xmrig | 92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0d

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
Size

1.2MB
MD5

4bad10d3641267de09f4378970fe2980
SHA1

39112bb6dca6c439a4b21cf5329f5fb7fa420765
SHA256

92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0d
SHA512

a4344e14568ece22cbe6d445217ad370b1b72a446d970f971c3f5d1a2b18aeb034f35eedae2ce5e135952f1d31028ff6068fcdf9293320b6e97f0e2c68231f69
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675ESA6:Lz071uv4BPMkFfdg6f

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/3068-9-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2696-38-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2748-65-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2820-148-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2532-145-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2860-144-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2656-143-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2660-142-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2800-138-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/2728-135-0x000000013F420000-0x000000013F812000-memory.dmp	xmrig
behavioral1/memory/2532-1449-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/3068-2977-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/3068-4296-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2800-4890-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/2728-4899-0x000000013F420000-0x000000013F812000-memory.dmp	xmrig
behavioral1/memory/2660-4896-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2696-4912-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2820-4903-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2860-4901-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1880	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3068	Iarzbtj.exe
2696	ioeyRIG.exe
2748	eGRxFsd.exe
2820	LxGxImL.exe
2728	XQEZhoB.exe
2800	jHozhng.exe
2660	amnnqPu.exe
2656	sTsgsZc.exe
2860	AUCBwjc.exe
2220	dIsntSB.exe
768	ilDUkhG.exe
2924	KoEcsIa.exe
1816	NFjormb.exe
1756	mlBnHyh.exe
604	MOCtMMG.exe
1248	PmzZNJg.exe
1704	THoOHGd.exe
2772	NhFsOYK.exe
2616	mxWeYHC.exe
1796	tiUKBiX.exe
844	HyPxhCu.exe
1040	BhADVJw.exe
320	SZMtdIm.exe
600	CUILLzf.exe
1488	xHHvNVO.exe
2840	ZUTsIIn.exe
2920	RBWQQPJ.exe
3048	YYPFIkR.exe
972	OvCJyRb.exe
1924	ULmVhbB.exe
2968	YmKcPJr.exe
1940	VdPJoRh.exe
2296	HtOCKpi.exe
1896	tEWYzKW.exe
912	NJloSFy.exe
1544	DnaRTiH.exe
2208	InDfliT.exe
3036	ghUVEhE.exe
1528	obhkaCt.exe
2360	yfRqkwE.exe
2116	lANiLTn.exe
336	HlYeebc.exe
2544	mBKeLyz.exe
1152	fqAjXgZ.exe
2104	FcysccV.exe
1988	hVCuVuy.exe
1508	eyfIhyn.exe
1960	zuzxDPR.exe
892	IrQhJmG.exe
2244	pulPHUz.exe
1184	vvtlymu.exe
2304	LDyBWNh.exe
1576	bRvmpfG.exe
2404	ZUlSRMU.exe
2160	nbbJbhf.exe
2848	FkQsuOb.exe
2268	XDzNIdz.exe
2836	dwCzswF.exe
2912	QMnAnpB.exe
2872	CWsCZFZ.exe
2604	Vgkuypo.exe
2724	ovMBFQZ.exe
1304	DvKWvGl.exe
992	yvdgAdJ.exe

Loads dropped DLL 64 IoCs

pid	Process
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2532-0-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/files/0x00090000000120f9-3.dat	upx
behavioral1/files/0x0008000000015ec9-21.dat	upx
behavioral1/files/0x000a000000015d79-17.dat	upx
behavioral1/files/0x0007000000015f71-29.dat	upx
behavioral1/files/0x0007000000004e74-20.dat	upx
behavioral1/memory/3068-9-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/files/0x0006000000016dd9-84.dat	upx
behavioral1/files/0x0006000000016d6d-75.dat	upx
behavioral1/files/0x0007000000015ff5-71.dat	upx
behavioral1/files/0x0006000000016d63-68.dat	upx
behavioral1/files/0x0006000000016d47-58.dat	upx
behavioral1/files/0x0006000000016d36-51.dat	upx
behavioral1/files/0x0008000000016101-44.dat	upx
behavioral1/memory/2696-38-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/files/0x000500000001868b-168.dat	upx
behavioral1/files/0x00050000000186f2-175.dat	upx
behavioral1/files/0x00050000000186f8-179.dat	upx
behavioral1/files/0x0009000000015d2a-171.dat	upx
behavioral1/files/0x0011000000018682-164.dat	upx
behavioral1/files/0x0006000000018669-163.dat	upx
behavioral1/files/0x0006000000017491-161.dat	upx
behavioral1/files/0x000600000001743a-160.dat	upx
behavioral1/files/0x0006000000016eb4-96.dat	upx
behavioral1/files/0x0006000000016de0-87.dat	upx
behavioral1/files/0x0006000000016d72-80.dat	upx
behavioral1/files/0x0006000000016d69-72.dat	upx
behavioral1/memory/2748-65-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/files/0x0006000000016d4f-62.dat	upx
behavioral1/files/0x0006000000016d3f-55.dat	upx
behavioral1/memory/2820-148-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2860-144-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2656-143-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/2660-142-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/2800-138-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/files/0x0008000000016241-136.dat	upx
behavioral1/memory/2728-135-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/files/0x001400000001866f-131.dat	upx
behavioral1/files/0x00060000000175e7-130.dat	upx
behavioral1/files/0x000600000001747d-127.dat	upx
behavioral1/files/0x0006000000017047-125.dat	upx
behavioral1/files/0x0006000000016dea-124.dat	upx
behavioral1/memory/2532-1449-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/memory/3068-2977-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/3068-4296-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2800-4890-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/2728-4899-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/memory/2660-4896-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/2696-4912-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2820-4903-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2860-4901-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\efwFEbA.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\KEyiDyP.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\tjyyVEt.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\rfycIrh.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\IqUcFkI.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\TJoiVIR.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\ObOkajn.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\ydveFfe.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\eChfeKn.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\aagUuiz.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\zHNZeUI.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\GwLrNYZ.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\rCABzEi.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\AxPdBDa.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\BVzINdA.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\juhSBxO.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\aKdxyOv.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\YzRRlrD.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\uBxhaQt.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\SASgbaE.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\krlfdeY.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\YreuDWP.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\QExhXdX.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\WeXQkVD.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\GmbVdeO.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\NCOUrNe.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\ljUThle.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\bkhMPca.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\gUuaPgl.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\EmMwXSV.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\WNiZgTa.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\JkjfxSn.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\YioMqSN.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\VwESKXb.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\JvvfRIy.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\EDqjdfJ.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\jwKpRxR.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\evpQDdk.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\fmpznSC.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\uxRbhMk.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\YFlbBym.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\wbBupPu.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\wBTEZNn.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\bPQzcJy.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\VuEnntd.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\keZpXws.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\DLwGSTH.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\tEdGWjs.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\wTlkkbk.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\fCgrAjP.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\AkukSWb.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\PjywFgg.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\qgXWclH.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\uOufxea.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\vOGPjQA.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\ECVooxW.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\mESZUmc.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\AyNzhTq.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\zhIkboe.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\veVZEGQ.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\sfYTQMj.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\pMdDpdQ.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\jIoFAtV.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
File created	C:\Windows\System\nWvqxBx.exe	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1880	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
Token: SeLockMemoryPrivilege	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
Token: SeDebugPrivilege	1880	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1880	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	31
PID 2532 wrote to memory of 1880	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	31
PID 2532 wrote to memory of 1880	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	31
PID 2532 wrote to memory of 3068	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	32
PID 2532 wrote to memory of 3068	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	32
PID 2532 wrote to memory of 3068	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	32
PID 2532 wrote to memory of 2696	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	33
PID 2532 wrote to memory of 2696	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	33
PID 2532 wrote to memory of 2696	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	33
PID 2532 wrote to memory of 2748	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	34
PID 2532 wrote to memory of 2748	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	34
PID 2532 wrote to memory of 2748	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	34
PID 2532 wrote to memory of 2820	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	35
PID 2532 wrote to memory of 2820	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	35
PID 2532 wrote to memory of 2820	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	35
PID 2532 wrote to memory of 2728	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	36
PID 2532 wrote to memory of 2728	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	36
PID 2532 wrote to memory of 2728	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	36
PID 2532 wrote to memory of 2860	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	37
PID 2532 wrote to memory of 2860	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	37
PID 2532 wrote to memory of 2860	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	37
PID 2532 wrote to memory of 2800	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	38
PID 2532 wrote to memory of 2800	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	38
PID 2532 wrote to memory of 2800	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	38
PID 2532 wrote to memory of 2772	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	39
PID 2532 wrote to memory of 2772	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	39
PID 2532 wrote to memory of 2772	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	39
PID 2532 wrote to memory of 2660	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	40
PID 2532 wrote to memory of 2660	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	40
PID 2532 wrote to memory of 2660	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	40
PID 2532 wrote to memory of 2616	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	41
PID 2532 wrote to memory of 2616	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	41
PID 2532 wrote to memory of 2616	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	41
PID 2532 wrote to memory of 2656	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	42
PID 2532 wrote to memory of 2656	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	42
PID 2532 wrote to memory of 2656	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	42
PID 2532 wrote to memory of 1796	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	43
PID 2532 wrote to memory of 1796	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	43
PID 2532 wrote to memory of 1796	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	43
PID 2532 wrote to memory of 2220	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	44
PID 2532 wrote to memory of 2220	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	44
PID 2532 wrote to memory of 2220	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	44
PID 2532 wrote to memory of 844	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	45
PID 2532 wrote to memory of 844	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	45
PID 2532 wrote to memory of 844	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	45
PID 2532 wrote to memory of 768	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	46
PID 2532 wrote to memory of 768	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	46
PID 2532 wrote to memory of 768	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	46
PID 2532 wrote to memory of 1040	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	47
PID 2532 wrote to memory of 1040	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	47
PID 2532 wrote to memory of 1040	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	47
PID 2532 wrote to memory of 2924	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	48
PID 2532 wrote to memory of 2924	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	48
PID 2532 wrote to memory of 2924	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	48
PID 2532 wrote to memory of 320	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	49
PID 2532 wrote to memory of 320	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	49
PID 2532 wrote to memory of 320	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	49
PID 2532 wrote to memory of 1816	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	50
PID 2532 wrote to memory of 1816	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	50
PID 2532 wrote to memory of 1816	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	50
PID 2532 wrote to memory of 600	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	51
PID 2532 wrote to memory of 600	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	51
PID 2532 wrote to memory of 600	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	51
PID 2532 wrote to memory of 1756	2532	92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe	52

C:\Users\Admin\AppData\Local\Temp\92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe
"C:\Users\Admin\AppData\Local\Temp\92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1880
- C:\Windows\System\Iarzbtj.exe
  C:\Windows\System\Iarzbtj.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\ioeyRIG.exe
  C:\Windows\System\ioeyRIG.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\eGRxFsd.exe
  C:\Windows\System\eGRxFsd.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\LxGxImL.exe
  C:\Windows\System\LxGxImL.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\XQEZhoB.exe
  C:\Windows\System\XQEZhoB.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\AUCBwjc.exe
  C:\Windows\System\AUCBwjc.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\jHozhng.exe
  C:\Windows\System\jHozhng.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\NhFsOYK.exe
  C:\Windows\System\NhFsOYK.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\amnnqPu.exe
  C:\Windows\System\amnnqPu.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\mxWeYHC.exe
  C:\Windows\System\mxWeYHC.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\sTsgsZc.exe
  C:\Windows\System\sTsgsZc.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\tiUKBiX.exe
  C:\Windows\System\tiUKBiX.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\dIsntSB.exe
  C:\Windows\System\dIsntSB.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\HyPxhCu.exe
  C:\Windows\System\HyPxhCu.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\ilDUkhG.exe
  C:\Windows\System\ilDUkhG.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\BhADVJw.exe
  C:\Windows\System\BhADVJw.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\KoEcsIa.exe
  C:\Windows\System\KoEcsIa.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\SZMtdIm.exe
  C:\Windows\System\SZMtdIm.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\NFjormb.exe
  C:\Windows\System\NFjormb.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\CUILLzf.exe
  C:\Windows\System\CUILLzf.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\mlBnHyh.exe
  C:\Windows\System\mlBnHyh.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\xHHvNVO.exe
  C:\Windows\System\xHHvNVO.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\MOCtMMG.exe
  C:\Windows\System\MOCtMMG.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\ZUTsIIn.exe
  C:\Windows\System\ZUTsIIn.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\PmzZNJg.exe
  C:\Windows\System\PmzZNJg.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\RBWQQPJ.exe
  C:\Windows\System\RBWQQPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\THoOHGd.exe
  C:\Windows\System\THoOHGd.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\YYPFIkR.exe
  C:\Windows\System\YYPFIkR.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\OvCJyRb.exe
  C:\Windows\System\OvCJyRb.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\ULmVhbB.exe
  C:\Windows\System\ULmVhbB.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\YmKcPJr.exe
  C:\Windows\System\YmKcPJr.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\VdPJoRh.exe
  C:\Windows\System\VdPJoRh.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\HtOCKpi.exe
  C:\Windows\System\HtOCKpi.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\tEWYzKW.exe
  C:\Windows\System\tEWYzKW.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\NJloSFy.exe
  C:\Windows\System\NJloSFy.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\DnaRTiH.exe
  C:\Windows\System\DnaRTiH.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\InDfliT.exe
  C:\Windows\System\InDfliT.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\ghUVEhE.exe
  C:\Windows\System\ghUVEhE.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\obhkaCt.exe
  C:\Windows\System\obhkaCt.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\yfRqkwE.exe
  C:\Windows\System\yfRqkwE.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\lANiLTn.exe
  C:\Windows\System\lANiLTn.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\HlYeebc.exe
  C:\Windows\System\HlYeebc.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\mBKeLyz.exe
  C:\Windows\System\mBKeLyz.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\fqAjXgZ.exe
  C:\Windows\System\fqAjXgZ.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\FcysccV.exe
  C:\Windows\System\FcysccV.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\hVCuVuy.exe
  C:\Windows\System\hVCuVuy.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\eyfIhyn.exe
  C:\Windows\System\eyfIhyn.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\zuzxDPR.exe
  C:\Windows\System\zuzxDPR.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\IrQhJmG.exe
  C:\Windows\System\IrQhJmG.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\pulPHUz.exe
  C:\Windows\System\pulPHUz.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\vvtlymu.exe
  C:\Windows\System\vvtlymu.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\LDyBWNh.exe
  C:\Windows\System\LDyBWNh.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\bRvmpfG.exe
  C:\Windows\System\bRvmpfG.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\ZUlSRMU.exe
  C:\Windows\System\ZUlSRMU.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\nbbJbhf.exe
  C:\Windows\System\nbbJbhf.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\FkQsuOb.exe
  C:\Windows\System\FkQsuOb.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\XDzNIdz.exe
  C:\Windows\System\XDzNIdz.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\dwCzswF.exe
  C:\Windows\System\dwCzswF.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\QMnAnpB.exe
  C:\Windows\System\QMnAnpB.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\CWsCZFZ.exe
  C:\Windows\System\CWsCZFZ.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\Vgkuypo.exe
  C:\Windows\System\Vgkuypo.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\ovMBFQZ.exe
  C:\Windows\System\ovMBFQZ.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\DvKWvGl.exe
  C:\Windows\System\DvKWvGl.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\yvdgAdJ.exe
  C:\Windows\System\yvdgAdJ.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\CFAtTtl.exe
  C:\Windows\System\CFAtTtl.exe
  2⤵
  PID:576
- C:\Windows\System\vbdBkZh.exe
  C:\Windows\System\vbdBkZh.exe
  2⤵
  PID:352
- C:\Windows\System\ScMdCsC.exe
  C:\Windows\System\ScMdCsC.exe
  2⤵
  PID:640
- C:\Windows\System\IitIYkf.exe
  C:\Windows\System\IitIYkf.exe
  2⤵
  PID:1640
- C:\Windows\System\utUEvlQ.exe
  C:\Windows\System\utUEvlQ.exe
  2⤵
  PID:2796
- C:\Windows\System\BKIPnNM.exe
  C:\Windows\System\BKIPnNM.exe
  2⤵
  PID:2988
- C:\Windows\System\FLkhhAI.exe
  C:\Windows\System\FLkhhAI.exe
  2⤵
  PID:2936
- C:\Windows\System\LCjaaYI.exe
  C:\Windows\System\LCjaaYI.exe
  2⤵
  PID:2652
- C:\Windows\System\eMsUSjp.exe
  C:\Windows\System\eMsUSjp.exe
  2⤵
  PID:2464
- C:\Windows\System\IgKCcpq.exe
  C:\Windows\System\IgKCcpq.exe
  2⤵
  PID:2664
- C:\Windows\System\pJFykMg.exe
  C:\Windows\System\pJFykMg.exe
  2⤵
  PID:2036
- C:\Windows\System\mVFjrfJ.exe
  C:\Windows\System\mVFjrfJ.exe
  2⤵
  PID:1140
- C:\Windows\System\EDqjdfJ.exe
  C:\Windows\System\EDqjdfJ.exe
  2⤵
  PID:2588
- C:\Windows\System\FidtnvS.exe
  C:\Windows\System\FidtnvS.exe
  2⤵
  PID:2476
- C:\Windows\System\carzecJ.exe
  C:\Windows\System\carzecJ.exe
  2⤵
  PID:988
- C:\Windows\System\PAaMbXO.exe
  C:\Windows\System\PAaMbXO.exe
  2⤵
  PID:1892
- C:\Windows\System\yUQgmMA.exe
  C:\Windows\System\yUQgmMA.exe
  2⤵
  PID:1540
- C:\Windows\System\WgLHynh.exe
  C:\Windows\System\WgLHynh.exe
  2⤵
  PID:2460
- C:\Windows\System\NBQLcaa.exe
  C:\Windows\System\NBQLcaa.exe
  2⤵
  PID:2228
- C:\Windows\System\fJEuUHB.exe
  C:\Windows\System\fJEuUHB.exe
  2⤵
  PID:1060
- C:\Windows\System\iNYmGJn.exe
  C:\Windows\System\iNYmGJn.exe
  2⤵
  PID:2252
- C:\Windows\System\UPojDbW.exe
  C:\Windows\System\UPojDbW.exe
  2⤵
  PID:2468
- C:\Windows\System\ZtYyMqI.exe
  C:\Windows\System\ZtYyMqI.exe
  2⤵
  PID:1512
- C:\Windows\System\imoGLOO.exe
  C:\Windows\System\imoGLOO.exe
  2⤵
  PID:1944
- C:\Windows\System\uHtYIew.exe
  C:\Windows\System\uHtYIew.exe
  2⤵
  PID:2396
- C:\Windows\System\SJfpFJG.exe
  C:\Windows\System\SJfpFJG.exe
  2⤵
  PID:1600
- C:\Windows\System\TyWGbpm.exe
  C:\Windows\System\TyWGbpm.exe
  2⤵
  PID:2788
- C:\Windows\System\XFABGuY.exe
  C:\Windows\System\XFABGuY.exe
  2⤵
  PID:2832
- C:\Windows\System\bqTVhFP.exe
  C:\Windows\System\bqTVhFP.exe
  2⤵
  PID:2332
- C:\Windows\System\AuIQbsW.exe
  C:\Windows\System\AuIQbsW.exe
  2⤵
  PID:2600
- C:\Windows\System\wlItUPe.exe
  C:\Windows\System\wlItUPe.exe
  2⤵
  PID:684
- C:\Windows\System\gLgSAtf.exe
  C:\Windows\System\gLgSAtf.exe
  2⤵
  PID:2904
- C:\Windows\System\ThIlyQS.exe
  C:\Windows\System\ThIlyQS.exe
  2⤵
  PID:1440
- C:\Windows\System\KyDVyGH.exe
  C:\Windows\System\KyDVyGH.exe
  2⤵
  PID:2124
- C:\Windows\System\gyyfTHa.exe
  C:\Windows\System\gyyfTHa.exe
  2⤵
  PID:2736
- C:\Windows\System\SBaNTuF.exe
  C:\Windows\System\SBaNTuF.exe
  2⤵
  PID:1480
- C:\Windows\System\ooDnJlj.exe
  C:\Windows\System\ooDnJlj.exe
  2⤵
  PID:572
- C:\Windows\System\DQKFnUT.exe
  C:\Windows\System\DQKFnUT.exe
  2⤵
  PID:628
- C:\Windows\System\PPdSwXt.exe
  C:\Windows\System\PPdSwXt.exe
  2⤵
  PID:1912
- C:\Windows\System\sbRbofp.exe
  C:\Windows\System\sbRbofp.exe
  2⤵
  PID:3080
- C:\Windows\System\RtuTtvG.exe
  C:\Windows\System\RtuTtvG.exe
  2⤵
  PID:3096
- C:\Windows\System\mEDnBKs.exe
  C:\Windows\System\mEDnBKs.exe
  2⤵
  PID:3112
- C:\Windows\System\IzyFqfT.exe
  C:\Windows\System\IzyFqfT.exe
  2⤵
  PID:3128
- C:\Windows\System\gnzQfJn.exe
  C:\Windows\System\gnzQfJn.exe
  2⤵
  PID:3144
- C:\Windows\System\wlZOcIM.exe
  C:\Windows\System\wlZOcIM.exe
  2⤵
  PID:3160
- C:\Windows\System\WNiZgTa.exe
  C:\Windows\System\WNiZgTa.exe
  2⤵
  PID:3176
- C:\Windows\System\KhnALiU.exe
  C:\Windows\System\KhnALiU.exe
  2⤵
  PID:3192
- C:\Windows\System\KBFjjyY.exe
  C:\Windows\System\KBFjjyY.exe
  2⤵
  PID:3208
- C:\Windows\System\LcNuncC.exe
  C:\Windows\System\LcNuncC.exe
  2⤵
  PID:3224
- C:\Windows\System\AMmBhqt.exe
  C:\Windows\System\AMmBhqt.exe
  2⤵
  PID:3240
- C:\Windows\System\rlnffZk.exe
  C:\Windows\System\rlnffZk.exe
  2⤵
  PID:3256
- C:\Windows\System\nJDqSXl.exe
  C:\Windows\System\nJDqSXl.exe
  2⤵
  PID:3272
- C:\Windows\System\NtOZneh.exe
  C:\Windows\System\NtOZneh.exe
  2⤵
  PID:3288
- C:\Windows\System\udHLuLu.exe
  C:\Windows\System\udHLuLu.exe
  2⤵
  PID:3304
- C:\Windows\System\VNPqEnE.exe
  C:\Windows\System\VNPqEnE.exe
  2⤵
  PID:3320
- C:\Windows\System\RrsAxUY.exe
  C:\Windows\System\RrsAxUY.exe
  2⤵
  PID:3336
- C:\Windows\System\meccNKy.exe
  C:\Windows\System\meccNKy.exe
  2⤵
  PID:3352
- C:\Windows\System\DVOiDSu.exe
  C:\Windows\System\DVOiDSu.exe
  2⤵
  PID:3368
- C:\Windows\System\unEQupT.exe
  C:\Windows\System\unEQupT.exe
  2⤵
  PID:3384
- C:\Windows\System\quUyIvr.exe
  C:\Windows\System\quUyIvr.exe
  2⤵
  PID:3400
- C:\Windows\System\GxHhhoI.exe
  C:\Windows\System\GxHhhoI.exe
  2⤵
  PID:3416
- C:\Windows\System\YFlbBym.exe
  C:\Windows\System\YFlbBym.exe
  2⤵
  PID:3432
- C:\Windows\System\ibFQDHW.exe
  C:\Windows\System\ibFQDHW.exe
  2⤵
  PID:3448
- C:\Windows\System\DcGmCWw.exe
  C:\Windows\System\DcGmCWw.exe
  2⤵
  PID:3464
- C:\Windows\System\cOuHWxK.exe
  C:\Windows\System\cOuHWxK.exe
  2⤵
  PID:3480
- C:\Windows\System\nHskyoh.exe
  C:\Windows\System\nHskyoh.exe
  2⤵
  PID:3496
- C:\Windows\System\YryvrlZ.exe
  C:\Windows\System\YryvrlZ.exe
  2⤵
  PID:3512
- C:\Windows\System\uRBjUGy.exe
  C:\Windows\System\uRBjUGy.exe
  2⤵
  PID:3528
- C:\Windows\System\vSgcchg.exe
  C:\Windows\System\vSgcchg.exe
  2⤵
  PID:3544
- C:\Windows\System\KDzQdLU.exe
  C:\Windows\System\KDzQdLU.exe
  2⤵
  PID:3560
- C:\Windows\System\dWnnzAk.exe
  C:\Windows\System\dWnnzAk.exe
  2⤵
  PID:3576
- C:\Windows\System\UIoRaCL.exe
  C:\Windows\System\UIoRaCL.exe
  2⤵
  PID:3592
- C:\Windows\System\iMLANvb.exe
  C:\Windows\System\iMLANvb.exe
  2⤵
  PID:3608
- C:\Windows\System\IoZTRSL.exe
  C:\Windows\System\IoZTRSL.exe
  2⤵
  PID:3624
- C:\Windows\System\xLxyFGx.exe
  C:\Windows\System\xLxyFGx.exe
  2⤵
  PID:3640
- C:\Windows\System\WeXQkVD.exe
  C:\Windows\System\WeXQkVD.exe
  2⤵
  PID:3656
- C:\Windows\System\OKLUdCr.exe
  C:\Windows\System\OKLUdCr.exe
  2⤵
  PID:3672
- C:\Windows\System\akvLkTC.exe
  C:\Windows\System\akvLkTC.exe
  2⤵
  PID:3688
- C:\Windows\System\zGfBzuf.exe
  C:\Windows\System\zGfBzuf.exe
  2⤵
  PID:3704
- C:\Windows\System\XqnKBYK.exe
  C:\Windows\System\XqnKBYK.exe
  2⤵
  PID:3720
- C:\Windows\System\qPOXkRN.exe
  C:\Windows\System\qPOXkRN.exe
  2⤵
  PID:3736
- C:\Windows\System\BMRncpe.exe
  C:\Windows\System\BMRncpe.exe
  2⤵
  PID:3752
- C:\Windows\System\QqkoPvv.exe
  C:\Windows\System\QqkoPvv.exe
  2⤵
  PID:3768
- C:\Windows\System\preQMjy.exe
  C:\Windows\System\preQMjy.exe
  2⤵
  PID:3784
- C:\Windows\System\pJXxCuz.exe
  C:\Windows\System\pJXxCuz.exe
  2⤵
  PID:3800
- C:\Windows\System\rhTuEdS.exe
  C:\Windows\System\rhTuEdS.exe
  2⤵
  PID:3816
- C:\Windows\System\kyWvSYV.exe
  C:\Windows\System\kyWvSYV.exe
  2⤵
  PID:3832
- C:\Windows\System\dHCWSDt.exe
  C:\Windows\System\dHCWSDt.exe
  2⤵
  PID:3848
- C:\Windows\System\ZxIjrrH.exe
  C:\Windows\System\ZxIjrrH.exe
  2⤵
  PID:3864
- C:\Windows\System\FCnQCkV.exe
  C:\Windows\System\FCnQCkV.exe
  2⤵
  PID:3880
- C:\Windows\System\LhbGYnB.exe
  C:\Windows\System\LhbGYnB.exe
  2⤵
  PID:3896
- C:\Windows\System\bNfIuxT.exe
  C:\Windows\System\bNfIuxT.exe
  2⤵
  PID:3912
- C:\Windows\System\ctcqVWV.exe
  C:\Windows\System\ctcqVWV.exe
  2⤵
  PID:3928
- C:\Windows\System\ZvjVfSP.exe
  C:\Windows\System\ZvjVfSP.exe
  2⤵
  PID:3944
- C:\Windows\System\JGBojmo.exe
  C:\Windows\System\JGBojmo.exe
  2⤵
  PID:3960
- C:\Windows\System\Wglwtvf.exe
  C:\Windows\System\Wglwtvf.exe
  2⤵
  PID:3976
- C:\Windows\System\zEnAQeB.exe
  C:\Windows\System\zEnAQeB.exe
  2⤵
  PID:3992
- C:\Windows\System\hfQHpoC.exe
  C:\Windows\System\hfQHpoC.exe
  2⤵
  PID:4008
- C:\Windows\System\JrCrlUc.exe
  C:\Windows\System\JrCrlUc.exe
  2⤵
  PID:4024
- C:\Windows\System\WxTpGCS.exe
  C:\Windows\System\WxTpGCS.exe
  2⤵
  PID:4040
- C:\Windows\System\TxTURpQ.exe
  C:\Windows\System\TxTURpQ.exe
  2⤵
  PID:4056
- C:\Windows\System\GOrUwMU.exe
  C:\Windows\System\GOrUwMU.exe
  2⤵
  PID:4072
- C:\Windows\System\yIODzUJ.exe
  C:\Windows\System\yIODzUJ.exe
  2⤵
  PID:4088
- C:\Windows\System\IuEohoL.exe
  C:\Windows\System\IuEohoL.exe
  2⤵
  PID:2128
- C:\Windows\System\eQXCpjE.exe
  C:\Windows\System\eQXCpjE.exe
  2⤵
  PID:3028
- C:\Windows\System\gfTNkLu.exe
  C:\Windows\System\gfTNkLu.exe
  2⤵
  PID:2300
- C:\Windows\System\hdaBNSF.exe
  C:\Windows\System\hdaBNSF.exe
  2⤵
  PID:1628
- C:\Windows\System\lENndig.exe
  C:\Windows\System\lENndig.exe
  2⤵
  PID:1524
- C:\Windows\System\hiMdlqV.exe
  C:\Windows\System\hiMdlqV.exe
  2⤵
  PID:2172
- C:\Windows\System\VmMgrwq.exe
  C:\Windows\System\VmMgrwq.exe
  2⤵
  PID:2740
- C:\Windows\System\sBhIrzQ.exe
  C:\Windows\System\sBhIrzQ.exe
  2⤵
  PID:1900
- C:\Windows\System\gUuaPgl.exe
  C:\Windows\System\gUuaPgl.exe
  2⤵
  PID:2804
- C:\Windows\System\tQXXcaJ.exe
  C:\Windows\System\tQXXcaJ.exe
  2⤵
  PID:2648
- C:\Windows\System\CBGXfTY.exe
  C:\Windows\System\CBGXfTY.exe
  2⤵
  PID:236
- C:\Windows\System\BspGmWg.exe
  C:\Windows\System\BspGmWg.exe
  2⤵
  PID:2072
- C:\Windows\System\DwqhOBU.exe
  C:\Windows\System\DwqhOBU.exe
  2⤵
  PID:3104
- C:\Windows\System\BtdqxYV.exe
  C:\Windows\System\BtdqxYV.exe
  2⤵
  PID:3136
- C:\Windows\System\vsjAGLP.exe
  C:\Windows\System\vsjAGLP.exe
  2⤵
  PID:3156
- C:\Windows\System\gFVtrZx.exe
  C:\Windows\System\gFVtrZx.exe
  2⤵
  PID:3184
- C:\Windows\System\PWHadHr.exe
  C:\Windows\System\PWHadHr.exe
  2⤵
  PID:3204
- C:\Windows\System\NEyetPV.exe
  C:\Windows\System\NEyetPV.exe
  2⤵
  PID:3236
- C:\Windows\System\UdWlbvy.exe
  C:\Windows\System\UdWlbvy.exe
  2⤵
  PID:3268
- C:\Windows\System\CGpZlDL.exe
  C:\Windows\System\CGpZlDL.exe
  2⤵
  PID:3300
- C:\Windows\System\SNCJmOK.exe
  C:\Windows\System\SNCJmOK.exe
  2⤵
  PID:3316
- C:\Windows\System\OWCMNMd.exe
  C:\Windows\System\OWCMNMd.exe
  2⤵
  PID:3364
- C:\Windows\System\ucrYjsy.exe
  C:\Windows\System\ucrYjsy.exe
  2⤵
  PID:1804
- C:\Windows\System\iRqttAK.exe
  C:\Windows\System\iRqttAK.exe
  2⤵
  PID:1580
- C:\Windows\System\KeSEhhw.exe
  C:\Windows\System\KeSEhhw.exe
  2⤵
  PID:3440
- C:\Windows\System\HqKbLyX.exe
  C:\Windows\System\HqKbLyX.exe
  2⤵
  PID:3472
- C:\Windows\System\dvClulb.exe
  C:\Windows\System\dvClulb.exe
  2⤵
  PID:1920
- C:\Windows\System\MuceNUZ.exe
  C:\Windows\System\MuceNUZ.exe
  2⤵
  PID:3508
- C:\Windows\System\IGDUpoh.exe
  C:\Windows\System\IGDUpoh.exe
  2⤵
  PID:3556
- C:\Windows\System\DmctDGa.exe
  C:\Windows\System\DmctDGa.exe
  2⤵
  PID:3588
- C:\Windows\System\LWAUBBo.exe
  C:\Windows\System\LWAUBBo.exe
  2⤵
  PID:3620
- C:\Windows\System\hzHbcNM.exe
  C:\Windows\System\hzHbcNM.exe
  2⤵
  PID:3652
- C:\Windows\System\DRtFEOY.exe
  C:\Windows\System\DRtFEOY.exe
  2⤵
  PID:3680
- C:\Windows\System\XCPfDXd.exe
  C:\Windows\System\XCPfDXd.exe
  2⤵
  PID:3700
- C:\Windows\System\SzMSLgu.exe
  C:\Windows\System\SzMSLgu.exe
  2⤵
  PID:3744
- C:\Windows\System\zlNKDiv.exe
  C:\Windows\System\zlNKDiv.exe
  2⤵
  PID:3764
- C:\Windows\System\AxjDLiA.exe
  C:\Windows\System\AxjDLiA.exe
  2⤵
  PID:3796
- C:\Windows\System\KechPjW.exe
  C:\Windows\System\KechPjW.exe
  2⤵
  PID:2704
- C:\Windows\System\tRQxkcJ.exe
  C:\Windows\System\tRQxkcJ.exe
  2⤵
  PID:1736
- C:\Windows\System\vPSeaJa.exe
  C:\Windows\System\vPSeaJa.exe
  2⤵
  PID:3872
- C:\Windows\System\iFNmUjw.exe
  C:\Windows\System\iFNmUjw.exe
  2⤵
  PID:3904
- C:\Windows\System\skZRAFa.exe
  C:\Windows\System\skZRAFa.exe
  2⤵
  PID:3924
- C:\Windows\System\ecHozsM.exe
  C:\Windows\System\ecHozsM.exe
  2⤵
  PID:3956
- C:\Windows\System\VLcFCPK.exe
  C:\Windows\System\VLcFCPK.exe
  2⤵
  PID:3988
- C:\Windows\System\DQORvIf.exe
  C:\Windows\System\DQORvIf.exe
  2⤵
  PID:4032
- C:\Windows\System\rxiSDJY.exe
  C:\Windows\System\rxiSDJY.exe
  2⤵
  PID:4052
- C:\Windows\System\SqnQnHG.exe
  C:\Windows\System\SqnQnHG.exe
  2⤵
  PID:4084
- C:\Windows\System\XmXGjGp.exe
  C:\Windows\System\XmXGjGp.exe
  2⤵
  PID:824
- C:\Windows\System\bhvyDFz.exe
  C:\Windows\System\bhvyDFz.exe
  2⤵
  PID:1268
- C:\Windows\System\xaxFAoS.exe
  C:\Windows\System\xaxFAoS.exe
  2⤵
  PID:1504
- C:\Windows\System\oenUQaF.exe
  C:\Windows\System\oenUQaF.exe
  2⤵
  PID:2084
- C:\Windows\System\wUsMKeB.exe
  C:\Windows\System\wUsMKeB.exe
  2⤵
  PID:1648
- C:\Windows\System\sbvLhTF.exe
  C:\Windows\System\sbvLhTF.exe
  2⤵
  PID:2948
- C:\Windows\System\nUZgtCx.exe
  C:\Windows\System\nUZgtCx.exe
  2⤵
  PID:2188
- C:\Windows\System\qyMKLLn.exe
  C:\Windows\System\qyMKLLn.exe
  2⤵
  PID:3088
- C:\Windows\System\DZvvNxb.exe
  C:\Windows\System\DZvvNxb.exe
  2⤵
  PID:3152
- C:\Windows\System\zWFqqTX.exe
  C:\Windows\System\zWFqqTX.exe
  2⤵
  PID:3188
- C:\Windows\System\ZYYWYMY.exe
  C:\Windows\System\ZYYWYMY.exe
  2⤵
  PID:3264
- C:\Windows\System\TVMylYL.exe
  C:\Windows\System\TVMylYL.exe
  2⤵
  PID:3312
- C:\Windows\System\ZYplTKT.exe
  C:\Windows\System\ZYplTKT.exe
  2⤵
  PID:3392
- C:\Windows\System\vvqonuj.exe
  C:\Windows\System\vvqonuj.exe
  2⤵
  PID:3428
- C:\Windows\System\ICHaGUj.exe
  C:\Windows\System\ICHaGUj.exe
  2⤵
  PID:3492
- C:\Windows\System\KipiwMq.exe
  C:\Windows\System\KipiwMq.exe
  2⤵
  PID:3552
- C:\Windows\System\TklniBt.exe
  C:\Windows\System\TklniBt.exe
  2⤵
  PID:3604
- C:\Windows\System\HyvTCzz.exe
  C:\Windows\System\HyvTCzz.exe
  2⤵
  PID:3664
- C:\Windows\System\TFDBDbG.exe
  C:\Windows\System\TFDBDbG.exe
  2⤵
  PID:3716
- C:\Windows\System\Uvpcxzm.exe
  C:\Windows\System\Uvpcxzm.exe
  2⤵
  PID:3780
- C:\Windows\System\tfCqZrQ.exe
  C:\Windows\System\tfCqZrQ.exe
  2⤵
  PID:3824
- C:\Windows\System\XqfWygl.exe
  C:\Windows\System\XqfWygl.exe
  2⤵
  PID:3856
- C:\Windows\System\pMjtyGD.exe
  C:\Windows\System\pMjtyGD.exe
  2⤵
  PID:3940
- C:\Windows\System\PlzJoQB.exe
  C:\Windows\System\PlzJoQB.exe
  2⤵
  PID:3984
- C:\Windows\System\GDEvtsQ.exe
  C:\Windows\System\GDEvtsQ.exe
  2⤵
  PID:4068
- C:\Windows\System\oeDKJkf.exe
  C:\Windows\System\oeDKJkf.exe
  2⤵
  PID:1592
- C:\Windows\System\VXcqDxU.exe
  C:\Windows\System\VXcqDxU.exe
  2⤵
  PID:1864
- C:\Windows\System\Ofmnmyt.exe
  C:\Windows\System\Ofmnmyt.exe
  2⤵
  PID:2900
- C:\Windows\System\tXjVBRZ.exe
  C:\Windows\System\tXjVBRZ.exe
  2⤵
  PID:2368
- C:\Windows\System\fiSIbHy.exe
  C:\Windows\System\fiSIbHy.exe
  2⤵
  PID:3172
- C:\Windows\System\MBHnQpX.exe
  C:\Windows\System\MBHnQpX.exe
  2⤵
  PID:3332
- C:\Windows\System\BeoPMXV.exe
  C:\Windows\System\BeoPMXV.exe
  2⤵
  PID:588
- C:\Windows\System\gAQQVXR.exe
  C:\Windows\System\gAQQVXR.exe
  2⤵
  PID:3504
- C:\Windows\System\pSOxmVT.exe
  C:\Windows\System\pSOxmVT.exe
  2⤵
  PID:4108
- C:\Windows\System\OPOvDwM.exe
  C:\Windows\System\OPOvDwM.exe
  2⤵
  PID:4124
- C:\Windows\System\cOaFneP.exe
  C:\Windows\System\cOaFneP.exe
  2⤵
  PID:4140
- C:\Windows\System\JuSrlQA.exe
  C:\Windows\System\JuSrlQA.exe
  2⤵
  PID:4156
- C:\Windows\System\bOteikP.exe
  C:\Windows\System\bOteikP.exe
  2⤵
  PID:4172
- C:\Windows\System\wjRRWzH.exe
  C:\Windows\System\wjRRWzH.exe
  2⤵
  PID:4188
- C:\Windows\System\fCCgXBO.exe
  C:\Windows\System\fCCgXBO.exe
  2⤵
  PID:4204
- C:\Windows\System\mdFSCgG.exe
  C:\Windows\System\mdFSCgG.exe
  2⤵
  PID:4220
- C:\Windows\System\ssKTAyS.exe
  C:\Windows\System\ssKTAyS.exe
  2⤵
  PID:4236
- C:\Windows\System\XTYiTqs.exe
  C:\Windows\System\XTYiTqs.exe
  2⤵
  PID:4252
- C:\Windows\System\PfAzKxu.exe
  C:\Windows\System\PfAzKxu.exe
  2⤵
  PID:4268
- C:\Windows\System\zhOWPWL.exe
  C:\Windows\System\zhOWPWL.exe
  2⤵
  PID:4284
- C:\Windows\System\vZrMGLb.exe
  C:\Windows\System\vZrMGLb.exe
  2⤵
  PID:4300
- C:\Windows\System\GXvsWGq.exe
  C:\Windows\System\GXvsWGq.exe
  2⤵
  PID:4316
- C:\Windows\System\BHrsobT.exe
  C:\Windows\System\BHrsobT.exe
  2⤵
  PID:4332
- C:\Windows\System\ZKgnEeD.exe
  C:\Windows\System\ZKgnEeD.exe
  2⤵
  PID:4348
- C:\Windows\System\hreqxon.exe
  C:\Windows\System\hreqxon.exe
  2⤵
  PID:4364
- C:\Windows\System\MKNZHbK.exe
  C:\Windows\System\MKNZHbK.exe
  2⤵
  PID:4380
- C:\Windows\System\DvPGdoK.exe
  C:\Windows\System\DvPGdoK.exe
  2⤵
  PID:4396
- C:\Windows\System\PThjlkY.exe
  C:\Windows\System\PThjlkY.exe
  2⤵
  PID:4412
- C:\Windows\System\iataJQt.exe
  C:\Windows\System\iataJQt.exe
  2⤵
  PID:4428
- C:\Windows\System\dBdAYCL.exe
  C:\Windows\System\dBdAYCL.exe
  2⤵
  PID:4444
- C:\Windows\System\UjieeVI.exe
  C:\Windows\System\UjieeVI.exe
  2⤵
  PID:4460
- C:\Windows\System\zqqScMI.exe
  C:\Windows\System\zqqScMI.exe
  2⤵
  PID:4476
- C:\Windows\System\QUuvgDH.exe
  C:\Windows\System\QUuvgDH.exe
  2⤵
  PID:4492
- C:\Windows\System\VPGDrKv.exe
  C:\Windows\System\VPGDrKv.exe
  2⤵
  PID:4508
- C:\Windows\System\ycFWyCc.exe
  C:\Windows\System\ycFWyCc.exe
  2⤵
  PID:4524
- C:\Windows\System\BQzjJtG.exe
  C:\Windows\System\BQzjJtG.exe
  2⤵
  PID:4540
- C:\Windows\System\uvPxskz.exe
  C:\Windows\System\uvPxskz.exe
  2⤵
  PID:4556
- C:\Windows\System\rZcIsWb.exe
  C:\Windows\System\rZcIsWb.exe
  2⤵
  PID:4572
- C:\Windows\System\jwKpRxR.exe
  C:\Windows\System\jwKpRxR.exe
  2⤵
  PID:4588
- C:\Windows\System\XvFcCMV.exe
  C:\Windows\System\XvFcCMV.exe
  2⤵
  PID:4604
- C:\Windows\System\omvoQCW.exe
  C:\Windows\System\omvoQCW.exe
  2⤵
  PID:4620
- C:\Windows\System\uAYGouA.exe
  C:\Windows\System\uAYGouA.exe
  2⤵
  PID:4636
- C:\Windows\System\BzyRLyr.exe
  C:\Windows\System\BzyRLyr.exe
  2⤵
  PID:4652
- C:\Windows\System\RfMmYMz.exe
  C:\Windows\System\RfMmYMz.exe
  2⤵
  PID:4668
- C:\Windows\System\ReyEzqW.exe
  C:\Windows\System\ReyEzqW.exe
  2⤵
  PID:4684
- C:\Windows\System\RTebaPz.exe
  C:\Windows\System\RTebaPz.exe
  2⤵
  PID:4700
- C:\Windows\System\pGqekxX.exe
  C:\Windows\System\pGqekxX.exe
  2⤵
  PID:4716
- C:\Windows\System\yWadWPI.exe
  C:\Windows\System\yWadWPI.exe
  2⤵
  PID:4732
- C:\Windows\System\GcpSkdS.exe
  C:\Windows\System\GcpSkdS.exe
  2⤵
  PID:4748
- C:\Windows\System\nfSbIbr.exe
  C:\Windows\System\nfSbIbr.exe
  2⤵
  PID:4764
- C:\Windows\System\Ebzehrp.exe
  C:\Windows\System\Ebzehrp.exe
  2⤵
  PID:4780
- C:\Windows\System\fRhjxHU.exe
  C:\Windows\System\fRhjxHU.exe
  2⤵
  PID:4796
- C:\Windows\System\IDjCCeL.exe
  C:\Windows\System\IDjCCeL.exe
  2⤵
  PID:4812
- C:\Windows\System\QbSZzMv.exe
  C:\Windows\System\QbSZzMv.exe
  2⤵
  PID:4828
- C:\Windows\System\WAYPysP.exe
  C:\Windows\System\WAYPysP.exe
  2⤵
  PID:4844
- C:\Windows\System\gGpqLKs.exe
  C:\Windows\System\gGpqLKs.exe
  2⤵
  PID:4860
- C:\Windows\System\EpuLsFA.exe
  C:\Windows\System\EpuLsFA.exe
  2⤵
  PID:4876
- C:\Windows\System\EMXPlMv.exe
  C:\Windows\System\EMXPlMv.exe
  2⤵
  PID:4892
- C:\Windows\System\anYgtUT.exe
  C:\Windows\System\anYgtUT.exe
  2⤵
  PID:4908
- C:\Windows\System\vpWQeGG.exe
  C:\Windows\System\vpWQeGG.exe
  2⤵
  PID:4924
- C:\Windows\System\xWoIBqm.exe
  C:\Windows\System\xWoIBqm.exe
  2⤵
  PID:4940
- C:\Windows\System\HFlXokT.exe
  C:\Windows\System\HFlXokT.exe
  2⤵
  PID:4956
- C:\Windows\System\jHcmbdY.exe
  C:\Windows\System\jHcmbdY.exe
  2⤵
  PID:4972
- C:\Windows\System\wgxAvBA.exe
  C:\Windows\System\wgxAvBA.exe
  2⤵
  PID:4988
- C:\Windows\System\Ddgfvur.exe
  C:\Windows\System\Ddgfvur.exe
  2⤵
  PID:5004
- C:\Windows\System\RXaNlvP.exe
  C:\Windows\System\RXaNlvP.exe
  2⤵
  PID:5020
- C:\Windows\System\iRZXerM.exe
  C:\Windows\System\iRZXerM.exe
  2⤵
  PID:5036
- C:\Windows\System\giYKRWp.exe
  C:\Windows\System\giYKRWp.exe
  2⤵
  PID:5052
- C:\Windows\System\QuUVsOZ.exe
  C:\Windows\System\QuUVsOZ.exe
  2⤵
  PID:5068
- C:\Windows\System\plFRPXT.exe
  C:\Windows\System\plFRPXT.exe
  2⤵
  PID:5084
- C:\Windows\System\gtDmpUa.exe
  C:\Windows\System\gtDmpUa.exe
  2⤵
  PID:5100
- C:\Windows\System\UgReCpF.exe
  C:\Windows\System\UgReCpF.exe
  2⤵
  PID:5116
- C:\Windows\System\xGglzlB.exe
  C:\Windows\System\xGglzlB.exe
  2⤵
  PID:3648
- C:\Windows\System\yhzMFFW.exe
  C:\Windows\System\yhzMFFW.exe
  2⤵
  PID:3760
- C:\Windows\System\SOprArR.exe
  C:\Windows\System\SOprArR.exe
  2⤵
  PID:3812
- C:\Windows\System\vNPieqm.exe
  C:\Windows\System\vNPieqm.exe
  2⤵
  PID:3040
- C:\Windows\System\BxKPVvZ.exe
  C:\Windows\System\BxKPVvZ.exe
  2⤵
  PID:2584
- C:\Windows\System\lVbOzXU.exe
  C:\Windows\System\lVbOzXU.exe
  2⤵
  PID:2156
- C:\Windows\System\mWUwGbK.exe
  C:\Windows\System\mWUwGbK.exe
  2⤵
  PID:1948
- C:\Windows\System\LjldKRW.exe
  C:\Windows\System\LjldKRW.exe
  2⤵
  PID:1744
- C:\Windows\System\NmeEgBh.exe
  C:\Windows\System\NmeEgBh.exe
  2⤵
  PID:2952
- C:\Windows\System\jXrtiLR.exe
  C:\Windows\System\jXrtiLR.exe
  2⤵
  PID:2564
- C:\Windows\System\qXCqOaH.exe
  C:\Windows\System\qXCqOaH.exe
  2⤵
  PID:1740
- C:\Windows\System\BYzryhH.exe
  C:\Windows\System\BYzryhH.exe
  2⤵
  PID:2972
- C:\Windows\System\qOEAZll.exe
  C:\Windows\System\qOEAZll.exe
  2⤵
  PID:3124
- C:\Windows\System\LBWIVMb.exe
  C:\Windows\System\LBWIVMb.exe
  2⤵
  PID:3360
- C:\Windows\System\IGDWaFK.exe
  C:\Windows\System\IGDWaFK.exe
  2⤵
  PID:4100
- C:\Windows\System\mfIFHkm.exe
  C:\Windows\System\mfIFHkm.exe
  2⤵
  PID:4116
- C:\Windows\System\SNyFkJL.exe
  C:\Windows\System\SNyFkJL.exe
  2⤵
  PID:4148
- C:\Windows\System\jkRqZYs.exe
  C:\Windows\System\jkRqZYs.exe
  2⤵
  PID:1036
- C:\Windows\System\vXVbQHg.exe
  C:\Windows\System\vXVbQHg.exe
  2⤵
  PID:4184
- C:\Windows\System\HagyvMi.exe
  C:\Windows\System\HagyvMi.exe
  2⤵
  PID:4212
- C:\Windows\System\JeAHqpZ.exe
  C:\Windows\System\JeAHqpZ.exe
  2⤵
  PID:4232
- C:\Windows\System\DwRUPcC.exe
  C:\Windows\System\DwRUPcC.exe
  2⤵
  PID:1188
- C:\Windows\System\DgmbHqT.exe
  C:\Windows\System\DgmbHqT.exe
  2⤵
  PID:4280
- C:\Windows\System\AMgJVHJ.exe
  C:\Windows\System\AMgJVHJ.exe
  2⤵
  PID:4312
- C:\Windows\System\QTmAMqs.exe
  C:\Windows\System\QTmAMqs.exe
  2⤵
  PID:4344
- C:\Windows\System\MtJvMyP.exe
  C:\Windows\System\MtJvMyP.exe
  2⤵
  PID:4372
- C:\Windows\System\RUPeCuB.exe
  C:\Windows\System\RUPeCuB.exe
  2⤵
  PID:4404
- C:\Windows\System\Xpezdlk.exe
  C:\Windows\System\Xpezdlk.exe
  2⤵
  PID:3012
- C:\Windows\System\aUCkPcn.exe
  C:\Windows\System\aUCkPcn.exe
  2⤵
  PID:4456
- C:\Windows\System\OxWjKeo.exe
  C:\Windows\System\OxWjKeo.exe
  2⤵
  PID:4488
- C:\Windows\System\AlJCNDY.exe
  C:\Windows\System\AlJCNDY.exe
  2⤵
  PID:4520
- C:\Windows\System\zXVyMSt.exe
  C:\Windows\System\zXVyMSt.exe
  2⤵
  PID:4552
- C:\Windows\System\TkYmBpT.exe
  C:\Windows\System\TkYmBpT.exe
  2⤵
  PID:4584
- C:\Windows\System\nJUOqTq.exe
  C:\Windows\System\nJUOqTq.exe
  2⤵
  PID:4616
- C:\Windows\System\sAWHmga.exe
  C:\Windows\System\sAWHmga.exe
  2⤵
  PID:880
- C:\Windows\System\QrpabnC.exe
  C:\Windows\System\QrpabnC.exe
  2⤵
  PID:4676
- C:\Windows\System\LYhsjgw.exe
  C:\Windows\System\LYhsjgw.exe
  2⤵
  PID:4708
- C:\Windows\System\RPifUvS.exe
  C:\Windows\System\RPifUvS.exe
  2⤵
  PID:4728
- C:\Windows\System\bSvxpbb.exe
  C:\Windows\System\bSvxpbb.exe
  2⤵
  PID:4772
- C:\Windows\System\tNbqFCa.exe
  C:\Windows\System\tNbqFCa.exe
  2⤵
  PID:4792
- C:\Windows\System\MWFPWGC.exe
  C:\Windows\System\MWFPWGC.exe
  2⤵
  PID:4836
- C:\Windows\System\JgekKWh.exe
  C:\Windows\System\JgekKWh.exe
  2⤵
  PID:4868
- C:\Windows\System\DNboqDd.exe
  C:\Windows\System\DNboqDd.exe
  2⤵
  PID:4900
- C:\Windows\System\oCcvBJe.exe
  C:\Windows\System\oCcvBJe.exe
  2⤵
  PID:4932
- C:\Windows\System\lSVHNvT.exe
  C:\Windows\System\lSVHNvT.exe
  2⤵
  PID:4968
- C:\Windows\System\yspRhrZ.exe
  C:\Windows\System\yspRhrZ.exe
  2⤵
  PID:4984
- C:\Windows\System\nUVPMVQ.exe
  C:\Windows\System\nUVPMVQ.exe
  2⤵
  PID:5016
- C:\Windows\System\FfHgfHC.exe
  C:\Windows\System\FfHgfHC.exe
  2⤵
  PID:5064
- C:\Windows\System\UBUgvoj.exe
  C:\Windows\System\UBUgvoj.exe
  2⤵
  PID:5096
- C:\Windows\System\fJijdYk.exe
  C:\Windows\System\fJijdYk.exe
  2⤵
  PID:2888
- C:\Windows\System\PjqlbQe.exe
  C:\Windows\System\PjqlbQe.exe
  2⤵
  PID:3696
- C:\Windows\System\HglHfXR.exe
  C:\Windows\System\HglHfXR.exe
  2⤵
  PID:2776
- C:\Windows\System\MtaSHDu.exe
  C:\Windows\System\MtaSHDu.exe
  2⤵
  PID:3972
- C:\Windows\System\srnFPkU.exe
  C:\Windows\System\srnFPkU.exe
  2⤵
  PID:876
- C:\Windows\System\GmbVdeO.exe
  C:\Windows\System\GmbVdeO.exe
  2⤵
  PID:1484
- C:\Windows\System\wSnVaKj.exe
  C:\Windows\System\wSnVaKj.exe
  2⤵
  PID:3120
- C:\Windows\System\ggAShKt.exe
  C:\Windows\System\ggAShKt.exe
  2⤵
  PID:1380
- C:\Windows\System\aJJPyyh.exe
  C:\Windows\System\aJJPyyh.exe
  2⤵
  PID:4136
- C:\Windows\System\vPNRqqg.exe
  C:\Windows\System\vPNRqqg.exe
  2⤵
  PID:4180
- C:\Windows\System\SdlElVl.exe
  C:\Windows\System\SdlElVl.exe
  2⤵
  PID:4228
- C:\Windows\System\WEQuTwG.exe
  C:\Windows\System\WEQuTwG.exe
  2⤵
  PID:4264
- C:\Windows\System\tRXBXbF.exe
  C:\Windows\System\tRXBXbF.exe
  2⤵
  PID:4328
- C:\Windows\System\HbsMlkb.exe
  C:\Windows\System\HbsMlkb.exe
  2⤵
  PID:4388
- C:\Windows\System\sLwLtwx.exe
  C:\Windows\System\sLwLtwx.exe
  2⤵
  PID:4424
- C:\Windows\System\PxKOFfI.exe
  C:\Windows\System\PxKOFfI.exe
  2⤵
  PID:4504
- C:\Windows\System\UlCvoXU.exe
  C:\Windows\System\UlCvoXU.exe
  2⤵
  PID:4568
- C:\Windows\System\TLsuJmp.exe
  C:\Windows\System\TLsuJmp.exe
  2⤵
  PID:4612
- C:\Windows\System\zNXLHnC.exe
  C:\Windows\System\zNXLHnC.exe
  2⤵
  PID:4692
- C:\Windows\System\XKUbDiy.exe
  C:\Windows\System\XKUbDiy.exe
  2⤵
  PID:4740
- C:\Windows\System\pChNBGK.exe
  C:\Windows\System\pChNBGK.exe
  2⤵
  PID:4804
- C:\Windows\System\tEPCMJh.exe
  C:\Windows\System\tEPCMJh.exe
  2⤵
  PID:4856
- C:\Windows\System\oTHAdql.exe
  C:\Windows\System\oTHAdql.exe
  2⤵
  PID:4920
- C:\Windows\System\IoRdZze.exe
  C:\Windows\System\IoRdZze.exe
  2⤵
  PID:5012
- C:\Windows\System\cVYXHgB.exe
  C:\Windows\System\cVYXHgB.exe
  2⤵
  PID:4996
- C:\Windows\System\NrruESe.exe
  C:\Windows\System\NrruESe.exe
  2⤵
  PID:5060
- C:\Windows\System\JbzWNvE.exe
  C:\Windows\System\JbzWNvE.exe
  2⤵
  PID:3616
- C:\Windows\System\WyfOucL.exe
  C:\Windows\System\WyfOucL.exe
  2⤵
  PID:3876
- C:\Windows\System\vypEpvO.exe
  C:\Windows\System\vypEpvO.exe
  2⤵
  PID:2784
- C:\Windows\System\EXlUbbd.exe
  C:\Windows\System\EXlUbbd.exe
  2⤵
  PID:2352
- C:\Windows\System\EWRPIBM.exe
  C:\Windows\System\EWRPIBM.exe
  2⤵
  PID:620
- C:\Windows\System\ZqWoTDR.exe
  C:\Windows\System\ZqWoTDR.exe
  2⤵
  PID:996
- C:\Windows\System\hgOGPQE.exe
  C:\Windows\System\hgOGPQE.exe
  2⤵
  PID:448
- C:\Windows\System\mOXQkvU.exe
  C:\Windows\System\mOXQkvU.exe
  2⤵
  PID:4152
- C:\Windows\System\lcbabDO.exe
  C:\Windows\System\lcbabDO.exe
  2⤵
  PID:1884
- C:\Windows\System\UzZcFDh.exe
  C:\Windows\System\UzZcFDh.exe
  2⤵
  PID:4296
- C:\Windows\System\XAUCWjm.exe
  C:\Windows\System\XAUCWjm.exe
  2⤵
  PID:1780
- C:\Windows\System\sSPCKbl.exe
  C:\Windows\System\sSPCKbl.exe
  2⤵
  PID:4516
- C:\Windows\System\igbMIau.exe
  C:\Windows\System\igbMIau.exe
  2⤵
  PID:4644
- C:\Windows\System\rWiHdfa.exe
  C:\Windows\System\rWiHdfa.exe
  2⤵
  PID:4788
- C:\Windows\System\fwBKYnn.exe
  C:\Windows\System\fwBKYnn.exe
  2⤵
  PID:4916
- C:\Windows\System\CkIuWFI.exe
  C:\Windows\System\CkIuWFI.exe
  2⤵
  PID:2984
- C:\Windows\System\UbZLOss.exe
  C:\Windows\System\UbZLOss.exe
  2⤵
  PID:3748
- C:\Windows\System\OPOPSdn.exe
  C:\Windows\System\OPOPSdn.exe
  2⤵
  PID:1936
- C:\Windows\System\zxTPcjm.exe
  C:\Windows\System\zxTPcjm.exe
  2⤵
  PID:1788
- C:\Windows\System\dvrZoFG.exe
  C:\Windows\System\dvrZoFG.exe
  2⤵
  PID:1688
- C:\Windows\System\gJyuxtN.exe
  C:\Windows\System\gJyuxtN.exe
  2⤵
  PID:5128
- C:\Windows\System\ZukujiV.exe
  C:\Windows\System\ZukujiV.exe
  2⤵
  PID:5144
- C:\Windows\System\Zwmxrts.exe
  C:\Windows\System\Zwmxrts.exe
  2⤵
  PID:5160
- C:\Windows\System\qdASCgz.exe
  C:\Windows\System\qdASCgz.exe
  2⤵
  PID:5176
- C:\Windows\System\JStPzBP.exe
  C:\Windows\System\JStPzBP.exe
  2⤵
  PID:5192
- C:\Windows\System\JcHYGzE.exe
  C:\Windows\System\JcHYGzE.exe
  2⤵
  PID:5208
- C:\Windows\System\cqldmxD.exe
  C:\Windows\System\cqldmxD.exe
  2⤵
  PID:5224
- C:\Windows\System\bPQzcJy.exe
  C:\Windows\System\bPQzcJy.exe
  2⤵
  PID:5240
- C:\Windows\System\VSaKHaP.exe
  C:\Windows\System\VSaKHaP.exe
  2⤵
  PID:5256
- C:\Windows\System\YMwhpYQ.exe
  C:\Windows\System\YMwhpYQ.exe
  2⤵
  PID:5272
- C:\Windows\System\gPkHmBr.exe
  C:\Windows\System\gPkHmBr.exe
  2⤵
  PID:5288
- C:\Windows\System\lLqHAWS.exe
  C:\Windows\System\lLqHAWS.exe
  2⤵
  PID:5304
- C:\Windows\System\ojOgsiC.exe
  C:\Windows\System\ojOgsiC.exe
  2⤵
  PID:5320
- C:\Windows\System\ouRnWjv.exe
  C:\Windows\System\ouRnWjv.exe
  2⤵
  PID:5336
- C:\Windows\System\LaTyPoB.exe
  C:\Windows\System\LaTyPoB.exe
  2⤵
  PID:5352
- C:\Windows\System\RikGHxc.exe
  C:\Windows\System\RikGHxc.exe
  2⤵
  PID:5368
- C:\Windows\System\jFjahtx.exe
  C:\Windows\System\jFjahtx.exe
  2⤵
  PID:5384
- C:\Windows\System\edqiqOk.exe
  C:\Windows\System\edqiqOk.exe
  2⤵
  PID:5400
- C:\Windows\System\ChuLTdp.exe
  C:\Windows\System\ChuLTdp.exe
  2⤵
  PID:5416
- C:\Windows\System\fCwgAtK.exe
  C:\Windows\System\fCwgAtK.exe
  2⤵
  PID:5432
- C:\Windows\System\bqwLAjd.exe
  C:\Windows\System\bqwLAjd.exe
  2⤵
  PID:5448
- C:\Windows\System\MxyaHdq.exe
  C:\Windows\System\MxyaHdq.exe
  2⤵
  PID:5464
- C:\Windows\System\QohFWvD.exe
  C:\Windows\System\QohFWvD.exe
  2⤵
  PID:5480
- C:\Windows\System\DwrMyPg.exe
  C:\Windows\System\DwrMyPg.exe
  2⤵
  PID:5496
- C:\Windows\System\kvDhlfi.exe
  C:\Windows\System\kvDhlfi.exe
  2⤵
  PID:5512
- C:\Windows\System\gTAFggI.exe
  C:\Windows\System\gTAFggI.exe
  2⤵
  PID:5528
- C:\Windows\System\TuaApBH.exe
  C:\Windows\System\TuaApBH.exe
  2⤵
  PID:5544
- C:\Windows\System\AiQcbfK.exe
  C:\Windows\System\AiQcbfK.exe
  2⤵
  PID:5560
- C:\Windows\System\yFBTuqo.exe
  C:\Windows\System\yFBTuqo.exe
  2⤵
  PID:5576
- C:\Windows\System\ZQNCknk.exe
  C:\Windows\System\ZQNCknk.exe
  2⤵
  PID:5592
- C:\Windows\System\AWAhkyI.exe
  C:\Windows\System\AWAhkyI.exe
  2⤵
  PID:5608
- C:\Windows\System\bfyZTgf.exe
  C:\Windows\System\bfyZTgf.exe
  2⤵
  PID:5624
- C:\Windows\System\tcEnHWc.exe
  C:\Windows\System\tcEnHWc.exe
  2⤵
  PID:5640
- C:\Windows\System\oFItEfh.exe
  C:\Windows\System\oFItEfh.exe
  2⤵
  PID:5656
- C:\Windows\System\iXXKyxB.exe
  C:\Windows\System\iXXKyxB.exe
  2⤵
  PID:5672
- C:\Windows\System\XYzJTLz.exe
  C:\Windows\System\XYzJTLz.exe
  2⤵
  PID:5688
- C:\Windows\System\mIKMNKQ.exe
  C:\Windows\System\mIKMNKQ.exe
  2⤵
  PID:5704
- C:\Windows\System\edsuPhH.exe
  C:\Windows\System\edsuPhH.exe
  2⤵
  PID:5720
- C:\Windows\System\TIrZzHh.exe
  C:\Windows\System\TIrZzHh.exe
  2⤵
  PID:5736
- C:\Windows\System\xZfsxvk.exe
  C:\Windows\System\xZfsxvk.exe
  2⤵
  PID:5752
- C:\Windows\System\WlHymQw.exe
  C:\Windows\System\WlHymQw.exe
  2⤵
  PID:5768
- C:\Windows\System\CSIIiPd.exe
  C:\Windows\System\CSIIiPd.exe
  2⤵
  PID:5784
- C:\Windows\System\uVWkblh.exe
  C:\Windows\System\uVWkblh.exe
  2⤵
  PID:5800
- C:\Windows\System\uvcHCYW.exe
  C:\Windows\System\uvcHCYW.exe
  2⤵
  PID:5816
- C:\Windows\System\grkRKrT.exe
  C:\Windows\System\grkRKrT.exe
  2⤵
  PID:5832
- C:\Windows\System\LvEMHGd.exe
  C:\Windows\System\LvEMHGd.exe
  2⤵
  PID:5848
- C:\Windows\System\FTPKOZz.exe
  C:\Windows\System\FTPKOZz.exe
  2⤵
  PID:5864
- C:\Windows\System\IixFKiz.exe
  C:\Windows\System\IixFKiz.exe
  2⤵
  PID:5880
- C:\Windows\System\GHvoLuz.exe
  C:\Windows\System\GHvoLuz.exe
  2⤵
  PID:5896
- C:\Windows\System\vAGBuot.exe
  C:\Windows\System\vAGBuot.exe
  2⤵
  PID:5912
- C:\Windows\System\VPFeXxF.exe
  C:\Windows\System\VPFeXxF.exe
  2⤵
  PID:5928
- C:\Windows\System\rzAAYKh.exe
  C:\Windows\System\rzAAYKh.exe
  2⤵
  PID:5944
- C:\Windows\System\xXufLvD.exe
  C:\Windows\System\xXufLvD.exe
  2⤵
  PID:5960
- C:\Windows\System\svUEnph.exe
  C:\Windows\System\svUEnph.exe
  2⤵
  PID:5976
- C:\Windows\System\CYoUZcg.exe
  C:\Windows\System\CYoUZcg.exe
  2⤵
  PID:5992
- C:\Windows\System\lLahEAP.exe
  C:\Windows\System\lLahEAP.exe
  2⤵
  PID:6008
- C:\Windows\System\cdAVxRX.exe
  C:\Windows\System\cdAVxRX.exe
  2⤵
  PID:6024
- C:\Windows\System\UxaHCHu.exe
  C:\Windows\System\UxaHCHu.exe
  2⤵
  PID:6040
- C:\Windows\System\zyzxCon.exe
  C:\Windows\System\zyzxCon.exe
  2⤵
  PID:6056
- C:\Windows\System\GkgHbxZ.exe
  C:\Windows\System\GkgHbxZ.exe
  2⤵
  PID:6072
- C:\Windows\System\AwfhrMN.exe
  C:\Windows\System\AwfhrMN.exe
  2⤵
  PID:6088
- C:\Windows\System\vUQwriS.exe
  C:\Windows\System\vUQwriS.exe
  2⤵
  PID:6104
- C:\Windows\System\biZAfba.exe
  C:\Windows\System\biZAfba.exe
  2⤵
  PID:6120
- C:\Windows\System\QsSomwY.exe
  C:\Windows\System\QsSomwY.exe
  2⤵
  PID:6136
- C:\Windows\System\ZIZSYvk.exe
  C:\Windows\System\ZIZSYvk.exe
  2⤵
  PID:6156
- C:\Windows\System\qkDrOph.exe
  C:\Windows\System\qkDrOph.exe
  2⤵
  PID:6192
- C:\Windows\System\wFxTHXl.exe
  C:\Windows\System\wFxTHXl.exe
  2⤵
  PID:6208
- C:\Windows\System\fCPXyPS.exe
  C:\Windows\System\fCPXyPS.exe
  2⤵
  PID:6224
- C:\Windows\System\uiwtXBW.exe
  C:\Windows\System\uiwtXBW.exe
  2⤵
  PID:6240
- C:\Windows\System\EzOijGV.exe
  C:\Windows\System\EzOijGV.exe
  2⤵
  PID:6256
- C:\Windows\System\yqFrtpd.exe
  C:\Windows\System\yqFrtpd.exe
  2⤵
  PID:6272
- C:\Windows\System\XSMsqkp.exe
  C:\Windows\System\XSMsqkp.exe
  2⤵
  PID:6288
- C:\Windows\System\NZqOHRQ.exe
  C:\Windows\System\NZqOHRQ.exe
  2⤵
  PID:6304
- C:\Windows\System\AmKBpZr.exe
  C:\Windows\System\AmKBpZr.exe
  2⤵
  PID:6320
- C:\Windows\System\EIfptQt.exe
  C:\Windows\System\EIfptQt.exe
  2⤵
  PID:6336
- C:\Windows\System\tigKqnZ.exe
  C:\Windows\System\tigKqnZ.exe
  2⤵
  PID:6352
- C:\Windows\System\ihkeBBg.exe
  C:\Windows\System\ihkeBBg.exe
  2⤵
  PID:6368
- C:\Windows\System\fZqGdUG.exe
  C:\Windows\System\fZqGdUG.exe
  2⤵
  PID:6384
- C:\Windows\System\jXpVeLe.exe
  C:\Windows\System\jXpVeLe.exe
  2⤵
  PID:6400
- C:\Windows\System\nrMkuNA.exe
  C:\Windows\System\nrMkuNA.exe
  2⤵
  PID:6416
- C:\Windows\System\etkuGaG.exe
  C:\Windows\System\etkuGaG.exe
  2⤵
  PID:6432
- C:\Windows\System\jRPJCxD.exe
  C:\Windows\System\jRPJCxD.exe
  2⤵
  PID:6448
- C:\Windows\System\tmMepJB.exe
  C:\Windows\System\tmMepJB.exe
  2⤵
  PID:6464
- C:\Windows\System\evpQDdk.exe
  C:\Windows\System\evpQDdk.exe
  2⤵
  PID:6480
- C:\Windows\System\FZqwnwr.exe
  C:\Windows\System\FZqwnwr.exe
  2⤵
  PID:6496
- C:\Windows\System\AgjtKjZ.exe
  C:\Windows\System\AgjtKjZ.exe
  2⤵
  PID:6512
- C:\Windows\System\WSKyyzM.exe
  C:\Windows\System\WSKyyzM.exe
  2⤵
  PID:6528
- C:\Windows\System\gMZGdlS.exe
  C:\Windows\System\gMZGdlS.exe
  2⤵
  PID:6544
- C:\Windows\System\ceNcisN.exe
  C:\Windows\System\ceNcisN.exe
  2⤵
  PID:6560
- C:\Windows\System\HrICocp.exe
  C:\Windows\System\HrICocp.exe
  2⤵
  PID:6576
- C:\Windows\System\lMZZPos.exe
  C:\Windows\System\lMZZPos.exe
  2⤵
  PID:6592
- C:\Windows\System\LMSoEqV.exe
  C:\Windows\System\LMSoEqV.exe
  2⤵
  PID:6608
- C:\Windows\System\NgFYEWs.exe
  C:\Windows\System\NgFYEWs.exe
  2⤵
  PID:6624
- C:\Windows\System\YWURhGB.exe
  C:\Windows\System\YWURhGB.exe
  2⤵
  PID:6640
- C:\Windows\System\FCVrhiF.exe
  C:\Windows\System\FCVrhiF.exe
  2⤵
  PID:6656
- C:\Windows\System\nouRcpL.exe
  C:\Windows\System\nouRcpL.exe
  2⤵
  PID:6672
- C:\Windows\System\DXhSkpX.exe
  C:\Windows\System\DXhSkpX.exe
  2⤵
  PID:6692
- C:\Windows\System\kxxovxg.exe
  C:\Windows\System\kxxovxg.exe
  2⤵
  PID:6708
- C:\Windows\System\lHBQPKT.exe
  C:\Windows\System\lHBQPKT.exe
  2⤵
  PID:6724
- C:\Windows\System\pVVuKrP.exe
  C:\Windows\System\pVVuKrP.exe
  2⤵
  PID:6740
- C:\Windows\System\woWDYLA.exe
  C:\Windows\System\woWDYLA.exe
  2⤵
  PID:6756
- C:\Windows\System\ZauQiYz.exe
  C:\Windows\System\ZauQiYz.exe
  2⤵
  PID:6772
- C:\Windows\System\UuAyLie.exe
  C:\Windows\System\UuAyLie.exe
  2⤵
  PID:6788
- C:\Windows\System\xnSZYCX.exe
  C:\Windows\System\xnSZYCX.exe
  2⤵
  PID:6804
- C:\Windows\System\daATaFa.exe
  C:\Windows\System\daATaFa.exe
  2⤵
  PID:6820
- C:\Windows\System\OsTwwEp.exe
  C:\Windows\System\OsTwwEp.exe
  2⤵
  PID:6836
- C:\Windows\System\sbbQRiE.exe
  C:\Windows\System\sbbQRiE.exe
  2⤵
  PID:6852
- C:\Windows\System\ijcRMUc.exe
  C:\Windows\System\ijcRMUc.exe
  2⤵
  PID:6868
- C:\Windows\System\CGMqORU.exe
  C:\Windows\System\CGMqORU.exe
  2⤵
  PID:6884
- C:\Windows\System\gPmZyNi.exe
  C:\Windows\System\gPmZyNi.exe
  2⤵
  PID:6900
- C:\Windows\System\GhdhMGB.exe
  C:\Windows\System\GhdhMGB.exe
  2⤵
  PID:6916
- C:\Windows\System\kICtjAZ.exe
  C:\Windows\System\kICtjAZ.exe
  2⤵
  PID:6932
- C:\Windows\System\FfLsisg.exe
  C:\Windows\System\FfLsisg.exe
  2⤵
  PID:6948
- C:\Windows\System\jWtSreK.exe
  C:\Windows\System\jWtSreK.exe
  2⤵
  PID:6964
- C:\Windows\System\pPKdtOl.exe
  C:\Windows\System\pPKdtOl.exe
  2⤵
  PID:6980
- C:\Windows\System\DzJUVjY.exe
  C:\Windows\System\DzJUVjY.exe
  2⤵
  PID:6996
- C:\Windows\System\xWkgcSS.exe
  C:\Windows\System\xWkgcSS.exe
  2⤵
  PID:7012
- C:\Windows\System\sdArLLI.exe
  C:\Windows\System\sdArLLI.exe
  2⤵
  PID:7028
- C:\Windows\System\MjXrOEg.exe
  C:\Windows\System\MjXrOEg.exe
  2⤵
  PID:7044
- C:\Windows\System\OKHKZpt.exe
  C:\Windows\System\OKHKZpt.exe
  2⤵
  PID:7060
- C:\Windows\System\vFDaesI.exe
  C:\Windows\System\vFDaesI.exe
  2⤵
  PID:7076
- C:\Windows\System\wImEFMM.exe
  C:\Windows\System\wImEFMM.exe
  2⤵
  PID:7092
- C:\Windows\System\PRTHzBG.exe
  C:\Windows\System\PRTHzBG.exe
  2⤵
  PID:7108
- C:\Windows\System\EZdqVvz.exe
  C:\Windows\System\EZdqVvz.exe
  2⤵
  PID:7124
- C:\Windows\System\yapEZLU.exe
  C:\Windows\System\yapEZLU.exe
  2⤵
  PID:7140
- C:\Windows\System\cLkJmrZ.exe
  C:\Windows\System\cLkJmrZ.exe
  2⤵
  PID:7156
- C:\Windows\System\KClmekU.exe
  C:\Windows\System\KClmekU.exe
  2⤵
  PID:4580
- C:\Windows\System\eTqyCfy.exe
  C:\Windows\System\eTqyCfy.exe
  2⤵
  PID:968
- C:\Windows\System\jaxRSaG.exe
  C:\Windows\System\jaxRSaG.exe
  2⤵
  PID:5188
- C:\Windows\System\FCaNJrP.exe
  C:\Windows\System\FCaNJrP.exe
  2⤵
  PID:5252
- C:\Windows\System\XAqphwW.exe
  C:\Windows\System\XAqphwW.exe
  2⤵
  PID:5316
- C:\Windows\System\PPJkLLO.exe
  C:\Windows\System\PPJkLLO.exe
  2⤵
  PID:5380
- C:\Windows\System\VijpcLi.exe
  C:\Windows\System\VijpcLi.exe
  2⤵
  PID:5444
- C:\Windows\System\MjOEjtB.exe
  C:\Windows\System\MjOEjtB.exe
  2⤵
  PID:5508
- C:\Windows\System\GOszITp.exe
  C:\Windows\System\GOszITp.exe
  2⤵
  PID:5600
- C:\Windows\System\YQZlCKj.exe
  C:\Windows\System\YQZlCKj.exe
  2⤵
  PID:5664
- C:\Windows\System\KzsIGoA.exe
  C:\Windows\System\KzsIGoA.exe
  2⤵
  PID:5728
- C:\Windows\System\thRpZgJ.exe
  C:\Windows\System\thRpZgJ.exe
  2⤵
  PID:5792
- C:\Windows\System\JrgnTvO.exe
  C:\Windows\System\JrgnTvO.exe
  2⤵
  PID:5856
- C:\Windows\System\EobTBKa.exe
  C:\Windows\System\EobTBKa.exe
  2⤵
  PID:5920
- C:\Windows\System\LmWFCiT.exe
  C:\Windows\System\LmWFCiT.exe
  2⤵
  PID:5984
- C:\Windows\System\yqFhsdV.exe
  C:\Windows\System\yqFhsdV.exe
  2⤵
  PID:6048
- C:\Windows\System\JtXwaYl.exe
  C:\Windows\System\JtXwaYl.exe
  2⤵
  PID:6112
- C:\Windows\System\mpOqnaM.exe
  C:\Windows\System\mpOqnaM.exe
  2⤵
  PID:2892
- C:\Windows\System\ZEjWeIM.exe
  C:\Windows\System\ZEjWeIM.exe
  2⤵
  PID:5080
- C:\Windows\System\rZQFrDD.exe
  C:\Windows\System\rZQFrDD.exe
  2⤵
  PID:6116
- C:\Windows\System\CKbZQSp.exe
  C:\Windows\System\CKbZQSp.exe
  2⤵
  PID:6236
- C:\Windows\System\LrSISHY.exe
  C:\Windows\System\LrSISHY.exe
  2⤵
  PID:6300
- C:\Windows\System\pAgjycP.exe
  C:\Windows\System\pAgjycP.exe
  2⤵
  PID:6364
- C:\Windows\System\xdecElY.exe
  C:\Windows\System\xdecElY.exe
  2⤵
  PID:6428
- C:\Windows\System\jovYvGX.exe
  C:\Windows\System\jovYvGX.exe
  2⤵
  PID:6492
- C:\Windows\System\KyEsYCH.exe
  C:\Windows\System\KyEsYCH.exe
  2⤵
  PID:6556
- C:\Windows\System\FvlXmyH.exe
  C:\Windows\System\FvlXmyH.exe
  2⤵
  PID:2628
- C:\Windows\System\wObjEiz.exe
  C:\Windows\System\wObjEiz.exe
  2⤵
  PID:6680
- C:\Windows\System\YRNobbV.exe
  C:\Windows\System\YRNobbV.exe
  2⤵
  PID:6748
- C:\Windows\System\RqcxWMP.exe
  C:\Windows\System\RqcxWMP.exe
  2⤵
  PID:6812
- C:\Windows\System\rYxdKbG.exe
  C:\Windows\System\rYxdKbG.exe
  2⤵
  PID:6876
- C:\Windows\System\rjwvTsi.exe
  C:\Windows\System\rjwvTsi.exe
  2⤵
  PID:6944
- C:\Windows\System\hHdqzxD.exe
  C:\Windows\System\hHdqzxD.exe
  2⤵
  PID:7008
- C:\Windows\System\pYPpQJK.exe
  C:\Windows\System\pYPpQJK.exe
  2⤵
  PID:7072
- C:\Windows\System\yQpJPLB.exe
  C:\Windows\System\yQpJPLB.exe
  2⤵
  PID:7136
- C:\Windows\System\nNyxKud.exe
  C:\Windows\System\nNyxKud.exe
  2⤵
  PID:5184
- C:\Windows\System\ItlRjYL.exe
  C:\Windows\System\ItlRjYL.exe
  2⤵
  PID:5696
- C:\Windows\System\xTPIdkk.exe
  C:\Windows\System\xTPIdkk.exe
  2⤵
  PID:6460
- C:\Windows\System\sAsvPSR.exe
  C:\Windows\System\sAsvPSR.exe
  2⤵
  PID:7196
- C:\Windows\System\tVJOfjT.exe
  C:\Windows\System\tVJOfjT.exe
  2⤵
  PID:7316
- C:\Windows\System\jfxZmsB.exe
  C:\Windows\System\jfxZmsB.exe
  2⤵
  PID:7332
- C:\Windows\System\iQSlxUR.exe
  C:\Windows\System\iQSlxUR.exe
  2⤵
  PID:7348
- C:\Windows\System\AUnnQKN.exe
  C:\Windows\System\AUnnQKN.exe
  2⤵
  PID:7364
- C:\Windows\System\pDtlHEX.exe
  C:\Windows\System\pDtlHEX.exe
  2⤵
  PID:7380
- C:\Windows\System\TvsfLjr.exe
  C:\Windows\System\TvsfLjr.exe
  2⤵
  PID:7400
- C:\Windows\System\sEktrmA.exe
  C:\Windows\System\sEktrmA.exe
  2⤵
  PID:7416
- C:\Windows\System\ySjnEpO.exe
  C:\Windows\System\ySjnEpO.exe
  2⤵
  PID:7436
- C:\Windows\System\eRKJDoi.exe
  C:\Windows\System\eRKJDoi.exe
  2⤵
  PID:7452
- C:\Windows\System\ZbShGEE.exe
  C:\Windows\System\ZbShGEE.exe
  2⤵
  PID:7468
- C:\Windows\System\ajdkMTW.exe
  C:\Windows\System\ajdkMTW.exe
  2⤵
  PID:7492
- C:\Windows\System\RAlnbiW.exe
  C:\Windows\System\RAlnbiW.exe
  2⤵
  PID:7508
- C:\Windows\System\HlYxbbB.exe
  C:\Windows\System\HlYxbbB.exe
  2⤵
  PID:7524
- C:\Windows\System\xSQmGrc.exe
  C:\Windows\System\xSQmGrc.exe
  2⤵
  PID:7540
- C:\Windows\System\NfeVPak.exe
  C:\Windows\System\NfeVPak.exe
  2⤵
  PID:7556
- C:\Windows\System\PIKUJmC.exe
  C:\Windows\System\PIKUJmC.exe
  2⤵
  PID:7572
- C:\Windows\System\SEmtWeP.exe
  C:\Windows\System\SEmtWeP.exe
  2⤵
  PID:7588
- C:\Windows\System\EvKEziZ.exe
  C:\Windows\System\EvKEziZ.exe
  2⤵
  PID:7604
- C:\Windows\System\EbBzVPK.exe
  C:\Windows\System\EbBzVPK.exe
  2⤵
  PID:7620
- C:\Windows\System\vQPCtkk.exe
  C:\Windows\System\vQPCtkk.exe
  2⤵
  PID:7636
- C:\Windows\System\fINjXHD.exe
  C:\Windows\System\fINjXHD.exe
  2⤵
  PID:7656
- C:\Windows\System\oLUofWF.exe
  C:\Windows\System\oLUofWF.exe
  2⤵
  PID:7672
- C:\Windows\System\JtlWHED.exe
  C:\Windows\System\JtlWHED.exe
  2⤵
  PID:7700
- C:\Windows\System\rfycIrh.exe
  C:\Windows\System\rfycIrh.exe
  2⤵
  PID:7716
- C:\Windows\System\yxJxcTA.exe
  C:\Windows\System\yxJxcTA.exe
  2⤵
  PID:7732
- C:\Windows\System\HPqSrAT.exe
  C:\Windows\System\HPqSrAT.exe
  2⤵
  PID:7748
- C:\Windows\System\eMsOlJY.exe
  C:\Windows\System\eMsOlJY.exe
  2⤵
  PID:7764
- C:\Windows\System\KvMfvtc.exe
  C:\Windows\System\KvMfvtc.exe
  2⤵
  PID:7780
- C:\Windows\System\qkFQleC.exe
  C:\Windows\System\qkFQleC.exe
  2⤵
  PID:7796
- C:\Windows\System\aKdxyOv.exe
  C:\Windows\System\aKdxyOv.exe
  2⤵
  PID:7812
- C:\Windows\System\VgCTZqU.exe
  C:\Windows\System\VgCTZqU.exe
  2⤵
  PID:7828
- C:\Windows\System\SOGdlLM.exe
  C:\Windows\System\SOGdlLM.exe
  2⤵
  PID:7844
- C:\Windows\System\URYZOJR.exe
  C:\Windows\System\URYZOJR.exe
  2⤵
  PID:7860
- C:\Windows\System\pWKIsfj.exe
  C:\Windows\System\pWKIsfj.exe
  2⤵
  PID:7876
- C:\Windows\System\FPoopwZ.exe
  C:\Windows\System\FPoopwZ.exe
  2⤵
  PID:7892
- C:\Windows\System\oSkaEQA.exe
  C:\Windows\System\oSkaEQA.exe
  2⤵
  PID:7908
- C:\Windows\System\CTXnqdf.exe
  C:\Windows\System\CTXnqdf.exe
  2⤵
  PID:7924
- C:\Windows\System\asfwwiH.exe
  C:\Windows\System\asfwwiH.exe
  2⤵
  PID:7940
- C:\Windows\System\efwFEbA.exe
  C:\Windows\System\efwFEbA.exe
  2⤵
  PID:7956
- C:\Windows\System\vAsdoyk.exe
  C:\Windows\System\vAsdoyk.exe
  2⤵
  PID:7972
- C:\Windows\System\GRCSkij.exe
  C:\Windows\System\GRCSkij.exe
  2⤵
  PID:7988
- C:\Windows\System\WngdXUO.exe
  C:\Windows\System\WngdXUO.exe
  2⤵
  PID:8004
- C:\Windows\System\mmePeLn.exe
  C:\Windows\System\mmePeLn.exe
  2⤵
  PID:8020
- C:\Windows\System\BAwRgWV.exe
  C:\Windows\System\BAwRgWV.exe
  2⤵
  PID:8040
- C:\Windows\System\yZZHUbg.exe
  C:\Windows\System\yZZHUbg.exe
  2⤵
  PID:8056
- C:\Windows\System\vsYGTPc.exe
  C:\Windows\System\vsYGTPc.exe
  2⤵
  PID:8072
- C:\Windows\System\DPyGmzx.exe
  C:\Windows\System\DPyGmzx.exe
  2⤵
  PID:8088
- C:\Windows\System\ULOvNVY.exe
  C:\Windows\System\ULOvNVY.exe
  2⤵
  PID:8104
- C:\Windows\System\mMHeloL.exe
  C:\Windows\System\mMHeloL.exe
  2⤵
  PID:8120
- C:\Windows\System\eGjPYPH.exe
  C:\Windows\System\eGjPYPH.exe
  2⤵
  PID:8144
- C:\Windows\System\hOpMIUs.exe
  C:\Windows\System\hOpMIUs.exe
  2⤵
  PID:8164
- C:\Windows\System\LySoEPh.exe
  C:\Windows\System\LySoEPh.exe
  2⤵
  PID:8180
- C:\Windows\System\seWuNbX.exe
  C:\Windows\System\seWuNbX.exe
  2⤵
  PID:7004
- C:\Windows\System\HcXaCji.exe
  C:\Windows\System\HcXaCji.exe
  2⤵
  PID:5440
- C:\Windows\System\hROUZnN.exe
  C:\Windows\System\hROUZnN.exe
  2⤵
  PID:6588
- C:\Windows\System\fYFARLR.exe
  C:\Windows\System\fYFARLR.exe
  2⤵
  PID:6848
- C:\Windows\System\MdSxhUK.exe
  C:\Windows\System\MdSxhUK.exe
  2⤵
  PID:7184
- C:\Windows\System\IgmCqWb.exe
  C:\Windows\System\IgmCqWb.exe
  2⤵
  PID:7328
- C:\Windows\System\OXCfGCu.exe
  C:\Windows\System\OXCfGCu.exe
  2⤵
  PID:7396
- C:\Windows\System\BDCGpqb.exe
  C:\Windows\System\BDCGpqb.exe
  2⤵
  PID:7460
- C:\Windows\System\syHLPIT.exe
  C:\Windows\System\syHLPIT.exe
  2⤵
  PID:7532
- C:\Windows\System\kZiJRSc.exe
  C:\Windows\System\kZiJRSc.exe
  2⤵
  PID:7628
- C:\Windows\System\JQUopAX.exe
  C:\Windows\System\JQUopAX.exe
  2⤵
  PID:6216
- C:\Windows\System\TUTkHnQ.exe
  C:\Windows\System\TUTkHnQ.exe
  2⤵
  PID:5744
- C:\Windows\System\enySXWb.exe
  C:\Windows\System\enySXWb.exe
  2⤵
  PID:4468
- C:\Windows\System\xuJATLN.exe
  C:\Windows\System\xuJATLN.exe
  2⤵
  PID:1972
- C:\Windows\System\EuzgaDH.exe
  C:\Windows\System\EuzgaDH.exe
  2⤵
  PID:3476
- C:\Windows\System\spjapcW.exe
  C:\Windows\System\spjapcW.exe
  2⤵
  PID:5172
- C:\Windows\System\LRXniey.exe
  C:\Windows\System\LRXniey.exe
  2⤵
  PID:5236
- C:\Windows\System\KacFWol.exe
  C:\Windows\System\KacFWol.exe
  2⤵
  PID:5332
- C:\Windows\System\xkENfOR.exe
  C:\Windows\System\xkENfOR.exe
  2⤵
  PID:5428
- C:\Windows\System\NlvaGfN.exe
  C:\Windows\System\NlvaGfN.exe
  2⤵
  PID:5556
- C:\Windows\System\YtYYrvP.exe
  C:\Windows\System\YtYYrvP.exe
  2⤵
  PID:5648
- C:\Windows\System\QETDMMC.exe
  C:\Windows\System\QETDMMC.exe
  2⤵
  PID:5684
- C:\Windows\System\sVZSiub.exe
  C:\Windows\System\sVZSiub.exe
  2⤵
  PID:5780
- C:\Windows\System\tAcuign.exe
  C:\Windows\System\tAcuign.exe
  2⤵
  PID:5872
- C:\Windows\System\UzrBpmB.exe
  C:\Windows\System\UzrBpmB.exe
  2⤵
  PID:5936
- C:\Windows\System\KDwTmUE.exe
  C:\Windows\System\KDwTmUE.exe
  2⤵
  PID:6004
- C:\Windows\System\yvGclzG.exe
  C:\Windows\System\yvGclzG.exe
  2⤵
  PID:6096
- C:\Windows\System\njDIDNA.exe
  C:\Windows\System\njDIDNA.exe
  2⤵
  PID:6164
- C:\Windows\System\vWpGQYh.exe
  C:\Windows\System\vWpGQYh.exe
  2⤵
  PID:6180
- C:\Windows\System\vnwZsmw.exe
  C:\Windows\System\vnwZsmw.exe
  2⤵
  PID:6280
- C:\Windows\System\frhbLgn.exe
  C:\Windows\System\frhbLgn.exe
  2⤵
  PID:6348
- C:\Windows\System\nwVlXAL.exe
  C:\Windows\System\nwVlXAL.exe
  2⤵
  PID:6412
- C:\Windows\System\UksSPVE.exe
  C:\Windows\System\UksSPVE.exe
  2⤵
  PID:6476
- C:\Windows\System\pjrchsI.exe
  C:\Windows\System\pjrchsI.exe
  2⤵
  PID:6540
- C:\Windows\System\xuoDiqd.exe
  C:\Windows\System\xuoDiqd.exe
  2⤵
  PID:6604
- C:\Windows\System\HZkFnSf.exe
  C:\Windows\System\HZkFnSf.exe
  2⤵
  PID:6668
- C:\Windows\System\xwMYJJe.exe
  C:\Windows\System\xwMYJJe.exe
  2⤵
  PID:6736
- C:\Windows\System\nEaeImD.exe
  C:\Windows\System\nEaeImD.exe
  2⤵
  PID:6864
- C:\Windows\System\iEUeLMx.exe
  C:\Windows\System\iEUeLMx.exe
  2⤵
  PID:6956
- C:\Windows\System\qBHwKfG.exe
  C:\Windows\System\qBHwKfG.exe
  2⤵
  PID:7020
- C:\Windows\System\juLkKwD.exe
  C:\Windows\System\juLkKwD.exe
  2⤵
  PID:7084
- C:\Windows\System\fxdxpgL.exe
  C:\Windows\System\fxdxpgL.exe
  2⤵
  PID:7148
- C:\Windows\System\KSMbHOD.exe
  C:\Windows\System\KSMbHOD.exe
  2⤵
  PID:5220
- C:\Windows\System\WaYSHOw.exe
  C:\Windows\System\WaYSHOw.exe
  2⤵
  PID:5476
- C:\Windows\System\pmsBTsw.exe
  C:\Windows\System\pmsBTsw.exe
  2⤵
  PID:5764
- C:\Windows\System\yykmNWK.exe
  C:\Windows\System\yykmNWK.exe
  2⤵
  PID:6020
- C:\Windows\System\blgzbrn.exe
  C:\Windows\System\blgzbrn.exe
  2⤵
  PID:5124
- C:\Windows\System\ysVDsvg.exe
  C:\Windows\System\ysVDsvg.exe
  2⤵
  PID:6424
- C:\Windows\System\JicxfIY.exe
  C:\Windows\System\JicxfIY.exe
  2⤵
  PID:6652
- C:\Windows\System\XcfDDtv.exe
  C:\Windows\System\XcfDDtv.exe
  2⤵
  PID:6940
- C:\Windows\System\uVOEQSw.exe
  C:\Windows\System\uVOEQSw.exe
  2⤵
  PID:6880
- C:\Windows\System\JKVnOnC.exe
  C:\Windows\System\JKVnOnC.exe
  2⤵
  PID:5956
- C:\Windows\System\XegLMnd.exe
  C:\Windows\System\XegLMnd.exe
  2⤵
  PID:6204
- C:\Windows\System\uoxPkFc.exe
  C:\Windows\System\uoxPkFc.exe
  2⤵
  PID:7204
- C:\Windows\System\OpnicQy.exe
  C:\Windows\System\OpnicQy.exe
  2⤵
  PID:7220
- C:\Windows\System\uneGZHy.exe
  C:\Windows\System\uneGZHy.exe
  2⤵
  PID:7236
- C:\Windows\System\zqBdKdA.exe
  C:\Windows\System\zqBdKdA.exe
  2⤵
  PID:7252
- C:\Windows\System\IozuEBX.exe
  C:\Windows\System\IozuEBX.exe
  2⤵
  PID:7268
- C:\Windows\System\xcmRWZU.exe
  C:\Windows\System\xcmRWZU.exe
  2⤵
  PID:7288
- C:\Windows\System\KWzXxFj.exe
  C:\Windows\System\KWzXxFj.exe
  2⤵
  PID:7304
- C:\Windows\System\lJBnIqB.exe
  C:\Windows\System\lJBnIqB.exe
  2⤵
  PID:7344
- C:\Windows\System\EIffeKE.exe
  C:\Windows\System\EIffeKE.exe
  2⤵
  PID:7412
- C:\Windows\System\sMgjPdt.exe
  C:\Windows\System\sMgjPdt.exe
  2⤵
  PID:7480
- C:\Windows\System\JwMhxhP.exe
  C:\Windows\System\JwMhxhP.exe
  2⤵
  PID:7520
- C:\Windows\System\XtBCDJZ.exe
  C:\Windows\System\XtBCDJZ.exe
  2⤵
  PID:7612
- C:\Windows\System\fZrYkiq.exe
  C:\Windows\System\fZrYkiq.exe
  2⤵
  PID:7652
- C:\Windows\System\IsbDQNm.exe
  C:\Windows\System\IsbDQNm.exe
  2⤵
  PID:7692
- C:\Windows\System\mTTPNBS.exe
  C:\Windows\System\mTTPNBS.exe
  2⤵
  PID:7756
- C:\Windows\System\tuqVdbG.exe
  C:\Windows\System\tuqVdbG.exe
  2⤵
  PID:7820
- C:\Windows\System\tUVftlM.exe
  C:\Windows\System\tUVftlM.exe
  2⤵
  PID:7536
- C:\Windows\System\BzrlvHE.exe
  C:\Windows\System\BzrlvHE.exe
  2⤵
  PID:7856
- C:\Windows\System\hcEXitJ.exe
  C:\Windows\System\hcEXitJ.exe
  2⤵
  PID:7920
- C:\Windows\System\fqfRAtW.exe
  C:\Windows\System\fqfRAtW.exe
  2⤵
  PID:8012
- C:\Windows\System\tgtoipY.exe
  C:\Windows\System\tgtoipY.exe
  2⤵
  PID:8052
- C:\Windows\System\TRlgaZT.exe
  C:\Windows\System\TRlgaZT.exe
  2⤵
  PID:8156
- C:\Windows\System\wgNuvfs.exe
  C:\Windows\System\wgNuvfs.exe
  2⤵
  PID:8188
- C:\Windows\System\nXtmGye.exe
  C:\Windows\System\nXtmGye.exe
  2⤵
  PID:7744
- C:\Windows\System\qEdBEoE.exe
  C:\Windows\System\qEdBEoE.exe
  2⤵
  PID:7840
- C:\Windows\System\abOOhZR.exe
  C:\Windows\System\abOOhZR.exe
  2⤵
  PID:6360
- C:\Windows\System\hYhwxuE.exe
  C:\Windows\System\hYhwxuE.exe
  2⤵
  PID:7932
- C:\Windows\System\vQYWWGj.exe
  C:\Windows\System\vQYWWGj.exe
  2⤵
  PID:8028
- C:\Windows\System\CihiVKc.exe
  C:\Windows\System\CihiVKc.exe
  2⤵
  PID:8068
- C:\Windows\System\pVTzkEf.exe
  C:\Windows\System\pVTzkEf.exe
  2⤵
  PID:8132
- C:\Windows\System\zxyWpwT.exe
  C:\Windows\System\zxyWpwT.exe
  2⤵
  PID:7176
- C:\Windows\System\zHvKeuX.exe
  C:\Windows\System\zHvKeuX.exe
  2⤵
  PID:7504
- C:\Windows\System\JyAxkfZ.exe
  C:\Windows\System\JyAxkfZ.exe
  2⤵
  PID:5312
- C:\Windows\System\alTvgFI.exe
  C:\Windows\System\alTvgFI.exe
  2⤵
  PID:5296
- C:\Windows\System\uWlnANj.exe
  C:\Windows\System\uWlnANj.exe
  2⤵
  PID:664
- C:\Windows\System\ldRefwr.exe
  C:\Windows\System\ldRefwr.exe
  2⤵
  PID:8140
- C:\Windows\System\YyerRRr.exe
  C:\Windows\System\YyerRRr.exe
  2⤵
  PID:6720
- C:\Windows\System\uQynruO.exe
  C:\Windows\System\uQynruO.exe
  2⤵
  PID:7324
- C:\Windows\System\yPMhdaA.exe
  C:\Windows\System\yPMhdaA.exe
  2⤵
  PID:4760
- C:\Windows\System\GnajkWf.exe
  C:\Windows\System\GnajkWf.exe
  2⤵
  PID:5776
- C:\Windows\System\cYSoaEo.exe
  C:\Windows\System\cYSoaEo.exe
  2⤵
  PID:5396
- C:\Windows\System\KEyiDyP.exe
  C:\Windows\System\KEyiDyP.exe
  2⤵
  PID:5328
- C:\Windows\System\XycrzHP.exe
  C:\Windows\System\XycrzHP.exe
  2⤵
  PID:5844
- C:\Windows\System\ErSjPEu.exe
  C:\Windows\System\ErSjPEu.exe
  2⤵
  PID:6000
- C:\Windows\System\rdjHStW.exe
  C:\Windows\System\rdjHStW.exe
  2⤵
  PID:6312
- C:\Windows\System\PPTJerM.exe
  C:\Windows\System\PPTJerM.exe
  2⤵
  PID:5968
- C:\Windows\System\VzcnDPC.exe
  C:\Windows\System\VzcnDPC.exe
  2⤵
  PID:6472
- C:\Windows\System\kKkilKA.exe
  C:\Windows\System\kKkilKA.exe
  2⤵
  PID:6508
- C:\Windows\System\pNVIxKm.exe
  C:\Windows\System\pNVIxKm.exe
  2⤵
  PID:6536
- C:\Windows\System\rlCCDfV.exe
  C:\Windows\System\rlCCDfV.exe
  2⤵
  PID:6768
- C:\Windows\System\ahxkMeQ.exe
  C:\Windows\System\ahxkMeQ.exe
  2⤵
  PID:2852
- C:\Windows\System\uxJOjzh.exe
  C:\Windows\System\uxJOjzh.exe
  2⤵
  PID:6928
- C:\Windows\System\giHUrHD.exe
  C:\Windows\System\giHUrHD.exe
  2⤵
  PID:4048
- C:\Windows\System\VbFHmph.exe
  C:\Windows\System\VbFHmph.exe
  2⤵
  PID:6800
- C:\Windows\System\FKmZyuN.exe
  C:\Windows\System\FKmZyuN.exe
  2⤵
  PID:6988
- C:\Windows\System\rdiIvbH.exe
  C:\Windows\System\rdiIvbH.exe
  2⤵
  PID:5348
- C:\Windows\System\aGKtCWv.exe
  C:\Windows\System\aGKtCWv.exe
  2⤵
  PID:6396
- C:\Windows\System\pZmBfCs.exe
  C:\Windows\System\pZmBfCs.exe
  2⤵
  PID:7276
- C:\Windows\System\RgoLPrr.exe
  C:\Windows\System\RgoLPrr.exe
  2⤵
  PID:2780
- C:\Windows\System\yQWlVNq.exe
  C:\Windows\System\yQWlVNq.exe
  2⤵
  PID:7068
- C:\Windows\System\mpFaMFP.exe
  C:\Windows\System\mpFaMFP.exe
  2⤵
  PID:7428
- C:\Windows\System\pczlBLW.exe
  C:\Windows\System\pczlBLW.exe
  2⤵
  PID:7964
- C:\Windows\System\awZxFCG.exe
  C:\Windows\System\awZxFCG.exe
  2⤵
  PID:8100
- C:\Windows\System\xtoXiBX.exe
  C:\Windows\System\xtoXiBX.exe
  2⤵
  PID:7596
- C:\Windows\System\kyJqtJI.exe
  C:\Windows\System\kyJqtJI.exe
  2⤵
  PID:7192
- C:\Windows\System\juWdtpN.exe
  C:\Windows\System\juWdtpN.exe
  2⤵
  PID:5300
- C:\Windows\System\bEirQmm.exe
  C:\Windows\System\bEirQmm.exe
  2⤵
  PID:5680
- C:\Windows\System\WehFgpk.exe
  C:\Windows\System\WehFgpk.exe
  2⤵
  PID:6636
- C:\Windows\System\ayDCgWe.exe
  C:\Windows\System\ayDCgWe.exe
  2⤵
  PID:5364
- C:\Windows\System\GMuJsqp.exe
  C:\Windows\System\GMuJsqp.exe
  2⤵
  PID:7568
- C:\Windows\System\zFwlurs.exe
  C:\Windows\System\zFwlurs.exe
  2⤵
  PID:7056
- C:\Windows\System\XcRqdZX.exe
  C:\Windows\System\XcRqdZX.exe
  2⤵
  PID:6704
- C:\Windows\System\hqTpNjE.exe
  C:\Windows\System\hqTpNjE.exe
  2⤵
  PID:4888
- C:\Windows\System\jpcadPl.exe
  C:\Windows\System\jpcadPl.exe
  2⤵
  PID:6784
- C:\Windows\System\cfZMQzw.exe
  C:\Windows\System\cfZMQzw.exe
  2⤵
  PID:6828
- C:\Windows\System\QtLrpCU.exe
  C:\Windows\System\QtLrpCU.exe
  2⤵
  PID:7284
- C:\Windows\System\zcwNoVi.exe
  C:\Windows\System\zcwNoVi.exe
  2⤵
  PID:7580
- C:\Windows\System\RSUnUVA.exe
  C:\Windows\System\RSUnUVA.exe
  2⤵
  PID:6860
- C:\Windows\System\kPCktpo.exe
  C:\Windows\System\kPCktpo.exe
  2⤵
  PID:8036
- C:\Windows\System\GBbRYKi.exe
  C:\Windows\System\GBbRYKi.exe
  2⤵
  PID:7808
- C:\Windows\System\xNhRliY.exe
  C:\Windows\System\xNhRliY.exe
  2⤵
  PID:8152
- C:\Windows\System\cJJZjYb.exe
  C:\Windows\System\cJJZjYb.exe
  2⤵
  PID:7888
- C:\Windows\System\hYRbNwD.exe
  C:\Windows\System\hYRbNwD.exe
  2⤵
  PID:7724
- C:\Windows\System\eXLBVvI.exe
  C:\Windows\System\eXLBVvI.exe
  2⤵
  PID:7948
- C:\Windows\System\qxWfhLj.exe
  C:\Windows\System\qxWfhLj.exe
  2⤵
  PID:7792
- C:\Windows\System\fLuNzNN.exe
  C:\Windows\System\fLuNzNN.exe
  2⤵
  PID:7684
- C:\Windows\System\MATBAoG.exe
  C:\Windows\System\MATBAoG.exe
  2⤵
  PID:7300
- C:\Windows\System\JottHNd.exe
  C:\Windows\System\JottHNd.exe
  2⤵
  PID:7248
- C:\Windows\System\umFCdEb.exe
  C:\Windows\System\umFCdEb.exe
  2⤵
  PID:6296
- C:\Windows\System\hCHrOcS.exe
  C:\Windows\System\hCHrOcS.exe
  2⤵
  PID:2956
- C:\Windows\System\OVZaTMh.exe
  C:\Windows\System\OVZaTMh.exe
  2⤵
  PID:5552
- C:\Windows\System\OnxjOdy.exe
  C:\Windows\System\OnxjOdy.exe
  2⤵
  PID:6128
- C:\Windows\System\XRIbKfJ.exe
  C:\Windows\System\XRIbKfJ.exe
  2⤵
  PID:2324
- C:\Windows\System\reKuFkw.exe
  C:\Windows\System\reKuFkw.exe
  2⤵
  PID:6648
- C:\Windows\System\jZMfIKK.exe
  C:\Windows\System\jZMfIKK.exe
  2⤵
  PID:7776
- C:\Windows\System\PcHMnSe.exe
  C:\Windows\System\PcHMnSe.exe
  2⤵
  PID:6844
- C:\Windows\System\gwUtUjJ.exe
  C:\Windows\System\gwUtUjJ.exe
  2⤵
  PID:5652
- C:\Windows\System\BbnoEEU.exe
  C:\Windows\System\BbnoEEU.exe
  2⤵
  PID:7668
- C:\Windows\System\IqUcFkI.exe
  C:\Windows\System\IqUcFkI.exe
  2⤵
  PID:5156
- C:\Windows\System\koiVSDD.exe
  C:\Windows\System\koiVSDD.exe
  2⤵
  PID:7360
- C:\Windows\System\zTBTCqt.exe
  C:\Windows\System\zTBTCqt.exe
  2⤵
  PID:6084
- C:\Windows\System\cYKYHYo.exe
  C:\Windows\System\cYKYHYo.exe
  2⤵
  PID:7688
- C:\Windows\System\ECVooxW.exe
  C:\Windows\System\ECVooxW.exe
  2⤵
  PID:7968
- C:\Windows\System\pZlqPhd.exe
  C:\Windows\System\pZlqPhd.exe
  2⤵
  PID:6732
- C:\Windows\System\oYrkZgK.exe
  C:\Windows\System\oYrkZgK.exe
  2⤵
  PID:6176
- C:\Windows\System\KbmAeMz.exe
  C:\Windows\System\KbmAeMz.exe
  2⤵
  PID:7280
- C:\Windows\System\xrdkane.exe
  C:\Windows\System\xrdkane.exe
  2⤵
  PID:8172
- C:\Windows\System\PLYwTez.exe
  C:\Windows\System\PLYwTez.exe
  2⤵
  PID:8112
- C:\Windows\System\uFhFyDH.exe
  C:\Windows\System\uFhFyDH.exe
  2⤵
  PID:7264
- C:\Windows\System\QjmYqGF.exe
  C:\Windows\System\QjmYqGF.exe
  2⤵
  PID:8048
- C:\Windows\System\mVFiraY.exe
  C:\Windows\System\mVFiraY.exe
  2⤵
  PID:7904
- C:\Windows\System\EqKPrzN.exe
  C:\Windows\System\EqKPrzN.exe
  2⤵
  PID:5840
- C:\Windows\System\PaoLjkm.exe
  C:\Windows\System\PaoLjkm.exe
  2⤵
  PID:7516
- C:\Windows\System\sMNMmeV.exe
  C:\Windows\System\sMNMmeV.exe
  2⤵
  PID:5616
- C:\Windows\System\ewQfxKp.exe
  C:\Windows\System\ewQfxKp.exe
  2⤵
  PID:7852
- C:\Windows\System\nYrUNRu.exe
  C:\Windows\System\nYrUNRu.exe
  2⤵
  PID:8196
- C:\Windows\System\xKyuUpq.exe
  C:\Windows\System\xKyuUpq.exe
  2⤵
  PID:8212
- C:\Windows\System\zNhpRSf.exe
  C:\Windows\System\zNhpRSf.exe
  2⤵
  PID:8228
- C:\Windows\System\uisJRFU.exe
  C:\Windows\System\uisJRFU.exe
  2⤵
  PID:8244
- C:\Windows\System\JNRveXa.exe
  C:\Windows\System\JNRveXa.exe
  2⤵
  PID:8264
- C:\Windows\System\JHIJgNN.exe
  C:\Windows\System\JHIJgNN.exe
  2⤵
  PID:8280
- C:\Windows\System\pnJuCFJ.exe
  C:\Windows\System\pnJuCFJ.exe
  2⤵
  PID:8296
- C:\Windows\System\sStaojy.exe
  C:\Windows\System\sStaojy.exe
  2⤵
  PID:8316
- C:\Windows\System\KvryAUl.exe
  C:\Windows\System\KvryAUl.exe
  2⤵
  PID:8460
- C:\Windows\System\JxpAxZj.exe
  C:\Windows\System\JxpAxZj.exe
  2⤵
  PID:8476
- C:\Windows\System\iLseCjV.exe
  C:\Windows\System\iLseCjV.exe
  2⤵
  PID:8500
- C:\Windows\System\KuylJYE.exe
  C:\Windows\System\KuylJYE.exe
  2⤵
  PID:8516
- C:\Windows\System\vWxabac.exe
  C:\Windows\System\vWxabac.exe
  2⤵
  PID:8532
- C:\Windows\System\NddGvWB.exe
  C:\Windows\System\NddGvWB.exe
  2⤵
  PID:8548
- C:\Windows\System\BZLPtSz.exe
  C:\Windows\System\BZLPtSz.exe
  2⤵
  PID:8564
- C:\Windows\System\JrzgTon.exe
  C:\Windows\System\JrzgTon.exe
  2⤵
  PID:8580
- C:\Windows\System\BrBmDsf.exe
  C:\Windows\System\BrBmDsf.exe
  2⤵
  PID:8600
- C:\Windows\System\lSlpCDA.exe
  C:\Windows\System\lSlpCDA.exe
  2⤵
  PID:8616
- C:\Windows\System\FxmvJMD.exe
  C:\Windows\System\FxmvJMD.exe
  2⤵
  PID:8632
- C:\Windows\System\mJIYUnW.exe
  C:\Windows\System\mJIYUnW.exe
  2⤵
  PID:8648
- C:\Windows\System\vlaeqnF.exe
  C:\Windows\System\vlaeqnF.exe
  2⤵
  PID:8664
- C:\Windows\System\FlqzIyo.exe
  C:\Windows\System\FlqzIyo.exe
  2⤵
  PID:8680
- C:\Windows\System\onWHOZZ.exe
  C:\Windows\System\onWHOZZ.exe
  2⤵
  PID:8696
- C:\Windows\System\oFbfrtx.exe
  C:\Windows\System\oFbfrtx.exe
  2⤵
  PID:8716
- C:\Windows\System\YxpKABN.exe
  C:\Windows\System\YxpKABN.exe
  2⤵
  PID:8732
- C:\Windows\System\oBHRLxK.exe
  C:\Windows\System\oBHRLxK.exe
  2⤵
  PID:8748
- C:\Windows\System\uldFQjH.exe
  C:\Windows\System\uldFQjH.exe
  2⤵
  PID:8764
- C:\Windows\System\gYgaibB.exe
  C:\Windows\System\gYgaibB.exe
  2⤵
  PID:8780
- C:\Windows\System\tlWLxxB.exe
  C:\Windows\System\tlWLxxB.exe
  2⤵
  PID:8796
- C:\Windows\System\bTkYBtk.exe
  C:\Windows\System\bTkYBtk.exe
  2⤵
  PID:8812
- C:\Windows\System\zOZZRVl.exe
  C:\Windows\System\zOZZRVl.exe
  2⤵
  PID:8828
- C:\Windows\System\WlOKDDv.exe
  C:\Windows\System\WlOKDDv.exe
  2⤵
  PID:8844
- C:\Windows\System\HPemzor.exe
  C:\Windows\System\HPemzor.exe
  2⤵
  PID:8860
- C:\Windows\System\IDgMvNX.exe
  C:\Windows\System\IDgMvNX.exe
  2⤵
  PID:8876
- C:\Windows\System\jhWENjw.exe
  C:\Windows\System\jhWENjw.exe
  2⤵
  PID:8892
- C:\Windows\System\HIkBSEe.exe
  C:\Windows\System\HIkBSEe.exe
  2⤵
  PID:8908
- C:\Windows\System\vUDmDNj.exe
  C:\Windows\System\vUDmDNj.exe
  2⤵
  PID:8924
- C:\Windows\System\cocdYqQ.exe
  C:\Windows\System\cocdYqQ.exe
  2⤵
  PID:8940
- C:\Windows\System\oLNQyfb.exe
  C:\Windows\System\oLNQyfb.exe
  2⤵
  PID:8956
- C:\Windows\System\IICqgpG.exe
  C:\Windows\System\IICqgpG.exe
  2⤵
  PID:8972
- C:\Windows\System\XWusvFS.exe
  C:\Windows\System\XWusvFS.exe
  2⤵
  PID:8992
- C:\Windows\System\kCgTphL.exe
  C:\Windows\System\kCgTphL.exe
  2⤵
  PID:9008
- C:\Windows\System\wjUaGru.exe
  C:\Windows\System\wjUaGru.exe
  2⤵
  PID:9024
- C:\Windows\System\eRaJYvm.exe
  C:\Windows\System\eRaJYvm.exe
  2⤵
  PID:9040
- C:\Windows\System\jySUHpd.exe
  C:\Windows\System\jySUHpd.exe
  2⤵
  PID:9056
- C:\Windows\System\uXAVYKM.exe
  C:\Windows\System\uXAVYKM.exe
  2⤵
  PID:9072
- C:\Windows\System\RrAvbrQ.exe
  C:\Windows\System\RrAvbrQ.exe
  2⤵
  PID:9088
- C:\Windows\System\SoMrVKD.exe
  C:\Windows\System\SoMrVKD.exe
  2⤵
  PID:9104
- C:\Windows\System\JHsIpcw.exe
  C:\Windows\System\JHsIpcw.exe
  2⤵
  PID:9120
- C:\Windows\System\OillxMr.exe
  C:\Windows\System\OillxMr.exe
  2⤵
  PID:9136
- C:\Windows\System\BNRyfLz.exe
  C:\Windows\System\BNRyfLz.exe
  2⤵
  PID:9152
- C:\Windows\System\clBrgGt.exe
  C:\Windows\System\clBrgGt.exe
  2⤵
  PID:9168
- C:\Windows\System\xRZZVQP.exe
  C:\Windows\System\xRZZVQP.exe
  2⤵
  PID:9184
- C:\Windows\System\TkcxASq.exe
  C:\Windows\System\TkcxASq.exe
  2⤵
  PID:9200
- C:\Windows\System\bFmJoCH.exe
  C:\Windows\System\bFmJoCH.exe
  2⤵
  PID:7376
- C:\Windows\System\nNIdjPY.exe
  C:\Windows\System\nNIdjPY.exe
  2⤵
  PID:8240
- C:\Windows\System\sPhTAaU.exe
  C:\Windows\System\sPhTAaU.exe
  2⤵
  PID:6332
- C:\Windows\System\CbZbYAF.exe
  C:\Windows\System\CbZbYAF.exe
  2⤵
  PID:2204
- C:\Windows\System\DQJAbzf.exe
  C:\Windows\System\DQJAbzf.exe
  2⤵
  PID:7872
- C:\Windows\System\ZLRndfX.exe
  C:\Windows\System\ZLRndfX.exe
  2⤵
  PID:8220
- C:\Windows\System\EYizTdK.exe
  C:\Windows\System\EYizTdK.exe
  2⤵
  PID:8260
- C:\Windows\System\uDHXaMg.exe
  C:\Windows\System\uDHXaMg.exe
  2⤵
  PID:8348
- C:\Windows\System\uGRxXhh.exe
  C:\Windows\System\uGRxXhh.exe
  2⤵
  PID:8336
- C:\Windows\System\gUYqARW.exe
  C:\Windows\System\gUYqARW.exe
  2⤵
  PID:8292
- C:\Windows\System\YCMwwhr.exe
  C:\Windows\System\YCMwwhr.exe
  2⤵
  PID:8448
- C:\Windows\System\IYQDngV.exe
  C:\Windows\System\IYQDngV.exe
  2⤵
  PID:8472
- C:\Windows\System\rbFlKlk.exe
  C:\Windows\System\rbFlKlk.exe
  2⤵
  PID:8508
- C:\Windows\System\irZuFtU.exe
  C:\Windows\System\irZuFtU.exe
  2⤵
  PID:8524
- C:\Windows\System\QEtcDLo.exe
  C:\Windows\System\QEtcDLo.exe
  2⤵
  PID:2344
- C:\Windows\System\ODRqPKB.exe
  C:\Windows\System\ODRqPKB.exe
  2⤵
  PID:8592
- C:\Windows\System\MDSmwwq.exe
  C:\Windows\System\MDSmwwq.exe
  2⤵
  PID:8612
- C:\Windows\System\YOHwRXs.exe
  C:\Windows\System\YOHwRXs.exe
  2⤵
  PID:8656
- C:\Windows\System\lOHkjGC.exe
  C:\Windows\System\lOHkjGC.exe
  2⤵
  PID:8672
- C:\Windows\System\MvCuDMa.exe
  C:\Windows\System\MvCuDMa.exe
  2⤵
  PID:8692
- C:\Windows\System\HaIlksC.exe
  C:\Windows\System\HaIlksC.exe
  2⤵
  PID:8744
- C:\Windows\System\MYCNdMA.exe
  C:\Windows\System\MYCNdMA.exe
  2⤵
  PID:8760
- C:\Windows\System\pOkQGnJ.exe
  C:\Windows\System\pOkQGnJ.exe
  2⤵
  PID:8792
- C:\Windows\System\gLxHCWU.exe
  C:\Windows\System\gLxHCWU.exe
  2⤵
  PID:8836
- C:\Windows\System\PeFwPDp.exe
  C:\Windows\System\PeFwPDp.exe
  2⤵
  PID:8900
- C:\Windows\System\zkXTfWy.exe
  C:\Windows\System\zkXTfWy.exe
  2⤵
  PID:8444
- C:\Windows\System\KMYArYH.exe
  C:\Windows\System\KMYArYH.exe
  2⤵
  PID:8920
- C:\Windows\System\UIdvPte.exe
  C:\Windows\System\UIdvPte.exe
  2⤵
  PID:8964
- C:\Windows\System\IOZZkdD.exe
  C:\Windows\System\IOZZkdD.exe
  2⤵
  PID:9000
- C:\Windows\System\DQkcGJu.exe
  C:\Windows\System\DQkcGJu.exe
  2⤵
  PID:9020
- C:\Windows\System\HlNYJGO.exe
  C:\Windows\System\HlNYJGO.exe
  2⤵
  PID:9036
- C:\Windows\System\bXVXngv.exe
  C:\Windows\System\bXVXngv.exe
  2⤵
  PID:9096
- C:\Windows\System\ZkqsZXc.exe
  C:\Windows\System\ZkqsZXc.exe
  2⤵
  PID:9128
- C:\Windows\System\okGVPLt.exe
  C:\Windows\System\okGVPLt.exe
  2⤵
  PID:9148
- C:\Windows\System\nxOhECA.exe
  C:\Windows\System\nxOhECA.exe
  2⤵
  PID:9192
- C:\Windows\System\KAwspRp.exe
  C:\Windows\System\KAwspRp.exe
  2⤵
  PID:8208
- C:\Windows\System\odxwmTZ.exe
  C:\Windows\System\odxwmTZ.exe
  2⤵
  PID:5812
- C:\Windows\System\bsCtLja.exe
  C:\Windows\System\bsCtLja.exe
  2⤵
  PID:7728
- C:\Windows\System\TwahVVE.exe
  C:\Windows\System\TwahVVE.exe
  2⤵
  PID:8352
- C:\Windows\System\cYbdOCH.exe
  C:\Windows\System\cYbdOCH.exe
  2⤵
  PID:8332
- C:\Windows\System\wNGAeDb.exe
  C:\Windows\System\wNGAeDb.exe
  2⤵
  PID:8308
- C:\Windows\System\kZKoPnc.exe
  C:\Windows\System\kZKoPnc.exe
  2⤵
  PID:8512
- C:\Windows\System\mAZtWDn.exe
  C:\Windows\System\mAZtWDn.exe
  2⤵
  PID:8588
- C:\Windows\System\bUgBwEJ.exe
  C:\Windows\System\bUgBwEJ.exe
  2⤵
  PID:8608
- C:\Windows\System\RPysfXm.exe
  C:\Windows\System\RPysfXm.exe
  2⤵
  PID:8704
- C:\Windows\System\YlhTkSv.exe
  C:\Windows\System\YlhTkSv.exe
  2⤵
  PID:8724
- C:\Windows\System\LGLLCpV.exe
  C:\Windows\System\LGLLCpV.exe
  2⤵
  PID:8824
- C:\Windows\System\kPbhKuz.exe
  C:\Windows\System\kPbhKuz.exe
  2⤵
  PID:8804
- C:\Windows\System\QKdzJOj.exe
  C:\Windows\System\QKdzJOj.exe
  2⤵
  PID:8916
- C:\Windows\System\eJBGPUK.exe
  C:\Windows\System\eJBGPUK.exe
  2⤵
  PID:8712
- C:\Windows\System\ghuPNPM.exe
  C:\Windows\System\ghuPNPM.exe
  2⤵
  PID:9032
- C:\Windows\System\WoGVDrA.exe
  C:\Windows\System\WoGVDrA.exe
  2⤵
  PID:8980
- C:\Windows\System\nAPPhnu.exe
  C:\Windows\System\nAPPhnu.exe
  2⤵
  PID:9180
- C:\Windows\System\XmItgeQ.exe
  C:\Windows\System\XmItgeQ.exe
  2⤵
  PID:7984
- C:\Windows\System\EquEGdI.exe
  C:\Windows\System\EquEGdI.exe
  2⤵
  PID:6132
- C:\Windows\System\fpoPSjQ.exe
  C:\Windows\System\fpoPSjQ.exe
  2⤵
  PID:7712
- C:\Windows\System\iJbKQKI.exe
  C:\Windows\System\iJbKQKI.exe
  2⤵
  PID:8576
- C:\Windows\System\VQyWXgD.exe
  C:\Windows\System\VQyWXgD.exe
  2⤵
  PID:8756
- C:\Windows\System\lqZZNwz.exe
  C:\Windows\System\lqZZNwz.exe
  2⤵
  PID:8788
- C:\Windows\System\RkMygdN.exe
  C:\Windows\System\RkMygdN.exe
  2⤵
  PID:8820
- C:\Windows\System\dOINTBL.exe
  C:\Windows\System\dOINTBL.exe
  2⤵
  PID:9080
- C:\Windows\System\TJhcBVd.exe
  C:\Windows\System\TJhcBVd.exe
  2⤵
  PID:9208
- C:\Windows\System\JoPzpWQ.exe
  C:\Windows\System\JoPzpWQ.exe
  2⤵
  PID:8340
- C:\Windows\System\AZNrlDj.exe
  C:\Windows\System\AZNrlDj.exe
  2⤵
  PID:8468
- C:\Windows\System\IxlNVkm.exe
  C:\Windows\System\IxlNVkm.exe
  2⤵
  PID:8872
- C:\Windows\System\pOsQbPS.exe
  C:\Windows\System\pOsQbPS.exe
  2⤵
  PID:9048
- C:\Windows\System\kjLHmEk.exe
  C:\Windows\System\kjLHmEk.exe
  2⤵
  PID:8644
- C:\Windows\System\KoaDJqO.exe
  C:\Windows\System\KoaDJqO.exe
  2⤵
  PID:8740
- C:\Windows\System\RCvdQiP.exe
  C:\Windows\System\RCvdQiP.exe
  2⤵
  PID:9224
- C:\Windows\System\XRgoiDz.exe
  C:\Windows\System\XRgoiDz.exe
  2⤵
  PID:9240
- C:\Windows\System\CEfarGn.exe
  C:\Windows\System\CEfarGn.exe
  2⤵
  PID:9256
- C:\Windows\System\VZSsZjr.exe
  C:\Windows\System\VZSsZjr.exe
  2⤵
  PID:9272
- C:\Windows\System\VSgebJZ.exe
  C:\Windows\System\VSgebJZ.exe
  2⤵
  PID:9288
- C:\Windows\System\CHbnBsC.exe
  C:\Windows\System\CHbnBsC.exe
  2⤵
  PID:9304
- C:\Windows\System\nBRhLPL.exe
  C:\Windows\System\nBRhLPL.exe
  2⤵
  PID:9320
- C:\Windows\System\SYmDtGs.exe
  C:\Windows\System\SYmDtGs.exe
  2⤵
  PID:9336
- C:\Windows\System\nBJBKyO.exe
  C:\Windows\System\nBJBKyO.exe
  2⤵
  PID:9352
- C:\Windows\System\xfWEyIW.exe
  C:\Windows\System\xfWEyIW.exe
  2⤵
  PID:9368
- C:\Windows\System\jJshrDO.exe
  C:\Windows\System\jJshrDO.exe
  2⤵
  PID:9384
- C:\Windows\System\aApVulH.exe
  C:\Windows\System\aApVulH.exe
  2⤵
  PID:9400
- C:\Windows\System\tRJREzq.exe
  C:\Windows\System\tRJREzq.exe
  2⤵
  PID:9416
- C:\Windows\System\tsLxbbK.exe
  C:\Windows\System\tsLxbbK.exe
  2⤵
  PID:9432
- C:\Windows\System\ThTrrZZ.exe
  C:\Windows\System\ThTrrZZ.exe
  2⤵
  PID:9448
- C:\Windows\System\cLYGBUp.exe
  C:\Windows\System\cLYGBUp.exe
  2⤵
  PID:9464
- C:\Windows\System\xVcYjEh.exe
  C:\Windows\System\xVcYjEh.exe
  2⤵
  PID:9484
- C:\Windows\System\YidnSNB.exe
  C:\Windows\System\YidnSNB.exe
  2⤵
  PID:9500
- C:\Windows\System\lXdJgBS.exe
  C:\Windows\System\lXdJgBS.exe
  2⤵
  PID:9516
- C:\Windows\System\yJJJGUV.exe
  C:\Windows\System\yJJJGUV.exe
  2⤵
  PID:9532
- C:\Windows\System\VVktPMu.exe
  C:\Windows\System\VVktPMu.exe
  2⤵
  PID:9548
- C:\Windows\System\KHjtrMq.exe
  C:\Windows\System\KHjtrMq.exe
  2⤵
  PID:9564
- C:\Windows\System\Fpfnvzp.exe
  C:\Windows\System\Fpfnvzp.exe
  2⤵
  PID:9580
- C:\Windows\System\hRSInKA.exe
  C:\Windows\System\hRSInKA.exe
  2⤵
  PID:9596
- C:\Windows\System\RbXpyjc.exe
  C:\Windows\System\RbXpyjc.exe
  2⤵
  PID:9612
- C:\Windows\System\sogapuL.exe
  C:\Windows\System\sogapuL.exe
  2⤵
  PID:9628
- C:\Windows\System\HOypuFj.exe
  C:\Windows\System\HOypuFj.exe
  2⤵
  PID:9644
- C:\Windows\System\bigrkzf.exe
  C:\Windows\System\bigrkzf.exe
  2⤵
  PID:9660
- C:\Windows\System\WTTcTlz.exe
  C:\Windows\System\WTTcTlz.exe
  2⤵
  PID:9676
- C:\Windows\System\lOvWTJp.exe
  C:\Windows\System\lOvWTJp.exe
  2⤵
  PID:9692
- C:\Windows\System\gFbhAtQ.exe
  C:\Windows\System\gFbhAtQ.exe
  2⤵
  PID:9708
- C:\Windows\System\IaOOBxM.exe
  C:\Windows\System\IaOOBxM.exe
  2⤵
  PID:9724
- C:\Windows\System\mQxYntw.exe
  C:\Windows\System\mQxYntw.exe
  2⤵
  PID:9740
- C:\Windows\System\cYAllai.exe
  C:\Windows\System\cYAllai.exe
  2⤵
  PID:9756
- C:\Windows\System\HFRWMFz.exe
  C:\Windows\System\HFRWMFz.exe
  2⤵
  PID:9772
- C:\Windows\System\olBTYKv.exe
  C:\Windows\System\olBTYKv.exe
  2⤵
  PID:9788
- C:\Windows\System\JpSaBcA.exe
  C:\Windows\System\JpSaBcA.exe
  2⤵
  PID:9804
- C:\Windows\System\SPztyqk.exe
  C:\Windows\System\SPztyqk.exe
  2⤵
  PID:9820
- C:\Windows\System\UVQsyEl.exe
  C:\Windows\System\UVQsyEl.exe
  2⤵
  PID:9836
- C:\Windows\System\WvSdnGg.exe
  C:\Windows\System\WvSdnGg.exe
  2⤵
  PID:9852
- C:\Windows\System\JhmUuJI.exe
  C:\Windows\System\JhmUuJI.exe
  2⤵
  PID:9868
- C:\Windows\System\gSStzFm.exe
  C:\Windows\System\gSStzFm.exe
  2⤵
  PID:9904
- C:\Windows\System\CmYQbhn.exe
  C:\Windows\System\CmYQbhn.exe
  2⤵
  PID:9920
- C:\Windows\System\ACVmCAI.exe
  C:\Windows\System\ACVmCAI.exe
  2⤵
  PID:9936
- C:\Windows\System\FkHGPVH.exe
  C:\Windows\System\FkHGPVH.exe
  2⤵
  PID:9952
- C:\Windows\System\xwiFRye.exe
  C:\Windows\System\xwiFRye.exe
  2⤵
  PID:9968
- C:\Windows\System\ikuKPUM.exe
  C:\Windows\System\ikuKPUM.exe
  2⤵
  PID:9984
- C:\Windows\System\UNhvoxR.exe
  C:\Windows\System\UNhvoxR.exe
  2⤵
  PID:10004
- C:\Windows\System\JhEdQOn.exe
  C:\Windows\System\JhEdQOn.exe
  2⤵
  PID:10020
- C:\Windows\System\buRtOXg.exe
  C:\Windows\System\buRtOXg.exe
  2⤵
  PID:10060
- C:\Windows\System\mVjrLkP.exe
  C:\Windows\System\mVjrLkP.exe
  2⤵
  PID:10076
- C:\Windows\System\ePnqvSN.exe
  C:\Windows\System\ePnqvSN.exe
  2⤵
  PID:10092
- C:\Windows\System\XpMcwOb.exe
  C:\Windows\System\XpMcwOb.exe
  2⤵
  PID:10116
- C:\Windows\System\cyOcbDC.exe
  C:\Windows\System\cyOcbDC.exe
  2⤵
  PID:10132
- C:\Windows\System\EZJCGlw.exe
  C:\Windows\System\EZJCGlw.exe
  2⤵
  PID:10152
- C:\Windows\System\abovNnb.exe
  C:\Windows\System\abovNnb.exe
  2⤵
  PID:10168
- C:\Windows\System\TXKBRJd.exe
  C:\Windows\System\TXKBRJd.exe
  2⤵
  PID:10184
- C:\Windows\System\tEdGWjs.exe
  C:\Windows\System\tEdGWjs.exe
  2⤵
  PID:10200
- C:\Windows\System\OJHXUxA.exe
  C:\Windows\System\OJHXUxA.exe
  2⤵
  PID:10220
- C:\Windows\System\wGenVdC.exe
  C:\Windows\System\wGenVdC.exe
  2⤵
  PID:10236
- C:\Windows\System\uOBpkGp.exe
  C:\Windows\System\uOBpkGp.exe
  2⤵
  PID:8660
- C:\Windows\System\RdCzyTY.exe
  C:\Windows\System\RdCzyTY.exe
  2⤵
  PID:9248
- C:\Windows\System\ejbIhoV.exe
  C:\Windows\System\ejbIhoV.exe
  2⤵
  PID:9300
- C:\Windows\System\uCNbdoK.exe
  C:\Windows\System\uCNbdoK.exe
  2⤵
  PID:9252
- C:\Windows\System\ejwASDZ.exe
  C:\Windows\System\ejwASDZ.exe
  2⤵
  PID:9332
- C:\Windows\System\kIsPZEu.exe
  C:\Windows\System\kIsPZEu.exe
  2⤵
  PID:9364
- C:\Windows\System\rKOBoMT.exe
  C:\Windows\System\rKOBoMT.exe
  2⤵
  PID:9408
- C:\Windows\System\yysidHc.exe
  C:\Windows\System\yysidHc.exe
  2⤵
  PID:9440
- C:\Windows\System\wPMpCEI.exe
  C:\Windows\System\wPMpCEI.exe
  2⤵
  PID:9472
- C:\Windows\System\EQjMeQK.exe
  C:\Windows\System\EQjMeQK.exe
  2⤵
  PID:9496
- C:\Windows\System\cUaLvjs.exe
  C:\Windows\System\cUaLvjs.exe
  2⤵
  PID:9560
- C:\Windows\System\KiHSGZq.exe
  C:\Windows\System\KiHSGZq.exe
  2⤵
  PID:9540
- C:\Windows\System\sToeQRt.exe
  C:\Windows\System\sToeQRt.exe
  2⤵
  PID:9620
- C:\Windows\System\ecKrnle.exe
  C:\Windows\System\ecKrnle.exe
  2⤵
  PID:9656
- C:\Windows\System\MxsQSHc.exe
  C:\Windows\System\MxsQSHc.exe
  2⤵
  PID:9688
- C:\Windows\System\xsyQyyG.exe
  C:\Windows\System\xsyQyyG.exe
  2⤵
  PID:9720
- C:\Windows\System\OKuvOyW.exe
  C:\Windows\System\OKuvOyW.exe
  2⤵
  PID:9764
- C:\Windows\System\zxcJVjA.exe
  C:\Windows\System\zxcJVjA.exe
  2⤵
  PID:9816
- C:\Windows\System\vVLEUvq.exe
  C:\Windows\System\vVLEUvq.exe
  2⤵
  PID:9876
- C:\Windows\System\JxxJZsn.exe
  C:\Windows\System\JxxJZsn.exe
  2⤵
  PID:9860
- C:\Windows\System\DpAhqOB.exe
  C:\Windows\System\DpAhqOB.exe
  2⤵
  PID:9884
- C:\Windows\System\EFICAdv.exe
  C:\Windows\System\EFICAdv.exe
  2⤵
  PID:9916
- C:\Windows\System\JjsVETG.exe
  C:\Windows\System\JjsVETG.exe
  2⤵
  PID:9976
- C:\Windows\System\jcklysn.exe
  C:\Windows\System\jcklysn.exe
  2⤵
  PID:9960
- C:\Windows\System\NemwbeD.exe
  C:\Windows\System\NemwbeD.exe
  2⤵
  PID:10028
- C:\Windows\System\ihGrtrE.exe
  C:\Windows\System\ihGrtrE.exe
  2⤵
  PID:10044
- C:\Windows\System\HKhvcjo.exe
  C:\Windows\System\HKhvcjo.exe
  2⤵
  PID:10084
- C:\Windows\System\NLhgdUt.exe
  C:\Windows\System\NLhgdUt.exe
  2⤵
  PID:9316
- C:\Windows\System\kwetOQv.exe
  C:\Windows\System\kwetOQv.exe
  2⤵
  PID:9444
- C:\Windows\System\LzYEMEu.exe
  C:\Windows\System\LzYEMEu.exe
  2⤵
  PID:9480
- C:\Windows\System\xWEuCsT.exe
  C:\Windows\System\xWEuCsT.exe
  2⤵
  PID:9716
- C:\Windows\System\qRqFRBR.exe
  C:\Windows\System\qRqFRBR.exe
  2⤵
  PID:9652
- C:\Windows\System\sEaDHTW.exe
  C:\Windows\System\sEaDHTW.exe
  2⤵
  PID:9604
- C:\Windows\System\jKCOVXN.exe
  C:\Windows\System\jKCOVXN.exe
  2⤵
  PID:9780
- C:\Windows\System\jqsvpOS.exe
  C:\Windows\System\jqsvpOS.exe
  2⤵
  PID:9996
- C:\Windows\System\rVWXgdi.exe
  C:\Windows\System\rVWXgdi.exe
  2⤵
  PID:2168
- C:\Windows\System\WbAReVA.exe
  C:\Windows\System\WbAReVA.exe
  2⤵
  PID:9476
- C:\Windows\System\UhhigCP.exe
  C:\Windows\System\UhhigCP.exe
  2⤵
  PID:9736
- C:\Windows\System\TJoiVIR.exe
  C:\Windows\System\TJoiVIR.exe
  2⤵
  PID:10196
- C:\Windows\System\CXvNGzh.exe
  C:\Windows\System\CXvNGzh.exe
  2⤵
  PID:10212
- C:\Windows\System\yACfLNd.exe
  C:\Windows\System\yACfLNd.exe
  2⤵
  PID:8496
- C:\Windows\System\xTulsJs.exe
  C:\Windows\System\xTulsJs.exe
  2⤵
  PID:10216
- C:\Windows\System\JyehKQp.exe
  C:\Windows\System\JyehKQp.exe
  2⤵
  PID:9456
- C:\Windows\System\WAVsxNy.exe
  C:\Windows\System\WAVsxNy.exe
  2⤵
  PID:9844
- C:\Windows\System\czlOqCV.exe
  C:\Windows\System\czlOqCV.exe
  2⤵
  PID:9684
- C:\Windows\System\HWWZSjO.exe
  C:\Windows\System\HWWZSjO.exe
  2⤵
  PID:9524
- C:\Windows\System\fpDjHRE.exe
  C:\Windows\System\fpDjHRE.exe
  2⤵
  PID:9424
- C:\Windows\System\yEDgKEO.exe
  C:\Windows\System\yEDgKEO.exe
  2⤵
  PID:2340
- C:\Windows\System\LvugPVf.exe
  C:\Windows\System\LvugPVf.exe
  2⤵
  PID:10108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AUCBwjc.exe

Filesize
1.2MB

MD5
b16587bf3f645cfaaac04695db565a3a

SHA1
65267ec57350436d2c5d350925fcd29e65e21c85

SHA256
ca616b5d50f949d373a5a0262569a10addc25e7c453561225254789435d2bf1f

SHA512
413634ef71b5811718777dd941f63526a36cfaf685a1752b460d369cf0ecb61dc625aba87ec278ad0db0f5ee7c7d2cedc2921b011d1183ce4b0059ce54269a01

Download Submit
C:\Windows\system\BbTCMie.exe

Filesize
8B

MD5
32b7ea6808cb0d0588880e19bc938e0d

SHA1
a2a14fb2496477c15447641668b3a4ba57cd6868

SHA256
d351356313a629cc71b2192da43801c99792ac1840130fa9c0e894d77cc61fe6

SHA512
45c98726b9e87daa1a8bc20775b1d55cecc308f1fbc7a3306dcf2a568110044a51cf50eaa68813deb6bb7e6bc1da7716afccc3451cbc0cee8b79db8ffaf5afc8

Download Submit
C:\Windows\system\LxGxImL.exe

Filesize
1.2MB

MD5
88a31a8017bbae24804ebc8d1580d662

SHA1
1bddaefd4cc17cf5f56c2166a33a3fdf8f0e7b0b

SHA256
18fa4355c01b92576bddb52bc970f494270417d4dedacef53093076c8e28d284

SHA512
7dcecdc28c6392c5a984b4bdcf6c95e9b429b0b4b631ebfb15da1735ff7f866be7644ec915752372336aad1634da2f101779c68100da5cc548cd2b1b70fd4e10

Download Submit
C:\Windows\system\MOCtMMG.exe

Filesize
1.2MB

MD5
306d15ec7d3cc1e6bb2eba4a68529054

SHA1
c2ea35d092378ca802293cb991f5a2d63fb45c03

SHA256
b5ed0eaba2bc4fa7af449f719ed796d5f11fa30d699829da44ae42da58973152

SHA512
d018ed3f2ed6cbb82858ed603ede308bbc247ab1b61b508079e46d9202679ef4c68573e85fb2b86d2cec2bf3c709d564171b39d18aca866663d9b5308fb5cfac

Download Submit
C:\Windows\system\NFjormb.exe

Filesize
1.2MB

MD5
3edafc474b0fa2d515e651eead303c14

SHA1
14537b811d6eceb1953d4da56190a692a1e36364

SHA256
fb5678b83424c76fa04801846223d8fad8fac826413f0bb51910023a2aacfb46

SHA512
92c3dab2315dd2f1a1de4f9f31a22812929328bc4c80e1c2c5c37a8484d5b9ebf15ee64f727cbcf04e2e96004c0b1e27c824f55e0f87c4eaa52f043e00260ac6

Download Submit
C:\Windows\system\NhFsOYK.exe

Filesize
1.2MB

MD5
0e21a9d2ddef16188d673292d5484aa9

SHA1
43ebc4f920bff55ca890216dc6d2287f1bcb4655

SHA256
8bb3d68a3450a225ff6b03a4934842030fd4d3e7475aaa433870d35349e8a78d

SHA512
d03c193a1294d554a23dd8392cff28547efdc881a806475d49a1d3a0e9fa1a594b8b607d24b3c4e7fc68005c664111f851ce7f4da53e055242b26e8839d004ca

Download Submit
C:\Windows\system\OvCJyRb.exe

Filesize
1.2MB

MD5
cf01390cb0bcc9bc406d22aa17b7916f

SHA1
dbb1e5225721ba3d8105d3f40c3aec3f0434cb45

SHA256
ed43db033c70d5028316276426832181bbc2ab65dcb2b5c4182ac4d95ce78e8c

SHA512
976d03805552cee6f27cfff535a36158c510faf2369042477d0704496542f7e4c1842244d2f5021e8b06a5ac68fe26ef5a231c56de6039f29a76944a322d1d00

Download Submit
C:\Windows\system\PmzZNJg.exe

Filesize
1.2MB

MD5
919d43db52d82f49f28b8cd05ad5aa61

SHA1
05332e267128e8c1d31a7ba1580eca8481b932d2

SHA256
3e8baf388a31dcf25f08d5cf684e4d0ac07d189a5498d5536eaa894f839020d8

SHA512
3b40864b6b84fa08568678b51651353c0627ed3f02061cad89c5e8d25d207b706460f7f7c9159b427243e29bbebeefe8a16e5360328b3d24f244f549e1eac9e2

Download Submit
C:\Windows\system\RBWQQPJ.exe

Filesize
1.2MB

MD5
d426a581856bb27fc2468d8ee53df57a

SHA1
2785b9743a8084d5dec02b6ac16322ea0285f48a

SHA256
8b6922a1ff862e85288692d83d87881b76bde1ac2bd2ea3ce5dceb0a0d335961

SHA512
e8bdf58007d27f443af699f15434b0688b3f7064db1eb1301b52f6dfc695430729a91492350b80b943dc495b5b5926a44e067e2ba3dd07ec31e50e415666d048

Download Submit
C:\Windows\system\THoOHGd.exe

Filesize
1.2MB

MD5
0ccde130e510843bbb2f70703d81f33a

SHA1
76649290cd8f72a7805a74fb585ed764627b37bf

SHA256
71f9baa905cc5963fecd6b5e4dd0142047f5638bf15321503e13b3a7def32ae1

SHA512
2b0c64b07135bbcd8a26dd5ea62abff9ba5a79c0d87e52a81e3b350cb916b6833c0059629966332ea28578a74b46efb676a47cf61c5bd8865ed607327febbb2e

Download Submit
C:\Windows\system\ULmVhbB.exe

Filesize
1.2MB

MD5
177101148ca3167444a134295121556e

SHA1
b23abfde80acd023dbd84ec9f3a4b06ad0519705

SHA256
fc0295f7b832896023a14f1429a01fdf7766875abd063c3210205f796ed00522

SHA512
06c46b62ef643b14b18b2fa2baf210645765b68274b72c387c42a1c301cd087576a8887e94ab332356461494dba0b0b77dc63dc0aeba14ae80e0b2b3a1cde316

Download Submit
C:\Windows\system\VdPJoRh.exe

Filesize
1.2MB

MD5
b6f5f0998414de9b0af60d861ea20007

SHA1
9d337f64c43c363752f1eb8e29224be15c3202b0

SHA256
175c46dd16f42a9c615f1f8cd19357815cd7f018e4b708ac924179ae8c39e033

SHA512
7e2465d0814403df4b62046c41f76c9b47ac0bb611be7f71f22fbdbe58e7916fe9685f934067146619b804efa8191342ed13e53c69cde36a557833085a21c6ba

Download Submit
C:\Windows\system\YYPFIkR.exe

Filesize
1.2MB

MD5
1c655dc87da1d1b5f9dcffa84b158ca8

SHA1
ab291c8b23d51a9e2613c31a9a86286732e3f619

SHA256
5c72240e2a0e809f07332d95281ba2864b1310f11daf4989b04c14c39e306a03

SHA512
72d2f1d7a8d02da3743ebb71d2a276664e5f883cab8f42e10d5cb0ffd1138e1f97b063d524049fa52cc1fc6c39e1a4509a7c431463305d0f6bb5b511108c9e7a

Download Submit
C:\Windows\system\YmKcPJr.exe

Filesize
1.2MB

MD5
4fd3e5d8263484b61859b34bce243b43

SHA1
19a965758f7e93ca7579389e6dca7ff77a042466

SHA256
e98d8dd3516ff4c27ce37adeb35afcad83ff2d358ea2b08f5f7ac323615c96f9

SHA512
9026ac6060245773329136b6862574641a235d26ff367a509c5c3ee17ddf7e62245b3c9368e2c55275e358f7d6af10678a66d01728e35a2256ebfb083726035b

Download Submit
C:\Windows\system\ZUTsIIn.exe

Filesize
1.2MB

MD5
c6b83f5b6ae451b730c910daefe34dc2

SHA1
d7fea05d0607e7cb984f34e35e17b040c4c0e17d

SHA256
a76638789ccb6a383c1cb3602b293a28a7eb35fa06c43ff40906dd85dc453cbf

SHA512
3851c811e4835ba06bb49dc9560276d259a491cca2792e10631c30b6f3c963bb1126c0b76f32f509220564d8beb34eec87c78e245779277ff529378e86c7675b

Download Submit
C:\Windows\system\eGRxFsd.exe

Filesize
1.2MB

MD5
7aa4c866695c34fd2f6433069ab66eb6

SHA1
966c57a0be69d4059466a760792e0d089d09e8ef

SHA256
20d21b9d95f7c61841a6f6499039a0b4faa1303d9f5446989baca1986ac35643

SHA512
6464cb2fc247ff2c8114c3d0e9b8b3eadd1ed56d8799c5db8e53f820bf418cc9ea946508e26129f0b33b9ce86e13837b8312a8af90b14182dc205e62ee9404e0

Download Submit
C:\Windows\system\ioeyRIG.exe

Filesize
1.2MB

MD5
af92b4865597a2209736a0b7fbb0e589

SHA1
7fd274c37b3189259aae904dda290ec5daff64dd

SHA256
ce243c04437f14ded3727b30b33f9998874ddb4fd2f50a057c07a22c2cfdc32d

SHA512
e68e0b4762cc6a6da44edadcd0eca53b3a26a03b50b0407f9157fe0e45885235327041c97bbc58a57cdd563cea85cada52c07d727aa41c2bc9bd90025c39292d

Download Submit
C:\Windows\system\mlBnHyh.exe

Filesize
1.2MB

MD5
47779fe0fe4ea971e611550975af675c

SHA1
20ab6c88f762da2353864c1f8a76b5ea4d45da8d

SHA256
4a53988e239c3d0ae535211387e36e58b87e8d61e590edbc1149e196a57ca859

SHA512
e59f6e3c82666886dab8edaa7f88045ebcda0d71c178dbf93e9bda63c97f779024d263a06fcf738657d180d28f4dd732e57515556940cc5fce62d2edcf3237c7

Download Submit
C:\Windows\system\xHHvNVO.exe

Filesize
1.2MB

MD5
8861f85920ee76da9d2f4ea2cc750a6b

SHA1
6a495ec663ab736e040c4f6addac5759399c8a90

SHA256
54c07b1b5bfa3761ab547ab0c4fe1c08ec9bb7da0f083fe6d689c391f8d63e3e

SHA512
8a19ae6065cc9a4b9a28f40012ca99e700830829b9a443ffc652c0e4de07ba6033e29ffacb3e3829613702534ba0d5d50a3551be56ead760f5d356f0b7404096

Download Submit
\Windows\system\BhADVJw.exe

Filesize
1.2MB

MD5
229a5522057d50225926330398e87a38

SHA1
f503a5215762e6a2a295c6ed37f1f86241562de6

SHA256
5eb7433947fe579b8b05ce00f46846e0d8e1da4cef4ac721b93734abf5e32e0e

SHA512
7cd8fe90e1011059c72f34b65c07b81201ce49a5e69def8f8ea7d2d0f4400694aa1ff8bfcf819579f1619be3022c8ff288ff3a194e0abf6cecbb58cb30288afa

Download Submit
\Windows\system\CUILLzf.exe

Filesize
1.2MB

MD5
1d3adcbfd710d2ca86e9f5089314c4fe

SHA1
a97d81f5d53d1f00bcdfeff81be63835b988810e

SHA256
a6c03b2b5c0adc07dbaa4f8e9ac303c66323f13c992e0e8e7b555c93d43847ba

SHA512
2e22d4112630a49a45724b3f4d2e3fea5ec3f698ade4257bb90bac13180232f33049dc6cae721f3ab81c9475c43a094c02553461261d17eb10f7650590c9918b

Download Submit
\Windows\system\HyPxhCu.exe

Filesize
1.2MB

MD5
461ba8baac694689e99d1b6699f411e5

SHA1
26eba7b227636d7a2940b44d885e57dfa0582f7e

SHA256
ea174bf51eba687dd500b6175076377dea87a5f19c30d1bd9c64e3c9c70a55a0

SHA512
502c3921fac6ddc58eaac191e2b937c7a92762d2451846cf6aa783f830ad91bc8b0c57608d7b461adfafc23234c64caa32bf56b18b9d2004c4d7c26a1cc745f1

Download Submit
\Windows\system\Iarzbtj.exe

Filesize
1.2MB

MD5
33e61e5d9d17f1598186e41469548dac

SHA1
c7fa48020bee9da6817b32b5872aaadfeae586fa

SHA256
72ff184942d3cbb415d51a1a4b4fef26a261e905c506f8d65a36a8ddcbcb5bbe

SHA512
133c246657b837d09f896bf90c532681339c98b87f93022ed90735612c90135846fb6e71bf25dab9072cd791d84f775cbefd08038e602e4dc71a9d3d1abeada3

Download Submit
\Windows\system\KoEcsIa.exe

Filesize
1.2MB

MD5
7e952c6af1abf838315c6acd1d03f074

SHA1
4600f2b449a14787d3dd84e42c1f01f01a1fabc8

SHA256
d136f4e65b366c5a04c31b146a6bad88dd5a90f0fe5a0d07a1f725ee96bfa2f4

SHA512
0a2a38c4debbb4d3dbad139c9fd0f447af05a899b7f77fd0e23173b6ccacab0a28af5e669c3e8c736349c3726afabbbed03a93fcf23c6ff202ea82953312f531

Download Submit
\Windows\system\SZMtdIm.exe

Filesize
1.2MB

MD5
8671f338a1eacb224d56b9e80fa82513

SHA1
4db54d0e5e9f43e04da2bd61f02b80972d49ec28

SHA256
aa60f8f79f075e008c24970ca90af42b1ba838bf2a304d4cf70d2a957453fb22

SHA512
f745cc9dd2192666ba39bea294e3961df8d81fce470f95787717bb8d7e33ac882e60f44d8434b216d8970d387f190147082d471027e7307d31678556aeb96385

Download Submit
\Windows\system\XQEZhoB.exe

Filesize
1.2MB

MD5
cbef36263dedad78c7c5c0529de274c7

SHA1
0ec20654430495bf8416d5acb192fd18c11f23f7

SHA256
485eb010e098d82c2febc7e7d7f837add99af866d671c4e124954e495be5d67d

SHA512
63c555d56eef3b357eac5326df9606f370a822f546d7d3f26b1c2f805e6edaf39b94d19507844ee4c539789b884496a79d5fc2c9d6ca161e21afe6a5e0d30519

Download Submit
\Windows\system\amnnqPu.exe

Filesize
1.2MB

MD5
92b8439590cbec0c9d4e631a9330c3cb

SHA1
e91f923fbfbf1de0f91a0e6fe0acb74127b70c3a

SHA256
997845f83c3c1c1c27f55816c8c58f93e20edd87db97dcf4279f7153cc18f2c2

SHA512
a6c73cbce39bebd6f7a2b61a9927dac8e4c80d1551cdffa9bd6feb9e1252fee9e2fa57ecfc512cafb167fd255739d38a98ab2f84220e38ded8df936190fa915f

Download Submit
\Windows\system\dIsntSB.exe

Filesize
1.2MB

MD5
6487ffc70ff0b62570efc8fc4e977a69

SHA1
016eba3d6e256fb9edf771b3d339536ec0482dbb

SHA256
aebf7126e0652e0cf1d01af0fd9e45108c4db80fd4f099763817f92cbffd0982

SHA512
cb00d78adc062e4898fcea7a50c1586d05128b36c8496bb953d1dab4ef24ec0ea384e4e7e583a9e91b8114d5aa5256189d70d6f4a10ce1e05c3aeccc84dca434

Download Submit
\Windows\system\ilDUkhG.exe

Filesize
1.2MB

MD5
cc239868f0e1815b1076e25f23de6f67

SHA1
e8bdeccbc7ac220620737049f969e257ff2f60a5

SHA256
2c693107e55044e1bd9e59aab7cbd276b85db83934f58207adb327cc75899924

SHA512
46cdfccaf39573e180d921cb6d2ab7d426ada0b6de4a4fa201a3ae55ec814d0bf7b5ed502dbadbe158ad4c961db21e94cddad902f5969223dbaab3733aa1f2f2

Download Submit
\Windows\system\jHozhng.exe

Filesize
1.2MB

MD5
3996aacd697bfc8511820f0c6610da37

SHA1
4896a8322024a072985078d2b623c233590a3bcf

SHA256
29edc90f47b6959fdbe25209881f4ee05c8693ecfdca5b9dfe53d034ece4ded8

SHA512
77891065d9a38790b75c0ab258bae46e5007d6ea8240d207d1370fe81067c6489e959ef6c0dd28fd312880f68c58e0dad23ef8ce37fe329932bba6b2cb1d9f22

Download Submit
\Windows\system\mxWeYHC.exe

Filesize
1.2MB

MD5
05b3cbb464dd30deba2f37f040857a0c

SHA1
421b7e63aae36548c48135eace44fecf97c1ecdd

SHA256
7bb8f828231a8b3c266d6b399953a91ccddbfdfaa762ec8f3a26a99f6a317497

SHA512
bde3aae8a87e53ea53e98b9bdb29f2ab79d71df0e0c6c3701bbeb761cd862f992fbba061ed717e1204ef237a10872b4a7ffc7eef5e1d3145840002b84f5000c3

Download Submit
\Windows\system\sTsgsZc.exe

Filesize
1.2MB

MD5
db9ee7ab6f4a072e4adfca4d8e76e7c2

SHA1
a0cb830add05292805ea90088158de58313bc118

SHA256
d4f83621e799e23bae455e5e59bdc7ae765fd55b72b59049ef22bd34cae38bae

SHA512
bc31215ea29065fd1c8b4a1426d146d22cd1e8f59a86d1f2e777d0b2ed5b19a42054f3eb593b97d5d2f892cb4ef9d9103fb273b29d5fc7f22f02561c3b69c348

Download Submit
\Windows\system\tiUKBiX.exe

Filesize
1.2MB

MD5
5f5a44253fe11340a7cd71a1adc2d012

SHA1
aec8be0a4ed30942a6573c7d4c839621be586434

SHA256
977cba1b2743eadfdb2901637cc76ccd751cc179b0bdef4d8e6abaae9c9f6b63

SHA512
321494d4147ed4cc8dd8d117f110d4612693fbc13a8805f8ed941585df055930d3d00697274d819599a65b2742342c52b1261e376b28da4c838d19c80c148973

Download Submit
memory/1880-35-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/1880-36-0x0000000002760000-0x0000000002768000-memory.dmp

Filesize
32KB

Download
memory/1880-2199-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/1880-123-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/1880-27-0x000007FEF561E000-0x000007FEF561F000-memory.dmp

Filesize
4KB

Download
memory/1880-30-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/1880-41-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/2532-150-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2532-82-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/2532-149-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-1-0x0000000001B20000-0x0000000001B30000-memory.dmp

Filesize
64KB

Download
memory/2532-147-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-146-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-145-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2532-4024-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-4023-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-4019-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-140-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-139-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-4018-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-137-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-1449-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2532-0-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2532-61-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-6-0x0000000002C10000-0x0000000003002000-memory.dmp

Filesize
3.9MB

Download
memory/2532-26-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2532-151-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-143-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2660-4896-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-142-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-38-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2696-4912-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2728-135-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/2728-4899-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/2748-65-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2800-138-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2800-4890-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2820-148-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2820-4903-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2860-144-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-4901-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/3068-4296-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3068-9-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3068-2977-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download