xmrig | b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001d

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
Size

1.3MB
MD5

f3fdc921296b42c5f72bba9d44228410
SHA1

4bd66526c503e18bb913ed578da7284c3cffa615
SHA256

b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001d
SHA512

5cd107c5e4374dff6e48f1976bff7ef7d4ffde7f161687054ba4914f47f9cacc1350cf1635f2e28e7cce6ce6c35ae9c1ad3d72db0aa3ae2a2ae9a26086db0f87
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYMYkWvUmPBLl+lk6y:Lz071uv4BPMkibTIA5BBMm5w8

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/2220-548-0x00007FF694A80000-0x00007FF694E72000-memory.dmp	xmrig
behavioral2/memory/2044-629-0x00007FF64E000000-0x00007FF64E3F2000-memory.dmp	xmrig
behavioral2/memory/3444-637-0x00007FF6D8E20000-0x00007FF6D9212000-memory.dmp	xmrig
behavioral2/memory/4828-641-0x00007FF7B2780000-0x00007FF7B2B72000-memory.dmp	xmrig
behavioral2/memory/3652-2763-0x00007FF70F5C0000-0x00007FF70F9B2000-memory.dmp	xmrig
behavioral2/memory/2556-2760-0x00007FF6068B0000-0x00007FF606CA2000-memory.dmp	xmrig
behavioral2/memory/3372-639-0x00007FF69BC00000-0x00007FF69BFF2000-memory.dmp	xmrig
behavioral2/memory/2672-638-0x00007FF688590000-0x00007FF688982000-memory.dmp	xmrig
behavioral2/memory/880-636-0x00007FF7A6560000-0x00007FF7A6952000-memory.dmp	xmrig
behavioral2/memory/1684-635-0x00007FF701950000-0x00007FF701D42000-memory.dmp	xmrig
behavioral2/memory/3800-634-0x00007FF687850000-0x00007FF687C42000-memory.dmp	xmrig
behavioral2/memory/4516-633-0x00007FF640890000-0x00007FF640C82000-memory.dmp	xmrig
behavioral2/memory/2472-632-0x00007FF635080000-0x00007FF635472000-memory.dmp	xmrig
behavioral2/memory/404-631-0x00007FF78DAD0000-0x00007FF78DEC2000-memory.dmp	xmrig
behavioral2/memory/4916-630-0x00007FF6275A0000-0x00007FF627992000-memory.dmp	xmrig
behavioral2/memory/3492-549-0x00007FF76F130000-0x00007FF76F522000-memory.dmp	xmrig
behavioral2/memory/4808-475-0x00007FF7C0F90000-0x00007FF7C1382000-memory.dmp	xmrig
behavioral2/memory/1260-405-0x00007FF77D660000-0x00007FF77DA52000-memory.dmp	xmrig
behavioral2/memory/1656-312-0x00007FF7CC940000-0x00007FF7CCD32000-memory.dmp	xmrig
behavioral2/memory/3424-311-0x00007FF724010000-0x00007FF724402000-memory.dmp	xmrig
behavioral2/memory/2688-275-0x00007FF788E60000-0x00007FF789252000-memory.dmp	xmrig
behavioral2/memory/4720-274-0x00007FF6E8770000-0x00007FF6E8B62000-memory.dmp	xmrig
behavioral2/memory/4992-248-0x00007FF6A1970000-0x00007FF6A1D62000-memory.dmp	xmrig
behavioral2/memory/1508-176-0x00007FF635E50000-0x00007FF636242000-memory.dmp	xmrig
behavioral2/memory/4896-142-0x00007FF7F1230000-0x00007FF7F1622000-memory.dmp	xmrig
behavioral2/memory/2472-4380-0x00007FF635080000-0x00007FF635472000-memory.dmp	xmrig
behavioral2/memory/4720-4386-0x00007FF6E8770000-0x00007FF6E8B62000-memory.dmp	xmrig
behavioral2/memory/404-4390-0x00007FF78DAD0000-0x00007FF78DEC2000-memory.dmp	xmrig
behavioral2/memory/1260-4398-0x00007FF77D660000-0x00007FF77DA52000-memory.dmp	xmrig
behavioral2/memory/4808-4408-0x00007FF7C0F90000-0x00007FF7C1382000-memory.dmp	xmrig
behavioral2/memory/2220-4454-0x00007FF694A80000-0x00007FF694E72000-memory.dmp	xmrig
behavioral2/memory/3444-4445-0x00007FF6D8E20000-0x00007FF6D9212000-memory.dmp	xmrig
behavioral2/memory/2672-4554-0x00007FF688590000-0x00007FF688982000-memory.dmp	xmrig
behavioral2/memory/3492-4551-0x00007FF76F130000-0x00007FF76F522000-memory.dmp	xmrig
behavioral2/memory/3372-4539-0x00007FF69BC00000-0x00007FF69BFF2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3916	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3652	dYrwlNQ.exe
4896	SjRdscC.exe
4828	lRonKcA.exe
1508	jHDONvG.exe
4992	zNkNrAD.exe
4720	NreVUUK.exe
2688	AnJVBSJ.exe
3424	VMIhNcq.exe
1656	HoyIdLB.exe
1260	wzXSxNQ.exe
4808	STRzlpF.exe
2220	JqucizG.exe
3492	ajuhZpg.exe
2044	ZUDAFHw.exe
4916	bcgzVnN.exe
404	TpVBFPc.exe
2472	IpaVfza.exe
4516	pVBztRE.exe
3800	bLGhTul.exe
1684	zMTDBsP.exe
880	jZgbqCj.exe
3444	tXlRbJn.exe
2672	ktAkTRS.exe
3372	KPiYHks.exe
4908	HCiEOUa.exe
4968	XsyIgHR.exe
4788	INkWXoR.exe
2804	JKXXaEH.exe
4708	wLeehzM.exe
212	BnRMwMO.exe
1616	TcBNeCb.exe
928	JsFRIcB.exe
2224	xSCDMeA.exe
3084	ZwilCeM.exe
2712	LUvReYv.exe
1452	wXwzbxf.exe
1436	HTSWYdH.exe
2520	xazwhlS.exe
4964	UuGmsFY.exe
1492	NFYOfGZ.exe
4424	rNuEmax.exe
980	kMMqCkM.exe
3992	bBhzcyk.exe
3216	xjBivFd.exe
5084	QkIuVYW.exe
5068	SmOisOO.exe
1512	hOxcGqd.exe
3748	VWDJIXt.exe
3176	mQiBtgo.exe
4396	AehfSaT.exe
1788	rcOdZTc.exe
3240	eniNxoC.exe
3984	ksxbrov.exe
2024	yDfMUIk.exe
3968	zPeqCkW.exe
412	ijXYcgk.exe
3212	brRgWhz.exe
4536	unWxcqG.exe
1400	VRoRzxt.exe
336	Xnypdgk.exe
4128	EKIMboD.exe
224	dnhdscN.exe
4100	InhloKP.exe
4356	sPbykFK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2556-0-0x00007FF6068B0000-0x00007FF606CA2000-memory.dmp	upx
behavioral2/files/0x000d000000023b49-5.dat	upx
behavioral2/files/0x0008000000023be2-11.dat	upx
behavioral2/files/0x0008000000023c05-59.dat	upx
behavioral2/files/0x0008000000023bff-54.dat	upx
behavioral2/files/0x0008000000023c26-159.dat	upx
behavioral2/memory/2220-548-0x00007FF694A80000-0x00007FF694E72000-memory.dmp	upx
behavioral2/memory/2044-629-0x00007FF64E000000-0x00007FF64E3F2000-memory.dmp	upx
behavioral2/memory/3444-637-0x00007FF6D8E20000-0x00007FF6D9212000-memory.dmp	upx
behavioral2/memory/4828-641-0x00007FF7B2780000-0x00007FF7B2B72000-memory.dmp	upx
behavioral2/memory/3652-2763-0x00007FF70F5C0000-0x00007FF70F9B2000-memory.dmp	upx
behavioral2/memory/2556-2760-0x00007FF6068B0000-0x00007FF606CA2000-memory.dmp	upx
behavioral2/memory/3372-639-0x00007FF69BC00000-0x00007FF69BFF2000-memory.dmp	upx
behavioral2/memory/2672-638-0x00007FF688590000-0x00007FF688982000-memory.dmp	upx
behavioral2/memory/880-636-0x00007FF7A6560000-0x00007FF7A6952000-memory.dmp	upx
behavioral2/memory/1684-635-0x00007FF701950000-0x00007FF701D42000-memory.dmp	upx
behavioral2/memory/3800-634-0x00007FF687850000-0x00007FF687C42000-memory.dmp	upx
behavioral2/memory/4516-633-0x00007FF640890000-0x00007FF640C82000-memory.dmp	upx
behavioral2/memory/2472-632-0x00007FF635080000-0x00007FF635472000-memory.dmp	upx
behavioral2/memory/404-631-0x00007FF78DAD0000-0x00007FF78DEC2000-memory.dmp	upx
behavioral2/memory/4916-630-0x00007FF6275A0000-0x00007FF627992000-memory.dmp	upx
behavioral2/memory/3492-549-0x00007FF76F130000-0x00007FF76F522000-memory.dmp	upx
behavioral2/memory/4808-475-0x00007FF7C0F90000-0x00007FF7C1382000-memory.dmp	upx
behavioral2/memory/1260-405-0x00007FF77D660000-0x00007FF77DA52000-memory.dmp	upx
behavioral2/memory/1656-312-0x00007FF7CC940000-0x00007FF7CCD32000-memory.dmp	upx
behavioral2/memory/3424-311-0x00007FF724010000-0x00007FF724402000-memory.dmp	upx
behavioral2/memory/2688-275-0x00007FF788E60000-0x00007FF789252000-memory.dmp	upx
behavioral2/memory/4720-274-0x00007FF6E8770000-0x00007FF6E8B62000-memory.dmp	upx
behavioral2/memory/4992-248-0x00007FF6A1970000-0x00007FF6A1D62000-memory.dmp	upx
behavioral2/files/0x0008000000023c37-182.dat	upx
behavioral2/files/0x0008000000023c36-179.dat	upx
behavioral2/memory/1508-176-0x00007FF635E50000-0x00007FF636242000-memory.dmp	upx
behavioral2/files/0x0007000000023c51-173.dat	upx
behavioral2/files/0x0007000000023c50-170.dat	upx
behavioral2/files/0x0008000000023c07-169.dat	upx
behavioral2/files/0x0008000000023c06-168.dat	upx
behavioral2/files/0x0007000000023c4f-166.dat	upx
behavioral2/files/0x0007000000023c4e-165.dat	upx
behavioral2/files/0x0007000000023c4d-164.dat	upx
behavioral2/files/0x0007000000023c4b-186.dat	upx
behavioral2/files/0x0008000000023c09-151.dat	upx
behavioral2/files/0x0008000000023c08-144.dat	upx
behavioral2/files/0x0009000000023c40-143.dat	upx
behavioral2/memory/4896-142-0x00007FF7F1230000-0x00007FF7F1622000-memory.dmp	upx
behavioral2/files/0x0008000000023c3e-133.dat	upx
behavioral2/files/0x0008000000023c3f-129.dat	upx
behavioral2/files/0x0016000000023c20-123.dat	upx
behavioral2/files/0x0008000000023c3c-122.dat	upx
behavioral2/files/0x0008000000023c3b-121.dat	upx
behavioral2/files/0x0008000000023c3a-120.dat	upx
behavioral2/files/0x0008000000023c39-119.dat	upx
behavioral2/files/0x0008000000023c38-117.dat	upx
behavioral2/files/0x0007000000023c4c-156.dat	upx
behavioral2/files/0x0007000000023c4a-147.dat	upx
behavioral2/files/0x0008000000023beb-101.dat	upx
behavioral2/files/0x0008000000023c2a-98.dat	upx
behavioral2/files/0x0008000000023c3d-124.dat	upx
behavioral2/files/0x000b000000023c1f-84.dat	upx
behavioral2/files/0x0008000000023c0a-75.dat	upx
behavioral2/files/0x0008000000023be6-104.dat	upx
behavioral2/files/0x0008000000023be4-60.dat	upx
behavioral2/files/0x0008000000023be3-50.dat	upx
behavioral2/files/0x0008000000023bed-49.dat	upx
behavioral2/files/0x0008000000023bec-46.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VkOMfLT.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\RKYGAac.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\ISvSBBl.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\GGMjkRf.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\oywloNu.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\crLVDlU.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\RUqxWSO.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\HQGYrKm.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\IukXynV.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\lbCKaHk.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\lvYhdbr.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\eGcPMNG.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\agtXmtN.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\ZsBBDGP.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\IzoCWgl.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\GMKgQqc.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\VUhXWTs.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\KPmLxBt.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\gMJvywy.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\qjPPele.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\lkPvvpr.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\BzpTeYS.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\WMftJzw.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\mgMUkzc.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\gSeAWhY.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\DirexPb.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\bAvlouU.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\IvgBWvE.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\mmyYFZI.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\lXCxXmq.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\awWvUat.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\mqyhFpY.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\YhrUxkE.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\tEuVhhx.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\LIUNWeP.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\DGMvCbn.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\uUNLblk.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\dzTXfNW.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\HtNxRSx.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\xgZMwrr.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\ZdmLcva.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\dWkpkbs.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\uAyXbnc.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\gtgkNLu.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\WdNDrXj.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\ewhHjni.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\mEhfION.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\yMaHJNR.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\VOOBxHl.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\YUPkzCg.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\gUsbEmI.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\UbghAbn.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\vYvuLBw.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\KmjdURo.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\oobIGQV.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\IWwyuRw.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\peQrsIB.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\ZXBjPtu.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\CbZvhyw.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\zzfRkvf.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\NGrRGiD.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\nkRwQNc.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\dRSFKtF.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
File created	C:\Windows\System\QRuJQTs.exe	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3916	powershell.exe
3916	powershell.exe
3916	powershell.exe
3916	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeLockMemoryPrivilege	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 3916	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	84
PID 2556 wrote to memory of 3916	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	84
PID 2556 wrote to memory of 3652	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	85
PID 2556 wrote to memory of 3652	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	85
PID 2556 wrote to memory of 4896	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	86
PID 2556 wrote to memory of 4896	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	86
PID 2556 wrote to memory of 4828	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	87
PID 2556 wrote to memory of 4828	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	87
PID 2556 wrote to memory of 1508	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	88
PID 2556 wrote to memory of 1508	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	88
PID 2556 wrote to memory of 4992	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	89
PID 2556 wrote to memory of 4992	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	89
PID 2556 wrote to memory of 4720	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	90
PID 2556 wrote to memory of 4720	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	90
PID 2556 wrote to memory of 2688	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	91
PID 2556 wrote to memory of 2688	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	91
PID 2556 wrote to memory of 3424	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	92
PID 2556 wrote to memory of 3424	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	92
PID 2556 wrote to memory of 1656	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	93
PID 2556 wrote to memory of 1656	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	93
PID 2556 wrote to memory of 1260	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	94
PID 2556 wrote to memory of 1260	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	94
PID 2556 wrote to memory of 4808	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	95
PID 2556 wrote to memory of 4808	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	95
PID 2556 wrote to memory of 2220	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	96
PID 2556 wrote to memory of 2220	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	96
PID 2556 wrote to memory of 3492	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	97
PID 2556 wrote to memory of 3492	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	97
PID 2556 wrote to memory of 2044	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	98
PID 2556 wrote to memory of 2044	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	98
PID 2556 wrote to memory of 4916	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	99
PID 2556 wrote to memory of 4916	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	99
PID 2556 wrote to memory of 404	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	100
PID 2556 wrote to memory of 404	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	100
PID 2556 wrote to memory of 2472	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	101
PID 2556 wrote to memory of 2472	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	101
PID 2556 wrote to memory of 4516	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	102
PID 2556 wrote to memory of 4516	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	102
PID 2556 wrote to memory of 3800	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	103
PID 2556 wrote to memory of 3800	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	103
PID 2556 wrote to memory of 1684	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	104
PID 2556 wrote to memory of 1684	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	104
PID 2556 wrote to memory of 880	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	105
PID 2556 wrote to memory of 880	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	105
PID 2556 wrote to memory of 3444	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	106
PID 2556 wrote to memory of 3444	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	106
PID 2556 wrote to memory of 2672	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	107
PID 2556 wrote to memory of 2672	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	107
PID 2556 wrote to memory of 3372	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	108
PID 2556 wrote to memory of 3372	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	108
PID 2556 wrote to memory of 4908	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	109
PID 2556 wrote to memory of 4908	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	109
PID 2556 wrote to memory of 4968	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	110
PID 2556 wrote to memory of 4968	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	110
PID 2556 wrote to memory of 4788	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	111
PID 2556 wrote to memory of 4788	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	111
PID 2556 wrote to memory of 2804	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	112
PID 2556 wrote to memory of 2804	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	112
PID 2556 wrote to memory of 212	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	113
PID 2556 wrote to memory of 212	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	113
PID 2556 wrote to memory of 4708	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	114
PID 2556 wrote to memory of 4708	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	114
PID 2556 wrote to memory of 1616	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	115
PID 2556 wrote to memory of 1616	2556	b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe	115

C:\Users\Admin\AppData\Local\Temp\b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe
"C:\Users\Admin\AppData\Local\Temp\b3b7352c5aa8171d303f8a3be07590f1f8f0591bac7ab61d1200baf5cc12001dN.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\Windows\System\dYrwlNQ.exe
  C:\Windows\System\dYrwlNQ.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\SjRdscC.exe
  C:\Windows\System\SjRdscC.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\lRonKcA.exe
  C:\Windows\System\lRonKcA.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\jHDONvG.exe
  C:\Windows\System\jHDONvG.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\zNkNrAD.exe
  C:\Windows\System\zNkNrAD.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\NreVUUK.exe
  C:\Windows\System\NreVUUK.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\AnJVBSJ.exe
  C:\Windows\System\AnJVBSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\VMIhNcq.exe
  C:\Windows\System\VMIhNcq.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\HoyIdLB.exe
  C:\Windows\System\HoyIdLB.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\wzXSxNQ.exe
  C:\Windows\System\wzXSxNQ.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\STRzlpF.exe
  C:\Windows\System\STRzlpF.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\JqucizG.exe
  C:\Windows\System\JqucizG.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\ajuhZpg.exe
  C:\Windows\System\ajuhZpg.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\ZUDAFHw.exe
  C:\Windows\System\ZUDAFHw.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\bcgzVnN.exe
  C:\Windows\System\bcgzVnN.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\TpVBFPc.exe
  C:\Windows\System\TpVBFPc.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\IpaVfza.exe
  C:\Windows\System\IpaVfza.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\pVBztRE.exe
  C:\Windows\System\pVBztRE.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\bLGhTul.exe
  C:\Windows\System\bLGhTul.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\zMTDBsP.exe
  C:\Windows\System\zMTDBsP.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\jZgbqCj.exe
  C:\Windows\System\jZgbqCj.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\tXlRbJn.exe
  C:\Windows\System\tXlRbJn.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\ktAkTRS.exe
  C:\Windows\System\ktAkTRS.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\KPiYHks.exe
  C:\Windows\System\KPiYHks.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\HCiEOUa.exe
  C:\Windows\System\HCiEOUa.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\XsyIgHR.exe
  C:\Windows\System\XsyIgHR.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\INkWXoR.exe
  C:\Windows\System\INkWXoR.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\JKXXaEH.exe
  C:\Windows\System\JKXXaEH.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\BnRMwMO.exe
  C:\Windows\System\BnRMwMO.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\wLeehzM.exe
  C:\Windows\System\wLeehzM.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\TcBNeCb.exe
  C:\Windows\System\TcBNeCb.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\JsFRIcB.exe
  C:\Windows\System\JsFRIcB.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\xSCDMeA.exe
  C:\Windows\System\xSCDMeA.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\ZwilCeM.exe
  C:\Windows\System\ZwilCeM.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\LUvReYv.exe
  C:\Windows\System\LUvReYv.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\wXwzbxf.exe
  C:\Windows\System\wXwzbxf.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\HTSWYdH.exe
  C:\Windows\System\HTSWYdH.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\xazwhlS.exe
  C:\Windows\System\xazwhlS.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\UuGmsFY.exe
  C:\Windows\System\UuGmsFY.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\bBhzcyk.exe
  C:\Windows\System\bBhzcyk.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\xjBivFd.exe
  C:\Windows\System\xjBivFd.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\NFYOfGZ.exe
  C:\Windows\System\NFYOfGZ.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\rNuEmax.exe
  C:\Windows\System\rNuEmax.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\kMMqCkM.exe
  C:\Windows\System\kMMqCkM.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\wWlLzAO.exe
  C:\Windows\System\wWlLzAO.exe
  2⤵
  PID:1396
- C:\Windows\System\QkIuVYW.exe
  C:\Windows\System\QkIuVYW.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\SmOisOO.exe
  C:\Windows\System\SmOisOO.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\hOxcGqd.exe
  C:\Windows\System\hOxcGqd.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\VWDJIXt.exe
  C:\Windows\System\VWDJIXt.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\mQiBtgo.exe
  C:\Windows\System\mQiBtgo.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\AehfSaT.exe
  C:\Windows\System\AehfSaT.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\rcOdZTc.exe
  C:\Windows\System\rcOdZTc.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\eamSWlq.exe
  C:\Windows\System\eamSWlq.exe
  2⤵
  PID:2536
- C:\Windows\System\eniNxoC.exe
  C:\Windows\System\eniNxoC.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\ksxbrov.exe
  C:\Windows\System\ksxbrov.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\yDfMUIk.exe
  C:\Windows\System\yDfMUIk.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\zPeqCkW.exe
  C:\Windows\System\zPeqCkW.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\ijXYcgk.exe
  C:\Windows\System\ijXYcgk.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\brRgWhz.exe
  C:\Windows\System\brRgWhz.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\unWxcqG.exe
  C:\Windows\System\unWxcqG.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\VRoRzxt.exe
  C:\Windows\System\VRoRzxt.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\Xnypdgk.exe
  C:\Windows\System\Xnypdgk.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\EKIMboD.exe
  C:\Windows\System\EKIMboD.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\dnhdscN.exe
  C:\Windows\System\dnhdscN.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\InhloKP.exe
  C:\Windows\System\InhloKP.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\sPbykFK.exe
  C:\Windows\System\sPbykFK.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\GWOBMCC.exe
  C:\Windows\System\GWOBMCC.exe
  2⤵
  PID:4332
- C:\Windows\System\FzzVBTw.exe
  C:\Windows\System\FzzVBTw.exe
  2⤵
  PID:5096
- C:\Windows\System\uDOMNby.exe
  C:\Windows\System\uDOMNby.exe
  2⤵
  PID:4456
- C:\Windows\System\UKGqVdO.exe
  C:\Windows\System\UKGqVdO.exe
  2⤵
  PID:2996
- C:\Windows\System\HEdJbPt.exe
  C:\Windows\System\HEdJbPt.exe
  2⤵
  PID:764
- C:\Windows\System\MDkJiQh.exe
  C:\Windows\System\MDkJiQh.exe
  2⤵
  PID:1472
- C:\Windows\System\MnIgizy.exe
  C:\Windows\System\MnIgizy.exe
  2⤵
  PID:1604
- C:\Windows\System\EHmzack.exe
  C:\Windows\System\EHmzack.exe
  2⤵
  PID:2228
- C:\Windows\System\ykKlmiI.exe
  C:\Windows\System\ykKlmiI.exe
  2⤵
  PID:1620
- C:\Windows\System\yeraliJ.exe
  C:\Windows\System\yeraliJ.exe
  2⤵
  PID:1680
- C:\Windows\System\fTpryhD.exe
  C:\Windows\System\fTpryhD.exe
  2⤵
  PID:3980
- C:\Windows\System\MSBPWSZ.exe
  C:\Windows\System\MSBPWSZ.exe
  2⤵
  PID:4532
- C:\Windows\System\MnNhvRU.exe
  C:\Windows\System\MnNhvRU.exe
  2⤵
  PID:3464
- C:\Windows\System\zyRwsri.exe
  C:\Windows\System\zyRwsri.exe
  2⤵
  PID:1504
- C:\Windows\System\wJtKcsy.exe
  C:\Windows\System\wJtKcsy.exe
  2⤵
  PID:4776
- C:\Windows\System\JJUSjbi.exe
  C:\Windows\System\JJUSjbi.exe
  2⤵
  PID:4484
- C:\Windows\System\fivzFJO.exe
  C:\Windows\System\fivzFJO.exe
  2⤵
  PID:4056
- C:\Windows\System\BzVMgqj.exe
  C:\Windows\System\BzVMgqj.exe
  2⤵
  PID:456
- C:\Windows\System\WimDBiO.exe
  C:\Windows\System\WimDBiO.exe
  2⤵
  PID:4024
- C:\Windows\System\oYkBmNH.exe
  C:\Windows\System\oYkBmNH.exe
  2⤵
  PID:3132
- C:\Windows\System\lMyVgnU.exe
  C:\Windows\System\lMyVgnU.exe
  2⤵
  PID:4192
- C:\Windows\System\vijWyio.exe
  C:\Windows\System\vijWyio.exe
  2⤵
  PID:4016
- C:\Windows\System\aLMxmpI.exe
  C:\Windows\System\aLMxmpI.exe
  2⤵
  PID:2068
- C:\Windows\System\VkbssiH.exe
  C:\Windows\System\VkbssiH.exe
  2⤵
  PID:4996
- C:\Windows\System\ruCbfdW.exe
  C:\Windows\System\ruCbfdW.exe
  2⤵
  PID:3900
- C:\Windows\System\cBVCDUF.exe
  C:\Windows\System\cBVCDUF.exe
  2⤵
  PID:4304
- C:\Windows\System\jLhsaKe.exe
  C:\Windows\System\jLhsaKe.exe
  2⤵
  PID:5148
- C:\Windows\System\howZBvi.exe
  C:\Windows\System\howZBvi.exe
  2⤵
  PID:5164
- C:\Windows\System\qQHuxwG.exe
  C:\Windows\System\qQHuxwG.exe
  2⤵
  PID:5180
- C:\Windows\System\RPtNEFs.exe
  C:\Windows\System\RPtNEFs.exe
  2⤵
  PID:5196
- C:\Windows\System\IBHlRFa.exe
  C:\Windows\System\IBHlRFa.exe
  2⤵
  PID:5212
- C:\Windows\System\MdsHrNF.exe
  C:\Windows\System\MdsHrNF.exe
  2⤵
  PID:5228
- C:\Windows\System\tjxRmuR.exe
  C:\Windows\System\tjxRmuR.exe
  2⤵
  PID:5248
- C:\Windows\System\WQSLIXo.exe
  C:\Windows\System\WQSLIXo.exe
  2⤵
  PID:5264
- C:\Windows\System\IApNuFE.exe
  C:\Windows\System\IApNuFE.exe
  2⤵
  PID:5284
- C:\Windows\System\TSBRTzq.exe
  C:\Windows\System\TSBRTzq.exe
  2⤵
  PID:5304
- C:\Windows\System\dJGpOON.exe
  C:\Windows\System\dJGpOON.exe
  2⤵
  PID:5324
- C:\Windows\System\bCUhHQv.exe
  C:\Windows\System\bCUhHQv.exe
  2⤵
  PID:5340
- C:\Windows\System\bEuWbRv.exe
  C:\Windows\System\bEuWbRv.exe
  2⤵
  PID:5360
- C:\Windows\System\kkRrwJY.exe
  C:\Windows\System\kkRrwJY.exe
  2⤵
  PID:5388
- C:\Windows\System\WpgKTDu.exe
  C:\Windows\System\WpgKTDu.exe
  2⤵
  PID:5404
- C:\Windows\System\HLQjEOd.exe
  C:\Windows\System\HLQjEOd.exe
  2⤵
  PID:5424
- C:\Windows\System\BbIzJnp.exe
  C:\Windows\System\BbIzJnp.exe
  2⤵
  PID:5444
- C:\Windows\System\tWKvtfA.exe
  C:\Windows\System\tWKvtfA.exe
  2⤵
  PID:5460
- C:\Windows\System\YWdEvSY.exe
  C:\Windows\System\YWdEvSY.exe
  2⤵
  PID:5484
- C:\Windows\System\PdTSwnN.exe
  C:\Windows\System\PdTSwnN.exe
  2⤵
  PID:5504
- C:\Windows\System\dfknatg.exe
  C:\Windows\System\dfknatg.exe
  2⤵
  PID:5524
- C:\Windows\System\PSEicqG.exe
  C:\Windows\System\PSEicqG.exe
  2⤵
  PID:5540
- C:\Windows\System\lmGOeUs.exe
  C:\Windows\System\lmGOeUs.exe
  2⤵
  PID:5568
- C:\Windows\System\IBWfBeX.exe
  C:\Windows\System\IBWfBeX.exe
  2⤵
  PID:5588
- C:\Windows\System\EuFuRBr.exe
  C:\Windows\System\EuFuRBr.exe
  2⤵
  PID:5612
- C:\Windows\System\lcomkqq.exe
  C:\Windows\System\lcomkqq.exe
  2⤵
  PID:5632
- C:\Windows\System\SWuurFy.exe
  C:\Windows\System\SWuurFy.exe
  2⤵
  PID:5656
- C:\Windows\System\DkfMFVF.exe
  C:\Windows\System\DkfMFVF.exe
  2⤵
  PID:5672
- C:\Windows\System\rHpulZx.exe
  C:\Windows\System\rHpulZx.exe
  2⤵
  PID:5696
- C:\Windows\System\ojhwQQt.exe
  C:\Windows\System\ojhwQQt.exe
  2⤵
  PID:5724
- C:\Windows\System\cclUCqO.exe
  C:\Windows\System\cclUCqO.exe
  2⤵
  PID:5740
- C:\Windows\System\vMUvMZQ.exe
  C:\Windows\System\vMUvMZQ.exe
  2⤵
  PID:5764
- C:\Windows\System\TmHvzyJ.exe
  C:\Windows\System\TmHvzyJ.exe
  2⤵
  PID:5784
- C:\Windows\System\BnVfYEz.exe
  C:\Windows\System\BnVfYEz.exe
  2⤵
  PID:5804
- C:\Windows\System\TPEyUHC.exe
  C:\Windows\System\TPEyUHC.exe
  2⤵
  PID:5820
- C:\Windows\System\guPtHeB.exe
  C:\Windows\System\guPtHeB.exe
  2⤵
  PID:5836
- C:\Windows\System\nvAYOGZ.exe
  C:\Windows\System\nvAYOGZ.exe
  2⤵
  PID:5852
- C:\Windows\System\EqAqjWc.exe
  C:\Windows\System\EqAqjWc.exe
  2⤵
  PID:5872
- C:\Windows\System\dzHyNqZ.exe
  C:\Windows\System\dzHyNqZ.exe
  2⤵
  PID:5896
- C:\Windows\System\nJYPTiv.exe
  C:\Windows\System\nJYPTiv.exe
  2⤵
  PID:5912
- C:\Windows\System\CMnjLHF.exe
  C:\Windows\System\CMnjLHF.exe
  2⤵
  PID:5936
- C:\Windows\System\yjzUwUN.exe
  C:\Windows\System\yjzUwUN.exe
  2⤵
  PID:5952
- C:\Windows\System\RimTnLI.exe
  C:\Windows\System\RimTnLI.exe
  2⤵
  PID:6004
- C:\Windows\System\ESmtDkY.exe
  C:\Windows\System\ESmtDkY.exe
  2⤵
  PID:6020
- C:\Windows\System\kTiPtXN.exe
  C:\Windows\System\kTiPtXN.exe
  2⤵
  PID:6044
- C:\Windows\System\uZEVbRZ.exe
  C:\Windows\System\uZEVbRZ.exe
  2⤵
  PID:6060
- C:\Windows\System\cwJzThb.exe
  C:\Windows\System\cwJzThb.exe
  2⤵
  PID:6088
- C:\Windows\System\aoIiZgA.exe
  C:\Windows\System\aoIiZgA.exe
  2⤵
  PID:6108
- C:\Windows\System\hirJxKe.exe
  C:\Windows\System\hirJxKe.exe
  2⤵
  PID:3300
- C:\Windows\System\bSfwJgU.exe
  C:\Windows\System\bSfwJgU.exe
  2⤵
  PID:4152
- C:\Windows\System\agbYSji.exe
  C:\Windows\System\agbYSji.exe
  2⤵
  PID:1036
- C:\Windows\System\cRMKyoF.exe
  C:\Windows\System\cRMKyoF.exe
  2⤵
  PID:3352
- C:\Windows\System\kGEonkQ.exe
  C:\Windows\System\kGEonkQ.exe
  2⤵
  PID:1344
- C:\Windows\System\PTaRcTc.exe
  C:\Windows\System\PTaRcTc.exe
  2⤵
  PID:2452
- C:\Windows\System\poOluJA.exe
  C:\Windows\System\poOluJA.exe
  2⤵
  PID:4328
- C:\Windows\System\xIkPRzJ.exe
  C:\Windows\System\xIkPRzJ.exe
  2⤵
  PID:2324
- C:\Windows\System\LVmrzLu.exe
  C:\Windows\System\LVmrzLu.exe
  2⤵
  PID:8
- C:\Windows\System\MKtTecD.exe
  C:\Windows\System\MKtTecD.exe
  2⤵
  PID:1748
- C:\Windows\System\RIQfrcY.exe
  C:\Windows\System\RIQfrcY.exe
  2⤵
  PID:5532
- C:\Windows\System\ckSsRJN.exe
  C:\Windows\System\ckSsRJN.exe
  2⤵
  PID:3624
- C:\Windows\System\smLwnut.exe
  C:\Windows\System\smLwnut.exe
  2⤵
  PID:5620
- C:\Windows\System\NzTdotW.exe
  C:\Windows\System\NzTdotW.exe
  2⤵
  PID:5680
- C:\Windows\System\PKAAniz.exe
  C:\Windows\System\PKAAniz.exe
  2⤵
  PID:892
- C:\Windows\System\PVHzKjJ.exe
  C:\Windows\System\PVHzKjJ.exe
  2⤵
  PID:5924
- C:\Windows\System\mpYcMNm.exe
  C:\Windows\System\mpYcMNm.exe
  2⤵
  PID:6156
- C:\Windows\System\BacbWee.exe
  C:\Windows\System\BacbWee.exe
  2⤵
  PID:6176
- C:\Windows\System\gGQNmqx.exe
  C:\Windows\System\gGQNmqx.exe
  2⤵
  PID:6212
- C:\Windows\System\nqLIHfC.exe
  C:\Windows\System\nqLIHfC.exe
  2⤵
  PID:6232
- C:\Windows\System\jlhxvmc.exe
  C:\Windows\System\jlhxvmc.exe
  2⤵
  PID:6284
- C:\Windows\System\NKQWoBW.exe
  C:\Windows\System\NKQWoBW.exe
  2⤵
  PID:6304
- C:\Windows\System\hZdRlgE.exe
  C:\Windows\System\hZdRlgE.exe
  2⤵
  PID:6384
- C:\Windows\System\YKpBWAr.exe
  C:\Windows\System\YKpBWAr.exe
  2⤵
  PID:6404
- C:\Windows\System\zxPMHJW.exe
  C:\Windows\System\zxPMHJW.exe
  2⤵
  PID:6424
- C:\Windows\System\tzMpWgI.exe
  C:\Windows\System\tzMpWgI.exe
  2⤵
  PID:6440
- C:\Windows\System\pOjKtVt.exe
  C:\Windows\System\pOjKtVt.exe
  2⤵
  PID:6464
- C:\Windows\System\kKSPWjj.exe
  C:\Windows\System\kKSPWjj.exe
  2⤵
  PID:6480
- C:\Windows\System\tfpbVJT.exe
  C:\Windows\System\tfpbVJT.exe
  2⤵
  PID:6504
- C:\Windows\System\BeEANuX.exe
  C:\Windows\System\BeEANuX.exe
  2⤵
  PID:6520
- C:\Windows\System\iUlQjuQ.exe
  C:\Windows\System\iUlQjuQ.exe
  2⤵
  PID:6544
- C:\Windows\System\pXCbDAB.exe
  C:\Windows\System\pXCbDAB.exe
  2⤵
  PID:6560
- C:\Windows\System\IvWQjjg.exe
  C:\Windows\System\IvWQjjg.exe
  2⤵
  PID:6584
- C:\Windows\System\dksXvNo.exe
  C:\Windows\System\dksXvNo.exe
  2⤵
  PID:6600
- C:\Windows\System\RHxNwxF.exe
  C:\Windows\System\RHxNwxF.exe
  2⤵
  PID:6620
- C:\Windows\System\rlXgiYq.exe
  C:\Windows\System\rlXgiYq.exe
  2⤵
  PID:6640
- C:\Windows\System\RcJaKzG.exe
  C:\Windows\System\RcJaKzG.exe
  2⤵
  PID:6656
- C:\Windows\System\tixPfcV.exe
  C:\Windows\System\tixPfcV.exe
  2⤵
  PID:6676
- C:\Windows\System\YmhOJXK.exe
  C:\Windows\System\YmhOJXK.exe
  2⤵
  PID:6696
- C:\Windows\System\BeULfll.exe
  C:\Windows\System\BeULfll.exe
  2⤵
  PID:6712
- C:\Windows\System\LxjGTLV.exe
  C:\Windows\System\LxjGTLV.exe
  2⤵
  PID:6732
- C:\Windows\System\ECHIhvx.exe
  C:\Windows\System\ECHIhvx.exe
  2⤵
  PID:6760
- C:\Windows\System\QYFsUKf.exe
  C:\Windows\System\QYFsUKf.exe
  2⤵
  PID:6784
- C:\Windows\System\agRNGGi.exe
  C:\Windows\System\agRNGGi.exe
  2⤵
  PID:6800
- C:\Windows\System\TYYwFJD.exe
  C:\Windows\System\TYYwFJD.exe
  2⤵
  PID:6816
- C:\Windows\System\aSWpYke.exe
  C:\Windows\System\aSWpYke.exe
  2⤵
  PID:6836
- C:\Windows\System\fwnVaAW.exe
  C:\Windows\System\fwnVaAW.exe
  2⤵
  PID:6856
- C:\Windows\System\vjKSNsm.exe
  C:\Windows\System\vjKSNsm.exe
  2⤵
  PID:6876
- C:\Windows\System\LWehbUF.exe
  C:\Windows\System\LWehbUF.exe
  2⤵
  PID:6892
- C:\Windows\System\YIpkkGx.exe
  C:\Windows\System\YIpkkGx.exe
  2⤵
  PID:6916
- C:\Windows\System\ZNoWyOb.exe
  C:\Windows\System\ZNoWyOb.exe
  2⤵
  PID:6932
- C:\Windows\System\FrDgmdy.exe
  C:\Windows\System\FrDgmdy.exe
  2⤵
  PID:6956
- C:\Windows\System\OYsRBpG.exe
  C:\Windows\System\OYsRBpG.exe
  2⤵
  PID:6972
- C:\Windows\System\mEnjGdZ.exe
  C:\Windows\System\mEnjGdZ.exe
  2⤵
  PID:7000
- C:\Windows\System\NXfAykA.exe
  C:\Windows\System\NXfAykA.exe
  2⤵
  PID:7016
- C:\Windows\System\BspCWUG.exe
  C:\Windows\System\BspCWUG.exe
  2⤵
  PID:7040
- C:\Windows\System\TXaSsrN.exe
  C:\Windows\System\TXaSsrN.exe
  2⤵
  PID:7064
- C:\Windows\System\AAocwvX.exe
  C:\Windows\System\AAocwvX.exe
  2⤵
  PID:7080
- C:\Windows\System\DRbThWR.exe
  C:\Windows\System\DRbThWR.exe
  2⤵
  PID:7104
- C:\Windows\System\KfLFIuB.exe
  C:\Windows\System\KfLFIuB.exe
  2⤵
  PID:7120
- C:\Windows\System\QQYDeOP.exe
  C:\Windows\System\QQYDeOP.exe
  2⤵
  PID:7144
- C:\Windows\System\BbxKkmu.exe
  C:\Windows\System\BbxKkmu.exe
  2⤵
  PID:5964
- C:\Windows\System\XeQBDoL.exe
  C:\Windows\System\XeQBDoL.exe
  2⤵
  PID:6100
- C:\Windows\System\LOKhfKl.exe
  C:\Windows\System\LOKhfKl.exe
  2⤵
  PID:2360
- C:\Windows\System\YIsbxAy.exe
  C:\Windows\System\YIsbxAy.exe
  2⤵
  PID:2256
- C:\Windows\System\hPSaWpp.exe
  C:\Windows\System\hPSaWpp.exe
  2⤵
  PID:4224
- C:\Windows\System\nJJqXAC.exe
  C:\Windows\System\nJJqXAC.exe
  2⤵
  PID:1852
- C:\Windows\System\zYipAKI.exe
  C:\Windows\System\zYipAKI.exe
  2⤵
  PID:2332
- C:\Windows\System\MgIZXPi.exe
  C:\Windows\System\MgIZXPi.exe
  2⤵
  PID:1060
- C:\Windows\System\mRectkT.exe
  C:\Windows\System\mRectkT.exe
  2⤵
  PID:1596
- C:\Windows\System\hxxafrb.exe
  C:\Windows\System\hxxafrb.exe
  2⤵
  PID:1200
- C:\Windows\System\GOooTfT.exe
  C:\Windows\System\GOooTfT.exe
  2⤵
  PID:6168
- C:\Windows\System\oUobxJG.exe
  C:\Windows\System\oUobxJG.exe
  2⤵
  PID:5416
- C:\Windows\System\XweDzPV.exe
  C:\Windows\System\XweDzPV.exe
  2⤵
  PID:5452
- C:\Windows\System\sKOgzcP.exe
  C:\Windows\System\sKOgzcP.exe
  2⤵
  PID:5480
- C:\Windows\System\gCQeAtT.exe
  C:\Windows\System\gCQeAtT.exe
  2⤵
  PID:5516
- C:\Windows\System\RFHqqBw.exe
  C:\Windows\System\RFHqqBw.exe
  2⤵
  PID:5088
- C:\Windows\System\jGhtgmR.exe
  C:\Windows\System\jGhtgmR.exe
  2⤵
  PID:6420
- C:\Windows\System\wanRCpW.exe
  C:\Windows\System\wanRCpW.exe
  2⤵
  PID:5708
- C:\Windows\System\RmGmyZs.exe
  C:\Windows\System\RmGmyZs.exe
  2⤵
  PID:5796
- C:\Windows\System\XfhhRWv.exe
  C:\Windows\System\XfhhRWv.exe
  2⤵
  PID:5816
- C:\Windows\System\BRoaZcC.exe
  C:\Windows\System\BRoaZcC.exe
  2⤵
  PID:5848
- C:\Windows\System\akXaVqu.exe
  C:\Windows\System\akXaVqu.exe
  2⤵
  PID:5888
- C:\Windows\System\ePBESPi.exe
  C:\Windows\System\ePBESPi.exe
  2⤵
  PID:6164
- C:\Windows\System\BPDPTbE.exe
  C:\Windows\System\BPDPTbE.exe
  2⤵
  PID:6120
- C:\Windows\System\IRjpFiN.exe
  C:\Windows\System\IRjpFiN.exe
  2⤵
  PID:4104
- C:\Windows\System\WzUFkwU.exe
  C:\Windows\System\WzUFkwU.exe
  2⤵
  PID:540
- C:\Windows\System\KFdGiAJ.exe
  C:\Windows\System\KFdGiAJ.exe
  2⤵
  PID:920
- C:\Windows\System\bMTEgqc.exe
  C:\Windows\System\bMTEgqc.exe
  2⤵
  PID:6224
- C:\Windows\System\HRfKnkB.exe
  C:\Windows\System\HRfKnkB.exe
  2⤵
  PID:6292
- C:\Windows\System\QDxxNsA.exe
  C:\Windows\System\QDxxNsA.exe
  2⤵
  PID:6340
- C:\Windows\System\rZCKlYE.exe
  C:\Windows\System\rZCKlYE.exe
  2⤵
  PID:6376
- C:\Windows\System\fzgjkHu.exe
  C:\Windows\System\fzgjkHu.exe
  2⤵
  PID:6528
- C:\Windows\System\jHuexEW.exe
  C:\Windows\System\jHuexEW.exe
  2⤵
  PID:6980
- C:\Windows\System\MCVqXee.exe
  C:\Windows\System\MCVqXee.exe
  2⤵
  PID:7048
- C:\Windows\System\fxUMEtj.exe
  C:\Windows\System\fxUMEtj.exe
  2⤵
  PID:1516
- C:\Windows\System\VrWsUzc.exe
  C:\Windows\System\VrWsUzc.exe
  2⤵
  PID:4344
- C:\Windows\System\hjXBmWf.exe
  C:\Windows\System\hjXBmWf.exe
  2⤵
  PID:6636
- C:\Windows\System\GNeIijp.exe
  C:\Windows\System\GNeIijp.exe
  2⤵
  PID:6704
- C:\Windows\System\JHmjXDH.exe
  C:\Windows\System\JHmjXDH.exe
  2⤵
  PID:7192
- C:\Windows\System\EzbIzfT.exe
  C:\Windows\System\EzbIzfT.exe
  2⤵
  PID:7208
- C:\Windows\System\hFcMmzc.exe
  C:\Windows\System\hFcMmzc.exe
  2⤵
  PID:7232
- C:\Windows\System\JxKSQSZ.exe
  C:\Windows\System\JxKSQSZ.exe
  2⤵
  PID:7256
- C:\Windows\System\JpxxGaa.exe
  C:\Windows\System\JpxxGaa.exe
  2⤵
  PID:7272
- C:\Windows\System\wbzyBRw.exe
  C:\Windows\System\wbzyBRw.exe
  2⤵
  PID:7292
- C:\Windows\System\vtTFwLr.exe
  C:\Windows\System\vtTFwLr.exe
  2⤵
  PID:7312
- C:\Windows\System\SgkAblv.exe
  C:\Windows\System\SgkAblv.exe
  2⤵
  PID:7328
- C:\Windows\System\GmSxSRA.exe
  C:\Windows\System\GmSxSRA.exe
  2⤵
  PID:7352
- C:\Windows\System\XOkszks.exe
  C:\Windows\System\XOkszks.exe
  2⤵
  PID:7372
- C:\Windows\System\vcSSnFb.exe
  C:\Windows\System\vcSSnFb.exe
  2⤵
  PID:7392
- C:\Windows\System\DvcHRon.exe
  C:\Windows\System\DvcHRon.exe
  2⤵
  PID:7408
- C:\Windows\System\TSVxxuq.exe
  C:\Windows\System\TSVxxuq.exe
  2⤵
  PID:7432
- C:\Windows\System\pdKsOPL.exe
  C:\Windows\System\pdKsOPL.exe
  2⤵
  PID:7452
- C:\Windows\System\GFxaKQZ.exe
  C:\Windows\System\GFxaKQZ.exe
  2⤵
  PID:7468
- C:\Windows\System\rsRNRkE.exe
  C:\Windows\System\rsRNRkE.exe
  2⤵
  PID:7492
- C:\Windows\System\XYhgJJA.exe
  C:\Windows\System\XYhgJJA.exe
  2⤵
  PID:7508
- C:\Windows\System\syBEyQx.exe
  C:\Windows\System\syBEyQx.exe
  2⤵
  PID:7532
- C:\Windows\System\ahyABsw.exe
  C:\Windows\System\ahyABsw.exe
  2⤵
  PID:7548
- C:\Windows\System\TBJqPak.exe
  C:\Windows\System\TBJqPak.exe
  2⤵
  PID:7572
- C:\Windows\System\SArcaKP.exe
  C:\Windows\System\SArcaKP.exe
  2⤵
  PID:7588
- C:\Windows\System\OmwlhFe.exe
  C:\Windows\System\OmwlhFe.exe
  2⤵
  PID:7608
- C:\Windows\System\KzdDeNn.exe
  C:\Windows\System\KzdDeNn.exe
  2⤵
  PID:7628
- C:\Windows\System\QhNRhwh.exe
  C:\Windows\System\QhNRhwh.exe
  2⤵
  PID:7644
- C:\Windows\System\WQXGUFS.exe
  C:\Windows\System\WQXGUFS.exe
  2⤵
  PID:7664
- C:\Windows\System\TjXqsAH.exe
  C:\Windows\System\TjXqsAH.exe
  2⤵
  PID:7684
- C:\Windows\System\eMooERA.exe
  C:\Windows\System\eMooERA.exe
  2⤵
  PID:7704
- C:\Windows\System\IYoLrdk.exe
  C:\Windows\System\IYoLrdk.exe
  2⤵
  PID:7720
- C:\Windows\System\PSAiDqt.exe
  C:\Windows\System\PSAiDqt.exe
  2⤵
  PID:7736
- C:\Windows\System\xdbeQsL.exe
  C:\Windows\System\xdbeQsL.exe
  2⤵
  PID:7752
- C:\Windows\System\DNtbsSN.exe
  C:\Windows\System\DNtbsSN.exe
  2⤵
  PID:7772
- C:\Windows\System\zzouezp.exe
  C:\Windows\System\zzouezp.exe
  2⤵
  PID:7792
- C:\Windows\System\cZinRKk.exe
  C:\Windows\System\cZinRKk.exe
  2⤵
  PID:7808
- C:\Windows\System\LkEUhdK.exe
  C:\Windows\System\LkEUhdK.exe
  2⤵
  PID:7824
- C:\Windows\System\vCNLOmX.exe
  C:\Windows\System\vCNLOmX.exe
  2⤵
  PID:7840
- C:\Windows\System\OyVwctu.exe
  C:\Windows\System\OyVwctu.exe
  2⤵
  PID:7856
- C:\Windows\System\utAXgSu.exe
  C:\Windows\System\utAXgSu.exe
  2⤵
  PID:7880
- C:\Windows\System\oFWjfgr.exe
  C:\Windows\System\oFWjfgr.exe
  2⤵
  PID:7900
- C:\Windows\System\pIYRncC.exe
  C:\Windows\System\pIYRncC.exe
  2⤵
  PID:7924
- C:\Windows\System\YIJbNPI.exe
  C:\Windows\System\YIJbNPI.exe
  2⤵
  PID:7940
- C:\Windows\System\tmkRuqN.exe
  C:\Windows\System\tmkRuqN.exe
  2⤵
  PID:7960
- C:\Windows\System\bOYFPsm.exe
  C:\Windows\System\bOYFPsm.exe
  2⤵
  PID:7976
- C:\Windows\System\yzCOLwJ.exe
  C:\Windows\System\yzCOLwJ.exe
  2⤵
  PID:7996
- C:\Windows\System\gZGWllx.exe
  C:\Windows\System\gZGWllx.exe
  2⤵
  PID:8012
- C:\Windows\System\zwVTYyV.exe
  C:\Windows\System\zwVTYyV.exe
  2⤵
  PID:8032
- C:\Windows\System\uwlNaXh.exe
  C:\Windows\System\uwlNaXh.exe
  2⤵
  PID:8052
- C:\Windows\System\ZhMcGiI.exe
  C:\Windows\System\ZhMcGiI.exe
  2⤵
  PID:8072
- C:\Windows\System\IAOiluh.exe
  C:\Windows\System\IAOiluh.exe
  2⤵
  PID:8092
- C:\Windows\System\vApAYPJ.exe
  C:\Windows\System\vApAYPJ.exe
  2⤵
  PID:8112
- C:\Windows\System\zpNMJPe.exe
  C:\Windows\System\zpNMJPe.exe
  2⤵
  PID:8132
- C:\Windows\System\gEQQiAb.exe
  C:\Windows\System\gEQQiAb.exe
  2⤵
  PID:8152
- C:\Windows\System\pLtVLpg.exe
  C:\Windows\System\pLtVLpg.exe
  2⤵
  PID:8168
- C:\Windows\System\zepdTrh.exe
  C:\Windows\System\zepdTrh.exe
  2⤵
  PID:8188
- C:\Windows\System\ROyzlNb.exe
  C:\Windows\System\ROyzlNb.exe
  2⤵
  PID:6848
- C:\Windows\System\tYPuOgw.exe
  C:\Windows\System\tYPuOgw.exe
  2⤵
  PID:6988
- C:\Windows\System\DSrHDul.exe
  C:\Windows\System\DSrHDul.exe
  2⤵
  PID:5944
- C:\Windows\System\zrlcPFJ.exe
  C:\Windows\System\zrlcPFJ.exe
  2⤵
  PID:384
- C:\Windows\System\cEnthpY.exe
  C:\Windows\System\cEnthpY.exe
  2⤵
  PID:8200
- C:\Windows\System\XcSEJzW.exe
  C:\Windows\System\XcSEJzW.exe
  2⤵
  PID:8224
- C:\Windows\System\MYTMnnx.exe
  C:\Windows\System\MYTMnnx.exe
  2⤵
  PID:8240
- C:\Windows\System\ZbKUuRo.exe
  C:\Windows\System\ZbKUuRo.exe
  2⤵
  PID:8268
- C:\Windows\System\qxIRVVV.exe
  C:\Windows\System\qxIRVVV.exe
  2⤵
  PID:8284
- C:\Windows\System\RkDdgew.exe
  C:\Windows\System\RkDdgew.exe
  2⤵
  PID:8304
- C:\Windows\System\HYLBVRL.exe
  C:\Windows\System\HYLBVRL.exe
  2⤵
  PID:8320
- C:\Windows\System\sssuNTl.exe
  C:\Windows\System\sssuNTl.exe
  2⤵
  PID:8344
- C:\Windows\System\fnKQCfy.exe
  C:\Windows\System\fnKQCfy.exe
  2⤵
  PID:8360
- C:\Windows\System\jTXhsQk.exe
  C:\Windows\System\jTXhsQk.exe
  2⤵
  PID:8380
- C:\Windows\System\jjWWmDQ.exe
  C:\Windows\System\jjWWmDQ.exe
  2⤵
  PID:8396
- C:\Windows\System\pIAhPPt.exe
  C:\Windows\System\pIAhPPt.exe
  2⤵
  PID:8412
- C:\Windows\System\GcOeDFr.exe
  C:\Windows\System\GcOeDFr.exe
  2⤵
  PID:8432
- C:\Windows\System\FaPZESX.exe
  C:\Windows\System\FaPZESX.exe
  2⤵
  PID:8448
- C:\Windows\System\bFzKEcm.exe
  C:\Windows\System\bFzKEcm.exe
  2⤵
  PID:8464
- C:\Windows\System\owWmuQO.exe
  C:\Windows\System\owWmuQO.exe
  2⤵
  PID:8488
- C:\Windows\System\OBdjiyD.exe
  C:\Windows\System\OBdjiyD.exe
  2⤵
  PID:8504
- C:\Windows\System\txUiODS.exe
  C:\Windows\System\txUiODS.exe
  2⤵
  PID:8528
- C:\Windows\System\dqAozkM.exe
  C:\Windows\System\dqAozkM.exe
  2⤵
  PID:8544
- C:\Windows\System\XzRJSPR.exe
  C:\Windows\System\XzRJSPR.exe
  2⤵
  PID:8572
- C:\Windows\System\koaiFHB.exe
  C:\Windows\System\koaiFHB.exe
  2⤵
  PID:9008
- C:\Windows\System\LwivWhw.exe
  C:\Windows\System\LwivWhw.exe
  2⤵
  PID:9028
- C:\Windows\System\MZCZKWj.exe
  C:\Windows\System\MZCZKWj.exe
  2⤵
  PID:9044
- C:\Windows\System\nszYzKG.exe
  C:\Windows\System\nszYzKG.exe
  2⤵
  PID:9060
- C:\Windows\System\uhiuUVH.exe
  C:\Windows\System\uhiuUVH.exe
  2⤵
  PID:9076
- C:\Windows\System\vFOxTpr.exe
  C:\Windows\System\vFOxTpr.exe
  2⤵
  PID:9104
- C:\Windows\System\irOkEBE.exe
  C:\Windows\System\irOkEBE.exe
  2⤵
  PID:9120
- C:\Windows\System\DRKgVST.exe
  C:\Windows\System\DRKgVST.exe
  2⤵
  PID:9136
- C:\Windows\System\PYYMRYX.exe
  C:\Windows\System\PYYMRYX.exe
  2⤵
  PID:9152
- C:\Windows\System\vyEnOKC.exe
  C:\Windows\System\vyEnOKC.exe
  2⤵
  PID:9168
- C:\Windows\System\FCQWCRM.exe
  C:\Windows\System\FCQWCRM.exe
  2⤵
  PID:9184
- C:\Windows\System\vHpGctv.exe
  C:\Windows\System\vHpGctv.exe
  2⤵
  PID:9200
- C:\Windows\System\WqLzkBy.exe
  C:\Windows\System\WqLzkBy.exe
  2⤵
  PID:6536
- C:\Windows\System\hrWKMAK.exe
  C:\Windows\System\hrWKMAK.exe
  2⤵
  PID:6728
- C:\Windows\System\DlQNXOp.exe
  C:\Windows\System\DlQNXOp.exe
  2⤵
  PID:6952
- C:\Windows\System\uvjAwab.exe
  C:\Windows\System\uvjAwab.exe
  2⤵
  PID:4560
- C:\Windows\System\ABZkXEA.exe
  C:\Windows\System\ABZkXEA.exe
  2⤵
  PID:6436
- C:\Windows\System\wglbMdo.exe
  C:\Windows\System\wglbMdo.exe
  2⤵
  PID:6476
- C:\Windows\System\UDXwHqf.exe
  C:\Windows\System\UDXwHqf.exe
  2⤵
  PID:6512
- C:\Windows\System\eqtWiSY.exe
  C:\Windows\System\eqtWiSY.exe
  2⤵
  PID:6592
- C:\Windows\System\RAqpZOo.exe
  C:\Windows\System\RAqpZOo.exe
  2⤵
  PID:6668
- C:\Windows\System\OOeKipb.exe
  C:\Windows\System\OOeKipb.exe
  2⤵
  PID:6744
- C:\Windows\System\VGpOUll.exe
  C:\Windows\System\VGpOUll.exe
  2⤵
  PID:6852
- C:\Windows\System\aCBkdRp.exe
  C:\Windows\System\aCBkdRp.exe
  2⤵
  PID:6928
- C:\Windows\System\VuWcoIU.exe
  C:\Windows\System\VuWcoIU.exe
  2⤵
  PID:7060
- C:\Windows\System\DxWRgZV.exe
  C:\Windows\System\DxWRgZV.exe
  2⤵
  PID:7096
- C:\Windows\System\rUFEYxp.exe
  C:\Windows\System\rUFEYxp.exe
  2⤵
  PID:6096
- C:\Windows\System\jGDfLIw.exe
  C:\Windows\System\jGDfLIw.exe
  2⤵
  PID:8584
- C:\Windows\System\YohqdeT.exe
  C:\Windows\System\YohqdeT.exe
  2⤵
  PID:3616
- C:\Windows\System\joFriri.exe
  C:\Windows\System\joFriri.exe
  2⤵
  PID:8176
- C:\Windows\System\VCHsYmY.exe
  C:\Windows\System\VCHsYmY.exe
  2⤵
  PID:6792
- C:\Windows\System\wnNeUbx.exe
  C:\Windows\System\wnNeUbx.exe
  2⤵
  PID:7012
- C:\Windows\System\uAIOvKr.exe
  C:\Windows\System\uAIOvKr.exe
  2⤵
  PID:1148
- C:\Windows\System\kyuvwCo.exe
  C:\Windows\System\kyuvwCo.exe
  2⤵
  PID:5400
- C:\Windows\System\xdSDjEH.exe
  C:\Windows\System\xdSDjEH.exe
  2⤵
  PID:5468
- C:\Windows\System\qjPPele.exe
  C:\Windows\System\qjPPele.exe
  2⤵
  PID:5536
- C:\Windows\System\lpdyYmA.exe
  C:\Windows\System\lpdyYmA.exe
  2⤵
  PID:6568
- C:\Windows\System\GucraXP.exe
  C:\Windows\System\GucraXP.exe
  2⤵
  PID:2928
- C:\Windows\System\BqKZFnB.exe
  C:\Windows\System\BqKZFnB.exe
  2⤵
  PID:5920
- C:\Windows\System\fnWtaBU.exe
  C:\Windows\System\fnWtaBU.exe
  2⤵
  PID:6132
- C:\Windows\System\NkMadYb.exe
  C:\Windows\System\NkMadYb.exe
  2⤵
  PID:4540
- C:\Windows\System\OFIkeaS.exe
  C:\Windows\System\OFIkeaS.exe
  2⤵
  PID:6368
- C:\Windows\System\qiCCfPN.exe
  C:\Windows\System\qiCCfPN.exe
  2⤵
  PID:6220
- C:\Windows\System\NUTPUAr.exe
  C:\Windows\System\NUTPUAr.exe
  2⤵
  PID:7200
- C:\Windows\System\NCfBYKo.exe
  C:\Windows\System\NCfBYKo.exe
  2⤵
  PID:6652
- C:\Windows\System\oDKuBcf.exe
  C:\Windows\System\oDKuBcf.exe
  2⤵
  PID:4948
- C:\Windows\System\JNrenyJ.exe
  C:\Windows\System\JNrenyJ.exe
  2⤵
  PID:7128
- C:\Windows\System\WSxuKds.exe
  C:\Windows\System\WSxuKds.exe
  2⤵
  PID:6768
- C:\Windows\System\WTSNlIH.exe
  C:\Windows\System\WTSNlIH.exe
  2⤵
  PID:7336
- C:\Windows\System\cKUUeZp.exe
  C:\Windows\System\cKUUeZp.exe
  2⤵
  PID:7288
- C:\Windows\System\LwBYTNc.exe
  C:\Windows\System\LwBYTNc.exe
  2⤵
  PID:7264
- C:\Windows\System\dYEFGYw.exe
  C:\Windows\System\dYEFGYw.exe
  2⤵
  PID:7364
- C:\Windows\System\ukyafas.exe
  C:\Windows\System\ukyafas.exe
  2⤵
  PID:7488
- C:\Windows\System\SxXWKdR.exe
  C:\Windows\System\SxXWKdR.exe
  2⤵
  PID:7540
- C:\Windows\System\WxZChCQ.exe
  C:\Windows\System\WxZChCQ.exe
  2⤵
  PID:7560
- C:\Windows\System\VhrLKDK.exe
  C:\Windows\System\VhrLKDK.exe
  2⤵
  PID:7604
- C:\Windows\System\SAPPMOX.exe
  C:\Windows\System\SAPPMOX.exe
  2⤵
  PID:7640
- C:\Windows\System\vPbyyMJ.exe
  C:\Windows\System\vPbyyMJ.exe
  2⤵
  PID:7676
- C:\Windows\System\oXjqKFk.exe
  C:\Windows\System\oXjqKFk.exe
  2⤵
  PID:7700
- C:\Windows\System\vhcWGxt.exe
  C:\Windows\System\vhcWGxt.exe
  2⤵
  PID:7732
- C:\Windows\System\YeuzHwl.exe
  C:\Windows\System\YeuzHwl.exe
  2⤵
  PID:7780
- C:\Windows\System\FBpjprN.exe
  C:\Windows\System\FBpjprN.exe
  2⤵
  PID:7820
- C:\Windows\System\ZXCBmiJ.exe
  C:\Windows\System\ZXCBmiJ.exe
  2⤵
  PID:7852
- C:\Windows\System\SUVbcna.exe
  C:\Windows\System\SUVbcna.exe
  2⤵
  PID:7896
- C:\Windows\System\tVbpXIA.exe
  C:\Windows\System\tVbpXIA.exe
  2⤵
  PID:7936
- C:\Windows\System\scfGzVu.exe
  C:\Windows\System\scfGzVu.exe
  2⤵
  PID:7984
- C:\Windows\System\FisUhmU.exe
  C:\Windows\System\FisUhmU.exe
  2⤵
  PID:8008
- C:\Windows\System\Usqvpst.exe
  C:\Windows\System\Usqvpst.exe
  2⤵
  PID:8064
- C:\Windows\System\flvJQuM.exe
  C:\Windows\System\flvJQuM.exe
  2⤵
  PID:8104
- C:\Windows\System\pZWmtjD.exe
  C:\Windows\System\pZWmtjD.exe
  2⤵
  PID:9000
- C:\Windows\System\YAFqoex.exe
  C:\Windows\System\YAFqoex.exe
  2⤵
  PID:1692
- C:\Windows\System\TbxaBCl.exe
  C:\Windows\System\TbxaBCl.exe
  2⤵
  PID:8220
- C:\Windows\System\OaHMJUx.exe
  C:\Windows\System\OaHMJUx.exe
  2⤵
  PID:8256
- C:\Windows\System\srTKHiT.exe
  C:\Windows\System\srTKHiT.exe
  2⤵
  PID:8296
- C:\Windows\System\ytHcYmR.exe
  C:\Windows\System\ytHcYmR.exe
  2⤵
  PID:8328
- C:\Windows\System\GWaDbGV.exe
  C:\Windows\System\GWaDbGV.exe
  2⤵
  PID:8356
- C:\Windows\System\dbkypen.exe
  C:\Windows\System\dbkypen.exe
  2⤵
  PID:8388
- C:\Windows\System\xqKggVx.exe
  C:\Windows\System\xqKggVx.exe
  2⤵
  PID:8420
- C:\Windows\System\zBqIOBj.exe
  C:\Windows\System\zBqIOBj.exe
  2⤵
  PID:8460
- C:\Windows\System\llCprVk.exe
  C:\Windows\System\llCprVk.exe
  2⤵
  PID:8496
- C:\Windows\System\UwKPJCO.exe
  C:\Windows\System\UwKPJCO.exe
  2⤵
  PID:8524
- C:\Windows\System\NUCUqke.exe
  C:\Windows\System\NUCUqke.exe
  2⤵
  PID:8560
- C:\Windows\System\wMfoRpb.exe
  C:\Windows\System\wMfoRpb.exe
  2⤵
  PID:4412
- C:\Windows\System\OOrlXvp.exe
  C:\Windows\System\OOrlXvp.exe
  2⤵
  PID:6496
- C:\Windows\System\UOLguLd.exe
  C:\Windows\System\UOLguLd.exe
  2⤵
  PID:9224
- C:\Windows\System\uhCRBBY.exe
  C:\Windows\System\uhCRBBY.exe
  2⤵
  PID:9244
- C:\Windows\System\mEPJImR.exe
  C:\Windows\System\mEPJImR.exe
  2⤵
  PID:9264
- C:\Windows\System\pzGrZua.exe
  C:\Windows\System\pzGrZua.exe
  2⤵
  PID:9284
- C:\Windows\System\MyNYxeX.exe
  C:\Windows\System\MyNYxeX.exe
  2⤵
  PID:9304
- C:\Windows\System\RThDKFL.exe
  C:\Windows\System\RThDKFL.exe
  2⤵
  PID:9328
- C:\Windows\System\hYCPhOH.exe
  C:\Windows\System\hYCPhOH.exe
  2⤵
  PID:9344
- C:\Windows\System\oMJqdjP.exe
  C:\Windows\System\oMJqdjP.exe
  2⤵
  PID:9368
- C:\Windows\System\QLeapji.exe
  C:\Windows\System\QLeapji.exe
  2⤵
  PID:9388
- C:\Windows\System\qkkEgLv.exe
  C:\Windows\System\qkkEgLv.exe
  2⤵
  PID:9416
- C:\Windows\System\PrfNCcw.exe
  C:\Windows\System\PrfNCcw.exe
  2⤵
  PID:9440
- C:\Windows\System\VHigdzz.exe
  C:\Windows\System\VHigdzz.exe
  2⤵
  PID:9456
- C:\Windows\System\IjFjzGq.exe
  C:\Windows\System\IjFjzGq.exe
  2⤵
  PID:9476
- C:\Windows\System\rRrhMRn.exe
  C:\Windows\System\rRrhMRn.exe
  2⤵
  PID:9492
- C:\Windows\System\WLGLfyY.exe
  C:\Windows\System\WLGLfyY.exe
  2⤵
  PID:9508
- C:\Windows\System\yecjnbj.exe
  C:\Windows\System\yecjnbj.exe
  2⤵
  PID:9524
- C:\Windows\System\CKVzxdT.exe
  C:\Windows\System\CKVzxdT.exe
  2⤵
  PID:9544
- C:\Windows\System\JfPTRoD.exe
  C:\Windows\System\JfPTRoD.exe
  2⤵
  PID:9568
- C:\Windows\System\jpYJfCS.exe
  C:\Windows\System\jpYJfCS.exe
  2⤵
  PID:9588
- C:\Windows\System\DKTkLaC.exe
  C:\Windows\System\DKTkLaC.exe
  2⤵
  PID:9608
- C:\Windows\System\ORkehFv.exe
  C:\Windows\System\ORkehFv.exe
  2⤵
  PID:9632
- C:\Windows\System\CuBrQUT.exe
  C:\Windows\System\CuBrQUT.exe
  2⤵
  PID:9652
- C:\Windows\System\ZbasJHT.exe
  C:\Windows\System\ZbasJHT.exe
  2⤵
  PID:9676
- C:\Windows\System\ZpzKyHm.exe
  C:\Windows\System\ZpzKyHm.exe
  2⤵
  PID:9696
- C:\Windows\System\BJYPQtP.exe
  C:\Windows\System\BJYPQtP.exe
  2⤵
  PID:9716
- C:\Windows\System\PybAhVg.exe
  C:\Windows\System\PybAhVg.exe
  2⤵
  PID:9736
- C:\Windows\System\kADJSNJ.exe
  C:\Windows\System\kADJSNJ.exe
  2⤵
  PID:9752
- C:\Windows\System\rzdOcbm.exe
  C:\Windows\System\rzdOcbm.exe
  2⤵
  PID:9776
- C:\Windows\System\DgdeRwh.exe
  C:\Windows\System\DgdeRwh.exe
  2⤵
  PID:9800
- C:\Windows\System\jcRQfTP.exe
  C:\Windows\System\jcRQfTP.exe
  2⤵
  PID:9816
- C:\Windows\System\KyXJilA.exe
  C:\Windows\System\KyXJilA.exe
  2⤵
  PID:9840
- C:\Windows\System\gcrkOez.exe
  C:\Windows\System\gcrkOez.exe
  2⤵
  PID:9860
- C:\Windows\System\QaCClIM.exe
  C:\Windows\System\QaCClIM.exe
  2⤵
  PID:9876
- C:\Windows\System\fGPjkMe.exe
  C:\Windows\System\fGPjkMe.exe
  2⤵
  PID:9900
- C:\Windows\System\QFTmWVF.exe
  C:\Windows\System\QFTmWVF.exe
  2⤵
  PID:9916
- C:\Windows\System\EfLkmOv.exe
  C:\Windows\System\EfLkmOv.exe
  2⤵
  PID:9940
- C:\Windows\System\QcvTVMz.exe
  C:\Windows\System\QcvTVMz.exe
  2⤵
  PID:9964
- C:\Windows\System\xipVFOD.exe
  C:\Windows\System\xipVFOD.exe
  2⤵
  PID:9980
- C:\Windows\System\cTMoeKw.exe
  C:\Windows\System\cTMoeKw.exe
  2⤵
  PID:10000
- C:\Windows\System\hWVPBTd.exe
  C:\Windows\System\hWVPBTd.exe
  2⤵
  PID:10016
- C:\Windows\System\TDAiSJi.exe
  C:\Windows\System\TDAiSJi.exe
  2⤵
  PID:10036
- C:\Windows\System\KMVMDbA.exe
  C:\Windows\System\KMVMDbA.exe
  2⤵
  PID:10056
- C:\Windows\System\HwPvsAI.exe
  C:\Windows\System\HwPvsAI.exe
  2⤵
  PID:10076
- C:\Windows\System\JXmMkiC.exe
  C:\Windows\System\JXmMkiC.exe
  2⤵
  PID:10092
- C:\Windows\System\MyEEhDz.exe
  C:\Windows\System\MyEEhDz.exe
  2⤵
  PID:10120
- C:\Windows\System\xtGWacL.exe
  C:\Windows\System\xtGWacL.exe
  2⤵
  PID:10136
- C:\Windows\System\qdnwtNU.exe
  C:\Windows\System\qdnwtNU.exe
  2⤵
  PID:10160
- C:\Windows\System\DKlPenB.exe
  C:\Windows\System\DKlPenB.exe
  2⤵
  PID:10184
- C:\Windows\System\AXujiCz.exe
  C:\Windows\System\AXujiCz.exe
  2⤵
  PID:10204
- C:\Windows\System\yXEYTuH.exe
  C:\Windows\System\yXEYTuH.exe
  2⤵
  PID:10220
- C:\Windows\System\SMXMnzL.exe
  C:\Windows\System\SMXMnzL.exe
  2⤵
  PID:8144
- C:\Windows\System\LGZSKNK.exe
  C:\Windows\System\LGZSKNK.exe
  2⤵
  PID:5368
- C:\Windows\System\qmBktyM.exe
  C:\Windows\System\qmBktyM.exe
  2⤵
  PID:5868
- C:\Windows\System\FVyPORX.exe
  C:\Windows\System\FVyPORX.exe
  2⤵
  PID:7176
- C:\Windows\System\mIrhxSY.exe
  C:\Windows\System\mIrhxSY.exe
  2⤵
  PID:10248
- C:\Windows\System\OECkvUE.exe
  C:\Windows\System\OECkvUE.exe
  2⤵
  PID:10272
- C:\Windows\System\DBpTwtA.exe
  C:\Windows\System\DBpTwtA.exe
  2⤵
  PID:10292
- C:\Windows\System\vZFunDZ.exe
  C:\Windows\System\vZFunDZ.exe
  2⤵
  PID:10312
- C:\Windows\System\QJqqxdu.exe
  C:\Windows\System\QJqqxdu.exe
  2⤵
  PID:10332
- C:\Windows\System\IUqAwjT.exe
  C:\Windows\System\IUqAwjT.exe
  2⤵
  PID:10348
- C:\Windows\System\TXBerwI.exe
  C:\Windows\System\TXBerwI.exe
  2⤵
  PID:10368
- C:\Windows\System\uuLfRGa.exe
  C:\Windows\System\uuLfRGa.exe
  2⤵
  PID:10388
- C:\Windows\System\HeUeFqq.exe
  C:\Windows\System\HeUeFqq.exe
  2⤵
  PID:10408
- C:\Windows\System\vFnwPmT.exe
  C:\Windows\System\vFnwPmT.exe
  2⤵
  PID:10424
- C:\Windows\System\SAmdRit.exe
  C:\Windows\System\SAmdRit.exe
  2⤵
  PID:10448
- C:\Windows\System\njNEZam.exe
  C:\Windows\System\njNEZam.exe
  2⤵
  PID:10468
- C:\Windows\System\YqsbMMa.exe
  C:\Windows\System\YqsbMMa.exe
  2⤵
  PID:10488
- C:\Windows\System\oqUVSzx.exe
  C:\Windows\System\oqUVSzx.exe
  2⤵
  PID:10508
- C:\Windows\System\VZOdWtV.exe
  C:\Windows\System\VZOdWtV.exe
  2⤵
  PID:10528
- C:\Windows\System\KPJgysw.exe
  C:\Windows\System\KPJgysw.exe
  2⤵
  PID:10552
- C:\Windows\System\wankQKR.exe
  C:\Windows\System\wankQKR.exe
  2⤵
  PID:10572
- C:\Windows\System\GyRRKcH.exe
  C:\Windows\System\GyRRKcH.exe
  2⤵
  PID:10592
- C:\Windows\System\ErkAqww.exe
  C:\Windows\System\ErkAqww.exe
  2⤵
  PID:10620
- C:\Windows\System\WrslmEZ.exe
  C:\Windows\System\WrslmEZ.exe
  2⤵
  PID:10636
- C:\Windows\System\vTxjzTF.exe
  C:\Windows\System\vTxjzTF.exe
  2⤵
  PID:10660
- C:\Windows\System\mdProVF.exe
  C:\Windows\System\mdProVF.exe
  2⤵
  PID:10676
- C:\Windows\System\HlxIbfy.exe
  C:\Windows\System\HlxIbfy.exe
  2⤵
  PID:10700
- C:\Windows\System\WBCpaQh.exe
  C:\Windows\System\WBCpaQh.exe
  2⤵
  PID:10720
- C:\Windows\System\qGzEYLM.exe
  C:\Windows\System\qGzEYLM.exe
  2⤵
  PID:10740
- C:\Windows\System\EcMUtbR.exe
  C:\Windows\System\EcMUtbR.exe
  2⤵
  PID:10756
- C:\Windows\System\nwtBLyW.exe
  C:\Windows\System\nwtBLyW.exe
  2⤵
  PID:10780
- C:\Windows\System\HHAahFk.exe
  C:\Windows\System\HHAahFk.exe
  2⤵
  PID:10796
- C:\Windows\System\uTeZUyk.exe
  C:\Windows\System\uTeZUyk.exe
  2⤵
  PID:10816
- C:\Windows\System\DOaVSTa.exe
  C:\Windows\System\DOaVSTa.exe
  2⤵
  PID:10840
- C:\Windows\System\JBfddzo.exe
  C:\Windows\System\JBfddzo.exe
  2⤵
  PID:10856
- C:\Windows\System\XJXhwBG.exe
  C:\Windows\System\XJXhwBG.exe
  2⤵
  PID:10880
- C:\Windows\System\jVeowGQ.exe
  C:\Windows\System\jVeowGQ.exe
  2⤵
  PID:10896
- C:\Windows\System\ykaRywZ.exe
  C:\Windows\System\ykaRywZ.exe
  2⤵
  PID:10920
- C:\Windows\System\RCiPeox.exe
  C:\Windows\System\RCiPeox.exe
  2⤵
  PID:10948
- C:\Windows\System\szcCgXK.exe
  C:\Windows\System\szcCgXK.exe
  2⤵
  PID:10964
- C:\Windows\System\QHNfcyu.exe
  C:\Windows\System\QHNfcyu.exe
  2⤵
  PID:11080
- C:\Windows\System\gEGsbND.exe
  C:\Windows\System\gEGsbND.exe
  2⤵
  PID:11096
- C:\Windows\System\SYYrdSo.exe
  C:\Windows\System\SYYrdSo.exe
  2⤵
  PID:11112
- C:\Windows\System\KAWGdoB.exe
  C:\Windows\System\KAWGdoB.exe
  2⤵
  PID:11128
- C:\Windows\System\yQCkOAm.exe
  C:\Windows\System\yQCkOAm.exe
  2⤵
  PID:11144
- C:\Windows\System\QLALmhT.exe
  C:\Windows\System\QLALmhT.exe
  2⤵
  PID:11160
- C:\Windows\System\yVzYNpz.exe
  C:\Windows\System\yVzYNpz.exe
  2⤵
  PID:11176
- C:\Windows\System\iWRNNYY.exe
  C:\Windows\System\iWRNNYY.exe
  2⤵
  PID:11192
- C:\Windows\System\npLrAFq.exe
  C:\Windows\System\npLrAFq.exe
  2⤵
  PID:11208
- C:\Windows\System\PiLaowG.exe
  C:\Windows\System\PiLaowG.exe
  2⤵
  PID:11224
- C:\Windows\System\zaasVXN.exe
  C:\Windows\System\zaasVXN.exe
  2⤵
  PID:11244
- C:\Windows\System\GWLXuOj.exe
  C:\Windows\System\GWLXuOj.exe
  2⤵
  PID:5984
- C:\Windows\System\oHtEgue.exe
  C:\Windows\System\oHtEgue.exe
  2⤵
  PID:9084
- C:\Windows\System\zdwcoyh.exe
  C:\Windows\System\zdwcoyh.exe
  2⤵
  PID:8956
- C:\Windows\System\tSLzuIJ.exe
  C:\Windows\System\tSLzuIJ.exe
  2⤵
  PID:8976
- C:\Windows\System\dHPKdJE.exe
  C:\Windows\System\dHPKdJE.exe
  2⤵
  PID:11272
- C:\Windows\System\tjLUNcr.exe
  C:\Windows\System\tjLUNcr.exe
  2⤵
  PID:11296
- C:\Windows\System\ojMWKco.exe
  C:\Windows\System\ojMWKco.exe
  2⤵
  PID:11312
- C:\Windows\System\YqHLLCb.exe
  C:\Windows\System\YqHLLCb.exe
  2⤵
  PID:11340
- C:\Windows\System\OnctqGK.exe
  C:\Windows\System\OnctqGK.exe
  2⤵
  PID:11360
- C:\Windows\System\WZSHjMH.exe
  C:\Windows\System\WZSHjMH.exe
  2⤵
  PID:11380
- C:\Windows\System\EXCEnIB.exe
  C:\Windows\System\EXCEnIB.exe
  2⤵
  PID:11400
- C:\Windows\System\FVYqJZB.exe
  C:\Windows\System\FVYqJZB.exe
  2⤵
  PID:11420
- C:\Windows\System\EhgpECo.exe
  C:\Windows\System\EhgpECo.exe
  2⤵
  PID:11436
- C:\Windows\System\vgcLTKF.exe
  C:\Windows\System\vgcLTKF.exe
  2⤵
  PID:11452
- C:\Windows\System\niRwJHi.exe
  C:\Windows\System\niRwJHi.exe
  2⤵
  PID:11468
- C:\Windows\System\bJBnMYz.exe
  C:\Windows\System\bJBnMYz.exe
  2⤵
  PID:11492
- C:\Windows\System\tYqKKve.exe
  C:\Windows\System\tYqKKve.exe
  2⤵
  PID:11512
- C:\Windows\System\GRMMfAv.exe
  C:\Windows\System\GRMMfAv.exe
  2⤵
  PID:11532
- C:\Windows\System\QdwhhHU.exe
  C:\Windows\System\QdwhhHU.exe
  2⤵
  PID:11552
- C:\Windows\System\ZwTHdsv.exe
  C:\Windows\System\ZwTHdsv.exe
  2⤵
  PID:11572
- C:\Windows\System\aCjwyKx.exe
  C:\Windows\System\aCjwyKx.exe
  2⤵
  PID:11596
- C:\Windows\System\gnGlcKV.exe
  C:\Windows\System\gnGlcKV.exe
  2⤵
  PID:11612
- C:\Windows\System\ScnVesC.exe
  C:\Windows\System\ScnVesC.exe
  2⤵
  PID:11640
- C:\Windows\System\egDpAEb.exe
  C:\Windows\System\egDpAEb.exe
  2⤵
  PID:11656
- C:\Windows\System\ikNBeLY.exe
  C:\Windows\System\ikNBeLY.exe
  2⤵
  PID:11676
- C:\Windows\System\CltrSqT.exe
  C:\Windows\System\CltrSqT.exe
  2⤵
  PID:11696
- C:\Windows\System\PsWTzCV.exe
  C:\Windows\System\PsWTzCV.exe
  2⤵
  PID:11716
- C:\Windows\System\vgBcqFn.exe
  C:\Windows\System\vgBcqFn.exe
  2⤵
  PID:11732
- C:\Windows\System\rFiEcJI.exe
  C:\Windows\System\rFiEcJI.exe
  2⤵
  PID:11752
- C:\Windows\System\YfTlXbM.exe
  C:\Windows\System\YfTlXbM.exe
  2⤵
  PID:11772
- C:\Windows\System\LNvEIiM.exe
  C:\Windows\System\LNvEIiM.exe
  2⤵
  PID:11788
- C:\Windows\System\DTmdewV.exe
  C:\Windows\System\DTmdewV.exe
  2⤵
  PID:11804
- C:\Windows\System\XjdeUif.exe
  C:\Windows\System\XjdeUif.exe
  2⤵
  PID:11820
- C:\Windows\System\tBEEAGh.exe
  C:\Windows\System\tBEEAGh.exe
  2⤵
  PID:11836
- C:\Windows\System\JLEUWKA.exe
  C:\Windows\System\JLEUWKA.exe
  2⤵
  PID:11856
- C:\Windows\System\cUbTBng.exe
  C:\Windows\System\cUbTBng.exe
  2⤵
  PID:11880
- C:\Windows\System\cRAuczD.exe
  C:\Windows\System\cRAuczD.exe
  2⤵
  PID:11896
- C:\Windows\System\xDqsNke.exe
  C:\Windows\System\xDqsNke.exe
  2⤵
  PID:11920
- C:\Windows\System\mfxBBbk.exe
  C:\Windows\System\mfxBBbk.exe
  2⤵
  PID:11944
- C:\Windows\System\oHfFuFi.exe
  C:\Windows\System\oHfFuFi.exe
  2⤵
  PID:11964
- C:\Windows\System\YpJHtaF.exe
  C:\Windows\System\YpJHtaF.exe
  2⤵
  PID:11988
- C:\Windows\System\KDEEPPi.exe
  C:\Windows\System\KDEEPPi.exe
  2⤵
  PID:12008
- C:\Windows\System\nxHECcY.exe
  C:\Windows\System\nxHECcY.exe
  2⤵
  PID:12028
- C:\Windows\System\XLTyXiz.exe
  C:\Windows\System\XLTyXiz.exe
  2⤵
  PID:12052
- C:\Windows\System\BWAtEAV.exe
  C:\Windows\System\BWAtEAV.exe
  2⤵
  PID:12072
- C:\Windows\System\oPSeOLr.exe
  C:\Windows\System\oPSeOLr.exe
  2⤵
  PID:12096
- C:\Windows\System\TTYYxat.exe
  C:\Windows\System\TTYYxat.exe
  2⤵
  PID:12116
- C:\Windows\System\lYxVkeO.exe
  C:\Windows\System\lYxVkeO.exe
  2⤵
  PID:12136
- C:\Windows\System\LsNNtQk.exe
  C:\Windows\System\LsNNtQk.exe
  2⤵
  PID:12164
- C:\Windows\System\lgnWtMM.exe
  C:\Windows\System\lgnWtMM.exe
  2⤵
  PID:12180
- C:\Windows\System\BfLQHud.exe
  C:\Windows\System\BfLQHud.exe
  2⤵
  PID:12200
- C:\Windows\System\NXwmhrZ.exe
  C:\Windows\System\NXwmhrZ.exe
  2⤵
  PID:12216
- C:\Windows\System\CAXYyHJ.exe
  C:\Windows\System\CAXYyHJ.exe
  2⤵
  PID:12232
- C:\Windows\System\TdJGrDn.exe
  C:\Windows\System\TdJGrDn.exe
  2⤵
  PID:12252
- C:\Windows\System\oDHAQFP.exe
  C:\Windows\System\oDHAQFP.exe
  2⤵
  PID:12272
- C:\Windows\System\LzVwJED.exe
  C:\Windows\System\LzVwJED.exe
  2⤵
  PID:7564
- C:\Windows\System\sdRXFdN.exe
  C:\Windows\System\sdRXFdN.exe
  2⤵
  PID:1540
- C:\Windows\System\BcWqMWa.exe
  C:\Windows\System\BcWqMWa.exe
  2⤵
  PID:2268
- C:\Windows\System\uBouatY.exe
  C:\Windows\System\uBouatY.exe
  2⤵
  PID:7968
- C:\Windows\System\rqwhCpx.exe
  C:\Windows\System\rqwhCpx.exe
  2⤵
  PID:9052
- C:\Windows\System\GhxiKhG.exe
  C:\Windows\System\GhxiKhG.exe
  2⤵
  PID:8248
- C:\Windows\System\rzdfZnw.exe
  C:\Windows\System\rzdfZnw.exe
  2⤵
  PID:6616
- C:\Windows\System\dCcLjeP.exe
  C:\Windows\System\dCcLjeP.exe
  2⤵
  PID:8480
- C:\Windows\System\AkbdNHa.exe
  C:\Windows\System\AkbdNHa.exe
  2⤵
  PID:12308
- C:\Windows\System\vnBalGl.exe
  C:\Windows\System\vnBalGl.exe
  2⤵
  PID:12332
- C:\Windows\System\gcnPHBU.exe
  C:\Windows\System\gcnPHBU.exe
  2⤵
  PID:12348
- C:\Windows\System\cXXVyma.exe
  C:\Windows\System\cXXVyma.exe
  2⤵
  PID:12372
- C:\Windows\System\CyWaYbD.exe
  C:\Windows\System\CyWaYbD.exe
  2⤵
  PID:12388
- C:\Windows\System\iQrzvsN.exe
  C:\Windows\System\iQrzvsN.exe
  2⤵
  PID:12404
- C:\Windows\System\WmNeGdD.exe
  C:\Windows\System\WmNeGdD.exe
  2⤵
  PID:12424
- C:\Windows\System\qYuLxKt.exe
  C:\Windows\System\qYuLxKt.exe
  2⤵
  PID:12448
- C:\Windows\System\WEdmEjD.exe
  C:\Windows\System\WEdmEjD.exe
  2⤵
  PID:12480
- C:\Windows\System\evUrcjb.exe
  C:\Windows\System\evUrcjb.exe
  2⤵
  PID:12516
- C:\Windows\System\KRawzuY.exe
  C:\Windows\System\KRawzuY.exe
  2⤵
  PID:12560
- C:\Windows\System\lOaGkdJ.exe
  C:\Windows\System\lOaGkdJ.exe
  2⤵
  PID:13128
- C:\Windows\System\yhoeihZ.exe
  C:\Windows\System\yhoeihZ.exe
  2⤵
  PID:13156
- C:\Windows\System\cBmjgvd.exe
  C:\Windows\System\cBmjgvd.exe
  2⤵
  PID:13176
- C:\Windows\System\DlblGUr.exe
  C:\Windows\System\DlblGUr.exe
  2⤵
  PID:13196
- C:\Windows\System\ebRvLQd.exe
  C:\Windows\System\ebRvLQd.exe
  2⤵
  PID:13212
- C:\Windows\System\PSLReZk.exe
  C:\Windows\System\PSLReZk.exe
  2⤵
  PID:13228
- C:\Windows\System\nmaERqK.exe
  C:\Windows\System\nmaERqK.exe
  2⤵
  PID:13244
- C:\Windows\System\kRZWmBA.exe
  C:\Windows\System\kRZWmBA.exe
  2⤵
  PID:13260
- C:\Windows\System\vtSSFob.exe
  C:\Windows\System\vtSSFob.exe
  2⤵
  PID:10728
- C:\Windows\System\tcUcSda.exe
  C:\Windows\System\tcUcSda.exe
  2⤵
  PID:12932
- C:\Windows\System\HrGmZGd.exe
  C:\Windows\System\HrGmZGd.exe
  2⤵
  PID:12980
- C:\Windows\System\Bsqrzcp.exe
  C:\Windows\System\Bsqrzcp.exe
  2⤵
  PID:10864
- C:\Windows\System\sUQYNPR.exe
  C:\Windows\System\sUQYNPR.exe
  2⤵
  PID:13052
- C:\Windows\System\OamEyNw.exe
  C:\Windows\System\OamEyNw.exe
  2⤵
  PID:11028
- C:\Windows\System\HprsjaF.exe
  C:\Windows\System\HprsjaF.exe
  2⤵
  PID:11088
- C:\Windows\System\dvQCVwx.exe
  C:\Windows\System\dvQCVwx.exe
  2⤵
  PID:11220
- C:\Windows\System\XmevNap.exe
  C:\Windows\System\XmevNap.exe
  2⤵
  PID:11904
- C:\Windows\System\PtNxzTY.exe
  C:\Windows\System\PtNxzTY.exe
  2⤵
  PID:12040
- C:\Windows\System\vbwLCrs.exe
  C:\Windows\System\vbwLCrs.exe
  2⤵
  PID:12192
- C:\Windows\System\BRXgqtx.exe
  C:\Windows\System\BRXgqtx.exe
  2⤵
  PID:12244
- C:\Windows\System\vqWRFuB.exe
  C:\Windows\System\vqWRFuB.exe
  2⤵
  PID:7716
- C:\Windows\System\maAucDK.exe
  C:\Windows\System\maAucDK.exe
  2⤵
  PID:7888
- C:\Windows\System\TqiiSuP.exe
  C:\Windows\System\TqiiSuP.exe
  2⤵
  PID:8456
- C:\Windows\System\gqJZAHB.exe
  C:\Windows\System\gqJZAHB.exe
  2⤵
  PID:12464
- C:\Windows\System\gYNjgEY.exe
  C:\Windows\System\gYNjgEY.exe
  2⤵
  PID:12508
- C:\Windows\System\TtPZxAa.exe
  C:\Windows\System\TtPZxAa.exe
  2⤵
  PID:6812
- C:\Windows\System\XSvqoxR.exe
  C:\Windows\System\XSvqoxR.exe
  2⤵
  PID:9324
- C:\Windows\System\JMXUJFU.exe
  C:\Windows\System\JMXUJFU.exe
  2⤵
  PID:11108
- C:\Windows\System\LLIniPE.exe
  C:\Windows\System\LLIniPE.exe
  2⤵
  PID:11172
- C:\Windows\System\KQZYpwy.exe
  C:\Windows\System\KQZYpwy.exe
  2⤵
  PID:9468
- C:\Windows\System\CbNuWVK.exe
  C:\Windows\System\CbNuWVK.exe
  2⤵
  PID:9484
- C:\Windows\System\XkELGwz.exe
  C:\Windows\System\XkELGwz.exe
  2⤵
  PID:8948
- C:\Windows\System\EVnYZZO.exe
  C:\Windows\System\EVnYZZO.exe
  2⤵
  PID:5736
- C:\Windows\System\HZIzaTc.exe
  C:\Windows\System\HZIzaTc.exe
  2⤵
  PID:9796
- C:\Windows\System\htLKsWD.exe
  C:\Windows\System\htLKsWD.exe
  2⤵
  PID:5832
- C:\Windows\System\zEnsGWq.exe
  C:\Windows\System\zEnsGWq.exe
  2⤵
  PID:5992
- C:\Windows\System\eFvkLuH.exe
  C:\Windows\System\eFvkLuH.exe
  2⤵
  PID:6268
- C:\Windows\System\GcuQfgH.exe
  C:\Windows\System\GcuQfgH.exe
  2⤵
  PID:10360
- C:\Windows\System\pzPOLow.exe
  C:\Windows\System\pzPOLow.exe
  2⤵
  PID:10400
- C:\Windows\System\THsdYuG.exe
  C:\Windows\System\THsdYuG.exe
  2⤵
  PID:10460
- C:\Windows\System\dOPbiLb.exe
  C:\Windows\System\dOPbiLb.exe
  2⤵
  PID:10548
- C:\Windows\System\TThNpsC.exe
  C:\Windows\System\TThNpsC.exe
  2⤵
  PID:7340
- C:\Windows\System\wgudNan.exe
  C:\Windows\System\wgudNan.exe
  2⤵
  PID:10888
- C:\Windows\System\loBSjjF.exe
  C:\Windows\System\loBSjjF.exe
  2⤵
  PID:11252
- C:\Windows\System\ChendDb.exe
  C:\Windows\System\ChendDb.exe
  2⤵
  PID:1100
- C:\Windows\System\rjgikxl.exe
  C:\Windows\System\rjgikxl.exe
  2⤵
  PID:2424
- C:\Windows\System\ZfMWFGB.exe
  C:\Windows\System\ZfMWFGB.exe
  2⤵
  PID:11728
- C:\Windows\System\tyOmsuV.exe
  C:\Windows\System\tyOmsuV.exe
  2⤵
  PID:12620
- C:\Windows\System\yMZlgmZ.exe
  C:\Windows\System\yMZlgmZ.exe
  2⤵
  PID:11268
- C:\Windows\System\DfGIPtd.exe
  C:\Windows\System\DfGIPtd.exe
  2⤵
  PID:12660
- C:\Windows\System\mwXZjWD.exe
  C:\Windows\System\mwXZjWD.exe
  2⤵
  PID:12676
- C:\Windows\System\mybuAwJ.exe
  C:\Windows\System\mybuAwJ.exe
  2⤵
  PID:11848
- C:\Windows\System\EJviwdn.exe
  C:\Windows\System\EJviwdn.exe
  2⤵
  PID:3048
- C:\Windows\System\CtOinJF.exe
  C:\Windows\System\CtOinJF.exe
  2⤵
  PID:11688
- C:\Windows\System\DJpaIzY.exe
  C:\Windows\System\DJpaIzY.exe
  2⤵
  PID:8048
- C:\Windows\System\MFOBkSJ.exe
  C:\Windows\System\MFOBkSJ.exe
  2⤵
  PID:7972
- C:\Windows\System\DVABgTt.exe
  C:\Windows\System\DVABgTt.exe
  2⤵
  PID:12684
- C:\Windows\System\UgwOiZb.exe
  C:\Windows\System\UgwOiZb.exe
  2⤵
  PID:4748
- C:\Windows\System\PFCQhUo.exe
  C:\Windows\System\PFCQhUo.exe
  2⤵
  PID:3028
- C:\Windows\System\yBufFLG.exe
  C:\Windows\System\yBufFLG.exe
  2⤵
  PID:3068
- C:\Windows\System\sPydYbI.exe
  C:\Windows\System\sPydYbI.exe
  2⤵
  PID:12068
- C:\Windows\System\dlJeZri.exe
  C:\Windows\System\dlJeZri.exe
  2⤵
  PID:12176
- C:\Windows\System\GFmzRjU.exe
  C:\Windows\System\GFmzRjU.exe
  2⤵
  PID:12268
- C:\Windows\System\ZItpzWj.exe
  C:\Windows\System\ZItpzWj.exe
  2⤵
  PID:6740
- C:\Windows\System\FRAbcGY.exe
  C:\Windows\System\FRAbcGY.exe
  2⤵
  PID:12320
- C:\Windows\System\uGRxhSi.exe
  C:\Windows\System\uGRxhSi.exe
  2⤵
  PID:12364
- C:\Windows\System\GcQICjZ.exe
  C:\Windows\System\GcQICjZ.exe
  2⤵
  PID:8236
- C:\Windows\System\hTjHAzo.exe
  C:\Windows\System\hTjHAzo.exe
  2⤵
  PID:8552
- C:\Windows\System\RrjKCuh.exe
  C:\Windows\System\RrjKCuh.exe
  2⤵
  PID:1468
- C:\Windows\System\mMAwvhz.exe
  C:\Windows\System\mMAwvhz.exe
  2⤵
  PID:9868
- C:\Windows\System\DpcYrKx.exe
  C:\Windows\System\DpcYrKx.exe
  2⤵
  PID:9960
- C:\Windows\System\PvmXodY.exe
  C:\Windows\System\PvmXodY.exe
  2⤵
  PID:12920
- C:\Windows\System\XBPkQxD.exe
  C:\Windows\System\XBPkQxD.exe
  2⤵
  PID:7656
- C:\Windows\System\wMzdEki.exe
  C:\Windows\System\wMzdEki.exe
  2⤵
  PID:9504
- C:\Windows\System\BUHxOIB.exe
  C:\Windows\System\BUHxOIB.exe
  2⤵
  PID:9560
- C:\Windows\System\KtzMpBH.exe
  C:\Windows\System\KtzMpBH.exe
  2⤵
  PID:11280
- C:\Windows\System\HxpBWuu.exe
  C:\Windows\System\HxpBWuu.exe
  2⤵
  PID:4360
- C:\Windows\System\JmKhDkE.exe
  C:\Windows\System\JmKhDkE.exe
  2⤵
  PID:11852
- C:\Windows\System\eDwlpKX.exe
  C:\Windows\System\eDwlpKX.exe
  2⤵
  PID:10032
- C:\Windows\System\fnSOWHN.exe
  C:\Windows\System\fnSOWHN.exe
  2⤵
  PID:10228
- C:\Windows\System\egUaBlL.exe
  C:\Windows\System\egUaBlL.exe
  2⤵
  PID:12868
- C:\Windows\System\mUULRvl.exe
  C:\Windows\System\mUULRvl.exe
  2⤵
  PID:4500
- C:\Windows\System\nFPFUns.exe
  C:\Windows\System\nFPFUns.exe
  2⤵
  PID:3252
- C:\Windows\System\rfWNsAP.exe
  C:\Windows\System\rfWNsAP.exe
  2⤵
  PID:6580
- C:\Windows\System\WXCNKHW.exe
  C:\Windows\System\WXCNKHW.exe
  2⤵
  PID:12880
- C:\Windows\System\MYpefTw.exe
  C:\Windows\System\MYpefTw.exe
  2⤵
  PID:12440
- C:\Windows\System\XyAZoyH.exe
  C:\Windows\System\XyAZoyH.exe
  2⤵
  PID:11544
- C:\Windows\System\rdwfyoX.exe
  C:\Windows\System\rdwfyoX.exe
  2⤵
  PID:10068
- C:\Windows\System\UpfaMVF.exe
  C:\Windows\System\UpfaMVF.exe
  2⤵
  PID:12896
- C:\Windows\System\RfwZalt.exe
  C:\Windows\System\RfwZalt.exe
  2⤵
  PID:10824
- C:\Windows\System\XwEzJwg.exe
  C:\Windows\System\XwEzJwg.exe
  2⤵
  PID:13024
- C:\Windows\System\elhXpCr.exe
  C:\Windows\System\elhXpCr.exe
  2⤵
  PID:11068
- C:\Windows\System\zTUcuxe.exe
  C:\Windows\System\zTUcuxe.exe
  2⤵
  PID:9828
- C:\Windows\System\wfiFrvO.exe
  C:\Windows\System\wfiFrvO.exe
  2⤵
  PID:10916
- C:\Windows\System\luNFLPh.exe
  C:\Windows\System\luNFLPh.exe
  2⤵
  PID:10432
- C:\Windows\System\kUSFgBG.exe
  C:\Windows\System\kUSFgBG.exe
  2⤵
  PID:13088
- C:\Windows\System\RtVnNEO.exe
  C:\Windows\System\RtVnNEO.exe
  2⤵
  PID:12000
- C:\Windows\System\yjZNXCJ.exe
  C:\Windows\System\yjZNXCJ.exe
  2⤵
  PID:12228
- C:\Windows\System\XTVKiXw.exe
  C:\Windows\System\XTVKiXw.exe
  2⤵
  PID:12500
- C:\Windows\System\AdmnVGM.exe
  C:\Windows\System\AdmnVGM.exe
  2⤵
  PID:10612
- C:\Windows\System\XPrabku.exe
  C:\Windows\System\XPrabku.exe
  2⤵
  PID:11448
- C:\Windows\System\UXpWRcp.exe
  C:\Windows\System\UXpWRcp.exe
  2⤵
  PID:9688
- C:\Windows\System\pbHfoJJ.exe
  C:\Windows\System\pbHfoJJ.exe
  2⤵
  PID:12540
- C:\Windows\System\AWyJyze.exe
  C:\Windows\System\AWyJyze.exe
  2⤵
  PID:6968
- C:\Windows\System\RPprAAP.exe
  C:\Windows\System\RPprAAP.exe
  2⤵
  PID:9088
- C:\Windows\System\PihSpqo.exe
  C:\Windows\System\PihSpqo.exe
  2⤵
  PID:9148
- C:\Windows\System\gOirRwv.exe
  C:\Windows\System\gOirRwv.exe
  2⤵
  PID:11664
- C:\Windows\System\wAjQzQX.exe
  C:\Windows\System\wAjQzQX.exe
  2⤵
  PID:9236
- C:\Windows\System\DmPzeHU.exe
  C:\Windows\System\DmPzeHU.exe
  2⤵
  PID:8340
- C:\Windows\System\dUgviiS.exe
  C:\Windows\System\dUgviiS.exe
  2⤵
  PID:9192
- C:\Windows\System\EJUDwQj.exe
  C:\Windows\System\EJUDwQj.exe
  2⤵
  PID:10928
- C:\Windows\System\hdfBxqV.exe
  C:\Windows\System\hdfBxqV.exe
  2⤵
  PID:11352
- C:\Windows\System\WmeGGaq.exe
  C:\Windows\System\WmeGGaq.exe
  2⤵
  PID:13236
- C:\Windows\System\dPrhVSp.exe
  C:\Windows\System\dPrhVSp.exe
  2⤵
  PID:7444
- C:\Windows\System\LEjAOec.exe
  C:\Windows\System\LEjAOec.exe
  2⤵
  PID:9312
- C:\Windows\System\kBijWWA.exe
  C:\Windows\System\kBijWWA.exe
  2⤵
  PID:7692
- C:\Windows\System\kYVnmZe.exe
  C:\Windows\System\kYVnmZe.exe
  2⤵
  PID:9432
- C:\Windows\System\qvpDhkC.exe
  C:\Windows\System\qvpDhkC.exe
  2⤵
  PID:11936
- C:\Windows\System\sAyXofP.exe
  C:\Windows\System\sAyXofP.exe
  2⤵
  PID:13332
- C:\Windows\System\VUAUQNm.exe
  C:\Windows\System\VUAUQNm.exe
  2⤵
  PID:13756
- C:\Windows\System\TqYsFrE.exe
  C:\Windows\System\TqYsFrE.exe
  2⤵
  PID:13960
- C:\Windows\System\yyvmmba.exe
  C:\Windows\System\yyvmmba.exe
  2⤵
  PID:13976
- C:\Windows\System\rPoOvaS.exe
  C:\Windows\System\rPoOvaS.exe
  2⤵
  PID:13996
- C:\Windows\System\IltRFJc.exe
  C:\Windows\System\IltRFJc.exe
  2⤵
  PID:12744
- C:\Windows\System\pGpjUqD.exe
  C:\Windows\System\pGpjUqD.exe
  2⤵
  PID:13408
- C:\Windows\System\fiukuYs.exe
  C:\Windows\System\fiukuYs.exe
  2⤵
  PID:12576
- C:\Windows\System\VzQXEyA.exe
  C:\Windows\System\VzQXEyA.exe
  2⤵
  PID:7848
- C:\Windows\System\ZHQiLiL.exe
  C:\Windows\System\ZHQiLiL.exe
  2⤵
  PID:13732
- C:\Windows\System\BDbeqRy.exe
  C:\Windows\System\BDbeqRy.exe
  2⤵
  PID:13836
- C:\Windows\System\qjRdgvH.exe
  C:\Windows\System\qjRdgvH.exe
  2⤵
  PID:13720
- C:\Windows\System\bvsWYOM.exe
  C:\Windows\System\bvsWYOM.exe
  2⤵
  PID:13940
- C:\Windows\System\qqYAlWx.exe
  C:\Windows\System\qqYAlWx.exe
  2⤵
  PID:13988
- C:\Windows\System\DLqtehf.exe
  C:\Windows\System\DLqtehf.exe
  2⤵
  PID:14020
- C:\Windows\System\QiJYjvS.exe
  C:\Windows\System\QiJYjvS.exe
  2⤵
  PID:14044
- C:\Windows\System\UGCLhqR.exe
  C:\Windows\System\UGCLhqR.exe
  2⤵
  PID:14104
- C:\Windows\System\iblFXGo.exe
  C:\Windows\System\iblFXGo.exe
  2⤵
  PID:13740
- C:\Windows\System\HtNxRSx.exe
  C:\Windows\System\HtNxRSx.exe
  2⤵
  PID:14188
- C:\Windows\System\UizoDso.exe
  C:\Windows\System\UizoDso.exe
  2⤵
  PID:14228
- C:\Windows\System\wECAerV.exe
  C:\Windows\System\wECAerV.exe
  2⤵
  PID:11236
- C:\Windows\System\ibShDzH.exe
  C:\Windows\System\ibShDzH.exe
  2⤵
  PID:10328
- C:\Windows\System\cZkldMc.exe
  C:\Windows\System\cZkldMc.exe
  2⤵
  PID:14296
- C:\Windows\System\qugwaaT.exe
  C:\Windows\System\qugwaaT.exe
  2⤵
  PID:14332
- C:\Windows\System\uYKhYdM.exe
  C:\Windows\System\uYKhYdM.exe
  2⤵
  PID:10684
- C:\Windows\System\ipQxMUV.exe
  C:\Windows\System\ipQxMUV.exe
  2⤵
  PID:11020
- C:\Windows\System\BRtwVBS.exe
  C:\Windows\System\BRtwVBS.exe
  2⤵
  PID:12344
- C:\Windows\System\hukaRVc.exe
  C:\Windows\System\hukaRVc.exe
  2⤵
  PID:10152
- C:\Windows\System\yLzMcnw.exe
  C:\Windows\System\yLzMcnw.exe
  2⤵
  PID:13492
- C:\Windows\System\TFMXvqZ.exe
  C:\Windows\System\TFMXvqZ.exe
  2⤵
  PID:13152
- C:\Windows\System\fnRHISb.exe
  C:\Windows\System\fnRHISb.exe
  2⤵
  PID:9896
- C:\Windows\System\gnIMVoz.exe
  C:\Windows\System\gnIMVoz.exe
  2⤵
  PID:13500
- C:\Windows\System\HMsBQev.exe
  C:\Windows\System\HMsBQev.exe
  2⤵
  PID:12132
- C:\Windows\System\kicLSoX.exe
  C:\Windows\System\kicLSoX.exe
  2⤵
  PID:13580
- C:\Windows\System\xoAuhKV.exe
  C:\Windows\System\xoAuhKV.exe
  2⤵
  PID:14324
- C:\Windows\System\PPEcpPI.exe
  C:\Windows\System\PPEcpPI.exe
  2⤵
  PID:12592
- C:\Windows\System\xpFzawt.exe
  C:\Windows\System\xpFzawt.exe
  2⤵
  PID:13900
- C:\Windows\System\dlNrMYg.exe
  C:\Windows\System\dlNrMYg.exe
  2⤵
  PID:13344
- C:\Windows\System\NNXyPHU.exe
  C:\Windows\System\NNXyPHU.exe
  2⤵
  PID:10996
- C:\Windows\System\PdTvRRl.exe
  C:\Windows\System\PdTvRRl.exe
  2⤵
  PID:13520
- C:\Windows\System\elqIlOO.exe
  C:\Windows\System\elqIlOO.exe
  2⤵
  PID:13564
- C:\Windows\System\YgvEBFP.exe
  C:\Windows\System\YgvEBFP.exe
  2⤵
  PID:9708
- C:\Windows\System\XLkycQS.exe
  C:\Windows\System\XLkycQS.exe
  2⤵
  PID:13412
- C:\Windows\System\MCfuDtI.exe
  C:\Windows\System\MCfuDtI.exe
  2⤵
  PID:12652
- C:\Windows\System\rjVTdho.exe
  C:\Windows\System\rjVTdho.exe
  2⤵
  PID:10972
- C:\Windows\System\ZAanpfR.exe
  C:\Windows\System\ZAanpfR.exe
  2⤵
  PID:9948
- C:\Windows\System\taZLbFU.exe
  C:\Windows\System\taZLbFU.exe
  2⤵
  PID:1308
- C:\Windows\System\lCKsdUP.exe
  C:\Windows\System\lCKsdUP.exe
  2⤵
  PID:14160
- C:\Windows\System\sAkxpGf.exe
  C:\Windows\System\sAkxpGf.exe
  2⤵
  PID:3636
- C:\Windows\System\QtUIWiz.exe
  C:\Windows\System\QtUIWiz.exe
  2⤵
  PID:2012
- C:\Windows\System\oMncfhh.exe
  C:\Windows\System\oMncfhh.exe
  2⤵
  PID:5356
- C:\Windows\System\KBNEZGz.exe
  C:\Windows\System\KBNEZGz.exe
  2⤵
  PID:4640
- C:\Windows\System\DlrhjmI.exe
  C:\Windows\System\DlrhjmI.exe
  2⤵
  PID:13512
- C:\Windows\System\RYKYdRz.exe
  C:\Windows\System\RYKYdRz.exe
  2⤵
  PID:5280
- C:\Windows\System\lfxVxlq.exe
  C:\Windows\System\lfxVxlq.exe
  2⤵
  PID:13556
- C:\Windows\System\LpZpEqw.exe
  C:\Windows\System\LpZpEqw.exe
  2⤵
  PID:13776
- C:\Windows\System\MRbteYq.exe
  C:\Windows\System\MRbteYq.exe
  2⤵
  PID:13096
- C:\Windows\System\vYWvndp.exe
  C:\Windows\System\vYWvndp.exe
  2⤵
  PID:3888
- C:\Windows\System\MHPDnLL.exe
  C:\Windows\System\MHPDnLL.exe
  2⤵
  PID:14068
- C:\Windows\System\ZTuVItF.exe
  C:\Windows\System\ZTuVItF.exe
  2⤵
  PID:13396
- C:\Windows\System\rcyDYHU.exe
  C:\Windows\System\rcyDYHU.exe
  2⤵
  PID:13284
- C:\Windows\System\hnJbttK.exe
  C:\Windows\System\hnJbttK.exe
  2⤵
  PID:11376
- C:\Windows\System\ECfTEQX.exe
  C:\Windows\System\ECfTEQX.exe
  2⤵
  PID:10672
- C:\Windows\System\gMxEutg.exe
  C:\Windows\System\gMxEutg.exe
  2⤵
  PID:10256
- C:\Windows\System\naUVvGa.exe
  C:\Windows\System\naUVvGa.exe
  2⤵
  PID:13000
- C:\Windows\System\egZocFc.exe
  C:\Windows\System\egZocFc.exe
  2⤵
  PID:6748
- C:\Windows\System\QMbOyjS.exe
  C:\Windows\System\QMbOyjS.exe
  2⤵
  PID:10716
- C:\Windows\System\FXoAxSV.exe
  C:\Windows\System\FXoAxSV.exe
  2⤵
  PID:12640
- C:\Windows\System\snkTGlt.exe
  C:\Windows\System\snkTGlt.exe
  2⤵
  PID:2456
- C:\Windows\System\djRUjwZ.exe
  C:\Windows\System\djRUjwZ.exe
  2⤵
  PID:8964
- C:\Windows\System\Cttyrij.exe
  C:\Windows\System\Cttyrij.exe
  2⤵
  PID:4836
- C:\Windows\System\LsesMvS.exe
  C:\Windows\System\LsesMvS.exe
  2⤵
  PID:12144
- C:\Windows\System\CqQZjbZ.exe
  C:\Windows\System\CqQZjbZ.exe
  2⤵
  PID:5092
- C:\Windows\System\xlAWTuX.exe
  C:\Windows\System\xlAWTuX.exe
  2⤵
  PID:940
- C:\Windows\System\NxfzQSL.exe
  C:\Windows\System\NxfzQSL.exe
  2⤵
  PID:13548
- C:\Windows\System\biGeGSU.exe
  C:\Windows\System\biGeGSU.exe
  2⤵
  PID:11140
- C:\Windows\System\YAWUWeI.exe
  C:\Windows\System\YAWUWeI.exe
  2⤵
  PID:5864
- C:\Windows\System\dhSPYGy.exe
  C:\Windows\System\dhSPYGy.exe
  2⤵
  PID:8968
- C:\Windows\System\bIlqBWb.exe
  C:\Windows\System\bIlqBWb.exe
  2⤵
  PID:2888
- C:\Windows\System\RhWEXFc.exe
  C:\Windows\System\RhWEXFc.exe
  2⤵
  PID:1736
- C:\Windows\System\lXJEpGk.exe
  C:\Windows\System\lXJEpGk.exe
  2⤵
  PID:10688
- C:\Windows\System\ZLESiDo.exe
  C:\Windows\System\ZLESiDo.exe
  2⤵
  PID:14236
- C:\Windows\System\vNyqLgG.exe
  C:\Windows\System\vNyqLgG.exe
  2⤵
  PID:14108
- C:\Windows\System\ItuMXRH.exe
  C:\Windows\System\ItuMXRH.exe
  2⤵
  PID:3864
- C:\Windows\System\SwhzASo.exe
  C:\Windows\System\SwhzASo.exe
  2⤵
  PID:10696
- C:\Windows\System\EmDqzzo.exe
  C:\Windows\System\EmDqzzo.exe
  2⤵
  PID:13888
- C:\Windows\System\HgGpyVx.exe
  C:\Windows\System\HgGpyVx.exe
  2⤵
  PID:12612
- C:\Windows\System\sZAoGiK.exe
  C:\Windows\System\sZAoGiK.exe
  2⤵
  PID:13484
- C:\Windows\System\NaGxpcy.exe
  C:\Windows\System\NaGxpcy.exe
  2⤵
  PID:13444
- C:\Windows\System\iXfqFye.exe
  C:\Windows\System\iXfqFye.exe
  2⤵
  PID:14268
- C:\Windows\System\XEspzKX.exe
  C:\Windows\System\XEspzKX.exe
  2⤵
  PID:13476
- C:\Windows\System\iveAHFI.exe
  C:\Windows\System\iveAHFI.exe
  2⤵
  PID:13416
- C:\Windows\System\VRrNRMW.exe
  C:\Windows\System\VRrNRMW.exe
  2⤵
  PID:11232
- C:\Windows\System\qISMabf.exe
  C:\Windows\System\qISMabf.exe
  2⤵
  PID:7076
- C:\Windows\System\oMvCPKA.exe
  C:\Windows\System\oMvCPKA.exe
  2⤵
  PID:11200
- C:\Windows\System\YHfspzK.exe
  C:\Windows\System\YHfspzK.exe
  2⤵
  PID:14060
- C:\Windows\System\OAMPpgt.exe
  C:\Windows\System\OAMPpgt.exe
  2⤵
  PID:12092
- C:\Windows\System\WIkiQhW.exe
  C:\Windows\System\WIkiQhW.exe
  2⤵
  PID:9644
- C:\Windows\System\nkihmaZ.exe
  C:\Windows\System\nkihmaZ.exe
  2⤵
  PID:13688
- C:\Windows\System\RmjRjFH.exe
  C:\Windows\System\RmjRjFH.exe
  2⤵
  PID:1776
- C:\Windows\System\OWmFXuH.exe
  C:\Windows\System\OWmFXuH.exe
  2⤵
  PID:13568
- C:\Windows\System\hjHtxVm.exe
  C:\Windows\System\hjHtxVm.exe
  2⤵
  PID:13780
- C:\Windows\System\AlvvgWd.exe
  C:\Windows\System\AlvvgWd.exe
  2⤵
  PID:2720
- C:\Windows\System\nPmMAss.exe
  C:\Windows\System\nPmMAss.exe
  2⤵
  PID:14360
- C:\Windows\System\eokZUaI.exe
  C:\Windows\System\eokZUaI.exe
  2⤵
  PID:14380
- C:\Windows\System\tFWOCnQ.exe
  C:\Windows\System\tFWOCnQ.exe
  2⤵
  PID:14408
- C:\Windows\System\QwJulYy.exe
  C:\Windows\System\QwJulYy.exe
  2⤵
  PID:14512
- C:\Windows\System\jmrPXys.exe
  C:\Windows\System\jmrPXys.exe
  2⤵
  PID:14532
- C:\Windows\System\LpWSMqr.exe
  C:\Windows\System\LpWSMqr.exe
  2⤵
  PID:14556
- C:\Windows\System\HdKEIaa.exe
  C:\Windows\System\HdKEIaa.exe
  2⤵
  PID:14628
- C:\Windows\System\LraGWyL.exe
  C:\Windows\System\LraGWyL.exe
  2⤵
  PID:14716
- C:\Windows\System\cyERKPj.exe
  C:\Windows\System\cyERKPj.exe
  2⤵
  PID:14776
- C:\Windows\System\lIQhuUt.exe
  C:\Windows\System\lIQhuUt.exe
  2⤵
  PID:14840
- C:\Windows\System\jvMQWRI.exe
  C:\Windows\System\jvMQWRI.exe
  2⤵
  PID:14864
- C:\Windows\System\XyUjRru.exe
  C:\Windows\System\XyUjRru.exe
  2⤵
  PID:15216
- C:\Windows\System\XuOiDDT.exe
  C:\Windows\System\XuOiDDT.exe
  2⤵
  PID:15232
- C:\Windows\System\Pkpjfls.exe
  C:\Windows\System\Pkpjfls.exe
  2⤵
  PID:15252
- C:\Windows\System\SlVWhwx.exe
  C:\Windows\System\SlVWhwx.exe
  2⤵
  PID:15268
- C:\Windows\System\UshUqCO.exe
  C:\Windows\System\UshUqCO.exe
  2⤵
  PID:15296
- C:\Windows\System\IXzGseK.exe
  C:\Windows\System\IXzGseK.exe
  2⤵
  PID:15328
- C:\Windows\System\zYgOYbJ.exe
  C:\Windows\System\zYgOYbJ.exe
  2⤵
  PID:13972
- C:\Windows\System\ItRXUiQ.exe
  C:\Windows\System\ItRXUiQ.exe
  2⤵
  PID:14620
- C:\Windows\System\bCyrmzf.exe
  C:\Windows\System\bCyrmzf.exe
  2⤵
  PID:14672
- C:\Windows\System\vxpwcEl.exe
  C:\Windows\System\vxpwcEl.exe
  2⤵
  PID:15028
- C:\Windows\System\UAVCmxC.exe
  C:\Windows\System\UAVCmxC.exe
  2⤵
  PID:15048
- C:\Windows\System\eJkINov.exe
  C:\Windows\System\eJkINov.exe
  2⤵
  PID:15060
- C:\Windows\System\nJOMhTZ.exe
  C:\Windows\System\nJOMhTZ.exe
  2⤵
  PID:15088
- C:\Windows\System\EalmqWS.exe
  C:\Windows\System\EalmqWS.exe
  2⤵
  PID:14784
- C:\Windows\System\FWLjYbj.exe
  C:\Windows\System\FWLjYbj.exe
  2⤵
  PID:14884
- C:\Windows\System\tsqdCTC.exe
  C:\Windows\System\tsqdCTC.exe
  2⤵
  PID:14848
- C:\Windows\System\AAEGnmv.exe
  C:\Windows\System\AAEGnmv.exe
  2⤵
  PID:14804
- C:\Windows\System\mkOivEC.exe
  C:\Windows\System\mkOivEC.exe
  2⤵
  PID:14488
- C:\Windows\System\JpdBrCb.exe
  C:\Windows\System\JpdBrCb.exe
  2⤵
  PID:14652
- C:\Windows\System\lawgxgf.exe
  C:\Windows\System\lawgxgf.exe
  2⤵
  PID:14484
- C:\Windows\System\HUOIpwJ.exe
  C:\Windows\System\HUOIpwJ.exe
  2⤵
  PID:14612
- C:\Windows\System\YakiCGg.exe
  C:\Windows\System\YakiCGg.exe
  2⤵
  PID:15092
- C:\Windows\System\woxCROu.exe
  C:\Windows\System\woxCROu.exe
  2⤵
  PID:15164
- C:\Windows\System\LUICgyz.exe
  C:\Windows\System\LUICgyz.exe
  2⤵
  PID:1228
- C:\Windows\System\uYfvirD.exe
  C:\Windows\System\uYfvirD.exe
  2⤵
  PID:1292
- C:\Windows\System\hVweBfe.exe
  C:\Windows\System\hVweBfe.exe
  2⤵
  PID:1884
- C:\Windows\System\kkxOJnA.exe
  C:\Windows\System\kkxOJnA.exe
  2⤵
  PID:3836
- C:\Windows\System\loZxYZB.exe
  C:\Windows\System\loZxYZB.exe
  2⤵
  PID:1224
- C:\Windows\System\kbWybGm.exe
  C:\Windows\System\kbWybGm.exe
  2⤵
  PID:15264
- C:\Windows\System\lZkrfhX.exe
  C:\Windows\System\lZkrfhX.exe
  2⤵
  PID:14284
- C:\Windows\System\yRNlFlQ.exe
  C:\Windows\System\yRNlFlQ.exe
  2⤵
  PID:1952
- C:\Windows\System\ZzePJbz.exe
  C:\Windows\System\ZzePJbz.exe
  2⤵
  PID:13468
- C:\Windows\System\WHlDHsB.exe
  C:\Windows\System\WHlDHsB.exe
  2⤵
  PID:3604
- C:\Windows\System\yILEWoq.exe
  C:\Windows\System\yILEWoq.exe
  2⤵
  PID:14004
- C:\Windows\System\kxKpLEV.exe
  C:\Windows\System\kxKpLEV.exe
  2⤵
  PID:14416
- C:\Windows\System\dgJJBxA.exe
  C:\Windows\System\dgJJBxA.exe
  2⤵
  PID:14356
- C:\Windows\System\QqSEpxz.exe
  C:\Windows\System\QqSEpxz.exe
  2⤵
  PID:5032
- C:\Windows\System\TpYXpqh.exe
  C:\Windows\System\TpYXpqh.exe
  2⤵
  PID:1624
- C:\Windows\System\fTfwOHs.exe
  C:\Windows\System\fTfwOHs.exe
  2⤵
  PID:14288
- C:\Windows\System\MfavHwF.exe
  C:\Windows\System\MfavHwF.exe
  2⤵
  PID:14684
- C:\Windows\System\vnzOoUV.exe
  C:\Windows\System\vnzOoUV.exe
  2⤵
  PID:1448
- C:\Windows\System\pfCmJFg.exe
  C:\Windows\System\pfCmJFg.exe
  2⤵
  PID:2468
- C:\Windows\System\zoihBhC.exe
  C:\Windows\System\zoihBhC.exe
  2⤵
  PID:14816
- C:\Windows\System\xibZHxe.exe
  C:\Windows\System\xibZHxe.exe
  2⤵
  PID:3136
- C:\Windows\System\TwKHYjg.exe
  C:\Windows\System\TwKHYjg.exe
  2⤵
  PID:2300
- C:\Windows\System\OeECmzC.exe
  C:\Windows\System\OeECmzC.exe
  2⤵
  PID:3504
- C:\Windows\System\TlRnOyp.exe
  C:\Windows\System\TlRnOyp.exe
  2⤵
  PID:14916
- C:\Windows\System\hAdfbLU.exe
  C:\Windows\System\hAdfbLU.exe
  2⤵
  PID:14960
- C:\Windows\System\KLWzPDY.exe
  C:\Windows\System\KLWzPDY.exe
  2⤵
  PID:15000
- C:\Windows\System\UoVzEsd.exe
  C:\Windows\System\UoVzEsd.exe
  2⤵
  PID:1404
- C:\Windows\System\ZvfFUQW.exe
  C:\Windows\System\ZvfFUQW.exe
  2⤵
  PID:14580
- C:\Windows\System\ctaWWgJ.exe
  C:\Windows\System\ctaWWgJ.exe
  2⤵
  PID:3452
- C:\Windows\System\NiqhrKF.exe
  C:\Windows\System\NiqhrKF.exe
  2⤵
  PID:820
- C:\Windows\System\PiKQaVc.exe
  C:\Windows\System\PiKQaVc.exe
  2⤵
  PID:972
- C:\Windows\System\hNpnZAA.exe
  C:\Windows\System\hNpnZAA.exe
  2⤵
  PID:15184
- C:\Windows\System\TzPeHeN.exe
  C:\Windows\System\TzPeHeN.exe
  2⤵
  PID:15044
- C:\Windows\System\vqfymnj.exe
  C:\Windows\System\vqfymnj.exe
  2⤵
  PID:15064
- C:\Windows\System\oBjSCkO.exe
  C:\Windows\System\oBjSCkO.exe
  2⤵
  PID:1824
- C:\Windows\System\eUjcUqW.exe
  C:\Windows\System\eUjcUqW.exe
  2⤵
  PID:4488
- C:\Windows\System\XRlgvrE.exe
  C:\Windows\System\XRlgvrE.exe
  2⤵
  PID:15248
- C:\Windows\System\zRJEmGJ.exe
  C:\Windows\System\zRJEmGJ.exe
  2⤵
  PID:1140
- C:\Windows\System\DvjcaWx.exe
  C:\Windows\System\DvjcaWx.exe
  2⤵
  PID:15280
- C:\Windows\System\HwEwwWn.exe
  C:\Windows\System\HwEwwWn.exe
  2⤵
  PID:2564
- C:\Windows\System\DzRgYxu.exe
  C:\Windows\System\DzRgYxu.exe
  2⤵
  PID:15324
- C:\Windows\System\WgQwUWU.exe
  C:\Windows\System\WgQwUWU.exe
  2⤵
  PID:2864
- C:\Windows\System\jmtNrSS.exe
  C:\Windows\System\jmtNrSS.exe
  2⤵
  PID:5320
- C:\Windows\System\ZbCJXPT.exe
  C:\Windows\System\ZbCJXPT.exe
  2⤵
  PID:5652
- C:\Windows\System\EyKViyS.exe
  C:\Windows\System\EyKViyS.exe
  2⤵
  PID:14528
- C:\Windows\System\vusDeuD.exe
  C:\Windows\System\vusDeuD.exe
  2⤵
  PID:4736
- C:\Windows\System\IukXynV.exe
  C:\Windows\System\IukXynV.exe
  2⤵
  PID:5748
- C:\Windows\System\axtpjtT.exe
  C:\Windows\System\axtpjtT.exe
  2⤵
  PID:14996
- C:\Windows\System\vbpseii.exe
  C:\Windows\System\vbpseii.exe
  2⤵
  PID:15040
- C:\Windows\System\zPqYWoR.exe
  C:\Windows\System\zPqYWoR.exe
  2⤵
  PID:15008
- C:\Windows\System\WoWCuVL.exe
  C:\Windows\System\WoWCuVL.exe
  2⤵
  PID:3488
- C:\Windows\System\BfoaDRx.exe
  C:\Windows\System\BfoaDRx.exe
  2⤵
  PID:14872
- C:\Windows\System\OEBZtex.exe
  C:\Windows\System\OEBZtex.exe
  2⤵
  PID:6204
- C:\Windows\System\mTCrGcU.exe
  C:\Windows\System\mTCrGcU.exe
  2⤵
  PID:6136
- C:\Windows\System\IMTqhNT.exe
  C:\Windows\System\IMTqhNT.exe
  2⤵
  PID:1896
- C:\Windows\System\TGXOdFq.exe
  C:\Windows\System\TGXOdFq.exe
  2⤵
  PID:15340
- C:\Windows\System\hCsgisO.exe
  C:\Windows\System\hCsgisO.exe
  2⤵
  PID:5552
- C:\Windows\System\cfxLdXH.exe
  C:\Windows\System\cfxLdXH.exe
  2⤵
  PID:13364
- C:\Windows\System\yQFjLIE.exe
  C:\Windows\System\yQFjLIE.exe
  2⤵
  PID:5640
- C:\Windows\System\glrFuPz.exe
  C:\Windows\System\glrFuPz.exe
  2⤵
  PID:6028
- C:\Windows\System\KowPEre.exe
  C:\Windows\System\KowPEre.exe
  2⤵
  PID:1280
- C:\Windows\System\fmPxAtz.exe
  C:\Windows\System\fmPxAtz.exe
  2⤵
  PID:4844
- C:\Windows\System\CqTjjdr.exe
  C:\Windows\System\CqTjjdr.exe
  2⤵
  PID:14340
- C:\Windows\System\lmuGcuK.exe
  C:\Windows\System\lmuGcuK.exe
  2⤵
  PID:6492
- C:\Windows\System\gOFWOLZ.exe
  C:\Windows\System\gOFWOLZ.exe
  2⤵
  PID:6208
- C:\Windows\System\IXPWGJE.exe
  C:\Windows\System\IXPWGJE.exe
  2⤵
  PID:6128
- C:\Windows\System\beIAugI.exe
  C:\Windows\System\beIAugI.exe
  2⤵
  PID:5136
- C:\Windows\System\MgTOgjL.exe
  C:\Windows\System\MgTOgjL.exe
  2⤵
  PID:14676
- C:\Windows\System\myKVrHm.exe
  C:\Windows\System\myKVrHm.exe
  2⤵
  PID:2120
- C:\Windows\System\EUsJSHY.exe
  C:\Windows\System\EUsJSHY.exe
  2⤵
  PID:5276
- C:\Windows\System\ktibHnb.exe
  C:\Windows\System\ktibHnb.exe
  2⤵
  PID:6532
- C:\Windows\System\FgNQKNO.exe
  C:\Windows\System\FgNQKNO.exe
  2⤵
  PID:6140
- C:\Windows\System\lcjgpfH.exe
  C:\Windows\System\lcjgpfH.exe
  2⤵
  PID:6984
- C:\Windows\System\nJxWxmb.exe
  C:\Windows\System\nJxWxmb.exe
  2⤵
  PID:6864
- C:\Windows\System\YlJoWHj.exe
  C:\Windows\System\YlJoWHj.exe
  2⤵
  PID:5988
- C:\Windows\System\FPePPYl.exe
  C:\Windows\System\FPePPYl.exe
  2⤵
  PID:6336
- C:\Windows\System\XhKvjzn.exe
  C:\Windows\System\XhKvjzn.exe
  2⤵
  PID:4892
- C:\Windows\System\sbuntoU.exe
  C:\Windows\System\sbuntoU.exe
  2⤵
  PID:6252
- C:\Windows\System\MqxlXxz.exe
  C:\Windows\System\MqxlXxz.exe
  2⤵
  PID:14856
- C:\Windows\System\CzgxOFB.exe
  C:\Windows\System\CzgxOFB.exe
  2⤵
  PID:3040
- C:\Windows\System\talUeUa.exe
  C:\Windows\System\talUeUa.exe
  2⤵
  PID:1128
- C:\Windows\System\nvyqVXX.exe
  C:\Windows\System\nvyqVXX.exe
  2⤵
  PID:8568
- C:\Windows\System\SXeSrYK.exe
  C:\Windows\System\SXeSrYK.exe
  2⤵
  PID:5980
- C:\Windows\System\oXBjyBk.exe
  C:\Windows\System\oXBjyBk.exe
  2⤵
  PID:6344
- C:\Windows\System\xuAHyPO.exe
  C:\Windows\System\xuAHyPO.exe
  2⤵
  PID:5156
- C:\Windows\System\tEZbVbo.exe
  C:\Windows\System\tEZbVbo.exe
  2⤵
  PID:8648
- C:\Windows\System\UquuOvO.exe
  C:\Windows\System\UquuOvO.exe
  2⤵
  PID:15168
- C:\Windows\System\uoKPyHc.exe
  C:\Windows\System\uoKPyHc.exe
  2⤵
  PID:8692
- C:\Windows\System\dFShlYY.exe
  C:\Windows\System\dFShlYY.exe
  2⤵
  PID:2160
- C:\Windows\System\XVQbknX.exe
  C:\Windows\System\XVQbknX.exe
  2⤵
  PID:3928
- C:\Windows\System\rGmxebP.exe
  C:\Windows\System\rGmxebP.exe
  2⤵
  PID:3304
- C:\Windows\System\FvphajY.exe
  C:\Windows\System\FvphajY.exe
  2⤵
  PID:15260
- C:\Windows\System\OVgDlzJ.exe
  C:\Windows\System\OVgDlzJ.exe
  2⤵
  PID:6056
- C:\Windows\System\iCqZmin.exe
  C:\Windows\System\iCqZmin.exe
  2⤵
  PID:392
- C:\Windows\System\JpbsysB.exe
  C:\Windows\System\JpbsysB.exe
  2⤵
  PID:3872
- C:\Windows\System\mXOeBYR.exe
  C:\Windows\System\mXOeBYR.exe
  2⤵
  PID:8596
- C:\Windows\System\OHYsChD.exe
  C:\Windows\System\OHYsChD.exe
  2⤵
  PID:7300
- C:\Windows\System\qJvKadC.exe
  C:\Windows\System\qJvKadC.exe
  2⤵
  PID:5608
- C:\Windows\System\RvVqCfI.exe
  C:\Windows\System\RvVqCfI.exe
  2⤵
  PID:3780
- C:\Windows\System\mGsZvJH.exe
  C:\Windows\System\mGsZvJH.exe
  2⤵
  PID:2184
- C:\Windows\System\WHEqZXW.exe
  C:\Windows\System\WHEqZXW.exe
  2⤵
  PID:2388
- C:\Windows\System\BDwfNOO.exe
  C:\Windows\System\BDwfNOO.exe
  2⤵
  PID:8624
- C:\Windows\System\nUqiSOA.exe
  C:\Windows\System\nUqiSOA.exe
  2⤵
  PID:8680
- C:\Windows\System\qFkeBeK.exe
  C:\Windows\System\qFkeBeK.exe
  2⤵
  PID:7028
- C:\Windows\System\txTMzlP.exe
  C:\Windows\System\txTMzlP.exe
  2⤵
  PID:8252
- C:\Windows\System\oOdODoM.exe
  C:\Windows\System\oOdODoM.exe
  2⤵
  PID:1180
- C:\Windows\System\jySprGd.exe
  C:\Windows\System\jySprGd.exe
  2⤵
  PID:6012
- C:\Windows\System\uoOjpJx.exe
  C:\Windows\System\uoOjpJx.exe
  2⤵
  PID:4744
- C:\Windows\System\tHWfqzN.exe
  C:\Windows\System\tHWfqzN.exe
  2⤵
  PID:5208
- C:\Windows\System\VIaVWeZ.exe
  C:\Windows\System\VIaVWeZ.exe
  2⤵
  PID:8784
- C:\Windows\System\omBWZSn.exe
  C:\Windows\System\omBWZSn.exe
  2⤵
  PID:5256
- C:\Windows\System\JdSGUAA.exe
  C:\Windows\System\JdSGUAA.exe
  2⤵
  PID:9316
- C:\Windows\System\HdQMixi.exe
  C:\Windows\System\HdQMixi.exe
  2⤵
  PID:7616
- C:\Windows\System\FeoTiXt.exe
  C:\Windows\System\FeoTiXt.exe
  2⤵
  PID:6192
- C:\Windows\System\jJguPIN.exe
  C:\Windows\System\jJguPIN.exe
  2⤵
  PID:7868
- C:\Windows\System\XthEvbs.exe
  C:\Windows\System\XthEvbs.exe
  2⤵
  PID:8684
- C:\Windows\System\XKLYNIp.exe
  C:\Windows\System\XKLYNIp.exe
  2⤵
  PID:8920
- C:\Windows\System\oKMoqco.exe
  C:\Windows\System\oKMoqco.exe
  2⤵
  PID:8732
- C:\Windows\System\IRHkmAC.exe
  C:\Windows\System\IRHkmAC.exe
  2⤵
  PID:8928
- C:\Windows\System\wiepRrm.exe
  C:\Windows\System\wiepRrm.exe
  2⤵
  PID:8780
- C:\Windows\System\aDflxbJ.exe
  C:\Windows\System\aDflxbJ.exe
  2⤵
  PID:8880
- C:\Windows\System\qwxadun.exe
  C:\Windows\System\qwxadun.exe
  2⤵
  PID:8516
- C:\Windows\System\ZrILqPB.exe
  C:\Windows\System\ZrILqPB.exe
  2⤵
  PID:4348
- C:\Windows\System\GxCsMsx.exe
  C:\Windows\System\GxCsMsx.exe
  2⤵
  PID:8840
- C:\Windows\System\VxmaewC.exe
  C:\Windows\System\VxmaewC.exe
  2⤵
  PID:10176
- C:\Windows\System\QZARpWL.exe
  C:\Windows\System\QZARpWL.exe
  2⤵
  PID:8604
- C:\Windows\System\iwkfBOj.exe
  C:\Windows\System\iwkfBOj.exe
  2⤵
  PID:2408
- C:\Windows\System\guWcCWX.exe
  C:\Windows\System\guWcCWX.exe
  2⤵
  PID:8716
- C:\Windows\System\nOcmJKm.exe
  C:\Windows\System\nOcmJKm.exe
  2⤵
  PID:8476
- C:\Windows\System\sfOLaGM.exe
  C:\Windows\System\sfOLaGM.exe
  2⤵
  PID:5580
- C:\Windows\System\tHOcxeD.exe
  C:\Windows\System\tHOcxeD.exe
  2⤵
  PID:7480
- C:\Windows\System\slIarfy.exe
  C:\Windows\System\slIarfy.exe
  2⤵
  PID:1248
- C:\Windows\System\TDInwWR.exe
  C:\Windows\System\TDInwWR.exe
  2⤵
  PID:5668
- C:\Windows\System\evOwROi.exe
  C:\Windows\System\evOwROi.exe
  2⤵
  PID:8884
- C:\Windows\System\WqZStDU.exe
  C:\Windows\System\WqZStDU.exe
  2⤵
  PID:7404
- C:\Windows\System\gtaJeIG.exe
  C:\Windows\System\gtaJeIG.exe
  2⤵
  PID:6772
- C:\Windows\System\IXnzwHq.exe
  C:\Windows\System\IXnzwHq.exe
  2⤵
  PID:7956
- C:\Windows\System\TgAOYrf.exe
  C:\Windows\System\TgAOYrf.exe
  2⤵
  PID:11760
- C:\Windows\System\XxCkOjZ.exe
  C:\Windows\System\XxCkOjZ.exe
  2⤵
  PID:11624
- C:\Windows\System\uoRPwxF.exe
  C:\Windows\System\uoRPwxF.exe
  2⤵
  PID:6372
- C:\Windows\System\PuUfjSZ.exe
  C:\Windows\System\PuUfjSZ.exe
  2⤵
  PID:8896
- C:\Windows\System\bHwAGDU.exe
  C:\Windows\System\bHwAGDU.exe
  2⤵
  PID:11048
- C:\Windows\System\GAYPVDb.exe
  C:\Windows\System\GAYPVDb.exe
  2⤵
  PID:12764
- C:\Windows\System\MuJCFdx.exe
  C:\Windows\System\MuJCFdx.exe
  2⤵
  PID:5760
- C:\Windows\System\xYIXFKM.exe
  C:\Windows\System\xYIXFKM.exe
  2⤵
  PID:8828
- C:\Windows\System\ldTNyQY.exe
  C:\Windows\System\ldTNyQY.exe
  2⤵
  PID:12776
- C:\Windows\System\HuDkCWz.exe
  C:\Windows\System\HuDkCWz.exe
  2⤵
  PID:8632
- C:\Windows\System\yUVNhvH.exe
  C:\Windows\System\yUVNhvH.exe
  2⤵
  PID:15148
- C:\Windows\System\ieSdjRL.exe
  C:\Windows\System\ieSdjRL.exe
  2⤵
  PID:8020
- C:\Windows\System\TlvxUsG.exe
  C:\Windows\System\TlvxUsG.exe
  2⤵
  PID:8800
- C:\Windows\System\DxSSnvm.exe
  C:\Windows\System\DxSSnvm.exe
  2⤵
  PID:10260
- C:\Windows\System\yhjuDCI.exe
  C:\Windows\System\yhjuDCI.exe
  2⤵
  PID:12832
- C:\Windows\System\ZWptzYS.exe
  C:\Windows\System\ZWptzYS.exe
  2⤵
  PID:10384
- C:\Windows\System\PGCVjyp.exe
  C:\Windows\System\PGCVjyp.exe
  2⤵
  PID:12780
- C:\Windows\System\CGmDLrm.exe
  C:\Windows\System\CGmDLrm.exe
  2⤵
  PID:12828
- C:\Windows\System\RXPzSeM.exe
  C:\Windows\System\RXPzSeM.exe
  2⤵
  PID:10300
- C:\Windows\System\TcybwNW.exe
  C:\Windows\System\TcybwNW.exe
  2⤵
  PID:9532
- C:\Windows\System\OmTPRNN.exe
  C:\Windows\System\OmTPRNN.exe
  2⤵
  PID:8728
- C:\Windows\System\ZFWBSiD.exe
  C:\Windows\System\ZFWBSiD.exe
  2⤵
  PID:8060
- C:\Windows\System\blLyYny.exe
  C:\Windows\System\blLyYny.exe
  2⤵
  PID:9892
- C:\Windows\System\uvegOda.exe
  C:\Windows\System\uvegOda.exe
  2⤵
  PID:12808
- C:\Windows\System\ZXBjPtu.exe
  C:\Windows\System\ZXBjPtu.exe
  2⤵
  PID:14144
- C:\Windows\System\ELSDpKD.exe
  C:\Windows\System\ELSDpKD.exe
  2⤵
  PID:11764
- C:\Windows\System\RaMENQl.exe
  C:\Windows\System\RaMENQl.exe
  2⤵
  PID:12644
- C:\Windows\System\NPBhRHH.exe
  C:\Windows\System\NPBhRHH.exe
  2⤵
  PID:10772
- C:\Windows\System\knqFvMe.exe
  C:\Windows\System\knqFvMe.exe
  2⤵
  PID:1820
- C:\Windows\System\CrfhutZ.exe
  C:\Windows\System\CrfhutZ.exe
  2⤵
  PID:12908
- C:\Windows\System\rDFyMtA.exe
  C:\Windows\System\rDFyMtA.exe
  2⤵
  PID:760
- C:\Windows\System\DbQgtwy.exe
  C:\Windows\System\DbQgtwy.exe
  2⤵
  PID:12904
- C:\Windows\System\YeywruE.exe
  C:\Windows\System\YeywruE.exe
  2⤵
  PID:10868
- C:\Windows\System\BXSDzea.exe
  C:\Windows\System\BXSDzea.exe
  2⤵
  PID:11024
- C:\Windows\System\WzipQIe.exe
  C:\Windows\System\WzipQIe.exe
  2⤵
  PID:11056
- C:\Windows\System\GDWuOhI.exe
  C:\Windows\System\GDWuOhI.exe
  2⤵
  PID:11072
- C:\Windows\System\yQfWAag.exe
  C:\Windows\System\yQfWAag.exe
  2⤵
  PID:11032
- C:\Windows\System\qxwdIDF.exe
  C:\Windows\System\qxwdIDF.exe
  2⤵
  PID:10364
- C:\Windows\System\iLFUEGE.exe
  C:\Windows\System\iLFUEGE.exe
  2⤵
  PID:5236
- C:\Windows\System\ftrgies.exe
  C:\Windows\System\ftrgies.exe
  2⤵
  PID:8864
- C:\Windows\System\FcdgWHX.exe
  C:\Windows\System\FcdgWHX.exe
  2⤵
  PID:9620
- C:\Windows\System\GOeBWEH.exe
  C:\Windows\System\GOeBWEH.exe
  2⤵
  PID:12884
- C:\Windows\System\ttafKvM.exe
  C:\Windows\System\ttafKvM.exe
  2⤵
  PID:10192
- C:\Windows\System\JCpeyKM.exe
  C:\Windows\System\JCpeyKM.exe
  2⤵
  PID:10580
- C:\Windows\System\pmjZboJ.exe
  C:\Windows\System\pmjZboJ.exe
  2⤵
  PID:11284
- C:\Windows\System\chxRFaK.exe
  C:\Windows\System\chxRFaK.exe
  2⤵
  PID:11520
- C:\Windows\System\CqicEez.exe
  C:\Windows\System\CqicEez.exe
  2⤵
  PID:12968
- C:\Windows\System\PdTEeHw.exe
  C:\Windows\System\PdTEeHw.exe
  2⤵
  PID:15032
- C:\Windows\System\tNmZcvb.exe
  C:\Windows\System\tNmZcvb.exe
  2⤵
  PID:7504

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 5920 -ip 5920
1⤵
PID:10068

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 588 -p 5536 -ip 5536
1⤵
PID:11448

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 652 -p 12164 -ip 12164
1⤵
PID:13720

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 740 -p 12116 -ip 12116
1⤵
PID:13740

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 10272 -ip 10272
1⤵
PID:12592

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:15204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bo5d0kg1.4eq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AnJVBSJ.exe

Filesize
1.3MB

MD5
5a13a012b0d3e41a95c2c26733e5029f

SHA1
093176ca99d0a17f601e75f7fc78f2be85bc7f1e

SHA256
163cc9b745fb71d1d4bfd170242ead1d1ebc9d44f141df789cb718e7e153636b

SHA512
f500bd10b0e986cddaea632049e63a2cade7b77a03eba0df93ff08e4e7758cf140a14600a621ff1a7f6a2992fc18396dcd49ba54970425f90431d2267c402c9a

Download Submit
C:\Windows\System\BnRMwMO.exe

Filesize
1.3MB

MD5
981df0b9f4dfef22b09950c691fc24f5

SHA1
ff3662f4eb1f106a170b324f2ef9e9b0a8590683

SHA256
f0e163afd0fbc370f28d1ed519ab74a4f149736adf4cc254e7758b662f2753c5

SHA512
252396f001898d737a0ffaf567964747f5a7b91fe3332b57cb75b1f9c78ae8dee3f25c2b8abab3736dd85bceba91e1e78f6084c24a9afd9b153fcf6c1824bb47

Download Submit
C:\Windows\System\HCiEOUa.exe

Filesize
1.3MB

MD5
997cce3807d6505fb146e4868a9c6c19

SHA1
58c6fede34332e6f411fa54511c00e73e473c4bc

SHA256
32ad1eb1aae28ab9bc3583f84badd0086fc99605eae8e386aa6afccb6ab6be79

SHA512
2fd14a6960e418ec3ea8efb0c2baaa7449c774ac5e31d45bd509f7c9e83d32204b6fa401adb3f27ae6e5a4503acddc47c5c0da0714414c142e1e12c2319b630d

Download Submit
C:\Windows\System\HTSWYdH.exe

Filesize
1.3MB

MD5
980654a26ae4ecbefa7ae16cef16f78c

SHA1
5ca68e37292042dc6daa3b962f98d8c90171681f

SHA256
18e01de154f41664abdc988d8dba537bf4d0b0784bf29757d5685ce052bbbab3

SHA512
d532f732ff8fc22aea9edaf6f9bcb5313b8ffdf36a02174ca2f103a14205ac4ee126682318a59457f7332fdb8a3b9a8b0e8bb9cf6ed5abae7e6182defcb91cd4

Download Submit
C:\Windows\System\HoyIdLB.exe

Filesize
1.3MB

MD5
a3e2e557c6fa8683acf40e4faed22283

SHA1
9a3096f14c1c4ff01c21eeaef3b88f0641bd7b56

SHA256
6d48c7db63908a458197b73d2d5c9bca2c40668239c88454ce03cb0dc7dce27e

SHA512
2b717c72b6a33954f0df5b40120a4c1a186d2c47c5efda9fbb7c5689a4afdde77fc217bdab4fb113ec68ffa2587c2394455cc9b2c230e94eba6f3459d1985259

Download Submit
C:\Windows\System\INkWXoR.exe

Filesize
1.3MB

MD5
1150028a2b0bbd5a37b7f9b2d819c3a8

SHA1
06315218f5fa5e48b92bbe1bddc02e123be931a4

SHA256
749c47e3d43145589c43839e3fea0ac0690ff15a1a2473189b86f8ea7640eddb

SHA512
d877014cd1176af5328ee009ecbd042fbc9e47ab1a106e233f4092872029987beecb78cac78ce9427ebbf4424d98b0f97afebfa709452d26abd361454d169e8d

Download Submit
C:\Windows\System\IpaVfza.exe

Filesize
1.3MB

MD5
682046ed65603c2235024f8201a53939

SHA1
5243ac6221c2b527cab63321952fef0459b0f8da

SHA256
72b6c809324ffc8fee2ecb7c310879075255c756452944127e6c2ee7243f929f

SHA512
b355947b8b5193b58c02c7d5c9f3418fe81179b6e353896ec58d1cd809f2db51731c397f541c5bd9c081e46c0a98b6c3bf1fd426c58b04423e9be0596e14af97

Download Submit
C:\Windows\System\JKXXaEH.exe

Filesize
1.3MB

MD5
81fd9ad39a94f5c03ea127f5e7629f6d

SHA1
b9cd6de926f3b175ff49df9f5169ce345a063308

SHA256
d0f586b7c50980d3db2aed530e0ceb0e9f24426279e343b7a1787f0ab9b20144

SHA512
a14daa3600fbd783d738e753873d27415b44e79dc9c059fc4b1b13d3c81c69d71b82bfa13c9339c55f624220b72d4795b4dc1d3d8c2e5e112c2c431a481d8d32

Download Submit
C:\Windows\System\JqucizG.exe

Filesize
1.3MB

MD5
75b918fc6081a31ec42d14fc7cfed176

SHA1
55cedfedfb5359f88f771cfea7784fc4a1072e87

SHA256
e546413ca5e431f5b74e6751eaeec88fe578653ee38344ef75777ce3d59ccf12

SHA512
89f4936dfdc9be17302607cddc632fe7e918fe27483fe3ef594e201ff140c87c773305b3943e4081020eb4c1ce7b7c7eb3dfd989b117f5c3d984de3df628f44d

Download Submit
C:\Windows\System\JsFRIcB.exe

Filesize
1.3MB

MD5
93613729301994211a7d12ac755052a2

SHA1
615b9352e6daec36543a1232484eeba75cd32415

SHA256
bc16fb4f5b7758da03518e5df92018cbd5cd1f7b57f1e3572a7e02fc2eb58c3b

SHA512
bf186b4417ceddbf272550e67e0777ddc86bfbfbf006b7f198aaec8d4932c3aa21787448dad25bc8478483db11ff19aa86ccb3313a6a9cb422edc10f3dd495af

Download Submit
C:\Windows\System\KPiYHks.exe

Filesize
1.3MB

MD5
48d12643c540ec6d0137b03f1b28ea0f

SHA1
02e4c6a4a57ec57d20418cf5c40a0c6fbf6b1ea7

SHA256
bd65d38723806257071171ca5852460e22f71d489735e7f10f336aff5bffaca1

SHA512
2ba28e6d78a97540c6faacec470518ace8970382ab1648718926ecd5f511d4565b56cf6902af89dd78ff0d859966ce4017e1fa0dd94ee9a4331e91e91800afc3

Download Submit
C:\Windows\System\LUvReYv.exe

Filesize
1.3MB

MD5
b15f42cd2565a578d1912712ff95a0f6

SHA1
f5a9439f11264f193b463dbe25f3cc7f0a75df99

SHA256
8156ab059243fb5954e9e2e8283460d164bab6acd6014637d76a9dfc83c9a367

SHA512
6854a5bb0217c7124eaee8aca7b52a762abec5da4cf83d8937e4e5af9b24b282e07ed09918cdcfa346b860310e146572543e9436e75b88836379579d4ae5ce5a

Download Submit
C:\Windows\System\NreVUUK.exe

Filesize
1.3MB

MD5
0577c3230539de3c1078bd9ca1e092f8

SHA1
2ff6afeb7c294dffa18c2ddb9b7b813f171cc7b9

SHA256
9c0834985fe2a04218ede0dba03edb1cc0715f75f0e7a1fb9257e928d15c47c6

SHA512
83a1c416e171ae6fe76e7b99bb36f2608d8f5fbea34c0c8c382fa0682e64d9f6908ccb50abedace12adac8a41032393fc04e169f27c0eb2cc1656c6fec0031be

Download Submit
C:\Windows\System\STRzlpF.exe

Filesize
1.3MB

MD5
ed27c8504b38b791403ff2f982719468

SHA1
10111fc83ebd88fd9f83140e61d2786247079402

SHA256
66619ca91ce2f9c0b5bad8b0c79196544cdbea6200b0b57220b186097898aaf1

SHA512
97eed1ab9b986c0630134627e0004bc2dab7f5f9b1dab8e6c0d46b2295f5a8399966716a2c79f4aec41453de604dbe3e4811c1b49c0697d871684e38fc1c0728

Download Submit
C:\Windows\System\SjRdscC.exe

Filesize
1.3MB

MD5
fa21bc977f8abc7e9c3952276c972f12

SHA1
f6a05c9465a3885eb7496dd68de182077b545626

SHA256
a797514eae63a4533680e73e92f9db1098ee155e0362ca8d832462e7c2d3cd33

SHA512
083c9c08905e53654b72a097315c8f3b5b6b8faf04a071255941980ad0283d9155623f3a17a4d353e53d6a39c062d4ecc4f3a881e1698b868057fa16f17ba8cc

Download Submit
C:\Windows\System\TcBNeCb.exe

Filesize
1.3MB

MD5
55a3e7a7659e3e06ba5e56d500b67896

SHA1
3cb66a3a7b30b2ce754770b544bdc219f2fcc5ac

SHA256
f37b2462f60ef5ee60184138eecbc7facb00a85d1f450427e182564533e94509

SHA512
6743716134e95d0d337521b24675207946e8d0f35b24bac1da7432471203b9119f99d5db8aed54ce1ca742bdd927ec0d745e09afaadc5d40bb6f997b23083be2

Download Submit
C:\Windows\System\TpVBFPc.exe

Filesize
1.3MB

MD5
16b000194faf6c35c1639cbee0026509

SHA1
e97c1149ca4c213001d0bd8406c25ea303265987

SHA256
4a3c45bb77a465ed0c8261136090de8d6293be26ce5376bcea31fd52221a7d00

SHA512
cdae8e3a107b54a2129811492ca9a7c6373ffd70b96e20acd0580f4bbfad21f02b975d2d54c62634353eb1f8135cb6176a65a01f957e7b03d134aad42e094e1f

Download Submit
C:\Windows\System\UuGmsFY.exe

Filesize
1.3MB

MD5
3bee888ec6696853531900f767cdbc64

SHA1
758b8ff132041d6e3db5c2347364b685dd571b6a

SHA256
af224006d0f81d12ac9e341a38d4b24cd1762740da0f0d09381c6be090eae3e8

SHA512
73d9c971d833c6166645365fcfc6e9e9532629739513dd1a9957d388dcad7bad8e2192dfb9814f676822e077932ea7028736433fe84f0f35871c884b7f5256b4

Download Submit
C:\Windows\System\VMIhNcq.exe

Filesize
1.3MB

MD5
839a51813ab09891a2bbde60ab7ce178

SHA1
bcd6566c3a29aaf52026c2c6fd8c14c011316222

SHA256
fb3b41d781cfb0d53f51509ace1e9d278e09d10c5fc83fc16bc4c98e4569d585

SHA512
b7242e9089da13e6e4081baac258f85a5463f502bf64cff627ff59cf469f6c439d92cd91b360b401c28e3c3a45931b0e722c3479a9b2e86ca951d33cdd58103f

Download Submit
C:\Windows\System\XsyIgHR.exe

Filesize
1.3MB

MD5
5918f1fa2bd186246c0f6775d3e1c25a

SHA1
d2ad4fcd1520fc22073af98fa18f83380ae5f998

SHA256
2317978dd5700d384775149acce788db0d487dcba0bf460c7a3bd63a965d21d7

SHA512
a174748a8b47f237d3bb48a53479c7ab480e4c3a0dc3cc17929295bdc7f09de33835302f521cd913dece909a16c1cd130182e8fe1c5cb83f32e228b3e590585d

Download Submit
C:\Windows\System\ZUDAFHw.exe

Filesize
1.3MB

MD5
5efd6a47becf3cfcd43b6bf739166f27

SHA1
3ea74336a91ca63699b9e5043b824e4626b6ec5e

SHA256
2a7133ab5e63acb77f30ea07db2a1d07363cdfed2931718ddf04b9377f877e3a

SHA512
411f0dc4c99af219a67a2d9369cbda81011dab97a7fb3b0fb32fa41280896e6c6b02afccf46b334bcae6a0305ddea46e5da8ef90143ba45708183fe56cb2ee4c

Download Submit
C:\Windows\System\ZwilCeM.exe

Filesize
1.3MB

MD5
46cfded53b2170ffd956c93b41a9eddf

SHA1
889aeab1616d2e1a8ebde06ec955c11603f5336b

SHA256
2fca717cae25cca1d3081e486af918b83e5a0411c3f76e36a1feb9f9a07a5d7a

SHA512
1873010ac6dc0b719d3ab7794bda7f27b3d4f28bb12b0c287bb8bc2a0c369bdc51408c8e260fdcf0777903f14b81dcb7f1e637860a9ba63bfa761f17ceadabc0

Download Submit
C:\Windows\System\ajuhZpg.exe

Filesize
1.3MB

MD5
3dc405aeceb34f805041274076e0d829

SHA1
4095e53bd13ac3ac7bcc5b0d36c63a43e4a8c612

SHA256
869f4a14aed6e56d5f50eae188d00417f9612f1e9887fed1783434600d2d455e

SHA512
c80aea8ca5762bbe966aa0aadaea53368e28b1e7a83b8491c8613fa36444727f0633176dd5875ce7119c9cdec2be24f16c59f126d2d3cb8751c40aa7f9f0caa9

Download Submit
C:\Windows\System\bLGhTul.exe

Filesize
1.3MB

MD5
7e199fce9c70b0990fd620c9eb3e9fb8

SHA1
96f7dea266d9f4a997ca2dc8b5d042a4d619b377

SHA256
66a410aa7646c5e2dfd376ce958ec2ba7da555a92a165a1d4ef1e8ea994b5578

SHA512
90e56244c7f7f5bfe4675d2cf17bc68f12904c8629eabf033bf6a4b45cf442fccfc70171ff829122a50ab638640112b9fb974b6bcd52476f74816931a7cbc24e

Download Submit
C:\Windows\System\bcgzVnN.exe

Filesize
1.3MB

MD5
cd4b22ab9dd6899f440eb2a9aee904e0

SHA1
d45e4c794a0d11a1bb3d60724add16649509b9b7

SHA256
ed802a9be898c097faa4bcf1d24288aace1d0453393c296e461ffea1f3c03ff5

SHA512
84316e2ead3c44571517cb8dfc50870773fd21a894f1775ca800bd5e0bc3ebb4a591bcf778b64db9b86ceaf2a9da52eb63c832ce4ffae799c9e9772399a58bb2

Download Submit
C:\Windows\System\dYrwlNQ.exe

Filesize
1.3MB

MD5
5e9b78f97bb9fce7ac5eb46165f559f1

SHA1
00e0b20a533bc37641e00c12f83eeaec0a0639b3

SHA256
c0230a28e70d2de4360650277f8ed14e534f69c295ba5147a38abfc9ef43442a

SHA512
ab1faec0fee336ae54b6ef37c7877e21546ae14612baed50f34e674d4ed044142da6fa38e1942ba8553c71afc7b1f083a8e9ec2935b7a6cea2f7c52ba930ea15

Download Submit
C:\Windows\System\jHDONvG.exe

Filesize
1.3MB

MD5
14ea4a650f1727caf21a9fa3247603f9

SHA1
71cb952cbac1ac5804ebfb06b23fb00f9f15d42d

SHA256
c9b35225e1de4fb3853eec8baec1a1c50a185ca5762d74afa9c2b97467c8b10f

SHA512
5956d94e1c650c039925d22efaabfc4474afc9dd044b686a8d28bdd4a69d47ecba4ab703fe201bedcdfa716f187c56e97004f3100b67b92fab90ed8b86c257de

Download Submit
C:\Windows\System\jZgbqCj.exe

Filesize
1.3MB

MD5
84edee91b53c6bab821a0246e868e1c1

SHA1
0c032c11188f980a5fd690224f981ebde4bcb60f

SHA256
45f658e47666d85dec478525dae9a0315d835e8e26b2812193d5fb661f29c747

SHA512
43951cb5377836b9aa8b8e29c4951b9a48551df27874d6cf20ca64d1dac88f722f484c27b2e7cc173c02e7027c9d9edcf341e0d32f6246eeceb0fc47b71dc69f

Download Submit
C:\Windows\System\kWioQvK.exe

Filesize
8B

MD5
9cb4bf9fd9671df0839f651b7291ada1

SHA1
65a07e22b4bb88cf278eb1826c308150ded29593

SHA256
7188099eb9c8547d41ed9f4696ce901a0066852814ae83835a5ed6cbffc1cf40

SHA512
6f35a15b3248c656029fbcfa880774f447f590d87875077936e1e0e583b3b4b43f507832937ba7994137923090cc3abaa893880b066cf5189f7fd87f77593929

Download Submit
C:\Windows\System\ktAkTRS.exe

Filesize
1.3MB

MD5
0ba6db091240f94e31853dee81ce719a

SHA1
0601bd4856b923375ac6e5bd5d44d582223423bd

SHA256
4c1cfa93b29cfc6c1987c2980c1d8ad7e34ccc235c54031ccca2343f5789fdca

SHA512
431f9f9d9995846d620ea6a11ab302e78785c37681212f6e2f4f770ef5c394a8e83ecb5cc68ec7ea5c88fae5c00b541851b85d18a84a759dcd03f5481fde2fbf

Download Submit
C:\Windows\System\lRonKcA.exe

Filesize
1.3MB

MD5
88ae733dd3e15d61ae802f8e3ef634f0

SHA1
2ae1cc4a2f9d02d9f8b894bf6834161a4036c427

SHA256
bb8852b5efca267b0e089a3856e1ac5d5cf8dd00e45e25588a9062123f6e9f0e

SHA512
0ea9e79820a535734dbe7550ccab9d4b8adb9974df92c38f7ec481a6e7f838a4b210442653117c2f433b7bc528593cf31f968cb19244156197af78f5b836dfcc

Download Submit
C:\Windows\System\pVBztRE.exe

Filesize
1.3MB

MD5
93a3f4ede731b72c6a105e1c1c319fed

SHA1
2372f82295abd2e9f14c8ea639cb9beb958b7f41

SHA256
d44813b5f4d7b7b59c34dc71502c4c6ff104ac6a3996b4ed1460ce4675f6eb52

SHA512
0dab059aee1085aef7825134414bb2f314574e54e2dee84bf230a312bf33ad87250673cdf9a9cd787350900b7737c29ee22a67be5a655422e979d91be4a5733c

Download Submit
C:\Windows\System\tXlRbJn.exe

Filesize
1.3MB

MD5
7d233b3e7bad13540dd8602462a65acc

SHA1
f7c9ac72e5f6871cb090156bf82c8b0734c03c67

SHA256
82154e6553dbb5bbe58aa15003eee6804ad2f6128f3689129d9879697908116f

SHA512
98f9a5ec7a5db88eff707e5b7031217c6481ef3acf3e1d337bf8a9b5e7dba208692381ed9dabd7d8e2d0b64174c5900fbcf38ddf6664b6d64892a2500cb9156a

Download Submit
C:\Windows\System\wLeehzM.exe

Filesize
1.3MB

MD5
dcedb524d79fc0024293b0daf82fc14e

SHA1
c2452f91ca05dd3404aab568edd29d96c38f8abd

SHA256
a6a768fa92aa3155635e8c27bdfe4702dd526bd933c6f6d2c1d8379d546a688d

SHA512
9db183e8c42a2add0ca00030725302bebfaceb091f02d483035fb5a2729864a4cc8d09f45940c9574c1e8486ef32837de4e5a347853ea4a03a3a18b5790f18c6

Download Submit
C:\Windows\System\wXwzbxf.exe

Filesize
1.3MB

MD5
482bfd5441773a4932174834aaebcbca

SHA1
498d989c4b0e8944dc53479c9951b4ea3ce61e3d

SHA256
203d9a39e563a349fe280a54d458684294513d121009b49c991359d3e1c1124d

SHA512
9d2b03b55ebdc10cb1896a0fd9fc6caf28cf086022fa2f2e55aa0a27d9c507af9badc992c388fb5a19857055b6a49be952a81566be5159b06c2811ea34dbd78d

Download Submit
C:\Windows\System\wzXSxNQ.exe

Filesize
1.3MB

MD5
e504b116b23a2ff1d0fdb9c745bb5017

SHA1
3b180641a571f0012032d16bb5a7a5c19ea40fb2

SHA256
9fd030c6bfbc6453d337c390b8fee0b6556c1e0c5416562ad26dfd4c2a9b7a67

SHA512
7cc7a6687c2462f7f212d096079a898d75d4439cb302c4227dcc30855feb155295ff9e08530d92ebd07b9c04d92ab1e7782714a9e7f89c662eaa18ad7aa92ad7

Download Submit
C:\Windows\System\xSCDMeA.exe

Filesize
1.3MB

MD5
25419bab5333eea2820ae7201ec441fe

SHA1
eccb005e091ab30b4a62618e6c886e276b16a635

SHA256
0bc13f3ba00ac264597d85a2613c9b2250af671a076e565859cc8c89ccd6d3bd

SHA512
880fdff0c1b0164a26f996037b1d2400a98c0261ba6ab429c89704a5aaef20b70be3910174c50dfdd8d4463df65ae682ab34197163c3bde6b3216b2c8b96c0f7

Download Submit
C:\Windows\System\xazwhlS.exe

Filesize
1.3MB

MD5
fdc51393fa2b1b6559104459d922faef

SHA1
f2988a2251dd0da6e060d14b66c86adf9fe67aeb

SHA256
400d60b409971b977e18919673a4a91e677b1886f34ceb84f8317b81e5d216ca

SHA512
90ad45fb29b3b721197fa5a50ea7eb9e767d16886772ecc0c9836a683aa407efceb92baaeb61ae3c8c1ca2f0a8bdf385ab5776c8c924bd23086e3700d59f3bcb

Download Submit
C:\Windows\System\zMTDBsP.exe

Filesize
1.3MB

MD5
d5670c5592aecc108f2a0f1b63f961a5

SHA1
7a16ef14b4cc4c24140cfb3c8faf510b57a38dbd

SHA256
d55f6c8d693c0b721ff0a9c2b812c1b5e57527d7cc714be3b6842f1899c53b44

SHA512
e5304da2ed21654e2a9d2dee7c24b7a6a6bccea660678cdb9119d31e16be9baf92ab73106831613c01355823070580ce9efa1adce23be1c92f0d4fdf0343101c

Download Submit
C:\Windows\System\zNkNrAD.exe

Filesize
1.3MB

MD5
389b9a7f876beb41bb8b2d3d11944165

SHA1
4116c66012786443946920cc98e875a9600b5aa2

SHA256
361b8211f7568f92bc8bdf3ae4af66c69ba72ebeb8a891f0501fd4e946015ab8

SHA512
2aa41b114558853200f271cfe8658a5d09ec4a8c256c6c977afa56d58354fd7f3b88578eb95009509ba6af6a666bcc9fc51fbe4e027fc19896521bab5128b27e

Download Submit
memory/404-631-0x00007FF78DAD0000-0x00007FF78DEC2000-memory.dmp

Filesize
3.9MB

Download
memory/404-4390-0x00007FF78DAD0000-0x00007FF78DEC2000-memory.dmp

Filesize
3.9MB

Download
memory/880-636-0x00007FF7A6560000-0x00007FF7A6952000-memory.dmp

Filesize
3.9MB

Download
memory/1260-405-0x00007FF77D660000-0x00007FF77DA52000-memory.dmp

Filesize
3.9MB

Download
memory/1260-4398-0x00007FF77D660000-0x00007FF77DA52000-memory.dmp

Filesize
3.9MB

Download
memory/1508-176-0x00007FF635E50000-0x00007FF636242000-memory.dmp

Filesize
3.9MB

Download
memory/1656-312-0x00007FF7CC940000-0x00007FF7CCD32000-memory.dmp

Filesize
3.9MB

Download
memory/1684-635-0x00007FF701950000-0x00007FF701D42000-memory.dmp

Filesize
3.9MB

Download
memory/2044-629-0x00007FF64E000000-0x00007FF64E3F2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-548-0x00007FF694A80000-0x00007FF694E72000-memory.dmp

Filesize
3.9MB

Download
memory/2220-4454-0x00007FF694A80000-0x00007FF694E72000-memory.dmp

Filesize
3.9MB

Download
memory/2472-4380-0x00007FF635080000-0x00007FF635472000-memory.dmp

Filesize
3.9MB

Download
memory/2472-632-0x00007FF635080000-0x00007FF635472000-memory.dmp

Filesize
3.9MB

Download
memory/2556-0-0x00007FF6068B0000-0x00007FF606CA2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-2760-0x00007FF6068B0000-0x00007FF606CA2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-1-0x000002AF61300000-0x000002AF61310000-memory.dmp

Filesize
64KB

Download
memory/2672-4554-0x00007FF688590000-0x00007FF688982000-memory.dmp

Filesize
3.9MB

Download
memory/2672-638-0x00007FF688590000-0x00007FF688982000-memory.dmp

Filesize
3.9MB

Download
memory/2688-275-0x00007FF788E60000-0x00007FF789252000-memory.dmp

Filesize
3.9MB

Download
memory/3372-639-0x00007FF69BC00000-0x00007FF69BFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3372-4539-0x00007FF69BC00000-0x00007FF69BFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3424-311-0x00007FF724010000-0x00007FF724402000-memory.dmp

Filesize
3.9MB

Download
memory/3444-637-0x00007FF6D8E20000-0x00007FF6D9212000-memory.dmp

Filesize
3.9MB

Download
memory/3444-4445-0x00007FF6D8E20000-0x00007FF6D9212000-memory.dmp

Filesize
3.9MB

Download
memory/3492-549-0x00007FF76F130000-0x00007FF76F522000-memory.dmp

Filesize
3.9MB

Download
memory/3492-4551-0x00007FF76F130000-0x00007FF76F522000-memory.dmp

Filesize
3.9MB

Download
memory/3652-2763-0x00007FF70F5C0000-0x00007FF70F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/3652-16-0x00007FF70F5C0000-0x00007FF70F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/3800-634-0x00007FF687850000-0x00007FF687C42000-memory.dmp

Filesize
3.9MB

Download
memory/3916-212-0x0000016770DB0000-0x0000016770DD2000-memory.dmp

Filesize
136KB

Download
memory/3916-640-0x00007FFE236D0000-0x00007FFE24191000-memory.dmp

Filesize
10.8MB

Download
memory/3916-2609-0x00007FFE236D0000-0x00007FFE24191000-memory.dmp

Filesize
10.8MB

Download
memory/3916-8-0x00007FFE236D3000-0x00007FFE236D5000-memory.dmp

Filesize
8KB

Download
memory/3916-138-0x00007FFE236D0000-0x00007FFE24191000-memory.dmp

Filesize
10.8MB

Download
memory/4516-633-0x00007FF640890000-0x00007FF640C82000-memory.dmp

Filesize
3.9MB

Download
memory/4720-4386-0x00007FF6E8770000-0x00007FF6E8B62000-memory.dmp

Filesize
3.9MB

Download
memory/4720-274-0x00007FF6E8770000-0x00007FF6E8B62000-memory.dmp

Filesize
3.9MB

Download
memory/4808-4408-0x00007FF7C0F90000-0x00007FF7C1382000-memory.dmp

Filesize
3.9MB

Download
memory/4808-475-0x00007FF7C0F90000-0x00007FF7C1382000-memory.dmp

Filesize
3.9MB

Download
memory/4828-641-0x00007FF7B2780000-0x00007FF7B2B72000-memory.dmp

Filesize
3.9MB

Download
memory/4896-142-0x00007FF7F1230000-0x00007FF7F1622000-memory.dmp

Filesize
3.9MB

Download
memory/4916-630-0x00007FF6275A0000-0x00007FF627992000-memory.dmp

Filesize
3.9MB

Download
memory/4992-248-0x00007FF6A1970000-0x00007FF6A1D62000-memory.dmp

Filesize
3.9MB

Download