xmrig | a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
Size

3.1MB
MD5

4d6a17eba7f1a734cd9e1d74a7f38d4a
SHA1

43a1314a8726d87695f566120072ee8025bd86eb
SHA256

a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983
SHA512

f2f07e9b90243b548751caa5ef8f138f9a04e3c3e2f09b67d1dae1abfe8c6e1e0a7726e883a1f0e1327252f8495adcc86bd0c72eccc20588f722a51f3eb69341
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWY:7bBeSFkM

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2932-0-0x00007FF7CB860000-0x00007FF7CBC56000-memory.dmp	xmrig
behavioral2/files/0x000800000002349d-11.dat	xmrig
behavioral2/files/0x000700000002349e-16.dat	xmrig
behavioral2/files/0x00080000000234a3-42.dat	xmrig
behavioral2/files/0x00070000000234a4-38.dat	xmrig
behavioral2/files/0x00070000000234a0-36.dat	xmrig
behavioral2/files/0x00080000000234a2-48.dat	xmrig
behavioral2/memory/3528-51-0x00007FF672400000-0x00007FF6727F6000-memory.dmp	xmrig
behavioral2/memory/2980-52-0x00007FF72DB90000-0x00007FF72DF86000-memory.dmp	xmrig
behavioral2/memory/1148-9-0x00007FF62FEA0000-0x00007FF630296000-memory.dmp	xmrig
behavioral2/memory/4576-53-0x00007FF789760000-0x00007FF789B56000-memory.dmp	xmrig
behavioral2/memory/3004-54-0x00007FF611F80000-0x00007FF612376000-memory.dmp	xmrig
behavioral2/memory/1296-55-0x00007FF778640000-0x00007FF778A36000-memory.dmp	xmrig
behavioral2/files/0x000600000002324e-8.dat	xmrig
behavioral2/memory/4792-57-0x00007FF6F90B0000-0x00007FF6F94A6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234a9-77.dat	xmrig
behavioral2/files/0x00070000000234aa-89.dat	xmrig
behavioral2/files/0x00070000000234ac-95.dat	xmrig
behavioral2/files/0x00070000000234ae-103.dat	xmrig
behavioral2/files/0x00070000000234b2-125.dat	xmrig
behavioral2/files/0x00070000000234b4-137.dat	xmrig
behavioral2/files/0x00070000000234b6-151.dat	xmrig
behavioral2/files/0x00070000000234bb-179.dat	xmrig
behavioral2/memory/2276-634-0x00007FF6766E0000-0x00007FF676AD6000-memory.dmp	xmrig
behavioral2/memory/4980-638-0x00007FF66FF20000-0x00007FF670316000-memory.dmp	xmrig
behavioral2/memory/860-650-0x00007FF6760F0000-0x00007FF6764E6000-memory.dmp	xmrig
behavioral2/memory/1832-653-0x00007FF66D0B0000-0x00007FF66D4A6000-memory.dmp	xmrig
behavioral2/memory/4896-656-0x00007FF7CC7E0000-0x00007FF7CCBD6000-memory.dmp	xmrig
behavioral2/memory/3748-658-0x00007FF7FEFF0000-0x00007FF7FF3E6000-memory.dmp	xmrig
behavioral2/memory/3724-659-0x00007FF74D010000-0x00007FF74D406000-memory.dmp	xmrig
behavioral2/memory/4492-657-0x00007FF75C490000-0x00007FF75C886000-memory.dmp	xmrig
behavioral2/memory/2200-660-0x00007FF637860000-0x00007FF637C56000-memory.dmp	xmrig
behavioral2/memory/2112-661-0x00007FF63B3B0000-0x00007FF63B7A6000-memory.dmp	xmrig
behavioral2/memory/4460-663-0x00007FF6AC480000-0x00007FF6AC876000-memory.dmp	xmrig
behavioral2/memory/1852-664-0x00007FF67A830000-0x00007FF67AC26000-memory.dmp	xmrig
behavioral2/memory/5000-665-0x00007FF741AD0000-0x00007FF741EC6000-memory.dmp	xmrig
behavioral2/memory/4668-662-0x00007FF75E870000-0x00007FF75EC66000-memory.dmp	xmrig
behavioral2/memory/4560-655-0x00007FF7D3600000-0x00007FF7D39F6000-memory.dmp	xmrig
behavioral2/memory/3344-643-0x00007FF7A7850000-0x00007FF7A7C46000-memory.dmp	xmrig
behavioral2/memory/4468-629-0x00007FF6CA790000-0x00007FF6CAB86000-memory.dmp	xmrig
behavioral2/files/0x00070000000234bc-186.dat	xmrig
behavioral2/files/0x00070000000234be-182.dat	xmrig
behavioral2/files/0x00070000000234bd-176.dat	xmrig
behavioral2/files/0x00070000000234ba-173.dat	xmrig
behavioral2/files/0x00070000000234b9-169.dat	xmrig
behavioral2/files/0x00070000000234b8-162.dat	xmrig
behavioral2/files/0x00070000000234b7-156.dat	xmrig
behavioral2/files/0x00070000000234b5-147.dat	xmrig
behavioral2/files/0x00070000000234b3-133.dat	xmrig
behavioral2/files/0x00070000000234b1-123.dat	xmrig
behavioral2/files/0x00070000000234b0-119.dat	xmrig
behavioral2/files/0x00070000000234af-117.dat	xmrig
behavioral2/files/0x00070000000234ad-104.dat	xmrig
behavioral2/files/0x00070000000234ab-93.dat	xmrig
behavioral2/files/0x00070000000234a8-79.dat	xmrig
behavioral2/files/0x00070000000234a7-73.dat	xmrig
behavioral2/files/0x00070000000234a6-69.dat	xmrig
behavioral2/files/0x00070000000234a5-61.dat	xmrig
behavioral2/memory/1148-1289-0x00007FF62FEA0000-0x00007FF630296000-memory.dmp	xmrig
behavioral2/memory/4792-1298-0x00007FF6F90B0000-0x00007FF6F94A6000-memory.dmp	xmrig
behavioral2/memory/3528-1303-0x00007FF672400000-0x00007FF6727F6000-memory.dmp	xmrig
behavioral2/memory/2980-1325-0x00007FF72DB90000-0x00007FF72DF86000-memory.dmp	xmrig
behavioral2/memory/4576-1329-0x00007FF789760000-0x00007FF789B56000-memory.dmp	xmrig
behavioral2/memory/3004-1340-0x00007FF611F80000-0x00007FF612376000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
3	4728	powershell.exe
5	4728	powershell.exe
10	4728	powershell.exe
11	4728	powershell.exe
13	4728	powershell.exe
14	4728	powershell.exe
16	4728	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4728	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1148	SNVRseB.exe
4792	juAQaoX.exe
3528	fCPKHZR.exe
2980	qrpdNQc.exe
4576	owSYwla.exe
3004	QPJEyJr.exe
1296	WMLOndR.exe
4468	NOSSAdN.exe
2276	KLXUttz.exe
4980	PFdDKDR.exe
3344	UXhcjYp.exe
860	GgvJuhO.exe
1832	jvqVJCJ.exe
4560	sASYyoR.exe
4896	WRqFbMv.exe
4492	BrfEEbL.exe
3748	NbpqbRr.exe
3724	qZVWUVW.exe
2200	WwQoIEf.exe
2112	mWgTnKq.exe
4668	VoPKyTs.exe
4460	YNEiEVV.exe
1852	imRhxgn.exe
5000	wQeMUmW.exe
4704	wLGUJcZ.exe
1952	ShMFvOo.exe
716	dJuupHG.exe
4408	JzwRaTY.exe
4340	wwdgidk.exe
752	Dgmftow.exe
2752	CFbRgzQ.exe
2796	pcQrowy.exe
3436	HXrsZWN.exe
864	THRONHd.exe
3556	jkueXcg.exe
2072	DirPTGb.exe
5100	HLvqUmV.exe
4552	moPPILm.exe
3788	mInJjJM.exe
4948	BmiWvOp.exe
996	iDvoOne.exe
4356	PxsYnQP.exe
1600	WVKHbcI.exe
1480	GZyTrUn.exe
4964	ZBBBKjs.exe
2544	yPvtSLv.exe
3404	lWmJmEW.exe
868	AEutPCk.exe
2240	JhEKcLF.exe
2460	GBjheLZ.exe
1656	rplZRDR.exe
3164	TPALrQo.exe
1864	mpOYzfO.exe
3240	FuHWvdm.exe
1720	nwoWsDW.exe
2760	oSXtueD.exe
372	qPPFXrV.exe
1936	wtplfJc.exe
916	YwFsclI.exe
2168	gkwmcHL.exe
1572	ipdwtFB.exe
1624	pVndVCH.exe
2764	EvbmglF.exe
4368	SThvUbm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2932-0-0x00007FF7CB860000-0x00007FF7CBC56000-memory.dmp	upx
behavioral2/files/0x000800000002349d-11.dat	upx
behavioral2/files/0x000700000002349e-16.dat	upx
behavioral2/files/0x00080000000234a3-42.dat	upx
behavioral2/files/0x00070000000234a4-38.dat	upx
behavioral2/files/0x00070000000234a0-36.dat	upx
behavioral2/files/0x00080000000234a2-48.dat	upx
behavioral2/memory/3528-51-0x00007FF672400000-0x00007FF6727F6000-memory.dmp	upx
behavioral2/memory/2980-52-0x00007FF72DB90000-0x00007FF72DF86000-memory.dmp	upx
behavioral2/memory/1148-9-0x00007FF62FEA0000-0x00007FF630296000-memory.dmp	upx
behavioral2/memory/4576-53-0x00007FF789760000-0x00007FF789B56000-memory.dmp	upx
behavioral2/memory/3004-54-0x00007FF611F80000-0x00007FF612376000-memory.dmp	upx
behavioral2/memory/1296-55-0x00007FF778640000-0x00007FF778A36000-memory.dmp	upx
behavioral2/files/0x000600000002324e-8.dat	upx
behavioral2/memory/4792-57-0x00007FF6F90B0000-0x00007FF6F94A6000-memory.dmp	upx
behavioral2/files/0x00070000000234a9-77.dat	upx
behavioral2/files/0x00070000000234aa-89.dat	upx
behavioral2/files/0x00070000000234ac-95.dat	upx
behavioral2/files/0x00070000000234ae-103.dat	upx
behavioral2/files/0x00070000000234b2-125.dat	upx
behavioral2/files/0x00070000000234b4-137.dat	upx
behavioral2/files/0x00070000000234b6-151.dat	upx
behavioral2/files/0x00070000000234bb-179.dat	upx
behavioral2/memory/2276-634-0x00007FF6766E0000-0x00007FF676AD6000-memory.dmp	upx
behavioral2/memory/4980-638-0x00007FF66FF20000-0x00007FF670316000-memory.dmp	upx
behavioral2/memory/860-650-0x00007FF6760F0000-0x00007FF6764E6000-memory.dmp	upx
behavioral2/memory/1832-653-0x00007FF66D0B0000-0x00007FF66D4A6000-memory.dmp	upx
behavioral2/memory/4896-656-0x00007FF7CC7E0000-0x00007FF7CCBD6000-memory.dmp	upx
behavioral2/memory/3748-658-0x00007FF7FEFF0000-0x00007FF7FF3E6000-memory.dmp	upx
behavioral2/memory/3724-659-0x00007FF74D010000-0x00007FF74D406000-memory.dmp	upx
behavioral2/memory/4492-657-0x00007FF75C490000-0x00007FF75C886000-memory.dmp	upx
behavioral2/memory/2200-660-0x00007FF637860000-0x00007FF637C56000-memory.dmp	upx
behavioral2/memory/2112-661-0x00007FF63B3B0000-0x00007FF63B7A6000-memory.dmp	upx
behavioral2/memory/4460-663-0x00007FF6AC480000-0x00007FF6AC876000-memory.dmp	upx
behavioral2/memory/1852-664-0x00007FF67A830000-0x00007FF67AC26000-memory.dmp	upx
behavioral2/memory/5000-665-0x00007FF741AD0000-0x00007FF741EC6000-memory.dmp	upx
behavioral2/memory/4668-662-0x00007FF75E870000-0x00007FF75EC66000-memory.dmp	upx
behavioral2/memory/4560-655-0x00007FF7D3600000-0x00007FF7D39F6000-memory.dmp	upx
behavioral2/memory/3344-643-0x00007FF7A7850000-0x00007FF7A7C46000-memory.dmp	upx
behavioral2/memory/4468-629-0x00007FF6CA790000-0x00007FF6CAB86000-memory.dmp	upx
behavioral2/files/0x00070000000234bc-186.dat	upx
behavioral2/files/0x00070000000234be-182.dat	upx
behavioral2/files/0x00070000000234bd-176.dat	upx
behavioral2/files/0x00070000000234ba-173.dat	upx
behavioral2/files/0x00070000000234b9-169.dat	upx
behavioral2/files/0x00070000000234b8-162.dat	upx
behavioral2/files/0x00070000000234b7-156.dat	upx
behavioral2/files/0x00070000000234b5-147.dat	upx
behavioral2/files/0x00070000000234b3-133.dat	upx
behavioral2/files/0x00070000000234b1-123.dat	upx
behavioral2/files/0x00070000000234b0-119.dat	upx
behavioral2/files/0x00070000000234af-117.dat	upx
behavioral2/files/0x00070000000234ad-104.dat	upx
behavioral2/files/0x00070000000234ab-93.dat	upx
behavioral2/files/0x00070000000234a8-79.dat	upx
behavioral2/files/0x00070000000234a7-73.dat	upx
behavioral2/files/0x00070000000234a6-69.dat	upx
behavioral2/files/0x00070000000234a5-61.dat	upx
behavioral2/memory/1148-1289-0x00007FF62FEA0000-0x00007FF630296000-memory.dmp	upx
behavioral2/memory/4792-1298-0x00007FF6F90B0000-0x00007FF6F94A6000-memory.dmp	upx
behavioral2/memory/3528-1303-0x00007FF672400000-0x00007FF6727F6000-memory.dmp	upx
behavioral2/memory/2980-1325-0x00007FF72DB90000-0x00007FF72DF86000-memory.dmp	upx
behavioral2/memory/4576-1329-0x00007FF789760000-0x00007FF789B56000-memory.dmp	upx
behavioral2/memory/3004-1340-0x00007FF611F80000-0x00007FF612376000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xVmsDpT.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\drwqoEl.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\iJnegFK.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\xfxbzUg.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\HdkFIyq.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\QcHMGIZ.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\SWAtvOy.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\DiRUIRQ.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\EGhSpDv.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\XyiKgCW.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\CLtVFuV.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\Ustczjr.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\MaZFGng.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\wwdgidk.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\ySiuxQm.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\bjkIwjU.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\wUYmMoS.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\KdDieaY.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\hyUREKl.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\eRhTGCR.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\RgHsutw.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\wwUVmjC.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\GDfchsm.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\fUWOjaP.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\SmHXBHq.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\MDonYsw.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\fxceepV.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\zXARYjD.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\yweknzv.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\DShJJDz.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\syWaqME.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\uWBmDbk.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\afvUPwO.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\SjWUTrf.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\dGRVGpq.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\JbiYYRL.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\tpcCgxW.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\FcmVsOP.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\XFwcMbu.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\RfjIfHE.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\zTkdIfv.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\NXprXmH.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\AaIRrVt.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\aZgTiec.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\amirBNU.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\lmkRjJc.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\sGQCKtD.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\roirKal.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\yXPZcaM.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\YmdFWSN.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\LmCWkMN.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\dBhxGeS.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\qSHmRHz.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\DjYLfAH.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\bhsQDmk.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\CsofMDv.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\WMLOndR.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\FDQonRm.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\UzjDxeU.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\yWaXlOC.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\iWwtQRC.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\bdnuhMU.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\ubHXpSD.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
File created	C:\Windows\System\Tnevihb.exe	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4728	powershell.exe
4728	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
Token: SeLockMemoryPrivilege	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
Token: SeDebugPrivilege	4728	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 4728	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	85
PID 2932 wrote to memory of 4728	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	85
PID 2932 wrote to memory of 1148	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	86
PID 2932 wrote to memory of 1148	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	86
PID 2932 wrote to memory of 4792	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	87
PID 2932 wrote to memory of 4792	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	87
PID 2932 wrote to memory of 3528	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	88
PID 2932 wrote to memory of 3528	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	88
PID 2932 wrote to memory of 2980	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	89
PID 2932 wrote to memory of 2980	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	89
PID 2932 wrote to memory of 4576	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	91
PID 2932 wrote to memory of 4576	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	91
PID 2932 wrote to memory of 3004	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	92
PID 2932 wrote to memory of 3004	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	92
PID 2932 wrote to memory of 1296	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	93
PID 2932 wrote to memory of 1296	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	93
PID 2932 wrote to memory of 4468	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	94
PID 2932 wrote to memory of 4468	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	94
PID 2932 wrote to memory of 2276	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	95
PID 2932 wrote to memory of 2276	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	95
PID 2932 wrote to memory of 4980	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	96
PID 2932 wrote to memory of 4980	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	96
PID 2932 wrote to memory of 3344	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	97
PID 2932 wrote to memory of 3344	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	97
PID 2932 wrote to memory of 860	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	98
PID 2932 wrote to memory of 860	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	98
PID 2932 wrote to memory of 1832	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	99
PID 2932 wrote to memory of 1832	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	99
PID 2932 wrote to memory of 4560	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	100
PID 2932 wrote to memory of 4560	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	100
PID 2932 wrote to memory of 4896	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	101
PID 2932 wrote to memory of 4896	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	101
PID 2932 wrote to memory of 4492	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	102
PID 2932 wrote to memory of 4492	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	102
PID 2932 wrote to memory of 3748	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	103
PID 2932 wrote to memory of 3748	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	103
PID 2932 wrote to memory of 3724	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	104
PID 2932 wrote to memory of 3724	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	104
PID 2932 wrote to memory of 2200	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	105
PID 2932 wrote to memory of 2200	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	105
PID 2932 wrote to memory of 2112	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	106
PID 2932 wrote to memory of 2112	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	106
PID 2932 wrote to memory of 4668	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	107
PID 2932 wrote to memory of 4668	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	107
PID 2932 wrote to memory of 4460	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	108
PID 2932 wrote to memory of 4460	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	108
PID 2932 wrote to memory of 1852	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	109
PID 2932 wrote to memory of 1852	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	109
PID 2932 wrote to memory of 5000	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	110
PID 2932 wrote to memory of 5000	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	110
PID 2932 wrote to memory of 4704	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	111
PID 2932 wrote to memory of 4704	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	111
PID 2932 wrote to memory of 1952	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	112
PID 2932 wrote to memory of 1952	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	112
PID 2932 wrote to memory of 716	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	113
PID 2932 wrote to memory of 716	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	113
PID 2932 wrote to memory of 4408	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	114
PID 2932 wrote to memory of 4408	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	114
PID 2932 wrote to memory of 4340	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	115
PID 2932 wrote to memory of 4340	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	115
PID 2932 wrote to memory of 752	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	116
PID 2932 wrote to memory of 752	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	116
PID 2932 wrote to memory of 2752	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	117
PID 2932 wrote to memory of 2752	2932	a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe	117

C:\Users\Admin\AppData\Local\Temp\a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe
"C:\Users\Admin\AppData\Local\Temp\a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\System\SNVRseB.exe
  C:\Windows\System\SNVRseB.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\juAQaoX.exe
  C:\Windows\System\juAQaoX.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\fCPKHZR.exe
  C:\Windows\System\fCPKHZR.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\qrpdNQc.exe
  C:\Windows\System\qrpdNQc.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\owSYwla.exe
  C:\Windows\System\owSYwla.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\QPJEyJr.exe
  C:\Windows\System\QPJEyJr.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\WMLOndR.exe
  C:\Windows\System\WMLOndR.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\NOSSAdN.exe
  C:\Windows\System\NOSSAdN.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\KLXUttz.exe
  C:\Windows\System\KLXUttz.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\PFdDKDR.exe
  C:\Windows\System\PFdDKDR.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\UXhcjYp.exe
  C:\Windows\System\UXhcjYp.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\GgvJuhO.exe
  C:\Windows\System\GgvJuhO.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\jvqVJCJ.exe
  C:\Windows\System\jvqVJCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\sASYyoR.exe
  C:\Windows\System\sASYyoR.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\WRqFbMv.exe
  C:\Windows\System\WRqFbMv.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\BrfEEbL.exe
  C:\Windows\System\BrfEEbL.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\NbpqbRr.exe
  C:\Windows\System\NbpqbRr.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\qZVWUVW.exe
  C:\Windows\System\qZVWUVW.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\WwQoIEf.exe
  C:\Windows\System\WwQoIEf.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\mWgTnKq.exe
  C:\Windows\System\mWgTnKq.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\VoPKyTs.exe
  C:\Windows\System\VoPKyTs.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\YNEiEVV.exe
  C:\Windows\System\YNEiEVV.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\imRhxgn.exe
  C:\Windows\System\imRhxgn.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\wQeMUmW.exe
  C:\Windows\System\wQeMUmW.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\wLGUJcZ.exe
  C:\Windows\System\wLGUJcZ.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\ShMFvOo.exe
  C:\Windows\System\ShMFvOo.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\dJuupHG.exe
  C:\Windows\System\dJuupHG.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\JzwRaTY.exe
  C:\Windows\System\JzwRaTY.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\wwdgidk.exe
  C:\Windows\System\wwdgidk.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\Dgmftow.exe
  C:\Windows\System\Dgmftow.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\CFbRgzQ.exe
  C:\Windows\System\CFbRgzQ.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\pcQrowy.exe
  C:\Windows\System\pcQrowy.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\HXrsZWN.exe
  C:\Windows\System\HXrsZWN.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\THRONHd.exe
  C:\Windows\System\THRONHd.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\jkueXcg.exe
  C:\Windows\System\jkueXcg.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\DirPTGb.exe
  C:\Windows\System\DirPTGb.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\HLvqUmV.exe
  C:\Windows\System\HLvqUmV.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\moPPILm.exe
  C:\Windows\System\moPPILm.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\mInJjJM.exe
  C:\Windows\System\mInJjJM.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\BmiWvOp.exe
  C:\Windows\System\BmiWvOp.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\iDvoOne.exe
  C:\Windows\System\iDvoOne.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\PxsYnQP.exe
  C:\Windows\System\PxsYnQP.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\WVKHbcI.exe
  C:\Windows\System\WVKHbcI.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\GZyTrUn.exe
  C:\Windows\System\GZyTrUn.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\ZBBBKjs.exe
  C:\Windows\System\ZBBBKjs.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\yPvtSLv.exe
  C:\Windows\System\yPvtSLv.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\lWmJmEW.exe
  C:\Windows\System\lWmJmEW.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\AEutPCk.exe
  C:\Windows\System\AEutPCk.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\JhEKcLF.exe
  C:\Windows\System\JhEKcLF.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\GBjheLZ.exe
  C:\Windows\System\GBjheLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\rplZRDR.exe
  C:\Windows\System\rplZRDR.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\TPALrQo.exe
  C:\Windows\System\TPALrQo.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\mpOYzfO.exe
  C:\Windows\System\mpOYzfO.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\FuHWvdm.exe
  C:\Windows\System\FuHWvdm.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\nwoWsDW.exe
  C:\Windows\System\nwoWsDW.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\oSXtueD.exe
  C:\Windows\System\oSXtueD.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\qPPFXrV.exe
  C:\Windows\System\qPPFXrV.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\wtplfJc.exe
  C:\Windows\System\wtplfJc.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\YwFsclI.exe
  C:\Windows\System\YwFsclI.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\gkwmcHL.exe
  C:\Windows\System\gkwmcHL.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\ipdwtFB.exe
  C:\Windows\System\ipdwtFB.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\pVndVCH.exe
  C:\Windows\System\pVndVCH.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\EvbmglF.exe
  C:\Windows\System\EvbmglF.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\SThvUbm.exe
  C:\Windows\System\SThvUbm.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\rzYBkQm.exe
  C:\Windows\System\rzYBkQm.exe
  2⤵
  PID:3080
- C:\Windows\System\ZCxDCNa.exe
  C:\Windows\System\ZCxDCNa.exe
  2⤵
  PID:1992
- C:\Windows\System\hzhUeGv.exe
  C:\Windows\System\hzhUeGv.exe
  2⤵
  PID:2248
- C:\Windows\System\qwgtgiy.exe
  C:\Windows\System\qwgtgiy.exe
  2⤵
  PID:2028
- C:\Windows\System\KymtKVX.exe
  C:\Windows\System\KymtKVX.exe
  2⤵
  PID:1220
- C:\Windows\System\WzkZImd.exe
  C:\Windows\System\WzkZImd.exe
  2⤵
  PID:5028
- C:\Windows\System\yqkSYBS.exe
  C:\Windows\System\yqkSYBS.exe
  2⤵
  PID:2244
- C:\Windows\System\MVbPCJT.exe
  C:\Windows\System\MVbPCJT.exe
  2⤵
  PID:5008
- C:\Windows\System\MAeRrUt.exe
  C:\Windows\System\MAeRrUt.exe
  2⤵
  PID:3028
- C:\Windows\System\iiLHseF.exe
  C:\Windows\System\iiLHseF.exe
  2⤵
  PID:2596
- C:\Windows\System\OUujZHG.exe
  C:\Windows\System\OUujZHG.exe
  2⤵
  PID:2468
- C:\Windows\System\vQEmFrO.exe
  C:\Windows\System\vQEmFrO.exe
  2⤵
  PID:5128
- C:\Windows\System\otXeZgk.exe
  C:\Windows\System\otXeZgk.exe
  2⤵
  PID:5148
- C:\Windows\System\OLxuxRn.exe
  C:\Windows\System\OLxuxRn.exe
  2⤵
  PID:5188
- C:\Windows\System\RISNtEb.exe
  C:\Windows\System\RISNtEb.exe
  2⤵
  PID:5212
- C:\Windows\System\ykhoqPJ.exe
  C:\Windows\System\ykhoqPJ.exe
  2⤵
  PID:5244
- C:\Windows\System\ZYcqGZd.exe
  C:\Windows\System\ZYcqGZd.exe
  2⤵
  PID:5280
- C:\Windows\System\qEjIdfC.exe
  C:\Windows\System\qEjIdfC.exe
  2⤵
  PID:5316
- C:\Windows\System\VRMXulV.exe
  C:\Windows\System\VRMXulV.exe
  2⤵
  PID:5348
- C:\Windows\System\nFQEHBD.exe
  C:\Windows\System\nFQEHBD.exe
  2⤵
  PID:5368
- C:\Windows\System\JkyxbQN.exe
  C:\Windows\System\JkyxbQN.exe
  2⤵
  PID:5384
- C:\Windows\System\ZdbTmlQ.exe
  C:\Windows\System\ZdbTmlQ.exe
  2⤵
  PID:5416
- C:\Windows\System\HBrvuYK.exe
  C:\Windows\System\HBrvuYK.exe
  2⤵
  PID:5436
- C:\Windows\System\uiscTLo.exe
  C:\Windows\System\uiscTLo.exe
  2⤵
  PID:5488
- C:\Windows\System\NVuTbyo.exe
  C:\Windows\System\NVuTbyo.exe
  2⤵
  PID:5520
- C:\Windows\System\SFsRxvq.exe
  C:\Windows\System\SFsRxvq.exe
  2⤵
  PID:5548
- C:\Windows\System\ONUcbwu.exe
  C:\Windows\System\ONUcbwu.exe
  2⤵
  PID:5564
- C:\Windows\System\WsVvpdC.exe
  C:\Windows\System\WsVvpdC.exe
  2⤵
  PID:5592
- C:\Windows\System\oFbbZwE.exe
  C:\Windows\System\oFbbZwE.exe
  2⤵
  PID:5624
- C:\Windows\System\gQGKtMc.exe
  C:\Windows\System\gQGKtMc.exe
  2⤵
  PID:5648
- C:\Windows\System\oEfiNhR.exe
  C:\Windows\System\oEfiNhR.exe
  2⤵
  PID:5668
- C:\Windows\System\srFIuct.exe
  C:\Windows\System\srFIuct.exe
  2⤵
  PID:5688
- C:\Windows\System\siUmBzS.exe
  C:\Windows\System\siUmBzS.exe
  2⤵
  PID:5708
- C:\Windows\System\UKxdvYE.exe
  C:\Windows\System\UKxdvYE.exe
  2⤵
  PID:5736
- C:\Windows\System\Rvzggdf.exe
  C:\Windows\System\Rvzggdf.exe
  2⤵
  PID:5760
- C:\Windows\System\WFzFbYo.exe
  C:\Windows\System\WFzFbYo.exe
  2⤵
  PID:5784
- C:\Windows\System\rKDdSEg.exe
  C:\Windows\System\rKDdSEg.exe
  2⤵
  PID:5820
- C:\Windows\System\EuJbbzX.exe
  C:\Windows\System\EuJbbzX.exe
  2⤵
  PID:5876
- C:\Windows\System\sKoaaGa.exe
  C:\Windows\System\sKoaaGa.exe
  2⤵
  PID:5912
- C:\Windows\System\oYhvzGn.exe
  C:\Windows\System\oYhvzGn.exe
  2⤵
  PID:5928
- C:\Windows\System\MoCyijl.exe
  C:\Windows\System\MoCyijl.exe
  2⤵
  PID:5956
- C:\Windows\System\RnTuYNN.exe
  C:\Windows\System\RnTuYNN.exe
  2⤵
  PID:5976
- C:\Windows\System\uzgLRVP.exe
  C:\Windows\System\uzgLRVP.exe
  2⤵
  PID:6012
- C:\Windows\System\UNnAtMw.exe
  C:\Windows\System\UNnAtMw.exe
  2⤵
  PID:6040
- C:\Windows\System\WClZLQr.exe
  C:\Windows\System\WClZLQr.exe
  2⤵
  PID:6056
- C:\Windows\System\wvOcwGK.exe
  C:\Windows\System\wvOcwGK.exe
  2⤵
  PID:6076
- C:\Windows\System\csAoMXt.exe
  C:\Windows\System\csAoMXt.exe
  2⤵
  PID:6104
- C:\Windows\System\nmImdIw.exe
  C:\Windows\System\nmImdIw.exe
  2⤵
  PID:6136
- C:\Windows\System\FsxIXvG.exe
  C:\Windows\System\FsxIXvG.exe
  2⤵
  PID:3916
- C:\Windows\System\KWMuIlp.exe
  C:\Windows\System\KWMuIlp.exe
  2⤵
  PID:3948
- C:\Windows\System\mAoYPMW.exe
  C:\Windows\System\mAoYPMW.exe
  2⤵
  PID:3852
- C:\Windows\System\OUmDwav.exe
  C:\Windows\System\OUmDwav.exe
  2⤵
  PID:2672
- C:\Windows\System\oWqVTZt.exe
  C:\Windows\System\oWqVTZt.exe
  2⤵
  PID:3656
- C:\Windows\System\xlUyAEP.exe
  C:\Windows\System\xlUyAEP.exe
  2⤵
  PID:4364
- C:\Windows\System\FjGoEsq.exe
  C:\Windows\System\FjGoEsq.exe
  2⤵
  PID:5144
- C:\Windows\System\WvjtGrR.exe
  C:\Windows\System\WvjtGrR.exe
  2⤵
  PID:5308
- C:\Windows\System\QJAkAea.exe
  C:\Windows\System\QJAkAea.exe
  2⤵
  PID:5344
- C:\Windows\System\uTOGEQn.exe
  C:\Windows\System\uTOGEQn.exe
  2⤵
  PID:5400
- C:\Windows\System\DVTUmJl.exe
  C:\Windows\System\DVTUmJl.exe
  2⤵
  PID:5468
- C:\Windows\System\KxSpdaK.exe
  C:\Windows\System\KxSpdaK.exe
  2⤵
  PID:5540
- C:\Windows\System\ewSTuwx.exe
  C:\Windows\System\ewSTuwx.exe
  2⤵
  PID:5604
- C:\Windows\System\UmLNHXv.exe
  C:\Windows\System\UmLNHXv.exe
  2⤵
  PID:5640
- C:\Windows\System\dkZBxKw.exe
  C:\Windows\System\dkZBxKw.exe
  2⤵
  PID:5700
- C:\Windows\System\rbymlAC.exe
  C:\Windows\System\rbymlAC.exe
  2⤵
  PID:5748
- C:\Windows\System\SsmOsIB.exe
  C:\Windows\System\SsmOsIB.exe
  2⤵
  PID:5808
- C:\Windows\System\iklRSmF.exe
  C:\Windows\System\iklRSmF.exe
  2⤵
  PID:5844
- C:\Windows\System\jhNmFAa.exe
  C:\Windows\System\jhNmFAa.exe
  2⤵
  PID:5904
- C:\Windows\System\klKNIXW.exe
  C:\Windows\System\klKNIXW.exe
  2⤵
  PID:5936
- C:\Windows\System\pOvOYGo.exe
  C:\Windows\System\pOvOYGo.exe
  2⤵
  PID:6052
- C:\Windows\System\jIYDnWp.exe
  C:\Windows\System\jIYDnWp.exe
  2⤵
  PID:6132
- C:\Windows\System\qcNMywU.exe
  C:\Windows\System\qcNMywU.exe
  2⤵
  PID:2024
- C:\Windows\System\wKBTLBk.exe
  C:\Windows\System\wKBTLBk.exe
  2⤵
  PID:5172
- C:\Windows\System\fFeQVRx.exe
  C:\Windows\System\fFeQVRx.exe
  2⤵
  PID:5376
- C:\Windows\System\PaTyotR.exe
  C:\Windows\System\PaTyotR.exe
  2⤵
  PID:5516
- C:\Windows\System\QuAdSWz.exe
  C:\Windows\System\QuAdSWz.exe
  2⤵
  PID:5724
- C:\Windows\System\icgwBEx.exe
  C:\Windows\System\icgwBEx.exe
  2⤵
  PID:5828
- C:\Windows\System\CReSvNW.exe
  C:\Windows\System\CReSvNW.exe
  2⤵
  PID:1368
- C:\Windows\System\ajwhGNa.exe
  C:\Windows\System\ajwhGNa.exe
  2⤵
  PID:6096
- C:\Windows\System\OoqbfZp.exe
  C:\Windows\System\OoqbfZp.exe
  2⤵
  PID:636
- C:\Windows\System\jzEbgnv.exe
  C:\Windows\System\jzEbgnv.exe
  2⤵
  PID:6148
- C:\Windows\System\IdDvtMM.exe
  C:\Windows\System\IdDvtMM.exe
  2⤵
  PID:6184
- C:\Windows\System\DtSwUlS.exe
  C:\Windows\System\DtSwUlS.exe
  2⤵
  PID:6208
- C:\Windows\System\gAGRWhm.exe
  C:\Windows\System\gAGRWhm.exe
  2⤵
  PID:6240
- C:\Windows\System\hQMTQCR.exe
  C:\Windows\System\hQMTQCR.exe
  2⤵
  PID:6264
- C:\Windows\System\eKfnXst.exe
  C:\Windows\System\eKfnXst.exe
  2⤵
  PID:6296
- C:\Windows\System\pGmOvbM.exe
  C:\Windows\System\pGmOvbM.exe
  2⤵
  PID:6328
- C:\Windows\System\eIdOQiG.exe
  C:\Windows\System\eIdOQiG.exe
  2⤵
  PID:6356
- C:\Windows\System\EJSvjIz.exe
  C:\Windows\System\EJSvjIz.exe
  2⤵
  PID:6380
- C:\Windows\System\EHzPWzd.exe
  C:\Windows\System\EHzPWzd.exe
  2⤵
  PID:6404
- C:\Windows\System\qcesaIU.exe
  C:\Windows\System\qcesaIU.exe
  2⤵
  PID:6428
- C:\Windows\System\EzHKNSp.exe
  C:\Windows\System\EzHKNSp.exe
  2⤵
  PID:6464
- C:\Windows\System\RSrihSe.exe
  C:\Windows\System\RSrihSe.exe
  2⤵
  PID:6496
- C:\Windows\System\pfSSbaz.exe
  C:\Windows\System\pfSSbaz.exe
  2⤵
  PID:6516
- C:\Windows\System\ItCntLZ.exe
  C:\Windows\System\ItCntLZ.exe
  2⤵
  PID:6544
- C:\Windows\System\sQujfFj.exe
  C:\Windows\System\sQujfFj.exe
  2⤵
  PID:6564
- C:\Windows\System\zwjBVUG.exe
  C:\Windows\System\zwjBVUG.exe
  2⤵
  PID:6580
- C:\Windows\System\ftcFZuf.exe
  C:\Windows\System\ftcFZuf.exe
  2⤵
  PID:6604
- C:\Windows\System\WkTOAha.exe
  C:\Windows\System\WkTOAha.exe
  2⤵
  PID:6620
- C:\Windows\System\PYuhgnF.exe
  C:\Windows\System\PYuhgnF.exe
  2⤵
  PID:6636
- C:\Windows\System\kcLsnTb.exe
  C:\Windows\System\kcLsnTb.exe
  2⤵
  PID:6672
- C:\Windows\System\cLafrDe.exe
  C:\Windows\System\cLafrDe.exe
  2⤵
  PID:6708
- C:\Windows\System\MBlbyOh.exe
  C:\Windows\System\MBlbyOh.exe
  2⤵
  PID:6760
- C:\Windows\System\NIRoDyx.exe
  C:\Windows\System\NIRoDyx.exe
  2⤵
  PID:6784
- C:\Windows\System\MgvrRGw.exe
  C:\Windows\System\MgvrRGw.exe
  2⤵
  PID:6808
- C:\Windows\System\pRxarJJ.exe
  C:\Windows\System\pRxarJJ.exe
  2⤵
  PID:6824
- C:\Windows\System\HPYeLWq.exe
  C:\Windows\System\HPYeLWq.exe
  2⤵
  PID:6848
- C:\Windows\System\iHPPMWe.exe
  C:\Windows\System\iHPPMWe.exe
  2⤵
  PID:6868
- C:\Windows\System\FRTruOc.exe
  C:\Windows\System\FRTruOc.exe
  2⤵
  PID:6888
- C:\Windows\System\UxTJmWZ.exe
  C:\Windows\System\UxTJmWZ.exe
  2⤵
  PID:6908
- C:\Windows\System\uSVzKGj.exe
  C:\Windows\System\uSVzKGj.exe
  2⤵
  PID:6944
- C:\Windows\System\pBVwzwK.exe
  C:\Windows\System\pBVwzwK.exe
  2⤵
  PID:6992
- C:\Windows\System\unUyuyg.exe
  C:\Windows\System\unUyuyg.exe
  2⤵
  PID:7008
- C:\Windows\System\mUdEPwY.exe
  C:\Windows\System\mUdEPwY.exe
  2⤵
  PID:7024
- C:\Windows\System\kmmbcfY.exe
  C:\Windows\System\kmmbcfY.exe
  2⤵
  PID:7044
- C:\Windows\System\SSRaZkb.exe
  C:\Windows\System\SSRaZkb.exe
  2⤵
  PID:7064
- C:\Windows\System\cRgNdiJ.exe
  C:\Windows\System\cRgNdiJ.exe
  2⤵
  PID:7104
- C:\Windows\System\fZYYrsf.exe
  C:\Windows\System\fZYYrsf.exe
  2⤵
  PID:5728
- C:\Windows\System\skNnDla.exe
  C:\Windows\System\skNnDla.exe
  2⤵
  PID:5140
- C:\Windows\System\iZITsXn.exe
  C:\Windows\System\iZITsXn.exe
  2⤵
  PID:6200
- C:\Windows\System\hFpvcwr.exe
  C:\Windows\System\hFpvcwr.exe
  2⤵
  PID:6260
- C:\Windows\System\xvMUVUU.exe
  C:\Windows\System\xvMUVUU.exe
  2⤵
  PID:6304
- C:\Windows\System\kewaowH.exe
  C:\Windows\System\kewaowH.exe
  2⤵
  PID:6344
- C:\Windows\System\MkkfvYp.exe
  C:\Windows\System\MkkfvYp.exe
  2⤵
  PID:6392
- C:\Windows\System\TjncXIL.exe
  C:\Windows\System\TjncXIL.exe
  2⤵
  PID:6420
- C:\Windows\System\bakdJqM.exe
  C:\Windows\System\bakdJqM.exe
  2⤵
  PID:6480
- C:\Windows\System\QyeaFHh.exe
  C:\Windows\System\QyeaFHh.exe
  2⤵
  PID:6512
- C:\Windows\System\sWGFjqZ.exe
  C:\Windows\System\sWGFjqZ.exe
  2⤵
  PID:6964
- C:\Windows\System\ZaikEyi.exe
  C:\Windows\System\ZaikEyi.exe
  2⤵
  PID:7032
- C:\Windows\System\NtNodel.exe
  C:\Windows\System\NtNodel.exe
  2⤵
  PID:1588
- C:\Windows\System\JBpCYXL.exe
  C:\Windows\System\JBpCYXL.exe
  2⤵
  PID:7132
- C:\Windows\System\RFuyehU.exe
  C:\Windows\System\RFuyehU.exe
  2⤵
  PID:1420
- C:\Windows\System\NicfAho.exe
  C:\Windows\System\NicfAho.exe
  2⤵
  PID:3612
- C:\Windows\System\kheJXbs.exe
  C:\Windows\System\kheJXbs.exe
  2⤵
  PID:6172
- C:\Windows\System\mVuDzDS.exe
  C:\Windows\System\mVuDzDS.exe
  2⤵
  PID:2228
- C:\Windows\System\oKKuAQt.exe
  C:\Windows\System\oKKuAQt.exe
  2⤵
  PID:6412
- C:\Windows\System\MOVWHJJ.exe
  C:\Windows\System\MOVWHJJ.exe
  2⤵
  PID:2340
- C:\Windows\System\WOJYgUi.exe
  C:\Windows\System\WOJYgUi.exe
  2⤵
  PID:6504
- C:\Windows\System\bPZBbsk.exe
  C:\Windows\System\bPZBbsk.exe
  2⤵
  PID:2316
- C:\Windows\System\STsGZaU.exe
  C:\Windows\System\STsGZaU.exe
  2⤵
  PID:2812
- C:\Windows\System\tpIHJsB.exe
  C:\Windows\System\tpIHJsB.exe
  2⤵
  PID:6556
- C:\Windows\System\IbPNQCY.exe
  C:\Windows\System\IbPNQCY.exe
  2⤵
  PID:4880
- C:\Windows\System\YWiOaGP.exe
  C:\Windows\System\YWiOaGP.exe
  2⤵
  PID:4928
- C:\Windows\System\XQVtKFw.exe
  C:\Windows\System\XQVtKFw.exe
  2⤵
  PID:2924
- C:\Windows\System\xdIQryJ.exe
  C:\Windows\System\xdIQryJ.exe
  2⤵
  PID:7016
- C:\Windows\System\VbNlNcZ.exe
  C:\Windows\System\VbNlNcZ.exe
  2⤵
  PID:4672
- C:\Windows\System\EnQEiPJ.exe
  C:\Windows\System\EnQEiPJ.exe
  2⤵
  PID:3932
- C:\Windows\System\gtOGIRr.exe
  C:\Windows\System\gtOGIRr.exe
  2⤵
  PID:4412
- C:\Windows\System\nXUzCdZ.exe
  C:\Windows\System\nXUzCdZ.exe
  2⤵
  PID:4292
- C:\Windows\System\YqZgKdO.exe
  C:\Windows\System\YqZgKdO.exe
  2⤵
  PID:3332
- C:\Windows\System\HLJlKDB.exe
  C:\Windows\System\HLJlKDB.exe
  2⤵
  PID:4520
- C:\Windows\System\EnfaDrU.exe
  C:\Windows\System\EnfaDrU.exe
  2⤵
  PID:2292
- C:\Windows\System\AzzRfJg.exe
  C:\Windows\System\AzzRfJg.exe
  2⤵
  PID:3056
- C:\Windows\System\KFyExZI.exe
  C:\Windows\System\KFyExZI.exe
  2⤵
  PID:3588
- C:\Windows\System\DlxidyJ.exe
  C:\Windows\System\DlxidyJ.exe
  2⤵
  PID:516
- C:\Windows\System\LARfgzH.exe
  C:\Windows\System\LARfgzH.exe
  2⤵
  PID:1548
- C:\Windows\System\LrULRgk.exe
  C:\Windows\System\LrULRgk.exe
  2⤵
  PID:6968
- C:\Windows\System\eIzIMMu.exe
  C:\Windows\System\eIzIMMu.exe
  2⤵
  PID:7216
- C:\Windows\System\OSFkmkX.exe
  C:\Windows\System\OSFkmkX.exe
  2⤵
  PID:7272
- C:\Windows\System\jcauVEz.exe
  C:\Windows\System\jcauVEz.exe
  2⤵
  PID:7424
- C:\Windows\System\rnDUYUU.exe
  C:\Windows\System\rnDUYUU.exe
  2⤵
  PID:7508
- C:\Windows\System\YdEaGPX.exe
  C:\Windows\System\YdEaGPX.exe
  2⤵
  PID:7568
- C:\Windows\System\dLjTbGQ.exe
  C:\Windows\System\dLjTbGQ.exe
  2⤵
  PID:7616
- C:\Windows\System\uYCdyQC.exe
  C:\Windows\System\uYCdyQC.exe
  2⤵
  PID:7668
- C:\Windows\System\QnPdTVn.exe
  C:\Windows\System\QnPdTVn.exe
  2⤵
  PID:7732
- C:\Windows\System\STlIGyF.exe
  C:\Windows\System\STlIGyF.exe
  2⤵
  PID:7784
- C:\Windows\System\jUyVNuG.exe
  C:\Windows\System\jUyVNuG.exe
  2⤵
  PID:7904
- C:\Windows\System\IiRvcLP.exe
  C:\Windows\System\IiRvcLP.exe
  2⤵
  PID:7988
- C:\Windows\System\QmtZuSM.exe
  C:\Windows\System\QmtZuSM.exe
  2⤵
  PID:8072
- C:\Windows\System\leEWttg.exe
  C:\Windows\System\leEWttg.exe
  2⤵
  PID:8132
- C:\Windows\System\uhSSegD.exe
  C:\Windows\System\uhSSegD.exe
  2⤵
  PID:6876
- C:\Windows\System\rJLCjol.exe
  C:\Windows\System\rJLCjol.exe
  2⤵
  PID:7188
- C:\Windows\System\JePOdOx.exe
  C:\Windows\System\JePOdOx.exe
  2⤵
  PID:7320
- C:\Windows\System\eSqMxLn.exe
  C:\Windows\System\eSqMxLn.exe
  2⤵
  PID:7412
- C:\Windows\System\GGfAlsl.exe
  C:\Windows\System\GGfAlsl.exe
  2⤵
  PID:7432
- C:\Windows\System\cnWhySU.exe
  C:\Windows\System\cnWhySU.exe
  2⤵
  PID:7488
- C:\Windows\System\zOFyxQX.exe
  C:\Windows\System\zOFyxQX.exe
  2⤵
  PID:7520
- C:\Windows\System\TbpArUA.exe
  C:\Windows\System\TbpArUA.exe
  2⤵
  PID:7628
- C:\Windows\System\VAWSnhj.exe
  C:\Windows\System\VAWSnhj.exe
  2⤵
  PID:7664
- C:\Windows\System\CWUqZZQ.exe
  C:\Windows\System\CWUqZZQ.exe
  2⤵
  PID:7748
- C:\Windows\System\ViOLiQf.exe
  C:\Windows\System\ViOLiQf.exe
  2⤵
  PID:7796
- C:\Windows\System\HKTDZPV.exe
  C:\Windows\System\HKTDZPV.exe
  2⤵
  PID:7860
- C:\Windows\System\mDSZpci.exe
  C:\Windows\System\mDSZpci.exe
  2⤵
  PID:7884
- C:\Windows\System\tQtMBNN.exe
  C:\Windows\System\tQtMBNN.exe
  2⤵
  PID:7948
- C:\Windows\System\UaUtJCB.exe
  C:\Windows\System\UaUtJCB.exe
  2⤵
  PID:8004
- C:\Windows\System\wCDSqHz.exe
  C:\Windows\System\wCDSqHz.exe
  2⤵
  PID:8044
- C:\Windows\System\vMgirju.exe
  C:\Windows\System\vMgirju.exe
  2⤵
  PID:8080
- C:\Windows\System\pSOueby.exe
  C:\Windows\System\pSOueby.exe
  2⤵
  PID:8144
- C:\Windows\System\ewMdmoZ.exe
  C:\Windows\System\ewMdmoZ.exe
  2⤵
  PID:8152
- C:\Windows\System\xFgLzdL.exe
  C:\Windows\System\xFgLzdL.exe
  2⤵
  PID:8172
- C:\Windows\System\QDVswtk.exe
  C:\Windows\System\QDVswtk.exe
  2⤵
  PID:7180
- C:\Windows\System\rAsuxDE.exe
  C:\Windows\System\rAsuxDE.exe
  2⤵
  PID:6460
- C:\Windows\System\jCahOUV.exe
  C:\Windows\System\jCahOUV.exe
  2⤵
  PID:7208
- C:\Windows\System\iriDSGT.exe
  C:\Windows\System\iriDSGT.exe
  2⤵
  PID:7288
- C:\Windows\System\UfsiJMp.exe
  C:\Windows\System\UfsiJMp.exe
  2⤵
  PID:7352
- C:\Windows\System\hoduZbN.exe
  C:\Windows\System\hoduZbN.exe
  2⤵
  PID:7376
- C:\Windows\System\IXBuZSj.exe
  C:\Windows\System\IXBuZSj.exe
  2⤵
  PID:7472
- C:\Windows\System\wqfESrs.exe
  C:\Windows\System\wqfESrs.exe
  2⤵
  PID:7484
- C:\Windows\System\dWRTHTh.exe
  C:\Windows\System\dWRTHTh.exe
  2⤵
  PID:7552
- C:\Windows\System\ZoSKwLf.exe
  C:\Windows\System\ZoSKwLf.exe
  2⤵
  PID:7632
- C:\Windows\System\obDUKdC.exe
  C:\Windows\System\obDUKdC.exe
  2⤵
  PID:7692
- C:\Windows\System\bXbhoZN.exe
  C:\Windows\System\bXbhoZN.exe
  2⤵
  PID:7772
- C:\Windows\System\hKUSoYr.exe
  C:\Windows\System\hKUSoYr.exe
  2⤵
  PID:7808
- C:\Windows\System\liBaOZc.exe
  C:\Windows\System\liBaOZc.exe
  2⤵
  PID:7848
- C:\Windows\System\OFAEiJj.exe
  C:\Windows\System\OFAEiJj.exe
  2⤵
  PID:7968
- C:\Windows\System\nXpoYoe.exe
  C:\Windows\System\nXpoYoe.exe
  2⤵
  PID:8028
- C:\Windows\System\CiMfgKS.exe
  C:\Windows\System\CiMfgKS.exe
  2⤵
  PID:8104
- C:\Windows\System\aoYJKXV.exe
  C:\Windows\System\aoYJKXV.exe
  2⤵
  PID:8188
- C:\Windows\System\gtmVWLu.exe
  C:\Windows\System\gtmVWLu.exe
  2⤵
  PID:7232
- C:\Windows\System\UoGpaDc.exe
  C:\Windows\System\UoGpaDc.exe
  2⤵
  PID:7348
- C:\Windows\System\nUOPOJs.exe
  C:\Windows\System\nUOPOJs.exe
  2⤵
  PID:4784
- C:\Windows\System\MUXXyar.exe
  C:\Windows\System\MUXXyar.exe
  2⤵
  PID:7452
- C:\Windows\System\bqAwEbH.exe
  C:\Windows\System\bqAwEbH.exe
  2⤵
  PID:7580
- C:\Windows\System\agpRPae.exe
  C:\Windows\System\agpRPae.exe
  2⤵
  PID:7716
- C:\Windows\System\ocnelFp.exe
  C:\Windows\System\ocnelFp.exe
  2⤵
  PID:7916
- C:\Windows\System\YWIjupH.exe
  C:\Windows\System\YWIjupH.exe
  2⤵
  PID:7980
- C:\Windows\System\PrNydWa.exe
  C:\Windows\System\PrNydWa.exe
  2⤵
  PID:1380
- C:\Windows\System\jwqipuh.exe
  C:\Windows\System\jwqipuh.exe
  2⤵
  PID:7444
- C:\Windows\System\dkyrfPG.exe
  C:\Windows\System\dkyrfPG.exe
  2⤵
  PID:7292
- C:\Windows\System\eCPvLoR.exe
  C:\Windows\System\eCPvLoR.exe
  2⤵
  PID:4888
- C:\Windows\System\UxUsSVL.exe
  C:\Windows\System\UxUsSVL.exe
  2⤵
  PID:7656
- C:\Windows\System\YWaxXPd.exe
  C:\Windows\System\YWaxXPd.exe
  2⤵
  PID:7928
- C:\Windows\System\nKQPcDX.exe
  C:\Windows\System\nKQPcDX.exe
  2⤵
  PID:7112
- C:\Windows\System\MzgKcYQ.exe
  C:\Windows\System\MzgKcYQ.exe
  2⤵
  PID:7328
- C:\Windows\System\wpUbZYd.exe
  C:\Windows\System\wpUbZYd.exe
  2⤵
  PID:8100
- C:\Windows\System\BwQPgWL.exe
  C:\Windows\System\BwQPgWL.exe
  2⤵
  PID:7900
- C:\Windows\System\BMcjJru.exe
  C:\Windows\System\BMcjJru.exe
  2⤵
  PID:8200
- C:\Windows\System\OVkcLag.exe
  C:\Windows\System\OVkcLag.exe
  2⤵
  PID:8228
- C:\Windows\System\uvKCAlW.exe
  C:\Windows\System\uvKCAlW.exe
  2⤵
  PID:8256
- C:\Windows\System\sFfMUEa.exe
  C:\Windows\System\sFfMUEa.exe
  2⤵
  PID:8288
- C:\Windows\System\YfSUONH.exe
  C:\Windows\System\YfSUONH.exe
  2⤵
  PID:8316
- C:\Windows\System\mMtHVTt.exe
  C:\Windows\System\mMtHVTt.exe
  2⤵
  PID:8352
- C:\Windows\System\BjaPGeN.exe
  C:\Windows\System\BjaPGeN.exe
  2⤵
  PID:8388
- C:\Windows\System\bQGcXjg.exe
  C:\Windows\System\bQGcXjg.exe
  2⤵
  PID:8416
- C:\Windows\System\uCDRSRs.exe
  C:\Windows\System\uCDRSRs.exe
  2⤵
  PID:8468
- C:\Windows\System\ZZqUstz.exe
  C:\Windows\System\ZZqUstz.exe
  2⤵
  PID:8496
- C:\Windows\System\bnTjQwn.exe
  C:\Windows\System\bnTjQwn.exe
  2⤵
  PID:8532
- C:\Windows\System\ZtTxaZB.exe
  C:\Windows\System\ZtTxaZB.exe
  2⤵
  PID:8588
- C:\Windows\System\IKRiNpk.exe
  C:\Windows\System\IKRiNpk.exe
  2⤵
  PID:8628
- C:\Windows\System\ixrLGHQ.exe
  C:\Windows\System\ixrLGHQ.exe
  2⤵
  PID:8660
- C:\Windows\System\YXIIDSe.exe
  C:\Windows\System\YXIIDSe.exe
  2⤵
  PID:8696
- C:\Windows\System\aLluQlV.exe
  C:\Windows\System\aLluQlV.exe
  2⤵
  PID:8720
- C:\Windows\System\EQgFJna.exe
  C:\Windows\System\EQgFJna.exe
  2⤵
  PID:8752
- C:\Windows\System\jgEuDCc.exe
  C:\Windows\System\jgEuDCc.exe
  2⤵
  PID:8780
- C:\Windows\System\cHTXJNs.exe
  C:\Windows\System\cHTXJNs.exe
  2⤵
  PID:8816
- C:\Windows\System\shAZVGb.exe
  C:\Windows\System\shAZVGb.exe
  2⤵
  PID:8840
- C:\Windows\System\WGORFJc.exe
  C:\Windows\System\WGORFJc.exe
  2⤵
  PID:8864
- C:\Windows\System\rAGazAB.exe
  C:\Windows\System\rAGazAB.exe
  2⤵
  PID:8896
- C:\Windows\System\NxdxEnG.exe
  C:\Windows\System\NxdxEnG.exe
  2⤵
  PID:8940
- C:\Windows\System\iESFItZ.exe
  C:\Windows\System\iESFItZ.exe
  2⤵
  PID:8972
- C:\Windows\System\XwGdwXR.exe
  C:\Windows\System\XwGdwXR.exe
  2⤵
  PID:8996
- C:\Windows\System\uZhHXHG.exe
  C:\Windows\System\uZhHXHG.exe
  2⤵
  PID:9024
- C:\Windows\System\gepLFpp.exe
  C:\Windows\System\gepLFpp.exe
  2⤵
  PID:9056
- C:\Windows\System\rbdfoHF.exe
  C:\Windows\System\rbdfoHF.exe
  2⤵
  PID:9092
- C:\Windows\System\GIwosqF.exe
  C:\Windows\System\GIwosqF.exe
  2⤵
  PID:9116
- C:\Windows\System\EuMRsWM.exe
  C:\Windows\System\EuMRsWM.exe
  2⤵
  PID:9152
- C:\Windows\System\WYRuGPg.exe
  C:\Windows\System\WYRuGPg.exe
  2⤵
  PID:9192
- C:\Windows\System\hVgboUX.exe
  C:\Windows\System\hVgboUX.exe
  2⤵
  PID:8196
- C:\Windows\System\TDMtwya.exe
  C:\Windows\System\TDMtwya.exe
  2⤵
  PID:8272
- C:\Windows\System\lICJQFW.exe
  C:\Windows\System\lICJQFW.exe
  2⤵
  PID:8312
- C:\Windows\System\WVOqKxM.exe
  C:\Windows\System\WVOqKxM.exe
  2⤵
  PID:8380
- C:\Windows\System\VUpqrIM.exe
  C:\Windows\System\VUpqrIM.exe
  2⤵
  PID:8516
- C:\Windows\System\hfntHEl.exe
  C:\Windows\System\hfntHEl.exe
  2⤵
  PID:8648
- C:\Windows\System\YamXAIq.exe
  C:\Windows\System\YamXAIq.exe
  2⤵
  PID:8716
- C:\Windows\System\OmOiniy.exe
  C:\Windows\System\OmOiniy.exe
  2⤵
  PID:8772
- C:\Windows\System\WNtbhQO.exe
  C:\Windows\System\WNtbhQO.exe
  2⤵
  PID:8848
- C:\Windows\System\rANDwUW.exe
  C:\Windows\System\rANDwUW.exe
  2⤵
  PID:8980
- C:\Windows\System\FwEerIA.exe
  C:\Windows\System\FwEerIA.exe
  2⤵
  PID:8372
- C:\Windows\System\VqrFncG.exe
  C:\Windows\System\VqrFncG.exe
  2⤵
  PID:9084
- C:\Windows\System\GZghqSn.exe
  C:\Windows\System\GZghqSn.exe
  2⤵
  PID:9164
- C:\Windows\System\NmSOJjn.exe
  C:\Windows\System\NmSOJjn.exe
  2⤵
  PID:9204
- C:\Windows\System\fUfSenY.exe
  C:\Windows\System\fUfSenY.exe
  2⤵
  PID:8284
- C:\Windows\System\DnqSzLP.exe
  C:\Windows\System\DnqSzLP.exe
  2⤵
  PID:8492
- C:\Windows\System\SCsdzgw.exe
  C:\Windows\System\SCsdzgw.exe
  2⤵
  PID:8764
- C:\Windows\System\VfrqlbK.exe
  C:\Windows\System\VfrqlbK.exe
  2⤵
  PID:8920
- C:\Windows\System\BVqWCjz.exe
  C:\Windows\System\BVqWCjz.exe
  2⤵
  PID:9100
- C:\Windows\System\uijbqmm.exe
  C:\Windows\System\uijbqmm.exe
  2⤵
  PID:8244
- C:\Windows\System\xtXcjLN.exe
  C:\Windows\System\xtXcjLN.exe
  2⤵
  PID:8704
- C:\Windows\System\zZxItFu.exe
  C:\Windows\System\zZxItFu.exe
  2⤵
  PID:8800
- C:\Windows\System\TtkRKFM.exe
  C:\Windows\System\TtkRKFM.exe
  2⤵
  PID:8300
- C:\Windows\System\EAZSWMr.exe
  C:\Windows\System\EAZSWMr.exe
  2⤵
  PID:9160
- C:\Windows\System\KqtqZZT.exe
  C:\Windows\System\KqtqZZT.exe
  2⤵
  PID:9020
- C:\Windows\System\XZsXPJC.exe
  C:\Windows\System\XZsXPJC.exe
  2⤵
  PID:9236
- C:\Windows\System\GjUSAGD.exe
  C:\Windows\System\GjUSAGD.exe
  2⤵
  PID:9252
- C:\Windows\System\fDBDvoc.exe
  C:\Windows\System\fDBDvoc.exe
  2⤵
  PID:9280
- C:\Windows\System\zjupdqL.exe
  C:\Windows\System\zjupdqL.exe
  2⤵
  PID:9312
- C:\Windows\System\mfGvyEt.exe
  C:\Windows\System\mfGvyEt.exe
  2⤵
  PID:9340
- C:\Windows\System\gvvjXmP.exe
  C:\Windows\System\gvvjXmP.exe
  2⤵
  PID:9380
- C:\Windows\System\pYYlBkK.exe
  C:\Windows\System\pYYlBkK.exe
  2⤵
  PID:9396
- C:\Windows\System\MAfuzsy.exe
  C:\Windows\System\MAfuzsy.exe
  2⤵
  PID:9424
- C:\Windows\System\VALuaAL.exe
  C:\Windows\System\VALuaAL.exe
  2⤵
  PID:9452
- C:\Windows\System\OJHHDsd.exe
  C:\Windows\System\OJHHDsd.exe
  2⤵
  PID:9480
- C:\Windows\System\UuRBebV.exe
  C:\Windows\System\UuRBebV.exe
  2⤵
  PID:9512
- C:\Windows\System\ntmoknM.exe
  C:\Windows\System\ntmoknM.exe
  2⤵
  PID:9536
- C:\Windows\System\grehHpC.exe
  C:\Windows\System\grehHpC.exe
  2⤵
  PID:9564
- C:\Windows\System\vGlBDBO.exe
  C:\Windows\System\vGlBDBO.exe
  2⤵
  PID:9592
- C:\Windows\System\vpQEkfp.exe
  C:\Windows\System\vpQEkfp.exe
  2⤵
  PID:9624
- C:\Windows\System\cBIWdwl.exe
  C:\Windows\System\cBIWdwl.exe
  2⤵
  PID:9652
- C:\Windows\System\OYIDpPV.exe
  C:\Windows\System\OYIDpPV.exe
  2⤵
  PID:9688
- C:\Windows\System\bHdgrjo.exe
  C:\Windows\System\bHdgrjo.exe
  2⤵
  PID:9708
- C:\Windows\System\sbihcBX.exe
  C:\Windows\System\sbihcBX.exe
  2⤵
  PID:9744
- C:\Windows\System\prFSZrG.exe
  C:\Windows\System\prFSZrG.exe
  2⤵
  PID:9768
- C:\Windows\System\JyeZJYd.exe
  C:\Windows\System\JyeZJYd.exe
  2⤵
  PID:9796
- C:\Windows\System\vHwWGKh.exe
  C:\Windows\System\vHwWGKh.exe
  2⤵
  PID:9824
- C:\Windows\System\ROByboZ.exe
  C:\Windows\System\ROByboZ.exe
  2⤵
  PID:9852
- C:\Windows\System\PHgZWtA.exe
  C:\Windows\System\PHgZWtA.exe
  2⤵
  PID:9880
- C:\Windows\System\vaTSiKw.exe
  C:\Windows\System\vaTSiKw.exe
  2⤵
  PID:9908
- C:\Windows\System\oZyeVOg.exe
  C:\Windows\System\oZyeVOg.exe
  2⤵
  PID:9936
- C:\Windows\System\ORQowTu.exe
  C:\Windows\System\ORQowTu.exe
  2⤵
  PID:9964
- C:\Windows\System\NDeyUBo.exe
  C:\Windows\System\NDeyUBo.exe
  2⤵
  PID:10004
- C:\Windows\System\lmhllgA.exe
  C:\Windows\System\lmhllgA.exe
  2⤵
  PID:10024
- C:\Windows\System\rLXwduD.exe
  C:\Windows\System\rLXwduD.exe
  2⤵
  PID:10056
- C:\Windows\System\FqsdCET.exe
  C:\Windows\System\FqsdCET.exe
  2⤵
  PID:10084
- C:\Windows\System\jHhRTZb.exe
  C:\Windows\System\jHhRTZb.exe
  2⤵
  PID:10108
- C:\Windows\System\kOpXUSb.exe
  C:\Windows\System\kOpXUSb.exe
  2⤵
  PID:10132
- C:\Windows\System\NfXUEGh.exe
  C:\Windows\System\NfXUEGh.exe
  2⤵
  PID:10168
- C:\Windows\System\VUxnBhz.exe
  C:\Windows\System\VUxnBhz.exe
  2⤵
  PID:10192
- C:\Windows\System\OvYXbCH.exe
  C:\Windows\System\OvYXbCH.exe
  2⤵
  PID:10212
- C:\Windows\System\zxSkAYU.exe
  C:\Windows\System\zxSkAYU.exe
  2⤵
  PID:9184
- C:\Windows\System\rocZUUZ.exe
  C:\Windows\System\rocZUUZ.exe
  2⤵
  PID:9304
- C:\Windows\System\CNdVRRn.exe
  C:\Windows\System\CNdVRRn.exe
  2⤵
  PID:9352
- C:\Windows\System\AClMXZM.exe
  C:\Windows\System\AClMXZM.exe
  2⤵
  PID:9412
- C:\Windows\System\wyGwaLz.exe
  C:\Windows\System\wyGwaLz.exe
  2⤵
  PID:9472
- C:\Windows\System\VnsCYPP.exe
  C:\Windows\System\VnsCYPP.exe
  2⤵
  PID:9504
- C:\Windows\System\vCfvcCO.exe
  C:\Windows\System\vCfvcCO.exe
  2⤵
  PID:9604
- C:\Windows\System\mtNTrlf.exe
  C:\Windows\System\mtNTrlf.exe
  2⤵
  PID:9648
- C:\Windows\System\JlQUAkH.exe
  C:\Windows\System\JlQUAkH.exe
  2⤵
  PID:9720
- C:\Windows\System\CJCdUDo.exe
  C:\Windows\System\CJCdUDo.exe
  2⤵
  PID:9780
- C:\Windows\System\wEjrGay.exe
  C:\Windows\System\wEjrGay.exe
  2⤵
  PID:9876
- C:\Windows\System\xWHyWRc.exe
  C:\Windows\System\xWHyWRc.exe
  2⤵
  PID:9948
- C:\Windows\System\JPYOjXo.exe
  C:\Windows\System\JPYOjXo.exe
  2⤵
  PID:9984
- C:\Windows\System\hnJMCgs.exe
  C:\Windows\System\hnJMCgs.exe
  2⤵
  PID:3456
- C:\Windows\System\crOPhuX.exe
  C:\Windows\System\crOPhuX.exe
  2⤵
  PID:10092
- C:\Windows\System\qmiSLTc.exe
  C:\Windows\System\qmiSLTc.exe
  2⤵
  PID:10176
- C:\Windows\System\kCflMfl.exe
  C:\Windows\System\kCflMfl.exe
  2⤵
  PID:5832
- C:\Windows\System\zQxQvRU.exe
  C:\Windows\System\zQxQvRU.exe
  2⤵
  PID:5848
- C:\Windows\System\DDkJDnD.exe
  C:\Windows\System\DDkJDnD.exe
  2⤵
  PID:9500
- C:\Windows\System\bIJzdjq.exe
  C:\Windows\System\bIJzdjq.exe
  2⤵
  PID:9548
- C:\Windows\System\hEVDfyM.exe
  C:\Windows\System\hEVDfyM.exe
  2⤵
  PID:3500
- C:\Windows\System\TQHxocz.exe
  C:\Windows\System\TQHxocz.exe
  2⤵
  PID:9616
- C:\Windows\System\TpOuGIj.exe
  C:\Windows\System\TpOuGIj.exe
  2⤵
  PID:9808
- C:\Windows\System\oPSDZQE.exe
  C:\Windows\System\oPSDZQE.exe
  2⤵
  PID:9976
- C:\Windows\System\BTTDhfc.exe
  C:\Windows\System\BTTDhfc.exe
  2⤵
  PID:10164
- C:\Windows\System\ZJJYXcb.exe
  C:\Windows\System\ZJJYXcb.exe
  2⤵
  PID:1816
- C:\Windows\System\FJOidtQ.exe
  C:\Windows\System\FJOidtQ.exe
  2⤵
  PID:10232
- C:\Windows\System\gNUyjaD.exe
  C:\Windows\System\gNUyjaD.exe
  2⤵
  PID:100
- C:\Windows\System\WooLbDX.exe
  C:\Windows\System\WooLbDX.exe
  2⤵
  PID:1712
- C:\Windows\System\fGaIDUl.exe
  C:\Windows\System\fGaIDUl.exe
  2⤵
  PID:6020
- C:\Windows\System\VRRzWVO.exe
  C:\Windows\System\VRRzWVO.exe
  2⤵
  PID:2816
- C:\Windows\System\mWzNCNN.exe
  C:\Windows\System\mWzNCNN.exe
  2⤵
  PID:9812
- C:\Windows\System\IodMYEd.exe
  C:\Windows\System\IodMYEd.exe
  2⤵
  PID:10180
- C:\Windows\System\jgdtbnj.exe
  C:\Windows\System\jgdtbnj.exe
  2⤵
  PID:5456
- C:\Windows\System\nOIuPly.exe
  C:\Windows\System\nOIuPly.exe
  2⤵
  PID:5680
- C:\Windows\System\VACaqfq.exe
  C:\Windows\System\VACaqfq.exe
  2⤵
  PID:5892
- C:\Windows\System\xeEgBSU.exe
  C:\Windows\System\xeEgBSU.exe
  2⤵
  PID:1620
- C:\Windows\System\vTIMVqV.exe
  C:\Windows\System\vTIMVqV.exe
  2⤵
  PID:5900
- C:\Windows\System\QWYsZjX.exe
  C:\Windows\System\QWYsZjX.exe
  2⤵
  PID:5256
- C:\Windows\System\OWmWrjV.exe
  C:\Windows\System\OWmWrjV.exe
  2⤵
  PID:4220
- C:\Windows\System\vGxGUcz.exe
  C:\Windows\System\vGxGUcz.exe
  2⤵
  PID:6092
- C:\Windows\System\aZgTiec.exe
  C:\Windows\System\aZgTiec.exe
  2⤵
  PID:10068
- C:\Windows\System\lqkpBHA.exe
  C:\Windows\System\lqkpBHA.exe
  2⤵
  PID:4444
- C:\Windows\System\MTqmlSI.exe
  C:\Windows\System\MTqmlSI.exe
  2⤵
  PID:548
- C:\Windows\System\DxkQHRV.exe
  C:\Windows\System\DxkQHRV.exe
  2⤵
  PID:4336
- C:\Windows\System\dHXZOUG.exe
  C:\Windows\System\dHXZOUG.exe
  2⤵
  PID:4688
- C:\Windows\System\kEFIgvF.exe
  C:\Windows\System\kEFIgvF.exe
  2⤵
  PID:808
- C:\Windows\System\JapvTAD.exe
  C:\Windows\System\JapvTAD.exe
  2⤵
  PID:4832
- C:\Windows\System\Nucaqxc.exe
  C:\Windows\System\Nucaqxc.exe
  2⤵
  PID:5840
- C:\Windows\System\rtAbXbE.exe
  C:\Windows\System\rtAbXbE.exe
  2⤵
  PID:9272
- C:\Windows\System\HPzTmPv.exe
  C:\Windows\System\HPzTmPv.exe
  2⤵
  PID:1344
- C:\Windows\System\LLTdQrV.exe
  C:\Windows\System\LLTdQrV.exe
  2⤵
  PID:1496
- C:\Windows\System\XecPMwm.exe
  C:\Windows\System\XecPMwm.exe
  2⤵
  PID:2088
- C:\Windows\System\WrREgXI.exe
  C:\Windows\System\WrREgXI.exe
  2⤵
  PID:5720
- C:\Windows\System\DrkSgIy.exe
  C:\Windows\System\DrkSgIy.exe
  2⤵
  PID:3340
- C:\Windows\System\OCKTOYB.exe
  C:\Windows\System\OCKTOYB.exe
  2⤵
  PID:3392
- C:\Windows\System\GFpPSGR.exe
  C:\Windows\System\GFpPSGR.exe
  2⤵
  PID:4264
- C:\Windows\System\yWzYcFD.exe
  C:\Windows\System\yWzYcFD.exe
  2⤵
  PID:3216
- C:\Windows\System\rZogvKw.exe
  C:\Windows\System\rZogvKw.exe
  2⤵
  PID:2512
- C:\Windows\System\OtsmrTo.exe
  C:\Windows\System\OtsmrTo.exe
  2⤵
  PID:540
- C:\Windows\System\NqGMnKh.exe
  C:\Windows\System\NqGMnKh.exe
  2⤵
  PID:3472
- C:\Windows\System\sXKYiKB.exe
  C:\Windows\System\sXKYiKB.exe
  2⤵
  PID:3548
- C:\Windows\System\QCoTpYe.exe
  C:\Windows\System\QCoTpYe.exe
  2⤵
  PID:10228
- C:\Windows\System\uVceZNB.exe
  C:\Windows\System\uVceZNB.exe
  2⤵
  PID:10208
- C:\Windows\System\KSYmaQE.exe
  C:\Windows\System\KSYmaQE.exe
  2⤵
  PID:1704
- C:\Windows\System\deMRQIl.exe
  C:\Windows\System\deMRQIl.exe
  2⤵
  PID:6032
- C:\Windows\System\ermMbDB.exe
  C:\Windows\System\ermMbDB.exe
  2⤵
  PID:6008
- C:\Windows\System\UYSeqrH.exe
  C:\Windows\System\UYSeqrH.exe
  2⤵
  PID:3520
- C:\Windows\System\prtVDxo.exe
  C:\Windows\System\prtVDxo.exe
  2⤵
  PID:2184
- C:\Windows\System\nsYHQRk.exe
  C:\Windows\System\nsYHQRk.exe
  2⤵
  PID:7892
- C:\Windows\System\aUclDJy.exe
  C:\Windows\System\aUclDJy.exe
  2⤵
  PID:4396
- C:\Windows\System\okWHpXS.exe
  C:\Windows\System\okWHpXS.exe
  2⤵
  PID:8452
- C:\Windows\System\redkSer.exe
  C:\Windows\System\redkSer.exe
  2⤵
  PID:8916
- C:\Windows\System\nvpYdMq.exe
  C:\Windows\System\nvpYdMq.exe
  2⤵
  PID:4932
- C:\Windows\System\KHuWJXR.exe
  C:\Windows\System\KHuWJXR.exe
  2⤵
  PID:1744
- C:\Windows\System\SIYCbFU.exe
  C:\Windows\System\SIYCbFU.exe
  2⤵
  PID:5036
- C:\Windows\System\ZhAdwzq.exe
  C:\Windows\System\ZhAdwzq.exe
  2⤵
  PID:624
- C:\Windows\System\nEbqjUX.exe
  C:\Windows\System\nEbqjUX.exe
  2⤵
  PID:660
- C:\Windows\System\EIpnEJi.exe
  C:\Windows\System\EIpnEJi.exe
  2⤵
  PID:1428
- C:\Windows\System\fkRpuZd.exe
  C:\Windows\System\fkRpuZd.exe
  2⤵
  PID:2560
- C:\Windows\System\pWUCbpA.exe
  C:\Windows\System\pWUCbpA.exe
  2⤵
  PID:3628
- C:\Windows\System\iAzHABq.exe
  C:\Windows\System\iAzHABq.exe
  2⤵
  PID:3952
- C:\Windows\System\fZHPtYU.exe
  C:\Windows\System\fZHPtYU.exe
  2⤵
  PID:6124
- C:\Windows\System\HqlZTYJ.exe
  C:\Windows\System\HqlZTYJ.exe
  2⤵
  PID:1124
- C:\Windows\System\ZIdDDNR.exe
  C:\Windows\System\ZIdDDNR.exe
  2⤵
  PID:10264
- C:\Windows\System\ZOxXdtC.exe
  C:\Windows\System\ZOxXdtC.exe
  2⤵
  PID:10308
- C:\Windows\System\TJQvGXK.exe
  C:\Windows\System\TJQvGXK.exe
  2⤵
  PID:10324
- C:\Windows\System\AkTxeJf.exe
  C:\Windows\System\AkTxeJf.exe
  2⤵
  PID:10348
- C:\Windows\System\mIITOck.exe
  C:\Windows\System\mIITOck.exe
  2⤵
  PID:10392
- C:\Windows\System\VgJEAFT.exe
  C:\Windows\System\VgJEAFT.exe
  2⤵
  PID:10428
- C:\Windows\System\DfdEnLw.exe
  C:\Windows\System\DfdEnLw.exe
  2⤵
  PID:10464
- C:\Windows\System\FQqgoNk.exe
  C:\Windows\System\FQqgoNk.exe
  2⤵
  PID:10492
- C:\Windows\System\hBShNBi.exe
  C:\Windows\System\hBShNBi.exe
  2⤵
  PID:10520
- C:\Windows\System\oriKpBq.exe
  C:\Windows\System\oriKpBq.exe
  2⤵
  PID:10548
- C:\Windows\System\SrEocoW.exe
  C:\Windows\System\SrEocoW.exe
  2⤵
  PID:10576
- C:\Windows\System\KfPLtYr.exe
  C:\Windows\System\KfPLtYr.exe
  2⤵
  PID:10604
- C:\Windows\System\taWegVu.exe
  C:\Windows\System\taWegVu.exe
  2⤵
  PID:10640
- C:\Windows\System\Jwvhvmq.exe
  C:\Windows\System\Jwvhvmq.exe
  2⤵
  PID:10672
- C:\Windows\System\iJnegFK.exe
  C:\Windows\System\iJnegFK.exe
  2⤵
  PID:10688
- C:\Windows\System\RooDlxs.exe
  C:\Windows\System\RooDlxs.exe
  2⤵
  PID:10716
- C:\Windows\System\ONuZzsc.exe
  C:\Windows\System\ONuZzsc.exe
  2⤵
  PID:10744
- C:\Windows\System\AXvBqky.exe
  C:\Windows\System\AXvBqky.exe
  2⤵
  PID:10772
- C:\Windows\System\ixuNMNB.exe
  C:\Windows\System\ixuNMNB.exe
  2⤵
  PID:10800
- C:\Windows\System\DrlAhyK.exe
  C:\Windows\System\DrlAhyK.exe
  2⤵
  PID:10828
- C:\Windows\System\INAYKdy.exe
  C:\Windows\System\INAYKdy.exe
  2⤵
  PID:10856
- C:\Windows\System\YPvbxEf.exe
  C:\Windows\System\YPvbxEf.exe
  2⤵
  PID:10884
- C:\Windows\System\gopcNUk.exe
  C:\Windows\System\gopcNUk.exe
  2⤵
  PID:10924
- C:\Windows\System\alvvRzN.exe
  C:\Windows\System\alvvRzN.exe
  2⤵
  PID:10940
- C:\Windows\System\xoxdwDg.exe
  C:\Windows\System\xoxdwDg.exe
  2⤵
  PID:10968
- C:\Windows\System\NSGADuT.exe
  C:\Windows\System\NSGADuT.exe
  2⤵
  PID:11004
- C:\Windows\System\ixTMVww.exe
  C:\Windows\System\ixTMVww.exe
  2⤵
  PID:11024
- C:\Windows\System\qMXqASf.exe
  C:\Windows\System\qMXqASf.exe
  2⤵
  PID:11052
- C:\Windows\System\cHArUUV.exe
  C:\Windows\System\cHArUUV.exe
  2⤵
  PID:11080
- C:\Windows\System\lYLkpjt.exe
  C:\Windows\System\lYLkpjt.exe
  2⤵
  PID:11116
- C:\Windows\System\aSHfYdV.exe
  C:\Windows\System\aSHfYdV.exe
  2⤵
  PID:11140
- C:\Windows\System\uztXzTj.exe
  C:\Windows\System\uztXzTj.exe
  2⤵
  PID:11164
- C:\Windows\System\vtDnazX.exe
  C:\Windows\System\vtDnazX.exe
  2⤵
  PID:11192
- C:\Windows\System\JAGJLxT.exe
  C:\Windows\System\JAGJLxT.exe
  2⤵
  PID:11224
- C:\Windows\System\iscJkqj.exe
  C:\Windows\System\iscJkqj.exe
  2⤵
  PID:11256
- C:\Windows\System\dUkmezu.exe
  C:\Windows\System\dUkmezu.exe
  2⤵
  PID:4104
- C:\Windows\System\OsIVHNc.exe
  C:\Windows\System\OsIVHNc.exe
  2⤵
  PID:10288
- C:\Windows\System\MqrhwXc.exe
  C:\Windows\System\MqrhwXc.exe
  2⤵
  PID:10320
- C:\Windows\System\VaaiCEg.exe
  C:\Windows\System\VaaiCEg.exe
  2⤵
  PID:10380
- C:\Windows\System\gwycbPq.exe
  C:\Windows\System\gwycbPq.exe
  2⤵
  PID:3616
- C:\Windows\System\LxYwkCX.exe
  C:\Windows\System\LxYwkCX.exe
  2⤵
  PID:5240
- C:\Windows\System\vFKrgaP.exe
  C:\Windows\System\vFKrgaP.exe
  2⤵
  PID:10488
- C:\Windows\System\SIotaQD.exe
  C:\Windows\System\SIotaQD.exe
  2⤵
  PID:10540
- C:\Windows\System\aRaUVou.exe
  C:\Windows\System\aRaUVou.exe
  2⤵
  PID:10588
- C:\Windows\System\JzKMPzW.exe
  C:\Windows\System\JzKMPzW.exe
  2⤵
  PID:5292
- C:\Windows\System\aoMvRiG.exe
  C:\Windows\System\aoMvRiG.exe
  2⤵
  PID:10700
- C:\Windows\System\jEGCrSj.exe
  C:\Windows\System\jEGCrSj.exe
  2⤵
  PID:10736
- C:\Windows\System\syWaqME.exe
  C:\Windows\System\syWaqME.exe
  2⤵
  PID:10792
- C:\Windows\System\uaSCuLI.exe
  C:\Windows\System\uaSCuLI.exe
  2⤵
  PID:10852
- C:\Windows\System\MTNQivs.exe
  C:\Windows\System\MTNQivs.exe
  2⤵
  PID:10900
- C:\Windows\System\ISkpXiw.exe
  C:\Windows\System\ISkpXiw.exe
  2⤵
  PID:10952
- C:\Windows\System\uBuGXEs.exe
  C:\Windows\System\uBuGXEs.exe
  2⤵
  PID:10992
- C:\Windows\System\fwiNJys.exe
  C:\Windows\System\fwiNJys.exe
  2⤵
  PID:11044
- C:\Windows\System\WWbAnUf.exe
  C:\Windows\System\WWbAnUf.exe
  2⤵
  PID:5476
- C:\Windows\System\GFOhxwA.exe
  C:\Windows\System\GFOhxwA.exe
  2⤵
  PID:11148
- C:\Windows\System\tCNYGfW.exe
  C:\Windows\System\tCNYGfW.exe
  2⤵
  PID:5512
- C:\Windows\System\YdGrEXA.exe
  C:\Windows\System\YdGrEXA.exe
  2⤵
  PID:2944
- C:\Windows\System\wIPHjIO.exe
  C:\Windows\System\wIPHjIO.exe
  2⤵
  PID:10260
- C:\Windows\System\MVvkHLW.exe
  C:\Windows\System\MVvkHLW.exe
  2⤵
  PID:10404
- C:\Windows\System\wRVkJIV.exe
  C:\Windows\System\wRVkJIV.exe
  2⤵
  PID:10476
- C:\Windows\System\FDQonRm.exe
  C:\Windows\System\FDQonRm.exe
  2⤵
  PID:5260
- C:\Windows\System\bMkbyEJ.exe
  C:\Windows\System\bMkbyEJ.exe
  2⤵
  PID:10648
- C:\Windows\System\MlbRuwj.exe
  C:\Windows\System\MlbRuwj.exe
  2⤵
  PID:10728
- C:\Windows\System\ZkKduXy.exe
  C:\Windows\System\ZkKduXy.exe
  2⤵
  PID:10824
- C:\Windows\System\SFWvenb.exe
  C:\Windows\System\SFWvenb.exe
  2⤵
  PID:10932
- C:\Windows\System\oBBjROd.exe
  C:\Windows\System\oBBjROd.exe
  2⤵
  PID:11020
- C:\Windows\System\JZOcGFe.exe
  C:\Windows\System\JZOcGFe.exe
  2⤵
  PID:5496
- C:\Windows\System\cyKqCGK.exe
  C:\Windows\System\cyKqCGK.exe
  2⤵
  PID:5792
- C:\Windows\System\RygZYKe.exe
  C:\Windows\System\RygZYKe.exe
  2⤵
  PID:5156
- C:\Windows\System\cMByuQZ.exe
  C:\Windows\System\cMByuQZ.exe
  2⤵
  PID:10460
- C:\Windows\System\JfmirNI.exe
  C:\Windows\System\JfmirNI.exe
  2⤵
  PID:5620
- C:\Windows\System\UqIKnaL.exe
  C:\Windows\System\UqIKnaL.exe
  2⤵
  PID:10668
- C:\Windows\System\pJNjlrK.exe
  C:\Windows\System\pJNjlrK.exe
  2⤵
  PID:10880
- C:\Windows\System\yqfOWDG.exe
  C:\Windows\System\yqfOWDG.exe
  2⤵
  PID:5952
- C:\Windows\System\NlPGYmc.exe
  C:\Windows\System\NlPGYmc.exe
  2⤵
  PID:11220
- C:\Windows\System\CekFeXw.exe
  C:\Windows\System\CekFeXw.exe
  2⤵
  PID:5988
- C:\Windows\System\ZfgVABw.exe
  C:\Windows\System\ZfgVABw.exe
  2⤵
  PID:10708
- C:\Windows\System\hwsNBzF.exe
  C:\Windows\System\hwsNBzF.exe
  2⤵
  PID:10360
- C:\Windows\System\BbTuASS.exe
  C:\Windows\System\BbTuASS.exe
  2⤵
  PID:6072
- C:\Windows\System\wwippgT.exe
  C:\Windows\System\wwippgT.exe
  2⤵
  PID:11272
- C:\Windows\System\AnBdgxQ.exe
  C:\Windows\System\AnBdgxQ.exe
  2⤵
  PID:11304
- C:\Windows\System\HZzQBOW.exe
  C:\Windows\System\HZzQBOW.exe
  2⤵
  PID:11332
- C:\Windows\System\HBIXApy.exe
  C:\Windows\System\HBIXApy.exe
  2⤵
  PID:11360
- C:\Windows\System\nRRtyRa.exe
  C:\Windows\System\nRRtyRa.exe
  2⤵
  PID:11388
- C:\Windows\System\Adfghwq.exe
  C:\Windows\System\Adfghwq.exe
  2⤵
  PID:11420
- C:\Windows\System\JqKUxsl.exe
  C:\Windows\System\JqKUxsl.exe
  2⤵
  PID:11448
- C:\Windows\System\XFEibpX.exe
  C:\Windows\System\XFEibpX.exe
  2⤵
  PID:11476
- C:\Windows\System\XTcNZdr.exe
  C:\Windows\System\XTcNZdr.exe
  2⤵
  PID:11504
- C:\Windows\System\ftYQvNQ.exe
  C:\Windows\System\ftYQvNQ.exe
  2⤵
  PID:11532
- C:\Windows\System\JSviGsD.exe
  C:\Windows\System\JSviGsD.exe
  2⤵
  PID:11560
- C:\Windows\System\DWBuKXF.exe
  C:\Windows\System\DWBuKXF.exe
  2⤵
  PID:11588
- C:\Windows\System\ssfcghT.exe
  C:\Windows\System\ssfcghT.exe
  2⤵
  PID:11616
- C:\Windows\System\hDtNCpn.exe
  C:\Windows\System\hDtNCpn.exe
  2⤵
  PID:11644
- C:\Windows\System\FumHXcb.exe
  C:\Windows\System\FumHXcb.exe
  2⤵
  PID:11672
- C:\Windows\System\lzkiAIb.exe
  C:\Windows\System\lzkiAIb.exe
  2⤵
  PID:11704
- C:\Windows\System\kDDlaSv.exe
  C:\Windows\System\kDDlaSv.exe
  2⤵
  PID:11728
- C:\Windows\System\ENXSaic.exe
  C:\Windows\System\ENXSaic.exe
  2⤵
  PID:11756
- C:\Windows\System\weheImG.exe
  C:\Windows\System\weheImG.exe
  2⤵
  PID:11784
- C:\Windows\System\gecphDS.exe
  C:\Windows\System\gecphDS.exe
  2⤵
  PID:11812
- C:\Windows\System\ozDgFXy.exe
  C:\Windows\System\ozDgFXy.exe
  2⤵
  PID:11840
- C:\Windows\System\UseZhLZ.exe
  C:\Windows\System\UseZhLZ.exe
  2⤵
  PID:11868
- C:\Windows\System\UKaPATu.exe
  C:\Windows\System\UKaPATu.exe
  2⤵
  PID:11896
- C:\Windows\System\gxpIMOE.exe
  C:\Windows\System\gxpIMOE.exe
  2⤵
  PID:11924
- C:\Windows\System\pjkHYpC.exe
  C:\Windows\System\pjkHYpC.exe
  2⤵
  PID:11952
- C:\Windows\System\JZAvwOo.exe
  C:\Windows\System\JZAvwOo.exe
  2⤵
  PID:11976
- C:\Windows\System\HdkFIyq.exe
  C:\Windows\System\HdkFIyq.exe
  2⤵
  PID:11996
- C:\Windows\System\aOPXcKl.exe
  C:\Windows\System\aOPXcKl.exe
  2⤵
  PID:12036
- C:\Windows\System\ajSlQXL.exe
  C:\Windows\System\ajSlQXL.exe
  2⤵
  PID:12076
- C:\Windows\System\tNXoJzh.exe
  C:\Windows\System\tNXoJzh.exe
  2⤵
  PID:12092
- C:\Windows\System\ZTziCBE.exe
  C:\Windows\System\ZTziCBE.exe
  2⤵
  PID:12120
- C:\Windows\System\IzzaqdU.exe
  C:\Windows\System\IzzaqdU.exe
  2⤵
  PID:12152
- C:\Windows\System\ShevrrC.exe
  C:\Windows\System\ShevrrC.exe
  2⤵
  PID:12180
- C:\Windows\System\kPYSQcU.exe
  C:\Windows\System\kPYSQcU.exe
  2⤵
  PID:12208
- C:\Windows\System\fcUDrBf.exe
  C:\Windows\System\fcUDrBf.exe
  2⤵
  PID:12248
- C:\Windows\System\NwbBzmv.exe
  C:\Windows\System\NwbBzmv.exe
  2⤵
  PID:12272
- C:\Windows\System\dtGMiNr.exe
  C:\Windows\System\dtGMiNr.exe
  2⤵
  PID:11268
- C:\Windows\System\fRrHgAr.exe
  C:\Windows\System\fRrHgAr.exe
  2⤵
  PID:1964
- C:\Windows\System\YQqmdVZ.exe
  C:\Windows\System\YQqmdVZ.exe
  2⤵
  PID:6116
- C:\Windows\System\uNcbNFD.exe
  C:\Windows\System\uNcbNFD.exe
  2⤵
  PID:4248
- C:\Windows\System\vwmOQSd.exe
  C:\Windows\System\vwmOQSd.exe
  2⤵
  PID:11416
- C:\Windows\System\FDZcuvN.exe
  C:\Windows\System\FDZcuvN.exe
  2⤵
  PID:11464
- C:\Windows\System\uhVOaUs.exe
  C:\Windows\System\uhVOaUs.exe
  2⤵
  PID:11528
- C:\Windows\System\uWBmDbk.exe
  C:\Windows\System\uWBmDbk.exe
  2⤵
  PID:11580
- C:\Windows\System\SkzitiJ.exe
  C:\Windows\System\SkzitiJ.exe
  2⤵
  PID:11640
- C:\Windows\System\njBnLbR.exe
  C:\Windows\System\njBnLbR.exe
  2⤵
  PID:11720
- C:\Windows\System\PFFoZEa.exe
  C:\Windows\System\PFFoZEa.exe
  2⤵
  PID:5168
- C:\Windows\System\mQNpqZn.exe
  C:\Windows\System\mQNpqZn.exe
  2⤵
  PID:5300
- C:\Windows\System\uuFqSkx.exe
  C:\Windows\System\uuFqSkx.exe
  2⤵
  PID:11808
- C:\Windows\System\zJNJHKs.exe
  C:\Windows\System\zJNJHKs.exe
  2⤵
  PID:11860
- C:\Windows\System\ADnDzzQ.exe
  C:\Windows\System\ADnDzzQ.exe
  2⤵
  PID:11920
- C:\Windows\System\PZXTDZc.exe
  C:\Windows\System\PZXTDZc.exe
  2⤵
  PID:11992
- C:\Windows\System\unyeQMA.exe
  C:\Windows\System\unyeQMA.exe
  2⤵
  PID:12052
- C:\Windows\System\TkxvGXh.exe
  C:\Windows\System\TkxvGXh.exe
  2⤵
  PID:12116
- C:\Windows\System\CMIBRxE.exe
  C:\Windows\System\CMIBRxE.exe
  2⤵
  PID:12176
- C:\Windows\System\ERYHTbf.exe
  C:\Windows\System\ERYHTbf.exe
  2⤵
  PID:12256
- C:\Windows\System\eBpuGVn.exe
  C:\Windows\System\eBpuGVn.exe
  2⤵
  PID:11296
- C:\Windows\System\OGOQYZF.exe
  C:\Windows\System\OGOQYZF.exe
  2⤵
  PID:11372
- C:\Windows\System\oPCSCmT.exe
  C:\Windows\System\oPCSCmT.exe
  2⤵
  PID:11524
- C:\Windows\System\nnSJodT.exe
  C:\Windows\System\nnSJodT.exe
  2⤵
  PID:11684
- C:\Windows\System\TAORruZ.exe
  C:\Windows\System\TAORruZ.exe
  2⤵
  PID:11752
- C:\Windows\System\ThpZULx.exe
  C:\Windows\System\ThpZULx.exe
  2⤵
  PID:5336
- C:\Windows\System\jFdbiqn.exe
  C:\Windows\System\jFdbiqn.exe
  2⤵
  PID:11892
- C:\Windows\System\ZzlQauR.exe
  C:\Windows\System\ZzlQauR.exe
  2⤵
  PID:12028
- C:\Windows\System\uQgIuCU.exe
  C:\Windows\System\uQgIuCU.exe
  2⤵
  PID:12172
- C:\Windows\System\fzrVrPU.exe
  C:\Windows\System\fzrVrPU.exe
  2⤵
  PID:11312
- C:\Windows\System\xBFvHoV.exe
  C:\Windows\System\xBFvHoV.exe
  2⤵
  PID:11668
- C:\Windows\System\rNKaMEE.exe
  C:\Windows\System\rNKaMEE.exe
  2⤵
  PID:11984
- C:\Windows\System\FxGgFRO.exe
  C:\Windows\System\FxGgFRO.exe
  2⤵
  PID:11444
- C:\Windows\System\rVNFlaU.exe
  C:\Windows\System\rVNFlaU.exe
  2⤵
  PID:11948
- C:\Windows\System\EZoCWfg.exe
  C:\Windows\System\EZoCWfg.exe
  2⤵
  PID:12232
- C:\Windows\System\IkZAEix.exe
  C:\Windows\System\IkZAEix.exe
  2⤵
  PID:12308
- C:\Windows\System\vVYoDiH.exe
  C:\Windows\System\vVYoDiH.exe
  2⤵
  PID:12336
- C:\Windows\System\ugkjBPD.exe
  C:\Windows\System\ugkjBPD.exe
  2⤵
  PID:12364
- C:\Windows\System\pFZIgCP.exe
  C:\Windows\System\pFZIgCP.exe
  2⤵
  PID:12392
- C:\Windows\System\yYjoYgQ.exe
  C:\Windows\System\yYjoYgQ.exe
  2⤵
  PID:12428
- C:\Windows\System\qRkKijf.exe
  C:\Windows\System\qRkKijf.exe
  2⤵
  PID:12448
- C:\Windows\System\cPhlcEb.exe
  C:\Windows\System\cPhlcEb.exe
  2⤵
  PID:12476
- C:\Windows\System\JsNziYz.exe
  C:\Windows\System\JsNziYz.exe
  2⤵
  PID:12504
- C:\Windows\System\RfjIfHE.exe
  C:\Windows\System\RfjIfHE.exe
  2⤵
  PID:12536
- C:\Windows\System\IbZcyKM.exe
  C:\Windows\System\IbZcyKM.exe
  2⤵
  PID:12564
- C:\Windows\System\KkQkJBl.exe
  C:\Windows\System\KkQkJBl.exe
  2⤵
  PID:12604
- C:\Windows\System\gjZxAPw.exe
  C:\Windows\System\gjZxAPw.exe
  2⤵
  PID:12620
- C:\Windows\System\RwICiyL.exe
  C:\Windows\System\RwICiyL.exe
  2⤵
  PID:12648
- C:\Windows\System\HJwirai.exe
  C:\Windows\System\HJwirai.exe
  2⤵
  PID:12676
- C:\Windows\System\qYUiATj.exe
  C:\Windows\System\qYUiATj.exe
  2⤵
  PID:12712
- C:\Windows\System\PRVWZNT.exe
  C:\Windows\System\PRVWZNT.exe
  2⤵
  PID:12732
- C:\Windows\System\ffOIYwT.exe
  C:\Windows\System\ffOIYwT.exe
  2⤵
  PID:12772
- C:\Windows\System\AexfNCj.exe
  C:\Windows\System\AexfNCj.exe
  2⤵
  PID:12788
- C:\Windows\System\gwqNaeF.exe
  C:\Windows\System\gwqNaeF.exe
  2⤵
  PID:12820
- C:\Windows\System\wTsqvKg.exe
  C:\Windows\System\wTsqvKg.exe
  2⤵
  PID:12844
- C:\Windows\System\eclffvF.exe
  C:\Windows\System\eclffvF.exe
  2⤵
  PID:12872
- C:\Windows\System\sQUZerw.exe
  C:\Windows\System\sQUZerw.exe
  2⤵
  PID:12912
- C:\Windows\System\VashkGz.exe
  C:\Windows\System\VashkGz.exe
  2⤵
  PID:12928
- C:\Windows\System\feiSBIl.exe
  C:\Windows\System\feiSBIl.exe
  2⤵
  PID:12948
- C:\Windows\System\nsZCMnJ.exe
  C:\Windows\System\nsZCMnJ.exe
  2⤵
  PID:12980
- C:\Windows\System\rXRUcLm.exe
  C:\Windows\System\rXRUcLm.exe
  2⤵
  PID:13024
- C:\Windows\System\TOMpJyo.exe
  C:\Windows\System\TOMpJyo.exe
  2⤵
  PID:13040
- C:\Windows\System\SLxBSHn.exe
  C:\Windows\System\SLxBSHn.exe
  2⤵
  PID:13072
- C:\Windows\System\QCfzXTQ.exe
  C:\Windows\System\QCfzXTQ.exe
  2⤵
  PID:13112
- C:\Windows\System\paRhNns.exe
  C:\Windows\System\paRhNns.exe
  2⤵
  PID:13128
- C:\Windows\System\pzvKUlk.exe
  C:\Windows\System\pzvKUlk.exe
  2⤵
  PID:13156
- C:\Windows\System\dvcMwpp.exe
  C:\Windows\System\dvcMwpp.exe
  2⤵
  PID:13184
- C:\Windows\System\GPbMnWJ.exe
  C:\Windows\System\GPbMnWJ.exe
  2⤵
  PID:13212
- C:\Windows\System\QOuuoMa.exe
  C:\Windows\System\QOuuoMa.exe
  2⤵
  PID:13240
- C:\Windows\System\afvUPwO.exe
  C:\Windows\System\afvUPwO.exe
  2⤵
  PID:13276
- C:\Windows\System\tlklgUS.exe
  C:\Windows\System\tlklgUS.exe
  2⤵
  PID:13296
- C:\Windows\System\HjHhrtn.exe
  C:\Windows\System\HjHhrtn.exe
  2⤵
  PID:12324
- C:\Windows\System\FdfblIM.exe
  C:\Windows\System\FdfblIM.exe
  2⤵
  PID:12376
- C:\Windows\System\IwUHhUV.exe
  C:\Windows\System\IwUHhUV.exe
  2⤵
  PID:12444
- C:\Windows\System\mduDIDN.exe
  C:\Windows\System\mduDIDN.exe
  2⤵
  PID:12488
- C:\Windows\System\MgRdIWi.exe
  C:\Windows\System\MgRdIWi.exe
  2⤵
  PID:12528
- C:\Windows\System\xFpMyLx.exe
  C:\Windows\System\xFpMyLx.exe
  2⤵
  PID:12584
- C:\Windows\System\RetDgdA.exe
  C:\Windows\System\RetDgdA.exe
  2⤵
  PID:12612
- C:\Windows\System\UnWrQNi.exe
  C:\Windows\System\UnWrQNi.exe
  2⤵
  PID:3904
- C:\Windows\System\WlNLRvH.exe
  C:\Windows\System\WlNLRvH.exe
  2⤵
  PID:12672
- C:\Windows\System\AKodFqJ.exe
  C:\Windows\System\AKodFqJ.exe
  2⤵
  PID:12724
- C:\Windows\System\gBxzhSq.exe
  C:\Windows\System\gBxzhSq.exe
  2⤵
  PID:12768
- C:\Windows\System\yLngIgd.exe
  C:\Windows\System\yLngIgd.exe
  2⤵
  PID:12812
- C:\Windows\System\wawDwtT.exe
  C:\Windows\System\wawDwtT.exe
  2⤵
  PID:12840
- C:\Windows\System\uhDjeXK.exe
  C:\Windows\System\uhDjeXK.exe
  2⤵
  PID:6400
- C:\Windows\System\vWwMCrk.exe
  C:\Windows\System\vWwMCrk.exe
  2⤵
  PID:12920
- C:\Windows\System\bCWtkwq.exe
  C:\Windows\System\bCWtkwq.exe
  2⤵
  PID:12956
- C:\Windows\System\PhsRUbE.exe
  C:\Windows\System\PhsRUbE.exe
  2⤵
  PID:13004
- C:\Windows\System\RvnJehN.exe
  C:\Windows\System\RvnJehN.exe
  2⤵
  PID:13036
- C:\Windows\System\zSibWiz.exe
  C:\Windows\System\zSibWiz.exe
  2⤵
  PID:13092
- C:\Windows\System\dViRpHu.exe
  C:\Windows\System\dViRpHu.exe
  2⤵
  PID:13144
- C:\Windows\System\BdkKvvc.exe
  C:\Windows\System\BdkKvvc.exe
  2⤵
  PID:13168
- C:\Windows\System\mNOEkSP.exe
  C:\Windows\System\mNOEkSP.exe
  2⤵
  PID:13232
- C:\Windows\System\amirBNU.exe
  C:\Windows\System\amirBNU.exe
  2⤵
  PID:13260
- C:\Windows\System\dntVwvs.exe
  C:\Windows\System\dntVwvs.exe
  2⤵
  PID:4300
- C:\Windows\System\KVXatgw.exe
  C:\Windows\System\KVXatgw.exe
  2⤵
  PID:512
- C:\Windows\System\TbdTigu.exe
  C:\Windows\System\TbdTigu.exe
  2⤵
  PID:12516
- C:\Windows\System\MdLWRpT.exe
  C:\Windows\System\MdLWRpT.exe
  2⤵
  PID:6652
- C:\Windows\System\mQqlDTw.exe
  C:\Windows\System\mQqlDTw.exe
  2⤵
  PID:1060
- C:\Windows\System\sZvBTzn.exe
  C:\Windows\System\sZvBTzn.exe
  2⤵
  PID:6592
- C:\Windows\System\djkgUlh.exe
  C:\Windows\System\djkgUlh.exe
  2⤵
  PID:6776
- C:\Windows\System\BVewJVN.exe
  C:\Windows\System\BVewJVN.exe
  2⤵
  PID:12780
- C:\Windows\System\HqtsBxf.exe
  C:\Windows\System\HqtsBxf.exe
  2⤵
  PID:12836
- C:\Windows\System\oBggfLg.exe
  C:\Windows\System\oBggfLg.exe
  2⤵
  PID:12892
- C:\Windows\System\JVSeWpG.exe
  C:\Windows\System\JVSeWpG.exe
  2⤵
  PID:12992
- C:\Windows\System\nQsWwBs.exe
  C:\Windows\System\nQsWwBs.exe
  2⤵
  PID:13060
- C:\Windows\System\zrgsexg.exe
  C:\Windows\System\zrgsexg.exe
  2⤵
  PID:3820
- C:\Windows\System\GUExhml.exe
  C:\Windows\System\GUExhml.exe
  2⤵
  PID:13208
- C:\Windows\System\yzaNvYb.exe
  C:\Windows\System\yzaNvYb.exe
  2⤵
  PID:13284
- C:\Windows\System\skEKnQx.exe
  C:\Windows\System\skEKnQx.exe
  2⤵
  PID:6840
- C:\Windows\System\ZibwuNS.exe
  C:\Windows\System\ZibwuNS.exe
  2⤵
  PID:12440
- C:\Windows\System\wLjZIDB.exe
  C:\Windows\System\wLjZIDB.exe
  2⤵
  PID:7652
- C:\Windows\System\HNvbPeS.exe
  C:\Windows\System\HNvbPeS.exe
  2⤵
  PID:6832
- C:\Windows\System\WQOwPZH.exe
  C:\Windows\System\WQOwPZH.exe
  2⤵
  PID:12720
- C:\Windows\System\MVYjaJR.exe
  C:\Windows\System\MVYjaJR.exe
  2⤵
  PID:6728
- C:\Windows\System\TjZHXGm.exe
  C:\Windows\System\TjZHXGm.exe
  2⤵
  PID:2408
- C:\Windows\System\qlCBzEC.exe
  C:\Windows\System\qlCBzEC.exe
  2⤵
  PID:13108
- C:\Windows\System\ztdPHPN.exe
  C:\Windows\System\ztdPHPN.exe
  2⤵
  PID:7372
- C:\Windows\System\RIdLEuW.exe
  C:\Windows\System\RIdLEuW.exe
  2⤵
  PID:6588
- C:\Windows\System\PCMEpNr.exe
  C:\Windows\System\PCMEpNr.exe
  2⤵
  PID:12524
- C:\Windows\System\KuTVGmE.exe
  C:\Windows\System\KuTVGmE.exe
  2⤵
  PID:12660
- C:\Windows\System\PEtPYrR.exe
  C:\Windows\System\PEtPYrR.exe
  2⤵
  PID:6668
- C:\Windows\System\kkkUboD.exe
  C:\Windows\System\kkkUboD.exe
  2⤵
  PID:12700
- C:\Windows\System\tvNZkSq.exe
  C:\Windows\System\tvNZkSq.exe
  2⤵
  PID:7136
- C:\Windows\System\ChxfOOM.exe
  C:\Windows\System\ChxfOOM.exe
  2⤵
  PID:6740
- C:\Windows\System\bLybQxD.exe
  C:\Windows\System\bLybQxD.exe
  2⤵
  PID:5984
- C:\Windows\System\eFvLMKq.exe
  C:\Windows\System\eFvLMKq.exe
  2⤵
  PID:392
- C:\Windows\System\hMyFpjj.exe
  C:\Windows\System\hMyFpjj.exe
  2⤵
  PID:7528
- C:\Windows\System\GRxiltW.exe
  C:\Windows\System\GRxiltW.exe
  2⤵
  PID:6932
- C:\Windows\System\xVyOYzu.exe
  C:\Windows\System\xVyOYzu.exe
  2⤵
  PID:13068
- C:\Windows\System\YuFsITW.exe
  C:\Windows\System\YuFsITW.exe
  2⤵
  PID:7536
- C:\Windows\System\zTkdIfv.exe
  C:\Windows\System\zTkdIfv.exe
  2⤵
  PID:5772
- C:\Windows\System\UYeuUAY.exe
  C:\Windows\System\UYeuUAY.exe
  2⤵
  PID:7128
- C:\Windows\System\YxJPDAq.exe
  C:\Windows\System\YxJPDAq.exe
  2⤵
  PID:6472
- C:\Windows\System\xjpgQMs.exe
  C:\Windows\System\xjpgQMs.exe
  2⤵
  PID:8016
- C:\Windows\System\adUBghY.exe
  C:\Windows\System\adUBghY.exe
  2⤵
  PID:5612
- C:\Windows\System\QcxfrjY.exe
  C:\Windows\System\QcxfrjY.exe
  2⤵
  PID:8060
- C:\Windows\System\Qgocyyf.exe
  C:\Windows\System\Qgocyyf.exe
  2⤵
  PID:13328
- C:\Windows\System\LmCWkMN.exe
  C:\Windows\System\LmCWkMN.exe
  2⤵
  PID:13356
- C:\Windows\System\XfvIdvM.exe
  C:\Windows\System\XfvIdvM.exe
  2⤵
  PID:13384
- C:\Windows\System\vLMrXFT.exe
  C:\Windows\System\vLMrXFT.exe
  2⤵
  PID:13412
- C:\Windows\System\QKEwGYw.exe
  C:\Windows\System\QKEwGYw.exe
  2⤵
  PID:13444
- C:\Windows\System\VoONMKE.exe
  C:\Windows\System\VoONMKE.exe
  2⤵
  PID:13468
- C:\Windows\System\lZdQQnI.exe
  C:\Windows\System\lZdQQnI.exe
  2⤵
  PID:13496
- C:\Windows\System\GnDbhPj.exe
  C:\Windows\System\GnDbhPj.exe
  2⤵
  PID:13524
- C:\Windows\System\XjYHpTd.exe
  C:\Windows\System\XjYHpTd.exe
  2⤵
  PID:13552
- C:\Windows\System\ZDxZAdA.exe
  C:\Windows\System\ZDxZAdA.exe
  2⤵
  PID:13580
- C:\Windows\System\wNVaBjx.exe
  C:\Windows\System\wNVaBjx.exe
  2⤵
  PID:13596
- C:\Windows\System\RMLdGem.exe
  C:\Windows\System\RMLdGem.exe
  2⤵
  PID:13636
- C:\Windows\System\xEVLiJe.exe
  C:\Windows\System\xEVLiJe.exe
  2⤵
  PID:13672
- C:\Windows\System\DgJTtKC.exe
  C:\Windows\System\DgJTtKC.exe
  2⤵
  PID:13692
- C:\Windows\System\OIGXeeK.exe
  C:\Windows\System\OIGXeeK.exe
  2⤵
  PID:13720
- C:\Windows\System\vpwwcxx.exe
  C:\Windows\System\vpwwcxx.exe
  2⤵
  PID:13748
- C:\Windows\System\mEeljQy.exe
  C:\Windows\System\mEeljQy.exe
  2⤵
  PID:13776
- C:\Windows\System\dOGFMub.exe
  C:\Windows\System\dOGFMub.exe
  2⤵
  PID:13804
- C:\Windows\System\CFpCvUb.exe
  C:\Windows\System\CFpCvUb.exe
  2⤵
  PID:13832
- C:\Windows\System\wVPCaYr.exe
  C:\Windows\System\wVPCaYr.exe
  2⤵
  PID:13860
- C:\Windows\System\mKatZEj.exe
  C:\Windows\System\mKatZEj.exe
  2⤵
  PID:13888
- C:\Windows\System\ZIiazhn.exe
  C:\Windows\System\ZIiazhn.exe
  2⤵
  PID:13916
- C:\Windows\System\vyPczfe.exe
  C:\Windows\System\vyPczfe.exe
  2⤵
  PID:13944
- C:\Windows\System\BwOVmYR.exe
  C:\Windows\System\BwOVmYR.exe
  2⤵
  PID:13972
- C:\Windows\System\QRBpJeI.exe
  C:\Windows\System\QRBpJeI.exe
  2⤵
  PID:14000
- C:\Windows\System\PbXNRiO.exe
  C:\Windows\System\PbXNRiO.exe
  2⤵
  PID:14024
- C:\Windows\System\WcLwdwt.exe
  C:\Windows\System\WcLwdwt.exe
  2⤵
  PID:14048
- C:\Windows\System\JNQpzGg.exe
  C:\Windows\System\JNQpzGg.exe
  2⤵
  PID:14084
- C:\Windows\System\VUVxAgE.exe
  C:\Windows\System\VUVxAgE.exe
  2⤵
  PID:14116
- C:\Windows\System\YBXUovf.exe
  C:\Windows\System\YBXUovf.exe
  2⤵
  PID:14148
- C:\Windows\System\BvFwbUK.exe
  C:\Windows\System\BvFwbUK.exe
  2⤵
  PID:14176
- C:\Windows\System\EniquAp.exe
  C:\Windows\System\EniquAp.exe
  2⤵
  PID:14204
- C:\Windows\System\nRLTwJb.exe
  C:\Windows\System\nRLTwJb.exe
  2⤵
  PID:14232
- C:\Windows\System\bqiqGNL.exe
  C:\Windows\System\bqiqGNL.exe
  2⤵
  PID:14260
- C:\Windows\System\ToSaxJt.exe
  C:\Windows\System\ToSaxJt.exe
  2⤵
  PID:14288
- C:\Windows\System\gMDjARc.exe
  C:\Windows\System\gMDjARc.exe
  2⤵
  PID:14316
- C:\Windows\System\zXJKrLh.exe
  C:\Windows\System\zXJKrLh.exe
  2⤵
  PID:13324
- C:\Windows\System\qbTaLaI.exe
  C:\Windows\System\qbTaLaI.exe
  2⤵
  PID:13376
- C:\Windows\System\lBZQzGN.exe
  C:\Windows\System\lBZQzGN.exe
  2⤵
  PID:13424
- C:\Windows\System\gjTTWuJ.exe
  C:\Windows\System\gjTTWuJ.exe
  2⤵
  PID:13464
- C:\Windows\System\ccETTdE.exe
  C:\Windows\System\ccETTdE.exe
  2⤵
  PID:13516
- C:\Windows\System\oFCwYQk.exe
  C:\Windows\System\oFCwYQk.exe
  2⤵
  PID:13572
- C:\Windows\System\kgpupct.exe
  C:\Windows\System\kgpupct.exe
  2⤵
  PID:13652
- C:\Windows\System\CUjImVz.exe
  C:\Windows\System\CUjImVz.exe
  2⤵
  PID:13704
- C:\Windows\System\gTSLfrN.exe
  C:\Windows\System\gTSLfrN.exe
  2⤵
  PID:13788
- C:\Windows\System\QcpKoyZ.exe
  C:\Windows\System\QcpKoyZ.exe
  2⤵
  PID:13352
- C:\Windows\System\prYykdx.exe
  C:\Windows\System\prYykdx.exe
  2⤵
  PID:13408
- C:\Windows\System\UbAWCPT.exe
  C:\Windows\System\UbAWCPT.exe
  2⤵
  PID:13732
- C:\Windows\System\FWPymwO.exe
  C:\Windows\System\FWPymwO.exe
  2⤵
  PID:7396
- C:\Windows\System\rZnyVlD.exe
  C:\Windows\System\rZnyVlD.exe
  2⤵
  PID:7744
- C:\Windows\System\ZNBJhbc.exe
  C:\Windows\System\ZNBJhbc.exe
  2⤵
  PID:13912
- C:\Windows\System\UEDGEgC.exe
  C:\Windows\System\UEDGEgC.exe
  2⤵
  PID:8540
- C:\Windows\System\hqeBVQV.exe
  C:\Windows\System\hqeBVQV.exe
  2⤵
  PID:8784
- C:\Windows\System\VhbLnPK.exe
  C:\Windows\System\VhbLnPK.exe
  2⤵
  PID:8812
- C:\Windows\System\XRGxSSy.exe
  C:\Windows\System\XRGxSSy.exe
  2⤵
  PID:8160
- C:\Windows\System\lcEcaZD.exe
  C:\Windows\System\lcEcaZD.exe
  2⤵
  PID:13460
- C:\Windows\System\EaZUpxL.exe
  C:\Windows\System\EaZUpxL.exe
  2⤵
  PID:8932
- C:\Windows\System\ITKXHGx.exe
  C:\Windows\System\ITKXHGx.exe
  2⤵
  PID:8968
- C:\Windows\System\cwLipQS.exe
  C:\Windows\System\cwLipQS.exe
  2⤵
  PID:8992
- C:\Windows\System\BsbviTS.exe
  C:\Windows\System\BsbviTS.exe
  2⤵
  PID:13760
- C:\Windows\System\aKYnocY.exe
  C:\Windows\System\aKYnocY.exe
  2⤵
  PID:13852
- C:\Windows\System\IewcEYe.exe
  C:\Windows\System\IewcEYe.exe
  2⤵
  PID:13956
- C:\Windows\System\RBBKhOS.exe
  C:\Windows\System\RBBKhOS.exe
  2⤵
  PID:9208
- C:\Windows\System\tmsLCDU.exe
  C:\Windows\System\tmsLCDU.exe
  2⤵
  PID:7256
- C:\Windows\System\xypKUPw.exe
  C:\Windows\System\xypKUPw.exe
  2⤵
  PID:1436
- C:\Windows\System\rIiPwFa.exe
  C:\Windows\System\rIiPwFa.exe
  2⤵
  PID:8564
- C:\Windows\System\CveIszp.exe
  C:\Windows\System\CveIszp.exe
  2⤵
  PID:12436
- C:\Windows\System\niBRxHD.exe
  C:\Windows\System\niBRxHD.exe
  2⤵
  PID:8952
- C:\Windows\System\SoUnfoW.exe
  C:\Windows\System\SoUnfoW.exe
  2⤵
  PID:7092
- C:\Windows\System\XrFBxhB.exe
  C:\Windows\System\XrFBxhB.exe
  2⤵
  PID:8216
- C:\Windows\System\pyLIJtI.exe
  C:\Windows\System\pyLIJtI.exe
  2⤵
  PID:8236
- C:\Windows\System\YlRtfYs.exe
  C:\Windows\System\YlRtfYs.exe
  2⤵
  PID:14112
- C:\Windows\System\wdenHls.exe
  C:\Windows\System\wdenHls.exe
  2⤵
  PID:14040
- C:\Windows\System\snFPPue.exe
  C:\Windows\System\snFPPue.exe
  2⤵
  PID:14200
- C:\Windows\System\YbvUOOl.exe
  C:\Windows\System\YbvUOOl.exe
  2⤵
  PID:9076
- C:\Windows\System\TWZcXnH.exe
  C:\Windows\System\TWZcXnH.exe
  2⤵
  PID:8520
- C:\Windows\System\rMXrJql.exe
  C:\Windows\System\rMXrJql.exe
  2⤵
  PID:14252
- C:\Windows\System\sBLbVGb.exe
  C:\Windows\System\sBLbVGb.exe
  2⤵
  PID:9176
- C:\Windows\System\GeJGRHg.exe
  C:\Windows\System\GeJGRHg.exe
  2⤵
  PID:7076
- C:\Windows\System\axZHkVg.exe
  C:\Windows\System\axZHkVg.exe
  2⤵
  PID:8804
- C:\Windows\System\YqQlATN.exe
  C:\Windows\System\YqQlATN.exe
  2⤵
  PID:8728
- C:\Windows\System\crGnMPK.exe
  C:\Windows\System\crGnMPK.exe
  2⤵
  PID:14068
- C:\Windows\System\TBDPXOq.exe
  C:\Windows\System\TBDPXOq.exe
  2⤵
  PID:8852
- C:\Windows\System\vDxMele.exe
  C:\Windows\System\vDxMele.exe
  2⤵
  PID:8880
- C:\Windows\System\WtygEXI.exe
  C:\Windows\System\WtygEXI.exe
  2⤵
  PID:9496
- C:\Windows\System\uYjntyb.exe
  C:\Windows\System\uYjntyb.exe
  2⤵
  PID:14008
- C:\Windows\System\XfyKzuC.exe
  C:\Windows\System\XfyKzuC.exe
  2⤵
  PID:8296
- C:\Windows\System\aSsNAAc.exe
  C:\Windows\System\aSsNAAc.exe
  2⤵
  PID:8368
- C:\Windows\System\aapjhHo.exe
  C:\Windows\System\aapjhHo.exe
  2⤵
  PID:8404
- C:\Windows\System\rNdqyZb.exe
  C:\Windows\System\rNdqyZb.exe
  2⤵
  PID:8396
- C:\Windows\System\ZQVNjbU.exe
  C:\Windows\System\ZQVNjbU.exe
  2⤵
  PID:9776
- C:\Windows\System\YzDODhM.exe
  C:\Windows\System\YzDODhM.exe
  2⤵
  PID:8336
- C:\Windows\System\vkRkSrC.exe
  C:\Windows\System\vkRkSrC.exe
  2⤵
  PID:7156
- C:\Windows\System\zUfNskM.exe
  C:\Windows\System\zUfNskM.exe
  2⤵
  PID:9916
- C:\Windows\System\RzzPCJH.exe
  C:\Windows\System\RzzPCJH.exe
  2⤵
  PID:9992
- C:\Windows\System\ybwAuxZ.exe
  C:\Windows\System\ybwAuxZ.exe
  2⤵
  PID:10000
- C:\Windows\System\BBAuxsv.exe
  C:\Windows\System\BBAuxsv.exe
  2⤵
  PID:10040
- C:\Windows\System\rRzaHFf.exe
  C:\Windows\System\rRzaHFf.exe
  2⤵
  PID:9260
- C:\Windows\System\NDdFNAA.exe
  C:\Windows\System\NDdFNAA.exe
  2⤵
  PID:9288
- C:\Windows\System\TzyRCdS.exe
  C:\Windows\System\TzyRCdS.exe
  2⤵
  PID:8676
- C:\Windows\System\ycbwdoe.exe
  C:\Windows\System\ycbwdoe.exe
  2⤵
  PID:6492
- C:\Windows\System\zOpgApm.exe
  C:\Windows\System\zOpgApm.exe
  2⤵
  PID:9444
- C:\Windows\System\EcAQNPG.exe
  C:\Windows\System\EcAQNPG.exe
  2⤵
  PID:7612
- C:\Windows\System\uapsbku.exe
  C:\Windows\System\uapsbku.exe
  2⤵
  PID:6628
- C:\Windows\System\BiYxALC.exe
  C:\Windows\System\BiYxALC.exe
  2⤵
  PID:7624
- C:\Windows\System\MGsWXPU.exe
  C:\Windows\System\MGsWXPU.exe
  2⤵
  PID:14192
- C:\Windows\System\qSMvCqQ.exe
  C:\Windows\System\qSMvCqQ.exe
  2⤵
  PID:9716
- C:\Windows\System\aUDBmYO.exe
  C:\Windows\System\aUDBmYO.exe
  2⤵
  PID:14188
- C:\Windows\System\FhRGcje.exe
  C:\Windows\System\FhRGcje.exe
  2⤵
  PID:6988
- C:\Windows\System\YNoeJMr.exe
  C:\Windows\System\YNoeJMr.exe
  2⤵
  PID:14284
- C:\Windows\System\zvSnUKn.exe
  C:\Windows\System\zvSnUKn.exe
  2⤵
  PID:7476
- C:\Windows\System\xRIVYtV.exe
  C:\Windows\System\xRIVYtV.exe
  2⤵
  PID:9296
- C:\Windows\System\bjkIwjU.exe
  C:\Windows\System\bjkIwjU.exe
  2⤵
  PID:13872
- C:\Windows\System\fxceepV.exe
  C:\Windows\System\fxceepV.exe
  2⤵
  PID:7648
- C:\Windows\System\ifXkMQS.exe
  C:\Windows\System\ifXkMQS.exe
  2⤵
  PID:7684
- C:\Windows\System\xftbBEG.exe
  C:\Windows\System\xftbBEG.exe
  2⤵
  PID:7724
- C:\Windows\System\SsgakWY.exe
  C:\Windows\System\SsgakWY.exe
  2⤵
  PID:7676
- C:\Windows\System\gwtpSfs.exe
  C:\Windows\System\gwtpSfs.exe
  2⤵
  PID:8744
- C:\Windows\System\RKQHmoL.exe
  C:\Windows\System\RKQHmoL.exe
  2⤵
  PID:9600
- C:\Windows\System\dSmONkT.exe
  C:\Windows\System\dSmONkT.exe
  2⤵
  PID:7912
- C:\Windows\System\HWqschQ.exe
  C:\Windows\System\HWqschQ.exe
  2⤵
  PID:9668
- C:\Windows\System\FPjySWZ.exe
  C:\Windows\System\FPjySWZ.exe
  2⤵
  PID:13544
- C:\Windows\System\dGRVGpq.exe
  C:\Windows\System\dGRVGpq.exe
  2⤵
  PID:7296
- C:\Windows\System\LbZuXqD.exe
  C:\Windows\System\LbZuXqD.exe
  2⤵
  PID:14144
- C:\Windows\System\DbFnXmJ.exe
  C:\Windows\System\DbFnXmJ.exe
  2⤵
  PID:9460
- C:\Windows\System\XUKzZKs.exe
  C:\Windows\System\XUKzZKs.exe
  2⤵
  PID:7308
- C:\Windows\System\URQDeic.exe
  C:\Windows\System\URQDeic.exe
  2⤵
  PID:8464
- C:\Windows\System\TWPNCLG.exe
  C:\Windows\System\TWPNCLG.exe
  2⤵
  PID:9660
- C:\Windows\System\QiJuKWA.exe
  C:\Windows\System\QiJuKWA.exe
  2⤵
  PID:9816
- C:\Windows\System\KDRBMlR.exe
  C:\Windows\System\KDRBMlR.exe
  2⤵
  PID:2120
- C:\Windows\System\mQMKDHh.exe
  C:\Windows\System\mQMKDHh.exe
  2⤵
  PID:14300
- C:\Windows\System\TOizcuT.exe
  C:\Windows\System\TOizcuT.exe
  2⤵
  PID:3364
- C:\Windows\System\PTjYjwL.exe
  C:\Windows\System\PTjYjwL.exe
  2⤵
  PID:9840
- C:\Windows\System\ccmCXxg.exe
  C:\Windows\System\ccmCXxg.exe
  2⤵
  PID:8240
- C:\Windows\System\sLZKJQg.exe
  C:\Windows\System\sLZKJQg.exe
  2⤵
  PID:8116
- C:\Windows\System\dbLdggQ.exe
  C:\Windows\System\dbLdggQ.exe
  2⤵
  PID:9924
- C:\Windows\System\JbiYYRL.exe
  C:\Windows\System\JbiYYRL.exe
  2⤵
  PID:10124
- C:\Windows\System\WlaBFhD.exe
  C:\Windows\System\WlaBFhD.exe
  2⤵
  PID:6860
- C:\Windows\System\yZEPbYe.exe
  C:\Windows\System\yZEPbYe.exe
  2⤵
  PID:10128
- C:\Windows\System\ICBXVEa.exe
  C:\Windows\System\ICBXVEa.exe
  2⤵
  PID:8164
- C:\Windows\System\MocVXAS.exe
  C:\Windows\System\MocVXAS.exe
  2⤵
  PID:7800
- C:\Windows\System\SkbirkK.exe
  C:\Windows\System\SkbirkK.exe
  2⤵
  PID:14364
- C:\Windows\System\xeinnJC.exe
  C:\Windows\System\xeinnJC.exe
  2⤵
  PID:14400
- C:\Windows\System\rbZChmi.exe
  C:\Windows\System\rbZChmi.exe
  2⤵
  PID:14428
- C:\Windows\System\hPtKMEq.exe
  C:\Windows\System\hPtKMEq.exe
  2⤵
  PID:14456
- C:\Windows\System\LfZYmop.exe
  C:\Windows\System\LfZYmop.exe
  2⤵
  PID:14484
- C:\Windows\System\zXARYjD.exe
  C:\Windows\System\zXARYjD.exe
  2⤵
  PID:14512
- C:\Windows\System\mZHiPXW.exe
  C:\Windows\System\mZHiPXW.exe
  2⤵
  PID:14540
- C:\Windows\System\wTOGOnM.exe
  C:\Windows\System\wTOGOnM.exe
  2⤵
  PID:14572
- C:\Windows\System\xOYEaXJ.exe
  C:\Windows\System\xOYEaXJ.exe
  2⤵
  PID:14600
- C:\Windows\System\LpbUCBa.exe
  C:\Windows\System\LpbUCBa.exe
  2⤵
  PID:14628
- C:\Windows\System\wDKHdSt.exe
  C:\Windows\System\wDKHdSt.exe
  2⤵
  PID:14656
- C:\Windows\System\OtGQzex.exe
  C:\Windows\System\OtGQzex.exe
  2⤵
  PID:14684
- C:\Windows\System\ojDmhPN.exe
  C:\Windows\System\ojDmhPN.exe
  2⤵
  PID:14712
- C:\Windows\System\bLOQZjF.exe
  C:\Windows\System\bLOQZjF.exe
  2⤵
  PID:14740
- C:\Windows\System\nTrlzzX.exe
  C:\Windows\System\nTrlzzX.exe
  2⤵
  PID:14768
- C:\Windows\System\dynuKrI.exe
  C:\Windows\System\dynuKrI.exe
  2⤵
  PID:14796
- C:\Windows\System\ofGUOSx.exe
  C:\Windows\System\ofGUOSx.exe
  2⤵
  PID:14824
- C:\Windows\System\HXZKNzq.exe
  C:\Windows\System\HXZKNzq.exe
  2⤵
  PID:14852
- C:\Windows\System\AjzBkQT.exe
  C:\Windows\System\AjzBkQT.exe
  2⤵
  PID:14892
- C:\Windows\System\apyBpkA.exe
  C:\Windows\System\apyBpkA.exe
  2⤵
  PID:14908
- C:\Windows\System\RHxzhZL.exe
  C:\Windows\System\RHxzhZL.exe
  2⤵
  PID:14936
- C:\Windows\System\mExIoJz.exe
  C:\Windows\System\mExIoJz.exe
  2⤵
  PID:14964
- C:\Windows\System\acDQLCW.exe
  C:\Windows\System\acDQLCW.exe
  2⤵
  PID:14992
- C:\Windows\System\UisPClP.exe
  C:\Windows\System\UisPClP.exe
  2⤵
  PID:15024
- C:\Windows\System\KTcPMtt.exe
  C:\Windows\System\KTcPMtt.exe
  2⤵
  PID:15048
- C:\Windows\System\jINbiSE.exe
  C:\Windows\System\jINbiSE.exe
  2⤵
  PID:15084
- C:\Windows\System\NiVGdVA.exe
  C:\Windows\System\NiVGdVA.exe
  2⤵
  PID:15104
- C:\Windows\System\vtExLgM.exe
  C:\Windows\System\vtExLgM.exe
  2⤵
  PID:15132
- C:\Windows\System\cmMjZGY.exe
  C:\Windows\System\cmMjZGY.exe
  2⤵
  PID:15160
- C:\Windows\System\ughigEG.exe
  C:\Windows\System\ughigEG.exe
  2⤵
  PID:15192
- C:\Windows\System\qRYjimv.exe
  C:\Windows\System\qRYjimv.exe
  2⤵
  PID:15220
- C:\Windows\System\zhwnlrT.exe
  C:\Windows\System\zhwnlrT.exe
  2⤵
  PID:15248
- C:\Windows\System\gVAwLVR.exe
  C:\Windows\System\gVAwLVR.exe
  2⤵
  PID:15276
- C:\Windows\System\PeSpMAC.exe
  C:\Windows\System\PeSpMAC.exe
  2⤵
  PID:14452
- C:\Windows\System\YUlOnUx.exe
  C:\Windows\System\YUlOnUx.exe
  2⤵
  PID:14496
- C:\Windows\System\TrBRiyd.exe
  C:\Windows\System\TrBRiyd.exe
  2⤵
  PID:14568
- C:\Windows\System\htbvPEZ.exe
  C:\Windows\System\htbvPEZ.exe
  2⤵
  PID:9972
- C:\Windows\System\BeMHFaU.exe
  C:\Windows\System\BeMHFaU.exe
  2⤵
  PID:9336
- C:\Windows\System\GCrWJUy.exe
  C:\Windows\System\GCrWJUy.exe
  2⤵
  PID:14676
- C:\Windows\System\uiqiMpl.exe
  C:\Windows\System\uiqiMpl.exe
  2⤵
  PID:9388
- C:\Windows\System\pweLihL.exe
  C:\Windows\System\pweLihL.exe
  2⤵
  PID:14752
- C:\Windows\System\pMFcloG.exe
  C:\Windows\System\pMFcloG.exe
  2⤵
  PID:8656
- C:\Windows\System\jeCbxLu.exe
  C:\Windows\System\jeCbxLu.exe
  2⤵
  PID:14816
- C:\Windows\System\BgweOtv.exe
  C:\Windows\System\BgweOtv.exe
  2⤵
  PID:14864
- C:\Windows\System\ZxZGixo.exe
  C:\Windows\System\ZxZGixo.exe
  2⤵
  PID:1416
- C:\Windows\System\RuvsNxv.exe
  C:\Windows\System\RuvsNxv.exe
  2⤵
  PID:760
- C:\Windows\System\InxweAD.exe
  C:\Windows\System\InxweAD.exe
  2⤵
  PID:14548
- C:\Windows\System\ecRvbyG.exe
  C:\Windows\System\ecRvbyG.exe
  2⤵
  PID:15116
- C:\Windows\System\FxqJtXf.exe
  C:\Windows\System\FxqJtXf.exe
  2⤵
  PID:15144
- C:\Windows\System\gucLJZa.exe
  C:\Windows\System\gucLJZa.exe
  2⤵
  PID:15184
- C:\Windows\System\pGHgBhN.exe
  C:\Windows\System\pGHgBhN.exe
  2⤵
  PID:4908
- C:\Windows\System\TUkDiQc.exe
  C:\Windows\System\TUkDiQc.exe
  2⤵
  PID:15256
- C:\Windows\System\BaZiHVo.exe
  C:\Windows\System\BaZiHVo.exe
  2⤵
  PID:15304
- C:\Windows\System\qdYJIdq.exe
  C:\Windows\System\qdYJIdq.exe
  2⤵
  PID:15356
- C:\Windows\System\ylzndWv.exe
  C:\Windows\System\ylzndWv.exe
  2⤵
  PID:14444
- C:\Windows\System\jrsfDSJ.exe
  C:\Windows\System\jrsfDSJ.exe
  2⤵
  PID:8308
- C:\Windows\System\JbZMUAT.exe
  C:\Windows\System\JbZMUAT.exe
  2⤵
  PID:14480
- C:\Windows\System\sVtWRro.exe
  C:\Windows\System\sVtWRro.exe
  2⤵
  PID:8600
- C:\Windows\System\bwbrlUu.exe
  C:\Windows\System\bwbrlUu.exe
  2⤵
  PID:7280
- C:\Windows\System\yJLibbq.exe
  C:\Windows\System\yJLibbq.exe
  2⤵
  PID:8456
- C:\Windows\System\Xsiwimy.exe
  C:\Windows\System\Xsiwimy.exe
  2⤵
  PID:1940
- C:\Windows\System\hWnNZDf.exe
  C:\Windows\System\hWnNZDf.exe
  2⤵
  PID:14736
- C:\Windows\System\pZKyLyP.exe
  C:\Windows\System\pZKyLyP.exe
  2⤵
  PID:5580
- C:\Windows\System\mkGsGOH.exe
  C:\Windows\System\mkGsGOH.exe
  2⤵
  PID:5508
- C:\Windows\System\eCdyEuo.exe
  C:\Windows\System\eCdyEuo.exe
  2⤵
  PID:14872
- C:\Windows\System\EtUHvkO.exe
  C:\Windows\System\EtUHvkO.exe
  2⤵
  PID:14924
- C:\Windows\System\SoFtcyr.exe
  C:\Windows\System\SoFtcyr.exe
  2⤵
  PID:8556
- C:\Windows\System\WSOAJoA.exe
  C:\Windows\System\WSOAJoA.exe
  2⤵
  PID:4228
- C:\Windows\System\GDfguYL.exe
  C:\Windows\System\GDfguYL.exe
  2⤵
  PID:1772
- C:\Windows\System\jbTWheA.exe
  C:\Windows\System\jbTWheA.exe
  2⤵
  PID:15100
- C:\Windows\System\gFDgakS.exe
  C:\Windows\System\gFDgakS.exe
  2⤵
  PID:4548
- C:\Windows\System\iqXklaK.exe
  C:\Windows\System\iqXklaK.exe
  2⤵
  PID:1596
- C:\Windows\System\JhZDzsc.exe
  C:\Windows\System\JhZDzsc.exe
  2⤵
  PID:10284
- C:\Windows\System\UhkBzsC.exe
  C:\Windows\System\UhkBzsC.exe
  2⤵
  PID:10356
- C:\Windows\System\mxlZBzW.exe
  C:\Windows\System\mxlZBzW.exe
  2⤵
  PID:10424
- C:\Windows\System\hkEHzqi.exe
  C:\Windows\System\hkEHzqi.exe
  2⤵
  PID:10480
- C:\Windows\System\eRpFysC.exe
  C:\Windows\System\eRpFysC.exe
  2⤵
  PID:5948
- C:\Windows\System\ZJPiYVG.exe
  C:\Windows\System\ZJPiYVG.exe
  2⤵
  PID:10592
- C:\Windows\System\PDqxbmM.exe
  C:\Windows\System\PDqxbmM.exe
  2⤵
  PID:10636
- C:\Windows\System\nBkajqJ.exe
  C:\Windows\System\nBkajqJ.exe
  2⤵
  PID:14424
- C:\Windows\System\MyMdjxn.exe
  C:\Windows\System\MyMdjxn.exe
  2⤵
  PID:6644
- C:\Windows\System\IdBgAkE.exe
  C:\Windows\System\IdBgAkE.exe
  2⤵
  PID:10760
- C:\Windows\System\kgjxGqJ.exe
  C:\Windows\System\kgjxGqJ.exe
  2⤵
  PID:2464
- C:\Windows\System\IncPobJ.exe
  C:\Windows\System\IncPobJ.exe
  2⤵
  PID:14652
- C:\Windows\System\yWaTaRS.exe
  C:\Windows\System\yWaTaRS.exe
  2⤵
  PID:10864
- C:\Windows\System\UskuaMN.exe
  C:\Windows\System\UskuaMN.exe
  2⤵
  PID:10904
- C:\Windows\System\jimmWUN.exe
  C:\Windows\System\jimmWUN.exe
  2⤵
  PID:11032
- C:\Windows\System\KhcWAsJ.exe
  C:\Windows\System\KhcWAsJ.exe
  2⤵
  PID:9080
- C:\Windows\System\DVrTgdS.exe
  C:\Windows\System\DVrTgdS.exe
  2⤵
  PID:14960
- C:\Windows\System\YhUfxQX.exe
  C:\Windows\System\YhUfxQX.exe
  2⤵
  PID:14988
- C:\Windows\System\tanyMHW.exe
  C:\Windows\System\tanyMHW.exe
  2⤵
  PID:6064
- C:\Windows\System\QKZfEbw.exe
  C:\Windows\System\QKZfEbw.exe
  2⤵
  PID:11252
- C:\Windows\System\nKLeNxh.exe
  C:\Windows\System\nKLeNxh.exe
  2⤵
  PID:5208
- C:\Windows\System\KMrhonz.exe
  C:\Windows\System\KMrhonz.exe
  2⤵
  PID:10340
- C:\Windows\System\vEOGytz.exe
  C:\Windows\System\vEOGytz.exe
  2⤵
  PID:10408
- C:\Windows\System\wUYmMoS.exe
  C:\Windows\System\wUYmMoS.exe
  2⤵
  PID:15152
- C:\Windows\System\ycRgwyA.exe
  C:\Windows\System\ycRgwyA.exe
  2⤵
  PID:10560
- C:\Windows\System\NuNiwqZ.exe
  C:\Windows\System\NuNiwqZ.exe
  2⤵
  PID:9440
- C:\Windows\System\peAPvnP.exe
  C:\Windows\System\peAPvnP.exe
  2⤵
  PID:10440
- C:\Windows\System\AYFfxhh.exe
  C:\Windows\System\AYFfxhh.exe
  2⤵
  PID:14372
- C:\Windows\System\GULLezU.exe
  C:\Windows\System\GULLezU.exe
  2⤵
  PID:10780
- C:\Windows\System\tdMdkMK.exe
  C:\Windows\System\tdMdkMK.exe
  2⤵
  PID:3388
- C:\Windows\System\wSevUAt.exe
  C:\Windows\System\wSevUAt.exe
  2⤵
  PID:10100
- C:\Windows\System\NDfsRAU.exe
  C:\Windows\System\NDfsRAU.exe
  2⤵
  PID:4648
- C:\Windows\System\jLisqjO.exe
  C:\Windows\System\jLisqjO.exe
  2⤵
  PID:1048
- C:\Windows\System\isOxyMX.exe
  C:\Windows\System\isOxyMX.exe
  2⤵
  PID:11000
- C:\Windows\System\PrpXuOy.exe
  C:\Windows\System\PrpXuOy.exe
  2⤵
  PID:11040
- C:\Windows\System\kJLPyPV.exe
  C:\Windows\System\kJLPyPV.exe
  2⤵
  PID:5636
- C:\Windows\System\lKMckyl.exe
  C:\Windows\System\lKMckyl.exe
  2⤵
  PID:5664
- C:\Windows\System\jUeRlvY.exe
  C:\Windows\System\jUeRlvY.exe
  2⤵
  PID:5776
- C:\Windows\System\FpiNrDY.exe
  C:\Windows\System\FpiNrDY.exe
  2⤵
  PID:11208
- C:\Windows\System\LmFQDVo.exe
  C:\Windows\System\LmFQDVo.exe
  2⤵
  PID:11212
- C:\Windows\System\ccXUeKZ.exe
  C:\Windows\System\ccXUeKZ.exe
  2⤵
  PID:15012
- C:\Windows\System\NXeWpBL.exe
  C:\Windows\System\NXeWpBL.exe
  2⤵
  PID:10412
- C:\Windows\System\EhAmwbK.exe
  C:\Windows\System\EhAmwbK.exe
  2⤵
  PID:11700
- C:\Windows\System\DstUmiI.exe
  C:\Windows\System\DstUmiI.exe
  2⤵
  PID:3596
- C:\Windows\System\jBKUnLX.exe
  C:\Windows\System\jBKUnLX.exe
  2⤵
  PID:2348
- C:\Windows\System\HfiBswz.exe
  C:\Windows\System\HfiBswz.exe
  2⤵
  PID:9292
- C:\Windows\System\bTNhKEH.exe
  C:\Windows\System\bTNhKEH.exe
  2⤵
  PID:11068
- C:\Windows\System\zzaVkUx.exe
  C:\Windows\System\zzaVkUx.exe
  2⤵
  PID:9672
- C:\Windows\System\uWgGjaf.exe
  C:\Windows\System\uWgGjaf.exe
  2⤵
  PID:5572
- C:\Windows\System\HNWVyuw.exe
  C:\Windows\System\HNWVyuw.exe
  2⤵
  PID:9704
- C:\Windows\System\eHChabk.exe
  C:\Windows\System\eHChabk.exe
  2⤵
  PID:12068
- C:\Windows\System\ynsbjvN.exe
  C:\Windows\System\ynsbjvN.exe
  2⤵
  PID:1180
- C:\Windows\System\lKgUIqT.exe
  C:\Windows\System\lKgUIqT.exe
  2⤵
  PID:12224
- C:\Windows\System\MYASVgp.exe
  C:\Windows\System\MYASVgp.exe
  2⤵
  PID:4268
- C:\Windows\System\IYFnhGe.exe
  C:\Windows\System\IYFnhGe.exe
  2⤵
  PID:1972
- C:\Windows\System\mSMApph.exe
  C:\Windows\System\mSMApph.exe
  2⤵
  PID:10564
- C:\Windows\System\fIGHezQ.exe
  C:\Windows\System\fIGHezQ.exe
  2⤵
  PID:10436
- C:\Windows\System\FxDRRYl.exe
  C:\Windows\System\FxDRRYl.exe
  2⤵
  PID:5800
- C:\Windows\System\ftUNoqE.exe
  C:\Windows\System\ftUNoqE.exe
  2⤵
  PID:10712
- C:\Windows\System\TjnQqLW.exe
  C:\Windows\System\TjnQqLW.exe
  2⤵
  PID:5996
- C:\Windows\System\LISCbvE.exe
  C:\Windows\System\LISCbvE.exe
  2⤵
  PID:11132
- C:\Windows\System\wLznnVe.exe
  C:\Windows\System\wLznnVe.exe
  2⤵
  PID:15348
- C:\Windows\System\AUPVJvo.exe
  C:\Windows\System\AUPVJvo.exe
  2⤵
  PID:11772
- C:\Windows\System\iTvqrrA.exe
  C:\Windows\System\iTvqrrA.exe
  2⤵
  PID:2480
- C:\Windows\System\vweafka.exe
  C:\Windows\System\vweafka.exe
  2⤵
  PID:12024
- C:\Windows\System\OafbOzO.exe
  C:\Windows\System\OafbOzO.exe
  2⤵
  PID:14592
- C:\Windows\System\jKnxBxH.exe
  C:\Windows\System\jKnxBxH.exe
  2⤵
  PID:928
- C:\Windows\System\EcZqGRZ.exe
  C:\Windows\System\EcZqGRZ.exe
  2⤵
  PID:6036
- C:\Windows\System\ILeblPq.exe
  C:\Windows\System\ILeblPq.exe
  2⤵
  PID:10876
- C:\Windows\System\NGLptxq.exe
  C:\Windows\System\NGLptxq.exe
  2⤵
  PID:2756
- C:\Windows\System\ajVlBmB.exe
  C:\Windows\System\ajVlBmB.exe
  2⤵
  PID:11408
- C:\Windows\System\ErSDoVd.exe
  C:\Windows\System\ErSDoVd.exe
  2⤵
  PID:10912
- C:\Windows\System\UVznpKo.exe
  C:\Windows\System\UVznpKo.exe
  2⤵
  PID:11548
- C:\Windows\System\agQbpvb.exe
  C:\Windows\System\agQbpvb.exe
  2⤵
  PID:10916
- C:\Windows\System\cvqeLJc.exe
  C:\Windows\System\cvqeLJc.exe
  2⤵
  PID:12400
- C:\Windows\System\AexywhE.exe
  C:\Windows\System\AexywhE.exe
  2⤵
  PID:5860
- C:\Windows\System\JeCttox.exe
  C:\Windows\System\JeCttox.exe
  2⤵
  PID:3924
- C:\Windows\System\HNdMZcc.exe
  C:\Windows\System\HNdMZcc.exe
  2⤵
  PID:4148
- C:\Windows\System\bOdVUEM.exe
  C:\Windows\System\bOdVUEM.exe
  2⤵
  PID:14904
- C:\Windows\System\gRmhPuS.exe
  C:\Windows\System\gRmhPuS.exe
  2⤵
  PID:9376
- C:\Windows\System\Ucrolct.exe
  C:\Windows\System\Ucrolct.exe
  2⤵
  PID:10984
- C:\Windows\System\MILcQUi.exe
  C:\Windows\System\MILcQUi.exe
  2⤵
  PID:10020
- C:\Windows\System\YQDVQeU.exe
  C:\Windows\System\YQDVQeU.exe
  2⤵
  PID:9332
- C:\Windows\System\RgPnXcl.exe
  C:\Windows\System\RgPnXcl.exe
  2⤵
  PID:12692
- C:\Windows\System\gGtUkBt.exe
  C:\Windows\System\gGtUkBt.exe
  2⤵
  PID:11932
- C:\Windows\System\sxtLqva.exe
  C:\Windows\System\sxtLqva.exe
  2⤵
  PID:12740
- C:\Windows\System\nWYUqev.exe
  C:\Windows\System\nWYUqev.exe
  2⤵
  PID:9764
- C:\Windows\System\AzFxfzw.exe
  C:\Windows\System\AzFxfzw.exe
  2⤵
  PID:9792
- C:\Windows\System\eKwxdxK.exe
  C:\Windows\System\eKwxdxK.exe
  2⤵
  PID:12100
- C:\Windows\System\pXdYvkk.exe
  C:\Windows\System\pXdYvkk.exe
  2⤵
  PID:12880
- C:\Windows\System\vTzmoIF.exe
  C:\Windows\System\vTzmoIF.exe
  2⤵
  PID:12196
- C:\Windows\System\LUCESxp.exe
  C:\Windows\System\LUCESxp.exe
  2⤵
  PID:15344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_adem2r1q.uwn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BrfEEbL.exe

Filesize
3.1MB

MD5
656581c1ab1200ee5f9720131978ed86

SHA1
6789e3372a1eb19f560235538ffad85facd95311

SHA256
266f189d39238297d3f640f48a8e084c74d0380c1dfbe5875e3704db08e8ec15

SHA512
98efd382410b568850376fb9465f315ff39d538362d33a96bcbc55b1dcc1a30a97e7695b1d3eabf59063ee6faef92fd3c27504485036dcf8b81a3feab55b2a07

Download Submit
C:\Windows\System\CFbRgzQ.exe

Filesize
3.1MB

MD5
188709bebf1af318f3cf734c8eb162b9

SHA1
2e1356265eab88b3ee9098a4e9963602fe6c7ae2

SHA256
3c55e27a140a9e4909a9edac37a4aec25655024d03fa934c393217bdba9a9ae3

SHA512
036596c4bb5be64d45c871d51f7e44fdf12a01ffd8365c5e8c7b228b6b8cb45e68c1de8d711ab8bd18281ee6e1ee4b05479daf406001c9507bad02e7e7076f76

Download Submit
C:\Windows\System\Dgmftow.exe

Filesize
3.1MB

MD5
8fadd5135f72b63b96d99a2571429c7e

SHA1
1055ec5fa542a253ad3fcbdf508288b1c27c9e26

SHA256
5127e09b0bec777379c37ee2b1320388fe43f8f6534a892f2c6cefef1edcd3ff

SHA512
e6e115a90b24a62a9675da76bb438f10a6f8efbf7b7e2f5e260750863cf1a42ba31ec5f783d2a535007b3bf661c0886b115c14dd15585c965c35fc26690f2542

Download Submit
C:\Windows\System\GgvJuhO.exe

Filesize
3.1MB

MD5
701be53a52dccfef6ae798fe42e7aa9b

SHA1
1aeb0bc70a8f16e57b60f13a1298a3fd9e25be5f

SHA256
f4d329cfab54034866824f31bbbb6eb6b710ab2dc0711cccb56d62716c36428b

SHA512
5c9548920ea9f156411639d2c984b2319616b5555e932a15473aea703dc98016deeb54e5ba086e0ca2b5935f2cc5577624edfa8e27bc90abf7d96e3c9d17123d

Download Submit
C:\Windows\System\HXrsZWN.exe

Filesize
3.1MB

MD5
ff246057cb4c6de3b1466cda50c1a46a

SHA1
bc18171b7ba6e24f05f3b41b4c51fa24ad2a9f5a

SHA256
f451029aababf6ea1410afb0c96604ad9a402097098f582901d63ebf9d543c6b

SHA512
14440d29638a966016ec8b2de183c4fb249eada3e8659649ad9d55f94f24d6d7e0c6538a89bbf47bdbb6a863b9ae75746ca0bd408b8f47cd9419c5f3431fc780

Download Submit
C:\Windows\System\JzwRaTY.exe

Filesize
3.1MB

MD5
ae07bc3800d5515fe4aa4fe8159cab2c

SHA1
392a9538020937ad62236dc6aa64ba661187055c

SHA256
3e0fdbf008f6edecda8c5b73baeb52e91976425db693b17dcfd4bccfd5003062

SHA512
16d140a970938b7ca37f1fa34d4ffd4beab67d9b29d7dadc1e3a071fcd10dc7783305e76a2f591beeeda17e25029c28638ea4f2e252527b35cccd760b8bf36bf

Download Submit
C:\Windows\System\KLXUttz.exe

Filesize
3.1MB

MD5
df83a2bae7c63dff56371cd002e9c665

SHA1
b0078f552d8ec8a04eb348fd8ab9dbc61c00618a

SHA256
e8923216d4b48b3488e2feee953811e87891fe286d711a71944963699fb824bb

SHA512
200164130ad2e9854dff08f2839ef7da590b7174dfa89fcd209cbc77ed4eafa3a080513049a07d7d4c927fbb411e48ab63c5225d193bc348ea76471da724e38c

Download Submit
C:\Windows\System\NOSSAdN.exe

Filesize
3.1MB

MD5
f0bd4ea6665e2c5fb96a41048d28684d

SHA1
e0e638b813cda91df1972ca7096d5e166e5dae1d

SHA256
faa6f2b2bcfd692c71d318c4c5ee6e955eda5b6abe5fa00a5ba800a63ba01526

SHA512
f08d486a53928a4f49d092f9c1baf8bff3c8f8b705be509479089fb4cd537f8012b3579507dd67aa9411776cb078811e1cbd8db37afacd9ef7d1c158bb323630

Download Submit
C:\Windows\System\NbpqbRr.exe

Filesize
3.1MB

MD5
2ba1306013c09945fb499a49ac7a6ba3

SHA1
0bb68b10e492bfd78c5009cf35fe2bd5fece2960

SHA256
ee44f66b29ba36735a94f74a8c79270df75810502a56d2588a8680be6344dc87

SHA512
21db1f9a5c2cfd3e63b8bf92d8dc20e129ae433565c1d5442e4396740a17588a0a952cbc9f195935017e2de2f4f92a26f7966abff772584466af93954143e8ee

Download Submit
C:\Windows\System\PFdDKDR.exe

Filesize
3.1MB

MD5
8548c49a88aaecec4b8e8cb78647465c

SHA1
f5fa18d735057984db8abbc2334a0fced364e578

SHA256
4e2e5794888426fb6e8d8f946896448645ed80a81323314ce77715ce21afe9ae

SHA512
6bff6326315c4172e33549d47b3b3f0e311fb2f1c3b81788d6e50636bf47521f187655a7dd01afd45917049c202319cb6dbd6d919da6e17f07c75ddcd17ca4a5

Download Submit
C:\Windows\System\QPJEyJr.exe

Filesize
3.1MB

MD5
b5765f15b67e301560dbd7f368efd653

SHA1
5726cc06713e0555afadc465e2d93370d4cb8713

SHA256
49163f81ec66b24e22b088b0a8d222aa7cc69956429c00635a2fe4b8eac5171e

SHA512
b8c07ad8b42f0b00c7c428ec7261b9824cdebeaa6018217315150f927de23c64d3bf516d8c670157fa1e985c1ea132c0f3a801efcf2271c2bd4b11fc55228dc4

Download Submit
C:\Windows\System\SNVRseB.exe

Filesize
3.1MB

MD5
b18d483204868b9f00395da9013ccc7d

SHA1
7d98a0e812ce572ccc916a69a62a391dbb1e6d3c

SHA256
eda2ad9b956c418c49ab8f1d1de3701363c7447b55e84fca9244736d08aa9449

SHA512
d4799a112a40b69c2533218ce672440401fb6b63fcdd92ed8f7d0e9295487270591effb9ed1f83cf1550c6440bc6c2199ee07a75cc934f577decc7697b478032

Download Submit
C:\Windows\System\ShMFvOo.exe

Filesize
3.1MB

MD5
2c5ee54dc3a8381e29d2e8696efd0ed2

SHA1
aa32af003dbed186b3df7c6ef376d1ed3cffd60e

SHA256
0ef171fc32765a715cc053fb37007dfebfbbfbbc81f4cf31ddd8251ee8db0193

SHA512
557c4ef0831431b3598e5da61448141d007756a80d6a005d8078ffadf16e436c633e928780063b260037fcde55722cbd88d676946224608ceb9069c8987a9878

Download Submit
C:\Windows\System\UXhcjYp.exe

Filesize
3.1MB

MD5
1f8a5170ab3a321cf52ac97a030c325e

SHA1
66c57e048230d951bd07a1c7b97e495feb35f81d

SHA256
7bc65b5d46cd38c4d6956fc9105cfbe45322b367dcfd4efb48916aa53b0c79c4

SHA512
6bfecf672c21bd23f9ef20864712dd58e087b4b3212fafd37e7a3adf457dff5e5d93f4716e5f57bced1600709fb72b5906667b9f66acf165c5028faa79e06fe4

Download Submit
C:\Windows\System\VoPKyTs.exe

Filesize
3.1MB

MD5
9a93fb933e036f77fab16550bbc21c92

SHA1
4d641716c73e296cbd05628b3b5dcb097be94368

SHA256
c33e334e61dc78eab6d6c98d6e0e07657221a475788530bfd2b573894ae479eb

SHA512
1fc12a188ab81206eabd27b6ba10b79c35a753279c160583584183fe6b94ee33ab259d6d85c2d849db12c7c71db32593d6e5500005fc7d9311f433fe9db6dd57

Download Submit
C:\Windows\System\WMLOndR.exe

Filesize
3.1MB

MD5
810e7a41449ce6c2e52f420cf716b8f5

SHA1
1f1cd4cc879d165293e07a91ac23b4aa08752e06

SHA256
894ca326e97e5a3fb89071bbef4e072e232660e600954f3b66a7eb8546fd5b71

SHA512
e1fcd3d4a8beebe17fafe27ec9ffaad3190efa32d23bc711051f2c7622fad9b7c04b714b6fbf19cc9b0115ae222d1e0960e28a15358cfe3b663b9f3493e4661a

Download Submit
C:\Windows\System\WRqFbMv.exe

Filesize
3.1MB

MD5
070cc55c32e3ea81f6a1d8ed55a0dd01

SHA1
ad95480a60ad06e63fc42b9fa5f1ef02ae95e8f6

SHA256
edbb0a799d5b75aba6295c651465ee12205c2a5011ee13ffb19ea4c23b64c3ec

SHA512
6d2e526143d4ebb011cefc71c0de91f8e0daeb03d15b17bd72807a7f483a0aa4289cbcc2adbca62116fec71c660995bc314d11912f133511928b159b62244dd9

Download Submit
C:\Windows\System\WwQoIEf.exe

Filesize
3.1MB

MD5
80f5579377a5b12a5d6bc8db1e0003b0

SHA1
91942fb5422b62269b914d50d62ca2914e6b0264

SHA256
c4aa84fb9803efe65b32e8a86340b37985855edf7c71cd9cd92f0ae0a997b808

SHA512
50c2fe3e4050d23c096e3ed30279cb06c14c1b32d03bf86ee19fcca363ebd0b983cd8ee951864255317857559940a6c416a78f03892cb44760080fbef8998e86

Download Submit
C:\Windows\System\YNEiEVV.exe

Filesize
3.1MB

MD5
c670ef833fdd1216186ec7c8f7ad80f6

SHA1
c68da31d648f69607a8abf8a71b84823f7cf5bc2

SHA256
c9e3ecefed120cb35e7fa6137b9c246732723640c4e26b5513764bca2d6e704f

SHA512
d174cd0e1502c460c53f55dc05e79b6472ba128bc986ce3e35477dc6aad70b3e959f65dad0f9c9c1db9cde439a6f63b0205d5a9701d264bd5a39e7f631814ccc

Download Submit
C:\Windows\System\dJuupHG.exe

Filesize
3.1MB

MD5
65e15432a2da6b0731a090c68d673b26

SHA1
b86122380c28582b4b0304e1f5ec2c73075c20db

SHA256
ffef3364f335bffb40f029cc114101abee91658c8f5c3bc9a111412faae8bac7

SHA512
0bb0881356d7bd0a8da74e26ffeece722d3d1e5f8c8a362636d163b292ca4796e7cf830c9c3a844f43391670564823e5b63526be0a63125e5c0e8192825ebf50

Download Submit
C:\Windows\System\fCPKHZR.exe

Filesize
3.1MB

MD5
5dd9ddc27c07517f959972e6f90f993d

SHA1
ba88a74209624efd139a84d539f5e11ad5525201

SHA256
4bc4640976cecde388a5ad3229bd5ccff6fc5ea7989c151daa4831eca3c7b7c6

SHA512
7a43e026a645573e4fb1847f2cafd138c121e7a565aba6541fd81c18ef02b81eb3918c4eaafce5bf2fce17f6b09e88edcd9b47a9e33900cd067b4aa769ecb0e5

Download Submit
C:\Windows\System\imRhxgn.exe

Filesize
3.1MB

MD5
a6e297ce4d3a04892c9d14ccf3341713

SHA1
708b8a42f2759bef564f057466c9584d96774b5a

SHA256
f0460d649f22c5da9d0ff3596372dc45b2b603d3041586b505ec937654428e7c

SHA512
e2b72c8bb6b16e6b4cac748eb4a2c5f9c6e07274c75fe978231d1c9ac11dc44c02f42c0253689307e3b4ba534605d9170dfb66de3bd14fd2e4433909988b2708

Download Submit
C:\Windows\System\juAQaoX.exe

Filesize
3.1MB

MD5
601ae8c3142a3c61da8f8a6696b33ba6

SHA1
6442a67c0021cae0520017aa144ab5ab0db27312

SHA256
a30dbd8eaad2a4c1c794c7f488a85f6aed4e5b9ecc7a181d091cbad48afdcc16

SHA512
e4f4e8b7c5d6e417e45543c415e5b22ece98653c0b1f133251073729584e477753d44ddec0329f2528ab20a26f7c9eca6688e80b29254dde1df5fc84ea7424a6

Download Submit
C:\Windows\System\jvqVJCJ.exe

Filesize
3.1MB

MD5
5a2429b29b940fbd27922a0a428bde76

SHA1
3518b15ef2d63b77dbaab8ca3d3d778f5fb7409e

SHA256
1dad4a4151771f207e58e00569da97dce34afcc011291465d6a42867ef8c4ca5

SHA512
8f2d6253579348527893a8a8d26d61532446e6acbd10c9069e253438bca719366e1f7ef6e28e53ef456a6845654d36d85472277cdcc6a4f2b2604a3718948076

Download Submit
C:\Windows\System\mWgTnKq.exe

Filesize
3.1MB

MD5
2dd41120ffe11ba9c6e924b338e1151d

SHA1
c4b169b539cc2fb3fe16f280a3bedebc491f411a

SHA256
e68bf9f61c03c1eed96d09dbcc988e27cbf4801720afe9225665688e8808a5b3

SHA512
4d6166b6b8f517131e63266857f3bbc0ab7d86d65f102b2170c1504a4381d5b96911e9afd7bd76378cb24eb6794994055f9859d0eb50a0fd3c30a9b94db29b37

Download Submit
C:\Windows\System\owSYwla.exe

Filesize
3.1MB

MD5
a4fa09fa94a8313ad6712ca9e59b5e73

SHA1
806ee91124f60cf7f5478c0c980df4708ec6ee58

SHA256
ba54f4b113ac964766f4e06d9022ec223ed0e7377f492da9de12c0046bf82a20

SHA512
a18405f87252313c60e9e638fd14645242fd276347ea9b49c900cb46b8282ce0942304f744da1fd8841b2d177668ba60c28fabd565ed7dcf4e5c221909848ae7

Download Submit
C:\Windows\System\pcQrowy.exe

Filesize
3.1MB

MD5
e2a3e36d882581bab3c337a12fbaec98

SHA1
b893048899a0bf52baf5a098e799fc6d6b23b877

SHA256
8a219744d83efb6e2e4602ada1d36a3ff498bb11a6e19aa31911de9fe3dd9421

SHA512
3a5429743a682bf86ada19c3b187808e5935439d9a517938477cbc32f04c36fc02b55b33dc933a02e41455e7ecf063f31cebe753ff9f9a9c6078533d33c47b52

Download Submit
C:\Windows\System\qZVWUVW.exe

Filesize
3.1MB

MD5
857e48537635145cab987644e3029b37

SHA1
b4fa2b1b0d6e7eb119c282a2f2dc9e1acbe7c404

SHA256
ff209c5cf0e25cabe10da0b1d9611f6448b77b8bf4c05980aa732846adc607db

SHA512
c9b23e109dbe26bfad71374a0cd44de93b5aac7b974414d35dd077c00eaecc72929cb4d5bac14d8026b8cf833f3e4ff165459bb32093aa5f43990bd1cdc0855f

Download Submit
C:\Windows\System\qrpdNQc.exe

Filesize
3.1MB

MD5
8b005fd8f9b2aa1649e7107610d9a322

SHA1
51a94a1279e071776e57055a32ba929fbfcf45a9

SHA256
84fd04d90ac5f5c9be40dec8a48aaedbc8f38714fcea771d9f4a78cc73a5531a

SHA512
4c1e3fd629ba2a02358b6ae803795ae209e744840507232cbefe291668a2f217c97910533f97fe934bd5b6cf1e8f4f857f63b4fedc4ebef9719179dc9c2ca151

Download Submit
C:\Windows\System\rdFipUk.exe

Filesize
8B

MD5
89b49edfc15b320118dccc63dce276c0

SHA1
d6a182f9e8a009d8ebfef26a1c685fcf2b4f152a

SHA256
b80b4d5110187afa9e6d1cf3e2b0f3429a153e9d0c88c32cabdb6359e19204f1

SHA512
7177d9a15db58801e4f8b1c7970b405645f764452ade86d38cac06f6967fac62b12ef486104093e1892a28c57d2dd25b2fe393363d54d8f0cf2bd6688982c9c6

Download Submit
C:\Windows\System\sASYyoR.exe

Filesize
3.1MB

MD5
2bb4aa63fbc076c4d61f71e01ba32d51

SHA1
3eb4222d83060a34f4c9483431e8ec19d67116d2

SHA256
24bf50ee1795599fd683f37fab5cd59104c3e44f1c983b8faec39c1047e2ca68

SHA512
c2ef5eb20bc8ca2c42574dcaf32496b54e61b7c6ebae03d781cbaacf1b933fa408fb8c360e0d34ed5fcef8c4829876457540116b895ab35cac6508c99a207bab

Download Submit
C:\Windows\System\wLGUJcZ.exe

Filesize
3.1MB

MD5
a7bfcadd394e79e356707a0ca6bc6c08

SHA1
57065197c925d6f72db6d8adf742ad5b6c573ad4

SHA256
500c4993a3001116508de573de9ef5cfe117fdf6ab21d555bafd335a19d7a4a9

SHA512
3e92f02f6ea6cb1f2591d57dd70034e5e47b078a3dfc660fa5eb35d840c18b785805d3b9b9832ffc1ad59518bcfda031aa3e253bc8325edc73b8337ad9070abd

Download Submit
C:\Windows\System\wQeMUmW.exe

Filesize
3.1MB

MD5
778e5eeba9e365594b93e9f319227c5e

SHA1
ce96a2197a88164f171289ae88721953bbb5e592

SHA256
3b28ab1ca23ed30542817ecf9b84233acc0356d0fb1a2ccfc9b8f8572f84c3a4

SHA512
26cb354e28adb7f5d2c5c7199939f1b8acde83f94f5415aab812e38803bde72c497c2326748b6f9705f851e26a6788e18ad0c2ea4d4e53f02aaa860a1d635c95

Download Submit
C:\Windows\System\wwdgidk.exe

Filesize
3.1MB

MD5
f087b9f0c6a0fc6701ed2b9c926cbe1b

SHA1
b83cceb86e80332da8a7d1abb3baa20c493cd3cb

SHA256
868e9550d3952a0b4340f4c625032fccf2f04e8f51c845d9cd673c273a9d0c5e

SHA512
19c8cc8f4ffb1e9e751bc11423e962c8af1eb40c311e13f8bad591fd1aef6ec371eb4995b9c9d102159d96f8e953d62841f3f17541aa1dedf89da5b49be79695

Download Submit
memory/860-650-0x00007FF6760F0000-0x00007FF6764E6000-memory.dmp

Filesize
4.0MB

Download
memory/860-1496-0x00007FF6760F0000-0x00007FF6764E6000-memory.dmp

Filesize
4.0MB

Download
memory/1148-1289-0x00007FF62FEA0000-0x00007FF630296000-memory.dmp

Filesize
4.0MB

Download
memory/1148-9-0x00007FF62FEA0000-0x00007FF630296000-memory.dmp

Filesize
4.0MB

Download
memory/1296-1351-0x00007FF778640000-0x00007FF778A36000-memory.dmp

Filesize
4.0MB

Download
memory/1296-55-0x00007FF778640000-0x00007FF778A36000-memory.dmp

Filesize
4.0MB

Download
memory/1832-653-0x00007FF66D0B0000-0x00007FF66D4A6000-memory.dmp

Filesize
4.0MB

Download
memory/1832-1500-0x00007FF66D0B0000-0x00007FF66D4A6000-memory.dmp

Filesize
4.0MB

Download
memory/1852-1578-0x00007FF67A830000-0x00007FF67AC26000-memory.dmp

Filesize
4.0MB

Download
memory/1852-664-0x00007FF67A830000-0x00007FF67AC26000-memory.dmp

Filesize
4.0MB

Download
memory/2112-1558-0x00007FF63B3B0000-0x00007FF63B7A6000-memory.dmp

Filesize
4.0MB

Download
memory/2112-661-0x00007FF63B3B0000-0x00007FF63B7A6000-memory.dmp

Filesize
4.0MB

Download
memory/2200-660-0x00007FF637860000-0x00007FF637C56000-memory.dmp

Filesize
4.0MB

Download
memory/2200-1557-0x00007FF637860000-0x00007FF637C56000-memory.dmp

Filesize
4.0MB

Download
memory/2276-1477-0x00007FF6766E0000-0x00007FF676AD6000-memory.dmp

Filesize
4.0MB

Download
memory/2276-634-0x00007FF6766E0000-0x00007FF676AD6000-memory.dmp

Filesize
4.0MB

Download
memory/2932-0-0x00007FF7CB860000-0x00007FF7CBC56000-memory.dmp

Filesize
4.0MB

Download
memory/2932-2384-0x00007FF7CB860000-0x00007FF7CBC56000-memory.dmp

Filesize
4.0MB

Download
memory/2932-1-0x0000022418A40000-0x0000022418A50000-memory.dmp

Filesize
64KB

Download
memory/2980-52-0x00007FF72DB90000-0x00007FF72DF86000-memory.dmp

Filesize
4.0MB

Download
memory/2980-1325-0x00007FF72DB90000-0x00007FF72DF86000-memory.dmp

Filesize
4.0MB

Download
memory/3004-1340-0x00007FF611F80000-0x00007FF612376000-memory.dmp

Filesize
4.0MB

Download
memory/3004-54-0x00007FF611F80000-0x00007FF612376000-memory.dmp

Filesize
4.0MB

Download
memory/3344-1492-0x00007FF7A7850000-0x00007FF7A7C46000-memory.dmp

Filesize
4.0MB

Download
memory/3344-643-0x00007FF7A7850000-0x00007FF7A7C46000-memory.dmp

Filesize
4.0MB

Download
memory/3528-51-0x00007FF672400000-0x00007FF6727F6000-memory.dmp

Filesize
4.0MB

Download
memory/3528-1303-0x00007FF672400000-0x00007FF6727F6000-memory.dmp

Filesize
4.0MB

Download
memory/3724-659-0x00007FF74D010000-0x00007FF74D406000-memory.dmp

Filesize
4.0MB

Download
memory/3724-1548-0x00007FF74D010000-0x00007FF74D406000-memory.dmp

Filesize
4.0MB

Download
memory/3748-658-0x00007FF7FEFF0000-0x00007FF7FF3E6000-memory.dmp

Filesize
4.0MB

Download
memory/3748-1542-0x00007FF7FEFF0000-0x00007FF7FF3E6000-memory.dmp

Filesize
4.0MB

Download
memory/4460-663-0x00007FF6AC480000-0x00007FF6AC876000-memory.dmp

Filesize
4.0MB

Download
memory/4460-1566-0x00007FF6AC480000-0x00007FF6AC876000-memory.dmp

Filesize
4.0MB

Download
memory/4468-629-0x00007FF6CA790000-0x00007FF6CAB86000-memory.dmp

Filesize
4.0MB

Download
memory/4468-1467-0x00007FF6CA790000-0x00007FF6CAB86000-memory.dmp

Filesize
4.0MB

Download
memory/4492-657-0x00007FF75C490000-0x00007FF75C886000-memory.dmp

Filesize
4.0MB

Download
memory/4492-1534-0x00007FF75C490000-0x00007FF75C886000-memory.dmp

Filesize
4.0MB

Download
memory/4560-1510-0x00007FF7D3600000-0x00007FF7D39F6000-memory.dmp

Filesize
4.0MB

Download
memory/4560-655-0x00007FF7D3600000-0x00007FF7D39F6000-memory.dmp

Filesize
4.0MB

Download
memory/4576-1329-0x00007FF789760000-0x00007FF789B56000-memory.dmp

Filesize
4.0MB

Download
memory/4576-53-0x00007FF789760000-0x00007FF789B56000-memory.dmp

Filesize
4.0MB

Download
memory/4668-1564-0x00007FF75E870000-0x00007FF75EC66000-memory.dmp

Filesize
4.0MB

Download
memory/4668-662-0x00007FF75E870000-0x00007FF75EC66000-memory.dmp

Filesize
4.0MB

Download
memory/4728-6-0x00007FFD58FE3000-0x00007FFD58FE5000-memory.dmp

Filesize
8KB

Download
memory/4728-2596-0x00007FFD58FE3000-0x00007FFD58FE5000-memory.dmp

Filesize
8KB

Download
memory/4728-32-0x0000016E9D020000-0x0000016E9D042000-memory.dmp

Filesize
136KB

Download
memory/4728-56-0x00007FFD58FE0000-0x00007FFD59AA1000-memory.dmp

Filesize
10.8MB

Download
memory/4728-241-0x0000016E9DCD0000-0x0000016E9E476000-memory.dmp

Filesize
7.6MB

Download
memory/4728-2395-0x00007FFD58FE0000-0x00007FFD59AA1000-memory.dmp

Filesize
10.8MB

Download
memory/4728-50-0x00007FFD58FE0000-0x00007FFD59AA1000-memory.dmp

Filesize
10.8MB

Download
memory/4792-1298-0x00007FF6F90B0000-0x00007FF6F94A6000-memory.dmp

Filesize
4.0MB

Download
memory/4792-57-0x00007FF6F90B0000-0x00007FF6F94A6000-memory.dmp

Filesize
4.0MB

Download
memory/4896-656-0x00007FF7CC7E0000-0x00007FF7CCBD6000-memory.dmp

Filesize
4.0MB

Download
memory/4896-1529-0x00007FF7CC7E0000-0x00007FF7CCBD6000-memory.dmp

Filesize
4.0MB

Download
memory/4980-638-0x00007FF66FF20000-0x00007FF670316000-memory.dmp

Filesize
4.0MB

Download
memory/4980-1487-0x00007FF66FF20000-0x00007FF670316000-memory.dmp

Filesize
4.0MB

Download
memory/5000-1581-0x00007FF741AD0000-0x00007FF741EC6000-memory.dmp

Filesize
4.0MB

Download
memory/5000-665-0x00007FF741AD0000-0x00007FF741EC6000-memory.dmp

Filesize
4.0MB

Download