xmrig | 1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
Size

1.6MB
MD5

c56d2e84c8cb42fb24851c422b284a54
SHA1

f05a42b829aede7440041233bf85f0b0d3ffb56d
SHA256

1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905
SHA512

7e75cecfd2aab6b034130b66e2a73357c065c1d41d4797b0585b7b7a3d4690315d0d4b05e0a5ff50edf647e27a7bdaac88505a30ff32810c869717e90384c7a0
SSDEEP

49152:Lz071uv4BPMkyW10/wKV7hjSe5CtAlM22Cv:NABq

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/1408-9-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/2676-51-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/1788-52-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/1788-260-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2960-951-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2580-1027-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2860-270-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/3028-49-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/2716-55-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2360-53-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/1584-1303-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig
behavioral1/memory/2960-2863-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2716-3161-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/1408-3170-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/2860-3169-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/3028-3168-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/1584-3216-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig
behavioral1/memory/2360-3215-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2676-3214-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/2580-3217-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1376	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1408	VXVpRfp.exe
2860	KrlchRp.exe
2360	PkRjQPP.exe
2716	PlQQVNR.exe
3028	xfpEFnF.exe
2676	KsuzJKc.exe
2960	QKiJSbq.exe
2580	uiGxmQK.exe
1584	Oecuele.exe
2564	UMmJtPr.exe
1224	kaqGjVt.exe
1204	lFtnarK.exe
1900	LRzxLMY.exe
1672	uUotfLY.exe
1140	isaCanX.exe
2792	ECstBIO.exe
2712	wZvSyID.exe
2996	TeQfWYc.exe
2024	akKBxGo.exe
2604	NXGVvLz.exe
2296	OYNLbbK.exe
584	DCMccsD.exe
1460	FTnywVZ.exe
2568	jpRjoHe.exe
1200	qRvkKBx.exe
1496	jPUayve.exe
436	xlhhEVq.exe
2028	iiMUBGs.exe
2912	IMoYIxD.exe
1404	AUrcYGU.exe
1832	uPsOejp.exe
108	gxrfjKD.exe
2316	vBAyTem.exe
1332	ejhotvM.exe
900	RjlIUZH.exe
908	muIqheR.exe
1188	QnXjgQa.exe
596	xRVHLRd.exe
1428	XtxJsmH.exe
2200	NcOATcT.exe
2452	TJucmng.exe
2308	ssnrUBj.exe
800	nJOsiUD.exe
1640	QDBHnCL.exe
1628	nhPNvEb.exe
2796	MBTJzjF.exe
2480	hDiupRf.exe
2220	HNqKlvM.exe
1756	smHRytN.exe
236	KQsmekm.exe
3048	zbDFXDM.exe
2052	uQxMpoP.exe
2324	GssfeJA.exe
2664	UboUuav.exe
2760	vBxXVmL.exe
2336	sZoXuLR.exe
828	skQmIQV.exe
2104	UixVahx.exe
2820	CmvseBe.exe
2704	DeENHQl.exe
1652	gKcAprJ.exe
2880	FaRRCTI.exe
2940	drkRrUP.exe
2876	puYTpgV.exe

Loads dropped DLL 64 IoCs

pid	Process
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1788-0-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/files/0x0009000000016dca-6.dat	upx
behavioral1/memory/1408-9-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/files/0x0007000000018f80-10.dat	upx
behavioral1/files/0x0006000000018f84-16.dat	upx
behavioral1/files/0x0008000000018f8e-28.dat	upx
behavioral1/files/0x00060000000193d5-39.dat	upx
behavioral1/files/0x0004000000019461-50.dat	upx
behavioral1/memory/2676-51-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/files/0x0004000000019481-72.dat	upx
behavioral1/files/0x0004000000019515-104.dat	upx
behavioral1/files/0x0004000000019520-110.dat	upx
behavioral1/files/0x0004000000019524-121.dat	upx
behavioral1/files/0x0004000000019489-150.dat	upx
behavioral1/files/0x000400000001952e-170.dat	upx
behavioral1/files/0x0004000000019540-167.dat	upx
behavioral1/files/0x0004000000019522-163.dat	upx
behavioral1/files/0x0004000000019545-181.dat	upx
behavioral1/files/0x0004000000019548-187.dat	upx
behavioral1/memory/1788-260-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2960-951-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2580-1027-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/2860-270-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/files/0x0004000000019542-177.dat	upx
behavioral1/files/0x000400000001953e-175.dat	upx
behavioral1/files/0x000400000001951e-161.dat	upx
behavioral1/files/0x0004000000019510-159.dat	upx
behavioral1/files/0x00040000000194f7-157.dat	upx
behavioral1/files/0x00040000000194e8-155.dat	upx
behavioral1/files/0x000400000001942a-139.dat	upx
behavioral1/files/0x001700000000558f-137.dat	upx
behavioral1/memory/1584-119-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/files/0x000400000001950e-103.dat	upx
behavioral1/files/0x00040000000194f0-95.dat	upx
behavioral1/files/0x000400000001949e-88.dat	upx
behavioral1/memory/2580-80-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/files/0x000400000001946b-70.dat	upx
behavioral1/files/0x000400000001947d-68.dat	upx
behavioral1/files/0x0008000000018ef7-62.dat	upx
behavioral1/memory/3028-49-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/files/0x0006000000018f88-44.dat	upx
behavioral1/memory/2860-23-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/files/0x0004000000019537-143.dat	upx
behavioral1/memory/1788-58-0x0000000003080000-0x0000000003472000-memory.dmp	upx
behavioral1/memory/2716-55-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2360-53-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/1584-1303-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/memory/2960-2863-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2716-3161-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/1408-3170-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/memory/2860-3169-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/3028-3168-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/1584-3216-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/memory/2360-3215-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2676-3214-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/2580-3217-0x000000013F630000-0x000000013FA22000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UXVCzRG.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\RKwCDXh.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\nrzLfdi.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\ybOMfEx.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\SJyvDzO.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\QUIoElA.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\dOABAqz.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\tKSJaeU.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\qfrmywZ.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\IPQeKag.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\gCaLuLW.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\GQHJxog.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\LegzwPy.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\BTKkNEg.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\CNlBgti.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\rhvOEQB.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\UIlalRi.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\NLRhyUs.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\XdNlrPX.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\IwnPcDk.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\DPIhbjq.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\cCntQYE.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\FSEkpmZ.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\TOuIOjn.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\VhcinGe.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\GtpqsyH.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\BehwOBc.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\dAZpYKQ.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\MqlkiHl.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\hFxlpWa.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\VCtbIyy.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\rKmyqvC.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\XtxJsmH.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\PCEFqsz.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\rLUhdjW.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\aMsUWqQ.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\alszajP.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\UMmJtPr.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\PuESOOj.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\IVWsoAi.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\yjSCDVU.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\uWKwMQs.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\DJjgQBr.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\BImBuPS.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\wPOSrah.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\NpJtqYV.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\QbZtyrh.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\zcoopta.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\fUUMiwk.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\wVomfyx.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\JsfgCFn.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\lLZYQmN.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\RJkZpxY.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\WNTrJxc.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\TgOsYFX.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\nmhqUZq.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\HUFmLOI.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\yrQkIAf.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\mYVTWqT.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\KnkAdpt.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\uaRbJBf.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\WRGuRBy.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\wITpAmp.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
File created	C:\Windows\System\gZrPpVD.exe	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1376	powershell.exe
1376	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
Token: SeLockMemoryPrivilege	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
Token: SeDebugPrivilege	1376	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1376	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	31
PID 1788 wrote to memory of 1376	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	31
PID 1788 wrote to memory of 1376	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	31
PID 1788 wrote to memory of 1408	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	32
PID 1788 wrote to memory of 1408	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	32
PID 1788 wrote to memory of 1408	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	32
PID 1788 wrote to memory of 2360	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	33
PID 1788 wrote to memory of 2360	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	33
PID 1788 wrote to memory of 2360	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	33
PID 1788 wrote to memory of 2860	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	34
PID 1788 wrote to memory of 2860	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	34
PID 1788 wrote to memory of 2860	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	34
PID 1788 wrote to memory of 2676	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	35
PID 1788 wrote to memory of 2676	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	35
PID 1788 wrote to memory of 2676	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	35
PID 1788 wrote to memory of 2716	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	36
PID 1788 wrote to memory of 2716	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	36
PID 1788 wrote to memory of 2716	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	36
PID 1788 wrote to memory of 2792	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	37
PID 1788 wrote to memory of 2792	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	37
PID 1788 wrote to memory of 2792	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	37
PID 1788 wrote to memory of 3028	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	38
PID 1788 wrote to memory of 3028	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	38
PID 1788 wrote to memory of 3028	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	38
PID 1788 wrote to memory of 2712	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	39
PID 1788 wrote to memory of 2712	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	39
PID 1788 wrote to memory of 2712	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	39
PID 1788 wrote to memory of 2960	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	40
PID 1788 wrote to memory of 2960	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	40
PID 1788 wrote to memory of 2960	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	40
PID 1788 wrote to memory of 2024	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	41
PID 1788 wrote to memory of 2024	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	41
PID 1788 wrote to memory of 2024	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	41
PID 1788 wrote to memory of 2580	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	42
PID 1788 wrote to memory of 2580	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	42
PID 1788 wrote to memory of 2580	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	42
PID 1788 wrote to memory of 2604	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	43
PID 1788 wrote to memory of 2604	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	43
PID 1788 wrote to memory of 2604	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	43
PID 1788 wrote to memory of 1584	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	44
PID 1788 wrote to memory of 1584	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	44
PID 1788 wrote to memory of 1584	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	44
PID 1788 wrote to memory of 2296	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	45
PID 1788 wrote to memory of 2296	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	45
PID 1788 wrote to memory of 2296	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	45
PID 1788 wrote to memory of 2564	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	46
PID 1788 wrote to memory of 2564	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	46
PID 1788 wrote to memory of 2564	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	46
PID 1788 wrote to memory of 584	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	47
PID 1788 wrote to memory of 584	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	47
PID 1788 wrote to memory of 584	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	47
PID 1788 wrote to memory of 1224	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	48
PID 1788 wrote to memory of 1224	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	48
PID 1788 wrote to memory of 1224	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	48
PID 1788 wrote to memory of 1460	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	49
PID 1788 wrote to memory of 1460	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	49
PID 1788 wrote to memory of 1460	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	49
PID 1788 wrote to memory of 1204	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	50
PID 1788 wrote to memory of 1204	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	50
PID 1788 wrote to memory of 1204	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	50
PID 1788 wrote to memory of 2568	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	51
PID 1788 wrote to memory of 2568	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	51
PID 1788 wrote to memory of 2568	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	51
PID 1788 wrote to memory of 1900	1788	1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe	52

C:\Users\Admin\AppData\Local\Temp\1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe
"C:\Users\Admin\AppData\Local\Temp\1ffcbd750463191d3c1270d9ba1eb53304b6f00e51f928ac2db6a1af105e7905.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\System\VXVpRfp.exe
  C:\Windows\System\VXVpRfp.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\PkRjQPP.exe
  C:\Windows\System\PkRjQPP.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\KrlchRp.exe
  C:\Windows\System\KrlchRp.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\KsuzJKc.exe
  C:\Windows\System\KsuzJKc.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\PlQQVNR.exe
  C:\Windows\System\PlQQVNR.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\ECstBIO.exe
  C:\Windows\System\ECstBIO.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\xfpEFnF.exe
  C:\Windows\System\xfpEFnF.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\wZvSyID.exe
  C:\Windows\System\wZvSyID.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\QKiJSbq.exe
  C:\Windows\System\QKiJSbq.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\akKBxGo.exe
  C:\Windows\System\akKBxGo.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\uiGxmQK.exe
  C:\Windows\System\uiGxmQK.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\NXGVvLz.exe
  C:\Windows\System\NXGVvLz.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\Oecuele.exe
  C:\Windows\System\Oecuele.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\OYNLbbK.exe
  C:\Windows\System\OYNLbbK.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\UMmJtPr.exe
  C:\Windows\System\UMmJtPr.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\DCMccsD.exe
  C:\Windows\System\DCMccsD.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\kaqGjVt.exe
  C:\Windows\System\kaqGjVt.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\FTnywVZ.exe
  C:\Windows\System\FTnywVZ.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\lFtnarK.exe
  C:\Windows\System\lFtnarK.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\jpRjoHe.exe
  C:\Windows\System\jpRjoHe.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\LRzxLMY.exe
  C:\Windows\System\LRzxLMY.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\qRvkKBx.exe
  C:\Windows\System\qRvkKBx.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\uUotfLY.exe
  C:\Windows\System\uUotfLY.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\jPUayve.exe
  C:\Windows\System\jPUayve.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\isaCanX.exe
  C:\Windows\System\isaCanX.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\iiMUBGs.exe
  C:\Windows\System\iiMUBGs.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\TeQfWYc.exe
  C:\Windows\System\TeQfWYc.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\IMoYIxD.exe
  C:\Windows\System\IMoYIxD.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\xlhhEVq.exe
  C:\Windows\System\xlhhEVq.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\AUrcYGU.exe
  C:\Windows\System\AUrcYGU.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\uPsOejp.exe
  C:\Windows\System\uPsOejp.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\gxrfjKD.exe
  C:\Windows\System\gxrfjKD.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\vBAyTem.exe
  C:\Windows\System\vBAyTem.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\ejhotvM.exe
  C:\Windows\System\ejhotvM.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\RjlIUZH.exe
  C:\Windows\System\RjlIUZH.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\XtxJsmH.exe
  C:\Windows\System\XtxJsmH.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\muIqheR.exe
  C:\Windows\System\muIqheR.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\nJOsiUD.exe
  C:\Windows\System\nJOsiUD.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\QnXjgQa.exe
  C:\Windows\System\QnXjgQa.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\HNqKlvM.exe
  C:\Windows\System\HNqKlvM.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\xRVHLRd.exe
  C:\Windows\System\xRVHLRd.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\smHRytN.exe
  C:\Windows\System\smHRytN.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\NcOATcT.exe
  C:\Windows\System\NcOATcT.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\KQsmekm.exe
  C:\Windows\System\KQsmekm.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\TJucmng.exe
  C:\Windows\System\TJucmng.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\zbDFXDM.exe
  C:\Windows\System\zbDFXDM.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\ssnrUBj.exe
  C:\Windows\System\ssnrUBj.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\uQxMpoP.exe
  C:\Windows\System\uQxMpoP.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\QDBHnCL.exe
  C:\Windows\System\QDBHnCL.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\GssfeJA.exe
  C:\Windows\System\GssfeJA.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\nhPNvEb.exe
  C:\Windows\System\nhPNvEb.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\UboUuav.exe
  C:\Windows\System\UboUuav.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\MBTJzjF.exe
  C:\Windows\System\MBTJzjF.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\vBxXVmL.exe
  C:\Windows\System\vBxXVmL.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\hDiupRf.exe
  C:\Windows\System\hDiupRf.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\sZoXuLR.exe
  C:\Windows\System\sZoXuLR.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\skQmIQV.exe
  C:\Windows\System\skQmIQV.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\UixVahx.exe
  C:\Windows\System\UixVahx.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\CmvseBe.exe
  C:\Windows\System\CmvseBe.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\DeENHQl.exe
  C:\Windows\System\DeENHQl.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\gKcAprJ.exe
  C:\Windows\System\gKcAprJ.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\FaRRCTI.exe
  C:\Windows\System\FaRRCTI.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\drkRrUP.exe
  C:\Windows\System\drkRrUP.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\puYTpgV.exe
  C:\Windows\System\puYTpgV.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\DPIhbjq.exe
  C:\Windows\System\DPIhbjq.exe
  2⤵
  PID:2116
- C:\Windows\System\xLJXWdq.exe
  C:\Windows\System\xLJXWdq.exe
  2⤵
  PID:1152
- C:\Windows\System\FVYjbWe.exe
  C:\Windows\System\FVYjbWe.exe
  2⤵
  PID:1540
- C:\Windows\System\jokDQXx.exe
  C:\Windows\System\jokDQXx.exe
  2⤵
  PID:2140
- C:\Windows\System\hXuhCIa.exe
  C:\Windows\System\hXuhCIa.exe
  2⤵
  PID:1568
- C:\Windows\System\cRVZQFX.exe
  C:\Windows\System\cRVZQFX.exe
  2⤵
  PID:2472
- C:\Windows\System\lvojLyl.exe
  C:\Windows\System\lvojLyl.exe
  2⤵
  PID:688
- C:\Windows\System\hEPfCKM.exe
  C:\Windows\System\hEPfCKM.exe
  2⤵
  PID:3052
- C:\Windows\System\pjScTvD.exe
  C:\Windows\System\pjScTvD.exe
  2⤵
  PID:2428
- C:\Windows\System\jyFRoCo.exe
  C:\Windows\System\jyFRoCo.exe
  2⤵
  PID:2204
- C:\Windows\System\TqMWNVM.exe
  C:\Windows\System\TqMWNVM.exe
  2⤵
  PID:1908
- C:\Windows\System\ZuJYcqP.exe
  C:\Windows\System\ZuJYcqP.exe
  2⤵
  PID:2744
- C:\Windows\System\qVoIojG.exe
  C:\Windows\System\qVoIojG.exe
  2⤵
  PID:2644
- C:\Windows\System\YFPSoSS.exe
  C:\Windows\System\YFPSoSS.exe
  2⤵
  PID:1912
- C:\Windows\System\JsimTHd.exe
  C:\Windows\System\JsimTHd.exe
  2⤵
  PID:1616
- C:\Windows\System\sMGZroy.exe
  C:\Windows\System\sMGZroy.exe
  2⤵
  PID:1528
- C:\Windows\System\tHOBvHu.exe
  C:\Windows\System\tHOBvHu.exe
  2⤵
  PID:1636
- C:\Windows\System\tFnxpZy.exe
  C:\Windows\System\tFnxpZy.exe
  2⤵
  PID:2596
- C:\Windows\System\LESfWdc.exe
  C:\Windows\System\LESfWdc.exe
  2⤵
  PID:856
- C:\Windows\System\BgqZCch.exe
  C:\Windows\System\BgqZCch.exe
  2⤵
  PID:2124
- C:\Windows\System\mNINwxx.exe
  C:\Windows\System\mNINwxx.exe
  2⤵
  PID:3036
- C:\Windows\System\QLBbzgy.exe
  C:\Windows\System\QLBbzgy.exe
  2⤵
  PID:3008
- C:\Windows\System\iLGQMmS.exe
  C:\Windows\System\iLGQMmS.exe
  2⤵
  PID:552
- C:\Windows\System\CgIPaRZ.exe
  C:\Windows\System\CgIPaRZ.exe
  2⤵
  PID:2444
- C:\Windows\System\sgtqtud.exe
  C:\Windows\System\sgtqtud.exe
  2⤵
  PID:2808
- C:\Windows\System\yMEVROP.exe
  C:\Windows\System\yMEVROP.exe
  2⤵
  PID:2748
- C:\Windows\System\fJXsPxJ.exe
  C:\Windows\System\fJXsPxJ.exe
  2⤵
  PID:2888
- C:\Windows\System\sKWqcHI.exe
  C:\Windows\System\sKWqcHI.exe
  2⤵
  PID:2900
- C:\Windows\System\nrFfaqI.exe
  C:\Windows\System\nrFfaqI.exe
  2⤵
  PID:1516
- C:\Windows\System\mUfcrpi.exe
  C:\Windows\System\mUfcrpi.exe
  2⤵
  PID:2208
- C:\Windows\System\KFBCJPI.exe
  C:\Windows\System\KFBCJPI.exe
  2⤵
  PID:2004
- C:\Windows\System\CdncBsD.exe
  C:\Windows\System\CdncBsD.exe
  2⤵
  PID:1548
- C:\Windows\System\qmUSDmN.exe
  C:\Windows\System\qmUSDmN.exe
  2⤵
  PID:2992
- C:\Windows\System\BBLFBFa.exe
  C:\Windows\System\BBLFBFa.exe
  2⤵
  PID:1700
- C:\Windows\System\lUycFuj.exe
  C:\Windows\System\lUycFuj.exe
  2⤵
  PID:1520
- C:\Windows\System\xvISlma.exe
  C:\Windows\System\xvISlma.exe
  2⤵
  PID:2916
- C:\Windows\System\xhuyWjf.exe
  C:\Windows\System\xhuyWjf.exe
  2⤵
  PID:2412
- C:\Windows\System\bfcFaIP.exe
  C:\Windows\System\bfcFaIP.exe
  2⤵
  PID:3076
- C:\Windows\System\LzJoZQj.exe
  C:\Windows\System\LzJoZQj.exe
  2⤵
  PID:3092
- C:\Windows\System\dOABAqz.exe
  C:\Windows\System\dOABAqz.exe
  2⤵
  PID:3124
- C:\Windows\System\Zztiknm.exe
  C:\Windows\System\Zztiknm.exe
  2⤵
  PID:3152
- C:\Windows\System\EuWJaDC.exe
  C:\Windows\System\EuWJaDC.exe
  2⤵
  PID:3168
- C:\Windows\System\VpMBejy.exe
  C:\Windows\System\VpMBejy.exe
  2⤵
  PID:3184
- C:\Windows\System\NvfnSIW.exe
  C:\Windows\System\NvfnSIW.exe
  2⤵
  PID:3200
- C:\Windows\System\Rbxsmhm.exe
  C:\Windows\System\Rbxsmhm.exe
  2⤵
  PID:3216
- C:\Windows\System\nckHrst.exe
  C:\Windows\System\nckHrst.exe
  2⤵
  PID:3236
- C:\Windows\System\mifJEtM.exe
  C:\Windows\System\mifJEtM.exe
  2⤵
  PID:3252
- C:\Windows\System\nLaWtvX.exe
  C:\Windows\System\nLaWtvX.exe
  2⤵
  PID:3268
- C:\Windows\System\eTxrBUz.exe
  C:\Windows\System\eTxrBUz.exe
  2⤵
  PID:3288
- C:\Windows\System\nNikeKU.exe
  C:\Windows\System\nNikeKU.exe
  2⤵
  PID:3308
- C:\Windows\System\XTmDWDU.exe
  C:\Windows\System\XTmDWDU.exe
  2⤵
  PID:3324
- C:\Windows\System\eBfumDY.exe
  C:\Windows\System\eBfumDY.exe
  2⤵
  PID:3340
- C:\Windows\System\jCsVFWg.exe
  C:\Windows\System\jCsVFWg.exe
  2⤵
  PID:3356
- C:\Windows\System\etkIYpb.exe
  C:\Windows\System\etkIYpb.exe
  2⤵
  PID:3372
- C:\Windows\System\vNCkAlJ.exe
  C:\Windows\System\vNCkAlJ.exe
  2⤵
  PID:3388
- C:\Windows\System\xdaOxtn.exe
  C:\Windows\System\xdaOxtn.exe
  2⤵
  PID:3404
- C:\Windows\System\dByNLdD.exe
  C:\Windows\System\dByNLdD.exe
  2⤵
  PID:3420
- C:\Windows\System\bmRmLwB.exe
  C:\Windows\System\bmRmLwB.exe
  2⤵
  PID:3436
- C:\Windows\System\uuKhjQE.exe
  C:\Windows\System\uuKhjQE.exe
  2⤵
  PID:3452
- C:\Windows\System\FMmbioa.exe
  C:\Windows\System\FMmbioa.exe
  2⤵
  PID:3468
- C:\Windows\System\YzGwlov.exe
  C:\Windows\System\YzGwlov.exe
  2⤵
  PID:3484
- C:\Windows\System\NyFgJAh.exe
  C:\Windows\System\NyFgJAh.exe
  2⤵
  PID:3500
- C:\Windows\System\evyWgrs.exe
  C:\Windows\System\evyWgrs.exe
  2⤵
  PID:3516
- C:\Windows\System\PbUPsNn.exe
  C:\Windows\System\PbUPsNn.exe
  2⤵
  PID:3540
- C:\Windows\System\fzIGQer.exe
  C:\Windows\System\fzIGQer.exe
  2⤵
  PID:3556
- C:\Windows\System\vIAeYrT.exe
  C:\Windows\System\vIAeYrT.exe
  2⤵
  PID:3572
- C:\Windows\System\bFXwSke.exe
  C:\Windows\System\bFXwSke.exe
  2⤵
  PID:3588
- C:\Windows\System\REMtuzO.exe
  C:\Windows\System\REMtuzO.exe
  2⤵
  PID:3604
- C:\Windows\System\rQEGtzQ.exe
  C:\Windows\System\rQEGtzQ.exe
  2⤵
  PID:3620
- C:\Windows\System\YCPXKYB.exe
  C:\Windows\System\YCPXKYB.exe
  2⤵
  PID:3636
- C:\Windows\System\yrxXrDa.exe
  C:\Windows\System\yrxXrDa.exe
  2⤵
  PID:3656
- C:\Windows\System\pBfsPFP.exe
  C:\Windows\System\pBfsPFP.exe
  2⤵
  PID:3672
- C:\Windows\System\sZRmDlU.exe
  C:\Windows\System\sZRmDlU.exe
  2⤵
  PID:3696
- C:\Windows\System\PoAlVfC.exe
  C:\Windows\System\PoAlVfC.exe
  2⤵
  PID:3712
- C:\Windows\System\zsGmeOE.exe
  C:\Windows\System\zsGmeOE.exe
  2⤵
  PID:3728
- C:\Windows\System\OFnLMzH.exe
  C:\Windows\System\OFnLMzH.exe
  2⤵
  PID:3744
- C:\Windows\System\hXsiTxc.exe
  C:\Windows\System\hXsiTxc.exe
  2⤵
  PID:3760
- C:\Windows\System\CKHkchT.exe
  C:\Windows\System\CKHkchT.exe
  2⤵
  PID:3776
- C:\Windows\System\LDLIgXY.exe
  C:\Windows\System\LDLIgXY.exe
  2⤵
  PID:3792
- C:\Windows\System\ktrizhH.exe
  C:\Windows\System\ktrizhH.exe
  2⤵
  PID:3808
- C:\Windows\System\sxsJWUs.exe
  C:\Windows\System\sxsJWUs.exe
  2⤵
  PID:3824
- C:\Windows\System\YtKgMvG.exe
  C:\Windows\System\YtKgMvG.exe
  2⤵
  PID:3840
- C:\Windows\System\xRDLDoA.exe
  C:\Windows\System\xRDLDoA.exe
  2⤵
  PID:3856
- C:\Windows\System\URGUQEc.exe
  C:\Windows\System\URGUQEc.exe
  2⤵
  PID:3872
- C:\Windows\System\tjZRhnl.exe
  C:\Windows\System\tjZRhnl.exe
  2⤵
  PID:3888
- C:\Windows\System\YGBMDqQ.exe
  C:\Windows\System\YGBMDqQ.exe
  2⤵
  PID:3904
- C:\Windows\System\zCtYLCU.exe
  C:\Windows\System\zCtYLCU.exe
  2⤵
  PID:3920
- C:\Windows\System\UIEgrLn.exe
  C:\Windows\System\UIEgrLn.exe
  2⤵
  PID:3936
- C:\Windows\System\DJjgQBr.exe
  C:\Windows\System\DJjgQBr.exe
  2⤵
  PID:3952
- C:\Windows\System\dxEJvjc.exe
  C:\Windows\System\dxEJvjc.exe
  2⤵
  PID:3968
- C:\Windows\System\abSFoDJ.exe
  C:\Windows\System\abSFoDJ.exe
  2⤵
  PID:3984
- C:\Windows\System\BcvnLbt.exe
  C:\Windows\System\BcvnLbt.exe
  2⤵
  PID:4000
- C:\Windows\System\HnZpNHx.exe
  C:\Windows\System\HnZpNHx.exe
  2⤵
  PID:4020
- C:\Windows\System\RwSquzX.exe
  C:\Windows\System\RwSquzX.exe
  2⤵
  PID:2600
- C:\Windows\System\sGUkUxH.exe
  C:\Windows\System\sGUkUxH.exe
  2⤵
  PID:3108
- C:\Windows\System\DTAkxnW.exe
  C:\Windows\System\DTAkxnW.exe
  2⤵
  PID:3160
- C:\Windows\System\WtpIGzh.exe
  C:\Windows\System\WtpIGzh.exe
  2⤵
  PID:3196
- C:\Windows\System\QxcuGre.exe
  C:\Windows\System\QxcuGre.exe
  2⤵
  PID:3232
- C:\Windows\System\VgjAmkC.exe
  C:\Windows\System\VgjAmkC.exe
  2⤵
  PID:3296
- C:\Windows\System\fxxhQdF.exe
  C:\Windows\System\fxxhQdF.exe
  2⤵
  PID:3332
- C:\Windows\System\egEbRVu.exe
  C:\Windows\System\egEbRVu.exe
  2⤵
  PID:280
- C:\Windows\System\QeXgWKS.exe
  C:\Windows\System\QeXgWKS.exe
  2⤵
  PID:3400
- C:\Windows\System\eXQnVSI.exe
  C:\Windows\System\eXQnVSI.exe
  2⤵
  PID:3492
- C:\Windows\System\vTPLTtZ.exe
  C:\Windows\System\vTPLTtZ.exe
  2⤵
  PID:3532
- C:\Windows\System\LJbGjyL.exe
  C:\Windows\System\LJbGjyL.exe
  2⤵
  PID:3564
- C:\Windows\System\EIOBHud.exe
  C:\Windows\System\EIOBHud.exe
  2⤵
  PID:3628
- C:\Windows\System\lsiFjPj.exe
  C:\Windows\System\lsiFjPj.exe
  2⤵
  PID:2576
- C:\Windows\System\wDwRuDn.exe
  C:\Windows\System\wDwRuDn.exe
  2⤵
  PID:3668
- C:\Windows\System\msHcjTM.exe
  C:\Windows\System\msHcjTM.exe
  2⤵
  PID:3704
- C:\Windows\System\xWMvWwV.exe
  C:\Windows\System\xWMvWwV.exe
  2⤵
  PID:3768
- C:\Windows\System\pAdMnAZ.exe
  C:\Windows\System\pAdMnAZ.exe
  2⤵
  PID:3832
- C:\Windows\System\TJovuuS.exe
  C:\Windows\System\TJovuuS.exe
  2⤵
  PID:3896
- C:\Windows\System\arZoOAy.exe
  C:\Windows\System\arZoOAy.exe
  2⤵
  PID:3960
- C:\Windows\System\gYfZTgz.exe
  C:\Windows\System\gYfZTgz.exe
  2⤵
  PID:4084
- C:\Windows\System\yPJESSL.exe
  C:\Windows\System\yPJESSL.exe
  2⤵
  PID:4068
- C:\Windows\System\CnziJWR.exe
  C:\Windows\System\CnziJWR.exe
  2⤵
  PID:4052
- C:\Windows\System\NyRpzel.exe
  C:\Windows\System\NyRpzel.exe
  2⤵
  PID:4028
- C:\Windows\System\ySJGhuP.exe
  C:\Windows\System\ySJGhuP.exe
  2⤵
  PID:2492
- C:\Windows\System\DVlPXHr.exe
  C:\Windows\System\DVlPXHr.exe
  2⤵
  PID:2496
- C:\Windows\System\YAtlZfE.exe
  C:\Windows\System\YAtlZfE.exe
  2⤵
  PID:1020
- C:\Windows\System\TyHJVRB.exe
  C:\Windows\System\TyHJVRB.exe
  2⤵
  PID:1016
- C:\Windows\System\ChVixfU.exe
  C:\Windows\System\ChVixfU.exe
  2⤵
  PID:3316
- C:\Windows\System\QNNCyoo.exe
  C:\Windows\System\QNNCyoo.exe
  2⤵
  PID:3120
- C:\Windows\System\laVyVWM.exe
  C:\Windows\System\laVyVWM.exe
  2⤵
  PID:4108
- C:\Windows\System\mqlLHav.exe
  C:\Windows\System\mqlLHav.exe
  2⤵
  PID:4124
- C:\Windows\System\XjrxzDb.exe
  C:\Windows\System\XjrxzDb.exe
  2⤵
  PID:4140
- C:\Windows\System\oHeYRMp.exe
  C:\Windows\System\oHeYRMp.exe
  2⤵
  PID:4160
- C:\Windows\System\IPpbAar.exe
  C:\Windows\System\IPpbAar.exe
  2⤵
  PID:4176
- C:\Windows\System\gjnoljt.exe
  C:\Windows\System\gjnoljt.exe
  2⤵
  PID:4192
- C:\Windows\System\LQkMsui.exe
  C:\Windows\System\LQkMsui.exe
  2⤵
  PID:4208
- C:\Windows\System\sAmaaeX.exe
  C:\Windows\System\sAmaaeX.exe
  2⤵
  PID:4228
- C:\Windows\System\wsysHhX.exe
  C:\Windows\System\wsysHhX.exe
  2⤵
  PID:4244
- C:\Windows\System\oMGuUfF.exe
  C:\Windows\System\oMGuUfF.exe
  2⤵
  PID:4260
- C:\Windows\System\ubkvLir.exe
  C:\Windows\System\ubkvLir.exe
  2⤵
  PID:4276
- C:\Windows\System\ILkxLbj.exe
  C:\Windows\System\ILkxLbj.exe
  2⤵
  PID:4292
- C:\Windows\System\YUjAVdg.exe
  C:\Windows\System\YUjAVdg.exe
  2⤵
  PID:4308
- C:\Windows\System\AzfdymG.exe
  C:\Windows\System\AzfdymG.exe
  2⤵
  PID:4324
- C:\Windows\System\GEvgOcG.exe
  C:\Windows\System\GEvgOcG.exe
  2⤵
  PID:4340
- C:\Windows\System\PhYJvkm.exe
  C:\Windows\System\PhYJvkm.exe
  2⤵
  PID:4356
- C:\Windows\System\AtDVPrI.exe
  C:\Windows\System\AtDVPrI.exe
  2⤵
  PID:4372
- C:\Windows\System\PbJobgU.exe
  C:\Windows\System\PbJobgU.exe
  2⤵
  PID:4388
- C:\Windows\System\mYVTWqT.exe
  C:\Windows\System\mYVTWqT.exe
  2⤵
  PID:4404
- C:\Windows\System\TgOsYFX.exe
  C:\Windows\System\TgOsYFX.exe
  2⤵
  PID:4420
- C:\Windows\System\fslrgSL.exe
  C:\Windows\System\fslrgSL.exe
  2⤵
  PID:4448
- C:\Windows\System\IEsLkcO.exe
  C:\Windows\System\IEsLkcO.exe
  2⤵
  PID:4468
- C:\Windows\System\eLCDABv.exe
  C:\Windows\System\eLCDABv.exe
  2⤵
  PID:4484
- C:\Windows\System\SxMWOwS.exe
  C:\Windows\System\SxMWOwS.exe
  2⤵
  PID:4500
- C:\Windows\System\MZfZtbH.exe
  C:\Windows\System\MZfZtbH.exe
  2⤵
  PID:4520
- C:\Windows\System\nsOMMZs.exe
  C:\Windows\System\nsOMMZs.exe
  2⤵
  PID:4536
- C:\Windows\System\FpDfKmG.exe
  C:\Windows\System\FpDfKmG.exe
  2⤵
  PID:4552
- C:\Windows\System\aGCeheO.exe
  C:\Windows\System\aGCeheO.exe
  2⤵
  PID:4568
- C:\Windows\System\diItphu.exe
  C:\Windows\System\diItphu.exe
  2⤵
  PID:4584
- C:\Windows\System\kvfUmNh.exe
  C:\Windows\System\kvfUmNh.exe
  2⤵
  PID:4600
- C:\Windows\System\qJZdKIE.exe
  C:\Windows\System\qJZdKIE.exe
  2⤵
  PID:4616
- C:\Windows\System\UXVCzRG.exe
  C:\Windows\System\UXVCzRG.exe
  2⤵
  PID:4632
- C:\Windows\System\QbFsJXC.exe
  C:\Windows\System\QbFsJXC.exe
  2⤵
  PID:4652
- C:\Windows\System\PZpiptc.exe
  C:\Windows\System\PZpiptc.exe
  2⤵
  PID:4672
- C:\Windows\System\KdPJocN.exe
  C:\Windows\System\KdPJocN.exe
  2⤵
  PID:4688
- C:\Windows\System\elprORZ.exe
  C:\Windows\System\elprORZ.exe
  2⤵
  PID:4712
- C:\Windows\System\YIETVyj.exe
  C:\Windows\System\YIETVyj.exe
  2⤵
  PID:4736
- C:\Windows\System\TbFXgPA.exe
  C:\Windows\System\TbFXgPA.exe
  2⤵
  PID:4752
- C:\Windows\System\aRemAnQ.exe
  C:\Windows\System\aRemAnQ.exe
  2⤵
  PID:4776
- C:\Windows\System\IDQPJrC.exe
  C:\Windows\System\IDQPJrC.exe
  2⤵
  PID:4792
- C:\Windows\System\LsIRPGg.exe
  C:\Windows\System\LsIRPGg.exe
  2⤵
  PID:4808
- C:\Windows\System\PMurZbs.exe
  C:\Windows\System\PMurZbs.exe
  2⤵
  PID:4824
- C:\Windows\System\WJVYRwm.exe
  C:\Windows\System\WJVYRwm.exe
  2⤵
  PID:4840
- C:\Windows\System\XYuXwgt.exe
  C:\Windows\System\XYuXwgt.exe
  2⤵
  PID:4856
- C:\Windows\System\kCtCwZJ.exe
  C:\Windows\System\kCtCwZJ.exe
  2⤵
  PID:4872
- C:\Windows\System\dbrYuhc.exe
  C:\Windows\System\dbrYuhc.exe
  2⤵
  PID:4888
- C:\Windows\System\LWhkBRO.exe
  C:\Windows\System\LWhkBRO.exe
  2⤵
  PID:4916
- C:\Windows\System\YesEdve.exe
  C:\Windows\System\YesEdve.exe
  2⤵
  PID:4932
- C:\Windows\System\wfjyRor.exe
  C:\Windows\System\wfjyRor.exe
  2⤵
  PID:4948
- C:\Windows\System\VvlfemL.exe
  C:\Windows\System\VvlfemL.exe
  2⤵
  PID:4964
- C:\Windows\System\PItBJGC.exe
  C:\Windows\System\PItBJGC.exe
  2⤵
  PID:4980
- C:\Windows\System\dzChApi.exe
  C:\Windows\System\dzChApi.exe
  2⤵
  PID:4996
- C:\Windows\System\yKxzcVW.exe
  C:\Windows\System\yKxzcVW.exe
  2⤵
  PID:5012
- C:\Windows\System\GMyPVze.exe
  C:\Windows\System\GMyPVze.exe
  2⤵
  PID:5028
- C:\Windows\System\oetRaqE.exe
  C:\Windows\System\oetRaqE.exe
  2⤵
  PID:5044
- C:\Windows\System\hyEhXGU.exe
  C:\Windows\System\hyEhXGU.exe
  2⤵
  PID:5060
- C:\Windows\System\DaCgIYi.exe
  C:\Windows\System\DaCgIYi.exe
  2⤵
  PID:5076
- C:\Windows\System\yJKgWXZ.exe
  C:\Windows\System\yJKgWXZ.exe
  2⤵
  PID:5092
- C:\Windows\System\oHEpaai.exe
  C:\Windows\System\oHEpaai.exe
  2⤵
  PID:5108
- C:\Windows\System\cJlgJcp.exe
  C:\Windows\System\cJlgJcp.exe
  2⤵
  PID:2504
- C:\Windows\System\XKzPVCO.exe
  C:\Windows\System\XKzPVCO.exe
  2⤵
  PID:2328
- C:\Windows\System\eQyEjDM.exe
  C:\Windows\System\eQyEjDM.exe
  2⤵
  PID:3304
- C:\Windows\System\vmuuJWd.exe
  C:\Windows\System\vmuuJWd.exe
  2⤵
  PID:3496
- C:\Windows\System\OLFypBH.exe
  C:\Windows\System\OLFypBH.exe
  2⤵
  PID:1764
- C:\Windows\System\mmrqDKN.exe
  C:\Windows\System\mmrqDKN.exe
  2⤵
  PID:2392
- C:\Windows\System\DYrSKAg.exe
  C:\Windows\System\DYrSKAg.exe
  2⤵
  PID:3116
- C:\Windows\System\egaXoxN.exe
  C:\Windows\System\egaXoxN.exe
  2⤵
  PID:4136
- C:\Windows\System\TUwBogZ.exe
  C:\Windows\System\TUwBogZ.exe
  2⤵
  PID:4204
- C:\Windows\System\bxqmFwl.exe
  C:\Windows\System\bxqmFwl.exe
  2⤵
  PID:4272
- C:\Windows\System\llrFsGn.exe
  C:\Windows\System\llrFsGn.exe
  2⤵
  PID:4336
- C:\Windows\System\TXjzkZj.exe
  C:\Windows\System\TXjzkZj.exe
  2⤵
  PID:3584
- C:\Windows\System\UmJfPJv.exe
  C:\Windows\System\UmJfPJv.exe
  2⤵
  PID:4428
- C:\Windows\System\UZyZfGg.exe
  C:\Windows\System\UZyZfGg.exe
  2⤵
  PID:548
- C:\Windows\System\haEWZUA.exe
  C:\Windows\System\haEWZUA.exe
  2⤵
  PID:4512
- C:\Windows\System\korAbrd.exe
  C:\Windows\System\korAbrd.exe
  2⤵
  PID:4580
- C:\Windows\System\rMNkBNl.exe
  C:\Windows\System\rMNkBNl.exe
  2⤵
  PID:4608
- C:\Windows\System\jvEYcRX.exe
  C:\Windows\System\jvEYcRX.exe
  2⤵
  PID:2400
- C:\Windows\System\xuuewuz.exe
  C:\Windows\System\xuuewuz.exe
  2⤵
  PID:2612
- C:\Windows\System\RuzfFid.exe
  C:\Windows\System\RuzfFid.exe
  2⤵
  PID:2920
- C:\Windows\System\BImBuPS.exe
  C:\Windows\System\BImBuPS.exe
  2⤵
  PID:3020
- C:\Windows\System\HdWcCVY.exe
  C:\Windows\System\HdWcCVY.exe
  2⤵
  PID:2344
- C:\Windows\System\wRFNgzX.exe
  C:\Windows\System\wRFNgzX.exe
  2⤵
  PID:4644
- C:\Windows\System\LqqzUFE.exe
  C:\Windows\System\LqqzUFE.exe
  2⤵
  PID:2688
- C:\Windows\System\PhYCnFq.exe
  C:\Windows\System\PhYCnFq.exe
  2⤵
  PID:3180
- C:\Windows\System\Kmmbvko.exe
  C:\Windows\System\Kmmbvko.exe
  2⤵
  PID:4896
- C:\Windows\System\dnaPmmH.exe
  C:\Windows\System\dnaPmmH.exe
  2⤵
  PID:2696
- C:\Windows\System\sliFdnH.exe
  C:\Windows\System\sliFdnH.exe
  2⤵
  PID:4972
- C:\Windows\System\qbVRVIW.exe
  C:\Windows\System\qbVRVIW.exe
  2⤵
  PID:4368
- C:\Windows\System\uavjBpK.exe
  C:\Windows\System\uavjBpK.exe
  2⤵
  PID:4548
- C:\Windows\System\gUbzwMo.exe
  C:\Windows\System\gUbzwMo.exe
  2⤵
  PID:2768
- C:\Windows\System\TRAkgKg.exe
  C:\Windows\System\TRAkgKg.exe
  2⤵
  PID:1752
- C:\Windows\System\lWiOXog.exe
  C:\Windows\System\lWiOXog.exe
  2⤵
  PID:3248
- C:\Windows\System\RzdlBxk.exe
  C:\Windows\System\RzdlBxk.exe
  2⤵
  PID:1168
- C:\Windows\System\NpwVbVs.exe
  C:\Windows\System\NpwVbVs.exe
  2⤵
  PID:2376
- C:\Windows\System\cPFJaWq.exe
  C:\Windows\System\cPFJaWq.exe
  2⤵
  PID:2284
- C:\Windows\System\pKgGHYm.exe
  C:\Windows\System\pKgGHYm.exe
  2⤵
  PID:3432
- C:\Windows\System\nLCIqxE.exe
  C:\Windows\System\nLCIqxE.exe
  2⤵
  PID:3932
- C:\Windows\System\yXerbks.exe
  C:\Windows\System\yXerbks.exe
  2⤵
  PID:1688
- C:\Windows\System\HnSSoDa.exe
  C:\Windows\System\HnSSoDa.exe
  2⤵
  PID:4220
- C:\Windows\System\GsYonEc.exe
  C:\Windows\System\GsYonEc.exe
  2⤵
  PID:2932
- C:\Windows\System\TTNnvqf.exe
  C:\Windows\System\TTNnvqf.exe
  2⤵
  PID:4744
- C:\Windows\System\GLfkhmk.exe
  C:\Windows\System\GLfkhmk.exe
  2⤵
  PID:4816
- C:\Windows\System\QiAagOs.exe
  C:\Windows\System\QiAagOs.exe
  2⤵
  PID:4880
- C:\Windows\System\FchyZel.exe
  C:\Windows\System\FchyZel.exe
  2⤵
  PID:4956
- C:\Windows\System\THVXpTT.exe
  C:\Windows\System\THVXpTT.exe
  2⤵
  PID:5020
- C:\Windows\System\GsYnTuY.exe
  C:\Windows\System\GsYnTuY.exe
  2⤵
  PID:5056
- C:\Windows\System\phZePDe.exe
  C:\Windows\System\phZePDe.exe
  2⤵
  PID:2964
- C:\Windows\System\EhfymTq.exe
  C:\Windows\System\EhfymTq.exe
  2⤵
  PID:4060
- C:\Windows\System\UDgsRNM.exe
  C:\Windows\System\UDgsRNM.exe
  2⤵
  PID:4200
- C:\Windows\System\BHujkOu.exe
  C:\Windows\System\BHujkOu.exe
  2⤵
  PID:2044
- C:\Windows\System\walPUxF.exe
  C:\Windows\System\walPUxF.exe
  2⤵
  PID:3816
- C:\Windows\System\mHzXcML.exe
  C:\Windows\System\mHzXcML.exe
  2⤵
  PID:3104
- C:\Windows\System\WAQgrjE.exe
  C:\Windows\System\WAQgrjE.exe
  2⤵
  PID:4120
- C:\Windows\System\sBwiBes.exe
  C:\Windows\System\sBwiBes.exe
  2⤵
  PID:4216
- C:\Windows\System\fGEgqTy.exe
  C:\Windows\System\fGEgqTy.exe
  2⤵
  PID:3512
- C:\Windows\System\SOJTNtr.exe
  C:\Windows\System\SOJTNtr.exe
  2⤵
  PID:4380
- C:\Windows\System\cFHzreR.exe
  C:\Windows\System\cFHzreR.exe
  2⤵
  PID:4496
- C:\Windows\System\cahwUNe.exe
  C:\Windows\System\cahwUNe.exe
  2⤵
  PID:3692
- C:\Windows\System\znDltlW.exe
  C:\Windows\System\znDltlW.exe
  2⤵
  PID:3756
- C:\Windows\System\iUbylaY.exe
  C:\Windows\System\iUbylaY.exe
  2⤵
  PID:4624
- C:\Windows\System\FinDRRj.exe
  C:\Windows\System\FinDRRj.exe
  2⤵
  PID:4800
- C:\Windows\System\PqLybsa.exe
  C:\Windows\System\PqLybsa.exe
  2⤵
  PID:2844
- C:\Windows\System\WRGuRBy.exe
  C:\Windows\System\WRGuRBy.exe
  2⤵
  PID:4908
- C:\Windows\System\qBMnmDc.exe
  C:\Windows\System\qBMnmDc.exe
  2⤵
  PID:5036
- C:\Windows\System\EmuJvBr.exe
  C:\Windows\System\EmuJvBr.exe
  2⤵
  PID:676
- C:\Windows\System\aySATjC.exe
  C:\Windows\System\aySATjC.exe
  2⤵
  PID:2112
- C:\Windows\System\sdWydKc.exe
  C:\Windows\System\sdWydKc.exe
  2⤵
  PID:1968
- C:\Windows\System\uIcOZag.exe
  C:\Windows\System\uIcOZag.exe
  2⤵
  PID:1716
- C:\Windows\System\zKPJXKv.exe
  C:\Windows\System\zKPJXKv.exe
  2⤵
  PID:4728
- C:\Windows\System\sNSlxbg.exe
  C:\Windows\System\sNSlxbg.exe
  2⤵
  PID:1076
- C:\Windows\System\decjAiS.exe
  C:\Windows\System\decjAiS.exe
  2⤵
  PID:5004
- C:\Windows\System\vBwzXun.exe
  C:\Windows\System\vBwzXun.exe
  2⤵
  PID:5068
- C:\Windows\System\qSeRbeR.exe
  C:\Windows\System\qSeRbeR.exe
  2⤵
  PID:3140
- C:\Windows\System\UjmLfEA.exe
  C:\Windows\System\UjmLfEA.exe
  2⤵
  PID:2608
- C:\Windows\System\JsfgCFn.exe
  C:\Windows\System\JsfgCFn.exe
  2⤵
  PID:2952
- C:\Windows\System\jDYUNhV.exe
  C:\Windows\System\jDYUNhV.exe
  2⤵
  PID:2156
- C:\Windows\System\ZHcQTtd.exe
  C:\Windows\System\ZHcQTtd.exe
  2⤵
  PID:1876
- C:\Windows\System\AqDyjpB.exe
  C:\Windows\System\AqDyjpB.exe
  2⤵
  PID:4348
- C:\Windows\System\cCQeHKr.exe
  C:\Windows\System\cCQeHKr.exe
  2⤵
  PID:4416
- C:\Windows\System\bOYFPeW.exe
  C:\Windows\System\bOYFPeW.exe
  2⤵
  PID:2636
- C:\Windows\System\QUIoElA.exe
  C:\Windows\System\QUIoElA.exe
  2⤵
  PID:4628
- C:\Windows\System\oKDkScd.exe
  C:\Windows\System\oKDkScd.exe
  2⤵
  PID:3600
- C:\Windows\System\yEjywcR.exe
  C:\Windows\System\yEjywcR.exe
  2⤵
  PID:4332
- C:\Windows\System\uOVUBaA.exe
  C:\Windows\System\uOVUBaA.exe
  2⤵
  PID:1060
- C:\Windows\System\nmCNPud.exe
  C:\Windows\System\nmCNPud.exe
  2⤵
  PID:4640
- C:\Windows\System\RrWOifv.exe
  C:\Windows\System\RrWOifv.exe
  2⤵
  PID:4528
- C:\Windows\System\ZpktZAl.exe
  C:\Windows\System\ZpktZAl.exe
  2⤵
  PID:1880
- C:\Windows\System\RaENGEN.exe
  C:\Windows\System\RaENGEN.exe
  2⤵
  PID:4476
- C:\Windows\System\ADMXXTQ.exe
  C:\Windows\System\ADMXXTQ.exe
  2⤵
  PID:3276
- C:\Windows\System\HwPYCHV.exe
  C:\Windows\System\HwPYCHV.exe
  2⤵
  PID:4764
- C:\Windows\System\kslrPTl.exe
  C:\Windows\System\kslrPTl.exe
  2⤵
  PID:3320
- C:\Windows\System\ttCgOQo.exe
  C:\Windows\System\ttCgOQo.exe
  2⤵
  PID:1992
- C:\Windows\System\YgVjEdV.exe
  C:\Windows\System\YgVjEdV.exe
  2⤵
  PID:3416
- C:\Windows\System\YOUVVXG.exe
  C:\Windows\System\YOUVVXG.exe
  2⤵
  PID:4072
- C:\Windows\System\uRuWVrG.exe
  C:\Windows\System\uRuWVrG.exe
  2⤵
  PID:3976
- C:\Windows\System\SDYXXtv.exe
  C:\Windows\System\SDYXXtv.exe
  2⤵
  PID:1920
- C:\Windows\System\MTNYlZk.exe
  C:\Windows\System\MTNYlZk.exe
  2⤵
  PID:3736
- C:\Windows\System\AsMUfba.exe
  C:\Windows\System\AsMUfba.exe
  2⤵
  PID:3164
- C:\Windows\System\IkyVDIa.exe
  C:\Windows\System\IkyVDIa.exe
  2⤵
  PID:2852
- C:\Windows\System\ZsAeEjk.exe
  C:\Windows\System\ZsAeEjk.exe
  2⤵
  PID:4044
- C:\Windows\System\HXZJydi.exe
  C:\Windows\System\HXZJydi.exe
  2⤵
  PID:4868
- C:\Windows\System\AbastTz.exe
  C:\Windows\System\AbastTz.exe
  2⤵
  PID:4240
- C:\Windows\System\RtTRAFQ.exe
  C:\Windows\System\RtTRAFQ.exe
  2⤵
  PID:1748
- C:\Windows\System\HkJbTuc.exe
  C:\Windows\System\HkJbTuc.exe
  2⤵
  PID:2740
- C:\Windows\System\VeetqjU.exe
  C:\Windows\System\VeetqjU.exe
  2⤵
  PID:3800
- C:\Windows\System\FrqPqkk.exe
  C:\Windows\System\FrqPqkk.exe
  2⤵
  PID:2840
- C:\Windows\System\kDSacLr.exe
  C:\Windows\System\kDSacLr.exe
  2⤵
  PID:1400
- C:\Windows\System\afuoxmi.exe
  C:\Windows\System\afuoxmi.exe
  2⤵
  PID:4432
- C:\Windows\System\BAMTxFv.exe
  C:\Windows\System\BAMTxFv.exe
  2⤵
  PID:5116
- C:\Windows\System\darWhmm.exe
  C:\Windows\System\darWhmm.exe
  2⤵
  PID:2020
- C:\Windows\System\RtHlcKW.exe
  C:\Windows\System\RtHlcKW.exe
  2⤵
  PID:4928
- C:\Windows\System\PjBhICs.exe
  C:\Windows\System\PjBhICs.exe
  2⤵
  PID:4772
- C:\Windows\System\DomJUCo.exe
  C:\Windows\System\DomJUCo.exe
  2⤵
  PID:4992
- C:\Windows\System\mDyRpNY.exe
  C:\Windows\System\mDyRpNY.exe
  2⤵
  PID:3176
- C:\Windows\System\VMcRJeP.exe
  C:\Windows\System\VMcRJeP.exe
  2⤵
  PID:3536
- C:\Windows\System\XCNuBaO.exe
  C:\Windows\System\XCNuBaO.exe
  2⤵
  PID:3928
- C:\Windows\System\pJTbcyg.exe
  C:\Windows\System\pJTbcyg.exe
  2⤵
  PID:3644
- C:\Windows\System\euiRmWA.exe
  C:\Windows\System\euiRmWA.exe
  2⤵
  PID:3912
- C:\Windows\System\TSCtvbH.exe
  C:\Windows\System\TSCtvbH.exe
  2⤵
  PID:4256
- C:\Windows\System\YaVoBHY.exe
  C:\Windows\System\YaVoBHY.exe
  2⤵
  PID:4912
- C:\Windows\System\RrdHHHa.exe
  C:\Windows\System\RrdHHHa.exe
  2⤵
  PID:4456
- C:\Windows\System\TQvmzRK.exe
  C:\Windows\System\TQvmzRK.exe
  2⤵
  PID:3264
- C:\Windows\System\xOxlGUP.exe
  C:\Windows\System\xOxlGUP.exe
  2⤵
  PID:4316
- C:\Windows\System\zFfbMbV.exe
  C:\Windows\System\zFfbMbV.exe
  2⤵
  PID:3396
- C:\Windows\System\AKmkagd.exe
  C:\Windows\System\AKmkagd.exe
  2⤵
  PID:4148
- C:\Windows\System\eVhpsBN.exe
  C:\Windows\System\eVhpsBN.exe
  2⤵
  PID:4320
- C:\Windows\System\mgdNoWP.exe
  C:\Windows\System\mgdNoWP.exe
  2⤵
  PID:3084
- C:\Windows\System\ZjNzqBu.exe
  C:\Windows\System\ZjNzqBu.exe
  2⤵
  PID:3212
- C:\Windows\System\VhcinGe.exe
  C:\Windows\System\VhcinGe.exe
  2⤵
  PID:1484
- C:\Windows\System\fRRNPPh.exe
  C:\Windows\System\fRRNPPh.exe
  2⤵
  PID:4684
- C:\Windows\System\nDjNTbp.exe
  C:\Windows\System\nDjNTbp.exe
  2⤵
  PID:3616
- C:\Windows\System\uOwevkP.exe
  C:\Windows\System\uOwevkP.exe
  2⤵
  PID:3944
- C:\Windows\System\SyBtzwk.exe
  C:\Windows\System\SyBtzwk.exe
  2⤵
  PID:2620
- C:\Windows\System\wUocyjC.exe
  C:\Windows\System\wUocyjC.exe
  2⤵
  PID:5084
- C:\Windows\System\qcsYENM.exe
  C:\Windows\System\qcsYENM.exe
  2⤵
  PID:4724
- C:\Windows\System\lnCmpTs.exe
  C:\Windows\System\lnCmpTs.exe
  2⤵
  PID:2460
- C:\Windows\System\QuHYrxf.exe
  C:\Windows\System\QuHYrxf.exe
  2⤵
  PID:4864
- C:\Windows\System\wZLapRi.exe
  C:\Windows\System\wZLapRi.exe
  2⤵
  PID:3412
- C:\Windows\System\vsTGpKY.exe
  C:\Windows\System\vsTGpKY.exe
  2⤵
  PID:5136
- C:\Windows\System\OeLoxtN.exe
  C:\Windows\System\OeLoxtN.exe
  2⤵
  PID:5152
- C:\Windows\System\bFhMhjP.exe
  C:\Windows\System\bFhMhjP.exe
  2⤵
  PID:5168
- C:\Windows\System\eOpdqzY.exe
  C:\Windows\System\eOpdqzY.exe
  2⤵
  PID:5184
- C:\Windows\System\xRPbxYp.exe
  C:\Windows\System\xRPbxYp.exe
  2⤵
  PID:5200
- C:\Windows\System\wQBLIGv.exe
  C:\Windows\System\wQBLIGv.exe
  2⤵
  PID:5216
- C:\Windows\System\xXZnKfL.exe
  C:\Windows\System\xXZnKfL.exe
  2⤵
  PID:5232
- C:\Windows\System\jSfEmlW.exe
  C:\Windows\System\jSfEmlW.exe
  2⤵
  PID:5248
- C:\Windows\System\HICoVrD.exe
  C:\Windows\System\HICoVrD.exe
  2⤵
  PID:5268
- C:\Windows\System\nbkumbR.exe
  C:\Windows\System\nbkumbR.exe
  2⤵
  PID:5284
- C:\Windows\System\gUgTEOy.exe
  C:\Windows\System\gUgTEOy.exe
  2⤵
  PID:5300
- C:\Windows\System\gfaKlcW.exe
  C:\Windows\System\gfaKlcW.exe
  2⤵
  PID:5316
- C:\Windows\System\JlltOke.exe
  C:\Windows\System\JlltOke.exe
  2⤵
  PID:5332
- C:\Windows\System\vUqGHuk.exe
  C:\Windows\System\vUqGHuk.exe
  2⤵
  PID:5348
- C:\Windows\System\YeCvnWO.exe
  C:\Windows\System\YeCvnWO.exe
  2⤵
  PID:5364
- C:\Windows\System\icxjqjn.exe
  C:\Windows\System\icxjqjn.exe
  2⤵
  PID:5380
- C:\Windows\System\UndYWeB.exe
  C:\Windows\System\UndYWeB.exe
  2⤵
  PID:5396
- C:\Windows\System\jcIubmt.exe
  C:\Windows\System\jcIubmt.exe
  2⤵
  PID:5412
- C:\Windows\System\szNlCbV.exe
  C:\Windows\System\szNlCbV.exe
  2⤵
  PID:5432
- C:\Windows\System\Dnmsfzb.exe
  C:\Windows\System\Dnmsfzb.exe
  2⤵
  PID:5448
- C:\Windows\System\emvdegE.exe
  C:\Windows\System\emvdegE.exe
  2⤵
  PID:5464
- C:\Windows\System\LswuTAZ.exe
  C:\Windows\System\LswuTAZ.exe
  2⤵
  PID:5480
- C:\Windows\System\flyobZa.exe
  C:\Windows\System\flyobZa.exe
  2⤵
  PID:5496
- C:\Windows\System\HjqUnrR.exe
  C:\Windows\System\HjqUnrR.exe
  2⤵
  PID:5516
- C:\Windows\System\LYrsxnA.exe
  C:\Windows\System\LYrsxnA.exe
  2⤵
  PID:5532
- C:\Windows\System\pwYVicA.exe
  C:\Windows\System\pwYVicA.exe
  2⤵
  PID:5548
- C:\Windows\System\FUOsutT.exe
  C:\Windows\System\FUOsutT.exe
  2⤵
  PID:5564
- C:\Windows\System\ulzMFTc.exe
  C:\Windows\System\ulzMFTc.exe
  2⤵
  PID:5580
- C:\Windows\System\VwChTpe.exe
  C:\Windows\System\VwChTpe.exe
  2⤵
  PID:5596
- C:\Windows\System\FooMHuT.exe
  C:\Windows\System\FooMHuT.exe
  2⤵
  PID:5616
- C:\Windows\System\XijsWwj.exe
  C:\Windows\System\XijsWwj.exe
  2⤵
  PID:5632
- C:\Windows\System\agFgJAY.exe
  C:\Windows\System\agFgJAY.exe
  2⤵
  PID:5648
- C:\Windows\System\PCEFqsz.exe
  C:\Windows\System\PCEFqsz.exe
  2⤵
  PID:5664
- C:\Windows\System\Wygrfnh.exe
  C:\Windows\System\Wygrfnh.exe
  2⤵
  PID:5680
- C:\Windows\System\YAOkqDS.exe
  C:\Windows\System\YAOkqDS.exe
  2⤵
  PID:5696
- C:\Windows\System\byhRYyq.exe
  C:\Windows\System\byhRYyq.exe
  2⤵
  PID:5716
- C:\Windows\System\nODqUfL.exe
  C:\Windows\System\nODqUfL.exe
  2⤵
  PID:5732
- C:\Windows\System\XSpngLd.exe
  C:\Windows\System\XSpngLd.exe
  2⤵
  PID:5748
- C:\Windows\System\BjhiYUi.exe
  C:\Windows\System\BjhiYUi.exe
  2⤵
  PID:5764
- C:\Windows\System\AAJXdoN.exe
  C:\Windows\System\AAJXdoN.exe
  2⤵
  PID:5780
- C:\Windows\System\RSwfSXS.exe
  C:\Windows\System\RSwfSXS.exe
  2⤵
  PID:5796
- C:\Windows\System\vsgkuEE.exe
  C:\Windows\System\vsgkuEE.exe
  2⤵
  PID:5812
- C:\Windows\System\lLZYQmN.exe
  C:\Windows\System\lLZYQmN.exe
  2⤵
  PID:5828
- C:\Windows\System\ndBzsvZ.exe
  C:\Windows\System\ndBzsvZ.exe
  2⤵
  PID:5844
- C:\Windows\System\BehwOBc.exe
  C:\Windows\System\BehwOBc.exe
  2⤵
  PID:5860
- C:\Windows\System\jSkpQoN.exe
  C:\Windows\System\jSkpQoN.exe
  2⤵
  PID:5876
- C:\Windows\System\JrziYoF.exe
  C:\Windows\System\JrziYoF.exe
  2⤵
  PID:5892
- C:\Windows\System\STSJwMm.exe
  C:\Windows\System\STSJwMm.exe
  2⤵
  PID:5908
- C:\Windows\System\CoDggoC.exe
  C:\Windows\System\CoDggoC.exe
  2⤵
  PID:5924
- C:\Windows\System\fQqLwts.exe
  C:\Windows\System\fQqLwts.exe
  2⤵
  PID:5940
- C:\Windows\System\orrOuWC.exe
  C:\Windows\System\orrOuWC.exe
  2⤵
  PID:5956
- C:\Windows\System\JMCuTgL.exe
  C:\Windows\System\JMCuTgL.exe
  2⤵
  PID:5972
- C:\Windows\System\ufvWuOT.exe
  C:\Windows\System\ufvWuOT.exe
  2⤵
  PID:5988
- C:\Windows\System\xEcVdON.exe
  C:\Windows\System\xEcVdON.exe
  2⤵
  PID:6004
- C:\Windows\System\RPbcvvb.exe
  C:\Windows\System\RPbcvvb.exe
  2⤵
  PID:6020
- C:\Windows\System\lFjUCcc.exe
  C:\Windows\System\lFjUCcc.exe
  2⤵
  PID:6036
- C:\Windows\System\ygMQtdo.exe
  C:\Windows\System\ygMQtdo.exe
  2⤵
  PID:6052
- C:\Windows\System\JcQdWmU.exe
  C:\Windows\System\JcQdWmU.exe
  2⤵
  PID:6068
- C:\Windows\System\TPJmuci.exe
  C:\Windows\System\TPJmuci.exe
  2⤵
  PID:6084
- C:\Windows\System\jybiBve.exe
  C:\Windows\System\jybiBve.exe
  2⤵
  PID:6100
- C:\Windows\System\RzPTCXK.exe
  C:\Windows\System\RzPTCXK.exe
  2⤵
  PID:6116
- C:\Windows\System\EarLCbZ.exe
  C:\Windows\System\EarLCbZ.exe
  2⤵
  PID:6132
- C:\Windows\System\FIQendQ.exe
  C:\Windows\System\FIQendQ.exe
  2⤵
  PID:3384
- C:\Windows\System\Zsqfyhg.exe
  C:\Windows\System\Zsqfyhg.exe
  2⤵
  PID:612
- C:\Windows\System\ImbPtvM.exe
  C:\Windows\System\ImbPtvM.exe
  2⤵
  PID:3652
- C:\Windows\System\QnvYpuj.exe
  C:\Windows\System\QnvYpuj.exe
  2⤵
  PID:2096
- C:\Windows\System\HILeLgU.exe
  C:\Windows\System\HILeLgU.exe
  2⤵
  PID:5104
- C:\Windows\System\sAUMiRt.exe
  C:\Windows\System\sAUMiRt.exe
  2⤵
  PID:2640
- C:\Windows\System\fVIJvcH.exe
  C:\Windows\System\fVIJvcH.exe
  2⤵
  PID:5128
- C:\Windows\System\jfBHkAN.exe
  C:\Windows\System\jfBHkAN.exe
  2⤵
  PID:4100
- C:\Windows\System\QeyuolB.exe
  C:\Windows\System\QeyuolB.exe
  2⤵
  PID:2060
- C:\Windows\System\wXAGSVA.exe
  C:\Windows\System\wXAGSVA.exe
  2⤵
  PID:4464
- C:\Windows\System\iqSCLrU.exe
  C:\Windows\System\iqSCLrU.exe
  2⤵
  PID:3192
- C:\Windows\System\LeqcgXz.exe
  C:\Windows\System\LeqcgXz.exe
  2⤵
  PID:3680
- C:\Windows\System\uyVXMAG.exe
  C:\Windows\System\uyVXMAG.exe
  2⤵
  PID:5144
- C:\Windows\System\PBHGaNu.exe
  C:\Windows\System\PBHGaNu.exe
  2⤵
  PID:5240
- C:\Windows\System\RxkOBEr.exe
  C:\Windows\System\RxkOBEr.exe
  2⤵
  PID:5340
- C:\Windows\System\PLeBwyo.exe
  C:\Windows\System\PLeBwyo.exe
  2⤵
  PID:4748
- C:\Windows\System\AIsCRiy.exe
  C:\Windows\System\AIsCRiy.exe
  2⤵
  PID:2684
- C:\Windows\System\nRqMdVx.exe
  C:\Windows\System\nRqMdVx.exe
  2⤵
  PID:5132
- C:\Windows\System\HwixXTf.exe
  C:\Windows\System\HwixXTf.exe
  2⤵
  PID:5360
- C:\Windows\System\Nfpsuoz.exe
  C:\Windows\System\Nfpsuoz.exe
  2⤵
  PID:5440
- C:\Windows\System\IubkotM.exe
  C:\Windows\System\IubkotM.exe
  2⤵
  PID:5424
- C:\Windows\System\NnDRnMO.exe
  C:\Windows\System\NnDRnMO.exe
  2⤵
  PID:2872
- C:\Windows\System\rsBfFDf.exe
  C:\Windows\System\rsBfFDf.exe
  2⤵
  PID:5512
- C:\Windows\System\yfCDiOg.exe
  C:\Windows\System\yfCDiOg.exe
  2⤵
  PID:5492
- C:\Windows\System\oKTKSOK.exe
  C:\Windows\System\oKTKSOK.exe
  2⤵
  PID:112
- C:\Windows\System\YLCulKw.exe
  C:\Windows\System\YLCulKw.exe
  2⤵
  PID:5556
- C:\Windows\System\hiffIfA.exe
  C:\Windows\System\hiffIfA.exe
  2⤵
  PID:5592
- C:\Windows\System\TDwshwW.exe
  C:\Windows\System\TDwshwW.exe
  2⤵
  PID:5772
- C:\Windows\System\EZtQwHF.exe
  C:\Windows\System\EZtQwHF.exe
  2⤵
  PID:5836
- C:\Windows\System\GvcsBjQ.exe
  C:\Windows\System\GvcsBjQ.exe
  2⤵
  PID:5724
- C:\Windows\System\WHzjdtY.exe
  C:\Windows\System\WHzjdtY.exe
  2⤵
  PID:5872
- C:\Windows\System\QNimBRi.exe
  C:\Windows\System\QNimBRi.exe
  2⤵
  PID:5852
- C:\Windows\System\oOgSzuN.exe
  C:\Windows\System\oOgSzuN.exe
  2⤵
  PID:5900
- C:\Windows\System\XGZywrU.exe
  C:\Windows\System\XGZywrU.exe
  2⤵
  PID:5964
- C:\Windows\System\WcqoYJu.exe
  C:\Windows\System\WcqoYJu.exe
  2⤵
  PID:5728
- C:\Windows\System\ujZcrgm.exe
  C:\Windows\System\ujZcrgm.exe
  2⤵
  PID:5980
- C:\Windows\System\AGlPRji.exe
  C:\Windows\System\AGlPRji.exe
  2⤵
  PID:6000
- C:\Windows\System\IOgMdWM.exe
  C:\Windows\System\IOgMdWM.exe
  2⤵
  PID:6092
- C:\Windows\System\tsaRjjD.exe
  C:\Windows\System\tsaRjjD.exe
  2⤵
  PID:3148
- C:\Windows\System\otYKEGX.exe
  C:\Windows\System\otYKEGX.exe
  2⤵
  PID:6108
- C:\Windows\System\LkUPJmn.exe
  C:\Windows\System\LkUPJmn.exe
  2⤵
  PID:3752
- C:\Windows\System\bFJEEED.exe
  C:\Windows\System\bFJEEED.exe
  2⤵
  PID:5192
- C:\Windows\System\RJkZpxY.exe
  C:\Windows\System\RJkZpxY.exe
  2⤵
  PID:6112
- C:\Windows\System\KEnGYvT.exe
  C:\Windows\System\KEnGYvT.exe
  2⤵
  PID:3868
- C:\Windows\System\tqAXjyy.exe
  C:\Windows\System\tqAXjyy.exe
  2⤵
  PID:6016
- C:\Windows\System\nLoBvBl.exe
  C:\Windows\System\nLoBvBl.exe
  2⤵
  PID:5176
- C:\Windows\System\AqzoFWt.exe
  C:\Windows\System\AqzoFWt.exe
  2⤵
  PID:1772
- C:\Windows\System\MPxRXkP.exe
  C:\Windows\System\MPxRXkP.exe
  2⤵
  PID:2144
- C:\Windows\System\liBFfme.exe
  C:\Windows\System\liBFfme.exe
  2⤵
  PID:4492
- C:\Windows\System\PrUHsNO.exe
  C:\Windows\System\PrUHsNO.exe
  2⤵
  PID:5376
- C:\Windows\System\mwxLfRk.exe
  C:\Windows\System\mwxLfRk.exe
  2⤵
  PID:5276
- C:\Windows\System\SlaKqTW.exe
  C:\Windows\System\SlaKqTW.exe
  2⤵
  PID:5408
- C:\Windows\System\NQaPNPI.exe
  C:\Windows\System\NQaPNPI.exe
  2⤵
  PID:5420
- C:\Windows\System\PlEQLHb.exe
  C:\Windows\System\PlEQLHb.exe
  2⤵
  PID:5576
- C:\Windows\System\QrbMvET.exe
  C:\Windows\System\QrbMvET.exe
  2⤵
  PID:5644
- C:\Windows\System\ubBIYNL.exe
  C:\Windows\System\ubBIYNL.exe
  2⤵
  PID:5508
- C:\Windows\System\cXassUS.exe
  C:\Windows\System\cXassUS.exe
  2⤵
  PID:5672
- C:\Windows\System\seCpcRe.exe
  C:\Windows\System\seCpcRe.exe
  2⤵
  PID:5692
- C:\Windows\System\AAJDVnd.exe
  C:\Windows\System\AAJDVnd.exe
  2⤵
  PID:5932
- C:\Windows\System\LInkhZf.exe
  C:\Windows\System\LInkhZf.exe
  2⤵
  PID:6064
- C:\Windows\System\MtrdcMA.exe
  C:\Windows\System\MtrdcMA.exe
  2⤵
  PID:3884
- C:\Windows\System\pHqEgQw.exe
  C:\Windows\System\pHqEgQw.exe
  2⤵
  PID:6048
- C:\Windows\System\wPjgozN.exe
  C:\Windows\System\wPjgozN.exe
  2⤵
  PID:1720
- C:\Windows\System\nhJKmJW.exe
  C:\Windows\System\nhJKmJW.exe
  2⤵
  PID:1680
- C:\Windows\System\KRyQJZL.exe
  C:\Windows\System\KRyQJZL.exe
  2⤵
  PID:6140
- C:\Windows\System\MQYqqTn.exe
  C:\Windows\System\MQYqqTn.exe
  2⤵
  PID:5740
- C:\Windows\System\wbgwGlN.exe
  C:\Windows\System\wbgwGlN.exe
  2⤵
  PID:1724
- C:\Windows\System\wouMjrL.exe
  C:\Windows\System\wouMjrL.exe
  2⤵
  PID:6148
- C:\Windows\System\YMwKHTO.exe
  C:\Windows\System\YMwKHTO.exe
  2⤵
  PID:6164
- C:\Windows\System\IIGqLhE.exe
  C:\Windows\System\IIGqLhE.exe
  2⤵
  PID:6180
- C:\Windows\System\aFrMUPi.exe
  C:\Windows\System\aFrMUPi.exe
  2⤵
  PID:6196
- C:\Windows\System\Sjmxrdz.exe
  C:\Windows\System\Sjmxrdz.exe
  2⤵
  PID:6216
- C:\Windows\System\jWzpcjJ.exe
  C:\Windows\System\jWzpcjJ.exe
  2⤵
  PID:6232
- C:\Windows\System\FVgBMLm.exe
  C:\Windows\System\FVgBMLm.exe
  2⤵
  PID:6248
- C:\Windows\System\VXGrmzT.exe
  C:\Windows\System\VXGrmzT.exe
  2⤵
  PID:6264
- C:\Windows\System\ekhybgs.exe
  C:\Windows\System\ekhybgs.exe
  2⤵
  PID:6280
- C:\Windows\System\SFnEfJP.exe
  C:\Windows\System\SFnEfJP.exe
  2⤵
  PID:6296
- C:\Windows\System\RKwCDXh.exe
  C:\Windows\System\RKwCDXh.exe
  2⤵
  PID:6312
- C:\Windows\System\vyAhoKM.exe
  C:\Windows\System\vyAhoKM.exe
  2⤵
  PID:6328
- C:\Windows\System\kjAVQdH.exe
  C:\Windows\System\kjAVQdH.exe
  2⤵
  PID:6344
- C:\Windows\System\nQiFkuM.exe
  C:\Windows\System\nQiFkuM.exe
  2⤵
  PID:6360
- C:\Windows\System\AnQKamb.exe
  C:\Windows\System\AnQKamb.exe
  2⤵
  PID:6376
- C:\Windows\System\FAeSAIf.exe
  C:\Windows\System\FAeSAIf.exe
  2⤵
  PID:6392
- C:\Windows\System\xgLqyWc.exe
  C:\Windows\System\xgLqyWc.exe
  2⤵
  PID:6408
- C:\Windows\System\GyDhMJc.exe
  C:\Windows\System\GyDhMJc.exe
  2⤵
  PID:6424
- C:\Windows\System\bVNzfRS.exe
  C:\Windows\System\bVNzfRS.exe
  2⤵
  PID:6440
- C:\Windows\System\KeaGgRd.exe
  C:\Windows\System\KeaGgRd.exe
  2⤵
  PID:6456
- C:\Windows\System\ShCVESP.exe
  C:\Windows\System\ShCVESP.exe
  2⤵
  PID:6472
- C:\Windows\System\pCIZacU.exe
  C:\Windows\System\pCIZacU.exe
  2⤵
  PID:6492
- C:\Windows\System\KspeHor.exe
  C:\Windows\System\KspeHor.exe
  2⤵
  PID:6508
- C:\Windows\System\vLVpUwq.exe
  C:\Windows\System\vLVpUwq.exe
  2⤵
  PID:6524
- C:\Windows\System\RQfnSym.exe
  C:\Windows\System\RQfnSym.exe
  2⤵
  PID:6540
- C:\Windows\System\bTyOKjP.exe
  C:\Windows\System\bTyOKjP.exe
  2⤵
  PID:6556
- C:\Windows\System\CiFAvMl.exe
  C:\Windows\System\CiFAvMl.exe
  2⤵
  PID:6572
- C:\Windows\System\fTiieyj.exe
  C:\Windows\System\fTiieyj.exe
  2⤵
  PID:6588
- C:\Windows\System\tDdBzbi.exe
  C:\Windows\System\tDdBzbi.exe
  2⤵
  PID:6608
- C:\Windows\System\vMBUhVl.exe
  C:\Windows\System\vMBUhVl.exe
  2⤵
  PID:6624
- C:\Windows\System\GQHJxog.exe
  C:\Windows\System\GQHJxog.exe
  2⤵
  PID:6648
- C:\Windows\System\woIXIjv.exe
  C:\Windows\System\woIXIjv.exe
  2⤵
  PID:6664
- C:\Windows\System\kOHCvhh.exe
  C:\Windows\System\kOHCvhh.exe
  2⤵
  PID:6688
- C:\Windows\System\xTvrDdF.exe
  C:\Windows\System\xTvrDdF.exe
  2⤵
  PID:6704
- C:\Windows\System\MMXinks.exe
  C:\Windows\System\MMXinks.exe
  2⤵
  PID:6728
- C:\Windows\System\BzmlJNk.exe
  C:\Windows\System\BzmlJNk.exe
  2⤵
  PID:6744
- C:\Windows\System\GlwuvhJ.exe
  C:\Windows\System\GlwuvhJ.exe
  2⤵
  PID:6760
- C:\Windows\System\fQLYgdm.exe
  C:\Windows\System\fQLYgdm.exe
  2⤵
  PID:6776
- C:\Windows\System\PjwCPAt.exe
  C:\Windows\System\PjwCPAt.exe
  2⤵
  PID:6824
- C:\Windows\System\jIcOUYg.exe
  C:\Windows\System\jIcOUYg.exe
  2⤵
  PID:6840
- C:\Windows\System\dIaQYDx.exe
  C:\Windows\System\dIaQYDx.exe
  2⤵
  PID:6856
- C:\Windows\System\UpqHakT.exe
  C:\Windows\System\UpqHakT.exe
  2⤵
  PID:6872
- C:\Windows\System\fzbWvXT.exe
  C:\Windows\System\fzbWvXT.exe
  2⤵
  PID:6888
- C:\Windows\System\YbDGrBD.exe
  C:\Windows\System\YbDGrBD.exe
  2⤵
  PID:6904
- C:\Windows\System\pVIKIuA.exe
  C:\Windows\System\pVIKIuA.exe
  2⤵
  PID:6920
- C:\Windows\System\fcgoSph.exe
  C:\Windows\System\fcgoSph.exe
  2⤵
  PID:6936
- C:\Windows\System\hPQqMBi.exe
  C:\Windows\System\hPQqMBi.exe
  2⤵
  PID:6952
- C:\Windows\System\KvgRjjb.exe
  C:\Windows\System\KvgRjjb.exe
  2⤵
  PID:6968
- C:\Windows\System\sFpGUeS.exe
  C:\Windows\System\sFpGUeS.exe
  2⤵
  PID:6984
- C:\Windows\System\QWHkTma.exe
  C:\Windows\System\QWHkTma.exe
  2⤵
  PID:7000
- C:\Windows\System\wkSRIOQ.exe
  C:\Windows\System\wkSRIOQ.exe
  2⤵
  PID:7016
- C:\Windows\System\rgJwbpc.exe
  C:\Windows\System\rgJwbpc.exe
  2⤵
  PID:7032
- C:\Windows\System\JGMtNDy.exe
  C:\Windows\System\JGMtNDy.exe
  2⤵
  PID:7048
- C:\Windows\System\beJJHGv.exe
  C:\Windows\System\beJJHGv.exe
  2⤵
  PID:7064
- C:\Windows\System\BvnoVEt.exe
  C:\Windows\System\BvnoVEt.exe
  2⤵
  PID:7080
- C:\Windows\System\FGCtuWs.exe
  C:\Windows\System\FGCtuWs.exe
  2⤵
  PID:7096
- C:\Windows\System\dfzKeVE.exe
  C:\Windows\System\dfzKeVE.exe
  2⤵
  PID:7112
- C:\Windows\System\aszitlW.exe
  C:\Windows\System\aszitlW.exe
  2⤵
  PID:7128
- C:\Windows\System\CWldwpZ.exe
  C:\Windows\System\CWldwpZ.exe
  2⤵
  PID:7144
- C:\Windows\System\UvpeVWf.exe
  C:\Windows\System\UvpeVWf.exe
  2⤵
  PID:7160
- C:\Windows\System\sxuPVyA.exe
  C:\Windows\System\sxuPVyA.exe
  2⤵
  PID:5264
- C:\Windows\System\RoftUaf.exe
  C:\Windows\System\RoftUaf.exe
  2⤵
  PID:6128
- C:\Windows\System\zALjlcp.exe
  C:\Windows\System\zALjlcp.exe
  2⤵
  PID:5984
- C:\Windows\System\YLEUhYd.exe
  C:\Windows\System\YLEUhYd.exe
  2⤵
  PID:6012
- C:\Windows\System\MnefyKN.exe
  C:\Windows\System\MnefyKN.exe
  2⤵
  PID:3284
- C:\Windows\System\psWHDZk.exe
  C:\Windows\System\psWHDZk.exe
  2⤵
  PID:5296
- C:\Windows\System\Akhopsh.exe
  C:\Windows\System\Akhopsh.exe
  2⤵
  PID:5640
- C:\Windows\System\OtZNcBg.exe
  C:\Windows\System\OtZNcBg.exe
  2⤵
  PID:3948
- C:\Windows\System\Dnudyhh.exe
  C:\Windows\System\Dnudyhh.exe
  2⤵
  PID:6256
- C:\Windows\System\ZqYbdLG.exe
  C:\Windows\System\ZqYbdLG.exe
  2⤵
  PID:6324
- C:\Windows\System\IvqGaMk.exe
  C:\Windows\System\IvqGaMk.exe
  2⤵
  PID:5776
- C:\Windows\System\zPqtWQk.exe
  C:\Windows\System\zPqtWQk.exe
  2⤵
  PID:6172
- C:\Windows\System\MMQkzuv.exe
  C:\Windows\System\MMQkzuv.exe
  2⤵
  PID:5884
- C:\Windows\System\HJgflAY.exe
  C:\Windows\System\HJgflAY.exe
  2⤵
  PID:5588
- C:\Windows\System\tuZxiaW.exe
  C:\Windows\System\tuZxiaW.exe
  2⤵
  PID:6212
- C:\Windows\System\lbfGdvl.exe
  C:\Windows\System\lbfGdvl.exe
  2⤵
  PID:6272
- C:\Windows\System\zrgLrPD.exe
  C:\Windows\System\zrgLrPD.exe
  2⤵
  PID:6336
- C:\Windows\System\hrtHsbV.exe
  C:\Windows\System\hrtHsbV.exe
  2⤵
  PID:6384
- C:\Windows\System\nmhqUZq.exe
  C:\Windows\System\nmhqUZq.exe
  2⤵
  PID:6464
- C:\Windows\System\GKmGLea.exe
  C:\Windows\System\GKmGLea.exe
  2⤵
  PID:6356
- C:\Windows\System\NfxzvGf.exe
  C:\Windows\System\NfxzvGf.exe
  2⤵
  PID:5196
- C:\Windows\System\VOFoAbE.exe
  C:\Windows\System\VOFoAbE.exe
  2⤵
  PID:6568
- C:\Windows\System\bGjQdnF.exe
  C:\Windows\System\bGjQdnF.exe
  2⤵
  PID:6480
- C:\Windows\System\hhpWCxI.exe
  C:\Windows\System\hhpWCxI.exe
  2⤵
  PID:6532
- C:\Windows\System\XpMNdKa.exe
  C:\Windows\System\XpMNdKa.exe
  2⤵
  PID:6600
- C:\Windows\System\tQlzvak.exe
  C:\Windows\System\tQlzvak.exe
  2⤵
  PID:5428
- C:\Windows\System\xGFjfJi.exe
  C:\Windows\System\xGFjfJi.exe
  2⤵
  PID:6656
- C:\Windows\System\cmCbeFD.exe
  C:\Windows\System\cmCbeFD.exe
  2⤵
  PID:6736
- C:\Windows\System\GZUlfkQ.exe
  C:\Windows\System\GZUlfkQ.exe
  2⤵
  PID:6752
- C:\Windows\System\gWdhneJ.exe
  C:\Windows\System\gWdhneJ.exe
  2⤵
  PID:6720
- C:\Windows\System\sZufWic.exe
  C:\Windows\System\sZufWic.exe
  2⤵
  PID:6800
- C:\Windows\System\qcYHnbx.exe
  C:\Windows\System\qcYHnbx.exe
  2⤵
  PID:6816
- C:\Windows\System\GZjaoTd.exe
  C:\Windows\System\GZjaoTd.exe
  2⤵
  PID:6896
- C:\Windows\System\KRTNBka.exe
  C:\Windows\System\KRTNBka.exe
  2⤵
  PID:6928
- C:\Windows\System\KiHiWwd.exe
  C:\Windows\System\KiHiWwd.exe
  2⤵
  PID:6992
- C:\Windows\System\dbrFBCR.exe
  C:\Windows\System\dbrFBCR.exe
  2⤵
  PID:6944
- C:\Windows\System\hdtHIsL.exe
  C:\Windows\System\hdtHIsL.exe
  2⤵
  PID:7056
- C:\Windows\System\YafFAqR.exe
  C:\Windows\System\YafFAqR.exe
  2⤵
  PID:6948
- C:\Windows\System\QQhQVaL.exe
  C:\Windows\System\QQhQVaL.exe
  2⤵
  PID:7120
- C:\Windows\System\qiwPzms.exe
  C:\Windows\System\qiwPzms.exe
  2⤵
  PID:7008
- C:\Windows\System\Gyjggxr.exe
  C:\Windows\System\Gyjggxr.exe
  2⤵
  PID:6096
- C:\Windows\System\rvmELxP.exe
  C:\Windows\System\rvmELxP.exe
  2⤵
  PID:7104
- C:\Windows\System\IRNNcez.exe
  C:\Windows\System\IRNNcez.exe
  2⤵
  PID:6156
- C:\Windows\System\xZoTJvu.exe
  C:\Windows\System\xZoTJvu.exe
  2⤵
  PID:7076
- C:\Windows\System\GFRBxXR.exe
  C:\Windows\System\GFRBxXR.exe
  2⤵
  PID:6224
- C:\Windows\System\fROJPJA.exe
  C:\Windows\System\fROJPJA.exe
  2⤵
  PID:5788
- C:\Windows\System\JjujwGz.exe
  C:\Windows\System\JjujwGz.exe
  2⤵
  PID:6244
- C:\Windows\System\SNFhdLE.exe
  C:\Windows\System\SNFhdLE.exe
  2⤵
  PID:6228
- C:\Windows\System\EIuwVzW.exe
  C:\Windows\System\EIuwVzW.exe
  2⤵
  PID:6080
- C:\Windows\System\RxCqTEO.exe
  C:\Windows\System\RxCqTEO.exe
  2⤵
  PID:6352
- C:\Windows\System\dsKiKoy.exe
  C:\Windows\System\dsKiKoy.exe
  2⤵
  PID:6292
- C:\Windows\System\glancVA.exe
  C:\Windows\System\glancVA.exe
  2⤵
  PID:5868
- C:\Windows\System\dAZpYKQ.exe
  C:\Windows\System\dAZpYKQ.exe
  2⤵
  PID:6304
- C:\Windows\System\XVCQsEn.exe
  C:\Windows\System\XVCQsEn.exe
  2⤵
  PID:6500
- C:\Windows\System\IPQeKag.exe
  C:\Windows\System\IPQeKag.exe
  2⤵
  PID:6620
- C:\Windows\System\fRJlnVw.exe
  C:\Windows\System\fRJlnVw.exe
  2⤵
  PID:6680
- C:\Windows\System\MqlkiHl.exe
  C:\Windows\System\MqlkiHl.exe
  2⤵
  PID:6548
- C:\Windows\System\wngRKtX.exe
  C:\Windows\System\wngRKtX.exe
  2⤵
  PID:6640
- C:\Windows\System\mYLQpeN.exe
  C:\Windows\System\mYLQpeN.exe
  2⤵
  PID:6788
- C:\Windows\System\efbLEVK.exe
  C:\Windows\System\efbLEVK.exe
  2⤵
  PID:6864
- C:\Windows\System\VhcUguP.exe
  C:\Windows\System\VhcUguP.exe
  2⤵
  PID:6772
- C:\Windows\System\OTNkGGA.exe
  C:\Windows\System\OTNkGGA.exe
  2⤵
  PID:6868
- C:\Windows\System\WwYuarn.exe
  C:\Windows\System\WwYuarn.exe
  2⤵
  PID:6912
- C:\Windows\System\iEqaVMl.exe
  C:\Windows\System\iEqaVMl.exe
  2⤵
  PID:7152
- C:\Windows\System\CqZVTGC.exe
  C:\Windows\System\CqZVTGC.exe
  2⤵
  PID:7092
- C:\Windows\System\LegzwPy.exe
  C:\Windows\System\LegzwPy.exe
  2⤵
  PID:5996
- C:\Windows\System\flsFwHP.exe
  C:\Windows\System\flsFwHP.exe
  2⤵
  PID:6432
- C:\Windows\System\ihFIYHX.exe
  C:\Windows\System\ihFIYHX.exe
  2⤵
  PID:5624
- C:\Windows\System\HsiCOYN.exe
  C:\Windows\System\HsiCOYN.exe
  2⤵
  PID:6416
- C:\Windows\System\ItLmeNW.exe
  C:\Windows\System\ItLmeNW.exe
  2⤵
  PID:6672
- C:\Windows\System\XKUCEdN.exe
  C:\Windows\System\XKUCEdN.exe
  2⤵
  PID:6372
- C:\Windows\System\kPgQDNv.exe
  C:\Windows\System\kPgQDNv.exe
  2⤵
  PID:5476
- C:\Windows\System\JEcWDTH.exe
  C:\Windows\System\JEcWDTH.exe
  2⤵
  PID:6632
- C:\Windows\System\rQBhCbi.exe
  C:\Windows\System\rQBhCbi.exe
  2⤵
  PID:6812
- C:\Windows\System\syWovbC.exe
  C:\Windows\System\syWovbC.exe
  2⤵
  PID:6784
- C:\Windows\System\smXlgxT.exe
  C:\Windows\System\smXlgxT.exe
  2⤵
  PID:7072
- C:\Windows\System\NPPJpxo.exe
  C:\Windows\System\NPPJpxo.exe
  2⤵
  PID:7024
- C:\Windows\System\UVTcqCC.exe
  C:\Windows\System\UVTcqCC.exe
  2⤵
  PID:6204
- C:\Windows\System\hhWQutV.exe
  C:\Windows\System\hhWQutV.exe
  2⤵
  PID:5628
- C:\Windows\System\hhgEKqH.exe
  C:\Windows\System\hhgEKqH.exe
  2⤵
  PID:6448
- C:\Windows\System\OEqCFvy.exe
  C:\Windows\System\OEqCFvy.exe
  2⤵
  PID:5356
- C:\Windows\System\rtztCRz.exe
  C:\Windows\System\rtztCRz.exe
  2⤵
  PID:6260
- C:\Windows\System\PRwLUzQ.exe
  C:\Windows\System\PRwLUzQ.exe
  2⤵
  PID:6964
- C:\Windows\System\GHraiwK.exe
  C:\Windows\System\GHraiwK.exe
  2⤵
  PID:6836
- C:\Windows\System\IlrcOKs.exe
  C:\Windows\System\IlrcOKs.exe
  2⤵
  PID:6584
- C:\Windows\System\WLCIXII.exe
  C:\Windows\System\WLCIXII.exe
  2⤵
  PID:6848
- C:\Windows\System\fqdIXdS.exe
  C:\Windows\System\fqdIXdS.exe
  2⤵
  PID:7184
- C:\Windows\System\qomtmom.exe
  C:\Windows\System\qomtmom.exe
  2⤵
  PID:7200
- C:\Windows\System\pFgmpYR.exe
  C:\Windows\System\pFgmpYR.exe
  2⤵
  PID:7216
- C:\Windows\System\AJOBNpf.exe
  C:\Windows\System\AJOBNpf.exe
  2⤵
  PID:7232
- C:\Windows\System\JQkiPQZ.exe
  C:\Windows\System\JQkiPQZ.exe
  2⤵
  PID:7248
- C:\Windows\System\wITpAmp.exe
  C:\Windows\System\wITpAmp.exe
  2⤵
  PID:7264
- C:\Windows\System\WzMfSnl.exe
  C:\Windows\System\WzMfSnl.exe
  2⤵
  PID:7280
- C:\Windows\System\aRDnbwv.exe
  C:\Windows\System\aRDnbwv.exe
  2⤵
  PID:7296
- C:\Windows\System\uCzmKoi.exe
  C:\Windows\System\uCzmKoi.exe
  2⤵
  PID:7312
- C:\Windows\System\KBfCiSf.exe
  C:\Windows\System\KBfCiSf.exe
  2⤵
  PID:7332
- C:\Windows\System\xATtwml.exe
  C:\Windows\System\xATtwml.exe
  2⤵
  PID:7348
- C:\Windows\System\kYMmVEq.exe
  C:\Windows\System\kYMmVEq.exe
  2⤵
  PID:7364
- C:\Windows\System\biClaTt.exe
  C:\Windows\System\biClaTt.exe
  2⤵
  PID:7380
- C:\Windows\System\wlZjXGa.exe
  C:\Windows\System\wlZjXGa.exe
  2⤵
  PID:7396
- C:\Windows\System\ClDwrDu.exe
  C:\Windows\System\ClDwrDu.exe
  2⤵
  PID:7412
- C:\Windows\System\bhFxViB.exe
  C:\Windows\System\bhFxViB.exe
  2⤵
  PID:7428
- C:\Windows\System\OrQuNAb.exe
  C:\Windows\System\OrQuNAb.exe
  2⤵
  PID:7444
- C:\Windows\System\QhJLYqJ.exe
  C:\Windows\System\QhJLYqJ.exe
  2⤵
  PID:7460
- C:\Windows\System\KnkAdpt.exe
  C:\Windows\System\KnkAdpt.exe
  2⤵
  PID:7476
- C:\Windows\System\lstznxa.exe
  C:\Windows\System\lstznxa.exe
  2⤵
  PID:7492
- C:\Windows\System\jgQLRTy.exe
  C:\Windows\System\jgQLRTy.exe
  2⤵
  PID:7508
- C:\Windows\System\JVtozLK.exe
  C:\Windows\System\JVtozLK.exe
  2⤵
  PID:7524
- C:\Windows\System\fSAWLsD.exe
  C:\Windows\System\fSAWLsD.exe
  2⤵
  PID:7540
- C:\Windows\System\fZEtQcZ.exe
  C:\Windows\System\fZEtQcZ.exe
  2⤵
  PID:7556
- C:\Windows\System\TAJUyup.exe
  C:\Windows\System\TAJUyup.exe
  2⤵
  PID:7572
- C:\Windows\System\sQtDRAy.exe
  C:\Windows\System\sQtDRAy.exe
  2⤵
  PID:7588
- C:\Windows\System\cXlxAjg.exe
  C:\Windows\System\cXlxAjg.exe
  2⤵
  PID:7604
- C:\Windows\System\WsxYRka.exe
  C:\Windows\System\WsxYRka.exe
  2⤵
  PID:7620
- C:\Windows\System\ZdKlEdv.exe
  C:\Windows\System\ZdKlEdv.exe
  2⤵
  PID:7636
- C:\Windows\System\ytdJWjU.exe
  C:\Windows\System\ytdJWjU.exe
  2⤵
  PID:7652
- C:\Windows\System\JCprJWs.exe
  C:\Windows\System\JCprJWs.exe
  2⤵
  PID:7668
- C:\Windows\System\wwYlIgF.exe
  C:\Windows\System\wwYlIgF.exe
  2⤵
  PID:7684
- C:\Windows\System\jvOOpzX.exe
  C:\Windows\System\jvOOpzX.exe
  2⤵
  PID:7700
- C:\Windows\System\dHDARTl.exe
  C:\Windows\System\dHDARTl.exe
  2⤵
  PID:7716
- C:\Windows\System\tOpguOU.exe
  C:\Windows\System\tOpguOU.exe
  2⤵
  PID:7732
- C:\Windows\System\ETLYPog.exe
  C:\Windows\System\ETLYPog.exe
  2⤵
  PID:7752
- C:\Windows\System\dDsZJuQ.exe
  C:\Windows\System\dDsZJuQ.exe
  2⤵
  PID:7768
- C:\Windows\System\NKFgztt.exe
  C:\Windows\System\NKFgztt.exe
  2⤵
  PID:7784
- C:\Windows\System\MBIKbvB.exe
  C:\Windows\System\MBIKbvB.exe
  2⤵
  PID:7800
- C:\Windows\System\eSSothP.exe
  C:\Windows\System\eSSothP.exe
  2⤵
  PID:7820
- C:\Windows\System\FwrPQik.exe
  C:\Windows\System\FwrPQik.exe
  2⤵
  PID:7836
- C:\Windows\System\wqlPsoo.exe
  C:\Windows\System\wqlPsoo.exe
  2⤵
  PID:7852
- C:\Windows\System\BTKkNEg.exe
  C:\Windows\System\BTKkNEg.exe
  2⤵
  PID:7868
- C:\Windows\System\hnWXpGn.exe
  C:\Windows\System\hnWXpGn.exe
  2⤵
  PID:7884
- C:\Windows\System\pTYMhhe.exe
  C:\Windows\System\pTYMhhe.exe
  2⤵
  PID:7900
- C:\Windows\System\cStoRXT.exe
  C:\Windows\System\cStoRXT.exe
  2⤵
  PID:7936
- C:\Windows\System\REWwfsU.exe
  C:\Windows\System\REWwfsU.exe
  2⤵
  PID:7972
- C:\Windows\System\kXiGAZE.exe
  C:\Windows\System\kXiGAZE.exe
  2⤵
  PID:7996
- C:\Windows\System\RajrViy.exe
  C:\Windows\System\RajrViy.exe
  2⤵
  PID:8024
- C:\Windows\System\ypSZtYW.exe
  C:\Windows\System\ypSZtYW.exe
  2⤵
  PID:8040
- C:\Windows\System\cOQQYIR.exe
  C:\Windows\System\cOQQYIR.exe
  2⤵
  PID:8056
- C:\Windows\System\zZmzpDw.exe
  C:\Windows\System\zZmzpDw.exe
  2⤵
  PID:8072
- C:\Windows\System\pBkdcxl.exe
  C:\Windows\System\pBkdcxl.exe
  2⤵
  PID:8088
- C:\Windows\System\kjLGKfU.exe
  C:\Windows\System\kjLGKfU.exe
  2⤵
  PID:8104
- C:\Windows\System\FxbpnYT.exe
  C:\Windows\System\FxbpnYT.exe
  2⤵
  PID:8120
- C:\Windows\System\HqQjOXb.exe
  C:\Windows\System\HqQjOXb.exe
  2⤵
  PID:8136
- C:\Windows\System\piMLGdu.exe
  C:\Windows\System\piMLGdu.exe
  2⤵
  PID:8152
- C:\Windows\System\OUQESYs.exe
  C:\Windows\System\OUQESYs.exe
  2⤵
  PID:8172
- C:\Windows\System\uBnEemu.exe
  C:\Windows\System\uBnEemu.exe
  2⤵
  PID:8188
- C:\Windows\System\DFOPEPr.exe
  C:\Windows\System\DFOPEPr.exe
  2⤵
  PID:7196
- C:\Windows\System\oFuyXsD.exe
  C:\Windows\System\oFuyXsD.exe
  2⤵
  PID:6504
- C:\Windows\System\dfrJTbp.exe
  C:\Windows\System\dfrJTbp.exe
  2⤵
  PID:6076
- C:\Windows\System\CiJcFCf.exe
  C:\Windows\System\CiJcFCf.exe
  2⤵
  PID:7208
- C:\Windows\System\jZgyVoc.exe
  C:\Windows\System\jZgyVoc.exe
  2⤵
  PID:7180
- C:\Windows\System\ywPsrkx.exe
  C:\Windows\System\ywPsrkx.exe
  2⤵
  PID:7388
- C:\Windows\System\YcecGJN.exe
  C:\Windows\System\YcecGJN.exe
  2⤵
  PID:7456
- C:\Windows\System\cCntQYE.exe
  C:\Windows\System\cCntQYE.exe
  2⤵
  PID:7520
- C:\Windows\System\qIEmQFb.exe
  C:\Windows\System\qIEmQFb.exe
  2⤵
  PID:7436
- C:\Windows\System\qeQSiOh.exe
  C:\Windows\System\qeQSiOh.exe
  2⤵
  PID:7308
- C:\Windows\System\apACUFW.exe
  C:\Windows\System\apACUFW.exe
  2⤵
  PID:7344
- C:\Windows\System\ZZolJuv.exe
  C:\Windows\System\ZZolJuv.exe
  2⤵
  PID:7372
- C:\Windows\System\RxedOcC.exe
  C:\Windows\System\RxedOcC.exe
  2⤵
  PID:7612
- C:\Windows\System\vOBoDri.exe
  C:\Windows\System\vOBoDri.exe
  2⤵
  PID:7676
- C:\Windows\System\EnFOdvi.exe
  C:\Windows\System\EnFOdvi.exe
  2⤵
  PID:7600
- C:\Windows\System\IfVizUx.exe
  C:\Windows\System\IfVizUx.exe
  2⤵
  PID:7680
- C:\Windows\System\eSqvzkE.exe
  C:\Windows\System\eSqvzkE.exe
  2⤵
  PID:7744
- C:\Windows\System\hqfiRwq.exe
  C:\Windows\System\hqfiRwq.exe
  2⤵
  PID:7808
- C:\Windows\System\whAACmK.exe
  C:\Windows\System\whAACmK.exe
  2⤵
  PID:7724
- C:\Windows\System\mdFEaGQ.exe
  C:\Windows\System\mdFEaGQ.exe
  2⤵
  PID:7796
- C:\Windows\System\AxtKhNF.exe
  C:\Windows\System\AxtKhNF.exe
  2⤵
  PID:7764
- C:\Windows\System\MZsrLES.exe
  C:\Windows\System\MZsrLES.exe
  2⤵
  PID:7908
- C:\Windows\System\vxEoHEK.exe
  C:\Windows\System\vxEoHEK.exe
  2⤵
  PID:7044
- C:\Windows\System\PBnimvz.exe
  C:\Windows\System\PBnimvz.exe
  2⤵
  PID:8004
- C:\Windows\System\fRNDNuD.exe
  C:\Windows\System\fRNDNuD.exe
  2⤵
  PID:8052
- C:\Windows\System\KopWUKc.exe
  C:\Windows\System\KopWUKc.exe
  2⤵
  PID:8080
- C:\Windows\System\VrJcuXw.exe
  C:\Windows\System\VrJcuXw.exe
  2⤵
  PID:8032
- C:\Windows\System\vZXzGtf.exe
  C:\Windows\System\vZXzGtf.exe
  2⤵
  PID:8164
- C:\Windows\System\ZCQmEqD.exe
  C:\Windows\System\ZCQmEqD.exe
  2⤵
  PID:7292
- C:\Windows\System\ntBYqul.exe
  C:\Windows\System\ntBYqul.exe
  2⤵
  PID:7992
- C:\Windows\System\bLAtAPX.exe
  C:\Windows\System\bLAtAPX.exe
  2⤵
  PID:8168
- C:\Windows\System\xGHvTNS.exe
  C:\Windows\System\xGHvTNS.exe
  2⤵
  PID:6516
- C:\Windows\System\uRPacds.exe
  C:\Windows\System\uRPacds.exe
  2⤵
  PID:7328
- C:\Windows\System\OXwJtVE.exe
  C:\Windows\System\OXwJtVE.exe
  2⤵
  PID:7424
- C:\Windows\System\TEjvyru.exe
  C:\Windows\System\TEjvyru.exe
  2⤵
  PID:7468
- C:\Windows\System\pGNiLae.exe
  C:\Windows\System\pGNiLae.exe
  2⤵
  PID:7568
- C:\Windows\System\WsTwggM.exe
  C:\Windows\System\WsTwggM.exe
  2⤵
  PID:7320
- C:\Windows\System\GvUGZxX.exe
  C:\Windows\System\GvUGZxX.exe
  2⤵
  PID:7776
- C:\Windows\System\XpvlvwW.exe
  C:\Windows\System\XpvlvwW.exe
  2⤵
  PID:7780
- C:\Windows\System\zHmqFoz.exe
  C:\Windows\System\zHmqFoz.exe
  2⤵
  PID:7660
- C:\Windows\System\MWLTdcc.exe
  C:\Windows\System\MWLTdcc.exe
  2⤵
  PID:7304
- C:\Windows\System\JaoxjNv.exe
  C:\Windows\System\JaoxjNv.exe
  2⤵
  PID:7968
- C:\Windows\System\MMSFAZb.exe
  C:\Windows\System\MMSFAZb.exe
  2⤵
  PID:7848
- C:\Windows\System\vDQoYsh.exe
  C:\Windows\System\vDQoYsh.exe
  2⤵
  PID:7176
- C:\Windows\System\cvkKEPl.exe
  C:\Windows\System\cvkKEPl.exe
  2⤵
  PID:7228
- C:\Windows\System\gPffQZr.exe
  C:\Windows\System\gPffQZr.exe
  2⤵
  PID:7408
- C:\Windows\System\wQFCqLG.exe
  C:\Windows\System\wQFCqLG.exe
  2⤵
  PID:7740
- C:\Windows\System\NtZqxxK.exe
  C:\Windows\System\NtZqxxK.exe
  2⤵
  PID:7488
- C:\Windows\System\qqUYTkq.exe
  C:\Windows\System\qqUYTkq.exe
  2⤵
  PID:8068
- C:\Windows\System\EtKyyFJ.exe
  C:\Windows\System\EtKyyFJ.exe
  2⤵
  PID:7892
- C:\Windows\System\gCaLuLW.exe
  C:\Windows\System\gCaLuLW.exe
  2⤵
  PID:8112
- C:\Windows\System\bziOZsB.exe
  C:\Windows\System\bziOZsB.exe
  2⤵
  PID:8204
- C:\Windows\System\pBMMqCe.exe
  C:\Windows\System\pBMMqCe.exe
  2⤵
  PID:8220
- C:\Windows\System\uBScyXS.exe
  C:\Windows\System\uBScyXS.exe
  2⤵
  PID:8236
- C:\Windows\System\iXqzudZ.exe
  C:\Windows\System\iXqzudZ.exe
  2⤵
  PID:8256
- C:\Windows\System\YkmcXPv.exe
  C:\Windows\System\YkmcXPv.exe
  2⤵
  PID:8344
- C:\Windows\System\mcwkKsM.exe
  C:\Windows\System\mcwkKsM.exe
  2⤵
  PID:8360
- C:\Windows\System\HdQWjab.exe
  C:\Windows\System\HdQWjab.exe
  2⤵
  PID:8376
- C:\Windows\System\PuESOOj.exe
  C:\Windows\System\PuESOOj.exe
  2⤵
  PID:8392
- C:\Windows\System\IFSefQE.exe
  C:\Windows\System\IFSefQE.exe
  2⤵
  PID:8408
- C:\Windows\System\TbjPZiA.exe
  C:\Windows\System\TbjPZiA.exe
  2⤵
  PID:8424
- C:\Windows\System\Lltlkht.exe
  C:\Windows\System\Lltlkht.exe
  2⤵
  PID:8440
- C:\Windows\System\UIlalRi.exe
  C:\Windows\System\UIlalRi.exe
  2⤵
  PID:8456
- C:\Windows\System\wDluTcC.exe
  C:\Windows\System\wDluTcC.exe
  2⤵
  PID:8472
- C:\Windows\System\vQxswyq.exe
  C:\Windows\System\vQxswyq.exe
  2⤵
  PID:8488
- C:\Windows\System\KlpHhHF.exe
  C:\Windows\System\KlpHhHF.exe
  2⤵
  PID:8504
- C:\Windows\System\QJwdVay.exe
  C:\Windows\System\QJwdVay.exe
  2⤵
  PID:8520
- C:\Windows\System\jWvAVnQ.exe
  C:\Windows\System\jWvAVnQ.exe
  2⤵
  PID:8536
- C:\Windows\System\NTVeqbE.exe
  C:\Windows\System\NTVeqbE.exe
  2⤵
  PID:8552
- C:\Windows\System\nlxQUAX.exe
  C:\Windows\System\nlxQUAX.exe
  2⤵
  PID:8568
- C:\Windows\System\jVLSSCI.exe
  C:\Windows\System\jVLSSCI.exe
  2⤵
  PID:8584
- C:\Windows\System\ljDqfnf.exe
  C:\Windows\System\ljDqfnf.exe
  2⤵
  PID:8600
- C:\Windows\System\zSJLphi.exe
  C:\Windows\System\zSJLphi.exe
  2⤵
  PID:8616
- C:\Windows\System\ttjRkuA.exe
  C:\Windows\System\ttjRkuA.exe
  2⤵
  PID:8632
- C:\Windows\System\tEmHxfZ.exe
  C:\Windows\System\tEmHxfZ.exe
  2⤵
  PID:8648
- C:\Windows\System\vVweqWU.exe
  C:\Windows\System\vVweqWU.exe
  2⤵
  PID:8664
- C:\Windows\System\ymEugHE.exe
  C:\Windows\System\ymEugHE.exe
  2⤵
  PID:8680
- C:\Windows\System\voueKfL.exe
  C:\Windows\System\voueKfL.exe
  2⤵
  PID:8696
- C:\Windows\System\SpxwrMl.exe
  C:\Windows\System\SpxwrMl.exe
  2⤵
  PID:8712
- C:\Windows\System\NoNwVsZ.exe
  C:\Windows\System\NoNwVsZ.exe
  2⤵
  PID:8732
- C:\Windows\System\eLMHmyR.exe
  C:\Windows\System\eLMHmyR.exe
  2⤵
  PID:8748
- C:\Windows\System\NKZcvov.exe
  C:\Windows\System\NKZcvov.exe
  2⤵
  PID:8764
- C:\Windows\System\WMzdyfn.exe
  C:\Windows\System\WMzdyfn.exe
  2⤵
  PID:8780
- C:\Windows\System\orbMjfT.exe
  C:\Windows\System\orbMjfT.exe
  2⤵
  PID:8796
- C:\Windows\System\dZDhLWi.exe
  C:\Windows\System\dZDhLWi.exe
  2⤵
  PID:8812
- C:\Windows\System\oKHLpQf.exe
  C:\Windows\System\oKHLpQf.exe
  2⤵
  PID:8828
- C:\Windows\System\XKprSVz.exe
  C:\Windows\System\XKprSVz.exe
  2⤵
  PID:8844
- C:\Windows\System\qfgBJAV.exe
  C:\Windows\System\qfgBJAV.exe
  2⤵
  PID:8864
- C:\Windows\System\AXgugHu.exe
  C:\Windows\System\AXgugHu.exe
  2⤵
  PID:8880
- C:\Windows\System\PpBObUb.exe
  C:\Windows\System\PpBObUb.exe
  2⤵
  PID:8896
- C:\Windows\System\ocqTSMM.exe
  C:\Windows\System\ocqTSMM.exe
  2⤵
  PID:8912
- C:\Windows\System\SfTbuzF.exe
  C:\Windows\System\SfTbuzF.exe
  2⤵
  PID:8928
- C:\Windows\System\rUSlTnA.exe
  C:\Windows\System\rUSlTnA.exe
  2⤵
  PID:8944
- C:\Windows\System\LQUYyez.exe
  C:\Windows\System\LQUYyez.exe
  2⤵
  PID:8960
- C:\Windows\System\UqcCfNJ.exe
  C:\Windows\System\UqcCfNJ.exe
  2⤵
  PID:8976
- C:\Windows\System\DHauFyY.exe
  C:\Windows\System\DHauFyY.exe
  2⤵
  PID:8992
- C:\Windows\System\FBOvMyr.exe
  C:\Windows\System\FBOvMyr.exe
  2⤵
  PID:9008
- C:\Windows\System\NKcqdgs.exe
  C:\Windows\System\NKcqdgs.exe
  2⤵
  PID:9024
- C:\Windows\System\DmmQyyR.exe
  C:\Windows\System\DmmQyyR.exe
  2⤵
  PID:9040
- C:\Windows\System\jBmjicG.exe
  C:\Windows\System\jBmjicG.exe
  2⤵
  PID:9056
- C:\Windows\System\tplAixy.exe
  C:\Windows\System\tplAixy.exe
  2⤵
  PID:9072
- C:\Windows\System\PJianPJ.exe
  C:\Windows\System\PJianPJ.exe
  2⤵
  PID:9088
- C:\Windows\System\qQBnjrz.exe
  C:\Windows\System\qQBnjrz.exe
  2⤵
  PID:9104
- C:\Windows\System\GFiFfND.exe
  C:\Windows\System\GFiFfND.exe
  2⤵
  PID:9120
- C:\Windows\System\TfayExW.exe
  C:\Windows\System\TfayExW.exe
  2⤵
  PID:9136
- C:\Windows\System\ipqqZrL.exe
  C:\Windows\System\ipqqZrL.exe
  2⤵
  PID:9152
- C:\Windows\System\NBwmtrv.exe
  C:\Windows\System\NBwmtrv.exe
  2⤵
  PID:9168
- C:\Windows\System\hFxlpWa.exe
  C:\Windows\System\hFxlpWa.exe
  2⤵
  PID:9188
- C:\Windows\System\vjBpKTA.exe
  C:\Windows\System\vjBpKTA.exe
  2⤵
  PID:9204
- C:\Windows\System\VFSrhZo.exe
  C:\Windows\System\VFSrhZo.exe
  2⤵
  PID:8212
- C:\Windows\System\hXoTzpV.exe
  C:\Windows\System\hXoTzpV.exe
  2⤵
  PID:8132
- C:\Windows\System\bPalttQ.exe
  C:\Windows\System\bPalttQ.exe
  2⤵
  PID:8096
- C:\Windows\System\SsdojwY.exe
  C:\Windows\System\SsdojwY.exe
  2⤵
  PID:7532
- C:\Windows\System\AUyAahL.exe
  C:\Windows\System\AUyAahL.exe
  2⤵
  PID:7988
- C:\Windows\System\cErexky.exe
  C:\Windows\System\cErexky.exe
  2⤵
  PID:7376
- C:\Windows\System\PcGQsAv.exe
  C:\Windows\System\PcGQsAv.exe
  2⤵
  PID:8216
- C:\Windows\System\YzjsGLo.exe
  C:\Windows\System\YzjsGLo.exe
  2⤵
  PID:7760
- C:\Windows\System\aTuZFZI.exe
  C:\Windows\System\aTuZFZI.exe
  2⤵
  PID:7212
- C:\Windows\System\fOsmLuE.exe
  C:\Windows\System\fOsmLuE.exe
  2⤵
  PID:8276
- C:\Windows\System\VrSmWlp.exe
  C:\Windows\System\VrSmWlp.exe
  2⤵
  PID:8268
- C:\Windows\System\FGBdLGn.exe
  C:\Windows\System\FGBdLGn.exe
  2⤵
  PID:8404
- C:\Windows\System\SqveFhG.exe
  C:\Windows\System\SqveFhG.exe
  2⤵
  PID:8436
- C:\Windows\System\GhchqRI.exe
  C:\Windows\System\GhchqRI.exe
  2⤵
  PID:8496
- C:\Windows\System\rcSmLcX.exe
  C:\Windows\System\rcSmLcX.exe
  2⤵
  PID:8624
- C:\Windows\System\wRpwUIu.exe
  C:\Windows\System\wRpwUIu.exe
  2⤵
  PID:8660
- C:\Windows\System\MkjbcCT.exe
  C:\Windows\System\MkjbcCT.exe
  2⤵
  PID:8720
- C:\Windows\System\nkAdngU.exe
  C:\Windows\System\nkAdngU.exe
  2⤵
  PID:8760
- C:\Windows\System\WRibqIK.exe
  C:\Windows\System\WRibqIK.exe
  2⤵
  PID:8820
- C:\Windows\System\FpLJMGH.exe
  C:\Windows\System\FpLJMGH.exe
  2⤵
  PID:8924
- C:\Windows\System\dimBDxg.exe
  C:\Windows\System\dimBDxg.exe
  2⤵
  PID:8420
- C:\Windows\System\dCJzkvd.exe
  C:\Windows\System\dCJzkvd.exe
  2⤵
  PID:8292
- C:\Windows\System\DUpkDdf.exe
  C:\Windows\System\DUpkDdf.exe
  2⤵
  PID:8548
- C:\Windows\System\dacLKsN.exe
  C:\Windows\System\dacLKsN.exe
  2⤵
  PID:8640
- C:\Windows\System\wUfQuIi.exe
  C:\Windows\System\wUfQuIi.exe
  2⤵
  PID:8776
- C:\Windows\System\PeaFswj.exe
  C:\Windows\System\PeaFswj.exe
  2⤵
  PID:8836
- C:\Windows\System\KlmEwZO.exe
  C:\Windows\System\KlmEwZO.exe
  2⤵
  PID:8876
- C:\Windows\System\HDbcySz.exe
  C:\Windows\System\HDbcySz.exe
  2⤵
  PID:8388
- C:\Windows\System\wVwIVBY.exe
  C:\Windows\System\wVwIVBY.exe
  2⤵
  PID:8908
- C:\Windows\System\iSYjzDW.exe
  C:\Windows\System\iSYjzDW.exe
  2⤵
  PID:8968
- C:\Windows\System\UnxTQyv.exe
  C:\Windows\System\UnxTQyv.exe
  2⤵
  PID:9020
- C:\Windows\System\vHUYRRP.exe
  C:\Windows\System\vHUYRRP.exe
  2⤵
  PID:9128
- C:\Windows\System\SNMQxDb.exe
  C:\Windows\System\SNMQxDb.exe
  2⤵
  PID:9100
- C:\Windows\System\VhDXInc.exe
  C:\Windows\System\VhDXInc.exe
  2⤵
  PID:9052
- C:\Windows\System\XAXoSfh.exe
  C:\Windows\System\XAXoSfh.exe
  2⤵
  PID:9084
- C:\Windows\System\dqZXyPT.exe
  C:\Windows\System\dqZXyPT.exe
  2⤵
  PID:9200
- C:\Windows\System\druIxLv.exe
  C:\Windows\System\druIxLv.exe
  2⤵
  PID:9184
- C:\Windows\System\LaKCwEW.exe
  C:\Windows\System\LaKCwEW.exe
  2⤵
  PID:7928
- C:\Windows\System\aIhvVIp.exe
  C:\Windows\System\aIhvVIp.exe
  2⤵
  PID:7420
- C:\Windows\System\wKrdNpO.exe
  C:\Windows\System\wKrdNpO.exe
  2⤵
  PID:7924
- C:\Windows\System\IVWsoAi.exe
  C:\Windows\System\IVWsoAi.exe
  2⤵
  PID:8468
- C:\Windows\System\xokEcMQ.exe
  C:\Windows\System\xokEcMQ.exe
  2⤵
  PID:8560
- C:\Windows\System\mGQFHTn.exe
  C:\Windows\System\mGQFHTn.exe
  2⤵
  PID:8564
- C:\Windows\System\EIAETpT.exe
  C:\Windows\System\EIAETpT.exe
  2⤵
  PID:8532
- C:\Windows\System\ByuMBdR.exe
  C:\Windows\System\ByuMBdR.exe
  2⤵
  PID:8824
- C:\Windows\System\CgfDDCH.exe
  C:\Windows\System\CgfDDCH.exe
  2⤵
  PID:8316
- C:\Windows\System\wPOSrah.exe
  C:\Windows\System\wPOSrah.exe
  2⤵
  PID:7356
- C:\Windows\System\fjrFNGO.exe
  C:\Windows\System\fjrFNGO.exe
  2⤵
  PID:8628
- C:\Windows\System\uNQUMoc.exe
  C:\Windows\System\uNQUMoc.exe
  2⤵
  PID:8888
- C:\Windows\System\mTmDURj.exe
  C:\Windows\System\mTmDURj.exe
  2⤵
  PID:8484
- C:\Windows\System\mHEziVS.exe
  C:\Windows\System\mHEziVS.exe
  2⤵
  PID:8356
- C:\Windows\System\vEJMdQB.exe
  C:\Windows\System\vEJMdQB.exe
  2⤵
  PID:2364
- C:\Windows\System\xmThAZl.exe
  C:\Windows\System\xmThAZl.exe
  2⤵
  PID:8936
- C:\Windows\System\GKdkIrD.exe
  C:\Windows\System\GKdkIrD.exe
  2⤵
  PID:8956
- C:\Windows\System\tKSJaeU.exe
  C:\Windows\System\tKSJaeU.exe
  2⤵
  PID:8608
- C:\Windows\System\ZKJmIak.exe
  C:\Windows\System\ZKJmIak.exe
  2⤵
  PID:8644
- C:\Windows\System\MixJyJS.exe
  C:\Windows\System\MixJyJS.exe
  2⤵
  PID:9004
- C:\Windows\System\LgODTBk.exe
  C:\Windows\System\LgODTBk.exe
  2⤵
  PID:9016
- C:\Windows\System\WXgKYMq.exe
  C:\Windows\System\WXgKYMq.exe
  2⤵
  PID:8988
- C:\Windows\System\dzCZcWR.exe
  C:\Windows\System\dzCZcWR.exe
  2⤵
  PID:9112
- C:\Windows\System\UNCQNfv.exe
  C:\Windows\System\UNCQNfv.exe
  2⤵
  PID:8196
- C:\Windows\System\CAZaokd.exe
  C:\Windows\System\CAZaokd.exe
  2⤵
  PID:8264
- C:\Windows\System\CNlBgti.exe
  C:\Windows\System\CNlBgti.exe
  2⤵
  PID:8368
- C:\Windows\System\PVIyiKO.exe
  C:\Windows\System\PVIyiKO.exe
  2⤵
  PID:8872
- C:\Windows\System\WpuGvRf.exe
  C:\Windows\System\WpuGvRf.exe
  2⤵
  PID:8320
- C:\Windows\System\biNBUJo.exe
  C:\Windows\System\biNBUJo.exe
  2⤵
  PID:8920
- C:\Windows\System\VeZlcni.exe
  C:\Windows\System\VeZlcni.exe
  2⤵
  PID:9048
- C:\Windows\System\RQvQPIL.exe
  C:\Windows\System\RQvQPIL.exe
  2⤵
  PID:8432
- C:\Windows\System\pgoBRvq.exe
  C:\Windows\System\pgoBRvq.exe
  2⤵
  PID:8544
- C:\Windows\System\nBclhmk.exe
  C:\Windows\System\nBclhmk.exe
  2⤵
  PID:8328
- C:\Windows\System\qBTtdtE.exe
  C:\Windows\System\qBTtdtE.exe
  2⤵
  PID:8672
- C:\Windows\System\LHQpOyX.exe
  C:\Windows\System\LHQpOyX.exe
  2⤵
  PID:9068
- C:\Windows\System\Obphdkg.exe
  C:\Windows\System\Obphdkg.exe
  2⤵
  PID:8792
- C:\Windows\System\dacMiQP.exe
  C:\Windows\System\dacMiQP.exe
  2⤵
  PID:8940
- C:\Windows\System\YeYmYOA.exe
  C:\Windows\System\YeYmYOA.exe
  2⤵
  PID:8860
- C:\Windows\System\aDjJFgX.exe
  C:\Windows\System\aDjJFgX.exe
  2⤵
  PID:8304
- C:\Windows\System\fHPDzPJ.exe
  C:\Windows\System\fHPDzPJ.exe
  2⤵
  PID:9132
- C:\Windows\System\HJpYMhU.exe
  C:\Windows\System\HJpYMhU.exe
  2⤵
  PID:8084
- C:\Windows\System\NChxZlg.exe
  C:\Windows\System\NChxZlg.exe
  2⤵
  PID:8232
- C:\Windows\System\TQcsCho.exe
  C:\Windows\System\TQcsCho.exe
  2⤵
  PID:8856
- C:\Windows\System\pxYgogS.exe
  C:\Windows\System\pxYgogS.exe
  2⤵
  PID:8336
- C:\Windows\System\Ucuawiu.exe
  C:\Windows\System\Ucuawiu.exe
  2⤵
  PID:8612
- C:\Windows\System\OxZNpLS.exe
  C:\Windows\System\OxZNpLS.exe
  2⤵
  PID:8740
- C:\Windows\System\vWuSiCK.exe
  C:\Windows\System\vWuSiCK.exe
  2⤵
  PID:8692
- C:\Windows\System\lcCZQND.exe
  C:\Windows\System\lcCZQND.exe
  2⤵
  PID:9228
- C:\Windows\System\qpSOFbC.exe
  C:\Windows\System\qpSOFbC.exe
  2⤵
  PID:9252
- C:\Windows\System\uMcHyLt.exe
  C:\Windows\System\uMcHyLt.exe
  2⤵
  PID:9276
- C:\Windows\System\ZqVtJTd.exe
  C:\Windows\System\ZqVtJTd.exe
  2⤵
  PID:9344
- C:\Windows\System\ZWuTRxs.exe
  C:\Windows\System\ZWuTRxs.exe
  2⤵
  PID:9364
- C:\Windows\System\scAqVmK.exe
  C:\Windows\System\scAqVmK.exe
  2⤵
  PID:9388
- C:\Windows\System\xTHkdtm.exe
  C:\Windows\System\xTHkdtm.exe
  2⤵
  PID:9404
- C:\Windows\System\jGBMNwa.exe
  C:\Windows\System\jGBMNwa.exe
  2⤵
  PID:9420
- C:\Windows\System\tmfmhOv.exe
  C:\Windows\System\tmfmhOv.exe
  2⤵
  PID:9436
- C:\Windows\System\KnBnavV.exe
  C:\Windows\System\KnBnavV.exe
  2⤵
  PID:9452
- C:\Windows\System\RBKYfsc.exe
  C:\Windows\System\RBKYfsc.exe
  2⤵
  PID:9468
- C:\Windows\System\CdysetK.exe
  C:\Windows\System\CdysetK.exe
  2⤵
  PID:9484
- C:\Windows\System\NpJtqYV.exe
  C:\Windows\System\NpJtqYV.exe
  2⤵
  PID:9532
- C:\Windows\System\iYvZskj.exe
  C:\Windows\System\iYvZskj.exe
  2⤵
  PID:9548
- C:\Windows\System\aawduIN.exe
  C:\Windows\System\aawduIN.exe
  2⤵
  PID:9564
- C:\Windows\System\QInyvmL.exe
  C:\Windows\System\QInyvmL.exe
  2⤵
  PID:9580
- C:\Windows\System\zBRpVIU.exe
  C:\Windows\System\zBRpVIU.exe
  2⤵
  PID:9596
- C:\Windows\System\AutWaeU.exe
  C:\Windows\System\AutWaeU.exe
  2⤵
  PID:9616
- C:\Windows\System\vzEXwBV.exe
  C:\Windows\System\vzEXwBV.exe
  2⤵
  PID:9632
- C:\Windows\System\gomkiYL.exe
  C:\Windows\System\gomkiYL.exe
  2⤵
  PID:9672
- C:\Windows\System\TiKcUJH.exe
  C:\Windows\System\TiKcUJH.exe
  2⤵
  PID:9740
- C:\Windows\System\zOVShql.exe
  C:\Windows\System\zOVShql.exe
  2⤵
  PID:9756
- C:\Windows\System\DOtUBdC.exe
  C:\Windows\System\DOtUBdC.exe
  2⤵
  PID:9772
- C:\Windows\System\DMAmIQH.exe
  C:\Windows\System\DMAmIQH.exe
  2⤵
  PID:9788
- C:\Windows\System\gneASgo.exe
  C:\Windows\System\gneASgo.exe
  2⤵
  PID:9804
- C:\Windows\System\jKbOOQL.exe
  C:\Windows\System\jKbOOQL.exe
  2⤵
  PID:9820
- C:\Windows\System\dSaCOuY.exe
  C:\Windows\System\dSaCOuY.exe
  2⤵
  PID:9836
- C:\Windows\System\UmVnyYA.exe
  C:\Windows\System\UmVnyYA.exe
  2⤵
  PID:9852
- C:\Windows\System\ImwDzyy.exe
  C:\Windows\System\ImwDzyy.exe
  2⤵
  PID:9868
- C:\Windows\System\JknvRNR.exe
  C:\Windows\System\JknvRNR.exe
  2⤵
  PID:9884
- C:\Windows\System\ahsOqLo.exe
  C:\Windows\System\ahsOqLo.exe
  2⤵
  PID:9904
- C:\Windows\System\FukEnTh.exe
  C:\Windows\System\FukEnTh.exe
  2⤵
  PID:9920
- C:\Windows\System\KaDKuxu.exe
  C:\Windows\System\KaDKuxu.exe
  2⤵
  PID:9936
- C:\Windows\System\stQAzcM.exe
  C:\Windows\System\stQAzcM.exe
  2⤵
  PID:9952
- C:\Windows\System\WOuynVp.exe
  C:\Windows\System\WOuynVp.exe
  2⤵
  PID:9984
- C:\Windows\System\KIjFVNH.exe
  C:\Windows\System\KIjFVNH.exe
  2⤵
  PID:10012
- C:\Windows\System\fRLYFBQ.exe
  C:\Windows\System\fRLYFBQ.exe
  2⤵
  PID:10092
- C:\Windows\System\xEdFqiO.exe
  C:\Windows\System\xEdFqiO.exe
  2⤵
  PID:10112
- C:\Windows\System\neYpYhG.exe
  C:\Windows\System\neYpYhG.exe
  2⤵
  PID:10132
- C:\Windows\System\qCWvtkL.exe
  C:\Windows\System\qCWvtkL.exe
  2⤵
  PID:10152
- C:\Windows\System\XiANBKy.exe
  C:\Windows\System\XiANBKy.exe
  2⤵
  PID:10168
- C:\Windows\System\GCnSTTB.exe
  C:\Windows\System\GCnSTTB.exe
  2⤵
  PID:9324
- C:\Windows\System\yjSCDVU.exe
  C:\Windows\System\yjSCDVU.exe
  2⤵
  PID:9428
- C:\Windows\System\QbZtyrh.exe
  C:\Windows\System\QbZtyrh.exe
  2⤵
  PID:9248
- C:\Windows\System\qMSdiOE.exe
  C:\Windows\System\qMSdiOE.exe
  2⤵
  PID:9300
- C:\Windows\System\SroZPgv.exe
  C:\Windows\System\SroZPgv.exe
  2⤵
  PID:9332
- C:\Windows\System\pevjGPU.exe
  C:\Windows\System\pevjGPU.exe
  2⤵
  PID:9372
- C:\Windows\System\ngJnNJM.exe
  C:\Windows\System\ngJnNJM.exe
  2⤵
  PID:9444
- C:\Windows\System\jIEjDvx.exe
  C:\Windows\System\jIEjDvx.exe
  2⤵
  PID:9572
- C:\Windows\System\poNjaMp.exe
  C:\Windows\System\poNjaMp.exe
  2⤵
  PID:9236
- C:\Windows\System\hDvuerL.exe
  C:\Windows\System\hDvuerL.exe
  2⤵
  PID:9220
- C:\Windows\System\PfEYwHN.exe
  C:\Windows\System\PfEYwHN.exe
  2⤵
  PID:9524
- C:\Windows\System\UuxxKki.exe
  C:\Windows\System\UuxxKki.exe
  2⤵
  PID:9500
- C:\Windows\System\srKSVee.exe
  C:\Windows\System\srKSVee.exe
  2⤵
  PID:9780
- C:\Windows\System\ryVrVlS.exe
  C:\Windows\System\ryVrVlS.exe
  2⤵
  PID:9652
- C:\Windows\System\rWtNtLK.exe
  C:\Windows\System\rWtNtLK.exe
  2⤵
  PID:9912
- C:\Windows\System\AdyRnUr.exe
  C:\Windows\System\AdyRnUr.exe
  2⤵
  PID:9624
- C:\Windows\System\QRGffWu.exe
  C:\Windows\System\QRGffWu.exe
  2⤵
  PID:9704
- C:\Windows\System\duVQUDE.exe
  C:\Windows\System\duVQUDE.exe
  2⤵
  PID:9736
- C:\Windows\System\KbhJCIK.exe
  C:\Windows\System\KbhJCIK.exe
  2⤵
  PID:9800
- C:\Windows\System\UEWZJuU.exe
  C:\Windows\System\UEWZJuU.exe
  2⤵
  PID:9864
- C:\Windows\System\ptOUISg.exe
  C:\Windows\System\ptOUISg.exe
  2⤵
  PID:9900
- C:\Windows\System\PAuoWMv.exe
  C:\Windows\System\PAuoWMv.exe
  2⤵
  PID:9264
- C:\Windows\System\oMuKlHL.exe
  C:\Windows\System\oMuKlHL.exe
  2⤵
  PID:9964
- C:\Windows\System\KOffzEG.exe
  C:\Windows\System\KOffzEG.exe
  2⤵
  PID:9976
- C:\Windows\System\CPHwGNB.exe
  C:\Windows\System\CPHwGNB.exe
  2⤵
  PID:10004
- C:\Windows\System\wMqqeio.exe
  C:\Windows\System\wMqqeio.exe
  2⤵
  PID:10028
- C:\Windows\System\zSAWIai.exe
  C:\Windows\System\zSAWIai.exe
  2⤵
  PID:10068
- C:\Windows\System\AbkKKbb.exe
  C:\Windows\System\AbkKKbb.exe
  2⤵
  PID:10040
- C:\Windows\System\yDYkGmC.exe
  C:\Windows\System\yDYkGmC.exe
  2⤵
  PID:10072
- C:\Windows\System\RKKtlwp.exe
  C:\Windows\System\RKKtlwp.exe
  2⤵
  PID:10120
- C:\Windows\System\tQOIpuD.exe
  C:\Windows\System\tQOIpuD.exe
  2⤵
  PID:10128
- C:\Windows\System\rrslFPD.exe
  C:\Windows\System\rrslFPD.exe
  2⤵
  PID:10144
- C:\Windows\System\hOHrWgi.exe
  C:\Windows\System\hOHrWgi.exe
  2⤵
  PID:9448
- C:\Windows\System\YtycUJz.exe
  C:\Windows\System\YtycUJz.exe
  2⤵
  PID:10176
- C:\Windows\System\tTqlpkV.exe
  C:\Windows\System\tTqlpkV.exe
  2⤵
  PID:9876
- C:\Windows\System\mHTubtV.exe
  C:\Windows\System\mHTubtV.exe
  2⤵
  PID:9340
- C:\Windows\System\ERZfbci.exe
  C:\Windows\System\ERZfbci.exe
  2⤵
  PID:9520
- C:\Windows\System\GoGwOku.exe
  C:\Windows\System\GoGwOku.exe
  2⤵
  PID:9944
- C:\Windows\System\BgeZlFe.exe
  C:\Windows\System\BgeZlFe.exe
  2⤵
  PID:9784
- C:\Windows\System\VUrctki.exe
  C:\Windows\System\VUrctki.exe
  2⤵
  PID:9660
- C:\Windows\System\PdcWKJw.exe
  C:\Windows\System\PdcWKJw.exe
  2⤵
  PID:9516
- C:\Windows\System\LheBMXD.exe
  C:\Windows\System\LheBMXD.exe
  2⤵
  PID:9588
- C:\Windows\System\tuKvLhX.exe
  C:\Windows\System\tuKvLhX.exe
  2⤵
  PID:9720
- C:\Windows\System\RLRAGnq.exe
  C:\Windows\System\RLRAGnq.exe
  2⤵
  PID:9384
- C:\Windows\System\bxMKmfm.exe
  C:\Windows\System\bxMKmfm.exe
  2⤵
  PID:10032
- C:\Windows\System\FSEkpmZ.exe
  C:\Windows\System\FSEkpmZ.exe
  2⤵
  PID:10160
- C:\Windows\System\ybfkSLE.exe
  C:\Windows\System\ybfkSLE.exe
  2⤵
  PID:9480
- C:\Windows\System\AdHGayz.exe
  C:\Windows\System\AdHGayz.exe
  2⤵
  PID:10252
- C:\Windows\System\rLUhdjW.exe
  C:\Windows\System\rLUhdjW.exe
  2⤵
  PID:10268
- C:\Windows\System\tDqlFGF.exe
  C:\Windows\System\tDqlFGF.exe
  2⤵
  PID:10292
- C:\Windows\System\aRGnqZy.exe
  C:\Windows\System\aRGnqZy.exe
  2⤵
  PID:10308
- C:\Windows\System\ZooWLUL.exe
  C:\Windows\System\ZooWLUL.exe
  2⤵
  PID:10324
- C:\Windows\System\xdWghWf.exe
  C:\Windows\System\xdWghWf.exe
  2⤵
  PID:10340
- C:\Windows\System\cHirNkv.exe
  C:\Windows\System\cHirNkv.exe
  2⤵
  PID:10356
- C:\Windows\System\hubwben.exe
  C:\Windows\System\hubwben.exe
  2⤵
  PID:10372
- C:\Windows\System\cmyMnTb.exe
  C:\Windows\System\cmyMnTb.exe
  2⤵
  PID:10388
- C:\Windows\System\qinUeaC.exe
  C:\Windows\System\qinUeaC.exe
  2⤵
  PID:10404
- C:\Windows\System\qVPPZoP.exe
  C:\Windows\System\qVPPZoP.exe
  2⤵
  PID:10420
- C:\Windows\System\xbXbxaK.exe
  C:\Windows\System\xbXbxaK.exe
  2⤵
  PID:10436
- C:\Windows\System\enCPGBJ.exe
  C:\Windows\System\enCPGBJ.exe
  2⤵
  PID:10452
- C:\Windows\System\QRRgYpv.exe
  C:\Windows\System\QRRgYpv.exe
  2⤵
  PID:10468
- C:\Windows\System\uhuNQup.exe
  C:\Windows\System\uhuNQup.exe
  2⤵
  PID:10484
- C:\Windows\System\eXONnqr.exe
  C:\Windows\System\eXONnqr.exe
  2⤵
  PID:10500
- C:\Windows\System\gEYeYka.exe
  C:\Windows\System\gEYeYka.exe
  2⤵
  PID:10516
- C:\Windows\System\xOdqQSX.exe
  C:\Windows\System\xOdqQSX.exe
  2⤵
  PID:10532
- C:\Windows\System\FMzOkFg.exe
  C:\Windows\System\FMzOkFg.exe
  2⤵
  PID:10548
- C:\Windows\System\WiIpOcM.exe
  C:\Windows\System\WiIpOcM.exe
  2⤵
  PID:10564
- C:\Windows\System\hhCMaor.exe
  C:\Windows\System\hhCMaor.exe
  2⤵
  PID:10580
- C:\Windows\System\STqLiRW.exe
  C:\Windows\System\STqLiRW.exe
  2⤵
  PID:10596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AUrcYGU.exe

Filesize
1.6MB

MD5
d307bcc579e07ad5afada8134dd6b8a0

SHA1
f9920cb3ffc55409715aafdd23aabe126b91f310

SHA256
7d92658d4993eb47ac8e537f1880755c5399d2e6b97f388a133496fd94c5008a

SHA512
a973bfa3eff7a5f218a79627794941af3f08accce0dc1b3b135bca0be5fb7c91482de84e2296f58e79455058ba7e0a9fc6c43440767a5bbbb66cd5dfdefbf50e

Download Submit
C:\Windows\system\DCMccsD.exe

Filesize
1.6MB

MD5
3f375c4f05bde473f7d048c2f67c81f7

SHA1
099dd1db4ad39c0634d5cf508169e467279415d1

SHA256
564bfe6f129af9221388dd090ec9767576abf64953944868a52615e1e1876179

SHA512
1196f5dcd3a5c15308e241cf15f653e1c2b34413d954af7d306082df292b6b360de64f168275502797f2baa6f024d79075c2f6231a62bb0c33745f6667e07baf

Download Submit
C:\Windows\system\ECstBIO.exe

Filesize
1.6MB

MD5
71d4665961df120516ca02df1d671aaf

SHA1
cf0082b3da82ea0f337d37b890d641d62d2fc87d

SHA256
e73fa4c3a6131984b1725313f6a50e2109aa123bdd25d0d2e6f2c512f2d09df5

SHA512
831883e32a65929475392f41bf8387c36e3995fae2fab9327a9e04d995f6ba75505a938280123b56c39c61dfac97da14e1fabf4a6e8dacf29810ec692663674a

Download Submit
C:\Windows\system\FTnywVZ.exe

Filesize
1.6MB

MD5
b4145d9231dd01820535d67b84358af3

SHA1
1a951438d2c1b7a515d5fe951a01b5e96d45cdf2

SHA256
93b0f65406c916491a45320ad447a05fe7c0cef1cebf3ef5330ce597302d2c3b

SHA512
6172c8633a9c63f9a0985e8433652c7eea3d96008ec935ec754484816053e308c9e25169f55ca60276de4f5ae1b9579f0656ab94446f8b8e289343460bbed3f5

Download Submit
C:\Windows\system\IMoYIxD.exe

Filesize
1.6MB

MD5
512007ca51b1215238e37e40cf7f3ce0

SHA1
8adf4f1ea4567e7d4621d6605b1dc13af47a7f13

SHA256
b2cccb144d7eb5974125fff631fc4f2d641ef8094255da7a4ee44e27b6801850

SHA512
401577af340a511edc39f43ea090ed75195af13cddc5bd4839eee92e29b900c2f3f392b103cceb545a57dbcc8294521a2de323e7db39f6e1cc68b6d005077c38

Download Submit
C:\Windows\system\KrlchRp.exe

Filesize
1.6MB

MD5
40be2fdc2afbcdc9515c675313e26d81

SHA1
ecac37830d123358f4b31475a3910800090ed7e1

SHA256
ae0d5ecef0c52aefa3327a1f8a5042492a75bc4c3cf0d576c8dcac8d6b220e61

SHA512
9c38c0b17c9d7d26068c1b8067990094d510961af9624d1385702ef7633d3ea4077ef36fbde1e6ab0cfd305a3999e264ff0ec81d20a37d63d1e921a6199942aa

Download Submit
C:\Windows\system\KsuzJKc.exe

Filesize
1.6MB

MD5
b5d30163074592dde25c4408bc85e60a

SHA1
6e5e1970b339c884aeb6e968d73a6c4899ceffdf

SHA256
078192804d069c76b9e26e68bcfe8dc322155cb300b0743f93047ac210e2757a

SHA512
b857479a49f80644bd3eb86650fc1fb97f1bcb708ab0a74d14df45e86cd614ce136811e4032a620133c8d02c0be218e92874a85ddaa7c2c78600e6e2f8e0130a

Download Submit
C:\Windows\system\OYNLbbK.exe

Filesize
1.6MB

MD5
445582867d6520a579458e93c5e8be43

SHA1
c155d2069029088e98b716d2aa61259f2687b77e

SHA256
085963884cf86eb91b0325d0c007933b8cc0ee980d268cdd3e1d8c55892f00cf

SHA512
f8e58dbd7e99102ca8a2c63806c95ad277f05d9f39963d5b7fadc7f2aa3e9f577d67189a7f18c72c239f15d5aefe09f64f629a71d39a5848ef04edc28461fba7

Download Submit
C:\Windows\system\TeQfWYc.exe

Filesize
1.6MB

MD5
7ef555d865d91a618e4e4fcae47e6d5b

SHA1
8a3faad50e6eee8239a1b1bbe6d756660dc795e8

SHA256
312d8d566f847974833f6178f1cf4a1b5f1e0f9ebe51eda972ad745741001bf9

SHA512
f191f9c5a1251015b4076b2309e9668bf86ab833982e74eff39a7166d8b7065c90b757828c782fc2b03afe7654b48ab5d326e391b1f32444fce916f0eaf18287

Download Submit
C:\Windows\system\UMmJtPr.exe

Filesize
1.6MB

MD5
0fd804227000ad8fd4394c028837cc18

SHA1
7f1b3da809740e277f8da383ee3693c512604394

SHA256
05ab84177c923d9359d0bcd17de6caac4e5c059dd74ae041827bb175e60aad88

SHA512
7cf1fb43654f75008b0e9146e5e6cdc2dd37a44941338f60cd52a065c067a07feab507c9ff8563a721021558b76026449916e02a8bcd5644373fe6bd6e623966

Download Submit
C:\Windows\system\VXVpRfp.exe

Filesize
1.6MB

MD5
f2a50a2a506399f233f34fd60ba1e3c2

SHA1
d51c726cca98ae53ffe3322423de1137e2c00262

SHA256
dce3a47cbfb61d5f8bd1a95441b76f7af5a166fde4dbdad9f4a435421dd0c025

SHA512
77296c1e04035d9a1cd9d85799f02c000d450c10367e780fad285eebbd525ff7ae129465b8bb7192035ecc3e0108a9fe58f575a845afad0d845faa63c09f3e4e

Download Submit
C:\Windows\system\gxrfjKD.exe

Filesize
1.6MB

MD5
8e5ba4af35e1761160bf4f93b0124e04

SHA1
033a09a4a2fc903d1148e83d1aec2ed328961957

SHA256
ad064071b2f1b9cd19faff55107b4c8271dc278d24fc337b788f2e6cf2f6e51d

SHA512
8effc860a0690bc8450e47c498210a3dbfdb1a2a7969b2212955f07e735a6667ba6875bcaa65e9c723efcb154ef846a8ad7d4bdb4ce701fb4c75009d85d9c608

Download Submit
C:\Windows\system\iiMUBGs.exe

Filesize
1.6MB

MD5
486b1710e08dde35f39196583ae36e9d

SHA1
001514fafcfba5e1b6f7c06bc83d629683698e12

SHA256
1a810cf524520e43e79343cb3040ec059a56d871b88a817b418c4212455f399a

SHA512
5d0b0d30e662b7b05cc08e7be8e478478b7654b47a8ac607bb95c55a50d3c8e2cbb063e4fbed939a098bd1056b3008b897ea11d79ec70eb5be15322e900a9223

Download Submit
C:\Windows\system\jPUayve.exe

Filesize
1.6MB

MD5
4cf686bbc2b3c0efd1962bc0596e168b

SHA1
14d6368a3520a274630887e7eeb8746ad84db0b1

SHA256
58033099227b4afbffe19cbaf2c0ad4caf3fd4576b59dc84fbb9ffa501e28d30

SHA512
81bfffc53d7c1fdd23faa63706526d3bfbc1f2626cecc132c8446188dbb0f30096917816087fd46ad3d6c31419d29fe10d2b4830c390871c4f36e61c8fc1c909

Download Submit
C:\Windows\system\jpRjoHe.exe

Filesize
1.6MB

MD5
94a3d6614d1701d7c48d9fa21f9a4ffd

SHA1
2e378073eca0662f746775b23bafeeb11cc13f8e

SHA256
e9b56800f3e0fa9e3cdf2eca7fc8010798212a424041768694ac5eadd32701fe

SHA512
fb47185b44c0b250e834b3a9c822799ee8d9ccb67ce19c972e6d93045ea2bfb64b5e9fafbafb96495f14573e73dbe967bb2b3aad0543353177517ba45013a17e

Download Submit
C:\Windows\system\kaqGjVt.exe

Filesize
1.6MB

MD5
d4c424b4739e61fc87630be9ed787246

SHA1
68ce56d0628720e4b9baf56c075ce364fa6a6265

SHA256
5c5e0fd58eadc67ad8fb13f6340f85ed5ae542c26068ff56dcc23076af6f34a9

SHA512
da3542654aa5f0acd1273ef9d072ce754bc3cd953876cab96ad707644cdf0171972728d5c5a9f3d4d3ca96ee751fc45f52e4c7d70e857b0b1ef5f71e5ace67c2

Download Submit
C:\Windows\system\lFtnarK.exe

Filesize
1.6MB

MD5
cba8b14b800feec22c2047908aa492d0

SHA1
b3eddab87007b1ae45f9909066028f6838712ce7

SHA256
9fecb40ffd876e646e5f2c4b7d0e751b26d76df03e9543150e41c11090f5760f

SHA512
0d6cf9af10e5edb935bfb48e5baa861ecfa0eef37de883a2d3b01351804bd7670b8dee08a09c37b320347e830a5af5b58d39f0df5cc50ec6497f38c7ea739adf

Download Submit
C:\Windows\system\qRvkKBx.exe

Filesize
1.6MB

MD5
db6fec7f64d205a87832c48314ff0d4c

SHA1
dd1334f67490768499a0ddc96aa3b07a65b780b4

SHA256
3dd1008b0cf21611c85a1b4b73ad226e68f934d17c51315179bb2cc45071e80d

SHA512
47acbfdd48fdf5d031d0f3f9a488a7b833e94dc91400818be90080ae2d53280c00abf4dec07a5d751890e11f4be30ea4eea159a1775ec327db99080f7cf55f5b

Download Submit
C:\Windows\system\uPsOejp.exe

Filesize
1.6MB

MD5
472cb18e5b9f1bd8bd85ac9e35faa23f

SHA1
f5c63a795390d526025398b4d68f00e24bb51355

SHA256
350619bce9dbb9ec0ed28ee9788d0d93651cfb710ba4acec85d79fc940733dcd

SHA512
bdeef1cfde5a17a8ba5bff7d9f9824025035513dec4d248103d72f0308fe27b8c9ee1c214aa07fef1598792c8de360e5ceea4f1f83f2b4c27551ab35cfc59a97

Download Submit
C:\Windows\system\uiGxmQK.exe

Filesize
1.6MB

MD5
a7628d5bf632e1136f8a6a80bf5d8bbd

SHA1
d4a90555b94eab7ebe2755ed86d1f15816e67f9b

SHA256
bacb1f22edd8b6bd8292e785d3ef7f2cf5860f02d666e0c74a78080d467cf4cb

SHA512
79ec864625a479f28ea8e28f94e23ba0d9d2c210bb78b2fd02651c0ae26182e63bfa96990151b3e7e950161cc8e7442440610f157b7c00e44b3285a4d4a7b23e

Download Submit
C:\Windows\system\wZvSyID.exe

Filesize
1.6MB

MD5
40ef8614203fd74a38d720b95baa8b3d

SHA1
17041390531508d9abdf9fc940bdf51e8fa7ab95

SHA256
693d77157d2abc9332004b746260f936cec989a872ec5a197f4662d678b8078a

SHA512
1599ad1b3c7e4087e19db345f88b732f9c9a7ec26b50ff13afa5a4a2a308359a690933b95e7f36eeeec176edbf9e827a98b0d13387094024d074e520be55016a

Download Submit
C:\Windows\system\xfpEFnF.exe

Filesize
1.6MB

MD5
3df5af7df0b3850267b9f52871f291a5

SHA1
6f4ccbe5bed1d9d357462381649fd2c5d4cdf7d4

SHA256
706d0fc5494aeede1afbe0583e6f865a0329c19502e33d57ef4284a08d27373e

SHA512
01a908cb2121d8953f03b90f496caaf55bdee97f9df9069ae5f2d4e3543d20c3dd7cf45fb645e9920d0113903e2d12dd3dd05b9702edce256d2586dcd7fd4030

Download Submit
C:\Windows\system\xlhhEVq.exe

Filesize
1.6MB

MD5
53ae934a9630949dfc6df20d7b5d6822

SHA1
43fc99b32a5b4a8abb9cced957767b1e5e09d636

SHA256
2dcf8047ffb17789fe5ba317bf67d29f93f9c7c483b4e6638d55485e01d0500a

SHA512
6075cab23eb1c811a04d88fc49b2a159a95d3231fd191083beb4a9e1ea5ce6d74d4667ded2caa01eb43b1211090eac2a28d7b0c87f355f3cc331e6d5e59b88b5

Download Submit
\Windows\system\LRzxLMY.exe

Filesize
1.6MB

MD5
e1b7a97d41141b91a45bd91f1957d1bd

SHA1
b9b7839a1aa55130d172e37321674f1ec51d882f

SHA256
73da3d3ac1f67447267e728224235fb0f2a0effc24436008a0c8330caaa747f2

SHA512
95a676c181c2b24b377002d49c893244ff654587a35e545ff4b65952ed85a0dadcc0dd8b75ad3d0b3b9453a8cf4522b983dbf599908ce06502279d469e4aba1d

Download Submit
\Windows\system\NXGVvLz.exe

Filesize
1.6MB

MD5
1098ef64a745553457761ba9e4c6b063

SHA1
ff937626774f4d830ddfa2c86556624fe59dd8c1

SHA256
6a63ef27e48c173a802be39bb95440cc47512aa84fa1b19650b737e6c05b2109

SHA512
7d21d93f5ffd08907724ae51a1bebe6dec8973c4006d3e924617344dc1b2003a9d80e937a94a88d2f2a095e0a5967e70642503b39c406f37dc3559623099349e

Download Submit
\Windows\system\Oecuele.exe

Filesize
1.6MB

MD5
cae521b89aa663fbd5aeaf3170fdd3e5

SHA1
a57859fc2ba2879f811367153b261109d80be8e9

SHA256
35a730d25ddd15f3d3e36032f41620732a3cc8423978370b4e56cd63cafa52d2

SHA512
18098e71d2f30269d455ded24fc1233302dec9d7d96577fdf61f6f58aecdd456eb1b2d67aba7ff631158a9f29361a0c644058c5adeda039efdf90bf283d5cb58

Download Submit
\Windows\system\PkRjQPP.exe

Filesize
1.6MB

MD5
9c9f4379ad93ac5c506cde6d60ea7fff

SHA1
73b7f30ad1d9b4868a9bcb31e51257df8598b75b

SHA256
de72388f379913cdcf25b3164eeec071993ff8ae5fd0e954e9aec0bc99f40b5e

SHA512
7d22ac76489ca70636e8ec5d4f6d7626b980dff17230306f7c2ba9b69a1620487f108b387c09ae2c6d0bb07bc10052a3cf9b1a99a6354f36c7190e4dde030040

Download Submit
\Windows\system\PlQQVNR.exe

Filesize
1.6MB

MD5
f41d93a1ca40101a5cdbd2e4e4c4afd0

SHA1
ff72091066c72ed1e381c55e304e97feae9d7465

SHA256
f82dbecc30e04f4ada900d0f190ec7f130c78148d8c9dacb1268bfe29f8ff12f

SHA512
3572993f9051485dc826155550b68521ac03d3e140fbb72653c2ad5b970c9b2856f2b1f3c76c432d7feffa8d47132780fc425584279976aa0f4089d4c22889a8

Download Submit
\Windows\system\QKiJSbq.exe

Filesize
1.6MB

MD5
3f4ff76c437a0bcd13c0344e0b49e132

SHA1
77d9311af6cb8e087f797a6b48e1194a76479e6e

SHA256
23922398cb9a851cbc79808ce1b7aea47e20f84480d67d47fe6c52c5bb3f5e0e

SHA512
4306965657a48fad147f94180b00acd5e993b0e49ca2096df0d954f87e43e6fbdcb298a44e72cbbac6ae4cf204e6f7304bec493dd12c927b6a7a7e29ac76d9ad

Download Submit
\Windows\system\akKBxGo.exe

Filesize
1.6MB

MD5
1c78015ff92a4a259ddd445087941601

SHA1
826aadd3055ee20fcd9dfc6868d854db300e1e2b

SHA256
5196ad831fe4a8c0fd02c665f65797df38900d6672d443c7a9db9da20034da1a

SHA512
45c242c43b9815b81fc6c444787b9c4264157c7cb529d6074582caafadee97b4839be2a68800d95b8557931d327a67b7583de22458968ccc673ab09869d27329

Download Submit
\Windows\system\isaCanX.exe

Filesize
1.6MB

MD5
f60eee58c29b382eab42711b81537ab4

SHA1
c6882ed9035676bf99fabdf1396a47c48a085a61

SHA256
4ecc35c3c0a6b4b63658ff2cddbf8694eaf7dfd29ec759102a8a24b8677be249

SHA512
34ed4abf4df7c705b94f454994d4e777dc1e0d8826c1455389f8ca1eba99021df2a5cd014a92ba86daae371c7424c4ffb93ad73080c2c90089a68c5756aea722

Download Submit
\Windows\system\uUotfLY.exe

Filesize
1.6MB

MD5
cd7ad9afa73766b1c21cbba4ac792785

SHA1
f308931a43513bcb7536bccf2de73f06404d9c19

SHA256
9fa1bf99283d00dbf14b9e8cea9457cec6d411d4c8e9579d1f24916cb74f01d7

SHA512
b6420eab0f7e2250098dd4178ac4bd38cf6010f5efc906c497e2b121b476f7cda2b65dd07c595e56fc5375723fb53c4c764aa42aa7e338dedb99cd2b27f60304

Download Submit
memory/1376-1599-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/1376-942-0x0000000002530000-0x00000000025B0000-memory.dmp

Filesize
512KB

Download
memory/1376-57-0x0000000002530000-0x00000000025B0000-memory.dmp

Filesize
512KB

Download
memory/1376-801-0x000000001B300000-0x000000001B5E2000-memory.dmp

Filesize
2.9MB

Download
memory/1408-9-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/1408-3170-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/1584-3216-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/1584-1303-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/1584-119-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/1788-75-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/1788-118-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1788-102-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1788-120-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/1788-56-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/1788-87-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/1788-0-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/1788-52-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/1788-54-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/1788-58-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1788-260-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/1788-48-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/1788-8-0x0000000002BA0000-0x0000000002F92000-memory.dmp

Filesize
3.9MB

Download
memory/1788-43-0x0000000002BA0000-0x0000000002F92000-memory.dmp

Filesize
3.9MB

Download
memory/1788-34-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/1788-1218-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1788-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1788-944-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2360-53-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-3215-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-1027-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2580-3217-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2580-80-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2676-3214-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2676-51-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2716-55-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2716-3161-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2860-23-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2860-270-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2860-3169-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2960-951-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-2863-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-3168-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/3028-49-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download