xmrig | b0ef35e9740729527e8c4d3a28c7cab6c380170084f712979f9f69cf4cc8d57a

Analysis

max time kernel
99s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

313fc34210a067763be20656cad50c70N.exe
Size

2.2MB
MD5

313fc34210a067763be20656cad50c70
SHA1

c8b732136d719933ca44a28c27571b8cfa46eb3b
SHA256

b0ef35e9740729527e8c4d3a28c7cab6c380170084f712979f9f69cf4cc8d57a
SHA512

07dadd81cd10b01c6dd85193d612561e57f9435aa4896369eb3241a593c9bf53222e377aebb7ff63bcb2dbe797a39986f9c70106285f4e371b8938a828192ef2
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrUI/:NAB0

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/2756-31-0x00007FF736EE0000-0x00007FF7372D2000-memory.dmp	xmrig
behavioral2/memory/5084-253-0x00007FF78F1E0000-0x00007FF78F5D2000-memory.dmp	xmrig
behavioral2/memory/3120-297-0x00007FF6F4F70000-0x00007FF6F5362000-memory.dmp	xmrig
behavioral2/memory/5064-300-0x00007FF688D80000-0x00007FF689172000-memory.dmp	xmrig
behavioral2/memory/2716-334-0x00007FF74D630000-0x00007FF74DA22000-memory.dmp	xmrig
behavioral2/memory/4160-344-0x00007FF67E170000-0x00007FF67E562000-memory.dmp	xmrig
behavioral2/memory/2984-349-0x00007FF63FC40000-0x00007FF640032000-memory.dmp	xmrig
behavioral2/memory/3904-352-0x00007FF699CA0000-0x00007FF69A092000-memory.dmp	xmrig
behavioral2/memory/1584-361-0x00007FF7211E0000-0x00007FF7215D2000-memory.dmp	xmrig
behavioral2/memory/2652-359-0x00007FF6D8F60000-0x00007FF6D9352000-memory.dmp	xmrig
behavioral2/memory/2016-358-0x00007FF63B890000-0x00007FF63BC82000-memory.dmp	xmrig
behavioral2/memory/2412-351-0x00007FF7B3FD0000-0x00007FF7B43C2000-memory.dmp	xmrig
behavioral2/memory/4616-350-0x00007FF68A700000-0x00007FF68AAF2000-memory.dmp	xmrig
behavioral2/memory/2172-348-0x00007FF707080000-0x00007FF707472000-memory.dmp	xmrig
behavioral2/memory/3760-347-0x00007FF624860000-0x00007FF624C52000-memory.dmp	xmrig
behavioral2/memory/5100-346-0x00007FF723AE0000-0x00007FF723ED2000-memory.dmp	xmrig
behavioral2/memory/1368-345-0x00007FF67D3A0000-0x00007FF67D792000-memory.dmp	xmrig
behavioral2/memory/1180-343-0x00007FF736AC0000-0x00007FF736EB2000-memory.dmp	xmrig
behavioral2/memory/1492-340-0x00007FF754BF0000-0x00007FF754FE2000-memory.dmp	xmrig
behavioral2/memory/3432-320-0x00007FF62E1F0000-0x00007FF62E5E2000-memory.dmp	xmrig
behavioral2/memory/376-285-0x00007FF7EE140000-0x00007FF7EE532000-memory.dmp	xmrig
behavioral2/memory/1716-236-0x00007FF7022C0000-0x00007FF7026B2000-memory.dmp	xmrig
behavioral2/memory/1224-227-0x00007FF658860000-0x00007FF658C52000-memory.dmp	xmrig
behavioral2/memory/3676-226-0x00007FF6189D0000-0x00007FF618DC2000-memory.dmp	xmrig
behavioral2/memory/1224-3409-0x00007FF658860000-0x00007FF658C52000-memory.dmp	xmrig
behavioral2/memory/1716-3416-0x00007FF7022C0000-0x00007FF7026B2000-memory.dmp	xmrig
behavioral2/memory/5064-3426-0x00007FF688D80000-0x00007FF689172000-memory.dmp	xmrig
behavioral2/memory/3120-3445-0x00007FF6F4F70000-0x00007FF6F5362000-memory.dmp	xmrig
behavioral2/memory/4160-3471-0x00007FF67E170000-0x00007FF67E562000-memory.dmp	xmrig
behavioral2/memory/1180-3466-0x00007FF736AC0000-0x00007FF736EB2000-memory.dmp	xmrig
behavioral2/memory/2716-3476-0x00007FF74D630000-0x00007FF74DA22000-memory.dmp	xmrig
behavioral2/memory/376-3459-0x00007FF7EE140000-0x00007FF7EE532000-memory.dmp	xmrig
behavioral2/memory/5084-3452-0x00007FF78F1E0000-0x00007FF78F5D2000-memory.dmp	xmrig
behavioral2/memory/1492-3448-0x00007FF754BF0000-0x00007FF754FE2000-memory.dmp	xmrig
behavioral2/memory/2652-3444-0x00007FF6D8F60000-0x00007FF6D9352000-memory.dmp	xmrig
behavioral2/memory/2412-3499-0x00007FF7B3FD0000-0x00007FF7B43C2000-memory.dmp	xmrig
behavioral2/memory/3904-3592-0x00007FF699CA0000-0x00007FF69A092000-memory.dmp	xmrig
behavioral2/memory/1584-3588-0x00007FF7211E0000-0x00007FF7215D2000-memory.dmp	xmrig
behavioral2/memory/3760-3546-0x00007FF624860000-0x00007FF624C52000-memory.dmp	xmrig
behavioral2/memory/2172-3540-0x00007FF707080000-0x00007FF707472000-memory.dmp	xmrig
behavioral2/memory/5100-3521-0x00007FF723AE0000-0x00007FF723ED2000-memory.dmp	xmrig
behavioral2/memory/3432-3491-0x00007FF62E1F0000-0x00007FF62E5E2000-memory.dmp	xmrig
behavioral2/memory/2984-3488-0x00007FF63FC40000-0x00007FF640032000-memory.dmp	xmrig
behavioral2/memory/4616-3485-0x00007FF68A700000-0x00007FF68AAF2000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
9	3496	powershell.exe
11	3496	powershell.exe
13	3496	powershell.exe
14	3496	powershell.exe
16	3496	powershell.exe
20	3496	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3496	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2756	FSvuHBH.exe
2016	RtlNPOl.exe
3676	zCSLfWY.exe
1224	GSdXSYk.exe
1716	fxtyobv.exe
2652	EcQpgSK.exe
5084	JaJUHnN.exe
376	QDttKPP.exe
3120	fUVDTkg.exe
5064	PAqcOlS.exe
3432	prlhNrv.exe
2716	TOLFCfy.exe
1492	AWHHkiI.exe
1180	GoTFHDm.exe
4160	ISirtrz.exe
1368	zQvAPmD.exe
5100	piKKdUM.exe
3760	LmUQBxR.exe
2172	lBpWjIu.exe
2984	rvfYvJj.exe
4616	dzIEkiR.exe
2412	nGciGrb.exe
3904	LatlxNT.exe
1584	ctnTkKF.exe
4920	avxPxJV.exe
2324	taYhuKd.exe
1036	VViSJSx.exe
2608	Icykbkd.exe
1648	ZYNkLVa.exe
4436	gqShjNF.exe
4204	mWcoVao.exe
2884	RMQWHJB.exe
3528	nhhagWV.exe
544	AWfDjyo.exe
3464	MQHdFze.exe
2780	VEIKrFa.exe
3480	GAyFnYX.exe
384	WUtdALX.exe
1532	fLjaImD.exe
4948	tjoKXvj.exe
4632	reEbIAl.exe
3044	HIOkpLR.exe
4752	FmECmOq.exe
968	uNSvUfj.exe
3820	VcwZEpF.exe
388	HpIWQfN.exe
1400	sAMsqSp.exe
4220	FGiyClA.exe
4968	kYzIKqx.exe
2404	YhCvtJA.exe
5000	JlRTmsL.exe
4940	PEWQfAR.exe
2192	DFHaPom.exe
4680	tDawcZI.exe
4372	YEulXij.exe
4664	TJSOUIe.exe
4944	rZOrZTw.exe
5008	ewqtggV.exe
4336	HNQwpWo.exe
264	kRnygDg.exe
3704	HGPSteD.exe
3216	rURJdFZ.exe
3548	hdGnYrS.exe
4004	soaJgPm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1448-0-0x00007FF7AA1E0000-0x00007FF7AA5D2000-memory.dmp	upx
behavioral2/files/0x0008000000023451-6.dat	upx
behavioral2/files/0x0007000000023456-8.dat	upx
behavioral2/memory/2756-31-0x00007FF736EE0000-0x00007FF7372D2000-memory.dmp	upx
behavioral2/files/0x0007000000023455-17.dat	upx
behavioral2/files/0x000700000002345a-32.dat	upx
behavioral2/files/0x0007000000023459-30.dat	upx
behavioral2/files/0x0007000000023458-29.dat	upx
behavioral2/files/0x0007000000023457-36.dat	upx
behavioral2/files/0x000700000002345f-59.dat	upx
behavioral2/files/0x0007000000023463-76.dat	upx
behavioral2/files/0x0007000000023464-113.dat	upx
behavioral2/files/0x0007000000023477-172.dat	upx
behavioral2/memory/5084-253-0x00007FF78F1E0000-0x00007FF78F5D2000-memory.dmp	upx
behavioral2/memory/3120-297-0x00007FF6F4F70000-0x00007FF6F5362000-memory.dmp	upx
behavioral2/memory/5064-300-0x00007FF688D80000-0x00007FF689172000-memory.dmp	upx
behavioral2/memory/2716-334-0x00007FF74D630000-0x00007FF74DA22000-memory.dmp	upx
behavioral2/memory/4160-344-0x00007FF67E170000-0x00007FF67E562000-memory.dmp	upx
behavioral2/memory/2984-349-0x00007FF63FC40000-0x00007FF640032000-memory.dmp	upx
behavioral2/memory/3904-352-0x00007FF699CA0000-0x00007FF69A092000-memory.dmp	upx
behavioral2/memory/1584-361-0x00007FF7211E0000-0x00007FF7215D2000-memory.dmp	upx
behavioral2/memory/2652-359-0x00007FF6D8F60000-0x00007FF6D9352000-memory.dmp	upx
behavioral2/memory/2016-358-0x00007FF63B890000-0x00007FF63BC82000-memory.dmp	upx
behavioral2/memory/2412-351-0x00007FF7B3FD0000-0x00007FF7B43C2000-memory.dmp	upx
behavioral2/memory/4616-350-0x00007FF68A700000-0x00007FF68AAF2000-memory.dmp	upx
behavioral2/memory/2172-348-0x00007FF707080000-0x00007FF707472000-memory.dmp	upx
behavioral2/memory/3760-347-0x00007FF624860000-0x00007FF624C52000-memory.dmp	upx
behavioral2/memory/5100-346-0x00007FF723AE0000-0x00007FF723ED2000-memory.dmp	upx
behavioral2/memory/1368-345-0x00007FF67D3A0000-0x00007FF67D792000-memory.dmp	upx
behavioral2/memory/1180-343-0x00007FF736AC0000-0x00007FF736EB2000-memory.dmp	upx
behavioral2/memory/1492-340-0x00007FF754BF0000-0x00007FF754FE2000-memory.dmp	upx
behavioral2/memory/3432-320-0x00007FF62E1F0000-0x00007FF62E5E2000-memory.dmp	upx
behavioral2/memory/376-285-0x00007FF7EE140000-0x00007FF7EE532000-memory.dmp	upx
behavioral2/memory/1716-236-0x00007FF7022C0000-0x00007FF7026B2000-memory.dmp	upx
behavioral2/memory/1224-227-0x00007FF658860000-0x00007FF658C52000-memory.dmp	upx
behavioral2/memory/3676-226-0x00007FF6189D0000-0x00007FF618DC2000-memory.dmp	upx
behavioral2/files/0x0007000000023478-178.dat	upx
behavioral2/files/0x000700000002346f-174.dat	upx
behavioral2/files/0x000700000002346a-171.dat	upx
behavioral2/files/0x0007000000023476-169.dat	upx
behavioral2/files/0x0007000000023475-168.dat	upx
behavioral2/files/0x0007000000023474-167.dat	upx
behavioral2/files/0x0007000000023467-166.dat	upx
behavioral2/files/0x000700000002346e-159.dat	upx
behavioral2/files/0x0007000000023473-158.dat	upx
behavioral2/files/0x0007000000023466-157.dat	upx
behavioral2/files/0x0007000000023472-154.dat	upx
behavioral2/files/0x0007000000023471-148.dat	upx
behavioral2/files/0x0008000000023452-147.dat	upx
behavioral2/files/0x000700000002346b-144.dat	upx
behavioral2/files/0x0007000000023465-143.dat	upx
behavioral2/files/0x0007000000023470-142.dat	upx
behavioral2/files/0x0007000000023469-133.dat	upx
behavioral2/files/0x0007000000023468-129.dat	upx
behavioral2/files/0x000700000002345e-128.dat	upx
behavioral2/files/0x000700000002346c-121.dat	upx
behavioral2/files/0x0007000000023462-101.dat	upx
behavioral2/files/0x0007000000023461-100.dat	upx
behavioral2/files/0x000700000002346d-124.dat	upx
behavioral2/files/0x0007000000023460-88.dat	upx
behavioral2/files/0x000700000002345b-84.dat	upx
behavioral2/files/0x000700000002345d-74.dat	upx
behavioral2/files/0x000700000002345c-66.dat	upx
behavioral2/memory/1224-3409-0x00007FF658860000-0x00007FF658C52000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZMHngrN.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\mmNQliG.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\sSLlfkM.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\uiXwNvJ.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\UAnrCXw.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\KnYbGoC.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\orILXea.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\dgcmdnw.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\xztiXzN.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\CUXQRmL.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\wxXpamJ.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\FdpjqgQ.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\gqxVYSN.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\XZWIYsz.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\NPlUfXk.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\aSPujUc.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\FGDuZPg.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\hANuFyC.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\eyWARfE.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\SOGpRiu.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\ZTdxvBI.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\ZRvcwZD.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\eAiDpuC.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\lfAVINb.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\NaioRBk.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\BcPUVuT.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\VqALERs.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\YDRrjXt.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\sjrVEzl.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\ANBhxBc.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\kzgTBfC.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\jDJPlQt.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\pKcpkip.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\Icykbkd.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\QgtAOkj.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\XSwWjja.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\mBzIixu.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\vUCOFFO.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\zoMpoSD.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\OTREiyV.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\fruLtLC.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\xuGzMgz.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\dzgcYRx.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\cjBcSFb.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\pbDjrkO.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\ttJcnlY.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\tLaQaVw.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\fqrzkvc.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\sHwnEjl.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\RgXXNIm.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\jcNTpZs.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\jGiMLUB.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\PSNNnmk.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\LolNsoc.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\YmRVwys.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\uHzoEVA.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\RVhAinb.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\VOVmHvs.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\PnoWpeS.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\arGrpeG.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\zxujAwg.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\MdQHpYp.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\pIDAmQI.exe	313fc34210a067763be20656cad50c70N.exe
File created	C:\Windows\System\qIwwuYD.exe	313fc34210a067763be20656cad50c70N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3496	powershell.exe
3496	powershell.exe
3496	powershell.exe
3496	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeLockMemoryPrivilege	1448	313fc34210a067763be20656cad50c70N.exe
Token: SeLockMemoryPrivilege	1448	313fc34210a067763be20656cad50c70N.exe
Token: SeCreateGlobalPrivilege	3204	dwm.exe
Token: SeChangeNotifyPrivilege	3204	dwm.exe
Token: 33	3204	dwm.exe
Token: SeIncBasePriorityPrivilege	3204	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 3496	1448	313fc34210a067763be20656cad50c70N.exe	85
PID 1448 wrote to memory of 3496	1448	313fc34210a067763be20656cad50c70N.exe	85
PID 1448 wrote to memory of 2756	1448	313fc34210a067763be20656cad50c70N.exe	86
PID 1448 wrote to memory of 2756	1448	313fc34210a067763be20656cad50c70N.exe	86
PID 1448 wrote to memory of 2016	1448	313fc34210a067763be20656cad50c70N.exe	87
PID 1448 wrote to memory of 2016	1448	313fc34210a067763be20656cad50c70N.exe	87
PID 1448 wrote to memory of 3676	1448	313fc34210a067763be20656cad50c70N.exe	88
PID 1448 wrote to memory of 3676	1448	313fc34210a067763be20656cad50c70N.exe	88
PID 1448 wrote to memory of 376	1448	313fc34210a067763be20656cad50c70N.exe	89
PID 1448 wrote to memory of 376	1448	313fc34210a067763be20656cad50c70N.exe	89
PID 1448 wrote to memory of 1224	1448	313fc34210a067763be20656cad50c70N.exe	90
PID 1448 wrote to memory of 1224	1448	313fc34210a067763be20656cad50c70N.exe	90
PID 1448 wrote to memory of 1716	1448	313fc34210a067763be20656cad50c70N.exe	91
PID 1448 wrote to memory of 1716	1448	313fc34210a067763be20656cad50c70N.exe	91
PID 1448 wrote to memory of 2652	1448	313fc34210a067763be20656cad50c70N.exe	92
PID 1448 wrote to memory of 2652	1448	313fc34210a067763be20656cad50c70N.exe	92
PID 1448 wrote to memory of 5084	1448	313fc34210a067763be20656cad50c70N.exe	93
PID 1448 wrote to memory of 5084	1448	313fc34210a067763be20656cad50c70N.exe	93
PID 1448 wrote to memory of 5064	1448	313fc34210a067763be20656cad50c70N.exe	94
PID 1448 wrote to memory of 5064	1448	313fc34210a067763be20656cad50c70N.exe	94
PID 1448 wrote to memory of 3120	1448	313fc34210a067763be20656cad50c70N.exe	95
PID 1448 wrote to memory of 3120	1448	313fc34210a067763be20656cad50c70N.exe	95
PID 1448 wrote to memory of 3432	1448	313fc34210a067763be20656cad50c70N.exe	96
PID 1448 wrote to memory of 3432	1448	313fc34210a067763be20656cad50c70N.exe	96
PID 1448 wrote to memory of 2716	1448	313fc34210a067763be20656cad50c70N.exe	97
PID 1448 wrote to memory of 2716	1448	313fc34210a067763be20656cad50c70N.exe	97
PID 1448 wrote to memory of 1492	1448	313fc34210a067763be20656cad50c70N.exe	98
PID 1448 wrote to memory of 1492	1448	313fc34210a067763be20656cad50c70N.exe	98
PID 1448 wrote to memory of 1180	1448	313fc34210a067763be20656cad50c70N.exe	99
PID 1448 wrote to memory of 1180	1448	313fc34210a067763be20656cad50c70N.exe	99
PID 1448 wrote to memory of 4160	1448	313fc34210a067763be20656cad50c70N.exe	100
PID 1448 wrote to memory of 4160	1448	313fc34210a067763be20656cad50c70N.exe	100
PID 1448 wrote to memory of 1368	1448	313fc34210a067763be20656cad50c70N.exe	101
PID 1448 wrote to memory of 1368	1448	313fc34210a067763be20656cad50c70N.exe	101
PID 1448 wrote to memory of 2412	1448	313fc34210a067763be20656cad50c70N.exe	102
PID 1448 wrote to memory of 2412	1448	313fc34210a067763be20656cad50c70N.exe	102
PID 1448 wrote to memory of 5100	1448	313fc34210a067763be20656cad50c70N.exe	103
PID 1448 wrote to memory of 5100	1448	313fc34210a067763be20656cad50c70N.exe	103
PID 1448 wrote to memory of 3760	1448	313fc34210a067763be20656cad50c70N.exe	104
PID 1448 wrote to memory of 3760	1448	313fc34210a067763be20656cad50c70N.exe	104
PID 1448 wrote to memory of 2172	1448	313fc34210a067763be20656cad50c70N.exe	105
PID 1448 wrote to memory of 2172	1448	313fc34210a067763be20656cad50c70N.exe	105
PID 1448 wrote to memory of 2984	1448	313fc34210a067763be20656cad50c70N.exe	106
PID 1448 wrote to memory of 2984	1448	313fc34210a067763be20656cad50c70N.exe	106
PID 1448 wrote to memory of 4616	1448	313fc34210a067763be20656cad50c70N.exe	107
PID 1448 wrote to memory of 4616	1448	313fc34210a067763be20656cad50c70N.exe	107
PID 1448 wrote to memory of 3904	1448	313fc34210a067763be20656cad50c70N.exe	108
PID 1448 wrote to memory of 3904	1448	313fc34210a067763be20656cad50c70N.exe	108
PID 1448 wrote to memory of 2608	1448	313fc34210a067763be20656cad50c70N.exe	109
PID 1448 wrote to memory of 2608	1448	313fc34210a067763be20656cad50c70N.exe	109
PID 1448 wrote to memory of 1584	1448	313fc34210a067763be20656cad50c70N.exe	110
PID 1448 wrote to memory of 1584	1448	313fc34210a067763be20656cad50c70N.exe	110
PID 1448 wrote to memory of 4920	1448	313fc34210a067763be20656cad50c70N.exe	111
PID 1448 wrote to memory of 4920	1448	313fc34210a067763be20656cad50c70N.exe	111
PID 1448 wrote to memory of 2324	1448	313fc34210a067763be20656cad50c70N.exe	112
PID 1448 wrote to memory of 2324	1448	313fc34210a067763be20656cad50c70N.exe	112
PID 1448 wrote to memory of 2780	1448	313fc34210a067763be20656cad50c70N.exe	113
PID 1448 wrote to memory of 2780	1448	313fc34210a067763be20656cad50c70N.exe	113
PID 1448 wrote to memory of 1036	1448	313fc34210a067763be20656cad50c70N.exe	114
PID 1448 wrote to memory of 1036	1448	313fc34210a067763be20656cad50c70N.exe	114
PID 1448 wrote to memory of 1648	1448	313fc34210a067763be20656cad50c70N.exe	115
PID 1448 wrote to memory of 1648	1448	313fc34210a067763be20656cad50c70N.exe	115
PID 1448 wrote to memory of 4436	1448	313fc34210a067763be20656cad50c70N.exe	116
PID 1448 wrote to memory of 4436	1448	313fc34210a067763be20656cad50c70N.exe	116

C:\Users\Admin\AppData\Local\Temp\313fc34210a067763be20656cad50c70N.exe
"C:\Users\Admin\AppData\Local\Temp\313fc34210a067763be20656cad50c70N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3496
- C:\Windows\System\FSvuHBH.exe
  C:\Windows\System\FSvuHBH.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\RtlNPOl.exe
  C:\Windows\System\RtlNPOl.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\zCSLfWY.exe
  C:\Windows\System\zCSLfWY.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\QDttKPP.exe
  C:\Windows\System\QDttKPP.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\GSdXSYk.exe
  C:\Windows\System\GSdXSYk.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\fxtyobv.exe
  C:\Windows\System\fxtyobv.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\EcQpgSK.exe
  C:\Windows\System\EcQpgSK.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\JaJUHnN.exe
  C:\Windows\System\JaJUHnN.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\PAqcOlS.exe
  C:\Windows\System\PAqcOlS.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\fUVDTkg.exe
  C:\Windows\System\fUVDTkg.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\prlhNrv.exe
  C:\Windows\System\prlhNrv.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\TOLFCfy.exe
  C:\Windows\System\TOLFCfy.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\AWHHkiI.exe
  C:\Windows\System\AWHHkiI.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\GoTFHDm.exe
  C:\Windows\System\GoTFHDm.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\ISirtrz.exe
  C:\Windows\System\ISirtrz.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\zQvAPmD.exe
  C:\Windows\System\zQvAPmD.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\nGciGrb.exe
  C:\Windows\System\nGciGrb.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\piKKdUM.exe
  C:\Windows\System\piKKdUM.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\LmUQBxR.exe
  C:\Windows\System\LmUQBxR.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\lBpWjIu.exe
  C:\Windows\System\lBpWjIu.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\rvfYvJj.exe
  C:\Windows\System\rvfYvJj.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\dzIEkiR.exe
  C:\Windows\System\dzIEkiR.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\LatlxNT.exe
  C:\Windows\System\LatlxNT.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\Icykbkd.exe
  C:\Windows\System\Icykbkd.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\ctnTkKF.exe
  C:\Windows\System\ctnTkKF.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\avxPxJV.exe
  C:\Windows\System\avxPxJV.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\taYhuKd.exe
  C:\Windows\System\taYhuKd.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\VEIKrFa.exe
  C:\Windows\System\VEIKrFa.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\VViSJSx.exe
  C:\Windows\System\VViSJSx.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\ZYNkLVa.exe
  C:\Windows\System\ZYNkLVa.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\gqShjNF.exe
  C:\Windows\System\gqShjNF.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\mWcoVao.exe
  C:\Windows\System\mWcoVao.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\RMQWHJB.exe
  C:\Windows\System\RMQWHJB.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\nhhagWV.exe
  C:\Windows\System\nhhagWV.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\AWfDjyo.exe
  C:\Windows\System\AWfDjyo.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\MQHdFze.exe
  C:\Windows\System\MQHdFze.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\GAyFnYX.exe
  C:\Windows\System\GAyFnYX.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\WUtdALX.exe
  C:\Windows\System\WUtdALX.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\fLjaImD.exe
  C:\Windows\System\fLjaImD.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\HIOkpLR.exe
  C:\Windows\System\HIOkpLR.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\tjoKXvj.exe
  C:\Windows\System\tjoKXvj.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\reEbIAl.exe
  C:\Windows\System\reEbIAl.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\FmECmOq.exe
  C:\Windows\System\FmECmOq.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\uNSvUfj.exe
  C:\Windows\System\uNSvUfj.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\VcwZEpF.exe
  C:\Windows\System\VcwZEpF.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\HpIWQfN.exe
  C:\Windows\System\HpIWQfN.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\sAMsqSp.exe
  C:\Windows\System\sAMsqSp.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\FGiyClA.exe
  C:\Windows\System\FGiyClA.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\kYzIKqx.exe
  C:\Windows\System\kYzIKqx.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\YhCvtJA.exe
  C:\Windows\System\YhCvtJA.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\JlRTmsL.exe
  C:\Windows\System\JlRTmsL.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\PEWQfAR.exe
  C:\Windows\System\PEWQfAR.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\DFHaPom.exe
  C:\Windows\System\DFHaPom.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\tDawcZI.exe
  C:\Windows\System\tDawcZI.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\YEulXij.exe
  C:\Windows\System\YEulXij.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\TJSOUIe.exe
  C:\Windows\System\TJSOUIe.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\rZOrZTw.exe
  C:\Windows\System\rZOrZTw.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\ewqtggV.exe
  C:\Windows\System\ewqtggV.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\HNQwpWo.exe
  C:\Windows\System\HNQwpWo.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\kRnygDg.exe
  C:\Windows\System\kRnygDg.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\HGPSteD.exe
  C:\Windows\System\HGPSteD.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\rURJdFZ.exe
  C:\Windows\System\rURJdFZ.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\hdGnYrS.exe
  C:\Windows\System\hdGnYrS.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\soaJgPm.exe
  C:\Windows\System\soaJgPm.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\hNpGETP.exe
  C:\Windows\System\hNpGETP.exe
  2⤵
  PID:4396
- C:\Windows\System\XwVitdP.exe
  C:\Windows\System\XwVitdP.exe
  2⤵
  PID:8
- C:\Windows\System\aNwgAKi.exe
  C:\Windows\System\aNwgAKi.exe
  2⤵
  PID:4232
- C:\Windows\System\rkjFCVc.exe
  C:\Windows\System\rkjFCVc.exe
  2⤵
  PID:4084
- C:\Windows\System\kgiezOP.exe
  C:\Windows\System\kgiezOP.exe
  2⤵
  PID:2940
- C:\Windows\System\QxOOxNL.exe
  C:\Windows\System\QxOOxNL.exe
  2⤵
  PID:1644
- C:\Windows\System\lIdJCYi.exe
  C:\Windows\System\lIdJCYi.exe
  2⤵
  PID:3948
- C:\Windows\System\lCpTBva.exe
  C:\Windows\System\lCpTBva.exe
  2⤵
  PID:2320
- C:\Windows\System\RdNNQFh.exe
  C:\Windows\System\RdNNQFh.exe
  2⤵
  PID:4964
- C:\Windows\System\OHcQKJe.exe
  C:\Windows\System\OHcQKJe.exe
  2⤵
  PID:4556
- C:\Windows\System\prJJKvX.exe
  C:\Windows\System\prJJKvX.exe
  2⤵
  PID:3724
- C:\Windows\System\zeenLLW.exe
  C:\Windows\System\zeenLLW.exe
  2⤵
  PID:1060
- C:\Windows\System\pcRcFvp.exe
  C:\Windows\System\pcRcFvp.exe
  2⤵
  PID:1752
- C:\Windows\System\wVrQAlI.exe
  C:\Windows\System\wVrQAlI.exe
  2⤵
  PID:3660
- C:\Windows\System\lyuSWvY.exe
  C:\Windows\System\lyuSWvY.exe
  2⤵
  PID:3084
- C:\Windows\System\WQCYbIY.exe
  C:\Windows\System\WQCYbIY.exe
  2⤵
  PID:4784
- C:\Windows\System\fTprGaU.exe
  C:\Windows\System\fTprGaU.exe
  2⤵
  PID:2912
- C:\Windows\System\mQIfMnO.exe
  C:\Windows\System\mQIfMnO.exe
  2⤵
  PID:1012
- C:\Windows\System\nedclbI.exe
  C:\Windows\System\nedclbI.exe
  2⤵
  PID:5132
- C:\Windows\System\CLfMgoX.exe
  C:\Windows\System\CLfMgoX.exe
  2⤵
  PID:5148
- C:\Windows\System\mHMAVKI.exe
  C:\Windows\System\mHMAVKI.exe
  2⤵
  PID:5172
- C:\Windows\System\yWvIwwC.exe
  C:\Windows\System\yWvIwwC.exe
  2⤵
  PID:5256
- C:\Windows\System\eOyurjB.exe
  C:\Windows\System\eOyurjB.exe
  2⤵
  PID:5280
- C:\Windows\System\IYbcKXa.exe
  C:\Windows\System\IYbcKXa.exe
  2⤵
  PID:5980
- C:\Windows\System\ICOtKue.exe
  C:\Windows\System\ICOtKue.exe
  2⤵
  PID:6036
- C:\Windows\System\CrOvSsv.exe
  C:\Windows\System\CrOvSsv.exe
  2⤵
  PID:6068
- C:\Windows\System\sLtLhfm.exe
  C:\Windows\System\sLtLhfm.exe
  2⤵
  PID:6088
- C:\Windows\System\Tddakpv.exe
  C:\Windows\System\Tddakpv.exe
  2⤵
  PID:6108
- C:\Windows\System\RnlYzfx.exe
  C:\Windows\System\RnlYzfx.exe
  2⤵
  PID:620
- C:\Windows\System\QdFtUbG.exe
  C:\Windows\System\QdFtUbG.exe
  2⤵
  PID:5024
- C:\Windows\System\NKkoGUb.exe
  C:\Windows\System\NKkoGUb.exe
  2⤵
  PID:4264
- C:\Windows\System\jNjkaXl.exe
  C:\Windows\System\jNjkaXl.exe
  2⤵
  PID:4836
- C:\Windows\System\szlZXpN.exe
  C:\Windows\System\szlZXpN.exe
  2⤵
  PID:4760
- C:\Windows\System\BJeezHs.exe
  C:\Windows\System\BJeezHs.exe
  2⤵
  PID:668
- C:\Windows\System\iOhYhsq.exe
  C:\Windows\System\iOhYhsq.exe
  2⤵
  PID:5020
- C:\Windows\System\WNQQIiH.exe
  C:\Windows\System\WNQQIiH.exe
  2⤵
  PID:5164
- C:\Windows\System\adtvTuB.exe
  C:\Windows\System\adtvTuB.exe
  2⤵
  PID:5124
- C:\Windows\System\JApXxSQ.exe
  C:\Windows\System\JApXxSQ.exe
  2⤵
  PID:5204
- C:\Windows\System\RedykHJ.exe
  C:\Windows\System\RedykHJ.exe
  2⤵
  PID:4332
- C:\Windows\System\PZpHokX.exe
  C:\Windows\System\PZpHokX.exe
  2⤵
  PID:5396
- C:\Windows\System\MetYveT.exe
  C:\Windows\System\MetYveT.exe
  2⤵
  PID:1588
- C:\Windows\System\Mkcaxbq.exe
  C:\Windows\System\Mkcaxbq.exe
  2⤵
  PID:1156
- C:\Windows\System\GqZLpzO.exe
  C:\Windows\System\GqZLpzO.exe
  2⤵
  PID:3260
- C:\Windows\System\TwWqeGU.exe
  C:\Windows\System\TwWqeGU.exe
  2⤵
  PID:4108
- C:\Windows\System\qXOGZFn.exe
  C:\Windows\System\qXOGZFn.exe
  2⤵
  PID:1500
- C:\Windows\System\FwRzfcl.exe
  C:\Windows\System\FwRzfcl.exe
  2⤵
  PID:3604
- C:\Windows\System\kELZykd.exe
  C:\Windows\System\kELZykd.exe
  2⤵
  PID:3812
- C:\Windows\System\yqLvBjF.exe
  C:\Windows\System\yqLvBjF.exe
  2⤵
  PID:2784
- C:\Windows\System\zqWjJyS.exe
  C:\Windows\System\zqWjJyS.exe
  2⤵
  PID:2572
- C:\Windows\System\dIjBhHk.exe
  C:\Windows\System\dIjBhHk.exe
  2⤵
  PID:1480
- C:\Windows\System\gzOvjsP.exe
  C:\Windows\System\gzOvjsP.exe
  2⤵
  PID:1352
- C:\Windows\System\KeYVUxO.exe
  C:\Windows\System\KeYVUxO.exe
  2⤵
  PID:1636
- C:\Windows\System\UhiPcpO.exe
  C:\Windows\System\UhiPcpO.exe
  2⤵
  PID:5592
- C:\Windows\System\wGUGzwe.exe
  C:\Windows\System\wGUGzwe.exe
  2⤵
  PID:5604
- C:\Windows\System\HLAHSDk.exe
  C:\Windows\System\HLAHSDk.exe
  2⤵
  PID:5620
- C:\Windows\System\aWnyMCU.exe
  C:\Windows\System\aWnyMCU.exe
  2⤵
  PID:5644
- C:\Windows\System\rUSKgeH.exe
  C:\Windows\System\rUSKgeH.exe
  2⤵
  PID:5672
- C:\Windows\System\KbUjjzH.exe
  C:\Windows\System\KbUjjzH.exe
  2⤵
  PID:5704
- C:\Windows\System\MtQbyYk.exe
  C:\Windows\System\MtQbyYk.exe
  2⤵
  PID:5740
- C:\Windows\System\CQWGOzs.exe
  C:\Windows\System\CQWGOzs.exe
  2⤵
  PID:5776
- C:\Windows\System\jNpgblk.exe
  C:\Windows\System\jNpgblk.exe
  2⤵
  PID:5808
- C:\Windows\System\XrGjnTm.exe
  C:\Windows\System\XrGjnTm.exe
  2⤵
  PID:5828
- C:\Windows\System\hNgZHkg.exe
  C:\Windows\System\hNgZHkg.exe
  2⤵
  PID:3824
- C:\Windows\System\nXruDMp.exe
  C:\Windows\System\nXruDMp.exe
  2⤵
  PID:5868
- C:\Windows\System\iPuDRRc.exe
  C:\Windows\System\iPuDRRc.exe
  2⤵
  PID:5324
- C:\Windows\System\BJWmMtU.exe
  C:\Windows\System\BJWmMtU.exe
  2⤵
  PID:5356
- C:\Windows\System\MGSBmWh.exe
  C:\Windows\System\MGSBmWh.exe
  2⤵
  PID:5912
- C:\Windows\System\LJPSFKi.exe
  C:\Windows\System\LJPSFKi.exe
  2⤵
  PID:5368
- C:\Windows\System\lXneyck.exe
  C:\Windows\System\lXneyck.exe
  2⤵
  PID:5932
- C:\Windows\System\KpxPCSM.exe
  C:\Windows\System\KpxPCSM.exe
  2⤵
  PID:2220
- C:\Windows\System\PEACrgT.exe
  C:\Windows\System\PEACrgT.exe
  2⤵
  PID:5444
- C:\Windows\System\BtoGsvt.exe
  C:\Windows\System\BtoGsvt.exe
  2⤵
  PID:6064
- C:\Windows\System\EGHHBWH.exe
  C:\Windows\System\EGHHBWH.exe
  2⤵
  PID:5964
- C:\Windows\System\tJqCeki.exe
  C:\Windows\System\tJqCeki.exe
  2⤵
  PID:2180
- C:\Windows\System\ziMdcou.exe
  C:\Windows\System\ziMdcou.exe
  2⤵
  PID:5140
- C:\Windows\System\FXebeiR.exe
  C:\Windows\System\FXebeiR.exe
  2⤵
  PID:5276
- C:\Windows\System\SZzNKNU.exe
  C:\Windows\System\SZzNKNU.exe
  2⤵
  PID:5536
- C:\Windows\System\XeqJoqm.exe
  C:\Windows\System\XeqJoqm.exe
  2⤵
  PID:5144
- C:\Windows\System\rvgKiZZ.exe
  C:\Windows\System\rvgKiZZ.exe
  2⤵
  PID:4236
- C:\Windows\System\sPJgwCl.exe
  C:\Windows\System\sPJgwCl.exe
  2⤵
  PID:5380
- C:\Windows\System\llUwlDS.exe
  C:\Windows\System\llUwlDS.exe
  2⤵
  PID:5012
- C:\Windows\System\ThRURHK.exe
  C:\Windows\System\ThRURHK.exe
  2⤵
  PID:5728
- C:\Windows\System\RAyoudC.exe
  C:\Windows\System\RAyoudC.exe
  2⤵
  PID:5652
- C:\Windows\System\YJgInSP.exe
  C:\Windows\System\YJgInSP.exe
  2⤵
  PID:5916
- C:\Windows\System\lKtXoYk.exe
  C:\Windows\System\lKtXoYk.exe
  2⤵
  PID:4804
- C:\Windows\System\oNluiNo.exe
  C:\Windows\System\oNluiNo.exe
  2⤵
  PID:5772
- C:\Windows\System\hyIYnTT.exe
  C:\Windows\System\hyIYnTT.exe
  2⤵
  PID:4972
- C:\Windows\System\eKzUegg.exe
  C:\Windows\System\eKzUegg.exe
  2⤵
  PID:5856
- C:\Windows\System\ojLdboq.exe
  C:\Windows\System\ojLdboq.exe
  2⤵
  PID:5700
- C:\Windows\System\UxqOYQE.exe
  C:\Windows\System\UxqOYQE.exe
  2⤵
  PID:5748
- C:\Windows\System\nzTtBte.exe
  C:\Windows\System\nzTtBte.exe
  2⤵
  PID:5924
- C:\Windows\System\ymRznRx.exe
  C:\Windows\System\ymRznRx.exe
  2⤵
  PID:5416
- C:\Windows\System\sEcmitM.exe
  C:\Windows\System\sEcmitM.exe
  2⤵
  PID:5796
- C:\Windows\System\AeAvIEq.exe
  C:\Windows\System\AeAvIEq.exe
  2⤵
  PID:5060
- C:\Windows\System\kqFNtTF.exe
  C:\Windows\System\kqFNtTF.exe
  2⤵
  PID:6140
- C:\Windows\System\bKyLfUL.exe
  C:\Windows\System\bKyLfUL.exe
  2⤵
  PID:6148
- C:\Windows\System\kOopTza.exe
  C:\Windows\System\kOopTza.exe
  2⤵
  PID:6184
- C:\Windows\System\CruqGVO.exe
  C:\Windows\System\CruqGVO.exe
  2⤵
  PID:6208
- C:\Windows\System\gYahjrb.exe
  C:\Windows\System\gYahjrb.exe
  2⤵
  PID:6228
- C:\Windows\System\MvbwPgt.exe
  C:\Windows\System\MvbwPgt.exe
  2⤵
  PID:6252
- C:\Windows\System\kQIAkVZ.exe
  C:\Windows\System\kQIAkVZ.exe
  2⤵
  PID:6272
- C:\Windows\System\ZUXXgNQ.exe
  C:\Windows\System\ZUXXgNQ.exe
  2⤵
  PID:6308
- C:\Windows\System\DMtQqOP.exe
  C:\Windows\System\DMtQqOP.exe
  2⤵
  PID:6328
- C:\Windows\System\fBlOrDz.exe
  C:\Windows\System\fBlOrDz.exe
  2⤵
  PID:6352
- C:\Windows\System\cVnzCzM.exe
  C:\Windows\System\cVnzCzM.exe
  2⤵
  PID:6368
- C:\Windows\System\sxdmHFK.exe
  C:\Windows\System\sxdmHFK.exe
  2⤵
  PID:6388
- C:\Windows\System\aszFOkb.exe
  C:\Windows\System\aszFOkb.exe
  2⤵
  PID:6420
- C:\Windows\System\pbDjrkO.exe
  C:\Windows\System\pbDjrkO.exe
  2⤵
  PID:6524
- C:\Windows\System\iScXTZr.exe
  C:\Windows\System\iScXTZr.exe
  2⤵
  PID:6548
- C:\Windows\System\YEVgdMV.exe
  C:\Windows\System\YEVgdMV.exe
  2⤵
  PID:6568
- C:\Windows\System\YVAwOAm.exe
  C:\Windows\System\YVAwOAm.exe
  2⤵
  PID:6592
- C:\Windows\System\BskJsms.exe
  C:\Windows\System\BskJsms.exe
  2⤵
  PID:6628
- C:\Windows\System\XwwXwAo.exe
  C:\Windows\System\XwwXwAo.exe
  2⤵
  PID:6644
- C:\Windows\System\dOxFeJB.exe
  C:\Windows\System\dOxFeJB.exe
  2⤵
  PID:6660
- C:\Windows\System\CObGMYR.exe
  C:\Windows\System\CObGMYR.exe
  2⤵
  PID:6680
- C:\Windows\System\vsDQvYL.exe
  C:\Windows\System\vsDQvYL.exe
  2⤵
  PID:6708
- C:\Windows\System\weNIdbp.exe
  C:\Windows\System\weNIdbp.exe
  2⤵
  PID:6724
- C:\Windows\System\lBBjGWM.exe
  C:\Windows\System\lBBjGWM.exe
  2⤵
  PID:6748
- C:\Windows\System\XFvGMbQ.exe
  C:\Windows\System\XFvGMbQ.exe
  2⤵
  PID:6772
- C:\Windows\System\ANTyNQv.exe
  C:\Windows\System\ANTyNQv.exe
  2⤵
  PID:6804
- C:\Windows\System\MHorLYx.exe
  C:\Windows\System\MHorLYx.exe
  2⤵
  PID:6824
- C:\Windows\System\WEHwonv.exe
  C:\Windows\System\WEHwonv.exe
  2⤵
  PID:6848
- C:\Windows\System\sgbbxGD.exe
  C:\Windows\System\sgbbxGD.exe
  2⤵
  PID:6868
- C:\Windows\System\qbbIDij.exe
  C:\Windows\System\qbbIDij.exe
  2⤵
  PID:6888
- C:\Windows\System\mrcqyuA.exe
  C:\Windows\System\mrcqyuA.exe
  2⤵
  PID:6920
- C:\Windows\System\fbqWBYQ.exe
  C:\Windows\System\fbqWBYQ.exe
  2⤵
  PID:6940
- C:\Windows\System\OxbQBYq.exe
  C:\Windows\System\OxbQBYq.exe
  2⤵
  PID:6964
- C:\Windows\System\EvZLmSP.exe
  C:\Windows\System\EvZLmSP.exe
  2⤵
  PID:6988
- C:\Windows\System\sXousMo.exe
  C:\Windows\System\sXousMo.exe
  2⤵
  PID:7008
- C:\Windows\System\WkWZlRz.exe
  C:\Windows\System\WkWZlRz.exe
  2⤵
  PID:7028
- C:\Windows\System\NNQtZPT.exe
  C:\Windows\System\NNQtZPT.exe
  2⤵
  PID:7048
- C:\Windows\System\ZTdxvBI.exe
  C:\Windows\System\ZTdxvBI.exe
  2⤵
  PID:7068
- C:\Windows\System\lqMhSDn.exe
  C:\Windows\System\lqMhSDn.exe
  2⤵
  PID:7096
- C:\Windows\System\ACuCNyt.exe
  C:\Windows\System\ACuCNyt.exe
  2⤵
  PID:7116
- C:\Windows\System\idOxKOT.exe
  C:\Windows\System\idOxKOT.exe
  2⤵
  PID:7148
- C:\Windows\System\EOEktwe.exe
  C:\Windows\System\EOEktwe.exe
  2⤵
  PID:7164
- C:\Windows\System\UcOjaDq.exe
  C:\Windows\System\UcOjaDq.exe
  2⤵
  PID:1712
- C:\Windows\System\TRBuGvV.exe
  C:\Windows\System\TRBuGvV.exe
  2⤵
  PID:6084
- C:\Windows\System\RUoEHZH.exe
  C:\Windows\System\RUoEHZH.exe
  2⤵
  PID:5308
- C:\Windows\System\TNVRJDx.exe
  C:\Windows\System\TNVRJDx.exe
  2⤵
  PID:6176
- C:\Windows\System\JhZSdoN.exe
  C:\Windows\System\JhZSdoN.exe
  2⤵
  PID:6264
- C:\Windows\System\aVfoANc.exe
  C:\Windows\System\aVfoANc.exe
  2⤵
  PID:5976
- C:\Windows\System\CwAYhbq.exe
  C:\Windows\System\CwAYhbq.exe
  2⤵
  PID:6412
- C:\Windows\System\OElDGpT.exe
  C:\Windows\System\OElDGpT.exe
  2⤵
  PID:6196
- C:\Windows\System\HoRAzWU.exe
  C:\Windows\System\HoRAzWU.exe
  2⤵
  PID:6464
- C:\Windows\System\GczNeMs.exe
  C:\Windows\System\GczNeMs.exe
  2⤵
  PID:6488
- C:\Windows\System\TlTTNxx.exe
  C:\Windows\System\TlTTNxx.exe
  2⤵
  PID:6268
- C:\Windows\System\QkjmSvs.exe
  C:\Windows\System\QkjmSvs.exe
  2⤵
  PID:6320
- C:\Windows\System\nLCioiR.exe
  C:\Windows\System\nLCioiR.exe
  2⤵
  PID:6360
- C:\Windows\System\bJwNRoS.exe
  C:\Windows\System\bJwNRoS.exe
  2⤵
  PID:6984
- C:\Windows\System\BYVhnXK.exe
  C:\Windows\System\BYVhnXK.exe
  2⤵
  PID:6556
- C:\Windows\System\IrQrYol.exe
  C:\Windows\System\IrQrYol.exe
  2⤵
  PID:6616
- C:\Windows\System\almPMGv.exe
  C:\Windows\System\almPMGv.exe
  2⤵
  PID:6896
- C:\Windows\System\WeHVfMP.exe
  C:\Windows\System\WeHVfMP.exe
  2⤵
  PID:6912
- C:\Windows\System\IhVuyLH.exe
  C:\Windows\System\IhVuyLH.exe
  2⤵
  PID:3728
- C:\Windows\System\qMkyamj.exe
  C:\Windows\System\qMkyamj.exe
  2⤵
  PID:6704
- C:\Windows\System\DHPnqAc.exe
  C:\Windows\System\DHPnqAc.exe
  2⤵
  PID:3796
- C:\Windows\System\RVojrgC.exe
  C:\Windows\System\RVojrgC.exe
  2⤵
  PID:7024
- C:\Windows\System\DeLHHUr.exe
  C:\Windows\System\DeLHHUr.exe
  2⤵
  PID:6284
- C:\Windows\System\OaKGBLI.exe
  C:\Windows\System\OaKGBLI.exe
  2⤵
  PID:7172
- C:\Windows\System\MRqLqcz.exe
  C:\Windows\System\MRqLqcz.exe
  2⤵
  PID:7200
- C:\Windows\System\XILhrMq.exe
  C:\Windows\System\XILhrMq.exe
  2⤵
  PID:7224
- C:\Windows\System\YdRZXWW.exe
  C:\Windows\System\YdRZXWW.exe
  2⤵
  PID:7260
- C:\Windows\System\AdsGNwf.exe
  C:\Windows\System\AdsGNwf.exe
  2⤵
  PID:7284
- C:\Windows\System\qdXAHcL.exe
  C:\Windows\System\qdXAHcL.exe
  2⤵
  PID:7316
- C:\Windows\System\PJqsbiB.exe
  C:\Windows\System\PJqsbiB.exe
  2⤵
  PID:7340
- C:\Windows\System\forEgoS.exe
  C:\Windows\System\forEgoS.exe
  2⤵
  PID:7364
- C:\Windows\System\RAxQwOl.exe
  C:\Windows\System\RAxQwOl.exe
  2⤵
  PID:7388
- C:\Windows\System\llYcFXl.exe
  C:\Windows\System\llYcFXl.exe
  2⤵
  PID:7416
- C:\Windows\System\YBKcbdz.exe
  C:\Windows\System\YBKcbdz.exe
  2⤵
  PID:7444
- C:\Windows\System\xFVCbVL.exe
  C:\Windows\System\xFVCbVL.exe
  2⤵
  PID:7468
- C:\Windows\System\MbLlQYn.exe
  C:\Windows\System\MbLlQYn.exe
  2⤵
  PID:7492
- C:\Windows\System\ySGkzKF.exe
  C:\Windows\System\ySGkzKF.exe
  2⤵
  PID:7516
- C:\Windows\System\twXwuWV.exe
  C:\Windows\System\twXwuWV.exe
  2⤵
  PID:7540
- C:\Windows\System\KHXJUib.exe
  C:\Windows\System\KHXJUib.exe
  2⤵
  PID:7568
- C:\Windows\System\soGWRdl.exe
  C:\Windows\System\soGWRdl.exe
  2⤵
  PID:7592
- C:\Windows\System\RDkKeFK.exe
  C:\Windows\System\RDkKeFK.exe
  2⤵
  PID:7616
- C:\Windows\System\gHPiFUA.exe
  C:\Windows\System\gHPiFUA.exe
  2⤵
  PID:7640
- C:\Windows\System\MdUdLeR.exe
  C:\Windows\System\MdUdLeR.exe
  2⤵
  PID:7664
- C:\Windows\System\ljFEZaA.exe
  C:\Windows\System\ljFEZaA.exe
  2⤵
  PID:7684
- C:\Windows\System\wjEBQeR.exe
  C:\Windows\System\wjEBQeR.exe
  2⤵
  PID:7704
- C:\Windows\System\emvJrPu.exe
  C:\Windows\System\emvJrPu.exe
  2⤵
  PID:7728
- C:\Windows\System\cxJjxSB.exe
  C:\Windows\System\cxJjxSB.exe
  2⤵
  PID:7752
- C:\Windows\System\VkAtXIB.exe
  C:\Windows\System\VkAtXIB.exe
  2⤵
  PID:7772
- C:\Windows\System\mnopFNl.exe
  C:\Windows\System\mnopFNl.exe
  2⤵
  PID:7788
- C:\Windows\System\tZuAeTJ.exe
  C:\Windows\System\tZuAeTJ.exe
  2⤵
  PID:7808
- C:\Windows\System\bCnlRVz.exe
  C:\Windows\System\bCnlRVz.exe
  2⤵
  PID:7828
- C:\Windows\System\KcXoHPD.exe
  C:\Windows\System\KcXoHPD.exe
  2⤵
  PID:7856
- C:\Windows\System\sgHbTfR.exe
  C:\Windows\System\sgHbTfR.exe
  2⤵
  PID:7876
- C:\Windows\System\BwzHyHT.exe
  C:\Windows\System\BwzHyHT.exe
  2⤵
  PID:7900
- C:\Windows\System\QiNNHSU.exe
  C:\Windows\System\QiNNHSU.exe
  2⤵
  PID:7924
- C:\Windows\System\trWQjVT.exe
  C:\Windows\System\trWQjVT.exe
  2⤵
  PID:7944
- C:\Windows\System\YDRrjXt.exe
  C:\Windows\System\YDRrjXt.exe
  2⤵
  PID:7980
- C:\Windows\System\hPztaqc.exe
  C:\Windows\System\hPztaqc.exe
  2⤵
  PID:8000
- C:\Windows\System\BXytFtT.exe
  C:\Windows\System\BXytFtT.exe
  2⤵
  PID:8020
- C:\Windows\System\PtVOkfq.exe
  C:\Windows\System\PtVOkfq.exe
  2⤵
  PID:8044
- C:\Windows\System\IrZLzrc.exe
  C:\Windows\System\IrZLzrc.exe
  2⤵
  PID:8064
- C:\Windows\System\AjhWPQu.exe
  C:\Windows\System\AjhWPQu.exe
  2⤵
  PID:8088
- C:\Windows\System\aXZeegw.exe
  C:\Windows\System\aXZeegw.exe
  2⤵
  PID:8108
- C:\Windows\System\iygSKRh.exe
  C:\Windows\System\iygSKRh.exe
  2⤵
  PID:8128
- C:\Windows\System\VGQVyCJ.exe
  C:\Windows\System\VGQVyCJ.exe
  2⤵
  PID:8152
- C:\Windows\System\PIUbYTJ.exe
  C:\Windows\System\PIUbYTJ.exe
  2⤵
  PID:8188
- C:\Windows\System\ykMavzW.exe
  C:\Windows\System\ykMavzW.exe
  2⤵
  PID:6820
- C:\Windows\System\bTWIbLF.exe
  C:\Windows\System\bTWIbLF.exe
  2⤵
  PID:6224
- C:\Windows\System\gDfmZTw.exe
  C:\Windows\System\gDfmZTw.exe
  2⤵
  PID:6908
- C:\Windows\System\zHmoqnK.exe
  C:\Windows\System\zHmoqnK.exe
  2⤵
  PID:5420
- C:\Windows\System\qGCLfGX.exe
  C:\Windows\System\qGCLfGX.exe
  2⤵
  PID:6564
- C:\Windows\System\uYUtJtn.exe
  C:\Windows\System\uYUtJtn.exe
  2⤵
  PID:6436
- C:\Windows\System\rnMBldq.exe
  C:\Windows\System\rnMBldq.exe
  2⤵
  PID:7336
- C:\Windows\System\daFpZNx.exe
  C:\Windows\System\daFpZNx.exe
  2⤵
  PID:2924
- C:\Windows\System\gVQiYwm.exe
  C:\Windows\System\gVQiYwm.exe
  2⤵
  PID:6532
- C:\Windows\System\sjrVEzl.exe
  C:\Windows\System\sjrVEzl.exe
  2⤵
  PID:7404
- C:\Windows\System\gmAgxtl.exe
  C:\Windows\System\gmAgxtl.exe
  2⤵
  PID:6864
- C:\Windows\System\DaaKeyQ.exe
  C:\Windows\System\DaaKeyQ.exe
  2⤵
  PID:6204
- C:\Windows\System\zKcKilh.exe
  C:\Windows\System\zKcKilh.exe
  2⤵
  PID:2212
- C:\Windows\System\IHZqvqU.exe
  C:\Windows\System\IHZqvqU.exe
  2⤵
  PID:7528
- C:\Windows\System\ErrmjFt.exe
  C:\Windows\System\ErrmjFt.exe
  2⤵
  PID:7248
- C:\Windows\System\SlgLHBE.exe
  C:\Windows\System\SlgLHBE.exe
  2⤵
  PID:7824
- C:\Windows\System\dCvaxOy.exe
  C:\Windows\System\dCvaxOy.exe
  2⤵
  PID:7872
- C:\Windows\System\bSgXLPU.exe
  C:\Windows\System\bSgXLPU.exe
  2⤵
  PID:7936
- C:\Windows\System\FpWJHvr.exe
  C:\Windows\System\FpWJHvr.exe
  2⤵
  PID:7324
- C:\Windows\System\LwHltza.exe
  C:\Windows\System\LwHltza.exe
  2⤵
  PID:7760
- C:\Windows\System\PLATIrR.exe
  C:\Windows\System\PLATIrR.exe
  2⤵
  PID:7124
- C:\Windows\System\RRVZNOT.exe
  C:\Windows\System\RRVZNOT.exe
  2⤵
  PID:7956
- C:\Windows\System\DuealsA.exe
  C:\Windows\System\DuealsA.exe
  2⤵
  PID:6544
- C:\Windows\System\SQYIGfM.exe
  C:\Windows\System\SQYIGfM.exe
  2⤵
  PID:8012
- C:\Windows\System\kEPBMKn.exe
  C:\Windows\System\kEPBMKn.exe
  2⤵
  PID:7268
- C:\Windows\System\NkoOJMd.exe
  C:\Windows\System\NkoOJMd.exe
  2⤵
  PID:8212
- C:\Windows\System\qamROMX.exe
  C:\Windows\System\qamROMX.exe
  2⤵
  PID:8244
- C:\Windows\System\NDBzVNG.exe
  C:\Windows\System\NDBzVNG.exe
  2⤵
  PID:8264
- C:\Windows\System\QYbZolx.exe
  C:\Windows\System\QYbZolx.exe
  2⤵
  PID:8308
- C:\Windows\System\mVNieWy.exe
  C:\Windows\System\mVNieWy.exe
  2⤵
  PID:8332
- C:\Windows\System\ruamyJD.exe
  C:\Windows\System\ruamyJD.exe
  2⤵
  PID:8368
- C:\Windows\System\KnbznBH.exe
  C:\Windows\System\KnbznBH.exe
  2⤵
  PID:8396
- C:\Windows\System\TpjiKrZ.exe
  C:\Windows\System\TpjiKrZ.exe
  2⤵
  PID:8416
- C:\Windows\System\dcdlTkN.exe
  C:\Windows\System\dcdlTkN.exe
  2⤵
  PID:8436
- C:\Windows\System\ICoEzbJ.exe
  C:\Windows\System\ICoEzbJ.exe
  2⤵
  PID:8460
- C:\Windows\System\iFfFCTV.exe
  C:\Windows\System\iFfFCTV.exe
  2⤵
  PID:8492
- C:\Windows\System\stFnOHs.exe
  C:\Windows\System\stFnOHs.exe
  2⤵
  PID:8512
- C:\Windows\System\uEfqHdA.exe
  C:\Windows\System\uEfqHdA.exe
  2⤵
  PID:8536
- C:\Windows\System\TGvdHVk.exe
  C:\Windows\System\TGvdHVk.exe
  2⤵
  PID:8568
- C:\Windows\System\GOwOUPi.exe
  C:\Windows\System\GOwOUPi.exe
  2⤵
  PID:8588
- C:\Windows\System\wGCIYIQ.exe
  C:\Windows\System\wGCIYIQ.exe
  2⤵
  PID:8612
- C:\Windows\System\xztiXzN.exe
  C:\Windows\System\xztiXzN.exe
  2⤵
  PID:8644
- C:\Windows\System\iegFwhc.exe
  C:\Windows\System\iegFwhc.exe
  2⤵
  PID:8668
- C:\Windows\System\BLMwwmc.exe
  C:\Windows\System\BLMwwmc.exe
  2⤵
  PID:8688
- C:\Windows\System\epNaqvi.exe
  C:\Windows\System\epNaqvi.exe
  2⤵
  PID:8704
- C:\Windows\System\Fxhoewx.exe
  C:\Windows\System\Fxhoewx.exe
  2⤵
  PID:8724
- C:\Windows\System\JIKNago.exe
  C:\Windows\System\JIKNago.exe
  2⤵
  PID:8748
- C:\Windows\System\UrZFQIl.exe
  C:\Windows\System\UrZFQIl.exe
  2⤵
  PID:8768
- C:\Windows\System\JqDgyIV.exe
  C:\Windows\System\JqDgyIV.exe
  2⤵
  PID:8796
- C:\Windows\System\wsoOiXT.exe
  C:\Windows\System\wsoOiXT.exe
  2⤵
  PID:8816
- C:\Windows\System\ZbnkFQl.exe
  C:\Windows\System\ZbnkFQl.exe
  2⤵
  PID:8836
- C:\Windows\System\zNrpSgN.exe
  C:\Windows\System\zNrpSgN.exe
  2⤵
  PID:8860
- C:\Windows\System\rfdITTm.exe
  C:\Windows\System\rfdITTm.exe
  2⤵
  PID:8888
- C:\Windows\System\dQcBeUd.exe
  C:\Windows\System\dQcBeUd.exe
  2⤵
  PID:8904
- C:\Windows\System\BHchgUO.exe
  C:\Windows\System\BHchgUO.exe
  2⤵
  PID:8932
- C:\Windows\System\sUUcNHj.exe
  C:\Windows\System\sUUcNHj.exe
  2⤵
  PID:8964
- C:\Windows\System\UAwZLrZ.exe
  C:\Windows\System\UAwZLrZ.exe
  2⤵
  PID:8988
- C:\Windows\System\jQTdALA.exe
  C:\Windows\System\jQTdALA.exe
  2⤵
  PID:9008
- C:\Windows\System\mDfRhkn.exe
  C:\Windows\System\mDfRhkn.exe
  2⤵
  PID:9028
- C:\Windows\System\CpOQBdP.exe
  C:\Windows\System\CpOQBdP.exe
  2⤵
  PID:9056
- C:\Windows\System\ghSIgvt.exe
  C:\Windows\System\ghSIgvt.exe
  2⤵
  PID:9076
- C:\Windows\System\HBQoxDH.exe
  C:\Windows\System\HBQoxDH.exe
  2⤵
  PID:9100
- C:\Windows\System\sxDERIJ.exe
  C:\Windows\System\sxDERIJ.exe
  2⤵
  PID:9120
- C:\Windows\System\YJPPjPQ.exe
  C:\Windows\System\YJPPjPQ.exe
  2⤵
  PID:9144
- C:\Windows\System\eLEtQmf.exe
  C:\Windows\System\eLEtQmf.exe
  2⤵
  PID:9164
- C:\Windows\System\gqxVYSN.exe
  C:\Windows\System\gqxVYSN.exe
  2⤵
  PID:8220
- C:\Windows\System\uMNOaLx.exe
  C:\Windows\System\uMNOaLx.exe
  2⤵
  PID:8164
- C:\Windows\System\BvzOkTN.exe
  C:\Windows\System\BvzOkTN.exe
  2⤵
  PID:6156
- C:\Windows\System\gNrwNNE.exe
  C:\Windows\System\gNrwNNE.exe
  2⤵
  PID:8348
- C:\Windows\System\OvQQyGJ.exe
  C:\Windows\System\OvQQyGJ.exe
  2⤵
  PID:8408
- C:\Windows\System\kKpvxNs.exe
  C:\Windows\System\kKpvxNs.exe
  2⤵
  PID:2272
- C:\Windows\System\CXqVdWE.exe
  C:\Windows\System\CXqVdWE.exe
  2⤵
  PID:8584
- C:\Windows\System\UPRkBNu.exe
  C:\Windows\System\UPRkBNu.exe
  2⤵
  PID:7552
- C:\Windows\System\WcOqJBr.exe
  C:\Windows\System\WcOqJBr.exe
  2⤵
  PID:8324
- C:\Windows\System\slxyDNn.exe
  C:\Windows\System\slxyDNn.exe
  2⤵
  PID:8412
- C:\Windows\System\dftcWyW.exe
  C:\Windows\System\dftcWyW.exe
  2⤵
  PID:8468
- C:\Windows\System\KkxKoxE.exe
  C:\Windows\System\KkxKoxE.exe
  2⤵
  PID:8544
- C:\Windows\System\IpqNaop.exe
  C:\Windows\System\IpqNaop.exe
  2⤵
  PID:7588
- C:\Windows\System\IuaimYe.exe
  C:\Windows\System\IuaimYe.exe
  2⤵
  PID:8204
- C:\Windows\System\GLdNBuf.exe
  C:\Windows\System\GLdNBuf.exe
  2⤵
  PID:8376
- C:\Windows\System\IVFngqw.exe
  C:\Windows\System\IVFngqw.exe
  2⤵
  PID:9116
- C:\Windows\System\FRChoqm.exe
  C:\Windows\System\FRChoqm.exe
  2⤵
  PID:8760
- C:\Windows\System\dFVBNLU.exe
  C:\Windows\System\dFVBNLU.exe
  2⤵
  PID:9192
- C:\Windows\System\KrbAjEP.exe
  C:\Windows\System\KrbAjEP.exe
  2⤵
  PID:8684
- C:\Windows\System\ZRvcwZD.exe
  C:\Windows\System\ZRvcwZD.exe
  2⤵
  PID:8040
- C:\Windows\System\qaljVRk.exe
  C:\Windows\System\qaljVRk.exe
  2⤵
  PID:8872
- C:\Windows\System\avDXqXh.exe
  C:\Windows\System\avDXqXh.exe
  2⤵
  PID:9036
- C:\Windows\System\QSkrRvQ.exe
  C:\Windows\System\QSkrRvQ.exe
  2⤵
  PID:9228
- C:\Windows\System\jeNBeTq.exe
  C:\Windows\System\jeNBeTq.exe
  2⤵
  PID:9248
- C:\Windows\System\rTRrNBn.exe
  C:\Windows\System\rTRrNBn.exe
  2⤵
  PID:9268
- C:\Windows\System\iJSRLpV.exe
  C:\Windows\System\iJSRLpV.exe
  2⤵
  PID:9292
- C:\Windows\System\FipYabv.exe
  C:\Windows\System\FipYabv.exe
  2⤵
  PID:9308
- C:\Windows\System\msGMIEE.exe
  C:\Windows\System\msGMIEE.exe
  2⤵
  PID:9332
- C:\Windows\System\rNdPNyY.exe
  C:\Windows\System\rNdPNyY.exe
  2⤵
  PID:9352
- C:\Windows\System\CnDyeWM.exe
  C:\Windows\System\CnDyeWM.exe
  2⤵
  PID:9376
- C:\Windows\System\YUUxFxk.exe
  C:\Windows\System\YUUxFxk.exe
  2⤵
  PID:9396
- C:\Windows\System\NrVKeyV.exe
  C:\Windows\System\NrVKeyV.exe
  2⤵
  PID:9424
- C:\Windows\System\aplHmWn.exe
  C:\Windows\System\aplHmWn.exe
  2⤵
  PID:9444
- C:\Windows\System\NoGPRJz.exe
  C:\Windows\System\NoGPRJz.exe
  2⤵
  PID:9468
- C:\Windows\System\FzeMhLF.exe
  C:\Windows\System\FzeMhLF.exe
  2⤵
  PID:9496
- C:\Windows\System\kgcjjrl.exe
  C:\Windows\System\kgcjjrl.exe
  2⤵
  PID:9536
- C:\Windows\System\UutyeKu.exe
  C:\Windows\System\UutyeKu.exe
  2⤵
  PID:9556
- C:\Windows\System\aynvzzq.exe
  C:\Windows\System\aynvzzq.exe
  2⤵
  PID:9588
- C:\Windows\System\rMGFhrm.exe
  C:\Windows\System\rMGFhrm.exe
  2⤵
  PID:9608
- C:\Windows\System\sebPZuB.exe
  C:\Windows\System\sebPZuB.exe
  2⤵
  PID:9644
- C:\Windows\System\dgnmwXy.exe
  C:\Windows\System\dgnmwXy.exe
  2⤵
  PID:9664
- C:\Windows\System\MXrFZhR.exe
  C:\Windows\System\MXrFZhR.exe
  2⤵
  PID:9688
- C:\Windows\System\BEzFgwu.exe
  C:\Windows\System\BEzFgwu.exe
  2⤵
  PID:9708
- C:\Windows\System\ZaXmFbX.exe
  C:\Windows\System\ZaXmFbX.exe
  2⤵
  PID:9732
- C:\Windows\System\hgWKbkL.exe
  C:\Windows\System\hgWKbkL.exe
  2⤵
  PID:9760
- C:\Windows\System\NFrezOf.exe
  C:\Windows\System\NFrezOf.exe
  2⤵
  PID:9792
- C:\Windows\System\RJNUoeD.exe
  C:\Windows\System\RJNUoeD.exe
  2⤵
  PID:9816
- C:\Windows\System\ihzmkEG.exe
  C:\Windows\System\ihzmkEG.exe
  2⤵
  PID:9840
- C:\Windows\System\uyvhppD.exe
  C:\Windows\System\uyvhppD.exe
  2⤵
  PID:9868
- C:\Windows\System\JMqdrSj.exe
  C:\Windows\System\JMqdrSj.exe
  2⤵
  PID:9888
- C:\Windows\System\HjtqVdn.exe
  C:\Windows\System\HjtqVdn.exe
  2⤵
  PID:9916
- C:\Windows\System\vhXcbeE.exe
  C:\Windows\System\vhXcbeE.exe
  2⤵
  PID:9940
- C:\Windows\System\khqNNsl.exe
  C:\Windows\System\khqNNsl.exe
  2⤵
  PID:9960
- C:\Windows\System\uAFJdAr.exe
  C:\Windows\System\uAFJdAr.exe
  2⤵
  PID:9980
- C:\Windows\System\ynpyVlw.exe
  C:\Windows\System\ynpyVlw.exe
  2⤵
  PID:10004
- C:\Windows\System\XTGgFOt.exe
  C:\Windows\System\XTGgFOt.exe
  2⤵
  PID:10020
- C:\Windows\System\zoMpoSD.exe
  C:\Windows\System\zoMpoSD.exe
  2⤵
  PID:10044
- C:\Windows\System\flwDIdJ.exe
  C:\Windows\System\flwDIdJ.exe
  2⤵
  PID:10064
- C:\Windows\System\wMpgCQQ.exe
  C:\Windows\System\wMpgCQQ.exe
  2⤵
  PID:10080
- C:\Windows\System\eAiDpuC.exe
  C:\Windows\System\eAiDpuC.exe
  2⤵
  PID:10100
- C:\Windows\System\XmgpwOe.exe
  C:\Windows\System\XmgpwOe.exe
  2⤵
  PID:10120
- C:\Windows\System\EwJZTEA.exe
  C:\Windows\System\EwJZTEA.exe
  2⤵
  PID:10140
- C:\Windows\System\zxujAwg.exe
  C:\Windows\System\zxujAwg.exe
  2⤵
  PID:10160
- C:\Windows\System\NIknDhq.exe
  C:\Windows\System\NIknDhq.exe
  2⤵
  PID:10188
- C:\Windows\System\CtusUrF.exe
  C:\Windows\System\CtusUrF.exe
  2⤵
  PID:10208
- C:\Windows\System\HrvhgbI.exe
  C:\Windows\System\HrvhgbI.exe
  2⤵
  PID:10228
- C:\Windows\System\kLzKVSD.exe
  C:\Windows\System\kLzKVSD.exe
  2⤵
  PID:8228
- C:\Windows\System\SEZbtWZ.exe
  C:\Windows\System\SEZbtWZ.exe
  2⤵
  PID:8804
- C:\Windows\System\YMECbnq.exe
  C:\Windows\System\YMECbnq.exe
  2⤵
  PID:8580
- C:\Windows\System\ajgQRFy.exe
  C:\Windows\System\ajgQRFy.exe
  2⤵
  PID:8924
- C:\Windows\System\vigcess.exe
  C:\Windows\System\vigcess.exe
  2⤵
  PID:5732
- C:\Windows\System\DwPTvdQ.exe
  C:\Windows\System\DwPTvdQ.exe
  2⤵
  PID:7456
- C:\Windows\System\BEXYWhQ.exe
  C:\Windows\System\BEXYWhQ.exe
  2⤵
  PID:8856
- C:\Windows\System\DWjYTpD.exe
  C:\Windows\System\DWjYTpD.exe
  2⤵
  PID:9260
- C:\Windows\System\nZPEaFs.exe
  C:\Windows\System\nZPEaFs.exe
  2⤵
  PID:9324
- C:\Windows\System\JfUPtAX.exe
  C:\Windows\System\JfUPtAX.exe
  2⤵
  PID:9416
- C:\Windows\System\PKfHLXc.exe
  C:\Windows\System\PKfHLXc.exe
  2⤵
  PID:8160
- C:\Windows\System\RCQUIRf.exe
  C:\Windows\System\RCQUIRf.exe
  2⤵
  PID:9508
- C:\Windows\System\VwXHjEZ.exe
  C:\Windows\System\VwXHjEZ.exe
  2⤵
  PID:7112
- C:\Windows\System\nfziFeI.exe
  C:\Windows\System\nfziFeI.exe
  2⤵
  PID:8676
- C:\Windows\System\IVjRYAl.exe
  C:\Windows\System\IVjRYAl.exe
  2⤵
  PID:7888
- C:\Windows\System\ZsNKcnH.exe
  C:\Windows\System\ZsNKcnH.exe
  2⤵
  PID:2528
- C:\Windows\System\zgWxQvr.exe
  C:\Windows\System\zgWxQvr.exe
  2⤵
  PID:8432
- C:\Windows\System\IAxPfet.exe
  C:\Windows\System\IAxPfet.exe
  2⤵
  PID:8740
- C:\Windows\System\byddrdz.exe
  C:\Windows\System\byddrdz.exe
  2⤵
  PID:8664
- C:\Windows\System\ikvWCQu.exe
  C:\Windows\System\ikvWCQu.exe
  2⤵
  PID:9064
- C:\Windows\System\GHhVVrf.exe
  C:\Windows\System\GHhVVrf.exe
  2⤵
  PID:9852
- C:\Windows\System\RHMINIv.exe
  C:\Windows\System\RHMINIv.exe
  2⤵
  PID:9408
- C:\Windows\System\GzdqgCy.exe
  C:\Windows\System\GzdqgCy.exe
  2⤵
  PID:8276
- C:\Windows\System\JSNIEmS.exe
  C:\Windows\System\JSNIEmS.exe
  2⤵
  PID:10052
- C:\Windows\System\GJrHTcl.exe
  C:\Windows\System\GJrHTcl.exe
  2⤵
  PID:10096
- C:\Windows\System\lqzVLyj.exe
  C:\Windows\System\lqzVLyj.exe
  2⤵
  PID:9636
- C:\Windows\System\qfRMJDF.exe
  C:\Windows\System\qfRMJDF.exe
  2⤵
  PID:9672
- C:\Windows\System\WxmguuJ.exe
  C:\Windows\System\WxmguuJ.exe
  2⤵
  PID:8484
- C:\Windows\System\YPqOIaU.exe
  C:\Windows\System\YPqOIaU.exe
  2⤵
  PID:10172
- C:\Windows\System\FHzivCM.exe
  C:\Windows\System\FHzivCM.exe
  2⤵
  PID:10216
- C:\Windows\System\xjLKnSZ.exe
  C:\Windows\System\xjLKnSZ.exe
  2⤵
  PID:10260
- C:\Windows\System\etwjTkk.exe
  C:\Windows\System\etwjTkk.exe
  2⤵
  PID:10292
- C:\Windows\System\IuGcPtO.exe
  C:\Windows\System\IuGcPtO.exe
  2⤵
  PID:10316
- C:\Windows\System\ZAOQrtr.exe
  C:\Windows\System\ZAOQrtr.exe
  2⤵
  PID:10332
- C:\Windows\System\YefaCPh.exe
  C:\Windows\System\YefaCPh.exe
  2⤵
  PID:10356
- C:\Windows\System\LXFiGoY.exe
  C:\Windows\System\LXFiGoY.exe
  2⤵
  PID:10380
- C:\Windows\System\DcdxaDz.exe
  C:\Windows\System\DcdxaDz.exe
  2⤵
  PID:10404
- C:\Windows\System\LwwVDab.exe
  C:\Windows\System\LwwVDab.exe
  2⤵
  PID:10436
- C:\Windows\System\uNDbDlQ.exe
  C:\Windows\System\uNDbDlQ.exe
  2⤵
  PID:10452
- C:\Windows\System\pgnIrRI.exe
  C:\Windows\System\pgnIrRI.exe
  2⤵
  PID:10468
- C:\Windows\System\qCbAXEk.exe
  C:\Windows\System\qCbAXEk.exe
  2⤵
  PID:10488
- C:\Windows\System\uHzoEVA.exe
  C:\Windows\System\uHzoEVA.exe
  2⤵
  PID:10504
- C:\Windows\System\verkkZD.exe
  C:\Windows\System\verkkZD.exe
  2⤵
  PID:10524
- C:\Windows\System\TPRlmaO.exe
  C:\Windows\System\TPRlmaO.exe
  2⤵
  PID:10544
- C:\Windows\System\iJoEpho.exe
  C:\Windows\System\iJoEpho.exe
  2⤵
  PID:10560
- C:\Windows\System\reUcAcp.exe
  C:\Windows\System\reUcAcp.exe
  2⤵
  PID:10576
- C:\Windows\System\aYBVSyL.exe
  C:\Windows\System\aYBVSyL.exe
  2⤵
  PID:10596
- C:\Windows\System\pRRFTNP.exe
  C:\Windows\System\pRRFTNP.exe
  2⤵
  PID:10616
- C:\Windows\System\UFljjIK.exe
  C:\Windows\System\UFljjIK.exe
  2⤵
  PID:10644
- C:\Windows\System\UsXyyAm.exe
  C:\Windows\System\UsXyyAm.exe
  2⤵
  PID:10672
- C:\Windows\System\mknwFUb.exe
  C:\Windows\System\mknwFUb.exe
  2⤵
  PID:10704
- C:\Windows\System\ByAOtKk.exe
  C:\Windows\System\ByAOtKk.exe
  2⤵
  PID:10732
- C:\Windows\System\ndGBKEc.exe
  C:\Windows\System\ndGBKEc.exe
  2⤵
  PID:10752
- C:\Windows\System\wlpnZVA.exe
  C:\Windows\System\wlpnZVA.exe
  2⤵
  PID:10772
- C:\Windows\System\xETiDwR.exe
  C:\Windows\System\xETiDwR.exe
  2⤵
  PID:10796
- C:\Windows\System\IqGYseI.exe
  C:\Windows\System\IqGYseI.exe
  2⤵
  PID:10820
- C:\Windows\System\PvvVFWt.exe
  C:\Windows\System\PvvVFWt.exe
  2⤵
  PID:10840
- C:\Windows\System\SksVOjD.exe
  C:\Windows\System\SksVOjD.exe
  2⤵
  PID:10864
- C:\Windows\System\iGIuNhM.exe
  C:\Windows\System\iGIuNhM.exe
  2⤵
  PID:10888
- C:\Windows\System\oolHsjH.exe
  C:\Windows\System\oolHsjH.exe
  2⤵
  PID:10912
- C:\Windows\System\dcKulRT.exe
  C:\Windows\System\dcKulRT.exe
  2⤵
  PID:10932
- C:\Windows\System\PQZtaIb.exe
  C:\Windows\System\PQZtaIb.exe
  2⤵
  PID:10960
- C:\Windows\System\tRNwjjN.exe
  C:\Windows\System\tRNwjjN.exe
  2⤵
  PID:10988
- C:\Windows\System\HFKQvUq.exe
  C:\Windows\System\HFKQvUq.exe
  2⤵
  PID:11012
- C:\Windows\System\hQEftYy.exe
  C:\Windows\System\hQEftYy.exe
  2⤵
  PID:11036
- C:\Windows\System\WwCXhOq.exe
  C:\Windows\System\WwCXhOq.exe
  2⤵
  PID:11064
- C:\Windows\System\CUYLmkw.exe
  C:\Windows\System\CUYLmkw.exe
  2⤵
  PID:11084
- C:\Windows\System\lYymQrM.exe
  C:\Windows\System\lYymQrM.exe
  2⤵
  PID:11104
- C:\Windows\System\zYXPIPj.exe
  C:\Windows\System\zYXPIPj.exe
  2⤵
  PID:11128
- C:\Windows\System\mcoUynv.exe
  C:\Windows\System\mcoUynv.exe
  2⤵
  PID:11156
- C:\Windows\System\hKSYJpN.exe
  C:\Windows\System\hKSYJpN.exe
  2⤵
  PID:11180
- C:\Windows\System\xdURHmN.exe
  C:\Windows\System\xdURHmN.exe
  2⤵
  PID:11208
- C:\Windows\System\fEzCcvW.exe
  C:\Windows\System\fEzCcvW.exe
  2⤵
  PID:11232
- C:\Windows\System\OHBCJSS.exe
  C:\Windows\System\OHBCJSS.exe
  2⤵
  PID:11252
- C:\Windows\System\hxkJBjR.exe
  C:\Windows\System\hxkJBjR.exe
  2⤵
  PID:9224
- C:\Windows\System\DCDYhBl.exe
  C:\Windows\System\DCDYhBl.exe
  2⤵
  PID:8232
- C:\Windows\System\vrIUbbI.exe
  C:\Windows\System\vrIUbbI.exe
  2⤵
  PID:8260
- C:\Windows\System\pcNyzvO.exe
  C:\Windows\System\pcNyzvO.exe
  2⤵
  PID:9436
- C:\Windows\System\VlOaHov.exe
  C:\Windows\System\VlOaHov.exe
  2⤵
  PID:9956
- C:\Windows\System\gCESJYE.exe
  C:\Windows\System\gCESJYE.exe
  2⤵
  PID:10012
- C:\Windows\System\kELoXyI.exe
  C:\Windows\System\kELoXyI.exe
  2⤵
  PID:10076
- C:\Windows\System\PjAEidc.exe
  C:\Windows\System\PjAEidc.exe
  2⤵
  PID:8508
- C:\Windows\System\WYlHCSY.exe
  C:\Windows\System\WYlHCSY.exe
  2⤵
  PID:9836
- C:\Windows\System\oSpyewb.exe
  C:\Windows\System\oSpyewb.exe
  2⤵
  PID:10116
- C:\Windows\System\DuXDbon.exe
  C:\Windows\System\DuXDbon.exe
  2⤵
  PID:8356
- C:\Windows\System\yyqKthq.exe
  C:\Windows\System\yyqKthq.exe
  2⤵
  PID:10328
- C:\Windows\System\jEaeXNc.exe
  C:\Windows\System\jEaeXNc.exe
  2⤵
  PID:10420
- C:\Windows\System\zLJIzAQ.exe
  C:\Windows\System\zLJIzAQ.exe
  2⤵
  PID:10480
- C:\Windows\System\oocHyfm.exe
  C:\Windows\System\oocHyfm.exe
  2⤵
  PID:10568
- C:\Windows\System\dcRDlui.exe
  C:\Windows\System\dcRDlui.exe
  2⤵
  PID:11280
- C:\Windows\System\NEBFrhz.exe
  C:\Windows\System\NEBFrhz.exe
  2⤵
  PID:11312
- C:\Windows\System\zDbrZcf.exe
  C:\Windows\System\zDbrZcf.exe
  2⤵
  PID:11332
- C:\Windows\System\EdLfDUC.exe
  C:\Windows\System\EdLfDUC.exe
  2⤵
  PID:11356
- C:\Windows\System\BjFOFeo.exe
  C:\Windows\System\BjFOFeo.exe
  2⤵
  PID:11376
- C:\Windows\System\IJTrshA.exe
  C:\Windows\System\IJTrshA.exe
  2⤵
  PID:11408
- C:\Windows\System\aIjifTm.exe
  C:\Windows\System\aIjifTm.exe
  2⤵
  PID:11428
- C:\Windows\System\RBtitaK.exe
  C:\Windows\System\RBtitaK.exe
  2⤵
  PID:11448
- C:\Windows\System\vMSLOKE.exe
  C:\Windows\System\vMSLOKE.exe
  2⤵
  PID:11476
- C:\Windows\System\LFRGrdH.exe
  C:\Windows\System\LFRGrdH.exe
  2⤵
  PID:11500
- C:\Windows\System\NAuTxHC.exe
  C:\Windows\System\NAuTxHC.exe
  2⤵
  PID:11520
- C:\Windows\System\LPTYxpr.exe
  C:\Windows\System\LPTYxpr.exe
  2⤵
  PID:11552
- C:\Windows\System\whqmTiw.exe
  C:\Windows\System\whqmTiw.exe
  2⤵
  PID:11576
- C:\Windows\System\hLlqmxp.exe
  C:\Windows\System\hLlqmxp.exe
  2⤵
  PID:11604
- C:\Windows\System\FXLfeOZ.exe
  C:\Windows\System\FXLfeOZ.exe
  2⤵
  PID:11632
- C:\Windows\System\RNjZlDP.exe
  C:\Windows\System\RNjZlDP.exe
  2⤵
  PID:11656
- C:\Windows\System\fOiYyXJ.exe
  C:\Windows\System\fOiYyXJ.exe
  2⤵
  PID:11684
- C:\Windows\System\JTVmjHV.exe
  C:\Windows\System\JTVmjHV.exe
  2⤵
  PID:11708
- C:\Windows\System\BeaGkNy.exe
  C:\Windows\System\BeaGkNy.exe
  2⤵
  PID:11736
- C:\Windows\System\JcHnfQi.exe
  C:\Windows\System\JcHnfQi.exe
  2⤵
  PID:11752
- C:\Windows\System\OKcNQGq.exe
  C:\Windows\System\OKcNQGq.exe
  2⤵
  PID:11772
- C:\Windows\System\rOJEDGH.exe
  C:\Windows\System\rOJEDGH.exe
  2⤵
  PID:11792
- C:\Windows\System\rMJJcpV.exe
  C:\Windows\System\rMJJcpV.exe
  2⤵
  PID:11812
- C:\Windows\System\GtjrIdE.exe
  C:\Windows\System\GtjrIdE.exe
  2⤵
  PID:11832
- C:\Windows\System\WgaxcFV.exe
  C:\Windows\System\WgaxcFV.exe
  2⤵
  PID:11860
- C:\Windows\System\DayYraT.exe
  C:\Windows\System\DayYraT.exe
  2⤵
  PID:11888
- C:\Windows\System\ZNJdFjO.exe
  C:\Windows\System\ZNJdFjO.exe
  2⤵
  PID:11912
- C:\Windows\System\wGnicfZ.exe
  C:\Windows\System\wGnicfZ.exe
  2⤵
  PID:11932
- C:\Windows\System\tKoiWJE.exe
  C:\Windows\System\tKoiWJE.exe
  2⤵
  PID:11952
- C:\Windows\System\opDNwQs.exe
  C:\Windows\System\opDNwQs.exe
  2⤵
  PID:11972
- C:\Windows\System\UREyeZa.exe
  C:\Windows\System\UREyeZa.exe
  2⤵
  PID:11992
- C:\Windows\System\obqoAbz.exe
  C:\Windows\System\obqoAbz.exe
  2⤵
  PID:12020
- C:\Windows\System\mcQMNjc.exe
  C:\Windows\System\mcQMNjc.exe
  2⤵
  PID:12044
- C:\Windows\System\MMUyPFA.exe
  C:\Windows\System\MMUyPFA.exe
  2⤵
  PID:12116
- C:\Windows\System\KJQPMNz.exe
  C:\Windows\System\KJQPMNz.exe
  2⤵
  PID:12140
- C:\Windows\System\GCpxLoQ.exe
  C:\Windows\System\GCpxLoQ.exe
  2⤵
  PID:12156
- C:\Windows\System\UXNqzZi.exe
  C:\Windows\System\UXNqzZi.exe
  2⤵
  PID:12172
- C:\Windows\System\BOqBelp.exe
  C:\Windows\System\BOqBelp.exe
  2⤵
  PID:12188
- C:\Windows\System\makDTyG.exe
  C:\Windows\System\makDTyG.exe
  2⤵
  PID:12204
- C:\Windows\System\iVcWwEE.exe
  C:\Windows\System\iVcWwEE.exe
  2⤵
  PID:12220
- C:\Windows\System\ScttoIo.exe
  C:\Windows\System\ScttoIo.exe
  2⤵
  PID:12236
- C:\Windows\System\PywJCiF.exe
  C:\Windows\System\PywJCiF.exe
  2⤵
  PID:12252
- C:\Windows\System\qROVaoi.exe
  C:\Windows\System\qROVaoi.exe
  2⤵
  PID:12268
- C:\Windows\System\qIpqAzw.exe
  C:\Windows\System\qIpqAzw.exe
  2⤵
  PID:10588
- C:\Windows\System\juWqiBV.exe
  C:\Windows\System\juWqiBV.exe
  2⤵
  PID:9912
- C:\Windows\System\GgQyErL.exe
  C:\Windows\System\GgQyErL.exe
  2⤵
  PID:9484
- C:\Windows\System\bUuOhTZ.exe
  C:\Windows\System\bUuOhTZ.exe
  2⤵
  PID:9996
- C:\Windows\System\YbFJisp.exe
  C:\Windows\System\YbFJisp.exe
  2⤵
  PID:7992
- C:\Windows\System\EXNGNbB.exe
  C:\Windows\System\EXNGNbB.exe
  2⤵
  PID:10896
- C:\Windows\System\KLxysjg.exe
  C:\Windows\System\KLxysjg.exe
  2⤵
  PID:9720
- C:\Windows\System\qjBqxfO.exe
  C:\Windows\System\qjBqxfO.exe
  2⤵
  PID:11096
- C:\Windows\System\MRqJneB.exe
  C:\Windows\System\MRqJneB.exe
  2⤵
  PID:9364
- C:\Windows\System\ifcVONK.exe
  C:\Windows\System\ifcVONK.exe
  2⤵
  PID:10132
- C:\Windows\System\yGKeJft.exe
  C:\Windows\System\yGKeJft.exe
  2⤵
  PID:9740
- C:\Windows\System\KuopKOb.exe
  C:\Windows\System\KuopKOb.exe
  2⤵
  PID:10284
- C:\Windows\System\zWiIeDY.exe
  C:\Windows\System\zWiIeDY.exe
  2⤵
  PID:9136
- C:\Windows\System\MelKzbq.exe
  C:\Windows\System\MelKzbq.exe
  2⤵
  PID:10444
- C:\Windows\System\RVhAinb.exe
  C:\Windows\System\RVhAinb.exe
  2⤵
  PID:10536
- C:\Windows\System\mxKMJCM.exe
  C:\Windows\System\mxKMJCM.exe
  2⤵
  PID:10556
- C:\Windows\System\akcVBGy.exe
  C:\Windows\System\akcVBGy.exe
  2⤵
  PID:10412
- C:\Windows\System\GQpNrog.exe
  C:\Windows\System\GQpNrog.exe
  2⤵
  PID:11276
- C:\Windows\System\spewMWX.exe
  C:\Windows\System\spewMWX.exe
  2⤵
  PID:9236
- C:\Windows\System\hyNufLx.exe
  C:\Windows\System\hyNufLx.exe
  2⤵
  PID:11364
- C:\Windows\System\zdqQYxD.exe
  C:\Windows\System\zdqQYxD.exe
  2⤵
  PID:8896
- C:\Windows\System\KmaHmhl.exe
  C:\Windows\System\KmaHmhl.exe
  2⤵
  PID:11424
- C:\Windows\System\vUFqNfY.exe
  C:\Windows\System\vUFqNfY.exe
  2⤵
  PID:10748
- C:\Windows\System\SKSojtc.exe
  C:\Windows\System\SKSojtc.exe
  2⤵
  PID:11516
- C:\Windows\System\POdYwDy.exe
  C:\Windows\System\POdYwDy.exe
  2⤵
  PID:11596
- C:\Windows\System\YtgBgGC.exe
  C:\Windows\System\YtgBgGC.exe
  2⤵
  PID:12296
- C:\Windows\System\tgdSMXa.exe
  C:\Windows\System\tgdSMXa.exe
  2⤵
  PID:12316
- C:\Windows\System\RuqAcDX.exe
  C:\Windows\System\RuqAcDX.exe
  2⤵
  PID:12336
- C:\Windows\System\vcRSmmX.exe
  C:\Windows\System\vcRSmmX.exe
  2⤵
  PID:12360
- C:\Windows\System\qxAgZiq.exe
  C:\Windows\System\qxAgZiq.exe
  2⤵
  PID:12380
- C:\Windows\System\ifnBuYL.exe
  C:\Windows\System\ifnBuYL.exe
  2⤵
  PID:12408
- C:\Windows\System\wWphiFB.exe
  C:\Windows\System\wWphiFB.exe
  2⤵
  PID:12932
- C:\Windows\System\ZtJGdCF.exe
  C:\Windows\System\ZtJGdCF.exe
  2⤵
  PID:12988
- C:\Windows\System\lVQYomL.exe
  C:\Windows\System\lVQYomL.exe
  2⤵
  PID:13008
- C:\Windows\System\ZVCnphn.exe
  C:\Windows\System\ZVCnphn.exe
  2⤵
  PID:13024
- C:\Windows\System\AcvSWAg.exe
  C:\Windows\System\AcvSWAg.exe
  2⤵
  PID:13040
- C:\Windows\System\MNMbeZR.exe
  C:\Windows\System\MNMbeZR.exe
  2⤵
  PID:13060
- C:\Windows\System\KguBXaS.exe
  C:\Windows\System\KguBXaS.exe
  2⤵
  PID:13080
- C:\Windows\System\zMecdQI.exe
  C:\Windows\System\zMecdQI.exe
  2⤵
  PID:10572
- C:\Windows\System\BvQfgtf.exe
  C:\Windows\System\BvQfgtf.exe
  2⤵
  PID:12088
- C:\Windows\System\vuYANom.exe
  C:\Windows\System\vuYANom.exe
  2⤵
  PID:9600
- C:\Windows\System\MCJXewn.exe
  C:\Windows\System\MCJXewn.exe
  2⤵
  PID:9320
- C:\Windows\System\MFPzlmi.exe
  C:\Windows\System\MFPzlmi.exe
  2⤵
  PID:12424
- C:\Windows\System\WEfphIt.exe
  C:\Windows\System\WEfphIt.exe
  2⤵
  PID:13068
- C:\Windows\System\EaTYmwx.exe
  C:\Windows\System\EaTYmwx.exe
  2⤵
  PID:13100
- C:\Windows\System\hdORVAj.exe
  C:\Windows\System\hdORVAj.exe
  2⤵
  PID:13156
- C:\Windows\System\jUOUZqe.exe
  C:\Windows\System\jUOUZqe.exe
  2⤵
  PID:12812
- C:\Windows\System\zAaNziL.exe
  C:\Windows\System\zAaNziL.exe
  2⤵
  PID:12884
- C:\Windows\System\qcGTgXW.exe
  C:\Windows\System\qcGTgXW.exe
  2⤵
  PID:11748
- C:\Windows\System\yfsgNuL.exe
  C:\Windows\System\yfsgNuL.exe
  2⤵
  PID:9948
- C:\Windows\System\NPlUfXk.exe
  C:\Windows\System\NPlUfXk.exe
  2⤵
  PID:12164
- C:\Windows\System\rxRQsJC.exe
  C:\Windows\System\rxRQsJC.exe
  2⤵
  PID:12228
- C:\Windows\System\HELayPk.exe
  C:\Windows\System\HELayPk.exe
  2⤵
  PID:12056
- C:\Windows\System\qGgZnXw.exe
  C:\Windows\System\qGgZnXw.exe
  2⤵
  PID:11984
- C:\Windows\System\AsgBoEo.exe
  C:\Windows\System\AsgBoEo.exe
  2⤵
  PID:13020
- C:\Windows\System\BIHZnzf.exe
  C:\Windows\System\BIHZnzf.exe
  2⤵
  PID:13124
- C:\Windows\System\IJpEAtL.exe
  C:\Windows\System\IJpEAtL.exe
  2⤵
  PID:13180
- C:\Windows\System\QgtAOkj.exe
  C:\Windows\System\QgtAOkj.exe
  2⤵
  PID:11648
- C:\Windows\System\dGebYxg.exe
  C:\Windows\System\dGebYxg.exe
  2⤵
  PID:2084
- C:\Windows\System\nicdfZW.exe
  C:\Windows\System\nicdfZW.exe
  2⤵
  PID:3828
- C:\Windows\System\BTlpsCv.exe
  C:\Windows\System\BTlpsCv.exe
  2⤵
  PID:11704
- C:\Windows\System\gOQkXfs.exe
  C:\Windows\System\gOQkXfs.exe
  2⤵
  PID:10152
- C:\Windows\System\KXWRuEY.exe
  C:\Windows\System\KXWRuEY.exe
  2⤵
  PID:13176
- C:\Windows\System\RaLSvor.exe
  C:\Windows\System\RaLSvor.exe
  2⤵
  PID:13264
- C:\Windows\System\evrXTMT.exe
  C:\Windows\System\evrXTMT.exe
  2⤵
  PID:9748
- C:\Windows\System\qYNZuZN.exe
  C:\Windows\System\qYNZuZN.exe
  2⤵
  PID:12112
- C:\Windows\System\AKIQPkz.exe
  C:\Windows\System\AKIQPkz.exe
  2⤵
  PID:9976
- C:\Windows\System\wDThnPq.exe
  C:\Windows\System\wDThnPq.exe
  2⤵
  PID:10848
- C:\Windows\System\cdhfxxI.exe
  C:\Windows\System\cdhfxxI.exe
  2⤵
  PID:11620
- C:\Windows\System\eBchXZI.exe
  C:\Windows\System\eBchXZI.exe
  2⤵
  PID:10168
- C:\Windows\System\FFAMZPm.exe
  C:\Windows\System\FFAMZPm.exe
  2⤵
  PID:13280
- C:\Windows\System\hLNZCul.exe
  C:\Windows\System\hLNZCul.exe
  2⤵
  PID:12892
- C:\Windows\System\rptpWhB.exe
  C:\Windows\System\rptpWhB.exe
  2⤵
  PID:10300
- C:\Windows\System\YHaEbEo.exe
  C:\Windows\System\YHaEbEo.exe
  2⤵
  PID:9904
- C:\Windows\System\xFfHIet.exe
  C:\Windows\System\xFfHIet.exe
  2⤵
  PID:636
- C:\Windows\System\AawtNFe.exe
  C:\Windows\System\AawtNFe.exe
  2⤵
  PID:12684
- C:\Windows\System\MvJwEeF.exe
  C:\Windows\System\MvJwEeF.exe
  2⤵
  PID:13224
- C:\Windows\System\SVprIoe.exe
  C:\Windows\System\SVprIoe.exe
  2⤵
  PID:4048
- C:\Windows\System\RCkTHzW.exe
  C:\Windows\System\RCkTHzW.exe
  2⤵
  PID:8948
- C:\Windows\System\jBCWUaM.exe
  C:\Windows\System\jBCWUaM.exe
  2⤵
  PID:13132
- C:\Windows\System\ExQmMeH.exe
  C:\Windows\System\ExQmMeH.exe
  2⤵
  PID:10000
- C:\Windows\System\YVGvKjg.exe
  C:\Windows\System\YVGvKjg.exe
  2⤵
  PID:11788
- C:\Windows\System\dHbUtca.exe
  C:\Windows\System\dHbUtca.exe
  2⤵
  PID:12728
- C:\Windows\System\ClDknSG.exe
  C:\Windows\System\ClDknSG.exe
  2⤵
  PID:11116
- C:\Windows\System\sCCrtUl.exe
  C:\Windows\System\sCCrtUl.exe
  2⤵
  PID:10856
- C:\Windows\System\pjOFMsJ.exe
  C:\Windows\System\pjOFMsJ.exe
  2⤵
  PID:6860
- C:\Windows\System\VcwSFuo.exe
  C:\Windows\System\VcwSFuo.exe
  2⤵
  PID:13032
- C:\Windows\System\bRnwATm.exe
  C:\Windows\System\bRnwATm.exe
  2⤵
  PID:9160
- C:\Windows\System\QPKMJLG.exe
  C:\Windows\System\QPKMJLG.exe
  2⤵
  PID:1376
- C:\Windows\System\ZJtzdDh.exe
  C:\Windows\System\ZJtzdDh.exe
  2⤵
  PID:3092
- C:\Windows\System\NrxIwzN.exe
  C:\Windows\System\NrxIwzN.exe
  2⤵
  PID:13304
- C:\Windows\System\rlmbCFg.exe
  C:\Windows\System\rlmbCFg.exe
  2⤵
  PID:560
- C:\Windows\System\gMtnHaj.exe
  C:\Windows\System\gMtnHaj.exe
  2⤵
  PID:11052
- C:\Windows\System\EjacfCX.exe
  C:\Windows\System\EjacfCX.exe
  2⤵
  PID:1264
- C:\Windows\System\eJHrAgO.exe
  C:\Windows\System\eJHrAgO.exe
  2⤵
  PID:1380
- C:\Windows\System\FaLNdtk.exe
  C:\Windows\System\FaLNdtk.exe
  2⤵
  PID:2044
- C:\Windows\System\cftqVxg.exe
  C:\Windows\System\cftqVxg.exe
  2⤵
  PID:3568
- C:\Windows\System\MTHIVnn.exe
  C:\Windows\System\MTHIVnn.exe
  2⤵
  PID:4672
- C:\Windows\System\ffRNVxg.exe
  C:\Windows\System\ffRNVxg.exe
  2⤵
  PID:11196
- C:\Windows\System\CkDcqrn.exe
  C:\Windows\System\CkDcqrn.exe
  2⤵
  PID:4724
- C:\Windows\System\njJaSWk.exe
  C:\Windows\System\njJaSWk.exe
  2⤵
  PID:12784
- C:\Windows\System\fEsvisF.exe
  C:\Windows\System\fEsvisF.exe
  2⤵
  PID:11900
- C:\Windows\System\JiunRUn.exe
  C:\Windows\System\JiunRUn.exe
  2⤵
  PID:11388
- C:\Windows\System\dOnBTIK.exe
  C:\Windows\System\dOnBTIK.exe
  2⤵
  PID:10784
- C:\Windows\System\OugfYvr.exe
  C:\Windows\System\OugfYvr.exe
  2⤵
  PID:12420
- C:\Windows\System\PkXaIQh.exe
  C:\Windows\System\PkXaIQh.exe
  2⤵
  PID:13220
- C:\Windows\System\VAhBkkN.exe
  C:\Windows\System\VAhBkkN.exe
  2⤵
  PID:12924
- C:\Windows\System\RROhtqi.exe
  C:\Windows\System\RROhtqi.exe
  2⤵
  PID:1476
- C:\Windows\System\fMlulto.exe
  C:\Windows\System\fMlulto.exe
  2⤵
  PID:1852
- C:\Windows\System\UPalXrz.exe
  C:\Windows\System\UPalXrz.exe
  2⤵
  PID:12232
- C:\Windows\System\QQwXIFP.exe
  C:\Windows\System\QQwXIFP.exe
  2⤵
  PID:224
- C:\Windows\System\wGwHXiK.exe
  C:\Windows\System\wGwHXiK.exe
  2⤵
  PID:11760
- C:\Windows\System\ptkSlvs.exe
  C:\Windows\System\ptkSlvs.exe
  2⤵
  PID:4344
- C:\Windows\System\uuVkhiZ.exe
  C:\Windows\System\uuVkhiZ.exe
  2⤵
  PID:5512
- C:\Windows\System\mNvqZSj.exe
  C:\Windows\System\mNvqZSj.exe
  2⤵
  PID:11444
- C:\Windows\System\BLwybpt.exe
  C:\Windows\System\BLwybpt.exe
  2⤵
  PID:1508
- C:\Windows\System\xnBKGnj.exe
  C:\Windows\System\xnBKGnj.exe
  2⤵
  PID:11924
- C:\Windows\System\qLUIPuU.exe
  C:\Windows\System\qLUIPuU.exe
  2⤵
  PID:2040
- C:\Windows\System\KvwKhDl.exe
  C:\Windows\System\KvwKhDl.exe
  2⤵
  PID:220
- C:\Windows\System\giRYXYb.exe
  C:\Windows\System\giRYXYb.exe
  2⤵
  PID:3472
- C:\Windows\System\LolNsoc.exe
  C:\Windows\System\LolNsoc.exe
  2⤵
  PID:5492
- C:\Windows\System\fZBKajT.exe
  C:\Windows\System\fZBKajT.exe
  2⤵
  PID:8716
- C:\Windows\System\epRHwQu.exe
  C:\Windows\System\epRHwQu.exe
  2⤵
  PID:3864
- C:\Windows\System\LnpYNhV.exe
  C:\Windows\System\LnpYNhV.exe
  2⤵
  PID:12476
- C:\Windows\System\PXhMDra.exe
  C:\Windows\System\PXhMDra.exe
  2⤵
  PID:13340
- C:\Windows\System\IXQPDLf.exe
  C:\Windows\System\IXQPDLf.exe
  2⤵
  PID:13384
- C:\Windows\System\mdBIXFR.exe
  C:\Windows\System\mdBIXFR.exe
  2⤵
  PID:13404
- C:\Windows\System\NeeSqpw.exe
  C:\Windows\System\NeeSqpw.exe
  2⤵
  PID:13420
- C:\Windows\System\yODARqx.exe
  C:\Windows\System\yODARqx.exe
  2⤵
  PID:13452
- C:\Windows\System\HElAWdH.exe
  C:\Windows\System\HElAWdH.exe
  2⤵
  PID:13480
- C:\Windows\System\qslzRFO.exe
  C:\Windows\System\qslzRFO.exe
  2⤵
  PID:13508
- C:\Windows\System\dMLYNbx.exe
  C:\Windows\System\dMLYNbx.exe
  2⤵
  PID:13532
- C:\Windows\System\OjjHYsZ.exe
  C:\Windows\System\OjjHYsZ.exe
  2⤵
  PID:13556
- C:\Windows\System\THaKrnW.exe
  C:\Windows\System\THaKrnW.exe
  2⤵
  PID:13600
- C:\Windows\System\VumrfjR.exe
  C:\Windows\System\VumrfjR.exe
  2⤵
  PID:13656
- C:\Windows\System\ltVHice.exe
  C:\Windows\System\ltVHice.exe
  2⤵
  PID:13680
- C:\Windows\System\CDGPFmk.exe
  C:\Windows\System\CDGPFmk.exe
  2⤵
  PID:13708
- C:\Windows\System\hcHuPJd.exe
  C:\Windows\System\hcHuPJd.exe
  2⤵
  PID:13804
- C:\Windows\System\OFXVqMx.exe
  C:\Windows\System\OFXVqMx.exe
  2⤵
  PID:13864
- C:\Windows\System\eFgmfck.exe
  C:\Windows\System\eFgmfck.exe
  2⤵
  PID:13880
- C:\Windows\System\FFPwTlV.exe
  C:\Windows\System\FFPwTlV.exe
  2⤵
  PID:13900
- C:\Windows\System\eklTTYt.exe
  C:\Windows\System\eklTTYt.exe
  2⤵
  PID:13940
- C:\Windows\System\JdYckUZ.exe
  C:\Windows\System\JdYckUZ.exe
  2⤵
  PID:13968
- C:\Windows\System\SSKcmKE.exe
  C:\Windows\System\SSKcmKE.exe
  2⤵
  PID:14008
- C:\Windows\System\JrZIPBe.exe
  C:\Windows\System\JrZIPBe.exe
  2⤵
  PID:14036
- C:\Windows\System\Kbgvmhl.exe
  C:\Windows\System\Kbgvmhl.exe
  2⤵
  PID:14072
- C:\Windows\System\RSzjqoO.exe
  C:\Windows\System\RSzjqoO.exe
  2⤵
  PID:14092
- C:\Windows\System\fNVIyNi.exe
  C:\Windows\System\fNVIyNi.exe
  2⤵
  PID:14112
- C:\Windows\System\Kptoulp.exe
  C:\Windows\System\Kptoulp.exe
  2⤵
  PID:14148
- C:\Windows\System\MkGKDrT.exe
  C:\Windows\System\MkGKDrT.exe
  2⤵
  PID:14164
- C:\Windows\System\mlUDYGk.exe
  C:\Windows\System\mlUDYGk.exe
  2⤵
  PID:14192
- C:\Windows\System\eyWARfE.exe
  C:\Windows\System\eyWARfE.exe
  2⤵
  PID:14212
- C:\Windows\System\vzmjSfN.exe
  C:\Windows\System\vzmjSfN.exe
  2⤵
  PID:14232
- C:\Windows\System\AamzpHk.exe
  C:\Windows\System\AamzpHk.exe
  2⤵
  PID:14268
- C:\Windows\System\IcnnNWt.exe
  C:\Windows\System\IcnnNWt.exe
  2⤵
  PID:14296
- C:\Windows\System\TZAjcAg.exe
  C:\Windows\System\TZAjcAg.exe
  2⤵
  PID:14320
- C:\Windows\System\cYNlueq.exe
  C:\Windows\System\cYNlueq.exe
  2⤵
  PID:4280
- C:\Windows\System\irIrSYC.exe
  C:\Windows\System\irIrSYC.exe
  2⤵
  PID:1292
- C:\Windows\System\lDzeqlr.exe
  C:\Windows\System\lDzeqlr.exe
  2⤵
  PID:5036
- C:\Windows\System\StSLRzv.exe
  C:\Windows\System\StSLRzv.exe
  2⤵
  PID:12500
- C:\Windows\System\MEsASWs.exe
  C:\Windows\System\MEsASWs.exe
  2⤵
  PID:4536
- C:\Windows\System\eqEVvWn.exe
  C:\Windows\System\eqEVvWn.exe
  2⤵
  PID:6136
- C:\Windows\System\AgyfLmu.exe
  C:\Windows\System\AgyfLmu.exe
  2⤵
  PID:704
- C:\Windows\System\AWKMKXN.exe
  C:\Windows\System\AWKMKXN.exe
  2⤵
  PID:4360
- C:\Windows\System\fdzdsOT.exe
  C:\Windows\System\fdzdsOT.exe
  2⤵
  PID:11028
- C:\Windows\System\yZdkvKP.exe
  C:\Windows\System\yZdkvKP.exe
  2⤵
  PID:4688
- C:\Windows\System\mBzIixu.exe
  C:\Windows\System\mBzIixu.exe
  2⤵
  PID:13320
- C:\Windows\System\FYPZDBz.exe
  C:\Windows\System\FYPZDBz.exe
  2⤵
  PID:13764
- C:\Windows\System\gABOKnk.exe
  C:\Windows\System\gABOKnk.exe
  2⤵
  PID:13668
- C:\Windows\System\ubRRVec.exe
  C:\Windows\System\ubRRVec.exe
  2⤵
  PID:13696
- C:\Windows\System\YXQBbLj.exe
  C:\Windows\System\YXQBbLj.exe
  2⤵
  PID:2720
- C:\Windows\System\YwdDRzD.exe
  C:\Windows\System\YwdDRzD.exe
  2⤵
  PID:4640
- C:\Windows\System\qmJwaZp.exe
  C:\Windows\System\qmJwaZp.exe
  2⤵
  PID:13860
- C:\Windows\System\BHzvQoU.exe
  C:\Windows\System\BHzvQoU.exe
  2⤵
  PID:13888
- C:\Windows\System\lNUeCvj.exe
  C:\Windows\System\lNUeCvj.exe
  2⤵
  PID:14056
- C:\Windows\System\PktXvMV.exe
  C:\Windows\System\PktXvMV.exe
  2⤵
  PID:840
- C:\Windows\System\UewOFEZ.exe
  C:\Windows\System\UewOFEZ.exe
  2⤵
  PID:13908
- C:\Windows\System\xTPgdde.exe
  C:\Windows\System\xTPgdde.exe
  2⤵
  PID:14328
- C:\Windows\System\jDJPlQt.exe
  C:\Windows\System\jDJPlQt.exe
  2⤵
  PID:5248
- C:\Windows\System\mOPnOVF.exe
  C:\Windows\System\mOPnOVF.exe
  2⤵
  PID:4260
- C:\Windows\System\OQfoKIR.exe
  C:\Windows\System\OQfoKIR.exe
  2⤵
  PID:64
- C:\Windows\System\hnQPRnY.exe
  C:\Windows\System\hnQPRnY.exe
  2⤵
  PID:1236
- C:\Windows\System\aSPujUc.exe
  C:\Windows\System\aSPujUc.exe
  2⤵
  PID:2356
- C:\Windows\System\JwsOzGG.exe
  C:\Windows\System\JwsOzGG.exe
  2⤵
  PID:2148

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4kkjjfdf.iiq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AWHHkiI.exe

Filesize
2.2MB

MD5
9359fcafc634238f96334b61e8b358ae

SHA1
b925ba8cb55d9b91f964fe6de53737bff3523a78

SHA256
95f21b9fb3d0089036b3506be5ab32dac540f80ec497cfb94c1cc7447af29012

SHA512
ba69f13c2949a202c46ac0a5c9d57ae638c4c93e517c3313f35b2007227539c4099ca466f46c80acc44c7c8361cf76dc06f48b9a2e992a234afcf03055174456

Download Submit
C:\Windows\System\AWfDjyo.exe

Filesize
2.2MB

MD5
d2a6a487a18ffa451859afaa28e9e28a

SHA1
9228b0f634d626eb41575b7e209a97f9e463a130

SHA256
854e14ff6984725128b6f631972ab9613d047215812cdab59d64cab0c0130c84

SHA512
d420738c8ee521a29a9b11c053efb0028ba7189cd78fb43699c5550b70fd55369b12da6a59c0a368398e2a0b41cc3966c822af71d0521d6b38afea2e98967e03

Download Submit
C:\Windows\System\EcQpgSK.exe

Filesize
2.2MB

MD5
892f0709454e41b3fbb6b6b6410a9304

SHA1
62f2241f50cb120c16c85900dfeb15a0b23bce49

SHA256
5fde821024d12502f347ded3be058069a53bea7b47443d0bd173abd104334b70

SHA512
00b5bc32ba4a9c1daddf2906dee7a1d340ed0c30ff82ba60c26e05f79132a1580b92eeca258d56b177f0544226ab6e5d1982ab83031bbdc84945bfbbfa9aa5b3

Download Submit
C:\Windows\System\FSvuHBH.exe

Filesize
2.2MB

MD5
84d6e715a7e0419fc1bea5507b78adc2

SHA1
fef8cc17977289cb2dcbce3ab6fe3d5d4bd775ea

SHA256
ea776dadd0d975736644c34c87c4dae2079f96c560ed99b252292e1c5764d161

SHA512
309a09999a58a12c4a6d5d445e5fb76b328690a64709a970171d28278680fca7ff51309ce19514d93ff5ab78c16458d977accad17531866b47c708d4bc79811f

Download Submit
C:\Windows\System\GAyFnYX.exe

Filesize
2.2MB

MD5
e87fdea1981d91d72ed58348e742ca94

SHA1
2d8e90674c370061039bab296615f6f9eb936399

SHA256
b6ebdcf2de286f5322c229069a32379b0fdf476ec95d4a41315323e8d4ac3972

SHA512
afc1d6389e6abb8042a50accf677b4989571852b3c5ec98e7a10422fa4c6f37d045a0eec0423a04f8a556f25e9400ba32782f7c80828670cc28213849dfa3e8f

Download Submit
C:\Windows\System\GSdXSYk.exe

Filesize
2.2MB

MD5
dc9994035dae85fb713c996369d43905

SHA1
59f9ba32e75a1ef0fb2b24df98774f68c3725620

SHA256
31ec986715962b3656ad54581f4dac69c9657007f25ccb00d3ad4281c85b84ad

SHA512
e716d61d0b00502d8dbf5d1309cd402d8eb1ba73641cf4e330b43d82ad99933471c2e20d39a5cc6d2bd71ed6d309bc68814c698fecec68897ee3656b9274486d

Download Submit
C:\Windows\System\GoTFHDm.exe

Filesize
2.2MB

MD5
ff15c7cd7874d143f83513ee810d3df6

SHA1
bd1a8228a30266c0e3042b7f5234deb3fd69c7af

SHA256
95789fdf402abfbae06a1e521b3236ea59ea666338d8355916e17f059a38357e

SHA512
9a9fd5dce8d420188f2698be304844a348c5b55e740e63f5597b2e8669eb920fa8e16fbd1a374e5b0268f98507596bd8326238401f01f03be61d2b97a21f134d

Download Submit
C:\Windows\System\ISirtrz.exe

Filesize
2.2MB

MD5
0d1db64c23fd9afdbd3749ae368e9160

SHA1
ef6170c7678ded204d331e73226257e4752fa504

SHA256
a8579bc5271b67c8e51acabdcd7a0f1858534a555e7382b9597e3865dd69be2d

SHA512
10aad2464d74a2a373ce501663c81a79d5ef927f467f9852842819e5a430415e4863c9e995a7111c9759256d4d915938d28209ab8a1592a053908020adaf5e22

Download Submit
C:\Windows\System\Icykbkd.exe

Filesize
2.2MB

MD5
102efa3ccb39c78db8cf1c1f39557df1

SHA1
36663dd787351303883a3b7dba0ad9bd03540702

SHA256
9eff937058e505c7e857fe4e9203de6ce8ef91b5e891221150ae68949e0ba757

SHA512
fc1820bfb708d36c7e0d28448ebf401313661b429ad0fdfa320f908bc7fc4698768323911688d833d5a2c2f06646c5ee4329880cfb5aa4affee110d5bee10500

Download Submit
C:\Windows\System\JaJUHnN.exe

Filesize
2.2MB

MD5
2ff5f4c617dbee07c0c92bb33274b33e

SHA1
c08fcc9ebc3a803402b7e42c458b790e1728fc49

SHA256
ce772e28c7be98b9d6aed430a10399089cc7bd373a1551e9696c8fc6e6017989

SHA512
2d5a06c0c0752da2a0e355e91e7d9d6bf708f7bdbe908927802bb4bf2497d7dca1a51b353b760d8899e87f221bce58330c0cb16cf0c2f7b438ec5283d550153b

Download Submit
C:\Windows\System\LatlxNT.exe

Filesize
2.2MB

MD5
e23bf5cd3e6a4c0e73a0bb784a5f7d34

SHA1
5ac44adf6af7d710f55e1c0a74aaa6fd519be06d

SHA256
c54cceeceab3f63ab8b66ee0c9e67c962fee27e8d4c3a8447a0fc307c9cce1fb

SHA512
e908e260c404e38a7df79347382ef6bd41eff14b6fa5377d3d9d152d5dc50cf9121e5f65e74395bf8255875f4e57a0c7dff95a765e3634c695ef1313ca6b558d

Download Submit
C:\Windows\System\LmUQBxR.exe

Filesize
2.2MB

MD5
dc9b82600e0993e2fc1c2dc32699b447

SHA1
f1fb9e4205b5324e4304a90c23cd23c7b1b31392

SHA256
57e49a1063e98282e7ce5386ca1576f36e660925f47b5840015f647adc8da9db

SHA512
f46b9ac527cd1fd5ce802902bfd5b9d52f68d5a27494abdaca46f7234b756fd973066b11d6cff6d21d7dbfad90e1f1647f43cfd24193483e25616b172489b309

Download Submit
C:\Windows\System\MQHdFze.exe

Filesize
2.2MB

MD5
6b5c144d9b87a1d956e4459ccfe5e64e

SHA1
fa234676224a7ec8b3d89650e1d100a8495d01d0

SHA256
910ce2a95704ec8da25a51c3b92f684c5d5815555c09963c6ee8a818b6fc9c88

SHA512
8a787c54a52043e2c72ddde42cea6bcfb6745c14080f2ad80e8e4a6a63c70ec6c6c6e3495a5f1d36b8d6d88e3b9d4ff733d402ecdb089e06be4ec53af0fe7efc

Download Submit
C:\Windows\System\PAqcOlS.exe

Filesize
2.2MB

MD5
fe5ebddd55226caad254adb519d446a7

SHA1
72fbeed257e79a31cc66e0fe7024c24121a37ccb

SHA256
e4f01aa080ddbe2508972d28ba42e78d0989d8c1ee9a32c0fad044448f996522

SHA512
1cdf925af8d928249015c009394468fe265c9e07e90bfc3fa84c5c988396300227a6572679f6e5c35c0b773b8086bdbbc0b7ad6322d45ee0d1640c3c10a0a495

Download Submit
C:\Windows\System\QDttKPP.exe

Filesize
2.2MB

MD5
fe666d12ee1351ea0fa279066f562445

SHA1
45a9a02a8dd5c723e4314a1eb6f5b16b295260e7

SHA256
bd01346d945dea1d070f6fea9e560400812c1e4a374b76f89016b34a15cb3e02

SHA512
c5f7532f347e485b46c251b5ff5f3a8341009d78db61e7204ed1a4c3cb354c9211292e6e2133d37a9c474a4dcb6480f5620b94f2ef518629004dc096b7239f30

Download Submit
C:\Windows\System\RMQWHJB.exe

Filesize
2.2MB

MD5
d8e327450a1c7b2aae0c75252faecfa6

SHA1
5e373dd5bba70c64fca77d9c43baca315c1f7eef

SHA256
dfc9345e650903aa330283e00c7d88c68b1d5a777a0dd15a6f0a7f2b09f7ddb6

SHA512
0635733e95f588266ff8dab32d93332421ae487a50fab300f7e22ee17ade13e74dcff143956415d31c799f1037a2c591304c04719dc010f4d74be1c8d16f8c1f

Download Submit
C:\Windows\System\RtlNPOl.exe

Filesize
2.2MB

MD5
65ee66a3e8633eb1b49d611254930606

SHA1
5b6dc3aed1d62bb783fd279a92ea7d4c833db66c

SHA256
af7162a9fbe5d6d73a66c9e607be5448c487607b0d633d590764f66191d1dc9c

SHA512
0cd39f79cef6bf39a2af8ea0cf0fef588f8419e883df758e6736d4e9f8a24e332816ab19bacae316bf62076ba5b02c452139c4a45ee4557067b6c08ed13c8ec8

Download Submit
C:\Windows\System\TOLFCfy.exe

Filesize
2.2MB

MD5
0854fcfa8975d8b7e8071f7613773f78

SHA1
464341926ed1e12d1a06691d9baf11b4f84044c3

SHA256
58bd59915d464d0bdcef659aebc931d7b3315332a538e5eece12eff2b47baf66

SHA512
2150f3df9131bd60abe7bace246743962356e99d5a361e2cdc7d25d7075d549e97bc54f3cd7b51fabefe60510e496cba25248f45f28f6953e9078449982788ca

Download Submit
C:\Windows\System\VEIKrFa.exe

Filesize
2.2MB

MD5
ec1d60fe7c45def94546bff1449cf05b

SHA1
a8347b5c5fa5375297ca24c8b0fbe0aee79894f0

SHA256
4dc9432f9ebcc0c1674fa630b24cd8d982b7c91165cf149f100020453b60ae87

SHA512
7f8945796e495718be29a03ffebeed343cc53fe7afef4f510054c45bf2ec1e9c75d219feb264c28d0fa1ecd9bbf3add16ec243353ca565530fc5fe50b1924882

Download Submit
C:\Windows\System\VViSJSx.exe

Filesize
2.2MB

MD5
102b7aaea68e26e5f50e4f49a10f2944

SHA1
4ac0f69e94c22cfdc13dc07b0e13d31f76e68a50

SHA256
8649c716cf41844292124a70ec900bb383cd7800bcc25cca50d72162fb4ae041

SHA512
08cc17757e0b837a6214b9e0a3ca51160ff8da38315cc45e546406a89d0ef4d735f8c910b955fa3f70299c8ab0efcec2735cb47bb0a72f13fdb24839a1841d03

Download Submit
C:\Windows\System\WUtdALX.exe

Filesize
2.2MB

MD5
f1b0c5f5b52de289baa8acfb02f95dc9

SHA1
6a4c2859d286f39de331e55460bc0eb530af05ac

SHA256
a8028e910ab30757c0508250685b96b27197fb71514106207d785535fd3770df

SHA512
cdf38837d7441aa8fe40a87adf2a5fc9bf782e610cfea89711817c7474d65afc301df5ed7cdf6f4711773b93a2849933d2e90e8f2131e56dddc7184f3b3d1cde

Download Submit
C:\Windows\System\ZYNkLVa.exe

Filesize
2.2MB

MD5
2030e16b0efc6eeb751b6c2a8347033c

SHA1
b524f78d714896e5e92a1846e0824e79f41301c5

SHA256
9d5a965ad597fa53db4bff784decac113bb81ae3fb10f483d7d3424e625b83ee

SHA512
3f68b80c87f3a3bb74e6481afb45284332d24df1e890a09e8b875c0477ce734913b5e3ad712ddf4fe3329799dd7c9b3a41b13a4eed0fc3203b03d92029d00d96

Download Submit
C:\Windows\System\avxPxJV.exe

Filesize
2.2MB

MD5
0d13597070a38e81d27caf4cff7e08e5

SHA1
65fcfd2aeb6128390e1e0ace6497eedbf49bea4a

SHA256
2a5ebb18a456ce81023aef5607f0437c5e36025e49c26dd759d5a208d9cc1fda

SHA512
2f436a39f4ae3f5817ef6fdd26e533732c6ab484d462c3e54b36d0bd04fce867269905c1cf907a949354de002abb55b4552df48cca99cfdca949c2d50b463a27

Download Submit
C:\Windows\System\ctnTkKF.exe

Filesize
2.2MB

MD5
00c054e3052181d178b4b0442a68697f

SHA1
f124c7ce8783927ee8dbbcbb7cb6f0a78b0e151d

SHA256
54ee93df031ebb1ad38443c94c0c727ec715d592b9122cb4625d218c1a891e8c

SHA512
22049b813dee2910007e5f6fd0e6d3987e4ee9046c79942e2e216c66fe630cf028cd1cd4b8ce208c99ed28949792e327d25049f89efcd848c4188809b23ad4df

Download Submit
C:\Windows\System\dzIEkiR.exe

Filesize
2.2MB

MD5
77595e6084ba8f26b66aef48e50c2a26

SHA1
2047fabf6314f4da6d8d07f3f93de9e6922cb0a8

SHA256
725bb1c0c451d198aced72d79cc90c1773f98fb2b973ada34d8e7532164954ad

SHA512
22a0eefdf280c3c8bae43635f36c4bbbc0259d2571cea292250be915f3641d3577a6323cbda5b42ff8d1d87a42de79f4c79cd311e30a3b9e188280ec9033bbd9

Download Submit
C:\Windows\System\fUVDTkg.exe

Filesize
2.2MB

MD5
93a34f6897006b88cdb6c2cb71af8b58

SHA1
978dbc626bf2ad927231f33421f28833e5ff9f9e

SHA256
009099c49c3ca5f55cb41ff6a7af4ec7564c27b33bbcd80279adcc3bc699d4b5

SHA512
bc4a410e8cda2498634fd9b348b88a6e9bc21eb92b375843aec0c6243378c680996665e29410df9184fee44fdda69d20616412d36a4cd747f5e9d469f08274c2

Download Submit
C:\Windows\System\fxtyobv.exe

Filesize
2.2MB

MD5
5e956ae32a319585d8dc7ca7207f0c60

SHA1
0b711629f09cb043a12bf8199d1899863ad6069d

SHA256
cb86e1a0e3e17d0e09c942227a975be77616f98be98a8589d9064c6ffdd95fa2

SHA512
b0ef5afa9fd4a0bc82461be3b7f6d20571b33cfab268c5e5cd5c75843b9ff3e06b57bd61725080801f973b2c44517f28456c37eb96468a575407a561ae9e21c5

Download Submit
C:\Windows\System\gqShjNF.exe

Filesize
2.2MB

MD5
6a394077907c20f0c3e049e7d18e51d1

SHA1
e15408b27071767489f4b89efab1a3317eb6bd22

SHA256
77d30ff8a907c695081fa840fda8e388258b6e5031c2cc5ccbb42a3917ba50ab

SHA512
51ec1d90a6d549a4cf06194617915d00cf4824651b984681b216e25aedbd51000ad00a5d27b1079c44eb762bc66e1873c075976486f774c844a5814d5a5565a9

Download Submit
C:\Windows\System\lBpWjIu.exe

Filesize
2.2MB

MD5
0563cc0278ae170b82bf331b48f15e87

SHA1
31a180795d2b378463665638f6b43fa4a6d1bb2a

SHA256
52351c7d375791b56e3eb01b0a8c79b727ffc5d3f9a3b7a7733a131e3bd43d29

SHA512
633b2924e328f2ce960a397606538c20e6b317b0486000b6932ac57ce08ea6453f58aac5ecc8235302dcfb660d3a628e71af35850aa6c05bab9f46e460949800

Download Submit
C:\Windows\System\mWcoVao.exe

Filesize
2.2MB

MD5
a0bdb708768b76aaa4e1ab5305b52727

SHA1
a98c2dc440e4a9215486bd3dbc7cb78f81683e56

SHA256
bae4f7397925e21ceac1911260bea50262e8f5f7f1bcdd4616a2de459f82e376

SHA512
4eb0ff0d916714e829879d0aa9d65520058189817429a6d330c348a63e6037c9b17116176b2748cad77c1b514aa2de76d094dc5a656918e156fadca87be5a775

Download Submit
C:\Windows\System\nGciGrb.exe

Filesize
2.2MB

MD5
efd32f30f87e501572dc7fec1576385b

SHA1
7a0beeb0747be19f16041628d2cd0f0bd45c2bbf

SHA256
8e7b9f487aa2916d7ec8235d2a2678a4d135f5e60d24c549171e5f6ef9f82661

SHA512
a172cfc0966f54b29548bd4548c527ead3b67dbda655de52dec4b4632c00eb1085ec1eec0cdffc43c5e64e99c23b1c05f83de7544bbd45c932df94a145ee7d06

Download Submit
C:\Windows\System\nhhagWV.exe

Filesize
2.2MB

MD5
92f56cce18834bd73f5f713ea6642915

SHA1
7cf1eefa4a42be0536e91959987b3a1a7c9c2d43

SHA256
499e91ae5101c124ac2ce95620980c24f3c5ad0506740aa4837435c7b4e985e7

SHA512
c5633caee021d06a718e5e376f1d3595fc387eaf2341991939085e4f611357586d6dbedcc29099ae994051b2e4f95c0c33546bbf965b71e14361b0163cae49c4

Download Submit
C:\Windows\System\pPeIruk.exe

Filesize
8B

MD5
eaae70bdadb173622a087a8be7d1707d

SHA1
ef7daa6fb2da1ea773d7d2d0cf25965b57200ce1

SHA256
a0d1fe752fbc6eeae3a224169cdb18589cfd9b57a2f3d4f71c29a65344ce4f6a

SHA512
ec8320458adf58e4c18ad5e8e647f76bf87ceea78e9db1f8bd8db2f369c57df6fc9aa8a517f34436071e3c25ed38a30a1ded82b8e45fa863a53cc9ea5266fc32

Download Submit
C:\Windows\System\piKKdUM.exe

Filesize
2.2MB

MD5
91fda6c2a8f1faa95d2f57011fdec44d

SHA1
81c0a9523940f9ad441c5c9932d3c0ef81ebcc1b

SHA256
017486071837c39570978517e8f8baf15095c1cbe0197178610475a35c9ab569

SHA512
ea88d9b8c41dd8d32cdcdc5867b30a0c46b7dd1e52bc88af58047c834aab5697515bea2380f4d8bfc8e678009f580a30f81859c86c01515d4f0b50a445b53241

Download Submit
C:\Windows\System\prlhNrv.exe

Filesize
2.2MB

MD5
f432781bc7c285fd6a3c7020a38677b4

SHA1
1d21fce4ee4902cd419671e062bfd7a7d0e98130

SHA256
cfddf5f15684a807a815ff0472da45c1774626f48cc59bb6dcb836c2460c9454

SHA512
4282890060c53546e4480c224f36061fde558d642d049aaaf997200d8af175a250510c8cc29284f92ee1c2e2ca291e59ad9495b280c5a7b5244783dc7d964a17

Download Submit
C:\Windows\System\rvfYvJj.exe

Filesize
2.2MB

MD5
e01ffe7dddec5eb3943bd4b86da54f10

SHA1
38371f8d03ef1f50f29e69cc177803a997ff6eaa

SHA256
cd6e839030ef50b80323dbf7ef328fbc082b5a1392e36f8f57a892b25fda68dc

SHA512
48f524ffb472fd5c89c60de7565cff0beabf30cbe98a9ce180fc6d1bf6690e87b104a4176d04348a4c6fe07c2b0a9468fad424d9dbcf47a90fbc6e6927c7f46c

Download Submit
C:\Windows\System\taYhuKd.exe

Filesize
2.2MB

MD5
0a906ac2c4746f9a7fe15c01fc9953d3

SHA1
d337f75fdf1cc9dce00c1bfe34e6c0af2863bf05

SHA256
79a04fe0089b8d3a800c45e5488dc2a51a5fb9a163688a2476255584ce2968d1

SHA512
a95fcc62c3d76acd5aca1e86e5f54b6019ee063996ec2379c5c4c67d1ca0376382d74bb8ba24e5f67cbf922abab1b36e1d3694c5cb8d326b840d88a9c75d13c9

Download Submit
C:\Windows\System\zCSLfWY.exe

Filesize
2.2MB

MD5
4825e79b8081264a2d7d37dd96aa477c

SHA1
c3bbff78d9bc647ad2f2267ad5dbea74d2293fc1

SHA256
a9b517daeafd62d951a6587be4f38f7de291af27b0db1a7894cad6963ae2bbc3

SHA512
fab9683d16f3b4c8b1a76e225ef456ff080fb4aac992a9a30c740a2bf9312af642742aea1137f0e6b3d07fb399711e2967149c1e5dbdc0ef23af98f69f737ad6

Download Submit
C:\Windows\System\zQvAPmD.exe

Filesize
2.2MB

MD5
aa9965d2bd400bb8fa54d772319d300e

SHA1
d572c5d34b53c9d60cdc92e2b90a7917f6ada07b

SHA256
60edc5da06a20cb4f3e667825b07150b16645d7e3ee848f1ac5ab10b3a27974d

SHA512
609c369fc4da6d170b87556539db9850219f98558b4d24ddbb902b8d9fdf74c0ccd7d62087936c425c8ae616f8a81a3201812883de142a76d39e95c0468ea0fd

Download Submit
memory/376-285-0x00007FF7EE140000-0x00007FF7EE532000-memory.dmp

Filesize
3.9MB

Download
memory/376-3459-0x00007FF7EE140000-0x00007FF7EE532000-memory.dmp

Filesize
3.9MB

Download
memory/1180-343-0x00007FF736AC0000-0x00007FF736EB2000-memory.dmp

Filesize
3.9MB

Download
memory/1180-3466-0x00007FF736AC0000-0x00007FF736EB2000-memory.dmp

Filesize
3.9MB

Download
memory/1224-3409-0x00007FF658860000-0x00007FF658C52000-memory.dmp

Filesize
3.9MB

Download
memory/1224-227-0x00007FF658860000-0x00007FF658C52000-memory.dmp

Filesize
3.9MB

Download
memory/1368-345-0x00007FF67D3A0000-0x00007FF67D792000-memory.dmp

Filesize
3.9MB

Download
memory/1448-0-0x00007FF7AA1E0000-0x00007FF7AA5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1448-1-0x000002088E0B0000-0x000002088E0C0000-memory.dmp

Filesize
64KB

Download
memory/1492-3448-0x00007FF754BF0000-0x00007FF754FE2000-memory.dmp

Filesize
3.9MB

Download
memory/1492-340-0x00007FF754BF0000-0x00007FF754FE2000-memory.dmp

Filesize
3.9MB

Download
memory/1584-361-0x00007FF7211E0000-0x00007FF7215D2000-memory.dmp

Filesize
3.9MB

Download
memory/1584-3588-0x00007FF7211E0000-0x00007FF7215D2000-memory.dmp

Filesize
3.9MB

Download
memory/1716-236-0x00007FF7022C0000-0x00007FF7026B2000-memory.dmp

Filesize
3.9MB

Download
memory/1716-3416-0x00007FF7022C0000-0x00007FF7026B2000-memory.dmp

Filesize
3.9MB

Download
memory/2016-358-0x00007FF63B890000-0x00007FF63BC82000-memory.dmp

Filesize
3.9MB

Download
memory/2172-348-0x00007FF707080000-0x00007FF707472000-memory.dmp

Filesize
3.9MB

Download
memory/2172-3540-0x00007FF707080000-0x00007FF707472000-memory.dmp

Filesize
3.9MB

Download
memory/2412-351-0x00007FF7B3FD0000-0x00007FF7B43C2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-3499-0x00007FF7B3FD0000-0x00007FF7B43C2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-3444-0x00007FF6D8F60000-0x00007FF6D9352000-memory.dmp

Filesize
3.9MB

Download
memory/2652-359-0x00007FF6D8F60000-0x00007FF6D9352000-memory.dmp

Filesize
3.9MB

Download
memory/2716-334-0x00007FF74D630000-0x00007FF74DA22000-memory.dmp

Filesize
3.9MB

Download
memory/2716-3476-0x00007FF74D630000-0x00007FF74DA22000-memory.dmp

Filesize
3.9MB

Download
memory/2756-31-0x00007FF736EE0000-0x00007FF7372D2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-349-0x00007FF63FC40000-0x00007FF640032000-memory.dmp

Filesize
3.9MB

Download
memory/2984-3488-0x00007FF63FC40000-0x00007FF640032000-memory.dmp

Filesize
3.9MB

Download
memory/3120-297-0x00007FF6F4F70000-0x00007FF6F5362000-memory.dmp

Filesize
3.9MB

Download
memory/3120-3445-0x00007FF6F4F70000-0x00007FF6F5362000-memory.dmp

Filesize
3.9MB

Download
memory/3432-3491-0x00007FF62E1F0000-0x00007FF62E5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3432-320-0x00007FF62E1F0000-0x00007FF62E5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3496-93-0x00007FF945240000-0x00007FF945D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-180-0x00007FF945240000-0x00007FF945D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-4838-0x00007FF945240000-0x00007FF945D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-4822-0x00007FF945243000-0x00007FF945245000-memory.dmp

Filesize
8KB

Download
memory/3496-242-0x0000010B56FC0000-0x0000010B56FE2000-memory.dmp

Filesize
136KB

Download
memory/3496-362-0x0000010B71E30000-0x0000010B725D6000-memory.dmp

Filesize
7.6MB

Download
memory/3496-5-0x00007FF945243000-0x00007FF945245000-memory.dmp

Filesize
8KB

Download
memory/3676-226-0x00007FF6189D0000-0x00007FF618DC2000-memory.dmp

Filesize
3.9MB

Download
memory/3760-3546-0x00007FF624860000-0x00007FF624C52000-memory.dmp

Filesize
3.9MB

Download
memory/3760-347-0x00007FF624860000-0x00007FF624C52000-memory.dmp

Filesize
3.9MB

Download
memory/3904-3592-0x00007FF699CA0000-0x00007FF69A092000-memory.dmp

Filesize
3.9MB

Download
memory/3904-352-0x00007FF699CA0000-0x00007FF69A092000-memory.dmp

Filesize
3.9MB

Download
memory/4160-3471-0x00007FF67E170000-0x00007FF67E562000-memory.dmp

Filesize
3.9MB

Download
memory/4160-344-0x00007FF67E170000-0x00007FF67E562000-memory.dmp

Filesize
3.9MB

Download
memory/4616-350-0x00007FF68A700000-0x00007FF68AAF2000-memory.dmp

Filesize
3.9MB

Download
memory/4616-3485-0x00007FF68A700000-0x00007FF68AAF2000-memory.dmp

Filesize
3.9MB

Download
memory/5064-300-0x00007FF688D80000-0x00007FF689172000-memory.dmp

Filesize
3.9MB

Download
memory/5064-3426-0x00007FF688D80000-0x00007FF689172000-memory.dmp

Filesize
3.9MB

Download
memory/5084-3452-0x00007FF78F1E0000-0x00007FF78F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-253-0x00007FF78F1E0000-0x00007FF78F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-3521-0x00007FF723AE0000-0x00007FF723ED2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-346-0x00007FF723AE0000-0x00007FF723ED2000-memory.dmp

Filesize
3.9MB

Download