xmrig | 77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
Size

2.4MB
MD5

50475f29c8bea5f61328905f121ed482
SHA1

5f351bbb30184a59249134e3781a5b521c55e035
SHA256

77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8
SHA512

155a661fff72e4eb703a59258cd9aa1b191cd0629d41705c31b115a0218cb1024f170037d76562daa9137c210398a973f8e245be4d20e2c45b6e2d869178bb1c
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMvwWB86c:NABa

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2752-27-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2128-21-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2820-17-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/1664-131-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/2012-129-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2936-127-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/1724-113-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/3040-53-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2636-49-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2568-47-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2820-3439-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2636-3495-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/1724-3491-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2128-3450-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/3040-3524-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2568-3526-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2752-3538-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2012-3539-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2936-3540-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2272-3625-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/1664-3568-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2784	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2820	mposAOB.exe
2752	luqTBqQ.exe
2128	SPUuzRA.exe
2568	NgXjeGD.exe
2636	TzeNksQ.exe
3040	HIxCutq.exe
1724	ViSuPVy.exe
2936	qqnKsnZ.exe
2012	PDerJNM.exe
1664	ayVzOhz.exe
2528	fikbpVP.exe
2932	CNDjZeI.exe
2860	naqgYcD.exe
588	aGVfoEJ.exe
772	ilfGxAz.exe
1764	qZTJUni.exe
580	xqYqYeK.exe
528	dvtQNsI.exe
1008	fwUCpki.exe
2268	KPSfcmf.exe
2536	ELaqwId.exe
2136	pgvfMsd.exe
1148	QjXherP.exe
1160	QvIggcI.exe
1288	SXoaJPi.exe
464	mOqJwUA.exe
780	RhxApRn.exe
2120	LPFtoQW.exe
1708	uhBmpKX.exe
564	KtYxRbf.exe
2996	xRGpNfC.exe
1544	MtKjSzM.exe
272	TXQRRxz.exe
1712	OsoPueb.exe
660	ufLSXMD.exe
1632	BMyaBcv.exe
2512	SgMyyyN.exe
1788	oOjARQV.exe
3060	xVxUBUU.exe
2340	hOROBcM.exe
2328	RsCHyPG.exe
1880	pWGxfla.exe
2456	tLPYMrE.exe
892	tHqnGOz.exe
2220	kWJmBrC.exe
2464	OpIxhkA.exe
1584	hEESiQT.exe
2704	WpdaQaK.exe
2712	TFSunBx.exe
2728	RdfDLge.exe
2764	etLEztL.exe
3036	pYuHOvk.exe
2588	aYEzoDG.exe
3032	ulCqmfP.exe
2948	MiBldOc.exe
2880	teuUFGW.exe
2240	yqJgIWO.exe
1440	kUWYrmB.exe
2360	LzSToIs.exe
2384	kCawmii.exe
1732	OrXCVVX.exe
2912	LjczPOG.exe
1060	eKaFoIz.exe
2540	DuRsnZf.exe

Loads dropped DLL 64 IoCs

pid	Process
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2272-0-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/files/0x00090000000120f9-6.dat	upx
behavioral1/files/0x0008000000016d49-9.dat	upx
behavioral1/files/0x0009000000016d5a-12.dat	upx
behavioral1/memory/2752-27-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/2128-21-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2820-17-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/files/0x0007000000004e74-39.dat	upx
behavioral1/files/0x0008000000017342-42.dat	upx
behavioral1/files/0x0008000000016d71-35.dat	upx
behavioral1/files/0x0006000000019214-117.dat	upx
behavioral1/files/0x0006000000019369-136.dat	upx
behavioral1/files/0x000600000001937b-145.dat	upx
behavioral1/files/0x0006000000019382-154.dat	upx
behavioral1/files/0x00060000000193f0-178.dat	upx
behavioral1/files/0x000600000001945c-184.dat	upx
behavioral1/files/0x00050000000194e2-193.dat	upx
behavioral1/files/0x00060000000193e6-174.dat	upx
behavioral1/files/0x000600000001948d-187.dat	upx
behavioral1/files/0x00060000000193a8-164.dat	upx
behavioral1/files/0x00060000000193d1-169.dat	upx
behavioral1/files/0x000600000001938e-159.dat	upx
behavioral1/files/0x0006000000019371-141.dat	upx
behavioral1/memory/1664-131-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/memory/2012-129-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2936-127-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/files/0x0006000000019329-125.dat	upx
behavioral1/files/0x0030000000016ce8-121.dat	upx
behavioral1/files/0x0009000000017355-95.dat	upx
behavioral1/files/0x000600000001921d-92.dat	upx
behavioral1/files/0x00060000000191df-77.dat	upx
behavioral1/memory/1724-113-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/files/0x0006000000019345-110.dat	upx
behavioral1/files/0x00060000000191cf-109.dat	upx
behavioral1/files/0x0006000000019232-99.dat	upx
behavioral1/files/0x0006000000019219-90.dat	upx
behavioral1/memory/3040-53-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/files/0x00060000000191f8-81.dat	upx
behavioral1/memory/2636-49-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2568-47-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/files/0x00060000000191d1-73.dat	upx
behavioral1/files/0x000800000001739f-64.dat	upx
behavioral1/files/0x0007000000017349-58.dat	upx
behavioral1/memory/2820-3439-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/memory/2636-3495-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/1724-3491-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/2128-3450-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/3040-3524-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/memory/2568-3526-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2752-3538-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/2012-3539-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2936-3540-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2272-3625-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/1664-3568-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\aIqNcLU.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\bWyvHap.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\CcJOvOA.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\hlapfHx.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\qMzKVle.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\HrMMkUN.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\nSeQAtR.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\IgllNTM.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\DxSfaDO.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\bOsUzjp.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\LxPnERP.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\tVrEftC.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\wHIbhSi.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\Dgmtixo.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\KTQsyXe.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\RVvzjKM.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\EpZscrw.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\RPHbOPF.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\IxjEdGA.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\ZidOwvm.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\oWGHFpY.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\nAUgthZ.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\hpAosXJ.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\NUAqNkC.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\EsCtKJi.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\ZbEfUXu.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\OzMZDsH.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\ZUrNVwp.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\fxnhdmb.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\bCkxJcy.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\JoxLQjf.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\UIQGvkG.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\vavVpBk.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\PFsoDAs.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\MZyihGA.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\MdSXTfe.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\UIyaSDI.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\dQNevmF.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\OxWcAYc.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\qZNfOjZ.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\JTIGSgc.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\yzEpOzr.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\NTiKGjR.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\EDrsOYF.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\JdrwWZR.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\CqWdsoS.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\zvGsIXs.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\IxvbqjO.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\KEkbEiC.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\QzyDENS.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\oyzhWQB.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\jydhraq.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\SuoPioJ.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\wVmRwTF.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\oecpBvT.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\qsVPOGh.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\XwqbncP.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\sjMKxcZ.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\UCdBWKi.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\hplOGsB.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\bEDzGjc.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\rnRPjQh.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\VhAlvXk.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
File created	C:\Windows\System\xUVmypA.exe	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2784	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
Token: SeLockMemoryPrivilege	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
Token: SeDebugPrivilege	2784	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2784	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	32
PID 2272 wrote to memory of 2784	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	32
PID 2272 wrote to memory of 2784	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	32
PID 2272 wrote to memory of 2820	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	33
PID 2272 wrote to memory of 2820	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	33
PID 2272 wrote to memory of 2820	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	33
PID 2272 wrote to memory of 2752	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	34
PID 2272 wrote to memory of 2752	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	34
PID 2272 wrote to memory of 2752	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	34
PID 2272 wrote to memory of 2128	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	35
PID 2272 wrote to memory of 2128	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	35
PID 2272 wrote to memory of 2128	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	35
PID 2272 wrote to memory of 2568	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	36
PID 2272 wrote to memory of 2568	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	36
PID 2272 wrote to memory of 2568	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	36
PID 2272 wrote to memory of 2636	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	37
PID 2272 wrote to memory of 2636	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	37
PID 2272 wrote to memory of 2636	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	37
PID 2272 wrote to memory of 3040	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	38
PID 2272 wrote to memory of 3040	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	38
PID 2272 wrote to memory of 3040	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	38
PID 2272 wrote to memory of 1724	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	39
PID 2272 wrote to memory of 1724	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	39
PID 2272 wrote to memory of 1724	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	39
PID 2272 wrote to memory of 2932	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	40
PID 2272 wrote to memory of 2932	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	40
PID 2272 wrote to memory of 2932	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	40
PID 2272 wrote to memory of 2936	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	41
PID 2272 wrote to memory of 2936	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	41
PID 2272 wrote to memory of 2936	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	41
PID 2272 wrote to memory of 588	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	42
PID 2272 wrote to memory of 588	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	42
PID 2272 wrote to memory of 588	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	42
PID 2272 wrote to memory of 2012	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	43
PID 2272 wrote to memory of 2012	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	43
PID 2272 wrote to memory of 2012	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	43
PID 2272 wrote to memory of 1764	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	44
PID 2272 wrote to memory of 1764	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	44
PID 2272 wrote to memory of 1764	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	44
PID 2272 wrote to memory of 1664	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	45
PID 2272 wrote to memory of 1664	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	45
PID 2272 wrote to memory of 1664	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	45
PID 2272 wrote to memory of 580	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	46
PID 2272 wrote to memory of 580	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	46
PID 2272 wrote to memory of 580	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	46
PID 2272 wrote to memory of 2528	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	47
PID 2272 wrote to memory of 2528	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	47
PID 2272 wrote to memory of 2528	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	47
PID 2272 wrote to memory of 528	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	48
PID 2272 wrote to memory of 528	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	48
PID 2272 wrote to memory of 528	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	48
PID 2272 wrote to memory of 2860	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	49
PID 2272 wrote to memory of 2860	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	49
PID 2272 wrote to memory of 2860	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	49
PID 2272 wrote to memory of 1008	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	50
PID 2272 wrote to memory of 1008	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	50
PID 2272 wrote to memory of 1008	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	50
PID 2272 wrote to memory of 772	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	51
PID 2272 wrote to memory of 772	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	51
PID 2272 wrote to memory of 772	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	51
PID 2272 wrote to memory of 2536	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	52
PID 2272 wrote to memory of 2536	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	52
PID 2272 wrote to memory of 2536	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	52
PID 2272 wrote to memory of 2268	2272	77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe	53

C:\Users\Admin\AppData\Local\Temp\77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe
"C:\Users\Admin\AppData\Local\Temp\77b0ba1acd3f2efe8bc76055e95b5768890f2c38883de33b49a6ea95f827e7c8.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\System\mposAOB.exe
  C:\Windows\System\mposAOB.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\luqTBqQ.exe
  C:\Windows\System\luqTBqQ.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\SPUuzRA.exe
  C:\Windows\System\SPUuzRA.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\NgXjeGD.exe
  C:\Windows\System\NgXjeGD.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\TzeNksQ.exe
  C:\Windows\System\TzeNksQ.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\HIxCutq.exe
  C:\Windows\System\HIxCutq.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\ViSuPVy.exe
  C:\Windows\System\ViSuPVy.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\CNDjZeI.exe
  C:\Windows\System\CNDjZeI.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\qqnKsnZ.exe
  C:\Windows\System\qqnKsnZ.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\aGVfoEJ.exe
  C:\Windows\System\aGVfoEJ.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\PDerJNM.exe
  C:\Windows\System\PDerJNM.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\qZTJUni.exe
  C:\Windows\System\qZTJUni.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\ayVzOhz.exe
  C:\Windows\System\ayVzOhz.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\xqYqYeK.exe
  C:\Windows\System\xqYqYeK.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\fikbpVP.exe
  C:\Windows\System\fikbpVP.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\dvtQNsI.exe
  C:\Windows\System\dvtQNsI.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\naqgYcD.exe
  C:\Windows\System\naqgYcD.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\fwUCpki.exe
  C:\Windows\System\fwUCpki.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\ilfGxAz.exe
  C:\Windows\System\ilfGxAz.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\ELaqwId.exe
  C:\Windows\System\ELaqwId.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\KPSfcmf.exe
  C:\Windows\System\KPSfcmf.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\pgvfMsd.exe
  C:\Windows\System\pgvfMsd.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\QjXherP.exe
  C:\Windows\System\QjXherP.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\QvIggcI.exe
  C:\Windows\System\QvIggcI.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\SXoaJPi.exe
  C:\Windows\System\SXoaJPi.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\mOqJwUA.exe
  C:\Windows\System\mOqJwUA.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\RhxApRn.exe
  C:\Windows\System\RhxApRn.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\LPFtoQW.exe
  C:\Windows\System\LPFtoQW.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\uhBmpKX.exe
  C:\Windows\System\uhBmpKX.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\KtYxRbf.exe
  C:\Windows\System\KtYxRbf.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\xRGpNfC.exe
  C:\Windows\System\xRGpNfC.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\MtKjSzM.exe
  C:\Windows\System\MtKjSzM.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\TXQRRxz.exe
  C:\Windows\System\TXQRRxz.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\OsoPueb.exe
  C:\Windows\System\OsoPueb.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\ufLSXMD.exe
  C:\Windows\System\ufLSXMD.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\SgMyyyN.exe
  C:\Windows\System\SgMyyyN.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\BMyaBcv.exe
  C:\Windows\System\BMyaBcv.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\oOjARQV.exe
  C:\Windows\System\oOjARQV.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\xVxUBUU.exe
  C:\Windows\System\xVxUBUU.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\hOROBcM.exe
  C:\Windows\System\hOROBcM.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\RsCHyPG.exe
  C:\Windows\System\RsCHyPG.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\pWGxfla.exe
  C:\Windows\System\pWGxfla.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\tLPYMrE.exe
  C:\Windows\System\tLPYMrE.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\tHqnGOz.exe
  C:\Windows\System\tHqnGOz.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\kWJmBrC.exe
  C:\Windows\System\kWJmBrC.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\OpIxhkA.exe
  C:\Windows\System\OpIxhkA.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\hEESiQT.exe
  C:\Windows\System\hEESiQT.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\WpdaQaK.exe
  C:\Windows\System\WpdaQaK.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\TFSunBx.exe
  C:\Windows\System\TFSunBx.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\etLEztL.exe
  C:\Windows\System\etLEztL.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\RdfDLge.exe
  C:\Windows\System\RdfDLge.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\aYEzoDG.exe
  C:\Windows\System\aYEzoDG.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\pYuHOvk.exe
  C:\Windows\System\pYuHOvk.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\MiBldOc.exe
  C:\Windows\System\MiBldOc.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\ulCqmfP.exe
  C:\Windows\System\ulCqmfP.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\teuUFGW.exe
  C:\Windows\System\teuUFGW.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\yqJgIWO.exe
  C:\Windows\System\yqJgIWO.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\kUWYrmB.exe
  C:\Windows\System\kUWYrmB.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\LzSToIs.exe
  C:\Windows\System\LzSToIs.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\kCawmii.exe
  C:\Windows\System\kCawmii.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\OrXCVVX.exe
  C:\Windows\System\OrXCVVX.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\LjczPOG.exe
  C:\Windows\System\LjczPOG.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\eKaFoIz.exe
  C:\Windows\System\eKaFoIz.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\rqrHKnz.exe
  C:\Windows\System\rqrHKnz.exe
  2⤵
  PID:2364
- C:\Windows\System\DuRsnZf.exe
  C:\Windows\System\DuRsnZf.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\gMQGyIr.exe
  C:\Windows\System\gMQGyIr.exe
  2⤵
  PID:596
- C:\Windows\System\HaQwmNA.exe
  C:\Windows\System\HaQwmNA.exe
  2⤵
  PID:1960
- C:\Windows\System\qVGbbwj.exe
  C:\Windows\System\qVGbbwj.exe
  2⤵
  PID:2192
- C:\Windows\System\HJEZANL.exe
  C:\Windows\System\HJEZANL.exe
  2⤵
  PID:2816
- C:\Windows\System\OZWIapm.exe
  C:\Windows\System\OZWIapm.exe
  2⤵
  PID:1792
- C:\Windows\System\RwMunoB.exe
  C:\Windows\System\RwMunoB.exe
  2⤵
  PID:2516
- C:\Windows\System\GrntCuX.exe
  C:\Windows\System\GrntCuX.exe
  2⤵
  PID:788
- C:\Windows\System\rxvfaOn.exe
  C:\Windows\System\rxvfaOn.exe
  2⤵
  PID:1256
- C:\Windows\System\NAffbFy.exe
  C:\Windows\System\NAffbFy.exe
  2⤵
  PID:1804
- C:\Windows\System\WvyfNpp.exe
  C:\Windows\System\WvyfNpp.exe
  2⤵
  PID:1292
- C:\Windows\System\WiQmMGq.exe
  C:\Windows\System\WiQmMGq.exe
  2⤵
  PID:2420
- C:\Windows\System\nUFYzoi.exe
  C:\Windows\System\nUFYzoi.exe
  2⤵
  PID:1656
- C:\Windows\System\CTScPFh.exe
  C:\Windows\System\CTScPFh.exe
  2⤵
  PID:2028
- C:\Windows\System\YkvuJuD.exe
  C:\Windows\System\YkvuJuD.exe
  2⤵
  PID:2424
- C:\Windows\System\sdaLgvN.exe
  C:\Windows\System\sdaLgvN.exe
  2⤵
  PID:1868
- C:\Windows\System\AOgsFSx.exe
  C:\Windows\System\AOgsFSx.exe
  2⤵
  PID:1200
- C:\Windows\System\ldemeyU.exe
  C:\Windows\System\ldemeyU.exe
  2⤵
  PID:1852
- C:\Windows\System\HIRGKxk.exe
  C:\Windows\System\HIRGKxk.exe
  2⤵
  PID:2444
- C:\Windows\System\HxRXimY.exe
  C:\Windows\System\HxRXimY.exe
  2⤵
  PID:868
- C:\Windows\System\yLnuQMT.exe
  C:\Windows\System\yLnuQMT.exe
  2⤵
  PID:552
- C:\Windows\System\jneBanl.exe
  C:\Windows\System\jneBanl.exe
  2⤵
  PID:2848
- C:\Windows\System\ElrWEaX.exe
  C:\Windows\System\ElrWEaX.exe
  2⤵
  PID:2956
- C:\Windows\System\mooaFrR.exe
  C:\Windows\System\mooaFrR.exe
  2⤵
  PID:2660
- C:\Windows\System\AtaPiql.exe
  C:\Windows\System\AtaPiql.exe
  2⤵
  PID:2720
- C:\Windows\System\fDUGUlQ.exe
  C:\Windows\System\fDUGUlQ.exe
  2⤵
  PID:2680
- C:\Windows\System\TNWxSFj.exe
  C:\Windows\System\TNWxSFj.exe
  2⤵
  PID:1320
- C:\Windows\System\PnFPqTD.exe
  C:\Windows\System\PnFPqTD.exe
  2⤵
  PID:2868
- C:\Windows\System\tCqHCYH.exe
  C:\Windows\System\tCqHCYH.exe
  2⤵
  PID:1152
- C:\Windows\System\gmxzSyL.exe
  C:\Windows\System\gmxzSyL.exe
  2⤵
  PID:2852
- C:\Windows\System\yZXPgnG.exe
  C:\Windows\System\yZXPgnG.exe
  2⤵
  PID:2944
- C:\Windows\System\xsWhtcW.exe
  C:\Windows\System\xsWhtcW.exe
  2⤵
  PID:2564
- C:\Windows\System\muSeeHK.exe
  C:\Windows\System\muSeeHK.exe
  2⤵
  PID:444
- C:\Windows\System\chcwlVt.exe
  C:\Windows\System\chcwlVt.exe
  2⤵
  PID:2576
- C:\Windows\System\BNFVINz.exe
  C:\Windows\System\BNFVINz.exe
  2⤵
  PID:1260
- C:\Windows\System\sMNCpGw.exe
  C:\Windows\System\sMNCpGw.exe
  2⤵
  PID:1380
- C:\Windows\System\VTEGGTH.exe
  C:\Windows\System\VTEGGTH.exe
  2⤵
  PID:1252
- C:\Windows\System\DVmnYbb.exe
  C:\Windows\System\DVmnYbb.exe
  2⤵
  PID:1692
- C:\Windows\System\jfOjcVL.exe
  C:\Windows\System\jfOjcVL.exe
  2⤵
  PID:1780
- C:\Windows\System\iceyUxR.exe
  C:\Windows\System\iceyUxR.exe
  2⤵
  PID:2000
- C:\Windows\System\EItGYws.exe
  C:\Windows\System\EItGYws.exe
  2⤵
  PID:2144
- C:\Windows\System\vRQtHNc.exe
  C:\Windows\System\vRQtHNc.exe
  2⤵
  PID:1648
- C:\Windows\System\oBSIoVO.exe
  C:\Windows\System\oBSIoVO.exe
  2⤵
  PID:696
- C:\Windows\System\sMqHNGX.exe
  C:\Windows\System\sMqHNGX.exe
  2⤵
  PID:2556
- C:\Windows\System\jAwZBPD.exe
  C:\Windows\System\jAwZBPD.exe
  2⤵
  PID:2800
- C:\Windows\System\mzSGuQT.exe
  C:\Windows\System\mzSGuQT.exe
  2⤵
  PID:568
- C:\Windows\System\wYAWkZx.exe
  C:\Windows\System\wYAWkZx.exe
  2⤵
  PID:3028
- C:\Windows\System\JUOwZKM.exe
  C:\Windows\System\JUOwZKM.exe
  2⤵
  PID:2608
- C:\Windows\System\ZWpqavx.exe
  C:\Windows\System\ZWpqavx.exe
  2⤵
  PID:1716
- C:\Windows\System\CIHZfDE.exe
  C:\Windows\System\CIHZfDE.exe
  2⤵
  PID:2372
- C:\Windows\System\sXXBGSe.exe
  C:\Windows\System\sXXBGSe.exe
  2⤵
  PID:1876
- C:\Windows\System\lQggSwX.exe
  C:\Windows\System\lQggSwX.exe
  2⤵
  PID:1908
- C:\Windows\System\KtoGCVZ.exe
  C:\Windows\System\KtoGCVZ.exe
  2⤵
  PID:2292
- C:\Windows\System\CTlEJnf.exe
  C:\Windows\System\CTlEJnf.exe
  2⤵
  PID:1364
- C:\Windows\System\JXmBcsO.exe
  C:\Windows\System\JXmBcsO.exe
  2⤵
  PID:964
- C:\Windows\System\kTwUMmO.exe
  C:\Windows\System\kTwUMmO.exe
  2⤵
  PID:112
- C:\Windows\System\GkmQxHN.exe
  C:\Windows\System\GkmQxHN.exe
  2⤵
  PID:3068
- C:\Windows\System\xztVDiT.exe
  C:\Windows\System\xztVDiT.exe
  2⤵
  PID:2324
- C:\Windows\System\dBygJii.exe
  C:\Windows\System\dBygJii.exe
  2⤵
  PID:2016
- C:\Windows\System\DehNcWL.exe
  C:\Windows\System\DehNcWL.exe
  2⤵
  PID:2732
- C:\Windows\System\rgepFwL.exe
  C:\Windows\System\rgepFwL.exe
  2⤵
  PID:636
- C:\Windows\System\DYBkAya.exe
  C:\Windows\System\DYBkAya.exe
  2⤵
  PID:760
- C:\Windows\System\btHYoHh.exe
  C:\Windows\System\btHYoHh.exe
  2⤵
  PID:3048
- C:\Windows\System\nHLAeum.exe
  C:\Windows\System\nHLAeum.exe
  2⤵
  PID:1244
- C:\Windows\System\eEUGmjJ.exe
  C:\Windows\System\eEUGmjJ.exe
  2⤵
  PID:2052
- C:\Windows\System\bMXFQQN.exe
  C:\Windows\System\bMXFQQN.exe
  2⤵
  PID:2864
- C:\Windows\System\THAmFCH.exe
  C:\Windows\System\THAmFCH.exe
  2⤵
  PID:884
- C:\Windows\System\oPkIYLk.exe
  C:\Windows\System\oPkIYLk.exe
  2⤵
  PID:2232
- C:\Windows\System\bqPZyas.exe
  C:\Windows\System\bqPZyas.exe
  2⤵
  PID:1472
- C:\Windows\System\SKxQibD.exe
  C:\Windows\System\SKxQibD.exe
  2⤵
  PID:2132
- C:\Windows\System\zPIAKKX.exe
  C:\Windows\System\zPIAKKX.exe
  2⤵
  PID:1120
- C:\Windows\System\FAjPrzH.exe
  C:\Windows\System\FAjPrzH.exe
  2⤵
  PID:520
- C:\Windows\System\ZhgtApx.exe
  C:\Windows\System\ZhgtApx.exe
  2⤵
  PID:1752
- C:\Windows\System\npZXDfs.exe
  C:\Windows\System\npZXDfs.exe
  2⤵
  PID:1744
- C:\Windows\System\hyRrVCU.exe
  C:\Windows\System\hyRrVCU.exe
  2⤵
  PID:1044
- C:\Windows\System\znYFmLm.exe
  C:\Windows\System\znYFmLm.exe
  2⤵
  PID:2224
- C:\Windows\System\DqSVRkq.exe
  C:\Windows\System\DqSVRkq.exe
  2⤵
  PID:1700
- C:\Windows\System\FNrHUmE.exe
  C:\Windows\System\FNrHUmE.exe
  2⤵
  PID:1972
- C:\Windows\System\HvHOJXj.exe
  C:\Windows\System\HvHOJXj.exe
  2⤵
  PID:2596
- C:\Windows\System\vavVpBk.exe
  C:\Windows\System\vavVpBk.exe
  2⤵
  PID:1616
- C:\Windows\System\SCNFafK.exe
  C:\Windows\System\SCNFafK.exe
  2⤵
  PID:1392
- C:\Windows\System\JcgNxcw.exe
  C:\Windows\System\JcgNxcw.exe
  2⤵
  PID:1636
- C:\Windows\System\nGLhszT.exe
  C:\Windows\System\nGLhszT.exe
  2⤵
  PID:1336
- C:\Windows\System\DHSeSOS.exe
  C:\Windows\System\DHSeSOS.exe
  2⤵
  PID:1128
- C:\Windows\System\yRoBVYt.exe
  C:\Windows\System\yRoBVYt.exe
  2⤵
  PID:2840
- C:\Windows\System\qumIzId.exe
  C:\Windows\System\qumIzId.exe
  2⤵
  PID:996
- C:\Windows\System\ezugSkq.exe
  C:\Windows\System\ezugSkq.exe
  2⤵
  PID:1608
- C:\Windows\System\SgcQbLM.exe
  C:\Windows\System\SgcQbLM.exe
  2⤵
  PID:2160
- C:\Windows\System\KQSWzkP.exe
  C:\Windows\System\KQSWzkP.exe
  2⤵
  PID:1480
- C:\Windows\System\bcTbdXy.exe
  C:\Windows\System\bcTbdXy.exe
  2⤵
  PID:1432
- C:\Windows\System\ELCWMOa.exe
  C:\Windows\System\ELCWMOa.exe
  2⤵
  PID:2928
- C:\Windows\System\RgvGIgj.exe
  C:\Windows\System\RgvGIgj.exe
  2⤵
  PID:108
- C:\Windows\System\zaCzpwC.exe
  C:\Windows\System\zaCzpwC.exe
  2⤵
  PID:3076
- C:\Windows\System\TXQjCTj.exe
  C:\Windows\System\TXQjCTj.exe
  2⤵
  PID:3092
- C:\Windows\System\cmNLNuW.exe
  C:\Windows\System\cmNLNuW.exe
  2⤵
  PID:3108
- C:\Windows\System\QDHOJxH.exe
  C:\Windows\System\QDHOJxH.exe
  2⤵
  PID:3124
- C:\Windows\System\ZzuBLxK.exe
  C:\Windows\System\ZzuBLxK.exe
  2⤵
  PID:3140
- C:\Windows\System\kdEJKcy.exe
  C:\Windows\System\kdEJKcy.exe
  2⤵
  PID:3160
- C:\Windows\System\jGDJxSN.exe
  C:\Windows\System\jGDJxSN.exe
  2⤵
  PID:3176
- C:\Windows\System\jsfQsBK.exe
  C:\Windows\System\jsfQsBK.exe
  2⤵
  PID:3192
- C:\Windows\System\IFDqwyF.exe
  C:\Windows\System\IFDqwyF.exe
  2⤵
  PID:3208
- C:\Windows\System\AhyktRR.exe
  C:\Windows\System\AhyktRR.exe
  2⤵
  PID:3224
- C:\Windows\System\ryFrfkF.exe
  C:\Windows\System\ryFrfkF.exe
  2⤵
  PID:3244
- C:\Windows\System\mAomgKV.exe
  C:\Windows\System\mAomgKV.exe
  2⤵
  PID:3260
- C:\Windows\System\RcNolEF.exe
  C:\Windows\System\RcNolEF.exe
  2⤵
  PID:3276
- C:\Windows\System\QvycHsb.exe
  C:\Windows\System\QvycHsb.exe
  2⤵
  PID:3292
- C:\Windows\System\SZCEVEP.exe
  C:\Windows\System\SZCEVEP.exe
  2⤵
  PID:3308
- C:\Windows\System\QedlUdb.exe
  C:\Windows\System\QedlUdb.exe
  2⤵
  PID:3324
- C:\Windows\System\ldicZXD.exe
  C:\Windows\System\ldicZXD.exe
  2⤵
  PID:3344
- C:\Windows\System\HqaEXPG.exe
  C:\Windows\System\HqaEXPG.exe
  2⤵
  PID:3360
- C:\Windows\System\flFzFYf.exe
  C:\Windows\System\flFzFYf.exe
  2⤵
  PID:3376
- C:\Windows\System\vSgaqjo.exe
  C:\Windows\System\vSgaqjo.exe
  2⤵
  PID:3392
- C:\Windows\System\gNfoYXt.exe
  C:\Windows\System\gNfoYXt.exe
  2⤵
  PID:3412
- C:\Windows\System\IDrmUqj.exe
  C:\Windows\System\IDrmUqj.exe
  2⤵
  PID:3428
- C:\Windows\System\tJQaKkY.exe
  C:\Windows\System\tJQaKkY.exe
  2⤵
  PID:3444
- C:\Windows\System\hlLfQHr.exe
  C:\Windows\System\hlLfQHr.exe
  2⤵
  PID:3460
- C:\Windows\System\pVNkcGg.exe
  C:\Windows\System\pVNkcGg.exe
  2⤵
  PID:3480
- C:\Windows\System\ahmUsgR.exe
  C:\Windows\System\ahmUsgR.exe
  2⤵
  PID:3496
- C:\Windows\System\ZVwSpfG.exe
  C:\Windows\System\ZVwSpfG.exe
  2⤵
  PID:3512
- C:\Windows\System\mumzUbw.exe
  C:\Windows\System\mumzUbw.exe
  2⤵
  PID:3528
- C:\Windows\System\HvlBsKQ.exe
  C:\Windows\System\HvlBsKQ.exe
  2⤵
  PID:3544
- C:\Windows\System\lFgOJWu.exe
  C:\Windows\System\lFgOJWu.exe
  2⤵
  PID:3560
- C:\Windows\System\NFrsMFF.exe
  C:\Windows\System\NFrsMFF.exe
  2⤵
  PID:3580
- C:\Windows\System\bnmPZMk.exe
  C:\Windows\System\bnmPZMk.exe
  2⤵
  PID:3596
- C:\Windows\System\rTULujR.exe
  C:\Windows\System\rTULujR.exe
  2⤵
  PID:3612
- C:\Windows\System\sCbDTED.exe
  C:\Windows\System\sCbDTED.exe
  2⤵
  PID:3628
- C:\Windows\System\eQzFDhH.exe
  C:\Windows\System\eQzFDhH.exe
  2⤵
  PID:3644
- C:\Windows\System\yjgVqJo.exe
  C:\Windows\System\yjgVqJo.exe
  2⤵
  PID:3660
- C:\Windows\System\aalSckf.exe
  C:\Windows\System\aalSckf.exe
  2⤵
  PID:3676
- C:\Windows\System\yHxEffc.exe
  C:\Windows\System\yHxEffc.exe
  2⤵
  PID:3692
- C:\Windows\System\bTVPVjI.exe
  C:\Windows\System\bTVPVjI.exe
  2⤵
  PID:3716
- C:\Windows\System\gCzKQxs.exe
  C:\Windows\System\gCzKQxs.exe
  2⤵
  PID:3732
- C:\Windows\System\lNtkNMz.exe
  C:\Windows\System\lNtkNMz.exe
  2⤵
  PID:3748
- C:\Windows\System\IQjOZoL.exe
  C:\Windows\System\IQjOZoL.exe
  2⤵
  PID:3768
- C:\Windows\System\Zaugkrl.exe
  C:\Windows\System\Zaugkrl.exe
  2⤵
  PID:3784
- C:\Windows\System\PEDFyxu.exe
  C:\Windows\System\PEDFyxu.exe
  2⤵
  PID:3800
- C:\Windows\System\plLpgKi.exe
  C:\Windows\System\plLpgKi.exe
  2⤵
  PID:3816
- C:\Windows\System\DEjuQNl.exe
  C:\Windows\System\DEjuQNl.exe
  2⤵
  PID:3836
- C:\Windows\System\SgpKXPW.exe
  C:\Windows\System\SgpKXPW.exe
  2⤵
  PID:3852
- C:\Windows\System\GxWqgje.exe
  C:\Windows\System\GxWqgje.exe
  2⤵
  PID:3868
- C:\Windows\System\riiWpFR.exe
  C:\Windows\System\riiWpFR.exe
  2⤵
  PID:3884
- C:\Windows\System\EoyUsnQ.exe
  C:\Windows\System\EoyUsnQ.exe
  2⤵
  PID:3900
- C:\Windows\System\raaYAhw.exe
  C:\Windows\System\raaYAhw.exe
  2⤵
  PID:3920
- C:\Windows\System\plwvbta.exe
  C:\Windows\System\plwvbta.exe
  2⤵
  PID:4012
- C:\Windows\System\RDfIOfs.exe
  C:\Windows\System\RDfIOfs.exe
  2⤵
  PID:3240
- C:\Windows\System\tlmAMIK.exe
  C:\Windows\System\tlmAMIK.exe
  2⤵
  PID:3320
- C:\Windows\System\anCxWFx.exe
  C:\Windows\System\anCxWFx.exe
  2⤵
  PID:3388
- C:\Windows\System\kNppuNZ.exe
  C:\Windows\System\kNppuNZ.exe
  2⤵
  PID:3456
- C:\Windows\System\GaurnkS.exe
  C:\Windows\System\GaurnkS.exe
  2⤵
  PID:3524
- C:\Windows\System\qjJBMrO.exe
  C:\Windows\System\qjJBMrO.exe
  2⤵
  PID:3592
- C:\Windows\System\wdfUrQZ.exe
  C:\Windows\System\wdfUrQZ.exe
  2⤵
  PID:3684
- C:\Windows\System\WOQqqkR.exe
  C:\Windows\System\WOQqqkR.exe
  2⤵
  PID:3756
- C:\Windows\System\yngWqtW.exe
  C:\Windows\System\yngWqtW.exe
  2⤵
  PID:3796
- C:\Windows\System\Timrktu.exe
  C:\Windows\System\Timrktu.exe
  2⤵
  PID:3864
- C:\Windows\System\IJDbDDT.exe
  C:\Windows\System\IJDbDDT.exe
  2⤵
  PID:3940
- C:\Windows\System\ohrbIDA.exe
  C:\Windows\System\ohrbIDA.exe
  2⤵
  PID:2092
- C:\Windows\System\txTUEPj.exe
  C:\Windows\System\txTUEPj.exe
  2⤵
  PID:2664
- C:\Windows\System\PRVQlLU.exe
  C:\Windows\System\PRVQlLU.exe
  2⤵
  PID:1600
- C:\Windows\System\PLhdhbX.exe
  C:\Windows\System\PLhdhbX.exe
  2⤵
  PID:1068
- C:\Windows\System\HwDHiqy.exe
  C:\Windows\System\HwDHiqy.exe
  2⤵
  PID:1776
- C:\Windows\System\eXEJele.exe
  C:\Windows\System\eXEJele.exe
  2⤵
  PID:3132
- C:\Windows\System\AfoGXVN.exe
  C:\Windows\System\AfoGXVN.exe
  2⤵
  PID:3200
- C:\Windows\System\YeqwEbF.exe
  C:\Windows\System\YeqwEbF.exe
  2⤵
  PID:3268
- C:\Windows\System\rVsvFzZ.exe
  C:\Windows\System\rVsvFzZ.exe
  2⤵
  PID:3332
- C:\Windows\System\KiZdEmV.exe
  C:\Windows\System\KiZdEmV.exe
  2⤵
  PID:3372
- C:\Windows\System\iJcapBU.exe
  C:\Windows\System\iJcapBU.exe
  2⤵
  PID:3436
- C:\Windows\System\EKXywSc.exe
  C:\Windows\System\EKXywSc.exe
  2⤵
  PID:3476
- C:\Windows\System\iYyZREP.exe
  C:\Windows\System\iYyZREP.exe
  2⤵
  PID:3540
- C:\Windows\System\rMIGRyX.exe
  C:\Windows\System\rMIGRyX.exe
  2⤵
  PID:3604
- C:\Windows\System\cfcgxtN.exe
  C:\Windows\System\cfcgxtN.exe
  2⤵
  PID:3668
- C:\Windows\System\HQevYLB.exe
  C:\Windows\System\HQevYLB.exe
  2⤵
  PID:3780
- C:\Windows\System\pkWoJCv.exe
  C:\Windows\System\pkWoJCv.exe
  2⤵
  PID:4076
- C:\Windows\System\OgpavUw.exe
  C:\Windows\System\OgpavUw.exe
  2⤵
  PID:2396
- C:\Windows\System\tRQoTxB.exe
  C:\Windows\System\tRQoTxB.exe
  2⤵
  PID:3284
- C:\Windows\System\nOBKRCV.exe
  C:\Windows\System\nOBKRCV.exe
  2⤵
  PID:3252
- C:\Windows\System\VbBgxRq.exe
  C:\Windows\System\VbBgxRq.exe
  2⤵
  PID:1896
- C:\Windows\System\HoKcaKd.exe
  C:\Windows\System\HoKcaKd.exe
  2⤵
  PID:3120
- C:\Windows\System\xYvqKpF.exe
  C:\Windows\System\xYvqKpF.exe
  2⤵
  PID:3220
- C:\Windows\System\OxscQLB.exe
  C:\Windows\System\OxscQLB.exe
  2⤵
  PID:3588
- C:\Windows\System\HOHUNOI.exe
  C:\Windows\System\HOHUNOI.exe
  2⤵
  PID:3828
- C:\Windows\System\wnCiisa.exe
  C:\Windows\System\wnCiisa.exe
  2⤵
  PID:3216
- C:\Windows\System\vDeWDfk.exe
  C:\Windows\System\vDeWDfk.exe
  2⤵
  PID:3860
- C:\Windows\System\SkEFyRd.exe
  C:\Windows\System\SkEFyRd.exe
  2⤵
  PID:3792
- C:\Windows\System\jEkXKYE.exe
  C:\Windows\System\jEkXKYE.exe
  2⤵
  PID:3300
- C:\Windows\System\yjKwfci.exe
  C:\Windows\System\yjKwfci.exe
  2⤵
  PID:3812
- C:\Windows\System\YtreEOP.exe
  C:\Windows\System\YtreEOP.exe
  2⤵
  PID:3908
- C:\Windows\System\hXzFrID.exe
  C:\Windows\System\hXzFrID.exe
  2⤵
  PID:616
- C:\Windows\System\YplOhlJ.exe
  C:\Windows\System\YplOhlJ.exe
  2⤵
  PID:3916
- C:\Windows\System\BJLlcAN.exe
  C:\Windows\System\BJLlcAN.exe
  2⤵
  PID:4028
- C:\Windows\System\iAbjSJb.exe
  C:\Windows\System\iAbjSJb.exe
  2⤵
  PID:4036
- C:\Windows\System\qLEnBiV.exe
  C:\Windows\System\qLEnBiV.exe
  2⤵
  PID:3104
- C:\Windows\System\YGsOgVk.exe
  C:\Windows\System\YGsOgVk.exe
  2⤵
  PID:4060
- C:\Windows\System\vOsvhIp.exe
  C:\Windows\System\vOsvhIp.exe
  2⤵
  PID:3704
- C:\Windows\System\zBHvDIS.exe
  C:\Windows\System\zBHvDIS.exe
  2⤵
  PID:2692
- C:\Windows\System\ViVMrpf.exe
  C:\Windows\System\ViVMrpf.exe
  2⤵
  PID:1860
- C:\Windows\System\htxSzqt.exe
  C:\Windows\System\htxSzqt.exe
  2⤵
  PID:3288
- C:\Windows\System\KPkTpqc.exe
  C:\Windows\System\KPkTpqc.exe
  2⤵
  PID:3724
- C:\Windows\System\ufmZPYE.exe
  C:\Windows\System\ufmZPYE.exe
  2⤵
  PID:3168
- C:\Windows\System\henhByA.exe
  C:\Windows\System\henhByA.exe
  2⤵
  PID:3572
- C:\Windows\System\MvHCODf.exe
  C:\Windows\System\MvHCODf.exe
  2⤵
  PID:3652
- C:\Windows\System\daFDMBQ.exe
  C:\Windows\System\daFDMBQ.exe
  2⤵
  PID:1844
- C:\Windows\System\rKhNeAs.exe
  C:\Windows\System\rKhNeAs.exe
  2⤵
  PID:3536
- C:\Windows\System\vUQaKcl.exe
  C:\Windows\System\vUQaKcl.exe
  2⤵
  PID:3848
- C:\Windows\System\FQJYdVu.exe
  C:\Windows\System\FQJYdVu.exe
  2⤵
  PID:1784
- C:\Windows\System\qMvOZWV.exe
  C:\Windows\System\qMvOZWV.exe
  2⤵
  PID:3084
- C:\Windows\System\JsvTwxf.exe
  C:\Windows\System\JsvTwxf.exe
  2⤵
  PID:3452
- C:\Windows\System\oSXUBvI.exe
  C:\Windows\System\oSXUBvI.exe
  2⤵
  PID:3952
- C:\Windows\System\ynOwudx.exe
  C:\Windows\System\ynOwudx.exe
  2⤵
  PID:3932
- C:\Windows\System\aUcoApC.exe
  C:\Windows\System\aUcoApC.exe
  2⤵
  PID:1884
- C:\Windows\System\AWNWNXG.exe
  C:\Windows\System\AWNWNXG.exe
  2⤵
  PID:2984
- C:\Windows\System\hSInmAA.exe
  C:\Windows\System\hSInmAA.exe
  2⤵
  PID:4084
- C:\Windows\System\mpbPEOQ.exe
  C:\Windows\System\mpbPEOQ.exe
  2⤵
  PID:3832
- C:\Windows\System\oyzhWQB.exe
  C:\Windows\System\oyzhWQB.exe
  2⤵
  PID:3880
- C:\Windows\System\IbuzYui.exe
  C:\Windows\System\IbuzYui.exe
  2⤵
  PID:4072
- C:\Windows\System\EAuZOLp.exe
  C:\Windows\System\EAuZOLp.exe
  2⤵
  PID:1760
- C:\Windows\System\FXgTONk.exe
  C:\Windows\System\FXgTONk.exe
  2⤵
  PID:3636
- C:\Windows\System\HrMMkUN.exe
  C:\Windows\System\HrMMkUN.exe
  2⤵
  PID:2976
- C:\Windows\System\iIhHLRR.exe
  C:\Windows\System\iIhHLRR.exe
  2⤵
  PID:3384
- C:\Windows\System\cBcDYVa.exe
  C:\Windows\System\cBcDYVa.exe
  2⤵
  PID:3236
- C:\Windows\System\EPdRwRa.exe
  C:\Windows\System\EPdRwRa.exe
  2⤵
  PID:2076
- C:\Windows\System\lCgMFof.exe
  C:\Windows\System\lCgMFof.exe
  2⤵
  PID:3928
- C:\Windows\System\rIRLXVY.exe
  C:\Windows\System\rIRLXVY.exe
  2⤵
  PID:2228
- C:\Windows\System\ztkANjr.exe
  C:\Windows\System\ztkANjr.exe
  2⤵
  PID:2020
- C:\Windows\System\hIrDBBb.exe
  C:\Windows\System\hIrDBBb.exe
  2⤵
  PID:2828
- C:\Windows\System\LxArNsW.exe
  C:\Windows\System\LxArNsW.exe
  2⤵
  PID:3468
- C:\Windows\System\vopKKBa.exe
  C:\Windows\System\vopKKBa.exe
  2⤵
  PID:3352
- C:\Windows\System\gAovJFL.exe
  C:\Windows\System\gAovJFL.exe
  2⤵
  PID:4032
- C:\Windows\System\xyPEFXY.exe
  C:\Windows\System\xyPEFXY.exe
  2⤵
  PID:3232
- C:\Windows\System\LZIrhrz.exe
  C:\Windows\System\LZIrhrz.exe
  2⤵
  PID:2600
- C:\Windows\System\UStexsG.exe
  C:\Windows\System\UStexsG.exe
  2⤵
  PID:2652
- C:\Windows\System\OeKqxrS.exe
  C:\Windows\System\OeKqxrS.exe
  2⤵
  PID:4112
- C:\Windows\System\cRUsnmi.exe
  C:\Windows\System\cRUsnmi.exe
  2⤵
  PID:4128
- C:\Windows\System\aSUzBPF.exe
  C:\Windows\System\aSUzBPF.exe
  2⤵
  PID:4144
- C:\Windows\System\ACGXceF.exe
  C:\Windows\System\ACGXceF.exe
  2⤵
  PID:4160
- C:\Windows\System\ntNSnXO.exe
  C:\Windows\System\ntNSnXO.exe
  2⤵
  PID:4184
- C:\Windows\System\jnklaGL.exe
  C:\Windows\System\jnklaGL.exe
  2⤵
  PID:4208
- C:\Windows\System\yiQIKeI.exe
  C:\Windows\System\yiQIKeI.exe
  2⤵
  PID:4224
- C:\Windows\System\YxkxLxx.exe
  C:\Windows\System\YxkxLxx.exe
  2⤵
  PID:4240
- C:\Windows\System\FdDmALA.exe
  C:\Windows\System\FdDmALA.exe
  2⤵
  PID:4260
- C:\Windows\System\CqWdsoS.exe
  C:\Windows\System\CqWdsoS.exe
  2⤵
  PID:4288
- C:\Windows\System\YjANqrF.exe
  C:\Windows\System\YjANqrF.exe
  2⤵
  PID:4304
- C:\Windows\System\CfYadtM.exe
  C:\Windows\System\CfYadtM.exe
  2⤵
  PID:4320
- C:\Windows\System\qHlAGuP.exe
  C:\Windows\System\qHlAGuP.exe
  2⤵
  PID:4336
- C:\Windows\System\BvFjyzB.exe
  C:\Windows\System\BvFjyzB.exe
  2⤵
  PID:4352
- C:\Windows\System\ascTODK.exe
  C:\Windows\System\ascTODK.exe
  2⤵
  PID:4376
- C:\Windows\System\JnMZkkO.exe
  C:\Windows\System\JnMZkkO.exe
  2⤵
  PID:4392
- C:\Windows\System\xXCtNVZ.exe
  C:\Windows\System\xXCtNVZ.exe
  2⤵
  PID:4408
- C:\Windows\System\HoSOIFW.exe
  C:\Windows\System\HoSOIFW.exe
  2⤵
  PID:4424
- C:\Windows\System\RUONldJ.exe
  C:\Windows\System\RUONldJ.exe
  2⤵
  PID:4476
- C:\Windows\System\LsyGEYL.exe
  C:\Windows\System\LsyGEYL.exe
  2⤵
  PID:4496
- C:\Windows\System\cdItkIU.exe
  C:\Windows\System\cdItkIU.exe
  2⤵
  PID:4512
- C:\Windows\System\zHfUFQq.exe
  C:\Windows\System\zHfUFQq.exe
  2⤵
  PID:4528
- C:\Windows\System\XiSrPsX.exe
  C:\Windows\System\XiSrPsX.exe
  2⤵
  PID:4544
- C:\Windows\System\SnKlAtL.exe
  C:\Windows\System\SnKlAtL.exe
  2⤵
  PID:4560
- C:\Windows\System\GEoLSao.exe
  C:\Windows\System\GEoLSao.exe
  2⤵
  PID:4576
- C:\Windows\System\uHgiPRG.exe
  C:\Windows\System\uHgiPRG.exe
  2⤵
  PID:4592
- C:\Windows\System\mNVyZif.exe
  C:\Windows\System\mNVyZif.exe
  2⤵
  PID:4608
- C:\Windows\System\fpeBltO.exe
  C:\Windows\System\fpeBltO.exe
  2⤵
  PID:4624
- C:\Windows\System\XPmNeDI.exe
  C:\Windows\System\XPmNeDI.exe
  2⤵
  PID:4640
- C:\Windows\System\zBFcNau.exe
  C:\Windows\System\zBFcNau.exe
  2⤵
  PID:4656
- C:\Windows\System\TMyByhz.exe
  C:\Windows\System\TMyByhz.exe
  2⤵
  PID:4672
- C:\Windows\System\pewWsGA.exe
  C:\Windows\System\pewWsGA.exe
  2⤵
  PID:4688
- C:\Windows\System\ZHdstYj.exe
  C:\Windows\System\ZHdstYj.exe
  2⤵
  PID:4704
- C:\Windows\System\MErTaSu.exe
  C:\Windows\System\MErTaSu.exe
  2⤵
  PID:4724
- C:\Windows\System\jYdKPfC.exe
  C:\Windows\System\jYdKPfC.exe
  2⤵
  PID:4740
- C:\Windows\System\uensNMd.exe
  C:\Windows\System\uensNMd.exe
  2⤵
  PID:4756
- C:\Windows\System\zTwMKrX.exe
  C:\Windows\System\zTwMKrX.exe
  2⤵
  PID:4776
- C:\Windows\System\OnDMWra.exe
  C:\Windows\System\OnDMWra.exe
  2⤵
  PID:4888
- C:\Windows\System\jpotnIw.exe
  C:\Windows\System\jpotnIw.exe
  2⤵
  PID:4904
- C:\Windows\System\PwarXza.exe
  C:\Windows\System\PwarXza.exe
  2⤵
  PID:4924
- C:\Windows\System\quahObx.exe
  C:\Windows\System\quahObx.exe
  2⤵
  PID:4948
- C:\Windows\System\LMXeTaC.exe
  C:\Windows\System\LMXeTaC.exe
  2⤵
  PID:4964
- C:\Windows\System\LurruGh.exe
  C:\Windows\System\LurruGh.exe
  2⤵
  PID:4984
- C:\Windows\System\TRzoGsN.exe
  C:\Windows\System\TRzoGsN.exe
  2⤵
  PID:5000
- C:\Windows\System\WEHCvwG.exe
  C:\Windows\System\WEHCvwG.exe
  2⤵
  PID:5032
- C:\Windows\System\BFWeiyn.exe
  C:\Windows\System\BFWeiyn.exe
  2⤵
  PID:5048
- C:\Windows\System\dQNevmF.exe
  C:\Windows\System\dQNevmF.exe
  2⤵
  PID:5072
- C:\Windows\System\vxdYrvr.exe
  C:\Windows\System\vxdYrvr.exe
  2⤵
  PID:5092
- C:\Windows\System\VgjFpRV.exe
  C:\Windows\System\VgjFpRV.exe
  2⤵
  PID:5112
- C:\Windows\System\fDscrsq.exe
  C:\Windows\System\fDscrsq.exe
  2⤵
  PID:4056
- C:\Windows\System\csTsCyY.exe
  C:\Windows\System\csTsCyY.exe
  2⤵
  PID:4124
- C:\Windows\System\HstXQop.exe
  C:\Windows\System\HstXQop.exe
  2⤵
  PID:4176
- C:\Windows\System\rjZyFLz.exe
  C:\Windows\System\rjZyFLz.exe
  2⤵
  PID:4196
- C:\Windows\System\dxWSbKj.exe
  C:\Windows\System\dxWSbKj.exe
  2⤵
  PID:4268
- C:\Windows\System\tKNjXtY.exe
  C:\Windows\System\tKNjXtY.exe
  2⤵
  PID:4280
- C:\Windows\System\ifikhON.exe
  C:\Windows\System\ifikhON.exe
  2⤵
  PID:4316
- C:\Windows\System\AsMUPWU.exe
  C:\Windows\System\AsMUPWU.exe
  2⤵
  PID:4416
- C:\Windows\System\OyMTgfN.exe
  C:\Windows\System\OyMTgfN.exe
  2⤵
  PID:4388
- C:\Windows\System\CHiPmRv.exe
  C:\Windows\System\CHiPmRv.exe
  2⤵
  PID:4440
- C:\Windows\System\dENCaTZ.exe
  C:\Windows\System\dENCaTZ.exe
  2⤵
  PID:4460
- C:\Windows\System\TYfpSwf.exe
  C:\Windows\System\TYfpSwf.exe
  2⤵
  PID:4472
- C:\Windows\System\zVcnlqD.exe
  C:\Windows\System\zVcnlqD.exe
  2⤵
  PID:4552
- C:\Windows\System\HfbFWNH.exe
  C:\Windows\System\HfbFWNH.exe
  2⤵
  PID:4648
- C:\Windows\System\owzIzil.exe
  C:\Windows\System\owzIzil.exe
  2⤵
  PID:4684
- C:\Windows\System\dLkPRmR.exe
  C:\Windows\System\dLkPRmR.exe
  2⤵
  PID:4752
- C:\Windows\System\uSrLveM.exe
  C:\Windows\System\uSrLveM.exe
  2⤵
  PID:4732
- C:\Windows\System\PAnRvKP.exe
  C:\Windows\System\PAnRvKP.exe
  2⤵
  PID:4540
- C:\Windows\System\OEgRQsn.exe
  C:\Windows\System\OEgRQsn.exe
  2⤵
  PID:4604
- C:\Windows\System\jWNhwzd.exe
  C:\Windows\System\jWNhwzd.exe
  2⤵
  PID:4800
- C:\Windows\System\CnZYtsH.exe
  C:\Windows\System\CnZYtsH.exe
  2⤵
  PID:4816
- C:\Windows\System\NHntaAC.exe
  C:\Windows\System\NHntaAC.exe
  2⤵
  PID:4844
- C:\Windows\System\RNGUFXw.exe
  C:\Windows\System\RNGUFXw.exe
  2⤵
  PID:4864
- C:\Windows\System\fjYIDmu.exe
  C:\Windows\System\fjYIDmu.exe
  2⤵
  PID:4884
- C:\Windows\System\msIiJzd.exe
  C:\Windows\System\msIiJzd.exe
  2⤵
  PID:4912
- C:\Windows\System\HjsgpUR.exe
  C:\Windows\System\HjsgpUR.exe
  2⤵
  PID:4944
- C:\Windows\System\uGsqVOG.exe
  C:\Windows\System\uGsqVOG.exe
  2⤵
  PID:4980
- C:\Windows\System\xtahNyA.exe
  C:\Windows\System\xtahNyA.exe
  2⤵
  PID:5016
- C:\Windows\System\tuGjBOy.exe
  C:\Windows\System\tuGjBOy.exe
  2⤵
  PID:5040
- C:\Windows\System\bbWkHPg.exe
  C:\Windows\System\bbWkHPg.exe
  2⤵
  PID:5056
- C:\Windows\System\cyxmcdh.exe
  C:\Windows\System\cyxmcdh.exe
  2⤵
  PID:4100
- C:\Windows\System\UfKjgAV.exe
  C:\Windows\System\UfKjgAV.exe
  2⤵
  PID:4108
- C:\Windows\System\rrFIwMj.exe
  C:\Windows\System\rrFIwMj.exe
  2⤵
  PID:4172
- C:\Windows\System\ttjMeow.exe
  C:\Windows\System\ttjMeow.exe
  2⤵
  PID:4204
- C:\Windows\System\gBpNtCc.exe
  C:\Windows\System\gBpNtCc.exe
  2⤵
  PID:4276
- C:\Windows\System\vIBYaxi.exe
  C:\Windows\System\vIBYaxi.exe
  2⤵
  PID:4344
- C:\Windows\System\WxyHvGL.exe
  C:\Windows\System\WxyHvGL.exe
  2⤵
  PID:4372
- C:\Windows\System\UxhUQSU.exe
  C:\Windows\System\UxhUQSU.exe
  2⤵
  PID:4452
- C:\Windows\System\WXfYtjc.exe
  C:\Windows\System\WXfYtjc.exe
  2⤵
  PID:4492
- C:\Windows\System\MFtEaku.exe
  C:\Windows\System\MFtEaku.exe
  2⤵
  PID:4616
- C:\Windows\System\KaRyTza.exe
  C:\Windows\System\KaRyTza.exe
  2⤵
  PID:4748
- C:\Windows\System\dKYqUXR.exe
  C:\Windows\System\dKYqUXR.exe
  2⤵
  PID:4668
- C:\Windows\System\zUgqbrs.exe
  C:\Windows\System\zUgqbrs.exe
  2⤵
  PID:4536
- C:\Windows\System\EzDhFjI.exe
  C:\Windows\System\EzDhFjI.exe
  2⤵
  PID:4600
- C:\Windows\System\qRDUWYP.exe
  C:\Windows\System\qRDUWYP.exe
  2⤵
  PID:4804
- C:\Windows\System\LXdTcBo.exe
  C:\Windows\System\LXdTcBo.exe
  2⤵
  PID:4832
- C:\Windows\System\umHMUDh.exe
  C:\Windows\System\umHMUDh.exe
  2⤵
  PID:4856
- C:\Windows\System\fAWAEhZ.exe
  C:\Windows\System\fAWAEhZ.exe
  2⤵
  PID:4880
- C:\Windows\System\jUDXMlD.exe
  C:\Windows\System\jUDXMlD.exe
  2⤵
  PID:4956
- C:\Windows\System\qarrRoo.exe
  C:\Windows\System\qarrRoo.exe
  2⤵
  PID:4972
- C:\Windows\System\gNFqWsE.exe
  C:\Windows\System\gNFqWsE.exe
  2⤵
  PID:5068
- C:\Windows\System\apMvLyT.exe
  C:\Windows\System\apMvLyT.exe
  2⤵
  PID:5088
- C:\Windows\System\ornhNOb.exe
  C:\Windows\System\ornhNOb.exe
  2⤵
  PID:4420
- C:\Windows\System\oNppNqF.exe
  C:\Windows\System\oNppNqF.exe
  2⤵
  PID:4828
- C:\Windows\System\ChzNVry.exe
  C:\Windows\System\ChzNVry.exe
  2⤵
  PID:4312
- C:\Windows\System\xzDsCdl.exe
  C:\Windows\System\xzDsCdl.exe
  2⤵
  PID:4520
- C:\Windows\System\ifBasHa.exe
  C:\Windows\System\ifBasHa.exe
  2⤵
  PID:4456
- C:\Windows\System\usAabhf.exe
  C:\Windows\System\usAabhf.exe
  2⤵
  PID:4664
- C:\Windows\System\EWmJVsW.exe
  C:\Windows\System\EWmJVsW.exe
  2⤵
  PID:5104
- C:\Windows\System\TFyMZkG.exe
  C:\Windows\System\TFyMZkG.exe
  2⤵
  PID:4852
- C:\Windows\System\xOMHHty.exe
  C:\Windows\System\xOMHHty.exe
  2⤵
  PID:5012
- C:\Windows\System\uFPvcnU.exe
  C:\Windows\System\uFPvcnU.exe
  2⤵
  PID:4796
- C:\Windows\System\fnyZRqc.exe
  C:\Windows\System\fnyZRqc.exe
  2⤵
  PID:5020
- C:\Windows\System\HxaZoBd.exe
  C:\Windows\System\HxaZoBd.exe
  2⤵
  PID:4872
- C:\Windows\System\gxMgJKF.exe
  C:\Windows\System\gxMgJKF.exe
  2⤵
  PID:4464
- C:\Windows\System\wJfpTOT.exe
  C:\Windows\System\wJfpTOT.exe
  2⤵
  PID:5124
- C:\Windows\System\sfYiJUQ.exe
  C:\Windows\System\sfYiJUQ.exe
  2⤵
  PID:5144
- C:\Windows\System\kouivWb.exe
  C:\Windows\System\kouivWb.exe
  2⤵
  PID:5160
- C:\Windows\System\DQYztBc.exe
  C:\Windows\System\DQYztBc.exe
  2⤵
  PID:5176
- C:\Windows\System\TIyeqbb.exe
  C:\Windows\System\TIyeqbb.exe
  2⤵
  PID:5192
- C:\Windows\System\xXWupWp.exe
  C:\Windows\System\xXWupWp.exe
  2⤵
  PID:5212
- C:\Windows\System\TvzGtXc.exe
  C:\Windows\System\TvzGtXc.exe
  2⤵
  PID:5228
- C:\Windows\System\yrMzBDS.exe
  C:\Windows\System\yrMzBDS.exe
  2⤵
  PID:5248
- C:\Windows\System\yejwzZL.exe
  C:\Windows\System\yejwzZL.exe
  2⤵
  PID:5304
- C:\Windows\System\aKyhjZm.exe
  C:\Windows\System\aKyhjZm.exe
  2⤵
  PID:5320
- C:\Windows\System\mnSjsHV.exe
  C:\Windows\System\mnSjsHV.exe
  2⤵
  PID:5336
- C:\Windows\System\rbDvYIy.exe
  C:\Windows\System\rbDvYIy.exe
  2⤵
  PID:5352
- C:\Windows\System\avePlDa.exe
  C:\Windows\System\avePlDa.exe
  2⤵
  PID:5368
- C:\Windows\System\pKEflSM.exe
  C:\Windows\System\pKEflSM.exe
  2⤵
  PID:5388
- C:\Windows\System\eNgvLEE.exe
  C:\Windows\System\eNgvLEE.exe
  2⤵
  PID:5404
- C:\Windows\System\bdJFHZE.exe
  C:\Windows\System\bdJFHZE.exe
  2⤵
  PID:5420
- C:\Windows\System\gKYdsJp.exe
  C:\Windows\System\gKYdsJp.exe
  2⤵
  PID:5436
- C:\Windows\System\UJDLtqb.exe
  C:\Windows\System\UJDLtqb.exe
  2⤵
  PID:5452
- C:\Windows\System\dsJfuRV.exe
  C:\Windows\System\dsJfuRV.exe
  2⤵
  PID:5472
- C:\Windows\System\HfZIUNI.exe
  C:\Windows\System\HfZIUNI.exe
  2⤵
  PID:5488
- C:\Windows\System\geSLwnu.exe
  C:\Windows\System\geSLwnu.exe
  2⤵
  PID:5504
- C:\Windows\System\CiWlCVo.exe
  C:\Windows\System\CiWlCVo.exe
  2⤵
  PID:5520
- C:\Windows\System\PnGIQAZ.exe
  C:\Windows\System\PnGIQAZ.exe
  2⤵
  PID:5536
- C:\Windows\System\VZhifSF.exe
  C:\Windows\System\VZhifSF.exe
  2⤵
  PID:5572
- C:\Windows\System\SUyVkyC.exe
  C:\Windows\System\SUyVkyC.exe
  2⤵
  PID:5588
- C:\Windows\System\RvxBDTV.exe
  C:\Windows\System\RvxBDTV.exe
  2⤵
  PID:5604
- C:\Windows\System\LsWsCqr.exe
  C:\Windows\System\LsWsCqr.exe
  2⤵
  PID:5624
- C:\Windows\System\CdksvwX.exe
  C:\Windows\System\CdksvwX.exe
  2⤵
  PID:5640
- C:\Windows\System\vawhFfj.exe
  C:\Windows\System\vawhFfj.exe
  2⤵
  PID:5656
- C:\Windows\System\lHHhQsI.exe
  C:\Windows\System\lHHhQsI.exe
  2⤵
  PID:5756
- C:\Windows\System\hsAjtJx.exe
  C:\Windows\System\hsAjtJx.exe
  2⤵
  PID:5772
- C:\Windows\System\ltXmVzt.exe
  C:\Windows\System\ltXmVzt.exe
  2⤵
  PID:5792
- C:\Windows\System\bWakfaP.exe
  C:\Windows\System\bWakfaP.exe
  2⤵
  PID:5808
- C:\Windows\System\IxlRMEM.exe
  C:\Windows\System\IxlRMEM.exe
  2⤵
  PID:5824
- C:\Windows\System\QvKrlui.exe
  C:\Windows\System\QvKrlui.exe
  2⤵
  PID:5844
- C:\Windows\System\vJcnlbN.exe
  C:\Windows\System\vJcnlbN.exe
  2⤵
  PID:5860
- C:\Windows\System\lHwlxwa.exe
  C:\Windows\System\lHwlxwa.exe
  2⤵
  PID:5876
- C:\Windows\System\cPRypws.exe
  C:\Windows\System\cPRypws.exe
  2⤵
  PID:5908
- C:\Windows\System\zuhrxct.exe
  C:\Windows\System\zuhrxct.exe
  2⤵
  PID:5924
- C:\Windows\System\mcKRtMs.exe
  C:\Windows\System\mcKRtMs.exe
  2⤵
  PID:5940
- C:\Windows\System\ZDiUjCs.exe
  C:\Windows\System\ZDiUjCs.exe
  2⤵
  PID:5960
- C:\Windows\System\tOHgPxh.exe
  C:\Windows\System\tOHgPxh.exe
  2⤵
  PID:5976
- C:\Windows\System\YtkpuWl.exe
  C:\Windows\System\YtkpuWl.exe
  2⤵
  PID:6016
- C:\Windows\System\yHvdOBM.exe
  C:\Windows\System\yHvdOBM.exe
  2⤵
  PID:6032
- C:\Windows\System\ytMlgFU.exe
  C:\Windows\System\ytMlgFU.exe
  2⤵
  PID:6048
- C:\Windows\System\HXFMfjy.exe
  C:\Windows\System\HXFMfjy.exe
  2⤵
  PID:6064
- C:\Windows\System\iihmrkQ.exe
  C:\Windows\System\iihmrkQ.exe
  2⤵
  PID:6080
- C:\Windows\System\VKQAwym.exe
  C:\Windows\System\VKQAwym.exe
  2⤵
  PID:6112
- C:\Windows\System\hJfFKgi.exe
  C:\Windows\System\hJfFKgi.exe
  2⤵
  PID:6128
- C:\Windows\System\aTkQboZ.exe
  C:\Windows\System\aTkQboZ.exe
  2⤵
  PID:4104
- C:\Windows\System\glBdGZF.exe
  C:\Windows\System\glBdGZF.exe
  2⤵
  PID:4168
- C:\Windows\System\vTdgfxD.exe
  C:\Windows\System\vTdgfxD.exe
  2⤵
  PID:5168
- C:\Windows\System\IwKzJKA.exe
  C:\Windows\System\IwKzJKA.exe
  2⤵
  PID:4332
- C:\Windows\System\yGjNOpW.exe
  C:\Windows\System\yGjNOpW.exe
  2⤵
  PID:4824
- C:\Windows\System\pFfYpDK.exe
  C:\Windows\System\pFfYpDK.exe
  2⤵
  PID:5140
- C:\Windows\System\xFKvLpH.exe
  C:\Windows\System\xFKvLpH.exe
  2⤵
  PID:5244
- C:\Windows\System\efTQnDR.exe
  C:\Windows\System\efTQnDR.exe
  2⤵
  PID:4772
- C:\Windows\System\UPVuBew.exe
  C:\Windows\System\UPVuBew.exe
  2⤵
  PID:4120
- C:\Windows\System\bEoGMNs.exe
  C:\Windows\System\bEoGMNs.exe
  2⤵
  PID:5292
- C:\Windows\System\DPbevrt.exe
  C:\Windows\System\DPbevrt.exe
  2⤵
  PID:5188
- C:\Windows\System\utNALep.exe
  C:\Windows\System\utNALep.exe
  2⤵
  PID:5284
- C:\Windows\System\vWeZCoR.exe
  C:\Windows\System\vWeZCoR.exe
  2⤵
  PID:5376
- C:\Windows\System\WGDcJwd.exe
  C:\Windows\System\WGDcJwd.exe
  2⤵
  PID:5380
- C:\Windows\System\EHRwEBv.exe
  C:\Windows\System\EHRwEBv.exe
  2⤵
  PID:5444
- C:\Windows\System\gDhAChm.exe
  C:\Windows\System\gDhAChm.exe
  2⤵
  PID:5512
- C:\Windows\System\IokhgBZ.exe
  C:\Windows\System\IokhgBZ.exe
  2⤵
  PID:5360
- C:\Windows\System\NgLBTaE.exe
  C:\Windows\System\NgLBTaE.exe
  2⤵
  PID:5432
- C:\Windows\System\uTtzmTa.exe
  C:\Windows\System\uTtzmTa.exe
  2⤵
  PID:5528
- C:\Windows\System\Vpflytl.exe
  C:\Windows\System\Vpflytl.exe
  2⤵
  PID:5496
- C:\Windows\System\NUAqNkC.exe
  C:\Windows\System\NUAqNkC.exe
  2⤵
  PID:3708
- C:\Windows\System\uvkeybR.exe
  C:\Windows\System\uvkeybR.exe
  2⤵
  PID:5648
- C:\Windows\System\CfhyrbW.exe
  C:\Windows\System\CfhyrbW.exe
  2⤵
  PID:5708
- C:\Windows\System\fdtzLED.exe
  C:\Windows\System\fdtzLED.exe
  2⤵
  PID:5720
- C:\Windows\System\SrHpesF.exe
  C:\Windows\System\SrHpesF.exe
  2⤵
  PID:5736
- C:\Windows\System\rFNNQHW.exe
  C:\Windows\System\rFNNQHW.exe
  2⤵
  PID:5752
- C:\Windows\System\XzQNlYx.exe
  C:\Windows\System\XzQNlYx.exe
  2⤵
  PID:5804
- C:\Windows\System\pTxFJtK.exe
  C:\Windows\System\pTxFJtK.exe
  2⤵
  PID:5840
- C:\Windows\System\whjsepf.exe
  C:\Windows\System\whjsepf.exe
  2⤵
  PID:5896
- C:\Windows\System\bXaTphP.exe
  C:\Windows\System\bXaTphP.exe
  2⤵
  PID:5800
- C:\Windows\System\vPwjBiv.exe
  C:\Windows\System\vPwjBiv.exe
  2⤵
  PID:5932
- C:\Windows\System\ydHWVNz.exe
  C:\Windows\System\ydHWVNz.exe
  2⤵
  PID:5916
- C:\Windows\System\VHFFTKm.exe
  C:\Windows\System\VHFFTKm.exe
  2⤵
  PID:5984
- C:\Windows\System\LOWBALI.exe
  C:\Windows\System\LOWBALI.exe
  2⤵
  PID:6000
- C:\Windows\System\tLmKehg.exe
  C:\Windows\System\tLmKehg.exe
  2⤵
  PID:6024
- C:\Windows\System\tfafyWA.exe
  C:\Windows\System\tfafyWA.exe
  2⤵
  PID:5676
- C:\Windows\System\FgsLzxY.exe
  C:\Windows\System\FgsLzxY.exe
  2⤵
  PID:6060
- C:\Windows\System\MfKxRhc.exe
  C:\Windows\System\MfKxRhc.exe
  2⤵
  PID:6108
- C:\Windows\System\bEDzGjc.exe
  C:\Windows\System\bEDzGjc.exe
  2⤵
  PID:5028
- C:\Windows\System\COSDWsu.exe
  C:\Windows\System\COSDWsu.exe
  2⤵
  PID:4400
- C:\Windows\System\XWusBVn.exe
  C:\Windows\System\XWusBVn.exe
  2⤵
  PID:5272
- C:\Windows\System\dLDMIjM.exe
  C:\Windows\System\dLDMIjM.exe
  2⤵
  PID:4156
- C:\Windows\System\wEVEFls.exe
  C:\Windows\System\wEVEFls.exe
  2⤵
  PID:4700
- C:\Windows\System\KzGqhYK.exe
  C:\Windows\System\KzGqhYK.exe
  2⤵
  PID:5416
- C:\Windows\System\iErBitX.exe
  C:\Windows\System\iErBitX.exe
  2⤵
  PID:5516
- C:\Windows\System\nxgACpd.exe
  C:\Windows\System\nxgACpd.exe
  2⤵
  PID:5560
- C:\Windows\System\TZCQvCe.exe
  C:\Windows\System\TZCQvCe.exe
  2⤵
  PID:5568
- C:\Windows\System\WtoiiCL.exe
  C:\Windows\System\WtoiiCL.exe
  2⤵
  PID:5632
- C:\Windows\System\QsFTvEG.exe
  C:\Windows\System\QsFTvEG.exe
  2⤵
  PID:5544
- C:\Windows\System\YMQGhAh.exe
  C:\Windows\System\YMQGhAh.exe
  2⤵
  PID:5484
- C:\Windows\System\RlomeaK.exe
  C:\Windows\System\RlomeaK.exe
  2⤵
  PID:5596
- C:\Windows\System\sPLWEmb.exe
  C:\Windows\System\sPLWEmb.exe
  2⤵
  PID:5684
- C:\Windows\System\PIesxkJ.exe
  C:\Windows\System\PIesxkJ.exe
  2⤵
  PID:5820
- C:\Windows\System\bUboXHQ.exe
  C:\Windows\System\bUboXHQ.exe
  2⤵
  PID:5700
- C:\Windows\System\JhmEPvg.exe
  C:\Windows\System\JhmEPvg.exe
  2⤵
  PID:5816
- C:\Windows\System\jAtgAIy.exe
  C:\Windows\System\jAtgAIy.exe
  2⤵
  PID:5744
- C:\Windows\System\DKeoocX.exe
  C:\Windows\System\DKeoocX.exe
  2⤵
  PID:5224
- C:\Windows\System\HrFsIDE.exe
  C:\Windows\System\HrFsIDE.exe
  2⤵
  PID:5136
- C:\Windows\System\PANXxUq.exe
  C:\Windows\System\PANXxUq.exe
  2⤵
  PID:5872
- C:\Windows\System\QxTboyx.exe
  C:\Windows\System\QxTboyx.exe
  2⤵
  PID:5200
- C:\Windows\System\akZWKNb.exe
  C:\Windows\System\akZWKNb.exe
  2⤵
  PID:6124
- C:\Windows\System\yQSSkyA.exe
  C:\Windows\System\yQSSkyA.exe
  2⤵
  PID:5348
- C:\Windows\System\jDYXEmL.exe
  C:\Windows\System\jDYXEmL.exe
  2⤵
  PID:5400
- C:\Windows\System\WApOmCR.exe
  C:\Windows\System\WApOmCR.exe
  2⤵
  PID:5692
- C:\Windows\System\iviCOqZ.exe
  C:\Windows\System\iviCOqZ.exe
  2⤵
  PID:5184
- C:\Windows\System\REhidFJ.exe
  C:\Windows\System\REhidFJ.exe
  2⤵
  PID:5664
- C:\Windows\System\LsuRlOo.exe
  C:\Windows\System\LsuRlOo.exe
  2⤵
  PID:5428
- C:\Windows\System\HJMimdB.exe
  C:\Windows\System\HJMimdB.exe
  2⤵
  PID:5716
- C:\Windows\System\DscGGOe.exe
  C:\Windows\System\DscGGOe.exe
  2⤵
  PID:6012
- C:\Windows\System\Ggwyvuv.exe
  C:\Windows\System\Ggwyvuv.exe
  2⤵
  PID:6100
- C:\Windows\System\CyUvijb.exe
  C:\Windows\System\CyUvijb.exe
  2⤵
  PID:6044
- C:\Windows\System\TLYTfMk.exe
  C:\Windows\System\TLYTfMk.exe
  2⤵
  PID:5836
- C:\Windows\System\MWcXGUF.exe
  C:\Windows\System\MWcXGUF.exe
  2⤵
  PID:5384
- C:\Windows\System\iCTrhyw.exe
  C:\Windows\System\iCTrhyw.exe
  2⤵
  PID:5276
- C:\Windows\System\VJtGSbJ.exe
  C:\Windows\System\VJtGSbJ.exe
  2⤵
  PID:6140
- C:\Windows\System\oDHMzFw.exe
  C:\Windows\System\oDHMzFw.exe
  2⤵
  PID:4720
- C:\Windows\System\JZDCelm.exe
  C:\Windows\System\JZDCelm.exe
  2⤵
  PID:5268
- C:\Windows\System\WTrUBVN.exe
  C:\Windows\System\WTrUBVN.exe
  2⤵
  PID:5260
- C:\Windows\System\jKlMFlb.exe
  C:\Windows\System\jKlMFlb.exe
  2⤵
  PID:5952
- C:\Windows\System\BSOxtrB.exe
  C:\Windows\System\BSOxtrB.exe
  2⤵
  PID:4584
- C:\Windows\System\IobrgTn.exe
  C:\Windows\System\IobrgTn.exe
  2⤵
  PID:6072
- C:\Windows\System\FqUzQKA.exe
  C:\Windows\System\FqUzQKA.exe
  2⤵
  PID:6164
- C:\Windows\System\nQkUvML.exe
  C:\Windows\System\nQkUvML.exe
  2⤵
  PID:6180
- C:\Windows\System\ehJcHoV.exe
  C:\Windows\System\ehJcHoV.exe
  2⤵
  PID:6196
- C:\Windows\System\OlAIQtr.exe
  C:\Windows\System\OlAIQtr.exe
  2⤵
  PID:6216
- C:\Windows\System\DHbQeZa.exe
  C:\Windows\System\DHbQeZa.exe
  2⤵
  PID:6232
- C:\Windows\System\EhOluEH.exe
  C:\Windows\System\EhOluEH.exe
  2⤵
  PID:6248
- C:\Windows\System\VVufaJM.exe
  C:\Windows\System\VVufaJM.exe
  2⤵
  PID:6284
- C:\Windows\System\VbIHNLm.exe
  C:\Windows\System\VbIHNLm.exe
  2⤵
  PID:6300
- C:\Windows\System\QqQOIwl.exe
  C:\Windows\System\QqQOIwl.exe
  2⤵
  PID:6316
- C:\Windows\System\lLHcmCV.exe
  C:\Windows\System\lLHcmCV.exe
  2⤵
  PID:6332
- C:\Windows\System\SgYCWdV.exe
  C:\Windows\System\SgYCWdV.exe
  2⤵
  PID:6348
- C:\Windows\System\vwAyyXq.exe
  C:\Windows\System\vwAyyXq.exe
  2⤵
  PID:6364
- C:\Windows\System\iyaCzwS.exe
  C:\Windows\System\iyaCzwS.exe
  2⤵
  PID:6384
- C:\Windows\System\eTiVgnf.exe
  C:\Windows\System\eTiVgnf.exe
  2⤵
  PID:6400
- C:\Windows\System\ilIxVdu.exe
  C:\Windows\System\ilIxVdu.exe
  2⤵
  PID:6416
- C:\Windows\System\NBUuupO.exe
  C:\Windows\System\NBUuupO.exe
  2⤵
  PID:6436
- C:\Windows\System\MeKOkFN.exe
  C:\Windows\System\MeKOkFN.exe
  2⤵
  PID:6452
- C:\Windows\System\zJppbXl.exe
  C:\Windows\System\zJppbXl.exe
  2⤵
  PID:6468
- C:\Windows\System\ikdEVKM.exe
  C:\Windows\System\ikdEVKM.exe
  2⤵
  PID:6484
- C:\Windows\System\UutLirb.exe
  C:\Windows\System\UutLirb.exe
  2⤵
  PID:6500
- C:\Windows\System\KzVodAv.exe
  C:\Windows\System\KzVodAv.exe
  2⤵
  PID:6520
- C:\Windows\System\QytGWLd.exe
  C:\Windows\System\QytGWLd.exe
  2⤵
  PID:6612
- C:\Windows\System\YcYPLwT.exe
  C:\Windows\System\YcYPLwT.exe
  2⤵
  PID:6628
- C:\Windows\System\sQPPFQv.exe
  C:\Windows\System\sQPPFQv.exe
  2⤵
  PID:6644
- C:\Windows\System\lUNDbpz.exe
  C:\Windows\System\lUNDbpz.exe
  2⤵
  PID:6660
- C:\Windows\System\nwgcuAS.exe
  C:\Windows\System\nwgcuAS.exe
  2⤵
  PID:6692
- C:\Windows\System\Aqwyxdu.exe
  C:\Windows\System\Aqwyxdu.exe
  2⤵
  PID:6708
- C:\Windows\System\dlWvwRK.exe
  C:\Windows\System\dlWvwRK.exe
  2⤵
  PID:6732
- C:\Windows\System\FXPbWwh.exe
  C:\Windows\System\FXPbWwh.exe
  2⤵
  PID:6748
- C:\Windows\System\wEMySLB.exe
  C:\Windows\System\wEMySLB.exe
  2⤵
  PID:6768
- C:\Windows\System\CoklIRu.exe
  C:\Windows\System\CoklIRu.exe
  2⤵
  PID:6784
- C:\Windows\System\fVwmYvu.exe
  C:\Windows\System\fVwmYvu.exe
  2⤵
  PID:6800
- C:\Windows\System\wYFprbF.exe
  C:\Windows\System\wYFprbF.exe
  2⤵
  PID:6816
- C:\Windows\System\YVJepMg.exe
  C:\Windows\System\YVJepMg.exe
  2⤵
  PID:6832
- C:\Windows\System\nODWoKm.exe
  C:\Windows\System\nODWoKm.exe
  2⤵
  PID:6848
- C:\Windows\System\XylRLOa.exe
  C:\Windows\System\XylRLOa.exe
  2⤵
  PID:6868
- C:\Windows\System\ofbKdhn.exe
  C:\Windows\System\ofbKdhn.exe
  2⤵
  PID:6884
- C:\Windows\System\jBnbKqi.exe
  C:\Windows\System\jBnbKqi.exe
  2⤵
  PID:6904
- C:\Windows\System\ujHRdNV.exe
  C:\Windows\System\ujHRdNV.exe
  2⤵
  PID:6972
- C:\Windows\System\EhNJScn.exe
  C:\Windows\System\EhNJScn.exe
  2⤵
  PID:6988
- C:\Windows\System\dSancES.exe
  C:\Windows\System\dSancES.exe
  2⤵
  PID:7004
- C:\Windows\System\ZvCkoyr.exe
  C:\Windows\System\ZvCkoyr.exe
  2⤵
  PID:7020
- C:\Windows\System\JECrqMh.exe
  C:\Windows\System\JECrqMh.exe
  2⤵
  PID:7036
- C:\Windows\System\mCfZnmE.exe
  C:\Windows\System\mCfZnmE.exe
  2⤵
  PID:7052
- C:\Windows\System\HXZPxKP.exe
  C:\Windows\System\HXZPxKP.exe
  2⤵
  PID:7088
- C:\Windows\System\AGlHlgS.exe
  C:\Windows\System\AGlHlgS.exe
  2⤵
  PID:7104
- C:\Windows\System\dINTJOX.exe
  C:\Windows\System\dINTJOX.exe
  2⤵
  PID:7120
- C:\Windows\System\amhHukC.exe
  C:\Windows\System\amhHukC.exe
  2⤵
  PID:7136
- C:\Windows\System\WhpISKP.exe
  C:\Windows\System\WhpISKP.exe
  2⤵
  PID:7156
- C:\Windows\System\lecfZBI.exe
  C:\Windows\System\lecfZBI.exe
  2⤵
  PID:6028
- C:\Windows\System\iMFcMqo.exe
  C:\Windows\System\iMFcMqo.exe
  2⤵
  PID:5344
- C:\Windows\System\JbAItuZ.exe
  C:\Windows\System\JbAItuZ.exe
  2⤵
  PID:6240
- C:\Windows\System\RqYKZxY.exe
  C:\Windows\System\RqYKZxY.exe
  2⤵
  PID:5208
- C:\Windows\System\HRSOfvR.exe
  C:\Windows\System\HRSOfvR.exe
  2⤵
  PID:6172
- C:\Windows\System\JoXEBnf.exe
  C:\Windows\System\JoXEBnf.exe
  2⤵
  PID:6160
- C:\Windows\System\mTjEcDI.exe
  C:\Windows\System\mTjEcDI.exe
  2⤵
  PID:4572
- C:\Windows\System\wSrAKoG.exe
  C:\Windows\System\wSrAKoG.exe
  2⤵
  PID:6296
- C:\Windows\System\NjdsctQ.exe
  C:\Windows\System\NjdsctQ.exe
  2⤵
  PID:6360
- C:\Windows\System\esxwkpW.exe
  C:\Windows\System\esxwkpW.exe
  2⤵
  PID:6464
- C:\Windows\System\tVTVZRL.exe
  C:\Windows\System\tVTVZRL.exe
  2⤵
  PID:5904
- C:\Windows\System\oWxexqB.exe
  C:\Windows\System\oWxexqB.exe
  2⤵
  PID:6268
- C:\Windows\System\CwinruF.exe
  C:\Windows\System\CwinruF.exe
  2⤵
  PID:6156
- C:\Windows\System\jJlHvnB.exe
  C:\Windows\System\jJlHvnB.exe
  2⤵
  PID:6260
- C:\Windows\System\GrzqdFU.exe
  C:\Windows\System\GrzqdFU.exe
  2⤵
  PID:2108
- C:\Windows\System\NTiKGjR.exe
  C:\Windows\System\NTiKGjR.exe
  2⤵
  PID:2024
- C:\Windows\System\gthriDp.exe
  C:\Windows\System\gthriDp.exe
  2⤵
  PID:6312
- C:\Windows\System\eXuepHS.exe
  C:\Windows\System\eXuepHS.exe
  2⤵
  PID:6408
- C:\Windows\System\ZjmnmQk.exe
  C:\Windows\System\ZjmnmQk.exe
  2⤵
  PID:6512
- C:\Windows\System\pYILRjz.exe
  C:\Windows\System\pYILRjz.exe
  2⤵
  PID:6544
- C:\Windows\System\OePDSha.exe
  C:\Windows\System\OePDSha.exe
  2⤵
  PID:6556
- C:\Windows\System\tBphgJV.exe
  C:\Windows\System\tBphgJV.exe
  2⤵
  PID:6572
- C:\Windows\System\EZlCCDO.exe
  C:\Windows\System\EZlCCDO.exe
  2⤵
  PID:6604
- C:\Windows\System\EpjHith.exe
  C:\Windows\System\EpjHith.exe
  2⤵
  PID:6668
- C:\Windows\System\AgJOeEg.exe
  C:\Windows\System\AgJOeEg.exe
  2⤵
  PID:6688
- C:\Windows\System\LNPPIgO.exe
  C:\Windows\System\LNPPIgO.exe
  2⤵
  PID:6716
- C:\Windows\System\rsLmFzV.exe
  C:\Windows\System\rsLmFzV.exe
  2⤵
  PID:6728
- C:\Windows\System\pNoKHdl.exe
  C:\Windows\System\pNoKHdl.exe
  2⤵
  PID:6760
- C:\Windows\System\cKtmYlV.exe
  C:\Windows\System\cKtmYlV.exe
  2⤵
  PID:6700
- C:\Windows\System\HJcpDfs.exe
  C:\Windows\System\HJcpDfs.exe
  2⤵
  PID:6892
- C:\Windows\System\wRjQiKN.exe
  C:\Windows\System\wRjQiKN.exe
  2⤵
  PID:6840
- C:\Windows\System\QNaHWYZ.exe
  C:\Windows\System\QNaHWYZ.exe
  2⤵
  PID:6916
- C:\Windows\System\XPHOHgS.exe
  C:\Windows\System\XPHOHgS.exe
  2⤵
  PID:6912
- C:\Windows\System\KTQsyXe.exe
  C:\Windows\System\KTQsyXe.exe
  2⤵
  PID:6932
- C:\Windows\System\JpYJpEf.exe
  C:\Windows\System\JpYJpEf.exe
  2⤵
  PID:6952
- C:\Windows\System\lpZtPGy.exe
  C:\Windows\System\lpZtPGy.exe
  2⤵
  PID:6968
- C:\Windows\System\gWnycVc.exe
  C:\Windows\System\gWnycVc.exe
  2⤵
  PID:7000
- C:\Windows\System\CfRtbmk.exe
  C:\Windows\System\CfRtbmk.exe
  2⤵
  PID:7076
- C:\Windows\System\MtEBuPx.exe
  C:\Windows\System\MtEBuPx.exe
  2⤵
  PID:7016
- C:\Windows\System\NAGmPws.exe
  C:\Windows\System\NAGmPws.exe
  2⤵
  PID:7064
- C:\Windows\System\fltvGKz.exe
  C:\Windows\System\fltvGKz.exe
  2⤵
  PID:7132
- C:\Windows\System\uAeRbHE.exe
  C:\Windows\System\uAeRbHE.exe
  2⤵
  PID:6212
- C:\Windows\System\ZoiHlEF.exe
  C:\Windows\System\ZoiHlEF.exe
  2⤵
  PID:6256
- C:\Windows\System\diwwpGx.exe
  C:\Windows\System\diwwpGx.exe
  2⤵
  PID:7144
- C:\Windows\System\AurDuvy.exe
  C:\Windows\System\AurDuvy.exe
  2⤵
  PID:7152
- C:\Windows\System\bryaufq.exe
  C:\Windows\System\bryaufq.exe
  2⤵
  PID:5992
- C:\Windows\System\plsPxEI.exe
  C:\Windows\System\plsPxEI.exe
  2⤵
  PID:6432
- C:\Windows\System\rmXrBqM.exe
  C:\Windows\System\rmXrBqM.exe
  2⤵
  PID:6460
- C:\Windows\System\wyFjAJy.exe
  C:\Windows\System\wyFjAJy.exe
  2⤵
  PID:6152
- C:\Windows\System\AgyWUlz.exe
  C:\Windows\System\AgyWUlz.exe
  2⤵
  PID:6376
- C:\Windows\System\sUbnVfn.exe
  C:\Windows\System\sUbnVfn.exe
  2⤵
  PID:2320
- C:\Windows\System\jftGqym.exe
  C:\Windows\System\jftGqym.exe
  2⤵
  PID:6552
- C:\Windows\System\gjgBrir.exe
  C:\Windows\System\gjgBrir.exe
  2⤵
  PID:6568
- C:\Windows\System\WOLEJws.exe
  C:\Windows\System\WOLEJws.exe
  2⤵
  PID:6592
- C:\Windows\System\QuctlES.exe
  C:\Windows\System\QuctlES.exe
  2⤵
  PID:6608
- C:\Windows\System\LJHqYtK.exe
  C:\Windows\System\LJHqYtK.exe
  2⤵
  PID:6640
- C:\Windows\System\FCMGmPN.exe
  C:\Windows\System\FCMGmPN.exe
  2⤵
  PID:6796
- C:\Windows\System\NiCwBCX.exe
  C:\Windows\System\NiCwBCX.exe
  2⤵
  PID:6812
- C:\Windows\System\DAnWoFq.exe
  C:\Windows\System\DAnWoFq.exe
  2⤵
  PID:6880
- C:\Windows\System\xzqmZda.exe
  C:\Windows\System\xzqmZda.exe
  2⤵
  PID:7072
- C:\Windows\System\HdiOMCQ.exe
  C:\Windows\System\HdiOMCQ.exe
  2⤵
  PID:5636
- C:\Windows\System\ENXfMaq.exe
  C:\Windows\System\ENXfMaq.exe
  2⤵
  PID:6740
- C:\Windows\System\oLcsjui.exe
  C:\Windows\System\oLcsjui.exe
  2⤵
  PID:7080
- C:\Windows\System\RBaBoHP.exe
  C:\Windows\System\RBaBoHP.exe
  2⤵
  PID:6208
- C:\Windows\System\vopTtPB.exe
  C:\Windows\System\vopTtPB.exe
  2⤵
  PID:6496
- C:\Windows\System\rHvefrS.exe
  C:\Windows\System\rHvefrS.exe
  2⤵
  PID:6276
- C:\Windows\System\peRdbda.exe
  C:\Windows\System\peRdbda.exe
  2⤵
  PID:6724
- C:\Windows\System\xaifZit.exe
  C:\Windows\System\xaifZit.exe
  2⤵
  PID:6856
- C:\Windows\System\DvQVpWh.exe
  C:\Windows\System\DvQVpWh.exe
  2⤵
  PID:6860
- C:\Windows\System\gxVKnNK.exe
  C:\Windows\System\gxVKnNK.exe
  2⤵
  PID:6380
- C:\Windows\System\gTGAUbJ.exe
  C:\Windows\System\gTGAUbJ.exe
  2⤵
  PID:7032
- C:\Windows\System\tliRBnq.exe
  C:\Windows\System\tliRBnq.exe
  2⤵
  PID:6344
- C:\Windows\System\imjLmTI.exe
  C:\Windows\System\imjLmTI.exe
  2⤵
  PID:5888
- C:\Windows\System\LfrLGhl.exe
  C:\Windows\System\LfrLGhl.exe
  2⤵
  PID:6428
- C:\Windows\System\ByxJgTp.exe
  C:\Windows\System\ByxJgTp.exe
  2⤵
  PID:6204
- C:\Windows\System\iRoFrIR.exe
  C:\Windows\System\iRoFrIR.exe
  2⤵
  PID:6684
- C:\Windows\System\TlvKZbZ.exe
  C:\Windows\System\TlvKZbZ.exe
  2⤵
  PID:6600
- C:\Windows\System\TJOiMyU.exe
  C:\Windows\System\TJOiMyU.exe
  2⤵
  PID:6508
- C:\Windows\System\XIjzcgE.exe
  C:\Windows\System\XIjzcgE.exe
  2⤵
  PID:7128
- C:\Windows\System\vfjbFVB.exe
  C:\Windows\System\vfjbFVB.exe
  2⤵
  PID:7060
- C:\Windows\System\vOYHhhv.exe
  C:\Windows\System\vOYHhhv.exe
  2⤵
  PID:6532
- C:\Windows\System\RUYLBQa.exe
  C:\Windows\System\RUYLBQa.exe
  2⤵
  PID:7084
- C:\Windows\System\JdOIniN.exe
  C:\Windows\System\JdOIniN.exe
  2⤵
  PID:6264
- C:\Windows\System\PmjcrOQ.exe
  C:\Windows\System\PmjcrOQ.exe
  2⤵
  PID:6876
- C:\Windows\System\uVkRnDk.exe
  C:\Windows\System\uVkRnDk.exe
  2⤵
  PID:6964
- C:\Windows\System\FjSBKwK.exe
  C:\Windows\System\FjSBKwK.exe
  2⤵
  PID:7112
- C:\Windows\System\NGGIDkY.exe
  C:\Windows\System\NGGIDkY.exe
  2⤵
  PID:6956
- C:\Windows\System\ibiIlLE.exe
  C:\Windows\System\ibiIlLE.exe
  2⤵
  PID:7116
- C:\Windows\System\AlgwSws.exe
  C:\Windows\System\AlgwSws.exe
  2⤵
  PID:7172
- C:\Windows\System\nsyXklh.exe
  C:\Windows\System\nsyXklh.exe
  2⤵
  PID:7188
- C:\Windows\System\VZQwrdR.exe
  C:\Windows\System\VZQwrdR.exe
  2⤵
  PID:7204
- C:\Windows\System\ytUsaiN.exe
  C:\Windows\System\ytUsaiN.exe
  2⤵
  PID:7220
- C:\Windows\System\BLsLJrO.exe
  C:\Windows\System\BLsLJrO.exe
  2⤵
  PID:7240
- C:\Windows\System\UiRwpjn.exe
  C:\Windows\System\UiRwpjn.exe
  2⤵
  PID:7384
- C:\Windows\System\youEkuR.exe
  C:\Windows\System\youEkuR.exe
  2⤵
  PID:7400
- C:\Windows\System\bKTsAYK.exe
  C:\Windows\System\bKTsAYK.exe
  2⤵
  PID:7416
- C:\Windows\System\keWJTkr.exe
  C:\Windows\System\keWJTkr.exe
  2⤵
  PID:7432
- C:\Windows\System\FkAjohn.exe
  C:\Windows\System\FkAjohn.exe
  2⤵
  PID:7452
- C:\Windows\System\PFsoDAs.exe
  C:\Windows\System\PFsoDAs.exe
  2⤵
  PID:7468
- C:\Windows\System\hXwHpKR.exe
  C:\Windows\System\hXwHpKR.exe
  2⤵
  PID:7488
- C:\Windows\System\UelxSHl.exe
  C:\Windows\System\UelxSHl.exe
  2⤵
  PID:7508
- C:\Windows\System\CODcWPJ.exe
  C:\Windows\System\CODcWPJ.exe
  2⤵
  PID:7528
- C:\Windows\System\HNZnvrN.exe
  C:\Windows\System\HNZnvrN.exe
  2⤵
  PID:7584
- C:\Windows\System\biXNYHb.exe
  C:\Windows\System\biXNYHb.exe
  2⤵
  PID:7600
- C:\Windows\System\cboHFfh.exe
  C:\Windows\System\cboHFfh.exe
  2⤵
  PID:7620
- C:\Windows\System\yhlpViV.exe
  C:\Windows\System\yhlpViV.exe
  2⤵
  PID:7656
- C:\Windows\System\SrlUFZh.exe
  C:\Windows\System\SrlUFZh.exe
  2⤵
  PID:7672
- C:\Windows\System\examTyy.exe
  C:\Windows\System\examTyy.exe
  2⤵
  PID:7688
- C:\Windows\System\nSeQAtR.exe
  C:\Windows\System\nSeQAtR.exe
  2⤵
  PID:7704
- C:\Windows\System\BnacnTJ.exe
  C:\Windows\System\BnacnTJ.exe
  2⤵
  PID:7724
- C:\Windows\System\KjQhABM.exe
  C:\Windows\System\KjQhABM.exe
  2⤵
  PID:7740
- C:\Windows\System\hLssdGB.exe
  C:\Windows\System\hLssdGB.exe
  2⤵
  PID:7756
- C:\Windows\System\hkXijMQ.exe
  C:\Windows\System\hkXijMQ.exe
  2⤵
  PID:7772
- C:\Windows\System\VUSGCiy.exe
  C:\Windows\System\VUSGCiy.exe
  2⤵
  PID:7788
- C:\Windows\System\vKyiBSk.exe
  C:\Windows\System\vKyiBSk.exe
  2⤵
  PID:7808
- C:\Windows\System\eDSkJxd.exe
  C:\Windows\System\eDSkJxd.exe
  2⤵
  PID:7824
- C:\Windows\System\Ioqztuy.exe
  C:\Windows\System\Ioqztuy.exe
  2⤵
  PID:7840
- C:\Windows\System\PBxhLGb.exe
  C:\Windows\System\PBxhLGb.exe
  2⤵
  PID:7860
- C:\Windows\System\TzbdBhP.exe
  C:\Windows\System\TzbdBhP.exe
  2⤵
  PID:7908
- C:\Windows\System\PakYZzo.exe
  C:\Windows\System\PakYZzo.exe
  2⤵
  PID:7932
- C:\Windows\System\aNxxqae.exe
  C:\Windows\System\aNxxqae.exe
  2⤵
  PID:7956
- C:\Windows\System\siFgBhD.exe
  C:\Windows\System\siFgBhD.exe
  2⤵
  PID:7980
- C:\Windows\System\ZrShQHL.exe
  C:\Windows\System\ZrShQHL.exe
  2⤵
  PID:7996
- C:\Windows\System\wMJzYrC.exe
  C:\Windows\System\wMJzYrC.exe
  2⤵
  PID:8012
- C:\Windows\System\qWXEPIw.exe
  C:\Windows\System\qWXEPIw.exe
  2⤵
  PID:8028
- C:\Windows\System\MuEQpko.exe
  C:\Windows\System\MuEQpko.exe
  2⤵
  PID:8044
- C:\Windows\System\aUnIZmE.exe
  C:\Windows\System\aUnIZmE.exe
  2⤵
  PID:8060
- C:\Windows\System\EsCtKJi.exe
  C:\Windows\System\EsCtKJi.exe
  2⤵
  PID:8104
- C:\Windows\System\ajPwwoW.exe
  C:\Windows\System\ajPwwoW.exe
  2⤵
  PID:8120
- C:\Windows\System\AsMHbER.exe
  C:\Windows\System\AsMHbER.exe
  2⤵
  PID:8136
- C:\Windows\System\FOtPhOm.exe
  C:\Windows\System\FOtPhOm.exe
  2⤵
  PID:8156
- C:\Windows\System\xGZuxui.exe
  C:\Windows\System\xGZuxui.exe
  2⤵
  PID:8172
- C:\Windows\System\qfDcgHr.exe
  C:\Windows\System\qfDcgHr.exe
  2⤵
  PID:8188
- C:\Windows\System\ouIefhp.exe
  C:\Windows\System\ouIefhp.exe
  2⤵
  PID:7200
- C:\Windows\System\paJzorJ.exe
  C:\Windows\System\paJzorJ.exe
  2⤵
  PID:7228
- C:\Windows\System\NbdVUic.exe
  C:\Windows\System\NbdVUic.exe
  2⤵
  PID:7248
- C:\Windows\System\TWjgiTr.exe
  C:\Windows\System\TWjgiTr.exe
  2⤵
  PID:6936
- C:\Windows\System\LxKKpeH.exe
  C:\Windows\System\LxKKpeH.exe
  2⤵
  PID:7268
- C:\Windows\System\mfYzFLy.exe
  C:\Windows\System\mfYzFLy.exe
  2⤵
  PID:7284
- C:\Windows\System\aoGSFaK.exe
  C:\Windows\System\aoGSFaK.exe
  2⤵
  PID:7304
- C:\Windows\System\ApEENtb.exe
  C:\Windows\System\ApEENtb.exe
  2⤵
  PID:7316
- C:\Windows\System\QORsZIE.exe
  C:\Windows\System\QORsZIE.exe
  2⤵
  PID:7336
- C:\Windows\System\EsThjXR.exe
  C:\Windows\System\EsThjXR.exe
  2⤵
  PID:7348
- C:\Windows\System\sZRJNTf.exe
  C:\Windows\System\sZRJNTf.exe
  2⤵
  PID:7364
- C:\Windows\System\HolVGuJ.exe
  C:\Windows\System\HolVGuJ.exe
  2⤵
  PID:7396
- C:\Windows\System\LANZxEY.exe
  C:\Windows\System\LANZxEY.exe
  2⤵
  PID:7464
- C:\Windows\System\WQtuDrG.exe
  C:\Windows\System\WQtuDrG.exe
  2⤵
  PID:7540
- C:\Windows\System\PhVuhxt.exe
  C:\Windows\System\PhVuhxt.exe
  2⤵
  PID:7556
- C:\Windows\System\ibJzNCE.exe
  C:\Windows\System\ibJzNCE.exe
  2⤵
  PID:7524
- C:\Windows\System\PsRSydr.exe
  C:\Windows\System\PsRSydr.exe
  2⤵
  PID:7480
- C:\Windows\System\WhzReVj.exe
  C:\Windows\System\WhzReVj.exe
  2⤵
  PID:7408
- C:\Windows\System\RHakhaR.exe
  C:\Windows\System\RHakhaR.exe
  2⤵
  PID:7612
- C:\Windows\System\xLGhEaM.exe
  C:\Windows\System\xLGhEaM.exe
  2⤵
  PID:7652
- C:\Windows\System\qlSXUqS.exe
  C:\Windows\System\qlSXUqS.exe
  2⤵
  PID:7648
- C:\Windows\System\QWMIpnk.exe
  C:\Windows\System\QWMIpnk.exe
  2⤵
  PID:7680
- C:\Windows\System\oWGHFpY.exe
  C:\Windows\System\oWGHFpY.exe
  2⤵
  PID:7732
- C:\Windows\System\KXfDPyx.exe
  C:\Windows\System\KXfDPyx.exe
  2⤵
  PID:7820
- C:\Windows\System\XAVXyra.exe
  C:\Windows\System\XAVXyra.exe
  2⤵
  PID:7888
- C:\Windows\System\QCdYbQc.exe
  C:\Windows\System\QCdYbQc.exe
  2⤵
  PID:7752
- C:\Windows\System\ZmcczUq.exe
  C:\Windows\System\ZmcczUq.exe
  2⤵
  PID:7916
- C:\Windows\System\KpkdFKo.exe
  C:\Windows\System\KpkdFKo.exe
  2⤵
  PID:7948
- C:\Windows\System\XREWTDd.exe
  C:\Windows\System\XREWTDd.exe
  2⤵
  PID:7972
- C:\Windows\System\mZzRYGw.exe
  C:\Windows\System\mZzRYGw.exe
  2⤵
  PID:7988
- C:\Windows\System\GRVaHNY.exe
  C:\Windows\System\GRVaHNY.exe
  2⤵
  PID:8004
- C:\Windows\System\OXgbCmY.exe
  C:\Windows\System\OXgbCmY.exe
  2⤵
  PID:8072
- C:\Windows\System\fmUBEvC.exe
  C:\Windows\System\fmUBEvC.exe
  2⤵
  PID:8088
- C:\Windows\System\ufKdezA.exe
  C:\Windows\System\ufKdezA.exe
  2⤵
  PID:8112
- C:\Windows\System\tjJbyCd.exe
  C:\Windows\System\tjJbyCd.exe
  2⤵
  PID:8184
- C:\Windows\System\LlJpbST.exe
  C:\Windows\System\LlJpbST.exe
  2⤵
  PID:7344
- C:\Windows\System\SAvshxr.exe
  C:\Windows\System\SAvshxr.exe
  2⤵
  PID:7500
- C:\Windows\System\kWyDANw.exe
  C:\Windows\System\kWyDANw.exe
  2⤵
  PID:7280
- C:\Windows\System\ZZXZksK.exe
  C:\Windows\System\ZZXZksK.exe
  2⤵
  PID:8164
- C:\Windows\System\xBFsaHK.exe
  C:\Windows\System\xBFsaHK.exe
  2⤵
  PID:6580
- C:\Windows\System\cksFLiB.exe
  C:\Windows\System\cksFLiB.exe
  2⤵
  PID:7560
- C:\Windows\System\icUqgLa.exe
  C:\Windows\System\icUqgLa.exe
  2⤵
  PID:7296
- C:\Windows\System\OmiFxjc.exe
  C:\Windows\System\OmiFxjc.exe
  2⤵
  PID:7428
- C:\Windows\System\gScLoqi.exe
  C:\Windows\System\gScLoqi.exe
  2⤵
  PID:7516
- C:\Windows\System\xfeZyTL.exe
  C:\Windows\System\xfeZyTL.exe
  2⤵
  PID:7476
- C:\Windows\System\CivopQu.exe
  C:\Windows\System\CivopQu.exe
  2⤵
  PID:7640
- C:\Windows\System\LfwfYLM.exe
  C:\Windows\System\LfwfYLM.exe
  2⤵
  PID:7596
- C:\Windows\System\wvLFore.exe
  C:\Windows\System\wvLFore.exe
  2⤵
  PID:7644
- C:\Windows\System\hxFzdKy.exe
  C:\Windows\System\hxFzdKy.exe
  2⤵
  PID:7816
- C:\Windows\System\NRLAWLG.exe
  C:\Windows\System\NRLAWLG.exe
  2⤵
  PID:7768
- C:\Windows\System\vuKeUaE.exe
  C:\Windows\System\vuKeUaE.exe
  2⤵
  PID:7876
- C:\Windows\System\DWkOCEY.exe
  C:\Windows\System\DWkOCEY.exe
  2⤵
  PID:7896
- C:\Windows\System\jNtwioZ.exe
  C:\Windows\System\jNtwioZ.exe
  2⤵
  PID:7884
- C:\Windows\System\svGxvcN.exe
  C:\Windows\System\svGxvcN.exe
  2⤵
  PID:7872
- C:\Windows\System\hhHdmjN.exe
  C:\Windows\System\hhHdmjN.exe
  2⤵
  PID:7964
- C:\Windows\System\YZwPAUB.exe
  C:\Windows\System\YZwPAUB.exe
  2⤵
  PID:8096
- C:\Windows\System\qQHmWQj.exe
  C:\Windows\System\qQHmWQj.exe
  2⤵
  PID:7976
- C:\Windows\System\bOqAkaT.exe
  C:\Windows\System\bOqAkaT.exe
  2⤵
  PID:8076
- C:\Windows\System\uVLduEW.exe
  C:\Windows\System\uVLduEW.exe
  2⤵
  PID:6328
- C:\Windows\System\vHAIGQz.exe
  C:\Windows\System\vHAIGQz.exe
  2⤵
  PID:8148
- C:\Windows\System\HPCwxPb.exe
  C:\Windows\System\HPCwxPb.exe
  2⤵
  PID:7536
- C:\Windows\System\LvjKxOG.exe
  C:\Windows\System\LvjKxOG.exe
  2⤵
  PID:7568
- C:\Windows\System\rPjvfof.exe
  C:\Windows\System\rPjvfof.exe
  2⤵
  PID:6476
- C:\Windows\System\oKRjUoA.exe
  C:\Windows\System\oKRjUoA.exe
  2⤵
  PID:7552
- C:\Windows\System\ixqEjpw.exe
  C:\Windows\System\ixqEjpw.exe
  2⤵
  PID:7576
- C:\Windows\System\VrpXuHy.exe
  C:\Windows\System\VrpXuHy.exe
  2⤵
  PID:7780
- C:\Windows\System\UzlhRGR.exe
  C:\Windows\System\UzlhRGR.exe
  2⤵
  PID:7848
- C:\Windows\System\afKPGVf.exe
  C:\Windows\System\afKPGVf.exe
  2⤵
  PID:7312
- C:\Windows\System\bCkxJcy.exe
  C:\Windows\System\bCkxJcy.exe
  2⤵
  PID:7944
- C:\Windows\System\tNSHWbc.exe
  C:\Windows\System\tNSHWbc.exe
  2⤵
  PID:7260
- C:\Windows\System\HUOseur.exe
  C:\Windows\System\HUOseur.exe
  2⤵
  PID:7856
- C:\Windows\System\QnpCSrv.exe
  C:\Windows\System\QnpCSrv.exe
  2⤵
  PID:8084
- C:\Windows\System\VrujEQQ.exe
  C:\Windows\System\VrujEQQ.exe
  2⤵
  PID:8080
- C:\Windows\System\oqfuTjo.exe
  C:\Windows\System\oqfuTjo.exe
  2⤵
  PID:8180
- C:\Windows\System\puDuGmv.exe
  C:\Windows\System\puDuGmv.exe
  2⤵
  PID:7412
- C:\Windows\System\sbsUHZz.exe
  C:\Windows\System\sbsUHZz.exe
  2⤵
  PID:7800
- C:\Windows\System\VSTyjel.exe
  C:\Windows\System\VSTyjel.exe
  2⤵
  PID:8212
- C:\Windows\System\owZKbGT.exe
  C:\Windows\System\owZKbGT.exe
  2⤵
  PID:8240
- C:\Windows\System\ZAsaNWX.exe
  C:\Windows\System\ZAsaNWX.exe
  2⤵
  PID:8256
- C:\Windows\System\tkXMoBJ.exe
  C:\Windows\System\tkXMoBJ.exe
  2⤵
  PID:8272
- C:\Windows\System\dfCZWto.exe
  C:\Windows\System\dfCZWto.exe
  2⤵
  PID:8372
- C:\Windows\System\GrNGCLp.exe
  C:\Windows\System\GrNGCLp.exe
  2⤵
  PID:8388
- C:\Windows\System\qGNoyps.exe
  C:\Windows\System\qGNoyps.exe
  2⤵
  PID:8404
- C:\Windows\System\MdmjVjk.exe
  C:\Windows\System\MdmjVjk.exe
  2⤵
  PID:8420
- C:\Windows\System\IGxTWQF.exe
  C:\Windows\System\IGxTWQF.exe
  2⤵
  PID:8436
- C:\Windows\System\IgllNTM.exe
  C:\Windows\System\IgllNTM.exe
  2⤵
  PID:8452
- C:\Windows\System\HHHwSms.exe
  C:\Windows\System\HHHwSms.exe
  2⤵
  PID:8472
- C:\Windows\System\xyOPqJC.exe
  C:\Windows\System\xyOPqJC.exe
  2⤵
  PID:8488
- C:\Windows\System\zqiFTEx.exe
  C:\Windows\System\zqiFTEx.exe
  2⤵
  PID:8504
- C:\Windows\System\oSkwCSR.exe
  C:\Windows\System\oSkwCSR.exe
  2⤵
  PID:8520
- C:\Windows\System\uIxgkxf.exe
  C:\Windows\System\uIxgkxf.exe
  2⤵
  PID:8540
- C:\Windows\System\VlYDjWt.exe
  C:\Windows\System\VlYDjWt.exe
  2⤵
  PID:8556
- C:\Windows\System\MggFnNO.exe
  C:\Windows\System\MggFnNO.exe
  2⤵
  PID:8572
- C:\Windows\System\zucTwvg.exe
  C:\Windows\System\zucTwvg.exe
  2⤵
  PID:8592
- C:\Windows\System\pwAwPDY.exe
  C:\Windows\System\pwAwPDY.exe
  2⤵
  PID:8608
- C:\Windows\System\EwyyKlm.exe
  C:\Windows\System\EwyyKlm.exe
  2⤵
  PID:8628
- C:\Windows\System\RfWbNCH.exe
  C:\Windows\System\RfWbNCH.exe
  2⤵
  PID:8688
- C:\Windows\System\fvMODEQ.exe
  C:\Windows\System\fvMODEQ.exe
  2⤵
  PID:8704
- C:\Windows\System\WDqUGPN.exe
  C:\Windows\System\WDqUGPN.exe
  2⤵
  PID:8724
- C:\Windows\System\SYNYEUd.exe
  C:\Windows\System\SYNYEUd.exe
  2⤵
  PID:8748
- C:\Windows\System\ZyyOOdk.exe
  C:\Windows\System\ZyyOOdk.exe
  2⤵
  PID:8768
- C:\Windows\System\TCRjfYU.exe
  C:\Windows\System\TCRjfYU.exe
  2⤵
  PID:8784
- C:\Windows\System\YSyfhOn.exe
  C:\Windows\System\YSyfhOn.exe
  2⤵
  PID:8800
- C:\Windows\System\HOsImKu.exe
  C:\Windows\System\HOsImKu.exe
  2⤵
  PID:8816
- C:\Windows\System\gygeunV.exe
  C:\Windows\System\gygeunV.exe
  2⤵
  PID:8832
- C:\Windows\System\xwoLBZT.exe
  C:\Windows\System\xwoLBZT.exe
  2⤵
  PID:8848
- C:\Windows\System\qJICXMl.exe
  C:\Windows\System\qJICXMl.exe
  2⤵
  PID:8864
- C:\Windows\System\ftytYmw.exe
  C:\Windows\System\ftytYmw.exe
  2⤵
  PID:8884
- C:\Windows\System\UxeQehO.exe
  C:\Windows\System\UxeQehO.exe
  2⤵
  PID:8900
- C:\Windows\System\mSzysBr.exe
  C:\Windows\System\mSzysBr.exe
  2⤵
  PID:8920
- C:\Windows\System\tpBcGPQ.exe
  C:\Windows\System\tpBcGPQ.exe
  2⤵
  PID:8956
- C:\Windows\System\KtYaMsV.exe
  C:\Windows\System\KtYaMsV.exe
  2⤵
  PID:8976
- C:\Windows\System\YCvrXBN.exe
  C:\Windows\System\YCvrXBN.exe
  2⤵
  PID:8992
- C:\Windows\System\LbmfJxj.exe
  C:\Windows\System\LbmfJxj.exe
  2⤵
  PID:9008
- C:\Windows\System\RMTggaK.exe
  C:\Windows\System\RMTggaK.exe
  2⤵
  PID:9024
- C:\Windows\System\COVxpEO.exe
  C:\Windows\System\COVxpEO.exe
  2⤵
  PID:9040
- C:\Windows\System\tTwQkhN.exe
  C:\Windows\System\tTwQkhN.exe
  2⤵
  PID:9056
- C:\Windows\System\pzVfNvK.exe
  C:\Windows\System\pzVfNvK.exe
  2⤵
  PID:9072
- C:\Windows\System\LSOoneJ.exe
  C:\Windows\System\LSOoneJ.exe
  2⤵
  PID:9088
- C:\Windows\System\RfVACXJ.exe
  C:\Windows\System\RfVACXJ.exe
  2⤵
  PID:9104
- C:\Windows\System\kLHDtXe.exe
  C:\Windows\System\kLHDtXe.exe
  2⤵
  PID:9132
- C:\Windows\System\PYuMpaV.exe
  C:\Windows\System\PYuMpaV.exe
  2⤵
  PID:9152
- C:\Windows\System\DJUdHDd.exe
  C:\Windows\System\DJUdHDd.exe
  2⤵
  PID:9168
- C:\Windows\System\RHXEDCo.exe
  C:\Windows\System\RHXEDCo.exe
  2⤵
  PID:9184
- C:\Windows\System\mFwFTqD.exe
  C:\Windows\System\mFwFTqD.exe
  2⤵
  PID:9200
- C:\Windows\System\icjIpwW.exe
  C:\Windows\System\icjIpwW.exe
  2⤵
  PID:7852
- C:\Windows\System\KlbRFll.exe
  C:\Windows\System\KlbRFll.exe
  2⤵
  PID:7392
- C:\Windows\System\xMXFZiK.exe
  C:\Windows\System\xMXFZiK.exe
  2⤵
  PID:8220
- C:\Windows\System\IklXiKT.exe
  C:\Windows\System\IklXiKT.exe
  2⤵
  PID:7592
- C:\Windows\System\QXQaZVK.exe
  C:\Windows\System\QXQaZVK.exe
  2⤵
  PID:7216
- C:\Windows\System\zKtJffQ.exe
  C:\Windows\System\zKtJffQ.exe
  2⤵
  PID:8204
- C:\Windows\System\TMSjBSn.exe
  C:\Windows\System\TMSjBSn.exe
  2⤵
  PID:8236
- C:\Windows\System\RVvzjKM.exe
  C:\Windows\System\RVvzjKM.exe
  2⤵
  PID:8248
- C:\Windows\System\VXCMaRZ.exe
  C:\Windows\System\VXCMaRZ.exe
  2⤵
  PID:8328
- C:\Windows\System\ddolOkH.exe
  C:\Windows\System\ddolOkH.exe
  2⤵
  PID:8344
- C:\Windows\System\HISsYeS.exe
  C:\Windows\System\HISsYeS.exe
  2⤵
  PID:8412
- C:\Windows\System\YUtErLc.exe
  C:\Windows\System\YUtErLc.exe
  2⤵
  PID:8316
- C:\Windows\System\ujwqlcm.exe
  C:\Windows\System\ujwqlcm.exe
  2⤵
  PID:8480
- C:\Windows\System\caZjIZV.exe
  C:\Windows\System\caZjIZV.exe
  2⤵
  PID:8484
- C:\Windows\System\GaWyrPx.exe
  C:\Windows\System\GaWyrPx.exe
  2⤵
  PID:8516
- C:\Windows\System\NntymUr.exe
  C:\Windows\System\NntymUr.exe
  2⤵
  PID:8384
- C:\Windows\System\nQsYdoV.exe
  C:\Windows\System\nQsYdoV.exe
  2⤵
  PID:8416
- C:\Windows\System\XnWklCs.exe
  C:\Windows\System\XnWklCs.exe
  2⤵
  PID:8464
- C:\Windows\System\vLIJRZl.exe
  C:\Windows\System\vLIJRZl.exe
  2⤵
  PID:8400
- C:\Windows\System\hSVakfF.exe
  C:\Windows\System\hSVakfF.exe
  2⤵
  PID:8568
- C:\Windows\System\NwOLfFZ.exe
  C:\Windows\System\NwOLfFZ.exe
  2⤵
  PID:8528
- C:\Windows\System\qXhXgBl.exe
  C:\Windows\System\qXhXgBl.exe
  2⤵
  PID:8644
- C:\Windows\System\nVYCqXM.exe
  C:\Windows\System\nVYCqXM.exe
  2⤵
  PID:8696
- C:\Windows\System\ZpJCsGW.exe
  C:\Windows\System\ZpJCsGW.exe
  2⤵
  PID:8640
- C:\Windows\System\MLZvRhs.exe
  C:\Windows\System\MLZvRhs.exe
  2⤵
  PID:8652
- C:\Windows\System\XJhCvbc.exe
  C:\Windows\System\XJhCvbc.exe
  2⤵
  PID:8760
- C:\Windows\System\kslLHyR.exe
  C:\Windows\System\kslLHyR.exe
  2⤵
  PID:8672
- C:\Windows\System\JdigSNk.exe
  C:\Windows\System\JdigSNk.exe
  2⤵
  PID:8896
- C:\Windows\System\UofsfVI.exe
  C:\Windows\System\UofsfVI.exe
  2⤵
  PID:8844
- C:\Windows\System\HqqoVPn.exe
  C:\Windows\System\HqqoVPn.exe
  2⤵
  PID:8824
- C:\Windows\System\atWbrmu.exe
  C:\Windows\System\atWbrmu.exe
  2⤵
  PID:8840
- C:\Windows\System\dxokIAd.exe
  C:\Windows\System\dxokIAd.exe
  2⤵
  PID:8796
- C:\Windows\System\wjLfwfN.exe
  C:\Windows\System\wjLfwfN.exe
  2⤵
  PID:8972
- C:\Windows\System\cQJjOPT.exe
  C:\Windows\System\cQJjOPT.exe
  2⤵
  PID:9032
- C:\Windows\System\JbRoUJN.exe
  C:\Windows\System\JbRoUJN.exe
  2⤵
  PID:8948
- C:\Windows\System\koPbGDU.exe
  C:\Windows\System\koPbGDU.exe
  2⤵
  PID:9096
- C:\Windows\System\cLJiImr.exe
  C:\Windows\System\cLJiImr.exe
  2⤵
  PID:9016
- C:\Windows\System\WFwiCYC.exe
  C:\Windows\System\WFwiCYC.exe
  2⤵
  PID:9080
- C:\Windows\System\nvKKgoH.exe
  C:\Windows\System\nvKKgoH.exe
  2⤵
  PID:9116
- C:\Windows\System\rnBksyz.exe
  C:\Windows\System\rnBksyz.exe
  2⤵
  PID:9176
- C:\Windows\System\jvyhspw.exe
  C:\Windows\System\jvyhspw.exe
  2⤵
  PID:8052
- C:\Windows\System\oTEOQFE.exe
  C:\Windows\System\oTEOQFE.exe
  2⤵
  PID:8232
- C:\Windows\System\ffQHSlH.exe
  C:\Windows\System\ffQHSlH.exe
  2⤵
  PID:9192
- C:\Windows\System\WgCCUXJ.exe
  C:\Windows\System\WgCCUXJ.exe
  2⤵
  PID:9164
- C:\Windows\System\rnRPjQh.exe
  C:\Windows\System\rnRPjQh.exe
  2⤵
  PID:8444
- C:\Windows\System\FCmvSmw.exe
  C:\Windows\System\FCmvSmw.exe
  2⤵
  PID:7276
- C:\Windows\System\YpnFwly.exe
  C:\Windows\System\YpnFwly.exe
  2⤵
  PID:8620
- C:\Windows\System\WReSHnj.exe
  C:\Windows\System\WReSHnj.exe
  2⤵
  PID:8552
- C:\Windows\System\wagjiEB.exe
  C:\Windows\System\wagjiEB.exe
  2⤵
  PID:8304
- C:\Windows\System\zvTSkqL.exe
  C:\Windows\System\zvTSkqL.exe
  2⤵
  PID:8532
- C:\Windows\System\YaCjdmq.exe
  C:\Windows\System\YaCjdmq.exe
  2⤵
  PID:8496
- C:\Windows\System\YvswDno.exe
  C:\Windows\System\YvswDno.exe
  2⤵
  PID:8664
- C:\Windows\System\zjWGIsG.exe
  C:\Windows\System\zjWGIsG.exe
  2⤵
  PID:8732
- C:\Windows\System\HptNsuK.exe
  C:\Windows\System\HptNsuK.exe
  2⤵
  PID:8684
- C:\Windows\System\KYISvgQ.exe
  C:\Windows\System\KYISvgQ.exe
  2⤵
  PID:8780
- C:\Windows\System\ZngbTlg.exe
  C:\Windows\System\ZngbTlg.exe
  2⤵
  PID:8892
- C:\Windows\System\Cgdqipg.exe
  C:\Windows\System\Cgdqipg.exe
  2⤵
  PID:8928
- C:\Windows\System\Ntgufwp.exe
  C:\Windows\System\Ntgufwp.exe
  2⤵
  PID:8940
- C:\Windows\System\eQfeBcn.exe
  C:\Windows\System\eQfeBcn.exe
  2⤵
  PID:9124
- C:\Windows\System\ceGwEZh.exe
  C:\Windows\System\ceGwEZh.exe
  2⤵
  PID:8808
- C:\Windows\System\esVYCfm.exe
  C:\Windows\System\esVYCfm.exe
  2⤵
  PID:9064
- C:\Windows\System\vzpNavd.exe
  C:\Windows\System\vzpNavd.exe
  2⤵
  PID:9140
- C:\Windows\System\sYEbTna.exe
  C:\Windows\System\sYEbTna.exe
  2⤵
  PID:9208
- C:\Windows\System\AqaNPFd.exe
  C:\Windows\System\AqaNPFd.exe
  2⤵
  PID:8264
- C:\Windows\System\dJBbkRb.exe
  C:\Windows\System\dJBbkRb.exe
  2⤵
  PID:8604
- C:\Windows\System\WPitqli.exe
  C:\Windows\System\WPitqli.exe
  2⤵
  PID:8648
- C:\Windows\System\WwCWwgL.exe
  C:\Windows\System\WwCWwgL.exe
  2⤵
  PID:8428
- C:\Windows\System\ITrsoLK.exe
  C:\Windows\System\ITrsoLK.exe
  2⤵
  PID:8284
- C:\Windows\System\fyIUQnf.exe
  C:\Windows\System\fyIUQnf.exe
  2⤵
  PID:8668
- C:\Windows\System\pMoUGkU.exe
  C:\Windows\System\pMoUGkU.exe
  2⤵
  PID:8812
- C:\Windows\System\cphhrqL.exe
  C:\Windows\System\cphhrqL.exe
  2⤵
  PID:9120
- C:\Windows\System\HzKRVFo.exe
  C:\Windows\System\HzKRVFo.exe
  2⤵
  PID:8296
- C:\Windows\System\xGVfdxT.exe
  C:\Windows\System\xGVfdxT.exe
  2⤵
  PID:7372
- C:\Windows\System\UmcOZtQ.exe
  C:\Windows\System\UmcOZtQ.exe
  2⤵
  PID:8580
- C:\Windows\System\VbUOkaS.exe
  C:\Windows\System\VbUOkaS.exe
  2⤵
  PID:8792
- C:\Windows\System\wHHqspQ.exe
  C:\Windows\System\wHHqspQ.exe
  2⤵
  PID:8916
- C:\Windows\System\cTIHAxV.exe
  C:\Windows\System\cTIHAxV.exe
  2⤵
  PID:8968
- C:\Windows\System\fAzrUJm.exe
  C:\Windows\System\fAzrUJm.exe
  2⤵
  PID:8988
- C:\Windows\System\RSVgKXI.exe
  C:\Windows\System\RSVgKXI.exe
  2⤵
  PID:9236
- C:\Windows\System\perCCbz.exe
  C:\Windows\System\perCCbz.exe
  2⤵
  PID:9252
- C:\Windows\System\bttfjRC.exe
  C:\Windows\System\bttfjRC.exe
  2⤵
  PID:9268
- C:\Windows\System\ivWDPUa.exe
  C:\Windows\System\ivWDPUa.exe
  2⤵
  PID:9284
- C:\Windows\System\wRWqrpD.exe
  C:\Windows\System\wRWqrpD.exe
  2⤵
  PID:9300
- C:\Windows\System\SuzIOIi.exe
  C:\Windows\System\SuzIOIi.exe
  2⤵
  PID:9316
- C:\Windows\System\fLocZEc.exe
  C:\Windows\System\fLocZEc.exe
  2⤵
  PID:9332
- C:\Windows\System\tIpeMxB.exe
  C:\Windows\System\tIpeMxB.exe
  2⤵
  PID:9352
- C:\Windows\System\ogMkJOY.exe
  C:\Windows\System\ogMkJOY.exe
  2⤵
  PID:9372
- C:\Windows\System\dSdZkVe.exe
  C:\Windows\System\dSdZkVe.exe
  2⤵
  PID:9392
- C:\Windows\System\jGnLUOs.exe
  C:\Windows\System\jGnLUOs.exe
  2⤵
  PID:9408
- C:\Windows\System\FoWDjKE.exe
  C:\Windows\System\FoWDjKE.exe
  2⤵
  PID:9424
- C:\Windows\System\aopeMGG.exe
  C:\Windows\System\aopeMGG.exe
  2⤵
  PID:9480
- C:\Windows\System\DpIoMIH.exe
  C:\Windows\System\DpIoMIH.exe
  2⤵
  PID:9496
- C:\Windows\System\mmnDtUV.exe
  C:\Windows\System\mmnDtUV.exe
  2⤵
  PID:9516
- C:\Windows\System\qhHvcxB.exe
  C:\Windows\System\qhHvcxB.exe
  2⤵
  PID:9532
- C:\Windows\System\fqqAvsD.exe
  C:\Windows\System\fqqAvsD.exe
  2⤵
  PID:9552
- C:\Windows\System\MpQOOga.exe
  C:\Windows\System\MpQOOga.exe
  2⤵
  PID:9568
- C:\Windows\System\iKxtGRZ.exe
  C:\Windows\System\iKxtGRZ.exe
  2⤵
  PID:9584
- C:\Windows\System\hYpcdmT.exe
  C:\Windows\System\hYpcdmT.exe
  2⤵
  PID:9604
- C:\Windows\System\tIDhTmH.exe
  C:\Windows\System\tIDhTmH.exe
  2⤵
  PID:9620
- C:\Windows\System\sqGBxCZ.exe
  C:\Windows\System\sqGBxCZ.exe
  2⤵
  PID:9636
- C:\Windows\System\oBjXWMf.exe
  C:\Windows\System\oBjXWMf.exe
  2⤵
  PID:9652
- C:\Windows\System\hiqzstC.exe
  C:\Windows\System\hiqzstC.exe
  2⤵
  PID:9668
- C:\Windows\System\lbaoUEJ.exe
  C:\Windows\System\lbaoUEJ.exe
  2⤵
  PID:9684
- C:\Windows\System\cycKPPc.exe
  C:\Windows\System\cycKPPc.exe
  2⤵
  PID:9704
- C:\Windows\System\MBeBxtk.exe
  C:\Windows\System\MBeBxtk.exe
  2⤵
  PID:9720
- C:\Windows\System\GQPmbkB.exe
  C:\Windows\System\GQPmbkB.exe
  2⤵
  PID:9748
- C:\Windows\System\DpfLUxP.exe
  C:\Windows\System\DpfLUxP.exe
  2⤵
  PID:9764
- C:\Windows\System\IuXTtqF.exe
  C:\Windows\System\IuXTtqF.exe
  2⤵
  PID:9780
- C:\Windows\System\tYtYvUS.exe
  C:\Windows\System\tYtYvUS.exe
  2⤵
  PID:9800
- C:\Windows\System\jJQjSoK.exe
  C:\Windows\System\jJQjSoK.exe
  2⤵
  PID:9820
- C:\Windows\System\RhZDqbd.exe
  C:\Windows\System\RhZDqbd.exe
  2⤵
  PID:9844
- C:\Windows\System\bLasqOb.exe
  C:\Windows\System\bLasqOb.exe
  2⤵
  PID:9860
- C:\Windows\System\jAUxHme.exe
  C:\Windows\System\jAUxHme.exe
  2⤵
  PID:9876
- C:\Windows\System\bRQOUjH.exe
  C:\Windows\System\bRQOUjH.exe
  2⤵
  PID:9892
- C:\Windows\System\NtUrrxt.exe
  C:\Windows\System\NtUrrxt.exe
  2⤵
  PID:9912
- C:\Windows\System\aZGnqrA.exe
  C:\Windows\System\aZGnqrA.exe
  2⤵
  PID:9928
- C:\Windows\System\vRRgFfD.exe
  C:\Windows\System\vRRgFfD.exe
  2⤵
  PID:10100
- C:\Windows\System\cQDaueh.exe
  C:\Windows\System\cQDaueh.exe
  2⤵
  PID:10196
- C:\Windows\System\vKlcpJq.exe
  C:\Windows\System\vKlcpJq.exe
  2⤵
  PID:10220
- C:\Windows\System\dyMxPzM.exe
  C:\Windows\System\dyMxPzM.exe
  2⤵
  PID:10236
- C:\Windows\System\BysreRm.exe
  C:\Windows\System\BysreRm.exe
  2⤵
  PID:8776
- C:\Windows\System\NjktbAB.exe
  C:\Windows\System\NjktbAB.exe
  2⤵
  PID:9232
- C:\Windows\System\VLQDRJX.exe
  C:\Windows\System\VLQDRJX.exe
  2⤵
  PID:9328
- C:\Windows\System\xezYqyo.exe
  C:\Windows\System\xezYqyo.exe
  2⤵
  PID:9020
- C:\Windows\System\gqIKVpo.exe
  C:\Windows\System\gqIKVpo.exe
  2⤵
  PID:7804
- C:\Windows\System\SIeERMg.exe
  C:\Windows\System\SIeERMg.exe
  2⤵
  PID:7332
- C:\Windows\System\klPzDab.exe
  C:\Windows\System\klPzDab.exe
  2⤵
  PID:8880
- C:\Windows\System\VyoJEJB.exe
  C:\Windows\System\VyoJEJB.exe
  2⤵
  PID:9280
- C:\Windows\System\PgGHutw.exe
  C:\Windows\System\PgGHutw.exe
  2⤵
  PID:9344
- C:\Windows\System\gFOvWzU.exe
  C:\Windows\System\gFOvWzU.exe
  2⤵
  PID:9416
- C:\Windows\System\lvdgfnp.exe
  C:\Windows\System\lvdgfnp.exe
  2⤵
  PID:9432
- C:\Windows\System\MjTyFee.exe
  C:\Windows\System\MjTyFee.exe
  2⤵
  PID:9448
- C:\Windows\System\czQGNZP.exe
  C:\Windows\System\czQGNZP.exe
  2⤵
  PID:9464
- C:\Windows\System\VAAGfej.exe
  C:\Windows\System\VAAGfej.exe
  2⤵
  PID:9504
- C:\Windows\System\awlEkFs.exe
  C:\Windows\System\awlEkFs.exe
  2⤵
  PID:9544
- C:\Windows\System\HDhHZsW.exe
  C:\Windows\System\HDhHZsW.exe
  2⤵
  PID:9528
- C:\Windows\System\zihDPYF.exe
  C:\Windows\System\zihDPYF.exe
  2⤵
  PID:9644
- C:\Windows\System\kIvaHxV.exe
  C:\Windows\System\kIvaHxV.exe
  2⤵
  PID:9524
- C:\Windows\System\GJlrkaB.exe
  C:\Windows\System\GJlrkaB.exe
  2⤵
  PID:9692
- C:\Windows\System\eaOmZFY.exe
  C:\Windows\System\eaOmZFY.exe
  2⤵
  PID:9596
- C:\Windows\System\ZBFmErD.exe
  C:\Windows\System\ZBFmErD.exe
  2⤵
  PID:9760
- C:\Windows\System\NpxLgig.exe
  C:\Windows\System\NpxLgig.exe
  2⤵
  PID:9628
- C:\Windows\System\NHvBomm.exe
  C:\Windows\System\NHvBomm.exe
  2⤵
  PID:9696
- C:\Windows\System\EMCOPCa.exe
  C:\Windows\System\EMCOPCa.exe
  2⤵
  PID:9736
- C:\Windows\System\kbzkEkY.exe
  C:\Windows\System\kbzkEkY.exe
  2⤵
  PID:9816
- C:\Windows\System\bErEpRP.exe
  C:\Windows\System\bErEpRP.exe
  2⤵
  PID:9840
- C:\Windows\System\BOwyxCA.exe
  C:\Windows\System\BOwyxCA.exe
  2⤵
  PID:9888
- C:\Windows\System\MGqIHMc.exe
  C:\Windows\System\MGqIHMc.exe
  2⤵
  PID:9836
- C:\Windows\System\cpmwgkc.exe
  C:\Windows\System\cpmwgkc.exe
  2⤵
  PID:9904
- C:\Windows\System\oDJFQie.exe
  C:\Windows\System\oDJFQie.exe
  2⤵
  PID:9940
- C:\Windows\System\thCLkvw.exe
  C:\Windows\System\thCLkvw.exe
  2⤵
  PID:9992
- C:\Windows\System\pCRAltD.exe
  C:\Windows\System\pCRAltD.exe
  2⤵
  PID:10012
- C:\Windows\System\GCOZGKw.exe
  C:\Windows\System\GCOZGKw.exe
  2⤵
  PID:10032
- C:\Windows\System\DnphKPE.exe
  C:\Windows\System\DnphKPE.exe
  2⤵
  PID:10048
- C:\Windows\System\feIJDol.exe
  C:\Windows\System\feIJDol.exe
  2⤵
  PID:10060
- C:\Windows\System\ilMPOae.exe
  C:\Windows\System\ilMPOae.exe
  2⤵
  PID:10068
- C:\Windows\System\YGKiwFR.exe
  C:\Windows\System\YGKiwFR.exe
  2⤵
  PID:10096
- C:\Windows\System\Fsgusoh.exe
  C:\Windows\System\Fsgusoh.exe
  2⤵
  PID:10120
- C:\Windows\System\mcQzKJB.exe
  C:\Windows\System\mcQzKJB.exe
  2⤵
  PID:10144
- C:\Windows\System\nAUgthZ.exe
  C:\Windows\System\nAUgthZ.exe
  2⤵
  PID:10156
- C:\Windows\System\ugcUDCW.exe
  C:\Windows\System\ugcUDCW.exe
  2⤵
  PID:10172
- C:\Windows\System\vSuqugH.exe
  C:\Windows\System\vSuqugH.exe
  2⤵
  PID:10212
- C:\Windows\System\kJembnq.exe
  C:\Windows\System\kJembnq.exe
  2⤵
  PID:9292
- C:\Windows\System\pErMoJD.exe
  C:\Windows\System\pErMoJD.exe
  2⤵
  PID:8380
- C:\Windows\System\PtxvKfC.exe
  C:\Windows\System\PtxvKfC.exe
  2⤵
  PID:9220
- C:\Windows\System\wewjzbQ.exe
  C:\Windows\System\wewjzbQ.exe
  2⤵
  PID:9260
- C:\Windows\System\kTvtuFP.exe
  C:\Windows\System\kTvtuFP.exe
  2⤵
  PID:8756
- C:\Windows\System\MYbQrxL.exe
  C:\Windows\System\MYbQrxL.exe
  2⤵
  PID:9248
- C:\Windows\System\zfDmEvM.exe
  C:\Windows\System\zfDmEvM.exe
  2⤵
  PID:9404
- C:\Windows\System\pvspJxa.exe
  C:\Windows\System\pvspJxa.exe
  2⤵
  PID:9540
- C:\Windows\System\SPveDip.exe
  C:\Windows\System\SPveDip.exe
  2⤵
  PID:9492
- C:\Windows\System\UKtSZMm.exe
  C:\Windows\System\UKtSZMm.exe
  2⤵
  PID:9712
- C:\Windows\System\WbarncF.exe
  C:\Windows\System\WbarncF.exe
  2⤵
  PID:9716
- C:\Windows\System\hzeXbPZ.exe
  C:\Windows\System\hzeXbPZ.exe
  2⤵
  PID:9592
- C:\Windows\System\MueGsnD.exe
  C:\Windows\System\MueGsnD.exe
  2⤵
  PID:9796
- C:\Windows\System\MZyihGA.exe
  C:\Windows\System\MZyihGA.exe
  2⤵
  PID:9744
- C:\Windows\System\zKKVcHo.exe
  C:\Windows\System\zKKVcHo.exe
  2⤵
  PID:9856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CNDjZeI.exe

Filesize
2.4MB

MD5
101278debc6179ee79c1db8dd8ab897e

SHA1
d01300573b71578f2361d49b09ea88be2854f073

SHA256
d686158478a90e4fe1d86acd48fd9501b1cf3fb7241a1cfcfe674e8c3a414ce5

SHA512
28d580d72b34de98a6a4dd6c2148cc2e1f35b7d26469f9b97944d1eca8eb6188d1e2c7b608f21e73cba57eb60f34a207f634341143a6c26fd8a24d5e065e4693

Download Submit
C:\Windows\system\HIxCutq.exe

Filesize
2.4MB

MD5
1ccc89bc071ef6f380da41591ef3b249

SHA1
5de5553c0eb61d27476360cf0d1d0816d46768f4

SHA256
bd31cf02a932d63f50cceb0d7b1e16deb1d58ad78ec917cffb2af05483738c03

SHA512
2f3e2f469569db32b550c5b6071f616bfa666570606dff38b27b466038b880c98deeb296578cdf77d27d98e71654ed108c691428682f602b71dc811cc385c0a7

Download Submit
C:\Windows\system\KPSfcmf.exe

Filesize
2.4MB

MD5
0323c11bc2aa89ca8a59e23b5b01476b

SHA1
24cbf8e5c4513cc56c08b6c8462cb116adc917d3

SHA256
62d2d56022fd250d8525e438e1b83742378763c160a5a621a0c316f4db2082e6

SHA512
a541f4ece35d5d36eca43eb0bc21f1a8d875bf157504bbc6276a8581ac82108182ec4be600ae29b7b9f39673cfee61e717c011c2b56081ef5edb674c3d061cc4

Download Submit
C:\Windows\system\KtYxRbf.exe

Filesize
2.4MB

MD5
306519e33e0d1c038d6e1eb676a69a07

SHA1
7aa249364bf29b6caa151352ca002793f37bba49

SHA256
b63ab65203ac5d3abf816dcee7f6cda738137185ac2fda98dfbcd83b7d5a8a39

SHA512
c44fdb8cad95d24031cea4a04b4cbcedad3de3e964578a16752fe33a4fe4f440601205da0e7e65f27d2a8aeb4bb3a1a028afd4e83e9f9ecdc55ef41b51bef48e

Download Submit
C:\Windows\system\LPFtoQW.exe

Filesize
2.4MB

MD5
c19ed23efcefcd62efd6db78b106e4aa

SHA1
1e2ecae706e40d64d08c378025a07957b0ce95f3

SHA256
50b6b0e3b63b72ea451c9c4834529fd9e19e6e3ce1a691190a0427edbc129b0d

SHA512
230340c7e67c0877335b5539cd41741df1a415762c65a0ad49628ba21fe4b639f3e300034141ff2b37a962cf84fa6775c69f703c403e1e8318210bb09a21b427

Download Submit
C:\Windows\system\MtKjSzM.exe

Filesize
2.4MB

MD5
9b8838c4c9495220d6ca8a0467bfae1c

SHA1
871fee2e7e74251a01f64eae3f4b15f965f55b48

SHA256
7de0176ca398a17724753a5c09a28c942a7bb1f77133f162e2e0c477501b3fea

SHA512
2b3fc588bdb61b72b6706287dec1fc6a7c9d1860331092d68991abebece40c6469a2df323a7c5379cd4eb61a5bd60990462a026df087bbecda9ee67c2e9c1005

Download Submit
C:\Windows\system\NgXjeGD.exe

Filesize
2.4MB

MD5
55555eca294f42316b9f685f47f446c6

SHA1
eacd584042cd37d48dd4a11d41ff2b9084d7631e

SHA256
79fe3e6bb28acc634db9adce2251761bb9340cf56a71b55e0e701ad1676041ff

SHA512
3bcd8d0d8d6a62d6c1564009a56e9d154091475cf3b74a0c443c4fad49f26b1ca9ad44b07c00a0fe0abda58bce0f613c7437b8c2189a2fa81692cf62dc2cf734

Download Submit
C:\Windows\system\PDerJNM.exe

Filesize
2.4MB

MD5
8ccaec3361f09dcf032d11ba0f133c3a

SHA1
e18680bc1ed21865dbfcf35435d74b4a840d5081

SHA256
097f46d47a76e9dbd5376a9dd6613d907fa52027e15f3a8d3afabab483f757a1

SHA512
7ef23c4cccf916537bffc75c1b18a71f65b80c23aacf8fe493bcce79c8ca61a202e29190492ea5421c7a51f0e6ad34a61099271bd81c6bf5df069bcbc283b2ea

Download Submit
C:\Windows\system\QjXherP.exe

Filesize
2.4MB

MD5
f5c7a8a2e8abfef5233c9d6ece3ac774

SHA1
9a311ea305d560a0a376027e627ecadce0db694b

SHA256
72bfd193c0d6a61ec216d95513bf3884d0bdb4f11456f2137494bdde3d87dd58

SHA512
a3ab922da14d2187b1bbefd5da236465352fba224283973db6b156d1e77c4709cd21cc790b61298fe795d95dff18868c0e74c706351d8b3f15c130b9cac9508b

Download Submit
C:\Windows\system\QvIggcI.exe

Filesize
2.4MB

MD5
c8fac5d3b87371a31336d94377c73833

SHA1
a7e26c8598637d58a737fb6076a5d9a37b30ae8f

SHA256
d55ea9400272fed7d695c77856761850ffe4a95f1e8d6499531171e730221ee3

SHA512
8fb40e7bc0e4e80e4354e5b2ae38a25c877407c3eb5846820a29319ec742fc12227830358849163499e591e98ccc6ca5624f24e7b6b63d8da53e3bc7c31171ae

Download Submit
C:\Windows\system\RhxApRn.exe

Filesize
2.4MB

MD5
c4a58626412f56dccf1640eb857e9708

SHA1
f4a52006b428e5656718a7ea6d23101765a2c074

SHA256
18738ea31831fe1e79bcbf08c142e9f08f923d0011f92d83341944169be47a4f

SHA512
b629d97a852d92099a65de3eb525f95a283d794c54ee8130ca2562595f84d782b47023b58be6812daaba2e599fc5017faf8bdbf28dffb617b5bccfa7ec6a5629

Download Submit
C:\Windows\system\SXoaJPi.exe

Filesize
2.4MB

MD5
f23bb1aaf25c480d098bca7f96a98216

SHA1
640b3c60523095ce5641adc02667a160866efb4b

SHA256
aeb5d8383a196c91761750019751eb0f27b6684793f0015fd3286a3a93043d0c

SHA512
0b24afaadd69a5f0ee70fc97810933352a5c5af3138f17f98865a41eeb4e80698e85907f9a9e5a16a3888945b8ae34a952fbf44c4d820e299cb215f8dea808d9

Download Submit
C:\Windows\system\TzeNksQ.exe

Filesize
2.4MB

MD5
1954d7abe159aa987bff1efe278134ef

SHA1
e894df9ab4f4c4e11308c642d4db1038d5ab1e36

SHA256
5165894c7f740c2b8559265cf6ac282a520078ba5ab167c0bec454d59f54aafd

SHA512
024d5af4a1fbcec9728fc3f168f67ac17e830c77ff144499d949b7c5a1bacfd9e5a8aab5d658e07669cdddecdc4d947197e547bf6d2f8ff5f361253cb24fff8d

Download Submit
C:\Windows\system\ViSuPVy.exe

Filesize
2.4MB

MD5
66940144119a0fe8087e000274313d0c

SHA1
65836e650c4643f9ac8e9c0828ed00e8ea4bbeea

SHA256
a333bd06d717ded5b32182bccbbe4a28f9ea625fad02d4aa521552a3fa903ab0

SHA512
8f39053585c595fb02c22a2554dd20473713514673dbf5d338161b4f84eb96846c8166465c23c7ce1abef2bc41b73f38af834195a11098e3f6ef879507cbfe0f

Download Submit
C:\Windows\system\aGVfoEJ.exe

Filesize
2.4MB

MD5
d6408a53c694c241d057eae81b68c627

SHA1
264893656ed3412c12ed70b453daeb76b372c962

SHA256
8b8a4be314f641f29c72abb136cf71c8c68c0d3c745c1ad5d8a61be79ac14287

SHA512
670c18e5633feb999812793bf7e0085f38e3330c29a828b22dcfb47c4a134e53e628dbef6f1b499bdc0dbb4492c291b04227ddb2cd46d557edd18bd2fe1b1731

Download Submit
C:\Windows\system\ayVzOhz.exe

Filesize
2.4MB

MD5
9601b6ed69f5aab872852d13adf79ed2

SHA1
1b6b518f44a01170de2593c9656fb52ea8c9e745

SHA256
ddd963a039c3dfbb5817408df71ae30ca1409cfd65e391d8776a6db0f2dfe0e9

SHA512
34ab926a55342a445eb4054af95618600da48842e146636021c2ff49a7e7dc643603e00169160966c87492680b35760e80b36c97aeec085e9d858e93042cde17

Download Submit
C:\Windows\system\fikbpVP.exe

Filesize
2.4MB

MD5
108ad2de2605b5e3039204cc93e94683

SHA1
f867accdcb30e1e71eaf89d7e3e7a56401a0d8ad

SHA256
20aa0aee58bae59c36aff6e95a5fbfd811a2536072f91da5388e14100cd34671

SHA512
347b354f8e19d8fd9413b68ff82f1259023eb56ec4e2c3d9e640d7f6b9c9f6b97d8dc5c73430c1d85e4fe091f73f8ad701f3195a4de0aeb3f55cd8924a679d65

Download Submit
C:\Windows\system\fwUCpki.exe

Filesize
2.4MB

MD5
3a6f42a35fb893cf32075a7a8abced06

SHA1
03a30028d83c474c3eb01c67b72a9967d83b52a1

SHA256
28f3d22dd46a892d76789d4ee5f1b248f331325b45d522d92d16866fe53f0ea2

SHA512
234b34b5062923718002aedf770dd66c5ddd693b9282ed299206144ce0ef4d4cde5bdb6c7acdb7d91d68ec0fd0f11dc153bcabf209af90edd240e543c150ad4c

Download Submit
C:\Windows\system\ilfGxAz.exe

Filesize
2.4MB

MD5
cfb80cd42267bfb4799419adba6a96c6

SHA1
2bb67df464e71d1be28926de87c0ba9449589f40

SHA256
48ae565d59d1c4729ec311fdee0414f6e929890524afb151cd8962484c75dcdf

SHA512
d1eec24dea315aa516dcdaa12f579de37f3225c3f3ec47c90c2c442a5fc02e235360dd1c1e68ffe70fb945091af40c8dc97d4c312c18ba2d35e6a947be92ba74

Download Submit
C:\Windows\system\luqTBqQ.exe

Filesize
2.4MB

MD5
86bb9facc67130793dca598bfe08f3d8

SHA1
8e7414d3ebf4e9701d3f16ada5ee10b7dd199011

SHA256
1c8bacd14a462446617679b44f9d516121f42c38ef9fd347f15dec06177c35be

SHA512
54da680685c60d2f936fae3f2f8a0b335fdc4ebb1154c9409afdcfe2b8919c570df82fd0d5b4b82aeced1c23d4c675a87358b55bb3026474e0a48ac5f98c1b2a

Download Submit
C:\Windows\system\mOqJwUA.exe

Filesize
2.4MB

MD5
fd19b8de4ef0110aa78e4ffe5d46c0cb

SHA1
1c6acd6a658a828c58634757ae3272d65ccb76b9

SHA256
d582fa25ac6d5941da0eaf2fb21a02ab0522acbceed1a8aa9cee5d39dd8be6b5

SHA512
e85d01f66d05c66d3167208844bd6b40cb08145407db586da80123484655cc6b2a88f207d9de7a3f88f5a6ca12eecbf86bd097e7082846894a9d92118c84c0b6

Download Submit
C:\Windows\system\mposAOB.exe

Filesize
2.4MB

MD5
d9900860b021fab5e417cf90fd4491f1

SHA1
0f63791b55a2b4f86254ac27da6b2ca0f8b671f6

SHA256
f3897c3bcd720ea3942428dce371ac6a3d9c471232fc4818f7f2e25963fe9821

SHA512
855250614c964cb1fdd8c31a59da11be50a7d5630cbe7343b39bf6e972e84c7f4630d868590c8193d90bcf41f2560486bccc9abdd8864ea471bb6db90f38c57b

Download Submit
C:\Windows\system\naqgYcD.exe

Filesize
2.4MB

MD5
d047465213c33d18f46530f8f1e1c5f4

SHA1
003948a36f58b5ab23112763d0b63453832b2d13

SHA256
38f70338c291a75361aff7ee50bf9bffe3dc9e16c57e9534cf11530dfc3ceabb

SHA512
b88f2c9ce525eb9b89ae36d1a0caf5f530c16d52f41176af905ea64077cd141c66612bd7c3252daef8eb548eeb40096ddd92c74819be33d5fd7770407fcc9d78

Download Submit
C:\Windows\system\pgvfMsd.exe

Filesize
2.4MB

MD5
dbd414cff7164c4c40dda2ba8766d06b

SHA1
1ef9449bb143e9ef6eda9a91c2a75121a148b086

SHA256
ba7140f3f8a1c0662ae3863b8ee5e257b52072b3a1291353823a1858cf46ffec

SHA512
6cd58539ed0cc459f9d9ef029f08ce0d34b243b6d54653a20b35ecbdc6c94605c31e5a169b9df1d85d261f40839a0b590acecc86f70d934d6704b481fbcac94b

Download Submit
C:\Windows\system\qqnKsnZ.exe

Filesize
2.4MB

MD5
fa08d0ebebea92b243b37f2647c5312c

SHA1
e95ba726c86f17cb7ccb05fba144dbe3b35c0126

SHA256
6e885fa245d6f78f238f9c96601267bfd813ff2c6c89c22e89820e8f31d5480a

SHA512
31d0cf021bfb255258c801574e433dcbc7e6a4bee10ed1e65dff4695ed84488df25ff4d5935eec00a4d8c93157923b9705a253a82fbcfd0d858497ff4ac3d7df

Download Submit
C:\Windows\system\uhBmpKX.exe

Filesize
2.4MB

MD5
73d8ed0d7d3cb2628fb8492f6162ee4a

SHA1
23765fd81e1a1e1810e26fe1b76ba6fd13d8320e

SHA256
a2d46e3588ff2814b56da71e01c86c67376c0b8aed14441f5aca7dccd7653796

SHA512
0b2e418f776ba5cda1b69c9e0c81ef1effc3896c2987cb1f18a1c9a0cc3b95fabd20c8d0f501c976037efb15b49acbef68c5740445da93bf4ae075fc62dc6635

Download Submit
C:\Windows\system\xRGpNfC.exe

Filesize
2.4MB

MD5
aee51a2085cd4a6c45423d3e6060b974

SHA1
e0a46055ed0da769e7b51857221622942cfc9c29

SHA256
07ca8ea8e5cd01b21ca3c49d4abef346d2079c65e8941cd97cdd10e618ef8425

SHA512
4a8b90a456917c7ffa9e29c1a81acb137f68d70d235901cbb412519cea4737d041da9ec5dc5ed110dfdc9d98683bb8d83a78c333db8ef23b3d466f2c4bb464b8

Download Submit
C:\Windows\system\xqYqYeK.exe

Filesize
2.4MB

MD5
263f2c2bfcad85ec5fb10384ec9c6850

SHA1
c0a1e3f246d82a43e91d6cc7a54bc199caf3359d

SHA256
62323d5db21151ba459e02f9e28548d40d46b3963dd6588b23ed965df4747763

SHA512
e3752fafdd0fe9c4ab7e4956231184317c3ae4296e3ef5ebb8caba611a843350594d2e51ddd2e4bf56a8598fc1d61a63fb330e8a0ddbbce3477e2c9f22da94b9

Download Submit
\Windows\system\ELaqwId.exe

Filesize
2.4MB

MD5
30314bafd4948ac22e4b4a432bc0744e

SHA1
e786e60227ca5a8ab36fe9aedeb9fc9bd65b8e83

SHA256
8d3dadadc4f9477dc639487b4a138da15bb56d2d312fbdc26541f8b6f09b3559

SHA512
10bda8349f2fad90709e80211ab1f05ddf04e6bb9580691017f7a94d84abfb24023f80408c3d1a29d5a44a3bd93c7de44b5e21eab982db4ea5d42b60795b42a4

Download Submit
\Windows\system\SPUuzRA.exe

Filesize
2.4MB

MD5
a580ae35f7933ae5751e69f53f4f0867

SHA1
95cccf1bc618936db711d81d55a3439f0614c24d

SHA256
08e04bf9314bbc3cd1b972d6526e3d4d1b9b86d8f8039804cf899be485a08f40

SHA512
516b80639e12e8888fa0e2c02edda2b3011aa9668b86a980a86bb64eae1b02df66e9d44fa83ab091d431aa2d8e2d2889da97e91d1147ae1f384632956c617290

Download Submit
\Windows\system\dvtQNsI.exe

Filesize
2.4MB

MD5
6b9b613be08d5e53651961b423f9769b

SHA1
4747508b2959d6374a61bef7f652fa9159bb5f17

SHA256
71637b9fe05b5ae4d1e15ebbf067c0f64dddb0dbd0795a89e24c5ff680b57ae8

SHA512
87c2ccc01982fcb1ee37f75320a913f009621dc618ca9ccb3fb2c994e2baa307d992198fea81ab1278e6a3272751391fe4e2d2b2961cf84c895432d96509fbde

Download Submit
\Windows\system\qZTJUni.exe

Filesize
2.4MB

MD5
8a51f465d0349b6bd34fd2458b83c644

SHA1
ce4389525a34a8e945cd62778f87c8689e54fb4b

SHA256
a9b0471f8c5ae869891b515609e6b03c62625ba8278f1ddf3680779f593f84cc

SHA512
270eef213ffdeb8c8b4af8141648481322a2dc3575fa0566d45214775b16ca5144f235373fdc0262735fb997186f17f5e16fd748cfb16f918304a1e265f44c05

Download Submit
memory/1664-3568-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/1664-131-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/1724-113-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/1724-3491-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2012-129-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2012-3539-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2128-21-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-3450-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-128-0x00000000034D0000-0x00000000038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-3625-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2272-6016-0x0000000003170000-0x0000000003562000-memory.dmp

Filesize
3.9MB

Download
memory/2272-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2272-115-0x00000000034D0000-0x00000000038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-114-0x00000000034D0000-0x00000000038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-130-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2272-132-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2272-0-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2272-20-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-22-0x0000000003170000-0x0000000003562000-memory.dmp

Filesize
3.9MB

Download
memory/2272-71-0x00000000034D0000-0x00000000038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-11-0x0000000003170000-0x0000000003562000-memory.dmp

Filesize
3.9MB

Download
memory/2272-52-0x00000000034D0000-0x00000000038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-46-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-48-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2568-47-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-3526-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-49-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2636-3495-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2752-27-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2752-3538-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2784-29-0x000007FEF547E000-0x000007FEF547F000-memory.dmp

Filesize
4KB

Download
memory/2784-45-0x000007FEF51C0000-0x000007FEF5B5D000-memory.dmp

Filesize
9.6MB

Download
memory/2784-28-0x00000000028E0000-0x0000000002960000-memory.dmp

Filesize
512KB

Download
memory/2784-31-0x00000000028A0000-0x00000000028A8000-memory.dmp

Filesize
32KB

Download
memory/2784-30-0x000000001B500000-0x000000001B7E2000-memory.dmp

Filesize
2.9MB

Download
memory/2784-54-0x000007FEF51C0000-0x000007FEF5B5D000-memory.dmp

Filesize
9.6MB

Download
memory/2784-148-0x000007FEF51C0000-0x000007FEF5B5D000-memory.dmp

Filesize
9.6MB

Download
memory/2820-3439-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2820-17-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2936-3540-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2936-127-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/3040-53-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/3040-3524-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download