xmrig | c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
Size

1.9MB
MD5

4b8e61fc802dc086d49f3dc4cb5c5034
SHA1

0a151d2ace329d4bd20e0352ec90c8bd27633af9
SHA256

c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af
SHA512

b6682b28799198ea5c68442d1422ee3d6a0205eb815f49e8061b323546c885db3bda5716d65a8afccb2e693e0160e8f462db5b813f3a00f806301cce45a71bdd
SSDEEP

49152:Lz071uv4BPMkyW10/w16BvZX71Fq86z7W:NABu

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4880-240-0x00007FF7F02A0000-0x00007FF7F0692000-memory.dmp	xmrig
behavioral2/memory/1440-257-0x00007FF736F80000-0x00007FF737372000-memory.dmp	xmrig
behavioral2/memory/4352-263-0x00007FF6F2BC0000-0x00007FF6F2FB2000-memory.dmp	xmrig
behavioral2/memory/2984-269-0x00007FF70FE20000-0x00007FF710212000-memory.dmp	xmrig
behavioral2/memory/4568-271-0x00007FF6B6DB0000-0x00007FF6B71A2000-memory.dmp	xmrig
behavioral2/memory/940-270-0x00007FF65FBA0000-0x00007FF65FF92000-memory.dmp	xmrig
behavioral2/memory/1600-268-0x00007FF76AD10000-0x00007FF76B102000-memory.dmp	xmrig
behavioral2/memory/460-267-0x00007FF70F9D0000-0x00007FF70FDC2000-memory.dmp	xmrig
behavioral2/memory/2372-266-0x00007FF68A830000-0x00007FF68AC22000-memory.dmp	xmrig
behavioral2/memory/3324-265-0x00007FF774030000-0x00007FF774422000-memory.dmp	xmrig
behavioral2/memory/2740-264-0x00007FF726AD0000-0x00007FF726EC2000-memory.dmp	xmrig
behavioral2/memory/2848-262-0x00007FF7DFD90000-0x00007FF7E0182000-memory.dmp	xmrig
behavioral2/memory/4892-261-0x00007FF613DB0000-0x00007FF6141A2000-memory.dmp	xmrig
behavioral2/memory/1924-260-0x00007FF632FA0000-0x00007FF633392000-memory.dmp	xmrig
behavioral2/memory/4852-259-0x00007FF7D95E0000-0x00007FF7D99D2000-memory.dmp	xmrig
behavioral2/memory/3628-258-0x00007FF7FE460000-0x00007FF7FE852000-memory.dmp	xmrig
behavioral2/memory/3168-256-0x00007FF70A7E0000-0x00007FF70ABD2000-memory.dmp	xmrig
behavioral2/memory/2028-255-0x00007FF7B2590000-0x00007FF7B2982000-memory.dmp	xmrig
behavioral2/memory/980-254-0x00007FF7E4A00000-0x00007FF7E4DF2000-memory.dmp	xmrig
behavioral2/memory/2024-252-0x00007FF602AD0000-0x00007FF602EC2000-memory.dmp	xmrig
behavioral2/memory/3276-251-0x00007FF6F4120000-0x00007FF6F4512000-memory.dmp	xmrig
behavioral2/memory/3572-202-0x00007FF760AD0000-0x00007FF760EC2000-memory.dmp	xmrig
behavioral2/memory/4952-136-0x00007FF7811F0000-0x00007FF7815E2000-memory.dmp	xmrig
behavioral2/memory/3936-3286-0x00007FF6D7340000-0x00007FF6D7732000-memory.dmp	xmrig
behavioral2/memory/3936-3293-0x00007FF6D7340000-0x00007FF6D7732000-memory.dmp	xmrig
behavioral2/memory/4952-3295-0x00007FF7811F0000-0x00007FF7815E2000-memory.dmp	xmrig
behavioral2/memory/1600-3299-0x00007FF76AD10000-0x00007FF76B102000-memory.dmp	xmrig
behavioral2/memory/4880-3305-0x00007FF7F02A0000-0x00007FF7F0692000-memory.dmp	xmrig
behavioral2/memory/3276-3307-0x00007FF6F4120000-0x00007FF6F4512000-memory.dmp	xmrig
behavioral2/memory/3572-3303-0x00007FF760AD0000-0x00007FF760EC2000-memory.dmp	xmrig
behavioral2/memory/1440-3311-0x00007FF736F80000-0x00007FF737372000-memory.dmp	xmrig
behavioral2/memory/980-3313-0x00007FF7E4A00000-0x00007FF7E4DF2000-memory.dmp	xmrig
behavioral2/memory/4568-3317-0x00007FF6B6DB0000-0x00007FF6B71A2000-memory.dmp	xmrig
behavioral2/memory/940-3319-0x00007FF65FBA0000-0x00007FF65FF92000-memory.dmp	xmrig
behavioral2/memory/3168-3321-0x00007FF70A7E0000-0x00007FF70ABD2000-memory.dmp	xmrig
behavioral2/memory/4852-3315-0x00007FF7D95E0000-0x00007FF7D99D2000-memory.dmp	xmrig
behavioral2/memory/2024-3310-0x00007FF602AD0000-0x00007FF602EC2000-memory.dmp	xmrig
behavioral2/memory/2848-3331-0x00007FF7DFD90000-0x00007FF7E0182000-memory.dmp	xmrig
behavioral2/memory/4352-3333-0x00007FF6F2BC0000-0x00007FF6F2FB2000-memory.dmp	xmrig
behavioral2/memory/3324-3328-0x00007FF774030000-0x00007FF774422000-memory.dmp	xmrig
behavioral2/memory/460-3348-0x00007FF70F9D0000-0x00007FF70FDC2000-memory.dmp	xmrig
behavioral2/memory/3628-3343-0x00007FF7FE460000-0x00007FF7FE852000-memory.dmp	xmrig
behavioral2/memory/1924-3341-0x00007FF632FA0000-0x00007FF633392000-memory.dmp	xmrig
behavioral2/memory/2372-3340-0x00007FF68A830000-0x00007FF68AC22000-memory.dmp	xmrig
behavioral2/memory/2740-3326-0x00007FF726AD0000-0x00007FF726EC2000-memory.dmp	xmrig
behavioral2/memory/4892-3324-0x00007FF613DB0000-0x00007FF6141A2000-memory.dmp	xmrig
behavioral2/memory/2028-3301-0x00007FF7B2590000-0x00007FF7B2982000-memory.dmp	xmrig
behavioral2/memory/2984-3298-0x00007FF70FE20000-0x00007FF710212000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2284	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3936	chiNycZ.exe
1600	XSrZalB.exe
2984	YbASUwo.exe
4952	XGhEFDn.exe
3572	jPrOHGM.exe
4880	iHraqTh.exe
3276	LAudLmY.exe
2024	vFodtEU.exe
980	HkpPdcY.exe
2028	jUWVjpm.exe
940	ydpAdUy.exe
3168	YEZcCgs.exe
1440	OQoNZQC.exe
3628	tfSlNNd.exe
4852	sFFLffE.exe
1924	pFeNNfS.exe
4892	xPxzUFk.exe
2848	LHZzeTd.exe
4568	vqcwNRb.exe
4352	aegzMGz.exe
2740	HKfoHtU.exe
3324	nflCYOb.exe
2372	sUCKiAS.exe
460	nwWYrll.exe
1380	eBwOLWu.exe
1632	ziMqkxz.exe
3884	UvwYwdd.exe
3944	fPrNGeX.exe
4124	TkxLZii.exe
4564	eoDqFKf.exe
2496	WxBhXpo.exe
2548	UHbSxhs.exe
1480	xfrbuqn.exe
4280	hRtqDzY.exe
2280	IIEALph.exe
2864	ILwITln.exe
4004	WNWBkqo.exe
1192	GsxIrvt.exe
3748	jCgssJP.exe
488	nkGMpMJ.exe
1876	IZOSneH.exe
4064	wCVrERv.exe
4252	rWiReYW.exe
540	thWrKJt.exe
3808	sSjQLyX.exe
1672	cYxNHsG.exe
1032	PmloCuM.exe
2476	vZWlzyj.exe
1828	VQIZfvI.exe
1648	kCxasCF.exe
1028	noPuKIC.exe
4088	EZSsDFG.exe
1528	pGcidQo.exe
3508	JbKUHpl.exe
1176	duyKQFi.exe
972	qgOBUOn.exe
4744	UvrVoBh.exe
5056	iejPPmU.exe
1616	YkiEput.exe
1260	gpxUIwd.exe
400	RuJYsVt.exe
1984	ojZGPoG.exe
4604	sOACqJi.exe
3708	eRhhVRF.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2852-0-0x00007FF789D40000-0x00007FF78A132000-memory.dmp	upx
behavioral2/files/0x000d0000000233e4-5.dat	upx
behavioral2/files/0x0007000000023495-23.dat	upx
behavioral2/files/0x0007000000023493-31.dat	upx
behavioral2/files/0x0008000000023492-28.dat	upx
behavioral2/files/0x0007000000023496-27.dat	upx
behavioral2/files/0x0007000000023497-26.dat	upx
behavioral2/files/0x0007000000023494-32.dat	upx
behavioral2/memory/3936-17-0x00007FF6D7340000-0x00007FF6D7732000-memory.dmp	upx
behavioral2/files/0x000700000002349d-81.dat	upx
behavioral2/files/0x00070000000234b7-205.dat	upx
behavioral2/memory/4880-240-0x00007FF7F02A0000-0x00007FF7F0692000-memory.dmp	upx
behavioral2/memory/1440-257-0x00007FF736F80000-0x00007FF737372000-memory.dmp	upx
behavioral2/memory/4352-263-0x00007FF6F2BC0000-0x00007FF6F2FB2000-memory.dmp	upx
behavioral2/memory/2984-269-0x00007FF70FE20000-0x00007FF710212000-memory.dmp	upx
behavioral2/memory/4568-271-0x00007FF6B6DB0000-0x00007FF6B71A2000-memory.dmp	upx
behavioral2/memory/940-270-0x00007FF65FBA0000-0x00007FF65FF92000-memory.dmp	upx
behavioral2/memory/1600-268-0x00007FF76AD10000-0x00007FF76B102000-memory.dmp	upx
behavioral2/memory/460-267-0x00007FF70F9D0000-0x00007FF70FDC2000-memory.dmp	upx
behavioral2/memory/2372-266-0x00007FF68A830000-0x00007FF68AC22000-memory.dmp	upx
behavioral2/memory/3324-265-0x00007FF774030000-0x00007FF774422000-memory.dmp	upx
behavioral2/memory/2740-264-0x00007FF726AD0000-0x00007FF726EC2000-memory.dmp	upx
behavioral2/memory/2848-262-0x00007FF7DFD90000-0x00007FF7E0182000-memory.dmp	upx
behavioral2/memory/4892-261-0x00007FF613DB0000-0x00007FF6141A2000-memory.dmp	upx
behavioral2/memory/1924-260-0x00007FF632FA0000-0x00007FF633392000-memory.dmp	upx
behavioral2/memory/4852-259-0x00007FF7D95E0000-0x00007FF7D99D2000-memory.dmp	upx
behavioral2/memory/3628-258-0x00007FF7FE460000-0x00007FF7FE852000-memory.dmp	upx
behavioral2/memory/3168-256-0x00007FF70A7E0000-0x00007FF70ABD2000-memory.dmp	upx
behavioral2/memory/2028-255-0x00007FF7B2590000-0x00007FF7B2982000-memory.dmp	upx
behavioral2/memory/980-254-0x00007FF7E4A00000-0x00007FF7E4DF2000-memory.dmp	upx
behavioral2/memory/2024-252-0x00007FF602AD0000-0x00007FF602EC2000-memory.dmp	upx
behavioral2/memory/3276-251-0x00007FF6F4120000-0x00007FF6F4512000-memory.dmp	upx
behavioral2/files/0x00070000000234b5-198.dat	upx
behavioral2/files/0x00070000000234b4-197.dat	upx
behavioral2/files/0x00070000000234aa-193.dat	upx
behavioral2/files/0x00070000000234a4-191.dat	upx
behavioral2/files/0x00070000000234b3-190.dat	upx
behavioral2/files/0x00070000000234b2-189.dat	upx
behavioral2/files/0x00070000000234b1-183.dat	upx
behavioral2/files/0x00070000000234b0-180.dat	upx
behavioral2/files/0x00070000000234af-179.dat	upx
behavioral2/files/0x00070000000234a0-178.dat	upx
behavioral2/files/0x00070000000234a6-170.dat	upx
behavioral2/files/0x00070000000234ae-169.dat	upx
behavioral2/memory/3572-202-0x00007FF760AD0000-0x00007FF760EC2000-memory.dmp	upx
behavioral2/files/0x00070000000234b6-199.dat	upx
behavioral2/files/0x00070000000234a5-141.dat	upx
behavioral2/files/0x00070000000234ab-140.dat	upx
behavioral2/memory/4952-136-0x00007FF7811F0000-0x00007FF7815E2000-memory.dmp	upx
behavioral2/files/0x00070000000234a9-132.dat	upx
behavioral2/files/0x000700000002349e-131.dat	upx
behavioral2/files/0x00070000000234a2-126.dat	upx
behavioral2/files/0x00070000000234a1-123.dat	upx
behavioral2/files/0x00070000000234a8-122.dat	upx
behavioral2/files/0x00070000000234ad-168.dat	upx
behavioral2/files/0x00070000000234ac-165.dat	upx
behavioral2/files/0x00070000000234a3-101.dat	upx
behavioral2/files/0x000700000002349f-98.dat	upx
behavioral2/files/0x00070000000234a7-119.dat	upx
behavioral2/files/0x0007000000023499-86.dat	upx
behavioral2/files/0x000700000002349c-111.dat	upx
behavioral2/files/0x000700000002349b-108.dat	upx
behavioral2/files/0x0007000000023498-75.dat	upx
behavioral2/files/0x000700000002349a-50.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mNVqDpo.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\QXJXfIu.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\VvRdzlM.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\lIPHrXI.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\GZgUDGP.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\ZADplGo.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\OWakPIS.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\QjHclvR.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\QsUZAXd.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\PmloCuM.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\xkgtHep.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\gpxUIwd.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\IeAjlxa.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\TxeaEAU.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\fntqFGM.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\HpvuOMu.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\jTRubdQ.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\TjsZWkl.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\pqdkqlz.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\biAFjjQ.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\heUmLdZ.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\JpLDOiQ.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\zJCsBgH.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\pjfFhml.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\lzqUyat.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\ztFrRPS.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\VidiyIN.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\QeGYvty.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\LtCJyfd.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\PTKnIDk.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\gFssUYP.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\COeSyfq.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\yoHqUXJ.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\QpffqSd.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\VyqVHqC.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\GeLeDzG.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\QaQgNli.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\WuHlQFW.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\zspfMtD.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\QKGOnOH.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\PwUAdjx.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\FIAqjtV.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\OsGcbBE.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\BQScnhh.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\yjfukKl.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\tXUbaXH.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\jdQjfPS.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\LMjbgZP.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\VclSFaR.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\nrnAmOL.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\UwIKlDt.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\GftyzKL.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\VSPDUmo.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\kbmkylB.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\FyIVQcY.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\DSSgBuj.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\bSxcwZo.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\IHdCSOd.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\UEEfJlH.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\nVWNdcz.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\wxCrEcJ.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\XadGoZC.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\fPrNGeX.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
File created	C:\Windows\System\PMorahV.exe	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2284	powershell.exe
2284	powershell.exe
2284	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeLockMemoryPrivilege	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2284	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	83
PID 2852 wrote to memory of 2284	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	83
PID 2852 wrote to memory of 3936	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	84
PID 2852 wrote to memory of 3936	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	84
PID 2852 wrote to memory of 1600	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	85
PID 2852 wrote to memory of 1600	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	85
PID 2852 wrote to memory of 2984	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	86
PID 2852 wrote to memory of 2984	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	86
PID 2852 wrote to memory of 4952	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	87
PID 2852 wrote to memory of 4952	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	87
PID 2852 wrote to memory of 3572	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	88
PID 2852 wrote to memory of 3572	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	88
PID 2852 wrote to memory of 3276	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	89
PID 2852 wrote to memory of 3276	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	89
PID 2852 wrote to memory of 4880	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	90
PID 2852 wrote to memory of 4880	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	90
PID 2852 wrote to memory of 2024	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	91
PID 2852 wrote to memory of 2024	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	91
PID 2852 wrote to memory of 980	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	92
PID 2852 wrote to memory of 980	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	92
PID 2852 wrote to memory of 2028	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	93
PID 2852 wrote to memory of 2028	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	93
PID 2852 wrote to memory of 940	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	94
PID 2852 wrote to memory of 940	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	94
PID 2852 wrote to memory of 3168	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	95
PID 2852 wrote to memory of 3168	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	95
PID 2852 wrote to memory of 1440	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	96
PID 2852 wrote to memory of 1440	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	96
PID 2852 wrote to memory of 3628	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	97
PID 2852 wrote to memory of 3628	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	97
PID 2852 wrote to memory of 4852	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	98
PID 2852 wrote to memory of 4852	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	98
PID 2852 wrote to memory of 1924	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	99
PID 2852 wrote to memory of 1924	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	99
PID 2852 wrote to memory of 4892	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	100
PID 2852 wrote to memory of 4892	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	100
PID 2852 wrote to memory of 2848	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	101
PID 2852 wrote to memory of 2848	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	101
PID 2852 wrote to memory of 4568	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	102
PID 2852 wrote to memory of 4568	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	102
PID 2852 wrote to memory of 4352	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	103
PID 2852 wrote to memory of 4352	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	103
PID 2852 wrote to memory of 2740	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	104
PID 2852 wrote to memory of 2740	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	104
PID 2852 wrote to memory of 3324	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	105
PID 2852 wrote to memory of 3324	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	105
PID 2852 wrote to memory of 2372	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	106
PID 2852 wrote to memory of 2372	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	106
PID 2852 wrote to memory of 460	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	107
PID 2852 wrote to memory of 460	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	107
PID 2852 wrote to memory of 1380	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	108
PID 2852 wrote to memory of 1380	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	108
PID 2852 wrote to memory of 1632	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	109
PID 2852 wrote to memory of 1632	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	109
PID 2852 wrote to memory of 3884	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	110
PID 2852 wrote to memory of 3884	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	110
PID 2852 wrote to memory of 3944	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	111
PID 2852 wrote to memory of 3944	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	111
PID 2852 wrote to memory of 4124	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	112
PID 2852 wrote to memory of 4124	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	112
PID 2852 wrote to memory of 4564	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	113
PID 2852 wrote to memory of 4564	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	113
PID 2852 wrote to memory of 2496	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	114
PID 2852 wrote to memory of 2496	2852	c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe	114

C:\Users\Admin\AppData\Local\Temp\c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe
"C:\Users\Admin\AppData\Local\Temp\c4b99ec0e365bdc21902b3808fae1355427d15b946a803ba5b4805681578c8af.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Windows\System\chiNycZ.exe
  C:\Windows\System\chiNycZ.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\XSrZalB.exe
  C:\Windows\System\XSrZalB.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\YbASUwo.exe
  C:\Windows\System\YbASUwo.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\XGhEFDn.exe
  C:\Windows\System\XGhEFDn.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\jPrOHGM.exe
  C:\Windows\System\jPrOHGM.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\LAudLmY.exe
  C:\Windows\System\LAudLmY.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\iHraqTh.exe
  C:\Windows\System\iHraqTh.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\vFodtEU.exe
  C:\Windows\System\vFodtEU.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\HkpPdcY.exe
  C:\Windows\System\HkpPdcY.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\jUWVjpm.exe
  C:\Windows\System\jUWVjpm.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\ydpAdUy.exe
  C:\Windows\System\ydpAdUy.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\YEZcCgs.exe
  C:\Windows\System\YEZcCgs.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\OQoNZQC.exe
  C:\Windows\System\OQoNZQC.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\tfSlNNd.exe
  C:\Windows\System\tfSlNNd.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\sFFLffE.exe
  C:\Windows\System\sFFLffE.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\pFeNNfS.exe
  C:\Windows\System\pFeNNfS.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\xPxzUFk.exe
  C:\Windows\System\xPxzUFk.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\LHZzeTd.exe
  C:\Windows\System\LHZzeTd.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\vqcwNRb.exe
  C:\Windows\System\vqcwNRb.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\aegzMGz.exe
  C:\Windows\System\aegzMGz.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\HKfoHtU.exe
  C:\Windows\System\HKfoHtU.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\nflCYOb.exe
  C:\Windows\System\nflCYOb.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\sUCKiAS.exe
  C:\Windows\System\sUCKiAS.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\nwWYrll.exe
  C:\Windows\System\nwWYrll.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\eBwOLWu.exe
  C:\Windows\System\eBwOLWu.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\ziMqkxz.exe
  C:\Windows\System\ziMqkxz.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\UvwYwdd.exe
  C:\Windows\System\UvwYwdd.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\fPrNGeX.exe
  C:\Windows\System\fPrNGeX.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\TkxLZii.exe
  C:\Windows\System\TkxLZii.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\eoDqFKf.exe
  C:\Windows\System\eoDqFKf.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\WxBhXpo.exe
  C:\Windows\System\WxBhXpo.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\UHbSxhs.exe
  C:\Windows\System\UHbSxhs.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\xfrbuqn.exe
  C:\Windows\System\xfrbuqn.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\hRtqDzY.exe
  C:\Windows\System\hRtqDzY.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\IIEALph.exe
  C:\Windows\System\IIEALph.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\ILwITln.exe
  C:\Windows\System\ILwITln.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\WNWBkqo.exe
  C:\Windows\System\WNWBkqo.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\GsxIrvt.exe
  C:\Windows\System\GsxIrvt.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\jCgssJP.exe
  C:\Windows\System\jCgssJP.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\nkGMpMJ.exe
  C:\Windows\System\nkGMpMJ.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\IZOSneH.exe
  C:\Windows\System\IZOSneH.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\wCVrERv.exe
  C:\Windows\System\wCVrERv.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\rWiReYW.exe
  C:\Windows\System\rWiReYW.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\thWrKJt.exe
  C:\Windows\System\thWrKJt.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\sSjQLyX.exe
  C:\Windows\System\sSjQLyX.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\cYxNHsG.exe
  C:\Windows\System\cYxNHsG.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\PmloCuM.exe
  C:\Windows\System\PmloCuM.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\vZWlzyj.exe
  C:\Windows\System\vZWlzyj.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\VQIZfvI.exe
  C:\Windows\System\VQIZfvI.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\kCxasCF.exe
  C:\Windows\System\kCxasCF.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\noPuKIC.exe
  C:\Windows\System\noPuKIC.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\EZSsDFG.exe
  C:\Windows\System\EZSsDFG.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\pGcidQo.exe
  C:\Windows\System\pGcidQo.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\JbKUHpl.exe
  C:\Windows\System\JbKUHpl.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\duyKQFi.exe
  C:\Windows\System\duyKQFi.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\qgOBUOn.exe
  C:\Windows\System\qgOBUOn.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\UvrVoBh.exe
  C:\Windows\System\UvrVoBh.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\iejPPmU.exe
  C:\Windows\System\iejPPmU.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\YkiEput.exe
  C:\Windows\System\YkiEput.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\gpxUIwd.exe
  C:\Windows\System\gpxUIwd.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\RuJYsVt.exe
  C:\Windows\System\RuJYsVt.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\ojZGPoG.exe
  C:\Windows\System\ojZGPoG.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\sOACqJi.exe
  C:\Windows\System\sOACqJi.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\eRhhVRF.exe
  C:\Windows\System\eRhhVRF.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\ZalSuDa.exe
  C:\Windows\System\ZalSuDa.exe
  2⤵
  PID:4540
- C:\Windows\System\sejRLED.exe
  C:\Windows\System\sejRLED.exe
  2⤵
  PID:4536
- C:\Windows\System\cfEPlmh.exe
  C:\Windows\System\cfEPlmh.exe
  2⤵
  PID:2884
- C:\Windows\System\gjJFVlc.exe
  C:\Windows\System\gjJFVlc.exe
  2⤵
  PID:3232
- C:\Windows\System\QMMsoky.exe
  C:\Windows\System\QMMsoky.exe
  2⤵
  PID:2976
- C:\Windows\System\PFeUXUy.exe
  C:\Windows\System\PFeUXUy.exe
  2⤵
  PID:2072
- C:\Windows\System\aKunVYA.exe
  C:\Windows\System\aKunVYA.exe
  2⤵
  PID:3984
- C:\Windows\System\FUXnZoT.exe
  C:\Windows\System\FUXnZoT.exe
  2⤵
  PID:1384
- C:\Windows\System\BxXfzLY.exe
  C:\Windows\System\BxXfzLY.exe
  2⤵
  PID:4784
- C:\Windows\System\ykdsMxp.exe
  C:\Windows\System\ykdsMxp.exe
  2⤵
  PID:3516
- C:\Windows\System\DDjnlhM.exe
  C:\Windows\System\DDjnlhM.exe
  2⤵
  PID:2228
- C:\Windows\System\ObIVFHm.exe
  C:\Windows\System\ObIVFHm.exe
  2⤵
  PID:3688
- C:\Windows\System\LqXYZzA.exe
  C:\Windows\System\LqXYZzA.exe
  2⤵
  PID:2256
- C:\Windows\System\ZLsoeTc.exe
  C:\Windows\System\ZLsoeTc.exe
  2⤵
  PID:4480
- C:\Windows\System\jONHrSX.exe
  C:\Windows\System\jONHrSX.exe
  2⤵
  PID:4332
- C:\Windows\System\rswTiAQ.exe
  C:\Windows\System\rswTiAQ.exe
  2⤵
  PID:4392
- C:\Windows\System\JKDClPO.exe
  C:\Windows\System\JKDClPO.exe
  2⤵
  PID:1312
- C:\Windows\System\JywBXGP.exe
  C:\Windows\System\JywBXGP.exe
  2⤵
  PID:3604
- C:\Windows\System\eXMWkVL.exe
  C:\Windows\System\eXMWkVL.exe
  2⤵
  PID:4632
- C:\Windows\System\pQdcoxv.exe
  C:\Windows\System\pQdcoxv.exe
  2⤵
  PID:4036
- C:\Windows\System\cZmorDJ.exe
  C:\Windows\System\cZmorDJ.exe
  2⤵
  PID:536
- C:\Windows\System\iPImlQK.exe
  C:\Windows\System\iPImlQK.exe
  2⤵
  PID:3844
- C:\Windows\System\oTGRYNs.exe
  C:\Windows\System\oTGRYNs.exe
  2⤵
  PID:1376
- C:\Windows\System\GrmZjOd.exe
  C:\Windows\System\GrmZjOd.exe
  2⤵
  PID:1708
- C:\Windows\System\MNTJFmw.exe
  C:\Windows\System\MNTJFmw.exe
  2⤵
  PID:1904
- C:\Windows\System\ZnqRdJw.exe
  C:\Windows\System\ZnqRdJw.exe
  2⤵
  PID:3156
- C:\Windows\System\NdtXCbR.exe
  C:\Windows\System\NdtXCbR.exe
  2⤵
  PID:2916
- C:\Windows\System\pWyIzVo.exe
  C:\Windows\System\pWyIzVo.exe
  2⤵
  PID:1328
- C:\Windows\System\mRNwMZd.exe
  C:\Windows\System\mRNwMZd.exe
  2⤵
  PID:2360
- C:\Windows\System\KgphlEp.exe
  C:\Windows\System\KgphlEp.exe
  2⤵
  PID:3528
- C:\Windows\System\AVpkJgx.exe
  C:\Windows\System\AVpkJgx.exe
  2⤵
  PID:3464
- C:\Windows\System\TcOVKYt.exe
  C:\Windows\System\TcOVKYt.exe
  2⤵
  PID:2184
- C:\Windows\System\aHCTrqd.exe
  C:\Windows\System\aHCTrqd.exe
  2⤵
  PID:5136
- C:\Windows\System\nxPpqkh.exe
  C:\Windows\System\nxPpqkh.exe
  2⤵
  PID:5152
- C:\Windows\System\IheszuV.exe
  C:\Windows\System\IheszuV.exe
  2⤵
  PID:5172
- C:\Windows\System\CcVXMfV.exe
  C:\Windows\System\CcVXMfV.exe
  2⤵
  PID:5192
- C:\Windows\System\hlXkisn.exe
  C:\Windows\System\hlXkisn.exe
  2⤵
  PID:5208
- C:\Windows\System\CBFdQqg.exe
  C:\Windows\System\CBFdQqg.exe
  2⤵
  PID:5228
- C:\Windows\System\NruNGUR.exe
  C:\Windows\System\NruNGUR.exe
  2⤵
  PID:5260
- C:\Windows\System\esuGHqq.exe
  C:\Windows\System\esuGHqq.exe
  2⤵
  PID:5276
- C:\Windows\System\MLTuRIm.exe
  C:\Windows\System\MLTuRIm.exe
  2⤵
  PID:5296
- C:\Windows\System\ipskIpP.exe
  C:\Windows\System\ipskIpP.exe
  2⤵
  PID:5316
- C:\Windows\System\TykJTsJ.exe
  C:\Windows\System\TykJTsJ.exe
  2⤵
  PID:5332
- C:\Windows\System\dOYfzjH.exe
  C:\Windows\System\dOYfzjH.exe
  2⤵
  PID:5348
- C:\Windows\System\XsDKhDU.exe
  C:\Windows\System\XsDKhDU.exe
  2⤵
  PID:5368
- C:\Windows\System\aOSBblY.exe
  C:\Windows\System\aOSBblY.exe
  2⤵
  PID:5392
- C:\Windows\System\eHaKrGp.exe
  C:\Windows\System\eHaKrGp.exe
  2⤵
  PID:5408
- C:\Windows\System\weIQBWy.exe
  C:\Windows\System\weIQBWy.exe
  2⤵
  PID:5432
- C:\Windows\System\JknXamo.exe
  C:\Windows\System\JknXamo.exe
  2⤵
  PID:5452
- C:\Windows\System\kGNkOjK.exe
  C:\Windows\System\kGNkOjK.exe
  2⤵
  PID:5480
- C:\Windows\System\vyoTsWs.exe
  C:\Windows\System\vyoTsWs.exe
  2⤵
  PID:5496
- C:\Windows\System\mOswYow.exe
  C:\Windows\System\mOswYow.exe
  2⤵
  PID:5516
- C:\Windows\System\JwFoKhC.exe
  C:\Windows\System\JwFoKhC.exe
  2⤵
  PID:5540
- C:\Windows\System\MDtnCnK.exe
  C:\Windows\System\MDtnCnK.exe
  2⤵
  PID:5556
- C:\Windows\System\PSRKFRX.exe
  C:\Windows\System\PSRKFRX.exe
  2⤵
  PID:5584
- C:\Windows\System\zULeysB.exe
  C:\Windows\System\zULeysB.exe
  2⤵
  PID:5604
- C:\Windows\System\gFssUYP.exe
  C:\Windows\System\gFssUYP.exe
  2⤵
  PID:5624
- C:\Windows\System\HNwktXB.exe
  C:\Windows\System\HNwktXB.exe
  2⤵
  PID:5644
- C:\Windows\System\rxvobnF.exe
  C:\Windows\System\rxvobnF.exe
  2⤵
  PID:5668
- C:\Windows\System\RiPjkKa.exe
  C:\Windows\System\RiPjkKa.exe
  2⤵
  PID:5684
- C:\Windows\System\FUPhKuy.exe
  C:\Windows\System\FUPhKuy.exe
  2⤵
  PID:5704
- C:\Windows\System\aqGQKxk.exe
  C:\Windows\System\aqGQKxk.exe
  2⤵
  PID:5724
- C:\Windows\System\GmxPocR.exe
  C:\Windows\System\GmxPocR.exe
  2⤵
  PID:5748
- C:\Windows\System\kVsOVEs.exe
  C:\Windows\System\kVsOVEs.exe
  2⤵
  PID:5768
- C:\Windows\System\eOtAQzG.exe
  C:\Windows\System\eOtAQzG.exe
  2⤵
  PID:5792
- C:\Windows\System\jHnDkzm.exe
  C:\Windows\System\jHnDkzm.exe
  2⤵
  PID:5820
- C:\Windows\System\BtIvrwE.exe
  C:\Windows\System\BtIvrwE.exe
  2⤵
  PID:5836
- C:\Windows\System\WULHXXr.exe
  C:\Windows\System\WULHXXr.exe
  2⤵
  PID:5864
- C:\Windows\System\qzpxSqN.exe
  C:\Windows\System\qzpxSqN.exe
  2⤵
  PID:5880
- C:\Windows\System\XCrvxvC.exe
  C:\Windows\System\XCrvxvC.exe
  2⤵
  PID:5900
- C:\Windows\System\iBvMzmC.exe
  C:\Windows\System\iBvMzmC.exe
  2⤵
  PID:5924
- C:\Windows\System\SVIgysX.exe
  C:\Windows\System\SVIgysX.exe
  2⤵
  PID:5952
- C:\Windows\System\vdnXkUe.exe
  C:\Windows\System\vdnXkUe.exe
  2⤵
  PID:5972
- C:\Windows\System\TdEzQda.exe
  C:\Windows\System\TdEzQda.exe
  2⤵
  PID:5988
- C:\Windows\System\LjJYyFk.exe
  C:\Windows\System\LjJYyFk.exe
  2⤵
  PID:6012
- C:\Windows\System\ZqAaNUA.exe
  C:\Windows\System\ZqAaNUA.exe
  2⤵
  PID:6036
- C:\Windows\System\fFAaJCs.exe
  C:\Windows\System\fFAaJCs.exe
  2⤵
  PID:6052
- C:\Windows\System\qHTMWuS.exe
  C:\Windows\System\qHTMWuS.exe
  2⤵
  PID:6076
- C:\Windows\System\mPzwxui.exe
  C:\Windows\System\mPzwxui.exe
  2⤵
  PID:6096
- C:\Windows\System\vsCDEcY.exe
  C:\Windows\System\vsCDEcY.exe
  2⤵
  PID:6112
- C:\Windows\System\xRzWhKE.exe
  C:\Windows\System\xRzWhKE.exe
  2⤵
  PID:6136
- C:\Windows\System\ZnlSXlO.exe
  C:\Windows\System\ZnlSXlO.exe
  2⤵
  PID:752
- C:\Windows\System\zSsrUhX.exe
  C:\Windows\System\zSsrUhX.exe
  2⤵
  PID:692
- C:\Windows\System\sJcquVe.exe
  C:\Windows\System\sJcquVe.exe
  2⤵
  PID:3160
- C:\Windows\System\PKXygfL.exe
  C:\Windows\System\PKXygfL.exe
  2⤵
  PID:4328
- C:\Windows\System\uDQMdrA.exe
  C:\Windows\System\uDQMdrA.exe
  2⤵
  PID:1500
- C:\Windows\System\INPdYwV.exe
  C:\Windows\System\INPdYwV.exe
  2⤵
  PID:1532
- C:\Windows\System\kLCogxR.exe
  C:\Windows\System\kLCogxR.exe
  2⤵
  PID:2928
- C:\Windows\System\mCPwkjB.exe
  C:\Windows\System\mCPwkjB.exe
  2⤵
  PID:2264
- C:\Windows\System\AVrrPSK.exe
  C:\Windows\System\AVrrPSK.exe
  2⤵
  PID:3940
- C:\Windows\System\zZWkgUm.exe
  C:\Windows\System\zZWkgUm.exe
  2⤵
  PID:688
- C:\Windows\System\PAjFquR.exe
  C:\Windows\System\PAjFquR.exe
  2⤵
  PID:4216
- C:\Windows\System\HEkhoQI.exe
  C:\Windows\System\HEkhoQI.exe
  2⤵
  PID:5236
- C:\Windows\System\rsYIjgm.exe
  C:\Windows\System\rsYIjgm.exe
  2⤵
  PID:5424
- C:\Windows\System\XhDPMAO.exe
  C:\Windows\System\XhDPMAO.exe
  2⤵
  PID:5508
- C:\Windows\System\sXJDXLU.exe
  C:\Windows\System\sXJDXLU.exe
  2⤵
  PID:5532
- C:\Windows\System\vjHzqbj.exe
  C:\Windows\System\vjHzqbj.exe
  2⤵
  PID:3460
- C:\Windows\System\Xzcjddu.exe
  C:\Windows\System\Xzcjddu.exe
  2⤵
  PID:3588
- C:\Windows\System\vznvGVi.exe
  C:\Windows\System\vznvGVi.exe
  2⤵
  PID:4648
- C:\Windows\System\LlfrDOW.exe
  C:\Windows\System\LlfrDOW.exe
  2⤵
  PID:4572
- C:\Windows\System\nyvfDWS.exe
  C:\Windows\System\nyvfDWS.exe
  2⤵
  PID:5572
- C:\Windows\System\GeLeDzG.exe
  C:\Windows\System\GeLeDzG.exe
  2⤵
  PID:5328
- C:\Windows\System\fDdCftL.exe
  C:\Windows\System\fDdCftL.exe
  2⤵
  PID:5376
- C:\Windows\System\wmJmaLh.exe
  C:\Windows\System\wmJmaLh.exe
  2⤵
  PID:5168
- C:\Windows\System\ZyRKkbw.exe
  C:\Windows\System\ZyRKkbw.exe
  2⤵
  PID:5404
- C:\Windows\System\KZWcpRd.exe
  C:\Windows\System\KZWcpRd.exe
  2⤵
  PID:5700
- C:\Windows\System\yVVMIAe.exe
  C:\Windows\System\yVVMIAe.exe
  2⤵
  PID:5832
- C:\Windows\System\RCqlSuk.exe
  C:\Windows\System\RCqlSuk.exe
  2⤵
  PID:5876
- C:\Windows\System\IhKXfou.exe
  C:\Windows\System\IhKXfou.exe
  2⤵
  PID:6020
- C:\Windows\System\QUYBCXu.exe
  C:\Windows\System\QUYBCXu.exe
  2⤵
  PID:6072
- C:\Windows\System\qvFRyTe.exe
  C:\Windows\System\qvFRyTe.exe
  2⤵
  PID:5248
- C:\Windows\System\zCSuTRO.exe
  C:\Windows\System\zCSuTRO.exe
  2⤵
  PID:3800
- C:\Windows\System\hGXlDzP.exe
  C:\Windows\System\hGXlDzP.exe
  2⤵
  PID:6168
- C:\Windows\System\VMMMZkb.exe
  C:\Windows\System\VMMMZkb.exe
  2⤵
  PID:6188
- C:\Windows\System\NKJqtYg.exe
  C:\Windows\System\NKJqtYg.exe
  2⤵
  PID:6208
- C:\Windows\System\BQzMXtA.exe
  C:\Windows\System\BQzMXtA.exe
  2⤵
  PID:6236
- C:\Windows\System\jwyTeaZ.exe
  C:\Windows\System\jwyTeaZ.exe
  2⤵
  PID:6256
- C:\Windows\System\rDCHCjJ.exe
  C:\Windows\System\rDCHCjJ.exe
  2⤵
  PID:6288
- C:\Windows\System\JDcnMyI.exe
  C:\Windows\System\JDcnMyI.exe
  2⤵
  PID:6312
- C:\Windows\System\ahYhdBw.exe
  C:\Windows\System\ahYhdBw.exe
  2⤵
  PID:6328
- C:\Windows\System\cjvsfnc.exe
  C:\Windows\System\cjvsfnc.exe
  2⤵
  PID:6352
- C:\Windows\System\yKRnvvk.exe
  C:\Windows\System\yKRnvvk.exe
  2⤵
  PID:6376
- C:\Windows\System\AMnSFIv.exe
  C:\Windows\System\AMnSFIv.exe
  2⤵
  PID:6392
- C:\Windows\System\VKScyux.exe
  C:\Windows\System\VKScyux.exe
  2⤵
  PID:6420
- C:\Windows\System\PYEowPw.exe
  C:\Windows\System\PYEowPw.exe
  2⤵
  PID:6444
- C:\Windows\System\xXscPfk.exe
  C:\Windows\System\xXscPfk.exe
  2⤵
  PID:6460
- C:\Windows\System\xajcVhH.exe
  C:\Windows\System\xajcVhH.exe
  2⤵
  PID:6488
- C:\Windows\System\bDqqeTf.exe
  C:\Windows\System\bDqqeTf.exe
  2⤵
  PID:6504
- C:\Windows\System\yOXvoFJ.exe
  C:\Windows\System\yOXvoFJ.exe
  2⤵
  PID:6532
- C:\Windows\System\IqyIJNK.exe
  C:\Windows\System\IqyIJNK.exe
  2⤵
  PID:6548
- C:\Windows\System\xgflVGg.exe
  C:\Windows\System\xgflVGg.exe
  2⤵
  PID:6568
- C:\Windows\System\XMNlQkZ.exe
  C:\Windows\System\XMNlQkZ.exe
  2⤵
  PID:6588
- C:\Windows\System\nrwBPXB.exe
  C:\Windows\System\nrwBPXB.exe
  2⤵
  PID:6620
- C:\Windows\System\PbZvNlq.exe
  C:\Windows\System\PbZvNlq.exe
  2⤵
  PID:6644
- C:\Windows\System\CXxxaKo.exe
  C:\Windows\System\CXxxaKo.exe
  2⤵
  PID:6664
- C:\Windows\System\sDZcfTY.exe
  C:\Windows\System\sDZcfTY.exe
  2⤵
  PID:6684
- C:\Windows\System\tpfvLeM.exe
  C:\Windows\System\tpfvLeM.exe
  2⤵
  PID:6712
- C:\Windows\System\HlhIRgs.exe
  C:\Windows\System\HlhIRgs.exe
  2⤵
  PID:6728
- C:\Windows\System\JwywPtJ.exe
  C:\Windows\System\JwywPtJ.exe
  2⤵
  PID:6752
- C:\Windows\System\HYeMTaM.exe
  C:\Windows\System\HYeMTaM.exe
  2⤵
  PID:6772
- C:\Windows\System\JzNuZBc.exe
  C:\Windows\System\JzNuZBc.exe
  2⤵
  PID:6800
- C:\Windows\System\afsBfjr.exe
  C:\Windows\System\afsBfjr.exe
  2⤵
  PID:6820
- C:\Windows\System\xMmOpVA.exe
  C:\Windows\System\xMmOpVA.exe
  2⤵
  PID:6840
- C:\Windows\System\xTnHWvZ.exe
  C:\Windows\System\xTnHWvZ.exe
  2⤵
  PID:6864
- C:\Windows\System\tMXXzzZ.exe
  C:\Windows\System\tMXXzzZ.exe
  2⤵
  PID:6884
- C:\Windows\System\DJyJcgy.exe
  C:\Windows\System\DJyJcgy.exe
  2⤵
  PID:6904
- C:\Windows\System\CPWhQQB.exe
  C:\Windows\System\CPWhQQB.exe
  2⤵
  PID:6932
- C:\Windows\System\yXnleix.exe
  C:\Windows\System\yXnleix.exe
  2⤵
  PID:6952
- C:\Windows\System\tpnzZoD.exe
  C:\Windows\System\tpnzZoD.exe
  2⤵
  PID:6976
- C:\Windows\System\VidiyIN.exe
  C:\Windows\System\VidiyIN.exe
  2⤵
  PID:6996
- C:\Windows\System\QvxWOMx.exe
  C:\Windows\System\QvxWOMx.exe
  2⤵
  PID:7024
- C:\Windows\System\QxIXNov.exe
  C:\Windows\System\QxIXNov.exe
  2⤵
  PID:7044
- C:\Windows\System\QaQgNli.exe
  C:\Windows\System\QaQgNli.exe
  2⤵
  PID:7072
- C:\Windows\System\GZnUxyx.exe
  C:\Windows\System\GZnUxyx.exe
  2⤵
  PID:7088
- C:\Windows\System\jCKLisg.exe
  C:\Windows\System\jCKLisg.exe
  2⤵
  PID:7104
- C:\Windows\System\uaIlPxM.exe
  C:\Windows\System\uaIlPxM.exe
  2⤵
  PID:7128
- C:\Windows\System\GRbkYHp.exe
  C:\Windows\System\GRbkYHp.exe
  2⤵
  PID:7148
- C:\Windows\System\UMJYvZy.exe
  C:\Windows\System\UMJYvZy.exe
  2⤵
  PID:5312
- C:\Windows\System\dghqGBh.exe
  C:\Windows\System\dghqGBh.exe
  2⤵
  PID:1760
- C:\Windows\System\PgWAUhk.exe
  C:\Windows\System\PgWAUhk.exe
  2⤵
  PID:5664
- C:\Windows\System\QbFMvds.exe
  C:\Windows\System\QbFMvds.exe
  2⤵
  PID:5092
- C:\Windows\System\pHxjwJh.exe
  C:\Windows\System\pHxjwJh.exe
  2⤵
  PID:5468
- C:\Windows\System\sLzRexs.exe
  C:\Windows\System\sLzRexs.exe
  2⤵
  PID:5680
- C:\Windows\System\hpCQBzm.exe
  C:\Windows\System\hpCQBzm.exe
  2⤵
  PID:5600
- C:\Windows\System\bpqsZfj.exe
  C:\Windows\System\bpqsZfj.exe
  2⤵
  PID:5552
- C:\Windows\System\DeFssJj.exe
  C:\Windows\System\DeFssJj.exe
  2⤵
  PID:5384
- C:\Windows\System\JLpMBYY.exe
  C:\Windows\System\JLpMBYY.exe
  2⤵
  PID:5760
- C:\Windows\System\fhPxIIB.exe
  C:\Windows\System\fhPxIIB.exe
  2⤵
  PID:6360
- C:\Windows\System\RXAPCcW.exe
  C:\Windows\System\RXAPCcW.exe
  2⤵
  PID:5804
- C:\Windows\System\JQnuqYv.exe
  C:\Windows\System\JQnuqYv.exe
  2⤵
  PID:4992
- C:\Windows\System\nVWNdcz.exe
  C:\Windows\System\nVWNdcz.exe
  2⤵
  PID:5896
- C:\Windows\System\SCqPQoI.exe
  C:\Windows\System\SCqPQoI.exe
  2⤵
  PID:5932
- C:\Windows\System\STRaJZR.exe
  C:\Windows\System\STRaJZR.exe
  2⤵
  PID:5968
- C:\Windows\System\rhPGWCj.exe
  C:\Windows\System\rhPGWCj.exe
  2⤵
  PID:5160
- C:\Windows\System\xkgtHep.exe
  C:\Windows\System\xkgtHep.exe
  2⤵
  PID:3408
- C:\Windows\System\BTaalpP.exe
  C:\Windows\System\BTaalpP.exe
  2⤵
  PID:7172
- C:\Windows\System\BVApiZi.exe
  C:\Windows\System\BVApiZi.exe
  2⤵
  PID:7196
- C:\Windows\System\oXLrRIS.exe
  C:\Windows\System\oXLrRIS.exe
  2⤵
  PID:7216
- C:\Windows\System\OsGcbBE.exe
  C:\Windows\System\OsGcbBE.exe
  2⤵
  PID:7240
- C:\Windows\System\sNcBkgc.exe
  C:\Windows\System\sNcBkgc.exe
  2⤵
  PID:7268
- C:\Windows\System\wVCGbKp.exe
  C:\Windows\System\wVCGbKp.exe
  2⤵
  PID:7292
- C:\Windows\System\fWEvlFE.exe
  C:\Windows\System\fWEvlFE.exe
  2⤵
  PID:7308
- C:\Windows\System\DHUcFlP.exe
  C:\Windows\System\DHUcFlP.exe
  2⤵
  PID:7340
- C:\Windows\System\XfgKwqt.exe
  C:\Windows\System\XfgKwqt.exe
  2⤵
  PID:7360
- C:\Windows\System\gRykLtY.exe
  C:\Windows\System\gRykLtY.exe
  2⤵
  PID:7388
- C:\Windows\System\DkVVJvM.exe
  C:\Windows\System\DkVVJvM.exe
  2⤵
  PID:7412
- C:\Windows\System\zcmjzRy.exe
  C:\Windows\System\zcmjzRy.exe
  2⤵
  PID:7428
- C:\Windows\System\KCuVyrw.exe
  C:\Windows\System\KCuVyrw.exe
  2⤵
  PID:7452
- C:\Windows\System\cuUKWnX.exe
  C:\Windows\System\cuUKWnX.exe
  2⤵
  PID:7472
- C:\Windows\System\bZzgzHs.exe
  C:\Windows\System\bZzgzHs.exe
  2⤵
  PID:7496
- C:\Windows\System\vVJObYs.exe
  C:\Windows\System\vVJObYs.exe
  2⤵
  PID:7520
- C:\Windows\System\NinYbts.exe
  C:\Windows\System\NinYbts.exe
  2⤵
  PID:7548
- C:\Windows\System\fVlfLUD.exe
  C:\Windows\System\fVlfLUD.exe
  2⤵
  PID:7568
- C:\Windows\System\rbQXajv.exe
  C:\Windows\System\rbQXajv.exe
  2⤵
  PID:7588
- C:\Windows\System\fxRqmzI.exe
  C:\Windows\System\fxRqmzI.exe
  2⤵
  PID:7612
- C:\Windows\System\FocAiKj.exe
  C:\Windows\System\FocAiKj.exe
  2⤵
  PID:7632
- C:\Windows\System\ulDfVQP.exe
  C:\Windows\System\ulDfVQP.exe
  2⤵
  PID:7656
- C:\Windows\System\IncLHgg.exe
  C:\Windows\System\IncLHgg.exe
  2⤵
  PID:7672
- C:\Windows\System\qtzsMrA.exe
  C:\Windows\System\qtzsMrA.exe
  2⤵
  PID:7696
- C:\Windows\System\dXtGTKb.exe
  C:\Windows\System\dXtGTKb.exe
  2⤵
  PID:7716
- C:\Windows\System\fFxxrmR.exe
  C:\Windows\System\fFxxrmR.exe
  2⤵
  PID:7736
- C:\Windows\System\wSODyDv.exe
  C:\Windows\System\wSODyDv.exe
  2⤵
  PID:7756
- C:\Windows\System\IzWOgYY.exe
  C:\Windows\System\IzWOgYY.exe
  2⤵
  PID:7784
- C:\Windows\System\aWMOMaM.exe
  C:\Windows\System\aWMOMaM.exe
  2⤵
  PID:7808
- C:\Windows\System\NCtkJXu.exe
  C:\Windows\System\NCtkJXu.exe
  2⤵
  PID:7828
- C:\Windows\System\jTRubdQ.exe
  C:\Windows\System\jTRubdQ.exe
  2⤵
  PID:7856
- C:\Windows\System\xUaMoUx.exe
  C:\Windows\System\xUaMoUx.exe
  2⤵
  PID:7880
- C:\Windows\System\mKnQYyj.exe
  C:\Windows\System\mKnQYyj.exe
  2⤵
  PID:7908
- C:\Windows\System\ZGxNjKJ.exe
  C:\Windows\System\ZGxNjKJ.exe
  2⤵
  PID:7924
- C:\Windows\System\slGYSSD.exe
  C:\Windows\System\slGYSSD.exe
  2⤵
  PID:7944
- C:\Windows\System\UJAHfzY.exe
  C:\Windows\System\UJAHfzY.exe
  2⤵
  PID:7964
- C:\Windows\System\FbkEgSm.exe
  C:\Windows\System\FbkEgSm.exe
  2⤵
  PID:7992
- C:\Windows\System\AdzzyQP.exe
  C:\Windows\System\AdzzyQP.exe
  2⤵
  PID:8008
- C:\Windows\System\sJfgmKW.exe
  C:\Windows\System\sJfgmKW.exe
  2⤵
  PID:8032
- C:\Windows\System\hVErKuY.exe
  C:\Windows\System\hVErKuY.exe
  2⤵
  PID:8052
- C:\Windows\System\yIZvZvi.exe
  C:\Windows\System\yIZvZvi.exe
  2⤵
  PID:8072
- C:\Windows\System\GZiYoue.exe
  C:\Windows\System\GZiYoue.exe
  2⤵
  PID:8100
- C:\Windows\System\iWbvnCt.exe
  C:\Windows\System\iWbvnCt.exe
  2⤵
  PID:8116
- C:\Windows\System\tqYBgJU.exe
  C:\Windows\System\tqYBgJU.exe
  2⤵
  PID:8140
- C:\Windows\System\dUHfuRH.exe
  C:\Windows\System\dUHfuRH.exe
  2⤵
  PID:8156
- C:\Windows\System\wLRJMND.exe
  C:\Windows\System\wLRJMND.exe
  2⤵
  PID:8180
- C:\Windows\System\QjHclvR.exe
  C:\Windows\System\QjHclvR.exe
  2⤵
  PID:6148
- C:\Windows\System\fTMWRYw.exe
  C:\Windows\System\fTMWRYw.exe
  2⤵
  PID:1680
- C:\Windows\System\sGjkljd.exe
  C:\Windows\System\sGjkljd.exe
  2⤵
  PID:6692
- C:\Windows\System\NyMiHxM.exe
  C:\Windows\System\NyMiHxM.exe
  2⤵
  PID:6744
- C:\Windows\System\pYIezhI.exe
  C:\Windows\System\pYIezhI.exe
  2⤵
  PID:3204
- C:\Windows\System\HRndWIc.exe
  C:\Windows\System\HRndWIc.exe
  2⤵
  PID:5220
- C:\Windows\System\XxqJgup.exe
  C:\Windows\System\XxqJgup.exe
  2⤵
  PID:3024
- C:\Windows\System\BOwrfgB.exe
  C:\Windows\System\BOwrfgB.exe
  2⤵
  PID:6836
- C:\Windows\System\fWFPXtv.exe
  C:\Windows\System\fWFPXtv.exe
  2⤵
  PID:6304
- C:\Windows\System\InjTeQc.exe
  C:\Windows\System\InjTeQc.exe
  2⤵
  PID:6988
- C:\Windows\System\hlBGHJW.exe
  C:\Windows\System\hlBGHJW.exe
  2⤵
  PID:3760
- C:\Windows\System\BBdYGLy.exe
  C:\Windows\System\BBdYGLy.exe
  2⤵
  PID:1344
- C:\Windows\System\ZfXzDSX.exe
  C:\Windows\System\ZfXzDSX.exe
  2⤵
  PID:5564
- C:\Windows\System\CeeVSLK.exe
  C:\Windows\System\CeeVSLK.exe
  2⤵
  PID:5420
- C:\Windows\System\iCvVLuI.exe
  C:\Windows\System\iCvVLuI.exe
  2⤵
  PID:5240
- C:\Windows\System\fLOErZe.exe
  C:\Windows\System\fLOErZe.exe
  2⤵
  PID:6008
- C:\Windows\System\avPElDW.exe
  C:\Windows\System\avPElDW.exe
  2⤵
  PID:6428
- C:\Windows\System\xEdyebQ.exe
  C:\Windows\System\xEdyebQ.exe
  2⤵
  PID:6580
- C:\Windows\System\ZWVBfky.exe
  C:\Windows\System\ZWVBfky.exe
  2⤵
  PID:5268
- C:\Windows\System\RTuwWQH.exe
  C:\Windows\System\RTuwWQH.exe
  2⤵
  PID:7304
- C:\Windows\System\Kggoowq.exe
  C:\Windows\System\Kggoowq.exe
  2⤵
  PID:7352
- C:\Windows\System\YrVltyC.exe
  C:\Windows\System\YrVltyC.exe
  2⤵
  PID:7376
- C:\Windows\System\vCNOboD.exe
  C:\Windows\System\vCNOboD.exe
  2⤵
  PID:7408
- C:\Windows\System\KshbgtC.exe
  C:\Windows\System\KshbgtC.exe
  2⤵
  PID:6252
- C:\Windows\System\uprciUe.exe
  C:\Windows\System\uprciUe.exe
  2⤵
  PID:8216
- C:\Windows\System\RKqxhqm.exe
  C:\Windows\System\RKqxhqm.exe
  2⤵
  PID:8236
- C:\Windows\System\ebTKSje.exe
  C:\Windows\System\ebTKSje.exe
  2⤵
  PID:8256
- C:\Windows\System\dmvslUL.exe
  C:\Windows\System\dmvslUL.exe
  2⤵
  PID:8280
- C:\Windows\System\SlMVbzA.exe
  C:\Windows\System\SlMVbzA.exe
  2⤵
  PID:8308
- C:\Windows\System\VChmZtK.exe
  C:\Windows\System\VChmZtK.exe
  2⤵
  PID:8328
- C:\Windows\System\KJLbgXf.exe
  C:\Windows\System\KJLbgXf.exe
  2⤵
  PID:8344
- C:\Windows\System\ydIXovk.exe
  C:\Windows\System\ydIXovk.exe
  2⤵
  PID:8368
- C:\Windows\System\WuHlQFW.exe
  C:\Windows\System\WuHlQFW.exe
  2⤵
  PID:8388
- C:\Windows\System\CgRIskx.exe
  C:\Windows\System\CgRIskx.exe
  2⤵
  PID:8412
- C:\Windows\System\aQTcBvF.exe
  C:\Windows\System\aQTcBvF.exe
  2⤵
  PID:8440
- C:\Windows\System\JgULrdR.exe
  C:\Windows\System\JgULrdR.exe
  2⤵
  PID:8456
- C:\Windows\System\UttFrpp.exe
  C:\Windows\System\UttFrpp.exe
  2⤵
  PID:8480
- C:\Windows\System\nkqeAQu.exe
  C:\Windows\System\nkqeAQu.exe
  2⤵
  PID:8500
- C:\Windows\System\zwRQHxo.exe
  C:\Windows\System\zwRQHxo.exe
  2⤵
  PID:8516
- C:\Windows\System\XtZEHBR.exe
  C:\Windows\System\XtZEHBR.exe
  2⤵
  PID:8540
- C:\Windows\System\kjYYosK.exe
  C:\Windows\System\kjYYosK.exe
  2⤵
  PID:8568
- C:\Windows\System\aavewST.exe
  C:\Windows\System\aavewST.exe
  2⤵
  PID:8588
- C:\Windows\System\LMjbgZP.exe
  C:\Windows\System\LMjbgZP.exe
  2⤵
  PID:8608
- C:\Windows\System\CskKqPN.exe
  C:\Windows\System\CskKqPN.exe
  2⤵
  PID:8628
- C:\Windows\System\wkWxTlP.exe
  C:\Windows\System\wkWxTlP.exe
  2⤵
  PID:8656
- C:\Windows\System\mDtABbH.exe
  C:\Windows\System\mDtABbH.exe
  2⤵
  PID:8676
- C:\Windows\System\gjbpaQn.exe
  C:\Windows\System\gjbpaQn.exe
  2⤵
  PID:8696
- C:\Windows\System\HSQelhN.exe
  C:\Windows\System\HSQelhN.exe
  2⤵
  PID:8724
- C:\Windows\System\YKkYxVj.exe
  C:\Windows\System\YKkYxVj.exe
  2⤵
  PID:8744
- C:\Windows\System\ULEaomV.exe
  C:\Windows\System\ULEaomV.exe
  2⤵
  PID:8764
- C:\Windows\System\tEmRaty.exe
  C:\Windows\System\tEmRaty.exe
  2⤵
  PID:8784
- C:\Windows\System\VYwnNfM.exe
  C:\Windows\System\VYwnNfM.exe
  2⤵
  PID:8812
- C:\Windows\System\jDlMLDq.exe
  C:\Windows\System\jDlMLDq.exe
  2⤵
  PID:8836
- C:\Windows\System\TRNLvqB.exe
  C:\Windows\System\TRNLvqB.exe
  2⤵
  PID:8860
- C:\Windows\System\kAOEILn.exe
  C:\Windows\System\kAOEILn.exe
  2⤵
  PID:8876
- C:\Windows\System\uPySXvR.exe
  C:\Windows\System\uPySXvR.exe
  2⤵
  PID:8900
- C:\Windows\System\IwPXoyW.exe
  C:\Windows\System\IwPXoyW.exe
  2⤵
  PID:8920
- C:\Windows\System\BHcupFq.exe
  C:\Windows\System\BHcupFq.exe
  2⤵
  PID:8940
- C:\Windows\System\ahKvaOW.exe
  C:\Windows\System\ahKvaOW.exe
  2⤵
  PID:8960
- C:\Windows\System\FMpRSEM.exe
  C:\Windows\System\FMpRSEM.exe
  2⤵
  PID:8980
- C:\Windows\System\phRRNhu.exe
  C:\Windows\System\phRRNhu.exe
  2⤵
  PID:9168
- C:\Windows\System\GzSqGBg.exe
  C:\Windows\System\GzSqGBg.exe
  2⤵
  PID:9192
- C:\Windows\System\DJbBjDc.exe
  C:\Windows\System\DJbBjDc.exe
  2⤵
  PID:6264
- C:\Windows\System\vnJNYXq.exe
  C:\Windows\System\vnJNYXq.exe
  2⤵
  PID:6896
- C:\Windows\System\JGJBSQP.exe
  C:\Windows\System\JGJBSQP.exe
  2⤵
  PID:7624
- C:\Windows\System\amZvHpG.exe
  C:\Windows\System\amZvHpG.exe
  2⤵
  PID:7664
- C:\Windows\System\raHeGdI.exe
  C:\Windows\System\raHeGdI.exe
  2⤵
  PID:7040
- C:\Windows\System\uNMAUfW.exe
  C:\Windows\System\uNMAUfW.exe
  2⤵
  PID:6400
- C:\Windows\System\XTHfzgp.exe
  C:\Windows\System\XTHfzgp.exe
  2⤵
  PID:7752
- C:\Windows\System\AABoiXg.exe
  C:\Windows\System\AABoiXg.exe
  2⤵
  PID:5732
- C:\Windows\System\VcHvmzb.exe
  C:\Windows\System\VcHvmzb.exe
  2⤵
  PID:8828
- C:\Windows\System\RpGZxIY.exe
  C:\Windows\System\RpGZxIY.exe
  2⤵
  PID:6268
- C:\Windows\System\MJxutKm.exe
  C:\Windows\System\MJxutKm.exe
  2⤵
  PID:436
- C:\Windows\System\ezdmRqL.exe
  C:\Windows\System\ezdmRqL.exe
  2⤵
  PID:6564
- C:\Windows\System\kwJLOuo.exe
  C:\Windows\System\kwJLOuo.exe
  2⤵
  PID:7192
- C:\Windows\System\ueSjYPa.exe
  C:\Windows\System\ueSjYPa.exe
  2⤵
  PID:7252
- C:\Windows\System\cdeCclf.exe
  C:\Windows\System\cdeCclf.exe
  2⤵
  PID:6060
- C:\Windows\System\nqEzDCC.exe
  C:\Windows\System\nqEzDCC.exe
  2⤵
  PID:9132
- C:\Windows\System\XtFZNrO.exe
  C:\Windows\System\XtFZNrO.exe
  2⤵
  PID:8360
- C:\Windows\System\yIHNJpz.exe
  C:\Windows\System\yIHNJpz.exe
  2⤵
  PID:8428
- C:\Windows\System\RrMGeSx.exe
  C:\Windows\System\RrMGeSx.exe
  2⤵
  PID:7732
- C:\Windows\System\UTzrYpN.exe
  C:\Windows\System\UTzrYpN.exe
  2⤵
  PID:7708
- C:\Windows\System\OKYzmXy.exe
  C:\Windows\System\OKYzmXy.exe
  2⤵
  PID:1668
- C:\Windows\System\ZxNNiOM.exe
  C:\Windows\System\ZxNNiOM.exe
  2⤵
  PID:8004
- C:\Windows\System\aicoHnD.exe
  C:\Windows\System\aicoHnD.exe
  2⤵
  PID:9236
- C:\Windows\System\FkfZvLB.exe
  C:\Windows\System\FkfZvLB.exe
  2⤵
  PID:9260
- C:\Windows\System\aOvQIiN.exe
  C:\Windows\System\aOvQIiN.exe
  2⤵
  PID:9280
- C:\Windows\System\zZczJRw.exe
  C:\Windows\System\zZczJRw.exe
  2⤵
  PID:9300
- C:\Windows\System\OvXOQxj.exe
  C:\Windows\System\OvXOQxj.exe
  2⤵
  PID:9324
- C:\Windows\System\QOJkGgw.exe
  C:\Windows\System\QOJkGgw.exe
  2⤵
  PID:9352
- C:\Windows\System\jVSVKsQ.exe
  C:\Windows\System\jVSVKsQ.exe
  2⤵
  PID:9376
- C:\Windows\System\pbUGSJd.exe
  C:\Windows\System\pbUGSJd.exe
  2⤵
  PID:9400
- C:\Windows\System\DuOVZmi.exe
  C:\Windows\System\DuOVZmi.exe
  2⤵
  PID:9420
- C:\Windows\System\ByWwjsL.exe
  C:\Windows\System\ByWwjsL.exe
  2⤵
  PID:9444
- C:\Windows\System\fkSNgPE.exe
  C:\Windows\System\fkSNgPE.exe
  2⤵
  PID:9476
- C:\Windows\System\DtmfujK.exe
  C:\Windows\System\DtmfujK.exe
  2⤵
  PID:9500
- C:\Windows\System\tLxCXUo.exe
  C:\Windows\System\tLxCXUo.exe
  2⤵
  PID:9524
- C:\Windows\System\sqvczBw.exe
  C:\Windows\System\sqvczBw.exe
  2⤵
  PID:9548
- C:\Windows\System\wqWESxs.exe
  C:\Windows\System\wqWESxs.exe
  2⤵
  PID:9568
- C:\Windows\System\OvZbykJ.exe
  C:\Windows\System\OvZbykJ.exe
  2⤵
  PID:9592
- C:\Windows\System\Xodqhvg.exe
  C:\Windows\System\Xodqhvg.exe
  2⤵
  PID:9608
- C:\Windows\System\RgWoOIh.exe
  C:\Windows\System\RgWoOIh.exe
  2⤵
  PID:9632
- C:\Windows\System\BHjcOSg.exe
  C:\Windows\System\BHjcOSg.exe
  2⤵
  PID:9676
- C:\Windows\System\uyOnxhl.exe
  C:\Windows\System\uyOnxhl.exe
  2⤵
  PID:9720
- C:\Windows\System\tiBCqaz.exe
  C:\Windows\System\tiBCqaz.exe
  2⤵
  PID:9736
- C:\Windows\System\DYIqmfq.exe
  C:\Windows\System\DYIqmfq.exe
  2⤵
  PID:9764
- C:\Windows\System\YIFqtbD.exe
  C:\Windows\System\YIFqtbD.exe
  2⤵
  PID:9784
- C:\Windows\System\sXYlQrg.exe
  C:\Windows\System\sXYlQrg.exe
  2⤵
  PID:9804
- C:\Windows\System\WlluAMI.exe
  C:\Windows\System\WlluAMI.exe
  2⤵
  PID:9828
- C:\Windows\System\vRXLLOv.exe
  C:\Windows\System\vRXLLOv.exe
  2⤵
  PID:9856
- C:\Windows\System\fEMFjbx.exe
  C:\Windows\System\fEMFjbx.exe
  2⤵
  PID:9896
- C:\Windows\System\rgqCtvN.exe
  C:\Windows\System\rgqCtvN.exe
  2⤵
  PID:9940
- C:\Windows\System\BAnuBvC.exe
  C:\Windows\System\BAnuBvC.exe
  2⤵
  PID:9980
- C:\Windows\System\cDqeypg.exe
  C:\Windows\System\cDqeypg.exe
  2⤵
  PID:10000
- C:\Windows\System\FfoMJMq.exe
  C:\Windows\System\FfoMJMq.exe
  2⤵
  PID:10020
- C:\Windows\System\BNjKRhS.exe
  C:\Windows\System\BNjKRhS.exe
  2⤵
  PID:10044
- C:\Windows\System\DKrIkJp.exe
  C:\Windows\System\DKrIkJp.exe
  2⤵
  PID:10068
- C:\Windows\System\lrMOzAO.exe
  C:\Windows\System\lrMOzAO.exe
  2⤵
  PID:10088
- C:\Windows\System\bEpAqxW.exe
  C:\Windows\System\bEpAqxW.exe
  2⤵
  PID:10112
- C:\Windows\System\pLjPYmI.exe
  C:\Windows\System\pLjPYmI.exe
  2⤵
  PID:10164
- C:\Windows\System\siTXoog.exe
  C:\Windows\System\siTXoog.exe
  2⤵
  PID:10180
- C:\Windows\System\pQxQpGf.exe
  C:\Windows\System\pQxQpGf.exe
  2⤵
  PID:10196
- C:\Windows\System\ZPuxggH.exe
  C:\Windows\System\ZPuxggH.exe
  2⤵
  PID:10212
- C:\Windows\System\DvhLavy.exe
  C:\Windows\System\DvhLavy.exe
  2⤵
  PID:10228
- C:\Windows\System\xNnFfgR.exe
  C:\Windows\System\xNnFfgR.exe
  2⤵
  PID:7976
- C:\Windows\System\VNfNcsa.exe
  C:\Windows\System\VNfNcsa.exe
  2⤵
  PID:8760
- C:\Windows\System\OqcoOTp.exe
  C:\Windows\System\OqcoOTp.exe
  2⤵
  PID:8188
- C:\Windows\System\JsFgxgG.exe
  C:\Windows\System\JsFgxgG.exe
  2⤵
  PID:8844
- C:\Windows\System\SAZvAeh.exe
  C:\Windows\System\SAZvAeh.exe
  2⤵
  PID:8912
- C:\Windows\System\FcrNzgT.exe
  C:\Windows\System\FcrNzgT.exe
  2⤵
  PID:1020
- C:\Windows\System\EwyvsOD.exe
  C:\Windows\System\EwyvsOD.exe
  2⤵
  PID:6436
- C:\Windows\System\IHxvkHZ.exe
  C:\Windows\System\IHxvkHZ.exe
  2⤵
  PID:6604
- C:\Windows\System\LYRLeUn.exe
  C:\Windows\System\LYRLeUn.exe
  2⤵
  PID:5288
- C:\Windows\System\bVDpyZe.exe
  C:\Windows\System\bVDpyZe.exe
  2⤵
  PID:8200
- C:\Windows\System\vzxmORV.exe
  C:\Windows\System\vzxmORV.exe
  2⤵
  PID:8492
- C:\Windows\System\vIyGfMk.exe
  C:\Windows\System\vIyGfMk.exe
  2⤵
  PID:10256
- C:\Windows\System\QpXmAZl.exe
  C:\Windows\System\QpXmAZl.exe
  2⤵
  PID:10280
- C:\Windows\System\NCtGKxd.exe
  C:\Windows\System\NCtGKxd.exe
  2⤵
  PID:10308
- C:\Windows\System\iANtOmU.exe
  C:\Windows\System\iANtOmU.exe
  2⤵
  PID:10328
- C:\Windows\System\qSVxkNE.exe
  C:\Windows\System\qSVxkNE.exe
  2⤵
  PID:10352
- C:\Windows\System\lMdYBKp.exe
  C:\Windows\System\lMdYBKp.exe
  2⤵
  PID:10376
- C:\Windows\System\yTmAUED.exe
  C:\Windows\System\yTmAUED.exe
  2⤵
  PID:10400
- C:\Windows\System\gosJBFA.exe
  C:\Windows\System\gosJBFA.exe
  2⤵
  PID:10424
- C:\Windows\System\UPmpsIN.exe
  C:\Windows\System\UPmpsIN.exe
  2⤵
  PID:10448
- C:\Windows\System\AIStZfg.exe
  C:\Windows\System\AIStZfg.exe
  2⤵
  PID:10472
- C:\Windows\System\QeGYvty.exe
  C:\Windows\System\QeGYvty.exe
  2⤵
  PID:10496
- C:\Windows\System\uQOPQBe.exe
  C:\Windows\System\uQOPQBe.exe
  2⤵
  PID:10536
- C:\Windows\System\RCeGXAo.exe
  C:\Windows\System\RCeGXAo.exe
  2⤵
  PID:10560
- C:\Windows\System\cWojbLR.exe
  C:\Windows\System\cWojbLR.exe
  2⤵
  PID:10580
- C:\Windows\System\ruRrpPd.exe
  C:\Windows\System\ruRrpPd.exe
  2⤵
  PID:10600
- C:\Windows\System\JijfvRi.exe
  C:\Windows\System\JijfvRi.exe
  2⤵
  PID:10624
- C:\Windows\System\VclyagD.exe
  C:\Windows\System\VclyagD.exe
  2⤵
  PID:10648
- C:\Windows\System\uFkMNrs.exe
  C:\Windows\System\uFkMNrs.exe
  2⤵
  PID:10672
- C:\Windows\System\GZRjOMR.exe
  C:\Windows\System\GZRjOMR.exe
  2⤵
  PID:10708
- C:\Windows\System\KUnbtDc.exe
  C:\Windows\System\KUnbtDc.exe
  2⤵
  PID:10732
- C:\Windows\System\WkzsdXb.exe
  C:\Windows\System\WkzsdXb.exe
  2⤵
  PID:10756
- C:\Windows\System\KKTObNB.exe
  C:\Windows\System\KKTObNB.exe
  2⤵
  PID:10776
- C:\Windows\System\SnjFiQd.exe
  C:\Windows\System\SnjFiQd.exe
  2⤵
  PID:10796
- C:\Windows\System\QLVQeeM.exe
  C:\Windows\System\QLVQeeM.exe
  2⤵
  PID:10820
- C:\Windows\System\ZADplGo.exe
  C:\Windows\System\ZADplGo.exe
  2⤵
  PID:10848
- C:\Windows\System\wHDoFNp.exe
  C:\Windows\System\wHDoFNp.exe
  2⤵
  PID:10872
- C:\Windows\System\zspfMtD.exe
  C:\Windows\System\zspfMtD.exe
  2⤵
  PID:10900
- C:\Windows\System\sThGzCQ.exe
  C:\Windows\System\sThGzCQ.exe
  2⤵
  PID:10920
- C:\Windows\System\XhbZGgt.exe
  C:\Windows\System\XhbZGgt.exe
  2⤵
  PID:10944
- C:\Windows\System\YOdWqUd.exe
  C:\Windows\System\YOdWqUd.exe
  2⤵
  PID:10964
- C:\Windows\System\tOVhgQa.exe
  C:\Windows\System\tOVhgQa.exe
  2⤵
  PID:10984
- C:\Windows\System\bGapaRX.exe
  C:\Windows\System\bGapaRX.exe
  2⤵
  PID:11004
- C:\Windows\System\zteqHxt.exe
  C:\Windows\System\zteqHxt.exe
  2⤵
  PID:11024
- C:\Windows\System\GZgUDGP.exe
  C:\Windows\System\GZgUDGP.exe
  2⤵
  PID:11044
- C:\Windows\System\nEqKKNc.exe
  C:\Windows\System\nEqKKNc.exe
  2⤵
  PID:11072
- C:\Windows\System\voDErFl.exe
  C:\Windows\System\voDErFl.exe
  2⤵
  PID:11100
- C:\Windows\System\TJlwTTK.exe
  C:\Windows\System\TJlwTTK.exe
  2⤵
  PID:11124
- C:\Windows\System\amjFZNm.exe
  C:\Windows\System\amjFZNm.exe
  2⤵
  PID:11144
- C:\Windows\System\NNVyAQl.exe
  C:\Windows\System\NNVyAQl.exe
  2⤵
  PID:11164
- C:\Windows\System\CUmVyIW.exe
  C:\Windows\System\CUmVyIW.exe
  2⤵
  PID:11180
- C:\Windows\System\hkzhiYO.exe
  C:\Windows\System\hkzhiYO.exe
  2⤵
  PID:11196
- C:\Windows\System\OyIFHWf.exe
  C:\Windows\System\OyIFHWf.exe
  2⤵
  PID:11212
- C:\Windows\System\QKGOnOH.exe
  C:\Windows\System\QKGOnOH.exe
  2⤵
  PID:11228
- C:\Windows\System\oUlqnOH.exe
  C:\Windows\System\oUlqnOH.exe
  2⤵
  PID:11244
- C:\Windows\System\anMpXkQ.exe
  C:\Windows\System\anMpXkQ.exe
  2⤵
  PID:11260
- C:\Windows\System\iaEGqRe.exe
  C:\Windows\System\iaEGqRe.exe
  2⤵
  PID:8932
- C:\Windows\System\VSPDUmo.exe
  C:\Windows\System\VSPDUmo.exe
  2⤵
  PID:5944
- C:\Windows\System\PUlhHqF.exe
  C:\Windows\System\PUlhHqF.exe
  2⤵
  PID:8580
- C:\Windows\System\vIcjFhr.exe
  C:\Windows\System\vIcjFhr.exe
  2⤵
  PID:7864
- C:\Windows\System\QsZQGvW.exe
  C:\Windows\System\QsZQGvW.exe
  2⤵
  PID:8292
- C:\Windows\System\iATEstg.exe
  C:\Windows\System\iATEstg.exe
  2⤵
  PID:7972
- C:\Windows\System\VclSFaR.exe
  C:\Windows\System\VclSFaR.exe
  2⤵
  PID:8620
- C:\Windows\System\qRbVPUD.exe
  C:\Windows\System\qRbVPUD.exe
  2⤵
  PID:9296
- C:\Windows\System\LswkFfs.exe
  C:\Windows\System\LswkFfs.exe
  2⤵
  PID:8776
- C:\Windows\System\RFknzTV.exe
  C:\Windows\System\RFknzTV.exe
  2⤵
  PID:6472
- C:\Windows\System\ZmWfYIV.exe
  C:\Windows\System\ZmWfYIV.exe
  2⤵
  PID:9488
- C:\Windows\System\hIQRlhM.exe
  C:\Windows\System\hIQRlhM.exe
  2⤵
  PID:9628
- C:\Windows\System\HzaZJyF.exe
  C:\Windows\System\HzaZJyF.exe
  2⤵
  PID:6540
- C:\Windows\System\EShDlcf.exe
  C:\Windows\System\EShDlcf.exe
  2⤵
  PID:2500
- C:\Windows\System\gbMeNjI.exe
  C:\Windows\System\gbMeNjI.exe
  2⤵
  PID:9812
- C:\Windows\System\JhvPasi.exe
  C:\Windows\System\JhvPasi.exe
  2⤵
  PID:9888
- C:\Windows\System\COeSyfq.exe
  C:\Windows\System\COeSyfq.exe
  2⤵
  PID:6792
- C:\Windows\System\MYoZGLF.exe
  C:\Windows\System\MYoZGLF.exe
  2⤵
  PID:8300
- C:\Windows\System\mWJlEUt.exe
  C:\Windows\System\mWJlEUt.exe
  2⤵
  PID:9996
- C:\Windows\System\bWmGxIp.exe
  C:\Windows\System\bWmGxIp.exe
  2⤵
  PID:10084
- C:\Windows\System\NHObqmT.exe
  C:\Windows\System\NHObqmT.exe
  2⤵
  PID:384
- C:\Windows\System\rgliZGq.exe
  C:\Windows\System\rgliZGq.exe
  2⤵
  PID:8404
- C:\Windows\System\exDrxxs.exe
  C:\Windows\System\exDrxxs.exe
  2⤵
  PID:10156
- C:\Windows\System\zTwtDxK.exe
  C:\Windows\System\zTwtDxK.exe
  2⤵
  PID:10236
- C:\Windows\System\IQatewE.exe
  C:\Windows\System\IQatewE.exe
  2⤵
  PID:396
- C:\Windows\System\LZTgSCB.exe
  C:\Windows\System\LZTgSCB.exe
  2⤵
  PID:5964
- C:\Windows\System\tSBZjIY.exe
  C:\Windows\System\tSBZjIY.exe
  2⤵
  PID:6972
- C:\Windows\System\LjtSqjJ.exe
  C:\Windows\System\LjtSqjJ.exe
  2⤵
  PID:8684
- C:\Windows\System\PURkuBx.exe
  C:\Windows\System\PURkuBx.exe
  2⤵
  PID:4968
- C:\Windows\System\wBiyBTK.exe
  C:\Windows\System\wBiyBTK.exe
  2⤵
  PID:10292
- C:\Windows\System\QbnGnXc.exe
  C:\Windows\System\QbnGnXc.exe
  2⤵
  PID:7232
- C:\Windows\System\aTrMWxL.exe
  C:\Windows\System\aTrMWxL.exe
  2⤵
  PID:10392
- C:\Windows\System\wbXAilE.exe
  C:\Windows\System\wbXAilE.exe
  2⤵
  PID:10432
- C:\Windows\System\QiVYrby.exe
  C:\Windows\System\QiVYrby.exe
  2⤵
  PID:10464
- C:\Windows\System\EeIClKj.exe
  C:\Windows\System\EeIClKj.exe
  2⤵
  PID:10488
- C:\Windows\System\aspfwPQ.exe
  C:\Windows\System\aspfwPQ.exe
  2⤵
  PID:9276
- C:\Windows\System\uribVPH.exe
  C:\Windows\System\uribVPH.exe
  2⤵
  PID:9344
- C:\Windows\System\BzGerdB.exe
  C:\Windows\System\BzGerdB.exe
  2⤵
  PID:10572
- C:\Windows\System\oNnDUTJ.exe
  C:\Windows\System\oNnDUTJ.exe
  2⤵
  PID:9416
- C:\Windows\System\vEDeWjc.exe
  C:\Windows\System\vEDeWjc.exe
  2⤵
  PID:9508
- C:\Windows\System\oHYLFzi.exe
  C:\Windows\System\oHYLFzi.exe
  2⤵
  PID:10716
- C:\Windows\System\qSOgUPZ.exe
  C:\Windows\System\qSOgUPZ.exe
  2⤵
  PID:11288
- C:\Windows\System\hBWALag.exe
  C:\Windows\System\hBWALag.exe
  2⤵
  PID:11312
- C:\Windows\System\WoUBHNk.exe
  C:\Windows\System\WoUBHNk.exe
  2⤵
  PID:11332
- C:\Windows\System\nDvrRQB.exe
  C:\Windows\System\nDvrRQB.exe
  2⤵
  PID:11352
- C:\Windows\System\eGEsHeY.exe
  C:\Windows\System\eGEsHeY.exe
  2⤵
  PID:11376
- C:\Windows\System\rVHXFHZ.exe
  C:\Windows\System\rVHXFHZ.exe
  2⤵
  PID:11396
- C:\Windows\System\RnCGRSH.exe
  C:\Windows\System\RnCGRSH.exe
  2⤵
  PID:11416
- C:\Windows\System\kNLQocy.exe
  C:\Windows\System\kNLQocy.exe
  2⤵
  PID:11440
- C:\Windows\System\MdDwvkn.exe
  C:\Windows\System\MdDwvkn.exe
  2⤵
  PID:11460
- C:\Windows\System\OoeuxKh.exe
  C:\Windows\System\OoeuxKh.exe
  2⤵
  PID:11480
- C:\Windows\System\TBROexD.exe
  C:\Windows\System\TBROexD.exe
  2⤵
  PID:11500
- C:\Windows\System\zwnfFYL.exe
  C:\Windows\System\zwnfFYL.exe
  2⤵
  PID:11520
- C:\Windows\System\YJqvwdE.exe
  C:\Windows\System\YJqvwdE.exe
  2⤵
  PID:11544
- C:\Windows\System\AfrRQnc.exe
  C:\Windows\System\AfrRQnc.exe
  2⤵
  PID:11572
- C:\Windows\System\GvDQceo.exe
  C:\Windows\System\GvDQceo.exe
  2⤵
  PID:11592
- C:\Windows\System\UyMTLzq.exe
  C:\Windows\System\UyMTLzq.exe
  2⤵
  PID:11612
- C:\Windows\System\NyRDVeA.exe
  C:\Windows\System\NyRDVeA.exe
  2⤵
  PID:11628
- C:\Windows\System\BFhijWK.exe
  C:\Windows\System\BFhijWK.exe
  2⤵
  PID:11644
- C:\Windows\System\NlgqiNY.exe
  C:\Windows\System\NlgqiNY.exe
  2⤵
  PID:11660
- C:\Windows\System\rsahTTc.exe
  C:\Windows\System\rsahTTc.exe
  2⤵
  PID:11676
- C:\Windows\System\MQimCUM.exe
  C:\Windows\System\MQimCUM.exe
  2⤵
  PID:11692
- C:\Windows\System\BSSmWDh.exe
  C:\Windows\System\BSSmWDh.exe
  2⤵
  PID:11708
- C:\Windows\System\ubvdECQ.exe
  C:\Windows\System\ubvdECQ.exe
  2⤵
  PID:11724
- C:\Windows\System\ntAWzis.exe
  C:\Windows\System\ntAWzis.exe
  2⤵
  PID:11744
- C:\Windows\System\viOMogM.exe
  C:\Windows\System\viOMogM.exe
  2⤵
  PID:11760
- C:\Windows\System\unSDlTT.exe
  C:\Windows\System\unSDlTT.exe
  2⤵
  PID:11776
- C:\Windows\System\TjsZWkl.exe
  C:\Windows\System\TjsZWkl.exe
  2⤵
  PID:11792
- C:\Windows\System\AakZeEz.exe
  C:\Windows\System\AakZeEz.exe
  2⤵
  PID:11816
- C:\Windows\System\jBDXZND.exe
  C:\Windows\System\jBDXZND.exe
  2⤵
  PID:11836
- C:\Windows\System\AJHNyvg.exe
  C:\Windows\System\AJHNyvg.exe
  2⤵
  PID:11856
- C:\Windows\System\tDBsznc.exe
  C:\Windows\System\tDBsznc.exe
  2⤵
  PID:11876
- C:\Windows\System\sEAmrVd.exe
  C:\Windows\System\sEAmrVd.exe
  2⤵
  PID:11896
- C:\Windows\System\kDzsdCN.exe
  C:\Windows\System\kDzsdCN.exe
  2⤵
  PID:11916
- C:\Windows\System\USpvLXE.exe
  C:\Windows\System\USpvLXE.exe
  2⤵
  PID:12252
- C:\Windows\System\TQbBOCe.exe
  C:\Windows\System\TQbBOCe.exe
  2⤵
  PID:10728
- C:\Windows\System\dQBQMvd.exe
  C:\Windows\System\dQBQMvd.exe
  2⤵
  PID:11088
- C:\Windows\System\DkJCemC.exe
  C:\Windows\System\DkJCemC.exe
  2⤵
  PID:10052
- C:\Windows\System\NEhEXUB.exe
  C:\Windows\System\NEhEXUB.exe
  2⤵
  PID:11176
- C:\Windows\System\nfrraji.exe
  C:\Windows\System\nfrraji.exe
  2⤵
  PID:10204
- C:\Windows\System\OyGPdlG.exe
  C:\Windows\System\OyGPdlG.exe
  2⤵
  PID:6092
- C:\Windows\System\QQAceAM.exe
  C:\Windows\System\QQAceAM.exe
  2⤵
  PID:9772
- C:\Windows\System\McdBwJF.exe
  C:\Windows\System\McdBwJF.exe
  2⤵
  PID:7212
- C:\Windows\System\aZBcwkP.exe
  C:\Windows\System\aZBcwkP.exe
  2⤵
  PID:9180
- C:\Windows\System\KCyAFwz.exe
  C:\Windows\System\KCyAFwz.exe
  2⤵
  PID:3220
- C:\Windows\System\CufQelr.exe
  C:\Windows\System\CufQelr.exe
  2⤵
  PID:10272
- C:\Windows\System\IJprshS.exe
  C:\Windows\System\IJprshS.exe
  2⤵
  PID:10664
- C:\Windows\System\IHRNHWf.exe
  C:\Windows\System\IHRNHWf.exe
  2⤵
  PID:9520
- C:\Windows\System\ZnHYglM.exe
  C:\Windows\System\ZnHYglM.exe
  2⤵
  PID:10792
- C:\Windows\System\bhbSbUE.exe
  C:\Windows\System\bhbSbUE.exe
  2⤵
  PID:9684
- C:\Windows\System\qwWubtk.exe
  C:\Windows\System\qwWubtk.exe
  2⤵
  PID:10860
- C:\Windows\System\wevTdue.exe
  C:\Windows\System\wevTdue.exe
  2⤵
  PID:9776
- C:\Windows\System\KgCYRAN.exe
  C:\Windows\System\KgCYRAN.exe
  2⤵
  PID:11496
- C:\Windows\System\skntVGR.exe
  C:\Windows\System\skntVGR.exe
  2⤵
  PID:11012
- C:\Windows\System\QcSIxYz.exe
  C:\Windows\System\QcSIxYz.exe
  2⤵
  PID:11624
- C:\Windows\System\bYCeYjN.exe
  C:\Windows\System\bYCeYjN.exe
  2⤵
  PID:11852
- C:\Windows\System\WTNIecJ.exe
  C:\Windows\System\WTNIecJ.exe
  2⤵
  PID:11204
- C:\Windows\System\rHdDGWU.exe
  C:\Windows\System\rHdDGWU.exe
  2⤵
  PID:8524
- C:\Windows\System\YhRKcFS.exe
  C:\Windows\System\YhRKcFS.exe
  2⤵
  PID:11344
- C:\Windows\System\VVJyVJh.exe
  C:\Windows\System\VVJyVJh.exe
  2⤵
  PID:9268
- C:\Windows\System\IinSKke.exe
  C:\Windows\System\IinSKke.exe
  2⤵
  PID:8224
- C:\Windows\System\JpLDOiQ.exe
  C:\Windows\System\JpLDOiQ.exe
  2⤵
  PID:11864
- C:\Windows\System\hTcoOxl.exe
  C:\Windows\System\hTcoOxl.exe
  2⤵
  PID:10336
- C:\Windows\System\JShJHHT.exe
  C:\Windows\System\JShJHHT.exe
  2⤵
  PID:10532
- C:\Windows\System\ZPBIcuR.exe
  C:\Windows\System\ZPBIcuR.exe
  2⤵
  PID:9440
- C:\Windows\System\whhMtPE.exe
  C:\Windows\System\whhMtPE.exe
  2⤵
  PID:11276
- C:\Windows\System\tFlwNNg.exe
  C:\Windows\System\tFlwNNg.exe
  2⤵
  PID:11308
- C:\Windows\System\lZyKGPB.exe
  C:\Windows\System\lZyKGPB.exe
  2⤵
  PID:11656
- C:\Windows\System\ZPWtVzn.exe
  C:\Windows\System\ZPWtVzn.exe
  2⤵
  PID:11720
- C:\Windows\System\MRvXqUN.exe
  C:\Windows\System\MRvXqUN.exe
  2⤵
  PID:11804
- C:\Windows\System\YKIqMWp.exe
  C:\Windows\System\YKIqMWp.exe
  2⤵
  PID:9392
- C:\Windows\System\KbjJfWJ.exe
  C:\Windows\System\KbjJfWJ.exe
  2⤵
  PID:11948
- C:\Windows\System\MpXcYXY.exe
  C:\Windows\System\MpXcYXY.exe
  2⤵
  PID:11236
- C:\Windows\System\CyKWCdp.exe
  C:\Windows\System\CyKWCdp.exe
  2⤵
  PID:9368
- C:\Windows\System\iZxrFcJ.exe
  C:\Windows\System\iZxrFcJ.exe
  2⤵
  PID:12272
- C:\Windows\System\JiVmzAp.exe
  C:\Windows\System\JiVmzAp.exe
  2⤵
  PID:4900
- C:\Windows\System\JrwQsGo.exe
  C:\Windows\System\JrwQsGo.exe
  2⤵
  PID:12416
- C:\Windows\System\yEGbsIi.exe
  C:\Windows\System\yEGbsIi.exe
  2⤵
  PID:12436
- C:\Windows\System\rwBqMfc.exe
  C:\Windows\System\rwBqMfc.exe
  2⤵
  PID:12460
- C:\Windows\System\XZTSNqw.exe
  C:\Windows\System\XZTSNqw.exe
  2⤵
  PID:12492
- C:\Windows\System\chJATCv.exe
  C:\Windows\System\chJATCv.exe
  2⤵
  PID:12536
- C:\Windows\System\UOaEkZa.exe
  C:\Windows\System\UOaEkZa.exe
  2⤵
  PID:12556
- C:\Windows\System\YKQtsOS.exe
  C:\Windows\System\YKQtsOS.exe
  2⤵
  PID:12572
- C:\Windows\System\fEZhiFi.exe
  C:\Windows\System\fEZhiFi.exe
  2⤵
  PID:12604
- C:\Windows\System\GbsqjQt.exe
  C:\Windows\System\GbsqjQt.exe
  2⤵
  PID:12624
- C:\Windows\System\kWzkOsF.exe
  C:\Windows\System\kWzkOsF.exe
  2⤵
  PID:12948
- C:\Windows\System\qwKHhuG.exe
  C:\Windows\System\qwKHhuG.exe
  2⤵
  PID:12964
- C:\Windows\System\lBzuBMm.exe
  C:\Windows\System\lBzuBMm.exe
  2⤵
  PID:12980
- C:\Windows\System\ciTBdvX.exe
  C:\Windows\System\ciTBdvX.exe
  2⤵
  PID:13160
- C:\Windows\System\TfJINcz.exe
  C:\Windows\System\TfJINcz.exe
  2⤵
  PID:13180
- C:\Windows\System\BBTDbUC.exe
  C:\Windows\System\BBTDbUC.exe
  2⤵
  PID:10548
- C:\Windows\System\mFOuKjj.exe
  C:\Windows\System\mFOuKjj.exe
  2⤵
  PID:10916
- C:\Windows\System\IFIduUb.exe
  C:\Windows\System\IFIduUb.exe
  2⤵
  PID:10608
- C:\Windows\System\bZdiwdC.exe
  C:\Windows\System\bZdiwdC.exe
  2⤵
  PID:12392
- C:\Windows\System\DNXUmhp.exe
  C:\Windows\System\DNXUmhp.exe
  2⤵
  PID:12456
- C:\Windows\System\DbWjCZK.exe
  C:\Windows\System\DbWjCZK.exe
  2⤵
  PID:12404
- C:\Windows\System\NTJAArN.exe
  C:\Windows\System\NTJAArN.exe
  2⤵
  PID:12792
- C:\Windows\System\UnWsQZu.exe
  C:\Windows\System\UnWsQZu.exe
  2⤵
  PID:12564
- C:\Windows\System\RmScfxN.exe
  C:\Windows\System\RmScfxN.exe
  2⤵
  PID:12696
- C:\Windows\System\RKpmfxy.exe
  C:\Windows\System\RKpmfxy.exe
  2⤵
  PID:3288
- C:\Windows\System\ZrtNaLa.exe
  C:\Windows\System\ZrtNaLa.exe
  2⤵
  PID:13284
- C:\Windows\System\VyFnPpC.exe
  C:\Windows\System\VyFnPpC.exe
  2⤵
  PID:11812
- C:\Windows\System\qqqIkSh.exe
  C:\Windows\System\qqqIkSh.exe
  2⤵
  PID:10248
- C:\Windows\System\ckDOEQA.exe
  C:\Windows\System\ckDOEQA.exe
  2⤵
  PID:9884
- C:\Windows\System\xPcEDPk.exe
  C:\Windows\System\xPcEDPk.exe
  2⤵
  PID:10188
- C:\Windows\System\grRXTLl.exe
  C:\Windows\System\grRXTLl.exe
  2⤵
  PID:6720
- C:\Windows\System\eGbNgsR.exe
  C:\Windows\System\eGbNgsR.exe
  2⤵
  PID:11412
- C:\Windows\System\zgzXHCx.exe
  C:\Windows\System\zgzXHCx.exe
  2⤵
  PID:11988
- C:\Windows\System\SwUXCwL.exe
  C:\Windows\System\SwUXCwL.exe
  2⤵
  PID:13296
- C:\Windows\System\WAFyKcM.exe
  C:\Windows\System\WAFyKcM.exe
  2⤵
  PID:13304
- C:\Windows\System\qglvciB.exe
  C:\Windows\System\qglvciB.exe
  2⤵
  PID:13056
- C:\Windows\System\glMhquu.exe
  C:\Windows\System\glMhquu.exe
  2⤵
  PID:12736
- C:\Windows\System\vWhPmpZ.exe
  C:\Windows\System\vWhPmpZ.exe
  2⤵
  PID:13044
- C:\Windows\System\kuSuZKf.exe
  C:\Windows\System\kuSuZKf.exe
  2⤵
  PID:4868
- C:\Windows\System\RcNiExE.exe
  C:\Windows\System\RcNiExE.exe
  2⤵
  PID:8756
- C:\Windows\System\DaVhtqt.exe
  C:\Windows\System\DaVhtqt.exe
  2⤵
  PID:13268
- C:\Windows\System\hVXCCyX.exe
  C:\Windows\System\hVXCCyX.exe
  2⤵
  PID:11872
- C:\Windows\System\uXePXBK.exe
  C:\Windows\System\uXePXBK.exe
  2⤵
  PID:11428
- C:\Windows\System\naQGbvY.exe
  C:\Windows\System\naQGbvY.exe
  2⤵
  PID:13236
- C:\Windows\System\wqcBTQA.exe
  C:\Windows\System\wqcBTQA.exe
  2⤵
  PID:428
- C:\Windows\System\iUdEQAe.exe
  C:\Windows\System\iUdEQAe.exe
  2⤵
  PID:6364
- C:\Windows\System\ngCkiYC.exe
  C:\Windows\System\ngCkiYC.exe
  2⤵
  PID:1396
- C:\Windows\System\hCiFJjM.exe
  C:\Windows\System\hCiFJjM.exe
  2⤵
  PID:9016
- C:\Windows\System\QcQcggb.exe
  C:\Windows\System\QcQcggb.exe
  2⤵
  PID:11300
- C:\Windows\System\pOBuQMm.exe
  C:\Windows\System\pOBuQMm.exe
  2⤵
  PID:12616
- C:\Windows\System\zYFahIP.exe
  C:\Windows\System\zYFahIP.exe
  2⤵
  PID:12664
- C:\Windows\System\VNhdNmM.exe
  C:\Windows\System\VNhdNmM.exe
  2⤵
  PID:13036
- C:\Windows\System\ZGfzMGh.exe
  C:\Windows\System\ZGfzMGh.exe
  2⤵
  PID:7576
- C:\Windows\System\BKLJTap.exe
  C:\Windows\System\BKLJTap.exe
  2⤵
  PID:11784
- C:\Windows\System\mNVqDpo.exe
  C:\Windows\System\mNVqDpo.exe
  2⤵
  PID:13244
- C:\Windows\System\IJpGMrF.exe
  C:\Windows\System\IJpGMrF.exe
  2⤵
  PID:4488
- C:\Windows\System\RiTmXey.exe
  C:\Windows\System\RiTmXey.exe
  2⤵
  PID:2624
- C:\Windows\System\ZUpBCXC.exe
  C:\Windows\System\ZUpBCXC.exe
  2⤵
  PID:1112
- C:\Windows\System\BUZuOlv.exe
  C:\Windows\System\BUZuOlv.exe
  2⤵
  PID:12400
- C:\Windows\System\DmQqQrf.exe
  C:\Windows\System\DmQqQrf.exe
  2⤵
  PID:5032
- C:\Windows\System\vibEdfV.exe
  C:\Windows\System\vibEdfV.exe
  2⤵
  PID:3236
- C:\Windows\System\zxriLJE.exe
  C:\Windows\System\zxriLJE.exe
  2⤵
  PID:12840
- C:\Windows\System\pksnRdJ.exe
  C:\Windows\System\pksnRdJ.exe
  2⤵
  PID:13224
- C:\Windows\System\YuCOhSb.exe
  C:\Windows\System\YuCOhSb.exe
  2⤵
  PID:12516
- C:\Windows\System\ySSDlnG.exe
  C:\Windows\System\ySSDlnG.exe
  2⤵
  PID:13204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f3b3wycc.gb2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\GsxIrvt.exe

Filesize
1.9MB

MD5
532e6e2ccf893e72574e50a053418956

SHA1
89ecaa31498d514acf97cdac3c32c76f411fbdb2

SHA256
872543dab8595cf301231f8536c704478038a4fbfa13d78fb5ace38c1afa3d89

SHA512
07101330faf0851402cf120ffe8c945059961eae38f3d4b308cadec77db9620375b53b6347937f48896b486ecdbcb7dee6bb8026b05cf3cf044b4b7d16b07f05

Download Submit
C:\Windows\System\HKfoHtU.exe

Filesize
1.9MB

MD5
0359d94b42d7819273aabba6b73a3e99

SHA1
531d45b318ae4ed6a77d0b6015e3a6584508c56c

SHA256
3dbd2c50800ceb66fde100632d2e8bbf548c95a13e21d178dc1a7885972af41e

SHA512
47d5b1b5b688a401073e889dc0ccfa212ca4a46fa312dd38b64d5639ea318f587f7892064885dadcb355e1d3f6661ad35284972d3b57ab84b98ca3c540cfaa30

Download Submit
C:\Windows\System\HkpPdcY.exe

Filesize
1.9MB

MD5
fcf20c5617f1251e68953bc1ccf46933

SHA1
c5517eb7daef6cf9eaf57c3efdc3119a063c0708

SHA256
eaa753b4289dfa91f12e904bbd85fe4377928ee72add914aafaebebf83e092c2

SHA512
ed8b9bf413e3bef07c6c6bafe0231c20c477868eb20fc4e09ede8cc5099f3b741aa59a072c8f8d25109277630ce8900a468d035b73f3bf883969d0900fd731f1

Download Submit
C:\Windows\System\IIEALph.exe

Filesize
1.9MB

MD5
91685b8a7bc9cde5c85632eb77c14a85

SHA1
c32ba6c6dd94280e7530dd1798ceebaf7cacadb1

SHA256
1f01a8b2bff3806700f9d12b83a38bf0e08fe6088c5e33bea868649e5726a8f4

SHA512
4595a85e2631e58e717a119d20429b92be229792a0b4ffe2a4adc6b830766b821837c5abae36624e09e82fc1656ab4cf4b3f72e4314db1256e9f8e127bcb094e

Download Submit
C:\Windows\System\ILwITln.exe

Filesize
1.9MB

MD5
b1f7e5416137c2a09731691b17b0a9e1

SHA1
38c7f0a702c7391f1d833ee97325da1619158ff5

SHA256
213a9e28a7e0aba23a100f0780cee1f07d0d9bbdb82c32ac532af8cad167a1c9

SHA512
034e22aaa43915e0200e62a73408d6609b2abae7e301568006c9e0c9eb18bb5ce6acfc9ff95a554dc139b90cfbd3f38ad560a6929a731dfc5446aeea7405163b

Download Submit
C:\Windows\System\LAudLmY.exe

Filesize
1.9MB

MD5
837fa57865be82554f1e133ddea2d742

SHA1
719047e55d84d763b8b967069ed79e4b9d24497d

SHA256
d687086bdff8cb05f66b4d8485eff11b97c1403001557205a5e1f821570b4cfb

SHA512
866534a83f92e4de33e12ec10f517921474fbe62cae53b7d326d456ef4a84f8fcd87a5efe444a8eda3f8ecb380cd90b1096882d83704448f6ee4fae334d3cc37

Download Submit
C:\Windows\System\LHZzeTd.exe

Filesize
1.9MB

MD5
a9892e69d981e59f295a4bb01a43d5c0

SHA1
955114c0cff2376f67f8df111bd7d06377c4c261

SHA256
5bb181c3a83c49fe369006c64fe8504d6996448a479ed6528b80bc64ea9a77c7

SHA512
17fcafd78226f28f47907ad9142b6a6f00293caabaad7822c5fae57eb5742c69af380b4260f4a1b6a2e0db549598ff8f19c0ff285d8334d106fc1435c660997e

Download Submit
C:\Windows\System\OQoNZQC.exe

Filesize
1.9MB

MD5
944e989a075b4a54ab860e23ea822d7a

SHA1
a1fdeb348711a50ea7c84a02f80dded1af0f06a9

SHA256
dbc3c96bfec843b375a523d30f8d5358d5df520c4820607bbc8e36f7c9dc9587

SHA512
42357d8bc3b20360009f60786ab22f8ffe676f345e5453bfe475db4b07b6c5d5dc969902f5851db37a7245d472ec08abcbc22f961ceba34abc30166878bdd900

Download Submit
C:\Windows\System\TkxLZii.exe

Filesize
1.9MB

MD5
4e65efb8475a1febc884b2ce4762f2db

SHA1
4af24fde49eef92521fca19907e1b90189686b6d

SHA256
463ccc4fbeb8b41b97e74fd480db45cbb00a5f6b69864d3cffde87d48ea4056b

SHA512
540851d7c0a3f2570cb0d33a1013928758436f537416b3a8637dafc5c6f4cfac29d2c1eb207b0879ef9781f87f2093c6afd7627ecee8a8d2e3f206c566715424

Download Submit
C:\Windows\System\UHbSxhs.exe

Filesize
1.9MB

MD5
2c6f83709eeadc653910191cc981ef96

SHA1
9cda9ccc20bee031640598bf3c85b329ae94f3fa

SHA256
907d71433436a850acca2c4aa618144d291475338de0f76c259d727b7b97fd47

SHA512
ee46f99fb47517c6dc32123e3319f5479026f93de84ab25e1a2fb86ec767c642a326d4e63fc7786cee353b9a641dc3f0db869a61ee67b7a9ac063142aaa8484c

Download Submit
C:\Windows\System\UvwYwdd.exe

Filesize
1.9MB

MD5
ed6fd096a45479fb9a381a387f093e92

SHA1
9edcce0053ed2f29b8df537c74febb4eba98df2e

SHA256
9bc9935a08f0861cfe5ec5ab528ae2f2cc2d5550a6d6d2276f485bd252dbe89d

SHA512
0fed0a929a2013a84d7febe6e182b74820e8d668932fb88192438c66edf0b788a835456d743169bcb84624780c39c1a901c6e964229acf7b3990f6d8341186d4

Download Submit
C:\Windows\System\WNWBkqo.exe

Filesize
1.9MB

MD5
bde925563968e908e53c6e6ebcc85f2d

SHA1
395a08d77a2cf01ec966c31eceb5ffa7ecf4c5ca

SHA256
c222f884e3971452600a628b18c3a630f1e0df27b3047316a3c6bc0a0dba815a

SHA512
0274c3d589696510107445f1538ecbfc76caef36603a003da407385b3f5eb67a3a5d0f0b7ebe557e0351dd176647b45eae528b609b8c613a85ef2a27d1eb9b57

Download Submit
C:\Windows\System\WxBhXpo.exe

Filesize
1.9MB

MD5
5b1b450a827f64f154977f94703ed723

SHA1
b4d0b080fac9a5edd50645706ce2f612a4be897c

SHA256
39821b702cf20835732860036fd184d9168e61c481e65c23e058b53a835fb415

SHA512
9d385a30e4ed54b6cbe2d58ea595dec6cba5e082f13696d6ec7fb3eda11f4b7f9df8d3645810034681f3725d74c3a18b9c4cdcaa358b8a0c18144f155f4dd6fc

Download Submit
C:\Windows\System\XGhEFDn.exe

Filesize
1.9MB

MD5
4f87d05edf591318130800909b37fd2f

SHA1
10d49e78b63f27d818cee3850377edb85fa99ef2

SHA256
fca6f755de7bcdeb749902c03fc899a7223261094cc24039f83fb67719b6d786

SHA512
6d1e838f6231c4033445010b822e422c78df12883237b9dd48afc8dd0dbfb811567081dcb81466a057b5583021922519a39336c8228526af547805d316ec62d1

Download Submit
C:\Windows\System\XSrZalB.exe

Filesize
1.9MB

MD5
fa71fe9ae00ff5f4f7fa243cfb88656d

SHA1
f4cc76c2bba7d277b9e30deeb2a3770a40c2a573

SHA256
d1ec66d41081d0cdb9798d0bba7220f95b2c87131cc92ea68264a60aa2fb3342

SHA512
c0dddb48dd96d636350c2e0b0414bd9df366ae1e0ed622a6b0a9044fdfd6f71ab66affc4e0c432112080d77b2d3a407e599576a1fefe3146f605ad7032dac1e3

Download Submit
C:\Windows\System\YEZcCgs.exe

Filesize
1.9MB

MD5
d774ce6b651c49c97024af8d91f722e1

SHA1
2f35243f24bb9ad29ff97588eb222472f113ec90

SHA256
01078ad8f96b7fc3e09fe839f9378b663a34faa6080192a58c70271cc5274e1b

SHA512
a7aaf5b28898d8f07b901bc3706c57d20a836f8a533ccde7dd181e260b60d7ab2531edd3d1a8579ea1a8069f956a325ffca02f57d72bbcad9b875734f61fe569

Download Submit
C:\Windows\System\YbASUwo.exe

Filesize
1.9MB

MD5
fbc55ee910403c316c2cff6ab53cd83d

SHA1
bf2f56e038bc4d1e39fb59ba2c2e2eb8acd135d1

SHA256
381b461e2bcf2f91954312046ae742c58cd7ad51c58aec03851889c69fc7ec05

SHA512
8b79d020ff3aa0f6c365ef4c78901d98215825f5f406bee5de88838d907e64317a9c101d2e1db9aac392cbb3439c2fa9f69d259e0e83f0a4f94e0ee74312182f

Download Submit
C:\Windows\System\aegzMGz.exe

Filesize
1.9MB

MD5
49de512bc38b9e0901b4d5d5d9f315e4

SHA1
98de56eeb7bbf72402d971d9f2ca3d3e645a84dd

SHA256
a44cd1abc2798234540ced2eda65dc144de06bb269666433a89aa9a41525ae88

SHA512
293a3a8da6bc3d8a5ab239dc5e663f2efc351c19e833f03bdc649f47898eecac02d7ae718bc6c3e84310738164363a986e4c71372b2aec653f0833d3998397ba

Download Submit
C:\Windows\System\chiNycZ.exe

Filesize
1.9MB

MD5
64cc26e47138e09b2aa21a2be75c66a0

SHA1
d9b13b5a9ef7ac1439532c1f44aba8f3bfeef91b

SHA256
c4307e52272b81f4c13650e9ff4129dddb62f1d0295e3d85eb60a192548607b9

SHA512
acaf7f35292a9c49361727eeaa3e2e10a15bec10655d59f8c2d97450ed1c2e581ed5017192e46908a9239ef6c1bc668e96842aa32be7f724df1bd05234023dac

Download Submit
C:\Windows\System\eBwOLWu.exe

Filesize
1.9MB

MD5
1c855589f5ed5c8f9908a5f1f28fed75

SHA1
f5d895675f52c16fd9188b6387cd1453d0566a2a

SHA256
f57704e17346f8028b54d8e957f0853fa16e62dcc8d81e7d042c91dba40d26ef

SHA512
e4c44fc13a09ea5b6b86f61c3010adbedd57dcdde2348a75ee46c0c1e81dc1d8fb476d3c5cedcdf21d93a48904e7cf1d065d716b49672fb9773670366a9f2598

Download Submit
C:\Windows\System\eoDqFKf.exe

Filesize
1.9MB

MD5
550cb9932daa6df873028079d29a01aa

SHA1
9a7466f2ca0554ee62c7fa419b8dad611f9816eb

SHA256
b8eb74778dbcd0afae0c6deb0c5663f53fed6c4c646c381fc6a5f62267f31e8b

SHA512
60d43751a4ddaa42b50d3351917ad8a8f4223c1c4b92a5379fced1a2febd513f2b791cc46779cfe4e6852daada36461080de73243d20b008bafd5fea6014dc75

Download Submit
C:\Windows\System\fPrNGeX.exe

Filesize
1.9MB

MD5
695f362bb2590711f87a4e0f98d9ac1a

SHA1
2f3752eaa9500217cc84b839abb130fafc10fdfd

SHA256
d34738c5ccb7561e2961ba8aa63d45df99c14dcc5248d484cbd74f20927bcc68

SHA512
967acd4fa02abc5096947cf5d0a7eea21b5fbfcd7382d93ef39a6a6066087a8ec409f74ba2f3716a97231e708f501a5cd2a7d4c226185e954877870d0281647d

Download Submit
C:\Windows\System\hRtqDzY.exe

Filesize
1.9MB

MD5
b345f0b15ab736832dc1c66ef9cb1ec1

SHA1
357c0763a56483ed70893b2d1d23234bbfbfb1d1

SHA256
a2e83d5a1b798478764d54c2102c2a826bb0e6fbd9500bc2b632351e272d61c2

SHA512
8dc8f618a32a15d59543c38bb0cf740b5116dbf216ea512b007b3accc582337a2deee371d597a1d3f211487484d1bc4a53a6298c374ba3c45c8cc31634dca70f

Download Submit
C:\Windows\System\iHraqTh.exe

Filesize
1.9MB

MD5
6c61c34a0c3f09d17441114f3cf759e3

SHA1
cce32cd8c1a2f26335c1d6ec188b09c8ec147797

SHA256
d2ff2040e23d9e56d632e2cb0aeeec97d91f8c01dff9cf45e49e379623216e32

SHA512
51a5120cbd1237ab5b3709ab324c0f0893286838d766a9bd942c5989a01f1a5b289ee47e1a363581f4e9da9e7bbd458583a4cd8fef9ceebb1bd775e9a0db5897

Download Submit
C:\Windows\System\jCgssJP.exe

Filesize
1.9MB

MD5
59589da2267adc84b27c366baf8e539a

SHA1
6c3c7a0cd04ea2727e9a2e20bddff78af4a793b8

SHA256
3dc5b3187d3f21b38a5076496281878ffc6c30d7923152512ecb17c48c261fed

SHA512
6ae9e4d457023403b4b909a5438c6783f2035209d06d655af082116dac5dc7478367447efc9092260e1d4004f2dc2c14bc38abd4a1f7ab959d5574ed6588eaa5

Download Submit
C:\Windows\System\jPrOHGM.exe

Filesize
1.9MB

MD5
eee37d9c724a432b276bf2784ef27a3d

SHA1
7f379768974e4c04d107f486f981af9e41641a8d

SHA256
f0cd254ada98f02925827e9f5fd587eede03b5265613b622b6787014f2aa3b8c

SHA512
9b67f0943e0e578411fdb2d583cff2f755611de692ed9ae7d2a11b16da5ef32d856709320a749f8c76d193ce3dcd97cae80dc80afdde0ea0dd51513e859246e9

Download Submit
C:\Windows\System\jUWVjpm.exe

Filesize
1.9MB

MD5
9118d945a3ab88db79f233ae69fdefb3

SHA1
1a04b633d6d0d8a03b9acea57ce0c78942cceb93

SHA256
75ab73ea0c131522a4dd2ff1d04335f978e33a4487120bb6d07ada3722274a86

SHA512
b5e1457483dfb037df87ac080d43d8c12f703a0fbeb922cf380d4aa8f5924a5a5522c494043a36fccdc6bced41007a6c7e886913c803c06bacd78536b41f9941

Download Submit
C:\Windows\System\nflCYOb.exe

Filesize
1.9MB

MD5
57f6cceb035e09dac67924870382cbe5

SHA1
087543c8079ad50957690d049fb8ae8ae9627068

SHA256
1f6bbd6bf2b1684dfec2c1177d4a991f1a2d534b4499d917fc5b122bb8a65ae7

SHA512
9879160fcb7b88d0ee23615cf9a86dda9907225a8b943414d17134112a8998474fd5f9ab0ae6fdbd4a66a857204a0e05c4d221f079bb2682b97a5457a6e17ff7

Download Submit
C:\Windows\System\nwWYrll.exe

Filesize
1.9MB

MD5
9e65cba16cc652a72163920bab9bfd7a

SHA1
196d6f81bcf4b20b9de3ff83dcb5974d15661e67

SHA256
00234c7800aefa85c836a76d383aff6d417f9c41031b56e4a6d83a1c21056d26

SHA512
c8ae13187ac3b7c4b3faa652ac9286ae48c4ba882fe661faa011e507d3b21b45b9b62a68454fd82595e903194f9ac58dcd41633dd314d5baaf4471452b704d95

Download Submit
C:\Windows\System\pFeNNfS.exe

Filesize
1.9MB

MD5
fda1dc5ff608604dcdfc32ca117d87c2

SHA1
1da69da3d940932acf250bcc6c0b05ea04895618

SHA256
975353cb28af91a79d7637fad71dc1ebb5d9951a7b0b5a6c402d0b29fcb1b254

SHA512
dbca3d32b99611357dcb390660f02376aae27dd00e679be70db8669fbb6d0a7824685258c711815fd45ac43fd688110c4ba601ad36520b3c6730d138d794ec0c

Download Submit
C:\Windows\System\sFFLffE.exe

Filesize
1.9MB

MD5
4b8dd761a26ba261ca91599a8c5ba612

SHA1
e51315a24bdb017c6252fb0b1bdfa632cf899142

SHA256
d2f58570961a08bd51c699b7ff70d3c62c1c57eb12f34d8c223359057135435f

SHA512
23f35de380cf764fc4f879ee2e767c33fffaa178d3d25ff44478d2f8b30f1f459755b7154ea9c3f4b6322d35295b9d5abb29e52d309f79306adef72e748b4256

Download Submit
C:\Windows\System\sUCKiAS.exe

Filesize
1.9MB

MD5
ef041aee96bf61c2a4d4ed9694af6ec5

SHA1
850eb618736b1029ed1e758e48fd99edcd2053ce

SHA256
820d60d01978be7a801fc2fab99741e984f5b1512b84e4a57c41e9c1c5837f6c

SHA512
20d99219bb7ac63b88a558895c5a9c732753f179ec39e109bd9d8c415e170f620bdeda6b8aea0c0f743ca1b17a16ee27baa5cc67d9f67d797155f13416904251

Download Submit
C:\Windows\System\scuhIvQ.exe

Filesize
8B

MD5
98078e6e3179cf16096b56055d65598a

SHA1
839bba9cf7f249374903727f77bb74aa057bfe10

SHA256
5e241d47c5c1bba728b1d456a45dbbbc3cb228d84126e71ecd96ca4d2f21321d

SHA512
37603709821b73dff96cab19e79390a8575f1f7caab4fda9dc215ff6a704ee2d38a1d8b0677b8c0cb56a47fade60f20502f12be7f4cabcce2355b4e9fb212f78

Download Submit
C:\Windows\System\tfSlNNd.exe

Filesize
1.9MB

MD5
5263927f541967adf5dd562cf5c528c7

SHA1
ba354bda7dca4067de34b1712ee45ff9728cbe40

SHA256
a3ea2c85fb6be4700efe0f742b22704ff2fc5ba44f646231bf4c5e2132df0d2f

SHA512
ed42ab627f60003d3b5f6940998ee8ebcc83ccd483e0e6d51e6fc4d7ccaa0780d198c017aceb4c5a7cc69a254dc2e97f326e89595e66a15180f5de4e4cc6c3af

Download Submit
C:\Windows\System\vFodtEU.exe

Filesize
1.9MB

MD5
d013b7b85dd0c69159e59562a4a628fc

SHA1
23f8b5c5676d4ee4c1de8954ee123aa9614bf2d3

SHA256
21c5bbfa94ad5a49fc636fbc532acce3b5ae37651ae33be7f231a7c7d6803f2b

SHA512
ea4d50b343b0324eb456f86f58f300ff30948a8e98e31e3899d98eedbe4ccf7cdf14f4bf75d241f738edc8b8a21c502037b90e420a63824b24f2bf986246ac73

Download Submit
C:\Windows\System\vqcwNRb.exe

Filesize
1.9MB

MD5
4741908a0889a39334b2c7148a048f38

SHA1
7e8a91dd87d171b2f321afc56eb72678e7f4329f

SHA256
885bb378cbff163c0533f4a25fe3c91ecb5be783e266a61c489b7832014250c4

SHA512
6b7427ad59db4892ceb25b55eec71b4e1fc25329f9527d7ef112da3c2f39ebae40b4099cf7c804e108ce07b70c42118665f9de0f9cc3b4db3da99349f944f13a

Download Submit
C:\Windows\System\xPxzUFk.exe

Filesize
1.9MB

MD5
bfedf6978057e8c23f3b0df77a74d7e5

SHA1
09b621c98a6901e24e7587408a0f5441feac654d

SHA256
dcdbb35a97688fee559b39e7e475f5859f8ae51fbf670537ce8645a1cba88f6e

SHA512
5cdbeacb6cad84588d5630a97823b556d150a4c2fd378af50e1bb379c02a1f5cf56a96389a126f7fb427db7ab0d6e67a8d32da2a139b2b733bcb4fab3bfa401b

Download Submit
C:\Windows\System\xfrbuqn.exe

Filesize
1.9MB

MD5
d15e0f709f3fcf9ef31de625922e8460

SHA1
4941b70c7b60e952ffbb9882b3c7c72a79f87871

SHA256
a8f00482fc0bf36e5ebfa67c35f3b1a4a20398b64d676aad7de06144d587bffb

SHA512
4cc026ef8e1b41797609623b13f4d839b9e6735a6a2f24564377da9ab7aa95e3312bdee8854c83567219be145c429b1b1f46dcd12f83547b4323f0c32d814b8b

Download Submit
C:\Windows\System\ydpAdUy.exe

Filesize
1.9MB

MD5
346bd6f3635294374bd5c713f5540626

SHA1
56893857f9319b2b263911e20b5a2fbd76c97474

SHA256
5aae693942ae5495d5f9728d0ce1fda3461a3bdc9fd0bf9d22d2607be5a8316e

SHA512
0d464e07b3435fb3b1b0e30fe72ab684543553e6f1a91d5e6c0125c00470a359ab3df0083b1d85e63760b85fbfcbd0dbba729a5d706ea95605242db00c52c792

Download Submit
C:\Windows\System\ziMqkxz.exe

Filesize
1.9MB

MD5
5737fe00ac9b74f39c323f0747e1e3a3

SHA1
a1c9dbc334f2e70824342d7e9cdec72d6c4983ad

SHA256
24d3bbe86b12581909240c4ff710f5b1e194de822790c7a2e1474b7a7b6aa1e8

SHA512
cd8844bba747b824a6df67a33cc0cd65b99fb982821695fb941e01f077432f521ac0c01d20369d0c71b1099f652abc752b234d57438b0847bea36359eacc3ba9

Download Submit
memory/460-3348-0x00007FF70F9D0000-0x00007FF70FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/460-267-0x00007FF70F9D0000-0x00007FF70FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/940-270-0x00007FF65FBA0000-0x00007FF65FF92000-memory.dmp

Filesize
3.9MB

Download
memory/940-3319-0x00007FF65FBA0000-0x00007FF65FF92000-memory.dmp

Filesize
3.9MB

Download
memory/980-3313-0x00007FF7E4A00000-0x00007FF7E4DF2000-memory.dmp

Filesize
3.9MB

Download
memory/980-254-0x00007FF7E4A00000-0x00007FF7E4DF2000-memory.dmp

Filesize
3.9MB

Download
memory/1440-3311-0x00007FF736F80000-0x00007FF737372000-memory.dmp

Filesize
3.9MB

Download
memory/1440-257-0x00007FF736F80000-0x00007FF737372000-memory.dmp

Filesize
3.9MB

Download
memory/1600-268-0x00007FF76AD10000-0x00007FF76B102000-memory.dmp

Filesize
3.9MB

Download
memory/1600-3299-0x00007FF76AD10000-0x00007FF76B102000-memory.dmp

Filesize
3.9MB

Download
memory/1924-3341-0x00007FF632FA0000-0x00007FF633392000-memory.dmp

Filesize
3.9MB

Download
memory/1924-260-0x00007FF632FA0000-0x00007FF633392000-memory.dmp

Filesize
3.9MB

Download
memory/2024-252-0x00007FF602AD0000-0x00007FF602EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2024-3310-0x00007FF602AD0000-0x00007FF602EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-255-0x00007FF7B2590000-0x00007FF7B2982000-memory.dmp

Filesize
3.9MB

Download
memory/2028-3301-0x00007FF7B2590000-0x00007FF7B2982000-memory.dmp

Filesize
3.9MB

Download
memory/2284-91-0x00007FFA55E30000-0x00007FFA568F1000-memory.dmp

Filesize
10.8MB

Download
memory/2284-51-0x00007FFA55E30000-0x00007FFA568F1000-memory.dmp

Filesize
10.8MB

Download
memory/2284-164-0x000001B0F2060000-0x000001B0F2082000-memory.dmp

Filesize
136KB

Download
memory/2284-19-0x00007FFA55E33000-0x00007FFA55E35000-memory.dmp

Filesize
8KB

Download
memory/2372-266-0x00007FF68A830000-0x00007FF68AC22000-memory.dmp

Filesize
3.9MB

Download
memory/2372-3340-0x00007FF68A830000-0x00007FF68AC22000-memory.dmp

Filesize
3.9MB

Download
memory/2740-3326-0x00007FF726AD0000-0x00007FF726EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-264-0x00007FF726AD0000-0x00007FF726EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-262-0x00007FF7DFD90000-0x00007FF7E0182000-memory.dmp

Filesize
3.9MB

Download
memory/2848-3331-0x00007FF7DFD90000-0x00007FF7E0182000-memory.dmp

Filesize
3.9MB

Download
memory/2852-0-0x00007FF789D40000-0x00007FF78A132000-memory.dmp

Filesize
3.9MB

Download
memory/2852-1-0x0000015CCADC0000-0x0000015CCADD0000-memory.dmp

Filesize
64KB

Download
memory/2984-269-0x00007FF70FE20000-0x00007FF710212000-memory.dmp

Filesize
3.9MB

Download
memory/2984-3298-0x00007FF70FE20000-0x00007FF710212000-memory.dmp

Filesize
3.9MB

Download
memory/3168-256-0x00007FF70A7E0000-0x00007FF70ABD2000-memory.dmp

Filesize
3.9MB

Download
memory/3168-3321-0x00007FF70A7E0000-0x00007FF70ABD2000-memory.dmp

Filesize
3.9MB

Download
memory/3276-3307-0x00007FF6F4120000-0x00007FF6F4512000-memory.dmp

Filesize
3.9MB

Download
memory/3276-251-0x00007FF6F4120000-0x00007FF6F4512000-memory.dmp

Filesize
3.9MB

Download
memory/3324-265-0x00007FF774030000-0x00007FF774422000-memory.dmp

Filesize
3.9MB

Download
memory/3324-3328-0x00007FF774030000-0x00007FF774422000-memory.dmp

Filesize
3.9MB

Download
memory/3572-3303-0x00007FF760AD0000-0x00007FF760EC2000-memory.dmp

Filesize
3.9MB

Download
memory/3572-202-0x00007FF760AD0000-0x00007FF760EC2000-memory.dmp

Filesize
3.9MB

Download
memory/3628-3343-0x00007FF7FE460000-0x00007FF7FE852000-memory.dmp

Filesize
3.9MB

Download
memory/3628-258-0x00007FF7FE460000-0x00007FF7FE852000-memory.dmp

Filesize
3.9MB

Download
memory/3936-17-0x00007FF6D7340000-0x00007FF6D7732000-memory.dmp

Filesize
3.9MB

Download
memory/3936-3293-0x00007FF6D7340000-0x00007FF6D7732000-memory.dmp

Filesize
3.9MB

Download
memory/3936-3286-0x00007FF6D7340000-0x00007FF6D7732000-memory.dmp

Filesize
3.9MB

Download
memory/4352-263-0x00007FF6F2BC0000-0x00007FF6F2FB2000-memory.dmp

Filesize
3.9MB

Download
memory/4352-3333-0x00007FF6F2BC0000-0x00007FF6F2FB2000-memory.dmp

Filesize
3.9MB

Download
memory/4568-3317-0x00007FF6B6DB0000-0x00007FF6B71A2000-memory.dmp

Filesize
3.9MB

Download
memory/4568-271-0x00007FF6B6DB0000-0x00007FF6B71A2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-3315-0x00007FF7D95E0000-0x00007FF7D99D2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-259-0x00007FF7D95E0000-0x00007FF7D99D2000-memory.dmp

Filesize
3.9MB

Download
memory/4880-240-0x00007FF7F02A0000-0x00007FF7F0692000-memory.dmp

Filesize
3.9MB

Download
memory/4880-3305-0x00007FF7F02A0000-0x00007FF7F0692000-memory.dmp

Filesize
3.9MB

Download
memory/4892-261-0x00007FF613DB0000-0x00007FF6141A2000-memory.dmp

Filesize
3.9MB

Download
memory/4892-3324-0x00007FF613DB0000-0x00007FF6141A2000-memory.dmp

Filesize
3.9MB

Download
memory/4952-136-0x00007FF7811F0000-0x00007FF7815E2000-memory.dmp

Filesize
3.9MB

Download
memory/4952-3295-0x00007FF7811F0000-0x00007FF7815E2000-memory.dmp

Filesize
3.9MB

Download