xmrig | 3ff44ce2fff47702c0f24c54d59762efc6cd1898df00a535291f155c72295d8e

Analysis

max time kernel
120s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
Size

1.9MB
MD5

ad869f865c93a6cc2927bcdd6e8f2fe0
SHA1

045cc343022f85ca518686108665cb4116cc245a
SHA256

3ff44ce2fff47702c0f24c54d59762efc6cd1898df00a535291f155c72295d8e
SHA512

b8da23af91eb8cb0691231b492c47c47a7a203876ea82e971907c6c06a0b37c1a7dfb5242c69275f58d52fb8cda2639b5d85f17d3b936ec62a262cff9170cb67
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VqaWVR:NABn

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/3064-254-0x00007FF622B20000-0x00007FF622F12000-memory.dmp	xmrig
behavioral2/memory/4180-300-0x00007FF6A4900000-0x00007FF6A4CF2000-memory.dmp	xmrig
behavioral2/memory/1088-320-0x00007FF616F50000-0x00007FF617342000-memory.dmp	xmrig
behavioral2/memory/4808-369-0x00007FF703090000-0x00007FF703482000-memory.dmp	xmrig
behavioral2/memory/1808-375-0x00007FF692950000-0x00007FF692D42000-memory.dmp	xmrig
behavioral2/memory/3136-403-0x00007FF6F8370000-0x00007FF6F8762000-memory.dmp	xmrig
behavioral2/memory/4468-414-0x00007FF600500000-0x00007FF6008F2000-memory.dmp	xmrig
behavioral2/memory/3588-405-0x00007FF72D710000-0x00007FF72DB02000-memory.dmp	xmrig
behavioral2/memory/1036-402-0x00007FF79E690000-0x00007FF79EA82000-memory.dmp	xmrig
behavioral2/memory/3516-401-0x00007FF69CEE0000-0x00007FF69D2D2000-memory.dmp	xmrig
behavioral2/memory/2132-368-0x00007FF7FE960000-0x00007FF7FED52000-memory.dmp	xmrig
behavioral2/memory/1888-350-0x00007FF7C4100000-0x00007FF7C44F2000-memory.dmp	xmrig
behavioral2/memory/3628-349-0x00007FF7B6D70000-0x00007FF7B7162000-memory.dmp	xmrig
behavioral2/memory/2936-296-0x00007FF64B630000-0x00007FF64BA22000-memory.dmp	xmrig
behavioral2/memory/244-281-0x00007FF7DC710000-0x00007FF7DCB02000-memory.dmp	xmrig
behavioral2/memory/2260-247-0x00007FF6EBF30000-0x00007FF6EC322000-memory.dmp	xmrig
behavioral2/memory/4544-237-0x00007FF638A90000-0x00007FF638E82000-memory.dmp	xmrig
behavioral2/memory/5020-236-0x00007FF7C19D0000-0x00007FF7C1DC2000-memory.dmp	xmrig
behavioral2/memory/4428-220-0x00007FF7FB560000-0x00007FF7FB952000-memory.dmp	xmrig
behavioral2/memory/4136-181-0x00007FF6DD6C0000-0x00007FF6DDAB2000-memory.dmp	xmrig
behavioral2/memory/4296-116-0x00007FF7C5020000-0x00007FF7C5412000-memory.dmp	xmrig
behavioral2/memory/2712-120-0x00007FF7EB8A0000-0x00007FF7EBC92000-memory.dmp	xmrig
behavioral2/memory/1092-83-0x00007FF69E4D0000-0x00007FF69E8C2000-memory.dmp	xmrig
behavioral2/memory/5064-4518-0x00007FF77B610000-0x00007FF77BA02000-memory.dmp	xmrig
behavioral2/memory/1092-4522-0x00007FF69E4D0000-0x00007FF69E8C2000-memory.dmp	xmrig
behavioral2/memory/4296-4527-0x00007FF7C5020000-0x00007FF7C5412000-memory.dmp	xmrig
behavioral2/memory/4544-4532-0x00007FF638A90000-0x00007FF638E82000-memory.dmp	xmrig
behavioral2/memory/4428-4536-0x00007FF7FB560000-0x00007FF7FB952000-memory.dmp	xmrig
behavioral2/memory/2712-4528-0x00007FF7EB8A0000-0x00007FF7EBC92000-memory.dmp	xmrig
behavioral2/memory/2260-4542-0x00007FF6EBF30000-0x00007FF6EC322000-memory.dmp	xmrig
behavioral2/memory/4468-4605-0x00007FF600500000-0x00007FF6008F2000-memory.dmp	xmrig
behavioral2/memory/1808-4610-0x00007FF692950000-0x00007FF692D42000-memory.dmp	xmrig
behavioral2/memory/4808-4596-0x00007FF703090000-0x00007FF703482000-memory.dmp	xmrig
behavioral2/memory/1888-4593-0x00007FF7C4100000-0x00007FF7C44F2000-memory.dmp	xmrig
behavioral2/memory/1088-4582-0x00007FF616F50000-0x00007FF617342000-memory.dmp	xmrig
behavioral2/memory/3136-4578-0x00007FF6F8370000-0x00007FF6F8762000-memory.dmp	xmrig
behavioral2/memory/2132-4577-0x00007FF7FE960000-0x00007FF7FED52000-memory.dmp	xmrig
behavioral2/memory/3628-4572-0x00007FF7B6D70000-0x00007FF7B7162000-memory.dmp	xmrig
behavioral2/memory/3588-4569-0x00007FF72D710000-0x00007FF72DB02000-memory.dmp	xmrig
behavioral2/memory/5020-4554-0x00007FF7C19D0000-0x00007FF7C1DC2000-memory.dmp	xmrig
behavioral2/memory/3064-4548-0x00007FF622B20000-0x00007FF622F12000-memory.dmp	xmrig
behavioral2/memory/4136-4557-0x00007FF6DD6C0000-0x00007FF6DDAB2000-memory.dmp	xmrig
behavioral2/memory/2936-4551-0x00007FF64B630000-0x00007FF64BA22000-memory.dmp	xmrig
behavioral2/memory/244-4547-0x00007FF7DC710000-0x00007FF7DCB02000-memory.dmp	xmrig
behavioral2/memory/4180-4539-0x00007FF6A4900000-0x00007FF6A4CF2000-memory.dmp	xmrig
behavioral2/memory/644-4883-0x00007FF79F760000-0x00007FF79FB52000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	3732	powershell.exe
5	3732	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3732	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
5064	rpUBLIA.exe
3516	KvDXjIX.exe
1036	UzSsdKd.exe
1092	IgOwojj.exe
4296	YsNxpqO.exe
2712	pMXZoSF.exe
4136	nWYeGpa.exe
4428	DGmkKdC.exe
5020	yQdmAlx.exe
4544	twDPJMi.exe
2260	eNiDhwt.exe
3136	Usabclt.exe
3064	ZTLQuXH.exe
244	NAZabmO.exe
2936	UEvNNgB.exe
4180	ygZLrbN.exe
1088	kXpTShH.exe
3588	wtrFtof.exe
3628	hQrOjjn.exe
1888	drzQArQ.exe
2132	VXwZRfP.exe
4808	pkrPawp.exe
1808	oBhkXOx.exe
4468	HmRAoBa.exe
2172	wEUjQKu.exe
2476	MGgmGqT.exe
4980	DhyubKB.exe
3484	DTPkHhs.exe
4908	HkLJgmH.exe
3672	SOecfIu.exe
4672	qqRIIvY.exe
1676	mHVANjX.exe
3744	BnWiZSQ.exe
4536	iDnBQDC.exe
3188	QCiVFJL.exe
848	vMIyKOj.exe
2776	HkhTNYK.exe
2532	DmBrzpI.exe
3324	qjMQgwm.exe
992	kUfKLDW.exe
768	FEQAURJ.exe
4044	zGnfgJJ.exe
3556	tjpMsMR.exe
740	cgvtooc.exe
2736	ZezBUIT.exe
2768	bJwiXgU.exe
3676	xBOhXCX.exe
1508	LfhOnWA.exe
404	TQLusVy.exe
1076	IDtSezN.exe
3360	eJHnsMU.exe
1852	DQWtjGI.exe
5048	UGgZNqE.exe
2116	gqZLZFR.exe
4844	FAOiOpE.exe
4028	ZuHxdbM.exe
3068	WsNTQEb.exe
1264	NeBAzck.exe
4988	YldGxKL.exe
2660	vnHZfLM.exe
4592	LSoIOQz.exe
2524	GKRFAOm.exe
3640	lvMvcbs.exe
3004	HNCYlop.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/644-0-0x00007FF79F760000-0x00007FF79FB52000-memory.dmp	upx
behavioral2/files/0x000700000002342f-17.dat	upx
behavioral2/files/0x000700000002342e-36.dat	upx
behavioral2/files/0x0007000000023431-43.dat	upx
behavioral2/files/0x0007000000023433-59.dat	upx
behavioral2/files/0x0007000000023440-108.dat	upx
behavioral2/files/0x000700000002344e-161.dat	upx
behavioral2/memory/3064-254-0x00007FF622B20000-0x00007FF622F12000-memory.dmp	upx
behavioral2/memory/4180-300-0x00007FF6A4900000-0x00007FF6A4CF2000-memory.dmp	upx
behavioral2/memory/1088-320-0x00007FF616F50000-0x00007FF617342000-memory.dmp	upx
behavioral2/memory/4808-369-0x00007FF703090000-0x00007FF703482000-memory.dmp	upx
behavioral2/memory/1808-375-0x00007FF692950000-0x00007FF692D42000-memory.dmp	upx
behavioral2/memory/3136-403-0x00007FF6F8370000-0x00007FF6F8762000-memory.dmp	upx
behavioral2/memory/4468-414-0x00007FF600500000-0x00007FF6008F2000-memory.dmp	upx
behavioral2/memory/3588-405-0x00007FF72D710000-0x00007FF72DB02000-memory.dmp	upx
behavioral2/memory/1036-402-0x00007FF79E690000-0x00007FF79EA82000-memory.dmp	upx
behavioral2/memory/3516-401-0x00007FF69CEE0000-0x00007FF69D2D2000-memory.dmp	upx
behavioral2/memory/2132-368-0x00007FF7FE960000-0x00007FF7FED52000-memory.dmp	upx
behavioral2/memory/1888-350-0x00007FF7C4100000-0x00007FF7C44F2000-memory.dmp	upx
behavioral2/memory/3628-349-0x00007FF7B6D70000-0x00007FF7B7162000-memory.dmp	upx
behavioral2/memory/2936-296-0x00007FF64B630000-0x00007FF64BA22000-memory.dmp	upx
behavioral2/memory/244-281-0x00007FF7DC710000-0x00007FF7DCB02000-memory.dmp	upx
behavioral2/memory/2260-247-0x00007FF6EBF30000-0x00007FF6EC322000-memory.dmp	upx
behavioral2/memory/4544-237-0x00007FF638A90000-0x00007FF638E82000-memory.dmp	upx
behavioral2/memory/5020-236-0x00007FF7C19D0000-0x00007FF7C1DC2000-memory.dmp	upx
behavioral2/memory/4428-220-0x00007FF7FB560000-0x00007FF7FB952000-memory.dmp	upx
behavioral2/memory/4136-181-0x00007FF6DD6C0000-0x00007FF6DDAB2000-memory.dmp	upx
behavioral2/files/0x0007000000023444-177.dat	upx
behavioral2/files/0x0007000000023443-174.dat	upx
behavioral2/files/0x0007000000023451-170.dat	upx
behavioral2/files/0x0007000000023448-168.dat	upx
behavioral2/files/0x0007000000023447-166.dat	upx
behavioral2/files/0x0007000000023450-165.dat	upx
behavioral2/files/0x000700000002344f-164.dat	upx
behavioral2/files/0x0007000000023441-162.dat	upx
behavioral2/files/0x000700000002344d-160.dat	upx
behavioral2/files/0x000700000002344c-159.dat	upx
behavioral2/files/0x000700000002344b-158.dat	upx
behavioral2/files/0x000700000002344a-155.dat	upx
behavioral2/files/0x000700000002343c-141.dat	upx
behavioral2/files/0x0007000000023446-133.dat	upx
behavioral2/files/0x0007000000023445-132.dat	upx
behavioral2/files/0x000700000002343e-126.dat	upx
behavioral2/files/0x000700000002343f-156.dat	upx
behavioral2/files/0x000700000002343d-123.dat	upx
behavioral2/files/0x0007000000023449-154.dat	upx
behavioral2/memory/4296-116-0x00007FF7C5020000-0x00007FF7C5412000-memory.dmp	upx
behavioral2/files/0x0007000000023442-115.dat	upx
behavioral2/files/0x0007000000023437-111.dat	upx
behavioral2/files/0x000700000002343b-109.dat	upx
behavioral2/files/0x0007000000023436-103.dat	upx
behavioral2/files/0x0007000000023438-94.dat	upx
behavioral2/memory/2712-120-0x00007FF7EB8A0000-0x00007FF7EBC92000-memory.dmp	upx
behavioral2/files/0x000700000002343a-84.dat	upx
behavioral2/memory/1092-83-0x00007FF69E4D0000-0x00007FF69E8C2000-memory.dmp	upx
behavioral2/files/0x0007000000023439-98.dat	upx
behavioral2/files/0x0007000000023434-69.dat	upx
behavioral2/files/0x0007000000023435-50.dat	upx
behavioral2/files/0x0007000000023432-49.dat	upx
behavioral2/files/0x0007000000023430-41.dat	upx
behavioral2/files/0x000800000002342d-14.dat	upx
behavioral2/files/0x00090000000233cb-23.dat	upx
behavioral2/memory/5064-11-0x00007FF77B610000-0x00007FF77BA02000-memory.dmp	upx
behavioral2/memory/5064-4518-0x00007FF77B610000-0x00007FF77BA02000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fQCHWfm.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\THqAKLb.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\wkQKwVT.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\wNpFBmK.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\bcPeKMR.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\AYWxYaK.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\WWrZicI.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\VGEJNPR.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\vgeyZdA.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\uVSfAjF.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\uvMGVdY.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\QNBxVHW.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\owTvDpK.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\xUYwujt.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\cFLyBsp.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\DyjcVhN.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\AGtBnNH.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\kHSPmqs.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\SvEYmfS.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\wlWnefP.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\QDiXjlo.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\EaLtBuJ.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\aFqdjoU.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\VPvyvxY.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\eIBqQIp.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\wmUygJE.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\ZHDErXG.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\PCSipAh.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\SxFmsjG.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\CKaLxWL.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\MNTkODX.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\lkhGiIg.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\uHfXkZl.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\nlhAJuG.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\GBUntLI.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\vpEsBJn.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\HkJDMNJ.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\rAzUDaL.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\JCkCVkT.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\TuRYAKZ.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\ApXIUxw.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\DARQVwR.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\jXDkTKR.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\lpOGCpS.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\celXUoC.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\WAaCKcA.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\cQrqvmn.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\xinadrP.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\rDqgQab.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\LnCDvpx.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\LKzyWCt.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\xKgNryP.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\FXjTEEv.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\WuuFCfR.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\dJFTlCG.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\cGBANXA.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\yZErlgf.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\qHAevQM.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\OxAbrko.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\GTzOlOf.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\coFLtPX.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\rHSXWoT.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\vjuYokU.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
File created	C:\Windows\System\GUXOUci.exe	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3732	powershell.exe
3732	powershell.exe
3732	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeLockMemoryPrivilege	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
Token: SeLockMemoryPrivilege	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
Token: SeCreateGlobalPrivilege	15124	dwm.exe
Token: SeChangeNotifyPrivilege	15124	dwm.exe
Token: 33	15124	dwm.exe
Token: SeIncBasePriorityPrivilege	15124	dwm.exe
Token: SeCreateGlobalPrivilege	14844	dwm.exe
Token: SeChangeNotifyPrivilege	14844	dwm.exe
Token: 33	14844	dwm.exe
Token: SeIncBasePriorityPrivilege	14844	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 3732	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	84
PID 644 wrote to memory of 3732	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	84
PID 644 wrote to memory of 5064	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	85
PID 644 wrote to memory of 5064	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	85
PID 644 wrote to memory of 3516	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	86
PID 644 wrote to memory of 3516	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	86
PID 644 wrote to memory of 4296	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	87
PID 644 wrote to memory of 4296	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	87
PID 644 wrote to memory of 1036	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	88
PID 644 wrote to memory of 1036	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	88
PID 644 wrote to memory of 1092	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	89
PID 644 wrote to memory of 1092	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	89
PID 644 wrote to memory of 2712	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	90
PID 644 wrote to memory of 2712	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	90
PID 644 wrote to memory of 4136	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	91
PID 644 wrote to memory of 4136	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	91
PID 644 wrote to memory of 4428	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	92
PID 644 wrote to memory of 4428	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	92
PID 644 wrote to memory of 5020	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	93
PID 644 wrote to memory of 5020	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	93
PID 644 wrote to memory of 4544	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	94
PID 644 wrote to memory of 4544	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	94
PID 644 wrote to memory of 2260	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	95
PID 644 wrote to memory of 2260	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	95
PID 644 wrote to memory of 3136	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	96
PID 644 wrote to memory of 3136	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	96
PID 644 wrote to memory of 3064	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	97
PID 644 wrote to memory of 3064	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	97
PID 644 wrote to memory of 244	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	98
PID 644 wrote to memory of 244	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	98
PID 644 wrote to memory of 2936	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	99
PID 644 wrote to memory of 2936	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	99
PID 644 wrote to memory of 4180	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	100
PID 644 wrote to memory of 4180	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	100
PID 644 wrote to memory of 1088	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	101
PID 644 wrote to memory of 1088	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	101
PID 644 wrote to memory of 3588	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	102
PID 644 wrote to memory of 3588	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	102
PID 644 wrote to memory of 3628	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	103
PID 644 wrote to memory of 3628	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	103
PID 644 wrote to memory of 1888	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	104
PID 644 wrote to memory of 1888	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	104
PID 644 wrote to memory of 2132	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	105
PID 644 wrote to memory of 2132	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	105
PID 644 wrote to memory of 4808	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	106
PID 644 wrote to memory of 4808	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	106
PID 644 wrote to memory of 1808	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	107
PID 644 wrote to memory of 1808	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	107
PID 644 wrote to memory of 4468	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	108
PID 644 wrote to memory of 4468	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	108
PID 644 wrote to memory of 2172	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	109
PID 644 wrote to memory of 2172	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	109
PID 644 wrote to memory of 2476	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	110
PID 644 wrote to memory of 2476	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	110
PID 644 wrote to memory of 4980	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	111
PID 644 wrote to memory of 4980	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	111
PID 644 wrote to memory of 3484	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	112
PID 644 wrote to memory of 3484	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	112
PID 644 wrote to memory of 4908	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	113
PID 644 wrote to memory of 4908	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	113
PID 644 wrote to memory of 3672	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	114
PID 644 wrote to memory of 3672	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	114
PID 644 wrote to memory of 4672	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	115
PID 644 wrote to memory of 4672	644	ad869f865c93a6cc2927bcdd6e8f2fe0N.exe	115

C:\Users\Admin\AppData\Local\Temp\ad869f865c93a6cc2927bcdd6e8f2fe0N.exe
"C:\Users\Admin\AppData\Local\Temp\ad869f865c93a6cc2927bcdd6e8f2fe0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3732" "3016" "2920" "3020" "0" "0" "3024" "0" "0" "0" "0" "0"
    3⤵
    PID:12116
- C:\Windows\System\rpUBLIA.exe
  C:\Windows\System\rpUBLIA.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\KvDXjIX.exe
  C:\Windows\System\KvDXjIX.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\YsNxpqO.exe
  C:\Windows\System\YsNxpqO.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\UzSsdKd.exe
  C:\Windows\System\UzSsdKd.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\IgOwojj.exe
  C:\Windows\System\IgOwojj.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\pMXZoSF.exe
  C:\Windows\System\pMXZoSF.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\nWYeGpa.exe
  C:\Windows\System\nWYeGpa.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\DGmkKdC.exe
  C:\Windows\System\DGmkKdC.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\yQdmAlx.exe
  C:\Windows\System\yQdmAlx.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\twDPJMi.exe
  C:\Windows\System\twDPJMi.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\eNiDhwt.exe
  C:\Windows\System\eNiDhwt.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\Usabclt.exe
  C:\Windows\System\Usabclt.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\ZTLQuXH.exe
  C:\Windows\System\ZTLQuXH.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\NAZabmO.exe
  C:\Windows\System\NAZabmO.exe
  2⤵
  - Executes dropped EXE
  PID:244
- C:\Windows\System\UEvNNgB.exe
  C:\Windows\System\UEvNNgB.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\ygZLrbN.exe
  C:\Windows\System\ygZLrbN.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\kXpTShH.exe
  C:\Windows\System\kXpTShH.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\wtrFtof.exe
  C:\Windows\System\wtrFtof.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\hQrOjjn.exe
  C:\Windows\System\hQrOjjn.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\drzQArQ.exe
  C:\Windows\System\drzQArQ.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\VXwZRfP.exe
  C:\Windows\System\VXwZRfP.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\pkrPawp.exe
  C:\Windows\System\pkrPawp.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\oBhkXOx.exe
  C:\Windows\System\oBhkXOx.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\HmRAoBa.exe
  C:\Windows\System\HmRAoBa.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\wEUjQKu.exe
  C:\Windows\System\wEUjQKu.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\MGgmGqT.exe
  C:\Windows\System\MGgmGqT.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\DhyubKB.exe
  C:\Windows\System\DhyubKB.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\DTPkHhs.exe
  C:\Windows\System\DTPkHhs.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\HkLJgmH.exe
  C:\Windows\System\HkLJgmH.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\SOecfIu.exe
  C:\Windows\System\SOecfIu.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\qqRIIvY.exe
  C:\Windows\System\qqRIIvY.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\mHVANjX.exe
  C:\Windows\System\mHVANjX.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\BnWiZSQ.exe
  C:\Windows\System\BnWiZSQ.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\iDnBQDC.exe
  C:\Windows\System\iDnBQDC.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\QCiVFJL.exe
  C:\Windows\System\QCiVFJL.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\vMIyKOj.exe
  C:\Windows\System\vMIyKOj.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\HkhTNYK.exe
  C:\Windows\System\HkhTNYK.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\DmBrzpI.exe
  C:\Windows\System\DmBrzpI.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\qjMQgwm.exe
  C:\Windows\System\qjMQgwm.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\kUfKLDW.exe
  C:\Windows\System\kUfKLDW.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\FEQAURJ.exe
  C:\Windows\System\FEQAURJ.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\zGnfgJJ.exe
  C:\Windows\System\zGnfgJJ.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\tjpMsMR.exe
  C:\Windows\System\tjpMsMR.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\cgvtooc.exe
  C:\Windows\System\cgvtooc.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\ZezBUIT.exe
  C:\Windows\System\ZezBUIT.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\bJwiXgU.exe
  C:\Windows\System\bJwiXgU.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\xBOhXCX.exe
  C:\Windows\System\xBOhXCX.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\LfhOnWA.exe
  C:\Windows\System\LfhOnWA.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\TQLusVy.exe
  C:\Windows\System\TQLusVy.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\IDtSezN.exe
  C:\Windows\System\IDtSezN.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\eJHnsMU.exe
  C:\Windows\System\eJHnsMU.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\DQWtjGI.exe
  C:\Windows\System\DQWtjGI.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\UGgZNqE.exe
  C:\Windows\System\UGgZNqE.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\gqZLZFR.exe
  C:\Windows\System\gqZLZFR.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\FAOiOpE.exe
  C:\Windows\System\FAOiOpE.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\ZuHxdbM.exe
  C:\Windows\System\ZuHxdbM.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\WsNTQEb.exe
  C:\Windows\System\WsNTQEb.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\NeBAzck.exe
  C:\Windows\System\NeBAzck.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\YldGxKL.exe
  C:\Windows\System\YldGxKL.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\vnHZfLM.exe
  C:\Windows\System\vnHZfLM.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\LSoIOQz.exe
  C:\Windows\System\LSoIOQz.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\GKRFAOm.exe
  C:\Windows\System\GKRFAOm.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\lvMvcbs.exe
  C:\Windows\System\lvMvcbs.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\HNCYlop.exe
  C:\Windows\System\HNCYlop.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\XRxQpRt.exe
  C:\Windows\System\XRxQpRt.exe
  2⤵
  PID:1584
- C:\Windows\System\owlPyzQ.exe
  C:\Windows\System\owlPyzQ.exe
  2⤵
  PID:1948
- C:\Windows\System\emHYLXH.exe
  C:\Windows\System\emHYLXH.exe
  2⤵
  PID:4884
- C:\Windows\System\ZAziODk.exe
  C:\Windows\System\ZAziODk.exe
  2⤵
  PID:396
- C:\Windows\System\iEYlNCO.exe
  C:\Windows\System\iEYlNCO.exe
  2⤵
  PID:4700
- C:\Windows\System\MkmkYxK.exe
  C:\Windows\System\MkmkYxK.exe
  2⤵
  PID:3964
- C:\Windows\System\DLMCHmm.exe
  C:\Windows\System\DLMCHmm.exe
  2⤵
  PID:5084
- C:\Windows\System\upVlqpi.exe
  C:\Windows\System\upVlqpi.exe
  2⤵
  PID:4300
- C:\Windows\System\AiJEbGz.exe
  C:\Windows\System\AiJEbGz.exe
  2⤵
  PID:3520
- C:\Windows\System\INxKZmJ.exe
  C:\Windows\System\INxKZmJ.exe
  2⤵
  PID:468
- C:\Windows\System\FNAuThz.exe
  C:\Windows\System\FNAuThz.exe
  2⤵
  PID:1928
- C:\Windows\System\vEqZGzn.exe
  C:\Windows\System\vEqZGzn.exe
  2⤵
  PID:1196
- C:\Windows\System\XDgUPwb.exe
  C:\Windows\System\XDgUPwb.exe
  2⤵
  PID:5008
- C:\Windows\System\aJFRacr.exe
  C:\Windows\System\aJFRacr.exe
  2⤵
  PID:3248
- C:\Windows\System\kkMpuPT.exe
  C:\Windows\System\kkMpuPT.exe
  2⤵
  PID:1344
- C:\Windows\System\zveiFsY.exe
  C:\Windows\System\zveiFsY.exe
  2⤵
  PID:4444
- C:\Windows\System\gchOzIq.exe
  C:\Windows\System\gchOzIq.exe
  2⤵
  PID:3808
- C:\Windows\System\hwuEOWw.exe
  C:\Windows\System\hwuEOWw.exe
  2⤵
  PID:216
- C:\Windows\System\PONTUUi.exe
  C:\Windows\System\PONTUUi.exe
  2⤵
  PID:3384
- C:\Windows\System\enxLXEr.exe
  C:\Windows\System\enxLXEr.exe
  2⤵
  PID:2288
- C:\Windows\System\iwyQzgi.exe
  C:\Windows\System\iwyQzgi.exe
  2⤵
  PID:5124
- C:\Windows\System\cWkcNeP.exe
  C:\Windows\System\cWkcNeP.exe
  2⤵
  PID:5152
- C:\Windows\System\jQlXZfc.exe
  C:\Windows\System\jQlXZfc.exe
  2⤵
  PID:5168
- C:\Windows\System\VjytjnK.exe
  C:\Windows\System\VjytjnK.exe
  2⤵
  PID:5224
- C:\Windows\System\jIQlMGz.exe
  C:\Windows\System\jIQlMGz.exe
  2⤵
  PID:5248
- C:\Windows\System\oeVZYXb.exe
  C:\Windows\System\oeVZYXb.exe
  2⤵
  PID:5268
- C:\Windows\System\NTeGYGR.exe
  C:\Windows\System\NTeGYGR.exe
  2⤵
  PID:5288
- C:\Windows\System\UGDmCLG.exe
  C:\Windows\System\UGDmCLG.exe
  2⤵
  PID:5324
- C:\Windows\System\IaRcKKX.exe
  C:\Windows\System\IaRcKKX.exe
  2⤵
  PID:5348
- C:\Windows\System\ImKArRx.exe
  C:\Windows\System\ImKArRx.exe
  2⤵
  PID:5372
- C:\Windows\System\UclHJoo.exe
  C:\Windows\System\UclHJoo.exe
  2⤵
  PID:5388
- C:\Windows\System\BLDKlOe.exe
  C:\Windows\System\BLDKlOe.exe
  2⤵
  PID:5404
- C:\Windows\System\cwjtTZu.exe
  C:\Windows\System\cwjtTZu.exe
  2⤵
  PID:5420
- C:\Windows\System\sGKuJix.exe
  C:\Windows\System\sGKuJix.exe
  2⤵
  PID:5456
- C:\Windows\System\GvVNJum.exe
  C:\Windows\System\GvVNJum.exe
  2⤵
  PID:5540
- C:\Windows\System\QaBkYGD.exe
  C:\Windows\System\QaBkYGD.exe
  2⤵
  PID:5560
- C:\Windows\System\gQyDdox.exe
  C:\Windows\System\gQyDdox.exe
  2⤵
  PID:5588
- C:\Windows\System\qHciTzu.exe
  C:\Windows\System\qHciTzu.exe
  2⤵
  PID:5604
- C:\Windows\System\IGxBMlO.exe
  C:\Windows\System\IGxBMlO.exe
  2⤵
  PID:5628
- C:\Windows\System\PdGEBOs.exe
  C:\Windows\System\PdGEBOs.exe
  2⤵
  PID:5648
- C:\Windows\System\YRWzyqa.exe
  C:\Windows\System\YRWzyqa.exe
  2⤵
  PID:5668
- C:\Windows\System\lCcgbIA.exe
  C:\Windows\System\lCcgbIA.exe
  2⤵
  PID:5704
- C:\Windows\System\KLfKKuf.exe
  C:\Windows\System\KLfKKuf.exe
  2⤵
  PID:5732
- C:\Windows\System\NPZFJPq.exe
  C:\Windows\System\NPZFJPq.exe
  2⤵
  PID:6040
- C:\Windows\System\wphaWFy.exe
  C:\Windows\System\wphaWFy.exe
  2⤵
  PID:6056
- C:\Windows\System\BiecZSb.exe
  C:\Windows\System\BiecZSb.exe
  2⤵
  PID:6072
- C:\Windows\System\eeDxdsv.exe
  C:\Windows\System\eeDxdsv.exe
  2⤵
  PID:6096
- C:\Windows\System\HxtQxlA.exe
  C:\Windows\System\HxtQxlA.exe
  2⤵
  PID:6112
- C:\Windows\System\HfbtuWV.exe
  C:\Windows\System\HfbtuWV.exe
  2⤵
  PID:6136
- C:\Windows\System\mwWXIBc.exe
  C:\Windows\System\mwWXIBc.exe
  2⤵
  PID:2128
- C:\Windows\System\VSukfhG.exe
  C:\Windows\System\VSukfhG.exe
  2⤵
  PID:4184
- C:\Windows\System\DNpMyqA.exe
  C:\Windows\System\DNpMyqA.exe
  2⤵
  PID:4012
- C:\Windows\System\nraznAL.exe
  C:\Windows\System\nraznAL.exe
  2⤵
  PID:4200
- C:\Windows\System\LNTRsps.exe
  C:\Windows\System\LNTRsps.exe
  2⤵
  PID:756
- C:\Windows\System\diPzveZ.exe
  C:\Windows\System\diPzveZ.exe
  2⤵
  PID:2512
- C:\Windows\System\vhZPJhC.exe
  C:\Windows\System\vhZPJhC.exe
  2⤵
  PID:1032
- C:\Windows\System\fTEPuke.exe
  C:\Windows\System\fTEPuke.exe
  2⤵
  PID:1684
- C:\Windows\System\vClyNvs.exe
  C:\Windows\System\vClyNvs.exe
  2⤵
  PID:3740
- C:\Windows\System\iQlxVEG.exe
  C:\Windows\System\iQlxVEG.exe
  2⤵
  PID:5280
- C:\Windows\System\KxFtMRd.exe
  C:\Windows\System\KxFtMRd.exe
  2⤵
  PID:5336
- C:\Windows\System\VGEJNPR.exe
  C:\Windows\System\VGEJNPR.exe
  2⤵
  PID:5380
- C:\Windows\System\BNIzLQU.exe
  C:\Windows\System\BNIzLQU.exe
  2⤵
  PID:5416
- C:\Windows\System\jRsREyx.exe
  C:\Windows\System\jRsREyx.exe
  2⤵
  PID:5452
- C:\Windows\System\VtTwABs.exe
  C:\Windows\System\VtTwABs.exe
  2⤵
  PID:5508
- C:\Windows\System\xADwIHE.exe
  C:\Windows\System\xADwIHE.exe
  2⤵
  PID:1224
- C:\Windows\System\ytdsZKx.exe
  C:\Windows\System\ytdsZKx.exe
  2⤵
  PID:5716
- C:\Windows\System\tVkBobc.exe
  C:\Windows\System\tVkBobc.exe
  2⤵
  PID:5680
- C:\Windows\System\WYwIZKR.exe
  C:\Windows\System\WYwIZKR.exe
  2⤵
  PID:5644
- C:\Windows\System\CQwrKnu.exe
  C:\Windows\System\CQwrKnu.exe
  2⤵
  PID:5620
- C:\Windows\System\HDIWIem.exe
  C:\Windows\System\HDIWIem.exe
  2⤵
  PID:5580
- C:\Windows\System\jWQFGdI.exe
  C:\Windows\System\jWQFGdI.exe
  2⤵
  PID:5536
- C:\Windows\System\VNikSjP.exe
  C:\Windows\System\VNikSjP.exe
  2⤵
  PID:5924
- C:\Windows\System\JiitUgf.exe
  C:\Windows\System\JiitUgf.exe
  2⤵
  PID:5948
- C:\Windows\System\oGJWIis.exe
  C:\Windows\System\oGJWIis.exe
  2⤵
  PID:5988
- C:\Windows\System\wdRbsQy.exe
  C:\Windows\System\wdRbsQy.exe
  2⤵
  PID:5188
- C:\Windows\System\tqOCxDo.exe
  C:\Windows\System\tqOCxDo.exe
  2⤵
  PID:6064
- C:\Windows\System\TrriqYT.exe
  C:\Windows\System\TrriqYT.exe
  2⤵
  PID:6108
- C:\Windows\System\hAGRLnt.exe
  C:\Windows\System\hAGRLnt.exe
  2⤵
  PID:6148
- C:\Windows\System\cWVcsrM.exe
  C:\Windows\System\cWVcsrM.exe
  2⤵
  PID:6172
- C:\Windows\System\ZCZOPYk.exe
  C:\Windows\System\ZCZOPYk.exe
  2⤵
  PID:6196
- C:\Windows\System\MsRodEL.exe
  C:\Windows\System\MsRodEL.exe
  2⤵
  PID:6216
- C:\Windows\System\PnEheXF.exe
  C:\Windows\System\PnEheXF.exe
  2⤵
  PID:6236
- C:\Windows\System\jxdOdxW.exe
  C:\Windows\System\jxdOdxW.exe
  2⤵
  PID:6260
- C:\Windows\System\pqMlSLP.exe
  C:\Windows\System\pqMlSLP.exe
  2⤵
  PID:6276
- C:\Windows\System\vBXVETd.exe
  C:\Windows\System\vBXVETd.exe
  2⤵
  PID:6300
- C:\Windows\System\TrGlMAY.exe
  C:\Windows\System\TrGlMAY.exe
  2⤵
  PID:6324
- C:\Windows\System\QZlysUE.exe
  C:\Windows\System\QZlysUE.exe
  2⤵
  PID:6340
- C:\Windows\System\HMYXIEi.exe
  C:\Windows\System\HMYXIEi.exe
  2⤵
  PID:6364
- C:\Windows\System\yfsKZzp.exe
  C:\Windows\System\yfsKZzp.exe
  2⤵
  PID:6388
- C:\Windows\System\YOYhKff.exe
  C:\Windows\System\YOYhKff.exe
  2⤵
  PID:6404
- C:\Windows\System\FjpLElk.exe
  C:\Windows\System\FjpLElk.exe
  2⤵
  PID:6432
- C:\Windows\System\sPHrVGp.exe
  C:\Windows\System\sPHrVGp.exe
  2⤵
  PID:6448
- C:\Windows\System\LxFxvMf.exe
  C:\Windows\System\LxFxvMf.exe
  2⤵
  PID:6608
- C:\Windows\System\lAnDgny.exe
  C:\Windows\System\lAnDgny.exe
  2⤵
  PID:6636
- C:\Windows\System\lsdRWqy.exe
  C:\Windows\System\lsdRWqy.exe
  2⤵
  PID:6652
- C:\Windows\System\GTGZMgg.exe
  C:\Windows\System\GTGZMgg.exe
  2⤵
  PID:6676
- C:\Windows\System\eAEAyVv.exe
  C:\Windows\System\eAEAyVv.exe
  2⤵
  PID:6816
- C:\Windows\System\vRDNtLk.exe
  C:\Windows\System\vRDNtLk.exe
  2⤵
  PID:6832
- C:\Windows\System\RAnrfZB.exe
  C:\Windows\System\RAnrfZB.exe
  2⤵
  PID:6848
- C:\Windows\System\UaqOHqh.exe
  C:\Windows\System\UaqOHqh.exe
  2⤵
  PID:6872
- C:\Windows\System\asBhZXR.exe
  C:\Windows\System\asBhZXR.exe
  2⤵
  PID:6908
- C:\Windows\System\rcKgkdi.exe
  C:\Windows\System\rcKgkdi.exe
  2⤵
  PID:6928
- C:\Windows\System\FBfWJsL.exe
  C:\Windows\System\FBfWJsL.exe
  2⤵
  PID:6944
- C:\Windows\System\XjcgWcW.exe
  C:\Windows\System\XjcgWcW.exe
  2⤵
  PID:6960
- C:\Windows\System\GAIHZQV.exe
  C:\Windows\System\GAIHZQV.exe
  2⤵
  PID:6976
- C:\Windows\System\bAAXqeP.exe
  C:\Windows\System\bAAXqeP.exe
  2⤵
  PID:7000
- C:\Windows\System\czSiHvi.exe
  C:\Windows\System\czSiHvi.exe
  2⤵
  PID:7020
- C:\Windows\System\JhfIXjS.exe
  C:\Windows\System\JhfIXjS.exe
  2⤵
  PID:7040
- C:\Windows\System\ozhETJA.exe
  C:\Windows\System\ozhETJA.exe
  2⤵
  PID:7056
- C:\Windows\System\uZFtdCp.exe
  C:\Windows\System\uZFtdCp.exe
  2⤵
  PID:7076
- C:\Windows\System\ZGgIwSU.exe
  C:\Windows\System\ZGgIwSU.exe
  2⤵
  PID:7096
- C:\Windows\System\rAzUDaL.exe
  C:\Windows\System\rAzUDaL.exe
  2⤵
  PID:7116
- C:\Windows\System\OELfYpM.exe
  C:\Windows\System\OELfYpM.exe
  2⤵
  PID:7132
- C:\Windows\System\oysBqdb.exe
  C:\Windows\System\oysBqdb.exe
  2⤵
  PID:7148
- C:\Windows\System\yfPoaAX.exe
  C:\Windows\System\yfPoaAX.exe
  2⤵
  PID:3240
- C:\Windows\System\OODynOd.exe
  C:\Windows\System\OODynOd.exe
  2⤵
  PID:5276
- C:\Windows\System\HNRnLsS.exe
  C:\Windows\System\HNRnLsS.exe
  2⤵
  PID:3528
- C:\Windows\System\dbwGFyK.exe
  C:\Windows\System\dbwGFyK.exe
  2⤵
  PID:5484
- C:\Windows\System\kDFwkoB.exe
  C:\Windows\System\kDFwkoB.exe
  2⤵
  PID:5696
- C:\Windows\System\mFAJwhd.exe
  C:\Windows\System\mFAJwhd.exe
  2⤵
  PID:5624
- C:\Windows\System\HpaOtpA.exe
  C:\Windows\System\HpaOtpA.exe
  2⤵
  PID:5568
- C:\Windows\System\uaXGPIA.exe
  C:\Windows\System\uaXGPIA.exe
  2⤵
  PID:5972
- C:\Windows\System\cHnhYcC.exe
  C:\Windows\System\cHnhYcC.exe
  2⤵
  PID:6052
- C:\Windows\System\jKHoeIf.exe
  C:\Windows\System\jKHoeIf.exe
  2⤵
  PID:4944
- C:\Windows\System\QbVOAFP.exe
  C:\Windows\System\QbVOAFP.exe
  2⤵
  PID:1236
- C:\Windows\System\wLfEvPc.exe
  C:\Windows\System\wLfEvPc.exe
  2⤵
  PID:4508
- C:\Windows\System\rnsPSXQ.exe
  C:\Windows\System\rnsPSXQ.exe
  2⤵
  PID:6188
- C:\Windows\System\UhNSPsv.exe
  C:\Windows\System\UhNSPsv.exe
  2⤵
  PID:6224
- C:\Windows\System\XtYSwhW.exe
  C:\Windows\System\XtYSwhW.exe
  2⤵
  PID:6272
- C:\Windows\System\erPIOei.exe
  C:\Windows\System\erPIOei.exe
  2⤵
  PID:6320
- C:\Windows\System\MsywwlW.exe
  C:\Windows\System\MsywwlW.exe
  2⤵
  PID:6372
- C:\Windows\System\GaKpocY.exe
  C:\Windows\System\GaKpocY.exe
  2⤵
  PID:6420
- C:\Windows\System\qBWUBDy.exe
  C:\Windows\System\qBWUBDy.exe
  2⤵
  PID:6460
- C:\Windows\System\kdSAymf.exe
  C:\Windows\System\kdSAymf.exe
  2⤵
  PID:6592
- C:\Windows\System\GzYcmPp.exe
  C:\Windows\System\GzYcmPp.exe
  2⤵
  PID:6628
- C:\Windows\System\ZplYZUL.exe
  C:\Windows\System\ZplYZUL.exe
  2⤵
  PID:6684
- C:\Windows\System\tEyCdyF.exe
  C:\Windows\System\tEyCdyF.exe
  2⤵
  PID:6844
- C:\Windows\System\KbozqVj.exe
  C:\Windows\System\KbozqVj.exe
  2⤵
  PID:4240
- C:\Windows\System\hZvaZmo.exe
  C:\Windows\System\hZvaZmo.exe
  2⤵
  PID:5092
- C:\Windows\System\PTCnyfP.exe
  C:\Windows\System\PTCnyfP.exe
  2⤵
  PID:2756
- C:\Windows\System\HhIRxbX.exe
  C:\Windows\System\HhIRxbX.exe
  2⤵
  PID:2212
- C:\Windows\System\ffDQxqG.exe
  C:\Windows\System\ffDQxqG.exe
  2⤵
  PID:5000
- C:\Windows\System\UHqvAgf.exe
  C:\Windows\System\UHqvAgf.exe
  2⤵
  PID:5304
- C:\Windows\System\RJOcAjr.exe
  C:\Windows\System\RJOcAjr.exe
  2⤵
  PID:5476
- C:\Windows\System\abOdQEG.exe
  C:\Windows\System\abOdQEG.exe
  2⤵
  PID:6860
- C:\Windows\System\uXDIRuS.exe
  C:\Windows\System\uXDIRuS.exe
  2⤵
  PID:6884
- C:\Windows\System\AEXOJAN.exe
  C:\Windows\System\AEXOJAN.exe
  2⤵
  PID:388
- C:\Windows\System\cIKLfKy.exe
  C:\Windows\System\cIKLfKy.exe
  2⤵
  PID:184
- C:\Windows\System\GThsQNU.exe
  C:\Windows\System\GThsQNU.exe
  2⤵
  PID:2740
- C:\Windows\System\NiXStzj.exe
  C:\Windows\System\NiXStzj.exe
  2⤵
  PID:3132
- C:\Windows\System\JyxZMeT.exe
  C:\Windows\System\JyxZMeT.exe
  2⤵
  PID:2836
- C:\Windows\System\nLRytYi.exe
  C:\Windows\System\nLRytYi.exe
  2⤵
  PID:2572
- C:\Windows\System\PgtPmkS.exe
  C:\Windows\System\PgtPmkS.exe
  2⤵
  PID:3124
- C:\Windows\System\SvpvPmX.exe
  C:\Windows\System\SvpvPmX.exe
  2⤵
  PID:7008
- C:\Windows\System\aGnmbfc.exe
  C:\Windows\System\aGnmbfc.exe
  2⤵
  PID:7064
- C:\Windows\System\DirwmBj.exe
  C:\Windows\System\DirwmBj.exe
  2⤵
  PID:4964
- C:\Windows\System\Wkwksus.exe
  C:\Windows\System\Wkwksus.exe
  2⤵
  PID:1656
- C:\Windows\System\mBQmeOW.exe
  C:\Windows\System\mBQmeOW.exe
  2⤵
  PID:6952
- C:\Windows\System\VfRPFRr.exe
  C:\Windows\System\VfRPFRr.exe
  2⤵
  PID:6940
- C:\Windows\System\jjwtRQX.exe
  C:\Windows\System\jjwtRQX.exe
  2⤵
  PID:7072
- C:\Windows\System\IWBbDSR.exe
  C:\Windows\System\IWBbDSR.exe
  2⤵
  PID:3648
- C:\Windows\System\UpahQjT.exe
  C:\Windows\System\UpahQjT.exe
  2⤵
  PID:6180
- C:\Windows\System\qZKHtvF.exe
  C:\Windows\System\qZKHtvF.exe
  2⤵
  PID:5660
- C:\Windows\System\bacnbUx.exe
  C:\Windows\System\bacnbUx.exe
  2⤵
  PID:6400
- C:\Windows\System\FpeQAkd.exe
  C:\Windows\System\FpeQAkd.exe
  2⤵
  PID:5724
- C:\Windows\System\wXduqoM.exe
  C:\Windows\System\wXduqoM.exe
  2⤵
  PID:1596
- C:\Windows\System\SppTcHi.exe
  C:\Windows\System\SppTcHi.exe
  2⤵
  PID:6568
- C:\Windows\System\EmJBmEZ.exe
  C:\Windows\System\EmJBmEZ.exe
  2⤵
  PID:316
- C:\Windows\System\ICXllya.exe
  C:\Windows\System\ICXllya.exe
  2⤵
  PID:6256
- C:\Windows\System\veSDQGa.exe
  C:\Windows\System\veSDQGa.exe
  2⤵
  PID:7188
- C:\Windows\System\nkIfiCZ.exe
  C:\Windows\System\nkIfiCZ.exe
  2⤵
  PID:7208
- C:\Windows\System\ghafejc.exe
  C:\Windows\System\ghafejc.exe
  2⤵
  PID:7224
- C:\Windows\System\ZHDErXG.exe
  C:\Windows\System\ZHDErXG.exe
  2⤵
  PID:7248
- C:\Windows\System\KyUOhNZ.exe
  C:\Windows\System\KyUOhNZ.exe
  2⤵
  PID:7264
- C:\Windows\System\kEFHsBw.exe
  C:\Windows\System\kEFHsBw.exe
  2⤵
  PID:7288
- C:\Windows\System\psvxDij.exe
  C:\Windows\System\psvxDij.exe
  2⤵
  PID:7320
- C:\Windows\System\ktQUAXc.exe
  C:\Windows\System\ktQUAXc.exe
  2⤵
  PID:7340
- C:\Windows\System\QEBsLAi.exe
  C:\Windows\System\QEBsLAi.exe
  2⤵
  PID:7360
- C:\Windows\System\vdaxDrk.exe
  C:\Windows\System\vdaxDrk.exe
  2⤵
  PID:7392
- C:\Windows\System\wVNUsMh.exe
  C:\Windows\System\wVNUsMh.exe
  2⤵
  PID:7416
- C:\Windows\System\wXflXXx.exe
  C:\Windows\System\wXflXXx.exe
  2⤵
  PID:7436
- C:\Windows\System\fQCHWfm.exe
  C:\Windows\System\fQCHWfm.exe
  2⤵
  PID:7452
- C:\Windows\System\XibRnmT.exe
  C:\Windows\System\XibRnmT.exe
  2⤵
  PID:7476
- C:\Windows\System\OWOyCIT.exe
  C:\Windows\System\OWOyCIT.exe
  2⤵
  PID:7492
- C:\Windows\System\WixBBTn.exe
  C:\Windows\System\WixBBTn.exe
  2⤵
  PID:7516
- C:\Windows\System\unPOTos.exe
  C:\Windows\System\unPOTos.exe
  2⤵
  PID:7540
- C:\Windows\System\vgvLnfi.exe
  C:\Windows\System\vgvLnfi.exe
  2⤵
  PID:7560
- C:\Windows\System\cdqzBoo.exe
  C:\Windows\System\cdqzBoo.exe
  2⤵
  PID:7584
- C:\Windows\System\ZhFeKqx.exe
  C:\Windows\System\ZhFeKqx.exe
  2⤵
  PID:7608
- C:\Windows\System\ibyRDqf.exe
  C:\Windows\System\ibyRDqf.exe
  2⤵
  PID:7628
- C:\Windows\System\CPQRioW.exe
  C:\Windows\System\CPQRioW.exe
  2⤵
  PID:7652
- C:\Windows\System\wGaKolJ.exe
  C:\Windows\System\wGaKolJ.exe
  2⤵
  PID:7672
- C:\Windows\System\UYtBJcO.exe
  C:\Windows\System\UYtBJcO.exe
  2⤵
  PID:7692
- C:\Windows\System\nRTVPCw.exe
  C:\Windows\System\nRTVPCw.exe
  2⤵
  PID:7716
- C:\Windows\System\ZMjVHeH.exe
  C:\Windows\System\ZMjVHeH.exe
  2⤵
  PID:7736
- C:\Windows\System\BmTWpgS.exe
  C:\Windows\System\BmTWpgS.exe
  2⤵
  PID:7760
- C:\Windows\System\YOCCcOy.exe
  C:\Windows\System\YOCCcOy.exe
  2⤵
  PID:7784
- C:\Windows\System\MJJNAMm.exe
  C:\Windows\System\MJJNAMm.exe
  2⤵
  PID:7808
- C:\Windows\System\cfQGrXX.exe
  C:\Windows\System\cfQGrXX.exe
  2⤵
  PID:7824
- C:\Windows\System\LyiazEo.exe
  C:\Windows\System\LyiazEo.exe
  2⤵
  PID:7848
- C:\Windows\System\kufnYFd.exe
  C:\Windows\System\kufnYFd.exe
  2⤵
  PID:7868
- C:\Windows\System\cSZLvKG.exe
  C:\Windows\System\cSZLvKG.exe
  2⤵
  PID:7892
- C:\Windows\System\fzEWUbX.exe
  C:\Windows\System\fzEWUbX.exe
  2⤵
  PID:7916
- C:\Windows\System\AvCsngJ.exe
  C:\Windows\System\AvCsngJ.exe
  2⤵
  PID:7932
- C:\Windows\System\ZCfyKwM.exe
  C:\Windows\System\ZCfyKwM.exe
  2⤵
  PID:7952
- C:\Windows\System\FfkzETp.exe
  C:\Windows\System\FfkzETp.exe
  2⤵
  PID:7976
- C:\Windows\System\GLvKEZI.exe
  C:\Windows\System\GLvKEZI.exe
  2⤵
  PID:8000
- C:\Windows\System\VBCUoAr.exe
  C:\Windows\System\VBCUoAr.exe
  2⤵
  PID:8020
- C:\Windows\System\IJCXpaM.exe
  C:\Windows\System\IJCXpaM.exe
  2⤵
  PID:8036
- C:\Windows\System\KYlxgcM.exe
  C:\Windows\System\KYlxgcM.exe
  2⤵
  PID:8064
- C:\Windows\System\mQMMoxV.exe
  C:\Windows\System\mQMMoxV.exe
  2⤵
  PID:8084
- C:\Windows\System\VMhBZVy.exe
  C:\Windows\System\VMhBZVy.exe
  2⤵
  PID:8104
- C:\Windows\System\WiuksRT.exe
  C:\Windows\System\WiuksRT.exe
  2⤵
  PID:8136
- C:\Windows\System\vwZzLSs.exe
  C:\Windows\System\vwZzLSs.exe
  2⤵
  PID:8152
- C:\Windows\System\dcNPhIs.exe
  C:\Windows\System\dcNPhIs.exe
  2⤵
  PID:8176
- C:\Windows\System\wecsBez.exe
  C:\Windows\System\wecsBez.exe
  2⤵
  PID:1284
- C:\Windows\System\EwOTluc.exe
  C:\Windows\System\EwOTluc.exe
  2⤵
  PID:7016
- C:\Windows\System\wgAXbnv.exe
  C:\Windows\System\wgAXbnv.exe
  2⤵
  PID:6920
- C:\Windows\System\MDurtfE.exe
  C:\Windows\System\MDurtfE.exe
  2⤵
  PID:3140
- C:\Windows\System\SBDYwxm.exe
  C:\Windows\System\SBDYwxm.exe
  2⤵
  PID:2644
- C:\Windows\System\DslUXGM.exe
  C:\Windows\System\DslUXGM.exe
  2⤵
  PID:6668
- C:\Windows\System\BoldqhX.exe
  C:\Windows\System\BoldqhX.exe
  2⤵
  PID:1964
- C:\Windows\System\ccFFRAR.exe
  C:\Windows\System\ccFFRAR.exe
  2⤵
  PID:4244
- C:\Windows\System\KpUzybC.exe
  C:\Windows\System\KpUzybC.exe
  2⤵
  PID:5912
- C:\Windows\System\EbbFVzq.exe
  C:\Windows\System\EbbFVzq.exe
  2⤵
  PID:2880
- C:\Windows\System\JmIbGqr.exe
  C:\Windows\System\JmIbGqr.exe
  2⤵
  PID:7180
- C:\Windows\System\DjQoyPd.exe
  C:\Windows\System\DjQoyPd.exe
  2⤵
  PID:7244
- C:\Windows\System\WINfVNX.exe
  C:\Windows\System\WINfVNX.exe
  2⤵
  PID:7272
- C:\Windows\System\lrVFWVK.exe
  C:\Windows\System\lrVFWVK.exe
  2⤵
  PID:5500
- C:\Windows\System\IQvXdYx.exe
  C:\Windows\System\IQvXdYx.exe
  2⤵
  PID:4676
- C:\Windows\System\KtbTMLw.exe
  C:\Windows\System\KtbTMLw.exe
  2⤵
  PID:7368
- C:\Windows\System\qFzrCbP.exe
  C:\Windows\System\qFzrCbP.exe
  2⤵
  PID:1120
- C:\Windows\System\YrWgWhi.exe
  C:\Windows\System\YrWgWhi.exe
  2⤵
  PID:7468
- C:\Windows\System\csFWpdF.exe
  C:\Windows\System\csFWpdF.exe
  2⤵
  PID:7500
- C:\Windows\System\PmszlwM.exe
  C:\Windows\System\PmszlwM.exe
  2⤵
  PID:4956
- C:\Windows\System\OEoKqVB.exe
  C:\Windows\System\OEoKqVB.exe
  2⤵
  PID:7196
- C:\Windows\System\PjIGyjZ.exe
  C:\Windows\System\PjIGyjZ.exe
  2⤵
  PID:7680
- C:\Windows\System\pSvTnOn.exe
  C:\Windows\System\pSvTnOn.exe
  2⤵
  PID:7256
- C:\Windows\System\KRmlFcm.exe
  C:\Windows\System\KRmlFcm.exe
  2⤵
  PID:7840
- C:\Windows\System\EotLvlL.exe
  C:\Windows\System\EotLvlL.exe
  2⤵
  PID:7864
- C:\Windows\System\JnkplXG.exe
  C:\Windows\System\JnkplXG.exe
  2⤵
  PID:7908
- C:\Windows\System\RvwhrJm.exe
  C:\Windows\System\RvwhrJm.exe
  2⤵
  PID:7928
- C:\Windows\System\arjPbca.exe
  C:\Windows\System\arjPbca.exe
  2⤵
  PID:7088
- C:\Windows\System\tSYefqv.exe
  C:\Windows\System\tSYefqv.exe
  2⤵
  PID:7972
- C:\Windows\System\nSfUONB.exe
  C:\Windows\System\nSfUONB.exe
  2⤵
  PID:7640
- C:\Windows\System\UPUvlxw.exe
  C:\Windows\System\UPUvlxw.exe
  2⤵
  PID:7708
- C:\Windows\System\MQFdPpv.exe
  C:\Windows\System\MQFdPpv.exe
  2⤵
  PID:7752
- C:\Windows\System\EXKMEGe.exe
  C:\Windows\System\EXKMEGe.exe
  2⤵
  PID:6828
- C:\Windows\System\thrvzVV.exe
  C:\Windows\System\thrvzVV.exe
  2⤵
  PID:8208
- C:\Windows\System\sdNNLSc.exe
  C:\Windows\System\sdNNLSc.exe
  2⤵
  PID:8228
- C:\Windows\System\EECPMNi.exe
  C:\Windows\System\EECPMNi.exe
  2⤵
  PID:8248
- C:\Windows\System\MGshGUD.exe
  C:\Windows\System\MGshGUD.exe
  2⤵
  PID:8272
- C:\Windows\System\ibHDHtw.exe
  C:\Windows\System\ibHDHtw.exe
  2⤵
  PID:8296
- C:\Windows\System\TmFJBZH.exe
  C:\Windows\System\TmFJBZH.exe
  2⤵
  PID:8312
- C:\Windows\System\hSMKOtp.exe
  C:\Windows\System\hSMKOtp.exe
  2⤵
  PID:8340
- C:\Windows\System\FcVngRY.exe
  C:\Windows\System\FcVngRY.exe
  2⤵
  PID:8360
- C:\Windows\System\kjfDbjn.exe
  C:\Windows\System\kjfDbjn.exe
  2⤵
  PID:8384
- C:\Windows\System\ZINfbMh.exe
  C:\Windows\System\ZINfbMh.exe
  2⤵
  PID:8404
- C:\Windows\System\fsinpZV.exe
  C:\Windows\System\fsinpZV.exe
  2⤵
  PID:8424
- C:\Windows\System\XiJHrAh.exe
  C:\Windows\System\XiJHrAh.exe
  2⤵
  PID:8444
- C:\Windows\System\vcMhBkL.exe
  C:\Windows\System\vcMhBkL.exe
  2⤵
  PID:8468
- C:\Windows\System\wkALQys.exe
  C:\Windows\System\wkALQys.exe
  2⤵
  PID:8488
- C:\Windows\System\GSkJlvw.exe
  C:\Windows\System\GSkJlvw.exe
  2⤵
  PID:8512
- C:\Windows\System\yjelUyM.exe
  C:\Windows\System\yjelUyM.exe
  2⤵
  PID:8536
- C:\Windows\System\umDTnMH.exe
  C:\Windows\System\umDTnMH.exe
  2⤵
  PID:8596
- C:\Windows\System\UNogIyx.exe
  C:\Windows\System\UNogIyx.exe
  2⤵
  PID:8620
- C:\Windows\System\FBvceOG.exe
  C:\Windows\System\FBvceOG.exe
  2⤵
  PID:8640
- C:\Windows\System\jJHoqNQ.exe
  C:\Windows\System\jJHoqNQ.exe
  2⤵
  PID:8660
- C:\Windows\System\zNZcfwI.exe
  C:\Windows\System\zNZcfwI.exe
  2⤵
  PID:8684
- C:\Windows\System\ZbBtkUK.exe
  C:\Windows\System\ZbBtkUK.exe
  2⤵
  PID:8708
- C:\Windows\System\PSJoCjH.exe
  C:\Windows\System\PSJoCjH.exe
  2⤵
  PID:8728
- C:\Windows\System\PijCvkX.exe
  C:\Windows\System\PijCvkX.exe
  2⤵
  PID:8752
- C:\Windows\System\tdmsufj.exe
  C:\Windows\System\tdmsufj.exe
  2⤵
  PID:8776
- C:\Windows\System\sdJCBBl.exe
  C:\Windows\System\sdJCBBl.exe
  2⤵
  PID:8800
- C:\Windows\System\exSPOKt.exe
  C:\Windows\System\exSPOKt.exe
  2⤵
  PID:8816
- C:\Windows\System\uHfXkZl.exe
  C:\Windows\System\uHfXkZl.exe
  2⤵
  PID:8840
- C:\Windows\System\fNJaCou.exe
  C:\Windows\System\fNJaCou.exe
  2⤵
  PID:8868
- C:\Windows\System\DxbHWfX.exe
  C:\Windows\System\DxbHWfX.exe
  2⤵
  PID:8888
- C:\Windows\System\kSlBUfc.exe
  C:\Windows\System\kSlBUfc.exe
  2⤵
  PID:8912
- C:\Windows\System\udELvrU.exe
  C:\Windows\System\udELvrU.exe
  2⤵
  PID:8932
- C:\Windows\System\kimMpVp.exe
  C:\Windows\System\kimMpVp.exe
  2⤵
  PID:8952
- C:\Windows\System\syKZbzn.exe
  C:\Windows\System\syKZbzn.exe
  2⤵
  PID:8976
- C:\Windows\System\zEXWuuo.exe
  C:\Windows\System\zEXWuuo.exe
  2⤵
  PID:9000
- C:\Windows\System\HuIYPRQ.exe
  C:\Windows\System\HuIYPRQ.exe
  2⤵
  PID:9016
- C:\Windows\System\pdkySlV.exe
  C:\Windows\System\pdkySlV.exe
  2⤵
  PID:9044
- C:\Windows\System\DLivyFP.exe
  C:\Windows\System\DLivyFP.exe
  2⤵
  PID:9072
- C:\Windows\System\icOGlkm.exe
  C:\Windows\System\icOGlkm.exe
  2⤵
  PID:9088
- C:\Windows\System\KbZPaZN.exe
  C:\Windows\System\KbZPaZN.exe
  2⤵
  PID:9116
- C:\Windows\System\obgrgZJ.exe
  C:\Windows\System\obgrgZJ.exe
  2⤵
  PID:9136
- C:\Windows\System\gLXWsTu.exe
  C:\Windows\System\gLXWsTu.exe
  2⤵
  PID:9160
- C:\Windows\System\dOcPFOY.exe
  C:\Windows\System\dOcPFOY.exe
  2⤵
  PID:9188
- C:\Windows\System\XYPcvcb.exe
  C:\Windows\System\XYPcvcb.exe
  2⤵
  PID:2464
- C:\Windows\System\SJPzQLO.exe
  C:\Windows\System\SJPzQLO.exe
  2⤵
  PID:7424
- C:\Windows\System\LVeAWMX.exe
  C:\Windows\System\LVeAWMX.exe
  2⤵
  PID:7548
- C:\Windows\System\ETZzoHc.exe
  C:\Windows\System\ETZzoHc.exe
  2⤵
  PID:6956
- C:\Windows\System\dMHEYlK.exe
  C:\Windows\System\dMHEYlK.exe
  2⤵
  PID:7464
- C:\Windows\System\kuQuExz.exe
  C:\Windows\System\kuQuExz.exe
  2⤵
  PID:4972
- C:\Windows\System\aHXhdGI.exe
  C:\Windows\System\aHXhdGI.exe
  2⤵
  PID:8096
- C:\Windows\System\hQOoDBT.exe
  C:\Windows\System\hQOoDBT.exe
  2⤵
  PID:2684
- C:\Windows\System\jmiEziz.exe
  C:\Windows\System\jmiEziz.exe
  2⤵
  PID:7432
- C:\Windows\System\SIaVNXb.exe
  C:\Windows\System\SIaVNXb.exe
  2⤵
  PID:2596
- C:\Windows\System\bhifijj.exe
  C:\Windows\System\bhifijj.exe
  2⤵
  PID:8320
- C:\Windows\System\XBgPvcf.exe
  C:\Windows\System\XBgPvcf.exe
  2⤵
  PID:6992
- C:\Windows\System\tZiPOOb.exe
  C:\Windows\System\tZiPOOb.exe
  2⤵
  PID:8436
- C:\Windows\System\SxFmsjG.exe
  C:\Windows\System\SxFmsjG.exe
  2⤵
  PID:8504
- C:\Windows\System\vCJAyxh.exe
  C:\Windows\System\vCJAyxh.exe
  2⤵
  PID:9232
- C:\Windows\System\KmfkjXw.exe
  C:\Windows\System\KmfkjXw.exe
  2⤵
  PID:9276
- C:\Windows\System\BXDPaYj.exe
  C:\Windows\System\BXDPaYj.exe
  2⤵
  PID:9296
- C:\Windows\System\jiIhYOI.exe
  C:\Windows\System\jiIhYOI.exe
  2⤵
  PID:9332
- C:\Windows\System\otmrgHw.exe
  C:\Windows\System\otmrgHw.exe
  2⤵
  PID:9352
- C:\Windows\System\RBvJkAq.exe
  C:\Windows\System\RBvJkAq.exe
  2⤵
  PID:9372
- C:\Windows\System\exsUEuh.exe
  C:\Windows\System\exsUEuh.exe
  2⤵
  PID:9404
- C:\Windows\System\qTONBsp.exe
  C:\Windows\System\qTONBsp.exe
  2⤵
  PID:9424
- C:\Windows\System\abZdKbl.exe
  C:\Windows\System\abZdKbl.exe
  2⤵
  PID:9448
- C:\Windows\System\eyWMJhK.exe
  C:\Windows\System\eyWMJhK.exe
  2⤵
  PID:9480
- C:\Windows\System\nPqPbdc.exe
  C:\Windows\System\nPqPbdc.exe
  2⤵
  PID:9500
- C:\Windows\System\pmbuTzO.exe
  C:\Windows\System\pmbuTzO.exe
  2⤵
  PID:9528
- C:\Windows\System\jzMOciC.exe
  C:\Windows\System\jzMOciC.exe
  2⤵
  PID:9548
- C:\Windows\System\TDZQrQj.exe
  C:\Windows\System\TDZQrQj.exe
  2⤵
  PID:9568
- C:\Windows\System\oiOVogT.exe
  C:\Windows\System\oiOVogT.exe
  2⤵
  PID:9588
- C:\Windows\System\zYIZfUz.exe
  C:\Windows\System\zYIZfUz.exe
  2⤵
  PID:9608
- C:\Windows\System\VkKTSsL.exe
  C:\Windows\System\VkKTSsL.exe
  2⤵
  PID:9624
- C:\Windows\System\qOTuisT.exe
  C:\Windows\System\qOTuisT.exe
  2⤵
  PID:9652
- C:\Windows\System\sgvbKhO.exe
  C:\Windows\System\sgvbKhO.exe
  2⤵
  PID:9668
- C:\Windows\System\XjZrOEj.exe
  C:\Windows\System\XjZrOEj.exe
  2⤵
  PID:9688
- C:\Windows\System\aGfkhcP.exe
  C:\Windows\System\aGfkhcP.exe
  2⤵
  PID:9716
- C:\Windows\System\ugkWBTb.exe
  C:\Windows\System\ugkWBTb.exe
  2⤵
  PID:9736
- C:\Windows\System\SdbSIbp.exe
  C:\Windows\System\SdbSIbp.exe
  2⤵
  PID:9760
- C:\Windows\System\nYsrAMQ.exe
  C:\Windows\System\nYsrAMQ.exe
  2⤵
  PID:9780
- C:\Windows\System\QwBbPhU.exe
  C:\Windows\System\QwBbPhU.exe
  2⤵
  PID:9800
- C:\Windows\System\RDgQIYt.exe
  C:\Windows\System\RDgQIYt.exe
  2⤵
  PID:9824
- C:\Windows\System\CODMefV.exe
  C:\Windows\System\CODMefV.exe
  2⤵
  PID:9852
- C:\Windows\System\bggNTHN.exe
  C:\Windows\System\bggNTHN.exe
  2⤵
  PID:9868
- C:\Windows\System\VBeTiZZ.exe
  C:\Windows\System\VBeTiZZ.exe
  2⤵
  PID:9892
- C:\Windows\System\YfqKUtl.exe
  C:\Windows\System\YfqKUtl.exe
  2⤵
  PID:9912
- C:\Windows\System\ebyBSDf.exe
  C:\Windows\System\ebyBSDf.exe
  2⤵
  PID:9936
- C:\Windows\System\JLjIlaI.exe
  C:\Windows\System\JLjIlaI.exe
  2⤵
  PID:9960
- C:\Windows\System\qDTqGwX.exe
  C:\Windows\System\qDTqGwX.exe
  2⤵
  PID:9984
- C:\Windows\System\meekrFg.exe
  C:\Windows\System\meekrFg.exe
  2⤵
  PID:10008
- C:\Windows\System\ypOkEKu.exe
  C:\Windows\System\ypOkEKu.exe
  2⤵
  PID:10024
- C:\Windows\System\hpqOoGK.exe
  C:\Windows\System\hpqOoGK.exe
  2⤵
  PID:10044
- C:\Windows\System\aMEvbDs.exe
  C:\Windows\System\aMEvbDs.exe
  2⤵
  PID:10068
- C:\Windows\System\GKxPMvh.exe
  C:\Windows\System\GKxPMvh.exe
  2⤵
  PID:10084
- C:\Windows\System\BxHDxTZ.exe
  C:\Windows\System\BxHDxTZ.exe
  2⤵
  PID:10104
- C:\Windows\System\bQnPioA.exe
  C:\Windows\System\bQnPioA.exe
  2⤵
  PID:10124
- C:\Windows\System\NZVANtY.exe
  C:\Windows\System\NZVANtY.exe
  2⤵
  PID:10152
- C:\Windows\System\HSbqmHg.exe
  C:\Windows\System\HSbqmHg.exe
  2⤵
  PID:10168
- C:\Windows\System\QhsAPHE.exe
  C:\Windows\System\QhsAPHE.exe
  2⤵
  PID:10204
- C:\Windows\System\UahyjON.exe
  C:\Windows\System\UahyjON.exe
  2⤵
  PID:10228
- C:\Windows\System\hrvRoWc.exe
  C:\Windows\System\hrvRoWc.exe
  2⤵
  PID:7488
- C:\Windows\System\PvyXDhp.exe
  C:\Windows\System\PvyXDhp.exe
  2⤵
  PID:7636
- C:\Windows\System\rFtRVxo.exe
  C:\Windows\System\rFtRVxo.exe
  2⤵
  PID:7772
- C:\Windows\System\ChKQQPC.exe
  C:\Windows\System\ChKQQPC.exe
  2⤵
  PID:8796
- C:\Windows\System\cBFTkjS.exe
  C:\Windows\System\cBFTkjS.exe
  2⤵
  PID:8172
- C:\Windows\System\ZOCQgzw.exe
  C:\Windows\System\ZOCQgzw.exe
  2⤵
  PID:8928
- C:\Windows\System\cndMaPS.exe
  C:\Windows\System\cndMaPS.exe
  2⤵
  PID:8968
- C:\Windows\System\JIanEVu.exe
  C:\Windows\System\JIanEVu.exe
  2⤵
  PID:6552
- C:\Windows\System\xrxdHFs.exe
  C:\Windows\System\xrxdHFs.exe
  2⤵
  PID:6232
- C:\Windows\System\GMYeCkd.exe
  C:\Windows\System\GMYeCkd.exe
  2⤵
  PID:7260
- C:\Windows\System\KRSJitJ.exe
  C:\Windows\System\KRSJitJ.exe
  2⤵
  PID:8352
- C:\Windows\System\fcbQspu.exe
  C:\Windows\System\fcbQspu.exe
  2⤵
  PID:7444
- C:\Windows\System\NTrTYeE.exe
  C:\Windows\System\NTrTYeE.exe
  2⤵
  PID:8604
- C:\Windows\System\PbKeUgG.exe
  C:\Windows\System\PbKeUgG.exe
  2⤵
  PID:9344
- C:\Windows\System\kyRpSJg.exe
  C:\Windows\System\kyRpSJg.exe
  2⤵
  PID:9420
- C:\Windows\System\WpTSaNe.exe
  C:\Windows\System\WpTSaNe.exe
  2⤵
  PID:7832
- C:\Windows\System\sflXFNl.exe
  C:\Windows\System\sflXFNl.exe
  2⤵
  PID:9464
- C:\Windows\System\jTdlyxh.exe
  C:\Windows\System\jTdlyxh.exe
  2⤵
  PID:9560
- C:\Windows\System\KLAZoiX.exe
  C:\Windows\System\KLAZoiX.exe
  2⤵
  PID:9632
- C:\Windows\System\ZkxbzER.exe
  C:\Windows\System\ZkxbzER.exe
  2⤵
  PID:9708
- C:\Windows\System\iqMYJcV.exe
  C:\Windows\System\iqMYJcV.exe
  2⤵
  PID:9012
- C:\Windows\System\ruYeStK.exe
  C:\Windows\System\ruYeStK.exe
  2⤵
  PID:9860
- C:\Windows\System\xxykfzp.exe
  C:\Windows\System\xxykfzp.exe
  2⤵
  PID:9920
- C:\Windows\System\HuQPdBD.exe
  C:\Windows\System\HuQPdBD.exe
  2⤵
  PID:9972
- C:\Windows\System\vtbGhzy.exe
  C:\Windows\System\vtbGhzy.exe
  2⤵
  PID:9184
- C:\Windows\System\cYycGcK.exe
  C:\Windows\System\cYycGcK.exe
  2⤵
  PID:8264
- C:\Windows\System\CTAZQtH.exe
  C:\Windows\System\CTAZQtH.exe
  2⤵
  PID:8324
- C:\Windows\System\LQNvZgH.exe
  C:\Windows\System\LQNvZgH.exe
  2⤵
  PID:1592
- C:\Windows\System\WGYjofd.exe
  C:\Windows\System\WGYjofd.exe
  2⤵
  PID:8476
- C:\Windows\System\RQVrJgu.exe
  C:\Windows\System\RQVrJgu.exe
  2⤵
  PID:8528
- C:\Windows\System\VCBBaWL.exe
  C:\Windows\System\VCBBaWL.exe
  2⤵
  PID:8636
- C:\Windows\System\YFxiLEZ.exe
  C:\Windows\System\YFxiLEZ.exe
  2⤵
  PID:8772
- C:\Windows\System\abzldKy.exe
  C:\Windows\System\abzldKy.exe
  2⤵
  PID:10244
- C:\Windows\System\ATpcmbL.exe
  C:\Windows\System\ATpcmbL.exe
  2⤵
  PID:10260
- C:\Windows\System\bJVWDKa.exe
  C:\Windows\System\bJVWDKa.exe
  2⤵
  PID:10276
- C:\Windows\System\tnuKjUx.exe
  C:\Windows\System\tnuKjUx.exe
  2⤵
  PID:10292
- C:\Windows\System\NUclkQA.exe
  C:\Windows\System\NUclkQA.exe
  2⤵
  PID:10308
- C:\Windows\System\CXOsLlZ.exe
  C:\Windows\System\CXOsLlZ.exe
  2⤵
  PID:10332
- C:\Windows\System\MIFfKKq.exe
  C:\Windows\System\MIFfKKq.exe
  2⤵
  PID:10348
- C:\Windows\System\kubJGaU.exe
  C:\Windows\System\kubJGaU.exe
  2⤵
  PID:10368
- C:\Windows\System\UuGUnwl.exe
  C:\Windows\System\UuGUnwl.exe
  2⤵
  PID:10388
- C:\Windows\System\xsxEFoM.exe
  C:\Windows\System\xsxEFoM.exe
  2⤵
  PID:10420
- C:\Windows\System\uAPpjvO.exe
  C:\Windows\System\uAPpjvO.exe
  2⤵
  PID:10440
- C:\Windows\System\ENJPOxK.exe
  C:\Windows\System\ENJPOxK.exe
  2⤵
  PID:10460
- C:\Windows\System\iwwHyOA.exe
  C:\Windows\System\iwwHyOA.exe
  2⤵
  PID:10476
- C:\Windows\System\bOfptUg.exe
  C:\Windows\System\bOfptUg.exe
  2⤵
  PID:10496
- C:\Windows\System\gmUobmF.exe
  C:\Windows\System\gmUobmF.exe
  2⤵
  PID:10516
- C:\Windows\System\EneiiUy.exe
  C:\Windows\System\EneiiUy.exe
  2⤵
  PID:10536
- C:\Windows\System\AWXtMTe.exe
  C:\Windows\System\AWXtMTe.exe
  2⤵
  PID:10556
- C:\Windows\System\faoskss.exe
  C:\Windows\System\faoskss.exe
  2⤵
  PID:10576
- C:\Windows\System\ZJkZbwn.exe
  C:\Windows\System\ZJkZbwn.exe
  2⤵
  PID:10596
- C:\Windows\System\gkghRNk.exe
  C:\Windows\System\gkghRNk.exe
  2⤵
  PID:10616
- C:\Windows\System\CVDzOms.exe
  C:\Windows\System\CVDzOms.exe
  2⤵
  PID:10636
- C:\Windows\System\sUZnzug.exe
  C:\Windows\System\sUZnzug.exe
  2⤵
  PID:10656
- C:\Windows\System\xBBtSId.exe
  C:\Windows\System\xBBtSId.exe
  2⤵
  PID:10676
- C:\Windows\System\BdRPVWB.exe
  C:\Windows\System\BdRPVWB.exe
  2⤵
  PID:10696
- C:\Windows\System\ZOHaENX.exe
  C:\Windows\System\ZOHaENX.exe
  2⤵
  PID:10716
- C:\Windows\System\LtpwcDY.exe
  C:\Windows\System\LtpwcDY.exe
  2⤵
  PID:10736
- C:\Windows\System\VmVRzBd.exe
  C:\Windows\System\VmVRzBd.exe
  2⤵
  PID:10756
- C:\Windows\System\KfArMQN.exe
  C:\Windows\System\KfArMQN.exe
  2⤵
  PID:10776
- C:\Windows\System\rcTozmM.exe
  C:\Windows\System\rcTozmM.exe
  2⤵
  PID:10796
- C:\Windows\System\RswfaLc.exe
  C:\Windows\System\RswfaLc.exe
  2⤵
  PID:10816
- C:\Windows\System\sgBcEcK.exe
  C:\Windows\System\sgBcEcK.exe
  2⤵
  PID:10836
- C:\Windows\System\dwIDEaO.exe
  C:\Windows\System\dwIDEaO.exe
  2⤵
  PID:10864
- C:\Windows\System\qXwDbjc.exe
  C:\Windows\System\qXwDbjc.exe
  2⤵
  PID:10884
- C:\Windows\System\EQDbvyi.exe
  C:\Windows\System\EQDbvyi.exe
  2⤵
  PID:10904
- C:\Windows\System\JQcYELH.exe
  C:\Windows\System\JQcYELH.exe
  2⤵
  PID:10928
- C:\Windows\System\IukVhTh.exe
  C:\Windows\System\IukVhTh.exe
  2⤵
  PID:10948
- C:\Windows\System\lEYuQKy.exe
  C:\Windows\System\lEYuQKy.exe
  2⤵
  PID:10972
- C:\Windows\System\SKuCqfg.exe
  C:\Windows\System\SKuCqfg.exe
  2⤵
  PID:10992
- C:\Windows\System\whfrDSy.exe
  C:\Windows\System\whfrDSy.exe
  2⤵
  PID:11016
- C:\Windows\System\kwcJAxH.exe
  C:\Windows\System\kwcJAxH.exe
  2⤵
  PID:11040
- C:\Windows\System\rBohqLP.exe
  C:\Windows\System\rBohqLP.exe
  2⤵
  PID:11064
- C:\Windows\System\rXmWZpR.exe
  C:\Windows\System\rXmWZpR.exe
  2⤵
  PID:11088
- C:\Windows\System\vmWpnww.exe
  C:\Windows\System\vmWpnww.exe
  2⤵
  PID:11112
- C:\Windows\System\pwGdIWc.exe
  C:\Windows\System\pwGdIWc.exe
  2⤵
  PID:11152
- C:\Windows\System\ikBOelj.exe
  C:\Windows\System\ikBOelj.exe
  2⤵
  PID:11172
- C:\Windows\System\LmEyxCd.exe
  C:\Windows\System\LmEyxCd.exe
  2⤵
  PID:11196
- C:\Windows\System\bRkPFLy.exe
  C:\Windows\System\bRkPFLy.exe
  2⤵
  PID:11228
- C:\Windows\System\knJpvlZ.exe
  C:\Windows\System\knJpvlZ.exe
  2⤵
  PID:7176
- C:\Windows\System\VTkCaPt.exe
  C:\Windows\System\VTkCaPt.exe
  2⤵
  PID:4696
- C:\Windows\System\ykXuzLN.exe
  C:\Windows\System\ykXuzLN.exe
  2⤵
  PID:8984
- C:\Windows\System\oFdZxEL.exe
  C:\Windows\System\oFdZxEL.exe
  2⤵
  PID:9944
- C:\Windows\System\UHizTRN.exe
  C:\Windows\System\UHizTRN.exe
  2⤵
  PID:8160
- C:\Windows\System\WbhbSRd.exe
  C:\Windows\System\WbhbSRd.exe
  2⤵
  PID:11268
- C:\Windows\System\pycpoqI.exe
  C:\Windows\System\pycpoqI.exe
  2⤵
  PID:11296
- C:\Windows\System\UjdJNnF.exe
  C:\Windows\System\UjdJNnF.exe
  2⤵
  PID:11320
- C:\Windows\System\NjDHuqn.exe
  C:\Windows\System\NjDHuqn.exe
  2⤵
  PID:11352
- C:\Windows\System\pEKejyr.exe
  C:\Windows\System\pEKejyr.exe
  2⤵
  PID:11376
- C:\Windows\System\fTovBJQ.exe
  C:\Windows\System\fTovBJQ.exe
  2⤵
  PID:11396
- C:\Windows\System\XeWkabO.exe
  C:\Windows\System\XeWkabO.exe
  2⤵
  PID:11424
- C:\Windows\System\PjkUqwX.exe
  C:\Windows\System\PjkUqwX.exe
  2⤵
  PID:11456
- C:\Windows\System\yqxzplB.exe
  C:\Windows\System\yqxzplB.exe
  2⤵
  PID:11480
- C:\Windows\System\hKBHkli.exe
  C:\Windows\System\hKBHkli.exe
  2⤵
  PID:11508
- C:\Windows\System\nTkqGZs.exe
  C:\Windows\System\nTkqGZs.exe
  2⤵
  PID:11536
- C:\Windows\System\ZFFQtvI.exe
  C:\Windows\System\ZFFQtvI.exe
  2⤵
  PID:11560
- C:\Windows\System\MSKlWcd.exe
  C:\Windows\System\MSKlWcd.exe
  2⤵
  PID:11580
- C:\Windows\System\EGykKKV.exe
  C:\Windows\System\EGykKKV.exe
  2⤵
  PID:11600
- C:\Windows\System\ogqYMui.exe
  C:\Windows\System\ogqYMui.exe
  2⤵
  PID:11616
- C:\Windows\System\TKAHNad.exe
  C:\Windows\System\TKAHNad.exe
  2⤵
  PID:11632
- C:\Windows\System\XJJFtyS.exe
  C:\Windows\System\XJJFtyS.exe
  2⤵
  PID:11648
- C:\Windows\System\QyfTzIb.exe
  C:\Windows\System\QyfTzIb.exe
  2⤵
  PID:11676
- C:\Windows\System\oHvmrUs.exe
  C:\Windows\System\oHvmrUs.exe
  2⤵
  PID:11696
- C:\Windows\System\qiMqJAY.exe
  C:\Windows\System\qiMqJAY.exe
  2⤵
  PID:11728
- C:\Windows\System\hdxsKvV.exe
  C:\Windows\System\hdxsKvV.exe
  2⤵
  PID:10176
- C:\Windows\System\sWVNLqz.exe
  C:\Windows\System\sWVNLqz.exe
  2⤵
  PID:9368
- C:\Windows\System\pTZJyZb.exe
  C:\Windows\System\pTZJyZb.exe
  2⤵
  PID:9596
- C:\Windows\System\PlCWxGH.exe
  C:\Windows\System\PlCWxGH.exe
  2⤵
  PID:9696
- C:\Windows\System\xRRhsKn.exe
  C:\Windows\System\xRRhsKn.exe
  2⤵
  PID:10252
- C:\Windows\System\FaAAUDw.exe
  C:\Windows\System\FaAAUDw.exe
  2⤵
  PID:10456
- C:\Windows\System\pMdjZtv.exe
  C:\Windows\System\pMdjZtv.exe
  2⤵
  PID:10856
- C:\Windows\System\KsJCNMz.exe
  C:\Windows\System\KsJCNMz.exe
  2⤵
  PID:10900
- C:\Windows\System\apxOoaO.exe
  C:\Windows\System\apxOoaO.exe
  2⤵
  PID:10924
- C:\Windows\System\asSNNQa.exe
  C:\Windows\System\asSNNQa.exe
  2⤵
  PID:10956
- C:\Windows\System\iIYgEcT.exe
  C:\Windows\System\iIYgEcT.exe
  2⤵
  PID:10980
- C:\Windows\System\eAVkacS.exe
  C:\Windows\System\eAVkacS.exe
  2⤵
  PID:9776
- C:\Windows\System\XopWFnK.exe
  C:\Windows\System\XopWFnK.exe
  2⤵
  PID:9832
- C:\Windows\System\CLeUzSY.exe
  C:\Windows\System\CLeUzSY.exe
  2⤵
  PID:9884
- C:\Windows\System\skUpAKP.exe
  C:\Windows\System\skUpAKP.exe
  2⤵
  PID:10004
- C:\Windows\System\VimSgBR.exe
  C:\Windows\System\VimSgBR.exe
  2⤵
  PID:10096
- C:\Windows\System\bOFBuLN.exe
  C:\Windows\System\bOFBuLN.exe
  2⤵
  PID:8236
- C:\Windows\System\YmiduwC.exe
  C:\Windows\System\YmiduwC.exe
  2⤵
  PID:9036
- C:\Windows\System\PXUpDSH.exe
  C:\Windows\System\PXUpDSH.exe
  2⤵
  PID:11368
- C:\Windows\System\vqpCwgJ.exe
  C:\Windows\System\vqpCwgJ.exe
  2⤵
  PID:8584
- C:\Windows\System\ScSrzup.exe
  C:\Windows\System\ScSrzup.exe
  2⤵
  PID:11640
- C:\Windows\System\TfkjMqh.exe
  C:\Windows\System\TfkjMqh.exe
  2⤵
  PID:9008
- C:\Windows\System\mxWLHHv.exe
  C:\Windows\System\mxWLHHv.exe
  2⤵
  PID:10284
- C:\Windows\System\mOBOMgv.exe
  C:\Windows\System\mOBOMgv.exe
  2⤵
  PID:11788
- C:\Windows\System\OVyIrJa.exe
  C:\Windows\System\OVyIrJa.exe
  2⤵
  PID:10400
- C:\Windows\System\HoQfvIl.exe
  C:\Windows\System\HoQfvIl.exe
  2⤵
  PID:6972
- C:\Windows\System\UsYdRtm.exe
  C:\Windows\System\UsYdRtm.exe
  2⤵
  PID:11420
- C:\Windows\System\ZGyKDmW.exe
  C:\Windows\System\ZGyKDmW.exe
  2⤵
  PID:10136
- C:\Windows\System\vzeijTp.exe
  C:\Windows\System\vzeijTp.exe
  2⤵
  PID:8744
- C:\Windows\System\gvQyoyk.exe
  C:\Windows\System\gvQyoyk.exe
  2⤵
  PID:10376
- C:\Windows\System\jaJjteV.exe
  C:\Windows\System\jaJjteV.exe
  2⤵
  PID:10524
- C:\Windows\System\NUbgujf.exe
  C:\Windows\System\NUbgujf.exe
  2⤵
  PID:10548
- C:\Windows\System\PhMhNFo.exe
  C:\Windows\System\PhMhNFo.exe
  2⤵
  PID:10608
- C:\Windows\System\opBkdXr.exe
  C:\Windows\System\opBkdXr.exe
  2⤵
  PID:10632
- C:\Windows\System\GTFGDtP.exe
  C:\Windows\System\GTFGDtP.exe
  2⤵
  PID:10664
- C:\Windows\System\WAaCKcA.exe
  C:\Windows\System\WAaCKcA.exe
  2⤵
  PID:10688
- C:\Windows\System\LNGrTyr.exe
  C:\Windows\System\LNGrTyr.exe
  2⤵
  PID:10724
- C:\Windows\System\smQUYOc.exe
  C:\Windows\System\smQUYOc.exe
  2⤵
  PID:10748
- C:\Windows\System\ernsKnD.exe
  C:\Windows\System\ernsKnD.exe
  2⤵
  PID:10772
- C:\Windows\System\fCmJrkU.exe
  C:\Windows\System\fCmJrkU.exe
  2⤵
  PID:12292
- C:\Windows\System\MNgVlec.exe
  C:\Windows\System\MNgVlec.exe
  2⤵
  PID:12308
- C:\Windows\System\sDtTUMM.exe
  C:\Windows\System\sDtTUMM.exe
  2⤵
  PID:12324
- C:\Windows\System\UIgCFhU.exe
  C:\Windows\System\UIgCFhU.exe
  2⤵
  PID:12340
- C:\Windows\System\uQbKhzU.exe
  C:\Windows\System\uQbKhzU.exe
  2⤵
  PID:12356
- C:\Windows\System\YJoSbdl.exe
  C:\Windows\System\YJoSbdl.exe
  2⤵
  PID:12372
- C:\Windows\System\cXqadOy.exe
  C:\Windows\System\cXqadOy.exe
  2⤵
  PID:12388
- C:\Windows\System\VrQhAIH.exe
  C:\Windows\System\VrQhAIH.exe
  2⤵
  PID:12404
- C:\Windows\System\sAnxpzD.exe
  C:\Windows\System\sAnxpzD.exe
  2⤵
  PID:12420
- C:\Windows\System\iCwciLh.exe
  C:\Windows\System\iCwciLh.exe
  2⤵
  PID:12436
- C:\Windows\System\pDXSCuZ.exe
  C:\Windows\System\pDXSCuZ.exe
  2⤵
  PID:12452
- C:\Windows\System\dieIEjS.exe
  C:\Windows\System\dieIEjS.exe
  2⤵
  PID:12468
- C:\Windows\System\idQJrgB.exe
  C:\Windows\System\idQJrgB.exe
  2⤵
  PID:12484
- C:\Windows\System\omQohuO.exe
  C:\Windows\System\omQohuO.exe
  2⤵
  PID:12500
- C:\Windows\System\KdURyZn.exe
  C:\Windows\System\KdURyZn.exe
  2⤵
  PID:12516
- C:\Windows\System\nUzTfXz.exe
  C:\Windows\System\nUzTfXz.exe
  2⤵
  PID:12536
- C:\Windows\System\zujMKJf.exe
  C:\Windows\System\zujMKJf.exe
  2⤵
  PID:12556
- C:\Windows\System\eTOUAey.exe
  C:\Windows\System\eTOUAey.exe
  2⤵
  PID:12576
- C:\Windows\System\PDTUaKZ.exe
  C:\Windows\System\PDTUaKZ.exe
  2⤵
  PID:12596
- C:\Windows\System\OQRjlpp.exe
  C:\Windows\System\OQRjlpp.exe
  2⤵
  PID:12616
- C:\Windows\System\xzFzsrQ.exe
  C:\Windows\System\xzFzsrQ.exe
  2⤵
  PID:12064
- C:\Windows\System\UjEFwbM.exe
  C:\Windows\System\UjEFwbM.exe
  2⤵
  PID:10472
- C:\Windows\System\ymZKlLb.exe
  C:\Windows\System\ymZKlLb.exe
  2⤵
  PID:10672
- C:\Windows\System\yPxFzGh.exe
  C:\Windows\System\yPxFzGh.exe
  2⤵
  PID:10964
- C:\Windows\System\rdnUMcI.exe
  C:\Windows\System\rdnUMcI.exe
  2⤵
  PID:10584
- C:\Windows\System\YEZRHOb.exe
  C:\Windows\System\YEZRHOb.exe
  2⤵
  PID:10732
- C:\Windows\System\WEpssqj.exe
  C:\Windows\System\WEpssqj.exe
  2⤵
  PID:12444
- C:\Windows\System\bSqiKLh.exe
  C:\Windows\System\bSqiKLh.exe
  2⤵
  PID:12552
- C:\Windows\System\hObicII.exe
  C:\Windows\System\hObicII.exe
  2⤵
  PID:12636
- C:\Windows\System\ZhzZUVS.exe
  C:\Windows\System\ZhzZUVS.exe
  2⤵
  PID:12956
- C:\Windows\System\nmZzLCi.exe
  C:\Windows\System\nmZzLCi.exe
  2⤵
  PID:12768
- C:\Windows\System\oDFZHwK.exe
  C:\Windows\System\oDFZHwK.exe
  2⤵
  PID:11692
- C:\Windows\System\LJXrDhU.exe
  C:\Windows\System\LJXrDhU.exe
  2⤵
  PID:12820
- C:\Windows\System\iwcWrGK.exe
  C:\Windows\System\iwcWrGK.exe
  2⤵
  PID:12836
- C:\Windows\System\uUsTtKb.exe
  C:\Windows\System\uUsTtKb.exe
  2⤵
  PID:3680
- C:\Windows\System\HqHZuBG.exe
  C:\Windows\System\HqHZuBG.exe
  2⤵
  PID:12304
- C:\Windows\System\FrqtuNx.exe
  C:\Windows\System\FrqtuNx.exe
  2⤵
  PID:12352
- C:\Windows\System\MkxwDGD.exe
  C:\Windows\System\MkxwDGD.exe
  2⤵
  PID:12384
- C:\Windows\System\FzsVrqV.exe
  C:\Windows\System\FzsVrqV.exe
  2⤵
  PID:12428
- C:\Windows\System\JuqTUqt.exe
  C:\Windows\System\JuqTUqt.exe
  2⤵
  PID:12508
- C:\Windows\System\RABRyUG.exe
  C:\Windows\System\RABRyUG.exe
  2⤵
  PID:12568
- C:\Windows\System\CMOHhFD.exe
  C:\Windows\System\CMOHhFD.exe
  2⤵
  PID:12912
- C:\Windows\System\UwyAByA.exe
  C:\Windows\System\UwyAByA.exe
  2⤵
  PID:13000
- C:\Windows\System\DQhYaKO.exe
  C:\Windows\System\DQhYaKO.exe
  2⤵
  PID:12760
- C:\Windows\System\mAOYiUE.exe
  C:\Windows\System\mAOYiUE.exe
  2⤵
  PID:12892
- C:\Windows\System\gPLTGdY.exe
  C:\Windows\System\gPLTGdY.exe
  2⤵
  PID:12932
- C:\Windows\System\FVunwmH.exe
  C:\Windows\System\FVunwmH.exe
  2⤵
  PID:12976
- C:\Windows\System\BgyuXQn.exe
  C:\Windows\System\BgyuXQn.exe
  2⤵
  PID:13040
- C:\Windows\System\HURIgqB.exe
  C:\Windows\System\HURIgqB.exe
  2⤵
  PID:12736
- C:\Windows\System\qySWxZs.exe
  C:\Windows\System\qySWxZs.exe
  2⤵
  PID:9180
- C:\Windows\System\pXKlQhi.exe
  C:\Windows\System\pXKlQhi.exe
  2⤵
  PID:4000
- C:\Windows\System\BeekYYJ.exe
  C:\Windows\System\BeekYYJ.exe
  2⤵
  PID:9156
- C:\Windows\System\rvxbAPR.exe
  C:\Windows\System\rvxbAPR.exe
  2⤵
  PID:12804
- C:\Windows\System\gtQOCJh.exe
  C:\Windows\System\gtQOCJh.exe
  2⤵
  PID:13204
- C:\Windows\System\DBdKRAv.exe
  C:\Windows\System\DBdKRAv.exe
  2⤵
  PID:13060
- C:\Windows\System\IUXUTIY.exe
  C:\Windows\System\IUXUTIY.exe
  2⤵
  PID:13296
- C:\Windows\System\hEOajaG.exe
  C:\Windows\System\hEOajaG.exe
  2⤵
  PID:4360
- C:\Windows\System\YtzaTJq.exe
  C:\Windows\System\YtzaTJq.exe
  2⤵
  PID:12188
- C:\Windows\System\VHLxMAW.exe
  C:\Windows\System\VHLxMAW.exe
  2⤵
  PID:12264
- C:\Windows\System\goYzvIg.exe
  C:\Windows\System\goYzvIg.exe
  2⤵
  PID:8392
- C:\Windows\System\ZXdfTmP.exe
  C:\Windows\System\ZXdfTmP.exe
  2⤵
  PID:12796
- C:\Windows\System\vytUoST.exe
  C:\Windows\System\vytUoST.exe
  2⤵
  PID:728
- C:\Windows\System\BekvkdI.exe
  C:\Windows\System\BekvkdI.exe
  2⤵
  PID:12628
- C:\Windows\System\wBzPGtp.exe
  C:\Windows\System\wBzPGtp.exe
  2⤵
  PID:13260
- C:\Windows\System\slUDpbU.exe
  C:\Windows\System\slUDpbU.exe
  2⤵
  PID:6560
- C:\Windows\System\gZnnZfj.exe
  C:\Windows\System\gZnnZfj.exe
  2⤵
  PID:10408
- C:\Windows\System\jMzoUKQ.exe
  C:\Windows\System\jMzoUKQ.exe
  2⤵
  PID:12048
- C:\Windows\System\BqAjazD.exe
  C:\Windows\System\BqAjazD.exe
  2⤵
  PID:13132
- C:\Windows\System\SgPWNUa.exe
  C:\Windows\System\SgPWNUa.exe
  2⤵
  PID:13176
- C:\Windows\System\nBfantR.exe
  C:\Windows\System\nBfantR.exe
  2⤵
  PID:13156
- C:\Windows\System\PdlmnSC.exe
  C:\Windows\System\PdlmnSC.exe
  2⤵
  PID:3540
- C:\Windows\System\bjKKhRD.exe
  C:\Windows\System\bjKKhRD.exe
  2⤵
  PID:11532
- C:\Windows\System\mtGLVVs.exe
  C:\Windows\System\mtGLVVs.exe
  2⤵
  PID:12284
- C:\Windows\System\fKJuWBI.exe
  C:\Windows\System\fKJuWBI.exe
  2⤵
  PID:7744
- C:\Windows\System\zfouAmV.exe
  C:\Windows\System\zfouAmV.exe
  2⤵
  PID:10412
- C:\Windows\System\mOwvZMd.exe
  C:\Windows\System\mOwvZMd.exe
  2⤵
  PID:11872
- C:\Windows\System\IJeGQCi.exe
  C:\Windows\System\IJeGQCi.exe
  2⤵
  PID:8124
- C:\Windows\System\WSlCAyS.exe
  C:\Windows\System\WSlCAyS.exe
  2⤵
  PID:12572
- C:\Windows\System\bNifXlh.exe
  C:\Windows\System\bNifXlh.exe
  2⤵
  PID:13252
- C:\Windows\System\cvVJfLu.exe
  C:\Windows\System\cvVJfLu.exe
  2⤵
  PID:12604
- C:\Windows\System\UaCekYk.exe
  C:\Windows\System\UaCekYk.exe
  2⤵
  PID:11908
- C:\Windows\System\VNhBcCe.exe
  C:\Windows\System\VNhBcCe.exe
  2⤵
  PID:13304
- C:\Windows\System\aWGALAm.exe
  C:\Windows\System\aWGALAm.exe
  2⤵
  PID:10828
- C:\Windows\System\fiZTjcI.exe
  C:\Windows\System\fiZTjcI.exe
  2⤵
  PID:11388
- C:\Windows\System\YgUkWah.exe
  C:\Windows\System\YgUkWah.exe
  2⤵
  PID:12812
- C:\Windows\System\fVoxogd.exe
  C:\Windows\System\fVoxogd.exe
  2⤵
  PID:12460
- C:\Windows\System\MNFKkqH.exe
  C:\Windows\System\MNFKkqH.exe
  2⤵
  PID:11824
- C:\Windows\System\APYbVID.exe
  C:\Windows\System\APYbVID.exe
  2⤵
  PID:10824
- C:\Windows\System\BqtFARH.exe
  C:\Windows\System\BqtFARH.exe
  2⤵
  PID:12416
- C:\Windows\System\aycXfJN.exe
  C:\Windows\System\aycXfJN.exe
  2⤵
  PID:13288
- C:\Windows\System\qKcSiin.exe
  C:\Windows\System\qKcSiin.exe
  2⤵
  PID:10488
- C:\Windows\System\RmdCxGt.exe
  C:\Windows\System\RmdCxGt.exe
  2⤵
  PID:11812
- C:\Windows\System\mXlDmoq.exe
  C:\Windows\System\mXlDmoq.exe
  2⤵
  PID:11612
- C:\Windows\System\PZOgoLc.exe
  C:\Windows\System\PZOgoLc.exe
  2⤵
  PID:13096
- C:\Windows\System\tbzoVPj.exe
  C:\Windows\System\tbzoVPj.exe
  2⤵
  PID:12816
- C:\Windows\System\BKymUmq.exe
  C:\Windows\System\BKymUmq.exe
  2⤵
  PID:12668
- C:\Windows\System\uafVGQy.exe
  C:\Windows\System\uafVGQy.exe
  2⤵
  PID:12860
- C:\Windows\System\UhTlqpi.exe
  C:\Windows\System\UhTlqpi.exe
  2⤵
  PID:13092
- C:\Windows\System\SEZfjbs.exe
  C:\Windows\System\SEZfjbs.exe
  2⤵
  PID:7600
- C:\Windows\System\wcSEZIx.exe
  C:\Windows\System\wcSEZIx.exe
  2⤵
  PID:12524
- C:\Windows\System\ccUCNLs.exe
  C:\Windows\System\ccUCNLs.exe
  2⤵
  PID:12116
- C:\Windows\System\oLdexNt.exe
  C:\Windows\System\oLdexNt.exe
  2⤵
  PID:12916
- C:\Windows\System\hZNydRP.exe
  C:\Windows\System\hZNydRP.exe
  2⤵
  PID:12700
- C:\Windows\System\UPyFMgT.exe
  C:\Windows\System\UPyFMgT.exe
  2⤵
  PID:2240
- C:\Windows\System\GlTusDz.exe
  C:\Windows\System\GlTusDz.exe
  2⤵
  PID:9580
- C:\Windows\System\rFgtcMS.exe
  C:\Windows\System\rFgtcMS.exe
  2⤵
  PID:10468
- C:\Windows\System\ampiLhh.exe
  C:\Windows\System\ampiLhh.exe
  2⤵
  PID:4840
- C:\Windows\System\nYqEKwg.exe
  C:\Windows\System\nYqEKwg.exe
  2⤵
  PID:456
- C:\Windows\System\CnXNDHl.exe
  C:\Windows\System\CnXNDHl.exe
  2⤵
  PID:1536
- C:\Windows\System\wYHvUaW.exe
  C:\Windows\System\wYHvUaW.exe
  2⤵
  PID:8948
- C:\Windows\System\pywvuHH.exe
  C:\Windows\System\pywvuHH.exe
  2⤵
  PID:12788
- C:\Windows\System\zCXPYvj.exe
  C:\Windows\System\zCXPYvj.exe
  2⤵
  PID:10032
- C:\Windows\System\ZEvwGTI.exe
  C:\Windows\System\ZEvwGTI.exe
  2⤵
  PID:11104
- C:\Windows\System\Phniaiy.exe
  C:\Windows\System\Phniaiy.exe
  2⤵
  PID:3988
- C:\Windows\System\JCGoiqa.exe
  C:\Windows\System\JCGoiqa.exe
  2⤵
  PID:1468
- C:\Windows\System\eheLCcF.exe
  C:\Windows\System\eheLCcF.exe
  2⤵
  PID:2952
- C:\Windows\System\ETluiwg.exe
  C:\Windows\System\ETluiwg.exe
  2⤵
  PID:6092
- C:\Windows\System\opZUfme.exe
  C:\Windows\System\opZUfme.exe
  2⤵
  PID:12096
- C:\Windows\System\SKtezOG.exe
  C:\Windows\System\SKtezOG.exe
  2⤵
  PID:12856
- C:\Windows\System\wgWgHkY.exe
  C:\Windows\System\wgWgHkY.exe
  2⤵
  PID:4668
- C:\Windows\System\PcIlCwQ.exe
  C:\Windows\System\PcIlCwQ.exe
  2⤵
  PID:1696
- C:\Windows\System\WeHPHbr.exe
  C:\Windows\System\WeHPHbr.exe
  2⤵
  PID:12300
- C:\Windows\System\InTQJXQ.exe
  C:\Windows\System\InTQJXQ.exe
  2⤵
  PID:10812
- C:\Windows\System\rPFVtXU.exe
  C:\Windows\System\rPFVtXU.exe
  2⤵
  PID:5108
- C:\Windows\System\ATddgxt.exe
  C:\Windows\System\ATddgxt.exe
  2⤵
  PID:7944
- C:\Windows\System\quntCHJ.exe
  C:\Windows\System\quntCHJ.exe
  2⤵
  PID:13328
- C:\Windows\System\YHaCIIy.exe
  C:\Windows\System\YHaCIIy.exe
  2⤵
  PID:13348
- C:\Windows\System\fKBkcKB.exe
  C:\Windows\System\fKBkcKB.exe
  2⤵
  PID:13364
- C:\Windows\System\YBUYVBm.exe
  C:\Windows\System\YBUYVBm.exe
  2⤵
  PID:13380
- C:\Windows\System\UbQugPk.exe
  C:\Windows\System\UbQugPk.exe
  2⤵
  PID:13396
- C:\Windows\System\sHiUagS.exe
  C:\Windows\System\sHiUagS.exe
  2⤵
  PID:13416
- C:\Windows\System\UVZnqAb.exe
  C:\Windows\System\UVZnqAb.exe
  2⤵
  PID:13432
- C:\Windows\System\sRYTUcj.exe
  C:\Windows\System\sRYTUcj.exe
  2⤵
  PID:13448
- C:\Windows\System\SoTvUTA.exe
  C:\Windows\System\SoTvUTA.exe
  2⤵
  PID:13464
- C:\Windows\System\IIsitVV.exe
  C:\Windows\System\IIsitVV.exe
  2⤵
  PID:13480
- C:\Windows\System\ISNZVcS.exe
  C:\Windows\System\ISNZVcS.exe
  2⤵
  PID:13500
- C:\Windows\System\EOIHNIu.exe
  C:\Windows\System\EOIHNIu.exe
  2⤵
  PID:13524
- C:\Windows\System\ZNhFetX.exe
  C:\Windows\System\ZNhFetX.exe
  2⤵
  PID:13540
- C:\Windows\System\rJzjBfC.exe
  C:\Windows\System\rJzjBfC.exe
  2⤵
  PID:13556
- C:\Windows\System\JwsMKuu.exe
  C:\Windows\System\JwsMKuu.exe
  2⤵
  PID:13576
- C:\Windows\System\vlSNcDB.exe
  C:\Windows\System\vlSNcDB.exe
  2⤵
  PID:13596
- C:\Windows\System\xSXxMCw.exe
  C:\Windows\System\xSXxMCw.exe
  2⤵
  PID:13612
- C:\Windows\System\oRCTzGj.exe
  C:\Windows\System\oRCTzGj.exe
  2⤵
  PID:13632
- C:\Windows\System\xTvazyZ.exe
  C:\Windows\System\xTvazyZ.exe
  2⤵
  PID:13648
- C:\Windows\System\lIQnyfs.exe
  C:\Windows\System\lIQnyfs.exe
  2⤵
  PID:13664
- C:\Windows\System\aVOLWxz.exe
  C:\Windows\System\aVOLWxz.exe
  2⤵
  PID:13680
- C:\Windows\System\BgbzzxK.exe
  C:\Windows\System\BgbzzxK.exe
  2⤵
  PID:13696
- C:\Windows\System\jFFEXhm.exe
  C:\Windows\System\jFFEXhm.exe
  2⤵
  PID:13712
- C:\Windows\System\rQEZvKH.exe
  C:\Windows\System\rQEZvKH.exe
  2⤵
  PID:13728
- C:\Windows\System\YtqoCRl.exe
  C:\Windows\System\YtqoCRl.exe
  2⤵
  PID:13744
- C:\Windows\System\HZGMdTQ.exe
  C:\Windows\System\HZGMdTQ.exe
  2⤵
  PID:13760
- C:\Windows\System\mgwHVcg.exe
  C:\Windows\System\mgwHVcg.exe
  2⤵
  PID:13776
- C:\Windows\System\oByKfyR.exe
  C:\Windows\System\oByKfyR.exe
  2⤵
  PID:13792
- C:\Windows\System\kwcqhDV.exe
  C:\Windows\System\kwcqhDV.exe
  2⤵
  PID:13808
- C:\Windows\System\oCXSCon.exe
  C:\Windows\System\oCXSCon.exe
  2⤵
  PID:13824
- C:\Windows\System\uJGipQb.exe
  C:\Windows\System\uJGipQb.exe
  2⤵
  PID:13840
- C:\Windows\System\Emphrkv.exe
  C:\Windows\System\Emphrkv.exe
  2⤵
  PID:13856
- C:\Windows\System\skWQjCL.exe
  C:\Windows\System\skWQjCL.exe
  2⤵
  PID:13872
- C:\Windows\System\sWAACcf.exe
  C:\Windows\System\sWAACcf.exe
  2⤵
  PID:13888
- C:\Windows\System\KVwXaaq.exe
  C:\Windows\System\KVwXaaq.exe
  2⤵
  PID:13904
- C:\Windows\System\KglbSeO.exe
  C:\Windows\System\KglbSeO.exe
  2⤵
  PID:13920
- C:\Windows\System\RfJaidE.exe
  C:\Windows\System\RfJaidE.exe
  2⤵
  PID:13936
- C:\Windows\System\IxPbbgc.exe
  C:\Windows\System\IxPbbgc.exe
  2⤵
  PID:13952
- C:\Windows\System\mFpWjDq.exe
  C:\Windows\System\mFpWjDq.exe
  2⤵
  PID:13968
- C:\Windows\System\lwAvCmY.exe
  C:\Windows\System\lwAvCmY.exe
  2⤵
  PID:13984
- C:\Windows\System\DPGxPDC.exe
  C:\Windows\System\DPGxPDC.exe
  2⤵
  PID:14000
- C:\Windows\System\BgEzqdb.exe
  C:\Windows\System\BgEzqdb.exe
  2⤵
  PID:14020
- C:\Windows\System\VhMjhpg.exe
  C:\Windows\System\VhMjhpg.exe
  2⤵
  PID:14036
- C:\Windows\System\IOKMhvd.exe
  C:\Windows\System\IOKMhvd.exe
  2⤵
  PID:14052
- C:\Windows\System\HjlvTDK.exe
  C:\Windows\System\HjlvTDK.exe
  2⤵
  PID:14072
- C:\Windows\System\rndEmEw.exe
  C:\Windows\System\rndEmEw.exe
  2⤵
  PID:14088
- C:\Windows\System\CxCGQMz.exe
  C:\Windows\System\CxCGQMz.exe
  2⤵
  PID:14104
- C:\Windows\System\MEyDAUd.exe
  C:\Windows\System\MEyDAUd.exe
  2⤵
  PID:14120
- C:\Windows\System\PofdcXQ.exe
  C:\Windows\System\PofdcXQ.exe
  2⤵
  PID:14136
- C:\Windows\System\HRGgrFb.exe
  C:\Windows\System\HRGgrFb.exe
  2⤵
  PID:14152
- C:\Windows\System\ByotiPx.exe
  C:\Windows\System\ByotiPx.exe
  2⤵
  PID:14168
- C:\Windows\System\EYiJrlw.exe
  C:\Windows\System\EYiJrlw.exe
  2⤵
  PID:14184
- C:\Windows\System\lBHiFFC.exe
  C:\Windows\System\lBHiFFC.exe
  2⤵
  PID:14200
- C:\Windows\System\vWncVUb.exe
  C:\Windows\System\vWncVUb.exe
  2⤵
  PID:14224
- C:\Windows\System\gWmaOuF.exe
  C:\Windows\System\gWmaOuF.exe
  2⤵
  PID:14240
- C:\Windows\System\hcnFuoV.exe
  C:\Windows\System\hcnFuoV.exe
  2⤵
  PID:14256
- C:\Windows\System\owhVoIh.exe
  C:\Windows\System\owhVoIh.exe
  2⤵
  PID:14272
- C:\Windows\System\laaVGXv.exe
  C:\Windows\System\laaVGXv.exe
  2⤵
  PID:14288
- C:\Windows\System\LDwsViI.exe
  C:\Windows\System\LDwsViI.exe
  2⤵
  PID:14304
- C:\Windows\System\DSPaTBp.exe
  C:\Windows\System\DSPaTBp.exe
  2⤵
  PID:14320
- C:\Windows\System\FtXiEfT.exe
  C:\Windows\System\FtXiEfT.exe
  2⤵
  PID:1580
- C:\Windows\System\ebLHrzk.exe
  C:\Windows\System\ebLHrzk.exe
  2⤵
  PID:13344
- C:\Windows\System\tBDJRQE.exe
  C:\Windows\System\tBDJRQE.exe
  2⤵
  PID:13376
- C:\Windows\System\FvwEznA.exe
  C:\Windows\System\FvwEznA.exe
  2⤵
  PID:13412
- C:\Windows\System\VJJPKQY.exe
  C:\Windows\System\VJJPKQY.exe
  2⤵
  PID:13444
- C:\Windows\System\CXXqxPL.exe
  C:\Windows\System\CXXqxPL.exe
  2⤵
  PID:13476
- C:\Windows\System\xQYCvhU.exe
  C:\Windows\System\xQYCvhU.exe
  2⤵
  PID:13520
- C:\Windows\System\pGjiOfg.exe
  C:\Windows\System\pGjiOfg.exe
  2⤵
  PID:13552
- C:\Windows\System\IWZOtmr.exe
  C:\Windows\System\IWZOtmr.exe
  2⤵
  PID:13588
- C:\Windows\System\McvbGTy.exe
  C:\Windows\System\McvbGTy.exe
  2⤵
  PID:13624
- C:\Windows\System\qMkBpYJ.exe
  C:\Windows\System\qMkBpYJ.exe
  2⤵
  PID:13660
- C:\Windows\System\jQPCcLH.exe
  C:\Windows\System\jQPCcLH.exe
  2⤵
  PID:13692
- C:\Windows\System\iKNLyNA.exe
  C:\Windows\System\iKNLyNA.exe
  2⤵
  PID:13724
- C:\Windows\System\RrNtMRI.exe
  C:\Windows\System\RrNtMRI.exe
  2⤵
  PID:13772
- C:\Windows\System\oQmmKun.exe
  C:\Windows\System\oQmmKun.exe
  2⤵
  PID:13800
- C:\Windows\System\AbuMWYw.exe
  C:\Windows\System\AbuMWYw.exe
  2⤵
  PID:13848
- C:\Windows\System\yzQoTXi.exe
  C:\Windows\System\yzQoTXi.exe
  2⤵
  PID:13880
- C:\Windows\System\MXlxdlH.exe
  C:\Windows\System\MXlxdlH.exe
  2⤵
  PID:4404
- C:\Windows\System\ClWEjOE.exe
  C:\Windows\System\ClWEjOE.exe
  2⤵
  PID:13932
- C:\Windows\System\ojpXDjS.exe
  C:\Windows\System\ojpXDjS.exe
  2⤵
  PID:13964
- C:\Windows\System\LiiqYUC.exe
  C:\Windows\System\LiiqYUC.exe
  2⤵
  PID:13996
- C:\Windows\System\llIQONg.exe
  C:\Windows\System\llIQONg.exe
  2⤵
  PID:14032
- C:\Windows\System\QJdFGeZ.exe
  C:\Windows\System\QJdFGeZ.exe
  2⤵
  PID:14068
- C:\Windows\System\tOcxNQG.exe
  C:\Windows\System\tOcxNQG.exe
  2⤵
  PID:14100
- C:\Windows\System\fqyGjaF.exe
  C:\Windows\System\fqyGjaF.exe
  2⤵
  PID:14148
- C:\Windows\System\KsOPyDy.exe
  C:\Windows\System\KsOPyDy.exe
  2⤵
  PID:14180
- C:\Windows\System\EcpyXVM.exe
  C:\Windows\System\EcpyXVM.exe
  2⤵
  PID:14220
- C:\Windows\System\pUYlRiz.exe
  C:\Windows\System\pUYlRiz.exe
  2⤵
  PID:14252
- C:\Windows\System\JzDCQLj.exe
  C:\Windows\System\JzDCQLj.exe
  2⤵
  PID:14284
- C:\Windows\System\EFBpStY.exe
  C:\Windows\System\EFBpStY.exe
  2⤵
  PID:14316
- C:\Windows\System\UYBOjYk.exe
  C:\Windows\System\UYBOjYk.exe
  2⤵
  PID:13324
- C:\Windows\System\jDcichv.exe
  C:\Windows\System\jDcichv.exe
  2⤵
  PID:13408
- C:\Windows\System\hCuDcHd.exe
  C:\Windows\System\hCuDcHd.exe
  2⤵
  PID:13472
- C:\Windows\System\LJYTNnN.exe
  C:\Windows\System\LJYTNnN.exe
  2⤵
  PID:13548
- C:\Windows\System\SSubYmu.exe
  C:\Windows\System\SSubYmu.exe
  2⤵
  PID:13608
- C:\Windows\System\UvAcGQs.exe
  C:\Windows\System\UvAcGQs.exe
  2⤵
  PID:13864
- C:\Windows\System\akvqKke.exe
  C:\Windows\System\akvqKke.exe
  2⤵
  PID:13928
- C:\Windows\System\aHNcTyW.exe
  C:\Windows\System\aHNcTyW.exe
  2⤵
  PID:13992
- C:\Windows\System\YBThTsK.exe
  C:\Windows\System\YBThTsK.exe
  2⤵
  PID:14144
- C:\Windows\System\YrAORMf.exe
  C:\Windows\System\YrAORMf.exe
  2⤵
  PID:14132
- C:\Windows\System\JUOjzal.exe
  C:\Windows\System\JUOjzal.exe
  2⤵
  PID:14236
- C:\Windows\System\bWgdTZU.exe
  C:\Windows\System\bWgdTZU.exe
  2⤵
  PID:14312
- C:\Windows\System\glLDntx.exe
  C:\Windows\System\glLDntx.exe
  2⤵
  PID:13392
- C:\Windows\System\lSxXhNr.exe
  C:\Windows\System\lSxXhNr.exe
  2⤵
  PID:13536
- C:\Windows\System\DzdPvog.exe
  C:\Windows\System\DzdPvog.exe
  2⤵
  PID:13788
- C:\Windows\System\EmzAQuN.exe
  C:\Windows\System\EmzAQuN.exe
  2⤵
  PID:13980
- C:\Windows\System\ogruGYF.exe
  C:\Windows\System\ogruGYF.exe
  2⤵
  PID:14176
- C:\Windows\System\rPvQZxY.exe
  C:\Windows\System\rPvQZxY.exe
  2⤵
  PID:14300
- C:\Windows\System\ykydiyv.exe
  C:\Windows\System\ykydiyv.exe
  2⤵
  PID:13508
- C:\Windows\System\tDHPfaj.exe
  C:\Windows\System\tDHPfaj.exe
  2⤵
  PID:13896
- C:\Windows\System\sNaLPwp.exe
  C:\Windows\System\sNaLPwp.exe
  2⤵
  PID:14128
- C:\Windows\System\hLhFXiT.exe
  C:\Windows\System\hLhFXiT.exe
  2⤵
  PID:13428
- C:\Windows\System\nhRNomu.exe
  C:\Windows\System\nhRNomu.exe
  2⤵
  PID:13960
- C:\Windows\System\LhoVGfS.exe
  C:\Windows\System\LhoVGfS.exe
  2⤵
  PID:14352
- C:\Windows\System\JyTQXPg.exe
  C:\Windows\System\JyTQXPg.exe
  2⤵
  PID:14368
- C:\Windows\System\QSjrcxs.exe
  C:\Windows\System\QSjrcxs.exe
  2⤵
  PID:14384
- C:\Windows\System\ePUtWMM.exe
  C:\Windows\System\ePUtWMM.exe
  2⤵
  PID:14400
- C:\Windows\System\ezZaDUI.exe
  C:\Windows\System\ezZaDUI.exe
  2⤵
  PID:14416
- C:\Windows\System\YSqAXJn.exe
  C:\Windows\System\YSqAXJn.exe
  2⤵
  PID:14432
- C:\Windows\System\UbyLOQU.exe
  C:\Windows\System\UbyLOQU.exe
  2⤵
  PID:14448
- C:\Windows\System\KFTwwCx.exe
  C:\Windows\System\KFTwwCx.exe
  2⤵
  PID:14464
- C:\Windows\System\UBEMKpq.exe
  C:\Windows\System\UBEMKpq.exe
  2⤵
  PID:14480
- C:\Windows\System\MTIevEQ.exe
  C:\Windows\System\MTIevEQ.exe
  2⤵
  PID:14496
- C:\Windows\System\xUBcQlW.exe
  C:\Windows\System\xUBcQlW.exe
  2⤵
  PID:14516
- C:\Windows\System\kyOZNnm.exe
  C:\Windows\System\kyOZNnm.exe
  2⤵
  PID:14532
- C:\Windows\System\dwpANql.exe
  C:\Windows\System\dwpANql.exe
  2⤵
  PID:14560
- C:\Windows\System\HRVNCqm.exe
  C:\Windows\System\HRVNCqm.exe
  2⤵
  PID:14580
- C:\Windows\System\dWcbjxu.exe
  C:\Windows\System\dWcbjxu.exe
  2⤵
  PID:14596
- C:\Windows\System\GIWoIGv.exe
  C:\Windows\System\GIWoIGv.exe
  2⤵
  PID:14612
- C:\Windows\System\zWshXDL.exe
  C:\Windows\System\zWshXDL.exe
  2⤵
  PID:14628
- C:\Windows\System\Tmttifu.exe
  C:\Windows\System\Tmttifu.exe
  2⤵
  PID:14644
- C:\Windows\System\nPUOzce.exe
  C:\Windows\System\nPUOzce.exe
  2⤵
  PID:14660
- C:\Windows\System\oATrbVF.exe
  C:\Windows\System\oATrbVF.exe
  2⤵
  PID:14676
- C:\Windows\System\XNhJEwb.exe
  C:\Windows\System\XNhJEwb.exe
  2⤵
  PID:14708
- C:\Windows\System\WqDUwvZ.exe
  C:\Windows\System\WqDUwvZ.exe
  2⤵
  PID:14784
- C:\Windows\System\wtlMIXL.exe
  C:\Windows\System\wtlMIXL.exe
  2⤵
  PID:14812
- C:\Windows\System\ryFHQCI.exe
  C:\Windows\System\ryFHQCI.exe
  2⤵
  PID:14848
- C:\Windows\System\arlrOWt.exe
  C:\Windows\System\arlrOWt.exe
  2⤵
  PID:15284
- C:\Windows\System\oGXzNjZ.exe
  C:\Windows\System\oGXzNjZ.exe
  2⤵
  PID:15108
- C:\Windows\System\tCaujoZ.exe
  C:\Windows\System\tCaujoZ.exe
  2⤵
  PID:15144
- C:\Windows\System\vZXsYEb.exe
  C:\Windows\System\vZXsYEb.exe
  2⤵
  PID:15168
- C:\Windows\System\UYVrijb.exe
  C:\Windows\System\UYVrijb.exe
  2⤵
  PID:15188
- C:\Windows\System\PLObjrb.exe
  C:\Windows\System\PLObjrb.exe
  2⤵
  PID:2232
- C:\Windows\System\ZKZFaac.exe
  C:\Windows\System\ZKZFaac.exe
  2⤵
  PID:15260
- C:\Windows\System\SDKLrdK.exe
  C:\Windows\System\SDKLrdK.exe
  2⤵
  PID:15304
- C:\Windows\System\HMzLrnv.exe
  C:\Windows\System\HMzLrnv.exe
  2⤵
  PID:15324
- C:\Windows\System\LMGXOXs.exe
  C:\Windows\System\LMGXOXs.exe
  2⤵
  PID:14360
- C:\Windows\System\GGTDGiV.exe
  C:\Windows\System\GGTDGiV.exe
  2⤵
  PID:14872
- C:\Windows\System\ZoKAsAw.exe
  C:\Windows\System\ZoKAsAw.exe
  2⤵
  PID:14412
- C:\Windows\System\rWyOuwd.exe
  C:\Windows\System\rWyOuwd.exe
  2⤵
  PID:14440
- C:\Windows\System\rKvpnCR.exe
  C:\Windows\System\rKvpnCR.exe
  2⤵
  PID:15240
- C:\Windows\System\kRqvlUC.exe
  C:\Windows\System\kRqvlUC.exe
  2⤵
  PID:15220
- C:\Windows\System\FCQwSQK.exe
  C:\Windows\System\FCQwSQK.exe
  2⤵
  PID:15248
- C:\Windows\System\kZafWgR.exe
  C:\Windows\System\kZafWgR.exe
  2⤵
  PID:14724
- C:\Windows\System\Pjjbqdj.exe
  C:\Windows\System\Pjjbqdj.exe
  2⤵
  PID:14592
- C:\Windows\System\kGrBsxx.exe
  C:\Windows\System\kGrBsxx.exe
  2⤵
  PID:14548
- C:\Windows\System\yMdJYDj.exe
  C:\Windows\System\yMdJYDj.exe
  2⤵
  PID:14832
- C:\Windows\System\hWNFPCq.exe
  C:\Windows\System\hWNFPCq.exe
  2⤵
  PID:14836
- C:\Windows\System\STlUTbG.exe
  C:\Windows\System\STlUTbG.exe
  2⤵
  PID:15292
- C:\Windows\System\KNyqCGP.exe
  C:\Windows\System\KNyqCGP.exe
  2⤵
  PID:14212
- C:\Windows\System\wBYfOWj.exe
  C:\Windows\System\wBYfOWj.exe
  2⤵
  PID:3592
- C:\Windows\System\ecegcxB.exe
  C:\Windows\System\ecegcxB.exe
  2⤵
  PID:13832
- C:\Windows\System\kSIWmQB.exe
  C:\Windows\System\kSIWmQB.exe
  2⤵
  PID:14916
- C:\Windows\System\kzcqmAv.exe
  C:\Windows\System\kzcqmAv.exe
  2⤵
  PID:14948
- C:\Windows\System\SzKLRkw.exe
  C:\Windows\System\SzKLRkw.exe
  2⤵
  PID:14956
- C:\Windows\System\QXWzYju.exe
  C:\Windows\System\QXWzYju.exe
  2⤵
  PID:15004
- C:\Windows\System\wBrBksI.exe
  C:\Windows\System\wBrBksI.exe
  2⤵
  PID:14952
- C:\Windows\System\CJwTlTI.exe
  C:\Windows\System\CJwTlTI.exe
  2⤵
  PID:15028
- C:\Windows\System\cVXrCzB.exe
  C:\Windows\System\cVXrCzB.exe
  2⤵
  PID:3404
- C:\Windows\System\sTGsHyN.exe
  C:\Windows\System\sTGsHyN.exe
  2⤵
  PID:3408
- C:\Windows\System\GGzjUGh.exe
  C:\Windows\System\GGzjUGh.exe
  2⤵
  PID:15072
- C:\Windows\System\kpxaDEK.exe
  C:\Windows\System\kpxaDEK.exe
  2⤵
  PID:15088
- C:\Windows\System\HsUVmQx.exe
  C:\Windows\System\HsUVmQx.exe
  2⤵
  PID:15092
- C:\Windows\System\KCWPpDB.exe
  C:\Windows\System\KCWPpDB.exe
  2⤵
  PID:668
- C:\Windows\System\NvNGMqh.exe
  C:\Windows\System\NvNGMqh.exe
  2⤵
  PID:1212
- C:\Windows\System\vsrAwvm.exe
  C:\Windows\System\vsrAwvm.exe
  2⤵
  PID:392
- C:\Windows\System\JPUWprB.exe
  C:\Windows\System\JPUWprB.exe
  2⤵
  PID:15180
- C:\Windows\System\aonegGo.exe
  C:\Windows\System\aonegGo.exe
  2⤵
  PID:15232
- C:\Windows\System\JFOkDee.exe
  C:\Windows\System\JFOkDee.exe
  2⤵
  PID:14716
- C:\Windows\System\WONIcrG.exe
  C:\Windows\System\WONIcrG.exe
  2⤵
  PID:14588
- C:\Windows\System\KOtcbfH.exe
  C:\Windows\System\KOtcbfH.exe
  2⤵
  PID:15300
- C:\Windows\System\WNLEWtt.exe
  C:\Windows\System\WNLEWtt.exe
  2⤵
  PID:4632
- C:\Windows\System\sDDTZof.exe
  C:\Windows\System\sDDTZof.exe
  2⤵
  PID:4324
- C:\Windows\System\mxIywDo.exe
  C:\Windows\System\mxIywDo.exe
  2⤵
  PID:14696
- C:\Windows\System\HMwScKK.exe
  C:\Windows\System\HMwScKK.exe
  2⤵
  PID:5100
- C:\Windows\System\ZyDhyLI.exe
  C:\Windows\System\ZyDhyLI.exe
  2⤵
  PID:14772
- C:\Windows\System\gzwFEvZ.exe
  C:\Windows\System\gzwFEvZ.exe
  2⤵
  PID:14776
- C:\Windows\System\fClinHo.exe
  C:\Windows\System\fClinHo.exe
  2⤵
  PID:15272
- C:\Windows\System\XzCwSRa.exe
  C:\Windows\System\XzCwSRa.exe
  2⤵
  PID:2960
- C:\Windows\System\nPcAfdl.exe
  C:\Windows\System\nPcAfdl.exe
  2⤵
  PID:4892
- C:\Windows\System\BQzLWSA.exe
  C:\Windows\System\BQzLWSA.exe
  2⤵
  PID:4940
- C:\Windows\System\AxaJIWG.exe
  C:\Windows\System\AxaJIWG.exe
  2⤵
  PID:416
- C:\Windows\System\eIBqQIp.exe
  C:\Windows\System\eIBqQIp.exe
  2⤵
  PID:2848
- C:\Windows\System\yPNcqOR.exe
  C:\Windows\System\yPNcqOR.exe
  2⤵
  PID:14988
- C:\Windows\System\guoKnlZ.exe
  C:\Windows\System\guoKnlZ.exe
  2⤵
  PID:14896
- C:\Windows\System\CrlTjnB.exe
  C:\Windows\System\CrlTjnB.exe
  2⤵
  PID:520
- C:\Windows\System\LQPnkDc.exe
  C:\Windows\System\LQPnkDc.exe
  2⤵
  PID:2200
- C:\Windows\System\ymhgRyi.exe
  C:\Windows\System\ymhgRyi.exe
  2⤵
  PID:1784
- C:\Windows\System\JqhvZDb.exe
  C:\Windows\System\JqhvZDb.exe
  2⤵
  PID:4900
- C:\Windows\System\TVEYiGT.exe
  C:\Windows\System\TVEYiGT.exe
  2⤵
  PID:2228
- C:\Windows\System\GGwZrhP.exe
  C:\Windows\System\GGwZrhP.exe
  2⤵
  PID:14980
- C:\Windows\System\mhZJgvB.exe
  C:\Windows\System\mhZJgvB.exe
  2⤵
  PID:14844
- C:\Windows\System\oiaFMvM.exe
  C:\Windows\System\oiaFMvM.exe
  2⤵
  PID:14928
- C:\Windows\System\KiDaRuZ.exe
  C:\Windows\System\KiDaRuZ.exe
  2⤵
  PID:3464
- C:\Windows\System\RGKYecc.exe
  C:\Windows\System\RGKYecc.exe
  2⤵
  PID:15064
- C:\Windows\System\fdYkigG.exe
  C:\Windows\System\fdYkigG.exe
  2⤵
  PID:2784
- C:\Windows\System\SFERNiz.exe
  C:\Windows\System\SFERNiz.exe
  2⤵
  PID:1544
- C:\Windows\System\XSJvlcg.exe
  C:\Windows\System\XSJvlcg.exe
  2⤵
  PID:4080
- C:\Windows\System\NkAPNPl.exe
  C:\Windows\System\NkAPNPl.exe
  2⤵
  PID:15160
- C:\Windows\System\qSgnkGD.exe
  C:\Windows\System\qSgnkGD.exe
  2⤵
  PID:15204
- C:\Windows\System\hznYzzH.exe
  C:\Windows\System\hznYzzH.exe
  2⤵
  PID:14348
- C:\Windows\System\qDBgSWV.exe
  C:\Windows\System\qDBgSWV.exe
  2⤵
  PID:6864
- C:\Windows\System\OhAZBJQ.exe
  C:\Windows\System\OhAZBJQ.exe
  2⤵
  PID:7352
- C:\Windows\System\eFmRFkn.exe
  C:\Windows\System\eFmRFkn.exe
  2⤵
  PID:3084
- C:\Windows\System\fLjfdCf.exe
  C:\Windows\System\fLjfdCf.exe
  2⤵
  PID:7556
- C:\Windows\System\shZfziy.exe
  C:\Windows\System\shZfziy.exe
  2⤵
  PID:7592
- C:\Windows\System\rRUoagB.exe
  C:\Windows\System\rRUoagB.exe
  2⤵
  PID:7276
- C:\Windows\System\bcFLczT.exe
  C:\Windows\System\bcFLczT.exe
  2⤵
  PID:7960
- C:\Windows\System\EATvHRz.exe
  C:\Windows\System\EATvHRz.exe
  2⤵
  PID:7984
- C:\Windows\System\bLQtpli.exe
  C:\Windows\System\bLQtpli.exe
  2⤵
  PID:8132
- C:\Windows\System\RUsDOnH.exe
  C:\Windows\System\RUsDOnH.exe
  2⤵
  PID:7036
- C:\Windows\System\aWKMPUt.exe
  C:\Windows\System\aWKMPUt.exe
  2⤵
  PID:6692
- C:\Windows\System\ddomfNz.exe
  C:\Windows\System\ddomfNz.exe
  2⤵
  PID:7904
- C:\Windows\System\RZFdeHr.exe
  C:\Windows\System\RZFdeHr.exe
  2⤵
  PID:3600
- C:\Windows\System\mDnIxNi.exe
  C:\Windows\System\mDnIxNi.exe
  2⤵
  PID:8120
- C:\Windows\System\hFUyZSd.exe
  C:\Windows\System\hFUyZSd.exe
  2⤵
  PID:1828
- C:\Windows\System\ZOfTMTC.exe
  C:\Windows\System\ZOfTMTC.exe
  2⤵
  PID:5056
- C:\Windows\System\NrTVCtV.exe
  C:\Windows\System\NrTVCtV.exe
  2⤵
  PID:7448
- C:\Windows\System\VdHfcGF.exe
  C:\Windows\System\VdHfcGF.exe
  2⤵
  PID:6936
- C:\Windows\System\VoRaDGf.exe
  C:\Windows\System\VoRaDGf.exe
  2⤵
  PID:8260
- C:\Windows\System\jMgulec.exe
  C:\Windows\System\jMgulec.exe
  2⤵
  PID:8452
- C:\Windows\System\JIZmtWA.exe
  C:\Windows\System\JIZmtWA.exe
  2⤵
  PID:4828
- C:\Windows\System\mLCBpSq.exe
  C:\Windows\System\mLCBpSq.exe
  2⤵
  PID:1252
- C:\Windows\System\RtseGkq.exe
  C:\Windows\System\RtseGkq.exe
  2⤵
  PID:4588
- C:\Windows\System\ECnIOrF.exe
  C:\Windows\System\ECnIOrF.exe
  2⤵
  PID:5344
- C:\Windows\System\wiGLFFR.exe
  C:\Windows\System\wiGLFFR.exe
  2⤵
  PID:4620
- C:\Windows\System\mFLXaoq.exe
  C:\Windows\System\mFLXaoq.exe
  2⤵
  PID:5432
- C:\Windows\System\hRfJGQh.exe
  C:\Windows\System\hRfJGQh.exe
  2⤵
  PID:4640
- C:\Windows\System\ejaIDoQ.exe
  C:\Windows\System\ejaIDoQ.exe
  2⤵
  PID:1920
- C:\Windows\System\IiTAudX.exe
  C:\Windows\System\IiTAudX.exe
  2⤵
  PID:1040
- C:\Windows\System\FwElJlB.exe
  C:\Windows\System\FwElJlB.exe
  2⤵
  PID:3956
- C:\Windows\System\VnWPuzo.exe
  C:\Windows\System\VnWPuzo.exe
  2⤵
  PID:412
- C:\Windows\System\feKIiDR.exe
  C:\Windows\System\feKIiDR.exe
  2⤵
  PID:6752
- C:\Windows\System\MFMYZOM.exe
  C:\Windows\System\MFMYZOM.exe
  2⤵
  PID:1776
- C:\Windows\System\lkhGiIg.exe
  C:\Windows\System\lkhGiIg.exe
  2⤵
  PID:2308
- C:\Windows\System\GzIKgoQ.exe
  C:\Windows\System\GzIKgoQ.exe
  2⤵
  PID:5184
- C:\Windows\System\VhmiJjO.exe
  C:\Windows\System\VhmiJjO.exe
  2⤵
  PID:4864
- C:\Windows\System\mdJDOXh.exe
  C:\Windows\System\mdJDOXh.exe
  2⤵
  PID:15212
- C:\Windows\System\movpkKL.exe
  C:\Windows\System\movpkKL.exe
  2⤵
  PID:2168
- C:\Windows\System\sXaEEKw.exe
  C:\Windows\System\sXaEEKw.exe
  2⤵
  PID:5428
- C:\Windows\System\ALlpODf.exe
  C:\Windows\System\ALlpODf.exe
  2⤵
  PID:14568
- C:\Windows\System\qYMjNxN.exe
  C:\Windows\System\qYMjNxN.exe
  2⤵
  PID:14908
- C:\Windows\System\JfjTljW.exe
  C:\Windows\System\JfjTljW.exe
  2⤵
  PID:15276
- C:\Windows\System\GoLCcCp.exe
  C:\Windows\System\GoLCcCp.exe
  2⤵
  PID:14728
- C:\Windows\System\CEqkObL.exe
  C:\Windows\System\CEqkObL.exe
  2⤵
  PID:4336
- C:\Windows\System\dsKDjej.exe
  C:\Windows\System\dsKDjej.exe
  2⤵
  PID:3700
- C:\Windows\System\hjjFQqR.exe
  C:\Windows\System\hjjFQqR.exe
  2⤵
  PID:5616
- C:\Windows\System\YhaWkxQ.exe
  C:\Windows\System\YhaWkxQ.exe
  2⤵
  PID:14492
- C:\Windows\System\edzhaqn.exe
  C:\Windows\System\edzhaqn.exe
  2⤵
  PID:14556
- C:\Windows\System\GLKGSdi.exe
  C:\Windows\System\GLKGSdi.exe
  2⤵
  PID:14992
- C:\Windows\System\EHoWCsP.exe
  C:\Windows\System\EHoWCsP.exe
  2⤵
  PID:14808
- C:\Windows\System\eLuGUlN.exe
  C:\Windows\System\eLuGUlN.exe
  2⤵
  PID:14824
- C:\Windows\System\QNcePGH.exe
  C:\Windows\System\QNcePGH.exe
  2⤵
  PID:3160
- C:\Windows\System\CNTfPHu.exe
  C:\Windows\System\CNTfPHu.exe
  2⤵
  PID:14528
- C:\Windows\System\XwtDJta.exe
  C:\Windows\System\XwtDJta.exe
  2⤵
  PID:15052
- C:\Windows\System\ArnKmYE.exe
  C:\Windows\System\ArnKmYE.exe
  2⤵
  PID:6784
- C:\Windows\System\VZTKeEG.exe
  C:\Windows\System\VZTKeEG.exe
  2⤵
  PID:14704
- C:\Windows\System\nYgtZOo.exe
  C:\Windows\System\nYgtZOo.exe
  2⤵
  PID:2152
- C:\Windows\System\AkkrnKc.exe
  C:\Windows\System\AkkrnKc.exe
  2⤵
  PID:2720
- C:\Windows\System\Degopbn.exe
  C:\Windows\System\Degopbn.exe
  2⤵
  PID:1368
- C:\Windows\System\JYliXgH.exe
  C:\Windows\System\JYliXgH.exe
  2⤵
  PID:956
- C:\Windows\System\afyieCH.exe
  C:\Windows\System\afyieCH.exe
  2⤵
  PID:5832
- C:\Windows\System\lgPMPwC.exe
  C:\Windows\System\lgPMPwC.exe
  2⤵
  PID:14936
- C:\Windows\System\dOFpngq.exe
  C:\Windows\System\dOFpngq.exe
  2⤵
  PID:5104
- C:\Windows\System\ItCmYzV.exe
  C:\Windows\System\ItCmYzV.exe
  2⤵
  PID:5884
- C:\Windows\System\SRJlzOC.exe
  C:\Windows\System\SRJlzOC.exe
  2⤵
  PID:1296
- C:\Windows\System\neFyvNi.exe
  C:\Windows\System\neFyvNi.exe
  2⤵
  PID:5848
- C:\Windows\System\BLQDisE.exe
  C:\Windows\System\BLQDisE.exe
  2⤵
  PID:3724
- C:\Windows\System\oqoHNPh.exe
  C:\Windows\System\oqoHNPh.exe
  2⤵
  PID:1140
- C:\Windows\System\UyQeWPu.exe
  C:\Windows\System\UyQeWPu.exe
  2⤵
  PID:5800
- C:\Windows\System\YGwTmdQ.exe
  C:\Windows\System\YGwTmdQ.exe
  2⤵
  PID:1352
- C:\Windows\System\rEpRgBv.exe
  C:\Windows\System\rEpRgBv.exe
  2⤵
  PID:4008
- C:\Windows\System\fjavMVT.exe
  C:\Windows\System\fjavMVT.exe
  2⤵
  PID:7380
- C:\Windows\System\neTIdZf.exe
  C:\Windows\System\neTIdZf.exe
  2⤵
  PID:5584
- C:\Windows\System\HBUoynO.exe
  C:\Windows\System\HBUoynO.exe
  2⤵
  PID:6024
- C:\Windows\System\GYFQWUJ.exe
  C:\Windows\System\GYFQWUJ.exe
  2⤵
  PID:7316
- C:\Windows\System\EwIeimX.exe
  C:\Windows\System\EwIeimX.exe
  2⤵
  PID:7888
- C:\Windows\System\oeZXsfJ.exe
  C:\Windows\System\oeZXsfJ.exe
  2⤵
  PID:7472
- C:\Windows\System\mkVNTKS.exe
  C:\Windows\System\mkVNTKS.exe
  2⤵
  PID:7712
- C:\Windows\System\fYneInX.exe
  C:\Windows\System\fYneInX.exe
  2⤵
  PID:7648
- C:\Windows\System\cGBANXA.exe
  C:\Windows\System\cGBANXA.exe
  2⤵
  PID:7876
- C:\Windows\System\suVRtUv.exe
  C:\Windows\System\suVRtUv.exe
  2⤵
  PID:8164
- C:\Windows\System\ULdcFyN.exe
  C:\Windows\System\ULdcFyN.exe
  2⤵
  PID:4292
- C:\Windows\System\wtHUqjc.exe
  C:\Windows\System\wtHUqjc.exe
  2⤵
  PID:7664
- C:\Windows\System\ywJObHP.exe
  C:\Windows\System\ywJObHP.exe
  2⤵
  PID:8412
- C:\Windows\System\gAKCnBS.exe
  C:\Windows\System\gAKCnBS.exe
  2⤵
  PID:2120
- C:\Windows\System\BpgQISz.exe
  C:\Windows\System\BpgQISz.exe
  2⤵
  PID:4596
- C:\Windows\System\RVjqrgy.exe
  C:\Windows\System\RVjqrgy.exe
  2⤵
  PID:4488
- C:\Windows\System\nIxKcsJ.exe
  C:\Windows\System\nIxKcsJ.exe
  2⤵
  PID:540
- C:\Windows\System\CJJVDgX.exe
  C:\Windows\System\CJJVDgX.exe
  2⤵
  PID:5176
- C:\Windows\System\afPvHjK.exe
  C:\Windows\System\afPvHjK.exe
  2⤵
  PID:3316
- C:\Windows\System\WcPvvBe.exe
  C:\Windows\System\WcPvvBe.exe
  2⤵
  PID:2352
- C:\Windows\System\rdrNnFp.exe
  C:\Windows\System\rdrNnFp.exe
  2⤵
  PID:4364
- C:\Windows\System\oBoXSqb.exe
  C:\Windows\System\oBoXSqb.exe
  2⤵
  PID:4608
- C:\Windows\System\FtzYCEq.exe
  C:\Windows\System\FtzYCEq.exe
  2⤵
  PID:2448
- C:\Windows\System\IzhPODC.exe
  C:\Windows\System\IzhPODC.exe
  2⤵
  PID:1512
- C:\Windows\System\TGYnpGE.exe
  C:\Windows\System\TGYnpGE.exe
  2⤵
  PID:5208
- C:\Windows\System\MLlBZiz.exe
  C:\Windows\System\MLlBZiz.exe
  2⤵
  PID:4484
- C:\Windows\System\wzSKkDL.exe
  C:\Windows\System\wzSKkDL.exe
  2⤵
  PID:1516
- C:\Windows\System\TMgExsz.exe
  C:\Windows\System\TMgExsz.exe
  2⤵
  PID:5316
- C:\Windows\System\joZPWuc.exe
  C:\Windows\System\joZPWuc.exe
  2⤵
  PID:1044
- C:\Windows\System\WfXTNtE.exe
  C:\Windows\System\WfXTNtE.exe
  2⤵
  PID:1700
- C:\Windows\System\NUotIMF.exe
  C:\Windows\System\NUotIMF.exe
  2⤵
  PID:14576
- C:\Windows\System\OJeFYnp.exe
  C:\Windows\System\OJeFYnp.exe
  2⤵
  PID:5748
- C:\Windows\System\JqNpmsZ.exe
  C:\Windows\System\JqNpmsZ.exe
  2⤵
  PID:14428
- C:\Windows\System\niDcrUT.exe
  C:\Windows\System\niDcrUT.exe
  2⤵
  PID:4456
- C:\Windows\System\jsBlWsw.exe
  C:\Windows\System\jsBlWsw.exe
  2⤵
  PID:1028
- C:\Windows\System\aQFIlcN.exe
  C:\Windows\System\aQFIlcN.exe
  2⤵
  PID:1084
- C:\Windows\System\CODrLQs.exe
  C:\Windows\System\CODrLQs.exe
  2⤵
  PID:3344
- C:\Windows\System\FLGUHWe.exe
  C:\Windows\System\FLGUHWe.exe
  2⤵
  PID:14380
- C:\Windows\System\lmRYUxJ.exe
  C:\Windows\System\lmRYUxJ.exe
  2⤵
  PID:5768
- C:\Windows\System\WgrnEjV.exe
  C:\Windows\System\WgrnEjV.exe
  2⤵
  PID:14672
- C:\Windows\System\OacNRxF.exe
  C:\Windows\System\OacNRxF.exe
  2⤵
  PID:1988
- C:\Windows\System\QZJaZFC.exe
  C:\Windows\System\QZJaZFC.exe
  2⤵
  PID:5776
- C:\Windows\System\lZTOGMw.exe
  C:\Windows\System\lZTOGMw.exe
  2⤵
  PID:3400
- C:\Windows\System\IORlCul.exe
  C:\Windows\System\IORlCul.exe
  2⤵
  PID:14508
- C:\Windows\System\qSjrWIy.exe
  C:\Windows\System\qSjrWIy.exe
  2⤵
  PID:5256
- C:\Windows\System\MWnlWnU.exe
  C:\Windows\System\MWnlWnU.exe
  2⤵
  PID:4148
- C:\Windows\System\JpoGoFm.exe
  C:\Windows\System\JpoGoFm.exe
  2⤵
  PID:15268
- C:\Windows\System\edqqCUR.exe
  C:\Windows\System\edqqCUR.exe
  2⤵
  PID:3980
- C:\Windows\System\GzffEDl.exe
  C:\Windows\System\GzffEDl.exe
  2⤵
  PID:5496
- C:\Windows\System\OFTxhPj.exe
  C:\Windows\System\OFTxhPj.exe
  2⤵
  PID:15132
- C:\Windows\System\byWwZXM.exe
  C:\Windows\System\byWwZXM.exe
  2⤵
  PID:14408
- C:\Windows\System\YGDQwzc.exe
  C:\Windows\System\YGDQwzc.exe
  2⤵
  PID:5876
- C:\Windows\System\cQudThW.exe
  C:\Windows\System\cQudThW.exe
  2⤵
  PID:1200
- C:\Windows\System\EkHHcKk.exe
  C:\Windows\System\EkHHcKk.exe
  2⤵
  PID:14904
- C:\Windows\System\mSFpVpH.exe
  C:\Windows\System\mSFpVpH.exe
  2⤵
  PID:5788

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15124

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:14844

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:15012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_45akeh02.24o.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BnWiZSQ.exe

Filesize
1.9MB

MD5
1fcfebd3e8e4d0c50544cd6bd66542cc

SHA1
bcc2471d984a4a948134fd2879fd8cf5901c94e9

SHA256
b28fd1b36faa5d70d1ef43b198e48aa63d3e70a579b1a382603a8bedaf40f446

SHA512
273e7c774e25aad2f9bf9f2c4e7054e9b5ac3812e91351299ccf671c3dc68a6ee98373a9731a33b9383af2595344e4812dbf2ce664a9c4e7f7ba4ee8f2a91737

Download Submit
C:\Windows\System\DGmkKdC.exe

Filesize
1.9MB

MD5
49ce650cb161987a0c7f734d2c1229d7

SHA1
403d84de6e9dd967a85eb58e57b478a2c3a586f3

SHA256
6e77f19796208d223d325eb8730e1bfdb9399dc3296aad6975f06470d218d869

SHA512
806bac42c87227e0335ad8a8359b9e28fc26b1cbd1048a72f5989fa8ca3bdcfd49e2b8f6ae385b099e9bdd4641cc98168b4629223655bc5949098e7b4038cfd4

Download Submit
C:\Windows\System\DTPkHhs.exe

Filesize
1.9MB

MD5
f03bd9df1600db104b11c2465b076041

SHA1
9f0af38a67829e4f03de4a21ced6549f9632819f

SHA256
8c040156716abb5b95fd17cddd87bc42b8cc89fe29547f38e9e4abe1ac553692

SHA512
9019ab8d37a89846958cb33dece023f1d8d5b038a6190a1cda63ff4b87acca2859d7027efda1a872b3cf809982f87b78e07909313f6bd902c58c9ce5ae8241fa

Download Submit
C:\Windows\System\DhyubKB.exe

Filesize
1.9MB

MD5
46e3ee98f25ca246ae77817c6d835383

SHA1
01a92c89599d56c1a045145b11cf7e1bb1d16844

SHA256
cf1e0b2b7fa8ca7cc06923b6038be8b3b2e9d1ca9fa6c8073f939f7be53aa962

SHA512
2c16ec7c98fa5543707febd9cd1a8447dc5d7bb1ceb43db7894082b027e9bd2b1c6b30ddc1427693834c277855fefd762fd9add2fa91239a3a0c90566bb6379f

Download Submit
C:\Windows\System\DmBrzpI.exe

Filesize
1.9MB

MD5
45fe33e116bd41971d2228f14e650dd9

SHA1
5a293ac768404bfe6869af1a6ada47e08e6b18c3

SHA256
4784d18a98f96839a5073beb883a26d7bfa339308844aba7ca0845d98506ad21

SHA512
31ccc899ddadd5e69b4a48140e0ee75bf6d553310b33cc2b69821e2e50178f2cbb2d8f5aa0c94f5694d14d61b18a6f57569448d0612319be3679226c81940eb9

Download Submit
C:\Windows\System\HkLJgmH.exe

Filesize
1.9MB

MD5
54a1a4c404526357b129501e71126267

SHA1
4bca5e8232b93fd95e3a390fa08c1ae1a512bd76

SHA256
f68e38bf42fc0db66132c3e289949b464e9a063b35e1e2d2162ee8e64e174ce3

SHA512
859c35dfa8aa44f0447dfd3a422496443f9b2c621b4c505890520fe9afeda1265ae1fb58b62eec4aad87da882b2930f52ee39cce8f324af1a3f1b074ba52161b

Download Submit
C:\Windows\System\HkhTNYK.exe

Filesize
1.9MB

MD5
9e45476c93c08bfc3b2a5257526591bd

SHA1
69d58b53c6c9450b12764f9c0ddbbcefcf097ca7

SHA256
aba0a340849fbb61749528c25d9c9eec34536d48bcb4396a9ca363b263899d9c

SHA512
cc391cd8698a926571390be9558fec22afac2288893887413115380275ea01246c25f31c09fc72105934e3226629cf5b9a5d562cfe83abe572788890d6ae0178

Download Submit
C:\Windows\System\HmRAoBa.exe

Filesize
1.9MB

MD5
daa160e64afa4f6c60806e9627ba9bd9

SHA1
eaed0d51c3fe819008c5f1713fe0f96d913d6054

SHA256
6a127f55ed4f440ae956cb4ec59b3274c6080cf3b7f79d412b9c6464e5200f39

SHA512
06e9a7813a5a3e05029e1fe021512bca2a92ccd62231d1f9390f81676f5c77544afb72e22443fc7b2a960a2f85d9be73be1609d801b7d354ef73e334425183f4

Download Submit
C:\Windows\System\IgOwojj.exe

Filesize
1.9MB

MD5
186f675b1c1c297c0f3340be5344a2b9

SHA1
92124bb00d1f8a1d34bb194683c5e9284c1f312c

SHA256
71465104efb8b3f6ff0e43a94fa672b20f5a9015586416f90735d30b97afb3a4

SHA512
dedf0f6f15c9a968f69ba99ee581551e8aaae2ec04d4d592aeed5aa5acb2e177f944d010f7686a3b91bb512b526db2f59534eb2f39e59b581c1f70620816164a

Download Submit
C:\Windows\System\KvDXjIX.exe

Filesize
1.9MB

MD5
7861cebdc5b0ef186037981656d1581e

SHA1
81a559fdef51e9175e779f1fe1785b921cdd9dac

SHA256
3ab0a38687db8eeee209a592d1b64f771a54d0775dc865b7afa6a9d63a259f62

SHA512
d898fe070fb528634312534e83b4d5d8a0f7aec21299031c78d55f18f9ee01275cb939555a4358a3fc72c1a5ca97621430a52d5d0561efa748154b4f2a80c11b

Download Submit
C:\Windows\System\MGgmGqT.exe

Filesize
1.9MB

MD5
28767a74bb996a8a2d55432a04792cec

SHA1
1fdd198bd655c506f3bca6d941e4f6bf80296a98

SHA256
2e0d25a69a9b1b280b8078c7cdd75f812fcf34d1206b89750a8f83fcbe1a833b

SHA512
adfee55486f00c7c89dea7de1e66866ac5111e3fa5f45619b8ca3dec08ffc925ca10519b673390a395a1da78a8c8ccc4688848487470413a241b421e26088300

Download Submit
C:\Windows\System\NAZabmO.exe

Filesize
1.9MB

MD5
613e2a446578245af18c971507b1d4c5

SHA1
83ac8f587bf3eb0ef4b7f7b525929d3dbd1c9d73

SHA256
e5b3eee2266d4391f007646be2641abe93557565074f0582a94fb7050d200633

SHA512
6368eb66caff2d9489be791c9babc9f8c9c3ed4485b6ca22caa008b5ac77129a7c4b11a628ce732d11cb7b56b920b9698ad2168c63d3cc984f2025187a7bb825

Download Submit
C:\Windows\System\NusPVKA.exe

Filesize
18B

MD5
bfb583257cb761da77fbf8352ec954a6

SHA1
19e34ff1de8a6f5272d90e872addece324fb8cc5

SHA256
d755648ce473104eb4288ba17f93fb6dd46beb071ec41f05965c776f53951ba4

SHA512
3298b6cc8f31df1cc48609a760655c2e163242b2f4a77c4f3a22d5de8a28aedadf8f58ddd3f500b371eda566553c4d7daf2e2cde5a1ae24a34154d120553ae0f

Download Submit
C:\Windows\System\QCiVFJL.exe

Filesize
1.9MB

MD5
ae2e6d5a6c4ec80b850f1281dcc98902

SHA1
b43618605f6ef7902630c137e73150e8f2f49ce0

SHA256
e16a0cde182fc400d32d10fea0402cf3df03cd5a5d29875aedec8e079b13316b

SHA512
1e0c2d9d19b679492f19308504e2c19a5139e85fe4c9078a24dbfdba7b16dea43c68635d83190536633104ffde45a7ad6628c10d797731480bd63da67ddc2f96

Download Submit
C:\Windows\System\SOecfIu.exe

Filesize
1.9MB

MD5
ac7cc1adc462fcca2f054c251163c34e

SHA1
c4e2457058e83fe36f3b92ceb623fa6845e64749

SHA256
d615d9005afc4fe9de6456047dab6a273719bda15a55f9dbeecf8b7809d56a88

SHA512
c8ba2884cc489c56bd666104993afc4286bf4708074b38f4efbb39fd1733721418033590a5afd9f9a328ed73681cb4a4bd122a1be639075c4a5ae1170e6ee91b

Download Submit
C:\Windows\System\UEvNNgB.exe

Filesize
1.9MB

MD5
44f3456b96af4c6ae67fd425461c4a4a

SHA1
17ede6d915ed00c9ee4f488193daa160da546a0f

SHA256
d12142e5b9368380a2656956c11015e1c38fdc430b0d68cbfba03a099488ae06

SHA512
e72112781e40156302f5159547bd5d01dc75abdcacfcf72e81acbd6e19bd31b7dd174a9edc9b2910ab3e01b2664d56be531003297c09324860c3fff55b402ad6

Download Submit
C:\Windows\System\Usabclt.exe

Filesize
1.9MB

MD5
c0124a1e785b45c6c136d7546a0d943c

SHA1
4dc4eae4216395abec5110e662cf43189362b6cc

SHA256
2eaaf257e0ec64ab92d4f0fa752075784a6d51d3bc43af74db1d7d04b3750902

SHA512
89f34bc7cb3ea24664b50ce5f0c9abed554ed712b53d934fcaa55235835f6207b287eb25f5c16f8cf960ae3d055faddb2c0e4a67da857034efeacdddaeb0ff8d

Download Submit
C:\Windows\System\UzSsdKd.exe

Filesize
1.9MB

MD5
a9566dbfccfe0b3569e13f62c61e8989

SHA1
9e04a600ed4e852c9862c6c09533783e18eb8d62

SHA256
e6a6a93ab5646533be0d1ab9f72b6e494d362e94179552d762a4d996b1f15e74

SHA512
25f7e9ac81dc1972594fde87f387f483e4f8831c2a14dd0190aa6fb8e93b8682c68897ab5ab7d9050a02365ddf7dcc2428aaa5344b4fdd79a70747b689c9e9f5

Download Submit
C:\Windows\System\VXwZRfP.exe

Filesize
1.9MB

MD5
6666efa10428d360163c298b25070937

SHA1
a0798c682c44f4f30b642b09e02e90b9b093b2d7

SHA256
fd92fa9ca985654a0665bc1b5fcbcde3697002af86a0ebbeb6d6416eb7928492

SHA512
fcadb3647a173b86875c21598e8f7f3bec5e6ee95195feeedd96a40e29e1b5b6f891cd9d295e4eccb10789d6e3f2fe557b78323e74af91939bfe6f33c6765c4f

Download Submit
C:\Windows\System\YsNxpqO.exe

Filesize
1.9MB

MD5
b9bfb026221abc30243129694eabc097

SHA1
60b07fa891af28407e30eaec99544b7904af63d4

SHA256
b1164d752374c22a4d7d6b556450e9b7350d6e560d4df83c7b7edd6b3c94cf69

SHA512
ee3a2241761134347669f98bf5d8b6fafbbfe3328f932a95354df47b60cf73346326f88b26338062a39a0509556a7c60ec796f8b20f18778b4009cd337d0c38f

Download Submit
C:\Windows\System\ZTLQuXH.exe

Filesize
1.9MB

MD5
31117b78907b48997956c46c7dd414d6

SHA1
55edbb0205b6fdd5cc2eb995f967571ccf45d549

SHA256
95ed4a28dbd77e33d48374f5f8280998712a802f68fbe1d971dbe12460512c2a

SHA512
aa49760c9a5c22925120aa1fc6958b9ecadfd945a52ef9c4fb3b4961ff603de6124c88dea96420774bf71526ade2925c8c6de425462cb413abab21ff097652f0

Download Submit
C:\Windows\System\drzQArQ.exe

Filesize
1.9MB

MD5
c04d05482bbd966df3dfce8325a6768a

SHA1
7c2dfa3349c38a0d9d1a3ef5e70b521067e339ad

SHA256
580acb88f5b11e9ca0aced66b2bb3d285e82cbad619edbfbace6d14b560045ac

SHA512
70f08d944edd5bbf5b59d5123197f7a2dfba57934c486868a9ed1b01f5cfb57bb5b710e351d92e2a35ad6fb4c707cce87b3c6eb2681c88eece9331a094eda808

Download Submit
C:\Windows\System\eNiDhwt.exe

Filesize
1.9MB

MD5
6f53d083d8682671b9d2113300b22fb7

SHA1
7bf8396695d39ce7d35ef79979f9662efa3cf9a5

SHA256
acc41159558e44a1c4890212cc4213c2a6f7a6a9a681f3d903b9cc217e3ff4f5

SHA512
83da8f6e2192a595b740bc8334f02d51a086baaf0bff087b8f8f98953b9e8a7d85fdc5cf0585222cc7883448ba15b818f5eafc13d55bc8a5030cd44a535cfdfd

Download Submit
C:\Windows\System\hQrOjjn.exe

Filesize
1.9MB

MD5
5e340b3846ad60671c78686b38fd6ac6

SHA1
4a50990700e17498e155954e28612cdc9c4a0c06

SHA256
b99820471c8635e737d3ac753e300dfee08466cd46365d7672cac98f0a4653c9

SHA512
b04178760c750212d56c3b8b1d060e5e585000b0a8d8915203e8483bbedcd57d24ec5d323f2b936291b7491cb7722bd4ad24f194e18c3a627c50b612fe412d6e

Download Submit
C:\Windows\System\iDnBQDC.exe

Filesize
1.9MB

MD5
b97f22320ab54b199856ce6a04b309e5

SHA1
c42a912accf9cb6ed0596be1055766041a20723c

SHA256
c64c250c78381b54700a8fd3dd139f78d50a1790b6e08eb7897b536abf71bab3

SHA512
76b67c231a14f4ef34ba7ed59735a352c5bf3f88484ebdbfda2c039718730250a53065b7f6f76e5ad3794443e357791b8c3d59a11234b362e1a5f9e905a810f4

Download Submit
C:\Windows\System\kXpTShH.exe

Filesize
1.9MB

MD5
4553e8b200f472a994dc2b72bd760951

SHA1
64525e9f270124830ce0937624dd70ded8bcd97d

SHA256
5ce0a24bf3d4c3af3225ba8bed5c778a7d6cf91a5450fe232ff72eba312c9b08

SHA512
61f178654441b3875aad4b1c996d7699141e72efd33848d6b3767b36874912b38c7fd6ee784f95b130323ff4418eb4f8c2a607ab9f05fc478380b8d0cf19d48f

Download Submit
C:\Windows\System\mHVANjX.exe

Filesize
1.9MB

MD5
16cc825b123f741d1806404a2f13eec5

SHA1
b9ead13b6f97ec32a60fea6366bc4bf141dc1b31

SHA256
9a910befa8a4598c5f9f6b4133a03b6b1e69c6c534908766873e98891bdecf66

SHA512
6a783413460d683a4ce53d3ef4425aba25ebebd896e89b1999655f915f02a82707a6c5ecb7fa5c0df62d58c99912a3fd0e653a02d46edcd326a0e43b7839ba21

Download Submit
C:\Windows\System\nWYeGpa.exe

Filesize
1.9MB

MD5
07cdf61530947ec6e24ded6084f8f81a

SHA1
49acf11e90f283677ee382f911297a62b1fb7667

SHA256
df39c9eca33b42a1e8147226f42f96f4c5cf5e31df84ccea9b952ce923f752e4

SHA512
eab697815388c6060fe678da2e0311a3db5a00014c94317bd2dacea3dc529155c0d7c75f35b5c1ff7c1465aa39648b5fb1eaf4507cf4482359efcc6afb608046

Download Submit
C:\Windows\System\oBhkXOx.exe

Filesize
1.9MB

MD5
d23cd8c4b807d83994b63c5c3814f216

SHA1
b7782ce9b9df3ee883b238649a17ad73b17754d9

SHA256
82c5a434099fae3a6f1b7eaf1c33573492bfaa9562ba0644dc0544400e0f8c94

SHA512
d442a6ce71f353351f1c9550b439c9dbe8f0ce9da8c83e2b85f02daf87dd8a7a3c744f23d78bb2b1c543814be10748f48078f5d4f79dd4be97410446b1d9257a

Download Submit
C:\Windows\System\pMXZoSF.exe

Filesize
1.9MB

MD5
c1ff760a3decc89fda526e0997596ed3

SHA1
a6c4715800652a3d44c0685d8c083b7ba88430c9

SHA256
d187f2c31b751b70949d564b8a642edbc5f6bdab6f6356aba6887790359b4440

SHA512
05b1e12f0b5a5bd6b5a4e2d50c18ec92578bad6b02c5f34873c4456bac83389f4de88929571dec19c520f088da66830711ea01312eef4ce95871c44cd6bd5c5d

Download Submit
C:\Windows\System\pkrPawp.exe

Filesize
1.9MB

MD5
b40fc67afe47e7369dc11ff38c0120df

SHA1
1fbc5f58f0e2e4caceed7f0748edd360c1bc0b06

SHA256
4be28499b4f7b98ec74ad952b2a7536937d5576c5fec8b7fd24e2b6887c61140

SHA512
b6bdd0791b1d60a3d9c6cb267db171f051fd611093dc09131c11b36931c3abcc58c6f508c7ba229b63efd2fd82e0cfae4eba5e61cd51676aee2413ca811c3392

Download Submit
C:\Windows\System\qqRIIvY.exe

Filesize
1.9MB

MD5
90b86a6f4dd5c4aa0f7de3b7c38e8af6

SHA1
153832c0460afec646607cec3d5e6c5954b94f79

SHA256
e637181c824d8cb80f34e543d7e7e43513826f9532eba8ddfec5b385f40484f0

SHA512
68f86fc5e846495415fabefb6c13c7d3826c9c26b7ff935025b8faa3a938a0bf1c58811906455949467521acec1bf754d50e721dfacf82c0be9fb06acd6c440d

Download Submit
C:\Windows\System\rpUBLIA.exe

Filesize
1.9MB

MD5
38ed332e3dd7a3060eba62726faa6428

SHA1
b68decfa8ce37179519fd7f31043c7a9e4c95d54

SHA256
2be759cd32b2d3f0cba6fc77571f0830ddc8b803ceafe736668abbf8d0a5a828

SHA512
3c41699ccd99093627fa06887bccce8fa8f262c469d57692eb48e81ed50053c10c154396edaa59bb464a2621928fda3b77257cf0118e6105629b6b77910e7afe

Download Submit
C:\Windows\System\twDPJMi.exe

Filesize
1.9MB

MD5
bad3232366d57d30d43df0d9cdf5d503

SHA1
75aec2770b77e6b4e0081df1cb8798d8c1c0d644

SHA256
dcdb504591db679d0c4dd9e4f037db67420010e46d6f44f5f3f51289066f5ebd

SHA512
60241e2025a14b155f5ded5351c38f16a5f19a2121073a3acd6133ea62cbfe1b6ee935873e9cf51f9eb8c05d3f556b8fc710607e6981fd4ebef08b479484ab76

Download Submit
C:\Windows\System\vMIyKOj.exe

Filesize
1.9MB

MD5
3736ae12f3699eb1da7bdf4c1ebff5cf

SHA1
fe16985e4140a64a3cc74715fff13bd876ff7cfc

SHA256
d70366aa28d8963d653955442d39ce3cedd9627eb42a7a6adf2c529b41bb65c9

SHA512
a5555552b3c5cb0bdf4dab2570fee1e860a12022650fbcb6417a919b3ffd0bdaa0d9971495dda0c8f1d8e824074b7c82cc8f12bff2796f92ec9415acd210c01d

Download Submit
C:\Windows\System\wEUjQKu.exe

Filesize
1.9MB

MD5
d8b6ed2601dda2e935c7acf87011b2a7

SHA1
0ba5c5234fb670dcb395275c803d13749a0a40d3

SHA256
89c28dde26b49378eade920916c5be69e2a8c9d6dbc54dced4a5a0d8a52135f0

SHA512
1bffc3f172b4fc4ec202b4350da3d6aee04f3dd74cf5ad209d954ba895ec75acbd6727b74351553fbc0c33e0e308ab23ddbd1d1cfbf8d6f211f3763d8a284a47

Download Submit
C:\Windows\System\wsDRkdp.exe

Filesize
8B

MD5
20f50227b408431507e9e4298a89a7d5

SHA1
021be5cef03ca413a261257f3fa674d51e4eaecb

SHA256
f053af72ebaae8c20b4aa760dccbaa50d5e8c1b0612207e6dff562e592b0ee16

SHA512
a69e9f155961cdfb2c580f410cf1f9148255cadde0f420c64800ffc84ebbf2c4fc4d8c24eda7cee14ae357ad0398853cbe4f84f9db0bb9573e1f43351f2da9c0

Download Submit
C:\Windows\System\wtrFtof.exe

Filesize
1.9MB

MD5
0fb4e1d1e9980693b72f71809f083fcb

SHA1
1b9e0e17ef5a693a6b353e1abb427b8557006f5e

SHA256
6a04a46bd296df3db0397bc56a0771e154c5ccfafdaba773e2d66fb1e2594b50

SHA512
301816de5fea6e109980d7ebcd5960a3b6766ce119cc5044e189f86bce5d8e4898d9f151bb5a8da0414e1d20f9cb1ebefdf34db1597e35bbe5f58c99a6da5f30

Download Submit
C:\Windows\System\yQdmAlx.exe

Filesize
1.9MB

MD5
5dc4892ac349d3ab9a20cd780ff79dff

SHA1
65ce65bee419a1133ea56784bf6171ae28034a9e

SHA256
9455700da7d192ba95dab434489df84ea98ccd44862b2a62d1c50f1dd938ecf9

SHA512
58ebc882d412a845968e2a8a789e8e2400e817ba97cce02b97b11e08b1d7f58c714990e1686ab6082a83911cf5017f3b938d83078b1998b1f4888f72194f2e0a

Download Submit
C:\Windows\System\ygZLrbN.exe

Filesize
1.9MB

MD5
b61240c0e7f873aa6c87d580b9cdb0ee

SHA1
b8f5907e939e4159b83220a0a4230fdfd5cb1981

SHA256
252645a2a12b13bb122546460f5f49e8f9495bfffc1b5a05108b74a7a7db6321

SHA512
64d348e4867a93448b8cac82a135e679b192d181dddc69fa2ccd62d49bdfe131ba9922064c83d76c727cb72b1164cfe061ff15e65724d4c96cb46f238373a6b6

Download Submit
memory/244-4547-0x00007FF7DC710000-0x00007FF7DCB02000-memory.dmp

Filesize
3.9MB

Download
memory/244-281-0x00007FF7DC710000-0x00007FF7DCB02000-memory.dmp

Filesize
3.9MB

Download
memory/644-4883-0x00007FF79F760000-0x00007FF79FB52000-memory.dmp

Filesize
3.9MB

Download
memory/644-1-0x00000163D4C40000-0x00000163D4C50000-memory.dmp

Filesize
64KB

Download
memory/644-0-0x00007FF79F760000-0x00007FF79FB52000-memory.dmp

Filesize
3.9MB

Download
memory/1036-402-0x00007FF79E690000-0x00007FF79EA82000-memory.dmp

Filesize
3.9MB

Download
memory/1088-4582-0x00007FF616F50000-0x00007FF617342000-memory.dmp

Filesize
3.9MB

Download
memory/1088-320-0x00007FF616F50000-0x00007FF617342000-memory.dmp

Filesize
3.9MB

Download
memory/1092-4522-0x00007FF69E4D0000-0x00007FF69E8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1092-83-0x00007FF69E4D0000-0x00007FF69E8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-375-0x00007FF692950000-0x00007FF692D42000-memory.dmp

Filesize
3.9MB

Download
memory/1808-4610-0x00007FF692950000-0x00007FF692D42000-memory.dmp

Filesize
3.9MB

Download
memory/1888-4593-0x00007FF7C4100000-0x00007FF7C44F2000-memory.dmp

Filesize
3.9MB

Download
memory/1888-350-0x00007FF7C4100000-0x00007FF7C44F2000-memory.dmp

Filesize
3.9MB

Download
memory/2132-368-0x00007FF7FE960000-0x00007FF7FED52000-memory.dmp

Filesize
3.9MB

Download
memory/2132-4577-0x00007FF7FE960000-0x00007FF7FED52000-memory.dmp

Filesize
3.9MB

Download
memory/2260-4542-0x00007FF6EBF30000-0x00007FF6EC322000-memory.dmp

Filesize
3.9MB

Download
memory/2260-247-0x00007FF6EBF30000-0x00007FF6EC322000-memory.dmp

Filesize
3.9MB

Download
memory/2712-120-0x00007FF7EB8A0000-0x00007FF7EBC92000-memory.dmp

Filesize
3.9MB

Download
memory/2712-4528-0x00007FF7EB8A0000-0x00007FF7EBC92000-memory.dmp

Filesize
3.9MB

Download
memory/2936-296-0x00007FF64B630000-0x00007FF64BA22000-memory.dmp

Filesize
3.9MB

Download
memory/2936-4551-0x00007FF64B630000-0x00007FF64BA22000-memory.dmp

Filesize
3.9MB

Download
memory/3064-254-0x00007FF622B20000-0x00007FF622F12000-memory.dmp

Filesize
3.9MB

Download
memory/3064-4548-0x00007FF622B20000-0x00007FF622F12000-memory.dmp

Filesize
3.9MB

Download
memory/3136-4578-0x00007FF6F8370000-0x00007FF6F8762000-memory.dmp

Filesize
3.9MB

Download
memory/3136-403-0x00007FF6F8370000-0x00007FF6F8762000-memory.dmp

Filesize
3.9MB

Download
memory/3516-401-0x00007FF69CEE0000-0x00007FF69D2D2000-memory.dmp

Filesize
3.9MB

Download
memory/3588-405-0x00007FF72D710000-0x00007FF72DB02000-memory.dmp

Filesize
3.9MB

Download
memory/3588-4569-0x00007FF72D710000-0x00007FF72DB02000-memory.dmp

Filesize
3.9MB

Download
memory/3628-4572-0x00007FF7B6D70000-0x00007FF7B7162000-memory.dmp

Filesize
3.9MB

Download
memory/3628-349-0x00007FF7B6D70000-0x00007FF7B7162000-memory.dmp

Filesize
3.9MB

Download
memory/3732-63-0x00007FFA105F0000-0x00007FFA110B1000-memory.dmp

Filesize
10.8MB

Download
memory/3732-12-0x00007FFA105F3000-0x00007FFA105F5000-memory.dmp

Filesize
8KB

Download
memory/3732-192-0x000001D2F1BA0000-0x000001D2F1BC2000-memory.dmp

Filesize
136KB

Download
memory/3732-173-0x00007FFA105F0000-0x00007FFA110B1000-memory.dmp

Filesize
10.8MB

Download
memory/4136-4557-0x00007FF6DD6C0000-0x00007FF6DDAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4136-181-0x00007FF6DD6C0000-0x00007FF6DDAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4180-300-0x00007FF6A4900000-0x00007FF6A4CF2000-memory.dmp

Filesize
3.9MB

Download
memory/4180-4539-0x00007FF6A4900000-0x00007FF6A4CF2000-memory.dmp

Filesize
3.9MB

Download
memory/4296-116-0x00007FF7C5020000-0x00007FF7C5412000-memory.dmp

Filesize
3.9MB

Download
memory/4296-4527-0x00007FF7C5020000-0x00007FF7C5412000-memory.dmp

Filesize
3.9MB

Download
memory/4428-4536-0x00007FF7FB560000-0x00007FF7FB952000-memory.dmp

Filesize
3.9MB

Download
memory/4428-220-0x00007FF7FB560000-0x00007FF7FB952000-memory.dmp

Filesize
3.9MB

Download
memory/4468-4605-0x00007FF600500000-0x00007FF6008F2000-memory.dmp

Filesize
3.9MB

Download
memory/4468-414-0x00007FF600500000-0x00007FF6008F2000-memory.dmp

Filesize
3.9MB

Download
memory/4544-237-0x00007FF638A90000-0x00007FF638E82000-memory.dmp

Filesize
3.9MB

Download
memory/4544-4532-0x00007FF638A90000-0x00007FF638E82000-memory.dmp

Filesize
3.9MB

Download
memory/4808-4596-0x00007FF703090000-0x00007FF703482000-memory.dmp

Filesize
3.9MB

Download
memory/4808-369-0x00007FF703090000-0x00007FF703482000-memory.dmp

Filesize
3.9MB

Download
memory/5020-236-0x00007FF7C19D0000-0x00007FF7C1DC2000-memory.dmp

Filesize
3.9MB

Download
memory/5020-4554-0x00007FF7C19D0000-0x00007FF7C1DC2000-memory.dmp

Filesize
3.9MB

Download
memory/5064-11-0x00007FF77B610000-0x00007FF77BA02000-memory.dmp

Filesize
3.9MB

Download
memory/5064-4518-0x00007FF77B610000-0x00007FF77BA02000-memory.dmp

Filesize
3.9MB

Download