xmrig | 48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14a

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
Size

1.2MB
MD5

bc498adb8460122f86a829c9b3c87860
SHA1

3bac526cc85f46054c3182b378ccec7cd8b5339f
SHA256

48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14a
SHA512

c3283790f49e1b8251cae6e91a4b62465a6196d60fb8a9c97b1afd0ffb5cd343e15d42a8a2f889c59eef8c10725ebc27c332acd987113150dce4dc88a9f3c896
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlQV8z0q:Lz071uv4BPMkibTIA5/D

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/4944-176-0x00007FF71BE30000-0x00007FF71C222000-memory.dmp	xmrig
behavioral2/memory/1188-175-0x00007FF6793E0000-0x00007FF6797D2000-memory.dmp	xmrig
behavioral2/memory/5080-169-0x00007FF67D210000-0x00007FF67D602000-memory.dmp	xmrig
behavioral2/memory/1140-163-0x00007FF624210000-0x00007FF624602000-memory.dmp	xmrig
behavioral2/memory/3148-157-0x00007FF7E2590000-0x00007FF7E2982000-memory.dmp	xmrig
behavioral2/memory/4988-156-0x00007FF7EA2E0000-0x00007FF7EA6D2000-memory.dmp	xmrig
behavioral2/memory/3968-150-0x00007FF698CC0000-0x00007FF6990B2000-memory.dmp	xmrig
behavioral2/memory/3720-142-0x00007FF794A40000-0x00007FF794E32000-memory.dmp	xmrig
behavioral2/memory/2584-140-0x00007FF715FC0000-0x00007FF7163B2000-memory.dmp	xmrig
behavioral2/memory/1812-134-0x00007FF7AB9E0000-0x00007FF7ABDD2000-memory.dmp	xmrig
behavioral2/memory/4740-121-0x00007FF6EF630000-0x00007FF6EFA22000-memory.dmp	xmrig
behavioral2/memory/1604-115-0x00007FF62D570000-0x00007FF62D962000-memory.dmp	xmrig
behavioral2/memory/692-114-0x00007FF6728F0000-0x00007FF672CE2000-memory.dmp	xmrig
behavioral2/memory/4388-109-0x00007FF75D1E0000-0x00007FF75D5D2000-memory.dmp	xmrig
behavioral2/memory/4472-104-0x00007FF65B780000-0x00007FF65BB72000-memory.dmp	xmrig
behavioral2/memory/4108-103-0x00007FF678300000-0x00007FF6786F2000-memory.dmp	xmrig
behavioral2/memory/1512-97-0x00007FF78F4F0000-0x00007FF78F8E2000-memory.dmp	xmrig
behavioral2/memory/5052-96-0x00007FF7599C0000-0x00007FF759DB2000-memory.dmp	xmrig
behavioral2/memory/2380-75-0x00007FF780F70000-0x00007FF781362000-memory.dmp	xmrig
behavioral2/memory/3048-1035-0x00007FF6E51C0000-0x00007FF6E55B2000-memory.dmp	xmrig
behavioral2/memory/1124-1031-0x00007FF7BCC80000-0x00007FF7BD072000-memory.dmp	xmrig
behavioral2/memory/1732-1151-0x00007FF661590000-0x00007FF661982000-memory.dmp	xmrig
behavioral2/memory/2164-1153-0x00007FF6291F0000-0x00007FF6295E2000-memory.dmp	xmrig
behavioral2/memory/2364-1163-0x00007FF6D3AD0000-0x00007FF6D3EC2000-memory.dmp	xmrig
behavioral2/memory/2624-1171-0x00007FF7AA200000-0x00007FF7AA5F2000-memory.dmp	xmrig
behavioral2/memory/2364-4171-0x00007FF6D3AD0000-0x00007FF6D3EC2000-memory.dmp	xmrig
behavioral2/memory/3720-4190-0x00007FF794A40000-0x00007FF794E32000-memory.dmp	xmrig
behavioral2/memory/4388-4195-0x00007FF75D1E0000-0x00007FF75D5D2000-memory.dmp	xmrig
behavioral2/memory/3968-4233-0x00007FF698CC0000-0x00007FF6990B2000-memory.dmp	xmrig
behavioral2/memory/1140-4254-0x00007FF624210000-0x00007FF624602000-memory.dmp	xmrig
behavioral2/memory/3148-4241-0x00007FF7E2590000-0x00007FF7E2982000-memory.dmp	xmrig
behavioral2/memory/4988-4236-0x00007FF7EA2E0000-0x00007FF7EA6D2000-memory.dmp	xmrig
behavioral2/memory/4740-4225-0x00007FF6EF630000-0x00007FF6EFA22000-memory.dmp	xmrig
behavioral2/memory/4944-4260-0x00007FF71BE30000-0x00007FF71C222000-memory.dmp	xmrig
behavioral2/memory/5080-4271-0x00007FF67D210000-0x00007FF67D602000-memory.dmp	xmrig
behavioral2/memory/1188-4263-0x00007FF6793E0000-0x00007FF6797D2000-memory.dmp	xmrig
behavioral2/memory/1604-4194-0x00007FF62D570000-0x00007FF62D962000-memory.dmp	xmrig
behavioral2/memory/2624-4736-0x00007FF7AA200000-0x00007FF7AA5F2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	2836	powershell.exe
9	2836	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2836	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3048	uNlnpjn.exe
1732	VNKiJrn.exe
1812	ogDcaaB.exe
2164	zpYyyhR.exe
2364	PtXJGiY.exe
2584	QkvXFFP.exe
2380	KZJWoKt.exe
5052	EBmVqKi.exe
1512	xHOkVBO.exe
4108	wgTFAmR.exe
4472	fBxaxox.exe
3720	dxzzMsU.exe
4388	cknHspV.exe
692	AQSoFcG.exe
1604	POoGVwC.exe
4740	kEdnLQy.exe
2624	XMLoYtj.exe
3968	LXsgADE.exe
4988	kPLchcu.exe
3148	LjqHlIy.exe
1140	ZNZjMLr.exe
5080	QOjuOaA.exe
1188	zEPSnIo.exe
4944	KRthlIs.exe
2936	CIMBJlJ.exe
4580	HuGLIXa.exe
3856	rahxRpZ.exe
3656	gdbvMcZ.exe
1728	XSmoidm.exe
3220	GUtMlgV.exe
1908	NYwbdum.exe
740	sUTwXVQ.exe
4232	Gajwcpk.exe
632	PRiAHcY.exe
4752	KNmEjYB.exe
1396	pwnYfpj.exe
3008	rdCYWKa.exe
2548	inXZvdE.exe
4616	yPUhqtx.exe
4972	DkBUSkn.exe
1172	WOIHwpE.exe
2752	zoTOftg.exe
1440	OJZhToS.exe
1300	cjxPDYO.exe
4492	AkZeupI.exe
2036	DRiXkoE.exe
1344	uHteiPh.exe
4264	mDMbfSm.exe
4392	ZvoSpWB.exe
4724	zxfLlft.exe
2896	cnZdZcb.exe
2724	QWZtVdi.exe
3012	hWlCYbD.exe
4512	pnKDiKy.exe
4520	RWNhnNG.exe
3576	PAYaCba.exe
2960	xovPghO.exe
2124	nmRnCAl.exe
2104	aKobqfq.exe
2404	EBnmbUa.exe
3416	kGMecun.exe
2524	cpAfJRv.exe
4164	qaRlfUO.exe
4856	HRKYuPd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1124-0-0x00007FF7BCC80000-0x00007FF7BD072000-memory.dmp	upx
behavioral2/files/0x000b000000023b5f-20.dat	upx
behavioral2/memory/2164-37-0x00007FF6291F0000-0x00007FF6295E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b64-46.dat	upx
behavioral2/files/0x000a000000023b69-50.dat	upx
behavioral2/files/0x000a000000023b6f-70.dat	upx
behavioral2/files/0x000a000000023b71-80.dat	upx
behavioral2/files/0x000a000000023b72-93.dat	upx
behavioral2/files/0x000a000000023b73-100.dat	upx
behavioral2/files/0x000a000000023b75-132.dat	upx
behavioral2/files/0x000a000000023b79-143.dat	upx
behavioral2/files/0x000a000000023b7b-177.dat	upx
behavioral2/files/0x000b000000023b77-197.dat	upx
behavioral2/files/0x000a000000023b80-199.dat	upx
behavioral2/files/0x000a000000023b7f-194.dat	upx
behavioral2/files/0x000a000000023b7e-192.dat	upx
behavioral2/files/0x000a000000023b7d-187.dat	upx
behavioral2/files/0x000a000000023b7c-182.dat	upx
behavioral2/memory/4944-176-0x00007FF71BE30000-0x00007FF71C222000-memory.dmp	upx
behavioral2/memory/1188-175-0x00007FF6793E0000-0x00007FF6797D2000-memory.dmp	upx
behavioral2/files/0x000b000000023b78-170.dat	upx
behavioral2/memory/5080-169-0x00007FF67D210000-0x00007FF67D602000-memory.dmp	upx
behavioral2/files/0x000a000000023b7a-164.dat	upx
behavioral2/memory/1140-163-0x00007FF624210000-0x00007FF624602000-memory.dmp	upx
behavioral2/memory/3148-157-0x00007FF7E2590000-0x00007FF7E2982000-memory.dmp	upx
behavioral2/memory/4988-156-0x00007FF7EA2E0000-0x00007FF7EA6D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b76-151.dat	upx
behavioral2/memory/3968-150-0x00007FF698CC0000-0x00007FF6990B2000-memory.dmp	upx
behavioral2/memory/3720-142-0x00007FF794A40000-0x00007FF794E32000-memory.dmp	upx
behavioral2/memory/2584-140-0x00007FF715FC0000-0x00007FF7163B2000-memory.dmp	upx
behavioral2/files/0x000b000000023b60-138.dat	upx
behavioral2/memory/1812-134-0x00007FF7AB9E0000-0x00007FF7ABDD2000-memory.dmp	upx
behavioral2/memory/2624-129-0x00007FF7AA200000-0x00007FF7AA5F2000-memory.dmp	upx
behavioral2/memory/4740-121-0x00007FF6EF630000-0x00007FF6EFA22000-memory.dmp	upx
behavioral2/files/0x000a000000023b74-116.dat	upx
behavioral2/memory/1604-115-0x00007FF62D570000-0x00007FF62D962000-memory.dmp	upx
behavioral2/memory/692-114-0x00007FF6728F0000-0x00007FF672CE2000-memory.dmp	upx
behavioral2/memory/4388-109-0x00007FF75D1E0000-0x00007FF75D5D2000-memory.dmp	upx
behavioral2/memory/4472-104-0x00007FF65B780000-0x00007FF65BB72000-memory.dmp	upx
behavioral2/memory/4108-103-0x00007FF678300000-0x00007FF6786F2000-memory.dmp	upx
behavioral2/files/0x000a000000023b70-98.dat	upx
behavioral2/memory/1512-97-0x00007FF78F4F0000-0x00007FF78F8E2000-memory.dmp	upx
behavioral2/memory/5052-96-0x00007FF7599C0000-0x00007FF759DB2000-memory.dmp	upx
behavioral2/memory/2380-75-0x00007FF780F70000-0x00007FF781362000-memory.dmp	upx
behavioral2/files/0x000a000000023b6e-87.dat	upx
behavioral2/files/0x000a000000023b6d-85.dat	upx
behavioral2/files/0x000a000000023b6c-83.dat	upx
behavioral2/files/0x000a000000023b6b-77.dat	upx
behavioral2/files/0x000a000000023b6a-64.dat	upx
behavioral2/files/0x000a000000023b65-60.dat	upx
behavioral2/memory/2364-57-0x00007FF6D3AD0000-0x00007FF6D3EC2000-memory.dmp	upx
behavioral2/files/0x000a000000023b68-42.dat	upx
behavioral2/files/0x000a000000023b63-39.dat	upx
behavioral2/files/0x000a000000023b67-36.dat	upx
behavioral2/files/0x000a000000023b66-29.dat	upx
behavioral2/memory/1732-25-0x00007FF661590000-0x00007FF661982000-memory.dmp	upx
behavioral2/files/0x000c000000023b0f-16.dat	upx
behavioral2/memory/3048-13-0x00007FF6E51C0000-0x00007FF6E55B2000-memory.dmp	upx
behavioral2/memory/3048-1035-0x00007FF6E51C0000-0x00007FF6E55B2000-memory.dmp	upx
behavioral2/memory/1124-1031-0x00007FF7BCC80000-0x00007FF7BD072000-memory.dmp	upx
behavioral2/memory/1732-1151-0x00007FF661590000-0x00007FF661982000-memory.dmp	upx
behavioral2/memory/2164-1153-0x00007FF6291F0000-0x00007FF6295E2000-memory.dmp	upx
behavioral2/memory/2364-1163-0x00007FF6D3AD0000-0x00007FF6D3EC2000-memory.dmp	upx
behavioral2/memory/2624-1171-0x00007FF7AA200000-0x00007FF7AA5F2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kzmZoGv.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\bZhqlNH.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\gTKksDG.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\bfPgHjz.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\EXOhlyT.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\ZZHKgvp.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\WusHFGt.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\zwdkBjN.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\vWWmgGA.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\fXbUJcG.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\oyoOVHp.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\pjWSAmG.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\ISLvjhW.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\zoTOftg.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\jZMJOnh.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\MIOzayh.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\zsuGcdp.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\oGzhYMj.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\BnWIyCh.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\KaTiVOZ.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\mDfnSTc.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\uvLVvRq.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\xgUEBsw.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\VQIwkIi.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\vByhfnG.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\ZtKnIku.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\myNEbmb.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\TyelzhY.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\GqfHDKn.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\uVjrWsp.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\GHSdrQQ.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\psBEWZm.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\ATZpKTg.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\Tobrjqw.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\qCRMJmp.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\ucLNsPX.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\ImoMqWZ.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\vEULMOO.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\LreGRgg.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\MWviLvh.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\mOyzWgM.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\IidBucC.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\JYRMuwB.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\NVatddN.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\YkStGhm.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\TQmdfhW.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\cptLXQq.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\kLcuWCO.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\rTNVlVO.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\WHNYiNx.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\zRKlKiZ.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\vSaYqYS.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\ElXlNZO.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\snNNDKy.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\LuEgZAS.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\XcVtPnU.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\pxbAmvZ.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\WFoEDlF.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\nuZDhuX.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\lrLNcYJ.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\IJkaDeU.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\hWEoJbK.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\jjcRWxD.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
File created	C:\Windows\System\dxzzMsU.exe	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2836	powershell.exe
2836	powershell.exe
2836	powershell.exe
2836	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeLockMemoryPrivilege	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
Token: SeLockMemoryPrivilege	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 2836	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	84
PID 1124 wrote to memory of 2836	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	84
PID 1124 wrote to memory of 3048	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	85
PID 1124 wrote to memory of 3048	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	85
PID 1124 wrote to memory of 1812	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	86
PID 1124 wrote to memory of 1812	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	86
PID 1124 wrote to memory of 1732	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	87
PID 1124 wrote to memory of 1732	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	87
PID 1124 wrote to memory of 2164	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	88
PID 1124 wrote to memory of 2164	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	88
PID 1124 wrote to memory of 2364	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	89
PID 1124 wrote to memory of 2364	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	89
PID 1124 wrote to memory of 2584	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	90
PID 1124 wrote to memory of 2584	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	90
PID 1124 wrote to memory of 2380	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	91
PID 1124 wrote to memory of 2380	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	91
PID 1124 wrote to memory of 5052	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	92
PID 1124 wrote to memory of 5052	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	92
PID 1124 wrote to memory of 1512	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	93
PID 1124 wrote to memory of 1512	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	93
PID 1124 wrote to memory of 4108	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	94
PID 1124 wrote to memory of 4108	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	94
PID 1124 wrote to memory of 4472	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	95
PID 1124 wrote to memory of 4472	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	95
PID 1124 wrote to memory of 3720	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	96
PID 1124 wrote to memory of 3720	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	96
PID 1124 wrote to memory of 4388	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	97
PID 1124 wrote to memory of 4388	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	97
PID 1124 wrote to memory of 692	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	98
PID 1124 wrote to memory of 692	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	98
PID 1124 wrote to memory of 1604	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	99
PID 1124 wrote to memory of 1604	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	99
PID 1124 wrote to memory of 4740	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	100
PID 1124 wrote to memory of 4740	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	100
PID 1124 wrote to memory of 2624	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	101
PID 1124 wrote to memory of 2624	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	101
PID 1124 wrote to memory of 3968	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	102
PID 1124 wrote to memory of 3968	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	102
PID 1124 wrote to memory of 4988	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	103
PID 1124 wrote to memory of 4988	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	103
PID 1124 wrote to memory of 3148	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	104
PID 1124 wrote to memory of 3148	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	104
PID 1124 wrote to memory of 1140	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	105
PID 1124 wrote to memory of 1140	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	105
PID 1124 wrote to memory of 5080	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	106
PID 1124 wrote to memory of 5080	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	106
PID 1124 wrote to memory of 1188	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	107
PID 1124 wrote to memory of 1188	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	107
PID 1124 wrote to memory of 4944	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	108
PID 1124 wrote to memory of 4944	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	108
PID 1124 wrote to memory of 2936	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	109
PID 1124 wrote to memory of 2936	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	109
PID 1124 wrote to memory of 4580	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	110
PID 1124 wrote to memory of 4580	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	110
PID 1124 wrote to memory of 3856	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	111
PID 1124 wrote to memory of 3856	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	111
PID 1124 wrote to memory of 3656	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	112
PID 1124 wrote to memory of 3656	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	112
PID 1124 wrote to memory of 1728	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	113
PID 1124 wrote to memory of 1728	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	113
PID 1124 wrote to memory of 3220	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	114
PID 1124 wrote to memory of 3220	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	114
PID 1124 wrote to memory of 1908	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	115
PID 1124 wrote to memory of 1908	1124	48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe	115

C:\Users\Admin\AppData\Local\Temp\48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe
"C:\Users\Admin\AppData\Local\Temp\48945c190fe26566f6b2a47d288de7552ce7254eb68f0838a6375e8d9242d14aN.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2836" "2952" "2868" "2956" "0" "0" "2960" "0" "0" "0" "0" "0"
    3⤵
    PID:13572
- C:\Windows\System\uNlnpjn.exe
  C:\Windows\System\uNlnpjn.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\ogDcaaB.exe
  C:\Windows\System\ogDcaaB.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\VNKiJrn.exe
  C:\Windows\System\VNKiJrn.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\zpYyyhR.exe
  C:\Windows\System\zpYyyhR.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\PtXJGiY.exe
  C:\Windows\System\PtXJGiY.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\QkvXFFP.exe
  C:\Windows\System\QkvXFFP.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\KZJWoKt.exe
  C:\Windows\System\KZJWoKt.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\EBmVqKi.exe
  C:\Windows\System\EBmVqKi.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\xHOkVBO.exe
  C:\Windows\System\xHOkVBO.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\wgTFAmR.exe
  C:\Windows\System\wgTFAmR.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\fBxaxox.exe
  C:\Windows\System\fBxaxox.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\dxzzMsU.exe
  C:\Windows\System\dxzzMsU.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\cknHspV.exe
  C:\Windows\System\cknHspV.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\AQSoFcG.exe
  C:\Windows\System\AQSoFcG.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\POoGVwC.exe
  C:\Windows\System\POoGVwC.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\kEdnLQy.exe
  C:\Windows\System\kEdnLQy.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\XMLoYtj.exe
  C:\Windows\System\XMLoYtj.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\LXsgADE.exe
  C:\Windows\System\LXsgADE.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\kPLchcu.exe
  C:\Windows\System\kPLchcu.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\LjqHlIy.exe
  C:\Windows\System\LjqHlIy.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\ZNZjMLr.exe
  C:\Windows\System\ZNZjMLr.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\QOjuOaA.exe
  C:\Windows\System\QOjuOaA.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\zEPSnIo.exe
  C:\Windows\System\zEPSnIo.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\KRthlIs.exe
  C:\Windows\System\KRthlIs.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\CIMBJlJ.exe
  C:\Windows\System\CIMBJlJ.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\HuGLIXa.exe
  C:\Windows\System\HuGLIXa.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\rahxRpZ.exe
  C:\Windows\System\rahxRpZ.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\gdbvMcZ.exe
  C:\Windows\System\gdbvMcZ.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\XSmoidm.exe
  C:\Windows\System\XSmoidm.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\GUtMlgV.exe
  C:\Windows\System\GUtMlgV.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\NYwbdum.exe
  C:\Windows\System\NYwbdum.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\sUTwXVQ.exe
  C:\Windows\System\sUTwXVQ.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\Gajwcpk.exe
  C:\Windows\System\Gajwcpk.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\PRiAHcY.exe
  C:\Windows\System\PRiAHcY.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\KNmEjYB.exe
  C:\Windows\System\KNmEjYB.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\pwnYfpj.exe
  C:\Windows\System\pwnYfpj.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\rdCYWKa.exe
  C:\Windows\System\rdCYWKa.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\inXZvdE.exe
  C:\Windows\System\inXZvdE.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\yPUhqtx.exe
  C:\Windows\System\yPUhqtx.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\DkBUSkn.exe
  C:\Windows\System\DkBUSkn.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\WOIHwpE.exe
  C:\Windows\System\WOIHwpE.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\zoTOftg.exe
  C:\Windows\System\zoTOftg.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\OJZhToS.exe
  C:\Windows\System\OJZhToS.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\cjxPDYO.exe
  C:\Windows\System\cjxPDYO.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\AkZeupI.exe
  C:\Windows\System\AkZeupI.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\DRiXkoE.exe
  C:\Windows\System\DRiXkoE.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\uHteiPh.exe
  C:\Windows\System\uHteiPh.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\mDMbfSm.exe
  C:\Windows\System\mDMbfSm.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\ZvoSpWB.exe
  C:\Windows\System\ZvoSpWB.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\zxfLlft.exe
  C:\Windows\System\zxfLlft.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\cnZdZcb.exe
  C:\Windows\System\cnZdZcb.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\QWZtVdi.exe
  C:\Windows\System\QWZtVdi.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\hWlCYbD.exe
  C:\Windows\System\hWlCYbD.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\pnKDiKy.exe
  C:\Windows\System\pnKDiKy.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\RWNhnNG.exe
  C:\Windows\System\RWNhnNG.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\PAYaCba.exe
  C:\Windows\System\PAYaCba.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\xovPghO.exe
  C:\Windows\System\xovPghO.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\nmRnCAl.exe
  C:\Windows\System\nmRnCAl.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\aKobqfq.exe
  C:\Windows\System\aKobqfq.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\EBnmbUa.exe
  C:\Windows\System\EBnmbUa.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\kGMecun.exe
  C:\Windows\System\kGMecun.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\cpAfJRv.exe
  C:\Windows\System\cpAfJRv.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\qaRlfUO.exe
  C:\Windows\System\qaRlfUO.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\HRKYuPd.exe
  C:\Windows\System\HRKYuPd.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\wsMNXfX.exe
  C:\Windows\System\wsMNXfX.exe
  2⤵
  PID:4556
- C:\Windows\System\ykqflzU.exe
  C:\Windows\System\ykqflzU.exe
  2⤵
  PID:1336
- C:\Windows\System\cuBtNuL.exe
  C:\Windows\System\cuBtNuL.exe
  2⤵
  PID:4176
- C:\Windows\System\ssuflSH.exe
  C:\Windows\System\ssuflSH.exe
  2⤵
  PID:4104
- C:\Windows\System\GEnITKo.exe
  C:\Windows\System\GEnITKo.exe
  2⤵
  PID:4936
- C:\Windows\System\aeaBKVL.exe
  C:\Windows\System\aeaBKVL.exe
  2⤵
  PID:2352
- C:\Windows\System\KYZofLj.exe
  C:\Windows\System\KYZofLj.exe
  2⤵
  PID:3468
- C:\Windows\System\sxcjeBr.exe
  C:\Windows\System\sxcjeBr.exe
  2⤵
  PID:1464
- C:\Windows\System\GajAhLR.exe
  C:\Windows\System\GajAhLR.exe
  2⤵
  PID:5128
- C:\Windows\System\QKWSdeZ.exe
  C:\Windows\System\QKWSdeZ.exe
  2⤵
  PID:5160
- C:\Windows\System\UQmhWsC.exe
  C:\Windows\System\UQmhWsC.exe
  2⤵
  PID:5192
- C:\Windows\System\cpVEcMN.exe
  C:\Windows\System\cpVEcMN.exe
  2⤵
  PID:5216
- C:\Windows\System\DVxYJGI.exe
  C:\Windows\System\DVxYJGI.exe
  2⤵
  PID:5244
- C:\Windows\System\IUOMjNk.exe
  C:\Windows\System\IUOMjNk.exe
  2⤵
  PID:5272
- C:\Windows\System\gSEochh.exe
  C:\Windows\System\gSEochh.exe
  2⤵
  PID:5300
- C:\Windows\System\oETGSSo.exe
  C:\Windows\System\oETGSSo.exe
  2⤵
  PID:5328
- C:\Windows\System\zcXADbC.exe
  C:\Windows\System\zcXADbC.exe
  2⤵
  PID:5352
- C:\Windows\System\ytTKHyN.exe
  C:\Windows\System\ytTKHyN.exe
  2⤵
  PID:5380
- C:\Windows\System\mbGDOre.exe
  C:\Windows\System\mbGDOre.exe
  2⤵
  PID:5408
- C:\Windows\System\ACNVLsi.exe
  C:\Windows\System\ACNVLsi.exe
  2⤵
  PID:5444
- C:\Windows\System\rgPrDBo.exe
  C:\Windows\System\rgPrDBo.exe
  2⤵
  PID:5472
- C:\Windows\System\NVWTkoX.exe
  C:\Windows\System\NVWTkoX.exe
  2⤵
  PID:5504
- C:\Windows\System\GBlLgzi.exe
  C:\Windows\System\GBlLgzi.exe
  2⤵
  PID:5532
- C:\Windows\System\ECVRAAi.exe
  C:\Windows\System\ECVRAAi.exe
  2⤵
  PID:5560
- C:\Windows\System\jAWxfpY.exe
  C:\Windows\System\jAWxfpY.exe
  2⤵
  PID:5588
- C:\Windows\System\NCpUdOY.exe
  C:\Windows\System\NCpUdOY.exe
  2⤵
  PID:5616
- C:\Windows\System\eUPIyEp.exe
  C:\Windows\System\eUPIyEp.exe
  2⤵
  PID:5644
- C:\Windows\System\bfrnbim.exe
  C:\Windows\System\bfrnbim.exe
  2⤵
  PID:5672
- C:\Windows\System\fBjQSnH.exe
  C:\Windows\System\fBjQSnH.exe
  2⤵
  PID:5700
- C:\Windows\System\KaGukLH.exe
  C:\Windows\System\KaGukLH.exe
  2⤵
  PID:5732
- C:\Windows\System\EVVjtEM.exe
  C:\Windows\System\EVVjtEM.exe
  2⤵
  PID:5760
- C:\Windows\System\AdTZIAL.exe
  C:\Windows\System\AdTZIAL.exe
  2⤵
  PID:5784
- C:\Windows\System\fWxVebP.exe
  C:\Windows\System\fWxVebP.exe
  2⤵
  PID:5812
- C:\Windows\System\oHlTuys.exe
  C:\Windows\System\oHlTuys.exe
  2⤵
  PID:5844
- C:\Windows\System\xrJrwxP.exe
  C:\Windows\System\xrJrwxP.exe
  2⤵
  PID:5872
- C:\Windows\System\YMUEqfq.exe
  C:\Windows\System\YMUEqfq.exe
  2⤵
  PID:5900
- C:\Windows\System\rPUNpWR.exe
  C:\Windows\System\rPUNpWR.exe
  2⤵
  PID:5928
- C:\Windows\System\LJkeTmE.exe
  C:\Windows\System\LJkeTmE.exe
  2⤵
  PID:5956
- C:\Windows\System\rcRnvlh.exe
  C:\Windows\System\rcRnvlh.exe
  2⤵
  PID:5980
- C:\Windows\System\vICtSFV.exe
  C:\Windows\System\vICtSFV.exe
  2⤵
  PID:6016
- C:\Windows\System\IfGoCHB.exe
  C:\Windows\System\IfGoCHB.exe
  2⤵
  PID:6044
- C:\Windows\System\pBgNOpn.exe
  C:\Windows\System\pBgNOpn.exe
  2⤵
  PID:6068
- C:\Windows\System\AIJJPUu.exe
  C:\Windows\System\AIJJPUu.exe
  2⤵
  PID:6100
- C:\Windows\System\Uepplrl.exe
  C:\Windows\System\Uepplrl.exe
  2⤵
  PID:6124
- C:\Windows\System\CWLTHwF.exe
  C:\Windows\System\CWLTHwF.exe
  2⤵
  PID:3444
- C:\Windows\System\UMyjvQM.exe
  C:\Windows\System\UMyjvQM.exe
  2⤵
  PID:2976
- C:\Windows\System\xPlCtRV.exe
  C:\Windows\System\xPlCtRV.exe
  2⤵
  PID:1244
- C:\Windows\System\ojBYgov.exe
  C:\Windows\System\ojBYgov.exe
  2⤵
  PID:2764
- C:\Windows\System\MTvSXOH.exe
  C:\Windows\System\MTvSXOH.exe
  2⤵
  PID:3652
- C:\Windows\System\OYylcvj.exe
  C:\Windows\System\OYylcvj.exe
  2⤵
  PID:4928
- C:\Windows\System\JZUNzhc.exe
  C:\Windows\System\JZUNzhc.exe
  2⤵
  PID:5236
- C:\Windows\System\fAoxGGC.exe
  C:\Windows\System\fAoxGGC.exe
  2⤵
  PID:5288
- C:\Windows\System\RAVQNsD.exe
  C:\Windows\System\RAVQNsD.exe
  2⤵
  PID:5320
- C:\Windows\System\EyIzrdM.exe
  C:\Windows\System\EyIzrdM.exe
  2⤵
  PID:2740
- C:\Windows\System\JFATeAS.exe
  C:\Windows\System\JFATeAS.exe
  2⤵
  PID:5400
- C:\Windows\System\wKBWFix.exe
  C:\Windows\System\wKBWFix.exe
  2⤵
  PID:5496
- C:\Windows\System\mfLToVe.exe
  C:\Windows\System\mfLToVe.exe
  2⤵
  PID:5552
- C:\Windows\System\qluSRrX.exe
  C:\Windows\System\qluSRrX.exe
  2⤵
  PID:5600
- C:\Windows\System\PoAXWDl.exe
  C:\Windows\System\PoAXWDl.exe
  2⤵
  PID:5688
- C:\Windows\System\jycXXZS.exe
  C:\Windows\System\jycXXZS.exe
  2⤵
  PID:1292
- C:\Windows\System\EeRKlPx.exe
  C:\Windows\System\EeRKlPx.exe
  2⤵
  PID:5800
- C:\Windows\System\geeqSkD.exe
  C:\Windows\System\geeqSkD.exe
  2⤵
  PID:5836
- C:\Windows\System\okxYLwB.exe
  C:\Windows\System\okxYLwB.exe
  2⤵
  PID:5976
- C:\Windows\System\MlJCCGr.exe
  C:\Windows\System\MlJCCGr.exe
  2⤵
  PID:2348
- C:\Windows\System\EYphgay.exe
  C:\Windows\System\EYphgay.exe
  2⤵
  PID:6032
- C:\Windows\System\LqClyfF.exe
  C:\Windows\System\LqClyfF.exe
  2⤵
  PID:6084
- C:\Windows\System\qNrrCxi.exe
  C:\Windows\System\qNrrCxi.exe
  2⤵
  PID:6120
- C:\Windows\System\RsFiDYm.exe
  C:\Windows\System\RsFiDYm.exe
  2⤵
  PID:4612
- C:\Windows\System\AdrCZPi.exe
  C:\Windows\System\AdrCZPi.exe
  2⤵
  PID:4444
- C:\Windows\System\yQKBNkj.exe
  C:\Windows\System\yQKBNkj.exe
  2⤵
  PID:1508
- C:\Windows\System\vXQfanF.exe
  C:\Windows\System\vXQfanF.exe
  2⤵
  PID:3124
- C:\Windows\System\UHhQPcN.exe
  C:\Windows\System\UHhQPcN.exe
  2⤵
  PID:1976
- C:\Windows\System\olhOgUU.exe
  C:\Windows\System\olhOgUU.exe
  2⤵
  PID:2476
- C:\Windows\System\HqBGjzr.exe
  C:\Windows\System\HqBGjzr.exe
  2⤵
  PID:2604
- C:\Windows\System\wvsvEll.exe
  C:\Windows\System\wvsvEll.exe
  2⤵
  PID:5172
- C:\Windows\System\MSOmUaD.exe
  C:\Windows\System\MSOmUaD.exe
  2⤵
  PID:2684
- C:\Windows\System\hAvZLbG.exe
  C:\Windows\System\hAvZLbG.exe
  2⤵
  PID:1700
- C:\Windows\System\KcXtgMz.exe
  C:\Windows\System\KcXtgMz.exe
  2⤵
  PID:1996
- C:\Windows\System\KbfbTsF.exe
  C:\Windows\System\KbfbTsF.exe
  2⤵
  PID:3660
- C:\Windows\System\ocZgWIY.exe
  C:\Windows\System\ocZgWIY.exe
  2⤵
  PID:676
- C:\Windows\System\lNAeZnN.exe
  C:\Windows\System\lNAeZnN.exe
  2⤵
  PID:3032
- C:\Windows\System\zhqPOcU.exe
  C:\Windows\System\zhqPOcU.exe
  2⤵
  PID:4428
- C:\Windows\System\PqOroip.exe
  C:\Windows\System\PqOroip.exe
  2⤵
  PID:956
- C:\Windows\System\eRHBsrm.exe
  C:\Windows\System\eRHBsrm.exe
  2⤵
  PID:5208
- C:\Windows\System\RWFDzOH.exe
  C:\Windows\System\RWFDzOH.exe
  2⤵
  PID:5344
- C:\Windows\System\zBPqcAS.exe
  C:\Windows\System\zBPqcAS.exe
  2⤵
  PID:4404
- C:\Windows\System\SiACgVl.exe
  C:\Windows\System\SiACgVl.exe
  2⤵
  PID:5808
- C:\Windows\System\FCCFYti.exe
  C:\Windows\System\FCCFYti.exe
  2⤵
  PID:5892
- C:\Windows\System\BSyucVC.exe
  C:\Windows\System\BSyucVC.exe
  2⤵
  PID:5000
- C:\Windows\System\WFoEDlF.exe
  C:\Windows\System\WFoEDlF.exe
  2⤵
  PID:6064
- C:\Windows\System\IxMGdsW.exe
  C:\Windows\System\IxMGdsW.exe
  2⤵
  PID:4288
- C:\Windows\System\yOepgCU.exe
  C:\Windows\System\yOepgCU.exe
  2⤵
  PID:3428
- C:\Windows\System\eqMsUeG.exe
  C:\Windows\System\eqMsUeG.exe
  2⤵
  PID:4080
- C:\Windows\System\HppLPhh.exe
  C:\Windows\System\HppLPhh.exe
  2⤵
  PID:4228
- C:\Windows\System\tTgNdkj.exe
  C:\Windows\System\tTgNdkj.exe
  2⤵
  PID:2068
- C:\Windows\System\XRbNeME.exe
  C:\Windows\System\XRbNeME.exe
  2⤵
  PID:4256
- C:\Windows\System\JadXrLn.exe
  C:\Windows\System\JadXrLn.exe
  2⤵
  PID:5456
- C:\Windows\System\JXFZHlD.exe
  C:\Windows\System\JXFZHlD.exe
  2⤵
  PID:4716
- C:\Windows\System\TAslKqT.exe
  C:\Windows\System\TAslKqT.exe
  2⤵
  PID:5776
- C:\Windows\System\MkuiMvE.exe
  C:\Windows\System\MkuiMvE.exe
  2⤵
  PID:4980
- C:\Windows\System\fIeZiPX.exe
  C:\Windows\System\fIeZiPX.exe
  2⤵
  PID:3760
- C:\Windows\System\efcFnes.exe
  C:\Windows\System\efcFnes.exe
  2⤵
  PID:4180
- C:\Windows\System\cptLXQq.exe
  C:\Windows\System\cptLXQq.exe
  2⤵
  PID:3236
- C:\Windows\System\zAMWnOk.exe
  C:\Windows\System\zAMWnOk.exe
  2⤵
  PID:3764
- C:\Windows\System\PsWyrma.exe
  C:\Windows\System\PsWyrma.exe
  2⤵
  PID:1956
- C:\Windows\System\NMVXaag.exe
  C:\Windows\System\NMVXaag.exe
  2⤵
  PID:2416
- C:\Windows\System\yWMJHpw.exe
  C:\Windows\System\yWMJHpw.exe
  2⤵
  PID:6176
- C:\Windows\System\ZRromsN.exe
  C:\Windows\System\ZRromsN.exe
  2⤵
  PID:6192
- C:\Windows\System\UzdkhPj.exe
  C:\Windows\System\UzdkhPj.exe
  2⤵
  PID:6220
- C:\Windows\System\anJBBmI.exe
  C:\Windows\System\anJBBmI.exe
  2⤵
  PID:6284
- C:\Windows\System\WAOEnpA.exe
  C:\Windows\System\WAOEnpA.exe
  2⤵
  PID:6304
- C:\Windows\System\tqVArvH.exe
  C:\Windows\System\tqVArvH.exe
  2⤵
  PID:6324
- C:\Windows\System\pprvtge.exe
  C:\Windows\System\pprvtge.exe
  2⤵
  PID:6344
- C:\Windows\System\bZhqlNH.exe
  C:\Windows\System\bZhqlNH.exe
  2⤵
  PID:6368
- C:\Windows\System\SNokWXM.exe
  C:\Windows\System\SNokWXM.exe
  2⤵
  PID:6396
- C:\Windows\System\IcFILyK.exe
  C:\Windows\System\IcFILyK.exe
  2⤵
  PID:6420
- C:\Windows\System\UyhiUrF.exe
  C:\Windows\System\UyhiUrF.exe
  2⤵
  PID:6436
- C:\Windows\System\ldskvOv.exe
  C:\Windows\System\ldskvOv.exe
  2⤵
  PID:6456
- C:\Windows\System\idFfjFS.exe
  C:\Windows\System\idFfjFS.exe
  2⤵
  PID:6488
- C:\Windows\System\hbtOCiq.exe
  C:\Windows\System\hbtOCiq.exe
  2⤵
  PID:6504
- C:\Windows\System\kLchCQH.exe
  C:\Windows\System\kLchCQH.exe
  2⤵
  PID:6528
- C:\Windows\System\lETsqHq.exe
  C:\Windows\System\lETsqHq.exe
  2⤵
  PID:6544
- C:\Windows\System\eATzzfZ.exe
  C:\Windows\System\eATzzfZ.exe
  2⤵
  PID:6564
- C:\Windows\System\gnIxCVF.exe
  C:\Windows\System\gnIxCVF.exe
  2⤵
  PID:6612
- C:\Windows\System\ytqqixJ.exe
  C:\Windows\System\ytqqixJ.exe
  2⤵
  PID:6716
- C:\Windows\System\uzmveBX.exe
  C:\Windows\System\uzmveBX.exe
  2⤵
  PID:6732
- C:\Windows\System\bGzIuSb.exe
  C:\Windows\System\bGzIuSb.exe
  2⤵
  PID:6748
- C:\Windows\System\ZsvxeWH.exe
  C:\Windows\System\ZsvxeWH.exe
  2⤵
  PID:6764
- C:\Windows\System\gUALNgO.exe
  C:\Windows\System\gUALNgO.exe
  2⤵
  PID:6780
- C:\Windows\System\jQGLHZt.exe
  C:\Windows\System\jQGLHZt.exe
  2⤵
  PID:6800
- C:\Windows\System\EfqdYBH.exe
  C:\Windows\System\EfqdYBH.exe
  2⤵
  PID:6816
- C:\Windows\System\cVProKx.exe
  C:\Windows\System\cVProKx.exe
  2⤵
  PID:6832
- C:\Windows\System\oBPUsIT.exe
  C:\Windows\System\oBPUsIT.exe
  2⤵
  PID:6848
- C:\Windows\System\DDdzslH.exe
  C:\Windows\System\DDdzslH.exe
  2⤵
  PID:6864
- C:\Windows\System\ZjMcPtT.exe
  C:\Windows\System\ZjMcPtT.exe
  2⤵
  PID:6880
- C:\Windows\System\zLrYhnS.exe
  C:\Windows\System\zLrYhnS.exe
  2⤵
  PID:6896
- C:\Windows\System\YpzJPfX.exe
  C:\Windows\System\YpzJPfX.exe
  2⤵
  PID:6912
- C:\Windows\System\NhAjxwj.exe
  C:\Windows\System\NhAjxwj.exe
  2⤵
  PID:6932
- C:\Windows\System\XsJNXqG.exe
  C:\Windows\System\XsJNXqG.exe
  2⤵
  PID:6972
- C:\Windows\System\SjOSXio.exe
  C:\Windows\System\SjOSXio.exe
  2⤵
  PID:6996
- C:\Windows\System\vvBlWMN.exe
  C:\Windows\System\vvBlWMN.exe
  2⤵
  PID:7080
- C:\Windows\System\tCLzAWJ.exe
  C:\Windows\System\tCLzAWJ.exe
  2⤵
  PID:7096
- C:\Windows\System\FQLYQVY.exe
  C:\Windows\System\FQLYQVY.exe
  2⤵
  PID:7112
- C:\Windows\System\aJEvHLH.exe
  C:\Windows\System\aJEvHLH.exe
  2⤵
  PID:7144
- C:\Windows\System\groyenj.exe
  C:\Windows\System\groyenj.exe
  2⤵
  PID:7160
- C:\Windows\System\cUUEPgt.exe
  C:\Windows\System\cUUEPgt.exe
  2⤵
  PID:6316
- C:\Windows\System\jXmCEaZ.exe
  C:\Windows\System\jXmCEaZ.exe
  2⤵
  PID:6300
- C:\Windows\System\ZpoSccW.exe
  C:\Windows\System\ZpoSccW.exe
  2⤵
  PID:6556
- C:\Windows\System\FXcvUxM.exe
  C:\Windows\System\FXcvUxM.exe
  2⤵
  PID:6636
- C:\Windows\System\iNKuUPF.exe
  C:\Windows\System\iNKuUPF.exe
  2⤵
  PID:6648
- C:\Windows\System\UIauTaD.exe
  C:\Windows\System\UIauTaD.exe
  2⤵
  PID:6656
- C:\Windows\System\UcLgRTI.exe
  C:\Windows\System\UcLgRTI.exe
  2⤵
  PID:6908
- C:\Windows\System\IkVNcep.exe
  C:\Windows\System\IkVNcep.exe
  2⤵
  PID:6708
- C:\Windows\System\SSDtiib.exe
  C:\Windows\System\SSDtiib.exe
  2⤵
  PID:6824
- C:\Windows\System\ZtKnIku.exe
  C:\Windows\System\ZtKnIku.exe
  2⤵
  PID:6956
- C:\Windows\System\neDUtCm.exe
  C:\Windows\System\neDUtCm.exe
  2⤵
  PID:7088
- C:\Windows\System\kuJfeOn.exe
  C:\Windows\System\kuJfeOn.exe
  2⤵
  PID:7004
- C:\Windows\System\NESVQxj.exe
  C:\Windows\System\NESVQxj.exe
  2⤵
  PID:7140
- C:\Windows\System\eJdBLoR.exe
  C:\Windows\System\eJdBLoR.exe
  2⤵
  PID:6352
- C:\Windows\System\SzsJVQT.exe
  C:\Windows\System\SzsJVQT.exe
  2⤵
  PID:6248
- C:\Windows\System\ZLrLWmz.exe
  C:\Windows\System\ZLrLWmz.exe
  2⤵
  PID:6992
- C:\Windows\System\kZVHVBw.exe
  C:\Windows\System\kZVHVBw.exe
  2⤵
  PID:6888
- C:\Windows\System\QDrTYUp.exe
  C:\Windows\System\QDrTYUp.exe
  2⤵
  PID:7024
- C:\Windows\System\SVHmlOj.exe
  C:\Windows\System\SVHmlOj.exe
  2⤵
  PID:7104
- C:\Windows\System\ZbRwrxf.exe
  C:\Windows\System\ZbRwrxf.exe
  2⤵
  PID:6272
- C:\Windows\System\VfCZpoY.exe
  C:\Windows\System\VfCZpoY.exe
  2⤵
  PID:6408
- C:\Windows\System\rwKhGxK.exe
  C:\Windows\System\rwKhGxK.exe
  2⤵
  PID:6680
- C:\Windows\System\JeKCyMq.exe
  C:\Windows\System\JeKCyMq.exe
  2⤵
  PID:7156
- C:\Windows\System\neQKbNv.exe
  C:\Windows\System\neQKbNv.exe
  2⤵
  PID:7180
- C:\Windows\System\JnWRgwX.exe
  C:\Windows\System\JnWRgwX.exe
  2⤵
  PID:7196
- C:\Windows\System\jCoZhbc.exe
  C:\Windows\System\jCoZhbc.exe
  2⤵
  PID:7220
- C:\Windows\System\nFDdHkN.exe
  C:\Windows\System\nFDdHkN.exe
  2⤵
  PID:7256
- C:\Windows\System\VjfUVrs.exe
  C:\Windows\System\VjfUVrs.exe
  2⤵
  PID:7280
- C:\Windows\System\tWRMHbF.exe
  C:\Windows\System\tWRMHbF.exe
  2⤵
  PID:7296
- C:\Windows\System\jSKUsIQ.exe
  C:\Windows\System\jSKUsIQ.exe
  2⤵
  PID:7316
- C:\Windows\System\NnJIaqR.exe
  C:\Windows\System\NnJIaqR.exe
  2⤵
  PID:7348
- C:\Windows\System\yfqZZkR.exe
  C:\Windows\System\yfqZZkR.exe
  2⤵
  PID:7368
- C:\Windows\System\jGwyiSF.exe
  C:\Windows\System\jGwyiSF.exe
  2⤵
  PID:7396
- C:\Windows\System\iIwXKtN.exe
  C:\Windows\System\iIwXKtN.exe
  2⤵
  PID:7416
- C:\Windows\System\KcQUKZO.exe
  C:\Windows\System\KcQUKZO.exe
  2⤵
  PID:7436
- C:\Windows\System\bCFjMhh.exe
  C:\Windows\System\bCFjMhh.exe
  2⤵
  PID:7476
- C:\Windows\System\iymLqmH.exe
  C:\Windows\System\iymLqmH.exe
  2⤵
  PID:7524
- C:\Windows\System\UxgckJP.exe
  C:\Windows\System\UxgckJP.exe
  2⤵
  PID:7568
- C:\Windows\System\AGCtYqq.exe
  C:\Windows\System\AGCtYqq.exe
  2⤵
  PID:7608
- C:\Windows\System\TbwFQdY.exe
  C:\Windows\System\TbwFQdY.exe
  2⤵
  PID:7624
- C:\Windows\System\ucwuzco.exe
  C:\Windows\System\ucwuzco.exe
  2⤵
  PID:7644
- C:\Windows\System\EHfHdnc.exe
  C:\Windows\System\EHfHdnc.exe
  2⤵
  PID:7696
- C:\Windows\System\NRaGYwx.exe
  C:\Windows\System\NRaGYwx.exe
  2⤵
  PID:7712
- C:\Windows\System\ASXpFTX.exe
  C:\Windows\System\ASXpFTX.exe
  2⤵
  PID:7736
- C:\Windows\System\UIUadFU.exe
  C:\Windows\System\UIUadFU.exe
  2⤵
  PID:7756
- C:\Windows\System\btHyQqm.exe
  C:\Windows\System\btHyQqm.exe
  2⤵
  PID:7772
- C:\Windows\System\xeKXcuO.exe
  C:\Windows\System\xeKXcuO.exe
  2⤵
  PID:7796
- C:\Windows\System\udFiUQu.exe
  C:\Windows\System\udFiUQu.exe
  2⤵
  PID:7816
- C:\Windows\System\WXWZmGP.exe
  C:\Windows\System\WXWZmGP.exe
  2⤵
  PID:7860
- C:\Windows\System\IQxPXVL.exe
  C:\Windows\System\IQxPXVL.exe
  2⤵
  PID:7912
- C:\Windows\System\UeSZZqU.exe
  C:\Windows\System\UeSZZqU.exe
  2⤵
  PID:7952
- C:\Windows\System\cUDRgKa.exe
  C:\Windows\System\cUDRgKa.exe
  2⤵
  PID:7976
- C:\Windows\System\Rviyyxn.exe
  C:\Windows\System\Rviyyxn.exe
  2⤵
  PID:7996
- C:\Windows\System\dQrbAFG.exe
  C:\Windows\System\dQrbAFG.exe
  2⤵
  PID:8024
- C:\Windows\System\BDdQUUA.exe
  C:\Windows\System\BDdQUUA.exe
  2⤵
  PID:8052
- C:\Windows\System\JhKqkxq.exe
  C:\Windows\System\JhKqkxq.exe
  2⤵
  PID:8096
- C:\Windows\System\KaTiVOZ.exe
  C:\Windows\System\KaTiVOZ.exe
  2⤵
  PID:8112
- C:\Windows\System\FvXKool.exe
  C:\Windows\System\FvXKool.exe
  2⤵
  PID:8140
- C:\Windows\System\cdjklua.exe
  C:\Windows\System\cdjklua.exe
  2⤵
  PID:8164
- C:\Windows\System\kzjhyvD.exe
  C:\Windows\System\kzjhyvD.exe
  2⤵
  PID:8184
- C:\Windows\System\lslnDqL.exe
  C:\Windows\System\lslnDqL.exe
  2⤵
  PID:6516
- C:\Windows\System\ZaGbhek.exe
  C:\Windows\System\ZaGbhek.exe
  2⤵
  PID:7244
- C:\Windows\System\gCaJNns.exe
  C:\Windows\System\gCaJNns.exe
  2⤵
  PID:7308
- C:\Windows\System\kVRYSwq.exe
  C:\Windows\System\kVRYSwq.exe
  2⤵
  PID:7412
- C:\Windows\System\EyzhNwA.exe
  C:\Windows\System\EyzhNwA.exe
  2⤵
  PID:7404
- C:\Windows\System\vouUwPk.exe
  C:\Windows\System\vouUwPk.exe
  2⤵
  PID:7584
- C:\Windows\System\OxClXQS.exe
  C:\Windows\System\OxClXQS.exe
  2⤵
  PID:7560
- C:\Windows\System\VWKTHcT.exe
  C:\Windows\System\VWKTHcT.exe
  2⤵
  PID:7604
- C:\Windows\System\WRHjSIY.exe
  C:\Windows\System\WRHjSIY.exe
  2⤵
  PID:7636
- C:\Windows\System\nHvsCde.exe
  C:\Windows\System\nHvsCde.exe
  2⤵
  PID:7724
- C:\Windows\System\DRnvYRQ.exe
  C:\Windows\System\DRnvYRQ.exe
  2⤵
  PID:7748
- C:\Windows\System\cCKpzLZ.exe
  C:\Windows\System\cCKpzLZ.exe
  2⤵
  PID:7808
- C:\Windows\System\VOPceDc.exe
  C:\Windows\System\VOPceDc.exe
  2⤵
  PID:7852
- C:\Windows\System\lTHFVVg.exe
  C:\Windows\System\lTHFVVg.exe
  2⤵
  PID:7968
- C:\Windows\System\ZqZKljr.exe
  C:\Windows\System\ZqZKljr.exe
  2⤵
  PID:8088
- C:\Windows\System\aEGOJDO.exe
  C:\Windows\System\aEGOJDO.exe
  2⤵
  PID:8132
- C:\Windows\System\cIZwhIO.exe
  C:\Windows\System\cIZwhIO.exe
  2⤵
  PID:8180
- C:\Windows\System\cpECNmY.exe
  C:\Windows\System\cpECNmY.exe
  2⤵
  PID:7240
- C:\Windows\System\XwcRFdk.exe
  C:\Windows\System\XwcRFdk.exe
  2⤵
  PID:7268
- C:\Windows\System\poLxxHP.exe
  C:\Windows\System\poLxxHP.exe
  2⤵
  PID:7392
- C:\Windows\System\fSFtYxS.exe
  C:\Windows\System\fSFtYxS.exe
  2⤵
  PID:7548
- C:\Windows\System\ARaZsrN.exe
  C:\Windows\System\ARaZsrN.exe
  2⤵
  PID:7836
- C:\Windows\System\kPGvZDq.exe
  C:\Windows\System\kPGvZDq.exe
  2⤵
  PID:7908
- C:\Windows\System\qRXbyLk.exe
  C:\Windows\System\qRXbyLk.exe
  2⤵
  PID:8176
- C:\Windows\System\Wvpnmpk.exe
  C:\Windows\System\Wvpnmpk.exe
  2⤵
  PID:7292
- C:\Windows\System\TLqpUBz.exe
  C:\Windows\System\TLqpUBz.exe
  2⤵
  PID:7620
- C:\Windows\System\TKUKODC.exe
  C:\Windows\System\TKUKODC.exe
  2⤵
  PID:8108
- C:\Windows\System\QFwImCM.exe
  C:\Windows\System\QFwImCM.exe
  2⤵
  PID:8208
- C:\Windows\System\kTrfOyp.exe
  C:\Windows\System\kTrfOyp.exe
  2⤵
  PID:8244
- C:\Windows\System\bZXQUFe.exe
  C:\Windows\System\bZXQUFe.exe
  2⤵
  PID:8260
- C:\Windows\System\aBVMnHJ.exe
  C:\Windows\System\aBVMnHJ.exe
  2⤵
  PID:8280
- C:\Windows\System\xBlgxzr.exe
  C:\Windows\System\xBlgxzr.exe
  2⤵
  PID:8320
- C:\Windows\System\yeMBvnR.exe
  C:\Windows\System\yeMBvnR.exe
  2⤵
  PID:8340
- C:\Windows\System\uQXFgyk.exe
  C:\Windows\System\uQXFgyk.exe
  2⤵
  PID:8356
- C:\Windows\System\oSqEvqU.exe
  C:\Windows\System\oSqEvqU.exe
  2⤵
  PID:8376
- C:\Windows\System\ZVGxdLQ.exe
  C:\Windows\System\ZVGxdLQ.exe
  2⤵
  PID:8392
- C:\Windows\System\vMvfEBe.exe
  C:\Windows\System\vMvfEBe.exe
  2⤵
  PID:8412
- C:\Windows\System\ZeYZjMF.exe
  C:\Windows\System\ZeYZjMF.exe
  2⤵
  PID:8432
- C:\Windows\System\FtthRCC.exe
  C:\Windows\System\FtthRCC.exe
  2⤵
  PID:8472
- C:\Windows\System\QdapVxj.exe
  C:\Windows\System\QdapVxj.exe
  2⤵
  PID:8496
- C:\Windows\System\dLiroxW.exe
  C:\Windows\System\dLiroxW.exe
  2⤵
  PID:8520
- C:\Windows\System\HiuPMob.exe
  C:\Windows\System\HiuPMob.exe
  2⤵
  PID:8556
- C:\Windows\System\uNbMmqb.exe
  C:\Windows\System\uNbMmqb.exe
  2⤵
  PID:8572
- C:\Windows\System\YgOOhRm.exe
  C:\Windows\System\YgOOhRm.exe
  2⤵
  PID:8596
- C:\Windows\System\DYaQGFg.exe
  C:\Windows\System\DYaQGFg.exe
  2⤵
  PID:8612
- C:\Windows\System\mdzWAFd.exe
  C:\Windows\System\mdzWAFd.exe
  2⤵
  PID:8632
- C:\Windows\System\PUOICNJ.exe
  C:\Windows\System\PUOICNJ.exe
  2⤵
  PID:8724
- C:\Windows\System\RZQQZun.exe
  C:\Windows\System\RZQQZun.exe
  2⤵
  PID:8748
- C:\Windows\System\ATBKgzs.exe
  C:\Windows\System\ATBKgzs.exe
  2⤵
  PID:8764
- C:\Windows\System\EUFmxmF.exe
  C:\Windows\System\EUFmxmF.exe
  2⤵
  PID:8792
- C:\Windows\System\UGgczDi.exe
  C:\Windows\System\UGgczDi.exe
  2⤵
  PID:8832
- C:\Windows\System\ZDcKbPO.exe
  C:\Windows\System\ZDcKbPO.exe
  2⤵
  PID:8892
- C:\Windows\System\MGOiNZy.exe
  C:\Windows\System\MGOiNZy.exe
  2⤵
  PID:8916
- C:\Windows\System\IPAIsys.exe
  C:\Windows\System\IPAIsys.exe
  2⤵
  PID:8940
- C:\Windows\System\yoAFYxv.exe
  C:\Windows\System\yoAFYxv.exe
  2⤵
  PID:8960
- C:\Windows\System\HNgmRtq.exe
  C:\Windows\System\HNgmRtq.exe
  2⤵
  PID:8980
- C:\Windows\System\obZTDzn.exe
  C:\Windows\System\obZTDzn.exe
  2⤵
  PID:9084
- C:\Windows\System\JVXjndt.exe
  C:\Windows\System\JVXjndt.exe
  2⤵
  PID:9100
- C:\Windows\System\ykHwcZZ.exe
  C:\Windows\System\ykHwcZZ.exe
  2⤵
  PID:9120
- C:\Windows\System\OaDhxxZ.exe
  C:\Windows\System\OaDhxxZ.exe
  2⤵
  PID:9148
- C:\Windows\System\feOSmsC.exe
  C:\Windows\System\feOSmsC.exe
  2⤵
  PID:9164
- C:\Windows\System\nuZDhuX.exe
  C:\Windows\System\nuZDhuX.exe
  2⤵
  PID:9180
- C:\Windows\System\MACwLvw.exe
  C:\Windows\System\MACwLvw.exe
  2⤵
  PID:9196
- C:\Windows\System\XfxNPhT.exe
  C:\Windows\System\XfxNPhT.exe
  2⤵
  PID:8228
- C:\Windows\System\WeIRplG.exe
  C:\Windows\System\WeIRplG.exe
  2⤵
  PID:8296
- C:\Windows\System\SJPXNQw.exe
  C:\Windows\System\SJPXNQw.exe
  2⤵
  PID:8252
- C:\Windows\System\hoRqgHT.exe
  C:\Windows\System\hoRqgHT.exe
  2⤵
  PID:8428
- C:\Windows\System\ZwVXadl.exe
  C:\Windows\System\ZwVXadl.exe
  2⤵
  PID:8452
- C:\Windows\System\nSWhoxi.exe
  C:\Windows\System\nSWhoxi.exe
  2⤵
  PID:8532
- C:\Windows\System\RmeruIB.exe
  C:\Windows\System\RmeruIB.exe
  2⤵
  PID:8648
- C:\Windows\System\HGGFBKm.exe
  C:\Windows\System\HGGFBKm.exe
  2⤵
  PID:8568
- C:\Windows\System\MwsmGYl.exe
  C:\Windows\System\MwsmGYl.exe
  2⤵
  PID:8668
- C:\Windows\System\wnHWEMn.exe
  C:\Windows\System\wnHWEMn.exe
  2⤵
  PID:8820
- C:\Windows\System\WOxIHbY.exe
  C:\Windows\System\WOxIHbY.exe
  2⤵
  PID:8772
- C:\Windows\System\VNcOnQO.exe
  C:\Windows\System\VNcOnQO.exe
  2⤵
  PID:8928
- C:\Windows\System\xWczOWw.exe
  C:\Windows\System\xWczOWw.exe
  2⤵
  PID:8976
- C:\Windows\System\EZaUngn.exe
  C:\Windows\System\EZaUngn.exe
  2⤵
  PID:9116
- C:\Windows\System\ckVeyqj.exe
  C:\Windows\System\ckVeyqj.exe
  2⤵
  PID:9144
- C:\Windows\System\YXmBYUt.exe
  C:\Windows\System\YXmBYUt.exe
  2⤵
  PID:7236
- C:\Windows\System\WhzluMf.exe
  C:\Windows\System\WhzluMf.exe
  2⤵
  PID:8232
- C:\Windows\System\MdXNlCE.exe
  C:\Windows\System\MdXNlCE.exe
  2⤵
  PID:8312
- C:\Windows\System\ssNUlmX.exe
  C:\Windows\System\ssNUlmX.exe
  2⤵
  PID:8512
- C:\Windows\System\YoZUuqT.exe
  C:\Windows\System\YoZUuqT.exe
  2⤵
  PID:8592
- C:\Windows\System\OeldELf.exe
  C:\Windows\System\OeldELf.exe
  2⤵
  PID:8624
- C:\Windows\System\BGlWwmr.exe
  C:\Windows\System\BGlWwmr.exe
  2⤵
  PID:8872
- C:\Windows\System\UhBaNyv.exe
  C:\Windows\System\UhBaNyv.exe
  2⤵
  PID:9092
- C:\Windows\System\wtTiEPi.exe
  C:\Windows\System\wtTiEPi.exe
  2⤵
  PID:8040
- C:\Windows\System\zeSquKE.exe
  C:\Windows\System\zeSquKE.exe
  2⤵
  PID:8620
- C:\Windows\System\vXrTPBU.exe
  C:\Windows\System\vXrTPBU.exe
  2⤵
  PID:8904
- C:\Windows\System\QCUyuUT.exe
  C:\Windows\System\QCUyuUT.exe
  2⤵
  PID:9220
- C:\Windows\System\QlGyeiT.exe
  C:\Windows\System\QlGyeiT.exe
  2⤵
  PID:9236
- C:\Windows\System\PdKvcqO.exe
  C:\Windows\System\PdKvcqO.exe
  2⤵
  PID:9268
- C:\Windows\System\uzNUmEg.exe
  C:\Windows\System\uzNUmEg.exe
  2⤵
  PID:9288
- C:\Windows\System\iqPbcnD.exe
  C:\Windows\System\iqPbcnD.exe
  2⤵
  PID:9308
- C:\Windows\System\SCWsFwV.exe
  C:\Windows\System\SCWsFwV.exe
  2⤵
  PID:9340
- C:\Windows\System\FyIIPRj.exe
  C:\Windows\System\FyIIPRj.exe
  2⤵
  PID:9364
- C:\Windows\System\TnlcTdC.exe
  C:\Windows\System\TnlcTdC.exe
  2⤵
  PID:9384
- C:\Windows\System\SjXwcaM.exe
  C:\Windows\System\SjXwcaM.exe
  2⤵
  PID:9436
- C:\Windows\System\akvbIXO.exe
  C:\Windows\System\akvbIXO.exe
  2⤵
  PID:9480
- C:\Windows\System\JQdLURD.exe
  C:\Windows\System\JQdLURD.exe
  2⤵
  PID:9504
- C:\Windows\System\CGqzEkA.exe
  C:\Windows\System\CGqzEkA.exe
  2⤵
  PID:9528
- C:\Windows\System\vWIMRHT.exe
  C:\Windows\System\vWIMRHT.exe
  2⤵
  PID:9544
- C:\Windows\System\daZgPGS.exe
  C:\Windows\System\daZgPGS.exe
  2⤵
  PID:9572
- C:\Windows\System\QmKRHtc.exe
  C:\Windows\System\QmKRHtc.exe
  2⤵
  PID:9588
- C:\Windows\System\JltliGt.exe
  C:\Windows\System\JltliGt.exe
  2⤵
  PID:9608
- C:\Windows\System\HkVfrJA.exe
  C:\Windows\System\HkVfrJA.exe
  2⤵
  PID:9632
- C:\Windows\System\giIyLoS.exe
  C:\Windows\System\giIyLoS.exe
  2⤵
  PID:9648
- C:\Windows\System\imyFVnP.exe
  C:\Windows\System\imyFVnP.exe
  2⤵
  PID:9688
- C:\Windows\System\vGHViPu.exe
  C:\Windows\System\vGHViPu.exe
  2⤵
  PID:9744
- C:\Windows\System\jRHsQis.exe
  C:\Windows\System\jRHsQis.exe
  2⤵
  PID:9772
- C:\Windows\System\GngkCxZ.exe
  C:\Windows\System\GngkCxZ.exe
  2⤵
  PID:9840
- C:\Windows\System\lseKKpG.exe
  C:\Windows\System\lseKKpG.exe
  2⤵
  PID:9856
- C:\Windows\System\lefgJAp.exe
  C:\Windows\System\lefgJAp.exe
  2⤵
  PID:9880
- C:\Windows\System\WoRYFDs.exe
  C:\Windows\System\WoRYFDs.exe
  2⤵
  PID:9904
- C:\Windows\System\epbJfFY.exe
  C:\Windows\System\epbJfFY.exe
  2⤵
  PID:9940
- C:\Windows\System\NlWJMBG.exe
  C:\Windows\System\NlWJMBG.exe
  2⤵
  PID:9956
- C:\Windows\System\yPijqYs.exe
  C:\Windows\System\yPijqYs.exe
  2⤵
  PID:9984
- C:\Windows\System\DhDptsT.exe
  C:\Windows\System\DhDptsT.exe
  2⤵
  PID:10016
- C:\Windows\System\sjAjDGy.exe
  C:\Windows\System\sjAjDGy.exe
  2⤵
  PID:10048
- C:\Windows\System\KZVbskp.exe
  C:\Windows\System\KZVbskp.exe
  2⤵
  PID:10080
- C:\Windows\System\IAuVvcE.exe
  C:\Windows\System\IAuVvcE.exe
  2⤵
  PID:10108
- C:\Windows\System\vbWhqeH.exe
  C:\Windows\System\vbWhqeH.exe
  2⤵
  PID:10156
- C:\Windows\System\fptDVKk.exe
  C:\Windows\System\fptDVKk.exe
  2⤵
  PID:10192
- C:\Windows\System\ZwqRRQR.exe
  C:\Windows\System\ZwqRRQR.exe
  2⤵
  PID:10212
- C:\Windows\System\eVqNdDk.exe
  C:\Windows\System\eVqNdDk.exe
  2⤵
  PID:10228
- C:\Windows\System\fTPcDZa.exe
  C:\Windows\System\fTPcDZa.exe
  2⤵
  PID:9244
- C:\Windows\System\wjMNHsi.exe
  C:\Windows\System\wjMNHsi.exe
  2⤵
  PID:9284
- C:\Windows\System\mNwhxlB.exe
  C:\Windows\System\mNwhxlB.exe
  2⤵
  PID:9348
- C:\Windows\System\sVSkKjc.exe
  C:\Windows\System\sVSkKjc.exe
  2⤵
  PID:9464
- C:\Windows\System\RwhRQWU.exe
  C:\Windows\System\RwhRQWU.exe
  2⤵
  PID:9424
- C:\Windows\System\tKwbssg.exe
  C:\Windows\System\tKwbssg.exe
  2⤵
  PID:9584
- C:\Windows\System\kfHbcck.exe
  C:\Windows\System\kfHbcck.exe
  2⤵
  PID:9520
- C:\Windows\System\qUSBUGl.exe
  C:\Windows\System\qUSBUGl.exe
  2⤵
  PID:9680
- C:\Windows\System\fUycZuU.exe
  C:\Windows\System\fUycZuU.exe
  2⤵
  PID:9784
- C:\Windows\System\aIxffPu.exe
  C:\Windows\System\aIxffPu.exe
  2⤵
  PID:9764
- C:\Windows\System\iRjoTQM.exe
  C:\Windows\System\iRjoTQM.exe
  2⤵
  PID:9804
- C:\Windows\System\KNoTJDb.exe
  C:\Windows\System\KNoTJDb.exe
  2⤵
  PID:9832
- C:\Windows\System\DKVdgET.exe
  C:\Windows\System\DKVdgET.exe
  2⤵
  PID:9932
- C:\Windows\System\uzNgEwv.exe
  C:\Windows\System\uzNgEwv.exe
  2⤵
  PID:9000
- C:\Windows\System\rdZTXcf.exe
  C:\Windows\System\rdZTXcf.exe
  2⤵
  PID:10012
- C:\Windows\System\JqFbSuk.exe
  C:\Windows\System\JqFbSuk.exe
  2⤵
  PID:10032
- C:\Windows\System\mwDCNdZ.exe
  C:\Windows\System\mwDCNdZ.exe
  2⤵
  PID:8584
- C:\Windows\System\IktFGjn.exe
  C:\Windows\System\IktFGjn.exe
  2⤵
  PID:8968
- C:\Windows\System\OtMjfZr.exe
  C:\Windows\System\OtMjfZr.exe
  2⤵
  PID:9396
- C:\Windows\System\OuisIWv.exe
  C:\Windows\System\OuisIWv.exe
  2⤵
  PID:9600
- C:\Windows\System\NlVcpxO.exe
  C:\Windows\System\NlVcpxO.exe
  2⤵
  PID:9868
- C:\Windows\System\IGuLNYl.exe
  C:\Windows\System\IGuLNYl.exe
  2⤵
  PID:9720
- C:\Windows\System\xRyKZSf.exe
  C:\Windows\System\xRyKZSf.exe
  2⤵
  PID:9924
- C:\Windows\System\qVRKKAm.exe
  C:\Windows\System\qVRKKAm.exe
  2⤵
  PID:10044
- C:\Windows\System\OBMjciM.exe
  C:\Windows\System\OBMjciM.exe
  2⤵
  PID:10184
- C:\Windows\System\pYuSWWx.exe
  C:\Windows\System\pYuSWWx.exe
  2⤵
  PID:9228
- C:\Windows\System\HxUhvaa.exe
  C:\Windows\System\HxUhvaa.exe
  2⤵
  PID:9920
- C:\Windows\System\SsbIPYV.exe
  C:\Windows\System\SsbIPYV.exe
  2⤵
  PID:10040
- C:\Windows\System\OuHYaVg.exe
  C:\Windows\System\OuHYaVg.exe
  2⤵
  PID:10244
- C:\Windows\System\cjktEuc.exe
  C:\Windows\System\cjktEuc.exe
  2⤵
  PID:10260
- C:\Windows\System\GdrxecH.exe
  C:\Windows\System\GdrxecH.exe
  2⤵
  PID:10284
- C:\Windows\System\jNmpHEe.exe
  C:\Windows\System\jNmpHEe.exe
  2⤵
  PID:10304
- C:\Windows\System\ESvtFfN.exe
  C:\Windows\System\ESvtFfN.exe
  2⤵
  PID:10332
- C:\Windows\System\XMAevQF.exe
  C:\Windows\System\XMAevQF.exe
  2⤵
  PID:10352
- C:\Windows\System\zpivSuC.exe
  C:\Windows\System\zpivSuC.exe
  2⤵
  PID:10368
- C:\Windows\System\qFQoqmG.exe
  C:\Windows\System\qFQoqmG.exe
  2⤵
  PID:10388
- C:\Windows\System\rPFdaRo.exe
  C:\Windows\System\rPFdaRo.exe
  2⤵
  PID:10404
- C:\Windows\System\QVgWLEm.exe
  C:\Windows\System\QVgWLEm.exe
  2⤵
  PID:10420
- C:\Windows\System\WcGDeaK.exe
  C:\Windows\System\WcGDeaK.exe
  2⤵
  PID:10516
- C:\Windows\System\zKBSUrJ.exe
  C:\Windows\System\zKBSUrJ.exe
  2⤵
  PID:10536
- C:\Windows\System\MgUZJnX.exe
  C:\Windows\System\MgUZJnX.exe
  2⤵
  PID:10604
- C:\Windows\System\KEWNsAq.exe
  C:\Windows\System\KEWNsAq.exe
  2⤵
  PID:10620
- C:\Windows\System\sifaehu.exe
  C:\Windows\System\sifaehu.exe
  2⤵
  PID:10648
- C:\Windows\System\evNBGyZ.exe
  C:\Windows\System\evNBGyZ.exe
  2⤵
  PID:10668
- C:\Windows\System\VyOdmpt.exe
  C:\Windows\System\VyOdmpt.exe
  2⤵
  PID:10688
- C:\Windows\System\MZhIMqw.exe
  C:\Windows\System\MZhIMqw.exe
  2⤵
  PID:10732
- C:\Windows\System\Asotkgt.exe
  C:\Windows\System\Asotkgt.exe
  2⤵
  PID:10772
- C:\Windows\System\eiNuXmi.exe
  C:\Windows\System\eiNuXmi.exe
  2⤵
  PID:10800
- C:\Windows\System\nUHbFll.exe
  C:\Windows\System\nUHbFll.exe
  2⤵
  PID:10824
- C:\Windows\System\zXElajJ.exe
  C:\Windows\System\zXElajJ.exe
  2⤵
  PID:10844
- C:\Windows\System\chzcMZS.exe
  C:\Windows\System\chzcMZS.exe
  2⤵
  PID:10864
- C:\Windows\System\jdMwKcG.exe
  C:\Windows\System\jdMwKcG.exe
  2⤵
  PID:10900
- C:\Windows\System\plIbJoT.exe
  C:\Windows\System\plIbJoT.exe
  2⤵
  PID:10932
- C:\Windows\System\kfSWQHB.exe
  C:\Windows\System\kfSWQHB.exe
  2⤵
  PID:10956
- C:\Windows\System\KUBURpO.exe
  C:\Windows\System\KUBURpO.exe
  2⤵
  PID:10996
- C:\Windows\System\OjSccIY.exe
  C:\Windows\System\OjSccIY.exe
  2⤵
  PID:11012
- C:\Windows\System\tNbKged.exe
  C:\Windows\System\tNbKged.exe
  2⤵
  PID:11044
- C:\Windows\System\jeCGVmq.exe
  C:\Windows\System\jeCGVmq.exe
  2⤵
  PID:11072
- C:\Windows\System\TYtnDEC.exe
  C:\Windows\System\TYtnDEC.exe
  2⤵
  PID:11088
- C:\Windows\System\pthlWcc.exe
  C:\Windows\System\pthlWcc.exe
  2⤵
  PID:11108
- C:\Windows\System\NdvcEjG.exe
  C:\Windows\System\NdvcEjG.exe
  2⤵
  PID:11140
- C:\Windows\System\SQDecUd.exe
  C:\Windows\System\SQDecUd.exe
  2⤵
  PID:11184
- C:\Windows\System\BewrgSA.exe
  C:\Windows\System\BewrgSA.exe
  2⤵
  PID:11208
- C:\Windows\System\datAAft.exe
  C:\Windows\System\datAAft.exe
  2⤵
  PID:11236
- C:\Windows\System\HqZYHlY.exe
  C:\Windows\System\HqZYHlY.exe
  2⤵
  PID:9524
- C:\Windows\System\mDfnSTc.exe
  C:\Windows\System\mDfnSTc.exe
  2⤵
  PID:9820
- C:\Windows\System\ACaAdlB.exe
  C:\Windows\System\ACaAdlB.exe
  2⤵
  PID:10256
- C:\Windows\System\npPWCHP.exe
  C:\Windows\System\npPWCHP.exe
  2⤵
  PID:10280
- C:\Windows\System\QsqhimI.exe
  C:\Windows\System\QsqhimI.exe
  2⤵
  PID:10412
- C:\Windows\System\cWboBOL.exe
  C:\Windows\System\cWboBOL.exe
  2⤵
  PID:10504
- C:\Windows\System\jznKmmk.exe
  C:\Windows\System\jznKmmk.exe
  2⤵
  PID:10508
- C:\Windows\System\HGRIhoH.exe
  C:\Windows\System\HGRIhoH.exe
  2⤵
  PID:10660
- C:\Windows\System\kcTSBQJ.exe
  C:\Windows\System\kcTSBQJ.exe
  2⤵
  PID:10664
- C:\Windows\System\NOZzPPn.exe
  C:\Windows\System\NOZzPPn.exe
  2⤵
  PID:10784
- C:\Windows\System\TMGmRNq.exe
  C:\Windows\System\TMGmRNq.exe
  2⤵
  PID:10816
- C:\Windows\System\ajkOBwi.exe
  C:\Windows\System\ajkOBwi.exe
  2⤵
  PID:10892
- C:\Windows\System\dHksgzy.exe
  C:\Windows\System\dHksgzy.exe
  2⤵
  PID:10928
- C:\Windows\System\bIfmuIt.exe
  C:\Windows\System\bIfmuIt.exe
  2⤵
  PID:10984
- C:\Windows\System\aWMkogL.exe
  C:\Windows\System\aWMkogL.exe
  2⤵
  PID:11032
- C:\Windows\System\NmpVlFD.exe
  C:\Windows\System\NmpVlFD.exe
  2⤵
  PID:11096
- C:\Windows\System\wqBitfW.exe
  C:\Windows\System\wqBitfW.exe
  2⤵
  PID:11156
- C:\Windows\System\lqWDblK.exe
  C:\Windows\System\lqWDblK.exe
  2⤵
  PID:11200
- C:\Windows\System\RfKhCwU.exe
  C:\Windows\System\RfKhCwU.exe
  2⤵
  PID:11252
- C:\Windows\System\IcAJSpu.exe
  C:\Windows\System\IcAJSpu.exe
  2⤵
  PID:10416
- C:\Windows\System\fmSGQvp.exe
  C:\Windows\System\fmSGQvp.exe
  2⤵
  PID:10572
- C:\Windows\System\mLrGMHt.exe
  C:\Windows\System\mLrGMHt.exe
  2⤵
  PID:10764
- C:\Windows\System\xQINVUD.exe
  C:\Windows\System\xQINVUD.exe
  2⤵
  PID:10856
- C:\Windows\System\CyOTgyf.exe
  C:\Windows\System\CyOTgyf.exe
  2⤵
  PID:10924
- C:\Windows\System\EGDHLfH.exe
  C:\Windows\System\EGDHLfH.exe
  2⤵
  PID:11008
- C:\Windows\System\vDnEvDc.exe
  C:\Windows\System\vDnEvDc.exe
  2⤵
  PID:11124
- C:\Windows\System\KLzHVyO.exe
  C:\Windows\System\KLzHVyO.exe
  2⤵
  PID:11248
- C:\Windows\System\qCazCZC.exe
  C:\Windows\System\qCazCZC.exe
  2⤵
  PID:9952
- C:\Windows\System\JrupZxl.exe
  C:\Windows\System\JrupZxl.exe
  2⤵
  PID:10444
- C:\Windows\System\jUGQbGS.exe
  C:\Windows\System\jUGQbGS.exe
  2⤵
  PID:10812
- C:\Windows\System\XRmvGtR.exe
  C:\Windows\System\XRmvGtR.exe
  2⤵
  PID:11288
- C:\Windows\System\MdcxoEN.exe
  C:\Windows\System\MdcxoEN.exe
  2⤵
  PID:11348
- C:\Windows\System\tVvEjrO.exe
  C:\Windows\System\tVvEjrO.exe
  2⤵
  PID:11392
- C:\Windows\System\yGNhcyB.exe
  C:\Windows\System\yGNhcyB.exe
  2⤵
  PID:11408
- C:\Windows\System\FTRWyJs.exe
  C:\Windows\System\FTRWyJs.exe
  2⤵
  PID:11448
- C:\Windows\System\ajiWAGT.exe
  C:\Windows\System\ajiWAGT.exe
  2⤵
  PID:11464
- C:\Windows\System\dnVrgWA.exe
  C:\Windows\System\dnVrgWA.exe
  2⤵
  PID:11484
- C:\Windows\System\pRNJvCc.exe
  C:\Windows\System\pRNJvCc.exe
  2⤵
  PID:11512
- C:\Windows\System\opNIfZF.exe
  C:\Windows\System\opNIfZF.exe
  2⤵
  PID:11540
- C:\Windows\System\cVteuYX.exe
  C:\Windows\System\cVteuYX.exe
  2⤵
  PID:11568
- C:\Windows\System\JqtTNUd.exe
  C:\Windows\System\JqtTNUd.exe
  2⤵
  PID:11584
- C:\Windows\System\cjqkMZr.exe
  C:\Windows\System\cjqkMZr.exe
  2⤵
  PID:11616
- C:\Windows\System\GgwWzvv.exe
  C:\Windows\System\GgwWzvv.exe
  2⤵
  PID:11660
- C:\Windows\System\YCsWyNw.exe
  C:\Windows\System\YCsWyNw.exe
  2⤵
  PID:11676
- C:\Windows\System\fhGZvfq.exe
  C:\Windows\System\fhGZvfq.exe
  2⤵
  PID:11708
- C:\Windows\System\MPauioA.exe
  C:\Windows\System\MPauioA.exe
  2⤵
  PID:11736
- C:\Windows\System\EHEPXsi.exe
  C:\Windows\System\EHEPXsi.exe
  2⤵
  PID:11756
- C:\Windows\System\MGGeddU.exe
  C:\Windows\System\MGGeddU.exe
  2⤵
  PID:11780
- C:\Windows\System\mhTVsQE.exe
  C:\Windows\System\mhTVsQE.exe
  2⤵
  PID:11824
- C:\Windows\System\xLqgNoR.exe
  C:\Windows\System\xLqgNoR.exe
  2⤵
  PID:11844
- C:\Windows\System\XZlqsVJ.exe
  C:\Windows\System\XZlqsVJ.exe
  2⤵
  PID:11868
- C:\Windows\System\qaaNKWb.exe
  C:\Windows\System\qaaNKWb.exe
  2⤵
  PID:11892
- C:\Windows\System\tOofLzy.exe
  C:\Windows\System\tOofLzy.exe
  2⤵
  PID:11912
- C:\Windows\System\gvFrSeY.exe
  C:\Windows\System\gvFrSeY.exe
  2⤵
  PID:11932
- C:\Windows\System\RczOpjG.exe
  C:\Windows\System\RczOpjG.exe
  2⤵
  PID:11968
- C:\Windows\System\qpfkXIb.exe
  C:\Windows\System\qpfkXIb.exe
  2⤵
  PID:11984
- C:\Windows\System\ioKywBR.exe
  C:\Windows\System\ioKywBR.exe
  2⤵
  PID:12000
- C:\Windows\System\wpXbaZd.exe
  C:\Windows\System\wpXbaZd.exe
  2⤵
  PID:12040
- C:\Windows\System\zRCbsge.exe
  C:\Windows\System\zRCbsge.exe
  2⤵
  PID:12064
- C:\Windows\System\EfaTJKl.exe
  C:\Windows\System\EfaTJKl.exe
  2⤵
  PID:12080
- C:\Windows\System\VwGtFSx.exe
  C:\Windows\System\VwGtFSx.exe
  2⤵
  PID:12100
- C:\Windows\System\ladRDHd.exe
  C:\Windows\System\ladRDHd.exe
  2⤵
  PID:12120
- C:\Windows\System\HFQuOqU.exe
  C:\Windows\System\HFQuOqU.exe
  2⤵
  PID:12140
- C:\Windows\System\Pmtyobj.exe
  C:\Windows\System\Pmtyobj.exe
  2⤵
  PID:12168
- C:\Windows\System\KUPUgdP.exe
  C:\Windows\System\KUPUgdP.exe
  2⤵
  PID:12184
- C:\Windows\System\lotYFBC.exe
  C:\Windows\System\lotYFBC.exe
  2⤵
  PID:12204
- C:\Windows\System\JNheJyv.exe
  C:\Windows\System\JNheJyv.exe
  2⤵
  PID:12220
- C:\Windows\System\nGRYGSi.exe
  C:\Windows\System\nGRYGSi.exe
  2⤵
  PID:12248
- C:\Windows\System\lESqndU.exe
  C:\Windows\System\lESqndU.exe
  2⤵
  PID:11276
- C:\Windows\System\yRasgow.exe
  C:\Windows\System\yRasgow.exe
  2⤵
  PID:10980
- C:\Windows\System\AEdqnOT.exe
  C:\Windows\System\AEdqnOT.exe
  2⤵
  PID:11528
- C:\Windows\System\vmhbrLW.exe
  C:\Windows\System\vmhbrLW.exe
  2⤵
  PID:11640
- C:\Windows\System\IujXinw.exe
  C:\Windows\System\IujXinw.exe
  2⤵
  PID:11692
- C:\Windows\System\SVEMzRP.exe
  C:\Windows\System\SVEMzRP.exe
  2⤵
  PID:11776
- C:\Windows\System\HSRAUjN.exe
  C:\Windows\System\HSRAUjN.exe
  2⤵
  PID:11884
- C:\Windows\System\arWuIES.exe
  C:\Windows\System\arWuIES.exe
  2⤵
  PID:11924
- C:\Windows\System\AkJZzhp.exe
  C:\Windows\System\AkJZzhp.exe
  2⤵
  PID:12028
- C:\Windows\System\uvEQBdC.exe
  C:\Windows\System\uvEQBdC.exe
  2⤵
  PID:12072
- C:\Windows\System\zTafAfu.exe
  C:\Windows\System\zTafAfu.exe
  2⤵
  PID:12096
- C:\Windows\System\hFdEyxs.exe
  C:\Windows\System\hFdEyxs.exe
  2⤵
  PID:12164
- C:\Windows\System\gXAGyrw.exe
  C:\Windows\System\gXAGyrw.exe
  2⤵
  PID:12212
- C:\Windows\System\HhSLspE.exe
  C:\Windows\System\HhSLspE.exe
  2⤵
  PID:11436
- C:\Windows\System\iUAzizE.exe
  C:\Windows\System\iUAzizE.exe
  2⤵
  PID:11196
- C:\Windows\System\wjADkil.exe
  C:\Windows\System\wjADkil.exe
  2⤵
  PID:11336
- C:\Windows\System\mbSmKDF.exe
  C:\Windows\System\mbSmKDF.exe
  2⤵
  PID:11556
- C:\Windows\System\kHkktiq.exe
  C:\Windows\System\kHkktiq.exe
  2⤵
  PID:11672
- C:\Windows\System\qAFhNQk.exe
  C:\Windows\System\qAFhNQk.exe
  2⤵
  PID:11752
- C:\Windows\System\JVSPUof.exe
  C:\Windows\System\JVSPUof.exe
  2⤵
  PID:11904
- C:\Windows\System\dzPzLYz.exe
  C:\Windows\System\dzPzLYz.exe
  2⤵
  PID:12060
- C:\Windows\System\eYqQYXE.exe
  C:\Windows\System\eYqQYXE.exe
  2⤵
  PID:12160
- C:\Windows\System\IjCxsrU.exe
  C:\Windows\System\IjCxsrU.exe
  2⤵
  PID:12280
- C:\Windows\System\jAmsIgu.exe
  C:\Windows\System\jAmsIgu.exe
  2⤵
  PID:12052
- C:\Windows\System\dlOfkfS.exe
  C:\Windows\System\dlOfkfS.exe
  2⤵
  PID:12292
- C:\Windows\System\hzcWnPa.exe
  C:\Windows\System\hzcWnPa.exe
  2⤵
  PID:12324
- C:\Windows\System\FOWTiVa.exe
  C:\Windows\System\FOWTiVa.exe
  2⤵
  PID:12340
- C:\Windows\System\DYKifcv.exe
  C:\Windows\System\DYKifcv.exe
  2⤵
  PID:12364
- C:\Windows\System\pXUlmTB.exe
  C:\Windows\System\pXUlmTB.exe
  2⤵
  PID:12380
- C:\Windows\System\BdwGUvR.exe
  C:\Windows\System\BdwGUvR.exe
  2⤵
  PID:12400
- C:\Windows\System\FfnEvAT.exe
  C:\Windows\System\FfnEvAT.exe
  2⤵
  PID:12524
- C:\Windows\System\nRtttQg.exe
  C:\Windows\System\nRtttQg.exe
  2⤵
  PID:12552
- C:\Windows\System\ofnrlmt.exe
  C:\Windows\System\ofnrlmt.exe
  2⤵
  PID:12572
- C:\Windows\System\YzyfAAt.exe
  C:\Windows\System\YzyfAAt.exe
  2⤵
  PID:12596
- C:\Windows\System\XarnYqF.exe
  C:\Windows\System\XarnYqF.exe
  2⤵
  PID:12616
- C:\Windows\System\EKYlptM.exe
  C:\Windows\System\EKYlptM.exe
  2⤵
  PID:12632
- C:\Windows\System\EulbTCe.exe
  C:\Windows\System\EulbTCe.exe
  2⤵
  PID:12652
- C:\Windows\System\ESoocpz.exe
  C:\Windows\System\ESoocpz.exe
  2⤵
  PID:12696
- C:\Windows\System\YKNlQpy.exe
  C:\Windows\System\YKNlQpy.exe
  2⤵
  PID:12744
- C:\Windows\System\kdthhyQ.exe
  C:\Windows\System\kdthhyQ.exe
  2⤵
  PID:12772
- C:\Windows\System\bBgPrkn.exe
  C:\Windows\System\bBgPrkn.exe
  2⤵
  PID:12804
- C:\Windows\System\bsQHdwR.exe
  C:\Windows\System\bsQHdwR.exe
  2⤵
  PID:12844
- C:\Windows\System\xCKPcqU.exe
  C:\Windows\System\xCKPcqU.exe
  2⤵
  PID:12864
- C:\Windows\System\NQoCoEY.exe
  C:\Windows\System\NQoCoEY.exe
  2⤵
  PID:12888
- C:\Windows\System\MuTzDUZ.exe
  C:\Windows\System\MuTzDUZ.exe
  2⤵
  PID:12908
- C:\Windows\System\MAuIHAW.exe
  C:\Windows\System\MAuIHAW.exe
  2⤵
  PID:12948
- C:\Windows\System\gTKksDG.exe
  C:\Windows\System\gTKksDG.exe
  2⤵
  PID:12972
- C:\Windows\System\CrXEcfU.exe
  C:\Windows\System\CrXEcfU.exe
  2⤵
  PID:12992
- C:\Windows\System\jIXGNJR.exe
  C:\Windows\System\jIXGNJR.exe
  2⤵
  PID:13032
- C:\Windows\System\ESwLRuh.exe
  C:\Windows\System\ESwLRuh.exe
  2⤵
  PID:13052
- C:\Windows\System\IoHNwFj.exe
  C:\Windows\System\IoHNwFj.exe
  2⤵
  PID:13088
- C:\Windows\System\tafAXyP.exe
  C:\Windows\System\tafAXyP.exe
  2⤵
  PID:13124
- C:\Windows\System\nyGSRdK.exe
  C:\Windows\System\nyGSRdK.exe
  2⤵
  PID:13140
- C:\Windows\System\CWdmSGZ.exe
  C:\Windows\System\CWdmSGZ.exe
  2⤵
  PID:13168
- C:\Windows\System\ndLrqJj.exe
  C:\Windows\System\ndLrqJj.exe
  2⤵
  PID:13188
- C:\Windows\System\bmtyOzi.exe
  C:\Windows\System\bmtyOzi.exe
  2⤵
  PID:13232
- C:\Windows\System\yMcIuos.exe
  C:\Windows\System\yMcIuos.exe
  2⤵
  PID:13252
- C:\Windows\System\rGUXMuW.exe
  C:\Windows\System\rGUXMuW.exe
  2⤵
  PID:13292
- C:\Windows\System\BpNbfhc.exe
  C:\Windows\System\BpNbfhc.exe
  2⤵
  PID:11920
- C:\Windows\System\MBxoiMQ.exe
  C:\Windows\System\MBxoiMQ.exe
  2⤵
  PID:12320
- C:\Windows\System\AlpzamZ.exe
  C:\Windows\System\AlpzamZ.exe
  2⤵
  PID:12360
- C:\Windows\System\FlxCfNN.exe
  C:\Windows\System\FlxCfNN.exe
  2⤵
  PID:12428
- C:\Windows\System\dvolHrL.exe
  C:\Windows\System\dvolHrL.exe
  2⤵
  PID:12472
- C:\Windows\System\xHNMhXZ.exe
  C:\Windows\System\xHNMhXZ.exe
  2⤵
  PID:12496
- C:\Windows\System\LNfQkmh.exe
  C:\Windows\System\LNfQkmh.exe
  2⤵
  PID:12504
- C:\Windows\System\wihsryn.exe
  C:\Windows\System\wihsryn.exe
  2⤵
  PID:12564
- C:\Windows\System\dKiPaRi.exe
  C:\Windows\System\dKiPaRi.exe
  2⤵
  PID:12668
- C:\Windows\System\TxwiPWI.exe
  C:\Windows\System\TxwiPWI.exe
  2⤵
  PID:12860
- C:\Windows\System\fAYIgLi.exe
  C:\Windows\System\fAYIgLi.exe
  2⤵
  PID:12920
- C:\Windows\System\sxVnieY.exe
  C:\Windows\System\sxVnieY.exe
  2⤵
  PID:12956
- C:\Windows\System\aLQWQRH.exe
  C:\Windows\System\aLQWQRH.exe
  2⤵
  PID:12968
- C:\Windows\System\kaKsfbm.exe
  C:\Windows\System\kaKsfbm.exe
  2⤵
  PID:12988
- C:\Windows\System\EqHLZpI.exe
  C:\Windows\System\EqHLZpI.exe
  2⤵
  PID:13044
- C:\Windows\System\UxFRZnp.exe
  C:\Windows\System\UxFRZnp.exe
  2⤵
  PID:13132
- C:\Windows\System\kNJnvQC.exe
  C:\Windows\System\kNJnvQC.exe
  2⤵
  PID:13112
- C:\Windows\System\oeByMJU.exe
  C:\Windows\System\oeByMJU.exe
  2⤵
  PID:13180
- C:\Windows\System\MOyOgLQ.exe
  C:\Windows\System\MOyOgLQ.exe
  2⤵
  PID:13272
- C:\Windows\System\eZzoXAq.exe
  C:\Windows\System\eZzoXAq.exe
  2⤵
  PID:11552
- C:\Windows\System\jcFEjSS.exe
  C:\Windows\System\jcFEjSS.exe
  2⤵
  PID:12312
- C:\Windows\System\tKGqALY.exe
  C:\Windows\System\tKGqALY.exe
  2⤵
  PID:12356
- C:\Windows\System\qtArDaY.exe
  C:\Windows\System\qtArDaY.exe
  2⤵
  PID:12452
- C:\Windows\System\GJNCveW.exe
  C:\Windows\System\GJNCveW.exe
  2⤵
  PID:12588
- C:\Windows\System\cRkrDmo.exe
  C:\Windows\System\cRkrDmo.exe
  2⤵
  PID:12780
- C:\Windows\System\MUjqZcA.exe
  C:\Windows\System\MUjqZcA.exe
  2⤵
  PID:12752
- C:\Windows\System\sqWTdiK.exe
  C:\Windows\System\sqWTdiK.exe
  2⤵
  PID:13284
- C:\Windows\System\OsrdkGE.exe
  C:\Windows\System\OsrdkGE.exe
  2⤵
  PID:12720
- C:\Windows\System\pDpGJcJ.exe
  C:\Windows\System\pDpGJcJ.exe
  2⤵
  PID:12944
- C:\Windows\System\ZjwGtGD.exe
  C:\Windows\System\ZjwGtGD.exe
  2⤵
  PID:13360
- C:\Windows\System\zXAKOMg.exe
  C:\Windows\System\zXAKOMg.exe
  2⤵
  PID:13380
- C:\Windows\System\CAbANVU.exe
  C:\Windows\System\CAbANVU.exe
  2⤵
  PID:13400
- C:\Windows\System\KkqxoFV.exe
  C:\Windows\System\KkqxoFV.exe
  2⤵
  PID:14200
- C:\Windows\System\LbSfoHV.exe
  C:\Windows\System\LbSfoHV.exe
  2⤵
  PID:14240
- C:\Windows\System\nNZWtky.exe
  C:\Windows\System\nNZWtky.exe
  2⤵
  PID:14268
- C:\Windows\System\WGxvKNo.exe
  C:\Windows\System\WGxvKNo.exe
  2⤵
  PID:14292
- C:\Windows\System\HKhlhdy.exe
  C:\Windows\System\HKhlhdy.exe
  2⤵
  PID:14328
- C:\Windows\System\HfnQExF.exe
  C:\Windows\System\HfnQExF.exe
  2⤵
  PID:13184
- C:\Windows\System\sKHbJdG.exe
  C:\Windows\System\sKHbJdG.exe
  2⤵
  PID:13484
- C:\Windows\System\oUvxssC.exe
  C:\Windows\System\oUvxssC.exe
  2⤵
  PID:13768
- C:\Windows\System\QlBfKPH.exe
  C:\Windows\System\QlBfKPH.exe
  2⤵
  PID:13800
- C:\Windows\System\xANWoeH.exe
  C:\Windows\System\xANWoeH.exe
  2⤵
  PID:13672
- C:\Windows\System\walHWAW.exe
  C:\Windows\System\walHWAW.exe
  2⤵
  PID:13748
- C:\Windows\System\GTrZskv.exe
  C:\Windows\System\GTrZskv.exe
  2⤵
  PID:3880
- C:\Windows\System\wUOYSRs.exe
  C:\Windows\System\wUOYSRs.exe
  2⤵
  PID:13740
- C:\Windows\System\dhdoOjP.exe
  C:\Windows\System\dhdoOjP.exe
  2⤵
  PID:14224
- C:\Windows\System\dMZKlOj.exe
  C:\Windows\System\dMZKlOj.exe
  2⤵
  PID:13764
- C:\Windows\System\GSNrCCB.exe
  C:\Windows\System\GSNrCCB.exe
  2⤵
  PID:13788
- C:\Windows\System\YpOjYzl.exe
  C:\Windows\System\YpOjYzl.exe
  2⤵
  PID:13832
- C:\Windows\System\HakvvDx.exe
  C:\Windows\System\HakvvDx.exe
  2⤵
  PID:13840
- C:\Windows\System\qLbIlyj.exe
  C:\Windows\System\qLbIlyj.exe
  2⤵
  PID:13864
- C:\Windows\System\lyUTtDE.exe
  C:\Windows\System\lyUTtDE.exe
  2⤵
  PID:13868
- C:\Windows\System\eoeNpuj.exe
  C:\Windows\System\eoeNpuj.exe
  2⤵
  PID:13912
- C:\Windows\System\lLihfHG.exe
  C:\Windows\System\lLihfHG.exe
  2⤵
  PID:13936
- C:\Windows\System\LlDZZud.exe
  C:\Windows\System\LlDZZud.exe
  2⤵
  PID:13968
- C:\Windows\System\CBWzJqc.exe
  C:\Windows\System\CBWzJqc.exe
  2⤵
  PID:13996
- C:\Windows\System\WixRYNj.exe
  C:\Windows\System\WixRYNj.exe
  2⤵
  PID:14020
- C:\Windows\System\tLttmBM.exe
  C:\Windows\System\tLttmBM.exe
  2⤵
  PID:14036
- C:\Windows\System\kZcuIbq.exe
  C:\Windows\System\kZcuIbq.exe
  2⤵
  PID:14052
- C:\Windows\System\RsgXovZ.exe
  C:\Windows\System\RsgXovZ.exe
  2⤵
  PID:14068
- C:\Windows\System\rvekrII.exe
  C:\Windows\System\rvekrII.exe
  2⤵
  PID:14084
- C:\Windows\System\nkXinEr.exe
  C:\Windows\System\nkXinEr.exe
  2⤵
  PID:14100
- C:\Windows\System\uGYxijO.exe
  C:\Windows\System\uGYxijO.exe
  2⤵
  PID:14112
- C:\Windows\System\PqQJNir.exe
  C:\Windows\System\PqQJNir.exe
  2⤵
  PID:3784
- C:\Windows\System\XogjaWN.exe
  C:\Windows\System\XogjaWN.exe
  2⤵
  PID:376
- C:\Windows\System\FcVEYwf.exe
  C:\Windows\System\FcVEYwf.exe
  2⤵
  PID:1240
- C:\Windows\System\wgHeTOU.exe
  C:\Windows\System\wgHeTOU.exe
  2⤵
  PID:1304
- C:\Windows\System\qnZIwCg.exe
  C:\Windows\System\qnZIwCg.exe
  2⤵
  PID:14192
- C:\Windows\System\yAOgrTm.exe
  C:\Windows\System\yAOgrTm.exe
  2⤵
  PID:13372
- C:\Windows\System\oKeeayA.exe
  C:\Windows\System\oKeeayA.exe
  2⤵
  PID:13408
- C:\Windows\System\MGqMLYV.exe
  C:\Windows\System\MGqMLYV.exe
  2⤵
  PID:13448
- C:\Windows\System\gotgcIG.exe
  C:\Windows\System\gotgcIG.exe
  2⤵
  PID:13532
- C:\Windows\System\IvUfLog.exe
  C:\Windows\System\IvUfLog.exe
  2⤵
  PID:1516
- C:\Windows\System\vSummnj.exe
  C:\Windows\System\vSummnj.exe
  2⤵
  PID:13728
- C:\Windows\System\ykcJJkg.exe
  C:\Windows\System\ykcJJkg.exe
  2⤵
  PID:13828
- C:\Windows\System\htoKxBx.exe
  C:\Windows\System\htoKxBx.exe
  2⤵
  PID:13876
- C:\Windows\System\eyENfOj.exe
  C:\Windows\System\eyENfOj.exe
  2⤵
  PID:1748
- C:\Windows\System\avJTdmv.exe
  C:\Windows\System\avJTdmv.exe
  2⤵
  PID:12540
- C:\Windows\System\vqmAsxg.exe
  C:\Windows\System\vqmAsxg.exe
  2⤵
  PID:14216
- C:\Windows\System\fcLXBuK.exe
  C:\Windows\System\fcLXBuK.exe
  2⤵
  PID:14028
- C:\Windows\System\oTLUGhP.exe
  C:\Windows\System\oTLUGhP.exe
  2⤵
  PID:14180
- C:\Windows\System\YbPenuy.exe
  C:\Windows\System\YbPenuy.exe
  2⤵
  PID:3004
- C:\Windows\System\YPFECWs.exe
  C:\Windows\System\YPFECWs.exe
  2⤵
  PID:14152
- C:\Windows\System\OshsxDD.exe
  C:\Windows\System\OshsxDD.exe
  2⤵
  PID:14160
- C:\Windows\System\FLtmZdV.exe
  C:\Windows\System\FLtmZdV.exe
  2⤵
  PID:14228
- C:\Windows\System\ZFQjVQN.exe
  C:\Windows\System\ZFQjVQN.exe
  2⤵
  PID:13716
- C:\Windows\System\pYxeXBr.exe
  C:\Windows\System\pYxeXBr.exe
  2⤵
  PID:13456
- C:\Windows\System\owGjnSe.exe
  C:\Windows\System\owGjnSe.exe
  2⤵
  PID:5680
- C:\Windows\System\otRYEOD.exe
  C:\Windows\System\otRYEOD.exe
  2⤵
  PID:5316
- C:\Windows\System\NdByyJO.exe
  C:\Windows\System\NdByyJO.exe
  2⤵
  PID:13420
- C:\Windows\System\PlwaDGn.exe
  C:\Windows\System\PlwaDGn.exe
  2⤵
  PID:14308
- C:\Windows\System\vFwldxg.exe
  C:\Windows\System\vFwldxg.exe
  2⤵
  PID:13604
- C:\Windows\System\cauNeYe.exe
  C:\Windows\System\cauNeYe.exe
  2⤵
  PID:13432
- C:\Windows\System\OlZgKZV.exe
  C:\Windows\System\OlZgKZV.exe
  2⤵
  PID:13472
- C:\Windows\System\uHdIUPX.exe
  C:\Windows\System\uHdIUPX.exe
  2⤵
  PID:13556
- C:\Windows\System\BAaeUrg.exe
  C:\Windows\System\BAaeUrg.exe
  2⤵
  PID:13636
- C:\Windows\System\qleOUrF.exe
  C:\Windows\System\qleOUrF.exe
  2⤵
  PID:13616
- C:\Windows\System\AUjdntw.exe
  C:\Windows\System\AUjdntw.exe
  2⤵
  PID:13568
- C:\Windows\System\MOUVTgz.exe
  C:\Windows\System\MOUVTgz.exe
  2⤵
  PID:13680
- C:\Windows\System\IAVfftl.exe
  C:\Windows\System\IAVfftl.exe
  2⤵
  PID:13664
- C:\Windows\System\sbrULiP.exe
  C:\Windows\System\sbrULiP.exe
  2⤵
  PID:856
- C:\Windows\System\eyXzrii.exe
  C:\Windows\System\eyXzrii.exe
  2⤵
  PID:1460
- C:\Windows\System\LICZckG.exe
  C:\Windows\System\LICZckG.exe
  2⤵
  PID:3952
- C:\Windows\System\TmBjYiV.exe
  C:\Windows\System\TmBjYiV.exe
  2⤵
  PID:2088
- C:\Windows\System\sdrdpXj.exe
  C:\Windows\System\sdrdpXj.exe
  2⤵
  PID:2644
- C:\Windows\System\TAOqhJb.exe
  C:\Windows\System\TAOqhJb.exe
  2⤵
  PID:5428
- C:\Windows\System\KTUdbQo.exe
  C:\Windows\System\KTUdbQo.exe
  2⤵
  PID:13696
- C:\Windows\System\xCcSska.exe
  C:\Windows\System\xCcSska.exe
  2⤵
  PID:3092
- C:\Windows\System\OKSKLrv.exe
  C:\Windows\System\OKSKLrv.exe
  2⤵
  PID:2616
- C:\Windows\System\wlfdvrx.exe
  C:\Windows\System\wlfdvrx.exe
  2⤵
  PID:13984
- C:\Windows\System\qKpbCuF.exe
  C:\Windows\System\qKpbCuF.exe
  2⤵
  PID:4864
- C:\Windows\System\NIemCKt.exe
  C:\Windows\System\NIemCKt.exe
  2⤵
  PID:4528
- C:\Windows\System\LGNPjkJ.exe
  C:\Windows\System\LGNPjkJ.exe
  2⤵
  PID:14016
- C:\Windows\System\IkzNXEY.exe
  C:\Windows\System\IkzNXEY.exe
  2⤵
  PID:6964
- C:\Windows\System\yuvnqUy.exe
  C:\Windows\System\yuvnqUy.exe
  2⤵
  PID:4904
- C:\Windows\System\BxTNtTA.exe
  C:\Windows\System\BxTNtTA.exe
  2⤵
  PID:6984
- C:\Windows\System\bXiSOBi.exe
  C:\Windows\System\bXiSOBi.exe
  2⤵
  PID:14096
- C:\Windows\System\YrviBmW.exe
  C:\Windows\System\YrviBmW.exe
  2⤵
  PID:14144
- C:\Windows\System\rdGQyLQ.exe
  C:\Windows\System\rdGQyLQ.exe
  2⤵
  PID:1236
- C:\Windows\System\qBtOGJS.exe
  C:\Windows\System\qBtOGJS.exe
  2⤵
  PID:6404
- C:\Windows\System\ZFQafKT.exe
  C:\Windows\System\ZFQafKT.exe
  2⤵
  PID:6928
- C:\Windows\System\ytfzJUW.exe
  C:\Windows\System\ytfzJUW.exe
  2⤵
  PID:13520
- C:\Windows\System\oBxzpiy.exe
  C:\Windows\System\oBxzpiy.exe
  2⤵
  PID:4524
- C:\Windows\System\pgHnVfx.exe
  C:\Windows\System\pgHnVfx.exe
  2⤵
  PID:1720
- C:\Windows\System\MINchYp.exe
  C:\Windows\System\MINchYp.exe
  2⤵
  PID:7252
- C:\Windows\System\BcYnztT.exe
  C:\Windows\System\BcYnztT.exe
  2⤵
  PID:7452
- C:\Windows\System\RIPvtAq.exe
  C:\Windows\System\RIPvtAq.exe
  2⤵
  PID:7508
- C:\Windows\System\TOdBWYm.exe
  C:\Windows\System\TOdBWYm.exe
  2⤵
  PID:7500
- C:\Windows\System\jESncTB.exe
  C:\Windows\System\jESncTB.exe
  2⤵
  PID:7504
- C:\Windows\System\HDaQbSn.exe
  C:\Windows\System\HDaQbSn.exe
  2⤵
  PID:7652
- C:\Windows\System\DWPSbqB.exe
  C:\Windows\System\DWPSbqB.exe
  2⤵
  PID:7660
- C:\Windows\System\wBLIKzg.exe
  C:\Windows\System\wBLIKzg.exe
  2⤵
  PID:4920
- C:\Windows\System\LhtKzON.exe
  C:\Windows\System\LhtKzON.exe
  2⤵
  PID:5060
- C:\Windows\System\dEbybkG.exe
  C:\Windows\System\dEbybkG.exe
  2⤵
  PID:7844
- C:\Windows\System\gHImMPv.exe
  C:\Windows\System\gHImMPv.exe
  2⤵
  PID:7900
- C:\Windows\System\TjqUedU.exe
  C:\Windows\System\TjqUedU.exe
  2⤵
  PID:14004
- C:\Windows\System\QaFMWYb.exe
  C:\Windows\System\QaFMWYb.exe
  2⤵
  PID:13336
- C:\Windows\System\WAmFoUo.exe
  C:\Windows\System\WAmFoUo.exe
  2⤵
  PID:13528
- C:\Windows\System\NbUWQli.exe
  C:\Windows\System\NbUWQli.exe
  2⤵
  PID:2576
- C:\Windows\System\xFCCSch.exe
  C:\Windows\System\xFCCSch.exe
  2⤵
  PID:8080
- C:\Windows\System\zMutNzM.exe
  C:\Windows\System\zMutNzM.exe
  2⤵
  PID:7212
- C:\Windows\System\BMICWlg.exe
  C:\Windows\System\BMICWlg.exe
  2⤵
  PID:4660
- C:\Windows\System\qDyxrvf.exe
  C:\Windows\System\qDyxrvf.exe
  2⤵
  PID:812
- C:\Windows\System\GDkKXvE.exe
  C:\Windows\System\GDkKXvE.exe
  2⤵
  PID:5488
- C:\Windows\System\qaOrRbc.exe
  C:\Windows\System\qaOrRbc.exe
  2⤵
  PID:7304
- C:\Windows\System\mrqLOGM.exe
  C:\Windows\System\mrqLOGM.exe
  2⤵
  PID:7364
- C:\Windows\System\JxwKUcL.exe
  C:\Windows\System\JxwKUcL.exe
  2⤵
  PID:7708
- C:\Windows\System\xKrOPyi.exe
  C:\Windows\System\xKrOPyi.exe
  2⤵
  PID:13588
- C:\Windows\System\olPFffJ.exe
  C:\Windows\System\olPFffJ.exe
  2⤵
  PID:1064
- C:\Windows\System\jxkHSWT.exe
  C:\Windows\System\jxkHSWT.exe
  2⤵
  PID:560
- C:\Windows\System\rYHiEFT.exe
  C:\Windows\System\rYHiEFT.exe
  2⤵
  PID:7932
- C:\Windows\System\bUchgwL.exe
  C:\Windows\System\bUchgwL.exe
  2⤵
  PID:13628
- C:\Windows\System\VuoMvaL.exe
  C:\Windows\System\VuoMvaL.exe
  2⤵
  PID:4608
- C:\Windows\System\qvRNMfG.exe
  C:\Windows\System\qvRNMfG.exe
  2⤵
  PID:8004
- C:\Windows\System\iybYorz.exe
  C:\Windows\System\iybYorz.exe
  2⤵
  PID:7216
- C:\Windows\System\WRbKnom.exe
  C:\Windows\System\WRbKnom.exe
  2⤵
  PID:7448
- C:\Windows\System\UzIhIEe.exe
  C:\Windows\System\UzIhIEe.exe
  2⤵
  PID:8048
- C:\Windows\System\SENbqXj.exe
  C:\Windows\System\SENbqXj.exe
  2⤵
  PID:7192
- C:\Windows\System\WVWebUH.exe
  C:\Windows\System\WVWebUH.exe
  2⤵
  PID:8440
- C:\Windows\System\VACzXZZ.exe
  C:\Windows\System\VACzXZZ.exe
  2⤵
  PID:4536
- C:\Windows\System\XYgFbYJ.exe
  C:\Windows\System\XYgFbYJ.exe
  2⤵
  PID:3568
- C:\Windows\System\zLoMTXo.exe
  C:\Windows\System\zLoMTXo.exe
  2⤵
  PID:2220
- C:\Windows\System\WqyUZFe.exe
  C:\Windows\System\WqyUZFe.exe
  2⤵
  PID:4052
- C:\Windows\System\aHiKlhx.exe
  C:\Windows\System\aHiKlhx.exe
  2⤵
  PID:2000
- C:\Windows\System\RutBxBg.exe
  C:\Windows\System\RutBxBg.exe
  2⤵
  PID:3980
- C:\Windows\System\ttzNTVj.exe
  C:\Windows\System\ttzNTVj.exe
  2⤵
  PID:12784
- C:\Windows\System\gPiidDs.exe
  C:\Windows\System\gPiidDs.exe
  2⤵
  PID:5044
- C:\Windows\System\vxuJaix.exe
  C:\Windows\System\vxuJaix.exe
  2⤵
  PID:1484
- C:\Windows\System\bvnspKb.exe
  C:\Windows\System\bvnspKb.exe
  2⤵
  PID:440
- C:\Windows\System\ZgYMyfW.exe
  C:\Windows\System\ZgYMyfW.exe
  2⤵
  PID:13712
- C:\Windows\System\zrqqLEF.exe
  C:\Windows\System\zrqqLEF.exe
  2⤵
  PID:13720
- C:\Windows\System\PGAEZGL.exe
  C:\Windows\System\PGAEZGL.exe
  2⤵
  PID:9064
- C:\Windows\System\XTQLJVh.exe
  C:\Windows\System\XTQLJVh.exe
  2⤵
  PID:5020
- C:\Windows\System\uErdFJQ.exe
  C:\Windows\System\uErdFJQ.exe
  2⤵
  PID:2504
- C:\Windows\System\NJkuzPw.exe
  C:\Windows\System\NJkuzPw.exe
  2⤵
  PID:1232
- C:\Windows\System\RdFrkuk.exe
  C:\Windows\System\RdFrkuk.exe
  2⤵
  PID:2328
- C:\Windows\System\PQrvLFt.exe
  C:\Windows\System\PQrvLFt.exe
  2⤵
  PID:13776
- C:\Windows\System\MrOEKHJ.exe
  C:\Windows\System\MrOEKHJ.exe
  2⤵
  PID:13836
- C:\Windows\System\VmIQyOK.exe
  C:\Windows\System\VmIQyOK.exe
  2⤵
  PID:14076
- C:\Windows\System\BxtrTUf.exe
  C:\Windows\System\BxtrTUf.exe
  2⤵
  PID:3388
- C:\Windows\System\IwhnxnL.exe
  C:\Windows\System\IwhnxnL.exe
  2⤵
  PID:14064
- C:\Windows\System\fTyaMcw.exe
  C:\Windows\System\fTyaMcw.exe
  2⤵
  PID:4708
- C:\Windows\System\rmzdJWj.exe
  C:\Windows\System\rmzdJWj.exe
  2⤵
  PID:2492
- C:\Windows\System\XjLYwsM.exe
  C:\Windows\System\XjLYwsM.exe
  2⤵
  PID:1060
- C:\Windows\System\iRwdvYm.exe
  C:\Windows\System\iRwdvYm.exe
  2⤵
  PID:4892
- C:\Windows\System\Pzrhcwh.exe
  C:\Windows\System\Pzrhcwh.exe
  2⤵
  PID:6644
- C:\Windows\System\SCaCAIw.exe
  C:\Windows\System\SCaCAIw.exe
  2⤵
  PID:1324
- C:\Windows\System\bGxRzEJ.exe
  C:\Windows\System\bGxRzEJ.exe
  2⤵
  PID:13860
- C:\Windows\System\UKvnTgi.exe
  C:\Windows\System\UKvnTgi.exe
  2⤵
  PID:6628
- C:\Windows\System\mUjAnJD.exe
  C:\Windows\System\mUjAnJD.exe
  2⤵
  PID:4200
- C:\Windows\System\wyBPNtb.exe
  C:\Windows\System\wyBPNtb.exe
  2⤵
  PID:316
- C:\Windows\System\WnJjaEx.exe
  C:\Windows\System\WnJjaEx.exe
  2⤵
  PID:6584
- C:\Windows\System\AcTaEXO.exe
  C:\Windows\System\AcTaEXO.exe
  2⤵
  PID:14128
- C:\Windows\System\JLSZGBP.exe
  C:\Windows\System\JLSZGBP.exe
  2⤵
  PID:7460
- C:\Windows\System\vRzzfIL.exe
  C:\Windows\System\vRzzfIL.exe
  2⤵
  PID:4984
- C:\Windows\System\ZlrSsUs.exe
  C:\Windows\System\ZlrSsUs.exe
  2⤵
  PID:7380
- C:\Windows\System\UbEMCIL.exe
  C:\Windows\System\UbEMCIL.exe
  2⤵
  PID:2988
- C:\Windows\System\Tobrjqw.exe
  C:\Windows\System\Tobrjqw.exe
  2⤵
  PID:3636
- C:\Windows\System\moMgWyn.exe
  C:\Windows\System\moMgWyn.exe
  2⤵
  PID:7688
- C:\Windows\System\IiFsipL.exe
  C:\Windows\System\IiFsipL.exe
  2⤵
  PID:5432
- C:\Windows\System\JbudhzX.exe
  C:\Windows\System\JbudhzX.exe
  2⤵
  PID:2672
- C:\Windows\System\MnNAXJZ.exe
  C:\Windows\System\MnNAXJZ.exe
  2⤵
  PID:13352
- C:\Windows\System\NHyHoIc.exe
  C:\Windows\System\NHyHoIc.exe
  2⤵
  PID:7264
- C:\Windows\System\jTftxuU.exe
  C:\Windows\System\jTftxuU.exe
  2⤵
  PID:5168
- C:\Windows\System\bdrAOam.exe
  C:\Windows\System\bdrAOam.exe
  2⤵
  PID:5204
- C:\Windows\System\gqCeXwu.exe
  C:\Windows\System\gqCeXwu.exe
  2⤵
  PID:5968
- C:\Windows\System\zKwnpCK.exe
  C:\Windows\System\zKwnpCK.exe
  2⤵
  PID:13544
- C:\Windows\System\hOfLVhI.exe
  C:\Windows\System\hOfLVhI.exe
  2⤵
  PID:7388
- C:\Windows\System\uVsnCPZ.exe
  C:\Windows\System\uVsnCPZ.exe
  2⤵
  PID:780
- C:\Windows\System\lCkkACq.exe
  C:\Windows\System\lCkkACq.exe
  2⤵
  PID:5376
- C:\Windows\System\pUbmzXS.exe
  C:\Windows\System\pUbmzXS.exe
  2⤵
  PID:13376
- C:\Windows\System\EzQbBlx.exe
  C:\Windows\System\EzQbBlx.exe
  2⤵
  PID:13620
- C:\Windows\System\ZBTHswL.exe
  C:\Windows\System\ZBTHswL.exe
  2⤵
  PID:7792
- C:\Windows\System\CCHrNiO.exe
  C:\Windows\System\CCHrNiO.exe
  2⤵
  PID:5336
- C:\Windows\System\kzVUBqr.exe
  C:\Windows\System\kzVUBqr.exe
  2⤵
  PID:5388
- C:\Windows\System\uBnQtfN.exe
  C:\Windows\System\uBnQtfN.exe
  2⤵
  PID:5436
- C:\Windows\System\Xmqhqwh.exe
  C:\Windows\System\Xmqhqwh.exe
  2⤵
  PID:8316
- C:\Windows\System\HsyrJTn.exe
  C:\Windows\System\HsyrJTn.exe
  2⤵
  PID:8400
- C:\Windows\System\cgYsjMb.exe
  C:\Windows\System\cgYsjMb.exe
  2⤵
  PID:8044
- C:\Windows\System\kWdUPkB.exe
  C:\Windows\System\kWdUPkB.exe
  2⤵
  PID:13880
- C:\Windows\System\iJlPalP.exe
  C:\Windows\System\iJlPalP.exe
  2⤵
  PID:8104
- C:\Windows\System\BbCulrO.exe
  C:\Windows\System\BbCulrO.exe
  2⤵
  PID:2468
- C:\Windows\System\fnTBvvU.exe
  C:\Windows\System\fnTBvvU.exe
  2⤵
  PID:13684
- C:\Windows\System\XeyUjkR.exe
  C:\Windows\System\XeyUjkR.exe
  2⤵
  PID:14136
- C:\Windows\System\IBloDyc.exe
  C:\Windows\System\IBloDyc.exe
  2⤵
  PID:13708
- C:\Windows\System\HjvotQc.exe
  C:\Windows\System\HjvotQc.exe
  2⤵
  PID:5480
- C:\Windows\System\LAJEvTk.exe
  C:\Windows\System\LAJEvTk.exe
  2⤵
  PID:5528
- C:\Windows\System\FTcPCQN.exe
  C:\Windows\System\FTcPCQN.exe
  2⤵
  PID:1136
- C:\Windows\System\AOlLZew.exe
  C:\Windows\System\AOlLZew.exe
  2⤵
  PID:2908
- C:\Windows\System\eaPSXJm.exe
  C:\Windows\System\eaPSXJm.exe
  2⤵
  PID:9024
- C:\Windows\System\eSvRplG.exe
  C:\Windows\System\eSvRplG.exe
  2⤵
  PID:5612
- C:\Windows\System\tskGpuz.exe
  C:\Windows\System\tskGpuz.exe
  2⤵
  PID:3024
- C:\Windows\System\RbfmCBa.exe
  C:\Windows\System\RbfmCBa.exe
  2⤵
  PID:13848
- C:\Windows\System\cFpQyjp.exe
  C:\Windows\System\cFpQyjp.exe
  2⤵
  PID:3988
- C:\Windows\System\zZctoZn.exe
  C:\Windows\System\zZctoZn.exe
  2⤵
  PID:13820
- C:\Windows\System\COyERbL.exe
  C:\Windows\System\COyERbL.exe
  2⤵
  PID:2400
- C:\Windows\System\mZMKNiL.exe
  C:\Windows\System\mZMKNiL.exe
  2⤵
  PID:5624
- C:\Windows\System\LyYvMBR.exe
  C:\Windows\System\LyYvMBR.exe
  2⤵
  PID:9076
- C:\Windows\System\UlWQYro.exe
  C:\Windows\System\UlWQYro.exe
  2⤵
  PID:336
- C:\Windows\System\oSMPTLy.exe
  C:\Windows\System\oSMPTLy.exe
  2⤵
  PID:5712
- C:\Windows\System\WRRrIfH.exe
  C:\Windows\System\WRRrIfH.exe
  2⤵
  PID:3532
- C:\Windows\System\ZewgLPK.exe
  C:\Windows\System\ZewgLPK.exe
  2⤵
  PID:2132
- C:\Windows\System\WMsKneI.exe
  C:\Windows\System\WMsKneI.exe
  2⤵
  PID:5768
- C:\Windows\System\vvcuFIn.exe
  C:\Windows\System\vvcuFIn.exe
  2⤵
  PID:14168
- C:\Windows\System\VHyNHin.exe
  C:\Windows\System\VHyNHin.exe
  2⤵
  PID:3240
- C:\Windows\System\xyOGked.exe
  C:\Windows\System\xyOGked.exe
  2⤵
  PID:5840
- C:\Windows\System\dgWTved.exe
  C:\Windows\System\dgWTved.exe
  2⤵
  PID:10168
- C:\Windows\System\bHsFPbR.exe
  C:\Windows\System\bHsFPbR.exe
  2⤵
  PID:5880
- C:\Windows\System\iMIfgjb.exe
  C:\Windows\System\iMIfgjb.exe
  2⤵
  PID:468
- C:\Windows\System\BCdcqLU.exe
  C:\Windows\System\BCdcqLU.exe
  2⤵
  PID:7444
- C:\Windows\System\LpfpfjE.exe
  C:\Windows\System\LpfpfjE.exe
  2⤵
  PID:6024
- C:\Windows\System\RBEIRYK.exe
  C:\Windows\System\RBEIRYK.exe
  2⤵
  PID:1792
- C:\Windows\System\GUrUNSf.exe
  C:\Windows\System\GUrUNSf.exe
  2⤵
  PID:7464
- C:\Windows\System\LLSJZls.exe
  C:\Windows\System\LLSJZls.exe
  2⤵
  PID:6132
- C:\Windows\System\wVZZcBA.exe
  C:\Windows\System\wVZZcBA.exe
  2⤵
  PID:7592
- C:\Windows\System\IuOcOhK.exe
  C:\Windows\System\IuOcOhK.exe
  2⤵
  PID:7680
- C:\Windows\System\IywoxbW.exe
  C:\Windows\System\IywoxbW.exe
  2⤵
  PID:2840
- C:\Windows\System\wcEoRwM.exe
  C:\Windows\System\wcEoRwM.exe
  2⤵
  PID:2208
- C:\Windows\System\OagcBDc.exe
  C:\Windows\System\OagcBDc.exe
  2⤵
  PID:3940
- C:\Windows\System\veRpxwc.exe
  C:\Windows\System\veRpxwc.exe
  2⤵
  PID:5124
- C:\Windows\System\PBZnowO.exe
  C:\Windows\System\PBZnowO.exe
  2⤵
  PID:5180
- C:\Windows\System\EunkAAE.exe
  C:\Windows\System\EunkAAE.exe
  2⤵
  PID:13560
- C:\Windows\System\liecAfc.exe
  C:\Windows\System\liecAfc.exe
  2⤵
  PID:116
- C:\Windows\System\YXpHwlp.exe
  C:\Windows\System\YXpHwlp.exe
  2⤵
  PID:2832
- C:\Windows\System\kfhxZjk.exe
  C:\Windows\System\kfhxZjk.exe
  2⤵
  PID:9560
- C:\Windows\System\AyjgdUO.exe
  C:\Windows\System\AyjgdUO.exe
  2⤵
  PID:5324
- C:\Windows\System\pPAitzz.exe
  C:\Windows\System\pPAitzz.exe
  2⤵
  PID:7904
- C:\Windows\System\bKmxiCS.exe
  C:\Windows\System\bKmxiCS.exe
  2⤵
  PID:13548
- C:\Windows\System\dTyOeZY.exe
  C:\Windows\System\dTyOeZY.exe
  2⤵
  PID:4320
- C:\Windows\System\bYJvtcy.exe
  C:\Windows\System\bYJvtcy.exe
  2⤵
  PID:8148
- C:\Windows\System\NGdjVzG.exe
  C:\Windows\System\NGdjVzG.exe
  2⤵
  PID:14008
- C:\Windows\System\IEabAAe.exe
  C:\Windows\System\IEabAAe.exe
  2⤵
  PID:2376
- C:\Windows\System\EzaewnA.exe
  C:\Windows\System\EzaewnA.exe
  2⤵
  PID:8020
- C:\Windows\System\sppkxEv.exe
  C:\Windows\System\sppkxEv.exe
  2⤵
  PID:9068
- C:\Windows\System\AmdRDzX.exe
  C:\Windows\System\AmdRDzX.exe
  2⤵
  PID:7456
- C:\Windows\System\sBOtDGg.exe
  C:\Windows\System\sBOtDGg.exe
  2⤵
  PID:5036
- C:\Windows\System\rqGmQbG.exe
  C:\Windows\System\rqGmQbG.exe
  2⤵
  PID:4100
- C:\Windows\System\IGyTlHg.exe
  C:\Windows\System\IGyTlHg.exe
  2⤵
  PID:7672
- C:\Windows\System\KABzYaf.exe
  C:\Windows\System\KABzYaf.exe
  2⤵
  PID:8036
- C:\Windows\System\nhyjHbh.exe
  C:\Windows\System\nhyjHbh.exe
  2⤵
  PID:7720
- C:\Windows\System\ZcwdGTe.exe
  C:\Windows\System\ZcwdGTe.exe
  2⤵
  PID:1832
- C:\Windows\System\eKNfFBc.exe
  C:\Windows\System\eKNfFBc.exe
  2⤵
  PID:5500
- C:\Windows\System\ApCCUFA.exe
  C:\Windows\System\ApCCUFA.exe
  2⤵
  PID:14108
- C:\Windows\System\GDuImjj.exe
  C:\Windows\System\GDuImjj.exe
  2⤵
  PID:10744
- C:\Windows\System\yUxDTRs.exe
  C:\Windows\System\yUxDTRs.exe
  2⤵
  PID:1716
- C:\Windows\System\cSDhxoj.exe
  C:\Windows\System\cSDhxoj.exe
  2⤵
  PID:5540
- C:\Windows\System\iyzyCUd.exe
  C:\Windows\System\iyzyCUd.exe
  2⤵
  PID:3836
- C:\Windows\System\tjLVzvf.exe
  C:\Windows\System\tjLVzvf.exe
  2⤵
  PID:13900
- C:\Windows\System\XAOTlJk.exe
  C:\Windows\System\XAOTlJk.exe
  2⤵
  PID:1584
- C:\Windows\System\xMdafoJ.exe
  C:\Windows\System\xMdafoJ.exe
  2⤵
  PID:1860
- C:\Windows\System\IlrODOQ.exe
  C:\Windows\System\IlrODOQ.exe
  2⤵
  PID:5668
- C:\Windows\System\Fodlihx.exe
  C:\Windows\System\Fodlihx.exe
  2⤵
  PID:5684
- C:\Windows\System\jDTAduR.exe
  C:\Windows\System\jDTAduR.exe
  2⤵
  PID:5740
- C:\Windows\System\riImtWs.exe
  C:\Windows\System\riImtWs.exe
  2⤵
  PID:224
- C:\Windows\System\JPCxkKk.exe
  C:\Windows\System\JPCxkKk.exe
  2⤵
  PID:5820
- C:\Windows\System\vYdTCvY.exe
  C:\Windows\System\vYdTCvY.exe
  2⤵
  PID:5796
- C:\Windows\System\WyjAwhO.exe
  C:\Windows\System\WyjAwhO.exe
  2⤵
  PID:10724
- C:\Windows\System\UarJGCY.exe
  C:\Windows\System\UarJGCY.exe
  2⤵
  PID:7032
- C:\Windows\System\nFGJhes.exe
  C:\Windows\System\nFGJhes.exe
  2⤵
  PID:13424
- C:\Windows\System\yzmNYTU.exe
  C:\Windows\System\yzmNYTU.exe
  2⤵
  PID:404
- C:\Windows\System\ffyqRKl.exe
  C:\Windows\System\ffyqRKl.exe
  2⤵
  PID:5224
- C:\Windows\System\jfhKtlI.exe
  C:\Windows\System\jfhKtlI.exe
  2⤵
  PID:3328
- C:\Windows\System\JVaisOY.exe
  C:\Windows\System\JVaisOY.exe
  2⤵
  PID:13516
- C:\Windows\System\WIYDXEl.exe
  C:\Windows\System\WIYDXEl.exe
  2⤵
  PID:9792
- C:\Windows\System\kwgabuv.exe
  C:\Windows\System\kwgabuv.exe
  2⤵
  PID:2392
- C:\Windows\System\vGfLEzM.exe
  C:\Windows\System\vGfLEzM.exe
  2⤵
  PID:7544
- C:\Windows\System\ieRqBOQ.exe
  C:\Windows\System\ieRqBOQ.exe
  2⤵
  PID:8032
- C:\Windows\System\ZFqDKne.exe
  C:\Windows\System\ZFqDKne.exe
  2⤵
  PID:7984
- C:\Windows\System\sGmVhtA.exe
  C:\Windows\System\sGmVhtA.exe
  2⤵
  PID:13572
- C:\Windows\System\SgBWhtk.exe
  C:\Windows\System\SgBWhtk.exe
  2⤵
  PID:11388
- C:\Windows\System\vWLzgGH.exe
  C:\Windows\System\vWLzgGH.exe
  2⤵
  PID:11420
- C:\Windows\System\GvSqEjo.exe
  C:\Windows\System\GvSqEjo.exe
  2⤵
  PID:13396
- C:\Windows\System\VSshfma.exe
  C:\Windows\System\VSshfma.exe
  2⤵
  PID:6000
- C:\Windows\System\BONYAcf.exe
  C:\Windows\System\BONYAcf.exe
  2⤵
  PID:5140
- C:\Windows\System\HoMTMSa.exe
  C:\Windows\System\HoMTMSa.exe
  2⤵
  PID:4532
- C:\Windows\System\soqlCmG.exe
  C:\Windows\System\soqlCmG.exe
  2⤵
  PID:4968
- C:\Windows\System\MUizJPU.exe
  C:\Windows\System\MUizJPU.exe
  2⤵
  PID:10628
- C:\Windows\System\XcVtPnU.exe
  C:\Windows\System\XcVtPnU.exe
  2⤵
  PID:8300
- C:\Windows\System\RIgkXQB.exe
  C:\Windows\System\RIgkXQB.exe
  2⤵
  PID:2900
- C:\Windows\System\ptWNvWN.exe
  C:\Windows\System\ptWNvWN.exe
  2⤵
  PID:5568
- C:\Windows\System\rvybXQP.exe
  C:\Windows\System\rvybXQP.exe
  2⤵
  PID:13956
- C:\Windows\System\AhtlydE.exe
  C:\Windows\System\AhtlydE.exe
  2⤵
  PID:6692
- C:\Windows\System\NKIZfGj.exe
  C:\Windows\System\NKIZfGj.exe
  2⤵
  PID:5728
- C:\Windows\System\hLJrwip.exe
  C:\Windows\System\hLJrwip.exe
  2⤵
  PID:14140
- C:\Windows\System\rskEtzR.exe
  C:\Windows\System\rskEtzR.exe
  2⤵
  PID:10616
- C:\Windows\System\MkcAqXK.exe
  C:\Windows\System\MkcAqXK.exe
  2⤵
  PID:11548
- C:\Windows\System\MhvdlLU.exe
  C:\Windows\System\MhvdlLU.exe
  2⤵
  PID:9416
- C:\Windows\System\LHQaXzU.exe
  C:\Windows\System\LHQaXzU.exe
  2⤵
  PID:6136
- C:\Windows\System\blvltfE.exe
  C:\Windows\System\blvltfE.exe
  2⤵
  PID:7324
- C:\Windows\System\YWLWmyM.exe
  C:\Windows\System\YWLWmyM.exe
  2⤵
  PID:7768
- C:\Windows\System\sRSeYqB.exe
  C:\Windows\System\sRSeYqB.exe
  2⤵
  PID:3232
- C:\Windows\System\rqTLnRN.exe
  C:\Windows\System\rqTLnRN.exe
  2⤵
  PID:6096
- C:\Windows\System\ElXlNZO.exe
  C:\Windows\System\ElXlNZO.exe
  2⤵
  PID:2812
- C:\Windows\System\JUgvAks.exe
  C:\Windows\System\JUgvAks.exe
  2⤵
  PID:5964
- C:\Windows\System\FOMRUXj.exe
  C:\Windows\System\FOMRUXj.exe
  2⤵
  PID:11428
- C:\Windows\System\KMxSpof.exe
  C:\Windows\System\KMxSpof.exe
  2⤵
  PID:5392
- C:\Windows\System\SgRWvIJ.exe
  C:\Windows\System\SgRWvIJ.exe
  2⤵
  PID:5936
- C:\Windows\System\QNgttcl.exe
  C:\Windows\System\QNgttcl.exe
  2⤵
  PID:1960
- C:\Windows\System\yTgzLnH.exe
  C:\Windows\System\yTgzLnH.exe
  2⤵
  PID:3924
- C:\Windows\System\VzblDug.exe
  C:\Windows\System\VzblDug.exe
  2⤵
  PID:10008
- C:\Windows\System\mfDOSlx.exe
  C:\Windows\System\mfDOSlx.exe
  2⤵
  PID:11960
- C:\Windows\System\BFGaSsQ.exe
  C:\Windows\System\BFGaSsQ.exe
  2⤵
  PID:8240
- C:\Windows\System\JgLfHlw.exe
  C:\Windows\System\JgLfHlw.exe
  2⤵
  PID:5040
- C:\Windows\System\UAKKycv.exe
  C:\Windows\System\UAKKycv.exe
  2⤵
  PID:5708
- C:\Windows\System\JVHlDHQ.exe
  C:\Windows\System\JVHlDHQ.exe
  2⤵
  PID:10584
- C:\Windows\System\eEqgctx.exe
  C:\Windows\System\eEqgctx.exe
  2⤵
  PID:5896
- C:\Windows\System\sdDotnP.exe
  C:\Windows\System\sdDotnP.exe
  2⤵
  PID:5988
- C:\Windows\System\OAQiBFW.exe
  C:\Windows\System\OAQiBFW.exe
  2⤵
  PID:8136
- C:\Windows\System\HYroXHa.exe
  C:\Windows\System\HYroXHa.exe
  2⤵
  PID:5888
- C:\Windows\System\VmQnPFZ.exe
  C:\Windows\System\VmQnPFZ.exe
  2⤵
  PID:10488
- C:\Windows\System\lCkYkwC.exe
  C:\Windows\System\lCkYkwC.exe
  2⤵
  PID:7328
- C:\Windows\System\lDfyBfv.exe
  C:\Windows\System\lDfyBfv.exe
  2⤵
  PID:11908
- C:\Windows\System\mDglnUb.exe
  C:\Windows\System\mDglnUb.exe
  2⤵
  PID:2940
- C:\Windows\System\kacJImq.exe
  C:\Windows\System\kacJImq.exe
  2⤵
  PID:5484
- C:\Windows\System\kcudEKO.exe
  C:\Windows\System\kcudEKO.exe
  2⤵
  PID:4016
- C:\Windows\System\XStBOAm.exe
  C:\Windows\System\XStBOAm.exe
  2⤵
  PID:5924
- C:\Windows\System\DNTajUG.exe
  C:\Windows\System\DNTajUG.exe
  2⤵
  PID:3412
- C:\Windows\System\nAkvonb.exe
  C:\Windows\System\nAkvonb.exe
  2⤵
  PID:4552
- C:\Windows\System\KQETLiz.exe
  C:\Windows\System\KQETLiz.exe
  2⤵
  PID:5720
- C:\Windows\System\MUPErVC.exe
  C:\Windows\System\MUPErVC.exe
  2⤵
  PID:5716
- C:\Windows\System\LLnSEKZ.exe
  C:\Windows\System\LLnSEKZ.exe
  2⤵
  PID:11996
- C:\Windows\System\VdYEtvE.exe
  C:\Windows\System\VdYEtvE.exe
  2⤵
  PID:1600
- C:\Windows\System\BBNwwkz.exe
  C:\Windows\System\BBNwwkz.exe
  2⤵
  PID:6008
- C:\Windows\System\bhIUPZp.exe
  C:\Windows\System\bhIUPZp.exe
  2⤵
  PID:4568
- C:\Windows\System\QKCUcEf.exe
  C:\Windows\System\QKCUcEf.exe
  2⤵
  PID:11976
- C:\Windows\System\HfbMWuq.exe
  C:\Windows\System\HfbMWuq.exe
  2⤵
  PID:10888
- C:\Windows\System\nOsPvkx.exe
  C:\Windows\System\nOsPvkx.exe
  2⤵
  PID:12936
- C:\Windows\System\ruTqwOL.exe
  C:\Windows\System\ruTqwOL.exe
  2⤵
  PID:3160
- C:\Windows\System\mmyhral.exe
  C:\Windows\System\mmyhral.exe
  2⤵
  PID:3168
- C:\Windows\System\RfVDQsu.exe
  C:\Windows\System\RfVDQsu.exe
  2⤵
  PID:13476
- C:\Windows\System\qiKPBXH.exe
  C:\Windows\System\qiKPBXH.exe
  2⤵
  PID:6012
- C:\Windows\System\xnxiOgh.exe
  C:\Windows\System\xnxiOgh.exe
  2⤵
  PID:5492
- C:\Windows\System\floCxmV.exe
  C:\Windows\System\floCxmV.exe
  2⤵
  PID:5628
- C:\Windows\System\nIAhDwJ.exe
  C:\Windows\System\nIAhDwJ.exe
  2⤵
  PID:5696
- C:\Windows\System\zWSIIUC.exe
  C:\Windows\System\zWSIIUC.exe
  2⤵
  PID:5912
- C:\Windows\System\ltHHZgJ.exe
  C:\Windows\System\ltHHZgJ.exe
  2⤵
  PID:13356
- C:\Windows\System\LuYnfmD.exe
  C:\Windows\System\LuYnfmD.exe
  2⤵
  PID:7496
- C:\Windows\System\ZSIfgkX.exe
  C:\Windows\System\ZSIfgkX.exe
  2⤵
  PID:1384
- C:\Windows\System\KNWpzCz.exe
  C:\Windows\System\KNWpzCz.exe
  2⤵
  PID:7920
- C:\Windows\System\JYVHDbT.exe
  C:\Windows\System\JYVHDbT.exe
  2⤵
  PID:3920
- C:\Windows\System\vMvzVnt.exe
  C:\Windows\System\vMvzVnt.exe
  2⤵
  PID:3336
- C:\Windows\System\SYFBXcy.exe
  C:\Windows\System\SYFBXcy.exe
  2⤵
  PID:12916
- C:\Windows\System\PMElNBG.exe
  C:\Windows\System\PMElNBG.exe
  2⤵
  PID:5944
- C:\Windows\System\NKWRahC.exe
  C:\Windows\System\NKWRahC.exe
  2⤵
  PID:11688
- C:\Windows\System\hDbIqGv.exe
  C:\Windows\System\hDbIqGv.exe
  2⤵
  PID:3896
- C:\Windows\System\levLPot.exe
  C:\Windows\System\levLPot.exe
  2⤵
  PID:1400
- C:\Windows\System\SdVCHSo.exe
  C:\Windows\System\SdVCHSo.exe
  2⤵
  PID:7532
- C:\Windows\System\hBTKPPB.exe
  C:\Windows\System\hBTKPPB.exe
  2⤵
  PID:3064
- C:\Windows\System\EglDBJM.exe
  C:\Windows\System\EglDBJM.exe
  2⤵
  PID:12604
- C:\Windows\System\PfIdhzu.exe
  C:\Windows\System\PfIdhzu.exe
  2⤵
  PID:5148
- C:\Windows\System\iYRYJyV.exe
  C:\Windows\System\iYRYJyV.exe
  2⤵
  PID:12316
- C:\Windows\System\lygpqJq.exe
  C:\Windows\System\lygpqJq.exe
  2⤵
  PID:2424
- C:\Windows\System\pVpEHUO.exe
  C:\Windows\System\pVpEHUO.exe
  2⤵
  PID:5264
- C:\Windows\System\yOkOqPh.exe
  C:\Windows\System\yOkOqPh.exe
  2⤵
  PID:3852
- C:\Windows\System\aJNlPaJ.exe
  C:\Windows\System\aJNlPaJ.exe
  2⤵
  PID:724
- C:\Windows\System\puyXDjc.exe
  C:\Windows\System\puyXDjc.exe
  2⤵
  PID:5828
- C:\Windows\System\zsuGcdp.exe
  C:\Windows\System\zsuGcdp.exe
  2⤵
  PID:1068
- C:\Windows\System\ynYTghV.exe
  C:\Windows\System\ynYTghV.exe
  2⤵
  PID:13264
- C:\Windows\System\NAhcvmL.exe
  C:\Windows\System\NAhcvmL.exe
  2⤵
  PID:10968
- C:\Windows\System\zSpCrkt.exe
  C:\Windows\System\zSpCrkt.exe
  2⤵
  PID:2192
- C:\Windows\System\rzjEzCs.exe
  C:\Windows\System\rzjEzCs.exe
  2⤵
  PID:3712
- C:\Windows\System\aSZgwjP.exe
  C:\Windows\System\aSZgwjP.exe
  2⤵
  PID:5656
- C:\Windows\System\fKeBloc.exe
  C:\Windows\System\fKeBloc.exe
  2⤵
  PID:4588
- C:\Windows\System\LaRWnhT.exe
  C:\Windows\System\LaRWnhT.exe
  2⤵
  PID:6060
- C:\Windows\System\OtFYklJ.exe
  C:\Windows\System\OtFYklJ.exe
  2⤵
  PID:13212
- C:\Windows\System\BXZFdmi.exe
  C:\Windows\System\BXZFdmi.exe
  2⤵
  PID:5576
- C:\Windows\System\JifZZeE.exe
  C:\Windows\System\JifZZeE.exe
  2⤵
  PID:4024
- C:\Windows\System\YtlpOBv.exe
  C:\Windows\System\YtlpOBv.exe
  2⤵
  PID:6364
- C:\Windows\System\hsBcdnI.exe
  C:\Windows\System\hsBcdnI.exe
  2⤵
  PID:6472
- C:\Windows\System\nWisaJT.exe
  C:\Windows\System\nWisaJT.exe
  2⤵
  PID:5952
- C:\Windows\System\DjViwdN.exe
  C:\Windows\System\DjViwdN.exe
  2⤵
  PID:6572
- C:\Windows\System\fjFRTFZ.exe
  C:\Windows\System\fjFRTFZ.exe
  2⤵
  PID:5664
- C:\Windows\System\hguzigH.exe
  C:\Windows\System\hguzigH.exe
  2⤵
  PID:6620
- C:\Windows\System\GaqEVEK.exe
  C:\Windows\System\GaqEVEK.exe
  2⤵
  PID:6664
- C:\Windows\System\aGosqek.exe
  C:\Windows\System\aGosqek.exe
  2⤵
  PID:1680
- C:\Windows\System\ZZHKgvp.exe
  C:\Windows\System\ZZHKgvp.exe
  2⤵
  PID:6704
- C:\Windows\System\QoJOTYQ.exe
  C:\Windows\System\QoJOTYQ.exe
  2⤵
  PID:8288
- C:\Windows\System\ksRelHC.exe
  C:\Windows\System\ksRelHC.exe
  2⤵
  PID:5544
- C:\Windows\System\vytbKCm.exe
  C:\Windows\System\vytbKCm.exe
  2⤵
  PID:6160
- C:\Windows\System\BkOPcfi.exe
  C:\Windows\System\BkOPcfi.exe
  2⤵
  PID:6112
- C:\Windows\System\hTClRhY.exe
  C:\Windows\System\hTClRhY.exe
  2⤵
  PID:6204
- C:\Windows\System\NpVCvFI.exe
  C:\Windows\System\NpVCvFI.exe
  2⤵
  PID:5524
- C:\Windows\System\TNDrYkV.exe
  C:\Windows\System\TNDrYkV.exe
  2⤵
  PID:3592
- C:\Windows\System\DJYhZff.exe
  C:\Windows\System\DJYhZff.exe
  2⤵
  PID:12708
- C:\Windows\System\ezwcgLW.exe
  C:\Windows\System\ezwcgLW.exe
  2⤵
  PID:5024
- C:\Windows\System\zvrZKrH.exe
  C:\Windows\System\zvrZKrH.exe
  2⤵
  PID:13480
- C:\Windows\System\TfzXwqo.exe
  C:\Windows\System\TfzXwqo.exe
  2⤵
  PID:6980
- C:\Windows\System\ObJVoKu.exe
  C:\Windows\System\ObJVoKu.exe
  2⤵
  PID:4072
- C:\Windows\System\GBwfqgO.exe
  C:\Windows\System\GBwfqgO.exe
  2⤵
  PID:7048
- C:\Windows\System\JxoRJjx.exe
  C:\Windows\System\JxoRJjx.exe
  2⤵
  PID:4744
- C:\Windows\System\mTctVQl.exe
  C:\Windows\System\mTctVQl.exe
  2⤵
  PID:5652
- C:\Windows\System\oSLhqdX.exe
  C:\Windows\System\oSLhqdX.exe
  2⤵
  PID:6184
- C:\Windows\System\LLtcsqW.exe
  C:\Windows\System\LLtcsqW.exe
  2⤵
  PID:5772
- C:\Windows\System\iEtUzVc.exe
  C:\Windows\System\iEtUzVc.exe
  2⤵
  PID:5884
- C:\Windows\System\IEWHVkE.exe
  C:\Windows\System\IEWHVkE.exe
  2⤵
  PID:6632
- C:\Windows\System\BnzOVUB.exe
  C:\Windows\System\BnzOVUB.exe
  2⤵
  PID:6380

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:14004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mankgimx.sum.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AQSoFcG.exe

Filesize
1.2MB

MD5
138136c5153c34710bc6b6d6e4a9f300

SHA1
17b34964b43d7a9e328411277c3b7cbc65c5381a

SHA256
9310d4ef8a444fc15dc5480a8b818c44b9d095c09ce1b62e1945d71273530b6f

SHA512
7a99bfeb169a5167388dbd02c411173784b66f957325bab88953079a024728d9f7de2b20fa83fefa583261e8616dccdcaf5bc25f884c13e0c0cf60a37b612e3b

Download Submit
C:\Windows\System\CIMBJlJ.exe

Filesize
1.2MB

MD5
2109f1695701eebc08b5c356afe1d0e2

SHA1
0cb204ac9a02b16bade4aafcec94838878e3a27c

SHA256
be916a1e5f9bf53014b95b1febc9fb45f8b3b1b9dec539a82dbd058977dc5baf

SHA512
f61338487f01c6db437578cb5e753832f97dea4c36632efdb6f3b8ab7e40fb55860732e75e409767721f1702a40c8a6b90b5fac6120555598acece72e257d2df

Download Submit
C:\Windows\System\CWYMBHh.exe

Filesize
8B

MD5
44bf49d36035eb00f5300ac1a1afc446

SHA1
efe4f6ff307f9caed7f6949e1a19ce6bff5ede19

SHA256
d6adb65d904d88ebbf5f73cace13dbd8ceb7d6b2b977c021ad3b0a4aa99b648f

SHA512
8e76802b3f04a2be9fcb0a504a2aab7f3a79e962c545a85c01bc2528c719fc825f28229de452d4507e45ed92f726c1862885d6f18fa5e01cbf2b77dcdf5d1348

Download Submit
C:\Windows\System\EBmVqKi.exe

Filesize
1.2MB

MD5
e4a018f2a61927f5438b413b642f31df

SHA1
6dd4a15ff77b88958862e7072068bc729cd66b85

SHA256
f612ee8cc13dcf535e88229e9e9d37ec4e5e2ead69dd784d81e76bc15f0e79a4

SHA512
1b46e7111a8cf3572c92d8f405a80fae1615bbe0885eb7eed094c17c422f9aa4d1a881139c1f72ee7e3676772374210820daa54b159432a940e8b8b1e652b0d0

Download Submit
C:\Windows\System\GUtMlgV.exe

Filesize
1.2MB

MD5
8f86714d5a717664a9eadd99dffe34b8

SHA1
217ea21b4f4e19c4570ae9d4940ff1ba61022c05

SHA256
2a73b20068523a6a11b8d7c789c32f36586d283f01337f9cfc253e0be356bfc4

SHA512
9797df11e4038e69ee3db57c04117c1ebc99cdd23996e522dcd1e8899ccf964830420d327150e1746b8c94f50fbb15ca2801631fe4d665248bc975d5fe8f5965

Download Submit
C:\Windows\System\Gajwcpk.exe

Filesize
1.2MB

MD5
853ed386db2f98533b894570b0252b70

SHA1
c516ab9000edfbfbdb6eef3902a33ba220e90912

SHA256
46c317498ebd247888b24fe732d1c2373c5f0965f3d0a4c535f945a7a0fd61c0

SHA512
0a1fc1dae2406643f316c71219da09e8f7c3ed54cb363aac0b44a42d09728c3ddc7ab57e91af87314e4f05ab4c876675d2992e0a8ddff077852e9ad478f8bd34

Download Submit
C:\Windows\System\HuGLIXa.exe

Filesize
1.2MB

MD5
ef1812f06ec10a4e77703b407c63b0ca

SHA1
f4b1e0652d9e053aae4f23bca7a40431a110c56a

SHA256
a397afe112ea78f38978a025fde60a4378c90fa84dbfe3ca4410563d4cae4698

SHA512
c1c519fd436e089f4a7410c8c14e26cf301f3652ae40f162b36366673387a035e52543104a169aed23eb859b571c37f9edb162fa1ad840917bab86437b291295

Download Submit
C:\Windows\System\KRthlIs.exe

Filesize
1.2MB

MD5
94a9dc23f4491d459ea725e7bf65cf39

SHA1
ca97bdc1d8ef288c4e03fe3420a213b62a45094d

SHA256
090663832e9acaa72be890de53bc69fadc0d802f28fc0c33fba04dca1852ea6e

SHA512
b090d00d4da54e93164876215feb35e2937c7b80319fe713118f2dd3d2709aaf728668f2d5f024519abde0213be2768ff7fe7dfe0b6ec0de005c170fb2fc13ca

Download Submit
C:\Windows\System\KZJWoKt.exe

Filesize
1.2MB

MD5
69bb7d60ed7892722c7fe92377d77fae

SHA1
81463042520b1a5cf49fb684fb5a4dee00bed0e6

SHA256
481a5b920d3c35d5537edfe8a0da0e6056f5b0099039913a4c3c08f26ea61ae1

SHA512
94100cffc737d16cb5ed0e94f7df7712a52e0ece5a8c7366ce0050a1f800439cc37f93037b4456393bf23e9f78f01b944d018ba3ca5605518177d4d02adef31c

Download Submit
C:\Windows\System\LXsgADE.exe

Filesize
1.2MB

MD5
17812f7ebe8a30f64c5eac8d71547937

SHA1
6d74709a614bec9b09bfc8957293cac87fd8e130

SHA256
04caddd0d27cbc4c2b1541b7bb631432dd58bfbcec81c81f5aa96d56e200c9f6

SHA512
9b8fa6a6f6f5f4ad824e702d8bc8ed1ea2b4a72a0fff5ec23254d83c68bfe1cfb69d97d7c67c8bfe97be4b4d4856ae9c3ba5e65490f9486c5ac46e78726370e9

Download Submit
C:\Windows\System\LjqHlIy.exe

Filesize
1.2MB

MD5
d4810fa2315aa701d227ef86ac4dae6a

SHA1
6fda9bc74b89d667b673c93e823c7641723e6a15

SHA256
59f161b59c2e137555088de0195f596d7d158ff50e824c34c9d036957995510f

SHA512
7b6f03d1c45b1cd09b05e603d48c23469db1dce14ed9852e1bde0e8f0aa1bb04b77e66034d6793bddf1796973b7e14a4a95ace6dd591ba702e207db77cd15909

Download Submit
C:\Windows\System\NYwbdum.exe

Filesize
1.2MB

MD5
888572ca157880c995baee894b28280f

SHA1
0d830cdadc22077d8f33b31415e4039ff375319a

SHA256
4605e4aa4235fd89891f75ee00ebb12581707aad09f86be1dd7d0265f7b343db

SHA512
ad6dec5f32cd065a151e52fcc6e88375612abd327331babf1c83d95a5da6ac3c37c473b14905c0599ec12bacfcc86811f660ba1f75c9e52d7b624cef6ded8940

Download Submit
C:\Windows\System\POoGVwC.exe

Filesize
1.2MB

MD5
6d4584fa6e14413173716fae9992d390

SHA1
efe3f8b3a556eee2b23af6044646093fdc7fc04c

SHA256
89e2db529fccac60a0f1cc65cfa314da407bc740b61e93c1eecbf46dd7c12d78

SHA512
59b85032a197390ae00c347384e998f67e160389c98562732f49201bc9c697134bd0772787244364dd7564251813badd19e0e908c0bb0237ca4fa7453ee5e766

Download Submit
C:\Windows\System\PtXJGiY.exe

Filesize
1.2MB

MD5
6b2ae3fd4a057c99e78592bd77137a31

SHA1
8ad3bf7235beae511ea223608a3c6a36cdac5991

SHA256
5e415346a1b329dd38091f05a50f71b2e24138e821b245cfd427886223ac9558

SHA512
607a5ea3cc22d78c48ba1d9fb98d47279709337749ec40140d816496a62794c51d53b7c51a25c6cf81f19f9665059198fb04d62443bf0b32739ee42609ed8e5b

Download Submit
C:\Windows\System\QOjuOaA.exe

Filesize
1.2MB

MD5
cf6986c882caf19574aa1e8536d89867

SHA1
6461e6eea0a2f0f35854c2dc57fdc39d81d1b65f

SHA256
7a9337d96609813f134c485cf6a7d2f445251fcefa963b10d61f9a1b8f0d6258

SHA512
ab0e7956b815c54f78fe688fe0f99a50346596e9fce15589fcce8aa2c9394aaa127c4c959f03b6d322edad1dd0500705fdfe57b54058ea3f300412a6bef8a277

Download Submit
C:\Windows\System\QkvXFFP.exe

Filesize
1.2MB

MD5
2956a61fbf3b14ccb381b6a977b95b80

SHA1
747a23e6d255da81424c4fcb703b3678d666d270

SHA256
bd473438778f6273b10ea005af8ccec49fba341a23f5354be114b40f42512081

SHA512
9fcbb83b1adf0478d5285239ba9438d77b58d9087c7bc918e0f5bd0a2f52ebde012adcb17fe60e44e3e1e967155f9127c462c1a4d7a00b0564d6618864b405a1

Download Submit
C:\Windows\System\VNKiJrn.exe

Filesize
1.2MB

MD5
4f2239bf743626bd64e3487283472b1e

SHA1
6b6f7f65f06a983097bf2808bb69fc029b8404b2

SHA256
a4fa99ced0280b4595ff1d79b7e1d51c99dde7026ccdb9433ff09dc74cecc702

SHA512
b5308fcbd7e59419cc0d21eff06f071a82f5f7c8ad4687e07f002387cf8fe6f9008c52a5d99f09cc222663c1a9eea0e889c65b3cd2cef6e7e5ebba1a4ba83056

Download Submit
C:\Windows\System\XMLoYtj.exe

Filesize
1.2MB

MD5
0fac0a9ca1e2062ecde4909f1c208d1e

SHA1
0fc36a9e5e509593e15106568ed2288705c83c08

SHA256
f4be33956695bb41cf75f9831c040f5729e5be63d838d8fae865ebdb7eb142ee

SHA512
ce1373a0c8814604ffb905cb73b2cf2c91f100b362e8db0bc0365ddda752e69b0edc5bbfc89cfec21c360a48a78472fe864388d8449106b7c1d04907abb9a346

Download Submit
C:\Windows\System\XSmoidm.exe

Filesize
1.2MB

MD5
9451ca12c2fb2be1adf624170dc2b0d5

SHA1
4d30e9146aae20ce55812db3c9c47f871949152d

SHA256
f509919541939b762f2b454a994f68b1ff968d7575e627ceabe4db8515f5afd9

SHA512
460eee19315871941bf06a7f97b1253a2a372e5a3bd9a68b36889f8386f6e281ffca8b241737778d116d9a444a93419c4703dd9427817b8f3a033b4b19ad4bd8

Download Submit
C:\Windows\System\ZNZjMLr.exe

Filesize
1.2MB

MD5
7de977159591091c929bbfc72fb4ad5b

SHA1
b0fe6197d420c503c2eb2cbdc1f9a11dd7ce0510

SHA256
2c13ddf5db8d220d6cda11264964efdbc6e846d8c32f512c6840d2ece0fb82b4

SHA512
1c0281247bab8cbf9c776e85389aecf0b409a1ec1e913988c4847a14d387b6ed84b981157e705160f40137cabff6042f394b64effd60f7eacc97246932eb4402

Download Submit
C:\Windows\System\cknHspV.exe

Filesize
1.2MB

MD5
ef4ebf6255c8f704c4a9845dbabad1e1

SHA1
892a1de2a41af700f1a385944a50fbd5a9546e5c

SHA256
5a6029fcb0d047f80118da3b1c45f337f1daa2e4017fa75f677d0a2deba4000c

SHA512
b4774cc07a0d111c4b4409d46eefcbb358ff5583c2d06f1d95f0c5e3e2c4421f07ff9198e1306674ffb27e2c37bc89c96e2fa45060265458436c3a1707db234c

Download Submit
C:\Windows\System\dxzzMsU.exe

Filesize
1.2MB

MD5
3c869a004a9bc9a44f591a1a7097b13d

SHA1
2a2334edaac7b8255de119f606f653c29900f6e0

SHA256
6ae45f625b9269d076965cd10948c9bab8f2acd57ed76b47c49f3586cec80a28

SHA512
18399622b4392689dc68433c35f36b0ba4faa71d3dddc9d546b406984ef6f679e752e9b91f1a8b3d5342f329b97aa50eb2d559dbb7142996ceac330fe62f249c

Download Submit
C:\Windows\System\fBxaxox.exe

Filesize
1.2MB

MD5
5beace2c05557c50d016769125616760

SHA1
878917ad1f1d52d976d18bfce74064175d12e619

SHA256
157e69619e8b0efb773ae67e6fb3fa9f67849e4ee8bdc320cfd800ca42587a6a

SHA512
35f2824e91b030018574cad03726da3d8147205f52bbceeef56f3f7deff1d0ac665ff1ec21f4ff0b743f92e3a046bcb5ac8411c4a7c4ed30fc364c685f7af77d

Download Submit
C:\Windows\System\gdbvMcZ.exe

Filesize
1.2MB

MD5
097cafc21f71573b8e91a0225288c278

SHA1
ad9a59aaf7ae7d521355c141b0f39f0d3c9dc26c

SHA256
8eab0b8ebfd7f0506e6432f16ee73dd61971e1e1e336778c01d4950f7c2f533f

SHA512
4cdfed990b1b98b282bd0bf446e88dd30fd0ac977889a774315b7265c66d01d05efcc75f3f7271da1d6d90c413d2559f20a4a05e1044eac1ef4059cff413129f

Download Submit
C:\Windows\System\kEdnLQy.exe

Filesize
1.2MB

MD5
37d085c2230dce212c75a58395109c84

SHA1
27a6feec1e570dcada9e14e7f9f158baaaf14cd5

SHA256
5f90271fec074ad23802d34973f353c7b52a1b484a034433d8aa94b2ff35e8ad

SHA512
7d7a2617b967d89310ebe3f276afad75df345497853f9e5aa81427c63c672d6e6d1f6754e41bb01ee35258ef613cbfc4b4be1f315f6adbea4994fd19541b217b

Download Submit
C:\Windows\System\kPLchcu.exe

Filesize
1.2MB

MD5
20265449636c976063c86c0ca8a500c4

SHA1
f7e2629ed75658660138ac51939bc035dea729fd

SHA256
a218fabdb148c578b66f2173d2e1279a099ada7d2fb64d242a12148d7554a625

SHA512
2c96609fd8875db485f3a023e7efc00de4c7a3da5ff660b0ff11e8d3381c9ff25836265765bbb63ec1344101b6e543a0e069ec940215c0c916a31e3e2b1efc63

Download Submit
C:\Windows\System\ogDcaaB.exe

Filesize
1.2MB

MD5
162ad0ff3aa8c8d0bb90e11615013082

SHA1
4bc0791950e27569e1bdad3c3a46a5e4e5e83806

SHA256
20b4dadcc91af026a798f2e2187274a8cca1ef609cade636a511d7d377fb2a9e

SHA512
74c4ea6d85a05841a0a00b275ab7fdbb184b0d9a099cc91c3503b4f33c266e0d80365c56e65003f451caa92fa8f31a664fd6210a002ec789fafaa17bc2e5c27f

Download Submit
C:\Windows\System\rahxRpZ.exe

Filesize
1.2MB

MD5
b9b9bc78e4ef1c9852c4b3bd863bf5c3

SHA1
0b07037f0ec7c0a58369ed35ea508bfa5c24efe6

SHA256
70d390fc144355215f9d5a71bfd99e896de0086cd88a6eafa2b7392f05d4dc5b

SHA512
88fc1863f218c6dd98092aa393d4859268911ca58be2836c86e339591c39fdbf578e7267577f14385921da8c3c8362d997597e84f427c5cc2db9cd7e2aeeac77

Download Submit
C:\Windows\System\sUTwXVQ.exe

Filesize
1.2MB

MD5
b15f4112efee3c9b97b859a5853c8f4a

SHA1
16916dbd1b01793b9258244bc1c2f5899bde8da1

SHA256
6f9d847feac3d05eeb79c4d26edf966601f437a00ebb7432fba8ece7f86f1e10

SHA512
46c534a8cac4f660797563daed6416a2e10354ef92e67beaad2f075a5fb737b852f5a202de18e14756d0cb5cb80a7e79fe3baadf886a73d76f4dc6c2321087ef

Download Submit
C:\Windows\System\uNlnpjn.exe

Filesize
1.2MB

MD5
1e4816f9f416126386abb72838974786

SHA1
ceec8bf219544834a8b9862aebea157af8e3ad67

SHA256
9b9c978b8be69badc19df2d4fdeda469d96ccfc2bd9f511ededf110d87ddcb30

SHA512
f88d1f7563670aa7163f3a2f700e027e5e2f18b3a957a2b602a37d2c4e3d5f601b0766fae80f9662950e85cc48036b3b5348d5d0cf34a64bac0f9dd3513d0e56

Download Submit
C:\Windows\System\wgTFAmR.exe

Filesize
1.2MB

MD5
6b4acc05936c8ab428dc2d83ddd49a02

SHA1
20cc9fdb5ca4d26d9d76bd2c6191df6a58fc0b98

SHA256
f8df039141380d45e742a6290faf9b7cf517847969cd387c6277eaf8f62a62cc

SHA512
ef0345b5f27b65c57bdf7a1e39712dc7f962624fba66546d84359ce009c4eb6f15d6a2c3c135f760790436f7ebf47d2a1954d2ff54192b180b4c120d3d47ea91

Download Submit
C:\Windows\System\xHOkVBO.exe

Filesize
1.2MB

MD5
cbfd156e72159e2d11ef328b6a9e6e1c

SHA1
6cee70a94493c20e76efa80eaa3e01065dad77dd

SHA256
217457c42124196086f659d6864c7939414acd4b059d8d3ca16f91133dc4a0ea

SHA512
91d54641677df7ac350c81e9c25334db858bd4f52a8c0475fe7e07aaae4cd2d58e371fcdf14936d73a9317beab361663ffaef50c147d6bbba2d2e7f3e1841c42

Download Submit
C:\Windows\System\zEPSnIo.exe

Filesize
1.2MB

MD5
3651259a0dc571c299fadaabe5d9d8cc

SHA1
223bc2672d4239d2068268bae3bf5070b0367f84

SHA256
9b2529cb9be2e8400c7087e2f4ab251a4bfa9958c268e4ea2e99ba27e7041486

SHA512
e5ee0a0d6c48b03dd2157e6fa4efc12cc0a6e208193a524d95156ecf970fdc3be309d728ee3f0271433d3937b08a3d97d79fc4307b8cacb8b521df1816733e49

Download Submit
C:\Windows\System\zpYyyhR.exe

Filesize
1.2MB

MD5
3b3dd3c7249080a73fcddc07219795ce

SHA1
e44ed1bb695dfd3bb2fc3175b3cffbf621edc021

SHA256
2badef51cc6ad235d74df4583267778f963538426a16bc977281641e05454633

SHA512
1edfaa447de29aa4d510cce762e4714c6f6eee16ca308310b87aaf5ab63f0bafe1e62f0ea0c6f40d67fc10feca745ce129a8555764f9c7739fbfb7c0fccff119

Download Submit
memory/692-114-0x00007FF6728F0000-0x00007FF672CE2000-memory.dmp

Filesize
3.9MB

Download
memory/1124-1-0x000001493CD70000-0x000001493CD80000-memory.dmp

Filesize
64KB

Download
memory/1124-1031-0x00007FF7BCC80000-0x00007FF7BD072000-memory.dmp

Filesize
3.9MB

Download
memory/1124-0-0x00007FF7BCC80000-0x00007FF7BD072000-memory.dmp

Filesize
3.9MB

Download
memory/1140-163-0x00007FF624210000-0x00007FF624602000-memory.dmp

Filesize
3.9MB

Download
memory/1140-4254-0x00007FF624210000-0x00007FF624602000-memory.dmp

Filesize
3.9MB

Download
memory/1188-175-0x00007FF6793E0000-0x00007FF6797D2000-memory.dmp

Filesize
3.9MB

Download
memory/1188-4263-0x00007FF6793E0000-0x00007FF6797D2000-memory.dmp

Filesize
3.9MB

Download
memory/1512-97-0x00007FF78F4F0000-0x00007FF78F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1604-4194-0x00007FF62D570000-0x00007FF62D962000-memory.dmp

Filesize
3.9MB

Download
memory/1604-115-0x00007FF62D570000-0x00007FF62D962000-memory.dmp

Filesize
3.9MB

Download
memory/1732-25-0x00007FF661590000-0x00007FF661982000-memory.dmp

Filesize
3.9MB

Download
memory/1732-1151-0x00007FF661590000-0x00007FF661982000-memory.dmp

Filesize
3.9MB

Download
memory/1812-134-0x00007FF7AB9E0000-0x00007FF7ABDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-37-0x00007FF6291F0000-0x00007FF6295E2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-1153-0x00007FF6291F0000-0x00007FF6295E2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-4171-0x00007FF6D3AD0000-0x00007FF6D3EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-1163-0x00007FF6D3AD0000-0x00007FF6D3EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-57-0x00007FF6D3AD0000-0x00007FF6D3EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-75-0x00007FF780F70000-0x00007FF781362000-memory.dmp

Filesize
3.9MB

Download
memory/2584-140-0x00007FF715FC0000-0x00007FF7163B2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-4736-0x00007FF7AA200000-0x00007FF7AA5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-129-0x00007FF7AA200000-0x00007FF7AA5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-1171-0x00007FF7AA200000-0x00007FF7AA5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-449-0x000001D1A4460000-0x000001D1A4C06000-memory.dmp

Filesize
7.6MB

Download
memory/2836-127-0x000001D1A34C0000-0x000001D1A34E2000-memory.dmp

Filesize
136KB

Download
memory/2836-92-0x000001D1A3560000-0x000001D1A3570000-memory.dmp

Filesize
64KB

Download
memory/2836-1420-0x00007FFAC9043000-0x00007FFAC9045000-memory.dmp

Filesize
8KB

Download
memory/2836-1273-0x000001D1A3560000-0x000001D1A3570000-memory.dmp

Filesize
64KB

Download
memory/2836-91-0x000001D1A3560000-0x000001D1A3570000-memory.dmp

Filesize
64KB

Download
memory/2836-141-0x00007FFAC9043000-0x00007FFAC9045000-memory.dmp

Filesize
8KB

Download
memory/3048-13-0x00007FF6E51C0000-0x00007FF6E55B2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-1035-0x00007FF6E51C0000-0x00007FF6E55B2000-memory.dmp

Filesize
3.9MB

Download
memory/3148-4241-0x00007FF7E2590000-0x00007FF7E2982000-memory.dmp

Filesize
3.9MB

Download
memory/3148-157-0x00007FF7E2590000-0x00007FF7E2982000-memory.dmp

Filesize
3.9MB

Download
memory/3720-142-0x00007FF794A40000-0x00007FF794E32000-memory.dmp

Filesize
3.9MB

Download
memory/3720-4190-0x00007FF794A40000-0x00007FF794E32000-memory.dmp

Filesize
3.9MB

Download
memory/3968-4233-0x00007FF698CC0000-0x00007FF6990B2000-memory.dmp

Filesize
3.9MB

Download
memory/3968-150-0x00007FF698CC0000-0x00007FF6990B2000-memory.dmp

Filesize
3.9MB

Download
memory/4108-103-0x00007FF678300000-0x00007FF6786F2000-memory.dmp

Filesize
3.9MB

Download
memory/4388-109-0x00007FF75D1E0000-0x00007FF75D5D2000-memory.dmp

Filesize
3.9MB

Download
memory/4388-4195-0x00007FF75D1E0000-0x00007FF75D5D2000-memory.dmp

Filesize
3.9MB

Download
memory/4472-104-0x00007FF65B780000-0x00007FF65BB72000-memory.dmp

Filesize
3.9MB

Download
memory/4740-121-0x00007FF6EF630000-0x00007FF6EFA22000-memory.dmp

Filesize
3.9MB

Download
memory/4740-4225-0x00007FF6EF630000-0x00007FF6EFA22000-memory.dmp

Filesize
3.9MB

Download
memory/4944-4260-0x00007FF71BE30000-0x00007FF71C222000-memory.dmp

Filesize
3.9MB

Download
memory/4944-176-0x00007FF71BE30000-0x00007FF71C222000-memory.dmp

Filesize
3.9MB

Download
memory/4988-156-0x00007FF7EA2E0000-0x00007FF7EA6D2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-4236-0x00007FF7EA2E0000-0x00007FF7EA6D2000-memory.dmp

Filesize
3.9MB

Download
memory/5052-96-0x00007FF7599C0000-0x00007FF759DB2000-memory.dmp

Filesize
3.9MB

Download
memory/5080-4271-0x00007FF67D210000-0x00007FF67D602000-memory.dmp

Filesize
3.9MB

Download
memory/5080-169-0x00007FF67D210000-0x00007FF67D602000-memory.dmp

Filesize
3.9MB

Download