xmrig | 4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
Size

1.7MB
MD5

b1248a1a55e644c853311913f5f3a6ea
SHA1

e3828f9a34c4641a924a4366021835eb8084b6fe
SHA256

4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc
SHA512

8fd6512c79b28e0acc2eee7a0bd3f94a829292247406c96dd62c7d41f4e14bc8174148b9eda74a8d6cc31dcd6b120c85e5220d31097a03a7a99acd4a06bc1d6d
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9zh:Lz071uv4BPMkibTIA5lCx7kvRWa4pQD

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/4016-197-0x00007FF78D710000-0x00007FF78DB02000-memory.dmp	xmrig
behavioral2/memory/3208-208-0x00007FF6A9BB0000-0x00007FF6A9FA2000-memory.dmp	xmrig
behavioral2/memory/1564-214-0x00007FF7E1250000-0x00007FF7E1642000-memory.dmp	xmrig
behavioral2/memory/1560-216-0x00007FF7B6580000-0x00007FF7B6972000-memory.dmp	xmrig
behavioral2/memory/852-215-0x00007FF777400000-0x00007FF7777F2000-memory.dmp	xmrig
behavioral2/memory/5044-213-0x00007FF7340D0000-0x00007FF7344C2000-memory.dmp	xmrig
behavioral2/memory/3336-212-0x00007FF65C430000-0x00007FF65C822000-memory.dmp	xmrig
behavioral2/memory/3216-211-0x00007FF74B4F0000-0x00007FF74B8E2000-memory.dmp	xmrig
behavioral2/memory/3792-210-0x00007FF61C830000-0x00007FF61CC22000-memory.dmp	xmrig
behavioral2/memory/2712-209-0x00007FF664CD0000-0x00007FF6650C2000-memory.dmp	xmrig
behavioral2/memory/512-203-0x00007FF6D5460000-0x00007FF6D5852000-memory.dmp	xmrig
behavioral2/memory/4556-202-0x00007FF76C1B0000-0x00007FF76C5A2000-memory.dmp	xmrig
behavioral2/memory/2888-194-0x00007FF790B20000-0x00007FF790F12000-memory.dmp	xmrig
behavioral2/memory/956-177-0x00007FF681BE0000-0x00007FF681FD2000-memory.dmp	xmrig
behavioral2/memory/4244-176-0x00007FF63F330000-0x00007FF63F722000-memory.dmp	xmrig
behavioral2/memory/4672-148-0x00007FF6AF120000-0x00007FF6AF512000-memory.dmp	xmrig
behavioral2/memory/3344-116-0x00007FF702D90000-0x00007FF703182000-memory.dmp	xmrig
behavioral2/memory/876-87-0x00007FF7C25E0000-0x00007FF7C29D2000-memory.dmp	xmrig
behavioral2/memory/1208-62-0x00007FF6B6500000-0x00007FF6B68F2000-memory.dmp	xmrig
behavioral2/memory/1812-51-0x00007FF7628F0000-0x00007FF762CE2000-memory.dmp	xmrig
behavioral2/memory/2832-32-0x00007FF7CFE80000-0x00007FF7D0272000-memory.dmp	xmrig
behavioral2/memory/1208-4934-0x00007FF6B6500000-0x00007FF6B68F2000-memory.dmp	xmrig
behavioral2/memory/876-4931-0x00007FF7C25E0000-0x00007FF7C29D2000-memory.dmp	xmrig
behavioral2/memory/3344-4941-0x00007FF702D90000-0x00007FF703182000-memory.dmp	xmrig
behavioral2/memory/3336-4945-0x00007FF65C430000-0x00007FF65C822000-memory.dmp	xmrig
behavioral2/memory/1072-4951-0x00007FF6E9EB0000-0x00007FF6EA2A2000-memory.dmp	xmrig
behavioral2/memory/4672-4954-0x00007FF6AF120000-0x00007FF6AF512000-memory.dmp	xmrig
behavioral2/memory/956-4957-0x00007FF681BE0000-0x00007FF681FD2000-memory.dmp	xmrig
behavioral2/memory/852-4997-0x00007FF777400000-0x00007FF7777F2000-memory.dmp	xmrig
behavioral2/memory/3504-4964-0x00007FF666460000-0x00007FF666852000-memory.dmp	xmrig
behavioral2/memory/2888-4960-0x00007FF790B20000-0x00007FF790F12000-memory.dmp	xmrig
behavioral2/memory/5044-4947-0x00007FF7340D0000-0x00007FF7344C2000-memory.dmp	xmrig
behavioral2/memory/3792-5087-0x00007FF61C830000-0x00007FF61CC22000-memory.dmp	xmrig
behavioral2/memory/4244-5108-0x00007FF63F330000-0x00007FF63F722000-memory.dmp	xmrig
behavioral2/memory/4016-5140-0x00007FF78D710000-0x00007FF78DB02000-memory.dmp	xmrig
behavioral2/memory/4556-5136-0x00007FF76C1B0000-0x00007FF76C5A2000-memory.dmp	xmrig
behavioral2/memory/2712-5133-0x00007FF664CD0000-0x00007FF6650C2000-memory.dmp	xmrig
behavioral2/memory/3216-5132-0x00007FF74B4F0000-0x00007FF74B8E2000-memory.dmp	xmrig
behavioral2/memory/3208-5217-0x00007FF6A9BB0000-0x00007FF6A9FA2000-memory.dmp	xmrig
behavioral2/memory/512-5124-0x00007FF6D5460000-0x00007FF6D5852000-memory.dmp	xmrig
behavioral2/memory/1560-5128-0x00007FF7B6580000-0x00007FF7B6972000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	3892	powershell.exe
11	3892	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3892	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3432	bCiPSNR.exe
2832	RlOxABu.exe
1812	sVNSdtX.exe
3336	xXGCIUX.exe
1072	tKILsqk.exe
1208	wPdATDH.exe
876	VCEVlDF.exe
3344	pbQzBKG.exe
3504	OVldGPC.exe
4672	cZrtHET.exe
5044	yiPkosq.exe
4244	GsspEDS.exe
956	WMyUlJc.exe
2888	grzZpDQ.exe
1564	rWJyxIN.exe
852	KBJDhFJ.exe
4016	aXXaBpw.exe
4556	FnovRiK.exe
512	WzlLjMY.exe
3208	lQKVFHO.exe
2712	XJsMwxt.exe
3792	OiKxiwL.exe
3216	jrEbdmz.exe
1560	RHnZxeZ.exe
2112	bOLKEgx.exe
4744	Injyyzj.exe
812	tNONAVa.exe
4956	gORmLIK.exe
1048	xslgApj.exe
2316	bWCkiWG.exe
4476	lFpQbuF.exe
1408	ZyqoHmB.exe
4724	XYdzHfp.exe
4384	qbYZVsD.exe
4024	sdedbhY.exe
4468	PCjJckL.exe
848	iueNzSH.exe
2948	XtpKobe.exe
2452	bPlrgIm.exe
3368	ywCJFHp.exe
3896	KXbGWqy.exe
3024	XceRrNt.exe
1508	IfPrySh.exe
3412	pSKvpCw.exe
4156	GMuNIUX.exe
3944	eHKlJyw.exe
2148	AhxklAc.exe
4752	ZPhkwsR.exe
4464	bvCnwVX.exe
1592	jjYOhbp.exe
656	UNFfbnI.exe
3872	BblScmr.exe
1080	ujFawnD.exe
3328	baHMvkb.exe
3040	SewksTQ.exe
1972	aUIIIKu.exe
3592	gCzQQBd.exe
3204	hTJNRfh.exe
2576	tzTtiJx.exe
4332	dMGapXn.exe
2056	BGFPmnA.exe
1804	hZyXuug.exe
5072	GMVjjZb.exe
2304	zOnMAkO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/700-0-0x00007FF7BA2C0000-0x00007FF7BA6B2000-memory.dmp	upx
behavioral2/files/0x00070000000234e4-6.dat	upx
behavioral2/files/0x00070000000234e3-8.dat	upx
behavioral2/files/0x00080000000234df-7.dat	upx
behavioral2/files/0x00070000000234e7-37.dat	upx
behavioral2/files/0x00070000000234e9-61.dat	upx
behavioral2/files/0x00070000000234eb-91.dat	upx
behavioral2/files/0x0007000000023502-144.dat	upx
behavioral2/files/0x00070000000234f8-170.dat	upx
behavioral2/files/0x0007000000023505-180.dat	upx
behavioral2/memory/4016-197-0x00007FF78D710000-0x00007FF78DB02000-memory.dmp	upx
behavioral2/memory/3208-208-0x00007FF6A9BB0000-0x00007FF6A9FA2000-memory.dmp	upx
behavioral2/memory/1564-214-0x00007FF7E1250000-0x00007FF7E1642000-memory.dmp	upx
behavioral2/memory/1560-216-0x00007FF7B6580000-0x00007FF7B6972000-memory.dmp	upx
behavioral2/memory/852-215-0x00007FF777400000-0x00007FF7777F2000-memory.dmp	upx
behavioral2/memory/5044-213-0x00007FF7340D0000-0x00007FF7344C2000-memory.dmp	upx
behavioral2/memory/3336-212-0x00007FF65C430000-0x00007FF65C822000-memory.dmp	upx
behavioral2/memory/3216-211-0x00007FF74B4F0000-0x00007FF74B8E2000-memory.dmp	upx
behavioral2/memory/3792-210-0x00007FF61C830000-0x00007FF61CC22000-memory.dmp	upx
behavioral2/memory/2712-209-0x00007FF664CD0000-0x00007FF6650C2000-memory.dmp	upx
behavioral2/memory/512-203-0x00007FF6D5460000-0x00007FF6D5852000-memory.dmp	upx
behavioral2/memory/4556-202-0x00007FF76C1B0000-0x00007FF76C5A2000-memory.dmp	upx
behavioral2/memory/2888-194-0x00007FF790B20000-0x00007FF790F12000-memory.dmp	upx
behavioral2/files/0x00080000000234e0-179.dat	upx
behavioral2/files/0x0007000000023504-178.dat	upx
behavioral2/memory/956-177-0x00007FF681BE0000-0x00007FF681FD2000-memory.dmp	upx
behavioral2/memory/4244-176-0x00007FF63F330000-0x00007FF63F722000-memory.dmp	upx
behavioral2/files/0x00070000000234fe-166.dat	upx
behavioral2/files/0x00070000000234fc-164.dat	upx
behavioral2/files/0x00070000000234f7-162.dat	upx
behavioral2/files/0x00070000000234f1-155.dat	upx
behavioral2/files/0x00070000000234f9-153.dat	upx
behavioral2/files/0x0007000000023503-151.dat	upx
behavioral2/memory/4672-148-0x00007FF6AF120000-0x00007FF6AF512000-memory.dmp	upx
behavioral2/files/0x00070000000234f6-147.dat	upx
behavioral2/files/0x00070000000234f5-146.dat	upx
behavioral2/files/0x00070000000234f4-145.dat	upx
behavioral2/files/0x0007000000023501-143.dat	upx
behavioral2/files/0x0007000000023500-142.dat	upx
behavioral2/files/0x00070000000234f3-141.dat	upx
behavioral2/files/0x00070000000234fd-139.dat	upx
behavioral2/files/0x00070000000234fb-138.dat	upx
behavioral2/files/0x00070000000234fa-137.dat	upx
behavioral2/memory/3504-134-0x00007FF666460000-0x00007FF666852000-memory.dmp	upx
behavioral2/files/0x00070000000234f0-128.dat	upx
behavioral2/files/0x00070000000234ff-140.dat	upx
behavioral2/files/0x00070000000234f2-119.dat	upx
behavioral2/memory/3344-116-0x00007FF702D90000-0x00007FF703182000-memory.dmp	upx
behavioral2/files/0x00070000000234ef-100.dat	upx
behavioral2/files/0x00070000000234ec-94.dat	upx
behavioral2/files/0x00070000000234ea-88.dat	upx
behavioral2/memory/876-87-0x00007FF7C25E0000-0x00007FF7C29D2000-memory.dmp	upx
behavioral2/files/0x00070000000234ed-78.dat	upx
behavioral2/files/0x00070000000234e6-74.dat	upx
behavioral2/files/0x00070000000234e5-71.dat	upx
behavioral2/files/0x00070000000234ee-93.dat	upx
behavioral2/memory/1072-58-0x00007FF6E9EB0000-0x00007FF6EA2A2000-memory.dmp	upx
behavioral2/memory/1208-62-0x00007FF6B6500000-0x00007FF6B68F2000-memory.dmp	upx
behavioral2/memory/1812-51-0x00007FF7628F0000-0x00007FF762CE2000-memory.dmp	upx
behavioral2/files/0x00070000000234e8-40.dat	upx
behavioral2/memory/2832-32-0x00007FF7CFE80000-0x00007FF7D0272000-memory.dmp	upx
behavioral2/memory/3432-24-0x00007FF6F71E0000-0x00007FF6F75D2000-memory.dmp	upx
behavioral2/memory/1208-4934-0x00007FF6B6500000-0x00007FF6B68F2000-memory.dmp	upx
behavioral2/memory/876-4931-0x00007FF7C25E0000-0x00007FF7C29D2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KXbGWqy.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\dpHyHKK.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\hUhennp.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\YrrETDy.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\EKdNdsw.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\FKBqCPL.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\JDsYUQc.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\HsTxqGz.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\HsWQamW.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\CqUNIGq.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\dNKSYMt.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\KPGaVgb.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\MgMsxbj.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\NJOwgrs.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\TBGnCZg.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\quMtqXC.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\ettoIWU.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\fqzqdMR.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\STDjKLW.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\PkeYziq.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\AsYXfUy.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\jRfAllW.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\jBmVCzX.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\DyegblJ.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\pKlXxDi.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\WzMUqcL.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\xPnNefU.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\AlJMdtt.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\OkgViXT.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\mXNINyw.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\uKleVxd.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\MumXcSr.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\AXydjdf.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\CPWvXlr.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\UjvIDjL.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\caiGidh.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\bLcUrcw.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\snDrnIo.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\kDPznTZ.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\gWJezDh.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\dqhzeNL.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\EnBWxWl.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\NmjTWqt.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\YIrLwIy.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\qiSGCQA.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\fdtxTfR.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\UpBLTaw.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\qJCCdfG.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\FvlnmSc.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\wiSwrAR.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\RzdaFSr.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\rdzKffW.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\PLapJQq.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\LdzVTpi.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\irikUSk.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\WHRdfvd.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\MrlUxDh.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\DNOwULx.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\JrSIrxZ.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\OBCMwFA.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\KxZiBuX.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\xZnHvlZ.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\KWTFciE.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
File created	C:\Windows\System\UFVvnAA.exe	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3892	powershell.exe
3892	powershell.exe
3892	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
Token: SeLockMemoryPrivilege	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
Token: SeDebugPrivilege	3892	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 3892	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	85
PID 700 wrote to memory of 3892	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	85
PID 700 wrote to memory of 3432	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	86
PID 700 wrote to memory of 3432	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	86
PID 700 wrote to memory of 2832	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	87
PID 700 wrote to memory of 2832	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	87
PID 700 wrote to memory of 1812	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	88
PID 700 wrote to memory of 1812	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	88
PID 700 wrote to memory of 3336	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	89
PID 700 wrote to memory of 3336	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	89
PID 700 wrote to memory of 1072	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	90
PID 700 wrote to memory of 1072	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	90
PID 700 wrote to memory of 1208	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	91
PID 700 wrote to memory of 1208	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	91
PID 700 wrote to memory of 876	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	92
PID 700 wrote to memory of 876	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	92
PID 700 wrote to memory of 3344	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	93
PID 700 wrote to memory of 3344	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	93
PID 700 wrote to memory of 3504	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	94
PID 700 wrote to memory of 3504	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	94
PID 700 wrote to memory of 4244	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	95
PID 700 wrote to memory of 4244	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	95
PID 700 wrote to memory of 4672	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	96
PID 700 wrote to memory of 4672	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	96
PID 700 wrote to memory of 5044	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	97
PID 700 wrote to memory of 5044	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	97
PID 700 wrote to memory of 956	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	98
PID 700 wrote to memory of 956	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	98
PID 700 wrote to memory of 2888	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	99
PID 700 wrote to memory of 2888	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	99
PID 700 wrote to memory of 1564	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	100
PID 700 wrote to memory of 1564	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	100
PID 700 wrote to memory of 3792	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	101
PID 700 wrote to memory of 3792	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	101
PID 700 wrote to memory of 852	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	102
PID 700 wrote to memory of 852	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	102
PID 700 wrote to memory of 4016	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	103
PID 700 wrote to memory of 4016	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	103
PID 700 wrote to memory of 4556	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	104
PID 700 wrote to memory of 4556	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	104
PID 700 wrote to memory of 512	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	105
PID 700 wrote to memory of 512	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	105
PID 700 wrote to memory of 3208	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	106
PID 700 wrote to memory of 3208	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	106
PID 700 wrote to memory of 2712	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	107
PID 700 wrote to memory of 2712	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	107
PID 700 wrote to memory of 3216	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	108
PID 700 wrote to memory of 3216	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	108
PID 700 wrote to memory of 1560	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	109
PID 700 wrote to memory of 1560	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	109
PID 700 wrote to memory of 4956	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	110
PID 700 wrote to memory of 4956	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	110
PID 700 wrote to memory of 1048	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	111
PID 700 wrote to memory of 1048	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	111
PID 700 wrote to memory of 2112	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	112
PID 700 wrote to memory of 2112	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	112
PID 700 wrote to memory of 4744	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	113
PID 700 wrote to memory of 4744	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	113
PID 700 wrote to memory of 812	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	114
PID 700 wrote to memory of 812	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	114
PID 700 wrote to memory of 2316	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	115
PID 700 wrote to memory of 2316	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	115
PID 700 wrote to memory of 4476	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	116
PID 700 wrote to memory of 4476	700	4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe	116

C:\Users\Admin\AppData\Local\Temp\4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe
"C:\Users\Admin\AppData\Local\Temp\4e568df7bb6d771e42477b7ff01502548988a8ed0914c59dcd54cc9ae7c289fc.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3892" "2944" "2900" "2948" "0" "0" "2952" "0" "0" "0" "0" "0"
    3⤵
    PID:13328
- C:\Windows\System\bCiPSNR.exe
  C:\Windows\System\bCiPSNR.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\RlOxABu.exe
  C:\Windows\System\RlOxABu.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\sVNSdtX.exe
  C:\Windows\System\sVNSdtX.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\xXGCIUX.exe
  C:\Windows\System\xXGCIUX.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\tKILsqk.exe
  C:\Windows\System\tKILsqk.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\wPdATDH.exe
  C:\Windows\System\wPdATDH.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\VCEVlDF.exe
  C:\Windows\System\VCEVlDF.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\pbQzBKG.exe
  C:\Windows\System\pbQzBKG.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\OVldGPC.exe
  C:\Windows\System\OVldGPC.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\GsspEDS.exe
  C:\Windows\System\GsspEDS.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\cZrtHET.exe
  C:\Windows\System\cZrtHET.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\yiPkosq.exe
  C:\Windows\System\yiPkosq.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\WMyUlJc.exe
  C:\Windows\System\WMyUlJc.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\grzZpDQ.exe
  C:\Windows\System\grzZpDQ.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\rWJyxIN.exe
  C:\Windows\System\rWJyxIN.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\OiKxiwL.exe
  C:\Windows\System\OiKxiwL.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\KBJDhFJ.exe
  C:\Windows\System\KBJDhFJ.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\aXXaBpw.exe
  C:\Windows\System\aXXaBpw.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\FnovRiK.exe
  C:\Windows\System\FnovRiK.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\WzlLjMY.exe
  C:\Windows\System\WzlLjMY.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\lQKVFHO.exe
  C:\Windows\System\lQKVFHO.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\XJsMwxt.exe
  C:\Windows\System\XJsMwxt.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\jrEbdmz.exe
  C:\Windows\System\jrEbdmz.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\RHnZxeZ.exe
  C:\Windows\System\RHnZxeZ.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\gORmLIK.exe
  C:\Windows\System\gORmLIK.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\xslgApj.exe
  C:\Windows\System\xslgApj.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\bOLKEgx.exe
  C:\Windows\System\bOLKEgx.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\Injyyzj.exe
  C:\Windows\System\Injyyzj.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\tNONAVa.exe
  C:\Windows\System\tNONAVa.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\bWCkiWG.exe
  C:\Windows\System\bWCkiWG.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\lFpQbuF.exe
  C:\Windows\System\lFpQbuF.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\ZyqoHmB.exe
  C:\Windows\System\ZyqoHmB.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\XYdzHfp.exe
  C:\Windows\System\XYdzHfp.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\qbYZVsD.exe
  C:\Windows\System\qbYZVsD.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\sdedbhY.exe
  C:\Windows\System\sdedbhY.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\PCjJckL.exe
  C:\Windows\System\PCjJckL.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\iueNzSH.exe
  C:\Windows\System\iueNzSH.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\XtpKobe.exe
  C:\Windows\System\XtpKobe.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\bPlrgIm.exe
  C:\Windows\System\bPlrgIm.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\ywCJFHp.exe
  C:\Windows\System\ywCJFHp.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\KXbGWqy.exe
  C:\Windows\System\KXbGWqy.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\XceRrNt.exe
  C:\Windows\System\XceRrNt.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\IfPrySh.exe
  C:\Windows\System\IfPrySh.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\pSKvpCw.exe
  C:\Windows\System\pSKvpCw.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\GMuNIUX.exe
  C:\Windows\System\GMuNIUX.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\eHKlJyw.exe
  C:\Windows\System\eHKlJyw.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\AhxklAc.exe
  C:\Windows\System\AhxklAc.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\ZPhkwsR.exe
  C:\Windows\System\ZPhkwsR.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\bvCnwVX.exe
  C:\Windows\System\bvCnwVX.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\jjYOhbp.exe
  C:\Windows\System\jjYOhbp.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\UNFfbnI.exe
  C:\Windows\System\UNFfbnI.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\BblScmr.exe
  C:\Windows\System\BblScmr.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\tzTtiJx.exe
  C:\Windows\System\tzTtiJx.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\ujFawnD.exe
  C:\Windows\System\ujFawnD.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\baHMvkb.exe
  C:\Windows\System\baHMvkb.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\SewksTQ.exe
  C:\Windows\System\SewksTQ.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\aUIIIKu.exe
  C:\Windows\System\aUIIIKu.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\gCzQQBd.exe
  C:\Windows\System\gCzQQBd.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\hTJNRfh.exe
  C:\Windows\System\hTJNRfh.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\dMGapXn.exe
  C:\Windows\System\dMGapXn.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\BGFPmnA.exe
  C:\Windows\System\BGFPmnA.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\hZyXuug.exe
  C:\Windows\System\hZyXuug.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\GMVjjZb.exe
  C:\Windows\System\GMVjjZb.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\zOnMAkO.exe
  C:\Windows\System\zOnMAkO.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\hKQIvua.exe
  C:\Windows\System\hKQIvua.exe
  2⤵
  PID:4612
- C:\Windows\System\ghDjBbA.exe
  C:\Windows\System\ghDjBbA.exe
  2⤵
  PID:1644
- C:\Windows\System\LJyeDGl.exe
  C:\Windows\System\LJyeDGl.exe
  2⤵
  PID:264
- C:\Windows\System\vUgkhsQ.exe
  C:\Windows\System\vUgkhsQ.exe
  2⤵
  PID:3520
- C:\Windows\System\uNiwWJF.exe
  C:\Windows\System\uNiwWJF.exe
  2⤵
  PID:3632
- C:\Windows\System\noUtcMo.exe
  C:\Windows\System\noUtcMo.exe
  2⤵
  PID:4140
- C:\Windows\System\KzFyRJA.exe
  C:\Windows\System\KzFyRJA.exe
  2⤵
  PID:3920
- C:\Windows\System\RwdEqfD.exe
  C:\Windows\System\RwdEqfD.exe
  2⤵
  PID:4832
- C:\Windows\System\hjyubnB.exe
  C:\Windows\System\hjyubnB.exe
  2⤵
  PID:380
- C:\Windows\System\dhyElKW.exe
  C:\Windows\System\dhyElKW.exe
  2⤵
  PID:3556
- C:\Windows\System\CKASbwP.exe
  C:\Windows\System\CKASbwP.exe
  2⤵
  PID:3340
- C:\Windows\System\QqRPJgb.exe
  C:\Windows\System\QqRPJgb.exe
  2⤵
  PID:3288
- C:\Windows\System\lkQlFjj.exe
  C:\Windows\System\lkQlFjj.exe
  2⤵
  PID:2504
- C:\Windows\System\vMVwyuy.exe
  C:\Windows\System\vMVwyuy.exe
  2⤵
  PID:1708
- C:\Windows\System\kqFZXPb.exe
  C:\Windows\System\kqFZXPb.exe
  2⤵
  PID:4812
- C:\Windows\System\YmKZzup.exe
  C:\Windows\System\YmKZzup.exe
  2⤵
  PID:3624
- C:\Windows\System\PMLnesW.exe
  C:\Windows\System\PMLnesW.exe
  2⤵
  PID:4664
- C:\Windows\System\xhgbRJc.exe
  C:\Windows\System\xhgbRJc.exe
  2⤵
  PID:1220
- C:\Windows\System\SOuTsnE.exe
  C:\Windows\System\SOuTsnE.exe
  2⤵
  PID:1156
- C:\Windows\System\MwmVSnS.exe
  C:\Windows\System\MwmVSnS.exe
  2⤵
  PID:1356
- C:\Windows\System\aUeHqIc.exe
  C:\Windows\System\aUeHqIc.exe
  2⤵
  PID:4992
- C:\Windows\System\oQPXyXW.exe
  C:\Windows\System\oQPXyXW.exe
  2⤵
  PID:3996
- C:\Windows\System\oevsHva.exe
  C:\Windows\System\oevsHva.exe
  2⤵
  PID:1716
- C:\Windows\System\uefhYJc.exe
  C:\Windows\System\uefhYJc.exe
  2⤵
  PID:4208
- C:\Windows\System\qWYuVYg.exe
  C:\Windows\System\qWYuVYg.exe
  2⤵
  PID:5128
- C:\Windows\System\WnLGpge.exe
  C:\Windows\System\WnLGpge.exe
  2⤵
  PID:5156
- C:\Windows\System\zBxfxwP.exe
  C:\Windows\System\zBxfxwP.exe
  2⤵
  PID:5176
- C:\Windows\System\FKKxUWV.exe
  C:\Windows\System\FKKxUWV.exe
  2⤵
  PID:5196
- C:\Windows\System\KGLdsBV.exe
  C:\Windows\System\KGLdsBV.exe
  2⤵
  PID:5220
- C:\Windows\System\wCdjpUn.exe
  C:\Windows\System\wCdjpUn.exe
  2⤵
  PID:5240
- C:\Windows\System\cPJWnoq.exe
  C:\Windows\System\cPJWnoq.exe
  2⤵
  PID:5256
- C:\Windows\System\jmMympv.exe
  C:\Windows\System\jmMympv.exe
  2⤵
  PID:5280
- C:\Windows\System\wJWnDOG.exe
  C:\Windows\System\wJWnDOG.exe
  2⤵
  PID:5300
- C:\Windows\System\FBZrXkq.exe
  C:\Windows\System\FBZrXkq.exe
  2⤵
  PID:5320
- C:\Windows\System\dObwqgn.exe
  C:\Windows\System\dObwqgn.exe
  2⤵
  PID:5336
- C:\Windows\System\XkpOkRQ.exe
  C:\Windows\System\XkpOkRQ.exe
  2⤵
  PID:5360
- C:\Windows\System\hZWsLmL.exe
  C:\Windows\System\hZWsLmL.exe
  2⤵
  PID:5376
- C:\Windows\System\sbXVNxI.exe
  C:\Windows\System\sbXVNxI.exe
  2⤵
  PID:5404
- C:\Windows\System\imIJStr.exe
  C:\Windows\System\imIJStr.exe
  2⤵
  PID:5440
- C:\Windows\System\iikKiqX.exe
  C:\Windows\System\iikKiqX.exe
  2⤵
  PID:5460
- C:\Windows\System\ioOoQCa.exe
  C:\Windows\System\ioOoQCa.exe
  2⤵
  PID:5484
- C:\Windows\System\gjGNyxJ.exe
  C:\Windows\System\gjGNyxJ.exe
  2⤵
  PID:5504
- C:\Windows\System\XMXmCDN.exe
  C:\Windows\System\XMXmCDN.exe
  2⤵
  PID:5528
- C:\Windows\System\jptsnWb.exe
  C:\Windows\System\jptsnWb.exe
  2⤵
  PID:5556
- C:\Windows\System\FtozQQb.exe
  C:\Windows\System\FtozQQb.exe
  2⤵
  PID:5576
- C:\Windows\System\JDlOUcP.exe
  C:\Windows\System\JDlOUcP.exe
  2⤵
  PID:5600
- C:\Windows\System\rKnSbxS.exe
  C:\Windows\System\rKnSbxS.exe
  2⤵
  PID:5616
- C:\Windows\System\UWXSsOq.exe
  C:\Windows\System\UWXSsOq.exe
  2⤵
  PID:5636
- C:\Windows\System\GejyRxM.exe
  C:\Windows\System\GejyRxM.exe
  2⤵
  PID:5660
- C:\Windows\System\mSEzGWx.exe
  C:\Windows\System\mSEzGWx.exe
  2⤵
  PID:5680
- C:\Windows\System\BOjnCiy.exe
  C:\Windows\System\BOjnCiy.exe
  2⤵
  PID:5700
- C:\Windows\System\BoxMbal.exe
  C:\Windows\System\BoxMbal.exe
  2⤵
  PID:5732
- C:\Windows\System\AnlVdqB.exe
  C:\Windows\System\AnlVdqB.exe
  2⤵
  PID:5752
- C:\Windows\System\BWbvSzE.exe
  C:\Windows\System\BWbvSzE.exe
  2⤵
  PID:5776
- C:\Windows\System\UbXmfMQ.exe
  C:\Windows\System\UbXmfMQ.exe
  2⤵
  PID:5796
- C:\Windows\System\WKNkokE.exe
  C:\Windows\System\WKNkokE.exe
  2⤵
  PID:5820
- C:\Windows\System\JropYJr.exe
  C:\Windows\System\JropYJr.exe
  2⤵
  PID:5836
- C:\Windows\System\DEgIckD.exe
  C:\Windows\System\DEgIckD.exe
  2⤵
  PID:5860
- C:\Windows\System\GWVMNPT.exe
  C:\Windows\System\GWVMNPT.exe
  2⤵
  PID:5876
- C:\Windows\System\nVfGZqO.exe
  C:\Windows\System\nVfGZqO.exe
  2⤵
  PID:5900
- C:\Windows\System\tllbqWR.exe
  C:\Windows\System\tllbqWR.exe
  2⤵
  PID:5920
- C:\Windows\System\oPzfejw.exe
  C:\Windows\System\oPzfejw.exe
  2⤵
  PID:5944
- C:\Windows\System\vOtvCDw.exe
  C:\Windows\System\vOtvCDw.exe
  2⤵
  PID:5964
- C:\Windows\System\qqTVCrH.exe
  C:\Windows\System\qqTVCrH.exe
  2⤵
  PID:5988
- C:\Windows\System\YQzbSKk.exe
  C:\Windows\System\YQzbSKk.exe
  2⤵
  PID:6012
- C:\Windows\System\mtJZfyY.exe
  C:\Windows\System\mtJZfyY.exe
  2⤵
  PID:6032
- C:\Windows\System\kHvxurS.exe
  C:\Windows\System\kHvxurS.exe
  2⤵
  PID:6052
- C:\Windows\System\hvhoYyh.exe
  C:\Windows\System\hvhoYyh.exe
  2⤵
  PID:6076
- C:\Windows\System\GHEciuV.exe
  C:\Windows\System\GHEciuV.exe
  2⤵
  PID:6096
- C:\Windows\System\CKBrNvx.exe
  C:\Windows\System\CKBrNvx.exe
  2⤵
  PID:6120
- C:\Windows\System\RYVhZJq.exe
  C:\Windows\System\RYVhZJq.exe
  2⤵
  PID:6136
- C:\Windows\System\gDzNLoL.exe
  C:\Windows\System\gDzNLoL.exe
  2⤵
  PID:4652
- C:\Windows\System\puCdCiH.exe
  C:\Windows\System\puCdCiH.exe
  2⤵
  PID:2696
- C:\Windows\System\DklJfnd.exe
  C:\Windows\System\DklJfnd.exe
  2⤵
  PID:5092
- C:\Windows\System\vtyPdZq.exe
  C:\Windows\System\vtyPdZq.exe
  2⤵
  PID:4092
- C:\Windows\System\nPZRQwN.exe
  C:\Windows\System\nPZRQwN.exe
  2⤵
  PID:5356
- C:\Windows\System\YayCCer.exe
  C:\Windows\System\YayCCer.exe
  2⤵
  PID:5208
- C:\Windows\System\uHlqOwU.exe
  C:\Windows\System\uHlqOwU.exe
  2⤵
  PID:1084
- C:\Windows\System\GrbahCJ.exe
  C:\Windows\System\GrbahCJ.exe
  2⤵
  PID:2892
- C:\Windows\System\NMnStMw.exe
  C:\Windows\System\NMnStMw.exe
  2⤵
  PID:4220
- C:\Windows\System\cyYYWVG.exe
  C:\Windows\System\cyYYWVG.exe
  2⤵
  PID:2816
- C:\Windows\System\IOATHyp.exe
  C:\Windows\System\IOATHyp.exe
  2⤵
  PID:4848
- C:\Windows\System\CkELtAc.exe
  C:\Windows\System\CkELtAc.exe
  2⤵
  PID:5172
- C:\Windows\System\qeNytBQ.exe
  C:\Windows\System\qeNytBQ.exe
  2⤵
  PID:5748
- C:\Windows\System\OfGWsiA.exe
  C:\Windows\System\OfGWsiA.exe
  2⤵
  PID:5252
- C:\Windows\System\qHVEYsC.exe
  C:\Windows\System\qHVEYsC.exe
  2⤵
  PID:5308
- C:\Windows\System\vxwykiw.exe
  C:\Windows\System\vxwykiw.exe
  2⤵
  PID:5568
- C:\Windows\System\uzEYNYZ.exe
  C:\Windows\System\uzEYNYZ.exe
  2⤵
  PID:6148
- C:\Windows\System\tjStHtH.exe
  C:\Windows\System\tjStHtH.exe
  2⤵
  PID:6172
- C:\Windows\System\uFmUvQz.exe
  C:\Windows\System\uFmUvQz.exe
  2⤵
  PID:6192
- C:\Windows\System\OsLArUI.exe
  C:\Windows\System\OsLArUI.exe
  2⤵
  PID:6212
- C:\Windows\System\nRsOdQr.exe
  C:\Windows\System\nRsOdQr.exe
  2⤵
  PID:6236
- C:\Windows\System\VCgFgyz.exe
  C:\Windows\System\VCgFgyz.exe
  2⤵
  PID:6260
- C:\Windows\System\DrPDSRh.exe
  C:\Windows\System\DrPDSRh.exe
  2⤵
  PID:6280
- C:\Windows\System\UBwCBDD.exe
  C:\Windows\System\UBwCBDD.exe
  2⤵
  PID:6304
- C:\Windows\System\gxLxblj.exe
  C:\Windows\System\gxLxblj.exe
  2⤵
  PID:6324
- C:\Windows\System\ZnxNaDQ.exe
  C:\Windows\System\ZnxNaDQ.exe
  2⤵
  PID:6352
- C:\Windows\System\qtqReNT.exe
  C:\Windows\System\qtqReNT.exe
  2⤵
  PID:6368
- C:\Windows\System\CWoHpzV.exe
  C:\Windows\System\CWoHpzV.exe
  2⤵
  PID:6396
- C:\Windows\System\oaZwgMM.exe
  C:\Windows\System\oaZwgMM.exe
  2⤵
  PID:6412
- C:\Windows\System\SqLuNWK.exe
  C:\Windows\System\SqLuNWK.exe
  2⤵
  PID:6440
- C:\Windows\System\GZzmtGx.exe
  C:\Windows\System\GZzmtGx.exe
  2⤵
  PID:6460
- C:\Windows\System\hmVdSlr.exe
  C:\Windows\System\hmVdSlr.exe
  2⤵
  PID:6480
- C:\Windows\System\FLqfsSQ.exe
  C:\Windows\System\FLqfsSQ.exe
  2⤵
  PID:6504
- C:\Windows\System\OxrslEr.exe
  C:\Windows\System\OxrslEr.exe
  2⤵
  PID:6532
- C:\Windows\System\LuLZiyy.exe
  C:\Windows\System\LuLZiyy.exe
  2⤵
  PID:6548
- C:\Windows\System\OyvRqwW.exe
  C:\Windows\System\OyvRqwW.exe
  2⤵
  PID:6572
- C:\Windows\System\TtTqQdT.exe
  C:\Windows\System\TtTqQdT.exe
  2⤵
  PID:6592
- C:\Windows\System\TwKgaxY.exe
  C:\Windows\System\TwKgaxY.exe
  2⤵
  PID:6620
- C:\Windows\System\KIycdyL.exe
  C:\Windows\System\KIycdyL.exe
  2⤵
  PID:6636
- C:\Windows\System\rnIyYJw.exe
  C:\Windows\System\rnIyYJw.exe
  2⤵
  PID:6664
- C:\Windows\System\bsBgJpU.exe
  C:\Windows\System\bsBgJpU.exe
  2⤵
  PID:6680
- C:\Windows\System\NpGehsN.exe
  C:\Windows\System\NpGehsN.exe
  2⤵
  PID:6708
- C:\Windows\System\YxQAYxY.exe
  C:\Windows\System\YxQAYxY.exe
  2⤵
  PID:6724
- C:\Windows\System\JdOHDWD.exe
  C:\Windows\System\JdOHDWD.exe
  2⤵
  PID:6744
- C:\Windows\System\SyXbROb.exe
  C:\Windows\System\SyXbROb.exe
  2⤵
  PID:6760
- C:\Windows\System\lpLpVQk.exe
  C:\Windows\System\lpLpVQk.exe
  2⤵
  PID:6784
- C:\Windows\System\yekXTdk.exe
  C:\Windows\System\yekXTdk.exe
  2⤵
  PID:6808
- C:\Windows\System\DFuRaGE.exe
  C:\Windows\System\DFuRaGE.exe
  2⤵
  PID:6824
- C:\Windows\System\OwlzJVm.exe
  C:\Windows\System\OwlzJVm.exe
  2⤵
  PID:6848
- C:\Windows\System\BKCAUOA.exe
  C:\Windows\System\BKCAUOA.exe
  2⤵
  PID:6868
- C:\Windows\System\ctEoQYj.exe
  C:\Windows\System\ctEoQYj.exe
  2⤵
  PID:6892
- C:\Windows\System\yrhHJLD.exe
  C:\Windows\System\yrhHJLD.exe
  2⤵
  PID:6916
- C:\Windows\System\GzZEPfO.exe
  C:\Windows\System\GzZEPfO.exe
  2⤵
  PID:6932
- C:\Windows\System\ESGLLRY.exe
  C:\Windows\System\ESGLLRY.exe
  2⤵
  PID:6956
- C:\Windows\System\TulIZvg.exe
  C:\Windows\System\TulIZvg.exe
  2⤵
  PID:6976
- C:\Windows\System\KsmJYQF.exe
  C:\Windows\System\KsmJYQF.exe
  2⤵
  PID:6992
- C:\Windows\System\MAcNVfa.exe
  C:\Windows\System\MAcNVfa.exe
  2⤵
  PID:7016
- C:\Windows\System\gupwZYF.exe
  C:\Windows\System\gupwZYF.exe
  2⤵
  PID:7036
- C:\Windows\System\rnyujFe.exe
  C:\Windows\System\rnyujFe.exe
  2⤵
  PID:7056
- C:\Windows\System\JgwUOxU.exe
  C:\Windows\System\JgwUOxU.exe
  2⤵
  PID:7076
- C:\Windows\System\xKsKzTG.exe
  C:\Windows\System\xKsKzTG.exe
  2⤵
  PID:7100
- C:\Windows\System\FkmEynu.exe
  C:\Windows\System\FkmEynu.exe
  2⤵
  PID:7120
- C:\Windows\System\ftVnlhL.exe
  C:\Windows\System\ftVnlhL.exe
  2⤵
  PID:7144
- C:\Windows\System\dWLCnJl.exe
  C:\Windows\System\dWLCnJl.exe
  2⤵
  PID:7160
- C:\Windows\System\vNoRBuk.exe
  C:\Windows\System\vNoRBuk.exe
  2⤵
  PID:5932
- C:\Windows\System\udAJNQG.exe
  C:\Windows\System\udAJNQG.exe
  2⤵
  PID:5668
- C:\Windows\System\glonpwB.exe
  C:\Windows\System\glonpwB.exe
  2⤵
  PID:5492
- C:\Windows\System\vDIvwyC.exe
  C:\Windows\System\vDIvwyC.exe
  2⤵
  PID:1820
- C:\Windows\System\HZPwDRG.exe
  C:\Windows\System\HZPwDRG.exe
  2⤵
  PID:1628
- C:\Windows\System\qLkLBde.exe
  C:\Windows\System\qLkLBde.exe
  2⤵
  PID:5500
- C:\Windows\System\fCfABFJ.exe
  C:\Windows\System\fCfABFJ.exe
  2⤵
  PID:5572
- C:\Windows\System\VlXNdCv.exe
  C:\Windows\System\VlXNdCv.exe
  2⤵
  PID:5896
- C:\Windows\System\FpPqMsa.exe
  C:\Windows\System\FpPqMsa.exe
  2⤵
  PID:5652
- C:\Windows\System\qSmTiZP.exe
  C:\Windows\System\qSmTiZP.exe
  2⤵
  PID:6048
- C:\Windows\System\yuIQWPV.exe
  C:\Windows\System\yuIQWPV.exe
  2⤵
  PID:6092
- C:\Windows\System\hxzPWqy.exe
  C:\Windows\System\hxzPWqy.exe
  2⤵
  PID:3568
- C:\Windows\System\mgGbaxC.exe
  C:\Windows\System\mgGbaxC.exe
  2⤵
  PID:6388
- C:\Windows\System\NsjUSka.exe
  C:\Windows\System\NsjUSka.exe
  2⤵
  PID:2412
- C:\Windows\System\ZzYiRET.exe
  C:\Windows\System\ZzYiRET.exe
  2⤵
  PID:6608
- C:\Windows\System\CqcbAwb.exe
  C:\Windows\System\CqcbAwb.exe
  2⤵
  PID:5296
- C:\Windows\System\OeFUPwc.exe
  C:\Windows\System\OeFUPwc.exe
  2⤵
  PID:5812
- C:\Windows\System\JhhVLuu.exe
  C:\Windows\System\JhhVLuu.exe
  2⤵
  PID:5392
- C:\Windows\System\plsBawK.exe
  C:\Windows\System\plsBawK.exe
  2⤵
  PID:6732
- C:\Windows\System\rANEjUj.exe
  C:\Windows\System\rANEjUj.exe
  2⤵
  PID:6160
- C:\Windows\System\OxXwakw.exe
  C:\Windows\System\OxXwakw.exe
  2⤵
  PID:5940
- C:\Windows\System\UgZdKDr.exe
  C:\Windows\System\UgZdKDr.exe
  2⤵
  PID:5972
- C:\Windows\System\zwDpHon.exe
  C:\Windows\System\zwDpHon.exe
  2⤵
  PID:6020
- C:\Windows\System\Jswnmiw.exe
  C:\Windows\System\Jswnmiw.exe
  2⤵
  PID:7180
- C:\Windows\System\EnBWxWl.exe
  C:\Windows\System\EnBWxWl.exe
  2⤵
  PID:7200
- C:\Windows\System\oteAgKB.exe
  C:\Windows\System\oteAgKB.exe
  2⤵
  PID:7220
- C:\Windows\System\rdoyKOK.exe
  C:\Windows\System\rdoyKOK.exe
  2⤵
  PID:7248
- C:\Windows\System\qMGuKkY.exe
  C:\Windows\System\qMGuKkY.exe
  2⤵
  PID:7264
- C:\Windows\System\KBqJiGl.exe
  C:\Windows\System\KBqJiGl.exe
  2⤵
  PID:7288
- C:\Windows\System\XeroAcK.exe
  C:\Windows\System\XeroAcK.exe
  2⤵
  PID:7312
- C:\Windows\System\uZuNxlP.exe
  C:\Windows\System\uZuNxlP.exe
  2⤵
  PID:7328
- C:\Windows\System\qSIfOsg.exe
  C:\Windows\System\qSIfOsg.exe
  2⤵
  PID:7356
- C:\Windows\System\zSXbzeP.exe
  C:\Windows\System\zSXbzeP.exe
  2⤵
  PID:7376
- C:\Windows\System\InWtueI.exe
  C:\Windows\System\InWtueI.exe
  2⤵
  PID:7400
- C:\Windows\System\KjjsMXi.exe
  C:\Windows\System\KjjsMXi.exe
  2⤵
  PID:7416
- C:\Windows\System\HsDbMNy.exe
  C:\Windows\System\HsDbMNy.exe
  2⤵
  PID:7440
- C:\Windows\System\PZSOYKj.exe
  C:\Windows\System\PZSOYKj.exe
  2⤵
  PID:7464
- C:\Windows\System\duwIFjw.exe
  C:\Windows\System\duwIFjw.exe
  2⤵
  PID:7484
- C:\Windows\System\zNlQiaH.exe
  C:\Windows\System\zNlQiaH.exe
  2⤵
  PID:7504
- C:\Windows\System\JxTLkzm.exe
  C:\Windows\System\JxTLkzm.exe
  2⤵
  PID:7528
- C:\Windows\System\VkMKzAx.exe
  C:\Windows\System\VkMKzAx.exe
  2⤵
  PID:7548
- C:\Windows\System\Gwgswlh.exe
  C:\Windows\System\Gwgswlh.exe
  2⤵
  PID:7572
- C:\Windows\System\GCFIQwZ.exe
  C:\Windows\System\GCFIQwZ.exe
  2⤵
  PID:7588
- C:\Windows\System\IzsmFWP.exe
  C:\Windows\System\IzsmFWP.exe
  2⤵
  PID:7608
- C:\Windows\System\xUPgKzx.exe
  C:\Windows\System\xUPgKzx.exe
  2⤵
  PID:7628
- C:\Windows\System\WuxFrCh.exe
  C:\Windows\System\WuxFrCh.exe
  2⤵
  PID:7648
- C:\Windows\System\gOfUHmZ.exe
  C:\Windows\System\gOfUHmZ.exe
  2⤵
  PID:7664
- C:\Windows\System\fEGyzbx.exe
  C:\Windows\System\fEGyzbx.exe
  2⤵
  PID:7688
- C:\Windows\System\dROOHsG.exe
  C:\Windows\System\dROOHsG.exe
  2⤵
  PID:7708
- C:\Windows\System\CqzRWeV.exe
  C:\Windows\System\CqzRWeV.exe
  2⤵
  PID:7728
- C:\Windows\System\tVtHiYV.exe
  C:\Windows\System\tVtHiYV.exe
  2⤵
  PID:7756
- C:\Windows\System\eftRfbh.exe
  C:\Windows\System\eftRfbh.exe
  2⤵
  PID:7772
- C:\Windows\System\thejlby.exe
  C:\Windows\System\thejlby.exe
  2⤵
  PID:7796
- C:\Windows\System\qefCBRp.exe
  C:\Windows\System\qefCBRp.exe
  2⤵
  PID:7820
- C:\Windows\System\weqDcRL.exe
  C:\Windows\System\weqDcRL.exe
  2⤵
  PID:7844
- C:\Windows\System\CviJUcu.exe
  C:\Windows\System\CviJUcu.exe
  2⤵
  PID:7868
- C:\Windows\System\mVYhtcn.exe
  C:\Windows\System\mVYhtcn.exe
  2⤵
  PID:7892
- C:\Windows\System\tNFWrRX.exe
  C:\Windows\System\tNFWrRX.exe
  2⤵
  PID:7916
- C:\Windows\System\PrPbzUi.exe
  C:\Windows\System\PrPbzUi.exe
  2⤵
  PID:7932
- C:\Windows\System\IQteMMF.exe
  C:\Windows\System\IQteMMF.exe
  2⤵
  PID:7952
- C:\Windows\System\tFIZhGL.exe
  C:\Windows\System\tFIZhGL.exe
  2⤵
  PID:7976
- C:\Windows\System\AQQkwJO.exe
  C:\Windows\System\AQQkwJO.exe
  2⤵
  PID:7992
- C:\Windows\System\JIaAsex.exe
  C:\Windows\System\JIaAsex.exe
  2⤵
  PID:8008
- C:\Windows\System\XdzopSo.exe
  C:\Windows\System\XdzopSo.exe
  2⤵
  PID:8024
- C:\Windows\System\ZCSRpRc.exe
  C:\Windows\System\ZCSRpRc.exe
  2⤵
  PID:8048
- C:\Windows\System\EmsLTtJ.exe
  C:\Windows\System\EmsLTtJ.exe
  2⤵
  PID:8076
- C:\Windows\System\FhekZpo.exe
  C:\Windows\System\FhekZpo.exe
  2⤵
  PID:8092
- C:\Windows\System\CYGsVoB.exe
  C:\Windows\System\CYGsVoB.exe
  2⤵
  PID:8120
- C:\Windows\System\UUvgEqo.exe
  C:\Windows\System\UUvgEqo.exe
  2⤵
  PID:8136
- C:\Windows\System\bKqboVG.exe
  C:\Windows\System\bKqboVG.exe
  2⤵
  PID:8160
- C:\Windows\System\pOAljMT.exe
  C:\Windows\System\pOAljMT.exe
  2⤵
  PID:8180
- C:\Windows\System\BvZRNOl.exe
  C:\Windows\System\BvZRNOl.exe
  2⤵
  PID:6084
- C:\Windows\System\dFIiRwa.exe
  C:\Windows\System\dFIiRwa.exe
  2⤵
  PID:3956
- C:\Windows\System\WCzkFoM.exe
  C:\Windows\System\WCzkFoM.exe
  2⤵
  PID:2292
- C:\Windows\System\rkxoWJb.exe
  C:\Windows\System\rkxoWJb.exe
  2⤵
  PID:2952
- C:\Windows\System\cMhKlli.exe
  C:\Windows\System\cMhKlli.exe
  2⤵
  PID:6456
- C:\Windows\System\DrWjfgc.exe
  C:\Windows\System\DrWjfgc.exe
  2⤵
  PID:6516
- C:\Windows\System\DNDJuHW.exe
  C:\Windows\System\DNDJuHW.exe
  2⤵
  PID:7112
- C:\Windows\System\RUmuwOb.exe
  C:\Windows\System\RUmuwOb.exe
  2⤵
  PID:6648
- C:\Windows\System\iflkvcu.exe
  C:\Windows\System\iflkvcu.exe
  2⤵
  PID:5740
- C:\Windows\System\IsWTKNZ.exe
  C:\Windows\System\IsWTKNZ.exe
  2⤵
  PID:6220
- C:\Windows\System\abPqTVF.exe
  C:\Windows\System\abPqTVF.exe
  2⤵
  PID:5352
- C:\Windows\System\LQTefdH.exe
  C:\Windows\System\LQTefdH.exe
  2⤵
  PID:5856
- C:\Windows\System\lcLgfJA.exe
  C:\Windows\System\lcLgfJA.exe
  2⤵
  PID:6268
- C:\Windows\System\HyNQZoa.exe
  C:\Windows\System\HyNQZoa.exe
  2⤵
  PID:6316
- C:\Windows\System\utygdlF.exe
  C:\Windows\System\utygdlF.exe
  2⤵
  PID:6948
- C:\Windows\System\dWgxLmR.exe
  C:\Windows\System\dWgxLmR.exe
  2⤵
  PID:6420
- C:\Windows\System\zTbRvzl.exe
  C:\Windows\System\zTbRvzl.exe
  2⤵
  PID:8212
- C:\Windows\System\fDAELTN.exe
  C:\Windows\System\fDAELTN.exe
  2⤵
  PID:8228
- C:\Windows\System\UlFZWsX.exe
  C:\Windows\System\UlFZWsX.exe
  2⤵
  PID:8252
- C:\Windows\System\TLtzrED.exe
  C:\Windows\System\TLtzrED.exe
  2⤵
  PID:8268
- C:\Windows\System\yhvIwZa.exe
  C:\Windows\System\yhvIwZa.exe
  2⤵
  PID:8292
- C:\Windows\System\JFGbEfr.exe
  C:\Windows\System\JFGbEfr.exe
  2⤵
  PID:8308
- C:\Windows\System\nBDVhmV.exe
  C:\Windows\System\nBDVhmV.exe
  2⤵
  PID:8328
- C:\Windows\System\SUyxvbI.exe
  C:\Windows\System\SUyxvbI.exe
  2⤵
  PID:8348
- C:\Windows\System\YDpOBJp.exe
  C:\Windows\System\YDpOBJp.exe
  2⤵
  PID:8376
- C:\Windows\System\EMBHjXQ.exe
  C:\Windows\System\EMBHjXQ.exe
  2⤵
  PID:8392
- C:\Windows\System\SljEtpx.exe
  C:\Windows\System\SljEtpx.exe
  2⤵
  PID:8412
- C:\Windows\System\cyIzqNM.exe
  C:\Windows\System\cyIzqNM.exe
  2⤵
  PID:8432
- C:\Windows\System\sErJLLT.exe
  C:\Windows\System\sErJLLT.exe
  2⤵
  PID:8460
- C:\Windows\System\hdXbXmf.exe
  C:\Windows\System\hdXbXmf.exe
  2⤵
  PID:8476
- C:\Windows\System\JnWMtxJ.exe
  C:\Windows\System\JnWMtxJ.exe
  2⤵
  PID:8500
- C:\Windows\System\dzrtNsn.exe
  C:\Windows\System\dzrtNsn.exe
  2⤵
  PID:8520
- C:\Windows\System\wfQyXvM.exe
  C:\Windows\System\wfQyXvM.exe
  2⤵
  PID:8540
- C:\Windows\System\ObHwWxA.exe
  C:\Windows\System\ObHwWxA.exe
  2⤵
  PID:8560
- C:\Windows\System\kBoHPhq.exe
  C:\Windows\System\kBoHPhq.exe
  2⤵
  PID:8592
- C:\Windows\System\OpJLoNH.exe
  C:\Windows\System\OpJLoNH.exe
  2⤵
  PID:8608
- C:\Windows\System\BUuyoDg.exe
  C:\Windows\System\BUuyoDg.exe
  2⤵
  PID:8632
- C:\Windows\System\AbFWKAf.exe
  C:\Windows\System\AbFWKAf.exe
  2⤵
  PID:8648
- C:\Windows\System\ZhkkhxN.exe
  C:\Windows\System\ZhkkhxN.exe
  2⤵
  PID:8672
- C:\Windows\System\yPIbPNC.exe
  C:\Windows\System\yPIbPNC.exe
  2⤵
  PID:8692
- C:\Windows\System\sjVdoru.exe
  C:\Windows\System\sjVdoru.exe
  2⤵
  PID:8712
- C:\Windows\System\PgTdzDN.exe
  C:\Windows\System\PgTdzDN.exe
  2⤵
  PID:8732
- C:\Windows\System\cjiUXIK.exe
  C:\Windows\System\cjiUXIK.exe
  2⤵
  PID:8752
- C:\Windows\System\tDKCplF.exe
  C:\Windows\System\tDKCplF.exe
  2⤵
  PID:8776
- C:\Windows\System\UepriVh.exe
  C:\Windows\System\UepriVh.exe
  2⤵
  PID:8800
- C:\Windows\System\OkpEeOi.exe
  C:\Windows\System\OkpEeOi.exe
  2⤵
  PID:8820
- C:\Windows\System\PAIJxBc.exe
  C:\Windows\System\PAIJxBc.exe
  2⤵
  PID:8844
- C:\Windows\System\KCxMVSs.exe
  C:\Windows\System\KCxMVSs.exe
  2⤵
  PID:8860
- C:\Windows\System\bXnvxbL.exe
  C:\Windows\System\bXnvxbL.exe
  2⤵
  PID:8888
- C:\Windows\System\KpVkPtz.exe
  C:\Windows\System\KpVkPtz.exe
  2⤵
  PID:8904
- C:\Windows\System\kkkKAAh.exe
  C:\Windows\System\kkkKAAh.exe
  2⤵
  PID:8932
- C:\Windows\System\KTZYVBh.exe
  C:\Windows\System\KTZYVBh.exe
  2⤵
  PID:8948
- C:\Windows\System\PKDgmXH.exe
  C:\Windows\System\PKDgmXH.exe
  2⤵
  PID:8964
- C:\Windows\System\firCWEI.exe
  C:\Windows\System\firCWEI.exe
  2⤵
  PID:8980
- C:\Windows\System\BujrPns.exe
  C:\Windows\System\BujrPns.exe
  2⤵
  PID:9004
- C:\Windows\System\IMBHaxe.exe
  C:\Windows\System\IMBHaxe.exe
  2⤵
  PID:9024
- C:\Windows\System\hptspbX.exe
  C:\Windows\System\hptspbX.exe
  2⤵
  PID:9044
- C:\Windows\System\FZwsqce.exe
  C:\Windows\System\FZwsqce.exe
  2⤵
  PID:9064
- C:\Windows\System\DyLTQMl.exe
  C:\Windows\System\DyLTQMl.exe
  2⤵
  PID:9084
- C:\Windows\System\UshZaPd.exe
  C:\Windows\System\UshZaPd.exe
  2⤵
  PID:9108
- C:\Windows\System\BgNHWHa.exe
  C:\Windows\System\BgNHWHa.exe
  2⤵
  PID:9128
- C:\Windows\System\KXGLpJe.exe
  C:\Windows\System\KXGLpJe.exe
  2⤵
  PID:9152
- C:\Windows\System\noEnZOt.exe
  C:\Windows\System\noEnZOt.exe
  2⤵
  PID:9172
- C:\Windows\System\UmqLgeR.exe
  C:\Windows\System\UmqLgeR.exe
  2⤵
  PID:9192
- C:\Windows\System\uhdTckw.exe
  C:\Windows\System\uhdTckw.exe
  2⤵
  PID:9212
- C:\Windows\System\vTgFvcY.exe
  C:\Windows\System\vTgFvcY.exe
  2⤵
  PID:6988
- C:\Windows\System\SKCKuVZ.exe
  C:\Windows\System\SKCKuVZ.exe
  2⤵
  PID:7616
- C:\Windows\System\TFibLPn.exe
  C:\Windows\System\TFibLPn.exe
  2⤵
  PID:7672
- C:\Windows\System\pKoRMhY.exe
  C:\Windows\System\pKoRMhY.exe
  2⤵
  PID:7808
- C:\Windows\System\tarkHCu.exe
  C:\Windows\System\tarkHCu.exe
  2⤵
  PID:7152
- C:\Windows\System\FXPOXqR.exe
  C:\Windows\System\FXPOXqR.exe
  2⤵
  PID:6672
- C:\Windows\System\TxGPzLw.exe
  C:\Windows\System\TxGPzLw.exe
  2⤵
  PID:1636
- C:\Windows\System\kcRAqIl.exe
  C:\Windows\System\kcRAqIl.exe
  2⤵
  PID:4232
- C:\Windows\System\BZrFaSV.exe
  C:\Windows\System\BZrFaSV.exe
  2⤵
  PID:7908
- C:\Windows\System\hmTZOHg.exe
  C:\Windows\System\hmTZOHg.exe
  2⤵
  PID:7944
- C:\Windows\System\FNiLoGv.exe
  C:\Windows\System\FNiLoGv.exe
  2⤵
  PID:5672
- C:\Windows\System\NOysRrw.exe
  C:\Windows\System\NOysRrw.exe
  2⤵
  PID:6752
- C:\Windows\System\gvpucCc.exe
  C:\Windows\System\gvpucCc.exe
  2⤵
  PID:8100
- C:\Windows\System\fJnnxUW.exe
  C:\Windows\System\fJnnxUW.exe
  2⤵
  PID:8176
- C:\Windows\System\nBozWXP.exe
  C:\Windows\System\nBozWXP.exe
  2⤵
  PID:6820
- C:\Windows\System\TrbeaXz.exe
  C:\Windows\System\TrbeaXz.exe
  2⤵
  PID:1784
- C:\Windows\System\hqfVboU.exe
  C:\Windows\System\hqfVboU.exe
  2⤵
  PID:7172
- C:\Windows\System\hQqsuJF.exe
  C:\Windows\System\hQqsuJF.exe
  2⤵
  PID:6856
- C:\Windows\System\CzDvxzv.exe
  C:\Windows\System\CzDvxzv.exe
  2⤵
  PID:7300
- C:\Windows\System\wNlSnGS.exe
  C:\Windows\System\wNlSnGS.exe
  2⤵
  PID:3668
- C:\Windows\System\iCIKFGU.exe
  C:\Windows\System\iCIKFGU.exe
  2⤵
  PID:6912
- C:\Windows\System\eWsqCca.exe
  C:\Windows\System\eWsqCca.exe
  2⤵
  PID:6252
- C:\Windows\System\whYfVEy.exe
  C:\Windows\System\whYfVEy.exe
  2⤵
  PID:6952
- C:\Windows\System\rFoDAli.exe
  C:\Windows\System\rFoDAli.exe
  2⤵
  PID:8220
- C:\Windows\System\gtXKNVz.exe
  C:\Windows\System\gtXKNVz.exe
  2⤵
  PID:9220
- C:\Windows\System\aErZokP.exe
  C:\Windows\System\aErZokP.exe
  2⤵
  PID:9244
- C:\Windows\System\VANWiUA.exe
  C:\Windows\System\VANWiUA.exe
  2⤵
  PID:9264
- C:\Windows\System\ULTuWiT.exe
  C:\Windows\System\ULTuWiT.exe
  2⤵
  PID:9280
- C:\Windows\System\krLGysL.exe
  C:\Windows\System\krLGysL.exe
  2⤵
  PID:9300
- C:\Windows\System\NXIovgd.exe
  C:\Windows\System\NXIovgd.exe
  2⤵
  PID:9324
- C:\Windows\System\pCaUgJz.exe
  C:\Windows\System\pCaUgJz.exe
  2⤵
  PID:9344
- C:\Windows\System\zaIfqzr.exe
  C:\Windows\System\zaIfqzr.exe
  2⤵
  PID:9364
- C:\Windows\System\aNxVGWV.exe
  C:\Windows\System\aNxVGWV.exe
  2⤵
  PID:9388
- C:\Windows\System\IKpggAP.exe
  C:\Windows\System\IKpggAP.exe
  2⤵
  PID:9408
- C:\Windows\System\qUOfytM.exe
  C:\Windows\System\qUOfytM.exe
  2⤵
  PID:9432
- C:\Windows\System\nntQdVb.exe
  C:\Windows\System\nntQdVb.exe
  2⤵
  PID:9456
- C:\Windows\System\ZXGeeTt.exe
  C:\Windows\System\ZXGeeTt.exe
  2⤵
  PID:9476
- C:\Windows\System\IfSPZRu.exe
  C:\Windows\System\IfSPZRu.exe
  2⤵
  PID:9500
- C:\Windows\System\upHHdUj.exe
  C:\Windows\System\upHHdUj.exe
  2⤵
  PID:9524
- C:\Windows\System\qXCdcCn.exe
  C:\Windows\System\qXCdcCn.exe
  2⤵
  PID:9544
- C:\Windows\System\AHorvzh.exe
  C:\Windows\System\AHorvzh.exe
  2⤵
  PID:9564
- C:\Windows\System\vcKYsdE.exe
  C:\Windows\System\vcKYsdE.exe
  2⤵
  PID:9584
- C:\Windows\System\TkXYZDE.exe
  C:\Windows\System\TkXYZDE.exe
  2⤵
  PID:9604
- C:\Windows\System\mvtUerE.exe
  C:\Windows\System\mvtUerE.exe
  2⤵
  PID:9624
- C:\Windows\System\cneimHu.exe
  C:\Windows\System\cneimHu.exe
  2⤵
  PID:9644
- C:\Windows\System\UhaEduy.exe
  C:\Windows\System\UhaEduy.exe
  2⤵
  PID:9664
- C:\Windows\System\dPCOquo.exe
  C:\Windows\System\dPCOquo.exe
  2⤵
  PID:9692
- C:\Windows\System\ZTXWYMd.exe
  C:\Windows\System\ZTXWYMd.exe
  2⤵
  PID:9708
- C:\Windows\System\SXuvFfc.exe
  C:\Windows\System\SXuvFfc.exe
  2⤵
  PID:9732
- C:\Windows\System\TQwDEvL.exe
  C:\Windows\System\TQwDEvL.exe
  2⤵
  PID:9748
- C:\Windows\System\tVzQAeB.exe
  C:\Windows\System\tVzQAeB.exe
  2⤵
  PID:9768
- C:\Windows\System\lHcmubk.exe
  C:\Windows\System\lHcmubk.exe
  2⤵
  PID:9788
- C:\Windows\System\CWggbxO.exe
  C:\Windows\System\CWggbxO.exe
  2⤵
  PID:9808
- C:\Windows\System\uOhOyiI.exe
  C:\Windows\System\uOhOyiI.exe
  2⤵
  PID:9832
- C:\Windows\System\FJvcbfQ.exe
  C:\Windows\System\FJvcbfQ.exe
  2⤵
  PID:9860
- C:\Windows\System\JhqeZCm.exe
  C:\Windows\System\JhqeZCm.exe
  2⤵
  PID:9876
- C:\Windows\System\xnOsgsa.exe
  C:\Windows\System\xnOsgsa.exe
  2⤵
  PID:9900
- C:\Windows\System\jonVJSg.exe
  C:\Windows\System\jonVJSg.exe
  2⤵
  PID:9916
- C:\Windows\System\bGABhSE.exe
  C:\Windows\System\bGABhSE.exe
  2⤵
  PID:9932
- C:\Windows\System\eubHcqV.exe
  C:\Windows\System\eubHcqV.exe
  2⤵
  PID:9948
- C:\Windows\System\JGKqlrI.exe
  C:\Windows\System\JGKqlrI.exe
  2⤵
  PID:9968
- C:\Windows\System\qFazfrC.exe
  C:\Windows\System\qFazfrC.exe
  2⤵
  PID:9988
- C:\Windows\System\onnzFaA.exe
  C:\Windows\System\onnzFaA.exe
  2⤵
  PID:10008
- C:\Windows\System\UpMqKYO.exe
  C:\Windows\System\UpMqKYO.exe
  2⤵
  PID:10032
- C:\Windows\System\Fctstdw.exe
  C:\Windows\System\Fctstdw.exe
  2⤵
  PID:10052
- C:\Windows\System\YPbufBi.exe
  C:\Windows\System\YPbufBi.exe
  2⤵
  PID:10076
- C:\Windows\System\HJuuhTt.exe
  C:\Windows\System\HJuuhTt.exe
  2⤵
  PID:10096
- C:\Windows\System\KfCAFxZ.exe
  C:\Windows\System\KfCAFxZ.exe
  2⤵
  PID:10112
- C:\Windows\System\MCHnOCM.exe
  C:\Windows\System\MCHnOCM.exe
  2⤵
  PID:10136
- C:\Windows\System\RRonxaN.exe
  C:\Windows\System\RRonxaN.exe
  2⤵
  PID:10156
- C:\Windows\System\lmoyhfR.exe
  C:\Windows\System\lmoyhfR.exe
  2⤵
  PID:10176
- C:\Windows\System\bPnRrdd.exe
  C:\Windows\System\bPnRrdd.exe
  2⤵
  PID:10196
- C:\Windows\System\edgbzse.exe
  C:\Windows\System\edgbzse.exe
  2⤵
  PID:10212
- C:\Windows\System\RVhKIPc.exe
  C:\Windows\System\RVhKIPc.exe
  2⤵
  PID:10236
- C:\Windows\System\dVFHjUA.exe
  C:\Windows\System\dVFHjUA.exe
  2⤵
  PID:8388
- C:\Windows\System\ULMTvVh.exe
  C:\Windows\System\ULMTvVh.exe
  2⤵
  PID:7624
- C:\Windows\System\nZrpJWi.exe
  C:\Windows\System\nZrpJWi.exe
  2⤵
  PID:8488
- C:\Windows\System\bQsdSDY.exe
  C:\Windows\System\bQsdSDY.exe
  2⤵
  PID:8448
- C:\Windows\System\ugvyomh.exe
  C:\Windows\System\ugvyomh.exe
  2⤵
  PID:7072
- C:\Windows\System\IrSoJRE.exe
  C:\Windows\System\IrSoJRE.exe
  2⤵
  PID:7748
- C:\Windows\System\WjqywDQ.exe
  C:\Windows\System\WjqywDQ.exe
  2⤵
  PID:8600
- C:\Windows\System\HRSYupj.exe
  C:\Windows\System\HRSYupj.exe
  2⤵
  PID:8688
- C:\Windows\System\sTRbVOc.exe
  C:\Windows\System\sTRbVOc.exe
  2⤵
  PID:7852
- C:\Windows\System\NHSfLUQ.exe
  C:\Windows\System\NHSfLUQ.exe
  2⤵
  PID:5960
- C:\Windows\System\nfMcYEB.exe
  C:\Windows\System\nfMcYEB.exe
  2⤵
  PID:7876
- C:\Windows\System\gaozwfJ.exe
  C:\Windows\System\gaozwfJ.exe
  2⤵
  PID:8912
- C:\Windows\System\XqtTprI.exe
  C:\Windows\System\XqtTprI.exe
  2⤵
  PID:8940
- C:\Windows\System\HIGxBTw.exe
  C:\Windows\System\HIGxBTw.exe
  2⤵
  PID:8996
- C:\Windows\System\EsxhHHE.exe
  C:\Windows\System\EsxhHHE.exe
  2⤵
  PID:9032
- C:\Windows\System\LAsDapQ.exe
  C:\Windows\System\LAsDapQ.exe
  2⤵
  PID:8084
- C:\Windows\System\Odagbje.exe
  C:\Windows\System\Odagbje.exe
  2⤵
  PID:9148
- C:\Windows\System\fYsUPuN.exe
  C:\Windows\System\fYsUPuN.exe
  2⤵
  PID:5292
- C:\Windows\System\XFwzLdT.exe
  C:\Windows\System\XFwzLdT.exe
  2⤵
  PID:7840
- C:\Windows\System\AlGrZvD.exe
  C:\Windows\System\AlGrZvD.exe
  2⤵
  PID:7176
- C:\Windows\System\OtUAWlf.exe
  C:\Windows\System\OtUAWlf.exe
  2⤵
  PID:7256
- C:\Windows\System\EuNpfNN.exe
  C:\Windows\System\EuNpfNN.exe
  2⤵
  PID:7296
- C:\Windows\System\tRwOonc.exe
  C:\Windows\System\tRwOonc.exe
  2⤵
  PID:10264
- C:\Windows\System\ALVHcZA.exe
  C:\Windows\System\ALVHcZA.exe
  2⤵
  PID:10288
- C:\Windows\System\FxTmELA.exe
  C:\Windows\System\FxTmELA.exe
  2⤵
  PID:10308
- C:\Windows\System\PhsvGjx.exe
  C:\Windows\System\PhsvGjx.exe
  2⤵
  PID:10328
- C:\Windows\System\fLJQMRc.exe
  C:\Windows\System\fLJQMRc.exe
  2⤵
  PID:10348
- C:\Windows\System\iIdKddh.exe
  C:\Windows\System\iIdKddh.exe
  2⤵
  PID:10368
- C:\Windows\System\ALUdTEo.exe
  C:\Windows\System\ALUdTEo.exe
  2⤵
  PID:10396
- C:\Windows\System\yXAvvTZ.exe
  C:\Windows\System\yXAvvTZ.exe
  2⤵
  PID:10412
- C:\Windows\System\cjpJhnA.exe
  C:\Windows\System\cjpJhnA.exe
  2⤵
  PID:10436
- C:\Windows\System\riFFrZJ.exe
  C:\Windows\System\riFFrZJ.exe
  2⤵
  PID:10456
- C:\Windows\System\JTQvuJE.exe
  C:\Windows\System\JTQvuJE.exe
  2⤵
  PID:10480
- C:\Windows\System\rHulIqE.exe
  C:\Windows\System\rHulIqE.exe
  2⤵
  PID:10500
- C:\Windows\System\nfBCRna.exe
  C:\Windows\System\nfBCRna.exe
  2⤵
  PID:10524
- C:\Windows\System\ABXiPYF.exe
  C:\Windows\System\ABXiPYF.exe
  2⤵
  PID:10540
- C:\Windows\System\dktyttI.exe
  C:\Windows\System\dktyttI.exe
  2⤵
  PID:10560
- C:\Windows\System\wMhfiPe.exe
  C:\Windows\System\wMhfiPe.exe
  2⤵
  PID:10580
- C:\Windows\System\NMjCteE.exe
  C:\Windows\System\NMjCteE.exe
  2⤵
  PID:10600
- C:\Windows\System\MBzObjx.exe
  C:\Windows\System\MBzObjx.exe
  2⤵
  PID:10620
- C:\Windows\System\rBtsUnU.exe
  C:\Windows\System\rBtsUnU.exe
  2⤵
  PID:10640
- C:\Windows\System\qjWrOfD.exe
  C:\Windows\System\qjWrOfD.exe
  2⤵
  PID:10664
- C:\Windows\System\KMnMmIf.exe
  C:\Windows\System\KMnMmIf.exe
  2⤵
  PID:10688
- C:\Windows\System\iCodXVC.exe
  C:\Windows\System\iCodXVC.exe
  2⤵
  PID:10704
- C:\Windows\System\yqHWUXS.exe
  C:\Windows\System\yqHWUXS.exe
  2⤵
  PID:10724
- C:\Windows\System\pdcxcou.exe
  C:\Windows\System\pdcxcou.exe
  2⤵
  PID:10748
- C:\Windows\System\gbhiLgk.exe
  C:\Windows\System\gbhiLgk.exe
  2⤵
  PID:10764
- C:\Windows\System\ZiFocuP.exe
  C:\Windows\System\ZiFocuP.exe
  2⤵
  PID:10788
- C:\Windows\System\haDtYeJ.exe
  C:\Windows\System\haDtYeJ.exe
  2⤵
  PID:10808
- C:\Windows\System\vSOWsmG.exe
  C:\Windows\System\vSOWsmG.exe
  2⤵
  PID:10832
- C:\Windows\System\mipIwTn.exe
  C:\Windows\System\mipIwTn.exe
  2⤵
  PID:10848
- C:\Windows\System\dFVeFBl.exe
  C:\Windows\System\dFVeFBl.exe
  2⤵
  PID:10868
- C:\Windows\System\SxKswpK.exe
  C:\Windows\System\SxKswpK.exe
  2⤵
  PID:10892
- C:\Windows\System\EVkIrQB.exe
  C:\Windows\System\EVkIrQB.exe
  2⤵
  PID:10912
- C:\Windows\System\FHCulrW.exe
  C:\Windows\System\FHCulrW.exe
  2⤵
  PID:10932
- C:\Windows\System\PFyILbj.exe
  C:\Windows\System\PFyILbj.exe
  2⤵
  PID:10960
- C:\Windows\System\BrvRECF.exe
  C:\Windows\System\BrvRECF.exe
  2⤵
  PID:10976
- C:\Windows\System\GCxWXdX.exe
  C:\Windows\System\GCxWXdX.exe
  2⤵
  PID:10992
- C:\Windows\System\oqkLsxD.exe
  C:\Windows\System\oqkLsxD.exe
  2⤵
  PID:11008
- C:\Windows\System\AYRAdTX.exe
  C:\Windows\System\AYRAdTX.exe
  2⤵
  PID:11028
- C:\Windows\System\BxdHSJK.exe
  C:\Windows\System\BxdHSJK.exe
  2⤵
  PID:11048
- C:\Windows\System\bdHzoys.exe
  C:\Windows\System\bdHzoys.exe
  2⤵
  PID:11068
- C:\Windows\System\WjFFBfi.exe
  C:\Windows\System\WjFFBfi.exe
  2⤵
  PID:11084
- C:\Windows\System\JeJNdST.exe
  C:\Windows\System\JeJNdST.exe
  2⤵
  PID:11100
- C:\Windows\System\RskjGHg.exe
  C:\Windows\System\RskjGHg.exe
  2⤵
  PID:11120
- C:\Windows\System\yuzGjcV.exe
  C:\Windows\System\yuzGjcV.exe
  2⤵
  PID:11144
- C:\Windows\System\arveeVV.exe
  C:\Windows\System\arveeVV.exe
  2⤵
  PID:11164
- C:\Windows\System\SNqzczd.exe
  C:\Windows\System\SNqzczd.exe
  2⤵
  PID:11184
- C:\Windows\System\vnTLdTw.exe
  C:\Windows\System\vnTLdTw.exe
  2⤵
  PID:11212
- C:\Windows\System\pIPLrmK.exe
  C:\Windows\System\pIPLrmK.exe
  2⤵
  PID:11228
- C:\Windows\System\fMhmPSb.exe
  C:\Windows\System\fMhmPSb.exe
  2⤵
  PID:11256
- C:\Windows\System\mWbyxnW.exe
  C:\Windows\System\mWbyxnW.exe
  2⤵
  PID:7928
- C:\Windows\System\BsrTlqU.exe
  C:\Windows\System\BsrTlqU.exe
  2⤵
  PID:6200
- C:\Windows\System\aYYccXA.exe
  C:\Windows\System\aYYccXA.exe
  2⤵
  PID:7344
- C:\Windows\System\ytqCHtX.exe
  C:\Windows\System\ytqCHtX.exe
  2⤵
  PID:7368
- C:\Windows\System\uZRTwLO.exe
  C:\Windows\System\uZRTwLO.exe
  2⤵
  PID:6104
- C:\Windows\System\DPIMZBC.exe
  C:\Windows\System\DPIMZBC.exe
  2⤵
  PID:7396
- C:\Windows\System\EPJxGcZ.exe
  C:\Windows\System\EPJxGcZ.exe
  2⤵
  PID:6864
- C:\Windows\System\jxIQvtD.exe
  C:\Windows\System\jxIQvtD.exe
  2⤵
  PID:7492
- C:\Windows\System\NocfjZq.exe
  C:\Windows\System\NocfjZq.exe
  2⤵
  PID:8224
- C:\Windows\System\BcHidrC.exe
  C:\Windows\System\BcHidrC.exe
  2⤵
  PID:8276
- C:\Windows\System\VEcwmeZ.exe
  C:\Windows\System\VEcwmeZ.exe
  2⤵
  PID:8340
- C:\Windows\System\obsNYRr.exe
  C:\Windows\System\obsNYRr.exe
  2⤵
  PID:9332
- C:\Windows\System\edpGkoj.exe
  C:\Windows\System\edpGkoj.exe
  2⤵
  PID:9396
- C:\Windows\System\wtYubXQ.exe
  C:\Windows\System\wtYubXQ.exe
  2⤵
  PID:11524
- C:\Windows\System\mSchcVI.exe
  C:\Windows\System\mSchcVI.exe
  2⤵
  PID:11548
- C:\Windows\System\fQzeGlp.exe
  C:\Windows\System\fQzeGlp.exe
  2⤵
  PID:11572
- C:\Windows\System\FtzfsEi.exe
  C:\Windows\System\FtzfsEi.exe
  2⤵
  PID:11596
- C:\Windows\System\vIYsAph.exe
  C:\Windows\System\vIYsAph.exe
  2⤵
  PID:11620
- C:\Windows\System\KWTFciE.exe
  C:\Windows\System\KWTFciE.exe
  2⤵
  PID:11636
- C:\Windows\System\qkZzqNS.exe
  C:\Windows\System\qkZzqNS.exe
  2⤵
  PID:11660
- C:\Windows\System\fffAjun.exe
  C:\Windows\System\fffAjun.exe
  2⤵
  PID:11692
- C:\Windows\System\uFHhTgV.exe
  C:\Windows\System\uFHhTgV.exe
  2⤵
  PID:11712
- C:\Windows\System\CFFmSaK.exe
  C:\Windows\System\CFFmSaK.exe
  2⤵
  PID:11736
- C:\Windows\System\kjnLEwt.exe
  C:\Windows\System\kjnLEwt.exe
  2⤵
  PID:11776
- C:\Windows\System\AUaNybn.exe
  C:\Windows\System\AUaNybn.exe
  2⤵
  PID:11800
- C:\Windows\System\PhFsMob.exe
  C:\Windows\System\PhFsMob.exe
  2⤵
  PID:11820
- C:\Windows\System\fyumSBX.exe
  C:\Windows\System\fyumSBX.exe
  2⤵
  PID:11848
- C:\Windows\System\kwycgRe.exe
  C:\Windows\System\kwycgRe.exe
  2⤵
  PID:11868
- C:\Windows\System\qndINiv.exe
  C:\Windows\System\qndINiv.exe
  2⤵
  PID:11892
- C:\Windows\System\CWzgMCo.exe
  C:\Windows\System\CWzgMCo.exe
  2⤵
  PID:11912
- C:\Windows\System\YxZZrec.exe
  C:\Windows\System\YxZZrec.exe
  2⤵
  PID:11940
- C:\Windows\System\fvkQmti.exe
  C:\Windows\System\fvkQmti.exe
  2⤵
  PID:11972
- C:\Windows\System\WiLzOrw.exe
  C:\Windows\System\WiLzOrw.exe
  2⤵
  PID:11992
- C:\Windows\System\PITUtus.exe
  C:\Windows\System\PITUtus.exe
  2⤵
  PID:12016
- C:\Windows\System\SJEAYQI.exe
  C:\Windows\System\SJEAYQI.exe
  2⤵
  PID:12044
- C:\Windows\System\beVOwKJ.exe
  C:\Windows\System\beVOwKJ.exe
  2⤵
  PID:12064
- C:\Windows\System\AEfDaZu.exe
  C:\Windows\System\AEfDaZu.exe
  2⤵
  PID:12088
- C:\Windows\System\NwdnjLZ.exe
  C:\Windows\System\NwdnjLZ.exe
  2⤵
  PID:12116
- C:\Windows\System\XjNqWMp.exe
  C:\Windows\System\XjNqWMp.exe
  2⤵
  PID:12132
- C:\Windows\System\runljqk.exe
  C:\Windows\System\runljqk.exe
  2⤵
  PID:12156
- C:\Windows\System\AsiQbdD.exe
  C:\Windows\System\AsiQbdD.exe
  2⤵
  PID:12180
- C:\Windows\System\apbFteA.exe
  C:\Windows\System\apbFteA.exe
  2⤵
  PID:12208
- C:\Windows\System\qGUQhiR.exe
  C:\Windows\System\qGUQhiR.exe
  2⤵
  PID:12228
- C:\Windows\System\fXWzqOp.exe
  C:\Windows\System\fXWzqOp.exe
  2⤵
  PID:12252
- C:\Windows\System\OrvVZPa.exe
  C:\Windows\System\OrvVZPa.exe
  2⤵
  PID:12272
- C:\Windows\System\cPuzPzo.exe
  C:\Windows\System\cPuzPzo.exe
  2⤵
  PID:5372
- C:\Windows\System\MKnijaL.exe
  C:\Windows\System\MKnijaL.exe
  2⤵
  PID:3012
- C:\Windows\System\BurMKxC.exe
  C:\Windows\System\BurMKxC.exe
  2⤵
  PID:10756
- C:\Windows\System\jArvGIA.exe
  C:\Windows\System\jArvGIA.exe
  2⤵
  PID:10840
- C:\Windows\System\TAEzgvP.exe
  C:\Windows\System\TAEzgvP.exe
  2⤵
  PID:10864
- C:\Windows\System\wswwyPw.exe
  C:\Windows\System\wswwyPw.exe
  2⤵
  PID:10968
- C:\Windows\System\esACWbR.exe
  C:\Windows\System\esACWbR.exe
  2⤵
  PID:9420
- C:\Windows\System\zvJkBUA.exe
  C:\Windows\System\zvJkBUA.exe
  2⤵
  PID:8516
- C:\Windows\System\KYLCnSo.exe
  C:\Windows\System\KYLCnSo.exe
  2⤵
  PID:11196
- C:\Windows\System\ktZPUtn.exe
  C:\Windows\System\ktZPUtn.exe
  2⤵
  PID:11248
- C:\Windows\System\pruShiM.exe
  C:\Windows\System\pruShiM.exe
  2⤵
  PID:9532
- C:\Windows\System\jyHJVov.exe
  C:\Windows\System\jyHJVov.exe
  2⤵
  PID:7320
- C:\Windows\System\HyEXDqu.exe
  C:\Windows\System\HyEXDqu.exe
  2⤵
  PID:9596
- C:\Windows\System\cAVVYIK.exe
  C:\Windows\System\cAVVYIK.exe
  2⤵
  PID:7480
- C:\Windows\System\feSsGTD.exe
  C:\Windows\System\feSsGTD.exe
  2⤵
  PID:9684
- C:\Windows\System\EkHdbEb.exe
  C:\Windows\System\EkHdbEb.exe
  2⤵
  PID:8852
- C:\Windows\System\twpJeMu.exe
  C:\Windows\System\twpJeMu.exe
  2⤵
  PID:9908
- C:\Windows\System\oGSUsGQ.exe
  C:\Windows\System\oGSUsGQ.exe
  2⤵
  PID:9964
- C:\Windows\System\muwLKRM.exe
  C:\Windows\System\muwLKRM.exe
  2⤵
  PID:9728
- C:\Windows\System\mPzhfXA.exe
  C:\Windows\System\mPzhfXA.exe
  2⤵
  PID:9104
- C:\Windows\System\ZZBCTfK.exe
  C:\Windows\System\ZZBCTfK.exe
  2⤵
  PID:10188
- C:\Windows\System\pjaRKfa.exe
  C:\Windows\System\pjaRKfa.exe
  2⤵
  PID:9188
- C:\Windows\System\OTXztQo.exe
  C:\Windows\System\OTXztQo.exe
  2⤵
  PID:7736
- C:\Windows\System\eqqndoB.exe
  C:\Windows\System\eqqndoB.exe
  2⤵
  PID:7604
- C:\Windows\System\cNlbgpl.exe
  C:\Windows\System\cNlbgpl.exe
  2⤵
  PID:7660
- C:\Windows\System\qSfvlsq.exe
  C:\Windows\System\qSfvlsq.exe
  2⤵
  PID:7884
- C:\Windows\System\UeymPNU.exe
  C:\Windows\System\UeymPNU.exe
  2⤵
  PID:6132
- C:\Windows\System\oJJkDvv.exe
  C:\Windows\System\oJJkDvv.exe
  2⤵
  PID:7284
- C:\Windows\System\DnJHQDg.exe
  C:\Windows\System\DnJHQDg.exe
  2⤵
  PID:10276
- C:\Windows\System\yHVxlPA.exe
  C:\Windows\System\yHVxlPA.exe
  2⤵
  PID:10304
- C:\Windows\System\avOhnnQ.exe
  C:\Windows\System\avOhnnQ.exe
  2⤵
  PID:10376
- C:\Windows\System\fNsplIN.exe
  C:\Windows\System\fNsplIN.exe
  2⤵
  PID:10408
- C:\Windows\System\zCymbYI.exe
  C:\Windows\System\zCymbYI.exe
  2⤵
  PID:5708
- C:\Windows\System\ezabUdD.exe
  C:\Windows\System\ezabUdD.exe
  2⤵
  PID:8172
- C:\Windows\System\QNmCeUd.exe
  C:\Windows\System\QNmCeUd.exe
  2⤵
  PID:3664
- C:\Windows\System\ssEpzPz.exe
  C:\Windows\System\ssEpzPz.exe
  2⤵
  PID:12304
- C:\Windows\System\ECROVIA.exe
  C:\Windows\System\ECROVIA.exe
  2⤵
  PID:12324
- C:\Windows\System\UpWiAGi.exe
  C:\Windows\System\UpWiAGi.exe
  2⤵
  PID:12348
- C:\Windows\System\uCwwLIx.exe
  C:\Windows\System\uCwwLIx.exe
  2⤵
  PID:12372
- C:\Windows\System\cxqaeYH.exe
  C:\Windows\System\cxqaeYH.exe
  2⤵
  PID:12396
- C:\Windows\System\xFAiXie.exe
  C:\Windows\System\xFAiXie.exe
  2⤵
  PID:12420
- C:\Windows\System\QqVTDVw.exe
  C:\Windows\System\QqVTDVw.exe
  2⤵
  PID:12440
- C:\Windows\System\edwowNX.exe
  C:\Windows\System\edwowNX.exe
  2⤵
  PID:12464
- C:\Windows\System\jQeJIIg.exe
  C:\Windows\System\jQeJIIg.exe
  2⤵
  PID:12492
- C:\Windows\System\bePifcg.exe
  C:\Windows\System\bePifcg.exe
  2⤵
  PID:12512
- C:\Windows\System\CnPimRw.exe
  C:\Windows\System\CnPimRw.exe
  2⤵
  PID:12532
- C:\Windows\System\FGSbVqH.exe
  C:\Windows\System\FGSbVqH.exe
  2⤵
  PID:12556
- C:\Windows\System\YISGBNG.exe
  C:\Windows\System\YISGBNG.exe
  2⤵
  PID:12580
- C:\Windows\System\gFmjyJd.exe
  C:\Windows\System\gFmjyJd.exe
  2⤵
  PID:12604
- C:\Windows\System\CfjJQKu.exe
  C:\Windows\System\CfjJQKu.exe
  2⤵
  PID:12628
- C:\Windows\System\cxtWvhu.exe
  C:\Windows\System\cxtWvhu.exe
  2⤵
  PID:12652
- C:\Windows\System\wEaRfpe.exe
  C:\Windows\System\wEaRfpe.exe
  2⤵
  PID:12676
- C:\Windows\System\XeRjbZf.exe
  C:\Windows\System\XeRjbZf.exe
  2⤵
  PID:12708
- C:\Windows\System\hKikzyE.exe
  C:\Windows\System\hKikzyE.exe
  2⤵
  PID:12732
- C:\Windows\System\JtgZaPu.exe
  C:\Windows\System\JtgZaPu.exe
  2⤵
  PID:12752
- C:\Windows\System\ecKwVaM.exe
  C:\Windows\System\ecKwVaM.exe
  2⤵
  PID:12776
- C:\Windows\System\sLNcqor.exe
  C:\Windows\System\sLNcqor.exe
  2⤵
  PID:12808
- C:\Windows\System\CVPAnHR.exe
  C:\Windows\System\CVPAnHR.exe
  2⤵
  PID:12824
- C:\Windows\System\AQFPAbv.exe
  C:\Windows\System\AQFPAbv.exe
  2⤵
  PID:12848
- C:\Windows\System\fUdPUqO.exe
  C:\Windows\System\fUdPUqO.exe
  2⤵
  PID:12872
- C:\Windows\System\uOiEuyS.exe
  C:\Windows\System\uOiEuyS.exe
  2⤵
  PID:12896
- C:\Windows\System\NLjGuTS.exe
  C:\Windows\System\NLjGuTS.exe
  2⤵
  PID:12912
- C:\Windows\System\ORtozYL.exe
  C:\Windows\System\ORtozYL.exe
  2⤵
  PID:12936
- C:\Windows\System\BqfpTzM.exe
  C:\Windows\System\BqfpTzM.exe
  2⤵
  PID:11948
- C:\Windows\System\FOVbgqY.exe
  C:\Windows\System\FOVbgqY.exe
  2⤵
  PID:11988
- C:\Windows\System\tDMBkFl.exe
  C:\Windows\System\tDMBkFl.exe
  2⤵
  PID:1452
- C:\Windows\System\ieVRGQw.exe
  C:\Windows\System\ieVRGQw.exe
  2⤵
  PID:11468
- C:\Windows\System\fzCMKud.exe
  C:\Windows\System\fzCMKud.exe
  2⤵
  PID:1744
- C:\Windows\System\UOTbNGM.exe
  C:\Windows\System\UOTbNGM.exe
  2⤵
  PID:10184
- C:\Windows\System\PSYPTCi.exe
  C:\Windows\System\PSYPTCi.exe
  2⤵
  PID:6296
- C:\Windows\System\lOJLunI.exe
  C:\Windows\System\lOJLunI.exe
  2⤵
  PID:12316
- C:\Windows\System\ITzMJKq.exe
  C:\Windows\System\ITzMJKq.exe
  2⤵
  PID:12392
- C:\Windows\System\XadjDhO.exe
  C:\Windows\System\XadjDhO.exe
  2⤵
  PID:12448
- C:\Windows\System\EVfqXKP.exe
  C:\Windows\System\EVfqXKP.exe
  2⤵
  PID:12484
- C:\Windows\System\FSbaEGs.exe
  C:\Windows\System\FSbaEGs.exe
  2⤵
  PID:12564
- C:\Windows\System\aYEbRsG.exe
  C:\Windows\System\aYEbRsG.exe
  2⤵
  PID:9464
- C:\Windows\System\hRmqLhB.exe
  C:\Windows\System\hRmqLhB.exe
  2⤵
  PID:11652
- C:\Windows\System\TUkvYVj.exe
  C:\Windows\System\TUkvYVj.exe
  2⤵
  PID:10608
- C:\Windows\System\JuPWZBi.exe
  C:\Windows\System\JuPWZBi.exe
  2⤵
  PID:10656
- C:\Windows\System\fgnjrPC.exe
  C:\Windows\System\fgnjrPC.exe
  2⤵
  PID:10908
- C:\Windows\System\ApQZutO.exe
  C:\Windows\System\ApQZutO.exe
  2⤵
  PID:10340
- C:\Windows\System\IEdFlSH.exe
  C:\Windows\System\IEdFlSH.exe
  2⤵
  PID:11676
- C:\Windows\System\pBiHwKC.exe
  C:\Windows\System\pBiHwKC.exe
  2⤵
  PID:10860
- C:\Windows\System\LZCfFky.exe
  C:\Windows\System\LZCfFky.exe
  2⤵
  PID:7476
- C:\Windows\System\csSYeON.exe
  C:\Windows\System\csSYeON.exe
  2⤵
  PID:12664
- C:\Windows\System\QSqHeYz.exe
  C:\Windows\System\QSqHeYz.exe
  2⤵
  PID:12816
- C:\Windows\System\CFKgVlO.exe
  C:\Windows\System\CFKgVlO.exe
  2⤵
  PID:12856
- C:\Windows\System\AcwaoEB.exe
  C:\Windows\System\AcwaoEB.exe
  2⤵
  PID:11788
- C:\Windows\System\qDmiErX.exe
  C:\Windows\System\qDmiErX.exe
  2⤵
  PID:12972
- C:\Windows\System\OWNWbqW.exe
  C:\Windows\System\OWNWbqW.exe
  2⤵
  PID:2192
- C:\Windows\System\aDZIQJt.exe
  C:\Windows\System\aDZIQJt.exe
  2⤵
  PID:13208
- C:\Windows\System\cPNnXRx.exe
  C:\Windows\System\cPNnXRx.exe
  2⤵
  PID:13212
- C:\Windows\System\VNsSUeK.exe
  C:\Windows\System\VNsSUeK.exe
  2⤵
  PID:11608
- C:\Windows\System\cKlKSPT.exe
  C:\Windows\System\cKlKSPT.exe
  2⤵
  PID:13248
- C:\Windows\System\KLlCbCy.exe
  C:\Windows\System\KLlCbCy.exe
  2⤵
  PID:5644
- C:\Windows\System\ThUFcIs.exe
  C:\Windows\System\ThUFcIs.exe
  2⤵
  PID:13132
- C:\Windows\System\BKfjaKC.exe
  C:\Windows\System\BKfjaKC.exe
  2⤵
  PID:3600
- C:\Windows\System\pwsAkjr.exe
  C:\Windows\System\pwsAkjr.exe
  2⤵
  PID:7720
- C:\Windows\System\sOOStuk.exe
  C:\Windows\System\sOOStuk.exe
  2⤵
  PID:11004
- C:\Windows\System\MxuaQeg.exe
  C:\Windows\System\MxuaQeg.exe
  2⤵
  PID:13224
- C:\Windows\System\TuGNayK.exe
  C:\Windows\System\TuGNayK.exe
  2⤵
  PID:8644
- C:\Windows\System\kwCwpKB.exe
  C:\Windows\System\kwCwpKB.exe
  2⤵
  PID:10256
- C:\Windows\System\ZhmVRwW.exe
  C:\Windows\System\ZhmVRwW.exe
  2⤵
  PID:10404
- C:\Windows\System\oFbZvnU.exe
  C:\Windows\System\oFbZvnU.exe
  2⤵
  PID:12340
- C:\Windows\System\iTdQZqp.exe
  C:\Windows\System\iTdQZqp.exe
  2⤵
  PID:12432
- C:\Windows\System\LayXBJE.exe
  C:\Windows\System\LayXBJE.exe
  2⤵
  PID:7512
- C:\Windows\System\OtEUwxP.exe
  C:\Windows\System\OtEUwxP.exe
  2⤵
  PID:11192
- C:\Windows\System\hJYMitz.exe
  C:\Windows\System\hJYMitz.exe
  2⤵
  PID:11952
- C:\Windows\System\wcxhBMk.exe
  C:\Windows\System\wcxhBMk.exe
  2⤵
  PID:10576
- C:\Windows\System\eeofdsr.exe
  C:\Windows\System\eeofdsr.exe
  2⤵
  PID:11532
- C:\Windows\System\yWtQupv.exe
  C:\Windows\System\yWtQupv.exe
  2⤵
  PID:1772
- C:\Windows\System\qVhyQMr.exe
  C:\Windows\System\qVhyQMr.exe
  2⤵
  PID:4360
- C:\Windows\System\phvXdWW.exe
  C:\Windows\System\phvXdWW.exe
  2⤵
  PID:12904
- C:\Windows\System\GOErtWM.exe
  C:\Windows\System\GOErtWM.exe
  2⤵
  PID:5344
- C:\Windows\System\BlPEGwQ.exe
  C:\Windows\System\BlPEGwQ.exe
  2⤵
  PID:10476
- C:\Windows\System\vilgoGf.exe
  C:\Windows\System\vilgoGf.exe
  2⤵
  PID:12176
- C:\Windows\System\CIHNSgn.exe
  C:\Windows\System\CIHNSgn.exe
  2⤵
  PID:8132
- C:\Windows\System\vgabYkf.exe
  C:\Windows\System\vgabYkf.exe
  2⤵
  PID:1328
- C:\Windows\System\GwaYFkx.exe
  C:\Windows\System\GwaYFkx.exe
  2⤵
  PID:10760
- C:\Windows\System\AGiOLun.exe
  C:\Windows\System\AGiOLun.exe
  2⤵
  PID:12524
- C:\Windows\System\GXUDwTr.exe
  C:\Windows\System\GXUDwTr.exe
  2⤵
  PID:13040
- C:\Windows\System\wLEzOaz.exe
  C:\Windows\System\wLEzOaz.exe
  2⤵
  PID:13044
- C:\Windows\System\XpNxstb.exe
  C:\Windows\System\XpNxstb.exe
  2⤵
  PID:10432
- C:\Windows\System\qcBPyep.exe
  C:\Windows\System\qcBPyep.exe
  2⤵
  PID:10660
- C:\Windows\System\mYUZhNG.exe
  C:\Windows\System\mYUZhNG.exe
  2⤵
  PID:11856
- C:\Windows\System\lpIFUHp.exe
  C:\Windows\System\lpIFUHp.exe
  2⤵
  PID:10940
- C:\Windows\System\MclQCsf.exe
  C:\Windows\System\MclQCsf.exe
  2⤵
  PID:4788
- C:\Windows\System\QWhzEoZ.exe
  C:\Windows\System\QWhzEoZ.exe
  2⤵
  PID:6496
- C:\Windows\System\xsnFQVa.exe
  C:\Windows\System\xsnFQVa.exe
  2⤵
  PID:4460
- C:\Windows\System\GNSruUE.exe
  C:\Windows\System\GNSruUE.exe
  2⤵
  PID:11884
- C:\Windows\System\sNBnmlq.exe
  C:\Windows\System\sNBnmlq.exe
  2⤵
  PID:8384
- C:\Windows\System\cqhUCSk.exe
  C:\Windows\System\cqhUCSk.exe
  2⤵
  PID:13012
- C:\Windows\System\kfTLeNm.exe
  C:\Windows\System\kfTLeNm.exe
  2⤵
  PID:12264
- C:\Windows\System\VJfwBTb.exe
  C:\Windows\System\VJfwBTb.exe
  2⤵
  PID:10612
- C:\Windows\System\cwrZWZE.exe
  C:\Windows\System\cwrZWZE.exe
  2⤵
  PID:12928
- C:\Windows\System\YxKObKy.exe
  C:\Windows\System\YxKObKy.exe
  2⤵
  PID:11644
- C:\Windows\System\LjEPkWV.exe
  C:\Windows\System\LjEPkWV.exe
  2⤵
  PID:1336
- C:\Windows\System\jhZqlUj.exe
  C:\Windows\System\jhZqlUj.exe
  2⤵
  PID:11796
- C:\Windows\System\jXZAIMi.exe
  C:\Windows\System\jXZAIMi.exe
  2⤵
  PID:7460
- C:\Windows\System\wBIFKeu.exe
  C:\Windows\System\wBIFKeu.exe
  2⤵
  PID:6612
- C:\Windows\System\gFvhqnD.exe
  C:\Windows\System\gFvhqnD.exe
  2⤵
  PID:12096
- C:\Windows\System\QDIVfNS.exe
  C:\Windows\System\QDIVfNS.exe
  2⤵
  PID:12412
- C:\Windows\System\KQfDhvx.exe
  C:\Windows\System\KQfDhvx.exe
  2⤵
  PID:2360
- C:\Windows\System\vQeaBxE.exe
  C:\Windows\System\vQeaBxE.exe
  2⤵
  PID:13344
- C:\Windows\System\CJyVqeH.exe
  C:\Windows\System\CJyVqeH.exe
  2⤵
  PID:13360
- C:\Windows\System\mUfSqpE.exe
  C:\Windows\System\mUfSqpE.exe
  2⤵
  PID:13892
- C:\Windows\System\IghorgW.exe
  C:\Windows\System\IghorgW.exe
  2⤵
  PID:13908
- C:\Windows\System\XvhPPjs.exe
  C:\Windows\System\XvhPPjs.exe
  2⤵
  PID:13936
- C:\Windows\System\ERcFvyy.exe
  C:\Windows\System\ERcFvyy.exe
  2⤵
  PID:14160
- C:\Windows\System\NzlwGvm.exe
  C:\Windows\System\NzlwGvm.exe
  2⤵
  PID:14180
- C:\Windows\System\zHxFyoD.exe
  C:\Windows\System\zHxFyoD.exe
  2⤵
  PID:14204
- C:\Windows\System\djweERV.exe
  C:\Windows\System\djweERV.exe
  2⤵
  PID:14228
- C:\Windows\System\aZtRjKA.exe
  C:\Windows\System\aZtRjKA.exe
  2⤵
  PID:14256
- C:\Windows\System\SdKsGAX.exe
  C:\Windows\System\SdKsGAX.exe
  2⤵
  PID:14276
- C:\Windows\System\vTQyyVn.exe
  C:\Windows\System\vTQyyVn.exe
  2⤵
  PID:14304
- C:\Windows\System\sHftEOf.exe
  C:\Windows\System\sHftEOf.exe
  2⤵
  PID:14328
- C:\Windows\System\WrRRvpt.exe
  C:\Windows\System\WrRRvpt.exe
  2⤵
  PID:11720
- C:\Windows\System\NeMIDgi.exe
  C:\Windows\System\NeMIDgi.exe
  2⤵
  PID:10508
- C:\Windows\System\XwjvQzb.exe
  C:\Windows\System\XwjvQzb.exe
  2⤵
  PID:13472
- C:\Windows\System\EblpKjT.exe
  C:\Windows\System\EblpKjT.exe
  2⤵
  PID:12844
- C:\Windows\System\RTTGqqH.exe
  C:\Windows\System\RTTGqqH.exe
  2⤵
  PID:13624
- C:\Windows\System\aHGKRxH.exe
  C:\Windows\System\aHGKRxH.exe
  2⤵
  PID:13776
- C:\Windows\System\szQmLNi.exe
  C:\Windows\System\szQmLNi.exe
  2⤵
  PID:13656
- C:\Windows\System\FSaMAwr.exe
  C:\Windows\System\FSaMAwr.exe
  2⤵
  PID:14000
- C:\Windows\System\UHaIOgU.exe
  C:\Windows\System\UHaIOgU.exe
  2⤵
  PID:13960
- C:\Windows\System\aVVwkDF.exe
  C:\Windows\System\aVVwkDF.exe
  2⤵
  PID:13372
- C:\Windows\System\TAyiIRS.exe
  C:\Windows\System\TAyiIRS.exe
  2⤵
  PID:13568
- C:\Windows\System\vaZuUaL.exe
  C:\Windows\System\vaZuUaL.exe
  2⤵
  PID:13588
- C:\Windows\System\CpVYrcp.exe
  C:\Windows\System\CpVYrcp.exe
  2⤵
  PID:13632
- C:\Windows\System\RYkjmVx.exe
  C:\Windows\System\RYkjmVx.exe
  2⤵
  PID:13676
- C:\Windows\System\HZjfYCo.exe
  C:\Windows\System\HZjfYCo.exe
  2⤵
  PID:13596
- C:\Windows\System\dlEBWIC.exe
  C:\Windows\System\dlEBWIC.exe
  2⤵
  PID:13712
- C:\Windows\System\wwOBdxx.exe
  C:\Windows\System\wwOBdxx.exe
  2⤵
  PID:13408
- C:\Windows\System\okzVDvp.exe
  C:\Windows\System\okzVDvp.exe
  2⤵
  PID:13756
- C:\Windows\System\rGuFQRf.exe
  C:\Windows\System\rGuFQRf.exe
  2⤵
  PID:13652
- C:\Windows\System\POztvXD.exe
  C:\Windows\System\POztvXD.exe
  2⤵
  PID:13796
- C:\Windows\System\isIFJQs.exe
  C:\Windows\System\isIFJQs.exe
  2⤵
  PID:13640
- C:\Windows\System\ogOjocd.exe
  C:\Windows\System\ogOjocd.exe
  2⤵
  PID:13864
- C:\Windows\System\bcAMhNu.exe
  C:\Windows\System\bcAMhNu.exe
  2⤵
  PID:13616
- C:\Windows\System\BfXzgKU.exe
  C:\Windows\System\BfXzgKU.exe
  2⤵
  PID:13836
- C:\Windows\System\VZoMWnx.exe
  C:\Windows\System\VZoMWnx.exe
  2⤵
  PID:13968
- C:\Windows\System\CexJjnT.exe
  C:\Windows\System\CexJjnT.exe
  2⤵
  PID:13820
- C:\Windows\System\KMBeGvQ.exe
  C:\Windows\System\KMBeGvQ.exe
  2⤵
  PID:13964
- C:\Windows\System\OUFaKtA.exe
  C:\Windows\System\OUFaKtA.exe
  2⤵
  PID:13404
- C:\Windows\System\SyBdqes.exe
  C:\Windows\System\SyBdqes.exe
  2⤵
  PID:13868
- C:\Windows\System\YhogJAG.exe
  C:\Windows\System\YhogJAG.exe
  2⤵
  PID:13884
- C:\Windows\System\bzaWiEU.exe
  C:\Windows\System\bzaWiEU.exe
  2⤵
  PID:14056
- C:\Windows\System\rARHyxP.exe
  C:\Windows\System\rARHyxP.exe
  2⤵
  PID:14072
- C:\Windows\System\WBqimXs.exe
  C:\Windows\System\WBqimXs.exe
  2⤵
  PID:10284
- C:\Windows\System\RpDHszR.exe
  C:\Windows\System\RpDHszR.exe
  2⤵
  PID:14088
- C:\Windows\System\czhuCom.exe
  C:\Windows\System\czhuCom.exe
  2⤵
  PID:14012
- C:\Windows\System\grTJyMz.exe
  C:\Windows\System\grTJyMz.exe
  2⤵
  PID:12248
- C:\Windows\System\wHYirve.exe
  C:\Windows\System\wHYirve.exe
  2⤵
  PID:13628
- C:\Windows\System\YxLkKCh.exe
  C:\Windows\System\YxLkKCh.exe
  2⤵
  PID:14060
- C:\Windows\System\kmkybIS.exe
  C:\Windows\System\kmkybIS.exe
  2⤵
  PID:13952
- C:\Windows\System\bNGEhpd.exe
  C:\Windows\System\bNGEhpd.exe
  2⤵
  PID:14112
- C:\Windows\System\zkmWlNH.exe
  C:\Windows\System\zkmWlNH.exe
  2⤵
  PID:2896
- C:\Windows\System\YJWulNb.exe
  C:\Windows\System\YJWulNb.exe
  2⤵
  PID:2060
- C:\Windows\System\GixbLBh.exe
  C:\Windows\System\GixbLBh.exe
  2⤵
  PID:14124
- C:\Windows\System\zUjJsnQ.exe
  C:\Windows\System\zUjJsnQ.exe
  2⤵
  PID:14172
- C:\Windows\System\aFprtJf.exe
  C:\Windows\System\aFprtJf.exe
  2⤵
  PID:14252
- C:\Windows\System\zzlhFcm.exe
  C:\Windows\System\zzlhFcm.exe
  2⤵
  PID:14292
- C:\Windows\System\jSXsfMI.exe
  C:\Windows\System\jSXsfMI.exe
  2⤵
  PID:14216
- C:\Windows\System\kOxkrjS.exe
  C:\Windows\System\kOxkrjS.exe
  2⤵
  PID:14316
- C:\Windows\System\ktsOevD.exe
  C:\Windows\System\ktsOevD.exe
  2⤵
  PID:13396
- C:\Windows\System\aXmafaQ.exe
  C:\Windows\System\aXmafaQ.exe
  2⤵
  PID:760
- C:\Windows\System\quYUykN.exe
  C:\Windows\System\quYUykN.exe
  2⤵
  PID:8928
- C:\Windows\System\YmhYkEc.exe
  C:\Windows\System\YmhYkEc.exe
  2⤵
  PID:9704
- C:\Windows\System\gpNTAZf.exe
  C:\Windows\System\gpNTAZf.exe
  2⤵
  PID:13120
- C:\Windows\System\nyQhxyv.exe
  C:\Windows\System\nyQhxyv.exe
  2⤵
  PID:9052
- C:\Windows\System\TLAngPv.exe
  C:\Windows\System\TLAngPv.exe
  2⤵
  PID:11400
- C:\Windows\System\SgwzTqX.exe
  C:\Windows\System\SgwzTqX.exe
  2⤵
  PID:13380
- C:\Windows\System\RelWgWb.exe
  C:\Windows\System\RelWgWb.exe
  2⤵
  PID:12920
- C:\Windows\System\TlhgXzt.exe
  C:\Windows\System\TlhgXzt.exe
  2⤵
  PID:12644
- C:\Windows\System\GFVWwbk.exe
  C:\Windows\System\GFVWwbk.exe
  2⤵
  PID:13388
- C:\Windows\System\mGFoHDq.exe
  C:\Windows\System\mGFoHDq.exe
  2⤵
  PID:14152
- C:\Windows\System\TjOUOgf.exe
  C:\Windows\System\TjOUOgf.exe
  2⤵
  PID:2364
- C:\Windows\System\JeLgrVF.exe
  C:\Windows\System\JeLgrVF.exe
  2⤵
  PID:13548
- C:\Windows\System\UyZWXAe.exe
  C:\Windows\System\UyZWXAe.exe
  2⤵
  PID:14236
- C:\Windows\System\KMXQJjn.exe
  C:\Windows\System\KMXQJjn.exe
  2⤵
  PID:4636
- C:\Windows\System\hzudsdb.exe
  C:\Windows\System\hzudsdb.exe
  2⤵
  PID:3516
- C:\Windows\System\sggdClK.exe
  C:\Windows\System\sggdClK.exe
  2⤵
  PID:1604
- C:\Windows\System\cwktmMI.exe
  C:\Windows\System\cwktmMI.exe
  2⤵
  PID:1376
- C:\Windows\System\jrRLTWX.exe
  C:\Windows\System\jrRLTWX.exe
  2⤵
  PID:13412
- C:\Windows\System\tVYpLuf.exe
  C:\Windows\System\tVYpLuf.exe
  2⤵
  PID:13580
- C:\Windows\System\mRprEWu.exe
  C:\Windows\System\mRprEWu.exe
  2⤵
  PID:13684
- C:\Windows\System\GFkrJHE.exe
  C:\Windows\System\GFkrJHE.exe
  2⤵
  PID:13720
- C:\Windows\System\NXQhJxV.exe
  C:\Windows\System\NXQhJxV.exe
  2⤵
  PID:13748
- C:\Windows\System\kgcFELz.exe
  C:\Windows\System\kgcFELz.exe
  2⤵
  PID:10028
- C:\Windows\System\lKDLWue.exe
  C:\Windows\System\lKDLWue.exe
  2⤵
  PID:12768
- C:\Windows\System\HtyFrUd.exe
  C:\Windows\System\HtyFrUd.exe
  2⤵
  PID:13920
- C:\Windows\System\jsrzXjI.exe
  C:\Windows\System\jsrzXjI.exe
  2⤵
  PID:13484
- C:\Windows\System\SxAoBSI.exe
  C:\Windows\System\SxAoBSI.exe
  2⤵
  PID:13876
- C:\Windows\System\hZqNFel.exe
  C:\Windows\System\hZqNFel.exe
  2⤵
  PID:13948
- C:\Windows\System\AWzaRCA.exe
  C:\Windows\System\AWzaRCA.exe
  2⤵
  PID:13840
- C:\Windows\System\YhBAAEy.exe
  C:\Windows\System\YhBAAEy.exe
  2⤵
  PID:14040
- C:\Windows\System\wNDsajQ.exe
  C:\Windows\System\wNDsajQ.exe
  2⤵
  PID:14068
- C:\Windows\System\MRkQemZ.exe
  C:\Windows\System\MRkQemZ.exe
  2⤵
  PID:14084
- C:\Windows\System\uFIeBdx.exe
  C:\Windows\System\uFIeBdx.exe
  2⤵
  PID:14264
- C:\Windows\System\KLnOZbX.exe
  C:\Windows\System\KLnOZbX.exe
  2⤵
  PID:5024
- C:\Windows\System\QGQMMRg.exe
  C:\Windows\System\QGQMMRg.exe
  2⤵
  PID:13816
- C:\Windows\System\vPfwyzY.exe
  C:\Windows\System\vPfwyzY.exe
  2⤵
  PID:3604
- C:\Windows\System\mqRGetC.exe
  C:\Windows\System\mqRGetC.exe
  2⤵
  PID:14064
- C:\Windows\System\lgYBSSE.exe
  C:\Windows\System\lgYBSSE.exe
  2⤵
  PID:14176
- C:\Windows\System\GwqNPhd.exe
  C:\Windows\System\GwqNPhd.exe
  2⤵
  PID:12968
- C:\Windows\System\vLFXRJO.exe
  C:\Windows\System\vLFXRJO.exe
  2⤵
  PID:13448
- C:\Windows\System\ifkxWgh.exe
  C:\Windows\System\ifkxWgh.exe
  2⤵
  PID:13260
- C:\Windows\System\cAzuLQA.exe
  C:\Windows\System\cAzuLQA.exe
  2⤵
  PID:12748
- C:\Windows\System\nvPUolK.exe
  C:\Windows\System\nvPUolK.exe
  2⤵
  PID:14028
- C:\Windows\System\MwubWRC.exe
  C:\Windows\System\MwubWRC.exe
  2⤵
  PID:13976
- C:\Windows\System\YQykoEn.exe
  C:\Windows\System\YQykoEn.exe
  2⤵
  PID:14080
- C:\Windows\System\zCnMOqV.exe
  C:\Windows\System\zCnMOqV.exe
  2⤵
  PID:13440
- C:\Windows\System\JOGvFuc.exe
  C:\Windows\System\JOGvFuc.exe
  2⤵
  PID:8316
- C:\Windows\System\lKssgqV.exe
  C:\Windows\System\lKssgqV.exe
  2⤵
  PID:13560
- C:\Windows\System\dIHlSNh.exe
  C:\Windows\System\dIHlSNh.exe
  2⤵
  PID:4920
- C:\Windows\System\QFUgGRI.exe
  C:\Windows\System\QFUgGRI.exe
  2⤵
  PID:2044
- C:\Windows\System\ZykiVIS.exe
  C:\Windows\System\ZykiVIS.exe
  2⤵
  PID:13716
- C:\Windows\System\yCPcWzP.exe
  C:\Windows\System\yCPcWzP.exe
  2⤵
  PID:13904
- C:\Windows\System\sYCOZmz.exe
  C:\Windows\System\sYCOZmz.exe
  2⤵
  PID:404
- C:\Windows\System\tXidIed.exe
  C:\Windows\System\tXidIed.exe
  2⤵
  PID:10900
- C:\Windows\System\niEDsmh.exe
  C:\Windows\System\niEDsmh.exe
  2⤵
  PID:3464
- C:\Windows\System\YXHDbcx.exe
  C:\Windows\System\YXHDbcx.exe
  2⤵
  PID:2556
- C:\Windows\System\wzciMEG.exe
  C:\Windows\System\wzciMEG.exe
  2⤵
  PID:3176
- C:\Windows\System\kkYaFsg.exe
  C:\Windows\System\kkYaFsg.exe
  2⤵
  PID:2708
- C:\Windows\System\rKxjtSd.exe
  C:\Windows\System\rKxjtSd.exe
  2⤵
  PID:2740
- C:\Windows\System\tcqtKNl.exe
  C:\Windows\System\tcqtKNl.exe
  2⤵
  PID:1484
- C:\Windows\System\iNkAmrj.exe
  C:\Windows\System\iNkAmrj.exe
  2⤵
  PID:9080
- C:\Windows\System\KsqEecc.exe
  C:\Windows\System\KsqEecc.exe
  2⤵
  PID:13856
- C:\Windows\System\bvLZVxj.exe
  C:\Windows\System\bvLZVxj.exe
  2⤵
  PID:3276
- C:\Windows\System\orJgvXT.exe
  C:\Windows\System\orJgvXT.exe
  2⤵
  PID:1204
- C:\Windows\System\ahuBWNp.exe
  C:\Windows\System\ahuBWNp.exe
  2⤵
  PID:9272
- C:\Windows\System\RIjZnDX.exe
  C:\Windows\System\RIjZnDX.exe
  2⤵
  PID:14340
- C:\Windows\System\EvstYip.exe
  C:\Windows\System\EvstYip.exe
  2⤵
  PID:14360
- C:\Windows\System\UxSMtYh.exe
  C:\Windows\System\UxSMtYh.exe
  2⤵
  PID:14440
- C:\Windows\System\LjInloA.exe
  C:\Windows\System\LjInloA.exe
  2⤵
  PID:14460
- C:\Windows\System\FjcIOwv.exe
  C:\Windows\System\FjcIOwv.exe
  2⤵
  PID:14492
- C:\Windows\System\tjcIESe.exe
  C:\Windows\System\tjcIESe.exe
  2⤵
  PID:14508
- C:\Windows\System\IgZzZlr.exe
  C:\Windows\System\IgZzZlr.exe
  2⤵
  PID:14540
- C:\Windows\System\Vgfwbxf.exe
  C:\Windows\System\Vgfwbxf.exe
  2⤵
  PID:14576
- C:\Windows\System\TeuRhLM.exe
  C:\Windows\System\TeuRhLM.exe
  2⤵
  PID:14608
- C:\Windows\System\bqQCDNR.exe
  C:\Windows\System\bqQCDNR.exe
  2⤵
  PID:14636
- C:\Windows\System\IjFVScc.exe
  C:\Windows\System\IjFVScc.exe
  2⤵
  PID:14656
- C:\Windows\System\uphbcCb.exe
  C:\Windows\System\uphbcCb.exe
  2⤵
  PID:14676
- C:\Windows\System\ASEEAZX.exe
  C:\Windows\System\ASEEAZX.exe
  2⤵
  PID:14692
- C:\Windows\System\osyxxeZ.exe
  C:\Windows\System\osyxxeZ.exe
  2⤵
  PID:14712
- C:\Windows\System\HqwOSDw.exe
  C:\Windows\System\HqwOSDw.exe
  2⤵
  PID:14776
- C:\Windows\System\PrhciVZ.exe
  C:\Windows\System\PrhciVZ.exe
  2⤵
  PID:14792
- C:\Windows\System\msbeSUV.exe
  C:\Windows\System\msbeSUV.exe
  2⤵
  PID:14812
- C:\Windows\System\TfuNiwH.exe
  C:\Windows\System\TfuNiwH.exe
  2⤵
  PID:14828
- C:\Windows\System\DamkfGz.exe
  C:\Windows\System\DamkfGz.exe
  2⤵
  PID:14844
- C:\Windows\System\VSNmNPB.exe
  C:\Windows\System\VSNmNPB.exe
  2⤵
  PID:14860
- C:\Windows\System\njYJYjU.exe
  C:\Windows\System\njYJYjU.exe
  2⤵
  PID:14880
- C:\Windows\System\ikOzAlo.exe
  C:\Windows\System\ikOzAlo.exe
  2⤵
  PID:14908
- C:\Windows\System\scEuiSp.exe
  C:\Windows\System\scEuiSp.exe
  2⤵
  PID:14928
- C:\Windows\System\PbltWIy.exe
  C:\Windows\System\PbltWIy.exe
  2⤵
  PID:14944
- C:\Windows\System\UEAjuOy.exe
  C:\Windows\System\UEAjuOy.exe
  2⤵
  PID:14960
- C:\Windows\System\JZeLrxy.exe
  C:\Windows\System\JZeLrxy.exe
  2⤵
  PID:14976
- C:\Windows\System\GztfuKd.exe
  C:\Windows\System\GztfuKd.exe
  2⤵
  PID:14996
- C:\Windows\System\qkdjYrs.exe
  C:\Windows\System\qkdjYrs.exe
  2⤵
  PID:15048
- C:\Windows\System\hOIQnEl.exe
  C:\Windows\System\hOIQnEl.exe
  2⤵
  PID:15072
- C:\Windows\System\ZAdkaoC.exe
  C:\Windows\System\ZAdkaoC.exe
  2⤵
  PID:15088
- C:\Windows\System\tpyYBbZ.exe
  C:\Windows\System\tpyYBbZ.exe
  2⤵
  PID:15104
- C:\Windows\System\oKUQDra.exe
  C:\Windows\System\oKUQDra.exe
  2⤵
  PID:15120
- C:\Windows\System\ndRiaoW.exe
  C:\Windows\System\ndRiaoW.exe
  2⤵
  PID:15136
- C:\Windows\System\FXDsqwk.exe
  C:\Windows\System\FXDsqwk.exe
  2⤵
  PID:15152
- C:\Windows\System\XugvvnK.exe
  C:\Windows\System\XugvvnK.exe
  2⤵
  PID:15168
- C:\Windows\System\WMPkoFL.exe
  C:\Windows\System\WMPkoFL.exe
  2⤵
  PID:15196
- C:\Windows\System\cbEZrnV.exe
  C:\Windows\System\cbEZrnV.exe
  2⤵
  PID:15212
- C:\Windows\System\ccBDktw.exe
  C:\Windows\System\ccBDktw.exe
  2⤵
  PID:15228
- C:\Windows\System\iLlgshz.exe
  C:\Windows\System\iLlgshz.exe
  2⤵
  PID:15244
- C:\Windows\System\whXAkRb.exe
  C:\Windows\System\whXAkRb.exe
  2⤵
  PID:15260
- C:\Windows\System\fIPGOlr.exe
  C:\Windows\System\fIPGOlr.exe
  2⤵
  PID:15276
- C:\Windows\System\bCTwoAF.exe
  C:\Windows\System\bCTwoAF.exe
  2⤵
  PID:15292
- C:\Windows\System\bCzuvrj.exe
  C:\Windows\System\bCzuvrj.exe
  2⤵
  PID:15308
- C:\Windows\System\BblInGu.exe
  C:\Windows\System\BblInGu.exe
  2⤵
  PID:15324
- C:\Windows\System\hyfGvRx.exe
  C:\Windows\System\hyfGvRx.exe
  2⤵
  PID:15340
- C:\Windows\System\orGLJka.exe
  C:\Windows\System\orGLJka.exe
  2⤵
  PID:15356
- C:\Windows\System\ZYEzZoO.exe
  C:\Windows\System\ZYEzZoO.exe
  2⤵
  PID:3104
- C:\Windows\System\zNcNEUs.exe
  C:\Windows\System\zNcNEUs.exe
  2⤵
  PID:3836
- C:\Windows\System\AcODFYZ.exe
  C:\Windows\System\AcODFYZ.exe
  2⤵
  PID:1168
- C:\Windows\System\rQOEnCh.exe
  C:\Windows\System\rQOEnCh.exe
  2⤵
  PID:13420
- C:\Windows\System\zUvpqkl.exe
  C:\Windows\System\zUvpqkl.exe
  2⤵
  PID:3888
- C:\Windows\System\orREIiV.exe
  C:\Windows\System\orREIiV.exe
  2⤵
  PID:13324
- C:\Windows\System\wxHDPeC.exe
  C:\Windows\System\wxHDPeC.exe
  2⤵
  PID:10444
- C:\Windows\System\HdkUHIS.exe
  C:\Windows\System\HdkUHIS.exe
  2⤵
  PID:2772
- C:\Windows\System\BpmjRNr.exe
  C:\Windows\System\BpmjRNr.exe
  2⤵
  PID:14100
- C:\Windows\System\IgvsPOE.exe
  C:\Windows\System\IgvsPOE.exe
  2⤵
  PID:460
- C:\Windows\System\CbsZLAD.exe
  C:\Windows\System\CbsZLAD.exe
  2⤵
  PID:1012
- C:\Windows\System\nYWJKuG.exe
  C:\Windows\System\nYWJKuG.exe
  2⤵
  PID:3652
- C:\Windows\System\WPwjYgp.exe
  C:\Windows\System\WPwjYgp.exe
  2⤵
  PID:4408
- C:\Windows\System\nlSWCee.exe
  C:\Windows\System\nlSWCee.exe
  2⤵
  PID:1928
- C:\Windows\System\kCcOtKC.exe
  C:\Windows\System\kCcOtKC.exe
  2⤵
  PID:14376
- C:\Windows\System\qGOGDXb.exe
  C:\Windows\System\qGOGDXb.exe
  2⤵
  PID:14404
- C:\Windows\System\ycJAVBS.exe
  C:\Windows\System\ycJAVBS.exe
  2⤵
  PID:3736
- C:\Windows\System\dOcQvvT.exe
  C:\Windows\System\dOcQvvT.exe
  2⤵
  PID:968
- C:\Windows\System\EWNUuez.exe
  C:\Windows\System\EWNUuez.exe
  2⤵
  PID:5060
- C:\Windows\System\JYXFdas.exe
  C:\Windows\System\JYXFdas.exe
  2⤵
  PID:5012
- C:\Windows\System\GbfQXVK.exe
  C:\Windows\System\GbfQXVK.exe
  2⤵
  PID:14348
- C:\Windows\System\AlHKEcT.exe
  C:\Windows\System\AlHKEcT.exe
  2⤵
  PID:14520
- C:\Windows\System\HkVdaTK.exe
  C:\Windows\System\HkVdaTK.exe
  2⤵
  PID:4504
- C:\Windows\System\ntHYSdm.exe
  C:\Windows\System\ntHYSdm.exe
  2⤵
  PID:4380
- C:\Windows\System\sVfRhbC.exe
  C:\Windows\System\sVfRhbC.exe
  2⤵
  PID:3300
- C:\Windows\System\qJCCdfG.exe
  C:\Windows\System\qJCCdfG.exe
  2⤵
  PID:4808
- C:\Windows\System\iaMHDrx.exe
  C:\Windows\System\iaMHDrx.exe
  2⤵
  PID:1704
- C:\Windows\System\RnvVdDl.exe
  C:\Windows\System\RnvVdDl.exe
  2⤵
  PID:4216
- C:\Windows\System\MKeuMCH.exe
  C:\Windows\System\MKeuMCH.exe
  2⤵
  PID:2688
- C:\Windows\System\rkdMMyX.exe
  C:\Windows\System\rkdMMyX.exe
  2⤵
  PID:3852
- C:\Windows\System\CISZubK.exe
  C:\Windows\System\CISZubK.exe
  2⤵
  PID:3856
- C:\Windows\System\ANIWTzg.exe
  C:\Windows\System\ANIWTzg.exe
  2⤵
  PID:14756
- C:\Windows\System\qbwYzUY.exe
  C:\Windows\System\qbwYzUY.exe
  2⤵
  PID:5000
- C:\Windows\System\eaSpVHC.exe
  C:\Windows\System\eaSpVHC.exe
  2⤵
  PID:14380
- C:\Windows\System\zlHlkTq.exe
  C:\Windows\System\zlHlkTq.exe
  2⤵
  PID:14420
- C:\Windows\System\rXzFKYB.exe
  C:\Windows\System\rXzFKYB.exe
  2⤵
  PID:14452
- C:\Windows\System\GVsDgTH.exe
  C:\Windows\System\GVsDgTH.exe
  2⤵
  PID:14476
- C:\Windows\System\PPxsquR.exe
  C:\Windows\System\PPxsquR.exe
  2⤵
  PID:14724
- C:\Windows\System\jYZvhto.exe
  C:\Windows\System\jYZvhto.exe
  2⤵
  PID:2672
- C:\Windows\System\amBMLgU.exe
  C:\Windows\System\amBMLgU.exe
  2⤵
  PID:14552
- C:\Windows\System\HNWkebo.exe
  C:\Windows\System\HNWkebo.exe
  2⤵
  PID:14572
- C:\Windows\System\lnLykpY.exe
  C:\Windows\System\lnLykpY.exe
  2⤵
  PID:14616
- C:\Windows\System\azAjrxp.exe
  C:\Windows\System\azAjrxp.exe
  2⤵
  PID:14652
- C:\Windows\System\rykNcLG.exe
  C:\Windows\System\rykNcLG.exe
  2⤵
  PID:14684
- C:\Windows\System\ZXXFdKx.exe
  C:\Windows\System\ZXXFdKx.exe
  2⤵
  PID:14708
- C:\Windows\System\EyZZswe.exe
  C:\Windows\System\EyZZswe.exe
  2⤵
  PID:14736
- C:\Windows\System\IWGltXL.exe
  C:\Windows\System\IWGltXL.exe
  2⤵
  PID:14752
- C:\Windows\System\ESEzZdS.exe
  C:\Windows\System\ESEzZdS.exe
  2⤵
  PID:14784
- C:\Windows\System\wwzUOfC.exe
  C:\Windows\System\wwzUOfC.exe
  2⤵
  PID:2100
- C:\Windows\System\IJQnBUv.exe
  C:\Windows\System\IJQnBUv.exe
  2⤵
  PID:4872
- C:\Windows\System\feERXiD.exe
  C:\Windows\System\feERXiD.exe
  2⤵
  PID:5004
- C:\Windows\System\DFrCNHe.exe
  C:\Windows\System\DFrCNHe.exe
  2⤵
  PID:14856
- C:\Windows\System\uGDbwwv.exe
  C:\Windows\System\uGDbwwv.exe
  2⤵
  PID:14876
- C:\Windows\System\gdpxSax.exe
  C:\Windows\System\gdpxSax.exe
  2⤵
  PID:14900
- C:\Windows\System\dcnsdFw.exe
  C:\Windows\System\dcnsdFw.exe
  2⤵
  PID:14924
- C:\Windows\System\xsavMRu.exe
  C:\Windows\System\xsavMRu.exe
  2⤵
  PID:14956
- C:\Windows\System\nVBXhZJ.exe
  C:\Windows\System\nVBXhZJ.exe
  2⤵
  PID:15012
- C:\Windows\System\UoYEQDh.exe
  C:\Windows\System\UoYEQDh.exe
  2⤵
  PID:15132
- C:\Windows\System\qavhxVR.exe
  C:\Windows\System\qavhxVR.exe
  2⤵
  PID:15176
- C:\Windows\System\XUkvXRk.exe
  C:\Windows\System\XUkvXRk.exe
  2⤵
  PID:15192
- C:\Windows\System\OdTmfLO.exe
  C:\Windows\System\OdTmfLO.exe
  2⤵
  PID:15224
- C:\Windows\System\cubLsGc.exe
  C:\Windows\System\cubLsGc.exe
  2⤵
  PID:15256
- C:\Windows\System\sJeblWs.exe
  C:\Windows\System\sJeblWs.exe
  2⤵
  PID:15284
- C:\Windows\System\fiiklYD.exe
  C:\Windows\System\fiiklYD.exe
  2⤵
  PID:15316
- C:\Windows\System\KpYFtIn.exe
  C:\Windows\System\KpYFtIn.exe
  2⤵
  PID:15336
- C:\Windows\System\BcJjVVJ.exe
  C:\Windows\System\BcJjVVJ.exe
  2⤵
  PID:2240
- C:\Windows\System\BbEMPiB.exe
  C:\Windows\System\BbEMPiB.exe
  2⤵
  PID:3584
- C:\Windows\System\WxIeCMq.exe
  C:\Windows\System\WxIeCMq.exe
  2⤵
  PID:14244
- C:\Windows\System\fjNZyeJ.exe
  C:\Windows\System\fjNZyeJ.exe
  2⤵
  PID:3108
- C:\Windows\System\wCWWQDD.exe
  C:\Windows\System\wCWWQDD.exe
  2⤵
  PID:14764
- C:\Windows\System\hNTViAq.exe
  C:\Windows\System\hNTViAq.exe
  2⤵
  PID:3180
- C:\Windows\System\nZJzGuN.exe
  C:\Windows\System\nZJzGuN.exe
  2⤵
  PID:13112
- C:\Windows\System\NxrVzOa.exe
  C:\Windows\System\NxrVzOa.exe
  2⤵
  PID:13352
- C:\Windows\System\wARqfFr.exe
  C:\Windows\System\wARqfFr.exe
  2⤵
  PID:14392
- C:\Windows\System\xDkpOgP.exe
  C:\Windows\System\xDkpOgP.exe
  2⤵
  PID:7580
- C:\Windows\System\dNKSYMt.exe
  C:\Windows\System\dNKSYMt.exe
  2⤵
  PID:3820
- C:\Windows\System\ExfYvzI.exe
  C:\Windows\System\ExfYvzI.exe
  2⤵
  PID:14504
- C:\Windows\System\RqMQGrM.exe
  C:\Windows\System\RqMQGrM.exe
  2⤵
  PID:14564
- C:\Windows\System\lbbJWne.exe
  C:\Windows\System\lbbJWne.exe
  2⤵
  PID:2244
- C:\Windows\System\yEsyBwP.exe
  C:\Windows\System\yEsyBwP.exe
  2⤵
  PID:14600
- C:\Windows\System\fdayFIl.exe
  C:\Windows\System\fdayFIl.exe
  2⤵
  PID:14396
- C:\Windows\System\tDqxpke.exe
  C:\Windows\System\tDqxpke.exe
  2⤵
  PID:13480
- C:\Windows\System\ThCmvDH.exe
  C:\Windows\System\ThCmvDH.exe
  2⤵
  PID:392
- C:\Windows\System\dXtMbAQ.exe
  C:\Windows\System\dXtMbAQ.exe
  2⤵
  PID:14368
- C:\Windows\System\jDRJCHA.exe
  C:\Windows\System\jDRJCHA.exe
  2⤵
  PID:14432
- C:\Windows\System\tnSRWvi.exe
  C:\Windows\System\tnSRWvi.exe
  2⤵
  PID:14484
- C:\Windows\System\McLTRIc.exe
  C:\Windows\System\McLTRIc.exe
  2⤵
  PID:15040
- C:\Windows\System\nweiXUA.exe
  C:\Windows\System\nweiXUA.exe
  2⤵
  PID:14820
- C:\Windows\System\tmDPEXs.exe
  C:\Windows\System\tmDPEXs.exe
  2⤵
  PID:13784
- C:\Windows\System\ggHTrqZ.exe
  C:\Windows\System\ggHTrqZ.exe
  2⤵
  PID:14672
- C:\Windows\System\bMLOYYw.exe
  C:\Windows\System\bMLOYYw.exe
  2⤵
  PID:14728
- C:\Windows\System\pkSjZok.exe
  C:\Windows\System\pkSjZok.exe
  2⤵
  PID:14400
- C:\Windows\System\iqAadlE.exe
  C:\Windows\System\iqAadlE.exe
  2⤵
  PID:632
- C:\Windows\System\SmpHrWo.exe
  C:\Windows\System\SmpHrWo.exe
  2⤵
  PID:15056
- C:\Windows\System\opfMomz.exe
  C:\Windows\System\opfMomz.exe
  2⤵
  PID:14760
- C:\Windows\System\cQrXZsC.exe
  C:\Windows\System\cQrXZsC.exe
  2⤵
  PID:14920
- C:\Windows\System\lNIcaWj.exe
  C:\Windows\System\lNIcaWj.exe
  2⤵
  PID:4364
- C:\Windows\System\AoYrGCa.exe
  C:\Windows\System\AoYrGCa.exe
  2⤵
  PID:15164
- C:\Windows\System\viBhWEZ.exe
  C:\Windows\System\viBhWEZ.exe
  2⤵
  PID:15188
- C:\Windows\System\HhuJdsn.exe
  C:\Windows\System\HhuJdsn.exe
  2⤵
  PID:15060
- C:\Windows\System\kENnCjk.exe
  C:\Windows\System\kENnCjk.exe
  2⤵
  PID:2120
- C:\Windows\System\FHAceJh.exe
  C:\Windows\System\FHAceJh.exe
  2⤵
  PID:15100
- C:\Windows\System\MTkURrY.exe
  C:\Windows\System\MTkURrY.exe
  2⤵
  PID:15128
- C:\Windows\System\hcASrNG.exe
  C:\Windows\System\hcASrNG.exe
  2⤵
  PID:3460
- C:\Windows\System\wdOeMYW.exe
  C:\Windows\System\wdOeMYW.exe
  2⤵
  PID:15148
- C:\Windows\System\bvgwrgQ.exe
  C:\Windows\System\bvgwrgQ.exe
  2⤵
  PID:15028
- C:\Windows\System\aCMfsNV.exe
  C:\Windows\System\aCMfsNV.exe
  2⤵
  PID:14188
- C:\Windows\System\SRcOjFl.exe
  C:\Windows\System\SRcOjFl.exe
  2⤵
  PID:4336
- C:\Windows\System\GLJxNET.exe
  C:\Windows\System\GLJxNET.exe
  2⤵
  PID:13516
- C:\Windows\System\viRiSVI.exe
  C:\Windows\System\viRiSVI.exe
  2⤵
  PID:4936
- C:\Windows\System\TxaOBCs.exe
  C:\Windows\System\TxaOBCs.exe
  2⤵
  PID:13488
- C:\Windows\System\tcabdgb.exe
  C:\Windows\System\tcabdgb.exe
  2⤵
  PID:584
- C:\Windows\System\buAECEr.exe
  C:\Windows\System\buAECEr.exe
  2⤵
  PID:3832
- C:\Windows\System\PcQCrgx.exe
  C:\Windows\System\PcQCrgx.exe
  2⤵
  PID:668
- C:\Windows\System\BbTBtVX.exe
  C:\Windows\System\BbTBtVX.exe
  2⤵
  PID:14468
- C:\Windows\System\lJlLWXA.exe
  C:\Windows\System\lJlLWXA.exe
  2⤵
  PID:14804
- C:\Windows\System\gaBJSLK.exe
  C:\Windows\System\gaBJSLK.exe
  2⤵
  PID:14668
- C:\Windows\System\vtpiHzD.exe
  C:\Windows\System\vtpiHzD.exe
  2⤵
  PID:14800
- C:\Windows\System\njEemqT.exe
  C:\Windows\System\njEemqT.exe
  2⤵
  PID:3800
- C:\Windows\System\lIfDlbu.exe
  C:\Windows\System\lIfDlbu.exe
  2⤵
  PID:3228
- C:\Windows\System\JlnBdtH.exe
  C:\Windows\System\JlnBdtH.exe
  2⤵
  PID:544
- C:\Windows\System\vfhixwI.exe
  C:\Windows\System\vfhixwI.exe
  2⤵
  PID:15160
- C:\Windows\System\INqhkfd.exe
  C:\Windows\System\INqhkfd.exe
  2⤵
  PID:15288
- C:\Windows\System\PkeYziq.exe
  C:\Windows\System\PkeYziq.exe
  2⤵
  PID:13444
- C:\Windows\System\kXDAshO.exe
  C:\Windows\System\kXDAshO.exe
  2⤵
  PID:15112
- C:\Windows\System\bvGlAmd.exe
  C:\Windows\System\bvGlAmd.exe
  2⤵
  PID:2860
- C:\Windows\System\jXswKvD.exe
  C:\Windows\System\jXswKvD.exe
  2⤵
  PID:15220
- C:\Windows\System\smRWpOB.exe
  C:\Windows\System\smRWpOB.exe
  2⤵
  PID:15240
- C:\Windows\System\gkxintM.exe
  C:\Windows\System\gkxintM.exe
  2⤵
  PID:15272
- C:\Windows\System\vkQvTHw.exe
  C:\Windows\System\vkQvTHw.exe
  2⤵
  PID:2840
- C:\Windows\System\oPgnheS.exe
  C:\Windows\System\oPgnheS.exe
  2⤵
  PID:2848
- C:\Windows\System\skkjsJB.exe
  C:\Windows\System\skkjsJB.exe
  2⤵
  PID:14388
- C:\Windows\System\TmqCaGj.exe
  C:\Windows\System\TmqCaGj.exe
  2⤵
  PID:376
- C:\Windows\System\lOpRcUo.exe
  C:\Windows\System\lOpRcUo.exe
  2⤵
  PID:4404
- C:\Windows\System\pKoJGmB.exe
  C:\Windows\System\pKoJGmB.exe
  2⤵
  PID:12196
- C:\Windows\System\dimMNmR.exe
  C:\Windows\System\dimMNmR.exe
  2⤵
  PID:3916
- C:\Windows\System\ukmmSYY.exe
  C:\Windows\System\ukmmSYY.exe
  2⤵
  PID:5148
- C:\Windows\System\OsilghM.exe
  C:\Windows\System\OsilghM.exe
  2⤵
  PID:14644
- C:\Windows\System\OaIWStk.exe
  C:\Windows\System\OaIWStk.exe
  2⤵
  PID:14748
- C:\Windows\System\MrJPIuo.exe
  C:\Windows\System\MrJPIuo.exe
  2⤵
  PID:4316
- C:\Windows\System\xjLTjUo.exe
  C:\Windows\System\xjLTjUo.exe
  2⤵
  PID:3268
- C:\Windows\System\sCEAyNK.exe
  C:\Windows\System\sCEAyNK.exe
  2⤵
  PID:14952
- C:\Windows\System\veInSoh.exe
  C:\Windows\System\veInSoh.exe
  2⤵
  PID:14984
- C:\Windows\System\RyinXsV.exe
  C:\Windows\System\RyinXsV.exe
  2⤵
  PID:15036
- C:\Windows\System\FUZLZWw.exe
  C:\Windows\System\FUZLZWw.exe
  2⤵
  PID:15080
- C:\Windows\System\DscDgaU.exe
  C:\Windows\System\DscDgaU.exe
  2⤵
  PID:3924
- C:\Windows\System\xEHkFmZ.exe
  C:\Windows\System\xEHkFmZ.exe
  2⤵
  PID:15020
- C:\Windows\System\uvEbjyo.exe
  C:\Windows\System\uvEbjyo.exe
  2⤵
  PID:14972
- C:\Windows\System\ZbvbnPn.exe
  C:\Windows\System\ZbvbnPn.exe
  2⤵
  PID:5712
- C:\Windows\System\mjarqLu.exe
  C:\Windows\System\mjarqLu.exe
  2⤵
  PID:2000
- C:\Windows\System\muXYweD.exe
  C:\Windows\System\muXYweD.exe
  2⤵
  PID:228
- C:\Windows\System\WyFRHpi.exe
  C:\Windows\System\WyFRHpi.exe
  2⤵
  PID:5760
- C:\Windows\System\rdMJtgl.exe
  C:\Windows\System\rdMJtgl.exe
  2⤵
  PID:5688
- C:\Windows\System\krLpvoB.exe
  C:\Windows\System\krLpvoB.exe
  2⤵
  PID:5716
- C:\Windows\System\KLuiOrw.exe
  C:\Windows\System\KLuiOrw.exe
  2⤵
  PID:14916
- C:\Windows\System\lfzpzRW.exe
  C:\Windows\System\lfzpzRW.exe
  2⤵
  PID:4036
- C:\Windows\System\wXFGGmH.exe
  C:\Windows\System\wXFGGmH.exe
  2⤵
  PID:5596
- C:\Windows\System\qxXocyt.exe
  C:\Windows\System\qxXocyt.exe
  2⤵
  PID:5216
- C:\Windows\System\yQJaoto.exe
  C:\Windows\System\yQJaoto.exe
  2⤵
  PID:5288
- C:\Windows\System\TQCJwLh.exe
  C:\Windows\System\TQCJwLh.exe
  2⤵
  PID:6156
- C:\Windows\System\BtyrwZB.exe
  C:\Windows\System\BtyrwZB.exe
  2⤵
  PID:4820
- C:\Windows\System\tNiJMDL.exe
  C:\Windows\System\tNiJMDL.exe
  2⤵
  PID:14604
- C:\Windows\System\NkYihcJ.exe
  C:\Windows\System\NkYihcJ.exe
  2⤵
  PID:6060
- C:\Windows\System\UqGUeEd.exe
  C:\Windows\System\UqGUeEd.exe
  2⤵
  PID:4924
- C:\Windows\System\gniERQP.exe
  C:\Windows\System\gniERQP.exe
  2⤵
  PID:1448
- C:\Windows\System\ABkYVJo.exe
  C:\Windows\System\ABkYVJo.exe
  2⤵
  PID:5784
- C:\Windows\System\NscsXeH.exe
  C:\Windows\System\NscsXeH.exe
  2⤵
  PID:1688
- C:\Windows\System\PuLlrxJ.exe
  C:\Windows\System\PuLlrxJ.exe
  2⤵
  PID:5272
- C:\Windows\System\hCfeZhM.exe
  C:\Windows\System\hCfeZhM.exe
  2⤵
  PID:13468
- C:\Windows\System\ufevjSG.exe
  C:\Windows\System\ufevjSG.exe
  2⤵
  PID:15004
- C:\Windows\System\hqABaoz.exe
  C:\Windows\System\hqABaoz.exe
  2⤵
  PID:3140
- C:\Windows\System\NbhBwvr.exe
  C:\Windows\System\NbhBwvr.exe
  2⤵
  PID:5936
- C:\Windows\System\uoaeVPu.exe
  C:\Windows\System\uoaeVPu.exe
  2⤵
  PID:1692
- C:\Windows\System\GJMiriy.exe
  C:\Windows\System\GJMiriy.exe
  2⤵
  PID:5412
- C:\Windows\System\DJQeMZR.exe
  C:\Windows\System\DJQeMZR.exe
  2⤵
  PID:6392
- C:\Windows\System\CDEtKdB.exe
  C:\Windows\System\CDEtKdB.exe
  2⤵
  PID:6528
- C:\Windows\System\QynPtsL.exe
  C:\Windows\System\QynPtsL.exe
  2⤵
  PID:4516
- C:\Windows\System\AvjfmKF.exe
  C:\Windows\System\AvjfmKF.exe
  2⤵
  PID:5524
- C:\Windows\System\qNprvfL.exe
  C:\Windows\System\qNprvfL.exe
  2⤵
  PID:13536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yijtcbrb.baj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\FnovRiK.exe

Filesize
1.7MB

MD5
3d284faa6423add39bc40ac678a74832

SHA1
5f18c3a9568baf4536d2c33fce6f6d5725d6d818

SHA256
1cbdaf73a90f41a2415769c171bdc9902121033e8186f94458ea0896e29818e4

SHA512
7539ba7b2e7dc787e3435374758e4c949aafc74f00808e60214fe174550b5394724c9191983ca8c247b45d83916d90d8a1eabedbbfbeac7782f920f7adbb031d

Download Submit
C:\Windows\System\GsspEDS.exe

Filesize
1.7MB

MD5
c766b9cccf5bffa0150d095fb078fd9d

SHA1
1785fc57d5342e5ce5fec5601b876bd056d86824

SHA256
b4a8c75cf70cf3a33a5a0b4df9084fd2cc88242492c38800b5d4375fdf8f084a

SHA512
26e3fcb088c5fa824ade185838cd6ef2b69081d04f063c5062c146cb9b4971d1b7f296c2802c13c08247d0276bcfc8e20fb6b95b1d6bdb6abbde23d2b7a5f13c

Download Submit
C:\Windows\System\Injyyzj.exe

Filesize
1.7MB

MD5
29e36b0ac323fe116b25977bac713153

SHA1
eb9bd7a923b78890a7cfb48f91c68b94b6dc6f14

SHA256
980ea9c1c48d241eb657537b6aaf2caef093b515d1d8521298512c77a2c95991

SHA512
a0faf8a0e548819dc3411b8417104abd1fee2e16dc67527eefbed2a1c8e14ec05094520d531663c1f50fff3fae48c7ffb2cce203e42208e52e115722b48c10af

Download Submit
C:\Windows\System\KBJDhFJ.exe

Filesize
1.7MB

MD5
53f623ebe677704d04b36f9d17972d89

SHA1
da277ecf97f35b1195e7c3043171ab2edefc36dd

SHA256
2640bf568d0edde2fcf2a04a11015346e01620e64873af11745db896361f2b3b

SHA512
e02709be12fcb079ae5d993f34d5f6dbe8f5e3789623d353b469c41c986e96ad4282f9593018b16c920617ab730fd563204b421443b0459fd5b6d01a7fbb50d7

Download Submit
C:\Windows\System\OVldGPC.exe

Filesize
1.7MB

MD5
f5e87e952e517cc86fd2f09c5c167eda

SHA1
5c28bc6ca94cf1f963d3241b110f4660744b7452

SHA256
4549b6cc09bcce76ff269b1d45d81ec792a558dcc29ec4cc62bb3d1a284bb2dd

SHA512
65bf614318e5ca8cfa903584d3a07528c79cbefda05464226e284e445d2d42dfe91f4f5c5a91b5f63b890b70e4e8379a5f0889249a211881d2b279cba2178bd9

Download Submit
C:\Windows\System\OiKxiwL.exe

Filesize
1.7MB

MD5
5cdb7d451badcaad8d7ebb8d457c359e

SHA1
51b7787700296b4685018240057b94a549c5e2e7

SHA256
96e53af11798ac525068b21e642fd888ab5c87c32bed64a21d87fef3568b529c

SHA512
94a710315b4b15763e1487c46a40ac470a3767aeb17d110a8aa0a40ccb725e6ee2d74ccc3fe910c2832a49eebe830561711358f2daa9c08ef4b30252d9ddd6f8

Download Submit
C:\Windows\System\PCjJckL.exe

Filesize
1.7MB

MD5
b5f8befbeb984f0ebd8d3653c3b6ac4f

SHA1
ad9854910749994e59e052a782f30345735f0449

SHA256
24370fcb5128eec3dcd14ec0405a8e741be48c8611a669fb1e5ace62a212196c

SHA512
9cf7adf0be4099a81ce8f5fcff854fda796cf02218cc711b435d8d98fa7f0481b8aa661b3e262a550ea54cb64ca26f47fe0aa064effd79ddb6f84da0f92cdc23

Download Submit
C:\Windows\System\RHnZxeZ.exe

Filesize
1.7MB

MD5
d97bdc0bc7feb0beced7ccdd3786d0a8

SHA1
e8b15e6561bae6903a1729036c0e3d47e3a6b7ff

SHA256
53ce3b6988373588bda6f3c58a95f797f0d9723ff07530535a6b6ceeac001148

SHA512
9878bbbfe6bbcf7ff07ecf82a620883174a1d97885572248820884851612f4d2b9f05e67ff38d475a11716daee5ce7d53f2ee22407c14fc99c13b2065cc17ebe

Download Submit
C:\Windows\System\RlOxABu.exe

Filesize
1.7MB

MD5
21f5136a7a1e8fd2a37726d51a2baad0

SHA1
24cccad0424857348f4d845fad1abbdc6b1a6fe5

SHA256
7ec78b2c57d014adca44a38455e568f25ea21a3d3279c215d431fe7e33cddf42

SHA512
9017d08dc2b63527e8399f6f6f0d941d407d953239d50c2ea742f020bb51c8a952c468864bba74333bba70c6ed01dc0e4c9f13b8290f96fe7ff66f1a40f72308

Download Submit
C:\Windows\System\VCEVlDF.exe

Filesize
1.7MB

MD5
4f57ce883523c43a87bb34efd4ebfd1e

SHA1
84712c51ed00398110efa931c17f316a6c9c64f1

SHA256
8cf0ca5f034ae8f26b70d52c38692283cef5877dfe859f2f152c99a2a26c1a08

SHA512
1d535cafd545af10e4611fc83836bee3c15519dd16d1245fc81307c553726c9b70501d92c237b57f074670c50f203c2b7d0e9eb2e5cb7251be9a2ac9a3bc4188

Download Submit
C:\Windows\System\WMyUlJc.exe

Filesize
1.7MB

MD5
fdafc21f93bf33c87fb803fe31c5e948

SHA1
e952cb860ea870ee30e36c5d530faa5e5c7cfaaf

SHA256
60a3a8849efc879afc067101f8e96657c63b75609636193d719de2e23ea29033

SHA512
f79a2a4a95b4467ca2c7a2bc7375c149bc2abb69f8e71a001389132fe4ab0d1e5edd34fe5b069a43d685e0fdc411e52ac7d8b3a34fc6a6abf24792643a150fa1

Download Submit
C:\Windows\System\WzlLjMY.exe

Filesize
1.7MB

MD5
f8ebd751034804e48ec8b2457cb0364c

SHA1
d5dc27a2933df8b938ae402f839c3e657e5821c4

SHA256
4a218f517f5647635c817414098508cf96b9cbb07290ad8c05f916e42ecb2674

SHA512
0614e3882464fda534a9f8790a66ee158549540122912c7277a2aa0f1fe4117741f08563ffbb7d0ce4f645b17c0899f451138a688a06b644d883a0f161348c56

Download Submit
C:\Windows\System\XJsMwxt.exe

Filesize
1.7MB

MD5
b6056897f05c1f0ce861372313585c77

SHA1
8fa2867b7251fa9eb42f91cac05c1446a4e12c1f

SHA256
a2fc6c73b4a4bba115cf39e66714b2b728dce1b727afaf10c716f97235b44d4b

SHA512
afc3a36a9e93391711efb3cc40a4eeb27774c7aeaa04458c9ed13d63de9ecebb5b9db76784e69be926e14027fc7a9a456fd368e282c0431e3198e951e0fa9765

Download Submit
C:\Windows\System\XYdzHfp.exe

Filesize
1.7MB

MD5
e23d05c4d031a5bcda549e746178f49c

SHA1
0d299c829a51ff995813bd3227a80182a4fce5f8

SHA256
aa629eb0f708db333993106cfc1d3407ea95cfcbef5d3a6671e48d4893525750

SHA512
b1ef8938d945296d361112dc03307dae15273994cd622ee217dc3c0ce34031e6448e2b3e42e48086ef7b5beb1c771c9f729bf83240aa653afcb6be4d01ab40bd

Download Submit
C:\Windows\System\ZyqoHmB.exe

Filesize
1.7MB

MD5
0b27a7303145bf3d24383318a1b6d73d

SHA1
d888e0f0fe9bf807ae6cced079735041fc7c718c

SHA256
445fd950617e51b4243f341a90331ce83779ad7cbc66f4af203c5c7b1b5b89bb

SHA512
859a6fca811d256d82b5eca0b6be7c4a477f04fd3bc1cff993b5b8b9157e9f4e99785a90a86ddb7b8fd4e5d77c2119daafa100899ae4e46587414b3ca25d97ca

Download Submit
C:\Windows\System\aXXaBpw.exe

Filesize
1.7MB

MD5
e133a2facafa5f98d581473b5299ac9a

SHA1
10fb6ff9d099afaee137ae88ed8ad768fbc478dd

SHA256
f0138804c975e2739c81d3d7b13738a40c7b76771b3665713d818de683718303

SHA512
4346863f57920c674a009744d94ce1e472506f89e2cce755956f498942b622750f03e11dd79363830e1d1c17e2fa44705d709d5336ad3e171dd5bc36cd9c1a74

Download Submit
C:\Windows\System\bCiPSNR.exe

Filesize
1.7MB

MD5
d772e979a1c838737cbc734fd9102221

SHA1
c731d7504a27442e647346c2dbf33fbad49376b5

SHA256
54527e203b6a9f0f1b83d1b9f3aeec9fa674227ea9663e2af8b5dc858a7b6350

SHA512
b564121ec7a35f665e37c4072c2c852a565ca1e0e0320e2b280fc78c32e464bd1a02fbb90cc73a4c621c8449bce59707411c2ab3ba78354c542a0f7014d6d31b

Download Submit
C:\Windows\System\bOLKEgx.exe

Filesize
1.7MB

MD5
8cc6b9d8234a66e525f366401d576be5

SHA1
ab68ffcfae6ef90b2546aa81ec1cb50029ca5537

SHA256
c5cde04a66823ae38a567e5c1ff01e50fd026e726efe64a9c8feeade23298abb

SHA512
0eefb229b69bc92e2f530bd036c25548d4a80322420ebf54f77cf541cfe3419f754f572a877d02d49a1b654d1fb919e0dd4cc77a80aad45638a58ffe3f780480

Download Submit
C:\Windows\System\bWCkiWG.exe

Filesize
1.7MB

MD5
2d63b06664a8d4a1a9fa263487f459c4

SHA1
f007e0de8d3391d4442233a1ea071e59fea74ae7

SHA256
cf67c8377372c5f45ddd924e5fb4c7efe0512299c32ea12d8624b111ae8cb799

SHA512
d1ada955c8ad0d4a7d33dcad546df1115d5b8800f7646c2b51942e5eaa5760e4441b3994fe78f17dc18d84ff9f0f548075a8f33843a1bbc1fd84589776e491d8

Download Submit
C:\Windows\System\cZrtHET.exe

Filesize
1.7MB

MD5
739bd3871fe08901549bef3f08b4f5a6

SHA1
b88de6edcfa327a58810fe7a3c0a198fef68bb4d

SHA256
2554f1e5c103b0e57334fe0dbf0f0cb575b350f516a3a05392a89020bfb1fa50

SHA512
791a6862f1fbf651c882802075acfed86c87de436b1266760f429a29335cc2e25076e7011a473e77f734262e006ab631a16b27ee9df7df7e20e55131fb7dd220

Download Submit
C:\Windows\System\gORmLIK.exe

Filesize
1.7MB

MD5
5966866f2c0f42846d0a03213589cb98

SHA1
ec40ae0f54ae3a097d7f705d0a89a0e8afb2b6c3

SHA256
a34ecc0997b7a17c1ae7fdeacfb2c0ba05a6d412d8ac395fb9bae51b552dd08d

SHA512
adf72c3ffac47cef50d3e90187e60458c4fcfe791a181d1eaf5973ec0b09735c38ce6021ca006803ed896c2183066902cdb1048f6156a50550e9010985f32941

Download Submit
C:\Windows\System\grzZpDQ.exe

Filesize
1.7MB

MD5
89c673cc16ca8f5d5412a05edeb18456

SHA1
cd68a799b897a233165d965c82a073c22f7bccd6

SHA256
7fde6b4b69721686eebbe7cb8ed30452f63f503d7816486d27825c3f710668f3

SHA512
720621df31d2aeefec2932b0f642ba86f93c8e4973a4f3571a59dcd18a748670c8995a73c703c003670e7bb25320f96b64fc91f7c625fa4e79d815407276e93e

Download Submit
C:\Windows\System\iueNzSH.exe

Filesize
1.7MB

MD5
cbaaf4e19c37d46705393a423b418362

SHA1
d60a187fd261fdaa45757d17da4fb475a3952a00

SHA256
fcaf0701c9b33a2154f4503ecf25ec53b082e27479c9d92d2254c0ff335fd8bb

SHA512
2e55d345312bd0dc273647bbbaa3c5a2df5702bbf5704788b090304f4d53826b657351fc64c90b05fc955ee40a61291671d3e55557ccf561a9a8f22f511ac347

Download Submit
C:\Windows\System\jrEbdmz.exe

Filesize
1.7MB

MD5
dbc94b8cace200a3a24903c621835885

SHA1
d2dc10d63494393ef0a9afc2bf3a266509ae5c21

SHA256
e3a3431d22b627ef4d08d3f09bd56364f5d04a327adcdca37481119c6dd1f208

SHA512
fd96c0cab71673b5bae1e8a02ecd7f78bdae6f2a234d04ed128fd73234c90cbc1d5770f734c71b2612ef253a02c2c92a0fcdc4a839e9c24edda77ed1cbf27615

Download Submit
C:\Windows\System\lFpQbuF.exe

Filesize
1.7MB

MD5
9a107888b654b43b07fe20058de5e558

SHA1
d7e39ec5e563b265a291bb6cba99b5d2ea9e92cb

SHA256
5a39611791236958a49314ecd44e2ba1663c6b41573d0e3c96c57ddd244189b5

SHA512
fdbd9fe392679a438bbcfda60333e8951b178f109b296d9ddc5ba5a416e6ba22bc5bb5e0be64f84b97abd11a9790367767855c3b2a6c806727a4a2ac45bffc89

Download Submit
C:\Windows\System\lQKVFHO.exe

Filesize
1.7MB

MD5
dc2c415741bb91a7c814b194a5079ecc

SHA1
9b8086c2437771d4b906505e9fe0254509874cff

SHA256
af54e76f0989678fbec7d52bd6c841be198193ac44d40ceb417450e82c1f00e3

SHA512
45c90d132a2c1ed7edfedba4110d791f7eabf54cfdee6b5885a02f54bd805b11a036d4efa25025caf8fb81ce514aa9f9d4ea2ff2832baa14761a69fb1f6736d6

Download Submit
C:\Windows\System\pbQzBKG.exe

Filesize
1.7MB

MD5
69db91f8a43f5239801e23287f735154

SHA1
d1c60e5bd0f767642a29064ad32fe3f261e0317d

SHA256
1863715bea2344f17e5d0fad22b79113282a0b3bd77ea5b29cb9b5eae37883cd

SHA512
83901f1c74bb0d01c7c961d2fd950b92f934efbf2fc1c2a72fffb4e2c3cbf3db317daeb9b271436eb140b4bca8e64546aa6fa0f889f7c47f503accc7edb9d07b

Download Submit
C:\Windows\System\qbYZVsD.exe

Filesize
1.7MB

MD5
5bda1592aee9de1769f414f11e47ba8e

SHA1
8f83d99d0a6658b87596a840b92732d2a9b01d0c

SHA256
332658f8030483f4ac17f359ae3cc44ae9b08150a563c081fc22f3e18df6612a

SHA512
42a568271ea2881a76e0c74c0f5adf08004ead052ab7a578895692a0b2674680994f549db30e9058467e290da2dadeb70137cfb7d3bcab5a34d3ec2039b38997

Download Submit
C:\Windows\System\rWJyxIN.exe

Filesize
1.7MB

MD5
0cdfc72e28406409e66821f3c10541b4

SHA1
28d93ab015eb6501b119fe4c11e5b9846142b3ff

SHA256
9eeb83d0846cf0b34e181650c95b3c4baf4a01d0addaaab5e415dd92b46dd15e

SHA512
1da1cf7bd73c1ec09108441b9dc8bc8a11ad09b33e40a1e6764cb99361b4cd1aa882d68ff871daf3ef01198de7951d7150e4e9dee5307e2a07bfc2b0679bec1d

Download Submit
C:\Windows\System\sVNSdtX.exe

Filesize
1.7MB

MD5
76c24734d111e5b51f0299bc69b3b29c

SHA1
2439477f0875c664bdcf0687a47d28b12c7573fb

SHA256
795b94f9b72e24912e6097ee4ac3f027bce8748617349044a13dc12cb98c412c

SHA512
d2f283530a25799e9a1e9078b269e57f575e29d4b237e7fb15fc663e2d0241e06d8da4c9bc8c7436646870aef738ec1d359cd774b5c29bb0d9f6d71aca64f30a

Download Submit
C:\Windows\System\sdedbhY.exe

Filesize
1.7MB

MD5
df2b9704c6eab0535587f3027de9aa6c

SHA1
0ebd500781070644d2db33100b249406aaef650b

SHA256
fea80ebd87303a3c133284ce82464f234d9ab461ebe735cf38246fadd219ca17

SHA512
d1b89048009878076558a5cff2e841a603c73efef8038e6a39f316a71582411116ae75fcb7555685efe6ac79c639165e87c8401e1878999fa6385aa8e3db0b84

Download Submit
C:\Windows\System\szOhJUF.exe

Filesize
8B

MD5
f711adee27516b005fc25d05db275022

SHA1
37fddcc1329d6f4da1b8eb78665830cbf5074110

SHA256
a9de3e5771bb94f83a0011d6be0e78d5e9c1c91c97b1401206471b56740d49d4

SHA512
5a6cabfef649b40043c3bced543aeaa96cc1135167dc5f35eff4dd8aef45c34ed818a13fca66a04a1ce4848095ed467409b597f0ce727137f28b37a18328e1e0

Download Submit
C:\Windows\System\tKILsqk.exe

Filesize
1.7MB

MD5
5aefec6a0b201cbab8f68622bbfb06bd

SHA1
47f4733de797c7de489ebfb80c18206169205fea

SHA256
b9a0847229f3780501def46f5e1bf81a6ffb2457cfa0000c31fafa954ff236b0

SHA512
24be4f1f19b154dc1f2bc922d45d48fd39e3642dddba93193152d41112cfc083aabab99eb07acce1af72286fe2f90cc3a419bc3aba8a195728cbc9194ed556da

Download Submit
C:\Windows\System\tNONAVa.exe

Filesize
1.7MB

MD5
942f6479124753a507710cf8fbe3d3de

SHA1
8d02ef5adf464dfa08b27e0c5d3e6791c185fe11

SHA256
5bac706635d841eef0ab81a0aa9b0dc3d517818732e117ba902f28944d4a4985

SHA512
bba40d64be8d992b0a51d2f540974a7861d5362545a64307e1baf3c7a8f47b169e168351f1fb3db07eff6a9110bf812571e984d0a7a69fd32232fb2453ac3325

Download Submit
C:\Windows\System\wPdATDH.exe

Filesize
1.7MB

MD5
cee2bbd5520b6e27213a66feb9946af7

SHA1
18b668b0fcc272003db2412f7000b3bdee1ba4e5

SHA256
691dca460663efee46b811186971b3918a2e6ae91aca275b313657db4315529a

SHA512
575777d28f6fe13b5b8a9e8ae8a99c2d25ae2d156c39021d1127138e36d3f5bcab2f7ce48ea1050bc2d58f41293f109fa3433a524f5fb4c4c0b20045c9ca581e

Download Submit
C:\Windows\System\xXGCIUX.exe

Filesize
1.7MB

MD5
91ec2294823a6ca4a7ae625752c5afdf

SHA1
a01cd71b2b9dffe19f1f4dac7ae4d924e07b9543

SHA256
ad66dc54de8cdf5fd406e75d53caace9772368898da1bd7139354da5068e4c3d

SHA512
c749c7856408a6336cdcbeab188bb12e128933598ae0b5e6fa7d75f8e1375a837cb1f259a1693be75890771e3a99b65aa9db0adb7488ea56bdd343fb055fc640

Download Submit
C:\Windows\System\xslgApj.exe

Filesize
1.7MB

MD5
7081c0d32b24496103148322dec3e946

SHA1
cb591d299b8ab81cddd673894ddee0d6f051e2c9

SHA256
85064dff2f39ea7040a217e264779f8c66bab3be0497eb41788ad3cb2e6e4089

SHA512
a45e891febb86aebdaf445bd1ab99d4e666456796c0f20fa17707e336b7518ea18ae9816cdb5ae9fa524925e84e8027d190439ae993a9b88e4289347f6c67174

Download Submit
C:\Windows\System\yiPkosq.exe

Filesize
1.7MB

MD5
3c6ed169a7d73197d2db4c36e06cde4e

SHA1
055a6c7eef9173d3f8514dc9062394b05a3cf629

SHA256
ac8500c32cd0e1ea492e6c0eae7197ddb3901efc127e735d97d8aa08392d76ef

SHA512
baa01bfd201e62c19ddf680e56873c36e32cadca1c990cd1837a3d7a0b9e324e056a6050b93713e00cecd04a17336b3342dcff0ba5d89448220909b0cd97d510

Download Submit
memory/512-203-0x00007FF6D5460000-0x00007FF6D5852000-memory.dmp

Filesize
3.9MB

Download
memory/512-5124-0x00007FF6D5460000-0x00007FF6D5852000-memory.dmp

Filesize
3.9MB

Download
memory/700-0-0x00007FF7BA2C0000-0x00007FF7BA6B2000-memory.dmp

Filesize
3.9MB

Download
memory/700-1-0x0000013FBE0E0000-0x0000013FBE0F0000-memory.dmp

Filesize
64KB

Download
memory/852-4997-0x00007FF777400000-0x00007FF7777F2000-memory.dmp

Filesize
3.9MB

Download
memory/852-215-0x00007FF777400000-0x00007FF7777F2000-memory.dmp

Filesize
3.9MB

Download
memory/876-4931-0x00007FF7C25E0000-0x00007FF7C29D2000-memory.dmp

Filesize
3.9MB

Download
memory/876-87-0x00007FF7C25E0000-0x00007FF7C29D2000-memory.dmp

Filesize
3.9MB

Download
memory/956-177-0x00007FF681BE0000-0x00007FF681FD2000-memory.dmp

Filesize
3.9MB

Download
memory/956-4957-0x00007FF681BE0000-0x00007FF681FD2000-memory.dmp

Filesize
3.9MB

Download
memory/1072-58-0x00007FF6E9EB0000-0x00007FF6EA2A2000-memory.dmp

Filesize
3.9MB

Download
memory/1072-4951-0x00007FF6E9EB0000-0x00007FF6EA2A2000-memory.dmp

Filesize
3.9MB

Download
memory/1208-62-0x00007FF6B6500000-0x00007FF6B68F2000-memory.dmp

Filesize
3.9MB

Download
memory/1208-4934-0x00007FF6B6500000-0x00007FF6B68F2000-memory.dmp

Filesize
3.9MB

Download
memory/1560-216-0x00007FF7B6580000-0x00007FF7B6972000-memory.dmp

Filesize
3.9MB

Download
memory/1560-5128-0x00007FF7B6580000-0x00007FF7B6972000-memory.dmp

Filesize
3.9MB

Download
memory/1564-214-0x00007FF7E1250000-0x00007FF7E1642000-memory.dmp

Filesize
3.9MB

Download
memory/1812-51-0x00007FF7628F0000-0x00007FF762CE2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-209-0x00007FF664CD0000-0x00007FF6650C2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-5133-0x00007FF664CD0000-0x00007FF6650C2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-32-0x00007FF7CFE80000-0x00007FF7D0272000-memory.dmp

Filesize
3.9MB

Download
memory/2888-194-0x00007FF790B20000-0x00007FF790F12000-memory.dmp

Filesize
3.9MB

Download
memory/2888-4960-0x00007FF790B20000-0x00007FF790F12000-memory.dmp

Filesize
3.9MB

Download
memory/3208-208-0x00007FF6A9BB0000-0x00007FF6A9FA2000-memory.dmp

Filesize
3.9MB

Download
memory/3208-5217-0x00007FF6A9BB0000-0x00007FF6A9FA2000-memory.dmp

Filesize
3.9MB

Download
memory/3216-5132-0x00007FF74B4F0000-0x00007FF74B8E2000-memory.dmp

Filesize
3.9MB

Download
memory/3216-211-0x00007FF74B4F0000-0x00007FF74B8E2000-memory.dmp

Filesize
3.9MB

Download
memory/3336-212-0x00007FF65C430000-0x00007FF65C822000-memory.dmp

Filesize
3.9MB

Download
memory/3336-4945-0x00007FF65C430000-0x00007FF65C822000-memory.dmp

Filesize
3.9MB

Download
memory/3344-116-0x00007FF702D90000-0x00007FF703182000-memory.dmp

Filesize
3.9MB

Download
memory/3344-4941-0x00007FF702D90000-0x00007FF703182000-memory.dmp

Filesize
3.9MB

Download
memory/3432-24-0x00007FF6F71E0000-0x00007FF6F75D2000-memory.dmp

Filesize
3.9MB

Download
memory/3504-4964-0x00007FF666460000-0x00007FF666852000-memory.dmp

Filesize
3.9MB

Download
memory/3504-134-0x00007FF666460000-0x00007FF666852000-memory.dmp

Filesize
3.9MB

Download
memory/3792-210-0x00007FF61C830000-0x00007FF61CC22000-memory.dmp

Filesize
3.9MB

Download
memory/3792-5087-0x00007FF61C830000-0x00007FF61CC22000-memory.dmp

Filesize
3.9MB

Download
memory/3892-226-0x000001DA6FBC0000-0x000001DA6FBE2000-memory.dmp

Filesize
136KB

Download
memory/3892-252-0x000001DA707A0000-0x000001DA70F46000-memory.dmp

Filesize
7.6MB

Download
memory/4016-197-0x00007FF78D710000-0x00007FF78DB02000-memory.dmp

Filesize
3.9MB

Download
memory/4016-5140-0x00007FF78D710000-0x00007FF78DB02000-memory.dmp

Filesize
3.9MB

Download
memory/4244-5108-0x00007FF63F330000-0x00007FF63F722000-memory.dmp

Filesize
3.9MB

Download
memory/4244-176-0x00007FF63F330000-0x00007FF63F722000-memory.dmp

Filesize
3.9MB

Download
memory/4556-202-0x00007FF76C1B0000-0x00007FF76C5A2000-memory.dmp

Filesize
3.9MB

Download
memory/4556-5136-0x00007FF76C1B0000-0x00007FF76C5A2000-memory.dmp

Filesize
3.9MB

Download
memory/4672-4954-0x00007FF6AF120000-0x00007FF6AF512000-memory.dmp

Filesize
3.9MB

Download
memory/4672-148-0x00007FF6AF120000-0x00007FF6AF512000-memory.dmp

Filesize
3.9MB

Download
memory/5044-4947-0x00007FF7340D0000-0x00007FF7344C2000-memory.dmp

Filesize
3.9MB

Download
memory/5044-213-0x00007FF7340D0000-0x00007FF7344C2000-memory.dmp

Filesize
3.9MB

Download