xmrig | 44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522

Analysis

max time kernel
119s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
Size

1.6MB
MD5

bec3396da0969931b4c557015c392450
SHA1

7251583c2ccacccf6d724e81c12e37cefd17432e
SHA256

44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522
SHA512

c0a1073c8710bc0dfd013c30904fe5a169b0a6cb7ee4641f28574e198b6cc8fef86bc5de9effc4c42e6179fec5e17032c9ad898a0c21b2030d87253507160144
SSDEEP

49152:Lz071uv4BPMkyW10/wKV7hjSe5CtAlM22Cwj:NABl

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2104-210-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2616-207-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2808-206-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2644-204-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2936-202-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/2776-200-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2960-198-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2768-196-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2208-26-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2196-15-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2072-14-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2216-1186-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2196-5558-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2616-5601-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2936-5685-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/2960-5684-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2072-5686-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2208-5722-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2768-5748-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2644-5747-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2776-5746-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2104-5745-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2808-5724-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2360	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2196	quVsLbc.exe
2072	nVzItgh.exe
2208	yqjodXM.exe
2768	rfbbyvc.exe
2960	BZDYJln.exe
2776	nUnmFJX.exe
2936	jkyudpI.exe
2644	ZonscHv.exe
2808	iMHLyiH.exe
2616	gwCKwFz.exe
2104	JJWTMqn.exe
2668	gvzLEvh.exe
1332	GHiXINR.exe
584	OUcSWvy.exe
1484	zIRTYAQ.exe
1856	IpVptrK.exe
2392	CweSkTL.exe
1688	KnOXsoA.exe
1684	grrIyeU.exe
1224	SyLBCZg.exe
1936	EUsXgRP.exe
2424	ziKbLsm.exe
1452	WiTYZpL.exe
316	EZCeIah.exe
1296	TZVXeZr.exe
2716	iVLcTFt.exe
2460	uLIBNYN.exe
2656	sPdfmcP.exe
1604	ctEPkBU.exe
2008	UxJzVMG.exe
1164	heNZsaN.exe
2916	OuyvjYS.exe
1780	bEzISYp.exe
1384	BRrkOXS.exe
2284	hurYHPU.exe
2400	HNkCzkz.exe
2588	XYrLgse.exe
2852	FYjdWHj.exe
2524	fIvGpmg.exe
2280	ogenFfJ.exe
760	vguhode.exe
1728	MSSGFxo.exe
3000	iuWHWoK.exe
2372	NtYYJRj.exe
2080	kzcqWLU.exe
2092	umXFjdC.exe
2300	orPxObv.exe
2556	IzKTCCJ.exe
2636	pUWXJyj.exe
2844	rqoITZS.exe
1968	yXZrNnz.exe
3060	qsCbyEQ.exe
1420	uoVJFYS.exe
2676	FHKNpPk.exe
2592	JFdZHRD.exe
2020	kZYREJH.exe
1392	xhGLRfN.exe
1096	tyUqeov.exe
2512	gvAEhxB.exe
2016	QvufDBO.exe
2804	HPyifZZ.exe
2256	WAPBzyz.exe
1796	NIkzIAw.exe
1152	nKmpByT.exe

Loads dropped DLL 64 IoCs

pid	Process
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2216-1-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x000700000001211a-3.dat	upx
behavioral1/files/0x0008000000018c26-7.dat	upx
behavioral1/files/0x000700000001903b-9.dat	upx
behavioral1/files/0x0007000000004e74-37.dat	upx
behavioral1/files/0x0005000000019423-60.dat	upx
behavioral1/files/0x0005000000019442-82.dat	upx
behavioral1/files/0x000500000001945c-88.dat	upx
behavioral1/files/0x00050000000194ff-121.dat	upx
behavioral1/files/0x0005000000019c5b-167.dat	upx
behavioral1/files/0x000500000001963b-140.dat	upx
behavioral1/files/0x0005000000019aff-160.dat	upx
behavioral1/files/0x0005000000019a62-150.dat	upx
behavioral1/memory/2104-210-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2616-207-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2808-206-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2644-204-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2936-202-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/memory/2776-200-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2960-198-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/memory/2768-196-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/files/0x0005000000019c74-169.dat	upx
behavioral1/files/0x0005000000019632-145.dat	upx
behavioral1/files/0x000500000001952c-126.dat	upx
behavioral1/files/0x0005000000019afd-159.dat	upx
behavioral1/files/0x00050000000197aa-149.dat	upx
behavioral1/files/0x00050000000194df-116.dat	upx
behavioral1/files/0x000500000001963a-138.dat	upx
behavioral1/files/0x0005000000019630-131.dat	upx
behavioral1/files/0x00050000000194ae-106.dat	upx
behavioral1/files/0x00050000000194c9-111.dat	upx
behavioral1/files/0x000500000001946b-96.dat	upx
behavioral1/files/0x000500000001946e-101.dat	upx
behavioral1/files/0x0005000000019458-87.dat	upx
behavioral1/files/0x0005000000019426-75.dat	upx
behavioral1/files/0x000500000001944d-79.dat	upx
behavioral1/files/0x00050000000193a5-56.dat	upx
behavioral1/files/0x000700000001937b-45.dat	upx
behavioral1/files/0x0005000000019438-67.dat	upx
behavioral1/files/0x0005000000019397-50.dat	upx
behavioral1/files/0x000a0000000191ff-41.dat	upx
behavioral1/files/0x00070000000190ce-32.dat	upx
behavioral1/memory/2208-26-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2196-15-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2072-14-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2216-1186-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/2196-5558-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2616-5601-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2936-5685-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/memory/2960-5684-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/memory/2072-5686-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2208-5722-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2768-5748-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/2644-5747-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2776-5746-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2104-5745-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2808-5724-0x000000013F560000-0x000000013F952000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\Givweml.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\rjrifUt.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\uPvCGXQ.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\blRevSO.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\TLCiCem.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\GLLEiwy.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\rHypbRr.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\DhUwDYy.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\cVIVhif.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\sdipglb.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\TRCAnES.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\IEvOaWf.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\isFulnt.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\GKddDkg.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\PqINiDo.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\zvXSQnn.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\qAVFkrA.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\bskyDPw.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\lQcQExi.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\ersLLPZ.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\SwEXlpA.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\FkMcanN.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\yrisDWT.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\kzEbcfM.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\dTJdavB.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\xpCPLBi.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\bsWoHxy.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\pxGOfKD.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\TWBtWFc.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\lSiSYLq.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\OwtUafC.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\dbueMuz.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\VdFlRdJ.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\YNzamoD.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\vIBdNku.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\aPwQDea.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\kaZeMnh.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\tYcOTvi.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\StPkJoG.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\uFujnsL.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\wJHCGHY.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\tZxejNl.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\qHxZowM.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\eclUmMi.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\lniwFtE.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\Gzirphz.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\euywIYc.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\pRBYFEi.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\scGdVqC.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\rcoUfmf.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\kyOcqgu.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\LlYJRSB.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\dvAMvLe.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\lnWzWjb.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\WdNFHfS.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\tqfPvUu.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\BjQzfZS.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\maEPRYk.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\BOhNZaC.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\VNCveKG.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\SKIMnyz.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\rTCCifd.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\CPARqeE.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\fAREFgk.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2360	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
Token: SeLockMemoryPrivilege	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
Token: SeDebugPrivilege	2360	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2360	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	31
PID 2216 wrote to memory of 2360	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	31
PID 2216 wrote to memory of 2360	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	31
PID 2216 wrote to memory of 2196	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	32
PID 2216 wrote to memory of 2196	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	32
PID 2216 wrote to memory of 2196	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	32
PID 2216 wrote to memory of 2072	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	33
PID 2216 wrote to memory of 2072	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	33
PID 2216 wrote to memory of 2072	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	33
PID 2216 wrote to memory of 2208	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	34
PID 2216 wrote to memory of 2208	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	34
PID 2216 wrote to memory of 2208	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	34
PID 2216 wrote to memory of 2768	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	36
PID 2216 wrote to memory of 2768	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	36
PID 2216 wrote to memory of 2768	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	36
PID 2216 wrote to memory of 2960	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	37
PID 2216 wrote to memory of 2960	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	37
PID 2216 wrote to memory of 2960	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	37
PID 2216 wrote to memory of 2776	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	38
PID 2216 wrote to memory of 2776	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	38
PID 2216 wrote to memory of 2776	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	38
PID 2216 wrote to memory of 2936	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	39
PID 2216 wrote to memory of 2936	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	39
PID 2216 wrote to memory of 2936	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	39
PID 2216 wrote to memory of 2644	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	40
PID 2216 wrote to memory of 2644	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	40
PID 2216 wrote to memory of 2644	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	40
PID 2216 wrote to memory of 2808	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	41
PID 2216 wrote to memory of 2808	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	41
PID 2216 wrote to memory of 2808	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	41
PID 2216 wrote to memory of 2616	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	42
PID 2216 wrote to memory of 2616	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	42
PID 2216 wrote to memory of 2616	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	42
PID 2216 wrote to memory of 2668	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	43
PID 2216 wrote to memory of 2668	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	43
PID 2216 wrote to memory of 2668	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	43
PID 2216 wrote to memory of 2104	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	44
PID 2216 wrote to memory of 2104	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	44
PID 2216 wrote to memory of 2104	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	44
PID 2216 wrote to memory of 584	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	45
PID 2216 wrote to memory of 584	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	45
PID 2216 wrote to memory of 584	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	45
PID 2216 wrote to memory of 1332	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	46
PID 2216 wrote to memory of 1332	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	46
PID 2216 wrote to memory of 1332	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	46
PID 2216 wrote to memory of 1484	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	47
PID 2216 wrote to memory of 1484	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	47
PID 2216 wrote to memory of 1484	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	47
PID 2216 wrote to memory of 1856	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	48
PID 2216 wrote to memory of 1856	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	48
PID 2216 wrote to memory of 1856	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	48
PID 2216 wrote to memory of 2392	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	49
PID 2216 wrote to memory of 2392	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	49
PID 2216 wrote to memory of 2392	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	49
PID 2216 wrote to memory of 1688	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	50
PID 2216 wrote to memory of 1688	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	50
PID 2216 wrote to memory of 1688	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	50
PID 2216 wrote to memory of 1684	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	51
PID 2216 wrote to memory of 1684	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	51
PID 2216 wrote to memory of 1684	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	51
PID 2216 wrote to memory of 1224	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	52
PID 2216 wrote to memory of 1224	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	52
PID 2216 wrote to memory of 1224	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	52
PID 2216 wrote to memory of 1936	2216	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	53

C:\Users\Admin\AppData\Local\Temp\44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
"C:\Users\Admin\AppData\Local\Temp\44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\System\quVsLbc.exe
  C:\Windows\System\quVsLbc.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\nVzItgh.exe
  C:\Windows\System\nVzItgh.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\yqjodXM.exe
  C:\Windows\System\yqjodXM.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\rfbbyvc.exe
  C:\Windows\System\rfbbyvc.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\BZDYJln.exe
  C:\Windows\System\BZDYJln.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\nUnmFJX.exe
  C:\Windows\System\nUnmFJX.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\jkyudpI.exe
  C:\Windows\System\jkyudpI.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\ZonscHv.exe
  C:\Windows\System\ZonscHv.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\iMHLyiH.exe
  C:\Windows\System\iMHLyiH.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\gwCKwFz.exe
  C:\Windows\System\gwCKwFz.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\gvzLEvh.exe
  C:\Windows\System\gvzLEvh.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\JJWTMqn.exe
  C:\Windows\System\JJWTMqn.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\OUcSWvy.exe
  C:\Windows\System\OUcSWvy.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\GHiXINR.exe
  C:\Windows\System\GHiXINR.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\zIRTYAQ.exe
  C:\Windows\System\zIRTYAQ.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\IpVptrK.exe
  C:\Windows\System\IpVptrK.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\CweSkTL.exe
  C:\Windows\System\CweSkTL.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\KnOXsoA.exe
  C:\Windows\System\KnOXsoA.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\grrIyeU.exe
  C:\Windows\System\grrIyeU.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\SyLBCZg.exe
  C:\Windows\System\SyLBCZg.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\EUsXgRP.exe
  C:\Windows\System\EUsXgRP.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\ziKbLsm.exe
  C:\Windows\System\ziKbLsm.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\WiTYZpL.exe
  C:\Windows\System\WiTYZpL.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\EZCeIah.exe
  C:\Windows\System\EZCeIah.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\iVLcTFt.exe
  C:\Windows\System\iVLcTFt.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\TZVXeZr.exe
  C:\Windows\System\TZVXeZr.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\sPdfmcP.exe
  C:\Windows\System\sPdfmcP.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\uLIBNYN.exe
  C:\Windows\System\uLIBNYN.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\heNZsaN.exe
  C:\Windows\System\heNZsaN.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\ctEPkBU.exe
  C:\Windows\System\ctEPkBU.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\hurYHPU.exe
  C:\Windows\System\hurYHPU.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\UxJzVMG.exe
  C:\Windows\System\UxJzVMG.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\HNkCzkz.exe
  C:\Windows\System\HNkCzkz.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\OuyvjYS.exe
  C:\Windows\System\OuyvjYS.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\XYrLgse.exe
  C:\Windows\System\XYrLgse.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\bEzISYp.exe
  C:\Windows\System\bEzISYp.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\FYjdWHj.exe
  C:\Windows\System\FYjdWHj.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\BRrkOXS.exe
  C:\Windows\System\BRrkOXS.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\fIvGpmg.exe
  C:\Windows\System\fIvGpmg.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\ogenFfJ.exe
  C:\Windows\System\ogenFfJ.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\vguhode.exe
  C:\Windows\System\vguhode.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\MSSGFxo.exe
  C:\Windows\System\MSSGFxo.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\iuWHWoK.exe
  C:\Windows\System\iuWHWoK.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\NtYYJRj.exe
  C:\Windows\System\NtYYJRj.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\kzcqWLU.exe
  C:\Windows\System\kzcqWLU.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\umXFjdC.exe
  C:\Windows\System\umXFjdC.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\xLUGvUb.exe
  C:\Windows\System\xLUGvUb.exe
  2⤵
  PID:2240
- C:\Windows\System\orPxObv.exe
  C:\Windows\System\orPxObv.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\eqvcwnC.exe
  C:\Windows\System\eqvcwnC.exe
  2⤵
  PID:2760
- C:\Windows\System\IzKTCCJ.exe
  C:\Windows\System\IzKTCCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\Rsxlqlb.exe
  C:\Windows\System\Rsxlqlb.exe
  2⤵
  PID:2888
- C:\Windows\System\pUWXJyj.exe
  C:\Windows\System\pUWXJyj.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\lcShKJv.exe
  C:\Windows\System\lcShKJv.exe
  2⤵
  PID:3044
- C:\Windows\System\rqoITZS.exe
  C:\Windows\System\rqoITZS.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\XWyZTVq.exe
  C:\Windows\System\XWyZTVq.exe
  2⤵
  PID:2728
- C:\Windows\System\yXZrNnz.exe
  C:\Windows\System\yXZrNnz.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\nvwZxVh.exe
  C:\Windows\System\nvwZxVh.exe
  2⤵
  PID:2736
- C:\Windows\System\qsCbyEQ.exe
  C:\Windows\System\qsCbyEQ.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\WINuzFj.exe
  C:\Windows\System\WINuzFj.exe
  2⤵
  PID:352
- C:\Windows\System\uoVJFYS.exe
  C:\Windows\System\uoVJFYS.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\OTFrgkK.exe
  C:\Windows\System\OTFrgkK.exe
  2⤵
  PID:1316
- C:\Windows\System\FHKNpPk.exe
  C:\Windows\System\FHKNpPk.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\ShQTyGT.exe
  C:\Windows\System\ShQTyGT.exe
  2⤵
  PID:668
- C:\Windows\System\JFdZHRD.exe
  C:\Windows\System\JFdZHRD.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\yvdFMoU.exe
  C:\Windows\System\yvdFMoU.exe
  2⤵
  PID:2228
- C:\Windows\System\kZYREJH.exe
  C:\Windows\System\kZYREJH.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\wvmmvxY.exe
  C:\Windows\System\wvmmvxY.exe
  2⤵
  PID:1736
- C:\Windows\System\xhGLRfN.exe
  C:\Windows\System\xhGLRfN.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\drdWJdh.exe
  C:\Windows\System\drdWJdh.exe
  2⤵
  PID:1376
- C:\Windows\System\tyUqeov.exe
  C:\Windows\System\tyUqeov.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\QaeyAjx.exe
  C:\Windows\System\QaeyAjx.exe
  2⤵
  PID:1488
- C:\Windows\System\gvAEhxB.exe
  C:\Windows\System\gvAEhxB.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\sZEyCSF.exe
  C:\Windows\System\sZEyCSF.exe
  2⤵
  PID:1956
- C:\Windows\System\QvufDBO.exe
  C:\Windows\System\QvufDBO.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\njPZjDI.exe
  C:\Windows\System\njPZjDI.exe
  2⤵
  PID:2052
- C:\Windows\System\HPyifZZ.exe
  C:\Windows\System\HPyifZZ.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\FbKnKol.exe
  C:\Windows\System\FbKnKol.exe
  2⤵
  PID:1540
- C:\Windows\System\WAPBzyz.exe
  C:\Windows\System\WAPBzyz.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\MgzgcHq.exe
  C:\Windows\System\MgzgcHq.exe
  2⤵
  PID:884
- C:\Windows\System\NIkzIAw.exe
  C:\Windows\System\NIkzIAw.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\ehBBpTS.exe
  C:\Windows\System\ehBBpTS.exe
  2⤵
  PID:1160
- C:\Windows\System\nKmpByT.exe
  C:\Windows\System\nKmpByT.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\xNMQDnj.exe
  C:\Windows\System\xNMQDnj.exe
  2⤵
  PID:2332
- C:\Windows\System\xHyhCin.exe
  C:\Windows\System\xHyhCin.exe
  2⤵
  PID:1804
- C:\Windows\System\brVREyI.exe
  C:\Windows\System\brVREyI.exe
  2⤵
  PID:1352
- C:\Windows\System\ZXLRxWj.exe
  C:\Windows\System\ZXLRxWj.exe
  2⤵
  PID:2856
- C:\Windows\System\PGwzOHs.exe
  C:\Windows\System\PGwzOHs.exe
  2⤵
  PID:1864
- C:\Windows\System\vHbDdtP.exe
  C:\Windows\System\vHbDdtP.exe
  2⤵
  PID:1980
- C:\Windows\System\OjfTJpL.exe
  C:\Windows\System\OjfTJpL.exe
  2⤵
  PID:2252
- C:\Windows\System\QQZeavo.exe
  C:\Windows\System\QQZeavo.exe
  2⤵
  PID:1528
- C:\Windows\System\UntSWXX.exe
  C:\Windows\System\UntSWXX.exe
  2⤵
  PID:3084
- C:\Windows\System\NGBjVbX.exe
  C:\Windows\System\NGBjVbX.exe
  2⤵
  PID:3100
- C:\Windows\System\oASnJtt.exe
  C:\Windows\System\oASnJtt.exe
  2⤵
  PID:3116
- C:\Windows\System\sbNQRyD.exe
  C:\Windows\System\sbNQRyD.exe
  2⤵
  PID:3132
- C:\Windows\System\qyQnwVR.exe
  C:\Windows\System\qyQnwVR.exe
  2⤵
  PID:3148
- C:\Windows\System\gebhkZD.exe
  C:\Windows\System\gebhkZD.exe
  2⤵
  PID:3164
- C:\Windows\System\hUFFbdc.exe
  C:\Windows\System\hUFFbdc.exe
  2⤵
  PID:3180
- C:\Windows\System\uWUzeeD.exe
  C:\Windows\System\uWUzeeD.exe
  2⤵
  PID:3196
- C:\Windows\System\shokKad.exe
  C:\Windows\System\shokKad.exe
  2⤵
  PID:3212
- C:\Windows\System\eFGzTkH.exe
  C:\Windows\System\eFGzTkH.exe
  2⤵
  PID:3228
- C:\Windows\System\mXNhvSx.exe
  C:\Windows\System\mXNhvSx.exe
  2⤵
  PID:3244
- C:\Windows\System\BtMPaeU.exe
  C:\Windows\System\BtMPaeU.exe
  2⤵
  PID:3260
- C:\Windows\System\TGiHudo.exe
  C:\Windows\System\TGiHudo.exe
  2⤵
  PID:3276
- C:\Windows\System\CisbWxl.exe
  C:\Windows\System\CisbWxl.exe
  2⤵
  PID:3292
- C:\Windows\System\hqxWUXP.exe
  C:\Windows\System\hqxWUXP.exe
  2⤵
  PID:3308
- C:\Windows\System\ZDVhyqc.exe
  C:\Windows\System\ZDVhyqc.exe
  2⤵
  PID:3324
- C:\Windows\System\ekySXaU.exe
  C:\Windows\System\ekySXaU.exe
  2⤵
  PID:3340
- C:\Windows\System\enSkkdA.exe
  C:\Windows\System\enSkkdA.exe
  2⤵
  PID:3356
- C:\Windows\System\qFWfCtd.exe
  C:\Windows\System\qFWfCtd.exe
  2⤵
  PID:3372
- C:\Windows\System\xqGUQfo.exe
  C:\Windows\System\xqGUQfo.exe
  2⤵
  PID:3388
- C:\Windows\System\giLSKOd.exe
  C:\Windows\System\giLSKOd.exe
  2⤵
  PID:3404
- C:\Windows\System\OUdhjvO.exe
  C:\Windows\System\OUdhjvO.exe
  2⤵
  PID:3420
- C:\Windows\System\MhjSMyX.exe
  C:\Windows\System\MhjSMyX.exe
  2⤵
  PID:3436
- C:\Windows\System\oVAJSNi.exe
  C:\Windows\System\oVAJSNi.exe
  2⤵
  PID:3452
- C:\Windows\System\FywKSjY.exe
  C:\Windows\System\FywKSjY.exe
  2⤵
  PID:3468
- C:\Windows\System\effjBzn.exe
  C:\Windows\System\effjBzn.exe
  2⤵
  PID:3484
- C:\Windows\System\lJeyoQw.exe
  C:\Windows\System\lJeyoQw.exe
  2⤵
  PID:3500
- C:\Windows\System\DGRiUWI.exe
  C:\Windows\System\DGRiUWI.exe
  2⤵
  PID:3516
- C:\Windows\System\MyJtZkH.exe
  C:\Windows\System\MyJtZkH.exe
  2⤵
  PID:3532
- C:\Windows\System\YYTMuuT.exe
  C:\Windows\System\YYTMuuT.exe
  2⤵
  PID:3548
- C:\Windows\System\SlTJjab.exe
  C:\Windows\System\SlTJjab.exe
  2⤵
  PID:3564
- C:\Windows\System\NJFABlZ.exe
  C:\Windows\System\NJFABlZ.exe
  2⤵
  PID:3580
- C:\Windows\System\PhBfmSf.exe
  C:\Windows\System\PhBfmSf.exe
  2⤵
  PID:3596
- C:\Windows\System\cfcTaAv.exe
  C:\Windows\System\cfcTaAv.exe
  2⤵
  PID:3612
- C:\Windows\System\gtnREbA.exe
  C:\Windows\System\gtnREbA.exe
  2⤵
  PID:3628
- C:\Windows\System\BxRsbNH.exe
  C:\Windows\System\BxRsbNH.exe
  2⤵
  PID:3644
- C:\Windows\System\dLDhGLO.exe
  C:\Windows\System\dLDhGLO.exe
  2⤵
  PID:3660
- C:\Windows\System\mUGRsJV.exe
  C:\Windows\System\mUGRsJV.exe
  2⤵
  PID:3676
- C:\Windows\System\yVizGEq.exe
  C:\Windows\System\yVizGEq.exe
  2⤵
  PID:3692
- C:\Windows\System\PhHybPS.exe
  C:\Windows\System\PhHybPS.exe
  2⤵
  PID:3708
- C:\Windows\System\UvdvBYV.exe
  C:\Windows\System\UvdvBYV.exe
  2⤵
  PID:3724
- C:\Windows\System\zFBUVyB.exe
  C:\Windows\System\zFBUVyB.exe
  2⤵
  PID:3740
- C:\Windows\System\enawJuv.exe
  C:\Windows\System\enawJuv.exe
  2⤵
  PID:3756
- C:\Windows\System\bAidlSn.exe
  C:\Windows\System\bAidlSn.exe
  2⤵
  PID:3772
- C:\Windows\System\RVfMmcQ.exe
  C:\Windows\System\RVfMmcQ.exe
  2⤵
  PID:3788
- C:\Windows\System\FdQYlTb.exe
  C:\Windows\System\FdQYlTb.exe
  2⤵
  PID:3804
- C:\Windows\System\rLZMMCS.exe
  C:\Windows\System\rLZMMCS.exe
  2⤵
  PID:3820
- C:\Windows\System\imUwFJG.exe
  C:\Windows\System\imUwFJG.exe
  2⤵
  PID:3836
- C:\Windows\System\QFOCVpL.exe
  C:\Windows\System\QFOCVpL.exe
  2⤵
  PID:3852
- C:\Windows\System\cGUiEng.exe
  C:\Windows\System\cGUiEng.exe
  2⤵
  PID:3868
- C:\Windows\System\WVJwlKZ.exe
  C:\Windows\System\WVJwlKZ.exe
  2⤵
  PID:3884
- C:\Windows\System\FpQigng.exe
  C:\Windows\System\FpQigng.exe
  2⤵
  PID:3904
- C:\Windows\System\ZBPryRG.exe
  C:\Windows\System\ZBPryRG.exe
  2⤵
  PID:3920
- C:\Windows\System\wTahjyj.exe
  C:\Windows\System\wTahjyj.exe
  2⤵
  PID:3936
- C:\Windows\System\KPFqxqE.exe
  C:\Windows\System\KPFqxqE.exe
  2⤵
  PID:3952
- C:\Windows\System\KcGfFtm.exe
  C:\Windows\System\KcGfFtm.exe
  2⤵
  PID:3968
- C:\Windows\System\vusxARi.exe
  C:\Windows\System\vusxARi.exe
  2⤵
  PID:3984
- C:\Windows\System\gBPgdaM.exe
  C:\Windows\System\gBPgdaM.exe
  2⤵
  PID:4000
- C:\Windows\System\YdMXIfJ.exe
  C:\Windows\System\YdMXIfJ.exe
  2⤵
  PID:4016
- C:\Windows\System\muIWgfS.exe
  C:\Windows\System\muIWgfS.exe
  2⤵
  PID:4032
- C:\Windows\System\VmxhUUI.exe
  C:\Windows\System\VmxhUUI.exe
  2⤵
  PID:4048
- C:\Windows\System\kXSFbQW.exe
  C:\Windows\System\kXSFbQW.exe
  2⤵
  PID:4064
- C:\Windows\System\FCIggkV.exe
  C:\Windows\System\FCIggkV.exe
  2⤵
  PID:4080
- C:\Windows\System\XWAlGKF.exe
  C:\Windows\System\XWAlGKF.exe
  2⤵
  PID:1200
- C:\Windows\System\aJwlDiP.exe
  C:\Windows\System\aJwlDiP.exe
  2⤵
  PID:2248
- C:\Windows\System\neazvFT.exe
  C:\Windows\System\neazvFT.exe
  2⤵
  PID:1928
- C:\Windows\System\aNhhqUt.exe
  C:\Windows\System\aNhhqUt.exe
  2⤵
  PID:604
- C:\Windows\System\AiWEkmR.exe
  C:\Windows\System\AiWEkmR.exe
  2⤵
  PID:2660
- C:\Windows\System\PAnsjSB.exe
  C:\Windows\System\PAnsjSB.exe
  2⤵
  PID:3108
- C:\Windows\System\rnnTDMk.exe
  C:\Windows\System\rnnTDMk.exe
  2⤵
  PID:3172
- C:\Windows\System\ahyzVcz.exe
  C:\Windows\System\ahyzVcz.exe
  2⤵
  PID:3208
- C:\Windows\System\AhhINkt.exe
  C:\Windows\System\AhhINkt.exe
  2⤵
  PID:3240
- C:\Windows\System\PYsuUaU.exe
  C:\Windows\System\PYsuUaU.exe
  2⤵
  PID:1640
- C:\Windows\System\mzWIerg.exe
  C:\Windows\System\mzWIerg.exe
  2⤵
  PID:1624
- C:\Windows\System\gpJqVSs.exe
  C:\Windows\System\gpJqVSs.exe
  2⤵
  PID:3396
- C:\Windows\System\gKaQsnx.exe
  C:\Windows\System\gKaQsnx.exe
  2⤵
  PID:3432
- C:\Windows\System\QGNZAIy.exe
  C:\Windows\System\QGNZAIy.exe
  2⤵
  PID:3464
- C:\Windows\System\lgdLuMq.exe
  C:\Windows\System\lgdLuMq.exe
  2⤵
  PID:3528
- C:\Windows\System\QMwsLjI.exe
  C:\Windows\System\QMwsLjI.exe
  2⤵
  PID:3588
- C:\Windows\System\jnLEiqA.exe
  C:\Windows\System\jnLEiqA.exe
  2⤵
  PID:3592
- C:\Windows\System\wwLVPGY.exe
  C:\Windows\System\wwLVPGY.exe
  2⤵
  PID:2064
- C:\Windows\System\EHGpmtv.exe
  C:\Windows\System\EHGpmtv.exe
  2⤵
  PID:1532
- C:\Windows\System\xjTsNQo.exe
  C:\Windows\System\xjTsNQo.exe
  2⤵
  PID:4244
- C:\Windows\System\YUJRqxg.exe
  C:\Windows\System\YUJRqxg.exe
  2⤵
  PID:4260
- C:\Windows\System\nRzkXQX.exe
  C:\Windows\System\nRzkXQX.exe
  2⤵
  PID:4276
- C:\Windows\System\OwGmUjY.exe
  C:\Windows\System\OwGmUjY.exe
  2⤵
  PID:4292
- C:\Windows\System\FGvayNe.exe
  C:\Windows\System\FGvayNe.exe
  2⤵
  PID:4308
- C:\Windows\System\inwTOtE.exe
  C:\Windows\System\inwTOtE.exe
  2⤵
  PID:4324
- C:\Windows\System\KWtaTCF.exe
  C:\Windows\System\KWtaTCF.exe
  2⤵
  PID:4340
- C:\Windows\System\voHcyei.exe
  C:\Windows\System\voHcyei.exe
  2⤵
  PID:4356
- C:\Windows\System\bZhepQK.exe
  C:\Windows\System\bZhepQK.exe
  2⤵
  PID:4372
- C:\Windows\System\aYuNejI.exe
  C:\Windows\System\aYuNejI.exe
  2⤵
  PID:4388
- C:\Windows\System\tfArgiS.exe
  C:\Windows\System\tfArgiS.exe
  2⤵
  PID:4404
- C:\Windows\System\koAWXXb.exe
  C:\Windows\System\koAWXXb.exe
  2⤵
  PID:4420
- C:\Windows\System\pdGAfHg.exe
  C:\Windows\System\pdGAfHg.exe
  2⤵
  PID:4436
- C:\Windows\System\JEgJXSf.exe
  C:\Windows\System\JEgJXSf.exe
  2⤵
  PID:4452
- C:\Windows\System\WJbpcUv.exe
  C:\Windows\System\WJbpcUv.exe
  2⤵
  PID:4468
- C:\Windows\System\TggcVID.exe
  C:\Windows\System\TggcVID.exe
  2⤵
  PID:4484
- C:\Windows\System\MVQPNvm.exe
  C:\Windows\System\MVQPNvm.exe
  2⤵
  PID:4500
- C:\Windows\System\BwZFzbE.exe
  C:\Windows\System\BwZFzbE.exe
  2⤵
  PID:4516
- C:\Windows\System\EHdFPbD.exe
  C:\Windows\System\EHdFPbD.exe
  2⤵
  PID:4532
- C:\Windows\System\KiiNxKP.exe
  C:\Windows\System\KiiNxKP.exe
  2⤵
  PID:4548
- C:\Windows\System\NIvUvzr.exe
  C:\Windows\System\NIvUvzr.exe
  2⤵
  PID:4564
- C:\Windows\System\LHxjSKG.exe
  C:\Windows\System\LHxjSKG.exe
  2⤵
  PID:4580
- C:\Windows\System\yHepaNG.exe
  C:\Windows\System\yHepaNG.exe
  2⤵
  PID:4596
- C:\Windows\System\odpAvBT.exe
  C:\Windows\System\odpAvBT.exe
  2⤵
  PID:4612
- C:\Windows\System\lXtiEpW.exe
  C:\Windows\System\lXtiEpW.exe
  2⤵
  PID:4628
- C:\Windows\System\UQtNOXJ.exe
  C:\Windows\System\UQtNOXJ.exe
  2⤵
  PID:4644
- C:\Windows\System\pptIIAy.exe
  C:\Windows\System\pptIIAy.exe
  2⤵
  PID:4660
- C:\Windows\System\neeZRru.exe
  C:\Windows\System\neeZRru.exe
  2⤵
  PID:4676
- C:\Windows\System\YqaTHAh.exe
  C:\Windows\System\YqaTHAh.exe
  2⤵
  PID:4692
- C:\Windows\System\NDdRnDL.exe
  C:\Windows\System\NDdRnDL.exe
  2⤵
  PID:4708
- C:\Windows\System\qnjLYbn.exe
  C:\Windows\System\qnjLYbn.exe
  2⤵
  PID:4788
- C:\Windows\System\JqNIyUb.exe
  C:\Windows\System\JqNIyUb.exe
  2⤵
  PID:4948
- C:\Windows\System\MXINJKt.exe
  C:\Windows\System\MXINJKt.exe
  2⤵
  PID:4964
- C:\Windows\System\oUBwjuc.exe
  C:\Windows\System\oUBwjuc.exe
  2⤵
  PID:4980
- C:\Windows\System\eDXAWaU.exe
  C:\Windows\System\eDXAWaU.exe
  2⤵
  PID:4996
- C:\Windows\System\JNGrqmm.exe
  C:\Windows\System\JNGrqmm.exe
  2⤵
  PID:5012
- C:\Windows\System\pbdhVkh.exe
  C:\Windows\System\pbdhVkh.exe
  2⤵
  PID:5028
- C:\Windows\System\TaXRxqy.exe
  C:\Windows\System\TaXRxqy.exe
  2⤵
  PID:5044
- C:\Windows\System\buLWIVJ.exe
  C:\Windows\System\buLWIVJ.exe
  2⤵
  PID:5060
- C:\Windows\System\DsoIxSY.exe
  C:\Windows\System\DsoIxSY.exe
  2⤵
  PID:5076
- C:\Windows\System\qLuSvCA.exe
  C:\Windows\System\qLuSvCA.exe
  2⤵
  PID:5096
- C:\Windows\System\vqhJlDs.exe
  C:\Windows\System\vqhJlDs.exe
  2⤵
  PID:5112
- C:\Windows\System\mACAoMH.exe
  C:\Windows\System\mACAoMH.exe
  2⤵
  PID:3720
- C:\Windows\System\frUGoBV.exe
  C:\Windows\System\frUGoBV.exe
  2⤵
  PID:3780
- C:\Windows\System\MqGIBmh.exe
  C:\Windows\System\MqGIBmh.exe
  2⤵
  PID:3848
- C:\Windows\System\YwlYmtj.exe
  C:\Windows\System\YwlYmtj.exe
  2⤵
  PID:3916
- C:\Windows\System\KHWNfDg.exe
  C:\Windows\System\KHWNfDg.exe
  2⤵
  PID:4008
- C:\Windows\System\SboxDFi.exe
  C:\Windows\System\SboxDFi.exe
  2⤵
  PID:4072
- C:\Windows\System\UtrTdRZ.exe
  C:\Windows\System\UtrTdRZ.exe
  2⤵
  PID:2612
- C:\Windows\System\sRkmsZZ.exe
  C:\Windows\System\sRkmsZZ.exe
  2⤵
  PID:1512
- C:\Windows\System\EWKILuH.exe
  C:\Windows\System\EWKILuH.exe
  2⤵
  PID:3368
- C:\Windows\System\vWfimQr.exe
  C:\Windows\System\vWfimQr.exe
  2⤵
  PID:3560
- C:\Windows\System\rWrnwrd.exe
  C:\Windows\System\rWrnwrd.exe
  2⤵
  PID:348
- C:\Windows\System\HbBpHkv.exe
  C:\Windows\System\HbBpHkv.exe
  2⤵
  PID:3652
- C:\Windows\System\wTmQpbH.exe
  C:\Windows\System\wTmQpbH.exe
  2⤵
  PID:2548
- C:\Windows\System\cKeTjNc.exe
  C:\Windows\System\cKeTjNc.exe
  2⤵
  PID:4100
- C:\Windows\System\cmgiKzH.exe
  C:\Windows\System\cmgiKzH.exe
  2⤵
  PID:4120
- C:\Windows\System\DlpvQYk.exe
  C:\Windows\System\DlpvQYk.exe
  2⤵
  PID:4140
- C:\Windows\System\MXlOfeY.exe
  C:\Windows\System\MXlOfeY.exe
  2⤵
  PID:4156
- C:\Windows\System\KQVYSwT.exe
  C:\Windows\System\KQVYSwT.exe
  2⤵
  PID:4172
- C:\Windows\System\RTEZXDu.exe
  C:\Windows\System\RTEZXDu.exe
  2⤵
  PID:4188
- C:\Windows\System\wefvmWF.exe
  C:\Windows\System\wefvmWF.exe
  2⤵
  PID:4204
- C:\Windows\System\rfAVTfw.exe
  C:\Windows\System\rfAVTfw.exe
  2⤵
  PID:4220
- C:\Windows\System\lbmgpkc.exe
  C:\Windows\System\lbmgpkc.exe
  2⤵
  PID:4236
- C:\Windows\System\asnpkoG.exe
  C:\Windows\System\asnpkoG.exe
  2⤵
  PID:4336
- C:\Windows\System\HklJFmX.exe
  C:\Windows\System\HklJFmX.exe
  2⤵
  PID:4460
- C:\Windows\System\uyXsOhX.exe
  C:\Windows\System\uyXsOhX.exe
  2⤵
  PID:4524
- C:\Windows\System\DcGClJQ.exe
  C:\Windows\System\DcGClJQ.exe
  2⤵
  PID:4588
- C:\Windows\System\SksYGGE.exe
  C:\Windows\System\SksYGGE.exe
  2⤵
  PID:4652
- C:\Windows\System\hMHhdSG.exe
  C:\Windows\System\hMHhdSG.exe
  2⤵
  PID:4716
- C:\Windows\System\txpXLCH.exe
  C:\Windows\System\txpXLCH.exe
  2⤵
  PID:4740
- C:\Windows\System\MpdTxBr.exe
  C:\Windows\System\MpdTxBr.exe
  2⤵
  PID:4756
- C:\Windows\System\iQXyOdV.exe
  C:\Windows\System\iQXyOdV.exe
  2⤵
  PID:4772
- C:\Windows\System\RaYLSiD.exe
  C:\Windows\System\RaYLSiD.exe
  2⤵
  PID:4720
- C:\Windows\System\WBcgVAc.exe
  C:\Windows\System\WBcgVAc.exe
  2⤵
  PID:3508
- C:\Windows\System\RwbbQEN.exe
  C:\Windows\System\RwbbQEN.exe
  2⤵
  PID:3732
- C:\Windows\System\AizcZbg.exe
  C:\Windows\System\AizcZbg.exe
  2⤵
  PID:1752
- C:\Windows\System\efsrFgd.exe
  C:\Windows\System\efsrFgd.exe
  2⤵
  PID:3192
- C:\Windows\System\ewQqqfQ.exe
  C:\Windows\System\ewQqqfQ.exe
  2⤵
  PID:2244
- C:\Windows\System\EOAzViV.exe
  C:\Windows\System\EOAzViV.exe
  2⤵
  PID:2060
- C:\Windows\System\KtvxoJZ.exe
  C:\Windows\System\KtvxoJZ.exe
  2⤵
  PID:1664
- C:\Windows\System\tNRvcrE.exe
  C:\Windows\System\tNRvcrE.exe
  2⤵
  PID:2520
- C:\Windows\System\nchkGLm.exe
  C:\Windows\System\nchkGLm.exe
  2⤵
  PID:2032
- C:\Windows\System\WnVxukp.exe
  C:\Windows\System\WnVxukp.exe
  2⤵
  PID:4088
- C:\Windows\System\cEJvVdv.exe
  C:\Windows\System\cEJvVdv.exe
  2⤵
  PID:2972
- C:\Windows\System\VdyMhTf.exe
  C:\Windows\System\VdyMhTf.exe
  2⤵
  PID:5020
- C:\Windows\System\ZRVHfGI.exe
  C:\Windows\System\ZRVHfGI.exe
  2⤵
  PID:5084
- C:\Windows\System\UzlWSSs.exe
  C:\Windows\System\UzlWSSs.exe
  2⤵
  PID:3716
- C:\Windows\System\BaTJzcm.exe
  C:\Windows\System\BaTJzcm.exe
  2⤵
  PID:3976
- C:\Windows\System\Jdkntvi.exe
  C:\Windows\System\Jdkntvi.exe
  2⤵
  PID:2648
- C:\Windows\System\QLHmhQb.exe
  C:\Windows\System\QLHmhQb.exe
  2⤵
  PID:764
- C:\Windows\System\LGftZzd.exe
  C:\Windows\System\LGftZzd.exe
  2⤵
  PID:4112
- C:\Windows\System\OKxdodD.exe
  C:\Windows\System\OKxdodD.exe
  2⤵
  PID:4180
- C:\Windows\System\ycUPFec.exe
  C:\Windows\System\ycUPFec.exe
  2⤵
  PID:1724
- C:\Windows\System\WcuVNqT.exe
  C:\Windows\System\WcuVNqT.exe
  2⤵
  PID:4300
- C:\Windows\System\urAhOkY.exe
  C:\Windows\System\urAhOkY.exe
  2⤵
  PID:5168
- C:\Windows\System\sblyzKC.exe
  C:\Windows\System\sblyzKC.exe
  2⤵
  PID:5188
- C:\Windows\System\Coskfcq.exe
  C:\Windows\System\Coskfcq.exe
  2⤵
  PID:5204
- C:\Windows\System\mmnbfnO.exe
  C:\Windows\System\mmnbfnO.exe
  2⤵
  PID:5220
- C:\Windows\System\PVdKMSC.exe
  C:\Windows\System\PVdKMSC.exe
  2⤵
  PID:5240
- C:\Windows\System\zPyrUZM.exe
  C:\Windows\System\zPyrUZM.exe
  2⤵
  PID:5256
- C:\Windows\System\RqsDgIP.exe
  C:\Windows\System\RqsDgIP.exe
  2⤵
  PID:5280
- C:\Windows\System\dhkuMqp.exe
  C:\Windows\System\dhkuMqp.exe
  2⤵
  PID:5300
- C:\Windows\System\ukBrbQr.exe
  C:\Windows\System\ukBrbQr.exe
  2⤵
  PID:5444
- C:\Windows\System\ObHkWeu.exe
  C:\Windows\System\ObHkWeu.exe
  2⤵
  PID:5488
- C:\Windows\System\kDTpQig.exe
  C:\Windows\System\kDTpQig.exe
  2⤵
  PID:5508
- C:\Windows\System\qqpqKLU.exe
  C:\Windows\System\qqpqKLU.exe
  2⤵
  PID:5524
- C:\Windows\System\TOBQQbs.exe
  C:\Windows\System\TOBQQbs.exe
  2⤵
  PID:5540
- C:\Windows\System\OIIdvkY.exe
  C:\Windows\System\OIIdvkY.exe
  2⤵
  PID:5556
- C:\Windows\System\icpgOmt.exe
  C:\Windows\System\icpgOmt.exe
  2⤵
  PID:5572
- C:\Windows\System\bUuZycJ.exe
  C:\Windows\System\bUuZycJ.exe
  2⤵
  PID:5588
- C:\Windows\System\PhXJUhM.exe
  C:\Windows\System\PhXJUhM.exe
  2⤵
  PID:5608
- C:\Windows\System\hBsGRbu.exe
  C:\Windows\System\hBsGRbu.exe
  2⤵
  PID:5624
- C:\Windows\System\wiTyCPw.exe
  C:\Windows\System\wiTyCPw.exe
  2⤵
  PID:5640
- C:\Windows\System\AmdexOA.exe
  C:\Windows\System\AmdexOA.exe
  2⤵
  PID:5664
- C:\Windows\System\odMcURW.exe
  C:\Windows\System\odMcURW.exe
  2⤵
  PID:5740
- C:\Windows\System\LtlsBla.exe
  C:\Windows\System\LtlsBla.exe
  2⤵
  PID:5760
- C:\Windows\System\gYLKGxJ.exe
  C:\Windows\System\gYLKGxJ.exe
  2⤵
  PID:5788
- C:\Windows\System\iNjOOZU.exe
  C:\Windows\System\iNjOOZU.exe
  2⤵
  PID:5808
- C:\Windows\System\vTLsVCi.exe
  C:\Windows\System\vTLsVCi.exe
  2⤵
  PID:5828
- C:\Windows\System\lfZzftz.exe
  C:\Windows\System\lfZzftz.exe
  2⤵
  PID:5844
- C:\Windows\System\KEsZVwW.exe
  C:\Windows\System\KEsZVwW.exe
  2⤵
  PID:5860
- C:\Windows\System\jRWFlCE.exe
  C:\Windows\System\jRWFlCE.exe
  2⤵
  PID:5876
- C:\Windows\System\JsfBFVx.exe
  C:\Windows\System\JsfBFVx.exe
  2⤵
  PID:5896
- C:\Windows\System\uEMwlmw.exe
  C:\Windows\System\uEMwlmw.exe
  2⤵
  PID:5916
- C:\Windows\System\ZwdXZvX.exe
  C:\Windows\System\ZwdXZvX.exe
  2⤵
  PID:5932
- C:\Windows\System\veSUaZY.exe
  C:\Windows\System\veSUaZY.exe
  2⤵
  PID:5948
- C:\Windows\System\BtiaBRl.exe
  C:\Windows\System\BtiaBRl.exe
  2⤵
  PID:5964
- C:\Windows\System\JcxjiFi.exe
  C:\Windows\System\JcxjiFi.exe
  2⤵
  PID:5988
- C:\Windows\System\aoOKiOt.exe
  C:\Windows\System\aoOKiOt.exe
  2⤵
  PID:6004
- C:\Windows\System\EsAuWVp.exe
  C:\Windows\System\EsAuWVp.exe
  2⤵
  PID:6020
- C:\Windows\System\HaEGdhg.exe
  C:\Windows\System\HaEGdhg.exe
  2⤵
  PID:6040
- C:\Windows\System\CbthbjM.exe
  C:\Windows\System\CbthbjM.exe
  2⤵
  PID:4148
- C:\Windows\System\DYhfIAJ.exe
  C:\Windows\System\DYhfIAJ.exe
  2⤵
  PID:4492
- C:\Windows\System\WwIMbYN.exe
  C:\Windows\System\WwIMbYN.exe
  2⤵
  PID:5180
- C:\Windows\System\EnnVWLv.exe
  C:\Windows\System\EnnVWLv.exe
  2⤵
  PID:3048
- C:\Windows\System\ryWnjcQ.exe
  C:\Windows\System\ryWnjcQ.exe
  2⤵
  PID:4252
- C:\Windows\System\UuPXcpZ.exe
  C:\Windows\System\UuPXcpZ.exe
  2⤵
  PID:3284
- C:\Windows\System\KMhqYct.exe
  C:\Windows\System\KMhqYct.exe
  2⤵
  PID:4684
- C:\Windows\System\oqVtIWz.exe
  C:\Windows\System\oqVtIWz.exe
  2⤵
  PID:4784
- C:\Windows\System\OwbmwGC.exe
  C:\Windows\System\OwbmwGC.exe
  2⤵
  PID:1368
- C:\Windows\System\NxIAWQz.exe
  C:\Windows\System\NxIAWQz.exe
  2⤵
  PID:3348
- C:\Windows\System\YeYczvS.exe
  C:\Windows\System\YeYczvS.exe
  2⤵
  PID:3412
- C:\Windows\System\WdNFHfS.exe
  C:\Windows\System\WdNFHfS.exe
  2⤵
  PID:3476
- C:\Windows\System\RklYIjx.exe
  C:\Windows\System\RklYIjx.exe
  2⤵
  PID:3544
- C:\Windows\System\ASKgqPK.exe
  C:\Windows\System\ASKgqPK.exe
  2⤵
  PID:3640
- C:\Windows\System\dLNJTuN.exe
  C:\Windows\System\dLNJTuN.exe
  2⤵
  PID:3704
- C:\Windows\System\VzOWmoA.exe
  C:\Windows\System\VzOWmoA.exe
  2⤵
  PID:3800
- C:\Windows\System\CqgcdDh.exe
  C:\Windows\System\CqgcdDh.exe
  2⤵
  PID:3896
- C:\Windows\System\dFyBbEw.exe
  C:\Windows\System\dFyBbEw.exe
  2⤵
  PID:3960
- C:\Windows\System\OODZQxX.exe
  C:\Windows\System\OODZQxX.exe
  2⤵
  PID:4024
- C:\Windows\System\QSOHTbP.exe
  C:\Windows\System\QSOHTbP.exe
  2⤵
  PID:536
- C:\Windows\System\oogAuNm.exe
  C:\Windows\System\oogAuNm.exe
  2⤵
  PID:3156
- C:\Windows\System\GnHIFDV.exe
  C:\Windows\System\GnHIFDV.exe
  2⤵
  PID:1700
- C:\Windows\System\cFxCHGK.exe
  C:\Windows\System\cFxCHGK.exe
  2⤵
  PID:2964
- C:\Windows\System\UmnOghF.exe
  C:\Windows\System\UmnOghF.exe
  2⤵
  PID:1012
- C:\Windows\System\nfrVDus.exe
  C:\Windows\System\nfrVDus.exe
  2⤵
  PID:1268
- C:\Windows\System\NIeciyi.exe
  C:\Windows\System\NIeciyi.exe
  2⤵
  PID:4284
- C:\Windows\System\bEczbLc.exe
  C:\Windows\System\bEczbLc.exe
  2⤵
  PID:4380
- C:\Windows\System\DBOkLHT.exe
  C:\Windows\System\DBOkLHT.exe
  2⤵
  PID:4448
- C:\Windows\System\KvFHpwM.exe
  C:\Windows\System\KvFHpwM.exe
  2⤵
  PID:4544
- C:\Windows\System\dsLvtSP.exe
  C:\Windows\System\dsLvtSP.exe
  2⤵
  PID:4608
- C:\Windows\System\CLAYCWG.exe
  C:\Windows\System\CLAYCWG.exe
  2⤵
  PID:4836
- C:\Windows\System\Tlngyka.exe
  C:\Windows\System\Tlngyka.exe
  2⤵
  PID:4860
- C:\Windows\System\yxsyEJC.exe
  C:\Windows\System\yxsyEJC.exe
  2⤵
  PID:3204
- C:\Windows\System\NNDRbqc.exe
  C:\Windows\System\NNDRbqc.exe
  2⤵
  PID:2412
- C:\Windows\System\kTMjHES.exe
  C:\Windows\System\kTMjHES.exe
  2⤵
  PID:4132
- C:\Windows\System\kRQTWVg.exe
  C:\Windows\System\kRQTWVg.exe
  2⤵
  PID:4368
- C:\Windows\System\IbOnkbe.exe
  C:\Windows\System\IbOnkbe.exe
  2⤵
  PID:3224
- C:\Windows\System\wVyolsP.exe
  C:\Windows\System\wVyolsP.exe
  2⤵
  PID:2000
- C:\Windows\System\SOQxWhQ.exe
  C:\Windows\System\SOQxWhQ.exe
  2⤵
  PID:4992
- C:\Windows\System\xIkaASY.exe
  C:\Windows\System\xIkaASY.exe
  2⤵
  PID:2544
- C:\Windows\System\UufkjQl.exe
  C:\Windows\System\UufkjQl.exe
  2⤵
  PID:4332
- C:\Windows\System\WAcbtpk.exe
  C:\Windows\System\WAcbtpk.exe
  2⤵
  PID:3144
- C:\Windows\System\aLVcBvX.exe
  C:\Windows\System\aLVcBvX.exe
  2⤵
  PID:2552
- C:\Windows\System\JdyLHgg.exe
  C:\Windows\System\JdyLHgg.exe
  2⤵
  PID:3428
- C:\Windows\System\XvPoklw.exe
  C:\Windows\System\XvPoklw.exe
  2⤵
  PID:5128
- C:\Windows\System\nZKsJcy.exe
  C:\Windows\System\nZKsJcy.exe
  2⤵
  PID:5144
- C:\Windows\System\grqNUAA.exe
  C:\Windows\System\grqNUAA.exe
  2⤵
  PID:5164
- C:\Windows\System\kOJbajB.exe
  C:\Windows\System\kOJbajB.exe
  2⤵
  PID:5236
- C:\Windows\System\MFwMYKy.exe
  C:\Windows\System\MFwMYKy.exe
  2⤵
  PID:5308
- C:\Windows\System\KUDHPLt.exe
  C:\Windows\System\KUDHPLt.exe
  2⤵
  PID:4476
- C:\Windows\System\aevEWkt.exe
  C:\Windows\System\aevEWkt.exe
  2⤵
  PID:5340
- C:\Windows\System\lwoXNGD.exe
  C:\Windows\System\lwoXNGD.exe
  2⤵
  PID:5356
- C:\Windows\System\sedvbUw.exe
  C:\Windows\System\sedvbUw.exe
  2⤵
  PID:5376
- C:\Windows\System\wRMgkbH.exe
  C:\Windows\System\wRMgkbH.exe
  2⤵
  PID:5392
- C:\Windows\System\aALrfOe.exe
  C:\Windows\System\aALrfOe.exe
  2⤵
  PID:5412
- C:\Windows\System\hDYJgrv.exe
  C:\Windows\System\hDYJgrv.exe
  2⤵
  PID:2536
- C:\Windows\System\TamVBko.exe
  C:\Windows\System\TamVBko.exe
  2⤵
  PID:5520
- C:\Windows\System\RWjuAtR.exe
  C:\Windows\System\RWjuAtR.exe
  2⤵
  PID:5616
- C:\Windows\System\mnMMGci.exe
  C:\Windows\System\mnMMGci.exe
  2⤵
  PID:5656
- C:\Windows\System\OUAyXOX.exe
  C:\Windows\System\OUAyXOX.exe
  2⤵
  PID:5696
- C:\Windows\System\qXqcUby.exe
  C:\Windows\System\qXqcUby.exe
  2⤵
  PID:5712
- C:\Windows\System\EhvehRx.exe
  C:\Windows\System\EhvehRx.exe
  2⤵
  PID:1932
- C:\Windows\System\mXVOMMS.exe
  C:\Windows\System\mXVOMMS.exe
  2⤵
  PID:5736
- C:\Windows\System\bwZbJZp.exe
  C:\Windows\System\bwZbJZp.exe
  2⤵
  PID:1696
- C:\Windows\System\qfzPyrI.exe
  C:\Windows\System\qfzPyrI.exe
  2⤵
  PID:5780
- C:\Windows\System\FfGVbTg.exe
  C:\Windows\System\FfGVbTg.exe
  2⤵
  PID:5836
- C:\Windows\System\wGFVSes.exe
  C:\Windows\System\wGFVSes.exe
  2⤵
  PID:5904
- C:\Windows\System\cnFhwUG.exe
  C:\Windows\System\cnFhwUG.exe
  2⤵
  PID:6048
- C:\Windows\System\ZrpMDPM.exe
  C:\Windows\System\ZrpMDPM.exe
  2⤵
  PID:5940
- C:\Windows\System\SLKxbXq.exe
  C:\Windows\System\SLKxbXq.exe
  2⤵
  PID:5784
- C:\Windows\System\ylCzcgM.exe
  C:\Windows\System\ylCzcgM.exe
  2⤵
  PID:6028
- C:\Windows\System\ZsmHYuN.exe
  C:\Windows\System\ZsmHYuN.exe
  2⤵
  PID:5824
- C:\Windows\System\QPZnpbC.exe
  C:\Windows\System\QPZnpbC.exe
  2⤵
  PID:5892
- C:\Windows\System\CfierxL.exe
  C:\Windows\System\CfierxL.exe
  2⤵
  PID:5960
- C:\Windows\System\EwSOQRU.exe
  C:\Windows\System\EwSOQRU.exe
  2⤵
  PID:6060
- C:\Windows\System\vpKkPwe.exe
  C:\Windows\System\vpKkPwe.exe
  2⤵
  PID:6076
- C:\Windows\System\imiWrmZ.exe
  C:\Windows\System\imiWrmZ.exe
  2⤵
  PID:6096
- C:\Windows\System\fJnECWH.exe
  C:\Windows\System\fJnECWH.exe
  2⤵
  PID:6108
- C:\Windows\System\vKBLJsV.exe
  C:\Windows\System\vKBLJsV.exe
  2⤵
  PID:6120
- C:\Windows\System\FWVvlME.exe
  C:\Windows\System\FWVvlME.exe
  2⤵
  PID:6140
- C:\Windows\System\MgbfiLF.exe
  C:\Windows\System\MgbfiLF.exe
  2⤵
  PID:2892
- C:\Windows\System\yxAmoXx.exe
  C:\Windows\System\yxAmoXx.exe
  2⤵
  PID:2516
- C:\Windows\System\lzkLshC.exe
  C:\Windows\System\lzkLshC.exe
  2⤵
  PID:4764
- C:\Windows\System\ceUhyrt.exe
  C:\Windows\System\ceUhyrt.exe
  2⤵
  PID:3796
- C:\Windows\System\DtvaYnf.exe
  C:\Windows\System\DtvaYnf.exe
  2⤵
  PID:2980
- C:\Windows\System\OuYCWRn.exe
  C:\Windows\System\OuYCWRn.exe
  2⤵
  PID:2628
- C:\Windows\System\DppsyHI.exe
  C:\Windows\System\DppsyHI.exe
  2⤵
  PID:4092
- C:\Windows\System\TsdzbYe.exe
  C:\Windows\System\TsdzbYe.exe
  2⤵
  PID:3948
- C:\Windows\System\AhPnvOr.exe
  C:\Windows\System\AhPnvOr.exe
  2⤵
  PID:1068
- C:\Windows\System\xXrCTLw.exe
  C:\Windows\System\xXrCTLw.exe
  2⤵
  PID:2296
- C:\Windows\System\GDNpjsl.exe
  C:\Windows\System\GDNpjsl.exe
  2⤵
  PID:1304
- C:\Windows\System\PkOROCZ.exe
  C:\Windows\System\PkOROCZ.exe
  2⤵
  PID:1908
- C:\Windows\System\ZBjdriK.exe
  C:\Windows\System\ZBjdriK.exe
  2⤵
  PID:4320
- C:\Windows\System\fOCXxav.exe
  C:\Windows\System\fOCXxav.exe
  2⤵
  PID:4224
- C:\Windows\System\uVajzVs.exe
  C:\Windows\System\uVajzVs.exe
  2⤵
  PID:4560
- C:\Windows\System\QYPXoDz.exe
  C:\Windows\System\QYPXoDz.exe
  2⤵
  PID:2788
- C:\Windows\System\wHSwOom.exe
  C:\Windows\System\wHSwOom.exe
  2⤵
  PID:4752
- C:\Windows\System\XMtzdyq.exe
  C:\Windows\System\XMtzdyq.exe
  2⤵
  PID:3672
- C:\Windows\System\eFKdfPL.exe
  C:\Windows\System\eFKdfPL.exe
  2⤵
  PID:3768
- C:\Windows\System\KrzSDaI.exe
  C:\Windows\System\KrzSDaI.exe
  2⤵
  PID:3992
- C:\Windows\System\fysuvBG.exe
  C:\Windows\System\fysuvBG.exe
  2⤵
  PID:4056
- C:\Windows\System\hhiyTNt.exe
  C:\Windows\System\hhiyTNt.exe
  2⤵
  PID:4256
- C:\Windows\System\mDjLnyb.exe
  C:\Windows\System\mDjLnyb.exe
  2⤵
  PID:4416
- C:\Windows\System\cRecIux.exe
  C:\Windows\System\cRecIux.exe
  2⤵
  PID:2260
- C:\Windows\System\yufChEB.exe
  C:\Windows\System\yufChEB.exe
  2⤵
  PID:3512
- C:\Windows\System\MiFLQkU.exe
  C:\Windows\System\MiFLQkU.exe
  2⤵
  PID:3864
- C:\Windows\System\uSTwUje.exe
  C:\Windows\System\uSTwUje.exe
  2⤵
  PID:4796
- C:\Windows\System\Khdrnjr.exe
  C:\Windows\System\Khdrnjr.exe
  2⤵
  PID:4512
- C:\Windows\System\vUBjPZj.exe
  C:\Windows\System\vUBjPZj.exe
  2⤵
  PID:4704
- C:\Windows\System\eoKsuha.exe
  C:\Windows\System\eoKsuha.exe
  2⤵
  PID:4808
- C:\Windows\System\ooLfFxG.exe
  C:\Windows\System\ooLfFxG.exe
  2⤵
  PID:4824
- C:\Windows\System\hDDBMqe.exe
  C:\Windows\System\hDDBMqe.exe
  2⤵
  PID:4844
- C:\Windows\System\LuwDMGE.exe
  C:\Windows\System\LuwDMGE.exe
  2⤵
  PID:4872
- C:\Windows\System\CAXFNSR.exe
  C:\Windows\System\CAXFNSR.exe
  2⤵
  PID:4888
- C:\Windows\System\LuRiali.exe
  C:\Windows\System\LuRiali.exe
  2⤵
  PID:4916
- C:\Windows\System\nSSwCNO.exe
  C:\Windows\System\nSSwCNO.exe
  2⤵
  PID:4900
- C:\Windows\System\xtToDJt.exe
  C:\Windows\System\xtToDJt.exe
  2⤵
  PID:1916
- C:\Windows\System\iutycFG.exe
  C:\Windows\System\iutycFG.exe
  2⤵
  PID:5008
- C:\Windows\System\xIAyAdk.exe
  C:\Windows\System\xIAyAdk.exe
  2⤵
  PID:5072
- C:\Windows\System\DdHOzfK.exe
  C:\Windows\System\DdHOzfK.exe
  2⤵
  PID:3748
- C:\Windows\System\MJzMmyG.exe
  C:\Windows\System\MJzMmyG.exe
  2⤵
  PID:4044
- C:\Windows\System\eSfKPBc.exe
  C:\Windows\System\eSfKPBc.exe
  2⤵
  PID:4164
- C:\Windows\System\CwwoAEb.exe
  C:\Windows\System\CwwoAEb.exe
  2⤵
  PID:4128
- C:\Windows\System\ljyQPqB.exe
  C:\Windows\System\ljyQPqB.exe
  2⤵
  PID:3052
- C:\Windows\System\ApSCGmq.exe
  C:\Windows\System\ApSCGmq.exe
  2⤵
  PID:5140
- C:\Windows\System\xQtTaXY.exe
  C:\Windows\System\xQtTaXY.exe
  2⤵
  PID:5316
- C:\Windows\System\fbvAzKC.exe
  C:\Windows\System\fbvAzKC.exe
  2⤵
  PID:5380
- C:\Windows\System\hgpwMie.exe
  C:\Windows\System\hgpwMie.exe
  2⤵
  PID:5552
- C:\Windows\System\qpKADaJ.exe
  C:\Windows\System\qpKADaJ.exe
  2⤵
  PID:2168
- C:\Windows\System\GBFXVUs.exe
  C:\Windows\System\GBFXVUs.exe
  2⤵
  PID:5536
- C:\Windows\System\cDhytyg.exe
  C:\Windows\System\cDhytyg.exe
  2⤵
  PID:5568
- C:\Windows\System\EMIHcAP.exe
  C:\Windows\System\EMIHcAP.exe
  2⤵
  PID:5428
- C:\Windows\System\FEedrII.exe
  C:\Windows\System\FEedrII.exe
  2⤵
  PID:5688
- C:\Windows\System\oUyVkfI.exe
  C:\Windows\System\oUyVkfI.exe
  2⤵
  PID:5328
- C:\Windows\System\CKQayzq.exe
  C:\Windows\System\CKQayzq.exe
  2⤵
  PID:5336
- C:\Windows\System\nhNRUvJ.exe
  C:\Windows\System\nhNRUvJ.exe
  2⤵
  PID:4212
- C:\Windows\System\RbKaHVW.exe
  C:\Windows\System\RbKaHVW.exe
  2⤵
  PID:3524
- C:\Windows\System\kjSDXDr.exe
  C:\Windows\System\kjSDXDr.exe
  2⤵
  PID:5268
- C:\Windows\System\pELgxjr.exe
  C:\Windows\System\pELgxjr.exe
  2⤵
  PID:5372
- C:\Windows\System\IaIBwEw.exe
  C:\Windows\System\IaIBwEw.exe
  2⤵
  PID:5516
- C:\Windows\System\xXJRtHC.exe
  C:\Windows\System\xXJRtHC.exe
  2⤵
  PID:4780
- C:\Windows\System\GpJJkoK.exe
  C:\Windows\System\GpJJkoK.exe
  2⤵
  PID:5772
- C:\Windows\System\YCawJhd.exe
  C:\Windows\System\YCawJhd.exe
  2⤵
  PID:2932
- C:\Windows\System\DdTntKV.exe
  C:\Windows\System\DdTntKV.exe
  2⤵
  PID:5976
- C:\Windows\System\yIrgVHl.exe
  C:\Windows\System\yIrgVHl.exe
  2⤵
  PID:6128
- C:\Windows\System\JEUkFaT.exe
  C:\Windows\System\JEUkFaT.exe
  2⤵
  PID:6068
- C:\Windows\System\xrQhwhu.exe
  C:\Windows\System\xrQhwhu.exe
  2⤵
  PID:2992
- C:\Windows\System\ITOpSqa.exe
  C:\Windows\System\ITOpSqa.exe
  2⤵
  PID:3316
- C:\Windows\System\pJxhKqt.exe
  C:\Windows\System\pJxhKqt.exe
  2⤵
  PID:5056
- C:\Windows\System\CuoPKrY.exe
  C:\Windows\System\CuoPKrY.exe
  2⤵
  PID:5248
- C:\Windows\System\BKtRsAp.exe
  C:\Windows\System\BKtRsAp.exe
  2⤵
  PID:568
- C:\Windows\System\AWiYVMQ.exe
  C:\Windows\System\AWiYVMQ.exe
  2⤵
  PID:5984
- C:\Windows\System\QNXTJVB.exe
  C:\Windows\System\QNXTJVB.exe
  2⤵
  PID:6084
- C:\Windows\System\LBaXXlf.exe
  C:\Windows\System\LBaXXlf.exe
  2⤵
  PID:4732
- C:\Windows\System\HexHIDE.exe
  C:\Windows\System\HexHIDE.exe
  2⤵
  PID:5776
- C:\Windows\System\eVOHPTS.exe
  C:\Windows\System\eVOHPTS.exe
  2⤵
  PID:5884
- C:\Windows\System\WHoHxqF.exe
  C:\Windows\System\WHoHxqF.exe
  2⤵
  PID:2672
- C:\Windows\System\QdjCqOZ.exe
  C:\Windows\System\QdjCqOZ.exe
  2⤵
  PID:3096
- C:\Windows\System\BDsBpzV.exe
  C:\Windows\System\BDsBpzV.exe
  2⤵
  PID:688
- C:\Windows\System\jLCyxPt.exe
  C:\Windows\System\jLCyxPt.exe
  2⤵
  PID:2744
- C:\Windows\System\hvxPxzN.exe
  C:\Windows\System\hvxPxzN.exe
  2⤵
  PID:5212
- C:\Windows\System\uGtuHHY.exe
  C:\Windows\System\uGtuHHY.exe
  2⤵
  PID:4856
- C:\Windows\System\UhbeRPp.exe
  C:\Windows\System\UhbeRPp.exe
  2⤵
  PID:3444
- C:\Windows\System\XquLKOC.exe
  C:\Windows\System\XquLKOC.exe
  2⤵
  PID:940
- C:\Windows\System\UkgRQMz.exe
  C:\Windows\System\UkgRQMz.exe
  2⤵
  PID:2956
- C:\Windows\System\IxmdmFF.exe
  C:\Windows\System\IxmdmFF.exe
  2⤵
  PID:4928
- C:\Windows\System\SRDXZzU.exe
  C:\Windows\System\SRDXZzU.exe
  2⤵
  PID:4832
- C:\Windows\System\BmCWbcf.exe
  C:\Windows\System\BmCWbcf.exe
  2⤵
  PID:5292
- C:\Windows\System\niTygWs.exe
  C:\Windows\System\niTygWs.exe
  2⤵
  PID:4556
- C:\Windows\System\zIRbOUI.exe
  C:\Windows\System\zIRbOUI.exe
  2⤵
  PID:3608
- C:\Windows\System\VdjMvUt.exe
  C:\Windows\System\VdjMvUt.exe
  2⤵
  PID:4576
- C:\Windows\System\aTyWpMt.exe
  C:\Windows\System\aTyWpMt.exe
  2⤵
  PID:3384
- C:\Windows\System\stOpSXO.exe
  C:\Windows\System\stOpSXO.exe
  2⤵
  PID:4672
- C:\Windows\System\gsyaxkd.exe
  C:\Windows\System\gsyaxkd.exe
  2⤵
  PID:4868
- C:\Windows\System\rfsrAef.exe
  C:\Windows\System\rfsrAef.exe
  2⤵
  PID:4936
- C:\Windows\System\fXRcpGK.exe
  C:\Windows\System\fXRcpGK.exe
  2⤵
  PID:3880
- C:\Windows\System\jcEDtag.exe
  C:\Windows\System\jcEDtag.exe
  2⤵
  PID:4972
- C:\Windows\System\wGteyvl.exe
  C:\Windows\System\wGteyvl.exe
  2⤵
  PID:2780
- C:\Windows\System\bFtMymc.exe
  C:\Windows\System\bFtMymc.exe
  2⤵
  PID:3032
- C:\Windows\System\AihslMQ.exe
  C:\Windows\System\AihslMQ.exe
  2⤵
  PID:5596
- C:\Windows\System\PDZtDOr.exe
  C:\Windows\System\PDZtDOr.exe
  2⤵
  PID:2632
- C:\Windows\System\QlymKio.exe
  C:\Windows\System\QlymKio.exe
  2⤵
  PID:5124
- C:\Windows\System\TyjQuMA.exe
  C:\Windows\System\TyjQuMA.exe
  2⤵
  PID:5728
- C:\Windows\System\CulnVLa.exe
  C:\Windows\System\CulnVLa.exe
  2⤵
  PID:6072
- C:\Windows\System\oxORQig.exe
  C:\Windows\System\oxORQig.exe
  2⤵
  PID:5228
- C:\Windows\System\AGdaVev.exe
  C:\Windows\System\AGdaVev.exe
  2⤵
  PID:5584
- C:\Windows\System\vgLgrpi.exe
  C:\Windows\System\vgLgrpi.exe
  2⤵
  PID:5564
- C:\Windows\System\FAEQRxV.exe
  C:\Windows\System\FAEQRxV.exe
  2⤵
  PID:2752
- C:\Windows\System\TrgLkbE.exe
  C:\Windows\System\TrgLkbE.exe
  2⤵
  PID:5652
- C:\Windows\System\TTwTMAK.exe
  C:\Windows\System\TTwTMAK.exe
  2⤵
  PID:6132
- C:\Windows\System\wZqRsjt.exe
  C:\Windows\System\wZqRsjt.exe
  2⤵
  PID:1336
- C:\Windows\System\JkTdvRA.exe
  C:\Windows\System\JkTdvRA.exe
  2⤵
  PID:6036
- C:\Windows\System\VvdXRQK.exe
  C:\Windows\System\VvdXRQK.exe
  2⤵
  PID:6088
- C:\Windows\System\IiWqjJp.exe
  C:\Windows\System\IiWqjJp.exe
  2⤵
  PID:2192
- C:\Windows\System\KffLQTg.exe
  C:\Windows\System\KffLQTg.exe
  2⤵
  PID:1800
- C:\Windows\System\TGMntHG.exe
  C:\Windows\System\TGMntHG.exe
  2⤵
  PID:4432
- C:\Windows\System\nDWCTuB.exe
  C:\Windows\System\nDWCTuB.exe
  2⤵
  PID:4700
- C:\Windows\System\ZzWgOfq.exe
  C:\Windows\System\ZzWgOfq.exe
  2⤵
  PID:3008
- C:\Windows\System\lxuzBlK.exe
  C:\Windows\System\lxuzBlK.exe
  2⤵
  PID:5276
- C:\Windows\System\jNPzPds.exe
  C:\Windows\System\jNPzPds.exe
  2⤵
  PID:5068
- C:\Windows\System\iMtiXJv.exe
  C:\Windows\System\iMtiXJv.exe
  2⤵
  PID:1732
- C:\Windows\System\oeOxbFr.exe
  C:\Windows\System\oeOxbFr.exe
  2⤵
  PID:3860
- C:\Windows\System\oEzaxnv.exe
  C:\Windows\System\oEzaxnv.exe
  2⤵
  PID:4800
- C:\Windows\System\QkDhbjt.exe
  C:\Windows\System\QkDhbjt.exe
  2⤵
  PID:2428
- C:\Windows\System\xLXQkJf.exe
  C:\Windows\System\xLXQkJf.exe
  2⤵
  PID:4944
- C:\Windows\System\kuccUpp.exe
  C:\Windows\System\kuccUpp.exe
  2⤵
  PID:5600
- C:\Windows\System\ZYQLKZb.exe
  C:\Windows\System\ZYQLKZb.exe
  2⤵
  PID:5840
- C:\Windows\System\uOokABC.exe
  C:\Windows\System\uOokABC.exe
  2⤵
  PID:5748
- C:\Windows\System\XcnvlWX.exe
  C:\Windows\System\XcnvlWX.exe
  2⤵
  PID:6052
- C:\Windows\System\aewBOHe.exe
  C:\Windows\System\aewBOHe.exe
  2⤵
  PID:2164
- C:\Windows\System\LOuDQbu.exe
  C:\Windows\System\LOuDQbu.exe
  2⤵
  PID:948
- C:\Windows\System\vRZAgIG.exe
  C:\Windows\System\vRZAgIG.exe
  2⤵
  PID:6160
- C:\Windows\System\cBaozGX.exe
  C:\Windows\System\cBaozGX.exe
  2⤵
  PID:6176
- C:\Windows\System\JjCGrvj.exe
  C:\Windows\System\JjCGrvj.exe
  2⤵
  PID:6192
- C:\Windows\System\vkSjXAo.exe
  C:\Windows\System\vkSjXAo.exe
  2⤵
  PID:6208
- C:\Windows\System\GWedjBy.exe
  C:\Windows\System\GWedjBy.exe
  2⤵
  PID:6224
- C:\Windows\System\ktQycPC.exe
  C:\Windows\System\ktQycPC.exe
  2⤵
  PID:6240
- C:\Windows\System\WaApMkL.exe
  C:\Windows\System\WaApMkL.exe
  2⤵
  PID:6256
- C:\Windows\System\VDnREnm.exe
  C:\Windows\System\VDnREnm.exe
  2⤵
  PID:6272
- C:\Windows\System\SyLtxQq.exe
  C:\Windows\System\SyLtxQq.exe
  2⤵
  PID:6288
- C:\Windows\System\sEDgibZ.exe
  C:\Windows\System\sEDgibZ.exe
  2⤵
  PID:6304
- C:\Windows\System\tWkDpRi.exe
  C:\Windows\System\tWkDpRi.exe
  2⤵
  PID:6320
- C:\Windows\System\UnnUloF.exe
  C:\Windows\System\UnnUloF.exe
  2⤵
  PID:6336
- C:\Windows\System\YEEgKkD.exe
  C:\Windows\System\YEEgKkD.exe
  2⤵
  PID:6352
- C:\Windows\System\GEVpaYT.exe
  C:\Windows\System\GEVpaYT.exe
  2⤵
  PID:6368
- C:\Windows\System\nLcwVNP.exe
  C:\Windows\System\nLcwVNP.exe
  2⤵
  PID:6384
- C:\Windows\System\pxrXooQ.exe
  C:\Windows\System\pxrXooQ.exe
  2⤵
  PID:6400
- C:\Windows\System\wDSKqVj.exe
  C:\Windows\System\wDSKqVj.exe
  2⤵
  PID:6416
- C:\Windows\System\mJMIulk.exe
  C:\Windows\System\mJMIulk.exe
  2⤵
  PID:6432
- C:\Windows\System\DDOSkhU.exe
  C:\Windows\System\DDOSkhU.exe
  2⤵
  PID:6452
- C:\Windows\System\NNclGCE.exe
  C:\Windows\System\NNclGCE.exe
  2⤵
  PID:6468
- C:\Windows\System\UBCcKCl.exe
  C:\Windows\System\UBCcKCl.exe
  2⤵
  PID:6484
- C:\Windows\System\oMAgBkd.exe
  C:\Windows\System\oMAgBkd.exe
  2⤵
  PID:6500
- C:\Windows\System\kpECMCN.exe
  C:\Windows\System\kpECMCN.exe
  2⤵
  PID:6516
- C:\Windows\System\YOWkdiZ.exe
  C:\Windows\System\YOWkdiZ.exe
  2⤵
  PID:6532
- C:\Windows\System\GirGhEJ.exe
  C:\Windows\System\GirGhEJ.exe
  2⤵
  PID:6548
- C:\Windows\System\XlhoUxC.exe
  C:\Windows\System\XlhoUxC.exe
  2⤵
  PID:6564
- C:\Windows\System\qqTLpDC.exe
  C:\Windows\System\qqTLpDC.exe
  2⤵
  PID:6580
- C:\Windows\System\uIWxQaW.exe
  C:\Windows\System\uIWxQaW.exe
  2⤵
  PID:6596
- C:\Windows\System\LCVTVXo.exe
  C:\Windows\System\LCVTVXo.exe
  2⤵
  PID:6616
- C:\Windows\System\mEgFBcU.exe
  C:\Windows\System\mEgFBcU.exe
  2⤵
  PID:6632
- C:\Windows\System\jUlQjoH.exe
  C:\Windows\System\jUlQjoH.exe
  2⤵
  PID:6652
- C:\Windows\System\rkZbtNP.exe
  C:\Windows\System\rkZbtNP.exe
  2⤵
  PID:6668
- C:\Windows\System\drIpmZB.exe
  C:\Windows\System\drIpmZB.exe
  2⤵
  PID:6684
- C:\Windows\System\bHYCKtp.exe
  C:\Windows\System\bHYCKtp.exe
  2⤵
  PID:6704
- C:\Windows\System\xJAAmyl.exe
  C:\Windows\System\xJAAmyl.exe
  2⤵
  PID:6720
- C:\Windows\System\BsijGJm.exe
  C:\Windows\System\BsijGJm.exe
  2⤵
  PID:6736
- C:\Windows\System\HiqZnFa.exe
  C:\Windows\System\HiqZnFa.exe
  2⤵
  PID:6896
- C:\Windows\System\UShBFaj.exe
  C:\Windows\System\UShBFaj.exe
  2⤵
  PID:6912
- C:\Windows\System\IpHaDID.exe
  C:\Windows\System\IpHaDID.exe
  2⤵
  PID:6928
- C:\Windows\System\yLdUdYh.exe
  C:\Windows\System\yLdUdYh.exe
  2⤵
  PID:6944
- C:\Windows\System\QbTOUcg.exe
  C:\Windows\System\QbTOUcg.exe
  2⤵
  PID:6964
- C:\Windows\System\RHxVFcZ.exe
  C:\Windows\System\RHxVFcZ.exe
  2⤵
  PID:6984
- C:\Windows\System\LgHVzJO.exe
  C:\Windows\System\LgHVzJO.exe
  2⤵
  PID:7000
- C:\Windows\System\RrBzHkG.exe
  C:\Windows\System\RrBzHkG.exe
  2⤵
  PID:7020
- C:\Windows\System\HbQZSEn.exe
  C:\Windows\System\HbQZSEn.exe
  2⤵
  PID:7036
- C:\Windows\System\cjljJJB.exe
  C:\Windows\System\cjljJJB.exe
  2⤵
  PID:7052
- C:\Windows\System\MjTRVgj.exe
  C:\Windows\System\MjTRVgj.exe
  2⤵
  PID:7100
- C:\Windows\System\NKkpaEF.exe
  C:\Windows\System\NKkpaEF.exe
  2⤵
  PID:7116
- C:\Windows\System\itZVgyx.exe
  C:\Windows\System\itZVgyx.exe
  2⤵
  PID:7132
- C:\Windows\System\aaRjyZX.exe
  C:\Windows\System\aaRjyZX.exe
  2⤵
  PID:7148
- C:\Windows\System\esvIbCm.exe
  C:\Windows\System\esvIbCm.exe
  2⤵
  PID:7164
- C:\Windows\System\IZRGuSG.exe
  C:\Windows\System\IZRGuSG.exe
  2⤵
  PID:5156
- C:\Windows\System\QAvhGAZ.exe
  C:\Windows\System\QAvhGAZ.exe
  2⤵
  PID:1192
- C:\Windows\System\zDEJlkg.exe
  C:\Windows\System\zDEJlkg.exe
  2⤵
  PID:4848
- C:\Windows\System\exDzDyc.exe
  C:\Windows\System\exDzDyc.exe
  2⤵
  PID:2448
- C:\Windows\System\FrdQJrT.exe
  C:\Windows\System\FrdQJrT.exe
  2⤵
  PID:2704
- C:\Windows\System\owyWvBI.exe
  C:\Windows\System\owyWvBI.exe
  2⤵
  PID:4620
- C:\Windows\System\uCsTqXt.exe
  C:\Windows\System\uCsTqXt.exe
  2⤵
  PID:6152
- C:\Windows\System\KYHulxR.exe
  C:\Windows\System\KYHulxR.exe
  2⤵
  PID:6216
- C:\Windows\System\JvjwVcg.exe
  C:\Windows\System\JvjwVcg.exe
  2⤵
  PID:6280
- C:\Windows\System\DXMZmZQ.exe
  C:\Windows\System\DXMZmZQ.exe
  2⤵
  PID:6376
- C:\Windows\System\YyAdUkX.exe
  C:\Windows\System\YyAdUkX.exe
  2⤵
  PID:6712
- C:\Windows\System\ADmjjBW.exe
  C:\Windows\System\ADmjjBW.exe
  2⤵
  PID:6644
- C:\Windows\System\LnyObjT.exe
  C:\Windows\System\LnyObjT.exe
  2⤵
  PID:6576
- C:\Windows\System\qIJxnVE.exe
  C:\Windows\System\qIJxnVE.exe
  2⤵
  PID:6512
- C:\Windows\System\UnJjwXi.exe
  C:\Windows\System\UnJjwXi.exe
  2⤵
  PID:6448
- C:\Windows\System\oqwHBXt.exe
  C:\Windows\System\oqwHBXt.exe
  2⤵
  PID:6748
- C:\Windows\System\lrXknTC.exe
  C:\Windows\System\lrXknTC.exe
  2⤵
  PID:992
- C:\Windows\System\KqImRPg.exe
  C:\Windows\System\KqImRPg.exe
  2⤵
  PID:1708
- C:\Windows\System\MHZaRgp.exe
  C:\Windows\System\MHZaRgp.exe
  2⤵
  PID:3932
- C:\Windows\System\fGdvLIb.exe
  C:\Windows\System\fGdvLIb.exe
  2⤵
  PID:2124
- C:\Windows\System\lcQfksm.exe
  C:\Windows\System\lcQfksm.exe
  2⤵
  PID:4820
- C:\Windows\System\hFIglkg.exe
  C:\Windows\System\hFIglkg.exe
  2⤵
  PID:6112
- C:\Windows\System\MwianlF.exe
  C:\Windows\System\MwianlF.exe
  2⤵
  PID:6296
- C:\Windows\System\OjxGePp.exe
  C:\Windows\System\OjxGePp.exe
  2⤵
  PID:6360
- C:\Windows\System\nYryacH.exe
  C:\Windows\System\nYryacH.exe
  2⤵
  PID:6424
- C:\Windows\System\yIQYmie.exe
  C:\Windows\System\yIQYmie.exe
  2⤵
  PID:6496
- C:\Windows\System\vKxllxP.exe
  C:\Windows\System\vKxllxP.exe
  2⤵
  PID:6560
- C:\Windows\System\miSvnxj.exe
  C:\Windows\System\miSvnxj.exe
  2⤵
  PID:6628
- C:\Windows\System\ifBtCrr.exe
  C:\Windows\System\ifBtCrr.exe
  2⤵
  PID:6696
- C:\Windows\System\ZkzPgWP.exe
  C:\Windows\System\ZkzPgWP.exe
  2⤵
  PID:6756
- C:\Windows\System\KpJHreq.exe
  C:\Windows\System\KpJHreq.exe
  2⤵
  PID:6768
- C:\Windows\System\eyYKjAZ.exe
  C:\Windows\System\eyYKjAZ.exe
  2⤵
  PID:6784
- C:\Windows\System\sdipglb.exe
  C:\Windows\System\sdipglb.exe
  2⤵
  PID:6800
- C:\Windows\System\EkbWtqc.exe
  C:\Windows\System\EkbWtqc.exe
  2⤵
  PID:6816
- C:\Windows\System\kjCEQBN.exe
  C:\Windows\System\kjCEQBN.exe
  2⤵
  PID:6836
- C:\Windows\System\OhBemRm.exe
  C:\Windows\System\OhBemRm.exe
  2⤵
  PID:6856
- C:\Windows\System\aKLBLSO.exe
  C:\Windows\System\aKLBLSO.exe
  2⤵
  PID:6876
- C:\Windows\System\yygBmUA.exe
  C:\Windows\System\yygBmUA.exe
  2⤵
  PID:6892
- C:\Windows\System\zkHPVIu.exe
  C:\Windows\System\zkHPVIu.exe
  2⤵
  PID:6956
- C:\Windows\System\UUlVnZi.exe
  C:\Windows\System\UUlVnZi.exe
  2⤵
  PID:7032
- C:\Windows\System\YttpGoE.exe
  C:\Windows\System\YttpGoE.exe
  2⤵
  PID:7060
- C:\Windows\System\FNYSiCu.exe
  C:\Windows\System\FNYSiCu.exe
  2⤵
  PID:6908
- C:\Windows\System\RYOiyOm.exe
  C:\Windows\System\RYOiyOm.exe
  2⤵
  PID:6976
- C:\Windows\System\oNVGLHU.exe
  C:\Windows\System\oNVGLHU.exe
  2⤵
  PID:7016
- C:\Windows\System\mZnRUxa.exe
  C:\Windows\System\mZnRUxa.exe
  2⤵
  PID:7088
- C:\Windows\System\JtUREqZ.exe
  C:\Windows\System\JtUREqZ.exe
  2⤵
  PID:7112
- C:\Windows\System\AnbHxtd.exe
  C:\Windows\System\AnbHxtd.exe
  2⤵
  PID:5684
- C:\Windows\System\SaCEUys.exe
  C:\Windows\System\SaCEUys.exe
  2⤵
  PID:7160
- C:\Windows\System\rYhpvhT.exe
  C:\Windows\System\rYhpvhT.exe
  2⤵
  PID:5004
- C:\Windows\System\eyeeBYr.exe
  C:\Windows\System\eyeeBYr.exe
  2⤵
  PID:6188
- C:\Windows\System\HowmXAW.exe
  C:\Windows\System\HowmXAW.exe
  2⤵
  PID:6676
- C:\Windows\System\qbSqAvk.exe
  C:\Windows\System\qbSqAvk.exe
  2⤵
  PID:6440
- C:\Windows\System\HJFJSkt.exe
  C:\Windows\System\HJFJSkt.exe
  2⤵
  PID:5160
- C:\Windows\System\HOPyBVF.exe
  C:\Windows\System\HOPyBVF.exe
  2⤵
  PID:3380
- C:\Windows\System\EPRLxPA.exe
  C:\Windows\System\EPRLxPA.exe
  2⤵
  PID:2108
- C:\Windows\System\oWzthEp.exe
  C:\Windows\System\oWzthEp.exe
  2⤵
  PID:6412
- C:\Windows\System\detsbDi.exe
  C:\Windows\System\detsbDi.exe
  2⤵
  PID:6480
- C:\Windows\System\GlwzQpO.exe
  C:\Windows\System\GlwzQpO.exe
  2⤵
  PID:2800
- C:\Windows\System\DfRmmVO.exe
  C:\Windows\System\DfRmmVO.exe
  2⤵
  PID:2708
- C:\Windows\System\xeNPGgN.exe
  C:\Windows\System\xeNPGgN.exe
  2⤵
  PID:6204
- C:\Windows\System\qIouEjH.exe
  C:\Windows\System\qIouEjH.exe
  2⤵
  PID:6848
- C:\Windows\System\cpyRtDi.exe
  C:\Windows\System\cpyRtDi.exe
  2⤵
  PID:6664
- C:\Windows\System\LgqAFVG.exe
  C:\Windows\System\LgqAFVG.exe
  2⤵
  PID:6796
- C:\Windows\System\fFNPQtB.exe
  C:\Windows\System\fFNPQtB.exe
  2⤵
  PID:6828
- C:\Windows\System\ThZPlez.exe
  C:\Windows\System\ThZPlez.exe
  2⤵
  PID:6920
- C:\Windows\System\bySrkQq.exe
  C:\Windows\System\bySrkQq.exe
  2⤵
  PID:6972
- C:\Windows\System\rOYeRXb.exe
  C:\Windows\System\rOYeRXb.exe
  2⤵
  PID:6464
- C:\Windows\System\hvYFzHq.exe
  C:\Windows\System\hvYFzHq.exe
  2⤵
  PID:6728
- C:\Windows\System\XhluNpI.exe
  C:\Windows\System\XhluNpI.exe
  2⤵
  PID:6808
- C:\Windows\System\YkGqZeu.exe
  C:\Windows\System\YkGqZeu.exe
  2⤵
  PID:6884
- C:\Windows\System\aRjiTjg.exe
  C:\Windows\System\aRjiTjg.exe
  2⤵
  PID:6924
- C:\Windows\System\frvdzRx.exe
  C:\Windows\System\frvdzRx.exe
  2⤵
  PID:7008
- C:\Windows\System\yquYiiv.exe
  C:\Windows\System\yquYiiv.exe
  2⤵
  PID:7140
- C:\Windows\System\xrOSsyu.exe
  C:\Windows\System\xrOSsyu.exe
  2⤵
  PID:6316
- C:\Windows\System\kVWkLND.exe
  C:\Windows\System\kVWkLND.exe
  2⤵
  PID:5368
- C:\Windows\System\rUOBnEG.exe
  C:\Windows\System\rUOBnEG.exe
  2⤵
  PID:6604
- C:\Windows\System\IVOYSTF.exe
  C:\Windows\System\IVOYSTF.exe
  2⤵
  PID:7128
- C:\Windows\System\EkpbQxM.exe
  C:\Windows\System\EkpbQxM.exe
  2⤵
  PID:4348
- C:\Windows\System\fVaPVBJ.exe
  C:\Windows\System\fVaPVBJ.exe
  2⤵
  PID:6236
- C:\Windows\System\XpDaxWm.exe
  C:\Windows\System\XpDaxWm.exe
  2⤵
  PID:6252
- C:\Windows\System\XfJqthW.exe
  C:\Windows\System\XfJqthW.exe
  2⤵
  PID:6172
- C:\Windows\System\sdkUbPn.exe
  C:\Windows\System\sdkUbPn.exe
  2⤵
  PID:6528
- C:\Windows\System\TSndAwL.exe
  C:\Windows\System\TSndAwL.exe
  2⤵
  PID:6952
- C:\Windows\System\qyUtHGo.exe
  C:\Windows\System\qyUtHGo.exe
  2⤵
  PID:6460
- C:\Windows\System\XLfBAKu.exe
  C:\Windows\System\XLfBAKu.exe
  2⤵
  PID:6624
- C:\Windows\System\PBqpeTE.exe
  C:\Windows\System\PBqpeTE.exe
  2⤵
  PID:6844
- C:\Windows\System\KkOEbdO.exe
  C:\Windows\System\KkOEbdO.exe
  2⤵
  PID:6012
- C:\Windows\System\SFLTIIT.exe
  C:\Windows\System\SFLTIIT.exe
  2⤵
  PID:7092
- C:\Windows\System\lKXeOzU.exe
  C:\Windows\System\lKXeOzU.exe
  2⤵
  PID:3128
- C:\Windows\System\qgXfmJy.exe
  C:\Windows\System\qgXfmJy.exe
  2⤵
  PID:6184
- C:\Windows\System\waGPBpu.exe
  C:\Windows\System\waGPBpu.exe
  2⤵
  PID:6556
- C:\Windows\System\qWOCIlD.exe
  C:\Windows\System\qWOCIlD.exe
  2⤵
  PID:5820
- C:\Windows\System\SReGjmX.exe
  C:\Windows\System\SReGjmX.exe
  2⤵
  PID:6764
- C:\Windows\System\RLcvTgB.exe
  C:\Windows\System\RLcvTgB.exe
  2⤵
  PID:6832
- C:\Windows\System\YteCrNZ.exe
  C:\Windows\System\YteCrNZ.exe
  2⤵
  PID:6780
- C:\Windows\System\xpCPLBi.exe
  C:\Windows\System\xpCPLBi.exe
  2⤵
  PID:6344
- C:\Windows\System\uaIkHPk.exe
  C:\Windows\System\uaIkHPk.exe
  2⤵
  PID:6348
- C:\Windows\System\CdMhTeH.exe
  C:\Windows\System\CdMhTeH.exe
  2⤵
  PID:7076
- C:\Windows\System\IbgiYVD.exe
  C:\Windows\System\IbgiYVD.exe
  2⤵
  PID:1004
- C:\Windows\System\XpBKLIc.exe
  C:\Windows\System\XpBKLIc.exe
  2⤵
  PID:6992
- C:\Windows\System\xezJkyL.exe
  C:\Windows\System\xezJkyL.exe
  2⤵
  PID:6608
- C:\Windows\System\inyWxfV.exe
  C:\Windows\System\inyWxfV.exe
  2⤵
  PID:6752
- C:\Windows\System\NSQSXRX.exe
  C:\Windows\System\NSQSXRX.exe
  2⤵
  PID:7176
- C:\Windows\System\xYTyWJB.exe
  C:\Windows\System\xYTyWJB.exe
  2⤵
  PID:7192
- C:\Windows\System\SbsQJql.exe
  C:\Windows\System\SbsQJql.exe
  2⤵
  PID:7208
- C:\Windows\System\oCehqlJ.exe
  C:\Windows\System\oCehqlJ.exe
  2⤵
  PID:7224
- C:\Windows\System\TBQUEuq.exe
  C:\Windows\System\TBQUEuq.exe
  2⤵
  PID:7240
- C:\Windows\System\uEHgTaX.exe
  C:\Windows\System\uEHgTaX.exe
  2⤵
  PID:7256
- C:\Windows\System\SeHAfta.exe
  C:\Windows\System\SeHAfta.exe
  2⤵
  PID:7280
- C:\Windows\System\JohPsSO.exe
  C:\Windows\System\JohPsSO.exe
  2⤵
  PID:7296
- C:\Windows\System\APkBwOU.exe
  C:\Windows\System\APkBwOU.exe
  2⤵
  PID:7312
- C:\Windows\System\GsWivka.exe
  C:\Windows\System\GsWivka.exe
  2⤵
  PID:7328
- C:\Windows\System\kJxNGRr.exe
  C:\Windows\System\kJxNGRr.exe
  2⤵
  PID:7344
- C:\Windows\System\aUMnaUh.exe
  C:\Windows\System\aUMnaUh.exe
  2⤵
  PID:7360
- C:\Windows\System\CgJaGmT.exe
  C:\Windows\System\CgJaGmT.exe
  2⤵
  PID:7376
- C:\Windows\System\SsRKivp.exe
  C:\Windows\System\SsRKivp.exe
  2⤵
  PID:7396
- C:\Windows\System\dTzhEAp.exe
  C:\Windows\System\dTzhEAp.exe
  2⤵
  PID:7412
- C:\Windows\System\VOXFzVx.exe
  C:\Windows\System\VOXFzVx.exe
  2⤵
  PID:7428
- C:\Windows\System\oWrFJzX.exe
  C:\Windows\System\oWrFJzX.exe
  2⤵
  PID:7444
- C:\Windows\System\YZLbkjW.exe
  C:\Windows\System\YZLbkjW.exe
  2⤵
  PID:7460
- C:\Windows\System\FLFPteg.exe
  C:\Windows\System\FLFPteg.exe
  2⤵
  PID:7476
- C:\Windows\System\vqmwCDC.exe
  C:\Windows\System\vqmwCDC.exe
  2⤵
  PID:7492
- C:\Windows\System\hFyMJRm.exe
  C:\Windows\System\hFyMJRm.exe
  2⤵
  PID:7508
- C:\Windows\System\AJLuPhP.exe
  C:\Windows\System\AJLuPhP.exe
  2⤵
  PID:7524
- C:\Windows\System\EmKotTh.exe
  C:\Windows\System\EmKotTh.exe
  2⤵
  PID:7540
- C:\Windows\System\nKXITwR.exe
  C:\Windows\System\nKXITwR.exe
  2⤵
  PID:7556
- C:\Windows\System\CpRBLaM.exe
  C:\Windows\System\CpRBLaM.exe
  2⤵
  PID:7576
- C:\Windows\System\YLPTYmL.exe
  C:\Windows\System\YLPTYmL.exe
  2⤵
  PID:7596
- C:\Windows\System\JwtPaeE.exe
  C:\Windows\System\JwtPaeE.exe
  2⤵
  PID:7612
- C:\Windows\System\IzoyKBY.exe
  C:\Windows\System\IzoyKBY.exe
  2⤵
  PID:7628
- C:\Windows\System\bLEKmUZ.exe
  C:\Windows\System\bLEKmUZ.exe
  2⤵
  PID:7644
- C:\Windows\System\qrzjyFp.exe
  C:\Windows\System\qrzjyFp.exe
  2⤵
  PID:7664
- C:\Windows\System\XSxNIcS.exe
  C:\Windows\System\XSxNIcS.exe
  2⤵
  PID:7680
- C:\Windows\System\TOicdan.exe
  C:\Windows\System\TOicdan.exe
  2⤵
  PID:7696
- C:\Windows\System\fuVlsYP.exe
  C:\Windows\System\fuVlsYP.exe
  2⤵
  PID:7712
- C:\Windows\System\gnUDUzf.exe
  C:\Windows\System\gnUDUzf.exe
  2⤵
  PID:7728
- C:\Windows\System\eHBVwod.exe
  C:\Windows\System\eHBVwod.exe
  2⤵
  PID:7744
- C:\Windows\System\iGzTegl.exe
  C:\Windows\System\iGzTegl.exe
  2⤵
  PID:7760
- C:\Windows\System\tlYGJlh.exe
  C:\Windows\System\tlYGJlh.exe
  2⤵
  PID:7780
- C:\Windows\System\pneWnRn.exe
  C:\Windows\System\pneWnRn.exe
  2⤵
  PID:7796
- C:\Windows\System\fNILAgT.exe
  C:\Windows\System\fNILAgT.exe
  2⤵
  PID:7816
- C:\Windows\System\iqygLJn.exe
  C:\Windows\System\iqygLJn.exe
  2⤵
  PID:7832
- C:\Windows\System\jlnCVJG.exe
  C:\Windows\System\jlnCVJG.exe
  2⤵
  PID:7852
- C:\Windows\System\pyyXXQt.exe
  C:\Windows\System\pyyXXQt.exe
  2⤵
  PID:7872
- C:\Windows\System\EQHHhSV.exe
  C:\Windows\System\EQHHhSV.exe
  2⤵
  PID:7888
- C:\Windows\System\PzUpAzT.exe
  C:\Windows\System\PzUpAzT.exe
  2⤵
  PID:7904
- C:\Windows\System\GiSVxnP.exe
  C:\Windows\System\GiSVxnP.exe
  2⤵
  PID:7920
- C:\Windows\System\CYWPSZe.exe
  C:\Windows\System\CYWPSZe.exe
  2⤵
  PID:7936
- C:\Windows\System\SepgnSC.exe
  C:\Windows\System\SepgnSC.exe
  2⤵
  PID:7956
- C:\Windows\System\BWBtOlY.exe
  C:\Windows\System\BWBtOlY.exe
  2⤵
  PID:7972
- C:\Windows\System\yiiyLZb.exe
  C:\Windows\System\yiiyLZb.exe
  2⤵
  PID:7988
- C:\Windows\System\iRuKEQg.exe
  C:\Windows\System\iRuKEQg.exe
  2⤵
  PID:8004
- C:\Windows\System\fdoQeZo.exe
  C:\Windows\System\fdoQeZo.exe
  2⤵
  PID:8024
- C:\Windows\System\ETsmSKO.exe
  C:\Windows\System\ETsmSKO.exe
  2⤵
  PID:8044
- C:\Windows\System\IiDkjMz.exe
  C:\Windows\System\IiDkjMz.exe
  2⤵
  PID:8060
- C:\Windows\System\UUpJkjM.exe
  C:\Windows\System\UUpJkjM.exe
  2⤵
  PID:8076
- C:\Windows\System\fSysdDw.exe
  C:\Windows\System\fSysdDw.exe
  2⤵
  PID:8092
- C:\Windows\System\xnmkUQC.exe
  C:\Windows\System\xnmkUQC.exe
  2⤵
  PID:8108
- C:\Windows\System\HflqwlA.exe
  C:\Windows\System\HflqwlA.exe
  2⤵
  PID:8124
- C:\Windows\System\TisfRis.exe
  C:\Windows\System\TisfRis.exe
  2⤵
  PID:8144
- C:\Windows\System\QRegMnj.exe
  C:\Windows\System\QRegMnj.exe
  2⤵
  PID:8160
- C:\Windows\System\SinLlQj.exe
  C:\Windows\System\SinLlQj.exe
  2⤵
  PID:8176
- C:\Windows\System\otCyCAA.exe
  C:\Windows\System\otCyCAA.exe
  2⤵
  PID:7184
- C:\Windows\System\gLHvgBf.exe
  C:\Windows\System\gLHvgBf.exe
  2⤵
  PID:7252
- C:\Windows\System\BkKKFQt.exe
  C:\Windows\System\BkKKFQt.exe
  2⤵
  PID:6168
- C:\Windows\System\BRxxqdF.exe
  C:\Windows\System\BRxxqdF.exe
  2⤵
  PID:7276
- C:\Windows\System\hPfpcWc.exe
  C:\Windows\System\hPfpcWc.exe
  2⤵
  PID:7292
- C:\Windows\System\GtiFsmS.exe
  C:\Windows\System\GtiFsmS.exe
  2⤵
  PID:7356
- C:\Windows\System\gLkEPXY.exe
  C:\Windows\System\gLkEPXY.exe
  2⤵
  PID:7392
- C:\Windows\System\pqaFtGY.exe
  C:\Windows\System\pqaFtGY.exe
  2⤵
  PID:7468
- C:\Windows\System\BQSZRaR.exe
  C:\Windows\System\BQSZRaR.exe
  2⤵
  PID:7504
- C:\Windows\System\DrrNqri.exe
  C:\Windows\System\DrrNqri.exe
  2⤵
  PID:7564
- C:\Windows\System\vVPOBrn.exe
  C:\Windows\System\vVPOBrn.exe
  2⤵
  PID:7456
- C:\Windows\System\hwGLhFz.exe
  C:\Windows\System\hwGLhFz.exe
  2⤵
  PID:7520
- C:\Windows\System\gRMSSsR.exe
  C:\Windows\System\gRMSSsR.exe
  2⤵
  PID:7588
- C:\Windows\System\ujtqLKO.exe
  C:\Windows\System\ujtqLKO.exe
  2⤵
  PID:7652
- C:\Windows\System\lbibrEV.exe
  C:\Windows\System\lbibrEV.exe
  2⤵
  PID:7692
- C:\Windows\System\EeclXxf.exe
  C:\Windows\System\EeclXxf.exe
  2⤵
  PID:7608
- C:\Windows\System\hwyoPDT.exe
  C:\Windows\System\hwyoPDT.exe
  2⤵
  PID:7704
- C:\Windows\System\LAqCeML.exe
  C:\Windows\System\LAqCeML.exe
  2⤵
  PID:7768
- C:\Windows\System\tPNidaK.exe
  C:\Windows\System\tPNidaK.exe
  2⤵
  PID:7804
- C:\Windows\System\LAEVPxc.exe
  C:\Windows\System\LAEVPxc.exe
  2⤵
  PID:7756
- C:\Windows\System\egMMBED.exe
  C:\Windows\System\egMMBED.exe
  2⤵
  PID:7828
- C:\Windows\System\MZIUIty.exe
  C:\Windows\System\MZIUIty.exe
  2⤵
  PID:7840
- C:\Windows\System\NRPMBsd.exe
  C:\Windows\System\NRPMBsd.exe
  2⤵
  PID:7884
- C:\Windows\System\lGyFDWe.exe
  C:\Windows\System\lGyFDWe.exe
  2⤵
  PID:7916
- C:\Windows\System\LUobmTx.exe
  C:\Windows\System\LUobmTx.exe
  2⤵
  PID:7948
- C:\Windows\System\JDPJYTe.exe
  C:\Windows\System\JDPJYTe.exe
  2⤵
  PID:7968
- C:\Windows\System\cyTWahc.exe
  C:\Windows\System\cyTWahc.exe
  2⤵
  PID:8032
- C:\Windows\System\gNyUzUM.exe
  C:\Windows\System\gNyUzUM.exe
  2⤵
  PID:8072
- C:\Windows\System\WxUPtEY.exe
  C:\Windows\System\WxUPtEY.exe
  2⤵
  PID:5500
- C:\Windows\System\MHmmtCL.exe
  C:\Windows\System\MHmmtCL.exe
  2⤵
  PID:8172
- C:\Windows\System\XnKMoEz.exe
  C:\Windows\System\XnKMoEz.exe
  2⤵
  PID:7200
- C:\Windows\System\rrcEwEW.exe
  C:\Windows\System\rrcEwEW.exe
  2⤵
  PID:7268
- C:\Windows\System\DBqTMNx.exe
  C:\Windows\System\DBqTMNx.exe
  2⤵
  PID:7324
- C:\Windows\System\RrtVgJs.exe
  C:\Windows\System\RrtVgJs.exe
  2⤵
  PID:7404
- C:\Windows\System\ECrzDkU.exe
  C:\Windows\System\ECrzDkU.exe
  2⤵
  PID:7440
- C:\Windows\System\SJfkXqO.exe
  C:\Windows\System\SJfkXqO.exe
  2⤵
  PID:7568
- C:\Windows\System\pjFcRTP.exe
  C:\Windows\System\pjFcRTP.exe
  2⤵
  PID:7604
- C:\Windows\System\xZZTuxE.exe
  C:\Windows\System\xZZTuxE.exe
  2⤵
  PID:7752
- C:\Windows\System\FVyFoxa.exe
  C:\Windows\System\FVyFoxa.exe
  2⤵
  PID:7932
- C:\Windows\System\HwiBfrN.exe
  C:\Windows\System\HwiBfrN.exe
  2⤵
  PID:7688
- C:\Windows\System\cenyAMF.exe
  C:\Windows\System\cenyAMF.exe
  2⤵
  PID:7584
- C:\Windows\System\sqnFiec.exe
  C:\Windows\System\sqnFiec.exe
  2⤵
  PID:7672
- C:\Windows\System\zYIKibS.exe
  C:\Windows\System\zYIKibS.exe
  2⤵
  PID:7944
- C:\Windows\System\bJobfzN.exe
  C:\Windows\System\bJobfzN.exe
  2⤵
  PID:8016
- C:\Windows\System\wtKuVFC.exe
  C:\Windows\System\wtKuVFC.exe
  2⤵
  PID:8088
- C:\Windows\System\PoOmTCi.exe
  C:\Windows\System\PoOmTCi.exe
  2⤵
  PID:8156
- C:\Windows\System\IDCuzyj.exe
  C:\Windows\System\IDCuzyj.exe
  2⤵
  PID:7912
- C:\Windows\System\EomLkZk.exe
  C:\Windows\System\EomLkZk.exe
  2⤵
  PID:8068
- C:\Windows\System\kTFkLKu.exe
  C:\Windows\System\kTFkLKu.exe
  2⤵
  PID:8140
- C:\Windows\System\wKeucck.exe
  C:\Windows\System\wKeucck.exe
  2⤵
  PID:7368
- C:\Windows\System\bwuSpKo.exe
  C:\Windows\System\bwuSpKo.exe
  2⤵
  PID:7516
- C:\Windows\System\nUMWSeG.exe
  C:\Windows\System\nUMWSeG.exe
  2⤵
  PID:7740
- C:\Windows\System\vrIJLax.exe
  C:\Windows\System\vrIJLax.exe
  2⤵
  PID:7676
- C:\Windows\System\CmVUBkc.exe
  C:\Windows\System\CmVUBkc.exe
  2⤵
  PID:7372
- C:\Windows\System\AaRoFLy.exe
  C:\Windows\System\AaRoFLy.exe
  2⤵
  PID:7964
- C:\Windows\System\HpgtZzb.exe
  C:\Windows\System\HpgtZzb.exe
  2⤵
  PID:7844
- C:\Windows\System\PnpymiM.exe
  C:\Windows\System\PnpymiM.exe
  2⤵
  PID:8052
- C:\Windows\System\HVWIFVq.exe
  C:\Windows\System\HVWIFVq.exe
  2⤵
  PID:7452
- C:\Windows\System\OGgOmJB.exe
  C:\Windows\System\OGgOmJB.exe
  2⤵
  PID:7552
- C:\Windows\System\YgNgLXG.exe
  C:\Windows\System\YgNgLXG.exe
  2⤵
  PID:7536
- C:\Windows\System\cJelLlQ.exe
  C:\Windows\System\cJelLlQ.exe
  2⤵
  PID:8168
- C:\Windows\System\hZcNlii.exe
  C:\Windows\System\hZcNlii.exe
  2⤵
  PID:7572
- C:\Windows\System\dJObvMu.exe
  C:\Windows\System\dJObvMu.exe
  2⤵
  PID:8084
- C:\Windows\System\jasOjHk.exe
  C:\Windows\System\jasOjHk.exe
  2⤵
  PID:8188
- C:\Windows\System\DvOsZSs.exe
  C:\Windows\System\DvOsZSs.exe
  2⤵
  PID:7880
- C:\Windows\System\cgwLMnb.exe
  C:\Windows\System\cgwLMnb.exe
  2⤵
  PID:8208
- C:\Windows\System\YWHymSD.exe
  C:\Windows\System\YWHymSD.exe
  2⤵
  PID:8224
- C:\Windows\System\XtpeoOU.exe
  C:\Windows\System\XtpeoOU.exe
  2⤵
  PID:8244
- C:\Windows\System\bfIJQVv.exe
  C:\Windows\System\bfIJQVv.exe
  2⤵
  PID:8260
- C:\Windows\System\ivhlypO.exe
  C:\Windows\System\ivhlypO.exe
  2⤵
  PID:8276
- C:\Windows\System\JXFjBAC.exe
  C:\Windows\System\JXFjBAC.exe
  2⤵
  PID:8292
- C:\Windows\System\QOcUwwk.exe
  C:\Windows\System\QOcUwwk.exe
  2⤵
  PID:8308
- C:\Windows\System\bIBQzhD.exe
  C:\Windows\System\bIBQzhD.exe
  2⤵
  PID:8324
- C:\Windows\System\gGeYSdG.exe
  C:\Windows\System\gGeYSdG.exe
  2⤵
  PID:8340
- C:\Windows\System\WIIVXiU.exe
  C:\Windows\System\WIIVXiU.exe
  2⤵
  PID:8356
- C:\Windows\System\ZBExgbO.exe
  C:\Windows\System\ZBExgbO.exe
  2⤵
  PID:8372
- C:\Windows\System\vGycgHO.exe
  C:\Windows\System\vGycgHO.exe
  2⤵
  PID:8388
- C:\Windows\System\GYWIhPR.exe
  C:\Windows\System\GYWIhPR.exe
  2⤵
  PID:8404
- C:\Windows\System\KaMHVKC.exe
  C:\Windows\System\KaMHVKC.exe
  2⤵
  PID:8420
- C:\Windows\System\ErsPfna.exe
  C:\Windows\System\ErsPfna.exe
  2⤵
  PID:8436
- C:\Windows\System\HqDDiTV.exe
  C:\Windows\System\HqDDiTV.exe
  2⤵
  PID:8452
- C:\Windows\System\SPuevuh.exe
  C:\Windows\System\SPuevuh.exe
  2⤵
  PID:8468
- C:\Windows\System\LetSRps.exe
  C:\Windows\System\LetSRps.exe
  2⤵
  PID:8484
- C:\Windows\System\JeeIYcN.exe
  C:\Windows\System\JeeIYcN.exe
  2⤵
  PID:8500
- C:\Windows\System\OBLmBaf.exe
  C:\Windows\System\OBLmBaf.exe
  2⤵
  PID:8516
- C:\Windows\System\TLWOOKp.exe
  C:\Windows\System\TLWOOKp.exe
  2⤵
  PID:8532
- C:\Windows\System\YIQjadQ.exe
  C:\Windows\System\YIQjadQ.exe
  2⤵
  PID:8548
- C:\Windows\System\NuyXMCs.exe
  C:\Windows\System\NuyXMCs.exe
  2⤵
  PID:8564
- C:\Windows\System\wkSUkdH.exe
  C:\Windows\System\wkSUkdH.exe
  2⤵
  PID:8580
- C:\Windows\System\jvWUoKW.exe
  C:\Windows\System\jvWUoKW.exe
  2⤵
  PID:8596
- C:\Windows\System\NCiADzP.exe
  C:\Windows\System\NCiADzP.exe
  2⤵
  PID:8612
- C:\Windows\System\yEBDEmQ.exe
  C:\Windows\System\yEBDEmQ.exe
  2⤵
  PID:8628
- C:\Windows\System\zQRQXko.exe
  C:\Windows\System\zQRQXko.exe
  2⤵
  PID:8644
- C:\Windows\System\zUFLrOV.exe
  C:\Windows\System\zUFLrOV.exe
  2⤵
  PID:8660
- C:\Windows\System\sTUUTuY.exe
  C:\Windows\System\sTUUTuY.exe
  2⤵
  PID:8676
- C:\Windows\System\HLvPhrp.exe
  C:\Windows\System\HLvPhrp.exe
  2⤵
  PID:8692
- C:\Windows\System\ykPWwlk.exe
  C:\Windows\System\ykPWwlk.exe
  2⤵
  PID:8708
- C:\Windows\System\BChojdr.exe
  C:\Windows\System\BChojdr.exe
  2⤵
  PID:8724
- C:\Windows\System\bZrmhqn.exe
  C:\Windows\System\bZrmhqn.exe
  2⤵
  PID:8740
- C:\Windows\System\BRdeSQw.exe
  C:\Windows\System\BRdeSQw.exe
  2⤵
  PID:8756
- C:\Windows\System\dTkjlij.exe
  C:\Windows\System\dTkjlij.exe
  2⤵
  PID:8772
- C:\Windows\System\FLftpBT.exe
  C:\Windows\System\FLftpBT.exe
  2⤵
  PID:8788
- C:\Windows\System\IBfmmMt.exe
  C:\Windows\System\IBfmmMt.exe
  2⤵
  PID:8804
- C:\Windows\System\nhICooZ.exe
  C:\Windows\System\nhICooZ.exe
  2⤵
  PID:8820
- C:\Windows\System\oticlzY.exe
  C:\Windows\System\oticlzY.exe
  2⤵
  PID:8836
- C:\Windows\System\Qrkzlpe.exe
  C:\Windows\System\Qrkzlpe.exe
  2⤵
  PID:8852
- C:\Windows\System\BmbBbqa.exe
  C:\Windows\System\BmbBbqa.exe
  2⤵
  PID:8868
- C:\Windows\System\VRuxZhi.exe
  C:\Windows\System\VRuxZhi.exe
  2⤵
  PID:8884
- C:\Windows\System\jYrFlzc.exe
  C:\Windows\System\jYrFlzc.exe
  2⤵
  PID:8900
- C:\Windows\System\UHDkwyX.exe
  C:\Windows\System\UHDkwyX.exe
  2⤵
  PID:8916
- C:\Windows\System\VmiMGqL.exe
  C:\Windows\System\VmiMGqL.exe
  2⤵
  PID:8932
- C:\Windows\System\uVaZIIB.exe
  C:\Windows\System\uVaZIIB.exe
  2⤵
  PID:8948
- C:\Windows\System\uZBlqnY.exe
  C:\Windows\System\uZBlqnY.exe
  2⤵
  PID:8964
- C:\Windows\System\ILZQSJv.exe
  C:\Windows\System\ILZQSJv.exe
  2⤵
  PID:8980
- C:\Windows\System\OZtlgfm.exe
  C:\Windows\System\OZtlgfm.exe
  2⤵
  PID:8996
- C:\Windows\System\prwqJCC.exe
  C:\Windows\System\prwqJCC.exe
  2⤵
  PID:9012
- C:\Windows\System\lUNjSFk.exe
  C:\Windows\System\lUNjSFk.exe
  2⤵
  PID:9028
- C:\Windows\System\tkBLUOK.exe
  C:\Windows\System\tkBLUOK.exe
  2⤵
  PID:9044
- C:\Windows\System\xTsSdvX.exe
  C:\Windows\System\xTsSdvX.exe
  2⤵
  PID:9060
- C:\Windows\System\sxXdwCc.exe
  C:\Windows\System\sxXdwCc.exe
  2⤵
  PID:9076
- C:\Windows\System\XuMyjrK.exe
  C:\Windows\System\XuMyjrK.exe
  2⤵
  PID:9092
- C:\Windows\System\QuanNhU.exe
  C:\Windows\System\QuanNhU.exe
  2⤵
  PID:9108
- C:\Windows\System\GhdYCUK.exe
  C:\Windows\System\GhdYCUK.exe
  2⤵
  PID:9124
- C:\Windows\System\IawKvOA.exe
  C:\Windows\System\IawKvOA.exe
  2⤵
  PID:9140
- C:\Windows\System\DSXNrzJ.exe
  C:\Windows\System\DSXNrzJ.exe
  2⤵
  PID:9160
- C:\Windows\System\ioPZvde.exe
  C:\Windows\System\ioPZvde.exe
  2⤵
  PID:9176
- C:\Windows\System\fKmbkfD.exe
  C:\Windows\System\fKmbkfD.exe
  2⤵
  PID:9196
- C:\Windows\System\CxoJIPx.exe
  C:\Windows\System\CxoJIPx.exe
  2⤵
  PID:9212
- C:\Windows\System\qXCxGIa.exe
  C:\Windows\System\qXCxGIa.exe
  2⤵
  PID:8232
- C:\Windows\System\ZponAWn.exe
  C:\Windows\System\ZponAWn.exe
  2⤵
  PID:8268
- C:\Windows\System\XHPXCqC.exe
  C:\Windows\System\XHPXCqC.exe
  2⤵
  PID:7288
- C:\Windows\System\WhZpAmV.exe
  C:\Windows\System\WhZpAmV.exe
  2⤵
  PID:8252
- C:\Windows\System\uXlIYxp.exe
  C:\Windows\System\uXlIYxp.exe
  2⤵
  PID:8316
- C:\Windows\System\CCScjrt.exe
  C:\Windows\System\CCScjrt.exe
  2⤵
  PID:8336
- C:\Windows\System\iVKXmvf.exe
  C:\Windows\System\iVKXmvf.exe
  2⤵
  PID:8400
- C:\Windows\System\QZyMLnR.exe
  C:\Windows\System\QZyMLnR.exe
  2⤵
  PID:8464
- C:\Windows\System\oxBtmDo.exe
  C:\Windows\System\oxBtmDo.exe
  2⤵
  PID:8528
- C:\Windows\System\oXQmAEe.exe
  C:\Windows\System\oXQmAEe.exe
  2⤵
  PID:8592
- C:\Windows\System\ruVocne.exe
  C:\Windows\System\ruVocne.exe
  2⤵
  PID:8656
- C:\Windows\System\IfKNtYQ.exe
  C:\Windows\System\IfKNtYQ.exe
  2⤵
  PID:8384
- C:\Windows\System\XjXydfs.exe
  C:\Windows\System\XjXydfs.exe
  2⤵
  PID:8688
- C:\Windows\System\ydrNFfH.exe
  C:\Windows\System\ydrNFfH.exe
  2⤵
  PID:8752
- C:\Windows\System\uWeBpmO.exe
  C:\Windows\System\uWeBpmO.exe
  2⤵
  PID:8816
- C:\Windows\System\dmZtzvh.exe
  C:\Windows\System\dmZtzvh.exe
  2⤵
  PID:8880
- C:\Windows\System\tJdlHmO.exe
  C:\Windows\System\tJdlHmO.exe
  2⤵
  PID:8944
- C:\Windows\System\CdIzvGZ.exe
  C:\Windows\System\CdIzvGZ.exe
  2⤵
  PID:9004
- C:\Windows\System\uNjjVdC.exe
  C:\Windows\System\uNjjVdC.exe
  2⤵
  PID:9036
- C:\Windows\System\WCwEgWN.exe
  C:\Windows\System\WCwEgWN.exe
  2⤵
  PID:8636
- C:\Windows\System\oVRgINw.exe
  C:\Windows\System\oVRgINw.exe
  2⤵
  PID:9068
- C:\Windows\System\aNkreia.exe
  C:\Windows\System\aNkreia.exe
  2⤵
  PID:9072
- C:\Windows\System\vMXIlxH.exe
  C:\Windows\System\vMXIlxH.exe
  2⤵
  PID:8480
- C:\Windows\System\TwUElHN.exe
  C:\Windows\System\TwUElHN.exe
  2⤵
  PID:8540
- C:\Windows\System\iFhEcCX.exe
  C:\Windows\System\iFhEcCX.exe
  2⤵
  PID:9052
- C:\Windows\System\zcTEPWX.exe
  C:\Windows\System\zcTEPWX.exe
  2⤵
  PID:8892
- C:\Windows\System\lhIyzjb.exe
  C:\Windows\System\lhIyzjb.exe
  2⤵
  PID:9100
- C:\Windows\System\fVMUQsg.exe
  C:\Windows\System\fVMUQsg.exe
  2⤵
  PID:8896
- C:\Windows\System\PawSwQd.exe
  C:\Windows\System\PawSwQd.exe
  2⤵
  PID:9020
- C:\Windows\System\SZquQtH.exe
  C:\Windows\System\SZquQtH.exe
  2⤵
  PID:7436
- C:\Windows\System\xAOiAat.exe
  C:\Windows\System\xAOiAat.exe
  2⤵
  PID:9136
- C:\Windows\System\QmBiewY.exe
  C:\Windows\System\QmBiewY.exe
  2⤵
  PID:9152
- C:\Windows\System\dMCICgq.exe
  C:\Windows\System\dMCICgq.exe
  2⤵
  PID:8240
- C:\Windows\System\jIUCVTI.exe
  C:\Windows\System\jIUCVTI.exe
  2⤵
  PID:7724
- C:\Windows\System\QTHBvUC.exe
  C:\Windows\System\QTHBvUC.exe
  2⤵
  PID:8272
- C:\Windows\System\HqgPCmR.exe
  C:\Windows\System\HqgPCmR.exe
  2⤵
  PID:8288
- C:\Windows\System\PWabtWx.exe
  C:\Windows\System\PWabtWx.exe
  2⤵
  PID:8460
- C:\Windows\System\ZzRRjtF.exe
  C:\Windows\System\ZzRRjtF.exe
  2⤵
  PID:8300
- C:\Windows\System\TVgWBjP.exe
  C:\Windows\System\TVgWBjP.exe
  2⤵
  PID:8848
- C:\Windows\System\wdVMdBS.exe
  C:\Windows\System\wdVMdBS.exe
  2⤵
  PID:8476
- C:\Windows\System\LoOcjhe.exe
  C:\Windows\System\LoOcjhe.exe
  2⤵
  PID:8496
- C:\Windows\System\vwvJgMZ.exe
  C:\Windows\System\vwvJgMZ.exe
  2⤵
  PID:8624
- C:\Windows\System\BsJIpba.exe
  C:\Windows\System\BsJIpba.exe
  2⤵
  PID:8684
- C:\Windows\System\uRQAhCJ.exe
  C:\Windows\System\uRQAhCJ.exe
  2⤵
  PID:8912
- C:\Windows\System\kCoBcmy.exe
  C:\Windows\System\kCoBcmy.exe
  2⤵
  PID:8444
- C:\Windows\System\OXgcqaG.exe
  C:\Windows\System\OXgcqaG.exe
  2⤵
  PID:8768
- C:\Windows\System\ZnTzOwe.exe
  C:\Windows\System\ZnTzOwe.exe
  2⤵
  PID:9084
- C:\Windows\System\CwBqEEj.exe
  C:\Windows\System\CwBqEEj.exe
  2⤵
  PID:8604
- C:\Windows\System\kcVEXUg.exe
  C:\Windows\System\kcVEXUg.exe
  2⤵
  PID:7792
- C:\Windows\System\JHvfYfa.exe
  C:\Windows\System\JHvfYfa.exe
  2⤵
  PID:8216
- C:\Windows\System\iCHQmWA.exe
  C:\Windows\System\iCHQmWA.exe
  2⤵
  PID:8332
- C:\Windows\System\qzRgVae.exe
  C:\Windows\System\qzRgVae.exe
  2⤵
  PID:8832
- C:\Windows\System\BsMixhn.exe
  C:\Windows\System\BsMixhn.exe
  2⤵
  PID:8720
- C:\Windows\System\cLuNdwW.exe
  C:\Windows\System\cLuNdwW.exe
  2⤵
  PID:8704
- C:\Windows\System\emamGDn.exe
  C:\Windows\System\emamGDn.exe
  2⤵
  PID:8652
- C:\Windows\System\SGIQTCW.exe
  C:\Windows\System\SGIQTCW.exe
  2⤵
  PID:8572
- C:\Windows\System\myPZuII.exe
  C:\Windows\System\myPZuII.exe
  2⤵
  PID:8368
- C:\Windows\System\PlVOceH.exe
  C:\Windows\System\PlVOceH.exe
  2⤵
  PID:8448
- C:\Windows\System\cQxOOUN.exe
  C:\Windows\System\cQxOOUN.exe
  2⤵
  PID:8668
- C:\Windows\System\udUtpTN.exe
  C:\Windows\System\udUtpTN.exe
  2⤵
  PID:8864
- C:\Windows\System\fxetaXu.exe
  C:\Windows\System\fxetaXu.exe
  2⤵
  PID:8748
- C:\Windows\System\LUwTOos.exe
  C:\Windows\System\LUwTOos.exe
  2⤵
  PID:9232
- C:\Windows\System\ksquGVW.exe
  C:\Windows\System\ksquGVW.exe
  2⤵
  PID:9248
- C:\Windows\System\eEnTlgD.exe
  C:\Windows\System\eEnTlgD.exe
  2⤵
  PID:9264
- C:\Windows\System\hbCnRML.exe
  C:\Windows\System\hbCnRML.exe
  2⤵
  PID:9280
- C:\Windows\System\jJWQgjn.exe
  C:\Windows\System\jJWQgjn.exe
  2⤵
  PID:9296
- C:\Windows\System\tXyIuPS.exe
  C:\Windows\System\tXyIuPS.exe
  2⤵
  PID:9312
- C:\Windows\System\ETCHtZF.exe
  C:\Windows\System\ETCHtZF.exe
  2⤵
  PID:9328
- C:\Windows\System\CBsskqd.exe
  C:\Windows\System\CBsskqd.exe
  2⤵
  PID:9344
- C:\Windows\System\WiaOpQO.exe
  C:\Windows\System\WiaOpQO.exe
  2⤵
  PID:9360
- C:\Windows\System\bEEuAFS.exe
  C:\Windows\System\bEEuAFS.exe
  2⤵
  PID:9376
- C:\Windows\System\CHizGrS.exe
  C:\Windows\System\CHizGrS.exe
  2⤵
  PID:9392
- C:\Windows\System\xLmEjsj.exe
  C:\Windows\System\xLmEjsj.exe
  2⤵
  PID:9408
- C:\Windows\System\NvYoXoz.exe
  C:\Windows\System\NvYoXoz.exe
  2⤵
  PID:9424
- C:\Windows\System\qLcUhcR.exe
  C:\Windows\System\qLcUhcR.exe
  2⤵
  PID:9440
- C:\Windows\System\unZIHhc.exe
  C:\Windows\System\unZIHhc.exe
  2⤵
  PID:9456
- C:\Windows\System\YCmHagu.exe
  C:\Windows\System\YCmHagu.exe
  2⤵
  PID:9472
- C:\Windows\System\cMYYfmb.exe
  C:\Windows\System\cMYYfmb.exe
  2⤵
  PID:9488
- C:\Windows\System\FDVZCbA.exe
  C:\Windows\System\FDVZCbA.exe
  2⤵
  PID:9504
- C:\Windows\System\wJWaPjl.exe
  C:\Windows\System\wJWaPjl.exe
  2⤵
  PID:9520
- C:\Windows\System\TpQyJFm.exe
  C:\Windows\System\TpQyJFm.exe
  2⤵
  PID:9536
- C:\Windows\System\EnFbiGE.exe
  C:\Windows\System\EnFbiGE.exe
  2⤵
  PID:9552
- C:\Windows\System\fzMUdKF.exe
  C:\Windows\System\fzMUdKF.exe
  2⤵
  PID:9568
- C:\Windows\System\LTXzszs.exe
  C:\Windows\System\LTXzszs.exe
  2⤵
  PID:9584
- C:\Windows\System\fgCfvNm.exe
  C:\Windows\System\fgCfvNm.exe
  2⤵
  PID:9600
- C:\Windows\System\pkfJHNK.exe
  C:\Windows\System\pkfJHNK.exe
  2⤵
  PID:9616
- C:\Windows\System\dNGoBYs.exe
  C:\Windows\System\dNGoBYs.exe
  2⤵
  PID:9632
- C:\Windows\System\aagyNCU.exe
  C:\Windows\System\aagyNCU.exe
  2⤵
  PID:9648
- C:\Windows\System\OUleJaJ.exe
  C:\Windows\System\OUleJaJ.exe
  2⤵
  PID:9664
- C:\Windows\System\IjvLLEg.exe
  C:\Windows\System\IjvLLEg.exe
  2⤵
  PID:9680
- C:\Windows\System\irpcbHk.exe
  C:\Windows\System\irpcbHk.exe
  2⤵
  PID:9696
- C:\Windows\System\vCELgeC.exe
  C:\Windows\System\vCELgeC.exe
  2⤵
  PID:9712
- C:\Windows\System\cgbghKe.exe
  C:\Windows\System\cgbghKe.exe
  2⤵
  PID:9728
- C:\Windows\System\pYaMNnv.exe
  C:\Windows\System\pYaMNnv.exe
  2⤵
  PID:9744
- C:\Windows\System\yjRRnao.exe
  C:\Windows\System\yjRRnao.exe
  2⤵
  PID:9760
- C:\Windows\System\nvlhPlJ.exe
  C:\Windows\System\nvlhPlJ.exe
  2⤵
  PID:9776
- C:\Windows\System\PJhsOSy.exe
  C:\Windows\System\PJhsOSy.exe
  2⤵
  PID:9792
- C:\Windows\System\GyCJumR.exe
  C:\Windows\System\GyCJumR.exe
  2⤵
  PID:9808
- C:\Windows\System\eFkUFnW.exe
  C:\Windows\System\eFkUFnW.exe
  2⤵
  PID:9824
- C:\Windows\System\FcHhcDU.exe
  C:\Windows\System\FcHhcDU.exe
  2⤵
  PID:9840
- C:\Windows\System\bkCWZsu.exe
  C:\Windows\System\bkCWZsu.exe
  2⤵
  PID:9856
- C:\Windows\System\JwofRMZ.exe
  C:\Windows\System\JwofRMZ.exe
  2⤵
  PID:9872
- C:\Windows\System\RmaYSNP.exe
  C:\Windows\System\RmaYSNP.exe
  2⤵
  PID:9888
- C:\Windows\System\fhQmlgg.exe
  C:\Windows\System\fhQmlgg.exe
  2⤵
  PID:9904
- C:\Windows\System\pBvWTRC.exe
  C:\Windows\System\pBvWTRC.exe
  2⤵
  PID:9920
- C:\Windows\System\KIVfyxI.exe
  C:\Windows\System\KIVfyxI.exe
  2⤵
  PID:9936
- C:\Windows\System\CFKrutT.exe
  C:\Windows\System\CFKrutT.exe
  2⤵
  PID:9952
- C:\Windows\System\OfExapb.exe
  C:\Windows\System\OfExapb.exe
  2⤵
  PID:9968
- C:\Windows\System\DDnpPuo.exe
  C:\Windows\System\DDnpPuo.exe
  2⤵
  PID:9984
- C:\Windows\System\CEuZXoj.exe
  C:\Windows\System\CEuZXoj.exe
  2⤵
  PID:10000
- C:\Windows\System\YNQwFWo.exe
  C:\Windows\System\YNQwFWo.exe
  2⤵
  PID:10020
- C:\Windows\System\QjjYght.exe
  C:\Windows\System\QjjYght.exe
  2⤵
  PID:10036
- C:\Windows\System\hlKaKIX.exe
  C:\Windows\System\hlKaKIX.exe
  2⤵
  PID:10052
- C:\Windows\System\ciPRaWr.exe
  C:\Windows\System\ciPRaWr.exe
  2⤵
  PID:10068
- C:\Windows\System\bdbjfOz.exe
  C:\Windows\System\bdbjfOz.exe
  2⤵
  PID:10084
- C:\Windows\System\mhikqIz.exe
  C:\Windows\System\mhikqIz.exe
  2⤵
  PID:10100
- C:\Windows\System\HLKgYOL.exe
  C:\Windows\System\HLKgYOL.exe
  2⤵
  PID:10116
- C:\Windows\System\OnDVnFB.exe
  C:\Windows\System\OnDVnFB.exe
  2⤵
  PID:10132
- C:\Windows\System\utuNFCJ.exe
  C:\Windows\System\utuNFCJ.exe
  2⤵
  PID:10148
- C:\Windows\System\HlcchnZ.exe
  C:\Windows\System\HlcchnZ.exe
  2⤵
  PID:10164
- C:\Windows\System\AvjCeDo.exe
  C:\Windows\System\AvjCeDo.exe
  2⤵
  PID:10180
- C:\Windows\System\roqWfAK.exe
  C:\Windows\System\roqWfAK.exe
  2⤵
  PID:10196
- C:\Windows\System\IlvAydY.exe
  C:\Windows\System\IlvAydY.exe
  2⤵
  PID:10212
- C:\Windows\System\dJdTlkk.exe
  C:\Windows\System\dJdTlkk.exe
  2⤵
  PID:10228
- C:\Windows\System\ZoPcxXT.exe
  C:\Windows\System\ZoPcxXT.exe
  2⤵
  PID:9228
- C:\Windows\System\oiZDKlu.exe
  C:\Windows\System\oiZDKlu.exe
  2⤵
  PID:8928
- C:\Windows\System\QLvrVqh.exe
  C:\Windows\System\QLvrVqh.exe
  2⤵
  PID:9192
- C:\Windows\System\MtNitfd.exe
  C:\Windows\System\MtNitfd.exe
  2⤵
  PID:8764
- C:\Windows\System\ThQgtkr.exe
  C:\Windows\System\ThQgtkr.exe
  2⤵
  PID:9324
- C:\Windows\System\PQHhzIA.exe
  C:\Windows\System\PQHhzIA.exe
  2⤵
  PID:8860
- C:\Windows\System\AKzxlNC.exe
  C:\Windows\System\AKzxlNC.exe
  2⤵
  PID:9420
- C:\Windows\System\pBDKITj.exe
  C:\Windows\System\pBDKITj.exe
  2⤵
  PID:9304
- C:\Windows\System\pDBvQUl.exe
  C:\Windows\System\pDBvQUl.exe
  2⤵
  PID:9480
- C:\Windows\System\yAIZIZO.exe
  C:\Windows\System\yAIZIZO.exe
  2⤵
  PID:9308
- C:\Windows\System\TMnzrrY.exe
  C:\Windows\System\TMnzrrY.exe
  2⤵
  PID:9276
- C:\Windows\System\OkwDYYA.exe
  C:\Windows\System\OkwDYYA.exe
  2⤵
  PID:9368
- C:\Windows\System\dSPFGgg.exe
  C:\Windows\System\dSPFGgg.exe
  2⤵
  PID:9500
- C:\Windows\System\MHrDlyx.exe
  C:\Windows\System\MHrDlyx.exe
  2⤵
  PID:9548
- C:\Windows\System\GIuDOSI.exe
  C:\Windows\System\GIuDOSI.exe
  2⤵
  PID:9564
- C:\Windows\System\prdEnAo.exe
  C:\Windows\System\prdEnAo.exe
  2⤵
  PID:9612
- C:\Windows\System\ENJtnbp.exe
  C:\Windows\System\ENJtnbp.exe
  2⤵
  PID:9628
- C:\Windows\System\LQzUmwa.exe
  C:\Windows\System\LQzUmwa.exe
  2⤵
  PID:9660
- C:\Windows\System\ZRgMxCh.exe
  C:\Windows\System\ZRgMxCh.exe
  2⤵
  PID:9720
- C:\Windows\System\Bgppyty.exe
  C:\Windows\System\Bgppyty.exe
  2⤵
  PID:9784
- C:\Windows\System\AWzwIaI.exe
  C:\Windows\System\AWzwIaI.exe
  2⤵
  PID:9740
- C:\Windows\System\YgRsuEt.exe
  C:\Windows\System\YgRsuEt.exe
  2⤵
  PID:9816
- C:\Windows\System\qMEBgRA.exe
  C:\Windows\System\qMEBgRA.exe
  2⤵
  PID:9832
- C:\Windows\System\PNeQnHF.exe
  C:\Windows\System\PNeQnHF.exe
  2⤵
  PID:9896
- C:\Windows\System\XPpqBKg.exe
  C:\Windows\System\XPpqBKg.exe
  2⤵
  PID:9884
- C:\Windows\System\TFjKLvQ.exe
  C:\Windows\System\TFjKLvQ.exe
  2⤵
  PID:9928
- C:\Windows\System\PjmZbHL.exe
  C:\Windows\System\PjmZbHL.exe
  2⤵
  PID:9980
- C:\Windows\System\XGQEpZP.exe
  C:\Windows\System\XGQEpZP.exe
  2⤵
  PID:9932
- C:\Windows\System\PXVNkpP.exe
  C:\Windows\System\PXVNkpP.exe
  2⤵
  PID:9996
- C:\Windows\System\LtaPeaW.exe
  C:\Windows\System\LtaPeaW.exe
  2⤵
  PID:10092
- C:\Windows\System\EoZijVx.exe
  C:\Windows\System\EoZijVx.exe
  2⤵
  PID:10044
- C:\Windows\System\zthgfeL.exe
  C:\Windows\System\zthgfeL.exe
  2⤵
  PID:10124
- C:\Windows\System\DonSCJl.exe
  C:\Windows\System\DonSCJl.exe
  2⤵
  PID:10140
- C:\Windows\System\MwkTBAl.exe
  C:\Windows\System\MwkTBAl.exe
  2⤵
  PID:10176
- C:\Windows\System\OTFrQtB.exe
  C:\Windows\System\OTFrQtB.exe
  2⤵
  PID:10220
- C:\Windows\System\goEQvUV.exe
  C:\Windows\System\goEQvUV.exe
  2⤵
  PID:10236
- C:\Windows\System\VTQxfHt.exe
  C:\Windows\System\VTQxfHt.exe
  2⤵
  PID:8796
- C:\Windows\System\juicXCW.exe
  C:\Windows\System\juicXCW.exe
  2⤵
  PID:8220
- C:\Windows\System\WWtrSwv.exe
  C:\Windows\System\WWtrSwv.exe
  2⤵
  PID:9448
- C:\Windows\System\yPimUji.exe
  C:\Windows\System\yPimUji.exe
  2⤵
  PID:8784
- C:\Windows\System\oJxiIzZ.exe
  C:\Windows\System\oJxiIzZ.exe
  2⤵
  PID:9400
- C:\Windows\System\UqMTSKR.exe
  C:\Windows\System\UqMTSKR.exe
  2⤵
  PID:9544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BZDYJln.exe

Filesize
1.6MB

MD5
7a9d15b2a0d57309d2b4c6205fe43a81

SHA1
2a31e2098a27fbc59e9fe7a200ad54ef0e253442

SHA256
ce41054aef5db4ce9df5514066ae47f9e1db16c52b0f896c4af03bd54e35143a

SHA512
aea02fc5fbc13a970fce2600a9e302560e4ebfa4eaedadc31403cb763ce6ed5ed0a884aaca25243f8a0a3fd1d013946fcc753c8929d8afbe7e556b7d03c773a7

Download Submit
C:\Windows\system\CweSkTL.exe

Filesize
1.6MB

MD5
9340502446d566dbfb5aae5df8990c05

SHA1
b5527a31b3f7191c7f2ba6d3ad2f84d368a76326

SHA256
c36ce83b0f9598d3d6d831867c759e083a7811832931d00b3f195ac79b563b91

SHA512
77da02009dea5b44ac0d226da62bb1b9165e91c3f37a42173ea3110fa7f6fa4d7e35f279695fe7118103c1561834ca406518e73ea0a169c2e135eaa3c1e9ae0f

Download Submit
C:\Windows\system\EUsXgRP.exe

Filesize
1.6MB

MD5
30c0b1191416df4348a0e2637d9f7f0f

SHA1
1eedda6cf364eceaefa40d918be7273a2ffd2c48

SHA256
71f7f95c4f660aed11f466a1abe7314eb68df298e86eb0285dbdf82555e438a7

SHA512
6bb2efc1d703c49fc8de6afa8d94c3a6d11e6c94ff80d35f919bd037c285c3799b54ee86259706ca4d9921b981fda89d8b2f6f12b5d3bef712c1441d7a8ef6d8

Download Submit
C:\Windows\system\EZCeIah.exe

Filesize
1.6MB

MD5
eb3818543eccdb052b0ac92cd3630ad8

SHA1
6fc8b72cf623e63901600f90048a4772828b4c8e

SHA256
1837e803240f9a13a66bbeb1ecc1783f34c2a86f7fb1c362b2f427f34cdbf27b

SHA512
96e80ebc67905e8886e5d7ff3524fd61af1d0347ecc961202b35565ef2a99ba04c862392ac41ea01b2a2ee0060f2ec5f55c3bc89d7c7f847d6b7e3ca5da044e9

Download Submit
C:\Windows\system\GHiXINR.exe

Filesize
1.6MB

MD5
04c200113be61319ec5af997d930bdb9

SHA1
6f84089940c7039d6f72bd1d6c0a0c5079ff3ce7

SHA256
1a954e0fd97a18bdca8cbd1e063d6255da3fd6537d1d7635fb6c37ac3ead9eb4

SHA512
0769be980c9668bbb72f6eab00be8ffa94a2c585be4828d54dbfaff1a83d615155fbde73d0c058395e917241fc819cf04f5b201629fe0c2b224406f0ee738e7e

Download Submit
C:\Windows\system\JJWTMqn.exe

Filesize
1.6MB

MD5
9a352ed9d7886501222800d8e8cccf4d

SHA1
8fb4eb75a353e23996a31c7d1da60f704fb12cc0

SHA256
d0e01be4a7c78b20fbaf9df547a24df69b878881a065787df9d08812337cf87d

SHA512
196d3113ca47f363e0749d883c2b08b38e7b8c394b145eac6bee2749082d46ecf40698574e2d9cc9d3e540f7318f9b65c50d2350ea12dc04fe4b06b331882036

Download Submit
C:\Windows\system\KnOXsoA.exe

Filesize
1.6MB

MD5
7a0e4d81a5b50e28b447f4ec678e4e7b

SHA1
e99c5044ea8e64aadd15e7878a2ae257f1c56fd8

SHA256
da3c8f9aed2d4e208614263a10885acc183a9971a5530bfbc8b54c80787a3e19

SHA512
639e63f413b0eff236d9ed8126fae40e609b2c4cba4dd19bee1af326e5d401352dbb07fe4455340fa94a91269cc8ddb5f50608d07642199455046bd5db3a990d

Download Submit
C:\Windows\system\OUcSWvy.exe

Filesize
1.6MB

MD5
60915d33b956578f878c4b28c4b3ff2e

SHA1
edb7d19d17fff528bec53d1afd897dcf7881e668

SHA256
a08bc4fb90aac40dbfc6f15c946319a5a541fd40f8ff6fdc7dd1b22a3c0a99c5

SHA512
6e8c8cf5ee0b6d9f62ee60e9e3a9ecb0eca1d4da81cfc09d17108689d3a77acc5cac34ed8c06ef6bb66030430f745e7ca28b0947ec74b7af7cb1de1594a5a44e

Download Submit
C:\Windows\system\SyLBCZg.exe

Filesize
1.6MB

MD5
a48b99dd990c15292ad0c28c6789a7b6

SHA1
cbe6b850dbf86d7e9b01d5ab71d893e8556d9faf

SHA256
87d72be08b3ae222ecefcae83ffc66ad6320f456f3c32ac31f42ee3ed800b8da

SHA512
975c62549757ca371fa5bfe70afaad27f68748afb7aafdd15c4b8a93aaf1b7857d39cae48b5c074207c996b686b3967ea35102532439ba4ec93b21fd2017c8d2

Download Submit
C:\Windows\system\TZVXeZr.exe

Filesize
1.6MB

MD5
666deb6298e7d2412409451a62298061

SHA1
db78bca936e2e3183df6d21506506d62abaa37e1

SHA256
13c2ec4692fb96df883c5c5cfb88243eff5cc10a0db3e53d9366667e6a125330

SHA512
360ae9b4b1aceaaf5d9fb938e31e770565b6fb96a00a2f3e2ba451b84ecba524f0151f66d92ad3ab166b864bf5f42844884e551c2a7d0f9a917985051658d66c

Download Submit
C:\Windows\system\UxJzVMG.exe

Filesize
1.6MB

MD5
fac03278f1632144cdbd1ac9b31e5f46

SHA1
33a32cbfa32baec8b7da954d898ee5135ea131d7

SHA256
cf6487ae920926d0510636750ffc7f6c0333745be478f310d1c3a70943facc7a

SHA512
94634913e2e842fb4f363716f3c724024792e613b816b098a85fdf3e75dff3993713cdc8fb5f0853a3d9dee4c29b0205030af854e3dac12c1168a613145a1a4c

Download Submit
C:\Windows\system\WiTYZpL.exe

Filesize
1.6MB

MD5
38ef438c5ef6c986127066e51d344631

SHA1
440feb47a24036210c60e9df0fded9c049fa3b38

SHA256
a7c3c0d25baebbc66a4a6f325f2fd6ce5d80bff066e95b18ae82fd0002a8ca41

SHA512
d0dea4a8bc386984c23ae88c1cdfe7f290cf37109518d0e5cb12fe03d1e0488eeb663c27280c41abe4e5333cb85b2fd91aae846a83bee35b82c8875e73783577

Download Submit
C:\Windows\system\ZonscHv.exe

Filesize
1.6MB

MD5
d2efb1bc5bf9a32690e8cee63aaf0157

SHA1
2baac2af63f43b1711d1d86ef203280d914ac5ce

SHA256
eb799332d0cd5adb1e0c99a332218af800f0382cd76ade6a0052e51d455e3056

SHA512
11b7725b132ab3cd1f183a0d8c2dc2bbbef70ff3f7400366f5b1440bab6224c462b74594f9154e291f48ea587c20030a826670ad734f700749267cd23e543963

Download Submit
C:\Windows\system\ctEPkBU.exe

Filesize
1.6MB

MD5
f5510f84331179e42a2b1d3e31b388ae

SHA1
1a6218a590845a2378c511c46eab24f9e2072d7a

SHA256
c3f491861408d4376cd986841006438249d5853bba449ee1592be8a563614c75

SHA512
0b6dffede970a47f5489e561b242c9da3247dfcec4a31e5f2ff2f6c9a30b24703f3acf8a4f61903973e68e7fb5972b3bddda23e00600082f98df909be625790e

Download Submit
C:\Windows\system\grrIyeU.exe

Filesize
1.6MB

MD5
b221f7c4484b7e44cb09320083211dd2

SHA1
dbeafff785eb37a9b85844d60d77c33c0e7bc255

SHA256
4d5643fd197a9f79d9e4c088441018ff31c5c69cbce96fa96d4c9f6cf3576c56

SHA512
a0bf8fcfc39a61964c0c0496f8d1f88a833efe24bce14496a8ff316cb23a4e7c5d34f3e7780d40b4fa2a156bda529f36118822481291b73b08e31f1aef65c223

Download Submit
C:\Windows\system\gvzLEvh.exe

Filesize
1.6MB

MD5
840f0b0baec81a87de3b37a6f290cb87

SHA1
fcf41a12daef81202c80271a3ea80321036ea0e7

SHA256
9df154bd64959f007870cd69268074cf6595949ab16047161c0a5828e40f7fec

SHA512
0eae76175846ea58df71e66f535081bf7efcd520d8452dae43b1b564b71ca405b64aa6dfc9a994f2cb4269ce6bf4e3603f1a6b1ed8a4b756b99edb647e44565d

Download Submit
C:\Windows\system\gwCKwFz.exe

Filesize
1.6MB

MD5
e0a65066610982dea125e72fcbece2a5

SHA1
72fd51c4da707be9ce1a45657d2c30054397b831

SHA256
d027a1b7c13783d5f528bdd1d2521bca59ada29fe548a035139ee239f9c94c9e

SHA512
852cf4f5f0bef5f14a0911fad7c96a46b2cbc74076ab13b373396db05188f6ba684b4803656a45ad5ba9187c262565606674becfefff34ca39a35204a0e7948f

Download Submit
C:\Windows\system\iMHLyiH.exe

Filesize
1.6MB

MD5
f2ac110599a605257f80e4a8ddddf6fb

SHA1
eef52e0434b95d8ae1175f9fcd3331836db587ef

SHA256
2700cfa5375611c87594cb0ccd804d78f73a5811b8d3dc557d93edcf9433fb77

SHA512
aa6c9e88d74e8d84cc71548f3452f734bc99d9892d57cba4a920b5c713f80621988060478656f7ef6bd30e1a8d99320d517143ee658944d0f79f0467e69ba647

Download Submit
C:\Windows\system\iVLcTFt.exe

Filesize
1.6MB

MD5
1564c28103ae3f6b1563bf70a775b234

SHA1
034fd66e71020a7fc44f57d00c22056f5425b2ca

SHA256
e9219d3bc0975d0abd40fc4971f2036adc7a09f90866db927cbed13971be447c

SHA512
9e17828f49d66fcb0604b8631560fc1aa7621d2f031f0e0bf57538dedcbb6d2a60fb683b873eea0bf50c1018ea0dd1b9cfcc0cf1813c16e3a4690beef71c85ad

Download Submit
C:\Windows\system\jkyudpI.exe

Filesize
1.6MB

MD5
ecf7aaad6912213162cedbe74358af59

SHA1
7f2c9084fbf06b0897eb4c0bbd349e4766ac010e

SHA256
9661a0e7bb0fda74f65cfb7e3870b239f3eafd67afd9b6b2153f901292d5d58e

SHA512
df037e218e31ae46c0f92f4b8810b2d503b0308dbf37eb008daf7c9f676cb99a8915cf0c03a9697a22f1098d8f1458bea5e78925f6e031283981f3b05ee993f3

Download Submit
C:\Windows\system\nUnmFJX.exe

Filesize
1.6MB

MD5
0a8661340045a9da44d2fdb812c20d24

SHA1
e20573668f3682bc77ceafecba4d9e24a85d69cc

SHA256
5d0c0a69ee42bf8956ab1bcce90284346eb610898964ab9e4c921284c706b9a2

SHA512
8f389ac074f32d1eb75963706637e4e7c677efcf0ba3c90ace3a759aacf21a69f93562ecdec00b288d408c5e4db6e1c1a059ca45da48be4303ee4169cbd31d6b

Download Submit
C:\Windows\system\rfbbyvc.exe

Filesize
1.6MB

MD5
5872c6936363fc9ce844f33081110a4b

SHA1
f50b4feca5f4c1c8b5d447c835955911b0328d3d

SHA256
c126c15d60dbebd2dd4355779b083bb6bab69642671a4d3b94ecac8565a3e3dc

SHA512
4dc9dcab2637d1abf09ac6e4135e6c846ae8590c09ddf65a7db9705b5d152b3624821e4f09be061667439e3dc4d601894116ed203ba66209eaf4403fe28cf3b9

Download Submit
C:\Windows\system\uLIBNYN.exe

Filesize
1.6MB

MD5
abd0cb66c4e4427356d541900562cf68

SHA1
9fcf188be8aefa30586dd8edade6ffe265906656

SHA256
5ceecc307be619574850535ee59d5f95dc5f4786245746e169ecb252c6e5f9ba

SHA512
f454850991686b7287e5c5e255664779a6bc2ec7a7e66b72a68053d5330617d4c0b9bb37ece87f1c82e57c1434e35e1fd80b5d474d02490500600f6f76191f81

Download Submit
C:\Windows\system\uxkGwss.exe

Filesize
8B

MD5
99de9fff1c384289fd83d6dc064e3eb0

SHA1
fa84ee172bcad31d12f63f68f75302eced3eb04f

SHA256
537073a623a98b420b130d9402dd47b4473cacc54bdf99b0af6e70cdc060b0c4

SHA512
32b02fb241ee8ccb51a930c94c4606bc8e22fc37808a558b3fe991d8b07928c47bc9164b507cba81eba02f3d4eb5f05322ac8cae374b09a2de26d954326f3d48

Download Submit
C:\Windows\system\yqjodXM.exe

Filesize
1.6MB

MD5
98f224749a8d8936a53c12e804853df3

SHA1
7ca9d554c81e46cc226e1d0a9009d4a99326b8d1

SHA256
f45b1d0515a4c0435ab40881fe9aa99fed933abf020600b3f9d136449e4e3cca

SHA512
ac9f1c7cdeae60fdfd2d9e882a5aa560d34ae2108cdfffb4ea71c9b7d7599770c56c901d9289ab1b952bb79785f07f0263416df8322f78c73b980997460471b7

Download Submit
C:\Windows\system\zIRTYAQ.exe

Filesize
1.6MB

MD5
0a883ea852051addfe193d8ca16a24d4

SHA1
e0cc09ff33a350ef4bc7e15462f0c986261d9fad

SHA256
be5be3d40a040ac4411a3f942ba41ed2599de687cbfa64278489d7030240855c

SHA512
bc6c07807cc3d3cdf35bc67ca38b498aa6e16eb200f61bc5e67c0155a3cd03804554939298945a737d614798bc4f7bbed7d8e78ff27f53e1d396cd426ddba789

Download Submit
C:\Windows\system\ziKbLsm.exe

Filesize
1.6MB

MD5
6ee44c5fdf7988a129b63b99c13c23e7

SHA1
9e8e044e1f703a27bfa21f1516a8053d7929135d

SHA256
6a88cc949c5a8ba6c8c2a07962c3429786d5ff35472e4ab748a9b938487dfd3d

SHA512
63be06553943b951abda0c87c04101bec5fa6bbf4601d7a8bfcf4afdc0cf19bb972a4dd355f341c4e481a2a629d838d2b09a7c7ce2b6844091c91dc846fe8c3f

Download Submit
\Windows\system\HNkCzkz.exe

Filesize
1.6MB

MD5
700d25fa34eb667485105b62cd1e37f8

SHA1
ca4e02e37dc754d93311de347ba169df4cef88ab

SHA256
06482cb044585d7d105acf575c62e934fa11a92ba2c25678ad39dfa92b16ef9a

SHA512
210b4c0c37563c55a162089221a005877904f28b05664127c01536299cce276c33969722b1929b9a72e249762f32de3d977e63077545b730117d6335828e0520

Download Submit
\Windows\system\IpVptrK.exe

Filesize
1.6MB

MD5
dc15cc4584c5f1b2e78e2a29ad55044c

SHA1
abf6fe43944d2f02715a0ebfdc606e19b3b7e144

SHA256
0164998a3a52fe8e2bd09988bcecd7541311496dfcecf2a09026376f72e35890

SHA512
bef559f2c203963a83e12810562c42ca673ac0907e1d3d0aadd54b01f0f44367818ee1701b144d04ed7b85294cbe9be6038b22b3890037562296f0ddc4db4002

Download Submit
\Windows\system\heNZsaN.exe

Filesize
1.6MB

MD5
591e84e73b03a0b168846eed101cd3a6

SHA1
2935d078704d915273b58ff553d8bcd9d90cc5c5

SHA256
1c3ea35f654d4f50631d334b0c2d5f9552b70558da9184853dbf4d537d12b914

SHA512
06c595342837005b9d14fbc7c6fcb01a23658e7d7ca3702f478ad29a00f5e3fcd798fc2912cf675aec3455b0620a82566c05b4d0ccd83244446ed2a79216464e

Download Submit
\Windows\system\hurYHPU.exe

Filesize
1.6MB

MD5
f253301c881330f39948d2fc95d7d938

SHA1
f1f7e9a2ea7b934a52987c1a6bf2f724bffdecb4

SHA256
e9f7300d31d611a49f8e14d53f560a8321264b6f24b8a8aa7b54d2ad6dcddf27

SHA512
043f6505292009f8c7bdc1b2e1bc52fce8c08158fcf09b21e5e91d9467f220aee00aa955fa7464447f8f886803795e594b39537cccbe179e743df67b88a69284

Download Submit
\Windows\system\nVzItgh.exe

Filesize
1.6MB

MD5
ee94f6d9efd376c4f777544c5451be3a

SHA1
6554fb4cb7da9aa9d2b1db017b00b5d59d6a5921

SHA256
f29e228efed2f01ea8036b331eec738d5a006bcd26153bbae8e502a1672fbbcc

SHA512
1b591a05f97120fd141deab43370c7fd6c97fc643a9de08fdfa3a1dcb69957540b61beeb8995f3ddd3d6d553221cabd10fb993bae34648277b2588c21111fa76

Download Submit
\Windows\system\quVsLbc.exe

Filesize
1.6MB

MD5
3a06c9974ddfb67d901b9381b1be5a6c

SHA1
52c7d081ea35ef0071c600cdfdb8dd80c664bbf3

SHA256
bc9f05be5a6de06538d9bddf4ca510368549195b8ac937a0d61497de9b3b876b

SHA512
234abf7cc65d4d4c6e763a4bd5ad59d8436e5d469980a72e3239430d39eadca18b683ce7073d4834498569a964d332293833e78000f56d3aeb6b5bb4fd23088a

Download Submit
\Windows\system\sPdfmcP.exe

Filesize
1.6MB

MD5
f4fd6b180bb8d41495f1e0a3e0ddd716

SHA1
0ab0c3a82c951faa075adcb8ee2f23c27c242712

SHA256
8942862dd35850af92a9fcffabbe46136ecfa038c5a091808222ecc5b92c3ea2

SHA512
379c4c2c04ce0dbccd89bc7f45d7d5084e54899126cb944de6cc2e71aeecd1ce435cfae7328cdd8da71312f63cbb2fd139712b3d7c04f50e0b359da80f4f5bd6

Download Submit
memory/2072-14-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2072-5686-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2104-210-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-5745-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2196-15-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2196-5558-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-26-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-5722-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2216-203-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2216-1-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2216-199-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2216-25-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-201-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-4520-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-212-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2216-1186-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2216-197-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2216-12-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-205-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2216-208-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2216-209-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2216-211-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2360-235-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2360-27-0x0000000002B00000-0x0000000002B80000-memory.dmp

Filesize
512KB

Download
memory/2360-195-0x000007FEF5570000-0x000007FEF5F0D000-memory.dmp

Filesize
9.6MB

Download
memory/2360-28-0x000007FEF582E000-0x000007FEF582F000-memory.dmp

Filesize
4KB

Download
memory/2360-231-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2616-207-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2616-5601-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2644-204-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2644-5747-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2768-196-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2768-5748-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2776-200-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2776-5746-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2808-206-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2808-5724-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2936-202-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-5685-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-5684-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-198-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download