xmrig | ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
Size

2.5MB
MD5

d48206b9ca37c40974770d0fc267cddd
SHA1

11371034ef6ca9999fc5e2d9d681e6adb7a9e4ec
SHA256

ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e
SHA512

564c9d8e8160c72f74e09d37ec6bdeae796d8bc679cfac15cddb399547a58dc83e633b9a137cf45e7d67175e888c7025137b34cbe9ecf9b4f4a076cc21c2358a
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMvwWBSBur:NABl

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/1948-82-0x00007FF76B0F0000-0x00007FF76B4E2000-memory.dmp	xmrig
behavioral2/memory/1008-84-0x00007FF6A9060000-0x00007FF6A9452000-memory.dmp	xmrig
behavioral2/memory/1208-90-0x00007FF7A0AD0000-0x00007FF7A0EC2000-memory.dmp	xmrig
behavioral2/memory/1520-92-0x00007FF7AED20000-0x00007FF7AF112000-memory.dmp	xmrig
behavioral2/memory/3920-93-0x00007FF74E300000-0x00007FF74E6F2000-memory.dmp	xmrig
behavioral2/memory/2092-100-0x00007FF61D3F0000-0x00007FF61D7E2000-memory.dmp	xmrig
behavioral2/memory/2080-113-0x00007FF707D80000-0x00007FF708172000-memory.dmp	xmrig
behavioral2/memory/1404-480-0x00007FF6EA220000-0x00007FF6EA612000-memory.dmp	xmrig
behavioral2/memory/4540-485-0x00007FF703310000-0x00007FF703702000-memory.dmp	xmrig
behavioral2/memory/424-499-0x00007FF6FCBF0000-0x00007FF6FCFE2000-memory.dmp	xmrig
behavioral2/memory/8-496-0x00007FF6F5CC0000-0x00007FF6F60B2000-memory.dmp	xmrig
behavioral2/memory/1220-493-0x00007FF74ED00000-0x00007FF74F0F2000-memory.dmp	xmrig
behavioral2/memory/4416-471-0x00007FF670BE0000-0x00007FF670FD2000-memory.dmp	xmrig
behavioral2/memory/228-466-0x00007FF6FA170000-0x00007FF6FA562000-memory.dmp	xmrig
behavioral2/memory/4804-116-0x00007FF687010000-0x00007FF687402000-memory.dmp	xmrig
behavioral2/memory/2492-115-0x00007FF71F120000-0x00007FF71F512000-memory.dmp	xmrig
behavioral2/memory/2276-114-0x00007FF7881F0000-0x00007FF7885E2000-memory.dmp	xmrig
behavioral2/memory/3372-112-0x00007FF792D50000-0x00007FF793142000-memory.dmp	xmrig
behavioral2/memory/4752-107-0x00007FF7AD1B0000-0x00007FF7AD5A2000-memory.dmp	xmrig
behavioral2/memory/4784-106-0x00007FF732660000-0x00007FF732A52000-memory.dmp	xmrig
behavioral2/memory/1032-104-0x00007FF679970000-0x00007FF679D62000-memory.dmp	xmrig
behavioral2/memory/1088-101-0x00007FF641D20000-0x00007FF642112000-memory.dmp	xmrig
behavioral2/memory/4940-97-0x00007FF779B90000-0x00007FF779F82000-memory.dmp	xmrig
behavioral2/memory/2416-83-0x00007FF6FEE50000-0x00007FF6FF242000-memory.dmp	xmrig
behavioral2/memory/2276-3393-0x00007FF7881F0000-0x00007FF7885E2000-memory.dmp	xmrig
behavioral2/memory/4752-3511-0x00007FF7AD1B0000-0x00007FF7AD5A2000-memory.dmp	xmrig
behavioral2/memory/4784-3514-0x00007FF732660000-0x00007FF732A52000-memory.dmp	xmrig
behavioral2/memory/1008-3518-0x00007FF6A9060000-0x00007FF6A9452000-memory.dmp	xmrig
behavioral2/memory/3372-3529-0x00007FF792D50000-0x00007FF793142000-memory.dmp	xmrig
behavioral2/memory/1208-3536-0x00007FF7A0AD0000-0x00007FF7A0EC2000-memory.dmp	xmrig
behavioral2/memory/3920-3540-0x00007FF74E300000-0x00007FF74E6F2000-memory.dmp	xmrig
behavioral2/memory/4416-3717-0x00007FF670BE0000-0x00007FF670FD2000-memory.dmp	xmrig
behavioral2/memory/1220-3715-0x00007FF74ED00000-0x00007FF74F0F2000-memory.dmp	xmrig
behavioral2/memory/1404-3711-0x00007FF6EA220000-0x00007FF6EA612000-memory.dmp	xmrig
behavioral2/memory/4540-3713-0x00007FF703310000-0x00007FF703702000-memory.dmp	xmrig
behavioral2/memory/228-3685-0x00007FF6FA170000-0x00007FF6FA562000-memory.dmp	xmrig
behavioral2/memory/2492-3644-0x00007FF71F120000-0x00007FF71F512000-memory.dmp	xmrig
behavioral2/memory/4804-3642-0x00007FF687010000-0x00007FF687402000-memory.dmp	xmrig
behavioral2/memory/2092-3594-0x00007FF61D3F0000-0x00007FF61D7E2000-memory.dmp	xmrig
behavioral2/memory/1032-3601-0x00007FF679970000-0x00007FF679D62000-memory.dmp	xmrig
behavioral2/memory/1088-3576-0x00007FF641D20000-0x00007FF642112000-memory.dmp	xmrig
behavioral2/memory/4940-3573-0x00007FF779B90000-0x00007FF779F82000-memory.dmp	xmrig
behavioral2/memory/2080-3571-0x00007FF707D80000-0x00007FF708172000-memory.dmp	xmrig
behavioral2/memory/1520-3532-0x00007FF7AED20000-0x00007FF7AF112000-memory.dmp	xmrig
behavioral2/memory/2416-3526-0x00007FF6FEE50000-0x00007FF6FF242000-memory.dmp	xmrig
behavioral2/memory/1948-3522-0x00007FF76B0F0000-0x00007FF76B4E2000-memory.dmp	xmrig
behavioral2/memory/2276-4138-0x00007FF7881F0000-0x00007FF7885E2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	2556	powershell.exe
10	2556	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2556	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4784	sFHykxZ.exe
4752	pgjcoUV.exe
1948	yCTlAok.exe
2416	OsdjxIN.exe
1008	KsrkAMY.exe
3372	YrQOtpv.exe
1208	ACQfgIw.exe
1520	gfajhFM.exe
3920	UUnlzjk.exe
4940	hnJvciC.exe
2092	TZywrBF.exe
1088	ShMblzJ.exe
2080	ofbfYCj.exe
1032	iRUoCvi.exe
2276	EZImkbd.exe
2492	RgXfnNu.exe
4804	eyzEutq.exe
228	wBzrYhZ.exe
4416	bZtaRPb.exe
1404	GhkbzZT.exe
4540	hBtiVle.exe
1220	uxEzFxZ.exe
8	PGRQZKW.exe
424	pLocntu.exe
1400	uWshkbJ.exe
2028	psGncLQ.exe
4776	BQgYMHA.exe
4040	FIslZEi.exe
532	LpXDXre.exe
4840	pYZWZIR.exe
2880	DJjxEBi.exe
3692	bkwiZJW.exe
2344	vRhpFfD.exe
3232	qdosNAT.exe
2672	wFvEPnE.exe
1904	hCMNeDF.exe
3428	zmWkzlX.exe
4452	WspGuTi.exe
2360	NaNTSip.exe
1384	UiKIDpZ.exe
1512	Dglmsoe.exe
1820	LnHSDOj.exe
2640	hfkZQJT.exe
1984	hbAGbxX.exe
768	dXxbuvP.exe
2828	NEyumuj.exe
3216	ruOLYBh.exe
752	SrGikfJ.exe
876	exjatwT.exe
884	wBNPLqh.exe
3000	LiCmTgf.exe
4584	UadFMWk.exe
1120	OVqBbfs.exe
3488	xMvmVQI.exe
4692	xFnVvhx.exe
4020	cPwFnKl.exe
692	TiMIMzo.exe
4916	aNYhOvU.exe
4320	NyawgWw.exe
4340	DLGlJyY.exe
224	TzVYjFQ.exe
2112	CyjsVlA.exe
3252	ckLRfYh.exe
3120	RItByPJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5092-0-0x00007FF77A190000-0x00007FF77A582000-memory.dmp	upx
behavioral2/files/0x00080000000234cc-5.dat	upx
behavioral2/files/0x00070000000234d0-11.dat	upx
behavioral2/files/0x00070000000234d1-23.dat	upx
behavioral2/files/0x00070000000234d5-27.dat	upx
behavioral2/files/0x00070000000234d6-41.dat	upx
behavioral2/files/0x00080000000234d3-51.dat	upx
behavioral2/files/0x00080000000234d4-61.dat	upx
behavioral2/files/0x00070000000234d7-67.dat	upx
behavioral2/memory/1948-82-0x00007FF76B0F0000-0x00007FF76B4E2000-memory.dmp	upx
behavioral2/memory/1008-84-0x00007FF6A9060000-0x00007FF6A9452000-memory.dmp	upx
behavioral2/memory/1208-90-0x00007FF7A0AD0000-0x00007FF7A0EC2000-memory.dmp	upx
behavioral2/memory/1520-92-0x00007FF7AED20000-0x00007FF7AF112000-memory.dmp	upx
behavioral2/memory/3920-93-0x00007FF74E300000-0x00007FF74E6F2000-memory.dmp	upx
behavioral2/memory/2092-100-0x00007FF61D3F0000-0x00007FF61D7E2000-memory.dmp	upx
behavioral2/files/0x00080000000234cd-105.dat	upx
behavioral2/memory/2080-113-0x00007FF707D80000-0x00007FF708172000-memory.dmp	upx
behavioral2/files/0x00070000000234df-120.dat	upx
behavioral2/files/0x00070000000234e1-133.dat	upx
behavioral2/files/0x00070000000234e6-157.dat	upx
behavioral2/files/0x00070000000234ea-172.dat	upx
behavioral2/files/0x00070000000234ed-187.dat	upx
behavioral2/memory/1404-480-0x00007FF6EA220000-0x00007FF6EA612000-memory.dmp	upx
behavioral2/memory/4540-485-0x00007FF703310000-0x00007FF703702000-memory.dmp	upx
behavioral2/memory/424-499-0x00007FF6FCBF0000-0x00007FF6FCFE2000-memory.dmp	upx
behavioral2/memory/8-496-0x00007FF6F5CC0000-0x00007FF6F60B2000-memory.dmp	upx
behavioral2/memory/1220-493-0x00007FF74ED00000-0x00007FF74F0F2000-memory.dmp	upx
behavioral2/memory/4416-471-0x00007FF670BE0000-0x00007FF670FD2000-memory.dmp	upx
behavioral2/memory/228-466-0x00007FF6FA170000-0x00007FF6FA562000-memory.dmp	upx
behavioral2/files/0x00070000000234ee-192.dat	upx
behavioral2/files/0x00070000000234ec-190.dat	upx
behavioral2/files/0x00070000000234eb-185.dat	upx
behavioral2/files/0x00070000000234e9-175.dat	upx
behavioral2/files/0x00070000000234e8-170.dat	upx
behavioral2/files/0x00070000000234e7-165.dat	upx
behavioral2/files/0x00070000000234e5-153.dat	upx
behavioral2/files/0x00070000000234e4-148.dat	upx
behavioral2/files/0x00070000000234e3-143.dat	upx
behavioral2/files/0x00070000000234e2-138.dat	upx
behavioral2/files/0x00070000000234e0-128.dat	upx
behavioral2/memory/4804-116-0x00007FF687010000-0x00007FF687402000-memory.dmp	upx
behavioral2/memory/2492-115-0x00007FF71F120000-0x00007FF71F512000-memory.dmp	upx
behavioral2/memory/2276-114-0x00007FF7881F0000-0x00007FF7885E2000-memory.dmp	upx
behavioral2/memory/3372-112-0x00007FF792D50000-0x00007FF793142000-memory.dmp	upx
behavioral2/files/0x00070000000234de-110.dat	upx
behavioral2/memory/4752-107-0x00007FF7AD1B0000-0x00007FF7AD5A2000-memory.dmp	upx
behavioral2/memory/4784-106-0x00007FF732660000-0x00007FF732A52000-memory.dmp	upx
behavioral2/memory/1032-104-0x00007FF679970000-0x00007FF679D62000-memory.dmp	upx
behavioral2/memory/1088-101-0x00007FF641D20000-0x00007FF642112000-memory.dmp	upx
behavioral2/files/0x00070000000234dd-98.dat	upx
behavioral2/memory/4940-97-0x00007FF779B90000-0x00007FF779F82000-memory.dmp	upx
behavioral2/files/0x00070000000234dc-88.dat	upx
behavioral2/files/0x00070000000234d9-85.dat	upx
behavioral2/memory/2416-83-0x00007FF6FEE50000-0x00007FF6FF242000-memory.dmp	upx
behavioral2/files/0x00070000000234db-78.dat	upx
behavioral2/files/0x00070000000234da-73.dat	upx
behavioral2/files/0x00070000000234d8-70.dat	upx
behavioral2/files/0x00070000000234d2-36.dat	upx
behavioral2/memory/2276-3393-0x00007FF7881F0000-0x00007FF7885E2000-memory.dmp	upx
behavioral2/memory/4752-3511-0x00007FF7AD1B0000-0x00007FF7AD5A2000-memory.dmp	upx
behavioral2/memory/4784-3514-0x00007FF732660000-0x00007FF732A52000-memory.dmp	upx
behavioral2/memory/1008-3518-0x00007FF6A9060000-0x00007FF6A9452000-memory.dmp	upx
behavioral2/memory/3372-3529-0x00007FF792D50000-0x00007FF793142000-memory.dmp	upx
behavioral2/memory/1208-3536-0x00007FF7A0AD0000-0x00007FF7A0EC2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pOkfRpD.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\LGVtHHq.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\ZjtPjuB.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\UnjxlMI.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\CqMgnVi.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\GVZiNff.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\HwwDyMF.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\BkVKcVG.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\XYbzhBv.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\hxitFGh.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\AiEvMKD.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\MFcpIyO.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\PVquRIW.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\vzCgbqP.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\ebiwpiL.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\dFUYiBA.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\zvGbKEi.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\QDVrJTY.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\tZzhzXq.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\NGLamJd.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\qKLdfmH.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\ujaUlkJ.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\PnpPaOE.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\nRLZYHH.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\aBAyDif.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\ECegvGj.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\uvWTOQg.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\wBNPLqh.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\hIcQWpz.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\hdRKIZJ.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\TJvVcUl.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\ouTcTia.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\uVYVVZF.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\jHvzJRP.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\qdosNAT.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\MtAnONS.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\igBYZWS.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\mvAlxPF.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\ismSnYq.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\WgnEBVy.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\GoFJAMz.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\TpSTKrq.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\VahCPzo.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\oORcjqM.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\zIHBabv.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\ZnpQfds.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\sovkLIu.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\HViYvyj.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\bIPtPwQ.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\JNWWPnf.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\LYsAjkU.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\xkQAbrp.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\AprhzaG.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\tXsvtmY.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\MHeUVDB.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\iyPCylR.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\xZuuFek.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\cpvegxx.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\seNTZQq.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\nMPIVTY.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\NuEkJII.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\ACzKPSq.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\hnMHAOj.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
File created	C:\Windows\System\QgdXNwQ.exe	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeLockMemoryPrivilege	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
Token: SeLockMemoryPrivilege	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 2556	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	85
PID 5092 wrote to memory of 2556	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	85
PID 5092 wrote to memory of 4784	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	86
PID 5092 wrote to memory of 4784	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	86
PID 5092 wrote to memory of 4752	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	87
PID 5092 wrote to memory of 4752	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	87
PID 5092 wrote to memory of 1948	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	88
PID 5092 wrote to memory of 1948	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	88
PID 5092 wrote to memory of 2416	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	89
PID 5092 wrote to memory of 2416	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	89
PID 5092 wrote to memory of 1008	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	90
PID 5092 wrote to memory of 1008	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	90
PID 5092 wrote to memory of 3372	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	91
PID 5092 wrote to memory of 3372	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	91
PID 5092 wrote to memory of 1208	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	92
PID 5092 wrote to memory of 1208	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	92
PID 5092 wrote to memory of 1520	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	93
PID 5092 wrote to memory of 1520	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	93
PID 5092 wrote to memory of 3920	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	94
PID 5092 wrote to memory of 3920	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	94
PID 5092 wrote to memory of 4940	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	95
PID 5092 wrote to memory of 4940	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	95
PID 5092 wrote to memory of 2092	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	96
PID 5092 wrote to memory of 2092	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	96
PID 5092 wrote to memory of 1088	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	97
PID 5092 wrote to memory of 1088	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	97
PID 5092 wrote to memory of 2080	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	98
PID 5092 wrote to memory of 2080	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	98
PID 5092 wrote to memory of 1032	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	99
PID 5092 wrote to memory of 1032	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	99
PID 5092 wrote to memory of 2276	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	100
PID 5092 wrote to memory of 2276	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	100
PID 5092 wrote to memory of 2492	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	101
PID 5092 wrote to memory of 2492	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	101
PID 5092 wrote to memory of 4804	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	102
PID 5092 wrote to memory of 4804	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	102
PID 5092 wrote to memory of 228	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	103
PID 5092 wrote to memory of 228	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	103
PID 5092 wrote to memory of 4416	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	104
PID 5092 wrote to memory of 4416	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	104
PID 5092 wrote to memory of 1404	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	105
PID 5092 wrote to memory of 1404	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	105
PID 5092 wrote to memory of 4540	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	106
PID 5092 wrote to memory of 4540	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	106
PID 5092 wrote to memory of 1220	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	107
PID 5092 wrote to memory of 1220	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	107
PID 5092 wrote to memory of 8	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	108
PID 5092 wrote to memory of 8	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	108
PID 5092 wrote to memory of 424	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	109
PID 5092 wrote to memory of 424	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	109
PID 5092 wrote to memory of 1400	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	110
PID 5092 wrote to memory of 1400	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	110
PID 5092 wrote to memory of 2028	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	111
PID 5092 wrote to memory of 2028	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	111
PID 5092 wrote to memory of 4776	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	112
PID 5092 wrote to memory of 4776	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	112
PID 5092 wrote to memory of 4040	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	113
PID 5092 wrote to memory of 4040	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	113
PID 5092 wrote to memory of 532	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	114
PID 5092 wrote to memory of 532	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	114
PID 5092 wrote to memory of 4840	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	115
PID 5092 wrote to memory of 4840	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	115
PID 5092 wrote to memory of 2880	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	116
PID 5092 wrote to memory of 2880	5092	ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe	116

C:\Users\Admin\AppData\Local\Temp\ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe
"C:\Users\Admin\AppData\Local\Temp\ba10482a90890c7c044c7363e4b6326eff3a8dac8db4ddb83613a307518f6d0e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2556
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2556" "2960" "2896" "2964" "0" "0" "2968" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12896
- C:\Windows\System\sFHykxZ.exe
  C:\Windows\System\sFHykxZ.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\pgjcoUV.exe
  C:\Windows\System\pgjcoUV.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\yCTlAok.exe
  C:\Windows\System\yCTlAok.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\OsdjxIN.exe
  C:\Windows\System\OsdjxIN.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\KsrkAMY.exe
  C:\Windows\System\KsrkAMY.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\YrQOtpv.exe
  C:\Windows\System\YrQOtpv.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\ACQfgIw.exe
  C:\Windows\System\ACQfgIw.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\gfajhFM.exe
  C:\Windows\System\gfajhFM.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\UUnlzjk.exe
  C:\Windows\System\UUnlzjk.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\hnJvciC.exe
  C:\Windows\System\hnJvciC.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\TZywrBF.exe
  C:\Windows\System\TZywrBF.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\ShMblzJ.exe
  C:\Windows\System\ShMblzJ.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\ofbfYCj.exe
  C:\Windows\System\ofbfYCj.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\iRUoCvi.exe
  C:\Windows\System\iRUoCvi.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\EZImkbd.exe
  C:\Windows\System\EZImkbd.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\RgXfnNu.exe
  C:\Windows\System\RgXfnNu.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\eyzEutq.exe
  C:\Windows\System\eyzEutq.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\wBzrYhZ.exe
  C:\Windows\System\wBzrYhZ.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\bZtaRPb.exe
  C:\Windows\System\bZtaRPb.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\GhkbzZT.exe
  C:\Windows\System\GhkbzZT.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\hBtiVle.exe
  C:\Windows\System\hBtiVle.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\uxEzFxZ.exe
  C:\Windows\System\uxEzFxZ.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\PGRQZKW.exe
  C:\Windows\System\PGRQZKW.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\pLocntu.exe
  C:\Windows\System\pLocntu.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\uWshkbJ.exe
  C:\Windows\System\uWshkbJ.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\psGncLQ.exe
  C:\Windows\System\psGncLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\BQgYMHA.exe
  C:\Windows\System\BQgYMHA.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\FIslZEi.exe
  C:\Windows\System\FIslZEi.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\LpXDXre.exe
  C:\Windows\System\LpXDXre.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\pYZWZIR.exe
  C:\Windows\System\pYZWZIR.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\DJjxEBi.exe
  C:\Windows\System\DJjxEBi.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\bkwiZJW.exe
  C:\Windows\System\bkwiZJW.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\vRhpFfD.exe
  C:\Windows\System\vRhpFfD.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\qdosNAT.exe
  C:\Windows\System\qdosNAT.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\wFvEPnE.exe
  C:\Windows\System\wFvEPnE.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\hCMNeDF.exe
  C:\Windows\System\hCMNeDF.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\zmWkzlX.exe
  C:\Windows\System\zmWkzlX.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\WspGuTi.exe
  C:\Windows\System\WspGuTi.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\NaNTSip.exe
  C:\Windows\System\NaNTSip.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\UiKIDpZ.exe
  C:\Windows\System\UiKIDpZ.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\Dglmsoe.exe
  C:\Windows\System\Dglmsoe.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\LnHSDOj.exe
  C:\Windows\System\LnHSDOj.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\hfkZQJT.exe
  C:\Windows\System\hfkZQJT.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\hbAGbxX.exe
  C:\Windows\System\hbAGbxX.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\dXxbuvP.exe
  C:\Windows\System\dXxbuvP.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\NEyumuj.exe
  C:\Windows\System\NEyumuj.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\ruOLYBh.exe
  C:\Windows\System\ruOLYBh.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\SrGikfJ.exe
  C:\Windows\System\SrGikfJ.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\exjatwT.exe
  C:\Windows\System\exjatwT.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\wBNPLqh.exe
  C:\Windows\System\wBNPLqh.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\LiCmTgf.exe
  C:\Windows\System\LiCmTgf.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\UadFMWk.exe
  C:\Windows\System\UadFMWk.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\OVqBbfs.exe
  C:\Windows\System\OVqBbfs.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\xMvmVQI.exe
  C:\Windows\System\xMvmVQI.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\xFnVvhx.exe
  C:\Windows\System\xFnVvhx.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\cPwFnKl.exe
  C:\Windows\System\cPwFnKl.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\TiMIMzo.exe
  C:\Windows\System\TiMIMzo.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\aNYhOvU.exe
  C:\Windows\System\aNYhOvU.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\NyawgWw.exe
  C:\Windows\System\NyawgWw.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\DLGlJyY.exe
  C:\Windows\System\DLGlJyY.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\TzVYjFQ.exe
  C:\Windows\System\TzVYjFQ.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\CyjsVlA.exe
  C:\Windows\System\CyjsVlA.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\ckLRfYh.exe
  C:\Windows\System\ckLRfYh.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\RItByPJ.exe
  C:\Windows\System\RItByPJ.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\GOEHPBx.exe
  C:\Windows\System\GOEHPBx.exe
  2⤵
  PID:1672
- C:\Windows\System\VPWOzCK.exe
  C:\Windows\System\VPWOzCK.exe
  2⤵
  PID:3408
- C:\Windows\System\qkItrod.exe
  C:\Windows\System\qkItrod.exe
  2⤵
  PID:3812
- C:\Windows\System\NtimNeS.exe
  C:\Windows\System\NtimNeS.exe
  2⤵
  PID:3632
- C:\Windows\System\UUSkugm.exe
  C:\Windows\System\UUSkugm.exe
  2⤵
  PID:4512
- C:\Windows\System\odXRBAW.exe
  C:\Windows\System\odXRBAW.exe
  2⤵
  PID:2700
- C:\Windows\System\ijKioaG.exe
  C:\Windows\System\ijKioaG.exe
  2⤵
  PID:2372
- C:\Windows\System\wCZwERd.exe
  C:\Windows\System\wCZwERd.exe
  2⤵
  PID:3280
- C:\Windows\System\wRQUwBG.exe
  C:\Windows\System\wRQUwBG.exe
  2⤵
  PID:3844
- C:\Windows\System\vkCslqH.exe
  C:\Windows\System\vkCslqH.exe
  2⤵
  PID:212
- C:\Windows\System\ycvzeWM.exe
  C:\Windows\System\ycvzeWM.exe
  2⤵
  PID:5104
- C:\Windows\System\VFHHhjc.exe
  C:\Windows\System\VFHHhjc.exe
  2⤵
  PID:5124
- C:\Windows\System\MTPFVup.exe
  C:\Windows\System\MTPFVup.exe
  2⤵
  PID:5156
- C:\Windows\System\PFZIoaK.exe
  C:\Windows\System\PFZIoaK.exe
  2⤵
  PID:5184
- C:\Windows\System\xyTBcZD.exe
  C:\Windows\System\xyTBcZD.exe
  2⤵
  PID:5212
- C:\Windows\System\qbcBnxm.exe
  C:\Windows\System\qbcBnxm.exe
  2⤵
  PID:5240
- C:\Windows\System\ymBFbdD.exe
  C:\Windows\System\ymBFbdD.exe
  2⤵
  PID:5268
- C:\Windows\System\niIMavk.exe
  C:\Windows\System\niIMavk.exe
  2⤵
  PID:5296
- C:\Windows\System\bqWnZRp.exe
  C:\Windows\System\bqWnZRp.exe
  2⤵
  PID:5320
- C:\Windows\System\NnpkQNL.exe
  C:\Windows\System\NnpkQNL.exe
  2⤵
  PID:5352
- C:\Windows\System\wlJwEYF.exe
  C:\Windows\System\wlJwEYF.exe
  2⤵
  PID:5376
- C:\Windows\System\IicfoYl.exe
  C:\Windows\System\IicfoYl.exe
  2⤵
  PID:5404
- C:\Windows\System\sKBBIly.exe
  C:\Windows\System\sKBBIly.exe
  2⤵
  PID:5432
- C:\Windows\System\QHVINlp.exe
  C:\Windows\System\QHVINlp.exe
  2⤵
  PID:5460
- C:\Windows\System\VubWROG.exe
  C:\Windows\System\VubWROG.exe
  2⤵
  PID:5488
- C:\Windows\System\fQWwNsR.exe
  C:\Windows\System\fQWwNsR.exe
  2⤵
  PID:5516
- C:\Windows\System\LVrfHEC.exe
  C:\Windows\System\LVrfHEC.exe
  2⤵
  PID:5544
- C:\Windows\System\DrYTgFw.exe
  C:\Windows\System\DrYTgFw.exe
  2⤵
  PID:5576
- C:\Windows\System\mbtMfiC.exe
  C:\Windows\System\mbtMfiC.exe
  2⤵
  PID:5600
- C:\Windows\System\uwJkqJL.exe
  C:\Windows\System\uwJkqJL.exe
  2⤵
  PID:5628
- C:\Windows\System\eJLJSrl.exe
  C:\Windows\System\eJLJSrl.exe
  2⤵
  PID:5660
- C:\Windows\System\KSZOPCX.exe
  C:\Windows\System\KSZOPCX.exe
  2⤵
  PID:5688
- C:\Windows\System\zhnxbmA.exe
  C:\Windows\System\zhnxbmA.exe
  2⤵
  PID:5712
- C:\Windows\System\dEJuYzD.exe
  C:\Windows\System\dEJuYzD.exe
  2⤵
  PID:5740
- C:\Windows\System\SfOohck.exe
  C:\Windows\System\SfOohck.exe
  2⤵
  PID:5772
- C:\Windows\System\KeFjSwL.exe
  C:\Windows\System\KeFjSwL.exe
  2⤵
  PID:5800
- C:\Windows\System\JEsaGgJ.exe
  C:\Windows\System\JEsaGgJ.exe
  2⤵
  PID:5824
- C:\Windows\System\Qklwecr.exe
  C:\Windows\System\Qklwecr.exe
  2⤵
  PID:5856
- C:\Windows\System\SXFkKVW.exe
  C:\Windows\System\SXFkKVW.exe
  2⤵
  PID:5884
- C:\Windows\System\fxnltiQ.exe
  C:\Windows\System\fxnltiQ.exe
  2⤵
  PID:5904
- C:\Windows\System\XVoGmDH.exe
  C:\Windows\System\XVoGmDH.exe
  2⤵
  PID:5936
- C:\Windows\System\OOPeOlw.exe
  C:\Windows\System\OOPeOlw.exe
  2⤵
  PID:5964
- C:\Windows\System\EcgeEke.exe
  C:\Windows\System\EcgeEke.exe
  2⤵
  PID:5992
- C:\Windows\System\gzMnkym.exe
  C:\Windows\System\gzMnkym.exe
  2⤵
  PID:6020
- C:\Windows\System\UnjxlMI.exe
  C:\Windows\System\UnjxlMI.exe
  2⤵
  PID:6048
- C:\Windows\System\GManoPi.exe
  C:\Windows\System\GManoPi.exe
  2⤵
  PID:6076
- C:\Windows\System\SKNKDKf.exe
  C:\Windows\System\SKNKDKf.exe
  2⤵
  PID:6108
- C:\Windows\System\cDiuaFd.exe
  C:\Windows\System\cDiuaFd.exe
  2⤵
  PID:6136
- C:\Windows\System\EXSiBQC.exe
  C:\Windows\System\EXSiBQC.exe
  2⤵
  PID:1816
- C:\Windows\System\VIPhkMb.exe
  C:\Windows\System\VIPhkMb.exe
  2⤵
  PID:3176
- C:\Windows\System\eGFneqf.exe
  C:\Windows\System\eGFneqf.exe
  2⤵
  PID:5148
- C:\Windows\System\BKutkmB.exe
  C:\Windows\System\BKutkmB.exe
  2⤵
  PID:5204
- C:\Windows\System\VGZaIAM.exe
  C:\Windows\System\VGZaIAM.exe
  2⤵
  PID:5260
- C:\Windows\System\RzgJLSO.exe
  C:\Windows\System\RzgJLSO.exe
  2⤵
  PID:5336
- C:\Windows\System\hpRDjqd.exe
  C:\Windows\System\hpRDjqd.exe
  2⤵
  PID:5392
- C:\Windows\System\BSrhYeS.exe
  C:\Windows\System\BSrhYeS.exe
  2⤵
  PID:5452
- C:\Windows\System\mKZOREL.exe
  C:\Windows\System\mKZOREL.exe
  2⤵
  PID:5508
- C:\Windows\System\gJTZZmV.exe
  C:\Windows\System\gJTZZmV.exe
  2⤵
  PID:5620
- C:\Windows\System\MhlEMum.exe
  C:\Windows\System\MhlEMum.exe
  2⤵
  PID:5652
- C:\Windows\System\tesMSNq.exe
  C:\Windows\System\tesMSNq.exe
  2⤵
  PID:5732
- C:\Windows\System\MQEBCNT.exe
  C:\Windows\System\MQEBCNT.exe
  2⤵
  PID:5788
- C:\Windows\System\VSJrrkm.exe
  C:\Windows\System\VSJrrkm.exe
  2⤵
  PID:5840
- C:\Windows\System\hiEIAmZ.exe
  C:\Windows\System\hiEIAmZ.exe
  2⤵
  PID:5876
- C:\Windows\System\EoWnqTe.exe
  C:\Windows\System\EoWnqTe.exe
  2⤵
  PID:5916
- C:\Windows\System\sdCKUng.exe
  C:\Windows\System\sdCKUng.exe
  2⤵
  PID:5952
- C:\Windows\System\qeUAWus.exe
  C:\Windows\System\qeUAWus.exe
  2⤵
  PID:6016
- C:\Windows\System\LZwRROD.exe
  C:\Windows\System\LZwRROD.exe
  2⤵
  PID:552
- C:\Windows\System\kYhTjrB.exe
  C:\Windows\System\kYhTjrB.exe
  2⤵
  PID:4696
- C:\Windows\System\PHjJXtV.exe
  C:\Windows\System\PHjJXtV.exe
  2⤵
  PID:3700
- C:\Windows\System\QtqiPhc.exe
  C:\Windows\System\QtqiPhc.exe
  2⤵
  PID:2612
- C:\Windows\System\bwgchLK.exe
  C:\Windows\System\bwgchLK.exe
  2⤵
  PID:5312
- C:\Windows\System\KxEWGPe.exe
  C:\Windows\System\KxEWGPe.exe
  2⤵
  PID:5428
- C:\Windows\System\cDBdKqW.exe
  C:\Windows\System\cDBdKqW.exe
  2⤵
  PID:5480
- C:\Windows\System\XxNqKDA.exe
  C:\Windows\System\XxNqKDA.exe
  2⤵
  PID:5728
- C:\Windows\System\PiaCMkI.exe
  C:\Windows\System\PiaCMkI.exe
  2⤵
  PID:1652
- C:\Windows\System\PBFajtD.exe
  C:\Windows\System\PBFajtD.exe
  2⤵
  PID:2808
- C:\Windows\System\CLjTkLc.exe
  C:\Windows\System\CLjTkLc.exe
  2⤵
  PID:4008
- C:\Windows\System\YafCbpE.exe
  C:\Windows\System\YafCbpE.exe
  2⤵
  PID:5820
- C:\Windows\System\egObZZf.exe
  C:\Windows\System\egObZZf.exe
  2⤵
  PID:6072
- C:\Windows\System\llrfzRu.exe
  C:\Windows\System\llrfzRu.exe
  2⤵
  PID:6128
- C:\Windows\System\tUkxOxM.exe
  C:\Windows\System\tUkxOxM.exe
  2⤵
  PID:4864
- C:\Windows\System\LJUVTmc.exe
  C:\Windows\System\LJUVTmc.exe
  2⤵
  PID:4472
- C:\Windows\System\UFCEgfP.exe
  C:\Windows\System\UFCEgfP.exe
  2⤵
  PID:3008
- C:\Windows\System\YBqYbBe.exe
  C:\Windows\System\YBqYbBe.exe
  2⤵
  PID:5704
- C:\Windows\System\JsryDfp.exe
  C:\Windows\System\JsryDfp.exe
  2⤵
  PID:3804
- C:\Windows\System\egNUBuN.exe
  C:\Windows\System\egNUBuN.exe
  2⤵
  PID:5900
- C:\Windows\System\gKChQot.exe
  C:\Windows\System\gKChQot.exe
  2⤵
  PID:3128
- C:\Windows\System\oyJoROE.exe
  C:\Windows\System\oyJoROE.exe
  2⤵
  PID:5368
- C:\Windows\System\HPOQXJJ.exe
  C:\Windows\System\HPOQXJJ.exe
  2⤵
  PID:3900
- C:\Windows\System\CWMWitJ.exe
  C:\Windows\System\CWMWitJ.exe
  2⤵
  PID:2272
- C:\Windows\System\blFJRTc.exe
  C:\Windows\System\blFJRTc.exe
  2⤵
  PID:5308
- C:\Windows\System\IUxDNad.exe
  C:\Windows\System\IUxDNad.exe
  2⤵
  PID:2552
- C:\Windows\System\qzuBFjX.exe
  C:\Windows\System\qzuBFjX.exe
  2⤵
  PID:6184
- C:\Windows\System\BclEYRY.exe
  C:\Windows\System\BclEYRY.exe
  2⤵
  PID:6204
- C:\Windows\System\MtAnONS.exe
  C:\Windows\System\MtAnONS.exe
  2⤵
  PID:6228
- C:\Windows\System\TMlipVF.exe
  C:\Windows\System\TMlipVF.exe
  2⤵
  PID:6256
- C:\Windows\System\iPRbWgI.exe
  C:\Windows\System\iPRbWgI.exe
  2⤵
  PID:6304
- C:\Windows\System\ZrksWkD.exe
  C:\Windows\System\ZrksWkD.exe
  2⤵
  PID:6336
- C:\Windows\System\arPovKY.exe
  C:\Windows\System\arPovKY.exe
  2⤵
  PID:6364
- C:\Windows\System\DDEjXBH.exe
  C:\Windows\System\DDEjXBH.exe
  2⤵
  PID:6388
- C:\Windows\System\dYBJtQg.exe
  C:\Windows\System\dYBJtQg.exe
  2⤵
  PID:6412
- C:\Windows\System\CqMgnVi.exe
  C:\Windows\System\CqMgnVi.exe
  2⤵
  PID:6452
- C:\Windows\System\TJqnUXy.exe
  C:\Windows\System\TJqnUXy.exe
  2⤵
  PID:6468
- C:\Windows\System\wPvuPcb.exe
  C:\Windows\System\wPvuPcb.exe
  2⤵
  PID:6484
- C:\Windows\System\aXTAtFX.exe
  C:\Windows\System\aXTAtFX.exe
  2⤵
  PID:6500
- C:\Windows\System\edJlxZS.exe
  C:\Windows\System\edJlxZS.exe
  2⤵
  PID:6520
- C:\Windows\System\aovjYpW.exe
  C:\Windows\System\aovjYpW.exe
  2⤵
  PID:6540
- C:\Windows\System\ycObWGD.exe
  C:\Windows\System\ycObWGD.exe
  2⤵
  PID:6584
- C:\Windows\System\UjgPJVJ.exe
  C:\Windows\System\UjgPJVJ.exe
  2⤵
  PID:6612
- C:\Windows\System\fmqKQDz.exe
  C:\Windows\System\fmqKQDz.exe
  2⤵
  PID:6632
- C:\Windows\System\QiBezPY.exe
  C:\Windows\System\QiBezPY.exe
  2⤵
  PID:6656
- C:\Windows\System\oHFOvUq.exe
  C:\Windows\System\oHFOvUq.exe
  2⤵
  PID:6676
- C:\Windows\System\yTZZjbk.exe
  C:\Windows\System\yTZZjbk.exe
  2⤵
  PID:6700
- C:\Windows\System\MXbaOwp.exe
  C:\Windows\System\MXbaOwp.exe
  2⤵
  PID:6720
- C:\Windows\System\CaCtJpr.exe
  C:\Windows\System\CaCtJpr.exe
  2⤵
  PID:6756
- C:\Windows\System\OAAohdd.exe
  C:\Windows\System\OAAohdd.exe
  2⤵
  PID:6780
- C:\Windows\System\nbqeRuQ.exe
  C:\Windows\System\nbqeRuQ.exe
  2⤵
  PID:6800
- C:\Windows\System\pbtdKEG.exe
  C:\Windows\System\pbtdKEG.exe
  2⤵
  PID:6828
- C:\Windows\System\AiEvMKD.exe
  C:\Windows\System\AiEvMKD.exe
  2⤵
  PID:6852
- C:\Windows\System\EFQxVLH.exe
  C:\Windows\System\EFQxVLH.exe
  2⤵
  PID:6888
- C:\Windows\System\wMWGMAe.exe
  C:\Windows\System\wMWGMAe.exe
  2⤵
  PID:6912
- C:\Windows\System\QacYgGW.exe
  C:\Windows\System\QacYgGW.exe
  2⤵
  PID:6960
- C:\Windows\System\ROaJUXJ.exe
  C:\Windows\System\ROaJUXJ.exe
  2⤵
  PID:6980
- C:\Windows\System\BDMOQTC.exe
  C:\Windows\System\BDMOQTC.exe
  2⤵
  PID:7004
- C:\Windows\System\zUfeIaS.exe
  C:\Windows\System\zUfeIaS.exe
  2⤵
  PID:7028
- C:\Windows\System\tbvvuVS.exe
  C:\Windows\System\tbvvuVS.exe
  2⤵
  PID:7056
- C:\Windows\System\ZRlmiHI.exe
  C:\Windows\System\ZRlmiHI.exe
  2⤵
  PID:7080
- C:\Windows\System\uHdlRYE.exe
  C:\Windows\System\uHdlRYE.exe
  2⤵
  PID:7120
- C:\Windows\System\WloMulJ.exe
  C:\Windows\System\WloMulJ.exe
  2⤵
  PID:7140
- C:\Windows\System\ifgPkPS.exe
  C:\Windows\System\ifgPkPS.exe
  2⤵
  PID:6124
- C:\Windows\System\SNXhLJK.exe
  C:\Windows\System\SNXhLJK.exe
  2⤵
  PID:6200
- C:\Windows\System\jLnOXTy.exe
  C:\Windows\System\jLnOXTy.exe
  2⤵
  PID:6328
- C:\Windows\System\ndjRksg.exe
  C:\Windows\System\ndjRksg.exe
  2⤵
  PID:6376
- C:\Windows\System\IduOjtY.exe
  C:\Windows\System\IduOjtY.exe
  2⤵
  PID:6432
- C:\Windows\System\LbvEULp.exe
  C:\Windows\System\LbvEULp.exe
  2⤵
  PID:6560
- C:\Windows\System\xWcPHBk.exe
  C:\Windows\System\xWcPHBk.exe
  2⤵
  PID:6688
- C:\Windows\System\bCaQGud.exe
  C:\Windows\System\bCaQGud.exe
  2⤵
  PID:6668
- C:\Windows\System\kpnEqiH.exe
  C:\Windows\System\kpnEqiH.exe
  2⤵
  PID:6648
- C:\Windows\System\RQUtFMA.exe
  C:\Windows\System\RQUtFMA.exe
  2⤵
  PID:6748
- C:\Windows\System\xzZrWPL.exe
  C:\Windows\System\xzZrWPL.exe
  2⤵
  PID:6880
- C:\Windows\System\ZKxVcGv.exe
  C:\Windows\System\ZKxVcGv.exe
  2⤵
  PID:6908
- C:\Windows\System\EUWaDOl.exe
  C:\Windows\System\EUWaDOl.exe
  2⤵
  PID:6972
- C:\Windows\System\GUybYVB.exe
  C:\Windows\System\GUybYVB.exe
  2⤵
  PID:7024
- C:\Windows\System\OGZVeqD.exe
  C:\Windows\System\OGZVeqD.exe
  2⤵
  PID:7116
- C:\Windows\System\BKovDfv.exe
  C:\Windows\System\BKovDfv.exe
  2⤵
  PID:7164
- C:\Windows\System\pfGTcmN.exe
  C:\Windows\System\pfGTcmN.exe
  2⤵
  PID:6212
- C:\Windows\System\cUtxjvS.exe
  C:\Windows\System\cUtxjvS.exe
  2⤵
  PID:6292
- C:\Windows\System\jVUaTgz.exe
  C:\Windows\System\jVUaTgz.exe
  2⤵
  PID:6512
- C:\Windows\System\HCbBacl.exe
  C:\Windows\System\HCbBacl.exe
  2⤵
  PID:6604
- C:\Windows\System\DOOwrbH.exe
  C:\Windows\System\DOOwrbH.exe
  2⤵
  PID:6764
- C:\Windows\System\HMvGnun.exe
  C:\Windows\System\HMvGnun.exe
  2⤵
  PID:7064
- C:\Windows\System\uUbEGIw.exe
  C:\Windows\System\uUbEGIw.exe
  2⤵
  PID:7048
- C:\Windows\System\JJyBCCD.exe
  C:\Windows\System\JJyBCCD.exe
  2⤵
  PID:7152
- C:\Windows\System\SMQsGYT.exe
  C:\Windows\System\SMQsGYT.exe
  2⤵
  PID:6360
- C:\Windows\System\VAZYWfc.exe
  C:\Windows\System\VAZYWfc.exe
  2⤵
  PID:6664
- C:\Windows\System\pFjhINt.exe
  C:\Windows\System\pFjhINt.exe
  2⤵
  PID:6936
- C:\Windows\System\vXerbZh.exe
  C:\Windows\System\vXerbZh.exe
  2⤵
  PID:6348
- C:\Windows\System\oqFCsoo.exe
  C:\Windows\System\oqFCsoo.exe
  2⤵
  PID:7176
- C:\Windows\System\HzOUneH.exe
  C:\Windows\System\HzOUneH.exe
  2⤵
  PID:7204
- C:\Windows\System\ltYuWQj.exe
  C:\Windows\System\ltYuWQj.exe
  2⤵
  PID:7244
- C:\Windows\System\KRXIHuX.exe
  C:\Windows\System\KRXIHuX.exe
  2⤵
  PID:7264
- C:\Windows\System\vwCjkNL.exe
  C:\Windows\System\vwCjkNL.exe
  2⤵
  PID:7296
- C:\Windows\System\EKscVFF.exe
  C:\Windows\System\EKscVFF.exe
  2⤵
  PID:7320
- C:\Windows\System\vxPRhkS.exe
  C:\Windows\System\vxPRhkS.exe
  2⤵
  PID:7356
- C:\Windows\System\ywEzzxk.exe
  C:\Windows\System\ywEzzxk.exe
  2⤵
  PID:7376
- C:\Windows\System\LJdnJRH.exe
  C:\Windows\System\LJdnJRH.exe
  2⤵
  PID:7400
- C:\Windows\System\jQvzMRE.exe
  C:\Windows\System\jQvzMRE.exe
  2⤵
  PID:7420
- C:\Windows\System\GsFQIDr.exe
  C:\Windows\System\GsFQIDr.exe
  2⤵
  PID:7464
- C:\Windows\System\dHrFKfJ.exe
  C:\Windows\System\dHrFKfJ.exe
  2⤵
  PID:7484
- C:\Windows\System\UqmVraZ.exe
  C:\Windows\System\UqmVraZ.exe
  2⤵
  PID:7504
- C:\Windows\System\RLIMQjy.exe
  C:\Windows\System\RLIMQjy.exe
  2⤵
  PID:7532
- C:\Windows\System\HTwxXGr.exe
  C:\Windows\System\HTwxXGr.exe
  2⤵
  PID:7604
- C:\Windows\System\HlLNckn.exe
  C:\Windows\System\HlLNckn.exe
  2⤵
  PID:7632
- C:\Windows\System\jJufxCY.exe
  C:\Windows\System\jJufxCY.exe
  2⤵
  PID:7652
- C:\Windows\System\vUaVoKU.exe
  C:\Windows\System\vUaVoKU.exe
  2⤵
  PID:7672
- C:\Windows\System\GiOqAIT.exe
  C:\Windows\System\GiOqAIT.exe
  2⤵
  PID:7708
- C:\Windows\System\bYBiCpB.exe
  C:\Windows\System\bYBiCpB.exe
  2⤵
  PID:7732
- C:\Windows\System\tFTkipc.exe
  C:\Windows\System\tFTkipc.exe
  2⤵
  PID:7756
- C:\Windows\System\cwieEyo.exe
  C:\Windows\System\cwieEyo.exe
  2⤵
  PID:7780
- C:\Windows\System\SyitEQw.exe
  C:\Windows\System\SyitEQw.exe
  2⤵
  PID:7824
- C:\Windows\System\KKKfVVg.exe
  C:\Windows\System\KKKfVVg.exe
  2⤵
  PID:7848
- C:\Windows\System\VpqAPBW.exe
  C:\Windows\System\VpqAPBW.exe
  2⤵
  PID:7872
- C:\Windows\System\Akbebqg.exe
  C:\Windows\System\Akbebqg.exe
  2⤵
  PID:7896
- C:\Windows\System\pjEuhGi.exe
  C:\Windows\System\pjEuhGi.exe
  2⤵
  PID:7916
- C:\Windows\System\evJIdvr.exe
  C:\Windows\System\evJIdvr.exe
  2⤵
  PID:7964
- C:\Windows\System\VVEUCLs.exe
  C:\Windows\System\VVEUCLs.exe
  2⤵
  PID:7984
- C:\Windows\System\nrqeTVg.exe
  C:\Windows\System\nrqeTVg.exe
  2⤵
  PID:8028
- C:\Windows\System\aBApPQZ.exe
  C:\Windows\System\aBApPQZ.exe
  2⤵
  PID:8056
- C:\Windows\System\PvYUusq.exe
  C:\Windows\System\PvYUusq.exe
  2⤵
  PID:8084
- C:\Windows\System\Qtiqjup.exe
  C:\Windows\System\Qtiqjup.exe
  2⤵
  PID:8104
- C:\Windows\System\tOSdGoS.exe
  C:\Windows\System\tOSdGoS.exe
  2⤵
  PID:8144
- C:\Windows\System\FCqvoyD.exe
  C:\Windows\System\FCqvoyD.exe
  2⤵
  PID:8172
- C:\Windows\System\rjrvqOa.exe
  C:\Windows\System\rjrvqOa.exe
  2⤵
  PID:6952
- C:\Windows\System\XMXViKW.exe
  C:\Windows\System\XMXViKW.exe
  2⤵
  PID:7172
- C:\Windows\System\PEZhFYZ.exe
  C:\Windows\System\PEZhFYZ.exe
  2⤵
  PID:7232
- C:\Windows\System\hgjoJKu.exe
  C:\Windows\System\hgjoJKu.exe
  2⤵
  PID:7288
- C:\Windows\System\yCCewPw.exe
  C:\Windows\System\yCCewPw.exe
  2⤵
  PID:7348
- C:\Windows\System\fjTbIJr.exe
  C:\Windows\System\fjTbIJr.exe
  2⤵
  PID:7480
- C:\Windows\System\cWuqQaG.exe
  C:\Windows\System\cWuqQaG.exe
  2⤵
  PID:7520
- C:\Windows\System\yHskJtW.exe
  C:\Windows\System\yHskJtW.exe
  2⤵
  PID:7612
- C:\Windows\System\mWJGEQb.exe
  C:\Windows\System\mWJGEQb.exe
  2⤵
  PID:7684
- C:\Windows\System\DUAxmJq.exe
  C:\Windows\System\DUAxmJq.exe
  2⤵
  PID:7724
- C:\Windows\System\dZkUPog.exe
  C:\Windows\System\dZkUPog.exe
  2⤵
  PID:7796
- C:\Windows\System\autpDzD.exe
  C:\Windows\System\autpDzD.exe
  2⤵
  PID:7860
- C:\Windows\System\CoSEjts.exe
  C:\Windows\System\CoSEjts.exe
  2⤵
  PID:7944
- C:\Windows\System\oQNBSrc.exe
  C:\Windows\System\oQNBSrc.exe
  2⤵
  PID:7976
- C:\Windows\System\CgntgBy.exe
  C:\Windows\System\CgntgBy.exe
  2⤵
  PID:8024
- C:\Windows\System\cvRzJdZ.exe
  C:\Windows\System\cvRzJdZ.exe
  2⤵
  PID:8100
- C:\Windows\System\opQLZdR.exe
  C:\Windows\System\opQLZdR.exe
  2⤵
  PID:8164
- C:\Windows\System\QJGEVQK.exe
  C:\Windows\System\QJGEVQK.exe
  2⤵
  PID:8188
- C:\Windows\System\wKGPlwq.exe
  C:\Windows\System\wKGPlwq.exe
  2⤵
  PID:3076
- C:\Windows\System\RymVlRn.exe
  C:\Windows\System\RymVlRn.exe
  2⤵
  PID:7316
- C:\Windows\System\XHvIsKa.exe
  C:\Windows\System\XHvIsKa.exe
  2⤵
  PID:7432
- C:\Windows\System\tWAqmAj.exe
  C:\Windows\System\tWAqmAj.exe
  2⤵
  PID:7668
- C:\Windows\System\OLEeKKP.exe
  C:\Windows\System\OLEeKKP.exe
  2⤵
  PID:7328
- C:\Windows\System\VCwZGvk.exe
  C:\Windows\System\VCwZGvk.exe
  2⤵
  PID:7956
- C:\Windows\System\jZCgbnD.exe
  C:\Windows\System\jZCgbnD.exe
  2⤵
  PID:6268
- C:\Windows\System\ddwOuoZ.exe
  C:\Windows\System\ddwOuoZ.exe
  2⤵
  PID:3592
- C:\Windows\System\cjgrbgH.exe
  C:\Windows\System\cjgrbgH.exe
  2⤵
  PID:7640
- C:\Windows\System\drSlIDz.exe
  C:\Windows\System\drSlIDz.exe
  2⤵
  PID:7884
- C:\Windows\System\bdoIJXz.exe
  C:\Windows\System\bdoIJXz.exe
  2⤵
  PID:6896
- C:\Windows\System\HguRKzm.exe
  C:\Windows\System\HguRKzm.exe
  2⤵
  PID:7304
- C:\Windows\System\taPWGOR.exe
  C:\Windows\System\taPWGOR.exe
  2⤵
  PID:8200
- C:\Windows\System\NtZSjpK.exe
  C:\Windows\System\NtZSjpK.exe
  2⤵
  PID:8224
- C:\Windows\System\FlrCqap.exe
  C:\Windows\System\FlrCqap.exe
  2⤵
  PID:8248
- C:\Windows\System\PoemWEN.exe
  C:\Windows\System\PoemWEN.exe
  2⤵
  PID:8272
- C:\Windows\System\bRORvCH.exe
  C:\Windows\System\bRORvCH.exe
  2⤵
  PID:8300
- C:\Windows\System\HkjSenw.exe
  C:\Windows\System\HkjSenw.exe
  2⤵
  PID:8324
- C:\Windows\System\mTyOSvk.exe
  C:\Windows\System\mTyOSvk.exe
  2⤵
  PID:8360
- C:\Windows\System\YWebpsD.exe
  C:\Windows\System\YWebpsD.exe
  2⤵
  PID:8396
- C:\Windows\System\IcNXddl.exe
  C:\Windows\System\IcNXddl.exe
  2⤵
  PID:8436
- C:\Windows\System\JAhZZvk.exe
  C:\Windows\System\JAhZZvk.exe
  2⤵
  PID:8460
- C:\Windows\System\QbYAtnu.exe
  C:\Windows\System\QbYAtnu.exe
  2⤵
  PID:8556
- C:\Windows\System\MjyFwok.exe
  C:\Windows\System\MjyFwok.exe
  2⤵
  PID:8596
- C:\Windows\System\ihcZDjH.exe
  C:\Windows\System\ihcZDjH.exe
  2⤵
  PID:8616
- C:\Windows\System\RWmRYQS.exe
  C:\Windows\System\RWmRYQS.exe
  2⤵
  PID:8636
- C:\Windows\System\OqpkXox.exe
  C:\Windows\System\OqpkXox.exe
  2⤵
  PID:8656
- C:\Windows\System\vZkTgEW.exe
  C:\Windows\System\vZkTgEW.exe
  2⤵
  PID:8700
- C:\Windows\System\MwvSsxX.exe
  C:\Windows\System\MwvSsxX.exe
  2⤵
  PID:8748
- C:\Windows\System\FQmjxZV.exe
  C:\Windows\System\FQmjxZV.exe
  2⤵
  PID:8788
- C:\Windows\System\omtpzag.exe
  C:\Windows\System\omtpzag.exe
  2⤵
  PID:8808
- C:\Windows\System\LDRtvHI.exe
  C:\Windows\System\LDRtvHI.exe
  2⤵
  PID:8836
- C:\Windows\System\gJcvGvG.exe
  C:\Windows\System\gJcvGvG.exe
  2⤵
  PID:8864
- C:\Windows\System\aKNYtdR.exe
  C:\Windows\System\aKNYtdR.exe
  2⤵
  PID:8892
- C:\Windows\System\SFFkxiW.exe
  C:\Windows\System\SFFkxiW.exe
  2⤵
  PID:8920
- C:\Windows\System\UTcFNBo.exe
  C:\Windows\System\UTcFNBo.exe
  2⤵
  PID:8968
- C:\Windows\System\ncnmsoH.exe
  C:\Windows\System\ncnmsoH.exe
  2⤵
  PID:8984
- C:\Windows\System\zAmiBBM.exe
  C:\Windows\System\zAmiBBM.exe
  2⤵
  PID:9004
- C:\Windows\System\cbbwXhX.exe
  C:\Windows\System\cbbwXhX.exe
  2⤵
  PID:9056
- C:\Windows\System\MLLYEum.exe
  C:\Windows\System\MLLYEum.exe
  2⤵
  PID:9080
- C:\Windows\System\TnUIahk.exe
  C:\Windows\System\TnUIahk.exe
  2⤵
  PID:9108
- C:\Windows\System\mcwCEom.exe
  C:\Windows\System\mcwCEom.exe
  2⤵
  PID:9136
- C:\Windows\System\ttwhcLH.exe
  C:\Windows\System\ttwhcLH.exe
  2⤵
  PID:9156
- C:\Windows\System\LkGXVKK.exe
  C:\Windows\System\LkGXVKK.exe
  2⤵
  PID:9196
- C:\Windows\System\NfNnEfq.exe
  C:\Windows\System\NfNnEfq.exe
  2⤵
  PID:8220
- C:\Windows\System\JYbiPay.exe
  C:\Windows\System\JYbiPay.exe
  2⤵
  PID:8264
- C:\Windows\System\wRCRsqA.exe
  C:\Windows\System\wRCRsqA.exe
  2⤵
  PID:8316
- C:\Windows\System\RkpcDVd.exe
  C:\Windows\System\RkpcDVd.exe
  2⤵
  PID:8412
- C:\Windows\System\dWZSalR.exe
  C:\Windows\System\dWZSalR.exe
  2⤵
  PID:5816
- C:\Windows\System\XGzTssV.exe
  C:\Windows\System\XGzTssV.exe
  2⤵
  PID:8420
- C:\Windows\System\SDzzEEM.exe
  C:\Windows\System\SDzzEEM.exe
  2⤵
  PID:8512
- C:\Windows\System\WqcLXPA.exe
  C:\Windows\System\WqcLXPA.exe
  2⤵
  PID:8500
- C:\Windows\System\nXCCWgT.exe
  C:\Windows\System\nXCCWgT.exe
  2⤵
  PID:8468
- C:\Windows\System\kLCSSKx.exe
  C:\Windows\System\kLCSSKx.exe
  2⤵
  PID:8648
- C:\Windows\System\kTkmIrz.exe
  C:\Windows\System\kTkmIrz.exe
  2⤵
  PID:8608
- C:\Windows\System\siPbiiR.exe
  C:\Windows\System\siPbiiR.exe
  2⤵
  PID:8744
- C:\Windows\System\jVvjgSK.exe
  C:\Windows\System\jVvjgSK.exe
  2⤵
  PID:8816
- C:\Windows\System\rjaSObd.exe
  C:\Windows\System\rjaSObd.exe
  2⤵
  PID:8872
- C:\Windows\System\wBhutuo.exe
  C:\Windows\System\wBhutuo.exe
  2⤵
  PID:8960
- C:\Windows\System\IdgNpvS.exe
  C:\Windows\System\IdgNpvS.exe
  2⤵
  PID:9032
- C:\Windows\System\SCNxeDi.exe
  C:\Windows\System\SCNxeDi.exe
  2⤵
  PID:9048
- C:\Windows\System\UGQxcxX.exe
  C:\Windows\System\UGQxcxX.exe
  2⤵
  PID:9116
- C:\Windows\System\fKNllVt.exe
  C:\Windows\System\fKNllVt.exe
  2⤵
  PID:9152
- C:\Windows\System\NCuKdaY.exe
  C:\Windows\System\NCuKdaY.exe
  2⤵
  PID:9212
- C:\Windows\System\rXpQDLq.exe
  C:\Windows\System\rXpQDLq.exe
  2⤵
  PID:8452
- C:\Windows\System\zgOvwmK.exe
  C:\Windows\System\zgOvwmK.exe
  2⤵
  PID:8528
- C:\Windows\System\Indnuhs.exe
  C:\Windows\System\Indnuhs.exe
  2⤵
  PID:8540
- C:\Windows\System\tHbKoTG.exe
  C:\Windows\System\tHbKoTG.exe
  2⤵
  PID:8780
- C:\Windows\System\NHbfsSG.exe
  C:\Windows\System\NHbfsSG.exe
  2⤵
  PID:8904
- C:\Windows\System\yWwhKrS.exe
  C:\Windows\System\yWwhKrS.exe
  2⤵
  PID:9016
- C:\Windows\System\QdPiaPq.exe
  C:\Windows\System\QdPiaPq.exe
  2⤵
  PID:9128
- C:\Windows\System\kQpMCJU.exe
  C:\Windows\System\kQpMCJU.exe
  2⤵
  PID:9208
- C:\Windows\System\FEWPwyM.exe
  C:\Windows\System\FEWPwyM.exe
  2⤵
  PID:8492
- C:\Windows\System\RvFkypr.exe
  C:\Windows\System\RvFkypr.exe
  2⤵
  PID:9100
- C:\Windows\System\rXZyrDe.exe
  C:\Windows\System\rXZyrDe.exe
  2⤵
  PID:8532
- C:\Windows\System\aUwMNsf.exe
  C:\Windows\System\aUwMNsf.exe
  2⤵
  PID:9000
- C:\Windows\System\umKbjVv.exe
  C:\Windows\System\umKbjVv.exe
  2⤵
  PID:9228
- C:\Windows\System\GBVyonS.exe
  C:\Windows\System\GBVyonS.exe
  2⤵
  PID:9248
- C:\Windows\System\bCzbipt.exe
  C:\Windows\System\bCzbipt.exe
  2⤵
  PID:9288
- C:\Windows\System\gQtcbwj.exe
  C:\Windows\System\gQtcbwj.exe
  2⤵
  PID:9308
- C:\Windows\System\ojQRcHx.exe
  C:\Windows\System\ojQRcHx.exe
  2⤵
  PID:9336
- C:\Windows\System\LpPgoxc.exe
  C:\Windows\System\LpPgoxc.exe
  2⤵
  PID:9356
- C:\Windows\System\mhflnSR.exe
  C:\Windows\System\mhflnSR.exe
  2⤵
  PID:9408
- C:\Windows\System\FzHWLOW.exe
  C:\Windows\System\FzHWLOW.exe
  2⤵
  PID:9432
- C:\Windows\System\HOnYcZc.exe
  C:\Windows\System\HOnYcZc.exe
  2⤵
  PID:9456
- C:\Windows\System\jEhXutd.exe
  C:\Windows\System\jEhXutd.exe
  2⤵
  PID:9492
- C:\Windows\System\alJEVHC.exe
  C:\Windows\System\alJEVHC.exe
  2⤵
  PID:9516
- C:\Windows\System\tqhBKPw.exe
  C:\Windows\System\tqhBKPw.exe
  2⤵
  PID:9552
- C:\Windows\System\YnKGxXc.exe
  C:\Windows\System\YnKGxXc.exe
  2⤵
  PID:9576
- C:\Windows\System\mfBLAhv.exe
  C:\Windows\System\mfBLAhv.exe
  2⤵
  PID:9596
- C:\Windows\System\rLlHyGY.exe
  C:\Windows\System\rLlHyGY.exe
  2⤵
  PID:9620
- C:\Windows\System\qCCohys.exe
  C:\Windows\System\qCCohys.exe
  2⤵
  PID:9640
- C:\Windows\System\iwtKUTQ.exe
  C:\Windows\System\iwtKUTQ.exe
  2⤵
  PID:9668
- C:\Windows\System\WVwrefk.exe
  C:\Windows\System\WVwrefk.exe
  2⤵
  PID:9696
- C:\Windows\System\whmHSep.exe
  C:\Windows\System\whmHSep.exe
  2⤵
  PID:9748
- C:\Windows\System\OfFXvac.exe
  C:\Windows\System\OfFXvac.exe
  2⤵
  PID:9772
- C:\Windows\System\duJhoqA.exe
  C:\Windows\System\duJhoqA.exe
  2⤵
  PID:9812
- C:\Windows\System\KOYRDWZ.exe
  C:\Windows\System\KOYRDWZ.exe
  2⤵
  PID:9836
- C:\Windows\System\pSilFPQ.exe
  C:\Windows\System\pSilFPQ.exe
  2⤵
  PID:9860
- C:\Windows\System\arLUuEA.exe
  C:\Windows\System\arLUuEA.exe
  2⤵
  PID:9884
- C:\Windows\System\BhIhqBi.exe
  C:\Windows\System\BhIhqBi.exe
  2⤵
  PID:9904
- C:\Windows\System\aMvjdGE.exe
  C:\Windows\System\aMvjdGE.exe
  2⤵
  PID:9944
- C:\Windows\System\RwLOODJ.exe
  C:\Windows\System\RwLOODJ.exe
  2⤵
  PID:9976
- C:\Windows\System\ZZUUZtZ.exe
  C:\Windows\System\ZZUUZtZ.exe
  2⤵
  PID:9996
- C:\Windows\System\pmtlhCR.exe
  C:\Windows\System\pmtlhCR.exe
  2⤵
  PID:10032
- C:\Windows\System\OMWujPu.exe
  C:\Windows\System\OMWujPu.exe
  2⤵
  PID:10052
- C:\Windows\System\BjqXufg.exe
  C:\Windows\System\BjqXufg.exe
  2⤵
  PID:10092
- C:\Windows\System\JZuOBNK.exe
  C:\Windows\System\JZuOBNK.exe
  2⤵
  PID:10116
- C:\Windows\System\MyYPnaU.exe
  C:\Windows\System\MyYPnaU.exe
  2⤵
  PID:10148
- C:\Windows\System\HsGgBGG.exe
  C:\Windows\System\HsGgBGG.exe
  2⤵
  PID:10164
- C:\Windows\System\wIPJvNS.exe
  C:\Windows\System\wIPJvNS.exe
  2⤵
  PID:10180
- C:\Windows\System\VXhnQhS.exe
  C:\Windows\System\VXhnQhS.exe
  2⤵
  PID:10232
- C:\Windows\System\NzLSnrW.exe
  C:\Windows\System\NzLSnrW.exe
  2⤵
  PID:9220
- C:\Windows\System\YtLFBZz.exe
  C:\Windows\System\YtLFBZz.exe
  2⤵
  PID:8940
- C:\Windows\System\AqbYLaB.exe
  C:\Windows\System\AqbYLaB.exe
  2⤵
  PID:9344
- C:\Windows\System\ptqYwhR.exe
  C:\Windows\System\ptqYwhR.exe
  2⤵
  PID:9416
- C:\Windows\System\TRXMWBd.exe
  C:\Windows\System\TRXMWBd.exe
  2⤵
  PID:9476
- C:\Windows\System\VqyTWAN.exe
  C:\Windows\System\VqyTWAN.exe
  2⤵
  PID:9504
- C:\Windows\System\CtDHRYW.exe
  C:\Windows\System\CtDHRYW.exe
  2⤵
  PID:9524
- C:\Windows\System\yLxuVAt.exe
  C:\Windows\System\yLxuVAt.exe
  2⤵
  PID:9632
- C:\Windows\System\GbBmIRD.exe
  C:\Windows\System\GbBmIRD.exe
  2⤵
  PID:9688
- C:\Windows\System\sUgBGqZ.exe
  C:\Windows\System\sUgBGqZ.exe
  2⤵
  PID:9744
- C:\Windows\System\MhzdcIm.exe
  C:\Windows\System\MhzdcIm.exe
  2⤵
  PID:9808
- C:\Windows\System\rmsonyX.exe
  C:\Windows\System\rmsonyX.exe
  2⤵
  PID:9892
- C:\Windows\System\tZXDiok.exe
  C:\Windows\System\tZXDiok.exe
  2⤵
  PID:9932
- C:\Windows\System\ipmUSpG.exe
  C:\Windows\System\ipmUSpG.exe
  2⤵
  PID:9992
- C:\Windows\System\ZcmSrtM.exe
  C:\Windows\System\ZcmSrtM.exe
  2⤵
  PID:10040
- C:\Windows\System\rSjoxir.exe
  C:\Windows\System\rSjoxir.exe
  2⤵
  PID:10136
- C:\Windows\System\LzQehKK.exe
  C:\Windows\System\LzQehKK.exe
  2⤵
  PID:10176
- C:\Windows\System\kzxYxrv.exe
  C:\Windows\System\kzxYxrv.exe
  2⤵
  PID:9396
- C:\Windows\System\rHJWzRq.exe
  C:\Windows\System\rHJWzRq.exe
  2⤵
  PID:9488
- C:\Windows\System\CpCgHmQ.exe
  C:\Windows\System\CpCgHmQ.exe
  2⤵
  PID:9724
- C:\Windows\System\YkKnPFH.exe
  C:\Windows\System\YkKnPFH.exe
  2⤵
  PID:9856
- C:\Windows\System\wuOaZYr.exe
  C:\Windows\System\wuOaZYr.exe
  2⤵
  PID:10088
- C:\Windows\System\BDpBzKD.exe
  C:\Windows\System\BDpBzKD.exe
  2⤵
  PID:10224
- C:\Windows\System\iHmWRzT.exe
  C:\Windows\System\iHmWRzT.exe
  2⤵
  PID:9348
- C:\Windows\System\QVaGlVR.exe
  C:\Windows\System\QVaGlVR.exe
  2⤵
  PID:10016
- C:\Windows\System\pjcRCyi.exe
  C:\Windows\System\pjcRCyi.exe
  2⤵
  PID:10012
- C:\Windows\System\OYZQwcW.exe
  C:\Windows\System\OYZQwcW.exe
  2⤵
  PID:10200
- C:\Windows\System\UhXEOhS.exe
  C:\Windows\System\UhXEOhS.exe
  2⤵
  PID:4044
- C:\Windows\System\jHFKlLH.exe
  C:\Windows\System\jHFKlLH.exe
  2⤵
  PID:10108
- C:\Windows\System\pvfbwue.exe
  C:\Windows\System\pvfbwue.exe
  2⤵
  PID:10264
- C:\Windows\System\ZojqQoT.exe
  C:\Windows\System\ZojqQoT.exe
  2⤵
  PID:10284
- C:\Windows\System\LaOHIFl.exe
  C:\Windows\System\LaOHIFl.exe
  2⤵
  PID:10308
- C:\Windows\System\WQYWEyE.exe
  C:\Windows\System\WQYWEyE.exe
  2⤵
  PID:10328
- C:\Windows\System\HKUlPJD.exe
  C:\Windows\System\HKUlPJD.exe
  2⤵
  PID:10360
- C:\Windows\System\NKyYlDa.exe
  C:\Windows\System\NKyYlDa.exe
  2⤵
  PID:10396
- C:\Windows\System\eFuGCwk.exe
  C:\Windows\System\eFuGCwk.exe
  2⤵
  PID:10420
- C:\Windows\System\noyjtUC.exe
  C:\Windows\System\noyjtUC.exe
  2⤵
  PID:10456
- C:\Windows\System\KGzAGXr.exe
  C:\Windows\System\KGzAGXr.exe
  2⤵
  PID:10476
- C:\Windows\System\goDrDao.exe
  C:\Windows\System\goDrDao.exe
  2⤵
  PID:10500
- C:\Windows\System\shedHjM.exe
  C:\Windows\System\shedHjM.exe
  2⤵
  PID:10528
- C:\Windows\System\kLXsgEP.exe
  C:\Windows\System\kLXsgEP.exe
  2⤵
  PID:10552
- C:\Windows\System\GldPVSH.exe
  C:\Windows\System\GldPVSH.exe
  2⤵
  PID:10584
- C:\Windows\System\ebpGoEQ.exe
  C:\Windows\System\ebpGoEQ.exe
  2⤵
  PID:10620
- C:\Windows\System\xlkAXOE.exe
  C:\Windows\System\xlkAXOE.exe
  2⤵
  PID:10644
- C:\Windows\System\jtPTzwv.exe
  C:\Windows\System\jtPTzwv.exe
  2⤵
  PID:10668
- C:\Windows\System\cRJzaPH.exe
  C:\Windows\System\cRJzaPH.exe
  2⤵
  PID:10688
- C:\Windows\System\gtYODOa.exe
  C:\Windows\System\gtYODOa.exe
  2⤵
  PID:10724
- C:\Windows\System\sOotDyZ.exe
  C:\Windows\System\sOotDyZ.exe
  2⤵
  PID:10748
- C:\Windows\System\EBtSmuz.exe
  C:\Windows\System\EBtSmuz.exe
  2⤵
  PID:10788
- C:\Windows\System\FsRQHRU.exe
  C:\Windows\System\FsRQHRU.exe
  2⤵
  PID:10808
- C:\Windows\System\BnGaQyq.exe
  C:\Windows\System\BnGaQyq.exe
  2⤵
  PID:10832
- C:\Windows\System\UjnOPyP.exe
  C:\Windows\System\UjnOPyP.exe
  2⤵
  PID:10856
- C:\Windows\System\sSRmeSm.exe
  C:\Windows\System\sSRmeSm.exe
  2⤵
  PID:10888
- C:\Windows\System\AAqzksY.exe
  C:\Windows\System\AAqzksY.exe
  2⤵
  PID:10928
- C:\Windows\System\WGbesjG.exe
  C:\Windows\System\WGbesjG.exe
  2⤵
  PID:10968
- C:\Windows\System\HVMQGat.exe
  C:\Windows\System\HVMQGat.exe
  2⤵
  PID:11004
- C:\Windows\System\tJlKTLH.exe
  C:\Windows\System\tJlKTLH.exe
  2⤵
  PID:11024
- C:\Windows\System\RBQEnlB.exe
  C:\Windows\System\RBQEnlB.exe
  2⤵
  PID:11048
- C:\Windows\System\SPHtzhW.exe
  C:\Windows\System\SPHtzhW.exe
  2⤵
  PID:11068
- C:\Windows\System\bySsPgZ.exe
  C:\Windows\System\bySsPgZ.exe
  2⤵
  PID:11100
- C:\Windows\System\PxDsEMO.exe
  C:\Windows\System\PxDsEMO.exe
  2⤵
  PID:11124
- C:\Windows\System\DwkjXIm.exe
  C:\Windows\System\DwkjXIm.exe
  2⤵
  PID:11168
- C:\Windows\System\IhInPbe.exe
  C:\Windows\System\IhInPbe.exe
  2⤵
  PID:11188
- C:\Windows\System\jZgGljy.exe
  C:\Windows\System\jZgGljy.exe
  2⤵
  PID:11236
- C:\Windows\System\mQlfLyj.exe
  C:\Windows\System\mQlfLyj.exe
  2⤵
  PID:11256
- C:\Windows\System\KJxAXib.exe
  C:\Windows\System\KJxAXib.exe
  2⤵
  PID:10256
- C:\Windows\System\PZhhvNz.exe
  C:\Windows\System\PZhhvNz.exe
  2⤵
  PID:10296
- C:\Windows\System\zGRkOur.exe
  C:\Windows\System\zGRkOur.exe
  2⤵
  PID:10372
- C:\Windows\System\aQdQQZv.exe
  C:\Windows\System\aQdQQZv.exe
  2⤵
  PID:10428
- C:\Windows\System\ewKBSDV.exe
  C:\Windows\System\ewKBSDV.exe
  2⤵
  PID:10496
- C:\Windows\System\gpoPXQf.exe
  C:\Windows\System\gpoPXQf.exe
  2⤵
  PID:10572
- C:\Windows\System\lMxsUOO.exe
  C:\Windows\System\lMxsUOO.exe
  2⤵
  PID:10632
- C:\Windows\System\PBBWYZO.exe
  C:\Windows\System\PBBWYZO.exe
  2⤵
  PID:10760
- C:\Windows\System\AaCfgwh.exe
  C:\Windows\System\AaCfgwh.exe
  2⤵
  PID:10744
- C:\Windows\System\qcDQJWw.exe
  C:\Windows\System\qcDQJWw.exe
  2⤵
  PID:10820
- C:\Windows\System\ypBliMW.exe
  C:\Windows\System\ypBliMW.exe
  2⤵
  PID:10848
- C:\Windows\System\glFMjlJ.exe
  C:\Windows\System\glFMjlJ.exe
  2⤵
  PID:10924
- C:\Windows\System\xSOCsDe.exe
  C:\Windows\System\xSOCsDe.exe
  2⤵
  PID:11108
- C:\Windows\System\rqYwWEe.exe
  C:\Windows\System\rqYwWEe.exe
  2⤵
  PID:11144
- C:\Windows\System\bJsutXK.exe
  C:\Windows\System\bJsutXK.exe
  2⤵
  PID:11224
- C:\Windows\System\dilLnSk.exe
  C:\Windows\System\dilLnSk.exe
  2⤵
  PID:2084
- C:\Windows\System\NkyGgGH.exe
  C:\Windows\System\NkyGgGH.exe
  2⤵
  PID:10408
- C:\Windows\System\YdcFkSB.exe
  C:\Windows\System\YdcFkSB.exe
  2⤵
  PID:10412
- C:\Windows\System\qdtsbvJ.exe
  C:\Windows\System\qdtsbvJ.exe
  2⤵
  PID:10592
- C:\Windows\System\GLRdkjz.exe
  C:\Windows\System\GLRdkjz.exe
  2⤵
  PID:10616
- C:\Windows\System\thPXwaC.exe
  C:\Windows\System\thPXwaC.exe
  2⤵
  PID:10796
- C:\Windows\System\WJwypIU.exe
  C:\Windows\System\WJwypIU.exe
  2⤵
  PID:10872
- C:\Windows\System\JmJQAaH.exe
  C:\Windows\System\JmJQAaH.exe
  2⤵
  PID:11012
- C:\Windows\System\ApBytxO.exe
  C:\Windows\System\ApBytxO.exe
  2⤵
  PID:11252
- C:\Windows\System\URgbrGA.exe
  C:\Windows\System\URgbrGA.exe
  2⤵
  PID:9440
- C:\Windows\System\iULyJCC.exe
  C:\Windows\System\iULyJCC.exe
  2⤵
  PID:11116
- C:\Windows\System\CcOCtBc.exe
  C:\Windows\System\CcOCtBc.exe
  2⤵
  PID:10340
- C:\Windows\System\kppHVUp.exe
  C:\Windows\System\kppHVUp.exe
  2⤵
  PID:11276
- C:\Windows\System\aAYnIzC.exe
  C:\Windows\System\aAYnIzC.exe
  2⤵
  PID:11320
- C:\Windows\System\vTMvoWp.exe
  C:\Windows\System\vTMvoWp.exe
  2⤵
  PID:11352
- C:\Windows\System\oUuywzx.exe
  C:\Windows\System\oUuywzx.exe
  2⤵
  PID:11372
- C:\Windows\System\HYqXFdf.exe
  C:\Windows\System\HYqXFdf.exe
  2⤵
  PID:11404
- C:\Windows\System\FFyMoxg.exe
  C:\Windows\System\FFyMoxg.exe
  2⤵
  PID:11444
- C:\Windows\System\RmQLiIc.exe
  C:\Windows\System\RmQLiIc.exe
  2⤵
  PID:11464
- C:\Windows\System\uJZtXUk.exe
  C:\Windows\System\uJZtXUk.exe
  2⤵
  PID:11496
- C:\Windows\System\SUqUTKn.exe
  C:\Windows\System\SUqUTKn.exe
  2⤵
  PID:11520
- C:\Windows\System\KAzeWrW.exe
  C:\Windows\System\KAzeWrW.exe
  2⤵
  PID:11540
- C:\Windows\System\SQxYiLZ.exe
  C:\Windows\System\SQxYiLZ.exe
  2⤵
  PID:11568
- C:\Windows\System\pnydUdu.exe
  C:\Windows\System\pnydUdu.exe
  2⤵
  PID:11596
- C:\Windows\System\KbrxGDZ.exe
  C:\Windows\System\KbrxGDZ.exe
  2⤵
  PID:11624
- C:\Windows\System\iQVpnZW.exe
  C:\Windows\System\iQVpnZW.exe
  2⤵
  PID:11644
- C:\Windows\System\PyHslPM.exe
  C:\Windows\System\PyHslPM.exe
  2⤵
  PID:11676
- C:\Windows\System\coEGLWH.exe
  C:\Windows\System\coEGLWH.exe
  2⤵
  PID:11704
- C:\Windows\System\XMiOTUy.exe
  C:\Windows\System\XMiOTUy.exe
  2⤵
  PID:11736
- C:\Windows\System\wUlIhfn.exe
  C:\Windows\System\wUlIhfn.exe
  2⤵
  PID:11764
- C:\Windows\System\AXKQcQV.exe
  C:\Windows\System\AXKQcQV.exe
  2⤵
  PID:11784
- C:\Windows\System\fteXGIm.exe
  C:\Windows\System\fteXGIm.exe
  2⤵
  PID:11812
- C:\Windows\System\JkLQPDD.exe
  C:\Windows\System\JkLQPDD.exe
  2⤵
  PID:11836
- C:\Windows\System\QTNRpEJ.exe
  C:\Windows\System\QTNRpEJ.exe
  2⤵
  PID:11864
- C:\Windows\System\SrUDLaR.exe
  C:\Windows\System\SrUDLaR.exe
  2⤵
  PID:11884
- C:\Windows\System\GxHJHPt.exe
  C:\Windows\System\GxHJHPt.exe
  2⤵
  PID:11928
- C:\Windows\System\ZNbJQWG.exe
  C:\Windows\System\ZNbJQWG.exe
  2⤵
  PID:11960
- C:\Windows\System\DGdsLvR.exe
  C:\Windows\System\DGdsLvR.exe
  2⤵
  PID:11992
- C:\Windows\System\GxTlPvx.exe
  C:\Windows\System\GxTlPvx.exe
  2⤵
  PID:12032
- C:\Windows\System\fhadCXp.exe
  C:\Windows\System\fhadCXp.exe
  2⤵
  PID:12056
- C:\Windows\System\uaLExud.exe
  C:\Windows\System\uaLExud.exe
  2⤵
  PID:12072
- C:\Windows\System\VbegxPO.exe
  C:\Windows\System\VbegxPO.exe
  2⤵
  PID:12092
- C:\Windows\System\Fzybbkh.exe
  C:\Windows\System\Fzybbkh.exe
  2⤵
  PID:12116
- C:\Windows\System\ddsTzpa.exe
  C:\Windows\System\ddsTzpa.exe
  2⤵
  PID:12136
- C:\Windows\System\eybcPky.exe
  C:\Windows\System\eybcPky.exe
  2⤵
  PID:12160
- C:\Windows\System\JzIZpjf.exe
  C:\Windows\System\JzIZpjf.exe
  2⤵
  PID:12200
- C:\Windows\System\nSVfukE.exe
  C:\Windows\System\nSVfukE.exe
  2⤵
  PID:12228
- C:\Windows\System\SDeRZxs.exe
  C:\Windows\System\SDeRZxs.exe
  2⤵
  PID:12256
- C:\Windows\System\ZjcQwqZ.exe
  C:\Windows\System\ZjcQwqZ.exe
  2⤵
  PID:12280
- C:\Windows\System\muHGHtu.exe
  C:\Windows\System\muHGHtu.exe
  2⤵
  PID:11272
- C:\Windows\System\grWWqhB.exe
  C:\Windows\System\grWWqhB.exe
  2⤵
  PID:11288
- C:\Windows\System\JMAyeul.exe
  C:\Windows\System\JMAyeul.exe
  2⤵
  PID:11360
- C:\Windows\System\ZEPbnpP.exe
  C:\Windows\System\ZEPbnpP.exe
  2⤵
  PID:11476
- C:\Windows\System\ydPHaTK.exe
  C:\Windows\System\ydPHaTK.exe
  2⤵
  PID:11564
- C:\Windows\System\xpcdgQo.exe
  C:\Windows\System\xpcdgQo.exe
  2⤵
  PID:11608
- C:\Windows\System\vvYGeaL.exe
  C:\Windows\System\vvYGeaL.exe
  2⤵
  PID:11660
- C:\Windows\System\RPgZIyB.exe
  C:\Windows\System\RPgZIyB.exe
  2⤵
  PID:11716
- C:\Windows\System\AyEWnxa.exe
  C:\Windows\System\AyEWnxa.exe
  2⤵
  PID:11748
- C:\Windows\System\pnarHeq.exe
  C:\Windows\System\pnarHeq.exe
  2⤵
  PID:11780
- C:\Windows\System\sFHMjxI.exe
  C:\Windows\System\sFHMjxI.exe
  2⤵
  PID:11920
- C:\Windows\System\WShyykF.exe
  C:\Windows\System\WShyykF.exe
  2⤵
  PID:11952
- C:\Windows\System\urJlanm.exe
  C:\Windows\System\urJlanm.exe
  2⤵
  PID:12012
- C:\Windows\System\MCDFzui.exe
  C:\Windows\System\MCDFzui.exe
  2⤵
  PID:12104
- C:\Windows\System\VPTMExR.exe
  C:\Windows\System\VPTMExR.exe
  2⤵
  PID:12188
- C:\Windows\System\AMcdAoy.exe
  C:\Windows\System\AMcdAoy.exe
  2⤵
  PID:12220
- C:\Windows\System\KJnKpAd.exe
  C:\Windows\System\KJnKpAd.exe
  2⤵
  PID:12264
- C:\Windows\System\SXWcBkQ.exe
  C:\Windows\System\SXWcBkQ.exe
  2⤵
  PID:11412
- C:\Windows\System\GdeLKwc.exe
  C:\Windows\System\GdeLKwc.exe
  2⤵
  PID:11456
- C:\Windows\System\XmZhKxO.exe
  C:\Windows\System\XmZhKxO.exe
  2⤵
  PID:11672
- C:\Windows\System\fzjUHSd.exe
  C:\Windows\System\fzjUHSd.exe
  2⤵
  PID:1380
- C:\Windows\System\uNrGdVW.exe
  C:\Windows\System\uNrGdVW.exe
  2⤵
  PID:1544
- C:\Windows\System\qPfSKGj.exe
  C:\Windows\System\qPfSKGj.exe
  2⤵
  PID:12004
- C:\Windows\System\WQPBQOR.exe
  C:\Windows\System\WQPBQOR.exe
  2⤵
  PID:12180
- C:\Windows\System\XEdYuhl.exe
  C:\Windows\System\XEdYuhl.exe
  2⤵
  PID:11396
- C:\Windows\System\IYUAFhi.exe
  C:\Windows\System\IYUAFhi.exe
  2⤵
  PID:11560
- C:\Windows\System\jTByhAl.exe
  C:\Windows\System\jTByhAl.exe
  2⤵
  PID:11880
- C:\Windows\System\EMGyexv.exe
  C:\Windows\System\EMGyexv.exe
  2⤵
  PID:12100
- C:\Windows\System\ghPQXMQ.exe
  C:\Windows\System\ghPQXMQ.exe
  2⤵
  PID:11508
- C:\Windows\System\dPuWVXk.exe
  C:\Windows\System\dPuWVXk.exe
  2⤵
  PID:12128
- C:\Windows\System\edxpkad.exe
  C:\Windows\System\edxpkad.exe
  2⤵
  PID:12304
- C:\Windows\System\IXnHYGf.exe
  C:\Windows\System\IXnHYGf.exe
  2⤵
  PID:12328
- C:\Windows\System\oRIcvdk.exe
  C:\Windows\System\oRIcvdk.exe
  2⤵
  PID:12344
- C:\Windows\System\PekbyPP.exe
  C:\Windows\System\PekbyPP.exe
  2⤵
  PID:12376
- C:\Windows\System\JBcWuMn.exe
  C:\Windows\System\JBcWuMn.exe
  2⤵
  PID:12412
- C:\Windows\System\sJqknPq.exe
  C:\Windows\System\sJqknPq.exe
  2⤵
  PID:12436
- C:\Windows\System\xhukKUh.exe
  C:\Windows\System\xhukKUh.exe
  2⤵
  PID:12464
- C:\Windows\System\nFczUwE.exe
  C:\Windows\System\nFczUwE.exe
  2⤵
  PID:12484
- C:\Windows\System\vQoCQXH.exe
  C:\Windows\System\vQoCQXH.exe
  2⤵
  PID:12508
- C:\Windows\System\VhRLPTp.exe
  C:\Windows\System\VhRLPTp.exe
  2⤵
  PID:12524
- C:\Windows\System\uMimkkH.exe
  C:\Windows\System\uMimkkH.exe
  2⤵
  PID:12592
- C:\Windows\System\RcfwHAV.exe
  C:\Windows\System\RcfwHAV.exe
  2⤵
  PID:12616
- C:\Windows\System\iVveNFc.exe
  C:\Windows\System\iVveNFc.exe
  2⤵
  PID:12636
- C:\Windows\System\ULmIhrv.exe
  C:\Windows\System\ULmIhrv.exe
  2⤵
  PID:12656
- C:\Windows\System\abPdFtY.exe
  C:\Windows\System\abPdFtY.exe
  2⤵
  PID:12680
- C:\Windows\System\PRlTcaC.exe
  C:\Windows\System\PRlTcaC.exe
  2⤵
  PID:12724
- C:\Windows\System\HjfxRWE.exe
  C:\Windows\System\HjfxRWE.exe
  2⤵
  PID:12752
- C:\Windows\System\LawCsRf.exe
  C:\Windows\System\LawCsRf.exe
  2⤵
  PID:12788
- C:\Windows\System\XfLxMyo.exe
  C:\Windows\System\XfLxMyo.exe
  2⤵
  PID:12808
- C:\Windows\System\isRkcox.exe
  C:\Windows\System\isRkcox.exe
  2⤵
  PID:3492
- C:\Windows\System\KXHtbug.exe
  C:\Windows\System\KXHtbug.exe
  2⤵
  PID:13092
- C:\Windows\System\yPxALWc.exe
  C:\Windows\System\yPxALWc.exe
  2⤵
  PID:13116
- C:\Windows\System\rjgsceJ.exe
  C:\Windows\System\rjgsceJ.exe
  2⤵
  PID:13136
- C:\Windows\System\yDTnuQr.exe
  C:\Windows\System\yDTnuQr.exe
  2⤵
  PID:13144
- C:\Windows\System\kMfikoe.exe
  C:\Windows\System\kMfikoe.exe
  2⤵
  PID:13152
- C:\Windows\System\NbmHhlu.exe
  C:\Windows\System\NbmHhlu.exe
  2⤵
  PID:13176
- C:\Windows\System\PmSgVIX.exe
  C:\Windows\System\PmSgVIX.exe
  2⤵
  PID:13188
- C:\Windows\System\UbCccaq.exe
  C:\Windows\System\UbCccaq.exe
  2⤵
  PID:13204
- C:\Windows\System\bJxpwDK.exe
  C:\Windows\System\bJxpwDK.exe
  2⤵
  PID:12676
- C:\Windows\System\MxrsVbf.exe
  C:\Windows\System\MxrsVbf.exe
  2⤵
  PID:12716
- C:\Windows\System\KeXqcNv.exe
  C:\Windows\System\KeXqcNv.exe
  2⤵
  PID:12744
- C:\Windows\System\TAdjLRo.exe
  C:\Windows\System\TAdjLRo.exe
  2⤵
  PID:12420
- C:\Windows\System\ZwpFeWB.exe
  C:\Windows\System\ZwpFeWB.exe
  2⤵
  PID:12800
- C:\Windows\System\YjIYaDg.exe
  C:\Windows\System\YjIYaDg.exe
  2⤵
  PID:12844
- C:\Windows\System\UFPeCEk.exe
  C:\Windows\System\UFPeCEk.exe
  2⤵
  PID:12868
- C:\Windows\System\WeWEfVb.exe
  C:\Windows\System\WeWEfVb.exe
  2⤵
  PID:12888
- C:\Windows\System\TJvVcUl.exe
  C:\Windows\System\TJvVcUl.exe
  2⤵
  PID:13056
- C:\Windows\System\HsFzIyS.exe
  C:\Windows\System\HsFzIyS.exe
  2⤵
  PID:13072
- C:\Windows\System\FptRjMu.exe
  C:\Windows\System\FptRjMu.exe
  2⤵
  PID:3516
- C:\Windows\System\fcqREgI.exe
  C:\Windows\System\fcqREgI.exe
  2⤵
  PID:13120
- C:\Windows\System\XEWmZTA.exe
  C:\Windows\System\XEWmZTA.exe
  2⤵
  PID:13140
- C:\Windows\System\tIkercA.exe
  C:\Windows\System\tIkercA.exe
  2⤵
  PID:13172
- C:\Windows\System\aCZHVAm.exe
  C:\Windows\System\aCZHVAm.exe
  2⤵
  PID:13200
- C:\Windows\System\hfsekxW.exe
  C:\Windows\System\hfsekxW.exe
  2⤵
  PID:13220
- C:\Windows\System\uixgedU.exe
  C:\Windows\System\uixgedU.exe
  2⤵
  PID:13244
- C:\Windows\System\VBmEPFi.exe
  C:\Windows\System\VBmEPFi.exe
  2⤵
  PID:13264
- C:\Windows\System\ZBWxDgU.exe
  C:\Windows\System\ZBWxDgU.exe
  2⤵
  PID:13276
- C:\Windows\System\UMYOYRz.exe
  C:\Windows\System\UMYOYRz.exe
  2⤵
  PID:13292
- C:\Windows\System\gRsFFRc.exe
  C:\Windows\System\gRsFFRc.exe
  2⤵
  PID:13304
- C:\Windows\System\chxszZj.exe
  C:\Windows\System\chxszZj.exe
  2⤵
  PID:12316
- C:\Windows\System\ppJMbwJ.exe
  C:\Windows\System\ppJMbwJ.exe
  2⤵
  PID:12404
- C:\Windows\System\BpsTTGa.exe
  C:\Windows\System\BpsTTGa.exe
  2⤵
  PID:12472
- C:\Windows\System\iaBWrGA.exe
  C:\Windows\System\iaBWrGA.exe
  2⤵
  PID:12476
- C:\Windows\System\AkbiHln.exe
  C:\Windows\System\AkbiHln.exe
  2⤵
  PID:12536
- C:\Windows\System\OjCSZdp.exe
  C:\Windows\System\OjCSZdp.exe
  2⤵
  PID:12500
- C:\Windows\System\xjoBZOl.exe
  C:\Windows\System\xjoBZOl.exe
  2⤵
  PID:12564
- C:\Windows\System\mpfsAPy.exe
  C:\Windows\System\mpfsAPy.exe
  2⤵
  PID:12628
- C:\Windows\System\xpBHMIp.exe
  C:\Windows\System\xpBHMIp.exe
  2⤵
  PID:12668
- C:\Windows\System\txfiFvt.exe
  C:\Windows\System\txfiFvt.exe
  2⤵
  PID:12772
- C:\Windows\System\IARTCge.exe
  C:\Windows\System\IARTCge.exe
  2⤵
  PID:12820
- C:\Windows\System\BWXCxau.exe
  C:\Windows\System\BWXCxau.exe
  2⤵
  PID:12860
- C:\Windows\System\XZHMbnc.exe
  C:\Windows\System\XZHMbnc.exe
  2⤵
  PID:3180
- C:\Windows\System\NamzGiV.exe
  C:\Windows\System\NamzGiV.exe
  2⤵
  PID:12932
- C:\Windows\System\ymwcvoE.exe
  C:\Windows\System\ymwcvoE.exe
  2⤵
  PID:12944
- C:\Windows\System\QfavtSV.exe
  C:\Windows\System\QfavtSV.exe
  2⤵
  PID:12980
- C:\Windows\System\YLwCttM.exe
  C:\Windows\System\YLwCttM.exe
  2⤵
  PID:13012
- C:\Windows\System\Mnlympj.exe
  C:\Windows\System\Mnlympj.exe
  2⤵
  PID:13032
- C:\Windows\System\TxXmGtR.exe
  C:\Windows\System\TxXmGtR.exe
  2⤵
  PID:13132
- C:\Windows\System\OzhIWJz.exe
  C:\Windows\System\OzhIWJz.exe
  2⤵
  PID:13212
- C:\Windows\System\FjfrUil.exe
  C:\Windows\System\FjfrUil.exe
  2⤵
  PID:3628
- C:\Windows\System\lNGKzly.exe
  C:\Windows\System\lNGKzly.exe
  2⤵
  PID:2628
- C:\Windows\System\gzXOSrq.exe
  C:\Windows\System\gzXOSrq.exe
  2⤵
  PID:716
- C:\Windows\System\rDQbAUr.exe
  C:\Windows\System\rDQbAUr.exe
  2⤵
  PID:12432
- C:\Windows\System\yGxAuhL.exe
  C:\Windows\System\yGxAuhL.exe
  2⤵
  PID:12584
- C:\Windows\System\VZNVWyI.exe
  C:\Windows\System\VZNVWyI.exe
  2⤵
  PID:12856
- C:\Windows\System\idkONvg.exe
  C:\Windows\System\idkONvg.exe
  2⤵
  PID:12928
- C:\Windows\System\ZmqbaUn.exe
  C:\Windows\System\ZmqbaUn.exe
  2⤵
  PID:12952
- C:\Windows\System\vWosxch.exe
  C:\Windows\System\vWosxch.exe
  2⤵
  PID:4844
- C:\Windows\System\PkqVigw.exe
  C:\Windows\System\PkqVigw.exe
  2⤵
  PID:13024
- C:\Windows\System\DiNTTIY.exe
  C:\Windows\System\DiNTTIY.exe
  2⤵
  PID:13168
- C:\Windows\System\pSlmdse.exe
  C:\Windows\System\pSlmdse.exe
  2⤵
  PID:5008
- C:\Windows\System\MIcEqJN.exe
  C:\Windows\System\MIcEqJN.exe
  2⤵
  PID:13196
- C:\Windows\System\qdsAowm.exe
  C:\Windows\System\qdsAowm.exe
  2⤵
  PID:1916
- C:\Windows\System\PoZsRLP.exe
  C:\Windows\System\PoZsRLP.exe
  2⤵
  PID:12896
- C:\Windows\System\bSlCXdi.exe
  C:\Windows\System\bSlCXdi.exe
  2⤵
  PID:5928
- C:\Windows\System\HqpOdJq.exe
  C:\Windows\System\HqpOdJq.exe
  2⤵
  PID:12372
- C:\Windows\System\NPRLBKO.exe
  C:\Windows\System\NPRLBKO.exe
  2⤵
  PID:4688
- C:\Windows\System\ykdjMUY.exe
  C:\Windows\System\ykdjMUY.exe
  2⤵
  PID:12912
- C:\Windows\System\Gtbjntq.exe
  C:\Windows\System\Gtbjntq.exe
  2⤵
  PID:1796
- C:\Windows\System\DMXYnnT.exe
  C:\Windows\System\DMXYnnT.exe
  2⤵
  PID:1836
- C:\Windows\System\XeGjpYW.exe
  C:\Windows\System\XeGjpYW.exe
  2⤵
  PID:2280
- C:\Windows\System\MbpSDIg.exe
  C:\Windows\System\MbpSDIg.exe
  2⤵
  PID:2480
- C:\Windows\System\fkTHObd.exe
  C:\Windows\System\fkTHObd.exe
  2⤵
  PID:12964
- C:\Windows\System\HmKCjdQ.exe
  C:\Windows\System\HmKCjdQ.exe
  2⤵
  PID:2836
- C:\Windows\System\LpABDZo.exe
  C:\Windows\System\LpABDZo.exe
  2⤵
  PID:5364
- C:\Windows\System\apaCVdy.exe
  C:\Windows\System\apaCVdy.exe
  2⤵
  PID:13180
- C:\Windows\System\ZEpdyvF.exe
  C:\Windows\System\ZEpdyvF.exe
  2⤵
  PID:12784
- C:\Windows\System\acrCoEd.exe
  C:\Windows\System\acrCoEd.exe
  2⤵
  PID:3944
- C:\Windows\System\IjGSrtC.exe
  C:\Windows\System\IjGSrtC.exe
  2⤵
  PID:2544
- C:\Windows\System\OaiLeMw.exe
  C:\Windows\System\OaiLeMw.exe
  2⤵
  PID:12368
- C:\Windows\System\hQvdSmi.exe
  C:\Windows\System\hQvdSmi.exe
  2⤵
  PID:4280
- C:\Windows\System\rYkZRNp.exe
  C:\Windows\System\rYkZRNp.exe
  2⤵
  PID:4860
- C:\Windows\System\dHhArGS.exe
  C:\Windows\System\dHhArGS.exe
  2⤵
  PID:12924
- C:\Windows\System\rjSfVdl.exe
  C:\Windows\System\rjSfVdl.exe
  2⤵
  PID:3556
- C:\Windows\System\RwnRZEd.exe
  C:\Windows\System\RwnRZEd.exe
  2⤵
  PID:3036
- C:\Windows\System\eFWuTYk.exe
  C:\Windows\System\eFWuTYk.exe
  2⤵
  PID:5232
- C:\Windows\System\pIlLBZy.exe
  C:\Windows\System\pIlLBZy.exe
  2⤵
  PID:12336
- C:\Windows\System\ReNtHBD.exe
  C:\Windows\System\ReNtHBD.exe
  2⤵
  PID:1376
- C:\Windows\System\cmvCVQO.exe
  C:\Windows\System\cmvCVQO.exe
  2⤵
  PID:2020
- C:\Windows\System\vlAFLMI.exe
  C:\Windows\System\vlAFLMI.exe
  2⤵
  PID:13324
- C:\Windows\System\hiijgaL.exe
  C:\Windows\System\hiijgaL.exe
  2⤵
  PID:13340
- C:\Windows\System\OsZCAzM.exe
  C:\Windows\System\OsZCAzM.exe
  2⤵
  PID:13356
- C:\Windows\System\DAnGAGx.exe
  C:\Windows\System\DAnGAGx.exe
  2⤵
  PID:13372
- C:\Windows\System\bTSobaw.exe
  C:\Windows\System\bTSobaw.exe
  2⤵
  PID:13388
- C:\Windows\System\jFfvYEJ.exe
  C:\Windows\System\jFfvYEJ.exe
  2⤵
  PID:13404
- C:\Windows\System\USkNBdl.exe
  C:\Windows\System\USkNBdl.exe
  2⤵
  PID:13424
- C:\Windows\System\suOFAtw.exe
  C:\Windows\System\suOFAtw.exe
  2⤵
  PID:13512
- C:\Windows\System\nmoyBLT.exe
  C:\Windows\System\nmoyBLT.exe
  2⤵
  PID:13528
- C:\Windows\System\eCmNnkz.exe
  C:\Windows\System\eCmNnkz.exe
  2⤵
  PID:13544
- C:\Windows\System\kprlnfl.exe
  C:\Windows\System\kprlnfl.exe
  2⤵
  PID:13560
- C:\Windows\System\xYSpUYi.exe
  C:\Windows\System\xYSpUYi.exe
  2⤵
  PID:13580
- C:\Windows\System\MuiPehC.exe
  C:\Windows\System\MuiPehC.exe
  2⤵
  PID:13648
- C:\Windows\System\kHQRvxg.exe
  C:\Windows\System\kHQRvxg.exe
  2⤵
  PID:13672
- C:\Windows\System\TbdWNNU.exe
  C:\Windows\System\TbdWNNU.exe
  2⤵
  PID:13688
- C:\Windows\System\jUipwOc.exe
  C:\Windows\System\jUipwOc.exe
  2⤵
  PID:13704
- C:\Windows\System\iOmwCkW.exe
  C:\Windows\System\iOmwCkW.exe
  2⤵
  PID:13720
- C:\Windows\System\TwIxVoG.exe
  C:\Windows\System\TwIxVoG.exe
  2⤵
  PID:13736
- C:\Windows\System\kehQCTE.exe
  C:\Windows\System\kehQCTE.exe
  2⤵
  PID:13760
- C:\Windows\System\maYchrP.exe
  C:\Windows\System\maYchrP.exe
  2⤵
  PID:13808
- C:\Windows\System\gTrEyaZ.exe
  C:\Windows\System\gTrEyaZ.exe
  2⤵
  PID:13836
- C:\Windows\System\FiynIsF.exe
  C:\Windows\System\FiynIsF.exe
  2⤵
  PID:13908
- C:\Windows\System\GIHJSmG.exe
  C:\Windows\System\GIHJSmG.exe
  2⤵
  PID:13928
- C:\Windows\System\eMcZgmD.exe
  C:\Windows\System\eMcZgmD.exe
  2⤵
  PID:14004
- C:\Windows\System\MlgaMQI.exe
  C:\Windows\System\MlgaMQI.exe
  2⤵
  PID:14024
- C:\Windows\System\ibYDxQx.exe
  C:\Windows\System\ibYDxQx.exe
  2⤵
  PID:14040
- C:\Windows\System\ENQtUNd.exe
  C:\Windows\System\ENQtUNd.exe
  2⤵
  PID:14056
- C:\Windows\System\WnWhSTC.exe
  C:\Windows\System\WnWhSTC.exe
  2⤵
  PID:14072
- C:\Windows\System\eSCtjZP.exe
  C:\Windows\System\eSCtjZP.exe
  2⤵
  PID:14100
- C:\Windows\System\qRcFhOQ.exe
  C:\Windows\System\qRcFhOQ.exe
  2⤵
  PID:14124
- C:\Windows\System\hicfYTe.exe
  C:\Windows\System\hicfYTe.exe
  2⤵
  PID:14148
- C:\Windows\System\vbBwXUf.exe
  C:\Windows\System\vbBwXUf.exe
  2⤵
  PID:14168
- C:\Windows\System\xjznVMk.exe
  C:\Windows\System\xjznVMk.exe
  2⤵
  PID:14196
- C:\Windows\System\CVGRMhs.exe
  C:\Windows\System\CVGRMhs.exe
  2⤵
  PID:14212
- C:\Windows\System\kgQjWZp.exe
  C:\Windows\System\kgQjWZp.exe
  2⤵
  PID:14228
- C:\Windows\System\cYXVowg.exe
  C:\Windows\System\cYXVowg.exe
  2⤵
  PID:14260
- C:\Windows\System\EiCzpwx.exe
  C:\Windows\System\EiCzpwx.exe
  2⤵
  PID:14280
- C:\Windows\System\UNeeOFr.exe
  C:\Windows\System\UNeeOFr.exe
  2⤵
  PID:14300
- C:\Windows\System\nOahiwg.exe
  C:\Windows\System\nOahiwg.exe
  2⤵
  PID:14328
- C:\Windows\System\XLoxPix.exe
  C:\Windows\System\XLoxPix.exe
  2⤵
  PID:3956
- C:\Windows\System\LDQmJKV.exe
  C:\Windows\System\LDQmJKV.exe
  2⤵
  PID:7128
- C:\Windows\System\tWmCJnb.exe
  C:\Windows\System\tWmCJnb.exe
  2⤵
  PID:2520
- C:\Windows\System\JhqhDRZ.exe
  C:\Windows\System\JhqhDRZ.exe
  2⤵
  PID:6492
- C:\Windows\System\PsnfCsA.exe
  C:\Windows\System\PsnfCsA.exe
  2⤵
  PID:3100
- C:\Windows\System\FUUdkQk.exe
  C:\Windows\System\FUUdkQk.exe
  2⤵
  PID:6640
- C:\Windows\System\gadSntM.exe
  C:\Windows\System\gadSntM.exe
  2⤵
  PID:1268
- C:\Windows\System\tBgnqwz.exe
  C:\Windows\System\tBgnqwz.exe
  2⤵
  PID:6424
- C:\Windows\System\mlvYKoE.exe
  C:\Windows\System\mlvYKoE.exe
  2⤵
  PID:4728
- C:\Windows\System\SDWRkrD.exe
  C:\Windows\System\SDWRkrD.exe
  2⤵
  PID:13020
- C:\Windows\System\FmawSzl.exe
  C:\Windows\System\FmawSzl.exe
  2⤵
  PID:13412
- C:\Windows\System\zbdeGzu.exe
  C:\Windows\System\zbdeGzu.exe
  2⤵
  PID:1632
- C:\Windows\System\yGmEyZg.exe
  C:\Windows\System\yGmEyZg.exe
  2⤵
  PID:6904
- C:\Windows\System\MtXkSrR.exe
  C:\Windows\System\MtXkSrR.exe
  2⤵
  PID:2304
- C:\Windows\System\oLAmaBV.exe
  C:\Windows\System\oLAmaBV.exe
  2⤵
  PID:1028
- C:\Windows\System\ytUhFPs.exe
  C:\Windows\System\ytUhFPs.exe
  2⤵
  PID:13380
- C:\Windows\System\vQxOnqi.exe
  C:\Windows\System\vQxOnqi.exe
  2⤵
  PID:13472
- C:\Windows\System\odwIciQ.exe
  C:\Windows\System\odwIciQ.exe
  2⤵
  PID:13480
- C:\Windows\System\Dmbxjqn.exe
  C:\Windows\System\Dmbxjqn.exe
  2⤵
  PID:13332
- C:\Windows\System\TSfBAwa.exe
  C:\Windows\System\TSfBAwa.exe
  2⤵
  PID:4228
- C:\Windows\System\JtDKaxy.exe
  C:\Windows\System\JtDKaxy.exe
  2⤵
  PID:6352
- C:\Windows\System\NIjZsAU.exe
  C:\Windows\System\NIjZsAU.exe
  2⤵
  PID:6396
- C:\Windows\System\TSrHosp.exe
  C:\Windows\System\TSrHosp.exe
  2⤵
  PID:13592
- C:\Windows\System\XSZzJop.exe
  C:\Windows\System\XSZzJop.exe
  2⤵
  PID:13608
- C:\Windows\System\SOLiXpX.exe
  C:\Windows\System\SOLiXpX.exe
  2⤵
  PID:13436
- C:\Windows\System\FGoasWZ.exe
  C:\Windows\System\FGoasWZ.exe
  2⤵
  PID:13492
- C:\Windows\System\PNZHKXU.exe
  C:\Windows\System\PNZHKXU.exe
  2⤵
  PID:7224
- C:\Windows\System\gTvbWbc.exe
  C:\Windows\System\gTvbWbc.exe
  2⤵
  PID:13772
- C:\Windows\System\hwBCfKn.exe
  C:\Windows\System\hwBCfKn.exe
  2⤵
  PID:13804
- C:\Windows\System\AaWWwOn.exe
  C:\Windows\System\AaWWwOn.exe
  2⤵
  PID:13848
- C:\Windows\System\pVCTSZh.exe
  C:\Windows\System\pVCTSZh.exe
  2⤵
  PID:13536
- C:\Windows\System\ttXmcEp.exe
  C:\Windows\System\ttXmcEp.exe
  2⤵
  PID:13572
- C:\Windows\System\uZXabdm.exe
  C:\Windows\System\uZXabdm.exe
  2⤵
  PID:13616
- C:\Windows\System\NUaWpuH.exe
  C:\Windows\System\NUaWpuH.exe
  2⤵
  PID:13628
- C:\Windows\System\IeQqBDX.exe
  C:\Windows\System\IeQqBDX.exe
  2⤵
  PID:13768
- C:\Windows\System\LyAdDpv.exe
  C:\Windows\System\LyAdDpv.exe
  2⤵
  PID:13832
- C:\Windows\System\HhMNQlU.exe
  C:\Windows\System\HhMNQlU.exe
  2⤵
  PID:13680
- C:\Windows\System\dZmxnev.exe
  C:\Windows\System\dZmxnev.exe
  2⤵
  PID:7544
- C:\Windows\System\yFeVkwt.exe
  C:\Windows\System\yFeVkwt.exe
  2⤵
  PID:13728
- C:\Windows\System\fwQQxdk.exe
  C:\Windows\System\fwQQxdk.exe
  2⤵
  PID:1728
- C:\Windows\System\KNLEpFR.exe
  C:\Windows\System\KNLEpFR.exe
  2⤵
  PID:13816
- C:\Windows\System\hYnlHun.exe
  C:\Windows\System\hYnlHun.exe
  2⤵
  PID:7584
- C:\Windows\System\QvCVzuU.exe
  C:\Windows\System\QvCVzuU.exe
  2⤵
  PID:13880
- C:\Windows\System\eNjQHIX.exe
  C:\Windows\System\eNjQHIX.exe
  2⤵
  PID:7616
- C:\Windows\System\KfIIVdT.exe
  C:\Windows\System\KfIIVdT.exe
  2⤵
  PID:13980
- C:\Windows\System\bSEmiaw.exe
  C:\Windows\System\bSEmiaw.exe
  2⤵
  PID:3092
- C:\Windows\System\SlcCRJy.exe
  C:\Windows\System\SlcCRJy.exe
  2⤵
  PID:1412
- C:\Windows\System\KZWSbHB.exe
  C:\Windows\System\KZWSbHB.exe
  2⤵
  PID:7716
- C:\Windows\System\uisqDJn.exe
  C:\Windows\System\uisqDJn.exe
  2⤵
  PID:4372
- C:\Windows\System\jbmtqbG.exe
  C:\Windows\System\jbmtqbG.exe
  2⤵
  PID:13896
- C:\Windows\System\NnQUsrV.exe
  C:\Windows\System\NnQUsrV.exe
  2⤵
  PID:13916
- C:\Windows\System\QsitYdX.exe
  C:\Windows\System\QsitYdX.exe
  2⤵
  PID:14084
- C:\Windows\System\kdwNEdZ.exe
  C:\Windows\System\kdwNEdZ.exe
  2⤵
  PID:3912
- C:\Windows\System\HXPFcZw.exe
  C:\Windows\System\HXPFcZw.exe
  2⤵
  PID:14108
- C:\Windows\System\ypEKmoK.exe
  C:\Windows\System\ypEKmoK.exe
  2⤵
  PID:13964
- C:\Windows\System\yFweyqg.exe
  C:\Windows\System\yFweyqg.exe
  2⤵
  PID:14048
- C:\Windows\System\keVGpKS.exe
  C:\Windows\System\keVGpKS.exe
  2⤵
  PID:13992
- C:\Windows\System\znHOgSD.exe
  C:\Windows\System\znHOgSD.exe
  2⤵
  PID:1476
- C:\Windows\System\PGUTpKa.exe
  C:\Windows\System\PGUTpKa.exe
  2⤵
  PID:4348
- C:\Windows\System\gJxobAt.exe
  C:\Windows\System\gJxobAt.exe
  2⤵
  PID:14096
- C:\Windows\System\QHQmzIW.exe
  C:\Windows\System\QHQmzIW.exe
  2⤵
  PID:4748
- C:\Windows\System\eCIxwey.exe
  C:\Windows\System\eCIxwey.exe
  2⤵
  PID:14112
- C:\Windows\System\FNSsOrk.exe
  C:\Windows\System\FNSsOrk.exe
  2⤵
  PID:14136
- C:\Windows\System\mqHFSwX.exe
  C:\Windows\System\mqHFSwX.exe
  2⤵
  PID:14144
- C:\Windows\System\DQQSORL.exe
  C:\Windows\System\DQQSORL.exe
  2⤵
  PID:14132
- C:\Windows\System\EHJHIMs.exe
  C:\Windows\System\EHJHIMs.exe
  2⤵
  PID:1972
- C:\Windows\System\oraHKcp.exe
  C:\Windows\System\oraHKcp.exe
  2⤵
  PID:14188
- C:\Windows\System\RzrHBIp.exe
  C:\Windows\System\RzrHBIp.exe
  2⤵
  PID:14204
- C:\Windows\System\GeDqwet.exe
  C:\Windows\System\GeDqwet.exe
  2⤵
  PID:8116
- C:\Windows\System\iVLkikD.exe
  C:\Windows\System\iVLkikD.exe
  2⤵
  PID:8180
- C:\Windows\System\MuCWPjd.exe
  C:\Windows\System\MuCWPjd.exe
  2⤵
  PID:7412
- C:\Windows\System\RcXiBtL.exe
  C:\Windows\System\RcXiBtL.exe
  2⤵
  PID:14244
- C:\Windows\System\lCRWsHq.exe
  C:\Windows\System\lCRWsHq.exe
  2⤵
  PID:7448
- C:\Windows\System\JkrRqON.exe
  C:\Windows\System\JkrRqON.exe
  2⤵
  PID:3288
- C:\Windows\System\lAjhoJU.exe
  C:\Windows\System\lAjhoJU.exe
  2⤵
  PID:14240
- C:\Windows\System\fIyyuGo.exe
  C:\Windows\System\fIyyuGo.exe
  2⤵
  PID:7388
- C:\Windows\System\qCGJamI.exe
  C:\Windows\System\qCGJamI.exe
  2⤵
  PID:14268
- C:\Windows\System\fUitZRS.exe
  C:\Windows\System\fUitZRS.exe
  2⤵
  PID:7572
- C:\Windows\System\BiTfjLo.exe
  C:\Windows\System\BiTfjLo.exe
  2⤵
  PID:4552
- C:\Windows\System\rfwVIex.exe
  C:\Windows\System\rfwVIex.exe
  2⤵
  PID:7076
- C:\Windows\System\BPTcurp.exe
  C:\Windows\System\BPTcurp.exe
  2⤵
  PID:2216
- C:\Windows\System\hgRcOUZ.exe
  C:\Windows\System\hgRcOUZ.exe
  2⤵
  PID:2572
- C:\Windows\System\UuRtnjO.exe
  C:\Windows\System\UuRtnjO.exe
  2⤵
  PID:8168
- C:\Windows\System\nzyfEwu.exe
  C:\Windows\System\nzyfEwu.exe
  2⤵
  PID:4788
- C:\Windows\System\zYiueRw.exe
  C:\Windows\System\zYiueRw.exe
  2⤵
  PID:7576
- C:\Windows\System\aEvydAG.exe
  C:\Windows\System\aEvydAG.exe
  2⤵
  PID:8036
- C:\Windows\System\WgCcwJr.exe
  C:\Windows\System\WgCcwJr.exe
  2⤵
  PID:7952
- C:\Windows\System\LYsAjkU.exe
  C:\Windows\System\LYsAjkU.exe
  2⤵
  PID:8212
- C:\Windows\System\vavKqbH.exe
  C:\Windows\System\vavKqbH.exe
  2⤵
  PID:3460
- C:\Windows\System\jOwLksh.exe
  C:\Windows\System\jOwLksh.exe
  2⤵
  PID:1020
- C:\Windows\System\PhLffPK.exe
  C:\Windows\System\PhLffPK.exe
  2⤵
  PID:13232
- C:\Windows\System\PKegeNk.exe
  C:\Windows\System\PKegeNk.exe
  2⤵
  PID:1472
- C:\Windows\System\VWKVfqO.exe
  C:\Windows\System\VWKVfqO.exe
  2⤵
  PID:4872
- C:\Windows\System\PehgIrq.exe
  C:\Windows\System\PehgIrq.exe
  2⤵
  PID:4972
- C:\Windows\System\KtmETsn.exe
  C:\Windows\System\KtmETsn.exe
  2⤵
  PID:8256
- C:\Windows\System\ciOdiiz.exe
  C:\Windows\System\ciOdiiz.exe
  2⤵
  PID:8356
- C:\Windows\System\FQmyMrk.exe
  C:\Windows\System\FQmyMrk.exe
  2⤵
  PID:8564
- C:\Windows\System\IOpXTPt.exe
  C:\Windows\System\IOpXTPt.exe
  2⤵
  PID:8576
- C:\Windows\System\nYunsBA.exe
  C:\Windows\System\nYunsBA.exe
  2⤵
  PID:8724
- C:\Windows\System\SbuphgN.exe
  C:\Windows\System\SbuphgN.exe
  2⤵
  PID:8764
- C:\Windows\System\rTVnhNS.exe
  C:\Windows\System\rTVnhNS.exe
  2⤵
  PID:8736
- C:\Windows\System\MZauRrm.exe
  C:\Windows\System\MZauRrm.exe
  2⤵
  PID:8888
- C:\Windows\System\VSlxbJC.exe
  C:\Windows\System\VSlxbJC.exe
  2⤵
  PID:8936
- C:\Windows\System\uuaUEWE.exe
  C:\Windows\System\uuaUEWE.exe
  2⤵
  PID:8952
- C:\Windows\System\hVdMAcx.exe
  C:\Windows\System\hVdMAcx.exe
  2⤵
  PID:9024
- C:\Windows\System\MVQDPmz.exe
  C:\Windows\System\MVQDPmz.exe
  2⤵
  PID:9104
- C:\Windows\System\zQHEaLz.exe
  C:\Windows\System\zQHEaLz.exe
  2⤵
  PID:13448
- C:\Windows\System\Vkqgxal.exe
  C:\Windows\System\Vkqgxal.exe
  2⤵
  PID:13828
- C:\Windows\System\hKwfGWL.exe
  C:\Windows\System\hKwfGWL.exe
  2⤵
  PID:4264
- C:\Windows\System\MGBmXfg.exe
  C:\Windows\System\MGBmXfg.exe
  2⤵
  PID:2568
- C:\Windows\System\vMMZnPv.exe
  C:\Windows\System\vMMZnPv.exe
  2⤵
  PID:4524
- C:\Windows\System\BHYKvPF.exe
  C:\Windows\System\BHYKvPF.exe
  2⤵
  PID:6216
- C:\Windows\System\fGeAxlF.exe
  C:\Windows\System\fGeAxlF.exe
  2⤵
  PID:13352
- C:\Windows\System\KpWtXZn.exe
  C:\Windows\System\KpWtXZn.exe
  2⤵
  PID:9132
- C:\Windows\System\TMsfqZq.exe
  C:\Windows\System\TMsfqZq.exe
  2⤵
  PID:9164
- C:\Windows\System\EFtKpWV.exe
  C:\Windows\System\EFtKpWV.exe
  2⤵
  PID:9204
- C:\Windows\System\PxBcvjm.exe
  C:\Windows\System\PxBcvjm.exe
  2⤵
  PID:13100
- C:\Windows\System\vuPbFda.exe
  C:\Windows\System\vuPbFda.exe
  2⤵
  PID:6272
- C:\Windows\System\DURjFfo.exe
  C:\Windows\System\DURjFfo.exe
  2⤵
  PID:8376
- C:\Windows\System\SizYtNY.exe
  C:\Windows\System\SizYtNY.exe
  2⤵
  PID:4908
- C:\Windows\System\SGKoyRL.exe
  C:\Windows\System\SGKoyRL.exe
  2⤵
  PID:900
- C:\Windows\System\tHIqxtJ.exe
  C:\Windows\System\tHIqxtJ.exe
  2⤵
  PID:8384
- C:\Windows\System\DZaTDyM.exe
  C:\Windows\System\DZaTDyM.exe
  2⤵
  PID:5372
- C:\Windows\System\UCKyWdM.exe
  C:\Windows\System\UCKyWdM.exe
  2⤵
  PID:8536
- C:\Windows\System\zVByece.exe
  C:\Windows\System\zVByece.exe
  2⤵
  PID:8544
- C:\Windows\System\nDVCisQ.exe
  C:\Windows\System\nDVCisQ.exe
  2⤵
  PID:8624
- C:\Windows\System\rFrMwyx.exe
  C:\Windows\System\rFrMwyx.exe
  2⤵
  PID:548
- C:\Windows\System\iLvcLQz.exe
  C:\Windows\System\iLvcLQz.exe
  2⤵
  PID:13384
- C:\Windows\System\XpOfSOB.exe
  C:\Windows\System\XpOfSOB.exe
  2⤵
  PID:8756
- C:\Windows\System\dibAVLi.exe
  C:\Windows\System\dibAVLi.exe
  2⤵
  PID:1928
- C:\Windows\System\FCRymcM.exe
  C:\Windows\System\FCRymcM.exe
  2⤵
  PID:8992
- C:\Windows\System\IDBvApk.exe
  C:\Windows\System\IDBvApk.exe
  2⤵
  PID:3696
- C:\Windows\System\yRZsCte.exe
  C:\Windows\System\yRZsCte.exe
  2⤵
  PID:9076
- C:\Windows\System\gFaCgla.exe
  C:\Windows\System\gFaCgla.exe
  2⤵
  PID:4432
- C:\Windows\System\lxEitPF.exe
  C:\Windows\System\lxEitPF.exe
  2⤵
  PID:8308
- C:\Windows\System\bVAfVYI.exe
  C:\Windows\System\bVAfVYI.exe
  2⤵
  PID:6400
- C:\Windows\System\gOXUEsU.exe
  C:\Windows\System\gOXUEsU.exe
  2⤵
  PID:1524
- C:\Windows\System\MNddOfP.exe
  C:\Windows\System\MNddOfP.exe
  2⤵
  PID:6532
- C:\Windows\System\HDsKLGH.exe
  C:\Windows\System\HDsKLGH.exe
  2⤵
  PID:940
- C:\Windows\System\QpAzknq.exe
  C:\Windows\System\QpAzknq.exe
  2⤵
  PID:5152
- C:\Windows\System\rXGpDTt.exe
  C:\Windows\System\rXGpDTt.exe
  2⤵
  PID:13632
- C:\Windows\System\JdRIkzB.exe
  C:\Windows\System\JdRIkzB.exe
  2⤵
  PID:8680
- C:\Windows\System\CcfUDqy.exe
  C:\Windows\System\CcfUDqy.exe
  2⤵
  PID:5164
- C:\Windows\System\zesJaYj.exe
  C:\Windows\System\zesJaYj.exe
  2⤵
  PID:8712
- C:\Windows\System\PZjCafr.exe
  C:\Windows\System\PZjCafr.exe
  2⤵
  PID:13788
- C:\Windows\System\OIzcxQS.exe
  C:\Windows\System\OIzcxQS.exe
  2⤵
  PID:7308
- C:\Windows\System\mgiPIzZ.exe
  C:\Windows\System\mgiPIzZ.exe
  2⤵
  PID:8216
- C:\Windows\System\zxmDTeg.exe
  C:\Windows\System\zxmDTeg.exe
  2⤵
  PID:13552
- C:\Windows\System\XotIuhQ.exe
  C:\Windows\System\XotIuhQ.exe
  2⤵
  PID:13568
- C:\Windows\System\tJvmyPI.exe
  C:\Windows\System\tJvmyPI.exe
  2⤵
  PID:13596
- C:\Windows\System\phSWazQ.exe
  C:\Windows\System\phSWazQ.exe
  2⤵
  PID:5248
- C:\Windows\System\yXbjOOI.exe
  C:\Windows\System\yXbjOOI.exe
  2⤵
  PID:9388
- C:\Windows\System\mxZyQDS.exe
  C:\Windows\System\mxZyQDS.exe
  2⤵
  PID:13824
- C:\Windows\System\plxNKtt.exe
  C:\Windows\System\plxNKtt.exe
  2⤵
  PID:13684
- C:\Windows\System\mvAlxPF.exe
  C:\Windows\System\mvAlxPF.exe
  2⤵
  PID:5328
- C:\Windows\System\RJOCIES.exe
  C:\Windows\System\RJOCIES.exe
  2⤵
  PID:5332
- C:\Windows\System\HiGiume.exe
  C:\Windows\System\HiGiume.exe
  2⤵
  PID:9728
- C:\Windows\System\pYnARPz.exe
  C:\Windows\System\pYnARPz.exe
  2⤵
  PID:13280
- C:\Windows\System\ANjCSBl.exe
  C:\Windows\System\ANjCSBl.exe
  2⤵
  PID:7628
- C:\Windows\System\CpPfxIR.exe
  C:\Windows\System\CpPfxIR.exe
  2⤵
  PID:9780
- C:\Windows\System\fGqEHKJ.exe
  C:\Windows\System\fGqEHKJ.exe
  2⤵
  PID:13972
- C:\Windows\System\THldzlG.exe
  C:\Windows\System\THldzlG.exe
  2⤵
  PID:4880
- C:\Windows\System\xgDuiTS.exe
  C:\Windows\System\xgDuiTS.exe
  2⤵
  PID:9896
- C:\Windows\System\yDpfFpN.exe
  C:\Windows\System\yDpfFpN.exe
  2⤵
  PID:3060
- C:\Windows\System\xvZYNty.exe
  C:\Windows\System\xvZYNty.exe
  2⤵
  PID:10028
- C:\Windows\System\GbQhIba.exe
  C:\Windows\System\GbQhIba.exe
  2⤵
  PID:13872
- C:\Windows\System\cHFGYQy.exe
  C:\Windows\System\cHFGYQy.exe
  2⤵
  PID:10060
- C:\Windows\System\PaDTYlJ.exe
  C:\Windows\System\PaDTYlJ.exe
  2⤵
  PID:2704
- C:\Windows\System\MtktZKo.exe
  C:\Windows\System\MtktZKo.exe
  2⤵
  PID:5524
- C:\Windows\System\cFndwwO.exe
  C:\Windows\System\cFndwwO.exe
  2⤵
  PID:4368
- C:\Windows\System\wSLWlUD.exe
  C:\Windows\System\wSLWlUD.exe
  2⤵
  PID:8740
- C:\Windows\System\UfvdGdb.exe
  C:\Windows\System\UfvdGdb.exe
  2⤵
  PID:14068
- C:\Windows\System\pKDQCax.exe
  C:\Windows\System\pKDQCax.exe
  2⤵
  PID:7924
- C:\Windows\System\rLlIgHN.exe
  C:\Windows\System\rLlIgHN.exe
  2⤵
  PID:14012
- C:\Windows\System\IqBkHXO.exe
  C:\Windows\System\IqBkHXO.exe
  2⤵
  PID:3356
- C:\Windows\System\Cnddojh.exe
  C:\Windows\System\Cnddojh.exe
  2⤵
  PID:14156
- C:\Windows\System\vDMCBDf.exe
  C:\Windows\System\vDMCBDf.exe
  2⤵
  PID:5612
- C:\Windows\System\lWTWJzv.exe
  C:\Windows\System\lWTWJzv.exe
  2⤵
  PID:9756
- C:\Windows\System\mDWZFnY.exe
  C:\Windows\System\mDWZFnY.exe
  2⤵
  PID:9828
- C:\Windows\System\ZLtIxAV.exe
  C:\Windows\System\ZLtIxAV.exe
  2⤵
  PID:5684
- C:\Windows\System\gmNWVxo.exe
  C:\Windows\System\gmNWVxo.exe
  2⤵
  PID:14192
- C:\Windows\System\ZOOpmwd.exe
  C:\Windows\System\ZOOpmwd.exe
  2⤵
  PID:8112
- C:\Windows\System\EfkNjkI.exe
  C:\Windows\System\EfkNjkI.exe
  2⤵
  PID:8184
- C:\Windows\System\rsJJXUg.exe
  C:\Windows\System\rsJJXUg.exe
  2⤵
  PID:3856
- C:\Windows\System\pZUzFGY.exe
  C:\Windows\System\pZUzFGY.exe
  2⤵
  PID:7368
- C:\Windows\System\vuKCMfu.exe
  C:\Windows\System\vuKCMfu.exe
  2⤵
  PID:9604
- C:\Windows\System\IifDRef.exe
  C:\Windows\System\IifDRef.exe
  2⤵
  PID:9760
- C:\Windows\System\NvNxwjm.exe
  C:\Windows\System\NvNxwjm.exe
  2⤵
  PID:9968
- C:\Windows\System\ELchRwb.exe
  C:\Windows\System\ELchRwb.exe
  2⤵
  PID:5780
- C:\Windows\System\RawNRCz.exe
  C:\Windows\System\RawNRCz.exe
  2⤵
  PID:10196
- C:\Windows\System\ugQPMcE.exe
  C:\Windows\System\ugQPMcE.exe
  2⤵
  PID:9692
- C:\Windows\System\cWetMUQ.exe
  C:\Windows\System\cWetMUQ.exe
  2⤵
  PID:14296
- C:\Windows\System\QBgxAAF.exe
  C:\Windows\System\QBgxAAF.exe
  2⤵
  PID:8004
- C:\Windows\System\iJmmYsv.exe
  C:\Windows\System\iJmmYsv.exe
  2⤵
  PID:3756
- C:\Windows\System\EygxfPM.exe
  C:\Windows\System\EygxfPM.exe
  2⤵
  PID:5136
- C:\Windows\System\fDlyxDO.exe
  C:\Windows\System\fDlyxDO.exe
  2⤵
  PID:10132
- C:\Windows\System\hNDwFek.exe
  C:\Windows\System\hNDwFek.exe
  2⤵
  PID:10292
- C:\Windows\System\pZgjjFn.exe
  C:\Windows\System\pZgjjFn.exe
  2⤵
  PID:10352
- C:\Windows\System\ekevRcg.exe
  C:\Windows\System\ekevRcg.exe
  2⤵
  PID:10432
- C:\Windows\System\bYNPNcK.exe
  C:\Windows\System\bYNPNcK.exe
  2⤵
  PID:7260
- C:\Windows\System\Hqyfnug.exe
  C:\Windows\System\Hqyfnug.exe
  2⤵
  PID:14308
- C:\Windows\System\HGBNFGD.exe
  C:\Windows\System\HGBNFGD.exe
  2⤵
  PID:7500
- C:\Windows\System\bxfAyrM.exe
  C:\Windows\System\bxfAyrM.exe
  2⤵
  PID:4380
- C:\Windows\System\syDgohn.exe
  C:\Windows\System\syDgohn.exe
  2⤵
  PID:7840
- C:\Windows\System\OqYDvTn.exe
  C:\Windows\System\OqYDvTn.exe
  2⤵
  PID:3452
- C:\Windows\System\FPeWvRs.exe
  C:\Windows\System\FPeWvRs.exe
  2⤵
  PID:10520
- C:\Windows\System\ruASATn.exe
  C:\Windows\System\ruASATn.exe
  2⤵
  PID:10604
- C:\Windows\System\FGvalaz.exe
  C:\Windows\System\FGvalaz.exe
  2⤵
  PID:5852
- C:\Windows\System\SXAZFzx.exe
  C:\Windows\System\SXAZFzx.exe
  2⤵
  PID:5880
- C:\Windows\System\rLKNriO.exe
  C:\Windows\System\rLKNriO.exe
  2⤵
  PID:7720
- C:\Windows\System\XsPUMiO.exe
  C:\Windows\System\XsPUMiO.exe
  2⤵
  PID:5972
- C:\Windows\System\oOjGwtq.exe
  C:\Windows\System\oOjGwtq.exe
  2⤵
  PID:4444
- C:\Windows\System\auedzNE.exe
  C:\Windows\System\auedzNE.exe
  2⤵
  PID:10772
- C:\Windows\System\mZuoHuQ.exe
  C:\Windows\System\mZuoHuQ.exe
  2⤵
  PID:6028
- C:\Windows\System\gujsbPs.exe
  C:\Windows\System\gujsbPs.exe
  2⤵
  PID:10868
- C:\Windows\System\mgwlhFl.exe
  C:\Windows\System\mgwlhFl.exe
  2⤵
  PID:8280
- C:\Windows\System\AcvPsRp.exe
  C:\Windows\System\AcvPsRp.exe
  2⤵
  PID:10940
- C:\Windows\System\fdAUXjv.exe
  C:\Windows\System\fdAUXjv.exe
  2⤵
  PID:10976
- C:\Windows\System\GzlpDDV.exe
  C:\Windows\System\GzlpDDV.exe
  2⤵
  PID:6088
- C:\Windows\System\IXLhBxQ.exe
  C:\Windows\System\IXLhBxQ.exe
  2⤵
  PID:8760
- C:\Windows\System\rQFnpuw.exe
  C:\Windows\System\rQFnpuw.exe
  2⤵
  PID:11076
- C:\Windows\System\EsImSat.exe
  C:\Windows\System\EsImSat.exe
  2⤵
  PID:2264
- C:\Windows\System\XYqgXPe.exe
  C:\Windows\System\XYqgXPe.exe
  2⤵
  PID:1624
- C:\Windows\System\Fskbkax.exe
  C:\Windows\System\Fskbkax.exe
  2⤵
  PID:8948
- C:\Windows\System\JgomlXZ.exe
  C:\Windows\System\JgomlXZ.exe
  2⤵
  PID:5144
- C:\Windows\System\OAPXRxj.exe
  C:\Windows\System\OAPXRxj.exe
  2⤵
  PID:13844
- C:\Windows\System\RZPLdxA.exe
  C:\Windows\System\RZPLdxA.exe
  2⤵
  PID:3948
- C:\Windows\System\drBpUsl.exe
  C:\Windows\System\drBpUsl.exe
  2⤵
  PID:5256
- C:\Windows\System\pQMoiRv.exe
  C:\Windows\System\pQMoiRv.exe
  2⤵
  PID:10472
- C:\Windows\System\xbKjiDP.exe
  C:\Windows\System\xbKjiDP.exe
  2⤵
  PID:5284
- C:\Windows\System\fgvffUB.exe
  C:\Windows\System\fgvffUB.exe
  2⤵
  PID:7624
- C:\Windows\System\qLXNMNI.exe
  C:\Windows\System\qLXNMNI.exe
  2⤵
  PID:3244
- C:\Windows\System\kVkOJpq.exe
  C:\Windows\System\kVkOJpq.exe
  2⤵
  PID:5420
- C:\Windows\System\ParcQUQ.exe
  C:\Windows\System\ParcQUQ.exe
  2⤵
  PID:7392
- C:\Windows\System\naWunVp.exe
  C:\Windows\System\naWunVp.exe
  2⤵
  PID:6608
- C:\Windows\System\yRsHVbv.exe
  C:\Windows\System\yRsHVbv.exe
  2⤵
  PID:8288
- C:\Windows\System\LohrmfE.exe
  C:\Windows\System\LohrmfE.exe
  2⤵
  PID:11044
- C:\Windows\System\ISMJlSr.exe
  C:\Windows\System\ISMJlSr.exe
  2⤵
  PID:2984
- C:\Windows\System\lsCBmhN.exe
  C:\Windows\System\lsCBmhN.exe
  2⤵
  PID:11152
- C:\Windows\System\hQeWFHP.exe
  C:\Windows\System\hQeWFHP.exe
  2⤵
  PID:10276
- C:\Windows\System\rvXKTHw.exe
  C:\Windows\System\rvXKTHw.exe
  2⤵
  PID:5680
- C:\Windows\System\oHYnGEi.exe
  C:\Windows\System\oHYnGEi.exe
  2⤵
  PID:13432
- C:\Windows\System\UXwljoL.exe
  C:\Windows\System\UXwljoL.exe
  2⤵
  PID:7052
- C:\Windows\System\pAvOzZN.exe
  C:\Windows\System\pAvOzZN.exe
  2⤵
  PID:3380
- C:\Windows\System\YFoCwXL.exe
  C:\Windows\System\YFoCwXL.exe
  2⤵
  PID:7160
- C:\Windows\System\lYhkrui.exe
  C:\Windows\System\lYhkrui.exe
  2⤵
  PID:4500
- C:\Windows\System\lunIbzs.exe
  C:\Windows\System\lunIbzs.exe
  2⤵
  PID:8728
- C:\Windows\System\jMikaqS.exe
  C:\Windows\System\jMikaqS.exe
  2⤵
  PID:2988
- C:\Windows\System\TsbPSwE.exe
  C:\Windows\System\TsbPSwE.exe
  2⤵
  PID:8996
- C:\Windows\System\eRhvZlt.exe
  C:\Windows\System\eRhvZlt.exe
  2⤵
  PID:13660
- C:\Windows\System\Qtakjik.exe
  C:\Windows\System\Qtakjik.exe
  2⤵
  PID:9176
- C:\Windows\System\eTBDgzf.exe
  C:\Windows\System\eTBDgzf.exe
  2⤵
  PID:11656
- C:\Windows\System\DXbbFPl.exe
  C:\Windows\System\DXbbFPl.exe
  2⤵
  PID:13644
- C:\Windows\System\GqDjArY.exe
  C:\Windows\System\GqDjArY.exe
  2⤵
  PID:5424
- C:\Windows\System\wrDUuHm.exe
  C:\Windows\System\wrDUuHm.exe
  2⤵
  PID:9296
- C:\Windows\System\lnUtJsL.exe
  C:\Windows\System\lnUtJsL.exe
  2⤵
  PID:5564
- C:\Windows\System\gBMflUR.exe
  C:\Windows\System\gBMflUR.exe
  2⤵
  PID:5560
- C:\Windows\System\AsmsJfv.exe
  C:\Windows\System\AsmsJfv.exe
  2⤵
  PID:13884
- C:\Windows\System\dYJOwfS.exe
  C:\Windows\System\dYJOwfS.exe
  2⤵
  PID:3024
- C:\Windows\System\HPOqZij.exe
  C:\Windows\System\HPOqZij.exe
  2⤵
  PID:9528
- C:\Windows\System\yMoPIcL.exe
  C:\Windows\System\yMoPIcL.exe
  2⤵
  PID:13732
- C:\Windows\System\bwtOxYg.exe
  C:\Windows\System\bwtOxYg.exe
  2⤵
  PID:12196
- C:\Windows\System\vPydjXT.exe
  C:\Windows\System\vPydjXT.exe
  2⤵
  PID:12212
- C:\Windows\System\pwpKoLV.exe
  C:\Windows\System\pwpKoLV.exe
  2⤵
  PID:9936
- C:\Windows\System\qGzXHaY.exe
  C:\Windows\System\qGzXHaY.exe
  2⤵
  PID:9716
- C:\Windows\System\XmVqeKn.exe
  C:\Windows\System\XmVqeKn.exe
  2⤵
  PID:5348
- C:\Windows\System\pkOKtHu.exe
  C:\Windows\System\pkOKtHu.exe
  2⤵
  PID:7580
- C:\Windows\System\tiXeGSX.exe
  C:\Windows\System\tiXeGSX.exe
  2⤵
  PID:10064
- C:\Windows\System\YPGwQYm.exe
  C:\Windows\System\YPGwQYm.exe
  2⤵
  PID:14080
- C:\Windows\System\MDfOOeJ.exe
  C:\Windows\System\MDfOOeJ.exe
  2⤵
  PID:13944
- C:\Windows\System\VIbdoBz.exe
  C:\Windows\System\VIbdoBz.exe
  2⤵
  PID:10540
- C:\Windows\System\FoJjMzr.exe
  C:\Windows\System\FoJjMzr.exe
  2⤵
  PID:11380
- C:\Windows\System\UdCcSiZ.exe
  C:\Windows\System\UdCcSiZ.exe
  2⤵
  PID:7592
- C:\Windows\System\EyafHpA.exe
  C:\Windows\System\EyafHpA.exe
  2⤵
  PID:9784
- C:\Windows\System\tBanRZg.exe
  C:\Windows\System\tBanRZg.exe
  2⤵
  PID:9832
- C:\Windows\System\gThHzew.exe
  C:\Windows\System\gThHzew.exe
  2⤵
  PID:5440
- C:\Windows\System\nmvFoMC.exe
  C:\Windows\System\nmvFoMC.exe
  2⤵
  PID:13956
- C:\Windows\System\tNkRBIR.exe
  C:\Windows\System\tNkRBIR.exe
  2⤵
  PID:1180
- C:\Windows\System\PGtvGMT.exe
  C:\Windows\System\PGtvGMT.exe
  2⤵
  PID:9392
- C:\Windows\System\VHFqLfM.exe
  C:\Windows\System\VHFqLfM.exe
  2⤵
  PID:4048
- C:\Windows\System\GrPRGsa.exe
  C:\Windows\System\GrPRGsa.exe
  2⤵
  PID:5496
- C:\Windows\System\KIIghHp.exe
  C:\Windows\System\KIIghHp.exe
  2⤵
  PID:13968
- C:\Windows\System\NsIAVXO.exe
  C:\Windows\System\NsIAVXO.exe
  2⤵
  PID:9304
- C:\Windows\System\rZKIUcp.exe
  C:\Windows\System\rZKIUcp.exe
  2⤵
  PID:216
- C:\Windows\System\tTvpJIO.exe
  C:\Windows\System\tTvpJIO.exe
  2⤵
  PID:9268
- C:\Windows\System\aFFTLCE.exe
  C:\Windows\System\aFFTLCE.exe
  2⤵
  PID:8052
- C:\Windows\System\FKhfTfC.exe
  C:\Windows\System\FKhfTfC.exe
  2⤵
  PID:12048
- C:\Windows\System\DCQqzHe.exe
  C:\Windows\System\DCQqzHe.exe
  2⤵
  PID:9768
- C:\Windows\System\EOeAAqQ.exe
  C:\Windows\System\EOeAAqQ.exe
  2⤵
  PID:208
- C:\Windows\System\mhCRNHS.exe
  C:\Windows\System\mhCRNHS.exe
  2⤵
  PID:2076
- C:\Windows\System\QoKcset.exe
  C:\Windows\System\QoKcset.exe
  2⤵
  PID:14164
- C:\Windows\System\tLefxFA.exe
  C:\Windows\System\tLefxFA.exe
  2⤵
  PID:5720
- C:\Windows\System\LbLijER.exe
  C:\Windows\System\LbLijER.exe
  2⤵
  PID:11576
- C:\Windows\System\jwGUAOC.exe
  C:\Windows\System\jwGUAOC.exe
  2⤵
  PID:5748
- C:\Windows\System\qEtZsiv.exe
  C:\Windows\System\qEtZsiv.exe
  2⤵
  PID:7216
- C:\Windows\System\vmPhrzQ.exe
  C:\Windows\System\vmPhrzQ.exe
  2⤵
  PID:11892
- C:\Windows\System\HBRgeeT.exe
  C:\Windows\System\HBRgeeT.exe
  2⤵
  PID:9612
- C:\Windows\System\DdgIipt.exe
  C:\Windows\System\DdgIipt.exe
  2⤵
  PID:12208
- C:\Windows\System\cgUdfaX.exe
  C:\Windows\System\cgUdfaX.exe
  2⤵
  PID:6324
- C:\Windows\System\pLDWOqT.exe
  C:\Windows\System\pLDWOqT.exe
  2⤵
  PID:6344
- C:\Windows\System\YLeKfWP.exe
  C:\Windows\System\YLeKfWP.exe
  2⤵
  PID:11696
- C:\Windows\System\DDPtihS.exe
  C:\Windows\System\DDPtihS.exe
  2⤵
  PID:1976
- C:\Windows\System\qmJynQD.exe
  C:\Windows\System\qmJynQD.exe
  2⤵
  PID:14292
- C:\Windows\System\GLhyymS.exe
  C:\Windows\System\GLhyymS.exe
  2⤵
  PID:7868
- C:\Windows\System\cmcNbQI.exe
  C:\Windows\System\cmcNbQI.exe
  2⤵
  PID:3772
- C:\Windows\System\LTDZFOJ.exe
  C:\Windows\System\LTDZFOJ.exe
  2⤵
  PID:12360
- C:\Windows\System\gWVkapE.exe
  C:\Windows\System\gWVkapE.exe
  2⤵
  PID:10260
- C:\Windows\System\aEdZAvf.exe
  C:\Windows\System\aEdZAvf.exe
  2⤵
  PID:6552
- C:\Windows\System\itCtPUc.exe
  C:\Windows\System\itCtPUc.exe
  2⤵
  PID:6568
- C:\Windows\System\AgCflNT.exe
  C:\Windows\System\AgCflNT.exe
  2⤵
  PID:6696
- C:\Windows\System\iIYbUzT.exe
  C:\Windows\System\iIYbUzT.exe
  2⤵
  PID:6556
- C:\Windows\System\QdGmJAt.exe
  C:\Windows\System\QdGmJAt.exe
  2⤵
  PID:8064
- C:\Windows\System\pOkfRpD.exe
  C:\Windows\System\pOkfRpD.exe
  2⤵
  PID:7512
- C:\Windows\System\EUthRuh.exe
  C:\Windows\System\EUthRuh.exe
  2⤵
  PID:6732
- C:\Windows\System\CBNxNVe.exe
  C:\Windows\System\CBNxNVe.exe
  2⤵
  PID:7800
- C:\Windows\System\PDajpEk.exe
  C:\Windows\System\PDajpEk.exe
  2⤵
  PID:12956
- C:\Windows\System\EpdzcSw.exe
  C:\Windows\System\EpdzcSw.exe
  2⤵
  PID:10548
- C:\Windows\System\xglrnEp.exe
  C:\Windows\System\xglrnEp.exe
  2⤵
  PID:10568
- C:\Windows\System\GhcdecI.exe
  C:\Windows\System\GhcdecI.exe
  2⤵
  PID:6876
- C:\Windows\System\ktGDenW.exe
  C:\Windows\System\ktGDenW.exe
  2⤵
  PID:6872
- C:\Windows\System\lABKbKU.exe
  C:\Windows\System\lABKbKU.exe
  2⤵
  PID:6944
- C:\Windows\System\hLrXlka.exe
  C:\Windows\System\hLrXlka.exe
  2⤵
  PID:7088
- C:\Windows\System\RMWhseN.exe
  C:\Windows\System\RMWhseN.exe
  2⤵
  PID:12852
- C:\Windows\System\KDkPDUk.exe
  C:\Windows\System\KDkPDUk.exe
  2⤵
  PID:6992
- C:\Windows\System\SDEljJY.exe
  C:\Windows\System\SDEljJY.exe
  2⤵
  PID:5976
- C:\Windows\System\MIdofoX.exe
  C:\Windows\System\MIdofoX.exe
  2⤵
  PID:12872
- C:\Windows\System\EJrUnop.exe
  C:\Windows\System\EJrUnop.exe
  2⤵
  PID:7104
- C:\Windows\System\VGowISR.exe
  C:\Windows\System\VGowISR.exe
  2⤵
  PID:8268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_frvsje1f.v2z.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ACQfgIw.exe

Filesize
2.5MB

MD5
20b497e7a1e086b7e7a206ba69e9fcd8

SHA1
7e4caf5dc54293a99c5febb92b5232603bbac0a7

SHA256
531e8460a3cbbdc635a1b4de9ccb0c1e59ad783073a0a548ccf1440a934b788c

SHA512
1442e8a1fb9b6ee65d574140c6a1cfd3bda18b116f6f2c48bd75825a5f9e1c3f9356cd5a087c7a81f110411d64221c7cbe8b6dd5bd9f8a923346dfc5c1367551

Download Submit
C:\Windows\System\BQgYMHA.exe

Filesize
2.5MB

MD5
a37408d6fb7bd8e5b72e61b99181e336

SHA1
b76affd62d7fb81b1b541079b7be71ff22b92642

SHA256
d33e21033f8a2e0a21e449553e678f51b36039822b30f35c11bcb2ee008a6265

SHA512
6fb2cc75b0386783ec9c347c0894ef396ce19bd0e916206610e94d80eedf22cd52847518c8db81d8e315262342ce99f49afc1a55ab3556c18211714106951df3

Download Submit
C:\Windows\System\DJjxEBi.exe

Filesize
2.5MB

MD5
20d5b98bb3e1ae23f24589bbb1b2e43c

SHA1
0642d434fc8d3cf7961335b4549b0aaa027edf7f

SHA256
f158f109a54a66620f6cf90a68c2aa5514c483e17b01454712118561aadae632

SHA512
31f3d5e09687311c7f4ac937c35a01587ab667135a8ade3dfc1b4c33945e53534ded7917cf56e6b5f8e2bc8d7d93438b587c0fb645651b99bcb12a289f059061

Download Submit
C:\Windows\System\EZImkbd.exe

Filesize
2.5MB

MD5
6a25ab88743bf66f89070ef419753040

SHA1
c8c913d39f711bd32bc38edf9fa67ea6d958db33

SHA256
6711e8da1e713a51954cf85da309037e4e776177cc047d3a1c3b5238da039f52

SHA512
d3c937b15fb953b1e8e665ce44fe00aef13f656e92794bd8dd35c3a48a33164187c3ec5a5506bf6557ff078a2333d6cd16d93864337854235a6f2273e307e61a

Download Submit
C:\Windows\System\FIslZEi.exe

Filesize
2.5MB

MD5
9521ba344bc262a1b0bf056ee16fd1c4

SHA1
0a4b3903e2871d2ced492f93e0a864e02913d715

SHA256
7e61a87bd9f72eb0b28c4601fcdc55796cf727c81d043e3ffcc8d2642d5c0acc

SHA512
7ff778f137976b853463c5da60010abf294db0d781e4a469b2b907d8088305d0855336ce9923cd1cb32c939d23670ff12e8ba78f6c59c0f60f94755ff53194e1

Download Submit
C:\Windows\System\GhkbzZT.exe

Filesize
2.5MB

MD5
5ca6b52376d1da206c87f0aa46de8a27

SHA1
35fe0fee3d6cf6222fc584cdc4c1cf8fb10302b4

SHA256
92de48ff30ae4646d29f75472d5c27bdc7e5a5a83330ac04cfbd69c3686d0cac

SHA512
2b3ccd29661bc55da6bf4d3d27d49cfc20e8202e29ba8ade4c52e0b8583d68a48c281f846561349e69767f56f8d4f520d50ad679ddc65ae91cd4e5e791ddf146

Download Submit
C:\Windows\System\KsrkAMY.exe

Filesize
2.5MB

MD5
ddf34c9c2cd4fe8f6c3684573970bb17

SHA1
984fb572c711fc6948b20f65d86bfda79b7e76ea

SHA256
8677fa691175ad205f3e6f719ce2eca8cba1896bc88db7b20b4e755886842535

SHA512
723795ad1d7a1229b932c40caab79950eb3f9a8fbd9cd441f2794c5947a8c44d3a57811050b67c1722074e13026312e7a1000280273eb486beedf6e55c1222eb

Download Submit
C:\Windows\System\LpXDXre.exe

Filesize
2.5MB

MD5
9076ff6badc5a7e5ca3343f430708a62

SHA1
deeea513e6360105e04b6ee71275c45e99e2fd31

SHA256
11e40dc5624149930d8bffc3661182c09efdae3223a173fe29c730bcfca2d22c

SHA512
fcede614104f4016e710e9bf992af8d08be61e44af42ec7f2e3dda56a36cc82126d9d13b829001b0b3e602852eaf1eaf24e6ce45c2b3a978d8a9d12776b6b7e9

Download Submit
C:\Windows\System\OsdjxIN.exe

Filesize
2.5MB

MD5
e5bd80473886e930b60b78f8b39c87d0

SHA1
4390c11df0194213531802ca4f3703b471e69a95

SHA256
6bcc56dbdc61f8f95a9a4c4e1526f5268924ddd9e5932adc958186473bedfb2d

SHA512
1a97bf9b821007cc78583022e991a93b21699de7487af7c969ba822fdd9dd2d5de92fecedec568bec8f9236038decbfc41d2eaf4598a7b4783b6e1cea24776b8

Download Submit
C:\Windows\System\PGRQZKW.exe

Filesize
2.5MB

MD5
90c0d48d18c6c3add80490a4201b7983

SHA1
7d463fe45e2e67606e8cff29a50b802385af58e9

SHA256
a043d457c84d3106530510063e8a0174dc167f17b59fba78c7b630102759f3de

SHA512
b6633c777c988ebd04774cf08f626488b5f0b76584baa2c99607dd5798ebefa9632aac22d100d30534519c8ad47e37d12674f6a3e45c88274c74def2f1060845

Download Submit
C:\Windows\System\RgXfnNu.exe

Filesize
2.5MB

MD5
20be19b2fa9e1f0f693fa0b4c0895339

SHA1
8f28aec94b29e7f58558499c19bdfbf80ffd3228

SHA256
aa9ffcc31af96403b0d729730c290bdf6d3813b60ff740ee567c59984547122f

SHA512
e4e24b403bbc196fda44033a828828d0030f02afdc25ba6493a53189be7eed33b38cd483503af4d00f4ec35e2f09b586a8c6b5fb380a9875392206d3f2a8ed5d

Download Submit
C:\Windows\System\ShMblzJ.exe

Filesize
2.5MB

MD5
5da6c764c2d35d5db29f60c30ac6e4a8

SHA1
c6af862667865357f33f5cb20d05ccb3f73e9109

SHA256
37d01854a5791b8487adb37e35cc973a3c528c866ab767f2f0945c6be2878ff8

SHA512
9463ee3ce2aa3a70a0bd3b12b8f309c0c40527cf3328ddefe778cd04018addaa2bdb859f4d973ce47fdc6936e0a2a4b9b7bd187f7fa07fc5e5a2b8a3d6205c28

Download Submit
C:\Windows\System\TZywrBF.exe

Filesize
2.5MB

MD5
4e0f79b1057776bcf50c4b1683602661

SHA1
130961eef9d23f67421b426c0f73a72e6b5e4531

SHA256
9e7ffb75cebc4d18feb9c0772cd78c06f1f01b649467002f0d2b10d3ce34cef0

SHA512
920147cac9ecd6ab307d6fe2ef9e26a734bc466cb0547af243041d93bf2e94b7fa17c1f5d64b2432fb3133e63670e249b1edf4ac1620d13388e681ab43bb7592

Download Submit
C:\Windows\System\UUnlzjk.exe

Filesize
2.5MB

MD5
cfb62a012b6bb778b3034d36dc6aab09

SHA1
c0bee063e34d077bd4c46bb42d94a7491e951d65

SHA256
a116e7e3a54bdadbe8bd1f5041483c7d6ce40953793c13642a88b8d4ff782265

SHA512
317fd9377118be5651fe7bf75bea3962167942fa156a7b6e2eb4e16ac908c0dabb6558e4b2cf0e6ab68da49aeb7d570626238cbfe394ce971a4053e680b42635

Download Submit
C:\Windows\System\YrQOtpv.exe

Filesize
2.5MB

MD5
e19520375d3f5d99cf68fc5a577b7069

SHA1
eb6e27cc13a87577942db6e588419880254e8bd5

SHA256
b4cd0936cf86670c967455d2d832f5280a42ce75ebd55ca4964c57c92a8179bb

SHA512
4e741ded04e7b5a03144e9518b9162c55805fd8c017f8b9cf0c1398de05ad513efbc0e8d8421269f27e8c023cf9ec4c19c2a17c2217843d4b37cdd5c83a5f41e

Download Submit
C:\Windows\System\bZtaRPb.exe

Filesize
2.5MB

MD5
c118730ed1d58c7aac135ca10a45a12b

SHA1
580ecf1d9f4463653dd03b5f7b9c0b53fd9097d5

SHA256
87c1855d9e6b4f5d0c88098508730c8b8cd7bfcbb4c66e4558fd5b0938f065b0

SHA512
690cfdd09486c672471f7f56faea5626ed7392309dd3a29d607e750ec3f2c9f3aab7748a3428a3202d5f15645d93cbd0d6d5723fd7ed3dc3f4a5c9f425b85c30

Download Submit
C:\Windows\System\bkwiZJW.exe

Filesize
2.5MB

MD5
0b0506d6da9170df5061bceeace0bbff

SHA1
de56357ac61d9c20796c1f81e3033b772dd53f91

SHA256
ffa5e6642451f26a7668feee385423ce01039cde52ed7d9a6bdf9f1a6069c515

SHA512
eaf41ce8d11fa3442d08f8cf56bfbf15ba9eef7e626dbca3fabc0298c70899f7688cb13ada25e033cb702af657fa0be41ad98970fee632276d29fdafc827c346

Download Submit
C:\Windows\System\eyzEutq.exe

Filesize
2.5MB

MD5
dd2ab2d372c97132a36367ee285bad22

SHA1
454ded9e5dafe68164f42854082b518a0c6b82ee

SHA256
35ab29fa370cb84b2a486b75a02b1e576c2f3c98e1ab9c2d5a5ee09d952ece9e

SHA512
ff5b61cbeb895b1b3e68f2c6e784fa0c6d1f156646239e6b6226a9c1b994efa7da975392813004ada1f18645ab7d8a9dffdc8b407e9b1a4fe5013c79fe3b6f4b

Download Submit
C:\Windows\System\gfajhFM.exe

Filesize
2.5MB

MD5
e21fbc1e0ffb96806af362f0d7e18f00

SHA1
f575151281edb54c65523a3820c7d952ad3f9ace

SHA256
31c9141a19f8d67c91529f0e3ac12f02d65ca884898c052833ce0d82a414aaa4

SHA512
e8027a816d37bf3be6ce9e067c8faeb0a983d1385dcc3313a7f92b5fed228f122586522e0ec5776b19ab541736aaa8bff10adb203e0cdb9485f7b1466430a33f

Download Submit
C:\Windows\System\hBtiVle.exe

Filesize
2.5MB

MD5
2fd62419b292ff7ea32f77571d748979

SHA1
ffe262e34603fa36d6439feac7722e0cc8f5fe6c

SHA256
b1c8fa15ecb64539346f741cf74e06b87429c6b4b834432e9d44cd8417368849

SHA512
c17618880f591517d25d156c1bb508b5e7a6166995db0b9ad75a9dad51c4b7c7a165da24022cf90d97ce8438d72ffe3ee4751a239786d62d75e1a2ad18263f0a

Download Submit
C:\Windows\System\hnJvciC.exe

Filesize
2.5MB

MD5
cb79be3a23289508fb53ac0f109fc8d4

SHA1
9e49da278b8fb27852dbd617e61ddc79cb469aea

SHA256
48d14e7894775c86f47c1c17701120922ee2198468a58104d2e0fb14938487bc

SHA512
67316f0367abc28b091de360619e320ba1d0f0a784c3bc082216e7b0072580a7c70de5062b40be312215375f1b9f869b02505b75f01a36e4090f65563f631c4a

Download Submit
C:\Windows\System\iRUoCvi.exe

Filesize
2.5MB

MD5
ea7647fc167433fb9293d6044e31ac01

SHA1
76a0e991e79a4b69ab718bfc24934212f3bcec27

SHA256
b6fcdec571dd66e4ad38687d54d5d4ef2ca07cb5def74289ea2dc8be417ff162

SHA512
0bebafb9eae8c1d08ecc4d1fd13584a6632635185fbabd46c95f83d1f1993fc94a61d868f4903a97a364f9f96ff981c8740013afa452b0ceab0a2a294bfda781

Download Submit
C:\Windows\System\ofbfYCj.exe

Filesize
2.5MB

MD5
0ca00e00ce781eda69f01b4f6cbf94af

SHA1
77dd5f61e9f8321f7058a0d4fddd06f3231674e8

SHA256
d9f1b3827fd04bd662c6dd644e5812227572f0d4b9f7083a8a90fd903350cfac

SHA512
66529e6ee0450bd4ee0fa242385ae01300fff6b13248f19b98addd083a9b0bca1814f6d647896e89080a2c7cc9a80b2ade2fd53867bd6e0cb958481d0fd2c1a9

Download Submit
C:\Windows\System\pLocntu.exe

Filesize
2.5MB

MD5
3214db4bee52a6e1c5d1731f7a5b3bc2

SHA1
b1a75821f51125bd2f61580652de53c1685b9821

SHA256
b02119475fdf2c281d7375615dea6a7fedf282014edecc92e374fce4f77a7564

SHA512
2c69449d27609a17a9422acec7d622d83fb7bfe196fa3eabd033609a4466aec314f2f4ed4deb74b17f75a90b9a8f1f8d2c68bee112bdc43c8b94d897d97d522e

Download Submit
C:\Windows\System\pYZWZIR.exe

Filesize
2.5MB

MD5
0cb7ff2ca24e95c7e39d4e2860bba785

SHA1
f256cbfe65e59a0e4f3a387853e6be4e6cde8cee

SHA256
9f9ab3e8437556ddb412902cc679127cdfcdff8a4308802d26aba3291f84ba42

SHA512
6be51de7e45964e91613cfc4571568e89d9002bc4393965840279d47e8820c2eff73e2110f77e57f6679d515f3af385662bf988c61ebb04547a378cacce0efc5

Download Submit
C:\Windows\System\pgjcoUV.exe

Filesize
2.5MB

MD5
805239d79c2025887a457d97458395bc

SHA1
a96f2a0fb4f439f938aaaaa14c814671a8659bed

SHA256
aa7829a82a63ee7323c631d504227f3c38449268204675f573c484cdd4f930ee

SHA512
837b0f24fdf1f2a519837c465beb725b771cd81384eecb00f24364a7d056a40146cef4409fd0c38482feeecba6af57c4928361f5ee142f450a248ad7f2ae46a2

Download Submit
C:\Windows\System\psGncLQ.exe

Filesize
2.5MB

MD5
618657c528cc6ae6f771a15d8be4cb61

SHA1
8471a51f6342a371be81968745c996e1f86fa97e

SHA256
9224f94b2d3d4f478c92b922e9b770119021481a70d8deb4007939770160a96f

SHA512
9a79fad0db671b58cc73cc6a0ea5ab2b889e9b51e02d5986c4e69b4209ad7555a91e9c5a45542293ede01274663c66d25440c4348ef3d8aacc95efcaee3638af

Download Submit
C:\Windows\System\sFHykxZ.exe

Filesize
2.5MB

MD5
48113edd185a26b57fc570ee7b7c3f1c

SHA1
c95a47037bee6d8d567c84e9e2e3f0a72c0222cb

SHA256
fd0b39ede82805d84612330574f739f70e340bd3d299d1a90c1c0b5d1c4fb9db

SHA512
2c6dd684cb9f53b4d0a44f971bb7169c197118ca84f027e9bbc084389f8f94ce0c55101f3d45d0fc18980e6554dd23a9e02132e0550abb4bd9d92d40b3187a81

Download Submit
C:\Windows\System\uTGNPiH.exe

Filesize
8B

MD5
f6061fc6a7c99ae821a125be5d34b682

SHA1
cd62deeb3efa237b04e342e9238578fd370ae14d

SHA256
700c9a719b011e50437e2fa1d083a87e3381f4f178b8b9f9899f4bbf7503df60

SHA512
cc6b78f85499cc18661ced0cca34cc6f25b4f82783646930e95bb966639561cabaf13feff5c13c58aa77b6804729d0ec64978f44b9a573d37b44aa1603320b3d

Download Submit
C:\Windows\System\uWshkbJ.exe

Filesize
2.5MB

MD5
8a6f8d01b1be38ed6bbc67bd0f14a741

SHA1
0f5c006bb9ee4ff52dd4ef5df0ada2adf803d3d8

SHA256
74ec87dd089cf305cbda3cd505d3f0151cae147aacaaa97127eb608af3d995fe

SHA512
65781d922c461b9ddfeda5b45e08a69d2b3a40e772389ae6e5b11013c8d723d1794fe3e66986f5c778d26f024e9ab97fe3130a4a9a13e54712a844becb0b99ae

Download Submit
C:\Windows\System\uxEzFxZ.exe

Filesize
2.5MB

MD5
aae0e9e5a2bdfe744543cbdd32b0d073

SHA1
b6b6933d090a0630b754e0579604341717de4173

SHA256
8aa6a34c90e4ea3f6e0b822ca4b7e67dffa1c5c9684f4a3901a61efefa0c2baa

SHA512
89fead5f56a0ca8372b591d95ef3667a61c9d310ac3dea24bc3298c0f26921759459192a3fc149bb0326c7653c7d244f6d6e65f8bef2b40b6ed3d358b5d91111

Download Submit
C:\Windows\System\vRhpFfD.exe

Filesize
2.5MB

MD5
f7d30d1a657867ec3b904fe385a62f63

SHA1
04eee39619dbd3053b27cdc829a1bdfa1e18937c

SHA256
34342c0e5b591591cc0908e69d204de89d1f1a027ee07a29fe744695bb89b770

SHA512
e3f810329d1e00bc380c335ea6677b879e1cdbbdb9ff8cdecaac8cc77929e4368d28c4ef6b85c909a0e8ec81636b0fca2f454ddc7764940b0dc1dff0eebdea1e

Download Submit
C:\Windows\System\wBzrYhZ.exe

Filesize
2.5MB

MD5
7c62239da1acb396615d5b25d06cfd9a

SHA1
baad07e830160091ff0935f21b9641b3022cdb54

SHA256
127fca194133e47e5bb254ef4f5d16fd07c6e86d11b9a91d10b51757d3531196

SHA512
f4d740a800da9b687d9d1da506d577c4ee66c6b65674c2a1356e09b29b5548b3e1f7746683454232ad1f21e225e1d3993b738c28d2e937b5371ec48366858a15

Download Submit
C:\Windows\System\yCTlAok.exe

Filesize
2.5MB

MD5
36e6e8e6e1b150212e93c6fbddda0e44

SHA1
326ac22df563982fee5270e073a8198d206f76e5

SHA256
b63c9cf2365dc08f83b5ae3a55efa1ce30b9c4bbd3b678c5409d794e1501fdfb

SHA512
e159d27a8f3e6dcf43de7284677f17ac2e64d74ddc627003752b006eccd1feb799e6e7d847a12ed031961bc227ff1f3554a342b8ad3be297d97f2b973bab8884

Download Submit
memory/8-496-0x00007FF6F5CC0000-0x00007FF6F60B2000-memory.dmp

Filesize
3.9MB

Download
memory/228-466-0x00007FF6FA170000-0x00007FF6FA562000-memory.dmp

Filesize
3.9MB

Download
memory/228-3685-0x00007FF6FA170000-0x00007FF6FA562000-memory.dmp

Filesize
3.9MB

Download
memory/424-499-0x00007FF6FCBF0000-0x00007FF6FCFE2000-memory.dmp

Filesize
3.9MB

Download
memory/1008-3518-0x00007FF6A9060000-0x00007FF6A9452000-memory.dmp

Filesize
3.9MB

Download
memory/1008-84-0x00007FF6A9060000-0x00007FF6A9452000-memory.dmp

Filesize
3.9MB

Download
memory/1032-3601-0x00007FF679970000-0x00007FF679D62000-memory.dmp

Filesize
3.9MB

Download
memory/1032-104-0x00007FF679970000-0x00007FF679D62000-memory.dmp

Filesize
3.9MB

Download
memory/1088-101-0x00007FF641D20000-0x00007FF642112000-memory.dmp

Filesize
3.9MB

Download
memory/1088-3576-0x00007FF641D20000-0x00007FF642112000-memory.dmp

Filesize
3.9MB

Download
memory/1208-90-0x00007FF7A0AD0000-0x00007FF7A0EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1208-3536-0x00007FF7A0AD0000-0x00007FF7A0EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1220-493-0x00007FF74ED00000-0x00007FF74F0F2000-memory.dmp

Filesize
3.9MB

Download
memory/1220-3715-0x00007FF74ED00000-0x00007FF74F0F2000-memory.dmp

Filesize
3.9MB

Download
memory/1404-480-0x00007FF6EA220000-0x00007FF6EA612000-memory.dmp

Filesize
3.9MB

Download
memory/1404-3711-0x00007FF6EA220000-0x00007FF6EA612000-memory.dmp

Filesize
3.9MB

Download
memory/1520-92-0x00007FF7AED20000-0x00007FF7AF112000-memory.dmp

Filesize
3.9MB

Download
memory/1520-3532-0x00007FF7AED20000-0x00007FF7AF112000-memory.dmp

Filesize
3.9MB

Download
memory/1948-82-0x00007FF76B0F0000-0x00007FF76B4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-3522-0x00007FF76B0F0000-0x00007FF76B4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-3571-0x00007FF707D80000-0x00007FF708172000-memory.dmp

Filesize
3.9MB

Download
memory/2080-113-0x00007FF707D80000-0x00007FF708172000-memory.dmp

Filesize
3.9MB

Download
memory/2092-3594-0x00007FF61D3F0000-0x00007FF61D7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2092-100-0x00007FF61D3F0000-0x00007FF61D7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-114-0x00007FF7881F0000-0x00007FF7885E2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-3393-0x00007FF7881F0000-0x00007FF7885E2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-4138-0x00007FF7881F0000-0x00007FF7885E2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-83-0x00007FF6FEE50000-0x00007FF6FF242000-memory.dmp

Filesize
3.9MB

Download
memory/2416-3526-0x00007FF6FEE50000-0x00007FF6FF242000-memory.dmp

Filesize
3.9MB

Download
memory/2492-115-0x00007FF71F120000-0x00007FF71F512000-memory.dmp

Filesize
3.9MB

Download
memory/2492-3644-0x00007FF71F120000-0x00007FF71F512000-memory.dmp

Filesize
3.9MB

Download
memory/2556-37-0x000001728DDB0000-0x000001728DDD2000-memory.dmp

Filesize
136KB

Download
memory/2556-3028-0x00007FF82C9C3000-0x00007FF82C9C5000-memory.dmp

Filesize
8KB

Download
memory/2556-28-0x00007FF82C9C0000-0x00007FF82D481000-memory.dmp

Filesize
10.8MB

Download
memory/2556-3478-0x00007FF82C9C0000-0x00007FF82D481000-memory.dmp

Filesize
10.8MB

Download
memory/2556-309-0x00000172A7560000-0x00000172A7D06000-memory.dmp

Filesize
7.6MB

Download
memory/2556-6-0x00007FF82C9C3000-0x00007FF82C9C5000-memory.dmp

Filesize
8KB

Download
memory/2556-64-0x00007FF82C9C0000-0x00007FF82D481000-memory.dmp

Filesize
10.8MB

Download
memory/3372-112-0x00007FF792D50000-0x00007FF793142000-memory.dmp

Filesize
3.9MB

Download
memory/3372-3529-0x00007FF792D50000-0x00007FF793142000-memory.dmp

Filesize
3.9MB

Download
memory/3920-93-0x00007FF74E300000-0x00007FF74E6F2000-memory.dmp

Filesize
3.9MB

Download
memory/3920-3540-0x00007FF74E300000-0x00007FF74E6F2000-memory.dmp

Filesize
3.9MB

Download
memory/4416-471-0x00007FF670BE0000-0x00007FF670FD2000-memory.dmp

Filesize
3.9MB

Download
memory/4416-3717-0x00007FF670BE0000-0x00007FF670FD2000-memory.dmp

Filesize
3.9MB

Download
memory/4540-3713-0x00007FF703310000-0x00007FF703702000-memory.dmp

Filesize
3.9MB

Download
memory/4540-485-0x00007FF703310000-0x00007FF703702000-memory.dmp

Filesize
3.9MB

Download
memory/4752-3511-0x00007FF7AD1B0000-0x00007FF7AD5A2000-memory.dmp

Filesize
3.9MB

Download
memory/4752-107-0x00007FF7AD1B0000-0x00007FF7AD5A2000-memory.dmp

Filesize
3.9MB

Download
memory/4784-106-0x00007FF732660000-0x00007FF732A52000-memory.dmp

Filesize
3.9MB

Download
memory/4784-3514-0x00007FF732660000-0x00007FF732A52000-memory.dmp

Filesize
3.9MB

Download
memory/4804-116-0x00007FF687010000-0x00007FF687402000-memory.dmp

Filesize
3.9MB

Download
memory/4804-3642-0x00007FF687010000-0x00007FF687402000-memory.dmp

Filesize
3.9MB

Download
memory/4940-3573-0x00007FF779B90000-0x00007FF779F82000-memory.dmp

Filesize
3.9MB

Download
memory/4940-97-0x00007FF779B90000-0x00007FF779F82000-memory.dmp

Filesize
3.9MB

Download
memory/5092-0-0x00007FF77A190000-0x00007FF77A582000-memory.dmp

Filesize
3.9MB

Download
memory/5092-1-0x000001C55A890000-0x000001C55A8A0000-memory.dmp

Filesize
64KB

Download