xmrig | 9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/11/2024, 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
Size

2.5MB
MD5

a765ecc9acb23d1a40cba657d11749f4
SHA1

8fb791c8d85bd3b37f8f579b31a3b6999320a739
SHA256

9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540
SHA512

bfaeff9fd8e162ae4c2883bc404cc5b37432f2ee6fad066812adc5e60d5f75d702a5d608ac10a1bccb900e7233c37593ae201012d6c3f7c333a279c460f67955
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkibTIA5ybH90uL:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rg

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral1/memory/1292-1-0x000000013FAB0000-0x000000013FEA6000-memory.dmp	xmrig
behavioral1/files/0x0007000000012119-6.dat	xmrig
behavioral1/files/0x0008000000015d41-9.dat	xmrig
behavioral1/memory/2508-13-0x000000013F8A0000-0x000000013FC96000-memory.dmp	xmrig
behavioral1/files/0x0008000000015d59-25.dat	xmrig
behavioral1/files/0x0007000000004e74-30.dat	xmrig
behavioral1/files/0x0008000000015ec9-35.dat	xmrig
behavioral1/files/0x0008000000016d3f-54.dat	xmrig
behavioral1/files/0x0006000000016d47-59.dat	xmrig
behavioral1/files/0x0006000000016d72-84.dat	xmrig
behavioral1/files/0x000600000001747d-119.dat	xmrig
behavioral1/files/0x0006000000017491-124.dat	xmrig
behavioral1/files/0x00060000000175e7-129.dat	xmrig
behavioral1/memory/1292-141-0x000000013F170000-0x000000013F566000-memory.dmp	xmrig
behavioral1/memory/1356-152-0x000000013F360000-0x000000013F756000-memory.dmp	xmrig
behavioral1/memory/2084-156-0x000000013FB40000-0x000000013FF36000-memory.dmp	xmrig
behavioral1/files/0x001400000001866f-161.dat	xmrig
behavioral1/files/0x000500000001868b-175.dat	xmrig
behavioral1/memory/1724-1467-0x000000013FE60000-0x0000000140256000-memory.dmp	xmrig
behavioral1/memory/1292-1201-0x000000013FAB0000-0x000000013FEA6000-memory.dmp	xmrig
behavioral1/files/0x0005000000018731-190.dat	xmrig
behavioral1/files/0x00050000000186f2-180.dat	xmrig
behavioral1/files/0x00050000000186f8-185.dat	xmrig
behavioral1/files/0x0011000000018682-170.dat	xmrig
behavioral1/files/0x0008000000015d0e-165.dat	xmrig
behavioral1/memory/2628-154-0x000000013FDA0000-0x0000000140196000-memory.dmp	xmrig
behavioral1/memory/2812-150-0x000000013FE10000-0x0000000140206000-memory.dmp	xmrig
behavioral1/memory/2624-148-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	xmrig
behavioral1/memory/2760-146-0x000000013F3D0000-0x000000013F7C6000-memory.dmp	xmrig
behavioral1/memory/2848-144-0x000000013FB70000-0x000000013FF66000-memory.dmp	xmrig
behavioral1/memory/2748-142-0x000000013F170000-0x000000013F566000-memory.dmp	xmrig
behavioral1/memory/2440-133-0x000000013FF30000-0x0000000140326000-memory.dmp	xmrig
behavioral1/memory/2840-140-0x000000013F580000-0x000000013F976000-memory.dmp	xmrig
behavioral1/files/0x0006000000018669-137.dat	xmrig
behavioral1/files/0x0006000000017047-109.dat	xmrig
behavioral1/files/0x000600000001743a-114.dat	xmrig
behavioral1/files/0x0006000000016dea-99.dat	xmrig
behavioral1/files/0x0006000000016eb4-103.dat	xmrig
behavioral1/files/0x0006000000016de0-94.dat	xmrig
behavioral1/files/0x0006000000016dd9-89.dat	xmrig
behavioral1/files/0x0006000000016d6d-79.dat	xmrig
behavioral1/files/0x0006000000016d69-74.dat	xmrig
behavioral1/files/0x0006000000016d63-69.dat	xmrig
behavioral1/files/0x0006000000016d4f-64.dat	xmrig
behavioral1/files/0x0009000000016241-50.dat	xmrig
behavioral1/files/0x0007000000015ff5-45.dat	xmrig
behavioral1/files/0x0007000000015f71-39.dat	xmrig
behavioral1/memory/1724-14-0x000000013FE60000-0x0000000140256000-memory.dmp	xmrig
behavioral1/memory/2624-4716-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2256	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2508	qtnleUI.exe
1724	ArEAoQB.exe
2440	IyYsVgp.exe
2840	RFfXaAI.exe
2748	VKIDqfg.exe
2848	VLrFwNl.exe
2760	IwNRhEq.exe
2624	UNqFbSr.exe
2812	YMWdGKu.exe
1356	PPAxBdv.exe
2628	mXSAvXp.exe
2084	HjJWjWv.exe
2176	FBtPXSv.exe
680	JlngkKD.exe
1488	JYPLTTc.exe
1976	xdSCmiw.exe
1704	omZGeLZ.exe
1296	bZoKXpw.exe
908	JoFogFN.exe
2896	bqRWptf.exe
1044	Qwjhpga.exe
2912	utEVbXg.exe
596	eHcMIcY.exe
756	tZrIeog.exe
2252	chmoByh.exe
1984	dWCUjeF.exe
2968	cewyzGZ.exe
2028	AtgsDzI.exe
1052	RKLxcim.exe
1820	xKlpHZg.exe
2580	yUcYtyj.exe
2224	XFpPieB.exe
1716	losgFZA.exe
892	YdjoJIh.exe
2164	nqzPhOR.exe
2072	TTdzZKM.exe
2380	tRvyNzY.exe
864	sUFijOp.exe
2212	nPDeYTa.exe
2364	RfcXzXE.exe
568	tsiCmmY.exe
888	IggsxeW.exe
1940	SxFdBIy.exe
1512	pDZFncY.exe
1632	gZwBmlX.exe
2292	zjPZzsJ.exe
1600	FmKJZAk.exe
2044	woBLgia.exe
3020	YpGvnKX.exe
1948	ghdVYFL.exe
2808	aDCWhZV.exe
2836	gepGmlT.exe
2956	AevMgOh.exe
3068	yeRVSbe.exe
2652	whLhoDK.exe
2612	fVzkSdT.exe
3052	VYddcAg.exe
536	dxPWHPB.exe
3036	HKIvLMY.exe
2584	NmPufUy.exe
2776	FAHSSuU.exe
308	hbCvDLA.exe
2040	LCzMrII.exe
3004	Lsjdfyi.exe

Loads dropped DLL 64 IoCs

pid	Process
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1292-1-0x000000013FAB0000-0x000000013FEA6000-memory.dmp	upx
behavioral1/files/0x0007000000012119-6.dat	upx
behavioral1/files/0x0008000000015d41-9.dat	upx
behavioral1/memory/2508-13-0x000000013F8A0000-0x000000013FC96000-memory.dmp	upx
behavioral1/files/0x0008000000015d59-25.dat	upx
behavioral1/files/0x0007000000004e74-30.dat	upx
behavioral1/files/0x0008000000015ec9-35.dat	upx
behavioral1/files/0x0008000000016d3f-54.dat	upx
behavioral1/files/0x0006000000016d47-59.dat	upx
behavioral1/files/0x0006000000016d72-84.dat	upx
behavioral1/files/0x000600000001747d-119.dat	upx
behavioral1/files/0x0006000000017491-124.dat	upx
behavioral1/files/0x00060000000175e7-129.dat	upx
behavioral1/memory/1356-152-0x000000013F360000-0x000000013F756000-memory.dmp	upx
behavioral1/memory/2084-156-0x000000013FB40000-0x000000013FF36000-memory.dmp	upx
behavioral1/files/0x001400000001866f-161.dat	upx
behavioral1/files/0x000500000001868b-175.dat	upx
behavioral1/memory/1724-1467-0x000000013FE60000-0x0000000140256000-memory.dmp	upx
behavioral1/memory/1292-1201-0x000000013FAB0000-0x000000013FEA6000-memory.dmp	upx
behavioral1/files/0x0005000000018731-190.dat	upx
behavioral1/files/0x00050000000186f2-180.dat	upx
behavioral1/files/0x00050000000186f8-185.dat	upx
behavioral1/files/0x0011000000018682-170.dat	upx
behavioral1/files/0x0008000000015d0e-165.dat	upx
behavioral1/memory/2628-154-0x000000013FDA0000-0x0000000140196000-memory.dmp	upx
behavioral1/memory/2812-150-0x000000013FE10000-0x0000000140206000-memory.dmp	upx
behavioral1/memory/2624-148-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	upx
behavioral1/memory/2760-146-0x000000013F3D0000-0x000000013F7C6000-memory.dmp	upx
behavioral1/memory/2848-144-0x000000013FB70000-0x000000013FF66000-memory.dmp	upx
behavioral1/memory/2748-142-0x000000013F170000-0x000000013F566000-memory.dmp	upx
behavioral1/memory/2440-133-0x000000013FF30000-0x0000000140326000-memory.dmp	upx
behavioral1/memory/2840-140-0x000000013F580000-0x000000013F976000-memory.dmp	upx
behavioral1/files/0x0006000000018669-137.dat	upx
behavioral1/files/0x0006000000017047-109.dat	upx
behavioral1/files/0x000600000001743a-114.dat	upx
behavioral1/files/0x0006000000016dea-99.dat	upx
behavioral1/files/0x0006000000016eb4-103.dat	upx
behavioral1/files/0x0006000000016de0-94.dat	upx
behavioral1/files/0x0006000000016dd9-89.dat	upx
behavioral1/files/0x0006000000016d6d-79.dat	upx
behavioral1/files/0x0006000000016d69-74.dat	upx
behavioral1/files/0x0006000000016d63-69.dat	upx
behavioral1/files/0x0006000000016d4f-64.dat	upx
behavioral1/files/0x0009000000016241-50.dat	upx
behavioral1/files/0x0007000000015ff5-45.dat	upx
behavioral1/files/0x0007000000015f71-39.dat	upx
behavioral1/memory/1724-14-0x000000013FE60000-0x0000000140256000-memory.dmp	upx
behavioral1/memory/2624-4716-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XPyymVE.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\nbAQGIg.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\MLbGzEf.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\dmKIrgH.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\DVGLmVa.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\sjYdDlU.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\hdpiICi.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\FyUsBmk.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\gvICjtM.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\PJHSEjh.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\wssuVxg.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\mraodDb.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\GdyIFqB.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\AcUcKQn.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\ADCXfrG.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\qyFSWwK.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\YAbdnPH.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\NPlfxmn.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\vbdxhft.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\XsvKCcc.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\vkDuzlx.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\ukQRKwt.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\PPQNdQS.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\wcvzMEm.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\AWOSSrv.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\syXlTXu.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\NqNMqZp.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\YkmwYTx.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\eDbkCuq.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\bMiJuhH.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\XewserK.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\URiwLws.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\FbBAlJd.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\QfuVYyu.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\GszHsxv.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\DQuHOIq.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\SoDhymV.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\TZmKLej.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\bHSZZYd.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\asNcdnp.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\DXPsKJj.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\dHbmhfW.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\XCCPkvQ.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\oRXieVv.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\YgHddBg.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\HbqNaWH.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\RpRtAPs.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\IHHgyqr.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\lPNZzSf.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\GjemcMe.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\TYsmEbW.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\ImWDDSL.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\TRuEMgr.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\PCiiPyF.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\CBKRRwH.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\XXISkim.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\AIIFvXs.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\qmSJEqd.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\tpTDIpp.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\kBgwLAu.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\qPOQMsI.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\EaOQOpZ.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\bXWsVSW.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
File created	C:\Windows\System\mDIFsGX.exe	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2256	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
Token: SeLockMemoryPrivilege	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
Token: SeDebugPrivilege	2256	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2256	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	31
PID 1292 wrote to memory of 2256	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	31
PID 1292 wrote to memory of 2256	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	31
PID 1292 wrote to memory of 2508	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	32
PID 1292 wrote to memory of 2508	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	32
PID 1292 wrote to memory of 2508	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	32
PID 1292 wrote to memory of 1724	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	33
PID 1292 wrote to memory of 1724	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	33
PID 1292 wrote to memory of 1724	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	33
PID 1292 wrote to memory of 2440	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	34
PID 1292 wrote to memory of 2440	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	34
PID 1292 wrote to memory of 2440	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	34
PID 1292 wrote to memory of 2840	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	35
PID 1292 wrote to memory of 2840	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	35
PID 1292 wrote to memory of 2840	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	35
PID 1292 wrote to memory of 2748	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	36
PID 1292 wrote to memory of 2748	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	36
PID 1292 wrote to memory of 2748	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	36
PID 1292 wrote to memory of 2848	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	37
PID 1292 wrote to memory of 2848	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	37
PID 1292 wrote to memory of 2848	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	37
PID 1292 wrote to memory of 2760	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	38
PID 1292 wrote to memory of 2760	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	38
PID 1292 wrote to memory of 2760	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	38
PID 1292 wrote to memory of 2624	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	39
PID 1292 wrote to memory of 2624	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	39
PID 1292 wrote to memory of 2624	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	39
PID 1292 wrote to memory of 2812	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	40
PID 1292 wrote to memory of 2812	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	40
PID 1292 wrote to memory of 2812	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	40
PID 1292 wrote to memory of 1356	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	41
PID 1292 wrote to memory of 1356	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	41
PID 1292 wrote to memory of 1356	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	41
PID 1292 wrote to memory of 2628	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	42
PID 1292 wrote to memory of 2628	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	42
PID 1292 wrote to memory of 2628	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	42
PID 1292 wrote to memory of 2084	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	43
PID 1292 wrote to memory of 2084	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	43
PID 1292 wrote to memory of 2084	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	43
PID 1292 wrote to memory of 2176	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	44
PID 1292 wrote to memory of 2176	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	44
PID 1292 wrote to memory of 2176	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	44
PID 1292 wrote to memory of 680	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	45
PID 1292 wrote to memory of 680	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	45
PID 1292 wrote to memory of 680	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	45
PID 1292 wrote to memory of 1488	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	46
PID 1292 wrote to memory of 1488	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	46
PID 1292 wrote to memory of 1488	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	46
PID 1292 wrote to memory of 1976	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	47
PID 1292 wrote to memory of 1976	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	47
PID 1292 wrote to memory of 1976	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	47
PID 1292 wrote to memory of 1704	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	48
PID 1292 wrote to memory of 1704	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	48
PID 1292 wrote to memory of 1704	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	48
PID 1292 wrote to memory of 1296	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	49
PID 1292 wrote to memory of 1296	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	49
PID 1292 wrote to memory of 1296	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	49
PID 1292 wrote to memory of 908	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	50
PID 1292 wrote to memory of 908	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	50
PID 1292 wrote to memory of 908	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	50
PID 1292 wrote to memory of 2896	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	51
PID 1292 wrote to memory of 2896	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	51
PID 1292 wrote to memory of 2896	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	51
PID 1292 wrote to memory of 1044	1292	9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe	52

C:\Users\Admin\AppData\Local\Temp\9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe
"C:\Users\Admin\AppData\Local\Temp\9254ba861a6381d3432edd5839cb93ce4792b96d6394e41cfad6f4fdf2199540.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\System\qtnleUI.exe
  C:\Windows\System\qtnleUI.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\ArEAoQB.exe
  C:\Windows\System\ArEAoQB.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\IyYsVgp.exe
  C:\Windows\System\IyYsVgp.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\RFfXaAI.exe
  C:\Windows\System\RFfXaAI.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\VKIDqfg.exe
  C:\Windows\System\VKIDqfg.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\VLrFwNl.exe
  C:\Windows\System\VLrFwNl.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\IwNRhEq.exe
  C:\Windows\System\IwNRhEq.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\UNqFbSr.exe
  C:\Windows\System\UNqFbSr.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\YMWdGKu.exe
  C:\Windows\System\YMWdGKu.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\PPAxBdv.exe
  C:\Windows\System\PPAxBdv.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\mXSAvXp.exe
  C:\Windows\System\mXSAvXp.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\HjJWjWv.exe
  C:\Windows\System\HjJWjWv.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\FBtPXSv.exe
  C:\Windows\System\FBtPXSv.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\JlngkKD.exe
  C:\Windows\System\JlngkKD.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\JYPLTTc.exe
  C:\Windows\System\JYPLTTc.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\xdSCmiw.exe
  C:\Windows\System\xdSCmiw.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\omZGeLZ.exe
  C:\Windows\System\omZGeLZ.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\bZoKXpw.exe
  C:\Windows\System\bZoKXpw.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\JoFogFN.exe
  C:\Windows\System\JoFogFN.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\bqRWptf.exe
  C:\Windows\System\bqRWptf.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\Qwjhpga.exe
  C:\Windows\System\Qwjhpga.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\utEVbXg.exe
  C:\Windows\System\utEVbXg.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\eHcMIcY.exe
  C:\Windows\System\eHcMIcY.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\tZrIeog.exe
  C:\Windows\System\tZrIeog.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\chmoByh.exe
  C:\Windows\System\chmoByh.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\dWCUjeF.exe
  C:\Windows\System\dWCUjeF.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\cewyzGZ.exe
  C:\Windows\System\cewyzGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\AtgsDzI.exe
  C:\Windows\System\AtgsDzI.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\RKLxcim.exe
  C:\Windows\System\RKLxcim.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\xKlpHZg.exe
  C:\Windows\System\xKlpHZg.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\yUcYtyj.exe
  C:\Windows\System\yUcYtyj.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\XFpPieB.exe
  C:\Windows\System\XFpPieB.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\losgFZA.exe
  C:\Windows\System\losgFZA.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\YdjoJIh.exe
  C:\Windows\System\YdjoJIh.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\nqzPhOR.exe
  C:\Windows\System\nqzPhOR.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\TTdzZKM.exe
  C:\Windows\System\TTdzZKM.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\tRvyNzY.exe
  C:\Windows\System\tRvyNzY.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\sUFijOp.exe
  C:\Windows\System\sUFijOp.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\nPDeYTa.exe
  C:\Windows\System\nPDeYTa.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\RfcXzXE.exe
  C:\Windows\System\RfcXzXE.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\tsiCmmY.exe
  C:\Windows\System\tsiCmmY.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\IggsxeW.exe
  C:\Windows\System\IggsxeW.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\SxFdBIy.exe
  C:\Windows\System\SxFdBIy.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\pDZFncY.exe
  C:\Windows\System\pDZFncY.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\gZwBmlX.exe
  C:\Windows\System\gZwBmlX.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\zjPZzsJ.exe
  C:\Windows\System\zjPZzsJ.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\FmKJZAk.exe
  C:\Windows\System\FmKJZAk.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\woBLgia.exe
  C:\Windows\System\woBLgia.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\YpGvnKX.exe
  C:\Windows\System\YpGvnKX.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\ghdVYFL.exe
  C:\Windows\System\ghdVYFL.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\aDCWhZV.exe
  C:\Windows\System\aDCWhZV.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\gepGmlT.exe
  C:\Windows\System\gepGmlT.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\AevMgOh.exe
  C:\Windows\System\AevMgOh.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\yeRVSbe.exe
  C:\Windows\System\yeRVSbe.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\whLhoDK.exe
  C:\Windows\System\whLhoDK.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\fVzkSdT.exe
  C:\Windows\System\fVzkSdT.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\VYddcAg.exe
  C:\Windows\System\VYddcAg.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\dxPWHPB.exe
  C:\Windows\System\dxPWHPB.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\HKIvLMY.exe
  C:\Windows\System\HKIvLMY.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\NmPufUy.exe
  C:\Windows\System\NmPufUy.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\FAHSSuU.exe
  C:\Windows\System\FAHSSuU.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\hbCvDLA.exe
  C:\Windows\System\hbCvDLA.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\LCzMrII.exe
  C:\Windows\System\LCzMrII.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\OsJwbHK.exe
  C:\Windows\System\OsJwbHK.exe
  2⤵
  PID:2228
- C:\Windows\System\Lsjdfyi.exe
  C:\Windows\System\Lsjdfyi.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\zzaDnhk.exe
  C:\Windows\System\zzaDnhk.exe
  2⤵
  PID:1536
- C:\Windows\System\UMusTrE.exe
  C:\Windows\System\UMusTrE.exe
  2⤵
  PID:1616
- C:\Windows\System\NjVdbpe.exe
  C:\Windows\System\NjVdbpe.exe
  2⤵
  PID:1144
- C:\Windows\System\TvOrttK.exe
  C:\Windows\System\TvOrttK.exe
  2⤵
  PID:1560
- C:\Windows\System\DVklYti.exe
  C:\Windows\System\DVklYti.exe
  2⤵
  PID:904
- C:\Windows\System\lyysFui.exe
  C:\Windows\System\lyysFui.exe
  2⤵
  PID:2420
- C:\Windows\System\nrhQWzt.exe
  C:\Windows\System\nrhQWzt.exe
  2⤵
  PID:2532
- C:\Windows\System\XBFDpIw.exe
  C:\Windows\System\XBFDpIw.exe
  2⤵
  PID:2576
- C:\Windows\System\cLiSQNA.exe
  C:\Windows\System\cLiSQNA.exe
  2⤵
  PID:1304
- C:\Windows\System\nHcsWuN.exe
  C:\Windows\System\nHcsWuN.exe
  2⤵
  PID:1656
- C:\Windows\System\JwyENzx.exe
  C:\Windows\System\JwyENzx.exe
  2⤵
  PID:1508
- C:\Windows\System\GavJFGp.exe
  C:\Windows\System\GavJFGp.exe
  2⤵
  PID:1252
- C:\Windows\System\BnKZdgI.exe
  C:\Windows\System\BnKZdgI.exe
  2⤵
  PID:1776
- C:\Windows\System\LeJCvni.exe
  C:\Windows\System\LeJCvni.exe
  2⤵
  PID:1908
- C:\Windows\System\nyuDrgF.exe
  C:\Windows\System\nyuDrgF.exe
  2⤵
  PID:2876
- C:\Windows\System\mjDRXMo.exe
  C:\Windows\System\mjDRXMo.exe
  2⤵
  PID:2816
- C:\Windows\System\JgEMsdX.exe
  C:\Windows\System\JgEMsdX.exe
  2⤵
  PID:2668
- C:\Windows\System\CWSiCBy.exe
  C:\Windows\System\CWSiCBy.exe
  2⤵
  PID:1532
- C:\Windows\System\CkRpolJ.exe
  C:\Windows\System\CkRpolJ.exe
  2⤵
  PID:2868
- C:\Windows\System\IuaXFrn.exe
  C:\Windows\System\IuaXFrn.exe
  2⤵
  PID:3044
- C:\Windows\System\txnQjlj.exe
  C:\Windows\System\txnQjlj.exe
  2⤵
  PID:2940
- C:\Windows\System\yoKuQJK.exe
  C:\Windows\System\yoKuQJK.exe
  2⤵
  PID:2888
- C:\Windows\System\TFbKzIi.exe
  C:\Windows\System\TFbKzIi.exe
  2⤵
  PID:1620
- C:\Windows\System\dIducHK.exe
  C:\Windows\System\dIducHK.exe
  2⤵
  PID:1444
- C:\Windows\System\GhrGiFz.exe
  C:\Windows\System\GhrGiFz.exe
  2⤵
  PID:1892
- C:\Windows\System\lkVfpNW.exe
  C:\Windows\System\lkVfpNW.exe
  2⤵
  PID:2388
- C:\Windows\System\fVeiGMF.exe
  C:\Windows\System\fVeiGMF.exe
  2⤵
  PID:2488
- C:\Windows\System\iBKLMic.exe
  C:\Windows\System\iBKLMic.exe
  2⤵
  PID:1800
- C:\Windows\System\nMoKkeI.exe
  C:\Windows\System\nMoKkeI.exe
  2⤵
  PID:1660
- C:\Windows\System\QEBKsvj.exe
  C:\Windows\System\QEBKsvj.exe
  2⤵
  PID:1612
- C:\Windows\System\PUtesBx.exe
  C:\Windows\System\PUtesBx.exe
  2⤵
  PID:1492
- C:\Windows\System\isIojlT.exe
  C:\Windows\System\isIojlT.exe
  2⤵
  PID:2192
- C:\Windows\System\wvSUSIu.exe
  C:\Windows\System\wvSUSIu.exe
  2⤵
  PID:2788
- C:\Windows\System\APWQZBS.exe
  C:\Windows\System\APWQZBS.exe
  2⤵
  PID:2408
- C:\Windows\System\WuYlwJo.exe
  C:\Windows\System\WuYlwJo.exe
  2⤵
  PID:2400
- C:\Windows\System\aKxMEna.exe
  C:\Windows\System\aKxMEna.exe
  2⤵
  PID:1648
- C:\Windows\System\mbxuIsX.exe
  C:\Windows\System\mbxuIsX.exe
  2⤵
  PID:1388
- C:\Windows\System\iJafXtl.exe
  C:\Windows\System\iJafXtl.exe
  2⤵
  PID:2880
- C:\Windows\System\EbvKTff.exe
  C:\Windows\System\EbvKTff.exe
  2⤵
  PID:2884
- C:\Windows\System\yAjanAu.exe
  C:\Windows\System\yAjanAu.exe
  2⤵
  PID:2856
- C:\Windows\System\TZSssSH.exe
  C:\Windows\System\TZSssSH.exe
  2⤵
  PID:952
- C:\Windows\System\SRKNrNO.exe
  C:\Windows\System\SRKNrNO.exe
  2⤵
  PID:1896
- C:\Windows\System\QQhYMeV.exe
  C:\Windows\System\QQhYMeV.exe
  2⤵
  PID:2632
- C:\Windows\System\zVKsxxP.exe
  C:\Windows\System\zVKsxxP.exe
  2⤵
  PID:1540
- C:\Windows\System\wdcgXaB.exe
  C:\Windows\System\wdcgXaB.exe
  2⤵
  PID:1316
- C:\Windows\System\OtxMdtT.exe
  C:\Windows\System\OtxMdtT.exe
  2⤵
  PID:3080
- C:\Windows\System\MZpCsWH.exe
  C:\Windows\System\MZpCsWH.exe
  2⤵
  PID:3100
- C:\Windows\System\uXNCkVs.exe
  C:\Windows\System\uXNCkVs.exe
  2⤵
  PID:3116
- C:\Windows\System\neGYCdR.exe
  C:\Windows\System\neGYCdR.exe
  2⤵
  PID:3140
- C:\Windows\System\QUlltkA.exe
  C:\Windows\System\QUlltkA.exe
  2⤵
  PID:3156
- C:\Windows\System\KQlEmIu.exe
  C:\Windows\System\KQlEmIu.exe
  2⤵
  PID:3176
- C:\Windows\System\HcJgLDm.exe
  C:\Windows\System\HcJgLDm.exe
  2⤵
  PID:3192
- C:\Windows\System\RHxPvui.exe
  C:\Windows\System\RHxPvui.exe
  2⤵
  PID:3212
- C:\Windows\System\QZvmUFU.exe
  C:\Windows\System\QZvmUFU.exe
  2⤵
  PID:3228
- C:\Windows\System\lbsDtEn.exe
  C:\Windows\System\lbsDtEn.exe
  2⤵
  PID:3248
- C:\Windows\System\sTWkaaM.exe
  C:\Windows\System\sTWkaaM.exe
  2⤵
  PID:3268
- C:\Windows\System\EBjnUoX.exe
  C:\Windows\System\EBjnUoX.exe
  2⤵
  PID:3288
- C:\Windows\System\XFwnQkF.exe
  C:\Windows\System\XFwnQkF.exe
  2⤵
  PID:3304
- C:\Windows\System\SZXZQti.exe
  C:\Windows\System\SZXZQti.exe
  2⤵
  PID:3324
- C:\Windows\System\XBrQgZh.exe
  C:\Windows\System\XBrQgZh.exe
  2⤵
  PID:3340
- C:\Windows\System\LcXaDln.exe
  C:\Windows\System\LcXaDln.exe
  2⤵
  PID:3392
- C:\Windows\System\JDVCLch.exe
  C:\Windows\System\JDVCLch.exe
  2⤵
  PID:3408
- C:\Windows\System\VXJeFMi.exe
  C:\Windows\System\VXJeFMi.exe
  2⤵
  PID:3428
- C:\Windows\System\UhLICRC.exe
  C:\Windows\System\UhLICRC.exe
  2⤵
  PID:3444
- C:\Windows\System\PIPfZVX.exe
  C:\Windows\System\PIPfZVX.exe
  2⤵
  PID:3464
- C:\Windows\System\NHSfopz.exe
  C:\Windows\System\NHSfopz.exe
  2⤵
  PID:3492
- C:\Windows\System\UXkmWKy.exe
  C:\Windows\System\UXkmWKy.exe
  2⤵
  PID:3512
- C:\Windows\System\WsHTSBJ.exe
  C:\Windows\System\WsHTSBJ.exe
  2⤵
  PID:3528
- C:\Windows\System\tqZEKdx.exe
  C:\Windows\System\tqZEKdx.exe
  2⤵
  PID:3552
- C:\Windows\System\GTMPnss.exe
  C:\Windows\System\GTMPnss.exe
  2⤵
  PID:3568
- C:\Windows\System\ySdFwGW.exe
  C:\Windows\System\ySdFwGW.exe
  2⤵
  PID:3588
- C:\Windows\System\iUYUFiR.exe
  C:\Windows\System\iUYUFiR.exe
  2⤵
  PID:3604
- C:\Windows\System\dAXxanh.exe
  C:\Windows\System\dAXxanh.exe
  2⤵
  PID:3624
- C:\Windows\System\JfQqAsp.exe
  C:\Windows\System\JfQqAsp.exe
  2⤵
  PID:3652
- C:\Windows\System\RnQZJql.exe
  C:\Windows\System\RnQZJql.exe
  2⤵
  PID:3672
- C:\Windows\System\lQORiZc.exe
  C:\Windows\System\lQORiZc.exe
  2⤵
  PID:3688
- C:\Windows\System\UxFFIfL.exe
  C:\Windows\System\UxFFIfL.exe
  2⤵
  PID:3708
- C:\Windows\System\fbwpvXX.exe
  C:\Windows\System\fbwpvXX.exe
  2⤵
  PID:3728
- C:\Windows\System\VLhZPFW.exe
  C:\Windows\System\VLhZPFW.exe
  2⤵
  PID:3748
- C:\Windows\System\vSCjFpa.exe
  C:\Windows\System\vSCjFpa.exe
  2⤵
  PID:3764
- C:\Windows\System\BfOUvoP.exe
  C:\Windows\System\BfOUvoP.exe
  2⤵
  PID:3784
- C:\Windows\System\lxWNzLX.exe
  C:\Windows\System\lxWNzLX.exe
  2⤵
  PID:3800
- C:\Windows\System\QQRMMyd.exe
  C:\Windows\System\QQRMMyd.exe
  2⤵
  PID:3820
- C:\Windows\System\tQDeoeZ.exe
  C:\Windows\System\tQDeoeZ.exe
  2⤵
  PID:3836
- C:\Windows\System\zcnqgDQ.exe
  C:\Windows\System\zcnqgDQ.exe
  2⤵
  PID:3860
- C:\Windows\System\EoDUCeP.exe
  C:\Windows\System\EoDUCeP.exe
  2⤵
  PID:3876
- C:\Windows\System\aKBSzGv.exe
  C:\Windows\System\aKBSzGv.exe
  2⤵
  PID:3904
- C:\Windows\System\hmokQZp.exe
  C:\Windows\System\hmokQZp.exe
  2⤵
  PID:3932
- C:\Windows\System\nRvprPB.exe
  C:\Windows\System\nRvprPB.exe
  2⤵
  PID:3952
- C:\Windows\System\QMcuNqX.exe
  C:\Windows\System\QMcuNqX.exe
  2⤵
  PID:3968
- C:\Windows\System\uTjrGRc.exe
  C:\Windows\System\uTjrGRc.exe
  2⤵
  PID:3988
- C:\Windows\System\oRfyzEb.exe
  C:\Windows\System\oRfyzEb.exe
  2⤵
  PID:4012
- C:\Windows\System\ncDSjMt.exe
  C:\Windows\System\ncDSjMt.exe
  2⤵
  PID:4032
- C:\Windows\System\SyPswOA.exe
  C:\Windows\System\SyPswOA.exe
  2⤵
  PID:4048
- C:\Windows\System\UawvREF.exe
  C:\Windows\System\UawvREF.exe
  2⤵
  PID:4072
- C:\Windows\System\JTnzKeI.exe
  C:\Windows\System\JTnzKeI.exe
  2⤵
  PID:4088
- C:\Windows\System\UTcxZUo.exe
  C:\Windows\System\UTcxZUo.exe
  2⤵
  PID:2916
- C:\Windows\System\agTLcWf.exe
  C:\Windows\System\agTLcWf.exe
  2⤵
  PID:1604
- C:\Windows\System\hMaybMR.exe
  C:\Windows\System\hMaybMR.exe
  2⤵
  PID:3092
- C:\Windows\System\fTsYZRF.exe
  C:\Windows\System\fTsYZRF.exe
  2⤵
  PID:3132
- C:\Windows\System\XtuFmiw.exe
  C:\Windows\System\XtuFmiw.exe
  2⤵
  PID:3208
- C:\Windows\System\spGzXjG.exe
  C:\Windows\System\spGzXjG.exe
  2⤵
  PID:1972
- C:\Windows\System\VfJXbRz.exe
  C:\Windows\System\VfJXbRz.exe
  2⤵
  PID:3284
- C:\Windows\System\KKYtFfd.exe
  C:\Windows\System\KKYtFfd.exe
  2⤵
  PID:2616
- C:\Windows\System\DaWmWGw.exe
  C:\Windows\System\DaWmWGw.exe
  2⤵
  PID:3320
- C:\Windows\System\ylpCojy.exe
  C:\Windows\System\ylpCojy.exe
  2⤵
  PID:3352
- C:\Windows\System\OGgPLFJ.exe
  C:\Windows\System\OGgPLFJ.exe
  2⤵
  PID:2372
- C:\Windows\System\aZvQcok.exe
  C:\Windows\System\aZvQcok.exe
  2⤵
  PID:3372
- C:\Windows\System\cmNWwlH.exe
  C:\Windows\System\cmNWwlH.exe
  2⤵
  PID:2784
- C:\Windows\System\CLvWSQl.exe
  C:\Windows\System\CLvWSQl.exe
  2⤵
  PID:3416
- C:\Windows\System\BQWbYAY.exe
  C:\Windows\System\BQWbYAY.exe
  2⤵
  PID:3424
- C:\Windows\System\zLDAGou.exe
  C:\Windows\System\zLDAGou.exe
  2⤵
  PID:3332
- C:\Windows\System\nfENjHS.exe
  C:\Windows\System\nfENjHS.exe
  2⤵
  PID:3256
- C:\Windows\System\HVZKciT.exe
  C:\Windows\System\HVZKciT.exe
  2⤵
  PID:3184
- C:\Windows\System\nugTfob.exe
  C:\Windows\System\nugTfob.exe
  2⤵
  PID:3108
- C:\Windows\System\zrmreDY.exe
  C:\Windows\System\zrmreDY.exe
  2⤵
  PID:3504
- C:\Windows\System\DHlRNjQ.exe
  C:\Windows\System\DHlRNjQ.exe
  2⤵
  PID:3544
- C:\Windows\System\cwyWAub.exe
  C:\Windows\System\cwyWAub.exe
  2⤵
  PID:3440
- C:\Windows\System\dOygyVX.exe
  C:\Windows\System\dOygyVX.exe
  2⤵
  PID:3480
- C:\Windows\System\xcfkccq.exe
  C:\Windows\System\xcfkccq.exe
  2⤵
  PID:3612
- C:\Windows\System\YBCJtHW.exe
  C:\Windows\System\YBCJtHW.exe
  2⤵
  PID:2824
- C:\Windows\System\Ywtkway.exe
  C:\Windows\System\Ywtkway.exe
  2⤵
  PID:2960
- C:\Windows\System\GumUnvc.exe
  C:\Windows\System\GumUnvc.exe
  2⤵
  PID:3696
- C:\Windows\System\GIlYEqS.exe
  C:\Windows\System\GIlYEqS.exe
  2⤵
  PID:3740
- C:\Windows\System\xIQMUDD.exe
  C:\Windows\System\xIQMUDD.exe
  2⤵
  PID:3776
- C:\Windows\System\umbHIUs.exe
  C:\Windows\System\umbHIUs.exe
  2⤵
  PID:3816
- C:\Windows\System\sunSRQu.exe
  C:\Windows\System\sunSRQu.exe
  2⤵
  PID:2908
- C:\Windows\System\LuinBFY.exe
  C:\Windows\System\LuinBFY.exe
  2⤵
  PID:3564
- C:\Windows\System\EGFJeIz.exe
  C:\Windows\System\EGFJeIz.exe
  2⤵
  PID:3600
- C:\Windows\System\QmUHBhu.exe
  C:\Windows\System\QmUHBhu.exe
  2⤵
  PID:3852
- C:\Windows\System\yuvDeTp.exe
  C:\Windows\System\yuvDeTp.exe
  2⤵
  PID:3888
- C:\Windows\System\aWBaQtL.exe
  C:\Windows\System\aWBaQtL.exe
  2⤵
  PID:3896
- C:\Windows\System\tSSvJNb.exe
  C:\Windows\System\tSSvJNb.exe
  2⤵
  PID:3720
- C:\Windows\System\ZjVtVzY.exe
  C:\Windows\System\ZjVtVzY.exe
  2⤵
  PID:3940
- C:\Windows\System\LdfvhAI.exe
  C:\Windows\System\LdfvhAI.exe
  2⤵
  PID:3984
- C:\Windows\System\rSnlumv.exe
  C:\Windows\System\rSnlumv.exe
  2⤵
  PID:3912
- C:\Windows\System\cSCaoAb.exe
  C:\Windows\System\cSCaoAb.exe
  2⤵
  PID:3920
- C:\Windows\System\QnGaQsu.exe
  C:\Windows\System\QnGaQsu.exe
  2⤵
  PID:3832
- C:\Windows\System\xhhqyJo.exe
  C:\Windows\System\xhhqyJo.exe
  2⤵
  PID:4024
- C:\Windows\System\hKsaGXP.exe
  C:\Windows\System\hKsaGXP.exe
  2⤵
  PID:4060
- C:\Windows\System\lVctXaI.exe
  C:\Windows\System\lVctXaI.exe
  2⤵
  PID:3960
- C:\Windows\System\fKTfJYh.exe
  C:\Windows\System\fKTfJYh.exe
  2⤵
  PID:2928
- C:\Windows\System\NOdNvBf.exe
  C:\Windows\System\NOdNvBf.exe
  2⤵
  PID:1840
- C:\Windows\System\cYZFgGF.exe
  C:\Windows\System\cYZFgGF.exe
  2⤵
  PID:2664
- C:\Windows\System\xveeCJS.exe
  C:\Windows\System\xveeCJS.exe
  2⤵
  PID:2304
- C:\Windows\System\BsfjElE.exe
  C:\Windows\System\BsfjElE.exe
  2⤵
  PID:3200
- C:\Windows\System\deYepYn.exe
  C:\Windows\System\deYepYn.exe
  2⤵
  PID:2568
- C:\Windows\System\MTKTtLn.exe
  C:\Windows\System\MTKTtLn.exe
  2⤵
  PID:3128
- C:\Windows\System\JxzkayX.exe
  C:\Windows\System\JxzkayX.exe
  2⤵
  PID:4044
- C:\Windows\System\dGEOZAN.exe
  C:\Windows\System\dGEOZAN.exe
  2⤵
  PID:3380
- C:\Windows\System\yzNQqWp.exe
  C:\Windows\System\yzNQqWp.exe
  2⤵
  PID:1188
- C:\Windows\System\kGDdePq.exe
  C:\Windows\System\kGDdePq.exe
  2⤵
  PID:3136
- C:\Windows\System\CuwKnXI.exe
  C:\Windows\System\CuwKnXI.exe
  2⤵
  PID:1808
- C:\Windows\System\rvEidlx.exe
  C:\Windows\System\rvEidlx.exe
  2⤵
  PID:3368
- C:\Windows\System\fIdEXXt.exe
  C:\Windows\System\fIdEXXt.exe
  2⤵
  PID:2280
- C:\Windows\System\UJuDNYW.exe
  C:\Windows\System\UJuDNYW.exe
  2⤵
  PID:3456
- C:\Windows\System\vvnaLjp.exe
  C:\Windows\System\vvnaLjp.exe
  2⤵
  PID:3188
- C:\Windows\System\WbxFVwp.exe
  C:\Windows\System\WbxFVwp.exe
  2⤵
  PID:3508
- C:\Windows\System\CKJmVxF.exe
  C:\Windows\System\CKJmVxF.exe
  2⤵
  PID:3476
- C:\Windows\System\clPOzsE.exe
  C:\Windows\System\clPOzsE.exe
  2⤵
  PID:3436
- C:\Windows\System\GTDcUyB.exe
  C:\Windows\System\GTDcUyB.exe
  2⤵
  PID:3488
- C:\Windows\System\sWSYvWc.exe
  C:\Windows\System\sWSYvWc.exe
  2⤵
  PID:3668
- C:\Windows\System\rwZPLIp.exe
  C:\Windows\System\rwZPLIp.exe
  2⤵
  PID:3772
- C:\Windows\System\WeGBmJA.exe
  C:\Windows\System\WeGBmJA.exe
  2⤵
  PID:2600
- C:\Windows\System\PKTHiJj.exe
  C:\Windows\System\PKTHiJj.exe
  2⤵
  PID:3644
- C:\Windows\System\xwVnUiN.exe
  C:\Windows\System\xwVnUiN.exe
  2⤵
  PID:1712
- C:\Windows\System\GhEuKLH.exe
  C:\Windows\System\GhEuKLH.exe
  2⤵
  PID:2608
- C:\Windows\System\BnxIFmb.exe
  C:\Windows\System\BnxIFmb.exe
  2⤵
  PID:1920
- C:\Windows\System\EsQRDYJ.exe
  C:\Windows\System\EsQRDYJ.exe
  2⤵
  PID:3916
- C:\Windows\System\EOvsJlL.exe
  C:\Windows\System\EOvsJlL.exe
  2⤵
  PID:3760
- C:\Windows\System\zfYWqgu.exe
  C:\Windows\System\zfYWqgu.exe
  2⤵
  PID:3872
- C:\Windows\System\nRGeyZh.exe
  C:\Windows\System\nRGeyZh.exe
  2⤵
  PID:2368
- C:\Windows\System\XKKMahb.exe
  C:\Windows\System\XKKMahb.exe
  2⤵
  PID:4004
- C:\Windows\System\ukWwFLI.exe
  C:\Windows\System\ukWwFLI.exe
  2⤵
  PID:4040
- C:\Windows\System\EmKWvJx.exe
  C:\Windows\System\EmKWvJx.exe
  2⤵
  PID:2736
- C:\Windows\System\uLOhikX.exe
  C:\Windows\System\uLOhikX.exe
  2⤵
  PID:3204
- C:\Windows\System\gBuLHDQ.exe
  C:\Windows\System\gBuLHDQ.exe
  2⤵
  PID:4080
- C:\Windows\System\XLkgyzy.exe
  C:\Windows\System\XLkgyzy.exe
  2⤵
  PID:2972
- C:\Windows\System\gNAVwIK.exe
  C:\Windows\System\gNAVwIK.exe
  2⤵
  PID:1680
- C:\Windows\System\YKEmrtx.exe
  C:\Windows\System\YKEmrtx.exe
  2⤵
  PID:3348
- C:\Windows\System\QSRXPkQ.exe
  C:\Windows\System\QSRXPkQ.exe
  2⤵
  PID:3296
- C:\Windows\System\rumKlQx.exe
  C:\Windows\System\rumKlQx.exe
  2⤵
  PID:3148
- C:\Windows\System\BNcGDxH.exe
  C:\Windows\System\BNcGDxH.exe
  2⤵
  PID:2780
- C:\Windows\System\awIvsSa.exe
  C:\Windows\System\awIvsSa.exe
  2⤵
  PID:3540
- C:\Windows\System\GOOVVUQ.exe
  C:\Windows\System\GOOVVUQ.exe
  2⤵
  PID:292
- C:\Windows\System\eBtvHXD.exe
  C:\Windows\System\eBtvHXD.exe
  2⤵
  PID:3664
- C:\Windows\System\RCSrmKI.exe
  C:\Windows\System\RCSrmKI.exe
  2⤵
  PID:288
- C:\Windows\System\COpmkCH.exe
  C:\Windows\System\COpmkCH.exe
  2⤵
  PID:3848
- C:\Windows\System\TuSWOWe.exe
  C:\Windows\System\TuSWOWe.exe
  2⤵
  PID:3648
- C:\Windows\System\aAtUVCB.exe
  C:\Windows\System\aAtUVCB.exe
  2⤵
  PID:3976
- C:\Windows\System\FqHHxrW.exe
  C:\Windows\System\FqHHxrW.exe
  2⤵
  PID:4020
- C:\Windows\System\eQOqCZk.exe
  C:\Windows\System\eQOqCZk.exe
  2⤵
  PID:1768
- C:\Windows\System\LoadaVH.exe
  C:\Windows\System\LoadaVH.exe
  2⤵
  PID:1936
- C:\Windows\System\vaJAlUp.exe
  C:\Windows\System\vaJAlUp.exe
  2⤵
  PID:2144
- C:\Windows\System\nDOsvWl.exe
  C:\Windows\System\nDOsvWl.exe
  2⤵
  PID:3360
- C:\Windows\System\gFWOITS.exe
  C:\Windows\System\gFWOITS.exe
  2⤵
  PID:1516
- C:\Windows\System\hUrmhyL.exe
  C:\Windows\System\hUrmhyL.exe
  2⤵
  PID:2268
- C:\Windows\System\Ytfqtua.exe
  C:\Windows\System\Ytfqtua.exe
  2⤵
  PID:3620
- C:\Windows\System\tYQqZxG.exe
  C:\Windows\System\tYQqZxG.exe
  2⤵
  PID:3736
- C:\Windows\System\QayewFY.exe
  C:\Windows\System\QayewFY.exe
  2⤵
  PID:3524
- C:\Windows\System\AYXYpng.exe
  C:\Windows\System\AYXYpng.exe
  2⤵
  PID:3640
- C:\Windows\System\dtDkAqq.exe
  C:\Windows\System\dtDkAqq.exe
  2⤵
  PID:2240
- C:\Windows\System\gabvcUk.exe
  C:\Windows\System\gabvcUk.exe
  2⤵
  PID:3996
- C:\Windows\System\zJYhWUK.exe
  C:\Windows\System\zJYhWUK.exe
  2⤵
  PID:3124
- C:\Windows\System\ykjBDqw.exe
  C:\Windows\System\ykjBDqw.exe
  2⤵
  PID:3076
- C:\Windows\System\eAmFwFW.exe
  C:\Windows\System\eAmFwFW.exe
  2⤵
  PID:656
- C:\Windows\System\aNEvxLs.exe
  C:\Windows\System\aNEvxLs.exe
  2⤵
  PID:4176
- C:\Windows\System\HsECgpb.exe
  C:\Windows\System\HsECgpb.exe
  2⤵
  PID:4244
- C:\Windows\System\nrMxcxW.exe
  C:\Windows\System\nrMxcxW.exe
  2⤵
  PID:4300
- C:\Windows\System\BFjmXgt.exe
  C:\Windows\System\BFjmXgt.exe
  2⤵
  PID:4336
- C:\Windows\System\dHkDMrT.exe
  C:\Windows\System\dHkDMrT.exe
  2⤵
  PID:4360
- C:\Windows\System\nPflWmI.exe
  C:\Windows\System\nPflWmI.exe
  2⤵
  PID:4384
- C:\Windows\System\xVnRlZk.exe
  C:\Windows\System\xVnRlZk.exe
  2⤵
  PID:4404
- C:\Windows\System\iHWQNvK.exe
  C:\Windows\System\iHWQNvK.exe
  2⤵
  PID:4420
- C:\Windows\System\LhjDANj.exe
  C:\Windows\System\LhjDANj.exe
  2⤵
  PID:4464
- C:\Windows\System\rVfdUCd.exe
  C:\Windows\System\rVfdUCd.exe
  2⤵
  PID:4488
- C:\Windows\System\ubMRnmC.exe
  C:\Windows\System\ubMRnmC.exe
  2⤵
  PID:4504
- C:\Windows\System\UsrsjgS.exe
  C:\Windows\System\UsrsjgS.exe
  2⤵
  PID:4520
- C:\Windows\System\kzuAZSU.exe
  C:\Windows\System\kzuAZSU.exe
  2⤵
  PID:4536
- C:\Windows\System\ESrZeTd.exe
  C:\Windows\System\ESrZeTd.exe
  2⤵
  PID:4552
- C:\Windows\System\BkKuDCP.exe
  C:\Windows\System\BkKuDCP.exe
  2⤵
  PID:4568
- C:\Windows\System\Grzxwof.exe
  C:\Windows\System\Grzxwof.exe
  2⤵
  PID:4584
- C:\Windows\System\BadyZxV.exe
  C:\Windows\System\BadyZxV.exe
  2⤵
  PID:4600
- C:\Windows\System\zRPkYmN.exe
  C:\Windows\System\zRPkYmN.exe
  2⤵
  PID:4616
- C:\Windows\System\lzhRtSv.exe
  C:\Windows\System\lzhRtSv.exe
  2⤵
  PID:4632
- C:\Windows\System\gIszsMN.exe
  C:\Windows\System\gIszsMN.exe
  2⤵
  PID:4648
- C:\Windows\System\IzEoFsC.exe
  C:\Windows\System\IzEoFsC.exe
  2⤵
  PID:4664
- C:\Windows\System\eQusxtz.exe
  C:\Windows\System\eQusxtz.exe
  2⤵
  PID:4680
- C:\Windows\System\DisWPhU.exe
  C:\Windows\System\DisWPhU.exe
  2⤵
  PID:4696
- C:\Windows\System\WWlSPKm.exe
  C:\Windows\System\WWlSPKm.exe
  2⤵
  PID:4712
- C:\Windows\System\JHOjMXr.exe
  C:\Windows\System\JHOjMXr.exe
  2⤵
  PID:4728
- C:\Windows\System\DfanmzH.exe
  C:\Windows\System\DfanmzH.exe
  2⤵
  PID:4744
- C:\Windows\System\aqUyoBT.exe
  C:\Windows\System\aqUyoBT.exe
  2⤵
  PID:4760
- C:\Windows\System\LsSFcNv.exe
  C:\Windows\System\LsSFcNv.exe
  2⤵
  PID:4780
- C:\Windows\System\wbDMDci.exe
  C:\Windows\System\wbDMDci.exe
  2⤵
  PID:4796
- C:\Windows\System\xiHqWVG.exe
  C:\Windows\System\xiHqWVG.exe
  2⤵
  PID:4812
- C:\Windows\System\CcMJBJN.exe
  C:\Windows\System\CcMJBJN.exe
  2⤵
  PID:4832
- C:\Windows\System\MnhCAuW.exe
  C:\Windows\System\MnhCAuW.exe
  2⤵
  PID:4860
- C:\Windows\System\vlvXlgL.exe
  C:\Windows\System\vlvXlgL.exe
  2⤵
  PID:4876
- C:\Windows\System\NYBDDsy.exe
  C:\Windows\System\NYBDDsy.exe
  2⤵
  PID:4892
- C:\Windows\System\eAtnfvJ.exe
  C:\Windows\System\eAtnfvJ.exe
  2⤵
  PID:4912
- C:\Windows\System\otFUjCJ.exe
  C:\Windows\System\otFUjCJ.exe
  2⤵
  PID:4928
- C:\Windows\System\YYMKLZT.exe
  C:\Windows\System\YYMKLZT.exe
  2⤵
  PID:4948
- C:\Windows\System\miMAcqD.exe
  C:\Windows\System\miMAcqD.exe
  2⤵
  PID:4964
- C:\Windows\System\AfdcHWr.exe
  C:\Windows\System\AfdcHWr.exe
  2⤵
  PID:4980
- C:\Windows\System\NiSJUPQ.exe
  C:\Windows\System\NiSJUPQ.exe
  2⤵
  PID:4996
- C:\Windows\System\Hxvqeov.exe
  C:\Windows\System\Hxvqeov.exe
  2⤵
  PID:5016
- C:\Windows\System\eKqplyw.exe
  C:\Windows\System\eKqplyw.exe
  2⤵
  PID:5032
- C:\Windows\System\YEROctr.exe
  C:\Windows\System\YEROctr.exe
  2⤵
  PID:5048
- C:\Windows\System\VuLgeHd.exe
  C:\Windows\System\VuLgeHd.exe
  2⤵
  PID:5064
- C:\Windows\System\whaNfNW.exe
  C:\Windows\System\whaNfNW.exe
  2⤵
  PID:5084
- C:\Windows\System\TeYRmQY.exe
  C:\Windows\System\TeYRmQY.exe
  2⤵
  PID:5104
- C:\Windows\System\ryvveGf.exe
  C:\Windows\System\ryvveGf.exe
  2⤵
  PID:1496
- C:\Windows\System\xlLRwzJ.exe
  C:\Windows\System\xlLRwzJ.exe
  2⤵
  PID:1484
- C:\Windows\System\amFucEi.exe
  C:\Windows\System\amFucEi.exe
  2⤵
  PID:4100
- C:\Windows\System\DaCQMlX.exe
  C:\Windows\System\DaCQMlX.exe
  2⤵
  PID:4120
- C:\Windows\System\ufgHZNK.exe
  C:\Windows\System\ufgHZNK.exe
  2⤵
  PID:4136
- C:\Windows\System\UDHHACB.exe
  C:\Windows\System\UDHHACB.exe
  2⤵
  PID:3088
- C:\Windows\System\kDxpRdE.exe
  C:\Windows\System\kDxpRdE.exe
  2⤵
  PID:4148
- C:\Windows\System\KkRUXvV.exe
  C:\Windows\System\KkRUXvV.exe
  2⤵
  PID:4164
- C:\Windows\System\sMsEOod.exe
  C:\Windows\System\sMsEOod.exe
  2⤵
  PID:4260
- C:\Windows\System\GixLuGS.exe
  C:\Windows\System\GixLuGS.exe
  2⤵
  PID:4280
- C:\Windows\System\MgLEpgE.exe
  C:\Windows\System\MgLEpgE.exe
  2⤵
  PID:4344
- C:\Windows\System\cxJKPOL.exe
  C:\Windows\System\cxJKPOL.exe
  2⤵
  PID:4184
- C:\Windows\System\tfrYwhG.exe
  C:\Windows\System\tfrYwhG.exe
  2⤵
  PID:4392
- C:\Windows\System\OjhLbsj.exe
  C:\Windows\System\OjhLbsj.exe
  2⤵
  PID:4200
- C:\Windows\System\adNTPVn.exe
  C:\Windows\System\adNTPVn.exe
  2⤵
  PID:4220
- C:\Windows\System\tpSOUvx.exe
  C:\Windows\System\tpSOUvx.exe
  2⤵
  PID:4296
- C:\Windows\System\SpTYpDJ.exe
  C:\Windows\System\SpTYpDJ.exe
  2⤵
  PID:4328
- C:\Windows\System\UdpOdLI.exe
  C:\Windows\System\UdpOdLI.exe
  2⤵
  PID:4376
- C:\Windows\System\YcUGvUl.exe
  C:\Windows\System\YcUGvUl.exe
  2⤵
  PID:4372
- C:\Windows\System\xHvLtnn.exe
  C:\Windows\System\xHvLtnn.exe
  2⤵
  PID:4436
- C:\Windows\System\WMMqdMK.exe
  C:\Windows\System\WMMqdMK.exe
  2⤵
  PID:4448
- C:\Windows\System\nllSSrG.exe
  C:\Windows\System\nllSSrG.exe
  2⤵
  PID:4460
- C:\Windows\System\UrsJrqN.exe
  C:\Windows\System\UrsJrqN.exe
  2⤵
  PID:4496
- C:\Windows\System\ozzVCIq.exe
  C:\Windows\System\ozzVCIq.exe
  2⤵
  PID:4528
- C:\Windows\System\ZnvaKhg.exe
  C:\Windows\System\ZnvaKhg.exe
  2⤵
  PID:708
- C:\Windows\System\lbwlOSV.exe
  C:\Windows\System\lbwlOSV.exe
  2⤵
  PID:4564
- C:\Windows\System\hPDopXp.exe
  C:\Windows\System\hPDopXp.exe
  2⤵
  PID:4628
- C:\Windows\System\gHuukiP.exe
  C:\Windows\System\gHuukiP.exe
  2⤵
  PID:4720
- C:\Windows\System\gpypxIV.exe
  C:\Windows\System\gpypxIV.exe
  2⤵
  PID:4756
- C:\Windows\System\Oxgrdxs.exe
  C:\Windows\System\Oxgrdxs.exe
  2⤵
  PID:1912
- C:\Windows\System\ElYUBxB.exe
  C:\Windows\System\ElYUBxB.exe
  2⤵
  PID:4776
- C:\Windows\System\yUnlmFM.exe
  C:\Windows\System\yUnlmFM.exe
  2⤵
  PID:4608
- C:\Windows\System\rMpVJeO.exe
  C:\Windows\System\rMpVJeO.exe
  2⤵
  PID:4676
- C:\Windows\System\NJFqjcP.exe
  C:\Windows\System\NJFqjcP.exe
  2⤵
  PID:4740
- C:\Windows\System\RfyrLLB.exe
  C:\Windows\System\RfyrLLB.exe
  2⤵
  PID:4824
- C:\Windows\System\kkMKiFF.exe
  C:\Windows\System\kkMKiFF.exe
  2⤵
  PID:4808
- C:\Windows\System\lVsDCdx.exe
  C:\Windows\System\lVsDCdx.exe
  2⤵
  PID:2356
- C:\Windows\System\CPPLxZH.exe
  C:\Windows\System\CPPLxZH.exe
  2⤵
  PID:4804
- C:\Windows\System\QIncMuy.exe
  C:\Windows\System\QIncMuy.exe
  2⤵
  PID:4944
- C:\Windows\System\rEQpwmF.exe
  C:\Windows\System\rEQpwmF.exe
  2⤵
  PID:5004
- C:\Windows\System\pAlQghW.exe
  C:\Windows\System\pAlQghW.exe
  2⤵
  PID:5076
- C:\Windows\System\hCJZyzt.exe
  C:\Windows\System\hCJZyzt.exe
  2⤵
  PID:5112
- C:\Windows\System\oRKdpJj.exe
  C:\Windows\System\oRKdpJj.exe
  2⤵
  PID:4920
- C:\Windows\System\RpgFAnx.exe
  C:\Windows\System\RpgFAnx.exe
  2⤵
  PID:4988
- C:\Windows\System\GdKJjUh.exe
  C:\Windows\System\GdKJjUh.exe
  2⤵
  PID:2492
- C:\Windows\System\rWEDzLs.exe
  C:\Windows\System\rWEDzLs.exe
  2⤵
  PID:5100
- C:\Windows\System\MOXSERA.exe
  C:\Windows\System\MOXSERA.exe
  2⤵
  PID:5060
- C:\Windows\System\IkeYGnr.exe
  C:\Windows\System\IkeYGnr.exe
  2⤵
  PID:4128
- C:\Windows\System\cQtGZuO.exe
  C:\Windows\System\cQtGZuO.exe
  2⤵
  PID:4112
- C:\Windows\System\StgvhGm.exe
  C:\Windows\System\StgvhGm.exe
  2⤵
  PID:1688
- C:\Windows\System\QVjdCmM.exe
  C:\Windows\System\QVjdCmM.exe
  2⤵
  PID:4156
- C:\Windows\System\vlVcEer.exe
  C:\Windows\System\vlVcEer.exe
  2⤵
  PID:4276
- C:\Windows\System\VbulldD.exe
  C:\Windows\System\VbulldD.exe
  2⤵
  PID:4228
- C:\Windows\System\LREhDfd.exe
  C:\Windows\System\LREhDfd.exe
  2⤵
  PID:4324
- C:\Windows\System\GFgrnGG.exe
  C:\Windows\System\GFgrnGG.exe
  2⤵
  PID:4444
- C:\Windows\System\dvfrrOJ.exe
  C:\Windows\System\dvfrrOJ.exe
  2⤵
  PID:4472
- C:\Windows\System\LTtdIcT.exe
  C:\Windows\System\LTtdIcT.exe
  2⤵
  PID:4368
- C:\Windows\System\iBJEHLW.exe
  C:\Windows\System\iBJEHLW.exe
  2⤵
  PID:4400
- C:\Windows\System\qegMhJr.exe
  C:\Windows\System\qegMhJr.exe
  2⤵
  PID:2152
- C:\Windows\System\hvPjjSh.exe
  C:\Windows\System\hvPjjSh.exe
  2⤵
  PID:4560
- C:\Windows\System\ceKSucF.exe
  C:\Windows\System\ceKSucF.exe
  2⤵
  PID:4416
- C:\Windows\System\ObbqDtD.exe
  C:\Windows\System\ObbqDtD.exe
  2⤵
  PID:4788
- C:\Windows\System\ZqCzJUm.exe
  C:\Windows\System\ZqCzJUm.exe
  2⤵
  PID:4772
- C:\Windows\System\lWEyAlZ.exe
  C:\Windows\System\lWEyAlZ.exe
  2⤵
  PID:1744
- C:\Windows\System\iGpseia.exe
  C:\Windows\System\iGpseia.exe
  2⤵
  PID:2112
- C:\Windows\System\QRtpgGy.exe
  C:\Windows\System\QRtpgGy.exe
  2⤵
  PID:5012
- C:\Windows\System\dfWOanr.exe
  C:\Windows\System\dfWOanr.exe
  2⤵
  PID:5028
- C:\Windows\System\kynanrX.exe
  C:\Windows\System\kynanrX.exe
  2⤵
  PID:5116
- C:\Windows\System\XDNKwoO.exe
  C:\Windows\System\XDNKwoO.exe
  2⤵
  PID:4116
- C:\Windows\System\mkEoGOs.exe
  C:\Windows\System\mkEoGOs.exe
  2⤵
  PID:1832
- C:\Windows\System\jmkpxIF.exe
  C:\Windows\System\jmkpxIF.exe
  2⤵
  PID:4960
- C:\Windows\System\youbpOw.exe
  C:\Windows\System\youbpOw.exe
  2⤵
  PID:4840
- C:\Windows\System\GIVBFDZ.exe
  C:\Windows\System\GIVBFDZ.exe
  2⤵
  PID:2032
- C:\Windows\System\TmGsczo.exe
  C:\Windows\System\TmGsczo.exe
  2⤵
  PID:5080
- C:\Windows\System\MpzTXWS.exe
  C:\Windows\System\MpzTXWS.exe
  2⤵
  PID:2140
- C:\Windows\System\jDVfMng.exe
  C:\Windows\System\jDVfMng.exe
  2⤵
  PID:4644
- C:\Windows\System\XyEZjpn.exe
  C:\Windows\System\XyEZjpn.exe
  2⤵
  PID:4688
- C:\Windows\System\pxWAmsb.exe
  C:\Windows\System\pxWAmsb.exe
  2⤵
  PID:3028
- C:\Windows\System\oTvzrdU.exe
  C:\Windows\System\oTvzrdU.exe
  2⤵
  PID:3040
- C:\Windows\System\cFKEaBU.exe
  C:\Windows\System\cFKEaBU.exe
  2⤵
  PID:4292
- C:\Windows\System\ehSHsUg.exe
  C:\Windows\System\ehSHsUg.exe
  2⤵
  PID:4216
- C:\Windows\System\REMHCxx.exe
  C:\Windows\System\REMHCxx.exe
  2⤵
  PID:5072
- C:\Windows\System\DFDvffP.exe
  C:\Windows\System\DFDvffP.exe
  2⤵
  PID:4900
- C:\Windows\System\nFKksbd.exe
  C:\Windows\System\nFKksbd.exe
  2⤵
  PID:5132
- C:\Windows\System\SGWsRJa.exe
  C:\Windows\System\SGWsRJa.exe
  2⤵
  PID:5148
- C:\Windows\System\KbxVcAg.exe
  C:\Windows\System\KbxVcAg.exe
  2⤵
  PID:5164
- C:\Windows\System\qCduohd.exe
  C:\Windows\System\qCduohd.exe
  2⤵
  PID:5180
- C:\Windows\System\agAHedI.exe
  C:\Windows\System\agAHedI.exe
  2⤵
  PID:5196
- C:\Windows\System\EMLzval.exe
  C:\Windows\System\EMLzval.exe
  2⤵
  PID:5212
- C:\Windows\System\oVaWgiN.exe
  C:\Windows\System\oVaWgiN.exe
  2⤵
  PID:5228
- C:\Windows\System\lumaegL.exe
  C:\Windows\System\lumaegL.exe
  2⤵
  PID:5244
- C:\Windows\System\tfhKlaz.exe
  C:\Windows\System\tfhKlaz.exe
  2⤵
  PID:5260
- C:\Windows\System\mPBzfkk.exe
  C:\Windows\System\mPBzfkk.exe
  2⤵
  PID:5276
- C:\Windows\System\ZrzNGAa.exe
  C:\Windows\System\ZrzNGAa.exe
  2⤵
  PID:5292
- C:\Windows\System\LZigxap.exe
  C:\Windows\System\LZigxap.exe
  2⤵
  PID:5308
- C:\Windows\System\ZaMrphv.exe
  C:\Windows\System\ZaMrphv.exe
  2⤵
  PID:5324
- C:\Windows\System\YnlswGM.exe
  C:\Windows\System\YnlswGM.exe
  2⤵
  PID:5340
- C:\Windows\System\PhnKMhx.exe
  C:\Windows\System\PhnKMhx.exe
  2⤵
  PID:5356
- C:\Windows\System\eIRTkse.exe
  C:\Windows\System\eIRTkse.exe
  2⤵
  PID:5372
- C:\Windows\System\wdYgehO.exe
  C:\Windows\System\wdYgehO.exe
  2⤵
  PID:5388
- C:\Windows\System\aLSfqnz.exe
  C:\Windows\System\aLSfqnz.exe
  2⤵
  PID:5404
- C:\Windows\System\kPpocxA.exe
  C:\Windows\System\kPpocxA.exe
  2⤵
  PID:5420
- C:\Windows\System\HFugEwQ.exe
  C:\Windows\System\HFugEwQ.exe
  2⤵
  PID:5440
- C:\Windows\System\ZkUrizl.exe
  C:\Windows\System\ZkUrizl.exe
  2⤵
  PID:5456
- C:\Windows\System\npvBzOA.exe
  C:\Windows\System\npvBzOA.exe
  2⤵
  PID:5472
- C:\Windows\System\sJJInwD.exe
  C:\Windows\System\sJJInwD.exe
  2⤵
  PID:5488
- C:\Windows\System\lsQBleX.exe
  C:\Windows\System\lsQBleX.exe
  2⤵
  PID:5512
- C:\Windows\System\FuhTvxB.exe
  C:\Windows\System\FuhTvxB.exe
  2⤵
  PID:5528
- C:\Windows\System\vVXFuuK.exe
  C:\Windows\System\vVXFuuK.exe
  2⤵
  PID:5544
- C:\Windows\System\MVjqwkt.exe
  C:\Windows\System\MVjqwkt.exe
  2⤵
  PID:5560
- C:\Windows\System\mrvwfGs.exe
  C:\Windows\System\mrvwfGs.exe
  2⤵
  PID:5576
- C:\Windows\System\QvnnOYh.exe
  C:\Windows\System\QvnnOYh.exe
  2⤵
  PID:5596
- C:\Windows\System\oAnDSkc.exe
  C:\Windows\System\oAnDSkc.exe
  2⤵
  PID:5612
- C:\Windows\System\OBHcHnk.exe
  C:\Windows\System\OBHcHnk.exe
  2⤵
  PID:5628
- C:\Windows\System\pKtxyrR.exe
  C:\Windows\System\pKtxyrR.exe
  2⤵
  PID:5644
- C:\Windows\System\AwcEvPS.exe
  C:\Windows\System\AwcEvPS.exe
  2⤵
  PID:5660
- C:\Windows\System\GflIfxl.exe
  C:\Windows\System\GflIfxl.exe
  2⤵
  PID:5676
- C:\Windows\System\CYRwXIo.exe
  C:\Windows\System\CYRwXIo.exe
  2⤵
  PID:5692
- C:\Windows\System\YFNwsIH.exe
  C:\Windows\System\YFNwsIH.exe
  2⤵
  PID:5708
- C:\Windows\System\acjDiAz.exe
  C:\Windows\System\acjDiAz.exe
  2⤵
  PID:5748
- C:\Windows\System\itONTLu.exe
  C:\Windows\System\itONTLu.exe
  2⤵
  PID:5796
- C:\Windows\System\DatvYrm.exe
  C:\Windows\System\DatvYrm.exe
  2⤵
  PID:5824
- C:\Windows\System\mMvTbkH.exe
  C:\Windows\System\mMvTbkH.exe
  2⤵
  PID:5840
- C:\Windows\System\gTBhvyM.exe
  C:\Windows\System\gTBhvyM.exe
  2⤵
  PID:5856
- C:\Windows\System\lhlOYFY.exe
  C:\Windows\System\lhlOYFY.exe
  2⤵
  PID:5888
- C:\Windows\System\LhlejGw.exe
  C:\Windows\System\LhlejGw.exe
  2⤵
  PID:5904
- C:\Windows\System\amCMYFd.exe
  C:\Windows\System\amCMYFd.exe
  2⤵
  PID:5920
- C:\Windows\System\wmLgRBb.exe
  C:\Windows\System\wmLgRBb.exe
  2⤵
  PID:5936
- C:\Windows\System\RoqFobT.exe
  C:\Windows\System\RoqFobT.exe
  2⤵
  PID:5956
- C:\Windows\System\xTDtZhB.exe
  C:\Windows\System\xTDtZhB.exe
  2⤵
  PID:5972
- C:\Windows\System\ZJABHyr.exe
  C:\Windows\System\ZJABHyr.exe
  2⤵
  PID:5988
- C:\Windows\System\YtTHXpy.exe
  C:\Windows\System\YtTHXpy.exe
  2⤵
  PID:6004
- C:\Windows\System\kfQGplO.exe
  C:\Windows\System\kfQGplO.exe
  2⤵
  PID:6020
- C:\Windows\System\AmSbzxc.exe
  C:\Windows\System\AmSbzxc.exe
  2⤵
  PID:6040
- C:\Windows\System\aEjYBUw.exe
  C:\Windows\System\aEjYBUw.exe
  2⤵
  PID:6064
- C:\Windows\System\SoFsXoP.exe
  C:\Windows\System\SoFsXoP.exe
  2⤵
  PID:6080
- C:\Windows\System\nObzseH.exe
  C:\Windows\System\nObzseH.exe
  2⤵
  PID:6096
- C:\Windows\System\LQUpbsN.exe
  C:\Windows\System\LQUpbsN.exe
  2⤵
  PID:6112
- C:\Windows\System\mPmjRal.exe
  C:\Windows\System\mPmjRal.exe
  2⤵
  PID:6128
- C:\Windows\System\lbFuJxv.exe
  C:\Windows\System\lbFuJxv.exe
  2⤵
  PID:5140
- C:\Windows\System\WSPRuth.exe
  C:\Windows\System\WSPRuth.exe
  2⤵
  PID:5204
- C:\Windows\System\pRcebeE.exe
  C:\Windows\System\pRcebeE.exe
  2⤵
  PID:5300
- C:\Windows\System\cnpGEXb.exe
  C:\Windows\System\cnpGEXb.exe
  2⤵
  PID:5364
- C:\Windows\System\lGEUOVM.exe
  C:\Windows\System\lGEUOVM.exe
  2⤵
  PID:5428
- C:\Windows\System\oEOGEuu.exe
  C:\Windows\System\oEOGEuu.exe
  2⤵
  PID:3948
- C:\Windows\System\tlfcUcw.exe
  C:\Windows\System\tlfcUcw.exe
  2⤵
  PID:4272
- C:\Windows\System\HRQubBg.exe
  C:\Windows\System\HRQubBg.exe
  2⤵
  PID:4308
- C:\Windows\System\opmMHrq.exe
  C:\Windows\System\opmMHrq.exe
  2⤵
  PID:5056
- C:\Windows\System\zYfcghi.exe
  C:\Windows\System\zYfcghi.exe
  2⤵
  PID:4144
- C:\Windows\System\OVMYJrW.exe
  C:\Windows\System\OVMYJrW.exe
  2⤵
  PID:4240
- C:\Windows\System\QDZOJmk.exe
  C:\Windows\System\QDZOJmk.exe
  2⤵
  PID:4624
- C:\Windows\System\NeomIVi.exe
  C:\Windows\System\NeomIVi.exe
  2⤵
  PID:5192
- C:\Windows\System\akYTunR.exe
  C:\Windows\System\akYTunR.exe
  2⤵
  PID:5284
- C:\Windows\System\yCgKQmI.exe
  C:\Windows\System\yCgKQmI.exe
  2⤵
  PID:5348
- C:\Windows\System\SKqSxbm.exe
  C:\Windows\System\SKqSxbm.exe
  2⤵
  PID:5412
- C:\Windows\System\JyFluPc.exe
  C:\Windows\System\JyFluPc.exe
  2⤵
  PID:5464
- C:\Windows\System\JPjbgDi.exe
  C:\Windows\System\JPjbgDi.exe
  2⤵
  PID:5156
- C:\Windows\System\pFNXuOb.exe
  C:\Windows\System\pFNXuOb.exe
  2⤵
  PID:5536
- C:\Windows\System\logvDqe.exe
  C:\Windows\System\logvDqe.exe
  2⤵
  PID:4236
- C:\Windows\System\sZYCMMX.exe
  C:\Windows\System\sZYCMMX.exe
  2⤵
  PID:4940
- C:\Windows\System\sUgOAXN.exe
  C:\Windows\System\sUgOAXN.exe
  2⤵
  PID:5552
- C:\Windows\System\ANVhGiS.exe
  C:\Windows\System\ANVhGiS.exe
  2⤵
  PID:5452
- C:\Windows\System\heHMhgm.exe
  C:\Windows\System\heHMhgm.exe
  2⤵
  PID:5604
- C:\Windows\System\QRQRLxC.exe
  C:\Windows\System\QRQRLxC.exe
  2⤵
  PID:5636
- C:\Windows\System\dlScJgh.exe
  C:\Windows\System\dlScJgh.exe
  2⤵
  PID:5624
- C:\Windows\System\fPsrzTC.exe
  C:\Windows\System\fPsrzTC.exe
  2⤵
  PID:5724
- C:\Windows\System\JHyDVGY.exe
  C:\Windows\System\JHyDVGY.exe
  2⤵
  PID:5756
- C:\Windows\System\ItqXvmE.exe
  C:\Windows\System\ItqXvmE.exe
  2⤵
  PID:5776
- C:\Windows\System\vokizbL.exe
  C:\Windows\System\vokizbL.exe
  2⤵
  PID:5832
- C:\Windows\System\BXZCctS.exe
  C:\Windows\System\BXZCctS.exe
  2⤵
  PID:5852
- C:\Windows\System\TUoWsmH.exe
  C:\Windows\System\TUoWsmH.exe
  2⤵
  PID:5872
- C:\Windows\System\NCnwznn.exe
  C:\Windows\System\NCnwznn.exe
  2⤵
  PID:5912
- C:\Windows\System\EtdzHqA.exe
  C:\Windows\System\EtdzHqA.exe
  2⤵
  PID:5980
- C:\Windows\System\yZlbxIa.exe
  C:\Windows\System\yZlbxIa.exe
  2⤵
  PID:5928
- C:\Windows\System\oDHRXke.exe
  C:\Windows\System\oDHRXke.exe
  2⤵
  PID:5968
- C:\Windows\System\ZWyokcC.exe
  C:\Windows\System\ZWyokcC.exe
  2⤵
  PID:6032
- C:\Windows\System\MqsjcyZ.exe
  C:\Windows\System\MqsjcyZ.exe
  2⤵
  PID:6052
- C:\Windows\System\KsLgydI.exe
  C:\Windows\System\KsLgydI.exe
  2⤵
  PID:6072
- C:\Windows\System\cXVSiKb.exe
  C:\Windows\System\cXVSiKb.exe
  2⤵
  PID:5236
- C:\Windows\System\VOboHGf.exe
  C:\Windows\System\VOboHGf.exe
  2⤵
  PID:5272
- C:\Windows\System\MwjNUAk.exe
  C:\Windows\System\MwjNUAk.exe
  2⤵
  PID:5172
- C:\Windows\System\PpcxRXI.exe
  C:\Windows\System\PpcxRXI.exe
  2⤵
  PID:4708
- C:\Windows\System\BzNhbfT.exe
  C:\Windows\System\BzNhbfT.exe
  2⤵
  PID:4356
- C:\Windows\System\XumlIIu.exe
  C:\Windows\System\XumlIIu.exe
  2⤵
  PID:5252
- C:\Windows\System\zeaNmzL.exe
  C:\Windows\System\zeaNmzL.exe
  2⤵
  PID:5380
- C:\Windows\System\CClZGcE.exe
  C:\Windows\System\CClZGcE.exe
  2⤵
  PID:5400
- C:\Windows\System\TtJcAfX.exe
  C:\Windows\System\TtJcAfX.exe
  2⤵
  PID:4976
- C:\Windows\System\hBWeDgE.exe
  C:\Windows\System\hBWeDgE.exe
  2⤵
  PID:5224
- C:\Windows\System\XUKBgVr.exe
  C:\Windows\System\XUKBgVr.exe
  2⤵
  PID:2724
- C:\Windows\System\SgZgLBO.exe
  C:\Windows\System\SgZgLBO.exe
  2⤵
  PID:5188
- C:\Windows\System\dICxsOF.exe
  C:\Windows\System\dICxsOF.exe
  2⤵
  PID:4820
- C:\Windows\System\hzoxRDU.exe
  C:\Windows\System\hzoxRDU.exe
  2⤵
  PID:5480
- C:\Windows\System\WokBCwS.exe
  C:\Windows\System\WokBCwS.exe
  2⤵
  PID:5484
- C:\Windows\System\uQtMUMr.exe
  C:\Windows\System\uQtMUMr.exe
  2⤵
  PID:5732
- C:\Windows\System\yrRczjw.exe
  C:\Windows\System\yrRczjw.exe
  2⤵
  PID:5816
- C:\Windows\System\DiUMBLf.exe
  C:\Windows\System\DiUMBLf.exe
  2⤵
  PID:5608
- C:\Windows\System\LUtpGQu.exe
  C:\Windows\System\LUtpGQu.exe
  2⤵
  PID:6036
- C:\Windows\System\AZTnnfP.exe
  C:\Windows\System\AZTnnfP.exe
  2⤵
  PID:5688
- C:\Windows\System\QcScbdZ.exe
  C:\Windows\System\QcScbdZ.exe
  2⤵
  PID:6140
- C:\Windows\System\gtbHUhK.exe
  C:\Windows\System\gtbHUhK.exe
  2⤵
  PID:5684
- C:\Windows\System\srosJuD.exe
  C:\Windows\System\srosJuD.exe
  2⤵
  PID:1448
- C:\Windows\System\iNvRjmQ.exe
  C:\Windows\System\iNvRjmQ.exe
  2⤵
  PID:448
- C:\Windows\System\ghsautP.exe
  C:\Windows\System\ghsautP.exe
  2⤵
  PID:6028
- C:\Windows\System\qaEtErF.exe
  C:\Windows\System\qaEtErF.exe
  2⤵
  PID:6108
- C:\Windows\System\ujtZnzP.exe
  C:\Windows\System\ujtZnzP.exe
  2⤵
  PID:4972
- C:\Windows\System\iNZWLrh.exe
  C:\Windows\System\iNZWLrh.exe
  2⤵
  PID:5496
- C:\Windows\System\bSrJjBQ.exe
  C:\Windows\System\bSrJjBQ.exe
  2⤵
  PID:5448
- C:\Windows\System\HbMaSsr.exe
  C:\Windows\System\HbMaSsr.exe
  2⤵
  PID:5964
- C:\Windows\System\VBqcRVG.exe
  C:\Windows\System\VBqcRVG.exe
  2⤵
  PID:5896
- C:\Windows\System\xuagcIi.exe
  C:\Windows\System\xuagcIi.exe
  2⤵
  PID:5572
- C:\Windows\System\gjviSSq.exe
  C:\Windows\System\gjviSSq.exe
  2⤵
  PID:5944
- C:\Windows\System\nolcgow.exe
  C:\Windows\System\nolcgow.exe
  2⤵
  PID:6124
- C:\Windows\System\hrROOPG.exe
  C:\Windows\System\hrROOPG.exe
  2⤵
  PID:4544
- C:\Windows\System\YkkyhCn.exe
  C:\Windows\System\YkkyhCn.exe
  2⤵
  PID:5584
- C:\Windows\System\QSxHULF.exe
  C:\Windows\System\QSxHULF.exe
  2⤵
  PID:5704
- C:\Windows\System\xwiLSbh.exe
  C:\Windows\System\xwiLSbh.exe
  2⤵
  PID:6152
- C:\Windows\System\buQHWJP.exe
  C:\Windows\System\buQHWJP.exe
  2⤵
  PID:6168
- C:\Windows\System\DdGaIYe.exe
  C:\Windows\System\DdGaIYe.exe
  2⤵
  PID:6184
- C:\Windows\System\bChsQcM.exe
  C:\Windows\System\bChsQcM.exe
  2⤵
  PID:6200
- C:\Windows\System\AsFoBJA.exe
  C:\Windows\System\AsFoBJA.exe
  2⤵
  PID:6220
- C:\Windows\System\eSgoAoF.exe
  C:\Windows\System\eSgoAoF.exe
  2⤵
  PID:6236
- C:\Windows\System\yUAgOfh.exe
  C:\Windows\System\yUAgOfh.exe
  2⤵
  PID:6264
- C:\Windows\System\eqeexvG.exe
  C:\Windows\System\eqeexvG.exe
  2⤵
  PID:6280
- C:\Windows\System\xBevxqy.exe
  C:\Windows\System\xBevxqy.exe
  2⤵
  PID:6296
- C:\Windows\System\vwoBeFj.exe
  C:\Windows\System\vwoBeFj.exe
  2⤵
  PID:6312
- C:\Windows\System\IfnVwAR.exe
  C:\Windows\System\IfnVwAR.exe
  2⤵
  PID:6328
- C:\Windows\System\oRqKpij.exe
  C:\Windows\System\oRqKpij.exe
  2⤵
  PID:6344
- C:\Windows\System\mcdyNiE.exe
  C:\Windows\System\mcdyNiE.exe
  2⤵
  PID:6360
- C:\Windows\System\kEMXTHT.exe
  C:\Windows\System\kEMXTHT.exe
  2⤵
  PID:6376
- C:\Windows\System\AQCsFMs.exe
  C:\Windows\System\AQCsFMs.exe
  2⤵
  PID:6392
- C:\Windows\System\qtBSjFK.exe
  C:\Windows\System\qtBSjFK.exe
  2⤵
  PID:6408
- C:\Windows\System\lKXcEwz.exe
  C:\Windows\System\lKXcEwz.exe
  2⤵
  PID:6424
- C:\Windows\System\faiPcJQ.exe
  C:\Windows\System\faiPcJQ.exe
  2⤵
  PID:6440
- C:\Windows\System\SvFsXHw.exe
  C:\Windows\System\SvFsXHw.exe
  2⤵
  PID:6460
- C:\Windows\System\mhuhfEc.exe
  C:\Windows\System\mhuhfEc.exe
  2⤵
  PID:6476
- C:\Windows\System\wUBlwGE.exe
  C:\Windows\System\wUBlwGE.exe
  2⤵
  PID:6492
- C:\Windows\System\fqSjIJC.exe
  C:\Windows\System\fqSjIJC.exe
  2⤵
  PID:6508
- C:\Windows\System\iJlONbD.exe
  C:\Windows\System\iJlONbD.exe
  2⤵
  PID:6536
- C:\Windows\System\ttYSIeq.exe
  C:\Windows\System\ttYSIeq.exe
  2⤵
  PID:6568
- C:\Windows\System\HJLSRaY.exe
  C:\Windows\System\HJLSRaY.exe
  2⤵
  PID:6584
- C:\Windows\System\TumbIJA.exe
  C:\Windows\System\TumbIJA.exe
  2⤵
  PID:6600
- C:\Windows\System\FuSIuDi.exe
  C:\Windows\System\FuSIuDi.exe
  2⤵
  PID:6616
- C:\Windows\System\wBblsEZ.exe
  C:\Windows\System\wBblsEZ.exe
  2⤵
  PID:6640
- C:\Windows\System\oqvMwNn.exe
  C:\Windows\System\oqvMwNn.exe
  2⤵
  PID:6656
- C:\Windows\System\KBzPMai.exe
  C:\Windows\System\KBzPMai.exe
  2⤵
  PID:6672
- C:\Windows\System\lCKnPwQ.exe
  C:\Windows\System\lCKnPwQ.exe
  2⤵
  PID:6688
- C:\Windows\System\BIWBmOZ.exe
  C:\Windows\System\BIWBmOZ.exe
  2⤵
  PID:6716
- C:\Windows\System\igHFxYU.exe
  C:\Windows\System\igHFxYU.exe
  2⤵
  PID:6732
- C:\Windows\System\cmbtKrZ.exe
  C:\Windows\System\cmbtKrZ.exe
  2⤵
  PID:6756
- C:\Windows\System\NBqDZhd.exe
  C:\Windows\System\NBqDZhd.exe
  2⤵
  PID:6772
- C:\Windows\System\OcZaEAk.exe
  C:\Windows\System\OcZaEAk.exe
  2⤵
  PID:6792
- C:\Windows\System\Siwblqb.exe
  C:\Windows\System\Siwblqb.exe
  2⤵
  PID:6816
- C:\Windows\System\KVdVQsW.exe
  C:\Windows\System\KVdVQsW.exe
  2⤵
  PID:6832
- C:\Windows\System\prMbagM.exe
  C:\Windows\System\prMbagM.exe
  2⤵
  PID:6848
- C:\Windows\System\sRqyKPU.exe
  C:\Windows\System\sRqyKPU.exe
  2⤵
  PID:6872
- C:\Windows\System\CdHacMG.exe
  C:\Windows\System\CdHacMG.exe
  2⤵
  PID:6888
- C:\Windows\System\TQCZiuH.exe
  C:\Windows\System\TQCZiuH.exe
  2⤵
  PID:6904
- C:\Windows\System\WTYrvBL.exe
  C:\Windows\System\WTYrvBL.exe
  2⤵
  PID:6924
- C:\Windows\System\UGramus.exe
  C:\Windows\System\UGramus.exe
  2⤵
  PID:6940
- C:\Windows\System\JGQRXCd.exe
  C:\Windows\System\JGQRXCd.exe
  2⤵
  PID:6960
- C:\Windows\System\PdgVpvr.exe
  C:\Windows\System\PdgVpvr.exe
  2⤵
  PID:6976
- C:\Windows\System\mgGQrXz.exe
  C:\Windows\System\mgGQrXz.exe
  2⤵
  PID:6992
- C:\Windows\System\lmWLVHo.exe
  C:\Windows\System\lmWLVHo.exe
  2⤵
  PID:7012
- C:\Windows\System\vfGXkMm.exe
  C:\Windows\System\vfGXkMm.exe
  2⤵
  PID:7032
- C:\Windows\System\nSicOOJ.exe
  C:\Windows\System\nSicOOJ.exe
  2⤵
  PID:7144
- C:\Windows\System\BIpdYdk.exe
  C:\Windows\System\BIpdYdk.exe
  2⤵
  PID:7160
- C:\Windows\System\gwLdyvV.exe
  C:\Windows\System\gwLdyvV.exe
  2⤵
  PID:6196
- C:\Windows\System\qgsAUmU.exe
  C:\Windows\System\qgsAUmU.exe
  2⤵
  PID:2740
- C:\Windows\System\PchQDzN.exe
  C:\Windows\System\PchQDzN.exe
  2⤵
  PID:5320
- C:\Windows\System\kRQEzvK.exe
  C:\Windows\System\kRQEzvK.exe
  2⤵
  PID:5336
- C:\Windows\System\WolYKgb.exe
  C:\Windows\System\WolYKgb.exe
  2⤵
  PID:6148
- C:\Windows\System\qNnRpaX.exe
  C:\Windows\System\qNnRpaX.exe
  2⤵
  PID:5932
- C:\Windows\System\yBCavkk.exe
  C:\Windows\System\yBCavkk.exe
  2⤵
  PID:6212
- C:\Windows\System\vFOgVlR.exe
  C:\Windows\System\vFOgVlR.exe
  2⤵
  PID:6308
- C:\Windows\System\LRxoEhg.exe
  C:\Windows\System\LRxoEhg.exe
  2⤵
  PID:6260
- C:\Windows\System\SKZIttY.exe
  C:\Windows\System\SKZIttY.exe
  2⤵
  PID:6320
- C:\Windows\System\svSBIAz.exe
  C:\Windows\System\svSBIAz.exe
  2⤵
  PID:6400
- C:\Windows\System\mHGRsip.exe
  C:\Windows\System\mHGRsip.exe
  2⤵
  PID:6468
- C:\Windows\System\QtSewEj.exe
  C:\Windows\System\QtSewEj.exe
  2⤵
  PID:6488
- C:\Windows\System\ezCSWQT.exe
  C:\Windows\System\ezCSWQT.exe
  2⤵
  PID:6452
- C:\Windows\System\zLBuPQH.exe
  C:\Windows\System\zLBuPQH.exe
  2⤵
  PID:6352
- C:\Windows\System\znwGiVB.exe
  C:\Windows\System\znwGiVB.exe
  2⤵
  PID:6552
- C:\Windows\System\SrJrFFb.exe
  C:\Windows\System\SrJrFFb.exe
  2⤵
  PID:6532
- C:\Windows\System\SYNTlPq.exe
  C:\Windows\System\SYNTlPq.exe
  2⤵
  PID:6592
- C:\Windows\System\gXafPlc.exe
  C:\Windows\System\gXafPlc.exe
  2⤵
  PID:6632
- C:\Windows\System\ssRyAHc.exe
  C:\Windows\System\ssRyAHc.exe
  2⤵
  PID:6576
- C:\Windows\System\XrlhFVA.exe
  C:\Windows\System\XrlhFVA.exe
  2⤵
  PID:6580
- C:\Windows\System\jhWWyCK.exe
  C:\Windows\System\jhWWyCK.exe
  2⤵
  PID:6724
- C:\Windows\System\uboqwrr.exe
  C:\Windows\System\uboqwrr.exe
  2⤵
  PID:6808
- C:\Windows\System\XcWbAqW.exe
  C:\Windows\System\XcWbAqW.exe
  2⤵
  PID:6884
- C:\Windows\System\dEACkDw.exe
  C:\Windows\System\dEACkDw.exe
  2⤵
  PID:7068
- C:\Windows\System\ARhqMkI.exe
  C:\Windows\System\ARhqMkI.exe
  2⤵
  PID:6748
- C:\Windows\System\hQtoQlN.exe
  C:\Windows\System\hQtoQlN.exe
  2⤵
  PID:6860
- C:\Windows\System\aRibykJ.exe
  C:\Windows\System\aRibykJ.exe
  2⤵
  PID:6900
- C:\Windows\System\XNFZSZe.exe
  C:\Windows\System\XNFZSZe.exe
  2⤵
  PID:6972
- C:\Windows\System\mkxDfYO.exe
  C:\Windows\System\mkxDfYO.exe
  2⤵
  PID:7048
- C:\Windows\System\yzIjTMv.exe
  C:\Windows\System\yzIjTMv.exe
  2⤵
  PID:7064
- C:\Windows\System\etmGzWg.exe
  C:\Windows\System\etmGzWg.exe
  2⤵
  PID:6952
- C:\Windows\System\KuaSwhQ.exe
  C:\Windows\System\KuaSwhQ.exe
  2⤵
  PID:7028
- C:\Windows\System\qdPmPlu.exe
  C:\Windows\System\qdPmPlu.exe
  2⤵
  PID:6956
- C:\Windows\System\XEdMYHA.exe
  C:\Windows\System\XEdMYHA.exe
  2⤵
  PID:6800
- C:\Windows\System\mmrnYwI.exe
  C:\Windows\System\mmrnYwI.exe
  2⤵
  PID:5948
- C:\Windows\System\tuUGOBg.exe
  C:\Windows\System\tuUGOBg.exe
  2⤵
  PID:6192
- C:\Windows\System\COTimXF.exe
  C:\Windows\System\COTimXF.exe
  2⤵
  PID:6136
- C:\Windows\System\FZQHtdN.exe
  C:\Windows\System\FZQHtdN.exe
  2⤵
  PID:6208
- C:\Windows\System\fWSUIeq.exe
  C:\Windows\System\fWSUIeq.exe
  2⤵
  PID:6372
- C:\Windows\System\xDzeOMT.exe
  C:\Windows\System\xDzeOMT.exe
  2⤵
  PID:6180
- C:\Windows\System\rRXfXdc.exe
  C:\Windows\System\rRXfXdc.exe
  2⤵
  PID:6256
- C:\Windows\System\aXAQvCw.exe
  C:\Windows\System\aXAQvCw.exe
  2⤵
  PID:6484
- C:\Windows\System\MUJLgwQ.exe
  C:\Windows\System\MUJLgwQ.exe
  2⤵
  PID:6528
- C:\Windows\System\tEeATyo.exe
  C:\Windows\System\tEeATyo.exe
  2⤵
  PID:6288
- C:\Windows\System\ecqztiO.exe
  C:\Windows\System\ecqztiO.exe
  2⤵
  PID:6556
- C:\Windows\System\EIrUkkK.exe
  C:\Windows\System\EIrUkkK.exe
  2⤵
  PID:6664
- C:\Windows\System\CnSYFDf.exe
  C:\Windows\System\CnSYFDf.exe
  2⤵
  PID:6612
- C:\Windows\System\lrfSbvQ.exe
  C:\Windows\System\lrfSbvQ.exe
  2⤵
  PID:6712
- C:\Windows\System\tqaILEY.exe
  C:\Windows\System\tqaILEY.exe
  2⤵
  PID:6764
- C:\Windows\System\CJmuiGx.exe
  C:\Windows\System\CJmuiGx.exe
  2⤵
  PID:6780
- C:\Windows\System\GrUswsj.exe
  C:\Windows\System\GrUswsj.exe
  2⤵
  PID:6856
- C:\Windows\System\ahmykep.exe
  C:\Windows\System\ahmykep.exe
  2⤵
  PID:6896
- C:\Windows\System\pcwmXQb.exe
  C:\Windows\System\pcwmXQb.exe
  2⤵
  PID:7076
- C:\Windows\System\blQsPZj.exe
  C:\Windows\System\blQsPZj.exe
  2⤵
  PID:6840
- C:\Windows\System\IdiukRx.exe
  C:\Windows\System\IdiukRx.exe
  2⤵
  PID:7056
- C:\Windows\System\QaAhZdN.exe
  C:\Windows\System\QaAhZdN.exe
  2⤵
  PID:6160
- C:\Windows\System\rZhJHan.exe
  C:\Windows\System\rZhJHan.exe
  2⤵
  PID:5568
- C:\Windows\System\NzuaQMb.exe
  C:\Windows\System\NzuaQMb.exe
  2⤵
  PID:6232
- C:\Windows\System\UQvYFuX.exe
  C:\Windows\System\UQvYFuX.exe
  2⤵
  PID:6520
- C:\Windows\System\JEaFZZd.exe
  C:\Windows\System\JEaFZZd.exe
  2⤵
  PID:6104
- C:\Windows\System\PlItKVx.exe
  C:\Windows\System\PlItKVx.exe
  2⤵
  PID:6968
- C:\Windows\System\JwzBlzy.exe
  C:\Windows\System\JwzBlzy.exe
  2⤵
  PID:6292
- C:\Windows\System\CeHQbYv.exe
  C:\Windows\System\CeHQbYv.exe
  2⤵
  PID:6804
- C:\Windows\System\JXoPBLM.exe
  C:\Windows\System\JXoPBLM.exe
  2⤵
  PID:7040
- C:\Windows\System\GYoXVeS.exe
  C:\Windows\System\GYoXVeS.exe
  2⤵
  PID:6744
- C:\Windows\System\KmuQruz.exe
  C:\Windows\System\KmuQruz.exe
  2⤵
  PID:6504
- C:\Windows\System\nWxruer.exe
  C:\Windows\System\nWxruer.exe
  2⤵
  PID:6524
- C:\Windows\System\EwMqzHt.exe
  C:\Windows\System\EwMqzHt.exe
  2⤵
  PID:6868
- C:\Windows\System\CoTWfun.exe
  C:\Windows\System\CoTWfun.exe
  2⤵
  PID:7152
- C:\Windows\System\xTezuoc.exe
  C:\Windows\System\xTezuoc.exe
  2⤵
  PID:7020
- C:\Windows\System\peOULSO.exe
  C:\Windows\System\peOULSO.exe
  2⤵
  PID:6704
- C:\Windows\System\KgQfNba.exe
  C:\Windows\System\KgQfNba.exe
  2⤵
  PID:6420
- C:\Windows\System\BKFToHn.exe
  C:\Windows\System\BKFToHn.exe
  2⤵
  PID:6988
- C:\Windows\System\MvtClQf.exe
  C:\Windows\System\MvtClQf.exe
  2⤵
  PID:7008
- C:\Windows\System\KvHyGOb.exe
  C:\Windows\System\KvHyGOb.exe
  2⤵
  PID:5884
- C:\Windows\System\fqzupPg.exe
  C:\Windows\System\fqzupPg.exe
  2⤵
  PID:7456
- C:\Windows\System\pOcCaLC.exe
  C:\Windows\System\pOcCaLC.exe
  2⤵
  PID:7488
- C:\Windows\System\ePCitnR.exe
  C:\Windows\System\ePCitnR.exe
  2⤵
  PID:7504
- C:\Windows\System\OgrRcQu.exe
  C:\Windows\System\OgrRcQu.exe
  2⤵
  PID:7524
- C:\Windows\System\aJYYWYB.exe
  C:\Windows\System\aJYYWYB.exe
  2⤵
  PID:7548
- C:\Windows\System\rLNeHli.exe
  C:\Windows\System\rLNeHli.exe
  2⤵
  PID:7564
- C:\Windows\System\asiTNvk.exe
  C:\Windows\System\asiTNvk.exe
  2⤵
  PID:7580
- C:\Windows\System\koRSFty.exe
  C:\Windows\System\koRSFty.exe
  2⤵
  PID:7596
- C:\Windows\System\OSnHGwX.exe
  C:\Windows\System\OSnHGwX.exe
  2⤵
  PID:7612
- C:\Windows\System\nyAuShq.exe
  C:\Windows\System\nyAuShq.exe
  2⤵
  PID:7628
- C:\Windows\System\fgIsHCO.exe
  C:\Windows\System\fgIsHCO.exe
  2⤵
  PID:7644
- C:\Windows\System\WbByVCM.exe
  C:\Windows\System\WbByVCM.exe
  2⤵
  PID:7660
- C:\Windows\System\HEksinZ.exe
  C:\Windows\System\HEksinZ.exe
  2⤵
  PID:7680
- C:\Windows\System\VtuWkmi.exe
  C:\Windows\System\VtuWkmi.exe
  2⤵
  PID:7696
- C:\Windows\System\jUTmJJA.exe
  C:\Windows\System\jUTmJJA.exe
  2⤵
  PID:7712
- C:\Windows\System\MLIPaKP.exe
  C:\Windows\System\MLIPaKP.exe
  2⤵
  PID:7728
- C:\Windows\System\PfETXpx.exe
  C:\Windows\System\PfETXpx.exe
  2⤵
  PID:7748
- C:\Windows\System\pDmkKDG.exe
  C:\Windows\System\pDmkKDG.exe
  2⤵
  PID:7764
- C:\Windows\System\UeRgqPB.exe
  C:\Windows\System\UeRgqPB.exe
  2⤵
  PID:7784
- C:\Windows\System\hPGDAuK.exe
  C:\Windows\System\hPGDAuK.exe
  2⤵
  PID:7800
- C:\Windows\System\XQZAhpp.exe
  C:\Windows\System\XQZAhpp.exe
  2⤵
  PID:7816
- C:\Windows\System\XohaWNz.exe
  C:\Windows\System\XohaWNz.exe
  2⤵
  PID:7832
- C:\Windows\System\ACmTjUT.exe
  C:\Windows\System\ACmTjUT.exe
  2⤵
  PID:7848
- C:\Windows\System\gTTdPsl.exe
  C:\Windows\System\gTTdPsl.exe
  2⤵
  PID:7864
- C:\Windows\System\RaoKJBR.exe
  C:\Windows\System\RaoKJBR.exe
  2⤵
  PID:7880
- C:\Windows\System\bTUIhTT.exe
  C:\Windows\System\bTUIhTT.exe
  2⤵
  PID:7896
- C:\Windows\System\yPeuaNg.exe
  C:\Windows\System\yPeuaNg.exe
  2⤵
  PID:7912
- C:\Windows\System\YtRHOZp.exe
  C:\Windows\System\YtRHOZp.exe
  2⤵
  PID:7928
- C:\Windows\System\jSegjsd.exe
  C:\Windows\System\jSegjsd.exe
  2⤵
  PID:7944
- C:\Windows\System\MaqGaBs.exe
  C:\Windows\System\MaqGaBs.exe
  2⤵
  PID:7960
- C:\Windows\System\TmodBFH.exe
  C:\Windows\System\TmodBFH.exe
  2⤵
  PID:7976
- C:\Windows\System\cWXFYfc.exe
  C:\Windows\System\cWXFYfc.exe
  2⤵
  PID:7992
- C:\Windows\System\vuLfEGG.exe
  C:\Windows\System\vuLfEGG.exe
  2⤵
  PID:8008
- C:\Windows\System\PDreMKp.exe
  C:\Windows\System\PDreMKp.exe
  2⤵
  PID:8024
- C:\Windows\System\bxsHfdG.exe
  C:\Windows\System\bxsHfdG.exe
  2⤵
  PID:8040
- C:\Windows\System\zfSprOD.exe
  C:\Windows\System\zfSprOD.exe
  2⤵
  PID:8056
- C:\Windows\System\ybeQCOx.exe
  C:\Windows\System\ybeQCOx.exe
  2⤵
  PID:8072
- C:\Windows\System\UsUUrHE.exe
  C:\Windows\System\UsUUrHE.exe
  2⤵
  PID:8088
- C:\Windows\System\MfWBMWM.exe
  C:\Windows\System\MfWBMWM.exe
  2⤵
  PID:8104
- C:\Windows\System\McXKNgJ.exe
  C:\Windows\System\McXKNgJ.exe
  2⤵
  PID:8120
- C:\Windows\System\jEPuoUs.exe
  C:\Windows\System\jEPuoUs.exe
  2⤵
  PID:8136
- C:\Windows\System\pbDzMOJ.exe
  C:\Windows\System\pbDzMOJ.exe
  2⤵
  PID:8152
- C:\Windows\System\KCmcFcd.exe
  C:\Windows\System\KCmcFcd.exe
  2⤵
  PID:8168
- C:\Windows\System\upNIpzh.exe
  C:\Windows\System\upNIpzh.exe
  2⤵
  PID:8184
- C:\Windows\System\gqrhKFu.exe
  C:\Windows\System\gqrhKFu.exe
  2⤵
  PID:6436
- C:\Windows\System\vOmxfXS.exe
  C:\Windows\System\vOmxfXS.exe
  2⤵
  PID:7176
- C:\Windows\System\PqpBigY.exe
  C:\Windows\System\PqpBigY.exe
  2⤵
  PID:7192
- C:\Windows\System\nEaBvHf.exe
  C:\Windows\System\nEaBvHf.exe
  2⤵
  PID:7208
- C:\Windows\System\cEhLerV.exe
  C:\Windows\System\cEhLerV.exe
  2⤵
  PID:7224
- C:\Windows\System\oUHUtCF.exe
  C:\Windows\System\oUHUtCF.exe
  2⤵
  PID:7236
- C:\Windows\System\XwlshBx.exe
  C:\Windows\System\XwlshBx.exe
  2⤵
  PID:7252
- C:\Windows\System\HPWTuEo.exe
  C:\Windows\System\HPWTuEo.exe
  2⤵
  PID:7268
- C:\Windows\System\qvQuHif.exe
  C:\Windows\System\qvQuHif.exe
  2⤵
  PID:7284
- C:\Windows\System\kfINfOt.exe
  C:\Windows\System\kfINfOt.exe
  2⤵
  PID:7300
- C:\Windows\System\GkOZNky.exe
  C:\Windows\System\GkOZNky.exe
  2⤵
  PID:7316
- C:\Windows\System\bAMgTjZ.exe
  C:\Windows\System\bAMgTjZ.exe
  2⤵
  PID:7332
- C:\Windows\System\BbCgRbw.exe
  C:\Windows\System\BbCgRbw.exe
  2⤵
  PID:7348
- C:\Windows\System\LnCIIxT.exe
  C:\Windows\System\LnCIIxT.exe
  2⤵
  PID:7364
- C:\Windows\System\ogWQCEy.exe
  C:\Windows\System\ogWQCEy.exe
  2⤵
  PID:7380
- C:\Windows\System\OnVHqbK.exe
  C:\Windows\System\OnVHqbK.exe
  2⤵
  PID:7392
- C:\Windows\System\PTZIebc.exe
  C:\Windows\System\PTZIebc.exe
  2⤵
  PID:7412
- C:\Windows\System\aNUSQeA.exe
  C:\Windows\System\aNUSQeA.exe
  2⤵
  PID:7428
- C:\Windows\System\OUCJMWk.exe
  C:\Windows\System\OUCJMWk.exe
  2⤵
  PID:7448
- C:\Windows\System\WQGkAoV.exe
  C:\Windows\System\WQGkAoV.exe
  2⤵
  PID:7476
- C:\Windows\System\Rtvxclb.exe
  C:\Windows\System\Rtvxclb.exe
  2⤵
  PID:7496
- C:\Windows\System\UuUkVdY.exe
  C:\Windows\System\UuUkVdY.exe
  2⤵
  PID:7556
- C:\Windows\System\hRbkcft.exe
  C:\Windows\System\hRbkcft.exe
  2⤵
  PID:7540
- C:\Windows\System\ZvhQEfi.exe
  C:\Windows\System\ZvhQEfi.exe
  2⤵
  PID:7652
- C:\Windows\System\fLJiOZM.exe
  C:\Windows\System\fLJiOZM.exe
  2⤵
  PID:7688
- C:\Windows\System\IwdAldA.exe
  C:\Windows\System\IwdAldA.exe
  2⤵
  PID:7640
- C:\Windows\System\eCBhLxz.exe
  C:\Windows\System\eCBhLxz.exe
  2⤵
  PID:7708
- C:\Windows\System\EJrbGRM.exe
  C:\Windows\System\EJrbGRM.exe
  2⤵
  PID:2744
- C:\Windows\System\xbmlAzF.exe
  C:\Windows\System\xbmlAzF.exe
  2⤵
  PID:7740
- C:\Windows\System\DHIMZTi.exe
  C:\Windows\System\DHIMZTi.exe
  2⤵
  PID:7604
- C:\Windows\System\MoYdQCL.exe
  C:\Windows\System\MoYdQCL.exe
  2⤵
  PID:7796
- C:\Windows\System\jxEgcxy.exe
  C:\Windows\System\jxEgcxy.exe
  2⤵
  PID:7780
- C:\Windows\System\mMSIDBe.exe
  C:\Windows\System\mMSIDBe.exe
  2⤵
  PID:7812
- C:\Windows\System\dLPWBpC.exe
  C:\Windows\System\dLPWBpC.exe
  2⤵
  PID:7872
- C:\Windows\System\xBkaYgP.exe
  C:\Windows\System\xBkaYgP.exe
  2⤵
  PID:7876
- C:\Windows\System\gqRdVnK.exe
  C:\Windows\System\gqRdVnK.exe
  2⤵
  PID:7940
- C:\Windows\System\VssxUeJ.exe
  C:\Windows\System\VssxUeJ.exe
  2⤵
  PID:7984
- C:\Windows\System\JKIOjFS.exe
  C:\Windows\System\JKIOjFS.exe
  2⤵
  PID:8016
- C:\Windows\System\qQDjTvt.exe
  C:\Windows\System\qQDjTvt.exe
  2⤵
  PID:8080
- C:\Windows\System\nPfwqmO.exe
  C:\Windows\System\nPfwqmO.exe
  2⤵
  PID:8032
- C:\Windows\System\eOhUcPq.exe
  C:\Windows\System\eOhUcPq.exe
  2⤵
  PID:8144
- C:\Windows\System\TPfGfKN.exe
  C:\Windows\System\TPfGfKN.exe
  2⤵
  PID:8064
- C:\Windows\System\aNljpnt.exe
  C:\Windows\System\aNljpnt.exe
  2⤵
  PID:8180
- C:\Windows\System\bJFdMeG.exe
  C:\Windows\System\bJFdMeG.exe
  2⤵
  PID:7204
- C:\Windows\System\nMlayCz.exe
  C:\Windows\System\nMlayCz.exe
  2⤵
  PID:7220
- C:\Windows\System\RIIfYFB.exe
  C:\Windows\System\RIIfYFB.exe
  2⤵
  PID:6416
- C:\Windows\System\bUUtdKJ.exe
  C:\Windows\System\bUUtdKJ.exe
  2⤵
  PID:7244
- C:\Windows\System\xTtiNFp.exe
  C:\Windows\System\xTtiNFp.exe
  2⤵
  PID:7292
- C:\Windows\System\qauIfNf.exe
  C:\Windows\System\qauIfNf.exe
  2⤵
  PID:7312
- C:\Windows\System\xLSVzGO.exe
  C:\Windows\System\xLSVzGO.exe
  2⤵
  PID:7324
- C:\Windows\System\BFWZezB.exe
  C:\Windows\System\BFWZezB.exe
  2⤵
  PID:7436
- C:\Windows\System\tJTovxs.exe
  C:\Windows\System\tJTovxs.exe
  2⤵
  PID:7372
- C:\Windows\System\xbsSfYS.exe
  C:\Windows\System\xbsSfYS.exe
  2⤵
  PID:7376
- C:\Windows\System\FErOnis.exe
  C:\Windows\System\FErOnis.exe
  2⤵
  PID:7408
- C:\Windows\System\VgJOWLn.exe
  C:\Windows\System\VgJOWLn.exe
  2⤵
  PID:7520
- C:\Windows\System\vlbONtS.exe
  C:\Windows\System\vlbONtS.exe
  2⤵
  PID:7756
- C:\Windows\System\zAFjnzC.exe
  C:\Windows\System\zAFjnzC.exe
  2⤵
  PID:7624
- C:\Windows\System\mEPMEnN.exe
  C:\Windows\System\mEPMEnN.exe
  2⤵
  PID:7636
- C:\Windows\System\elXGpIg.exe
  C:\Windows\System\elXGpIg.exe
  2⤵
  PID:7672
- C:\Windows\System\fBQjhWz.exe
  C:\Windows\System\fBQjhWz.exe
  2⤵
  PID:7792
- C:\Windows\System\DobCoEZ.exe
  C:\Windows\System\DobCoEZ.exe
  2⤵
  PID:7904
- C:\Windows\System\SDIVNzf.exe
  C:\Windows\System\SDIVNzf.exe
  2⤵
  PID:7808
- C:\Windows\System\UZMWUsQ.exe
  C:\Windows\System\UZMWUsQ.exe
  2⤵
  PID:7972
- C:\Windows\System\QNkmEBz.exe
  C:\Windows\System\QNkmEBz.exe
  2⤵
  PID:8112
- C:\Windows\System\ePYEjdM.exe
  C:\Windows\System\ePYEjdM.exe
  2⤵
  PID:8036
- C:\Windows\System\PaXJxkL.exe
  C:\Windows\System\PaXJxkL.exe
  2⤵
  PID:8068
- C:\Windows\System\CVXivik.exe
  C:\Windows\System\CVXivik.exe
  2⤵
  PID:7516
- C:\Windows\System\IxsvwQn.exe
  C:\Windows\System\IxsvwQn.exe
  2⤵
  PID:2108
- C:\Windows\System\qWZhsLu.exe
  C:\Windows\System\qWZhsLu.exe
  2⤵
  PID:7464
- C:\Windows\System\GIZBSAx.exe
  C:\Windows\System\GIZBSAx.exe
  2⤵
  PID:6920
- C:\Windows\System\ssXkKXJ.exe
  C:\Windows\System\ssXkKXJ.exe
  2⤵
  PID:6272
- C:\Windows\System\aSgmzwL.exe
  C:\Windows\System\aSgmzwL.exe
  2⤵
  PID:7356
- C:\Windows\System\lUlbooa.exe
  C:\Windows\System\lUlbooa.exe
  2⤵
  PID:7404
- C:\Windows\System\iUxvGLj.exe
  C:\Windows\System\iUxvGLj.exe
  2⤵
  PID:2932
- C:\Windows\System\SgcxPwE.exe
  C:\Windows\System\SgcxPwE.exe
  2⤵
  PID:7956
- C:\Windows\System\QuKfYiq.exe
  C:\Windows\System\QuKfYiq.exe
  2⤵
  PID:7920
- C:\Windows\System\QVZZcYW.exe
  C:\Windows\System\QVZZcYW.exe
  2⤵
  PID:7592
- C:\Windows\System\pPTsBOj.exe
  C:\Windows\System\pPTsBOj.exe
  2⤵
  PID:7260
- C:\Windows\System\WEixMBa.exe
  C:\Windows\System\WEixMBa.exe
  2⤵
  PID:7844
- C:\Windows\System\xalOSqX.exe
  C:\Windows\System\xalOSqX.exe
  2⤵
  PID:7480
- C:\Windows\System\ZjFvFum.exe
  C:\Windows\System\ZjFvFum.exe
  2⤵
  PID:8096
- C:\Windows\System\qnggBFK.exe
  C:\Windows\System\qnggBFK.exe
  2⤵
  PID:7444
- C:\Windows\System\ZdZJPnU.exe
  C:\Windows\System\ZdZJPnU.exe
  2⤵
  PID:7500
- C:\Windows\System\QZngUVj.exe
  C:\Windows\System\QZngUVj.exe
  2⤵
  PID:7772
- C:\Windows\System\KLsojxM.exe
  C:\Windows\System\KLsojxM.exe
  2⤵
  PID:7264
- C:\Windows\System\lHCsTVj.exe
  C:\Windows\System\lHCsTVj.exe
  2⤵
  PID:8204
- C:\Windows\System\eikDZzX.exe
  C:\Windows\System\eikDZzX.exe
  2⤵
  PID:8220
- C:\Windows\System\CtgSpqQ.exe
  C:\Windows\System\CtgSpqQ.exe
  2⤵
  PID:8236
- C:\Windows\System\JasSdVX.exe
  C:\Windows\System\JasSdVX.exe
  2⤵
  PID:8252
- C:\Windows\System\XwdZhRF.exe
  C:\Windows\System\XwdZhRF.exe
  2⤵
  PID:8268
- C:\Windows\System\zgZhrlf.exe
  C:\Windows\System\zgZhrlf.exe
  2⤵
  PID:8288
- C:\Windows\System\uLziaNv.exe
  C:\Windows\System\uLziaNv.exe
  2⤵
  PID:8304
- C:\Windows\System\OjMaErC.exe
  C:\Windows\System\OjMaErC.exe
  2⤵
  PID:8320
- C:\Windows\System\tlPbPTq.exe
  C:\Windows\System\tlPbPTq.exe
  2⤵
  PID:8596
- C:\Windows\System\TeRxGux.exe
  C:\Windows\System\TeRxGux.exe
  2⤵
  PID:8620
- C:\Windows\System\UNiWDKF.exe
  C:\Windows\System\UNiWDKF.exe
  2⤵
  PID:8656
- C:\Windows\System\KOqxDOv.exe
  C:\Windows\System\KOqxDOv.exe
  2⤵
  PID:8672
- C:\Windows\System\gIYOfks.exe
  C:\Windows\System\gIYOfks.exe
  2⤵
  PID:8692
- C:\Windows\System\BveIHVN.exe
  C:\Windows\System\BveIHVN.exe
  2⤵
  PID:8708
- C:\Windows\System\VRbgDac.exe
  C:\Windows\System\VRbgDac.exe
  2⤵
  PID:9212
- C:\Windows\System\nwALvsY.exe
  C:\Windows\System\nwALvsY.exe
  2⤵
  PID:8312
- C:\Windows\System\OGROQZF.exe
  C:\Windows\System\OGROQZF.exe
  2⤵
  PID:8340
- C:\Windows\System\KMdaYUb.exe
  C:\Windows\System\KMdaYUb.exe
  2⤵
  PID:8352
- C:\Windows\System\wRbwBzU.exe
  C:\Windows\System\wRbwBzU.exe
  2⤵
  PID:8368
- C:\Windows\System\VdcePAD.exe
  C:\Windows\System\VdcePAD.exe
  2⤵
  PID:8392
- C:\Windows\System\yDhmkzm.exe
  C:\Windows\System\yDhmkzm.exe
  2⤵
  PID:8520
- C:\Windows\System\qoalawn.exe
  C:\Windows\System\qoalawn.exe
  2⤵
  PID:8504
- C:\Windows\System\fweChzE.exe
  C:\Windows\System\fweChzE.exe
  2⤵
  PID:8536
- C:\Windows\System\NVSarag.exe
  C:\Windows\System\NVSarag.exe
  2⤵
  PID:8572
- C:\Windows\System\HXuMaWP.exe
  C:\Windows\System\HXuMaWP.exe
  2⤵
  PID:8540
- C:\Windows\System\uHbQZTN.exe
  C:\Windows\System\uHbQZTN.exe
  2⤵
  PID:8636
- C:\Windows\System\srlBOJw.exe
  C:\Windows\System\srlBOJw.exe
  2⤵
  PID:8720
- C:\Windows\System\HSNZKWt.exe
  C:\Windows\System\HSNZKWt.exe
  2⤵
  PID:8736
- C:\Windows\System\hdPfkXS.exe
  C:\Windows\System\hdPfkXS.exe
  2⤵
  PID:8700
- C:\Windows\System\gZWSjrs.exe
  C:\Windows\System\gZWSjrs.exe
  2⤵
  PID:8792
- C:\Windows\System\HgxltNE.exe
  C:\Windows\System\HgxltNE.exe
  2⤵
  PID:8880
- C:\Windows\System\BKFBHJt.exe
  C:\Windows\System\BKFBHJt.exe
  2⤵
  PID:8760
- C:\Windows\System\oZcFkMS.exe
  C:\Windows\System\oZcFkMS.exe
  2⤵
  PID:8780
- C:\Windows\System\WOygbCK.exe
  C:\Windows\System\WOygbCK.exe
  2⤵
  PID:8816
- C:\Windows\System\OCoGBlD.exe
  C:\Windows\System\OCoGBlD.exe
  2⤵
  PID:8840
- C:\Windows\System\uplIUen.exe
  C:\Windows\System\uplIUen.exe
  2⤵
  PID:8908
- C:\Windows\System\DsFbubk.exe
  C:\Windows\System\DsFbubk.exe
  2⤵
  PID:8936
- C:\Windows\System\ynHVpGz.exe
  C:\Windows\System\ynHVpGz.exe
  2⤵
  PID:8956
- C:\Windows\System\nLDcYyC.exe
  C:\Windows\System\nLDcYyC.exe
  2⤵
  PID:8992
- C:\Windows\System\jcoxicc.exe
  C:\Windows\System\jcoxicc.exe
  2⤵
  PID:9028
- C:\Windows\System\UTASUvR.exe
  C:\Windows\System\UTASUvR.exe
  2⤵
  PID:9044
- C:\Windows\System\tnWxxFS.exe
  C:\Windows\System\tnWxxFS.exe
  2⤵
  PID:9088
- C:\Windows\System\wazLEwT.exe
  C:\Windows\System\wazLEwT.exe
  2⤵
  PID:9120
- C:\Windows\System\wsnMHzd.exe
  C:\Windows\System\wsnMHzd.exe
  2⤵
  PID:9140
- C:\Windows\System\tYAoktG.exe
  C:\Windows\System\tYAoktG.exe
  2⤵
  PID:9160
- C:\Windows\System\rhmdrTp.exe
  C:\Windows\System\rhmdrTp.exe
  2⤵
  PID:9200
- C:\Windows\System\pzfbEGg.exe
  C:\Windows\System\pzfbEGg.exe
  2⤵
  PID:8328
- C:\Windows\System\InhHPnW.exe
  C:\Windows\System\InhHPnW.exe
  2⤵
  PID:8232
- C:\Windows\System\KwNUyyE.exe
  C:\Windows\System\KwNUyyE.exe
  2⤵
  PID:7280
- C:\Windows\System\QRJjQyQ.exe
  C:\Windows\System\QRJjQyQ.exe
  2⤵
  PID:8248
- C:\Windows\System\ZEzUxpt.exe
  C:\Windows\System\ZEzUxpt.exe
  2⤵
  PID:8336
- C:\Windows\System\FRRZtQZ.exe
  C:\Windows\System\FRRZtQZ.exe
  2⤵
  PID:8528
- C:\Windows\System\bsVkyVv.exe
  C:\Windows\System\bsVkyVv.exe
  2⤵
  PID:8376
- C:\Windows\System\wnNqEHn.exe
  C:\Windows\System\wnNqEHn.exe
  2⤵
  PID:7776
- C:\Windows\System\PFFjcdk.exe
  C:\Windows\System\PFFjcdk.exe
  2⤵
  PID:8428
- C:\Windows\System\kdEPghZ.exe
  C:\Windows\System\kdEPghZ.exe
  2⤵
  PID:8424
- C:\Windows\System\kzqiMOP.exe
  C:\Windows\System\kzqiMOP.exe
  2⤵
  PID:8408
- C:\Windows\System\DjClGvN.exe
  C:\Windows\System\DjClGvN.exe
  2⤵
  PID:8544
- C:\Windows\System\wvBAXFL.exe
  C:\Windows\System\wvBAXFL.exe
  2⤵
  PID:8460
- C:\Windows\System\AIffsMk.exe
  C:\Windows\System\AIffsMk.exe
  2⤵
  PID:8584
- C:\Windows\System\OvJyvhX.exe
  C:\Windows\System\OvJyvhX.exe
  2⤵
  PID:8612
- C:\Windows\System\hTivpbJ.exe
  C:\Windows\System\hTivpbJ.exe
  2⤵
  PID:8652
- C:\Windows\System\TXJmwoW.exe
  C:\Windows\System\TXJmwoW.exe
  2⤵
  PID:8668
- C:\Windows\System\SslCnhT.exe
  C:\Windows\System\SslCnhT.exe
  2⤵
  PID:8768
- C:\Windows\System\WBPhodK.exe
  C:\Windows\System\WBPhodK.exe
  2⤵
  PID:8856
- C:\Windows\System\TZJdiQk.exe
  C:\Windows\System\TZJdiQk.exe
  2⤵
  PID:8824
- C:\Windows\System\HObhbqL.exe
  C:\Windows\System\HObhbqL.exe
  2⤵
  PID:8728
- C:\Windows\System\dZKoIsq.exe
  C:\Windows\System\dZKoIsq.exe
  2⤵
  PID:8888
- C:\Windows\System\OjWflCL.exe
  C:\Windows\System\OjWflCL.exe
  2⤵
  PID:8900
- C:\Windows\System\qXgmDXm.exe
  C:\Windows\System\qXgmDXm.exe
  2⤵
  PID:8920
- C:\Windows\System\wlFulHJ.exe
  C:\Windows\System\wlFulHJ.exe
  2⤵
  PID:8972
- C:\Windows\System\PujXIfU.exe
  C:\Windows\System\PujXIfU.exe
  2⤵
  PID:9036
- C:\Windows\System\nQDQIKy.exe
  C:\Windows\System\nQDQIKy.exe
  2⤵
  PID:9020
- C:\Windows\System\qXdtdna.exe
  C:\Windows\System\qXdtdna.exe
  2⤵
  PID:9064
- C:\Windows\System\gcWrAXW.exe
  C:\Windows\System\gcWrAXW.exe
  2⤵
  PID:9096
- C:\Windows\System\XbwkeNk.exe
  C:\Windows\System\XbwkeNk.exe
  2⤵
  PID:9168
- C:\Windows\System\mcphTUx.exe
  C:\Windows\System\mcphTUx.exe
  2⤵
  PID:9184
- C:\Windows\System\qdfbZic.exe
  C:\Windows\System\qdfbZic.exe
  2⤵
  PID:8200
- C:\Windows\System\DhYVNAq.exe
  C:\Windows\System\DhYVNAq.exe
  2⤵
  PID:8296
- C:\Windows\System\MTMUyuV.exe
  C:\Windows\System\MTMUyuV.exe
  2⤵
  PID:8212
- C:\Windows\System\EigQEMp.exe
  C:\Windows\System\EigQEMp.exe
  2⤵
  PID:8400
- C:\Windows\System\VDQNDFq.exe
  C:\Windows\System\VDQNDFq.exe
  2⤵
  PID:8488
- C:\Windows\System\tPQAusF.exe
  C:\Windows\System\tPQAusF.exe
  2⤵
  PID:8456
- C:\Windows\System\OYtNdfU.exe
  C:\Windows\System\OYtNdfU.exe
  2⤵
  PID:8432
- C:\Windows\System\oPQJztR.exe
  C:\Windows\System\oPQJztR.exe
  2⤵
  PID:8480
- C:\Windows\System\mstpXRW.exe
  C:\Windows\System\mstpXRW.exe
  2⤵
  PID:8588
- C:\Windows\System\cjsVoTm.exe
  C:\Windows\System\cjsVoTm.exe
  2⤵
  PID:8664
- C:\Windows\System\JJHkmsr.exe
  C:\Windows\System\JJHkmsr.exe
  2⤵
  PID:8828
- C:\Windows\System\fRWmrFp.exe
  C:\Windows\System\fRWmrFp.exe
  2⤵
  PID:8836
- C:\Windows\System\lQVGjda.exe
  C:\Windows\System\lQVGjda.exe
  2⤵
  PID:8804
- C:\Windows\System\LGZXMDR.exe
  C:\Windows\System\LGZXMDR.exe
  2⤵
  PID:9012
- C:\Windows\System\QHGsshf.exe
  C:\Windows\System\QHGsshf.exe
  2⤵
  PID:8960
- C:\Windows\System\MLvFLdU.exe
  C:\Windows\System\MLvFLdU.exe
  2⤵
  PID:8928
- C:\Windows\System\tFtMCyf.exe
  C:\Windows\System\tFtMCyf.exe
  2⤵
  PID:8984
- C:\Windows\System\DoZXKvB.exe
  C:\Windows\System\DoZXKvB.exe
  2⤵
  PID:9072
- C:\Windows\System\xZCvMgp.exe
  C:\Windows\System\xZCvMgp.exe
  2⤵
  PID:9104
- C:\Windows\System\IunRBUp.exe
  C:\Windows\System\IunRBUp.exe
  2⤵
  PID:9188
- C:\Windows\System\ezYCRxw.exe
  C:\Windows\System\ezYCRxw.exe
  2⤵
  PID:7388
- C:\Windows\System\keVOJeC.exe
  C:\Windows\System\keVOJeC.exe
  2⤵
  PID:8284
- C:\Windows\System\SCvrwgE.exe
  C:\Windows\System\SCvrwgE.exe
  2⤵
  PID:8348
- C:\Windows\System\nmTLJcu.exe
  C:\Windows\System\nmTLJcu.exe
  2⤵
  PID:8416
- C:\Windows\System\HHxJwaX.exe
  C:\Windows\System\HHxJwaX.exe
  2⤵
  PID:8744
- C:\Windows\System\pBcojqJ.exe
  C:\Windows\System\pBcojqJ.exe
  2⤵
  PID:8564
- C:\Windows\System\BOxcRdJ.exe
  C:\Windows\System\BOxcRdJ.exe
  2⤵
  PID:8732
- C:\Windows\System\fEtMjZY.exe
  C:\Windows\System\fEtMjZY.exe
  2⤵
  PID:8876
- C:\Windows\System\mvtryey.exe
  C:\Windows\System\mvtryey.exe
  2⤵
  PID:8932
- C:\Windows\System\DHuFVvx.exe
  C:\Windows\System\DHuFVvx.exe
  2⤵
  PID:9024
- C:\Windows\System\wStVaAK.exe
  C:\Windows\System\wStVaAK.exe
  2⤵
  PID:8988
- C:\Windows\System\vxVDgYg.exe
  C:\Windows\System\vxVDgYg.exe
  2⤵
  PID:9116
- C:\Windows\System\ICUNHmW.exe
  C:\Windows\System\ICUNHmW.exe
  2⤵
  PID:8560
- C:\Windows\System\otRhzkc.exe
  C:\Windows\System\otRhzkc.exe
  2⤵
  PID:8872
- C:\Windows\System\MbdsoDI.exe
  C:\Windows\System\MbdsoDI.exe
  2⤵
  PID:8796
- C:\Windows\System\OJbEOeY.exe
  C:\Windows\System\OJbEOeY.exe
  2⤵
  PID:8952
- C:\Windows\System\LWkewhB.exe
  C:\Windows\System\LWkewhB.exe
  2⤵
  PID:9068
- C:\Windows\System\DlWagnU.exe
  C:\Windows\System\DlWagnU.exe
  2⤵
  PID:8752
- C:\Windows\System\zvnVUOM.exe
  C:\Windows\System\zvnVUOM.exe
  2⤵
  PID:8484
- C:\Windows\System\jfJlIHF.exe
  C:\Windows\System\jfJlIHF.exe
  2⤵
  PID:8968
- C:\Windows\System\DQLsAth.exe
  C:\Windows\System\DQLsAth.exe
  2⤵
  PID:8388
- C:\Windows\System\qRncMBW.exe
  C:\Windows\System\qRncMBW.exe
  2⤵
  PID:8912
- C:\Windows\System\uoqTNbb.exe
  C:\Windows\System\uoqTNbb.exe
  2⤵
  PID:9108
- C:\Windows\System\NdrZLJH.exe
  C:\Windows\System\NdrZLJH.exe
  2⤵
  PID:8852
- C:\Windows\System\XcfZCFh.exe
  C:\Windows\System\XcfZCFh.exe
  2⤵
  PID:8592
- C:\Windows\System\HnVGlQh.exe
  C:\Windows\System\HnVGlQh.exe
  2⤵
  PID:9232
- C:\Windows\System\IhPBOUX.exe
  C:\Windows\System\IhPBOUX.exe
  2⤵
  PID:9268
- C:\Windows\System\AepULVW.exe
  C:\Windows\System\AepULVW.exe
  2⤵
  PID:9288
- C:\Windows\System\RmqqKpy.exe
  C:\Windows\System\RmqqKpy.exe
  2⤵
  PID:9304
- C:\Windows\System\TBfpHyY.exe
  C:\Windows\System\TBfpHyY.exe
  2⤵
  PID:9324
- C:\Windows\System\aAactyR.exe
  C:\Windows\System\aAactyR.exe
  2⤵
  PID:9340
- C:\Windows\System\dflcUOt.exe
  C:\Windows\System\dflcUOt.exe
  2⤵
  PID:9360
- C:\Windows\System\bjGKJOu.exe
  C:\Windows\System\bjGKJOu.exe
  2⤵
  PID:9376
- C:\Windows\System\rRKimzt.exe
  C:\Windows\System\rRKimzt.exe
  2⤵
  PID:9396
- C:\Windows\System\FpdwpqZ.exe
  C:\Windows\System\FpdwpqZ.exe
  2⤵
  PID:9416
- C:\Windows\System\fMKnzrY.exe
  C:\Windows\System\fMKnzrY.exe
  2⤵
  PID:9436
- C:\Windows\System\hiFdCxa.exe
  C:\Windows\System\hiFdCxa.exe
  2⤵
  PID:9456
- C:\Windows\System\cEFxHLE.exe
  C:\Windows\System\cEFxHLE.exe
  2⤵
  PID:9480
- C:\Windows\System\TMqgNoE.exe
  C:\Windows\System\TMqgNoE.exe
  2⤵
  PID:9496
- C:\Windows\System\jLuXNfK.exe
  C:\Windows\System\jLuXNfK.exe
  2⤵
  PID:9512
- C:\Windows\System\oTmhxVx.exe
  C:\Windows\System\oTmhxVx.exe
  2⤵
  PID:9528
- C:\Windows\System\uqBYxRF.exe
  C:\Windows\System\uqBYxRF.exe
  2⤵
  PID:9548
- C:\Windows\System\KyVAhXC.exe
  C:\Windows\System\KyVAhXC.exe
  2⤵
  PID:9564
- C:\Windows\System\ELXPchc.exe
  C:\Windows\System\ELXPchc.exe
  2⤵
  PID:9580
- C:\Windows\System\JcGUJUL.exe
  C:\Windows\System\JcGUJUL.exe
  2⤵
  PID:9600
- C:\Windows\System\jqywyNF.exe
  C:\Windows\System\jqywyNF.exe
  2⤵
  PID:9616
- C:\Windows\System\YAlNPpz.exe
  C:\Windows\System\YAlNPpz.exe
  2⤵
  PID:9636
- C:\Windows\System\boxXvlF.exe
  C:\Windows\System\boxXvlF.exe
  2⤵
  PID:9656
- C:\Windows\System\wdOMLDZ.exe
  C:\Windows\System\wdOMLDZ.exe
  2⤵
  PID:9684
- C:\Windows\System\YmFMPub.exe
  C:\Windows\System\YmFMPub.exe
  2⤵
  PID:9704
- C:\Windows\System\kdjyalJ.exe
  C:\Windows\System\kdjyalJ.exe
  2⤵
  PID:9720
- C:\Windows\System\eVuMLLu.exe
  C:\Windows\System\eVuMLLu.exe
  2⤵
  PID:9736
- C:\Windows\System\MlWOuYl.exe
  C:\Windows\System\MlWOuYl.exe
  2⤵
  PID:9752
- C:\Windows\System\evNpnVT.exe
  C:\Windows\System\evNpnVT.exe
  2⤵
  PID:9768
- C:\Windows\System\hPvLWGX.exe
  C:\Windows\System\hPvLWGX.exe
  2⤵
  PID:9796
- C:\Windows\System\MNsynjQ.exe
  C:\Windows\System\MNsynjQ.exe
  2⤵
  PID:9812
- C:\Windows\System\fRoLJYC.exe
  C:\Windows\System\fRoLJYC.exe
  2⤵
  PID:9832
- C:\Windows\System\YPetvJU.exe
  C:\Windows\System\YPetvJU.exe
  2⤵
  PID:9896
- C:\Windows\System\jRxRdfK.exe
  C:\Windows\System\jRxRdfK.exe
  2⤵
  PID:9912
- C:\Windows\System\qDHzDsw.exe
  C:\Windows\System\qDHzDsw.exe
  2⤵
  PID:9936
- C:\Windows\System\quxJlTy.exe
  C:\Windows\System\quxJlTy.exe
  2⤵
  PID:9952
- C:\Windows\System\HRPrOxV.exe
  C:\Windows\System\HRPrOxV.exe
  2⤵
  PID:9968
- C:\Windows\System\QRrVyvn.exe
  C:\Windows\System\QRrVyvn.exe
  2⤵
  PID:9992
- C:\Windows\System\KBpeJrp.exe
  C:\Windows\System\KBpeJrp.exe
  2⤵
  PID:10008
- C:\Windows\System\padTpBD.exe
  C:\Windows\System\padTpBD.exe
  2⤵
  PID:10032
- C:\Windows\System\OxOaXrr.exe
  C:\Windows\System\OxOaXrr.exe
  2⤵
  PID:10056
- C:\Windows\System\HpzPnlJ.exe
  C:\Windows\System\HpzPnlJ.exe
  2⤵
  PID:10072
- C:\Windows\System\ryulmKh.exe
  C:\Windows\System\ryulmKh.exe
  2⤵
  PID:10092
- C:\Windows\System\cexLPEL.exe
  C:\Windows\System\cexLPEL.exe
  2⤵
  PID:10116
- C:\Windows\System\PxnZUAb.exe
  C:\Windows\System\PxnZUAb.exe
  2⤵
  PID:10136
- C:\Windows\System\qLuXdGF.exe
  C:\Windows\System\qLuXdGF.exe
  2⤵
  PID:10152
- C:\Windows\System\nuxPtNK.exe
  C:\Windows\System\nuxPtNK.exe
  2⤵
  PID:10172
- C:\Windows\System\ZKgABjI.exe
  C:\Windows\System\ZKgABjI.exe
  2⤵
  PID:10188
- C:\Windows\System\CmJpbzC.exe
  C:\Windows\System\CmJpbzC.exe
  2⤵
  PID:10208
- C:\Windows\System\dZIkkfQ.exe
  C:\Windows\System\dZIkkfQ.exe
  2⤵
  PID:10224
- C:\Windows\System\QtGtpzA.exe
  C:\Windows\System\QtGtpzA.exe
  2⤵
  PID:9224
- C:\Windows\System\rjMCZwf.exe
  C:\Windows\System\rjMCZwf.exe
  2⤵
  PID:9256
- C:\Windows\System\MsYhJQd.exe
  C:\Windows\System\MsYhJQd.exe
  2⤵
  PID:9248
- C:\Windows\System\gxmIpwI.exe
  C:\Windows\System\gxmIpwI.exe
  2⤵
  PID:9284
- C:\Windows\System\weLacFV.exe
  C:\Windows\System\weLacFV.exe
  2⤵
  PID:9316
- C:\Windows\System\xRCEUlc.exe
  C:\Windows\System\xRCEUlc.exe
  2⤵
  PID:9388
- C:\Windows\System\AEpfgNC.exe
  C:\Windows\System\AEpfgNC.exe
  2⤵
  PID:9428
- C:\Windows\System\VtPTPUH.exe
  C:\Windows\System\VtPTPUH.exe
  2⤵
  PID:9404
- C:\Windows\System\mEGmamV.exe
  C:\Windows\System\mEGmamV.exe
  2⤵
  PID:9504
- C:\Windows\System\kNHgHRo.exe
  C:\Windows\System\kNHgHRo.exe
  2⤵
  PID:9572
- C:\Windows\System\rxKsiFX.exe
  C:\Windows\System\rxKsiFX.exe
  2⤵
  PID:9612
- C:\Windows\System\zGycXeb.exe
  C:\Windows\System\zGycXeb.exe
  2⤵
  PID:9700
- C:\Windows\System\KSmeVXr.exe
  C:\Windows\System\KSmeVXr.exe
  2⤵
  PID:9668
- C:\Windows\System\bPsNfYM.exe
  C:\Windows\System\bPsNfYM.exe
  2⤵
  PID:9624
- C:\Windows\System\Equsdwx.exe
  C:\Windows\System\Equsdwx.exe
  2⤵
  PID:9676
- C:\Windows\System\VLRBCvF.exe
  C:\Windows\System\VLRBCvF.exe
  2⤵
  PID:9804
- C:\Windows\System\uvBVfWE.exe
  C:\Windows\System\uvBVfWE.exe
  2⤵
  PID:9492
- C:\Windows\System\PlfPKSz.exe
  C:\Windows\System\PlfPKSz.exe
  2⤵
  PID:9128
- C:\Windows\System\AwCSNXr.exe
  C:\Windows\System\AwCSNXr.exe
  2⤵
  PID:9776
- C:\Windows\System\IWUmUbc.exe
  C:\Windows\System\IWUmUbc.exe
  2⤵
  PID:9820
- C:\Windows\System\ZZiYnHE.exe
  C:\Windows\System\ZZiYnHE.exe
  2⤵
  PID:9824
- C:\Windows\System\eAwMhoP.exe
  C:\Windows\System\eAwMhoP.exe
  2⤵
  PID:9860
- C:\Windows\System\SDJYDRl.exe
  C:\Windows\System\SDJYDRl.exe
  2⤵
  PID:9876
- C:\Windows\System\riSptqQ.exe
  C:\Windows\System\riSptqQ.exe
  2⤵
  PID:9904
- C:\Windows\System\sAvQOhb.exe
  C:\Windows\System\sAvQOhb.exe
  2⤵
  PID:9932
- C:\Windows\System\pPMavwe.exe
  C:\Windows\System\pPMavwe.exe
  2⤵
  PID:9964
- C:\Windows\System\BPTEsDn.exe
  C:\Windows\System\BPTEsDn.exe
  2⤵
  PID:9976
- C:\Windows\System\uMdAMqz.exe
  C:\Windows\System\uMdAMqz.exe
  2⤵
  PID:10024
- C:\Windows\System\EzqDELf.exe
  C:\Windows\System\EzqDELf.exe
  2⤵
  PID:10052
- C:\Windows\System\xdOhCrD.exe
  C:\Windows\System\xdOhCrD.exe
  2⤵
  PID:10088
- C:\Windows\System\gPkhkTz.exe
  C:\Windows\System\gPkhkTz.exe
  2⤵
  PID:10108
- C:\Windows\System\RdLqycz.exe
  C:\Windows\System\RdLqycz.exe
  2⤵
  PID:10144
- C:\Windows\System\YIwltyY.exe
  C:\Windows\System\YIwltyY.exe
  2⤵
  PID:10180
- C:\Windows\System\wEfXBea.exe
  C:\Windows\System\wEfXBea.exe
  2⤵
  PID:10196
- C:\Windows\System\fDTEloP.exe
  C:\Windows\System\fDTEloP.exe
  2⤵
  PID:10184
- C:\Windows\System\MIpGdRU.exe
  C:\Windows\System\MIpGdRU.exe
  2⤵
  PID:9264
- C:\Windows\System\ftxwJBe.exe
  C:\Windows\System\ftxwJBe.exe
  2⤵
  PID:9300
- C:\Windows\System\iFkmwhV.exe
  C:\Windows\System\iFkmwhV.exe
  2⤵
  PID:9464
- C:\Windows\System\TxevWts.exe
  C:\Windows\System\TxevWts.exe
  2⤵
  PID:9472
- C:\Windows\System\OdcITiy.exe
  C:\Windows\System\OdcITiy.exe
  2⤵
  PID:9644
- C:\Windows\System\fRpaIeC.exe
  C:\Windows\System\fRpaIeC.exe
  2⤵
  PID:9592
- C:\Windows\System\fymRVNE.exe
  C:\Windows\System\fymRVNE.exe
  2⤵
  PID:9712
- C:\Windows\System\RMwIhqx.exe
  C:\Windows\System\RMwIhqx.exe
  2⤵
  PID:9872
- C:\Windows\System\cIBRqRq.exe
  C:\Windows\System\cIBRqRq.exe
  2⤵
  PID:10048
- C:\Windows\System\KNVUDUW.exe
  C:\Windows\System\KNVUDUW.exe
  2⤵
  PID:10200
- C:\Windows\System\EQiFIbP.exe
  C:\Windows\System\EQiFIbP.exe
  2⤵
  PID:8548
- C:\Windows\System\NnKTzLJ.exe
  C:\Windows\System\NnKTzLJ.exe
  2⤵
  PID:9808
- C:\Windows\System\nvWXdDU.exe
  C:\Windows\System\nvWXdDU.exe
  2⤵
  PID:9888
- C:\Windows\System\PiHUYQi.exe
  C:\Windows\System\PiHUYQi.exe
  2⤵
  PID:9944
- C:\Windows\System\pQcDvgd.exe
  C:\Windows\System\pQcDvgd.exe
  2⤵
  PID:10016
- C:\Windows\System\JHnNKli.exe
  C:\Windows\System\JHnNKli.exe
  2⤵
  PID:9280
- C:\Windows\System\uFUmdqo.exe
  C:\Windows\System\uFUmdqo.exe
  2⤵
  PID:9848
- C:\Windows\System\MMxpgpo.exe
  C:\Windows\System\MMxpgpo.exe
  2⤵
  PID:9368
- C:\Windows\System\cwGAFeV.exe
  C:\Windows\System\cwGAFeV.exe
  2⤵
  PID:10128
- C:\Windows\System\aqPdSFC.exe
  C:\Windows\System\aqPdSFC.exe
  2⤵
  PID:8976
- C:\Windows\System\xUWxdsD.exe
  C:\Windows\System\xUWxdsD.exe
  2⤵
  PID:9508
- C:\Windows\System\ROtoPgH.exe
  C:\Windows\System\ROtoPgH.exe
  2⤵
  PID:9672
- C:\Windows\System\oDbSIZX.exe
  C:\Windows\System\oDbSIZX.exe
  2⤵
  PID:9732
- C:\Windows\System\zUAPRwW.exe
  C:\Windows\System\zUAPRwW.exe
  2⤵
  PID:9692
- C:\Windows\System\XTbROoW.exe
  C:\Windows\System\XTbROoW.exe
  2⤵
  PID:10104
- C:\Windows\System\VIjwiJg.exe
  C:\Windows\System\VIjwiJg.exe
  2⤵
  PID:9632
- C:\Windows\System\scyyEuQ.exe
  C:\Windows\System\scyyEuQ.exe
  2⤵
  PID:9556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AtgsDzI.exe

Filesize
2.5MB

MD5
993b60f02bc878a2361c221ab4ac6896

SHA1
90e50251fd4b2da12f73693c73396c8a7b174d4d

SHA256
ba030ecd5fa8b6a8556750fab7aae8d9083438f7dca9ed5ba8aa7172ee2a9787

SHA512
da919a45949246dba393e5d42217088383fd2ef12afcdadc645b770439df8a40ff6ae581d8369e7fd853a3ec159d45051c13ea9a4cc66d4cbc608be7d48e5286

Download Submit
C:\Windows\system\FBtPXSv.exe

Filesize
2.5MB

MD5
ccba665a2be522d95ad3622f195bb1a0

SHA1
60e6a1b6700d48d08e26a1598a02ea16cc9d4b06

SHA256
5fe99f376f321b74d8fd1b034e3d5dd063c056cfada5b90161db5f6846148cbd

SHA512
a44b41e77f45d95a3571262fe4da4a6e27ea29a93b5b1b029f0da6675c680c8bcd0b209d346b606be81dd08affe4d15cb121950d68c9e97478008abc0e40c08b

Download Submit
C:\Windows\system\HjJWjWv.exe

Filesize
2.5MB

MD5
2e3518d2909018eab7c5c30a8542daed

SHA1
45c62a5a059a21b87b1f945f0cdd2bb29dbdb48b

SHA256
d5f7322de6760e0d1dcd96957f3ca86c61dc5afab0600d7f73948695c9534670

SHA512
e87e3953c1c44bcf52239c279ab437d1317433c74e812cce93b211f9dc66153424a6b525c39810acd2548883f950f6751caf739ee93c023ab2e3706f3b74db87

Download Submit
C:\Windows\system\IwNRhEq.exe

Filesize
2.5MB

MD5
b6be1fb85792472879bc604f0c5bf6c2

SHA1
34afb400e5833fbad13107fb989d6a85a11ce612

SHA256
858f82f8d1fc3ff1ac2b1995ff2f66f1d199c9a1f2aee27145aced1827565b75

SHA512
e311a4e73b839a714747ad112bca66bef051ee5e06d1871108423b1470fa884ca8c8fc1bbaf8726a08441b884d8455e0dc3513339aedf734ea1d2cc20d11ec36

Download Submit
C:\Windows\system\IyYsVgp.exe

Filesize
2.5MB

MD5
732ed73b35de05a298bf3a4b474903da

SHA1
ebef9c8d0482232e6673c3249fbd8a25b05c5b58

SHA256
ae00a7512867239d309bdfbc54e6521f3d845d0f54a21f29e474521f17a8ae9a

SHA512
769ac3b80bb7e242ca19cd6e42aab97e8955bf901cec6fc4fc97af2529f01bea8995f333996b21d496f028eb2b142b7063c64b392b28cc2965e71724c085c660

Download Submit
C:\Windows\system\JYPLTTc.exe

Filesize
2.5MB

MD5
e6e9ef1ec787e0647da2746fe71796b6

SHA1
07d8eea1937bf570840afd537f461152ae5b5ddf

SHA256
9172b337b762b6d26e7bc59b55ed9cf8d2577fd764bff3b86efd608af9de2330

SHA512
eb472c5c865067ac55b55563e5511673244b630a8767860bbd44ed72421dacaee7d5a5f6e4deb3ee129dac154e681a3c4496d3bd43414b538f7bc56de1426c97

Download Submit
C:\Windows\system\JlngkKD.exe

Filesize
2.5MB

MD5
e01a922f167fee2fcac8fbef4c0f1803

SHA1
97c725f8ba2d467ebde70fbb8262cb9942e3ac61

SHA256
ef0db16934202bb157b5edceeafc9ab4388b46bf23de06183adca8240b6f88c5

SHA512
c38b47609dcaab1de0fbdd79bb35880a9a79743bc85cafd4eee5ec534609583c58aa187e4416abaf39345bbdfb6a76b89e419e5e2499fcdafa373718094a6b90

Download Submit
C:\Windows\system\JoFogFN.exe

Filesize
2.5MB

MD5
d1f383c192423e814445cd7a7aa94743

SHA1
4d727129ecc41869865803ad6b601c3e3a9d3a6e

SHA256
5996284481a81d4350e8b5f74a43a3d60ad4ae8f7b02921d83ab3ee0853c95c5

SHA512
518d8e5a0a2d11b888a358f96b4d740721f5ee58b096d446202498bc24b29b3ec01f754cf51b0f69bf81f3ffc774143bd50348f182a112a031dc201a1c89efea

Download Submit
C:\Windows\system\PPAxBdv.exe

Filesize
2.5MB

MD5
26b5c1a78e40680f7799de36b2a1e2f7

SHA1
7880b212c0a41ac5a631a5650f894cf13d4c5696

SHA256
b9eb94e147a774b57639ae2d5070719932cd7dafc5f84c6d63ec979b22e0483a

SHA512
2a42cceb7657e36336fc3029d71d659b010bd34059a2e327946ef0a4190bbf5d48203e02d879925fd095fc330bae05679f5a754bbef7426df2d27bf874968df3

Download Submit
C:\Windows\system\Qwjhpga.exe

Filesize
2.5MB

MD5
2dbc897c982bd2af95ac465d168700f1

SHA1
3a21ca810ba120b8e31ed95d07b11373a9b55338

SHA256
915d8fd833945097a76807f97dbb9c54a7ca64282aec82ddee21be6628dca186

SHA512
f186241c697b1335f3eafbce8cabc2f6a0d989d2160a2aea92fc626f7a9595f6b53ec30c709f29146c272d1f5b2a1d9a8e4595e3d92625e0687953a684d87ac7

Download Submit
C:\Windows\system\RFfXaAI.exe

Filesize
2.5MB

MD5
f6417af19cac2fc47fb3292acb8b6812

SHA1
6882c18158ca46cee2d43e199b3e7e0300f54c47

SHA256
d13de3bf5dc7e36a6c73722090c8cae6bbffa73fce7c198d7f14a7209cdebca5

SHA512
bb03c87fe9c23e44c356f6e6bac40cc78f6ae45bcaa28bd2a963add72d79e4069f5f7e3dfec5081a582b9cfc11086997a0299cfcebe7a1a7a996a253dac9e538

Download Submit
C:\Windows\system\RKLxcim.exe

Filesize
2.5MB

MD5
17b607d091cd05cce2ca1ada29d8db9d

SHA1
93455c15a5f62de045ddd13ff2b31fccf75cda35

SHA256
94908eafb881d7f85c87e4aae9f48648e441dae83e58811560ea2ed98870a06c

SHA512
37de426c397ea632d46058226826ad18bc40f6dccd6c4da597cb17863801cbc4fa31206467020a097278682bfafa47715320caa889b7a8037591122b08071f8d

Download Submit
C:\Windows\system\UNqFbSr.exe

Filesize
2.5MB

MD5
6855c7af3c4ada7bbc0ace80f64356a7

SHA1
61a08f6672ca2ab6abaf00038f3d1d9678315a72

SHA256
55e6404310d4ca6ad42a48810814bf1b0138788d45ae205a2abfcd8b32e2ade1

SHA512
add689118cd60f86ef94bdf33e9622a7464eb38be384ab248019fe147e268cb0cb7517fb80e1f5950079bd6089f4ddb569b138a67a29ac7b0867eab9f954c30a

Download Submit
C:\Windows\system\VKIDqfg.exe

Filesize
2.5MB

MD5
f98620c0bd5f9fa5ce106d5472f5e3fa

SHA1
40d8fe7c1a1675d977b13b80ac1b51f2863f2a07

SHA256
0c069d95750607960149f2ca367229f49b47fbfc9003eed37aa49e9480e5a193

SHA512
aa105697a1d4edfc236176c8ddc0df1f64b09c22b8a327230365d55a2abff3ae3d2b853b405e887114cb9e8b675e9ab089555819fb858b4e0e0d96d10d6a440f

Download Submit
C:\Windows\system\VLrFwNl.exe

Filesize
2.5MB

MD5
a2c8557ab1c93f76ae176ac3d31fb77b

SHA1
abcaee652b9c35678c02341ad5d099c80093d6ca

SHA256
aa63e3bb09b997d111774e935de8f52aee04327e51419c445db9ed8fc52ccce7

SHA512
74250ce42a07610f870b011d99ac83de1939340677df585889215de83cb4dce0d3646ed5530995c31d709ecf8882dbb0fb3d9a92b43b3583144ebfdddc6b2f2c

Download Submit
C:\Windows\system\XFpPieB.exe

Filesize
2.5MB

MD5
4ecc410d48f1cea492522f7da37ed03b

SHA1
855fbcb3e7b9e07c95ba2e73af8413f3be6631f9

SHA256
4efb5d707b9d6cdcc3fb3c96c22dab1ef4b589535609af400c3f72736a2c2e94

SHA512
fb1224f5e884e191fc7e00e7028fb25af560c98d5939a4ab3acbf559d9ba926135d476942e124184f310b1638f4d3d68e5bff7a7ba548da935fb8eb291d8d21c

Download Submit
C:\Windows\system\YMWdGKu.exe

Filesize
2.5MB

MD5
4d9ee7ebb50edb990ae4ef54ce1a1258

SHA1
7efaddace22120608969f2713c74b400a2086f52

SHA256
931d9f7d32b59326841b69ec2642dac77212fe6f2c646a5f5091b10aa9c54ac4

SHA512
21fe5f5f9a9a1f48de25c6fa26a454a3f4f83aed6065c3fe6e1bc9a32215a70d679cea6378254b634786f7cd0256a2c244802fff8a22f2d0645275afbe2559fe

Download Submit
C:\Windows\system\bZoKXpw.exe

Filesize
2.5MB

MD5
4bda32814d713055500a915cd17265dc

SHA1
67018c07e2e53c4ee5fa5a466a6a35283ad319cc

SHA256
b2184387f543dad7dfcf23d2f8a876b7206761a1c2e7c24c51ea656b9a75b4a6

SHA512
d70243631abadabc029e0be1677e914f280605ed57d07b792747206a626873651790aa7ef2815a614f8dbe69a57510868a89189cc17d9b997f5ddfc5a61dc03b

Download Submit
C:\Windows\system\bqRWptf.exe

Filesize
2.5MB

MD5
e0d8a5f6e152add26ebaa19fcf84fc88

SHA1
273f9a3976744371efc67e450696fac8a025de4e

SHA256
05a006ecc95636ea04a545404c83fe20105d070aaa4e5c222e291455e79860ab

SHA512
6483fbe6a76cca15360f37bf5f68158f6be0c8451a7d632a77b4a3ab1ea574d28094612b1d824cf0108096ae5de70ee91dbe051fe89257b4b1e696fa00d28e3f

Download Submit
C:\Windows\system\cewyzGZ.exe

Filesize
2.5MB

MD5
3cc08b0fa9717b3ef17e11de05e02ee2

SHA1
8a2389ee65664b9931985d569dc5c9456a633f09

SHA256
34d173c1ebc474fbbedea16af8f775a3381af62e35c48a411409e5a376d5efcb

SHA512
9ff61bdd52111eb605e1ab2541c6e3a0804cb92676dcf191ad4619bc454381f012575e4d3087c72982b5a3c0f53b0a50235723a0f0f3d796d67c73bac232c4e3

Download Submit
C:\Windows\system\chmoByh.exe

Filesize
2.5MB

MD5
8afa20c69f2b4ec07fc7e2df2290a0d5

SHA1
561eb3e60804d738c3dd331bb0559a19fb2577d0

SHA256
8aa25466cb5f75d6964c7973c77ff3dd4c03b1dec1d9e55f361ea3c0cfa88dd4

SHA512
68597939e81bcd42426c3f360f5046d60a77815216f4bcf5492cdb9d910a6ec38a80e2f1d2789cbb84a77a5e6be591b37aa227e993f09677ddc45c0730030004

Download Submit
C:\Windows\system\dWCUjeF.exe

Filesize
2.5MB

MD5
7a29622b0925119e8a78d501d20f2122

SHA1
9a10ca9a7aab45c9d9863e13f6eb16095a3ca2d9

SHA256
2f7fee1ab6d8caa0e594f19200110862fbf4d45d56984c70af6d057f6956be88

SHA512
17fc5924803d8b942b34271b5661ceec50e883eb4a6aab00f3114a9a7121a666943b2f733309f5f2f07359bc389f24f519932901d6029e98475fb32bc65c8890

Download Submit
C:\Windows\system\eHcMIcY.exe

Filesize
2.5MB

MD5
62b61a1bb635b85d00167e1a2ece461a

SHA1
7ef9a2fd65059e26346c629ec1df32056a209d27

SHA256
3fcf0eb9a43dadc9ded0e30ffb9c01b96a5545001f38ebd2e3b00ff8770751e9

SHA512
98dcad53f6eae422d8f2b09c81523aea0dd2930820669f983daf9e3bf41d45271d6ad76b71e182e0219f651743f64a1596bf2bd1e341b25d0306ba1d85ef2f83

Download Submit
C:\Windows\system\mXSAvXp.exe

Filesize
2.5MB

MD5
35a0775565bc4b6c51c649bb0787de40

SHA1
5e443dab2a16cb55e29a0af27c86c01de93e9d53

SHA256
fd8c4df2793f7663a54c5daa566c1a043aae65750c0fb74962a7c02bbefe4153

SHA512
d0d2e0f8b2ea75fe78f5864abbfbd1a62311a48290ddc513a9cceef220c08a02a41722f50f4b1ae7b311c1bd76b4cd2217684d4d480f74179e9107f39c1053bb

Download Submit
C:\Windows\system\omZGeLZ.exe

Filesize
2.5MB

MD5
2f90ca0ee9207488fc23df8368645317

SHA1
57347c8e9be5a966529ab676a89f61364439642f

SHA256
aefe05458d43a2f7b75a03ac7c24f175d24bcb5c3f7ffaaea62e6bda135d2911

SHA512
ffc96fd26537ed8069f3fdbc8d86632bd8bbef3c97834dab1862d309727a0818acc89dc5e9d2b1ccbeafb3ffb70176c1db8ae203127563da4fd6cd8217e38b73

Download Submit
C:\Windows\system\qtnleUI.exe

Filesize
2.5MB

MD5
0e884b1512ddc4db07221c9437254c0e

SHA1
dd88424f0fc2e4addbf8a7e13927fbd63b3ba766

SHA256
addfa83fe17fbd3c39fcbe031a2bdf84934b9ffb67de7c584fdb152c43c4ed8d

SHA512
c6dc3c09958f0271147388a30fb77ad37f2df33e9af86e804ed72af4c5a727dd552e2ebdd2c14e1e0f8c6741cf7e5602a6d2608db5516421fcbf22647febc12a

Download Submit
C:\Windows\system\tZrIeog.exe

Filesize
2.5MB

MD5
8e5f17183f6b0ecb2a43f09b8386b181

SHA1
b82df451e457844ce2f4d4d4a399ac5f8997ed97

SHA256
12819828ccf8ad621993684065c9ac57f2bdd55605e97cae3fc7e7bd5c5aa7cc

SHA512
5c07e5572504bc42c2cb66bb1dc270760c80d2dc6f474bb08b5c6d09994f6a4966c9d195383738e1e1a287bc81cd4f0a690d7029e435ad9d8cbdc7abd1d4b1a3

Download Submit
C:\Windows\system\utEVbXg.exe

Filesize
2.5MB

MD5
a6081666ffe2e8719fad62c4531554ea

SHA1
b711d08572e5f1b2f5098608d2ebbca420547ba1

SHA256
826309e5f065dd20139ed17d178430e1971237bb0cf202d461549b94d8ac457c

SHA512
9415cc562bd68b086f0270be0b3e18182cbe2142329de60b27416ad761d147bc8ad29fc0862fa57dc4c3677ddb5fc309f1b6a813621f0dd429921d4a0e78bead

Download Submit
C:\Windows\system\xKlpHZg.exe

Filesize
2.5MB

MD5
3c72a17a17f83af86ff07572c91d5151

SHA1
ec52ca0d57c47e4d2c84ab6bfaaf6a33720c3abc

SHA256
aa54a37159203d8d661b2a3d2658849c49308c38509e031c992c060e424d58fd

SHA512
1c72d86db31b162711dc824fdbdb21d00a82ffca6713ec9064b75d11d2c93a4123de4dc28573fa02739dbda1621d9c6cdea618b6c315e218e3bf8db1c287b18c

Download Submit
C:\Windows\system\xdSCmiw.exe

Filesize
2.5MB

MD5
8e1307ec646a2a5f56943df3f2d85ba4

SHA1
bb4f4f40f523220427615f32fc1c2b462554ba88

SHA256
51055c60964a4f97675aaa2480bc0ad5c09148b9273f680b66c574bf3449fca0

SHA512
b9523e878dac76c64206e112fe03b3e1358a38e7064179d7f498de42cac8aef922f46652c3413132c65e46448c4a66806496912e298df09dd6dff467e7be9930

Download Submit
C:\Windows\system\yUcYtyj.exe

Filesize
2.5MB

MD5
f93722b6f914efec784343d451f05b11

SHA1
8e416e7f17014132b4ae2f3fd41effee04577c06

SHA256
fb63a8071d55e1e22989ed97e1d6a45ab5916ebf7845129ca40ae5280b384b95

SHA512
d748219d003e3a810e68ab531dcce00df8871d81252ac2f720339cc3161df8b6b5a9303495055b123f86b986e55c25a16d03c63cf5c932ae0e9f3a02a82427a5

Download Submit
\Windows\system\ArEAoQB.exe

Filesize
2.5MB

MD5
20efa5ca55cc3c92636ea5e5aa3aaa79

SHA1
d440ce6c6e781dbcfe01f91a8770c2a8b6aa6f64

SHA256
b8c7b49a239e2a25b36db070416b8dad7783fafc8d36d50de39e6666492ebba4

SHA512
764b539cd26ede02d189a58222456006114078145262eaef5b233f4f86ab3da10909a043d4aa95be5a699ed5f201f0e0ed3893d21715ebdd2366988bbca9bc07

Download Submit
memory/1292-145-0x000000013F3D0000-0x000000013F7C6000-memory.dmp

Filesize
4.0MB

Download
memory/1292-1-0x000000013FAB0000-0x000000013FEA6000-memory.dmp

Filesize
4.0MB

Download
memory/1292-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1292-1201-0x000000013FAB0000-0x000000013FEA6000-memory.dmp

Filesize
4.0MB

Download
memory/1292-2691-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/1292-20-0x0000000003360000-0x0000000003756000-memory.dmp

Filesize
4.0MB

Download
memory/1292-2693-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/1292-141-0x000000013F170000-0x000000013F566000-memory.dmp

Filesize
4.0MB

Download
memory/1292-153-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/1292-151-0x000000013F360000-0x000000013F756000-memory.dmp

Filesize
4.0MB

Download
memory/1292-134-0x000000013F580000-0x000000013F976000-memory.dmp

Filesize
4.0MB

Download
memory/1292-2690-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/1292-147-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/1292-149-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/1292-2692-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/1292-143-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/1292-8-0x0000000002F40000-0x0000000003336000-memory.dmp

Filesize
4.0MB

Download
memory/1292-157-0x000000013FF30000-0x0000000140326000-memory.dmp

Filesize
4.0MB

Download
memory/1292-155-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/1356-152-0x000000013F360000-0x000000013F756000-memory.dmp

Filesize
4.0MB

Download
memory/1724-14-0x000000013FE60000-0x0000000140256000-memory.dmp

Filesize
4.0MB

Download
memory/1724-1467-0x000000013FE60000-0x0000000140256000-memory.dmp

Filesize
4.0MB

Download
memory/2084-156-0x000000013FB40000-0x000000013FF36000-memory.dmp

Filesize
4.0MB

Download
memory/2256-132-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2256-676-0x000000001B7B0000-0x000000001BA92000-memory.dmp

Filesize
2.9MB

Download
memory/2256-1987-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

Filesize
9.6MB

Download
memory/2256-822-0x0000000002250000-0x0000000002258000-memory.dmp

Filesize
32KB

Download
memory/2256-21-0x000007FEF540E000-0x000007FEF540F000-memory.dmp

Filesize
4KB

Download
memory/2440-133-0x000000013FF30000-0x0000000140326000-memory.dmp

Filesize
4.0MB

Download
memory/2508-13-0x000000013F8A0000-0x000000013FC96000-memory.dmp

Filesize
4.0MB

Download
memory/2624-4716-0x000000013F8C0000-0x000000013FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/2624-148-0x000000013F8C0000-0x000000013FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/2628-154-0x000000013FDA0000-0x0000000140196000-memory.dmp

Filesize
4.0MB

Download
memory/2748-142-0x000000013F170000-0x000000013F566000-memory.dmp

Filesize
4.0MB

Download
memory/2760-146-0x000000013F3D0000-0x000000013F7C6000-memory.dmp

Filesize
4.0MB

Download
memory/2812-150-0x000000013FE10000-0x0000000140206000-memory.dmp

Filesize
4.0MB

Download
memory/2840-140-0x000000013F580000-0x000000013F976000-memory.dmp

Filesize
4.0MB

Download
memory/2848-144-0x000000013FB70000-0x000000013FF66000-memory.dmp

Filesize
4.0MB

Download