xmrig | 7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
Size

1.7MB
MD5

722f79091b76c870529ba6c8be413850
SHA1

c5fae78f34784674cee7d34891cc7fee3cd93f85
SHA256

7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811d
SHA512

110e5e081e4c29f3c52ce8398fd86d4e34ef4db22b3faf0b3f08cca33e24142318423d19ad10abbb0babf74d20864830546d036877f9b69905c3938eef547793
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwV0LV+:Lz071uv4BPMkFfdg6NsIRSwVW+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2820-333-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2112-332-0x000000013FD20000-0x0000000140112000-memory.dmp	xmrig
behavioral1/memory/2780-331-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/1320-82-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2884-81-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2628-80-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2648-71-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2824-65-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2816-41-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/1972-965-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2588-1452-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/1932-1454-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/1932-4286-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/1320-4307-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2780-4305-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2820-4326-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2112-4324-0x000000013FD20000-0x0000000140112000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2696	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2588	oDbTlRw.exe
1932	gieFvDZ.exe
2816	CEQqiTQ.exe
2824	BjroAEy.exe
2648	JeRQEcF.exe
2780	wLgvaNB.exe
2628	vpIeazV.exe
2884	OSgRjTB.exe
1320	uxmdoMK.exe
2112	AQtazqP.exe
2820	PENugUB.exe
2164	gRFtiRN.exe
2684	MIoOQbP.exe
2952	ftJolWS.exe
2712	BaRGpMc.exe
920	lLHtlGj.exe
2796	ITjaxTG.exe
1728	WmbCAow.exe
820	uIWeaWR.exe
2920	AwqLOdD.exe
1816	szPQiAq.exe
1632	PQXuJPG.exe
1624	xXgpTKd.exe
2924	ojrhIXl.exe
2972	gkQQSag.exe
668	iHgaXYQ.exe
1888	TxowLuM.exe
2272	bcEJRla.exe
712	UDAOQPp.exe
628	tcsqlcg.exe
284	LGgDJTp.exe
1808	UCTaSZi.exe
1948	pcYKiPJ.exe
1692	RwmVEwk.exe
912	ySVUdmd.exe
956	psWoMwh.exe
2292	VRVhlhk.exe
2492	pvRFqeS.exe
3056	CyWWsgJ.exe
1672	jIQZFoF.exe
1068	pYQEHEA.exe
2244	dDgMsBo.exe
1784	uXIkXYq.exe
3068	zitUTBy.exe
1492	DYROgQy.exe
1032	MvbyjNX.exe
1944	ZBGQeGn.exe
1700	EtGRCJc.exe
1572	tjBbYkj.exe
2156	JSMbhgm.exe
2356	JWAmRNO.exe
2960	VSEKKhG.exe
2876	YFhdRqA.exe
996	joaYxqt.exe
2728	cYTjzIO.exe
2660	kGUbNfp.exe
2936	ZmWIgis.exe
2032	euGryLz.exe
2624	XpBamzJ.exe
2948	VWkqYus.exe
608	ioMDWdF.exe
2672	nCztpMV.exe
1840	EIRLlcc.exe
1756	LzAGAYs.exe

Loads dropped DLL 64 IoCs

pid	Process
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1972-0-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/files/0x00090000000120ce-3.dat	upx
behavioral1/memory/2588-9-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/files/0x0007000000004e74-18.dat	upx
behavioral1/files/0x0008000000016d36-17.dat	upx
behavioral1/files/0x0009000000016dd9-83.dat	upx
behavioral1/files/0x0005000000018731-50.dat	upx
behavioral1/files/0x0006000000018bf3-91.dat	upx
behavioral1/files/0x000500000001922c-102.dat	upx
behavioral1/files/0x0005000000019261-112.dat	upx
behavioral1/files/0x0005000000019379-137.dat	upx
behavioral1/files/0x00050000000193ac-152.dat	upx
behavioral1/files/0x000500000001945c-172.dat	upx
behavioral1/memory/2820-333-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2112-332-0x000000013FD20000-0x0000000140112000-memory.dmp	upx
behavioral1/memory/2780-331-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/files/0x0005000000019496-183.dat	upx
behavioral1/files/0x0005000000019438-162.dat	upx
behavioral1/files/0x0005000000019467-176.dat	upx
behavioral1/files/0x0005000000019456-167.dat	upx
behavioral1/files/0x000500000001942c-156.dat	upx
behavioral1/files/0x000500000001939d-142.dat	upx
behavioral1/files/0x00050000000193a4-147.dat	upx
behavioral1/files/0x00050000000192a9-132.dat	upx
behavioral1/files/0x0005000000019284-127.dat	upx
behavioral1/files/0x0005000000019279-122.dat	upx
behavioral1/files/0x000500000001926a-117.dat	upx
behavioral1/files/0x000500000001925e-107.dat	upx
behavioral1/files/0x0005000000018781-56.dat	upx
behavioral1/files/0x0005000000019227-96.dat	upx
behavioral1/files/0x0007000000016d6d-46.dat	upx
behavioral1/files/0x0007000000016d63-45.dat	upx
behavioral1/memory/1320-82-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2884-81-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2628-80-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/files/0x0007000000016d69-78.dat	upx
behavioral1/memory/2648-71-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/files/0x000500000001878c-69.dat	upx
behavioral1/files/0x0009000000016d47-68.dat	upx
behavioral1/files/0x0005000000018742-67.dat	upx
behavioral1/files/0x00050000000186f8-66.dat	upx
behavioral1/memory/2824-65-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/1932-27-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2816-41-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/memory/1972-965-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/2588-1452-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/1932-1454-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/1932-4286-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/1320-4307-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2780-4305-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2820-4326-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2112-4324-0x000000013FD20000-0x0000000140112000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mDtQbIJ.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\BoCLAKz.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\CWkmoRp.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\wvGYXet.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\sGrkQQW.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\ntSJwZP.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\nerHxlr.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\saRqVLe.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\jJwnxiT.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\oPLpjjT.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\izcLSXy.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\zdFZkEn.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\XiwRtCt.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\DkyDfae.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\AFmdmPe.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\AelCukx.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\eRrczAY.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\gvWljIl.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\LPUMdxe.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\fSdqSEc.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\ZnLNDRX.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\ymzQgCd.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\wUeIyqH.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\bZEmZpb.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\LzOfSmA.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\TbbIyMo.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\jAPVmRE.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\WoiXFov.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\aJKzRZo.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\IgkeZzn.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\DxrbFfx.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\RcDcACt.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\FdOijSf.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\PZlUljq.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\GLxBhiv.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\gPeDuDQ.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\zEmHbjZ.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\KuwVFjD.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\TGdPJll.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\pRYuPWM.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\JcuLqBo.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\tcEjBBp.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\HjASCgp.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\NOdEcFS.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\pfxyESJ.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\aNmUjoV.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\JZHeIla.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\yfBrcCj.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\GSHeRRP.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\HMKTIbu.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\VAYNkLg.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\RPdocbs.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\vQFKEso.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\QwFAmsE.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\XZacgNn.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\OgjFsNK.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\LbSiswP.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\QVydLEQ.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\hEkBPOP.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\SFhJqMc.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\LCngcxb.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\YmYFCSU.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\mlnTPAv.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
File created	C:\Windows\System\TwvqZWD.exe	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2696	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
Token: SeLockMemoryPrivilege	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
Token: SeDebugPrivilege	2696	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2696	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	31
PID 1972 wrote to memory of 2696	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	31
PID 1972 wrote to memory of 2696	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	31
PID 1972 wrote to memory of 2588	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	32
PID 1972 wrote to memory of 2588	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	32
PID 1972 wrote to memory of 2588	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	32
PID 1972 wrote to memory of 1932	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	33
PID 1972 wrote to memory of 1932	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	33
PID 1972 wrote to memory of 1932	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	33
PID 1972 wrote to memory of 2816	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	34
PID 1972 wrote to memory of 2816	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	34
PID 1972 wrote to memory of 2816	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	34
PID 1972 wrote to memory of 2884	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	35
PID 1972 wrote to memory of 2884	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	35
PID 1972 wrote to memory of 2884	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	35
PID 1972 wrote to memory of 2824	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	36
PID 1972 wrote to memory of 2824	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	36
PID 1972 wrote to memory of 2824	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	36
PID 1972 wrote to memory of 2112	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	37
PID 1972 wrote to memory of 2112	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	37
PID 1972 wrote to memory of 2112	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	37
PID 1972 wrote to memory of 2648	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	38
PID 1972 wrote to memory of 2648	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	38
PID 1972 wrote to memory of 2648	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	38
PID 1972 wrote to memory of 2820	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	39
PID 1972 wrote to memory of 2820	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	39
PID 1972 wrote to memory of 2820	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	39
PID 1972 wrote to memory of 2780	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	40
PID 1972 wrote to memory of 2780	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	40
PID 1972 wrote to memory of 2780	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	40
PID 1972 wrote to memory of 2164	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	41
PID 1972 wrote to memory of 2164	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	41
PID 1972 wrote to memory of 2164	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	41
PID 1972 wrote to memory of 2628	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	42
PID 1972 wrote to memory of 2628	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	42
PID 1972 wrote to memory of 2628	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	42
PID 1972 wrote to memory of 2684	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	43
PID 1972 wrote to memory of 2684	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	43
PID 1972 wrote to memory of 2684	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	43
PID 1972 wrote to memory of 1320	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	44
PID 1972 wrote to memory of 1320	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	44
PID 1972 wrote to memory of 1320	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	44
PID 1972 wrote to memory of 2952	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	45
PID 1972 wrote to memory of 2952	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	45
PID 1972 wrote to memory of 2952	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	45
PID 1972 wrote to memory of 2712	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	46
PID 1972 wrote to memory of 2712	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	46
PID 1972 wrote to memory of 2712	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	46
PID 1972 wrote to memory of 920	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	47
PID 1972 wrote to memory of 920	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	47
PID 1972 wrote to memory of 920	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	47
PID 1972 wrote to memory of 2796	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	48
PID 1972 wrote to memory of 2796	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	48
PID 1972 wrote to memory of 2796	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	48
PID 1972 wrote to memory of 1728	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	49
PID 1972 wrote to memory of 1728	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	49
PID 1972 wrote to memory of 1728	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	49
PID 1972 wrote to memory of 820	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	50
PID 1972 wrote to memory of 820	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	50
PID 1972 wrote to memory of 820	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	50
PID 1972 wrote to memory of 2920	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	51
PID 1972 wrote to memory of 2920	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	51
PID 1972 wrote to memory of 2920	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	51
PID 1972 wrote to memory of 1816	1972	7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe	52

C:\Users\Admin\AppData\Local\Temp\7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe
"C:\Users\Admin\AppData\Local\Temp\7def3327f8dc101eb9bbd463be99e296a5ac7b166fcf4da3dec29b1205a0811dN.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\System\oDbTlRw.exe
  C:\Windows\System\oDbTlRw.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\gieFvDZ.exe
  C:\Windows\System\gieFvDZ.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\CEQqiTQ.exe
  C:\Windows\System\CEQqiTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\OSgRjTB.exe
  C:\Windows\System\OSgRjTB.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\BjroAEy.exe
  C:\Windows\System\BjroAEy.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\AQtazqP.exe
  C:\Windows\System\AQtazqP.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\JeRQEcF.exe
  C:\Windows\System\JeRQEcF.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\PENugUB.exe
  C:\Windows\System\PENugUB.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\wLgvaNB.exe
  C:\Windows\System\wLgvaNB.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\gRFtiRN.exe
  C:\Windows\System\gRFtiRN.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\vpIeazV.exe
  C:\Windows\System\vpIeazV.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\MIoOQbP.exe
  C:\Windows\System\MIoOQbP.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\uxmdoMK.exe
  C:\Windows\System\uxmdoMK.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\ftJolWS.exe
  C:\Windows\System\ftJolWS.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\BaRGpMc.exe
  C:\Windows\System\BaRGpMc.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\lLHtlGj.exe
  C:\Windows\System\lLHtlGj.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\ITjaxTG.exe
  C:\Windows\System\ITjaxTG.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\WmbCAow.exe
  C:\Windows\System\WmbCAow.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\uIWeaWR.exe
  C:\Windows\System\uIWeaWR.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\AwqLOdD.exe
  C:\Windows\System\AwqLOdD.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\szPQiAq.exe
  C:\Windows\System\szPQiAq.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\PQXuJPG.exe
  C:\Windows\System\PQXuJPG.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\xXgpTKd.exe
  C:\Windows\System\xXgpTKd.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\ojrhIXl.exe
  C:\Windows\System\ojrhIXl.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\gkQQSag.exe
  C:\Windows\System\gkQQSag.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\iHgaXYQ.exe
  C:\Windows\System\iHgaXYQ.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\TxowLuM.exe
  C:\Windows\System\TxowLuM.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\bcEJRla.exe
  C:\Windows\System\bcEJRla.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\UDAOQPp.exe
  C:\Windows\System\UDAOQPp.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\tcsqlcg.exe
  C:\Windows\System\tcsqlcg.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\LGgDJTp.exe
  C:\Windows\System\LGgDJTp.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\UCTaSZi.exe
  C:\Windows\System\UCTaSZi.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\pcYKiPJ.exe
  C:\Windows\System\pcYKiPJ.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\RwmVEwk.exe
  C:\Windows\System\RwmVEwk.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\ySVUdmd.exe
  C:\Windows\System\ySVUdmd.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\psWoMwh.exe
  C:\Windows\System\psWoMwh.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\VRVhlhk.exe
  C:\Windows\System\VRVhlhk.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\pvRFqeS.exe
  C:\Windows\System\pvRFqeS.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\CyWWsgJ.exe
  C:\Windows\System\CyWWsgJ.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\jIQZFoF.exe
  C:\Windows\System\jIQZFoF.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\pYQEHEA.exe
  C:\Windows\System\pYQEHEA.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\dDgMsBo.exe
  C:\Windows\System\dDgMsBo.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\uXIkXYq.exe
  C:\Windows\System\uXIkXYq.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\zitUTBy.exe
  C:\Windows\System\zitUTBy.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\DYROgQy.exe
  C:\Windows\System\DYROgQy.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\MvbyjNX.exe
  C:\Windows\System\MvbyjNX.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\ZBGQeGn.exe
  C:\Windows\System\ZBGQeGn.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\EtGRCJc.exe
  C:\Windows\System\EtGRCJc.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\tjBbYkj.exe
  C:\Windows\System\tjBbYkj.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\JSMbhgm.exe
  C:\Windows\System\JSMbhgm.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\JWAmRNO.exe
  C:\Windows\System\JWAmRNO.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\YFhdRqA.exe
  C:\Windows\System\YFhdRqA.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\VSEKKhG.exe
  C:\Windows\System\VSEKKhG.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\kGUbNfp.exe
  C:\Windows\System\kGUbNfp.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\joaYxqt.exe
  C:\Windows\System\joaYxqt.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\ZmWIgis.exe
  C:\Windows\System\ZmWIgis.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\cYTjzIO.exe
  C:\Windows\System\cYTjzIO.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\XpBamzJ.exe
  C:\Windows\System\XpBamzJ.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\euGryLz.exe
  C:\Windows\System\euGryLz.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\VWkqYus.exe
  C:\Windows\System\VWkqYus.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\ioMDWdF.exe
  C:\Windows\System\ioMDWdF.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\nCztpMV.exe
  C:\Windows\System\nCztpMV.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\EIRLlcc.exe
  C:\Windows\System\EIRLlcc.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\wwtcpNS.exe
  C:\Windows\System\wwtcpNS.exe
  2⤵
  PID:2856
- C:\Windows\System\LzAGAYs.exe
  C:\Windows\System\LzAGAYs.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\uoUkBzD.exe
  C:\Windows\System\uoUkBzD.exe
  2⤵
  PID:2096
- C:\Windows\System\HyzceAl.exe
  C:\Windows\System\HyzceAl.exe
  2⤵
  PID:2788
- C:\Windows\System\SQXUNgG.exe
  C:\Windows\System\SQXUNgG.exe
  2⤵
  PID:1356
- C:\Windows\System\cJjNFEQ.exe
  C:\Windows\System\cJjNFEQ.exe
  2⤵
  PID:1332
- C:\Windows\System\nQHdNaS.exe
  C:\Windows\System\nQHdNaS.exe
  2⤵
  PID:3036
- C:\Windows\System\EcktYtt.exe
  C:\Windows\System\EcktYtt.exe
  2⤵
  PID:1252
- C:\Windows\System\lcmQThq.exe
  C:\Windows\System\lcmQThq.exe
  2⤵
  PID:1236
- C:\Windows\System\iFLyFvm.exe
  C:\Windows\System\iFLyFvm.exe
  2⤵
  PID:940
- C:\Windows\System\zJwiSkz.exe
  C:\Windows\System\zJwiSkz.exe
  2⤵
  PID:2364
- C:\Windows\System\ZLrTDIp.exe
  C:\Windows\System\ZLrTDIp.exe
  2⤵
  PID:2232
- C:\Windows\System\yFfiVQo.exe
  C:\Windows\System\yFfiVQo.exe
  2⤵
  PID:780
- C:\Windows\System\AFmdmPe.exe
  C:\Windows\System\AFmdmPe.exe
  2⤵
  PID:1028
- C:\Windows\System\oLwqujF.exe
  C:\Windows\System\oLwqujF.exe
  2⤵
  PID:1300
- C:\Windows\System\xcHuete.exe
  C:\Windows\System\xcHuete.exe
  2⤵
  PID:2300
- C:\Windows\System\kCmsjRV.exe
  C:\Windows\System\kCmsjRV.exe
  2⤵
  PID:2488
- C:\Windows\System\SWUEdFv.exe
  C:\Windows\System\SWUEdFv.exe
  2⤵
  PID:1600
- C:\Windows\System\CjzXaRy.exe
  C:\Windows\System\CjzXaRy.exe
  2⤵
  PID:1604
- C:\Windows\System\HcFMsxw.exe
  C:\Windows\System\HcFMsxw.exe
  2⤵
  PID:2748
- C:\Windows\System\hyVCXzY.exe
  C:\Windows\System\hyVCXzY.exe
  2⤵
  PID:2608
- C:\Windows\System\rDYXWGT.exe
  C:\Windows\System\rDYXWGT.exe
  2⤵
  PID:2840
- C:\Windows\System\hkZDMDf.exe
  C:\Windows\System\hkZDMDf.exe
  2⤵
  PID:2860
- C:\Windows\System\cQvCNuj.exe
  C:\Windows\System\cQvCNuj.exe
  2⤵
  PID:2940
- C:\Windows\System\PPWFHcz.exe
  C:\Windows\System\PPWFHcz.exe
  2⤵
  PID:1940
- C:\Windows\System\SKDLHPE.exe
  C:\Windows\System\SKDLHPE.exe
  2⤵
  PID:356
- C:\Windows\System\zklbDUg.exe
  C:\Windows\System\zklbDUg.exe
  2⤵
  PID:872
- C:\Windows\System\PvGNOMy.exe
  C:\Windows\System\PvGNOMy.exe
  2⤵
  PID:2916
- C:\Windows\System\OavdpCb.exe
  C:\Windows\System\OavdpCb.exe
  2⤵
  PID:2432
- C:\Windows\System\IGWIpRi.exe
  C:\Windows\System\IGWIpRi.exe
  2⤵
  PID:2980
- C:\Windows\System\COPvBGx.exe
  C:\Windows\System\COPvBGx.exe
  2⤵
  PID:2580
- C:\Windows\System\qjlEZXV.exe
  C:\Windows\System\qjlEZXV.exe
  2⤵
  PID:2964
- C:\Windows\System\sDjePLA.exe
  C:\Windows\System\sDjePLA.exe
  2⤵
  PID:2476
- C:\Windows\System\bTqParr.exe
  C:\Windows\System\bTqParr.exe
  2⤵
  PID:572
- C:\Windows\System\IXaIwCp.exe
  C:\Windows\System\IXaIwCp.exe
  2⤵
  PID:784
- C:\Windows\System\dcqZTZN.exe
  C:\Windows\System\dcqZTZN.exe
  2⤵
  PID:2700
- C:\Windows\System\liBxeGw.exe
  C:\Windows\System\liBxeGw.exe
  2⤵
  PID:2004
- C:\Windows\System\XdVLLUm.exe
  C:\Windows\System\XdVLLUm.exe
  2⤵
  PID:2812
- C:\Windows\System\cwzTtwm.exe
  C:\Windows\System\cwzTtwm.exe
  2⤵
  PID:2172
- C:\Windows\System\vSgsjXs.exe
  C:\Windows\System\vSgsjXs.exe
  2⤵
  PID:2912
- C:\Windows\System\ZJDaquY.exe
  C:\Windows\System\ZJDaquY.exe
  2⤵
  PID:316
- C:\Windows\System\RINrJMI.exe
  C:\Windows\System\RINrJMI.exe
  2⤵
  PID:1964
- C:\Windows\System\HOSHrUf.exe
  C:\Windows\System\HOSHrUf.exe
  2⤵
  PID:3008
- C:\Windows\System\rAPDZCb.exe
  C:\Windows\System\rAPDZCb.exe
  2⤵
  PID:888
- C:\Windows\System\fRLZfRe.exe
  C:\Windows\System\fRLZfRe.exe
  2⤵
  PID:2956
- C:\Windows\System\GVHxLZp.exe
  C:\Windows\System\GVHxLZp.exe
  2⤵
  PID:2152
- C:\Windows\System\fOokXFN.exe
  C:\Windows\System\fOokXFN.exe
  2⤵
  PID:2468
- C:\Windows\System\lfFGVUD.exe
  C:\Windows\System\lfFGVUD.exe
  2⤵
  PID:1248
- C:\Windows\System\SaFmocn.exe
  C:\Windows\System\SaFmocn.exe
  2⤵
  PID:2440
- C:\Windows\System\WtuzJzy.exe
  C:\Windows\System\WtuzJzy.exe
  2⤵
  PID:2196
- C:\Windows\System\ikhswmn.exe
  C:\Windows\System\ikhswmn.exe
  2⤵
  PID:2420
- C:\Windows\System\DCdbVev.exe
  C:\Windows\System\DCdbVev.exe
  2⤵
  PID:2716
- C:\Windows\System\RYxHvdK.exe
  C:\Windows\System\RYxHvdK.exe
  2⤵
  PID:2872
- C:\Windows\System\PUhSizM.exe
  C:\Windows\System\PUhSizM.exe
  2⤵
  PID:2760
- C:\Windows\System\yJqvKIL.exe
  C:\Windows\System\yJqvKIL.exe
  2⤵
  PID:332
- C:\Windows\System\QIotmiD.exe
  C:\Windows\System\QIotmiD.exe
  2⤵
  PID:2724
- C:\Windows\System\JHqXxgM.exe
  C:\Windows\System\JHqXxgM.exe
  2⤵
  PID:1536
- C:\Windows\System\cccqYcp.exe
  C:\Windows\System\cccqYcp.exe
  2⤵
  PID:2600
- C:\Windows\System\ToygvLl.exe
  C:\Windows\System\ToygvLl.exe
  2⤵
  PID:1636
- C:\Windows\System\NXcpVVp.exe
  C:\Windows\System\NXcpVVp.exe
  2⤵
  PID:2880
- C:\Windows\System\OZyGLKD.exe
  C:\Windows\System\OZyGLKD.exe
  2⤵
  PID:2008
- C:\Windows\System\DFTtRGs.exe
  C:\Windows\System\DFTtRGs.exe
  2⤵
  PID:3040
- C:\Windows\System\CWkmoRp.exe
  C:\Windows\System\CWkmoRp.exe
  2⤵
  PID:1164
- C:\Windows\System\nhwbtly.exe
  C:\Windows\System\nhwbtly.exe
  2⤵
  PID:1676
- C:\Windows\System\cAlarjo.exe
  C:\Windows\System\cAlarjo.exe
  2⤵
  PID:1548
- C:\Windows\System\BKyyMcP.exe
  C:\Windows\System\BKyyMcP.exe
  2⤵
  PID:1052
- C:\Windows\System\jDFWnMu.exe
  C:\Windows\System\jDFWnMu.exe
  2⤵
  PID:2984
- C:\Windows\System\TZZYvNv.exe
  C:\Windows\System\TZZYvNv.exe
  2⤵
  PID:1244
- C:\Windows\System\CxWQgqH.exe
  C:\Windows\System\CxWQgqH.exe
  2⤵
  PID:2496
- C:\Windows\System\yYnRKHf.exe
  C:\Windows\System\yYnRKHf.exe
  2⤵
  PID:2704
- C:\Windows\System\uVaZpQE.exe
  C:\Windows\System\uVaZpQE.exe
  2⤵
  PID:588
- C:\Windows\System\PpwcZLk.exe
  C:\Windows\System\PpwcZLk.exe
  2⤵
  PID:1196
- C:\Windows\System\wPesmZY.exe
  C:\Windows\System\wPesmZY.exe
  2⤵
  PID:1924
- C:\Windows\System\PHqCjCJ.exe
  C:\Windows\System\PHqCjCJ.exe
  2⤵
  PID:652
- C:\Windows\System\EjiyxDG.exe
  C:\Windows\System\EjiyxDG.exe
  2⤵
  PID:2316
- C:\Windows\System\peabhFf.exe
  C:\Windows\System\peabhFf.exe
  2⤵
  PID:2868
- C:\Windows\System\BKXENnh.exe
  C:\Windows\System\BKXENnh.exe
  2⤵
  PID:3080
- C:\Windows\System\trIznNw.exe
  C:\Windows\System\trIznNw.exe
  2⤵
  PID:3096
- C:\Windows\System\SIrdlvK.exe
  C:\Windows\System\SIrdlvK.exe
  2⤵
  PID:3112
- C:\Windows\System\dVbuvLL.exe
  C:\Windows\System\dVbuvLL.exe
  2⤵
  PID:3128
- C:\Windows\System\OmRehoF.exe
  C:\Windows\System\OmRehoF.exe
  2⤵
  PID:3144
- C:\Windows\System\zwRKIJA.exe
  C:\Windows\System\zwRKIJA.exe
  2⤵
  PID:3160
- C:\Windows\System\IiysQpe.exe
  C:\Windows\System\IiysQpe.exe
  2⤵
  PID:3176
- C:\Windows\System\ypHpPQs.exe
  C:\Windows\System\ypHpPQs.exe
  2⤵
  PID:3192
- C:\Windows\System\ixeayDY.exe
  C:\Windows\System\ixeayDY.exe
  2⤵
  PID:3208
- C:\Windows\System\VhsYOAl.exe
  C:\Windows\System\VhsYOAl.exe
  2⤵
  PID:3224
- C:\Windows\System\vPzxacu.exe
  C:\Windows\System\vPzxacu.exe
  2⤵
  PID:3240
- C:\Windows\System\TKgLlRM.exe
  C:\Windows\System\TKgLlRM.exe
  2⤵
  PID:3256
- C:\Windows\System\MRMAaoF.exe
  C:\Windows\System\MRMAaoF.exe
  2⤵
  PID:3272
- C:\Windows\System\DLfpjjC.exe
  C:\Windows\System\DLfpjjC.exe
  2⤵
  PID:3288
- C:\Windows\System\fqqaIXg.exe
  C:\Windows\System\fqqaIXg.exe
  2⤵
  PID:3304
- C:\Windows\System\ZTPwhuQ.exe
  C:\Windows\System\ZTPwhuQ.exe
  2⤵
  PID:3320
- C:\Windows\System\VbTiTBC.exe
  C:\Windows\System\VbTiTBC.exe
  2⤵
  PID:3336
- C:\Windows\System\JEGZXzr.exe
  C:\Windows\System\JEGZXzr.exe
  2⤵
  PID:3352
- C:\Windows\System\srftPux.exe
  C:\Windows\System\srftPux.exe
  2⤵
  PID:3368
- C:\Windows\System\ugMvOBQ.exe
  C:\Windows\System\ugMvOBQ.exe
  2⤵
  PID:3384
- C:\Windows\System\aGWOYxG.exe
  C:\Windows\System\aGWOYxG.exe
  2⤵
  PID:3400
- C:\Windows\System\pzwKosb.exe
  C:\Windows\System\pzwKosb.exe
  2⤵
  PID:3416
- C:\Windows\System\WnZJkof.exe
  C:\Windows\System\WnZJkof.exe
  2⤵
  PID:3432
- C:\Windows\System\pBBkWsF.exe
  C:\Windows\System\pBBkWsF.exe
  2⤵
  PID:3448
- C:\Windows\System\tnBEDly.exe
  C:\Windows\System\tnBEDly.exe
  2⤵
  PID:3464
- C:\Windows\System\TbgMcHu.exe
  C:\Windows\System\TbgMcHu.exe
  2⤵
  PID:3480
- C:\Windows\System\bHbdKii.exe
  C:\Windows\System\bHbdKii.exe
  2⤵
  PID:3496
- C:\Windows\System\IdqPzcH.exe
  C:\Windows\System\IdqPzcH.exe
  2⤵
  PID:3512
- C:\Windows\System\upZandZ.exe
  C:\Windows\System\upZandZ.exe
  2⤵
  PID:3528
- C:\Windows\System\hoTDmSw.exe
  C:\Windows\System\hoTDmSw.exe
  2⤵
  PID:3644
- C:\Windows\System\HrjMfii.exe
  C:\Windows\System\HrjMfii.exe
  2⤵
  PID:3660
- C:\Windows\System\aqcnDWR.exe
  C:\Windows\System\aqcnDWR.exe
  2⤵
  PID:3680
- C:\Windows\System\MQxyuqu.exe
  C:\Windows\System\MQxyuqu.exe
  2⤵
  PID:3696
- C:\Windows\System\ADjbGZV.exe
  C:\Windows\System\ADjbGZV.exe
  2⤵
  PID:3712
- C:\Windows\System\DpKnRTy.exe
  C:\Windows\System\DpKnRTy.exe
  2⤵
  PID:3728
- C:\Windows\System\uQBZujq.exe
  C:\Windows\System\uQBZujq.exe
  2⤵
  PID:3744
- C:\Windows\System\vSbtSbD.exe
  C:\Windows\System\vSbtSbD.exe
  2⤵
  PID:3760
- C:\Windows\System\kLYYBkd.exe
  C:\Windows\System\kLYYBkd.exe
  2⤵
  PID:3792
- C:\Windows\System\pcWUMcJ.exe
  C:\Windows\System\pcWUMcJ.exe
  2⤵
  PID:3816
- C:\Windows\System\oYobyPO.exe
  C:\Windows\System\oYobyPO.exe
  2⤵
  PID:3836
- C:\Windows\System\yOOdTuk.exe
  C:\Windows\System\yOOdTuk.exe
  2⤵
  PID:3856
- C:\Windows\System\IIJdStH.exe
  C:\Windows\System\IIJdStH.exe
  2⤵
  PID:3880
- C:\Windows\System\UglnIio.exe
  C:\Windows\System\UglnIio.exe
  2⤵
  PID:3896
- C:\Windows\System\ZbvfCbU.exe
  C:\Windows\System\ZbvfCbU.exe
  2⤵
  PID:3920
- C:\Windows\System\MVuaLTl.exe
  C:\Windows\System\MVuaLTl.exe
  2⤵
  PID:924
- C:\Windows\System\MPPVivX.exe
  C:\Windows\System\MPPVivX.exe
  2⤵
  PID:2744
- C:\Windows\System\mJapzue.exe
  C:\Windows\System\mJapzue.exe
  2⤵
  PID:444
- C:\Windows\System\GOBSALk.exe
  C:\Windows\System\GOBSALk.exe
  2⤵
  PID:2184
- C:\Windows\System\DkMPBvu.exe
  C:\Windows\System\DkMPBvu.exe
  2⤵
  PID:2464
- C:\Windows\System\ivpJVSU.exe
  C:\Windows\System\ivpJVSU.exe
  2⤵
  PID:3108
- C:\Windows\System\CpvsxIR.exe
  C:\Windows\System\CpvsxIR.exe
  2⤵
  PID:1992
- C:\Windows\System\OVrwUon.exe
  C:\Windows\System\OVrwUon.exe
  2⤵
  PID:3120
- C:\Windows\System\FdUaohH.exe
  C:\Windows\System\FdUaohH.exe
  2⤵
  PID:3168
- C:\Windows\System\LZNCrqh.exe
  C:\Windows\System\LZNCrqh.exe
  2⤵
  PID:3200
- C:\Windows\System\uEtCRTG.exe
  C:\Windows\System\uEtCRTG.exe
  2⤵
  PID:3216
- C:\Windows\System\lKaKgyn.exe
  C:\Windows\System\lKaKgyn.exe
  2⤵
  PID:3236
- C:\Windows\System\qqOsCeK.exe
  C:\Windows\System\qqOsCeK.exe
  2⤵
  PID:3248
- C:\Windows\System\xUWYjST.exe
  C:\Windows\System\xUWYjST.exe
  2⤵
  PID:3296
- C:\Windows\System\WoXSnXZ.exe
  C:\Windows\System\WoXSnXZ.exe
  2⤵
  PID:3312
- C:\Windows\System\iCiPVuZ.exe
  C:\Windows\System\iCiPVuZ.exe
  2⤵
  PID:3316
- C:\Windows\System\yTmnxZL.exe
  C:\Windows\System\yTmnxZL.exe
  2⤵
  PID:3348
- C:\Windows\System\hALqOGY.exe
  C:\Windows\System\hALqOGY.exe
  2⤵
  PID:3380
- C:\Windows\System\sPHEVBD.exe
  C:\Windows\System\sPHEVBD.exe
  2⤵
  PID:3412
- C:\Windows\System\mrrlray.exe
  C:\Windows\System\mrrlray.exe
  2⤵
  PID:2020
- C:\Windows\System\YLgxHKM.exe
  C:\Windows\System\YLgxHKM.exe
  2⤵
  PID:3440
- C:\Windows\System\rGWwNvi.exe
  C:\Windows\System\rGWwNvi.exe
  2⤵
  PID:3472
- C:\Windows\System\XZogHEH.exe
  C:\Windows\System\XZogHEH.exe
  2⤵
  PID:3520
- C:\Windows\System\uvrHFXb.exe
  C:\Windows\System\uvrHFXb.exe
  2⤵
  PID:3536
- C:\Windows\System\ekeWnyB.exe
  C:\Windows\System\ekeWnyB.exe
  2⤵
  PID:3544
- C:\Windows\System\laQpcbw.exe
  C:\Windows\System\laQpcbw.exe
  2⤵
  PID:3560
- C:\Windows\System\EyovuMm.exe
  C:\Windows\System\EyovuMm.exe
  2⤵
  PID:3576
- C:\Windows\System\IHocyiK.exe
  C:\Windows\System\IHocyiK.exe
  2⤵
  PID:3592
- C:\Windows\System\rzLTfcX.exe
  C:\Windows\System\rzLTfcX.exe
  2⤵
  PID:3608
- C:\Windows\System\FcokqOB.exe
  C:\Windows\System\FcokqOB.exe
  2⤵
  PID:3624
- C:\Windows\System\GdHEVnh.exe
  C:\Windows\System\GdHEVnh.exe
  2⤵
  PID:3640
- C:\Windows\System\qfhJvRt.exe
  C:\Windows\System\qfhJvRt.exe
  2⤵
  PID:3704
- C:\Windows\System\sMFlWIZ.exe
  C:\Windows\System\sMFlWIZ.exe
  2⤵
  PID:3752
- C:\Windows\System\BIchBsA.exe
  C:\Windows\System\BIchBsA.exe
  2⤵
  PID:3808
- C:\Windows\System\diShZra.exe
  C:\Windows\System\diShZra.exe
  2⤵
  PID:3852
- C:\Windows\System\JwMSgMo.exe
  C:\Windows\System\JwMSgMo.exe
  2⤵
  PID:3932
- C:\Windows\System\YYBDMNs.exe
  C:\Windows\System\YYBDMNs.exe
  2⤵
  PID:3956
- C:\Windows\System\pXGZUVO.exe
  C:\Windows\System\pXGZUVO.exe
  2⤵
  PID:3972
- C:\Windows\System\NQggDvN.exe
  C:\Windows\System\NQggDvN.exe
  2⤵
  PID:3996
- C:\Windows\System\hMwmGQy.exe
  C:\Windows\System\hMwmGQy.exe
  2⤵
  PID:4004
- C:\Windows\System\TGVEGWW.exe
  C:\Windows\System\TGVEGWW.exe
  2⤵
  PID:4020
- C:\Windows\System\MOIALvf.exe
  C:\Windows\System\MOIALvf.exe
  2⤵
  PID:4036
- C:\Windows\System\KJTRstJ.exe
  C:\Windows\System\KJTRstJ.exe
  2⤵
  PID:4052
- C:\Windows\System\sLYmgyP.exe
  C:\Windows\System\sLYmgyP.exe
  2⤵
  PID:1852
- C:\Windows\System\ZYWuOCr.exe
  C:\Windows\System\ZYWuOCr.exe
  2⤵
  PID:3088
- C:\Windows\System\mbbcRSG.exe
  C:\Windows\System\mbbcRSG.exe
  2⤵
  PID:3152
- C:\Windows\System\ujUspPA.exe
  C:\Windows\System\ujUspPA.exe
  2⤵
  PID:1824
- C:\Windows\System\ZceayKM.exe
  C:\Windows\System\ZceayKM.exe
  2⤵
  PID:2200
- C:\Windows\System\xFqwRXf.exe
  C:\Windows\System\xFqwRXf.exe
  2⤵
  PID:3492
- C:\Windows\System\ArakYau.exe
  C:\Windows\System\ArakYau.exe
  2⤵
  PID:3504
- C:\Windows\System\upMsTAD.exe
  C:\Windows\System\upMsTAD.exe
  2⤵
  PID:3552
- C:\Windows\System\TGlLhDg.exe
  C:\Windows\System\TGlLhDg.exe
  2⤵
  PID:3600
- C:\Windows\System\RfBlHpq.exe
  C:\Windows\System\RfBlHpq.exe
  2⤵
  PID:3844
- C:\Windows\System\bsazulr.exe
  C:\Windows\System\bsazulr.exe
  2⤵
  PID:3952
- C:\Windows\System\eYlreDi.exe
  C:\Windows\System\eYlreDi.exe
  2⤵
  PID:4016
- C:\Windows\System\CFmwyEY.exe
  C:\Windows\System\CFmwyEY.exe
  2⤵
  PID:2848
- C:\Windows\System\mmYalJc.exe
  C:\Windows\System\mmYalJc.exe
  2⤵
  PID:1060
- C:\Windows\System\dpDlmWm.exe
  C:\Windows\System\dpDlmWm.exe
  2⤵
  PID:604
- C:\Windows\System\Kllugtp.exe
  C:\Windows\System\Kllugtp.exe
  2⤵
  PID:4112
- C:\Windows\System\SPHdvjm.exe
  C:\Windows\System\SPHdvjm.exe
  2⤵
  PID:4128
- C:\Windows\System\QQloeUx.exe
  C:\Windows\System\QQloeUx.exe
  2⤵
  PID:4148
- C:\Windows\System\LykGaWX.exe
  C:\Windows\System\LykGaWX.exe
  2⤵
  PID:4164
- C:\Windows\System\TKVgRhp.exe
  C:\Windows\System\TKVgRhp.exe
  2⤵
  PID:4180
- C:\Windows\System\GqDxfOg.exe
  C:\Windows\System\GqDxfOg.exe
  2⤵
  PID:4196
- C:\Windows\System\wiRmUIL.exe
  C:\Windows\System\wiRmUIL.exe
  2⤵
  PID:4216
- C:\Windows\System\EiylrKA.exe
  C:\Windows\System\EiylrKA.exe
  2⤵
  PID:4232
- C:\Windows\System\zEttgVY.exe
  C:\Windows\System\zEttgVY.exe
  2⤵
  PID:4248
- C:\Windows\System\SyMdnUV.exe
  C:\Windows\System\SyMdnUV.exe
  2⤵
  PID:4264
- C:\Windows\System\MeYAIyM.exe
  C:\Windows\System\MeYAIyM.exe
  2⤵
  PID:4280
- C:\Windows\System\jbykoyK.exe
  C:\Windows\System\jbykoyK.exe
  2⤵
  PID:4296
- C:\Windows\System\NzaPQwI.exe
  C:\Windows\System\NzaPQwI.exe
  2⤵
  PID:4464
- C:\Windows\System\iZrJZsW.exe
  C:\Windows\System\iZrJZsW.exe
  2⤵
  PID:4500
- C:\Windows\System\gkKqyGQ.exe
  C:\Windows\System\gkKqyGQ.exe
  2⤵
  PID:4528
- C:\Windows\System\OslAUSG.exe
  C:\Windows\System\OslAUSG.exe
  2⤵
  PID:4544
- C:\Windows\System\nrdZXro.exe
  C:\Windows\System\nrdZXro.exe
  2⤵
  PID:4560
- C:\Windows\System\xFPUACH.exe
  C:\Windows\System\xFPUACH.exe
  2⤵
  PID:4576
- C:\Windows\System\arkmiwZ.exe
  C:\Windows\System\arkmiwZ.exe
  2⤵
  PID:4592
- C:\Windows\System\avrtFsE.exe
  C:\Windows\System\avrtFsE.exe
  2⤵
  PID:4608
- C:\Windows\System\xUADjIl.exe
  C:\Windows\System\xUADjIl.exe
  2⤵
  PID:4628
- C:\Windows\System\CHwarLq.exe
  C:\Windows\System\CHwarLq.exe
  2⤵
  PID:4648
- C:\Windows\System\OYdEVpw.exe
  C:\Windows\System\OYdEVpw.exe
  2⤵
  PID:4664
- C:\Windows\System\DpJPTsi.exe
  C:\Windows\System\DpJPTsi.exe
  2⤵
  PID:4680
- C:\Windows\System\hAfaFXs.exe
  C:\Windows\System\hAfaFXs.exe
  2⤵
  PID:4696
- C:\Windows\System\uScqtmp.exe
  C:\Windows\System\uScqtmp.exe
  2⤵
  PID:4728
- C:\Windows\System\PPTUrwT.exe
  C:\Windows\System\PPTUrwT.exe
  2⤵
  PID:4744
- C:\Windows\System\rgrgmNK.exe
  C:\Windows\System\rgrgmNK.exe
  2⤵
  PID:4760
- C:\Windows\System\NGeQHmz.exe
  C:\Windows\System\NGeQHmz.exe
  2⤵
  PID:4776
- C:\Windows\System\uEhAhdT.exe
  C:\Windows\System\uEhAhdT.exe
  2⤵
  PID:4840
- C:\Windows\System\gwzJCEL.exe
  C:\Windows\System\gwzJCEL.exe
  2⤵
  PID:4856
- C:\Windows\System\CIXECOn.exe
  C:\Windows\System\CIXECOn.exe
  2⤵
  PID:4872
- C:\Windows\System\vJtpssA.exe
  C:\Windows\System\vJtpssA.exe
  2⤵
  PID:4888
- C:\Windows\System\nbYWBYo.exe
  C:\Windows\System\nbYWBYo.exe
  2⤵
  PID:4904
- C:\Windows\System\coWcPwB.exe
  C:\Windows\System\coWcPwB.exe
  2⤵
  PID:4920
- C:\Windows\System\zEmHbjZ.exe
  C:\Windows\System\zEmHbjZ.exe
  2⤵
  PID:4936
- C:\Windows\System\cPMTHQL.exe
  C:\Windows\System\cPMTHQL.exe
  2⤵
  PID:4952
- C:\Windows\System\pboAEeQ.exe
  C:\Windows\System\pboAEeQ.exe
  2⤵
  PID:4972
- C:\Windows\System\JJKtdgV.exe
  C:\Windows\System\JJKtdgV.exe
  2⤵
  PID:4988
- C:\Windows\System\vRqttGM.exe
  C:\Windows\System\vRqttGM.exe
  2⤵
  PID:5004
- C:\Windows\System\VfhNGWY.exe
  C:\Windows\System\VfhNGWY.exe
  2⤵
  PID:5020
- C:\Windows\System\EbTWjVt.exe
  C:\Windows\System\EbTWjVt.exe
  2⤵
  PID:5064
- C:\Windows\System\nsjsify.exe
  C:\Windows\System\nsjsify.exe
  2⤵
  PID:5080
- C:\Windows\System\PnhnSPa.exe
  C:\Windows\System\PnhnSPa.exe
  2⤵
  PID:5100
- C:\Windows\System\LsajVWP.exe
  C:\Windows\System\LsajVWP.exe
  2⤵
  PID:5116
- C:\Windows\System\lAtBwOP.exe
  C:\Windows\System\lAtBwOP.exe
  2⤵
  PID:2368
- C:\Windows\System\ZgGMzvM.exe
  C:\Windows\System\ZgGMzvM.exe
  2⤵
  PID:3136
- C:\Windows\System\eQlktPS.exe
  C:\Windows\System\eQlktPS.exe
  2⤵
  PID:3188
- C:\Windows\System\scsXAbm.exe
  C:\Windows\System\scsXAbm.exe
  2⤵
  PID:4176
- C:\Windows\System\hGuPbUy.exe
  C:\Windows\System\hGuPbUy.exe
  2⤵
  PID:4240
- C:\Windows\System\lAYOfYn.exe
  C:\Windows\System\lAYOfYn.exe
  2⤵
  PID:4320
- C:\Windows\System\iYwKCwU.exe
  C:\Windows\System\iYwKCwU.exe
  2⤵
  PID:4156
- C:\Windows\System\aeyHCwC.exe
  C:\Windows\System\aeyHCwC.exe
  2⤵
  PID:4260
- C:\Windows\System\HvLCbWU.exe
  C:\Windows\System\HvLCbWU.exe
  2⤵
  PID:3616
- C:\Windows\System\CwKsuca.exe
  C:\Windows\System\CwKsuca.exe
  2⤵
  PID:3800
- C:\Windows\System\cGTpkPI.exe
  C:\Windows\System\cGTpkPI.exe
  2⤵
  PID:3928
- C:\Windows\System\qRzGrql.exe
  C:\Windows\System\qRzGrql.exe
  2⤵
  PID:4000
- C:\Windows\System\CfqVfbZ.exe
  C:\Windows\System\CfqVfbZ.exe
  2⤵
  PID:4068
- C:\Windows\System\ORmzeFE.exe
  C:\Windows\System\ORmzeFE.exe
  2⤵
  PID:3736
- C:\Windows\System\AelCukx.exe
  C:\Windows\System\AelCukx.exe
  2⤵
  PID:3784
- C:\Windows\System\uieDxdd.exe
  C:\Windows\System\uieDxdd.exe
  2⤵
  PID:3788
- C:\Windows\System\rmwwLax.exe
  C:\Windows\System\rmwwLax.exe
  2⤵
  PID:3864
- C:\Windows\System\jBwzDfT.exe
  C:\Windows\System\jBwzDfT.exe
  2⤵
  PID:3872
- C:\Windows\System\vTAWhuj.exe
  C:\Windows\System\vTAWhuj.exe
  2⤵
  PID:2160
- C:\Windows\System\ysUPwSl.exe
  C:\Windows\System\ysUPwSl.exe
  2⤵
  PID:4092
- C:\Windows\System\DAEDEaE.exe
  C:\Windows\System\DAEDEaE.exe
  2⤵
  PID:1264
- C:\Windows\System\JBQsyMh.exe
  C:\Windows\System\JBQsyMh.exe
  2⤵
  PID:2776
- C:\Windows\System\cyyfrcs.exe
  C:\Windows\System\cyyfrcs.exe
  2⤵
  PID:1716
- C:\Windows\System\JMSabDc.exe
  C:\Windows\System\JMSabDc.exe
  2⤵
  PID:3268
- C:\Windows\System\zQUIWer.exe
  C:\Windows\System\zQUIWer.exe
  2⤵
  PID:3392
- C:\Windows\System\HrDOJif.exe
  C:\Windows\System\HrDOJif.exe
  2⤵
  PID:3604
- C:\Windows\System\XhXqOUY.exe
  C:\Windows\System\XhXqOUY.exe
  2⤵
  PID:3140
- C:\Windows\System\mAILJEX.exe
  C:\Windows\System\mAILJEX.exe
  2⤵
  PID:1532
- C:\Windows\System\zMXjeZG.exe
  C:\Windows\System\zMXjeZG.exe
  2⤵
  PID:4408
- C:\Windows\System\pUGmmzN.exe
  C:\Windows\System\pUGmmzN.exe
  2⤵
  PID:2668
- C:\Windows\System\KkeGIdQ.exe
  C:\Windows\System\KkeGIdQ.exe
  2⤵
  PID:2864
- C:\Windows\System\RWvTtea.exe
  C:\Windows\System\RWvTtea.exe
  2⤵
  PID:4448
- C:\Windows\System\FJZHoqB.exe
  C:\Windows\System\FJZHoqB.exe
  2⤵
  PID:4480
- C:\Windows\System\KNLIvmm.exe
  C:\Windows\System\KNLIvmm.exe
  2⤵
  PID:4496
- C:\Windows\System\tqLtzXH.exe
  C:\Windows\System\tqLtzXH.exe
  2⤵
  PID:4492
- C:\Windows\System\GDLTpum.exe
  C:\Windows\System\GDLTpum.exe
  2⤵
  PID:4536
- C:\Windows\System\rlGHthB.exe
  C:\Windows\System\rlGHthB.exe
  2⤵
  PID:4616
- C:\Windows\System\nruPEDy.exe
  C:\Windows\System\nruPEDy.exe
  2⤵
  PID:4620
- C:\Windows\System\KuEgqqz.exe
  C:\Windows\System\KuEgqqz.exe
  2⤵
  PID:4636
- C:\Windows\System\FXHcZrM.exe
  C:\Windows\System\FXHcZrM.exe
  2⤵
  PID:4688
- C:\Windows\System\tfrKnKC.exe
  C:\Windows\System\tfrKnKC.exe
  2⤵
  PID:4768
- C:\Windows\System\cIqsYkp.exe
  C:\Windows\System\cIqsYkp.exe
  2⤵
  PID:4640
- C:\Windows\System\RpQpfIT.exe
  C:\Windows\System\RpQpfIT.exe
  2⤵
  PID:4784
- C:\Windows\System\pqiuBpz.exe
  C:\Windows\System\pqiuBpz.exe
  2⤵
  PID:2720
- C:\Windows\System\MeTBzSu.exe
  C:\Windows\System\MeTBzSu.exe
  2⤵
  PID:4716
- C:\Windows\System\OjSvRDp.exe
  C:\Windows\System\OjSvRDp.exe
  2⤵
  PID:4948
- C:\Windows\System\GKvCgqH.exe
  C:\Windows\System\GKvCgqH.exe
  2⤵
  PID:5016
- C:\Windows\System\aKdVUeW.exe
  C:\Windows\System\aKdVUeW.exe
  2⤵
  PID:3984
- C:\Windows\System\bMwSbcK.exe
  C:\Windows\System\bMwSbcK.exe
  2⤵
  PID:5056
- C:\Windows\System\UdnjJdy.exe
  C:\Windows\System\UdnjJdy.exe
  2⤵
  PID:3508
- C:\Windows\System\AxoQTGe.exe
  C:\Windows\System\AxoQTGe.exe
  2⤵
  PID:3184
- C:\Windows\System\sUSByqX.exe
  C:\Windows\System\sUSByqX.exe
  2⤵
  PID:2224
- C:\Windows\System\RtwXUOA.exe
  C:\Windows\System\RtwXUOA.exe
  2⤵
  PID:4204
- C:\Windows\System\yWGGIsf.exe
  C:\Windows\System\yWGGIsf.exe
  2⤵
  PID:4212
- C:\Windows\System\XewAToP.exe
  C:\Windows\System\XewAToP.exe
  2⤵
  PID:4272
- C:\Windows\System\yhJTnKQ.exe
  C:\Windows\System\yhJTnKQ.exe
  2⤵
  PID:4080
- C:\Windows\System\JMbDGaz.exe
  C:\Windows\System\JMbDGaz.exe
  2⤵
  PID:3264
- C:\Windows\System\ZMtoYvz.exe
  C:\Windows\System\ZMtoYvz.exe
  2⤵
  PID:2892
- C:\Windows\System\ZVdqzjM.exe
  C:\Windows\System\ZVdqzjM.exe
  2⤵
  PID:3988
- C:\Windows\System\PzDxOoQ.exe
  C:\Windows\System\PzDxOoQ.exe
  2⤵
  PID:2584
- C:\Windows\System\AYNWuaU.exe
  C:\Windows\System\AYNWuaU.exe
  2⤵
  PID:3832
- C:\Windows\System\uYnnjHy.exe
  C:\Windows\System\uYnnjHy.exe
  2⤵
  PID:4292
- C:\Windows\System\TBjgQMH.exe
  C:\Windows\System\TBjgQMH.exe
  2⤵
  PID:4032
- C:\Windows\System\JUdiZLR.exe
  C:\Windows\System\JUdiZLR.exe
  2⤵
  PID:3780
- C:\Windows\System\wwnBAwk.exe
  C:\Windows\System\wwnBAwk.exe
  2⤵
  PID:3360
- C:\Windows\System\mYDEtvm.exe
  C:\Windows\System\mYDEtvm.exe
  2⤵
  PID:2616
- C:\Windows\System\JGfIKCg.exe
  C:\Windows\System\JGfIKCg.exe
  2⤵
  PID:3740
- C:\Windows\System\UBcFUHT.exe
  C:\Windows\System\UBcFUHT.exe
  2⤵
  PID:3556
- C:\Windows\System\MLXWOVC.exe
  C:\Windows\System\MLXWOVC.exe
  2⤵
  PID:4692
- C:\Windows\System\iRbuSUS.exe
  C:\Windows\System\iRbuSUS.exe
  2⤵
  PID:4704
- C:\Windows\System\VWIrceT.exe
  C:\Windows\System\VWIrceT.exe
  2⤵
  PID:4736
- C:\Windows\System\NZRHVgf.exe
  C:\Windows\System\NZRHVgf.exe
  2⤵
  PID:1044
- C:\Windows\System\UxRTmMg.exe
  C:\Windows\System\UxRTmMg.exe
  2⤵
  PID:4792
- C:\Windows\System\xQdkTZa.exe
  C:\Windows\System\xQdkTZa.exe
  2⤵
  PID:4308
- C:\Windows\System\EoIvHFQ.exe
  C:\Windows\System\EoIvHFQ.exe
  2⤵
  PID:4800
- C:\Windows\System\JLSvroY.exe
  C:\Windows\System\JLSvroY.exe
  2⤵
  PID:4944
- C:\Windows\System\naZehnC.exe
  C:\Windows\System\naZehnC.exe
  2⤵
  PID:4864
- C:\Windows\System\bfkPjbh.exe
  C:\Windows\System\bfkPjbh.exe
  2⤵
  PID:5000
- C:\Windows\System\gNyYRfg.exe
  C:\Windows\System\gNyYRfg.exe
  2⤵
  PID:4960
- C:\Windows\System\mEPAuMM.exe
  C:\Windows\System\mEPAuMM.exe
  2⤵
  PID:4984
- C:\Windows\System\vyoACKp.exe
  C:\Windows\System\vyoACKp.exe
  2⤵
  PID:5112
- C:\Windows\System\uRcOuoG.exe
  C:\Windows\System\uRcOuoG.exe
  2⤵
  PID:4208
- C:\Windows\System\ZoNBbfj.exe
  C:\Windows\System\ZoNBbfj.exe
  2⤵
  PID:3936
- C:\Windows\System\gZivZTq.exe
  C:\Windows\System\gZivZTq.exe
  2⤵
  PID:3424
- C:\Windows\System\lCJKRGG.exe
  C:\Windows\System\lCJKRGG.exe
  2⤵
  PID:3904
- C:\Windows\System\TykQNpw.exe
  C:\Windows\System\TykQNpw.exe
  2⤵
  PID:3344
- C:\Windows\System\bLclDgy.exe
  C:\Windows\System\bLclDgy.exe
  2⤵
  PID:1272
- C:\Windows\System\kShYcyH.exe
  C:\Windows\System\kShYcyH.exe
  2⤵
  PID:3568
- C:\Windows\System\hqSkEsl.exe
  C:\Windows\System\hqSkEsl.exe
  2⤵
  PID:4380
- C:\Windows\System\zzwAHLP.exe
  C:\Windows\System\zzwAHLP.exe
  2⤵
  PID:4416
- C:\Windows\System\UvxLLLI.exe
  C:\Windows\System\UvxLLLI.exe
  2⤵
  PID:4568
- C:\Windows\System\TmRcKGz.exe
  C:\Windows\System\TmRcKGz.exe
  2⤵
  PID:4432
- C:\Windows\System\zrhXuGh.exe
  C:\Windows\System\zrhXuGh.exe
  2⤵
  PID:1040
- C:\Windows\System\CeoptyF.exe
  C:\Windows\System\CeoptyF.exe
  2⤵
  PID:4624
- C:\Windows\System\HryuUgo.exe
  C:\Windows\System\HryuUgo.exe
  2⤵
  PID:4556
- C:\Windows\System\dohzVBQ.exe
  C:\Windows\System\dohzVBQ.exe
  2⤵
  PID:4724
- C:\Windows\System\NgYVVhH.exe
  C:\Windows\System\NgYVVhH.exe
  2⤵
  PID:4848
- C:\Windows\System\awPcpyU.exe
  C:\Windows\System\awPcpyU.exe
  2⤵
  PID:5040
- C:\Windows\System\IAOogae.exe
  C:\Windows\System\IAOogae.exe
  2⤵
  PID:4996
- C:\Windows\System\jpRQroS.exe
  C:\Windows\System\jpRQroS.exe
  2⤵
  PID:4816
- C:\Windows\System\nvJOGFD.exe
  C:\Windows\System\nvJOGFD.exe
  2⤵
  PID:4852
- C:\Windows\System\DrWuIET.exe
  C:\Windows\System\DrWuIET.exe
  2⤵
  PID:5076
- C:\Windows\System\kgAvgka.exe
  C:\Windows\System\kgAvgka.exe
  2⤵
  PID:4644
- C:\Windows\System\cVafiTG.exe
  C:\Windows\System\cVafiTG.exe
  2⤵
  PID:4192
- C:\Windows\System\YjUHNjp.exe
  C:\Windows\System\YjUHNjp.exe
  2⤵
  PID:3204
- C:\Windows\System\FcDDErc.exe
  C:\Windows\System\FcDDErc.exe
  2⤵
  PID:5092
- C:\Windows\System\jJwnxiT.exe
  C:\Windows\System\jJwnxiT.exe
  2⤵
  PID:1288
- C:\Windows\System\yXYURWG.exe
  C:\Windows\System\yXYURWG.exe
  2⤵
  PID:3804
- C:\Windows\System\xgSDCxM.exe
  C:\Windows\System\xgSDCxM.exe
  2⤵
  PID:3724
- C:\Windows\System\OfHDVoO.exe
  C:\Windows\System\OfHDVoO.exe
  2⤵
  PID:4756
- C:\Windows\System\fPivOvd.exe
  C:\Windows\System\fPivOvd.exe
  2⤵
  PID:5128
- C:\Windows\System\ASpWckQ.exe
  C:\Windows\System\ASpWckQ.exe
  2⤵
  PID:5148
- C:\Windows\System\cIIFYNH.exe
  C:\Windows\System\cIIFYNH.exe
  2⤵
  PID:5184
- C:\Windows\System\eEKfHii.exe
  C:\Windows\System\eEKfHii.exe
  2⤵
  PID:5200
- C:\Windows\System\qieYiBn.exe
  C:\Windows\System\qieYiBn.exe
  2⤵
  PID:5216
- C:\Windows\System\eeFIolD.exe
  C:\Windows\System\eeFIolD.exe
  2⤵
  PID:5232
- C:\Windows\System\sgaKXbh.exe
  C:\Windows\System\sgaKXbh.exe
  2⤵
  PID:5248
- C:\Windows\System\XSDFIPn.exe
  C:\Windows\System\XSDFIPn.exe
  2⤵
  PID:5264
- C:\Windows\System\NOdEcFS.exe
  C:\Windows\System\NOdEcFS.exe
  2⤵
  PID:5292
- C:\Windows\System\RDwUAOo.exe
  C:\Windows\System\RDwUAOo.exe
  2⤵
  PID:5308
- C:\Windows\System\oLgPLml.exe
  C:\Windows\System\oLgPLml.exe
  2⤵
  PID:5324
- C:\Windows\System\aoQhAOi.exe
  C:\Windows\System\aoQhAOi.exe
  2⤵
  PID:5340
- C:\Windows\System\XiWbvkr.exe
  C:\Windows\System\XiWbvkr.exe
  2⤵
  PID:5360
- C:\Windows\System\LjcTAaJ.exe
  C:\Windows\System\LjcTAaJ.exe
  2⤵
  PID:5376
- C:\Windows\System\PizDhKf.exe
  C:\Windows\System\PizDhKf.exe
  2⤵
  PID:5392
- C:\Windows\System\JfoOVgC.exe
  C:\Windows\System\JfoOVgC.exe
  2⤵
  PID:5408
- C:\Windows\System\JdzQyRm.exe
  C:\Windows\System\JdzQyRm.exe
  2⤵
  PID:5428
- C:\Windows\System\HEmHPRe.exe
  C:\Windows\System\HEmHPRe.exe
  2⤵
  PID:5444
- C:\Windows\System\sHeuKFb.exe
  C:\Windows\System\sHeuKFb.exe
  2⤵
  PID:5460
- C:\Windows\System\BhvOjXx.exe
  C:\Windows\System\BhvOjXx.exe
  2⤵
  PID:5476
- C:\Windows\System\YELFsZd.exe
  C:\Windows\System\YELFsZd.exe
  2⤵
  PID:5492
- C:\Windows\System\yAnoVgt.exe
  C:\Windows\System\yAnoVgt.exe
  2⤵
  PID:5508
- C:\Windows\System\Cusctzf.exe
  C:\Windows\System\Cusctzf.exe
  2⤵
  PID:5528
- C:\Windows\System\HkrLfGd.exe
  C:\Windows\System\HkrLfGd.exe
  2⤵
  PID:5544
- C:\Windows\System\iHoXOjz.exe
  C:\Windows\System\iHoXOjz.exe
  2⤵
  PID:5560
- C:\Windows\System\pXaYDRj.exe
  C:\Windows\System\pXaYDRj.exe
  2⤵
  PID:5576
- C:\Windows\System\WPckPnb.exe
  C:\Windows\System\WPckPnb.exe
  2⤵
  PID:5592
- C:\Windows\System\mSweJKz.exe
  C:\Windows\System\mSweJKz.exe
  2⤵
  PID:5608
- C:\Windows\System\dSPCwZA.exe
  C:\Windows\System\dSPCwZA.exe
  2⤵
  PID:5624
- C:\Windows\System\KOoTHps.exe
  C:\Windows\System\KOoTHps.exe
  2⤵
  PID:5648
- C:\Windows\System\mLjxYCJ.exe
  C:\Windows\System\mLjxYCJ.exe
  2⤵
  PID:5664
- C:\Windows\System\JsLjSry.exe
  C:\Windows\System\JsLjSry.exe
  2⤵
  PID:5680
- C:\Windows\System\mLfkhuh.exe
  C:\Windows\System\mLfkhuh.exe
  2⤵
  PID:5700
- C:\Windows\System\OquihYx.exe
  C:\Windows\System\OquihYx.exe
  2⤵
  PID:5716
- C:\Windows\System\UykZkgc.exe
  C:\Windows\System\UykZkgc.exe
  2⤵
  PID:5732
- C:\Windows\System\nerHxlr.exe
  C:\Windows\System\nerHxlr.exe
  2⤵
  PID:5748
- C:\Windows\System\jUjfTDO.exe
  C:\Windows\System\jUjfTDO.exe
  2⤵
  PID:5764
- C:\Windows\System\zTrZlTt.exe
  C:\Windows\System\zTrZlTt.exe
  2⤵
  PID:5780
- C:\Windows\System\aGJNGFd.exe
  C:\Windows\System\aGJNGFd.exe
  2⤵
  PID:5796
- C:\Windows\System\cbiBucS.exe
  C:\Windows\System\cbiBucS.exe
  2⤵
  PID:5812
- C:\Windows\System\oZQGYpK.exe
  C:\Windows\System\oZQGYpK.exe
  2⤵
  PID:5828
- C:\Windows\System\XTgLrWZ.exe
  C:\Windows\System\XTgLrWZ.exe
  2⤵
  PID:5844
- C:\Windows\System\XYtIPgz.exe
  C:\Windows\System\XYtIPgz.exe
  2⤵
  PID:5860
- C:\Windows\System\KUVEoDJ.exe
  C:\Windows\System\KUVEoDJ.exe
  2⤵
  PID:5876
- C:\Windows\System\ENAEjjC.exe
  C:\Windows\System\ENAEjjC.exe
  2⤵
  PID:5896
- C:\Windows\System\GiqvrUp.exe
  C:\Windows\System\GiqvrUp.exe
  2⤵
  PID:5912
- C:\Windows\System\Bsiqtax.exe
  C:\Windows\System\Bsiqtax.exe
  2⤵
  PID:5928
- C:\Windows\System\TPfcbGw.exe
  C:\Windows\System\TPfcbGw.exe
  2⤵
  PID:5944
- C:\Windows\System\WQYRICR.exe
  C:\Windows\System\WQYRICR.exe
  2⤵
  PID:5960
- C:\Windows\System\RFsHSKU.exe
  C:\Windows\System\RFsHSKU.exe
  2⤵
  PID:5976
- C:\Windows\System\Njvkouc.exe
  C:\Windows\System\Njvkouc.exe
  2⤵
  PID:5992
- C:\Windows\System\XYbcrSo.exe
  C:\Windows\System\XYbcrSo.exe
  2⤵
  PID:6008
- C:\Windows\System\juGTkvV.exe
  C:\Windows\System\juGTkvV.exe
  2⤵
  PID:6024
- C:\Windows\System\KpmvCif.exe
  C:\Windows\System\KpmvCif.exe
  2⤵
  PID:6044
- C:\Windows\System\VfbXYLb.exe
  C:\Windows\System\VfbXYLb.exe
  2⤵
  PID:6060
- C:\Windows\System\oPLpjjT.exe
  C:\Windows\System\oPLpjjT.exe
  2⤵
  PID:6076
- C:\Windows\System\LvUcmVn.exe
  C:\Windows\System\LvUcmVn.exe
  2⤵
  PID:6092
- C:\Windows\System\MLHaslY.exe
  C:\Windows\System\MLHaslY.exe
  2⤵
  PID:6108
- C:\Windows\System\UvWJVpE.exe
  C:\Windows\System\UvWJVpE.exe
  2⤵
  PID:6124
- C:\Windows\System\fXXQPOE.exe
  C:\Windows\System\fXXQPOE.exe
  2⤵
  PID:6140
- C:\Windows\System\VBRmJJH.exe
  C:\Windows\System\VBRmJJH.exe
  2⤵
  PID:1644
- C:\Windows\System\GlWtZjT.exe
  C:\Windows\System\GlWtZjT.exe
  2⤵
  PID:4740
- C:\Windows\System\XnYIIUD.exe
  C:\Windows\System\XnYIIUD.exe
  2⤵
  PID:3428
- C:\Windows\System\lCpzfre.exe
  C:\Windows\System\lCpzfre.exe
  2⤵
  PID:4712
- C:\Windows\System\lVBzgHg.exe
  C:\Windows\System\lVBzgHg.exe
  2⤵
  PID:5096
- C:\Windows\System\etKQCgh.exe
  C:\Windows\System\etKQCgh.exe
  2⤵
  PID:3332
- C:\Windows\System\ZIxovLQ.exe
  C:\Windows\System\ZIxovLQ.exe
  2⤵
  PID:5060
- C:\Windows\System\ukVeKHX.exe
  C:\Windows\System\ukVeKHX.exe
  2⤵
  PID:4796
- C:\Windows\System\QGduHVn.exe
  C:\Windows\System\QGduHVn.exe
  2⤵
  PID:2348
- C:\Windows\System\zlYeznk.exe
  C:\Windows\System\zlYeznk.exe
  2⤵
  PID:2040
- C:\Windows\System\iBkcWYr.exe
  C:\Windows\System\iBkcWYr.exe
  2⤵
  PID:5144
- C:\Windows\System\JPBQOqH.exe
  C:\Windows\System\JPBQOqH.exe
  2⤵
  PID:5168
- C:\Windows\System\ZUZDBpa.exe
  C:\Windows\System\ZUZDBpa.exe
  2⤵
  PID:5172
- C:\Windows\System\QkRxxbM.exe
  C:\Windows\System\QkRxxbM.exe
  2⤵
  PID:5228
- C:\Windows\System\MnSwBda.exe
  C:\Windows\System\MnSwBda.exe
  2⤵
  PID:5300
- C:\Windows\System\KKWdcUC.exe
  C:\Windows\System\KKWdcUC.exe
  2⤵
  PID:5400
- C:\Windows\System\FxbxOkJ.exe
  C:\Windows\System\FxbxOkJ.exe
  2⤵
  PID:5468
- C:\Windows\System\FeMYNYX.exe
  C:\Windows\System\FeMYNYX.exe
  2⤵
  PID:5536
- C:\Windows\System\kyAIpWb.exe
  C:\Windows\System\kyAIpWb.exe
  2⤵
  PID:5600
- C:\Windows\System\VqitWvB.exe
  C:\Windows\System\VqitWvB.exe
  2⤵
  PID:5660
- C:\Windows\System\WPYeAZd.exe
  C:\Windows\System\WPYeAZd.exe
  2⤵
  PID:5488
- C:\Windows\System\RLTMgVK.exe
  C:\Windows\System\RLTMgVK.exe
  2⤵
  PID:5240
- C:\Windows\System\wRrceKy.exe
  C:\Windows\System\wRrceKy.exe
  2⤵
  PID:5756
- C:\Windows\System\eoiCdHq.exe
  C:\Windows\System\eoiCdHq.exe
  2⤵
  PID:5788
- C:\Windows\System\PNvKQfJ.exe
  C:\Windows\System\PNvKQfJ.exe
  2⤵
  PID:5316
- C:\Windows\System\TguvtUs.exe
  C:\Windows\System\TguvtUs.exe
  2⤵
  PID:5352
- C:\Windows\System\RmHkFTK.exe
  C:\Windows\System\RmHkFTK.exe
  2⤵
  PID:5416
- C:\Windows\System\DkokrRG.exe
  C:\Windows\System\DkokrRG.exe
  2⤵
  PID:5820
- C:\Windows\System\hVfVwkh.exe
  C:\Windows\System\hVfVwkh.exe
  2⤵
  PID:5524
- C:\Windows\System\hxXxKEC.exe
  C:\Windows\System\hxXxKEC.exe
  2⤵
  PID:5588
- C:\Windows\System\XwMSmcU.exe
  C:\Windows\System\XwMSmcU.exe
  2⤵
  PID:5808
- C:\Windows\System\CBuSvCG.exe
  C:\Windows\System\CBuSvCG.exe
  2⤵
  PID:5676
- C:\Windows\System\ZnPRHfb.exe
  C:\Windows\System\ZnPRHfb.exe
  2⤵
  PID:5852
- C:\Windows\System\szduLuq.exe
  C:\Windows\System\szduLuq.exe
  2⤵
  PID:5884
- C:\Windows\System\zRdDiRg.exe
  C:\Windows\System\zRdDiRg.exe
  2⤵
  PID:5904
- C:\Windows\System\CFfMwkp.exe
  C:\Windows\System\CFfMwkp.exe
  2⤵
  PID:5924
- C:\Windows\System\aiXHlQK.exe
  C:\Windows\System\aiXHlQK.exe
  2⤵
  PID:5988
- C:\Windows\System\CTiEWSu.exe
  C:\Windows\System\CTiEWSu.exe
  2⤵
  PID:6116
- C:\Windows\System\tSyeoTL.exe
  C:\Windows\System\tSyeoTL.exe
  2⤵
  PID:6088
- C:\Windows\System\PCUTklM.exe
  C:\Windows\System\PCUTklM.exe
  2⤵
  PID:3588
- C:\Windows\System\FBXrZbg.exe
  C:\Windows\System\FBXrZbg.exe
  2⤵
  PID:3916
- C:\Windows\System\NfDSeXJ.exe
  C:\Windows\System\NfDSeXJ.exe
  2⤵
  PID:4472
- C:\Windows\System\lAdOLQK.exe
  C:\Windows\System\lAdOLQK.exe
  2⤵
  PID:4832
- C:\Windows\System\KzoGxxf.exe
  C:\Windows\System\KzoGxxf.exe
  2⤵
  PID:5940
- C:\Windows\System\UaUSpNi.exe
  C:\Windows\System\UaUSpNi.exe
  2⤵
  PID:6004
- C:\Windows\System\tgJiEEV.exe
  C:\Windows\System\tgJiEEV.exe
  2⤵
  PID:5452
- C:\Windows\System\AVitdxD.exe
  C:\Windows\System\AVitdxD.exe
  2⤵
  PID:5744
- C:\Windows\System\fHIEaMT.exe
  C:\Windows\System\fHIEaMT.exe
  2⤵
  PID:5552
- C:\Windows\System\MycnMKA.exe
  C:\Windows\System\MycnMKA.exe
  2⤵
  PID:5288
- C:\Windows\System\IDylMOE.exe
  C:\Windows\System\IDylMOE.exe
  2⤵
  PID:5688
- C:\Windows\System\xnnctiW.exe
  C:\Windows\System\xnnctiW.exe
  2⤵
  PID:5740
- C:\Windows\System\xYoULDn.exe
  C:\Windows\System\xYoULDn.exe
  2⤵
  PID:4932
- C:\Windows\System\kOOqAdz.exe
  C:\Windows\System\kOOqAdz.exe
  2⤵
  PID:5028
- C:\Windows\System\lqARedo.exe
  C:\Windows\System\lqARedo.exe
  2⤵
  PID:3376
- C:\Windows\System\JKYQhVQ.exe
  C:\Windows\System\JKYQhVQ.exe
  2⤵
  PID:5160
- C:\Windows\System\HZVBdGx.exe
  C:\Windows\System\HZVBdGx.exe
  2⤵
  PID:5500
- C:\Windows\System\WjGrdpL.exe
  C:\Windows\System\WjGrdpL.exe
  2⤵
  PID:5656
- C:\Windows\System\QWiIYQl.exe
  C:\Windows\System\QWiIYQl.exe
  2⤵
  PID:5420
- C:\Windows\System\ygwzlKQ.exe
  C:\Windows\System\ygwzlKQ.exe
  2⤵
  PID:5620
- C:\Windows\System\xyZprbi.exe
  C:\Windows\System\xyZprbi.exe
  2⤵
  PID:2140
- C:\Windows\System\JouXLal.exe
  C:\Windows\System\JouXLal.exe
  2⤵
  PID:4352
- C:\Windows\System\oRRJBZN.exe
  C:\Windows\System\oRRJBZN.exe
  2⤵
  PID:6068
- C:\Windows\System\kScvDwF.exe
  C:\Windows\System\kScvDwF.exe
  2⤵
  PID:6104
- C:\Windows\System\ffTUDcx.exe
  C:\Windows\System\ffTUDcx.exe
  2⤵
  PID:5140
- C:\Windows\System\gxjqipx.exe
  C:\Windows\System\gxjqipx.exe
  2⤵
  PID:5276
- C:\Windows\System\IBGlVgJ.exe
  C:\Windows\System\IBGlVgJ.exe
  2⤵
  PID:5568
- C:\Windows\System\zFJTzrI.exe
  C:\Windows\System\zFJTzrI.exe
  2⤵
  PID:5708
- C:\Windows\System\JljQczl.exe
  C:\Windows\System\JljQczl.exe
  2⤵
  PID:6000
- C:\Windows\System\edGtunM.exe
  C:\Windows\System\edGtunM.exe
  2⤵
  PID:5760
- C:\Windows\System\hwQGONJ.exe
  C:\Windows\System\hwQGONJ.exe
  2⤵
  PID:5372
- C:\Windows\System\mcbQzQE.exe
  C:\Windows\System\mcbQzQE.exe
  2⤵
  PID:5180
- C:\Windows\System\BaKnBAW.exe
  C:\Windows\System\BaKnBAW.exe
  2⤵
  PID:6136
- C:\Windows\System\eDlIGyb.exe
  C:\Windows\System\eDlIGyb.exe
  2⤵
  PID:5728
- C:\Windows\System\aVyalJW.exe
  C:\Windows\System\aVyalJW.exe
  2⤵
  PID:4396
- C:\Windows\System\SEoohUO.exe
  C:\Windows\System\SEoohUO.exe
  2⤵
  PID:5280
- C:\Windows\System\nXQMOIS.exe
  C:\Windows\System\nXQMOIS.exe
  2⤵
  PID:4964
- C:\Windows\System\ofgYpBb.exe
  C:\Windows\System\ofgYpBb.exe
  2⤵
  PID:6040
- C:\Windows\System\XVKvDiW.exe
  C:\Windows\System\XVKvDiW.exe
  2⤵
  PID:6152
- C:\Windows\System\ICRdaBi.exe
  C:\Windows\System\ICRdaBi.exe
  2⤵
  PID:6224
- C:\Windows\System\AqbkHWz.exe
  C:\Windows\System\AqbkHWz.exe
  2⤵
  PID:6240
- C:\Windows\System\skKoGxP.exe
  C:\Windows\System\skKoGxP.exe
  2⤵
  PID:6256
- C:\Windows\System\CmrXiqC.exe
  C:\Windows\System\CmrXiqC.exe
  2⤵
  PID:6272
- C:\Windows\System\PAzPQmx.exe
  C:\Windows\System\PAzPQmx.exe
  2⤵
  PID:6288
- C:\Windows\System\EBxBtTv.exe
  C:\Windows\System\EBxBtTv.exe
  2⤵
  PID:6304
- C:\Windows\System\gOjnqVu.exe
  C:\Windows\System\gOjnqVu.exe
  2⤵
  PID:6324
- C:\Windows\System\TyCJLCJ.exe
  C:\Windows\System\TyCJLCJ.exe
  2⤵
  PID:6340
- C:\Windows\System\QUoioCQ.exe
  C:\Windows\System\QUoioCQ.exe
  2⤵
  PID:6356
- C:\Windows\System\hEkBPOP.exe
  C:\Windows\System\hEkBPOP.exe
  2⤵
  PID:6372
- C:\Windows\System\WqEorCt.exe
  C:\Windows\System\WqEorCt.exe
  2⤵
  PID:6392
- C:\Windows\System\RqzsyjR.exe
  C:\Windows\System\RqzsyjR.exe
  2⤵
  PID:6408
- C:\Windows\System\zkZrAMR.exe
  C:\Windows\System\zkZrAMR.exe
  2⤵
  PID:6432
- C:\Windows\System\AbzWgGT.exe
  C:\Windows\System\AbzWgGT.exe
  2⤵
  PID:6448
- C:\Windows\System\eUBaZFn.exe
  C:\Windows\System\eUBaZFn.exe
  2⤵
  PID:6464
- C:\Windows\System\JfyfocQ.exe
  C:\Windows\System\JfyfocQ.exe
  2⤵
  PID:6480
- C:\Windows\System\pJGMsOZ.exe
  C:\Windows\System\pJGMsOZ.exe
  2⤵
  PID:6496
- C:\Windows\System\fSOqQWx.exe
  C:\Windows\System\fSOqQWx.exe
  2⤵
  PID:6512
- C:\Windows\System\hRvdEfZ.exe
  C:\Windows\System\hRvdEfZ.exe
  2⤵
  PID:6528
- C:\Windows\System\RJFXIKQ.exe
  C:\Windows\System\RJFXIKQ.exe
  2⤵
  PID:6544
- C:\Windows\System\bVhstXB.exe
  C:\Windows\System\bVhstXB.exe
  2⤵
  PID:6560
- C:\Windows\System\MmtpHLQ.exe
  C:\Windows\System\MmtpHLQ.exe
  2⤵
  PID:6576
- C:\Windows\System\QaiAayF.exe
  C:\Windows\System\QaiAayF.exe
  2⤵
  PID:6592
- C:\Windows\System\ykSHNOG.exe
  C:\Windows\System\ykSHNOG.exe
  2⤵
  PID:6608
- C:\Windows\System\SFhJqMc.exe
  C:\Windows\System\SFhJqMc.exe
  2⤵
  PID:6624
- C:\Windows\System\cCpqfef.exe
  C:\Windows\System\cCpqfef.exe
  2⤵
  PID:6640
- C:\Windows\System\zgEPdON.exe
  C:\Windows\System\zgEPdON.exe
  2⤵
  PID:6656
- C:\Windows\System\BoPaWnm.exe
  C:\Windows\System\BoPaWnm.exe
  2⤵
  PID:6672
- C:\Windows\System\OErKtSQ.exe
  C:\Windows\System\OErKtSQ.exe
  2⤵
  PID:6692
- C:\Windows\System\cLkNuTE.exe
  C:\Windows\System\cLkNuTE.exe
  2⤵
  PID:6708
- C:\Windows\System\pMKhGco.exe
  C:\Windows\System\pMKhGco.exe
  2⤵
  PID:6724
- C:\Windows\System\AFPSUsp.exe
  C:\Windows\System\AFPSUsp.exe
  2⤵
  PID:6740
- C:\Windows\System\SyMXVEX.exe
  C:\Windows\System\SyMXVEX.exe
  2⤵
  PID:6756
- C:\Windows\System\mPTtkAH.exe
  C:\Windows\System\mPTtkAH.exe
  2⤵
  PID:6772
- C:\Windows\System\pfxyESJ.exe
  C:\Windows\System\pfxyESJ.exe
  2⤵
  PID:6788
- C:\Windows\System\XShKCHH.exe
  C:\Windows\System\XShKCHH.exe
  2⤵
  PID:6808
- C:\Windows\System\vvKwsys.exe
  C:\Windows\System\vvKwsys.exe
  2⤵
  PID:6824
- C:\Windows\System\Htettzc.exe
  C:\Windows\System\Htettzc.exe
  2⤵
  PID:6840
- C:\Windows\System\TuPPQiC.exe
  C:\Windows\System\TuPPQiC.exe
  2⤵
  PID:6856
- C:\Windows\System\BrlKztm.exe
  C:\Windows\System\BrlKztm.exe
  2⤵
  PID:6872
- C:\Windows\System\FsCYIVI.exe
  C:\Windows\System\FsCYIVI.exe
  2⤵
  PID:6888
- C:\Windows\System\pxnKbNb.exe
  C:\Windows\System\pxnKbNb.exe
  2⤵
  PID:6904
- C:\Windows\System\RglXRBE.exe
  C:\Windows\System\RglXRBE.exe
  2⤵
  PID:6920
- C:\Windows\System\LZllbeI.exe
  C:\Windows\System\LZllbeI.exe
  2⤵
  PID:6936
- C:\Windows\System\kXUtukW.exe
  C:\Windows\System\kXUtukW.exe
  2⤵
  PID:6952
- C:\Windows\System\uNIVWMo.exe
  C:\Windows\System\uNIVWMo.exe
  2⤵
  PID:6968
- C:\Windows\System\pyzxViI.exe
  C:\Windows\System\pyzxViI.exe
  2⤵
  PID:6988
- C:\Windows\System\IDsaoeI.exe
  C:\Windows\System\IDsaoeI.exe
  2⤵
  PID:7004
- C:\Windows\System\cFUtvyp.exe
  C:\Windows\System\cFUtvyp.exe
  2⤵
  PID:7020
- C:\Windows\System\yVhjrSX.exe
  C:\Windows\System\yVhjrSX.exe
  2⤵
  PID:7036
- C:\Windows\System\OoPGLIH.exe
  C:\Windows\System\OoPGLIH.exe
  2⤵
  PID:7052
- C:\Windows\System\QKCvacU.exe
  C:\Windows\System\QKCvacU.exe
  2⤵
  PID:7068
- C:\Windows\System\yPNpFaZ.exe
  C:\Windows\System\yPNpFaZ.exe
  2⤵
  PID:7084
- C:\Windows\System\ocfyOEX.exe
  C:\Windows\System\ocfyOEX.exe
  2⤵
  PID:7100
- C:\Windows\System\ZKXykrW.exe
  C:\Windows\System\ZKXykrW.exe
  2⤵
  PID:7116
- C:\Windows\System\fbARZjA.exe
  C:\Windows\System\fbARZjA.exe
  2⤵
  PID:7132
- C:\Windows\System\DfWFelz.exe
  C:\Windows\System\DfWFelz.exe
  2⤵
  PID:7152
- C:\Windows\System\JaSstMd.exe
  C:\Windows\System\JaSstMd.exe
  2⤵
  PID:6072
- C:\Windows\System\QCfSLqi.exe
  C:\Windows\System\QCfSLqi.exe
  2⤵
  PID:6316
- C:\Windows\System\vrTRQmm.exe
  C:\Windows\System\vrTRQmm.exe
  2⤵
  PID:6236
- C:\Windows\System\sUsfNEf.exe
  C:\Windows\System\sUsfNEf.exe
  2⤵
  PID:6336
- C:\Windows\System\RPdocbs.exe
  C:\Windows\System\RPdocbs.exe
  2⤵
  PID:6332
- C:\Windows\System\sEqMWAp.exe
  C:\Windows\System\sEqMWAp.exe
  2⤵
  PID:6428
- C:\Windows\System\KJshzLY.exe
  C:\Windows\System\KJshzLY.exe
  2⤵
  PID:6204
- C:\Windows\System\wBJHpLO.exe
  C:\Windows\System\wBJHpLO.exe
  2⤵
  PID:6524
- C:\Windows\System\knDdLkW.exe
  C:\Windows\System\knDdLkW.exe
  2⤵
  PID:6556
- C:\Windows\System\qnWrhsb.exe
  C:\Windows\System\qnWrhsb.exe
  2⤵
  PID:6616
- C:\Windows\System\NbWdInz.exe
  C:\Windows\System\NbWdInz.exe
  2⤵
  PID:6680
- C:\Windows\System\gnKwklg.exe
  C:\Windows\System\gnKwklg.exe
  2⤵
  PID:6716
- C:\Windows\System\scViqqc.exe
  C:\Windows\System\scViqqc.exe
  2⤵
  PID:6752
- C:\Windows\System\JutSgFb.exe
  C:\Windows\System\JutSgFb.exe
  2⤵
  PID:6632
- C:\Windows\System\FJWAflH.exe
  C:\Windows\System\FJWAflH.exe
  2⤵
  PID:6568
- C:\Windows\System\UyzAZDR.exe
  C:\Windows\System\UyzAZDR.exe
  2⤵
  PID:6508
- C:\Windows\System\qatvBNu.exe
  C:\Windows\System\qatvBNu.exe
  2⤵
  PID:6196
- C:\Windows\System\yXbXbjX.exe
  C:\Windows\System\yXbXbjX.exe
  2⤵
  PID:6884
- C:\Windows\System\WeMbPrb.exe
  C:\Windows\System\WeMbPrb.exe
  2⤵
  PID:6572
- C:\Windows\System\mEfBAUy.exe
  C:\Windows\System\mEfBAUy.exe
  2⤵
  PID:6896
- C:\Windows\System\dRbpsNu.exe
  C:\Windows\System\dRbpsNu.exe
  2⤵
  PID:6900
- C:\Windows\System\tBClcin.exe
  C:\Windows\System\tBClcin.exe
  2⤵
  PID:6732
- C:\Windows\System\lchywzt.exe
  C:\Windows\System\lchywzt.exe
  2⤵
  PID:6984
- C:\Windows\System\nuIbnbB.exe
  C:\Windows\System\nuIbnbB.exe
  2⤵
  PID:7016
- C:\Windows\System\noebSiS.exe
  C:\Windows\System\noebSiS.exe
  2⤵
  PID:7048
- C:\Windows\System\WlehTkm.exe
  C:\Windows\System\WlehTkm.exe
  2⤵
  PID:6996
- C:\Windows\System\xuRGgew.exe
  C:\Windows\System\xuRGgew.exe
  2⤵
  PID:7144
- C:\Windows\System\xnJTIKL.exe
  C:\Windows\System\xnJTIKL.exe
  2⤵
  PID:7128
- C:\Windows\System\eKHTBPy.exe
  C:\Windows\System\eKHTBPy.exe
  2⤵
  PID:7064
- C:\Windows\System\cYQYujV.exe
  C:\Windows\System\cYQYujV.exe
  2⤵
  PID:6928
- C:\Windows\System\jtxmGsd.exe
  C:\Windows\System\jtxmGsd.exe
  2⤵
  PID:6084
- C:\Windows\System\DcVQJTR.exe
  C:\Windows\System\DcVQJTR.exe
  2⤵
  PID:5908
- C:\Windows\System\MhBcqpb.exe
  C:\Windows\System\MhBcqpb.exe
  2⤵
  PID:6164
- C:\Windows\System\RoGMDKt.exe
  C:\Windows\System\RoGMDKt.exe
  2⤵
  PID:6180
- C:\Windows\System\TjVUzKP.exe
  C:\Windows\System\TjVUzKP.exe
  2⤵
  PID:5892
- C:\Windows\System\VZEEOgP.exe
  C:\Windows\System\VZEEOgP.exe
  2⤵
  PID:6220
- C:\Windows\System\KWVfZfX.exe
  C:\Windows\System\KWVfZfX.exe
  2⤵
  PID:6252
- C:\Windows\System\pjAGvcT.exe
  C:\Windows\System\pjAGvcT.exe
  2⤵
  PID:6384
- C:\Windows\System\TZWvRCE.exe
  C:\Windows\System\TZWvRCE.exe
  2⤵
  PID:6424
- C:\Windows\System\kreVvxK.exe
  C:\Windows\System\kreVvxK.exe
  2⤵
  PID:6444
- C:\Windows\System\HdUqOro.exe
  C:\Windows\System\HdUqOro.exe
  2⤵
  PID:6456
- C:\Windows\System\VUHphXp.exe
  C:\Windows\System\VUHphXp.exe
  2⤵
  PID:6748
- C:\Windows\System\pirxfwI.exe
  C:\Windows\System\pirxfwI.exe
  2⤵
  PID:6348
- C:\Windows\System\jBBngNL.exe
  C:\Windows\System\jBBngNL.exe
  2⤵
  PID:6600
- C:\Windows\System\ghkWlUl.exe
  C:\Windows\System\ghkWlUl.exe
  2⤵
  PID:6880
- C:\Windows\System\FnjBRkS.exe
  C:\Windows\System\FnjBRkS.exe
  2⤵
  PID:6768
- C:\Windows\System\yLTVbPE.exe
  C:\Windows\System\yLTVbPE.exe
  2⤵
  PID:6980
- C:\Windows\System\BRBRCXC.exe
  C:\Windows\System\BRBRCXC.exe
  2⤵
  PID:6948
- C:\Windows\System\ChodpMP.exe
  C:\Windows\System\ChodpMP.exe
  2⤵
  PID:6160
- C:\Windows\System\csoAaqA.exe
  C:\Windows\System\csoAaqA.exe
  2⤵
  PID:7140
- C:\Windows\System\hBnLKLp.exe
  C:\Windows\System\hBnLKLp.exe
  2⤵
  PID:4344
- C:\Windows\System\VvPiweN.exe
  C:\Windows\System\VvPiweN.exe
  2⤵
  PID:6172
- C:\Windows\System\jLAuTYx.exe
  C:\Windows\System\jLAuTYx.exe
  2⤵
  PID:6148
- C:\Windows\System\HyMCUnw.exe
  C:\Windows\System\HyMCUnw.exe
  2⤵
  PID:5440
- C:\Windows\System\QAoDpRz.exe
  C:\Windows\System\QAoDpRz.exe
  2⤵
  PID:5984
- C:\Windows\System\oDZVeFB.exe
  C:\Windows\System\oDZVeFB.exe
  2⤵
  PID:6248
- C:\Windows\System\vcacTHO.exe
  C:\Windows\System\vcacTHO.exe
  2⤵
  PID:6440
- C:\Windows\System\ZKrjBMr.exe
  C:\Windows\System\ZKrjBMr.exe
  2⤵
  PID:6460
- C:\Windows\System\XJNceMU.exe
  C:\Windows\System\XJNceMU.exe
  2⤵
  PID:6764
- C:\Windows\System\vQFKEso.exe
  C:\Windows\System\vQFKEso.exe
  2⤵
  PID:6704
- C:\Windows\System\EqoAXMp.exe
  C:\Windows\System\EqoAXMp.exe
  2⤵
  PID:5520
- C:\Windows\System\nNjhzSg.exe
  C:\Windows\System\nNjhzSg.exe
  2⤵
  PID:7044
- C:\Windows\System\hhcJxsL.exe
  C:\Windows\System\hhcJxsL.exe
  2⤵
  PID:6504
- C:\Windows\System\IJTWHtC.exe
  C:\Windows\System\IJTWHtC.exe
  2⤵
  PID:6836
- C:\Windows\System\wbemwzi.exe
  C:\Windows\System\wbemwzi.exe
  2⤵
  PID:7160
- C:\Windows\System\zOdtebo.exe
  C:\Windows\System\zOdtebo.exe
  2⤵
  PID:7108
- C:\Windows\System\WHPrzrG.exe
  C:\Windows\System\WHPrzrG.exe
  2⤵
  PID:5888
- C:\Windows\System\tyjlskM.exe
  C:\Windows\System\tyjlskM.exe
  2⤵
  PID:6552
- C:\Windows\System\bqmuscx.exe
  C:\Windows\System\bqmuscx.exe
  2⤵
  PID:6820
- C:\Windows\System\DGcKobF.exe
  C:\Windows\System\DGcKobF.exe
  2⤵
  PID:6476
- C:\Windows\System\ttEABtk.exe
  C:\Windows\System\ttEABtk.exe
  2⤵
  PID:6804
- C:\Windows\System\offFeKM.exe
  C:\Windows\System\offFeKM.exe
  2⤵
  PID:5584
- C:\Windows\System\XxmNrFt.exe
  C:\Windows\System\XxmNrFt.exe
  2⤵
  PID:6188
- C:\Windows\System\VeufJIm.exe
  C:\Windows\System\VeufJIm.exe
  2⤵
  PID:6736
- C:\Windows\System\lfHexfE.exe
  C:\Windows\System\lfHexfE.exe
  2⤵
  PID:7184
- C:\Windows\System\TMFcsov.exe
  C:\Windows\System\TMFcsov.exe
  2⤵
  PID:7200
- C:\Windows\System\ECzQGRg.exe
  C:\Windows\System\ECzQGRg.exe
  2⤵
  PID:7216
- C:\Windows\System\oJjIqsm.exe
  C:\Windows\System\oJjIqsm.exe
  2⤵
  PID:7236
- C:\Windows\System\LzOfSmA.exe
  C:\Windows\System\LzOfSmA.exe
  2⤵
  PID:7252
- C:\Windows\System\NXiYvON.exe
  C:\Windows\System\NXiYvON.exe
  2⤵
  PID:7268
- C:\Windows\System\tCGLDgO.exe
  C:\Windows\System\tCGLDgO.exe
  2⤵
  PID:7288
- C:\Windows\System\hvfGaxR.exe
  C:\Windows\System\hvfGaxR.exe
  2⤵
  PID:7304
- C:\Windows\System\JrPJoCu.exe
  C:\Windows\System\JrPJoCu.exe
  2⤵
  PID:7320
- C:\Windows\System\cpklvfv.exe
  C:\Windows\System\cpklvfv.exe
  2⤵
  PID:7336
- C:\Windows\System\GAHgWdl.exe
  C:\Windows\System\GAHgWdl.exe
  2⤵
  PID:7352
- C:\Windows\System\GMOoelf.exe
  C:\Windows\System\GMOoelf.exe
  2⤵
  PID:7372
- C:\Windows\System\VFuBuKO.exe
  C:\Windows\System\VFuBuKO.exe
  2⤵
  PID:7388
- C:\Windows\System\dCsrBoJ.exe
  C:\Windows\System\dCsrBoJ.exe
  2⤵
  PID:7404
- C:\Windows\System\xMJURBL.exe
  C:\Windows\System\xMJURBL.exe
  2⤵
  PID:7424
- C:\Windows\System\HClysTm.exe
  C:\Windows\System\HClysTm.exe
  2⤵
  PID:7440
- C:\Windows\System\mfLpZJd.exe
  C:\Windows\System\mfLpZJd.exe
  2⤵
  PID:7456
- C:\Windows\System\IeQNDDG.exe
  C:\Windows\System\IeQNDDG.exe
  2⤵
  PID:7596
- C:\Windows\System\TiHdBin.exe
  C:\Windows\System\TiHdBin.exe
  2⤵
  PID:7616
- C:\Windows\System\mcejaRO.exe
  C:\Windows\System\mcejaRO.exe
  2⤵
  PID:7632
- C:\Windows\System\jZwOyzn.exe
  C:\Windows\System\jZwOyzn.exe
  2⤵
  PID:7652
- C:\Windows\System\pjWrUDh.exe
  C:\Windows\System\pjWrUDh.exe
  2⤵
  PID:7668
- C:\Windows\System\WFQYihE.exe
  C:\Windows\System\WFQYihE.exe
  2⤵
  PID:7688
- C:\Windows\System\ULNRDYt.exe
  C:\Windows\System\ULNRDYt.exe
  2⤵
  PID:7704
- C:\Windows\System\UYHlMhb.exe
  C:\Windows\System\UYHlMhb.exe
  2⤵
  PID:7720
- C:\Windows\System\qXxNgVL.exe
  C:\Windows\System\qXxNgVL.exe
  2⤵
  PID:7740
- C:\Windows\System\wObPuFi.exe
  C:\Windows\System\wObPuFi.exe
  2⤵
  PID:7756
- C:\Windows\System\ropigqT.exe
  C:\Windows\System\ropigqT.exe
  2⤵
  PID:7776
- C:\Windows\System\XZacgNn.exe
  C:\Windows\System\XZacgNn.exe
  2⤵
  PID:7804
- C:\Windows\System\qzakLXk.exe
  C:\Windows\System\qzakLXk.exe
  2⤵
  PID:7820
- C:\Windows\System\LgNdQqK.exe
  C:\Windows\System\LgNdQqK.exe
  2⤵
  PID:7836
- C:\Windows\System\eZnqRmk.exe
  C:\Windows\System\eZnqRmk.exe
  2⤵
  PID:7852
- C:\Windows\System\NhYDRJK.exe
  C:\Windows\System\NhYDRJK.exe
  2⤵
  PID:7868
- C:\Windows\System\JJWAMXM.exe
  C:\Windows\System\JJWAMXM.exe
  2⤵
  PID:7892
- C:\Windows\System\SBITcmN.exe
  C:\Windows\System\SBITcmN.exe
  2⤵
  PID:7908
- C:\Windows\System\BPCXNFD.exe
  C:\Windows\System\BPCXNFD.exe
  2⤵
  PID:7928
- C:\Windows\System\efTItPB.exe
  C:\Windows\System\efTItPB.exe
  2⤵
  PID:7944
- C:\Windows\System\aDqzBnA.exe
  C:\Windows\System\aDqzBnA.exe
  2⤵
  PID:7964
- C:\Windows\System\YQEDgab.exe
  C:\Windows\System\YQEDgab.exe
  2⤵
  PID:7984
- C:\Windows\System\cEMteiv.exe
  C:\Windows\System\cEMteiv.exe
  2⤵
  PID:8000
- C:\Windows\System\NTRtJfG.exe
  C:\Windows\System\NTRtJfG.exe
  2⤵
  PID:8016
- C:\Windows\System\gCVKeDd.exe
  C:\Windows\System\gCVKeDd.exe
  2⤵
  PID:8040
- C:\Windows\System\sZpLxVO.exe
  C:\Windows\System\sZpLxVO.exe
  2⤵
  PID:8060
- C:\Windows\System\sYgiWSh.exe
  C:\Windows\System\sYgiWSh.exe
  2⤵
  PID:8076
- C:\Windows\System\ABikYCR.exe
  C:\Windows\System\ABikYCR.exe
  2⤵
  PID:8096
- C:\Windows\System\IBElTto.exe
  C:\Windows\System\IBElTto.exe
  2⤵
  PID:8116
- C:\Windows\System\qBbYHUO.exe
  C:\Windows\System\qBbYHUO.exe
  2⤵
  PID:8132
- C:\Windows\System\nkBEVNL.exe
  C:\Windows\System\nkBEVNL.exe
  2⤵
  PID:8148
- C:\Windows\System\bRzAbbh.exe
  C:\Windows\System\bRzAbbh.exe
  2⤵
  PID:8164
- C:\Windows\System\xqnZXpn.exe
  C:\Windows\System\xqnZXpn.exe
  2⤵
  PID:8180
- C:\Windows\System\ocrHyJl.exe
  C:\Windows\System\ocrHyJl.exe
  2⤵
  PID:6976
- C:\Windows\System\qhdLRRk.exe
  C:\Windows\System\qhdLRRk.exe
  2⤵
  PID:7176
- C:\Windows\System\Azmxcap.exe
  C:\Windows\System\Azmxcap.exe
  2⤵
  PID:7232
- C:\Windows\System\dYobGqj.exe
  C:\Windows\System\dYobGqj.exe
  2⤵
  PID:7296
- C:\Windows\System\JShoHKj.exe
  C:\Windows\System\JShoHKj.exe
  2⤵
  PID:7312
- C:\Windows\System\FNRNjxI.exe
  C:\Windows\System\FNRNjxI.exe
  2⤵
  PID:7364
- C:\Windows\System\gtOLioA.exe
  C:\Windows\System\gtOLioA.exe
  2⤵
  PID:7316
- C:\Windows\System\vNdFkrm.exe
  C:\Windows\System\vNdFkrm.exe
  2⤵
  PID:7400
- C:\Windows\System\lNRLPCp.exe
  C:\Windows\System\lNRLPCp.exe
  2⤵
  PID:7344
- C:\Windows\System\IiQEBOZ.exe
  C:\Windows\System\IiQEBOZ.exe
  2⤵
  PID:7380
- C:\Windows\System\sBgwmtY.exe
  C:\Windows\System\sBgwmtY.exe
  2⤵
  PID:7472
- C:\Windows\System\sdpFFfW.exe
  C:\Windows\System\sdpFFfW.exe
  2⤵
  PID:7480
- C:\Windows\System\jaJvwua.exe
  C:\Windows\System\jaJvwua.exe
  2⤵
  PID:7496
- C:\Windows\System\QIgcYCZ.exe
  C:\Windows\System\QIgcYCZ.exe
  2⤵
  PID:7512
- C:\Windows\System\gQANnIz.exe
  C:\Windows\System\gQANnIz.exe
  2⤵
  PID:7528
- C:\Windows\System\tOqPADU.exe
  C:\Windows\System\tOqPADU.exe
  2⤵
  PID:7544
- C:\Windows\System\Endarbb.exe
  C:\Windows\System\Endarbb.exe
  2⤵
  PID:7560
- C:\Windows\System\YVPpZXK.exe
  C:\Windows\System\YVPpZXK.exe
  2⤵
  PID:7576
- C:\Windows\System\KFMyndJ.exe
  C:\Windows\System\KFMyndJ.exe
  2⤵
  PID:7660
- C:\Windows\System\tMrAkzY.exe
  C:\Windows\System\tMrAkzY.exe
  2⤵
  PID:7732
- C:\Windows\System\mjVOOun.exe
  C:\Windows\System\mjVOOun.exe
  2⤵
  PID:7644
- C:\Windows\System\VrEKnZu.exe
  C:\Windows\System\VrEKnZu.exe
  2⤵
  PID:7924
- C:\Windows\System\ByOWpIW.exe
  C:\Windows\System\ByOWpIW.exe
  2⤵
  PID:7788
- C:\Windows\System\EkMkvGu.exe
  C:\Windows\System\EkMkvGu.exe
  2⤵
  PID:7860
- C:\Windows\System\rdRwePP.exe
  C:\Windows\System\rdRwePP.exe
  2⤵
  PID:7976
- C:\Windows\System\VVdEQtl.exe
  C:\Windows\System\VVdEQtl.exe
  2⤵
  PID:7796
- C:\Windows\System\ZWMJuXh.exe
  C:\Windows\System\ZWMJuXh.exe
  2⤵
  PID:8036
- C:\Windows\System\IKhzUIn.exe
  C:\Windows\System\IKhzUIn.exe
  2⤵
  PID:8068
- C:\Windows\System\ZGLfjIG.exe
  C:\Windows\System\ZGLfjIG.exe
  2⤵
  PID:8112
- C:\Windows\System\reNUXnK.exe
  C:\Windows\System\reNUXnK.exe
  2⤵
  PID:8176
- C:\Windows\System\FTgStVi.exe
  C:\Windows\System\FTgStVi.exe
  2⤵
  PID:8128
- C:\Windows\System\eDCVOla.exe
  C:\Windows\System\eDCVOla.exe
  2⤵
  PID:8160
- C:\Windows\System\hacBrZj.exe
  C:\Windows\System\hacBrZj.exe
  2⤵
  PID:7180
- C:\Windows\System\yBaUrBw.exe
  C:\Windows\System\yBaUrBw.exe
  2⤵
  PID:7212
- C:\Windows\System\EhIbDYs.exe
  C:\Windows\System\EhIbDYs.exe
  2⤵
  PID:7248
- C:\Windows\System\SJIbUZA.exe
  C:\Windows\System\SJIbUZA.exe
  2⤵
  PID:7416
- C:\Windows\System\KLbGFMn.exe
  C:\Windows\System\KLbGFMn.exe
  2⤵
  PID:7396
- C:\Windows\System\GOlXCfX.exe
  C:\Windows\System\GOlXCfX.exe
  2⤵
  PID:7448
- C:\Windows\System\muHZZzT.exe
  C:\Windows\System\muHZZzT.exe
  2⤵
  PID:7572
- C:\Windows\System\SQwgCGc.exe
  C:\Windows\System\SQwgCGc.exe
  2⤵
  PID:7716
- C:\Windows\System\CcmzmMw.exe
  C:\Windows\System\CcmzmMw.exe
  2⤵
  PID:7768
- C:\Windows\System\DXhoutY.exe
  C:\Windows\System\DXhoutY.exe
  2⤵
  PID:7816
- C:\Windows\System\iwnmaiI.exe
  C:\Windows\System\iwnmaiI.exe
  2⤵
  PID:7880
- C:\Windows\System\kPfLRLp.exe
  C:\Windows\System\kPfLRLp.exe
  2⤵
  PID:7916
- C:\Windows\System\sOtDmRV.exe
  C:\Windows\System\sOtDmRV.exe
  2⤵
  PID:7904
- C:\Windows\System\jljqfHO.exe
  C:\Windows\System\jljqfHO.exe
  2⤵
  PID:8056
- C:\Windows\System\DcsQDZB.exe
  C:\Windows\System\DcsQDZB.exe
  2⤵
  PID:7264
- C:\Windows\System\yCnBEyZ.exe
  C:\Windows\System\yCnBEyZ.exe
  2⤵
  PID:6604
- C:\Windows\System\QphiUaM.exe
  C:\Windows\System\QphiUaM.exe
  2⤵
  PID:7900
- C:\Windows\System\XbEnCym.exe
  C:\Windows\System\XbEnCym.exe
  2⤵
  PID:8104
- C:\Windows\System\TvjwNAF.exe
  C:\Windows\System\TvjwNAF.exe
  2⤵
  PID:8124
- C:\Windows\System\WMbNXMF.exe
  C:\Windows\System\WMbNXMF.exe
  2⤵
  PID:7092
- C:\Windows\System\sEfHCIB.exe
  C:\Windows\System\sEfHCIB.exe
  2⤵
  PID:7568
- C:\Windows\System\PUBYwSh.exe
  C:\Windows\System\PUBYwSh.exe
  2⤵
  PID:7504
- C:\Windows\System\bnBRUUg.exe
  C:\Windows\System\bnBRUUg.exe
  2⤵
  PID:7728
- C:\Windows\System\dZvALAa.exe
  C:\Windows\System\dZvALAa.exe
  2⤵
  PID:7604
- C:\Windows\System\RvsuOIF.exe
  C:\Windows\System\RvsuOIF.exe
  2⤵
  PID:7624
- C:\Windows\System\GjicsWj.exe
  C:\Windows\System\GjicsWj.exe
  2⤵
  PID:7680
- C:\Windows\System\VVAuFQW.exe
  C:\Windows\System\VVAuFQW.exe
  2⤵
  PID:7736
- C:\Windows\System\YnPxxUK.exe
  C:\Windows\System\YnPxxUK.exe
  2⤵
  PID:7812
- C:\Windows\System\mQfOXJA.exe
  C:\Windows\System\mQfOXJA.exe
  2⤵
  PID:8028
- C:\Windows\System\mWsOHAG.exe
  C:\Windows\System\mWsOHAG.exe
  2⤵
  PID:8032
- C:\Windows\System\JfUiouQ.exe
  C:\Windows\System\JfUiouQ.exe
  2⤵
  PID:7828
- C:\Windows\System\mFtXKSo.exe
  C:\Windows\System\mFtXKSo.exe
  2⤵
  PID:7524
- C:\Windows\System\MhSTzDN.exe
  C:\Windows\System\MhSTzDN.exe
  2⤵
  PID:7844
- C:\Windows\System\rELcMME.exe
  C:\Windows\System\rELcMME.exe
  2⤵
  PID:8140
- C:\Windows\System\mFRGANl.exe
  C:\Windows\System\mFRGANl.exe
  2⤵
  PID:7552
- C:\Windows\System\vyPmMwk.exe
  C:\Windows\System\vyPmMwk.exe
  2⤵
  PID:7960
- C:\Windows\System\AfmYvxy.exe
  C:\Windows\System\AfmYvxy.exe
  2⤵
  PID:7540
- C:\Windows\System\QvyxLRB.exe
  C:\Windows\System\QvyxLRB.exe
  2⤵
  PID:7520
- C:\Windows\System\PQMyBgj.exe
  C:\Windows\System\PQMyBgj.exe
  2⤵
  PID:7952
- C:\Windows\System\PyusISS.exe
  C:\Windows\System\PyusISS.exe
  2⤵
  PID:7488
- C:\Windows\System\bMIqHWV.exe
  C:\Windows\System\bMIqHWV.exe
  2⤵
  PID:7920
- C:\Windows\System\zEgfeUX.exe
  C:\Windows\System\zEgfeUX.exe
  2⤵
  PID:8024
- C:\Windows\System\wIKotff.exe
  C:\Windows\System\wIKotff.exe
  2⤵
  PID:7328
- C:\Windows\System\IjNEjKi.exe
  C:\Windows\System\IjNEjKi.exe
  2⤵
  PID:7608
- C:\Windows\System\WwucMXA.exe
  C:\Windows\System\WwucMXA.exe
  2⤵
  PID:8156
- C:\Windows\System\XKztVuz.exe
  C:\Windows\System\XKztVuz.exe
  2⤵
  PID:8196
- C:\Windows\System\VGoTdcW.exe
  C:\Windows\System\VGoTdcW.exe
  2⤵
  PID:8212
- C:\Windows\System\cmOZsxa.exe
  C:\Windows\System\cmOZsxa.exe
  2⤵
  PID:8228
- C:\Windows\System\MtZcbGy.exe
  C:\Windows\System\MtZcbGy.exe
  2⤵
  PID:8248
- C:\Windows\System\LCngcxb.exe
  C:\Windows\System\LCngcxb.exe
  2⤵
  PID:8264
- C:\Windows\System\RuMeztQ.exe
  C:\Windows\System\RuMeztQ.exe
  2⤵
  PID:8280
- C:\Windows\System\ylZYzRq.exe
  C:\Windows\System\ylZYzRq.exe
  2⤵
  PID:8296
- C:\Windows\System\emEUgct.exe
  C:\Windows\System\emEUgct.exe
  2⤵
  PID:8316
- C:\Windows\System\UveSuaS.exe
  C:\Windows\System\UveSuaS.exe
  2⤵
  PID:8332
- C:\Windows\System\IfYSCGr.exe
  C:\Windows\System\IfYSCGr.exe
  2⤵
  PID:8356
- C:\Windows\System\mVvVXdi.exe
  C:\Windows\System\mVvVXdi.exe
  2⤵
  PID:8376
- C:\Windows\System\FjkYECQ.exe
  C:\Windows\System\FjkYECQ.exe
  2⤵
  PID:8392
- C:\Windows\System\TbbIyMo.exe
  C:\Windows\System\TbbIyMo.exe
  2⤵
  PID:8416
- C:\Windows\System\eazpEqI.exe
  C:\Windows\System\eazpEqI.exe
  2⤵
  PID:8432
- C:\Windows\System\SRCYatU.exe
  C:\Windows\System\SRCYatU.exe
  2⤵
  PID:8448
- C:\Windows\System\bqxhlXi.exe
  C:\Windows\System\bqxhlXi.exe
  2⤵
  PID:8464
- C:\Windows\System\kKqKVFE.exe
  C:\Windows\System\kKqKVFE.exe
  2⤵
  PID:8480
- C:\Windows\System\XLRBWMx.exe
  C:\Windows\System\XLRBWMx.exe
  2⤵
  PID:8496
- C:\Windows\System\mxPYxaE.exe
  C:\Windows\System\mxPYxaE.exe
  2⤵
  PID:8512
- C:\Windows\System\ThKonve.exe
  C:\Windows\System\ThKonve.exe
  2⤵
  PID:8528
- C:\Windows\System\ZcpUYeM.exe
  C:\Windows\System\ZcpUYeM.exe
  2⤵
  PID:8544
- C:\Windows\System\QgpkXmA.exe
  C:\Windows\System\QgpkXmA.exe
  2⤵
  PID:8560
- C:\Windows\System\QmLgegm.exe
  C:\Windows\System\QmLgegm.exe
  2⤵
  PID:8576
- C:\Windows\System\omsUtnW.exe
  C:\Windows\System\omsUtnW.exe
  2⤵
  PID:8612
- C:\Windows\System\JYeCect.exe
  C:\Windows\System\JYeCect.exe
  2⤵
  PID:8632
- C:\Windows\System\vyDTiho.exe
  C:\Windows\System\vyDTiho.exe
  2⤵
  PID:8652
- C:\Windows\System\XifbHni.exe
  C:\Windows\System\XifbHni.exe
  2⤵
  PID:8668
- C:\Windows\System\QrTHjNI.exe
  C:\Windows\System\QrTHjNI.exe
  2⤵
  PID:8684
- C:\Windows\System\pEEhzDe.exe
  C:\Windows\System\pEEhzDe.exe
  2⤵
  PID:8700
- C:\Windows\System\WvtVmcd.exe
  C:\Windows\System\WvtVmcd.exe
  2⤵
  PID:8716
- C:\Windows\System\DGGfJAh.exe
  C:\Windows\System\DGGfJAh.exe
  2⤵
  PID:8752
- C:\Windows\System\goUvRMt.exe
  C:\Windows\System\goUvRMt.exe
  2⤵
  PID:8788
- C:\Windows\System\AQVIrxn.exe
  C:\Windows\System\AQVIrxn.exe
  2⤵
  PID:8804
- C:\Windows\System\vuAzxoh.exe
  C:\Windows\System\vuAzxoh.exe
  2⤵
  PID:8820
- C:\Windows\System\sdXvAkg.exe
  C:\Windows\System\sdXvAkg.exe
  2⤵
  PID:8836
- C:\Windows\System\qMchPMS.exe
  C:\Windows\System\qMchPMS.exe
  2⤵
  PID:8852
- C:\Windows\System\TaVFnSJ.exe
  C:\Windows\System\TaVFnSJ.exe
  2⤵
  PID:8868
- C:\Windows\System\sehgQXA.exe
  C:\Windows\System\sehgQXA.exe
  2⤵
  PID:8884
- C:\Windows\System\HFawzHF.exe
  C:\Windows\System\HFawzHF.exe
  2⤵
  PID:8900
- C:\Windows\System\juhSdlf.exe
  C:\Windows\System\juhSdlf.exe
  2⤵
  PID:8920
- C:\Windows\System\HLoekRj.exe
  C:\Windows\System\HLoekRj.exe
  2⤵
  PID:8936
- C:\Windows\System\DsBYfog.exe
  C:\Windows\System\DsBYfog.exe
  2⤵
  PID:8952
- C:\Windows\System\MPPZdRp.exe
  C:\Windows\System\MPPZdRp.exe
  2⤵
  PID:8968
- C:\Windows\System\iUvgBIM.exe
  C:\Windows\System\iUvgBIM.exe
  2⤵
  PID:8988
- C:\Windows\System\PoMcHBb.exe
  C:\Windows\System\PoMcHBb.exe
  2⤵
  PID:9100
- C:\Windows\System\dBYlsAr.exe
  C:\Windows\System\dBYlsAr.exe
  2⤵
  PID:9120
- C:\Windows\System\VlXSGjL.exe
  C:\Windows\System\VlXSGjL.exe
  2⤵
  PID:9136
- C:\Windows\System\yINTYdy.exe
  C:\Windows\System\yINTYdy.exe
  2⤵
  PID:9152
- C:\Windows\System\FEcpchE.exe
  C:\Windows\System\FEcpchE.exe
  2⤵
  PID:9168
- C:\Windows\System\KTIXNJf.exe
  C:\Windows\System\KTIXNJf.exe
  2⤵
  PID:9188
- C:\Windows\System\KnNTyzK.exe
  C:\Windows\System\KnNTyzK.exe
  2⤵
  PID:9204
- C:\Windows\System\AWGzGIU.exe
  C:\Windows\System\AWGzGIU.exe
  2⤵
  PID:8220
- C:\Windows\System\rTwrzGK.exe
  C:\Windows\System\rTwrzGK.exe
  2⤵
  PID:8256
- C:\Windows\System\tqtAPWZ.exe
  C:\Windows\System\tqtAPWZ.exe
  2⤵
  PID:7832
- C:\Windows\System\ZTjpbtP.exe
  C:\Windows\System\ZTjpbtP.exe
  2⤵
  PID:8328
- C:\Windows\System\ZZTuagK.exe
  C:\Windows\System\ZZTuagK.exe
  2⤵
  PID:8400
- C:\Windows\System\bdjOgPY.exe
  C:\Windows\System\bdjOgPY.exe
  2⤵
  PID:8440
- C:\Windows\System\hlpzEUP.exe
  C:\Windows\System\hlpzEUP.exe
  2⤵
  PID:8272
- C:\Windows\System\aNfhwdL.exe
  C:\Windows\System\aNfhwdL.exe
  2⤵
  PID:8312
- C:\Windows\System\SmNpaQv.exe
  C:\Windows\System\SmNpaQv.exe
  2⤵
  PID:8444
- C:\Windows\System\sfiOsut.exe
  C:\Windows\System\sfiOsut.exe
  2⤵
  PID:8348
- C:\Windows\System\TjhZtqB.exe
  C:\Windows\System\TjhZtqB.exe
  2⤵
  PID:8428
- C:\Windows\System\xMOBOeW.exe
  C:\Windows\System\xMOBOeW.exe
  2⤵
  PID:8460
- C:\Windows\System\yLDMUnS.exe
  C:\Windows\System\yLDMUnS.exe
  2⤵
  PID:8736
- C:\Windows\System\iPsHcvY.exe
  C:\Windows\System\iPsHcvY.exe
  2⤵
  PID:8768
- C:\Windows\System\QGLLzTr.exe
  C:\Windows\System\QGLLzTr.exe
  2⤵
  PID:8760
- C:\Windows\System\isWpMGF.exe
  C:\Windows\System\isWpMGF.exe
  2⤵
  PID:8784
- C:\Windows\System\UiaooOs.exe
  C:\Windows\System\UiaooOs.exe
  2⤵
  PID:8844
- C:\Windows\System\UKymmvd.exe
  C:\Windows\System\UKymmvd.exe
  2⤵
  PID:8932
- C:\Windows\System\sLwzMGX.exe
  C:\Windows\System\sLwzMGX.exe
  2⤵
  PID:8916
- C:\Windows\System\OGUdAIg.exe
  C:\Windows\System\OGUdAIg.exe
  2⤵
  PID:8960
- C:\Windows\System\IHywzJg.exe
  C:\Windows\System\IHywzJg.exe
  2⤵
  PID:9004
- C:\Windows\System\cKtwvNh.exe
  C:\Windows\System\cKtwvNh.exe
  2⤵
  PID:9016
- C:\Windows\System\aNmUjoV.exe
  C:\Windows\System\aNmUjoV.exe
  2⤵
  PID:9044
- C:\Windows\System\qnxSfAT.exe
  C:\Windows\System\qnxSfAT.exe
  2⤵
  PID:9060
- C:\Windows\System\uAcuAsx.exe
  C:\Windows\System\uAcuAsx.exe
  2⤵
  PID:9080
- C:\Windows\System\medihHc.exe
  C:\Windows\System\medihHc.exe
  2⤵
  PID:9096
- C:\Windows\System\qKXGAbm.exe
  C:\Windows\System\qKXGAbm.exe
  2⤵
  PID:8304
- C:\Windows\System\sdZpmrJ.exe
  C:\Windows\System\sdZpmrJ.exe
  2⤵
  PID:8208
- C:\Windows\System\vPRZgFT.exe
  C:\Windows\System\vPRZgFT.exe
  2⤵
  PID:7196
- C:\Windows\System\pFtdJZy.exe
  C:\Windows\System\pFtdJZy.exe
  2⤵
  PID:8240
- C:\Windows\System\CChnTmJ.exe
  C:\Windows\System\CChnTmJ.exe
  2⤵
  PID:8536
- C:\Windows\System\oFjmAXS.exe
  C:\Windows\System\oFjmAXS.exe
  2⤵
  PID:8592
- C:\Windows\System\GERtReZ.exe
  C:\Windows\System\GERtReZ.exe
  2⤵
  PID:8584
- C:\Windows\System\CZETlKo.exe
  C:\Windows\System\CZETlKo.exe
  2⤵
  PID:8604
- C:\Windows\System\VvYGRWs.exe
  C:\Windows\System\VvYGRWs.exe
  2⤵
  PID:8708
- C:\Windows\System\dMHtfZr.exe
  C:\Windows\System\dMHtfZr.exe
  2⤵
  PID:8748
- C:\Windows\System\gLlkwxr.exe
  C:\Windows\System\gLlkwxr.exe
  2⤵
  PID:8728
- C:\Windows\System\UmNdBmK.exe
  C:\Windows\System\UmNdBmK.exe
  2⤵
  PID:8860
- C:\Windows\System\BzCwzDj.exe
  C:\Windows\System\BzCwzDj.exe
  2⤵
  PID:8812
- C:\Windows\System\nZFLBLx.exe
  C:\Windows\System\nZFLBLx.exe
  2⤵
  PID:8896
- C:\Windows\System\XtExTQQ.exe
  C:\Windows\System\XtExTQQ.exe
  2⤵
  PID:9052
- C:\Windows\System\JaudxpF.exe
  C:\Windows\System\JaudxpF.exe
  2⤵
  PID:9092
- C:\Windows\System\hGtcQow.exe
  C:\Windows\System\hGtcQow.exe
  2⤵
  PID:9040
- C:\Windows\System\ZttEUPd.exe
  C:\Windows\System\ZttEUPd.exe
  2⤵
  PID:7476
- C:\Windows\System\FdOijSf.exe
  C:\Windows\System\FdOijSf.exe
  2⤵
  PID:8244
- C:\Windows\System\xnUOttU.exe
  C:\Windows\System\xnUOttU.exe
  2⤵
  PID:8552
- C:\Windows\System\NJytfkP.exe
  C:\Windows\System\NJytfkP.exe
  2⤵
  PID:8504
- C:\Windows\System\lGWdIBz.exe
  C:\Windows\System\lGWdIBz.exe
  2⤵
  PID:8744
- C:\Windows\System\dmbAXcj.exe
  C:\Windows\System\dmbAXcj.exe
  2⤵
  PID:8344
- C:\Windows\System\haWazya.exe
  C:\Windows\System\haWazya.exe
  2⤵
  PID:8644
- C:\Windows\System\cxsNIXK.exe
  C:\Windows\System\cxsNIXK.exe
  2⤵
  PID:8624
- C:\Windows\System\AlpktEj.exe
  C:\Windows\System\AlpktEj.exe
  2⤵
  PID:8620
- C:\Windows\System\MhOvMnf.exe
  C:\Windows\System\MhOvMnf.exe
  2⤵
  PID:8692
- C:\Windows\System\XOwmGJz.exe
  C:\Windows\System\XOwmGJz.exe
  2⤵
  PID:8980
- C:\Windows\System\pnjpCDR.exe
  C:\Windows\System\pnjpCDR.exe
  2⤵
  PID:8864
- C:\Windows\System\FRbAvlR.exe
  C:\Windows\System\FRbAvlR.exe
  2⤵
  PID:9072
- C:\Windows\System\YlAUzGe.exe
  C:\Windows\System\YlAUzGe.exe
  2⤵
  PID:8984
- C:\Windows\System\FKFwVjb.exe
  C:\Windows\System\FKFwVjb.exe
  2⤵
  PID:9164
- C:\Windows\System\OcQgFFa.exe
  C:\Windows\System\OcQgFFa.exe
  2⤵
  PID:8224
- C:\Windows\System\BSRgZtn.exe
  C:\Windows\System\BSRgZtn.exe
  2⤵
  PID:8292
- C:\Windows\System\TqzDYVW.exe
  C:\Windows\System\TqzDYVW.exe
  2⤵
  PID:9180
- C:\Windows\System\AFpQTUF.exe
  C:\Windows\System\AFpQTUF.exe
  2⤵
  PID:7764
- C:\Windows\System\hoTGKbQ.exe
  C:\Windows\System\hoTGKbQ.exe
  2⤵
  PID:8680
- C:\Windows\System\TCtuJsF.exe
  C:\Windows\System\TCtuJsF.exe
  2⤵
  PID:8816
- C:\Windows\System\sLQvLJa.exe
  C:\Windows\System\sLQvLJa.exe
  2⤵
  PID:9028
- C:\Windows\System\ZBFltEB.exe
  C:\Windows\System\ZBFltEB.exe
  2⤵
  PID:9112
- C:\Windows\System\oLCCEpA.exe
  C:\Windows\System\oLCCEpA.exe
  2⤵
  PID:8676
- C:\Windows\System\aUglJjC.exe
  C:\Windows\System\aUglJjC.exe
  2⤵
  PID:9220
- C:\Windows\System\UtYkCST.exe
  C:\Windows\System\UtYkCST.exe
  2⤵
  PID:9236
- C:\Windows\System\BvmIQqi.exe
  C:\Windows\System\BvmIQqi.exe
  2⤵
  PID:9252
- C:\Windows\System\UDqvIzE.exe
  C:\Windows\System\UDqvIzE.exe
  2⤵
  PID:9268
- C:\Windows\System\XZqdYzR.exe
  C:\Windows\System\XZqdYzR.exe
  2⤵
  PID:9284
- C:\Windows\System\QQHwart.exe
  C:\Windows\System\QQHwart.exe
  2⤵
  PID:9300
- C:\Windows\System\vcgXtbp.exe
  C:\Windows\System\vcgXtbp.exe
  2⤵
  PID:9316
- C:\Windows\System\fxxPQui.exe
  C:\Windows\System\fxxPQui.exe
  2⤵
  PID:9332
- C:\Windows\System\ZtXGsEJ.exe
  C:\Windows\System\ZtXGsEJ.exe
  2⤵
  PID:9348
- C:\Windows\System\tVmOJHq.exe
  C:\Windows\System\tVmOJHq.exe
  2⤵
  PID:9364
- C:\Windows\System\NgVtiGI.exe
  C:\Windows\System\NgVtiGI.exe
  2⤵
  PID:9380
- C:\Windows\System\NQJXZSV.exe
  C:\Windows\System\NQJXZSV.exe
  2⤵
  PID:9396
- C:\Windows\System\NfMThsm.exe
  C:\Windows\System\NfMThsm.exe
  2⤵
  PID:9412
- C:\Windows\System\YuDvIlc.exe
  C:\Windows\System\YuDvIlc.exe
  2⤵
  PID:9428
- C:\Windows\System\gKEmBBY.exe
  C:\Windows\System\gKEmBBY.exe
  2⤵
  PID:9444
- C:\Windows\System\yIJoXlB.exe
  C:\Windows\System\yIJoXlB.exe
  2⤵
  PID:9460
- C:\Windows\System\XCZrTKg.exe
  C:\Windows\System\XCZrTKg.exe
  2⤵
  PID:9480
- C:\Windows\System\PFSbueN.exe
  C:\Windows\System\PFSbueN.exe
  2⤵
  PID:9496
- C:\Windows\System\sIVByCz.exe
  C:\Windows\System\sIVByCz.exe
  2⤵
  PID:9512
- C:\Windows\System\VwWAIdo.exe
  C:\Windows\System\VwWAIdo.exe
  2⤵
  PID:9528
- C:\Windows\System\wvGYXet.exe
  C:\Windows\System\wvGYXet.exe
  2⤵
  PID:9544
- C:\Windows\System\IxSbqSA.exe
  C:\Windows\System\IxSbqSA.exe
  2⤵
  PID:9560
- C:\Windows\System\sLGScat.exe
  C:\Windows\System\sLGScat.exe
  2⤵
  PID:9576
- C:\Windows\System\XJMkvZP.exe
  C:\Windows\System\XJMkvZP.exe
  2⤵
  PID:9592
- C:\Windows\System\fbiPQIR.exe
  C:\Windows\System\fbiPQIR.exe
  2⤵
  PID:9608
- C:\Windows\System\pJRcSWO.exe
  C:\Windows\System\pJRcSWO.exe
  2⤵
  PID:9624
- C:\Windows\System\roslGmj.exe
  C:\Windows\System\roslGmj.exe
  2⤵
  PID:9640
- C:\Windows\System\MeUYwgH.exe
  C:\Windows\System\MeUYwgH.exe
  2⤵
  PID:9656
- C:\Windows\System\JPDjEvy.exe
  C:\Windows\System\JPDjEvy.exe
  2⤵
  PID:9672
- C:\Windows\System\saRqVLe.exe
  C:\Windows\System\saRqVLe.exe
  2⤵
  PID:9688
- C:\Windows\System\kDKsdNW.exe
  C:\Windows\System\kDKsdNW.exe
  2⤵
  PID:9704
- C:\Windows\System\OFEsBkf.exe
  C:\Windows\System\OFEsBkf.exe
  2⤵
  PID:9720
- C:\Windows\System\ztJTdgM.exe
  C:\Windows\System\ztJTdgM.exe
  2⤵
  PID:9736
- C:\Windows\System\qaAKsvA.exe
  C:\Windows\System\qaAKsvA.exe
  2⤵
  PID:9752
- C:\Windows\System\DcYVqnS.exe
  C:\Windows\System\DcYVqnS.exe
  2⤵
  PID:9772
- C:\Windows\System\ujgjtgm.exe
  C:\Windows\System\ujgjtgm.exe
  2⤵
  PID:9788
- C:\Windows\System\ZWeDETu.exe
  C:\Windows\System\ZWeDETu.exe
  2⤵
  PID:9804
- C:\Windows\System\CaXPBUQ.exe
  C:\Windows\System\CaXPBUQ.exe
  2⤵
  PID:9820
- C:\Windows\System\DlofuuS.exe
  C:\Windows\System\DlofuuS.exe
  2⤵
  PID:9836
- C:\Windows\System\ZYBMQZX.exe
  C:\Windows\System\ZYBMQZX.exe
  2⤵
  PID:9852
- C:\Windows\System\QElRpUf.exe
  C:\Windows\System\QElRpUf.exe
  2⤵
  PID:9868
- C:\Windows\System\NrLcGPB.exe
  C:\Windows\System\NrLcGPB.exe
  2⤵
  PID:9884
- C:\Windows\System\KuwVFjD.exe
  C:\Windows\System\KuwVFjD.exe
  2⤵
  PID:9900
- C:\Windows\System\NJUFxHB.exe
  C:\Windows\System\NJUFxHB.exe
  2⤵
  PID:9916
- C:\Windows\System\QIgpJGk.exe
  C:\Windows\System\QIgpJGk.exe
  2⤵
  PID:9932
- C:\Windows\System\rFjhuJX.exe
  C:\Windows\System\rFjhuJX.exe
  2⤵
  PID:9948
- C:\Windows\System\FrVmcxk.exe
  C:\Windows\System\FrVmcxk.exe
  2⤵
  PID:9964
- C:\Windows\System\pgMnStQ.exe
  C:\Windows\System\pgMnStQ.exe
  2⤵
  PID:9980
- C:\Windows\System\VBSINyW.exe
  C:\Windows\System\VBSINyW.exe
  2⤵
  PID:9996
- C:\Windows\System\beDYiks.exe
  C:\Windows\System\beDYiks.exe
  2⤵
  PID:10012
- C:\Windows\System\TxNaLuX.exe
  C:\Windows\System\TxNaLuX.exe
  2⤵
  PID:10028
- C:\Windows\System\VAFlWLr.exe
  C:\Windows\System\VAFlWLr.exe
  2⤵
  PID:10044
- C:\Windows\System\oiuiehN.exe
  C:\Windows\System\oiuiehN.exe
  2⤵
  PID:10060
- C:\Windows\System\qmWcyxn.exe
  C:\Windows\System\qmWcyxn.exe
  2⤵
  PID:10076
- C:\Windows\System\ueOVUed.exe
  C:\Windows\System\ueOVUed.exe
  2⤵
  PID:10092
- C:\Windows\System\rkicRop.exe
  C:\Windows\System\rkicRop.exe
  2⤵
  PID:10108
- C:\Windows\System\GykTesa.exe
  C:\Windows\System\GykTesa.exe
  2⤵
  PID:10124
- C:\Windows\System\mpApJtv.exe
  C:\Windows\System\mpApJtv.exe
  2⤵
  PID:10140
- C:\Windows\System\sGrkQQW.exe
  C:\Windows\System\sGrkQQW.exe
  2⤵
  PID:10160
- C:\Windows\System\RDKozZe.exe
  C:\Windows\System\RDKozZe.exe
  2⤵
  PID:10176
- C:\Windows\System\yugAMEx.exe
  C:\Windows\System\yugAMEx.exe
  2⤵
  PID:9276
- C:\Windows\System\ZnLNDRX.exe
  C:\Windows\System\ZnLNDRX.exe
  2⤵
  PID:8476
- C:\Windows\System\wQcJFip.exe
  C:\Windows\System\wQcJFip.exe
  2⤵
  PID:8732
- C:\Windows\System\jrIxXKb.exe
  C:\Windows\System\jrIxXKb.exe
  2⤵
  PID:8568
- C:\Windows\System\EVaFIyg.exe
  C:\Windows\System\EVaFIyg.exe
  2⤵
  PID:8764
- C:\Windows\System\SWXbyQK.exe
  C:\Windows\System\SWXbyQK.exe
  2⤵
  PID:8892
- C:\Windows\System\gtmyWPY.exe
  C:\Windows\System\gtmyWPY.exe
  2⤵
  PID:8996
- C:\Windows\System\iXZmHOi.exe
  C:\Windows\System\iXZmHOi.exe
  2⤵
  PID:8628
- C:\Windows\System\arFAExg.exe
  C:\Windows\System\arFAExg.exe
  2⤵
  PID:9536
- C:\Windows\System\TlqIpUx.exe
  C:\Windows\System\TlqIpUx.exe
  2⤵
  PID:9520
- C:\Windows\System\sCNKXVy.exe
  C:\Windows\System\sCNKXVy.exe
  2⤵
  PID:9600
- C:\Windows\System\jvuZVZu.exe
  C:\Windows\System\jvuZVZu.exe
  2⤵
  PID:9360
- C:\Windows\System\qmKHHHH.exe
  C:\Windows\System\qmKHHHH.exe
  2⤵
  PID:9488
- C:\Windows\System\OcNblKD.exe
  C:\Windows\System\OcNblKD.exe
  2⤵
  PID:9588
- C:\Windows\System\EBwUFSz.exe
  C:\Windows\System\EBwUFSz.exe
  2⤵
  PID:9616
- C:\Windows\System\NguIXpY.exe
  C:\Windows\System\NguIXpY.exe
  2⤵
  PID:9652
- C:\Windows\System\LwGxpZz.exe
  C:\Windows\System\LwGxpZz.exe
  2⤵
  PID:9680
- C:\Windows\System\ZKCUyYI.exe
  C:\Windows\System\ZKCUyYI.exe
  2⤵
  PID:9732
- C:\Windows\System\hxVSkfp.exe
  C:\Windows\System\hxVSkfp.exe
  2⤵
  PID:9780
- C:\Windows\System\mMAKRiy.exe
  C:\Windows\System\mMAKRiy.exe
  2⤵
  PID:9796
- C:\Windows\System\smGyUNg.exe
  C:\Windows\System\smGyUNg.exe
  2⤵
  PID:10036
- C:\Windows\System\hRaZBXe.exe
  C:\Windows\System\hRaZBXe.exe
  2⤵
  PID:8408
- C:\Windows\System\oriwwVI.exe
  C:\Windows\System\oriwwVI.exe
  2⤵
  PID:9176
- C:\Windows\System\WKlsGKB.exe
  C:\Windows\System\WKlsGKB.exe
  2⤵
  PID:9340
- C:\Windows\System\lUOGjUx.exe
  C:\Windows\System\lUOGjUx.exe
  2⤵
  PID:9404
- C:\Windows\System\dFoyODn.exe
  C:\Windows\System\dFoyODn.exe
  2⤵
  PID:9468
- C:\Windows\System\IKVleML.exe
  C:\Windows\System\IKVleML.exe
  2⤵
  PID:9508
- C:\Windows\System\UQnqvhb.exe
  C:\Windows\System\UQnqvhb.exe
  2⤵
  PID:9424
- C:\Windows\System\mKHKUeT.exe
  C:\Windows\System\mKHKUeT.exe
  2⤵
  PID:9684
- C:\Windows\System\eynWxYl.exe
  C:\Windows\System\eynWxYl.exe
  2⤵
  PID:9452
- C:\Windows\System\UDxtWdP.exe
  C:\Windows\System\UDxtWdP.exe
  2⤵
  PID:9664
- C:\Windows\System\ocivqqR.exe
  C:\Windows\System\ocivqqR.exe
  2⤵
  PID:9728
- C:\Windows\System\jKpWjnm.exe
  C:\Windows\System\jKpWjnm.exe
  2⤵
  PID:9568
- C:\Windows\System\jkeEUdv.exe
  C:\Windows\System\jkeEUdv.exe
  2⤵
  PID:9892
- C:\Windows\System\xPXITRo.exe
  C:\Windows\System\xPXITRo.exe
  2⤵
  PID:10104
- C:\Windows\System\rMAMjjY.exe
  C:\Windows\System\rMAMjjY.exe
  2⤵
  PID:4708
- C:\Windows\System\dJXWCtz.exe
  C:\Windows\System\dJXWCtz.exe
  2⤵
  PID:9908
- C:\Windows\System\zmzPAIb.exe
  C:\Windows\System\zmzPAIb.exe
  2⤵
  PID:8384
- C:\Windows\System\CVJqggN.exe
  C:\Windows\System\CVJqggN.exe
  2⤵
  PID:10196
- C:\Windows\System\BXlJWZb.exe
  C:\Windows\System\BXlJWZb.exe
  2⤵
  PID:10156
- C:\Windows\System\BJOBqHz.exe
  C:\Windows\System\BJOBqHz.exe
  2⤵
  PID:10228
- C:\Windows\System\oQOdNVW.exe
  C:\Windows\System\oQOdNVW.exe
  2⤵
  PID:9944
- C:\Windows\System\PTIUsjr.exe
  C:\Windows\System\PTIUsjr.exe
  2⤵
  PID:9992
- C:\Windows\System\hKHJqdl.exe
  C:\Windows\System\hKHJqdl.exe
  2⤵
  PID:10024
- C:\Windows\System\LyrffeB.exe
  C:\Windows\System\LyrffeB.exe
  2⤵
  PID:9308
- C:\Windows\System\zfkQMJN.exe
  C:\Windows\System\zfkQMJN.exe
  2⤵
  PID:10184
- C:\Windows\System\rxZoEyu.exe
  C:\Windows\System\rxZoEyu.exe
  2⤵
  PID:9244
- C:\Windows\System\AHFIbxt.exe
  C:\Windows\System\AHFIbxt.exe
  2⤵
  PID:9388
- C:\Windows\System\VvBPxTK.exe
  C:\Windows\System\VvBPxTK.exe
  2⤵
  PID:10192
- C:\Windows\System\uvdxDTX.exe
  C:\Windows\System\uvdxDTX.exe
  2⤵
  PID:9584
- C:\Windows\System\ffYdthT.exe
  C:\Windows\System\ffYdthT.exe
  2⤵
  PID:10212
- C:\Windows\System\neZpTVM.exe
  C:\Windows\System\neZpTVM.exe
  2⤵
  PID:9160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AQtazqP.exe

Filesize
1.7MB

MD5
b5fa6b5557c2fd8e3552e05af3d0adb1

SHA1
fd507a70c0486d914bef8052700fe489a6aa50eb

SHA256
d0a00b7eebbadfede9b4e687a676e0563cb98799c74951706e65c337050e3681

SHA512
0e37d23cb028bad46a5e49462e2efd7758ec678c8727e10bb482fac30173ab55de42d07a9791f4580248e3dff3baab0e83a9ad326438caf508537195e3351a2c

Download Submit
C:\Windows\system\AwqLOdD.exe

Filesize
1.7MB

MD5
92c0df6268a33c019bc76a55f9337fb1

SHA1
8b21f84a77d510563f96ddebe375a92503aa7073

SHA256
225e51bf5e1634a89ab1c8cfe078b88cf910716adf71c862c8e7a166ddd96fb9

SHA512
af2b2af1bf9b21551e9826f5bff9ab8882256f1bbcfbe5035a1f51803c38f28c24781dcda584ac989a2a273d3a011b2625befdf22f3e2f457154d641750f084e

Download Submit
C:\Windows\system\BaRGpMc.exe

Filesize
1.7MB

MD5
5a3774c64952a71d763155f32db66a7a

SHA1
f181ad029bf68ef1fe525f448f8ffed3e1537d47

SHA256
b96ea16c118a41544f14fe45c2d2cd7a3b5bc8dca2f47d5840982d078a92dec3

SHA512
5d87a522a12dc601f4ea85466dfda4aee3fee0e89b305a9b1f5306297787176d861de39d749b521dded9166f7e72ec9da0ec636f8a0cb65cb2ff372dfe1c2664

Download Submit
C:\Windows\system\BjroAEy.exe

Filesize
1.7MB

MD5
2f6110390d034906751d39baf255b4a1

SHA1
4554811e8d4025a93d24ea5ca0415371949ff80f

SHA256
c6762ff558ee9dda5d4542ef7d1b8ed5c5cf61cb1eabbf1a9619c16a5855b81a

SHA512
65689d89464b06ec132fd327593f0ad0658d426df5a3a36e0fbca0a71356d2136d1dcae4de1de37bf683fea869ac109975e779eb824117b93318d3a31626af5c

Download Submit
C:\Windows\system\ITjaxTG.exe

Filesize
1.7MB

MD5
b387ee8c4be9a731b35651713f564b40

SHA1
d7cf00b71a338b4dd5a61355388dd4f34c63a4e2

SHA256
8502b04e491940828f2cc8f298cb40c4e1e1b4d06d0b918d4bf5c2f0ffde6732

SHA512
9a7995414b1e4c62fadddffdbf35c75327055d8590ef4882b33eeff5fa840fa5fe6294544291d70ef92b73c635f40f84c87064d012fc06ac7c3e5dbfc76cbbd9

Download Submit
C:\Windows\system\JeRQEcF.exe

Filesize
1.7MB

MD5
f593a898a46c7a48acac26c8942aae90

SHA1
a5d153a1796f74b5469735463806560ad42b4f8b

SHA256
0e0c7f91612909b3be07750aa158c0d132298b7c9dcf78f478557a8f8ee10865

SHA512
7c0fa7f87758fe88c799c492aea5d65112593fc34f965553e9dab8dfadff1ae695fa8e970cead754aa6ef842a0ba4029dc0bca96cf70118ae6d5d177217113f4

Download Submit
C:\Windows\system\LGgDJTp.exe

Filesize
1.7MB

MD5
3b56e8c877313f826fed44154f873040

SHA1
149473f684508957d31c888b1663ff5c74b956ac

SHA256
a24d80c001088be432a14023f8098e3cc19078308ad5d0fbc3ba2658815dde83

SHA512
063da21307f1fdc007f8f8d1121e12a36e7de456d72a599cf11d614a10f582a54d06b9eeee9b80e33a6bfce9e1d77b7e527f254227f34b6f86ca89f493590d4f

Download Submit
C:\Windows\system\OSgRjTB.exe

Filesize
1.7MB

MD5
cfc8bfddc36eafe50d79f80fae1767a4

SHA1
9806957e7f41d0931b4f0cb50ab71490794cad4e

SHA256
1f0d53c5dc5eb3318782523a04e5b1f57aa7f66e1a3da9e80e3bcd3aff2d0973

SHA512
f568a2246a0407b408859733519e59b4fee3dd5dc9638f06558ed27acbadbcdd55f310e0096c62c4b7643568ab99470e1d8912b1a2309d31e0b1989d80bf160b

Download Submit
C:\Windows\system\PENugUB.exe

Filesize
1.7MB

MD5
a17110dfffe48e329d3cd67e83f21f31

SHA1
f2eb2039a9827132156c8889d02ffc2c2975aef1

SHA256
dbf4d04e1eebfd6701a67b08542086c4d0a4b84993ce85ec7ec86394a19cb914

SHA512
8bbc24d2506ae854abaf7e8fe09fb4f6c78147cc10fcc6e504b41da6764bd9d1ff569e87d4fbad21f4d3c0be89bffcfc80b1b53c0916d3a7508e34691787a602

Download Submit
C:\Windows\system\PQXuJPG.exe

Filesize
1.7MB

MD5
ec5cb02cc8d69945dc04a731b01e71c7

SHA1
dcdb6a5429b85fc02d536727b71fddda4ac53a44

SHA256
865630a8c56aa8354e4b439f97032b099fdf6b25c663aa46456ccde4be30597a

SHA512
b33f4fa4a0e6de5def2b714e6161e6d427c6115f46a3b04c7d57374ae38bb66df04253cc865adecb1e987cf1527713f753e0d04d0eaf0e6dd3f0d4dc075887aa

Download Submit
C:\Windows\system\TxowLuM.exe

Filesize
1.7MB

MD5
d4a9c905cdf0a999c13c2f41a552540c

SHA1
9ecbf288315e269a1505b59f9d58ed1a9004726b

SHA256
57c7b913514caee59c91a850d85af8a3fad77b0218570e3c2a0cd8e9299e7cbe

SHA512
9eaee612bd1aaa764d1bb86eafb859601a547f25592baf2cd1f66e22c66b5fffb0ad86e6f7606e94ecbabb6ce9b7148d73d2c4558cfc433ca3c8de0b76128cea

Download Submit
C:\Windows\system\UCTaSZi.exe

Filesize
1.7MB

MD5
a869498a0a02d9d1265f75c3c7b7ae72

SHA1
bc02bb5b6316265550e8e4dcdab4a340d36f0c60

SHA256
3caad70774643cda712f0a83d1419e87942f7c7ebe77315eb39c6bbb50a95e15

SHA512
06f4194c3a90495695ca932f4d0f1c143fa5c3d143df22eede91ee42850a5f2a4bd13fb29303b1e1f7efbdf70b8b5e13264da35092ec9c009304edd6b9325d01

Download Submit
C:\Windows\system\UDAOQPp.exe

Filesize
1.7MB

MD5
abf94222e25c09c01bddd89f49621618

SHA1
383bc66791c3b81c27f83deff2d08b0568b28999

SHA256
ffd5d3b5614053be39df8841329ad9b276b74f048ff1989a57183548a73f758b

SHA512
6c32a6a7d43d5866ac0bbde5fcb395d18c89257ef58b820f64cc121faff4230197b097c8ecae9df33b6ff337b45516501317a83abe1ec15a472ec76670084e39

Download Submit
C:\Windows\system\WmbCAow.exe

Filesize
1.7MB

MD5
081e3ddda8bdf325a441471968a3bd4a

SHA1
1bf0aa9b7e9e151ea459619695a267e398618e42

SHA256
d35cf7d677ffd5dad084a6a7d93a9499150eb1d22cfd3f2116dd0dc066bb455f

SHA512
a548fc372b54c0069d56e29a696d978bd3c5f362009106a5e0c66c89e0e8e58f6e53e5dedc4a87739616030a451a9de63168c6fe319c41ce73a4d800d11894af

Download Submit
C:\Windows\system\bcEJRla.exe

Filesize
1.7MB

MD5
ccc22b619c0290b8297b09c00a31ebc3

SHA1
d4d991c7c1efd908c76c91343d0f688af4830cc3

SHA256
e733a58907d375f35edc85ee146f43e6ac75e6bc7f02504ffc388a6bb60e3f4e

SHA512
7351079ac25a3040c4ca50451050e72999695d2d39dfb1faf509183d8d6bdc74a664a76206c5c867b7677b0dda4a1821b9667772ea2ae95850dd5d7922e251be

Download Submit
C:\Windows\system\ftJolWS.exe

Filesize
1.7MB

MD5
8b999859660ae408dc8d50e902b84d1a

SHA1
448394b36099247413d938c09050d32e28f62083

SHA256
6fe60f8cbcc9af63931feb3ef9b14af4bf25de180c6ed5a27e53adfb1dcd71b8

SHA512
7ecce63179c6f5c49f3244e13f8bcb9ffe97731f1fff723144c926a6db7e639a189920ad2a0f95773dddc2625cc5ef1932c3dd9e16e223735fb591eec1b5fbc7

Download Submit
C:\Windows\system\gieFvDZ.exe

Filesize
1.7MB

MD5
cfcb49bd3111528c45cc846c7a3f08b8

SHA1
0a6962e45a0e05423bab0d3e6d483953156dc2f0

SHA256
c96b3f5c0eaa5e2397125387f48c80f1c62e232c9e8e7ceb94282759bc1711aa

SHA512
2b48753fd7690eef0348fc1a66cd970afaf174a43d5411f8ecb66e1fd9c44c3165b61299ec9956c5b5ef41e6308e05bb6d5fa6ac7f3f96d4c4d7ba4f915b7458

Download Submit
C:\Windows\system\gkQQSag.exe

Filesize
1.7MB

MD5
e71c88dc1951b317d11f78a793df6831

SHA1
dcf92c02bc755ddf429d9101a7142943ba414571

SHA256
af920c962b6420d78468a29c729e38f5610b7df580c9c1c291a0441eb3dcec9b

SHA512
88d1c9d1bec761180ab2e4f9c49b78112d7aff6f70f7b4d2fa2aa3053910b2b38b6c3301a728e57ebbb38d7529074a7e9e09eb43972b09b14d0c17807920d1f0

Download Submit
C:\Windows\system\iHgaXYQ.exe

Filesize
1.7MB

MD5
add466efd7baea0de2c42c1173ae1930

SHA1
e30efce79aa2712965daa7da96d830ee06c7d9e0

SHA256
2f1541ca97eb72066534d3327e27cedb641a8918a969ed19e2363af25fd38aff

SHA512
a84d78cbf081efa67d5b2a3fcbafd5aa7bd624f5d647bb85cd93297f7beb92ca3c1ac8aaabecdaa9f929a0263aa9c5f2f2d7835ca8cbdb83c809d1d314ac250e

Download Submit
C:\Windows\system\lLHtlGj.exe

Filesize
1.7MB

MD5
4c97c8f48e265d54108efb00267d8931

SHA1
84e5b0ef78f640e9c797830da44fdc752a2f751f

SHA256
b7d7af9127274be6a75c23fc0da4f6cc126aa3c22629642ef2fcad6eef05a216

SHA512
348b16116ff800ff6af7a08dfaae535ff6485847084ae7a5259cffb66e8da633b94492ad7e56b18cec0289cf01885ceb04d8d97807f8b59c68d95be43196e65e

Download Submit
C:\Windows\system\ojrhIXl.exe

Filesize
1.7MB

MD5
fab84508e947b8cb0c3e03efb1b373e1

SHA1
c042f6778c20989d4d8f9710b4dbe233fd8057af

SHA256
56ad4401d00f3adfc6115403c60ac6a875d69571f16a020b070ca18b4c2e2fff

SHA512
dee42e411e82882b74619805c28936adf84bb2496ec12928d64da44812b3abf1d1358f4b24696cd303cc3b0f32ae9f1e5945b5704e438e2b74ae457e6560ffe6

Download Submit
C:\Windows\system\szPQiAq.exe

Filesize
1.7MB

MD5
e6c95c7f08733f106b460a90f76c0a01

SHA1
3792869bc0e98c147fd33d3713aa95963301c035

SHA256
184032db70b72d35cf06ca78ae1c7e4c4afa0773306bdf306b68025a1a8f6291

SHA512
a7723fc95d2d638fcade5116c598ed4efb1f5e98aa1d889e739a6c280396d35f6df54c3335cfb93a0617499b4f991067a07aedeaad07f42967097a8b525cf191

Download Submit
C:\Windows\system\tcsqlcg.exe

Filesize
1.7MB

MD5
e137fa0270a1a05bbcfd3d1afffa252a

SHA1
04dab48d5afc11a963d3c7cbb7ae7a368c1b885e

SHA256
12c0635453ea2458821ea5ece2b99e1e14123fb9c1d91489f0dfc2a8d8ba085b

SHA512
f6c6f4d606a3f58314328e60d6a55c8d58fe2a0eed40cc757fa9a20dae1980d3ee6e283411b16a3ba86b1ab5bf50ea8a83f35742324f84c40d50092aa608306d

Download Submit
C:\Windows\system\uIWeaWR.exe

Filesize
1.7MB

MD5
dcc6514ce8528ae8735e03f5af70c211

SHA1
ae55cc1dc17dee143eec6799dec11406b6a5b34f

SHA256
69fdad23abc8e8c80e3ff2b08173888f2694eac517d6e56b4e15f22175e8f0c9

SHA512
1d54e5de9d9d3746478e507b18bf4f1b8d3478439276f97215043504c06be1443f94fc522de56ce5a4082eac2f1eaf9fb6147c10e5f7a4e5e4f1ea6c142445ac

Download Submit
C:\Windows\system\uxmdoMK.exe

Filesize
1.7MB

MD5
f99781aa849a4983b2596bb5e67edf84

SHA1
a9e90d6b7376421e722bd784ab5caaa47d75cc84

SHA256
41e85a24dd1efb8b2bd99b20f46511a4115b9218f6aabcee387c4f10b532ddd4

SHA512
3d8b272e1f8fa42f068f0d9ca60c205577ca53865f5725405de4d198cf67acbf703a1cd68986d57657454fa0433b737d13dd544551aab5d981c3c0f1cc74f898

Download Submit
C:\Windows\system\vpIeazV.exe

Filesize
1.7MB

MD5
2eed36393cfd434772026ed855d2587f

SHA1
a15427d06a1061a77fcf5945a09320faaa8414de

SHA256
b3f08b2903533eb5438da74d814e4842fd9450c467a5f52fd9e7507fc1e927e5

SHA512
ccc7cf2aefd81bb3f26e642dac3194310e8b11034b432c87f75287736a27beb8aa7fe019afb5555aa0308a750e8edd31efb8d03813a6ee1654698ecd9a962b39

Download Submit
C:\Windows\system\wLgvaNB.exe

Filesize
1.7MB

MD5
7fd02548ce4f8d47898fc2567e3c86df

SHA1
91bb5f4f40e584437e628ab3f50a49da954f1ee2

SHA256
a67dc89fd50f544b46b6e80c539cbe267fd591da0bbbf0cd0123fb5e9d0d12ab

SHA512
bf85300f2a97df3b8a8855a984fa47f17c64bbcdcf005d3626995ba805e43b6fac16a39715306dff3575bc6b67da18c57ce1afd5f197230daaa184d084e6822c

Download Submit
C:\Windows\system\xXgpTKd.exe

Filesize
1.7MB

MD5
7a96114bf9e07973252e31c8ee26512d

SHA1
0a89bd6387870ebb325395d94f41f9cd9708ca45

SHA256
27661e2f97abd2e84bc48c9fa135b053ab774cb4afe580c02cef069d6ff2220e

SHA512
d41b76b60ab7e0a22816ff1360e736a7dbb227d6a7406df8c3281222d49866bfb9aa361b0599739ce520e76f8481045cdc591490ec1ae6a582a98c56617d6b5c

Download Submit
\Windows\system\CEQqiTQ.exe

Filesize
1.7MB

MD5
2a793102b6a32be879e3730d6025182b

SHA1
a7be0eb20799b07d7c8dd21fb5834fb1462d9aac

SHA256
22d06eccf40934e037b44e5a1e7cb989779736c534d20efbf10ce0f4377208ab

SHA512
2f725646ed7ae9a87756dec232d6620918e0189ec17d2e080d791ce0543d26a1c642e3166824b2a17b9a8d1a9133e24cfb00020218b861478faa410a50b4f75f

Download Submit
\Windows\system\MIoOQbP.exe

Filesize
1.7MB

MD5
227d61d7d965fd37dd5d23ce659300ca

SHA1
55846cb7b6dfebc2810381b491ace994886530fa

SHA256
6143db1f04d439be9497008bb4522bbb31656adbb422772f4307d963d9e2d89b

SHA512
6ed7675124ad30162fd81e704f333e7aa09afa446e1a8c3f719b216c6062565fb4f05925e96031045dd76d9c3b128fa16afc5aed214421bb9d543f30ec552e1a

Download Submit
\Windows\system\gRFtiRN.exe

Filesize
1.7MB

MD5
e534286973c3598bbb510922bc7fa239

SHA1
5c76d5a51f377327d95e3dc5237c3f9376b540bb

SHA256
118683daa4d8b64b4558011ca9ee92f7b591904b8f932e1b2ecd309d1ff75e5c

SHA512
e0fa875fb7976e37083d7c8427261849f0b67d9df3493b3feb7f6fd2ec2f8ce3b09ef65df8671a3cab85d6d5a63e0a3bba2264c8799363b8011258d2a7a3c8c3

Download Submit
\Windows\system\oDbTlRw.exe

Filesize
1.7MB

MD5
0887d37e9bede036d3bdeba267373998

SHA1
8d56bfe07f8e90b0d4e00e87ad9a40770793e883

SHA256
427c8118c289e025309296ff25868297d26cfe9732de12c30aad5aa5963e0a1c

SHA512
4970a6137e223be7a63b3add39be8db479c57a3349c90b3adefe256de20d046ef47d72ee7e236adf3af8359c5cb5953aa56e1b01031ea49afb7dda66b95f5088

Download Submit
memory/1320-4307-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/1320-82-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/1932-4286-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/1932-27-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/1932-1454-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1972-76-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1972-1231-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/1972-965-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/1972-328-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1972-21-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1972-1453-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1972-6-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/1972-37-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1972-1693-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1972-1692-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-1569-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1972-79-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-330-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1972-77-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-59-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1972-75-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-327-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-1695-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1972-329-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1972-1694-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1972-326-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-0-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/1972-1691-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-332-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2112-4324-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2588-9-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-1452-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-80-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-71-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-28-0x000007FEF5BDE000-0x000007FEF5BDF000-memory.dmp

Filesize
4KB

Download
memory/2696-297-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/2696-237-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2696-22-0x0000000002DF0000-0x0000000002E70000-memory.dmp

Filesize
512KB

Download
memory/2696-891-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/2696-325-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/2696-242-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2780-331-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-4305-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-41-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2820-333-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2820-4326-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2824-65-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2884-81-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download