xmrig | 15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1

Analysis

max time kernel
136s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
Size

1.5MB
MD5

f76ecc03b34568279a222f7c3709dbc0
SHA1

880da0bc8bedc8666b785a60b04c7d72466e48ae
SHA256

15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1
SHA512

406016ebb99ccedf2213a849f513b48eebdfdc5b9b6f0317c1b358a527ab5f64ae2e83d8323e10bc7764afc98c8aed6734c7e898e37b284ecda45ff46241ceb2
SSDEEP

24576:RVIl/WDGCi7/qkat62wT83PzKgAm0PyFLb//e3XZXW+NguyN+UMjD6/OOeNSlsFu:ROdWCCi7/ra+GvAFnhyN1uEe2

Score

10^/10

xmrig miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 58 IoCs

miner

resource	yara_rule
behavioral2/memory/4988-43-0x00007FF638840000-0x00007FF638B91000-memory.dmp	xmrig
behavioral2/memory/3956-423-0x00007FF627190000-0x00007FF6274E1000-memory.dmp	xmrig
behavioral2/memory/1940-426-0x00007FF66E2C0000-0x00007FF66E611000-memory.dmp	xmrig
behavioral2/memory/640-428-0x00007FF69DE30000-0x00007FF69E181000-memory.dmp	xmrig
behavioral2/memory/4548-438-0x00007FF792E60000-0x00007FF7931B1000-memory.dmp	xmrig
behavioral2/memory/4184-439-0x00007FF799F70000-0x00007FF79A2C1000-memory.dmp	xmrig
behavioral2/memory/3984-444-0x00007FF6C11F0000-0x00007FF6C1541000-memory.dmp	xmrig
behavioral2/memory/1492-451-0x00007FF7B3A30000-0x00007FF7B3D81000-memory.dmp	xmrig
behavioral2/memory/1916-456-0x00007FF65E570000-0x00007FF65E8C1000-memory.dmp	xmrig
behavioral2/memory/2372-465-0x00007FF685FC0000-0x00007FF686311000-memory.dmp	xmrig
behavioral2/memory/2584-464-0x00007FF7020B0000-0x00007FF702401000-memory.dmp	xmrig
behavioral2/memory/4300-455-0x00007FF760960000-0x00007FF760CB1000-memory.dmp	xmrig
behavioral2/memory/1532-452-0x00007FF6D7FB0000-0x00007FF6D8301000-memory.dmp	xmrig
behavioral2/memory/2428-447-0x00007FF7FE020000-0x00007FF7FE371000-memory.dmp	xmrig
behavioral2/memory/1820-445-0x00007FF791BF0000-0x00007FF791F41000-memory.dmp	xmrig
behavioral2/memory/3832-435-0x00007FF7032A0000-0x00007FF7035F1000-memory.dmp	xmrig
behavioral2/memory/1076-432-0x00007FF7026C0000-0x00007FF702A11000-memory.dmp	xmrig
behavioral2/memory/2668-430-0x00007FF62F270000-0x00007FF62F5C1000-memory.dmp	xmrig
behavioral2/memory/4360-470-0x00007FF7BA660000-0x00007FF7BA9B1000-memory.dmp	xmrig
behavioral2/memory/4768-469-0x00007FF7FC3D0000-0x00007FF7FC721000-memory.dmp	xmrig
behavioral2/memory/4212-468-0x00007FF74F170000-0x00007FF74F4C1000-memory.dmp	xmrig
behavioral2/memory/2588-55-0x00007FF65E8C0000-0x00007FF65EC11000-memory.dmp	xmrig
behavioral2/memory/312-17-0x00007FF6A0040000-0x00007FF6A0391000-memory.dmp	xmrig
behavioral2/memory/1900-2172-0x00007FF6C8060000-0x00007FF6C83B1000-memory.dmp	xmrig
behavioral2/memory/2936-2204-0x00007FF77AEB0000-0x00007FF77B201000-memory.dmp	xmrig
behavioral2/memory/4492-2205-0x00007FF738460000-0x00007FF7387B1000-memory.dmp	xmrig
behavioral2/memory/4928-2206-0x00007FF671A60000-0x00007FF671DB1000-memory.dmp	xmrig
behavioral2/memory/3408-2207-0x00007FF6CE8F0000-0x00007FF6CEC41000-memory.dmp	xmrig
behavioral2/memory/2876-2208-0x00007FF70B140000-0x00007FF70B491000-memory.dmp	xmrig
behavioral2/memory/312-2246-0x00007FF6A0040000-0x00007FF6A0391000-memory.dmp	xmrig
behavioral2/memory/1900-2248-0x00007FF6C8060000-0x00007FF6C83B1000-memory.dmp	xmrig
behavioral2/memory/2936-2250-0x00007FF77AEB0000-0x00007FF77B201000-memory.dmp	xmrig
behavioral2/memory/4492-2252-0x00007FF738460000-0x00007FF7387B1000-memory.dmp	xmrig
behavioral2/memory/4988-2254-0x00007FF638840000-0x00007FF638B91000-memory.dmp	xmrig
behavioral2/memory/4928-2256-0x00007FF671A60000-0x00007FF671DB1000-memory.dmp	xmrig
behavioral2/memory/2588-2262-0x00007FF65E8C0000-0x00007FF65EC11000-memory.dmp	xmrig
behavioral2/memory/3408-2266-0x00007FF6CE8F0000-0x00007FF6CEC41000-memory.dmp	xmrig
behavioral2/memory/640-2268-0x00007FF69DE30000-0x00007FF69E181000-memory.dmp	xmrig
behavioral2/memory/3956-2264-0x00007FF627190000-0x00007FF6274E1000-memory.dmp	xmrig
behavioral2/memory/1940-2259-0x00007FF66E2C0000-0x00007FF66E611000-memory.dmp	xmrig
behavioral2/memory/2876-2261-0x00007FF70B140000-0x00007FF70B491000-memory.dmp	xmrig
behavioral2/memory/3832-2273-0x00007FF7032A0000-0x00007FF7035F1000-memory.dmp	xmrig
behavioral2/memory/4548-2271-0x00007FF792E60000-0x00007FF7931B1000-memory.dmp	xmrig
behavioral2/memory/2668-2276-0x00007FF62F270000-0x00007FF62F5C1000-memory.dmp	xmrig
behavioral2/memory/1076-2275-0x00007FF7026C0000-0x00007FF702A11000-memory.dmp	xmrig
behavioral2/memory/4184-2278-0x00007FF799F70000-0x00007FF79A2C1000-memory.dmp	xmrig
behavioral2/memory/1820-2282-0x00007FF791BF0000-0x00007FF791F41000-memory.dmp	xmrig
behavioral2/memory/2428-2284-0x00007FF7FE020000-0x00007FF7FE371000-memory.dmp	xmrig
behavioral2/memory/3984-2280-0x00007FF6C11F0000-0x00007FF6C1541000-memory.dmp	xmrig
behavioral2/memory/1532-2302-0x00007FF6D7FB0000-0x00007FF6D8301000-memory.dmp	xmrig
behavioral2/memory/2584-2298-0x00007FF7020B0000-0x00007FF702401000-memory.dmp	xmrig
behavioral2/memory/4300-2310-0x00007FF760960000-0x00007FF760CB1000-memory.dmp	xmrig
behavioral2/memory/1916-2308-0x00007FF65E570000-0x00007FF65E8C1000-memory.dmp	xmrig
behavioral2/memory/4768-2306-0x00007FF7FC3D0000-0x00007FF7FC721000-memory.dmp	xmrig
behavioral2/memory/1492-2304-0x00007FF7B3A30000-0x00007FF7B3D81000-memory.dmp	xmrig
behavioral2/memory/4360-2295-0x00007FF7BA660000-0x00007FF7BA9B1000-memory.dmp	xmrig
behavioral2/memory/4212-2293-0x00007FF74F170000-0x00007FF74F4C1000-memory.dmp	xmrig
behavioral2/memory/2372-2297-0x00007FF685FC0000-0x00007FF686311000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1900	pScrbaZ.exe
312	MicRffY.exe
2936	DRyQwoO.exe
4492	bTZcMnY.exe
4988	vpHIVnu.exe
4928	mHmLoyS.exe
2876	eIgeYUE.exe
3408	XxBqyKc.exe
2588	Sbqtdes.exe
3956	qFxrvnn.exe
1940	nnBkwTm.exe
640	NovfxjD.exe
2668	yzoKVkA.exe
1076	kcYqKEX.exe
3832	hJmruzo.exe
4548	xmYHVuk.exe
4184	fyQIvDy.exe
3984	AUIsGJW.exe
1820	lEAjKmQ.exe
2428	kVzqhyh.exe
1492	McOIzRV.exe
1532	qMnQsYo.exe
4300	ozxlFpZ.exe
1916	CbxfVMQ.exe
2584	VBxnEvR.exe
2372	AnKYLoY.exe
4212	BDVzLPM.exe
4768	iscvaje.exe
4360	azkeObK.exe
3936	PJIMbmN.exe
4064	IiHuOgf.exe
1116	AtEERRl.exe
4668	NXWeJDL.exe
5084	DMEbMWg.exe
4836	UtRGrye.exe
3444	JYtupIs.exe
2692	dLbLfqo.exe
4376	aWVRSro.exe
1520	WaEfgIX.exe
3804	LWFbGdS.exe
3048	dovZWhN.exe
5104	WGpPQep.exe
4004	OngGbWe.exe
3416	cSoAnIc.exe
2608	GLtHbSq.exe
1108	saAVbrl.exe
1808	hAqrevx.exe
3356	IMrBKgT.exe
4972	MmjTORz.exe
2160	zQjPQpK.exe
2472	THeLryh.exe
3844	nTYxEno.exe
1640	tbSPjJR.exe
4920	PLHemGr.exe
4752	DgzOArN.exe
4200	Xvkhawv.exe
2640	YDeuFeK.exe
3428	ScxQKen.exe
4908	YeIwrOF.exe
2788	GPwyWAn.exe
916	fcMsJnx.exe
4368	mXGnPQc.exe
964	EIvOOOS.exe
8	phmfYLm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2076-0-0x00007FF7F7270000-0x00007FF7F75C1000-memory.dmp	upx
behavioral2/files/0x00080000000234f1-5.dat	upx
behavioral2/files/0x00080000000234f7-7.dat	upx
behavioral2/files/0x00080000000234f4-9.dat	upx
behavioral2/memory/4928-36-0x00007FF671A60000-0x00007FF671DB1000-memory.dmp	upx
behavioral2/files/0x00070000000234fc-38.dat	upx
behavioral2/memory/4988-43-0x00007FF638840000-0x00007FF638B91000-memory.dmp	upx
behavioral2/files/0x00070000000234fe-63.dat	upx
behavioral2/files/0x00070000000234ff-70.dat	upx
behavioral2/files/0x0007000000023500-75.dat	upx
behavioral2/files/0x0007000000023501-80.dat	upx
behavioral2/files/0x0007000000023504-87.dat	upx
behavioral2/files/0x0007000000023508-107.dat	upx
behavioral2/files/0x000700000002350a-117.dat	upx
behavioral2/files/0x000700000002350c-127.dat	upx
behavioral2/files/0x0007000000023511-152.dat	upx
behavioral2/files/0x0007000000023514-167.dat	upx
behavioral2/memory/3956-423-0x00007FF627190000-0x00007FF6274E1000-memory.dmp	upx
behavioral2/memory/1940-426-0x00007FF66E2C0000-0x00007FF66E611000-memory.dmp	upx
behavioral2/memory/640-428-0x00007FF69DE30000-0x00007FF69E181000-memory.dmp	upx
behavioral2/memory/4548-438-0x00007FF792E60000-0x00007FF7931B1000-memory.dmp	upx
behavioral2/memory/4184-439-0x00007FF799F70000-0x00007FF79A2C1000-memory.dmp	upx
behavioral2/memory/3984-444-0x00007FF6C11F0000-0x00007FF6C1541000-memory.dmp	upx
behavioral2/memory/1492-451-0x00007FF7B3A30000-0x00007FF7B3D81000-memory.dmp	upx
behavioral2/memory/1916-456-0x00007FF65E570000-0x00007FF65E8C1000-memory.dmp	upx
behavioral2/memory/2372-465-0x00007FF685FC0000-0x00007FF686311000-memory.dmp	upx
behavioral2/memory/2584-464-0x00007FF7020B0000-0x00007FF702401000-memory.dmp	upx
behavioral2/memory/4300-455-0x00007FF760960000-0x00007FF760CB1000-memory.dmp	upx
behavioral2/memory/1532-452-0x00007FF6D7FB0000-0x00007FF6D8301000-memory.dmp	upx
behavioral2/memory/2428-447-0x00007FF7FE020000-0x00007FF7FE371000-memory.dmp	upx
behavioral2/memory/1820-445-0x00007FF791BF0000-0x00007FF791F41000-memory.dmp	upx
behavioral2/memory/3832-435-0x00007FF7032A0000-0x00007FF7035F1000-memory.dmp	upx
behavioral2/memory/1076-432-0x00007FF7026C0000-0x00007FF702A11000-memory.dmp	upx
behavioral2/memory/2668-430-0x00007FF62F270000-0x00007FF62F5C1000-memory.dmp	upx
behavioral2/files/0x0007000000023515-172.dat	upx
behavioral2/files/0x0007000000023513-170.dat	upx
behavioral2/files/0x0007000000023512-165.dat	upx
behavioral2/memory/4360-470-0x00007FF7BA660000-0x00007FF7BA9B1000-memory.dmp	upx
behavioral2/memory/4768-469-0x00007FF7FC3D0000-0x00007FF7FC721000-memory.dmp	upx
behavioral2/memory/4212-468-0x00007FF74F170000-0x00007FF74F4C1000-memory.dmp	upx
behavioral2/files/0x0007000000023510-155.dat	upx
behavioral2/files/0x000700000002350f-150.dat	upx
behavioral2/files/0x000700000002350e-145.dat	upx
behavioral2/files/0x000700000002350d-140.dat	upx
behavioral2/files/0x000700000002350b-130.dat	upx
behavioral2/files/0x0007000000023509-120.dat	upx
behavioral2/files/0x0007000000023507-110.dat	upx
behavioral2/files/0x0007000000023506-105.dat	upx
behavioral2/files/0x0007000000023505-100.dat	upx
behavioral2/files/0x0007000000023503-90.dat	upx
behavioral2/files/0x0007000000023502-85.dat	upx
behavioral2/memory/2588-55-0x00007FF65E8C0000-0x00007FF65EC11000-memory.dmp	upx
behavioral2/memory/2876-54-0x00007FF70B140000-0x00007FF70B491000-memory.dmp	upx
behavioral2/files/0x00070000000234fb-50.dat	upx
behavioral2/files/0x00070000000234fd-49.dat	upx
behavioral2/memory/3408-47-0x00007FF6CE8F0000-0x00007FF6CEC41000-memory.dmp	upx
behavioral2/files/0x00070000000234fa-42.dat	upx
behavioral2/files/0x00070000000234f9-40.dat	upx
behavioral2/files/0x00070000000234f8-35.dat	upx
behavioral2/memory/4492-32-0x00007FF738460000-0x00007FF7387B1000-memory.dmp	upx
behavioral2/memory/2936-24-0x00007FF77AEB0000-0x00007FF77B201000-memory.dmp	upx
behavioral2/memory/312-17-0x00007FF6A0040000-0x00007FF6A0391000-memory.dmp	upx
behavioral2/memory/1900-10-0x00007FF6C8060000-0x00007FF6C83B1000-memory.dmp	upx
behavioral2/memory/1900-2172-0x00007FF6C8060000-0x00007FF6C83B1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wqyRlre.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\ivDCMpB.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\NwvtBJU.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\LditqCn.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\HItwmTr.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\mDYoFtS.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\SsoVYoX.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\XqHOJoc.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\GPwyWAn.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\cerbgix.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\sUYxxTD.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\fBllocK.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\vWlHqDC.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\SeSuSqw.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\roWqBjN.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\SkhljjA.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\GaeLfPv.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\GODGkAu.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\NovfxjD.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\ZdABjUb.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\BUlMKKJ.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\QIMhNDp.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\MUSYjmj.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\bLRlFPL.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\zBbiruh.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\BdaKEfl.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\AtEERRl.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\YnMueXl.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\prUAbOW.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\dptIgie.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\PPYmrGA.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\zygQOgD.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\kwyfntx.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\tBzqgeo.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\kVzqhyh.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\Xvkhawv.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\YwUkYpB.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\qLyZPvb.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\mHmLoyS.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\DFkmfqw.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\KVvMiTM.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\EKxKYCr.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\yKyqAuR.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\PirVLXM.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\BVEgdjn.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\ZZozUcM.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\BDVzLPM.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\PDKwfTw.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\lyrlqws.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\hOWqfGk.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\jpVZHus.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\IdusNrP.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\WoiWeEX.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\jucswdx.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\wEhTZgp.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\XBFwOZi.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\cdjPqwP.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\yDCMReR.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\cpKyepK.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\CfrRlwe.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\YDeuFeK.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\ptRUpvK.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\mEnjgbf.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
File created	C:\Windows\System\sTdyDAe.exe	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1900	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	83
PID 2076 wrote to memory of 1900	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	83
PID 2076 wrote to memory of 312	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	84
PID 2076 wrote to memory of 312	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	84
PID 2076 wrote to memory of 2936	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	85
PID 2076 wrote to memory of 2936	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	85
PID 2076 wrote to memory of 4492	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	86
PID 2076 wrote to memory of 4492	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	86
PID 2076 wrote to memory of 4988	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	87
PID 2076 wrote to memory of 4988	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	87
PID 2076 wrote to memory of 4928	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	88
PID 2076 wrote to memory of 4928	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	88
PID 2076 wrote to memory of 2876	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	89
PID 2076 wrote to memory of 2876	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	89
PID 2076 wrote to memory of 3408	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	90
PID 2076 wrote to memory of 3408	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	90
PID 2076 wrote to memory of 2588	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	91
PID 2076 wrote to memory of 2588	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	91
PID 2076 wrote to memory of 3956	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	92
PID 2076 wrote to memory of 3956	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	92
PID 2076 wrote to memory of 1940	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	93
PID 2076 wrote to memory of 1940	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	93
PID 2076 wrote to memory of 640	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	94
PID 2076 wrote to memory of 640	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	94
PID 2076 wrote to memory of 2668	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	96
PID 2076 wrote to memory of 2668	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	96
PID 2076 wrote to memory of 1076	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	97
PID 2076 wrote to memory of 1076	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	97
PID 2076 wrote to memory of 3832	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	98
PID 2076 wrote to memory of 3832	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	98
PID 2076 wrote to memory of 4548	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	99
PID 2076 wrote to memory of 4548	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	99
PID 2076 wrote to memory of 4184	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	100
PID 2076 wrote to memory of 4184	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	100
PID 2076 wrote to memory of 3984	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	101
PID 2076 wrote to memory of 3984	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	101
PID 2076 wrote to memory of 1820	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	102
PID 2076 wrote to memory of 1820	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	102
PID 2076 wrote to memory of 2428	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	103
PID 2076 wrote to memory of 2428	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	103
PID 2076 wrote to memory of 1492	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	104
PID 2076 wrote to memory of 1492	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	104
PID 2076 wrote to memory of 1532	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	105
PID 2076 wrote to memory of 1532	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	105
PID 2076 wrote to memory of 4300	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	106
PID 2076 wrote to memory of 4300	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	106
PID 2076 wrote to memory of 1916	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	107
PID 2076 wrote to memory of 1916	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	107
PID 2076 wrote to memory of 2584	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	108
PID 2076 wrote to memory of 2584	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	108
PID 2076 wrote to memory of 2372	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	109
PID 2076 wrote to memory of 2372	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	109
PID 2076 wrote to memory of 4212	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	110
PID 2076 wrote to memory of 4212	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	110
PID 2076 wrote to memory of 4768	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	111
PID 2076 wrote to memory of 4768	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	111
PID 2076 wrote to memory of 4360	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	112
PID 2076 wrote to memory of 4360	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	112
PID 2076 wrote to memory of 3936	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	113
PID 2076 wrote to memory of 3936	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	113
PID 2076 wrote to memory of 4064	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	114
PID 2076 wrote to memory of 4064	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	114
PID 2076 wrote to memory of 1116	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	115
PID 2076 wrote to memory of 1116	2076	15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe	115

C:\Users\Admin\AppData\Local\Temp\15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe
"C:\Users\Admin\AppData\Local\Temp\15f1e183093693731832aaa2a2fe4523999d17e1bf62cf59b86dfba3594ac8d1.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\System\pScrbaZ.exe
  C:\Windows\System\pScrbaZ.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\MicRffY.exe
  C:\Windows\System\MicRffY.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\DRyQwoO.exe
  C:\Windows\System\DRyQwoO.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\bTZcMnY.exe
  C:\Windows\System\bTZcMnY.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\vpHIVnu.exe
  C:\Windows\System\vpHIVnu.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\mHmLoyS.exe
  C:\Windows\System\mHmLoyS.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\eIgeYUE.exe
  C:\Windows\System\eIgeYUE.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\XxBqyKc.exe
  C:\Windows\System\XxBqyKc.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\Sbqtdes.exe
  C:\Windows\System\Sbqtdes.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\qFxrvnn.exe
  C:\Windows\System\qFxrvnn.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\nnBkwTm.exe
  C:\Windows\System\nnBkwTm.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\NovfxjD.exe
  C:\Windows\System\NovfxjD.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\yzoKVkA.exe
  C:\Windows\System\yzoKVkA.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\kcYqKEX.exe
  C:\Windows\System\kcYqKEX.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\hJmruzo.exe
  C:\Windows\System\hJmruzo.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\xmYHVuk.exe
  C:\Windows\System\xmYHVuk.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\fyQIvDy.exe
  C:\Windows\System\fyQIvDy.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\AUIsGJW.exe
  C:\Windows\System\AUIsGJW.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\lEAjKmQ.exe
  C:\Windows\System\lEAjKmQ.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\kVzqhyh.exe
  C:\Windows\System\kVzqhyh.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\McOIzRV.exe
  C:\Windows\System\McOIzRV.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\qMnQsYo.exe
  C:\Windows\System\qMnQsYo.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\ozxlFpZ.exe
  C:\Windows\System\ozxlFpZ.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\CbxfVMQ.exe
  C:\Windows\System\CbxfVMQ.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\VBxnEvR.exe
  C:\Windows\System\VBxnEvR.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\AnKYLoY.exe
  C:\Windows\System\AnKYLoY.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\BDVzLPM.exe
  C:\Windows\System\BDVzLPM.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\iscvaje.exe
  C:\Windows\System\iscvaje.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\azkeObK.exe
  C:\Windows\System\azkeObK.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\PJIMbmN.exe
  C:\Windows\System\PJIMbmN.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\IiHuOgf.exe
  C:\Windows\System\IiHuOgf.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\AtEERRl.exe
  C:\Windows\System\AtEERRl.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\NXWeJDL.exe
  C:\Windows\System\NXWeJDL.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\DMEbMWg.exe
  C:\Windows\System\DMEbMWg.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\UtRGrye.exe
  C:\Windows\System\UtRGrye.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\JYtupIs.exe
  C:\Windows\System\JYtupIs.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\dLbLfqo.exe
  C:\Windows\System\dLbLfqo.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\aWVRSro.exe
  C:\Windows\System\aWVRSro.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\WaEfgIX.exe
  C:\Windows\System\WaEfgIX.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\LWFbGdS.exe
  C:\Windows\System\LWFbGdS.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\dovZWhN.exe
  C:\Windows\System\dovZWhN.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\WGpPQep.exe
  C:\Windows\System\WGpPQep.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\OngGbWe.exe
  C:\Windows\System\OngGbWe.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\cSoAnIc.exe
  C:\Windows\System\cSoAnIc.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\GLtHbSq.exe
  C:\Windows\System\GLtHbSq.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\saAVbrl.exe
  C:\Windows\System\saAVbrl.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\hAqrevx.exe
  C:\Windows\System\hAqrevx.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\IMrBKgT.exe
  C:\Windows\System\IMrBKgT.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\MmjTORz.exe
  C:\Windows\System\MmjTORz.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\zQjPQpK.exe
  C:\Windows\System\zQjPQpK.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\THeLryh.exe
  C:\Windows\System\THeLryh.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\nTYxEno.exe
  C:\Windows\System\nTYxEno.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\tbSPjJR.exe
  C:\Windows\System\tbSPjJR.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\PLHemGr.exe
  C:\Windows\System\PLHemGr.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\DgzOArN.exe
  C:\Windows\System\DgzOArN.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\Xvkhawv.exe
  C:\Windows\System\Xvkhawv.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\YDeuFeK.exe
  C:\Windows\System\YDeuFeK.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\ScxQKen.exe
  C:\Windows\System\ScxQKen.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\YeIwrOF.exe
  C:\Windows\System\YeIwrOF.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\GPwyWAn.exe
  C:\Windows\System\GPwyWAn.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\fcMsJnx.exe
  C:\Windows\System\fcMsJnx.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\mXGnPQc.exe
  C:\Windows\System\mXGnPQc.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\EIvOOOS.exe
  C:\Windows\System\EIvOOOS.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\phmfYLm.exe
  C:\Windows\System\phmfYLm.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\AblWikX.exe
  C:\Windows\System\AblWikX.exe
  2⤵
  PID:3136
- C:\Windows\System\MjCZMsS.exe
  C:\Windows\System\MjCZMsS.exe
  2⤵
  PID:3992
- C:\Windows\System\bmdGcLM.exe
  C:\Windows\System\bmdGcLM.exe
  2⤵
  PID:1276
- C:\Windows\System\JUGkgmy.exe
  C:\Windows\System\JUGkgmy.exe
  2⤵
  PID:3020
- C:\Windows\System\VTvcDrD.exe
  C:\Windows\System\VTvcDrD.exe
  2⤵
  PID:3620
- C:\Windows\System\RlxQqwL.exe
  C:\Windows\System\RlxQqwL.exe
  2⤵
  PID:4204
- C:\Windows\System\LxbgBvD.exe
  C:\Windows\System\LxbgBvD.exe
  2⤵
  PID:60
- C:\Windows\System\kGtBnao.exe
  C:\Windows\System\kGtBnao.exe
  2⤵
  PID:4392
- C:\Windows\System\yYGfBOe.exe
  C:\Windows\System\yYGfBOe.exe
  2⤵
  PID:4380
- C:\Windows\System\iBgnANq.exe
  C:\Windows\System\iBgnANq.exe
  2⤵
  PID:536
- C:\Windows\System\RCFxLwb.exe
  C:\Windows\System\RCFxLwb.exe
  2⤵
  PID:4348
- C:\Windows\System\ZdABjUb.exe
  C:\Windows\System\ZdABjUb.exe
  2⤵
  PID:4312
- C:\Windows\System\pXxAwpL.exe
  C:\Windows\System\pXxAwpL.exe
  2⤵
  PID:3024
- C:\Windows\System\OgRBnPG.exe
  C:\Windows\System\OgRBnPG.exe
  2⤵
  PID:4568
- C:\Windows\System\cYiNtKR.exe
  C:\Windows\System\cYiNtKR.exe
  2⤵
  PID:1288
- C:\Windows\System\noAzOeK.exe
  C:\Windows\System\noAzOeK.exe
  2⤵
  PID:2164
- C:\Windows\System\JfYNeGj.exe
  C:\Windows\System\JfYNeGj.exe
  2⤵
  PID:1784
- C:\Windows\System\PvhULei.exe
  C:\Windows\System\PvhULei.exe
  2⤵
  PID:1876
- C:\Windows\System\moXDFcv.exe
  C:\Windows\System\moXDFcv.exe
  2⤵
  PID:3384
- C:\Windows\System\PIQGPOM.exe
  C:\Windows\System\PIQGPOM.exe
  2⤵
  PID:516
- C:\Windows\System\FXsKHhN.exe
  C:\Windows\System\FXsKHhN.exe
  2⤵
  PID:3044
- C:\Windows\System\MaZeRnH.exe
  C:\Windows\System\MaZeRnH.exe
  2⤵
  PID:3248
- C:\Windows\System\dYUheyM.exe
  C:\Windows\System\dYUheyM.exe
  2⤵
  PID:2536
- C:\Windows\System\PDkiuMA.exe
  C:\Windows\System\PDkiuMA.exe
  2⤵
  PID:1968
- C:\Windows\System\RScksGP.exe
  C:\Windows\System\RScksGP.exe
  2⤵
  PID:1216
- C:\Windows\System\pBkNqLY.exe
  C:\Windows\System\pBkNqLY.exe
  2⤵
  PID:2016
- C:\Windows\System\fMltTla.exe
  C:\Windows\System\fMltTla.exe
  2⤵
  PID:5128
- C:\Windows\System\ZsbIwDa.exe
  C:\Windows\System\ZsbIwDa.exe
  2⤵
  PID:5160
- C:\Windows\System\YwUkYpB.exe
  C:\Windows\System\YwUkYpB.exe
  2⤵
  PID:5184
- C:\Windows\System\GaYBkoQ.exe
  C:\Windows\System\GaYBkoQ.exe
  2⤵
  PID:5212
- C:\Windows\System\uoBaQsf.exe
  C:\Windows\System\uoBaQsf.exe
  2⤵
  PID:5244
- C:\Windows\System\wEhTZgp.exe
  C:\Windows\System\wEhTZgp.exe
  2⤵
  PID:5272
- C:\Windows\System\FGyPiuo.exe
  C:\Windows\System\FGyPiuo.exe
  2⤵
  PID:5300
- C:\Windows\System\vPClzUq.exe
  C:\Windows\System\vPClzUq.exe
  2⤵
  PID:5332
- C:\Windows\System\xjWWlgj.exe
  C:\Windows\System\xjWWlgj.exe
  2⤵
  PID:5360
- C:\Windows\System\vWcfitW.exe
  C:\Windows\System\vWcfitW.exe
  2⤵
  PID:5384
- C:\Windows\System\iolWsfL.exe
  C:\Windows\System\iolWsfL.exe
  2⤵
  PID:5412
- C:\Windows\System\plfDtqT.exe
  C:\Windows\System\plfDtqT.exe
  2⤵
  PID:5436
- C:\Windows\System\harQTaX.exe
  C:\Windows\System\harQTaX.exe
  2⤵
  PID:5464
- C:\Windows\System\CFFPJQm.exe
  C:\Windows\System\CFFPJQm.exe
  2⤵
  PID:5492
- C:\Windows\System\ivDCMpB.exe
  C:\Windows\System\ivDCMpB.exe
  2⤵
  PID:5524
- C:\Windows\System\pNJLFQL.exe
  C:\Windows\System\pNJLFQL.exe
  2⤵
  PID:5552
- C:\Windows\System\HERHFfi.exe
  C:\Windows\System\HERHFfi.exe
  2⤵
  PID:5576
- C:\Windows\System\mZkaoVe.exe
  C:\Windows\System\mZkaoVe.exe
  2⤵
  PID:5608
- C:\Windows\System\KLmrPeu.exe
  C:\Windows\System\KLmrPeu.exe
  2⤵
  PID:5636
- C:\Windows\System\sRwHDCK.exe
  C:\Windows\System\sRwHDCK.exe
  2⤵
  PID:5664
- C:\Windows\System\YnMueXl.exe
  C:\Windows\System\YnMueXl.exe
  2⤵
  PID:5688
- C:\Windows\System\pSEBPYX.exe
  C:\Windows\System\pSEBPYX.exe
  2⤵
  PID:5720
- C:\Windows\System\yMptWGi.exe
  C:\Windows\System\yMptWGi.exe
  2⤵
  PID:5748
- C:\Windows\System\rIHWzMP.exe
  C:\Windows\System\rIHWzMP.exe
  2⤵
  PID:5772
- C:\Windows\System\lcQFDag.exe
  C:\Windows\System\lcQFDag.exe
  2⤵
  PID:5800
- C:\Windows\System\CirOuMH.exe
  C:\Windows\System\CirOuMH.exe
  2⤵
  PID:5832
- C:\Windows\System\UNhJzZr.exe
  C:\Windows\System\UNhJzZr.exe
  2⤵
  PID:5860
- C:\Windows\System\xxuGEvy.exe
  C:\Windows\System\xxuGEvy.exe
  2⤵
  PID:5916
- C:\Windows\System\KkWOAjZ.exe
  C:\Windows\System\KkWOAjZ.exe
  2⤵
  PID:6004
- C:\Windows\System\xEeSBAi.exe
  C:\Windows\System\xEeSBAi.exe
  2⤵
  PID:6024
- C:\Windows\System\qbJOBxt.exe
  C:\Windows\System\qbJOBxt.exe
  2⤵
  PID:6048
- C:\Windows\System\ZGcZEOK.exe
  C:\Windows\System\ZGcZEOK.exe
  2⤵
  PID:6096
- C:\Windows\System\RPoanMh.exe
  C:\Windows\System\RPoanMh.exe
  2⤵
  PID:6112
- C:\Windows\System\IeMCDgc.exe
  C:\Windows\System\IeMCDgc.exe
  2⤵
  PID:4552
- C:\Windows\System\iLTwxjl.exe
  C:\Windows\System\iLTwxjl.exe
  2⤵
  PID:4432
- C:\Windows\System\umCbUFk.exe
  C:\Windows\System\umCbUFk.exe
  2⤵
  PID:1764
- C:\Windows\System\uOrrlUJ.exe
  C:\Windows\System\uOrrlUJ.exe
  2⤵
  PID:5268
- C:\Windows\System\wHpaQHp.exe
  C:\Windows\System\wHpaQHp.exe
  2⤵
  PID:5312
- C:\Windows\System\MijssMH.exe
  C:\Windows\System\MijssMH.exe
  2⤵
  PID:5340
- C:\Windows\System\NwvtBJU.exe
  C:\Windows\System\NwvtBJU.exe
  2⤵
  PID:5480
- C:\Windows\System\ptRUpvK.exe
  C:\Windows\System\ptRUpvK.exe
  2⤵
  PID:5544
- C:\Windows\System\jbnHaNs.exe
  C:\Windows\System\jbnHaNs.exe
  2⤵
  PID:5568
- C:\Windows\System\JxTnAJE.exe
  C:\Windows\System\JxTnAJE.exe
  2⤵
  PID:5600
- C:\Windows\System\QEtziFq.exe
  C:\Windows\System\QEtziFq.exe
  2⤵
  PID:5652
- C:\Windows\System\wTgkbNg.exe
  C:\Windows\System\wTgkbNg.exe
  2⤵
  PID:5732
- C:\Windows\System\sfAzIok.exe
  C:\Windows\System\sfAzIok.exe
  2⤵
  PID:5764
- C:\Windows\System\yCyLfOO.exe
  C:\Windows\System\yCyLfOO.exe
  2⤵
  PID:2696
- C:\Windows\System\TQJrCMr.exe
  C:\Windows\System\TQJrCMr.exe
  2⤵
  PID:3312
- C:\Windows\System\pffLZZB.exe
  C:\Windows\System\pffLZZB.exe
  2⤵
  PID:5848
- C:\Windows\System\cSVieJG.exe
  C:\Windows\System\cSVieJG.exe
  2⤵
  PID:3100
- C:\Windows\System\VtcRmfc.exe
  C:\Windows\System\VtcRmfc.exe
  2⤵
  PID:2620
- C:\Windows\System\kOqeWuc.exe
  C:\Windows\System\kOqeWuc.exe
  2⤵
  PID:5996
- C:\Windows\System\bDumWwA.exe
  C:\Windows\System\bDumWwA.exe
  2⤵
  PID:6060
- C:\Windows\System\ORDDnTg.exe
  C:\Windows\System\ORDDnTg.exe
  2⤵
  PID:4436
- C:\Windows\System\XBFwOZi.exe
  C:\Windows\System\XBFwOZi.exe
  2⤵
  PID:2648
- C:\Windows\System\vFpUgHv.exe
  C:\Windows\System\vFpUgHv.exe
  2⤵
  PID:232
- C:\Windows\System\prUAbOW.exe
  C:\Windows\System\prUAbOW.exe
  2⤵
  PID:5292
- C:\Windows\System\JUWBOsK.exe
  C:\Windows\System\JUWBOsK.exe
  2⤵
  PID:5980
- C:\Windows\System\jpVZHus.exe
  C:\Windows\System\jpVZHus.exe
  2⤵
  PID:5148
- C:\Windows\System\qkHjgaI.exe
  C:\Windows\System\qkHjgaI.exe
  2⤵
  PID:5152
- C:\Windows\System\OqXsZHd.exe
  C:\Windows\System\OqXsZHd.exe
  2⤵
  PID:5432
- C:\Windows\System\mdqlWOL.exe
  C:\Windows\System\mdqlWOL.exe
  2⤵
  PID:5064
- C:\Windows\System\cdjPqwP.exe
  C:\Windows\System\cdjPqwP.exe
  2⤵
  PID:5564
- C:\Windows\System\bHNiALA.exe
  C:\Windows\System\bHNiALA.exe
  2⤵
  PID:5736
- C:\Windows\System\XYfzGnY.exe
  C:\Windows\System\XYfzGnY.exe
  2⤵
  PID:5940
- C:\Windows\System\tefPkHR.exe
  C:\Windows\System\tefPkHR.exe
  2⤵
  PID:6068
- C:\Windows\System\csKFubQ.exe
  C:\Windows\System\csKFubQ.exe
  2⤵
  PID:6092
- C:\Windows\System\zLEJQKG.exe
  C:\Windows\System\zLEJQKG.exe
  2⤵
  PID:4188
- C:\Windows\System\EHnAYFd.exe
  C:\Windows\System\EHnAYFd.exe
  2⤵
  PID:6124
- C:\Windows\System\GSVroQZ.exe
  C:\Windows\System\GSVroQZ.exe
  2⤵
  PID:6128
- C:\Windows\System\cxSGIUE.exe
  C:\Windows\System\cxSGIUE.exe
  2⤵
  PID:5624
- C:\Windows\System\NhKQSsE.exe
  C:\Windows\System\NhKQSsE.exe
  2⤵
  PID:5900
- C:\Windows\System\QYemvqi.exe
  C:\Windows\System\QYemvqi.exe
  2⤵
  PID:1248
- C:\Windows\System\YywDsBT.exe
  C:\Windows\System\YywDsBT.exe
  2⤵
  PID:1844
- C:\Windows\System\xhJtJNf.exe
  C:\Windows\System\xhJtJNf.exe
  2⤵
  PID:1048
- C:\Windows\System\YtBohAG.exe
  C:\Windows\System\YtBohAG.exe
  2⤵
  PID:5816
- C:\Windows\System\bWIfMbi.exe
  C:\Windows\System\bWIfMbi.exe
  2⤵
  PID:6080
- C:\Windows\System\OAbRkVv.exe
  C:\Windows\System\OAbRkVv.exe
  2⤵
  PID:6160
- C:\Windows\System\gkTpBoL.exe
  C:\Windows\System\gkTpBoL.exe
  2⤵
  PID:6180
- C:\Windows\System\dYPLOUd.exe
  C:\Windows\System\dYPLOUd.exe
  2⤵
  PID:6196
- C:\Windows\System\pZBYrae.exe
  C:\Windows\System\pZBYrae.exe
  2⤵
  PID:6224
- C:\Windows\System\btBlOtC.exe
  C:\Windows\System\btBlOtC.exe
  2⤵
  PID:6244
- C:\Windows\System\zXZeDmH.exe
  C:\Windows\System\zXZeDmH.exe
  2⤵
  PID:6280
- C:\Windows\System\QFViNIh.exe
  C:\Windows\System\QFViNIh.exe
  2⤵
  PID:6320
- C:\Windows\System\PDKwfTw.exe
  C:\Windows\System\PDKwfTw.exe
  2⤵
  PID:6340
- C:\Windows\System\PPYmrGA.exe
  C:\Windows\System\PPYmrGA.exe
  2⤵
  PID:6360
- C:\Windows\System\UWLhzyF.exe
  C:\Windows\System\UWLhzyF.exe
  2⤵
  PID:6380
- C:\Windows\System\ggmwJgQ.exe
  C:\Windows\System\ggmwJgQ.exe
  2⤵
  PID:6424
- C:\Windows\System\ldxvnzr.exe
  C:\Windows\System\ldxvnzr.exe
  2⤵
  PID:6448
- C:\Windows\System\lyrlqws.exe
  C:\Windows\System\lyrlqws.exe
  2⤵
  PID:6476
- C:\Windows\System\trzsvDZ.exe
  C:\Windows\System\trzsvDZ.exe
  2⤵
  PID:6500
- C:\Windows\System\mEnjgbf.exe
  C:\Windows\System\mEnjgbf.exe
  2⤵
  PID:6520
- C:\Windows\System\IdusNrP.exe
  C:\Windows\System\IdusNrP.exe
  2⤵
  PID:6572
- C:\Windows\System\JsXXXoK.exe
  C:\Windows\System\JsXXXoK.exe
  2⤵
  PID:6596
- C:\Windows\System\HItwmTr.exe
  C:\Windows\System\HItwmTr.exe
  2⤵
  PID:6616
- C:\Windows\System\yHWaHzc.exe
  C:\Windows\System\yHWaHzc.exe
  2⤵
  PID:6668
- C:\Windows\System\kfEFSXl.exe
  C:\Windows\System\kfEFSXl.exe
  2⤵
  PID:6740
- C:\Windows\System\VWRlOQs.exe
  C:\Windows\System\VWRlOQs.exe
  2⤵
  PID:6756
- C:\Windows\System\LUFnZoI.exe
  C:\Windows\System\LUFnZoI.exe
  2⤵
  PID:6776
- C:\Windows\System\SeSuSqw.exe
  C:\Windows\System\SeSuSqw.exe
  2⤵
  PID:6804
- C:\Windows\System\oGImaqL.exe
  C:\Windows\System\oGImaqL.exe
  2⤵
  PID:6832
- C:\Windows\System\pxWJzAQ.exe
  C:\Windows\System\pxWJzAQ.exe
  2⤵
  PID:6856
- C:\Windows\System\iWSYvkL.exe
  C:\Windows\System\iWSYvkL.exe
  2⤵
  PID:6884
- C:\Windows\System\AbHNJfW.exe
  C:\Windows\System\AbHNJfW.exe
  2⤵
  PID:6904
- C:\Windows\System\QnJHIdA.exe
  C:\Windows\System\QnJHIdA.exe
  2⤵
  PID:6956
- C:\Windows\System\YvVclfc.exe
  C:\Windows\System\YvVclfc.exe
  2⤵
  PID:6976
- C:\Windows\System\SZYygEf.exe
  C:\Windows\System\SZYygEf.exe
  2⤵
  PID:6996
- C:\Windows\System\moqJbxv.exe
  C:\Windows\System\moqJbxv.exe
  2⤵
  PID:7036
- C:\Windows\System\kzYOPVB.exe
  C:\Windows\System\kzYOPVB.exe
  2⤵
  PID:7056
- C:\Windows\System\dLxbAXG.exe
  C:\Windows\System\dLxbAXG.exe
  2⤵
  PID:7080
- C:\Windows\System\FlbhSgS.exe
  C:\Windows\System\FlbhSgS.exe
  2⤵
  PID:7096
- C:\Windows\System\ihdjrUv.exe
  C:\Windows\System\ihdjrUv.exe
  2⤵
  PID:7132
- C:\Windows\System\GDgMPMo.exe
  C:\Windows\System\GDgMPMo.exe
  2⤵
  PID:6168
- C:\Windows\System\ftiwwdr.exe
  C:\Windows\System\ftiwwdr.exe
  2⤵
  PID:6148
- C:\Windows\System\cerbgix.exe
  C:\Windows\System\cerbgix.exe
  2⤵
  PID:6176
- C:\Windows\System\mwjBLbN.exe
  C:\Windows\System\mwjBLbN.exe
  2⤵
  PID:6272
- C:\Windows\System\yQuIAxq.exe
  C:\Windows\System\yQuIAxq.exe
  2⤵
  PID:6332
- C:\Windows\System\DRAgsxH.exe
  C:\Windows\System\DRAgsxH.exe
  2⤵
  PID:6352
- C:\Windows\System\pUuVlKM.exe
  C:\Windows\System\pUuVlKM.exe
  2⤵
  PID:6412
- C:\Windows\System\peLdImx.exe
  C:\Windows\System\peLdImx.exe
  2⤵
  PID:6492
- C:\Windows\System\apsokuF.exe
  C:\Windows\System\apsokuF.exe
  2⤵
  PID:6496
- C:\Windows\System\oZINmyK.exe
  C:\Windows\System\oZINmyK.exe
  2⤵
  PID:6584
- C:\Windows\System\jyoDyAt.exe
  C:\Windows\System\jyoDyAt.exe
  2⤵
  PID:6716
- C:\Windows\System\roWqBjN.exe
  C:\Windows\System\roWqBjN.exe
  2⤵
  PID:6796
- C:\Windows\System\mCPlNyF.exe
  C:\Windows\System\mCPlNyF.exe
  2⤵
  PID:6876
- C:\Windows\System\yriIbpI.exe
  C:\Windows\System\yriIbpI.exe
  2⤵
  PID:6920
- C:\Windows\System\vozAqZm.exe
  C:\Windows\System\vozAqZm.exe
  2⤵
  PID:6992
- C:\Windows\System\ebQIWpl.exe
  C:\Windows\System\ebQIWpl.exe
  2⤵
  PID:7088
- C:\Windows\System\xzrqNLe.exe
  C:\Windows\System\xzrqNLe.exe
  2⤵
  PID:7064
- C:\Windows\System\AtoAaqe.exe
  C:\Windows\System\AtoAaqe.exe
  2⤵
  PID:6156
- C:\Windows\System\qjvnoGR.exe
  C:\Windows\System\qjvnoGR.exe
  2⤵
  PID:6328
- C:\Windows\System\VqpqFCG.exe
  C:\Windows\System\VqpqFCG.exe
  2⤵
  PID:6312
- C:\Windows\System\RnCQykO.exe
  C:\Windows\System\RnCQykO.exe
  2⤵
  PID:6444
- C:\Windows\System\yrUmQuj.exe
  C:\Windows\System\yrUmQuj.exe
  2⤵
  PID:6688
- C:\Windows\System\XhcrcBr.exe
  C:\Windows\System\XhcrcBr.exe
  2⤵
  PID:7024
- C:\Windows\System\ZOJGINH.exe
  C:\Windows\System\ZOJGINH.exe
  2⤵
  PID:7128
- C:\Windows\System\QfVmNKh.exe
  C:\Windows\System\QfVmNKh.exe
  2⤵
  PID:6472
- C:\Windows\System\VKAJEta.exe
  C:\Windows\System\VKAJEta.exe
  2⤵
  PID:6432
- C:\Windows\System\ttYhJdf.exe
  C:\Windows\System\ttYhJdf.exe
  2⤵
  PID:6624
- C:\Windows\System\eesSjyX.exe
  C:\Windows\System\eesSjyX.exe
  2⤵
  PID:7160
- C:\Windows\System\SkhljjA.exe
  C:\Windows\System\SkhljjA.exe
  2⤵
  PID:7176
- C:\Windows\System\UdkKiys.exe
  C:\Windows\System\UdkKiys.exe
  2⤵
  PID:7192
- C:\Windows\System\dikzfSz.exe
  C:\Windows\System\dikzfSz.exe
  2⤵
  PID:7232
- C:\Windows\System\PBUDvBZ.exe
  C:\Windows\System\PBUDvBZ.exe
  2⤵
  PID:7252
- C:\Windows\System\dlfSJhq.exe
  C:\Windows\System\dlfSJhq.exe
  2⤵
  PID:7272
- C:\Windows\System\YWjXyFV.exe
  C:\Windows\System\YWjXyFV.exe
  2⤵
  PID:7288
- C:\Windows\System\fGGCDoE.exe
  C:\Windows\System\fGGCDoE.exe
  2⤵
  PID:7308
- C:\Windows\System\fbTYYdP.exe
  C:\Windows\System\fbTYYdP.exe
  2⤵
  PID:7376
- C:\Windows\System\BUlMKKJ.exe
  C:\Windows\System\BUlMKKJ.exe
  2⤵
  PID:7396
- C:\Windows\System\ruaOEIh.exe
  C:\Windows\System\ruaOEIh.exe
  2⤵
  PID:7412
- C:\Windows\System\SqbgKBy.exe
  C:\Windows\System\SqbgKBy.exe
  2⤵
  PID:7456
- C:\Windows\System\rrQKbdW.exe
  C:\Windows\System\rrQKbdW.exe
  2⤵
  PID:7472
- C:\Windows\System\jNEKXWL.exe
  C:\Windows\System\jNEKXWL.exe
  2⤵
  PID:7496
- C:\Windows\System\nkYHjHs.exe
  C:\Windows\System\nkYHjHs.exe
  2⤵
  PID:7512
- C:\Windows\System\AjMGqVI.exe
  C:\Windows\System\AjMGqVI.exe
  2⤵
  PID:7552
- C:\Windows\System\IcYTeee.exe
  C:\Windows\System\IcYTeee.exe
  2⤵
  PID:7592
- C:\Windows\System\SnOPgHd.exe
  C:\Windows\System\SnOPgHd.exe
  2⤵
  PID:7632
- C:\Windows\System\qvWsNeD.exe
  C:\Windows\System\qvWsNeD.exe
  2⤵
  PID:7648
- C:\Windows\System\kaJvIPP.exe
  C:\Windows\System\kaJvIPP.exe
  2⤵
  PID:7668
- C:\Windows\System\ojLzQNI.exe
  C:\Windows\System\ojLzQNI.exe
  2⤵
  PID:7696
- C:\Windows\System\VSKHYoS.exe
  C:\Windows\System\VSKHYoS.exe
  2⤵
  PID:7724
- C:\Windows\System\xgWlKyq.exe
  C:\Windows\System\xgWlKyq.exe
  2⤵
  PID:7748
- C:\Windows\System\OJdzYWF.exe
  C:\Windows\System\OJdzYWF.exe
  2⤵
  PID:7780
- C:\Windows\System\RUXuyaZ.exe
  C:\Windows\System\RUXuyaZ.exe
  2⤵
  PID:7804
- C:\Windows\System\hypnVXj.exe
  C:\Windows\System\hypnVXj.exe
  2⤵
  PID:7824
- C:\Windows\System\LditqCn.exe
  C:\Windows\System\LditqCn.exe
  2⤵
  PID:7860
- C:\Windows\System\FLGejrV.exe
  C:\Windows\System\FLGejrV.exe
  2⤵
  PID:7880
- C:\Windows\System\cBNCtaJ.exe
  C:\Windows\System\cBNCtaJ.exe
  2⤵
  PID:7908
- C:\Windows\System\ppDpsjj.exe
  C:\Windows\System\ppDpsjj.exe
  2⤵
  PID:7936
- C:\Windows\System\tDAuaEG.exe
  C:\Windows\System\tDAuaEG.exe
  2⤵
  PID:7984
- C:\Windows\System\VwZRYwB.exe
  C:\Windows\System\VwZRYwB.exe
  2⤵
  PID:8004
- C:\Windows\System\cJrQZcQ.exe
  C:\Windows\System\cJrQZcQ.exe
  2⤵
  PID:8028
- C:\Windows\System\cLSTwJb.exe
  C:\Windows\System\cLSTwJb.exe
  2⤵
  PID:8048
- C:\Windows\System\EKxKYCr.exe
  C:\Windows\System\EKxKYCr.exe
  2⤵
  PID:8096
- C:\Windows\System\DFkmfqw.exe
  C:\Windows\System\DFkmfqw.exe
  2⤵
  PID:8136
- C:\Windows\System\rGjjkRZ.exe
  C:\Windows\System\rGjjkRZ.exe
  2⤵
  PID:8160
- C:\Windows\System\xroWpUX.exe
  C:\Windows\System\xroWpUX.exe
  2⤵
  PID:8180
- C:\Windows\System\uNMxaYH.exe
  C:\Windows\System\uNMxaYH.exe
  2⤵
  PID:7184
- C:\Windows\System\YjMspqa.exe
  C:\Windows\System\YjMspqa.exe
  2⤵
  PID:7284
- C:\Windows\System\bMhOBEU.exe
  C:\Windows\System\bMhOBEU.exe
  2⤵
  PID:7344
- C:\Windows\System\wNwxESb.exe
  C:\Windows\System\wNwxESb.exe
  2⤵
  PID:7404
- C:\Windows\System\eRvAIcz.exe
  C:\Windows\System\eRvAIcz.exe
  2⤵
  PID:7444
- C:\Windows\System\isbBpLY.exe
  C:\Windows\System\isbBpLY.exe
  2⤵
  PID:7428
- C:\Windows\System\FCUZwmX.exe
  C:\Windows\System\FCUZwmX.exe
  2⤵
  PID:7572
- C:\Windows\System\APjAKjS.exe
  C:\Windows\System\APjAKjS.exe
  2⤵
  PID:7644
- C:\Windows\System\xjbDVzO.exe
  C:\Windows\System\xjbDVzO.exe
  2⤵
  PID:7720
- C:\Windows\System\wqyRlre.exe
  C:\Windows\System\wqyRlre.exe
  2⤵
  PID:7744
- C:\Windows\System\QopnTQw.exe
  C:\Windows\System\QopnTQw.exe
  2⤵
  PID:7820
- C:\Windows\System\qPHsXpD.exe
  C:\Windows\System\qPHsXpD.exe
  2⤵
  PID:7916
- C:\Windows\System\hkYvCRB.exe
  C:\Windows\System\hkYvCRB.exe
  2⤵
  PID:7900
- C:\Windows\System\ipLjUxA.exe
  C:\Windows\System\ipLjUxA.exe
  2⤵
  PID:8044
- C:\Windows\System\zLihErb.exe
  C:\Windows\System\zLihErb.exe
  2⤵
  PID:8148
- C:\Windows\System\sOvFrgh.exe
  C:\Windows\System\sOvFrgh.exe
  2⤵
  PID:7224
- C:\Windows\System\itZkVsN.exe
  C:\Windows\System\itZkVsN.exe
  2⤵
  PID:7316
- C:\Windows\System\iWHMFTh.exe
  C:\Windows\System\iWHMFTh.exe
  2⤵
  PID:7408
- C:\Windows\System\yKyqAuR.exe
  C:\Windows\System\yKyqAuR.exe
  2⤵
  PID:7544
- C:\Windows\System\HEZfJyN.exe
  C:\Windows\System\HEZfJyN.exe
  2⤵
  PID:7608
- C:\Windows\System\PXhWPId.exe
  C:\Windows\System\PXhWPId.exe
  2⤵
  PID:7848
- C:\Windows\System\RnBGRiI.exe
  C:\Windows\System\RnBGRiI.exe
  2⤵
  PID:8084
- C:\Windows\System\uGXxuLi.exe
  C:\Windows\System\uGXxuLi.exe
  2⤵
  PID:6972
- C:\Windows\System\CbqrKnA.exe
  C:\Windows\System\CbqrKnA.exe
  2⤵
  PID:7368
- C:\Windows\System\SbCROns.exe
  C:\Windows\System\SbCROns.exe
  2⤵
  PID:7612
- C:\Windows\System\nMiwhJJ.exe
  C:\Windows\System\nMiwhJJ.exe
  2⤵
  PID:7972
- C:\Windows\System\obcjHyS.exe
  C:\Windows\System\obcjHyS.exe
  2⤵
  PID:7788
- C:\Windows\System\zTPEPvA.exe
  C:\Windows\System\zTPEPvA.exe
  2⤵
  PID:8208
- C:\Windows\System\QKXbTYP.exe
  C:\Windows\System\QKXbTYP.exe
  2⤵
  PID:8232
- C:\Windows\System\JJeKvzK.exe
  C:\Windows\System\JJeKvzK.exe
  2⤵
  PID:8276
- C:\Windows\System\vqMQAbc.exe
  C:\Windows\System\vqMQAbc.exe
  2⤵
  PID:8292
- C:\Windows\System\jFAsqNA.exe
  C:\Windows\System\jFAsqNA.exe
  2⤵
  PID:8316
- C:\Windows\System\gxCjwAG.exe
  C:\Windows\System\gxCjwAG.exe
  2⤵
  PID:8336
- C:\Windows\System\jYnCaTq.exe
  C:\Windows\System\jYnCaTq.exe
  2⤵
  PID:8384
- C:\Windows\System\GVOpNVk.exe
  C:\Windows\System\GVOpNVk.exe
  2⤵
  PID:8416
- C:\Windows\System\fzdRPFl.exe
  C:\Windows\System\fzdRPFl.exe
  2⤵
  PID:8440
- C:\Windows\System\ddjyLsT.exe
  C:\Windows\System\ddjyLsT.exe
  2⤵
  PID:8460
- C:\Windows\System\bDjZrHO.exe
  C:\Windows\System\bDjZrHO.exe
  2⤵
  PID:8492
- C:\Windows\System\QIMhNDp.exe
  C:\Windows\System\QIMhNDp.exe
  2⤵
  PID:8512
- C:\Windows\System\aMiYWdQ.exe
  C:\Windows\System\aMiYWdQ.exe
  2⤵
  PID:8552
- C:\Windows\System\sLBmmBT.exe
  C:\Windows\System\sLBmmBT.exe
  2⤵
  PID:8572
- C:\Windows\System\EbnJltP.exe
  C:\Windows\System\EbnJltP.exe
  2⤵
  PID:8596
- C:\Windows\System\QlCKdZF.exe
  C:\Windows\System\QlCKdZF.exe
  2⤵
  PID:8616
- C:\Windows\System\MartxJA.exe
  C:\Windows\System\MartxJA.exe
  2⤵
  PID:8640
- C:\Windows\System\dGMabQQ.exe
  C:\Windows\System\dGMabQQ.exe
  2⤵
  PID:8660
- C:\Windows\System\cpWeIfG.exe
  C:\Windows\System\cpWeIfG.exe
  2⤵
  PID:8692
- C:\Windows\System\MbKBCsM.exe
  C:\Windows\System\MbKBCsM.exe
  2⤵
  PID:8716
- C:\Windows\System\TgmuDtg.exe
  C:\Windows\System\TgmuDtg.exe
  2⤵
  PID:8736
- C:\Windows\System\GCDIsDH.exe
  C:\Windows\System\GCDIsDH.exe
  2⤵
  PID:8760
- C:\Windows\System\WJkbDRG.exe
  C:\Windows\System\WJkbDRG.exe
  2⤵
  PID:8780
- C:\Windows\System\MWJJzBi.exe
  C:\Windows\System\MWJJzBi.exe
  2⤵
  PID:8800
- C:\Windows\System\qYCXFrm.exe
  C:\Windows\System\qYCXFrm.exe
  2⤵
  PID:8844
- C:\Windows\System\DRNYVNH.exe
  C:\Windows\System\DRNYVNH.exe
  2⤵
  PID:8880
- C:\Windows\System\zlaqNdF.exe
  C:\Windows\System\zlaqNdF.exe
  2⤵
  PID:8896
- C:\Windows\System\WTanRrJ.exe
  C:\Windows\System\WTanRrJ.exe
  2⤵
  PID:8924
- C:\Windows\System\ktTofLX.exe
  C:\Windows\System\ktTofLX.exe
  2⤵
  PID:8964
- C:\Windows\System\NlYXYsz.exe
  C:\Windows\System\NlYXYsz.exe
  2⤵
  PID:9016
- C:\Windows\System\qzIBUtx.exe
  C:\Windows\System\qzIBUtx.exe
  2⤵
  PID:9036
- C:\Windows\System\CQFyayP.exe
  C:\Windows\System\CQFyayP.exe
  2⤵
  PID:9072
- C:\Windows\System\QcctoYw.exe
  C:\Windows\System\QcctoYw.exe
  2⤵
  PID:9096
- C:\Windows\System\sVgZAnG.exe
  C:\Windows\System\sVgZAnG.exe
  2⤵
  PID:9144
- C:\Windows\System\GLWFSWY.exe
  C:\Windows\System\GLWFSWY.exe
  2⤵
  PID:9164
- C:\Windows\System\yLgUAEj.exe
  C:\Windows\System\yLgUAEj.exe
  2⤵
  PID:9184
- C:\Windows\System\yOOICBO.exe
  C:\Windows\System\yOOICBO.exe
  2⤵
  PID:7548
- C:\Windows\System\QSnATPq.exe
  C:\Windows\System\QSnATPq.exe
  2⤵
  PID:7996
- C:\Windows\System\pGvSyfB.exe
  C:\Windows\System\pGvSyfB.exe
  2⤵
  PID:8288
- C:\Windows\System\UVYRdca.exe
  C:\Windows\System\UVYRdca.exe
  2⤵
  PID:8564
- C:\Windows\System\KINoaaH.exe
  C:\Windows\System\KINoaaH.exe
  2⤵
  PID:8608
- C:\Windows\System\zvGRHcT.exe
  C:\Windows\System\zvGRHcT.exe
  2⤵
  PID:8680
- C:\Windows\System\TORHqnn.exe
  C:\Windows\System\TORHqnn.exe
  2⤵
  PID:8732
- C:\Windows\System\vlEiXmm.exe
  C:\Windows\System\vlEiXmm.exe
  2⤵
  PID:8856
- C:\Windows\System\gXUxKID.exe
  C:\Windows\System\gXUxKID.exe
  2⤵
  PID:8892
- C:\Windows\System\LDPwQHz.exe
  C:\Windows\System\LDPwQHz.exe
  2⤵
  PID:8920
- C:\Windows\System\odnEIXD.exe
  C:\Windows\System\odnEIXD.exe
  2⤵
  PID:8960
- C:\Windows\System\tOiSbkN.exe
  C:\Windows\System\tOiSbkN.exe
  2⤵
  PID:9032
- C:\Windows\System\ZQBNLvg.exe
  C:\Windows\System\ZQBNLvg.exe
  2⤵
  PID:9092
- C:\Windows\System\ooOLGbW.exe
  C:\Windows\System\ooOLGbW.exe
  2⤵
  PID:9136
- C:\Windows\System\UfhgrJM.exe
  C:\Windows\System\UfhgrJM.exe
  2⤵
  PID:8656
- C:\Windows\System\aOHSFrB.exe
  C:\Windows\System\aOHSFrB.exe
  2⤵
  PID:8508
- C:\Windows\System\NXhLaTp.exe
  C:\Windows\System\NXhLaTp.exe
  2⤵
  PID:8500
- C:\Windows\System\AOLtuds.exe
  C:\Windows\System\AOLtuds.exe
  2⤵
  PID:8812
- C:\Windows\System\njdKKRX.exe
  C:\Windows\System\njdKKRX.exe
  2⤵
  PID:8756
- C:\Windows\System\jYwEgMD.exe
  C:\Windows\System\jYwEgMD.exe
  2⤵
  PID:9044
- C:\Windows\System\vKhbScP.exe
  C:\Windows\System\vKhbScP.exe
  2⤵
  PID:8772
- C:\Windows\System\xuFBtYD.exe
  C:\Windows\System\xuFBtYD.exe
  2⤵
  PID:8220
- C:\Windows\System\PqkPAFc.exe
  C:\Windows\System\PqkPAFc.exe
  2⤵
  PID:8484
- C:\Windows\System\lxPTDqK.exe
  C:\Windows\System\lxPTDqK.exe
  2⤵
  PID:8888
- C:\Windows\System\ZZOfPBY.exe
  C:\Windows\System\ZZOfPBY.exe
  2⤵
  PID:8728
- C:\Windows\System\eqnXlxA.exe
  C:\Windows\System\eqnXlxA.exe
  2⤵
  PID:8436
- C:\Windows\System\qiKkZnW.exe
  C:\Windows\System\qiKkZnW.exe
  2⤵
  PID:8840
- C:\Windows\System\pnYOcaB.exe
  C:\Windows\System\pnYOcaB.exe
  2⤵
  PID:9236
- C:\Windows\System\xXlmNWG.exe
  C:\Windows\System\xXlmNWG.exe
  2⤵
  PID:9260
- C:\Windows\System\FKJgxoN.exe
  C:\Windows\System\FKJgxoN.exe
  2⤵
  PID:9280
- C:\Windows\System\NRoccXw.exe
  C:\Windows\System\NRoccXw.exe
  2⤵
  PID:9304
- C:\Windows\System\wlWgIml.exe
  C:\Windows\System\wlWgIml.exe
  2⤵
  PID:9328
- C:\Windows\System\ynsFLzO.exe
  C:\Windows\System\ynsFLzO.exe
  2⤵
  PID:9352
- C:\Windows\System\YQFdHiG.exe
  C:\Windows\System\YQFdHiG.exe
  2⤵
  PID:9380
- C:\Windows\System\yFFmVzZ.exe
  C:\Windows\System\yFFmVzZ.exe
  2⤵
  PID:9416
- C:\Windows\System\FxBrUIn.exe
  C:\Windows\System\FxBrUIn.exe
  2⤵
  PID:9452
- C:\Windows\System\FKVRVyk.exe
  C:\Windows\System\FKVRVyk.exe
  2⤵
  PID:9472
- C:\Windows\System\EPzjfRC.exe
  C:\Windows\System\EPzjfRC.exe
  2⤵
  PID:9500
- C:\Windows\System\MJXzCRg.exe
  C:\Windows\System\MJXzCRg.exe
  2⤵
  PID:9520
- C:\Windows\System\KVvMiTM.exe
  C:\Windows\System\KVvMiTM.exe
  2⤵
  PID:9544
- C:\Windows\System\jJHbEtl.exe
  C:\Windows\System\jJHbEtl.exe
  2⤵
  PID:9564
- C:\Windows\System\FfPwfvM.exe
  C:\Windows\System\FfPwfvM.exe
  2⤵
  PID:9632
- C:\Windows\System\eqJzniL.exe
  C:\Windows\System\eqJzniL.exe
  2⤵
  PID:9652
- C:\Windows\System\NQUOhmZ.exe
  C:\Windows\System\NQUOhmZ.exe
  2⤵
  PID:9676
- C:\Windows\System\mqQRDea.exe
  C:\Windows\System\mqQRDea.exe
  2⤵
  PID:9716
- C:\Windows\System\uTpfgAG.exe
  C:\Windows\System\uTpfgAG.exe
  2⤵
  PID:9740
- C:\Windows\System\sVfayOf.exe
  C:\Windows\System\sVfayOf.exe
  2⤵
  PID:9760
- C:\Windows\System\mRcyHwY.exe
  C:\Windows\System\mRcyHwY.exe
  2⤵
  PID:9780
- C:\Windows\System\fBllocK.exe
  C:\Windows\System\fBllocK.exe
  2⤵
  PID:9804
- C:\Windows\System\maGYYMn.exe
  C:\Windows\System\maGYYMn.exe
  2⤵
  PID:9832
- C:\Windows\System\oQFrWNo.exe
  C:\Windows\System\oQFrWNo.exe
  2⤵
  PID:9848
- C:\Windows\System\HuzWKLE.exe
  C:\Windows\System\HuzWKLE.exe
  2⤵
  PID:9892
- C:\Windows\System\XilYLaP.exe
  C:\Windows\System\XilYLaP.exe
  2⤵
  PID:9912
- C:\Windows\System\ZPSEsds.exe
  C:\Windows\System\ZPSEsds.exe
  2⤵
  PID:9932
- C:\Windows\System\lIjYxqA.exe
  C:\Windows\System\lIjYxqA.exe
  2⤵
  PID:9968
- C:\Windows\System\ObWbMlh.exe
  C:\Windows\System\ObWbMlh.exe
  2⤵
  PID:9988
- C:\Windows\System\EBrGlPA.exe
  C:\Windows\System\EBrGlPA.exe
  2⤵
  PID:10028
- C:\Windows\System\VlsLgLz.exe
  C:\Windows\System\VlsLgLz.exe
  2⤵
  PID:10048
- C:\Windows\System\ocZtsjV.exe
  C:\Windows\System\ocZtsjV.exe
  2⤵
  PID:10068
- C:\Windows\System\HgkSIDo.exe
  C:\Windows\System\HgkSIDo.exe
  2⤵
  PID:10088
- C:\Windows\System\bDWewjM.exe
  C:\Windows\System\bDWewjM.exe
  2⤵
  PID:10124
- C:\Windows\System\COhlzal.exe
  C:\Windows\System\COhlzal.exe
  2⤵
  PID:10140
- C:\Windows\System\AaNViqf.exe
  C:\Windows\System\AaNViqf.exe
  2⤵
  PID:10164
- C:\Windows\System\KWkgoQe.exe
  C:\Windows\System\KWkgoQe.exe
  2⤵
  PID:10200
- C:\Windows\System\gcPlvHy.exe
  C:\Windows\System\gcPlvHy.exe
  2⤵
  PID:8980
- C:\Windows\System\mkHuVov.exe
  C:\Windows\System\mkHuVov.exe
  2⤵
  PID:9268
- C:\Windows\System\pBFAzmg.exe
  C:\Windows\System\pBFAzmg.exe
  2⤵
  PID:9312
- C:\Windows\System\ZzTCfrf.exe
  C:\Windows\System\ZzTCfrf.exe
  2⤵
  PID:9324
- C:\Windows\System\kcIFlxF.exe
  C:\Windows\System\kcIFlxF.exe
  2⤵
  PID:9412
- C:\Windows\System\JhPSLuI.exe
  C:\Windows\System\JhPSLuI.exe
  2⤵
  PID:9448
- C:\Windows\System\AQwehGp.exe
  C:\Windows\System\AQwehGp.exe
  2⤵
  PID:9644
- C:\Windows\System\uEOXjoi.exe
  C:\Windows\System\uEOXjoi.exe
  2⤵
  PID:9728
- C:\Windows\System\CjcqHPI.exe
  C:\Windows\System\CjcqHPI.exe
  2⤵
  PID:9772
- C:\Windows\System\wjLCaSI.exe
  C:\Windows\System\wjLCaSI.exe
  2⤵
  PID:9820
- C:\Windows\System\oweDiVd.exe
  C:\Windows\System\oweDiVd.exe
  2⤵
  PID:9884
- C:\Windows\System\BVyIQfx.exe
  C:\Windows\System\BVyIQfx.exe
  2⤵
  PID:9956
- C:\Windows\System\RLigwcQ.exe
  C:\Windows\System\RLigwcQ.exe
  2⤵
  PID:9984
- C:\Windows\System\GHCaNdV.exe
  C:\Windows\System\GHCaNdV.exe
  2⤵
  PID:10084
- C:\Windows\System\GaeLfPv.exe
  C:\Windows\System\GaeLfPv.exe
  2⤵
  PID:10148
- C:\Windows\System\HYKcCYs.exe
  C:\Windows\System\HYKcCYs.exe
  2⤵
  PID:10220
- C:\Windows\System\gghuHui.exe
  C:\Windows\System\gghuHui.exe
  2⤵
  PID:9228
- C:\Windows\System\ehaRwVx.exe
  C:\Windows\System\ehaRwVx.exe
  2⤵
  PID:9408
- C:\Windows\System\FIWEbPF.exe
  C:\Windows\System\FIWEbPF.exe
  2⤵
  PID:9672
- C:\Windows\System\rWmTmej.exe
  C:\Windows\System\rWmTmej.exe
  2⤵
  PID:9748
- C:\Windows\System\sJauVIY.exe
  C:\Windows\System\sJauVIY.exe
  2⤵
  PID:9868
- C:\Windows\System\WooFMtC.exe
  C:\Windows\System\WooFMtC.exe
  2⤵
  PID:10076
- C:\Windows\System\Iljetwe.exe
  C:\Windows\System\Iljetwe.exe
  2⤵
  PID:9248
- C:\Windows\System\hfKqIyr.exe
  C:\Windows\System\hfKqIyr.exe
  2⤵
  PID:9624
- C:\Windows\System\GSNMrxF.exe
  C:\Windows\System\GSNMrxF.exe
  2⤵
  PID:9788
- C:\Windows\System\SeCvGKv.exe
  C:\Windows\System\SeCvGKv.exe
  2⤵
  PID:10236
- C:\Windows\System\zPZkchV.exe
  C:\Windows\System\zPZkchV.exe
  2⤵
  PID:10268
- C:\Windows\System\qzVmvZx.exe
  C:\Windows\System\qzVmvZx.exe
  2⤵
  PID:10300
- C:\Windows\System\GwgtdXn.exe
  C:\Windows\System\GwgtdXn.exe
  2⤵
  PID:10320
- C:\Windows\System\gpKqORF.exe
  C:\Windows\System\gpKqORF.exe
  2⤵
  PID:10352
- C:\Windows\System\FSXsTnp.exe
  C:\Windows\System\FSXsTnp.exe
  2⤵
  PID:10376
- C:\Windows\System\rUvJEuG.exe
  C:\Windows\System\rUvJEuG.exe
  2⤵
  PID:10408
- C:\Windows\System\jYmPopM.exe
  C:\Windows\System\jYmPopM.exe
  2⤵
  PID:10436
- C:\Windows\System\ktBpgyx.exe
  C:\Windows\System\ktBpgyx.exe
  2⤵
  PID:10464
- C:\Windows\System\mODGvIw.exe
  C:\Windows\System\mODGvIw.exe
  2⤵
  PID:10484
- C:\Windows\System\nJgvUXB.exe
  C:\Windows\System\nJgvUXB.exe
  2⤵
  PID:10508
- C:\Windows\System\yDCMReR.exe
  C:\Windows\System\yDCMReR.exe
  2⤵
  PID:10540
- C:\Windows\System\hsxcSbN.exe
  C:\Windows\System\hsxcSbN.exe
  2⤵
  PID:10584
- C:\Windows\System\oAZcCxG.exe
  C:\Windows\System\oAZcCxG.exe
  2⤵
  PID:10604
- C:\Windows\System\eJUPrTo.exe
  C:\Windows\System\eJUPrTo.exe
  2⤵
  PID:10648
- C:\Windows\System\qLyZPvb.exe
  C:\Windows\System\qLyZPvb.exe
  2⤵
  PID:10668
- C:\Windows\System\qgSoNfP.exe
  C:\Windows\System\qgSoNfP.exe
  2⤵
  PID:10708
- C:\Windows\System\WoiWeEX.exe
  C:\Windows\System\WoiWeEX.exe
  2⤵
  PID:10732
- C:\Windows\System\FfnUQTh.exe
  C:\Windows\System\FfnUQTh.exe
  2⤵
  PID:10752
- C:\Windows\System\XsrAbXT.exe
  C:\Windows\System\XsrAbXT.exe
  2⤵
  PID:10784
- C:\Windows\System\UskhFNR.exe
  C:\Windows\System\UskhFNR.exe
  2⤵
  PID:10804
- C:\Windows\System\YPhUiAT.exe
  C:\Windows\System\YPhUiAT.exe
  2⤵
  PID:10840
- C:\Windows\System\VbVUUuV.exe
  C:\Windows\System\VbVUUuV.exe
  2⤵
  PID:10876
- C:\Windows\System\clPQGMA.exe
  C:\Windows\System\clPQGMA.exe
  2⤵
  PID:10900
- C:\Windows\System\tXtvZod.exe
  C:\Windows\System\tXtvZod.exe
  2⤵
  PID:10920
- C:\Windows\System\LuaLZnG.exe
  C:\Windows\System\LuaLZnG.exe
  2⤵
  PID:10960
- C:\Windows\System\NbetDdm.exe
  C:\Windows\System\NbetDdm.exe
  2⤵
  PID:10976
- C:\Windows\System\zygQOgD.exe
  C:\Windows\System\zygQOgD.exe
  2⤵
  PID:11000
- C:\Windows\System\Epygajp.exe
  C:\Windows\System\Epygajp.exe
  2⤵
  PID:11024
- C:\Windows\System\CpEtfCy.exe
  C:\Windows\System\CpEtfCy.exe
  2⤵
  PID:11052
- C:\Windows\System\XLMkbkH.exe
  C:\Windows\System\XLMkbkH.exe
  2⤵
  PID:11080
- C:\Windows\System\GoplAZd.exe
  C:\Windows\System\GoplAZd.exe
  2⤵
  PID:11104
- C:\Windows\System\ZNBEKBx.exe
  C:\Windows\System\ZNBEKBx.exe
  2⤵
  PID:11148
- C:\Windows\System\sttVfSm.exe
  C:\Windows\System\sttVfSm.exe
  2⤵
  PID:11168
- C:\Windows\System\IkXoUsg.exe
  C:\Windows\System\IkXoUsg.exe
  2⤵
  PID:11192
- C:\Windows\System\uzmYnYb.exe
  C:\Windows\System\uzmYnYb.exe
  2⤵
  PID:11220
- C:\Windows\System\ejVISdZ.exe
  C:\Windows\System\ejVISdZ.exe
  2⤵
  PID:11240
- C:\Windows\System\dpsIIVt.exe
  C:\Windows\System\dpsIIVt.exe
  2⤵
  PID:11260
- C:\Windows\System\gIqlEot.exe
  C:\Windows\System\gIqlEot.exe
  2⤵
  PID:10252
- C:\Windows\System\YhmXzeP.exe
  C:\Windows\System\YhmXzeP.exe
  2⤵
  PID:10296
- C:\Windows\System\zrvlotz.exe
  C:\Windows\System\zrvlotz.exe
  2⤵
  PID:10372
- C:\Windows\System\ineqPOb.exe
  C:\Windows\System\ineqPOb.exe
  2⤵
  PID:10432
- C:\Windows\System\FqraSlC.exe
  C:\Windows\System\FqraSlC.exe
  2⤵
  PID:10480
- C:\Windows\System\BVXEWHF.exe
  C:\Windows\System\BVXEWHF.exe
  2⤵
  PID:10576
- C:\Windows\System\cpKyepK.exe
  C:\Windows\System\cpKyepK.exe
  2⤵
  PID:10600
- C:\Windows\System\gsUgSMm.exe
  C:\Windows\System\gsUgSMm.exe
  2⤵
  PID:10644
- C:\Windows\System\qNPMxUu.exe
  C:\Windows\System\qNPMxUu.exe
  2⤵
  PID:10700
- C:\Windows\System\dBTefrf.exe
  C:\Windows\System\dBTefrf.exe
  2⤵
  PID:10792
- C:\Windows\System\IZcfpkz.exe
  C:\Windows\System\IZcfpkz.exe
  2⤵
  PID:10868
- C:\Windows\System\TpQRUPE.exe
  C:\Windows\System\TpQRUPE.exe
  2⤵
  PID:10916
- C:\Windows\System\FJADXOI.exe
  C:\Windows\System\FJADXOI.exe
  2⤵
  PID:10988
- C:\Windows\System\rTpdHwq.exe
  C:\Windows\System\rTpdHwq.exe
  2⤵
  PID:11120
- C:\Windows\System\ZWkmYpQ.exe
  C:\Windows\System\ZWkmYpQ.exe
  2⤵
  PID:11212
- C:\Windows\System\vSNhpto.exe
  C:\Windows\System\vSNhpto.exe
  2⤵
  PID:11200
- C:\Windows\System\ZhkZLOI.exe
  C:\Windows\System\ZhkZLOI.exe
  2⤵
  PID:11248
- C:\Windows\System\sUYxxTD.exe
  C:\Windows\System\sUYxxTD.exe
  2⤵
  PID:10388
- C:\Windows\System\rYNnhso.exe
  C:\Windows\System\rYNnhso.exe
  2⤵
  PID:10472
- C:\Windows\System\aHZSzTM.exe
  C:\Windows\System\aHZSzTM.exe
  2⤵
  PID:10656
- C:\Windows\System\XFmNhTa.exe
  C:\Windows\System\XFmNhTa.exe
  2⤵
  PID:10764
- C:\Windows\System\EenPVwL.exe
  C:\Windows\System\EenPVwL.exe
  2⤵
  PID:10972
- C:\Windows\System\gqtxyzK.exe
  C:\Windows\System\gqtxyzK.exe
  2⤵
  PID:11044
- C:\Windows\System\yunQXyr.exe
  C:\Windows\System\yunQXyr.exe
  2⤵
  PID:10368
- C:\Windows\System\DYQhNIE.exe
  C:\Windows\System\DYQhNIE.exe
  2⤵
  PID:10748
- C:\Windows\System\haSxLpe.exe
  C:\Windows\System\haSxLpe.exe
  2⤵
  PID:11032
- C:\Windows\System\uudtUex.exe
  C:\Windows\System\uudtUex.exe
  2⤵
  PID:3424
- C:\Windows\System\GDvjTJs.exe
  C:\Windows\System\GDvjTJs.exe
  2⤵
  PID:11268
- C:\Windows\System\fAOVfzZ.exe
  C:\Windows\System\fAOVfzZ.exe
  2⤵
  PID:11292
- C:\Windows\System\rPQHSQD.exe
  C:\Windows\System\rPQHSQD.exe
  2⤵
  PID:11308
- C:\Windows\System\lrZTuiZ.exe
  C:\Windows\System\lrZTuiZ.exe
  2⤵
  PID:11336
- C:\Windows\System\UQzCgJY.exe
  C:\Windows\System\UQzCgJY.exe
  2⤵
  PID:11356
- C:\Windows\System\PirVLXM.exe
  C:\Windows\System\PirVLXM.exe
  2⤵
  PID:11372
- C:\Windows\System\aBHBoxg.exe
  C:\Windows\System\aBHBoxg.exe
  2⤵
  PID:11396
- C:\Windows\System\jKNcOfG.exe
  C:\Windows\System\jKNcOfG.exe
  2⤵
  PID:11464
- C:\Windows\System\YFHChCM.exe
  C:\Windows\System\YFHChCM.exe
  2⤵
  PID:11480
- C:\Windows\System\tvdWuZG.exe
  C:\Windows\System\tvdWuZG.exe
  2⤵
  PID:11516
- C:\Windows\System\zUbIHKh.exe
  C:\Windows\System\zUbIHKh.exe
  2⤵
  PID:11544
- C:\Windows\System\XECxNWR.exe
  C:\Windows\System\XECxNWR.exe
  2⤵
  PID:11564
- C:\Windows\System\kwyfntx.exe
  C:\Windows\System\kwyfntx.exe
  2⤵
  PID:11588
- C:\Windows\System\vsFWgxo.exe
  C:\Windows\System\vsFWgxo.exe
  2⤵
  PID:11620
- C:\Windows\System\mDYoFtS.exe
  C:\Windows\System\mDYoFtS.exe
  2⤵
  PID:11636
- C:\Windows\System\jCtZNzC.exe
  C:\Windows\System\jCtZNzC.exe
  2⤵
  PID:11672
- C:\Windows\System\jldtTLw.exe
  C:\Windows\System\jldtTLw.exe
  2⤵
  PID:11708
- C:\Windows\System\UwDJQjn.exe
  C:\Windows\System\UwDJQjn.exe
  2⤵
  PID:11728
- C:\Windows\System\rSZwtXX.exe
  C:\Windows\System\rSZwtXX.exe
  2⤵
  PID:11756
- C:\Windows\System\YAiSNvA.exe
  C:\Windows\System\YAiSNvA.exe
  2⤵
  PID:11776
- C:\Windows\System\zSoJvhS.exe
  C:\Windows\System\zSoJvhS.exe
  2⤵
  PID:11804
- C:\Windows\System\SsoVYoX.exe
  C:\Windows\System\SsoVYoX.exe
  2⤵
  PID:11844
- C:\Windows\System\vwQznRQ.exe
  C:\Windows\System\vwQznRQ.exe
  2⤵
  PID:11860
- C:\Windows\System\IREQwri.exe
  C:\Windows\System\IREQwri.exe
  2⤵
  PID:11924
- C:\Windows\System\wbMzXdp.exe
  C:\Windows\System\wbMzXdp.exe
  2⤵
  PID:11944
- C:\Windows\System\TtlqBpO.exe
  C:\Windows\System\TtlqBpO.exe
  2⤵
  PID:11984
- C:\Windows\System\PDTyfRi.exe
  C:\Windows\System\PDTyfRi.exe
  2⤵
  PID:12008
- C:\Windows\System\peBkDJr.exe
  C:\Windows\System\peBkDJr.exe
  2⤵
  PID:12032
- C:\Windows\System\naSrWuW.exe
  C:\Windows\System\naSrWuW.exe
  2⤵
  PID:12056
- C:\Windows\System\eSlBmjk.exe
  C:\Windows\System\eSlBmjk.exe
  2⤵
  PID:12096
- C:\Windows\System\CChUxkS.exe
  C:\Windows\System\CChUxkS.exe
  2⤵
  PID:12116
- C:\Windows\System\IeGnxzi.exe
  C:\Windows\System\IeGnxzi.exe
  2⤵
  PID:12144
- C:\Windows\System\BVEgdjn.exe
  C:\Windows\System\BVEgdjn.exe
  2⤵
  PID:12164
- C:\Windows\System\MizMRnX.exe
  C:\Windows\System\MizMRnX.exe
  2⤵
  PID:12184
- C:\Windows\System\oASxvAA.exe
  C:\Windows\System\oASxvAA.exe
  2⤵
  PID:12208
- C:\Windows\System\jucswdx.exe
  C:\Windows\System\jucswdx.exe
  2⤵
  PID:12232
- C:\Windows\System\KOklkDa.exe
  C:\Windows\System\KOklkDa.exe
  2⤵
  PID:12248
- C:\Windows\System\nuHevih.exe
  C:\Windows\System\nuHevih.exe
  2⤵
  PID:12276
- C:\Windows\System\ipwyPOh.exe
  C:\Windows\System\ipwyPOh.exe
  2⤵
  PID:10892
- C:\Windows\System\cPgyiIK.exe
  C:\Windows\System\cPgyiIK.exe
  2⤵
  PID:11284
- C:\Windows\System\MUSYjmj.exe
  C:\Windows\System\MUSYjmj.exe
  2⤵
  PID:11324
- C:\Windows\System\oDEremU.exe
  C:\Windows\System\oDEremU.exe
  2⤵
  PID:11388
- C:\Windows\System\iMDqhcY.exe
  C:\Windows\System\iMDqhcY.exe
  2⤵
  PID:11488
- C:\Windows\System\ZZozUcM.exe
  C:\Windows\System\ZZozUcM.exe
  2⤵
  PID:11500
- C:\Windows\System\MVEoddJ.exe
  C:\Windows\System\MVEoddJ.exe
  2⤵
  PID:11560
- C:\Windows\System\FSytgQH.exe
  C:\Windows\System\FSytgQH.exe
  2⤵
  PID:11628
- C:\Windows\System\ebUPzJp.exe
  C:\Windows\System\ebUPzJp.exe
  2⤵
  PID:11852
- C:\Windows\System\dLNaGxA.exe
  C:\Windows\System\dLNaGxA.exe
  2⤵
  PID:11940
- C:\Windows\System\mmtMKjI.exe
  C:\Windows\System\mmtMKjI.exe
  2⤵
  PID:11980
- C:\Windows\System\gaeFIDm.exe
  C:\Windows\System\gaeFIDm.exe
  2⤵
  PID:12044
- C:\Windows\System\WYAMbnD.exe
  C:\Windows\System\WYAMbnD.exe
  2⤵
  PID:12112
- C:\Windows\System\KjuSCNv.exe
  C:\Windows\System\KjuSCNv.exe
  2⤵
  PID:12136
- C:\Windows\System\kHwoRep.exe
  C:\Windows\System\kHwoRep.exe
  2⤵
  PID:12200
- C:\Windows\System\xSZDjdM.exe
  C:\Windows\System\xSZDjdM.exe
  2⤵
  PID:10344
- C:\Windows\System\GDWlikI.exe
  C:\Windows\System\GDWlikI.exe
  2⤵
  PID:11352
- C:\Windows\System\MJpfmnv.exe
  C:\Windows\System\MJpfmnv.exe
  2⤵
  PID:11460
- C:\Windows\System\jCPBzcz.exe
  C:\Windows\System\jCPBzcz.exe
  2⤵
  PID:11680
- C:\Windows\System\LaZxrjn.exe
  C:\Windows\System\LaZxrjn.exe
  2⤵
  PID:11772
- C:\Windows\System\nTFVzrZ.exe
  C:\Windows\System\nTFVzrZ.exe
  2⤵
  PID:11744
- C:\Windows\System\gGRprey.exe
  C:\Windows\System\gGRprey.exe
  2⤵
  PID:11936
- C:\Windows\System\eErbLfb.exe
  C:\Windows\System\eErbLfb.exe
  2⤵
  PID:12216
- C:\Windows\System\TtYAhuu.exe
  C:\Windows\System\TtYAhuu.exe
  2⤵
  PID:11452
- C:\Windows\System\hOWqfGk.exe
  C:\Windows\System\hOWqfGk.exe
  2⤵
  PID:11920
- C:\Windows\System\JQYmsth.exe
  C:\Windows\System\JQYmsth.exe
  2⤵
  PID:11280
- C:\Windows\System\SznHeWT.exe
  C:\Windows\System\SznHeWT.exe
  2⤵
  PID:12324
- C:\Windows\System\ADcbRsj.exe
  C:\Windows\System\ADcbRsj.exe
  2⤵
  PID:12364
- C:\Windows\System\bmIjhAO.exe
  C:\Windows\System\bmIjhAO.exe
  2⤵
  PID:12388
- C:\Windows\System\rMfBiFa.exe
  C:\Windows\System\rMfBiFa.exe
  2⤵
  PID:12408
- C:\Windows\System\LAfGKva.exe
  C:\Windows\System\LAfGKva.exe
  2⤵
  PID:12428
- C:\Windows\System\SXxOqNS.exe
  C:\Windows\System\SXxOqNS.exe
  2⤵
  PID:12456
- C:\Windows\System\KFSEQCr.exe
  C:\Windows\System\KFSEQCr.exe
  2⤵
  PID:12476
- C:\Windows\System\upmAnWy.exe
  C:\Windows\System\upmAnWy.exe
  2⤵
  PID:12500
- C:\Windows\System\LsOCTuJ.exe
  C:\Windows\System\LsOCTuJ.exe
  2⤵
  PID:12520
- C:\Windows\System\biqmqxN.exe
  C:\Windows\System\biqmqxN.exe
  2⤵
  PID:12604
- C:\Windows\System\gzZuOoM.exe
  C:\Windows\System\gzZuOoM.exe
  2⤵
  PID:12620
- C:\Windows\System\TYduLrG.exe
  C:\Windows\System\TYduLrG.exe
  2⤵
  PID:12636
- C:\Windows\System\gaZUaYk.exe
  C:\Windows\System\gaZUaYk.exe
  2⤵
  PID:12664
- C:\Windows\System\GSntooN.exe
  C:\Windows\System\GSntooN.exe
  2⤵
  PID:12692
- C:\Windows\System\TewfSNx.exe
  C:\Windows\System\TewfSNx.exe
  2⤵
  PID:12720
- C:\Windows\System\nxVlDCL.exe
  C:\Windows\System\nxVlDCL.exe
  2⤵
  PID:12748
- C:\Windows\System\SdrIFnq.exe
  C:\Windows\System\SdrIFnq.exe
  2⤵
  PID:12784
- C:\Windows\System\IJTfxOc.exe
  C:\Windows\System\IJTfxOc.exe
  2⤵
  PID:12804
- C:\Windows\System\DGVaYVl.exe
  C:\Windows\System\DGVaYVl.exe
  2⤵
  PID:12820
- C:\Windows\System\KjnMlPQ.exe
  C:\Windows\System\KjnMlPQ.exe
  2⤵
  PID:12840
- C:\Windows\System\ShTLVeo.exe
  C:\Windows\System\ShTLVeo.exe
  2⤵
  PID:12860
- C:\Windows\System\lPabAoa.exe
  C:\Windows\System\lPabAoa.exe
  2⤵
  PID:12896
- C:\Windows\System\AXnSkDA.exe
  C:\Windows\System\AXnSkDA.exe
  2⤵
  PID:12932
- C:\Windows\System\XYkfsdu.exe
  C:\Windows\System\XYkfsdu.exe
  2⤵
  PID:12952
- C:\Windows\System\fEqXsxZ.exe
  C:\Windows\System\fEqXsxZ.exe
  2⤵
  PID:12972
- C:\Windows\System\UAZNNBZ.exe
  C:\Windows\System\UAZNNBZ.exe
  2⤵
  PID:12992
- C:\Windows\System\aVTyWuv.exe
  C:\Windows\System\aVTyWuv.exe
  2⤵
  PID:13012
- C:\Windows\System\PiGwBhi.exe
  C:\Windows\System\PiGwBhi.exe
  2⤵
  PID:13032
- C:\Windows\System\ENtsmwJ.exe
  C:\Windows\System\ENtsmwJ.exe
  2⤵
  PID:13056
- C:\Windows\System\ecMeoJP.exe
  C:\Windows\System\ecMeoJP.exe
  2⤵
  PID:13080
- C:\Windows\System\jzYDDMZ.exe
  C:\Windows\System\jzYDDMZ.exe
  2⤵
  PID:13144
- C:\Windows\System\LFYBCwm.exe
  C:\Windows\System\LFYBCwm.exe
  2⤵
  PID:13172
- C:\Windows\System\JcWpQQV.exe
  C:\Windows\System\JcWpQQV.exe
  2⤵
  PID:13192
- C:\Windows\System\tBzqgeo.exe
  C:\Windows\System\tBzqgeo.exe
  2⤵
  PID:13216
- C:\Windows\System\fOGgUoY.exe
  C:\Windows\System\fOGgUoY.exe
  2⤵
  PID:13236
- C:\Windows\System\mJBouTu.exe
  C:\Windows\System\mJBouTu.exe
  2⤵
  PID:13256
- C:\Windows\System\bYUMpwh.exe
  C:\Windows\System\bYUMpwh.exe
  2⤵
  PID:13280
- C:\Windows\System\kWGzChO.exe
  C:\Windows\System\kWGzChO.exe
  2⤵
  PID:11724
- C:\Windows\System\VQJgPcn.exe
  C:\Windows\System\VQJgPcn.exe
  2⤵
  PID:12308
- C:\Windows\System\BQdapHb.exe
  C:\Windows\System\BQdapHb.exe
  2⤵
  PID:12344
- C:\Windows\System\kAwbSoM.exe
  C:\Windows\System\kAwbSoM.exe
  2⤵
  PID:12400
- C:\Windows\System\kYFvFXc.exe
  C:\Windows\System\kYFvFXc.exe
  2⤵
  PID:12468
- C:\Windows\System\CfrRlwe.exe
  C:\Windows\System\CfrRlwe.exe
  2⤵
  PID:12508
- C:\Windows\System\IsVsiln.exe
  C:\Windows\System\IsVsiln.exe
  2⤵
  PID:12592
- C:\Windows\System\ULlyxVe.exe
  C:\Windows\System\ULlyxVe.exe
  2⤵
  PID:12628
- C:\Windows\System\JOYiKdo.exe
  C:\Windows\System\JOYiKdo.exe
  2⤵
  PID:12684
- C:\Windows\System\xAksejd.exe
  C:\Windows\System\xAksejd.exe
  2⤵
  PID:12828
- C:\Windows\System\hbEfMuN.exe
  C:\Windows\System\hbEfMuN.exe
  2⤵
  PID:12928
- C:\Windows\System\oKAUjsA.exe
  C:\Windows\System\oKAUjsA.exe
  2⤵
  PID:12920
- C:\Windows\System\HRgpyHi.exe
  C:\Windows\System\HRgpyHi.exe
  2⤵
  PID:13020
- C:\Windows\System\QrsKRBu.exe
  C:\Windows\System\QrsKRBu.exe
  2⤵
  PID:13064
- C:\Windows\System\kEWqojT.exe
  C:\Windows\System\kEWqojT.exe
  2⤵
  PID:13068
- C:\Windows\System\hlLqTyv.exe
  C:\Windows\System\hlLqTyv.exe
  2⤵
  PID:11832
- C:\Windows\System\GBkRXRN.exe
  C:\Windows\System\GBkRXRN.exe
  2⤵
  PID:12356
- C:\Windows\System\KluEyzr.exe
  C:\Windows\System\KluEyzr.exe
  2⤵
  PID:12612
- C:\Windows\System\ZGGNGcI.exe
  C:\Windows\System\ZGGNGcI.exe
  2⤵
  PID:12536
- C:\Windows\System\vQUTSXD.exe
  C:\Windows\System\vQUTSXD.exe
  2⤵
  PID:12816
- C:\Windows\System\ysCMdeX.exe
  C:\Windows\System\ysCMdeX.exe
  2⤵
  PID:12856
- C:\Windows\System\funSvdW.exe
  C:\Windows\System\funSvdW.exe
  2⤵
  PID:1572
- C:\Windows\System\NOHRUqr.exe
  C:\Windows\System\NOHRUqr.exe
  2⤵
  PID:13164
- C:\Windows\System\LcQxoLp.exe
  C:\Windows\System\LcQxoLp.exe
  2⤵
  PID:12464
- C:\Windows\System\YMiDNOR.exe
  C:\Windows\System\YMiDNOR.exe
  2⤵
  PID:12320
- C:\Windows\System\TpEbuBr.exe
  C:\Windows\System\TpEbuBr.exe
  2⤵
  PID:12800
- C:\Windows\System\wvlQijI.exe
  C:\Windows\System\wvlQijI.exe
  2⤵
  PID:13184
- C:\Windows\System\AhCkgkk.exe
  C:\Windows\System\AhCkgkk.exe
  2⤵
  PID:12652
- C:\Windows\System\XqHOJoc.exe
  C:\Windows\System\XqHOJoc.exe
  2⤵
  PID:12296
- C:\Windows\System\bLRlFPL.exe
  C:\Windows\System\bLRlFPL.exe
  2⤵
  PID:12984
- C:\Windows\System\mszDCdn.exe
  C:\Windows\System\mszDCdn.exe
  2⤵
  PID:13336
- C:\Windows\System\uAIkinC.exe
  C:\Windows\System\uAIkinC.exe
  2⤵
  PID:13356
- C:\Windows\System\BjGzJtR.exe
  C:\Windows\System\BjGzJtR.exe
  2⤵
  PID:13412
- C:\Windows\System\IvkyUEY.exe
  C:\Windows\System\IvkyUEY.exe
  2⤵
  PID:13432
- C:\Windows\System\JhATcgp.exe
  C:\Windows\System\JhATcgp.exe
  2⤵
  PID:13456
- C:\Windows\System\MaPqZqG.exe
  C:\Windows\System\MaPqZqG.exe
  2⤵
  PID:13476
- C:\Windows\System\IObJvln.exe
  C:\Windows\System\IObJvln.exe
  2⤵
  PID:13496
- C:\Windows\System\InsvjKx.exe
  C:\Windows\System\InsvjKx.exe
  2⤵
  PID:13516
- C:\Windows\System\dqwfpUb.exe
  C:\Windows\System\dqwfpUb.exe
  2⤵
  PID:13576
- C:\Windows\System\zEALjxZ.exe
  C:\Windows\System\zEALjxZ.exe
  2⤵
  PID:13608
- C:\Windows\System\vQRsQgP.exe
  C:\Windows\System\vQRsQgP.exe
  2⤵
  PID:13628
- C:\Windows\System\zBbiruh.exe
  C:\Windows\System\zBbiruh.exe
  2⤵
  PID:13648
- C:\Windows\System\ahVcyIm.exe
  C:\Windows\System\ahVcyIm.exe
  2⤵
  PID:13668
- C:\Windows\System\GIXbugx.exe
  C:\Windows\System\GIXbugx.exe
  2⤵
  PID:13692
- C:\Windows\System\uoIgccn.exe
  C:\Windows\System\uoIgccn.exe
  2⤵
  PID:13748
- C:\Windows\System\fbVfVbW.exe
  C:\Windows\System\fbVfVbW.exe
  2⤵
  PID:13772
- C:\Windows\System\dBmeFvV.exe
  C:\Windows\System\dBmeFvV.exe
  2⤵
  PID:13800
- C:\Windows\System\piPsGRY.exe
  C:\Windows\System\piPsGRY.exe
  2⤵
  PID:13824
- C:\Windows\System\NOHpbVp.exe
  C:\Windows\System\NOHpbVp.exe
  2⤵
  PID:13844
- C:\Windows\System\KUBKYfs.exe
  C:\Windows\System\KUBKYfs.exe
  2⤵
  PID:13876
- C:\Windows\System\xIFgKyU.exe
  C:\Windows\System\xIFgKyU.exe
  2⤵
  PID:13908
- C:\Windows\System\zXSQVCV.exe
  C:\Windows\System\zXSQVCV.exe
  2⤵
  PID:13932
- C:\Windows\System\FMKeDve.exe
  C:\Windows\System\FMKeDve.exe
  2⤵
  PID:13960
- C:\Windows\System\RJMMmJz.exe
  C:\Windows\System\RJMMmJz.exe
  2⤵
  PID:14004
- C:\Windows\System\IixwaRJ.exe
  C:\Windows\System\IixwaRJ.exe
  2⤵
  PID:14024
- C:\Windows\System\MFAOdKX.exe
  C:\Windows\System\MFAOdKX.exe
  2⤵
  PID:14048
- C:\Windows\System\oJOEljF.exe
  C:\Windows\System\oJOEljF.exe
  2⤵
  PID:14076
- C:\Windows\System\ifaKIhs.exe
  C:\Windows\System\ifaKIhs.exe
  2⤵
  PID:14096
- C:\Windows\System\GczEtbc.exe
  C:\Windows\System\GczEtbc.exe
  2⤵
  PID:14140
- C:\Windows\System\RWGVifg.exe
  C:\Windows\System\RWGVifg.exe
  2⤵
  PID:14176
- C:\Windows\System\sZoyckF.exe
  C:\Windows\System\sZoyckF.exe
  2⤵
  PID:14204
- C:\Windows\System\UFrhwjW.exe
  C:\Windows\System\UFrhwjW.exe
  2⤵
  PID:14228
- C:\Windows\System\vzFwcdY.exe
  C:\Windows\System\vzFwcdY.exe
  2⤵
  PID:14256
- C:\Windows\System\sTdyDAe.exe
  C:\Windows\System\sTdyDAe.exe
  2⤵
  PID:14280
- C:\Windows\System\iCpgIhb.exe
  C:\Windows\System\iCpgIhb.exe
  2⤵
  PID:14300
- C:\Windows\System\lbYySCe.exe
  C:\Windows\System\lbYySCe.exe
  2⤵
  PID:14320
- C:\Windows\System\pzDnxdn.exe
  C:\Windows\System\pzDnxdn.exe
  2⤵
  PID:12568
- C:\Windows\System\iUEhmvt.exe
  C:\Windows\System\iUEhmvt.exe
  2⤵
  PID:13452
- C:\Windows\System\DHrphyU.exe
  C:\Windows\System\DHrphyU.exe
  2⤵
  PID:13532
- C:\Windows\System\aoMrijX.exe
  C:\Windows\System\aoMrijX.exe
  2⤵
  PID:13560
- C:\Windows\System\tiZCQzO.exe
  C:\Windows\System\tiZCQzO.exe
  2⤵
  PID:13656
- C:\Windows\System\ziWnmFb.exe
  C:\Windows\System\ziWnmFb.exe
  2⤵
  PID:13716
- C:\Windows\System\eBhDbkS.exe
  C:\Windows\System\eBhDbkS.exe
  2⤵
  PID:13720
- C:\Windows\System\lUKthqB.exe
  C:\Windows\System\lUKthqB.exe
  2⤵
  PID:13788
- C:\Windows\System\oAmakpA.exe
  C:\Windows\System\oAmakpA.exe
  2⤵
  PID:13840
- C:\Windows\System\fdWDwCx.exe
  C:\Windows\System\fdWDwCx.exe
  2⤵
  PID:13924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AUIsGJW.exe

Filesize
1.5MB

MD5
b776b1f7bc564273b715e08c70279182

SHA1
0a3b3900a2b79d5e9aa35a925a76ab5b117cd774

SHA256
6cafdfd5f380c984e8f84fac76c627193e5fb6986d33580dbce61973c517f73d

SHA512
3b0c41caf8a7c54b57da1d2387a57fee044eec0d79a65ea2ba15d5cbf26da99be59fde84891cc82d2834b2f3e89ad1adc59f5f1919604604a8cb2ea84fc8be5c

Download Submit
C:\Windows\System\AnKYLoY.exe

Filesize
1.5MB

MD5
4ae860feaa78b4e0e9c5e4369256e563

SHA1
d15671d774f0d5d5a7d4c8ea5aa6c1a337d0f766

SHA256
f5183ebc82854ecf2868caf316d743f68fff68cb078ed38ffdd587889d27a6d7

SHA512
e3f7bde516a46e27e439f67b7841287a96a1108fa3c0737f7a36f23f2077fb2ee024f4ae942d3261a864106dd5645692ff2e0c6fb3a596164673ebbf3600bde3

Download Submit
C:\Windows\System\AtEERRl.exe

Filesize
1.5MB

MD5
95cbb74895853569163aa172a80d7486

SHA1
f463100c0a8d9f96719cc32e6001888a8609a8c9

SHA256
849d6a12981dabc0820ee9716b8804097f3a6443dde1ed0bb9cf8890eac1bfb6

SHA512
c4556d839983c64571e409e72f4b107d310f3d548ad37cedcd82359ad7c27bae25c1caeb690e77314ec072a3b220d237b1e98962081a2a2fef588ba4e3fbed0c

Download Submit
C:\Windows\System\BDVzLPM.exe

Filesize
1.5MB

MD5
bad07cbf5f824da7000909f9cc62cbc1

SHA1
d7c66c5962221e285734f5204649693d1f71fd43

SHA256
feedfacb0e7472c9d9b31be34e6ea23f569d6fed260a0c18d3aeec5c29d2dfd5

SHA512
956cd639af82606f802196e9a6fc8c92f30f84243aa87b9b2eb9d211ad49f7642df74f984b75e4ae1841a0793ba67b856b43d38c1cc60d3b76d7c3cbff5e7c3a

Download Submit
C:\Windows\System\CbxfVMQ.exe

Filesize
1.5MB

MD5
fa49267772856758576559eeeae9c8b6

SHA1
e0c65edac4b552152fc7944290ba6b2cb2571f4d

SHA256
c2c051a262d5c5dff262186e3c8dd87f0b0025ffb8be6a6ad13e0f34030c939d

SHA512
d37ff6791413c85ac0370aee96cd261709fc126cbfec4a674f67d1f65ad933a812dccffe6b7b9bcc52d1e3c5504a7d4b618c321347a8f511d39272c6419a2159

Download Submit
C:\Windows\System\DRyQwoO.exe

Filesize
1.5MB

MD5
d3d77c9af126650d4f996550c9779ca0

SHA1
2144406e29a40f1aee793ac3b05921591bb4ff8c

SHA256
f9e21296d97554b96a9b53f0bbaeb3ee29756bd205f83a78289b22f8450096ba

SHA512
2ec6e8a74a502080de36c54f3d8131c04ca15e02c89fc4c1869eb7f6f472da14713c9081589997a33e0bb93b675d7722b000293c745e84a67e7908b3bf83f15e

Download Submit
C:\Windows\System\IiHuOgf.exe

Filesize
1.5MB

MD5
7f98a438f4c2234562ad255cbf9c7d32

SHA1
970d5ac8c9d7d5748abde640d2ffb41b2df357a6

SHA256
a274e5f869c861ced54a573d721bbe448bf175fe07f65579b8ef0ef29b35ef7e

SHA512
eeba465087669371b7321ec96f6aa7deff308a285844460e0ff12bc406741bb8f2035a9acb6f0b40f0e79d0bd6cb59388f6eb6d9b97aea5f44c98d01e9c9b652

Download Submit
C:\Windows\System\McOIzRV.exe

Filesize
1.5MB

MD5
64c53a1f6b7cc643ded0e2c123a91e8b

SHA1
e8dbca4f34ddfef62ea65e2a2993d3cd5434f077

SHA256
72e42f38e1a1b862360bc4b740ed7bb0e9660e3def9096c14fe1e2262b28cdfb

SHA512
4d04b48685906d65391b4544ee9671525df76266a44b56aa9c5d32b1f6e5c4c5ef2b81921ace46916a2d76cf91dc55722426f54dec1955102a78cb0387a2470c

Download Submit
C:\Windows\System\MicRffY.exe

Filesize
1.5MB

MD5
78539d97d5a42c6400e535eb476011a0

SHA1
a4bede6b157c4df328eb08ba0339ca650927ec09

SHA256
fea1845d99d1d1db1df0d37158ca62efc40044f76322d4f2a8da35c0fec1629d

SHA512
216298dea11bd32645d28a307a08929c491f1ab33e59830c8a7a6022f510273cf76a31bb8149fb081d79e85203add5a5f469dc1cdcec14d92f1de520cc9943ff

Download Submit
C:\Windows\System\NXWeJDL.exe

Filesize
1.5MB

MD5
ac3f7741370504b254bbaef9c515130b

SHA1
99b40b423202dcb3bb05a2c1f9beb063987c7054

SHA256
a34610be19053df8fc83a61cfe99b4a2ce96321c38cf3c76b9cbb55eded6e7fb

SHA512
601bd5d058bb8534f35f216d6451dfc8375e46726a69b73034abba0761251b64800bc4f73ab036a138d867e048f2785d3f2e137bacf3283b857997ee90f3beb8

Download Submit
C:\Windows\System\NovfxjD.exe

Filesize
1.5MB

MD5
b458f3acb8f17a23655b2e8f8cb9e02e

SHA1
f3ed1f8888e04d210b9e0ce705f17c224b8d7a5f

SHA256
add0c3da1bcd2d06683b0ea123d263e5cdf41144d0e70972cc96800c9615b5dc

SHA512
20a3ab037468609f22fe0b0870e60ca5ceb54d5d7ab72289a2dc783474204fa7b37817146168e18a90b9bff40371bb3673bf28faa62443527dd5f4ba8a557845

Download Submit
C:\Windows\System\PJIMbmN.exe

Filesize
1.5MB

MD5
ec6d69c04cebd8ecaf9cd7e91b38dc7c

SHA1
22c080517cd99fbca03d205d7bdda5108a784f9b

SHA256
912ce729d3d1951670e7e00bbb04932ef5859cbf668504a8027e1a72dc10e392

SHA512
1b1735bac345af22b9c63e52c3db7a0ae09de6f168150a081ab13cab1e8a73924f26b57ebb4ea1f9b5e9b584cce2f2850c72e31bc3208ac5c9bf8e458220732a

Download Submit
C:\Windows\System\Sbqtdes.exe

Filesize
1.5MB

MD5
062558fcff3e9ab39199774c5468e19a

SHA1
69485a1baea515f245ab1b2c493feaa139b55514

SHA256
b71cae8260cc7ecba9f38ed37eb2fcd7ad6f56d814b334e1df32bec7e7abc072

SHA512
4df1761fa1e9c5e84b7b4b8ec6d0af2925cd5193be503406811344417a8cf2797b9a6907b4b404e4bdb8a317d6f5e6435a177c3f40ad4e543d2d305a872bc2bb

Download Submit
C:\Windows\System\VBxnEvR.exe

Filesize
1.5MB

MD5
2d8121db496193b5675a940edcbff308

SHA1
1e14c020600be8e20aa36fa07dd6db06c8e4238b

SHA256
c0bed447c7dc4b45a2b1a64c690265cb39a999e0e7be12f64aca7a0537f3ffab

SHA512
0e53b07ebf8e59101abe08f1915c15a92879c04bfd030c4bb763513dfbc62b58f331bbb812a7b72b716a0573f05c7402777530c1a36bf978fe36c7f57adf6d28

Download Submit
C:\Windows\System\XxBqyKc.exe

Filesize
1.5MB

MD5
b6c37394980e292c1b6fbe2a9f8864bd

SHA1
9f931e9549fa48b9c1cbf7c6428d1c4992e4572d

SHA256
006a61d600717d369fbfb2d5de3c190edc73a06b5645162c1e7a6f9b1d4c9d08

SHA512
34640e86318e604c552e1e8bde629ae4d4909384d20823ec360ec32bee842067127aeb0d96d09e449c1e66bbf8e579045e9c720766e6ac207d8305413ee41c5b

Download Submit
C:\Windows\System\azkeObK.exe

Filesize
1.5MB

MD5
6811680b133565b6a6c9c6b245c45bcd

SHA1
4c8244ad3652ea8339688e64d33bd0f80f6500b9

SHA256
60f17302a0926008d02320c0931ebee6339277ebfa5f6dcbb09075651aeecadc

SHA512
af8916cf7275195a8047b77ce90dec1cc11fabc692ec01aa3d1268627da0984dfd2b59f17c5a70a2f9a6ca6f1ecac7aaa371667a6e82be5a594c81996276790b

Download Submit
C:\Windows\System\bTZcMnY.exe

Filesize
1.5MB

MD5
e1851f7b7d1fe75a166d9d5097b066ec

SHA1
14f6b067263cead8ee05ebd7af96cb0a0e1f81ad

SHA256
7270a3c862ef828ba97b8c19eb927ffd0fe29c0e302f347de97ef63199bf0f67

SHA512
37c34e28b129d1747f57368e2be1da52c53fc441a6b4b52622183a4905bb4e070413d9f78c2a5c2c254827b5e7dbe120a69e616122669f7af844dd13d9966efd

Download Submit
C:\Windows\System\eIgeYUE.exe

Filesize
1.5MB

MD5
fa7aaf66358a59360cff1f97731b64a5

SHA1
70c3e7bd4cdaf458c364447d66b665091ab71f34

SHA256
f5a5da5254e2018b6274e64e2210abb631a89c7b068dfc41fbfd3e7fc8153ccc

SHA512
40e8326f1e7f689bbf1f48dc1c6a612a1527da077bb8f88c9e866dda69bda3b11b062fc2afce0bfd04b53288ff04fb7e8adf8f962fd4f009fa5f5e6c4b5e4dea

Download Submit
C:\Windows\System\fyQIvDy.exe

Filesize
1.5MB

MD5
4b5033cef280e8d67329013e28eb7767

SHA1
fae11a10305a39a7bc7662b92426cb02a3da068d

SHA256
d88a8ecc46546574ed33cf79c00dcc5b58b6c0adf138f478afffadfcac230222

SHA512
6985fb189e0e3454937a8c7bcb0a8fc80c9a451a98804d92cec8b5ae70103dec7f96a4ed2d9d17e951976b99046a5aa18feabb9b802c7f7945aef13595bcbb6f

Download Submit
C:\Windows\System\hJmruzo.exe

Filesize
1.5MB

MD5
ee9b54d68c1e5fe920d1067d8edf4f7c

SHA1
665e426318ca5c61ac5059ad34124dcb767ee8e7

SHA256
1de5b05b04a089a294a0109f1d4cd64f8ee8f11f8d50f2a571ce3a6750311046

SHA512
ee8a1b8cf3af7417cd83fc3f99a58bbeb9dedb519c37d3817880fc870bbff6ae92501659679981953b99dd8a6f31c1a55c4b27c58a2d0e31cf8fec07c5afb6b8

Download Submit
C:\Windows\System\iscvaje.exe

Filesize
1.5MB

MD5
c64f1dbb126fda41cd6ace769d98b1e7

SHA1
eea5f5bf9fbdd3e907d6b62c6fc82370237c555d

SHA256
b0a620116a3bef15c2eea263284dc2083e4eb589718a009b0825d3875566ef7f

SHA512
d4373d690ccc801e20760a31e3d15be51141d4fce9409259cd654fb481f3c1c26f6a64116e0d81aabb0729ad15dd920b237b0fde704f224303305b3f44f672b0

Download Submit
C:\Windows\System\kVzqhyh.exe

Filesize
1.5MB

MD5
80e2b3703a80134b867c79ac118fb9fc

SHA1
0d6773f7eb6201f32e07eb41a691e1220e78c508

SHA256
9bd2097b49219bdf2d88be27c2253c9b718ade963a3c0c740e4b8ff2b0de6439

SHA512
6d9b04760a8fa8525fee7343aad8e49565411e441c1630716372f374d30305e6e6ced421938e6e06035d2d060da7096d8b29f8134fb5055fa11942f2a14d2a3a

Download Submit
C:\Windows\System\kcYqKEX.exe

Filesize
1.5MB

MD5
ae0fa6dcef41e030d6130aab62eea895

SHA1
77cc62289995d28da2b3a321bb21351e77cbd0f8

SHA256
b4feb145b353245a74293c39a35da777979f9daba57bf7b55a0fdc37f4a9f704

SHA512
d0f4da9bd2ccfbf96774f41fa3884ace2722b8b92efd3bf47de505ea92a9db0a863e703deb3b4f9f9e0fab46dfdc1d1b109b338c2b18dc739af819a7e6ff584e

Download Submit
C:\Windows\System\lEAjKmQ.exe

Filesize
1.5MB

MD5
69f8677b1cc11a70d453dd34a38b2cce

SHA1
e8cee016eac9b15a55a961c1c249e8402481fbb9

SHA256
d67ee04614f9163ab112a91c1bd70097609321a55b32856e68ec8891c9f5694c

SHA512
87fbd7a288aa1518dc63dec4c242114d81f2840030b17966298d31cc929444959ede8e9fbe1f46ec3a4583a324b0ef34e55e1e4f13417380cdbff591c3bcda7f

Download Submit
C:\Windows\System\mHmLoyS.exe

Filesize
1.5MB

MD5
f5fff3635e0abfa78a7e8f4193f679f8

SHA1
14257a5a9c5ac655aff5b607bdd44ef63fb6afcf

SHA256
ce4a426bf5c43833d12e6b7f6b1087a4a0a1cf5fb869aaeaf829ed99163a86d7

SHA512
53da6a269da7c779cdde6072701b65e8eec41ef6d0a3f4863757ad6140bf7f00df340edc3c98d2e37e58f983903ad576b9975ee32d3155b35ca40c46fddd7278

Download Submit
C:\Windows\System\nnBkwTm.exe

Filesize
1.5MB

MD5
6f5fb33ca1a725619ddbdb5a2596f32d

SHA1
925ca45ac67981d4afa198c84b55e08f20361b4b

SHA256
cc604afaf35d4057aa4ff8535fcf45e06bb52f88a941b4291001b8f105f79611

SHA512
3fe82e4caf44682431f88ff432e76688d3352c02e58b86e0ac908f1c173640d0b2951a86c4b739ccd51d092f245382bf00d7d525235d04ef230f4d77650a08e8

Download Submit
C:\Windows\System\ozxlFpZ.exe

Filesize
1.5MB

MD5
fd18b2f60c5db966655c14d57c847616

SHA1
25ec344015ad92624e8780b9fe4d2b2ec7b2e84f

SHA256
95487bcbc061a6500715e369908100957d16ee5ac1b05b676fabdaf0dea06aaf

SHA512
2ea6d60258cebfcac644a06be6105c6e454887c24595f5bd72fc82a8da8f262754d1587559d0d28721ebb9a0b1b16a7f9cafd74f4649106834f3c500d50270ec

Download Submit
C:\Windows\System\pScrbaZ.exe

Filesize
1.5MB

MD5
510db91d7d44eb04a63f292ba6474681

SHA1
b55699a5ce097e390fc6b759b5f50a29204cff3e

SHA256
d1d89924f7fb0f5e20dc980daac4b03b3c3cd8f9827e595e4f6dda0783a40474

SHA512
832f40930bb68c3be18f3bca81be7122414e3a9f2b71204173638157eb46cf022866398d8bc69854262590fe909cc7cb5c8290c30980e0a1974430aeef369e37

Download Submit
C:\Windows\System\qFxrvnn.exe

Filesize
1.5MB

MD5
c30e6d44d98f95d9c191c741fc6d8efe

SHA1
94ba6b9d6b65bd590a136b91c736f7b076ed9827

SHA256
6c2cec9ab93fe97f1d383bb4de2ffb34409f2132800f52c5769be75c95935e03

SHA512
2bb1cd33bf31c24812501847dddb07cdb69969d52a3a6e04f0bfc134a14857387de9a83288ce848bd75568c344232a833fc4f2e22ec257be5033c2f9a70bdf3d

Download Submit
C:\Windows\System\qMnQsYo.exe

Filesize
1.5MB

MD5
5dea639c16b631d03804c265a2a13ba4

SHA1
7d4bd09a77a8005873604a00fba09707bb0a75a9

SHA256
5b069cd728821052d6c42ee7ef8b2857aa26b6e0cb5b2f9474804f87114b9f44

SHA512
26041d0eb5ce441e084fa8de6fe309200c65ef71c2305ebab75d7a974e3f365d40d6cea182f9868165c81db71cd6d7b9fa9ba13168670cf599a3829c90607ab9

Download Submit
C:\Windows\System\vpHIVnu.exe

Filesize
1.5MB

MD5
aa8b878553732f391d1927b3d534476d

SHA1
5674d342646bd9accd347515e0687309570c965a

SHA256
df815fd9872286901f20d5c3bf07ae39bdedc29ba1aa920e047128cd3f8ff8b9

SHA512
39495b5416bc2b7b320aff94f94be2e075622304f8a8e2830e0c4601e22501e4a4c81abdce8b657ac08a36ea0c98c7bdbfdcc455b4b745c119ebceec70db53a1

Download Submit
C:\Windows\System\xmYHVuk.exe

Filesize
1.5MB

MD5
637f5ae3c93f044e2b402e0692a44013

SHA1
6e90155f9e255a2411c99578a311cf42a715c540

SHA256
442f0091d21dfaddd334bd51863739db28917813a4a9d95cd3b5f4da6ff92b73

SHA512
74043ce9859dda6fa867d060bcb6c49916523e117444f6a0477ffe9486955af42afa8d74c011b20393b7a2dad1a50929609f785f96dd8fa03063a48c2bcb6a22

Download Submit
C:\Windows\System\yzoKVkA.exe

Filesize
1.5MB

MD5
17bc8b819fa4e2247a7923b97e21c60e

SHA1
32b0e62aed564639c4386e9855481ccc239f5490

SHA256
0865fa4c128b9f474b6c0c698cfb12a79779207514dd742f959863ef3b929363

SHA512
85468b97fea8558555870626fe357cfe7e88cc6f00895a5e7a8a2f609baed01bbff444969353de6d7dd6c12ef456b036f295ad67a3d5b4488ad006d88ad35119

Download Submit
memory/312-17-0x00007FF6A0040000-0x00007FF6A0391000-memory.dmp

Filesize
3.3MB

Download
memory/312-2246-0x00007FF6A0040000-0x00007FF6A0391000-memory.dmp

Filesize
3.3MB

Download
memory/640-428-0x00007FF69DE30000-0x00007FF69E181000-memory.dmp

Filesize
3.3MB

Download
memory/640-2268-0x00007FF69DE30000-0x00007FF69E181000-memory.dmp

Filesize
3.3MB

Download
memory/1076-2275-0x00007FF7026C0000-0x00007FF702A11000-memory.dmp

Filesize
3.3MB

Download
memory/1076-432-0x00007FF7026C0000-0x00007FF702A11000-memory.dmp

Filesize
3.3MB

Download
memory/1492-451-0x00007FF7B3A30000-0x00007FF7B3D81000-memory.dmp

Filesize
3.3MB

Download
memory/1492-2304-0x00007FF7B3A30000-0x00007FF7B3D81000-memory.dmp

Filesize
3.3MB

Download
memory/1532-452-0x00007FF6D7FB0000-0x00007FF6D8301000-memory.dmp

Filesize
3.3MB

Download
memory/1532-2302-0x00007FF6D7FB0000-0x00007FF6D8301000-memory.dmp

Filesize
3.3MB

Download
memory/1820-445-0x00007FF791BF0000-0x00007FF791F41000-memory.dmp

Filesize
3.3MB

Download
memory/1820-2282-0x00007FF791BF0000-0x00007FF791F41000-memory.dmp

Filesize
3.3MB

Download
memory/1900-10-0x00007FF6C8060000-0x00007FF6C83B1000-memory.dmp

Filesize
3.3MB

Download
memory/1900-2248-0x00007FF6C8060000-0x00007FF6C83B1000-memory.dmp

Filesize
3.3MB

Download
memory/1900-2172-0x00007FF6C8060000-0x00007FF6C83B1000-memory.dmp

Filesize
3.3MB

Download
memory/1916-456-0x00007FF65E570000-0x00007FF65E8C1000-memory.dmp

Filesize
3.3MB

Download
memory/1916-2308-0x00007FF65E570000-0x00007FF65E8C1000-memory.dmp

Filesize
3.3MB

Download
memory/1940-426-0x00007FF66E2C0000-0x00007FF66E611000-memory.dmp

Filesize
3.3MB

Download
memory/1940-2259-0x00007FF66E2C0000-0x00007FF66E611000-memory.dmp

Filesize
3.3MB

Download
memory/2076-1-0x0000026E03160000-0x0000026E03170000-memory.dmp

Filesize
64KB

Download
memory/2076-0-0x00007FF7F7270000-0x00007FF7F75C1000-memory.dmp

Filesize
3.3MB

Download
memory/2372-2297-0x00007FF685FC0000-0x00007FF686311000-memory.dmp

Filesize
3.3MB

Download
memory/2372-465-0x00007FF685FC0000-0x00007FF686311000-memory.dmp

Filesize
3.3MB

Download
memory/2428-2284-0x00007FF7FE020000-0x00007FF7FE371000-memory.dmp

Filesize
3.3MB

Download
memory/2428-447-0x00007FF7FE020000-0x00007FF7FE371000-memory.dmp

Filesize
3.3MB

Download
memory/2584-2298-0x00007FF7020B0000-0x00007FF702401000-memory.dmp

Filesize
3.3MB

Download
memory/2584-464-0x00007FF7020B0000-0x00007FF702401000-memory.dmp

Filesize
3.3MB

Download
memory/2588-55-0x00007FF65E8C0000-0x00007FF65EC11000-memory.dmp

Filesize
3.3MB

Download
memory/2588-2262-0x00007FF65E8C0000-0x00007FF65EC11000-memory.dmp

Filesize
3.3MB

Download
memory/2668-2276-0x00007FF62F270000-0x00007FF62F5C1000-memory.dmp

Filesize
3.3MB

Download
memory/2668-430-0x00007FF62F270000-0x00007FF62F5C1000-memory.dmp

Filesize
3.3MB

Download
memory/2876-2208-0x00007FF70B140000-0x00007FF70B491000-memory.dmp

Filesize
3.3MB

Download
memory/2876-2261-0x00007FF70B140000-0x00007FF70B491000-memory.dmp

Filesize
3.3MB

Download
memory/2876-54-0x00007FF70B140000-0x00007FF70B491000-memory.dmp

Filesize
3.3MB

Download
memory/2936-2204-0x00007FF77AEB0000-0x00007FF77B201000-memory.dmp

Filesize
3.3MB

Download
memory/2936-24-0x00007FF77AEB0000-0x00007FF77B201000-memory.dmp

Filesize
3.3MB

Download
memory/2936-2250-0x00007FF77AEB0000-0x00007FF77B201000-memory.dmp

Filesize
3.3MB

Download
memory/3408-47-0x00007FF6CE8F0000-0x00007FF6CEC41000-memory.dmp

Filesize
3.3MB

Download
memory/3408-2266-0x00007FF6CE8F0000-0x00007FF6CEC41000-memory.dmp

Filesize
3.3MB

Download
memory/3408-2207-0x00007FF6CE8F0000-0x00007FF6CEC41000-memory.dmp

Filesize
3.3MB

Download
memory/3832-435-0x00007FF7032A0000-0x00007FF7035F1000-memory.dmp

Filesize
3.3MB

Download
memory/3832-2273-0x00007FF7032A0000-0x00007FF7035F1000-memory.dmp

Filesize
3.3MB

Download
memory/3956-423-0x00007FF627190000-0x00007FF6274E1000-memory.dmp

Filesize
3.3MB

Download
memory/3956-2264-0x00007FF627190000-0x00007FF6274E1000-memory.dmp

Filesize
3.3MB

Download
memory/3984-2280-0x00007FF6C11F0000-0x00007FF6C1541000-memory.dmp

Filesize
3.3MB

Download
memory/3984-444-0x00007FF6C11F0000-0x00007FF6C1541000-memory.dmp

Filesize
3.3MB

Download
memory/4184-2278-0x00007FF799F70000-0x00007FF79A2C1000-memory.dmp

Filesize
3.3MB

Download
memory/4184-439-0x00007FF799F70000-0x00007FF79A2C1000-memory.dmp

Filesize
3.3MB

Download
memory/4212-2293-0x00007FF74F170000-0x00007FF74F4C1000-memory.dmp

Filesize
3.3MB

Download
memory/4212-468-0x00007FF74F170000-0x00007FF74F4C1000-memory.dmp

Filesize
3.3MB

Download
memory/4300-2310-0x00007FF760960000-0x00007FF760CB1000-memory.dmp

Filesize
3.3MB

Download
memory/4300-455-0x00007FF760960000-0x00007FF760CB1000-memory.dmp

Filesize
3.3MB

Download
memory/4360-2295-0x00007FF7BA660000-0x00007FF7BA9B1000-memory.dmp

Filesize
3.3MB

Download
memory/4360-470-0x00007FF7BA660000-0x00007FF7BA9B1000-memory.dmp

Filesize
3.3MB

Download
memory/4492-2205-0x00007FF738460000-0x00007FF7387B1000-memory.dmp

Filesize
3.3MB

Download
memory/4492-2252-0x00007FF738460000-0x00007FF7387B1000-memory.dmp

Filesize
3.3MB

Download
memory/4492-32-0x00007FF738460000-0x00007FF7387B1000-memory.dmp

Filesize
3.3MB

Download
memory/4548-438-0x00007FF792E60000-0x00007FF7931B1000-memory.dmp

Filesize
3.3MB

Download
memory/4548-2271-0x00007FF792E60000-0x00007FF7931B1000-memory.dmp

Filesize
3.3MB

Download
memory/4768-2306-0x00007FF7FC3D0000-0x00007FF7FC721000-memory.dmp

Filesize
3.3MB

Download
memory/4768-469-0x00007FF7FC3D0000-0x00007FF7FC721000-memory.dmp

Filesize
3.3MB

Download
memory/4928-36-0x00007FF671A60000-0x00007FF671DB1000-memory.dmp

Filesize
3.3MB

Download
memory/4928-2256-0x00007FF671A60000-0x00007FF671DB1000-memory.dmp

Filesize
3.3MB

Download
memory/4928-2206-0x00007FF671A60000-0x00007FF671DB1000-memory.dmp

Filesize
3.3MB

Download
memory/4988-2254-0x00007FF638840000-0x00007FF638B91000-memory.dmp

Filesize
3.3MB

Download
memory/4988-43-0x00007FF638840000-0x00007FF638B91000-memory.dmp

Filesize
3.3MB

Download