xmrig | 9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
Size

1.6MB
MD5

321e18ae560512f8f304348add8c193a
SHA1

03674c7ad846fa03805065cd9e98cb016c2b4665
SHA256

9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6
SHA512

5361e771bfe33bff220ebec52febdc03abf8c17566ab84a83cb255838b6572b622236c45426f9f9be5a3a94372faae84d25956fd13e297d2611ae6c54a1dafb2
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwLENM:Lz071uv4BPMkibTIA5CJzi

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/1472-9-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2768-68-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2628-72-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2084-73-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2600-71-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/1680-83-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2240-524-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2760-679-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2132-102-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2932-60-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2764-58-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2872-55-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2764-4834-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2932-4835-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2872-4838-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/1472-4836-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2084-4986-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2600-4991-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/2768-5153-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2628-5152-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2132-5162-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/1680-5161-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2792-5928-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2396	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1472	MgHSvdt.exe
2760	dURYYHe.exe
2872	NzWHAGE.exe
2764	feAHHXt.exe
2932	FXkqzAj.exe
2768	xyaweud.exe
2600	QfMqjBN.exe
2628	wOdlGMZ.exe
2084	tCJmDjE.exe
1680	kOxcwKQ.exe
2792	hoRoBIR.exe
2132	nDFjSnH.exe
2820	RHRpISE.exe
2968	ZPYqCSC.exe
2580	IRKGtDH.exe
1528	NhodmKs.exe
3020	vzgPtzP.exe
2780	lEknOZy.exe
1712	aKuBGxT.exe
2112	FXAPskz.exe
2180	nKjBxoa.exe
2224	DYidBko.exe
2200	GALoSIL.exe
3052	Klmxcsf.exe
2152	AOrVnOR.exe
2452	NiwKWIT.exe
2164	mldunYZ.exe
1740	yJCREHi.exe
2068	maqOYZm.exe
3036	dYRnsjh.exe
1904	ORBWwYy.exe
1540	kwIpxqx.exe
1708	sWVJJKh.exe
2336	YByXYuW.exe
1076	miKgNAi.exe
2072	xOMiljr.exe
2996	XJnRRii.exe
3064	FByDBbj.exe
1988	ioQaDSs.exe
676	LRIsgBW.exe
1804	CBaglkb.exe
1664	YTmxSIm.exe
1352	WxlIzUr.exe
1608	lcvxqpD.exe
2516	XjJTeMC.exe
624	gDlfSPs.exe
1984	ddUDPav.exe
1596	ygThTkI.exe
2524	VyigOif.exe
2836	FckDITK.exe
2716	NcczQSN.exe
2624	YUCxXnH.exe
2616	tsBHubA.exe
2676	sYBaCsW.exe
3000	kvCrPfQ.exe
2672	oQvHhyv.exe
2620	enVtJUO.exe
2192	lEYRrbe.exe
2420	SoRDbZf.exe
2964	lSgPjHn.exe
2320	LJVNvKQ.exe
2520	GqnyBXm.exe
528	sPWhVFZ.exe
1240	vHmMCAG.exe

Loads dropped DLL 64 IoCs

pid	Process
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2240-0-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/files/0x00070000000120fe-6.dat	upx
behavioral1/memory/1472-9-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/files/0x0007000000004e74-22.dat	upx
behavioral1/files/0x0006000000019217-32.dat	upx
behavioral1/files/0x0009000000018b5c-31.dat	upx
behavioral1/files/0x0006000000019221-36.dat	upx
behavioral1/files/0x0006000000019234-44.dat	upx
behavioral1/memory/2760-19-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/files/0x000700000001876c-17.dat	upx
behavioral1/files/0x0008000000019256-47.dat	upx
behavioral1/memory/2768-68-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2628-72-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2084-73-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2600-71-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/files/0x0005000000019c4a-65.dat	upx
behavioral1/files/0x0023000000018702-87.dat	upx
behavioral1/memory/1680-83-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/files/0x0005000000019d9d-96.dat	upx
behavioral1/files/0x0005000000019ce4-94.dat	upx
behavioral1/files/0x0005000000019f9a-115.dat	upx
behavioral1/files/0x000500000001a40f-140.dat	upx
behavioral1/files/0x000500000001a417-163.dat	upx
behavioral1/files/0x000500000001a48c-186.dat	upx
behavioral1/memory/2240-524-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2760-679-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/files/0x000500000001a49d-195.dat	upx
behavioral1/files/0x000500000001a48e-190.dat	upx
behavioral1/files/0x000500000001a481-180.dat	upx
behavioral1/files/0x000500000001a47f-176.dat	upx
behavioral1/files/0x000500000001a421-174.dat	upx
behavioral1/files/0x000500000001a2fb-143.dat	upx
behavioral1/files/0x000500000001a463-167.dat	upx
behavioral1/files/0x000500000001a41b-158.dat	upx
behavioral1/files/0x000500000001a410-150.dat	upx
behavioral1/files/0x000500000001a072-125.dat	upx
behavioral1/files/0x000500000001a34d-138.dat	upx
behavioral1/files/0x000500000001a092-130.dat	upx
behavioral1/files/0x000500000001a069-120.dat	upx
behavioral1/files/0x0005000000019f7e-110.dat	upx
behavioral1/files/0x0005000000019db1-106.dat	upx
behavioral1/memory/2132-102-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x0005000000019cba-82.dat	upx
behavioral1/memory/2792-89-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2932-60-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/2764-58-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2872-55-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2764-4834-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2932-4835-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/2872-4838-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/1472-4836-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2084-4986-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2600-4991-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/2768-5153-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2628-5152-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2132-5162-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/1680-5161-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2792-5928-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qCzTdve.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\qxEdxzR.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\aWImoCb.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\PbKsivN.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\vTiKgHn.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\GHJyKFw.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\Qmnpurd.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\ozOQkwR.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\fSWLkcH.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\wJNkNKE.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\JDpseEO.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\xBbMDEK.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\lrnTKyD.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\toGhLpR.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\OHIdRoh.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\KGVZCzN.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\UlOAfVp.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\YnXDEud.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\iTWdjkM.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\AadtHce.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\oixcSYQ.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\sTcYVMo.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\HXDmSKD.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\OHzpgAp.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\pWwvpHa.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\ihvMRzn.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\ijuvpjq.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\SLSGtqg.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\WbOYaUx.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\ahVULXE.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\QNcRHaz.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\ZWMXgLV.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\WLUOOlb.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\kXWHQgi.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\UMIYQlu.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\obeMDJt.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\WlixWXH.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\NzxjKjX.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\qBlPtLQ.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\jGMSRMn.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\JMXIGeI.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\BMlBQUx.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\NzWUmfh.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\YkbSSWs.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\MnETsvH.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\cbknhvl.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\ymAorPW.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\pXErKDQ.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\nhdNnfc.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\NQkUBDU.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\NxcaNMi.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\xjpQvAM.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\XOoHnYF.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\fJHEToU.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\KtJaJfF.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\iPdVjyu.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\FicgwCa.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\NfTYlIT.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\SnVZlUa.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\aAJpiBz.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\WsOdiPj.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\pGfPnqv.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\EGeFCLe.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
File created	C:\Windows\System\fFbTbQC.exe	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2396	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
Token: SeLockMemoryPrivilege	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
Token: SeDebugPrivilege	2396	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2396	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	31
PID 2240 wrote to memory of 2396	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	31
PID 2240 wrote to memory of 2396	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	31
PID 2240 wrote to memory of 1472	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	32
PID 2240 wrote to memory of 1472	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	32
PID 2240 wrote to memory of 1472	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	32
PID 2240 wrote to memory of 2760	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	33
PID 2240 wrote to memory of 2760	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	33
PID 2240 wrote to memory of 2760	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	33
PID 2240 wrote to memory of 2872	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	34
PID 2240 wrote to memory of 2872	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	34
PID 2240 wrote to memory of 2872	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	34
PID 2240 wrote to memory of 2764	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	35
PID 2240 wrote to memory of 2764	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	35
PID 2240 wrote to memory of 2764	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	35
PID 2240 wrote to memory of 2932	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	36
PID 2240 wrote to memory of 2932	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	36
PID 2240 wrote to memory of 2932	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	36
PID 2240 wrote to memory of 2768	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	37
PID 2240 wrote to memory of 2768	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	37
PID 2240 wrote to memory of 2768	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	37
PID 2240 wrote to memory of 2600	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	38
PID 2240 wrote to memory of 2600	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	38
PID 2240 wrote to memory of 2600	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	38
PID 2240 wrote to memory of 2628	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	39
PID 2240 wrote to memory of 2628	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	39
PID 2240 wrote to memory of 2628	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	39
PID 2240 wrote to memory of 2084	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	40
PID 2240 wrote to memory of 2084	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	40
PID 2240 wrote to memory of 2084	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	40
PID 2240 wrote to memory of 1680	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	41
PID 2240 wrote to memory of 1680	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	41
PID 2240 wrote to memory of 1680	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	41
PID 2240 wrote to memory of 2792	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	42
PID 2240 wrote to memory of 2792	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	42
PID 2240 wrote to memory of 2792	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	42
PID 2240 wrote to memory of 2132	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	43
PID 2240 wrote to memory of 2132	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	43
PID 2240 wrote to memory of 2132	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	43
PID 2240 wrote to memory of 2820	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	44
PID 2240 wrote to memory of 2820	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	44
PID 2240 wrote to memory of 2820	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	44
PID 2240 wrote to memory of 2968	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	45
PID 2240 wrote to memory of 2968	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	45
PID 2240 wrote to memory of 2968	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	45
PID 2240 wrote to memory of 2580	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	46
PID 2240 wrote to memory of 2580	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	46
PID 2240 wrote to memory of 2580	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	46
PID 2240 wrote to memory of 1528	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	47
PID 2240 wrote to memory of 1528	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	47
PID 2240 wrote to memory of 1528	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	47
PID 2240 wrote to memory of 3020	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	48
PID 2240 wrote to memory of 3020	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	48
PID 2240 wrote to memory of 3020	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	48
PID 2240 wrote to memory of 2780	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	49
PID 2240 wrote to memory of 2780	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	49
PID 2240 wrote to memory of 2780	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	49
PID 2240 wrote to memory of 1712	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	50
PID 2240 wrote to memory of 1712	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	50
PID 2240 wrote to memory of 1712	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	50
PID 2240 wrote to memory of 2180	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	51
PID 2240 wrote to memory of 2180	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	51
PID 2240 wrote to memory of 2180	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	51
PID 2240 wrote to memory of 2112	2240	9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe	52

C:\Users\Admin\AppData\Local\Temp\9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe
"C:\Users\Admin\AppData\Local\Temp\9d4de6ec5d8b4bfc468c72daf591ff0f4b3f893f8360f71efa886055120519c6.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\System\MgHSvdt.exe
  C:\Windows\System\MgHSvdt.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\dURYYHe.exe
  C:\Windows\System\dURYYHe.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\NzWHAGE.exe
  C:\Windows\System\NzWHAGE.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\feAHHXt.exe
  C:\Windows\System\feAHHXt.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\FXkqzAj.exe
  C:\Windows\System\FXkqzAj.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\xyaweud.exe
  C:\Windows\System\xyaweud.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\QfMqjBN.exe
  C:\Windows\System\QfMqjBN.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\wOdlGMZ.exe
  C:\Windows\System\wOdlGMZ.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\tCJmDjE.exe
  C:\Windows\System\tCJmDjE.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\kOxcwKQ.exe
  C:\Windows\System\kOxcwKQ.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\hoRoBIR.exe
  C:\Windows\System\hoRoBIR.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\nDFjSnH.exe
  C:\Windows\System\nDFjSnH.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\RHRpISE.exe
  C:\Windows\System\RHRpISE.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\ZPYqCSC.exe
  C:\Windows\System\ZPYqCSC.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\IRKGtDH.exe
  C:\Windows\System\IRKGtDH.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\NhodmKs.exe
  C:\Windows\System\NhodmKs.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\vzgPtzP.exe
  C:\Windows\System\vzgPtzP.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\lEknOZy.exe
  C:\Windows\System\lEknOZy.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\aKuBGxT.exe
  C:\Windows\System\aKuBGxT.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\nKjBxoa.exe
  C:\Windows\System\nKjBxoa.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\FXAPskz.exe
  C:\Windows\System\FXAPskz.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\DYidBko.exe
  C:\Windows\System\DYidBko.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\GALoSIL.exe
  C:\Windows\System\GALoSIL.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\AOrVnOR.exe
  C:\Windows\System\AOrVnOR.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\Klmxcsf.exe
  C:\Windows\System\Klmxcsf.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\mldunYZ.exe
  C:\Windows\System\mldunYZ.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\NiwKWIT.exe
  C:\Windows\System\NiwKWIT.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\yJCREHi.exe
  C:\Windows\System\yJCREHi.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\maqOYZm.exe
  C:\Windows\System\maqOYZm.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\dYRnsjh.exe
  C:\Windows\System\dYRnsjh.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\ORBWwYy.exe
  C:\Windows\System\ORBWwYy.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\kwIpxqx.exe
  C:\Windows\System\kwIpxqx.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\sWVJJKh.exe
  C:\Windows\System\sWVJJKh.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\miKgNAi.exe
  C:\Windows\System\miKgNAi.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\YByXYuW.exe
  C:\Windows\System\YByXYuW.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\XJnRRii.exe
  C:\Windows\System\XJnRRii.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\xOMiljr.exe
  C:\Windows\System\xOMiljr.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\FByDBbj.exe
  C:\Windows\System\FByDBbj.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\ioQaDSs.exe
  C:\Windows\System\ioQaDSs.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\LRIsgBW.exe
  C:\Windows\System\LRIsgBW.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\CBaglkb.exe
  C:\Windows\System\CBaglkb.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\YTmxSIm.exe
  C:\Windows\System\YTmxSIm.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\WxlIzUr.exe
  C:\Windows\System\WxlIzUr.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\lcvxqpD.exe
  C:\Windows\System\lcvxqpD.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\XjJTeMC.exe
  C:\Windows\System\XjJTeMC.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\gDlfSPs.exe
  C:\Windows\System\gDlfSPs.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\ddUDPav.exe
  C:\Windows\System\ddUDPav.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\ygThTkI.exe
  C:\Windows\System\ygThTkI.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\VyigOif.exe
  C:\Windows\System\VyigOif.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\FckDITK.exe
  C:\Windows\System\FckDITK.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\NcczQSN.exe
  C:\Windows\System\NcczQSN.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\YUCxXnH.exe
  C:\Windows\System\YUCxXnH.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\tsBHubA.exe
  C:\Windows\System\tsBHubA.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\sYBaCsW.exe
  C:\Windows\System\sYBaCsW.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\kvCrPfQ.exe
  C:\Windows\System\kvCrPfQ.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\enVtJUO.exe
  C:\Windows\System\enVtJUO.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\oQvHhyv.exe
  C:\Windows\System\oQvHhyv.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\SoRDbZf.exe
  C:\Windows\System\SoRDbZf.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\lEYRrbe.exe
  C:\Windows\System\lEYRrbe.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\lSgPjHn.exe
  C:\Windows\System\lSgPjHn.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\LJVNvKQ.exe
  C:\Windows\System\LJVNvKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\GqnyBXm.exe
  C:\Windows\System\GqnyBXm.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\sPWhVFZ.exe
  C:\Windows\System\sPWhVFZ.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\KxoKFQB.exe
  C:\Windows\System\KxoKFQB.exe
  2⤵
  PID:2360
- C:\Windows\System\vHmMCAG.exe
  C:\Windows\System\vHmMCAG.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\mJPyVCE.exe
  C:\Windows\System\mJPyVCE.exe
  2⤵
  PID:444
- C:\Windows\System\yCLTYAw.exe
  C:\Windows\System\yCLTYAw.exe
  2⤵
  PID:2828
- C:\Windows\System\xNmUicc.exe
  C:\Windows\System\xNmUicc.exe
  2⤵
  PID:944
- C:\Windows\System\vDzMaSf.exe
  C:\Windows\System\vDzMaSf.exe
  2⤵
  PID:1840
- C:\Windows\System\gEOqyux.exe
  C:\Windows\System\gEOqyux.exe
  2⤵
  PID:2020
- C:\Windows\System\akoiWTy.exe
  C:\Windows\System\akoiWTy.exe
  2⤵
  PID:1588
- C:\Windows\System\ystJviG.exe
  C:\Windows\System\ystJviG.exe
  2⤵
  PID:1056
- C:\Windows\System\vxbLnMA.exe
  C:\Windows\System\vxbLnMA.exe
  2⤵
  PID:1564
- C:\Windows\System\JcjfswC.exe
  C:\Windows\System\JcjfswC.exe
  2⤵
  PID:1276
- C:\Windows\System\VwQlBEi.exe
  C:\Windows\System\VwQlBEi.exe
  2⤵
  PID:2508
- C:\Windows\System\gXMuUcG.exe
  C:\Windows\System\gXMuUcG.exe
  2⤵
  PID:2556
- C:\Windows\System\IjBkfqd.exe
  C:\Windows\System\IjBkfqd.exe
  2⤵
  PID:3068
- C:\Windows\System\aIqNeDR.exe
  C:\Windows\System\aIqNeDR.exe
  2⤵
  PID:2752
- C:\Windows\System\XMUuixN.exe
  C:\Windows\System\XMUuixN.exe
  2⤵
  PID:860
- C:\Windows\System\DCTdZhl.exe
  C:\Windows\System\DCTdZhl.exe
  2⤵
  PID:1484
- C:\Windows\System\SCRLMWB.exe
  C:\Windows\System\SCRLMWB.exe
  2⤵
  PID:1428
- C:\Windows\System\KlvYIvm.exe
  C:\Windows\System\KlvYIvm.exe
  2⤵
  PID:2272
- C:\Windows\System\OGjSsre.exe
  C:\Windows\System\OGjSsre.exe
  2⤵
  PID:1604
- C:\Windows\System\mQwxLvE.exe
  C:\Windows\System\mQwxLvE.exe
  2⤵
  PID:2940
- C:\Windows\System\KxkgEbk.exe
  C:\Windows\System\KxkgEbk.exe
  2⤵
  PID:2724
- C:\Windows\System\ujOddES.exe
  C:\Windows\System\ujOddES.exe
  2⤵
  PID:408
- C:\Windows\System\BDViheq.exe
  C:\Windows\System\BDViheq.exe
  2⤵
  PID:2688
- C:\Windows\System\XzkBPbg.exe
  C:\Windows\System\XzkBPbg.exe
  2⤵
  PID:2916
- C:\Windows\System\gGewxVa.exe
  C:\Windows\System\gGewxVa.exe
  2⤵
  PID:2300
- C:\Windows\System\wgBONet.exe
  C:\Windows\System\wgBONet.exe
  2⤵
  PID:2092
- C:\Windows\System\Oedgssn.exe
  C:\Windows\System\Oedgssn.exe
  2⤵
  PID:2364
- C:\Windows\System\sjvaPik.exe
  C:\Windows\System\sjvaPik.exe
  2⤵
  PID:2196
- C:\Windows\System\NNHNICd.exe
  C:\Windows\System\NNHNICd.exe
  2⤵
  PID:2280
- C:\Windows\System\OoloNkC.exe
  C:\Windows\System\OoloNkC.exe
  2⤵
  PID:2804
- C:\Windows\System\EBvEKtq.exe
  C:\Windows\System\EBvEKtq.exe
  2⤵
  PID:2388
- C:\Windows\System\GAXIQaW.exe
  C:\Windows\System\GAXIQaW.exe
  2⤵
  PID:2032
- C:\Windows\System\JskYKGH.exe
  C:\Windows\System\JskYKGH.exe
  2⤵
  PID:1460
- C:\Windows\System\FQpLKqO.exe
  C:\Windows\System\FQpLKqO.exe
  2⤵
  PID:1536
- C:\Windows\System\IBZNvDz.exe
  C:\Windows\System\IBZNvDz.exe
  2⤵
  PID:1096
- C:\Windows\System\tlpPzci.exe
  C:\Windows\System\tlpPzci.exe
  2⤵
  PID:1996
- C:\Windows\System\vdOwihX.exe
  C:\Windows\System\vdOwihX.exe
  2⤵
  PID:1288
- C:\Windows\System\SHZljwQ.exe
  C:\Windows\System\SHZljwQ.exe
  2⤵
  PID:1172
- C:\Windows\System\MHiJKyY.exe
  C:\Windows\System\MHiJKyY.exe
  2⤵
  PID:1992
- C:\Windows\System\jsBWniB.exe
  C:\Windows\System\jsBWniB.exe
  2⤵
  PID:2784
- C:\Windows\System\HiSEZTq.exe
  C:\Windows\System\HiSEZTq.exe
  2⤵
  PID:2352
- C:\Windows\System\ylCwAeY.exe
  C:\Windows\System\ylCwAeY.exe
  2⤵
  PID:3024
- C:\Windows\System\awugpFs.exe
  C:\Windows\System\awugpFs.exe
  2⤵
  PID:2832
- C:\Windows\System\dNAOwal.exe
  C:\Windows\System\dNAOwal.exe
  2⤵
  PID:2796
- C:\Windows\System\QcVvwZg.exe
  C:\Windows\System\QcVvwZg.exe
  2⤵
  PID:2100
- C:\Windows\System\IncleGa.exe
  C:\Windows\System\IncleGa.exe
  2⤵
  PID:1496
- C:\Windows\System\uwpYjMu.exe
  C:\Windows\System\uwpYjMu.exe
  2⤵
  PID:2884
- C:\Windows\System\pEsgPLk.exe
  C:\Windows\System\pEsgPLk.exe
  2⤵
  PID:2104
- C:\Windows\System\FFCwvue.exe
  C:\Windows\System\FFCwvue.exe
  2⤵
  PID:316
- C:\Windows\System\EWMGdLg.exe
  C:\Windows\System\EWMGdLg.exe
  2⤵
  PID:1064
- C:\Windows\System\HtOaiHu.exe
  C:\Windows\System\HtOaiHu.exe
  2⤵
  PID:2392
- C:\Windows\System\gHLOzri.exe
  C:\Windows\System\gHLOzri.exe
  2⤵
  PID:824
- C:\Windows\System\ftwcqax.exe
  C:\Windows\System\ftwcqax.exe
  2⤵
  PID:1036
- C:\Windows\System\EfZOUhY.exe
  C:\Windows\System\EfZOUhY.exe
  2⤵
  PID:1976
- C:\Windows\System\ikqzXVO.exe
  C:\Windows\System\ikqzXVO.exe
  2⤵
  PID:2348
- C:\Windows\System\GOPXRLv.exe
  C:\Windows\System\GOPXRLv.exe
  2⤵
  PID:1980
- C:\Windows\System\uiNRviU.exe
  C:\Windows\System\uiNRviU.exe
  2⤵
  PID:2924
- C:\Windows\System\RGsqWbg.exe
  C:\Windows\System\RGsqWbg.exe
  2⤵
  PID:3080
- C:\Windows\System\zMMSlvy.exe
  C:\Windows\System\zMMSlvy.exe
  2⤵
  PID:3104
- C:\Windows\System\KhfmPEv.exe
  C:\Windows\System\KhfmPEv.exe
  2⤵
  PID:3120
- C:\Windows\System\BCTpuRE.exe
  C:\Windows\System\BCTpuRE.exe
  2⤵
  PID:3140
- C:\Windows\System\jgVyuvO.exe
  C:\Windows\System\jgVyuvO.exe
  2⤵
  PID:3156
- C:\Windows\System\MvsDhHm.exe
  C:\Windows\System\MvsDhHm.exe
  2⤵
  PID:3180
- C:\Windows\System\sgicFYq.exe
  C:\Windows\System\sgicFYq.exe
  2⤵
  PID:3196
- C:\Windows\System\RVZYiiJ.exe
  C:\Windows\System\RVZYiiJ.exe
  2⤵
  PID:3212
- C:\Windows\System\ElrmpeK.exe
  C:\Windows\System\ElrmpeK.exe
  2⤵
  PID:3232
- C:\Windows\System\ljTCuLz.exe
  C:\Windows\System\ljTCuLz.exe
  2⤵
  PID:3256
- C:\Windows\System\olQCeDg.exe
  C:\Windows\System\olQCeDg.exe
  2⤵
  PID:3272
- C:\Windows\System\tJQyMAD.exe
  C:\Windows\System\tJQyMAD.exe
  2⤵
  PID:3292
- C:\Windows\System\WywReRj.exe
  C:\Windows\System\WywReRj.exe
  2⤵
  PID:3308
- C:\Windows\System\DdnDgDB.exe
  C:\Windows\System\DdnDgDB.exe
  2⤵
  PID:3324
- C:\Windows\System\BAydGJT.exe
  C:\Windows\System\BAydGJT.exe
  2⤵
  PID:3340
- C:\Windows\System\HQpFQLC.exe
  C:\Windows\System\HQpFQLC.exe
  2⤵
  PID:3360
- C:\Windows\System\PJOVHPo.exe
  C:\Windows\System\PJOVHPo.exe
  2⤵
  PID:3380
- C:\Windows\System\qSAhvNe.exe
  C:\Windows\System\qSAhvNe.exe
  2⤵
  PID:3400
- C:\Windows\System\kKzOzNk.exe
  C:\Windows\System\kKzOzNk.exe
  2⤵
  PID:3416
- C:\Windows\System\PciVdJJ.exe
  C:\Windows\System\PciVdJJ.exe
  2⤵
  PID:3432
- C:\Windows\System\ZirKmmh.exe
  C:\Windows\System\ZirKmmh.exe
  2⤵
  PID:3460
- C:\Windows\System\VXIwooN.exe
  C:\Windows\System\VXIwooN.exe
  2⤵
  PID:3492
- C:\Windows\System\mZzfWch.exe
  C:\Windows\System\mZzfWch.exe
  2⤵
  PID:3524
- C:\Windows\System\salAoyl.exe
  C:\Windows\System\salAoyl.exe
  2⤵
  PID:3560
- C:\Windows\System\fQIwEFt.exe
  C:\Windows\System\fQIwEFt.exe
  2⤵
  PID:3580
- C:\Windows\System\KdSrJih.exe
  C:\Windows\System\KdSrJih.exe
  2⤵
  PID:3600
- C:\Windows\System\LPVmlXM.exe
  C:\Windows\System\LPVmlXM.exe
  2⤵
  PID:3620
- C:\Windows\System\XhNoVXY.exe
  C:\Windows\System\XhNoVXY.exe
  2⤵
  PID:3640
- C:\Windows\System\feFNhCN.exe
  C:\Windows\System\feFNhCN.exe
  2⤵
  PID:3664
- C:\Windows\System\PyjydDP.exe
  C:\Windows\System\PyjydDP.exe
  2⤵
  PID:3684
- C:\Windows\System\BHTMzYT.exe
  C:\Windows\System\BHTMzYT.exe
  2⤵
  PID:3704
- C:\Windows\System\qWmxfFG.exe
  C:\Windows\System\qWmxfFG.exe
  2⤵
  PID:3724
- C:\Windows\System\EGeFCLe.exe
  C:\Windows\System\EGeFCLe.exe
  2⤵
  PID:3744
- C:\Windows\System\odwIwgS.exe
  C:\Windows\System\odwIwgS.exe
  2⤵
  PID:3764
- C:\Windows\System\oRUwOeA.exe
  C:\Windows\System\oRUwOeA.exe
  2⤵
  PID:3784
- C:\Windows\System\lvpOCAy.exe
  C:\Windows\System\lvpOCAy.exe
  2⤵
  PID:3804
- C:\Windows\System\qzzPKIF.exe
  C:\Windows\System\qzzPKIF.exe
  2⤵
  PID:3824
- C:\Windows\System\yBlvYgz.exe
  C:\Windows\System\yBlvYgz.exe
  2⤵
  PID:3844
- C:\Windows\System\kFkNlmP.exe
  C:\Windows\System\kFkNlmP.exe
  2⤵
  PID:3864
- C:\Windows\System\QzWIwMS.exe
  C:\Windows\System\QzWIwMS.exe
  2⤵
  PID:3884
- C:\Windows\System\hgShZsq.exe
  C:\Windows\System\hgShZsq.exe
  2⤵
  PID:3908
- C:\Windows\System\lXldwfo.exe
  C:\Windows\System\lXldwfo.exe
  2⤵
  PID:3928
- C:\Windows\System\GRHBlQP.exe
  C:\Windows\System\GRHBlQP.exe
  2⤵
  PID:3948
- C:\Windows\System\tmGNVLP.exe
  C:\Windows\System\tmGNVLP.exe
  2⤵
  PID:3968
- C:\Windows\System\BFwdtUT.exe
  C:\Windows\System\BFwdtUT.exe
  2⤵
  PID:3988
- C:\Windows\System\BikltlV.exe
  C:\Windows\System\BikltlV.exe
  2⤵
  PID:4004
- C:\Windows\System\AtbshDo.exe
  C:\Windows\System\AtbshDo.exe
  2⤵
  PID:4020
- C:\Windows\System\nvOgSxP.exe
  C:\Windows\System\nvOgSxP.exe
  2⤵
  PID:4036
- C:\Windows\System\tZUOkxZ.exe
  C:\Windows\System\tZUOkxZ.exe
  2⤵
  PID:4056
- C:\Windows\System\wJNkNKE.exe
  C:\Windows\System\wJNkNKE.exe
  2⤵
  PID:4080
- C:\Windows\System\JrMEfdG.exe
  C:\Windows\System\JrMEfdG.exe
  2⤵
  PID:1224
- C:\Windows\System\qfrCBve.exe
  C:\Windows\System\qfrCBve.exe
  2⤵
  PID:2704
- C:\Windows\System\GyrozFy.exe
  C:\Windows\System\GyrozFy.exe
  2⤵
  PID:2812
- C:\Windows\System\NrSaDdb.exe
  C:\Windows\System\NrSaDdb.exe
  2⤵
  PID:3116
- C:\Windows\System\sinWqjQ.exe
  C:\Windows\System\sinWqjQ.exe
  2⤵
  PID:3220
- C:\Windows\System\oddaasf.exe
  C:\Windows\System\oddaasf.exe
  2⤵
  PID:3300
- C:\Windows\System\MCyMZvW.exe
  C:\Windows\System\MCyMZvW.exe
  2⤵
  PID:3368
- C:\Windows\System\WZFkqTr.exe
  C:\Windows\System\WZFkqTr.exe
  2⤵
  PID:3412
- C:\Windows\System\zOMsUgz.exe
  C:\Windows\System\zOMsUgz.exe
  2⤵
  PID:2356
- C:\Windows\System\IpsURpe.exe
  C:\Windows\System\IpsURpe.exe
  2⤵
  PID:3456
- C:\Windows\System\zfEXbcF.exe
  C:\Windows\System\zfEXbcF.exe
  2⤵
  PID:2044
- C:\Windows\System\XtleAIW.exe
  C:\Windows\System\XtleAIW.exe
  2⤵
  PID:3444
- C:\Windows\System\bDDQQeg.exe
  C:\Windows\System\bDDQQeg.exe
  2⤵
  PID:2288
- C:\Windows\System\DBjwBJU.exe
  C:\Windows\System\DBjwBJU.exe
  2⤵
  PID:3516
- C:\Windows\System\NbIRQoc.exe
  C:\Windows\System\NbIRQoc.exe
  2⤵
  PID:988
- C:\Windows\System\pGlXbvR.exe
  C:\Windows\System\pGlXbvR.exe
  2⤵
  PID:3092
- C:\Windows\System\GJdXuIa.exe
  C:\Windows\System\GJdXuIa.exe
  2⤵
  PID:3128
- C:\Windows\System\vkGwcpY.exe
  C:\Windows\System\vkGwcpY.exe
  2⤵
  PID:3244
- C:\Windows\System\GNVXMqT.exe
  C:\Windows\System\GNVXMqT.exe
  2⤵
  PID:3284
- C:\Windows\System\SHGjxDx.exe
  C:\Windows\System\SHGjxDx.exe
  2⤵
  PID:3356
- C:\Windows\System\uUVVcUv.exe
  C:\Windows\System\uUVVcUv.exe
  2⤵
  PID:3476
- C:\Windows\System\mcAhyNV.exe
  C:\Windows\System\mcAhyNV.exe
  2⤵
  PID:3352
- C:\Windows\System\aWImoCb.exe
  C:\Windows\System\aWImoCb.exe
  2⤵
  PID:3548
- C:\Windows\System\wqEryJW.exe
  C:\Windows\System\wqEryJW.exe
  2⤵
  PID:3388
- C:\Windows\System\XhVhLkm.exe
  C:\Windows\System\XhVhLkm.exe
  2⤵
  PID:3588
- C:\Windows\System\MVbKZPG.exe
  C:\Windows\System\MVbKZPG.exe
  2⤵
  PID:3592
- C:\Windows\System\iFXpbGT.exe
  C:\Windows\System\iFXpbGT.exe
  2⤵
  PID:3632
- C:\Windows\System\fKXOwRd.exe
  C:\Windows\System\fKXOwRd.exe
  2⤵
  PID:3672
- C:\Windows\System\wmJzfQH.exe
  C:\Windows\System\wmJzfQH.exe
  2⤵
  PID:3700
- C:\Windows\System\XLXcxse.exe
  C:\Windows\System\XLXcxse.exe
  2⤵
  PID:1156
- C:\Windows\System\OsHSFiJ.exe
  C:\Windows\System\OsHSFiJ.exe
  2⤵
  PID:3736
- C:\Windows\System\biFsNGC.exe
  C:\Windows\System\biFsNGC.exe
  2⤵
  PID:3760
- C:\Windows\System\vqROKrf.exe
  C:\Windows\System\vqROKrf.exe
  2⤵
  PID:3820
- C:\Windows\System\IAkOptg.exe
  C:\Windows\System\IAkOptg.exe
  2⤵
  PID:3852
- C:\Windows\System\bLwDrrP.exe
  C:\Windows\System\bLwDrrP.exe
  2⤵
  PID:3856
- C:\Windows\System\iqpXmuL.exe
  C:\Windows\System\iqpXmuL.exe
  2⤵
  PID:3892
- C:\Windows\System\JKhdSPx.exe
  C:\Windows\System\JKhdSPx.exe
  2⤵
  PID:3880
- C:\Windows\System\kRwWstX.exe
  C:\Windows\System\kRwWstX.exe
  2⤵
  PID:956
- C:\Windows\System\VlnUrfZ.exe
  C:\Windows\System\VlnUrfZ.exe
  2⤵
  PID:748
- C:\Windows\System\nCmmEAk.exe
  C:\Windows\System\nCmmEAk.exe
  2⤵
  PID:3976
- C:\Windows\System\MKdAkKJ.exe
  C:\Windows\System\MKdAkKJ.exe
  2⤵
  PID:992
- C:\Windows\System\lAMMaSZ.exe
  C:\Windows\System\lAMMaSZ.exe
  2⤵
  PID:4044
- C:\Windows\System\LtRaWOT.exe
  C:\Windows\System\LtRaWOT.exe
  2⤵
  PID:844
- C:\Windows\System\MVcSedK.exe
  C:\Windows\System\MVcSedK.exe
  2⤵
  PID:4088
- C:\Windows\System\wFrjpNl.exe
  C:\Windows\System\wFrjpNl.exe
  2⤵
  PID:3996
- C:\Windows\System\SLSGtqg.exe
  C:\Windows\System\SLSGtqg.exe
  2⤵
  PID:1060
- C:\Windows\System\gJiLphS.exe
  C:\Windows\System\gJiLphS.exe
  2⤵
  PID:920
- C:\Windows\System\XaMkvgp.exe
  C:\Windows\System\XaMkvgp.exe
  2⤵
  PID:4064
- C:\Windows\System\QKUDjhF.exe
  C:\Windows\System\QKUDjhF.exe
  2⤵
  PID:3336
- C:\Windows\System\xeJfvJI.exe
  C:\Windows\System\xeJfvJI.exe
  2⤵
  PID:2888
- C:\Windows\System\VjODsWJ.exe
  C:\Windows\System\VjODsWJ.exe
  2⤵
  PID:3112
- C:\Windows\System\SpbbiZK.exe
  C:\Windows\System\SpbbiZK.exe
  2⤵
  PID:3504
- C:\Windows\System\GleCdSw.exe
  C:\Windows\System\GleCdSw.exe
  2⤵
  PID:3268
- C:\Windows\System\GRdFXBL.exe
  C:\Windows\System\GRdFXBL.exe
  2⤵
  PID:2168
- C:\Windows\System\dnISmGB.exe
  C:\Windows\System\dnISmGB.exe
  2⤵
  PID:3088
- C:\Windows\System\WTfRYMM.exe
  C:\Windows\System\WTfRYMM.exe
  2⤵
  PID:1480
- C:\Windows\System\etMYkKK.exe
  C:\Windows\System\etMYkKK.exe
  2⤵
  PID:3176
- C:\Windows\System\tdnFPyi.exe
  C:\Windows\System\tdnFPyi.exe
  2⤵
  PID:2856
- C:\Windows\System\LAmChac.exe
  C:\Windows\System\LAmChac.exe
  2⤵
  PID:2080
- C:\Windows\System\ItBCRus.exe
  C:\Windows\System\ItBCRus.exe
  2⤵
  PID:3280
- C:\Windows\System\BYjkuwu.exe
  C:\Windows\System\BYjkuwu.exe
  2⤵
  PID:2568
- C:\Windows\System\uMtaMdy.exe
  C:\Windows\System\uMtaMdy.exe
  2⤵
  PID:3316
- C:\Windows\System\IHnbngC.exe
  C:\Windows\System\IHnbngC.exe
  2⤵
  PID:1548
- C:\Windows\System\NsOeTHI.exe
  C:\Windows\System\NsOeTHI.exe
  2⤵
  PID:2436
- C:\Windows\System\nNIETyn.exe
  C:\Windows\System\nNIETyn.exe
  2⤵
  PID:3540
- C:\Windows\System\AAONNIn.exe
  C:\Windows\System\AAONNIn.exe
  2⤵
  PID:3392
- C:\Windows\System\YeBQYNL.exe
  C:\Windows\System\YeBQYNL.exe
  2⤵
  PID:3556
- C:\Windows\System\fXmBHfi.exe
  C:\Windows\System\fXmBHfi.exe
  2⤵
  PID:3616
- C:\Windows\System\jecsbKT.exe
  C:\Windows\System\jecsbKT.exe
  2⤵
  PID:3636
- C:\Windows\System\hgREcQF.exe
  C:\Windows\System\hgREcQF.exe
  2⤵
  PID:2120
- C:\Windows\System\QcutvDH.exe
  C:\Windows\System\QcutvDH.exe
  2⤵
  PID:2052
- C:\Windows\System\uvyJUwc.exe
  C:\Windows\System\uvyJUwc.exe
  2⤵
  PID:2292
- C:\Windows\System\FZIWZEt.exe
  C:\Windows\System\FZIWZEt.exe
  2⤵
  PID:3772
- C:\Windows\System\LmSrDlO.exe
  C:\Windows\System\LmSrDlO.exe
  2⤵
  PID:3780
- C:\Windows\System\QWzZHhv.exe
  C:\Windows\System\QWzZHhv.exe
  2⤵
  PID:1420
- C:\Windows\System\viEhkqz.exe
  C:\Windows\System\viEhkqz.exe
  2⤵
  PID:2128
- C:\Windows\System\hlwcCJM.exe
  C:\Windows\System\hlwcCJM.exe
  2⤵
  PID:2380
- C:\Windows\System\mAcIDZo.exe
  C:\Windows\System\mAcIDZo.exe
  2⤵
  PID:792
- C:\Windows\System\xJiKtaU.exe
  C:\Windows\System\xJiKtaU.exe
  2⤵
  PID:1292
- C:\Windows\System\EloWXbj.exe
  C:\Windows\System\EloWXbj.exe
  2⤵
  PID:4012
- C:\Windows\System\RdfwLai.exe
  C:\Windows\System\RdfwLai.exe
  2⤵
  PID:3960
- C:\Windows\System\NFfCcdf.exe
  C:\Windows\System\NFfCcdf.exe
  2⤵
  PID:4092
- C:\Windows\System\cHaOyPH.exe
  C:\Windows\System\cHaOyPH.exe
  2⤵
  PID:4032
- C:\Windows\System\IoXLqBt.exe
  C:\Windows\System\IoXLqBt.exe
  2⤵
  PID:4028
- C:\Windows\System\pLupJAo.exe
  C:\Windows\System\pLupJAo.exe
  2⤵
  PID:3332
- C:\Windows\System\RjOmTbm.exe
  C:\Windows\System\RjOmTbm.exe
  2⤵
  PID:1164
- C:\Windows\System\UGHxtTQ.exe
  C:\Windows\System\UGHxtTQ.exe
  2⤵
  PID:1272
- C:\Windows\System\ojGVeII.exe
  C:\Windows\System\ojGVeII.exe
  2⤵
  PID:3264
- C:\Windows\System\UJjNAvC.exe
  C:\Windows\System\UJjNAvC.exe
  2⤵
  PID:2720
- C:\Windows\System\PbPyMZB.exe
  C:\Windows\System\PbPyMZB.exe
  2⤵
  PID:2732
- C:\Windows\System\dPFyRsg.exe
  C:\Windows\System\dPFyRsg.exe
  2⤵
  PID:3172
- C:\Windows\System\aXClAxX.exe
  C:\Windows\System\aXClAxX.exe
  2⤵
  PID:380
- C:\Windows\System\vquNvXP.exe
  C:\Windows\System\vquNvXP.exe
  2⤵
  PID:2728
- C:\Windows\System\ZqZUznT.exe
  C:\Windows\System\ZqZUznT.exe
  2⤵
  PID:2124
- C:\Windows\System\WFtntAl.exe
  C:\Windows\System\WFtntAl.exe
  2⤵
  PID:572
- C:\Windows\System\VMFqIHR.exe
  C:\Windows\System\VMFqIHR.exe
  2⤵
  PID:3532
- C:\Windows\System\wGbEyfz.exe
  C:\Windows\System\wGbEyfz.exe
  2⤵
  PID:3572
- C:\Windows\System\oHwaYdn.exe
  C:\Windows\System\oHwaYdn.exe
  2⤵
  PID:4104
- C:\Windows\System\gdsiUaX.exe
  C:\Windows\System\gdsiUaX.exe
  2⤵
  PID:4120
- C:\Windows\System\tpxGhxn.exe
  C:\Windows\System\tpxGhxn.exe
  2⤵
  PID:4136
- C:\Windows\System\mWxutzc.exe
  C:\Windows\System\mWxutzc.exe
  2⤵
  PID:4264
- C:\Windows\System\LBzFqyC.exe
  C:\Windows\System\LBzFqyC.exe
  2⤵
  PID:4300
- C:\Windows\System\cMvHJVk.exe
  C:\Windows\System\cMvHJVk.exe
  2⤵
  PID:4316
- C:\Windows\System\BNYdqza.exe
  C:\Windows\System\BNYdqza.exe
  2⤵
  PID:4332
- C:\Windows\System\iaFjfHM.exe
  C:\Windows\System\iaFjfHM.exe
  2⤵
  PID:4348
- C:\Windows\System\UBJCxyA.exe
  C:\Windows\System\UBJCxyA.exe
  2⤵
  PID:4364
- C:\Windows\System\qtohIdJ.exe
  C:\Windows\System\qtohIdJ.exe
  2⤵
  PID:4380
- C:\Windows\System\zYFILye.exe
  C:\Windows\System\zYFILye.exe
  2⤵
  PID:4396
- C:\Windows\System\kFFsGuc.exe
  C:\Windows\System\kFFsGuc.exe
  2⤵
  PID:4412
- C:\Windows\System\UghhoCE.exe
  C:\Windows\System\UghhoCE.exe
  2⤵
  PID:4428
- C:\Windows\System\YTKIvLC.exe
  C:\Windows\System\YTKIvLC.exe
  2⤵
  PID:4444
- C:\Windows\System\GhGHIsz.exe
  C:\Windows\System\GhGHIsz.exe
  2⤵
  PID:4460
- C:\Windows\System\mAkTsGw.exe
  C:\Windows\System\mAkTsGw.exe
  2⤵
  PID:4480
- C:\Windows\System\aAfCXfV.exe
  C:\Windows\System\aAfCXfV.exe
  2⤵
  PID:4504
- C:\Windows\System\SugsfFA.exe
  C:\Windows\System\SugsfFA.exe
  2⤵
  PID:4520
- C:\Windows\System\oCMgpYH.exe
  C:\Windows\System\oCMgpYH.exe
  2⤵
  PID:4536
- C:\Windows\System\ZXOKXaI.exe
  C:\Windows\System\ZXOKXaI.exe
  2⤵
  PID:4552
- C:\Windows\System\LcrgWTK.exe
  C:\Windows\System\LcrgWTK.exe
  2⤵
  PID:4568
- C:\Windows\System\qnnKngg.exe
  C:\Windows\System\qnnKngg.exe
  2⤵
  PID:4584
- C:\Windows\System\YKqzrNw.exe
  C:\Windows\System\YKqzrNw.exe
  2⤵
  PID:4604
- C:\Windows\System\xxhBcCu.exe
  C:\Windows\System\xxhBcCu.exe
  2⤵
  PID:4628
- C:\Windows\System\oaDJIok.exe
  C:\Windows\System\oaDJIok.exe
  2⤵
  PID:4700
- C:\Windows\System\vWUTZVa.exe
  C:\Windows\System\vWUTZVa.exe
  2⤵
  PID:4768
- C:\Windows\System\lAiUJuR.exe
  C:\Windows\System\lAiUJuR.exe
  2⤵
  PID:4788
- C:\Windows\System\TBYDyZM.exe
  C:\Windows\System\TBYDyZM.exe
  2⤵
  PID:4804
- C:\Windows\System\TRdpuAu.exe
  C:\Windows\System\TRdpuAu.exe
  2⤵
  PID:4828
- C:\Windows\System\MnETsvH.exe
  C:\Windows\System\MnETsvH.exe
  2⤵
  PID:4860
- C:\Windows\System\IyAEksX.exe
  C:\Windows\System\IyAEksX.exe
  2⤵
  PID:4884
- C:\Windows\System\rnsIrpX.exe
  C:\Windows\System\rnsIrpX.exe
  2⤵
  PID:4900
- C:\Windows\System\snvabKA.exe
  C:\Windows\System\snvabKA.exe
  2⤵
  PID:4932
- C:\Windows\System\byrZtbV.exe
  C:\Windows\System\byrZtbV.exe
  2⤵
  PID:4948
- C:\Windows\System\LOKmxoq.exe
  C:\Windows\System\LOKmxoq.exe
  2⤵
  PID:4964
- C:\Windows\System\EEqInxv.exe
  C:\Windows\System\EEqInxv.exe
  2⤵
  PID:4980
- C:\Windows\System\OMgQcix.exe
  C:\Windows\System\OMgQcix.exe
  2⤵
  PID:5004
- C:\Windows\System\hUXRVvU.exe
  C:\Windows\System\hUXRVvU.exe
  2⤵
  PID:5024
- C:\Windows\System\GHJyKFw.exe
  C:\Windows\System\GHJyKFw.exe
  2⤵
  PID:5056
- C:\Windows\System\pMQaXyR.exe
  C:\Windows\System\pMQaXyR.exe
  2⤵
  PID:5072
- C:\Windows\System\tCNZrUV.exe
  C:\Windows\System\tCNZrUV.exe
  2⤵
  PID:5096
- C:\Windows\System\YaCkbVa.exe
  C:\Windows\System\YaCkbVa.exe
  2⤵
  PID:5116
- C:\Windows\System\ekDdeaT.exe
  C:\Windows\System\ekDdeaT.exe
  2⤵
  PID:3792
- C:\Windows\System\jOGHaAU.exe
  C:\Windows\System\jOGHaAU.exe
  2⤵
  PID:1772
- C:\Windows\System\UXxhHMX.exe
  C:\Windows\System\UXxhHMX.exe
  2⤵
  PID:1836
- C:\Windows\System\yuOnoEj.exe
  C:\Windows\System\yuOnoEj.exe
  2⤵
  PID:3192
- C:\Windows\System\IbRReLi.exe
  C:\Windows\System\IbRReLi.exe
  2⤵
  PID:3408
- C:\Windows\System\qltHAlE.exe
  C:\Windows\System\qltHAlE.exe
  2⤵
  PID:4100
- C:\Windows\System\JAlfbJW.exe
  C:\Windows\System\JAlfbJW.exe
  2⤵
  PID:4128
- C:\Windows\System\pdylJmU.exe
  C:\Windows\System\pdylJmU.exe
  2⤵
  PID:2176
- C:\Windows\System\gMYdfCG.exe
  C:\Windows\System\gMYdfCG.exe
  2⤵
  PID:4188
- C:\Windows\System\EUNwYdo.exe
  C:\Windows\System\EUNwYdo.exe
  2⤵
  PID:236
- C:\Windows\System\zWUxdKK.exe
  C:\Windows\System\zWUxdKK.exe
  2⤵
  PID:1660
- C:\Windows\System\cbknhvl.exe
  C:\Windows\System\cbknhvl.exe
  2⤵
  PID:3752
- C:\Windows\System\krmBMbK.exe
  C:\Windows\System\krmBMbK.exe
  2⤵
  PID:4072
- C:\Windows\System\cdjqecn.exe
  C:\Windows\System\cdjqecn.exe
  2⤵
  PID:4116
- C:\Windows\System\wPFBugI.exe
  C:\Windows\System\wPFBugI.exe
  2⤵
  PID:4156
- C:\Windows\System\nqDxDFL.exe
  C:\Windows\System\nqDxDFL.exe
  2⤵
  PID:4184
- C:\Windows\System\DMFmpEb.exe
  C:\Windows\System\DMFmpEb.exe
  2⤵
  PID:3076
- C:\Windows\System\gFICGHj.exe
  C:\Windows\System\gFICGHj.exe
  2⤵
  PID:3712
- C:\Windows\System\tlOqFYy.exe
  C:\Windows\System\tlOqFYy.exe
  2⤵
  PID:4496
- C:\Windows\System\aMtuIUy.exe
  C:\Windows\System\aMtuIUy.exe
  2⤵
  PID:4600
- C:\Windows\System\kZigLUF.exe
  C:\Windows\System\kZigLUF.exe
  2⤵
  PID:4340
- C:\Windows\System\YeAzyNO.exe
  C:\Windows\System\YeAzyNO.exe
  2⤵
  PID:4312
- C:\Windows\System\armdOJm.exe
  C:\Windows\System\armdOJm.exe
  2⤵
  PID:4344
- C:\Windows\System\HXkKWHp.exe
  C:\Windows\System\HXkKWHp.exe
  2⤵
  PID:4392
- C:\Windows\System\qBlPtLQ.exe
  C:\Windows\System\qBlPtLQ.exe
  2⤵
  PID:4420
- C:\Windows\System\CLaySST.exe
  C:\Windows\System\CLaySST.exe
  2⤵
  PID:4620
- C:\Windows\System\JVqZnKD.exe
  C:\Windows\System\JVqZnKD.exe
  2⤵
  PID:4476
- C:\Windows\System\IRhAWAO.exe
  C:\Windows\System\IRhAWAO.exe
  2⤵
  PID:4404
- C:\Windows\System\QSMjLGY.exe
  C:\Windows\System\QSMjLGY.exe
  2⤵
  PID:4644
- C:\Windows\System\QhFEgCN.exe
  C:\Windows\System\QhFEgCN.exe
  2⤵
  PID:4668
- C:\Windows\System\DrncGBc.exe
  C:\Windows\System\DrncGBc.exe
  2⤵
  PID:4696
- C:\Windows\System\btGNbBW.exe
  C:\Windows\System\btGNbBW.exe
  2⤵
  PID:4724
- C:\Windows\System\sImrxJs.exe
  C:\Windows\System\sImrxJs.exe
  2⤵
  PID:4740
- C:\Windows\System\dboVlLl.exe
  C:\Windows\System\dboVlLl.exe
  2⤵
  PID:4760
- C:\Windows\System\RmMIYsl.exe
  C:\Windows\System\RmMIYsl.exe
  2⤵
  PID:4800
- C:\Windows\System\OHZADhF.exe
  C:\Windows\System\OHZADhF.exe
  2⤵
  PID:4824
- C:\Windows\System\uaZZwwO.exe
  C:\Windows\System\uaZZwwO.exe
  2⤵
  PID:4848
- C:\Windows\System\SaHkZNx.exe
  C:\Windows\System\SaHkZNx.exe
  2⤵
  PID:4872
- C:\Windows\System\sQKVZph.exe
  C:\Windows\System\sQKVZph.exe
  2⤵
  PID:4912
- C:\Windows\System\CGyKyrg.exe
  C:\Windows\System\CGyKyrg.exe
  2⤵
  PID:4928
- C:\Windows\System\Wyhuhya.exe
  C:\Windows\System\Wyhuhya.exe
  2⤵
  PID:4960
- C:\Windows\System\VDMQMLQ.exe
  C:\Windows\System\VDMQMLQ.exe
  2⤵
  PID:4972
- C:\Windows\System\ajVjmYG.exe
  C:\Windows\System\ajVjmYG.exe
  2⤵
  PID:5032
- C:\Windows\System\YuZOyqL.exe
  C:\Windows\System\YuZOyqL.exe
  2⤵
  PID:5044
- C:\Windows\System\ruXdwyQ.exe
  C:\Windows\System\ruXdwyQ.exe
  2⤵
  PID:5064
- C:\Windows\System\aWWnYxg.exe
  C:\Windows\System\aWWnYxg.exe
  2⤵
  PID:5088
- C:\Windows\System\FJnnfvL.exe
  C:\Windows\System\FJnnfvL.exe
  2⤵
  PID:3776
- C:\Windows\System\WVBadjZ.exe
  C:\Windows\System\WVBadjZ.exe
  2⤵
  PID:5104
- C:\Windows\System\GzuXCPs.exe
  C:\Windows\System\GzuXCPs.exe
  2⤵
  PID:3004
- C:\Windows\System\ipjOEPF.exe
  C:\Windows\System\ipjOEPF.exe
  2⤵
  PID:4180
- C:\Windows\System\HSUwBMr.exe
  C:\Windows\System\HSUwBMr.exe
  2⤵
  PID:3656
- C:\Windows\System\gtvWIqj.exe
  C:\Windows\System\gtvWIqj.exe
  2⤵
  PID:3872
- C:\Windows\System\vdQRwNe.exe
  C:\Windows\System\vdQRwNe.exe
  2⤵
  PID:2900
- C:\Windows\System\mBXmXDQ.exe
  C:\Windows\System\mBXmXDQ.exe
  2⤵
  PID:4196
- C:\Windows\System\PtKGQcx.exe
  C:\Windows\System\PtKGQcx.exe
  2⤵
  PID:1232
- C:\Windows\System\yBFokvF.exe
  C:\Windows\System\yBFokvF.exe
  2⤵
  PID:4200
- C:\Windows\System\KOyDaHk.exe
  C:\Windows\System\KOyDaHk.exe
  2⤵
  PID:4216
- C:\Windows\System\hFaIehJ.exe
  C:\Windows\System\hFaIehJ.exe
  2⤵
  PID:1356
- C:\Windows\System\gsWZECL.exe
  C:\Windows\System\gsWZECL.exe
  2⤵
  PID:4164
- C:\Windows\System\raKAYHM.exe
  C:\Windows\System\raKAYHM.exe
  2⤵
  PID:3472
- C:\Windows\System\vhhpRSX.exe
  C:\Windows\System\vhhpRSX.exe
  2⤵
  PID:4292
- C:\Windows\System\DojbtuD.exe
  C:\Windows\System\DojbtuD.exe
  2⤵
  PID:4328
- C:\Windows\System\NceuCst.exe
  C:\Windows\System\NceuCst.exe
  2⤵
  PID:4612
- C:\Windows\System\LdwsTaL.exe
  C:\Windows\System\LdwsTaL.exe
  2⤵
  PID:4308
- C:\Windows\System\PhhCcwY.exe
  C:\Windows\System\PhhCcwY.exe
  2⤵
  PID:4492
- C:\Windows\System\WBTBxvb.exe
  C:\Windows\System\WBTBxvb.exe
  2⤵
  PID:4388
- C:\Windows\System\UjaXXpD.exe
  C:\Windows\System\UjaXXpD.exe
  2⤵
  PID:4592
- C:\Windows\System\sRTbGqW.exe
  C:\Windows\System\sRTbGqW.exe
  2⤵
  PID:4676
- C:\Windows\System\YPDCPnn.exe
  C:\Windows\System\YPDCPnn.exe
  2⤵
  PID:4784
- C:\Windows\System\aFKXeUz.exe
  C:\Windows\System\aFKXeUz.exe
  2⤵
  PID:4688
- C:\Windows\System\EQJIYhk.exe
  C:\Windows\System\EQJIYhk.exe
  2⤵
  PID:4820
- C:\Windows\System\IzZOhKL.exe
  C:\Windows\System\IzZOhKL.exe
  2⤵
  PID:4876
- C:\Windows\System\KVFUhQC.exe
  C:\Windows\System\KVFUhQC.exe
  2⤵
  PID:4908
- C:\Windows\System\QjGGzhA.exe
  C:\Windows\System\QjGGzhA.exe
  2⤵
  PID:5000
- C:\Windows\System\bpNFrkP.exe
  C:\Windows\System\bpNFrkP.exe
  2⤵
  PID:3500
- C:\Windows\System\zTaUnLp.exe
  C:\Windows\System\zTaUnLp.exe
  2⤵
  PID:2412
- C:\Windows\System\VEoEQiP.exe
  C:\Windows\System\VEoEQiP.exe
  2⤵
  PID:4920
- C:\Windows\System\OyIURgy.exe
  C:\Windows\System\OyIURgy.exe
  2⤵
  PID:4532
- C:\Windows\System\QtlbLji.exe
  C:\Windows\System\QtlbLji.exe
  2⤵
  PID:4736
- C:\Windows\System\zEgEyUQ.exe
  C:\Windows\System\zEgEyUQ.exe
  2⤵
  PID:5020
- C:\Windows\System\qmLDiMA.exe
  C:\Windows\System\qmLDiMA.exe
  2⤵
  PID:4152
- C:\Windows\System\BlIyTWn.exe
  C:\Windows\System\BlIyTWn.exe
  2⤵
  PID:2956
- C:\Windows\System\UoeYMzC.exe
  C:\Windows\System\UoeYMzC.exe
  2⤵
  PID:4376
- C:\Windows\System\zCHJxTu.exe
  C:\Windows\System\zCHJxTu.exe
  2⤵
  PID:4636
- C:\Windows\System\vLNQoNX.exe
  C:\Windows\System\vLNQoNX.exe
  2⤵
  PID:4856
- C:\Windows\System\qOxInGR.exe
  C:\Windows\System\qOxInGR.exe
  2⤵
  PID:1744
- C:\Windows\System\AlyDGFI.exe
  C:\Windows\System\AlyDGFI.exe
  2⤵
  PID:4472
- C:\Windows\System\ZhLjRTI.exe
  C:\Windows\System\ZhLjRTI.exe
  2⤵
  PID:2596
- C:\Windows\System\ClRNBPa.exe
  C:\Windows\System\ClRNBPa.exe
  2⤵
  PID:4776
- C:\Windows\System\wTtVuaG.exe
  C:\Windows\System\wTtVuaG.exe
  2⤵
  PID:4512
- C:\Windows\System\hFIKqLd.exe
  C:\Windows\System\hFIKqLd.exe
  2⤵
  PID:3940
- C:\Windows\System\cMkFJyN.exe
  C:\Windows\System\cMkFJyN.exe
  2⤵
  PID:1168
- C:\Windows\System\TFBsiFS.exe
  C:\Windows\System\TFBsiFS.exe
  2⤵
  PID:4752
- C:\Windows\System\kwQhgPX.exe
  C:\Windows\System\kwQhgPX.exe
  2⤵
  PID:4616
- C:\Windows\System\fIfgOhP.exe
  C:\Windows\System\fIfgOhP.exe
  2⤵
  PID:2056
- C:\Windows\System\zUEeeEA.exe
  C:\Windows\System\zUEeeEA.exe
  2⤵
  PID:536
- C:\Windows\System\VHKXsSw.exe
  C:\Windows\System\VHKXsSw.exe
  2⤵
  PID:4840
- C:\Windows\System\aHqVfwv.exe
  C:\Windows\System\aHqVfwv.exe
  2⤵
  PID:4576
- C:\Windows\System\FjPlsEU.exe
  C:\Windows\System\FjPlsEU.exe
  2⤵
  PID:4208
- C:\Windows\System\QUJoKUU.exe
  C:\Windows\System\QUJoKUU.exe
  2⤵
  PID:5084
- C:\Windows\System\WNqnzwj.exe
  C:\Windows\System\WNqnzwj.exe
  2⤵
  PID:4236
- C:\Windows\System\FEOLPuz.exe
  C:\Windows\System\FEOLPuz.exe
  2⤵
  PID:4424
- C:\Windows\System\GKnjaXG.exe
  C:\Windows\System\GKnjaXG.exe
  2⤵
  PID:4408
- C:\Windows\System\Qmnpurd.exe
  C:\Windows\System\Qmnpurd.exe
  2⤵
  PID:4212
- C:\Windows\System\qnJSBBa.exe
  C:\Windows\System\qnJSBBa.exe
  2⤵
  PID:4852
- C:\Windows\System\etDyYQz.exe
  C:\Windows\System\etDyYQz.exe
  2⤵
  PID:5012
- C:\Windows\System\MKSIrTU.exe
  C:\Windows\System\MKSIrTU.exe
  2⤵
  PID:5128
- C:\Windows\System\GbUAsZZ.exe
  C:\Windows\System\GbUAsZZ.exe
  2⤵
  PID:5144
- C:\Windows\System\iJlGgXY.exe
  C:\Windows\System\iJlGgXY.exe
  2⤵
  PID:5160
- C:\Windows\System\dmuGluA.exe
  C:\Windows\System\dmuGluA.exe
  2⤵
  PID:5176
- C:\Windows\System\yvqxNOd.exe
  C:\Windows\System\yvqxNOd.exe
  2⤵
  PID:5192
- C:\Windows\System\nAqOqLD.exe
  C:\Windows\System\nAqOqLD.exe
  2⤵
  PID:5208
- C:\Windows\System\VjeLMfg.exe
  C:\Windows\System\VjeLMfg.exe
  2⤵
  PID:5224
- C:\Windows\System\NbMDYEj.exe
  C:\Windows\System\NbMDYEj.exe
  2⤵
  PID:5252
- C:\Windows\System\pbyJQer.exe
  C:\Windows\System\pbyJQer.exe
  2⤵
  PID:5268
- C:\Windows\System\BSIkLVL.exe
  C:\Windows\System\BSIkLVL.exe
  2⤵
  PID:5372
- C:\Windows\System\GPFleKZ.exe
  C:\Windows\System\GPFleKZ.exe
  2⤵
  PID:5392
- C:\Windows\System\YHqdRjC.exe
  C:\Windows\System\YHqdRjC.exe
  2⤵
  PID:5408
- C:\Windows\System\gkuqAyZ.exe
  C:\Windows\System\gkuqAyZ.exe
  2⤵
  PID:5424
- C:\Windows\System\raqvnqP.exe
  C:\Windows\System\raqvnqP.exe
  2⤵
  PID:5440
- C:\Windows\System\UmFitkb.exe
  C:\Windows\System\UmFitkb.exe
  2⤵
  PID:5456
- C:\Windows\System\uUAbnFI.exe
  C:\Windows\System\uUAbnFI.exe
  2⤵
  PID:5492
- C:\Windows\System\CEAvxdi.exe
  C:\Windows\System\CEAvxdi.exe
  2⤵
  PID:5508
- C:\Windows\System\BrezLYA.exe
  C:\Windows\System\BrezLYA.exe
  2⤵
  PID:5524
- C:\Windows\System\cBDgYvn.exe
  C:\Windows\System\cBDgYvn.exe
  2⤵
  PID:5540
- C:\Windows\System\lTbxBgi.exe
  C:\Windows\System\lTbxBgi.exe
  2⤵
  PID:5556
- C:\Windows\System\NwxSQEv.exe
  C:\Windows\System\NwxSQEv.exe
  2⤵
  PID:5572
- C:\Windows\System\QpCZlaa.exe
  C:\Windows\System\QpCZlaa.exe
  2⤵
  PID:5604
- C:\Windows\System\yKzNHAa.exe
  C:\Windows\System\yKzNHAa.exe
  2⤵
  PID:5668
- C:\Windows\System\ljhvWXv.exe
  C:\Windows\System\ljhvWXv.exe
  2⤵
  PID:5688
- C:\Windows\System\PCmKPYU.exe
  C:\Windows\System\PCmKPYU.exe
  2⤵
  PID:5704
- C:\Windows\System\yKGWGlV.exe
  C:\Windows\System\yKGWGlV.exe
  2⤵
  PID:5720
- C:\Windows\System\JGPnLTh.exe
  C:\Windows\System\JGPnLTh.exe
  2⤵
  PID:5736
- C:\Windows\System\QRTYhEc.exe
  C:\Windows\System\QRTYhEc.exe
  2⤵
  PID:5752
- C:\Windows\System\trHbwJy.exe
  C:\Windows\System\trHbwJy.exe
  2⤵
  PID:5768
- C:\Windows\System\ShpkVuj.exe
  C:\Windows\System\ShpkVuj.exe
  2⤵
  PID:5784
- C:\Windows\System\wKhIIBL.exe
  C:\Windows\System\wKhIIBL.exe
  2⤵
  PID:5800
- C:\Windows\System\hMcQwKX.exe
  C:\Windows\System\hMcQwKX.exe
  2⤵
  PID:5816
- C:\Windows\System\WUuDiYx.exe
  C:\Windows\System\WUuDiYx.exe
  2⤵
  PID:5832
- C:\Windows\System\MRKkIQV.exe
  C:\Windows\System\MRKkIQV.exe
  2⤵
  PID:5848
- C:\Windows\System\DwfbLBR.exe
  C:\Windows\System\DwfbLBR.exe
  2⤵
  PID:5864
- C:\Windows\System\HOsooaq.exe
  C:\Windows\System\HOsooaq.exe
  2⤵
  PID:5880
- C:\Windows\System\yeKouhs.exe
  C:\Windows\System\yeKouhs.exe
  2⤵
  PID:5896
- C:\Windows\System\eXpNqBS.exe
  C:\Windows\System\eXpNqBS.exe
  2⤵
  PID:5916
- C:\Windows\System\hfhGEDf.exe
  C:\Windows\System\hfhGEDf.exe
  2⤵
  PID:5932
- C:\Windows\System\SkBdTVG.exe
  C:\Windows\System\SkBdTVG.exe
  2⤵
  PID:5948
- C:\Windows\System\ynfEYVE.exe
  C:\Windows\System\ynfEYVE.exe
  2⤵
  PID:5964
- C:\Windows\System\QNmLyCB.exe
  C:\Windows\System\QNmLyCB.exe
  2⤵
  PID:5980
- C:\Windows\System\PoxEcfu.exe
  C:\Windows\System\PoxEcfu.exe
  2⤵
  PID:5996
- C:\Windows\System\fjeFwVb.exe
  C:\Windows\System\fjeFwVb.exe
  2⤵
  PID:6012
- C:\Windows\System\jmPIRFG.exe
  C:\Windows\System\jmPIRFG.exe
  2⤵
  PID:6028
- C:\Windows\System\tjKhoZM.exe
  C:\Windows\System\tjKhoZM.exe
  2⤵
  PID:6044
- C:\Windows\System\dFAxaBb.exe
  C:\Windows\System\dFAxaBb.exe
  2⤵
  PID:6060
- C:\Windows\System\FoVIFCg.exe
  C:\Windows\System\FoVIFCg.exe
  2⤵
  PID:6076
- C:\Windows\System\YJmVljd.exe
  C:\Windows\System\YJmVljd.exe
  2⤵
  PID:6092
- C:\Windows\System\ISOJmdu.exe
  C:\Windows\System\ISOJmdu.exe
  2⤵
  PID:6108
- C:\Windows\System\TGUdMMT.exe
  C:\Windows\System\TGUdMMT.exe
  2⤵
  PID:6124
- C:\Windows\System\ikXkmqP.exe
  C:\Windows\System\ikXkmqP.exe
  2⤵
  PID:6140
- C:\Windows\System\krQQdli.exe
  C:\Windows\System\krQQdli.exe
  2⤵
  PID:4656
- C:\Windows\System\KwKItof.exe
  C:\Windows\System\KwKItof.exe
  2⤵
  PID:5188
- C:\Windows\System\obeMDJt.exe
  C:\Windows\System\obeMDJt.exe
  2⤵
  PID:5260
- C:\Windows\System\MBVIQWf.exe
  C:\Windows\System\MBVIQWf.exe
  2⤵
  PID:4528
- C:\Windows\System\rERjlag.exe
  C:\Windows\System\rERjlag.exe
  2⤵
  PID:5140
- C:\Windows\System\CwKGkeC.exe
  C:\Windows\System\CwKGkeC.exe
  2⤵
  PID:5204
- C:\Windows\System\rutrMUF.exe
  C:\Windows\System\rutrMUF.exe
  2⤵
  PID:5244
- C:\Windows\System\DTVmuNz.exe
  C:\Windows\System\DTVmuNz.exe
  2⤵
  PID:5284
- C:\Windows\System\tSiIpxS.exe
  C:\Windows\System\tSiIpxS.exe
  2⤵
  PID:5048
- C:\Windows\System\VPEpKRg.exe
  C:\Windows\System\VPEpKRg.exe
  2⤵
  PID:5308
- C:\Windows\System\gchOWrk.exe
  C:\Windows\System\gchOWrk.exe
  2⤵
  PID:5324
- C:\Windows\System\TBInuQy.exe
  C:\Windows\System\TBInuQy.exe
  2⤵
  PID:5340
- C:\Windows\System\wBfmQgP.exe
  C:\Windows\System\wBfmQgP.exe
  2⤵
  PID:5356
- C:\Windows\System\dyYWcsm.exe
  C:\Windows\System\dyYWcsm.exe
  2⤵
  PID:5388
- C:\Windows\System\iqFOawj.exe
  C:\Windows\System\iqFOawj.exe
  2⤵
  PID:5400
- C:\Windows\System\wXuSzIB.exe
  C:\Windows\System\wXuSzIB.exe
  2⤵
  PID:5472
- C:\Windows\System\Qydtqhy.exe
  C:\Windows\System\Qydtqhy.exe
  2⤵
  PID:5488
- C:\Windows\System\wzfkMRO.exe
  C:\Windows\System\wzfkMRO.exe
  2⤵
  PID:5520
- C:\Windows\System\qXmBKAJ.exe
  C:\Windows\System\qXmBKAJ.exe
  2⤵
  PID:5500
- C:\Windows\System\VWagYOP.exe
  C:\Windows\System\VWagYOP.exe
  2⤵
  PID:5448
- C:\Windows\System\utssovL.exe
  C:\Windows\System\utssovL.exe
  2⤵
  PID:5516
- C:\Windows\System\TACtlpa.exe
  C:\Windows\System\TACtlpa.exe
  2⤵
  PID:5600
- C:\Windows\System\irEYvkX.exe
  C:\Windows\System\irEYvkX.exe
  2⤵
  PID:5616
- C:\Windows\System\MRlcHAX.exe
  C:\Windows\System\MRlcHAX.exe
  2⤵
  PID:5684
- C:\Windows\System\tGUlqdd.exe
  C:\Windows\System\tGUlqdd.exe
  2⤵
  PID:5648
- C:\Windows\System\fKTQCHL.exe
  C:\Windows\System\fKTQCHL.exe
  2⤵
  PID:5664
- C:\Windows\System\UZcegzl.exe
  C:\Windows\System\UZcegzl.exe
  2⤵
  PID:5700
- C:\Windows\System\FsPtfAW.exe
  C:\Windows\System\FsPtfAW.exe
  2⤵
  PID:5764
- C:\Windows\System\WoqCaRz.exe
  C:\Windows\System\WoqCaRz.exe
  2⤵
  PID:5812
- C:\Windows\System\MJkUIZo.exe
  C:\Windows\System\MJkUIZo.exe
  2⤵
  PID:5808
- C:\Windows\System\KTLOdAy.exe
  C:\Windows\System\KTLOdAy.exe
  2⤵
  PID:5872
- C:\Windows\System\hXFxoQe.exe
  C:\Windows\System\hXFxoQe.exe
  2⤵
  PID:5944
- C:\Windows\System\uCFWowK.exe
  C:\Windows\System\uCFWowK.exe
  2⤵
  PID:6008
- C:\Windows\System\UdMAnrT.exe
  C:\Windows\System\UdMAnrT.exe
  2⤵
  PID:6068
- C:\Windows\System\RsxpzKO.exe
  C:\Windows\System\RsxpzKO.exe
  2⤵
  PID:5216
- C:\Windows\System\FKdbqGB.exe
  C:\Windows\System\FKdbqGB.exe
  2⤵
  PID:5200
- C:\Windows\System\xKujcpo.exe
  C:\Windows\System\xKujcpo.exe
  2⤵
  PID:5988
- C:\Windows\System\VxCoBrn.exe
  C:\Windows\System\VxCoBrn.exe
  2⤵
  PID:5280
- C:\Windows\System\makXOga.exe
  C:\Windows\System\makXOga.exe
  2⤵
  PID:6088
- C:\Windows\System\ZdzGMSn.exe
  C:\Windows\System\ZdzGMSn.exe
  2⤵
  PID:5384
- C:\Windows\System\eIeyrRE.exe
  C:\Windows\System\eIeyrRE.exe
  2⤵
  PID:5636
- C:\Windows\System\yXTbaXt.exe
  C:\Windows\System\yXTbaXt.exe
  2⤵
  PID:5464
- C:\Windows\System\wSlZHXp.exe
  C:\Windows\System\wSlZHXp.exe
  2⤵
  PID:2260
- C:\Windows\System\TMvJfjG.exe
  C:\Windows\System\TMvJfjG.exe
  2⤵
  PID:4672
- C:\Windows\System\onjZxma.exe
  C:\Windows\System\onjZxma.exe
  2⤵
  PID:5892
- C:\Windows\System\JVHTUgh.exe
  C:\Windows\System\JVHTUgh.exe
  2⤵
  PID:6052
- C:\Windows\System\Jywgtwl.exe
  C:\Windows\System\Jywgtwl.exe
  2⤵
  PID:5236
- C:\Windows\System\PbTcwZs.exe
  C:\Windows\System\PbTcwZs.exe
  2⤵
  PID:5416
- C:\Windows\System\AkNYgVR.exe
  C:\Windows\System\AkNYgVR.exe
  2⤵
  PID:5592
- C:\Windows\System\IydnqAS.exe
  C:\Windows\System\IydnqAS.exe
  2⤵
  PID:5564
- C:\Windows\System\eFGOHzj.exe
  C:\Windows\System\eFGOHzj.exe
  2⤵
  PID:5580
- C:\Windows\System\dlFzuJs.exe
  C:\Windows\System\dlFzuJs.exe
  2⤵
  PID:5584
- C:\Windows\System\GDbJksM.exe
  C:\Windows\System\GDbJksM.exe
  2⤵
  PID:6004
- C:\Windows\System\SXrIkhF.exe
  C:\Windows\System\SXrIkhF.exe
  2⤵
  PID:5776
- C:\Windows\System\wfvXeUw.exe
  C:\Windows\System\wfvXeUw.exe
  2⤵
  PID:5644
- C:\Windows\System\nrizzVa.exe
  C:\Windows\System\nrizzVa.exe
  2⤵
  PID:6104
- C:\Windows\System\qIaZeNA.exe
  C:\Windows\System\qIaZeNA.exe
  2⤵
  PID:5956
- C:\Windows\System\cpxskkP.exe
  C:\Windows\System\cpxskkP.exe
  2⤵
  PID:5908
- C:\Windows\System\vgSlXZh.exe
  C:\Windows\System\vgSlXZh.exe
  2⤵
  PID:5172
- C:\Windows\System\IEPRiVC.exe
  C:\Windows\System\IEPRiVC.exe
  2⤵
  PID:5304
- C:\Windows\System\RyENIon.exe
  C:\Windows\System\RyENIon.exe
  2⤵
  PID:5152
- C:\Windows\System\CRowHPE.exe
  C:\Windows\System\CRowHPE.exe
  2⤵
  PID:5824
- C:\Windows\System\fxYIIHH.exe
  C:\Windows\System\fxYIIHH.exe
  2⤵
  PID:5860
- C:\Windows\System\EfCUgbw.exe
  C:\Windows\System\EfCUgbw.exe
  2⤵
  PID:5504
- C:\Windows\System\FcADrtQ.exe
  C:\Windows\System\FcADrtQ.exe
  2⤵
  PID:5760
- C:\Windows\System\fEsTtXI.exe
  C:\Windows\System\fEsTtXI.exe
  2⤵
  PID:5220
- C:\Windows\System\ZmhmamQ.exe
  C:\Windows\System\ZmhmamQ.exe
  2⤵
  PID:5320
- C:\Windows\System\GxFefMU.exe
  C:\Windows\System\GxFefMU.exe
  2⤵
  PID:5632
- C:\Windows\System\Mqzumqj.exe
  C:\Windows\System\Mqzumqj.exe
  2⤵
  PID:5620
- C:\Windows\System\ZOOIZQQ.exe
  C:\Windows\System\ZOOIZQQ.exe
  2⤵
  PID:5276
- C:\Windows\System\JRZvglF.exe
  C:\Windows\System\JRZvglF.exe
  2⤵
  PID:3832
- C:\Windows\System\nVHztKV.exe
  C:\Windows\System\nVHztKV.exe
  2⤵
  PID:3716
- C:\Windows\System\kIGkDsZ.exe
  C:\Windows\System\kIGkDsZ.exe
  2⤵
  PID:5316
- C:\Windows\System\tDFbLaB.exe
  C:\Windows\System\tDFbLaB.exe
  2⤵
  PID:5876
- C:\Windows\System\xVJoUCr.exe
  C:\Windows\System\xVJoUCr.exe
  2⤵
  PID:6160
- C:\Windows\System\UjCojpp.exe
  C:\Windows\System\UjCojpp.exe
  2⤵
  PID:6176
- C:\Windows\System\nJPNWzI.exe
  C:\Windows\System\nJPNWzI.exe
  2⤵
  PID:6192
- C:\Windows\System\MTivLeE.exe
  C:\Windows\System\MTivLeE.exe
  2⤵
  PID:6208
- C:\Windows\System\jlPtfFt.exe
  C:\Windows\System\jlPtfFt.exe
  2⤵
  PID:6224
- C:\Windows\System\FbRflhg.exe
  C:\Windows\System\FbRflhg.exe
  2⤵
  PID:6240
- C:\Windows\System\CUXhJoY.exe
  C:\Windows\System\CUXhJoY.exe
  2⤵
  PID:6264
- C:\Windows\System\eacKeWT.exe
  C:\Windows\System\eacKeWT.exe
  2⤵
  PID:6280
- C:\Windows\System\rCtnFYp.exe
  C:\Windows\System\rCtnFYp.exe
  2⤵
  PID:6296
- C:\Windows\System\VASUefw.exe
  C:\Windows\System\VASUefw.exe
  2⤵
  PID:6312
- C:\Windows\System\GWObBRq.exe
  C:\Windows\System\GWObBRq.exe
  2⤵
  PID:6328
- C:\Windows\System\BhJWJIF.exe
  C:\Windows\System\BhJWJIF.exe
  2⤵
  PID:6344
- C:\Windows\System\rBlXHtV.exe
  C:\Windows\System\rBlXHtV.exe
  2⤵
  PID:6360
- C:\Windows\System\rcnRVsx.exe
  C:\Windows\System\rcnRVsx.exe
  2⤵
  PID:6376
- C:\Windows\System\CZDLKDs.exe
  C:\Windows\System\CZDLKDs.exe
  2⤵
  PID:6392
- C:\Windows\System\JmIKHtc.exe
  C:\Windows\System\JmIKHtc.exe
  2⤵
  PID:6408
- C:\Windows\System\DRTToEH.exe
  C:\Windows\System\DRTToEH.exe
  2⤵
  PID:6424
- C:\Windows\System\kzcmSos.exe
  C:\Windows\System\kzcmSos.exe
  2⤵
  PID:6440
- C:\Windows\System\llAugQd.exe
  C:\Windows\System\llAugQd.exe
  2⤵
  PID:6456
- C:\Windows\System\oWrpLZj.exe
  C:\Windows\System\oWrpLZj.exe
  2⤵
  PID:6472
- C:\Windows\System\RMgrxZc.exe
  C:\Windows\System\RMgrxZc.exe
  2⤵
  PID:6488
- C:\Windows\System\LiwZRXV.exe
  C:\Windows\System\LiwZRXV.exe
  2⤵
  PID:6504
- C:\Windows\System\bWXMrwg.exe
  C:\Windows\System\bWXMrwg.exe
  2⤵
  PID:6520
- C:\Windows\System\KFVcZbx.exe
  C:\Windows\System\KFVcZbx.exe
  2⤵
  PID:6540
- C:\Windows\System\GuuOXKU.exe
  C:\Windows\System\GuuOXKU.exe
  2⤵
  PID:6556
- C:\Windows\System\KPuHwKo.exe
  C:\Windows\System\KPuHwKo.exe
  2⤵
  PID:6572
- C:\Windows\System\hBWAygl.exe
  C:\Windows\System\hBWAygl.exe
  2⤵
  PID:6588
- C:\Windows\System\cKINnyp.exe
  C:\Windows\System\cKINnyp.exe
  2⤵
  PID:6608
- C:\Windows\System\AgguLYb.exe
  C:\Windows\System\AgguLYb.exe
  2⤵
  PID:6624
- C:\Windows\System\tWfJbKj.exe
  C:\Windows\System\tWfJbKj.exe
  2⤵
  PID:6640
- C:\Windows\System\cYPHRRJ.exe
  C:\Windows\System\cYPHRRJ.exe
  2⤵
  PID:6656
- C:\Windows\System\xWiHHys.exe
  C:\Windows\System\xWiHHys.exe
  2⤵
  PID:6672
- C:\Windows\System\mnYPbsp.exe
  C:\Windows\System\mnYPbsp.exe
  2⤵
  PID:6688
- C:\Windows\System\VxEYJko.exe
  C:\Windows\System\VxEYJko.exe
  2⤵
  PID:6704
- C:\Windows\System\ZKTEFbg.exe
  C:\Windows\System\ZKTEFbg.exe
  2⤵
  PID:6724
- C:\Windows\System\zbqaSxA.exe
  C:\Windows\System\zbqaSxA.exe
  2⤵
  PID:6740
- C:\Windows\System\gOjxhHu.exe
  C:\Windows\System\gOjxhHu.exe
  2⤵
  PID:6756
- C:\Windows\System\BQfSxTI.exe
  C:\Windows\System\BQfSxTI.exe
  2⤵
  PID:6772
- C:\Windows\System\iFVwIYK.exe
  C:\Windows\System\iFVwIYK.exe
  2⤵
  PID:6788
- C:\Windows\System\kViCGuX.exe
  C:\Windows\System\kViCGuX.exe
  2⤵
  PID:6804
- C:\Windows\System\RbPbyeR.exe
  C:\Windows\System\RbPbyeR.exe
  2⤵
  PID:6820
- C:\Windows\System\foVZjZb.exe
  C:\Windows\System\foVZjZb.exe
  2⤵
  PID:6836
- C:\Windows\System\BHWPxGB.exe
  C:\Windows\System\BHWPxGB.exe
  2⤵
  PID:6852
- C:\Windows\System\dGJkWlQ.exe
  C:\Windows\System\dGJkWlQ.exe
  2⤵
  PID:6868
- C:\Windows\System\lwSQzWB.exe
  C:\Windows\System\lwSQzWB.exe
  2⤵
  PID:6884
- C:\Windows\System\hXSLqoL.exe
  C:\Windows\System\hXSLqoL.exe
  2⤵
  PID:6900
- C:\Windows\System\GhCkGCZ.exe
  C:\Windows\System\GhCkGCZ.exe
  2⤵
  PID:6920
- C:\Windows\System\GgwwpOy.exe
  C:\Windows\System\GgwwpOy.exe
  2⤵
  PID:6936
- C:\Windows\System\vkZzxgA.exe
  C:\Windows\System\vkZzxgA.exe
  2⤵
  PID:6952
- C:\Windows\System\XujmiNH.exe
  C:\Windows\System\XujmiNH.exe
  2⤵
  PID:6968
- C:\Windows\System\lihlBIK.exe
  C:\Windows\System\lihlBIK.exe
  2⤵
  PID:6988
- C:\Windows\System\sLxCZuF.exe
  C:\Windows\System\sLxCZuF.exe
  2⤵
  PID:7004
- C:\Windows\System\MzCmbfY.exe
  C:\Windows\System\MzCmbfY.exe
  2⤵
  PID:7020
- C:\Windows\System\sPUdznX.exe
  C:\Windows\System\sPUdznX.exe
  2⤵
  PID:7040
- C:\Windows\System\ijIlHte.exe
  C:\Windows\System\ijIlHte.exe
  2⤵
  PID:7056
- C:\Windows\System\nMNrOgf.exe
  C:\Windows\System\nMNrOgf.exe
  2⤵
  PID:7072
- C:\Windows\System\VisOLhJ.exe
  C:\Windows\System\VisOLhJ.exe
  2⤵
  PID:7088
- C:\Windows\System\RUDjxlU.exe
  C:\Windows\System\RUDjxlU.exe
  2⤵
  PID:7104
- C:\Windows\System\wXcWgoa.exe
  C:\Windows\System\wXcWgoa.exe
  2⤵
  PID:7120
- C:\Windows\System\pPrBgzS.exe
  C:\Windows\System\pPrBgzS.exe
  2⤵
  PID:7144
- C:\Windows\System\bjfFfKm.exe
  C:\Windows\System\bjfFfKm.exe
  2⤵
  PID:7160
- C:\Windows\System\KkVpRKM.exe
  C:\Windows\System\KkVpRKM.exe
  2⤵
  PID:6188
- C:\Windows\System\MsPPEKs.exe
  C:\Windows\System\MsPPEKs.exe
  2⤵
  PID:6156
- C:\Windows\System\nDNuZIb.exe
  C:\Windows\System\nDNuZIb.exe
  2⤵
  PID:6220
- C:\Windows\System\hqEDKYQ.exe
  C:\Windows\System\hqEDKYQ.exe
  2⤵
  PID:6084
- C:\Windows\System\jAmHSGQ.exe
  C:\Windows\System\jAmHSGQ.exe
  2⤵
  PID:5680
- C:\Windows\System\JcrxkAD.exe
  C:\Windows\System\JcrxkAD.exe
  2⤵
  PID:4548
- C:\Windows\System\haqDsdh.exe
  C:\Windows\System\haqDsdh.exe
  2⤵
  PID:6260
- C:\Windows\System\EGPfvHv.exe
  C:\Windows\System\EGPfvHv.exe
  2⤵
  PID:6252
- C:\Windows\System\YcspEos.exe
  C:\Windows\System\YcspEos.exe
  2⤵
  PID:1568
- C:\Windows\System\BImwzPQ.exe
  C:\Windows\System\BImwzPQ.exe
  2⤵
  PID:6388
- C:\Windows\System\wpIWdkF.exe
  C:\Windows\System\wpIWdkF.exe
  2⤵
  PID:6324
- C:\Windows\System\yasbFeZ.exe
  C:\Windows\System\yasbFeZ.exe
  2⤵
  PID:6372
- C:\Windows\System\HsnTCtM.exe
  C:\Windows\System\HsnTCtM.exe
  2⤵
  PID:6400
- C:\Windows\System\QwzbGWm.exe
  C:\Windows\System\QwzbGWm.exe
  2⤵
  PID:6436
- C:\Windows\System\wHrpzsI.exe
  C:\Windows\System\wHrpzsI.exe
  2⤵
  PID:6500
- C:\Windows\System\ZBbgZbK.exe
  C:\Windows\System\ZBbgZbK.exe
  2⤵
  PID:6448
- C:\Windows\System\FqpkYeM.exe
  C:\Windows\System\FqpkYeM.exe
  2⤵
  PID:6548
- C:\Windows\System\kLFIeNT.exe
  C:\Windows\System\kLFIeNT.exe
  2⤵
  PID:6580
- C:\Windows\System\OOssHuj.exe
  C:\Windows\System\OOssHuj.exe
  2⤵
  PID:6604
- C:\Windows\System\AmBdgQE.exe
  C:\Windows\System\AmBdgQE.exe
  2⤵
  PID:6616
- C:\Windows\System\TMDeLwF.exe
  C:\Windows\System\TMDeLwF.exe
  2⤵
  PID:6696
- C:\Windows\System\WVhPHJJ.exe
  C:\Windows\System\WVhPHJJ.exe
  2⤵
  PID:6712
- C:\Windows\System\QBpNhuS.exe
  C:\Windows\System\QBpNhuS.exe
  2⤵
  PID:6752
- C:\Windows\System\gWfTPbS.exe
  C:\Windows\System\gWfTPbS.exe
  2⤵
  PID:6816
- C:\Windows\System\BGumarB.exe
  C:\Windows\System\BGumarB.exe
  2⤵
  PID:6876
- C:\Windows\System\OgbmMgm.exe
  C:\Windows\System\OgbmMgm.exe
  2⤵
  PID:6948
- C:\Windows\System\wNGMspM.exe
  C:\Windows\System\wNGMspM.exe
  2⤵
  PID:7012
- C:\Windows\System\dkrvjEn.exe
  C:\Windows\System\dkrvjEn.exe
  2⤵
  PID:7052
- C:\Windows\System\PjtKWCO.exe
  C:\Windows\System\PjtKWCO.exe
  2⤵
  PID:6768
- C:\Windows\System\sdRrgJH.exe
  C:\Windows\System\sdRrgJH.exe
  2⤵
  PID:6800
- C:\Windows\System\QlUyLoT.exe
  C:\Windows\System\QlUyLoT.exe
  2⤵
  PID:6864
- C:\Windows\System\rRwsjFn.exe
  C:\Windows\System\rRwsjFn.exe
  2⤵
  PID:6932
- C:\Windows\System\nefOsJx.exe
  C:\Windows\System\nefOsJx.exe
  2⤵
  PID:7000
- C:\Windows\System\CRaIFee.exe
  C:\Windows\System\CRaIFee.exe
  2⤵
  PID:7064
- C:\Windows\System\fUIsBoV.exe
  C:\Windows\System\fUIsBoV.exe
  2⤵
  PID:7128
- C:\Windows\System\bZTGsrL.exe
  C:\Windows\System\bZTGsrL.exe
  2⤵
  PID:5480
- C:\Windows\System\rEDvWdL.exe
  C:\Windows\System\rEDvWdL.exe
  2⤵
  PID:4896
- C:\Windows\System\UyHFilL.exe
  C:\Windows\System\UyHFilL.exe
  2⤵
  PID:5796
- C:\Windows\System\VPXLzSz.exe
  C:\Windows\System\VPXLzSz.exe
  2⤵
  PID:6232
- C:\Windows\System\fMTlIDO.exe
  C:\Windows\System\fMTlIDO.exe
  2⤵
  PID:5844
- C:\Windows\System\OJmgePB.exe
  C:\Windows\System\OJmgePB.exe
  2⤵
  PID:6336
- C:\Windows\System\dwHSbLz.exe
  C:\Windows\System\dwHSbLz.exe
  2⤵
  PID:6292
- C:\Windows\System\jFtSAFT.exe
  C:\Windows\System\jFtSAFT.exe
  2⤵
  PID:6308
- C:\Windows\System\slgRifp.exe
  C:\Windows\System\slgRifp.exe
  2⤵
  PID:6564
- C:\Windows\System\DxMJHFo.exe
  C:\Windows\System\DxMJHFo.exe
  2⤵
  PID:6784
- C:\Windows\System\bCZaTmM.exe
  C:\Windows\System\bCZaTmM.exe
  2⤵
  PID:6700
- C:\Windows\System\oYRfpdK.exe
  C:\Windows\System\oYRfpdK.exe
  2⤵
  PID:6912
- C:\Windows\System\nrAJHQX.exe
  C:\Windows\System\nrAJHQX.exe
  2⤵
  PID:7084
- C:\Windows\System\yoKfxhF.exe
  C:\Windows\System\yoKfxhF.exe
  2⤵
  PID:6764
- C:\Windows\System\GIQXFau.exe
  C:\Windows\System\GIQXFau.exe
  2⤵
  PID:6928
- C:\Windows\System\yqeyaCU.exe
  C:\Windows\System\yqeyaCU.exe
  2⤵
  PID:7032
- C:\Windows\System\ilrBIER.exe
  C:\Windows\System\ilrBIER.exe
  2⤵
  PID:7152
- C:\Windows\System\HaQZsus.exe
  C:\Windows\System\HaQZsus.exe
  2⤵
  PID:5924
- C:\Windows\System\EHWzeCL.exe
  C:\Windows\System\EHWzeCL.exe
  2⤵
  PID:6356
- C:\Windows\System\mnDsjhK.exe
  C:\Windows\System\mnDsjhK.exe
  2⤵
  PID:6432
- C:\Windows\System\GaGoNyY.exe
  C:\Windows\System\GaGoNyY.exe
  2⤵
  PID:6172
- C:\Windows\System\WrqbWko.exe
  C:\Windows\System\WrqbWko.exe
  2⤵
  PID:6512
- C:\Windows\System\VpbnGCE.exe
  C:\Windows\System\VpbnGCE.exe
  2⤵
  PID:6748
- C:\Windows\System\pRisMbA.exe
  C:\Windows\System\pRisMbA.exe
  2⤵
  PID:6736
- C:\Windows\System\YKzygfn.exe
  C:\Windows\System\YKzygfn.exe
  2⤵
  PID:6596
- C:\Windows\System\tEfLezw.exe
  C:\Windows\System\tEfLezw.exe
  2⤵
  PID:6652
- C:\Windows\System\yVljjgA.exe
  C:\Windows\System\yVljjgA.exe
  2⤵
  PID:6568
- C:\Windows\System\pFVllOU.exe
  C:\Windows\System\pFVllOU.exe
  2⤵
  PID:6796
- C:\Windows\System\iXfbgWG.exe
  C:\Windows\System\iXfbgWG.exe
  2⤵
  PID:6680
- C:\Windows\System\kGWUqDk.exe
  C:\Windows\System\kGWUqDk.exe
  2⤵
  PID:6980
- C:\Windows\System\dyDSHFv.exe
  C:\Windows\System\dyDSHFv.exe
  2⤵
  PID:6200
- C:\Windows\System\QUBNXVv.exe
  C:\Windows\System\QUBNXVv.exe
  2⤵
  PID:6288
- C:\Windows\System\InjiFkv.exe
  C:\Windows\System\InjiFkv.exe
  2⤵
  PID:6384
- C:\Windows\System\WrUxssK.exe
  C:\Windows\System\WrUxssK.exe
  2⤵
  PID:7176
- C:\Windows\System\hkHarQn.exe
  C:\Windows\System\hkHarQn.exe
  2⤵
  PID:7192
- C:\Windows\System\JfcmZEh.exe
  C:\Windows\System\JfcmZEh.exe
  2⤵
  PID:7208
- C:\Windows\System\WdIpNId.exe
  C:\Windows\System\WdIpNId.exe
  2⤵
  PID:7236
- C:\Windows\System\CRXwHpf.exe
  C:\Windows\System\CRXwHpf.exe
  2⤵
  PID:7304
- C:\Windows\System\gOvaDbR.exe
  C:\Windows\System\gOvaDbR.exe
  2⤵
  PID:7320
- C:\Windows\System\kwHehhV.exe
  C:\Windows\System\kwHehhV.exe
  2⤵
  PID:7336
- C:\Windows\System\DSDslec.exe
  C:\Windows\System\DSDslec.exe
  2⤵
  PID:7352
- C:\Windows\System\gmStJrU.exe
  C:\Windows\System\gmStJrU.exe
  2⤵
  PID:7368
- C:\Windows\System\FOcJIRc.exe
  C:\Windows\System\FOcJIRc.exe
  2⤵
  PID:7384
- C:\Windows\System\IwycMru.exe
  C:\Windows\System\IwycMru.exe
  2⤵
  PID:7404
- C:\Windows\System\PHzpmln.exe
  C:\Windows\System\PHzpmln.exe
  2⤵
  PID:7420
- C:\Windows\System\lhuDwiV.exe
  C:\Windows\System\lhuDwiV.exe
  2⤵
  PID:7436
- C:\Windows\System\vTngYgW.exe
  C:\Windows\System\vTngYgW.exe
  2⤵
  PID:7452
- C:\Windows\System\GjUZBpb.exe
  C:\Windows\System\GjUZBpb.exe
  2⤵
  PID:7472
- C:\Windows\System\YiXglRG.exe
  C:\Windows\System\YiXglRG.exe
  2⤵
  PID:7488
- C:\Windows\System\TDvhClS.exe
  C:\Windows\System\TDvhClS.exe
  2⤵
  PID:7512
- C:\Windows\System\WKhWajj.exe
  C:\Windows\System\WKhWajj.exe
  2⤵
  PID:7528
- C:\Windows\System\lecLCvg.exe
  C:\Windows\System\lecLCvg.exe
  2⤵
  PID:7544
- C:\Windows\System\UHjegdk.exe
  C:\Windows\System\UHjegdk.exe
  2⤵
  PID:7564
- C:\Windows\System\IinVvGC.exe
  C:\Windows\System\IinVvGC.exe
  2⤵
  PID:7580
- C:\Windows\System\MlYnYdv.exe
  C:\Windows\System\MlYnYdv.exe
  2⤵
  PID:7600
- C:\Windows\System\zCPCcdy.exe
  C:\Windows\System\zCPCcdy.exe
  2⤵
  PID:7616
- C:\Windows\System\XCAfFZc.exe
  C:\Windows\System\XCAfFZc.exe
  2⤵
  PID:7632
- C:\Windows\System\pcBwumP.exe
  C:\Windows\System\pcBwumP.exe
  2⤵
  PID:7652
- C:\Windows\System\ylkHvJj.exe
  C:\Windows\System\ylkHvJj.exe
  2⤵
  PID:7668
- C:\Windows\System\RKlJuzw.exe
  C:\Windows\System\RKlJuzw.exe
  2⤵
  PID:7684
- C:\Windows\System\CczCqOT.exe
  C:\Windows\System\CczCqOT.exe
  2⤵
  PID:7704
- C:\Windows\System\QbXjhqV.exe
  C:\Windows\System\QbXjhqV.exe
  2⤵
  PID:7720
- C:\Windows\System\BoWkDjb.exe
  C:\Windows\System\BoWkDjb.exe
  2⤵
  PID:7736
- C:\Windows\System\zzqywjA.exe
  C:\Windows\System\zzqywjA.exe
  2⤵
  PID:7756
- C:\Windows\System\jOOjBUu.exe
  C:\Windows\System\jOOjBUu.exe
  2⤵
  PID:7772
- C:\Windows\System\biQxOeo.exe
  C:\Windows\System\biQxOeo.exe
  2⤵
  PID:7788
- C:\Windows\System\JSrDnZo.exe
  C:\Windows\System\JSrDnZo.exe
  2⤵
  PID:7820
- C:\Windows\System\QOtcKbF.exe
  C:\Windows\System\QOtcKbF.exe
  2⤵
  PID:7836
- C:\Windows\System\rshMaTy.exe
  C:\Windows\System\rshMaTy.exe
  2⤵
  PID:7856
- C:\Windows\System\GuMcEmA.exe
  C:\Windows\System\GuMcEmA.exe
  2⤵
  PID:7872
- C:\Windows\System\ltDMVKb.exe
  C:\Windows\System\ltDMVKb.exe
  2⤵
  PID:7888
- C:\Windows\System\gMpnWrD.exe
  C:\Windows\System\gMpnWrD.exe
  2⤵
  PID:7904
- C:\Windows\System\ovkRKiq.exe
  C:\Windows\System\ovkRKiq.exe
  2⤵
  PID:7924
- C:\Windows\System\jETtihy.exe
  C:\Windows\System\jETtihy.exe
  2⤵
  PID:7940
- C:\Windows\System\bOUKNgB.exe
  C:\Windows\System\bOUKNgB.exe
  2⤵
  PID:7956
- C:\Windows\System\sEDJggk.exe
  C:\Windows\System\sEDJggk.exe
  2⤵
  PID:7972
- C:\Windows\System\pQedZWY.exe
  C:\Windows\System\pQedZWY.exe
  2⤵
  PID:7988
- C:\Windows\System\mJxNFpB.exe
  C:\Windows\System\mJxNFpB.exe
  2⤵
  PID:8008
- C:\Windows\System\QBjwijb.exe
  C:\Windows\System\QBjwijb.exe
  2⤵
  PID:8024
- C:\Windows\System\NpDYksn.exe
  C:\Windows\System\NpDYksn.exe
  2⤵
  PID:8040
- C:\Windows\System\zFsBrfo.exe
  C:\Windows\System\zFsBrfo.exe
  2⤵
  PID:8060
- C:\Windows\System\TUXEFWd.exe
  C:\Windows\System\TUXEFWd.exe
  2⤵
  PID:8076
- C:\Windows\System\ZPzWXOZ.exe
  C:\Windows\System\ZPzWXOZ.exe
  2⤵
  PID:8092
- C:\Windows\System\NtbgjAa.exe
  C:\Windows\System\NtbgjAa.exe
  2⤵
  PID:8112
- C:\Windows\System\MsXpxyD.exe
  C:\Windows\System\MsXpxyD.exe
  2⤵
  PID:8128
- C:\Windows\System\bbjaOUf.exe
  C:\Windows\System\bbjaOUf.exe
  2⤵
  PID:8148
- C:\Windows\System\oETbXqd.exe
  C:\Windows\System\oETbXqd.exe
  2⤵
  PID:8164
- C:\Windows\System\GhybyQq.exe
  C:\Windows\System\GhybyQq.exe
  2⤵
  PID:8180
- C:\Windows\System\aGRomij.exe
  C:\Windows\System\aGRomij.exe
  2⤵
  PID:6996
- C:\Windows\System\pbgDtFn.exe
  C:\Windows\System\pbgDtFn.exe
  2⤵
  PID:7184
- C:\Windows\System\HHOuSrD.exe
  C:\Windows\System\HHOuSrD.exe
  2⤵
  PID:7228
- C:\Windows\System\aJRQVsx.exe
  C:\Windows\System\aJRQVsx.exe
  2⤵
  PID:6908
- C:\Windows\System\KIEgQDi.exe
  C:\Windows\System\KIEgQDi.exe
  2⤵
  PID:6984
- C:\Windows\System\slMYzHP.exe
  C:\Windows\System\slMYzHP.exe
  2⤵
  PID:7244
- C:\Windows\System\DXYzxXC.exe
  C:\Windows\System\DXYzxXC.exe
  2⤵
  PID:7264
- C:\Windows\System\IgNCCbh.exe
  C:\Windows\System\IgNCCbh.exe
  2⤵
  PID:7288
- C:\Windows\System\RphXMOb.exe
  C:\Windows\System\RphXMOb.exe
  2⤵
  PID:7344
- C:\Windows\System\drvLRtT.exe
  C:\Windows\System\drvLRtT.exe
  2⤵
  PID:7412
- C:\Windows\System\cLbsPxV.exe
  C:\Windows\System\cLbsPxV.exe
  2⤵
  PID:7480
- C:\Windows\System\nDLgnvq.exe
  C:\Windows\System\nDLgnvq.exe
  2⤵
  PID:7552
- C:\Windows\System\ECulSOb.exe
  C:\Windows\System\ECulSOb.exe
  2⤵
  PID:7592
- C:\Windows\System\PqJhHsC.exe
  C:\Windows\System\PqJhHsC.exe
  2⤵
  PID:6664
- C:\Windows\System\gGeviuN.exe
  C:\Windows\System\gGeviuN.exe
  2⤵
  PID:7696
- C:\Windows\System\DouUJnC.exe
  C:\Windows\System\DouUJnC.exe
  2⤵
  PID:7728
- C:\Windows\System\TitVekc.exe
  C:\Windows\System\TitVekc.exe
  2⤵
  PID:7300
- C:\Windows\System\jjnOzpj.exe
  C:\Windows\System\jjnOzpj.exe
  2⤵
  PID:7468
- C:\Windows\System\Mkhgqqz.exe
  C:\Windows\System\Mkhgqqz.exe
  2⤵
  PID:7396
- C:\Windows\System\ILieQng.exe
  C:\Windows\System\ILieQng.exe
  2⤵
  PID:7460
- C:\Windows\System\OfBMqyQ.exe
  C:\Windows\System\OfBMqyQ.exe
  2⤵
  PID:7504
- C:\Windows\System\IEbnctw.exe
  C:\Windows\System\IEbnctw.exe
  2⤵
  PID:7572
- C:\Windows\System\rRkXQng.exe
  C:\Windows\System\rRkXQng.exe
  2⤵
  PID:7640
- C:\Windows\System\EsrifDR.exe
  C:\Windows\System\EsrifDR.exe
  2⤵
  PID:7680
- C:\Windows\System\fKoALNR.exe
  C:\Windows\System\fKoALNR.exe
  2⤵
  PID:7780
- C:\Windows\System\YhQvlRS.exe
  C:\Windows\System\YhQvlRS.exe
  2⤵
  PID:7808
- C:\Windows\System\tXKhqFu.exe
  C:\Windows\System\tXKhqFu.exe
  2⤵
  PID:7848
- C:\Windows\System\bJAVKUy.exe
  C:\Windows\System\bJAVKUy.exe
  2⤵
  PID:7884
- C:\Windows\System\JGBAgay.exe
  C:\Windows\System\JGBAgay.exe
  2⤵
  PID:8100
- C:\Windows\System\HetJajB.exe
  C:\Windows\System\HetJajB.exe
  2⤵
  PID:8104
- C:\Windows\System\ILfbnxg.exe
  C:\Windows\System\ILfbnxg.exe
  2⤵
  PID:8176
- C:\Windows\System\OKrJJrx.exe
  C:\Windows\System\OKrJJrx.exe
  2⤵
  PID:8136
- C:\Windows\System\kMwHbMT.exe
  C:\Windows\System\kMwHbMT.exe
  2⤵
  PID:8160
- C:\Windows\System\ggUhkSp.exe
  C:\Windows\System\ggUhkSp.exe
  2⤵
  PID:8172
- C:\Windows\System\CZPMTal.exe
  C:\Windows\System\CZPMTal.exe
  2⤵
  PID:7312
- C:\Windows\System\qKgobCl.exe
  C:\Windows\System\qKgobCl.exe
  2⤵
  PID:7448
- C:\Windows\System\aRbqLDz.exe
  C:\Windows\System\aRbqLDz.exe
  2⤵
  PID:7520
- C:\Windows\System\ggpmGQW.exe
  C:\Windows\System\ggpmGQW.exe
  2⤵
  PID:7692
- C:\Windows\System\NqEvkrv.exe
  C:\Windows\System\NqEvkrv.exe
  2⤵
  PID:7284
- C:\Windows\System\qhrNTxM.exe
  C:\Windows\System\qhrNTxM.exe
  2⤵
  PID:7296
- C:\Windows\System\tPQEfDj.exe
  C:\Windows\System\tPQEfDj.exe
  2⤵
  PID:7500
- C:\Windows\System\qKuqkou.exe
  C:\Windows\System\qKuqkou.exe
  2⤵
  PID:7612
- C:\Windows\System\JNCClYH.exe
  C:\Windows\System\JNCClYH.exe
  2⤵
  PID:7748
- C:\Windows\System\syRUgIj.exe
  C:\Windows\System\syRUgIj.exe
  2⤵
  PID:7916
- C:\Windows\System\cPsKGmx.exe
  C:\Windows\System\cPsKGmx.exe
  2⤵
  PID:7524
- C:\Windows\System\MTGdqaZ.exe
  C:\Windows\System\MTGdqaZ.exe
  2⤵
  PID:7328
- C:\Windows\System\qYEJdiz.exe
  C:\Windows\System\qYEJdiz.exe
  2⤵
  PID:7536
- C:\Windows\System\AvgxAWG.exe
  C:\Windows\System\AvgxAWG.exe
  2⤵
  PID:7828
- C:\Windows\System\QdsdLPR.exe
  C:\Windows\System\QdsdLPR.exe
  2⤵
  PID:7984
- C:\Windows\System\oVtkjdr.exe
  C:\Windows\System\oVtkjdr.exe
  2⤵
  PID:7900
- C:\Windows\System\qWvXUIv.exe
  C:\Windows\System\qWvXUIv.exe
  2⤵
  PID:8048
- C:\Windows\System\QeeHNcK.exe
  C:\Windows\System\QeeHNcK.exe
  2⤵
  PID:8088
- C:\Windows\System\IUzdOfI.exe
  C:\Windows\System\IUzdOfI.exe
  2⤵
  PID:8032
- C:\Windows\System\cWosWeu.exe
  C:\Windows\System\cWosWeu.exe
  2⤵
  PID:8140
- C:\Windows\System\pUJZuQP.exe
  C:\Windows\System\pUJZuQP.exe
  2⤵
  PID:7588
- C:\Windows\System\LQMYKoI.exe
  C:\Windows\System\LQMYKoI.exe
  2⤵
  PID:7496
- C:\Windows\System\jdRmrnl.exe
  C:\Windows\System\jdRmrnl.exe
  2⤵
  PID:7864
- C:\Windows\System\UdXChuF.exe
  C:\Windows\System\UdXChuF.exe
  2⤵
  PID:7732
- C:\Windows\System\ZAvCdoO.exe
  C:\Windows\System\ZAvCdoO.exe
  2⤵
  PID:6276
- C:\Windows\System\xhYouTG.exe
  C:\Windows\System\xhYouTG.exe
  2⤵
  PID:7116
- C:\Windows\System\PwmJUuP.exe
  C:\Windows\System\PwmJUuP.exe
  2⤵
  PID:7380
- C:\Windows\System\TPoiuen.exe
  C:\Windows\System\TPoiuen.exe
  2⤵
  PID:7816
- C:\Windows\System\TiRLjbO.exe
  C:\Windows\System\TiRLjbO.exe
  2⤵
  PID:8016
- C:\Windows\System\uCOChHq.exe
  C:\Windows\System\uCOChHq.exe
  2⤵
  PID:7392
- C:\Windows\System\OOLvkgE.exe
  C:\Windows\System\OOLvkgE.exe
  2⤵
  PID:6452
- C:\Windows\System\mkLZrHX.exe
  C:\Windows\System\mkLZrHX.exe
  2⤵
  PID:8052
- C:\Windows\System\WlixWXH.exe
  C:\Windows\System\WlixWXH.exe
  2⤵
  PID:8068
- C:\Windows\System\YobGYbF.exe
  C:\Windows\System\YobGYbF.exe
  2⤵
  PID:8120
- C:\Windows\System\uYPUjgx.exe
  C:\Windows\System\uYPUjgx.exe
  2⤵
  PID:7880
- C:\Windows\System\vEQxRpH.exe
  C:\Windows\System\vEQxRpH.exe
  2⤵
  PID:7648
- C:\Windows\System\sZGIeSg.exe
  C:\Windows\System\sZGIeSg.exe
  2⤵
  PID:7100
- C:\Windows\System\axEUOkI.exe
  C:\Windows\System\axEUOkI.exe
  2⤵
  PID:7628
- C:\Windows\System\YSPCUXh.exe
  C:\Windows\System\YSPCUXh.exe
  2⤵
  PID:7432
- C:\Windows\System\GmEcZWY.exe
  C:\Windows\System\GmEcZWY.exe
  2⤵
  PID:8208
- C:\Windows\System\WjSTTNV.exe
  C:\Windows\System\WjSTTNV.exe
  2⤵
  PID:8224
- C:\Windows\System\hkgKNGt.exe
  C:\Windows\System\hkgKNGt.exe
  2⤵
  PID:8284
- C:\Windows\System\HKXpuUE.exe
  C:\Windows\System\HKXpuUE.exe
  2⤵
  PID:8300
- C:\Windows\System\zrjeoKQ.exe
  C:\Windows\System\zrjeoKQ.exe
  2⤵
  PID:8316
- C:\Windows\System\JkyoMeh.exe
  C:\Windows\System\JkyoMeh.exe
  2⤵
  PID:8336
- C:\Windows\System\wzpbiYh.exe
  C:\Windows\System\wzpbiYh.exe
  2⤵
  PID:8392
- C:\Windows\System\mebsXUe.exe
  C:\Windows\System\mebsXUe.exe
  2⤵
  PID:8408
- C:\Windows\System\yNZuUTu.exe
  C:\Windows\System\yNZuUTu.exe
  2⤵
  PID:8424
- C:\Windows\System\rqlbFBU.exe
  C:\Windows\System\rqlbFBU.exe
  2⤵
  PID:8440
- C:\Windows\System\tYwTHjO.exe
  C:\Windows\System\tYwTHjO.exe
  2⤵
  PID:8456
- C:\Windows\System\hiwHYJo.exe
  C:\Windows\System\hiwHYJo.exe
  2⤵
  PID:8472
- C:\Windows\System\uPsFlhg.exe
  C:\Windows\System\uPsFlhg.exe
  2⤵
  PID:8488
- C:\Windows\System\PlGOriC.exe
  C:\Windows\System\PlGOriC.exe
  2⤵
  PID:8504
- C:\Windows\System\pxWgqSA.exe
  C:\Windows\System\pxWgqSA.exe
  2⤵
  PID:8520
- C:\Windows\System\orZiZaL.exe
  C:\Windows\System\orZiZaL.exe
  2⤵
  PID:8536
- C:\Windows\System\RMIZGdm.exe
  C:\Windows\System\RMIZGdm.exe
  2⤵
  PID:8552
- C:\Windows\System\iYaiGIH.exe
  C:\Windows\System\iYaiGIH.exe
  2⤵
  PID:8572
- C:\Windows\System\NKevkaE.exe
  C:\Windows\System\NKevkaE.exe
  2⤵
  PID:8588
- C:\Windows\System\iHdeqYP.exe
  C:\Windows\System\iHdeqYP.exe
  2⤵
  PID:8608
- C:\Windows\System\kedmQiS.exe
  C:\Windows\System\kedmQiS.exe
  2⤵
  PID:8628
- C:\Windows\System\gwjOICR.exe
  C:\Windows\System\gwjOICR.exe
  2⤵
  PID:8644
- C:\Windows\System\TLjtOAV.exe
  C:\Windows\System\TLjtOAV.exe
  2⤵
  PID:8740
- C:\Windows\System\fqbABcT.exe
  C:\Windows\System\fqbABcT.exe
  2⤵
  PID:8760
- C:\Windows\System\vqLxFqx.exe
  C:\Windows\System\vqLxFqx.exe
  2⤵
  PID:8776
- C:\Windows\System\FJFqPmZ.exe
  C:\Windows\System\FJFqPmZ.exe
  2⤵
  PID:8792
- C:\Windows\System\wsxGgNu.exe
  C:\Windows\System\wsxGgNu.exe
  2⤵
  PID:8808
- C:\Windows\System\WwUivsO.exe
  C:\Windows\System\WwUivsO.exe
  2⤵
  PID:8824
- C:\Windows\System\CBMucdp.exe
  C:\Windows\System\CBMucdp.exe
  2⤵
  PID:8840
- C:\Windows\System\lefhkkv.exe
  C:\Windows\System\lefhkkv.exe
  2⤵
  PID:8856
- C:\Windows\System\IMIyzte.exe
  C:\Windows\System\IMIyzte.exe
  2⤵
  PID:8872
- C:\Windows\System\CpCzlgG.exe
  C:\Windows\System\CpCzlgG.exe
  2⤵
  PID:8888
- C:\Windows\System\jcuroFz.exe
  C:\Windows\System\jcuroFz.exe
  2⤵
  PID:8904
- C:\Windows\System\YlNGYBL.exe
  C:\Windows\System\YlNGYBL.exe
  2⤵
  PID:8924
- C:\Windows\System\IVjLtep.exe
  C:\Windows\System\IVjLtep.exe
  2⤵
  PID:8940
- C:\Windows\System\hrRrhqQ.exe
  C:\Windows\System\hrRrhqQ.exe
  2⤵
  PID:8956
- C:\Windows\System\QMgUhEv.exe
  C:\Windows\System\QMgUhEv.exe
  2⤵
  PID:8972
- C:\Windows\System\XdfYQqy.exe
  C:\Windows\System\XdfYQqy.exe
  2⤵
  PID:8988
- C:\Windows\System\vPnNosu.exe
  C:\Windows\System\vPnNosu.exe
  2⤵
  PID:9004
- C:\Windows\System\yjEXVmO.exe
  C:\Windows\System\yjEXVmO.exe
  2⤵
  PID:9020
- C:\Windows\System\lBAOCJA.exe
  C:\Windows\System\lBAOCJA.exe
  2⤵
  PID:9036
- C:\Windows\System\DjhBHaz.exe
  C:\Windows\System\DjhBHaz.exe
  2⤵
  PID:9052
- C:\Windows\System\BSbThcH.exe
  C:\Windows\System\BSbThcH.exe
  2⤵
  PID:9068
- C:\Windows\System\gZZfpeU.exe
  C:\Windows\System\gZZfpeU.exe
  2⤵
  PID:9084
- C:\Windows\System\RDaILpS.exe
  C:\Windows\System\RDaILpS.exe
  2⤵
  PID:9100
- C:\Windows\System\kxDRNVW.exe
  C:\Windows\System\kxDRNVW.exe
  2⤵
  PID:9116
- C:\Windows\System\rKFFlHK.exe
  C:\Windows\System\rKFFlHK.exe
  2⤵
  PID:9132
- C:\Windows\System\OaOUouz.exe
  C:\Windows\System\OaOUouz.exe
  2⤵
  PID:9148
- C:\Windows\System\qHJzTXZ.exe
  C:\Windows\System\qHJzTXZ.exe
  2⤵
  PID:9164
- C:\Windows\System\nlaUgkz.exe
  C:\Windows\System\nlaUgkz.exe
  2⤵
  PID:9180
- C:\Windows\System\anzuzrt.exe
  C:\Windows\System\anzuzrt.exe
  2⤵
  PID:9196
- C:\Windows\System\yiOMtlV.exe
  C:\Windows\System\yiOMtlV.exe
  2⤵
  PID:9212
- C:\Windows\System\OXFMcys.exe
  C:\Windows\System\OXFMcys.exe
  2⤵
  PID:7932
- C:\Windows\System\oeIBOzK.exe
  C:\Windows\System\oeIBOzK.exe
  2⤵
  PID:8204
- C:\Windows\System\sWCHAxX.exe
  C:\Windows\System\sWCHAxX.exe
  2⤵
  PID:7852
- C:\Windows\System\RvhnvQX.exe
  C:\Windows\System\RvhnvQX.exe
  2⤵
  PID:8236
- C:\Windows\System\jvoDXuB.exe
  C:\Windows\System\jvoDXuB.exe
  2⤵
  PID:8252
- C:\Windows\System\cPWqfay.exe
  C:\Windows\System\cPWqfay.exe
  2⤵
  PID:8268
- C:\Windows\System\KFOHCuW.exe
  C:\Windows\System\KFOHCuW.exe
  2⤵
  PID:8296
- C:\Windows\System\LajDAZw.exe
  C:\Windows\System\LajDAZw.exe
  2⤵
  PID:8292
- C:\Windows\System\EDpMIRY.exe
  C:\Windows\System\EDpMIRY.exe
  2⤵
  PID:8348
- C:\Windows\System\jmnkZNh.exe
  C:\Windows\System\jmnkZNh.exe
  2⤵
  PID:8364
- C:\Windows\System\reTfSrF.exe
  C:\Windows\System\reTfSrF.exe
  2⤵
  PID:8380
- C:\Windows\System\zgBtdhs.exe
  C:\Windows\System\zgBtdhs.exe
  2⤵
  PID:8404
- C:\Windows\System\evfobQl.exe
  C:\Windows\System\evfobQl.exe
  2⤵
  PID:8468
- C:\Windows\System\ybAAIHi.exe
  C:\Windows\System\ybAAIHi.exe
  2⤵
  PID:8480
- C:\Windows\System\jsiuhOV.exe
  C:\Windows\System\jsiuhOV.exe
  2⤵
  PID:8416
- C:\Windows\System\rXRwUKx.exe
  C:\Windows\System\rXRwUKx.exe
  2⤵
  PID:8544
- C:\Windows\System\BBFNthT.exe
  C:\Windows\System\BBFNthT.exe
  2⤵
  PID:8616
- C:\Windows\System\jMnPEdI.exe
  C:\Windows\System\jMnPEdI.exe
  2⤵
  PID:8656
- C:\Windows\System\sbMPADS.exe
  C:\Windows\System\sbMPADS.exe
  2⤵
  PID:8672
- C:\Windows\System\DbMZpaF.exe
  C:\Windows\System\DbMZpaF.exe
  2⤵
  PID:8528
- C:\Windows\System\lZFqHuF.exe
  C:\Windows\System\lZFqHuF.exe
  2⤵
  PID:8636
- C:\Windows\System\jApMZfX.exe
  C:\Windows\System\jApMZfX.exe
  2⤵
  PID:8684
- C:\Windows\System\mAcXQrb.exe
  C:\Windows\System\mAcXQrb.exe
  2⤵
  PID:8700
- C:\Windows\System\FyhNRXE.exe
  C:\Windows\System\FyhNRXE.exe
  2⤵
  PID:8716
- C:\Windows\System\yCwvPne.exe
  C:\Windows\System\yCwvPne.exe
  2⤵
  PID:8732
- C:\Windows\System\EfVnVpM.exe
  C:\Windows\System\EfVnVpM.exe
  2⤵
  PID:8772
- C:\Windows\System\phpvJna.exe
  C:\Windows\System\phpvJna.exe
  2⤵
  PID:8836
- C:\Windows\System\AbuwcyR.exe
  C:\Windows\System\AbuwcyR.exe
  2⤵
  PID:8852
- C:\Windows\System\beNJlaC.exe
  C:\Windows\System\beNJlaC.exe
  2⤵
  PID:8784
- C:\Windows\System\WIZIzpC.exe
  C:\Windows\System\WIZIzpC.exe
  2⤵
  PID:8820
- C:\Windows\System\YhmPAry.exe
  C:\Windows\System\YhmPAry.exe
  2⤵
  PID:8932
- C:\Windows\System\cmOWfOv.exe
  C:\Windows\System\cmOWfOv.exe
  2⤵
  PID:8996
- C:\Windows\System\MHiYwXJ.exe
  C:\Windows\System\MHiYwXJ.exe
  2⤵
  PID:9032
- C:\Windows\System\UvyoIvh.exe
  C:\Windows\System\UvyoIvh.exe
  2⤵
  PID:9096
- C:\Windows\System\iwWHHGD.exe
  C:\Windows\System\iwWHHGD.exe
  2⤵
  PID:9160
- C:\Windows\System\FlDqYLd.exe
  C:\Windows\System\FlDqYLd.exe
  2⤵
  PID:8952
- C:\Windows\System\bSRAVeq.exe
  C:\Windows\System\bSRAVeq.exe
  2⤵
  PID:9012
- C:\Windows\System\OhbtIYe.exe
  C:\Windows\System\OhbtIYe.exe
  2⤵
  PID:7224
- C:\Windows\System\XnHTeki.exe
  C:\Windows\System\XnHTeki.exe
  2⤵
  PID:8240
- C:\Windows\System\UJUUtZB.exe
  C:\Windows\System\UJUUtZB.exe
  2⤵
  PID:8312
- C:\Windows\System\ryKrvsJ.exe
  C:\Windows\System\ryKrvsJ.exe
  2⤵
  PID:8436
- C:\Windows\System\ynYvHBC.exe
  C:\Windows\System\ynYvHBC.exe
  2⤵
  PID:9112
- C:\Windows\System\UblgHfS.exe
  C:\Windows\System\UblgHfS.exe
  2⤵
  PID:8668
- C:\Windows\System\uaYPoEe.exe
  C:\Windows\System\uaYPoEe.exe
  2⤵
  PID:9144
- C:\Windows\System\MwHCQXM.exe
  C:\Windows\System\MwHCQXM.exe
  2⤵
  PID:9208
- C:\Windows\System\iRALDvx.exe
  C:\Windows\System\iRALDvx.exe
  2⤵
  PID:8724
- C:\Windows\System\FKStcbm.exe
  C:\Windows\System\FKStcbm.exe
  2⤵
  PID:9044
- C:\Windows\System\TuInbKm.exe
  C:\Windows\System\TuInbKm.exe
  2⤵
  PID:8356
- C:\Windows\System\ANZPdlr.exe
  C:\Windows\System\ANZPdlr.exe
  2⤵
  PID:8832
- C:\Windows\System\xMPfaVW.exe
  C:\Windows\System\xMPfaVW.exe
  2⤵
  PID:8900
- C:\Windows\System\gnVxHUD.exe
  C:\Windows\System\gnVxHUD.exe
  2⤵
  PID:9128
- C:\Windows\System\DibyMYo.exe
  C:\Windows\System\DibyMYo.exe
  2⤵
  PID:8376
- C:\Windows\System\vylzBhA.exe
  C:\Windows\System\vylzBhA.exe
  2⤵
  PID:9176
- C:\Windows\System\jfOtLDc.exe
  C:\Windows\System\jfOtLDc.exe
  2⤵
  PID:8736
- C:\Windows\System\TEqLUJo.exe
  C:\Windows\System\TEqLUJo.exe
  2⤵
  PID:8512
- C:\Windows\System\glZljwo.exe
  C:\Windows\System\glZljwo.exe
  2⤵
  PID:8708
- C:\Windows\System\AExVlbS.exe
  C:\Windows\System\AExVlbS.exe
  2⤵
  PID:8624
- C:\Windows\System\vcAQCOq.exe
  C:\Windows\System\vcAQCOq.exe
  2⤵
  PID:8848
- C:\Windows\System\uBSzxXq.exe
  C:\Windows\System\uBSzxXq.exe
  2⤵
  PID:8968
- C:\Windows\System\DbzTtLi.exe
  C:\Windows\System\DbzTtLi.exe
  2⤵
  PID:8948
- C:\Windows\System\oAxzAnR.exe
  C:\Windows\System\oAxzAnR.exe
  2⤵
  PID:8276
- C:\Windows\System\hGSazaj.exe
  C:\Windows\System\hGSazaj.exe
  2⤵
  PID:9140
- C:\Windows\System\rLDgbCd.exe
  C:\Windows\System\rLDgbCd.exe
  2⤵
  PID:8324
- C:\Windows\System\imoyKlI.exe
  C:\Windows\System\imoyKlI.exe
  2⤵
  PID:8804
- C:\Windows\System\bYJmBQM.exe
  C:\Windows\System\bYJmBQM.exe
  2⤵
  PID:8584
- C:\Windows\System\BoVrLUK.exe
  C:\Windows\System\BoVrLUK.exe
  2⤵
  PID:9220
- C:\Windows\System\BPRxEIK.exe
  C:\Windows\System\BPRxEIK.exe
  2⤵
  PID:9240
- C:\Windows\System\GfuYqGY.exe
  C:\Windows\System\GfuYqGY.exe
  2⤵
  PID:9256
- C:\Windows\System\uQWwios.exe
  C:\Windows\System\uQWwios.exe
  2⤵
  PID:9272
- C:\Windows\System\xyqMMLt.exe
  C:\Windows\System\xyqMMLt.exe
  2⤵
  PID:9288
- C:\Windows\System\NbbYWKS.exe
  C:\Windows\System\NbbYWKS.exe
  2⤵
  PID:9312
- C:\Windows\System\YiRNIjf.exe
  C:\Windows\System\YiRNIjf.exe
  2⤵
  PID:9328
- C:\Windows\System\VOxTjjL.exe
  C:\Windows\System\VOxTjjL.exe
  2⤵
  PID:9344
- C:\Windows\System\mxtTToy.exe
  C:\Windows\System\mxtTToy.exe
  2⤵
  PID:9360
- C:\Windows\System\vXxXzcX.exe
  C:\Windows\System\vXxXzcX.exe
  2⤵
  PID:9376
- C:\Windows\System\sFiJalh.exe
  C:\Windows\System\sFiJalh.exe
  2⤵
  PID:9392
- C:\Windows\System\wCHLXNq.exe
  C:\Windows\System\wCHLXNq.exe
  2⤵
  PID:9408
- C:\Windows\System\ZjjaKfR.exe
  C:\Windows\System\ZjjaKfR.exe
  2⤵
  PID:9428
- C:\Windows\System\eGiOQBA.exe
  C:\Windows\System\eGiOQBA.exe
  2⤵
  PID:9444
- C:\Windows\System\DDQOxkF.exe
  C:\Windows\System\DDQOxkF.exe
  2⤵
  PID:9468
- C:\Windows\System\FmiBLzw.exe
  C:\Windows\System\FmiBLzw.exe
  2⤵
  PID:9488
- C:\Windows\System\ROjqHtH.exe
  C:\Windows\System\ROjqHtH.exe
  2⤵
  PID:9512
- C:\Windows\System\WbOYaUx.exe
  C:\Windows\System\WbOYaUx.exe
  2⤵
  PID:9536
- C:\Windows\System\vrpaMzn.exe
  C:\Windows\System\vrpaMzn.exe
  2⤵
  PID:9552
- C:\Windows\System\uMXIMIH.exe
  C:\Windows\System\uMXIMIH.exe
  2⤵
  PID:9572
- C:\Windows\System\bWUGlSD.exe
  C:\Windows\System\bWUGlSD.exe
  2⤵
  PID:9588
- C:\Windows\System\MdtuwMQ.exe
  C:\Windows\System\MdtuwMQ.exe
  2⤵
  PID:9604
- C:\Windows\System\mdsKkVs.exe
  C:\Windows\System\mdsKkVs.exe
  2⤵
  PID:9620
- C:\Windows\System\xJcbFEe.exe
  C:\Windows\System\xJcbFEe.exe
  2⤵
  PID:9636
- C:\Windows\System\xgXUiAt.exe
  C:\Windows\System\xgXUiAt.exe
  2⤵
  PID:9652
- C:\Windows\System\DSkEJnN.exe
  C:\Windows\System\DSkEJnN.exe
  2⤵
  PID:9676
- C:\Windows\System\DcGUHkC.exe
  C:\Windows\System\DcGUHkC.exe
  2⤵
  PID:9692
- C:\Windows\System\qpvxEvy.exe
  C:\Windows\System\qpvxEvy.exe
  2⤵
  PID:9708
- C:\Windows\System\cWYLNYy.exe
  C:\Windows\System\cWYLNYy.exe
  2⤵
  PID:9724
- C:\Windows\System\LizOgYH.exe
  C:\Windows\System\LizOgYH.exe
  2⤵
  PID:9740
- C:\Windows\System\KXFyawk.exe
  C:\Windows\System\KXFyawk.exe
  2⤵
  PID:9760
- C:\Windows\System\OXWnguZ.exe
  C:\Windows\System\OXWnguZ.exe
  2⤵
  PID:9776
- C:\Windows\System\tEpVGHF.exe
  C:\Windows\System\tEpVGHF.exe
  2⤵
  PID:9792
- C:\Windows\System\QMtFSTH.exe
  C:\Windows\System\QMtFSTH.exe
  2⤵
  PID:9872
- C:\Windows\System\KbeiQwM.exe
  C:\Windows\System\KbeiQwM.exe
  2⤵
  PID:9896
- C:\Windows\System\LQoWXfS.exe
  C:\Windows\System\LQoWXfS.exe
  2⤵
  PID:9912
- C:\Windows\System\uJIFuok.exe
  C:\Windows\System\uJIFuok.exe
  2⤵
  PID:9928
- C:\Windows\System\ilXrQvt.exe
  C:\Windows\System\ilXrQvt.exe
  2⤵
  PID:9948
- C:\Windows\System\dMtmWGf.exe
  C:\Windows\System\dMtmWGf.exe
  2⤵
  PID:9964
- C:\Windows\System\WXktDBX.exe
  C:\Windows\System\WXktDBX.exe
  2⤵
  PID:9980
- C:\Windows\System\gDfDgOF.exe
  C:\Windows\System\gDfDgOF.exe
  2⤵
  PID:9996
- C:\Windows\System\HyxCALb.exe
  C:\Windows\System\HyxCALb.exe
  2⤵
  PID:10016
- C:\Windows\System\QgxMENY.exe
  C:\Windows\System\QgxMENY.exe
  2⤵
  PID:10032
- C:\Windows\System\CmaZdgU.exe
  C:\Windows\System\CmaZdgU.exe
  2⤵
  PID:10048
- C:\Windows\System\epiFDct.exe
  C:\Windows\System\epiFDct.exe
  2⤵
  PID:10064
- C:\Windows\System\TxKmiwP.exe
  C:\Windows\System\TxKmiwP.exe
  2⤵
  PID:10084
- C:\Windows\System\aSYjDyJ.exe
  C:\Windows\System\aSYjDyJ.exe
  2⤵
  PID:10100
- C:\Windows\System\envrZAp.exe
  C:\Windows\System\envrZAp.exe
  2⤵
  PID:10116
- C:\Windows\System\rCRNClk.exe
  C:\Windows\System\rCRNClk.exe
  2⤵
  PID:10196
- C:\Windows\System\EjjzkOm.exe
  C:\Windows\System\EjjzkOm.exe
  2⤵
  PID:10216
- C:\Windows\System\aEKFDHo.exe
  C:\Windows\System\aEKFDHo.exe
  2⤵
  PID:10232
- C:\Windows\System\SSEXKGc.exe
  C:\Windows\System\SSEXKGc.exe
  2⤵
  PID:8816
- C:\Windows\System\yvodQxH.exe
  C:\Windows\System\yvodQxH.exe
  2⤵
  PID:8264
- C:\Windows\System\lZeiNdV.exe
  C:\Windows\System\lZeiNdV.exe
  2⤵
  PID:9232
- C:\Windows\System\JzWpcWP.exe
  C:\Windows\System\JzWpcWP.exe
  2⤵
  PID:9296
- C:\Windows\System\XBacsTB.exe
  C:\Windows\System\XBacsTB.exe
  2⤵
  PID:6720
- C:\Windows\System\WuCbJnF.exe
  C:\Windows\System\WuCbJnF.exe
  2⤵
  PID:8260
- C:\Windows\System\LVqSxGg.exe
  C:\Windows\System\LVqSxGg.exe
  2⤵
  PID:9092
- C:\Windows\System\ffPjnqg.exe
  C:\Windows\System\ffPjnqg.exe
  2⤵
  PID:9108
- C:\Windows\System\bGLbMcc.exe
  C:\Windows\System\bGLbMcc.exe
  2⤵
  PID:8500
- C:\Windows\System\cTJFHvM.exe
  C:\Windows\System\cTJFHvM.exe
  2⤵
  PID:9284
- C:\Windows\System\YiSJeSA.exe
  C:\Windows\System\YiSJeSA.exe
  2⤵
  PID:9352
- C:\Windows\System\nAEXIqy.exe
  C:\Windows\System\nAEXIqy.exe
  2⤵
  PID:9476
- C:\Windows\System\uQNOksM.exe
  C:\Windows\System\uQNOksM.exe
  2⤵
  PID:9596
- C:\Windows\System\Wsfkvle.exe
  C:\Windows\System\Wsfkvle.exe
  2⤵
  PID:9424
- C:\Windows\System\JgQoZyL.exe
  C:\Windows\System\JgQoZyL.exe
  2⤵
  PID:9564
- C:\Windows\System\uUbKKaO.exe
  C:\Windows\System\uUbKKaO.exe
  2⤵
  PID:9520
- C:\Windows\System\wfSYEnB.exe
  C:\Windows\System\wfSYEnB.exe
  2⤵
  PID:9500
- C:\Windows\System\VcNzaGT.exe
  C:\Windows\System\VcNzaGT.exe
  2⤵
  PID:9584
- C:\Windows\System\tcqzxxN.exe
  C:\Windows\System\tcqzxxN.exe
  2⤵
  PID:9544
- C:\Windows\System\iBFHygt.exe
  C:\Windows\System\iBFHygt.exe
  2⤵
  PID:9632
- C:\Windows\System\zyYAHzU.exe
  C:\Windows\System\zyYAHzU.exe
  2⤵
  PID:9684
- C:\Windows\System\KuolXcb.exe
  C:\Windows\System\KuolXcb.exe
  2⤵
  PID:9704
- C:\Windows\System\BULtgzT.exe
  C:\Windows\System\BULtgzT.exe
  2⤵
  PID:9720
- C:\Windows\System\PXfTgwQ.exe
  C:\Windows\System\PXfTgwQ.exe
  2⤵
  PID:9788
- C:\Windows\System\GDJdWLm.exe
  C:\Windows\System\GDJdWLm.exe
  2⤵
  PID:9800
- C:\Windows\System\uQBoAdF.exe
  C:\Windows\System\uQBoAdF.exe
  2⤵
  PID:9816
- C:\Windows\System\KWjxRlD.exe
  C:\Windows\System\KWjxRlD.exe
  2⤵
  PID:9832
- C:\Windows\System\glxTEuh.exe
  C:\Windows\System\glxTEuh.exe
  2⤵
  PID:9848
- C:\Windows\System\xoPCGDe.exe
  C:\Windows\System\xoPCGDe.exe
  2⤵
  PID:9904
- C:\Windows\System\zvILQRu.exe
  C:\Windows\System\zvILQRu.exe
  2⤵
  PID:9888
- C:\Windows\System\EzkyxzN.exe
  C:\Windows\System\EzkyxzN.exe
  2⤵
  PID:9960
- C:\Windows\System\mkOQnWp.exe
  C:\Windows\System\mkOQnWp.exe
  2⤵
  PID:9908
- C:\Windows\System\XZymxjd.exe
  C:\Windows\System\XZymxjd.exe
  2⤵
  PID:10040
- C:\Windows\System\hBIuCol.exe
  C:\Windows\System\hBIuCol.exe
  2⤵
  PID:9944
- C:\Windows\System\bMlRWAI.exe
  C:\Windows\System\bMlRWAI.exe
  2⤵
  PID:10056
- C:\Windows\System\vmYqKzz.exe
  C:\Windows\System\vmYqKzz.exe
  2⤵
  PID:10124
- C:\Windows\System\aIsgoTX.exe
  C:\Windows\System\aIsgoTX.exe
  2⤵
  PID:10112
- C:\Windows\System\XSiMlXO.exe
  C:\Windows\System\XSiMlXO.exe
  2⤵
  PID:10140
- C:\Windows\System\IUtVaBB.exe
  C:\Windows\System\IUtVaBB.exe
  2⤵
  PID:10156
- C:\Windows\System\whuRYYY.exe
  C:\Windows\System\whuRYYY.exe
  2⤵
  PID:10172
- C:\Windows\System\BXLIdLZ.exe
  C:\Windows\System\BXLIdLZ.exe
  2⤵
  PID:10228
- C:\Windows\System\BHzLTyk.exe
  C:\Windows\System\BHzLTyk.exe
  2⤵
  PID:9264
- C:\Windows\System\nmaViSf.exe
  C:\Windows\System\nmaViSf.exe
  2⤵
  PID:9280
- C:\Windows\System\leeVgmb.exe
  C:\Windows\System\leeVgmb.exe
  2⤵
  PID:9308
- C:\Windows\System\bcejVvj.exe
  C:\Windows\System\bcejVvj.exe
  2⤵
  PID:10212
- C:\Windows\System\XvTiYAF.exe
  C:\Windows\System\XvTiYAF.exe
  2⤵
  PID:8372
- C:\Windows\System\dxQldVt.exe
  C:\Windows\System\dxQldVt.exe
  2⤵
  PID:8568
- C:\Windows\System\ZikDFTx.exe
  C:\Windows\System\ZikDFTx.exe
  2⤵
  PID:9324
- C:\Windows\System\gREoQPC.exe
  C:\Windows\System\gREoQPC.exe
  2⤵
  PID:9372
- C:\Windows\System\BKZDcON.exe
  C:\Windows\System\BKZDcON.exe
  2⤵
  PID:9416
- C:\Windows\System\mFQeMXR.exe
  C:\Windows\System\mFQeMXR.exe
  2⤵
  PID:9548
- C:\Windows\System\MdPPyUS.exe
  C:\Windows\System\MdPPyUS.exe
  2⤵
  PID:9504
- C:\Windows\System\sNOcvND.exe
  C:\Windows\System\sNOcvND.exe
  2⤵
  PID:9452
- C:\Windows\System\qBbHsok.exe
  C:\Windows\System\qBbHsok.exe
  2⤵
  PID:9752
- C:\Windows\System\wlZmqZW.exe
  C:\Windows\System\wlZmqZW.exe
  2⤵
  PID:9648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AOrVnOR.exe

Filesize
1.6MB

MD5
d1dcd27b00df071afc1b79c4ef37ebdc

SHA1
63f3358a61e092f01c6ddb66292fca4e76b9864a

SHA256
3cf5ae875d73ccff6dabdaef929041659df827ab549368b5736c2fb25689ff69

SHA512
f2a60bc14ed569e47fa1ca80f8fc0c3ee01f1e6fbf4c5878ea27e072dd0650809b3f7247dbcba053a921f0820123728ea80ca3fdfb3b33fb2f2e0290d2f07915

Download Submit
C:\Windows\system\FXAPskz.exe

Filesize
1.6MB

MD5
4cc57e170bb847361143ddcfb5453821

SHA1
72ed5e1673bcb5b06521b2b0c41150fe5c4dc894

SHA256
786e61dd0427ad02d6af5ba6dc8c3c17f3afaf4e8e1ce3a9ea2991def84570b9

SHA512
4c12c9f845da8d4a23adfe2bd9577a48db037d5a24f811927106c4f12df3abae05ee00639478d5297f26a75527b53480bcf618ff4c6b6fc7ba6ec285736c5a9a

Download Submit
C:\Windows\system\GALoSIL.exe

Filesize
1.6MB

MD5
ffa0a1b6d76ccd0ac3445b8313ab6e98

SHA1
1fb51979d48c6fed9f41838dd12434383ca5dc8f

SHA256
39e5137a808997419a57db5bb4590ff629bd5fa5b968bd8252b975b90d43ca71

SHA512
03cf68fa892935af30f002c67adbb4ade67ce02e15499e691f891437435ae808214f622266d5ae83a6a776c806ded7d3f111e1c60495d0efc2b998f7a8c5baad

Download Submit
C:\Windows\system\IRKGtDH.exe

Filesize
1.6MB

MD5
ea21bb28f09ba512abb914d9a05d272c

SHA1
f4260c2abf8f298f0cd7b88c97bc45133fd0acf7

SHA256
89d72f5d50ec2ce4ca81dc7069dfdbf8a19196c7bd7d55700081010dbd823a2d

SHA512
9b1d0b7a13572f0ed475ba6f0c080c1079c2e22740d762147382b1f10f8006c825aec308e8569110a6c8a89611c4db856ee7f323ffe4842bcd579bac39ee16a9

Download Submit
C:\Windows\system\Klmxcsf.exe

Filesize
1.6MB

MD5
a2e968d1534753fcda0d57db0004c6a1

SHA1
4c21852428338867e6f7cd0f052244b53989efac

SHA256
adcbc90d7079200a4bb34760ffabfdc58a7df3ca1125af3e78e209e3c3f07d43

SHA512
465d1f086100e1de0b8defec7889414b7a699cc4fb7c339487c91f667c06dbf98d05a04cb0d1c0bcc2e4812f4210f5d1ac635af00289218a7ef6603897def614

Download Submit
C:\Windows\system\MgHSvdt.exe

Filesize
1.6MB

MD5
432916bb73d449db6b8f3e381c0934e9

SHA1
a4dcbf62ea21e1b9c8fd6f1c853863f1e0a10d2f

SHA256
ea680b1e6766701c9be49b61c196d211acdd437188b22a015a9a9bdf9da61ba4

SHA512
706863a760341440b1fc305810b4f9ff1126d5ff80e5888a765597b81db328f8ceb117f77ffa0ebe3014c0a578d51fd03138fc00686e9112ec01c8a37b6c4380

Download Submit
C:\Windows\system\NhodmKs.exe

Filesize
1.6MB

MD5
43094bf2e15b9efa81e67ca89bd76690

SHA1
461ce00b499e708af77ef55d83aab0e4f759c1f0

SHA256
c13eed88e266ddefd4fe87e2f46eeb8ee511532b87a1990c93051cdf3e978237

SHA512
1d7f5bbc40c79818efea4b8c9554626f0e5fa379f559720e1b24b850b5b2e47c918ebffb49c752f33002b9fef69ffdd29b1417087865d4ace62733eee058620b

Download Submit
C:\Windows\system\NiwKWIT.exe

Filesize
1.6MB

MD5
2f5614382b78535ad7210e5bee50ac26

SHA1
ca72217dde14f4a8de45c88a44e17f0a09beeca7

SHA256
3ed7f85def3efe9ebc748fa072a69890f26c26e7260797adfc1c8d92b21f6987

SHA512
bd56b3c5812328723657940f273270882f7ea28039d81303eaa8f0ca1c4b127ed9e593b047201318d4aaca875ff75ab8cd07a746c92af79e2e3a2fce39776b3e

Download Submit
C:\Windows\system\ORBWwYy.exe

Filesize
1.6MB

MD5
11ff0166f94734fca2289cd5cc05ea56

SHA1
6d1dfe5f0a5d3e93221bab706825085060a03f58

SHA256
e5220299adc97c4a33fabdd8a46071cd943a0c977bb823b3d9bce0a52c4db5f5

SHA512
9e30ddccaccc300c86134fe913d009df9e83085b63e3eec9d479483410b098f6e66a0245b54a02e74ae583b9cbe4973ea4f53d1c1629a8e7988e778d6f6d779f

Download Submit
C:\Windows\system\ZPYqCSC.exe

Filesize
1.6MB

MD5
5fa15f156ae89d1c3b7c87a55482522d

SHA1
d95d841de7c2b7e5190d3d0951475579f68da924

SHA256
6e30b202ca3a72e66932d6cbec9b477751dc01674d4f26068b8727b9fffe917e

SHA512
37a2e27893531b19e6cf9aaaf3800c43c28803f765da8e0c944115281fa9f34430320df91fb4edb66d8752f82a2fdc138250c61f461e75b0f88d49d0bfe0b202

Download Submit
C:\Windows\system\aKuBGxT.exe

Filesize
1.6MB

MD5
c13b529f574159a636aa5d523ef2b215

SHA1
a56332587e0fa35bbe0b4f5b648b45b27c5b9cce

SHA256
a635c59ab019cdf08d7cdfa03cb03c6f73346aaa918bae205a8c77be9a8def66

SHA512
513f7d9dde2d63fb4fdc4fb3daf9ea7f58f45c017b071ea2ac4ca3a58387f23a2817cfe32af069e68dc437c1ec6d0416a6248d5db2fe5a9af5961e6450dc76d1

Download Submit
C:\Windows\system\dURYYHe.exe

Filesize
1.6MB

MD5
ff5294fcc2528e8b30982c9ba0232538

SHA1
04f206c0d407960ae2856f6b3b2f6f105a0e8b73

SHA256
df2e4a422505bea1b5eddedec56724e3dd47283bfbfee7020574868b372a3476

SHA512
af1c921b7f1e5c8570641d10e0abc6a44fc917704d2d607448aec0e85c4d0fd0d75c148e6513785cd4e2800b59d7441c1d139b76cff26361d27d6180d536c35d

Download Submit
C:\Windows\system\dYRnsjh.exe

Filesize
1.6MB

MD5
ea06dc03ee2ba6caffc35e604ea8599f

SHA1
5a5d93a8f41300f36df941ee196d59fc581960c7

SHA256
6baf250ea08219b54fef8dd90d1485a11031350de87755fb1c741d88a06142f3

SHA512
38ad3dea0c88177b1c6dc4808ab95de8ab58e0cc19befa515f5459bb8d2fb701c746a30086dd2c316a84bbeb8ed30bd811a816f1b2446eb6b8aa622a6005edf2

Download Submit
C:\Windows\system\feAHHXt.exe

Filesize
1.6MB

MD5
9e8447169b2fa0bfe2e2a087bdc5e136

SHA1
c8bdb69e838390726378e589caf1e85cb65c11da

SHA256
d808d2f7286fa38272745215e0fc7540902c2446f341b02845bf62bb3caf556d

SHA512
ebaff7dcbde611b641000f9f717a026cdb99b9431ce0b8ce1acabce2fd8dd66490903ca378f7a7759fddfb8df52ec8c83b8eb2669b160053314328cdccc883a9

Download Submit
C:\Windows\system\hoRoBIR.exe

Filesize
1.6MB

MD5
692220030edd041af0dad0025d5548f1

SHA1
6c975ba0b7f62bdc3ddb5da54404c2e89c24bbb8

SHA256
f3588b4c358a9f8ba5f6c4a2770469d960b2d3b0ba50316829289c4692302fe0

SHA512
b9de71fcc9797b7048a540eccbfcd5904ac0db7a0e4f427e14b7a60adcea09dca7cdaa714c5f3a49c2dbd3df4eec7a728e67bce44dcb7e109e1c519a178ff539

Download Submit
C:\Windows\system\kOxcwKQ.exe

Filesize
1.6MB

MD5
3089be51c5752bd2222b9b54b4ba9ff0

SHA1
84e96cd22d145759b0bfaf7be51fc1400839aeb5

SHA256
f7b2e80442c4b8d5dc3521d1be7d8972f36c17a4682060b1114f5b5857a2dc6a

SHA512
72914da82de24ecad586011297eb82f851ce9726e95034001bcf048333f481b9e9f27fac2a9fad9675d72fcb880095ed3a8f6ac8854c96024422d626cb3a8e21

Download Submit
C:\Windows\system\kwIpxqx.exe

Filesize
1.6MB

MD5
f701e69dbe166a0cc0b28ee52d716d1b

SHA1
0aeb847e760fc9d102bc26e42a35cde546510b2f

SHA256
8e06b0f754c9251db345c8ab6b0d39b3e40d875410e0350dd699699947813afc

SHA512
5e68a1f04b1a302c5e2189157e4690894a7503c5029cbfa76536a1c6a0dd79fa65603b6f445739791cee295f2133060eebb33f98e1317d65ef462b9e50228da2

Download Submit
C:\Windows\system\lEknOZy.exe

Filesize
1.6MB

MD5
52e226a987ec189d63e20363a82fd7bd

SHA1
5b432bf6c45ddd70892032b580e04c0e9f1c5fd8

SHA256
783d53580f153142120892c1425a3d73d0a9d8210df1f13e8e7ef8f910e148eb

SHA512
8bc281bb681321176bdc3fed527e6b750125b13bb5e11b78449f3adff5a574cecc9efeb74e36b7f4dd081b5bae36145430bf06d455691895398453e08e164580

Download Submit
C:\Windows\system\maqOYZm.exe

Filesize
1.6MB

MD5
0b6c73542312483ff8c72fe0fdfaf05b

SHA1
023783a1ea91372f4bc1f9d93e36465fc70f5bad

SHA256
d417e75dccf565a5373ae047846f24e08655f55ffa5f2fb19def6d7e089fe04a

SHA512
ac5b1479090ac00c6d6a3212ff1ca7bb866326d12a33bc8757bd630d74eae6402026b47d6a1e9766455c07776cef7ecdd0c87ba7a37cd904216989d2c793ef32

Download Submit
C:\Windows\system\mldunYZ.exe

Filesize
1.6MB

MD5
4c0c024e037e1da7916167f528f452e4

SHA1
c9024657abe5bf21b5df35be64e2e087d28c022b

SHA256
d43fda39f44c2fb9d9bb766912be850ba37e441515fa07026648a0369b53f129

SHA512
7df1749c9e0766b5ac7a01d8835e8b28f2e99576b018e7c075f26113557f0f11e4c50ae3c8b317f5421aba9d6b4b8f663ae0cf4a17decb7aaaa691ab63993292

Download Submit
C:\Windows\system\nDFjSnH.exe

Filesize
1.6MB

MD5
cc2b5f3c654969a8ef279ad39d74cc4f

SHA1
5ee2682863850fadaf64b8b380561ddbf24cf78b

SHA256
95706974a28a22e83331b0635b2e806c541918ed4466ef4cb9d14cfe3418488d

SHA512
a6ce045e12e84c04638f67df03adfa3af87f36b36c4f7c8336cdb37e1ed2ede6dff12c3912b38034e643c09ee8d4489067f7f5e893805babf0c2e02dc6705b56

Download Submit
C:\Windows\system\nKjBxoa.exe

Filesize
1.6MB

MD5
d9a624f153e98a568e4e5f9640179494

SHA1
0745ca0b902ed528cf5cdd4c528ecee08b7f4cdd

SHA256
4f93325c5eec9dd5f189f2306f8405f10dd172f1bebd8ec7dda2d87315ea27a3

SHA512
e1466a8276d557799e46705a4751271550a2582711e9937ee0376a7632c56c6672c94347616298318de7d4281d639e708be00bfd07bf2484cb2d4b84dd8317cf

Download Submit
C:\Windows\system\tCJmDjE.exe

Filesize
1.6MB

MD5
3066b561c3ad875e78a8c5fcd64a171e

SHA1
fdd11f7b523074347881732ba309237db5a0ae5a

SHA256
0501449cbb4607c6bacd447d6e28cdc902f6e83df3cc117377e4eb41e712e42a

SHA512
7903fa0df513b64c65d0fcecd7b12baa3d86d124ff7d121188ab4f7d749040c5f659d625230767e68d125350bf4c25372c2a723a85d2ed48c07f4a0da83bda67

Download Submit
C:\Windows\system\vzgPtzP.exe

Filesize
1.6MB

MD5
8ae56d703bb32c1bc870befa14d6f02d

SHA1
9fc2847604bc126581f8be5eebdae51d86a1ab03

SHA256
11dfd9613c6fd5e84e97b711609e6e86df4806f63911263f812d035d6a4e89e8

SHA512
e1b70ca534789c193553e9afc7fdc06d06e7f3b3cb55b1c21ce469b26ccbf306498583d3a3e65f1d8624680b38aac6a90f0d59b60e9bc5a212e960c3d51427ff

Download Submit
C:\Windows\system\yJCREHi.exe

Filesize
1.6MB

MD5
20d5eb537fa47244d4a74f244db0d298

SHA1
b009b0128ccb42fe0c8e624fd279be9032d5018a

SHA256
dcc285c83df8f29c76a2b9b3d5198325bacf46863d409160f5bcc2443fd549bb

SHA512
f36cbf36aa3205d2a90eb08112167af78b935d6b519b32183f256e8a88012d34216986a6ce888420cb816de0c0e038e130cfd6fbf915de086ac30e42ec1bd6bc

Download Submit
\Windows\system\DYidBko.exe

Filesize
1.6MB

MD5
0065bea2bff08887e2bd37d9905a7246

SHA1
8bf7bb62e26119b6001fbf87133b9da77a19685a

SHA256
8b8052b9b91db5b3034154e469f97927414b42eb885b9c93c37b690e43816a1c

SHA512
24e96e38f1ea8d21a47b4b7b9da521386b99df738ba7f47c7761b6d113d53a013f90158e156ee9b633e00e802fd880cf2ca9e3cdac700b9508a968302ebaf2c1

Download Submit
\Windows\system\FXkqzAj.exe

Filesize
1.6MB

MD5
e8120dcb9abf9e7dd17141fff579af88

SHA1
99d3b01f6b7047195cd36d31a4a21bcc63db1c6d

SHA256
496c7d6eebd78fd43e849e95d275f2353a794fa19c2f4868ff32f0bf69bffaa4

SHA512
198142de409907df84f06803bbf0c23809404fe31884031b4c0cfb31347d2a28b3971fdab71fd7d8865a7a53daf12b236de946c6f5695ebfe440b47401d46d34

Download Submit
\Windows\system\NzWHAGE.exe

Filesize
1.6MB

MD5
2913dfc571cb78a16f361b0cfe7c2af7

SHA1
7f1e99851a3bfe8ab58016bf6a71caf0809825bf

SHA256
166a40c745fd62274d4eaf7310511aaa202ce2efbe73e5f82481f9510fef82d1

SHA512
ce65b39f31e63373f6dd12a933deff2479eb4b12413ac9eb65bdb25f3ac8bec6f4d7de22db109ae3370b5bda3888edf6787206410286f6a143ebe6ff332bd45d

Download Submit
\Windows\system\QfMqjBN.exe

Filesize
1.6MB

MD5
a17afbd00fbbb2f8536a56b4155c2ffa

SHA1
a49463732470b4af2539882b1726e876d01d0539

SHA256
ba2d3627dcd3af2689d176dfd0aaab75f1a26f529571fe5986721e6804eb1772

SHA512
d36bd99d51e3d1ff4df6fd4ad2ac9f70c73769c224140bc5a1357769864ae727d5dabe18a58e2c73387c0cb1e363147413d63bb94fef8e4ce58aa65d418c1552

Download Submit
\Windows\system\RHRpISE.exe

Filesize
1.6MB

MD5
1defea69b2077dd3b8e6dde8930f18ec

SHA1
a1a75b1ac52cb9d7cd4d0dcdfd1820dfc1df4b14

SHA256
80d409cdc76a429d6bdfd06285d06403a2f0720c46e264c2a34c0ffdc147e8a3

SHA512
43d4f4b8c06921006b43c2057267e88279f95953266e2d7aa6c7142e85bbe79df3de1817604b3a04ab298df4350dce35441cbe7699b7dc9081d85aa9f514f948

Download Submit
\Windows\system\wOdlGMZ.exe

Filesize
1.6MB

MD5
aaf1be7ff8040b17e2e75469e920e6cd

SHA1
b465de8999d68e9697ffdae37f9cdc39cb585655

SHA256
a54dffef07affd597d362f98737d2ddf7dbae9714a56f85bc8e46c5156da0e1e

SHA512
c8249fbd0a4f8090185065f6b3d90504db9606f59870daea7e5853ffe5bf55dd446a474668178a31515b0e16e85cba0bea2c11c3b021f9740aea90febb808238

Download Submit
\Windows\system\xyaweud.exe

Filesize
1.6MB

MD5
151c10e2f9812ac992ceb1776be2ad78

SHA1
827178de36f94fb4c28af2e7ca83e60835769a3d

SHA256
91d78366aacbc084e6477c5138e7517a2f364f97b6b75253a74ddaa512178d92

SHA512
7def473b2d78017d3192b7673559d925cf125995641437a23263bd70fb01087bcf76751e6ebca001a0ada5e9dae11d7de8462ff722843b2bbcc480bd1c250a21

Download Submit
memory/1472-9-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/1472-4836-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/1680-83-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1680-5161-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2084-4986-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2084-73-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2132-102-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2132-5162-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2240-91-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2240-59-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2240-524-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2240-78-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-69-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2240-7-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2240-56-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2240-75-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2240-76-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2240-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2240-70-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-61-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-0-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2240-18-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/2396-53-0x000007FEF4980000-0x000007FEF531D000-memory.dmp

Filesize
9.6MB

Download
memory/2396-66-0x000007FEF4980000-0x000007FEF531D000-memory.dmp

Filesize
9.6MB

Download
memory/2396-40-0x0000000001FE0000-0x0000000001FE8000-memory.dmp

Filesize
32KB

Download
memory/2396-79-0x000007FEF4980000-0x000007FEF531D000-memory.dmp

Filesize
9.6MB

Download
memory/2396-21-0x000007FEF4C3E000-0x000007FEF4C3F000-memory.dmp

Filesize
4KB

Download
memory/2396-20-0x0000000002CD0000-0x0000000002D50000-memory.dmp

Filesize
512KB

Download
memory/2396-74-0x000007FEF4980000-0x000007FEF531D000-memory.dmp

Filesize
9.6MB

Download
memory/2396-39-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2600-4991-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2600-71-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2628-5152-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2628-72-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2760-679-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-19-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2764-4834-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2764-58-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2768-5153-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2768-68-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2792-89-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2792-5928-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-4838-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2872-55-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2932-4835-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2932-60-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download