aab247bae24fde5e1e2ee3f43c24
SHA256

f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a
SHA512

55d13ab82eef4dba696649b7bfee191b8a2a97e08ccb37b4a026a7ce8f1c2564aaf1f6239b822189776bf9e950719a616d7a19bc688b70df2b81c17c199ffe70
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWh:7bBeSFkd

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 54 IoCs

miner

resource	yara_rule
behavioral1/memory/2936-221-0x000000013F060000-0x000000013F456000-memory.dmp	xmrig
behavioral1/memory/1372-254-0x000000013FE30000-0x0000000140226000-memory.dmp	xmrig
behavioral1/memory/2804-257-0x000000013F0B0000-0x000000013F4A6000-memory.dmp	xmrig
behavioral1/memory/2052-249-0x000000013F9C0000-0x000000013FDB6000-memory.dmp	xmrig
behavioral1/memory/1148-245-0x000000013F690000-0x000000013FA86000-memory.dmp	xmrig
behavioral1/memory/1976-242-0x000000013FE50000-0x0000000140246000-memory.dmp	xmrig
behavioral1/memory/2084-237-0x000000013FBF0000-0x000000013FFE6000-memory.dmp	xmrig
behavioral1/memory/2608-233-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	xmrig
behavioral1/memory/2548-230-0x000000013F060000-0x000000013F456000-memory.dmp	xmrig
behavioral1/memory/2600-228-0x000000013FC70000-0x0000000140066000-memory.dmp	xmrig
behavioral1/memory/2836-223-0x000000013F930000-0x000000013FD26000-memory.dmp	xmrig
behavioral1/memory/2664-218-0x000000013F9B0000-0x000000013FDA6000-memory.dmp	xmrig
behavioral1/files/0x00050000000198ff-161.dat	xmrig
behavioral1/files/0x0005000000019803-153.dat	xmrig
behavioral1/files/0x00050000000196b3-145.dat	xmrig
behavioral1/files/0x00050000000196b1-138.dat	xmrig
behavioral1/files/0x00050000000199ce-166.dat	xmrig
behavioral1/files/0x0005000000019847-158.dat	xmrig
behavioral1/files/0x0005000000019799-150.dat	xmrig
behavioral1/files/0x003600000001871e-143.dat	xmrig
behavioral1/files/0x0005000000019627-127.dat	xmrig
behavioral1/files/0x0005000000019624-118.dat	xmrig
behavioral1/files/0x0005000000019669-132.dat	xmrig
behavioral1/files/0x0005000000019625-123.dat	xmrig
behavioral1/files/0x0005000000019623-112.dat	xmrig
behavioral1/files/0x0005000000019621-108.dat	xmrig
behavioral1/files/0x000500000001961f-102.dat	xmrig
behavioral1/files/0x000500000001961d-98.dat	xmrig
behavioral1/files/0x000500000001961b-91.dat	xmrig
behavioral1/files/0x0005000000019619-86.dat	xmrig
behavioral1/files/0x0005000000019617-80.dat	xmrig
behavioral1/files/0x0005000000019615-76.dat	xmrig
behavioral1/files/0x0005000000019613-70.dat	xmrig
behavioral1/files/0x0005000000019611-66.dat	xmrig
behavioral1/files/0x000500000001960f-60.dat	xmrig
behavioral1/files/0x000500000001960d-56.dat	xmrig
behavioral1/files/0x0007000000019354-50.dat	xmrig
behavioral1/files/0x000800000001927e-46.dat	xmrig
behavioral1/files/0x000600000001927c-41.dat	xmrig
behavioral1/files/0x000700000001902b-35.dat	xmrig
behavioral1/files/0x0007000000018bd2-31.dat	xmrig
behavioral1/files/0x0009000000018b83-26.dat	xmrig
behavioral1/files/0x000f0000000054a8-21.dat	xmrig
behavioral1/files/0x0007000000018780-16.dat	xmrig
behavioral1/files/0x0004000000011ba2-5.dat	xmrig
behavioral1/memory/2372-1-0x000000013F8F0000-0x000000013FCE6000-memory.dmp	xmrig
behavioral1/memory/2372-2844-0x000000013F8F0000-0x000000013FCE6000-memory.dmp	xmrig
behavioral1/memory/2664-4631-0x000000013F9B0000-0x000000013FDA6000-memory.dmp	xmrig
behavioral1/memory/2548-4634-0x000000013F060000-0x000000013F456000-memory.dmp	xmrig
behavioral1/memory/1372-4639-0x000000013FE30000-0x0000000140226000-memory.dmp	xmrig
behavioral1/memory/2084-4638-0x000000013FBF0000-0x000000013FFE6000-memory.dmp	xmrig
behavioral1/memory/1976-4637-0x000000013FE50000-0x0000000140246000-memory.dmp	xmrig
behavioral1/memory/2052-4636-0x000000013F9C0000-0x000000013FDB6000-memory.dmp	xmrig
behavioral1/memory/1148-4635-0x000000013F690000-0x000000013FA86000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2128	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2804	TpmGQfd.exe
2664	akCJWTl.exe
2936	KhzIgVa.exe
2836	mDmdKEP.exe
2600	SYcmPMV.exe
2548	qNQRnra.exe
2608	aJMOBWx.exe
2084	xijIQvm.exe
1976	aVzmKhs.exe
1148	eJEWSkx.exe
2052	hTxphvv.exe
1372	fczMyft.exe
2528	gTsQBmX.exe
2820	FMkHiIw.exe
2788	ObpihKJ.exe
580	WDhtJMR.exe
1876	ITuTQPo.exe
1952	YpSpJKO.exe
1352	qzgJUAm.exe
2308	NevAYSU.exe
440	smNDdSE.exe
2872	gvmTROb.exe
2320	INXtDkv.exe
792	XEqMDmy.exe
1092	ondfjad.exe
1180	FmipvpV.exe
2148	kWqOiaj.exe
2172	vrEpKNM.exe
1284	pwDDXhm.exe
1392	wnzpAki.exe
2124	tHBeqbD.exe
1852	Owopctj.exe
2496	XzEVmPx.exe
1640	Ruwivaf.exe
1636	GUTCSKi.exe
1776	sHijNIz.exe
2512	ChrLGBw.exe
2004	zmXuWUC.exe
1360	zWerjdv.exe
1564	UEOdjyY.exe
3024	NgtitCw.exe
3020	ozNBIhg.exe
1436	HbETgXG.exe
2232	GieJexC.exe
1484	zMrPwFy.exe
1276	RSdxJlX.exe
1956	nEKlfcU.exe
2988	tYFzSbU.exe
2844	LTlCmdB.exe
1708	lEYfEOW.exe
2184	hBtpNCS.exe
2680	VNZCuRa.exe
2952	UgOwXvb.exe
2764	WuPAWIz.exe
2828	RxcJipz.exe
1188	InYWxta.exe
2420	yvegVPB.exe
3012	RMfardT.exe
2016	VfivcsF.exe
1572	DGahdAv.exe
2796	kNThjVh.exe
2864	CUmuLwt.exe
556	PDZJAxI.exe
2960	pHsIhIE.exe

Loads dropped DLL 64 IoCs

pid	Process
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2936-221-0x000000013F060000-0x000000013F456000-memory.dmp	upx
behavioral1/memory/1372-254-0x000000013FE30000-0x0000000140226000-memory.dmp	upx
behavioral1/memory/2804-257-0x000000013F0B0000-0x000000013F4A6000-memory.dmp	upx
behavioral1/memory/2052-249-0x000000013F9C0000-0x000000013FDB6000-memory.dmp	upx
behavioral1/memory/1148-245-0x000000013F690000-0x000000013FA86000-memory.dmp	upx
behavioral1/memory/1976-242-0x000000013FE50000-0x0000000140246000-memory.dmp	upx
behavioral1/memory/2084-237-0x000000013FBF0000-0x000000013FFE6000-memory.dmp	upx
behavioral1/memory/2608-233-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	upx
behavioral1/memory/2548-230-0x000000013F060000-0x000000013F456000-memory.dmp	upx
behavioral1/memory/2600-228-0x000000013FC70000-0x0000000140066000-memory.dmp	upx
behavioral1/memory/2836-223-0x000000013F930000-0x000000013FD26000-memory.dmp	upx
behavioral1/memory/2664-218-0x000000013F9B0000-0x000000013FDA6000-memory.dmp	upx
behavioral1/files/0x00050000000198ff-161.dat	upx
behavioral1/files/0x0005000000019803-153.dat	upx
behavioral1/files/0x00050000000196b3-145.dat	upx
behavioral1/files/0x00050000000196b1-138.dat	upx
behavioral1/files/0x00050000000199ce-166.dat	upx
behavioral1/files/0x0005000000019847-158.dat	upx
behavioral1/files/0x0005000000019799-150.dat	upx
behavioral1/files/0x003600000001871e-143.dat	upx
behavioral1/files/0x0005000000019627-127.dat	upx
behavioral1/files/0x0005000000019624-118.dat	upx
behavioral1/files/0x0005000000019669-132.dat	upx
behavioral1/files/0x0005000000019625-123.dat	upx
behavioral1/files/0x0005000000019623-112.dat	upx
behavioral1/files/0x0005000000019621-108.dat	upx
behavioral1/files/0x000500000001961f-102.dat	upx
behavioral1/files/0x000500000001961d-98.dat	upx
behavioral1/files/0x000500000001961b-91.dat	upx
behavioral1/files/0x0005000000019619-86.dat	upx
behavioral1/files/0x0005000000019617-80.dat	upx
behavioral1/files/0x0005000000019615-76.dat	upx
behavioral1/files/0x0005000000019613-70.dat	upx
behavioral1/files/0x0005000000019611-66.dat	upx
behavioral1/files/0x000500000001960f-60.dat	upx
behavioral1/files/0x000500000001960d-56.dat	upx
behavioral1/files/0x0007000000019354-50.dat	upx
behavioral1/files/0x000800000001927e-46.dat	upx
behavioral1/files/0x000600000001927c-41.dat	upx
behavioral1/files/0x000700000001902b-35.dat	upx
behavioral1/files/0x0007000000018bd2-31.dat	upx
behavioral1/files/0x0009000000018b83-26.dat	upx
behavioral1/files/0x000f0000000054a8-21.dat	upx
behavioral1/files/0x0007000000018780-16.dat	upx
behavioral1/files/0x0004000000011ba2-5.dat	upx
behavioral1/memory/2372-1-0x000000013F8F0000-0x000000013FCE6000-memory.dmp	upx
behavioral1/memory/2372-2844-0x000000013F8F0000-0x000000013FCE6000-memory.dmp	upx
behavioral1/memory/2664-4631-0x000000013F9B0000-0x000000013FDA6000-memory.dmp	upx
behavioral1/memory/2548-4634-0x000000013F060000-0x000000013F456000-memory.dmp	upx
behavioral1/memory/1372-4639-0x000000013FE30000-0x0000000140226000-memory.dmp	upx
behavioral1/memory/2084-4638-0x000000013FBF0000-0x000000013FFE6000-memory.dmp	upx
behavioral1/memory/1976-4637-0x000000013FE50000-0x0000000140246000-memory.dmp	upx
behavioral1/memory/2052-4636-0x000000013F9C0000-0x000000013FDB6000-memory.dmp	upx
behavioral1/memory/1148-4635-0x000000013F690000-0x000000013FA86000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mzLOHRE.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\VYnlvwR.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\JNGwNFn.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\XDHZiPX.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\SLSIanJ.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\VAwWVDd.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\oLlfavV.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\sKuWcUq.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\mDZuwBX.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\wgtoFfN.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\DeQVRHK.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\TlHKojW.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\rcraHMx.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\WwmhMzH.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\gJduhng.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\XmjATDD.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\WYTADhS.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\krYmSzc.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\jbsnHNF.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\gdKJhGS.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\fqXuotY.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\lDmiYKl.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\WfdRyvt.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\kzjzoVr.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\NWKEYyn.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\kZfmcgY.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\JYBfpSM.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\TRAOWxe.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\rWxtIiH.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\TgjMOlS.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\lGuKnHM.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\SBgXOLc.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\JQenrUJ.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\gciDiiE.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\haPEngt.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\PcKLYgX.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\GzbPptZ.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\eAUhcKR.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\hAGzurM.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\ERgPWwb.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\bxFNVyc.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\utybjsS.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\TSSFOCO.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\ENvPBbt.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\ezRSRyK.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\zjnVOSV.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\SLaIptl.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\XzypnEe.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\wkVltVK.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\oDTtvCZ.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\BtzoZlU.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\huukOhC.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\lCekYhh.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\nGTDyjt.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\cuOsakp.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\SkFcEVX.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\yhLeMOc.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\lzucHxj.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\HyMOikM.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\hHQXDeQ.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\NgtitCw.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\gJYiFsV.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\QoPSFvb.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\pRmmtMJ.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2128	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeLockMemoryPrivilege	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2128	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	32
PID 2372 wrote to memory of 2128	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	32
PID 2372 wrote to memory of 2128	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	32
PID 2372 wrote to memory of 2804	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	33
PID 2372 wrote to memory of 2804	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	33
PID 2372 wrote to memory of 2804	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	33
PID 2372 wrote to memory of 2664	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	34
PID 2372 wrote to memory of 2664	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	34
PID 2372 wrote to memory of 2664	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	34
PID 2372 wrote to memory of 2936	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	35
PID 2372 wrote to memory of 2936	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	35
PID 2372 wrote to memory of 2936	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	35
PID 2372 wrote to memory of 2836	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	36
PID 2372 wrote to memory of 2836	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	36
PID 2372 wrote to memory of 2836	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	36
PID 2372 wrote to memory of 2600	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	37
PID 2372 wrote to memory of 2600	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	37
PID 2372 wrote to memory of 2600	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	37
PID 2372 wrote to memory of 2548	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	38
PID 2372 wrote to memory of 2548	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	38
PID 2372 wrote to memory of 2548	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	38
PID 2372 wrote to memory of 2608	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	39
PID 2372 wrote to memory of 2608	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	39
PID 2372 wrote to memory of 2608	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	39
PID 2372 wrote to memory of 2084	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	40
PID 2372 wrote to memory of 2084	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	40
PID 2372 wrote to memory of 2084	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	40
PID 2372 wrote to memory of 1976	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	41
PID 2372 wrote to memory of 1976	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	41
PID 2372 wrote to memory of 1976	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	41
PID 2372 wrote to memory of 1148	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	42
PID 2372 wrote to memory of 1148	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	42
PID 2372 wrote to memory of 1148	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	42
PID 2372 wrote to memory of 2052	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	43
PID 2372 wrote to memory of 2052	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	43
PID 2372 wrote to memory of 2052	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	43
PID 2372 wrote to memory of 1372	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	44
PID 2372 wrote to memory of 1372	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	44
PID 2372 wrote to memory of 1372	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	44
PID 2372 wrote to memory of 2528	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	45
PID 2372 wrote to memory of 2528	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	45
PID 2372 wrote to memory of 2528	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	45
PID 2372 wrote to memory of 2820	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	46
PID 2372 wrote to memory of 2820	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	46
PID 2372 wrote to memory of 2820	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	46
PID 2372 wrote to memory of 2788	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	47
PID 2372 wrote to memory of 2788	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	47
PID 2372 wrote to memory of 2788	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	47
PID 2372 wrote to memory of 580	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	48
PID 2372 wrote to memory of 580	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	48
PID 2372 wrote to memory of 580	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	48
PID 2372 wrote to memory of 1876	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	49
PID 2372 wrote to memory of 1876	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	49
PID 2372 wrote to memory of 1876	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	49
PID 2372 wrote to memory of 1952	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	50
PID 2372 wrote to memory of 1952	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	50
PID 2372 wrote to memory of 1952	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	50
PID 2372 wrote to memory of 1352	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	51
PID 2372 wrote to memory of 1352	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	51
PID 2372 wrote to memory of 1352	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	51
PID 2372 wrote to memory of 2308	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	52
PID 2372 wrote to memory of 2308	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	52
PID 2372 wrote to memory of 2308	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	52
PID 2372 wrote to memory of 440	2372	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	53

C:\Users\Admin\AppData\Local\Temp\f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
"C:\Users\Admin\AppData\Local\Temp\f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\System\TpmGQfd.exe
  C:\Windows\System\TpmGQfd.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\akCJWTl.exe
  C:\Windows\System\akCJWTl.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\KhzIgVa.exe
  C:\Windows\System\KhzIgVa.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\mDmdKEP.exe
  C:\Windows\System\mDmdKEP.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\SYcmPMV.exe
  C:\Windows\System\SYcmPMV.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\qNQRnra.exe
  C:\Windows\System\qNQRnra.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\aJMOBWx.exe
  C:\Windows\System\aJMOBWx.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\xijIQvm.exe
  C:\Windows\System\xijIQvm.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\aVzmKhs.exe
  C:\Windows\System\aVzmKhs.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\eJEWSkx.exe
  C:\Windows\System\eJEWSkx.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\hTxphvv.exe
  C:\Windows\System\hTxphvv.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\fczMyft.exe
  C:\Windows\System\fczMyft.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\gTsQBmX.exe
  C:\Windows\System\gTsQBmX.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\FMkHiIw.exe
  C:\Windows\System\FMkHiIw.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\ObpihKJ.exe
  C:\Windows\System\ObpihKJ.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\WDhtJMR.exe
  C:\Windows\System\WDhtJMR.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\ITuTQPo.exe
  C:\Windows\System\ITuTQPo.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\YpSpJKO.exe
  C:\Windows\System\YpSpJKO.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\qzgJUAm.exe
  C:\Windows\System\qzgJUAm.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\NevAYSU.exe
  C:\Windows\System\NevAYSU.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\smNDdSE.exe
  C:\Windows\System\smNDdSE.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\gvmTROb.exe
  C:\Windows\System\gvmTROb.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\INXtDkv.exe
  C:\Windows\System\INXtDkv.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\XEqMDmy.exe
  C:\Windows\System\XEqMDmy.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\ondfjad.exe
  C:\Windows\System\ondfjad.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\FmipvpV.exe
  C:\Windows\System\FmipvpV.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\kWqOiaj.exe
  C:\Windows\System\kWqOiaj.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\tHBeqbD.exe
  C:\Windows\System\tHBeqbD.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\vrEpKNM.exe
  C:\Windows\System\vrEpKNM.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\Owopctj.exe
  C:\Windows\System\Owopctj.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\pwDDXhm.exe
  C:\Windows\System\pwDDXhm.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\XzEVmPx.exe
  C:\Windows\System\XzEVmPx.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\wnzpAki.exe
  C:\Windows\System\wnzpAki.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\Ruwivaf.exe
  C:\Windows\System\Ruwivaf.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\GUTCSKi.exe
  C:\Windows\System\GUTCSKi.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\sHijNIz.exe
  C:\Windows\System\sHijNIz.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\ChrLGBw.exe
  C:\Windows\System\ChrLGBw.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\zmXuWUC.exe
  C:\Windows\System\zmXuWUC.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\zWerjdv.exe
  C:\Windows\System\zWerjdv.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\UEOdjyY.exe
  C:\Windows\System\UEOdjyY.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\NgtitCw.exe
  C:\Windows\System\NgtitCw.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\ozNBIhg.exe
  C:\Windows\System\ozNBIhg.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\HbETgXG.exe
  C:\Windows\System\HbETgXG.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\GieJexC.exe
  C:\Windows\System\GieJexC.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\zMrPwFy.exe
  C:\Windows\System\zMrPwFy.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\RSdxJlX.exe
  C:\Windows\System\RSdxJlX.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\nEKlfcU.exe
  C:\Windows\System\nEKlfcU.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\tYFzSbU.exe
  C:\Windows\System\tYFzSbU.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\LTlCmdB.exe
  C:\Windows\System\LTlCmdB.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\lEYfEOW.exe
  C:\Windows\System\lEYfEOW.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\hBtpNCS.exe
  C:\Windows\System\hBtpNCS.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\VNZCuRa.exe
  C:\Windows\System\VNZCuRa.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\UgOwXvb.exe
  C:\Windows\System\UgOwXvb.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\WuPAWIz.exe
  C:\Windows\System\WuPAWIz.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\RxcJipz.exe
  C:\Windows\System\RxcJipz.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\InYWxta.exe
  C:\Windows\System\InYWxta.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\yvegVPB.exe
  C:\Windows\System\yvegVPB.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\RMfardT.exe
  C:\Windows\System\RMfardT.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\VfivcsF.exe
  C:\Windows\System\VfivcsF.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\DGahdAv.exe
  C:\Windows\System\DGahdAv.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\kNThjVh.exe
  C:\Windows\System\kNThjVh.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\CUmuLwt.exe
  C:\Windows\System\CUmuLwt.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\PDZJAxI.exe
  C:\Windows\System\PDZJAxI.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\dMNrDRS.exe
  C:\Windows\System\dMNrDRS.exe
  2⤵
  PID:532
- C:\Windows\System\pHsIhIE.exe
  C:\Windows\System\pHsIhIE.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\VXnRyrS.exe
  C:\Windows\System\VXnRyrS.exe
  2⤵
  PID:2992
- C:\Windows\System\jHDKiQr.exe
  C:\Windows\System\jHDKiQr.exe
  2⤵
  PID:2020
- C:\Windows\System\qcOoxsg.exe
  C:\Windows\System\qcOoxsg.exe
  2⤵
  PID:2824
- C:\Windows\System\CByVxgo.exe
  C:\Windows\System\CByVxgo.exe
  2⤵
  PID:2856
- C:\Windows\System\cZSUzFv.exe
  C:\Windows\System\cZSUzFv.exe
  2⤵
  PID:1052
- C:\Windows\System\HQOGecZ.exe
  C:\Windows\System\HQOGecZ.exe
  2⤵
  PID:2500
- C:\Windows\System\zjIHCEe.exe
  C:\Windows\System\zjIHCEe.exe
  2⤵
  PID:2156
- C:\Windows\System\GJNiZsp.exe
  C:\Windows\System\GJNiZsp.exe
  2⤵
  PID:2432
- C:\Windows\System\POjKgRe.exe
  C:\Windows\System\POjKgRe.exe
  2⤵
  PID:756
- C:\Windows\System\eTrKPju.exe
  C:\Windows\System\eTrKPju.exe
  2⤵
  PID:932
- C:\Windows\System\VocgrBG.exe
  C:\Windows\System\VocgrBG.exe
  2⤵
  PID:2336
- C:\Windows\System\qRUJNaS.exe
  C:\Windows\System\qRUJNaS.exe
  2⤵
  PID:1800
- C:\Windows\System\jdhHWzJ.exe
  C:\Windows\System\jdhHWzJ.exe
  2⤵
  PID:2888
- C:\Windows\System\CzMJdkZ.exe
  C:\Windows\System\CzMJdkZ.exe
  2⤵
  PID:2312
- C:\Windows\System\CpPohEg.exe
  C:\Windows\System\CpPohEg.exe
  2⤵
  PID:3056
- C:\Windows\System\BvSpYVl.exe
  C:\Windows\System\BvSpYVl.exe
  2⤵
  PID:2868
- C:\Windows\System\JBwxkit.exe
  C:\Windows\System\JBwxkit.exe
  2⤵
  PID:2136
- C:\Windows\System\rIgEjwY.exe
  C:\Windows\System\rIgEjwY.exe
  2⤵
  PID:2604
- C:\Windows\System\sUOprZt.exe
  C:\Windows\System\sUOprZt.exe
  2⤵
  PID:3036
- C:\Windows\System\ZrMooQo.exe
  C:\Windows\System\ZrMooQo.exe
  2⤵
  PID:1624
- C:\Windows\System\vhmLXkS.exe
  C:\Windows\System\vhmLXkS.exe
  2⤵
  PID:2212
- C:\Windows\System\sXrinsN.exe
  C:\Windows\System\sXrinsN.exe
  2⤵
  PID:1740
- C:\Windows\System\fKQWFmX.exe
  C:\Windows\System\fKQWFmX.exe
  2⤵
  PID:2028
- C:\Windows\System\XfdAaDt.exe
  C:\Windows\System\XfdAaDt.exe
  2⤵
  PID:2592
- C:\Windows\System\ZdHVFWC.exe
  C:\Windows\System\ZdHVFWC.exe
  2⤵
  PID:2576
- C:\Windows\System\YsvTsuR.exe
  C:\Windows\System\YsvTsuR.exe
  2⤵
  PID:2140
- C:\Windows\System\yiozbLi.exe
  C:\Windows\System\yiozbLi.exe
  2⤵
  PID:2388
- C:\Windows\System\IOBdBUi.exe
  C:\Windows\System\IOBdBUi.exe
  2⤵
  PID:2328
- C:\Windows\System\jYbbbZj.exe
  C:\Windows\System\jYbbbZj.exe
  2⤵
  PID:2492
- C:\Windows\System\TGbzTgX.exe
  C:\Windows\System\TGbzTgX.exe
  2⤵
  PID:1948
- C:\Windows\System\XcuawZg.exe
  C:\Windows\System\XcuawZg.exe
  2⤵
  PID:2168
- C:\Windows\System\IzFKgcb.exe
  C:\Windows\System\IzFKgcb.exe
  2⤵
  PID:1160
- C:\Windows\System\XsmrzmW.exe
  C:\Windows\System\XsmrzmW.exe
  2⤵
  PID:2568
- C:\Windows\System\tSsPoNW.exe
  C:\Windows\System\tSsPoNW.exe
  2⤵
  PID:2620
- C:\Windows\System\pzTgaMm.exe
  C:\Windows\System\pzTgaMm.exe
  2⤵
  PID:2672
- C:\Windows\System\CIwQVQs.exe
  C:\Windows\System\CIwQVQs.exe
  2⤵
  PID:2752
- C:\Windows\System\uIiBclh.exe
  C:\Windows\System\uIiBclh.exe
  2⤵
  PID:3004
- C:\Windows\System\vymjBhS.exe
  C:\Windows\System\vymjBhS.exe
  2⤵
  PID:1260
- C:\Windows\System\dRUsNrS.exe
  C:\Windows\System\dRUsNrS.exe
  2⤵
  PID:1244
- C:\Windows\System\JlBDJLw.exe
  C:\Windows\System\JlBDJLw.exe
  2⤵
  PID:316
- C:\Windows\System\FlHrQph.exe
  C:\Windows\System\FlHrQph.exe
  2⤵
  PID:2464
- C:\Windows\System\QRmFfRV.exe
  C:\Windows\System\QRmFfRV.exe
  2⤵
  PID:2252
- C:\Windows\System\EPlKtMJ.exe
  C:\Windows\System\EPlKtMJ.exe
  2⤵
  PID:2648
- C:\Windows\System\gelQopk.exe
  C:\Windows\System\gelQopk.exe
  2⤵
  PID:808
- C:\Windows\System\roVOOVQ.exe
  C:\Windows\System\roVOOVQ.exe
  2⤵
  PID:760
- C:\Windows\System\dWFvLWw.exe
  C:\Windows\System\dWFvLWw.exe
  2⤵
  PID:1556
- C:\Windows\System\FbGlcRL.exe
  C:\Windows\System\FbGlcRL.exe
  2⤵
  PID:2036
- C:\Windows\System\hRhPUPI.exe
  C:\Windows\System\hRhPUPI.exe
  2⤵
  PID:1864
- C:\Windows\System\VDQnDys.exe
  C:\Windows\System\VDQnDys.exe
  2⤵
  PID:1112
- C:\Windows\System\FtRzUbW.exe
  C:\Windows\System\FtRzUbW.exe
  2⤵
  PID:2656
- C:\Windows\System\eqNWsLs.exe
  C:\Windows\System\eqNWsLs.exe
  2⤵
  PID:1768
- C:\Windows\System\aPETwUD.exe
  C:\Windows\System\aPETwUD.exe
  2⤵
  PID:1720
- C:\Windows\System\fGvDHiz.exe
  C:\Windows\System\fGvDHiz.exe
  2⤵
  PID:2120
- C:\Windows\System\YnCLvHJ.exe
  C:\Windows\System\YnCLvHJ.exe
  2⤵
  PID:2072
- C:\Windows\System\jZwLKhW.exe
  C:\Windows\System\jZwLKhW.exe
  2⤵
  PID:1136
- C:\Windows\System\NfEbcxE.exe
  C:\Windows\System\NfEbcxE.exe
  2⤵
  PID:2768
- C:\Windows\System\ykrYDpo.exe
  C:\Windows\System\ykrYDpo.exe
  2⤵
  PID:3092
- C:\Windows\System\VGSVvXL.exe
  C:\Windows\System\VGSVvXL.exe
  2⤵
  PID:3112
- C:\Windows\System\UVMHzlG.exe
  C:\Windows\System\UVMHzlG.exe
  2⤵
  PID:3132
- C:\Windows\System\nMCZCQl.exe
  C:\Windows\System\nMCZCQl.exe
  2⤵
  PID:3152
- C:\Windows\System\HRzREWt.exe
  C:\Windows\System\HRzREWt.exe
  2⤵
  PID:3172
- C:\Windows\System\jDGomLr.exe
  C:\Windows\System\jDGomLr.exe
  2⤵
  PID:3192
- C:\Windows\System\eTWWHWr.exe
  C:\Windows\System\eTWWHWr.exe
  2⤵
  PID:3212
- C:\Windows\System\jtXUcse.exe
  C:\Windows\System\jtXUcse.exe
  2⤵
  PID:3228
- C:\Windows\System\OBaOicM.exe
  C:\Windows\System\OBaOicM.exe
  2⤵
  PID:3252
- C:\Windows\System\FVlbMkN.exe
  C:\Windows\System\FVlbMkN.exe
  2⤵
  PID:3272
- C:\Windows\System\FrTwxzM.exe
  C:\Windows\System\FrTwxzM.exe
  2⤵
  PID:3292
- C:\Windows\System\XiCUGJI.exe
  C:\Windows\System\XiCUGJI.exe
  2⤵
  PID:3308
- C:\Windows\System\FdudYyz.exe
  C:\Windows\System\FdudYyz.exe
  2⤵
  PID:3332
- C:\Windows\System\bAhPkJn.exe
  C:\Windows\System\bAhPkJn.exe
  2⤵
  PID:3352
- C:\Windows\System\qAzhICy.exe
  C:\Windows\System\qAzhICy.exe
  2⤵
  PID:3372
- C:\Windows\System\yCHgCDQ.exe
  C:\Windows\System\yCHgCDQ.exe
  2⤵
  PID:3392
- C:\Windows\System\KKoOyEX.exe
  C:\Windows\System\KKoOyEX.exe
  2⤵
  PID:3412
- C:\Windows\System\LWdekwN.exe
  C:\Windows\System\LWdekwN.exe
  2⤵
  PID:3432
- C:\Windows\System\nuGqbGZ.exe
  C:\Windows\System\nuGqbGZ.exe
  2⤵
  PID:3452
- C:\Windows\System\iyiyNvm.exe
  C:\Windows\System\iyiyNvm.exe
  2⤵
  PID:3472
- C:\Windows\System\pkuCcVR.exe
  C:\Windows\System\pkuCcVR.exe
  2⤵
  PID:3492
- C:\Windows\System\qEQHMen.exe
  C:\Windows\System\qEQHMen.exe
  2⤵
  PID:3512
- C:\Windows\System\jprwhFU.exe
  C:\Windows\System\jprwhFU.exe
  2⤵
  PID:3532
- C:\Windows\System\BHCilCB.exe
  C:\Windows\System\BHCilCB.exe
  2⤵
  PID:3548
- C:\Windows\System\gDGVmyJ.exe
  C:\Windows\System\gDGVmyJ.exe
  2⤵
  PID:3572
- C:\Windows\System\CMenRlm.exe
  C:\Windows\System\CMenRlm.exe
  2⤵
  PID:3588
- C:\Windows\System\TTGwIfl.exe
  C:\Windows\System\TTGwIfl.exe
  2⤵
  PID:3612
- C:\Windows\System\kQFNXLp.exe
  C:\Windows\System\kQFNXLp.exe
  2⤵
  PID:3628
- C:\Windows\System\OkmFeGT.exe
  C:\Windows\System\OkmFeGT.exe
  2⤵
  PID:3652
- C:\Windows\System\DiPxdTi.exe
  C:\Windows\System\DiPxdTi.exe
  2⤵
  PID:3668
- C:\Windows\System\JMwHNzJ.exe
  C:\Windows\System\JMwHNzJ.exe
  2⤵
  PID:3692
- C:\Windows\System\qIRQWHv.exe
  C:\Windows\System\qIRQWHv.exe
  2⤵
  PID:3712
- C:\Windows\System\HfnJOhu.exe
  C:\Windows\System\HfnJOhu.exe
  2⤵
  PID:3732
- C:\Windows\System\hZPbZfI.exe
  C:\Windows\System\hZPbZfI.exe
  2⤵
  PID:3752
- C:\Windows\System\LzUXCFr.exe
  C:\Windows\System\LzUXCFr.exe
  2⤵
  PID:3772
- C:\Windows\System\iECJAcc.exe
  C:\Windows\System\iECJAcc.exe
  2⤵
  PID:3792
- C:\Windows\System\TCnLtBu.exe
  C:\Windows\System\TCnLtBu.exe
  2⤵
  PID:3812
- C:\Windows\System\teohLeX.exe
  C:\Windows\System\teohLeX.exe
  2⤵
  PID:3832
- C:\Windows\System\WcqnGkV.exe
  C:\Windows\System\WcqnGkV.exe
  2⤵
  PID:3852
- C:\Windows\System\cEAFhMC.exe
  C:\Windows\System\cEAFhMC.exe
  2⤵
  PID:3876
- C:\Windows\System\uSLnmMa.exe
  C:\Windows\System\uSLnmMa.exe
  2⤵
  PID:3896
- C:\Windows\System\mnnFNOi.exe
  C:\Windows\System\mnnFNOi.exe
  2⤵
  PID:3916
- C:\Windows\System\FcsgVWz.exe
  C:\Windows\System\FcsgVWz.exe
  2⤵
  PID:3936
- C:\Windows\System\sOcxgTs.exe
  C:\Windows\System\sOcxgTs.exe
  2⤵
  PID:3956
- C:\Windows\System\Asitwmt.exe
  C:\Windows\System\Asitwmt.exe
  2⤵
  PID:3976
- C:\Windows\System\jLuqEQw.exe
  C:\Windows\System\jLuqEQw.exe
  2⤵
  PID:3996
- C:\Windows\System\vZwbnFI.exe
  C:\Windows\System\vZwbnFI.exe
  2⤵
  PID:4016
- C:\Windows\System\MPKOSXb.exe
  C:\Windows\System\MPKOSXb.exe
  2⤵
  PID:4036
- C:\Windows\System\hTfxLuH.exe
  C:\Windows\System\hTfxLuH.exe
  2⤵
  PID:4056
- C:\Windows\System\vSToShF.exe
  C:\Windows\System\vSToShF.exe
  2⤵
  PID:4076
- C:\Windows\System\ORBFJLc.exe
  C:\Windows\System\ORBFJLc.exe
  2⤵
  PID:2216
- C:\Windows\System\azUFEjC.exe
  C:\Windows\System\azUFEjC.exe
  2⤵
  PID:1968
- C:\Windows\System\sDxyxxk.exe
  C:\Windows\System\sDxyxxk.exe
  2⤵
  PID:1616
- C:\Windows\System\GlFosjb.exe
  C:\Windows\System\GlFosjb.exe
  2⤵
  PID:2068
- C:\Windows\System\TlxGtke.exe
  C:\Windows\System\TlxGtke.exe
  2⤵
  PID:568
- C:\Windows\System\nZRWcPd.exe
  C:\Windows\System\nZRWcPd.exe
  2⤵
  PID:2400
- C:\Windows\System\aleXZrW.exe
  C:\Windows\System\aleXZrW.exe
  2⤵
  PID:1748
- C:\Windows\System\PFhuGhS.exe
  C:\Windows\System\PFhuGhS.exe
  2⤵
  PID:2196
- C:\Windows\System\KrqErBV.exe
  C:\Windows\System\KrqErBV.exe
  2⤵
  PID:1884
- C:\Windows\System\JVsOBWx.exe
  C:\Windows\System\JVsOBWx.exe
  2⤵
  PID:2976
- C:\Windows\System\cUIxFfO.exe
  C:\Windows\System\cUIxFfO.exe
  2⤵
  PID:3100
- C:\Windows\System\zHNDyrt.exe
  C:\Windows\System\zHNDyrt.exe
  2⤵
  PID:3164
- C:\Windows\System\gKapXLW.exe
  C:\Windows\System\gKapXLW.exe
  2⤵
  PID:3200
- C:\Windows\System\bIizxLa.exe
  C:\Windows\System\bIizxLa.exe
  2⤵
  PID:3180
- C:\Windows\System\pIGKqbV.exe
  C:\Windows\System\pIGKqbV.exe
  2⤵
  PID:3224
- C:\Windows\System\HcCsGTG.exe
  C:\Windows\System\HcCsGTG.exe
  2⤵
  PID:3268
- C:\Windows\System\FzuUTCf.exe
  C:\Windows\System\FzuUTCf.exe
  2⤵
  PID:3328
- C:\Windows\System\YNgNdBK.exe
  C:\Windows\System\YNgNdBK.exe
  2⤵
  PID:3360
- C:\Windows\System\gglmCHT.exe
  C:\Windows\System\gglmCHT.exe
  2⤵
  PID:3400
- C:\Windows\System\jRfpOBE.exe
  C:\Windows\System\jRfpOBE.exe
  2⤵
  PID:3444
- C:\Windows\System\KouhGTb.exe
  C:\Windows\System\KouhGTb.exe
  2⤵
  PID:3448
- C:\Windows\System\ZhGOYoz.exe
  C:\Windows\System\ZhGOYoz.exe
  2⤵
  PID:3484
- C:\Windows\System\MWhbxHe.exe
  C:\Windows\System\MWhbxHe.exe
  2⤵
  PID:3524
- C:\Windows\System\xdKJhxw.exe
  C:\Windows\System\xdKJhxw.exe
  2⤵
  PID:3568
- C:\Windows\System\PXhvvNH.exe
  C:\Windows\System\PXhvvNH.exe
  2⤵
  PID:3596
- C:\Windows\System\qaRvTfE.exe
  C:\Windows\System\qaRvTfE.exe
  2⤵
  PID:3584
- C:\Windows\System\xfCdeFF.exe
  C:\Windows\System\xfCdeFF.exe
  2⤵
  PID:3676
- C:\Windows\System\vdcrYms.exe
  C:\Windows\System\vdcrYms.exe
  2⤵
  PID:3624
- C:\Windows\System\vEgYhhS.exe
  C:\Windows\System\vEgYhhS.exe
  2⤵
  PID:3720
- C:\Windows\System\RJOclIT.exe
  C:\Windows\System\RJOclIT.exe
  2⤵
  PID:3744
- C:\Windows\System\GhMiXcd.exe
  C:\Windows\System\GhMiXcd.exe
  2⤵
  PID:3780
- C:\Windows\System\DgtDZaZ.exe
  C:\Windows\System\DgtDZaZ.exe
  2⤵
  PID:3808
- C:\Windows\System\tMQqkeG.exe
  C:\Windows\System\tMQqkeG.exe
  2⤵
  PID:3848
- C:\Windows\System\IDDTcdT.exe
  C:\Windows\System\IDDTcdT.exe
  2⤵
  PID:3888
- C:\Windows\System\mcUPgRI.exe
  C:\Windows\System\mcUPgRI.exe
  2⤵
  PID:3924
- C:\Windows\System\SCkGkWf.exe
  C:\Windows\System\SCkGkWf.exe
  2⤵
  PID:3948
- C:\Windows\System\BptPEPn.exe
  C:\Windows\System\BptPEPn.exe
  2⤵
  PID:3984
- C:\Windows\System\cxyocSz.exe
  C:\Windows\System\cxyocSz.exe
  2⤵
  PID:3992
- C:\Windows\System\gRtUgQG.exe
  C:\Windows\System\gRtUgQG.exe
  2⤵
  PID:4048
- C:\Windows\System\PAqyPYR.exe
  C:\Windows\System\PAqyPYR.exe
  2⤵
  PID:4084
- C:\Windows\System\ZLrlyQv.exe
  C:\Windows\System\ZLrlyQv.exe
  2⤵
  PID:604
- C:\Windows\System\QPhHOkm.exe
  C:\Windows\System\QPhHOkm.exe
  2⤵
  PID:2632
- C:\Windows\System\RMLNrKD.exe
  C:\Windows\System\RMLNrKD.exe
  2⤵
  PID:2640
- C:\Windows\System\xfkCslS.exe
  C:\Windows\System\xfkCslS.exe
  2⤵
  PID:1808
- C:\Windows\System\pRElGVo.exe
  C:\Windows\System\pRElGVo.exe
  2⤵
  PID:1928
- C:\Windows\System\QZGJAWw.exe
  C:\Windows\System\QZGJAWw.exe
  2⤵
  PID:3084
- C:\Windows\System\zkyFANH.exe
  C:\Windows\System\zkyFANH.exe
  2⤵
  PID:3168
- C:\Windows\System\AxKQJun.exe
  C:\Windows\System\AxKQJun.exe
  2⤵
  PID:3248
- C:\Windows\System\AVdNOLE.exe
  C:\Windows\System\AVdNOLE.exe
  2⤵
  PID:3280
- C:\Windows\System\VtMdCCn.exe
  C:\Windows\System\VtMdCCn.exe
  2⤵
  PID:3260
- C:\Windows\System\oZHZzHb.exe
  C:\Windows\System\oZHZzHb.exe
  2⤵
  PID:3324
- C:\Windows\System\yeaROYl.exe
  C:\Windows\System\yeaROYl.exe
  2⤵
  PID:3408
- C:\Windows\System\SQutvgq.exe
  C:\Windows\System\SQutvgq.exe
  2⤵
  PID:3520
- C:\Windows\System\zLQaNnc.exe
  C:\Windows\System\zLQaNnc.exe
  2⤵
  PID:3544
- C:\Windows\System\DmPoxrL.exe
  C:\Windows\System\DmPoxrL.exe
  2⤵
  PID:3688
- C:\Windows\System\BPWTmEr.exe
  C:\Windows\System\BPWTmEr.exe
  2⤵
  PID:3556
- C:\Windows\System\ynCJaQz.exe
  C:\Windows\System\ynCJaQz.exe
  2⤵
  PID:3684
- C:\Windows\System\IkKHbMM.exe
  C:\Windows\System\IkKHbMM.exe
  2⤵
  PID:3824
- C:\Windows\System\TYyctJR.exe
  C:\Windows\System\TYyctJR.exe
  2⤵
  PID:3740
- C:\Windows\System\OAEGRWx.exe
  C:\Windows\System\OAEGRWx.exe
  2⤵
  PID:3788
- C:\Windows\System\HZrRQBn.exe
  C:\Windows\System\HZrRQBn.exe
  2⤵
  PID:3860
- C:\Windows\System\zyLbliQ.exe
  C:\Windows\System\zyLbliQ.exe
  2⤵
  PID:3932
- C:\Windows\System\acaLaMC.exe
  C:\Windows\System\acaLaMC.exe
  2⤵
  PID:4008
- C:\Windows\System\bVWuBtl.exe
  C:\Windows\System\bVWuBtl.exe
  2⤵
  PID:300
- C:\Windows\System\oUSebkN.exe
  C:\Windows\System\oUSebkN.exe
  2⤵
  PID:2848
- C:\Windows\System\mbDCjth.exe
  C:\Windows\System\mbDCjth.exe
  2⤵
  PID:1712
- C:\Windows\System\hblUZre.exe
  C:\Windows\System\hblUZre.exe
  2⤵
  PID:344
- C:\Windows\System\cKWKrzx.exe
  C:\Windows\System\cKWKrzx.exe
  2⤵
  PID:3088
- C:\Windows\System\CODbSEP.exe
  C:\Windows\System\CODbSEP.exe
  2⤵
  PID:3240
- C:\Windows\System\khyAaTY.exe
  C:\Windows\System\khyAaTY.exe
  2⤵
  PID:3320
- C:\Windows\System\mzLOHRE.exe
  C:\Windows\System\mzLOHRE.exe
  2⤵
  PID:3384
- C:\Windows\System\WAyxIME.exe
  C:\Windows\System\WAyxIME.exe
  2⤵
  PID:3640
- C:\Windows\System\fCbcQVU.exe
  C:\Windows\System\fCbcQVU.exe
  2⤵
  PID:3704
- C:\Windows\System\GqDKStS.exe
  C:\Windows\System\GqDKStS.exe
  2⤵
  PID:3528
- C:\Windows\System\ATJEpLD.exe
  C:\Windows\System\ATJEpLD.exe
  2⤵
  PID:3708
- C:\Windows\System\ychxujA.exe
  C:\Windows\System\ychxujA.exe
  2⤵
  PID:3952
- C:\Windows\System\qLCzLKj.exe
  C:\Windows\System\qLCzLKj.exe
  2⤵
  PID:3944
- C:\Windows\System\xfyCvQy.exe
  C:\Windows\System\xfyCvQy.exe
  2⤵
  PID:3872
- C:\Windows\System\lCotldu.exe
  C:\Windows\System\lCotldu.exe
  2⤵
  PID:2024
- C:\Windows\System\zWwCgsS.exe
  C:\Windows\System\zWwCgsS.exe
  2⤵
  PID:4112
- C:\Windows\System\lRdqsVG.exe
  C:\Windows\System\lRdqsVG.exe
  2⤵
  PID:4132
- C:\Windows\System\mWQdXLX.exe
  C:\Windows\System\mWQdXLX.exe
  2⤵
  PID:4152
- C:\Windows\System\fHcSunk.exe
  C:\Windows\System\fHcSunk.exe
  2⤵
  PID:4172
- C:\Windows\System\qQJMnSL.exe
  C:\Windows\System\qQJMnSL.exe
  2⤵
  PID:4192
- C:\Windows\System\SlJNJSR.exe
  C:\Windows\System\SlJNJSR.exe
  2⤵
  PID:4212
- C:\Windows\System\KeaKGqy.exe
  C:\Windows\System\KeaKGqy.exe
  2⤵
  PID:4232
- C:\Windows\System\TmGQnCp.exe
  C:\Windows\System\TmGQnCp.exe
  2⤵
  PID:4252
- C:\Windows\System\fJuXFcs.exe
  C:\Windows\System\fJuXFcs.exe
  2⤵
  PID:4272
- C:\Windows\System\JQPwCPw.exe
  C:\Windows\System\JQPwCPw.exe
  2⤵
  PID:4292
- C:\Windows\System\zZDXTup.exe
  C:\Windows\System\zZDXTup.exe
  2⤵
  PID:4312
- C:\Windows\System\FOmHeUy.exe
  C:\Windows\System\FOmHeUy.exe
  2⤵
  PID:4332
- C:\Windows\System\aorsKRo.exe
  C:\Windows\System\aorsKRo.exe
  2⤵
  PID:4352
- C:\Windows\System\CPpDGpQ.exe
  C:\Windows\System\CPpDGpQ.exe
  2⤵
  PID:4372
- C:\Windows\System\gFVGMVj.exe
  C:\Windows\System\gFVGMVj.exe
  2⤵
  PID:4388
- C:\Windows\System\AzaDEdo.exe
  C:\Windows\System\AzaDEdo.exe
  2⤵
  PID:4412
- C:\Windows\System\INjXZZK.exe
  C:\Windows\System\INjXZZK.exe
  2⤵
  PID:4432
- C:\Windows\System\ijbwjlL.exe
  C:\Windows\System\ijbwjlL.exe
  2⤵
  PID:4452
- C:\Windows\System\PWbYPQQ.exe
  C:\Windows\System\PWbYPQQ.exe
  2⤵
  PID:4472
- C:\Windows\System\zZXlZSR.exe
  C:\Windows\System\zZXlZSR.exe
  2⤵
  PID:4492
- C:\Windows\System\VtJgJKq.exe
  C:\Windows\System\VtJgJKq.exe
  2⤵
  PID:4508
- C:\Windows\System\qMfPvWg.exe
  C:\Windows\System\qMfPvWg.exe
  2⤵
  PID:4532
- C:\Windows\System\TQoxMtE.exe
  C:\Windows\System\TQoxMtE.exe
  2⤵
  PID:4552
- C:\Windows\System\mWUgFXP.exe
  C:\Windows\System\mWUgFXP.exe
  2⤵
  PID:4572
- C:\Windows\System\JOZMdYt.exe
  C:\Windows\System\JOZMdYt.exe
  2⤵
  PID:4592
- C:\Windows\System\rQFUmEU.exe
  C:\Windows\System\rQFUmEU.exe
  2⤵
  PID:4612
- C:\Windows\System\qCPIMJI.exe
  C:\Windows\System\qCPIMJI.exe
  2⤵
  PID:4628
- C:\Windows\System\bFNcmON.exe
  C:\Windows\System\bFNcmON.exe
  2⤵
  PID:4652
- C:\Windows\System\cgiZdaI.exe
  C:\Windows\System\cgiZdaI.exe
  2⤵
  PID:4672
- C:\Windows\System\KcSrqAE.exe
  C:\Windows\System\KcSrqAE.exe
  2⤵
  PID:4692
- C:\Windows\System\iEExPgv.exe
  C:\Windows\System\iEExPgv.exe
  2⤵
  PID:4712
- C:\Windows\System\UEbxMjR.exe
  C:\Windows\System\UEbxMjR.exe
  2⤵
  PID:4732
- C:\Windows\System\kcPAGJn.exe
  C:\Windows\System\kcPAGJn.exe
  2⤵
  PID:4752
- C:\Windows\System\sjuYtIX.exe
  C:\Windows\System\sjuYtIX.exe
  2⤵
  PID:4772
- C:\Windows\System\nBaRAoC.exe
  C:\Windows\System\nBaRAoC.exe
  2⤵
  PID:4792
- C:\Windows\System\DOQtklP.exe
  C:\Windows\System\DOQtklP.exe
  2⤵
  PID:4812
- C:\Windows\System\nPoXWQC.exe
  C:\Windows\System\nPoXWQC.exe
  2⤵
  PID:4832
- C:\Windows\System\jWgSUBs.exe
  C:\Windows\System\jWgSUBs.exe
  2⤵
  PID:4852
- C:\Windows\System\OqFSZFh.exe
  C:\Windows\System\OqFSZFh.exe
  2⤵
  PID:4876
- C:\Windows\System\FyBhQHw.exe
  C:\Windows\System\FyBhQHw.exe
  2⤵
  PID:4896
- C:\Windows\System\ZbHxfCF.exe
  C:\Windows\System\ZbHxfCF.exe
  2⤵
  PID:4916
- C:\Windows\System\SbIpcFW.exe
  C:\Windows\System\SbIpcFW.exe
  2⤵
  PID:4936
- C:\Windows\System\asbUJhC.exe
  C:\Windows\System\asbUJhC.exe
  2⤵
  PID:4956
- C:\Windows\System\FmDZcPf.exe
  C:\Windows\System\FmDZcPf.exe
  2⤵
  PID:4976
- C:\Windows\System\uveVTXf.exe
  C:\Windows\System\uveVTXf.exe
  2⤵
  PID:4992
- C:\Windows\System\VPlgVtT.exe
  C:\Windows\System\VPlgVtT.exe
  2⤵
  PID:5012
- C:\Windows\System\iqxGOgs.exe
  C:\Windows\System\iqxGOgs.exe
  2⤵
  PID:5032
- C:\Windows\System\EcIhdkF.exe
  C:\Windows\System\EcIhdkF.exe
  2⤵
  PID:5056
- C:\Windows\System\toABbzr.exe
  C:\Windows\System\toABbzr.exe
  2⤵
  PID:5076
- C:\Windows\System\JwIlHdo.exe
  C:\Windows\System\JwIlHdo.exe
  2⤵
  PID:5096
- C:\Windows\System\kaMTChx.exe
  C:\Windows\System\kaMTChx.exe
  2⤵
  PID:5116
- C:\Windows\System\WYTADhS.exe
  C:\Windows\System\WYTADhS.exe
  2⤵
  PID:1680
- C:\Windows\System\FAvDrjm.exe
  C:\Windows\System\FAvDrjm.exe
  2⤵
  PID:3108
- C:\Windows\System\HKIlHmg.exe
  C:\Windows\System\HKIlHmg.exe
  2⤵
  PID:3464
- C:\Windows\System\drHsFWu.exe
  C:\Windows\System\drHsFWu.exe
  2⤵
  PID:3500
- C:\Windows\System\bHPCUYQ.exe
  C:\Windows\System\bHPCUYQ.exe
  2⤵
  PID:3608
- C:\Windows\System\jOngZUt.exe
  C:\Windows\System\jOngZUt.exe
  2⤵
  PID:3800
- C:\Windows\System\Piwevpi.exe
  C:\Windows\System\Piwevpi.exe
  2⤵
  PID:3728
- C:\Windows\System\NGBpOtF.exe
  C:\Windows\System\NGBpOtF.exe
  2⤵
  PID:4120
- C:\Windows\System\QifRSfb.exe
  C:\Windows\System\QifRSfb.exe
  2⤵
  PID:4100
- C:\Windows\System\YCVBwOG.exe
  C:\Windows\System\YCVBwOG.exe
  2⤵
  PID:4160
- C:\Windows\System\OSFxzyB.exe
  C:\Windows\System\OSFxzyB.exe
  2⤵
  PID:4168
- C:\Windows\System\vOJekwJ.exe
  C:\Windows\System\vOJekwJ.exe
  2⤵
  PID:4180
- C:\Windows\System\DMNLYBB.exe
  C:\Windows\System\DMNLYBB.exe
  2⤵
  PID:4224
- C:\Windows\System\UacJimG.exe
  C:\Windows\System\UacJimG.exe
  2⤵
  PID:4260
- C:\Windows\System\BspHTPp.exe
  C:\Windows\System\BspHTPp.exe
  2⤵
  PID:4324
- C:\Windows\System\rWPJtKM.exe
  C:\Windows\System\rWPJtKM.exe
  2⤵
  PID:4360
- C:\Windows\System\PoTfDeb.exe
  C:\Windows\System\PoTfDeb.exe
  2⤵
  PID:4348
- C:\Windows\System\JQHRCiq.exe
  C:\Windows\System\JQHRCiq.exe
  2⤵
  PID:4380
- C:\Windows\System\dhilXOH.exe
  C:\Windows\System\dhilXOH.exe
  2⤵
  PID:4448
- C:\Windows\System\vAHgeYM.exe
  C:\Windows\System\vAHgeYM.exe
  2⤵
  PID:4428
- C:\Windows\System\NuFpero.exe
  C:\Windows\System\NuFpero.exe
  2⤵
  PID:4520
- C:\Windows\System\aQsxiXQ.exe
  C:\Windows\System\aQsxiXQ.exe
  2⤵
  PID:4504
- C:\Windows\System\TCWizLM.exe
  C:\Windows\System\TCWizLM.exe
  2⤵
  PID:4540
- C:\Windows\System\FXjeoee.exe
  C:\Windows\System\FXjeoee.exe
  2⤵
  PID:4604
- C:\Windows\System\duHnkWh.exe
  C:\Windows\System\duHnkWh.exe
  2⤵
  PID:4640
- C:\Windows\System\NTfYhYG.exe
  C:\Windows\System\NTfYhYG.exe
  2⤵
  PID:2100
- C:\Windows\System\fxruDCl.exe
  C:\Windows\System\fxruDCl.exe
  2⤵
  PID:4684
- C:\Windows\System\WahqGUz.exe
  C:\Windows\System\WahqGUz.exe
  2⤵
  PID:4720
- C:\Windows\System\bBzDorg.exe
  C:\Windows\System\bBzDorg.exe
  2⤵
  PID:4728
- C:\Windows\System\jKpIBaj.exe
  C:\Windows\System\jKpIBaj.exe
  2⤵
  PID:4764
- C:\Windows\System\PgPVnvZ.exe
  C:\Windows\System\PgPVnvZ.exe
  2⤵
  PID:4784
- C:\Windows\System\bdaZywO.exe
  C:\Windows\System\bdaZywO.exe
  2⤵
  PID:4844
- C:\Windows\System\TLjmYFZ.exe
  C:\Windows\System\TLjmYFZ.exe
  2⤵
  PID:4892
- C:\Windows\System\XerXZFc.exe
  C:\Windows\System\XerXZFc.exe
  2⤵
  PID:4928
- C:\Windows\System\IpjeZKl.exe
  C:\Windows\System\IpjeZKl.exe
  2⤵
  PID:4904
- C:\Windows\System\apCUKQc.exe
  C:\Windows\System\apCUKQc.exe
  2⤵
  PID:4908
- C:\Windows\System\qKhFLrY.exe
  C:\Windows\System\qKhFLrY.exe
  2⤵
  PID:4952
- C:\Windows\System\UYnQmsp.exe
  C:\Windows\System\UYnQmsp.exe
  2⤵
  PID:4988
- C:\Windows\System\lvnyHMf.exe
  C:\Windows\System\lvnyHMf.exe
  2⤵
  PID:5028
- C:\Windows\System\acExiYf.exe
  C:\Windows\System\acExiYf.exe
  2⤵
  PID:2920
- C:\Windows\System\YTAwShf.exe
  C:\Windows\System\YTAwShf.exe
  2⤵
  PID:5104
- C:\Windows\System\qLBaobJ.exe
  C:\Windows\System\qLBaobJ.exe
  2⤵
  PID:1048
- C:\Windows\System\FDmhatQ.exe
  C:\Windows\System\FDmhatQ.exe
  2⤵
  PID:3188
- C:\Windows\System\DcKrQil.exe
  C:\Windows\System\DcKrQil.exe
  2⤵
  PID:3540
- C:\Windows\System\GLWaNxQ.exe
  C:\Windows\System\GLWaNxQ.exe
  2⤵
  PID:2688
- C:\Windows\System\SqTFmSI.exe
  C:\Windows\System\SqTFmSI.exe
  2⤵
  PID:4072
- C:\Windows\System\EPkOpMA.exe
  C:\Windows\System\EPkOpMA.exe
  2⤵
  PID:4140
- C:\Windows\System\ytCFCfu.exe
  C:\Windows\System\ytCFCfu.exe
  2⤵
  PID:4244
- C:\Windows\System\TPGYmKO.exe
  C:\Windows\System\TPGYmKO.exe
  2⤵
  PID:1736
- C:\Windows\System\IiqTXUy.exe
  C:\Windows\System\IiqTXUy.exe
  2⤵
  PID:4248
- C:\Windows\System\voowUAq.exe
  C:\Windows\System\voowUAq.exe
  2⤵
  PID:904
- C:\Windows\System\NDePQiU.exe
  C:\Windows\System\NDePQiU.exe
  2⤵
  PID:4364
- C:\Windows\System\epaeeoW.exe
  C:\Windows\System\epaeeoW.exe
  2⤵
  PID:4308
- C:\Windows\System\stubPyz.exe
  C:\Windows\System\stubPyz.exe
  2⤵
  PID:4440
- C:\Windows\System\JngjsZP.exe
  C:\Windows\System\JngjsZP.exe
  2⤵
  PID:4564
- C:\Windows\System\RIjNzIH.exe
  C:\Windows\System\RIjNzIH.exe
  2⤵
  PID:4636
- C:\Windows\System\CoIsNhw.exe
  C:\Windows\System\CoIsNhw.exe
  2⤵
  PID:4524
- C:\Windows\System\QLoKAkN.exe
  C:\Windows\System\QLoKAkN.exe
  2⤵
  PID:4704
- C:\Windows\System\AddrNvv.exe
  C:\Windows\System\AddrNvv.exe
  2⤵
  PID:2424
- C:\Windows\System\kzjzoVr.exe
  C:\Windows\System\kzjzoVr.exe
  2⤵
  PID:4668
- C:\Windows\System\kXwAbRE.exe
  C:\Windows\System\kXwAbRE.exe
  2⤵
  PID:4744
- C:\Windows\System\VmdIJyo.exe
  C:\Windows\System\VmdIJyo.exe
  2⤵
  PID:1980
- C:\Windows\System\JVCLoQu.exe
  C:\Windows\System\JVCLoQu.exe
  2⤵
  PID:1544
- C:\Windows\System\osARgOh.exe
  C:\Windows\System\osARgOh.exe
  2⤵
  PID:4864
- C:\Windows\System\OHwpjJC.exe
  C:\Windows\System\OHwpjJC.exe
  2⤵
  PID:1916
- C:\Windows\System\dfhulBR.exe
  C:\Windows\System\dfhulBR.exe
  2⤵
  PID:2800
- C:\Windows\System\GmXHzhd.exe
  C:\Windows\System\GmXHzhd.exe
  2⤵
  PID:4840
- C:\Windows\System\WWGuODj.exe
  C:\Windows\System\WWGuODj.exe
  2⤵
  PID:4848
- C:\Windows\System\NnCHNBk.exe
  C:\Windows\System\NnCHNBk.exe
  2⤵
  PID:4968
- C:\Windows\System\FjuzilM.exe
  C:\Windows\System\FjuzilM.exe
  2⤵
  PID:4932
- C:\Windows\System\KvbnjcD.exe
  C:\Windows\System\KvbnjcD.exe
  2⤵
  PID:4944
- C:\Windows\System\JmFZKys.exe
  C:\Windows\System\JmFZKys.exe
  2⤵
  PID:5068
- C:\Windows\System\MLqFFVt.exe
  C:\Windows\System\MLqFFVt.exe
  2⤵
  PID:3428
- C:\Windows\System\NCmIjAS.exe
  C:\Windows\System\NCmIjAS.exe
  2⤵
  PID:3380
- C:\Windows\System\gFXLKzL.exe
  C:\Windows\System\gFXLKzL.exe
  2⤵
  PID:3868
- C:\Windows\System\IvmJZHW.exe
  C:\Windows\System\IvmJZHW.exe
  2⤵
  PID:4108
- C:\Windows\System\mFAZaKT.exe
  C:\Windows\System\mFAZaKT.exe
  2⤵
  PID:4204
- C:\Windows\System\fGrAclz.exe
  C:\Windows\System\fGrAclz.exe
  2⤵
  PID:4328
- C:\Windows\System\RMViklF.exe
  C:\Windows\System\RMViklF.exe
  2⤵
  PID:4464
- C:\Windows\System\lJUmjaP.exe
  C:\Windows\System\lJUmjaP.exe
  2⤵
  PID:4424
- C:\Windows\System\aKTLCNt.exe
  C:\Windows\System\aKTLCNt.exe
  2⤵
  PID:4548
- C:\Windows\System\jVWtqOa.exe
  C:\Windows\System\jVWtqOa.exe
  2⤵
  PID:2580
- C:\Windows\System\Bpqgmje.exe
  C:\Windows\System\Bpqgmje.exe
  2⤵
  PID:2412
- C:\Windows\System\LLUZHgw.exe
  C:\Windows\System\LLUZHgw.exe
  2⤵
  PID:2440
- C:\Windows\System\YsXOQUp.exe
  C:\Windows\System\YsXOQUp.exe
  2⤵
  PID:4964
- C:\Windows\System\nGJnKEI.exe
  C:\Windows\System\nGJnKEI.exe
  2⤵
  PID:2712
- C:\Windows\System\kmJvWTO.exe
  C:\Windows\System\kmJvWTO.exe
  2⤵
  PID:3904
- C:\Windows\System\JICqrUR.exe
  C:\Windows\System\JICqrUR.exe
  2⤵
  PID:480
- C:\Windows\System\RXtxIrr.exe
  C:\Windows\System\RXtxIrr.exe
  2⤵
  PID:4828
- C:\Windows\System\wokGymX.exe
  C:\Windows\System\wokGymX.exe
  2⤵
  PID:3348
- C:\Windows\System\NPFVsBw.exe
  C:\Windows\System\NPFVsBw.exe
  2⤵
  PID:2324
- C:\Windows\System\NvatJvN.exe
  C:\Windows\System\NvatJvN.exe
  2⤵
  PID:5048
- C:\Windows\System\gmrHNGw.exe
  C:\Windows\System\gmrHNGw.exe
  2⤵
  PID:5044
- C:\Windows\System\bRohZLV.exe
  C:\Windows\System\bRohZLV.exe
  2⤵
  PID:4748
- C:\Windows\System\QeXTRBL.exe
  C:\Windows\System\QeXTRBL.exe
  2⤵
  PID:4012
- C:\Windows\System\hrTiZyh.exe
  C:\Windows\System\hrTiZyh.exe
  2⤵
  PID:4516
- C:\Windows\System\vevxUvI.exe
  C:\Windows\System\vevxUvI.exe
  2⤵
  PID:4404
- C:\Windows\System\GvFdRzd.exe
  C:\Windows\System\GvFdRzd.exe
  2⤵
  PID:4500
- C:\Windows\System\jqdWzDj.exe
  C:\Windows\System\jqdWzDj.exe
  2⤵
  PID:2060
- C:\Windows\System\QKIlCZG.exe
  C:\Windows\System\QKIlCZG.exe
  2⤵
  PID:4588
- C:\Windows\System\gKhFbgr.exe
  C:\Windows\System\gKhFbgr.exe
  2⤵
  PID:816
- C:\Windows\System\OIgPbWW.exe
  C:\Windows\System\OIgPbWW.exe
  2⤵
  PID:1600
- C:\Windows\System\qbFRWux.exe
  C:\Windows\System\qbFRWux.exe
  2⤵
  PID:4912
- C:\Windows\System\flMrQMr.exe
  C:\Windows\System\flMrQMr.exe
  2⤵
  PID:4868
- C:\Windows\System\SjbDoLe.exe
  C:\Windows\System\SjbDoLe.exe
  2⤵
  PID:1004
- C:\Windows\System\njMGMWV.exe
  C:\Windows\System\njMGMWV.exe
  2⤵
  PID:5004
- C:\Windows\System\BahjFjU.exe
  C:\Windows\System\BahjFjU.exe
  2⤵
  PID:4608
- C:\Windows\System\AaFznvy.exe
  C:\Windows\System\AaFznvy.exe
  2⤵
  PID:5092
- C:\Windows\System\XFBGtwf.exe
  C:\Windows\System\XFBGtwf.exe
  2⤵
  PID:5108
- C:\Windows\System\qzpKlgV.exe
  C:\Windows\System\qzpKlgV.exe
  2⤵
  PID:2696
- C:\Windows\System\ccTOOPo.exe
  C:\Windows\System\ccTOOPo.exe
  2⤵
  PID:4304
- C:\Windows\System\HfBiPYz.exe
  C:\Windows\System\HfBiPYz.exe
  2⤵
  PID:4408
- C:\Windows\System\WhsIGaz.exe
  C:\Windows\System\WhsIGaz.exe
  2⤵
  PID:4680
- C:\Windows\System\MmeWGbM.exe
  C:\Windows\System\MmeWGbM.exe
  2⤵
  PID:3604
- C:\Windows\System\UocaYzh.exe
  C:\Windows\System\UocaYzh.exe
  2⤵
  PID:3644
- C:\Windows\System\PwnyAOC.exe
  C:\Windows\System\PwnyAOC.exe
  2⤵
  PID:3844
- C:\Windows\System\PXRAzPg.exe
  C:\Windows\System\PXRAzPg.exe
  2⤵
  PID:1480
- C:\Windows\System\racNLsq.exe
  C:\Windows\System\racNLsq.exe
  2⤵
  PID:5136
- C:\Windows\System\oNjrFVm.exe
  C:\Windows\System\oNjrFVm.exe
  2⤵
  PID:5152
- C:\Windows\System\VXRHwUK.exe
  C:\Windows\System\VXRHwUK.exe
  2⤵
  PID:5176
- C:\Windows\System\MUetrCX.exe
  C:\Windows\System\MUetrCX.exe
  2⤵
  PID:5200
- C:\Windows\System\XkHtJLp.exe
  C:\Windows\System\XkHtJLp.exe
  2⤵
  PID:5224
- C:\Windows\System\tigOGyM.exe
  C:\Windows\System\tigOGyM.exe
  2⤵
  PID:5244
- C:\Windows\System\qGSrtaE.exe
  C:\Windows\System\qGSrtaE.exe
  2⤵
  PID:5260
- C:\Windows\System\OJjKpeR.exe
  C:\Windows\System\OJjKpeR.exe
  2⤵
  PID:5276
- C:\Windows\System\izsnWib.exe
  C:\Windows\System\izsnWib.exe
  2⤵
  PID:5296
- C:\Windows\System\CzUqnrH.exe
  C:\Windows\System\CzUqnrH.exe
  2⤵
  PID:5312
- C:\Windows\System\FVaiTUi.exe
  C:\Windows\System\FVaiTUi.exe
  2⤵
  PID:5332
- C:\Windows\System\yPvKIxk.exe
  C:\Windows\System\yPvKIxk.exe
  2⤵
  PID:5352
- C:\Windows\System\NnzHRPz.exe
  C:\Windows\System\NnzHRPz.exe
  2⤵
  PID:5368
- C:\Windows\System\mUdFjkn.exe
  C:\Windows\System\mUdFjkn.exe
  2⤵
  PID:5384
- C:\Windows\System\WOxyhoX.exe
  C:\Windows\System\WOxyhoX.exe
  2⤵
  PID:5400
- C:\Windows\System\OCvvGvd.exe
  C:\Windows\System\OCvvGvd.exe
  2⤵
  PID:5416
- C:\Windows\System\VrIGTMf.exe
  C:\Windows\System\VrIGTMf.exe
  2⤵
  PID:5440
- C:\Windows\System\ZJmJBmK.exe
  C:\Windows\System\ZJmJBmK.exe
  2⤵
  PID:5464
- C:\Windows\System\HMUoFQz.exe
  C:\Windows\System\HMUoFQz.exe
  2⤵
  PID:5480
- C:\Windows\System\fxVymqq.exe
  C:\Windows\System\fxVymqq.exe
  2⤵
  PID:5500
- C:\Windows\System\PubMUVN.exe
  C:\Windows\System\PubMUVN.exe
  2⤵
  PID:5516
- C:\Windows\System\naEppZu.exe
  C:\Windows\System\naEppZu.exe
  2⤵
  PID:5564
- C:\Windows\System\tBPWZti.exe
  C:\Windows\System\tBPWZti.exe
  2⤵
  PID:5584
- C:\Windows\System\YNtMEMf.exe
  C:\Windows\System\YNtMEMf.exe
  2⤵
  PID:5608
- C:\Windows\System\gxtXBmB.exe
  C:\Windows\System\gxtXBmB.exe
  2⤵
  PID:5624
- C:\Windows\System\Aeevqix.exe
  C:\Windows\System\Aeevqix.exe
  2⤵
  PID:5640
- C:\Windows\System\MDAiwHO.exe
  C:\Windows\System\MDAiwHO.exe
  2⤵
  PID:5656
- C:\Windows\System\VBgcPjx.exe
  C:\Windows\System\VBgcPjx.exe
  2⤵
  PID:5672
- C:\Windows\System\VHCyoMm.exe
  C:\Windows\System\VHCyoMm.exe
  2⤵
  PID:5688
- C:\Windows\System\rrZIDhh.exe
  C:\Windows\System\rrZIDhh.exe
  2⤵
  PID:5704
- C:\Windows\System\QLODqgj.exe
  C:\Windows\System\QLODqgj.exe
  2⤵
  PID:5728
- C:\Windows\System\kusbpTV.exe
  C:\Windows\System\kusbpTV.exe
  2⤵
  PID:5744
- C:\Windows\System\hfYONSy.exe
  C:\Windows\System\hfYONSy.exe
  2⤵
  PID:5760
- C:\Windows\System\xiOCmKn.exe
  C:\Windows\System\xiOCmKn.exe
  2⤵
  PID:5776
- C:\Windows\System\WIcerST.exe
  C:\Windows\System\WIcerST.exe
  2⤵
  PID:5792
- C:\Windows\System\wCgptkI.exe
  C:\Windows\System\wCgptkI.exe
  2⤵
  PID:5808
- C:\Windows\System\exmipjT.exe
  C:\Windows\System\exmipjT.exe
  2⤵
  PID:5824
- C:\Windows\System\sPlYAMv.exe
  C:\Windows\System\sPlYAMv.exe
  2⤵
  PID:5848
- C:\Windows\System\WfrtaVh.exe
  C:\Windows\System\WfrtaVh.exe
  2⤵
  PID:5868
- C:\Windows\System\apVsEeE.exe
  C:\Windows\System\apVsEeE.exe
  2⤵
  PID:5888
- C:\Windows\System\dQHSISM.exe
  C:\Windows\System\dQHSISM.exe
  2⤵
  PID:5904
- C:\Windows\System\gZYwRdn.exe
  C:\Windows\System\gZYwRdn.exe
  2⤵
  PID:5968
- C:\Windows\System\BkKonkI.exe
  C:\Windows\System\BkKonkI.exe
  2⤵
  PID:5984
- C:\Windows\System\nSwaGEp.exe
  C:\Windows\System\nSwaGEp.exe
  2⤵
  PID:6004
- C:\Windows\System\kqEVMsc.exe
  C:\Windows\System\kqEVMsc.exe
  2⤵
  PID:6024
- C:\Windows\System\QbuKNdK.exe
  C:\Windows\System\QbuKNdK.exe
  2⤵
  PID:6048
- C:\Windows\System\uwbIDiy.exe
  C:\Windows\System\uwbIDiy.exe
  2⤵
  PID:6064
- C:\Windows\System\zIvtouy.exe
  C:\Windows\System\zIvtouy.exe
  2⤵
  PID:6080
- C:\Windows\System\AUviLFD.exe
  C:\Windows\System\AUviLFD.exe
  2⤵
  PID:6096
- C:\Windows\System\DvxTbcO.exe
  C:\Windows\System\DvxTbcO.exe
  2⤵
  PID:6120
- C:\Windows\System\adCFNMa.exe
  C:\Windows\System\adCFNMa.exe
  2⤵
  PID:2516
- C:\Windows\System\fbiTwMV.exe
  C:\Windows\System\fbiTwMV.exe
  2⤵
  PID:4924
- C:\Windows\System\oorPCxH.exe
  C:\Windows\System\oorPCxH.exe
  2⤵
  PID:5184
- C:\Windows\System\zjzpkBK.exe
  C:\Windows\System\zjzpkBK.exe
  2⤵
  PID:4700
- C:\Windows\System\REAZbWV.exe
  C:\Windows\System\REAZbWV.exe
  2⤵
  PID:5168
- C:\Windows\System\ZHWjsRf.exe
  C:\Windows\System\ZHWjsRf.exe
  2⤵
  PID:5216
- C:\Windows\System\bEbbdfi.exe
  C:\Windows\System\bEbbdfi.exe
  2⤵
  PID:5240
- C:\Windows\System\fWGYxZf.exe
  C:\Windows\System\fWGYxZf.exe
  2⤵
  PID:5304
- C:\Windows\System\ZFeWkuU.exe
  C:\Windows\System\ZFeWkuU.exe
  2⤵
  PID:5344
- C:\Windows\System\QtDbXVL.exe
  C:\Windows\System\QtDbXVL.exe
  2⤵
  PID:652
- C:\Windows\System\wDGODBF.exe
  C:\Windows\System\wDGODBF.exe
  2⤵
  PID:5256
- C:\Windows\System\iAloMwF.exe
  C:\Windows\System\iAloMwF.exe
  2⤵
  PID:5288
- C:\Windows\System\tfqoqCW.exe
  C:\Windows\System\tfqoqCW.exe
  2⤵
  PID:5320
- C:\Windows\System\bQXttmg.exe
  C:\Windows\System\bQXttmg.exe
  2⤵
  PID:5392
- C:\Windows\System\JjxoaCy.exe
  C:\Windows\System\JjxoaCy.exe
  2⤵
  PID:5432
- C:\Windows\System\HQUZEDl.exe
  C:\Windows\System\HQUZEDl.exe
  2⤵
  PID:5496
- C:\Windows\System\TFOVCdt.exe
  C:\Windows\System\TFOVCdt.exe
  2⤵
  PID:5544
- C:\Windows\System\BRdQXxN.exe
  C:\Windows\System\BRdQXxN.exe
  2⤵
  PID:5528
- C:\Windows\System\pyfuNWM.exe
  C:\Windows\System\pyfuNWM.exe
  2⤵
  PID:5592
- C:\Windows\System\DSRphyl.exe
  C:\Windows\System\DSRphyl.exe
  2⤵
  PID:5604
- C:\Windows\System\USmVKZU.exe
  C:\Windows\System\USmVKZU.exe
  2⤵
  PID:5668
- C:\Windows\System\puFZTRW.exe
  C:\Windows\System\puFZTRW.exe
  2⤵
  PID:2728
- C:\Windows\System\pDKmzzO.exe
  C:\Windows\System\pDKmzzO.exe
  2⤵
  PID:5772
- C:\Windows\System\iGXoYRL.exe
  C:\Windows\System\iGXoYRL.exe
  2⤵
  PID:5840
- C:\Windows\System\HyfYoPf.exe
  C:\Windows\System\HyfYoPf.exe
  2⤵
  PID:5884
- C:\Windows\System\WECELks.exe
  C:\Windows\System\WECELks.exe
  2⤵
  PID:5936
- C:\Windows\System\ZUDOCTj.exe
  C:\Windows\System\ZUDOCTj.exe
  2⤵
  PID:2668
- C:\Windows\System\wqRnuxG.exe
  C:\Windows\System\wqRnuxG.exe
  2⤵
  PID:5864
- C:\Windows\System\yXosBtF.exe
  C:\Windows\System\yXosBtF.exe
  2⤵
  PID:5720
- C:\Windows\System\vQqTyxK.exe
  C:\Windows\System\vQqTyxK.exe
  2⤵
  PID:5944
- C:\Windows\System\bXYmbrz.exe
  C:\Windows\System\bXYmbrz.exe
  2⤵
  PID:5960
- C:\Windows\System\sVRGwXs.exe
  C:\Windows\System\sVRGwXs.exe
  2⤵
  PID:5992
- C:\Windows\System\jmBwQIY.exe
  C:\Windows\System\jmBwQIY.exe
  2⤵
  PID:6012
- C:\Windows\System\mdhyUHG.exe
  C:\Windows\System\mdhyUHG.exe
  2⤵
  PID:6072
- C:\Windows\System\AnhfbKi.exe
  C:\Windows\System\AnhfbKi.exe
  2⤵
  PID:6116
- C:\Windows\System\EvTvAQe.exe
  C:\Windows\System\EvTvAQe.exe
  2⤵
  PID:6128
- C:\Windows\System\tcBmSaZ.exe
  C:\Windows\System\tcBmSaZ.exe
  2⤵
  PID:5148
- C:\Windows\System\qUCXqvz.exe
  C:\Windows\System\qUCXqvz.exe
  2⤵
  PID:5196
- C:\Windows\System\aDemODH.exe
  C:\Windows\System\aDemODH.exe
  2⤵
  PID:5380
- C:\Windows\System\PFvCyNf.exe
  C:\Windows\System\PFvCyNf.exe
  2⤵
  PID:1892
- C:\Windows\System\BlfPEJx.exe
  C:\Windows\System\BlfPEJx.exe
  2⤵
  PID:5488
- C:\Windows\System\kthExDp.exe
  C:\Windows\System\kthExDp.exe
  2⤵
  PID:4488
- C:\Windows\System\rvuKgFI.exe
  C:\Windows\System\rvuKgFI.exe
  2⤵
  PID:5376
- C:\Windows\System\iACgJcl.exe
  C:\Windows\System\iACgJcl.exe
  2⤵
  PID:892
- C:\Windows\System\TkNIrvV.exe
  C:\Windows\System\TkNIrvV.exe
  2⤵
  PID:5560
- C:\Windows\System\XDHZiPX.exe
  C:\Windows\System\XDHZiPX.exe
  2⤵
  PID:2244
- C:\Windows\System\FbiQpEc.exe
  C:\Windows\System\FbiQpEc.exe
  2⤵
  PID:5532
- C:\Windows\System\ugeskMT.exe
  C:\Windows\System\ugeskMT.exe
  2⤵
  PID:5572
- C:\Windows\System\pwQlxaD.exe
  C:\Windows\System\pwQlxaD.exe
  2⤵
  PID:5620
- C:\Windows\System\KdzXfbH.exe
  C:\Windows\System\KdzXfbH.exe
  2⤵
  PID:5680
- C:\Windows\System\UEUYxbN.exe
  C:\Windows\System\UEUYxbN.exe
  2⤵
  PID:5924
- C:\Windows\System\unwLLlX.exe
  C:\Windows\System\unwLLlX.exe
  2⤵
  PID:5636
- C:\Windows\System\wvxwdah.exe
  C:\Windows\System\wvxwdah.exe
  2⤵
  PID:5880
- C:\Windows\System\jkOVkfR.exe
  C:\Windows\System\jkOVkfR.exe
  2⤵
  PID:5752
- C:\Windows\System\VGITHKX.exe
  C:\Windows\System\VGITHKX.exe
  2⤵
  PID:6108
- C:\Windows\System\cdqLmhy.exe
  C:\Windows\System\cdqLmhy.exe
  2⤵
  PID:5020
- C:\Windows\System\LMZmYUI.exe
  C:\Windows\System\LMZmYUI.exe
  2⤵
  PID:6020
- C:\Windows\System\GHNqSlZ.exe
  C:\Windows\System\GHNqSlZ.exe
  2⤵
  PID:6140
- C:\Windows\System\RRDrwQG.exe
  C:\Windows\System\RRDrwQG.exe
  2⤵
  PID:5188
- C:\Windows\System\HCKyCBZ.exe
  C:\Windows\System\HCKyCBZ.exe
  2⤵
  PID:5328
- C:\Windows\System\UMPlyBy.exe
  C:\Windows\System\UMPlyBy.exe
  2⤵
  PID:5268
- C:\Windows\System\bFIKMFt.exe
  C:\Windows\System\bFIKMFt.exe
  2⤵
  PID:5232
- C:\Windows\System\FjIaLlC.exe
  C:\Windows\System\FjIaLlC.exe
  2⤵
  PID:5252
- C:\Windows\System\gJYiFsV.exe
  C:\Windows\System\gJYiFsV.exe
  2⤵
  PID:5508
- C:\Windows\System\uUbDKuT.exe
  C:\Windows\System\uUbDKuT.exe
  2⤵
  PID:5804
- C:\Windows\System\DhKmlMV.exe
  C:\Windows\System\DhKmlMV.exe
  2⤵
  PID:5580
- C:\Windows\System\luAPSDM.exe
  C:\Windows\System\luAPSDM.exe
  2⤵
  PID:5856
- C:\Windows\System\fTnLqZM.exe
  C:\Windows\System\fTnLqZM.exe
  2⤵
  PID:5900
- C:\Windows\System\WnJBxBP.exe
  C:\Windows\System\WnJBxBP.exe
  2⤵
  PID:5912
- C:\Windows\System\QohPEvj.exe
  C:\Windows\System\QohPEvj.exe
  2⤵
  PID:6136
- C:\Windows\System\uDGgXfp.exe
  C:\Windows\System\uDGgXfp.exe
  2⤵
  PID:5412
- C:\Windows\System\tWhhyiw.exe
  C:\Windows\System\tWhhyiw.exe
  2⤵
  PID:6016
- C:\Windows\System\leqPZZW.exe
  C:\Windows\System\leqPZZW.exe
  2⤵
  PID:5128
- C:\Windows\System\bpnwnwK.exe
  C:\Windows\System\bpnwnwK.exe
  2⤵
  PID:5448
- C:\Windows\System\jguRmSA.exe
  C:\Windows\System\jguRmSA.exe
  2⤵
  PID:1920
- C:\Windows\System\WvGaPFJ.exe
  C:\Windows\System\WvGaPFJ.exe
  2⤵
  PID:6148
- C:\Windows\System\WfIQxYl.exe
  C:\Windows\System\WfIQxYl.exe
  2⤵
  PID:6164
- C:\Windows\System\otYaWnj.exe
  C:\Windows\System\otYaWnj.exe
  2⤵
  PID:6180
- C:\Windows\System\rXoGNZG.exe
  C:\Windows\System\rXoGNZG.exe
  2⤵
  PID:6200
- C:\Windows\System\SUhSFcW.exe
  C:\Windows\System\SUhSFcW.exe
  2⤵
  PID:6216
- C:\Windows\System\niyzCsl.exe
  C:\Windows\System\niyzCsl.exe
  2⤵
  PID:6232
- C:\Windows\System\NHxChAK.exe
  C:\Windows\System\NHxChAK.exe
  2⤵
  PID:6248
- C:\Windows\System\DeQVRHK.exe
  C:\Windows\System\DeQVRHK.exe
  2⤵
  PID:6276
- C:\Windows\System\HltdtnP.exe
  C:\Windows\System\HltdtnP.exe
  2⤵
  PID:6292
- C:\Windows\System\BGicJkL.exe
  C:\Windows\System\BGicJkL.exe
  2⤵
  PID:6316
- C:\Windows\System\CzdcApb.exe
  C:\Windows\System\CzdcApb.exe
  2⤵
  PID:6332
- C:\Windows\System\BHmtgOx.exe
  C:\Windows\System\BHmtgOx.exe
  2⤵
  PID:6348
- C:\Windows\System\ejLcqTp.exe
  C:\Windows\System\ejLcqTp.exe
  2⤵
  PID:6364
- C:\Windows\System\kRTRmPJ.exe
  C:\Windows\System\kRTRmPJ.exe
  2⤵
  PID:6380
- C:\Windows\System\FBiQjSP.exe
  C:\Windows\System\FBiQjSP.exe
  2⤵
  PID:6472
- C:\Windows\System\VCubdHi.exe
  C:\Windows\System\VCubdHi.exe
  2⤵
  PID:6488
- C:\Windows\System\MrBNKzJ.exe
  C:\Windows\System\MrBNKzJ.exe
  2⤵
  PID:6508
- C:\Windows\System\xZYMqol.exe
  C:\Windows\System\xZYMqol.exe
  2⤵
  PID:6524
- C:\Windows\System\DlFImNo.exe
  C:\Windows\System\DlFImNo.exe
  2⤵
  PID:6540
- C:\Windows\System\GVXNHgT.exe
  C:\Windows\System\GVXNHgT.exe
  2⤵
  PID:6568
- C:\Windows\System\SRutNfF.exe
  C:\Windows\System\SRutNfF.exe
  2⤵
  PID:6588
- C:\Windows\System\oTesfIN.exe
  C:\Windows\System\oTesfIN.exe
  2⤵
  PID:6608
- C:\Windows\System\oBiggzg.exe
  C:\Windows\System\oBiggzg.exe
  2⤵
  PID:6624
- C:\Windows\System\IOsTbFr.exe
  C:\Windows\System\IOsTbFr.exe
  2⤵
  PID:6640
- C:\Windows\System\zTVVala.exe
  C:\Windows\System\zTVVala.exe
  2⤵
  PID:6656
- C:\Windows\System\ysjbRje.exe
  C:\Windows\System\ysjbRje.exe
  2⤵
  PID:6672
- C:\Windows\System\bKYNfHs.exe
  C:\Windows\System\bKYNfHs.exe
  2⤵
  PID:6688
- C:\Windows\System\GoduneV.exe
  C:\Windows\System\GoduneV.exe
  2⤵
  PID:6704
- C:\Windows\System\KlZIwMc.exe
  C:\Windows\System\KlZIwMc.exe
  2⤵
  PID:6724
- C:\Windows\System\IZAvBpK.exe
  C:\Windows\System\IZAvBpK.exe
  2⤵
  PID:6740
- C:\Windows\System\mqLqJHO.exe
  C:\Windows\System\mqLqJHO.exe
  2⤵
  PID:6756
- C:\Windows\System\szjXded.exe
  C:\Windows\System\szjXded.exe
  2⤵
  PID:6780
- C:\Windows\System\jBGsekV.exe
  C:\Windows\System\jBGsekV.exe
  2⤵
  PID:6812
- C:\Windows\System\LbEfphi.exe
  C:\Windows\System\LbEfphi.exe
  2⤵
  PID:6828
- C:\Windows\System\nKdinVh.exe
  C:\Windows\System\nKdinVh.exe
  2⤵
  PID:6844
- C:\Windows\System\riLDzsW.exe
  C:\Windows\System\riLDzsW.exe
  2⤵
  PID:6860
- C:\Windows\System\SuoLHpd.exe
  C:\Windows\System\SuoLHpd.exe
  2⤵
  PID:6908
- C:\Windows\System\yqrlMPT.exe
  C:\Windows\System\yqrlMPT.exe
  2⤵
  PID:6928
- C:\Windows\System\VmSwASF.exe
  C:\Windows\System\VmSwASF.exe
  2⤵
  PID:6944
- C:\Windows\System\NQzIfOG.exe
  C:\Windows\System\NQzIfOG.exe
  2⤵
  PID:6960
- C:\Windows\System\xSRiqyP.exe
  C:\Windows\System\xSRiqyP.exe
  2⤵
  PID:6976
- C:\Windows\System\togtJiX.exe
  C:\Windows\System\togtJiX.exe
  2⤵
  PID:6992
- C:\Windows\System\RCqpbWD.exe
  C:\Windows\System\RCqpbWD.exe
  2⤵
  PID:7008
- C:\Windows\System\mzIFWvf.exe
  C:\Windows\System\mzIFWvf.exe
  2⤵
  PID:7024
- C:\Windows\System\fmskVvz.exe
  C:\Windows\System\fmskVvz.exe
  2⤵
  PID:7040
- C:\Windows\System\KfCHqYs.exe
  C:\Windows\System\KfCHqYs.exe
  2⤵
  PID:7068
- C:\Windows\System\JSDffJT.exe
  C:\Windows\System\JSDffJT.exe
  2⤵
  PID:7084
- C:\Windows\System\TarEmIi.exe
  C:\Windows\System\TarEmIi.exe
  2⤵
  PID:7108
- C:\Windows\System\HQVyHRA.exe
  C:\Windows\System\HQVyHRA.exe
  2⤵
  PID:7128
- C:\Windows\System\RZngaAU.exe
  C:\Windows\System\RZngaAU.exe
  2⤵
  PID:7144
- C:\Windows\System\qmweYVt.exe
  C:\Windows\System\qmweYVt.exe
  2⤵
  PID:7160
- C:\Windows\System\XpFtrjs.exe
  C:\Windows\System\XpFtrjs.exe
  2⤵
  PID:5788
- C:\Windows\System\YMNolsj.exe
  C:\Windows\System\YMNolsj.exe
  2⤵
  PID:5816
- C:\Windows\System\EKKdipI.exe
  C:\Windows\System\EKKdipI.exe
  2⤵
  PID:1676
- C:\Windows\System\oQrLfDp.exe
  C:\Windows\System\oQrLfDp.exe
  2⤵
  PID:6324
- C:\Windows\System\ydpNvcH.exe
  C:\Windows\System\ydpNvcH.exe
  2⤵
  PID:6088
- C:\Windows\System\grqiISW.exe
  C:\Windows\System\grqiISW.exe
  2⤵
  PID:5980
- C:\Windows\System\mMVbBfI.exe
  C:\Windows\System\mMVbBfI.exe
  2⤵
  PID:6156
- C:\Windows\System\GHbQGxE.exe
  C:\Windows\System\GHbQGxE.exe
  2⤵
  PID:6224
- C:\Windows\System\LuVaucg.exe
  C:\Windows\System\LuVaucg.exe
  2⤵
  PID:6268
- C:\Windows\System\MCOzsbk.exe
  C:\Windows\System\MCOzsbk.exe
  2⤵
  PID:6308
- C:\Windows\System\GeYsBZE.exe
  C:\Windows\System\GeYsBZE.exe
  2⤵
  PID:6372
- C:\Windows\System\pvPHHdT.exe
  C:\Windows\System\pvPHHdT.exe
  2⤵
  PID:5756
- C:\Windows\System\OgIueeC.exe
  C:\Windows\System\OgIueeC.exe
  2⤵
  PID:6428
- C:\Windows\System\IVBwWAG.exe
  C:\Windows\System\IVBwWAG.exe
  2⤵
  PID:6392
- C:\Windows\System\EwwiWiT.exe
  C:\Windows\System\EwwiWiT.exe
  2⤵
  PID:6464
- C:\Windows\System\rwjcqto.exe
  C:\Windows\System\rwjcqto.exe
  2⤵
  PID:6480
- C:\Windows\System\cielQKj.exe
  C:\Windows\System\cielQKj.exe
  2⤵
  PID:6536
- C:\Windows\System\IybQHRF.exe
  C:\Windows\System\IybQHRF.exe
  2⤵
  PID:6564
- C:\Windows\System\VKoFnfJ.exe
  C:\Windows\System\VKoFnfJ.exe
  2⤵
  PID:6580
- C:\Windows\System\JahlMPR.exe
  C:\Windows\System\JahlMPR.exe
  2⤵
  PID:6620
- C:\Windows\System\oKBiQUa.exe
  C:\Windows\System\oKBiQUa.exe
  2⤵
  PID:6680
- C:\Windows\System\NMgUUiG.exe
  C:\Windows\System\NMgUUiG.exe
  2⤵
  PID:6748
- C:\Windows\System\mQjWOWE.exe
  C:\Windows\System\mQjWOWE.exe
  2⤵
  PID:6764
- C:\Windows\System\BaQSleq.exe
  C:\Windows\System\BaQSleq.exe
  2⤵
  PID:6820
- C:\Windows\System\TZpJcJR.exe
  C:\Windows\System\TZpJcJR.exe
  2⤵
  PID:6856
- C:\Windows\System\ZhsaFrh.exe
  C:\Windows\System\ZhsaFrh.exe
  2⤵
  PID:6876
- C:\Windows\System\psFDDUg.exe
  C:\Windows\System\psFDDUg.exe
  2⤵
  PID:6892
- C:\Windows\System\owSfxgd.exe
  C:\Windows\System\owSfxgd.exe
  2⤵
  PID:6700
- C:\Windows\System\ItPGyeo.exe
  C:\Windows\System\ItPGyeo.exe
  2⤵
  PID:6924
- C:\Windows\System\ZmaXsTR.exe
  C:\Windows\System\ZmaXsTR.exe
  2⤵
  PID:6988
- C:\Windows\System\kYZWaaB.exe
  C:\Windows\System\kYZWaaB.exe
  2⤵
  PID:6972
- C:\Windows\System\oBKlFeO.exe
  C:\Windows\System\oBKlFeO.exe
  2⤵
  PID:7048
- C:\Windows\System\TbVlrOw.exe
  C:\Windows\System\TbVlrOw.exe
  2⤵
  PID:7096
- C:\Windows\System\YvuKEzw.exe
  C:\Windows\System\YvuKEzw.exe
  2⤵
  PID:7140
- C:\Windows\System\nDMglWm.exe
  C:\Windows\System\nDMglWm.exe
  2⤵
  PID:5996
- C:\Windows\System\WijkGmp.exe
  C:\Windows\System\WijkGmp.exe
  2⤵
  PID:7076
- C:\Windows\System\FCjaBYV.exe
  C:\Windows\System\FCjaBYV.exe
  2⤵
  PID:7120
- C:\Windows\System\feRMgKH.exe
  C:\Windows\System\feRMgKH.exe
  2⤵
  PID:5360
- C:\Windows\System\VtKCVGa.exe
  C:\Windows\System\VtKCVGa.exe
  2⤵
  PID:6244
- C:\Windows\System\tPCYPpJ.exe
  C:\Windows\System\tPCYPpJ.exe
  2⤵
  PID:6388
- C:\Windows\System\LEetXJh.exe
  C:\Windows\System\LEetXJh.exe
  2⤵
  PID:6416
- C:\Windows\System\sKcLzGH.exe
  C:\Windows\System\sKcLzGH.exe
  2⤵
  PID:6496
- C:\Windows\System\cdgcFdq.exe
  C:\Windows\System\cdgcFdq.exe
  2⤵
  PID:6548
- C:\Windows\System\TcuGyCP.exe
  C:\Windows\System\TcuGyCP.exe
  2⤵
  PID:5712
- C:\Windows\System\ptAnAig.exe
  C:\Windows\System\ptAnAig.exe
  2⤵
  PID:6456
- C:\Windows\System\aZctnin.exe
  C:\Windows\System\aZctnin.exe
  2⤵
  PID:6788
- C:\Windows\System\GKkAdqo.exe
  C:\Windows\System\GKkAdqo.exe
  2⤵
  PID:6956
- C:\Windows\System\oBqwTHQ.exe
  C:\Windows\System\oBqwTHQ.exe
  2⤵
  PID:6904
- C:\Windows\System\elmFamt.exe
  C:\Windows\System\elmFamt.exe
  2⤵
  PID:7104
- C:\Windows\System\WaKogdy.exe
  C:\Windows\System\WaKogdy.exe
  2⤵
  PID:6400
- C:\Windows\System\oIIVaNk.exe
  C:\Windows\System\oIIVaNk.exe
  2⤵
  PID:5740
- C:\Windows\System\DcvOqHV.exe
  C:\Windows\System\DcvOqHV.exe
  2⤵
  PID:6356
- C:\Windows\System\TBCvmNR.exe
  C:\Windows\System\TBCvmNR.exe
  2⤵
  PID:6420
- C:\Windows\System\NzNallI.exe
  C:\Windows\System\NzNallI.exe
  2⤵
  PID:6176
- C:\Windows\System\OWnoumP.exe
  C:\Windows\System\OWnoumP.exe
  2⤵
  PID:6800
- C:\Windows\System\oDMKpCK.exe
  C:\Windows\System\oDMKpCK.exe
  2⤵
  PID:6636
- C:\Windows\System\BTGuoBk.exe
  C:\Windows\System\BTGuoBk.exe
  2⤵
  PID:6824
- C:\Windows\System\KEjTGRX.exe
  C:\Windows\System\KEjTGRX.exe
  2⤵
  PID:7056
- C:\Windows\System\OlxZmmR.exe
  C:\Windows\System\OlxZmmR.exe
  2⤵
  PID:6920
- C:\Windows\System\sRuLOzV.exe
  C:\Windows\System\sRuLOzV.exe
  2⤵
  PID:5512
- C:\Windows\System\fIMepeh.exe
  C:\Windows\System\fIMepeh.exe
  2⤵
  PID:6264
- C:\Windows\System\BaqrErh.exe
  C:\Windows\System\BaqrErh.exe
  2⤵
  PID:6616
- C:\Windows\System\incmBiI.exe
  C:\Windows\System\incmBiI.exe
  2⤵
  PID:6560
- C:\Windows\System\GiWTXDi.exe
  C:\Windows\System\GiWTXDi.exe
  2⤵
  PID:6532
- C:\Windows\System\vuEZGls.exe
  C:\Windows\System\vuEZGls.exe
  2⤵
  PID:6868
- C:\Windows\System\ckqIyLA.exe
  C:\Windows\System\ckqIyLA.exe
  2⤵
  PID:6172
- C:\Windows\System\UIcfPCu.exe
  C:\Windows\System\UIcfPCu.exe
  2⤵
  PID:6032
- C:\Windows\System\jkBGUSP.exe
  C:\Windows\System\jkBGUSP.exe
  2⤵
  PID:6632
- C:\Windows\System\mpaQKAF.exe
  C:\Windows\System\mpaQKAF.exe
  2⤵
  PID:7016
- C:\Windows\System\HZoACAx.exe
  C:\Windows\System\HZoACAx.exe
  2⤵
  PID:6300
- C:\Windows\System\VqnkioH.exe
  C:\Windows\System\VqnkioH.exe
  2⤵
  PID:6796
- C:\Windows\System\hqoZNRe.exe
  C:\Windows\System\hqoZNRe.exe
  2⤵
  PID:7124
- C:\Windows\System\lAyXgiA.exe
  C:\Windows\System\lAyXgiA.exe
  2⤵
  PID:6304
- C:\Windows\System\SXXAEfz.exe
  C:\Windows\System\SXXAEfz.exe
  2⤵
  PID:6736
- C:\Windows\System\tlWpRKg.exe
  C:\Windows\System\tlWpRKg.exe
  2⤵
  PID:6500
- C:\Windows\System\OqcIaiH.exe
  C:\Windows\System\OqcIaiH.exe
  2⤵
  PID:5976
- C:\Windows\System\BodEoxT.exe
  C:\Windows\System\BodEoxT.exe
  2⤵
  PID:6940
- C:\Windows\System\YrHqQor.exe
  C:\Windows\System\YrHqQor.exe
  2⤵
  PID:6652
- C:\Windows\System\kqIxFjP.exe
  C:\Windows\System\kqIxFjP.exe
  2⤵
  PID:5552
- C:\Windows\System\bfNuqXt.exe
  C:\Windows\System\bfNuqXt.exe
  2⤵
  PID:6604
- C:\Windows\System\GsnEeAB.exe
  C:\Windows\System\GsnEeAB.exe
  2⤵
  PID:6192
- C:\Windows\System\GANpzZg.exe
  C:\Windows\System\GANpzZg.exe
  2⤵
  PID:7180
- C:\Windows\System\QNxbjrW.exe
  C:\Windows\System\QNxbjrW.exe
  2⤵
  PID:7196
- C:\Windows\System\JWJHhID.exe
  C:\Windows\System\JWJHhID.exe
  2⤵
  PID:7212
- C:\Windows\System\BsWWAgo.exe
  C:\Windows\System\BsWWAgo.exe
  2⤵
  PID:7244
- C:\Windows\System\UhRAzRd.exe
  C:\Windows\System\UhRAzRd.exe
  2⤵
  PID:7260
- C:\Windows\System\nvEeRiM.exe
  C:\Windows\System\nvEeRiM.exe
  2⤵
  PID:7280
- C:\Windows\System\thWlxsU.exe
  C:\Windows\System\thWlxsU.exe
  2⤵
  PID:7296
- C:\Windows\System\fLLIEpK.exe
  C:\Windows\System\fLLIEpK.exe
  2⤵
  PID:7316
- C:\Windows\System\AjNiDyV.exe
  C:\Windows\System\AjNiDyV.exe
  2⤵
  PID:7336
- C:\Windows\System\JuyFcmT.exe
  C:\Windows\System\JuyFcmT.exe
  2⤵
  PID:7352
- C:\Windows\System\mVzjNIG.exe
  C:\Windows\System\mVzjNIG.exe
  2⤵
  PID:7368
- C:\Windows\System\emAwgIo.exe
  C:\Windows\System\emAwgIo.exe
  2⤵
  PID:7388
- C:\Windows\System\AyjRLrC.exe
  C:\Windows\System\AyjRLrC.exe
  2⤵
  PID:7404
- C:\Windows\System\vQujDwr.exe
  C:\Windows\System\vQujDwr.exe
  2⤵
  PID:7420
- C:\Windows\System\nAdNswd.exe
  C:\Windows\System\nAdNswd.exe
  2⤵
  PID:7440
- C:\Windows\System\GQFJyRS.exe
  C:\Windows\System\GQFJyRS.exe
  2⤵
  PID:7460
- C:\Windows\System\udcNsZu.exe
  C:\Windows\System\udcNsZu.exe
  2⤵
  PID:7480
- C:\Windows\System\TqCJbZs.exe
  C:\Windows\System\TqCJbZs.exe
  2⤵
  PID:7496
- C:\Windows\System\kxdSVwA.exe
  C:\Windows\System\kxdSVwA.exe
  2⤵
  PID:7512
- C:\Windows\System\wHffJib.exe
  C:\Windows\System\wHffJib.exe
  2⤵
  PID:7560
- C:\Windows\System\VokmatZ.exe
  C:\Windows\System\VokmatZ.exe
  2⤵
  PID:7576
- C:\Windows\System\xbiInZk.exe
  C:\Windows\System\xbiInZk.exe
  2⤵
  PID:7592
- C:\Windows\System\NsGrILH.exe
  C:\Windows\System\NsGrILH.exe
  2⤵
  PID:7640
- C:\Windows\System\awzJbSN.exe
  C:\Windows\System\awzJbSN.exe
  2⤵
  PID:7656
- C:\Windows\System\ugnBUYR.exe
  C:\Windows\System\ugnBUYR.exe
  2⤵
  PID:7676
- C:\Windows\System\CHCJYLg.exe
  C:\Windows\System\CHCJYLg.exe
  2⤵
  PID:7696
- C:\Windows\System\tgFoBMO.exe
  C:\Windows\System\tgFoBMO.exe
  2⤵
  PID:7712
- C:\Windows\System\GQPpBxi.exe
  C:\Windows\System\GQPpBxi.exe
  2⤵
  PID:7728
- C:\Windows\System\ewtZHUM.exe
  C:\Windows\System\ewtZHUM.exe
  2⤵
  PID:7756
- C:\Windows\System\QfpDaXG.exe
  C:\Windows\System\QfpDaXG.exe
  2⤵
  PID:7776
- C:\Windows\System\nYpWvSv.exe
  C:\Windows\System\nYpWvSv.exe
  2⤵
  PID:7796
- C:\Windows\System\DmkEMkN.exe
  C:\Windows\System\DmkEMkN.exe
  2⤵
  PID:7812
- C:\Windows\System\CvcQnwa.exe
  C:\Windows\System\CvcQnwa.exe
  2⤵
  PID:7840
- C:\Windows\System\ctFacAp.exe
  C:\Windows\System\ctFacAp.exe
  2⤵
  PID:7860
- C:\Windows\System\UyAzRkN.exe
  C:\Windows\System\UyAzRkN.exe
  2⤵
  PID:7876
- C:\Windows\System\rzevvKf.exe
  C:\Windows\System\rzevvKf.exe
  2⤵
  PID:7896
- C:\Windows\System\TEwWcJO.exe
  C:\Windows\System\TEwWcJO.exe
  2⤵
  PID:7912
- C:\Windows\System\uavZCAC.exe
  C:\Windows\System\uavZCAC.exe
  2⤵
  PID:7928
- C:\Windows\System\pzhMkWp.exe
  C:\Windows\System\pzhMkWp.exe
  2⤵
  PID:7964
- C:\Windows\System\ZWvUCIN.exe
  C:\Windows\System\ZWvUCIN.exe
  2⤵
  PID:7980
- C:\Windows\System\ZDWcIqW.exe
  C:\Windows\System\ZDWcIqW.exe
  2⤵
  PID:8000
- C:\Windows\System\FXjTDRf.exe
  C:\Windows\System\FXjTDRf.exe
  2⤵
  PID:8020
- C:\Windows\System\yGdInJc.exe
  C:\Windows\System\yGdInJc.exe
  2⤵
  PID:8036
- C:\Windows\System\ontbWQP.exe
  C:\Windows\System\ontbWQP.exe
  2⤵
  PID:8052
- C:\Windows\System\duNPUGm.exe
  C:\Windows\System\duNPUGm.exe
  2⤵
  PID:8072
- C:\Windows\System\jymhQnc.exe
  C:\Windows\System\jymhQnc.exe
  2⤵
  PID:8088
- C:\Windows\System\rZvcWqM.exe
  C:\Windows\System\rZvcWqM.exe
  2⤵
  PID:8128
- C:\Windows\System\cjhRxtU.exe
  C:\Windows\System\cjhRxtU.exe
  2⤵
  PID:8148
- C:\Windows\System\PJoCRhX.exe
  C:\Windows\System\PJoCRhX.exe
  2⤵
  PID:8164
- C:\Windows\System\tglBSvN.exe
  C:\Windows\System\tglBSvN.exe
  2⤵
  PID:8188
- C:\Windows\System\TBHfKjw.exe
  C:\Windows\System\TBHfKjw.exe
  2⤵
  PID:6208
- C:\Windows\System\VDwmKsO.exe
  C:\Windows\System\VDwmKsO.exe
  2⤵
  PID:7204
- C:\Windows\System\AfwjMgJ.exe
  C:\Windows\System\AfwjMgJ.exe
  2⤵
  PID:6772
- C:\Windows\System\sBhqIIV.exe
  C:\Windows\System\sBhqIIV.exe
  2⤵
  PID:6556
- C:\Windows\System\lUwSDic.exe
  C:\Windows\System\lUwSDic.exe
  2⤵
  PID:7240
- C:\Windows\System\ddNFiiQ.exe
  C:\Windows\System\ddNFiiQ.exe
  2⤵
  PID:7328
- C:\Windows\System\rKEKGVQ.exe
  C:\Windows\System\rKEKGVQ.exe
  2⤵
  PID:7428
- C:\Windows\System\urJOksX.exe
  C:\Windows\System\urJOksX.exe
  2⤵
  PID:7476
- C:\Windows\System\fWVLhyJ.exe
  C:\Windows\System\fWVLhyJ.exe
  2⤵
  PID:7344
- C:\Windows\System\MBUBPIm.exe
  C:\Windows\System\MBUBPIm.exe
  2⤵
  PID:7272
- C:\Windows\System\FLjxqla.exe
  C:\Windows\System\FLjxqla.exe
  2⤵
  PID:7384
- C:\Windows\System\ZxlIlOu.exe
  C:\Windows\System\ZxlIlOu.exe
  2⤵
  PID:7448
- C:\Windows\System\BYqEOzm.exe
  C:\Windows\System\BYqEOzm.exe
  2⤵
  PID:7524
- C:\Windows\System\qNiSoSb.exe
  C:\Windows\System\qNiSoSb.exe
  2⤵
  PID:7556
- C:\Windows\System\vssbVYU.exe
  C:\Windows\System\vssbVYU.exe
  2⤵
  PID:7520
- C:\Windows\System\wPwtSJc.exe
  C:\Windows\System\wPwtSJc.exe
  2⤵
  PID:7584
- C:\Windows\System\QUSWLYP.exe
  C:\Windows\System\QUSWLYP.exe
  2⤵
  PID:7632
- C:\Windows\System\KzZjOfG.exe
  C:\Windows\System\KzZjOfG.exe
  2⤵
  PID:7664
- C:\Windows\System\ZOBwtNl.exe
  C:\Windows\System\ZOBwtNl.exe
  2⤵
  PID:7688
- C:\Windows\System\rfaItmq.exe
  C:\Windows\System\rfaItmq.exe
  2⤵
  PID:7772
- C:\Windows\System\PDOFNkA.exe
  C:\Windows\System\PDOFNkA.exe
  2⤵
  PID:7792
- C:\Windows\System\kMPIYnA.exe
  C:\Windows\System\kMPIYnA.exe
  2⤵
  PID:7804
- C:\Windows\System\GbDEWtG.exe
  C:\Windows\System\GbDEWtG.exe
  2⤵
  PID:7872
- C:\Windows\System\intnwuX.exe
  C:\Windows\System\intnwuX.exe
  2⤵
  PID:7884
- C:\Windows\System\QaBmyXR.exe
  C:\Windows\System\QaBmyXR.exe
  2⤵
  PID:7944
- C:\Windows\System\VkhvYZL.exe
  C:\Windows\System\VkhvYZL.exe
  2⤵
  PID:7960
- C:\Windows\System\UYuYJQX.exe
  C:\Windows\System\UYuYJQX.exe
  2⤵
  PID:7976
- C:\Windows\System\ZOwWBIn.exe
  C:\Windows\System\ZOwWBIn.exe
  2⤵
  PID:8032
- C:\Windows\System\nbTaTrZ.exe
  C:\Windows\System\nbTaTrZ.exe
  2⤵
  PID:8064
- C:\Windows\System\KYclBdQ.exe
  C:\Windows\System\KYclBdQ.exe
  2⤵
  PID:8104
- C:\Windows\System\rNGSGXX.exe
  C:\Windows\System\rNGSGXX.exe
  2⤵
  PID:8136
- C:\Windows\System\mUGFVFv.exe
  C:\Windows\System\mUGFVFv.exe
  2⤵
  PID:8160
- C:\Windows\System\FNLGuNW.exe
  C:\Windows\System\FNLGuNW.exe
  2⤵
  PID:8108
- C:\Windows\System\AVHiOuT.exe
  C:\Windows\System\AVHiOuT.exe
  2⤵
  PID:5172
- C:\Windows\System\AKVBvxn.exe
  C:\Windows\System\AKVBvxn.exe
  2⤵
  PID:6716
- C:\Windows\System\omCnWLZ.exe
  C:\Windows\System\omCnWLZ.exe
  2⤵
  PID:7252
- C:\Windows\System\qTVLsDW.exe
  C:\Windows\System\qTVLsDW.exe
  2⤵
  PID:7364
- C:\Windows\System\PCSkjwt.exe
  C:\Windows\System\PCSkjwt.exe
  2⤵
  PID:7508
- C:\Windows\System\vPXMCwG.exe
  C:\Windows\System\vPXMCwG.exe
  2⤵
  PID:7348
- C:\Windows\System\iFXigam.exe
  C:\Windows\System\iFXigam.exe
  2⤵
  PID:7492
- C:\Windows\System\WYMoSiE.exe
  C:\Windows\System\WYMoSiE.exe
  2⤵
  PID:7568
- C:\Windows\System\GcphrTL.exe
  C:\Windows\System\GcphrTL.exe
  2⤵
  PID:7528
- C:\Windows\System\YpBWrQb.exe
  C:\Windows\System\YpBWrQb.exe
  2⤵
  PID:7704
- C:\Windows\System\uhCMVay.exe
  C:\Windows\System\uhCMVay.exe
  2⤵
  PID:7708
- C:\Windows\System\cpDwrXf.exe
  C:\Windows\System\cpDwrXf.exe
  2⤵
  PID:7288
- C:\Windows\System\ebEjifi.exe
  C:\Windows\System\ebEjifi.exe
  2⤵
  PID:7784
- C:\Windows\System\tpsqzns.exe
  C:\Windows\System\tpsqzns.exe
  2⤵
  PID:7856
- C:\Windows\System\BxniNob.exe
  C:\Windows\System\BxniNob.exe
  2⤵
  PID:7888
- C:\Windows\System\ZyZBCES.exe
  C:\Windows\System\ZyZBCES.exe
  2⤵
  PID:7936
- C:\Windows\System\IKjGyDA.exe
  C:\Windows\System\IKjGyDA.exe
  2⤵
  PID:7996
- C:\Windows\System\zEVxGCM.exe
  C:\Windows\System\zEVxGCM.exe
  2⤵
  PID:8080
- C:\Windows\System\KDfYnak.exe
  C:\Windows\System\KDfYnak.exe
  2⤵
  PID:8028
- C:\Windows\System\UzMxFMp.exe
  C:\Windows\System\UzMxFMp.exe
  2⤵
  PID:6340
- C:\Windows\System\Pcjdrgj.exe
  C:\Windows\System\Pcjdrgj.exe
  2⤵
  PID:8156
- C:\Windows\System\PYynMOH.exe
  C:\Windows\System\PYynMOH.exe
  2⤵
  PID:7312
- C:\Windows\System\BbEFztZ.exe
  C:\Windows\System\BbEFztZ.exe
  2⤵
  PID:7396
- C:\Windows\System\QIZMVKf.exe
  C:\Windows\System\QIZMVKf.exe
  2⤵
  PID:7400
- C:\Windows\System\sTPFZBf.exe
  C:\Windows\System\sTPFZBf.exe
  2⤵
  PID:7736
- C:\Windows\System\KasIMKv.exe
  C:\Windows\System\KasIMKv.exe
  2⤵
  PID:7652
- C:\Windows\System\LukLSLu.exe
  C:\Windows\System\LukLSLu.exe
  2⤵
  PID:7376
- C:\Windows\System\qXetUiG.exe
  C:\Windows\System\qXetUiG.exe
  2⤵
  PID:7744
- C:\Windows\System\nullUZQ.exe
  C:\Windows\System\nullUZQ.exe
  2⤵
  PID:7828
- C:\Windows\System\mQWfubd.exe
  C:\Windows\System\mQWfubd.exe
  2⤵
  PID:7764
- C:\Windows\System\owEUyRI.exe
  C:\Windows\System\owEUyRI.exe
  2⤵
  PID:8016
- C:\Windows\System\aLSnhAX.exe
  C:\Windows\System\aLSnhAX.exe
  2⤵
  PID:7824
- C:\Windows\System\FxnHEml.exe
  C:\Windows\System\FxnHEml.exe
  2⤵
  PID:8180
- C:\Windows\System\CQHehER.exe
  C:\Windows\System\CQHehER.exe
  2⤵
  PID:7360
- C:\Windows\System\rtzPlMl.exe
  C:\Windows\System\rtzPlMl.exe
  2⤵
  PID:7848
- C:\Windows\System\jJSQZlP.exe
  C:\Windows\System\jJSQZlP.exe
  2⤵
  PID:8060
- C:\Windows\System\TZYbDSF.exe
  C:\Windows\System\TZYbDSF.exe
  2⤵
  PID:7724
- C:\Windows\System\tqXXRbs.exe
  C:\Windows\System\tqXXRbs.exe
  2⤵
  PID:7548
- C:\Windows\System\UFMrnPg.exe
  C:\Windows\System\UFMrnPg.exe
  2⤵
  PID:7820
- C:\Windows\System\wXfMHMu.exe
  C:\Windows\System\wXfMHMu.exe
  2⤵
  PID:7504
- C:\Windows\System\KwPhQJI.exe
  C:\Windows\System\KwPhQJI.exe
  2⤵
  PID:7176
- C:\Windows\System\nHGvocQ.exe
  C:\Windows\System\nHGvocQ.exe
  2⤵
  PID:7684
- C:\Windows\System\FdWEDVb.exe
  C:\Windows\System\FdWEDVb.exe
  2⤵
  PID:7636
- C:\Windows\System\tlJiyYF.exe
  C:\Windows\System\tlJiyYF.exe
  2⤵
  PID:8120
- C:\Windows\System\XlUJZCy.exe
  C:\Windows\System\XlUJZCy.exe
  2⤵
  PID:6732
- C:\Windows\System\AIYwwmw.exe
  C:\Windows\System\AIYwwmw.exe
  2⤵
  PID:8096
- C:\Windows\System\LtWEyge.exe
  C:\Windows\System\LtWEyge.exe
  2⤵
  PID:7540
- C:\Windows\System\rOcILcG.exe
  C:\Windows\System\rOcILcG.exe
  2⤵
  PID:7308
- C:\Windows\System\KaUzitG.exe
  C:\Windows\System\KaUzitG.exe
  2⤵
  PID:8204
- C:\Windows\System\gdUbfTm.exe
  C:\Windows\System\gdUbfTm.exe
  2⤵
  PID:8224
- C:\Windows\System\PEtMbSA.exe
  C:\Windows\System\PEtMbSA.exe
  2⤵
  PID:8252
- C:\Windows\System\fsYsVAg.exe
  C:\Windows\System\fsYsVAg.exe
  2⤵
  PID:8268
- C:\Windows\System\zUWwjuS.exe
  C:\Windows\System\zUWwjuS.exe
  2⤵
  PID:8284
- C:\Windows\System\cspYqyb.exe
  C:\Windows\System\cspYqyb.exe
  2⤵
  PID:8300
- C:\Windows\System\dbXJQzE.exe
  C:\Windows\System\dbXJQzE.exe
  2⤵
  PID:8340
- C:\Windows\System\ioznRqS.exe
  C:\Windows\System\ioznRqS.exe
  2⤵
  PID:8360
- C:\Windows\System\WSsBVyt.exe
  C:\Windows\System\WSsBVyt.exe
  2⤵
  PID:8376
- C:\Windows\System\WZLaGXh.exe
  C:\Windows\System\WZLaGXh.exe
  2⤵
  PID:8396
- C:\Windows\System\DpPmuwW.exe
  C:\Windows\System\DpPmuwW.exe
  2⤵
  PID:8412
- C:\Windows\System\REYrGwe.exe
  C:\Windows\System\REYrGwe.exe
  2⤵
  PID:8428
- C:\Windows\System\AHtBTyT.exe
  C:\Windows\System\AHtBTyT.exe
  2⤵
  PID:8444
- C:\Windows\System\oyVRWQK.exe
  C:\Windows\System\oyVRWQK.exe
  2⤵
  PID:8468
- C:\Windows\System\RJVBqaX.exe
  C:\Windows\System\RJVBqaX.exe
  2⤵
  PID:8488
- C:\Windows\System\CiKxgJX.exe
  C:\Windows\System\CiKxgJX.exe
  2⤵
  PID:8508
- C:\Windows\System\PcQwRKl.exe
  C:\Windows\System\PcQwRKl.exe
  2⤵
  PID:8532
- C:\Windows\System\peysMtd.exe
  C:\Windows\System\peysMtd.exe
  2⤵
  PID:8556
- C:\Windows\System\KrDBwop.exe
  C:\Windows\System\KrDBwop.exe
  2⤵
  PID:8576
- C:\Windows\System\ZaGyrYl.exe
  C:\Windows\System\ZaGyrYl.exe
  2⤵
  PID:8592
- C:\Windows\System\xIrkCzz.exe
  C:\Windows\System\xIrkCzz.exe
  2⤵
  PID:8616
- C:\Windows\System\wzoaOfh.exe
  C:\Windows\System\wzoaOfh.exe
  2⤵
  PID:8632
- C:\Windows\System\jKDjepB.exe
  C:\Windows\System\jKDjepB.exe
  2⤵
  PID:8656
- C:\Windows\System\GeRjIKk.exe
  C:\Windows\System\GeRjIKk.exe
  2⤵
  PID:8676
- C:\Windows\System\qNxgLAW.exe
  C:\Windows\System\qNxgLAW.exe
  2⤵
  PID:8692
- C:\Windows\System\bTrKCxu.exe
  C:\Windows\System\bTrKCxu.exe
  2⤵
  PID:8708
- C:\Windows\System\AsnfWlN.exe
  C:\Windows\System\AsnfWlN.exe
  2⤵
  PID:8732
- C:\Windows\System\mdLKCAb.exe
  C:\Windows\System\mdLKCAb.exe
  2⤵
  PID:8752
- C:\Windows\System\iDMOjMH.exe
  C:\Windows\System\iDMOjMH.exe
  2⤵
  PID:8768
- C:\Windows\System\gQMKdMl.exe
  C:\Windows\System\gQMKdMl.exe
  2⤵
  PID:8784
- C:\Windows\System\RIlfnld.exe
  C:\Windows\System\RIlfnld.exe
  2⤵
  PID:8800
- C:\Windows\System\WQQaxbn.exe
  C:\Windows\System\WQQaxbn.exe
  2⤵
  PID:8824
- C:\Windows\System\sjIaOLD.exe
  C:\Windows\System\sjIaOLD.exe
  2⤵
  PID:8844
- C:\Windows\System\UEdZswD.exe
  C:\Windows\System\UEdZswD.exe
  2⤵
  PID:8864
- C:\Windows\System\JVIVdut.exe
  C:\Windows\System\JVIVdut.exe
  2⤵
  PID:8884
- C:\Windows\System\YlimvTh.exe
  C:\Windows\System\YlimvTh.exe
  2⤵
  PID:8900
- C:\Windows\System\rSxTcxh.exe
  C:\Windows\System\rSxTcxh.exe
  2⤵
  PID:8916
- C:\Windows\System\llLQlhX.exe
  C:\Windows\System\llLQlhX.exe
  2⤵
  PID:8972
- C:\Windows\System\ObbknCw.exe
  C:\Windows\System\ObbknCw.exe
  2⤵
  PID:8988
- C:\Windows\System\WDSuAzE.exe
  C:\Windows\System\WDSuAzE.exe
  2⤵
  PID:9004
- C:\Windows\System\UpGyxRa.exe
  C:\Windows\System\UpGyxRa.exe
  2⤵
  PID:9024
- C:\Windows\System\RpJAwjJ.exe
  C:\Windows\System\RpJAwjJ.exe
  2⤵
  PID:9048
- C:\Windows\System\TPXnVrK.exe
  C:\Windows\System\TPXnVrK.exe
  2⤵
  PID:9064
- C:\Windows\System\PwVOzOJ.exe
  C:\Windows\System\PwVOzOJ.exe
  2⤵
  PID:9080
- C:\Windows\System\QtcdybB.exe
  C:\Windows\System\QtcdybB.exe
  2⤵
  PID:9112
- C:\Windows\System\xDtBkLJ.exe
  C:\Windows\System\xDtBkLJ.exe
  2⤵
  PID:9132
- C:\Windows\System\hrmSZJn.exe
  C:\Windows\System\hrmSZJn.exe
  2⤵
  PID:9148
- C:\Windows\System\ZPBAnsO.exe
  C:\Windows\System\ZPBAnsO.exe
  2⤵
  PID:9164
- C:\Windows\System\kluRAjf.exe
  C:\Windows\System\kluRAjf.exe
  2⤵
  PID:9184
- C:\Windows\System\mcJZhNe.exe
  C:\Windows\System\mcJZhNe.exe
  2⤵
  PID:9200
- C:\Windows\System\auKebGI.exe
  C:\Windows\System\auKebGI.exe
  2⤵
  PID:7416
- C:\Windows\System\TefRiID.exe
  C:\Windows\System\TefRiID.exe
  2⤵
  PID:8220
- C:\Windows\System\OUsMUUu.exe
  C:\Windows\System\OUsMUUu.exe
  2⤵
  PID:8244
- C:\Windows\System\qrSqqsn.exe
  C:\Windows\System\qrSqqsn.exe
  2⤵
  PID:8292
- C:\Windows\System\wttYegZ.exe
  C:\Windows\System\wttYegZ.exe
  2⤵
  PID:8316
- C:\Windows\System\FNmUaKi.exe
  C:\Windows\System\FNmUaKi.exe
  2⤵
  PID:8328
- C:\Windows\System\vHvmbiM.exe
  C:\Windows\System\vHvmbiM.exe
  2⤵
  PID:8356
- C:\Windows\System\AZICGbU.exe
  C:\Windows\System\AZICGbU.exe
  2⤵
  PID:8452
- C:\Windows\System\RvwiikU.exe
  C:\Windows\System\RvwiikU.exe
  2⤵
  PID:8408
- C:\Windows\System\KdLEVPT.exe
  C:\Windows\System\KdLEVPT.exe
  2⤵
  PID:8480
- C:\Windows\System\iMARzfV.exe
  C:\Windows\System\iMARzfV.exe
  2⤵
  PID:8540
- C:\Windows\System\kyszEfO.exe
  C:\Windows\System\kyszEfO.exe
  2⤵
  PID:8564
- C:\Windows\System\TFjWwgd.exe
  C:\Windows\System\TFjWwgd.exe
  2⤵
  PID:8588
- C:\Windows\System\aSTUBiI.exe
  C:\Windows\System\aSTUBiI.exe
  2⤵
  PID:8612
- C:\Windows\System\ybnNjrs.exe
  C:\Windows\System\ybnNjrs.exe
  2⤵
  PID:8644
- C:\Windows\System\scJbRGX.exe
  C:\Windows\System\scJbRGX.exe
  2⤵
  PID:8700
- C:\Windows\System\KDcrOQb.exe
  C:\Windows\System\KDcrOQb.exe
  2⤵
  PID:8808
- C:\Windows\System\AQGTQyp.exe
  C:\Windows\System\AQGTQyp.exe
  2⤵
  PID:8856
- C:\Windows\System\PLQcqOU.exe
  C:\Windows\System\PLQcqOU.exe
  2⤵
  PID:8876
- C:\Windows\System\CvQnFTW.exe
  C:\Windows\System\CvQnFTW.exe
  2⤵
  PID:8716
- C:\Windows\System\RbkkkEB.exe
  C:\Windows\System\RbkkkEB.exe
  2⤵
  PID:8792
- C:\Windows\System\vEKSOYH.exe
  C:\Windows\System\vEKSOYH.exe
  2⤵
  PID:8836
- C:\Windows\System\EOnlcxp.exe
  C:\Windows\System\EOnlcxp.exe
  2⤵
  PID:8912
- C:\Windows\System\qtktoyc.exe
  C:\Windows\System\qtktoyc.exe
  2⤵
  PID:8968
- C:\Windows\System\JgqREno.exe
  C:\Windows\System\JgqREno.exe
  2⤵
  PID:9032
- C:\Windows\System\xJsAYZb.exe
  C:\Windows\System\xJsAYZb.exe
  2⤵
  PID:9036
- C:\Windows\System\ThNxBUv.exe
  C:\Windows\System\ThNxBUv.exe
  2⤵
  PID:9076
- C:\Windows\System\cIgjLUc.exe
  C:\Windows\System\cIgjLUc.exe
  2⤵
  PID:9096
- C:\Windows\System\nGaeCQT.exe
  C:\Windows\System\nGaeCQT.exe
  2⤵
  PID:9128
- C:\Windows\System\CPGFsQD.exe
  C:\Windows\System\CPGFsQD.exe
  2⤵
  PID:8216
- C:\Windows\System\isSHRlz.exe
  C:\Windows\System\isSHRlz.exe
  2⤵
  PID:9140
- C:\Windows\System\ASAPBUx.exe
  C:\Windows\System\ASAPBUx.exe
  2⤵
  PID:8200
- C:\Windows\System\xdZNKQz.exe
  C:\Windows\System\xdZNKQz.exe
  2⤵
  PID:9180
- C:\Windows\System\NkqdqyB.exe
  C:\Windows\System\NkqdqyB.exe
  2⤵
  PID:8324
- C:\Windows\System\ppXslXs.exe
  C:\Windows\System\ppXslXs.exe
  2⤵
  PID:8352
- C:\Windows\System\BBpKoeL.exe
  C:\Windows\System\BBpKoeL.exe
  2⤵
  PID:8368
- C:\Windows\System\CWxpROU.exe
  C:\Windows\System\CWxpROU.exe
  2⤵
  PID:8964
- C:\Windows\System\DJeLQlj.exe
  C:\Windows\System\DJeLQlj.exe
  2⤵
  PID:8504
- C:\Windows\System\ZPdUwcU.exe
  C:\Windows\System\ZPdUwcU.exe
  2⤵
  PID:8624
- C:\Windows\System\onILqTC.exe
  C:\Windows\System\onILqTC.exe
  2⤵
  PID:8668
- C:\Windows\System\SQWZoWL.exe
  C:\Windows\System\SQWZoWL.exe
  2⤵
  PID:8816
- C:\Windows\System\KtSYdvl.exe
  C:\Windows\System\KtSYdvl.exe
  2⤵
  PID:8812
- C:\Windows\System\YWxBABg.exe
  C:\Windows\System\YWxBABg.exe
  2⤵
  PID:8728
- C:\Windows\System\mBoIdpE.exe
  C:\Windows\System\mBoIdpE.exe
  2⤵
  PID:8928
- C:\Windows\System\Zadrjod.exe
  C:\Windows\System\Zadrjod.exe
  2⤵
  PID:8880
- C:\Windows\System\qaORatS.exe
  C:\Windows\System\qaORatS.exe
  2⤵
  PID:8932
- C:\Windows\System\LcOpUhl.exe
  C:\Windows\System\LcOpUhl.exe
  2⤵
  PID:8332
- C:\Windows\System\USLNJUz.exe
  C:\Windows\System\USLNJUz.exe
  2⤵
  PID:9012
- C:\Windows\System\pHKhyCY.exe
  C:\Windows\System\pHKhyCY.exe
  2⤵
  PID:9088
- C:\Windows\System\WXjYkMO.exe
  C:\Windows\System\WXjYkMO.exe
  2⤵
  PID:9104
- C:\Windows\System\oGORhoE.exe
  C:\Windows\System\oGORhoE.exe
  2⤵
  PID:9144
- C:\Windows\System\bApYgUJ.exe
  C:\Windows\System\bApYgUJ.exe
  2⤵
  PID:8320
- C:\Windows\System\mmqOSZL.exe
  C:\Windows\System\mmqOSZL.exe
  2⤵
  PID:8280
- C:\Windows\System\vnvqieX.exe
  C:\Windows\System\vnvqieX.exe
  2⤵
  PID:8440
- C:\Windows\System\nrVVbkz.exe
  C:\Windows\System\nrVVbkz.exe
  2⤵
  PID:8628
- C:\Windows\System\arwBbFw.exe
  C:\Windows\System\arwBbFw.exe
  2⤵
  PID:8740
- C:\Windows\System\exHxiBx.exe
  C:\Windows\System\exHxiBx.exe
  2⤵
  PID:8780
- C:\Windows\System\GwFPIZY.exe
  C:\Windows\System\GwFPIZY.exe
  2⤵
  PID:8948
- C:\Windows\System\WWJxQGv.exe
  C:\Windows\System\WWJxQGv.exe
  2⤵
  PID:9160
- C:\Windows\System\bwhCEyg.exe
  C:\Windows\System\bwhCEyg.exe
  2⤵
  PID:9176
- C:\Windows\System\fZbRfao.exe
  C:\Windows\System\fZbRfao.exe
  2⤵
  PID:8348
- C:\Windows\System\bvtchLy.exe
  C:\Windows\System\bvtchLy.exe
  2⤵
  PID:8212
- C:\Windows\System\yeetpIc.exe
  C:\Windows\System\yeetpIc.exe
  2⤵
  PID:8640
- C:\Windows\System\THpQqEg.exe
  C:\Windows\System\THpQqEg.exe
  2⤵
  PID:8552
- C:\Windows\System\EQifuIO.exe
  C:\Windows\System\EQifuIO.exe
  2⤵
  PID:9120
- C:\Windows\System\ohuvjwz.exe
  C:\Windows\System\ohuvjwz.exe
  2⤵
  PID:8388
- C:\Windows\System\eWgyMKp.exe
  C:\Windows\System\eWgyMKp.exe
  2⤵
  PID:8984
- C:\Windows\System\mhZPkgg.exe
  C:\Windows\System\mhZPkgg.exe
  2⤵
  PID:8264
- C:\Windows\System\SRhOcZj.exe
  C:\Windows\System\SRhOcZj.exe
  2⤵
  PID:9196
- C:\Windows\System\NZRBPbc.exe
  C:\Windows\System\NZRBPbc.exe
  2⤵
  PID:8476
- C:\Windows\System\dAnlnKb.exe
  C:\Windows\System\dAnlnKb.exe
  2⤵
  PID:8516
- C:\Windows\System\xzAxXwA.exe
  C:\Windows\System\xzAxXwA.exe
  2⤵
  PID:8260
- C:\Windows\System\gCzXnlu.exe
  C:\Windows\System\gCzXnlu.exe
  2⤵
  PID:9020
- C:\Windows\System\NoviECH.exe
  C:\Windows\System\NoviECH.exe
  2⤵
  PID:8584
- C:\Windows\System\XffIjxp.exe
  C:\Windows\System\XffIjxp.exe
  2⤵
  PID:7456
- C:\Windows\System\FphETLr.exe
  C:\Windows\System\FphETLr.exe
  2⤵
  PID:8460
- C:\Windows\System\ENydLls.exe
  C:\Windows\System\ENydLls.exe
  2⤵
  PID:8392
- C:\Windows\System\MzeWUwY.exe
  C:\Windows\System\MzeWUwY.exe
  2⤵
  PID:8528
- C:\Windows\System\VmbZVXS.exe
  C:\Windows\System\VmbZVXS.exe
  2⤵
  PID:9228
- C:\Windows\System\ailrCOh.exe
  C:\Windows\System\ailrCOh.exe
  2⤵
  PID:9248
- C:\Windows\System\puMrjJa.exe
  C:\Windows\System\puMrjJa.exe
  2⤵
  PID:9272
- C:\Windows\System\bHirPxC.exe
  C:\Windows\System\bHirPxC.exe
  2⤵
  PID:9288
- C:\Windows\System\phoMVbQ.exe
  C:\Windows\System\phoMVbQ.exe
  2⤵
  PID:9308
- C:\Windows\System\wuoXJbI.exe
  C:\Windows\System\wuoXJbI.exe
  2⤵
  PID:9324
- C:\Windows\System\TJAOnTP.exe
  C:\Windows\System\TJAOnTP.exe
  2⤵
  PID:9344
- C:\Windows\System\otlzchi.exe
  C:\Windows\System\otlzchi.exe
  2⤵
  PID:9364
- C:\Windows\System\lHqbRYg.exe
  C:\Windows\System\lHqbRYg.exe
  2⤵
  PID:9384
- C:\Windows\System\vdqEpDH.exe
  C:\Windows\System\vdqEpDH.exe
  2⤵
  PID:9408
- C:\Windows\System\CNyOrJh.exe
  C:\Windows\System\CNyOrJh.exe
  2⤵
  PID:9432
- C:\Windows\System\qxaSVEU.exe
  C:\Windows\System\qxaSVEU.exe
  2⤵
  PID:9448
- C:\Windows\System\MKUpLgP.exe
  C:\Windows\System\MKUpLgP.exe
  2⤵
  PID:9464
- C:\Windows\System\krYmSzc.exe
  C:\Windows\System\krYmSzc.exe
  2⤵
  PID:9480
- C:\Windows\System\eFODTfz.exe
  C:\Windows\System\eFODTfz.exe
  2⤵
  PID:9504
- C:\Windows\System\SLSIanJ.exe
  C:\Windows\System\SLSIanJ.exe
  2⤵
  PID:9524
- C:\Windows\System\oGMYzwO.exe
  C:\Windows\System\oGMYzwO.exe
  2⤵
  PID:9544
- C:\Windows\System\woqqxPN.exe
  C:\Windows\System\woqqxPN.exe
  2⤵
  PID:9564
- C:\Windows\System\bTvPbHp.exe
  C:\Windows\System\bTvPbHp.exe
  2⤵
  PID:9580
- C:\Windows\System\EhdZxJV.exe
  C:\Windows\System\EhdZxJV.exe
  2⤵
  PID:9596
- C:\Windows\System\uVasjtj.exe
  C:\Windows\System\uVasjtj.exe
  2⤵
  PID:9616
- C:\Windows\System\hbfwPEv.exe
  C:\Windows\System\hbfwPEv.exe
  2⤵
  PID:9632
- C:\Windows\System\aNzajZI.exe
  C:\Windows\System\aNzajZI.exe
  2⤵
  PID:9652
- C:\Windows\System\GRreuwJ.exe
  C:\Windows\System\GRreuwJ.exe
  2⤵
  PID:9672
- C:\Windows\System\lGuKnHM.exe
  C:\Windows\System\lGuKnHM.exe
  2⤵
  PID:9696
- C:\Windows\System\bCfsoGe.exe
  C:\Windows\System\bCfsoGe.exe
  2⤵
  PID:9716
- C:\Windows\System\jxNwcbL.exe
  C:\Windows\System\jxNwcbL.exe
  2⤵
  PID:9736
- C:\Windows\System\UPMuQjy.exe
  C:\Windows\System\UPMuQjy.exe
  2⤵
  PID:9756
- C:\Windows\System\EkGUlsn.exe
  C:\Windows\System\EkGUlsn.exe
  2⤵
  PID:9772
- C:\Windows\System\cedIOZm.exe
  C:\Windows\System\cedIOZm.exe
  2⤵
  PID:9788
- C:\Windows\System\sPngMLo.exe
  C:\Windows\System\sPngMLo.exe
  2⤵
  PID:9804
- C:\Windows\System\nVKLMGc.exe
  C:\Windows\System\nVKLMGc.exe
  2⤵
  PID:9820
- C:\Windows\System\jnMuTTC.exe
  C:\Windows\System\jnMuTTC.exe
  2⤵
  PID:9836
- C:\Windows\System\krQaWsD.exe
  C:\Windows\System\krQaWsD.exe
  2⤵
  PID:9852
- C:\Windows\System\fgQaTZd.exe
  C:\Windows\System\fgQaTZd.exe
  2⤵
  PID:9868
- C:\Windows\System\ugCFRJs.exe
  C:\Windows\System\ugCFRJs.exe
  2⤵
  PID:9932
- C:\Windows\System\DWJbRrM.exe
  C:\Windows\System\DWJbRrM.exe
  2⤵
  PID:9948
- C:\Windows\System\cwSJFFG.exe
  C:\Windows\System\cwSJFFG.exe
  2⤵
  PID:9968
- C:\Windows\System\rkespcD.exe
  C:\Windows\System\rkespcD.exe
  2⤵
  PID:9992
- C:\Windows\System\swtEFcG.exe
  C:\Windows\System\swtEFcG.exe
  2⤵
  PID:10012
- C:\Windows\System\aTZiuab.exe
  C:\Windows\System\aTZiuab.exe
  2⤵
  PID:10028
- C:\Windows\System\cMaixxw.exe
  C:\Windows\System\cMaixxw.exe
  2⤵
  PID:10044
- C:\Windows\System\dJLpAPX.exe
  C:\Windows\System\dJLpAPX.exe
  2⤵
  PID:10060
- C:\Windows\System\ufhwWUk.exe
  C:\Windows\System\ufhwWUk.exe
  2⤵
  PID:10084
- C:\Windows\System\mbOVqGK.exe
  C:\Windows\System\mbOVqGK.exe
  2⤵
  PID:10104
- C:\Windows\System\ZmNUeBa.exe
  C:\Windows\System\ZmNUeBa.exe
  2⤵
  PID:10124
- C:\Windows\System\zqGbZcV.exe
  C:\Windows\System\zqGbZcV.exe
  2⤵
  PID:10156
- C:\Windows\System\JVylCNG.exe
  C:\Windows\System\JVylCNG.exe
  2⤵
  PID:10172
- C:\Windows\System\kkXUAgL.exe
  C:\Windows\System\kkXUAgL.exe
  2⤵
  PID:10200
- C:\Windows\System\aBcbWMa.exe
  C:\Windows\System\aBcbWMa.exe
  2⤵
  PID:10216
- C:\Windows\System\xjjaIRu.exe
  C:\Windows\System\xjjaIRu.exe
  2⤵
  PID:10232
- C:\Windows\System\XsIYMyc.exe
  C:\Windows\System\XsIYMyc.exe
  2⤵
  PID:9224
- C:\Windows\System\JsWttaj.exe
  C:\Windows\System\JsWttaj.exe
  2⤵
  PID:9264
- C:\Windows\System\yIhikok.exe
  C:\Windows\System\yIhikok.exe
  2⤵
  PID:9316
- C:\Windows\System\NjPDScR.exe
  C:\Windows\System\NjPDScR.exe
  2⤵
  PID:9332
- C:\Windows\System\MVdNlMF.exe
  C:\Windows\System\MVdNlMF.exe
  2⤵
  PID:9296
- C:\Windows\System\hqIbdJZ.exe
  C:\Windows\System\hqIbdJZ.exe
  2⤵
  PID:9376
- C:\Windows\System\NoXoHBc.exe
  C:\Windows\System\NoXoHBc.exe
  2⤵
  PID:9400
- C:\Windows\System\blityps.exe
  C:\Windows\System\blityps.exe
  2⤵
  PID:9472
- C:\Windows\System\layZKmb.exe
  C:\Windows\System\layZKmb.exe
  2⤵
  PID:9488
- C:\Windows\System\FUhvslm.exe
  C:\Windows\System\FUhvslm.exe
  2⤵
  PID:9592
- C:\Windows\System\UJSLfvG.exe
  C:\Windows\System\UJSLfvG.exe
  2⤵
  PID:9664
- C:\Windows\System\LQgYlLd.exe
  C:\Windows\System\LQgYlLd.exe
  2⤵
  PID:9744
- C:\Windows\System\iRiqVdD.exe
  C:\Windows\System\iRiqVdD.exe
  2⤵
  PID:9608
- C:\Windows\System\IFIbOLZ.exe
  C:\Windows\System\IFIbOLZ.exe
  2⤵
  PID:9500
- C:\Windows\System\OPbcjjD.exe
  C:\Windows\System\OPbcjjD.exe
  2⤵
  PID:9680
- C:\Windows\System\MrxyaiX.exe
  C:\Windows\System\MrxyaiX.exe
  2⤵
  PID:9540
- C:\Windows\System\DlkaVso.exe
  C:\Windows\System\DlkaVso.exe
  2⤵
  PID:9816
- C:\Windows\System\BiuATpM.exe
  C:\Windows\System\BiuATpM.exe
  2⤵
  PID:9828
- C:\Windows\System\lKYCimQ.exe
  C:\Windows\System\lKYCimQ.exe
  2⤵
  PID:9848
- C:\Windows\System\naFhGXV.exe
  C:\Windows\System\naFhGXV.exe
  2⤵
  PID:9876
- C:\Windows\System\FmtiEBr.exe
  C:\Windows\System\FmtiEBr.exe
  2⤵
  PID:9908
- C:\Windows\System\uFujThN.exe
  C:\Windows\System\uFujThN.exe
  2⤵
  PID:9880
- C:\Windows\System\CMkvxZr.exe
  C:\Windows\System\CMkvxZr.exe
  2⤵
  PID:9980
- C:\Windows\System\PPaFEec.exe
  C:\Windows\System\PPaFEec.exe
  2⤵
  PID:10076
- C:\Windows\System\NwqnDYv.exe
  C:\Windows\System\NwqnDYv.exe
  2⤵
  PID:9940
- C:\Windows\System\PeOaggY.exe
  C:\Windows\System\PeOaggY.exe
  2⤵
  PID:9988
- C:\Windows\System\kHhkKFT.exe
  C:\Windows\System\kHhkKFT.exe
  2⤵
  PID:10020
- C:\Windows\System\ygofrbI.exe
  C:\Windows\System\ygofrbI.exe
  2⤵
  PID:10168
- C:\Windows\System\KzTQZtZ.exe
  C:\Windows\System\KzTQZtZ.exe
  2⤵
  PID:10144
- C:\Windows\System\aUnIztl.exe
  C:\Windows\System\aUnIztl.exe
  2⤵
  PID:10184
- C:\Windows\System\WGaKgrF.exe
  C:\Windows\System\WGaKgrF.exe
  2⤵
  PID:9236
- C:\Windows\System\UPeXhxA.exe
  C:\Windows\System\UPeXhxA.exe
  2⤵
  PID:9284
- C:\Windows\System\PFWZoVe.exe
  C:\Windows\System\PFWZoVe.exe
  2⤵
  PID:9444
- C:\Windows\System\OAcYBvW.exe
  C:\Windows\System\OAcYBvW.exe
  2⤵
  PID:9456
- C:\Windows\System\xjBgQAy.exe
  C:\Windows\System\xjBgQAy.exe
  2⤵
  PID:9520
- C:\Windows\System\wLyMRER.exe
  C:\Windows\System\wLyMRER.exe
  2⤵
  PID:9360
- C:\Windows\System\GuuWFWx.exe
  C:\Windows\System\GuuWFWx.exe
  2⤵
  PID:9556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FMkHiIw.exe

Filesize
3.2MB

MD5
d1914a0526d9872e4bca9209b38afe43

SHA1
fbac7a100c65bd60879fe82c23e741db12d977b3

SHA256
0e657140a8d86852589a1fec6995c6307b13627f758b7304c2092ecaf68b6ef3

SHA512
5140550c7cefadd8d2c49cff08cb9d4cce50ba1c5cf914931274a9491d93644c75243c17347ee4e795043444b62fa1de9492013cd9c8d4d8538d5847611d5cdf

Download Submit
C:\Windows\system\FmipvpV.exe

Filesize
3.2MB

MD5
94b581e479729498e1c9cd81efe42184

SHA1
ee6295d6d109e5de5277bf8c86f1191802145d20

SHA256
e0e91eb14b579acec652ad3b077558b5464ba267398646f2176d27f5bac75f97

SHA512
9bbd1e6d7d40009034ccfa43eec969691e84b59bf6f2339a76f36d1d224eee0337ea2f89c7b31f277413cf2977a9389f37ce5d295de054c43a673ff348f69210

Download Submit
C:\Windows\system\INXtDkv.exe

Filesize
3.2MB

MD5
2fcefb63ecbda2ea04f6942f9b2d63a6

SHA1
7b6857a19eb41a88c9ecff04dbafc66f753b9e43

SHA256
0b22be9cc02f33646b5cb9b13e0252348168c7ea398b06ef06196fcc481e4896

SHA512
c6ff1dbe0b82eba9740d70024bd86dfc96f6cbeb82c00dd820c27f943f320597204334bc9373f9d4eef4cf04c7e0737eaba14d89c591d1cfccb8e1e24c9a959f

Download Submit
C:\Windows\system\ITuTQPo.exe

Filesize
3.2MB

MD5
0d5fa6c82546b351f6d915ce0bd490cd

SHA1
3f9610a97d3b39407eb9eea6ad0a43c11fb47e19

SHA256
a884fb9f5cb8008ca87d95a10f4d864b0ec6c5f994f72072af6e216a1ed551ce

SHA512
52b9d7a7f2bc6c38344ea48fd2cff7e442d00482a3e9dbfbd652995d2d44104150ca15bba1de64016060adcd546ecf7bfc67da9853c9f85d68b8175942daf18e

Download Submit
C:\Windows\system\KhzIgVa.exe

Filesize
3.2MB

MD5
0d34eac07876ecbd5970bee1ebfc091a

SHA1
0ad997641c7674bf86e6ff7fe57412d3242795d8

SHA256
27b305c6454fa1989b7ac6b138fa094ca50c0711d03951426f6f890466dac8f0

SHA512
2402b9357a851cfcef006e5f55407e40dc1daa251ca97b378a29dba190751cc39f23c88d92b0fdc7f500ab31e8ad2e98230aea56f02141115651fbd7e668cacb

Download Submit
C:\Windows\system\NevAYSU.exe

Filesize
3.2MB

MD5
d98259684d79c75fb8b34450d5632438

SHA1
ca956c025d3103f4880e9701a9b98625e5f41cad

SHA256
c2ae0656f46dec07e03ccc7888f9d0963d6da820ceecf2402fe5528d6f1f70d5

SHA512
6cdefeba0d901ce9db87c61d773917932920bd148273a7544b263bcf385fe0f2035213933eb50c47eed332b0ad1b6cab92801e6cd2263a2e8d53bc29fff2a839

Download Submit
C:\Windows\system\ObpihKJ.exe

Filesize
3.2MB

MD5
d18b1d578b2504b6a29e0051bef4f34f

SHA1
46ba6e7af5ee69e0d1ddc403c234c45d2fcca4c9

SHA256
8db5ae76e3b0257d7e36af2a94ed9e73fba48a559031c24f5f9dc80677483f27

SHA512
765dd7cbcd456be8cee05ad68228a81ac3f7cb30b9241fa5fe54f8d80b88e215aad6aa9b58db97d678a4e30789e724d7e22d623b635b4de7b9d79e0439b085e7

Download Submit
C:\Windows\system\SYcmPMV.exe

Filesize
3.2MB

MD5
0b7cd55bfa38bfc3fdca29471d28911f

SHA1
34f973b0c26117724f576591f23c44314dd5ac1a

SHA256
c3b1e7616667a108ae3f6c403c8932aeaca83ae857ea599e792a8557a21d4b74

SHA512
a0301466f34336b11a9b5c8f1c15848b8ba8151121b36e6469fc272aae72a47bb7315dff6afdb83083665655387b976d26ad2e63fad9ba4f9eac2a6d395a29a4

Download Submit
C:\Windows\system\TpmGQfd.exe

Filesize
3.2MB

MD5
e49389f25fc38573eca4e487b04f6308

SHA1
645f1376b4cd523d16cf08c2979893475884b328

SHA256
5acee65efa729441f13928441f51a8d91bf61b68b80eff5ec1424930b51420c9

SHA512
7297f50c90c5f5ece460ad77604af689ec8649a112f18a16980af067d015d706f06cf4ac02448aba63ff54f5b6105c9ba4de95b9941fd66307e7057d29d8f5c1

Download Submit
C:\Windows\system\WDhtJMR.exe

Filesize
3.2MB

MD5
5c7d3e8847b29b0c08eec21d2c974276

SHA1
2c4171081608db4756807438cef2070ea5bf1db9

SHA256
64a0f0c15847f170f6cc2ddad7287d757d6a95c97aefaedd5139a3a9ad11dc58

SHA512
3a134ec4e5cd8ae9cb3861ad04729c3bc5ab5c5387b0d567cd9076bcb79b05aa56ddff12302517515c873398bc984e1bbc3eac72997d55c858053cfb3c024a65

Download Submit
C:\Windows\system\XEqMDmy.exe

Filesize
3.2MB

MD5
3bb94cbe41062fda4b625457022f866f

SHA1
7ca6eb1fe854512dbd3c2740e79e5417c7ad9acc

SHA256
3ef7b3d6def0fb5b31c1e42d75a0669621067eadf67f39f34315c9661f0406ad

SHA512
7a59801523ce1f5f19f970e1fb7b303d1c7d785578729b8347a3ed0b3e8929748f00a456e10e5289cb25999a3e120ea3135843daa97943b1dcf6dbaf71c1d147

Download Submit
C:\Windows\system\YpSpJKO.exe

Filesize
3.2MB

MD5
243939ba6c2d7dcf57680b73c20db85f

SHA1
9a779a9f9d5d905024b0afc6a5361381b8d2c670

SHA256
65d1853f70a7788ef95bb08197d85488821f83e0ed9aaf63b1a4c04676c5ac3e

SHA512
debea6288e2295e10da65623f66993156d859d2a603b6dca4d792995903fc2ff13b5b9d57b060c69e91bc372e8f8893435607b67d76a9ac8b475d124ca9df520

Download Submit
C:\Windows\system\aJMOBWx.exe

Filesize
3.2MB

MD5
5796a2b323d55ea7a9ec521225c7a643

SHA1
bc11c50ae8d9f27952f9ad4a3eb644bc8cf75407

SHA256
6a1cdfdab066b5bb3159a8c731cc2abb4671121a28030ec9856adb3930b3ec75

SHA512
527267074762ce8bd2b074cbe41e4868bc13091dc45cf250679bfe881a2d07da938ede5eea9e46e1d0b0c86e81633ef4f9e38098c4a92b4c5a45e0f373e47b52

Download Submit
C:\Windows\system\aVzmKhs.exe

Filesize
3.2MB

MD5
2b4791405ac7c1d71298ad4df131d75c

SHA1
5deb689ec0381663ca89e24250a493ece0a677f8

SHA256
9df07855f7fc3a5debca8694c4ed8dddbd595e39537f4342514aaa69a0b09e5c

SHA512
d4c720ac7cc52fddd5372ce394ec73d2dce48bc280f721b6ed6154387388bee3a7b0de2917b734655e3050bb2488707f82d6dbff63dde7415a7b0b38603275db

Download Submit
C:\Windows\system\akCJWTl.exe

Filesize
3.2MB

MD5
86812d24a03c5ca50deac41c450328bf

SHA1
6bac4628d19c60047f9ab09366b089a2eab4828e

SHA256
236201cd7ebc5b157518f11a0e7b9e4c187a260b2ec289ae279db421d1cd635a

SHA512
9696fe06b978a1a3c88987a1ee98eef6d1ae710fdfe2cc7e28367eb1fbd9a0b916b735e828edb2f6f3a898b236b60c60646089f5bec9c75ece662881f266d00e

Download Submit
C:\Windows\system\eJEWSkx.exe

Filesize
3.2MB

MD5
634a7624ee15ce265fa4917b60033c3d

SHA1
0abc44dd1a7e6884323652d2921c7c3a80cff64e

SHA256
b2477d0aed338ce2cd16e66e4eb62d560f65caecad5a196504d67fdfbaa212a3

SHA512
7ac9312cee930b87b4320e4720907ff08b9cfad383592537d6feb7946a6f1eb7441a0c8ee827f586007bdfd618f5e7cbbedea8bdc6150747870c4a86bbc28809

Download Submit
C:\Windows\system\fczMyft.exe

Filesize
3.2MB

MD5
3844e622fc83addd54e6a0bb2c8556e5

SHA1
739ca691382b0e931621c51f6250a44e04d95cc7

SHA256
7e3c6e4ec55ed677ef796f71f3ece819f09c8780b3c69fc2a47b8a37dfa64e27

SHA512
fb3f488d5e71816970e1f4ba6522484852a33a5fb8a960c6479ff07411c02956f73f37a6871764edc3163bd517937111fc7935ee6c9f37cb045ef6105da5e994

Download Submit
C:\Windows\system\gTsQBmX.exe

Filesize
3.2MB

MD5
9f19043539991ef92bc050046109c2e6

SHA1
5c6e229d9b72c2de09672ace802ca2e449678140

SHA256
0fcda9ce1f9ed917ae9e7e4c07baa32d1a6f96cf19116139bbfd9153a6d22f95

SHA512
738427199a0b59445042b888ce1c6ff04139bbef1aa73d040463dd1bf9425c11e0b36f73d3d12d94207065082062f6524bb772b7e27931d117d761b7c409b107

Download Submit
C:\Windows\system\gvmTROb.exe

Filesize
3.2MB

MD5
f98e07f2bae45cbd978b834f9e386682

SHA1
8604290cb14cfeb9dcb65307a094382cbdf950dd

SHA256
b9a6eab08e9592ccddf1245bcd0d135e169f2df93e0d7412df2d06ed664de823

SHA512
77886d2689b5b8cc5102f8fbc09e794da3f3bfaa56e4f55ccc9b3939001b2200795c44a10ae3304d7a7020373da1b7f788dd534fe79abe3f6e0fd1283ccbcdd4

Download Submit
C:\Windows\system\hTxphvv.exe

Filesize
3.2MB

MD5
6f35dea863085d456aa637718ab8a2f8

SHA1
7704df7fa5a4d92c2776249daf829c4e1c0a3b2e

SHA256
b43f0dea39f6a07dd422219a50b006a8675b835c3e8afd3e216f3aa0d620ea6b

SHA512
14a894119e8cca53ea7a8b016b0bc5183a7920525e1e00faaf331a4172ddb77e525938bc9873a194b98fee2ccef17d05d61f2d6421f6f7ad6ac1235055c9cbb7

Download Submit
C:\Windows\system\kWqOiaj.exe

Filesize
3.2MB

MD5
d8420193d4723f46f36e830bf68d54e3

SHA1
5cba940161047b2a073f8725caf0156be847b1b3

SHA256
976d3d42452073a0af327932a158b50db7905866dc337bff33450338c3391705

SHA512
7da0bd73033507a877aa07d0f4863cf4ddfb0b70bad18fcc14f8b58a9f8d564ba850cb8837a8590dec15787eb19dd47b37aa81751eed570e2f48bdb8c0abc9dd

Download Submit
C:\Windows\system\mDmdKEP.exe

Filesize
3.2MB

MD5
2af151eb5ce8295b990805c20829b374

SHA1
d0db96fedcd832bf03baaf810da0dd29cdcd2cc4

SHA256
483c8b73bedb091884d04740ba481a4fa266886222a0843d00dc910956bf4198

SHA512
928b25592ea19eb8a2714252edd7327483ff10c9cc9633ac6eedb9c4d09f5498879bc5a78b0118d5bda6e91f5e7e78512e3e5be4d77fce7d92d9516c12314475

Download Submit
C:\Windows\system\ondfjad.exe

Filesize
3.2MB

MD5
17e6eac054ded0a865888938e39df998

SHA1
d3d270f61cc49ecb249b06975a794360adafd9f6

SHA256
4bf5587593d07e80819d9543d4d16491f75d069a679edbe0433b6829d14dfc71

SHA512
2b1678307be52782e1a889eb9010fa40f38800996839922759d5436f0c8e7be56ed798bfb3c1d0807576de82030c90c29da388c451012889e7cd3380338fe5a8

Download Submit
C:\Windows\system\pwDDXhm.exe

Filesize
3.2MB

MD5
5d8067ee441ed6e6c836a24865ba09e4

SHA1
a5986ffd84bbc806d99e737f5715b4ebf9b49f2a

SHA256
09c1bc7d12e40d06b1638fdedb60c4246786d4a3305a1ddf88b26ff474c0ac59

SHA512
201e4d7b33ccfb958a41f2fab381964830405464652b5eefa97644b420496028b3e55036963c52b031fbf3a13140dc1fcedfe48015501a8ac3f6970c868a57f0

Download Submit
C:\Windows\system\qNQRnra.exe

Filesize
3.2MB

MD5
45362e4185aeae3448b095a18303c951

SHA1
8adb6ac246d4e2708edf15ac8d0dca5214818d80

SHA256
3753dbee9efdefeddfe4b2e4a91f55ce178b3179f239a4605783a28c3b37932a

SHA512
e14272f62126f10ea5548fc843d7012dda3b159d6f39277bd2dae490f70c34abab1a02230b1573212b036adf3d4664e2a442c49af938db26bd9c3291798e9a31

Download Submit
C:\Windows\system\qzgJUAm.exe

Filesize
3.2MB

MD5
8679ad841abc1c1631a6710e8f4bbb97

SHA1
1ae77497f040f3154fcf918d18cdb13bdc7b9804

SHA256
32eaf8c1ae3bfb92fdd7ed975a3b43a6d82d282c9fd98f5beb9a2f1c19c77c8d

SHA512
b233c96d6d3025c49cdf0a1682d33e76be4ebe380633540b93d71c3d17894154001a4333277f37163106710f2807ea13f35255bde1bbd4a6861db32e1a156a16

Download Submit
C:\Windows\system\smNDdSE.exe

Filesize
3.2MB

MD5
8b3e4d29a68adc7adfc2797e9acd80d8

SHA1
cdb84cc9c3baef4b6b9fc85dbb47ebe6eecf0f3a

SHA256
c63faabf8025cc3d19cdee22869600ac6653f3206dcdd35e1b06f446e042bc0e

SHA512
38a10e6bb42990e09864d05e535b5207b101942499d6df34be88ee464abf9fcfa5b79597fd570255550951e7fad56a5af39fcf870d8700c89505d144f3538111

Download Submit
C:\Windows\system\vrEpKNM.exe

Filesize
3.2MB

MD5
46bc5292e535411e068f4055f1627d9e

SHA1
4782f9ac3781b5ba730625b8171c51d91b175b06

SHA256
32b33bced9fba3a26f7c81d4a8e1bbbef5f75a0ba1d9979d43c726746e958bba

SHA512
816b9565dc63d2ee16babd7df53f0cb9b3bd9d2f5e87b3d1a0b442e1620ead1eba62da89543cf81168cf7a46cd6e722a0c7af3e6cbbf7774b4dc0110a8e32e4f

Download Submit
C:\Windows\system\wnzpAki.exe

Filesize
3.2MB

MD5
30e901b2b360ed999684a8e8f43f3f25

SHA1
04a617027c9f8b07a7dacafd92a5c0e3dce170a5

SHA256
3a85283ae51aff303c982e8b38f30228f77b9aa603548355a5a2a1ed814f5159

SHA512
5109fa24365c99f5cc8216a9bc445dc5746e588bd966fc609aab329c8f5748d93feafbe28be3dabf90c69db20cdacc1758fc7e4b96d28cf57db136148e92c870

Download Submit
C:\Windows\system\xijIQvm.exe

Filesize
3.2MB

MD5
562e4d16a1cb4c79195b69b20079ff1b

SHA1
3be9193022c36a6aefba5e2e422a4e984b180b7b

SHA256
2481fe6d8ddc13b41cd0ce11902c40f42c0ad7f796da65afe8fd1fef4a7471b3

SHA512
69f0a2ccf7f662812c27994d9d5425e08e9367133124c90074a27467694e8f0c9945b98dc893201f7055777a2e31ad43882c2a339d5dc13836dd793a7e49962e

Download Submit
\Windows\system\Owopctj.exe

Filesize
3.2MB

MD5
2360c5ddb05d8edbc6d443756c0feba3

SHA1
4d5fb12eb18019d09334ac6875c287e88a5061b4

SHA256
4361129118bd710bf274307ae95bc1a8a38ef81713716b7793ab8ba5fa7f157c

SHA512
c6ff3867b99cf208ca5b4aa2354cc6b0bbfcdffd095b997906b24bca9fdee8703c8793f71cb3e5b2e5544dfee3253622fee78decef0fcfe2578fda809d60a230

Download Submit
\Windows\system\XzEVmPx.exe

Filesize
3.2MB

MD5
58fe2e0cc348d98923cd644a31afd65a

SHA1
0edbab62b5e8e1f5de4d783ecd16eea248d4c585

SHA256
d2efa7c87f0225c175fbf1bfc246b4b8ef98623d989773a7cab7783347e720c9

SHA512
776c213c62c83fc6e952c6b684edb96d4a3fb9306d739723770d7fdad408f0da243c818068def61ca5549597dd5a883dea543d874dc8fddc8a0fc4933f4c2e0a

Download Submit
\Windows\system\tHBeqbD.exe

Filesize
3.2MB

MD5
6a8d24f8f8da214bdd341971557e19f6

SHA1
e704faafe58449cd34c0727cde345415bc365903

SHA256
2963f3fc0a713db1c940d8afccd5ec8ea96bab1fc97ef4175b56ab2a2d12e774

SHA512
d829ac6a73cec6c66f116fece9f43e7b82b99522b771637b068bff56afeb4e45355f0a5ddffe69806b9cd21889cecc3658a23eca3ac526eb1c1b773a9e5cc184

Download Submit
memory/1148-245-0x000000013F690000-0x000000013FA86000-memory.dmp

Filesize
4.0MB

Download
memory/1148-4635-0x000000013F690000-0x000000013FA86000-memory.dmp

Filesize
4.0MB

Download
memory/1372-4639-0x000000013FE30000-0x0000000140226000-memory.dmp

Filesize
4.0MB

Download
memory/1372-254-0x000000013FE30000-0x0000000140226000-memory.dmp

Filesize
4.0MB

Download
memory/1976-4637-0x000000013FE50000-0x0000000140246000-memory.dmp

Filesize
4.0MB

Download
memory/1976-242-0x000000013FE50000-0x0000000140246000-memory.dmp

Filesize
4.0MB

Download
memory/2052-4636-0x000000013F9C0000-0x000000013FDB6000-memory.dmp

Filesize
4.0MB

Download
memory/2052-249-0x000000013F9C0000-0x000000013FDB6000-memory.dmp

Filesize
4.0MB

Download
memory/2084-4638-0x000000013FBF0000-0x000000013FFE6000-memory.dmp

Filesize
4.0MB

Download
memory/2084-237-0x000000013FBF0000-0x000000013FFE6000-memory.dmp

Filesize
4.0MB

Download
memory/2128-93-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2128-88-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/2128-216-0x000007FEF4F60000-0x000007FEF58FD000-memory.dmp

Filesize
9.6MB

Download
memory/2128-167-0x000007FEF521E000-0x000007FEF521F000-memory.dmp

Filesize
4KB

Download
memory/2372-238-0x000000013FE50000-0x0000000140246000-memory.dmp

Filesize
4.0MB

Download
memory/2372-0-0x0000000000090000-0x00000000000A0000-memory.dmp

Filesize
64KB

Download
memory/2372-246-0x00000000030B0000-0x00000000034A6000-memory.dmp

Filesize
4.0MB

Download
memory/2372-222-0x00000000030B0000-0x00000000034A6000-memory.dmp

Filesize
4.0MB

Download
memory/2372-231-0x00000000030B0000-0x00000000034A6000-memory.dmp

Filesize
4.0MB

Download
memory/2372-250-0x000000013FE30000-0x0000000140226000-memory.dmp

Filesize
4.0MB

Download
memory/2372-224-0x00000000030B0000-0x00000000034A6000-memory.dmp

Filesize
4.0MB

Download
memory/2372-258-0x00000000030B0000-0x00000000034A6000-memory.dmp

Filesize
4.0MB

Download
memory/2372-229-0x000000013F060000-0x000000013F456000-memory.dmp

Filesize
4.0MB

Download
memory/2372-3897-0x00000000030B0000-0x00000000034A6000-memory.dmp

Filesize
4.0MB

Download
memory/2372-3514-0x000000013FE30000-0x0000000140226000-memory.dmp

Filesize
4.0MB

Download
memory/2372-9-0x000000013F0B0000-0x000000013F4A6000-memory.dmp

Filesize
4.0MB

Download
memory/2372-234-0x00000000030B0000-0x00000000034A6000-memory.dmp

Filesize
4.0MB

Download
memory/2372-243-0x00000000030B0000-0x00000000034A6000-memory.dmp

Filesize
4.0MB

Download
memory/2372-1-0x000000013F8F0000-0x000000013FCE6000-memory.dmp

Filesize
4.0MB

Download
memory/2372-2844-0x000000013F8F0000-0x000000013FCE6000-memory.dmp

Filesize
4.0MB

Download
memory/2372-3506-0x00000000030B0000-0x00000000034A6000-memory.dmp

Filesize
4.0MB

Download
memory/2372-3507-0x00000000030B0000-0x00000000034A6000-memory.dmp

Filesize
4.0MB

Download
memory/2548-230-0x000000013F060000-0x000000013F456000-memory.dmp

Filesize
4.0MB

Download
memory/2548-4634-0x000000013F060000-0x000000013F456000-memory.dmp

Filesize
4.0MB

Download
memory/2600-228-0x000000013FC70000-0x0000000140066000-memory.dmp

Filesize
4.0MB

Download
memory/2608-233-0x000000013F8C0000-0x000000013FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/2664-4631-0x000000013F9B0000-0x000000013FDA6000-memory.dmp

Filesize
4.0MB

Download
memory/2664-218-0x000000013F9B0000-0x000000013FDA6000-memory.dmp

Filesize
4.0MB

Download
memory/2804-257-0x000000013F0B0000-0x000000013F4A6000-memory.dmp

Filesize
4.0MB

Download
memory/2836-223-0x000000013F930000-0x000000013FD26000-memory.dmp

Filesize
4.0MB

Download
memory/2936-221-0x000000013F060000-0x000000013F456000-memory.dmp

Filesize
4.0MB

Download