xmrig | d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
Size

1.9MB
MD5

d6a18ee2c444360815f25e5e001a22e0
SHA1

e9c67e878f97b678ef97577b4cebb1dab05f77d1
SHA256

d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420
SHA512

17275d24998e045979ff012ae64a8abd6f12ec02390fa134c4b7ec9b74170bfef5371edb39727d7ba13cd77dc2969e792e0481f4ba626146c9b05a1b894b696a
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+7RrTFl6hvVjq:Lz071uv4BPMkyW10/w16BvZX71Fq8+w

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2376-18-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/1924-1196-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/780-145-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2832-141-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2916-136-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2784-125-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/624-48-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2772-67-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2080-1460-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2784-5082-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2376-5076-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2916-5073-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2832-5084-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2080-5092-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/780-5094-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/624-5095-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2772-5066-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2560	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2376	eEPljFA.exe
2080	DBdkqfD.exe
624	LjttQCx.exe
2772	DFtoPKv.exe
780	SfPKwYa.exe
2784	boOHcnY.exe
2916	OpwnDBy.exe
2832	rlJomOD.exe
2764	wvjXBxv.exe
2644	cQmgbnR.exe
2584	vGOLjpK.exe
1684	OKAJNCX.exe
992	lyKrgCe.exe
2888	fAWVtYn.exe
2120	JCheiob.exe
3000	kABwDqW.exe
2996	etvGxIB.exe
2752	OZwFhCx.exe
2992	gVDZJYr.exe
2684	NXVFerC.exe
1628	cComowa.exe
2704	kkrlApg.exe
2632	dlieKBh.exe
1200	jBtAPhl.exe
3004	HZKvLit.exe
2976	DFSqlaw.exe
1348	SCGBqCm.exe
2372	hBQRgsi.exe
2596	lssdbAH.exe
1984	ilvlFpY.exe
1916	gYucotS.exe
2484	fhrzMUf.exe
3008	IgKLvRm.exe
1884	XbxdqIu.exe
2328	INnZGNi.exe
908	xGVqBVu.exe
1780	hbjCUsv.exe
1360	McXtvjI.exe
2964	eWlgcQx.exe
2512	ByguWzG.exe
1540	iyBXUhf.exe
2204	FIBCrmm.exe
2364	LQXoLfI.exe
2176	PyaCSTw.exe
1816	hkTmRaj.exe
2960	lZROAHk.exe
3064	avVcupX.exe
2092	AyGVsXT.exe
3052	EvxViFU.exe
2576	dPvjGHp.exe
1908	wkQpfuK.exe
2556	xOrKXss.exe
1728	oJYjQJQ.exe
852	nOpwDrv.exe
2292	iuoLSgw.exe
1592	XOBYbLx.exe
1596	oCdQOcq.exe
2020	VyRTaJw.exe
2776	wrKLwNB.exe
2864	XgDXOOY.exe
2912	CCQSWEK.exe
2676	dhpsoKF.exe
572	PUDnELF.exe
1488	Ztifqed.exe

Loads dropped DLL 64 IoCs

pid	Process
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1924-0-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/files/0x00070000000120fe-5.dat	upx
behavioral1/files/0x0008000000016ee0-42.dat	upx
behavioral1/files/0x0005000000019624-61.dat	upx
behavioral1/memory/2080-40-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/files/0x0007000000019234-38.dat	upx
behavioral1/files/0x00070000000175c6-29.dat	upx
behavioral1/files/0x0007000000017546-22.dat	upx
behavioral1/memory/2376-18-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/files/0x00070000000170b5-19.dat	upx
behavioral1/files/0x0008000000016dd2-12.dat	upx
behavioral1/files/0x0008000000016dc7-9.dat	upx
behavioral1/memory/1924-1196-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/files/0x000500000001a325-172.dat	upx
behavioral1/files/0x000500000001a2e7-168.dat	upx
behavioral1/files/0x000500000001a08a-164.dat	upx
behavioral1/files/0x0005000000019589-149.dat	upx
behavioral1/files/0x000500000001953a-148.dat	upx
behavioral1/memory/780-145-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2832-141-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/files/0x00090000000175d2-138.dat	upx
behavioral1/memory/2916-136-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/files/0x0005000000019f4e-131.dat	upx
behavioral1/files/0x0005000000019d8b-130.dat	upx
behavioral1/files/0x0006000000019c68-129.dat	upx
behavioral1/files/0x0005000000019c50-127.dat	upx
behavioral1/files/0x0005000000019aec-126.dat	upx
behavioral1/memory/2784-125-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x000500000001a04e-120.dat	upx
behavioral1/files/0x0005000000019f4a-113.dat	upx
behavioral1/files/0x0005000000019cbf-106.dat	upx
behavioral1/files/0x0007000000004e76-100.dat	upx
behavioral1/files/0x0005000000019aee-85.dat	upx
behavioral1/files/0x000500000001961b-78.dat	upx
behavioral1/files/0x000500000001957c-77.dat	upx
behavioral1/files/0x0005000000019aea-76.dat	upx
behavioral1/files/0x0005000000019625-69.dat	upx
behavioral1/files/0x000500000001961f-58.dat	upx
behavioral1/memory/624-48-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/files/0x000500000001a061-152.dat	upx
behavioral1/files/0x00050000000197c1-99.dat	upx
behavioral1/memory/2772-67-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2080-1460-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/2784-5082-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2376-5076-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2916-5073-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/memory/2832-5084-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2080-5092-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/780-5094-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/624-5095-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2772-5066-0x000000013F470000-0x000000013F862000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yMdPHtY.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\tIUVtmB.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\TOgVsAG.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\wkQpfuK.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\DXcHcjU.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\QgGiAED.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\zoRDHNt.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\XnRlbCv.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\jdqqXtC.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\OvJwvZY.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\UBWTudS.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\xrafAXu.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\boOHcnY.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\EjcVsIS.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\qZjslwT.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\aQBLTxd.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\GUGrMKb.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\ShJoxEp.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\BeuwhRe.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\ejIkhVD.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\rvEPEOl.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\qDUaaBQ.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\JBfRdDT.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\GLpxLAD.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\Epkvvqd.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\cnoDQVX.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\qXRkisJ.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\gMeACFa.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\neKquqk.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\GbWcDah.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\pLgvOrL.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\jLIKfCC.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\JICgTiN.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\KajieAQ.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\xvFazac.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\ZoFBwaD.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\oGJqphM.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\lKVJvpV.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\hjDBPsX.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\DmyCout.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\uWKHMrY.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\qFaFsvH.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\qVvBFlc.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\cbjoeOA.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\IGPqpiU.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\QhCMcaA.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\lyKrgCe.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\MTSGIjr.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\goIrOJg.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\YqxLRab.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\LcvttcW.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\PfUjBpf.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\UUjckND.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\isQuFfd.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\zptBmBA.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\rqaJAKU.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\UKCsccu.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\tDaqlbp.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\yibIjKM.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\SxEbjVv.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\RxwyLNj.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\HBkbHcR.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\QXfzIlR.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
File created	C:\Windows\System\InEuCiV.exe	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2560	powershell.exe
2560	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
Token: SeLockMemoryPrivilege	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
Token: SeDebugPrivilege	2560	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2560	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	31
PID 1924 wrote to memory of 2560	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	31
PID 1924 wrote to memory of 2560	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	31
PID 1924 wrote to memory of 2376	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	32
PID 1924 wrote to memory of 2376	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	32
PID 1924 wrote to memory of 2376	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	32
PID 1924 wrote to memory of 2080	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	33
PID 1924 wrote to memory of 2080	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	33
PID 1924 wrote to memory of 2080	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	33
PID 1924 wrote to memory of 624	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	34
PID 1924 wrote to memory of 624	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	34
PID 1924 wrote to memory of 624	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	34
PID 1924 wrote to memory of 780	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	35
PID 1924 wrote to memory of 780	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	35
PID 1924 wrote to memory of 780	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	35
PID 1924 wrote to memory of 2772	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	36
PID 1924 wrote to memory of 2772	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	36
PID 1924 wrote to memory of 2772	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	36
PID 1924 wrote to memory of 2832	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	37
PID 1924 wrote to memory of 2832	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	37
PID 1924 wrote to memory of 2832	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	37
PID 1924 wrote to memory of 2784	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	38
PID 1924 wrote to memory of 2784	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	38
PID 1924 wrote to memory of 2784	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	38
PID 1924 wrote to memory of 2752	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	39
PID 1924 wrote to memory of 2752	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	39
PID 1924 wrote to memory of 2752	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	39
PID 1924 wrote to memory of 2916	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	40
PID 1924 wrote to memory of 2916	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	40
PID 1924 wrote to memory of 2916	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	40
PID 1924 wrote to memory of 2992	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	41
PID 1924 wrote to memory of 2992	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	41
PID 1924 wrote to memory of 2992	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	41
PID 1924 wrote to memory of 2764	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	42
PID 1924 wrote to memory of 2764	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	42
PID 1924 wrote to memory of 2764	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	42
PID 1924 wrote to memory of 2684	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	43
PID 1924 wrote to memory of 2684	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	43
PID 1924 wrote to memory of 2684	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	43
PID 1924 wrote to memory of 2644	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	44
PID 1924 wrote to memory of 2644	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	44
PID 1924 wrote to memory of 2644	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	44
PID 1924 wrote to memory of 2704	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	45
PID 1924 wrote to memory of 2704	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	45
PID 1924 wrote to memory of 2704	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	45
PID 1924 wrote to memory of 2584	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	46
PID 1924 wrote to memory of 2584	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	46
PID 1924 wrote to memory of 2584	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	46
PID 1924 wrote to memory of 2632	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	47
PID 1924 wrote to memory of 2632	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	47
PID 1924 wrote to memory of 2632	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	47
PID 1924 wrote to memory of 1684	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	48
PID 1924 wrote to memory of 1684	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	48
PID 1924 wrote to memory of 1684	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	48
PID 1924 wrote to memory of 1200	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	49
PID 1924 wrote to memory of 1200	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	49
PID 1924 wrote to memory of 1200	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	49
PID 1924 wrote to memory of 992	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	50
PID 1924 wrote to memory of 992	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	50
PID 1924 wrote to memory of 992	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	50
PID 1924 wrote to memory of 3004	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	51
PID 1924 wrote to memory of 3004	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	51
PID 1924 wrote to memory of 3004	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	51
PID 1924 wrote to memory of 2888	1924	d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe	52

C:\Users\Admin\AppData\Local\Temp\d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe
"C:\Users\Admin\AppData\Local\Temp\d958950ec90d523f75d36f4be68e847a43dd9e74c9bb00831b4622ff35243420N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\System\eEPljFA.exe
  C:\Windows\System\eEPljFA.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\DBdkqfD.exe
  C:\Windows\System\DBdkqfD.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\LjttQCx.exe
  C:\Windows\System\LjttQCx.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\SfPKwYa.exe
  C:\Windows\System\SfPKwYa.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\DFtoPKv.exe
  C:\Windows\System\DFtoPKv.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\rlJomOD.exe
  C:\Windows\System\rlJomOD.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\boOHcnY.exe
  C:\Windows\System\boOHcnY.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\OZwFhCx.exe
  C:\Windows\System\OZwFhCx.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\OpwnDBy.exe
  C:\Windows\System\OpwnDBy.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\gVDZJYr.exe
  C:\Windows\System\gVDZJYr.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\wvjXBxv.exe
  C:\Windows\System\wvjXBxv.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\NXVFerC.exe
  C:\Windows\System\NXVFerC.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\cQmgbnR.exe
  C:\Windows\System\cQmgbnR.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\kkrlApg.exe
  C:\Windows\System\kkrlApg.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\vGOLjpK.exe
  C:\Windows\System\vGOLjpK.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\dlieKBh.exe
  C:\Windows\System\dlieKBh.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\OKAJNCX.exe
  C:\Windows\System\OKAJNCX.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\jBtAPhl.exe
  C:\Windows\System\jBtAPhl.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\lyKrgCe.exe
  C:\Windows\System\lyKrgCe.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\HZKvLit.exe
  C:\Windows\System\HZKvLit.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\fAWVtYn.exe
  C:\Windows\System\fAWVtYn.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\DFSqlaw.exe
  C:\Windows\System\DFSqlaw.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\JCheiob.exe
  C:\Windows\System\JCheiob.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\SCGBqCm.exe
  C:\Windows\System\SCGBqCm.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\kABwDqW.exe
  C:\Windows\System\kABwDqW.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\hBQRgsi.exe
  C:\Windows\System\hBQRgsi.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\etvGxIB.exe
  C:\Windows\System\etvGxIB.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\lssdbAH.exe
  C:\Windows\System\lssdbAH.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\cComowa.exe
  C:\Windows\System\cComowa.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\ilvlFpY.exe
  C:\Windows\System\ilvlFpY.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\gYucotS.exe
  C:\Windows\System\gYucotS.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\fhrzMUf.exe
  C:\Windows\System\fhrzMUf.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\IgKLvRm.exe
  C:\Windows\System\IgKLvRm.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\XbxdqIu.exe
  C:\Windows\System\XbxdqIu.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\INnZGNi.exe
  C:\Windows\System\INnZGNi.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\xGVqBVu.exe
  C:\Windows\System\xGVqBVu.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\hbjCUsv.exe
  C:\Windows\System\hbjCUsv.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\McXtvjI.exe
  C:\Windows\System\McXtvjI.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\eWlgcQx.exe
  C:\Windows\System\eWlgcQx.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\ByguWzG.exe
  C:\Windows\System\ByguWzG.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\iyBXUhf.exe
  C:\Windows\System\iyBXUhf.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\FIBCrmm.exe
  C:\Windows\System\FIBCrmm.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\LQXoLfI.exe
  C:\Windows\System\LQXoLfI.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\PyaCSTw.exe
  C:\Windows\System\PyaCSTw.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\hkTmRaj.exe
  C:\Windows\System\hkTmRaj.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\lZROAHk.exe
  C:\Windows\System\lZROAHk.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\avVcupX.exe
  C:\Windows\System\avVcupX.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\AyGVsXT.exe
  C:\Windows\System\AyGVsXT.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\EvxViFU.exe
  C:\Windows\System\EvxViFU.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\dPvjGHp.exe
  C:\Windows\System\dPvjGHp.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\wkQpfuK.exe
  C:\Windows\System\wkQpfuK.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\xOrKXss.exe
  C:\Windows\System\xOrKXss.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\oJYjQJQ.exe
  C:\Windows\System\oJYjQJQ.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\nOpwDrv.exe
  C:\Windows\System\nOpwDrv.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\iuoLSgw.exe
  C:\Windows\System\iuoLSgw.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\XOBYbLx.exe
  C:\Windows\System\XOBYbLx.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\oCdQOcq.exe
  C:\Windows\System\oCdQOcq.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\VyRTaJw.exe
  C:\Windows\System\VyRTaJw.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\wrKLwNB.exe
  C:\Windows\System\wrKLwNB.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\XgDXOOY.exe
  C:\Windows\System\XgDXOOY.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\CCQSWEK.exe
  C:\Windows\System\CCQSWEK.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\dhpsoKF.exe
  C:\Windows\System\dhpsoKF.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\PUDnELF.exe
  C:\Windows\System\PUDnELF.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\Ztifqed.exe
  C:\Windows\System\Ztifqed.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\eAqnbwq.exe
  C:\Windows\System\eAqnbwq.exe
  2⤵
  PID:2944
- C:\Windows\System\ISjWCHW.exe
  C:\Windows\System\ISjWCHW.exe
  2⤵
  PID:672
- C:\Windows\System\huWYZlI.exe
  C:\Windows\System\huWYZlI.exe
  2⤵
  PID:2816
- C:\Windows\System\jalHbGE.exe
  C:\Windows\System\jalHbGE.exe
  2⤵
  PID:1512
- C:\Windows\System\xIFXZyt.exe
  C:\Windows\System\xIFXZyt.exe
  2⤵
  PID:2656
- C:\Windows\System\xBeDIEu.exe
  C:\Windows\System\xBeDIEu.exe
  2⤵
  PID:1296
- C:\Windows\System\xHDmnDu.exe
  C:\Windows\System\xHDmnDu.exe
  2⤵
  PID:1048
- C:\Windows\System\PocORMO.exe
  C:\Windows\System\PocORMO.exe
  2⤵
  PID:3012
- C:\Windows\System\zBZVmGG.exe
  C:\Windows\System\zBZVmGG.exe
  2⤵
  PID:580
- C:\Windows\System\MkWQzTQ.exe
  C:\Windows\System\MkWQzTQ.exe
  2⤵
  PID:1280
- C:\Windows\System\iXUgdSV.exe
  C:\Windows\System\iXUgdSV.exe
  2⤵
  PID:3032
- C:\Windows\System\cJvQaeb.exe
  C:\Windows\System\cJvQaeb.exe
  2⤵
  PID:840
- C:\Windows\System\OnKIYsn.exe
  C:\Windows\System\OnKIYsn.exe
  2⤵
  PID:2024
- C:\Windows\System\rIMyEtb.exe
  C:\Windows\System\rIMyEtb.exe
  2⤵
  PID:1920
- C:\Windows\System\PfbcHek.exe
  C:\Windows\System\PfbcHek.exe
  2⤵
  PID:1652
- C:\Windows\System\Evsennc.exe
  C:\Windows\System\Evsennc.exe
  2⤵
  PID:1268
- C:\Windows\System\TPZhmhY.exe
  C:\Windows\System\TPZhmhY.exe
  2⤵
  PID:1776
- C:\Windows\System\drRfNUS.exe
  C:\Windows\System\drRfNUS.exe
  2⤵
  PID:568
- C:\Windows\System\qQItUCq.exe
  C:\Windows\System\qQItUCq.exe
  2⤵
  PID:2492
- C:\Windows\System\aLIoyin.exe
  C:\Windows\System\aLIoyin.exe
  2⤵
  PID:604
- C:\Windows\System\ZjwPBeM.exe
  C:\Windows\System\ZjwPBeM.exe
  2⤵
  PID:2236
- C:\Windows\System\mfMnQdF.exe
  C:\Windows\System\mfMnQdF.exe
  2⤵
  PID:1336
- C:\Windows\System\osFtTuU.exe
  C:\Windows\System\osFtTuU.exe
  2⤵
  PID:884
- C:\Windows\System\IxuWbOO.exe
  C:\Windows\System\IxuWbOO.exe
  2⤵
  PID:1896
- C:\Windows\System\DkFVgUW.exe
  C:\Windows\System\DkFVgUW.exe
  2⤵
  PID:2420
- C:\Windows\System\ECjjsPP.exe
  C:\Windows\System\ECjjsPP.exe
  2⤵
  PID:1748
- C:\Windows\System\nmXBoRz.exe
  C:\Windows\System\nmXBoRz.exe
  2⤵
  PID:2544
- C:\Windows\System\KGpLJRX.exe
  C:\Windows\System\KGpLJRX.exe
  2⤵
  PID:2260
- C:\Windows\System\LruSvFC.exe
  C:\Windows\System\LruSvFC.exe
  2⤵
  PID:2756
- C:\Windows\System\uBLEfla.exe
  C:\Windows\System\uBLEfla.exe
  2⤵
  PID:2244
- C:\Windows\System\mcxPtBq.exe
  C:\Windows\System\mcxPtBq.exe
  2⤵
  PID:2936
- C:\Windows\System\GzGvlRA.exe
  C:\Windows\System\GzGvlRA.exe
  2⤵
  PID:1260
- C:\Windows\System\EuTgyOj.exe
  C:\Windows\System\EuTgyOj.exe
  2⤵
  PID:2624
- C:\Windows\System\sQGHPjQ.exe
  C:\Windows\System\sQGHPjQ.exe
  2⤵
  PID:2972
- C:\Windows\System\SbTMgLA.exe
  C:\Windows\System\SbTMgLA.exe
  2⤵
  PID:3080
- C:\Windows\System\YypZphn.exe
  C:\Windows\System\YypZphn.exe
  2⤵
  PID:3096
- C:\Windows\System\RjMaWOU.exe
  C:\Windows\System\RjMaWOU.exe
  2⤵
  PID:3112
- C:\Windows\System\eLFehVh.exe
  C:\Windows\System\eLFehVh.exe
  2⤵
  PID:3128
- C:\Windows\System\pZKFBlL.exe
  C:\Windows\System\pZKFBlL.exe
  2⤵
  PID:3144
- C:\Windows\System\akkbCFX.exe
  C:\Windows\System\akkbCFX.exe
  2⤵
  PID:3160
- C:\Windows\System\JSmZlfQ.exe
  C:\Windows\System\JSmZlfQ.exe
  2⤵
  PID:3176
- C:\Windows\System\DUmwoeY.exe
  C:\Windows\System\DUmwoeY.exe
  2⤵
  PID:3192
- C:\Windows\System\IRZSuiw.exe
  C:\Windows\System\IRZSuiw.exe
  2⤵
  PID:3208
- C:\Windows\System\HlTGJzu.exe
  C:\Windows\System\HlTGJzu.exe
  2⤵
  PID:3224
- C:\Windows\System\HDJZbsI.exe
  C:\Windows\System\HDJZbsI.exe
  2⤵
  PID:3240
- C:\Windows\System\RRabuvY.exe
  C:\Windows\System\RRabuvY.exe
  2⤵
  PID:3256
- C:\Windows\System\WPIjSYw.exe
  C:\Windows\System\WPIjSYw.exe
  2⤵
  PID:3272
- C:\Windows\System\pRZHgDU.exe
  C:\Windows\System\pRZHgDU.exe
  2⤵
  PID:3288
- C:\Windows\System\EbURTrP.exe
  C:\Windows\System\EbURTrP.exe
  2⤵
  PID:3304
- C:\Windows\System\rYnRddH.exe
  C:\Windows\System\rYnRddH.exe
  2⤵
  PID:3320
- C:\Windows\System\FZpjVlZ.exe
  C:\Windows\System\FZpjVlZ.exe
  2⤵
  PID:3336
- C:\Windows\System\AvnpSft.exe
  C:\Windows\System\AvnpSft.exe
  2⤵
  PID:3352
- C:\Windows\System\Edrbzxe.exe
  C:\Windows\System\Edrbzxe.exe
  2⤵
  PID:3368
- C:\Windows\System\uDlQrZq.exe
  C:\Windows\System\uDlQrZq.exe
  2⤵
  PID:3384
- C:\Windows\System\PgUKpTu.exe
  C:\Windows\System\PgUKpTu.exe
  2⤵
  PID:3400
- C:\Windows\System\xsvJFAR.exe
  C:\Windows\System\xsvJFAR.exe
  2⤵
  PID:3416
- C:\Windows\System\wSZFZjK.exe
  C:\Windows\System\wSZFZjK.exe
  2⤵
  PID:3432
- C:\Windows\System\FktOlWj.exe
  C:\Windows\System\FktOlWj.exe
  2⤵
  PID:3448
- C:\Windows\System\HGbntpd.exe
  C:\Windows\System\HGbntpd.exe
  2⤵
  PID:3464
- C:\Windows\System\xaoqiMt.exe
  C:\Windows\System\xaoqiMt.exe
  2⤵
  PID:3480
- C:\Windows\System\NtkdexO.exe
  C:\Windows\System\NtkdexO.exe
  2⤵
  PID:3496
- C:\Windows\System\yIBNxwE.exe
  C:\Windows\System\yIBNxwE.exe
  2⤵
  PID:3512
- C:\Windows\System\IBstavI.exe
  C:\Windows\System\IBstavI.exe
  2⤵
  PID:3528
- C:\Windows\System\GEHFrEk.exe
  C:\Windows\System\GEHFrEk.exe
  2⤵
  PID:3544
- C:\Windows\System\xQdvKVi.exe
  C:\Windows\System\xQdvKVi.exe
  2⤵
  PID:3560
- C:\Windows\System\tNSPViE.exe
  C:\Windows\System\tNSPViE.exe
  2⤵
  PID:3576
- C:\Windows\System\ADWPIwK.exe
  C:\Windows\System\ADWPIwK.exe
  2⤵
  PID:3592
- C:\Windows\System\ygPlnJb.exe
  C:\Windows\System\ygPlnJb.exe
  2⤵
  PID:3608
- C:\Windows\System\PFIEnuH.exe
  C:\Windows\System\PFIEnuH.exe
  2⤵
  PID:3624
- C:\Windows\System\KKufOZW.exe
  C:\Windows\System\KKufOZW.exe
  2⤵
  PID:3640
- C:\Windows\System\deIEyZx.exe
  C:\Windows\System\deIEyZx.exe
  2⤵
  PID:3656
- C:\Windows\System\zdbGLFL.exe
  C:\Windows\System\zdbGLFL.exe
  2⤵
  PID:3672
- C:\Windows\System\zSlTpVk.exe
  C:\Windows\System\zSlTpVk.exe
  2⤵
  PID:3688
- C:\Windows\System\YZAknRc.exe
  C:\Windows\System\YZAknRc.exe
  2⤵
  PID:3704
- C:\Windows\System\aGvgPgY.exe
  C:\Windows\System\aGvgPgY.exe
  2⤵
  PID:3720
- C:\Windows\System\BsQMzbB.exe
  C:\Windows\System\BsQMzbB.exe
  2⤵
  PID:3736
- C:\Windows\System\EZKqDGE.exe
  C:\Windows\System\EZKqDGE.exe
  2⤵
  PID:3752
- C:\Windows\System\kwZvxio.exe
  C:\Windows\System\kwZvxio.exe
  2⤵
  PID:3768
- C:\Windows\System\bpgGMIX.exe
  C:\Windows\System\bpgGMIX.exe
  2⤵
  PID:3784
- C:\Windows\System\gkEmiiz.exe
  C:\Windows\System\gkEmiiz.exe
  2⤵
  PID:3800
- C:\Windows\System\apyXfTG.exe
  C:\Windows\System\apyXfTG.exe
  2⤵
  PID:3816
- C:\Windows\System\UfvVRfE.exe
  C:\Windows\System\UfvVRfE.exe
  2⤵
  PID:3832
- C:\Windows\System\PrkKPxh.exe
  C:\Windows\System\PrkKPxh.exe
  2⤵
  PID:3848
- C:\Windows\System\DGuehUW.exe
  C:\Windows\System\DGuehUW.exe
  2⤵
  PID:3864
- C:\Windows\System\EgsMLMI.exe
  C:\Windows\System\EgsMLMI.exe
  2⤵
  PID:3880
- C:\Windows\System\niuhDSr.exe
  C:\Windows\System\niuhDSr.exe
  2⤵
  PID:3896
- C:\Windows\System\aWVWgZb.exe
  C:\Windows\System\aWVWgZb.exe
  2⤵
  PID:3912
- C:\Windows\System\SzjvPHW.exe
  C:\Windows\System\SzjvPHW.exe
  2⤵
  PID:3928
- C:\Windows\System\YfNmZxf.exe
  C:\Windows\System\YfNmZxf.exe
  2⤵
  PID:3944
- C:\Windows\System\GZcIfer.exe
  C:\Windows\System\GZcIfer.exe
  2⤵
  PID:3960
- C:\Windows\System\VTOrBTG.exe
  C:\Windows\System\VTOrBTG.exe
  2⤵
  PID:3976
- C:\Windows\System\JMtXQrV.exe
  C:\Windows\System\JMtXQrV.exe
  2⤵
  PID:3992
- C:\Windows\System\WlxeoOi.exe
  C:\Windows\System\WlxeoOi.exe
  2⤵
  PID:4008
- C:\Windows\System\tAKhylj.exe
  C:\Windows\System\tAKhylj.exe
  2⤵
  PID:4024
- C:\Windows\System\GwsHrUs.exe
  C:\Windows\System\GwsHrUs.exe
  2⤵
  PID:4040
- C:\Windows\System\yXYSlxA.exe
  C:\Windows\System\yXYSlxA.exe
  2⤵
  PID:4056
- C:\Windows\System\qLYODCa.exe
  C:\Windows\System\qLYODCa.exe
  2⤵
  PID:4072
- C:\Windows\System\SawbDTn.exe
  C:\Windows\System\SawbDTn.exe
  2⤵
  PID:4088
- C:\Windows\System\xHluZqn.exe
  C:\Windows\System\xHluZqn.exe
  2⤵
  PID:1520
- C:\Windows\System\rDJddMs.exe
  C:\Windows\System\rDJddMs.exe
  2⤵
  PID:2104
- C:\Windows\System\tKshTMc.exe
  C:\Windows\System\tKshTMc.exe
  2⤵
  PID:708
- C:\Windows\System\OynETIs.exe
  C:\Windows\System\OynETIs.exe
  2⤵
  PID:1848
- C:\Windows\System\LEfmbIH.exe
  C:\Windows\System\LEfmbIH.exe
  2⤵
  PID:1640
- C:\Windows\System\rUZWGuE.exe
  C:\Windows\System\rUZWGuE.exe
  2⤵
  PID:1256
- C:\Windows\System\mfnMrju.exe
  C:\Windows\System\mfnMrju.exe
  2⤵
  PID:1968
- C:\Windows\System\ODQcfcj.exe
  C:\Windows\System\ODQcfcj.exe
  2⤵
  PID:1876
- C:\Windows\System\ixtMgaU.exe
  C:\Windows\System\ixtMgaU.exe
  2⤵
  PID:1564
- C:\Windows\System\mssmsNx.exe
  C:\Windows\System\mssmsNx.exe
  2⤵
  PID:1744
- C:\Windows\System\ZQBXYKd.exe
  C:\Windows\System\ZQBXYKd.exe
  2⤵
  PID:2040
- C:\Windows\System\fKStxCq.exe
  C:\Windows\System\fKStxCq.exe
  2⤵
  PID:2384
- C:\Windows\System\VfbLvSy.exe
  C:\Windows\System\VfbLvSy.exe
  2⤵
  PID:1172
- C:\Windows\System\fvusSzc.exe
  C:\Windows\System\fvusSzc.exe
  2⤵
  PID:3092
- C:\Windows\System\znTtkIM.exe
  C:\Windows\System\znTtkIM.exe
  2⤵
  PID:3124
- C:\Windows\System\yHTuPkQ.exe
  C:\Windows\System\yHTuPkQ.exe
  2⤵
  PID:3156
- C:\Windows\System\LHjYBlh.exe
  C:\Windows\System\LHjYBlh.exe
  2⤵
  PID:3172
- C:\Windows\System\tozSKIH.exe
  C:\Windows\System\tozSKIH.exe
  2⤵
  PID:3220
- C:\Windows\System\BjfiopQ.exe
  C:\Windows\System\BjfiopQ.exe
  2⤵
  PID:3252
- C:\Windows\System\XEVIaRj.exe
  C:\Windows\System\XEVIaRj.exe
  2⤵
  PID:3268
- C:\Windows\System\LWkrlEq.exe
  C:\Windows\System\LWkrlEq.exe
  2⤵
  PID:3316
- C:\Windows\System\LprBmoA.exe
  C:\Windows\System\LprBmoA.exe
  2⤵
  PID:3348
- C:\Windows\System\zhhwYRw.exe
  C:\Windows\System\zhhwYRw.exe
  2⤵
  PID:3408
- C:\Windows\System\HIrxUzd.exe
  C:\Windows\System\HIrxUzd.exe
  2⤵
  PID:3412
- C:\Windows\System\LrWnOsp.exe
  C:\Windows\System\LrWnOsp.exe
  2⤵
  PID:3444
- C:\Windows\System\usHaovT.exe
  C:\Windows\System\usHaovT.exe
  2⤵
  PID:3476
- C:\Windows\System\tLGMhul.exe
  C:\Windows\System\tLGMhul.exe
  2⤵
  PID:3508
- C:\Windows\System\KgkGOcF.exe
  C:\Windows\System\KgkGOcF.exe
  2⤵
  PID:3524
- C:\Windows\System\UrJnsRh.exe
  C:\Windows\System\UrJnsRh.exe
  2⤵
  PID:3556
- C:\Windows\System\oVxiaLa.exe
  C:\Windows\System\oVxiaLa.exe
  2⤵
  PID:3604
- C:\Windows\System\vkAXDAH.exe
  C:\Windows\System\vkAXDAH.exe
  2⤵
  PID:3620
- C:\Windows\System\zXfPumj.exe
  C:\Windows\System\zXfPumj.exe
  2⤵
  PID:3652
- C:\Windows\System\TPXQeid.exe
  C:\Windows\System\TPXQeid.exe
  2⤵
  PID:3684
- C:\Windows\System\DXcHcjU.exe
  C:\Windows\System\DXcHcjU.exe
  2⤵
  PID:3716
- C:\Windows\System\KFMtfDN.exe
  C:\Windows\System\KFMtfDN.exe
  2⤵
  PID:3764
- C:\Windows\System\auNvNHL.exe
  C:\Windows\System\auNvNHL.exe
  2⤵
  PID:3792
- C:\Windows\System\UOZWOie.exe
  C:\Windows\System\UOZWOie.exe
  2⤵
  PID:3812
- C:\Windows\System\RQPFnfE.exe
  C:\Windows\System\RQPFnfE.exe
  2⤵
  PID:3844
- C:\Windows\System\yzijdiL.exe
  C:\Windows\System\yzijdiL.exe
  2⤵
  PID:3892
- C:\Windows\System\CVfWaVo.exe
  C:\Windows\System\CVfWaVo.exe
  2⤵
  PID:3924
- C:\Windows\System\eajbAhx.exe
  C:\Windows\System\eajbAhx.exe
  2⤵
  PID:3956
- C:\Windows\System\BrklwCp.exe
  C:\Windows\System\BrklwCp.exe
  2⤵
  PID:3988
- C:\Windows\System\TZJLmEI.exe
  C:\Windows\System\TZJLmEI.exe
  2⤵
  PID:4016
- C:\Windows\System\vNBiyiy.exe
  C:\Windows\System\vNBiyiy.exe
  2⤵
  PID:4032
- C:\Windows\System\FfRRxZc.exe
  C:\Windows\System\FfRRxZc.exe
  2⤵
  PID:4084
- C:\Windows\System\sqKkUUd.exe
  C:\Windows\System\sqKkUUd.exe
  2⤵
  PID:2344
- C:\Windows\System\FbieAmK.exe
  C:\Windows\System\FbieAmK.exe
  2⤵
  PID:1872
- C:\Windows\System\vhviIik.exe
  C:\Windows\System\vhviIik.exe
  2⤵
  PID:1772
- C:\Windows\System\ZRyfRlQ.exe
  C:\Windows\System\ZRyfRlQ.exe
  2⤵
  PID:1928
- C:\Windows\System\gsnlJYz.exe
  C:\Windows\System\gsnlJYz.exe
  2⤵
  PID:2844
- C:\Windows\System\XnRlbCv.exe
  C:\Windows\System\XnRlbCv.exe
  2⤵
  PID:2680
- C:\Windows\System\kEvgXhL.exe
  C:\Windows\System\kEvgXhL.exe
  2⤵
  PID:3076
- C:\Windows\System\fMdnfvH.exe
  C:\Windows\System\fMdnfvH.exe
  2⤵
  PID:3108
- C:\Windows\System\cupvZEV.exe
  C:\Windows\System\cupvZEV.exe
  2⤵
  PID:3204
- C:\Windows\System\kDotDra.exe
  C:\Windows\System\kDotDra.exe
  2⤵
  PID:3284
- C:\Windows\System\uSSYYlb.exe
  C:\Windows\System\uSSYYlb.exe
  2⤵
  PID:3312
- C:\Windows\System\XVdYcoP.exe
  C:\Windows\System\XVdYcoP.exe
  2⤵
  PID:3380
- C:\Windows\System\ryEIoUM.exe
  C:\Windows\System\ryEIoUM.exe
  2⤵
  PID:3428
- C:\Windows\System\quqIsTB.exe
  C:\Windows\System\quqIsTB.exe
  2⤵
  PID:4104
- C:\Windows\System\evGLRKt.exe
  C:\Windows\System\evGLRKt.exe
  2⤵
  PID:4120
- C:\Windows\System\FkGFZFb.exe
  C:\Windows\System\FkGFZFb.exe
  2⤵
  PID:4136
- C:\Windows\System\iNjJLNV.exe
  C:\Windows\System\iNjJLNV.exe
  2⤵
  PID:4152
- C:\Windows\System\rGdifFK.exe
  C:\Windows\System\rGdifFK.exe
  2⤵
  PID:4168
- C:\Windows\System\cPMPaLE.exe
  C:\Windows\System\cPMPaLE.exe
  2⤵
  PID:4184
- C:\Windows\System\BZxzIdg.exe
  C:\Windows\System\BZxzIdg.exe
  2⤵
  PID:4200
- C:\Windows\System\goIrOJg.exe
  C:\Windows\System\goIrOJg.exe
  2⤵
  PID:4216
- C:\Windows\System\HSksuWP.exe
  C:\Windows\System\HSksuWP.exe
  2⤵
  PID:4232
- C:\Windows\System\dUUMbKM.exe
  C:\Windows\System\dUUMbKM.exe
  2⤵
  PID:4248
- C:\Windows\System\EbThVuR.exe
  C:\Windows\System\EbThVuR.exe
  2⤵
  PID:4264
- C:\Windows\System\pWklUAs.exe
  C:\Windows\System\pWklUAs.exe
  2⤵
  PID:4280
- C:\Windows\System\KYnIVhq.exe
  C:\Windows\System\KYnIVhq.exe
  2⤵
  PID:4296
- C:\Windows\System\aPUcaNF.exe
  C:\Windows\System\aPUcaNF.exe
  2⤵
  PID:4312
- C:\Windows\System\QySFQhU.exe
  C:\Windows\System\QySFQhU.exe
  2⤵
  PID:4328
- C:\Windows\System\THtMMRq.exe
  C:\Windows\System\THtMMRq.exe
  2⤵
  PID:4344
- C:\Windows\System\gjaAYod.exe
  C:\Windows\System\gjaAYod.exe
  2⤵
  PID:4360
- C:\Windows\System\AqWRAmB.exe
  C:\Windows\System\AqWRAmB.exe
  2⤵
  PID:4376
- C:\Windows\System\XjVlFJm.exe
  C:\Windows\System\XjVlFJm.exe
  2⤵
  PID:4392
- C:\Windows\System\Kykxzkc.exe
  C:\Windows\System\Kykxzkc.exe
  2⤵
  PID:4408
- C:\Windows\System\kftKWzT.exe
  C:\Windows\System\kftKWzT.exe
  2⤵
  PID:4424
- C:\Windows\System\KEiXbHx.exe
  C:\Windows\System\KEiXbHx.exe
  2⤵
  PID:4440
- C:\Windows\System\uwDQktP.exe
  C:\Windows\System\uwDQktP.exe
  2⤵
  PID:4456
- C:\Windows\System\kIikKLn.exe
  C:\Windows\System\kIikKLn.exe
  2⤵
  PID:4472
- C:\Windows\System\OHFwgWy.exe
  C:\Windows\System\OHFwgWy.exe
  2⤵
  PID:4488
- C:\Windows\System\WwQaHrq.exe
  C:\Windows\System\WwQaHrq.exe
  2⤵
  PID:4504
- C:\Windows\System\BYgtdjf.exe
  C:\Windows\System\BYgtdjf.exe
  2⤵
  PID:4520
- C:\Windows\System\egZgVdk.exe
  C:\Windows\System\egZgVdk.exe
  2⤵
  PID:4536
- C:\Windows\System\JxIftYI.exe
  C:\Windows\System\JxIftYI.exe
  2⤵
  PID:4552
- C:\Windows\System\QGyyoIT.exe
  C:\Windows\System\QGyyoIT.exe
  2⤵
  PID:4568
- C:\Windows\System\kffJZgA.exe
  C:\Windows\System\kffJZgA.exe
  2⤵
  PID:4584
- C:\Windows\System\VifDZhs.exe
  C:\Windows\System\VifDZhs.exe
  2⤵
  PID:4600
- C:\Windows\System\ZypOajx.exe
  C:\Windows\System\ZypOajx.exe
  2⤵
  PID:4616
- C:\Windows\System\xDPVUWw.exe
  C:\Windows\System\xDPVUWw.exe
  2⤵
  PID:4632
- C:\Windows\System\uSVvThb.exe
  C:\Windows\System\uSVvThb.exe
  2⤵
  PID:4648
- C:\Windows\System\fMVicNI.exe
  C:\Windows\System\fMVicNI.exe
  2⤵
  PID:4664
- C:\Windows\System\XoyBAFq.exe
  C:\Windows\System\XoyBAFq.exe
  2⤵
  PID:4680
- C:\Windows\System\yaaiieU.exe
  C:\Windows\System\yaaiieU.exe
  2⤵
  PID:4696
- C:\Windows\System\TwtNGNO.exe
  C:\Windows\System\TwtNGNO.exe
  2⤵
  PID:4712
- C:\Windows\System\QqVUhaC.exe
  C:\Windows\System\QqVUhaC.exe
  2⤵
  PID:4728
- C:\Windows\System\WHJdWvD.exe
  C:\Windows\System\WHJdWvD.exe
  2⤵
  PID:4744
- C:\Windows\System\EjcVsIS.exe
  C:\Windows\System\EjcVsIS.exe
  2⤵
  PID:4760
- C:\Windows\System\uBONrxV.exe
  C:\Windows\System\uBONrxV.exe
  2⤵
  PID:4776
- C:\Windows\System\DJhnqRA.exe
  C:\Windows\System\DJhnqRA.exe
  2⤵
  PID:4792
- C:\Windows\System\nLqrFVg.exe
  C:\Windows\System\nLqrFVg.exe
  2⤵
  PID:4808
- C:\Windows\System\oiQDLMA.exe
  C:\Windows\System\oiQDLMA.exe
  2⤵
  PID:4824
- C:\Windows\System\OdhpoPP.exe
  C:\Windows\System\OdhpoPP.exe
  2⤵
  PID:4840
- C:\Windows\System\seJQeff.exe
  C:\Windows\System\seJQeff.exe
  2⤵
  PID:4856
- C:\Windows\System\uoVMSGA.exe
  C:\Windows\System\uoVMSGA.exe
  2⤵
  PID:4872
- C:\Windows\System\alBmAAG.exe
  C:\Windows\System\alBmAAG.exe
  2⤵
  PID:4888
- C:\Windows\System\aZFtnjL.exe
  C:\Windows\System\aZFtnjL.exe
  2⤵
  PID:4904
- C:\Windows\System\tvdGUbT.exe
  C:\Windows\System\tvdGUbT.exe
  2⤵
  PID:4920
- C:\Windows\System\NpbmPcT.exe
  C:\Windows\System\NpbmPcT.exe
  2⤵
  PID:4936
- C:\Windows\System\bBUGlxR.exe
  C:\Windows\System\bBUGlxR.exe
  2⤵
  PID:4952
- C:\Windows\System\ktNuhlT.exe
  C:\Windows\System\ktNuhlT.exe
  2⤵
  PID:4968
- C:\Windows\System\TfsmNru.exe
  C:\Windows\System\TfsmNru.exe
  2⤵
  PID:4984
- C:\Windows\System\Lccpfpj.exe
  C:\Windows\System\Lccpfpj.exe
  2⤵
  PID:5000
- C:\Windows\System\jzwccnp.exe
  C:\Windows\System\jzwccnp.exe
  2⤵
  PID:5016
- C:\Windows\System\vPsOtkJ.exe
  C:\Windows\System\vPsOtkJ.exe
  2⤵
  PID:5032
- C:\Windows\System\gAhZmxc.exe
  C:\Windows\System\gAhZmxc.exe
  2⤵
  PID:5048
- C:\Windows\System\XfbVSkC.exe
  C:\Windows\System\XfbVSkC.exe
  2⤵
  PID:5064
- C:\Windows\System\ihHzwYj.exe
  C:\Windows\System\ihHzwYj.exe
  2⤵
  PID:5080
- C:\Windows\System\atDwWuN.exe
  C:\Windows\System\atDwWuN.exe
  2⤵
  PID:5096
- C:\Windows\System\zAThsbe.exe
  C:\Windows\System\zAThsbe.exe
  2⤵
  PID:5112
- C:\Windows\System\rRoZyIc.exe
  C:\Windows\System\rRoZyIc.exe
  2⤵
  PID:3504
- C:\Windows\System\GzIOJtk.exe
  C:\Windows\System\GzIOJtk.exe
  2⤵
  PID:3572
- C:\Windows\System\KAsPoBo.exe
  C:\Windows\System\KAsPoBo.exe
  2⤵
  PID:3664
- C:\Windows\System\HhLOoqc.exe
  C:\Windows\System\HhLOoqc.exe
  2⤵
  PID:3680
- C:\Windows\System\KQFKtlQ.exe
  C:\Windows\System\KQFKtlQ.exe
  2⤵
  PID:3760
- C:\Windows\System\vFCKjPu.exe
  C:\Windows\System\vFCKjPu.exe
  2⤵
  PID:3824
- C:\Windows\System\BOrLicS.exe
  C:\Windows\System\BOrLicS.exe
  2⤵
  PID:3888
- C:\Windows\System\TFPaAPF.exe
  C:\Windows\System\TFPaAPF.exe
  2⤵
  PID:3952
- C:\Windows\System\hJzlYVf.exe
  C:\Windows\System\hJzlYVf.exe
  2⤵
  PID:4004
- C:\Windows\System\XTRUaOq.exe
  C:\Windows\System\XTRUaOq.exe
  2⤵
  PID:2988
- C:\Windows\System\zDMxYad.exe
  C:\Windows\System\zDMxYad.exe
  2⤵
  PID:2464
- C:\Windows\System\bCZuous.exe
  C:\Windows\System\bCZuous.exe
  2⤵
  PID:3044
- C:\Windows\System\kZyJPxo.exe
  C:\Windows\System\kZyJPxo.exe
  2⤵
  PID:236
- C:\Windows\System\SGSLOCH.exe
  C:\Windows\System\SGSLOCH.exe
  2⤵
  PID:3140
- C:\Windows\System\nehtDRP.exe
  C:\Windows\System\nehtDRP.exe
  2⤵
  PID:3328
- C:\Windows\System\AWBbgAJ.exe
  C:\Windows\System\AWBbgAJ.exe
  2⤵
  PID:3440
- C:\Windows\System\IwJQmGh.exe
  C:\Windows\System\IwJQmGh.exe
  2⤵
  PID:3492
- C:\Windows\System\griZVhO.exe
  C:\Windows\System\griZVhO.exe
  2⤵
  PID:4128
- C:\Windows\System\XfPIfzL.exe
  C:\Windows\System\XfPIfzL.exe
  2⤵
  PID:4148
- C:\Windows\System\FgEMvpk.exe
  C:\Windows\System\FgEMvpk.exe
  2⤵
  PID:4180
- C:\Windows\System\AHPBtnr.exe
  C:\Windows\System\AHPBtnr.exe
  2⤵
  PID:4212
- C:\Windows\System\GbCGCqV.exe
  C:\Windows\System\GbCGCqV.exe
  2⤵
  PID:4240
- C:\Windows\System\xvFfhxq.exe
  C:\Windows\System\xvFfhxq.exe
  2⤵
  PID:4276
- C:\Windows\System\bdRDKMt.exe
  C:\Windows\System\bdRDKMt.exe
  2⤵
  PID:4308
- C:\Windows\System\EdhybiD.exe
  C:\Windows\System\EdhybiD.exe
  2⤵
  PID:4340
- C:\Windows\System\ZZvhIAT.exe
  C:\Windows\System\ZZvhIAT.exe
  2⤵
  PID:4352
- C:\Windows\System\NnTwWga.exe
  C:\Windows\System\NnTwWga.exe
  2⤵
  PID:4400
- C:\Windows\System\WMArUKj.exe
  C:\Windows\System\WMArUKj.exe
  2⤵
  PID:4416
- C:\Windows\System\RJesuCV.exe
  C:\Windows\System\RJesuCV.exe
  2⤵
  PID:4448
- C:\Windows\System\LGXTctw.exe
  C:\Windows\System\LGXTctw.exe
  2⤵
  PID:4480
- C:\Windows\System\FoRbewo.exe
  C:\Windows\System\FoRbewo.exe
  2⤵
  PID:4512
- C:\Windows\System\jAKCcVi.exe
  C:\Windows\System\jAKCcVi.exe
  2⤵
  PID:4544
- C:\Windows\System\iEjipEw.exe
  C:\Windows\System\iEjipEw.exe
  2⤵
  PID:4576
- C:\Windows\System\aXygKmJ.exe
  C:\Windows\System\aXygKmJ.exe
  2⤵
  PID:4624
- C:\Windows\System\LYhoSDj.exe
  C:\Windows\System\LYhoSDj.exe
  2⤵
  PID:4640
- C:\Windows\System\ypydIIp.exe
  C:\Windows\System\ypydIIp.exe
  2⤵
  PID:4672
- C:\Windows\System\lUAoGIn.exe
  C:\Windows\System\lUAoGIn.exe
  2⤵
  PID:4704
- C:\Windows\System\dMnJBSF.exe
  C:\Windows\System\dMnJBSF.exe
  2⤵
  PID:4736
- C:\Windows\System\vHCBtQM.exe
  C:\Windows\System\vHCBtQM.exe
  2⤵
  PID:4768
- C:\Windows\System\qBSJfky.exe
  C:\Windows\System\qBSJfky.exe
  2⤵
  PID:4800
- C:\Windows\System\ySAAbDs.exe
  C:\Windows\System\ySAAbDs.exe
  2⤵
  PID:4832
- C:\Windows\System\dILMVTL.exe
  C:\Windows\System\dILMVTL.exe
  2⤵
  PID:4864
- C:\Windows\System\CgWpUtt.exe
  C:\Windows\System\CgWpUtt.exe
  2⤵
  PID:4896
- C:\Windows\System\ChEEgPo.exe
  C:\Windows\System\ChEEgPo.exe
  2⤵
  PID:4928
- C:\Windows\System\bAxdTOj.exe
  C:\Windows\System\bAxdTOj.exe
  2⤵
  PID:4960
- C:\Windows\System\CaiMnPA.exe
  C:\Windows\System\CaiMnPA.exe
  2⤵
  PID:4992
- C:\Windows\System\PSFHKxw.exe
  C:\Windows\System\PSFHKxw.exe
  2⤵
  PID:5024
- C:\Windows\System\eRlbReX.exe
  C:\Windows\System\eRlbReX.exe
  2⤵
  PID:1952
- C:\Windows\System\aAKQORE.exe
  C:\Windows\System\aAKQORE.exe
  2⤵
  PID:5056
- C:\Windows\System\vKgbzvU.exe
  C:\Windows\System\vKgbzvU.exe
  2⤵
  PID:5088
- C:\Windows\System\NQBuBgL.exe
  C:\Windows\System\NQBuBgL.exe
  2⤵
  PID:3540
- C:\Windows\System\GmqTvlo.exe
  C:\Windows\System\GmqTvlo.exe
  2⤵
  PID:3616
- C:\Windows\System\BkavSIS.exe
  C:\Windows\System\BkavSIS.exe
  2⤵
  PID:3776
- C:\Windows\System\zzTptwp.exe
  C:\Windows\System\zzTptwp.exe
  2⤵
  PID:3904
- C:\Windows\System\MrVRkpl.exe
  C:\Windows\System\MrVRkpl.exe
  2⤵
  PID:4048
- C:\Windows\System\suRzCXG.exe
  C:\Windows\System\suRzCXG.exe
  2⤵
  PID:2744
- C:\Windows\System\vPNXFvm.exe
  C:\Windows\System\vPNXFvm.exe
  2⤵
  PID:2876
- C:\Windows\System\wyVZiKg.exe
  C:\Windows\System\wyVZiKg.exe
  2⤵
  PID:3152
- C:\Windows\System\RFHVBut.exe
  C:\Windows\System\RFHVBut.exe
  2⤵
  PID:3248
- C:\Windows\System\gQPbCdz.exe
  C:\Windows\System\gQPbCdz.exe
  2⤵
  PID:4116
- C:\Windows\System\lbVyhnc.exe
  C:\Windows\System\lbVyhnc.exe
  2⤵
  PID:4164
- C:\Windows\System\LyACPoT.exe
  C:\Windows\System\LyACPoT.exe
  2⤵
  PID:4196
- C:\Windows\System\BUiDvAt.exe
  C:\Windows\System\BUiDvAt.exe
  2⤵
  PID:4272
- C:\Windows\System\WiakRME.exe
  C:\Windows\System\WiakRME.exe
  2⤵
  PID:4320
- C:\Windows\System\UdAmDVL.exe
  C:\Windows\System\UdAmDVL.exe
  2⤵
  PID:2660
- C:\Windows\System\ZbXfKip.exe
  C:\Windows\System\ZbXfKip.exe
  2⤵
  PID:2012
- C:\Windows\System\GUGrMKb.exe
  C:\Windows\System\GUGrMKb.exe
  2⤵
  PID:4420
- C:\Windows\System\dsuTPrk.exe
  C:\Windows\System\dsuTPrk.exe
  2⤵
  PID:4500
- C:\Windows\System\IGMvDLf.exe
  C:\Windows\System\IGMvDLf.exe
  2⤵
  PID:4564
- C:\Windows\System\nCdzLjf.exe
  C:\Windows\System\nCdzLjf.exe
  2⤵
  PID:4660
- C:\Windows\System\lYKuGnL.exe
  C:\Windows\System\lYKuGnL.exe
  2⤵
  PID:4708
- C:\Windows\System\pyiBOQQ.exe
  C:\Windows\System\pyiBOQQ.exe
  2⤵
  PID:4740
- C:\Windows\System\rajSNjq.exe
  C:\Windows\System\rajSNjq.exe
  2⤵
  PID:4820
- C:\Windows\System\jWOSvwC.exe
  C:\Windows\System\jWOSvwC.exe
  2⤵
  PID:4868
- C:\Windows\System\sOQqwkG.exe
  C:\Windows\System\sOQqwkG.exe
  2⤵
  PID:4964
- C:\Windows\System\ehHvrAb.exe
  C:\Windows\System\ehHvrAb.exe
  2⤵
  PID:5044
- C:\Windows\System\WOmvzcr.exe
  C:\Windows\System\WOmvzcr.exe
  2⤵
  PID:5028
- C:\Windows\System\HPJhqbw.exe
  C:\Windows\System\HPJhqbw.exe
  2⤵
  PID:5092
- C:\Windows\System\fESIIty.exe
  C:\Windows\System\fESIIty.exe
  2⤵
  PID:3728
- C:\Windows\System\ShJoxEp.exe
  C:\Windows\System\ShJoxEp.exe
  2⤵
  PID:3780
- C:\Windows\System\YzlPbRF.exe
  C:\Windows\System\YzlPbRF.exe
  2⤵
  PID:5128
- C:\Windows\System\mXNPiul.exe
  C:\Windows\System\mXNPiul.exe
  2⤵
  PID:5144
- C:\Windows\System\OrpsSHG.exe
  C:\Windows\System\OrpsSHG.exe
  2⤵
  PID:5160
- C:\Windows\System\VAaqZBf.exe
  C:\Windows\System\VAaqZBf.exe
  2⤵
  PID:5176
- C:\Windows\System\fvVtEOV.exe
  C:\Windows\System\fvVtEOV.exe
  2⤵
  PID:5192
- C:\Windows\System\ztDpDpt.exe
  C:\Windows\System\ztDpDpt.exe
  2⤵
  PID:5208
- C:\Windows\System\BollptM.exe
  C:\Windows\System\BollptM.exe
  2⤵
  PID:5224
- C:\Windows\System\byDjcgs.exe
  C:\Windows\System\byDjcgs.exe
  2⤵
  PID:5240
- C:\Windows\System\vGzOAfA.exe
  C:\Windows\System\vGzOAfA.exe
  2⤵
  PID:5256
- C:\Windows\System\FiihNKh.exe
  C:\Windows\System\FiihNKh.exe
  2⤵
  PID:5272
- C:\Windows\System\FtuVYYO.exe
  C:\Windows\System\FtuVYYO.exe
  2⤵
  PID:5288
- C:\Windows\System\qLAocbN.exe
  C:\Windows\System\qLAocbN.exe
  2⤵
  PID:5304
- C:\Windows\System\QtdJnmg.exe
  C:\Windows\System\QtdJnmg.exe
  2⤵
  PID:5320
- C:\Windows\System\KlSDyTW.exe
  C:\Windows\System\KlSDyTW.exe
  2⤵
  PID:5336
- C:\Windows\System\ywtUqju.exe
  C:\Windows\System\ywtUqju.exe
  2⤵
  PID:5352
- C:\Windows\System\XCFpXTF.exe
  C:\Windows\System\XCFpXTF.exe
  2⤵
  PID:5368
- C:\Windows\System\gQtCEeq.exe
  C:\Windows\System\gQtCEeq.exe
  2⤵
  PID:5384
- C:\Windows\System\WfUFthX.exe
  C:\Windows\System\WfUFthX.exe
  2⤵
  PID:5400
- C:\Windows\System\yioOCcw.exe
  C:\Windows\System\yioOCcw.exe
  2⤵
  PID:5416
- C:\Windows\System\OBuPrDT.exe
  C:\Windows\System\OBuPrDT.exe
  2⤵
  PID:5432
- C:\Windows\System\vtWsMOd.exe
  C:\Windows\System\vtWsMOd.exe
  2⤵
  PID:5448
- C:\Windows\System\hcFqaSC.exe
  C:\Windows\System\hcFqaSC.exe
  2⤵
  PID:5464
- C:\Windows\System\QpHwnEZ.exe
  C:\Windows\System\QpHwnEZ.exe
  2⤵
  PID:5480
- C:\Windows\System\koDXFsH.exe
  C:\Windows\System\koDXFsH.exe
  2⤵
  PID:5496
- C:\Windows\System\DgBOvIU.exe
  C:\Windows\System\DgBOvIU.exe
  2⤵
  PID:5512
- C:\Windows\System\QRqtZoC.exe
  C:\Windows\System\QRqtZoC.exe
  2⤵
  PID:5528
- C:\Windows\System\RkBXGwX.exe
  C:\Windows\System\RkBXGwX.exe
  2⤵
  PID:5544
- C:\Windows\System\ZqBYhFf.exe
  C:\Windows\System\ZqBYhFf.exe
  2⤵
  PID:5560
- C:\Windows\System\RREUAin.exe
  C:\Windows\System\RREUAin.exe
  2⤵
  PID:5576
- C:\Windows\System\Noevqbf.exe
  C:\Windows\System\Noevqbf.exe
  2⤵
  PID:5592
- C:\Windows\System\JtyfvLV.exe
  C:\Windows\System\JtyfvLV.exe
  2⤵
  PID:5608
- C:\Windows\System\WdAoIAs.exe
  C:\Windows\System\WdAoIAs.exe
  2⤵
  PID:5624
- C:\Windows\System\nKhyQnH.exe
  C:\Windows\System\nKhyQnH.exe
  2⤵
  PID:5640
- C:\Windows\System\yLkRmtg.exe
  C:\Windows\System\yLkRmtg.exe
  2⤵
  PID:5656
- C:\Windows\System\bGERFTJ.exe
  C:\Windows\System\bGERFTJ.exe
  2⤵
  PID:5672
- C:\Windows\System\ZnEDsEh.exe
  C:\Windows\System\ZnEDsEh.exe
  2⤵
  PID:5688
- C:\Windows\System\HiCSNKv.exe
  C:\Windows\System\HiCSNKv.exe
  2⤵
  PID:5704
- C:\Windows\System\EUfDgnt.exe
  C:\Windows\System\EUfDgnt.exe
  2⤵
  PID:5720
- C:\Windows\System\wTvqBFv.exe
  C:\Windows\System\wTvqBFv.exe
  2⤵
  PID:5736
- C:\Windows\System\Ellekex.exe
  C:\Windows\System\Ellekex.exe
  2⤵
  PID:5752
- C:\Windows\System\whThFuk.exe
  C:\Windows\System\whThFuk.exe
  2⤵
  PID:5768
- C:\Windows\System\YtpEkwx.exe
  C:\Windows\System\YtpEkwx.exe
  2⤵
  PID:5784
- C:\Windows\System\dIGapqy.exe
  C:\Windows\System\dIGapqy.exe
  2⤵
  PID:5800
- C:\Windows\System\gOfFojh.exe
  C:\Windows\System\gOfFojh.exe
  2⤵
  PID:5816
- C:\Windows\System\hvUAVAU.exe
  C:\Windows\System\hvUAVAU.exe
  2⤵
  PID:5832
- C:\Windows\System\kGcnsrW.exe
  C:\Windows\System\kGcnsrW.exe
  2⤵
  PID:5848
- C:\Windows\System\ZUvpDum.exe
  C:\Windows\System\ZUvpDum.exe
  2⤵
  PID:5864
- C:\Windows\System\oQJYHHR.exe
  C:\Windows\System\oQJYHHR.exe
  2⤵
  PID:5880
- C:\Windows\System\WYuNneZ.exe
  C:\Windows\System\WYuNneZ.exe
  2⤵
  PID:5896
- C:\Windows\System\OuBUzaY.exe
  C:\Windows\System\OuBUzaY.exe
  2⤵
  PID:5912
- C:\Windows\System\NFjfQpT.exe
  C:\Windows\System\NFjfQpT.exe
  2⤵
  PID:5928
- C:\Windows\System\vguKqAz.exe
  C:\Windows\System\vguKqAz.exe
  2⤵
  PID:5944
- C:\Windows\System\NQMyKoE.exe
  C:\Windows\System\NQMyKoE.exe
  2⤵
  PID:5960
- C:\Windows\System\TJGFRnw.exe
  C:\Windows\System\TJGFRnw.exe
  2⤵
  PID:5976
- C:\Windows\System\nlqJVSY.exe
  C:\Windows\System\nlqJVSY.exe
  2⤵
  PID:5992
- C:\Windows\System\mbkSNLo.exe
  C:\Windows\System\mbkSNLo.exe
  2⤵
  PID:6008
- C:\Windows\System\uJUKwqw.exe
  C:\Windows\System\uJUKwqw.exe
  2⤵
  PID:6024
- C:\Windows\System\GJKNssn.exe
  C:\Windows\System\GJKNssn.exe
  2⤵
  PID:6040
- C:\Windows\System\dKPsEjY.exe
  C:\Windows\System\dKPsEjY.exe
  2⤵
  PID:6056
- C:\Windows\System\KxfPxSf.exe
  C:\Windows\System\KxfPxSf.exe
  2⤵
  PID:6072
- C:\Windows\System\dLBbLEY.exe
  C:\Windows\System\dLBbLEY.exe
  2⤵
  PID:6088
- C:\Windows\System\ZeGugRl.exe
  C:\Windows\System\ZeGugRl.exe
  2⤵
  PID:6104
- C:\Windows\System\HUkqVlA.exe
  C:\Windows\System\HUkqVlA.exe
  2⤵
  PID:6120
- C:\Windows\System\IIUVPCb.exe
  C:\Windows\System\IIUVPCb.exe
  2⤵
  PID:6136
- C:\Windows\System\FZzxyHI.exe
  C:\Windows\System\FZzxyHI.exe
  2⤵
  PID:2036
- C:\Windows\System\HEApndB.exe
  C:\Windows\System\HEApndB.exe
  2⤵
  PID:1868
- C:\Windows\System\jMSlJVH.exe
  C:\Windows\System\jMSlJVH.exe
  2⤵
  PID:3216
- C:\Windows\System\luNcKWS.exe
  C:\Windows\System\luNcKWS.exe
  2⤵
  PID:4144
- C:\Windows\System\IkSeYTk.exe
  C:\Windows\System\IkSeYTk.exe
  2⤵
  PID:4228
- C:\Windows\System\MEuTLxd.exe
  C:\Windows\System\MEuTLxd.exe
  2⤵
  PID:2060
- C:\Windows\System\hjCiEuW.exe
  C:\Windows\System\hjCiEuW.exe
  2⤵
  PID:4436
- C:\Windows\System\bjKwaxp.exe
  C:\Windows\System\bjKwaxp.exe
  2⤵
  PID:4516
- C:\Windows\System\eURKIwg.exe
  C:\Windows\System\eURKIwg.exe
  2⤵
  PID:4644
- C:\Windows\System\FTsWoDQ.exe
  C:\Windows\System\FTsWoDQ.exe
  2⤵
  PID:4788
- C:\Windows\System\nYoGfFB.exe
  C:\Windows\System\nYoGfFB.exe
  2⤵
  PID:4916
- C:\Windows\System\uQOtwMb.exe
  C:\Windows\System\uQOtwMb.exe
  2⤵
  PID:2720
- C:\Windows\System\thasZAE.exe
  C:\Windows\System\thasZAE.exe
  2⤵
  PID:3520
- C:\Windows\System\aJSqusb.exe
  C:\Windows\System\aJSqusb.exe
  2⤵
  PID:3920
- C:\Windows\System\ttTQVjh.exe
  C:\Windows\System\ttTQVjh.exe
  2⤵
  PID:5152
- C:\Windows\System\qUjmjvb.exe
  C:\Windows\System\qUjmjvb.exe
  2⤵
  PID:5184
- C:\Windows\System\qGWytfE.exe
  C:\Windows\System\qGWytfE.exe
  2⤵
  PID:5204
- C:\Windows\System\tuurJKu.exe
  C:\Windows\System\tuurJKu.exe
  2⤵
  PID:5236
- C:\Windows\System\chvyPKz.exe
  C:\Windows\System\chvyPKz.exe
  2⤵
  PID:5268
- C:\Windows\System\jqCIUWn.exe
  C:\Windows\System\jqCIUWn.exe
  2⤵
  PID:5312
- C:\Windows\System\TdLFDdx.exe
  C:\Windows\System\TdLFDdx.exe
  2⤵
  PID:5332
- C:\Windows\System\hyozFLD.exe
  C:\Windows\System\hyozFLD.exe
  2⤵
  PID:5364
- C:\Windows\System\RoTisfl.exe
  C:\Windows\System\RoTisfl.exe
  2⤵
  PID:5396
- C:\Windows\System\ATfjQaj.exe
  C:\Windows\System\ATfjQaj.exe
  2⤵
  PID:5428
- C:\Windows\System\hgIYaRR.exe
  C:\Windows\System\hgIYaRR.exe
  2⤵
  PID:5460
- C:\Windows\System\SWACjHW.exe
  C:\Windows\System\SWACjHW.exe
  2⤵
  PID:5492
- C:\Windows\System\zolmRpO.exe
  C:\Windows\System\zolmRpO.exe
  2⤵
  PID:5524
- C:\Windows\System\BWgosvC.exe
  C:\Windows\System\BWgosvC.exe
  2⤵
  PID:5568
- C:\Windows\System\yHDknrF.exe
  C:\Windows\System\yHDknrF.exe
  2⤵
  PID:5600
- C:\Windows\System\pgYqLiW.exe
  C:\Windows\System\pgYqLiW.exe
  2⤵
  PID:5632
- C:\Windows\System\IGFraVl.exe
  C:\Windows\System\IGFraVl.exe
  2⤵
  PID:5680
- C:\Windows\System\wsrGcEm.exe
  C:\Windows\System\wsrGcEm.exe
  2⤵
  PID:5712
- C:\Windows\System\UnicFZO.exe
  C:\Windows\System\UnicFZO.exe
  2⤵
  PID:5728
- C:\Windows\System\AUKYlSh.exe
  C:\Windows\System\AUKYlSh.exe
  2⤵
  PID:5760
- C:\Windows\System\kdvgAMA.exe
  C:\Windows\System\kdvgAMA.exe
  2⤵
  PID:5792
- C:\Windows\System\HWYGlPO.exe
  C:\Windows\System\HWYGlPO.exe
  2⤵
  PID:5824
- C:\Windows\System\TpBltmJ.exe
  C:\Windows\System\TpBltmJ.exe
  2⤵
  PID:5856
- C:\Windows\System\WKxUhSE.exe
  C:\Windows\System\WKxUhSE.exe
  2⤵
  PID:5888
- C:\Windows\System\pZrDpyU.exe
  C:\Windows\System\pZrDpyU.exe
  2⤵
  PID:5920
- C:\Windows\System\bIxtGmw.exe
  C:\Windows\System\bIxtGmw.exe
  2⤵
  PID:5952
- C:\Windows\System\CcPTdAr.exe
  C:\Windows\System\CcPTdAr.exe
  2⤵
  PID:5984
- C:\Windows\System\LENrabT.exe
  C:\Windows\System\LENrabT.exe
  2⤵
  PID:6016
- C:\Windows\System\cfoYdJF.exe
  C:\Windows\System\cfoYdJF.exe
  2⤵
  PID:6064
- C:\Windows\System\JeUdtEf.exe
  C:\Windows\System\JeUdtEf.exe
  2⤵
  PID:6080
- C:\Windows\System\soxslbh.exe
  C:\Windows\System\soxslbh.exe
  2⤵
  PID:6112
- C:\Windows\System\WXtTgjo.exe
  C:\Windows\System\WXtTgjo.exe
  2⤵
  PID:4052
- C:\Windows\System\JPdXpgG.exe
  C:\Windows\System\JPdXpgG.exe
  2⤵
  PID:784
- C:\Windows\System\MXnFpMv.exe
  C:\Windows\System\MXnFpMv.exe
  2⤵
  PID:4132
- C:\Windows\System\MlZEtAP.exe
  C:\Windows\System\MlZEtAP.exe
  2⤵
  PID:2672
- C:\Windows\System\KaaLpEB.exe
  C:\Windows\System\KaaLpEB.exe
  2⤵
  PID:4548
- C:\Windows\System\PVoRdrN.exe
  C:\Windows\System\PVoRdrN.exe
  2⤵
  PID:4804
- C:\Windows\System\yvftzNl.exe
  C:\Windows\System\yvftzNl.exe
  2⤵
  PID:2396
- C:\Windows\System\wnjSNCX.exe
  C:\Windows\System\wnjSNCX.exe
  2⤵
  PID:2812
- C:\Windows\System\waYlacA.exe
  C:\Windows\System\waYlacA.exe
  2⤵
  PID:2160
- C:\Windows\System\VgNWbGU.exe
  C:\Windows\System\VgNWbGU.exe
  2⤵
  PID:2608
- C:\Windows\System\iEOwMxm.exe
  C:\Windows\System\iEOwMxm.exe
  2⤵
  PID:5220
- C:\Windows\System\KCTtWty.exe
  C:\Windows\System\KCTtWty.exe
  2⤵
  PID:844
- C:\Windows\System\TwaJOiy.exe
  C:\Windows\System\TwaJOiy.exe
  2⤵
  PID:1384
- C:\Windows\System\zaurJGh.exe
  C:\Windows\System\zaurJGh.exe
  2⤵
  PID:5252
- C:\Windows\System\iMxiuMl.exe
  C:\Windows\System\iMxiuMl.exe
  2⤵
  PID:2728
- C:\Windows\System\UYDYvbT.exe
  C:\Windows\System\UYDYvbT.exe
  2⤵
  PID:1604
- C:\Windows\System\TTIrcHZ.exe
  C:\Windows\System\TTIrcHZ.exe
  2⤵
  PID:1244
- C:\Windows\System\cnrvDRO.exe
  C:\Windows\System\cnrvDRO.exe
  2⤵
  PID:5348
- C:\Windows\System\MYffBXK.exe
  C:\Windows\System\MYffBXK.exe
  2⤵
  PID:2724
- C:\Windows\System\LkfDEiL.exe
  C:\Windows\System\LkfDEiL.exe
  2⤵
  PID:5412
- C:\Windows\System\qBrBxmD.exe
  C:\Windows\System\qBrBxmD.exe
  2⤵
  PID:5444
- C:\Windows\System\LAPrmpF.exe
  C:\Windows\System\LAPrmpF.exe
  2⤵
  PID:5540
- C:\Windows\System\CWuABPR.exe
  C:\Windows\System\CWuABPR.exe
  2⤵
  PID:1960
- C:\Windows\System\ssjMsid.exe
  C:\Windows\System\ssjMsid.exe
  2⤵
  PID:5620
- C:\Windows\System\aSnYOwg.exe
  C:\Windows\System\aSnYOwg.exe
  2⤵
  PID:5684
- C:\Windows\System\ywcWVif.exe
  C:\Windows\System\ywcWVif.exe
  2⤵
  PID:1408
- C:\Windows\System\JVDeQRz.exe
  C:\Windows\System\JVDeQRz.exe
  2⤵
  PID:900
- C:\Windows\System\iNWwzkU.exe
  C:\Windows\System\iNWwzkU.exe
  2⤵
  PID:5812
- C:\Windows\System\TRisLWe.exe
  C:\Windows\System\TRisLWe.exe
  2⤵
  PID:5876
- C:\Windows\System\bbixqRI.exe
  C:\Windows\System\bbixqRI.exe
  2⤵
  PID:5924
- C:\Windows\System\cYKVCtl.exe
  C:\Windows\System\cYKVCtl.exe
  2⤵
  PID:5972
- C:\Windows\System\pKsEEca.exe
  C:\Windows\System\pKsEEca.exe
  2⤵
  PID:6052
- C:\Windows\System\acEgiiT.exe
  C:\Windows\System\acEgiiT.exe
  2⤵
  PID:6100
- C:\Windows\System\jNuTrYr.exe
  C:\Windows\System\jNuTrYr.exe
  2⤵
  PID:3280
- C:\Windows\System\QfBvrZy.exe
  C:\Windows\System\QfBvrZy.exe
  2⤵
  PID:4336
- C:\Windows\System\pOoAQhy.exe
  C:\Windows\System\pOoAQhy.exe
  2⤵
  PID:4884
- C:\Windows\System\mGruNsr.exe
  C:\Windows\System\mGruNsr.exe
  2⤵
  PID:3696
- C:\Windows\System\NXiasPU.exe
  C:\Windows\System\NXiasPU.exe
  2⤵
  PID:2200
- C:\Windows\System\syZpMNc.exe
  C:\Windows\System\syZpMNc.exe
  2⤵
  PID:2808
- C:\Windows\System\CivkLjG.exe
  C:\Windows\System\CivkLjG.exe
  2⤵
  PID:5284
- C:\Windows\System\XSVWMHn.exe
  C:\Windows\System\XSVWMHn.exe
  2⤵
  PID:684
- C:\Windows\System\AKgXXuV.exe
  C:\Windows\System\AKgXXuV.exe
  2⤵
  PID:2152
- C:\Windows\System\fmeXsyQ.exe
  C:\Windows\System\fmeXsyQ.exe
  2⤵
  PID:5380
- C:\Windows\System\rmYYDuZ.exe
  C:\Windows\System\rmYYDuZ.exe
  2⤵
  PID:5508
- C:\Windows\System\vjhtlEX.exe
  C:\Windows\System\vjhtlEX.exe
  2⤵
  PID:5588
- C:\Windows\System\XEvFsAj.exe
  C:\Windows\System\XEvFsAj.exe
  2⤵
  PID:5732
- C:\Windows\System\ynACidx.exe
  C:\Windows\System\ynACidx.exe
  2⤵
  PID:5780
- C:\Windows\System\qwilBDQ.exe
  C:\Windows\System\qwilBDQ.exe
  2⤵
  PID:2356
- C:\Windows\System\uiXcTek.exe
  C:\Windows\System\uiXcTek.exe
  2⤵
  PID:6032
- C:\Windows\System\XWGiAnN.exe
  C:\Windows\System\XWGiAnN.exe
  2⤵
  PID:2168
- C:\Windows\System\OMapxpH.exe
  C:\Windows\System\OMapxpH.exe
  2⤵
  PID:5008
- C:\Windows\System\mJNNMIR.exe
  C:\Windows\System\mJNNMIR.exe
  2⤵
  PID:5140
- C:\Windows\System\VllsqUP.exe
  C:\Windows\System\VllsqUP.exe
  2⤵
  PID:5316
- C:\Windows\System\XfqZFTB.exe
  C:\Windows\System\XfqZFTB.exe
  2⤵
  PID:1792
- C:\Windows\System\fnSAkGG.exe
  C:\Windows\System\fnSAkGG.exe
  2⤵
  PID:5488
- C:\Windows\System\XnfWuEl.exe
  C:\Windows\System\XnfWuEl.exe
  2⤵
  PID:6156
- C:\Windows\System\YDJVZqw.exe
  C:\Windows\System\YDJVZqw.exe
  2⤵
  PID:6172
- C:\Windows\System\ixhvUeV.exe
  C:\Windows\System\ixhvUeV.exe
  2⤵
  PID:6188
- C:\Windows\System\gwZaNlx.exe
  C:\Windows\System\gwZaNlx.exe
  2⤵
  PID:6204
- C:\Windows\System\wCkDzXo.exe
  C:\Windows\System\wCkDzXo.exe
  2⤵
  PID:6220
- C:\Windows\System\swhYtdz.exe
  C:\Windows\System\swhYtdz.exe
  2⤵
  PID:6236
- C:\Windows\System\axabjRC.exe
  C:\Windows\System\axabjRC.exe
  2⤵
  PID:6252
- C:\Windows\System\zEWsYJN.exe
  C:\Windows\System\zEWsYJN.exe
  2⤵
  PID:6268
- C:\Windows\System\VIboyIg.exe
  C:\Windows\System\VIboyIg.exe
  2⤵
  PID:6284
- C:\Windows\System\dbDjfGH.exe
  C:\Windows\System\dbDjfGH.exe
  2⤵
  PID:6300
- C:\Windows\System\HYBjCCW.exe
  C:\Windows\System\HYBjCCW.exe
  2⤵
  PID:6316
- C:\Windows\System\jxlozHj.exe
  C:\Windows\System\jxlozHj.exe
  2⤵
  PID:6332
- C:\Windows\System\Ldiyayl.exe
  C:\Windows\System\Ldiyayl.exe
  2⤵
  PID:6348
- C:\Windows\System\tikuoon.exe
  C:\Windows\System\tikuoon.exe
  2⤵
  PID:6364
- C:\Windows\System\qClsHTQ.exe
  C:\Windows\System\qClsHTQ.exe
  2⤵
  PID:6380
- C:\Windows\System\SYCHuyU.exe
  C:\Windows\System\SYCHuyU.exe
  2⤵
  PID:6400
- C:\Windows\System\KCdntTX.exe
  C:\Windows\System\KCdntTX.exe
  2⤵
  PID:6416
- C:\Windows\System\VtgQaQE.exe
  C:\Windows\System\VtgQaQE.exe
  2⤵
  PID:6432
- C:\Windows\System\zUhXrpM.exe
  C:\Windows\System\zUhXrpM.exe
  2⤵
  PID:6448
- C:\Windows\System\YZXLkYK.exe
  C:\Windows\System\YZXLkYK.exe
  2⤵
  PID:6464
- C:\Windows\System\jRkjDEk.exe
  C:\Windows\System\jRkjDEk.exe
  2⤵
  PID:6480
- C:\Windows\System\zoBaQSS.exe
  C:\Windows\System\zoBaQSS.exe
  2⤵
  PID:6496
- C:\Windows\System\BipQCyv.exe
  C:\Windows\System\BipQCyv.exe
  2⤵
  PID:6512
- C:\Windows\System\bFswZSo.exe
  C:\Windows\System\bFswZSo.exe
  2⤵
  PID:6528
- C:\Windows\System\NOathMD.exe
  C:\Windows\System\NOathMD.exe
  2⤵
  PID:6544
- C:\Windows\System\yawyAYR.exe
  C:\Windows\System\yawyAYR.exe
  2⤵
  PID:6560
- C:\Windows\System\FzRvRNM.exe
  C:\Windows\System\FzRvRNM.exe
  2⤵
  PID:6580
- C:\Windows\System\uDaTImf.exe
  C:\Windows\System\uDaTImf.exe
  2⤵
  PID:6596
- C:\Windows\System\pOIAggx.exe
  C:\Windows\System\pOIAggx.exe
  2⤵
  PID:6612
- C:\Windows\System\dGJiEOS.exe
  C:\Windows\System\dGJiEOS.exe
  2⤵
  PID:6628
- C:\Windows\System\RxneSzF.exe
  C:\Windows\System\RxneSzF.exe
  2⤵
  PID:6644
- C:\Windows\System\YxhoTgL.exe
  C:\Windows\System\YxhoTgL.exe
  2⤵
  PID:6660
- C:\Windows\System\PlPTWsU.exe
  C:\Windows\System\PlPTWsU.exe
  2⤵
  PID:6676
- C:\Windows\System\Fdqojcr.exe
  C:\Windows\System\Fdqojcr.exe
  2⤵
  PID:6692
- C:\Windows\System\cYxGFSY.exe
  C:\Windows\System\cYxGFSY.exe
  2⤵
  PID:6708
- C:\Windows\System\SOpmEvz.exe
  C:\Windows\System\SOpmEvz.exe
  2⤵
  PID:6724
- C:\Windows\System\frEiIBE.exe
  C:\Windows\System\frEiIBE.exe
  2⤵
  PID:6740
- C:\Windows\System\UuLfmGx.exe
  C:\Windows\System\UuLfmGx.exe
  2⤵
  PID:6756
- C:\Windows\System\CqQQljS.exe
  C:\Windows\System\CqQQljS.exe
  2⤵
  PID:6772
- C:\Windows\System\ydQIjza.exe
  C:\Windows\System\ydQIjza.exe
  2⤵
  PID:6788
- C:\Windows\System\IihVPSq.exe
  C:\Windows\System\IihVPSq.exe
  2⤵
  PID:6804
- C:\Windows\System\zADBEoD.exe
  C:\Windows\System\zADBEoD.exe
  2⤵
  PID:6820
- C:\Windows\System\jbHBHsE.exe
  C:\Windows\System\jbHBHsE.exe
  2⤵
  PID:6836
- C:\Windows\System\YeWOstS.exe
  C:\Windows\System\YeWOstS.exe
  2⤵
  PID:6852
- C:\Windows\System\EwAdnrb.exe
  C:\Windows\System\EwAdnrb.exe
  2⤵
  PID:6868
- C:\Windows\System\KXECWpW.exe
  C:\Windows\System\KXECWpW.exe
  2⤵
  PID:6884
- C:\Windows\System\YegwWma.exe
  C:\Windows\System\YegwWma.exe
  2⤵
  PID:6900
- C:\Windows\System\CMJIzsk.exe
  C:\Windows\System\CMJIzsk.exe
  2⤵
  PID:6916
- C:\Windows\System\fKQHHvu.exe
  C:\Windows\System\fKQHHvu.exe
  2⤵
  PID:6932
- C:\Windows\System\IAURlkz.exe
  C:\Windows\System\IAURlkz.exe
  2⤵
  PID:6948
- C:\Windows\System\nOvfgOV.exe
  C:\Windows\System\nOvfgOV.exe
  2⤵
  PID:6964
- C:\Windows\System\IBuFZpu.exe
  C:\Windows\System\IBuFZpu.exe
  2⤵
  PID:6980
- C:\Windows\System\urZUnrU.exe
  C:\Windows\System\urZUnrU.exe
  2⤵
  PID:6996
- C:\Windows\System\zpHAsIv.exe
  C:\Windows\System\zpHAsIv.exe
  2⤵
  PID:7012
- C:\Windows\System\qEWmzCa.exe
  C:\Windows\System\qEWmzCa.exe
  2⤵
  PID:7040
- C:\Windows\System\TLysiEn.exe
  C:\Windows\System\TLysiEn.exe
  2⤵
  PID:7056
- C:\Windows\System\AaAUZJN.exe
  C:\Windows\System\AaAUZJN.exe
  2⤵
  PID:7072
- C:\Windows\System\PiMNaGK.exe
  C:\Windows\System\PiMNaGK.exe
  2⤵
  PID:7088
- C:\Windows\System\yjkQBRs.exe
  C:\Windows\System\yjkQBRs.exe
  2⤵
  PID:7104
- C:\Windows\System\uftlepl.exe
  C:\Windows\System\uftlepl.exe
  2⤵
  PID:7124
- C:\Windows\System\JmxGejz.exe
  C:\Windows\System\JmxGejz.exe
  2⤵
  PID:304
- C:\Windows\System\JuvezEs.exe
  C:\Windows\System\JuvezEs.exe
  2⤵
  PID:5264
- C:\Windows\System\tagXGkk.exe
  C:\Windows\System\tagXGkk.exe
  2⤵
  PID:6184
- C:\Windows\System\zvOhJpO.exe
  C:\Windows\System\zvOhJpO.exe
  2⤵
  PID:6292
- C:\Windows\System\liabnAf.exe
  C:\Windows\System\liabnAf.exe
  2⤵
  PID:6356
- C:\Windows\System\jeaJkpe.exe
  C:\Windows\System\jeaJkpe.exe
  2⤵
  PID:6428
- C:\Windows\System\McEqpvW.exe
  C:\Windows\System\McEqpvW.exe
  2⤵
  PID:6520
- C:\Windows\System\gvAcouc.exe
  C:\Windows\System\gvAcouc.exe
  2⤵
  PID:6552
- C:\Windows\System\HWDWDKy.exe
  C:\Windows\System\HWDWDKy.exe
  2⤵
  PID:6588
- C:\Windows\System\QjMGZFV.exe
  C:\Windows\System\QjMGZFV.exe
  2⤵
  PID:6624
- C:\Windows\System\nArLJYM.exe
  C:\Windows\System\nArLJYM.exe
  2⤵
  PID:336
- C:\Windows\System\hpbTyKe.exe
  C:\Windows\System\hpbTyKe.exe
  2⤵
  PID:6688
- C:\Windows\System\lokqAjQ.exe
  C:\Windows\System\lokqAjQ.exe
  2⤵
  PID:6720
- C:\Windows\System\EYQSYqw.exe
  C:\Windows\System\EYQSYqw.exe
  2⤵
  PID:6764
- C:\Windows\System\gvXnNBy.exe
  C:\Windows\System\gvXnNBy.exe
  2⤵
  PID:6796
- C:\Windows\System\xsKPnMQ.exe
  C:\Windows\System\xsKPnMQ.exe
  2⤵
  PID:6832
- C:\Windows\System\HSNvefO.exe
  C:\Windows\System\HSNvefO.exe
  2⤵
  PID:6864
- C:\Windows\System\aLJnPBS.exe
  C:\Windows\System\aLJnPBS.exe
  2⤵
  PID:6908
- C:\Windows\System\lLFYNIB.exe
  C:\Windows\System\lLFYNIB.exe
  2⤵
  PID:6940
- C:\Windows\System\mfTwsvJ.exe
  C:\Windows\System\mfTwsvJ.exe
  2⤵
  PID:6976
- C:\Windows\System\PkftpGd.exe
  C:\Windows\System\PkftpGd.exe
  2⤵
  PID:1656
- C:\Windows\System\bmCugdQ.exe
  C:\Windows\System\bmCugdQ.exe
  2⤵
  PID:1000
- C:\Windows\System\ivaTCxc.exe
  C:\Windows\System\ivaTCxc.exe
  2⤵
  PID:1940
- C:\Windows\System\MLtcBVP.exe
  C:\Windows\System\MLtcBVP.exe
  2⤵
  PID:2348
- C:\Windows\System\QnTESbB.exe
  C:\Windows\System\QnTESbB.exe
  2⤵
  PID:2892
- C:\Windows\System\OvJwvZY.exe
  C:\Windows\System\OvJwvZY.exe
  2⤵
  PID:6396
- C:\Windows\System\FOTpgYO.exe
  C:\Windows\System\FOTpgYO.exe
  2⤵
  PID:7112
- C:\Windows\System\BXIlGBa.exe
  C:\Windows\System\BXIlGBa.exe
  2⤵
  PID:7068
- C:\Windows\System\QfIwLqt.exe
  C:\Windows\System\QfIwLqt.exe
  2⤵
  PID:7116
- C:\Windows\System\NHWdBSx.exe
  C:\Windows\System\NHWdBSx.exe
  2⤵
  PID:7148
- C:\Windows\System\jqsHhmV.exe
  C:\Windows\System\jqsHhmV.exe
  2⤵
  PID:7136
- C:\Windows\System\YzobsHu.exe
  C:\Windows\System\YzobsHu.exe
  2⤵
  PID:5968
- C:\Windows\System\EavjMbb.exe
  C:\Windows\System\EavjMbb.exe
  2⤵
  PID:6132
- C:\Windows\System\tQrIDrX.exe
  C:\Windows\System\tQrIDrX.exe
  2⤵
  PID:4484
- C:\Windows\System\Pmnqcni.exe
  C:\Windows\System\Pmnqcni.exe
  2⤵
  PID:2984
- C:\Windows\System\vFZPkeB.exe
  C:\Windows\System\vFZPkeB.exe
  2⤵
  PID:6168
- C:\Windows\System\MaTDXTg.exe
  C:\Windows\System\MaTDXTg.exe
  2⤵
  PID:5296
- C:\Windows\System\gbqbvDt.exe
  C:\Windows\System\gbqbvDt.exe
  2⤵
  PID:6244
- C:\Windows\System\KJrAEXg.exe
  C:\Windows\System\KJrAEXg.exe
  2⤵
  PID:6280
- C:\Windows\System\RjyGXnJ.exe
  C:\Windows\System\RjyGXnJ.exe
  2⤵
  PID:6276
- C:\Windows\System\cAoXwyX.exe
  C:\Windows\System\cAoXwyX.exe
  2⤵
  PID:6372
- C:\Windows\System\LrEAOZN.exe
  C:\Windows\System\LrEAOZN.exe
  2⤵
  PID:6388
- C:\Windows\System\IxBJBat.exe
  C:\Windows\System\IxBJBat.exe
  2⤵
  PID:6412
- C:\Windows\System\JMnOGgL.exe
  C:\Windows\System\JMnOGgL.exe
  2⤵
  PID:6504
- C:\Windows\System\pPCXnrf.exe
  C:\Windows\System\pPCXnrf.exe
  2⤵
  PID:6536
- C:\Windows\System\IjwRsqf.exe
  C:\Windows\System\IjwRsqf.exe
  2⤵
  PID:6620
- C:\Windows\System\nvlypkO.exe
  C:\Windows\System\nvlypkO.exe
  2⤵
  PID:6716
- C:\Windows\System\ncgmyMk.exe
  C:\Windows\System\ncgmyMk.exe
  2⤵
  PID:6768
- C:\Windows\System\IVBqMQo.exe
  C:\Windows\System\IVBqMQo.exe
  2⤵
  PID:2668
- C:\Windows\System\ALJATMb.exe
  C:\Windows\System\ALJATMb.exe
  2⤵
  PID:6992
- C:\Windows\System\ulWipre.exe
  C:\Windows\System\ulWipre.exe
  2⤵
  PID:7120
- C:\Windows\System\lwenhnM.exe
  C:\Windows\System\lwenhnM.exe
  2⤵
  PID:6004
- C:\Windows\System\DLUIMUC.exe
  C:\Windows\System\DLUIMUC.exe
  2⤵
  PID:6216
- C:\Windows\System\bclToUC.exe
  C:\Windows\System\bclToUC.exe
  2⤵
  PID:6672
- C:\Windows\System\ekjydul.exe
  C:\Windows\System\ekjydul.exe
  2⤵
  PID:6344
- C:\Windows\System\QJkweFO.exe
  C:\Windows\System\QJkweFO.exe
  2⤵
  PID:7020
- C:\Windows\System\tFUahIL.exe
  C:\Windows\System\tFUahIL.exe
  2⤵
  PID:7144
- C:\Windows\System\JmzJTdE.exe
  C:\Windows\System\JmzJTdE.exe
  2⤵
  PID:5872
- C:\Windows\System\LocsIBv.exe
  C:\Windows\System\LocsIBv.exe
  2⤵
  PID:6232
- C:\Windows\System\RhuxtOp.exe
  C:\Windows\System\RhuxtOp.exe
  2⤵
  PID:6376
- C:\Windows\System\VDxvBNA.exe
  C:\Windows\System\VDxvBNA.exe
  2⤵
  PID:6752
- C:\Windows\System\FJipzOs.exe
  C:\Windows\System\FJipzOs.exe
  2⤵
  PID:6264
- C:\Windows\System\rrIdMsX.exe
  C:\Windows\System\rrIdMsX.exe
  2⤵
  PID:6860
- C:\Windows\System\cjrqsnU.exe
  C:\Windows\System\cjrqsnU.exe
  2⤵
  PID:7156
- C:\Windows\System\opTJKSl.exe
  C:\Windows\System\opTJKSl.exe
  2⤵
  PID:7052
- C:\Windows\System\TbQRxXF.exe
  C:\Windows\System\TbQRxXF.exe
  2⤵
  PID:6340
- C:\Windows\System\qBaawsQ.exe
  C:\Windows\System\qBaawsQ.exe
  2⤵
  PID:6488
- C:\Windows\System\bALmJFy.exe
  C:\Windows\System\bALmJFy.exe
  2⤵
  PID:6912
- C:\Windows\System\RtgOFjy.exe
  C:\Windows\System\RtgOFjy.exe
  2⤵
  PID:7140
- C:\Windows\System\LyVnhJd.exe
  C:\Windows\System\LyVnhJd.exe
  2⤵
  PID:6736
- C:\Windows\System\vgZEFgS.exe
  C:\Windows\System\vgZEFgS.exe
  2⤵
  PID:6892
- C:\Windows\System\DrenVtZ.exe
  C:\Windows\System\DrenVtZ.exe
  2⤵
  PID:6880
- C:\Windows\System\OEcpGNH.exe
  C:\Windows\System\OEcpGNH.exe
  2⤵
  PID:6212
- C:\Windows\System\rnnNqnF.exe
  C:\Windows\System\rnnNqnF.exe
  2⤵
  PID:7004
- C:\Windows\System\qMIlDtI.exe
  C:\Windows\System\qMIlDtI.exe
  2⤵
  PID:6924
- C:\Windows\System\QvlcXkv.exe
  C:\Windows\System\QvlcXkv.exe
  2⤵
  PID:7172
- C:\Windows\System\gNgpqpa.exe
  C:\Windows\System\gNgpqpa.exe
  2⤵
  PID:7188
- C:\Windows\System\AYJMMam.exe
  C:\Windows\System\AYJMMam.exe
  2⤵
  PID:7204
- C:\Windows\System\ToCGLjh.exe
  C:\Windows\System\ToCGLjh.exe
  2⤵
  PID:7224
- C:\Windows\System\ZDnjrIf.exe
  C:\Windows\System\ZDnjrIf.exe
  2⤵
  PID:7240
- C:\Windows\System\XRtbwFr.exe
  C:\Windows\System\XRtbwFr.exe
  2⤵
  PID:7260
- C:\Windows\System\dLNdLKI.exe
  C:\Windows\System\dLNdLKI.exe
  2⤵
  PID:7276
- C:\Windows\System\OUdqwoc.exe
  C:\Windows\System\OUdqwoc.exe
  2⤵
  PID:7292
- C:\Windows\System\TEKdVIT.exe
  C:\Windows\System\TEKdVIT.exe
  2⤵
  PID:7312
- C:\Windows\System\GDVUePR.exe
  C:\Windows\System\GDVUePR.exe
  2⤵
  PID:7328
- C:\Windows\System\GCdUBaP.exe
  C:\Windows\System\GCdUBaP.exe
  2⤵
  PID:7344
- C:\Windows\System\WltucMb.exe
  C:\Windows\System\WltucMb.exe
  2⤵
  PID:7360
- C:\Windows\System\cYZBWZq.exe
  C:\Windows\System\cYZBWZq.exe
  2⤵
  PID:7376
- C:\Windows\System\xSLwMyS.exe
  C:\Windows\System\xSLwMyS.exe
  2⤵
  PID:7392
- C:\Windows\System\fbzffhI.exe
  C:\Windows\System\fbzffhI.exe
  2⤵
  PID:7416
- C:\Windows\System\oelYfcP.exe
  C:\Windows\System\oelYfcP.exe
  2⤵
  PID:7432
- C:\Windows\System\fgLqfXc.exe
  C:\Windows\System\fgLqfXc.exe
  2⤵
  PID:7448
- C:\Windows\System\vNdYxbh.exe
  C:\Windows\System\vNdYxbh.exe
  2⤵
  PID:7464
- C:\Windows\System\xXpeCMx.exe
  C:\Windows\System\xXpeCMx.exe
  2⤵
  PID:7480
- C:\Windows\System\OiQhrmy.exe
  C:\Windows\System\OiQhrmy.exe
  2⤵
  PID:7496
- C:\Windows\System\zPmxsin.exe
  C:\Windows\System\zPmxsin.exe
  2⤵
  PID:7516
- C:\Windows\System\kccKeqV.exe
  C:\Windows\System\kccKeqV.exe
  2⤵
  PID:7556
- C:\Windows\System\VJEPfLu.exe
  C:\Windows\System\VJEPfLu.exe
  2⤵
  PID:7576
- C:\Windows\System\bDHASeC.exe
  C:\Windows\System\bDHASeC.exe
  2⤵
  PID:7592
- C:\Windows\System\CMXxQra.exe
  C:\Windows\System\CMXxQra.exe
  2⤵
  PID:7608
- C:\Windows\System\EbnVKgO.exe
  C:\Windows\System\EbnVKgO.exe
  2⤵
  PID:7624
- C:\Windows\System\EfoRGvk.exe
  C:\Windows\System\EfoRGvk.exe
  2⤵
  PID:7640
- C:\Windows\System\JxWORkZ.exe
  C:\Windows\System\JxWORkZ.exe
  2⤵
  PID:7656
- C:\Windows\System\nZOUgVk.exe
  C:\Windows\System\nZOUgVk.exe
  2⤵
  PID:7672
- C:\Windows\System\mXGHOYC.exe
  C:\Windows\System\mXGHOYC.exe
  2⤵
  PID:7692
- C:\Windows\System\tRNyzzn.exe
  C:\Windows\System\tRNyzzn.exe
  2⤵
  PID:7724
- C:\Windows\System\wEyfCQR.exe
  C:\Windows\System\wEyfCQR.exe
  2⤵
  PID:7752
- C:\Windows\System\QGsTwSs.exe
  C:\Windows\System\QGsTwSs.exe
  2⤵
  PID:7768
- C:\Windows\System\NLuOIpe.exe
  C:\Windows\System\NLuOIpe.exe
  2⤵
  PID:7784
- C:\Windows\System\rwfBjIC.exe
  C:\Windows\System\rwfBjIC.exe
  2⤵
  PID:7800
- C:\Windows\System\sphPXhr.exe
  C:\Windows\System\sphPXhr.exe
  2⤵
  PID:7820
- C:\Windows\System\YroLAIc.exe
  C:\Windows\System\YroLAIc.exe
  2⤵
  PID:7836
- C:\Windows\System\trkqTyd.exe
  C:\Windows\System\trkqTyd.exe
  2⤵
  PID:7852
- C:\Windows\System\tTRemFF.exe
  C:\Windows\System\tTRemFF.exe
  2⤵
  PID:7872
- C:\Windows\System\mEcaIOs.exe
  C:\Windows\System\mEcaIOs.exe
  2⤵
  PID:7888
- C:\Windows\System\kaRNlGn.exe
  C:\Windows\System\kaRNlGn.exe
  2⤵
  PID:7904
- C:\Windows\System\BgjNtIt.exe
  C:\Windows\System\BgjNtIt.exe
  2⤵
  PID:7920
- C:\Windows\System\CvPQjdZ.exe
  C:\Windows\System\CvPQjdZ.exe
  2⤵
  PID:7936
- C:\Windows\System\Sohprxs.exe
  C:\Windows\System\Sohprxs.exe
  2⤵
  PID:7968
- C:\Windows\System\jBjwbAo.exe
  C:\Windows\System\jBjwbAo.exe
  2⤵
  PID:7992
- C:\Windows\System\FiRwale.exe
  C:\Windows\System\FiRwale.exe
  2⤵
  PID:8012
- C:\Windows\System\RAIjbxe.exe
  C:\Windows\System\RAIjbxe.exe
  2⤵
  PID:8036
- C:\Windows\System\XMWcZSV.exe
  C:\Windows\System\XMWcZSV.exe
  2⤵
  PID:8076
- C:\Windows\System\rVztzlO.exe
  C:\Windows\System\rVztzlO.exe
  2⤵
  PID:8092
- C:\Windows\System\hxfEKzg.exe
  C:\Windows\System\hxfEKzg.exe
  2⤵
  PID:8108
- C:\Windows\System\DVqwDyp.exe
  C:\Windows\System\DVqwDyp.exe
  2⤵
  PID:8124
- C:\Windows\System\ostFyme.exe
  C:\Windows\System\ostFyme.exe
  2⤵
  PID:8140
- C:\Windows\System\JfllfXZ.exe
  C:\Windows\System\JfllfXZ.exe
  2⤵
  PID:8156
- C:\Windows\System\cWGzVpP.exe
  C:\Windows\System\cWGzVpP.exe
  2⤵
  PID:8176
- C:\Windows\System\HxKEbHJ.exe
  C:\Windows\System\HxKEbHJ.exe
  2⤵
  PID:7064
- C:\Windows\System\lAHGOpu.exe
  C:\Windows\System\lAHGOpu.exe
  2⤵
  PID:7180
- C:\Windows\System\topBswl.exe
  C:\Windows\System\topBswl.exe
  2⤵
  PID:7220
- C:\Windows\System\wIVeAjj.exe
  C:\Windows\System\wIVeAjj.exe
  2⤵
  PID:7284
- C:\Windows\System\TxOZdFn.exe
  C:\Windows\System\TxOZdFn.exe
  2⤵
  PID:7352
- C:\Windows\System\SDPOksK.exe
  C:\Windows\System\SDPOksK.exe
  2⤵
  PID:7488
- C:\Windows\System\YGlYVmv.exe
  C:\Windows\System\YGlYVmv.exe
  2⤵
  PID:7028
- C:\Windows\System\bAKigZY.exe
  C:\Windows\System\bAKigZY.exe
  2⤵
  PID:7524
- C:\Windows\System\AmtxLLZ.exe
  C:\Windows\System\AmtxLLZ.exe
  2⤵
  PID:1096
- C:\Windows\System\krdHWQp.exe
  C:\Windows\System\krdHWQp.exe
  2⤵
  PID:7232
- C:\Windows\System\cIcZCeb.exe
  C:\Windows\System\cIcZCeb.exe
  2⤵
  PID:7304
- C:\Windows\System\NOUstwq.exe
  C:\Windows\System\NOUstwq.exe
  2⤵
  PID:7340
- C:\Windows\System\kOlxWWr.exe
  C:\Windows\System\kOlxWWr.exe
  2⤵
  PID:7504
- C:\Windows\System\KzzgMqf.exe
  C:\Windows\System\KzzgMqf.exe
  2⤵
  PID:7544
- C:\Windows\System\EWsZHGc.exe
  C:\Windows\System\EWsZHGc.exe
  2⤵
  PID:1060
- C:\Windows\System\sfWKpPr.exe
  C:\Windows\System\sfWKpPr.exe
  2⤵
  PID:7680
- C:\Windows\System\IPVMPYj.exe
  C:\Windows\System\IPVMPYj.exe
  2⤵
  PID:7688
- C:\Windows\System\CdUwwuJ.exe
  C:\Windows\System\CdUwwuJ.exe
  2⤵
  PID:7684
- C:\Windows\System\sLewoSw.exe
  C:\Windows\System\sLewoSw.exe
  2⤵
  PID:7664
- C:\Windows\System\caHkoqq.exe
  C:\Windows\System\caHkoqq.exe
  2⤵
  PID:7632
- C:\Windows\System\tjidRbS.exe
  C:\Windows\System\tjidRbS.exe
  2⤵
  PID:7776
- C:\Windows\System\yUqgkke.exe
  C:\Windows\System\yUqgkke.exe
  2⤵
  PID:7812
- C:\Windows\System\ZmerwWL.exe
  C:\Windows\System\ZmerwWL.exe
  2⤵
  PID:7884
- C:\Windows\System\ccAjYRL.exe
  C:\Windows\System\ccAjYRL.exe
  2⤵
  PID:7952
- C:\Windows\System\zyCAzQa.exe
  C:\Windows\System\zyCAzQa.exe
  2⤵
  PID:7828
- C:\Windows\System\RaLwuDy.exe
  C:\Windows\System\RaLwuDy.exe
  2⤵
  PID:7896
- C:\Windows\System\OEfRJaF.exe
  C:\Windows\System\OEfRJaF.exe
  2⤵
  PID:7716
- C:\Windows\System\wDKRQjC.exe
  C:\Windows\System\wDKRQjC.exe
  2⤵
  PID:7796
- C:\Windows\System\CgufxCs.exe
  C:\Windows\System\CgufxCs.exe
  2⤵
  PID:7964
- C:\Windows\System\dRfDpfP.exe
  C:\Windows\System\dRfDpfP.exe
  2⤵
  PID:8000
- C:\Windows\System\CHrQEbN.exe
  C:\Windows\System\CHrQEbN.exe
  2⤵
  PID:8024
- C:\Windows\System\gMeACFa.exe
  C:\Windows\System\gMeACFa.exe
  2⤵
  PID:8052
- C:\Windows\System\LmNQQdm.exe
  C:\Windows\System\LmNQQdm.exe
  2⤵
  PID:8072
- C:\Windows\System\xUunEqG.exe
  C:\Windows\System\xUunEqG.exe
  2⤵
  PID:6460
- C:\Windows\System\dAWmWEf.exe
  C:\Windows\System\dAWmWEf.exe
  2⤵
  PID:6096
- C:\Windows\System\akaHdgu.exe
  C:\Windows\System\akaHdgu.exe
  2⤵
  PID:7456
- C:\Windows\System\ghPDnfZ.exe
  C:\Windows\System\ghPDnfZ.exe
  2⤵
  PID:7196
- C:\Windows\System\BXMzZRg.exe
  C:\Windows\System\BXMzZRg.exe
  2⤵
  PID:8152
- C:\Windows\System\cnyzBxV.exe
  C:\Windows\System\cnyzBxV.exe
  2⤵
  PID:7216
- C:\Windows\System\EAJSTFk.exe
  C:\Windows\System\EAJSTFk.exe
  2⤵
  PID:7336
- C:\Windows\System\OfVMZGr.exe
  C:\Windows\System\OfVMZGr.exe
  2⤵
  PID:7272
- C:\Windows\System\YQWyQEf.exe
  C:\Windows\System\YQWyQEf.exe
  2⤵
  PID:8088
- C:\Windows\System\gSSPBwg.exe
  C:\Windows\System\gSSPBwg.exe
  2⤵
  PID:7408
- C:\Windows\System\PcGbtiz.exe
  C:\Windows\System\PcGbtiz.exe
  2⤵
  PID:7472
- C:\Windows\System\dvjfFux.exe
  C:\Windows\System\dvjfFux.exe
  2⤵
  PID:7512
- C:\Windows\System\dBDmLWz.exe
  C:\Windows\System\dBDmLWz.exe
  2⤵
  PID:7652
- C:\Windows\System\taFBzji.exe
  C:\Windows\System\taFBzji.exe
  2⤵
  PID:7736
- C:\Windows\System\mMAcZoZ.exe
  C:\Windows\System\mMAcZoZ.exe
  2⤵
  PID:7944
- C:\Windows\System\NMpyUNl.exe
  C:\Windows\System\NMpyUNl.exe
  2⤵
  PID:7960
- C:\Windows\System\lXxzIrT.exe
  C:\Windows\System\lXxzIrT.exe
  2⤵
  PID:8104
- C:\Windows\System\MOyGraa.exe
  C:\Windows\System\MOyGraa.exe
  2⤵
  PID:7604
- C:\Windows\System\yxzsvLN.exe
  C:\Windows\System\yxzsvLN.exe
  2⤵
  PID:7744
- C:\Windows\System\VfPZXyQ.exe
  C:\Windows\System\VfPZXyQ.exe
  2⤵
  PID:7764
- C:\Windows\System\DzVrZlq.exe
  C:\Windows\System\DzVrZlq.exe
  2⤵
  PID:7976
- C:\Windows\System\QIpNhRr.exe
  C:\Windows\System\QIpNhRr.exe
  2⤵
  PID:8028
- C:\Windows\System\NswhiKN.exe
  C:\Windows\System\NswhiKN.exe
  2⤵
  PID:8136
- C:\Windows\System\wSsOYzu.exe
  C:\Windows\System\wSsOYzu.exe
  2⤵
  PID:6152
- C:\Windows\System\aEDYKqs.exe
  C:\Windows\System\aEDYKqs.exe
  2⤵
  PID:8148
- C:\Windows\System\WwOwfEg.exe
  C:\Windows\System\WwOwfEg.exe
  2⤵
  PID:7404
- C:\Windows\System\nbMpjHi.exe
  C:\Windows\System\nbMpjHi.exe
  2⤵
  PID:7880
- C:\Windows\System\qskzZyG.exe
  C:\Windows\System\qskzZyG.exe
  2⤵
  PID:8188
- C:\Windows\System\dQIoDBJ.exe
  C:\Windows\System\dQIoDBJ.exe
  2⤵
  PID:7928
- C:\Windows\System\hLiIyFs.exe
  C:\Windows\System\hLiIyFs.exe
  2⤵
  PID:7268
- C:\Windows\System\gdXhbIY.exe
  C:\Windows\System\gdXhbIY.exe
  2⤵
  PID:7848
- C:\Windows\System\ziuBqyW.exe
  C:\Windows\System\ziuBqyW.exe
  2⤵
  PID:8044
- C:\Windows\System\PrcLVxW.exe
  C:\Windows\System\PrcLVxW.exe
  2⤵
  PID:7932
- C:\Windows\System\XChUxws.exe
  C:\Windows\System\XChUxws.exe
  2⤵
  PID:8120
- C:\Windows\System\WnOLzuh.exe
  C:\Windows\System\WnOLzuh.exe
  2⤵
  PID:7536
- C:\Windows\System\IaEukZI.exe
  C:\Windows\System\IaEukZI.exe
  2⤵
  PID:8208
- C:\Windows\System\aATWxxm.exe
  C:\Windows\System\aATWxxm.exe
  2⤵
  PID:8224
- C:\Windows\System\QCDNXxD.exe
  C:\Windows\System\QCDNXxD.exe
  2⤵
  PID:8240
- C:\Windows\System\TmODgUQ.exe
  C:\Windows\System\TmODgUQ.exe
  2⤵
  PID:8256
- C:\Windows\System\EqIGBuw.exe
  C:\Windows\System\EqIGBuw.exe
  2⤵
  PID:8272
- C:\Windows\System\YCNXqtg.exe
  C:\Windows\System\YCNXqtg.exe
  2⤵
  PID:8288
- C:\Windows\System\EnSRYwj.exe
  C:\Windows\System\EnSRYwj.exe
  2⤵
  PID:8304
- C:\Windows\System\FzEVFaD.exe
  C:\Windows\System\FzEVFaD.exe
  2⤵
  PID:8320
- C:\Windows\System\KOKhPHg.exe
  C:\Windows\System\KOKhPHg.exe
  2⤵
  PID:8336
- C:\Windows\System\qIBRnYa.exe
  C:\Windows\System\qIBRnYa.exe
  2⤵
  PID:8352
- C:\Windows\System\qVoMpFq.exe
  C:\Windows\System\qVoMpFq.exe
  2⤵
  PID:8368
- C:\Windows\System\GvuUEuf.exe
  C:\Windows\System\GvuUEuf.exe
  2⤵
  PID:8384
- C:\Windows\System\FYpQcYf.exe
  C:\Windows\System\FYpQcYf.exe
  2⤵
  PID:8400
- C:\Windows\System\QqnLMyf.exe
  C:\Windows\System\QqnLMyf.exe
  2⤵
  PID:8416
- C:\Windows\System\CsvnWDt.exe
  C:\Windows\System\CsvnWDt.exe
  2⤵
  PID:8432
- C:\Windows\System\MBYJbjJ.exe
  C:\Windows\System\MBYJbjJ.exe
  2⤵
  PID:8448
- C:\Windows\System\BTVMTIg.exe
  C:\Windows\System\BTVMTIg.exe
  2⤵
  PID:8464
- C:\Windows\System\YVRBnwR.exe
  C:\Windows\System\YVRBnwR.exe
  2⤵
  PID:8480
- C:\Windows\System\GwurjKZ.exe
  C:\Windows\System\GwurjKZ.exe
  2⤵
  PID:8496
- C:\Windows\System\DDUmfFn.exe
  C:\Windows\System\DDUmfFn.exe
  2⤵
  PID:8512
- C:\Windows\System\aiElgtt.exe
  C:\Windows\System\aiElgtt.exe
  2⤵
  PID:8528
- C:\Windows\System\Jjwgekj.exe
  C:\Windows\System\Jjwgekj.exe
  2⤵
  PID:8544
- C:\Windows\System\xNcEHlu.exe
  C:\Windows\System\xNcEHlu.exe
  2⤵
  PID:8560
- C:\Windows\System\HpbEMYd.exe
  C:\Windows\System\HpbEMYd.exe
  2⤵
  PID:8576
- C:\Windows\System\vgszrBG.exe
  C:\Windows\System\vgszrBG.exe
  2⤵
  PID:8592
- C:\Windows\System\FuPkRwL.exe
  C:\Windows\System\FuPkRwL.exe
  2⤵
  PID:8608
- C:\Windows\System\HPYIyOs.exe
  C:\Windows\System\HPYIyOs.exe
  2⤵
  PID:8624
- C:\Windows\System\EeiBNcD.exe
  C:\Windows\System\EeiBNcD.exe
  2⤵
  PID:8640
- C:\Windows\System\nMSlVkE.exe
  C:\Windows\System\nMSlVkE.exe
  2⤵
  PID:8656
- C:\Windows\System\WtdqklB.exe
  C:\Windows\System\WtdqklB.exe
  2⤵
  PID:8672
- C:\Windows\System\xzDDyCM.exe
  C:\Windows\System\xzDDyCM.exe
  2⤵
  PID:8688
- C:\Windows\System\clpLUmD.exe
  C:\Windows\System\clpLUmD.exe
  2⤵
  PID:8704
- C:\Windows\System\NxoLjrv.exe
  C:\Windows\System\NxoLjrv.exe
  2⤵
  PID:8720
- C:\Windows\System\pGGnUuY.exe
  C:\Windows\System\pGGnUuY.exe
  2⤵
  PID:8736
- C:\Windows\System\TJSLPnk.exe
  C:\Windows\System\TJSLPnk.exe
  2⤵
  PID:8752
- C:\Windows\System\nwawzSf.exe
  C:\Windows\System\nwawzSf.exe
  2⤵
  PID:8768
- C:\Windows\System\xlFcXjB.exe
  C:\Windows\System\xlFcXjB.exe
  2⤵
  PID:8784
- C:\Windows\System\ZTOeyvz.exe
  C:\Windows\System\ZTOeyvz.exe
  2⤵
  PID:8800
- C:\Windows\System\cbajAWQ.exe
  C:\Windows\System\cbajAWQ.exe
  2⤵
  PID:8816
- C:\Windows\System\dxaELpN.exe
  C:\Windows\System\dxaELpN.exe
  2⤵
  PID:8832
- C:\Windows\System\twxlhAE.exe
  C:\Windows\System\twxlhAE.exe
  2⤵
  PID:8848
- C:\Windows\System\bwaJlWT.exe
  C:\Windows\System\bwaJlWT.exe
  2⤵
  PID:8864
- C:\Windows\System\ztlxbMZ.exe
  C:\Windows\System\ztlxbMZ.exe
  2⤵
  PID:8880
- C:\Windows\System\UXPyqXR.exe
  C:\Windows\System\UXPyqXR.exe
  2⤵
  PID:8896
- C:\Windows\System\rQpvsCC.exe
  C:\Windows\System\rQpvsCC.exe
  2⤵
  PID:8912
- C:\Windows\System\fiyRsGE.exe
  C:\Windows\System\fiyRsGE.exe
  2⤵
  PID:8928
- C:\Windows\System\ENlWJWc.exe
  C:\Windows\System\ENlWJWc.exe
  2⤵
  PID:8944
- C:\Windows\System\GqlIiLC.exe
  C:\Windows\System\GqlIiLC.exe
  2⤵
  PID:8960
- C:\Windows\System\CKQcTTu.exe
  C:\Windows\System\CKQcTTu.exe
  2⤵
  PID:8976
- C:\Windows\System\MDCnhtd.exe
  C:\Windows\System\MDCnhtd.exe
  2⤵
  PID:8992
- C:\Windows\System\oIffMzA.exe
  C:\Windows\System\oIffMzA.exe
  2⤵
  PID:9008
- C:\Windows\System\zZMVQAf.exe
  C:\Windows\System\zZMVQAf.exe
  2⤵
  PID:9024
- C:\Windows\System\aAIupDA.exe
  C:\Windows\System\aAIupDA.exe
  2⤵
  PID:9040
- C:\Windows\System\rZohBci.exe
  C:\Windows\System\rZohBci.exe
  2⤵
  PID:9056
- C:\Windows\System\KcuaCfg.exe
  C:\Windows\System\KcuaCfg.exe
  2⤵
  PID:9072
- C:\Windows\System\ApkMqFq.exe
  C:\Windows\System\ApkMqFq.exe
  2⤵
  PID:9088
- C:\Windows\System\xovwKqa.exe
  C:\Windows\System\xovwKqa.exe
  2⤵
  PID:9104
- C:\Windows\System\jixvuoX.exe
  C:\Windows\System\jixvuoX.exe
  2⤵
  PID:9120
- C:\Windows\System\gbXZdCV.exe
  C:\Windows\System\gbXZdCV.exe
  2⤵
  PID:9136
- C:\Windows\System\hzmaYvx.exe
  C:\Windows\System\hzmaYvx.exe
  2⤵
  PID:9152
- C:\Windows\System\toTvpTh.exe
  C:\Windows\System\toTvpTh.exe
  2⤵
  PID:9168
- C:\Windows\System\zmFBNvD.exe
  C:\Windows\System\zmFBNvD.exe
  2⤵
  PID:9184
- C:\Windows\System\JZrONTq.exe
  C:\Windows\System\JZrONTq.exe
  2⤵
  PID:9200
- C:\Windows\System\vOfFvfJ.exe
  C:\Windows\System\vOfFvfJ.exe
  2⤵
  PID:7444
- C:\Windows\System\NqouhVd.exe
  C:\Windows\System\NqouhVd.exe
  2⤵
  PID:7400
- C:\Windows\System\unRepip.exe
  C:\Windows\System\unRepip.exe
  2⤵
  PID:8164
- C:\Windows\System\LCJXdPI.exe
  C:\Windows\System\LCJXdPI.exe
  2⤵
  PID:8248
- C:\Windows\System\hiYDLko.exe
  C:\Windows\System\hiYDLko.exe
  2⤵
  PID:8100
- C:\Windows\System\LaFhHKk.exe
  C:\Windows\System\LaFhHKk.exe
  2⤵
  PID:7988
- C:\Windows\System\zCJbHFR.exe
  C:\Windows\System\zCJbHFR.exe
  2⤵
  PID:8280
- C:\Windows\System\VEEAwin.exe
  C:\Windows\System\VEEAwin.exe
  2⤵
  PID:8344
- C:\Windows\System\DwkPlib.exe
  C:\Windows\System\DwkPlib.exe
  2⤵
  PID:8408
- C:\Windows\System\rlZATno.exe
  C:\Windows\System\rlZATno.exe
  2⤵
  PID:8232
- C:\Windows\System\eAJtpDI.exe
  C:\Windows\System\eAJtpDI.exe
  2⤵
  PID:8296
- C:\Windows\System\CcEgeLS.exe
  C:\Windows\System\CcEgeLS.exe
  2⤵
  PID:8360
- C:\Windows\System\sIviqcj.exe
  C:\Windows\System\sIviqcj.exe
  2⤵
  PID:8412
- C:\Windows\System\gxdZOiZ.exe
  C:\Windows\System\gxdZOiZ.exe
  2⤵
  PID:8504
- C:\Windows\System\uviUYBy.exe
  C:\Windows\System\uviUYBy.exe
  2⤵
  PID:8540
- C:\Windows\System\JYvoLpp.exe
  C:\Windows\System\JYvoLpp.exe
  2⤵
  PID:8604
- C:\Windows\System\btQoyad.exe
  C:\Windows\System\btQoyad.exe
  2⤵
  PID:8488
- C:\Windows\System\GFVHAtG.exe
  C:\Windows\System\GFVHAtG.exe
  2⤵
  PID:8584
- C:\Windows\System\NJJiYcX.exe
  C:\Windows\System\NJJiYcX.exe
  2⤵
  PID:8668
- C:\Windows\System\JCVsGUt.exe
  C:\Windows\System\JCVsGUt.exe
  2⤵
  PID:8728
- C:\Windows\System\aJtTlkf.exe
  C:\Windows\System\aJtTlkf.exe
  2⤵
  PID:8620
- C:\Windows\System\zeBQyUZ.exe
  C:\Windows\System\zeBQyUZ.exe
  2⤵
  PID:8684
- C:\Windows\System\IXpGXLF.exe
  C:\Windows\System\IXpGXLF.exe
  2⤵
  PID:8776
- C:\Windows\System\VQQmjQn.exe
  C:\Windows\System\VQQmjQn.exe
  2⤵
  PID:8616
- C:\Windows\System\VjnTMfJ.exe
  C:\Windows\System\VjnTMfJ.exe
  2⤵
  PID:8812
- C:\Windows\System\FOxmXbJ.exe
  C:\Windows\System\FOxmXbJ.exe
  2⤵
  PID:8876
- C:\Windows\System\dBwoPpj.exe
  C:\Windows\System\dBwoPpj.exe
  2⤵
  PID:8940
- C:\Windows\System\PPVtQAN.exe
  C:\Windows\System\PPVtQAN.exe
  2⤵
  PID:9036
- C:\Windows\System\CfTevIg.exe
  C:\Windows\System\CfTevIg.exe
  2⤵
  PID:9100
- C:\Windows\System\POiMbeI.exe
  C:\Windows\System\POiMbeI.exe
  2⤵
  PID:8972
- C:\Windows\System\CKknIeZ.exe
  C:\Windows\System\CKknIeZ.exe
  2⤵
  PID:9112
- C:\Windows\System\isCWFwM.exe
  C:\Windows\System\isCWFwM.exe
  2⤵
  PID:8828
- C:\Windows\System\XiYMciq.exe
  C:\Windows\System\XiYMciq.exe
  2⤵
  PID:9052
- C:\Windows\System\jkzHlnI.exe
  C:\Windows\System\jkzHlnI.exe
  2⤵
  PID:9148
- C:\Windows\System\mYHeJTr.exe
  C:\Windows\System\mYHeJTr.exe
  2⤵
  PID:8956
- C:\Windows\System\hjWkhQs.exe
  C:\Windows\System\hjWkhQs.exe
  2⤵
  PID:8892
- C:\Windows\System\XtoKtAQ.exe
  C:\Windows\System\XtoKtAQ.exe
  2⤵
  PID:9164
- C:\Windows\System\bjUdhHE.exe
  C:\Windows\System\bjUdhHE.exe
  2⤵
  PID:9212
- C:\Windows\System\WHiXErR.exe
  C:\Windows\System\WHiXErR.exe
  2⤵
  PID:7916
- C:\Windows\System\ybkdOov.exe
  C:\Windows\System\ybkdOov.exe
  2⤵
  PID:8252
- C:\Windows\System\wKdPSyV.exe
  C:\Windows\System\wKdPSyV.exe
  2⤵
  PID:8392
- C:\Windows\System\RgViNby.exe
  C:\Windows\System\RgViNby.exe
  2⤵
  PID:8428
- C:\Windows\System\SwHqiTn.exe
  C:\Windows\System\SwHqiTn.exe
  2⤵
  PID:8760
- C:\Windows\System\lllNLTd.exe
  C:\Windows\System\lllNLTd.exe
  2⤵
  PID:7428
- C:\Windows\System\zQOfFRY.exe
  C:\Windows\System\zQOfFRY.exe
  2⤵
  PID:8444
- C:\Windows\System\olUIImh.exe
  C:\Windows\System\olUIImh.exe
  2⤵
  PID:8520
- C:\Windows\System\oxWkNjm.exe
  C:\Windows\System\oxWkNjm.exe
  2⤵
  PID:8216
- C:\Windows\System\FllZNVv.exe
  C:\Windows\System\FllZNVv.exe
  2⤵
  PID:8744
- C:\Windows\System\IoYNVJy.exe
  C:\Windows\System\IoYNVJy.exe
  2⤵
  PID:8936
- C:\Windows\System\HrDWBIE.exe
  C:\Windows\System\HrDWBIE.exe
  2⤵
  PID:9020
- C:\Windows\System\mWBHYOD.exe
  C:\Windows\System\mWBHYOD.exe
  2⤵
  PID:8316
- C:\Windows\System\uQcqEkv.exe
  C:\Windows\System\uQcqEkv.exe
  2⤵
  PID:9180
- C:\Windows\System\BQiwdxQ.exe
  C:\Windows\System\BQiwdxQ.exe
  2⤵
  PID:8968
- C:\Windows\System\LSrDbxE.exe
  C:\Windows\System\LSrDbxE.exe
  2⤵
  PID:9196
- C:\Windows\System\HpNcAEI.exe
  C:\Windows\System\HpNcAEI.exe
  2⤵
  PID:8552
- C:\Windows\System\GSgnjqR.exe
  C:\Windows\System\GSgnjqR.exe
  2⤵
  PID:9116
- C:\Windows\System\DjMQsaj.exe
  C:\Windows\System\DjMQsaj.exe
  2⤵
  PID:9208
- C:\Windows\System\qrAVGLu.exe
  C:\Windows\System\qrAVGLu.exe
  2⤵
  PID:8536
- C:\Windows\System\eiLwQLs.exe
  C:\Windows\System\eiLwQLs.exe
  2⤵
  PID:8440
- C:\Windows\System\dosGKYf.exe
  C:\Windows\System\dosGKYf.exe
  2⤵
  PID:9048
- C:\Windows\System\TWqBHmd.exe
  C:\Windows\System\TWqBHmd.exe
  2⤵
  PID:8908
- C:\Windows\System\FejqFCt.exe
  C:\Windows\System\FejqFCt.exe
  2⤵
  PID:9096
- C:\Windows\System\mWRxlrK.exe
  C:\Windows\System\mWRxlrK.exe
  2⤵
  PID:8264
- C:\Windows\System\YTLvQvN.exe
  C:\Windows\System\YTLvQvN.exe
  2⤵
  PID:8332
- C:\Windows\System\CirlwKX.exe
  C:\Windows\System\CirlwKX.exe
  2⤵
  PID:8764
- C:\Windows\System\jfZGhxq.exe
  C:\Windows\System\jfZGhxq.exe
  2⤵
  PID:8984
- C:\Windows\System\YMUkPMA.exe
  C:\Windows\System\YMUkPMA.exe
  2⤵
  PID:9032
- C:\Windows\System\wCaTsmL.exe
  C:\Windows\System\wCaTsmL.exe
  2⤵
  PID:8588
- C:\Windows\System\XBnidfk.exe
  C:\Windows\System\XBnidfk.exe
  2⤵
  PID:8716
- C:\Windows\System\YuHYuRi.exe
  C:\Windows\System\YuHYuRi.exe
  2⤵
  PID:8636
- C:\Windows\System\tpFFwqv.exe
  C:\Windows\System\tpFFwqv.exe
  2⤵
  PID:7956
- C:\Windows\System\CDdioUW.exe
  C:\Windows\System\CDdioUW.exe
  2⤵
  PID:9160
- C:\Windows\System\cNnnWgn.exe
  C:\Windows\System\cNnnWgn.exe
  2⤵
  PID:9224
- C:\Windows\System\uddrugk.exe
  C:\Windows\System\uddrugk.exe
  2⤵
  PID:9244
- C:\Windows\System\LJvdhWB.exe
  C:\Windows\System\LJvdhWB.exe
  2⤵
  PID:9260
- C:\Windows\System\wHblVXP.exe
  C:\Windows\System\wHblVXP.exe
  2⤵
  PID:9276
- C:\Windows\System\vIZqjyy.exe
  C:\Windows\System\vIZqjyy.exe
  2⤵
  PID:9292
- C:\Windows\System\GiUwIft.exe
  C:\Windows\System\GiUwIft.exe
  2⤵
  PID:9308
- C:\Windows\System\BtEuKlr.exe
  C:\Windows\System\BtEuKlr.exe
  2⤵
  PID:9328
- C:\Windows\System\ItrtKzZ.exe
  C:\Windows\System\ItrtKzZ.exe
  2⤵
  PID:9344
- C:\Windows\System\RstrJID.exe
  C:\Windows\System\RstrJID.exe
  2⤵
  PID:9360
- C:\Windows\System\TJXdLyA.exe
  C:\Windows\System\TJXdLyA.exe
  2⤵
  PID:9376
- C:\Windows\System\vuudwFx.exe
  C:\Windows\System\vuudwFx.exe
  2⤵
  PID:9392
- C:\Windows\System\nskWKwq.exe
  C:\Windows\System\nskWKwq.exe
  2⤵
  PID:9408
- C:\Windows\System\qZjslwT.exe
  C:\Windows\System\qZjslwT.exe
  2⤵
  PID:9424
- C:\Windows\System\DeqQEJQ.exe
  C:\Windows\System\DeqQEJQ.exe
  2⤵
  PID:9440
- C:\Windows\System\ZEdpknQ.exe
  C:\Windows\System\ZEdpknQ.exe
  2⤵
  PID:9456
- C:\Windows\System\iOtviTP.exe
  C:\Windows\System\iOtviTP.exe
  2⤵
  PID:9472
- C:\Windows\System\eJrftJf.exe
  C:\Windows\System\eJrftJf.exe
  2⤵
  PID:9492
- C:\Windows\System\ANOAeeH.exe
  C:\Windows\System\ANOAeeH.exe
  2⤵
  PID:9508
- C:\Windows\System\KOzLweb.exe
  C:\Windows\System\KOzLweb.exe
  2⤵
  PID:9524
- C:\Windows\System\NwykzDc.exe
  C:\Windows\System\NwykzDc.exe
  2⤵
  PID:9540
- C:\Windows\System\gZiNjDY.exe
  C:\Windows\System\gZiNjDY.exe
  2⤵
  PID:9560
- C:\Windows\System\YACHtbl.exe
  C:\Windows\System\YACHtbl.exe
  2⤵
  PID:9576
- C:\Windows\System\YAiNwFG.exe
  C:\Windows\System\YAiNwFG.exe
  2⤵
  PID:9592
- C:\Windows\System\MrCFTWo.exe
  C:\Windows\System\MrCFTWo.exe
  2⤵
  PID:9608
- C:\Windows\System\SomphQz.exe
  C:\Windows\System\SomphQz.exe
  2⤵
  PID:9624
- C:\Windows\System\lEzGvPM.exe
  C:\Windows\System\lEzGvPM.exe
  2⤵
  PID:9644
- C:\Windows\System\ndJAkwq.exe
  C:\Windows\System\ndJAkwq.exe
  2⤵
  PID:9660
- C:\Windows\System\phlOgGC.exe
  C:\Windows\System\phlOgGC.exe
  2⤵
  PID:9676
- C:\Windows\System\gxYamSq.exe
  C:\Windows\System\gxYamSq.exe
  2⤵
  PID:9692
- C:\Windows\System\bBAXRAM.exe
  C:\Windows\System\bBAXRAM.exe
  2⤵
  PID:9708
- C:\Windows\System\EGGSkmQ.exe
  C:\Windows\System\EGGSkmQ.exe
  2⤵
  PID:9732
- C:\Windows\System\LaDfKWy.exe
  C:\Windows\System\LaDfKWy.exe
  2⤵
  PID:9748
- C:\Windows\System\zrcfRBa.exe
  C:\Windows\System\zrcfRBa.exe
  2⤵
  PID:9764
- C:\Windows\System\GBqGWBw.exe
  C:\Windows\System\GBqGWBw.exe
  2⤵
  PID:9780
- C:\Windows\System\RzBXaEO.exe
  C:\Windows\System\RzBXaEO.exe
  2⤵
  PID:9796
- C:\Windows\System\tscPgMj.exe
  C:\Windows\System\tscPgMj.exe
  2⤵
  PID:9816
- C:\Windows\System\uTMTjHQ.exe
  C:\Windows\System\uTMTjHQ.exe
  2⤵
  PID:9840
- C:\Windows\System\YmTHAHu.exe
  C:\Windows\System\YmTHAHu.exe
  2⤵
  PID:9856
- C:\Windows\System\rNacXny.exe
  C:\Windows\System\rNacXny.exe
  2⤵
  PID:9872
- C:\Windows\System\jMPMHdM.exe
  C:\Windows\System\jMPMHdM.exe
  2⤵
  PID:9888
- C:\Windows\System\pFGLdKn.exe
  C:\Windows\System\pFGLdKn.exe
  2⤵
  PID:9908
- C:\Windows\System\EGIoaCq.exe
  C:\Windows\System\EGIoaCq.exe
  2⤵
  PID:9924
- C:\Windows\System\peVWhaE.exe
  C:\Windows\System\peVWhaE.exe
  2⤵
  PID:9940
- C:\Windows\System\zJxXMDH.exe
  C:\Windows\System\zJxXMDH.exe
  2⤵
  PID:9960
- C:\Windows\System\DVJzNzO.exe
  C:\Windows\System\DVJzNzO.exe
  2⤵
  PID:9976
- C:\Windows\System\eciZFRF.exe
  C:\Windows\System\eciZFRF.exe
  2⤵
  PID:9992
- C:\Windows\System\miJvbSp.exe
  C:\Windows\System\miJvbSp.exe
  2⤵
  PID:10008
- C:\Windows\System\LHMYnZR.exe
  C:\Windows\System\LHMYnZR.exe
  2⤵
  PID:10024
- C:\Windows\System\xBQRoUW.exe
  C:\Windows\System\xBQRoUW.exe
  2⤵
  PID:10040
- C:\Windows\System\jMvIkXq.exe
  C:\Windows\System\jMvIkXq.exe
  2⤵
  PID:10056
- C:\Windows\System\eEDNsCi.exe
  C:\Windows\System\eEDNsCi.exe
  2⤵
  PID:10092
- C:\Windows\System\wEkVTdW.exe
  C:\Windows\System\wEkVTdW.exe
  2⤵
  PID:10108
- C:\Windows\System\RcAYMqR.exe
  C:\Windows\System\RcAYMqR.exe
  2⤵
  PID:10124
- C:\Windows\System\MnfPWvD.exe
  C:\Windows\System\MnfPWvD.exe
  2⤵
  PID:10140
- C:\Windows\System\AdhpGFq.exe
  C:\Windows\System\AdhpGFq.exe
  2⤵
  PID:10156
- C:\Windows\System\IMYfhja.exe
  C:\Windows\System\IMYfhja.exe
  2⤵
  PID:10176
- C:\Windows\System\jtjZZHS.exe
  C:\Windows\System\jtjZZHS.exe
  2⤵
  PID:10196
- C:\Windows\System\qHcEHOb.exe
  C:\Windows\System\qHcEHOb.exe
  2⤵
  PID:10212
- C:\Windows\System\FjJmMtn.exe
  C:\Windows\System\FjJmMtn.exe
  2⤵
  PID:10228
- C:\Windows\System\sKvsPME.exe
  C:\Windows\System\sKvsPME.exe
  2⤵
  PID:8572
- C:\Windows\System\ZRYgJbL.exe
  C:\Windows\System\ZRYgJbL.exe
  2⤵
  PID:9284
- C:\Windows\System\kyQpChq.exe
  C:\Windows\System\kyQpChq.exe
  2⤵
  PID:9324
- C:\Windows\System\xFosZaD.exe
  C:\Windows\System\xFosZaD.exe
  2⤵
  PID:9384
- C:\Windows\System\Fozfhmt.exe
  C:\Windows\System\Fozfhmt.exe
  2⤵
  PID:9416
- C:\Windows\System\wmCPLcx.exe
  C:\Windows\System\wmCPLcx.exe
  2⤵
  PID:9488
- C:\Windows\System\lIrUmQo.exe
  C:\Windows\System\lIrUmQo.exe
  2⤵
  PID:9556
- C:\Windows\System\ptmPBtq.exe
  C:\Windows\System\ptmPBtq.exe
  2⤵
  PID:9656
- C:\Windows\System\afensda.exe
  C:\Windows\System\afensda.exe
  2⤵
  PID:8312
- C:\Windows\System\CTyOONh.exe
  C:\Windows\System\CTyOONh.exe
  2⤵
  PID:9232
- C:\Windows\System\bOWLbuz.exe
  C:\Windows\System\bOWLbuz.exe
  2⤵
  PID:9300
- C:\Windows\System\UKCsccu.exe
  C:\Windows\System\UKCsccu.exe
  2⤵
  PID:9756
- C:\Windows\System\sxCJIph.exe
  C:\Windows\System\sxCJIph.exe
  2⤵
  PID:9824
- C:\Windows\System\dgxQOnz.exe
  C:\Windows\System\dgxQOnz.exe
  2⤵
  PID:9432
- C:\Windows\System\tDaqlbp.exe
  C:\Windows\System\tDaqlbp.exe
  2⤵
  PID:9500
- C:\Windows\System\qWyMDxC.exe
  C:\Windows\System\qWyMDxC.exe
  2⤵
  PID:9632
- C:\Windows\System\LSTNeyZ.exe
  C:\Windows\System\LSTNeyZ.exe
  2⤵
  PID:9772
- C:\Windows\System\ffIAAgW.exe
  C:\Windows\System\ffIAAgW.exe
  2⤵
  PID:9272
- C:\Windows\System\lnLUzwL.exe
  C:\Windows\System\lnLUzwL.exe
  2⤵
  PID:9828
- C:\Windows\System\tBtiKDu.exe
  C:\Windows\System\tBtiKDu.exe
  2⤵
  PID:9900
- C:\Windows\System\DGLHDOr.exe
  C:\Windows\System\DGLHDOr.exe
  2⤵
  PID:9968
- C:\Windows\System\hjDBPsX.exe
  C:\Windows\System\hjDBPsX.exe
  2⤵
  PID:10032
- C:\Windows\System\jMidcgw.exe
  C:\Windows\System\jMidcgw.exe
  2⤵
  PID:10076
- C:\Windows\System\UFcRora.exe
  C:\Windows\System\UFcRora.exe
  2⤵
  PID:9700
- C:\Windows\System\ikqzmxR.exe
  C:\Windows\System\ikqzmxR.exe
  2⤵
  PID:10104
- C:\Windows\System\CGDwuzg.exe
  C:\Windows\System\CGDwuzg.exe
  2⤵
  PID:10116
- C:\Windows\System\VqCMQJc.exe
  C:\Windows\System\VqCMQJc.exe
  2⤵
  PID:10152
- C:\Windows\System\Jdsgtie.exe
  C:\Windows\System\Jdsgtie.exe
  2⤵
  PID:9916
- C:\Windows\System\OgwWcYr.exe
  C:\Windows\System\OgwWcYr.exe
  2⤵
  PID:9852
- C:\Windows\System\PhMMPcJ.exe
  C:\Windows\System\PhMMPcJ.exe
  2⤵
  PID:9988
- C:\Windows\System\oTFkmMd.exe
  C:\Windows\System\oTFkmMd.exe
  2⤵
  PID:10016
- C:\Windows\System\xvFazac.exe
  C:\Windows\System\xvFazac.exe
  2⤵
  PID:10220
- C:\Windows\System\IbcFMTR.exe
  C:\Windows\System\IbcFMTR.exe
  2⤵
  PID:9256
- C:\Windows\System\AKuSybH.exe
  C:\Windows\System\AKuSybH.exe
  2⤵
  PID:9484
- C:\Windows\System\WzqqxcH.exe
  C:\Windows\System\WzqqxcH.exe
  2⤵
  PID:10208
- C:\Windows\System\uORRkyp.exe
  C:\Windows\System\uORRkyp.exe
  2⤵
  PID:9720
- C:\Windows\System\OWgsFAx.exe
  C:\Windows\System\OWgsFAx.exe
  2⤵
  PID:9600
- C:\Windows\System\cZDQNGZ.exe
  C:\Windows\System\cZDQNGZ.exe
  2⤵
  PID:9788
- C:\Windows\System\bllBGYR.exe
  C:\Windows\System\bllBGYR.exe
  2⤵
  PID:9672
- C:\Windows\System\ZgKvptB.exe
  C:\Windows\System\ZgKvptB.exe
  2⤵
  PID:9620
- C:\Windows\System\LwTBFDX.exe
  C:\Windows\System\LwTBFDX.exe
  2⤵
  PID:9716
- C:\Windows\System\tAbbEGy.exe
  C:\Windows\System\tAbbEGy.exe
  2⤵
  PID:9804
- C:\Windows\System\mDZjSHs.exe
  C:\Windows\System\mDZjSHs.exe
  2⤵
  PID:9812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\JCheiob.exe

Filesize
1.9MB

MD5
bfb03c6a1c629b6c1c4c438d14cdc864

SHA1
6b360003b847b255f39fd356db3b4491145f3269

SHA256
00f224ec29aa452716b4d8513c936bc85d8214a326923192bec936b8ab171283

SHA512
4977450638a4309d4c4a9346d3ac2b5e08257535c8f2b60488791f864bfa5fa538cebd04170fa77eb8cc00f6b92d9c3ee3a6d26d345dae931e4aa9fca10eb433

Download Submit
C:\Windows\system\NXVFerC.exe

Filesize
1.9MB

MD5
687eb02e09b8b50b28837b5a4bd73ee6

SHA1
41cbc8e79d7274a0d28a320d42f485a4aa184589

SHA256
687924b3868a7620e6bbef48ad6ae60587da6a8170fc6722a9717a9bcbc865a0

SHA512
e4362202b006b35881f3b19728987c95ecf4c7304dab0d0bcc2e7c481afa3e6d7eba8859744654b9ebd7c449b9bf86355194c1bb78a8b1a7f2f1d537b183054f

Download Submit
C:\Windows\system\OKAJNCX.exe

Filesize
1.9MB

MD5
8edd98bd27a0284b1b0a68557c56ab65

SHA1
9c254b914184bd9daf49f014e5135443b03ad95e

SHA256
64cb174f3016e6008aab0af23a9ecf4b4200b0ec45d28fdfb8924b3dccfd5615

SHA512
24947031ae302426e2056b11fb221766aa6804fc92f84fc5fff408a1f0a8157fc218cde4144f17924e4367669397d8233ee69173fd32def2f4dc182500e4d83a

Download Submit
C:\Windows\system\OZwFhCx.exe

Filesize
1.9MB

MD5
10a4931820f03fb4f443f92b8fe287e7

SHA1
9298c3227e35c7448d6c37e76b8845841d9e6b9d

SHA256
9eddae56b3a00a5f8e654f1a15cb39533fe9e6dbd63ff97681e4ec6aa75b7e3b

SHA512
f64a362db246b8c271859d32f745bcc07d0da389c0e3c5973d1c4db99c67f65e98125bbb67469fd844e938331c462c6923de41006de554b387b79b6c3c8b1063

Download Submit
C:\Windows\system\SfPKwYa.exe

Filesize
1.9MB

MD5
6cab1d65770e63a601b3de61804678c1

SHA1
1cb2b04a9492dcbb5492b3386d3398d88db5d4d9

SHA256
09b709e2728fc2585fdb5adb20a11d3419ff1508cacb73049e056c4b6a65c1f6

SHA512
86833b83ae630420004a87b6be6d89a4783435124fd78f82587cc7da7e37e945a051d410c4242c42368a73e6614503ee7196271ee9abc126956c08ca4531e13c

Download Submit
C:\Windows\system\cComowa.exe

Filesize
1.9MB

MD5
8ba1d53b59af25df3c260334d340ad0d

SHA1
bd205aa61739472321d2afcf32b1de643783bbc0

SHA256
5f5d92a9134fc0f7dfa5298cadd196891a36ff6ffaa7727a5dcd15275a2edc2d

SHA512
a93fcb2aef16c8777fbf37d6e7db3cb6e509db8fad8fa615af72562b02017794814b80ce814b90a8a210fcd428470c3890b2279ef389f7d594544644ccb49a79

Download Submit
C:\Windows\system\cQmgbnR.exe

Filesize
1.9MB

MD5
679a64eb7f2f9eb7c3d71c2a8d9dc2d0

SHA1
a2a09ec94ed642345b20b7af7621dca5fed62af3

SHA256
7465b24623bc94a5fd0ce60f02a7d2467c5de476d3214ae5b0164941ee6c40c4

SHA512
9b5b1e08e2154c967dbd09e4520736fe63def22f4f190aacd498e7e2bdab37bb5a79f7b7deb84dba95cf9249c946b95478dc7d1ca2bc6f2b18957ec09ed0d2e8

Download Submit
C:\Windows\system\eEPljFA.exe

Filesize
1.9MB

MD5
6a62c7cc2383e3a3d3c1ec23f1cc181d

SHA1
87f5d4c8dc0121db9c1989a831e3364941ddf277

SHA256
394ccc02d5809f141a8ad09c75008cfcfc21f951ea6ad03853b62db1f3131a4c

SHA512
65ee044ac2663b341b00e68cbcb7dbdc006a2047353ca5a9267cffaeca74a1c69d3b93d8e66db7ff017bc80a39422da0e64c923c5a430d2c19686cfecd0ea8ea

Download Submit
C:\Windows\system\etvGxIB.exe

Filesize
1.9MB

MD5
de5722276f3573d370e29a3a343b5090

SHA1
c5a366360e1feeb53ed4bae2734737aaecab330a

SHA256
21653c19eaabc9870ccb28823d58e0740eb216781bb2b0b79a4581478ff53816

SHA512
7af8f21ab987d7863c9d098727fdcba180c87ac2e3a49bad41a1d1e545a553c21463daea9198fffc0e70082f05d2230df108bfb16afb5de100b1baf4cfe77291

Download Submit
C:\Windows\system\fAWVtYn.exe

Filesize
1.9MB

MD5
a40af1af320b4f564e3ecc62c92e8e80

SHA1
88ca7234a6e73b0f36f226287a0821ee21c1edff

SHA256
d2e51d2d8be44d7b0cde75248ab175b8c250c88600fef6d59c9d1d05da9d375d

SHA512
844ada067d80a02df545ef7d2169b6ce9b59b915ae7bfd66ae554c07d0e13f62b7aec233ed0e386b4c5ec15106ec22af2bee16dca9aa14ad716192fd44f58a6b

Download Submit
C:\Windows\system\fhrzMUf.exe

Filesize
1.9MB

MD5
e2d6a74c420e75605388f932f81cdeb8

SHA1
6e14dccfff527cff604373d387df86afde94e64a

SHA256
f566b59a3c11e24c2aeda3e86d074ba12e2abbb4257a57434c7b75db8ceb11dd

SHA512
b37441e09b27a0117c74611fbdc00f2c8db2a02fb1ed31070d8b944d0bb28f2ddf01cbdcff2fe59d446894fdcca29f7238e6c232f4187cae02c420840015fa59

Download Submit
C:\Windows\system\gVDZJYr.exe

Filesize
1.9MB

MD5
0203cdf861d3e2fdbfc4168d143501f5

SHA1
a7a044b229652120e87d5c84c2f78cc6923991e2

SHA256
af07098d4063271e41f5261c1a20a2be71b46b4593b504dfd8f4e44c63971dca

SHA512
450a9743526ef806cef0c220bbbf01ed5ea23db1e3790f6941e75aedbdd9880111d4f527686e0045177c84c120f95a7748ddbc753634ca18694350e9f913e03b

Download Submit
C:\Windows\system\gYucotS.exe

Filesize
1.9MB

MD5
52f935d945c62fb8cab951f2aa3acad5

SHA1
1ee76210f78b50ad5ce43162247a0448cb41ae63

SHA256
0520979c4bc1182ad6d0df608d83c19f8cd1f6af552fc34fa787dfc00184237c

SHA512
96960c5154868bdffc81d423e30d789f6de97d22bf2d52d069edbc6261ed1e893c987fdb42c92f15133e21b90ae073cbd8431c803fc9891cb82891e30f089ccd

Download Submit
C:\Windows\system\ilvlFpY.exe

Filesize
1.9MB

MD5
f3da0cc12cf26bc4849df06643cadb9e

SHA1
ccef93dc50438bf65823555f08e41999edd92f95

SHA256
ca84a2c8b625a9041cde068e8bb125b2042b15cb1f6441232a33482c1d9cf6ff

SHA512
620dcc3b243de8c284cba10ed43bfe4e0d8887e865a9e0b04251bdcece788f7897335745d59de63ffcabc73f2cb95452499903ac540231a31871bc73dbfd9184

Download Submit
C:\Windows\system\kABwDqW.exe

Filesize
1.9MB

MD5
5525b294c3f3cd0386510cf7d776f6a0

SHA1
f9a2eb1ee636768a58d237638c01bbdec6a84ba8

SHA256
6b576e7eac0465368cc280e068a09d345802c4f837caf9d20d75b08c7dda12cd

SHA512
3c2885696e83e9b5cc982d58ca436e9899ecd63f116c1c9b50f331a78219e3add47bdb8d5b507bb06467fc09c77ae4522099c91c05c2acb47f1a4b0046065359

Download Submit
C:\Windows\system\lyKrgCe.exe

Filesize
1.9MB

MD5
96f9642fbca65e8ef9698dbb268b8ba8

SHA1
b23666fde40c350001ff3de0db089f5bc4d67e7f

SHA256
95073652b7431dd510893e665cfec993bb22063955623580bf24d9bb5a13bb89

SHA512
8609e46e8e661663c0e925d2fa521498be089f8af34e4eed575a4a1fea9180fd562909b4299deeca55447019bdeec4aa7c8dc8e08fca8b9a2bbcc838dfeb8cb6

Download Submit
C:\Windows\system\wvjXBxv.exe

Filesize
1.9MB

MD5
7c7e02a5a52a1c2e00ace9476c080c31

SHA1
145f503c4bbcf299e23bec031197157d368884ae

SHA256
3d9811adf7cd30781b6834fc66e197bebc577ae802cbd07c00a6f5df78e61d24

SHA512
fbac2632918a854426b7ba17dd7ae0983f64e372e486fbb5199a05c715cbf033854356f754772d9c2fe1d65ae446c11b912f5de4102ca29c3bc09df3e8cfc6c3

Download Submit
\Windows\system\DBdkqfD.exe

Filesize
1.9MB

MD5
9d3b88e6d4c4a73d9bae6482cba2d07e

SHA1
58e9a7271f11b8d2dbe33e27709b0b9bc8039ee7

SHA256
80f253704c5c749431ad5c35de6f17e9e2fcd4e96163445381cfd2f73f4e17cc

SHA512
207b2fb19a28179bd1517c68c1caadb539668a39e739cef9e66a4bf4f153287735eefa3781a73f605deb6e2d49232a39942ffe59cf7277a58f146294a1f39331

Download Submit
\Windows\system\DFSqlaw.exe

Filesize
1.9MB

MD5
3d876fbadb4c9c93bde9070338542907

SHA1
1b576572cf784f40556bf949ea707d9f7dc55f31

SHA256
1617d3a898b00d88302cab14a15c3b425982530211138649b561c02e628ec1e1

SHA512
ab4fcf2d29cea5f24708e2b6253222f52432574347721469851f7d37ee0203625210d3278eade91018b0be7aeede9797eb4a6d2dc064b595f3380e1ae8475af1

Download Submit
\Windows\system\DFtoPKv.exe

Filesize
1.9MB

MD5
823068da0b17ae6b91ad7ca76c1bf595

SHA1
2530bc96e9e1c87ef9973a02ce17e33e2064a601

SHA256
5764a1b4be4f185e87dadc4b56dc1c0fd1425f128b1bd0244738f8f701945b66

SHA512
07d4b4d9d6bcba5ed9ac5dc10fde5ff304f1bb2114883ac24e8dc871ec0bdcf972470327413796f52806a99ca13b3edbb2b93c86e5f52b6dd8a4d20e7772a292

Download Submit
\Windows\system\HZKvLit.exe

Filesize
1.9MB

MD5
c9fcd4188b330b0e0cc8817ba81f19e3

SHA1
9b30be85ad9611b9916f2270d0bb2aee5de2ee1b

SHA256
62cc91bdbe6139f0b06ac4862438d3fa5dc641fb0736d27715cfff207ac1db5f

SHA512
3e54d79887c8f55ae756fd027bf7d239a6155aab3eafedc12073fcbce0bf28cd6d288bdb55d02a88a69326ebc7d0b9a24dddef6134a10620ccba078360f12f32

Download Submit
\Windows\system\LjttQCx.exe

Filesize
1.9MB

MD5
c21300bdec1fd886e34c98c6ecf82622

SHA1
93c93d34b61b7e796b73531104c285256e3a799b

SHA256
a3072fe81553a29bdbf539fd106dbf39ddd92c3e86483e89b7299d4fc9057060

SHA512
eb3321031ee299d62b599d595bdef532a1fdf43ca62bd2b312aaeaa2209bcc31624b03f8dcbe2fbf4ab987ea552abbdd8691ee698fff03ab0f327530e4b5826e

Download Submit
\Windows\system\OpwnDBy.exe

Filesize
1.9MB

MD5
786efc0d5fdb01caef4c896aea9b28d2

SHA1
315213ad4fe9ea1ed023f8e390e0ad17077f3095

SHA256
5e107b8a68b99feafaf21e87722660972a727a1caf102e4bd188b040f57ff945

SHA512
20111146a5855ec6237ae8a3edd588d27a926a872132f74f905831ff8ee83dbd56291bab877cd80dec351a280f196cd79131a154ea1a21566702864260c1b2dd

Download Submit
\Windows\system\SCGBqCm.exe

Filesize
1.9MB

MD5
9f64ec984cfe0da088c6e934b8ad00c1

SHA1
46de55268e8e6ce595275f728c58542eb2396e21

SHA256
975c013e7206c8dc99ede5b3973b7c409a36e5e2af23c2eed78689b5d5e3d66b

SHA512
25914758a8b20e50aacd93e7fe79a4a6d6ad3ee5abb10cc1e056dfecd0b4f8a2b96ca75d26342856f0d066d95aaa3f88c4283a86bb601487c116803f8b5e6d42

Download Submit
\Windows\system\boOHcnY.exe

Filesize
1.9MB

MD5
14c9eca27904f389be0f9f14c6ef6fcd

SHA1
d3ce6bfeab1f4eda5a96a6de1f906763eb8b79ab

SHA256
e1c1c9ab5843131e35e11008a75c09c503bf266588ac95c1ee6af2511fa6ff6f

SHA512
e488e4e7235c2ed6861ee3006c26bf79f8c005af3d295b19940a5446704a8ab37dbcde21c46e2637d1e2f36a504fe9a3c27cac5d5ae382cec159593277abbe30

Download Submit
\Windows\system\dlieKBh.exe

Filesize
1.9MB

MD5
60b71087c77516bb4d614c1e98396625

SHA1
232cbba2e3466e06419debcf6f1cb389fb598419

SHA256
cc6d9003d5440ddddbd2560c1fbe8279b504231919e918ea84fa28203a9e6fd1

SHA512
b8ab5ec79575ae90f905985405a4a95c1bd9e20d2fc011a1ee45dcdb1baaea854147277fdf5af738a57ff49629539aac594ff8ee73ba02e5d5c0273cd5412038

Download Submit
\Windows\system\hBQRgsi.exe

Filesize
1.9MB

MD5
d6d45871fec89d59732fe51866c41d87

SHA1
b09c93418ec740ee94f5ead365b295cd91eedda0

SHA256
c48602e317bb04183ec8a6e8cd1d4accc1d2d69b23ece87fa62ecd9544095eed

SHA512
10395eaa39da96c899b50d47f6bbdbcab25b3f7f405cbf3320577d945a28f6fd548e59c3af0ba1cb2ebd2b59d39937ba12bf5e719e8b62980f51d600ac81b2d6

Download Submit
\Windows\system\jBtAPhl.exe

Filesize
1.9MB

MD5
0e6f52fcd0d5ee33a692d8c749475781

SHA1
87a7268ea1c8b3fe3ef204a15b97015e58ec00a1

SHA256
eed242e0a15acf7d90dfea15f0125d5251e2588a707d362a0584ad6f052f8d66

SHA512
a8ba355f541cbc74c238f4cc7bb9dd6a5c9b4f9140a5d5ece4fca30e7e87821d2239c17503ee690fd6cc2037244a4845d37f668f82749c1e686616020d98c90d

Download Submit
\Windows\system\kkrlApg.exe

Filesize
1.9MB

MD5
34a549bb754e23b38ec519f36a2b7018

SHA1
674e0f047526e4893521ec5f4f5edbe2e5c4e701

SHA256
0a9509e0f74337a9d4352999f0cc49a1ba777d1f39456ca9c6d6ffb7f4e7b44c

SHA512
3e01116caf8bef046883c4e8ee727706acfb46a0e5826887b5aab11d6e2a617d5a30cc9c5a058c3617ee32f10f0846664bfe3e4241901a0079918e3081299472

Download Submit
\Windows\system\lssdbAH.exe

Filesize
1.9MB

MD5
2b8d45ed4fc04d401dfe60f79e4ef10b

SHA1
3d971e6997f25bea8ad48266b5164e77b83f4280

SHA256
3a1966909c4afbc05abab52328a749549239078fb9d4e4238395698eb5af1875

SHA512
d51f29149a9ea5f77d51271ce818b1051a291f9c600b181db076548a93cf28cf0c043cbeb0e4c0596d72a32aad6688d9b89ac5917e607107eee14a8759f810cd

Download Submit
\Windows\system\rlJomOD.exe

Filesize
1.9MB

MD5
cf13a04c53cf0c08122313613106f61e

SHA1
4fe6beb78e715ed4931f0e336e4faabe2aa32e9c

SHA256
7e38f1f89e4a4827c4a0c4f7c38e18b0a82bb6df0558937f682bffb55a7d21a2

SHA512
f48919393a329e2f53b0a0a896d5d3f32a1bfe0f6ed657d6772290db233614ffb95c89b31eebcef5a919ed5e304efa72f1b8b517b33fbb285703548c0433e1f9

Download Submit
\Windows\system\vGOLjpK.exe

Filesize
1.9MB

MD5
18ff93818051c3648c2e04b6d72b9425

SHA1
f42b99125d9a7d7d612b3f1420acd6bb1d0c2d00

SHA256
49e52f4d14a990f847965f1ad1fc4eca5743fb874cd25b5ee6540e6b0aa6c438

SHA512
9bc8100958b8a46385b327c4183b0f1a32a278521dd4c7faf371f1cbe06cfb269868ef73401daf52f64557acf4fb5ae7c7e3ffc0f9e174978c1897ba54771286

Download Submit
memory/624-48-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/624-5095-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/780-145-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/780-5094-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-140-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1924-8521-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-123-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-137-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-116-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/1924-8397-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-139-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-8026-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/1924-142-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/1924-7535-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/1924-143-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/1924-144-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-146-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-147-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-0-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/1924-8-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/1924-1196-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/1924-26-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-75-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/1924-4294-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-1460-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2080-40-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2080-5092-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2376-5076-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2376-18-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2560-124-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2560-2067-0x00000000022B0000-0x00000000022B8000-memory.dmp

Filesize
32KB

Download
memory/2772-67-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2772-5066-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2784-5082-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-125-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-5084-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-141-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-136-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2916-5073-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download