xmrig | 06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
Size

3.6MB
MD5

b62db2fad60a697423fe6c95a6404d2c
SHA1

460ef2e4c06328a92c3b1f634e17a493baba594a
SHA256

06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066
SHA512

db3a7cbbe1de6f65ec5a4a96cf976b024e1454ea29646db73c8821bebd9777a8247646cd61ef2c0960cc038238f0b4c107fd199832e28aea99f1964967e99f8f
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWM:7bBeSFkg

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5116-0-0x00007FF70C390000-0x00007FF70C786000-memory.dmp	xmrig
behavioral2/files/0x00080000000234c8-5.dat	xmrig
behavioral2/files/0x00070000000234cc-10.dat	xmrig
behavioral2/files/0x00070000000234cd-16.dat	xmrig
behavioral2/files/0x00070000000234ce-19.dat	xmrig
behavioral2/files/0x00070000000234cf-46.dat	xmrig
behavioral2/files/0x00070000000234d5-57.dat	xmrig
behavioral2/files/0x00080000000234d4-73.dat	xmrig
behavioral2/memory/4488-90-0x00007FF60A8C0000-0x00007FF60ACB6000-memory.dmp	xmrig
behavioral2/memory/4656-96-0x00007FF7E9F10000-0x00007FF7EA306000-memory.dmp	xmrig
behavioral2/memory/3052-97-0x00007FF7D0860000-0x00007FF7D0C56000-memory.dmp	xmrig
behavioral2/files/0x00070000000234da-108.dat	xmrig
behavioral2/files/0x00070000000234e0-123.dat	xmrig
behavioral2/memory/4020-144-0x00007FF6ED350000-0x00007FF6ED746000-memory.dmp	xmrig
behavioral2/files/0x00070000000234e1-159.dat	xmrig
behavioral2/memory/1920-171-0x00007FF7B2F40000-0x00007FF7B3336000-memory.dmp	xmrig
behavioral2/memory/3108-174-0x00007FF6189C0000-0x00007FF618DB6000-memory.dmp	xmrig
behavioral2/memory/1260-173-0x00007FF73F8C0000-0x00007FF73FCB6000-memory.dmp	xmrig
behavioral2/memory/3132-172-0x00007FF6387E0000-0x00007FF638BD6000-memory.dmp	xmrig
behavioral2/memory/3372-170-0x00007FF686810000-0x00007FF686C06000-memory.dmp	xmrig
behavioral2/memory/2992-169-0x00007FF79BFA0000-0x00007FF79C396000-memory.dmp	xmrig
behavioral2/memory/4344-168-0x00007FF676090000-0x00007FF676486000-memory.dmp	xmrig
behavioral2/memory/4312-166-0x00007FF67D7C0000-0x00007FF67DBB6000-memory.dmp	xmrig
behavioral2/memory/668-165-0x00007FF62BA90000-0x00007FF62BE86000-memory.dmp	xmrig
behavioral2/files/0x00070000000234e4-163.dat	xmrig
behavioral2/files/0x00070000000234e3-161.dat	xmrig
behavioral2/memory/2972-158-0x00007FF623F20000-0x00007FF624316000-memory.dmp	xmrig
behavioral2/files/0x00070000000234e2-156.dat	xmrig
behavioral2/memory/1552-155-0x00007FF7D8EB0000-0x00007FF7D92A6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234df-149.dat	xmrig
behavioral2/files/0x00070000000234de-147.dat	xmrig
behavioral2/files/0x00070000000234dc-142.dat	xmrig
behavioral2/files/0x00070000000234db-138.dat	xmrig
behavioral2/files/0x00080000000234c9-135.dat	xmrig
behavioral2/files/0x00070000000234dd-130.dat	xmrig
behavioral2/memory/1256-127-0x00007FF79F910000-0x00007FF79FD06000-memory.dmp	xmrig
behavioral2/memory/2132-119-0x00007FF6109F0000-0x00007FF610DE6000-memory.dmp	xmrig
behavioral2/memory/4464-99-0x00007FF76F590000-0x00007FF76F986000-memory.dmp	xmrig
behavioral2/memory/5104-98-0x00007FF77A180000-0x00007FF77A576000-memory.dmp	xmrig
behavioral2/files/0x00070000000234d9-94.dat	xmrig
behavioral2/files/0x00070000000234d8-92.dat	xmrig
behavioral2/memory/264-91-0x00007FF6157B0000-0x00007FF615BA6000-memory.dmp	xmrig
behavioral2/files/0x00080000000234d3-88.dat	xmrig
behavioral2/files/0x00070000000234d7-86.dat	xmrig
behavioral2/memory/4308-85-0x00007FF7EDB10000-0x00007FF7EDF06000-memory.dmp	xmrig
behavioral2/memory/1868-78-0x00007FF641170000-0x00007FF641566000-memory.dmp	xmrig
behavioral2/files/0x00070000000234d1-74.dat	xmrig
behavioral2/files/0x00070000000234d6-63.dat	xmrig
behavioral2/files/0x00070000000234d0-58.dat	xmrig
behavioral2/files/0x00070000000234d2-67.dat	xmrig
behavioral2/memory/2500-53-0x00007FF740080000-0x00007FF740476000-memory.dmp	xmrig
behavioral2/memory/2988-31-0x00007FF778320000-0x00007FF778716000-memory.dmp	xmrig
behavioral2/files/0x00070000000234e5-326.dat	xmrig
behavioral2/files/0x0007000000023516-330.dat	xmrig
behavioral2/files/0x0007000000023519-343.dat	xmrig
behavioral2/files/0x000700000002351e-350.dat	xmrig
behavioral2/files/0x0007000000023520-353.dat	xmrig
behavioral2/files/0x0007000000023521-361.dat	xmrig
behavioral2/memory/5116-1509-0x00007FF70C390000-0x00007FF70C786000-memory.dmp	xmrig
behavioral2/memory/4020-2160-0x00007FF6ED350000-0x00007FF6ED746000-memory.dmp	xmrig
behavioral2/memory/1256-2158-0x00007FF79F910000-0x00007FF79FD06000-memory.dmp	xmrig
behavioral2/memory/1552-2303-0x00007FF7D8EB0000-0x00007FF7D92A6000-memory.dmp	xmrig
behavioral2/memory/2988-2328-0x00007FF778320000-0x00007FF778716000-memory.dmp	xmrig
behavioral2/memory/4344-2330-0x00007FF676090000-0x00007FF676486000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
8	3204	powershell.exe
10	3204	powershell.exe
12	3204	powershell.exe
13	3204	powershell.exe
15	3204	powershell.exe
25	3204	powershell.exe
27	3204	powershell.exe
29	3204	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3204	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2988	GSQHlLx.exe
4344	qRKkXDO.exe
2500	rOQOVbZ.exe
1868	jWnOjEg.exe
4308	VNRLQiq.exe
4488	Ovagvwx.exe
2992	GVHegka.exe
3372	XFbDiYP.exe
264	fqyJRNP.exe
4656	hxhItDw.exe
3052	GHSkGKx.exe
5104	xJhqmwI.exe
4464	XgtnhsB.exe
1920	njrpXya.exe
2132	HDEfNWm.exe
3132	GiCsnye.exe
1256	eGjwbtr.exe
4020	LUQoDRw.exe
1552	HTFWIyh.exe
1260	dLSkpKl.exe
2972	eadSkMY.exe
668	XYPBRwe.exe
4312	LgKUaDz.exe
3108	hDRCOdW.exe
2236	osXxkgA.exe
2868	OVFFYqh.exe
2908	dLdNPnO.exe
2900	gIxBYJI.exe
2200	xQSWgMO.exe
3348	fMXtnMy.exe
2840	dYYEyTH.exe
3504	CCKElFH.exe
2800	RVdVhqK.exe
3196	zCXkQkS.exe
4676	BxWdVdF.exe
3920	ctcliKd.exe
3876	BZIcIjk.exe
1996	ebLpdWY.exe
1656	jFSMyBG.exe
2864	RIfDcIy.exe
2072	YgbYKIf.exe
1924	vqZApQo.exe
4628	gMsKiNq.exe
3168	bzgQBCS.exe
3800	DfFQGYp.exe
4000	WWNHPgi.exe
3408	fPhkMCz.exe
3384	IjAIWlM.exe
2264	yjnjwOh.exe
3684	SmqOQnK.exe
2700	bpEvXCl.exe
384	HEGcPWI.exe
3908	QeeQuIO.exe
4260	APruQEj.exe
1896	YeWLTfC.exe
4252	bjWEeOc.exe
400	ObDkFLd.exe
4984	FuaiyyD.exe
3828	cowXFwP.exe
3356	LyePpvb.exe
1360	eZHSWsJ.exe
4872	ipmwKYx.exe
3056	KanSXwl.exe
1680	rciGbHJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5116-0-0x00007FF70C390000-0x00007FF70C786000-memory.dmp	upx
behavioral2/files/0x00080000000234c8-5.dat	upx
behavioral2/files/0x00070000000234cc-10.dat	upx
behavioral2/files/0x00070000000234cd-16.dat	upx
behavioral2/files/0x00070000000234ce-19.dat	upx
behavioral2/files/0x00070000000234cf-46.dat	upx
behavioral2/files/0x00070000000234d5-57.dat	upx
behavioral2/files/0x00080000000234d4-73.dat	upx
behavioral2/memory/4488-90-0x00007FF60A8C0000-0x00007FF60ACB6000-memory.dmp	upx
behavioral2/memory/4656-96-0x00007FF7E9F10000-0x00007FF7EA306000-memory.dmp	upx
behavioral2/memory/3052-97-0x00007FF7D0860000-0x00007FF7D0C56000-memory.dmp	upx
behavioral2/files/0x00070000000234da-108.dat	upx
behavioral2/files/0x00070000000234e0-123.dat	upx
behavioral2/memory/4020-144-0x00007FF6ED350000-0x00007FF6ED746000-memory.dmp	upx
behavioral2/files/0x00070000000234e1-159.dat	upx
behavioral2/memory/1920-171-0x00007FF7B2F40000-0x00007FF7B3336000-memory.dmp	upx
behavioral2/memory/3108-174-0x00007FF6189C0000-0x00007FF618DB6000-memory.dmp	upx
behavioral2/memory/1260-173-0x00007FF73F8C0000-0x00007FF73FCB6000-memory.dmp	upx
behavioral2/memory/3132-172-0x00007FF6387E0000-0x00007FF638BD6000-memory.dmp	upx
behavioral2/memory/3372-170-0x00007FF686810000-0x00007FF686C06000-memory.dmp	upx
behavioral2/memory/2992-169-0x00007FF79BFA0000-0x00007FF79C396000-memory.dmp	upx
behavioral2/memory/4344-168-0x00007FF676090000-0x00007FF676486000-memory.dmp	upx
behavioral2/memory/4312-166-0x00007FF67D7C0000-0x00007FF67DBB6000-memory.dmp	upx
behavioral2/memory/668-165-0x00007FF62BA90000-0x00007FF62BE86000-memory.dmp	upx
behavioral2/files/0x00070000000234e4-163.dat	upx
behavioral2/files/0x00070000000234e3-161.dat	upx
behavioral2/memory/2972-158-0x00007FF623F20000-0x00007FF624316000-memory.dmp	upx
behavioral2/files/0x00070000000234e2-156.dat	upx
behavioral2/memory/1552-155-0x00007FF7D8EB0000-0x00007FF7D92A6000-memory.dmp	upx
behavioral2/files/0x00070000000234df-149.dat	upx
behavioral2/files/0x00070000000234de-147.dat	upx
behavioral2/files/0x00070000000234dc-142.dat	upx
behavioral2/files/0x00070000000234db-138.dat	upx
behavioral2/files/0x00080000000234c9-135.dat	upx
behavioral2/files/0x00070000000234dd-130.dat	upx
behavioral2/memory/1256-127-0x00007FF79F910000-0x00007FF79FD06000-memory.dmp	upx
behavioral2/memory/2132-119-0x00007FF6109F0000-0x00007FF610DE6000-memory.dmp	upx
behavioral2/memory/4464-99-0x00007FF76F590000-0x00007FF76F986000-memory.dmp	upx
behavioral2/memory/5104-98-0x00007FF77A180000-0x00007FF77A576000-memory.dmp	upx
behavioral2/files/0x00070000000234d9-94.dat	upx
behavioral2/files/0x00070000000234d8-92.dat	upx
behavioral2/memory/264-91-0x00007FF6157B0000-0x00007FF615BA6000-memory.dmp	upx
behavioral2/files/0x00080000000234d3-88.dat	upx
behavioral2/files/0x00070000000234d7-86.dat	upx
behavioral2/memory/4308-85-0x00007FF7EDB10000-0x00007FF7EDF06000-memory.dmp	upx
behavioral2/memory/1868-78-0x00007FF641170000-0x00007FF641566000-memory.dmp	upx
behavioral2/files/0x00070000000234d1-74.dat	upx
behavioral2/files/0x00070000000234d6-63.dat	upx
behavioral2/files/0x00070000000234d0-58.dat	upx
behavioral2/files/0x00070000000234d2-67.dat	upx
behavioral2/memory/2500-53-0x00007FF740080000-0x00007FF740476000-memory.dmp	upx
behavioral2/memory/2988-31-0x00007FF778320000-0x00007FF778716000-memory.dmp	upx
behavioral2/files/0x00070000000234e5-326.dat	upx
behavioral2/files/0x0007000000023516-330.dat	upx
behavioral2/files/0x0007000000023519-343.dat	upx
behavioral2/files/0x000700000002351e-350.dat	upx
behavioral2/files/0x0007000000023520-353.dat	upx
behavioral2/files/0x0007000000023521-361.dat	upx
behavioral2/memory/5116-1509-0x00007FF70C390000-0x00007FF70C786000-memory.dmp	upx
behavioral2/memory/4020-2160-0x00007FF6ED350000-0x00007FF6ED746000-memory.dmp	upx
behavioral2/memory/1256-2158-0x00007FF79F910000-0x00007FF79FD06000-memory.dmp	upx
behavioral2/memory/1552-2303-0x00007FF7D8EB0000-0x00007FF7D92A6000-memory.dmp	upx
behavioral2/memory/2988-2328-0x00007FF778320000-0x00007FF778716000-memory.dmp	upx
behavioral2/memory/4344-2330-0x00007FF676090000-0x00007FF676486000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IOVuOVx.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\nvIaKuc.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\KYuVbwS.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\JQRMNHm.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\hRnKuWO.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\TadzjXB.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\DcZWytq.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\hSqcYcA.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\kHABHzh.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\btjTaJK.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\NsNqmDO.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\HrpsNTK.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\SezSziD.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\dVWTSsg.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\CozMqQx.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\jXsMpjm.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\FsUDLra.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\SanneMp.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\yjvcaIP.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\pccRVbN.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\CzLOHBA.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\MvBnMyw.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\ewnFzCH.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\PZevVUi.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\cRjcpDH.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\CBSysCj.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\vyUaWyY.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\wXyFiDJ.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\AcDxlSg.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\lZtDMyC.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\aBubgUg.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\AqGLUub.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\taqVFMG.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\NuidnoH.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\XnyUfQC.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\FqdFHWR.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\knWUuOH.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\uxWJWlK.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\podxLuE.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\IkIUuBn.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\HOTeOMJ.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\mroOZNK.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\RISbRbC.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\URxSHrE.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\BBMPlWI.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\aQXZGKS.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\fJdllSP.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\yeTapMo.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\eyNHhYe.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\ndVlhOT.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\zDqMzSq.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\FdVDHiC.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\vagVLlo.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\OkolOlp.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\rbEsKZH.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\EmucPFZ.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\loXoKJP.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\ttrFtXm.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\EQksWaI.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\ZhOJIFU.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\eGjZAjC.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\lzblFDt.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\MXLCpqV.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
File created	C:\Windows\System\CPbVqwK.exe	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3204	powershell.exe
3204	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
Token: SeLockMemoryPrivilege	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
Token: SeDebugPrivilege	3204	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 3204	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	84
PID 5116 wrote to memory of 3204	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	84
PID 5116 wrote to memory of 2988	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	85
PID 5116 wrote to memory of 2988	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	85
PID 5116 wrote to memory of 4344	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	86
PID 5116 wrote to memory of 4344	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	86
PID 5116 wrote to memory of 2500	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	87
PID 5116 wrote to memory of 2500	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	87
PID 5116 wrote to memory of 1868	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	88
PID 5116 wrote to memory of 1868	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	88
PID 5116 wrote to memory of 4308	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	89
PID 5116 wrote to memory of 4308	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	89
PID 5116 wrote to memory of 4488	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	90
PID 5116 wrote to memory of 4488	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	90
PID 5116 wrote to memory of 2992	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	91
PID 5116 wrote to memory of 2992	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	91
PID 5116 wrote to memory of 3372	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	92
PID 5116 wrote to memory of 3372	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	92
PID 5116 wrote to memory of 264	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	93
PID 5116 wrote to memory of 264	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	93
PID 5116 wrote to memory of 4656	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	94
PID 5116 wrote to memory of 4656	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	94
PID 5116 wrote to memory of 3052	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	95
PID 5116 wrote to memory of 3052	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	95
PID 5116 wrote to memory of 5104	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	96
PID 5116 wrote to memory of 5104	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	96
PID 5116 wrote to memory of 4464	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	97
PID 5116 wrote to memory of 4464	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	97
PID 5116 wrote to memory of 1920	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	98
PID 5116 wrote to memory of 1920	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	98
PID 5116 wrote to memory of 2132	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	99
PID 5116 wrote to memory of 2132	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	99
PID 5116 wrote to memory of 3132	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	100
PID 5116 wrote to memory of 3132	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	100
PID 5116 wrote to memory of 1256	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	101
PID 5116 wrote to memory of 1256	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	101
PID 5116 wrote to memory of 4020	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	102
PID 5116 wrote to memory of 4020	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	102
PID 5116 wrote to memory of 1552	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	103
PID 5116 wrote to memory of 1552	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	103
PID 5116 wrote to memory of 1260	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	104
PID 5116 wrote to memory of 1260	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	104
PID 5116 wrote to memory of 2972	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	105
PID 5116 wrote to memory of 2972	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	105
PID 5116 wrote to memory of 668	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	106
PID 5116 wrote to memory of 668	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	106
PID 5116 wrote to memory of 4312	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	107
PID 5116 wrote to memory of 4312	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	107
PID 5116 wrote to memory of 3108	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	108
PID 5116 wrote to memory of 3108	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	108
PID 5116 wrote to memory of 2236	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	109
PID 5116 wrote to memory of 2236	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	109
PID 5116 wrote to memory of 2868	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	110
PID 5116 wrote to memory of 2868	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	110
PID 5116 wrote to memory of 2908	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	111
PID 5116 wrote to memory of 2908	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	111
PID 5116 wrote to memory of 2900	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	112
PID 5116 wrote to memory of 2900	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	112
PID 5116 wrote to memory of 2200	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	113
PID 5116 wrote to memory of 2200	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	113
PID 5116 wrote to memory of 3348	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	114
PID 5116 wrote to memory of 3348	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	114
PID 5116 wrote to memory of 2840	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	115
PID 5116 wrote to memory of 2840	5116	06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe	115

C:\Users\Admin\AppData\Local\Temp\06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe
"C:\Users\Admin\AppData\Local\Temp\06a33ef38416f028f5a84405d64c0f1acc5314f5ae8ad340e21a606a36b00066.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3204
- C:\Windows\System\GSQHlLx.exe
  C:\Windows\System\GSQHlLx.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\qRKkXDO.exe
  C:\Windows\System\qRKkXDO.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\rOQOVbZ.exe
  C:\Windows\System\rOQOVbZ.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\jWnOjEg.exe
  C:\Windows\System\jWnOjEg.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\VNRLQiq.exe
  C:\Windows\System\VNRLQiq.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\Ovagvwx.exe
  C:\Windows\System\Ovagvwx.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\GVHegka.exe
  C:\Windows\System\GVHegka.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\XFbDiYP.exe
  C:\Windows\System\XFbDiYP.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\fqyJRNP.exe
  C:\Windows\System\fqyJRNP.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\hxhItDw.exe
  C:\Windows\System\hxhItDw.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\GHSkGKx.exe
  C:\Windows\System\GHSkGKx.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\xJhqmwI.exe
  C:\Windows\System\xJhqmwI.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\XgtnhsB.exe
  C:\Windows\System\XgtnhsB.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\njrpXya.exe
  C:\Windows\System\njrpXya.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\HDEfNWm.exe
  C:\Windows\System\HDEfNWm.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\GiCsnye.exe
  C:\Windows\System\GiCsnye.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\eGjwbtr.exe
  C:\Windows\System\eGjwbtr.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\LUQoDRw.exe
  C:\Windows\System\LUQoDRw.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\HTFWIyh.exe
  C:\Windows\System\HTFWIyh.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\dLSkpKl.exe
  C:\Windows\System\dLSkpKl.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\eadSkMY.exe
  C:\Windows\System\eadSkMY.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\XYPBRwe.exe
  C:\Windows\System\XYPBRwe.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\LgKUaDz.exe
  C:\Windows\System\LgKUaDz.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\hDRCOdW.exe
  C:\Windows\System\hDRCOdW.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\osXxkgA.exe
  C:\Windows\System\osXxkgA.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\OVFFYqh.exe
  C:\Windows\System\OVFFYqh.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\dLdNPnO.exe
  C:\Windows\System\dLdNPnO.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\gIxBYJI.exe
  C:\Windows\System\gIxBYJI.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\xQSWgMO.exe
  C:\Windows\System\xQSWgMO.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\fMXtnMy.exe
  C:\Windows\System\fMXtnMy.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\dYYEyTH.exe
  C:\Windows\System\dYYEyTH.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\CCKElFH.exe
  C:\Windows\System\CCKElFH.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\RVdVhqK.exe
  C:\Windows\System\RVdVhqK.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\zCXkQkS.exe
  C:\Windows\System\zCXkQkS.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\BxWdVdF.exe
  C:\Windows\System\BxWdVdF.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\ctcliKd.exe
  C:\Windows\System\ctcliKd.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\BZIcIjk.exe
  C:\Windows\System\BZIcIjk.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\ebLpdWY.exe
  C:\Windows\System\ebLpdWY.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\jFSMyBG.exe
  C:\Windows\System\jFSMyBG.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\RIfDcIy.exe
  C:\Windows\System\RIfDcIy.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\YgbYKIf.exe
  C:\Windows\System\YgbYKIf.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\vqZApQo.exe
  C:\Windows\System\vqZApQo.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\gMsKiNq.exe
  C:\Windows\System\gMsKiNq.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\bzgQBCS.exe
  C:\Windows\System\bzgQBCS.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\DfFQGYp.exe
  C:\Windows\System\DfFQGYp.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\WWNHPgi.exe
  C:\Windows\System\WWNHPgi.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\fPhkMCz.exe
  C:\Windows\System\fPhkMCz.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\IjAIWlM.exe
  C:\Windows\System\IjAIWlM.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\yjnjwOh.exe
  C:\Windows\System\yjnjwOh.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\SmqOQnK.exe
  C:\Windows\System\SmqOQnK.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\bpEvXCl.exe
  C:\Windows\System\bpEvXCl.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\HEGcPWI.exe
  C:\Windows\System\HEGcPWI.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\QeeQuIO.exe
  C:\Windows\System\QeeQuIO.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\APruQEj.exe
  C:\Windows\System\APruQEj.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\YeWLTfC.exe
  C:\Windows\System\YeWLTfC.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\bjWEeOc.exe
  C:\Windows\System\bjWEeOc.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\ObDkFLd.exe
  C:\Windows\System\ObDkFLd.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\FuaiyyD.exe
  C:\Windows\System\FuaiyyD.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\cowXFwP.exe
  C:\Windows\System\cowXFwP.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\LyePpvb.exe
  C:\Windows\System\LyePpvb.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\eZHSWsJ.exe
  C:\Windows\System\eZHSWsJ.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\ipmwKYx.exe
  C:\Windows\System\ipmwKYx.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\KanSXwl.exe
  C:\Windows\System\KanSXwl.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\rciGbHJ.exe
  C:\Windows\System\rciGbHJ.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\Pdhpkde.exe
  C:\Windows\System\Pdhpkde.exe
  2⤵
  PID:1476
- C:\Windows\System\AtWKXyY.exe
  C:\Windows\System\AtWKXyY.exe
  2⤵
  PID:3608
- C:\Windows\System\WMidIIv.exe
  C:\Windows\System\WMidIIv.exe
  2⤵
  PID:1716
- C:\Windows\System\bQHmxut.exe
  C:\Windows\System\bQHmxut.exe
  2⤵
  PID:512
- C:\Windows\System\XAQVPMo.exe
  C:\Windows\System\XAQVPMo.exe
  2⤵
  PID:1448
- C:\Windows\System\JtycrIq.exe
  C:\Windows\System\JtycrIq.exe
  2⤵
  PID:4948
- C:\Windows\System\BkeYpBs.exe
  C:\Windows\System\BkeYpBs.exe
  2⤵
  PID:3236
- C:\Windows\System\jkYTsRe.exe
  C:\Windows\System\jkYTsRe.exe
  2⤵
  PID:4668
- C:\Windows\System\Qsnvior.exe
  C:\Windows\System\Qsnvior.exe
  2⤵
  PID:2856
- C:\Windows\System\oowHukP.exe
  C:\Windows\System\oowHukP.exe
  2⤵
  PID:2360
- C:\Windows\System\sXgzoNZ.exe
  C:\Windows\System\sXgzoNZ.exe
  2⤵
  PID:2780
- C:\Windows\System\uhPdPSa.exe
  C:\Windows\System\uhPdPSa.exe
  2⤵
  PID:508
- C:\Windows\System\SGMjxlg.exe
  C:\Windows\System\SGMjxlg.exe
  2⤵
  PID:1744
- C:\Windows\System\ZzWQCvF.exe
  C:\Windows\System\ZzWQCvF.exe
  2⤵
  PID:4580
- C:\Windows\System\Rqajdng.exe
  C:\Windows\System\Rqajdng.exe
  2⤵
  PID:2512
- C:\Windows\System\OcFDSWB.exe
  C:\Windows\System\OcFDSWB.exe
  2⤵
  PID:2748
- C:\Windows\System\aHCmzDA.exe
  C:\Windows\System\aHCmzDA.exe
  2⤵
  PID:4664
- C:\Windows\System\JpzELEF.exe
  C:\Windows\System\JpzELEF.exe
  2⤵
  PID:2308
- C:\Windows\System\QksQnNN.exe
  C:\Windows\System\QksQnNN.exe
  2⤵
  PID:3664
- C:\Windows\System\xceKNmf.exe
  C:\Windows\System\xceKNmf.exe
  2⤵
  PID:3396
- C:\Windows\System\vbjhqHZ.exe
  C:\Windows\System\vbjhqHZ.exe
  2⤵
  PID:4600
- C:\Windows\System\Sgmtpgf.exe
  C:\Windows\System\Sgmtpgf.exe
  2⤵
  PID:5128
- C:\Windows\System\ndJrcWF.exe
  C:\Windows\System\ndJrcWF.exe
  2⤵
  PID:5160
- C:\Windows\System\lqlcpBB.exe
  C:\Windows\System\lqlcpBB.exe
  2⤵
  PID:5188
- C:\Windows\System\RdEJVxj.exe
  C:\Windows\System\RdEJVxj.exe
  2⤵
  PID:5204
- C:\Windows\System\eRMsDXM.exe
  C:\Windows\System\eRMsDXM.exe
  2⤵
  PID:5236
- C:\Windows\System\wtTzrRz.exe
  C:\Windows\System\wtTzrRz.exe
  2⤵
  PID:5256
- C:\Windows\System\JDydJpx.exe
  C:\Windows\System\JDydJpx.exe
  2⤵
  PID:5312
- C:\Windows\System\ADsyBTZ.exe
  C:\Windows\System\ADsyBTZ.exe
  2⤵
  PID:5348
- C:\Windows\System\GmdNLTF.exe
  C:\Windows\System\GmdNLTF.exe
  2⤵
  PID:5380
- C:\Windows\System\GtQTiJZ.exe
  C:\Windows\System\GtQTiJZ.exe
  2⤵
  PID:5400
- C:\Windows\System\tgscHyQ.exe
  C:\Windows\System\tgscHyQ.exe
  2⤵
  PID:5420
- C:\Windows\System\KiCdmWE.exe
  C:\Windows\System\KiCdmWE.exe
  2⤵
  PID:5456
- C:\Windows\System\oYwRafl.exe
  C:\Windows\System\oYwRafl.exe
  2⤵
  PID:5484
- C:\Windows\System\qrIuPyU.exe
  C:\Windows\System\qrIuPyU.exe
  2⤵
  PID:5512
- C:\Windows\System\kMzLmBv.exe
  C:\Windows\System\kMzLmBv.exe
  2⤵
  PID:5540
- C:\Windows\System\DYqOQiW.exe
  C:\Windows\System\DYqOQiW.exe
  2⤵
  PID:5572
- C:\Windows\System\Kbqzrgu.exe
  C:\Windows\System\Kbqzrgu.exe
  2⤵
  PID:5608
- C:\Windows\System\ZrDqOLS.exe
  C:\Windows\System\ZrDqOLS.exe
  2⤵
  PID:5636
- C:\Windows\System\ndBiVNO.exe
  C:\Windows\System\ndBiVNO.exe
  2⤵
  PID:5668
- C:\Windows\System\IOVuOVx.exe
  C:\Windows\System\IOVuOVx.exe
  2⤵
  PID:5704
- C:\Windows\System\OxuwTPO.exe
  C:\Windows\System\OxuwTPO.exe
  2⤵
  PID:5728
- C:\Windows\System\FVktddC.exe
  C:\Windows\System\FVktddC.exe
  2⤵
  PID:5756
- C:\Windows\System\zXnfOde.exe
  C:\Windows\System\zXnfOde.exe
  2⤵
  PID:5784
- C:\Windows\System\wlgIUFq.exe
  C:\Windows\System\wlgIUFq.exe
  2⤵
  PID:5824
- C:\Windows\System\oRtmSSP.exe
  C:\Windows\System\oRtmSSP.exe
  2⤵
  PID:5852
- C:\Windows\System\KcuCiSZ.exe
  C:\Windows\System\KcuCiSZ.exe
  2⤵
  PID:5880
- C:\Windows\System\MxNoCOK.exe
  C:\Windows\System\MxNoCOK.exe
  2⤵
  PID:5916
- C:\Windows\System\TyZnGCS.exe
  C:\Windows\System\TyZnGCS.exe
  2⤵
  PID:5964
- C:\Windows\System\yhOWTNh.exe
  C:\Windows\System\yhOWTNh.exe
  2⤵
  PID:6032
- C:\Windows\System\KMwNMHm.exe
  C:\Windows\System\KMwNMHm.exe
  2⤵
  PID:6048
- C:\Windows\System\wDOwJIX.exe
  C:\Windows\System\wDOwJIX.exe
  2⤵
  PID:6068
- C:\Windows\System\NgmoBdr.exe
  C:\Windows\System\NgmoBdr.exe
  2⤵
  PID:6116
- C:\Windows\System\LschSaA.exe
  C:\Windows\System\LschSaA.exe
  2⤵
  PID:2916
- C:\Windows\System\KWLOkKj.exe
  C:\Windows\System\KWLOkKj.exe
  2⤵
  PID:5200
- C:\Windows\System\dsPWfhU.exe
  C:\Windows\System\dsPWfhU.exe
  2⤵
  PID:5280
- C:\Windows\System\OnNfKtv.exe
  C:\Windows\System\OnNfKtv.exe
  2⤵
  PID:5336
- C:\Windows\System\xSImlgi.exe
  C:\Windows\System\xSImlgi.exe
  2⤵
  PID:5396
- C:\Windows\System\XOdCdsH.exe
  C:\Windows\System\XOdCdsH.exe
  2⤵
  PID:5448
- C:\Windows\System\bZpPqDu.exe
  C:\Windows\System\bZpPqDu.exe
  2⤵
  PID:5508
- C:\Windows\System\LCpFtfG.exe
  C:\Windows\System\LCpFtfG.exe
  2⤵
  PID:5584
- C:\Windows\System\snFBurG.exe
  C:\Windows\System\snFBurG.exe
  2⤵
  PID:5644
- C:\Windows\System\QkvwIJu.exe
  C:\Windows\System\QkvwIJu.exe
  2⤵
  PID:5712
- C:\Windows\System\yKmjRKO.exe
  C:\Windows\System\yKmjRKO.exe
  2⤵
  PID:5848
- C:\Windows\System\ZTQkbfw.exe
  C:\Windows\System\ZTQkbfw.exe
  2⤵
  PID:5940
- C:\Windows\System\aPDWdJJ.exe
  C:\Windows\System\aPDWdJJ.exe
  2⤵
  PID:6000
- C:\Windows\System\FMUtexU.exe
  C:\Windows\System\FMUtexU.exe
  2⤵
  PID:5212
- C:\Windows\System\QphuaAf.exe
  C:\Windows\System\QphuaAf.exe
  2⤵
  PID:5168
- C:\Windows\System\BHNcXYB.exe
  C:\Windows\System\BHNcXYB.exe
  2⤵
  PID:5324
- C:\Windows\System\qWUpepI.exe
  C:\Windows\System\qWUpepI.exe
  2⤵
  PID:5624
- C:\Windows\System\yxECmMm.exe
  C:\Windows\System\yxECmMm.exe
  2⤵
  PID:5736
- C:\Windows\System\LgeREVD.exe
  C:\Windows\System\LgeREVD.exe
  2⤵
  PID:6088
- C:\Windows\System\XxCZqRP.exe
  C:\Windows\System\XxCZqRP.exe
  2⤵
  PID:5416
- C:\Windows\System\frfwMsY.exe
  C:\Windows\System\frfwMsY.exe
  2⤵
  PID:6132
- C:\Windows\System\xwiUAuM.exe
  C:\Windows\System\xwiUAuM.exe
  2⤵
  PID:6180
- C:\Windows\System\dwjEuag.exe
  C:\Windows\System\dwjEuag.exe
  2⤵
  PID:6196
- C:\Windows\System\VqPSPeS.exe
  C:\Windows\System\VqPSPeS.exe
  2⤵
  PID:6232
- C:\Windows\System\ChTAVlc.exe
  C:\Windows\System\ChTAVlc.exe
  2⤵
  PID:6284
- C:\Windows\System\kkquguz.exe
  C:\Windows\System\kkquguz.exe
  2⤵
  PID:6340
- C:\Windows\System\GftXqVr.exe
  C:\Windows\System\GftXqVr.exe
  2⤵
  PID:6384
- C:\Windows\System\zrUhGWx.exe
  C:\Windows\System\zrUhGWx.exe
  2⤵
  PID:6428
- C:\Windows\System\regjVty.exe
  C:\Windows\System\regjVty.exe
  2⤵
  PID:6456
- C:\Windows\System\NmkFKGA.exe
  C:\Windows\System\NmkFKGA.exe
  2⤵
  PID:6488
- C:\Windows\System\npeUJHK.exe
  C:\Windows\System\npeUJHK.exe
  2⤵
  PID:6512
- C:\Windows\System\PmxeFWE.exe
  C:\Windows\System\PmxeFWE.exe
  2⤵
  PID:6548
- C:\Windows\System\OXLKIeA.exe
  C:\Windows\System\OXLKIeA.exe
  2⤵
  PID:6576
- C:\Windows\System\plDKdeo.exe
  C:\Windows\System\plDKdeo.exe
  2⤵
  PID:6612
- C:\Windows\System\VWGFZcK.exe
  C:\Windows\System\VWGFZcK.exe
  2⤵
  PID:6652
- C:\Windows\System\wprEqLU.exe
  C:\Windows\System\wprEqLU.exe
  2⤵
  PID:6680
- C:\Windows\System\SdYkyzS.exe
  C:\Windows\System\SdYkyzS.exe
  2⤵
  PID:6712
- C:\Windows\System\CXmHgCT.exe
  C:\Windows\System\CXmHgCT.exe
  2⤵
  PID:6736
- C:\Windows\System\xFGBOqf.exe
  C:\Windows\System\xFGBOqf.exe
  2⤵
  PID:6764
- C:\Windows\System\XzmrWCn.exe
  C:\Windows\System\XzmrWCn.exe
  2⤵
  PID:6792
- C:\Windows\System\fUKmjKx.exe
  C:\Windows\System\fUKmjKx.exe
  2⤵
  PID:6824
- C:\Windows\System\xBvLNEj.exe
  C:\Windows\System\xBvLNEj.exe
  2⤵
  PID:6856
- C:\Windows\System\gOlqyTg.exe
  C:\Windows\System\gOlqyTg.exe
  2⤵
  PID:6892
- C:\Windows\System\lWgqrkm.exe
  C:\Windows\System\lWgqrkm.exe
  2⤵
  PID:6912
- C:\Windows\System\woRYXlL.exe
  C:\Windows\System\woRYXlL.exe
  2⤵
  PID:6940
- C:\Windows\System\nVrmfqP.exe
  C:\Windows\System\nVrmfqP.exe
  2⤵
  PID:6956
- C:\Windows\System\CTFliTt.exe
  C:\Windows\System\CTFliTt.exe
  2⤵
  PID:6976
- C:\Windows\System\JEFbgcq.exe
  C:\Windows\System\JEFbgcq.exe
  2⤵
  PID:7024
- C:\Windows\System\YuMigAZ.exe
  C:\Windows\System\YuMigAZ.exe
  2⤵
  PID:7056
- C:\Windows\System\JUPUHrT.exe
  C:\Windows\System\JUPUHrT.exe
  2⤵
  PID:7084
- C:\Windows\System\lwDDMwF.exe
  C:\Windows\System\lwDDMwF.exe
  2⤵
  PID:7108
- C:\Windows\System\lGCMtqA.exe
  C:\Windows\System\lGCMtqA.exe
  2⤵
  PID:7152
- C:\Windows\System\UhsyGAO.exe
  C:\Windows\System\UhsyGAO.exe
  2⤵
  PID:5816
- C:\Windows\System\KqtjKHw.exe
  C:\Windows\System\KqtjKHw.exe
  2⤵
  PID:6220
- C:\Windows\System\sNYCNay.exe
  C:\Windows\System\sNYCNay.exe
  2⤵
  PID:6328
- C:\Windows\System\NrUKkEl.exe
  C:\Windows\System\NrUKkEl.exe
  2⤵
  PID:6440
- C:\Windows\System\nHktdAB.exe
  C:\Windows\System\nHktdAB.exe
  2⤵
  PID:6496
- C:\Windows\System\qjCEnHh.exe
  C:\Windows\System\qjCEnHh.exe
  2⤵
  PID:6568
- C:\Windows\System\MhPJLCz.exe
  C:\Windows\System\MhPJLCz.exe
  2⤵
  PID:6644
- C:\Windows\System\RQHDvkL.exe
  C:\Windows\System\RQHDvkL.exe
  2⤵
  PID:6704
- C:\Windows\System\WReToaj.exe
  C:\Windows\System\WReToaj.exe
  2⤵
  PID:6776
- C:\Windows\System\EFcJiAq.exe
  C:\Windows\System\EFcJiAq.exe
  2⤵
  PID:6848
- C:\Windows\System\XetgirW.exe
  C:\Windows\System\XetgirW.exe
  2⤵
  PID:6908
- C:\Windows\System\qoLKJRS.exe
  C:\Windows\System\qoLKJRS.exe
  2⤵
  PID:6964
- C:\Windows\System\QgpkrKp.exe
  C:\Windows\System\QgpkrKp.exe
  2⤵
  PID:7064
- C:\Windows\System\aKOtazo.exe
  C:\Windows\System\aKOtazo.exe
  2⤵
  PID:7104
- C:\Windows\System\XPgRWsH.exe
  C:\Windows\System\XPgRWsH.exe
  2⤵
  PID:7164
- C:\Windows\System\MeNaHHZ.exe
  C:\Windows\System\MeNaHHZ.exe
  2⤵
  PID:5296
- C:\Windows\System\MDJTiuE.exe
  C:\Windows\System\MDJTiuE.exe
  2⤵
  PID:6540
- C:\Windows\System\UVODfmC.exe
  C:\Windows\System\UVODfmC.exe
  2⤵
  PID:6760
- C:\Windows\System\hmWbSRr.exe
  C:\Windows\System\hmWbSRr.exe
  2⤵
  PID:6832
- C:\Windows\System\MFsBtit.exe
  C:\Windows\System\MFsBtit.exe
  2⤵
  PID:7016
- C:\Windows\System\vAMtyPE.exe
  C:\Windows\System\vAMtyPE.exe
  2⤵
  PID:6300
- C:\Windows\System\oqlidqx.exe
  C:\Windows\System\oqlidqx.exe
  2⤵
  PID:6672
- C:\Windows\System\FBOOGgV.exe
  C:\Windows\System\FBOOGgV.exe
  2⤵
  PID:6968
- C:\Windows\System\wFKSene.exe
  C:\Windows\System\wFKSene.exe
  2⤵
  PID:6756
- C:\Windows\System\ohBMsfs.exe
  C:\Windows\System\ohBMsfs.exe
  2⤵
  PID:7092
- C:\Windows\System\PRYotUk.exe
  C:\Windows\System\PRYotUk.exe
  2⤵
  PID:7192
- C:\Windows\System\iNiGswG.exe
  C:\Windows\System\iNiGswG.exe
  2⤵
  PID:7220
- C:\Windows\System\eTyqAgk.exe
  C:\Windows\System\eTyqAgk.exe
  2⤵
  PID:7252
- C:\Windows\System\IORalHf.exe
  C:\Windows\System\IORalHf.exe
  2⤵
  PID:7280
- C:\Windows\System\hmFUCoV.exe
  C:\Windows\System\hmFUCoV.exe
  2⤵
  PID:7308
- C:\Windows\System\jFkRJsz.exe
  C:\Windows\System\jFkRJsz.exe
  2⤵
  PID:7336
- C:\Windows\System\PFgnFXo.exe
  C:\Windows\System\PFgnFXo.exe
  2⤵
  PID:7356
- C:\Windows\System\dXffwbs.exe
  C:\Windows\System\dXffwbs.exe
  2⤵
  PID:7384
- C:\Windows\System\mrNniaC.exe
  C:\Windows\System\mrNniaC.exe
  2⤵
  PID:7412
- C:\Windows\System\ZCufqTu.exe
  C:\Windows\System\ZCufqTu.exe
  2⤵
  PID:7448
- C:\Windows\System\QzPAORP.exe
  C:\Windows\System\QzPAORP.exe
  2⤵
  PID:7476
- C:\Windows\System\sHXHYIg.exe
  C:\Windows\System\sHXHYIg.exe
  2⤵
  PID:7496
- C:\Windows\System\hFVKbGn.exe
  C:\Windows\System\hFVKbGn.exe
  2⤵
  PID:7524
- C:\Windows\System\eflGIiz.exe
  C:\Windows\System\eflGIiz.exe
  2⤵
  PID:7552
- C:\Windows\System\jLVrFPi.exe
  C:\Windows\System\jLVrFPi.exe
  2⤵
  PID:7580
- C:\Windows\System\VdNrJex.exe
  C:\Windows\System\VdNrJex.exe
  2⤵
  PID:7608
- C:\Windows\System\xSocIWt.exe
  C:\Windows\System\xSocIWt.exe
  2⤵
  PID:7636
- C:\Windows\System\LlvOAhe.exe
  C:\Windows\System\LlvOAhe.exe
  2⤵
  PID:7664
- C:\Windows\System\YOEFOXP.exe
  C:\Windows\System\YOEFOXP.exe
  2⤵
  PID:7692
- C:\Windows\System\QVKrfIm.exe
  C:\Windows\System\QVKrfIm.exe
  2⤵
  PID:7720
- C:\Windows\System\UlMlOvP.exe
  C:\Windows\System\UlMlOvP.exe
  2⤵
  PID:7748
- C:\Windows\System\wPYDbqi.exe
  C:\Windows\System\wPYDbqi.exe
  2⤵
  PID:7776
- C:\Windows\System\JotvSmA.exe
  C:\Windows\System\JotvSmA.exe
  2⤵
  PID:7804
- C:\Windows\System\NDgzAxj.exe
  C:\Windows\System\NDgzAxj.exe
  2⤵
  PID:7832
- C:\Windows\System\PLJaXqB.exe
  C:\Windows\System\PLJaXqB.exe
  2⤵
  PID:7880
- C:\Windows\System\pyImyIC.exe
  C:\Windows\System\pyImyIC.exe
  2⤵
  PID:7920
- C:\Windows\System\dcRzitD.exe
  C:\Windows\System\dcRzitD.exe
  2⤵
  PID:7956
- C:\Windows\System\BYSuzml.exe
  C:\Windows\System\BYSuzml.exe
  2⤵
  PID:7984
- C:\Windows\System\ZsFbIAV.exe
  C:\Windows\System\ZsFbIAV.exe
  2⤵
  PID:8012
- C:\Windows\System\HmoGcuX.exe
  C:\Windows\System\HmoGcuX.exe
  2⤵
  PID:8040
- C:\Windows\System\GhxiEKN.exe
  C:\Windows\System\GhxiEKN.exe
  2⤵
  PID:8068
- C:\Windows\System\TqPxtbw.exe
  C:\Windows\System\TqPxtbw.exe
  2⤵
  PID:8096
- C:\Windows\System\flDLNRM.exe
  C:\Windows\System\flDLNRM.exe
  2⤵
  PID:8124
- C:\Windows\System\JARLphE.exe
  C:\Windows\System\JARLphE.exe
  2⤵
  PID:8152
- C:\Windows\System\WJgeTNd.exe
  C:\Windows\System\WJgeTNd.exe
  2⤵
  PID:8180
- C:\Windows\System\PLIlxhE.exe
  C:\Windows\System\PLIlxhE.exe
  2⤵
  PID:7200
- C:\Windows\System\OIdWvLt.exe
  C:\Windows\System\OIdWvLt.exe
  2⤵
  PID:7264
- C:\Windows\System\OPGOUPG.exe
  C:\Windows\System\OPGOUPG.exe
  2⤵
  PID:7324
- C:\Windows\System\wmZvJsT.exe
  C:\Windows\System\wmZvJsT.exe
  2⤵
  PID:7380
- C:\Windows\System\quSXjxu.exe
  C:\Windows\System\quSXjxu.exe
  2⤵
  PID:7456
- C:\Windows\System\ndLrYtZ.exe
  C:\Windows\System\ndLrYtZ.exe
  2⤵
  PID:7516
- C:\Windows\System\YfAqpDX.exe
  C:\Windows\System\YfAqpDX.exe
  2⤵
  PID:7576
- C:\Windows\System\BiIWmzj.exe
  C:\Windows\System\BiIWmzj.exe
  2⤵
  PID:7632
- C:\Windows\System\khBVgwD.exe
  C:\Windows\System\khBVgwD.exe
  2⤵
  PID:7704
- C:\Windows\System\EigCwlB.exe
  C:\Windows\System\EigCwlB.exe
  2⤵
  PID:7772
- C:\Windows\System\QGqBVle.exe
  C:\Windows\System\QGqBVle.exe
  2⤵
  PID:7820
- C:\Windows\System\BYnITrl.exe
  C:\Windows\System\BYnITrl.exe
  2⤵
  PID:7936
- C:\Windows\System\xDzfWas.exe
  C:\Windows\System\xDzfWas.exe
  2⤵
  PID:7996
- C:\Windows\System\brxLKAt.exe
  C:\Windows\System\brxLKAt.exe
  2⤵
  PID:8060
- C:\Windows\System\Qzmpjca.exe
  C:\Windows\System\Qzmpjca.exe
  2⤵
  PID:8116
- C:\Windows\System\WoZaLMT.exe
  C:\Windows\System\WoZaLMT.exe
  2⤵
  PID:7128
- C:\Windows\System\HQPjwkj.exe
  C:\Windows\System\HQPjwkj.exe
  2⤵
  PID:7320
- C:\Windows\System\QxcMjMG.exe
  C:\Windows\System\QxcMjMG.exe
  2⤵
  PID:7484
- C:\Windows\System\ULKrXRo.exe
  C:\Windows\System\ULKrXRo.exe
  2⤵
  PID:7072
- C:\Windows\System\HFVCTfJ.exe
  C:\Windows\System\HFVCTfJ.exe
  2⤵
  PID:7760
- C:\Windows\System\DhMzAeA.exe
  C:\Windows\System\DhMzAeA.exe
  2⤵
  PID:7912
- C:\Windows\System\SNbzPYI.exe
  C:\Windows\System\SNbzPYI.exe
  2⤵
  PID:8092
- C:\Windows\System\NnOkqsI.exe
  C:\Windows\System\NnOkqsI.exe
  2⤵
  PID:7260
- C:\Windows\System\MprAIDK.exe
  C:\Windows\System\MprAIDK.exe
  2⤵
  PID:7660
- C:\Windows\System\skRyuEj.exe
  C:\Windows\System\skRyuEj.exe
  2⤵
  PID:7872
- C:\Windows\System\xyCMKwY.exe
  C:\Windows\System\xyCMKwY.exe
  2⤵
  PID:7408
- C:\Windows\System\XZHjgBb.exe
  C:\Windows\System\XZHjgBb.exe
  2⤵
  PID:8052
- C:\Windows\System\eWrFNxa.exe
  C:\Windows\System\eWrFNxa.exe
  2⤵
  PID:8196
- C:\Windows\System\tdwQRwr.exe
  C:\Windows\System\tdwQRwr.exe
  2⤵
  PID:8220
- C:\Windows\System\ykQwRXS.exe
  C:\Windows\System\ykQwRXS.exe
  2⤵
  PID:8248
- C:\Windows\System\uoSHxpp.exe
  C:\Windows\System\uoSHxpp.exe
  2⤵
  PID:8280
- C:\Windows\System\XlbSErj.exe
  C:\Windows\System\XlbSErj.exe
  2⤵
  PID:8308
- C:\Windows\System\cdxvEqy.exe
  C:\Windows\System\cdxvEqy.exe
  2⤵
  PID:8340
- C:\Windows\System\FdlGSwh.exe
  C:\Windows\System\FdlGSwh.exe
  2⤵
  PID:8364
- C:\Windows\System\WXXfYCK.exe
  C:\Windows\System\WXXfYCK.exe
  2⤵
  PID:8400
- C:\Windows\System\EsVaMid.exe
  C:\Windows\System\EsVaMid.exe
  2⤵
  PID:8424
- C:\Windows\System\DRstuJL.exe
  C:\Windows\System\DRstuJL.exe
  2⤵
  PID:8448
- C:\Windows\System\WelUFBu.exe
  C:\Windows\System\WelUFBu.exe
  2⤵
  PID:8476
- C:\Windows\System\DYHjZFh.exe
  C:\Windows\System\DYHjZFh.exe
  2⤵
  PID:8508
- C:\Windows\System\SBLjazK.exe
  C:\Windows\System\SBLjazK.exe
  2⤵
  PID:8532
- C:\Windows\System\LEufHwt.exe
  C:\Windows\System\LEufHwt.exe
  2⤵
  PID:8560
- C:\Windows\System\cKymSKD.exe
  C:\Windows\System\cKymSKD.exe
  2⤵
  PID:8588
- C:\Windows\System\JVyiTXC.exe
  C:\Windows\System\JVyiTXC.exe
  2⤵
  PID:8616
- C:\Windows\System\bNEiDUo.exe
  C:\Windows\System\bNEiDUo.exe
  2⤵
  PID:8644
- C:\Windows\System\mJGCaOL.exe
  C:\Windows\System\mJGCaOL.exe
  2⤵
  PID:8672
- C:\Windows\System\JeVSHeB.exe
  C:\Windows\System\JeVSHeB.exe
  2⤵
  PID:8700
- C:\Windows\System\xIAofAX.exe
  C:\Windows\System\xIAofAX.exe
  2⤵
  PID:8728
- C:\Windows\System\fLAiJkr.exe
  C:\Windows\System\fLAiJkr.exe
  2⤵
  PID:8756
- C:\Windows\System\TeQIOgh.exe
  C:\Windows\System\TeQIOgh.exe
  2⤵
  PID:8796
- C:\Windows\System\YnXQDpn.exe
  C:\Windows\System\YnXQDpn.exe
  2⤵
  PID:8824
- C:\Windows\System\PSucLLQ.exe
  C:\Windows\System\PSucLLQ.exe
  2⤵
  PID:8848
- C:\Windows\System\bexjmqS.exe
  C:\Windows\System\bexjmqS.exe
  2⤵
  PID:8872
- C:\Windows\System\oydgrIu.exe
  C:\Windows\System\oydgrIu.exe
  2⤵
  PID:8900
- C:\Windows\System\QEVnzdy.exe
  C:\Windows\System\QEVnzdy.exe
  2⤵
  PID:8928
- C:\Windows\System\gKBeiwR.exe
  C:\Windows\System\gKBeiwR.exe
  2⤵
  PID:8956
- C:\Windows\System\IOZpXaq.exe
  C:\Windows\System\IOZpXaq.exe
  2⤵
  PID:8984
- C:\Windows\System\NQgnGoC.exe
  C:\Windows\System\NQgnGoC.exe
  2⤵
  PID:9020
- C:\Windows\System\MWJPDBV.exe
  C:\Windows\System\MWJPDBV.exe
  2⤵
  PID:9040
- C:\Windows\System\JfPUvdl.exe
  C:\Windows\System\JfPUvdl.exe
  2⤵
  PID:9068
- C:\Windows\System\kbxLQSk.exe
  C:\Windows\System\kbxLQSk.exe
  2⤵
  PID:9096
- C:\Windows\System\aQWFAcU.exe
  C:\Windows\System\aQWFAcU.exe
  2⤵
  PID:9124
- C:\Windows\System\vifDoPD.exe
  C:\Windows\System\vifDoPD.exe
  2⤵
  PID:9156
- C:\Windows\System\GJNtXIw.exe
  C:\Windows\System\GJNtXIw.exe
  2⤵
  PID:9192
- C:\Windows\System\zLMWDBK.exe
  C:\Windows\System\zLMWDBK.exe
  2⤵
  PID:9212
- C:\Windows\System\ogDYKHD.exe
  C:\Windows\System\ogDYKHD.exe
  2⤵
  PID:8244
- C:\Windows\System\BrhUGov.exe
  C:\Windows\System\BrhUGov.exe
  2⤵
  PID:8328
- C:\Windows\System\rUhXGlO.exe
  C:\Windows\System\rUhXGlO.exe
  2⤵
  PID:8384
- C:\Windows\System\opzBEkO.exe
  C:\Windows\System\opzBEkO.exe
  2⤵
  PID:8444
- C:\Windows\System\gwFNWZI.exe
  C:\Windows\System\gwFNWZI.exe
  2⤵
  PID:8516
- C:\Windows\System\LaxCoWN.exe
  C:\Windows\System\LaxCoWN.exe
  2⤵
  PID:8580
- C:\Windows\System\woLFXuM.exe
  C:\Windows\System\woLFXuM.exe
  2⤵
  PID:8640
- C:\Windows\System\lzxBKpg.exe
  C:\Windows\System\lzxBKpg.exe
  2⤵
  PID:8712
- C:\Windows\System\CdZtSle.exe
  C:\Windows\System\CdZtSle.exe
  2⤵
  PID:8776
- C:\Windows\System\IcxAwJl.exe
  C:\Windows\System\IcxAwJl.exe
  2⤵
  PID:4696
- C:\Windows\System\Dstuacx.exe
  C:\Windows\System\Dstuacx.exe
  2⤵
  PID:848
- C:\Windows\System\GkVZPnY.exe
  C:\Windows\System\GkVZPnY.exe
  2⤵
  PID:3644
- C:\Windows\System\sBlluuL.exe
  C:\Windows\System\sBlluuL.exe
  2⤵
  PID:4100
- C:\Windows\System\seWDoLq.exe
  C:\Windows\System\seWDoLq.exe
  2⤵
  PID:8896
- C:\Windows\System\ycKhktD.exe
  C:\Windows\System\ycKhktD.exe
  2⤵
  PID:8968
- C:\Windows\System\BuDRryr.exe
  C:\Windows\System\BuDRryr.exe
  2⤵
  PID:9064
- C:\Windows\System\rLRGESe.exe
  C:\Windows\System\rLRGESe.exe
  2⤵
  PID:9148
- C:\Windows\System\kDAsLDM.exe
  C:\Windows\System\kDAsLDM.exe
  2⤵
  PID:8276
- C:\Windows\System\tYsSBiY.exe
  C:\Windows\System\tYsSBiY.exe
  2⤵
  PID:8376
- C:\Windows\System\giWdHgp.exe
  C:\Windows\System\giWdHgp.exe
  2⤵
  PID:2904
- C:\Windows\System\WpLlwWy.exe
  C:\Windows\System\WpLlwWy.exe
  2⤵
  PID:776
- C:\Windows\System\PfONMVg.exe
  C:\Windows\System\PfONMVg.exe
  2⤵
  PID:3416
- C:\Windows\System\yvkwyQZ.exe
  C:\Windows\System\yvkwyQZ.exe
  2⤵
  PID:8940
- C:\Windows\System\YtXZkkP.exe
  C:\Windows\System\YtXZkkP.exe
  2⤵
  PID:8352
- C:\Windows\System\TncHlua.exe
  C:\Windows\System\TncHlua.exe
  2⤵
  PID:5960
- C:\Windows\System\wKFWWMI.exe
  C:\Windows\System\wKFWWMI.exe
  2⤵
  PID:9004
- C:\Windows\System\BLEOoRM.exe
  C:\Windows\System\BLEOoRM.exe
  2⤵
  PID:9204
- C:\Windows\System\FhqAbvt.exe
  C:\Windows\System\FhqAbvt.exe
  2⤵
  PID:9236
- C:\Windows\System\GmLPvdL.exe
  C:\Windows\System\GmLPvdL.exe
  2⤵
  PID:9268
- C:\Windows\System\TXkrbdH.exe
  C:\Windows\System\TXkrbdH.exe
  2⤵
  PID:9296
- C:\Windows\System\cvJHBLV.exe
  C:\Windows\System\cvJHBLV.exe
  2⤵
  PID:9324
- C:\Windows\System\kMuQYBz.exe
  C:\Windows\System\kMuQYBz.exe
  2⤵
  PID:9352
- C:\Windows\System\aIXwSLm.exe
  C:\Windows\System\aIXwSLm.exe
  2⤵
  PID:9384
- C:\Windows\System\DQvwxqi.exe
  C:\Windows\System\DQvwxqi.exe
  2⤵
  PID:9412
- C:\Windows\System\tKXLVPT.exe
  C:\Windows\System\tKXLVPT.exe
  2⤵
  PID:9440
- C:\Windows\System\gnEkrur.exe
  C:\Windows\System\gnEkrur.exe
  2⤵
  PID:9468
- C:\Windows\System\VcqsOfo.exe
  C:\Windows\System\VcqsOfo.exe
  2⤵
  PID:9496
- C:\Windows\System\CDpMBgJ.exe
  C:\Windows\System\CDpMBgJ.exe
  2⤵
  PID:9524
- C:\Windows\System\vAPKMNJ.exe
  C:\Windows\System\vAPKMNJ.exe
  2⤵
  PID:9552
- C:\Windows\System\IooYFBg.exe
  C:\Windows\System\IooYFBg.exe
  2⤵
  PID:9584
- C:\Windows\System\gsHXJmu.exe
  C:\Windows\System\gsHXJmu.exe
  2⤵
  PID:9608
- C:\Windows\System\YNOaIwc.exe
  C:\Windows\System\YNOaIwc.exe
  2⤵
  PID:9636
- C:\Windows\System\YwQNxTn.exe
  C:\Windows\System\YwQNxTn.exe
  2⤵
  PID:9664
- C:\Windows\System\yHmdFvT.exe
  C:\Windows\System\yHmdFvT.exe
  2⤵
  PID:9692
- C:\Windows\System\fyJLZlD.exe
  C:\Windows\System\fyJLZlD.exe
  2⤵
  PID:9720
- C:\Windows\System\xMXJnIP.exe
  C:\Windows\System\xMXJnIP.exe
  2⤵
  PID:9748
- C:\Windows\System\omLPlsQ.exe
  C:\Windows\System\omLPlsQ.exe
  2⤵
  PID:9788
- C:\Windows\System\DVZCFTL.exe
  C:\Windows\System\DVZCFTL.exe
  2⤵
  PID:9804
- C:\Windows\System\MSdhYhY.exe
  C:\Windows\System\MSdhYhY.exe
  2⤵
  PID:9832
- C:\Windows\System\rdgHIVI.exe
  C:\Windows\System\rdgHIVI.exe
  2⤵
  PID:9860
- C:\Windows\System\apNvAPp.exe
  C:\Windows\System\apNvAPp.exe
  2⤵
  PID:9888
- C:\Windows\System\jPIOaoo.exe
  C:\Windows\System\jPIOaoo.exe
  2⤵
  PID:9916
- C:\Windows\System\earrMlM.exe
  C:\Windows\System\earrMlM.exe
  2⤵
  PID:9944
- C:\Windows\System\BShdBHK.exe
  C:\Windows\System\BShdBHK.exe
  2⤵
  PID:9976
- C:\Windows\System\wZxXiAB.exe
  C:\Windows\System\wZxXiAB.exe
  2⤵
  PID:10000
- C:\Windows\System\dSxtmOg.exe
  C:\Windows\System\dSxtmOg.exe
  2⤵
  PID:10028
- C:\Windows\System\yzdshLr.exe
  C:\Windows\System\yzdshLr.exe
  2⤵
  PID:10056
- C:\Windows\System\zPALRHB.exe
  C:\Windows\System\zPALRHB.exe
  2⤵
  PID:10084
- C:\Windows\System\TFzdzjl.exe
  C:\Windows\System\TFzdzjl.exe
  2⤵
  PID:10112
- C:\Windows\System\AkIsYnY.exe
  C:\Windows\System\AkIsYnY.exe
  2⤵
  PID:10140
- C:\Windows\System\FDRKJja.exe
  C:\Windows\System\FDRKJja.exe
  2⤵
  PID:10168
- C:\Windows\System\OkolOlp.exe
  C:\Windows\System\OkolOlp.exe
  2⤵
  PID:10196
- C:\Windows\System\ERKMiEg.exe
  C:\Windows\System\ERKMiEg.exe
  2⤵
  PID:10224
- C:\Windows\System\jDYVcRa.exe
  C:\Windows\System\jDYVcRa.exe
  2⤵
  PID:9228
- C:\Windows\System\iYgzKCQ.exe
  C:\Windows\System\iYgzKCQ.exe
  2⤵
  PID:9308
- C:\Windows\System\idxiCjK.exe
  C:\Windows\System\idxiCjK.exe
  2⤵
  PID:9376
- C:\Windows\System\DyhCNyd.exe
  C:\Windows\System\DyhCNyd.exe
  2⤵
  PID:9460
- C:\Windows\System\rbEsKZH.exe
  C:\Windows\System\rbEsKZH.exe
  2⤵
  PID:9516
- C:\Windows\System\ZshhisB.exe
  C:\Windows\System\ZshhisB.exe
  2⤵
  PID:9576
- C:\Windows\System\XXfyVen.exe
  C:\Windows\System\XXfyVen.exe
  2⤵
  PID:9648
- C:\Windows\System\TgoNyCD.exe
  C:\Windows\System\TgoNyCD.exe
  2⤵
  PID:9712
- C:\Windows\System\NJypbmP.exe
  C:\Windows\System\NJypbmP.exe
  2⤵
  PID:9784
- C:\Windows\System\qpvtYXK.exe
  C:\Windows\System\qpvtYXK.exe
  2⤵
  PID:9844
- C:\Windows\System\BJUOAdC.exe
  C:\Windows\System\BJUOAdC.exe
  2⤵
  PID:9908
- C:\Windows\System\OnFOcJx.exe
  C:\Windows\System\OnFOcJx.exe
  2⤵
  PID:9968
- C:\Windows\System\tnaOTgr.exe
  C:\Windows\System\tnaOTgr.exe
  2⤵
  PID:10040
- C:\Windows\System\jdkFwEl.exe
  C:\Windows\System\jdkFwEl.exe
  2⤵
  PID:10104
- C:\Windows\System\WWsWExm.exe
  C:\Windows\System\WWsWExm.exe
  2⤵
  PID:10160
- C:\Windows\System\GPkRUgc.exe
  C:\Windows\System\GPkRUgc.exe
  2⤵
  PID:10220
- C:\Windows\System\lcZFwHe.exe
  C:\Windows\System\lcZFwHe.exe
  2⤵
  PID:9336
- C:\Windows\System\xgBtsBG.exe
  C:\Windows\System\xgBtsBG.exe
  2⤵
  PID:9480
- C:\Windows\System\FMPjgTv.exe
  C:\Windows\System\FMPjgTv.exe
  2⤵
  PID:9628
- C:\Windows\System\lyswByy.exe
  C:\Windows\System\lyswByy.exe
  2⤵
  PID:9760
- C:\Windows\System\PDudjGN.exe
  C:\Windows\System\PDudjGN.exe
  2⤵
  PID:4512
- C:\Windows\System\cdXlaQU.exe
  C:\Windows\System\cdXlaQU.exe
  2⤵
  PID:10068
- C:\Windows\System\rxRxLJX.exe
  C:\Windows\System\rxRxLJX.exe
  2⤵
  PID:10208
- C:\Windows\System\xtxpylX.exe
  C:\Windows\System\xtxpylX.exe
  2⤵
  PID:9432
- C:\Windows\System\HLHsxgS.exe
  C:\Windows\System\HLHsxgS.exe
  2⤵
  PID:9828
- C:\Windows\System\PybXwle.exe
  C:\Windows\System\PybXwle.exe
  2⤵
  PID:10192
- C:\Windows\System\pVvUyNQ.exe
  C:\Windows\System\pVvUyNQ.exe
  2⤵
  PID:9740
- C:\Windows\System\bZWjpdU.exe
  C:\Windows\System\bZWjpdU.exe
  2⤵
  PID:10136
- C:\Windows\System\JQYLUem.exe
  C:\Windows\System\JQYLUem.exe
  2⤵
  PID:10260
- C:\Windows\System\OUanXEv.exe
  C:\Windows\System\OUanXEv.exe
  2⤵
  PID:10288
- C:\Windows\System\RbFwPOy.exe
  C:\Windows\System\RbFwPOy.exe
  2⤵
  PID:10316
- C:\Windows\System\jkWrdCy.exe
  C:\Windows\System\jkWrdCy.exe
  2⤵
  PID:10344
- C:\Windows\System\sMssLCH.exe
  C:\Windows\System\sMssLCH.exe
  2⤵
  PID:10372
- C:\Windows\System\JFcdEsP.exe
  C:\Windows\System\JFcdEsP.exe
  2⤵
  PID:10392
- C:\Windows\System\fefLISf.exe
  C:\Windows\System\fefLISf.exe
  2⤵
  PID:10424
- C:\Windows\System\PLENDMX.exe
  C:\Windows\System\PLENDMX.exe
  2⤵
  PID:10460
- C:\Windows\System\RISbRbC.exe
  C:\Windows\System\RISbRbC.exe
  2⤵
  PID:10488
- C:\Windows\System\iswlbPY.exe
  C:\Windows\System\iswlbPY.exe
  2⤵
  PID:10516
- C:\Windows\System\ZRiBcZX.exe
  C:\Windows\System\ZRiBcZX.exe
  2⤵
  PID:10548
- C:\Windows\System\AsaWWhN.exe
  C:\Windows\System\AsaWWhN.exe
  2⤵
  PID:10576
- C:\Windows\System\pRKAdFM.exe
  C:\Windows\System\pRKAdFM.exe
  2⤵
  PID:10604
- C:\Windows\System\LAPHCsE.exe
  C:\Windows\System\LAPHCsE.exe
  2⤵
  PID:10660
- C:\Windows\System\iMtOuHt.exe
  C:\Windows\System\iMtOuHt.exe
  2⤵
  PID:10700
- C:\Windows\System\nbGavaf.exe
  C:\Windows\System\nbGavaf.exe
  2⤵
  PID:10720
- C:\Windows\System\mLGkqGj.exe
  C:\Windows\System\mLGkqGj.exe
  2⤵
  PID:10752
- C:\Windows\System\btPuVnS.exe
  C:\Windows\System\btPuVnS.exe
  2⤵
  PID:10792
- C:\Windows\System\sWBaNSl.exe
  C:\Windows\System\sWBaNSl.exe
  2⤵
  PID:10820
- C:\Windows\System\FPNdPpZ.exe
  C:\Windows\System\FPNdPpZ.exe
  2⤵
  PID:10848
- C:\Windows\System\OgCbjSV.exe
  C:\Windows\System\OgCbjSV.exe
  2⤵
  PID:10880
- C:\Windows\System\reVOuTE.exe
  C:\Windows\System\reVOuTE.exe
  2⤵
  PID:10908
- C:\Windows\System\LxFvEBV.exe
  C:\Windows\System\LxFvEBV.exe
  2⤵
  PID:10940
- C:\Windows\System\IGQvGyp.exe
  C:\Windows\System\IGQvGyp.exe
  2⤵
  PID:10968
- C:\Windows\System\cjmeFWH.exe
  C:\Windows\System\cjmeFWH.exe
  2⤵
  PID:10996
- C:\Windows\System\JXxkeJV.exe
  C:\Windows\System\JXxkeJV.exe
  2⤵
  PID:11024
- C:\Windows\System\CVXGNxs.exe
  C:\Windows\System\CVXGNxs.exe
  2⤵
  PID:11060
- C:\Windows\System\iEvDhuF.exe
  C:\Windows\System\iEvDhuF.exe
  2⤵
  PID:11088
- C:\Windows\System\LOKPKdo.exe
  C:\Windows\System\LOKPKdo.exe
  2⤵
  PID:11120
- C:\Windows\System\mVZpEyV.exe
  C:\Windows\System\mVZpEyV.exe
  2⤵
  PID:11152
- C:\Windows\System\FPlDaKF.exe
  C:\Windows\System\FPlDaKF.exe
  2⤵
  PID:11180
- C:\Windows\System\FsnjSws.exe
  C:\Windows\System\FsnjSws.exe
  2⤵
  PID:11208
- C:\Windows\System\FFVRIJd.exe
  C:\Windows\System\FFVRIJd.exe
  2⤵
  PID:11228
- C:\Windows\System\bwJawOC.exe
  C:\Windows\System\bwJawOC.exe
  2⤵
  PID:11244
- C:\Windows\System\GrJNwxO.exe
  C:\Windows\System\GrJNwxO.exe
  2⤵
  PID:10256
- C:\Windows\System\kIDeweJ.exe
  C:\Windows\System\kIDeweJ.exe
  2⤵
  PID:10308
- C:\Windows\System\HzpKsbh.exe
  C:\Windows\System\HzpKsbh.exe
  2⤵
  PID:10384
- C:\Windows\System\nvIaKuc.exe
  C:\Windows\System\nvIaKuc.exe
  2⤵
  PID:10480
- C:\Windows\System\cznRljR.exe
  C:\Windows\System\cznRljR.exe
  2⤵
  PID:10564
- C:\Windows\System\QVigGeq.exe
  C:\Windows\System\QVigGeq.exe
  2⤵
  PID:10632
- C:\Windows\System\GgnSkTw.exe
  C:\Windows\System\GgnSkTw.exe
  2⤵
  PID:1188
- C:\Windows\System\CgRQgKU.exe
  C:\Windows\System\CgRQgKU.exe
  2⤵
  PID:10712
- C:\Windows\System\WBPowRM.exe
  C:\Windows\System\WBPowRM.exe
  2⤵
  PID:10788
- C:\Windows\System\rAItMzl.exe
  C:\Windows\System\rAItMzl.exe
  2⤵
  PID:10860
- C:\Windows\System\csAgSql.exe
  C:\Windows\System\csAgSql.exe
  2⤵
  PID:5932
- C:\Windows\System\HkxtRSK.exe
  C:\Windows\System\HkxtRSK.exe
  2⤵
  PID:5952
- C:\Windows\System\AdisofU.exe
  C:\Windows\System\AdisofU.exe
  2⤵
  PID:1180
- C:\Windows\System\QAaQfGJ.exe
  C:\Windows\System\QAaQfGJ.exe
  2⤵
  PID:10980
- C:\Windows\System\WOKHzuL.exe
  C:\Windows\System\WOKHzuL.exe
  2⤵
  PID:3248
- C:\Windows\System\NSbPnqV.exe
  C:\Windows\System\NSbPnqV.exe
  2⤵
  PID:11084
- C:\Windows\System\HYLuBDU.exe
  C:\Windows\System\HYLuBDU.exe
  2⤵
  PID:11164
- C:\Windows\System\cSZiQMy.exe
  C:\Windows\System\cSZiQMy.exe
  2⤵
  PID:11204
- C:\Windows\System\PsxIGQQ.exe
  C:\Windows\System\PsxIGQQ.exe
  2⤵
  PID:11260
- C:\Windows\System\RpgMcKC.exe
  C:\Windows\System\RpgMcKC.exe
  2⤵
  PID:10452
- C:\Windows\System\QoxzzsC.exe
  C:\Windows\System\QoxzzsC.exe
  2⤵
  PID:10600
- C:\Windows\System\JdvUDgn.exe
  C:\Windows\System\JdvUDgn.exe
  2⤵
  PID:4860
- C:\Windows\System\rvBFyRK.exe
  C:\Windows\System\rvBFyRK.exe
  2⤵
  PID:10764
- C:\Windows\System\yncndWg.exe
  C:\Windows\System\yncndWg.exe
  2⤵
  PID:5568
- C:\Windows\System\clIHTog.exe
  C:\Windows\System\clIHTog.exe
  2⤵
  PID:4636
- C:\Windows\System\mnQOBfy.exe
  C:\Windows\System\mnQOBfy.exe
  2⤵
  PID:11144
- C:\Windows\System\HPENcbH.exe
  C:\Windows\System\HPENcbH.exe
  2⤵
  PID:11236
- C:\Windows\System\BrTVGSK.exe
  C:\Windows\System\BrTVGSK.exe
  2⤵
  PID:10512
- C:\Windows\System\nbEqmfh.exe
  C:\Windows\System\nbEqmfh.exe
  2⤵
  PID:10892
- C:\Windows\System\UpBrkfS.exe
  C:\Windows\System\UpBrkfS.exe
  2⤵
  PID:11116
- C:\Windows\System\XOAyyfv.exe
  C:\Windows\System\XOAyyfv.exe
  2⤵
  PID:10596
- C:\Windows\System\DzrqdbB.exe
  C:\Windows\System\DzrqdbB.exe
  2⤵
  PID:10328
- C:\Windows\System\iljPlyg.exe
  C:\Windows\System\iljPlyg.exe
  2⤵
  PID:11268
- C:\Windows\System\gphklWH.exe
  C:\Windows\System\gphklWH.exe
  2⤵
  PID:11292
- C:\Windows\System\QJsinix.exe
  C:\Windows\System\QJsinix.exe
  2⤵
  PID:11328
- C:\Windows\System\yazaaXw.exe
  C:\Windows\System\yazaaXw.exe
  2⤵
  PID:11372
- C:\Windows\System\wrjVzal.exe
  C:\Windows\System\wrjVzal.exe
  2⤵
  PID:11388
- C:\Windows\System\lclizIu.exe
  C:\Windows\System\lclizIu.exe
  2⤵
  PID:11424
- C:\Windows\System\fRTiXad.exe
  C:\Windows\System\fRTiXad.exe
  2⤵
  PID:11444
- C:\Windows\System\HpqdZLv.exe
  C:\Windows\System\HpqdZLv.exe
  2⤵
  PID:11480
- C:\Windows\System\gIYYPuD.exe
  C:\Windows\System\gIYYPuD.exe
  2⤵
  PID:11500
- C:\Windows\System\vjbqkzO.exe
  C:\Windows\System\vjbqkzO.exe
  2⤵
  PID:11516
- C:\Windows\System\iioJmlU.exe
  C:\Windows\System\iioJmlU.exe
  2⤵
  PID:11532
- C:\Windows\System\jaRTMwn.exe
  C:\Windows\System\jaRTMwn.exe
  2⤵
  PID:11548
- C:\Windows\System\uBbbzTr.exe
  C:\Windows\System\uBbbzTr.exe
  2⤵
  PID:11564
- C:\Windows\System\RABlcJy.exe
  C:\Windows\System\RABlcJy.exe
  2⤵
  PID:11596
- C:\Windows\System\zTSjEDL.exe
  C:\Windows\System\zTSjEDL.exe
  2⤵
  PID:11648
- C:\Windows\System\PYPfDFw.exe
  C:\Windows\System\PYPfDFw.exe
  2⤵
  PID:11696
- C:\Windows\System\PWkipTw.exe
  C:\Windows\System\PWkipTw.exe
  2⤵
  PID:11740
- C:\Windows\System\bkVklPo.exe
  C:\Windows\System\bkVklPo.exe
  2⤵
  PID:11756
- C:\Windows\System\tMLfyki.exe
  C:\Windows\System\tMLfyki.exe
  2⤵
  PID:11792
- C:\Windows\System\nMbnbOg.exe
  C:\Windows\System\nMbnbOg.exe
  2⤵
  PID:11820
- C:\Windows\System\MVganfT.exe
  C:\Windows\System\MVganfT.exe
  2⤵
  PID:11848
- C:\Windows\System\KclSHpT.exe
  C:\Windows\System\KclSHpT.exe
  2⤵
  PID:11876
- C:\Windows\System\fjiKUGW.exe
  C:\Windows\System\fjiKUGW.exe
  2⤵
  PID:11904
- C:\Windows\System\WVQbSYQ.exe
  C:\Windows\System\WVQbSYQ.exe
  2⤵
  PID:11932
- C:\Windows\System\yRktqdZ.exe
  C:\Windows\System\yRktqdZ.exe
  2⤵
  PID:11960
- C:\Windows\System\FZoAkJm.exe
  C:\Windows\System\FZoAkJm.exe
  2⤵
  PID:11988
- C:\Windows\System\UoDjsUj.exe
  C:\Windows\System\UoDjsUj.exe
  2⤵
  PID:12004
- C:\Windows\System\uOnuqLs.exe
  C:\Windows\System\uOnuqLs.exe
  2⤵
  PID:12032
- C:\Windows\System\UndAcbO.exe
  C:\Windows\System\UndAcbO.exe
  2⤵
  PID:12056
- C:\Windows\System\uoUMpgB.exe
  C:\Windows\System\uoUMpgB.exe
  2⤵
  PID:12076
- C:\Windows\System\oItmvEO.exe
  C:\Windows\System\oItmvEO.exe
  2⤵
  PID:12092
- C:\Windows\System\pFWDFIO.exe
  C:\Windows\System\pFWDFIO.exe
  2⤵
  PID:12116
- C:\Windows\System\cHrfMpC.exe
  C:\Windows\System\cHrfMpC.exe
  2⤵
  PID:12136
- C:\Windows\System\GiOtlZf.exe
  C:\Windows\System\GiOtlZf.exe
  2⤵
  PID:12164
- C:\Windows\System\XVTiBpG.exe
  C:\Windows\System\XVTiBpG.exe
  2⤵
  PID:12192
- C:\Windows\System\YGvCdAi.exe
  C:\Windows\System\YGvCdAi.exe
  2⤵
  PID:12240
- C:\Windows\System\gHXcTLt.exe
  C:\Windows\System\gHXcTLt.exe
  2⤵
  PID:11276
- C:\Windows\System\zRzHBdy.exe
  C:\Windows\System\zRzHBdy.exe
  2⤵
  PID:11368
- C:\Windows\System\sAZZyRh.exe
  C:\Windows\System\sAZZyRh.exe
  2⤵
  PID:11436
- C:\Windows\System\rxmxXju.exe
  C:\Windows\System\rxmxXju.exe
  2⤵
  PID:11488
- C:\Windows\System\dtTVJcT.exe
  C:\Windows\System\dtTVJcT.exe
  2⤵
  PID:11540
- C:\Windows\System\JuyFuRc.exe
  C:\Windows\System\JuyFuRc.exe
  2⤵
  PID:11676
- C:\Windows\System\fMSJmyx.exe
  C:\Windows\System\fMSJmyx.exe
  2⤵
  PID:11776
- C:\Windows\System\DmEFiWv.exe
  C:\Windows\System\DmEFiWv.exe
  2⤵
  PID:11816
- C:\Windows\System\gkHjrNW.exe
  C:\Windows\System\gkHjrNW.exe
  2⤵
  PID:11888
- C:\Windows\System\ChHQxSH.exe
  C:\Windows\System\ChHQxSH.exe
  2⤵
  PID:11952
- C:\Windows\System\wrhsmVX.exe
  C:\Windows\System\wrhsmVX.exe
  2⤵
  PID:12044
- C:\Windows\System\jYzzkHE.exe
  C:\Windows\System\jYzzkHE.exe
  2⤵
  PID:12124
- C:\Windows\System\QSCVHfN.exe
  C:\Windows\System\QSCVHfN.exe
  2⤵
  PID:12104
- C:\Windows\System\jYxWXBd.exe
  C:\Windows\System\jYxWXBd.exe
  2⤵
  PID:12224
- C:\Windows\System\ipdwbvo.exe
  C:\Windows\System\ipdwbvo.exe
  2⤵
  PID:12280
- C:\Windows\System\iFFcrXa.exe
  C:\Windows\System\iFFcrXa.exe
  2⤵
  PID:11412
- C:\Windows\System\oANSTSP.exe
  C:\Windows\System\oANSTSP.exe
  2⤵
  PID:11608
- C:\Windows\System\BtMWOaz.exe
  C:\Windows\System\BtMWOaz.exe
  2⤵
  PID:11752
- C:\Windows\System\ROrRIBI.exe
  C:\Windows\System\ROrRIBI.exe
  2⤵
  PID:11216
- C:\Windows\System\guhDuPm.exe
  C:\Windows\System\guhDuPm.exe
  2⤵
  PID:4660
- C:\Windows\System\siwzZud.exe
  C:\Windows\System\siwzZud.exe
  2⤵
  PID:840
- C:\Windows\System\UFrfDSm.exe
  C:\Windows\System\UFrfDSm.exe
  2⤵
  PID:12000
- C:\Windows\System\lnywltH.exe
  C:\Windows\System\lnywltH.exe
  2⤵
  PID:12148
- C:\Windows\System\xwvqoTD.exe
  C:\Windows\System\xwvqoTD.exe
  2⤵
  PID:12268
- C:\Windows\System\fEXhFWy.exe
  C:\Windows\System\fEXhFWy.exe
  2⤵
  PID:11616
- C:\Windows\System\lhEJJRu.exe
  C:\Windows\System\lhEJJRu.exe
  2⤵
  PID:11788
- C:\Windows\System\DvrhjMI.exe
  C:\Windows\System\DvrhjMI.exe
  2⤵
  PID:11944
- C:\Windows\System\SjgygUF.exe
  C:\Windows\System\SjgygUF.exe
  2⤵
  PID:12208
- C:\Windows\System\GsuQYql.exe
  C:\Windows\System\GsuQYql.exe
  2⤵
  PID:11860
- C:\Windows\System\DVLdBDl.exe
  C:\Windows\System\DVLdBDl.exe
  2⤵
  PID:11108
- C:\Windows\System\TLgetdi.exe
  C:\Windows\System\TLgetdi.exe
  2⤵
  PID:12296
- C:\Windows\System\dWpsrPu.exe
  C:\Windows\System\dWpsrPu.exe
  2⤵
  PID:12324
- C:\Windows\System\iPlsVHj.exe
  C:\Windows\System\iPlsVHj.exe
  2⤵
  PID:12352
- C:\Windows\System\LDSBdaL.exe
  C:\Windows\System\LDSBdaL.exe
  2⤵
  PID:12380
- C:\Windows\System\UZmVNdZ.exe
  C:\Windows\System\UZmVNdZ.exe
  2⤵
  PID:12408
- C:\Windows\System\fvpXhGs.exe
  C:\Windows\System\fvpXhGs.exe
  2⤵
  PID:12436
- C:\Windows\System\DcKGhqG.exe
  C:\Windows\System\DcKGhqG.exe
  2⤵
  PID:12464
- C:\Windows\System\MJrmapg.exe
  C:\Windows\System\MJrmapg.exe
  2⤵
  PID:12492
- C:\Windows\System\XUTZpMJ.exe
  C:\Windows\System\XUTZpMJ.exe
  2⤵
  PID:12520
- C:\Windows\System\JrSbRlq.exe
  C:\Windows\System\JrSbRlq.exe
  2⤵
  PID:12548
- C:\Windows\System\DaXDUpi.exe
  C:\Windows\System\DaXDUpi.exe
  2⤵
  PID:12576
- C:\Windows\System\XOsuaGv.exe
  C:\Windows\System\XOsuaGv.exe
  2⤵
  PID:12604
- C:\Windows\System\GGvCdtY.exe
  C:\Windows\System\GGvCdtY.exe
  2⤵
  PID:12632
- C:\Windows\System\zYnizJY.exe
  C:\Windows\System\zYnizJY.exe
  2⤵
  PID:12660
- C:\Windows\System\tzYrXPb.exe
  C:\Windows\System\tzYrXPb.exe
  2⤵
  PID:12688
- C:\Windows\System\DvIGbrD.exe
  C:\Windows\System\DvIGbrD.exe
  2⤵
  PID:12716
- C:\Windows\System\LuRVLFN.exe
  C:\Windows\System\LuRVLFN.exe
  2⤵
  PID:12744
- C:\Windows\System\RGLdwWp.exe
  C:\Windows\System\RGLdwWp.exe
  2⤵
  PID:12772
- C:\Windows\System\DcZWytq.exe
  C:\Windows\System\DcZWytq.exe
  2⤵
  PID:12800
- C:\Windows\System\zvFItKI.exe
  C:\Windows\System\zvFItKI.exe
  2⤵
  PID:12828
- C:\Windows\System\kdxiLTP.exe
  C:\Windows\System\kdxiLTP.exe
  2⤵
  PID:12856
- C:\Windows\System\AZzQgDC.exe
  C:\Windows\System\AZzQgDC.exe
  2⤵
  PID:12884
- C:\Windows\System\pXjnNRE.exe
  C:\Windows\System\pXjnNRE.exe
  2⤵
  PID:12912
- C:\Windows\System\iiQtfZk.exe
  C:\Windows\System\iiQtfZk.exe
  2⤵
  PID:12944
- C:\Windows\System\EDhZIyM.exe
  C:\Windows\System\EDhZIyM.exe
  2⤵
  PID:12972
- C:\Windows\System\JebbUhs.exe
  C:\Windows\System\JebbUhs.exe
  2⤵
  PID:13000
- C:\Windows\System\cFsshAU.exe
  C:\Windows\System\cFsshAU.exe
  2⤵
  PID:13028
- C:\Windows\System\eJOqjzt.exe
  C:\Windows\System\eJOqjzt.exe
  2⤵
  PID:13056
- C:\Windows\System\dTzjOwU.exe
  C:\Windows\System\dTzjOwU.exe
  2⤵
  PID:13084
- C:\Windows\System\HMDffWY.exe
  C:\Windows\System\HMDffWY.exe
  2⤵
  PID:13112
- C:\Windows\System\WZVDlIx.exe
  C:\Windows\System\WZVDlIx.exe
  2⤵
  PID:12712
- C:\Windows\System\FIquXTV.exe
  C:\Windows\System\FIquXTV.exe
  2⤵
  PID:12756
- C:\Windows\System\hOwgSAf.exe
  C:\Windows\System\hOwgSAf.exe
  2⤵
  PID:12848
- C:\Windows\System\JwUOFTa.exe
  C:\Windows\System\JwUOFTa.exe
  2⤵
  PID:4028
- C:\Windows\System\eNhBtoW.exe
  C:\Windows\System\eNhBtoW.exe
  2⤵
  PID:12996
- C:\Windows\System\JYpmhIX.exe
  C:\Windows\System\JYpmhIX.exe
  2⤵
  PID:13080
- C:\Windows\System\jiozyCg.exe
  C:\Windows\System\jiozyCg.exe
  2⤵
  PID:13124
- C:\Windows\System\GEYyRRg.exe
  C:\Windows\System\GEYyRRg.exe
  2⤵
  PID:13200
- C:\Windows\System\QeYRfKL.exe
  C:\Windows\System\QeYRfKL.exe
  2⤵
  PID:13216
- C:\Windows\System\ohfRTRQ.exe
  C:\Windows\System\ohfRTRQ.exe
  2⤵
  PID:13244
- C:\Windows\System\qKGLIIa.exe
  C:\Windows\System\qKGLIIa.exe
  2⤵
  PID:13284
- C:\Windows\System\ZVbpZAL.exe
  C:\Windows\System\ZVbpZAL.exe
  2⤵
  PID:12292
- C:\Windows\System\OtnlgIw.exe
  C:\Windows\System\OtnlgIw.exe
  2⤵
  PID:12348
- C:\Windows\System\TgmZhYC.exe
  C:\Windows\System\TgmZhYC.exe
  2⤵
  PID:12428
- C:\Windows\System\JszSIyw.exe
  C:\Windows\System\JszSIyw.exe
  2⤵
  PID:12476
- C:\Windows\System\rbQDzda.exe
  C:\Windows\System\rbQDzda.exe
  2⤵
  PID:4304
- C:\Windows\System\YsjpSQC.exe
  C:\Windows\System\YsjpSQC.exe
  2⤵
  PID:12572
- C:\Windows\System\OyWBwIV.exe
  C:\Windows\System\OyWBwIV.exe
  2⤵
  PID:12644
- C:\Windows\System\exabahN.exe
  C:\Windows\System\exabahN.exe
  2⤵
  PID:12700
- C:\Windows\System\llCevTc.exe
  C:\Windows\System\llCevTc.exe
  2⤵
  PID:12876
- C:\Windows\System\MzheKAM.exe
  C:\Windows\System\MzheKAM.exe
  2⤵
  PID:12968
- C:\Windows\System\CQAdxni.exe
  C:\Windows\System\CQAdxni.exe
  2⤵
  PID:13196
- C:\Windows\System\HtBibfp.exe
  C:\Windows\System\HtBibfp.exe
  2⤵
  PID:13256
- C:\Windows\System\XUSaJsN.exe
  C:\Windows\System\XUSaJsN.exe
  2⤵
  PID:12376
- C:\Windows\System\MvBnMyw.exe
  C:\Windows\System\MvBnMyw.exe
  2⤵
  PID:12544
- C:\Windows\System\eqXVqop.exe
  C:\Windows\System\eqXVqop.exe
  2⤵
  PID:12740
- C:\Windows\System\sUByPZk.exe
  C:\Windows\System\sUByPZk.exe
  2⤵
  PID:13052
- C:\Windows\System\zyiBgGA.exe
  C:\Windows\System\zyiBgGA.exe
  2⤵
  PID:1832
- C:\Windows\System\IMAooEE.exe
  C:\Windows\System\IMAooEE.exe
  2⤵
  PID:13296
- C:\Windows\System\jrdyXDh.exe
  C:\Windows\System\jrdyXDh.exe
  2⤵
  PID:4620
- C:\Windows\System\DttGKPK.exe
  C:\Windows\System\DttGKPK.exe
  2⤵
  PID:12812
- C:\Windows\System\mdRtVSI.exe
  C:\Windows\System\mdRtVSI.exe
  2⤵
  PID:13272
- C:\Windows\System\ZxsgRkX.exe
  C:\Windows\System\ZxsgRkX.exe
  2⤵
  PID:12484
- C:\Windows\System\KeZQewx.exe
  C:\Windows\System\KeZQewx.exe
  2⤵
  PID:3612
- C:\Windows\System\jcrEPTI.exe
  C:\Windows\System\jcrEPTI.exe
  2⤵
  PID:432
- C:\Windows\System\mCLbtPM.exe
  C:\Windows\System\mCLbtPM.exe
  2⤵
  PID:4812
- C:\Windows\System\evjwUwW.exe
  C:\Windows\System\evjwUwW.exe
  2⤵
  PID:13076
- C:\Windows\System\XyzRGwy.exe
  C:\Windows\System\XyzRGwy.exe
  2⤵
  PID:3744
- C:\Windows\System\tmZGfux.exe
  C:\Windows\System\tmZGfux.exe
  2⤵
  PID:3732
- C:\Windows\System\DIhDSzl.exe
  C:\Windows\System\DIhDSzl.exe
  2⤵
  PID:13240
- C:\Windows\System\dYzgyjm.exe
  C:\Windows\System\dYzgyjm.exe
  2⤵
  PID:2688
- C:\Windows\System\GhhudUw.exe
  C:\Windows\System\GhhudUw.exe
  2⤵
  PID:12680
- C:\Windows\System\QLaYxZz.exe
  C:\Windows\System\QLaYxZz.exe
  2⤵
  PID:12372
- C:\Windows\System\sOTxLRo.exe
  C:\Windows\System\sOTxLRo.exe
  2⤵
  PID:1956
- C:\Windows\System\HzyNZnb.exe
  C:\Windows\System\HzyNZnb.exe
  2⤵
  PID:4760
- C:\Windows\System\WADvWJe.exe
  C:\Windows\System\WADvWJe.exe
  2⤵
  PID:1460
- C:\Windows\System\SGfZVsd.exe
  C:\Windows\System\SGfZVsd.exe
  2⤵
  PID:2952
- C:\Windows\System\nolieTJ.exe
  C:\Windows\System\nolieTJ.exe
  2⤵
  PID:228
- C:\Windows\System\hrwGuyy.exe
  C:\Windows\System\hrwGuyy.exe
  2⤵
  PID:3192
- C:\Windows\System\jfeAXMY.exe
  C:\Windows\System\jfeAXMY.exe
  2⤵
  PID:4904
- C:\Windows\System\MLlmveh.exe
  C:\Windows\System\MLlmveh.exe
  2⤵
  PID:4996
- C:\Windows\System\ctNMqwV.exe
  C:\Windows\System\ctNMqwV.exe
  2⤵
  PID:13276
- C:\Windows\System\MmcjeTF.exe
  C:\Windows\System\MmcjeTF.exe
  2⤵
  PID:32
- C:\Windows\System\DFNOPUi.exe
  C:\Windows\System\DFNOPUi.exe
  2⤵
  PID:4092
- C:\Windows\System\zoDWbPn.exe
  C:\Windows\System\zoDWbPn.exe
  2⤵
  PID:6260
- C:\Windows\System\nPILfzx.exe
  C:\Windows\System\nPILfzx.exe
  2⤵
  PID:1520
- C:\Windows\System\yFomZcL.exe
  C:\Windows\System\yFomZcL.exe
  2⤵
  PID:1408
- C:\Windows\System\pUmxohG.exe
  C:\Windows\System\pUmxohG.exe
  2⤵
  PID:6452
- C:\Windows\System\sNbHNiz.exe
  C:\Windows\System\sNbHNiz.exe
  2⤵
  PID:7188
- C:\Windows\System\flfTAeU.exe
  C:\Windows\System\flfTAeU.exe
  2⤵
  PID:6788
- C:\Windows\System\ztFVULC.exe
  C:\Windows\System\ztFVULC.exe
  2⤵
  PID:6528
- C:\Windows\System\BSVWoDk.exe
  C:\Windows\System\BSVWoDk.exe
  2⤵
  PID:3668
- C:\Windows\System\taLaNRH.exe
  C:\Windows\System\taLaNRH.exe
  2⤵
  PID:7848
- C:\Windows\System\BIFFtzt.exe
  C:\Windows\System\BIFFtzt.exe
  2⤵
  PID:4524
- C:\Windows\System\kjpKHuQ.exe
  C:\Windows\System\kjpKHuQ.exe
  2⤵
  PID:6628
- C:\Windows\System\wnNxQyF.exe
  C:\Windows\System\wnNxQyF.exe
  2⤵
  PID:1592
- C:\Windows\System\PtKGALd.exe
  C:\Windows\System\PtKGALd.exe
  2⤵
  PID:7964
- C:\Windows\System\tUufEAo.exe
  C:\Windows\System\tUufEAo.exe
  2⤵
  PID:2940
- C:\Windows\System\jcYVxag.exe
  C:\Windows\System\jcYVxag.exe
  2⤵
  PID:8048
- C:\Windows\System\YbpLPaV.exe
  C:\Windows\System\YbpLPaV.exe
  2⤵
  PID:8132
- C:\Windows\System\dqglcEy.exe
  C:\Windows\System\dqglcEy.exe
  2⤵
  PID:7288
- C:\Windows\System\BjUUZHJ.exe
  C:\Windows\System\BjUUZHJ.exe
  2⤵
  PID:7488
- C:\Windows\System\eyMgWEx.exe
  C:\Windows\System\eyMgWEx.exe
  2⤵
  PID:7676
- C:\Windows\System\FrWdtMO.exe
  C:\Windows\System\FrWdtMO.exe
  2⤵
  PID:7864
- C:\Windows\System\yqVUomU.exe
  C:\Windows\System\yqVUomU.exe
  2⤵
  PID:8080
- C:\Windows\System\tfLwsuv.exe
  C:\Windows\System\tfLwsuv.exe
  2⤵
  PID:7544
- C:\Windows\System\kyqyuqf.exe
  C:\Windows\System\kyqyuqf.exe
  2⤵
  PID:7972
- C:\Windows\System\ljQRyQu.exe
  C:\Windows\System\ljQRyQu.exe
  2⤵
  PID:7564
- C:\Windows\System\VmqBGvz.exe
  C:\Windows\System\VmqBGvz.exe
  2⤵
  PID:7240
- C:\Windows\System\RwzWTYA.exe
  C:\Windows\System\RwzWTYA.exe
  2⤵
  PID:8296
- C:\Windows\System\eecvzSJ.exe
  C:\Windows\System\eecvzSJ.exe
  2⤵
  PID:8380
- C:\Windows\System\ATLXPhM.exe
  C:\Windows\System\ATLXPhM.exe
  2⤵
  PID:8484
- C:\Windows\System\RhnpPTp.exe
  C:\Windows\System\RhnpPTp.exe
  2⤵
  PID:8568
- C:\Windows\System\SQPshnu.exe
  C:\Windows\System\SQPshnu.exe
  2⤵
  PID:3048
- C:\Windows\System\uApEqLe.exe
  C:\Windows\System\uApEqLe.exe
  2⤵
  PID:8764
- C:\Windows\System\NKGhhCY.exe
  C:\Windows\System\NKGhhCY.exe
  2⤵
  PID:5320
- C:\Windows\System\dybatRt.exe
  C:\Windows\System\dybatRt.exe
  2⤵
  PID:6624
- C:\Windows\System\tqiGJuS.exe
  C:\Windows\System\tqiGJuS.exe
  2⤵
  PID:8860
- C:\Windows\System\CUHQPje.exe
  C:\Windows\System\CUHQPje.exe
  2⤵
  PID:8880
- C:\Windows\System\muLRcOo.exe
  C:\Windows\System\muLRcOo.exe
  2⤵
  PID:3520
- C:\Windows\System\yjEBDUA.exe
  C:\Windows\System\yjEBDUA.exe
  2⤵
  PID:6812
- C:\Windows\System\OdMkVux.exe
  C:\Windows\System\OdMkVux.exe
  2⤵
  PID:6820
- C:\Windows\System\esOgKiF.exe
  C:\Windows\System\esOgKiF.exe
  2⤵
  PID:8992
- C:\Windows\System\soMzyyc.exe
  C:\Windows\System\soMzyyc.exe
  2⤵
  PID:7160
- C:\Windows\System\AtdxPfQ.exe
  C:\Windows\System\AtdxPfQ.exe
  2⤵
  PID:3864
- C:\Windows\System\wknlwaJ.exe
  C:\Windows\System\wknlwaJ.exe
  2⤵
  PID:9076
- C:\Windows\System\vnXuUmM.exe
  C:\Windows\System\vnXuUmM.exe
  2⤵
  PID:4456
- C:\Windows\System\zbuFknm.exe
  C:\Windows\System\zbuFknm.exe
  2⤵
  PID:5464
- C:\Windows\System\RiDhGhK.exe
  C:\Windows\System\RiDhGhK.exe
  2⤵
  PID:6952
- C:\Windows\System\CqhxnjY.exe
  C:\Windows\System\CqhxnjY.exe
  2⤵
  PID:12624
- C:\Windows\System\rXoIgti.exe
  C:\Windows\System\rXoIgti.exe
  2⤵
  PID:6212
- C:\Windows\System\YqWvOJk.exe
  C:\Windows\System\YqWvOJk.exe
  2⤵
  PID:4800
- C:\Windows\System\MHPOgTX.exe
  C:\Windows\System\MHPOgTX.exe
  2⤵
  PID:6972
- C:\Windows\System\IbInSgW.exe
  C:\Windows\System\IbInSgW.exe
  2⤵
  PID:8600
- C:\Windows\System\KNlWHnh.exe
  C:\Windows\System\KNlWHnh.exe
  2⤵
  PID:64
- C:\Windows\System\fdgtSdb.exe
  C:\Windows\System\fdgtSdb.exe
  2⤵
  PID:5876
- C:\Windows\System\KwEkPsM.exe
  C:\Windows\System\KwEkPsM.exe
  2⤵
  PID:4828
- C:\Windows\System\cZlcDfN.exe
  C:\Windows\System\cZlcDfN.exe
  2⤵
  PID:8864
- C:\Windows\System\ejsnlqZ.exe
  C:\Windows\System\ejsnlqZ.exe
  2⤵
  PID:7052
- C:\Windows\System\TYZvPVz.exe
  C:\Windows\System\TYZvPVz.exe
  2⤵
  PID:7276
- C:\Windows\System\DxZMzQu.exe
  C:\Windows\System\DxZMzQu.exe
  2⤵
  PID:5700
- C:\Windows\System\JKldwPf.exe
  C:\Windows\System\JKldwPf.exe
  2⤵
  PID:7080
- C:\Windows\System\YjcYqHl.exe
  C:\Windows\System\YjcYqHl.exe
  2⤵
  PID:5232
- C:\Windows\System\rClRzEB.exe
  C:\Windows\System\rClRzEB.exe
  2⤵
  PID:5476
- C:\Windows\System\bwvaoKn.exe
  C:\Windows\System\bwvaoKn.exe
  2⤵
  PID:7136
- C:\Windows\System\OvoiUyy.exe
  C:\Windows\System\OvoiUyy.exe
  2⤵
  PID:5588
- C:\Windows\System\JLCSYCe.exe
  C:\Windows\System\JLCSYCe.exe
  2⤵
  PID:7392
- C:\Windows\System\QBBayGD.exe
  C:\Windows\System\QBBayGD.exe
  2⤵
  PID:9052
- C:\Windows\System\pMxySnP.exe
  C:\Windows\System\pMxySnP.exe
  2⤵
  PID:3648
- C:\Windows\System\ALKQZEM.exe
  C:\Windows\System\ALKQZEM.exe
  2⤵
  PID:6188
- C:\Windows\System\eLYApWA.exe
  C:\Windows\System\eLYApWA.exe
  2⤵
  PID:6104
- C:\Windows\System\SQAgXRG.exe
  C:\Windows\System\SQAgXRG.exe
  2⤵
  PID:7472
- C:\Windows\System\ewPrDWy.exe
  C:\Windows\System\ewPrDWy.exe
  2⤵
  PID:8572
- C:\Windows\System\lTEzQOQ.exe
  C:\Windows\System\lTEzQOQ.exe
  2⤵
  PID:9244
- C:\Windows\System\WecuEyp.exe
  C:\Windows\System\WecuEyp.exe
  2⤵
  PID:3032
- C:\Windows\System\oguFhlp.exe
  C:\Windows\System\oguFhlp.exe
  2⤵
  PID:7560
- C:\Windows\System\NVhgoFu.exe
  C:\Windows\System\NVhgoFu.exe
  2⤵
  PID:5172
- C:\Windows\System\ykCroyM.exe
  C:\Windows\System\ykCroyM.exe
  2⤵
  PID:4924
- C:\Windows\System\rTwMRhX.exe
  C:\Windows\System\rTwMRhX.exe
  2⤵
  PID:9332
- C:\Windows\System\VdRgXZW.exe
  C:\Windows\System\VdRgXZW.exe
  2⤵
  PID:1852
- C:\Windows\System\YfrqESz.exe
  C:\Windows\System\YfrqESz.exe
  2⤵
  PID:6564
- C:\Windows\System\cPgrHos.exe
  C:\Windows\System\cPgrHos.exe
  2⤵
  PID:9392
- C:\Windows\System\PIUPtvr.exe
  C:\Windows\System\PIUPtvr.exe
  2⤵
  PID:6688
- C:\Windows\System\RhFmCrC.exe
  C:\Windows\System\RhFmCrC.exe
  2⤵
  PID:6500
- C:\Windows\System\FztTzpX.exe
  C:\Windows\System\FztTzpX.exe
  2⤵
  PID:9448
- C:\Windows\System\wakUioC.exe
  C:\Windows\System\wakUioC.exe
  2⤵
  PID:4652
- C:\Windows\System\pXguEMP.exe
  C:\Windows\System\pXguEMP.exe
  2⤵
  PID:7756
- C:\Windows\System\XkXRuGy.exe
  C:\Windows\System\XkXRuGy.exe
  2⤵
  PID:9540
- C:\Windows\System\uOLZUmU.exe
  C:\Windows\System\uOLZUmU.exe
  2⤵
  PID:9560
- C:\Windows\System\ggQHLzR.exe
  C:\Windows\System\ggQHLzR.exe
  2⤵
  PID:6932
- C:\Windows\System\HZBUlGT.exe
  C:\Windows\System\HZBUlGT.exe
  2⤵
  PID:5836
- C:\Windows\System\ZBhnTwP.exe
  C:\Windows\System\ZBhnTwP.exe
  2⤵
  PID:7900
- C:\Windows\System\RbbIZnh.exe
  C:\Windows\System\RbbIZnh.exe
  2⤵
  PID:6040
- C:\Windows\System\mtrznhz.exe
  C:\Windows\System\mtrznhz.exe
  2⤵
  PID:3300
- C:\Windows\System\EeZSkIe.exe
  C:\Windows\System\EeZSkIe.exe
  2⤵
  PID:9904
- C:\Windows\System\PdQBMvA.exe
  C:\Windows\System\PdQBMvA.exe
  2⤵
  PID:9972
- C:\Windows\System\jgdsVin.exe
  C:\Windows\System\jgdsVin.exe
  2⤵
  PID:6108
- C:\Windows\System\KbSejFU.exe
  C:\Windows\System\KbSejFU.exe
  2⤵
  PID:10044
- C:\Windows\System\aCVDuAQ.exe
  C:\Windows\System\aCVDuAQ.exe
  2⤵
  PID:10092
- C:\Windows\System\NvNRSSM.exe
  C:\Windows\System\NvNRSSM.exe
  2⤵
  PID:10148
- C:\Windows\System\GqwssPX.exe
  C:\Windows\System\GqwssPX.exe
  2⤵
  PID:8056
- C:\Windows\System\pTeOLWf.exe
  C:\Windows\System\pTeOLWf.exe
  2⤵
  PID:8140
- C:\Windows\System\GPAbPEu.exe
  C:\Windows\System\GPAbPEu.exe
  2⤵
  PID:7212
- C:\Windows\System\aANHDeV.exe
  C:\Windows\System\aANHDeV.exe
  2⤵
  PID:9536
- C:\Windows\System\UdwGSSq.exe
  C:\Windows\System\UdwGSSq.exe
  2⤵
  PID:9660
- C:\Windows\System\PjbaLSC.exe
  C:\Windows\System\PjbaLSC.exe
  2⤵
  PID:8172
- C:\Windows\System\PsTGYtP.exe
  C:\Windows\System\PsTGYtP.exe
  2⤵
  PID:7684
- C:\Windows\System\JcxVNnO.exe
  C:\Windows\System\JcxVNnO.exe
  2⤵
  PID:4888
- C:\Windows\System\ddzSoFw.exe
  C:\Windows\System\ddzSoFw.exe
  2⤵
  PID:10052
- C:\Windows\System\jPXiuHJ.exe
  C:\Windows\System\jPXiuHJ.exe
  2⤵
  PID:10188
- C:\Windows\System\WkQEiYW.exe
  C:\Windows\System\WkQEiYW.exe
  2⤵
  PID:8324
- C:\Windows\System\yBLManF.exe
  C:\Windows\System\yBLManF.exe
  2⤵
  PID:9704
- C:\Windows\System\KUjBvOD.exe
  C:\Windows\System\KUjBvOD.exe
  2⤵
  PID:9996
- C:\Windows\System\KPnvFWF.exe
  C:\Windows\System\KPnvFWF.exe
  2⤵
  PID:1988
- C:\Windows\System\LxEAuFh.exe
  C:\Windows\System\LxEAuFh.exe
  2⤵
  PID:8688
- C:\Windows\System\lowbxMt.exe
  C:\Windows\System\lowbxMt.exe
  2⤵
  PID:9288
- C:\Windows\System\ifRzOoS.exe
  C:\Windows\System\ifRzOoS.exe
  2⤵
  PID:3880
- C:\Windows\System\XqOgfqB.exe
  C:\Windows\System\XqOgfqB.exe
  2⤵
  PID:8820
- C:\Windows\System\elBTTfJ.exe
  C:\Windows\System\elBTTfJ.exe
  2⤵
  PID:6700
- C:\Windows\System\iMMgRWn.exe
  C:\Windows\System\iMMgRWn.exe
  2⤵
  PID:10400
- C:\Windows\System\EaDwWAW.exe
  C:\Windows\System\EaDwWAW.exe
  2⤵
  PID:6128
- C:\Windows\System\xiIUapt.exe
  C:\Windows\System\xiIUapt.exe
  2⤵
  PID:10504
- C:\Windows\System\ASNCkqo.exe
  C:\Windows\System\ASNCkqo.exe
  2⤵
  PID:10556
- C:\Windows\System\lROMTpl.exe
  C:\Windows\System\lROMTpl.exe
  2⤵
  PID:2188
- C:\Windows\System\zLplonl.exe
  C:\Windows\System\zLplonl.exe
  2⤵
  PID:10644
- C:\Windows\System\HhRIjHL.exe
  C:\Windows\System\HhRIjHL.exe
  2⤵
  PID:5436
- C:\Windows\System\BvrIcmx.exe
  C:\Windows\System\BvrIcmx.exe
  2⤵
  PID:10760
- C:\Windows\System\FEcjYrH.exe
  C:\Windows\System\FEcjYrH.exe
  2⤵
  PID:5364
- C:\Windows\System\ZbACDyh.exe
  C:\Windows\System\ZbACDyh.exe
  2⤵
  PID:1416
- C:\Windows\System\fkCyQPw.exe
  C:\Windows\System\fkCyQPw.exe
  2⤵
  PID:428
- C:\Windows\System\pTtKiFB.exe
  C:\Windows\System\pTtKiFB.exe
  2⤵
  PID:11004
- C:\Windows\System\nDKnAOO.exe
  C:\Windows\System\nDKnAOO.exe
  2⤵
  PID:4968
- C:\Windows\System\oDfoxdj.exe
  C:\Windows\System\oDfoxdj.exe
  2⤵
  PID:8320
- C:\Windows\System\XgYJohU.exe
  C:\Windows\System\XgYJohU.exe
  2⤵
  PID:11196
- C:\Windows\System\wxZVLyV.exe
  C:\Windows\System\wxZVLyV.exe
  2⤵
  PID:8724
- C:\Windows\System\KuBArbc.exe
  C:\Windows\System\KuBArbc.exe
  2⤵
  PID:10416
- C:\Windows\System\OdDLcrN.exe
  C:\Windows\System\OdDLcrN.exe
  2⤵
  PID:10588
- C:\Windows\System\ghhtmTm.exe
  C:\Windows\System\ghhtmTm.exe
  2⤵
  PID:6696
- C:\Windows\System\COfbqpG.exe
  C:\Windows\System\COfbqpG.exe
  2⤵
  PID:7068
- C:\Windows\System\fORKLCM.exe
  C:\Windows\System\fORKLCM.exe
  2⤵
  PID:8924
- C:\Windows\System\MXiHiRL.exe
  C:\Windows\System\MXiHiRL.exe
  2⤵
  PID:5196
- C:\Windows\System\DqjnIbl.exe
  C:\Windows\System\DqjnIbl.exe
  2⤵
  PID:9140
- C:\Windows\System\JBrrYIM.exe
  C:\Windows\System\JBrrYIM.exe
  2⤵
  PID:11224
- C:\Windows\System\HucYCZQ.exe
  C:\Windows\System\HucYCZQ.exe
  2⤵
  PID:10436
- C:\Windows\System\ESivPgn.exe
  C:\Windows\System\ESivPgn.exe
  2⤵
  PID:3948
- C:\Windows\System\QCpcbRK.exe
  C:\Windows\System\QCpcbRK.exe
  2⤵
  PID:10840
- C:\Windows\System\MYwKkZM.exe
  C:\Windows\System\MYwKkZM.exe
  2⤵
  PID:6208
- C:\Windows\System\JXqmlsr.exe
  C:\Windows\System\JXqmlsr.exe
  2⤵
  PID:5620
- C:\Windows\System\vqhwZzl.exe
  C:\Windows\System\vqhwZzl.exe
  2⤵
  PID:1160
- C:\Windows\System\GngjpLc.exe
  C:\Windows\System\GngjpLc.exe
  2⤵
  PID:3188
- C:\Windows\System\HtACbHs.exe
  C:\Windows\System\HtACbHs.exe
  2⤵
  PID:10528
- C:\Windows\System\TRHNuBP.exe
  C:\Windows\System\TRHNuBP.exe
  2⤵
  PID:4756
- C:\Windows\System\mPWXWmU.exe
  C:\Windows\System\mPWXWmU.exe
  2⤵
  PID:9224
- C:\Windows\System\zUEjahj.exe
  C:\Windows\System\zUEjahj.exe
  2⤵
  PID:11404
- C:\Windows\System\QoPbbew.exe
  C:\Windows\System\QoPbbew.exe
  2⤵
  PID:7568
- C:\Windows\System\XEyLuIt.exe
  C:\Windows\System\XEyLuIt.exe
  2⤵
  PID:6468
- C:\Windows\System\KnCqskd.exe
  C:\Windows\System\KnCqskd.exe
  2⤵
  PID:13156
- C:\Windows\System\SrLGIpE.exe
  C:\Windows\System\SrLGIpE.exe
  2⤵
  PID:7624
- C:\Windows\System\NuWHihK.exe
  C:\Windows\System\NuWHihK.exe
  2⤵
  PID:11680
- C:\Windows\System\QHpceiX.exe
  C:\Windows\System\QHpceiX.exe
  2⤵
  PID:6472
- C:\Windows\System\YczJoIs.exe
  C:\Windows\System\YczJoIs.exe
  2⤵
  PID:11800
- C:\Windows\System\bOkxEVL.exe
  C:\Windows\System\bOkxEVL.exe
  2⤵
  PID:11864
- C:\Windows\System\XkPxdqf.exe
  C:\Windows\System\XkPxdqf.exe
  2⤵
  PID:11912
- C:\Windows\System\kVIjVAb.exe
  C:\Windows\System\kVIjVAb.exe
  2⤵
  PID:9476
- C:\Windows\System\kobeUWM.exe
  C:\Windows\System\kobeUWM.exe
  2⤵
  PID:7784
- C:\Windows\System\MUnoLmz.exe
  C:\Windows\System\MUnoLmz.exe
  2⤵
  PID:12100
- C:\Windows\System\SYRfdwN.exe
  C:\Windows\System\SYRfdwN.exe
  2⤵
  PID:12200
- C:\Windows\System\zYlyhXv.exe
  C:\Windows\System\zYlyhXv.exe
  2⤵
  PID:5936
- C:\Windows\System\SFQOair.exe
  C:\Windows\System\SFQOair.exe
  2⤵
  PID:2652
- C:\Windows\System\BVpFxMu.exe
  C:\Windows\System\BVpFxMu.exe
  2⤵
  PID:9812
- C:\Windows\System\Kkvnmse.exe
  C:\Windows\System\Kkvnmse.exe
  2⤵
  PID:11560
- C:\Windows\System\mZoGige.exe
  C:\Windows\System\mZoGige.exe
  2⤵
  PID:11784
- C:\Windows\System\cpDfwBI.exe
  C:\Windows\System\cpDfwBI.exe
  2⤵
  PID:11900
- C:\Windows\System\KbVGWsA.exe
  C:\Windows\System\KbVGWsA.exe
  2⤵
  PID:12020
- C:\Windows\System\waFBmkT.exe
  C:\Windows\System\waFBmkT.exe
  2⤵
  PID:8000
- C:\Windows\System\DFHklbZ.exe
  C:\Windows\System\DFHklbZ.exe
  2⤵
  PID:11352
- C:\Windows\System\rrQEKxO.exe
  C:\Windows\System\rrQEKxO.exe
  2⤵
  PID:11544
- C:\Windows\System\jIHKGKa.exe
  C:\Windows\System\jIHKGKa.exe
  2⤵
  PID:10780
- C:\Windows\System\WijUTyy.exe
  C:\Windows\System\WijUTyy.exe
  2⤵
  PID:9396
- C:\Windows\System\tPbgmWc.exe
  C:\Windows\System\tPbgmWc.exe
  2⤵
  PID:11624
- C:\Windows\System\nTyRQuG.exe
  C:\Windows\System\nTyRQuG.exe
  2⤵
  PID:9684
- C:\Windows\System\hPNjLXD.exe
  C:\Windows\System\hPNjLXD.exe
  2⤵
  PID:2396
- C:\Windows\System\udJmRNX.exe
  C:\Windows\System\udJmRNX.exe
  2⤵
  PID:11768
- C:\Windows\System\yGzmrLx.exe
  C:\Windows\System\yGzmrLx.exe
  2⤵
  PID:12088
- C:\Windows\System\NOyWPYm.exe
  C:\Windows\System\NOyWPYm.exe
  2⤵
  PID:7376
- C:\Windows\System\HetrtES.exe
  C:\Windows\System\HetrtES.exe
  2⤵
  PID:12416
- C:\Windows\System\fQYYKbr.exe
  C:\Windows\System\fQYYKbr.exe
  2⤵
  PID:12500
- C:\Windows\System\dKMbpQF.exe
  C:\Windows\System\dKMbpQF.exe
  2⤵
  PID:10132
- C:\Windows\System\aNTBYmF.exe
  C:\Windows\System\aNTBYmF.exe
  2⤵
  PID:9260
- C:\Windows\System\Sulajbp.exe
  C:\Windows\System\Sulajbp.exe
  2⤵
  PID:8372
- C:\Windows\System\OUazjwt.exe
  C:\Windows\System\OUazjwt.exe
  2⤵
  PID:12788
- C:\Windows\System\IWmuRHZ.exe
  C:\Windows\System\IWmuRHZ.exe
  2⤵
  PID:12844
- C:\Windows\System\KMwMsyt.exe
  C:\Windows\System\KMwMsyt.exe
  2⤵
  PID:12900
- C:\Windows\System\KMvjXuj.exe
  C:\Windows\System\KMvjXuj.exe
  2⤵
  PID:12952
- C:\Windows\System\zOijPiw.exe
  C:\Windows\System\zOijPiw.exe
  2⤵
  PID:13008
- C:\Windows\System\KSbfkqx.exe
  C:\Windows\System\KSbfkqx.exe
  2⤵
  PID:10268
- C:\Windows\System\NZozANH.exe
  C:\Windows\System\NZozANH.exe
  2⤵
  PID:13120
- C:\Windows\System\SnDctKv.exe
  C:\Windows\System\SnDctKv.exe
  2⤵
  PID:10420
- C:\Windows\System\OIWgUhF.exe
  C:\Windows\System\OIWgUhF.exe
  2⤵
  PID:5376
- C:\Windows\System\sUNonLH.exe
  C:\Windows\System\sUNonLH.exe
  2⤵
  PID:10612
- C:\Windows\System\lbTOvPs.exe
  C:\Windows\System\lbTOvPs.exe
  2⤵
  PID:10800
- C:\Windows\System\NisscdF.exe
  C:\Windows\System\NisscdF.exe
  2⤵
  PID:4276
- C:\Windows\System\EdcNvSj.exe
  C:\Windows\System\EdcNvSj.exe
  2⤵
  PID:3552
- C:\Windows\System\eWjpXdd.exe
  C:\Windows\System\eWjpXdd.exe
  2⤵
  PID:10888
- C:\Windows\System\HoldZLw.exe
  C:\Windows\System\HoldZLw.exe
  2⤵
  PID:10976
- C:\Windows\System\DIZazch.exe
  C:\Windows\System\DIZazch.exe
  2⤵
  PID:8272
- C:\Windows\System\PviVFTg.exe
  C:\Windows\System\PviVFTg.exe
  2⤵
  PID:4480
- C:\Windows\System\SaREceC.exe
  C:\Windows\System\SaREceC.exe
  2⤵
  PID:7248
- C:\Windows\System\RZZXydm.exe
  C:\Windows\System\RZZXydm.exe
  2⤵
  PID:7272
- C:\Windows\System\CwZVuYf.exe
  C:\Windows\System\CwZVuYf.exe
  2⤵
  PID:10992
- C:\Windows\System\AXqAzII.exe
  C:\Windows\System\AXqAzII.exe
  2⤵
  PID:10252
- C:\Windows\System\drYVXzB.exe
  C:\Windows\System\drYVXzB.exe
  2⤵
  PID:6004
- C:\Windows\System\aBDOfNf.exe
  C:\Windows\System\aBDOfNf.exe
  2⤵
  PID:10356
- C:\Windows\System\AoRHBOq.exe
  C:\Windows\System\AoRHBOq.exe
  2⤵
  PID:10844
- C:\Windows\System\kkZILBg.exe
  C:\Windows\System\kkZILBg.exe
  2⤵
  PID:736
- C:\Windows\System\octeCNt.exe
  C:\Windows\System\octeCNt.exe
  2⤵
  PID:11460
- C:\Windows\System\BSKhpFm.exe
  C:\Windows\System\BSKhpFm.exe
  2⤵
  PID:11592
- C:\Windows\System\gQLOVdS.exe
  C:\Windows\System\gQLOVdS.exe
  2⤵
  PID:11732
- C:\Windows\System\SCwaaQV.exe
  C:\Windows\System\SCwaaQV.exe
  2⤵
  PID:11836
- C:\Windows\System\qEwIuDn.exe
  C:\Windows\System\qEwIuDn.exe
  2⤵
  PID:9180
- C:\Windows\System\CBcRuKh.exe
  C:\Windows\System\CBcRuKh.exe
  2⤵
  PID:9568
- C:\Windows\System\yqYKvJr.exe
  C:\Windows\System\yqYKvJr.exe
  2⤵
  PID:9652
- C:\Windows\System\CowjbNV.exe
  C:\Windows\System\CowjbNV.exe
  2⤵
  PID:9736
- C:\Windows\System\awcTrWQ.exe
  C:\Windows\System\awcTrWQ.exe
  2⤵
  PID:12964
- C:\Windows\System\xJvAVBz.exe
  C:\Windows\System\xJvAVBz.exe
  2⤵
  PID:11712
- C:\Windows\System\SkUgVSO.exe
  C:\Windows\System\SkUgVSO.exe
  2⤵
  PID:13172
- C:\Windows\System\FMXwsOP.exe
  C:\Windows\System\FMXwsOP.exe
  2⤵
  PID:10100
- C:\Windows\System\ysjHeZg.exe
  C:\Windows\System\ysjHeZg.exe
  2⤵
  PID:10204
- C:\Windows\System\nBtFGKf.exe
  C:\Windows\System\nBtFGKf.exe
  2⤵
  PID:11976
- C:\Windows\System\jXwEZAF.exe
  C:\Windows\System\jXwEZAF.exe
  2⤵
  PID:11340
- C:\Windows\System\uNThsny.exe
  C:\Windows\System\uNThsny.exe
  2⤵
  PID:9880
- C:\Windows\System\GcEkrVa.exe
  C:\Windows\System\GcEkrVa.exe
  2⤵
  PID:12388
- C:\Windows\System\rxtbfKT.exe
  C:\Windows\System\rxtbfKT.exe
  2⤵
  PID:12620
- C:\Windows\System\AhBzPfY.exe
  C:\Windows\System\AhBzPfY.exe
  2⤵
  PID:8420
- C:\Windows\System\DHplPNq.exe
  C:\Windows\System\DHplPNq.exe
  2⤵
  PID:9280
- C:\Windows\System\znLodDJ.exe
  C:\Windows\System\znLodDJ.exe
  2⤵
  PID:10248
- C:\Windows\System\dAtnIVW.exe
  C:\Windows\System\dAtnIVW.exe
  2⤵
  PID:10360
- C:\Windows\System\IQbrzph.exe
  C:\Windows\System\IQbrzph.exe
  2⤵
  PID:10584
- C:\Windows\System\iYjwcgq.exe
  C:\Windows\System\iYjwcgq.exe
  2⤵
  PID:4912
- C:\Windows\System\GpisHBi.exe
  C:\Windows\System\GpisHBi.exe
  2⤵
  PID:10856
- C:\Windows\System\PENQDAU.exe
  C:\Windows\System\PENQDAU.exe
  2⤵
  PID:13300
- C:\Windows\System\tjalrbx.exe
  C:\Windows\System\tjalrbx.exe
  2⤵
  PID:10484
- C:\Windows\System\WeUhwsH.exe
  C:\Windows\System\WeUhwsH.exe
  2⤵
  PID:5944
- C:\Windows\System\VwfUMXy.exe
  C:\Windows\System\VwfUMXy.exe
  2⤵
  PID:9168
- C:\Windows\System\ZhKeixT.exe
  C:\Windows\System\ZhKeixT.exe
  2⤵
  PID:12532
- C:\Windows\System\PBoBUjE.exe
  C:\Windows\System\PBoBUjE.exe
  2⤵
  PID:10748
- C:\Windows\System\OTeDJzI.exe
  C:\Windows\System\OTeDJzI.exe
  2⤵
  PID:10768
- C:\Windows\System\kvBZkSr.exe
  C:\Windows\System\kvBZkSr.exe
  2⤵
  PID:10284
- C:\Windows\System\OfWWVOC.exe
  C:\Windows\System\OfWWVOC.exe
  2⤵
  PID:9304
- C:\Windows\System\TWtHDcc.exe
  C:\Windows\System\TWtHDcc.exe
  2⤵
  PID:11704
- C:\Windows\System\IGGDNJP.exe
  C:\Windows\System\IGGDNJP.exe
  2⤵
  PID:9176
- C:\Windows\System\iMmHcDb.exe
  C:\Windows\System\iMmHcDb.exe
  2⤵
  PID:5720
- C:\Windows\System\GplCorh.exe
  C:\Windows\System\GplCorh.exe
  2⤵
  PID:12928
- C:\Windows\System\graOwGW.exe
  C:\Windows\System\graOwGW.exe
  2⤵
  PID:11780
- C:\Windows\System\zyaXoGf.exe
  C:\Windows\System\zyaXoGf.exe
  2⤵
  PID:12232
- C:\Windows\System\FWuVCIs.exe
  C:\Windows\System\FWuVCIs.exe
  2⤵
  PID:9620
- C:\Windows\System\jRmcREo.exe
  C:\Windows\System\jRmcREo.exe
  2⤵
  PID:12360
- C:\Windows\System\OwKEStz.exe
  C:\Windows\System\OwKEStz.exe
  2⤵
  PID:12732
- C:\Windows\System\OMSjYNA.exe
  C:\Windows\System\OMSjYNA.exe
  2⤵
  PID:13064
- C:\Windows\System\pJJAaNF.exe
  C:\Windows\System\pJJAaNF.exe
  2⤵
  PID:10432
- C:\Windows\System\jmjBndE.exe
  C:\Windows\System\jmjBndE.exe
  2⤵
  PID:11632
- C:\Windows\System\VeqtHKk.exe
  C:\Windows\System\VeqtHKk.exe
  2⤵
  PID:12152
- C:\Windows\System\rgZamYw.exe
  C:\Windows\System\rgZamYw.exe
  2⤵
  PID:11036
- C:\Windows\System\QZPtLYq.exe
  C:\Windows\System\QZPtLYq.exe
  2⤵
  PID:5140
- C:\Windows\System\hWVKbyQ.exe
  C:\Windows\System\hWVKbyQ.exe
  2⤵
  PID:5136
- C:\Windows\System\vmdXhYN.exe
  C:\Windows\System\vmdXhYN.exe
  2⤵
  PID:10380
- C:\Windows\System\LIfzEDF.exe
  C:\Windows\System\LIfzEDF.exe
  2⤵
  PID:12180
- C:\Windows\System\AOvmYli.exe
  C:\Windows\System\AOvmYli.exe
  2⤵
  PID:12228
- C:\Windows\System\lsTQuiN.exe
  C:\Windows\System\lsTQuiN.exe
  2⤵
  PID:11584
- C:\Windows\System\nMrmrfL.exe
  C:\Windows\System\nMrmrfL.exe
  2⤵
  PID:10232
- C:\Windows\System\NuidnoH.exe
  C:\Windows\System\NuidnoH.exe
  2⤵
  PID:2224
- C:\Windows\System\gplwtQt.exe
  C:\Windows\System\gplwtQt.exe
  2⤵
  PID:13016
- C:\Windows\System\kywgUGT.exe
  C:\Windows\System\kywgUGT.exe
  2⤵
  PID:4452
- C:\Windows\System\phXGsYK.exe
  C:\Windows\System\phXGsYK.exe
  2⤵
  PID:10936
- C:\Windows\System\FxGraEB.exe
  C:\Windows\System\FxGraEB.exe
  2⤵
  PID:11664
- C:\Windows\System\UBOypmr.exe
  C:\Windows\System\UBOypmr.exe
  2⤵
  PID:12236
- C:\Windows\System\jbkPRRu.exe
  C:\Windows\System\jbkPRRu.exe
  2⤵
  PID:1908
- C:\Windows\System\GHDljoK.exe
  C:\Windows\System\GHDljoK.exe
  2⤵
  PID:10920
- C:\Windows\System\mlmASfq.exe
  C:\Windows\System\mlmASfq.exe
  2⤵
  PID:12768
- C:\Windows\System\vberSuP.exe
  C:\Windows\System\vberSuP.exe
  2⤵
  PID:1156
- C:\Windows\System\AJjUaLu.exe
  C:\Windows\System\AJjUaLu.exe
  2⤵
  PID:12920
- C:\Windows\System\THEKvZG.exe
  C:\Windows\System\THEKvZG.exe
  2⤵
  PID:2660
- C:\Windows\System\afzQrLL.exe
  C:\Windows\System\afzQrLL.exe
  2⤵
  PID:8784
- C:\Windows\System\MEOQgUO.exe
  C:\Windows\System\MEOQgUO.exe
  2⤵
  PID:9364
- C:\Windows\System\mnFcDRq.exe
  C:\Windows\System\mnFcDRq.exe
  2⤵
  PID:1456
- C:\Windows\System\CypurnV.exe
  C:\Windows\System\CypurnV.exe
  2⤵
  PID:4592
- C:\Windows\System\CLGQAIS.exe
  C:\Windows\System\CLGQAIS.exe
  2⤵
  PID:13324
- C:\Windows\System\OUlukUp.exe
  C:\Windows\System\OUlukUp.exe
  2⤵
  PID:13352
- C:\Windows\System\WIqZUVB.exe
  C:\Windows\System\WIqZUVB.exe
  2⤵
  PID:13380
- C:\Windows\System\fUnXxIR.exe
  C:\Windows\System\fUnXxIR.exe
  2⤵
  PID:13408
- C:\Windows\System\esvyfTM.exe
  C:\Windows\System\esvyfTM.exe
  2⤵
  PID:13436
- C:\Windows\System\tNQVkWs.exe
  C:\Windows\System\tNQVkWs.exe
  2⤵
  PID:13464
- C:\Windows\System\ditoVra.exe
  C:\Windows\System\ditoVra.exe
  2⤵
  PID:13492
- C:\Windows\System\hzSCQqC.exe
  C:\Windows\System\hzSCQqC.exe
  2⤵
  PID:13520
- C:\Windows\System\BcuOptW.exe
  C:\Windows\System\BcuOptW.exe
  2⤵
  PID:13552
- C:\Windows\System\yatzQMp.exe
  C:\Windows\System\yatzQMp.exe
  2⤵
  PID:13580
- C:\Windows\System\cjGDbpJ.exe
  C:\Windows\System\cjGDbpJ.exe
  2⤵
  PID:13608
- C:\Windows\System\mRcCcma.exe
  C:\Windows\System\mRcCcma.exe
  2⤵
  PID:13636
- C:\Windows\System\JgOLUTi.exe
  C:\Windows\System\JgOLUTi.exe
  2⤵
  PID:13664
- C:\Windows\System\DjPctKD.exe
  C:\Windows\System\DjPctKD.exe
  2⤵
  PID:13692
- C:\Windows\System\TVOcYCf.exe
  C:\Windows\System\TVOcYCf.exe
  2⤵
  PID:13720
- C:\Windows\System\OTxXSUV.exe
  C:\Windows\System\OTxXSUV.exe
  2⤵
  PID:13748
- C:\Windows\System\sERNLrE.exe
  C:\Windows\System\sERNLrE.exe
  2⤵
  PID:13776
- C:\Windows\System\SrPMYUf.exe
  C:\Windows\System\SrPMYUf.exe
  2⤵
  PID:13804
- C:\Windows\System\eZzLFeh.exe
  C:\Windows\System\eZzLFeh.exe
  2⤵
  PID:13832
- C:\Windows\System\iOkUPRn.exe
  C:\Windows\System\iOkUPRn.exe
  2⤵
  PID:13860
- C:\Windows\System\sGUmwaM.exe
  C:\Windows\System\sGUmwaM.exe
  2⤵
  PID:13888
- C:\Windows\System\sKsGwbr.exe
  C:\Windows\System\sKsGwbr.exe
  2⤵
  PID:13916
- C:\Windows\System\ZeMEjyg.exe
  C:\Windows\System\ZeMEjyg.exe
  2⤵
  PID:13944
- C:\Windows\System\wJYxLXo.exe
  C:\Windows\System\wJYxLXo.exe
  2⤵
  PID:13972
- C:\Windows\System\lGkCmwv.exe
  C:\Windows\System\lGkCmwv.exe
  2⤵
  PID:14000
- C:\Windows\System\AcJEmtN.exe
  C:\Windows\System\AcJEmtN.exe
  2⤵
  PID:14028
- C:\Windows\System\fJPJcAn.exe
  C:\Windows\System\fJPJcAn.exe
  2⤵
  PID:14060
- C:\Windows\System\xcUThpe.exe
  C:\Windows\System\xcUThpe.exe
  2⤵
  PID:14088
- C:\Windows\System\LHqmGFn.exe
  C:\Windows\System\LHqmGFn.exe
  2⤵
  PID:14116
- C:\Windows\System\agpOgYc.exe
  C:\Windows\System\agpOgYc.exe
  2⤵
  PID:14144
- C:\Windows\System\zJEfghi.exe
  C:\Windows\System\zJEfghi.exe
  2⤵
  PID:14172
- C:\Windows\System\SKMAXEi.exe
  C:\Windows\System\SKMAXEi.exe
  2⤵
  PID:14200
- C:\Windows\System\whjKTyY.exe
  C:\Windows\System\whjKTyY.exe
  2⤵
  PID:14228
- C:\Windows\System\QytczSD.exe
  C:\Windows\System\QytczSD.exe
  2⤵
  PID:14256
- C:\Windows\System\zoUrhWx.exe
  C:\Windows\System\zoUrhWx.exe
  2⤵
  PID:14284
- C:\Windows\System\PKRdwFm.exe
  C:\Windows\System\PKRdwFm.exe
  2⤵
  PID:14312
- C:\Windows\System\TFJEsYV.exe
  C:\Windows\System\TFJEsYV.exe
  2⤵
  PID:13320
- C:\Windows\System\nOgnpzx.exe
  C:\Windows\System\nOgnpzx.exe
  2⤵
  PID:1828
- C:\Windows\System\PWxwdbx.exe
  C:\Windows\System\PWxwdbx.exe
  2⤵
  PID:13388
- C:\Windows\System\fmikjWQ.exe
  C:\Windows\System\fmikjWQ.exe
  2⤵
  PID:13432
- C:\Windows\System\cVkyBup.exe
  C:\Windows\System\cVkyBup.exe
  2⤵
  PID:12764
- C:\Windows\System\RqwmCOd.exe
  C:\Windows\System\RqwmCOd.exe
  2⤵
  PID:13508
- C:\Windows\System\DffpBdY.exe
  C:\Windows\System\DffpBdY.exe
  2⤵
  PID:3836
- C:\Windows\System\UpxhKFR.exe
  C:\Windows\System\UpxhKFR.exe
  2⤵
  PID:13588
- C:\Windows\System\gpdpxqQ.exe
  C:\Windows\System\gpdpxqQ.exe
  2⤵
  PID:1000
- C:\Windows\System\OoDqzrh.exe
  C:\Windows\System\OoDqzrh.exe
  2⤵
  PID:13672
- C:\Windows\System\wrTnwak.exe
  C:\Windows\System\wrTnwak.exe
  2⤵
  PID:3444
- C:\Windows\System\XRCdACZ.exe
  C:\Windows\System\XRCdACZ.exe
  2⤵
  PID:13744
- C:\Windows\System\OvjnrUE.exe
  C:\Windows\System\OvjnrUE.exe
  2⤵
  PID:13812
- C:\Windows\System\nofQPAk.exe
  C:\Windows\System\nofQPAk.exe
  2⤵
  PID:13876
- C:\Windows\System\IJQQbZn.exe
  C:\Windows\System\IJQQbZn.exe
  2⤵
  PID:13528
- C:\Windows\System\rVArzAJ.exe
  C:\Windows\System\rVArzAJ.exe
  2⤵
  PID:6276
- C:\Windows\System\juqBgyv.exe
  C:\Windows\System\juqBgyv.exe
  2⤵
  PID:14008
- C:\Windows\System\rTVVakX.exe
  C:\Windows\System\rTVVakX.exe
  2⤵
  PID:14076
- C:\Windows\System\BIXVOiK.exe
  C:\Windows\System\BIXVOiK.exe
  2⤵
  PID:14140
- C:\Windows\System\jzpGnNJ.exe
  C:\Windows\System\jzpGnNJ.exe
  2⤵
  PID:14208
- C:\Windows\System\zycemjH.exe
  C:\Windows\System\zycemjH.exe
  2⤵
  PID:14272
- C:\Windows\System\PZevVUi.exe
  C:\Windows\System\PZevVUi.exe
  2⤵
  PID:1712
- C:\Windows\System\HxglUAB.exe
  C:\Windows\System\HxglUAB.exe
  2⤵
  PID:13404
- C:\Windows\System\sBUGdvf.exe
  C:\Windows\System\sBUGdvf.exe
  2⤵
  PID:13480
- C:\Windows\System\vIZvVXK.exe
  C:\Windows\System\vIZvVXK.exe
  2⤵
  PID:2204
- C:\Windows\System\qDyOcxZ.exe
  C:\Windows\System\qDyOcxZ.exe
  2⤵
  PID:4540
- C:\Windows\System\ldoPtGv.exe
  C:\Windows\System\ldoPtGv.exe
  2⤵
  PID:13784
- C:\Windows\System\CDLHFtK.exe
  C:\Windows\System\CDLHFtK.exe
  2⤵
  PID:13912
- C:\Windows\System\DiVkIeW.exe
  C:\Windows\System\DiVkIeW.exe
  2⤵
  PID:14024
- C:\Windows\System\zDBRguj.exe
  C:\Windows\System\zDBRguj.exe
  2⤵
  PID:14180
- C:\Windows\System\nTbsZYa.exe
  C:\Windows\System\nTbsZYa.exe
  2⤵
  PID:14320
- C:\Windows\System\GJkmqzC.exe
  C:\Windows\System\GJkmqzC.exe
  2⤵
  PID:14052
- C:\Windows\System\EvQlZgx.exe
  C:\Windows\System\EvQlZgx.exe
  2⤵
  PID:6016
- C:\Windows\System\LOZakxP.exe
  C:\Windows\System\LOZakxP.exe
  2⤵
  PID:4868
- C:\Windows\System\PalqrpC.exe
  C:\Windows\System\PalqrpC.exe
  2⤵
  PID:14224
- C:\Windows\System\HgIKdyN.exe
  C:\Windows\System\HgIKdyN.exe
  2⤵
  PID:3956
- C:\Windows\System\QPNBrCp.exe
  C:\Windows\System\QPNBrCp.exe
  2⤵
  PID:13868
- C:\Windows\System\UQaWNBh.exe
  C:\Windows\System\UQaWNBh.exe
  2⤵
  PID:13532
- C:\Windows\System\NippnzK.exe
  C:\Windows\System\NippnzK.exe
  2⤵
  PID:6304
- C:\Windows\System\lXKNNTE.exe
  C:\Windows\System\lXKNNTE.exe
  2⤵
  PID:14360
- C:\Windows\System\ttORQnj.exe
  C:\Windows\System\ttORQnj.exe
  2⤵
  PID:14388
- C:\Windows\System\LnzjvMb.exe
  C:\Windows\System\LnzjvMb.exe
  2⤵
  PID:14416
- C:\Windows\System\TKyJHBC.exe
  C:\Windows\System\TKyJHBC.exe
  2⤵
  PID:14452
- C:\Windows\System\nKBEiOr.exe
  C:\Windows\System\nKBEiOr.exe
  2⤵
  PID:14480
- C:\Windows\System\dGYsUdx.exe
  C:\Windows\System\dGYsUdx.exe
  2⤵
  PID:14508
- C:\Windows\System\MpyoRMt.exe
  C:\Windows\System\MpyoRMt.exe
  2⤵
  PID:14544
- C:\Windows\System\WANAZrR.exe
  C:\Windows\System\WANAZrR.exe
  2⤵
  PID:14576
- C:\Windows\System\UkMXTxD.exe
  C:\Windows\System\UkMXTxD.exe
  2⤵
  PID:14608
- C:\Windows\System\jBDWFXb.exe
  C:\Windows\System\jBDWFXb.exe
  2⤵
  PID:14636
- C:\Windows\System\rQlSRDO.exe
  C:\Windows\System\rQlSRDO.exe
  2⤵
  PID:14664
- C:\Windows\System\qflqEzG.exe
  C:\Windows\System\qflqEzG.exe
  2⤵
  PID:14692
- C:\Windows\System\htlynZK.exe
  C:\Windows\System\htlynZK.exe
  2⤵
  PID:14720
- C:\Windows\System\UyOPJEy.exe
  C:\Windows\System\UyOPJEy.exe
  2⤵
  PID:14748
- C:\Windows\System\pjMmbKQ.exe
  C:\Windows\System\pjMmbKQ.exe
  2⤵
  PID:14776
- C:\Windows\System\sMMdBkU.exe
  C:\Windows\System\sMMdBkU.exe
  2⤵
  PID:14804
- C:\Windows\System\wtFjbHJ.exe
  C:\Windows\System\wtFjbHJ.exe
  2⤵
  PID:14832
- C:\Windows\System\TimxMNA.exe
  C:\Windows\System\TimxMNA.exe
  2⤵
  PID:14860
- C:\Windows\System\dBsjHZI.exe
  C:\Windows\System\dBsjHZI.exe
  2⤵
  PID:14888
- C:\Windows\System\fzncXks.exe
  C:\Windows\System\fzncXks.exe
  2⤵
  PID:14916
- C:\Windows\System\DZLRElM.exe
  C:\Windows\System\DZLRElM.exe
  2⤵
  PID:14944
- C:\Windows\System\UCIjbaX.exe
  C:\Windows\System\UCIjbaX.exe
  2⤵
  PID:14972
- C:\Windows\System\QEuXTVT.exe
  C:\Windows\System\QEuXTVT.exe
  2⤵
  PID:15004
- C:\Windows\System\YsTbKLh.exe
  C:\Windows\System\YsTbKLh.exe
  2⤵
  PID:15032
- C:\Windows\System\jcxamrX.exe
  C:\Windows\System\jcxamrX.exe
  2⤵
  PID:15064
- C:\Windows\System\iyWNEgS.exe
  C:\Windows\System\iyWNEgS.exe
  2⤵
  PID:15092
- C:\Windows\System\tQXlaMO.exe
  C:\Windows\System\tQXlaMO.exe
  2⤵
  PID:15120
- C:\Windows\System\ppdzzen.exe
  C:\Windows\System\ppdzzen.exe
  2⤵
  PID:15148
- C:\Windows\System\hszxVwb.exe
  C:\Windows\System\hszxVwb.exe
  2⤵
  PID:15176
- C:\Windows\System\RvXnejx.exe
  C:\Windows\System\RvXnejx.exe
  2⤵
  PID:15204
- C:\Windows\System\bdrHlVG.exe
  C:\Windows\System\bdrHlVG.exe
  2⤵
  PID:15232
- C:\Windows\System\qYtGdWa.exe
  C:\Windows\System\qYtGdWa.exe
  2⤵
  PID:15260
- C:\Windows\System\ZnsoHqm.exe
  C:\Windows\System\ZnsoHqm.exe
  2⤵
  PID:15288
- C:\Windows\System\TGSvZan.exe
  C:\Windows\System\TGSvZan.exe
  2⤵
  PID:15316
- C:\Windows\System\ojLroAG.exe
  C:\Windows\System\ojLroAG.exe
  2⤵
  PID:15344
- C:\Windows\System\VuvyJTS.exe
  C:\Windows\System\VuvyJTS.exe
  2⤵
  PID:14368
- C:\Windows\System\WjKmjMA.exe
  C:\Windows\System\WjKmjMA.exe
  2⤵
  PID:14424
- C:\Windows\System\HJYUlUA.exe
  C:\Windows\System\HJYUlUA.exe
  2⤵
  PID:14488
- C:\Windows\System\MhwEIIV.exe
  C:\Windows\System\MhwEIIV.exe
  2⤵
  PID:14540
- C:\Windows\System\zAJGLgi.exe
  C:\Windows\System\zAJGLgi.exe
  2⤵
  PID:14600
- C:\Windows\System\ttvAdup.exe
  C:\Windows\System\ttvAdup.exe
  2⤵
  PID:13252
- C:\Windows\System\HuPoqdK.exe
  C:\Windows\System\HuPoqdK.exe
  2⤵
  PID:14700
- C:\Windows\System\OOQqwtx.exe
  C:\Windows\System\OOQqwtx.exe
  2⤵
  PID:14764
- C:\Windows\System\qMqjTwK.exe
  C:\Windows\System\qMqjTwK.exe
  2⤵
  PID:14812
- C:\Windows\System\MQYlEBG.exe
  C:\Windows\System\MQYlEBG.exe
  2⤵
  PID:14876
- C:\Windows\System\bBXGTnj.exe
  C:\Windows\System\bBXGTnj.exe
  2⤵
  PID:14940
- C:\Windows\System\yecEXbR.exe
  C:\Windows\System\yecEXbR.exe
  2⤵
  PID:14988
- C:\Windows\System\VXplUsD.exe
  C:\Windows\System\VXplUsD.exe
  2⤵
  PID:13132
- C:\Windows\System\WiSuLqs.exe
  C:\Windows\System\WiSuLqs.exe
  2⤵
  PID:4680
- C:\Windows\System\STBTyUt.exe
  C:\Windows\System\STBTyUt.exe
  2⤵
  PID:15144
- C:\Windows\System\repWZSS.exe
  C:\Windows\System\repWZSS.exe
  2⤵
  PID:15200
- C:\Windows\System\RZWyaPJ.exe
  C:\Windows\System\RZWyaPJ.exe
  2⤵
  PID:12512
- C:\Windows\System\NBaSNFK.exe
  C:\Windows\System\NBaSNFK.exe
  2⤵
  PID:15284
- C:\Windows\System\SXYaVnh.exe
  C:\Windows\System\SXYaVnh.exe
  2⤵
  PID:15352
- C:\Windows\System\aNMwMqx.exe
  C:\Windows\System\aNMwMqx.exe
  2⤵
  PID:14460
- C:\Windows\System\HrIGjCB.exe
  C:\Windows\System\HrIGjCB.exe
  2⤵
  PID:14584
- C:\Windows\System\iscxxzH.exe
  C:\Windows\System\iscxxzH.exe
  2⤵
  PID:14688
- C:\Windows\System\DRVEvrW.exe
  C:\Windows\System\DRVEvrW.exe
  2⤵
  PID:14828
- C:\Windows\System\vQAOpqG.exe
  C:\Windows\System\vQAOpqG.exe
  2⤵
  PID:15100
- C:\Windows\System\utuJsRd.exe
  C:\Windows\System\utuJsRd.exe
  2⤵
  PID:15056
- C:\Windows\System\SfrgscI.exe
  C:\Windows\System\SfrgscI.exe
  2⤵
  PID:4364
- C:\Windows\System\rmHEHuC.exe
  C:\Windows\System\rmHEHuC.exe
  2⤵
  PID:14912
- C:\Windows\System\eHuaREu.exe
  C:\Windows\System\eHuaREu.exe
  2⤵
  PID:15052
- C:\Windows\System\cfDkzKw.exe
  C:\Windows\System\cfDkzKw.exe
  2⤵
  PID:812
- C:\Windows\System\dfOakrE.exe
  C:\Windows\System\dfOakrE.exe
  2⤵
  PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ag1qyoig.d3o.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CCKElFH.exe

Filesize
3.6MB

MD5
253c5960bf0d1b727f1cdc7f70125d2d

SHA1
d29018d8dafcbdc1378bcdda9a329ceaa1c2e808

SHA256
e53cf6eafbc687a56c61a178df5781db4bd0311bf0c9d1deba031212d8c35d64

SHA512
da6a57d7b47085afe3cf5c4d998c1f153de25a519bb60b6ad23a8b0f0e60da9ef90c9c3d9ece6c9ee84513d4b32779651aee53e0ba4e47ab0e496a66918af0d2

Download Submit
C:\Windows\System\GHSkGKx.exe

Filesize
3.6MB

MD5
2497c7a325d0a0d69369fd422bf6efc6

SHA1
e20b3f566df26c977b791de5f4892e19de548aaa

SHA256
3426bd89b479efbf84d39fc2852a213aaab5213bbd166e67af17025193b681a1

SHA512
e06e7fa6b5b6325ade67d9f9edc3820b060910addc1429e99dfde2bf18b30ec408bf1e7c8cb61f0e4c9ad8c6c75bed522cb5bf9de17ea721809dd3f1dc62f6c4

Download Submit
C:\Windows\System\GSQHlLx.exe

Filesize
3.6MB

MD5
9dbf36eb0ba33e2b06197234628a5bba

SHA1
ac80047e8fc9f2266700f018e210d9ad31eb0a8e

SHA256
78b33626a28f7a5e7f1c154879b7a73cf5f39e8357c13f26260761e8741b445b

SHA512
04bb5471c96791909b31f9a54c180d0c34bca9ae65f53d13e470e6c03ebc415f61c54f5d5f5550b9c23f0a1c854769a2d37d65f957a4fe3f43f09cbbacb2d315

Download Submit
C:\Windows\System\GVHegka.exe

Filesize
3.6MB

MD5
3027676f7357d75e8d9edb95794b5b80

SHA1
99dc81183c5ac64632f5ee2094d4eea5c073525d

SHA256
512261cbbc429b6c04ba135bb7b54b84c482047c466773851e4e125a58fa0011

SHA512
42dea4705d2ac6d43814da7b1cd017afc846ada070e74a6342431e88dc104620eff8e8787d11d9e5580b472166da1fb098a980856dd996500b1f47f6c847bdcb

Download Submit
C:\Windows\System\GiCsnye.exe

Filesize
3.6MB

MD5
9deef0df64c7bc3d6baa19e679b81343

SHA1
fdba5ee948a70d16972baa787f0e45e5f64071bc

SHA256
03286c68f55965f0c4df69dbce33fe22207b77ef84c4ed6c31a53cff8518dec0

SHA512
f308e9ec4026daa05c583e1d82dfc724c6528d883ef6e4950c1c8a56458291ccdc044493604a8e28f5cde015ff7b4ebdad4936557c45a56c4b1f4c5f3a35c3b3

Download Submit
C:\Windows\System\HDEfNWm.exe

Filesize
3.6MB

MD5
6f5e17dc5d02e1d1714c0412116da7c2

SHA1
aa573ba77fc4138bbaf12c0e9c9a4a2e6b919c5e

SHA256
a818ed3c181206554438491578acf322751d7ecbde2ab720cbe20545a88e7fb1

SHA512
100757f9575600e1ef0569a8e3bfa3c8f03c34ca1fe8fca141a1784dbd739230f27daf49ea911ea0cf82eed9dddb118f55c887808bbc29aa23586328ed682d74

Download Submit
C:\Windows\System\HTFWIyh.exe

Filesize
3.6MB

MD5
e7f899ee713ea81de30c81ad58744f4e

SHA1
b3d6f496eb4cf2ec5c8558ace6cada55d82da3e5

SHA256
910329bd7d77d4b8db79d0f540408aba41463fdbe8e11cd601e7a412502518dc

SHA512
9133c2f6412933e73f051dba7bad004e7248b9652c4c89af9ac8cfc46f471d69860093bd5f41a41fbba3db9ef8bf02626624f4734436bb8777e6b679414d1a24

Download Submit
C:\Windows\System\LUQoDRw.exe

Filesize
3.6MB

MD5
97b65ad374523a1931f9d7a5000e6db3

SHA1
c88354681884397f421277a6a5a9fb99503458a2

SHA256
cbee69e40316fccba5dc3089c568dd2db2e026630ce61febc86340544e750344

SHA512
f91bf85bf4666854448b91ee5bd601b9e130821fb506b3542b08c7d8cac59636159745e53533df4dc87d96b3793596e1e8fca4fcfabdf1343b5db8c345529560

Download Submit
C:\Windows\System\LgKUaDz.exe

Filesize
3.6MB

MD5
389e5dc1efd5b2fafbac7d1a4a9eede3

SHA1
9775f94bc26ec42343cf2df680d3a0ce359a08e9

SHA256
745b7a01c6043b403f7dcb4b6b03668f7b9a4e11d89773cae166b1bff19497b6

SHA512
98e0767e036a19261e20fb71aa1c2b12a39beb80681f1080eb56eafd240c6c7b94af9877a1f5ec8460d1f715b47d84efac1e2f632dc2c8c6004b4e09100f31fa

Download Submit
C:\Windows\System\OVFFYqh.exe

Filesize
3.6MB

MD5
9cc42b407e01c39d5ecb7892921f06c6

SHA1
2001ab68fc6e38356660d28e9195bf6f1161b205

SHA256
a7383a51ec054cc95c3ae1ba58b597b848755e98c84d64a1911f3a8890c26fb7

SHA512
2d58916779e453637b132cf0038f6b9e83e8ac3c55b5372671d642a25a5388203f01240542e8d867c6491f44743214b98aed5d2de21cca12ebc4938d7ffdfae9

Download Submit
C:\Windows\System\Ovagvwx.exe

Filesize
3.6MB

MD5
6e1c668a34276c013f3dac03ae751669

SHA1
4366edfb693f871c4575dd48ebd72b2aad7366ce

SHA256
4683eb06f462dec6a21353b24b147ebae04335d35741d2abd88502127b9629bc

SHA512
c1371e69481d32cc9f0d1a4e0d636ccc319df4e8b06683d59a1a5c0abf67c418cf94b4cdc548f8e17d341a6d097c1b27249d5541db62c87db9da164933614cff

Download Submit
C:\Windows\System\RVdVhqK.exe

Filesize
3.6MB

MD5
2da91267d9b5cbcb02699e5409e6ce86

SHA1
7c5355b22cea181d8402c421a6c36434a40de8c8

SHA256
462bb0b162fa49df27cc22f10e8e60244fe9dd5fac3c2bef0cd75618036f6d95

SHA512
e0fee27b3098671adb3ba07fbf9d3330642861c203b99d5b97c2c77d320d5c475ff256768b485aac09afa2559fe86118a5945e7a90825bf984d499280060aa4b

Download Submit
C:\Windows\System\VNRLQiq.exe

Filesize
3.6MB

MD5
80337bff2acc23664476be394a849a5c

SHA1
c08a7ef75cd24b05f4a9ce3902f8e4fd0e9b23b1

SHA256
cd984d91bfae309d1a3164c39260da826048fb35fa62d99c579e3fb75116f36a

SHA512
7c0978652f81adfbca56f336fc5bcfda725d9a76377fb6757087d294316091893b8548b625730ea0f67d164a746e489a48f50df44b42ff2cc00a6f86904dc1f4

Download Submit
C:\Windows\System\XFbDiYP.exe

Filesize
3.6MB

MD5
9a1f62f37cb65f7ab829071426f1872d

SHA1
c957dad803b49b524ef2762c10c0a74ceeb4721a

SHA256
c534e619499d01d0482045461c4442654ea01aeb8231985fedc31e53f4745c0d

SHA512
704cbd8405fa4bc33471663174ef9344bbfb3dbcfdbbce51c2c1c2c3e790770b1e78674210d76c54f9d61bf0a0570f267c1ac939776b6c1e250c66fd6e2eb7e2

Download Submit
C:\Windows\System\XYPBRwe.exe

Filesize
3.6MB

MD5
011eb7275f4e4145ba2c31ab0574a8d9

SHA1
616067e44fb3051e512132fe558be5d8c82af726

SHA256
c2f992c5a4b236e0e6695cf1c9c019738c6bf47368c740ed52f1e0a56ef15eb8

SHA512
abe0c3fc9907e937e95dba3b742004c29fb7f921810e26487aaf4b77b7f3190e85fc2311383d1acbf0e82969379c2b006028d26a6ac42b5c9b52ac62eea6066d

Download Submit
C:\Windows\System\XgtnhsB.exe

Filesize
3.6MB

MD5
cb328f71193981e54da36cdf44bfc332

SHA1
78c6682fb49df1295764791d629661206c725642

SHA256
00d5d182227be03108cea7436dc8ef1fd33a48859e7f09171fe4ee260205ec2a

SHA512
942b341cd545204ae552b212508b53563283463510680ae2dfb851f83312b56e681ee549b3edcc4308f7a90eec8b2f133fb58e06ca8dbdfaaec8200cc9fe9205

Download Submit
C:\Windows\System\dLSkpKl.exe

Filesize
3.6MB

MD5
1fad6afe4a5d6e0e1f9eae942dbd12e2

SHA1
b240444d3364228af20e41a322521b683d41fe78

SHA256
eb685610d5826a981cd07fada6442967bf160640be315294040f133c4e0146e5

SHA512
50cb70bef4568a2dc31d371199e3036f6d24d0a27d383e5d57eb7e4117bcdb4e97dd3794a0cc6af46c7ac2cf18b1228d89ca17973b175981153c46c596d6d92b

Download Submit
C:\Windows\System\dLdNPnO.exe

Filesize
3.6MB

MD5
8d633db2d9da4973a25dae3ffc27d00d

SHA1
96dab5936f4318dd5d6de805b2f79dba5de1913e

SHA256
3d7e3023857e61c930b2198f89ef511b28c9ef5b903376f8ae1a132a8b548679

SHA512
a8f3b587974018ef95df3159aedfbbaca739013a3ce40ebb8bcd9d45d34fe00bce15b53c1bb9009991843f22ee174c2a15622a0b58e358b6cc32926ddf409bf2

Download Submit
C:\Windows\System\dYYEyTH.exe

Filesize
3.6MB

MD5
87da58172bb995fefa4327e7c4e5da56

SHA1
d31ea3cb76675719c523fd14fcdb285aded8ddff

SHA256
36c44fbfc4ba91f194a764a19cd69b23f122929ce524e64ab9f201fd787a6b6c

SHA512
8d82d1d52da9d1ad3b998f7b46433485e667c24446df8c8e5efdca50276d3cfee45f45b4190ba016d0ec9bc5b529c6d0af8a2b95a7e2563d9431ca63acfba491

Download Submit
C:\Windows\System\eGjwbtr.exe

Filesize
3.6MB

MD5
942bf442b61bd39a6de2436ac4f2681a

SHA1
93fc80efc88c5141ccf0299b00ef6505b498c0b1

SHA256
6595248a2760a66edd282057c0b4a26b19bceee8ce6f84a0ed7a6d3502c4b805

SHA512
d0a06c3b28f4edec257ca6ba7aa82e1136df97cde3253560882616bb8d74c6126cf0ab7158416028aa68316967d906c5d0e7d54b8bf2b847b7b36ad86959fd74

Download Submit
C:\Windows\System\eadSkMY.exe

Filesize
3.6MB

MD5
17fd8304edbcd5f94c470f43ed43f873

SHA1
93aff8e7f1d182e4c200dae0445c2fc9de64b1dc

SHA256
948ba3164c65919b826aa7c585497f8e8cbd5e745106b1c3030a293db3ab09a6

SHA512
04cbda4b8caf46c141f09aee1f4aff4fcc12d0aa1d761fe367bf26cc2cae42eeaae3a18c2ab0b3781a83178af6e807128b89d1658f70b5a14593686859342b22

Download Submit
C:\Windows\System\fMXtnMy.exe

Filesize
3.6MB

MD5
39bdc3a5b4c227d8aa61b7692f18dae5

SHA1
899eee47ba25f9689133620493dccd26fb3b4460

SHA256
3ee84eeef66940da06b75d1ad3a68195b9475c20e114935674497b1221f8b84a

SHA512
f96c441bdbd38aa10f8429bf2e0b768e2d88d9b718184b35f4f7d87d14bcea1b0b4b1130ff9b0f314d956bf2d7e43648ab9615235e42bd00c43bd6bcdb63fe27

Download Submit
C:\Windows\System\fqyJRNP.exe

Filesize
3.6MB

MD5
ce508c01fa51c1acdb908130aa7de98e

SHA1
54ab15ea82e221525f9c17831e4a9e51ea427a90

SHA256
957024ab849b7d1970f5d762d1236e6fe7eb654e3b7b6e1b5ee62aa576c103c9

SHA512
ee694bfa01a79d2b6d5c49517059009bc351845b0e25b6e6e2a5d5c80c77bb06c28ec5b3837019612504845d34ee2d6fc5577be8b436c1d2af7db6a57782a37c

Download Submit
C:\Windows\System\gIxBYJI.exe

Filesize
3.6MB

MD5
55d443c3a8db2e4b2ecc0f60105ddf5c

SHA1
00812e3bb5cb9ad587d7a655a1d14439a896ae43

SHA256
f3deb45008052fa8a965816e1d35d5f1004cae87ddd37cb029364ac5d35d555c

SHA512
491806359796144d89ec82f52ff2dee05541c3c88ed1bdceee467744d81905e7c8f613098ba519850d46513f990ed82d8cf16a19f0e05f60603d07fdf239ee27

Download Submit
C:\Windows\System\hDRCOdW.exe

Filesize
3.6MB

MD5
948cec917cafdccf08cc552c1df98cc2

SHA1
38bb99638f4603b16d0defd9eb529703b3f738b6

SHA256
e2798a57110b98e01eafaf3125da43b87c2d885a198b8ef603d51533a4f007b6

SHA512
63fe0ba6002dbe45e88fb19da62883882e9156671d260c608016271ded007372ac6f3ade33667dcc9a873021dbb92ada2352155e6acef45054f455607808aadb

Download Submit
C:\Windows\System\hxhItDw.exe

Filesize
3.6MB

MD5
97c0d46f16f80d7a08133a51256e5b44

SHA1
261bd403639c16abee32b8fe447ffd0b8034cdb4

SHA256
0eadc2e45c07b097515568319139e2bafe2811d72a51f75771eade05b85e4261

SHA512
652a5eda7249bfc8c9644a032704b052d09690aed4aeef4fca3391719716bd2ce91f9bdb79ec652df46487f412c3d361f7165a2b46e86cd7f8fa638c8cbd9389

Download Submit
C:\Windows\System\iwEcUCj.exe

Filesize
18B

MD5
659bd1053fc0116690a42f30292cd3d4

SHA1
f4047500dd0292499dd1b70f726796bd5c02e84f

SHA256
f65fa1ea15eb1fe02c0db79aa83dca830a2510c5eafc20e0115f448064fffaf2

SHA512
f48b84b8a01308d9b05b4a77a6d12a284387153f1657b9b4c1a7cb73dea93189aa398f2bd5986d2d5d4f4737b93c3ca6a3f002b634cf96837732621df4de711a

Download Submit
C:\Windows\System\jWZDPjr.exe

Filesize
8B

MD5
73d2a6f98ec11a363ba40d9285f31146

SHA1
f412571986c937c29e7d1df48abd9ea9b810fb79

SHA256
9599521a11e3ac1412a598ac34375377cf195a57228d724684ce7cd2fc0f8bb0

SHA512
85230fa9f6b5cc93b67c122ee0f2a6b41f611e7c892a179490ce36def0b7cf39dd4e008408c7b0ba49dd6453338ebd04122a1a20b23e1ea00da2f3cdeed0b74f

Download Submit
C:\Windows\System\jWnOjEg.exe

Filesize
3.6MB

MD5
dd5a212ac28be11053b69dddc59b4f68

SHA1
58693a5e3217b532b436b52646c64c2015f3b96d

SHA256
005cbbcc0a41b89c4b2158b6d0f8f64c28057698422524fe2465e7b15cecf6ef

SHA512
9c68884a92ac4246ffd86a6f0f0c006d21a4b91ba5b0dd41082bdc2592357f22ed212107e359cac1dace1482e65e59d535e60dc92912fde66e29ff230ca9ba18

Download Submit
C:\Windows\System\njrpXya.exe

Filesize
3.6MB

MD5
a0503c1d127939c539cd4fafe8e1a939

SHA1
6a5ae1a3a030699c9095fe52fdf6d8c67d520d4e

SHA256
f04d82103289b03cc5c96c4b56dd25e23d1cda3e62597fb839f23fe24ef8309e

SHA512
8318f9e836dcc5cafb3556ac33f651e6133bda3092f5cb1c3958030b61f4d15a8e9c913acec72effa93ab86716ba6ca92c99754fbafd5e467140bee670fa66b6

Download Submit
C:\Windows\System\osXxkgA.exe

Filesize
3.6MB

MD5
3c80fe4d82945e3ddd1b4e1da7bef878

SHA1
48b2fe347d5811d673a345d922c3468dead0dad9

SHA256
ba9f03c5fbe4ff66ed2a282eeebeff12224070f2cc741a07dadd5ad97c060497

SHA512
9eacc973e8bfa789809a8ed048cf30a2bf841f4e726c6997614d02d0738005f4964f733ad4ccf2001ac1d82b0067e60146b4b1d1c8a16f493a2f48e908af29fb

Download Submit
C:\Windows\System\qRKkXDO.exe

Filesize
3.6MB

MD5
a5e770ca7f3c4fa6a0fb6de73c453b18

SHA1
b572df2b39adee31fa90faa708d8e5a860e74d96

SHA256
7d6b66377e2e758dd916bf0762221609792e4c8070d5c947dad86b47037f2ded

SHA512
9dbe6e781f08f6a0da169f4c192bceaf4929ca1228d97c37b57ab4ae997e2b74a7044c3dd792926be307dfb2be054f706e6ca2438330c122f011066bf4f9da4d

Download Submit
C:\Windows\System\rOQOVbZ.exe

Filesize
3.6MB

MD5
4fd00ad3591f2b68c5229ddc9cdf6611

SHA1
6c963fb931b05acc26673470ef488be7d0b09bd1

SHA256
961bdd2c0f1f82a94fa2a51dadca7b03f614be7cbda28e048ede4f10f7814a8e

SHA512
0ea9a1c08d728c25f4a5bd2de2ffc8f4a860ab808c58b12a5d3969099729bf0783c2f20dcba3911db0a33be5040d37e5bf1f812ee47027a8feea9ef423568be8

Download Submit
C:\Windows\System\xJhqmwI.exe

Filesize
3.6MB

MD5
e2d17e5ef3000bf9090ee200cec128ea

SHA1
6cd4b0011697d6a91c83e177459f7ffcab680100

SHA256
8a1a94b8a29d2fcf03380a76d379a87fe201307fed72ae73a7419c36da9a8023

SHA512
22a4a47fa26fa4e7fd3c7d7a06bed51868198482549940cace51802b552b085f4143d78cc816467abc0294342983c7ddc605f1636299d2e1db76dae42417104c

Download Submit
C:\Windows\System\xQSWgMO.exe

Filesize
3.6MB

MD5
a56a1c1f2449502fa0ba872ad4199f6c

SHA1
1ee864d67a37120a6b2ed9a0e11f5ac50b7ab6de

SHA256
58ff02a5ab1a3ababf431c3503b6d616a206b0dc69d795eeef8509be31997e62

SHA512
4f150b89044b8cee4f922a6fce4881b86433338a8bb79aa22700f0fef20274b51ccb6f01e80a1ec3a65274dc36687033f3bbc26367622b9fb6b38b1035eb727a

Download Submit
memory/264-91-0x00007FF6157B0000-0x00007FF615BA6000-memory.dmp

Filesize
4.0MB

Download
memory/264-2350-0x00007FF6157B0000-0x00007FF615BA6000-memory.dmp

Filesize
4.0MB

Download
memory/668-2376-0x00007FF62BA90000-0x00007FF62BE86000-memory.dmp

Filesize
4.0MB

Download
memory/668-165-0x00007FF62BA90000-0x00007FF62BE86000-memory.dmp

Filesize
4.0MB

Download
memory/1256-2379-0x00007FF79F910000-0x00007FF79FD06000-memory.dmp

Filesize
4.0MB

Download
memory/1256-2158-0x00007FF79F910000-0x00007FF79FD06000-memory.dmp

Filesize
4.0MB

Download
memory/1256-127-0x00007FF79F910000-0x00007FF79FD06000-memory.dmp

Filesize
4.0MB

Download
memory/1260-173-0x00007FF73F8C0000-0x00007FF73FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/1260-2381-0x00007FF73F8C0000-0x00007FF73FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/1552-2372-0x00007FF7D8EB0000-0x00007FF7D92A6000-memory.dmp

Filesize
4.0MB

Download
memory/1552-155-0x00007FF7D8EB0000-0x00007FF7D92A6000-memory.dmp

Filesize
4.0MB

Download
memory/1552-2303-0x00007FF7D8EB0000-0x00007FF7D92A6000-memory.dmp

Filesize
4.0MB

Download
memory/1868-78-0x00007FF641170000-0x00007FF641566000-memory.dmp

Filesize
4.0MB

Download
memory/1868-2342-0x00007FF641170000-0x00007FF641566000-memory.dmp

Filesize
4.0MB

Download
memory/1920-2366-0x00007FF7B2F40000-0x00007FF7B3336000-memory.dmp

Filesize
4.0MB

Download
memory/1920-171-0x00007FF7B2F40000-0x00007FF7B3336000-memory.dmp

Filesize
4.0MB

Download
memory/2132-119-0x00007FF6109F0000-0x00007FF610DE6000-memory.dmp

Filesize
4.0MB

Download
memory/2132-2364-0x00007FF6109F0000-0x00007FF610DE6000-memory.dmp

Filesize
4.0MB

Download
memory/2500-53-0x00007FF740080000-0x00007FF740476000-memory.dmp

Filesize
4.0MB

Download
memory/2500-2333-0x00007FF740080000-0x00007FF740476000-memory.dmp

Filesize
4.0MB

Download
memory/2972-2377-0x00007FF623F20000-0x00007FF624316000-memory.dmp

Filesize
4.0MB

Download
memory/2972-158-0x00007FF623F20000-0x00007FF624316000-memory.dmp

Filesize
4.0MB

Download
memory/2988-2328-0x00007FF778320000-0x00007FF778716000-memory.dmp

Filesize
4.0MB

Download
memory/2988-31-0x00007FF778320000-0x00007FF778716000-memory.dmp

Filesize
4.0MB

Download
memory/2992-2349-0x00007FF79BFA0000-0x00007FF79C396000-memory.dmp

Filesize
4.0MB

Download
memory/2992-169-0x00007FF79BFA0000-0x00007FF79C396000-memory.dmp

Filesize
4.0MB

Download
memory/3052-2360-0x00007FF7D0860000-0x00007FF7D0C56000-memory.dmp

Filesize
4.0MB

Download
memory/3052-97-0x00007FF7D0860000-0x00007FF7D0C56000-memory.dmp

Filesize
4.0MB

Download
memory/3108-2382-0x00007FF6189C0000-0x00007FF618DB6000-memory.dmp

Filesize
4.0MB

Download
memory/3108-174-0x00007FF6189C0000-0x00007FF618DB6000-memory.dmp

Filesize
4.0MB

Download
memory/3132-2380-0x00007FF6387E0000-0x00007FF638BD6000-memory.dmp

Filesize
4.0MB

Download
memory/3132-172-0x00007FF6387E0000-0x00007FF638BD6000-memory.dmp

Filesize
4.0MB

Download
memory/3204-167-0x00007FFF97940000-0x00007FFF98401000-memory.dmp

Filesize
10.8MB

Download
memory/3204-25-0x00007FFF97940000-0x00007FFF98401000-memory.dmp

Filesize
10.8MB

Download
memory/3204-2156-0x00007FFF97943000-0x00007FFF97945000-memory.dmp

Filesize
8KB

Download
memory/3204-3-0x00007FFF97943000-0x00007FFF97945000-memory.dmp

Filesize
8KB

Download
memory/3204-44-0x000001E079E30000-0x000001E079E52000-memory.dmp

Filesize
136KB

Download
memory/3204-175-0x000001E07AAB0000-0x000001E07B256000-memory.dmp

Filesize
7.6MB

Download
memory/3372-2355-0x00007FF686810000-0x00007FF686C06000-memory.dmp

Filesize
4.0MB

Download
memory/3372-170-0x00007FF686810000-0x00007FF686C06000-memory.dmp

Filesize
4.0MB

Download
memory/4020-2160-0x00007FF6ED350000-0x00007FF6ED746000-memory.dmp

Filesize
4.0MB

Download
memory/4020-144-0x00007FF6ED350000-0x00007FF6ED746000-memory.dmp

Filesize
4.0MB

Download
memory/4020-2378-0x00007FF6ED350000-0x00007FF6ED746000-memory.dmp

Filesize
4.0MB

Download
memory/4308-85-0x00007FF7EDB10000-0x00007FF7EDF06000-memory.dmp

Filesize
4.0MB

Download
memory/4308-2339-0x00007FF7EDB10000-0x00007FF7EDF06000-memory.dmp

Filesize
4.0MB

Download
memory/4312-2374-0x00007FF67D7C0000-0x00007FF67DBB6000-memory.dmp

Filesize
4.0MB

Download
memory/4312-166-0x00007FF67D7C0000-0x00007FF67DBB6000-memory.dmp

Filesize
4.0MB

Download
memory/4344-2330-0x00007FF676090000-0x00007FF676486000-memory.dmp

Filesize
4.0MB

Download
memory/4344-168-0x00007FF676090000-0x00007FF676486000-memory.dmp

Filesize
4.0MB

Download
memory/4464-2363-0x00007FF76F590000-0x00007FF76F986000-memory.dmp

Filesize
4.0MB

Download
memory/4464-99-0x00007FF76F590000-0x00007FF76F986000-memory.dmp

Filesize
4.0MB

Download
memory/4488-90-0x00007FF60A8C0000-0x00007FF60ACB6000-memory.dmp

Filesize
4.0MB

Download
memory/4488-2354-0x00007FF60A8C0000-0x00007FF60ACB6000-memory.dmp

Filesize
4.0MB

Download
memory/4656-96-0x00007FF7E9F10000-0x00007FF7EA306000-memory.dmp

Filesize
4.0MB

Download
memory/4656-2352-0x00007FF7E9F10000-0x00007FF7EA306000-memory.dmp

Filesize
4.0MB

Download
memory/5104-2359-0x00007FF77A180000-0x00007FF77A576000-memory.dmp

Filesize
4.0MB

Download
memory/5104-98-0x00007FF77A180000-0x00007FF77A576000-memory.dmp

Filesize
4.0MB

Download
memory/5116-1509-0x00007FF70C390000-0x00007FF70C786000-memory.dmp

Filesize
4.0MB

Download
memory/5116-0-0x00007FF70C390000-0x00007FF70C786000-memory.dmp

Filesize
4.0MB

Download
memory/5116-1-0x0000021823020000-0x0000021823030000-memory.dmp

Filesize
64KB

Download