xmrig | 4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747

Analysis

max time kernel
144s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
Size

1.9MB
MD5

36191f21eb377277725e12ac268f6640
SHA1

20fdcdf3dd6fbc4ef399e8b75a58ea24ddecd733
SHA256

4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747
SHA512

1e7ccf070c45015d5bc2134e6474148d29c42e20fbec653a306f31cf0da0af7cfdf192a093b6e08d9fd298ae62abd69b90b7fe238374f94f92572e309f662556
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boK:Lz071uv4BPMkiFGlObO11jB7aH4

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/560-226-0x00007FF795CF0000-0x00007FF7960E2000-memory.dmp	xmrig
behavioral2/memory/5052-249-0x00007FF701BC0000-0x00007FF701FB2000-memory.dmp	xmrig
behavioral2/memory/2660-252-0x00007FF797800000-0x00007FF797BF2000-memory.dmp	xmrig
behavioral2/memory/5056-254-0x00007FF72DCB0000-0x00007FF72E0A2000-memory.dmp	xmrig
behavioral2/memory/4044-257-0x00007FF654170000-0x00007FF654562000-memory.dmp	xmrig
behavioral2/memory/3468-356-0x00007FF76F680000-0x00007FF76FA72000-memory.dmp	xmrig
behavioral2/memory/2572-376-0x00007FF6BFE50000-0x00007FF6C0242000-memory.dmp	xmrig
behavioral2/memory/3640-398-0x00007FF797D20000-0x00007FF798112000-memory.dmp	xmrig
behavioral2/memory/1204-432-0x00007FF7AE6F0000-0x00007FF7AEAE2000-memory.dmp	xmrig
behavioral2/memory/2912-504-0x00007FF6A0430000-0x00007FF6A0822000-memory.dmp	xmrig
behavioral2/memory/4784-431-0x00007FF64E9C0000-0x00007FF64EDB2000-memory.dmp	xmrig
behavioral2/memory/4464-395-0x00007FF66CCA0000-0x00007FF66D092000-memory.dmp	xmrig
behavioral2/memory/3036-375-0x00007FF7FEE60000-0x00007FF7FF252000-memory.dmp	xmrig
behavioral2/memory/4020-338-0x00007FF7D6D20000-0x00007FF7D7112000-memory.dmp	xmrig
behavioral2/memory/1528-259-0x00007FF60E6C0000-0x00007FF60EAB2000-memory.dmp	xmrig
behavioral2/memory/1568-258-0x00007FF728880000-0x00007FF728C72000-memory.dmp	xmrig
behavioral2/memory/4964-256-0x00007FF667D70000-0x00007FF668162000-memory.dmp	xmrig
behavioral2/memory/3048-255-0x00007FF6EFB50000-0x00007FF6EFF42000-memory.dmp	xmrig
behavioral2/memory/4948-253-0x00007FF707740000-0x00007FF707B32000-memory.dmp	xmrig
behavioral2/memory/2984-251-0x00007FF7A02F0000-0x00007FF7A06E2000-memory.dmp	xmrig
behavioral2/memory/1460-250-0x00007FF6B5B50000-0x00007FF6B5F42000-memory.dmp	xmrig
behavioral2/memory/4804-248-0x00007FF74AA10000-0x00007FF74AE02000-memory.dmp	xmrig
behavioral2/memory/1636-90-0x00007FF6AA6A0000-0x00007FF6AAA92000-memory.dmp	xmrig
behavioral2/memory/976-11-0x00007FF7C8340000-0x00007FF7C8732000-memory.dmp	xmrig
behavioral2/memory/560-5214-0x00007FF795CF0000-0x00007FF7960E2000-memory.dmp	xmrig
behavioral2/memory/2572-5370-0x00007FF6BFE50000-0x00007FF6C0242000-memory.dmp	xmrig
behavioral2/memory/3640-5482-0x00007FF797D20000-0x00007FF798112000-memory.dmp	xmrig
behavioral2/memory/4464-5423-0x00007FF66CCA0000-0x00007FF66D092000-memory.dmp	xmrig
behavioral2/memory/5056-5378-0x00007FF72DCB0000-0x00007FF72E0A2000-memory.dmp	xmrig
behavioral2/memory/3468-5374-0x00007FF76F680000-0x00007FF76FA72000-memory.dmp	xmrig
behavioral2/memory/4948-5371-0x00007FF707740000-0x00007FF707B32000-memory.dmp	xmrig
behavioral2/memory/3036-5364-0x00007FF7FEE60000-0x00007FF7FF252000-memory.dmp	xmrig
behavioral2/memory/4044-5361-0x00007FF654170000-0x00007FF654562000-memory.dmp	xmrig
behavioral2/memory/2984-5356-0x00007FF7A02F0000-0x00007FF7A06E2000-memory.dmp	xmrig
behavioral2/memory/1460-5252-0x00007FF6B5B50000-0x00007FF6B5F42000-memory.dmp	xmrig
behavioral2/memory/4784-5203-0x00007FF64E9C0000-0x00007FF64EDB2000-memory.dmp	xmrig
behavioral2/memory/4804-5218-0x00007FF74AA10000-0x00007FF74AE02000-memory.dmp	xmrig
behavioral2/memory/1636-5208-0x00007FF6AA6A0000-0x00007FF6AAA92000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3288	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
976	sXezTOd.exe
1636	xopPtYi.exe
560	BPAvAWE.exe
4784	HpussmB.exe
4804	SvXQChE.exe
5052	lreVOgw.exe
1460	TLXhgSB.exe
2984	shDUuXr.exe
2660	NaWftZk.exe
4948	EmXpUGG.exe
5056	nWRJqIV.exe
3048	SIzcvDT.exe
4964	dGNdKhY.exe
4044	ISNJFsT.exe
1204	CGBVeoM.exe
1568	TPugcYG.exe
1528	DvKLEWJ.exe
4020	VNDEBxN.exe
2912	tAsmZIF.exe
3468	MoBPSPw.exe
3036	htkAhCE.exe
2572	ZALqYuk.exe
4464	zUqwfdP.exe
3640	vuCzRbp.exe
3744	bxPHItk.exe
3912	FTJQRMz.exe
3536	KNaJgfo.exe
1408	xiAnFCt.exe
972	ObxLxPF.exe
2968	bBOLgCS.exe
5060	nBepZpi.exe
1716	JsgrEwa.exe
3184	CceSHGR.exe
3312	eWODQek.exe
3176	NoJlmco.exe
3484	ouXspuD.exe
4572	PgYhOgg.exe
2384	XIpKcZx.exe
4408	CzQgKgC.exe
2620	vLNpnui.exe
2412	GsRRjoC.exe
1436	VPEhihr.exe
1892	uGrnSIO.exe
2152	OXrUkOh.exe
2920	rPYirBJ.exe
4756	EleniOn.exe
3408	cRpmTIM.exe
1812	IaqQyCl.exe
2960	fqQQQUc.exe
4620	DGXZzUT.exe
4388	OPzFsar.exe
1336	RQPEIvP.exe
4696	PjysJox.exe
556	HftLFzz.exe
4344	hPHYfpm.exe
936	JgDjApN.exe
2444	pnXUcpO.exe
4980	RIvnglL.exe
764	GkFTrjS.exe
5108	ZOZOdRt.exe
1572	NZLiynq.exe
1096	YGqoVYq.exe
3308	oedBIFp.exe
4428	HjLZEva.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4260-0-0x00007FF72FB40000-0x00007FF72FF32000-memory.dmp	upx
behavioral2/files/0x0007000000023468-9.dat	upx
behavioral2/files/0x000700000002346a-38.dat	upx
behavioral2/files/0x000700000002346e-47.dat	upx
behavioral2/files/0x0007000000023475-94.dat	upx
behavioral2/files/0x000700000002347f-117.dat	upx
behavioral2/files/0x000700000002347e-196.dat	upx
behavioral2/memory/560-226-0x00007FF795CF0000-0x00007FF7960E2000-memory.dmp	upx
behavioral2/memory/5052-249-0x00007FF701BC0000-0x00007FF701FB2000-memory.dmp	upx
behavioral2/memory/2660-252-0x00007FF797800000-0x00007FF797BF2000-memory.dmp	upx
behavioral2/memory/5056-254-0x00007FF72DCB0000-0x00007FF72E0A2000-memory.dmp	upx
behavioral2/memory/4044-257-0x00007FF654170000-0x00007FF654562000-memory.dmp	upx
behavioral2/memory/3468-356-0x00007FF76F680000-0x00007FF76FA72000-memory.dmp	upx
behavioral2/memory/2572-376-0x00007FF6BFE50000-0x00007FF6C0242000-memory.dmp	upx
behavioral2/memory/3640-398-0x00007FF797D20000-0x00007FF798112000-memory.dmp	upx
behavioral2/memory/1204-432-0x00007FF7AE6F0000-0x00007FF7AEAE2000-memory.dmp	upx
behavioral2/memory/2912-504-0x00007FF6A0430000-0x00007FF6A0822000-memory.dmp	upx
behavioral2/memory/4784-431-0x00007FF64E9C0000-0x00007FF64EDB2000-memory.dmp	upx
behavioral2/memory/4464-395-0x00007FF66CCA0000-0x00007FF66D092000-memory.dmp	upx
behavioral2/memory/3036-375-0x00007FF7FEE60000-0x00007FF7FF252000-memory.dmp	upx
behavioral2/memory/4020-338-0x00007FF7D6D20000-0x00007FF7D7112000-memory.dmp	upx
behavioral2/memory/1528-259-0x00007FF60E6C0000-0x00007FF60EAB2000-memory.dmp	upx
behavioral2/memory/1568-258-0x00007FF728880000-0x00007FF728C72000-memory.dmp	upx
behavioral2/memory/4964-256-0x00007FF667D70000-0x00007FF668162000-memory.dmp	upx
behavioral2/memory/3048-255-0x00007FF6EFB50000-0x00007FF6EFF42000-memory.dmp	upx
behavioral2/memory/4948-253-0x00007FF707740000-0x00007FF707B32000-memory.dmp	upx
behavioral2/memory/2984-251-0x00007FF7A02F0000-0x00007FF7A06E2000-memory.dmp	upx
behavioral2/memory/1460-250-0x00007FF6B5B50000-0x00007FF6B5F42000-memory.dmp	upx
behavioral2/memory/4804-248-0x00007FF74AA10000-0x00007FF74AE02000-memory.dmp	upx
behavioral2/files/0x000700000002348b-215.dat	upx
behavioral2/files/0x0007000000023482-212.dat	upx
behavioral2/files/0x000700000002348a-209.dat	upx
behavioral2/files/0x000700000002347c-192.dat	upx
behavioral2/files/0x0007000000023481-186.dat	upx
behavioral2/files/0x000700000002347a-183.dat	upx
behavioral2/files/0x0007000000023487-180.dat	upx
behavioral2/files/0x0007000000023479-178.dat	upx
behavioral2/files/0x0007000000023486-177.dat	upx
behavioral2/files/0x0007000000023485-176.dat	upx
behavioral2/files/0x0007000000023483-156.dat	upx
behavioral2/files/0x000700000002347b-200.dat	upx
behavioral2/files/0x0007000000023488-182.dat	upx
behavioral2/files/0x0007000000023474-132.dat	upx
behavioral2/files/0x0007000000023484-161.dat	upx
behavioral2/files/0x0007000000023472-121.dat	upx
behavioral2/files/0x0007000000023478-116.dat	upx
behavioral2/files/0x000700000002347d-112.dat	upx
behavioral2/files/0x0007000000023477-110.dat	upx
behavioral2/files/0x0007000000023480-127.dat	upx
behavioral2/files/0x0007000000023473-104.dat	upx
behavioral2/files/0x0007000000023470-103.dat	upx
behavioral2/files/0x0007000000023471-101.dat	upx
behavioral2/files/0x000700000002346f-93.dat	upx
behavioral2/memory/1636-90-0x00007FF6AA6A0000-0x00007FF6AAA92000-memory.dmp	upx
behavioral2/files/0x0007000000023476-82.dat	upx
behavioral2/files/0x000700000002346c-41.dat	upx
behavioral2/files/0x000700000002346d-44.dat	upx
behavioral2/files/0x000700000002346b-36.dat	upx
behavioral2/files/0x0007000000023469-26.dat	upx
behavioral2/files/0x0008000000023464-25.dat	upx
behavioral2/files/0x0009000000023404-7.dat	upx
behavioral2/memory/976-11-0x00007FF7C8340000-0x00007FF7C8732000-memory.dmp	upx
behavioral2/memory/560-5214-0x00007FF795CF0000-0x00007FF7960E2000-memory.dmp	upx
behavioral2/memory/2572-5370-0x00007FF6BFE50000-0x00007FF6C0242000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NMwxUwN.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\YDUuuVN.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\BVzdDeV.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\oaUotSP.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\plQiQzM.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\hsniJSU.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\zIiVNbP.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\tPhlZlK.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\hjvGZdE.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\aMBcDfP.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\zKpdtbZ.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\uZeGaZZ.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\anFmRyl.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\PQYuHGA.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\xJSdLop.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\mevMfAf.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\RDbCRzB.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\ZrXHsTT.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\zXjTOPU.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\jmLDYeJ.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\sZvImDt.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\Wnrxfjx.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\PZtRXpG.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\NGgRaDW.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\arzMtoR.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\DjiNwes.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\zoERYTz.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\bjFTNpJ.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\JfpHpBS.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\CviGDfv.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\SXCkPPo.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\kQmTteC.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\zhxMjLE.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\hNugoip.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\bEvqyfZ.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\qeoEUGc.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\CjDWYze.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\RAjKSlI.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\qlrJEUC.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\efqQRiY.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\EBaJnfm.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\GrTAINM.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\iZRHneu.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\ypFOIuE.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\ZDmWYfy.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\SywOKqU.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\OIybAcB.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\lpLvjet.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\TCfRrGQ.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\wPsOWWC.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\GSrkntA.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\tYdoFcO.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\RzEWgcO.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\qLZyBUO.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\zTYqRTN.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\RZoDXgG.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\FDihvyY.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\ZXTiSJI.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\dWlZgqa.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\qcMlLiM.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\nupCzKo.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\CIheAhw.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\bmVhqJz.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
File created	C:\Windows\System\YxliYZc.exe	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3288	powershell.exe
3288	powershell.exe
3288	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
Token: SeLockMemoryPrivilege	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
Token: SeDebugPrivilege	3288	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 3288	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	84
PID 4260 wrote to memory of 3288	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	84
PID 4260 wrote to memory of 976	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	85
PID 4260 wrote to memory of 976	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	85
PID 4260 wrote to memory of 1636	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	86
PID 4260 wrote to memory of 1636	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	86
PID 4260 wrote to memory of 560	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	87
PID 4260 wrote to memory of 560	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	87
PID 4260 wrote to memory of 4784	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	88
PID 4260 wrote to memory of 4784	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	88
PID 4260 wrote to memory of 4804	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	89
PID 4260 wrote to memory of 4804	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	89
PID 4260 wrote to memory of 5052	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	90
PID 4260 wrote to memory of 5052	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	90
PID 4260 wrote to memory of 1460	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	91
PID 4260 wrote to memory of 1460	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	91
PID 4260 wrote to memory of 2984	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	92
PID 4260 wrote to memory of 2984	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	92
PID 4260 wrote to memory of 2660	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	93
PID 4260 wrote to memory of 2660	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	93
PID 4260 wrote to memory of 4948	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	94
PID 4260 wrote to memory of 4948	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	94
PID 4260 wrote to memory of 5056	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	95
PID 4260 wrote to memory of 5056	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	95
PID 4260 wrote to memory of 3048	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	96
PID 4260 wrote to memory of 3048	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	96
PID 4260 wrote to memory of 4964	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	97
PID 4260 wrote to memory of 4964	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	97
PID 4260 wrote to memory of 4044	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	98
PID 4260 wrote to memory of 4044	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	98
PID 4260 wrote to memory of 1204	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	99
PID 4260 wrote to memory of 1204	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	99
PID 4260 wrote to memory of 1568	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	100
PID 4260 wrote to memory of 1568	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	100
PID 4260 wrote to memory of 1528	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	101
PID 4260 wrote to memory of 1528	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	101
PID 4260 wrote to memory of 4020	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	102
PID 4260 wrote to memory of 4020	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	102
PID 4260 wrote to memory of 2912	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	103
PID 4260 wrote to memory of 2912	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	103
PID 4260 wrote to memory of 3468	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	104
PID 4260 wrote to memory of 3468	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	104
PID 4260 wrote to memory of 3036	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	105
PID 4260 wrote to memory of 3036	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	105
PID 4260 wrote to memory of 2572	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	106
PID 4260 wrote to memory of 2572	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	106
PID 4260 wrote to memory of 4464	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	107
PID 4260 wrote to memory of 4464	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	107
PID 4260 wrote to memory of 3640	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	108
PID 4260 wrote to memory of 3640	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	108
PID 4260 wrote to memory of 3744	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	109
PID 4260 wrote to memory of 3744	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	109
PID 4260 wrote to memory of 3912	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	110
PID 4260 wrote to memory of 3912	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	110
PID 4260 wrote to memory of 3536	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	111
PID 4260 wrote to memory of 3536	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	111
PID 4260 wrote to memory of 1408	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	112
PID 4260 wrote to memory of 1408	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	112
PID 4260 wrote to memory of 972	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	113
PID 4260 wrote to memory of 972	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	113
PID 4260 wrote to memory of 2968	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	114
PID 4260 wrote to memory of 2968	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	114
PID 4260 wrote to memory of 5060	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	115
PID 4260 wrote to memory of 5060	4260	4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe	115

C:\Users\Admin\AppData\Local\Temp\4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe
"C:\Users\Admin\AppData\Local\Temp\4697774240b01c3a6c6fe767c732622b13fddfdfdd582d4848f2c2a7ce7e6747.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3288
- C:\Windows\System\sXezTOd.exe
  C:\Windows\System\sXezTOd.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\xopPtYi.exe
  C:\Windows\System\xopPtYi.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\BPAvAWE.exe
  C:\Windows\System\BPAvAWE.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\HpussmB.exe
  C:\Windows\System\HpussmB.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\SvXQChE.exe
  C:\Windows\System\SvXQChE.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\lreVOgw.exe
  C:\Windows\System\lreVOgw.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\TLXhgSB.exe
  C:\Windows\System\TLXhgSB.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\shDUuXr.exe
  C:\Windows\System\shDUuXr.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\NaWftZk.exe
  C:\Windows\System\NaWftZk.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\EmXpUGG.exe
  C:\Windows\System\EmXpUGG.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\nWRJqIV.exe
  C:\Windows\System\nWRJqIV.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\SIzcvDT.exe
  C:\Windows\System\SIzcvDT.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\dGNdKhY.exe
  C:\Windows\System\dGNdKhY.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\ISNJFsT.exe
  C:\Windows\System\ISNJFsT.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\CGBVeoM.exe
  C:\Windows\System\CGBVeoM.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\TPugcYG.exe
  C:\Windows\System\TPugcYG.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\DvKLEWJ.exe
  C:\Windows\System\DvKLEWJ.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\VNDEBxN.exe
  C:\Windows\System\VNDEBxN.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\tAsmZIF.exe
  C:\Windows\System\tAsmZIF.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\MoBPSPw.exe
  C:\Windows\System\MoBPSPw.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\htkAhCE.exe
  C:\Windows\System\htkAhCE.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\ZALqYuk.exe
  C:\Windows\System\ZALqYuk.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\zUqwfdP.exe
  C:\Windows\System\zUqwfdP.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\vuCzRbp.exe
  C:\Windows\System\vuCzRbp.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\bxPHItk.exe
  C:\Windows\System\bxPHItk.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\FTJQRMz.exe
  C:\Windows\System\FTJQRMz.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\KNaJgfo.exe
  C:\Windows\System\KNaJgfo.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\xiAnFCt.exe
  C:\Windows\System\xiAnFCt.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\ObxLxPF.exe
  C:\Windows\System\ObxLxPF.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\bBOLgCS.exe
  C:\Windows\System\bBOLgCS.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\nBepZpi.exe
  C:\Windows\System\nBepZpi.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\JsgrEwa.exe
  C:\Windows\System\JsgrEwa.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\CceSHGR.exe
  C:\Windows\System\CceSHGR.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\eWODQek.exe
  C:\Windows\System\eWODQek.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\NoJlmco.exe
  C:\Windows\System\NoJlmco.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\RQPEIvP.exe
  C:\Windows\System\RQPEIvP.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\ouXspuD.exe
  C:\Windows\System\ouXspuD.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\PgYhOgg.exe
  C:\Windows\System\PgYhOgg.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\XIpKcZx.exe
  C:\Windows\System\XIpKcZx.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\CzQgKgC.exe
  C:\Windows\System\CzQgKgC.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\vLNpnui.exe
  C:\Windows\System\vLNpnui.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\GsRRjoC.exe
  C:\Windows\System\GsRRjoC.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\VPEhihr.exe
  C:\Windows\System\VPEhihr.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\uGrnSIO.exe
  C:\Windows\System\uGrnSIO.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\OXrUkOh.exe
  C:\Windows\System\OXrUkOh.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\rPYirBJ.exe
  C:\Windows\System\rPYirBJ.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\EleniOn.exe
  C:\Windows\System\EleniOn.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\cRpmTIM.exe
  C:\Windows\System\cRpmTIM.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\IaqQyCl.exe
  C:\Windows\System\IaqQyCl.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\fqQQQUc.exe
  C:\Windows\System\fqQQQUc.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\DGXZzUT.exe
  C:\Windows\System\DGXZzUT.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\OPzFsar.exe
  C:\Windows\System\OPzFsar.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\PjysJox.exe
  C:\Windows\System\PjysJox.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\HftLFzz.exe
  C:\Windows\System\HftLFzz.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\hPHYfpm.exe
  C:\Windows\System\hPHYfpm.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\JgDjApN.exe
  C:\Windows\System\JgDjApN.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\pnXUcpO.exe
  C:\Windows\System\pnXUcpO.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\RIvnglL.exe
  C:\Windows\System\RIvnglL.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\GkFTrjS.exe
  C:\Windows\System\GkFTrjS.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\ZOZOdRt.exe
  C:\Windows\System\ZOZOdRt.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\RMneeyR.exe
  C:\Windows\System\RMneeyR.exe
  2⤵
  PID:4640
- C:\Windows\System\NZLiynq.exe
  C:\Windows\System\NZLiynq.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\YGqoVYq.exe
  C:\Windows\System\YGqoVYq.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\oedBIFp.exe
  C:\Windows\System\oedBIFp.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\HjLZEva.exe
  C:\Windows\System\HjLZEva.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\GQTUjEI.exe
  C:\Windows\System\GQTUjEI.exe
  2⤵
  PID:1828
- C:\Windows\System\ViHdUaa.exe
  C:\Windows\System\ViHdUaa.exe
  2⤵
  PID:5024
- C:\Windows\System\jKdzYqh.exe
  C:\Windows\System\jKdzYqh.exe
  2⤵
  PID:2556
- C:\Windows\System\BJXwrie.exe
  C:\Windows\System\BJXwrie.exe
  2⤵
  PID:400
- C:\Windows\System\UseHieA.exe
  C:\Windows\System\UseHieA.exe
  2⤵
  PID:2508
- C:\Windows\System\ldUuPdB.exe
  C:\Windows\System\ldUuPdB.exe
  2⤵
  PID:1640
- C:\Windows\System\VcoIEPl.exe
  C:\Windows\System\VcoIEPl.exe
  2⤵
  PID:1560
- C:\Windows\System\BTqedyB.exe
  C:\Windows\System\BTqedyB.exe
  2⤵
  PID:888
- C:\Windows\System\sNQncmY.exe
  C:\Windows\System\sNQncmY.exe
  2⤵
  PID:2908
- C:\Windows\System\vnSsBUk.exe
  C:\Windows\System\vnSsBUk.exe
  2⤵
  PID:3792
- C:\Windows\System\oOjkjJI.exe
  C:\Windows\System\oOjkjJI.exe
  2⤵
  PID:2536
- C:\Windows\System\QCNoxYD.exe
  C:\Windows\System\QCNoxYD.exe
  2⤵
  PID:1724
- C:\Windows\System\jjIMGgR.exe
  C:\Windows\System\jjIMGgR.exe
  2⤵
  PID:3540
- C:\Windows\System\LkgRScm.exe
  C:\Windows\System\LkgRScm.exe
  2⤵
  PID:2928
- C:\Windows\System\qySevtH.exe
  C:\Windows\System\qySevtH.exe
  2⤵
  PID:1964
- C:\Windows\System\rmQxqms.exe
  C:\Windows\System\rmQxqms.exe
  2⤵
  PID:2344
- C:\Windows\System\PPPrJxS.exe
  C:\Windows\System\PPPrJxS.exe
  2⤵
  PID:844
- C:\Windows\System\HbooAuj.exe
  C:\Windows\System\HbooAuj.exe
  2⤵
  PID:4688
- C:\Windows\System\ljPgkEc.exe
  C:\Windows\System\ljPgkEc.exe
  2⤵
  PID:4720
- C:\Windows\System\lkxKPSf.exe
  C:\Windows\System\lkxKPSf.exe
  2⤵
  PID:1696
- C:\Windows\System\VzNMQSa.exe
  C:\Windows\System\VzNMQSa.exe
  2⤵
  PID:1324
- C:\Windows\System\vamOsHS.exe
  C:\Windows\System\vamOsHS.exe
  2⤵
  PID:1424
- C:\Windows\System\kepxUbO.exe
  C:\Windows\System\kepxUbO.exe
  2⤵
  PID:4088
- C:\Windows\System\RbmrmVQ.exe
  C:\Windows\System\RbmrmVQ.exe
  2⤵
  PID:4904
- C:\Windows\System\HYCNTNE.exe
  C:\Windows\System\HYCNTNE.exe
  2⤵
  PID:5124
- C:\Windows\System\PUtHBMb.exe
  C:\Windows\System\PUtHBMb.exe
  2⤵
  PID:5144
- C:\Windows\System\cJapyHK.exe
  C:\Windows\System\cJapyHK.exe
  2⤵
  PID:5168
- C:\Windows\System\uAjVZqZ.exe
  C:\Windows\System\uAjVZqZ.exe
  2⤵
  PID:5184
- C:\Windows\System\wSUazIL.exe
  C:\Windows\System\wSUazIL.exe
  2⤵
  PID:5208
- C:\Windows\System\guuRlgO.exe
  C:\Windows\System\guuRlgO.exe
  2⤵
  PID:5232
- C:\Windows\System\vICaHZZ.exe
  C:\Windows\System\vICaHZZ.exe
  2⤵
  PID:5252
- C:\Windows\System\jgQKQWo.exe
  C:\Windows\System\jgQKQWo.exe
  2⤵
  PID:5368
- C:\Windows\System\GzmefhV.exe
  C:\Windows\System\GzmefhV.exe
  2⤵
  PID:5392
- C:\Windows\System\skqqzYh.exe
  C:\Windows\System\skqqzYh.exe
  2⤵
  PID:5412
- C:\Windows\System\PurhjyB.exe
  C:\Windows\System\PurhjyB.exe
  2⤵
  PID:5432
- C:\Windows\System\FMvpVYx.exe
  C:\Windows\System\FMvpVYx.exe
  2⤵
  PID:5452
- C:\Windows\System\VVVYlsh.exe
  C:\Windows\System\VVVYlsh.exe
  2⤵
  PID:5476
- C:\Windows\System\JIRXtdZ.exe
  C:\Windows\System\JIRXtdZ.exe
  2⤵
  PID:5496
- C:\Windows\System\BcnfRrX.exe
  C:\Windows\System\BcnfRrX.exe
  2⤵
  PID:5528
- C:\Windows\System\vfsIwTD.exe
  C:\Windows\System\vfsIwTD.exe
  2⤵
  PID:5544
- C:\Windows\System\rjqLRBx.exe
  C:\Windows\System\rjqLRBx.exe
  2⤵
  PID:5564
- C:\Windows\System\XjUcTSu.exe
  C:\Windows\System\XjUcTSu.exe
  2⤵
  PID:5680
- C:\Windows\System\kbmjcvD.exe
  C:\Windows\System\kbmjcvD.exe
  2⤵
  PID:5712
- C:\Windows\System\JxlCfIO.exe
  C:\Windows\System\JxlCfIO.exe
  2⤵
  PID:5732
- C:\Windows\System\LHeFRYX.exe
  C:\Windows\System\LHeFRYX.exe
  2⤵
  PID:5752
- C:\Windows\System\rTtddUL.exe
  C:\Windows\System\rTtddUL.exe
  2⤵
  PID:5776
- C:\Windows\System\MkmohDO.exe
  C:\Windows\System\MkmohDO.exe
  2⤵
  PID:5792
- C:\Windows\System\SatbTky.exe
  C:\Windows\System\SatbTky.exe
  2⤵
  PID:5912
- C:\Windows\System\EmxmkMD.exe
  C:\Windows\System\EmxmkMD.exe
  2⤵
  PID:5932
- C:\Windows\System\JGUCTuf.exe
  C:\Windows\System\JGUCTuf.exe
  2⤵
  PID:5956
- C:\Windows\System\KjCUesZ.exe
  C:\Windows\System\KjCUesZ.exe
  2⤵
  PID:5972
- C:\Windows\System\PzvGRRZ.exe
  C:\Windows\System\PzvGRRZ.exe
  2⤵
  PID:5996
- C:\Windows\System\tcDqIVD.exe
  C:\Windows\System\tcDqIVD.exe
  2⤵
  PID:6016
- C:\Windows\System\kRyRlUB.exe
  C:\Windows\System\kRyRlUB.exe
  2⤵
  PID:6036
- C:\Windows\System\piwgAdc.exe
  C:\Windows\System\piwgAdc.exe
  2⤵
  PID:6060
- C:\Windows\System\OkIorcm.exe
  C:\Windows\System\OkIorcm.exe
  2⤵
  PID:6080
- C:\Windows\System\spAARwa.exe
  C:\Windows\System\spAARwa.exe
  2⤵
  PID:6100
- C:\Windows\System\xzENTFt.exe
  C:\Windows\System\xzENTFt.exe
  2⤵
  PID:6124
- C:\Windows\System\wnijofh.exe
  C:\Windows\System\wnijofh.exe
  2⤵
  PID:1348
- C:\Windows\System\QfLXXsV.exe
  C:\Windows\System\QfLXXsV.exe
  2⤵
  PID:3244
- C:\Windows\System\OpQxqan.exe
  C:\Windows\System\OpQxqan.exe
  2⤵
  PID:5512
- C:\Windows\System\PALqxcc.exe
  C:\Windows\System\PALqxcc.exe
  2⤵
  PID:1020
- C:\Windows\System\UiugCoV.exe
  C:\Windows\System\UiugCoV.exe
  2⤵
  PID:4752
- C:\Windows\System\akKmPND.exe
  C:\Windows\System\akKmPND.exe
  2⤵
  PID:3112
- C:\Windows\System\SEFCfSQ.exe
  C:\Windows\System\SEFCfSQ.exe
  2⤵
  PID:4820
- C:\Windows\System\LEmctRh.exe
  C:\Windows\System\LEmctRh.exe
  2⤵
  PID:3200
- C:\Windows\System\LxtRuHJ.exe
  C:\Windows\System\LxtRuHJ.exe
  2⤵
  PID:1244
- C:\Windows\System\LbaVlwp.exe
  C:\Windows\System\LbaVlwp.exe
  2⤵
  PID:532
- C:\Windows\System\hCQUXUX.exe
  C:\Windows\System\hCQUXUX.exe
  2⤵
  PID:1844
- C:\Windows\System\kBSKRRN.exe
  C:\Windows\System\kBSKRRN.exe
  2⤵
  PID:2436
- C:\Windows\System\cPZZnpg.exe
  C:\Windows\System\cPZZnpg.exe
  2⤵
  PID:4092
- C:\Windows\System\xWAlgqa.exe
  C:\Windows\System\xWAlgqa.exe
  2⤵
  PID:5136
- C:\Windows\System\XPeSkws.exe
  C:\Windows\System\XPeSkws.exe
  2⤵
  PID:5192
- C:\Windows\System\FESwFyV.exe
  C:\Windows\System\FESwFyV.exe
  2⤵
  PID:5220
- C:\Windows\System\KSIsmwt.exe
  C:\Windows\System\KSIsmwt.exe
  2⤵
  PID:5336
- C:\Windows\System\txxBhgW.exe
  C:\Windows\System\txxBhgW.exe
  2⤵
  PID:5384
- C:\Windows\System\ImphyDD.exe
  C:\Windows\System\ImphyDD.exe
  2⤵
  PID:5444
- C:\Windows\System\szgtZkP.exe
  C:\Windows\System\szgtZkP.exe
  2⤵
  PID:5484
- C:\Windows\System\nJHlPpC.exe
  C:\Windows\System\nJHlPpC.exe
  2⤵
  PID:5540
- C:\Windows\System\DfoSWaT.exe
  C:\Windows\System\DfoSWaT.exe
  2⤵
  PID:5608
- C:\Windows\System\jBPjRss.exe
  C:\Windows\System\jBPjRss.exe
  2⤵
  PID:6052
- C:\Windows\System\YtvAMPP.exe
  C:\Windows\System\YtvAMPP.exe
  2⤵
  PID:6120
- C:\Windows\System\gvbcJYY.exe
  C:\Windows\System\gvbcJYY.exe
  2⤵
  PID:6160
- C:\Windows\System\KTiJJUs.exe
  C:\Windows\System\KTiJJUs.exe
  2⤵
  PID:6184
- C:\Windows\System\ChINuPL.exe
  C:\Windows\System\ChINuPL.exe
  2⤵
  PID:6272
- C:\Windows\System\nXnzruJ.exe
  C:\Windows\System\nXnzruJ.exe
  2⤵
  PID:6292
- C:\Windows\System\DLUYNuX.exe
  C:\Windows\System\DLUYNuX.exe
  2⤵
  PID:6316
- C:\Windows\System\SyOjOMU.exe
  C:\Windows\System\SyOjOMU.exe
  2⤵
  PID:6340
- C:\Windows\System\oCWQqxb.exe
  C:\Windows\System\oCWQqxb.exe
  2⤵
  PID:6364
- C:\Windows\System\UkBqGzW.exe
  C:\Windows\System\UkBqGzW.exe
  2⤵
  PID:6380
- C:\Windows\System\UCaJPdJ.exe
  C:\Windows\System\UCaJPdJ.exe
  2⤵
  PID:6404
- C:\Windows\System\AiVwGEM.exe
  C:\Windows\System\AiVwGEM.exe
  2⤵
  PID:6420
- C:\Windows\System\RCTpsXc.exe
  C:\Windows\System\RCTpsXc.exe
  2⤵
  PID:6444
- C:\Windows\System\atoJtym.exe
  C:\Windows\System\atoJtym.exe
  2⤵
  PID:6468
- C:\Windows\System\IpLLYYZ.exe
  C:\Windows\System\IpLLYYZ.exe
  2⤵
  PID:6488
- C:\Windows\System\JqHcCOL.exe
  C:\Windows\System\JqHcCOL.exe
  2⤵
  PID:6512
- C:\Windows\System\RtRPDac.exe
  C:\Windows\System\RtRPDac.exe
  2⤵
  PID:6532
- C:\Windows\System\ZxvIIhO.exe
  C:\Windows\System\ZxvIIhO.exe
  2⤵
  PID:6552
- C:\Windows\System\iOUJpMO.exe
  C:\Windows\System\iOUJpMO.exe
  2⤵
  PID:6576
- C:\Windows\System\kyGndbS.exe
  C:\Windows\System\kyGndbS.exe
  2⤵
  PID:6596
- C:\Windows\System\MJQLuwO.exe
  C:\Windows\System\MJQLuwO.exe
  2⤵
  PID:6616
- C:\Windows\System\wTvbjNF.exe
  C:\Windows\System\wTvbjNF.exe
  2⤵
  PID:6652
- C:\Windows\System\DpeeEgJ.exe
  C:\Windows\System\DpeeEgJ.exe
  2⤵
  PID:6672
- C:\Windows\System\YxJyovz.exe
  C:\Windows\System\YxJyovz.exe
  2⤵
  PID:6688
- C:\Windows\System\EKAPQAa.exe
  C:\Windows\System\EKAPQAa.exe
  2⤵
  PID:6816
- C:\Windows\System\eUQYdpY.exe
  C:\Windows\System\eUQYdpY.exe
  2⤵
  PID:6836
- C:\Windows\System\TKmmAaz.exe
  C:\Windows\System\TKmmAaz.exe
  2⤵
  PID:6852
- C:\Windows\System\xTKyTsd.exe
  C:\Windows\System\xTKyTsd.exe
  2⤵
  PID:6876
- C:\Windows\System\MttGvsd.exe
  C:\Windows\System\MttGvsd.exe
  2⤵
  PID:6896
- C:\Windows\System\LkKCHrq.exe
  C:\Windows\System\LkKCHrq.exe
  2⤵
  PID:6916
- C:\Windows\System\HnpUzPt.exe
  C:\Windows\System\HnpUzPt.exe
  2⤵
  PID:6944
- C:\Windows\System\oISFXSz.exe
  C:\Windows\System\oISFXSz.exe
  2⤵
  PID:6964
- C:\Windows\System\cWTJFZc.exe
  C:\Windows\System\cWTJFZc.exe
  2⤵
  PID:6980
- C:\Windows\System\dLBxTWm.exe
  C:\Windows\System\dLBxTWm.exe
  2⤵
  PID:7004
- C:\Windows\System\OtGGWve.exe
  C:\Windows\System\OtGGWve.exe
  2⤵
  PID:7084
- C:\Windows\System\KaLGecm.exe
  C:\Windows\System\KaLGecm.exe
  2⤵
  PID:7108
- C:\Windows\System\sbMlWnu.exe
  C:\Windows\System\sbMlWnu.exe
  2⤵
  PID:7132
- C:\Windows\System\RESuemH.exe
  C:\Windows\System\RESuemH.exe
  2⤵
  PID:7152
- C:\Windows\System\ktENBKY.exe
  C:\Windows\System\ktENBKY.exe
  2⤵
  PID:5688
- C:\Windows\System\MioDxwe.exe
  C:\Windows\System\MioDxwe.exe
  2⤵
  PID:5724
- C:\Windows\System\qXMvqsS.exe
  C:\Windows\System\qXMvqsS.exe
  2⤵
  PID:5772
- C:\Windows\System\rrfBHOW.exe
  C:\Windows\System\rrfBHOW.exe
  2⤵
  PID:1668
- C:\Windows\System\cPgDilA.exe
  C:\Windows\System\cPgDilA.exe
  2⤵
  PID:1840
- C:\Windows\System\eLadUVy.exe
  C:\Windows\System\eLadUVy.exe
  2⤵
  PID:3724
- C:\Windows\System\TQBbVZI.exe
  C:\Windows\System\TQBbVZI.exe
  2⤵
  PID:6004
- C:\Windows\System\bcxLcNp.exe
  C:\Windows\System\bcxLcNp.exe
  2⤵
  PID:6032
- C:\Windows\System\fXvVoUa.exe
  C:\Windows\System\fXvVoUa.exe
  2⤵
  PID:5404
- C:\Windows\System\nnmehfE.exe
  C:\Windows\System\nnmehfE.exe
  2⤵
  PID:5492
- C:\Windows\System\ZsOtvmR.exe
  C:\Windows\System\ZsOtvmR.exe
  2⤵
  PID:6172
- C:\Windows\System\HTFFypC.exe
  C:\Windows\System\HTFFypC.exe
  2⤵
  PID:2304
- C:\Windows\System\oWfvXrE.exe
  C:\Windows\System\oWfvXrE.exe
  2⤵
  PID:5572
- C:\Windows\System\cNWAwsq.exe
  C:\Windows\System\cNWAwsq.exe
  2⤵
  PID:916
- C:\Windows\System\ajUtgWm.exe
  C:\Windows\System\ajUtgWm.exe
  2⤵
  PID:548
- C:\Windows\System\DHDVNAo.exe
  C:\Windows\System\DHDVNAo.exe
  2⤵
  PID:1648
- C:\Windows\System\deGjzRt.exe
  C:\Windows\System\deGjzRt.exe
  2⤵
  PID:2136
- C:\Windows\System\eDEXpPT.exe
  C:\Windows\System\eDEXpPT.exe
  2⤵
  PID:5536
- C:\Windows\System\BOnShYq.exe
  C:\Windows\System\BOnShYq.exe
  2⤵
  PID:6960
- C:\Windows\System\SBOkZiv.exe
  C:\Windows\System\SBOkZiv.exe
  2⤵
  PID:6996
- C:\Windows\System\doLiITq.exe
  C:\Windows\System\doLiITq.exe
  2⤵
  PID:6252
- C:\Windows\System\JFlbGjY.exe
  C:\Windows\System\JFlbGjY.exe
  2⤵
  PID:6288
- C:\Windows\System\AHHycrB.exe
  C:\Windows\System\AHHycrB.exe
  2⤵
  PID:6332
- C:\Windows\System\rZqcbNk.exe
  C:\Windows\System\rZqcbNk.exe
  2⤵
  PID:6400
- C:\Windows\System\PAqpwDv.exe
  C:\Windows\System\PAqpwDv.exe
  2⤵
  PID:6440
- C:\Windows\System\PeiqBlK.exe
  C:\Windows\System\PeiqBlK.exe
  2⤵
  PID:6480
- C:\Windows\System\CrGFGEI.exe
  C:\Windows\System\CrGFGEI.exe
  2⤵
  PID:6520
- C:\Windows\System\jcNtEbM.exe
  C:\Windows\System\jcNtEbM.exe
  2⤵
  PID:6560
- C:\Windows\System\mWoIRBz.exe
  C:\Windows\System\mWoIRBz.exe
  2⤵
  PID:6636
- C:\Windows\System\DHyFkAz.exe
  C:\Windows\System\DHyFkAz.exe
  2⤵
  PID:4744
- C:\Windows\System\zSZhvno.exe
  C:\Windows\System\zSZhvno.exe
  2⤵
  PID:448
- C:\Windows\System\HhegRtv.exe
  C:\Windows\System\HhegRtv.exe
  2⤵
  PID:5880
- C:\Windows\System\tYyQKyj.exe
  C:\Windows\System\tYyQKyj.exe
  2⤵
  PID:7184
- C:\Windows\System\hcExNIY.exe
  C:\Windows\System\hcExNIY.exe
  2⤵
  PID:7208
- C:\Windows\System\jIWzpOI.exe
  C:\Windows\System\jIWzpOI.exe
  2⤵
  PID:7232
- C:\Windows\System\rsDihVU.exe
  C:\Windows\System\rsDihVU.exe
  2⤵
  PID:7256
- C:\Windows\System\wwjAiDJ.exe
  C:\Windows\System\wwjAiDJ.exe
  2⤵
  PID:7280
- C:\Windows\System\VXGgoPQ.exe
  C:\Windows\System\VXGgoPQ.exe
  2⤵
  PID:7300
- C:\Windows\System\vIvzVyA.exe
  C:\Windows\System\vIvzVyA.exe
  2⤵
  PID:7324
- C:\Windows\System\wmLwLMN.exe
  C:\Windows\System\wmLwLMN.exe
  2⤵
  PID:7440
- C:\Windows\System\AlbQMCT.exe
  C:\Windows\System\AlbQMCT.exe
  2⤵
  PID:7464
- C:\Windows\System\wPsCEey.exe
  C:\Windows\System\wPsCEey.exe
  2⤵
  PID:7484
- C:\Windows\System\roJdjhk.exe
  C:\Windows\System\roJdjhk.exe
  2⤵
  PID:7508
- C:\Windows\System\xKEvxtK.exe
  C:\Windows\System\xKEvxtK.exe
  2⤵
  PID:7532
- C:\Windows\System\dUXgRjH.exe
  C:\Windows\System\dUXgRjH.exe
  2⤵
  PID:7556
- C:\Windows\System\mZxWOYU.exe
  C:\Windows\System\mZxWOYU.exe
  2⤵
  PID:7580
- C:\Windows\System\LTcxJlz.exe
  C:\Windows\System\LTcxJlz.exe
  2⤵
  PID:7612
- C:\Windows\System\wpCuhYY.exe
  C:\Windows\System\wpCuhYY.exe
  2⤵
  PID:7628
- C:\Windows\System\wOQHwYx.exe
  C:\Windows\System\wOQHwYx.exe
  2⤵
  PID:7652
- C:\Windows\System\RxwTLgU.exe
  C:\Windows\System\RxwTLgU.exe
  2⤵
  PID:7672
- C:\Windows\System\rpEHYlU.exe
  C:\Windows\System\rpEHYlU.exe
  2⤵
  PID:7692
- C:\Windows\System\ltYBYqv.exe
  C:\Windows\System\ltYBYqv.exe
  2⤵
  PID:7720
- C:\Windows\System\WHTwrdo.exe
  C:\Windows\System\WHTwrdo.exe
  2⤵
  PID:7740
- C:\Windows\System\ZMYCUqN.exe
  C:\Windows\System\ZMYCUqN.exe
  2⤵
  PID:7756
- C:\Windows\System\htaXzgm.exe
  C:\Windows\System\htaXzgm.exe
  2⤵
  PID:7780
- C:\Windows\System\YaNrwtB.exe
  C:\Windows\System\YaNrwtB.exe
  2⤵
  PID:7796
- C:\Windows\System\crtpeeO.exe
  C:\Windows\System\crtpeeO.exe
  2⤵
  PID:7820
- C:\Windows\System\HMkHBIP.exe
  C:\Windows\System\HMkHBIP.exe
  2⤵
  PID:7844
- C:\Windows\System\qSwJaNf.exe
  C:\Windows\System\qSwJaNf.exe
  2⤵
  PID:7872
- C:\Windows\System\jchoDwl.exe
  C:\Windows\System\jchoDwl.exe
  2⤵
  PID:7976
- C:\Windows\System\cQAzBav.exe
  C:\Windows\System\cQAzBav.exe
  2⤵
  PID:7996
- C:\Windows\System\gereLNS.exe
  C:\Windows\System\gereLNS.exe
  2⤵
  PID:8020
- C:\Windows\System\nQxfetc.exe
  C:\Windows\System\nQxfetc.exe
  2⤵
  PID:8040
- C:\Windows\System\eijxZpd.exe
  C:\Windows\System\eijxZpd.exe
  2⤵
  PID:8060
- C:\Windows\System\aUlYCmX.exe
  C:\Windows\System\aUlYCmX.exe
  2⤵
  PID:8084
- C:\Windows\System\XLIxZgl.exe
  C:\Windows\System\XLIxZgl.exe
  2⤵
  PID:8108
- C:\Windows\System\uRELzvL.exe
  C:\Windows\System\uRELzvL.exe
  2⤵
  PID:8124
- C:\Windows\System\XLSWnZI.exe
  C:\Windows\System\XLSWnZI.exe
  2⤵
  PID:8148
- C:\Windows\System\Rlcazbz.exe
  C:\Windows\System\Rlcazbz.exe
  2⤵
  PID:8172
- C:\Windows\System\SvFHCvd.exe
  C:\Windows\System\SvFHCvd.exe
  2⤵
  PID:6728
- C:\Windows\System\CJxEfIg.exe
  C:\Windows\System\CJxEfIg.exe
  2⤵
  PID:6788
- C:\Windows\System\gDhrhta.exe
  C:\Windows\System\gDhrhta.exe
  2⤵
  PID:6848
- C:\Windows\System\YrLUDyo.exe
  C:\Windows\System\YrLUDyo.exe
  2⤵
  PID:6892
- C:\Windows\System\cVndKtp.exe
  C:\Windows\System\cVndKtp.exe
  2⤵
  PID:5156
- C:\Windows\System\CMPBHkU.exe
  C:\Windows\System\CMPBHkU.exe
  2⤵
  PID:5400
- C:\Windows\System\DOPOMAk.exe
  C:\Windows\System\DOPOMAk.exe
  2⤵
  PID:6992
- C:\Windows\System\hdncDgD.exe
  C:\Windows\System\hdncDgD.exe
  2⤵
  PID:6352
- C:\Windows\System\jsdITzx.exe
  C:\Windows\System\jsdITzx.exe
  2⤵
  PID:6452
- C:\Windows\System\btVczAJ.exe
  C:\Windows\System\btVczAJ.exe
  2⤵
  PID:6156
- C:\Windows\System\zbZQkgT.exe
  C:\Windows\System\zbZQkgT.exe
  2⤵
  PID:6108
- C:\Windows\System\lxaGfzM.exe
  C:\Windows\System\lxaGfzM.exe
  2⤵
  PID:7216
- C:\Windows\System\guhoJAb.exe
  C:\Windows\System\guhoJAb.exe
  2⤵
  PID:7292
- C:\Windows\System\lBYLnmB.exe
  C:\Windows\System\lBYLnmB.exe
  2⤵
  PID:7060
- C:\Windows\System\auOSaon.exe
  C:\Windows\System\auOSaon.exe
  2⤵
  PID:7100
- C:\Windows\System\pgPkIiK.exe
  C:\Windows\System\pgPkIiK.exe
  2⤵
  PID:7148
- C:\Windows\System\MtcuzkX.exe
  C:\Windows\System\MtcuzkX.exe
  2⤵
  PID:5720
- C:\Windows\System\iCLLRfi.exe
  C:\Windows\System\iCLLRfi.exe
  2⤵
  PID:5800
- C:\Windows\System\KsyTnFV.exe
  C:\Windows\System\KsyTnFV.exe
  2⤵
  PID:7568
- C:\Windows\System\ebCjtuV.exe
  C:\Windows\System\ebCjtuV.exe
  2⤵
  PID:6412
- C:\Windows\System\kjhJaBI.exe
  C:\Windows\System\kjhJaBI.exe
  2⤵
  PID:7240
- C:\Windows\System\YBxwkDm.exe
  C:\Windows\System\YBxwkDm.exe
  2⤵
  PID:7868
- C:\Windows\System\RvgmpoD.exe
  C:\Windows\System\RvgmpoD.exe
  2⤵
  PID:6152
- C:\Windows\System\qvjuzWq.exe
  C:\Windows\System\qvjuzWq.exe
  2⤵
  PID:5032
- C:\Windows\System\WSCKXCn.exe
  C:\Windows\System\WSCKXCn.exe
  2⤵
  PID:5204
- C:\Windows\System\AswZrLw.exe
  C:\Windows\System\AswZrLw.exe
  2⤵
  PID:8068
- C:\Windows\System\YSOXJrF.exe
  C:\Windows\System\YSOXJrF.exe
  2⤵
  PID:8092
- C:\Windows\System\iaUlflc.exe
  C:\Windows\System\iaUlflc.exe
  2⤵
  PID:8140
- C:\Windows\System\kTMDfsX.exe
  C:\Windows\System\kTMDfsX.exe
  2⤵
  PID:6884
- C:\Windows\System\daeoBmv.exe
  C:\Windows\System\daeoBmv.exe
  2⤵
  PID:7648
- C:\Windows\System\AIWPnBz.exe
  C:\Windows\System\AIWPnBz.exe
  2⤵
  PID:8208
- C:\Windows\System\tBybAlQ.exe
  C:\Windows\System\tBybAlQ.exe
  2⤵
  PID:8224
- C:\Windows\System\FNXymlR.exe
  C:\Windows\System\FNXymlR.exe
  2⤵
  PID:8248
- C:\Windows\System\mvdEHlk.exe
  C:\Windows\System\mvdEHlk.exe
  2⤵
  PID:8272
- C:\Windows\System\Xpoijjg.exe
  C:\Windows\System\Xpoijjg.exe
  2⤵
  PID:8292
- C:\Windows\System\KFjXGty.exe
  C:\Windows\System\KFjXGty.exe
  2⤵
  PID:8316
- C:\Windows\System\XWLXcWk.exe
  C:\Windows\System\XWLXcWk.exe
  2⤵
  PID:8340
- C:\Windows\System\cqnIHym.exe
  C:\Windows\System\cqnIHym.exe
  2⤵
  PID:8364
- C:\Windows\System\kesnfrL.exe
  C:\Windows\System\kesnfrL.exe
  2⤵
  PID:8384
- C:\Windows\System\wdrWIGw.exe
  C:\Windows\System\wdrWIGw.exe
  2⤵
  PID:8400
- C:\Windows\System\DPAeLkv.exe
  C:\Windows\System\DPAeLkv.exe
  2⤵
  PID:8424
- C:\Windows\System\XOruEND.exe
  C:\Windows\System\XOruEND.exe
  2⤵
  PID:8444
- C:\Windows\System\ZovQBMn.exe
  C:\Windows\System\ZovQBMn.exe
  2⤵
  PID:8460
- C:\Windows\System\wTiIlBO.exe
  C:\Windows\System\wTiIlBO.exe
  2⤵
  PID:8476
- C:\Windows\System\XjQcgZc.exe
  C:\Windows\System\XjQcgZc.exe
  2⤵
  PID:8932
- C:\Windows\System\MwxpooM.exe
  C:\Windows\System\MwxpooM.exe
  2⤵
  PID:8952
- C:\Windows\System\amTQfFj.exe
  C:\Windows\System\amTQfFj.exe
  2⤵
  PID:8976
- C:\Windows\System\aXPacoo.exe
  C:\Windows\System\aXPacoo.exe
  2⤵
  PID:9000
- C:\Windows\System\TGJAGuD.exe
  C:\Windows\System\TGJAGuD.exe
  2⤵
  PID:9024
- C:\Windows\System\PnRSNBb.exe
  C:\Windows\System\PnRSNBb.exe
  2⤵
  PID:9048
- C:\Windows\System\tbtzzcI.exe
  C:\Windows\System\tbtzzcI.exe
  2⤵
  PID:9068
- C:\Windows\System\ouozpHJ.exe
  C:\Windows\System\ouozpHJ.exe
  2⤵
  PID:9092
- C:\Windows\System\uygvWKM.exe
  C:\Windows\System\uygvWKM.exe
  2⤵
  PID:9116
- C:\Windows\System\fDVCcLL.exe
  C:\Windows\System\fDVCcLL.exe
  2⤵
  PID:9136
- C:\Windows\System\QVZQdRT.exe
  C:\Windows\System\QVZQdRT.exe
  2⤵
  PID:7752
- C:\Windows\System\yOAjXFo.exe
  C:\Windows\System\yOAjXFo.exe
  2⤵
  PID:7228
- C:\Windows\System\cRPwhIn.exe
  C:\Windows\System\cRPwhIn.exe
  2⤵
  PID:7140
- C:\Windows\System\nslvtcj.exe
  C:\Windows\System\nslvtcj.exe
  2⤵
  PID:7388
- C:\Windows\System\PKDsjIT.exe
  C:\Windows\System\PKDsjIT.exe
  2⤵
  PID:7428
- C:\Windows\System\aEwAIQO.exe
  C:\Windows\System\aEwAIQO.exe
  2⤵
  PID:7472
- C:\Windows\System\qxLyEIU.exe
  C:\Windows\System\qxLyEIU.exe
  2⤵
  PID:7516
- C:\Windows\System\aHgUagS.exe
  C:\Windows\System\aHgUagS.exe
  2⤵
  PID:7620
- C:\Windows\System\eXEPdyI.exe
  C:\Windows\System\eXEPdyI.exe
  2⤵
  PID:7956
- C:\Windows\System\mxGEqpG.exe
  C:\Windows\System\mxGEqpG.exe
  2⤵
  PID:8028
- C:\Windows\System\VbgLdMV.exe
  C:\Windows\System\VbgLdMV.exe
  2⤵
  PID:8096
- C:\Windows\System\oweRHbY.exe
  C:\Windows\System\oweRHbY.exe
  2⤵
  PID:6812
- C:\Windows\System\GbLrhye.exe
  C:\Windows\System\GbLrhye.exe
  2⤵
  PID:6924
- C:\Windows\System\PwnPPSt.exe
  C:\Windows\System\PwnPPSt.exe
  2⤵
  PID:6304
- C:\Windows\System\dNHbKfR.exe
  C:\Windows\System\dNHbKfR.exe
  2⤵
  PID:6548
- C:\Windows\System\lgQnAQd.exe
  C:\Windows\System\lgQnAQd.exe
  2⤵
  PID:8324
- C:\Windows\System\IYBFTpA.exe
  C:\Windows\System\IYBFTpA.exe
  2⤵
  PID:7316
- C:\Windows\System\vnsfFhS.exe
  C:\Windows\System\vnsfFhS.exe
  2⤵
  PID:5676
- C:\Windows\System\JPXNTUS.exe
  C:\Windows\System\JPXNTUS.exe
  2⤵
  PID:452
- C:\Windows\System\yiInRzL.exe
  C:\Windows\System\yiInRzL.exe
  2⤵
  PID:7684
- C:\Windows\System\oKQiBAy.exe
  C:\Windows\System\oKQiBAy.exe
  2⤵
  PID:7852
- C:\Windows\System\EYiyosQ.exe
  C:\Windows\System\EYiyosQ.exe
  2⤵
  PID:2904
- C:\Windows\System\bPcIYQi.exe
  C:\Windows\System\bPcIYQi.exe
  2⤵
  PID:8080
- C:\Windows\System\UkMpReB.exe
  C:\Windows\System\UkMpReB.exe
  2⤵
  PID:6748
- C:\Windows\System\FvNxnVA.exe
  C:\Windows\System\FvNxnVA.exe
  2⤵
  PID:8204
- C:\Windows\System\lHaRPCG.exe
  C:\Windows\System\lHaRPCG.exe
  2⤵
  PID:8256
- C:\Windows\System\upfDtoQ.exe
  C:\Windows\System\upfDtoQ.exe
  2⤵
  PID:8416
- C:\Windows\System\MjsixgP.exe
  C:\Windows\System\MjsixgP.exe
  2⤵
  PID:8452
- C:\Windows\System\JSjgFuu.exe
  C:\Windows\System\JSjgFuu.exe
  2⤵
  PID:8508
- C:\Windows\System\PrtxPsc.exe
  C:\Windows\System\PrtxPsc.exe
  2⤵
  PID:9224
- C:\Windows\System\eqerPGy.exe
  C:\Windows\System\eqerPGy.exe
  2⤵
  PID:9248
- C:\Windows\System\EncbKYx.exe
  C:\Windows\System\EncbKYx.exe
  2⤵
  PID:9272
- C:\Windows\System\pJptHzD.exe
  C:\Windows\System\pJptHzD.exe
  2⤵
  PID:9296
- C:\Windows\System\eOwcYLs.exe
  C:\Windows\System\eOwcYLs.exe
  2⤵
  PID:9316
- C:\Windows\System\zqiQnKx.exe
  C:\Windows\System\zqiQnKx.exe
  2⤵
  PID:9340
- C:\Windows\System\HQIPJcY.exe
  C:\Windows\System\HQIPJcY.exe
  2⤵
  PID:9392
- C:\Windows\System\KpMhBGn.exe
  C:\Windows\System\KpMhBGn.exe
  2⤵
  PID:9416
- C:\Windows\System\BrWQtKO.exe
  C:\Windows\System\BrWQtKO.exe
  2⤵
  PID:9440
- C:\Windows\System\HdpsLwh.exe
  C:\Windows\System\HdpsLwh.exe
  2⤵
  PID:9460
- C:\Windows\System\ZYhxRwP.exe
  C:\Windows\System\ZYhxRwP.exe
  2⤵
  PID:9484
- C:\Windows\System\sMMGvHo.exe
  C:\Windows\System\sMMGvHo.exe
  2⤵
  PID:9512
- C:\Windows\System\PkzZUsj.exe
  C:\Windows\System\PkzZUsj.exe
  2⤵
  PID:9536
- C:\Windows\System\XvIYlMw.exe
  C:\Windows\System\XvIYlMw.exe
  2⤵
  PID:9560
- C:\Windows\System\pRVgFNY.exe
  C:\Windows\System\pRVgFNY.exe
  2⤵
  PID:9580
- C:\Windows\System\PHznzem.exe
  C:\Windows\System\PHznzem.exe
  2⤵
  PID:9608
- C:\Windows\System\vqPrMyM.exe
  C:\Windows\System\vqPrMyM.exe
  2⤵
  PID:9636
- C:\Windows\System\nKvvTGy.exe
  C:\Windows\System\nKvvTGy.exe
  2⤵
  PID:9652
- C:\Windows\System\nYmEJep.exe
  C:\Windows\System\nYmEJep.exe
  2⤵
  PID:9676
- C:\Windows\System\RnbIiLq.exe
  C:\Windows\System\RnbIiLq.exe
  2⤵
  PID:9704
- C:\Windows\System\djhTBRZ.exe
  C:\Windows\System\djhTBRZ.exe
  2⤵
  PID:9724
- C:\Windows\System\eCuLSOc.exe
  C:\Windows\System\eCuLSOc.exe
  2⤵
  PID:9740
- C:\Windows\System\TYqeZZj.exe
  C:\Windows\System\TYqeZZj.exe
  2⤵
  PID:9756
- C:\Windows\System\iNtdgwZ.exe
  C:\Windows\System\iNtdgwZ.exe
  2⤵
  PID:9772
- C:\Windows\System\eYoLGgR.exe
  C:\Windows\System\eYoLGgR.exe
  2⤵
  PID:9976
- C:\Windows\System\SzNnsyH.exe
  C:\Windows\System\SzNnsyH.exe
  2⤵
  PID:10132
- C:\Windows\System\AnpgoxV.exe
  C:\Windows\System\AnpgoxV.exe
  2⤵
  PID:10184
- C:\Windows\System\abKjKzJ.exe
  C:\Windows\System\abKjKzJ.exe
  2⤵
  PID:10220
- C:\Windows\System\LwwqAXf.exe
  C:\Windows\System\LwwqAXf.exe
  2⤵
  PID:10236
- C:\Windows\System\EwxnkVq.exe
  C:\Windows\System\EwxnkVq.exe
  2⤵
  PID:6956
- C:\Windows\System\pbBJCFQ.exe
  C:\Windows\System\pbBJCFQ.exe
  2⤵
  PID:8300
- C:\Windows\System\TSXCdva.exe
  C:\Windows\System\TSXCdva.exe
  2⤵
  PID:9172
- C:\Windows\System\DqrSdam.exe
  C:\Windows\System\DqrSdam.exe
  2⤵
  PID:3212
- C:\Windows\System\TiaDVYD.exe
  C:\Windows\System\TiaDVYD.exe
  2⤵
  PID:8244
- C:\Windows\System\HntovnJ.exe
  C:\Windows\System\HntovnJ.exe
  2⤵
  PID:8848
- C:\Windows\System\oNlynHS.exe
  C:\Windows\System\oNlynHS.exe
  2⤵
  PID:8868
- C:\Windows\System\QCambEs.exe
  C:\Windows\System\QCambEs.exe
  2⤵
  PID:8888
- C:\Windows\System\TpWmfFJ.exe
  C:\Windows\System\TpWmfFJ.exe
  2⤵
  PID:8920
- C:\Windows\System\chOXHSA.exe
  C:\Windows\System\chOXHSA.exe
  2⤵
  PID:8948
- C:\Windows\System\eMbKHTB.exe
  C:\Windows\System\eMbKHTB.exe
  2⤵
  PID:8992
- C:\Windows\System\xXsBHgY.exe
  C:\Windows\System\xXsBHgY.exe
  2⤵
  PID:9016
- C:\Windows\System\KOfzVUG.exe
  C:\Windows\System\KOfzVUG.exe
  2⤵
  PID:9164
- C:\Windows\System\zlrGEzD.exe
  C:\Windows\System\zlrGEzD.exe
  2⤵
  PID:9196
- C:\Windows\System\fXauape.exe
  C:\Windows\System\fXauape.exe
  2⤵
  PID:4240
- C:\Windows\System\kjdVkUh.exe
  C:\Windows\System\kjdVkUh.exe
  2⤵
  PID:7880
- C:\Windows\System\CnHsIjr.exe
  C:\Windows\System\CnHsIjr.exe
  2⤵
  PID:7456
- C:\Windows\System\whQMVqA.exe
  C:\Windows\System\whQMVqA.exe
  2⤵
  PID:7920
- C:\Windows\System\QBqikni.exe
  C:\Windows\System\QBqikni.exe
  2⤵
  PID:6828
- C:\Windows\System\ygDzTVD.exe
  C:\Windows\System\ygDzTVD.exe
  2⤵
  PID:2652
- C:\Windows\System\ArkdguA.exe
  C:\Windows\System\ArkdguA.exe
  2⤵
  PID:8132
- C:\Windows\System\wtUGKrj.exe
  C:\Windows\System\wtUGKrj.exe
  2⤵
  PID:9692
- C:\Windows\System\JbTFeIh.exe
  C:\Windows\System\JbTFeIh.exe
  2⤵
  PID:9748
- C:\Windows\System\iWriGOU.exe
  C:\Windows\System\iWriGOU.exe
  2⤵
  PID:9780
- C:\Windows\System\adxHYHg.exe
  C:\Windows\System\adxHYHg.exe
  2⤵
  PID:8840
- C:\Windows\System\AFpdJBk.exe
  C:\Windows\System\AFpdJBk.exe
  2⤵
  PID:9256
- C:\Windows\System\xiGieUs.exe
  C:\Windows\System\xiGieUs.exe
  2⤵
  PID:9284
- C:\Windows\System\xcdzOqy.exe
  C:\Windows\System\xcdzOqy.exe
  2⤵
  PID:9336
- C:\Windows\System\eXAXZNi.exe
  C:\Windows\System\eXAXZNi.exe
  2⤵
  PID:9388
- C:\Windows\System\BvEBQlM.exe
  C:\Windows\System\BvEBQlM.exe
  2⤵
  PID:9428
- C:\Windows\System\iYEONLT.exe
  C:\Windows\System\iYEONLT.exe
  2⤵
  PID:9500
- C:\Windows\System\mnBxkJt.exe
  C:\Windows\System\mnBxkJt.exe
  2⤵
  PID:9548
- C:\Windows\System\uhZYHpy.exe
  C:\Windows\System\uhZYHpy.exe
  2⤵
  PID:9576
- C:\Windows\System\qrvwUgL.exe
  C:\Windows\System\qrvwUgL.exe
  2⤵
  PID:10036
- C:\Windows\System\VWNwunG.exe
  C:\Windows\System\VWNwunG.exe
  2⤵
  PID:9644
- C:\Windows\System\bjzBlIS.exe
  C:\Windows\System\bjzBlIS.exe
  2⤵
  PID:9824
- C:\Windows\System\kbMIRGE.exe
  C:\Windows\System\kbMIRGE.exe
  2⤵
  PID:2492
- C:\Windows\System\jqmcpHh.exe
  C:\Windows\System\jqmcpHh.exe
  2⤵
  PID:10256
- C:\Windows\System\hMHlttZ.exe
  C:\Windows\System\hMHlttZ.exe
  2⤵
  PID:10272
- C:\Windows\System\jvmcjof.exe
  C:\Windows\System\jvmcjof.exe
  2⤵
  PID:10296
- C:\Windows\System\kulLAto.exe
  C:\Windows\System\kulLAto.exe
  2⤵
  PID:10324
- C:\Windows\System\OXGEGgA.exe
  C:\Windows\System\OXGEGgA.exe
  2⤵
  PID:10340
- C:\Windows\System\dGcXSxU.exe
  C:\Windows\System\dGcXSxU.exe
  2⤵
  PID:10360
- C:\Windows\System\zgzHARP.exe
  C:\Windows\System\zgzHARP.exe
  2⤵
  PID:10388
- C:\Windows\System\XFwkyoM.exe
  C:\Windows\System\XFwkyoM.exe
  2⤵
  PID:10412
- C:\Windows\System\IaIwHEM.exe
  C:\Windows\System\IaIwHEM.exe
  2⤵
  PID:10432
- C:\Windows\System\XJeBHTK.exe
  C:\Windows\System\XJeBHTK.exe
  2⤵
  PID:10460
- C:\Windows\System\hpFpjiB.exe
  C:\Windows\System\hpFpjiB.exe
  2⤵
  PID:10476
- C:\Windows\System\MpYQpGZ.exe
  C:\Windows\System\MpYQpGZ.exe
  2⤵
  PID:10492
- C:\Windows\System\lFrLRgD.exe
  C:\Windows\System\lFrLRgD.exe
  2⤵
  PID:10516
- C:\Windows\System\ryTnAhM.exe
  C:\Windows\System\ryTnAhM.exe
  2⤵
  PID:10532
- C:\Windows\System\TqjoyKm.exe
  C:\Windows\System\TqjoyKm.exe
  2⤵
  PID:10552
- C:\Windows\System\HVJKICw.exe
  C:\Windows\System\HVJKICw.exe
  2⤵
  PID:10572
- C:\Windows\System\ETgBHzO.exe
  C:\Windows\System\ETgBHzO.exe
  2⤵
  PID:10600
- C:\Windows\System\RYbnaJa.exe
  C:\Windows\System\RYbnaJa.exe
  2⤵
  PID:10620
- C:\Windows\System\ygZoVsB.exe
  C:\Windows\System\ygZoVsB.exe
  2⤵
  PID:10640
- C:\Windows\System\YxsaFOD.exe
  C:\Windows\System\YxsaFOD.exe
  2⤵
  PID:10704
- C:\Windows\System\xkgucGr.exe
  C:\Windows\System\xkgucGr.exe
  2⤵
  PID:10732
- C:\Windows\System\PNhSOYL.exe
  C:\Windows\System\PNhSOYL.exe
  2⤵
  PID:10748
- C:\Windows\System\jiFfgqC.exe
  C:\Windows\System\jiFfgqC.exe
  2⤵
  PID:10772
- C:\Windows\System\laZuDDO.exe
  C:\Windows\System\laZuDDO.exe
  2⤵
  PID:10792
- C:\Windows\System\zutkKZM.exe
  C:\Windows\System\zutkKZM.exe
  2⤵
  PID:10812
- C:\Windows\System\MZZAbuN.exe
  C:\Windows\System\MZZAbuN.exe
  2⤵
  PID:10832
- C:\Windows\System\gciOLzG.exe
  C:\Windows\System\gciOLzG.exe
  2⤵
  PID:10856
- C:\Windows\System\IudjSBA.exe
  C:\Windows\System\IudjSBA.exe
  2⤵
  PID:10872
- C:\Windows\System\sufHWBI.exe
  C:\Windows\System\sufHWBI.exe
  2⤵
  PID:10888
- C:\Windows\System\FPSAVeU.exe
  C:\Windows\System\FPSAVeU.exe
  2⤵
  PID:10908
- C:\Windows\System\AVpeCnM.exe
  C:\Windows\System\AVpeCnM.exe
  2⤵
  PID:10924
- C:\Windows\System\nVpmvnL.exe
  C:\Windows\System\nVpmvnL.exe
  2⤵
  PID:10944
- C:\Windows\System\xgpwmJt.exe
  C:\Windows\System\xgpwmJt.exe
  2⤵
  PID:10960
- C:\Windows\System\bTMwOwX.exe
  C:\Windows\System\bTMwOwX.exe
  2⤵
  PID:10984
- C:\Windows\System\jcVUpnM.exe
  C:\Windows\System\jcVUpnM.exe
  2⤵
  PID:11000
- C:\Windows\System\dpdyGRB.exe
  C:\Windows\System\dpdyGRB.exe
  2⤵
  PID:11020
- C:\Windows\System\NFZOrBC.exe
  C:\Windows\System\NFZOrBC.exe
  2⤵
  PID:11040
- C:\Windows\System\osSvGqG.exe
  C:\Windows\System\osSvGqG.exe
  2⤵
  PID:11064
- C:\Windows\System\maLzOqf.exe
  C:\Windows\System\maLzOqf.exe
  2⤵
  PID:11084
- C:\Windows\System\HxFKJEp.exe
  C:\Windows\System\HxFKJEp.exe
  2⤵
  PID:11104
- C:\Windows\System\gbpiUIO.exe
  C:\Windows\System\gbpiUIO.exe
  2⤵
  PID:11124
- C:\Windows\System\PYvyxqB.exe
  C:\Windows\System\PYvyxqB.exe
  2⤵
  PID:11152
- C:\Windows\System\GTCeImj.exe
  C:\Windows\System\GTCeImj.exe
  2⤵
  PID:11176
- C:\Windows\System\TztfQwH.exe
  C:\Windows\System\TztfQwH.exe
  2⤵
  PID:11200
- C:\Windows\System\kYxXLiL.exe
  C:\Windows\System\kYxXLiL.exe
  2⤵
  PID:11220
- C:\Windows\System\OCvTRkS.exe
  C:\Windows\System\OCvTRkS.exe
  2⤵
  PID:11244
- C:\Windows\System\LVyxQqm.exe
  C:\Windows\System\LVyxQqm.exe
  2⤵
  PID:11260
- C:\Windows\System\OXCJQEo.exe
  C:\Windows\System\OXCJQEo.exe
  2⤵
  PID:8380
- C:\Windows\System\BhcFwLb.exe
  C:\Windows\System\BhcFwLb.exe
  2⤵
  PID:10072
- C:\Windows\System\QWsSyNk.exe
  C:\Windows\System\QWsSyNk.exe
  2⤵
  PID:8860
- C:\Windows\System\VsjExLu.exe
  C:\Windows\System\VsjExLu.exe
  2⤵
  PID:8968
- C:\Windows\System\pcbCtQz.exe
  C:\Windows\System\pcbCtQz.exe
  2⤵
  PID:6628
- C:\Windows\System\IynBAYq.exe
  C:\Windows\System\IynBAYq.exe
  2⤵
  PID:9988
- C:\Windows\System\ztVucUy.exe
  C:\Windows\System\ztVucUy.exe
  2⤵
  PID:10252
- C:\Windows\System\lTQKcbd.exe
  C:\Windows\System\lTQKcbd.exe
  2⤵
  PID:10316
- C:\Windows\System\BcGhdDx.exe
  C:\Windows\System\BcGhdDx.exe
  2⤵
  PID:9156
- C:\Windows\System\JfcaIlj.exe
  C:\Windows\System\JfcaIlj.exe
  2⤵
  PID:10356
- C:\Windows\System\lNSzIwQ.exe
  C:\Windows\System\lNSzIwQ.exe
  2⤵
  PID:8884
- C:\Windows\System\geDoksQ.exe
  C:\Windows\System\geDoksQ.exe
  2⤵
  PID:7480
- C:\Windows\System\dZPvKty.exe
  C:\Windows\System\dZPvKty.exe
  2⤵
  PID:8264
- C:\Windows\System\epwWFRX.exe
  C:\Windows\System\epwWFRX.exe
  2⤵
  PID:10596
- C:\Windows\System\WwKMmoN.exe
  C:\Windows\System\WwKMmoN.exe
  2⤵
  PID:10616
- C:\Windows\System\eiNKMvl.exe
  C:\Windows\System\eiNKMvl.exe
  2⤵
  PID:9764
- C:\Windows\System\PfwdzeZ.exe
  C:\Windows\System\PfwdzeZ.exe
  2⤵
  PID:9232
- C:\Windows\System\VUQGJME.exe
  C:\Windows\System\VUQGJME.exe
  2⤵
  PID:4944
- C:\Windows\System\CMAqwcY.exe
  C:\Windows\System\CMAqwcY.exe
  2⤵
  PID:8408
- C:\Windows\System\IeeEVJU.exe
  C:\Windows\System\IeeEVJU.exe
  2⤵
  PID:10996
- C:\Windows\System\GKnfFtx.exe
  C:\Windows\System\GKnfFtx.exe
  2⤵
  PID:8916
- C:\Windows\System\FHaBuFr.exe
  C:\Windows\System\FHaBuFr.exe
  2⤵
  PID:10508
- C:\Windows\System\ctxobNV.exe
  C:\Windows\System\ctxobNV.exe
  2⤵
  PID:10528
- C:\Windows\System\MyYMAed.exe
  C:\Windows\System\MyYMAed.exe
  2⤵
  PID:7552
- C:\Windows\System\snArTcx.exe
  C:\Windows\System\snArTcx.exe
  2⤵
  PID:11284
- C:\Windows\System\SEXYMmA.exe
  C:\Windows\System\SEXYMmA.exe
  2⤵
  PID:11308
- C:\Windows\System\kRHScZa.exe
  C:\Windows\System\kRHScZa.exe
  2⤵
  PID:11328
- C:\Windows\System\wclxtJL.exe
  C:\Windows\System\wclxtJL.exe
  2⤵
  PID:11352
- C:\Windows\System\nXElFyc.exe
  C:\Windows\System\nXElFyc.exe
  2⤵
  PID:11380
- C:\Windows\System\JzuZjIe.exe
  C:\Windows\System\JzuZjIe.exe
  2⤵
  PID:11400
- C:\Windows\System\sYAGREl.exe
  C:\Windows\System\sYAGREl.exe
  2⤵
  PID:11440
- C:\Windows\System\RbmCOon.exe
  C:\Windows\System\RbmCOon.exe
  2⤵
  PID:11456
- C:\Windows\System\VCoIQvt.exe
  C:\Windows\System\VCoIQvt.exe
  2⤵
  PID:11472
- C:\Windows\System\dtunVDh.exe
  C:\Windows\System\dtunVDh.exe
  2⤵
  PID:11488
- C:\Windows\System\jGyCCZY.exe
  C:\Windows\System\jGyCCZY.exe
  2⤵
  PID:11508
- C:\Windows\System\rrKnkQI.exe
  C:\Windows\System\rrKnkQI.exe
  2⤵
  PID:11524
- C:\Windows\System\lwWOAgj.exe
  C:\Windows\System\lwWOAgj.exe
  2⤵
  PID:11540
- C:\Windows\System\yXXcLba.exe
  C:\Windows\System\yXXcLba.exe
  2⤵
  PID:11564
- C:\Windows\System\KWXROtR.exe
  C:\Windows\System\KWXROtR.exe
  2⤵
  PID:11588
- C:\Windows\System\qzmkTWs.exe
  C:\Windows\System\qzmkTWs.exe
  2⤵
  PID:11612
- C:\Windows\System\lmZwcwd.exe
  C:\Windows\System\lmZwcwd.exe
  2⤵
  PID:11636
- C:\Windows\System\slMtUux.exe
  C:\Windows\System\slMtUux.exe
  2⤵
  PID:11656
- C:\Windows\System\FuvOQwP.exe
  C:\Windows\System\FuvOQwP.exe
  2⤵
  PID:11680
- C:\Windows\System\OyXxwal.exe
  C:\Windows\System\OyXxwal.exe
  2⤵
  PID:11704
- C:\Windows\System\qoFUCoD.exe
  C:\Windows\System\qoFUCoD.exe
  2⤵
  PID:11728
- C:\Windows\System\gXWQkiA.exe
  C:\Windows\System\gXWQkiA.exe
  2⤵
  PID:11748
- C:\Windows\System\cCzlhlq.exe
  C:\Windows\System\cCzlhlq.exe
  2⤵
  PID:11772
- C:\Windows\System\wNfPMqw.exe
  C:\Windows\System\wNfPMqw.exe
  2⤵
  PID:11792
- C:\Windows\System\JJSMQBO.exe
  C:\Windows\System\JJSMQBO.exe
  2⤵
  PID:11824
- C:\Windows\System\OwxwtFm.exe
  C:\Windows\System\OwxwtFm.exe
  2⤵
  PID:11840
- C:\Windows\System\sovklGJ.exe
  C:\Windows\System\sovklGJ.exe
  2⤵
  PID:11868
- C:\Windows\System\HpBBnaL.exe
  C:\Windows\System\HpBBnaL.exe
  2⤵
  PID:11896
- C:\Windows\System\NRQDuaP.exe
  C:\Windows\System\NRQDuaP.exe
  2⤵
  PID:11912
- C:\Windows\System\zipxqwL.exe
  C:\Windows\System\zipxqwL.exe
  2⤵
  PID:11936
- C:\Windows\System\caOUApG.exe
  C:\Windows\System\caOUApG.exe
  2⤵
  PID:11960
- C:\Windows\System\uamOqOg.exe
  C:\Windows\System\uamOqOg.exe
  2⤵
  PID:11984
- C:\Windows\System\EusBMEy.exe
  C:\Windows\System\EusBMEy.exe
  2⤵
  PID:12004
- C:\Windows\System\XKUesvy.exe
  C:\Windows\System\XKUesvy.exe
  2⤵
  PID:12028
- C:\Windows\System\eskTsBa.exe
  C:\Windows\System\eskTsBa.exe
  2⤵
  PID:12048
- C:\Windows\System\lNdljNp.exe
  C:\Windows\System\lNdljNp.exe
  2⤵
  PID:12072
- C:\Windows\System\dfrCYrE.exe
  C:\Windows\System\dfrCYrE.exe
  2⤵
  PID:12088
- C:\Windows\System\VxqlfBO.exe
  C:\Windows\System\VxqlfBO.exe
  2⤵
  PID:12108
- C:\Windows\System\CcqENZW.exe
  C:\Windows\System\CcqENZW.exe
  2⤵
  PID:12128
- C:\Windows\System\qKZriwP.exe
  C:\Windows\System\qKZriwP.exe
  2⤵
  PID:12144
- C:\Windows\System\iZrREiT.exe
  C:\Windows\System\iZrREiT.exe
  2⤵
  PID:12168
- C:\Windows\System\EeUWnap.exe
  C:\Windows\System\EeUWnap.exe
  2⤵
  PID:12188
- C:\Windows\System\iyFAmAd.exe
  C:\Windows\System\iyFAmAd.exe
  2⤵
  PID:12216
- C:\Windows\System\JINxLlT.exe
  C:\Windows\System\JINxLlT.exe
  2⤵
  PID:12232
- C:\Windows\System\PDpqnrk.exe
  C:\Windows\System\PDpqnrk.exe
  2⤵
  PID:12252
- C:\Windows\System\wFDdtXT.exe
  C:\Windows\System\wFDdtXT.exe
  2⤵
  PID:12272
- C:\Windows\System\GxVRqdQ.exe
  C:\Windows\System\GxVRqdQ.exe
  2⤵
  PID:8012
- C:\Windows\System\gnrRXeO.exe
  C:\Windows\System\gnrRXeO.exe
  2⤵
  PID:8900
- C:\Windows\System\GQeWXkr.exe
  C:\Windows\System\GQeWXkr.exe
  2⤵
  PID:9180
- C:\Windows\System\UGPDQMF.exe
  C:\Windows\System\UGPDQMF.exe
  2⤵
  PID:9324
- C:\Windows\System\UXohXba.exe
  C:\Windows\System\UXohXba.exe
  2⤵
  PID:9380
- C:\Windows\System\ivGvLoL.exe
  C:\Windows\System\ivGvLoL.exe
  2⤵
  PID:9496
- C:\Windows\System\mVVKKWA.exe
  C:\Windows\System\mVVKKWA.exe
  2⤵
  PID:2812
- C:\Windows\System\GoeawNz.exe
  C:\Windows\System\GoeawNz.exe
  2⤵
  PID:9624
- C:\Windows\System\UMYuhdZ.exe
  C:\Windows\System\UMYuhdZ.exe
  2⤵
  PID:10248
- C:\Windows\System\XezsArV.exe
  C:\Windows\System\XezsArV.exe
  2⤵
  PID:9964
- C:\Windows\System\nMKwjbC.exe
  C:\Windows\System\nMKwjbC.exe
  2⤵
  PID:2320
- C:\Windows\System\VnZZJrE.exe
  C:\Windows\System\VnZZJrE.exe
  2⤵
  PID:8164
- C:\Windows\System\PntVoKq.exe
  C:\Windows\System\PntVoKq.exe
  2⤵
  PID:10472
- C:\Windows\System\vUXPSHq.exe
  C:\Windows\System\vUXPSHq.exe
  2⤵
  PID:11076
- C:\Windows\System\kaiVDIY.exe
  C:\Windows\System\kaiVDIY.exe
  2⤵
  PID:10116
- C:\Windows\System\GeLtYqe.exe
  C:\Windows\System\GeLtYqe.exe
  2⤵
  PID:11160
- C:\Windows\System\MWMQmQC.exe
  C:\Windows\System\MWMQmQC.exe
  2⤵
  PID:10408
- C:\Windows\System\bjNiEuE.exe
  C:\Windows\System\bjNiEuE.exe
  2⤵
  PID:11192
- C:\Windows\System\mTPpDgX.exe
  C:\Windows\System\mTPpDgX.exe
  2⤵
  PID:10584
- C:\Windows\System\OzltveB.exe
  C:\Windows\System\OzltveB.exe
  2⤵
  PID:11360
- C:\Windows\System\MNAnBtA.exe
  C:\Windows\System\MNAnBtA.exe
  2⤵
  PID:11396
- C:\Windows\System\DaHkFzw.exe
  C:\Windows\System\DaHkFzw.exe
  2⤵
  PID:10692
- C:\Windows\System\VOkzidw.exe
  C:\Windows\System\VOkzidw.exe
  2⤵
  PID:10724
- C:\Windows\System\ygbbxTN.exe
  C:\Windows\System\ygbbxTN.exe
  2⤵
  PID:10768
- C:\Windows\System\uIQBcTj.exe
  C:\Windows\System\uIQBcTj.exe
  2⤵
  PID:10804
- C:\Windows\System\GgJxOcx.exe
  C:\Windows\System\GgJxOcx.exe
  2⤵
  PID:10840
- C:\Windows\System\mdNFbnt.exe
  C:\Windows\System\mdNFbnt.exe
  2⤵
  PID:10904
- C:\Windows\System\QcneFMi.exe
  C:\Windows\System\QcneFMi.exe
  2⤵
  PID:3876
- C:\Windows\System\cLhrbvw.exe
  C:\Windows\System\cLhrbvw.exe
  2⤵
  PID:11556
- C:\Windows\System\RHBaNvo.exe
  C:\Windows\System\RHBaNvo.exe
  2⤵
  PID:11688
- C:\Windows\System\MPXaAEO.exe
  C:\Windows\System\MPXaAEO.exe
  2⤵
  PID:11832
- C:\Windows\System\VDTuAgd.exe
  C:\Windows\System\VDTuAgd.exe
  2⤵
  PID:12308
- C:\Windows\System\ReqcQpL.exe
  C:\Windows\System\ReqcQpL.exe
  2⤵
  PID:12336
- C:\Windows\System\UNnauAY.exe
  C:\Windows\System\UNnauAY.exe
  2⤵
  PID:12368
- C:\Windows\System\yJENLGk.exe
  C:\Windows\System\yJENLGk.exe
  2⤵
  PID:12392
- C:\Windows\System\AZIsmKj.exe
  C:\Windows\System\AZIsmKj.exe
  2⤵
  PID:12416
- C:\Windows\System\JwtNhgq.exe
  C:\Windows\System\JwtNhgq.exe
  2⤵
  PID:12440
- C:\Windows\System\lqtmMOI.exe
  C:\Windows\System\lqtmMOI.exe
  2⤵
  PID:12460
- C:\Windows\System\KbVqeID.exe
  C:\Windows\System\KbVqeID.exe
  2⤵
  PID:12488
- C:\Windows\System\gRwUpmw.exe
  C:\Windows\System\gRwUpmw.exe
  2⤵
  PID:12504
- C:\Windows\System\sTONacX.exe
  C:\Windows\System\sTONacX.exe
  2⤵
  PID:12528
- C:\Windows\System\TBxauod.exe
  C:\Windows\System\TBxauod.exe
  2⤵
  PID:12548
- C:\Windows\System\PEklfoc.exe
  C:\Windows\System\PEklfoc.exe
  2⤵
  PID:12564
- C:\Windows\System\KRgGuPJ.exe
  C:\Windows\System\KRgGuPJ.exe
  2⤵
  PID:12584
- C:\Windows\System\XZZFdLl.exe
  C:\Windows\System\XZZFdLl.exe
  2⤵
  PID:12620
- C:\Windows\System\jTomzSj.exe
  C:\Windows\System\jTomzSj.exe
  2⤵
  PID:12644
- C:\Windows\System\Apeximz.exe
  C:\Windows\System\Apeximz.exe
  2⤵
  PID:12664
- C:\Windows\System\uiUycjk.exe
  C:\Windows\System\uiUycjk.exe
  2⤵
  PID:12692
- C:\Windows\System\wohxbpV.exe
  C:\Windows\System\wohxbpV.exe
  2⤵
  PID:13180
- C:\Windows\System\YrlSUae.exe
  C:\Windows\System\YrlSUae.exe
  2⤵
  PID:13240
- C:\Windows\System\qahpLEp.exe
  C:\Windows\System\qahpLEp.exe
  2⤵
  PID:12200
- C:\Windows\System\vtlupsu.exe
  C:\Windows\System\vtlupsu.exe
  2⤵
  PID:12228
- C:\Windows\System\UqxfODY.exe
  C:\Windows\System\UqxfODY.exe
  2⤵
  PID:12776
- C:\Windows\System\MnsLDFb.exe
  C:\Windows\System\MnsLDFb.exe
  2⤵
  PID:11448
- C:\Windows\System\jCBLVTq.exe
  C:\Windows\System\jCBLVTq.exe
  2⤵
  PID:11780
- C:\Windows\System\bLWBFUU.exe
  C:\Windows\System\bLWBFUU.exe
  2⤵
  PID:12304
- C:\Windows\System\ALCAVBZ.exe
  C:\Windows\System\ALCAVBZ.exe
  2⤵
  PID:11932
- C:\Windows\System\IeGNleE.exe
  C:\Windows\System\IeGNleE.exe
  2⤵
  PID:11992
- C:\Windows\System\OUkODHB.exe
  C:\Windows\System\OUkODHB.exe
  2⤵
  PID:12456
- C:\Windows\System\CFFlbxi.exe
  C:\Windows\System\CFFlbxi.exe
  2⤵
  PID:12120
- C:\Windows\System\lQtfdCU.exe
  C:\Windows\System\lQtfdCU.exe
  2⤵
  PID:12136
- C:\Windows\System\mODNQDU.exe
  C:\Windows\System\mODNQDU.exe
  2⤵
  PID:12640
- C:\Windows\System\dPADQqO.exe
  C:\Windows\System\dPADQqO.exe
  2⤵
  PID:9368
- C:\Windows\System\wIOJLQM.exe
  C:\Windows\System\wIOJLQM.exe
  2⤵
  PID:4496
- C:\Windows\System\PaMJcHi.exe
  C:\Windows\System\PaMJcHi.exe
  2⤵
  PID:12820
- C:\Windows\System\IFcsWqk.exe
  C:\Windows\System\IFcsWqk.exe
  2⤵
  PID:12940
- C:\Windows\System\yYrEpPO.exe
  C:\Windows\System\yYrEpPO.exe
  2⤵
  PID:4552
- C:\Windows\System\pLPMnDo.exe
  C:\Windows\System\pLPMnDo.exe
  2⤵
  PID:13084
- C:\Windows\System\STnZSFF.exe
  C:\Windows\System\STnZSFF.exe
  2⤵
  PID:12448
- C:\Windows\System\XmhajXK.exe
  C:\Windows\System\XmhajXK.exe
  2⤵
  PID:11344
- C:\Windows\System\IYCJChx.exe
  C:\Windows\System\IYCJChx.exe
  2⤵
  PID:13236
- C:\Windows\System\CkkxLCJ.exe
  C:\Windows\System\CkkxLCJ.exe
  2⤵
  PID:11856
- C:\Windows\System\vEPMtsk.exe
  C:\Windows\System\vEPMtsk.exe
  2⤵
  PID:11956
- C:\Windows\System\lZBDkbr.exe
  C:\Windows\System\lZBDkbr.exe
  2⤵
  PID:9268
- C:\Windows\System\PzrNxCp.exe
  C:\Windows\System\PzrNxCp.exe
  2⤵
  PID:10108
- C:\Windows\System\LsJWBQy.exe
  C:\Windows\System\LsJWBQy.exe
  2⤵
  PID:11468
- C:\Windows\System\qkYkwOe.exe
  C:\Windows\System\qkYkwOe.exe
  2⤵
  PID:11664
- C:\Windows\System\RUPtcKK.exe
  C:\Windows\System\RUPtcKK.exe
  2⤵
  PID:11736
- C:\Windows\System\QJqnTXg.exe
  C:\Windows\System\QJqnTXg.exe
  2⤵
  PID:11228
- C:\Windows\System\yMHzrdU.exe
  C:\Windows\System\yMHzrdU.exe
  2⤵
  PID:12284
- C:\Windows\System\TXXDtVm.exe
  C:\Windows\System\TXXDtVm.exe
  2⤵
  PID:10588
- C:\Windows\System\uetbMRs.exe
  C:\Windows\System\uetbMRs.exe
  2⤵
  PID:5092
- C:\Windows\System\aSkiJdS.exe
  C:\Windows\System\aSkiJdS.exe
  2⤵
  PID:11788
- C:\Windows\System\bvtYrnZ.exe
  C:\Windows\System\bvtYrnZ.exe
  2⤵
  PID:12680
- C:\Windows\System\ujUSxoP.exe
  C:\Windows\System\ujUSxoP.exe
  2⤵
  PID:11252
- C:\Windows\System\aMobBhu.exe
  C:\Windows\System\aMobBhu.exe
  2⤵
  PID:12784
- C:\Windows\System\eERCwMr.exe
  C:\Windows\System\eERCwMr.exe
  2⤵
  PID:12636
- C:\Windows\System\aTqyTkz.exe
  C:\Windows\System\aTqyTkz.exe
  2⤵
  PID:3280
- C:\Windows\System\rmSdzYN.exe
  C:\Windows\System\rmSdzYN.exe
  2⤵
  PID:2276
- C:\Windows\System\PmObrXb.exe
  C:\Windows\System\PmObrXb.exe
  2⤵
  PID:13284
- C:\Windows\System\IhpZOYw.exe
  C:\Windows\System\IhpZOYw.exe
  2⤵
  PID:11864
- C:\Windows\System\dotaOBh.exe
  C:\Windows\System\dotaOBh.exe
  2⤵
  PID:12632
- C:\Windows\System\lflFAzi.exe
  C:\Windows\System\lflFAzi.exe
  2⤵
  PID:13092
- C:\Windows\System\kaSKMWy.exe
  C:\Windows\System\kaSKMWy.exe
  2⤵
  PID:11484
- C:\Windows\System\sLPJjPY.exe
  C:\Windows\System\sLPJjPY.exe
  2⤵
  PID:11368
- C:\Windows\System\VjzaUSZ.exe
  C:\Windows\System\VjzaUSZ.exe
  2⤵
  PID:3528
- C:\Windows\System\KBDlhRP.exe
  C:\Windows\System\KBDlhRP.exe
  2⤵
  PID:12828
- C:\Windows\System\MXDVapY.exe
  C:\Windows\System\MXDVapY.exe
  2⤵
  PID:12656
- C:\Windows\System\GiSkndf.exe
  C:\Windows\System\GiSkndf.exe
  2⤵
  PID:10228
- C:\Windows\System\IxqQnJr.exe
  C:\Windows\System\IxqQnJr.exe
  2⤵
  PID:11624
- C:\Windows\System\tTKVwSE.exe
  C:\Windows\System\tTKVwSE.exe
  2⤵
  PID:12844
- C:\Windows\System\tFyPMro.exe
  C:\Windows\System\tFyPMro.exe
  2⤵
  PID:13028
- C:\Windows\System\GpcnceM.exe
  C:\Windows\System\GpcnceM.exe
  2⤵
  PID:11764
- C:\Windows\System\LBONvFk.exe
  C:\Windows\System\LBONvFk.exe
  2⤵
  PID:8928
- C:\Windows\System\GWzgCvV.exe
  C:\Windows\System\GWzgCvV.exe
  2⤵
  PID:404
- C:\Windows\System\vofpEWf.exe
  C:\Windows\System\vofpEWf.exe
  2⤵
  PID:11744
- C:\Windows\System\AklkEPe.exe
  C:\Windows\System\AklkEPe.exe
  2⤵
  PID:12476
- C:\Windows\System\PtFiFMf.exe
  C:\Windows\System\PtFiFMf.exe
  2⤵
  PID:11724
- C:\Windows\System\btBescd.exe
  C:\Windows\System\btBescd.exe
  2⤵
  PID:12792
- C:\Windows\System\NVKRtbH.exe
  C:\Windows\System\NVKRtbH.exe
  2⤵
  PID:1152
- C:\Windows\System\hFBTUFv.exe
  C:\Windows\System\hFBTUFv.exe
  2⤵
  PID:12704
- C:\Windows\System\HfJeeZd.exe
  C:\Windows\System\HfJeeZd.exe
  2⤵
  PID:12860
- C:\Windows\System\dVUORAO.exe
  C:\Windows\System\dVUORAO.exe
  2⤵
  PID:11464
- C:\Windows\System\MyEXbnR.exe
  C:\Windows\System\MyEXbnR.exe
  2⤵
  PID:11016
- C:\Windows\System\icEBott.exe
  C:\Windows\System\icEBott.exe
  2⤵
  PID:13032
- C:\Windows\System\IFFlYzn.exe
  C:\Windows\System\IFFlYzn.exe
  2⤵
  PID:13308
- C:\Windows\System\OSzRHuY.exe
  C:\Windows\System\OSzRHuY.exe
  2⤵
  PID:12960
- C:\Windows\System\gtNxoDC.exe
  C:\Windows\System\gtNxoDC.exe
  2⤵
  PID:9012
- C:\Windows\System\tBUxhSR.exe
  C:\Windows\System\tBUxhSR.exe
  2⤵
  PID:1036
- C:\Windows\System\BrqdYEo.exe
  C:\Windows\System\BrqdYEo.exe
  2⤵
  PID:436
- C:\Windows\System\QqRHQBt.exe
  C:\Windows\System\QqRHQBt.exe
  2⤵
  PID:11652
- C:\Windows\System\WXulWQF.exe
  C:\Windows\System\WXulWQF.exe
  2⤵
  PID:5080
- C:\Windows\System\waHJMUb.exe
  C:\Windows\System\waHJMUb.exe
  2⤵
  PID:12788
- C:\Windows\System\SUXAkMP.exe
  C:\Windows\System\SUXAkMP.exe
  2⤵
  PID:2952
- C:\Windows\System\mIqVEPy.exe
  C:\Windows\System\mIqVEPy.exe
  2⤵
  PID:12660
- C:\Windows\System\DhABnei.exe
  C:\Windows\System\DhABnei.exe
  2⤵
  PID:12964
- C:\Windows\System\wVzyvgb.exe
  C:\Windows\System\wVzyvgb.exe
  2⤵
  PID:5248
- C:\Windows\System\lOpDyJY.exe
  C:\Windows\System\lOpDyJY.exe
  2⤵
  PID:13168
- C:\Windows\System\APgihGJ.exe
  C:\Windows\System\APgihGJ.exe
  2⤵
  PID:4888
- C:\Windows\System\hdWbdrf.exe
  C:\Windows\System\hdWbdrf.exe
  2⤵
  PID:12576
- C:\Windows\System\zAdJPcs.exe
  C:\Windows\System\zAdJPcs.exe
  2⤵
  PID:1116
- C:\Windows\System\RBwysWS.exe
  C:\Windows\System\RBwysWS.exe
  2⤵
  PID:1368
- C:\Windows\System\RlSksGJ.exe
  C:\Windows\System\RlSksGJ.exe
  2⤵
  PID:3760
- C:\Windows\System\LgCEVau.exe
  C:\Windows\System\LgCEVau.exe
  2⤵
  PID:2712
- C:\Windows\System\UZXpjEo.exe
  C:\Windows\System\UZXpjEo.exe
  2⤵
  PID:4676
- C:\Windows\System\SvgsOhj.exe
  C:\Windows\System\SvgsOhj.exe
  2⤵
  PID:5868
- C:\Windows\System\mXkwUtb.exe
  C:\Windows\System\mXkwUtb.exe
  2⤵
  PID:12824
- C:\Windows\System\eFVJSSr.exe
  C:\Windows\System\eFVJSSr.exe
  2⤵
  PID:4988
- C:\Windows\System\nMNYfXD.exe
  C:\Windows\System\nMNYfXD.exe
  2⤵
  PID:3136
- C:\Windows\System\HDhAaBK.exe
  C:\Windows\System\HDhAaBK.exe
  2⤵
  PID:3824
- C:\Windows\System\sMLCmaU.exe
  C:\Windows\System\sMLCmaU.exe
  2⤵
  PID:2700
- C:\Windows\System\WuAnApb.exe
  C:\Windows\System\WuAnApb.exe
  2⤵
  PID:1100
- C:\Windows\System\gXdevUb.exe
  C:\Windows\System\gXdevUb.exe
  2⤵
  PID:4292
- C:\Windows\System\iKioAVf.exe
  C:\Windows\System\iKioAVf.exe
  2⤵
  PID:4008
- C:\Windows\System\zdbXWkh.exe
  C:\Windows\System\zdbXWkh.exe
  2⤵
  PID:4024
- C:\Windows\System\JnvDdeQ.exe
  C:\Windows\System\JnvDdeQ.exe
  2⤵
  PID:9884
- C:\Windows\System\KPfGfxK.exe
  C:\Windows\System\KPfGfxK.exe
  2⤵
  PID:9948
- C:\Windows\System\xDjJAEw.exe
  C:\Windows\System\xDjJAEw.exe
  2⤵
  PID:4328
- C:\Windows\System\EQTTcjG.exe
  C:\Windows\System\EQTTcjG.exe
  2⤵
  PID:4184
- C:\Windows\System\DAsHenc.exe
  C:\Windows\System\DAsHenc.exe
  2⤵
  PID:4336
- C:\Windows\System\gqkqlaM.exe
  C:\Windows\System\gqkqlaM.exe
  2⤵
  PID:4208
- C:\Windows\System\fJGsAdl.exe
  C:\Windows\System\fJGsAdl.exe
  2⤵
  PID:800
- C:\Windows\System\iLDoJJK.exe
  C:\Windows\System\iLDoJJK.exe
  2⤵
  PID:10180
- C:\Windows\System\bGzFYOZ.exe
  C:\Windows\System\bGzFYOZ.exe
  2⤵
  PID:3028
- C:\Windows\System\QjJqlAq.exe
  C:\Windows\System\QjJqlAq.exe
  2⤵
  PID:4072
- C:\Windows\System\fPxDjht.exe
  C:\Windows\System\fPxDjht.exe
  2⤵
  PID:8716
- C:\Windows\System\VnHXxih.exe
  C:\Windows\System\VnHXxih.exe
  2⤵
  PID:3752
- C:\Windows\System\HOxxpRI.exe
  C:\Windows\System\HOxxpRI.exe
  2⤵
  PID:3140
- C:\Windows\System\tzZTcgf.exe
  C:\Windows\System\tzZTcgf.exe
  2⤵
  PID:3840
- C:\Windows\System\vLqyauF.exe
  C:\Windows\System\vLqyauF.exe
  2⤵
  PID:9936
- C:\Windows\System\sJFKQoA.exe
  C:\Windows\System\sJFKQoA.exe
  2⤵
  PID:4268
- C:\Windows\System\PQVXsaS.exe
  C:\Windows\System\PQVXsaS.exe
  2⤵
  PID:4348
- C:\Windows\System\vjPfnxq.exe
  C:\Windows\System\vjPfnxq.exe
  2⤵
  PID:1184
- C:\Windows\System\LrCInZJ.exe
  C:\Windows\System\LrCInZJ.exe
  2⤵
  PID:2760
- C:\Windows\System\QBmHDXL.exe
  C:\Windows\System\QBmHDXL.exe
  2⤵
  PID:3788
- C:\Windows\System\wpZYLiS.exe
  C:\Windows\System\wpZYLiS.exe
  2⤵
  PID:7496
- C:\Windows\System\fzznYeA.exe
  C:\Windows\System\fzznYeA.exe
  2⤵
  PID:9896
- C:\Windows\System\KOMszgG.exe
  C:\Windows\System\KOMszgG.exe
  2⤵
  PID:6196
- C:\Windows\System\sqAYEBG.exe
  C:\Windows\System\sqAYEBG.exe
  2⤵
  PID:5072
- C:\Windows\System\tmkwgTL.exe
  C:\Windows\System\tmkwgTL.exe
  2⤵
  PID:4436
- C:\Windows\System\IOfarVF.exe
  C:\Windows\System\IOfarVF.exe
  2⤵
  PID:2880
- C:\Windows\System\TVRStTl.exe
  C:\Windows\System\TVRStTl.exe
  2⤵
  PID:3992
- C:\Windows\System\ubJAYav.exe
  C:\Windows\System\ubJAYav.exe
  2⤵
  PID:2604
- C:\Windows\System\MAfsTOq.exe
  C:\Windows\System\MAfsTOq.exe
  2⤵
  PID:13316
- C:\Windows\System\sSSWRMQ.exe
  C:\Windows\System\sSSWRMQ.exe
  2⤵
  PID:13448
- C:\Windows\System\CoqvSeW.exe
  C:\Windows\System\CoqvSeW.exe
  2⤵
  PID:13472
- C:\Windows\System\jhpURNF.exe
  C:\Windows\System\jhpURNF.exe
  2⤵
  PID:13556
- C:\Windows\System\PoshLMm.exe
  C:\Windows\System\PoshLMm.exe
  2⤵
  PID:13616
- C:\Windows\System\WNUAAZf.exe
  C:\Windows\System\WNUAAZf.exe
  2⤵
  PID:13672
- C:\Windows\System\OieHSbq.exe
  C:\Windows\System\OieHSbq.exe
  2⤵
  PID:13708
- C:\Windows\System\MsFwOCB.exe
  C:\Windows\System\MsFwOCB.exe
  2⤵
  PID:13732
- C:\Windows\System\BstyOmR.exe
  C:\Windows\System\BstyOmR.exe
  2⤵
  PID:13772
- C:\Windows\System\ZrKhhxZ.exe
  C:\Windows\System\ZrKhhxZ.exe
  2⤵
  PID:13800
- C:\Windows\System\KvHllsu.exe
  C:\Windows\System\KvHllsu.exe
  2⤵
  PID:13824
- C:\Windows\System\EYSnNNY.exe
  C:\Windows\System\EYSnNNY.exe
  2⤵
  PID:13844
- C:\Windows\System\rtOprMt.exe
  C:\Windows\System\rtOprMt.exe
  2⤵
  PID:13860
- C:\Windows\System\LnfVBxc.exe
  C:\Windows\System\LnfVBxc.exe
  2⤵
  PID:13896
- C:\Windows\System\RhPidKb.exe
  C:\Windows\System\RhPidKb.exe
  2⤵
  PID:13924
- C:\Windows\System\oYrRUSk.exe
  C:\Windows\System\oYrRUSk.exe
  2⤵
  PID:13960
- C:\Windows\System\YZZtJmb.exe
  C:\Windows\System\YZZtJmb.exe
  2⤵
  PID:14012
- C:\Windows\System\RqhAbJp.exe
  C:\Windows\System\RqhAbJp.exe
  2⤵
  PID:14080
- C:\Windows\System\HOKLTCQ.exe
  C:\Windows\System\HOKLTCQ.exe
  2⤵
  PID:14120
- C:\Windows\System\NuACzOV.exe
  C:\Windows\System\NuACzOV.exe
  2⤵
  PID:14144
- C:\Windows\System\WGvglmt.exe
  C:\Windows\System\WGvglmt.exe
  2⤵
  PID:14172
- C:\Windows\System\GhtIPHn.exe
  C:\Windows\System\GhtIPHn.exe
  2⤵
  PID:14200
- C:\Windows\System\wuMSKIG.exe
  C:\Windows\System\wuMSKIG.exe
  2⤵
  PID:14232
- C:\Windows\System\qcSHwYj.exe
  C:\Windows\System\qcSHwYj.exe
  2⤵
  PID:14296
- C:\Windows\System\fqIoqBg.exe
  C:\Windows\System\fqIoqBg.exe
  2⤵
  PID:4188
- C:\Windows\System\SIxxCcK.exe
  C:\Windows\System\SIxxCcK.exe
  2⤵
  PID:3688
- C:\Windows\System\FNYQENJ.exe
  C:\Windows\System\FNYQENJ.exe
  2⤵
  PID:1492
- C:\Windows\System\edEvuwn.exe
  C:\Windows\System\edEvuwn.exe
  2⤵
  PID:13400
- C:\Windows\System\pFZknsH.exe
  C:\Windows\System\pFZknsH.exe
  2⤵
  PID:13408
- C:\Windows\System\QtJOyQX.exe
  C:\Windows\System\QtJOyQX.exe
  2⤵
  PID:13420
- C:\Windows\System\UPDSoQD.exe
  C:\Windows\System\UPDSoQD.exe
  2⤵
  PID:13444
- C:\Windows\System\ldmCXfP.exe
  C:\Windows\System\ldmCXfP.exe
  2⤵
  PID:2972
- C:\Windows\System\DxxlXJX.exe
  C:\Windows\System\DxxlXJX.exe
  2⤵
  PID:216
- C:\Windows\System\GaqfUqH.exe
  C:\Windows\System\GaqfUqH.exe
  2⤵
  PID:3784
- C:\Windows\System\MPKeuIz.exe
  C:\Windows\System\MPKeuIz.exe
  2⤵
  PID:1628
- C:\Windows\System\RZkgAYY.exe
  C:\Windows\System\RZkgAYY.exe
  2⤵
  PID:3104
- C:\Windows\System\mAYoxMQ.exe
  C:\Windows\System\mAYoxMQ.exe
  2⤵
  PID:3332
- C:\Windows\System\QQYsjRa.exe
  C:\Windows\System\QQYsjRa.exe
  2⤵
  PID:6176
- C:\Windows\System\eWtKhHL.exe
  C:\Windows\System\eWtKhHL.exe
  2⤵
  PID:13544
- C:\Windows\System\aeUdMGw.exe
  C:\Windows\System\aeUdMGw.exe
  2⤵
  PID:13592
- C:\Windows\System\CEOPpNy.exe
  C:\Windows\System\CEOPpNy.exe
  2⤵
  PID:13936
- C:\Windows\System\yNDzuDG.exe
  C:\Windows\System\yNDzuDG.exe
  2⤵
  PID:13788
- C:\Windows\System\JyTgCnN.exe
  C:\Windows\System\JyTgCnN.exe
  2⤵
  PID:13812
- C:\Windows\System\wqisuOd.exe
  C:\Windows\System\wqisuOd.exe
  2⤵
  PID:4384
- C:\Windows\System\XoDrFYY.exe
  C:\Windows\System\XoDrFYY.exe
  2⤵
  PID:13852
- C:\Windows\System\IoyLAMq.exe
  C:\Windows\System\IoyLAMq.exe
  2⤵
  PID:14032
- C:\Windows\System\dLruQrO.exe
  C:\Windows\System\dLruQrO.exe
  2⤵
  PID:13884
- C:\Windows\System\TRfuLSw.exe
  C:\Windows\System\TRfuLSw.exe
  2⤵
  PID:14052
- C:\Windows\System\heZjpxz.exe
  C:\Windows\System\heZjpxz.exe
  2⤵
  PID:13944
- C:\Windows\System\XgsVlrn.exe
  C:\Windows\System\XgsVlrn.exe
  2⤵
  PID:13892
- C:\Windows\System\sWVOJgQ.exe
  C:\Windows\System\sWVOJgQ.exe
  2⤵
  PID:14132
- C:\Windows\System\cGydjCt.exe
  C:\Windows\System\cGydjCt.exe
  2⤵
  PID:5576
- C:\Windows\System\kkIVkog.exe
  C:\Windows\System\kkIVkog.exe
  2⤵
  PID:5160
- C:\Windows\System\TgNRUgs.exe
  C:\Windows\System\TgNRUgs.exe
  2⤵
  PID:5196
- C:\Windows\System\vXKDwIG.exe
  C:\Windows\System\vXKDwIG.exe
  2⤵
  PID:14168
- C:\Windows\System\hkaPVsW.exe
  C:\Windows\System\hkaPVsW.exe
  2⤵
  PID:14100
- C:\Windows\System\CvOrIzZ.exe
  C:\Windows\System\CvOrIzZ.exe
  2⤵
  PID:14252
- C:\Windows\System\DqRWhxe.exe
  C:\Windows\System\DqRWhxe.exe
  2⤵
  PID:14196
- C:\Windows\System\gIRHJpQ.exe
  C:\Windows\System\gIRHJpQ.exe
  2⤵
  PID:5708
- C:\Windows\System\YmYXXlH.exe
  C:\Windows\System\YmYXXlH.exe
  2⤵
  PID:5380
- C:\Windows\System\USfSZEQ.exe
  C:\Windows\System\USfSZEQ.exe
  2⤵
  PID:5700
- C:\Windows\System\qYjqkMc.exe
  C:\Windows\System\qYjqkMc.exe
  2⤵
  PID:1304
- C:\Windows\System\HXnYqCH.exe
  C:\Windows\System\HXnYqCH.exe
  2⤵
  PID:14272
- C:\Windows\System\NfdhkDJ.exe
  C:\Windows\System\NfdhkDJ.exe
  2⤵
  PID:14304
- C:\Windows\System\jFVPzCo.exe
  C:\Windows\System\jFVPzCo.exe
  2⤵
  PID:13440
- C:\Windows\System\SqYVAEM.exe
  C:\Windows\System\SqYVAEM.exe
  2⤵
  PID:724
- C:\Windows\System\IqSaOSf.exe
  C:\Windows\System\IqSaOSf.exe
  2⤵
  PID:2124
- C:\Windows\System\bJDQSNR.exe
  C:\Windows\System\bJDQSNR.exe
  2⤵
  PID:5660
- C:\Windows\System\eZRzDiI.exe
  C:\Windows\System\eZRzDiI.exe
  2⤵
  PID:5760
- C:\Windows\System\ltxxaBw.exe
  C:\Windows\System\ltxxaBw.exe
  2⤵
  PID:2996
- C:\Windows\System\DYGRLVI.exe
  C:\Windows\System\DYGRLVI.exe
  2⤵
  PID:3620
- C:\Windows\System\gECsrpF.exe
  C:\Windows\System\gECsrpF.exe
  2⤵
  PID:2540
- C:\Windows\System\ExHnxLn.exe
  C:\Windows\System\ExHnxLn.exe
  2⤵
  PID:13536
- C:\Windows\System\JjyUlky.exe
  C:\Windows\System\JjyUlky.exe
  2⤵
  PID:5280
- C:\Windows\System\oaQbJOZ.exe
  C:\Windows\System\oaQbJOZ.exe
  2⤵
  PID:13932
- C:\Windows\System\KBOUkiJ.exe
  C:\Windows\System\KBOUkiJ.exe
  2⤵
  PID:6048
- C:\Windows\System\QNZZOJx.exe
  C:\Windows\System\QNZZOJx.exe
  2⤵
  PID:3292
- C:\Windows\System\FCfJYVq.exe
  C:\Windows\System\FCfJYVq.exe
  2⤵
  PID:5292
- C:\Windows\System\oNhmzcE.exe
  C:\Windows\System\oNhmzcE.exe
  2⤵
  PID:4968
- C:\Windows\System\fMRLvhO.exe
  C:\Windows\System\fMRLvhO.exe
  2⤵
  PID:13780
- C:\Windows\System\tgNRRZi.exe
  C:\Windows\System\tgNRRZi.exe
  2⤵
  PID:2224
- C:\Windows\System\tiutpwl.exe
  C:\Windows\System\tiutpwl.exe
  2⤵
  PID:14064
- C:\Windows\System\NtlrPGe.exe
  C:\Windows\System\NtlrPGe.exe
  2⤵
  PID:5632
- C:\Windows\System\aZRajjq.exe
  C:\Windows\System\aZRajjq.exe
  2⤵
  PID:4652
- C:\Windows\System\amxWxBx.exe
  C:\Windows\System\amxWxBx.exe
  2⤵
  PID:13836
- C:\Windows\System\CZwkvwU.exe
  C:\Windows\System\CZwkvwU.exe
  2⤵
  PID:14220
- C:\Windows\System\NcjlCmA.exe
  C:\Windows\System\NcjlCmA.exe
  2⤵
  PID:14076
- C:\Windows\System\hfUaZOY.exe
  C:\Windows\System\hfUaZOY.exe
  2⤵
  PID:6564
- C:\Windows\System\hKFkAgh.exe
  C:\Windows\System\hKFkAgh.exe
  2⤵
  PID:14320
- C:\Windows\System\IlltodK.exe
  C:\Windows\System\IlltodK.exe
  2⤵
  PID:6756
- C:\Windows\System\TuzCTHK.exe
  C:\Windows\System\TuzCTHK.exe
  2⤵
  PID:3552
- C:\Windows\System\RVGlLre.exe
  C:\Windows\System\RVGlLre.exe
  2⤵
  PID:14292
- C:\Windows\System\JBfXhIY.exe
  C:\Windows\System\JBfXhIY.exe
  2⤵
  PID:5604
- C:\Windows\System\ytcZlBN.exe
  C:\Windows\System\ytcZlBN.exe
  2⤵
  PID:6432
- C:\Windows\System\nIACEns.exe
  C:\Windows\System\nIACEns.exe
  2⤵
  PID:1276
- C:\Windows\System\lqJubMp.exe
  C:\Windows\System\lqJubMp.exe
  2⤵
  PID:5176
- C:\Windows\System\KMaExdH.exe
  C:\Windows\System\KMaExdH.exe
  2⤵
  PID:5656
- C:\Windows\System\FEluRCZ.exe
  C:\Windows\System\FEluRCZ.exe
  2⤵
  PID:6140
- C:\Windows\System\FoBdGQp.exe
  C:\Windows\System\FoBdGQp.exe
  2⤵
  PID:6736
- C:\Windows\System\EAcPvBt.exe
  C:\Windows\System\EAcPvBt.exe
  2⤵
  PID:7028
- C:\Windows\System\kHLLAEe.exe
  C:\Windows\System\kHLLAEe.exe
  2⤵
  PID:5768
- C:\Windows\System\EWAxQFH.exe
  C:\Windows\System\EWAxQFH.exe
  2⤵
  PID:5876
- C:\Windows\System\ygXblcu.exe
  C:\Windows\System\ygXblcu.exe
  2⤵
  PID:6336
- C:\Windows\System\GGYZFVJ.exe
  C:\Windows\System\GGYZFVJ.exe
  2⤵
  PID:4524
- C:\Windows\System\bAvJwXs.exe
  C:\Windows\System\bAvJwXs.exe
  2⤵
  PID:6784
- C:\Windows\System\lpwRefu.exe
  C:\Windows\System\lpwRefu.exe
  2⤵
  PID:6632
- C:\Windows\System\onGJAcY.exe
  C:\Windows\System\onGJAcY.exe
  2⤵
  PID:6208
- C:\Windows\System\rYXJeXo.exe
  C:\Windows\System\rYXJeXo.exe
  2⤵
  PID:7120
- C:\Windows\System\fuFPLSs.exe
  C:\Windows\System\fuFPLSs.exe
  2⤵
  PID:13876
- C:\Windows\System\pNRdecS.exe
  C:\Windows\System\pNRdecS.exe
  2⤵
  PID:6116
- C:\Windows\System\qFJiECA.exe
  C:\Windows\System\qFJiECA.exe
  2⤵
  PID:6248
- C:\Windows\System\HegFXdF.exe
  C:\Windows\System\HegFXdF.exe
  2⤵
  PID:6668
- C:\Windows\System\iMBJfex.exe
  C:\Windows\System\iMBJfex.exe
  2⤵
  PID:3080
- C:\Windows\System\MSTHPBI.exe
  C:\Windows\System\MSTHPBI.exe
  2⤵
  PID:5584
- C:\Windows\System\VEvfSiE.exe
  C:\Windows\System\VEvfSiE.exe
  2⤵
  PID:6832
- C:\Windows\System\GmMFAXu.exe
  C:\Windows\System\GmMFAXu.exe
  2⤵
  PID:5508
- C:\Windows\System\ZPbyUpa.exe
  C:\Windows\System\ZPbyUpa.exe
  2⤵
  PID:1608
- C:\Windows\System\KnTPtAE.exe
  C:\Windows\System\KnTPtAE.exe
  2⤵
  PID:5284
- C:\Windows\System\oYqkBIg.exe
  C:\Windows\System\oYqkBIg.exe
  2⤵
  PID:13624
- C:\Windows\System\sLeBOlD.exe
  C:\Windows\System\sLeBOlD.exe
  2⤵
  PID:7908
- C:\Windows\System\MZwANNt.exe
  C:\Windows\System\MZwANNt.exe
  2⤵
  PID:4296
- C:\Windows\System\JmqCzQG.exe
  C:\Windows\System\JmqCzQG.exe
  2⤵
  PID:13340
- C:\Windows\System\GIznYUL.exe
  C:\Windows\System\GIznYUL.exe
  2⤵
  PID:5964
- C:\Windows\System\BVswzEx.exe
  C:\Windows\System\BVswzEx.exe
  2⤵
  PID:14268
- C:\Windows\System\JroXxLx.exe
  C:\Windows\System\JroXxLx.exe
  2⤵
  PID:7272
- C:\Windows\System\CXAoPbS.exe
  C:\Windows\System\CXAoPbS.exe
  2⤵
  PID:5356
- C:\Windows\System\wiQcRmp.exe
  C:\Windows\System\wiQcRmp.exe
  2⤵
  PID:7368
- C:\Windows\System\khxBUKG.exe
  C:\Windows\System\khxBUKG.exe
  2⤵
  PID:13640
- C:\Windows\System\XrUpafi.exe
  C:\Windows\System\XrUpafi.exe
  2⤵
  PID:7392
- C:\Windows\System\CNXdBAp.exe
  C:\Windows\System\CNXdBAp.exe
  2⤵
  PID:7348
- C:\Windows\System\KhZOPGZ.exe
  C:\Windows\System\KhZOPGZ.exe
  2⤵
  PID:6864
- C:\Windows\System\LWiAlOL.exe
  C:\Windows\System\LWiAlOL.exe
  2⤵
  PID:13212
- C:\Windows\System\qFRBeHB.exe
  C:\Windows\System\qFRBeHB.exe
  2⤵
  PID:5628
- C:\Windows\System\bbnLLis.exe
  C:\Windows\System\bbnLLis.exe
  2⤵
  PID:7244
- C:\Windows\System\lgvRBoB.exe
  C:\Windows\System\lgvRBoB.exe
  2⤵
  PID:6904
- C:\Windows\System\QYUxWsx.exe
  C:\Windows\System\QYUxWsx.exe
  2⤵
  PID:13460
- C:\Windows\System\IZAsYgt.exe
  C:\Windows\System\IZAsYgt.exe
  2⤵
  PID:3960
- C:\Windows\System\aTsOuKH.exe
  C:\Windows\System\aTsOuKH.exe
  2⤵
  PID:4244
- C:\Windows\System\fAFsrWq.exe
  C:\Windows\System\fAFsrWq.exe
  2⤵
  PID:7664
- C:\Windows\System\PaTaTak.exe
  C:\Windows\System\PaTaTak.exe
  2⤵
  PID:636
- C:\Windows\System\OgeBByh.exe
  C:\Windows\System\OgeBByh.exe
  2⤵
  PID:7252
- C:\Windows\System\OvkybzL.exe
  C:\Windows\System\OvkybzL.exe
  2⤵
  PID:3228
- C:\Windows\System\vDSqsfx.exe
  C:\Windows\System\vDSqsfx.exe
  2⤵
  PID:8008
- C:\Windows\System\xTJDElp.exe
  C:\Windows\System\xTJDElp.exe
  2⤵
  PID:7588
- C:\Windows\System\pSbbRic.exe
  C:\Windows\System\pSbbRic.exe
  2⤵
  PID:5132
- C:\Windows\System\mbYqziN.exe
  C:\Windows\System\mbYqziN.exe
  2⤵
  PID:6436
- C:\Windows\System\eFbmrMl.exe
  C:\Windows\System\eFbmrMl.exe
  2⤵
  PID:6716
- C:\Windows\System\WVRJczH.exe
  C:\Windows\System\WVRJczH.exe
  2⤵
  PID:5828
- C:\Windows\System\sqWkrMM.exe
  C:\Windows\System\sqWkrMM.exe
  2⤵
  PID:5316
- C:\Windows\System\LcbYilf.exe
  C:\Windows\System\LcbYilf.exe
  2⤵
  PID:7776
- C:\Windows\System\SZceKLP.exe
  C:\Windows\System\SZceKLP.exe
  2⤵
  PID:7404
- C:\Windows\System\WDrKsRc.exe
  C:\Windows\System\WDrKsRc.exe
  2⤵
  PID:13508
- C:\Windows\System\AKxyckp.exe
  C:\Windows\System\AKxyckp.exe
  2⤵
  PID:7856
- C:\Windows\System\PbvWFbG.exe
  C:\Windows\System\PbvWFbG.exe
  2⤵
  PID:4536
- C:\Windows\System\dZtcGeT.exe
  C:\Windows\System\dZtcGeT.exe
  2⤵
  PID:13940
- C:\Windows\System\SavsDes.exe
  C:\Windows\System\SavsDes.exe
  2⤵
  PID:3268
- C:\Windows\System\oTrUuyW.exe
  C:\Windows\System\oTrUuyW.exe
  2⤵
  PID:13636
- C:\Windows\System\CvKArAY.exe
  C:\Windows\System\CvKArAY.exe
  2⤵
  PID:13956
- C:\Windows\System\paQOHFG.exe
  C:\Windows\System\paQOHFG.exe
  2⤵
  PID:7352
- C:\Windows\System\aTrKUav.exe
  C:\Windows\System\aTrKUav.exe
  2⤵
  PID:6264
- C:\Windows\System\laJLEwz.exe
  C:\Windows\System\laJLEwz.exe
  2⤵
  PID:6504
- C:\Windows\System\SjYVTBg.exe
  C:\Windows\System\SjYVTBg.exe
  2⤵
  PID:7220
- C:\Windows\System\IcallaN.exe
  C:\Windows\System\IcallaN.exe
  2⤵
  PID:7608
- C:\Windows\System\ISwKKzW.exe
  C:\Windows\System\ISwKKzW.exe
  2⤵
  PID:7128
- C:\Windows\System\LkJykmx.exe
  C:\Windows\System\LkJykmx.exe
  2⤵
  PID:5352
- C:\Windows\System\ZJnHtsq.exe
  C:\Windows\System\ZJnHtsq.exe
  2⤵
  PID:8136
- C:\Windows\System\cVEfPGk.exe
  C:\Windows\System\cVEfPGk.exe
  2⤵
  PID:13368
- C:\Windows\System\eGCzIqO.exe
  C:\Windows\System\eGCzIqO.exe
  2⤵
  PID:13360
- C:\Windows\System\DpgFmJS.exe
  C:\Windows\System\DpgFmJS.exe
  2⤵
  PID:13096
- C:\Windows\System\pivORKk.exe
  C:\Windows\System\pivORKk.exe
  2⤵
  PID:13120
- C:\Windows\System\xJKphDP.exe
  C:\Windows\System\xJKphDP.exe
  2⤵
  PID:1264
- C:\Windows\System\WcYYCAQ.exe
  C:\Windows\System\WcYYCAQ.exe
  2⤵
  PID:6496
- C:\Windows\System\RoeMiXu.exe
  C:\Windows\System\RoeMiXu.exe
  2⤵
  PID:8664
- C:\Windows\System\DUrHxac.exe
  C:\Windows\System\DUrHxac.exe
  2⤵
  PID:8648
- C:\Windows\System\dmiSYNn.exe
  C:\Windows\System\dmiSYNn.exe
  2⤵
  PID:8780
- C:\Windows\System\ZpkQasO.exe
  C:\Windows\System\ZpkQasO.exe
  2⤵
  PID:3120
- C:\Windows\System\KHnXWXJ.exe
  C:\Windows\System\KHnXWXJ.exe
  2⤵
  PID:8760
- C:\Windows\System\yYCYMFn.exe
  C:\Windows\System\yYCYMFn.exe
  2⤵
  PID:3592
- C:\Windows\System\agRxbSI.exe
  C:\Windows\System\agRxbSI.exe
  2⤵
  PID:8748
- C:\Windows\System\TpDdUjs.exe
  C:\Windows\System\TpDdUjs.exe
  2⤵
  PID:8740
- C:\Windows\System\vAucapC.exe
  C:\Windows\System\vAucapC.exe
  2⤵
  PID:8556
- C:\Windows\System\bJmjLgJ.exe
  C:\Windows\System\bJmjLgJ.exe
  2⤵
  PID:7680
- C:\Windows\System\bXIRPGo.exe
  C:\Windows\System\bXIRPGo.exe
  2⤵
  PID:8560
- C:\Windows\System\pzVIorz.exe
  C:\Windows\System\pzVIorz.exe
  2⤵
  PID:8812
- C:\Windows\System\oEPWQzV.exe
  C:\Windows\System\oEPWQzV.exe
  2⤵
  PID:12060
- C:\Windows\System\IhdZSZk.exe
  C:\Windows\System\IhdZSZk.exe
  2⤵
  PID:8816
- C:\Windows\System\femmsKm.exe
  C:\Windows\System\femmsKm.exe
  2⤵
  PID:6244
- C:\Windows\System\ODlivDf.exe
  C:\Windows\System\ODlivDf.exe
  2⤵
  PID:8784
- C:\Windows\System\hOcpWVt.exe
  C:\Windows\System\hOcpWVt.exe
  2⤵
  PID:7736
- C:\Windows\System\qgPLcjK.exe
  C:\Windows\System\qgPLcjK.exe
  2⤵
  PID:9036
- C:\Windows\System\CgQOSWW.exe
  C:\Windows\System\CgQOSWW.exe
  2⤵
  PID:8640
- C:\Windows\System\DpZkEbC.exe
  C:\Windows\System\DpZkEbC.exe
  2⤵
  PID:5260
- C:\Windows\System\oSOrTsg.exe
  C:\Windows\System\oSOrTsg.exe
  2⤵
  PID:2668
- C:\Windows\System\SzrxyLe.exe
  C:\Windows\System\SzrxyLe.exe
  2⤵
  PID:4324
- C:\Windows\System\eUZFsUM.exe
  C:\Windows\System\eUZFsUM.exe
  2⤵
  PID:9352
- C:\Windows\System\vpBeORh.exe
  C:\Windows\System\vpBeORh.exe
  2⤵
  PID:1076
- C:\Windows\System\bfLPBEQ.exe
  C:\Windows\System\bfLPBEQ.exe
  2⤵
  PID:7748
- C:\Windows\System\QMsCNuJ.exe
  C:\Windows\System\QMsCNuJ.exe
  2⤵
  PID:7288
- C:\Windows\System\sadTEPh.exe
  C:\Windows\System\sadTEPh.exe
  2⤵
  PID:8120
- C:\Windows\System\mbrtVfm.exe
  C:\Windows\System\mbrtVfm.exe
  2⤵
  PID:13252
- C:\Windows\System\oBWEkJV.exe
  C:\Windows\System\oBWEkJV.exe
  2⤵
  PID:9664
- C:\Windows\System\VnCoNSk.exe
  C:\Windows\System\VnCoNSk.exe
  2⤵
  PID:7860
- C:\Windows\System\PvLVgXF.exe
  C:\Windows\System\PvLVgXF.exe
  2⤵
  PID:8568
- C:\Windows\System\yXmqXHB.exe
  C:\Windows\System\yXmqXHB.exe
  2⤵
  PID:8396
- C:\Windows\System\FDgptHb.exe
  C:\Windows\System\FDgptHb.exe
  2⤵
  PID:8372
- C:\Windows\System\mGrxNqz.exe
  C:\Windows\System\mGrxNqz.exe
  2⤵
  PID:8548
- C:\Windows\System\SNLhXmX.exe
  C:\Windows\System\SNLhXmX.exe
  2⤵
  PID:9604
- C:\Windows\System\bUILgKM.exe
  C:\Windows\System\bUILgKM.exe
  2⤵
  PID:8348
- C:\Windows\System\JdzPthQ.exe
  C:\Windows\System\JdzPthQ.exe
  2⤵
  PID:7992
- C:\Windows\System\gkQrIOe.exe
  C:\Windows\System\gkQrIOe.exe
  2⤵
  PID:3352
- C:\Windows\System\PmYslCw.exe
  C:\Windows\System\PmYslCw.exe
  2⤵
  PID:8672
- C:\Windows\System\JexYuam.exe
  C:\Windows\System\JexYuam.exe
  2⤵
  PID:7492
- C:\Windows\System\vchNrjc.exe
  C:\Windows\System\vchNrjc.exe
  2⤵
  PID:7668
- C:\Windows\System\icarTdC.exe
  C:\Windows\System\icarTdC.exe
  2⤵
  PID:9688
- C:\Windows\System\srDPkdV.exe
  C:\Windows\System\srDPkdV.exe
  2⤵
  PID:7732
- C:\Windows\System\iCrJGbv.exe
  C:\Windows\System\iCrJGbv.exe
  2⤵
  PID:9832
- C:\Windows\System\pwcjmyy.exe
  C:\Windows\System\pwcjmyy.exe
  2⤵
  PID:9880
- C:\Windows\System\vDZnGuI.exe
  C:\Windows\System\vDZnGuI.exe
  2⤵
  PID:9508
- C:\Windows\System\DyMupMY.exe
  C:\Windows\System\DyMupMY.exe
  2⤵
  PID:12764
- C:\Windows\System\ehOLQGa.exe
  C:\Windows\System\ehOLQGa.exe
  2⤵
  PID:9804
- C:\Windows\System\feleqNn.exe
  C:\Windows\System\feleqNn.exe
  2⤵
  PID:5028
- C:\Windows\System\yJbVApH.exe
  C:\Windows\System\yJbVApH.exe
  2⤵
  PID:7176
- C:\Windows\System\IZQSSMb.exe
  C:\Windows\System\IZQSSMb.exe
  2⤵
  PID:10056
- C:\Windows\System\aAncadQ.exe
  C:\Windows\System\aAncadQ.exe
  2⤵
  PID:9260
- C:\Windows\System\mzRFOnw.exe
  C:\Windows\System\mzRFOnw.exe
  2⤵
  PID:9928
- C:\Windows\System\GpVMotg.exe
  C:\Windows\System\GpVMotg.exe
  2⤵
  PID:7076
- C:\Windows\System\EMQZLhf.exe
  C:\Windows\System\EMQZLhf.exe
  2⤵
  PID:7792
- C:\Windows\System\STvXtRy.exe
  C:\Windows\System\STvXtRy.exe
  2⤵
  PID:10952
- C:\Windows\System\qwebcRF.exe
  C:\Windows\System\qwebcRF.exe
  2⤵
  PID:10120
- C:\Windows\System\cBGECrM.exe
  C:\Windows\System\cBGECrM.exe
  2⤵
  PID:9892
- C:\Windows\System\yKLhmWD.exe
  C:\Windows\System\yKLhmWD.exe
  2⤵
  PID:10016
- C:\Windows\System\yhvTPxh.exe
  C:\Windows\System\yhvTPxh.exe
  2⤵
  PID:9364
- C:\Windows\System\lIXZBST.exe
  C:\Windows\System\lIXZBST.exe
  2⤵
  PID:7248
- C:\Windows\System\hHkjRhB.exe
  C:\Windows\System\hHkjRhB.exe
  2⤵
  PID:7412
- C:\Windows\System\nKEttjj.exe
  C:\Windows\System\nKEttjj.exe
  2⤵
  PID:3472
- C:\Windows\System\JNJcmOg.exe
  C:\Windows\System\JNJcmOg.exe
  2⤵
  PID:10128
- C:\Windows\System\uTKBNRS.exe
  C:\Windows\System\uTKBNRS.exe
  2⤵
  PID:9588
- C:\Windows\System\XfJfsfM.exe
  C:\Windows\System\XfJfsfM.exe
  2⤵
  PID:9328
- C:\Windows\System\RtSshKx.exe
  C:\Windows\System\RtSshKx.exe
  2⤵
  PID:9436
- C:\Windows\System\YIORQIt.exe
  C:\Windows\System\YIORQIt.exe
  2⤵
  PID:10168
- C:\Windows\System\iepHjso.exe
  C:\Windows\System\iepHjso.exe
  2⤵
  PID:12344
- C:\Windows\System\ScbsxCv.exe
  C:\Windows\System\ScbsxCv.exe
  2⤵
  PID:9504
- C:\Windows\System\PFjdNWr.exe
  C:\Windows\System\PFjdNWr.exe
  2⤵
  PID:6912
- C:\Windows\System\zBveiuN.exe
  C:\Windows\System\zBveiuN.exe
  2⤵
  PID:10540
- C:\Windows\System\TUHPgbS.exe
  C:\Windows\System\TUHPgbS.exe
  2⤵
  PID:10084
- C:\Windows\System\QHNJasB.exe
  C:\Windows\System\QHNJasB.exe
  2⤵
  PID:9684
- C:\Windows\System\gMBitJh.exe
  C:\Windows\System\gMBitJh.exe
  2⤵
  PID:2176
- C:\Windows\System\cxHjWel.exe
  C:\Windows\System\cxHjWel.exe
  2⤵
  PID:10124
- C:\Windows\System\MBifZUQ.exe
  C:\Windows\System\MBifZUQ.exe
  2⤵
  PID:8688
- C:\Windows\System\duPYkyj.exe
  C:\Windows\System\duPYkyj.exe
  2⤵
  PID:14340
- C:\Windows\System\TxVXSnY.exe
  C:\Windows\System\TxVXSnY.exe
  2⤵
  PID:14368
- C:\Windows\System\OSzOVQI.exe
  C:\Windows\System\OSzOVQI.exe
  2⤵
  PID:14396
- C:\Windows\System\jIszeUx.exe
  C:\Windows\System\jIszeUx.exe
  2⤵
  PID:14416
- C:\Windows\System\qmDFWpI.exe
  C:\Windows\System\qmDFWpI.exe
  2⤵
  PID:14444
- C:\Windows\System\OJUjjfY.exe
  C:\Windows\System\OJUjjfY.exe
  2⤵
  PID:14472
- C:\Windows\System\krIwkBO.exe
  C:\Windows\System\krIwkBO.exe
  2⤵
  PID:14496
- C:\Windows\System\ZfQbttH.exe
  C:\Windows\System\ZfQbttH.exe
  2⤵
  PID:14528
- C:\Windows\System\hEmQiHM.exe
  C:\Windows\System\hEmQiHM.exe
  2⤵
  PID:14560
- C:\Windows\System\tISzaGV.exe
  C:\Windows\System\tISzaGV.exe
  2⤵
  PID:14584
- C:\Windows\System\cJfSUrl.exe
  C:\Windows\System\cJfSUrl.exe
  2⤵
  PID:14608
- C:\Windows\System\CRrCaqD.exe
  C:\Windows\System\CRrCaqD.exe
  2⤵
  PID:14636
- C:\Windows\System\BHPjksM.exe
  C:\Windows\System\BHPjksM.exe
  2⤵
  PID:14660
- C:\Windows\System\NKdeuby.exe
  C:\Windows\System\NKdeuby.exe
  2⤵
  PID:14688
- C:\Windows\System\ychVUcr.exe
  C:\Windows\System\ychVUcr.exe
  2⤵
  PID:14728
- C:\Windows\System\wKtjtsj.exe
  C:\Windows\System\wKtjtsj.exe
  2⤵
  PID:14752
- C:\Windows\System\liXnjsC.exe
  C:\Windows\System\liXnjsC.exe
  2⤵
  PID:14784
- C:\Windows\System\LvRlrzC.exe
  C:\Windows\System\LvRlrzC.exe
  2⤵
  PID:14808
- C:\Windows\System\KieTcmN.exe
  C:\Windows\System\KieTcmN.exe
  2⤵
  PID:14840
- C:\Windows\System\BuxuYpp.exe
  C:\Windows\System\BuxuYpp.exe
  2⤵
  PID:14876
- C:\Windows\System\zNPqlVv.exe
  C:\Windows\System\zNPqlVv.exe
  2⤵
  PID:14904
- C:\Windows\System\rVvNKVy.exe
  C:\Windows\System\rVvNKVy.exe
  2⤵
  PID:14940
- C:\Windows\System\PtOLXRE.exe
  C:\Windows\System\PtOLXRE.exe
  2⤵
  PID:14972
- C:\Windows\System\pWIMzoG.exe
  C:\Windows\System\pWIMzoG.exe
  2⤵
  PID:15000
- C:\Windows\System\qAfHZIk.exe
  C:\Windows\System\qAfHZIk.exe
  2⤵
  PID:15024
- C:\Windows\System\crEhwDS.exe
  C:\Windows\System\crEhwDS.exe
  2⤵
  PID:15056
- C:\Windows\System\PodEzpN.exe
  C:\Windows\System\PodEzpN.exe
  2⤵
  PID:15084
- C:\Windows\System\fKeRuIg.exe
  C:\Windows\System\fKeRuIg.exe
  2⤵
  PID:15112
- C:\Windows\System\JJKpAUf.exe
  C:\Windows\System\JJKpAUf.exe
  2⤵
  PID:15136
- C:\Windows\System\bUBxRMI.exe
  C:\Windows\System\bUBxRMI.exe
  2⤵
  PID:15164
- C:\Windows\System\ElrTwnj.exe
  C:\Windows\System\ElrTwnj.exe
  2⤵
  PID:15188
- C:\Windows\System\PnxuKaK.exe
  C:\Windows\System\PnxuKaK.exe
  2⤵
  PID:15224
- C:\Windows\System\Jyffqtf.exe
  C:\Windows\System\Jyffqtf.exe
  2⤵
  PID:15240
- C:\Windows\System\tsYKGpT.exe
  C:\Windows\System\tsYKGpT.exe
  2⤵
  PID:15256
- C:\Windows\System\ZsJEfpF.exe
  C:\Windows\System\ZsJEfpF.exe
  2⤵
  PID:15288
- C:\Windows\System\HpWooOQ.exe
  C:\Windows\System\HpWooOQ.exe
  2⤵
  PID:15344
- C:\Windows\System\fNPDBIH.exe
  C:\Windows\System\fNPDBIH.exe
  2⤵
  PID:10656
- C:\Windows\System\ajWEouc.exe
  C:\Windows\System\ajWEouc.exe
  2⤵
  PID:10668
- C:\Windows\System\iuUxIZN.exe
  C:\Windows\System\iuUxIZN.exe
  2⤵
  PID:7712
- C:\Windows\System\RGlHBuN.exe
  C:\Windows\System\RGlHBuN.exe
  2⤵
  PID:10000
- C:\Windows\System\evuPBti.exe
  C:\Windows\System\evuPBti.exe
  2⤵
  PID:8500
- C:\Windows\System\OIYgNxv.exe
  C:\Windows\System\OIYgNxv.exe
  2⤵
  PID:10628
- C:\Windows\System\xwDEajW.exe
  C:\Windows\System\xwDEajW.exe
  2⤵
  PID:8644
- C:\Windows\System\scTTVTP.exe
  C:\Windows\System\scTTVTP.exe
  2⤵
  PID:14384
- C:\Windows\System\sgXFFDw.exe
  C:\Windows\System\sgXFFDw.exe
  2⤵
  PID:11048
- C:\Windows\System\SSWuPlC.exe
  C:\Windows\System\SSWuPlC.exe
  2⤵
  PID:10400
- C:\Windows\System\neGmaHh.exe
  C:\Windows\System\neGmaHh.exe
  2⤵
  PID:14816
- C:\Windows\System\uMkeQWC.exe
  C:\Windows\System\uMkeQWC.exe
  2⤵
  PID:15080
- C:\Windows\System\owOcFJB.exe
  C:\Windows\System\owOcFJB.exe
  2⤵
  PID:15176
- C:\Windows\System\OEhFmYL.exe
  C:\Windows\System\OEhFmYL.exe
  2⤵
  PID:15312
- C:\Windows\System\jZLLYIn.exe
  C:\Windows\System\jZLLYIn.exe
  2⤵
  PID:15108
- C:\Windows\System\EZhLxUM.exe
  C:\Windows\System\EZhLxUM.exe
  2⤵
  PID:10172
- C:\Windows\System\IvrriZp.exe
  C:\Windows\System\IvrriZp.exe
  2⤵
  PID:10468
- C:\Windows\System\WJewBkT.exe
  C:\Windows\System\WJewBkT.exe
  2⤵
  PID:14404
- C:\Windows\System\fOhwbok.exe
  C:\Windows\System\fOhwbok.exe
  2⤵
  PID:14544
- C:\Windows\System\ydCMUFw.exe
  C:\Windows\System\ydCMUFw.exe
  2⤵
  PID:15324
- C:\Windows\System\FxRAzKg.exe
  C:\Windows\System\FxRAzKg.exe
  2⤵
  PID:14696
- C:\Windows\System\WkETcHx.exe
  C:\Windows\System\WkETcHx.exe
  2⤵
  PID:11376
- C:\Windows\System\NxeJtGE.exe
  C:\Windows\System\NxeJtGE.exe
  2⤵
  PID:14424
- C:\Windows\System\hMAeNgY.exe
  C:\Windows\System\hMAeNgY.exe
  2⤵
  PID:14988
- C:\Windows\System\ZlojcoH.exe
  C:\Windows\System\ZlojcoH.exe
  2⤵
  PID:14492
- C:\Windows\System\yYEkwKT.exe
  C:\Windows\System\yYEkwKT.exe
  2⤵
  PID:10096
- C:\Windows\System\UywubZe.exe
  C:\Windows\System\UywubZe.exe
  2⤵
  PID:1524
- C:\Windows\System\WYePRkp.exe
  C:\Windows\System\WYePRkp.exe
  2⤵
  PID:9244
- C:\Windows\System\XRHTURQ.exe
  C:\Windows\System\XRHTURQ.exe
  2⤵
  PID:12404
- C:\Windows\System\YvRpGEe.exe
  C:\Windows\System\YvRpGEe.exe
  2⤵
  PID:15236
- C:\Windows\System\rxSyPtF.exe
  C:\Windows\System\rxSyPtF.exe
  2⤵
  PID:11552
- C:\Windows\System\thMXMSl.exe
  C:\Windows\System\thMXMSl.exe
  2⤵
  PID:12068
- C:\Windows\System\wTNnMVK.exe
  C:\Windows\System\wTNnMVK.exe
  2⤵
  PID:8432
- C:\Windows\System\ZilfQuk.exe
  C:\Windows\System\ZilfQuk.exe
  2⤵
  PID:10764
- C:\Windows\System\Yejycmd.exe
  C:\Windows\System\Yejycmd.exe
  2⤵
  PID:14856
- C:\Windows\System\CQymZwJ.exe
  C:\Windows\System\CQymZwJ.exe
  2⤵
  PID:10092
- C:\Windows\System\YyUUDeF.exe
  C:\Windows\System\YyUUDeF.exe
  2⤵
  PID:14896
- C:\Windows\System\KbSMLRg.exe
  C:\Windows\System\KbSMLRg.exe
  2⤵
  PID:11768
- C:\Windows\System\JNQVTzF.exe
  C:\Windows\System\JNQVTzF.exe
  2⤵
  PID:15356
- C:\Windows\System\mEqLCrB.exe
  C:\Windows\System\mEqLCrB.exe
  2⤵
  PID:15208
- C:\Windows\System\saJYsDZ.exe
  C:\Windows\System\saJYsDZ.exe
  2⤵
  PID:12356
- C:\Windows\System\yRkdMmB.exe
  C:\Windows\System\yRkdMmB.exe
  2⤵
  PID:15128
- C:\Windows\System\dhuWdTi.exe
  C:\Windows\System\dhuWdTi.exe
  2⤵
  PID:12804
- C:\Windows\System\pfKaPgW.exe
  C:\Windows\System\pfKaPgW.exe
  2⤵
  PID:10100
- C:\Windows\System\gQQxOlw.exe
  C:\Windows\System\gQQxOlw.exe
  2⤵
  PID:11716
- C:\Windows\System\ugRYuSv.exe
  C:\Windows\System\ugRYuSv.exe
  2⤵
  PID:11336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ou1svmcn.yqg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BPAvAWE.exe

Filesize
1.9MB

MD5
099aa551aeea50fc1d85764596d6192f

SHA1
fc7e540d84f0d387ccdbdcda7ca979ae639c6bea

SHA256
41bc7e1fdc7cc73476a9575c2ca01e4e0484842bf82b334a76bc1e428abc1799

SHA512
3bf0872df89c69f46df399352bec7d4277a557eb1e7db86e20d1403531a906165973f5d27f83cf968c210cdc0b556f110423a6be64f9380fbaee11973046ce4c

Download Submit
C:\Windows\System\CGBVeoM.exe

Filesize
1.9MB

MD5
7b7fcb4d0af8f0ce808b95e18b64e151

SHA1
a19f76fb8ce26bbe147df62c8d78d23509678ab1

SHA256
8e19ddab9caf96591a83420740ce908cdf5051dbe8f87398a668a772f8b65ee5

SHA512
67e3e3d447071ea5a7a7dc2d2615cd62416693251cd96f16847d083e88bf4783fd711333fdbc4d78d58bb1210c0607923c7136a6567ebe557b947152257b7375

Download Submit
C:\Windows\System\CceSHGR.exe

Filesize
2.0MB

MD5
1faaa6f282d9fbd7a84274bfba7af130

SHA1
5e6668bb8e87aacdc6d46487ceec7c732fe63632

SHA256
2ef0aae4948c963c83f1eea9a0c10dca78c231b6bd6bbf711c6c0750efd0f95b

SHA512
e53bf2a35ebe33e2f5954cc828d1a7d4a76e65d3c6e09b44e5c6ab9676d697fbce9c2eeb30a386cc32ce543dd14b20100d381275a878228d05f68aa9cf1dc376

Download Submit
C:\Windows\System\DvKLEWJ.exe

Filesize
1.9MB

MD5
2bb5278ed906bc7eb072e9f0465fc243

SHA1
61157e601d286d7ca1ba283eea092b353c9a569d

SHA256
7360d990552696a6ec677e2f0bd89ae6730d59428e4a3f4c2d8a502af01e004f

SHA512
a968170c23f695a6e17ad4c667ecee14a5dcf6ec6db8ac861b343f352b78cce95732590102eee15b91ac183df33c65a47cbf9889494d80586ba21199267d131b

Download Submit
C:\Windows\System\EhvizIu.exe

Filesize
18B

MD5
a9a71c00fa2841c1dc78046106a11fbe

SHA1
dd4daed3b796a2e3184465a2d3bfa8be75f83888

SHA256
5a2c43fade5b843300d583be7d18d2b10755cef85024dc62ea5a8a1cfb12154a

SHA512
4e04a6fb0dbddf1c9f1ac0808d7f713dd2f81fb428b3a018a444691b509772b68074d01e662d7e4912a12102ae507b6a88b16f50869c85fcde6298c57cb2bcf6

Download Submit
C:\Windows\System\EmXpUGG.exe

Filesize
1.9MB

MD5
bb30c9240e2e32630f6bb3abf2c3b987

SHA1
187101c1fda09d5b18b88693c8acfa7b1449fdce

SHA256
fe0e4f9d141d5397f7c5a7c4cc63caa765fadfd1530c902bdf0f4ef4a06f182c

SHA512
db273d2da39db9d1e13d8328f40778ca1022ab9e04f476cebfdb46a8405ad893d71bbb94027eaeb26549edfef6f333699d0063b188a97ccb81e413c5374fee52

Download Submit
C:\Windows\System\FTJQRMz.exe

Filesize
1.9MB

MD5
acb5278895e2cae3b24b73f4beebb43c

SHA1
0c264cc9dd60320057bbbbb44451b318be50fea0

SHA256
a4fb060169898ad5ecabc7ae2c5ba627827d9f8a7192d6cbf302c6fff3ea2037

SHA512
74213e646c28b1a8c2bc67393e7ecf7be18651688e7d067d23d1d23004704687e97d1970e4879fb4ab96b7071f26de8215ece5a9e5d16a4766561a30d5c76291

Download Submit
C:\Windows\System\HpussmB.exe

Filesize
1.9MB

MD5
5149ff8685edc9fa651cf9f679163f51

SHA1
7d7bcae2c5cadc3424f53de361626f81c1b37941

SHA256
d15a33113cea6ffe312ff9cc7c6e8a2b8f3977e41b631abff2ea46b48c30a515

SHA512
c829849ef7d66650071fd0f4d0f0507d51143ff33101fab73f7f08f502a0cef32931cea63ed073565eb9910be1832e23fd40b0367cc80dd244d030716100afab

Download Submit
C:\Windows\System\ISNJFsT.exe

Filesize
1.9MB

MD5
7c5fa9e9a04526a9273b92d8324bfed5

SHA1
60b480152c66dc9f645e085e1d362bd47fe32a4c

SHA256
d8df29891f0de1c58c2c0a7e24a9aef07eb1415a970a24e7b6155e5127e3b9f0

SHA512
08d7bac256fbf038bed2de5a9000e40bb1f79ba6f5f44397a702b13bfaf5ecd83fc5aaec0caf2839d8f05659157a172bc6f73874567fd4eba9a0265df39460ee

Download Submit
C:\Windows\System\JsgrEwa.exe

Filesize
2.0MB

MD5
9305ef0742c0c0d306923edee28232f4

SHA1
91130a7dbc0a1094668c900da756fce2742781e4

SHA256
3e6b14c742f3593423c053f8c85e099612ff6699dc6df10ffe216422781b1705

SHA512
54c17ae502813f5b39c40cdd334545da38410b6697f20ca8865cee937ec8618690b79e6f8e19794b72854d6f624934ec49a63bd8f0f5ceedbb19d5e242afaea5

Download Submit
C:\Windows\System\KNaJgfo.exe

Filesize
2.0MB

MD5
f31c349731af3bc72bcf5fb6da82ff36

SHA1
e55dc14b787273a57a4f8854811e4a7adf4bc5e5

SHA256
741b7a0de38e90e970a5a04ec68044e47657d63d7da2bc283fd13ad1bd62b236

SHA512
357d3df9dfa27b5fca0688c40c0bf9974066b2b77808534fa10e5888aa0f41ec8d4cd4afb9ff9601b17d94949a3ce2fc5dec729499b64803ff2cbab780b327d4

Download Submit
C:\Windows\System\MoBPSPw.exe

Filesize
1.9MB

MD5
5a1f501f680fdc883d0893964e37131d

SHA1
3417d4d6fba83d68931e77ef9e6613d38892ef66

SHA256
24c95417b66dd05c66339cc0e1d01d81193d4de54a01737131f3a7064f7e622f

SHA512
0c03e70a8197124be51cd848f525ba198baef7769118ae1e956b9d7e9d135f9a2f03473fcffa9244a4d000f4f196bc19dd71471d61e3b1c7c5a7f265198c50a1

Download Submit
C:\Windows\System\NaWftZk.exe

Filesize
1.9MB

MD5
06cd98b781cf3514a1b510da3468ad8f

SHA1
7bc72f166fa35b54e737843bd285c6d4afeb163b

SHA256
3453a75bf07072be3e15d4db0e5ae7bcea12e18c566e6b72166559a055cbb138

SHA512
c9c24cc12ac442846e34feb660733421e105ba1b850c03c55f6e5d4f48735006fcd1b8cd8160e63b04abe33e9d1feba1ee646b5c341eaced863fce091fb1a9cc

Download Submit
C:\Windows\System\NoJlmco.exe

Filesize
2.0MB

MD5
b228827deaf1a2abbe7d13efb6e50546

SHA1
846511f355a3915822ae25e7f7fc22afdf0df89e

SHA256
1ffcc897cfbe0611acbd72cd33e550a1b50df560252ef03a1ffe9b01053bbfc4

SHA512
e2d73dad51d868a0a71311e6da6781e5356765d92fe545f88436efa812db57bdba31657bf3d8ebc2b3f2000da6587e670e38bc0dfb6d3157aa324e49b29a4311

Download Submit
C:\Windows\System\ObxLxPF.exe

Filesize
2.0MB

MD5
e8c9f51cf3eb0b43c6e01d30a206d68a

SHA1
4576c5f4bcbf74d8ab112fd4a84e0c0bafd8cf10

SHA256
95449b2cfc45d12c98eaba9b35e35ca6bcec811b5f9a1f7efe45bbb84d2c11e9

SHA512
26a8527c0aadc81f66b2d501bd3b0c7cb4406829e047fe146e6e66db72e0acd82ec5c346c5542d8135e27b817b2095ea09c770acadae3cee408e48f98d37e00c

Download Submit
C:\Windows\System\PgYhOgg.exe

Filesize
2.0MB

MD5
4cac867e174a49e3cc3cf25cedc76d70

SHA1
c81bf0421528e1a5f80eee6de7f82d8959273944

SHA256
7591a17b0622b58768ded21b83880d5aca9aa6ef655f89734ed8bb22d4387ad6

SHA512
59c4a39955ede196a65d173decbe7060e9f23bc492a1e1016b72bc74a6d4708932f95c341a23949df6244768d1fd3e391d1588b1a6655b65007ea11ec4c1c22c

Download Submit
C:\Windows\System\SIzcvDT.exe

Filesize
1.9MB

MD5
b3d64cef6f81da3975daf53fc7c67ad8

SHA1
592df1e4f3f9eba992b8de3918d7435202e687b8

SHA256
13747fef7e84551370233759eac119af45c5468951ebf30a429c1a2ff787c4de

SHA512
3ab793e2547cff00e83f69940061f67d4bc903aa74528d39d2343e21d246a7a67edac08e88220d33253996cb3ba2c32b246b6128e16578e8d1fcd194048ea71b

Download Submit
C:\Windows\System\SvXQChE.exe

Filesize
1.9MB

MD5
4d9e8280595933e47f31747815c3b145

SHA1
1e72b99d171e9050d5e095c7f3de63d4ec2f48b1

SHA256
dff3013d94e76eb63f74b4f9aacf1e0c5bbbcb53308a424e3deb598828fdecd9

SHA512
08b2be5be5c6f059a5f12e78268304603a578bb1168e731867bae8172696eaf8565844c122f8f88d00d249a4df7e2c52fb4ef70f13995a71834b7b69bedf254a

Download Submit
C:\Windows\System\TLXhgSB.exe

Filesize
1.9MB

MD5
27886e5349a485f2ea768a53f8257682

SHA1
2b4ed9235c151b1755b937dcc5aa90c4d71b462a

SHA256
bc2eac3899fafbabce1d03e6d2b2318fdde8e76130de61849b749a95d6610d19

SHA512
8c184524bf9bc183ff9f5d67961b808341e6fa2cdb7965d995c5480f0a6b47cae7f84a2e721c8d856e4897f340252ab16a893435862610d3d62e7b02ebfdfa34

Download Submit
C:\Windows\System\TPugcYG.exe

Filesize
1.9MB

MD5
98b20e2dff888a42adb00647e8af2279

SHA1
2260b6cc29ee2c5f978842ba81122a9be7227f74

SHA256
a791d6548c1c340a2e12d45ece620237f57a3c0937237799a8a67b3191b89c15

SHA512
565b2ee753bd302bfede6d16c104bba31edc282db8d7f84518e75148dc6d239c1d6f4f8c07e117fbb8dd14dc5fc9881b97c90ad10f1a859d1f21977fcf115594

Download Submit
C:\Windows\System\VNDEBxN.exe

Filesize
1.9MB

MD5
f814522f9dcd0761cb9e6c14bbc48aa9

SHA1
02aecf5b263415154fe0ee5f1428d3001525f980

SHA256
29682300322c6def78381dae743630439bd5b93175961c679675169c0100ce8a

SHA512
74cebadb2d5ca3b3a3d4c27e70514fb1f8dc1e2dc2682d4378d2302be033949af9ab81bc265101939567ffb2adb0015a7eb2b2f2fc6fc05e3084b6a90cf9ea78

Download Submit
C:\Windows\System\ZALqYuk.exe

Filesize
1.9MB

MD5
f985e7f30b02a2137c3667503a77c436

SHA1
7d219698ab89f507c612741fb9899bd45ff2da3d

SHA256
187fa7f6712c6c667fd7ef54e468cf00fae933c6402a2c402558312f16ae0c4c

SHA512
42cba140c503411d50dfd7571a805c573483e4e967a7732e2200cbed5b541d9c57864c86158726ce6bbcc88ef9c45c6899cfad32034dc97e2fca442d402b05eb

Download Submit
C:\Windows\System\bBOLgCS.exe

Filesize
2.0MB

MD5
69cd2cbb9b530bf65f559263afd86cd2

SHA1
02ef11c27b2e40421d714d4d124066d1b24b2b47

SHA256
dd75cf9e5fdf4d829b42d9cdc44c22224efc964bf49c3906f622a6835b710cc1

SHA512
a5e64b164a0c1c8b4c63b02440b071cb90e628e30a02d8b4efd060ce22f1483b387fb213ea156eec6d16f899d858a8482dad540f642e8a2cbebfd516eba4cc9a

Download Submit
C:\Windows\System\bxPHItk.exe

Filesize
1.9MB

MD5
a528f266b7c4c5bef0ea54bd88917918

SHA1
02c5a6560e99726256e654009326d47a13f0ef7c

SHA256
d5a446d2c33bf050f4734d2e13fc1a85eca7bd0b5f6fa6a21cf172710dad258a

SHA512
7245506941a45d5902e8b2b0490d0f343bdfdc89b230678a773a36e3958c0f23788523981c7b70d4027216c839e6a8f1a9ec8d348ef8a4e34204f865f5528fb5

Download Submit
C:\Windows\System\cXkZUVd.exe

Filesize
8B

MD5
ab3cbb0f5b25d29e1fe3885f31b6d5cd

SHA1
7c22d15ea6b3a43c82c09cc7df11efe3a37eb37d

SHA256
28c2807be2e7d04fb566b5f83e2eb3cc33fdcafa16aea05da58ef8a635a2cf4e

SHA512
ed6182d10035a015e01b6a31951ea502b44408b56e8a7e88b1c72aa2be90eda454a56bef8ab64846f932260fd4d1d5c015b4df2e3228a45ce6c70b82989061c9

Download Submit
C:\Windows\System\dGNdKhY.exe

Filesize
1.9MB

MD5
a70924d2a7f3bbd50d47528ee32f09a4

SHA1
89e874dcd39f1d2cf724dde4da196e2d9b491b87

SHA256
c88de6bea6d3c9a6cc03ff4eaf0222887cef5abb9ff4bd5d1f0e44d0aed768c9

SHA512
f52432829b968a090ea65dec0982524dbf19e00f742e197bccd8800627afc377589345f3647301e5743b27ad2958e6c390a5cec377ba7cdf0829e33a0806e4de

Download Submit
C:\Windows\System\eWODQek.exe

Filesize
2.0MB

MD5
d97309391b8ecbb61b16a0e0017698cd

SHA1
fbbb762c0f5df04e5614707482ddf430e6415f65

SHA256
d3719ca19f1332d8d0d6dd990a76385959d617495ef648e13d36046662daa48b

SHA512
1b068c1fc908b648e292944f8a73c1e79b7f7a42150ef9524b88fd0439a1c9019864197a5865bfd0a0607d12e6e2c37711bf0834244a5219198f4112291fe03d

Download Submit
C:\Windows\System\htkAhCE.exe

Filesize
1.9MB

MD5
84b237d459a83eccd80cb23e46dbb740

SHA1
900bf7923554487569154c0148731b3b26f334ca

SHA256
2f6cf8cf423f49336ed1996b1334d37f0902a3a1d7227ae043885a30901e6b88

SHA512
c73a7982c4542bfd8140861daa1aee01442155c8dc83e1c7013271488268ae159402b85f193d59993c2b4fb26cc0cea1ab839ce0dafacb757675b0cabe9b491d

Download Submit
C:\Windows\System\lreVOgw.exe

Filesize
1.9MB

MD5
7d62af10a3c3154b2b0f19c1a00a9db6

SHA1
82a5c6641898702ea19db3e66ff58a74e2408f06

SHA256
b4dc6bf63f221faa8e4b6a4210d786c09990eb8160e55c84406eb26fa6cbf81e

SHA512
dd8dfd5481bae2a90cb07afe21ed93729957d390516617cf336e0df8478ba3c436e76485a1019fac4c621e5c4376d75e5cef068ebc693340d17720aae81e904b

Download Submit
C:\Windows\System\nBepZpi.exe

Filesize
2.0MB

MD5
a55642ed5bbac00f0b2fc7d224ea135f

SHA1
1fc3d067b8413a4558401c9cee1a5b9fa91a81ca

SHA256
c3d27299c2db9c3a8262aa3cb58e08c27312e00acd310b7c8abfdffd8b1a0878

SHA512
c975bdc9173604fec6d2f29ab1f9f116e66a9667af4658f7324a52f3236cc55d8a34d27a3fb0250d4f1c579fcc22b321471013b9b91f938d7f17ce8899255e97

Download Submit
C:\Windows\System\nWRJqIV.exe

Filesize
1.9MB

MD5
6ef6089341d7532589af98506c46d34b

SHA1
134739d835d1f5507a1678879d2a6ad27b5a2205

SHA256
dcadf049af8c295f5363d5e3a1b232525dc16fb9859bb6a23cb3f90b279ecba8

SHA512
2aaa6213bb29b84137b2065b185579f17a0c1211ee4e737d16e53423cb1865721d04babecb38e12d759729005e737b69cc06e56b5342b072abf4aed3f993a7c3

Download Submit
C:\Windows\System\ouXspuD.exe

Filesize
2.0MB

MD5
bfdba30a9440549981f045b7237e4879

SHA1
e3c63c3aec5a362085443619c1f17d9936a5b142

SHA256
4f1e151ab7b9c14c45ec4e0e3ae1564b3d3d40837a2ba9ca2b24e1c778025838

SHA512
c62b0fa24e2bc83372fbfd5aeff81f645ab11b2f274f4a3613ca96325d9cd1e0850fba1383ec23028fd4603ac2440a47a4f80ef3f2f9c1b0ac9f06bf61e8445f

Download Submit
C:\Windows\System\sXezTOd.exe

Filesize
1.9MB

MD5
b871c04a9240e5cf37bafc39394b5612

SHA1
b1415bdab205cbdff0114972e0024b56f1f48c1d

SHA256
ee54892b33c9148a4c36523e219601e56440254d527d9aa74b393f1cbce33aa8

SHA512
1bfc107c36c4b194564ec309d15b21c8458aded29dd6b3324b71b92cb8c47b93d2420c517c12f47e463957b1a406abc9f47cbaf1f47f061a126bc2106a10996f

Download Submit
C:\Windows\System\shDUuXr.exe

Filesize
1.9MB

MD5
9f5d186c49ab2b89d316cdf244aec380

SHA1
572c82db248f5405b7170ab30f78d59a5c969ff5

SHA256
9ccdaf749d4fd737c89eb9c6db76a83a9d9b9d3778ed4ca3eb9c953b74e14fba

SHA512
0b3bad9f6689ef673a1b0133ea2ea985499d16c734a66bd6089f7502c00eccb35f05b525b7b5dc5d8c84683350b8e5ecf9ec2ac06c58c0ff7faf010a0b05a65a

Download Submit
C:\Windows\System\tAsmZIF.exe

Filesize
1.9MB

MD5
530dafef119ebdf199e4b7722d7f4a2f

SHA1
995ff80b5e4507c275f39f5de38e579b66a440df

SHA256
47b63fae195e6289e2163dcf71a8dc5b3157b035d7d43d95c6a42ff6bcc6e5bf

SHA512
ad45c251272f8c6c281db874c2487153e57a8f7569c5d48a14ffce12077455d775def802afc3bd2fe29b867ffd330c0efedc0964caf3e0017121c4146f6b3fda

Download Submit
C:\Windows\System\vuCzRbp.exe

Filesize
1.9MB

MD5
0d5bf2d0280b145a2b32991e28f6948b

SHA1
16f3184d6675b54ff807ab08a4f9287a5c4ec2b2

SHA256
ffa6aaaf8d317b15e659f899e98bf5ecd6fc5a870509d1fcd5687f7a3552c064

SHA512
40426735d2745a1d7a5a652569d0aadfc556d906ac81e387a746a61cdb2ff0121e961a9c304a1ef647bec443dba6229c34c5af78c71603b47ee261df6e92f49f

Download Submit
C:\Windows\System\xiAnFCt.exe

Filesize
2.0MB

MD5
9ab0922fdf3ddbc8b00a6f35067268ab

SHA1
a8cec71c078a69724d570566dc3328ef8c86f47c

SHA256
f71c14c792f96a33dad63b83480b7283dca9362abe4457788deda01d38e56810

SHA512
fdbdfa80eacb6ef239f2d1a7ca0abfed2cf72459a085a10c146f647774c903a836599d71292344f5e430fb36d8688454380ea3a1d201cf48473704e9dc12e2fe

Download Submit
C:\Windows\System\xopPtYi.exe

Filesize
1.9MB

MD5
7bff729ba27db07a66855f1aaea390ad

SHA1
414f651fbab138ace9c3f1a29fe9e1444bd8fec5

SHA256
f894987bbbfd19bf40f0c302bbac452b2975e4380aa5be237293c979448ec2aa

SHA512
f8da7595a7709a100b274025215d7603e1e3fa68926dd1cc22e7d758906e61daa410251593cc570a053382c2775327113b7063773a08516e6234881bb40f323b

Download Submit
C:\Windows\System\zUqwfdP.exe

Filesize
1.9MB

MD5
0f06a49b1b08b689a1ee2e95339a162f

SHA1
aabedc604c1e46238b4041f0bf7686cf2ba32f71

SHA256
0a6aeb00433f62a3d4ac3f9c40b5e1aa83eb95e6b63ad8daf7c991ed5caa0505

SHA512
72981987371c7ba49ad4c72492cfa7f5b368260bbb3d56ff9072d9201927a660167562c5d407ced117e497546b0b36bbafe1cc07ae4f8c1d879841557d4b2f12

Download Submit
memory/560-5214-0x00007FF795CF0000-0x00007FF7960E2000-memory.dmp

Filesize
3.9MB

Download
memory/560-226-0x00007FF795CF0000-0x00007FF7960E2000-memory.dmp

Filesize
3.9MB

Download
memory/976-11-0x00007FF7C8340000-0x00007FF7C8732000-memory.dmp

Filesize
3.9MB

Download
memory/1204-432-0x00007FF7AE6F0000-0x00007FF7AEAE2000-memory.dmp

Filesize
3.9MB

Download
memory/1460-5252-0x00007FF6B5B50000-0x00007FF6B5F42000-memory.dmp

Filesize
3.9MB

Download
memory/1460-250-0x00007FF6B5B50000-0x00007FF6B5F42000-memory.dmp

Filesize
3.9MB

Download
memory/1528-259-0x00007FF60E6C0000-0x00007FF60EAB2000-memory.dmp

Filesize
3.9MB

Download
memory/1568-258-0x00007FF728880000-0x00007FF728C72000-memory.dmp

Filesize
3.9MB

Download
memory/1636-5208-0x00007FF6AA6A0000-0x00007FF6AAA92000-memory.dmp

Filesize
3.9MB

Download
memory/1636-90-0x00007FF6AA6A0000-0x00007FF6AAA92000-memory.dmp

Filesize
3.9MB

Download
memory/2572-5370-0x00007FF6BFE50000-0x00007FF6C0242000-memory.dmp

Filesize
3.9MB

Download
memory/2572-376-0x00007FF6BFE50000-0x00007FF6C0242000-memory.dmp

Filesize
3.9MB

Download
memory/2660-252-0x00007FF797800000-0x00007FF797BF2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-504-0x00007FF6A0430000-0x00007FF6A0822000-memory.dmp

Filesize
3.9MB

Download
memory/2984-5356-0x00007FF7A02F0000-0x00007FF7A06E2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-251-0x00007FF7A02F0000-0x00007FF7A06E2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-5364-0x00007FF7FEE60000-0x00007FF7FF252000-memory.dmp

Filesize
3.9MB

Download
memory/3036-375-0x00007FF7FEE60000-0x00007FF7FF252000-memory.dmp

Filesize
3.9MB

Download
memory/3048-255-0x00007FF6EFB50000-0x00007FF6EFF42000-memory.dmp

Filesize
3.9MB

Download
memory/3288-153-0x00007FF801230000-0x00007FF801CF1000-memory.dmp

Filesize
10.8MB

Download
memory/3288-6-0x00007FF801233000-0x00007FF801235000-memory.dmp

Filesize
8KB

Download
memory/3288-69-0x00007FF801230000-0x00007FF801CF1000-memory.dmp

Filesize
10.8MB

Download
memory/3288-174-0x000001EED1D00000-0x000001EED1D22000-memory.dmp

Filesize
136KB

Download
memory/3468-5374-0x00007FF76F680000-0x00007FF76FA72000-memory.dmp

Filesize
3.9MB

Download
memory/3468-356-0x00007FF76F680000-0x00007FF76FA72000-memory.dmp

Filesize
3.9MB

Download
memory/3640-5482-0x00007FF797D20000-0x00007FF798112000-memory.dmp

Filesize
3.9MB

Download
memory/3640-398-0x00007FF797D20000-0x00007FF798112000-memory.dmp

Filesize
3.9MB

Download
memory/4020-338-0x00007FF7D6D20000-0x00007FF7D7112000-memory.dmp

Filesize
3.9MB

Download
memory/4044-5361-0x00007FF654170000-0x00007FF654562000-memory.dmp

Filesize
3.9MB

Download
memory/4044-257-0x00007FF654170000-0x00007FF654562000-memory.dmp

Filesize
3.9MB

Download
memory/4260-1-0x0000027A8D0F0000-0x0000027A8D100000-memory.dmp

Filesize
64KB

Download
memory/4260-0-0x00007FF72FB40000-0x00007FF72FF32000-memory.dmp

Filesize
3.9MB

Download
memory/4464-395-0x00007FF66CCA0000-0x00007FF66D092000-memory.dmp

Filesize
3.9MB

Download
memory/4464-5423-0x00007FF66CCA0000-0x00007FF66D092000-memory.dmp

Filesize
3.9MB

Download
memory/4784-5203-0x00007FF64E9C0000-0x00007FF64EDB2000-memory.dmp

Filesize
3.9MB

Download
memory/4784-431-0x00007FF64E9C0000-0x00007FF64EDB2000-memory.dmp

Filesize
3.9MB

Download
memory/4804-248-0x00007FF74AA10000-0x00007FF74AE02000-memory.dmp

Filesize
3.9MB

Download
memory/4804-5218-0x00007FF74AA10000-0x00007FF74AE02000-memory.dmp

Filesize
3.9MB

Download
memory/4948-5371-0x00007FF707740000-0x00007FF707B32000-memory.dmp

Filesize
3.9MB

Download
memory/4948-253-0x00007FF707740000-0x00007FF707B32000-memory.dmp

Filesize
3.9MB

Download
memory/4964-256-0x00007FF667D70000-0x00007FF668162000-memory.dmp

Filesize
3.9MB

Download
memory/5052-249-0x00007FF701BC0000-0x00007FF701FB2000-memory.dmp

Filesize
3.9MB

Download
memory/5056-254-0x00007FF72DCB0000-0x00007FF72E0A2000-memory.dmp

Filesize
3.9MB

Download
memory/5056-5378-0x00007FF72DCB0000-0x00007FF72E0A2000-memory.dmp

Filesize
3.9MB

Download