xmrig | c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
Size

2.1MB
MD5

3ac08783858f08c66c668810446ed358
SHA1

20dc9c56d0999802224db1f5c594961a20374627
SHA256

c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93
SHA512

3d607044f9800954fe9655f80a8209d6cacb2ae58a6d2b2c06dbfc0cd895df53adccaa2936388972aad670aa0876c7cd5c59d522eb13c0b6fae9149599277dd9
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTt6:NABe

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/348-39-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2816-57-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/1712-91-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2640-83-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2704-56-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2876-53-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/1284-46-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/608-41-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2396-26-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/608-4353-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2876-4357-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/1284-4355-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2704-4360-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/348-4358-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2816-4366-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2640-4383-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2748-4406-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/1712-4402-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2636-4362-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2024	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2396	QWpaeLR.exe
1284	JSmpugA.exe
348	tjYyTWH.exe
608	ZFYuWtQ.exe
2876	TaCygZi.exe
2704	seFsxBi.exe
2816	STIEMKC.exe
2636	sZLbQSF.exe
2748	jadrULX.exe
2640	ABcZoZg.exe
1712	PSZPKfR.exe
496	FxZLRWj.exe
856	SGSCkuZ.exe
2968	uzHXufr.exe
1624	qqfAUwH.exe
3016	aHXeUGZ.exe
1656	stItWIE.exe
3040	HhFnaxD.exe
3048	qSCVeOr.exe
828	phPkwio.exe
2128	nwhkUSJ.exe
2124	VkGVNrf.exe
2424	fnhvJBt.exe
2212	vXmJbLH.exe
448	LgSHtmL.exe
2148	fdevBKB.exe
892	FGNbDff.exe
1392	kRqrnJb.exe
628	CVUvgZE.exe
1968	RisRnUl.exe
1516	jvZPyUO.exe
1320	NyKSPge.exe
2208	iYxSMeY.exe
1160	CInJbKL.exe
2312	vjpsMqY.exe
2240	gVhlTNW.exe
2532	uYKyWzd.exe
2112	xiwpVpb.exe
2276	ZHGRedD.exe
1600	MKegeiC.exe
324	ndKlOVF.exe
2200	LhEnOSS.exe
1748	YTKqNNE.exe
1536	DnOaUSm.exe
1744	pxmcKXz.exe
1728	NZuzSrd.exe
1048	mPgGiGQ.exe
1580	NirqmTq.exe
288	HRtpgwi.exe
1572	UmZxyBl.exe
1736	xBisIGA.exe
556	mSNtXEy.exe
2720	CziXIHu.exe
2820	TogjWHx.exe
2732	mNWorxt.exe
1244	DTNvjnu.exe
296	LYFceEQ.exe
2008	kteFvrw.exe
2096	mOQfKQM.exe
1300	IEaltzx.exe
752	xaOCLKG.exe
1940	gJRErhF.exe
3056	zGPgfmb.exe
2492	UyIjQVV.exe

Loads dropped DLL 64 IoCs

pid	Process
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1288-0-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/files/0x00080000000120f4-5.dat	upx
behavioral1/memory/348-39-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/files/0x0008000000016d6f-38.dat	upx
behavioral1/files/0x00090000000173b8-47.dat	upx
behavioral1/files/0x0008000000016d9f-28.dat	upx
behavioral1/memory/2816-57-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/files/0x00080000000173eb-65.dat	upx
behavioral1/memory/1712-91-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/files/0x0005000000019412-107.dat	upx
behavioral1/files/0x000500000001941e-110.dat	upx
behavioral1/files/0x000500000001944b-122.dat	upx
behavioral1/files/0x000500000001948a-132.dat	upx
behavioral1/files/0x000500000001960b-162.dat	upx
behavioral1/files/0x0005000000019617-190.dat	upx
behavioral1/files/0x0005000000019613-182.dat	upx
behavioral1/files/0x0005000000019615-188.dat	upx
behavioral1/files/0x000500000001960f-173.dat	upx
behavioral1/files/0x0005000000019611-180.dat	upx
behavioral1/files/0x000500000001960d-168.dat	upx
behavioral1/files/0x00050000000195c7-157.dat	upx
behavioral1/files/0x0005000000019568-152.dat	upx
behavioral1/files/0x00050000000194b9-140.dat	upx
behavioral1/files/0x00050000000194e7-145.dat	upx
behavioral1/files/0x00050000000194ab-136.dat	upx
behavioral1/files/0x0005000000019456-127.dat	upx
behavioral1/files/0x0005000000019431-117.dat	upx
behavioral1/files/0x000500000001938f-102.dat	upx
behavioral1/files/0x0008000000016d43-93.dat	upx
behavioral1/files/0x0005000000019372-88.dat	upx
behavioral1/files/0x000f0000000054a8-84.dat	upx
behavioral1/memory/2640-83-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x0006000000019354-97.dat	upx
behavioral1/memory/1288-81-0x0000000003380000-0x0000000003772000-memory.dmp	upx
behavioral1/memory/2636-63-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/memory/2704-56-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2876-53-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/1284-46-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2748-76-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/files/0x000500000001927c-68.dat	upx
behavioral1/files/0x0007000000017093-43.dat	upx
behavioral1/memory/608-41-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2396-26-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/files/0x00070000000171b9-35.dat	upx
behavioral1/files/0x0008000000016d67-23.dat	upx
behavioral1/files/0x0008000000016d6b-14.dat	upx
behavioral1/memory/608-4353-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2876-4357-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/1284-4355-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2704-4360-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/348-4358-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2816-4366-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/2640-4383-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2748-4406-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/1712-4402-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2636-4362-0x000000013F220000-0x000000013F612000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TaCygZi.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\KVBXfeO.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\JVRillb.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\kbHAZwa.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\vqRmsfo.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\LmPSwHk.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\iDIuxRE.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\kgXjLsl.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\ncTQgiZ.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\bYTqFmj.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\bLyOmXQ.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\bhdpNdX.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\EIDzDHY.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\rwmTIpm.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\BlAGSxp.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\ukQdFtu.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\cWPJEZp.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\QWhrfZc.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\WlLqDVJ.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\WVBaVph.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\mtBLcMH.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\KECGWxh.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\LsqMzRU.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\mNWorxt.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\kSIxXPV.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\BzrCuSA.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\AmFYaMW.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\TOqrjCO.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\EMoXotp.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\uoaVIGe.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\foFCEpI.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\PKHRbUo.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\ABzwOnO.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\JdRKlEy.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\FOlLwmb.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\UVHjOHU.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\jTujYSN.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\bLUnbUr.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\fjHVAbU.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\MEcjwiE.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\utgXPpC.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\NaAsfNa.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\GdJKjKU.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\KqCvYVi.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\VHyLqEH.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\lZSKImx.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\bkMmiIt.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\PvKCreH.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\ULnvxAp.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\VLwRbaY.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\zSUXyhr.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\sjFfOyr.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\UPePPyw.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\cRMbweU.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\buxjkwM.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\hEKuTah.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\MftcoEF.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\cRXEnla.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\LdtooxZ.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\ylmDNon.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\eBtJKdT.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\msbQUZz.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\pmJpFtL.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
File created	C:\Windows\System\pUVcEDG.exe	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2024	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
Token: SeLockMemoryPrivilege	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
Token: SeDebugPrivilege	2024	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2024	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	31
PID 1288 wrote to memory of 2024	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	31
PID 1288 wrote to memory of 2024	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	31
PID 1288 wrote to memory of 2396	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	32
PID 1288 wrote to memory of 2396	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	32
PID 1288 wrote to memory of 2396	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	32
PID 1288 wrote to memory of 348	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	33
PID 1288 wrote to memory of 348	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	33
PID 1288 wrote to memory of 348	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	33
PID 1288 wrote to memory of 1284	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	34
PID 1288 wrote to memory of 1284	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	34
PID 1288 wrote to memory of 1284	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	34
PID 1288 wrote to memory of 2704	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	35
PID 1288 wrote to memory of 2704	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	35
PID 1288 wrote to memory of 2704	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	35
PID 1288 wrote to memory of 608	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	36
PID 1288 wrote to memory of 608	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	36
PID 1288 wrote to memory of 608	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	36
PID 1288 wrote to memory of 2816	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	37
PID 1288 wrote to memory of 2816	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	37
PID 1288 wrote to memory of 2816	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	37
PID 1288 wrote to memory of 2876	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	38
PID 1288 wrote to memory of 2876	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	38
PID 1288 wrote to memory of 2876	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	38
PID 1288 wrote to memory of 2636	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	40
PID 1288 wrote to memory of 2636	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	40
PID 1288 wrote to memory of 2636	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	40
PID 1288 wrote to memory of 2748	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	41
PID 1288 wrote to memory of 2748	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	41
PID 1288 wrote to memory of 2748	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	41
PID 1288 wrote to memory of 2640	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	42
PID 1288 wrote to memory of 2640	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	42
PID 1288 wrote to memory of 2640	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	42
PID 1288 wrote to memory of 496	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	43
PID 1288 wrote to memory of 496	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	43
PID 1288 wrote to memory of 496	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	43
PID 1288 wrote to memory of 1712	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	44
PID 1288 wrote to memory of 1712	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	44
PID 1288 wrote to memory of 1712	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	44
PID 1288 wrote to memory of 856	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	45
PID 1288 wrote to memory of 856	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	45
PID 1288 wrote to memory of 856	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	45
PID 1288 wrote to memory of 2968	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	46
PID 1288 wrote to memory of 2968	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	46
PID 1288 wrote to memory of 2968	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	46
PID 1288 wrote to memory of 1624	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	47
PID 1288 wrote to memory of 1624	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	47
PID 1288 wrote to memory of 1624	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	47
PID 1288 wrote to memory of 3016	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	48
PID 1288 wrote to memory of 3016	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	48
PID 1288 wrote to memory of 3016	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	48
PID 1288 wrote to memory of 1656	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	49
PID 1288 wrote to memory of 1656	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	49
PID 1288 wrote to memory of 1656	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	49
PID 1288 wrote to memory of 3040	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	50
PID 1288 wrote to memory of 3040	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	50
PID 1288 wrote to memory of 3040	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	50
PID 1288 wrote to memory of 3048	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	51
PID 1288 wrote to memory of 3048	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	51
PID 1288 wrote to memory of 3048	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	51
PID 1288 wrote to memory of 828	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	52
PID 1288 wrote to memory of 828	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	52
PID 1288 wrote to memory of 828	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	52
PID 1288 wrote to memory of 2128	1288	c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe	53

C:\Users\Admin\AppData\Local\Temp\c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe
"C:\Users\Admin\AppData\Local\Temp\c87201e94dfe30fc7bda964f8a19a7bc9233126211164ab6a052692608802e93.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Windows\System\QWpaeLR.exe
  C:\Windows\System\QWpaeLR.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\tjYyTWH.exe
  C:\Windows\System\tjYyTWH.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\JSmpugA.exe
  C:\Windows\System\JSmpugA.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\seFsxBi.exe
  C:\Windows\System\seFsxBi.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\ZFYuWtQ.exe
  C:\Windows\System\ZFYuWtQ.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\STIEMKC.exe
  C:\Windows\System\STIEMKC.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\TaCygZi.exe
  C:\Windows\System\TaCygZi.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\sZLbQSF.exe
  C:\Windows\System\sZLbQSF.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\jadrULX.exe
  C:\Windows\System\jadrULX.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\ABcZoZg.exe
  C:\Windows\System\ABcZoZg.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\FxZLRWj.exe
  C:\Windows\System\FxZLRWj.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\PSZPKfR.exe
  C:\Windows\System\PSZPKfR.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\SGSCkuZ.exe
  C:\Windows\System\SGSCkuZ.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\uzHXufr.exe
  C:\Windows\System\uzHXufr.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\qqfAUwH.exe
  C:\Windows\System\qqfAUwH.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\aHXeUGZ.exe
  C:\Windows\System\aHXeUGZ.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\stItWIE.exe
  C:\Windows\System\stItWIE.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\HhFnaxD.exe
  C:\Windows\System\HhFnaxD.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\qSCVeOr.exe
  C:\Windows\System\qSCVeOr.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\phPkwio.exe
  C:\Windows\System\phPkwio.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\nwhkUSJ.exe
  C:\Windows\System\nwhkUSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\VkGVNrf.exe
  C:\Windows\System\VkGVNrf.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\vXmJbLH.exe
  C:\Windows\System\vXmJbLH.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\fnhvJBt.exe
  C:\Windows\System\fnhvJBt.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\LgSHtmL.exe
  C:\Windows\System\LgSHtmL.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\fdevBKB.exe
  C:\Windows\System\fdevBKB.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\FGNbDff.exe
  C:\Windows\System\FGNbDff.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\kRqrnJb.exe
  C:\Windows\System\kRqrnJb.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\CVUvgZE.exe
  C:\Windows\System\CVUvgZE.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\RisRnUl.exe
  C:\Windows\System\RisRnUl.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\NyKSPge.exe
  C:\Windows\System\NyKSPge.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\jvZPyUO.exe
  C:\Windows\System\jvZPyUO.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\CInJbKL.exe
  C:\Windows\System\CInJbKL.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\iYxSMeY.exe
  C:\Windows\System\iYxSMeY.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\gVhlTNW.exe
  C:\Windows\System\gVhlTNW.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\vjpsMqY.exe
  C:\Windows\System\vjpsMqY.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\ZHGRedD.exe
  C:\Windows\System\ZHGRedD.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\uYKyWzd.exe
  C:\Windows\System\uYKyWzd.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\YTKqNNE.exe
  C:\Windows\System\YTKqNNE.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\xiwpVpb.exe
  C:\Windows\System\xiwpVpb.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\DnOaUSm.exe
  C:\Windows\System\DnOaUSm.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\MKegeiC.exe
  C:\Windows\System\MKegeiC.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\pxmcKXz.exe
  C:\Windows\System\pxmcKXz.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\ndKlOVF.exe
  C:\Windows\System\ndKlOVF.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\NZuzSrd.exe
  C:\Windows\System\NZuzSrd.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\LhEnOSS.exe
  C:\Windows\System\LhEnOSS.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\mPgGiGQ.exe
  C:\Windows\System\mPgGiGQ.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\NirqmTq.exe
  C:\Windows\System\NirqmTq.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\UmZxyBl.exe
  C:\Windows\System\UmZxyBl.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\HRtpgwi.exe
  C:\Windows\System\HRtpgwi.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\xBisIGA.exe
  C:\Windows\System\xBisIGA.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\mSNtXEy.exe
  C:\Windows\System\mSNtXEy.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\CziXIHu.exe
  C:\Windows\System\CziXIHu.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\TogjWHx.exe
  C:\Windows\System\TogjWHx.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\mNWorxt.exe
  C:\Windows\System\mNWorxt.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\DTNvjnu.exe
  C:\Windows\System\DTNvjnu.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\LYFceEQ.exe
  C:\Windows\System\LYFceEQ.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\kteFvrw.exe
  C:\Windows\System\kteFvrw.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\mOQfKQM.exe
  C:\Windows\System\mOQfKQM.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\IEaltzx.exe
  C:\Windows\System\IEaltzx.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\xaOCLKG.exe
  C:\Windows\System\xaOCLKG.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\gJRErhF.exe
  C:\Windows\System\gJRErhF.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\zGPgfmb.exe
  C:\Windows\System\zGPgfmb.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\UyIjQVV.exe
  C:\Windows\System\UyIjQVV.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\tVtKkXE.exe
  C:\Windows\System\tVtKkXE.exe
  2⤵
  PID:408
- C:\Windows\System\DnibXWr.exe
  C:\Windows\System\DnibXWr.exe
  2⤵
  PID:1496
- C:\Windows\System\hkcLRsd.exe
  C:\Windows\System\hkcLRsd.exe
  2⤵
  PID:2588
- C:\Windows\System\DDihuLC.exe
  C:\Windows\System\DDihuLC.exe
  2⤵
  PID:1816
- C:\Windows\System\bznSDgH.exe
  C:\Windows\System\bznSDgH.exe
  2⤵
  PID:2344
- C:\Windows\System\CMZlULI.exe
  C:\Windows\System\CMZlULI.exe
  2⤵
  PID:1528
- C:\Windows\System\EVFWIHw.exe
  C:\Windows\System\EVFWIHw.exe
  2⤵
  PID:1648
- C:\Windows\System\PEiaGGt.exe
  C:\Windows\System\PEiaGGt.exe
  2⤵
  PID:2788
- C:\Windows\System\wPtxbJm.exe
  C:\Windows\System\wPtxbJm.exe
  2⤵
  PID:2796
- C:\Windows\System\IntzzgL.exe
  C:\Windows\System\IntzzgL.exe
  2⤵
  PID:2484
- C:\Windows\System\PvKCreH.exe
  C:\Windows\System\PvKCreH.exe
  2⤵
  PID:2772
- C:\Windows\System\mKuwUBk.exe
  C:\Windows\System\mKuwUBk.exe
  2⤵
  PID:2676
- C:\Windows\System\MzIuzoG.exe
  C:\Windows\System\MzIuzoG.exe
  2⤵
  PID:2068
- C:\Windows\System\iyuRXJD.exe
  C:\Windows\System\iyuRXJD.exe
  2⤵
  PID:316
- C:\Windows\System\tuTooSj.exe
  C:\Windows\System\tuTooSj.exe
  2⤵
  PID:1448
- C:\Windows\System\HksZaIG.exe
  C:\Windows\System\HksZaIG.exe
  2⤵
  PID:2244
- C:\Windows\System\SrBwPXs.exe
  C:\Windows\System\SrBwPXs.exe
  2⤵
  PID:1340
- C:\Windows\System\pFffKBN.exe
  C:\Windows\System\pFffKBN.exe
  2⤵
  PID:1916
- C:\Windows\System\VuqfiEp.exe
  C:\Windows\System\VuqfiEp.exe
  2⤵
  PID:2700
- C:\Windows\System\XHhOvCW.exe
  C:\Windows\System\XHhOvCW.exe
  2⤵
  PID:860
- C:\Windows\System\INAyTYa.exe
  C:\Windows\System\INAyTYa.exe
  2⤵
  PID:1688
- C:\Windows\System\TYsdVoA.exe
  C:\Windows\System\TYsdVoA.exe
  2⤵
  PID:1716
- C:\Windows\System\HjnpQCj.exe
  C:\Windows\System\HjnpQCj.exe
  2⤵
  PID:876
- C:\Windows\System\iyRlups.exe
  C:\Windows\System\iyRlups.exe
  2⤵
  PID:2336
- C:\Windows\System\vmxRRBQ.exe
  C:\Windows\System\vmxRRBQ.exe
  2⤵
  PID:2740
- C:\Windows\System\cUwwJus.exe
  C:\Windows\System\cUwwJus.exe
  2⤵
  PID:1312
- C:\Windows\System\jCLnAdb.exe
  C:\Windows\System\jCLnAdb.exe
  2⤵
  PID:1564
- C:\Windows\System\dCjfGtj.exe
  C:\Windows\System\dCjfGtj.exe
  2⤵
  PID:1936
- C:\Windows\System\QNKKxkw.exe
  C:\Windows\System\QNKKxkw.exe
  2⤵
  PID:2764
- C:\Windows\System\rNGTlQP.exe
  C:\Windows\System\rNGTlQP.exe
  2⤵
  PID:1004
- C:\Windows\System\edEZXnb.exe
  C:\Windows\System\edEZXnb.exe
  2⤵
  PID:2620
- C:\Windows\System\PrRcCNd.exe
  C:\Windows\System\PrRcCNd.exe
  2⤵
  PID:264
- C:\Windows\System\UoQRLGE.exe
  C:\Windows\System\UoQRLGE.exe
  2⤵
  PID:2376
- C:\Windows\System\CBNPcxT.exe
  C:\Windows\System\CBNPcxT.exe
  2⤵
  PID:3064
- C:\Windows\System\yZVraXW.exe
  C:\Windows\System\yZVraXW.exe
  2⤵
  PID:2444
- C:\Windows\System\HFEEXDf.exe
  C:\Windows\System\HFEEXDf.exe
  2⤵
  PID:1420
- C:\Windows\System\XFGXZVs.exe
  C:\Windows\System\XFGXZVs.exe
  2⤵
  PID:2272
- C:\Windows\System\bygStmt.exe
  C:\Windows\System\bygStmt.exe
  2⤵
  PID:1524
- C:\Windows\System\UNrvtLL.exe
  C:\Windows\System\UNrvtLL.exe
  2⤵
  PID:1804
- C:\Windows\System\tWOwGED.exe
  C:\Windows\System\tWOwGED.exe
  2⤵
  PID:2616
- C:\Windows\System\nPOujLO.exe
  C:\Windows\System\nPOujLO.exe
  2⤵
  PID:864
- C:\Windows\System\gvEcTCP.exe
  C:\Windows\System\gvEcTCP.exe
  2⤵
  PID:1304
- C:\Windows\System\qjjaBQM.exe
  C:\Windows\System\qjjaBQM.exe
  2⤵
  PID:2368
- C:\Windows\System\VhnnYIV.exe
  C:\Windows\System\VhnnYIV.exe
  2⤵
  PID:2116
- C:\Windows\System\ZfCwsZi.exe
  C:\Windows\System\ZfCwsZi.exe
  2⤵
  PID:2836
- C:\Windows\System\qinavwz.exe
  C:\Windows\System\qinavwz.exe
  2⤵
  PID:2372
- C:\Windows\System\XgWCwjb.exe
  C:\Windows\System\XgWCwjb.exe
  2⤵
  PID:684
- C:\Windows\System\iHBnVaV.exe
  C:\Windows\System\iHBnVaV.exe
  2⤵
  PID:2088
- C:\Windows\System\YNULyCX.exe
  C:\Windows\System\YNULyCX.exe
  2⤵
  PID:2576
- C:\Windows\System\LeihaAY.exe
  C:\Windows\System\LeihaAY.exe
  2⤵
  PID:2448
- C:\Windows\System\RbUjPjB.exe
  C:\Windows\System\RbUjPjB.exe
  2⤵
  PID:2656
- C:\Windows\System\uZMqsSf.exe
  C:\Windows\System\uZMqsSf.exe
  2⤵
  PID:1192
- C:\Windows\System\izOLIWV.exe
  C:\Windows\System\izOLIWV.exe
  2⤵
  PID:2328
- C:\Windows\System\RhPKxNZ.exe
  C:\Windows\System\RhPKxNZ.exe
  2⤵
  PID:1360
- C:\Windows\System\VMyVVsl.exe
  C:\Windows\System\VMyVVsl.exe
  2⤵
  PID:1144
- C:\Windows\System\fEXiimh.exe
  C:\Windows\System\fEXiimh.exe
  2⤵
  PID:2872
- C:\Windows\System\KNAKyDB.exe
  C:\Windows\System\KNAKyDB.exe
  2⤵
  PID:1740
- C:\Windows\System\xEZJvIw.exe
  C:\Windows\System\xEZJvIw.exe
  2⤵
  PID:3080
- C:\Windows\System\MZLNtKJ.exe
  C:\Windows\System\MZLNtKJ.exe
  2⤵
  PID:3096
- C:\Windows\System\ggGPUHG.exe
  C:\Windows\System\ggGPUHG.exe
  2⤵
  PID:3112
- C:\Windows\System\tdzHLLq.exe
  C:\Windows\System\tdzHLLq.exe
  2⤵
  PID:3128
- C:\Windows\System\FOvjNUf.exe
  C:\Windows\System\FOvjNUf.exe
  2⤵
  PID:3144
- C:\Windows\System\xeTmJae.exe
  C:\Windows\System\xeTmJae.exe
  2⤵
  PID:3160
- C:\Windows\System\FKtmRcm.exe
  C:\Windows\System\FKtmRcm.exe
  2⤵
  PID:3176
- C:\Windows\System\EyHhNBA.exe
  C:\Windows\System\EyHhNBA.exe
  2⤵
  PID:3192
- C:\Windows\System\JGopmTq.exe
  C:\Windows\System\JGopmTq.exe
  2⤵
  PID:3208
- C:\Windows\System\OuuhvmN.exe
  C:\Windows\System\OuuhvmN.exe
  2⤵
  PID:3224
- C:\Windows\System\sZvNLtj.exe
  C:\Windows\System\sZvNLtj.exe
  2⤵
  PID:3240
- C:\Windows\System\losSnUG.exe
  C:\Windows\System\losSnUG.exe
  2⤵
  PID:3256
- C:\Windows\System\UnAJAry.exe
  C:\Windows\System\UnAJAry.exe
  2⤵
  PID:3272
- C:\Windows\System\PqahUwo.exe
  C:\Windows\System\PqahUwo.exe
  2⤵
  PID:3288
- C:\Windows\System\VOryCHF.exe
  C:\Windows\System\VOryCHF.exe
  2⤵
  PID:3304
- C:\Windows\System\YyghCOy.exe
  C:\Windows\System\YyghCOy.exe
  2⤵
  PID:3320
- C:\Windows\System\kMHthMB.exe
  C:\Windows\System\kMHthMB.exe
  2⤵
  PID:3336
- C:\Windows\System\YZoWkcy.exe
  C:\Windows\System\YZoWkcy.exe
  2⤵
  PID:3352
- C:\Windows\System\nRHvekN.exe
  C:\Windows\System\nRHvekN.exe
  2⤵
  PID:3368
- C:\Windows\System\ODjnrwv.exe
  C:\Windows\System\ODjnrwv.exe
  2⤵
  PID:3384
- C:\Windows\System\vGpecPQ.exe
  C:\Windows\System\vGpecPQ.exe
  2⤵
  PID:3400
- C:\Windows\System\DjzjQRx.exe
  C:\Windows\System\DjzjQRx.exe
  2⤵
  PID:3416
- C:\Windows\System\BpaMLYK.exe
  C:\Windows\System\BpaMLYK.exe
  2⤵
  PID:3432
- C:\Windows\System\HjWpNqM.exe
  C:\Windows\System\HjWpNqM.exe
  2⤵
  PID:3448
- C:\Windows\System\LEewHnH.exe
  C:\Windows\System\LEewHnH.exe
  2⤵
  PID:3464
- C:\Windows\System\bmXvoMK.exe
  C:\Windows\System\bmXvoMK.exe
  2⤵
  PID:3480
- C:\Windows\System\EDFCuOp.exe
  C:\Windows\System\EDFCuOp.exe
  2⤵
  PID:3496
- C:\Windows\System\hpMAgIv.exe
  C:\Windows\System\hpMAgIv.exe
  2⤵
  PID:3512
- C:\Windows\System\vrVvdED.exe
  C:\Windows\System\vrVvdED.exe
  2⤵
  PID:3528
- C:\Windows\System\AsTXptE.exe
  C:\Windows\System\AsTXptE.exe
  2⤵
  PID:3544
- C:\Windows\System\cEtAQuj.exe
  C:\Windows\System\cEtAQuj.exe
  2⤵
  PID:3560
- C:\Windows\System\thvdZbZ.exe
  C:\Windows\System\thvdZbZ.exe
  2⤵
  PID:3576
- C:\Windows\System\xOIGOsK.exe
  C:\Windows\System\xOIGOsK.exe
  2⤵
  PID:3592
- C:\Windows\System\JVyTMkW.exe
  C:\Windows\System\JVyTMkW.exe
  2⤵
  PID:3608
- C:\Windows\System\BJuNSct.exe
  C:\Windows\System\BJuNSct.exe
  2⤵
  PID:3624
- C:\Windows\System\ueODcEn.exe
  C:\Windows\System\ueODcEn.exe
  2⤵
  PID:3640
- C:\Windows\System\nRInvLh.exe
  C:\Windows\System\nRInvLh.exe
  2⤵
  PID:3656
- C:\Windows\System\JiuGnlk.exe
  C:\Windows\System\JiuGnlk.exe
  2⤵
  PID:3672
- C:\Windows\System\UnSugVb.exe
  C:\Windows\System\UnSugVb.exe
  2⤵
  PID:3688
- C:\Windows\System\ZhMaSTX.exe
  C:\Windows\System\ZhMaSTX.exe
  2⤵
  PID:3704
- C:\Windows\System\HmnJOpW.exe
  C:\Windows\System\HmnJOpW.exe
  2⤵
  PID:3720
- C:\Windows\System\kdDimPi.exe
  C:\Windows\System\kdDimPi.exe
  2⤵
  PID:3736
- C:\Windows\System\RwyrSTu.exe
  C:\Windows\System\RwyrSTu.exe
  2⤵
  PID:3752
- C:\Windows\System\NiEKpGF.exe
  C:\Windows\System\NiEKpGF.exe
  2⤵
  PID:3768
- C:\Windows\System\qSphnMm.exe
  C:\Windows\System\qSphnMm.exe
  2⤵
  PID:3784
- C:\Windows\System\yNcvNUH.exe
  C:\Windows\System\yNcvNUH.exe
  2⤵
  PID:3800
- C:\Windows\System\WqVkKYf.exe
  C:\Windows\System\WqVkKYf.exe
  2⤵
  PID:3816
- C:\Windows\System\mBIPqpv.exe
  C:\Windows\System\mBIPqpv.exe
  2⤵
  PID:3832
- C:\Windows\System\ABzwOnO.exe
  C:\Windows\System\ABzwOnO.exe
  2⤵
  PID:3848
- C:\Windows\System\QVygynx.exe
  C:\Windows\System\QVygynx.exe
  2⤵
  PID:3864
- C:\Windows\System\JyLTSqG.exe
  C:\Windows\System\JyLTSqG.exe
  2⤵
  PID:3880
- C:\Windows\System\xigBQgG.exe
  C:\Windows\System\xigBQgG.exe
  2⤵
  PID:3896
- C:\Windows\System\fxOoNqt.exe
  C:\Windows\System\fxOoNqt.exe
  2⤵
  PID:3912
- C:\Windows\System\tTLkuTD.exe
  C:\Windows\System\tTLkuTD.exe
  2⤵
  PID:3928
- C:\Windows\System\YLfFHWK.exe
  C:\Windows\System\YLfFHWK.exe
  2⤵
  PID:3944
- C:\Windows\System\VWOLZzC.exe
  C:\Windows\System\VWOLZzC.exe
  2⤵
  PID:3960
- C:\Windows\System\MWbvjES.exe
  C:\Windows\System\MWbvjES.exe
  2⤵
  PID:3976
- C:\Windows\System\ltQfBWO.exe
  C:\Windows\System\ltQfBWO.exe
  2⤵
  PID:3992
- C:\Windows\System\YVOZpMh.exe
  C:\Windows\System\YVOZpMh.exe
  2⤵
  PID:4008
- C:\Windows\System\LnOYePf.exe
  C:\Windows\System\LnOYePf.exe
  2⤵
  PID:4024
- C:\Windows\System\eMOgzne.exe
  C:\Windows\System\eMOgzne.exe
  2⤵
  PID:4040
- C:\Windows\System\qAOBayq.exe
  C:\Windows\System\qAOBayq.exe
  2⤵
  PID:4056
- C:\Windows\System\sUDtAeH.exe
  C:\Windows\System\sUDtAeH.exe
  2⤵
  PID:4072
- C:\Windows\System\ELqceNP.exe
  C:\Windows\System\ELqceNP.exe
  2⤵
  PID:4088
- C:\Windows\System\eKhJtXY.exe
  C:\Windows\System\eKhJtXY.exe
  2⤵
  PID:2564
- C:\Windows\System\noHwmmZ.exe
  C:\Windows\System\noHwmmZ.exe
  2⤵
  PID:2228
- C:\Windows\System\zRlHkus.exe
  C:\Windows\System\zRlHkus.exe
  2⤵
  PID:1384
- C:\Windows\System\hnFnxLN.exe
  C:\Windows\System\hnFnxLN.exe
  2⤵
  PID:672
- C:\Windows\System\EKMBjvq.exe
  C:\Windows\System\EKMBjvq.exe
  2⤵
  PID:2832
- C:\Windows\System\JsWnrfG.exe
  C:\Windows\System\JsWnrfG.exe
  2⤵
  PID:2120
- C:\Windows\System\OZCeEIp.exe
  C:\Windows\System\OZCeEIp.exe
  2⤵
  PID:1692
- C:\Windows\System\uAVCOMO.exe
  C:\Windows\System\uAVCOMO.exe
  2⤵
  PID:3076
- C:\Windows\System\bMcLjDA.exe
  C:\Windows\System\bMcLjDA.exe
  2⤵
  PID:3108
- C:\Windows\System\iLqQvNB.exe
  C:\Windows\System\iLqQvNB.exe
  2⤵
  PID:3152
- C:\Windows\System\vhPTUfN.exe
  C:\Windows\System\vhPTUfN.exe
  2⤵
  PID:3184
- C:\Windows\System\rNObYeY.exe
  C:\Windows\System\rNObYeY.exe
  2⤵
  PID:3216
- C:\Windows\System\NjyXhjR.exe
  C:\Windows\System\NjyXhjR.exe
  2⤵
  PID:3248
- C:\Windows\System\chiPcWY.exe
  C:\Windows\System\chiPcWY.exe
  2⤵
  PID:3264
- C:\Windows\System\MEcjwiE.exe
  C:\Windows\System\MEcjwiE.exe
  2⤵
  PID:3296
- C:\Windows\System\mjXclbz.exe
  C:\Windows\System\mjXclbz.exe
  2⤵
  PID:3328
- C:\Windows\System\oqPvtaq.exe
  C:\Windows\System\oqPvtaq.exe
  2⤵
  PID:3360
- C:\Windows\System\CPLzGwg.exe
  C:\Windows\System\CPLzGwg.exe
  2⤵
  PID:2884
- C:\Windows\System\GdfhxGK.exe
  C:\Windows\System\GdfhxGK.exe
  2⤵
  PID:3412
- C:\Windows\System\kzwhiOe.exe
  C:\Windows\System\kzwhiOe.exe
  2⤵
  PID:3444
- C:\Windows\System\rkPVJpa.exe
  C:\Windows\System\rkPVJpa.exe
  2⤵
  PID:3476
- C:\Windows\System\LyesUzT.exe
  C:\Windows\System\LyesUzT.exe
  2⤵
  PID:3508
- C:\Windows\System\nlRJdFy.exe
  C:\Windows\System\nlRJdFy.exe
  2⤵
  PID:3536
- C:\Windows\System\GBFlGUa.exe
  C:\Windows\System\GBFlGUa.exe
  2⤵
  PID:3568
- C:\Windows\System\NqmhWbQ.exe
  C:\Windows\System\NqmhWbQ.exe
  2⤵
  PID:3588
- C:\Windows\System\xBBLxhG.exe
  C:\Windows\System\xBBLxhG.exe
  2⤵
  PID:3632
- C:\Windows\System\ewxEiiS.exe
  C:\Windows\System\ewxEiiS.exe
  2⤵
  PID:3652
- C:\Windows\System\KVBXfeO.exe
  C:\Windows\System\KVBXfeO.exe
  2⤵
  PID:3680
- C:\Windows\System\IeVEOki.exe
  C:\Windows\System\IeVEOki.exe
  2⤵
  PID:3712
- C:\Windows\System\sXyprXu.exe
  C:\Windows\System\sXyprXu.exe
  2⤵
  PID:3760
- C:\Windows\System\vePEteQ.exe
  C:\Windows\System\vePEteQ.exe
  2⤵
  PID:3776
- C:\Windows\System\mHUIBNA.exe
  C:\Windows\System\mHUIBNA.exe
  2⤵
  PID:3808
- C:\Windows\System\iZhJtUD.exe
  C:\Windows\System\iZhJtUD.exe
  2⤵
  PID:3856
- C:\Windows\System\cDzwKFo.exe
  C:\Windows\System\cDzwKFo.exe
  2⤵
  PID:1676
- C:\Windows\System\bhlnhvk.exe
  C:\Windows\System\bhlnhvk.exe
  2⤵
  PID:3892
- C:\Windows\System\ImeUSCK.exe
  C:\Windows\System\ImeUSCK.exe
  2⤵
  PID:3924
- C:\Windows\System\RkxqxlJ.exe
  C:\Windows\System\RkxqxlJ.exe
  2⤵
  PID:3956
- C:\Windows\System\uhjKXPv.exe
  C:\Windows\System\uhjKXPv.exe
  2⤵
  PID:3988
- C:\Windows\System\pKVQMJE.exe
  C:\Windows\System\pKVQMJE.exe
  2⤵
  PID:4020
- C:\Windows\System\vVTTVDj.exe
  C:\Windows\System\vVTTVDj.exe
  2⤵
  PID:2612
- C:\Windows\System\nalYtfk.exe
  C:\Windows\System\nalYtfk.exe
  2⤵
  PID:4080
- C:\Windows\System\TMZFJRd.exe
  C:\Windows\System\TMZFJRd.exe
  2⤵
  PID:2052
- C:\Windows\System\lxIsVOv.exe
  C:\Windows\System\lxIsVOv.exe
  2⤵
  PID:868
- C:\Windows\System\nqaxkBM.exe
  C:\Windows\System\nqaxkBM.exe
  2⤵
  PID:2920
- C:\Windows\System\IHtzeGg.exe
  C:\Windows\System\IHtzeGg.exe
  2⤵
  PID:2952
- C:\Windows\System\ayseidc.exe
  C:\Windows\System\ayseidc.exe
  2⤵
  PID:3124
- C:\Windows\System\uGdNDFR.exe
  C:\Windows\System\uGdNDFR.exe
  2⤵
  PID:3172
- C:\Windows\System\TcHMFek.exe
  C:\Windows\System\TcHMFek.exe
  2⤵
  PID:3236
- C:\Windows\System\AaLZjWV.exe
  C:\Windows\System\AaLZjWV.exe
  2⤵
  PID:3312
- C:\Windows\System\pHunSjQ.exe
  C:\Windows\System\pHunSjQ.exe
  2⤵
  PID:3364
- C:\Windows\System\XBXqZol.exe
  C:\Windows\System\XBXqZol.exe
  2⤵
  PID:3348
- C:\Windows\System\dTPbmMJ.exe
  C:\Windows\System\dTPbmMJ.exe
  2⤵
  PID:3504
- C:\Windows\System\qmDZGgA.exe
  C:\Windows\System\qmDZGgA.exe
  2⤵
  PID:3604
- C:\Windows\System\OKUUUbs.exe
  C:\Windows\System\OKUUUbs.exe
  2⤵
  PID:3396
- C:\Windows\System\CzfgHMb.exe
  C:\Windows\System\CzfgHMb.exe
  2⤵
  PID:3780
- C:\Windows\System\ldzOkvm.exe
  C:\Windows\System\ldzOkvm.exe
  2⤵
  PID:3920
- C:\Windows\System\EHqYJjm.exe
  C:\Windows\System\EHqYJjm.exe
  2⤵
  PID:3972
- C:\Windows\System\yqUvwyS.exe
  C:\Windows\System\yqUvwyS.exe
  2⤵
  PID:1680
- C:\Windows\System\oLrLPNM.exe
  C:\Windows\System\oLrLPNM.exe
  2⤵
  PID:3092
- C:\Windows\System\YiIOCJE.exe
  C:\Windows\System\YiIOCJE.exe
  2⤵
  PID:3332
- C:\Windows\System\pRLQudI.exe
  C:\Windows\System\pRLQudI.exe
  2⤵
  PID:3620
- C:\Windows\System\AednrIF.exe
  C:\Windows\System\AednrIF.exe
  2⤵
  PID:3440
- C:\Windows\System\EDnlIQI.exe
  C:\Windows\System\EDnlIQI.exe
  2⤵
  PID:3812
- C:\Windows\System\nXicijG.exe
  C:\Windows\System\nXicijG.exe
  2⤵
  PID:3888
- C:\Windows\System\vAzCOXy.exe
  C:\Windows\System\vAzCOXy.exe
  2⤵
  PID:3540
- C:\Windows\System\tCULJQV.exe
  C:\Windows\System\tCULJQV.exe
  2⤵
  PID:3008
- C:\Windows\System\sEDZTgU.exe
  C:\Windows\System\sEDZTgU.exe
  2⤵
  PID:4016
- C:\Windows\System\xZQdmnT.exe
  C:\Windows\System\xZQdmnT.exe
  2⤵
  PID:1476
- C:\Windows\System\GjJFVVi.exe
  C:\Windows\System\GjJFVVi.exe
  2⤵
  PID:908
- C:\Windows\System\cbwLOmk.exe
  C:\Windows\System\cbwLOmk.exe
  2⤵
  PID:3136
- C:\Windows\System\iIBHFpM.exe
  C:\Windows\System\iIBHFpM.exe
  2⤵
  PID:2804
- C:\Windows\System\VImNIqU.exe
  C:\Windows\System\VImNIqU.exe
  2⤵
  PID:1488
- C:\Windows\System\KfJOuPJ.exe
  C:\Windows\System\KfJOuPJ.exe
  2⤵
  PID:3732
- C:\Windows\System\uEHAltr.exe
  C:\Windows\System\uEHAltr.exe
  2⤵
  PID:2084
- C:\Windows\System\sPWfhUR.exe
  C:\Windows\System\sPWfhUR.exe
  2⤵
  PID:2752
- C:\Windows\System\xqllMSt.exe
  C:\Windows\System\xqllMSt.exe
  2⤵
  PID:3316
- C:\Windows\System\bpMgZDK.exe
  C:\Windows\System\bpMgZDK.exe
  2⤵
  PID:3872
- C:\Windows\System\MpWidnq.exe
  C:\Windows\System\MpWidnq.exe
  2⤵
  PID:3428
- C:\Windows\System\mNPwRui.exe
  C:\Windows\System\mNPwRui.exe
  2⤵
  PID:2736
- C:\Windows\System\WRgWFsO.exe
  C:\Windows\System\WRgWFsO.exe
  2⤵
  PID:2652
- C:\Windows\System\oaweHCH.exe
  C:\Windows\System\oaweHCH.exe
  2⤵
  PID:568
- C:\Windows\System\LcboSxN.exe
  C:\Windows\System\LcboSxN.exe
  2⤵
  PID:3684
- C:\Windows\System\EmyhLDp.exe
  C:\Windows\System\EmyhLDp.exe
  2⤵
  PID:4100
- C:\Windows\System\OjFIvRl.exe
  C:\Windows\System\OjFIvRl.exe
  2⤵
  PID:4116
- C:\Windows\System\NntzLKu.exe
  C:\Windows\System\NntzLKu.exe
  2⤵
  PID:4132
- C:\Windows\System\UTRURwv.exe
  C:\Windows\System\UTRURwv.exe
  2⤵
  PID:4148
- C:\Windows\System\pNhqaQE.exe
  C:\Windows\System\pNhqaQE.exe
  2⤵
  PID:4164
- C:\Windows\System\XUkbkuI.exe
  C:\Windows\System\XUkbkuI.exe
  2⤵
  PID:4180
- C:\Windows\System\wcrjYIw.exe
  C:\Windows\System\wcrjYIw.exe
  2⤵
  PID:4196
- C:\Windows\System\YIJcTsJ.exe
  C:\Windows\System\YIJcTsJ.exe
  2⤵
  PID:4212
- C:\Windows\System\TbHaZJo.exe
  C:\Windows\System\TbHaZJo.exe
  2⤵
  PID:4228
- C:\Windows\System\jkzHwRp.exe
  C:\Windows\System\jkzHwRp.exe
  2⤵
  PID:4244
- C:\Windows\System\NQYofrn.exe
  C:\Windows\System\NQYofrn.exe
  2⤵
  PID:4260
- C:\Windows\System\qQhQQtx.exe
  C:\Windows\System\qQhQQtx.exe
  2⤵
  PID:4276
- C:\Windows\System\tcaIUTR.exe
  C:\Windows\System\tcaIUTR.exe
  2⤵
  PID:4300
- C:\Windows\System\cBMNBDv.exe
  C:\Windows\System\cBMNBDv.exe
  2⤵
  PID:4316
- C:\Windows\System\XeHILJH.exe
  C:\Windows\System\XeHILJH.exe
  2⤵
  PID:4332
- C:\Windows\System\baNdSvV.exe
  C:\Windows\System\baNdSvV.exe
  2⤵
  PID:4348
- C:\Windows\System\OvnPRaI.exe
  C:\Windows\System\OvnPRaI.exe
  2⤵
  PID:4364
- C:\Windows\System\jNkhFGf.exe
  C:\Windows\System\jNkhFGf.exe
  2⤵
  PID:4380
- C:\Windows\System\CfREcfZ.exe
  C:\Windows\System\CfREcfZ.exe
  2⤵
  PID:4396
- C:\Windows\System\WBrdrdj.exe
  C:\Windows\System\WBrdrdj.exe
  2⤵
  PID:4412
- C:\Windows\System\escTPgV.exe
  C:\Windows\System\escTPgV.exe
  2⤵
  PID:4428
- C:\Windows\System\wBeiNfw.exe
  C:\Windows\System\wBeiNfw.exe
  2⤵
  PID:4444
- C:\Windows\System\LWQfHPg.exe
  C:\Windows\System\LWQfHPg.exe
  2⤵
  PID:4460
- C:\Windows\System\FjJFCNH.exe
  C:\Windows\System\FjJFCNH.exe
  2⤵
  PID:4480
- C:\Windows\System\IPQAhVJ.exe
  C:\Windows\System\IPQAhVJ.exe
  2⤵
  PID:4496
- C:\Windows\System\pDCJAGb.exe
  C:\Windows\System\pDCJAGb.exe
  2⤵
  PID:4512
- C:\Windows\System\PawDYzP.exe
  C:\Windows\System\PawDYzP.exe
  2⤵
  PID:4528
- C:\Windows\System\BJvnaaW.exe
  C:\Windows\System\BJvnaaW.exe
  2⤵
  PID:4548
- C:\Windows\System\jGneKpz.exe
  C:\Windows\System\jGneKpz.exe
  2⤵
  PID:4584
- C:\Windows\System\iuofYaD.exe
  C:\Windows\System\iuofYaD.exe
  2⤵
  PID:4600
- C:\Windows\System\sjFfOyr.exe
  C:\Windows\System\sjFfOyr.exe
  2⤵
  PID:4616
- C:\Windows\System\zojfvhH.exe
  C:\Windows\System\zojfvhH.exe
  2⤵
  PID:4632
- C:\Windows\System\EFZEQZQ.exe
  C:\Windows\System\EFZEQZQ.exe
  2⤵
  PID:4648
- C:\Windows\System\eJLKqWj.exe
  C:\Windows\System\eJLKqWj.exe
  2⤵
  PID:4664
- C:\Windows\System\nEwAfpk.exe
  C:\Windows\System\nEwAfpk.exe
  2⤵
  PID:4680
- C:\Windows\System\dcIIiXq.exe
  C:\Windows\System\dcIIiXq.exe
  2⤵
  PID:4696
- C:\Windows\System\omQvsgo.exe
  C:\Windows\System\omQvsgo.exe
  2⤵
  PID:4712
- C:\Windows\System\EtUYsro.exe
  C:\Windows\System\EtUYsro.exe
  2⤵
  PID:4728
- C:\Windows\System\tbSXuPC.exe
  C:\Windows\System\tbSXuPC.exe
  2⤵
  PID:4748
- C:\Windows\System\KvmMiUl.exe
  C:\Windows\System\KvmMiUl.exe
  2⤵
  PID:4764
- C:\Windows\System\BTbYYCV.exe
  C:\Windows\System\BTbYYCV.exe
  2⤵
  PID:4780
- C:\Windows\System\ROzUAtN.exe
  C:\Windows\System\ROzUAtN.exe
  2⤵
  PID:4796
- C:\Windows\System\ubAHRmY.exe
  C:\Windows\System\ubAHRmY.exe
  2⤵
  PID:4816
- C:\Windows\System\hFacByQ.exe
  C:\Windows\System\hFacByQ.exe
  2⤵
  PID:4832
- C:\Windows\System\hbdGesM.exe
  C:\Windows\System\hbdGesM.exe
  2⤵
  PID:4848
- C:\Windows\System\NtGHbsi.exe
  C:\Windows\System\NtGHbsi.exe
  2⤵
  PID:4864
- C:\Windows\System\lSFEUZw.exe
  C:\Windows\System\lSFEUZw.exe
  2⤵
  PID:4884
- C:\Windows\System\ApyDCrj.exe
  C:\Windows\System\ApyDCrj.exe
  2⤵
  PID:4900
- C:\Windows\System\vhNXHXx.exe
  C:\Windows\System\vhNXHXx.exe
  2⤵
  PID:4916
- C:\Windows\System\RWUrwak.exe
  C:\Windows\System\RWUrwak.exe
  2⤵
  PID:4932
- C:\Windows\System\eJAcsvr.exe
  C:\Windows\System\eJAcsvr.exe
  2⤵
  PID:4968
- C:\Windows\System\MUSFkmi.exe
  C:\Windows\System\MUSFkmi.exe
  2⤵
  PID:4984
- C:\Windows\System\fWRshwW.exe
  C:\Windows\System\fWRshwW.exe
  2⤵
  PID:5000
- C:\Windows\System\PxWAlDM.exe
  C:\Windows\System\PxWAlDM.exe
  2⤵
  PID:5016
- C:\Windows\System\kQHOfma.exe
  C:\Windows\System\kQHOfma.exe
  2⤵
  PID:5032
- C:\Windows\System\vxxotHd.exe
  C:\Windows\System\vxxotHd.exe
  2⤵
  PID:5048
- C:\Windows\System\wGwPHFd.exe
  C:\Windows\System\wGwPHFd.exe
  2⤵
  PID:5064
- C:\Windows\System\jONXtIN.exe
  C:\Windows\System\jONXtIN.exe
  2⤵
  PID:5080
- C:\Windows\System\klgUSeI.exe
  C:\Windows\System\klgUSeI.exe
  2⤵
  PID:5096
- C:\Windows\System\ZfEJOHB.exe
  C:\Windows\System\ZfEJOHB.exe
  2⤵
  PID:5112
- C:\Windows\System\hXnFPAz.exe
  C:\Windows\System\hXnFPAz.exe
  2⤵
  PID:4112
- C:\Windows\System\IlZSYQZ.exe
  C:\Windows\System\IlZSYQZ.exe
  2⤵
  PID:4176
- C:\Windows\System\gTuSDbu.exe
  C:\Windows\System\gTuSDbu.exe
  2⤵
  PID:2132
- C:\Windows\System\BdpWloF.exe
  C:\Windows\System\BdpWloF.exe
  2⤵
  PID:4240
- C:\Windows\System\DZQwesF.exe
  C:\Windows\System\DZQwesF.exe
  2⤵
  PID:928
- C:\Windows\System\wawLbyn.exe
  C:\Windows\System\wawLbyn.exe
  2⤵
  PID:3952
- C:\Windows\System\pUVcEDG.exe
  C:\Windows\System\pUVcEDG.exe
  2⤵
  PID:4376
- C:\Windows\System\FRqfNSv.exe
  C:\Windows\System\FRqfNSv.exe
  2⤵
  PID:4224
- C:\Windows\System\PQTLhEC.exe
  C:\Windows\System\PQTLhEC.exe
  2⤵
  PID:4284
- C:\Windows\System\CJyMhEA.exe
  C:\Windows\System\CJyMhEA.exe
  2⤵
  PID:2288
- C:\Windows\System\iKhqvfE.exe
  C:\Windows\System\iKhqvfE.exe
  2⤵
  PID:1632
- C:\Windows\System\OHlZkxU.exe
  C:\Windows\System\OHlZkxU.exe
  2⤵
  PID:3572
- C:\Windows\System\SIpyJUL.exe
  C:\Windows\System\SIpyJUL.exe
  2⤵
  PID:4356
- C:\Windows\System\oPzIvib.exe
  C:\Windows\System\oPzIvib.exe
  2⤵
  PID:4408
- C:\Windows\System\TrrmrHB.exe
  C:\Windows\System\TrrmrHB.exe
  2⤵
  PID:4468
- C:\Windows\System\ymaqCOV.exe
  C:\Windows\System\ymaqCOV.exe
  2⤵
  PID:3032
- C:\Windows\System\oZDJxNd.exe
  C:\Windows\System\oZDJxNd.exe
  2⤵
  PID:4420
- C:\Windows\System\pKIpmAQ.exe
  C:\Windows\System\pKIpmAQ.exe
  2⤵
  PID:4192
- C:\Windows\System\MkywOkS.exe
  C:\Windows\System\MkywOkS.exe
  2⤵
  PID:4508
- C:\Windows\System\yTXbwDV.exe
  C:\Windows\System\yTXbwDV.exe
  2⤵
  PID:4388
- C:\Windows\System\YiEdZoN.exe
  C:\Windows\System\YiEdZoN.exe
  2⤵
  PID:4492
- C:\Windows\System\pBWcXPs.exe
  C:\Windows\System\pBWcXPs.exe
  2⤵
  PID:4564
- C:\Windows\System\dtMtmJL.exe
  C:\Windows\System\dtMtmJL.exe
  2⤵
  PID:4596
- C:\Windows\System\bbCGgqQ.exe
  C:\Windows\System\bbCGgqQ.exe
  2⤵
  PID:4660
- C:\Windows\System\PnRHjIU.exe
  C:\Windows\System\PnRHjIU.exe
  2⤵
  PID:4724
- C:\Windows\System\jDTXBnO.exe
  C:\Windows\System\jDTXBnO.exe
  2⤵
  PID:4792
- C:\Windows\System\AqhnnAo.exe
  C:\Windows\System\AqhnnAo.exe
  2⤵
  PID:4580
- C:\Windows\System\EaxdJGZ.exe
  C:\Windows\System\EaxdJGZ.exe
  2⤵
  PID:4828
- C:\Windows\System\kbcjgEM.exe
  C:\Windows\System\kbcjgEM.exe
  2⤵
  PID:4896
- C:\Windows\System\DXmSnIx.exe
  C:\Windows\System\DXmSnIx.exe
  2⤵
  PID:4644
- C:\Windows\System\VaKCbsj.exe
  C:\Windows\System\VaKCbsj.exe
  2⤵
  PID:4708
- C:\Windows\System\VaBLTiy.exe
  C:\Windows\System\VaBLTiy.exe
  2⤵
  PID:4928
- C:\Windows\System\odlEEef.exe
  C:\Windows\System\odlEEef.exe
  2⤵
  PID:4844
- C:\Windows\System\UEMpgCf.exe
  C:\Windows\System\UEMpgCf.exe
  2⤵
  PID:4912
- C:\Windows\System\FTrpnkU.exe
  C:\Windows\System\FTrpnkU.exe
  2⤵
  PID:4948
- C:\Windows\System\tBFrnNd.exe
  C:\Windows\System\tBFrnNd.exe
  2⤵
  PID:4980
- C:\Windows\System\innQDGx.exe
  C:\Windows\System\innQDGx.exe
  2⤵
  PID:5008
- C:\Windows\System\WWoCMyt.exe
  C:\Windows\System\WWoCMyt.exe
  2⤵
  PID:3728
- C:\Windows\System\ywwGJqB.exe
  C:\Windows\System\ywwGJqB.exe
  2⤵
  PID:5056
- C:\Windows\System\uvbGJWa.exe
  C:\Windows\System\uvbGJWa.exe
  2⤵
  PID:5104
- C:\Windows\System\CKGbMdn.exe
  C:\Windows\System\CKGbMdn.exe
  2⤵
  PID:4144
- C:\Windows\System\oGzIEmC.exe
  C:\Windows\System\oGzIEmC.exe
  2⤵
  PID:1028
- C:\Windows\System\dqCOQMh.exe
  C:\Windows\System\dqCOQMh.exe
  2⤵
  PID:4312
- C:\Windows\System\Dgxmlzn.exe
  C:\Windows\System\Dgxmlzn.exe
  2⤵
  PID:756
- C:\Windows\System\VBiHmfy.exe
  C:\Windows\System\VBiHmfy.exe
  2⤵
  PID:4372
- C:\Windows\System\WVnbgnc.exe
  C:\Windows\System\WVnbgnc.exe
  2⤵
  PID:4296
- C:\Windows\System\iXEIbDQ.exe
  C:\Windows\System\iXEIbDQ.exe
  2⤵
  PID:4472
- C:\Windows\System\tfHkTvt.exe
  C:\Windows\System\tfHkTvt.exe
  2⤵
  PID:4540
- C:\Windows\System\iOsjWWH.exe
  C:\Windows\System\iOsjWWH.exe
  2⤵
  PID:4628
- C:\Windows\System\tYJELNo.exe
  C:\Windows\System\tYJELNo.exe
  2⤵
  PID:2296
- C:\Windows\System\uztehAB.exe
  C:\Windows\System\uztehAB.exe
  2⤵
  PID:4524
- C:\Windows\System\rmpDpUt.exe
  C:\Windows\System\rmpDpUt.exe
  2⤵
  PID:4256
- C:\Windows\System\YfBGfhW.exe
  C:\Windows\System\YfBGfhW.exe
  2⤵
  PID:4128
- C:\Windows\System\mwmxNqA.exe
  C:\Windows\System\mwmxNqA.exe
  2⤵
  PID:4504
- C:\Windows\System\vCrCnRK.exe
  C:\Windows\System\vCrCnRK.exe
  2⤵
  PID:4608
- C:\Windows\System\fXmxWRZ.exe
  C:\Windows\System\fXmxWRZ.exe
  2⤵
  PID:4612
- C:\Windows\System\FVzyetj.exe
  C:\Windows\System\FVzyetj.exe
  2⤵
  PID:4880
- C:\Windows\System\DoVBnVA.exe
  C:\Windows\System\DoVBnVA.exe
  2⤵
  PID:5040
- C:\Windows\System\nCeSCuJ.exe
  C:\Windows\System\nCeSCuJ.exe
  2⤵
  PID:4272
- C:\Windows\System\UudMLTq.exe
  C:\Windows\System\UudMLTq.exe
  2⤵
  PID:4812
- C:\Windows\System\VKFRFSD.exe
  C:\Windows\System\VKFRFSD.exe
  2⤵
  PID:4940
- C:\Windows\System\hhWaNnB.exe
  C:\Windows\System\hhWaNnB.exe
  2⤵
  PID:5028
- C:\Windows\System\nCoivNW.exe
  C:\Windows\System\nCoivNW.exe
  2⤵
  PID:2784
- C:\Windows\System\ZjGqaPZ.exe
  C:\Windows\System\ZjGqaPZ.exe
  2⤵
  PID:4188
- C:\Windows\System\YrEIMAf.exe
  C:\Windows\System\YrEIMAf.exe
  2⤵
  PID:4720
- C:\Windows\System\JjJBUgq.exe
  C:\Windows\System\JjJBUgq.exe
  2⤵
  PID:4892
- C:\Windows\System\RXVTBWl.exe
  C:\Windows\System\RXVTBWl.exe
  2⤵
  PID:4556
- C:\Windows\System\vuPVKYF.exe
  C:\Windows\System\vuPVKYF.exe
  2⤵
  PID:4440
- C:\Windows\System\hGCFhRK.exe
  C:\Windows\System\hGCFhRK.exe
  2⤵
  PID:4924
- C:\Windows\System\fRHLwZE.exe
  C:\Windows\System\fRHLwZE.exe
  2⤵
  PID:1996
- C:\Windows\System\ELYvGgw.exe
  C:\Windows\System\ELYvGgw.exe
  2⤵
  PID:1124
- C:\Windows\System\PCOwOKF.exe
  C:\Windows\System\PCOwOKF.exe
  2⤵
  PID:5024
- C:\Windows\System\lPRJmXb.exe
  C:\Windows\System\lPRJmXb.exe
  2⤵
  PID:4860
- C:\Windows\System\wcTQndN.exe
  C:\Windows\System\wcTQndN.exe
  2⤵
  PID:4328
- C:\Windows\System\Vrthpbq.exe
  C:\Windows\System\Vrthpbq.exe
  2⤵
  PID:4992
- C:\Windows\System\NlvLfHy.exe
  C:\Windows\System\NlvLfHy.exe
  2⤵
  PID:4944
- C:\Windows\System\vKWoUvj.exe
  C:\Windows\System\vKWoUvj.exe
  2⤵
  PID:4692
- C:\Windows\System\JWHVcgA.exe
  C:\Windows\System\JWHVcgA.exe
  2⤵
  PID:4676
- C:\Windows\System\TbADkRI.exe
  C:\Windows\System\TbADkRI.exe
  2⤵
  PID:4704
- C:\Windows\System\MenbcPu.exe
  C:\Windows\System\MenbcPu.exe
  2⤵
  PID:4488
- C:\Windows\System\fNkeodM.exe
  C:\Windows\System\fNkeodM.exe
  2⤵
  PID:2668
- C:\Windows\System\UwjkCNq.exe
  C:\Windows\System\UwjkCNq.exe
  2⤵
  PID:5132
- C:\Windows\System\GxqVUAt.exe
  C:\Windows\System\GxqVUAt.exe
  2⤵
  PID:5148
- C:\Windows\System\dBTiINc.exe
  C:\Windows\System\dBTiINc.exe
  2⤵
  PID:5164
- C:\Windows\System\tAIWNtI.exe
  C:\Windows\System\tAIWNtI.exe
  2⤵
  PID:5180
- C:\Windows\System\ofmPzmI.exe
  C:\Windows\System\ofmPzmI.exe
  2⤵
  PID:5196
- C:\Windows\System\NoWLJnW.exe
  C:\Windows\System\NoWLJnW.exe
  2⤵
  PID:5212
- C:\Windows\System\TKYWAzi.exe
  C:\Windows\System\TKYWAzi.exe
  2⤵
  PID:5228
- C:\Windows\System\ARLvqdX.exe
  C:\Windows\System\ARLvqdX.exe
  2⤵
  PID:5248
- C:\Windows\System\LXQXwie.exe
  C:\Windows\System\LXQXwie.exe
  2⤵
  PID:5264
- C:\Windows\System\JtXDGrc.exe
  C:\Windows\System\JtXDGrc.exe
  2⤵
  PID:5280
- C:\Windows\System\SUnqfoJ.exe
  C:\Windows\System\SUnqfoJ.exe
  2⤵
  PID:5296
- C:\Windows\System\ncTQgiZ.exe
  C:\Windows\System\ncTQgiZ.exe
  2⤵
  PID:5312
- C:\Windows\System\NKobQwu.exe
  C:\Windows\System\NKobQwu.exe
  2⤵
  PID:5328
- C:\Windows\System\tADzKJJ.exe
  C:\Windows\System\tADzKJJ.exe
  2⤵
  PID:5344
- C:\Windows\System\QFHioSC.exe
  C:\Windows\System\QFHioSC.exe
  2⤵
  PID:5360
- C:\Windows\System\VHZDjsv.exe
  C:\Windows\System\VHZDjsv.exe
  2⤵
  PID:5376
- C:\Windows\System\TxThXuM.exe
  C:\Windows\System\TxThXuM.exe
  2⤵
  PID:5392
- C:\Windows\System\dfbHmUR.exe
  C:\Windows\System\dfbHmUR.exe
  2⤵
  PID:5408
- C:\Windows\System\DZYsVSq.exe
  C:\Windows\System\DZYsVSq.exe
  2⤵
  PID:5424
- C:\Windows\System\LKQPCve.exe
  C:\Windows\System\LKQPCve.exe
  2⤵
  PID:5440
- C:\Windows\System\LHOmdLF.exe
  C:\Windows\System\LHOmdLF.exe
  2⤵
  PID:5456
- C:\Windows\System\btnDrGn.exe
  C:\Windows\System\btnDrGn.exe
  2⤵
  PID:5472
- C:\Windows\System\yUZiEYu.exe
  C:\Windows\System\yUZiEYu.exe
  2⤵
  PID:5488
- C:\Windows\System\oUZrnUV.exe
  C:\Windows\System\oUZrnUV.exe
  2⤵
  PID:5504
- C:\Windows\System\KqCvYVi.exe
  C:\Windows\System\KqCvYVi.exe
  2⤵
  PID:5520
- C:\Windows\System\ulcdxnr.exe
  C:\Windows\System\ulcdxnr.exe
  2⤵
  PID:5536
- C:\Windows\System\IIJUrkk.exe
  C:\Windows\System\IIJUrkk.exe
  2⤵
  PID:5552
- C:\Windows\System\cElRUHo.exe
  C:\Windows\System\cElRUHo.exe
  2⤵
  PID:5568
- C:\Windows\System\MjcuLKL.exe
  C:\Windows\System\MjcuLKL.exe
  2⤵
  PID:5584
- C:\Windows\System\fUDNqIm.exe
  C:\Windows\System\fUDNqIm.exe
  2⤵
  PID:5600
- C:\Windows\System\uBoqNcn.exe
  C:\Windows\System\uBoqNcn.exe
  2⤵
  PID:5616
- C:\Windows\System\HIYcsVO.exe
  C:\Windows\System\HIYcsVO.exe
  2⤵
  PID:5632
- C:\Windows\System\HpEogCO.exe
  C:\Windows\System\HpEogCO.exe
  2⤵
  PID:5648
- C:\Windows\System\QYidUmJ.exe
  C:\Windows\System\QYidUmJ.exe
  2⤵
  PID:5664
- C:\Windows\System\agacmHi.exe
  C:\Windows\System\agacmHi.exe
  2⤵
  PID:5680
- C:\Windows\System\TjtdHmp.exe
  C:\Windows\System\TjtdHmp.exe
  2⤵
  PID:5696
- C:\Windows\System\icwkUwj.exe
  C:\Windows\System\icwkUwj.exe
  2⤵
  PID:5712
- C:\Windows\System\rcladSl.exe
  C:\Windows\System\rcladSl.exe
  2⤵
  PID:5728
- C:\Windows\System\gHKhZza.exe
  C:\Windows\System\gHKhZza.exe
  2⤵
  PID:5744
- C:\Windows\System\WmltKsD.exe
  C:\Windows\System\WmltKsD.exe
  2⤵
  PID:5760
- C:\Windows\System\JxswxeO.exe
  C:\Windows\System\JxswxeO.exe
  2⤵
  PID:5780
- C:\Windows\System\iHuaTDI.exe
  C:\Windows\System\iHuaTDI.exe
  2⤵
  PID:5796
- C:\Windows\System\QCxuwpS.exe
  C:\Windows\System\QCxuwpS.exe
  2⤵
  PID:5812
- C:\Windows\System\dZFVKWS.exe
  C:\Windows\System\dZFVKWS.exe
  2⤵
  PID:5828
- C:\Windows\System\XVAtnTf.exe
  C:\Windows\System\XVAtnTf.exe
  2⤵
  PID:5852
- C:\Windows\System\oNXjcUC.exe
  C:\Windows\System\oNXjcUC.exe
  2⤵
  PID:5868
- C:\Windows\System\HInqvfK.exe
  C:\Windows\System\HInqvfK.exe
  2⤵
  PID:5884
- C:\Windows\System\nIiSTqS.exe
  C:\Windows\System\nIiSTqS.exe
  2⤵
  PID:5900
- C:\Windows\System\fecXzYn.exe
  C:\Windows\System\fecXzYn.exe
  2⤵
  PID:5916
- C:\Windows\System\tXFEVHX.exe
  C:\Windows\System\tXFEVHX.exe
  2⤵
  PID:5932
- C:\Windows\System\RCLIlKM.exe
  C:\Windows\System\RCLIlKM.exe
  2⤵
  PID:5948
- C:\Windows\System\YYCpEWA.exe
  C:\Windows\System\YYCpEWA.exe
  2⤵
  PID:5968
- C:\Windows\System\lQQbnRk.exe
  C:\Windows\System\lQQbnRk.exe
  2⤵
  PID:5984
- C:\Windows\System\wPvlzMn.exe
  C:\Windows\System\wPvlzMn.exe
  2⤵
  PID:6000
- C:\Windows\System\LvycGbg.exe
  C:\Windows\System\LvycGbg.exe
  2⤵
  PID:6016
- C:\Windows\System\vuJMxHr.exe
  C:\Windows\System\vuJMxHr.exe
  2⤵
  PID:6032
- C:\Windows\System\bYTqFmj.exe
  C:\Windows\System\bYTqFmj.exe
  2⤵
  PID:6048
- C:\Windows\System\UwVpdlH.exe
  C:\Windows\System\UwVpdlH.exe
  2⤵
  PID:6064
- C:\Windows\System\cnRdvDa.exe
  C:\Windows\System\cnRdvDa.exe
  2⤵
  PID:6080
- C:\Windows\System\TmyOwlk.exe
  C:\Windows\System\TmyOwlk.exe
  2⤵
  PID:6096
- C:\Windows\System\OoBWIMJ.exe
  C:\Windows\System\OoBWIMJ.exe
  2⤵
  PID:6112
- C:\Windows\System\xqtSdwh.exe
  C:\Windows\System\xqtSdwh.exe
  2⤵
  PID:6128
- C:\Windows\System\hkqfKUY.exe
  C:\Windows\System\hkqfKUY.exe
  2⤵
  PID:5124
- C:\Windows\System\SujxNDC.exe
  C:\Windows\System\SujxNDC.exe
  2⤵
  PID:5156
- C:\Windows\System\RrYpLhR.exe
  C:\Windows\System\RrYpLhR.exe
  2⤵
  PID:5220
- C:\Windows\System\DWYyAGS.exe
  C:\Windows\System\DWYyAGS.exe
  2⤵
  PID:5288
- C:\Windows\System\giASvNi.exe
  C:\Windows\System\giASvNi.exe
  2⤵
  PID:5352
- C:\Windows\System\XafaVLT.exe
  C:\Windows\System\XafaVLT.exe
  2⤵
  PID:5140
- C:\Windows\System\aafSRLi.exe
  C:\Windows\System\aafSRLi.exe
  2⤵
  PID:5176
- C:\Windows\System\gZXJsYS.exe
  C:\Windows\System\gZXJsYS.exe
  2⤵
  PID:5236
- C:\Windows\System\pHlxZTh.exe
  C:\Windows\System\pHlxZTh.exe
  2⤵
  PID:5276
- C:\Windows\System\pilMXFZ.exe
  C:\Windows\System\pilMXFZ.exe
  2⤵
  PID:5340
- C:\Windows\System\eRYiQsu.exe
  C:\Windows\System\eRYiQsu.exe
  2⤵
  PID:5388
- C:\Windows\System\yYVUKfC.exe
  C:\Windows\System\yYVUKfC.exe
  2⤵
  PID:5420
- C:\Windows\System\tqKoeld.exe
  C:\Windows\System\tqKoeld.exe
  2⤵
  PID:5484
- C:\Windows\System\EcsUUVq.exe
  C:\Windows\System\EcsUUVq.exe
  2⤵
  PID:5436
- C:\Windows\System\gtbpTxu.exe
  C:\Windows\System\gtbpTxu.exe
  2⤵
  PID:5500
- C:\Windows\System\nMAEppv.exe
  C:\Windows\System\nMAEppv.exe
  2⤵
  PID:5576
- C:\Windows\System\lVPTBKg.exe
  C:\Windows\System\lVPTBKg.exe
  2⤵
  PID:5560
- C:\Windows\System\OVhiJYS.exe
  C:\Windows\System\OVhiJYS.exe
  2⤵
  PID:5640
- C:\Windows\System\VPSQjFf.exe
  C:\Windows\System\VPSQjFf.exe
  2⤵
  PID:5676
- C:\Windows\System\WnXfjCw.exe
  C:\Windows\System\WnXfjCw.exe
  2⤵
  PID:5736
- C:\Windows\System\JdRKlEy.exe
  C:\Windows\System\JdRKlEy.exe
  2⤵
  PID:5772
- C:\Windows\System\CXUpRfx.exe
  C:\Windows\System\CXUpRfx.exe
  2⤵
  PID:5720
- C:\Windows\System\DfZCPKJ.exe
  C:\Windows\System\DfZCPKJ.exe
  2⤵
  PID:5724
- C:\Windows\System\vBVGoef.exe
  C:\Windows\System\vBVGoef.exe
  2⤵
  PID:5840
- C:\Windows\System\bLyOmXQ.exe
  C:\Windows\System\bLyOmXQ.exe
  2⤵
  PID:5692
- C:\Windows\System\SrZQrln.exe
  C:\Windows\System\SrZQrln.exe
  2⤵
  PID:5752
- C:\Windows\System\TPLkrQS.exe
  C:\Windows\System\TPLkrQS.exe
  2⤵
  PID:5892
- C:\Windows\System\fAjpUkQ.exe
  C:\Windows\System\fAjpUkQ.exe
  2⤵
  PID:5924
- C:\Windows\System\tATLrbs.exe
  C:\Windows\System\tATLrbs.exe
  2⤵
  PID:5928
- C:\Windows\System\UQbCRnc.exe
  C:\Windows\System\UQbCRnc.exe
  2⤵
  PID:5944
- C:\Windows\System\RluWXTV.exe
  C:\Windows\System\RluWXTV.exe
  2⤵
  PID:6008
- C:\Windows\System\OrCHBYB.exe
  C:\Windows\System\OrCHBYB.exe
  2⤵
  PID:6024
- C:\Windows\System\hyPffwG.exe
  C:\Windows\System\hyPffwG.exe
  2⤵
  PID:6028
- C:\Windows\System\oqJrIpw.exe
  C:\Windows\System\oqJrIpw.exe
  2⤵
  PID:6108
- C:\Windows\System\jnRDome.exe
  C:\Windows\System\jnRDome.exe
  2⤵
  PID:6056
- C:\Windows\System\RNwYYUk.exe
  C:\Windows\System\RNwYYUk.exe
  2⤵
  PID:5256
- C:\Windows\System\RRnqyXS.exe
  C:\Windows\System\RRnqyXS.exe
  2⤵
  PID:5260
- C:\Windows\System\YNMaDzh.exe
  C:\Windows\System\YNMaDzh.exe
  2⤵
  PID:5172
- C:\Windows\System\vxwUdjK.exe
  C:\Windows\System\vxwUdjK.exe
  2⤵
  PID:5208
- C:\Windows\System\tHuBknS.exe
  C:\Windows\System\tHuBknS.exe
  2⤵
  PID:4344
- C:\Windows\System\rZdDotQ.exe
  C:\Windows\System\rZdDotQ.exe
  2⤵
  PID:2928
- C:\Windows\System\fYskUwn.exe
  C:\Windows\System\fYskUwn.exe
  2⤵
  PID:5452
- C:\Windows\System\JXBivCN.exe
  C:\Windows\System\JXBivCN.exe
  2⤵
  PID:5468
- C:\Windows\System\dMUonie.exe
  C:\Windows\System\dMUonie.exe
  2⤵
  PID:5672
- C:\Windows\System\JRCQmUd.exe
  C:\Windows\System\JRCQmUd.exe
  2⤵
  PID:5656
- C:\Windows\System\LhEwUCa.exe
  C:\Windows\System\LhEwUCa.exe
  2⤵
  PID:5532
- C:\Windows\System\eYcODeV.exe
  C:\Windows\System\eYcODeV.exe
  2⤵
  PID:5792
- C:\Windows\System\LZlCBqj.exe
  C:\Windows\System\LZlCBqj.exe
  2⤵
  PID:5708
- C:\Windows\System\LbDtoHQ.exe
  C:\Windows\System\LbDtoHQ.exe
  2⤵
  PID:5824
- C:\Windows\System\mMaWfBZ.exe
  C:\Windows\System\mMaWfBZ.exe
  2⤵
  PID:5836
- C:\Windows\System\kLmnLXC.exe
  C:\Windows\System\kLmnLXC.exe
  2⤵
  PID:5644
- C:\Windows\System\eGGBMxQ.exe
  C:\Windows\System\eGGBMxQ.exe
  2⤵
  PID:5912
- C:\Windows\System\LWYIJdB.exe
  C:\Windows\System\LWYIJdB.exe
  2⤵
  PID:6140
- C:\Windows\System\qQWEbWI.exe
  C:\Windows\System\qQWEbWI.exe
  2⤵
  PID:6104
- C:\Windows\System\ouCgRXz.exe
  C:\Windows\System\ouCgRXz.exe
  2⤵
  PID:4744
- C:\Windows\System\HNUyZAT.exe
  C:\Windows\System\HNUyZAT.exe
  2⤵
  PID:5324
- C:\Windows\System\RqcDzPg.exe
  C:\Windows\System\RqcDzPg.exe
  2⤵
  PID:2780
- C:\Windows\System\CUdnDoC.exe
  C:\Windows\System\CUdnDoC.exe
  2⤵
  PID:5480
- C:\Windows\System\lSGrPyD.exe
  C:\Windows\System\lSGrPyD.exe
  2⤵
  PID:5384
- C:\Windows\System\PlDeHdY.exe
  C:\Windows\System\PlDeHdY.exe
  2⤵
  PID:5820
- C:\Windows\System\XtRlyxS.exe
  C:\Windows\System\XtRlyxS.exe
  2⤵
  PID:5908
- C:\Windows\System\EvqKISq.exe
  C:\Windows\System\EvqKISq.exe
  2⤵
  PID:6076
- C:\Windows\System\gCnFdiU.exe
  C:\Windows\System\gCnFdiU.exe
  2⤵
  PID:2012
- C:\Windows\System\Cmlcniu.exe
  C:\Windows\System\Cmlcniu.exe
  2⤵
  PID:5808
- C:\Windows\System\TnpVYkc.exe
  C:\Windows\System\TnpVYkc.exe
  2⤵
  PID:5432
- C:\Windows\System\lyWHBjv.exe
  C:\Windows\System\lyWHBjv.exe
  2⤵
  PID:5996
- C:\Windows\System\UIxpcVR.exe
  C:\Windows\System\UIxpcVR.exe
  2⤵
  PID:4108
- C:\Windows\System\pGSMKND.exe
  C:\Windows\System\pGSMKND.exe
  2⤵
  PID:6320
- C:\Windows\System\ffLqHeQ.exe
  C:\Windows\System\ffLqHeQ.exe
  2⤵
  PID:6616
- C:\Windows\System\jvuNpUw.exe
  C:\Windows\System\jvuNpUw.exe
  2⤵
  PID:6844
- C:\Windows\System\FwhmZpk.exe
  C:\Windows\System\FwhmZpk.exe
  2⤵
  PID:6860
- C:\Windows\System\pzkhHZA.exe
  C:\Windows\System\pzkhHZA.exe
  2⤵
  PID:6880
- C:\Windows\System\deWKCPC.exe
  C:\Windows\System\deWKCPC.exe
  2⤵
  PID:6896
- C:\Windows\System\XrJJhFt.exe
  C:\Windows\System\XrJJhFt.exe
  2⤵
  PID:6912
- C:\Windows\System\cMbMEff.exe
  C:\Windows\System\cMbMEff.exe
  2⤵
  PID:6936
- C:\Windows\System\DiNmhxP.exe
  C:\Windows\System\DiNmhxP.exe
  2⤵
  PID:6952
- C:\Windows\System\QIyWEfj.exe
  C:\Windows\System\QIyWEfj.exe
  2⤵
  PID:6972
- C:\Windows\System\DYxrkWg.exe
  C:\Windows\System\DYxrkWg.exe
  2⤵
  PID:6988
- C:\Windows\System\igjHYwt.exe
  C:\Windows\System\igjHYwt.exe
  2⤵
  PID:7008
- C:\Windows\System\LNrCMtv.exe
  C:\Windows\System\LNrCMtv.exe
  2⤵
  PID:7024
- C:\Windows\System\seDvOBL.exe
  C:\Windows\System\seDvOBL.exe
  2⤵
  PID:7132
- C:\Windows\System\XbnOdeQ.exe
  C:\Windows\System\XbnOdeQ.exe
  2⤵
  PID:7152
- C:\Windows\System\siAFnQW.exe
  C:\Windows\System\siAFnQW.exe
  2⤵
  PID:2992
- C:\Windows\System\XyRbzFT.exe
  C:\Windows\System\XyRbzFT.exe
  2⤵
  PID:5188
- C:\Windows\System\glWEztB.exe
  C:\Windows\System\glWEztB.exe
  2⤵
  PID:6040
- C:\Windows\System\bSfJwTl.exe
  C:\Windows\System\bSfJwTl.exe
  2⤵
  PID:6196
- C:\Windows\System\ofmQUng.exe
  C:\Windows\System\ofmQUng.exe
  2⤵
  PID:6240
- C:\Windows\System\EZuUqaT.exe
  C:\Windows\System\EZuUqaT.exe
  2⤵
  PID:6288
- C:\Windows\System\KXekxJC.exe
  C:\Windows\System\KXekxJC.exe
  2⤵
  PID:6308
- C:\Windows\System\NJGqhnT.exe
  C:\Windows\System\NJGqhnT.exe
  2⤵
  PID:6328
- C:\Windows\System\RZQAsGg.exe
  C:\Windows\System\RZQAsGg.exe
  2⤵
  PID:6348
- C:\Windows\System\QTkWdPY.exe
  C:\Windows\System\QTkWdPY.exe
  2⤵
  PID:6364
- C:\Windows\System\uLdKJww.exe
  C:\Windows\System\uLdKJww.exe
  2⤵
  PID:6392
- C:\Windows\System\eeLxffp.exe
  C:\Windows\System\eeLxffp.exe
  2⤵
  PID:6412
- C:\Windows\System\nfdziVK.exe
  C:\Windows\System\nfdziVK.exe
  2⤵
  PID:6432
- C:\Windows\System\IEbVVQF.exe
  C:\Windows\System\IEbVVQF.exe
  2⤵
  PID:6448
- C:\Windows\System\zMpalRe.exe
  C:\Windows\System\zMpalRe.exe
  2⤵
  PID:6468
- C:\Windows\System\dAHWvvA.exe
  C:\Windows\System\dAHWvvA.exe
  2⤵
  PID:6480
- C:\Windows\System\dbRoVya.exe
  C:\Windows\System\dbRoVya.exe
  2⤵
  PID:6396
- C:\Windows\System\fdztwNP.exe
  C:\Windows\System\fdztwNP.exe
  2⤵
  PID:6500
- C:\Windows\System\FVGQrJN.exe
  C:\Windows\System\FVGQrJN.exe
  2⤵
  PID:6516
- C:\Windows\System\IglmfAv.exe
  C:\Windows\System\IglmfAv.exe
  2⤵
  PID:6592
- C:\Windows\System\UgAVAkf.exe
  C:\Windows\System\UgAVAkf.exe
  2⤵
  PID:6644
- C:\Windows\System\hcaCTgs.exe
  C:\Windows\System\hcaCTgs.exe
  2⤵
  PID:6660
- C:\Windows\System\kZrLDff.exe
  C:\Windows\System\kZrLDff.exe
  2⤵
  PID:6668
- C:\Windows\System\ZJtQoxh.exe
  C:\Windows\System\ZJtQoxh.exe
  2⤵
  PID:6684
- C:\Windows\System\DjODRKB.exe
  C:\Windows\System\DjODRKB.exe
  2⤵
  PID:6704
- C:\Windows\System\kkayozr.exe
  C:\Windows\System\kkayozr.exe
  2⤵
  PID:6728
- C:\Windows\System\WhhjfVr.exe
  C:\Windows\System\WhhjfVr.exe
  2⤵
  PID:6760
- C:\Windows\System\PDvKSFP.exe
  C:\Windows\System\PDvKSFP.exe
  2⤵
  PID:6776
- C:\Windows\System\AnQOVKm.exe
  C:\Windows\System\AnQOVKm.exe
  2⤵
  PID:6796
- C:\Windows\System\MvOIKbq.exe
  C:\Windows\System\MvOIKbq.exe
  2⤵
  PID:6812
- C:\Windows\System\lnCCpGf.exe
  C:\Windows\System\lnCCpGf.exe
  2⤵
  PID:6920
- C:\Windows\System\hciWmRq.exe
  C:\Windows\System\hciWmRq.exe
  2⤵
  PID:6828
- C:\Windows\System\WVfeDuC.exe
  C:\Windows\System\WVfeDuC.exe
  2⤵
  PID:7000
- C:\Windows\System\TtVcgFo.exe
  C:\Windows\System\TtVcgFo.exe
  2⤵
  PID:7040
- C:\Windows\System\OWqVBXW.exe
  C:\Windows\System\OWqVBXW.exe
  2⤵
  PID:7060
- C:\Windows\System\aOwqKZE.exe
  C:\Windows\System\aOwqKZE.exe
  2⤵
  PID:7068
- C:\Windows\System\LsdZpaa.exe
  C:\Windows\System\LsdZpaa.exe
  2⤵
  PID:7088
- C:\Windows\System\fVlpLkk.exe
  C:\Windows\System\fVlpLkk.exe
  2⤵
  PID:6816
- C:\Windows\System\GnSkEDJ.exe
  C:\Windows\System\GnSkEDJ.exe
  2⤵
  PID:7160
- C:\Windows\System\wOzLCng.exe
  C:\Windows\System\wOzLCng.exe
  2⤵
  PID:6200
- C:\Windows\System\oppCNej.exe
  C:\Windows\System\oppCNej.exe
  2⤵
  PID:7128
- C:\Windows\System\qtqPfas.exe
  C:\Windows\System\qtqPfas.exe
  2⤵
  PID:6216
- C:\Windows\System\mmyQTEl.exe
  C:\Windows\System\mmyQTEl.exe
  2⤵
  PID:6300
- C:\Windows\System\vecwUod.exe
  C:\Windows\System\vecwUod.exe
  2⤵
  PID:6508
- C:\Windows\System\GkXkZRO.exe
  C:\Windows\System\GkXkZRO.exe
  2⤵
  PID:5844
- C:\Windows\System\pjIpMjs.exe
  C:\Windows\System\pjIpMjs.exe
  2⤵
  PID:6164
- C:\Windows\System\cQnqaMg.exe
  C:\Windows\System\cQnqaMg.exe
  2⤵
  PID:6524
- C:\Windows\System\dVTjyEL.exe
  C:\Windows\System\dVTjyEL.exe
  2⤵
  PID:4876
- C:\Windows\System\VrJHNBO.exe
  C:\Windows\System\VrJHNBO.exe
  2⤵
  PID:6244
- C:\Windows\System\naCeaPP.exe
  C:\Windows\System\naCeaPP.exe
  2⤵
  PID:6564
- C:\Windows\System\mneGikw.exe
  C:\Windows\System\mneGikw.exe
  2⤵
  PID:6632
- C:\Windows\System\eVHCtkK.exe
  C:\Windows\System\eVHCtkK.exe
  2⤵
  PID:6176
- C:\Windows\System\YWVjntO.exe
  C:\Windows\System\YWVjntO.exe
  2⤵
  PID:6544
- C:\Windows\System\tXXYapa.exe
  C:\Windows\System\tXXYapa.exe
  2⤵
  PID:6492
- C:\Windows\System\HOFCvvj.exe
  C:\Windows\System\HOFCvvj.exe
  2⤵
  PID:6256
- C:\Windows\System\JUrUmYp.exe
  C:\Windows\System\JUrUmYp.exe
  2⤵
  PID:6280
- C:\Windows\System\fFFENta.exe
  C:\Windows\System\fFFENta.exe
  2⤵
  PID:6540
- C:\Windows\System\gAmoJdk.exe
  C:\Windows\System\gAmoJdk.exe
  2⤵
  PID:6752
- C:\Windows\System\clfVXmh.exe
  C:\Windows\System\clfVXmh.exe
  2⤵
  PID:6840
- C:\Windows\System\AzmsAXc.exe
  C:\Windows\System\AzmsAXc.exe
  2⤵
  PID:5548
- C:\Windows\System\ZvAPjBb.exe
  C:\Windows\System\ZvAPjBb.exe
  2⤵
  PID:6984
- C:\Windows\System\pQqgfxo.exe
  C:\Windows\System\pQqgfxo.exe
  2⤵
  PID:6408
- C:\Windows\System\RiVNnQi.exe
  C:\Windows\System\RiVNnQi.exe
  2⤵
  PID:6572
- C:\Windows\System\INGbjiV.exe
  C:\Windows\System\INGbjiV.exe
  2⤵
  PID:7052
- C:\Windows\System\KsAGvDv.exe
  C:\Windows\System\KsAGvDv.exe
  2⤵
  PID:6652
- C:\Windows\System\bJMTAVk.exe
  C:\Windows\System\bJMTAVk.exe
  2⤵
  PID:6724
- C:\Windows\System\uINfrjc.exe
  C:\Windows\System\uINfrjc.exe
  2⤵
  PID:6804
- C:\Windows\System\OrtHfeW.exe
  C:\Windows\System\OrtHfeW.exe
  2⤵
  PID:6968
- C:\Windows\System\RDXuTpu.exe
  C:\Windows\System\RDXuTpu.exe
  2⤵
  PID:7144
- C:\Windows\System\sEykwdV.exe
  C:\Windows\System\sEykwdV.exe
  2⤵
  PID:6168
- C:\Windows\System\UsBEcKS.exe
  C:\Windows\System\UsBEcKS.exe
  2⤵
  PID:7076
- C:\Windows\System\bzRcavr.exe
  C:\Windows\System\bzRcavr.exe
  2⤵
  PID:7080
- C:\Windows\System\ylknIML.exe
  C:\Windows\System\ylknIML.exe
  2⤵
  PID:7140
- C:\Windows\System\NFBYALv.exe
  C:\Windows\System\NFBYALv.exe
  2⤵
  PID:6628
- C:\Windows\System\DigCpmy.exe
  C:\Windows\System\DigCpmy.exe
  2⤵
  PID:6944
- C:\Windows\System\jebbFun.exe
  C:\Windows\System\jebbFun.exe
  2⤵
  PID:2996
- C:\Windows\System\wsGwLGO.exe
  C:\Windows\System\wsGwLGO.exe
  2⤵
  PID:7108
- C:\Windows\System\EqTZUIK.exe
  C:\Windows\System\EqTZUIK.exe
  2⤵
  PID:2840
- C:\Windows\System\eDjMPon.exe
  C:\Windows\System\eDjMPon.exe
  2⤵
  PID:6388
- C:\Windows\System\DZiKDLA.exe
  C:\Windows\System\DZiKDLA.exe
  2⤵
  PID:6252
- C:\Windows\System\xhRUyKY.exe
  C:\Windows\System\xhRUyKY.exe
  2⤵
  PID:6276
- C:\Windows\System\VlDtZfQ.exe
  C:\Windows\System\VlDtZfQ.exe
  2⤵
  PID:6612
- C:\Windows\System\ARCDvEf.exe
  C:\Windows\System\ARCDvEf.exe
  2⤵
  PID:6556
- C:\Windows\System\VpLgoIt.exe
  C:\Windows\System\VpLgoIt.exe
  2⤵
  PID:6376
- C:\Windows\System\BAWyyPM.exe
  C:\Windows\System\BAWyyPM.exe
  2⤵
  PID:6692
- C:\Windows\System\InlyuAf.exe
  C:\Windows\System\InlyuAf.exe
  2⤵
  PID:2060
- C:\Windows\System\LyYeSBf.exe
  C:\Windows\System\LyYeSBf.exe
  2⤵
  PID:6460
- C:\Windows\System\mZPgGFP.exe
  C:\Windows\System\mZPgGFP.exe
  2⤵
  PID:6836
- C:\Windows\System\LNVqLGi.exe
  C:\Windows\System\LNVqLGi.exe
  2⤵
  PID:6820
- C:\Windows\System\HcaYUqH.exe
  C:\Windows\System\HcaYUqH.exe
  2⤵
  PID:6284
- C:\Windows\System\YUlOBTQ.exe
  C:\Windows\System\YUlOBTQ.exe
  2⤵
  PID:6768
- C:\Windows\System\hiVjUEp.exe
  C:\Windows\System\hiVjUEp.exe
  2⤵
  PID:6888
- C:\Windows\System\LNWUCjh.exe
  C:\Windows\System\LNWUCjh.exe
  2⤵
  PID:6964
- C:\Windows\System\LjyJgNZ.exe
  C:\Windows\System\LjyJgNZ.exe
  2⤵
  PID:7020
- C:\Windows\System\BlkmDgA.exe
  C:\Windows\System\BlkmDgA.exe
  2⤵
  PID:7036
- C:\Windows\System\ljAjjQH.exe
  C:\Windows\System\ljAjjQH.exe
  2⤵
  PID:6380
- C:\Windows\System\XlTQXQX.exe
  C:\Windows\System\XlTQXQX.exe
  2⤵
  PID:6712
- C:\Windows\System\QIIPTOz.exe
  C:\Windows\System\QIIPTOz.exe
  2⤵
  PID:6496
- C:\Windows\System\IxFKKOm.exe
  C:\Windows\System\IxFKKOm.exe
  2⤵
  PID:6188
- C:\Windows\System\ItKaeVe.exe
  C:\Windows\System\ItKaeVe.exe
  2⤵
  PID:6304
- C:\Windows\System\SdJcGvX.exe
  C:\Windows\System\SdJcGvX.exe
  2⤵
  PID:6584
- C:\Windows\System\uKpDlTO.exe
  C:\Windows\System\uKpDlTO.exe
  2⤵
  PID:6152
- C:\Windows\System\ZezMZiU.exe
  C:\Windows\System\ZezMZiU.exe
  2⤵
  PID:1720
- C:\Windows\System\zPigEwR.exe
  C:\Windows\System\zPigEwR.exe
  2⤵
  PID:6656
- C:\Windows\System\GiSQPWY.exe
  C:\Windows\System\GiSQPWY.exe
  2⤵
  PID:6908
- C:\Windows\System\lhexhhf.exe
  C:\Windows\System\lhexhhf.exe
  2⤵
  PID:7032
- C:\Windows\System\pjIxvVT.exe
  C:\Windows\System\pjIxvVT.exe
  2⤵
  PID:6928
- C:\Windows\System\FrNBIFS.exe
  C:\Windows\System\FrNBIFS.exe
  2⤵
  PID:6560
- C:\Windows\System\HRMbvKE.exe
  C:\Windows\System\HRMbvKE.exe
  2⤵
  PID:6580
- C:\Windows\System\BeOsNJM.exe
  C:\Windows\System\BeOsNJM.exe
  2⤵
  PID:6420
- C:\Windows\System\GmslkIC.exe
  C:\Windows\System\GmslkIC.exe
  2⤵
  PID:6220
- C:\Windows\System\UpJTCyf.exe
  C:\Windows\System\UpJTCyf.exe
  2⤵
  PID:2812
- C:\Windows\System\lYMRSZh.exe
  C:\Windows\System\lYMRSZh.exe
  2⤵
  PID:6232
- C:\Windows\System\BdnRQhm.exe
  C:\Windows\System\BdnRQhm.exe
  2⤵
  PID:2352
- C:\Windows\System\OruTLkA.exe
  C:\Windows\System\OruTLkA.exe
  2⤵
  PID:6532
- C:\Windows\System\GokFCdk.exe
  C:\Windows\System\GokFCdk.exe
  2⤵
  PID:7176
- C:\Windows\System\LrZgIWy.exe
  C:\Windows\System\LrZgIWy.exe
  2⤵
  PID:7196
- C:\Windows\System\mlKFNFR.exe
  C:\Windows\System\mlKFNFR.exe
  2⤵
  PID:7212
- C:\Windows\System\LIIAcay.exe
  C:\Windows\System\LIIAcay.exe
  2⤵
  PID:7228
- C:\Windows\System\GQhSiYp.exe
  C:\Windows\System\GQhSiYp.exe
  2⤵
  PID:7244
- C:\Windows\System\UTfzdSy.exe
  C:\Windows\System\UTfzdSy.exe
  2⤵
  PID:7260
- C:\Windows\System\FOlLwmb.exe
  C:\Windows\System\FOlLwmb.exe
  2⤵
  PID:7276
- C:\Windows\System\rdWdxbW.exe
  C:\Windows\System\rdWdxbW.exe
  2⤵
  PID:7292
- C:\Windows\System\HrpHEcZ.exe
  C:\Windows\System\HrpHEcZ.exe
  2⤵
  PID:7316
- C:\Windows\System\IJSGNkQ.exe
  C:\Windows\System\IJSGNkQ.exe
  2⤵
  PID:7332
- C:\Windows\System\tRkUDsd.exe
  C:\Windows\System\tRkUDsd.exe
  2⤵
  PID:7348
- C:\Windows\System\IOjqwfH.exe
  C:\Windows\System\IOjqwfH.exe
  2⤵
  PID:7364
- C:\Windows\System\aSOcvnd.exe
  C:\Windows\System\aSOcvnd.exe
  2⤵
  PID:7380
- C:\Windows\System\qywcfBY.exe
  C:\Windows\System\qywcfBY.exe
  2⤵
  PID:7396
- C:\Windows\System\ELgFYHd.exe
  C:\Windows\System\ELgFYHd.exe
  2⤵
  PID:7416
- C:\Windows\System\BvQiBfl.exe
  C:\Windows\System\BvQiBfl.exe
  2⤵
  PID:7432
- C:\Windows\System\LhjBLJY.exe
  C:\Windows\System\LhjBLJY.exe
  2⤵
  PID:7448
- C:\Windows\System\KiSIApD.exe
  C:\Windows\System\KiSIApD.exe
  2⤵
  PID:7468
- C:\Windows\System\OwuIToY.exe
  C:\Windows\System\OwuIToY.exe
  2⤵
  PID:7484
- C:\Windows\System\YMkLLTf.exe
  C:\Windows\System\YMkLLTf.exe
  2⤵
  PID:7500
- C:\Windows\System\iMwPcRW.exe
  C:\Windows\System\iMwPcRW.exe
  2⤵
  PID:7520
- C:\Windows\System\JjPtMxX.exe
  C:\Windows\System\JjPtMxX.exe
  2⤵
  PID:7536
- C:\Windows\System\yesCdwS.exe
  C:\Windows\System\yesCdwS.exe
  2⤵
  PID:7552
- C:\Windows\System\AFNPwNY.exe
  C:\Windows\System\AFNPwNY.exe
  2⤵
  PID:7568
- C:\Windows\System\ywWjUtq.exe
  C:\Windows\System\ywWjUtq.exe
  2⤵
  PID:7584
- C:\Windows\System\uZrKGjV.exe
  C:\Windows\System\uZrKGjV.exe
  2⤵
  PID:7600
- C:\Windows\System\eKvwHHs.exe
  C:\Windows\System\eKvwHHs.exe
  2⤵
  PID:7688
- C:\Windows\System\UJvFNMJ.exe
  C:\Windows\System\UJvFNMJ.exe
  2⤵
  PID:7704
- C:\Windows\System\oGPiSxT.exe
  C:\Windows\System\oGPiSxT.exe
  2⤵
  PID:7720
- C:\Windows\System\oIEGzpT.exe
  C:\Windows\System\oIEGzpT.exe
  2⤵
  PID:7736
- C:\Windows\System\zwpvEqx.exe
  C:\Windows\System\zwpvEqx.exe
  2⤵
  PID:7752
- C:\Windows\System\oRjvZJQ.exe
  C:\Windows\System\oRjvZJQ.exe
  2⤵
  PID:7768
- C:\Windows\System\JzzlgJA.exe
  C:\Windows\System\JzzlgJA.exe
  2⤵
  PID:7784
- C:\Windows\System\OblLJbs.exe
  C:\Windows\System\OblLJbs.exe
  2⤵
  PID:7800
- C:\Windows\System\ggPhxcX.exe
  C:\Windows\System\ggPhxcX.exe
  2⤵
  PID:7816
- C:\Windows\System\wpMstOY.exe
  C:\Windows\System\wpMstOY.exe
  2⤵
  PID:7832
- C:\Windows\System\waBOuan.exe
  C:\Windows\System\waBOuan.exe
  2⤵
  PID:7856
- C:\Windows\System\aAYMyNF.exe
  C:\Windows\System\aAYMyNF.exe
  2⤵
  PID:7872
- C:\Windows\System\erPIyGS.exe
  C:\Windows\System\erPIyGS.exe
  2⤵
  PID:7892
- C:\Windows\System\ZeKOeLt.exe
  C:\Windows\System\ZeKOeLt.exe
  2⤵
  PID:7908
- C:\Windows\System\tPWOLjg.exe
  C:\Windows\System\tPWOLjg.exe
  2⤵
  PID:7924
- C:\Windows\System\ubROIaA.exe
  C:\Windows\System\ubROIaA.exe
  2⤵
  PID:7940
- C:\Windows\System\YYOABaZ.exe
  C:\Windows\System\YYOABaZ.exe
  2⤵
  PID:7956
- C:\Windows\System\fVSkkXt.exe
  C:\Windows\System\fVSkkXt.exe
  2⤵
  PID:7972
- C:\Windows\System\kmGIDEz.exe
  C:\Windows\System\kmGIDEz.exe
  2⤵
  PID:7988
- C:\Windows\System\mDvAvaC.exe
  C:\Windows\System\mDvAvaC.exe
  2⤵
  PID:8004
- C:\Windows\System\NSNyUlB.exe
  C:\Windows\System\NSNyUlB.exe
  2⤵
  PID:8020
- C:\Windows\System\vbuDlWZ.exe
  C:\Windows\System\vbuDlWZ.exe
  2⤵
  PID:8036
- C:\Windows\System\hazodwo.exe
  C:\Windows\System\hazodwo.exe
  2⤵
  PID:8052
- C:\Windows\System\JeyLaqU.exe
  C:\Windows\System\JeyLaqU.exe
  2⤵
  PID:8068
- C:\Windows\System\TxcvEhx.exe
  C:\Windows\System\TxcvEhx.exe
  2⤵
  PID:8084
- C:\Windows\System\ZGLeCRv.exe
  C:\Windows\System\ZGLeCRv.exe
  2⤵
  PID:8104
- C:\Windows\System\KlCZIGC.exe
  C:\Windows\System\KlCZIGC.exe
  2⤵
  PID:8120
- C:\Windows\System\uRrFCtX.exe
  C:\Windows\System\uRrFCtX.exe
  2⤵
  PID:8136
- C:\Windows\System\ZkXjNNw.exe
  C:\Windows\System\ZkXjNNw.exe
  2⤵
  PID:8152
- C:\Windows\System\IvDWwvY.exe
  C:\Windows\System\IvDWwvY.exe
  2⤵
  PID:8168
- C:\Windows\System\JxWJYtT.exe
  C:\Windows\System\JxWJYtT.exe
  2⤵
  PID:8184
- C:\Windows\System\hCmzLZx.exe
  C:\Windows\System\hCmzLZx.exe
  2⤵
  PID:7184
- C:\Windows\System\sLXmPOV.exe
  C:\Windows\System\sLXmPOV.exe
  2⤵
  PID:7220
- C:\Windows\System\zPorbzN.exe
  C:\Windows\System\zPorbzN.exe
  2⤵
  PID:6356
- C:\Windows\System\YXEHbjV.exe
  C:\Windows\System\YXEHbjV.exe
  2⤵
  PID:7324
- C:\Windows\System\yOLUfkU.exe
  C:\Windows\System\yOLUfkU.exe
  2⤵
  PID:7388
- C:\Windows\System\TZxNMKo.exe
  C:\Windows\System\TZxNMKo.exe
  2⤵
  PID:6208
- C:\Windows\System\tvUZKCn.exe
  C:\Windows\System\tvUZKCn.exe
  2⤵
  PID:7464
- C:\Windows\System\BCbgCsk.exe
  C:\Windows\System\BCbgCsk.exe
  2⤵
  PID:7272
- C:\Windows\System\yIzmqZt.exe
  C:\Windows\System\yIzmqZt.exe
  2⤵
  PID:7492
- C:\Windows\System\VQcOgNW.exe
  C:\Windows\System\VQcOgNW.exe
  2⤵
  PID:7344
- C:\Windows\System\BsmxNpC.exe
  C:\Windows\System\BsmxNpC.exe
  2⤵
  PID:7372
- C:\Windows\System\MEkajmj.exe
  C:\Windows\System\MEkajmj.exe
  2⤵
  PID:7440
- C:\Windows\System\YvfoVPP.exe
  C:\Windows\System\YvfoVPP.exe
  2⤵
  PID:7512
- C:\Windows\System\WsAOdBy.exe
  C:\Windows\System\WsAOdBy.exe
  2⤵
  PID:7580
- C:\Windows\System\ymlBlGe.exe
  C:\Windows\System\ymlBlGe.exe
  2⤵
  PID:7516
- C:\Windows\System\YVvuoJL.exe
  C:\Windows\System\YVvuoJL.exe
  2⤵
  PID:7532
- C:\Windows\System\nqKzUsh.exe
  C:\Windows\System\nqKzUsh.exe
  2⤵
  PID:7592
- C:\Windows\System\YLJCqzU.exe
  C:\Windows\System\YLJCqzU.exe
  2⤵
  PID:7620
- C:\Windows\System\thYOOtO.exe
  C:\Windows\System\thYOOtO.exe
  2⤵
  PID:7640
- C:\Windows\System\UDMtFGw.exe
  C:\Windows\System\UDMtFGw.exe
  2⤵
  PID:7656
- C:\Windows\System\kXHqvTP.exe
  C:\Windows\System\kXHqvTP.exe
  2⤵
  PID:7660
- C:\Windows\System\ytCHqzN.exe
  C:\Windows\System\ytCHqzN.exe
  2⤵
  PID:7728
- C:\Windows\System\PKlSOYe.exe
  C:\Windows\System\PKlSOYe.exe
  2⤵
  PID:7792
- C:\Windows\System\aQfFCQL.exe
  C:\Windows\System\aQfFCQL.exe
  2⤵
  PID:7780
- C:\Windows\System\LxJHTWf.exe
  C:\Windows\System\LxJHTWf.exe
  2⤵
  PID:7844
- C:\Windows\System\mRsNBbH.exe
  C:\Windows\System\mRsNBbH.exe
  2⤵
  PID:7868
- C:\Windows\System\lRBpuoZ.exe
  C:\Windows\System\lRBpuoZ.exe
  2⤵
  PID:7936
- C:\Windows\System\VddvZss.exe
  C:\Windows\System\VddvZss.exe
  2⤵
  PID:7952
- C:\Windows\System\aflJZOg.exe
  C:\Windows\System\aflJZOg.exe
  2⤵
  PID:7880
- C:\Windows\System\QITIFQP.exe
  C:\Windows\System\QITIFQP.exe
  2⤵
  PID:8032
- C:\Windows\System\STDZoKd.exe
  C:\Windows\System\STDZoKd.exe
  2⤵
  PID:8100
- C:\Windows\System\yfYaCbK.exe
  C:\Windows\System\yfYaCbK.exe
  2⤵
  PID:8132
- C:\Windows\System\QaOwfTX.exe
  C:\Windows\System\QaOwfTX.exe
  2⤵
  PID:8148
- C:\Windows\System\VwWlvGD.exe
  C:\Windows\System\VwWlvGD.exe
  2⤵
  PID:7104
- C:\Windows\System\kYrAMPd.exe
  C:\Windows\System\kYrAMPd.exe
  2⤵
  PID:7252
- C:\Windows\System\yfgfHYN.exe
  C:\Windows\System\yfgfHYN.exe
  2⤵
  PID:8112
- C:\Windows\System\IVpnosn.exe
  C:\Windows\System\IVpnosn.exe
  2⤵
  PID:7460
- C:\Windows\System\VnfhxgI.exe
  C:\Windows\System\VnfhxgI.exe
  2⤵
  PID:6636
- C:\Windows\System\LdNjtod.exe
  C:\Windows\System\LdNjtod.exe
  2⤵
  PID:7636
- C:\Windows\System\zHCRlQZ.exe
  C:\Windows\System\zHCRlQZ.exe
  2⤵
  PID:7564
- C:\Windows\System\vKhCvxf.exe
  C:\Windows\System\vKhCvxf.exe
  2⤵
  PID:7304
- C:\Windows\System\GiIzhrU.exe
  C:\Windows\System\GiIzhrU.exe
  2⤵
  PID:7268
- C:\Windows\System\XRUQMTS.exe
  C:\Windows\System\XRUQMTS.exe
  2⤵
  PID:7608
- C:\Windows\System\mtBLcMH.exe
  C:\Windows\System\mtBLcMH.exe
  2⤵
  PID:7480
- C:\Windows\System\ihOxcQE.exe
  C:\Windows\System\ihOxcQE.exe
  2⤵
  PID:7696
- C:\Windows\System\KftTRkY.exe
  C:\Windows\System\KftTRkY.exe
  2⤵
  PID:7684
- C:\Windows\System\iMIaVZA.exe
  C:\Windows\System\iMIaVZA.exe
  2⤵
  PID:7668
- C:\Windows\System\ThZDxyc.exe
  C:\Windows\System\ThZDxyc.exe
  2⤵
  PID:7812
- C:\Windows\System\JIpklne.exe
  C:\Windows\System\JIpklne.exe
  2⤵
  PID:7932
- C:\Windows\System\YHgqXrb.exe
  C:\Windows\System\YHgqXrb.exe
  2⤵
  PID:8060
- C:\Windows\System\naKJmRE.exe
  C:\Windows\System\naKJmRE.exe
  2⤵
  PID:8012
- C:\Windows\System\kMurQNy.exe
  C:\Windows\System\kMurQNy.exe
  2⤵
  PID:7920
- C:\Windows\System\nmdjLwR.exe
  C:\Windows\System\nmdjLwR.exe
  2⤵
  PID:8080
- C:\Windows\System\ugLqLGr.exe
  C:\Windows\System\ugLqLGr.exe
  2⤵
  PID:8028
- C:\Windows\System\GivSTcf.exe
  C:\Windows\System\GivSTcf.exe
  2⤵
  PID:7192
- C:\Windows\System\LYfyZCA.exe
  C:\Windows\System\LYfyZCA.exe
  2⤵
  PID:7544
- C:\Windows\System\lDoipqn.exe
  C:\Windows\System\lDoipqn.exe
  2⤵
  PID:7340
- C:\Windows\System\ihyWuQC.exe
  C:\Windows\System\ihyWuQC.exe
  2⤵
  PID:7716
- C:\Windows\System\IgOLYgY.exe
  C:\Windows\System\IgOLYgY.exe
  2⤵
  PID:8076
- C:\Windows\System\gRDHFqh.exe
  C:\Windows\System\gRDHFqh.exe
  2⤵
  PID:7748
- C:\Windows\System\IdmAgMD.exe
  C:\Windows\System\IdmAgMD.exe
  2⤵
  PID:7760
- C:\Windows\System\QkFaoPW.exe
  C:\Windows\System\QkFaoPW.exe
  2⤵
  PID:7476
- C:\Windows\System\cfLrQbt.exe
  C:\Windows\System\cfLrQbt.exe
  2⤵
  PID:7864
- C:\Windows\System\LpqHNKe.exe
  C:\Windows\System\LpqHNKe.exe
  2⤵
  PID:8000
- C:\Windows\System\TSiAxlx.exe
  C:\Windows\System\TSiAxlx.exe
  2⤵
  PID:7680
- C:\Windows\System\VRTDgyj.exe
  C:\Windows\System\VRTDgyj.exe
  2⤵
  PID:8164
- C:\Windows\System\mYHwFmB.exe
  C:\Windows\System\mYHwFmB.exe
  2⤵
  PID:6180
- C:\Windows\System\PeogLhr.exe
  C:\Windows\System\PeogLhr.exe
  2⤵
  PID:8208
- C:\Windows\System\ShAnAml.exe
  C:\Windows\System\ShAnAml.exe
  2⤵
  PID:8228
- C:\Windows\System\hvYyPUt.exe
  C:\Windows\System\hvYyPUt.exe
  2⤵
  PID:8244
- C:\Windows\System\taWMzix.exe
  C:\Windows\System\taWMzix.exe
  2⤵
  PID:8260
- C:\Windows\System\WNadrwV.exe
  C:\Windows\System\WNadrwV.exe
  2⤵
  PID:8276
- C:\Windows\System\JJJdXqg.exe
  C:\Windows\System\JJJdXqg.exe
  2⤵
  PID:8292
- C:\Windows\System\XxtMcgA.exe
  C:\Windows\System\XxtMcgA.exe
  2⤵
  PID:8308
- C:\Windows\System\uxGhOfr.exe
  C:\Windows\System\uxGhOfr.exe
  2⤵
  PID:8324
- C:\Windows\System\iYdOGRU.exe
  C:\Windows\System\iYdOGRU.exe
  2⤵
  PID:8344
- C:\Windows\System\FZmAmAd.exe
  C:\Windows\System\FZmAmAd.exe
  2⤵
  PID:8360
- C:\Windows\System\cRMbweU.exe
  C:\Windows\System\cRMbweU.exe
  2⤵
  PID:8376
- C:\Windows\System\uyeqDXB.exe
  C:\Windows\System\uyeqDXB.exe
  2⤵
  PID:8392
- C:\Windows\System\DMdTBBK.exe
  C:\Windows\System\DMdTBBK.exe
  2⤵
  PID:8408
- C:\Windows\System\uUCUmdx.exe
  C:\Windows\System\uUCUmdx.exe
  2⤵
  PID:8424
- C:\Windows\System\UXxwqBN.exe
  C:\Windows\System\UXxwqBN.exe
  2⤵
  PID:8440
- C:\Windows\System\FFkkrqx.exe
  C:\Windows\System\FFkkrqx.exe
  2⤵
  PID:8456
- C:\Windows\System\VDCQief.exe
  C:\Windows\System\VDCQief.exe
  2⤵
  PID:8472
- C:\Windows\System\wJJKjVT.exe
  C:\Windows\System\wJJKjVT.exe
  2⤵
  PID:8488
- C:\Windows\System\HjAFSps.exe
  C:\Windows\System\HjAFSps.exe
  2⤵
  PID:8504
- C:\Windows\System\SkvHELy.exe
  C:\Windows\System\SkvHELy.exe
  2⤵
  PID:8520
- C:\Windows\System\vOHHqqo.exe
  C:\Windows\System\vOHHqqo.exe
  2⤵
  PID:8536
- C:\Windows\System\dUKjMNG.exe
  C:\Windows\System\dUKjMNG.exe
  2⤵
  PID:8552
- C:\Windows\System\EJmqDhI.exe
  C:\Windows\System\EJmqDhI.exe
  2⤵
  PID:8572
- C:\Windows\System\tfKVepI.exe
  C:\Windows\System\tfKVepI.exe
  2⤵
  PID:8632
- C:\Windows\System\ommDIFp.exe
  C:\Windows\System\ommDIFp.exe
  2⤵
  PID:8648
- C:\Windows\System\VgvTJfv.exe
  C:\Windows\System\VgvTJfv.exe
  2⤵
  PID:8664
- C:\Windows\System\lkUkSpU.exe
  C:\Windows\System\lkUkSpU.exe
  2⤵
  PID:8680
- C:\Windows\System\PFarbdJ.exe
  C:\Windows\System\PFarbdJ.exe
  2⤵
  PID:8696
- C:\Windows\System\lICUhtr.exe
  C:\Windows\System\lICUhtr.exe
  2⤵
  PID:8712
- C:\Windows\System\KiObCAd.exe
  C:\Windows\System\KiObCAd.exe
  2⤵
  PID:8728
- C:\Windows\System\grIxXMr.exe
  C:\Windows\System\grIxXMr.exe
  2⤵
  PID:8744
- C:\Windows\System\mQKOmlt.exe
  C:\Windows\System\mQKOmlt.exe
  2⤵
  PID:8760
- C:\Windows\System\ALnQpZP.exe
  C:\Windows\System\ALnQpZP.exe
  2⤵
  PID:8776
- C:\Windows\System\fLGHeaU.exe
  C:\Windows\System\fLGHeaU.exe
  2⤵
  PID:8792
- C:\Windows\System\jWnfxLT.exe
  C:\Windows\System\jWnfxLT.exe
  2⤵
  PID:8808
- C:\Windows\System\bUcUzck.exe
  C:\Windows\System\bUcUzck.exe
  2⤵
  PID:8824
- C:\Windows\System\vxMnpXW.exe
  C:\Windows\System\vxMnpXW.exe
  2⤵
  PID:8844
- C:\Windows\System\FEKJeEp.exe
  C:\Windows\System\FEKJeEp.exe
  2⤵
  PID:8860
- C:\Windows\System\bddHcSu.exe
  C:\Windows\System\bddHcSu.exe
  2⤵
  PID:8876
- C:\Windows\System\NHeTnrK.exe
  C:\Windows\System\NHeTnrK.exe
  2⤵
  PID:8892
- C:\Windows\System\MhmeFNC.exe
  C:\Windows\System\MhmeFNC.exe
  2⤵
  PID:8908
- C:\Windows\System\lfTsvbF.exe
  C:\Windows\System\lfTsvbF.exe
  2⤵
  PID:8924
- C:\Windows\System\FeEUcDW.exe
  C:\Windows\System\FeEUcDW.exe
  2⤵
  PID:8940
- C:\Windows\System\AuXrGYD.exe
  C:\Windows\System\AuXrGYD.exe
  2⤵
  PID:8956
- C:\Windows\System\gRBoscu.exe
  C:\Windows\System\gRBoscu.exe
  2⤵
  PID:8972
- C:\Windows\System\opiQPGU.exe
  C:\Windows\System\opiQPGU.exe
  2⤵
  PID:8988
- C:\Windows\System\dUOTtfW.exe
  C:\Windows\System\dUOTtfW.exe
  2⤵
  PID:9008
- C:\Windows\System\uVKhvuo.exe
  C:\Windows\System\uVKhvuo.exe
  2⤵
  PID:9024
- C:\Windows\System\QvfNngY.exe
  C:\Windows\System\QvfNngY.exe
  2⤵
  PID:9040
- C:\Windows\System\CzfYgFx.exe
  C:\Windows\System\CzfYgFx.exe
  2⤵
  PID:9056
- C:\Windows\System\buxjkwM.exe
  C:\Windows\System\buxjkwM.exe
  2⤵
  PID:9072
- C:\Windows\System\ccBVmkl.exe
  C:\Windows\System\ccBVmkl.exe
  2⤵
  PID:9088
- C:\Windows\System\PoSWFsV.exe
  C:\Windows\System\PoSWFsV.exe
  2⤵
  PID:9104
- C:\Windows\System\wHsOZcG.exe
  C:\Windows\System\wHsOZcG.exe
  2⤵
  PID:9120
- C:\Windows\System\nXoglar.exe
  C:\Windows\System\nXoglar.exe
  2⤵
  PID:9136
- C:\Windows\System\tnADhea.exe
  C:\Windows\System\tnADhea.exe
  2⤵
  PID:9152
- C:\Windows\System\rCmCpwk.exe
  C:\Windows\System\rCmCpwk.exe
  2⤵
  PID:9168
- C:\Windows\System\xbxObjQ.exe
  C:\Windows\System\xbxObjQ.exe
  2⤵
  PID:9184
- C:\Windows\System\gGMyofC.exe
  C:\Windows\System\gGMyofC.exe
  2⤵
  PID:9200
- C:\Windows\System\bzVuJhI.exe
  C:\Windows\System\bzVuJhI.exe
  2⤵
  PID:7764
- C:\Windows\System\nflMZSC.exe
  C:\Windows\System\nflMZSC.exe
  2⤵
  PID:8216
- C:\Windows\System\FqmmRLw.exe
  C:\Windows\System\FqmmRLw.exe
  2⤵
  PID:8220
- C:\Windows\System\sdTKayi.exe
  C:\Windows\System\sdTKayi.exe
  2⤵
  PID:8284
- C:\Windows\System\rwmTIpm.exe
  C:\Windows\System\rwmTIpm.exe
  2⤵
  PID:7288
- C:\Windows\System\HgJqNow.exe
  C:\Windows\System\HgJqNow.exe
  2⤵
  PID:8320
- C:\Windows\System\DvMUCQm.exe
  C:\Windows\System\DvMUCQm.exe
  2⤵
  PID:8356
- C:\Windows\System\cuUnrYC.exe
  C:\Windows\System\cuUnrYC.exe
  2⤵
  PID:8416
- C:\Windows\System\dFSTuTC.exe
  C:\Windows\System\dFSTuTC.exe
  2⤵
  PID:8480
- C:\Windows\System\NRYscXw.exe
  C:\Windows\System\NRYscXw.exe
  2⤵
  PID:8548
- C:\Windows\System\RxRkdIN.exe
  C:\Windows\System\RxRkdIN.exe
  2⤵
  PID:8600
- C:\Windows\System\fPlWHnv.exe
  C:\Windows\System\fPlWHnv.exe
  2⤵
  PID:8612
- C:\Windows\System\ooHvUqp.exe
  C:\Windows\System\ooHvUqp.exe
  2⤵
  PID:8584
- C:\Windows\System\ATGjIiF.exe
  C:\Windows\System\ATGjIiF.exe
  2⤵
  PID:8692
- C:\Windows\System\VkxzfRM.exe
  C:\Windows\System\VkxzfRM.exe
  2⤵
  PID:8752
- C:\Windows\System\NhmPRYN.exe
  C:\Windows\System\NhmPRYN.exe
  2⤵
  PID:8816
- C:\Windows\System\xNvXnRv.exe
  C:\Windows\System\xNvXnRv.exe
  2⤵
  PID:8852
- C:\Windows\System\hpBaRZu.exe
  C:\Windows\System\hpBaRZu.exe
  2⤵
  PID:8948
- C:\Windows\System\ZdElJcH.exe
  C:\Windows\System\ZdElJcH.exe
  2⤵
  PID:8204
- C:\Windows\System\voYMKLG.exe
  C:\Windows\System\voYMKLG.exe
  2⤵
  PID:8240
- C:\Windows\System\HLDhlsV.exe
  C:\Windows\System\HLDhlsV.exe
  2⤵
  PID:8300
- C:\Windows\System\TLmzwAV.exe
  C:\Windows\System\TLmzwAV.exe
  2⤵
  PID:8372
- C:\Windows\System\aZHtASk.exe
  C:\Windows\System\aZHtASk.exe
  2⤵
  PID:8432
- C:\Windows\System\MMrQQoW.exe
  C:\Windows\System\MMrQQoW.exe
  2⤵
  PID:8528
- C:\Windows\System\VCewpbw.exe
  C:\Windows\System\VCewpbw.exe
  2⤵
  PID:8564
- C:\Windows\System\fxecqYJ.exe
  C:\Windows\System\fxecqYJ.exe
  2⤵
  PID:8640
- C:\Windows\System\uOkzDOo.exe
  C:\Windows\System\uOkzDOo.exe
  2⤵
  PID:8868
- C:\Windows\System\glrRCTT.exe
  C:\Windows\System\glrRCTT.exe
  2⤵
  PID:8676
- C:\Windows\System\QUGYFhE.exe
  C:\Windows\System\QUGYFhE.exe
  2⤵
  PID:8740
- C:\Windows\System\TqpMNXp.exe
  C:\Windows\System\TqpMNXp.exe
  2⤵
  PID:8832
- C:\Windows\System\WmPpOTO.exe
  C:\Windows\System\WmPpOTO.exe
  2⤵
  PID:8932
- C:\Windows\System\rNCIGXo.exe
  C:\Windows\System\rNCIGXo.exe
  2⤵
  PID:8964
- C:\Windows\System\NixtPeE.exe
  C:\Windows\System\NixtPeE.exe
  2⤵
  PID:9048
- C:\Windows\System\OaaQXbi.exe
  C:\Windows\System\OaaQXbi.exe
  2⤵
  PID:9112
- C:\Windows\System\FuuDrCV.exe
  C:\Windows\System\FuuDrCV.exe
  2⤵
  PID:9176
- C:\Windows\System\kQRvfuN.exe
  C:\Windows\System\kQRvfuN.exe
  2⤵
  PID:9208
- C:\Windows\System\CagrJAX.exe
  C:\Windows\System\CagrJAX.exe
  2⤵
  PID:9096
- C:\Windows\System\xfrSuzr.exe
  C:\Windows\System\xfrSuzr.exe
  2⤵
  PID:9128
- C:\Windows\System\vcqFjgT.exe
  C:\Windows\System\vcqFjgT.exe
  2⤵
  PID:9164
- C:\Windows\System\iYQvvHB.exe
  C:\Windows\System\iYQvvHB.exe
  2⤵
  PID:7888
- C:\Windows\System\fTlNvir.exe
  C:\Windows\System\fTlNvir.exe
  2⤵
  PID:8256
- C:\Windows\System\BMOomOB.exe
  C:\Windows\System\BMOomOB.exe
  2⤵
  PID:8452
- C:\Windows\System\OPdcsFW.exe
  C:\Windows\System\OPdcsFW.exe
  2⤵
  PID:8592
- C:\Windows\System\inYdUlu.exe
  C:\Windows\System\inYdUlu.exe
  2⤵
  PID:8720
- C:\Windows\System\sfcRrLC.exe
  C:\Windows\System\sfcRrLC.exe
  2⤵
  PID:7852
- C:\Windows\System\ywMFzas.exe
  C:\Windows\System\ywMFzas.exe
  2⤵
  PID:8400
- C:\Windows\System\yUYiBJm.exe
  C:\Windows\System\yUYiBJm.exe
  2⤵
  PID:8688
- C:\Windows\System\NYkNAAi.exe
  C:\Windows\System\NYkNAAi.exe
  2⤵
  PID:8608
- C:\Windows\System\GkfFhtB.exe
  C:\Windows\System\GkfFhtB.exe
  2⤵
  PID:8736
- C:\Windows\System\yjTLmNN.exe
  C:\Windows\System\yjTLmNN.exe
  2⤵
  PID:8236
- C:\Windows\System\LasgIGs.exe
  C:\Windows\System\LasgIGs.exe
  2⤵
  PID:8904
- C:\Windows\System\defKmDZ.exe
  C:\Windows\System\defKmDZ.exe
  2⤵
  PID:8500
- C:\Windows\System\vqJHJnV.exe
  C:\Windows\System\vqJHJnV.exe
  2⤵
  PID:8900
- C:\Windows\System\IIhZlVp.exe
  C:\Windows\System\IIhZlVp.exe
  2⤵
  PID:9000
- C:\Windows\System\wCwAcOH.exe
  C:\Windows\System\wCwAcOH.exe
  2⤵
  PID:9020
- C:\Windows\System\FPhZrsD.exe
  C:\Windows\System\FPhZrsD.exe
  2⤵
  PID:9032
- C:\Windows\System\nJpoUtZ.exe
  C:\Windows\System\nJpoUtZ.exe
  2⤵
  PID:9160
- C:\Windows\System\KadUFGr.exe
  C:\Windows\System\KadUFGr.exe
  2⤵
  PID:6456
- C:\Windows\System\bnczXbw.exe
  C:\Windows\System\bnczXbw.exe
  2⤵
  PID:7824
- C:\Windows\System\CLUkLrW.exe
  C:\Windows\System\CLUkLrW.exe
  2⤵
  PID:8448
- C:\Windows\System\swOxCQo.exe
  C:\Windows\System\swOxCQo.exe
  2⤵
  PID:8332
- C:\Windows\System\DOpVfTq.exe
  C:\Windows\System\DOpVfTq.exe
  2⤵
  PID:8704
- C:\Windows\System\zmrPOdC.exe
  C:\Windows\System\zmrPOdC.exe
  2⤵
  PID:8840
- C:\Windows\System\bZZmTxh.exe
  C:\Windows\System\bZZmTxh.exe
  2⤵
  PID:8872
- C:\Windows\System\nmDRBIr.exe
  C:\Windows\System\nmDRBIr.exe
  2⤵
  PID:8968
- C:\Windows\System\FqWsqJb.exe
  C:\Windows\System\FqWsqJb.exe
  2⤵
  PID:7632
- C:\Windows\System\QmTsfGq.exe
  C:\Windows\System\QmTsfGq.exe
  2⤵
  PID:8560
- C:\Windows\System\yTtgkGy.exe
  C:\Windows\System\yTtgkGy.exe
  2⤵
  PID:7652
- C:\Windows\System\qtnhPjo.exe
  C:\Windows\System\qtnhPjo.exe
  2⤵
  PID:8856
- C:\Windows\System\vSbppps.exe
  C:\Windows\System\vSbppps.exe
  2⤵
  PID:8800
- C:\Windows\System\HmkHbyB.exe
  C:\Windows\System\HmkHbyB.exe
  2⤵
  PID:8268
- C:\Windows\System\ioZoilR.exe
  C:\Windows\System\ioZoilR.exe
  2⤵
  PID:9232
- C:\Windows\System\tMzLDGe.exe
  C:\Windows\System\tMzLDGe.exe
  2⤵
  PID:9248
- C:\Windows\System\ifFONSP.exe
  C:\Windows\System\ifFONSP.exe
  2⤵
  PID:9264
- C:\Windows\System\UlGQCoi.exe
  C:\Windows\System\UlGQCoi.exe
  2⤵
  PID:9280
- C:\Windows\System\AXEqztH.exe
  C:\Windows\System\AXEqztH.exe
  2⤵
  PID:9296
- C:\Windows\System\pgyUlnY.exe
  C:\Windows\System\pgyUlnY.exe
  2⤵
  PID:9312
- C:\Windows\System\GSxwDVM.exe
  C:\Windows\System\GSxwDVM.exe
  2⤵
  PID:9328
- C:\Windows\System\TdbIXZo.exe
  C:\Windows\System\TdbIXZo.exe
  2⤵
  PID:9344
- C:\Windows\System\XyJVUcB.exe
  C:\Windows\System\XyJVUcB.exe
  2⤵
  PID:9360
- C:\Windows\System\JFmhltF.exe
  C:\Windows\System\JFmhltF.exe
  2⤵
  PID:9376
- C:\Windows\System\xopVCsf.exe
  C:\Windows\System\xopVCsf.exe
  2⤵
  PID:9392
- C:\Windows\System\AxbHbxV.exe
  C:\Windows\System\AxbHbxV.exe
  2⤵
  PID:9408
- C:\Windows\System\gjSGqZY.exe
  C:\Windows\System\gjSGqZY.exe
  2⤵
  PID:9424
- C:\Windows\System\SaOtDhj.exe
  C:\Windows\System\SaOtDhj.exe
  2⤵
  PID:9440
- C:\Windows\System\tPumtrp.exe
  C:\Windows\System\tPumtrp.exe
  2⤵
  PID:9456
- C:\Windows\System\LCDmdzy.exe
  C:\Windows\System\LCDmdzy.exe
  2⤵
  PID:9472
- C:\Windows\System\KpcoExr.exe
  C:\Windows\System\KpcoExr.exe
  2⤵
  PID:9488
- C:\Windows\System\ADGKcdq.exe
  C:\Windows\System\ADGKcdq.exe
  2⤵
  PID:9504
- C:\Windows\System\tZokOmU.exe
  C:\Windows\System\tZokOmU.exe
  2⤵
  PID:9520
- C:\Windows\System\wkEUZoK.exe
  C:\Windows\System\wkEUZoK.exe
  2⤵
  PID:9536
- C:\Windows\System\aUXGlEe.exe
  C:\Windows\System\aUXGlEe.exe
  2⤵
  PID:9552
- C:\Windows\System\gpJeVUK.exe
  C:\Windows\System\gpJeVUK.exe
  2⤵
  PID:9568
- C:\Windows\System\KiFtYrV.exe
  C:\Windows\System\KiFtYrV.exe
  2⤵
  PID:9584
- C:\Windows\System\uDKIDfm.exe
  C:\Windows\System\uDKIDfm.exe
  2⤵
  PID:9600
- C:\Windows\System\dtlUofi.exe
  C:\Windows\System\dtlUofi.exe
  2⤵
  PID:9616
- C:\Windows\System\LcTUCMG.exe
  C:\Windows\System\LcTUCMG.exe
  2⤵
  PID:9632
- C:\Windows\System\ZyOfeMN.exe
  C:\Windows\System\ZyOfeMN.exe
  2⤵
  PID:9648
- C:\Windows\System\jdRjKrJ.exe
  C:\Windows\System\jdRjKrJ.exe
  2⤵
  PID:9664
- C:\Windows\System\WvhFDDE.exe
  C:\Windows\System\WvhFDDE.exe
  2⤵
  PID:9680
- C:\Windows\System\YypSseK.exe
  C:\Windows\System\YypSseK.exe
  2⤵
  PID:9696
- C:\Windows\System\vjDpSvb.exe
  C:\Windows\System\vjDpSvb.exe
  2⤵
  PID:9712
- C:\Windows\System\WFRGlOO.exe
  C:\Windows\System\WFRGlOO.exe
  2⤵
  PID:9728
- C:\Windows\System\EadvWRG.exe
  C:\Windows\System\EadvWRG.exe
  2⤵
  PID:9744
- C:\Windows\System\LlWzZiN.exe
  C:\Windows\System\LlWzZiN.exe
  2⤵
  PID:9760
- C:\Windows\System\xZjfbNx.exe
  C:\Windows\System\xZjfbNx.exe
  2⤵
  PID:9776
- C:\Windows\System\YIMcYgq.exe
  C:\Windows\System\YIMcYgq.exe
  2⤵
  PID:9792
- C:\Windows\System\HWDqkve.exe
  C:\Windows\System\HWDqkve.exe
  2⤵
  PID:9808
- C:\Windows\System\uEkxDTQ.exe
  C:\Windows\System\uEkxDTQ.exe
  2⤵
  PID:9824
- C:\Windows\System\sTkYMed.exe
  C:\Windows\System\sTkYMed.exe
  2⤵
  PID:9840
- C:\Windows\System\FJnvcHR.exe
  C:\Windows\System\FJnvcHR.exe
  2⤵
  PID:9856
- C:\Windows\System\tuBLqvC.exe
  C:\Windows\System\tuBLqvC.exe
  2⤵
  PID:9872
- C:\Windows\System\vlUkLkO.exe
  C:\Windows\System\vlUkLkO.exe
  2⤵
  PID:9888
- C:\Windows\System\XTwItSg.exe
  C:\Windows\System\XTwItSg.exe
  2⤵
  PID:9904
- C:\Windows\System\LivsXDb.exe
  C:\Windows\System\LivsXDb.exe
  2⤵
  PID:9920
- C:\Windows\System\fWPwcOa.exe
  C:\Windows\System\fWPwcOa.exe
  2⤵
  PID:9936
- C:\Windows\System\xEqkLwv.exe
  C:\Windows\System\xEqkLwv.exe
  2⤵
  PID:9952
- C:\Windows\System\cSQkRPB.exe
  C:\Windows\System\cSQkRPB.exe
  2⤵
  PID:9968
- C:\Windows\System\fCwLFfS.exe
  C:\Windows\System\fCwLFfS.exe
  2⤵
  PID:9984
- C:\Windows\System\TYrXMSq.exe
  C:\Windows\System\TYrXMSq.exe
  2⤵
  PID:10000
- C:\Windows\System\OzOBAAt.exe
  C:\Windows\System\OzOBAAt.exe
  2⤵
  PID:10016
- C:\Windows\System\HlClFAO.exe
  C:\Windows\System\HlClFAO.exe
  2⤵
  PID:10032
- C:\Windows\System\DHawwIN.exe
  C:\Windows\System\DHawwIN.exe
  2⤵
  PID:10048
- C:\Windows\System\IgYLeYK.exe
  C:\Windows\System\IgYLeYK.exe
  2⤵
  PID:10064
- C:\Windows\System\ODiiECU.exe
  C:\Windows\System\ODiiECU.exe
  2⤵
  PID:10080
- C:\Windows\System\SpGRMAD.exe
  C:\Windows\System\SpGRMAD.exe
  2⤵
  PID:10096
- C:\Windows\System\HHoCRbV.exe
  C:\Windows\System\HHoCRbV.exe
  2⤵
  PID:10112
- C:\Windows\System\vzyLEAQ.exe
  C:\Windows\System\vzyLEAQ.exe
  2⤵
  PID:10128
- C:\Windows\System\PhncXZd.exe
  C:\Windows\System\PhncXZd.exe
  2⤵
  PID:10144
- C:\Windows\System\hfIKDYx.exe
  C:\Windows\System\hfIKDYx.exe
  2⤵
  PID:10160
- C:\Windows\System\utuOAMP.exe
  C:\Windows\System\utuOAMP.exe
  2⤵
  PID:10176
- C:\Windows\System\hKrlSyz.exe
  C:\Windows\System\hKrlSyz.exe
  2⤵
  PID:10196
- C:\Windows\System\EvoyqoQ.exe
  C:\Windows\System\EvoyqoQ.exe
  2⤵
  PID:10212
- C:\Windows\System\brfQIwT.exe
  C:\Windows\System\brfQIwT.exe
  2⤵
  PID:10228
- C:\Windows\System\hariZYV.exe
  C:\Windows\System\hariZYV.exe
  2⤵
  PID:8660
- C:\Windows\System\JWYKnUk.exe
  C:\Windows\System\JWYKnUk.exe
  2⤵
  PID:9276
- C:\Windows\System\JudbeWa.exe
  C:\Windows\System\JudbeWa.exe
  2⤵
  PID:9336
- C:\Windows\System\VHyLqEH.exe
  C:\Windows\System\VHyLqEH.exe
  2⤵
  PID:8316
- C:\Windows\System\cAYxxiC.exe
  C:\Windows\System\cAYxxiC.exe
  2⤵
  PID:9340
- C:\Windows\System\chGQzTA.exe
  C:\Windows\System\chGQzTA.exe
  2⤵
  PID:9288
- C:\Windows\System\kiAYrJc.exe
  C:\Windows\System\kiAYrJc.exe
  2⤵
  PID:9368
- C:\Windows\System\JVRillb.exe
  C:\Windows\System\JVRillb.exe
  2⤵
  PID:9400
- C:\Windows\System\DAogMES.exe
  C:\Windows\System\DAogMES.exe
  2⤵
  PID:9432
- C:\Windows\System\dZhDRto.exe
  C:\Windows\System\dZhDRto.exe
  2⤵
  PID:9464
- C:\Windows\System\VzmEaWR.exe
  C:\Windows\System\VzmEaWR.exe
  2⤵
  PID:9496
- C:\Windows\System\akAebXZ.exe
  C:\Windows\System\akAebXZ.exe
  2⤵
  PID:9480
- C:\Windows\System\wubiLoi.exe
  C:\Windows\System\wubiLoi.exe
  2⤵
  PID:9592
- C:\Windows\System\LQUbeKE.exe
  C:\Windows\System\LQUbeKE.exe
  2⤵
  PID:9656
- C:\Windows\System\sDXvNNV.exe
  C:\Windows\System\sDXvNNV.exe
  2⤵
  PID:9720
- C:\Windows\System\DmUTstZ.exe
  C:\Windows\System\DmUTstZ.exe
  2⤵
  PID:9756
- C:\Windows\System\dpDmxPC.exe
  C:\Windows\System\dpDmxPC.exe
  2⤵
  PID:9544
- C:\Windows\System\DiSoLDo.exe
  C:\Windows\System\DiSoLDo.exe
  2⤵
  PID:9736
- C:\Windows\System\jMkEcBo.exe
  C:\Windows\System\jMkEcBo.exe
  2⤵
  PID:9816
- C:\Windows\System\cztnKHI.exe
  C:\Windows\System\cztnKHI.exe
  2⤵
  PID:9644
- C:\Windows\System\BBAuEkD.exe
  C:\Windows\System\BBAuEkD.exe
  2⤵
  PID:9704
- C:\Windows\System\PIiObtW.exe
  C:\Windows\System\PIiObtW.exe
  2⤵
  PID:9880
- C:\Windows\System\iRnipAk.exe
  C:\Windows\System\iRnipAk.exe
  2⤵
  PID:9912
- C:\Windows\System\WprLCNj.exe
  C:\Windows\System\WprLCNj.exe
  2⤵
  PID:9944
- C:\Windows\System\jJFfIzA.exe
  C:\Windows\System\jJFfIzA.exe
  2⤵
  PID:10008
- C:\Windows\System\fxJhrRI.exe
  C:\Windows\System\fxJhrRI.exe
  2⤵
  PID:10040
- C:\Windows\System\ZoRgTQz.exe
  C:\Windows\System\ZoRgTQz.exe
  2⤵
  PID:9992
- C:\Windows\System\PEMlJle.exe
  C:\Windows\System\PEMlJle.exe
  2⤵
  PID:9960
- C:\Windows\System\RVAEwVo.exe
  C:\Windows\System\RVAEwVo.exe
  2⤵
  PID:10056
- C:\Windows\System\HrUQfJz.exe
  C:\Windows\System\HrUQfJz.exe
  2⤵
  PID:10108
- C:\Windows\System\QgdovnS.exe
  C:\Windows\System\QgdovnS.exe
  2⤵
  PID:10088
- C:\Windows\System\iyBhTld.exe
  C:\Windows\System\iyBhTld.exe
  2⤵
  PID:10124
- C:\Windows\System\jZIqrnv.exe
  C:\Windows\System\jZIqrnv.exe
  2⤵
  PID:10204
- C:\Windows\System\XnEbQBu.exe
  C:\Windows\System\XnEbQBu.exe
  2⤵
  PID:10220
- C:\Windows\System\LrRyWTa.exe
  C:\Windows\System\LrRyWTa.exe
  2⤵
  PID:9308
- C:\Windows\System\DsyqkTK.exe
  C:\Windows\System\DsyqkTK.exe
  2⤵
  PID:9320
- C:\Windows\System\xudlWUS.exe
  C:\Windows\System\xudlWUS.exe
  2⤵
  PID:9448
- C:\Windows\System\eqhanFk.exe
  C:\Windows\System\eqhanFk.exe
  2⤵
  PID:9564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ABcZoZg.exe

Filesize
2.1MB

MD5
fb4ac1d61b1f7f97957d5dd7fd621a45

SHA1
8a340d03f1c572002c28e1e85ce3a756e55c0b78

SHA256
cbce558d88a89b9e61b71c7a6b2b9eeb2f915d24eca13e1ebba9e05d00e310aa

SHA512
724aa935a142420d84456a6309b6a724d13f44dddf2c31f829839db44282783929c4d1b1f0022aa9f093277c9d8d22c23d737a84ea7a5a1c1da6baf31b4df157

Download Submit
C:\Windows\system\CVUvgZE.exe

Filesize
2.1MB

MD5
a34b07844e36ce804032a4532d60eebf

SHA1
820d13c2233de9f673410a170b510ded02925d47

SHA256
caaee32eb25db7aec510925761d5e67fbd58bf543e72cd12e31aa5771ccb69d0

SHA512
87f76b093d60da2fc56e915473f90faa2d5a4bfd6c7b6fb67b9fbf172bcd594ee3ecf03704a06a916c742369e0d2bcae441fbebdf7f88b640bb5f4264a72b242

Download Submit
C:\Windows\system\FGNbDff.exe

Filesize
2.1MB

MD5
95cf9227810ce7bee28a33076ca050bc

SHA1
d6be7f529ad9ebae632f31739645efa14ab52855

SHA256
d6a6a4dcb2506d97fde78942d326b0d143617a2f1e0f85c58cf10d85b7506f93

SHA512
8531dc7371c4eddd22c48e8ce7faa490dfed21e9f6f35f20a7414c55584c99f9209b6c933de724829e18e126575904a69b76951d5ed93500aaaa922c2e3ac0df

Download Submit
C:\Windows\system\FxZLRWj.exe

Filesize
2.1MB

MD5
ca1d65214cdb73059e47e9427b496df5

SHA1
8fa7f372f1c2f4d6a45cfe28f7409d4a8d2ba20b

SHA256
a547858486a8fbf9750436cc150444b1d739890034f903ca73be47499c09cd57

SHA512
37318d4ed17da28ddd049b23718ead388790fde40d6322da04d2a359ce89b673080a967d9eea69b39316738ff1b79cb2add7ee6fcb8632e7175c8f198016548e

Download Submit
C:\Windows\system\HhFnaxD.exe

Filesize
2.1MB

MD5
6403179251b83cfb9d85cddb5dc3d5f2

SHA1
2018bdfa1fbc502a3bdd7d29556506665e1a053d

SHA256
8b20a66d904e35305bcc2d5fef81441b7c38f2c159bfb6ab6a01fcca74d47f4f

SHA512
26c875b1af38ecf32a115ee8d531535a6e35a919aed619fa25a90d4230b895d64e35a26e7b0a3159963b5943c359b1b9fb4b96075053d1a9bde5e233215e4998

Download Submit
C:\Windows\system\JSmpugA.exe

Filesize
2.1MB

MD5
7a2eb93919859901d644f9dc984f56e3

SHA1
d61b72fa06ece6d0ccefbb347c60d7a1ceb20ac1

SHA256
e0a062861b3e977c3578366b3cca0ff07d32e23d0b77f9ee3d938de6e08f91fc

SHA512
1cf09ced422faf1004356e314866193de97b8222294d85354bcd1dcf2d908f5f4f22b43f00233248d4fd298afcc9a7064b02fcc1c1d340c72fff4107985f66c6

Download Submit
C:\Windows\system\LgSHtmL.exe

Filesize
2.1MB

MD5
d4d4bdbf8a33ef582f8c406993fe4a53

SHA1
dcf8f4b718f046c3539d5508a7be8467fe17e318

SHA256
20e72a95cd47beb5363142ce75fadfd3f76187360ddd078f08084998b034d2ba

SHA512
c193592b775e8a3dae42b7a73b29efa6b3761f64a390e4b21adc88fb1e8e7fd9a9b757c743f9db5173a00c4faa0fdc05745f24d87fbf9f816162dc6ca339987d

Download Submit
C:\Windows\system\PSZPKfR.exe

Filesize
2.1MB

MD5
4e411eafca6055d60ac475fb7f10b0ef

SHA1
7c31bc1c07b1cfc7b77dab0b0bc5eb07a946d651

SHA256
6e4ebc1bf65cc85535c94e938048d98aeb76d6970c897b1a75b82c4fc0f7ee7b

SHA512
d20e9bac2faf6e7ef0408ea275a2afb9f7973091218518c94134eeff86c5cc6658a2ad1d1467e69a82a47967c1fee6c06148babf66b47caeeacc0f5371b3eaba

Download Submit
C:\Windows\system\QWpaeLR.exe

Filesize
2.1MB

MD5
a15e7aedde7000fd58d2500b70a976c3

SHA1
8d8868300369fdbcc2332a30e2191bb992830311

SHA256
3bd1b4ab4836c22b895b130e2e8c8567efec495e7816f99b4d413af38e5b0203

SHA512
9ad7801118ae60c20c4d70ec8b0dcfc63270eb606e14b77009761efdad41043a1abdb4bb992ca1fe345cdbc7db539a86ae4f597ae141399ff3d11eaaa12fbf14

Download Submit
C:\Windows\system\RisRnUl.exe

Filesize
2.1MB

MD5
83caf6a40bc331af45f27888c8b408fc

SHA1
e92089fe54b2f926ffcfa22bf9915f402afb1563

SHA256
1b11e47e7b979f67365028398b6d14094ea2f27137ae4cd0ad7313c81ba6b53e

SHA512
1fb320606b5773b98a58c2c0da4026a1b49d87e14f5a9d1ca4636244fd8929bce7e10228f9167b1df0ac60b3b99cd6599487c1dc004b3a3224812a8af302f3f0

Download Submit
C:\Windows\system\SGSCkuZ.exe

Filesize
2.1MB

MD5
c2614118cb7cfd6d96f97bf5e2711de1

SHA1
0bc1c9abe0a44f2a06521642947fad9d95cfb615

SHA256
2c9bda14ba314ebf0c4816e6e2508b04d29555ff3dc9ed3acbe65c229ecb0339

SHA512
4fe406708e0dd92e429c72a5b3d3d37e50d2b1e01ca8740739f984bf52a62cd292d43489b106954405fee174940a7aae4546fd11392cfcf9f44432b2990345ea

Download Submit
C:\Windows\system\STIEMKC.exe

Filesize
2.1MB

MD5
e03f17d1ece1800d958d0a50feee7a3e

SHA1
469528c283a8cd474649f07f1d44e876710c82bc

SHA256
779a1509ca4c51f512a8dd4d563714af401bcbfefd147727bc6de3f80c9182a1

SHA512
7d865a092c8d711ca802784512eee8a818a5be1a4482fa43235bc74ab8f24fde383630333f37ff1b55d93d724bf377d011cc401f1c65425560178d8dc743fe52

Download Submit
C:\Windows\system\TaCygZi.exe

Filesize
2.1MB

MD5
fa552555b36a0d6ebdde3270e9923053

SHA1
773fc253e3ce189a4434dab479f6eaa319c12ac4

SHA256
fff77b8592de5f7b8258005f02542e127fc2e4a6929d98ddf48c51f2d8657e45

SHA512
d03d904fc04472d8722dac54cab78a504c8f64d5e90e0f772782ebfe35e598a2d549362dfe364cac465f5d555cea77ecf06dcbac18ee06e7b0efaf48098ddcb0

Download Submit
C:\Windows\system\VkGVNrf.exe

Filesize
2.1MB

MD5
d85bb391742e53eed531e26b0b36418c

SHA1
39b01e393a172c3ec9d5025c7de07317d47ad1ce

SHA256
0b27fb17c231166ff70f35adca83ffdf88f09f39ddd2258097b90590275698da

SHA512
8539f3e0aa2fd38b12bc6ec7cdfe5f642324f91a99f321999604b46bbf4e40f5ea03177fbdaa8af27eba7d6fa979b3035e5f9a89b30bea934a1e401f7a6d3efe

Download Submit
C:\Windows\system\ZFYuWtQ.exe

Filesize
2.1MB

MD5
49e44c01cfd09aa533d9d3618dae2856

SHA1
daf805d71198ca15905e4f9575ac3d00950d1801

SHA256
9dce199f12e90faee52bae7e0887cfacb02142c1d4d69c9d7e846dd89a0ff5b4

SHA512
ce51628a00c3d6acb4bf1d1cf9324e6fc191ef1520c67fd61513fb0df54301c7dbe973d2468e7025f7fbe72c745dbfc5410903bd978bb8697ca92f456b8b3de5

Download Submit
C:\Windows\system\aHXeUGZ.exe

Filesize
2.1MB

MD5
1984054cba5a7be43c2464569775daae

SHA1
9566c2c0ff829b6d76178acbb5eba1ba6ef8fa38

SHA256
19cbd0990fa3d20083d24814f402dffb1890f64ea6cff854d970fefdf8464a1c

SHA512
14f08f83b3930a4b87f11ff65e6d6603ba0287046aa881eea127503a3f4b569d3b0fcd5a80ccc441f60cb8d25bf7558206338a3c4271aa137795a247913182a5

Download Submit
C:\Windows\system\eqjDnjc.exe

Filesize
8B

MD5
0a09bd2e5542320a20ec8eafd2246c28

SHA1
7106c9c7587e96586e92363c5ef70ad925a395b7

SHA256
a2d90ea83d8a1ec8d2d933492892f6a19aa1f0a0628b1cc62b162e5271ee863b

SHA512
994b306b70fd71b0a462a50b9fc03457eac19be8a156ca56f4b5a47c058947eb0f9ce4c706b5ff16df4ad9b5c6da35585e95b3f5ce9ff8ead75dc92e4757e9c1

Download Submit
C:\Windows\system\fdevBKB.exe

Filesize
2.1MB

MD5
c4a2cf96a8ef11d872f9775ebb353763

SHA1
f3cf2fb02830bf2814fe100ccc6002c2dd62ac0b

SHA256
2bd3b375c1d5ee185ca3195ce8a6ef72922064964950db5d55b590c8204a13f9

SHA512
dbc3ca266850ef625b925fe5e4ea3e7538708b0aee1d2761cd26f5c0cc2a0d18b3d81cb7d83e43ec2eb66dea4e8998710410baf124a23d9c942331433c61f0a2

Download Submit
C:\Windows\system\fnhvJBt.exe

Filesize
2.1MB

MD5
c7b032877400806ba130be4f4942e359

SHA1
e17f8b092055af52b0e44bcd84cb83613d578f32

SHA256
db516e2b075c6ac2a7233f3eba768fa44a700aa9854ade181396ea8d66ccc38c

SHA512
c7905a31f971b5352e2a19eacc1e8e8dff97aa1236e5617062a9deb08735e9172e2890eb51b3d292c0b4dba4bdf2b12be3ae3036a3c7a31d4a051f9e723c46ac

Download Submit
C:\Windows\system\jadrULX.exe

Filesize
2.1MB

MD5
de7227f0f80725317a72e2858684c307

SHA1
d9af8cf80048fd57840ff687d376e6c5c4f1ab63

SHA256
7bf4e531e241660fd0c90e2d0d7cfa8c6de4930be1be8005822286c599015cf3

SHA512
80ac08b4a8972447e429e1226563014edf77a2f05a4c80eb579f6e59474cb32f45163f374c7e55f65e446f25a13ef44eb9c4b4cce00d3a1d44e65dbc4c376263

Download Submit
C:\Windows\system\jvZPyUO.exe

Filesize
2.1MB

MD5
d1106007a18707299feb65cd991e2060

SHA1
ac50a6725e86559ef6cd838e9af4b0179aaed474

SHA256
03e69b5e2e577b467f786e65be682dbd76972a4fb1cbbca1971441b9811912b7

SHA512
097d2e1357ed1944d2704027046572f4d407d3ce309d09d55aef8c8d01165393fd64a797c1bc6f3bbcc2f8e2abbd32f99f2cf98a5d88cb3d9a38cc82a992e469

Download Submit
C:\Windows\system\kRqrnJb.exe

Filesize
2.1MB

MD5
67e4652413c9dd2b2c7903c3270eb02c

SHA1
a691f6406b509b529b468c322b7530dc850e5b99

SHA256
5305af28088bbcdebd5effcd0deef5f00187ad1703f938fe8f46fb733158730e

SHA512
4112e73bda4b41271932cd789907165c50daddcc39e0d6d6fe8c1d939c798c121270180c7975724a7c769fd5840f35158154ddbda76788047194978d0f86c400

Download Submit
C:\Windows\system\nwhkUSJ.exe

Filesize
2.1MB

MD5
1815322365bc3cb2816a9a9696076855

SHA1
5a5740da91170cf92268425627dd693ab408b491

SHA256
2587a1b02b653bd523e9f56e340917897c91a6f7ecb5bc8da6e9bd01f2addd1f

SHA512
47ab9009458bae8090ccc40a1477a634a7f4f553464c48c1eecb0b445a3bb37ac62bbcd16e1bcce9e1c8f75ef733388a504393f67cb7cb2c2cd242f18fa76e8e

Download Submit
C:\Windows\system\phPkwio.exe

Filesize
2.1MB

MD5
8e1ecc1510079765f896a9f5ec73487f

SHA1
5d71e0bbf6298044aad4a299ffefe237cdc6070f

SHA256
1ba0f148d12ac1b6646d24672459b33c489eab93809e8a985221f44d8075b360

SHA512
dc04356963eb2b9dc0e1852676cacb88341bb4e6526308e0a8733928d353a044bea98165407540d4c05032c9d71ee665ac82bf89b86915bc3229d192fcdd7729

Download Submit
C:\Windows\system\qSCVeOr.exe

Filesize
2.1MB

MD5
f29644e0440ebe4d0ddc74c4e9849883

SHA1
42e755f0d8ecac43932a1b51a2de8178183da774

SHA256
4add8386f8696f686c6614c7c9914b316e176fd45da3d5e42f1d5f5592917eaf

SHA512
a39cc52bb2bc951444fe1b7fe76c2a7449a900be7218f100b24430835ab30179d7b6d73d949e80d65acd97fe14996518bdcbb048a4b88a7cedc077e8ca5ee1bc

Download Submit
C:\Windows\system\qqfAUwH.exe

Filesize
2.1MB

MD5
7f35f977a9ea6b4656cf0c6e3945c4ad

SHA1
b88c4bb320344bb8ccd5456e284ae47bfebcbb4b

SHA256
2e29bec0337977e749ac6a9dcaa2ee74686b80240754c0da07d44313986eff86

SHA512
a5efa9127ab59b011974d46a2b68e8993c0c0d5cfd7f32a28b4dc3065575be55739551da200a8728b8758a269b449a06cfcc67bc8f87fc27beaf0c307222c83b

Download Submit
C:\Windows\system\seFsxBi.exe

Filesize
2.1MB

MD5
eb826da085016f93daf8283e29112915

SHA1
cecc2fcb88426ed866ca6a21b6c9facb59bea127

SHA256
6f00746713b0010e0dea3be9c61d7558e8e8166dbaeb995fe0c35ac82c1ea37d

SHA512
9bfc40b1cf5f1a7b0a6627ecfeade0b76447f419d89c72b080618550f2cdea2d8aac47f080b92d0b47322dfa1408cb948bdcb31c9439bd9d26ce36491c12f725

Download Submit
C:\Windows\system\tjYyTWH.exe

Filesize
2.1MB

MD5
4d6ad96dd9b70fa830d568f784303d37

SHA1
f34862556d222ae84df761c9224918c1d6d851c3

SHA256
e84dd8fb53c594b50667e777ce956599962da91f0b8335f9f9ba6672369942bc

SHA512
2a7471448d9ed5bd85f133378fbae7fa4d5947557b83a4b4c7eff4fbd299dbf0df91292b94381861ba8e401db9fefd8d6d8d3eb4a029fd8f310a46ed06de6934

Download Submit
C:\Windows\system\uzHXufr.exe

Filesize
2.1MB

MD5
509847fccc5e04b1a51c255b85e30f07

SHA1
d2121ed2ad33554c79d586c6b09e555947027da8

SHA256
e39820e71f20ae398a99ab1c1273e94314f7edb38f72dd36b8d7f4882de5fad3

SHA512
84d137214f4980338f4926452be05133bfe9e6658e223f3eaa79092cc47c8a8702e7d79f88c36b31679f53f2159edd4eba3df5720e3cff1c213b3345dbc20eb7

Download Submit
\Windows\system\CInJbKL.exe

Filesize
2.1MB

MD5
cc6f89d5683e65749e50dc2f67344fcc

SHA1
ecb74a37897acad4a862a81a025294c0aa807433

SHA256
41d90966d5cbb084777412ca306b625aa58a07c3a35845f562871746d32165d3

SHA512
9db7240360d34193c76f0daed15127b1ee0983288cf351d5c40c70c9cade7290e86148a9296c9a6f4de2c7c21f41f7c52005fbc9d1eb512c1f0d3f1ea8202e31

Download Submit
\Windows\system\NyKSPge.exe

Filesize
2.1MB

MD5
e59540f0c7ec2948b78a077983002c15

SHA1
3d45f11e18a6e504bab06fa39ac4e0f105097917

SHA256
84da80be3709f32a63e51f81957954d940d9b264cd95e215afd78b2df12453c7

SHA512
81d619bfbaa2bd6427bdec972c7dd2920b034e5e3cf9cd0da64225da9a768ea51e4c31006518fa47584d3a18062e27f181235cb2a904913bddba75de3aac6381

Download Submit
\Windows\system\sZLbQSF.exe

Filesize
2.1MB

MD5
cec9d8e5ef41bcadf6fcc6c9e5c66665

SHA1
83fb5fb0d2fb794c8529587684d58f2ae619af47

SHA256
ca8dd6664b4dfad35907943d797a36d081aeab35ebf9c952159ecf5d290ca692

SHA512
b12f219a330ca0d3f90e395f8c659f2dc4ba53cf45725af380978e4fbe515ccf361e5513cf42f0ce4559447459fddaad90ff82081c2b74d05b8fce90cb40862e

Download Submit
\Windows\system\stItWIE.exe

Filesize
2.1MB

MD5
d2826da69ad888101279c876986b2d34

SHA1
1e867c5a6e63f33fd6a80ecd6e86b71156e0fcc6

SHA256
0498bacd59aaa28b41b219eeba371d3b8059bfeae38c856c5d05361541854100

SHA512
9a3eb082e95ccf959b81d56cab1f98ad8b1889704ae841d4b004d0bc84c3019ad8f2a23d338c4fd268fae3ad271dfb92362e7a2687412eb4a4f9c91fbe8ebfef

Download Submit
\Windows\system\vXmJbLH.exe

Filesize
2.1MB

MD5
b4b96c105fbed02474183a3028f0fb68

SHA1
8bdcf14c2176e8c21546d8de30b7dbf9004d5f1f

SHA256
a76b2928c260cc580fc44b977edd3216e3ab96dbdde9d9685aafe7d2a335052d

SHA512
6c9618feeec30767a62c7503e382e54a02cbbef1b9cb41a9769a2e4db8cbb0bea9df63419f98e13f8a629b7750589456deecbe125be44e7982ca42014dda1a9b

Download Submit
memory/348-39-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/348-4358-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/608-41-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/608-4353-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-46-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1284-4355-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1288-58-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/1288-44-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/1288-34-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1288-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1288-81-0x0000000003380000-0x0000000003772000-memory.dmp

Filesize
3.9MB

Download
memory/1288-85-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/1288-64-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/1288-45-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/1288-90-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1288-37-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/1288-89-0x0000000003380000-0x0000000003772000-memory.dmp

Filesize
3.9MB

Download
memory/1288-0-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/1288-11-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/1288-40-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/1712-91-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1712-4402-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2024-174-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2024-172-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2396-26-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-4362-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2636-63-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2640-4383-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2640-83-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2704-4360-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2704-56-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2748-76-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-4406-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-4366-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2816-57-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2876-53-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2876-4357-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download