xmrig | be754d07eddbeb2381c2de36e8e7d2494d8a577f470835b6f1906a821d0001b3

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2073c3c663c49621a85d15b7c79da420N.exe
Size

1.5MB
MD5

2073c3c663c49621a85d15b7c79da420
SHA1

cf3ab224f0b76684841250333b22f567135cf8c8
SHA256

be754d07eddbeb2381c2de36e8e7d2494d8a577f470835b6f1906a821d0001b3
SHA512

4c8049bfe383af8e517c74be10f759b34ced7c98367d92e445c59aa8a9005882cc620058abdc5a15b1478d37e2665f89b78df1c9de7e4b2a304d9df15959bec3
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZrV5GgCzxcMf8SZPviLoIo:Lz071uv4BPMkyW10/w16BWgac2zco

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/4488-47-0x00007FF73C8E0000-0x00007FF73CCD2000-memory.dmp	xmrig
behavioral2/memory/4188-64-0x00007FF6B23F0000-0x00007FF6B27E2000-memory.dmp	xmrig
behavioral2/memory/4256-68-0x00007FF6E1EE0000-0x00007FF6E22D2000-memory.dmp	xmrig
behavioral2/memory/2432-78-0x00007FF75DFF0000-0x00007FF75E3E2000-memory.dmp	xmrig
behavioral2/memory/4316-85-0x00007FF608100000-0x00007FF6084F2000-memory.dmp	xmrig
behavioral2/memory/1624-123-0x00007FF70DAE0000-0x00007FF70DED2000-memory.dmp	xmrig
behavioral2/memory/2600-178-0x00007FF7B2580000-0x00007FF7B2972000-memory.dmp	xmrig
behavioral2/memory/548-172-0x00007FF6D2750000-0x00007FF6D2B42000-memory.dmp	xmrig
behavioral2/memory/2392-166-0x00007FF7273E0000-0x00007FF7277D2000-memory.dmp	xmrig
behavioral2/memory/3660-154-0x00007FF7F3000000-0x00007FF7F33F2000-memory.dmp	xmrig
behavioral2/memory/1744-127-0x00007FF76BB00000-0x00007FF76BEF2000-memory.dmp	xmrig
behavioral2/memory/4832-106-0x00007FF7968F0000-0x00007FF796CE2000-memory.dmp	xmrig
behavioral2/memory/1796-81-0x00007FF6271A0000-0x00007FF627592000-memory.dmp	xmrig
behavioral2/memory/1088-77-0x00007FF7E1320000-0x00007FF7E1712000-memory.dmp	xmrig
behavioral2/memory/2412-76-0x00007FF6FF730000-0x00007FF6FFB22000-memory.dmp	xmrig
behavioral2/memory/2868-73-0x00007FF6E8AA0000-0x00007FF6E8E92000-memory.dmp	xmrig
behavioral2/memory/3372-70-0x00007FF6E1380000-0x00007FF6E1772000-memory.dmp	xmrig
behavioral2/memory/2028-60-0x00007FF66E060000-0x00007FF66E452000-memory.dmp	xmrig
behavioral2/memory/2868-2040-0x00007FF6E8AA0000-0x00007FF6E8E92000-memory.dmp	xmrig
behavioral2/memory/4748-2501-0x00007FF60F100000-0x00007FF60F4F2000-memory.dmp	xmrig
behavioral2/memory/3624-2507-0x00007FF6D9A70000-0x00007FF6D9E62000-memory.dmp	xmrig
behavioral2/memory/4460-2597-0x00007FF7BCFD0000-0x00007FF7BD3C2000-memory.dmp	xmrig
behavioral2/memory/3480-2598-0x00007FF689030000-0x00007FF689422000-memory.dmp	xmrig
behavioral2/memory/4128-2599-0x00007FF66A570000-0x00007FF66A962000-memory.dmp	xmrig
behavioral2/memory/2028-2698-0x00007FF66E060000-0x00007FF66E452000-memory.dmp	xmrig
behavioral2/memory/4256-2704-0x00007FF6E1EE0000-0x00007FF6E22D2000-memory.dmp	xmrig
behavioral2/memory/3372-2716-0x00007FF6E1380000-0x00007FF6E1772000-memory.dmp	xmrig
behavioral2/memory/2432-2722-0x00007FF75DFF0000-0x00007FF75E3E2000-memory.dmp	xmrig
behavioral2/memory/1796-2728-0x00007FF6271A0000-0x00007FF627592000-memory.dmp	xmrig
behavioral2/memory/4316-2736-0x00007FF608100000-0x00007FF6084F2000-memory.dmp	xmrig
behavioral2/memory/2868-2751-0x00007FF6E8AA0000-0x00007FF6E8E92000-memory.dmp	xmrig
behavioral2/memory/4748-2769-0x00007FF60F100000-0x00007FF60F4F2000-memory.dmp	xmrig
behavioral2/memory/4832-2772-0x00007FF7968F0000-0x00007FF796CE2000-memory.dmp	xmrig
behavioral2/memory/3480-2802-0x00007FF689030000-0x00007FF689422000-memory.dmp	xmrig
behavioral2/memory/2600-2832-0x00007FF7B2580000-0x00007FF7B2972000-memory.dmp	xmrig
behavioral2/memory/2392-2828-0x00007FF7273E0000-0x00007FF7277D2000-memory.dmp	xmrig
behavioral2/memory/3660-2825-0x00007FF7F3000000-0x00007FF7F33F2000-memory.dmp	xmrig
behavioral2/memory/4128-2812-0x00007FF66A570000-0x00007FF66A962000-memory.dmp	xmrig
behavioral2/memory/4460-2798-0x00007FF7BCFD0000-0x00007FF7BD3C2000-memory.dmp	xmrig
behavioral2/memory/1624-2781-0x00007FF70DAE0000-0x00007FF70DED2000-memory.dmp	xmrig
behavioral2/memory/1744-2779-0x00007FF76BB00000-0x00007FF76BEF2000-memory.dmp	xmrig
behavioral2/memory/1088-2708-0x00007FF7E1320000-0x00007FF7E1712000-memory.dmp	xmrig
behavioral2/memory/4188-2696-0x00007FF6B23F0000-0x00007FF6B27E2000-memory.dmp	xmrig
behavioral2/memory/2412-2691-0x00007FF6FF730000-0x00007FF6FFB22000-memory.dmp	xmrig
behavioral2/memory/4488-2682-0x00007FF73C8E0000-0x00007FF73CCD2000-memory.dmp	xmrig
behavioral2/memory/4660-3543-0x00007FF65B9C0000-0x00007FF65BDB2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	4388	powershell.exe
11	4388	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4388	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4488	OnazxGq.exe
2412	pOuLlew.exe
2028	hJepoRz.exe
4188	gJacllr.exe
4256	qzDDzru.exe
1088	iYsdHXk.exe
3372	unTrdsk.exe
2432	lPKxgOE.exe
2868	jOcWoTQ.exe
1796	rNmdrEw.exe
4316	XkwuWjW.exe
3656	jMNcRrw.exe
4748	DLgdmes.exe
4832	grZOnYL.exe
1624	gPBbwnZ.exe
1744	KKvQkzH.exe
4660	XjZdzUj.exe
3624	sfnfsSo.exe
4460	yXLQEZo.exe
3480	cniPGKK.exe
4128	qbBlokQ.exe
3660	SKCRLzT.exe
2392	rmpDRAL.exe
2600	yOkiYUt.exe
2436	uMGLzHV.exe
3968	aEgVGxW.exe
940	qQcWiql.exe
2216	YxNMMCx.exe
428	OramXDB.exe
1792	ixXhDBT.exe
2488	KHLAvqV.exe
3248	oCvuDDX.exe
4160	ydKbWfZ.exe
3560	zsyvdpX.exe
2580	GGNDJcK.exe
4828	BlvdfDx.exe
3632	anKRhXZ.exe
1860	DUcTfLT.exe
4920	QFIMgFz.exe
4024	UlsQmpT.exe
2144	tHxiUJl.exe
1264	HtxYYZe.exe
1052	hOvpvYh.exe
4296	MwEuoLR.exe
2760	GhlhaIJ.exe
2256	jUqOJjU.exe
2000	pWqVuYi.exe
1384	ziSRvkv.exe
3540	UZczTZM.exe
5116	UNungCN.exe
1536	uObUKzK.exe
3512	zRvHDRn.exe
1444	QlWVMCN.exe
1480	ADxxOjV.exe
764	rSeIOMV.exe
1920	rIYWOQi.exe
772	rpJVcyv.exe
2500	QdAMRsI.exe
2460	RDxFRQw.exe
4376	JWKNsfz.exe
2940	EypxCqI.exe
680	aFohMSX.exe
4696	oDUrcrA.exe
4516	fdAgdGI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/548-0-0x00007FF6D2750000-0x00007FF6D2B42000-memory.dmp	upx
behavioral2/files/0x0009000000023437-6.dat	upx
behavioral2/files/0x000700000002343d-17.dat	upx
behavioral2/files/0x000700000002343b-18.dat	upx
behavioral2/memory/4488-47-0x00007FF73C8E0000-0x00007FF73CCD2000-memory.dmp	upx
behavioral2/files/0x0007000000023441-52.dat	upx
behavioral2/files/0x0007000000023444-57.dat	upx
behavioral2/memory/4188-64-0x00007FF6B23F0000-0x00007FF6B27E2000-memory.dmp	upx
behavioral2/memory/4256-68-0x00007FF6E1EE0000-0x00007FF6E22D2000-memory.dmp	upx
behavioral2/files/0x0008000000023443-71.dat	upx
behavioral2/files/0x0007000000023445-74.dat	upx
behavioral2/memory/2432-78-0x00007FF75DFF0000-0x00007FF75E3E2000-memory.dmp	upx
behavioral2/files/0x0008000000023442-82.dat	upx
behavioral2/memory/4316-85-0x00007FF608100000-0x00007FF6084F2000-memory.dmp	upx
behavioral2/files/0x0007000000023446-93.dat	upx
behavioral2/files/0x0007000000023448-115.dat	upx
behavioral2/memory/1624-123-0x00007FF70DAE0000-0x00007FF70DED2000-memory.dmp	upx
behavioral2/memory/4460-131-0x00007FF7BCFD0000-0x00007FF7BD3C2000-memory.dmp	upx
behavioral2/files/0x000700000002344e-149.dat	upx
behavioral2/files/0x0007000000023451-157.dat	upx
behavioral2/memory/2600-178-0x00007FF7B2580000-0x00007FF7B2972000-memory.dmp	upx
behavioral2/files/0x0007000000023459-201.dat	upx
behavioral2/files/0x0007000000023457-199.dat	upx
behavioral2/files/0x0007000000023458-196.dat	upx
behavioral2/files/0x0007000000023456-194.dat	upx
behavioral2/files/0x0007000000023455-189.dat	upx
behavioral2/files/0x0007000000023454-184.dat	upx
behavioral2/files/0x0007000000023453-179.dat	upx
behavioral2/files/0x0007000000023452-173.dat	upx
behavioral2/memory/548-172-0x00007FF6D2750000-0x00007FF6D2B42000-memory.dmp	upx
behavioral2/memory/2392-166-0x00007FF7273E0000-0x00007FF7277D2000-memory.dmp	upx
behavioral2/files/0x0007000000023450-160.dat	upx
behavioral2/files/0x000700000002344f-155.dat	upx
behavioral2/memory/3660-154-0x00007FF7F3000000-0x00007FF7F33F2000-memory.dmp	upx
behavioral2/memory/4128-148-0x00007FF66A570000-0x00007FF66A962000-memory.dmp	upx
behavioral2/files/0x000700000002344d-143.dat	upx
behavioral2/memory/3480-142-0x00007FF689030000-0x00007FF689422000-memory.dmp	upx
behavioral2/files/0x000700000002344c-137.dat	upx
behavioral2/files/0x000700000002344b-132.dat	upx
behavioral2/memory/1744-127-0x00007FF76BB00000-0x00007FF76BEF2000-memory.dmp	upx
behavioral2/files/0x000700000002344a-119.dat	upx
behavioral2/files/0x0007000000023449-117.dat	upx
behavioral2/memory/3624-114-0x00007FF6D9A70000-0x00007FF6D9E62000-memory.dmp	upx
behavioral2/memory/4660-113-0x00007FF65B9C0000-0x00007FF65BDB2000-memory.dmp	upx
behavioral2/files/0x0007000000023447-111.dat	upx
behavioral2/memory/4832-106-0x00007FF7968F0000-0x00007FF796CE2000-memory.dmp	upx
behavioral2/files/0x0009000000023438-98.dat	upx
behavioral2/memory/4748-96-0x00007FF60F100000-0x00007FF60F4F2000-memory.dmp	upx
behavioral2/memory/3656-89-0x00007FF76D2C0000-0x00007FF76D6B2000-memory.dmp	upx
behavioral2/memory/1796-81-0x00007FF6271A0000-0x00007FF627592000-memory.dmp	upx
behavioral2/memory/1088-77-0x00007FF7E1320000-0x00007FF7E1712000-memory.dmp	upx
behavioral2/memory/2412-76-0x00007FF6FF730000-0x00007FF6FFB22000-memory.dmp	upx
behavioral2/memory/2868-73-0x00007FF6E8AA0000-0x00007FF6E8E92000-memory.dmp	upx
behavioral2/memory/3372-70-0x00007FF6E1380000-0x00007FF6E1772000-memory.dmp	upx
behavioral2/memory/2028-60-0x00007FF66E060000-0x00007FF66E452000-memory.dmp	upx
behavioral2/files/0x0007000000023440-50.dat	upx
behavioral2/files/0x000700000002343f-36.dat	upx
behavioral2/files/0x000700000002343e-34.dat	upx
behavioral2/files/0x000700000002343c-21.dat	upx
behavioral2/memory/2868-2040-0x00007FF6E8AA0000-0x00007FF6E8E92000-memory.dmp	upx
behavioral2/memory/4748-2501-0x00007FF60F100000-0x00007FF60F4F2000-memory.dmp	upx
behavioral2/memory/3624-2507-0x00007FF6D9A70000-0x00007FF6D9E62000-memory.dmp	upx
behavioral2/memory/4460-2597-0x00007FF7BCFD0000-0x00007FF7BD3C2000-memory.dmp	upx
behavioral2/memory/3480-2598-0x00007FF689030000-0x00007FF689422000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ODGElSb.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\LzyjEYe.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\xYKxYbK.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\AHhCjHv.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\CbuFOVG.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\wyJreQR.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\GhlhaIJ.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\dwJkaWV.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\yEbrqhR.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\CjoPdna.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\XkwuWjW.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\bWabHkY.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\WldxaaL.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\DKYUbsE.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\QUcOMMe.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\SraCETR.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\zDvEymB.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\xUiuhId.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\IqZOCDp.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\GynAoUG.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\JcTVJwR.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\cfjgvkA.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\oLHMFQv.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\VHECYpm.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\eaMolUa.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\FOVEmkV.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\oanMGGS.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\uMGLzHV.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\LYgkurm.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\yFwSpnl.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\UlsQmpT.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\VfyBuxg.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\uQBBQLO.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\AhKppKI.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\WSPHTZz.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\ReWqLfx.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\muLCvhe.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\kUElXeq.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\AgFXvbF.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\GlIoIJe.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\zFeaxGA.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\ptXaWjv.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\qTxrLmO.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\AhpDNOm.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\mvjYUpQ.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\HtxYYZe.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\AVhlwdC.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\iSKVmNY.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\UWyPoWt.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\tapJFEm.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\izbUmAF.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\iYsdHXk.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\KjnTiKM.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\unuXawT.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\imfKlCq.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\cJfZDTR.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\HGCwJdh.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\ODnxRQw.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\OUPvXsO.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\ePhNthB.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\ewNfeHP.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\DmlVCxh.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\NkSRiUW.exe	2073c3c663c49621a85d15b7c79da420N.exe
File created	C:\Windows\System\GGAToko.exe	2073c3c663c49621a85d15b7c79da420N.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4388	powershell.exe
4388	powershell.exe
4388	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	548	2073c3c663c49621a85d15b7c79da420N.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeLockMemoryPrivilege	548	2073c3c663c49621a85d15b7c79da420N.exe
Token: SeCreateGlobalPrivilege	7604	dwm.exe
Token: SeChangeNotifyPrivilege	7604	dwm.exe
Token: 33	7604	dwm.exe
Token: SeIncBasePriorityPrivilege	7604	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 4388	548	2073c3c663c49621a85d15b7c79da420N.exe	85
PID 548 wrote to memory of 4388	548	2073c3c663c49621a85d15b7c79da420N.exe	85
PID 548 wrote to memory of 4488	548	2073c3c663c49621a85d15b7c79da420N.exe	86
PID 548 wrote to memory of 4488	548	2073c3c663c49621a85d15b7c79da420N.exe	86
PID 548 wrote to memory of 2412	548	2073c3c663c49621a85d15b7c79da420N.exe	87
PID 548 wrote to memory of 2412	548	2073c3c663c49621a85d15b7c79da420N.exe	87
PID 548 wrote to memory of 2028	548	2073c3c663c49621a85d15b7c79da420N.exe	88
PID 548 wrote to memory of 2028	548	2073c3c663c49621a85d15b7c79da420N.exe	88
PID 548 wrote to memory of 4188	548	2073c3c663c49621a85d15b7c79da420N.exe	89
PID 548 wrote to memory of 4188	548	2073c3c663c49621a85d15b7c79da420N.exe	89
PID 548 wrote to memory of 4256	548	2073c3c663c49621a85d15b7c79da420N.exe	90
PID 548 wrote to memory of 4256	548	2073c3c663c49621a85d15b7c79da420N.exe	90
PID 548 wrote to memory of 1088	548	2073c3c663c49621a85d15b7c79da420N.exe	91
PID 548 wrote to memory of 1088	548	2073c3c663c49621a85d15b7c79da420N.exe	91
PID 548 wrote to memory of 3372	548	2073c3c663c49621a85d15b7c79da420N.exe	92
PID 548 wrote to memory of 3372	548	2073c3c663c49621a85d15b7c79da420N.exe	92
PID 548 wrote to memory of 2432	548	2073c3c663c49621a85d15b7c79da420N.exe	93
PID 548 wrote to memory of 2432	548	2073c3c663c49621a85d15b7c79da420N.exe	93
PID 548 wrote to memory of 2868	548	2073c3c663c49621a85d15b7c79da420N.exe	94
PID 548 wrote to memory of 2868	548	2073c3c663c49621a85d15b7c79da420N.exe	94
PID 548 wrote to memory of 1796	548	2073c3c663c49621a85d15b7c79da420N.exe	95
PID 548 wrote to memory of 1796	548	2073c3c663c49621a85d15b7c79da420N.exe	95
PID 548 wrote to memory of 4316	548	2073c3c663c49621a85d15b7c79da420N.exe	96
PID 548 wrote to memory of 4316	548	2073c3c663c49621a85d15b7c79da420N.exe	96
PID 548 wrote to memory of 3656	548	2073c3c663c49621a85d15b7c79da420N.exe	97
PID 548 wrote to memory of 3656	548	2073c3c663c49621a85d15b7c79da420N.exe	97
PID 548 wrote to memory of 4748	548	2073c3c663c49621a85d15b7c79da420N.exe	98
PID 548 wrote to memory of 4748	548	2073c3c663c49621a85d15b7c79da420N.exe	98
PID 548 wrote to memory of 4832	548	2073c3c663c49621a85d15b7c79da420N.exe	99
PID 548 wrote to memory of 4832	548	2073c3c663c49621a85d15b7c79da420N.exe	99
PID 548 wrote to memory of 1624	548	2073c3c663c49621a85d15b7c79da420N.exe	100
PID 548 wrote to memory of 1624	548	2073c3c663c49621a85d15b7c79da420N.exe	100
PID 548 wrote to memory of 1744	548	2073c3c663c49621a85d15b7c79da420N.exe	101
PID 548 wrote to memory of 1744	548	2073c3c663c49621a85d15b7c79da420N.exe	101
PID 548 wrote to memory of 4660	548	2073c3c663c49621a85d15b7c79da420N.exe	102
PID 548 wrote to memory of 4660	548	2073c3c663c49621a85d15b7c79da420N.exe	102
PID 548 wrote to memory of 3624	548	2073c3c663c49621a85d15b7c79da420N.exe	103
PID 548 wrote to memory of 3624	548	2073c3c663c49621a85d15b7c79da420N.exe	103
PID 548 wrote to memory of 4460	548	2073c3c663c49621a85d15b7c79da420N.exe	104
PID 548 wrote to memory of 4460	548	2073c3c663c49621a85d15b7c79da420N.exe	104
PID 548 wrote to memory of 3480	548	2073c3c663c49621a85d15b7c79da420N.exe	105
PID 548 wrote to memory of 3480	548	2073c3c663c49621a85d15b7c79da420N.exe	105
PID 548 wrote to memory of 4128	548	2073c3c663c49621a85d15b7c79da420N.exe	106
PID 548 wrote to memory of 4128	548	2073c3c663c49621a85d15b7c79da420N.exe	106
PID 548 wrote to memory of 3660	548	2073c3c663c49621a85d15b7c79da420N.exe	107
PID 548 wrote to memory of 3660	548	2073c3c663c49621a85d15b7c79da420N.exe	107
PID 548 wrote to memory of 2392	548	2073c3c663c49621a85d15b7c79da420N.exe	108
PID 548 wrote to memory of 2392	548	2073c3c663c49621a85d15b7c79da420N.exe	108
PID 548 wrote to memory of 2600	548	2073c3c663c49621a85d15b7c79da420N.exe	109
PID 548 wrote to memory of 2600	548	2073c3c663c49621a85d15b7c79da420N.exe	109
PID 548 wrote to memory of 2436	548	2073c3c663c49621a85d15b7c79da420N.exe	110
PID 548 wrote to memory of 2436	548	2073c3c663c49621a85d15b7c79da420N.exe	110
PID 548 wrote to memory of 3968	548	2073c3c663c49621a85d15b7c79da420N.exe	111
PID 548 wrote to memory of 3968	548	2073c3c663c49621a85d15b7c79da420N.exe	111
PID 548 wrote to memory of 940	548	2073c3c663c49621a85d15b7c79da420N.exe	112
PID 548 wrote to memory of 940	548	2073c3c663c49621a85d15b7c79da420N.exe	112
PID 548 wrote to memory of 2216	548	2073c3c663c49621a85d15b7c79da420N.exe	113
PID 548 wrote to memory of 2216	548	2073c3c663c49621a85d15b7c79da420N.exe	113
PID 548 wrote to memory of 428	548	2073c3c663c49621a85d15b7c79da420N.exe	114
PID 548 wrote to memory of 428	548	2073c3c663c49621a85d15b7c79da420N.exe	114
PID 548 wrote to memory of 1792	548	2073c3c663c49621a85d15b7c79da420N.exe	115
PID 548 wrote to memory of 1792	548	2073c3c663c49621a85d15b7c79da420N.exe	115
PID 548 wrote to memory of 2488	548	2073c3c663c49621a85d15b7c79da420N.exe	116
PID 548 wrote to memory of 2488	548	2073c3c663c49621a85d15b7c79da420N.exe	116

C:\Users\Admin\AppData\Local\Temp\2073c3c663c49621a85d15b7c79da420N.exe
"C:\Users\Admin\AppData\Local\Temp\2073c3c663c49621a85d15b7c79da420N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4388" "2940" "2872" "2944" "0" "0" "2948" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13200
- C:\Windows\System\OnazxGq.exe
  C:\Windows\System\OnazxGq.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\pOuLlew.exe
  C:\Windows\System\pOuLlew.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\hJepoRz.exe
  C:\Windows\System\hJepoRz.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\gJacllr.exe
  C:\Windows\System\gJacllr.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\qzDDzru.exe
  C:\Windows\System\qzDDzru.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\iYsdHXk.exe
  C:\Windows\System\iYsdHXk.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\unTrdsk.exe
  C:\Windows\System\unTrdsk.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\lPKxgOE.exe
  C:\Windows\System\lPKxgOE.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\jOcWoTQ.exe
  C:\Windows\System\jOcWoTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\rNmdrEw.exe
  C:\Windows\System\rNmdrEw.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\XkwuWjW.exe
  C:\Windows\System\XkwuWjW.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\jMNcRrw.exe
  C:\Windows\System\jMNcRrw.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\DLgdmes.exe
  C:\Windows\System\DLgdmes.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\grZOnYL.exe
  C:\Windows\System\grZOnYL.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\gPBbwnZ.exe
  C:\Windows\System\gPBbwnZ.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\KKvQkzH.exe
  C:\Windows\System\KKvQkzH.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\XjZdzUj.exe
  C:\Windows\System\XjZdzUj.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\sfnfsSo.exe
  C:\Windows\System\sfnfsSo.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\yXLQEZo.exe
  C:\Windows\System\yXLQEZo.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\cniPGKK.exe
  C:\Windows\System\cniPGKK.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\qbBlokQ.exe
  C:\Windows\System\qbBlokQ.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\SKCRLzT.exe
  C:\Windows\System\SKCRLzT.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\rmpDRAL.exe
  C:\Windows\System\rmpDRAL.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\yOkiYUt.exe
  C:\Windows\System\yOkiYUt.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\uMGLzHV.exe
  C:\Windows\System\uMGLzHV.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\aEgVGxW.exe
  C:\Windows\System\aEgVGxW.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\qQcWiql.exe
  C:\Windows\System\qQcWiql.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\YxNMMCx.exe
  C:\Windows\System\YxNMMCx.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\OramXDB.exe
  C:\Windows\System\OramXDB.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\ixXhDBT.exe
  C:\Windows\System\ixXhDBT.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\KHLAvqV.exe
  C:\Windows\System\KHLAvqV.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\oCvuDDX.exe
  C:\Windows\System\oCvuDDX.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\ydKbWfZ.exe
  C:\Windows\System\ydKbWfZ.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\zsyvdpX.exe
  C:\Windows\System\zsyvdpX.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\GGNDJcK.exe
  C:\Windows\System\GGNDJcK.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\BlvdfDx.exe
  C:\Windows\System\BlvdfDx.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\anKRhXZ.exe
  C:\Windows\System\anKRhXZ.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\DUcTfLT.exe
  C:\Windows\System\DUcTfLT.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\QFIMgFz.exe
  C:\Windows\System\QFIMgFz.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\UlsQmpT.exe
  C:\Windows\System\UlsQmpT.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\tHxiUJl.exe
  C:\Windows\System\tHxiUJl.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\HtxYYZe.exe
  C:\Windows\System\HtxYYZe.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\hOvpvYh.exe
  C:\Windows\System\hOvpvYh.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\MwEuoLR.exe
  C:\Windows\System\MwEuoLR.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\GhlhaIJ.exe
  C:\Windows\System\GhlhaIJ.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\jUqOJjU.exe
  C:\Windows\System\jUqOJjU.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\pWqVuYi.exe
  C:\Windows\System\pWqVuYi.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\ziSRvkv.exe
  C:\Windows\System\ziSRvkv.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\UZczTZM.exe
  C:\Windows\System\UZczTZM.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\UNungCN.exe
  C:\Windows\System\UNungCN.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\uObUKzK.exe
  C:\Windows\System\uObUKzK.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\zRvHDRn.exe
  C:\Windows\System\zRvHDRn.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\QlWVMCN.exe
  C:\Windows\System\QlWVMCN.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\ADxxOjV.exe
  C:\Windows\System\ADxxOjV.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\rSeIOMV.exe
  C:\Windows\System\rSeIOMV.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\rIYWOQi.exe
  C:\Windows\System\rIYWOQi.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\rpJVcyv.exe
  C:\Windows\System\rpJVcyv.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\QdAMRsI.exe
  C:\Windows\System\QdAMRsI.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\RDxFRQw.exe
  C:\Windows\System\RDxFRQw.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\JWKNsfz.exe
  C:\Windows\System\JWKNsfz.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\EypxCqI.exe
  C:\Windows\System\EypxCqI.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\aFohMSX.exe
  C:\Windows\System\aFohMSX.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\oDUrcrA.exe
  C:\Windows\System\oDUrcrA.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\fdAgdGI.exe
  C:\Windows\System\fdAgdGI.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\dwJkaWV.exe
  C:\Windows\System\dwJkaWV.exe
  2⤵
  PID:3848
- C:\Windows\System\LYgkurm.exe
  C:\Windows\System\LYgkurm.exe
  2⤵
  PID:4836
- C:\Windows\System\NRbfCCW.exe
  C:\Windows\System\NRbfCCW.exe
  2⤵
  PID:1532
- C:\Windows\System\FkMfqTE.exe
  C:\Windows\System\FkMfqTE.exe
  2⤵
  PID:2136
- C:\Windows\System\rBKMqds.exe
  C:\Windows\System\rBKMqds.exe
  2⤵
  PID:3088
- C:\Windows\System\cmMSFIL.exe
  C:\Windows\System\cmMSFIL.exe
  2⤵
  PID:3104
- C:\Windows\System\kjsUXDP.exe
  C:\Windows\System\kjsUXDP.exe
  2⤵
  PID:804
- C:\Windows\System\PHuHUch.exe
  C:\Windows\System\PHuHUch.exe
  2⤵
  PID:5136
- C:\Windows\System\fifbjeS.exe
  C:\Windows\System\fifbjeS.exe
  2⤵
  PID:5168
- C:\Windows\System\zDvEymB.exe
  C:\Windows\System\zDvEymB.exe
  2⤵
  PID:5200
- C:\Windows\System\gRwXfHv.exe
  C:\Windows\System\gRwXfHv.exe
  2⤵
  PID:5224
- C:\Windows\System\vxKFjXD.exe
  C:\Windows\System\vxKFjXD.exe
  2⤵
  PID:5252
- C:\Windows\System\EKxpiRU.exe
  C:\Windows\System\EKxpiRU.exe
  2⤵
  PID:5280
- C:\Windows\System\iYMPWIA.exe
  C:\Windows\System\iYMPWIA.exe
  2⤵
  PID:5312
- C:\Windows\System\gtlOIAn.exe
  C:\Windows\System\gtlOIAn.exe
  2⤵
  PID:5336
- C:\Windows\System\fRYUnlN.exe
  C:\Windows\System\fRYUnlN.exe
  2⤵
  PID:5364
- C:\Windows\System\DWZsvXZ.exe
  C:\Windows\System\DWZsvXZ.exe
  2⤵
  PID:5396
- C:\Windows\System\tUoSLbs.exe
  C:\Windows\System\tUoSLbs.exe
  2⤵
  PID:5420
- C:\Windows\System\WkuqqBO.exe
  C:\Windows\System\WkuqqBO.exe
  2⤵
  PID:5448
- C:\Windows\System\XfzystA.exe
  C:\Windows\System\XfzystA.exe
  2⤵
  PID:5476
- C:\Windows\System\WSiMnoz.exe
  C:\Windows\System\WSiMnoz.exe
  2⤵
  PID:5504
- C:\Windows\System\lHTMBPq.exe
  C:\Windows\System\lHTMBPq.exe
  2⤵
  PID:5532
- C:\Windows\System\TtMLunn.exe
  C:\Windows\System\TtMLunn.exe
  2⤵
  PID:5560
- C:\Windows\System\KQvfNic.exe
  C:\Windows\System\KQvfNic.exe
  2⤵
  PID:5588
- C:\Windows\System\jjDeJDD.exe
  C:\Windows\System\jjDeJDD.exe
  2⤵
  PID:5620
- C:\Windows\System\aydPUMK.exe
  C:\Windows\System\aydPUMK.exe
  2⤵
  PID:5644
- C:\Windows\System\aFValaZ.exe
  C:\Windows\System\aFValaZ.exe
  2⤵
  PID:5676
- C:\Windows\System\aJIvWKh.exe
  C:\Windows\System\aJIvWKh.exe
  2⤵
  PID:5700
- C:\Windows\System\qdCckqO.exe
  C:\Windows\System\qdCckqO.exe
  2⤵
  PID:5732
- C:\Windows\System\USgEeJp.exe
  C:\Windows\System\USgEeJp.exe
  2⤵
  PID:5756
- C:\Windows\System\PfkgamK.exe
  C:\Windows\System\PfkgamK.exe
  2⤵
  PID:5784
- C:\Windows\System\vYGzvzl.exe
  C:\Windows\System\vYGzvzl.exe
  2⤵
  PID:5812
- C:\Windows\System\YAAlHaz.exe
  C:\Windows\System\YAAlHaz.exe
  2⤵
  PID:5840
- C:\Windows\System\WmMKvQr.exe
  C:\Windows\System\WmMKvQr.exe
  2⤵
  PID:5868
- C:\Windows\System\StLcxzv.exe
  C:\Windows\System\StLcxzv.exe
  2⤵
  PID:5892
- C:\Windows\System\lXEeslC.exe
  C:\Windows\System\lXEeslC.exe
  2⤵
  PID:5944
- C:\Windows\System\anrEzsD.exe
  C:\Windows\System\anrEzsD.exe
  2⤵
  PID:5964
- C:\Windows\System\xyMSiUD.exe
  C:\Windows\System\xyMSiUD.exe
  2⤵
  PID:5992
- C:\Windows\System\nBQAbdd.exe
  C:\Windows\System\nBQAbdd.exe
  2⤵
  PID:6008
- C:\Windows\System\uFMVvAd.exe
  C:\Windows\System\uFMVvAd.exe
  2⤵
  PID:6036
- C:\Windows\System\FMOeMCi.exe
  C:\Windows\System\FMOeMCi.exe
  2⤵
  PID:6064
- C:\Windows\System\JlBuvii.exe
  C:\Windows\System\JlBuvii.exe
  2⤵
  PID:6088
- C:\Windows\System\ANyyjPe.exe
  C:\Windows\System\ANyyjPe.exe
  2⤵
  PID:6116
- C:\Windows\System\hVXWYJH.exe
  C:\Windows\System\hVXWYJH.exe
  2⤵
  PID:4152
- C:\Windows\System\gsmfLkL.exe
  C:\Windows\System\gsmfLkL.exe
  2⤵
  PID:4320
- C:\Windows\System\VfyBuxg.exe
  C:\Windows\System\VfyBuxg.exe
  2⤵
  PID:4020
- C:\Windows\System\heWRzBs.exe
  C:\Windows\System\heWRzBs.exe
  2⤵
  PID:1164
- C:\Windows\System\dEpBCxA.exe
  C:\Windows\System\dEpBCxA.exe
  2⤵
  PID:2424
- C:\Windows\System\PLArfoG.exe
  C:\Windows\System\PLArfoG.exe
  2⤵
  PID:1820
- C:\Windows\System\GynAoUG.exe
  C:\Windows\System\GynAoUG.exe
  2⤵
  PID:1340
- C:\Windows\System\jmiAdba.exe
  C:\Windows\System\jmiAdba.exe
  2⤵
  PID:5176
- C:\Windows\System\NoIYJcO.exe
  C:\Windows\System\NoIYJcO.exe
  2⤵
  PID:5236
- C:\Windows\System\qLGUfOY.exe
  C:\Windows\System\qLGUfOY.exe
  2⤵
  PID:5292
- C:\Windows\System\qniiMLA.exe
  C:\Windows\System\qniiMLA.exe
  2⤵
  PID:2764
- C:\Windows\System\LmHXKNA.exe
  C:\Windows\System\LmHXKNA.exe
  2⤵
  PID:5412
- C:\Windows\System\MjgBUer.exe
  C:\Windows\System\MjgBUer.exe
  2⤵
  PID:5468
- C:\Windows\System\Rugbwgw.exe
  C:\Windows\System\Rugbwgw.exe
  2⤵
  PID:5740
- C:\Windows\System\JVPOKRb.exe
  C:\Windows\System\JVPOKRb.exe
  2⤵
  PID:5772
- C:\Windows\System\fOcNfDw.exe
  C:\Windows\System\fOcNfDw.exe
  2⤵
  PID:5824
- C:\Windows\System\YPXbsAm.exe
  C:\Windows\System\YPXbsAm.exe
  2⤵
  PID:5856
- C:\Windows\System\EnuygxT.exe
  C:\Windows\System\EnuygxT.exe
  2⤵
  PID:5928
- C:\Windows\System\SPOvxhA.exe
  C:\Windows\System\SPOvxhA.exe
  2⤵
  PID:6004
- C:\Windows\System\UBgdXLJ.exe
  C:\Windows\System\UBgdXLJ.exe
  2⤵
  PID:4808
- C:\Windows\System\AQxqsNW.exe
  C:\Windows\System\AQxqsNW.exe
  2⤵
  PID:6108
- C:\Windows\System\LGrkjdc.exe
  C:\Windows\System\LGrkjdc.exe
  2⤵
  PID:6140
- C:\Windows\System\qqSBxLU.exe
  C:\Windows\System\qqSBxLU.exe
  2⤵
  PID:3468
- C:\Windows\System\doKlXaE.exe
  C:\Windows\System\doKlXaE.exe
  2⤵
  PID:4804
- C:\Windows\System\AVhlwdC.exe
  C:\Windows\System\AVhlwdC.exe
  2⤵
  PID:1440
- C:\Windows\System\teWbbFS.exe
  C:\Windows\System\teWbbFS.exe
  2⤵
  PID:5128
- C:\Windows\System\NfTDgmo.exe
  C:\Windows\System\NfTDgmo.exe
  2⤵
  PID:5244
- C:\Windows\System\ZgFYYZw.exe
  C:\Windows\System\ZgFYYZw.exe
  2⤵
  PID:5328
- C:\Windows\System\JuDCiER.exe
  C:\Windows\System\JuDCiER.exe
  2⤵
  PID:2184
- C:\Windows\System\cAiWtxh.exe
  C:\Windows\System\cAiWtxh.exe
  2⤵
  PID:5436
- C:\Windows\System\DRNTkOV.exe
  C:\Windows\System\DRNTkOV.exe
  2⤵
  PID:3184
- C:\Windows\System\gmCZiAM.exe
  C:\Windows\System\gmCZiAM.exe
  2⤵
  PID:5440
- C:\Windows\System\yzPQVLY.exe
  C:\Windows\System\yzPQVLY.exe
  2⤵
  PID:3504
- C:\Windows\System\KUbaUSD.exe
  C:\Windows\System\KUbaUSD.exe
  2⤵
  PID:1676
- C:\Windows\System\BHCplVD.exe
  C:\Windows\System\BHCplVD.exe
  2⤵
  PID:5660
- C:\Windows\System\PMwHNdx.exe
  C:\Windows\System\PMwHNdx.exe
  2⤵
  PID:2448
- C:\Windows\System\npNwlYF.exe
  C:\Windows\System\npNwlYF.exe
  2⤵
  PID:2824
- C:\Windows\System\VvwZPQv.exe
  C:\Windows\System\VvwZPQv.exe
  2⤵
  PID:4032
- C:\Windows\System\vMKJIWn.exe
  C:\Windows\System\vMKJIWn.exe
  2⤵
  PID:1972
- C:\Windows\System\LoOdLak.exe
  C:\Windows\System\LoOdLak.exe
  2⤵
  PID:4228
- C:\Windows\System\dUzAGUj.exe
  C:\Windows\System\dUzAGUj.exe
  2⤵
  PID:5800
- C:\Windows\System\BupPISq.exe
  C:\Windows\System\BupPISq.exe
  2⤵
  PID:6136
- C:\Windows\System\iCmeGPe.exe
  C:\Windows\System\iCmeGPe.exe
  2⤵
  PID:5380
- C:\Windows\System\FOzlgSM.exe
  C:\Windows\System\FOzlgSM.exe
  2⤵
  PID:3020
- C:\Windows\System\TvPoMVu.exe
  C:\Windows\System\TvPoMVu.exe
  2⤵
  PID:5656
- C:\Windows\System\mpfIUCO.exe
  C:\Windows\System\mpfIUCO.exe
  2⤵
  PID:3696
- C:\Windows\System\WszVsYp.exe
  C:\Windows\System\WszVsYp.exe
  2⤵
  PID:4104
- C:\Windows\System\bWabHkY.exe
  C:\Windows\System\bWabHkY.exe
  2⤵
  PID:5600
- C:\Windows\System\unjZomK.exe
  C:\Windows\System\unjZomK.exe
  2⤵
  PID:4292
- C:\Windows\System\WSPHTZz.exe
  C:\Windows\System\WSPHTZz.exe
  2⤵
  PID:5768
- C:\Windows\System\xowhJJg.exe
  C:\Windows\System\xowhJJg.exe
  2⤵
  PID:3464
- C:\Windows\System\iJULKyr.exe
  C:\Windows\System\iJULKyr.exe
  2⤵
  PID:6160
- C:\Windows\System\uVSttFy.exe
  C:\Windows\System\uVSttFy.exe
  2⤵
  PID:6176
- C:\Windows\System\ddKLNJw.exe
  C:\Windows\System\ddKLNJw.exe
  2⤵
  PID:6196
- C:\Windows\System\QjjyUAm.exe
  C:\Windows\System\QjjyUAm.exe
  2⤵
  PID:6220
- C:\Windows\System\mEiUvre.exe
  C:\Windows\System\mEiUvre.exe
  2⤵
  PID:6244
- C:\Windows\System\XbdVlfs.exe
  C:\Windows\System\XbdVlfs.exe
  2⤵
  PID:6260
- C:\Windows\System\ReWqLfx.exe
  C:\Windows\System\ReWqLfx.exe
  2⤵
  PID:6308
- C:\Windows\System\MByEplP.exe
  C:\Windows\System\MByEplP.exe
  2⤵
  PID:6332
- C:\Windows\System\BHGPCeJ.exe
  C:\Windows\System\BHGPCeJ.exe
  2⤵
  PID:6348
- C:\Windows\System\IMNbWVL.exe
  C:\Windows\System\IMNbWVL.exe
  2⤵
  PID:6368
- C:\Windows\System\ALWcFrX.exe
  C:\Windows\System\ALWcFrX.exe
  2⤵
  PID:6384
- C:\Windows\System\zABmHNK.exe
  C:\Windows\System\zABmHNK.exe
  2⤵
  PID:6408
- C:\Windows\System\OsWMNrR.exe
  C:\Windows\System\OsWMNrR.exe
  2⤵
  PID:6460
- C:\Windows\System\htuRcGG.exe
  C:\Windows\System\htuRcGG.exe
  2⤵
  PID:6476
- C:\Windows\System\NOJGWJL.exe
  C:\Windows\System\NOJGWJL.exe
  2⤵
  PID:6504
- C:\Windows\System\SuKrHbF.exe
  C:\Windows\System\SuKrHbF.exe
  2⤵
  PID:6528
- C:\Windows\System\SoJgXtu.exe
  C:\Windows\System\SoJgXtu.exe
  2⤵
  PID:6548
- C:\Windows\System\wZZOnvU.exe
  C:\Windows\System\wZZOnvU.exe
  2⤵
  PID:6604
- C:\Windows\System\AOqOrJJ.exe
  C:\Windows\System\AOqOrJJ.exe
  2⤵
  PID:6648
- C:\Windows\System\ImKGGcv.exe
  C:\Windows\System\ImKGGcv.exe
  2⤵
  PID:6672
- C:\Windows\System\wCOtrBh.exe
  C:\Windows\System\wCOtrBh.exe
  2⤵
  PID:6688
- C:\Windows\System\eUPTgLt.exe
  C:\Windows\System\eUPTgLt.exe
  2⤵
  PID:6708
- C:\Windows\System\IIfwYyi.exe
  C:\Windows\System\IIfwYyi.exe
  2⤵
  PID:6732
- C:\Windows\System\yAVBlLc.exe
  C:\Windows\System\yAVBlLc.exe
  2⤵
  PID:6752
- C:\Windows\System\uwkFhlY.exe
  C:\Windows\System\uwkFhlY.exe
  2⤵
  PID:6792
- C:\Windows\System\FVIplOy.exe
  C:\Windows\System\FVIplOy.exe
  2⤵
  PID:6808
- C:\Windows\System\ZoSldRd.exe
  C:\Windows\System\ZoSldRd.exe
  2⤵
  PID:6864
- C:\Windows\System\fEMYyoy.exe
  C:\Windows\System\fEMYyoy.exe
  2⤵
  PID:6900
- C:\Windows\System\KNgngEK.exe
  C:\Windows\System\KNgngEK.exe
  2⤵
  PID:6932
- C:\Windows\System\xhLAIKd.exe
  C:\Windows\System\xhLAIKd.exe
  2⤵
  PID:6952
- C:\Windows\System\ZgwPhCm.exe
  C:\Windows\System\ZgwPhCm.exe
  2⤵
  PID:7000
- C:\Windows\System\cWkMeXO.exe
  C:\Windows\System\cWkMeXO.exe
  2⤵
  PID:7024
- C:\Windows\System\iCElHKM.exe
  C:\Windows\System\iCElHKM.exe
  2⤵
  PID:7044
- C:\Windows\System\lvUwSuP.exe
  C:\Windows\System\lvUwSuP.exe
  2⤵
  PID:7072
- C:\Windows\System\SdxiMjl.exe
  C:\Windows\System\SdxiMjl.exe
  2⤵
  PID:7088
- C:\Windows\System\BbeTfgw.exe
  C:\Windows\System\BbeTfgw.exe
  2⤵
  PID:7112
- C:\Windows\System\BvGUDbJ.exe
  C:\Windows\System\BvGUDbJ.exe
  2⤵
  PID:7128
- C:\Windows\System\xTZGJyh.exe
  C:\Windows\System\xTZGJyh.exe
  2⤵
  PID:7148
- C:\Windows\System\nDnyqaP.exe
  C:\Windows\System\nDnyqaP.exe
  2⤵
  PID:1268
- C:\Windows\System\DMVWLGZ.exe
  C:\Windows\System\DMVWLGZ.exe
  2⤵
  PID:3516
- C:\Windows\System\vrJyFLS.exe
  C:\Windows\System\vrJyFLS.exe
  2⤵
  PID:6168
- C:\Windows\System\vKwyeaE.exe
  C:\Windows\System\vKwyeaE.exe
  2⤵
  PID:6204
- C:\Windows\System\soXcMkl.exe
  C:\Windows\System\soXcMkl.exe
  2⤵
  PID:6320
- C:\Windows\System\fuNTszd.exe
  C:\Windows\System\fuNTszd.exe
  2⤵
  PID:6344
- C:\Windows\System\lCUcnLn.exe
  C:\Windows\System\lCUcnLn.exe
  2⤵
  PID:6424
- C:\Windows\System\izbWrCK.exe
  C:\Windows\System\izbWrCK.exe
  2⤵
  PID:6512
- C:\Windows\System\jaKnAcF.exe
  C:\Windows\System\jaKnAcF.exe
  2⤵
  PID:760
- C:\Windows\System\zkvnEUn.exe
  C:\Windows\System\zkvnEUn.exe
  2⤵
  PID:6620
- C:\Windows\System\fhjvidw.exe
  C:\Windows\System\fhjvidw.exe
  2⤵
  PID:6656
- C:\Windows\System\oYcVBmk.exe
  C:\Windows\System\oYcVBmk.exe
  2⤵
  PID:6700
- C:\Windows\System\lRqNcSL.exe
  C:\Windows\System\lRqNcSL.exe
  2⤵
  PID:6728
- C:\Windows\System\RgNhvCe.exe
  C:\Windows\System\RgNhvCe.exe
  2⤵
  PID:6800
- C:\Windows\System\UkfMVgB.exe
  C:\Windows\System\UkfMVgB.exe
  2⤵
  PID:6916
- C:\Windows\System\InWphCU.exe
  C:\Windows\System\InWphCU.exe
  2⤵
  PID:916
- C:\Windows\System\JJUUwuw.exe
  C:\Windows\System\JJUUwuw.exe
  2⤵
  PID:6976
- C:\Windows\System\dWxycLS.exe
  C:\Windows\System\dWxycLS.exe
  2⤵
  PID:7052
- C:\Windows\System\VQdWZcm.exe
  C:\Windows\System\VQdWZcm.exe
  2⤵
  PID:3264
- C:\Windows\System\dlQqqun.exe
  C:\Windows\System\dlQqqun.exe
  2⤵
  PID:6212
- C:\Windows\System\HkzxPsm.exe
  C:\Windows\System\HkzxPsm.exe
  2⤵
  PID:6156
- C:\Windows\System\WtnUbGn.exe
  C:\Windows\System\WtnUbGn.exe
  2⤵
  PID:6396
- C:\Windows\System\ruFJazy.exe
  C:\Windows\System\ruFJazy.exe
  2⤵
  PID:6596
- C:\Windows\System\UWcaKNc.exe
  C:\Windows\System\UWcaKNc.exe
  2⤵
  PID:6852
- C:\Windows\System\rORDZPr.exe
  C:\Windows\System\rORDZPr.exe
  2⤵
  PID:6828
- C:\Windows\System\VsrGUVU.exe
  C:\Windows\System\VsrGUVU.exe
  2⤵
  PID:2892
- C:\Windows\System\rwPoatO.exe
  C:\Windows\System\rwPoatO.exe
  2⤵
  PID:6964
- C:\Windows\System\oGbvyBW.exe
  C:\Windows\System\oGbvyBW.exe
  2⤵
  PID:7096
- C:\Windows\System\wHfuict.exe
  C:\Windows\System\wHfuict.exe
  2⤵
  PID:5852
- C:\Windows\System\zUUCyKE.exe
  C:\Windows\System\zUUCyKE.exe
  2⤵
  PID:6640
- C:\Windows\System\hffCftt.exe
  C:\Windows\System\hffCftt.exe
  2⤵
  PID:6500
- C:\Windows\System\fkJcbII.exe
  C:\Windows\System\fkJcbII.exe
  2⤵
  PID:4268
- C:\Windows\System\RtVetvN.exe
  C:\Windows\System\RtVetvN.exe
  2⤵
  PID:6468
- C:\Windows\System\GlIoIJe.exe
  C:\Windows\System\GlIoIJe.exe
  2⤵
  PID:6856
- C:\Windows\System\MTslCGp.exe
  C:\Windows\System\MTslCGp.exe
  2⤵
  PID:7188
- C:\Windows\System\efkZjbA.exe
  C:\Windows\System\efkZjbA.exe
  2⤵
  PID:7256
- C:\Windows\System\QXJGuYe.exe
  C:\Windows\System\QXJGuYe.exe
  2⤵
  PID:7272
- C:\Windows\System\xHzizJV.exe
  C:\Windows\System\xHzizJV.exe
  2⤵
  PID:7296
- C:\Windows\System\tWrLBRE.exe
  C:\Windows\System\tWrLBRE.exe
  2⤵
  PID:7348
- C:\Windows\System\ahrqIHP.exe
  C:\Windows\System\ahrqIHP.exe
  2⤵
  PID:7380
- C:\Windows\System\TPxqPgD.exe
  C:\Windows\System\TPxqPgD.exe
  2⤵
  PID:7404
- C:\Windows\System\gAZAgBI.exe
  C:\Windows\System\gAZAgBI.exe
  2⤵
  PID:7424
- C:\Windows\System\aQGRURS.exe
  C:\Windows\System\aQGRURS.exe
  2⤵
  PID:7448
- C:\Windows\System\fByPSkP.exe
  C:\Windows\System\fByPSkP.exe
  2⤵
  PID:7484
- C:\Windows\System\vDQHoji.exe
  C:\Windows\System\vDQHoji.exe
  2⤵
  PID:7508
- C:\Windows\System\xGBguJr.exe
  C:\Windows\System\xGBguJr.exe
  2⤵
  PID:7528
- C:\Windows\System\EqkjzkI.exe
  C:\Windows\System\EqkjzkI.exe
  2⤵
  PID:7576
- C:\Windows\System\wZChiNe.exe
  C:\Windows\System\wZChiNe.exe
  2⤵
  PID:7612
- C:\Windows\System\GBRFmZb.exe
  C:\Windows\System\GBRFmZb.exe
  2⤵
  PID:7632
- C:\Windows\System\lzwHsmR.exe
  C:\Windows\System\lzwHsmR.exe
  2⤵
  PID:7660
- C:\Windows\System\sXvBIho.exe
  C:\Windows\System\sXvBIho.exe
  2⤵
  PID:7708
- C:\Windows\System\qbGBbsV.exe
  C:\Windows\System\qbGBbsV.exe
  2⤵
  PID:7728
- C:\Windows\System\AsWVRdQ.exe
  C:\Windows\System\AsWVRdQ.exe
  2⤵
  PID:7760
- C:\Windows\System\dzucsxX.exe
  C:\Windows\System\dzucsxX.exe
  2⤵
  PID:7800
- C:\Windows\System\wzGBDGc.exe
  C:\Windows\System\wzGBDGc.exe
  2⤵
  PID:7820
- C:\Windows\System\Udycgza.exe
  C:\Windows\System\Udycgza.exe
  2⤵
  PID:7860
- C:\Windows\System\xhDZcsj.exe
  C:\Windows\System\xhDZcsj.exe
  2⤵
  PID:7884
- C:\Windows\System\gjhDToA.exe
  C:\Windows\System\gjhDToA.exe
  2⤵
  PID:7904
- C:\Windows\System\qEGwnSL.exe
  C:\Windows\System\qEGwnSL.exe
  2⤵
  PID:7924
- C:\Windows\System\NiUyuZa.exe
  C:\Windows\System\NiUyuZa.exe
  2⤵
  PID:7940
- C:\Windows\System\MfNfOyb.exe
  C:\Windows\System\MfNfOyb.exe
  2⤵
  PID:7972
- C:\Windows\System\cgPeymA.exe
  C:\Windows\System\cgPeymA.exe
  2⤵
  PID:7996
- C:\Windows\System\FRKQAeB.exe
  C:\Windows\System\FRKQAeB.exe
  2⤵
  PID:8040
- C:\Windows\System\Avcairh.exe
  C:\Windows\System\Avcairh.exe
  2⤵
  PID:8080
- C:\Windows\System\lINibJj.exe
  C:\Windows\System\lINibJj.exe
  2⤵
  PID:8108
- C:\Windows\System\cYHHaCI.exe
  C:\Windows\System\cYHHaCI.exe
  2⤵
  PID:8124
- C:\Windows\System\MDRDDRh.exe
  C:\Windows\System\MDRDDRh.exe
  2⤵
  PID:8156
- C:\Windows\System\RgjnoNL.exe
  C:\Windows\System\RgjnoNL.exe
  2⤵
  PID:8188
- C:\Windows\System\ChgtCnG.exe
  C:\Windows\System\ChgtCnG.exe
  2⤵
  PID:7180
- C:\Windows\System\XTdbePf.exe
  C:\Windows\System\XTdbePf.exe
  2⤵
  PID:5976
- C:\Windows\System\eLUXyYN.exe
  C:\Windows\System\eLUXyYN.exe
  2⤵
  PID:7292
- C:\Windows\System\xwSyBVR.exe
  C:\Windows\System\xwSyBVR.exe
  2⤵
  PID:7420
- C:\Windows\System\dLOuOHi.exe
  C:\Windows\System\dLOuOHi.exe
  2⤵
  PID:7376
- C:\Windows\System\GGAToko.exe
  C:\Windows\System\GGAToko.exe
  2⤵
  PID:7480
- C:\Windows\System\WPMiLJF.exe
  C:\Windows\System\WPMiLJF.exe
  2⤵
  PID:7556
- C:\Windows\System\VmIrstT.exe
  C:\Windows\System\VmIrstT.exe
  2⤵
  PID:7596
- C:\Windows\System\fpbkgvY.exe
  C:\Windows\System\fpbkgvY.exe
  2⤵
  PID:7720
- C:\Windows\System\KkCWIYL.exe
  C:\Windows\System\KkCWIYL.exe
  2⤵
  PID:7788
- C:\Windows\System\ZrpsuIV.exe
  C:\Windows\System\ZrpsuIV.exe
  2⤵
  PID:7840
- C:\Windows\System\GDEAPAd.exe
  C:\Windows\System\GDEAPAd.exe
  2⤵
  PID:7952
- C:\Windows\System\NLVtOXt.exe
  C:\Windows\System\NLVtOXt.exe
  2⤵
  PID:7964
- C:\Windows\System\aEnyHWY.exe
  C:\Windows\System\aEnyHWY.exe
  2⤵
  PID:8052
- C:\Windows\System\TcqSPVi.exe
  C:\Windows\System\TcqSPVi.exe
  2⤵
  PID:8132
- C:\Windows\System\ODCBSEf.exe
  C:\Windows\System\ODCBSEf.exe
  2⤵
  PID:7316
- C:\Windows\System\TFVMhjj.exe
  C:\Windows\System\TFVMhjj.exe
  2⤵
  PID:7344
- C:\Windows\System\qyvkkxs.exe
  C:\Windows\System\qyvkkxs.exe
  2⤵
  PID:7500
- C:\Windows\System\gHqXYob.exe
  C:\Windows\System\gHqXYob.exe
  2⤵
  PID:7628
- C:\Windows\System\EfFdwzn.exe
  C:\Windows\System\EfFdwzn.exe
  2⤵
  PID:7672
- C:\Windows\System\cncntau.exe
  C:\Windows\System\cncntau.exe
  2⤵
  PID:7876
- C:\Windows\System\KmNIIUq.exe
  C:\Windows\System\KmNIIUq.exe
  2⤵
  PID:7960
- C:\Windows\System\uFllaQK.exe
  C:\Windows\System\uFllaQK.exe
  2⤵
  PID:8100
- C:\Windows\System\UiJuBKy.exe
  C:\Windows\System\UiJuBKy.exe
  2⤵
  PID:7172
- C:\Windows\System\IwfJLaH.exe
  C:\Windows\System\IwfJLaH.exe
  2⤵
  PID:6984
- C:\Windows\System\uJNfrFl.exe
  C:\Windows\System\uJNfrFl.exe
  2⤵
  PID:7752
- C:\Windows\System\qKkABVD.exe
  C:\Windows\System\qKkABVD.exe
  2⤵
  PID:8076
- C:\Windows\System\NzgsoFt.exe
  C:\Windows\System\NzgsoFt.exe
  2⤵
  PID:8196
- C:\Windows\System\xUiuhId.exe
  C:\Windows\System\xUiuhId.exe
  2⤵
  PID:8224
- C:\Windows\System\qnxXPhZ.exe
  C:\Windows\System\qnxXPhZ.exe
  2⤵
  PID:8296
- C:\Windows\System\OgAFtJD.exe
  C:\Windows\System\OgAFtJD.exe
  2⤵
  PID:8312
- C:\Windows\System\JGDILTM.exe
  C:\Windows\System\JGDILTM.exe
  2⤵
  PID:8332
- C:\Windows\System\LFHVOsJ.exe
  C:\Windows\System\LFHVOsJ.exe
  2⤵
  PID:8380
- C:\Windows\System\MGeTEHv.exe
  C:\Windows\System\MGeTEHv.exe
  2⤵
  PID:8408
- C:\Windows\System\oIOrHNC.exe
  C:\Windows\System\oIOrHNC.exe
  2⤵
  PID:8428
- C:\Windows\System\ibQmoEQ.exe
  C:\Windows\System\ibQmoEQ.exe
  2⤵
  PID:8472
- C:\Windows\System\pFByahS.exe
  C:\Windows\System\pFByahS.exe
  2⤵
  PID:8492
- C:\Windows\System\ZvPHemr.exe
  C:\Windows\System\ZvPHemr.exe
  2⤵
  PID:8512
- C:\Windows\System\ohrBlNL.exe
  C:\Windows\System\ohrBlNL.exe
  2⤵
  PID:8548
- C:\Windows\System\eKtdHRB.exe
  C:\Windows\System\eKtdHRB.exe
  2⤵
  PID:8572
- C:\Windows\System\UCNLAAX.exe
  C:\Windows\System\UCNLAAX.exe
  2⤵
  PID:8600
- C:\Windows\System\rGyDMoK.exe
  C:\Windows\System\rGyDMoK.exe
  2⤵
  PID:8624
- C:\Windows\System\GdPNgtt.exe
  C:\Windows\System\GdPNgtt.exe
  2⤵
  PID:8648
- C:\Windows\System\FIEJdfs.exe
  C:\Windows\System\FIEJdfs.exe
  2⤵
  PID:8664
- C:\Windows\System\stUKbJc.exe
  C:\Windows\System\stUKbJc.exe
  2⤵
  PID:8680
- C:\Windows\System\hUZruBk.exe
  C:\Windows\System\hUZruBk.exe
  2⤵
  PID:8700
- C:\Windows\System\DjywctO.exe
  C:\Windows\System\DjywctO.exe
  2⤵
  PID:8752
- C:\Windows\System\XhxmYLC.exe
  C:\Windows\System\XhxmYLC.exe
  2⤵
  PID:8768
- C:\Windows\System\gyODOJY.exe
  C:\Windows\System\gyODOJY.exe
  2⤵
  PID:8800
- C:\Windows\System\keasTTc.exe
  C:\Windows\System\keasTTc.exe
  2⤵
  PID:8820
- C:\Windows\System\fhZrDSV.exe
  C:\Windows\System\fhZrDSV.exe
  2⤵
  PID:8836
- C:\Windows\System\pjRnYvU.exe
  C:\Windows\System\pjRnYvU.exe
  2⤵
  PID:8892
- C:\Windows\System\uhbcVMg.exe
  C:\Windows\System\uhbcVMg.exe
  2⤵
  PID:8912
- C:\Windows\System\qiARpNQ.exe
  C:\Windows\System\qiARpNQ.exe
  2⤵
  PID:8964
- C:\Windows\System\ZfImjIz.exe
  C:\Windows\System\ZfImjIz.exe
  2⤵
  PID:8988
- C:\Windows\System\jAMSzpR.exe
  C:\Windows\System\jAMSzpR.exe
  2⤵
  PID:9008
- C:\Windows\System\AKFXTHm.exe
  C:\Windows\System\AKFXTHm.exe
  2⤵
  PID:9028
- C:\Windows\System\nsthMTX.exe
  C:\Windows\System\nsthMTX.exe
  2⤵
  PID:9068
- C:\Windows\System\dAoVXCZ.exe
  C:\Windows\System\dAoVXCZ.exe
  2⤵
  PID:9120
- C:\Windows\System\RtXrMYy.exe
  C:\Windows\System\RtXrMYy.exe
  2⤵
  PID:9152
- C:\Windows\System\PkwmmpP.exe
  C:\Windows\System\PkwmmpP.exe
  2⤵
  PID:9180
- C:\Windows\System\nhnzhKc.exe
  C:\Windows\System\nhnzhKc.exe
  2⤵
  PID:9212
- C:\Windows\System\XNLzNXa.exe
  C:\Windows\System\XNLzNXa.exe
  2⤵
  PID:8208
- C:\Windows\System\IHwokVI.exe
  C:\Windows\System\IHwokVI.exe
  2⤵
  PID:8324
- C:\Windows\System\VkncVVw.exe
  C:\Windows\System\VkncVVw.exe
  2⤵
  PID:8356
- C:\Windows\System\fQOQbPw.exe
  C:\Windows\System\fQOQbPw.exe
  2⤵
  PID:8424
- C:\Windows\System\TfpuMaf.exe
  C:\Windows\System\TfpuMaf.exe
  2⤵
  PID:8484
- C:\Windows\System\CToxIzR.exe
  C:\Windows\System\CToxIzR.exe
  2⤵
  PID:8508
- C:\Windows\System\rsXcHtr.exe
  C:\Windows\System\rsXcHtr.exe
  2⤵
  PID:8632
- C:\Windows\System\gOvOjbO.exe
  C:\Windows\System\gOvOjbO.exe
  2⤵
  PID:8816
- C:\Windows\System\bXwrYFK.exe
  C:\Windows\System\bXwrYFK.exe
  2⤵
  PID:8832
- C:\Windows\System\eQROYNE.exe
  C:\Windows\System\eQROYNE.exe
  2⤵
  PID:8880
- C:\Windows\System\POYZZUP.exe
  C:\Windows\System\POYZZUP.exe
  2⤵
  PID:9004
- C:\Windows\System\cfjgvkA.exe
  C:\Windows\System\cfjgvkA.exe
  2⤵
  PID:9080
- C:\Windows\System\qDdFVyw.exe
  C:\Windows\System\qDdFVyw.exe
  2⤵
  PID:9140
- C:\Windows\System\WldxaaL.exe
  C:\Windows\System\WldxaaL.exe
  2⤵
  PID:7688
- C:\Windows\System\ZCCGyWJ.exe
  C:\Windows\System\ZCCGyWJ.exe
  2⤵
  PID:9188
- C:\Windows\System\xDNjhBT.exe
  C:\Windows\System\xDNjhBT.exe
  2⤵
  PID:8656
- C:\Windows\System\HBukQnS.exe
  C:\Windows\System\HBukQnS.exe
  2⤵
  PID:9200
- C:\Windows\System\fcqwTsO.exe
  C:\Windows\System\fcqwTsO.exe
  2⤵
  PID:8252
- C:\Windows\System\AvzGkJS.exe
  C:\Windows\System\AvzGkJS.exe
  2⤵
  PID:8560
- C:\Windows\System\KHNwGGc.exe
  C:\Windows\System\KHNwGGc.exe
  2⤵
  PID:8812
- C:\Windows\System\hWDuMTE.exe
  C:\Windows\System\hWDuMTE.exe
  2⤵
  PID:8904
- C:\Windows\System\XiFqXaY.exe
  C:\Windows\System\XiFqXaY.exe
  2⤵
  PID:8952
- C:\Windows\System\pXBULnA.exe
  C:\Windows\System\pXBULnA.exe
  2⤵
  PID:9136
- C:\Windows\System\RCPWXLI.exe
  C:\Windows\System\RCPWXLI.exe
  2⤵
  PID:8368
- C:\Windows\System\zDOkCaH.exe
  C:\Windows\System\zDOkCaH.exe
  2⤵
  PID:8464
- C:\Windows\System\PKNxetQ.exe
  C:\Windows\System\PKNxetQ.exe
  2⤵
  PID:8236
- C:\Windows\System\rVmulXS.exe
  C:\Windows\System\rVmulXS.exe
  2⤵
  PID:8404
- C:\Windows\System\xdIRmCZ.exe
  C:\Windows\System\xdIRmCZ.exe
  2⤵
  PID:8808
- C:\Windows\System\KjnTiKM.exe
  C:\Windows\System\KjnTiKM.exe
  2⤵
  PID:8320
- C:\Windows\System\hgWfyhX.exe
  C:\Windows\System\hgWfyhX.exe
  2⤵
  PID:9264
- C:\Windows\System\ZKQrfTA.exe
  C:\Windows\System\ZKQrfTA.exe
  2⤵
  PID:9284
- C:\Windows\System\DPhYihV.exe
  C:\Windows\System\DPhYihV.exe
  2⤵
  PID:9312
- C:\Windows\System\CjYgZRW.exe
  C:\Windows\System\CjYgZRW.exe
  2⤵
  PID:9352
- C:\Windows\System\XkUPMEH.exe
  C:\Windows\System\XkUPMEH.exe
  2⤵
  PID:9376
- C:\Windows\System\AJwoDUu.exe
  C:\Windows\System\AJwoDUu.exe
  2⤵
  PID:9404
- C:\Windows\System\GBeEzvs.exe
  C:\Windows\System\GBeEzvs.exe
  2⤵
  PID:9420
- C:\Windows\System\HORTgSH.exe
  C:\Windows\System\HORTgSH.exe
  2⤵
  PID:9444
- C:\Windows\System\oLHMFQv.exe
  C:\Windows\System\oLHMFQv.exe
  2⤵
  PID:9472
- C:\Windows\System\bybrwzY.exe
  C:\Windows\System\bybrwzY.exe
  2⤵
  PID:9488
- C:\Windows\System\sYMFXrc.exe
  C:\Windows\System\sYMFXrc.exe
  2⤵
  PID:9512
- C:\Windows\System\ggzfOZO.exe
  C:\Windows\System\ggzfOZO.exe
  2⤵
  PID:9536
- C:\Windows\System\lCUMGda.exe
  C:\Windows\System\lCUMGda.exe
  2⤵
  PID:9560
- C:\Windows\System\cmxOxUa.exe
  C:\Windows\System\cmxOxUa.exe
  2⤵
  PID:9592
- C:\Windows\System\upwbJkA.exe
  C:\Windows\System\upwbJkA.exe
  2⤵
  PID:9652
- C:\Windows\System\DgjQAgO.exe
  C:\Windows\System\DgjQAgO.exe
  2⤵
  PID:9668
- C:\Windows\System\whwMzFr.exe
  C:\Windows\System\whwMzFr.exe
  2⤵
  PID:9692
- C:\Windows\System\qxEoeeL.exe
  C:\Windows\System\qxEoeeL.exe
  2⤵
  PID:9716
- C:\Windows\System\DSGmMQL.exe
  C:\Windows\System\DSGmMQL.exe
  2⤵
  PID:9736
- C:\Windows\System\AuPWgMB.exe
  C:\Windows\System\AuPWgMB.exe
  2⤵
  PID:9756
- C:\Windows\System\NKZQboD.exe
  C:\Windows\System\NKZQboD.exe
  2⤵
  PID:9784
- C:\Windows\System\eFigPdR.exe
  C:\Windows\System\eFigPdR.exe
  2⤵
  PID:9800
- C:\Windows\System\uECEVLQ.exe
  C:\Windows\System\uECEVLQ.exe
  2⤵
  PID:9824
- C:\Windows\System\yvcyqcA.exe
  C:\Windows\System\yvcyqcA.exe
  2⤵
  PID:9844
- C:\Windows\System\pimMFnn.exe
  C:\Windows\System\pimMFnn.exe
  2⤵
  PID:9864
- C:\Windows\System\bhQXACc.exe
  C:\Windows\System\bhQXACc.exe
  2⤵
  PID:9932
- C:\Windows\System\vaLKqCd.exe
  C:\Windows\System\vaLKqCd.exe
  2⤵
  PID:9960
- C:\Windows\System\pZJWznd.exe
  C:\Windows\System\pZJWznd.exe
  2⤵
  PID:9996
- C:\Windows\System\YuupbTv.exe
  C:\Windows\System\YuupbTv.exe
  2⤵
  PID:10024
- C:\Windows\System\eWEpRBK.exe
  C:\Windows\System\eWEpRBK.exe
  2⤵
  PID:10048
- C:\Windows\System\GwENYAY.exe
  C:\Windows\System\GwENYAY.exe
  2⤵
  PID:10088
- C:\Windows\System\pBMClMf.exe
  C:\Windows\System\pBMClMf.exe
  2⤵
  PID:10116
- C:\Windows\System\dYpgadp.exe
  C:\Windows\System\dYpgadp.exe
  2⤵
  PID:10160
- C:\Windows\System\dIdfAbZ.exe
  C:\Windows\System\dIdfAbZ.exe
  2⤵
  PID:10192
- C:\Windows\System\ILjSJGB.exe
  C:\Windows\System\ILjSJGB.exe
  2⤵
  PID:10220
- C:\Windows\System\kBsVOQD.exe
  C:\Windows\System\kBsVOQD.exe
  2⤵
  PID:9220
- C:\Windows\System\CNZRKcp.exe
  C:\Windows\System\CNZRKcp.exe
  2⤵
  PID:9272
- C:\Windows\System\DkaCoKk.exe
  C:\Windows\System\DkaCoKk.exe
  2⤵
  PID:9304
- C:\Windows\System\cYJKlOJ.exe
  C:\Windows\System\cYJKlOJ.exe
  2⤵
  PID:9368
- C:\Windows\System\UGnXDef.exe
  C:\Windows\System\UGnXDef.exe
  2⤵
  PID:9412
- C:\Windows\System\lgRrOtG.exe
  C:\Windows\System\lgRrOtG.exe
  2⤵
  PID:9496
- C:\Windows\System\JtlAJsO.exe
  C:\Windows\System\JtlAJsO.exe
  2⤵
  PID:9456
- C:\Windows\System\AsWbXGt.exe
  C:\Windows\System\AsWbXGt.exe
  2⤵
  PID:9532
- C:\Windows\System\SBsTBQV.exe
  C:\Windows\System\SBsTBQV.exe
  2⤵
  PID:9636
- C:\Windows\System\nKfhmoB.exe
  C:\Windows\System\nKfhmoB.exe
  2⤵
  PID:9708
- C:\Windows\System\yZHRFwm.exe
  C:\Windows\System\yZHRFwm.exe
  2⤵
  PID:9808
- C:\Windows\System\bKlWZhX.exe
  C:\Windows\System\bKlWZhX.exe
  2⤵
  PID:9884
- C:\Windows\System\jFlaCRn.exe
  C:\Windows\System\jFlaCRn.exe
  2⤵
  PID:9928
- C:\Windows\System\IJSxlzb.exe
  C:\Windows\System\IJSxlzb.exe
  2⤵
  PID:10008
- C:\Windows\System\VENIoSE.exe
  C:\Windows\System\VENIoSE.exe
  2⤵
  PID:10040
- C:\Windows\System\XAFcbvI.exe
  C:\Windows\System\XAFcbvI.exe
  2⤵
  PID:10184
- C:\Windows\System\OslZeII.exe
  C:\Windows\System\OslZeII.exe
  2⤵
  PID:10236
- C:\Windows\System\RVSYjqF.exe
  C:\Windows\System\RVSYjqF.exe
  2⤵
  PID:9300
- C:\Windows\System\DXnrvWG.exe
  C:\Windows\System\DXnrvWG.exe
  2⤵
  PID:9392
- C:\Windows\System\rjQFvND.exe
  C:\Windows\System\rjQFvND.exe
  2⤵
  PID:9484
- C:\Windows\System\yeFtaIv.exe
  C:\Windows\System\yeFtaIv.exe
  2⤵
  PID:9568
- C:\Windows\System\jCkbhwV.exe
  C:\Windows\System\jCkbhwV.exe
  2⤵
  PID:9684
- C:\Windows\System\yqrZLVa.exe
  C:\Windows\System\yqrZLVa.exe
  2⤵
  PID:9792
- C:\Windows\System\vnPWPGw.exe
  C:\Windows\System\vnPWPGw.exe
  2⤵
  PID:9948
- C:\Windows\System\zfvhqld.exe
  C:\Windows\System\zfvhqld.exe
  2⤵
  PID:10100
- C:\Windows\System\OmpiBOC.exe
  C:\Windows\System\OmpiBOC.exe
  2⤵
  PID:9428
- C:\Windows\System\UVVBjxb.exe
  C:\Windows\System\UVVBjxb.exe
  2⤵
  PID:10252
- C:\Windows\System\UVfvXxB.exe
  C:\Windows\System\UVfvXxB.exe
  2⤵
  PID:10272
- C:\Windows\System\edLSMxg.exe
  C:\Windows\System\edLSMxg.exe
  2⤵
  PID:10292
- C:\Windows\System\MqHZAGZ.exe
  C:\Windows\System\MqHZAGZ.exe
  2⤵
  PID:10308
- C:\Windows\System\yIfMIAi.exe
  C:\Windows\System\yIfMIAi.exe
  2⤵
  PID:10340
- C:\Windows\System\nBkcudn.exe
  C:\Windows\System\nBkcudn.exe
  2⤵
  PID:10392
- C:\Windows\System\IzLqlMO.exe
  C:\Windows\System\IzLqlMO.exe
  2⤵
  PID:10412
- C:\Windows\System\ySSDjPB.exe
  C:\Windows\System\ySSDjPB.exe
  2⤵
  PID:10468
- C:\Windows\System\jmtNowc.exe
  C:\Windows\System\jmtNowc.exe
  2⤵
  PID:10484
- C:\Windows\System\MrHStsg.exe
  C:\Windows\System\MrHStsg.exe
  2⤵
  PID:10504
- C:\Windows\System\unuXawT.exe
  C:\Windows\System\unuXawT.exe
  2⤵
  PID:10520
- C:\Windows\System\wVSpNon.exe
  C:\Windows\System\wVSpNon.exe
  2⤵
  PID:10544
- C:\Windows\System\NaqRvnl.exe
  C:\Windows\System\NaqRvnl.exe
  2⤵
  PID:10576
- C:\Windows\System\dKVqVYy.exe
  C:\Windows\System\dKVqVYy.exe
  2⤵
  PID:10592
- C:\Windows\System\CNuQfsx.exe
  C:\Windows\System\CNuQfsx.exe
  2⤵
  PID:10632
- C:\Windows\System\VZtbYae.exe
  C:\Windows\System\VZtbYae.exe
  2⤵
  PID:10656
- C:\Windows\System\lscbmMO.exe
  C:\Windows\System\lscbmMO.exe
  2⤵
  PID:10676
- C:\Windows\System\gADTPGZ.exe
  C:\Windows\System\gADTPGZ.exe
  2⤵
  PID:10720
- C:\Windows\System\gaATLoq.exe
  C:\Windows\System\gaATLoq.exe
  2⤵
  PID:10748
- C:\Windows\System\BoAhKyD.exe
  C:\Windows\System\BoAhKyD.exe
  2⤵
  PID:10864
- C:\Windows\System\AxRLjWu.exe
  C:\Windows\System\AxRLjWu.exe
  2⤵
  PID:10884
- C:\Windows\System\MWukGaQ.exe
  C:\Windows\System\MWukGaQ.exe
  2⤵
  PID:10900
- C:\Windows\System\QykKMHO.exe
  C:\Windows\System\QykKMHO.exe
  2⤵
  PID:10920
- C:\Windows\System\yfCKkLL.exe
  C:\Windows\System\yfCKkLL.exe
  2⤵
  PID:10936
- C:\Windows\System\TJgwMRv.exe
  C:\Windows\System\TJgwMRv.exe
  2⤵
  PID:10964
- C:\Windows\System\VaTJFkn.exe
  C:\Windows\System\VaTJFkn.exe
  2⤵
  PID:11004
- C:\Windows\System\NEdWLLf.exe
  C:\Windows\System\NEdWLLf.exe
  2⤵
  PID:11028
- C:\Windows\System\unTDNbX.exe
  C:\Windows\System\unTDNbX.exe
  2⤵
  PID:11044
- C:\Windows\System\UgaPhdj.exe
  C:\Windows\System\UgaPhdj.exe
  2⤵
  PID:11072
- C:\Windows\System\dUpdkHf.exe
  C:\Windows\System\dUpdkHf.exe
  2⤵
  PID:11096
- C:\Windows\System\skQNrZL.exe
  C:\Windows\System\skQNrZL.exe
  2⤵
  PID:11120
- C:\Windows\System\RrZalfQ.exe
  C:\Windows\System\RrZalfQ.exe
  2⤵
  PID:11160
- C:\Windows\System\iFJKfeT.exe
  C:\Windows\System\iFJKfeT.exe
  2⤵
  PID:11176
- C:\Windows\System\pgNymYe.exe
  C:\Windows\System\pgNymYe.exe
  2⤵
  PID:11200
- C:\Windows\System\ZjoHAUt.exe
  C:\Windows\System\ZjoHAUt.exe
  2⤵
  PID:11240
- C:\Windows\System\yBtfAhs.exe
  C:\Windows\System\yBtfAhs.exe
  2⤵
  PID:9260
- C:\Windows\System\fQrZUzL.exe
  C:\Windows\System\fQrZUzL.exe
  2⤵
  PID:10248
- C:\Windows\System\XQBjAJX.exe
  C:\Windows\System\XQBjAJX.exe
  2⤵
  PID:10304
- C:\Windows\System\vilysUS.exe
  C:\Windows\System\vilysUS.exe
  2⤵
  PID:10420
- C:\Windows\System\FbPgnXk.exe
  C:\Windows\System\FbPgnXk.exe
  2⤵
  PID:10496
- C:\Windows\System\zTsmnEI.exe
  C:\Windows\System\zTsmnEI.exe
  2⤵
  PID:10492
- C:\Windows\System\IwNIWJg.exe
  C:\Windows\System\IwNIWJg.exe
  2⤵
  PID:10564
- C:\Windows\System\lJqQRYn.exe
  C:\Windows\System\lJqQRYn.exe
  2⤵
  PID:10664
- C:\Windows\System\CyKDFbR.exe
  C:\Windows\System\CyKDFbR.exe
  2⤵
  PID:10788
- C:\Windows\System\XJhsuMx.exe
  C:\Windows\System\XJhsuMx.exe
  2⤵
  PID:10836
- C:\Windows\System\uTwPOcS.exe
  C:\Windows\System\uTwPOcS.exe
  2⤵
  PID:10852
- C:\Windows\System\XwTFCTF.exe
  C:\Windows\System\XwTFCTF.exe
  2⤵
  PID:10880
- C:\Windows\System\dAeorcl.exe
  C:\Windows\System\dAeorcl.exe
  2⤵
  PID:10908
- C:\Windows\System\bSaAOUW.exe
  C:\Windows\System\bSaAOUW.exe
  2⤵
  PID:11040
- C:\Windows\System\lZNEgka.exe
  C:\Windows\System\lZNEgka.exe
  2⤵
  PID:11088
- C:\Windows\System\lsDoZjI.exe
  C:\Windows\System\lsDoZjI.exe
  2⤵
  PID:11188
- C:\Windows\System\gOtEXoQ.exe
  C:\Windows\System\gOtEXoQ.exe
  2⤵
  PID:11132
- C:\Windows\System\iNNPYcy.exe
  C:\Windows\System\iNNPYcy.exe
  2⤵
  PID:11196
- C:\Windows\System\KrRbSJB.exe
  C:\Windows\System\KrRbSJB.exe
  2⤵
  PID:11252
- C:\Windows\System\yFMxQET.exe
  C:\Windows\System\yFMxQET.exe
  2⤵
  PID:9296
- C:\Windows\System\aesxhBO.exe
  C:\Windows\System\aesxhBO.exe
  2⤵
  PID:10368
- C:\Windows\System\ZULmaYm.exe
  C:\Windows\System\ZULmaYm.exe
  2⤵
  PID:10448
- C:\Windows\System\vfgieBq.exe
  C:\Windows\System\vfgieBq.exe
  2⤵
  PID:10652
- C:\Windows\System\rFBpGFe.exe
  C:\Windows\System\rFBpGFe.exe
  2⤵
  PID:10764
- C:\Windows\System\ivSmsNw.exe
  C:\Windows\System\ivSmsNw.exe
  2⤵
  PID:11084
- C:\Windows\System\PCdsVlC.exe
  C:\Windows\System\PCdsVlC.exe
  2⤵
  PID:11172
- C:\Windows\System\ytPQOIQ.exe
  C:\Windows\System\ytPQOIQ.exe
  2⤵
  PID:10644
- C:\Windows\System\ohWFuyw.exe
  C:\Windows\System\ohWFuyw.exe
  2⤵
  PID:10740
- C:\Windows\System\hlneCcu.exe
  C:\Windows\System\hlneCcu.exe
  2⤵
  PID:11224
- C:\Windows\System\vKSTdeF.exe
  C:\Windows\System\vKSTdeF.exe
  2⤵
  PID:10840
- C:\Windows\System\wFUuSpv.exe
  C:\Windows\System\wFUuSpv.exe
  2⤵
  PID:11284
- C:\Windows\System\WKoetFL.exe
  C:\Windows\System\WKoetFL.exe
  2⤵
  PID:11316
- C:\Windows\System\ElzKBZa.exe
  C:\Windows\System\ElzKBZa.exe
  2⤵
  PID:11336
- C:\Windows\System\aFjGTbb.exe
  C:\Windows\System\aFjGTbb.exe
  2⤵
  PID:11380
- C:\Windows\System\egSnBvZ.exe
  C:\Windows\System\egSnBvZ.exe
  2⤵
  PID:11396
- C:\Windows\System\QCJaNWz.exe
  C:\Windows\System\QCJaNWz.exe
  2⤵
  PID:11420
- C:\Windows\System\wnhYpEi.exe
  C:\Windows\System\wnhYpEi.exe
  2⤵
  PID:11436
- C:\Windows\System\cdEhtnP.exe
  C:\Windows\System\cdEhtnP.exe
  2⤵
  PID:11488
- C:\Windows\System\bRGxYXP.exe
  C:\Windows\System\bRGxYXP.exe
  2⤵
  PID:11508
- C:\Windows\System\pkIMfZP.exe
  C:\Windows\System\pkIMfZP.exe
  2⤵
  PID:11528
- C:\Windows\System\ikYRifU.exe
  C:\Windows\System\ikYRifU.exe
  2⤵
  PID:11548
- C:\Windows\System\bGqfJoR.exe
  C:\Windows\System\bGqfJoR.exe
  2⤵
  PID:11568
- C:\Windows\System\QiQhrgN.exe
  C:\Windows\System\QiQhrgN.exe
  2⤵
  PID:11588
- C:\Windows\System\WbtogmZ.exe
  C:\Windows\System\WbtogmZ.exe
  2⤵
  PID:11608
- C:\Windows\System\AVLDzhC.exe
  C:\Windows\System\AVLDzhC.exe
  2⤵
  PID:11628
- C:\Windows\System\VjSbnsb.exe
  C:\Windows\System\VjSbnsb.exe
  2⤵
  PID:11688
- C:\Windows\System\maLUkOO.exe
  C:\Windows\System\maLUkOO.exe
  2⤵
  PID:11724
- C:\Windows\System\qFqrLGB.exe
  C:\Windows\System\qFqrLGB.exe
  2⤵
  PID:11752
- C:\Windows\System\oMkelGt.exe
  C:\Windows\System\oMkelGt.exe
  2⤵
  PID:11768
- C:\Windows\System\WAAqGOg.exe
  C:\Windows\System\WAAqGOg.exe
  2⤵
  PID:11796
- C:\Windows\System\vPtQBMK.exe
  C:\Windows\System\vPtQBMK.exe
  2⤵
  PID:11820
- C:\Windows\System\hrUdsFT.exe
  C:\Windows\System\hrUdsFT.exe
  2⤵
  PID:11848
- C:\Windows\System\kbAVPrK.exe
  C:\Windows\System\kbAVPrK.exe
  2⤵
  PID:11868
- C:\Windows\System\CkhLtQL.exe
  C:\Windows\System\CkhLtQL.exe
  2⤵
  PID:11892
- C:\Windows\System\vEGbLIt.exe
  C:\Windows\System\vEGbLIt.exe
  2⤵
  PID:11912
- C:\Windows\System\IxHjbsi.exe
  C:\Windows\System\IxHjbsi.exe
  2⤵
  PID:11972
- C:\Windows\System\emjyaus.exe
  C:\Windows\System\emjyaus.exe
  2⤵
  PID:11988
- C:\Windows\System\NjxbweB.exe
  C:\Windows\System\NjxbweB.exe
  2⤵
  PID:12024
- C:\Windows\System\aHDzSbX.exe
  C:\Windows\System\aHDzSbX.exe
  2⤵
  PID:12048
- C:\Windows\System\kEMSvWv.exe
  C:\Windows\System\kEMSvWv.exe
  2⤵
  PID:12076
- C:\Windows\System\rUhHxYk.exe
  C:\Windows\System\rUhHxYk.exe
  2⤵
  PID:12092
- C:\Windows\System\AsmRhDV.exe
  C:\Windows\System\AsmRhDV.exe
  2⤵
  PID:12112
- C:\Windows\System\sXmHmhu.exe
  C:\Windows\System\sXmHmhu.exe
  2⤵
  PID:12144
- C:\Windows\System\qolheRW.exe
  C:\Windows\System\qolheRW.exe
  2⤵
  PID:12160
- C:\Windows\System\ujBBZAR.exe
  C:\Windows\System\ujBBZAR.exe
  2⤵
  PID:12180
- C:\Windows\System\SLRTxoj.exe
  C:\Windows\System\SLRTxoj.exe
  2⤵
  PID:12200
- C:\Windows\System\kBjLIoq.exe
  C:\Windows\System\kBjLIoq.exe
  2⤵
  PID:12236
- C:\Windows\System\kxlRTRF.exe
  C:\Windows\System\kxlRTRF.exe
  2⤵
  PID:11036
- C:\Windows\System\AUnzuBX.exe
  C:\Windows\System\AUnzuBX.exe
  2⤵
  PID:11324
- C:\Windows\System\OCVlahO.exe
  C:\Windows\System\OCVlahO.exe
  2⤵
  PID:4360
- C:\Windows\System\tAWbQbj.exe
  C:\Windows\System\tAWbQbj.exe
  2⤵
  PID:11404
- C:\Windows\System\WMvBRDS.exe
  C:\Windows\System\WMvBRDS.exe
  2⤵
  PID:11432
- C:\Windows\System\JylCcEw.exe
  C:\Windows\System\JylCcEw.exe
  2⤵
  PID:11496
- C:\Windows\System\BRugtHT.exe
  C:\Windows\System\BRugtHT.exe
  2⤵
  PID:11596
- C:\Windows\System\WUxZeeD.exe
  C:\Windows\System\WUxZeeD.exe
  2⤵
  PID:11620
- C:\Windows\System\CFQOLxS.exe
  C:\Windows\System\CFQOLxS.exe
  2⤵
  PID:11760
- C:\Windows\System\ORzNNJI.exe
  C:\Windows\System\ORzNNJI.exe
  2⤵
  PID:11900
- C:\Windows\System\xAwNbAk.exe
  C:\Windows\System\xAwNbAk.exe
  2⤵
  PID:11876
- C:\Windows\System\vzWUmhQ.exe
  C:\Windows\System\vzWUmhQ.exe
  2⤵
  PID:11932
- C:\Windows\System\GtdynNE.exe
  C:\Windows\System\GtdynNE.exe
  2⤵
  PID:12040
- C:\Windows\System\eFQemFO.exe
  C:\Windows\System\eFQemFO.exe
  2⤵
  PID:12100
- C:\Windows\System\OqSGKQn.exe
  C:\Windows\System\OqSGKQn.exe
  2⤵
  PID:12168
- C:\Windows\System\czLkQfb.exe
  C:\Windows\System\czLkQfb.exe
  2⤵
  PID:10628
- C:\Windows\System\NjpfqIn.exe
  C:\Windows\System\NjpfqIn.exe
  2⤵
  PID:12132
- C:\Windows\System\wKDKCmz.exe
  C:\Windows\System\wKDKCmz.exe
  2⤵
  PID:11356
- C:\Windows\System\pAOrhEQ.exe
  C:\Windows\System\pAOrhEQ.exe
  2⤵
  PID:11388
- C:\Windows\System\gChgkDn.exe
  C:\Windows\System\gChgkDn.exe
  2⤵
  PID:11480
- C:\Windows\System\VnpmdJX.exe
  C:\Windows\System\VnpmdJX.exe
  2⤵
  PID:11624
- C:\Windows\System\OLwPzng.exe
  C:\Windows\System\OLwPzng.exe
  2⤵
  PID:12136
- C:\Windows\System\sRhmBrq.exe
  C:\Windows\System\sRhmBrq.exe
  2⤵
  PID:12188
- C:\Windows\System\MVdZCGe.exe
  C:\Windows\System\MVdZCGe.exe
  2⤵
  PID:8596
- C:\Windows\System\kwVsWcQ.exe
  C:\Windows\System\kwVsWcQ.exe
  2⤵
  PID:2440
- C:\Windows\System\BMtUlkO.exe
  C:\Windows\System\BMtUlkO.exe
  2⤵
  PID:11936
- C:\Windows\System\lgzcfSo.exe
  C:\Windows\System\lgzcfSo.exe
  2⤵
  PID:12084
- C:\Windows\System\TYqhXLl.exe
  C:\Windows\System\TYqhXLl.exe
  2⤵
  PID:12296
- C:\Windows\System\PDJOETl.exe
  C:\Windows\System\PDJOETl.exe
  2⤵
  PID:12316
- C:\Windows\System\jnTZzBP.exe
  C:\Windows\System\jnTZzBP.exe
  2⤵
  PID:12336
- C:\Windows\System\GShUPHT.exe
  C:\Windows\System\GShUPHT.exe
  2⤵
  PID:12360
- C:\Windows\System\OhAYRyp.exe
  C:\Windows\System\OhAYRyp.exe
  2⤵
  PID:12400
- C:\Windows\System\CFHxtQV.exe
  C:\Windows\System\CFHxtQV.exe
  2⤵
  PID:12452
- C:\Windows\System\fMZNRiD.exe
  C:\Windows\System\fMZNRiD.exe
  2⤵
  PID:12468
- C:\Windows\System\sSDvnBz.exe
  C:\Windows\System\sSDvnBz.exe
  2⤵
  PID:12488
- C:\Windows\System\iCFEmvt.exe
  C:\Windows\System\iCFEmvt.exe
  2⤵
  PID:12512
- C:\Windows\System\UpXKOzp.exe
  C:\Windows\System\UpXKOzp.exe
  2⤵
  PID:12528
- C:\Windows\System\mNBTfKC.exe
  C:\Windows\System\mNBTfKC.exe
  2⤵
  PID:12544
- C:\Windows\System\BSvCFvZ.exe
  C:\Windows\System\BSvCFvZ.exe
  2⤵
  PID:12584
- C:\Windows\System\BMzDJzd.exe
  C:\Windows\System\BMzDJzd.exe
  2⤵
  PID:12600
- C:\Windows\System\cqqDKtn.exe
  C:\Windows\System\cqqDKtn.exe
  2⤵
  PID:12628
- C:\Windows\System\EnWINVc.exe
  C:\Windows\System\EnWINVc.exe
  2⤵
  PID:12648
- C:\Windows\System\zULOAMt.exe
  C:\Windows\System\zULOAMt.exe
  2⤵
  PID:12672
- C:\Windows\System\NIRaezZ.exe
  C:\Windows\System\NIRaezZ.exe
  2⤵
  PID:12692
- C:\Windows\System\fWJwtZj.exe
  C:\Windows\System\fWJwtZj.exe
  2⤵
  PID:12772
- C:\Windows\System\hGKRQfn.exe
  C:\Windows\System\hGKRQfn.exe
  2⤵
  PID:12792
- C:\Windows\System\pPbdkZd.exe
  C:\Windows\System\pPbdkZd.exe
  2⤵
  PID:12812
- C:\Windows\System\TafrYel.exe
  C:\Windows\System\TafrYel.exe
  2⤵
  PID:12832
- C:\Windows\System\pWvewbh.exe
  C:\Windows\System\pWvewbh.exe
  2⤵
  PID:12864
- C:\Windows\System\mbTgsgh.exe
  C:\Windows\System\mbTgsgh.exe
  2⤵
  PID:12912
- C:\Windows\System\nYiEfCv.exe
  C:\Windows\System\nYiEfCv.exe
  2⤵
  PID:12940
- C:\Windows\System\WhmujYe.exe
  C:\Windows\System\WhmujYe.exe
  2⤵
  PID:12968
- C:\Windows\System\cxyAwOb.exe
  C:\Windows\System\cxyAwOb.exe
  2⤵
  PID:12988
- C:\Windows\System\UWSezqD.exe
  C:\Windows\System\UWSezqD.exe
  2⤵
  PID:13008
- C:\Windows\System\TmOABAC.exe
  C:\Windows\System\TmOABAC.exe
  2⤵
  PID:13032
- C:\Windows\System\JgPbYCj.exe
  C:\Windows\System\JgPbYCj.exe
  2⤵
  PID:13052
- C:\Windows\System\DCyiHbc.exe
  C:\Windows\System\DCyiHbc.exe
  2⤵
  PID:13100
- C:\Windows\System\stDhges.exe
  C:\Windows\System\stDhges.exe
  2⤵
  PID:13148
- C:\Windows\System\BOXMfDA.exe
  C:\Windows\System\BOXMfDA.exe
  2⤵
  PID:13168
- C:\Windows\System\MmRZAAh.exe
  C:\Windows\System\MmRZAAh.exe
  2⤵
  PID:13204
- C:\Windows\System\uwoQGIR.exe
  C:\Windows\System\uwoQGIR.exe
  2⤵
  PID:13220
- C:\Windows\System\AkceEbb.exe
  C:\Windows\System\AkceEbb.exe
  2⤵
  PID:13240
- C:\Windows\System\keZGhHL.exe
  C:\Windows\System\keZGhHL.exe
  2⤵
  PID:13296
- C:\Windows\System\jRcGYGe.exe
  C:\Windows\System\jRcGYGe.exe
  2⤵
  PID:11808
- C:\Windows\System\DmnHFNe.exe
  C:\Windows\System\DmnHFNe.exe
  2⤵
  PID:12308
- C:\Windows\System\aJPKmIB.exe
  C:\Windows\System\aJPKmIB.exe
  2⤵
  PID:12348
- C:\Windows\System\WMurqNE.exe
  C:\Windows\System\WMurqNE.exe
  2⤵
  PID:12432
- C:\Windows\System\KvoHlOV.exe
  C:\Windows\System\KvoHlOV.exe
  2⤵
  PID:12504
- C:\Windows\System\UvQFGAP.exe
  C:\Windows\System\UvQFGAP.exe
  2⤵
  PID:12980
- C:\Windows\System\QcYTrfo.exe
  C:\Windows\System\QcYTrfo.exe
  2⤵
  PID:12480
- C:\Windows\System\fUfzXpr.exe
  C:\Windows\System\fUfzXpr.exe
  2⤵
  PID:12592
- C:\Windows\System\gpVxNwM.exe
  C:\Windows\System\gpVxNwM.exe
  2⤵
  PID:11700
- C:\Windows\System\OSFTZdM.exe
  C:\Windows\System\OSFTZdM.exe
  2⤵
  PID:1732
- C:\Windows\System\YjYungZ.exe
  C:\Windows\System\YjYungZ.exe
  2⤵
  PID:13112
- C:\Windows\System\NOHArzf.exe
  C:\Windows\System\NOHArzf.exe
  2⤵
  PID:13180
- C:\Windows\System\HXUyGfP.exe
  C:\Windows\System\HXUyGfP.exe
  2⤵
  PID:13136
- C:\Windows\System\kFbQXMW.exe
  C:\Windows\System\kFbQXMW.exe
  2⤵
  PID:13264
- C:\Windows\System\QkXLtJV.exe
  C:\Windows\System\QkXLtJV.exe
  2⤵
  PID:2968
- C:\Windows\System\twmpMAH.exe
  C:\Windows\System\twmpMAH.exe
  2⤵
  PID:2072
- C:\Windows\System\BufXNkB.exe
  C:\Windows\System\BufXNkB.exe
  2⤵
  PID:12396
- C:\Windows\System\qqTNJnl.exe
  C:\Windows\System\qqTNJnl.exe
  2⤵
  PID:12388
- C:\Windows\System\imfKlCq.exe
  C:\Windows\System\imfKlCq.exe
  2⤵
  PID:12744
- C:\Windows\System\LPeQBEY.exe
  C:\Windows\System\LPeQBEY.exe
  2⤵
  PID:12636
- C:\Windows\System\SzrXZHj.exe
  C:\Windows\System\SzrXZHj.exe
  2⤵
  PID:212
- C:\Windows\System\JwcadgK.exe
  C:\Windows\System\JwcadgK.exe
  2⤵
  PID:12596
- C:\Windows\System\WHmXkbz.exe
  C:\Windows\System\WHmXkbz.exe
  2⤵
  PID:12684
- C:\Windows\System\pOYpWEw.exe
  C:\Windows\System\pOYpWEw.exe
  2⤵
  PID:12780
- C:\Windows\System\GOilUKG.exe
  C:\Windows\System\GOilUKG.exe
  2⤵
  PID:12784
- C:\Windows\System\RTiFrSv.exe
  C:\Windows\System\RTiFrSv.exe
  2⤵
  PID:12928
- C:\Windows\System\XLUhEGq.exe
  C:\Windows\System\XLUhEGq.exe
  2⤵
  PID:12932
- C:\Windows\System\RQigUfx.exe
  C:\Windows\System\RQigUfx.exe
  2⤵
  PID:13000
- C:\Windows\System\hFsSGLB.exe
  C:\Windows\System\hFsSGLB.exe
  2⤵
  PID:13020
- C:\Windows\System\iPamgRJ.exe
  C:\Windows\System\iPamgRJ.exe
  2⤵
  PID:4796
- C:\Windows\System\oAegtxZ.exe
  C:\Windows\System\oAegtxZ.exe
  2⤵
  PID:5092
- C:\Windows\System\nQBaxMG.exe
  C:\Windows\System\nQBaxMG.exe
  2⤵
  PID:4056
- C:\Windows\System\jltfYFH.exe
  C:\Windows\System\jltfYFH.exe
  2⤵
  PID:5912
- C:\Windows\System\ZorEmBO.exe
  C:\Windows\System\ZorEmBO.exe
  2⤵
  PID:1280
- C:\Windows\System\xYKxYbK.exe
  C:\Windows\System\xYKxYbK.exe
  2⤵
  PID:3232
- C:\Windows\System\ZkpFWTw.exe
  C:\Windows\System\ZkpFWTw.exe
  2⤵
  PID:13288
- C:\Windows\System\YPiTcXG.exe
  C:\Windows\System\YPiTcXG.exe
  2⤵
  PID:12448
- C:\Windows\System\kNqkaVh.exe
  C:\Windows\System\kNqkaVh.exe
  2⤵
  PID:12560
- C:\Windows\System\NBgNsuG.exe
  C:\Windows\System\NBgNsuG.exe
  2⤵
  PID:12644
- C:\Windows\System\IwKcFwn.exe
  C:\Windows\System\IwKcFwn.exe
  2⤵
  PID:12840
- C:\Windows\System\bwLsDJD.exe
  C:\Windows\System\bwLsDJD.exe
  2⤵
  PID:12824
- C:\Windows\System\wSTsTXr.exe
  C:\Windows\System\wSTsTXr.exe
  2⤵
  PID:13048
- C:\Windows\System\RWyrVGn.exe
  C:\Windows\System\RWyrVGn.exe
  2⤵
  PID:4344
- C:\Windows\System\DcJsOFU.exe
  C:\Windows\System\DcJsOFU.exe
  2⤵
  PID:13096
- C:\Windows\System\pEpVazZ.exe
  C:\Windows\System\pEpVazZ.exe
  2⤵
  PID:4284
- C:\Windows\System\mANpeqP.exe
  C:\Windows\System\mANpeqP.exe
  2⤵
  PID:5616
- C:\Windows\System\zxldLUu.exe
  C:\Windows\System\zxldLUu.exe
  2⤵
  PID:2308
- C:\Windows\System\ZfSaWEq.exe
  C:\Windows\System\ZfSaWEq.exe
  2⤵
  PID:5936
- C:\Windows\System\xdmjmHQ.exe
  C:\Windows\System\xdmjmHQ.exe
  2⤵
  PID:13304
- C:\Windows\System\HkBTPXS.exe
  C:\Windows\System\HkBTPXS.exe
  2⤵
  PID:12800
- C:\Windows\System\hIoDLnk.exe
  C:\Windows\System\hIoDLnk.exe
  2⤵
  PID:2568
- C:\Windows\System\xigzBUt.exe
  C:\Windows\System\xigzBUt.exe
  2⤵
  PID:3528
- C:\Windows\System\TYPAhjJ.exe
  C:\Windows\System\TYPAhjJ.exe
  2⤵
  PID:5004
- C:\Windows\System\liJVoHA.exe
  C:\Windows\System\liJVoHA.exe
  2⤵
  PID:12760
- C:\Windows\System\QeqVgly.exe
  C:\Windows\System\QeqVgly.exe
  2⤵
  PID:13128
- C:\Windows\System\zSFHzfn.exe
  C:\Windows\System\zSFHzfn.exe
  2⤵
  PID:13016
- C:\Windows\System\pIqutKg.exe
  C:\Windows\System\pIqutKg.exe
  2⤵
  PID:13332
- C:\Windows\System\PBwvILJ.exe
  C:\Windows\System\PBwvILJ.exe
  2⤵
  PID:13348
- C:\Windows\System\SYiJRry.exe
  C:\Windows\System\SYiJRry.exe
  2⤵
  PID:13380
- C:\Windows\System\aardJzT.exe
  C:\Windows\System\aardJzT.exe
  2⤵
  PID:13400
- C:\Windows\System\lTfzlxI.exe
  C:\Windows\System\lTfzlxI.exe
  2⤵
  PID:13432
- C:\Windows\System\aGNMHDq.exe
  C:\Windows\System\aGNMHDq.exe
  2⤵
  PID:13468
- C:\Windows\System\AhpDNOm.exe
  C:\Windows\System\AhpDNOm.exe
  2⤵
  PID:13488
- C:\Windows\System\xHteSNg.exe
  C:\Windows\System\xHteSNg.exe
  2⤵
  PID:13520
- C:\Windows\System\WRTRoza.exe
  C:\Windows\System\WRTRoza.exe
  2⤵
  PID:13572
- C:\Windows\System\UEtUhMt.exe
  C:\Windows\System\UEtUhMt.exe
  2⤵
  PID:13588
- C:\Windows\System\vHAgrxt.exe
  C:\Windows\System\vHAgrxt.exe
  2⤵
  PID:13680
- C:\Windows\System\kQiiLLj.exe
  C:\Windows\System\kQiiLLj.exe
  2⤵
  PID:13712
- C:\Windows\System\IMGTWuy.exe
  C:\Windows\System\IMGTWuy.exe
  2⤵
  PID:13760
- C:\Windows\System\rbICpCw.exe
  C:\Windows\System\rbICpCw.exe
  2⤵
  PID:13808
- C:\Windows\System\JfnTVFq.exe
  C:\Windows\System\JfnTVFq.exe
  2⤵
  PID:13828
- C:\Windows\System\CNvMJhN.exe
  C:\Windows\System\CNvMJhN.exe
  2⤵
  PID:13856
- C:\Windows\System\SMmrqGR.exe
  C:\Windows\System\SMmrqGR.exe
  2⤵
  PID:13888
- C:\Windows\System\wyijtRv.exe
  C:\Windows\System\wyijtRv.exe
  2⤵
  PID:13904
- C:\Windows\System\fJOzCrM.exe
  C:\Windows\System\fJOzCrM.exe
  2⤵
  PID:13920
- C:\Windows\System\dYgFIED.exe
  C:\Windows\System\dYgFIED.exe
  2⤵
  PID:13944
- C:\Windows\System\flHYimm.exe
  C:\Windows\System\flHYimm.exe
  2⤵
  PID:13960
- C:\Windows\System\YhwEuOj.exe
  C:\Windows\System\YhwEuOj.exe
  2⤵
  PID:13976
- C:\Windows\System\aivpbdd.exe
  C:\Windows\System\aivpbdd.exe
  2⤵
  PID:13996
- C:\Windows\System\aRPOtUV.exe
  C:\Windows\System\aRPOtUV.exe
  2⤵
  PID:14012
- C:\Windows\System\avLwrPr.exe
  C:\Windows\System\avLwrPr.exe
  2⤵
  PID:14028
- C:\Windows\System\likgrtV.exe
  C:\Windows\System\likgrtV.exe
  2⤵
  PID:14052
- C:\Windows\System\YidksLY.exe
  C:\Windows\System\YidksLY.exe
  2⤵
  PID:14080
- C:\Windows\System\cQmGuOv.exe
  C:\Windows\System\cQmGuOv.exe
  2⤵
  PID:14112
- C:\Windows\System\hzivyai.exe
  C:\Windows\System\hzivyai.exe
  2⤵
  PID:14128
- C:\Windows\System\qTIOGaO.exe
  C:\Windows\System\qTIOGaO.exe
  2⤵
  PID:14144
- C:\Windows\System\mvjYUpQ.exe
  C:\Windows\System\mvjYUpQ.exe
  2⤵
  PID:14160
- C:\Windows\System\ldwZocX.exe
  C:\Windows\System\ldwZocX.exe
  2⤵
  PID:14176
- C:\Windows\System\vDCyLAb.exe
  C:\Windows\System\vDCyLAb.exe
  2⤵
  PID:14192
- C:\Windows\System\GjKkHYM.exe
  C:\Windows\System\GjKkHYM.exe
  2⤵
  PID:14212
- C:\Windows\System\tCQtZxn.exe
  C:\Windows\System\tCQtZxn.exe
  2⤵
  PID:14228
- C:\Windows\System\hlrwNqg.exe
  C:\Windows\System\hlrwNqg.exe
  2⤵
  PID:14252
- C:\Windows\System\cxUaTEz.exe
  C:\Windows\System\cxUaTEz.exe
  2⤵
  PID:14296
- C:\Windows\System\UnNxTRi.exe
  C:\Windows\System\UnNxTRi.exe
  2⤵
  PID:14332
- C:\Windows\System\bSPPNjz.exe
  C:\Windows\System\bSPPNjz.exe
  2⤵
  PID:3844
- C:\Windows\System\pskKdWy.exe
  C:\Windows\System\pskKdWy.exe
  2⤵
  PID:6588
- C:\Windows\System\EaGRHkz.exe
  C:\Windows\System\EaGRHkz.exe
  2⤵
  PID:13544
- C:\Windows\System\gwfSTeT.exe
  C:\Windows\System\gwfSTeT.exe
  2⤵
  PID:6668
- C:\Windows\System\KxDAsKH.exe
  C:\Windows\System\KxDAsKH.exe
  2⤵
  PID:13560
- C:\Windows\System\ziktIJT.exe
  C:\Windows\System\ziktIJT.exe
  2⤵
  PID:4000
- C:\Windows\System\SKfmxRS.exe
  C:\Windows\System\SKfmxRS.exe
  2⤵
  PID:13608
- C:\Windows\System\WMGMaNL.exe
  C:\Windows\System\WMGMaNL.exe
  2⤵
  PID:13648
- C:\Windows\System\LLXlINf.exe
  C:\Windows\System\LLXlINf.exe
  2⤵
  PID:13632
- C:\Windows\System\ABQrpLP.exe
  C:\Windows\System\ABQrpLP.exe
  2⤵
  PID:13616
- C:\Windows\System\JkeAJPZ.exe
  C:\Windows\System\JkeAJPZ.exe
  2⤵
  PID:13668
- C:\Windows\System\zyENjAx.exe
  C:\Windows\System\zyENjAx.exe
  2⤵
  PID:13704
- C:\Windows\System\KgiHaRo.exe
  C:\Windows\System\KgiHaRo.exe
  2⤵
  PID:13692
- C:\Windows\System\oveGLIo.exe
  C:\Windows\System\oveGLIo.exe
  2⤵
  PID:2140
- C:\Windows\System\yfrGySk.exe
  C:\Windows\System\yfrGySk.exe
  2⤵
  PID:1932
- C:\Windows\System\BMbkdEc.exe
  C:\Windows\System\BMbkdEc.exe
  2⤵
  PID:4524
- C:\Windows\System\xgBgNkD.exe
  C:\Windows\System\xgBgNkD.exe
  2⤵
  PID:2408
- C:\Windows\System\nKonstb.exe
  C:\Windows\System\nKonstb.exe
  2⤵
  PID:3808
- C:\Windows\System\kSvjnCS.exe
  C:\Windows\System\kSvjnCS.exe
  2⤵
  PID:13724
- C:\Windows\System\bDZFHnx.exe
  C:\Windows\System\bDZFHnx.exe
  2⤵
  PID:2472
- C:\Windows\System\SzwSgur.exe
  C:\Windows\System\SzwSgur.exe
  2⤵
  PID:13768
- C:\Windows\System\gwlxYcL.exe
  C:\Windows\System\gwlxYcL.exe
  2⤵
  PID:13788
- C:\Windows\System\KnsscnB.exe
  C:\Windows\System\KnsscnB.exe
  2⤵
  PID:13820
- C:\Windows\System\jfvhhMg.exe
  C:\Windows\System\jfvhhMg.exe
  2⤵
  PID:3732
- C:\Windows\System\klUoyqN.exe
  C:\Windows\System\klUoyqN.exe
  2⤵
  PID:4688
- C:\Windows\System\OGTljZF.exe
  C:\Windows\System\OGTljZF.exe
  2⤵
  PID:13852
- C:\Windows\System\hPbJkIZ.exe
  C:\Windows\System\hPbJkIZ.exe
  2⤵
  PID:13880
- C:\Windows\System\OqzNjZL.exe
  C:\Windows\System\OqzNjZL.exe
  2⤵
  PID:7008
- C:\Windows\System\tlJKbFq.exe
  C:\Windows\System\tlJKbFq.exe
  2⤵
  PID:3664
- C:\Windows\System\EcjjIVI.exe
  C:\Windows\System\EcjjIVI.exe
  2⤵
  PID:13388
- C:\Windows\System\NkSRiUW.exe
  C:\Windows\System\NkSRiUW.exe
  2⤵
  PID:14036
- C:\Windows\System\EWXyRok.exe
  C:\Windows\System\EWXyRok.exe
  2⤵
  PID:13840
- C:\Windows\System\nKgHcEq.exe
  C:\Windows\System\nKgHcEq.exe
  2⤵
  PID:13464
- C:\Windows\System\tovzMaJ.exe
  C:\Windows\System\tovzMaJ.exe
  2⤵
  PID:13444
- C:\Windows\System\dEbqvoO.exe
  C:\Windows\System\dEbqvoO.exe
  2⤵
  PID:14060
- C:\Windows\System\bmzvFbY.exe
  C:\Windows\System\bmzvFbY.exe
  2⤵
  PID:14092
- C:\Windows\System\GHqZyqd.exe
  C:\Windows\System\GHqZyqd.exe
  2⤵
  PID:13368
- C:\Windows\System\qyHKVui.exe
  C:\Windows\System\qyHKVui.exe
  2⤵
  PID:13672
- C:\Windows\System\UUSghTU.exe
  C:\Windows\System\UUSghTU.exe
  2⤵
  PID:13872
- C:\Windows\System\LvhnFJn.exe
  C:\Windows\System\LvhnFJn.exe
  2⤵
  PID:6472
- C:\Windows\System\brHSQPx.exe
  C:\Windows\System\brHSQPx.exe
  2⤵
  PID:6680
- C:\Windows\System\NEHGhGm.exe
  C:\Windows\System\NEHGhGm.exe
  2⤵
  PID:4756
- C:\Windows\System\HMXDLAT.exe
  C:\Windows\System\HMXDLAT.exe
  2⤵
  PID:7020
- C:\Windows\System\XHPnpeU.exe
  C:\Windows\System\XHPnpeU.exe
  2⤵
  PID:2916
- C:\Windows\System\XZnUVbe.exe
  C:\Windows\System\XZnUVbe.exe
  2⤵
  PID:7204
- C:\Windows\System\NuYxTOx.exe
  C:\Windows\System\NuYxTOx.exe
  2⤵
  PID:7196
- C:\Windows\System\mMvgVOZ.exe
  C:\Windows\System\mMvgVOZ.exe
  2⤵
  PID:7320
- C:\Windows\System\PhJMJJh.exe
  C:\Windows\System\PhJMJJh.exe
  2⤵
  PID:7332
- C:\Windows\System\AhfwHoa.exe
  C:\Windows\System\AhfwHoa.exe
  2⤵
  PID:7468
- C:\Windows\System\EKmpfZE.exe
  C:\Windows\System\EKmpfZE.exe
  2⤵
  PID:7504
- C:\Windows\System\OMySaYt.exe
  C:\Windows\System\OMySaYt.exe
  2⤵
  PID:7592
- C:\Windows\System\OADExze.exe
  C:\Windows\System\OADExze.exe
  2⤵
  PID:7716
- C:\Windows\System\eFCkuxH.exe
  C:\Windows\System\eFCkuxH.exe
  2⤵
  PID:7748
- C:\Windows\System\idRWpSd.exe
  C:\Windows\System\idRWpSd.exe
  2⤵
  PID:7880
- C:\Windows\System\ZTNunCy.exe
  C:\Windows\System\ZTNunCy.exe
  2⤵
  PID:7968
- C:\Windows\System\TceDkFK.exe
  C:\Windows\System\TceDkFK.exe
  2⤵
  PID:8004
- C:\Windows\System\dqDpkEI.exe
  C:\Windows\System\dqDpkEI.exe
  2⤵
  PID:8048
- C:\Windows\System\HklBDuG.exe
  C:\Windows\System\HklBDuG.exe
  2⤵
  PID:8104
- C:\Windows\System\rxSGDyc.exe
  C:\Windows\System\rxSGDyc.exe
  2⤵
  PID:6716
- C:\Windows\System\bPPHdfC.exe
  C:\Windows\System\bPPHdfC.exe
  2⤵
  PID:7252
- C:\Windows\System\NfWKCZB.exe
  C:\Windows\System\NfWKCZB.exe
  2⤵
  PID:7496
- C:\Windows\System\ncluMLb.exe
  C:\Windows\System\ncluMLb.exe
  2⤵
  PID:7564
- C:\Windows\System\WMDDifV.exe
  C:\Windows\System\WMDDifV.exe
  2⤵
  PID:7808
- C:\Windows\System\ucCrnqY.exe
  C:\Windows\System\ucCrnqY.exe
  2⤵
  PID:7912
- C:\Windows\System\JneuxPQ.exe
  C:\Windows\System\JneuxPQ.exe
  2⤵
  PID:8152
- C:\Windows\System\OVnHAKo.exe
  C:\Windows\System\OVnHAKo.exe
  2⤵
  PID:8256
- C:\Windows\System\kCNcIvG.exe
  C:\Windows\System\kCNcIvG.exe
  2⤵
  PID:8240
- C:\Windows\System\VhiwqJI.exe
  C:\Windows\System\VhiwqJI.exe
  2⤵
  PID:8340
- C:\Windows\System\AwDbirJ.exe
  C:\Windows\System\AwDbirJ.exe
  2⤵
  PID:8376
- C:\Windows\System\FRmYzBR.exe
  C:\Windows\System\FRmYzBR.exe
  2⤵
  PID:8416
- C:\Windows\System\OupHGMm.exe
  C:\Windows\System\OupHGMm.exe
  2⤵
  PID:8540
- C:\Windows\System\mdJWLmG.exe
  C:\Windows\System\mdJWLmG.exe
  2⤵
  PID:8736
- C:\Windows\System\oLkFbvp.exe
  C:\Windows\System\oLkFbvp.exe
  2⤵
  PID:8844
- C:\Windows\System\DFCeuVP.exe
  C:\Windows\System\DFCeuVP.exe
  2⤵
  PID:8876
- C:\Windows\System\zdySwLn.exe
  C:\Windows\System\zdySwLn.exe
  2⤵
  PID:8936
- C:\Windows\System\OYwQJHK.exe
  C:\Windows\System\OYwQJHK.exe
  2⤵
  PID:9036
- C:\Windows\System\SAuiLWF.exe
  C:\Windows\System\SAuiLWF.exe
  2⤵
  PID:9148
- C:\Windows\System\rdrKWWY.exe
  C:\Windows\System\rdrKWWY.exe
  2⤵
  PID:14064
- C:\Windows\System\knRafQH.exe
  C:\Windows\System\knRafQH.exe
  2⤵
  PID:14136
- C:\Windows\System\ObAfDez.exe
  C:\Windows\System\ObAfDez.exe
  2⤵
  PID:7584
- C:\Windows\System\ghRBGmm.exe
  C:\Windows\System\ghRBGmm.exe
  2⤵
  PID:7704
- C:\Windows\System\mOThiyM.exe
  C:\Windows\System\mOThiyM.exe
  2⤵
  PID:7696
- C:\Windows\System\PLDBaXL.exe
  C:\Windows\System\PLDBaXL.exe
  2⤵
  PID:14156
- C:\Windows\System\rddtpps.exe
  C:\Windows\System\rddtpps.exe
  2⤵
  PID:14184
- C:\Windows\System\qgllJvw.exe
  C:\Windows\System\qgllJvw.exe
  2⤵
  PID:2648
- C:\Windows\System\fjHnNjK.exe
  C:\Windows\System\fjHnNjK.exe
  2⤵
  PID:5248
- C:\Windows\System\gFkWgjy.exe
  C:\Windows\System\gFkWgjy.exe
  2⤵
  PID:3996
- C:\Windows\System\rKPzvtL.exe
  C:\Windows\System\rKPzvtL.exe
  2⤵
  PID:552
- C:\Windows\System\dEdpWmT.exe
  C:\Windows\System\dEdpWmT.exe
  2⤵
  PID:756
- C:\Windows\System\AqTWgNX.exe
  C:\Windows\System\AqTWgNX.exe
  2⤵
  PID:3880
- C:\Windows\System\aOqEbYD.exe
  C:\Windows\System\aOqEbYD.exe
  2⤵
  PID:2988
- C:\Windows\System\rwwuvaq.exe
  C:\Windows\System\rwwuvaq.exe
  2⤵
  PID:5212
- C:\Windows\System\Squhlfb.exe
  C:\Windows\System\Squhlfb.exe
  2⤵
  PID:1436
- C:\Windows\System\ZuSOzOy.exe
  C:\Windows\System\ZuSOzOy.exe
  2⤵
  PID:5344
- C:\Windows\System\uDCHaIX.exe
  C:\Windows\System\uDCHaIX.exe
  2⤵
  PID:2484
- C:\Windows\System\YhgDUKb.exe
  C:\Windows\System\YhgDUKb.exe
  2⤵
  PID:4036
- C:\Windows\System\eBGcRWo.exe
  C:\Windows\System\eBGcRWo.exe
  2⤵
  PID:4448
- C:\Windows\System\YQmTyOo.exe
  C:\Windows\System\YQmTyOo.exe
  2⤵
  PID:4012
- C:\Windows\System\wfghPXX.exe
  C:\Windows\System\wfghPXX.exe
  2⤵
  PID:1600
- C:\Windows\System\fHDUgfg.exe
  C:\Windows\System\fHDUgfg.exe
  2⤵
  PID:14324
- C:\Windows\System\JhmqzaR.exe
  C:\Windows\System\JhmqzaR.exe
  2⤵
  PID:5276
- C:\Windows\System\YyoUSls.exe
  C:\Windows\System\YyoUSls.exe
  2⤵
  PID:4208
- C:\Windows\System\SORxdWZ.exe
  C:\Windows\System\SORxdWZ.exe
  2⤵
  PID:2924
- C:\Windows\System\TdnqTMB.exe
  C:\Windows\System\TdnqTMB.exe
  2⤵
  PID:3888
- C:\Windows\System\LzmCrql.exe
  C:\Windows\System\LzmCrql.exe
  2⤵
  PID:5372
- C:\Windows\System\PNLOqKi.exe
  C:\Windows\System\PNLOqKi.exe
  2⤵
  PID:1864
- C:\Windows\System\SvzsXCh.exe
  C:\Windows\System\SvzsXCh.exe
  2⤵
  PID:2076
- C:\Windows\System\bmDoEDy.exe
  C:\Windows\System\bmDoEDy.exe
  2⤵
  PID:5408
- C:\Windows\System\rqiUzeq.exe
  C:\Windows\System\rqiUzeq.exe
  2⤵
  PID:512
- C:\Windows\System\GLXhbFf.exe
  C:\Windows\System\GLXhbFf.exe
  2⤵
  PID:4720
- C:\Windows\System\kUElXeq.exe
  C:\Windows\System\kUElXeq.exe
  2⤵
  PID:13456
- C:\Windows\System\xjIFaLG.exe
  C:\Windows\System\xjIFaLG.exe
  2⤵
  PID:1036
- C:\Windows\System\JomTedF.exe
  C:\Windows\System\JomTedF.exe
  2⤵
  PID:14248
- C:\Windows\System\gMmGPdC.exe
  C:\Windows\System\gMmGPdC.exe
  2⤵
  PID:8976
- C:\Windows\System\ToIYhbk.exe
  C:\Windows\System\ToIYhbk.exe
  2⤵
  PID:14320
- C:\Windows\System\EqcoLiM.exe
  C:\Windows\System\EqcoLiM.exe
  2⤵
  PID:9172
- C:\Windows\System\fJEeZix.exe
  C:\Windows\System\fJEeZix.exe
  2⤵
  PID:13396
- C:\Windows\System\eeOGfnU.exe
  C:\Windows\System\eeOGfnU.exe
  2⤵
  PID:13516
- C:\Windows\System\RTpLBil.exe
  C:\Windows\System\RTpLBil.exe
  2⤵
  PID:13408
- C:\Windows\System\UjghzwY.exe
  C:\Windows\System\UjghzwY.exe
  2⤵
  PID:8344
- C:\Windows\System\RUhFwAI.exe
  C:\Windows\System\RUhFwAI.exe
  2⤵
  PID:4560
- C:\Windows\System\scIGsLg.exe
  C:\Windows\System\scIGsLg.exe
  2⤵
  PID:344
- C:\Windows\System\pKhmUUK.exe
  C:\Windows\System\pKhmUUK.exe
  2⤵
  PID:5580
- C:\Windows\System\IzIWqmB.exe
  C:\Windows\System\IzIWqmB.exe
  2⤵
  PID:13640
- C:\Windows\System\qitKtsS.exe
  C:\Windows\System\qitKtsS.exe
  2⤵
  PID:13316
- C:\Windows\System\iSKVmNY.exe
  C:\Windows\System\iSKVmNY.exe
  2⤵
  PID:14220
- C:\Windows\System\fvhaGxh.exe
  C:\Windows\System\fvhaGxh.exe
  2⤵
  PID:4968
- C:\Windows\System\VqwAcDM.exe
  C:\Windows\System\VqwAcDM.exe
  2⤵
  PID:944
- C:\Windows\System\VrfBVtV.exe
  C:\Windows\System\VrfBVtV.exe
  2⤵
  PID:1916
- C:\Windows\System\rwKWRdd.exe
  C:\Windows\System\rwKWRdd.exe
  2⤵
  PID:12756
- C:\Windows\System\yMXvced.exe
  C:\Windows\System\yMXvced.exe
  2⤵
  PID:12860
- C:\Windows\System\kWXtFdu.exe
  C:\Windows\System\kWXtFdu.exe
  2⤵
  PID:13780
- C:\Windows\System\xNIDCvz.exe
  C:\Windows\System\xNIDCvz.exe
  2⤵
  PID:13480
- C:\Windows\System\QDeYNXX.exe
  C:\Windows\System\QDeYNXX.exe
  2⤵
  PID:6192
- C:\Windows\System\SHEGhvk.exe
  C:\Windows\System\SHEGhvk.exe
  2⤵
  PID:13584
- C:\Windows\System\OTOamvr.exe
  C:\Windows\System\OTOamvr.exe
  2⤵
  PID:13624
- C:\Windows\System\recplfz.exe
  C:\Windows\System\recplfz.exe
  2⤵
  PID:1192
- C:\Windows\System\CjoPdna.exe
  C:\Windows\System\CjoPdna.exe
  2⤵
  PID:1196
- C:\Windows\System\fuJQCEq.exe
  C:\Windows\System\fuJQCEq.exe
  2⤵
  PID:1424
- C:\Windows\System\HBkzmDZ.exe
  C:\Windows\System\HBkzmDZ.exe
  2⤵
  PID:1060
- C:\Windows\System\xezHVrY.exe
  C:\Windows\System\xezHVrY.exe
  2⤵
  PID:13700
- C:\Windows\System\rtsyVmM.exe
  C:\Windows\System\rtsyVmM.exe
  2⤵
  PID:5472
- C:\Windows\System\yDcBxJs.exe
  C:\Windows\System\yDcBxJs.exe
  2⤵
  PID:1576
- C:\Windows\System\izbUmAF.exe
  C:\Windows\System\izbUmAF.exe
  2⤵
  PID:1644
- C:\Windows\System\KJHPouM.exe
  C:\Windows\System\KJHPouM.exe
  2⤵
  PID:13044
- C:\Windows\System\FOXtkKi.exe
  C:\Windows\System\FOXtkKi.exe
  2⤵
  PID:13508
- C:\Windows\System\bCXXVCQ.exe
  C:\Windows\System\bCXXVCQ.exe
  2⤵
  PID:5528
- C:\Windows\System\wiUBjBF.exe
  C:\Windows\System\wiUBjBF.exe
  2⤵
  PID:5540
- C:\Windows\System\tTbyfAD.exe
  C:\Windows\System\tTbyfAD.exe
  2⤵
  PID:4452
- C:\Windows\System\EBQxhGN.exe
  C:\Windows\System\EBQxhGN.exe
  2⤵
  PID:5652
- C:\Windows\System\ZBAyeya.exe
  C:\Windows\System\ZBAyeya.exe
  2⤵
  PID:5672
- C:\Windows\System\EBkizuh.exe
  C:\Windows\System\EBkizuh.exe
  2⤵
  PID:14008
- C:\Windows\System\sqFNCzh.exe
  C:\Windows\System\sqFNCzh.exe
  2⤵
  PID:13816
- C:\Windows\System\JenZZUN.exe
  C:\Windows\System\JenZZUN.exe
  2⤵
  PID:13876
- C:\Windows\System\FtfKdlx.exe
  C:\Windows\System\FtfKdlx.exe
  2⤵
  PID:5708
- C:\Windows\System\ydsPuIB.exe
  C:\Windows\System\ydsPuIB.exe
  2⤵
  PID:5728
- C:\Windows\System\GNPNVHv.exe
  C:\Windows\System\GNPNVHv.exe
  2⤵
  PID:5780
- C:\Windows\System\HgEhdBx.exe
  C:\Windows\System\HgEhdBx.exe
  2⤵
  PID:14048
- C:\Windows\System\PLYPTsL.exe
  C:\Windows\System\PLYPTsL.exe
  2⤵
  PID:5568
- C:\Windows\System\ARJSYqw.exe
  C:\Windows\System\ARJSYqw.exe
  2⤵
  PID:5808
- C:\Windows\System\quTFXiJ.exe
  C:\Windows\System\quTFXiJ.exe
  2⤵
  PID:6744
- C:\Windows\System\GNKhJcb.exe
  C:\Windows\System\GNKhJcb.exe
  2⤵
  PID:7144
- C:\Windows\System\IqCYPzI.exe
  C:\Windows\System\IqCYPzI.exe
  2⤵
  PID:13912
- C:\Windows\System\lLdFiME.exe
  C:\Windows\System\lLdFiME.exe
  2⤵
  PID:13360
- C:\Windows\System\YkQONuj.exe
  C:\Windows\System\YkQONuj.exe
  2⤵
  PID:13412
- C:\Windows\System\ZGQyqVj.exe
  C:\Windows\System\ZGQyqVj.exe
  2⤵
  PID:5864
- C:\Windows\System\rKkjLYQ.exe
  C:\Windows\System\rKkjLYQ.exe
  2⤵
  PID:5876
- C:\Windows\System\SDhLHmm.exe
  C:\Windows\System\SDhLHmm.exe
  2⤵
  PID:5904
- C:\Windows\System\odHFtiW.exe
  C:\Windows\System\odHFtiW.exe
  2⤵
  PID:4196
- C:\Windows\System\ODnxRQw.exe
  C:\Windows\System\ODnxRQw.exe
  2⤵
  PID:7540
- C:\Windows\System\WClIzpJ.exe
  C:\Windows\System\WClIzpJ.exe
  2⤵
  PID:7176
- C:\Windows\System\tNmRcCV.exe
  C:\Windows\System\tNmRcCV.exe
  2⤵
  PID:6216
- C:\Windows\System\qgtnGko.exe
  C:\Windows\System\qgtnGko.exe
  2⤵
  PID:7304
- C:\Windows\System\hnBRtpC.exe
  C:\Windows\System\hnBRtpC.exe
  2⤵
  PID:5988
- C:\Windows\System\CdFRJBj.exe
  C:\Windows\System\CdFRJBj.exe
  2⤵
  PID:7412
- C:\Windows\System\XlaawIR.exe
  C:\Windows\System\XlaawIR.exe
  2⤵
  PID:7356
- C:\Windows\System\PtnzGMo.exe
  C:\Windows\System\PtnzGMo.exe
  2⤵
  PID:7264
- C:\Windows\System\BUzllBy.exe
  C:\Windows\System\BUzllBy.exe
  2⤵
  PID:6032
- C:\Windows\System\WfICISv.exe
  C:\Windows\System\WfICISv.exe
  2⤵
  PID:8060
- C:\Windows\System\gjwxNii.exe
  C:\Windows\System\gjwxNii.exe
  2⤵
  PID:7796
- C:\Windows\System\gGvqqql.exe
  C:\Windows\System\gGvqqql.exe
  2⤵
  PID:6072
- C:\Windows\System\IRHulZs.exe
  C:\Windows\System\IRHulZs.exe
  2⤵
  PID:8024
- C:\Windows\System\kZZKBFS.exe
  C:\Windows\System\kZZKBFS.exe
  2⤵
  PID:10176
- C:\Windows\System\QniaQuJ.exe
  C:\Windows\System\QniaQuJ.exe
  2⤵
  PID:7516
- C:\Windows\System\PeaufCh.exe
  C:\Windows\System\PeaufCh.exe
  2⤵
  PID:3680
- C:\Windows\System\CFGOvwp.exe
  C:\Windows\System\CFGOvwp.exe
  2⤵
  PID:7472
- C:\Windows\System\VqGzHQA.exe
  C:\Windows\System\VqGzHQA.exe
  2⤵
  PID:7700
- C:\Windows\System\YZHtfjF.exe
  C:\Windows\System\YZHtfjF.exe
  2⤵
  PID:7200
- C:\Windows\System\mFYDFyV.exe
  C:\Windows\System\mFYDFyV.exe
  2⤵
  PID:7812
- C:\Windows\System\nnVgEAJ.exe
  C:\Windows\System\nnVgEAJ.exe
  2⤵
  PID:8268
- C:\Windows\System\EspfwBA.exe
  C:\Windows\System\EspfwBA.exe
  2⤵
  PID:8248
- C:\Windows\System\jYhSzfL.exe
  C:\Windows\System\jYhSzfL.exe
  2⤵
  PID:4428
- C:\Windows\System\qyvxUDY.exe
  C:\Windows\System\qyvxUDY.exe
  2⤵
  PID:8456
- C:\Windows\System\XnxIzbZ.exe
  C:\Windows\System\XnxIzbZ.exe
  2⤵
  PID:8588
- C:\Windows\System\NmLTTDE.exe
  C:\Windows\System\NmLTTDE.exe
  2⤵
  PID:9780
- C:\Windows\System\smTKICd.exe
  C:\Windows\System\smTKICd.exe
  2⤵
  PID:8732
- C:\Windows\System\GuZuAaH.exe
  C:\Windows\System\GuZuAaH.exe
  2⤵
  PID:13688
- C:\Windows\System\qklNvZa.exe
  C:\Windows\System\qklNvZa.exe
  2⤵
  PID:8776
- C:\Windows\System\BxXkKkJ.exe
  C:\Windows\System\BxXkKkJ.exe
  2⤵
  PID:10132
- C:\Windows\System\FmWQiyP.exe
  C:\Windows\System\FmWQiyP.exe
  2⤵
  PID:8884
- C:\Windows\System\DcOcXoO.exe
  C:\Windows\System\DcOcXoO.exe
  2⤵
  PID:9088
- C:\Windows\System\YtvnxXD.exe
  C:\Windows\System\YtvnxXD.exe
  2⤵
  PID:9104
- C:\Windows\System\kWTHYeh.exe
  C:\Windows\System\kWTHYeh.exe
  2⤵
  PID:3168
- C:\Windows\System\yFVOwgU.exe
  C:\Windows\System\yFVOwgU.exe
  2⤵
  PID:14088
- C:\Windows\System\soACdzq.exe
  C:\Windows\System\soACdzq.exe
  2⤵
  PID:5192
- C:\Windows\System\MtWKcCK.exe
  C:\Windows\System\MtWKcCK.exe
  2⤵
  PID:3140
- C:\Windows\System\gFIBMqL.exe
  C:\Windows\System\gFIBMqL.exe
  2⤵
  PID:5360
- C:\Windows\System\yICnUcZ.exe
  C:\Windows\System\yICnUcZ.exe
  2⤵
  PID:2284
- C:\Windows\System\AMrocfY.exe
  C:\Windows\System\AMrocfY.exe
  2⤵
  PID:4252
- C:\Windows\System\TwMTNFU.exe
  C:\Windows\System\TwMTNFU.exe
  2⤵
  PID:10808
- C:\Windows\System\sVwenGS.exe
  C:\Windows\System\sVwenGS.exe
  2⤵
  PID:14348
- C:\Windows\System\uPBiYll.exe
  C:\Windows\System\uPBiYll.exe
  2⤵
  PID:14364
- C:\Windows\System\PmaJHMN.exe
  C:\Windows\System\PmaJHMN.exe
  2⤵
  PID:14380
- C:\Windows\System\GeDvRPd.exe
  C:\Windows\System\GeDvRPd.exe
  2⤵
  PID:14396
- C:\Windows\System\ehQEpdh.exe
  C:\Windows\System\ehQEpdh.exe
  2⤵
  PID:14412
- C:\Windows\System\AlccxVV.exe
  C:\Windows\System\AlccxVV.exe
  2⤵
  PID:14432
- C:\Windows\System\pLnuVhA.exe
  C:\Windows\System\pLnuVhA.exe
  2⤵
  PID:14448
- C:\Windows\System\GYZmFKt.exe
  C:\Windows\System\GYZmFKt.exe
  2⤵
  PID:14464
- C:\Windows\System\muwpXcb.exe
  C:\Windows\System\muwpXcb.exe
  2⤵
  PID:14480
- C:\Windows\System\GRSkhQF.exe
  C:\Windows\System\GRSkhQF.exe
  2⤵
  PID:14496
- C:\Windows\System\KxMMWDK.exe
  C:\Windows\System\KxMMWDK.exe
  2⤵
  PID:14512
- C:\Windows\System\nctkWcw.exe
  C:\Windows\System\nctkWcw.exe
  2⤵
  PID:14528
- C:\Windows\System\jmntPbX.exe
  C:\Windows\System\jmntPbX.exe
  2⤵
  PID:14784
- C:\Windows\System\hyNgWft.exe
  C:\Windows\System\hyNgWft.exe
  2⤵
  PID:14828
- C:\Windows\System\HYiziaz.exe
  C:\Windows\System\HYiziaz.exe
  2⤵
  PID:14856
- C:\Windows\System\nvsxWVD.exe
  C:\Windows\System\nvsxWVD.exe
  2⤵
  PID:14948
- C:\Windows\System\azddGHh.exe
  C:\Windows\System\azddGHh.exe
  2⤵
  PID:14984
- C:\Windows\System\yhVPvtK.exe
  C:\Windows\System\yhVPvtK.exe
  2⤵
  PID:15044
- C:\Windows\System\ettBlOK.exe
  C:\Windows\System\ettBlOK.exe
  2⤵
  PID:15072
- C:\Windows\System\bpaaLOr.exe
  C:\Windows\System\bpaaLOr.exe
  2⤵
  PID:15116
- C:\Windows\System\QfEMGoo.exe
  C:\Windows\System\QfEMGoo.exe
  2⤵
  PID:15136
- C:\Windows\System\wKbVNES.exe
  C:\Windows\System\wKbVNES.exe
  2⤵
  PID:15152
- C:\Windows\System\yHgafXg.exe
  C:\Windows\System\yHgafXg.exe
  2⤵
  PID:14140
- C:\Windows\System\CvHxgEB.exe
  C:\Windows\System\CvHxgEB.exe
  2⤵
  PID:6240
- C:\Windows\System\zlJyzub.exe
  C:\Windows\System\zlJyzub.exe
  2⤵
  PID:13604
- C:\Windows\System\UsGbAoj.exe
  C:\Windows\System\UsGbAoj.exe
  2⤵
  PID:3476
- C:\Windows\System\EFpcXgw.exe
  C:\Windows\System\EFpcXgw.exe
  2⤵
  PID:1296
- C:\Windows\System\wOVtDtU.exe
  C:\Windows\System\wOVtDtU.exe
  2⤵
  PID:2084
- C:\Windows\System\DisBIWf.exe
  C:\Windows\System\DisBIWf.exe
  2⤵
  PID:13720
- C:\Windows\System\KcfkzUr.exe
  C:\Windows\System\KcfkzUr.exe
  2⤵
  PID:4648
- C:\Windows\System\rshcOzq.exe
  C:\Windows\System\rshcOzq.exe
  2⤵
  PID:4264
- C:\Windows\System\HSiISuH.exe
  C:\Windows\System\HSiISuH.exe
  2⤵
  PID:4028
- C:\Windows\System\MqHXwPS.exe
  C:\Windows\System\MqHXwPS.exe
  2⤵
  PID:5556
- C:\Windows\System\QEUpTam.exe
  C:\Windows\System\QEUpTam.exe
  2⤵
  PID:5596
- C:\Windows\System\uHEEIrv.exe
  C:\Windows\System\uHEEIrv.exe
  2⤵
  PID:3676
- C:\Windows\System\tSLLqpA.exe
  C:\Windows\System\tSLLqpA.exe
  2⤵
  PID:5500
- C:\Windows\System\BEjWPAE.exe
  C:\Windows\System\BEjWPAE.exe
  2⤵
  PID:1456
- C:\Windows\System\OXpUnYk.exe
  C:\Windows\System\OXpUnYk.exe
  2⤵
  PID:12956
- C:\Windows\System\IFYuxJK.exe
  C:\Windows\System\IFYuxJK.exe
  2⤵
  PID:4744
- C:\Windows\System\fJdnqbY.exe
  C:\Windows\System\fJdnqbY.exe
  2⤵
  PID:13548
- C:\Windows\System\dNUSdLG.exe
  C:\Windows\System\dNUSdLG.exe
  2⤵
  PID:5952
- C:\Windows\System\NjjDfeS.exe
  C:\Windows\System\NjjDfeS.exe
  2⤵
  PID:2724
- C:\Windows\System\XOWZMWg.exe
  C:\Windows\System\XOWZMWg.exe
  2⤵
  PID:13696
- C:\Windows\System\QgBLxvP.exe
  C:\Windows\System\QgBLxvP.exe
  2⤵
  PID:7280
- C:\Windows\System\anjSlkg.exe
  C:\Windows\System\anjSlkg.exe
  2⤵
  PID:6096
- C:\Windows\System\aaDfdqE.exe
  C:\Windows\System\aaDfdqE.exe
  2⤵
  PID:6100
- C:\Windows\System\Roufcvx.exe
  C:\Windows\System\Roufcvx.exe
  2⤵
  PID:4928
- C:\Windows\System\wlCRjKW.exe
  C:\Windows\System\wlCRjKW.exe
  2⤵
  PID:5356
- C:\Windows\System\jFDZDta.exe
  C:\Windows\System\jFDZDta.exe
  2⤵
  PID:13324
- C:\Windows\System\XPrseTI.exe
  C:\Windows\System\XPrseTI.exe
  2⤵
  PID:11300
- C:\Windows\System\ciBpQaA.exe
  C:\Windows\System\ciBpQaA.exe
  2⤵
  PID:4464
- C:\Windows\System\GgJDdBi.exe
  C:\Windows\System\GgJDdBi.exe
  2⤵
  PID:3216
- C:\Windows\System\eaMolUa.exe
  C:\Windows\System\eaMolUa.exe
  2⤵
  PID:8996
- C:\Windows\System\PjNPmxR.exe
  C:\Windows\System\PjNPmxR.exe
  2⤵
  PID:4768
- C:\Windows\System\NxpYhaX.exe
  C:\Windows\System\NxpYhaX.exe
  2⤵
  PID:2936
- C:\Windows\System\sqILuLo.exe
  C:\Windows\System\sqILuLo.exe
  2⤵
  PID:10760
- C:\Windows\System\MJQVZCI.exe
  C:\Windows\System\MJQVZCI.exe
  2⤵
  PID:14472
- C:\Windows\System\FRAqBVQ.exe
  C:\Windows\System\FRAqBVQ.exe
  2⤵
  PID:1520
- C:\Windows\System\HMyvBUv.exe
  C:\Windows\System\HMyvBUv.exe
  2⤵
  PID:14560
- C:\Windows\System\qbFdQEd.exe
  C:\Windows\System\qbFdQEd.exe
  2⤵
  PID:13636
- C:\Windows\System\fQHkPJJ.exe
  C:\Windows\System\fQHkPJJ.exe
  2⤵
  PID:1876
- C:\Windows\System\bYjXWHY.exe
  C:\Windows\System\bYjXWHY.exe
  2⤵
  PID:1628
- C:\Windows\System\QjTjMtn.exe
  C:\Windows\System\QjTjMtn.exe
  2⤵
  PID:808
- C:\Windows\System\RpCJGxX.exe
  C:\Windows\System\RpCJGxX.exe
  2⤵
  PID:14588
- C:\Windows\System\BZmZhNo.exe
  C:\Windows\System\BZmZhNo.exe
  2⤵
  PID:14612
- C:\Windows\System\HGaaHlZ.exe
  C:\Windows\System\HGaaHlZ.exe
  2⤵
  PID:14580
- C:\Windows\System\FViZmeG.exe
  C:\Windows\System\FViZmeG.exe
  2⤵
  PID:13896
- C:\Windows\System\cwcrLzb.exe
  C:\Windows\System\cwcrLzb.exe
  2⤵
  PID:13916
- C:\Windows\System\gBAWCkv.exe
  C:\Windows\System\gBAWCkv.exe
  2⤵
  PID:14764
- C:\Windows\System\DHFClVB.exe
  C:\Windows\System\DHFClVB.exe
  2⤵
  PID:14268
- C:\Windows\System\YpVSSvV.exe
  C:\Windows\System\YpVSSvV.exe
  2⤵
  PID:14776
- C:\Windows\System\zJtcpjW.exe
  C:\Windows\System\zJtcpjW.exe
  2⤵
  PID:14796
- C:\Windows\System\lNYOMOR.exe
  C:\Windows\System\lNYOMOR.exe
  2⤵
  PID:5924
- C:\Windows\System\lEERJIO.exe
  C:\Windows\System\lEERJIO.exe
  2⤵
  PID:14820
- C:\Windows\System\YHSzSNn.exe
  C:\Windows\System\YHSzSNn.exe
  2⤵
  PID:7236
- C:\Windows\System\jPeiOWh.exe
  C:\Windows\System\jPeiOWh.exe
  2⤵
  PID:13740
- C:\Windows\System\nWkMHWl.exe
  C:\Windows\System\nWkMHWl.exe
  2⤵
  PID:7224
- C:\Windows\System\yNBQGHn.exe
  C:\Windows\System\yNBQGHn.exe
  2⤵
  PID:1356
- C:\Windows\System\KynwtSp.exe
  C:\Windows\System\KynwtSp.exe
  2⤵
  PID:15064
- C:\Windows\System\pWQqTEF.exe
  C:\Windows\System\pWQqTEF.exe
  2⤵
  PID:11604
- C:\Windows\System\VyphvyT.exe
  C:\Windows\System\VyphvyT.exe
  2⤵
  PID:4980
- C:\Windows\System\rLboRAM.exe
  C:\Windows\System\rLboRAM.exe
  2⤵
  PID:8444
- C:\Windows\System\dlvhPLb.exe
  C:\Windows\System\dlvhPLb.exe
  2⤵
  PID:8280
- C:\Windows\System\gkkFwyj.exe
  C:\Windows\System\gkkFwyj.exe
  2⤵
  PID:14152
- C:\Windows\System\LWnyTYb.exe
  C:\Windows\System\LWnyTYb.exe
  2⤵
  PID:3928
- C:\Windows\System\IoQNXzG.exe
  C:\Windows\System\IoQNXzG.exe
  2⤵
  PID:14372
- C:\Windows\System\ZBUtgZN.exe
  C:\Windows\System\ZBUtgZN.exe
  2⤵
  PID:6644
- C:\Windows\System\yRpxtEs.exe
  C:\Windows\System\yRpxtEs.exe
  2⤵
  PID:13612
- C:\Windows\System\jjawmgN.exe
  C:\Windows\System\jjawmgN.exe
  2⤵
  PID:14552
- C:\Windows\System\gXFbEKx.exe
  C:\Windows\System\gXFbEKx.exe
  2⤵
  PID:12228
- C:\Windows\System\BmEkiMY.exe
  C:\Windows\System\BmEkiMY.exe
  2⤵
  PID:14620
- C:\Windows\System\eQFNwSH.exe
  C:\Windows\System\eQFNwSH.exe
  2⤵
  PID:14652
- C:\Windows\System\qteaQON.exe
  C:\Windows\System\qteaQON.exe
  2⤵
  PID:12368
- C:\Windows\System\ohXjBJW.exe
  C:\Windows\System\ohXjBJW.exe
  2⤵
  PID:14680
- C:\Windows\System\wTXufid.exe
  C:\Windows\System\wTXufid.exe
  2⤵
  PID:14720
- C:\Windows\System\yzCMJqD.exe
  C:\Windows\System\yzCMJqD.exe
  2⤵
  PID:14100
- C:\Windows\System\UMZHKuC.exe
  C:\Windows\System\UMZHKuC.exe
  2⤵
  PID:5516
- C:\Windows\System\NLAOfuE.exe
  C:\Windows\System\NLAOfuE.exe
  2⤵
  PID:14872
- C:\Windows\System\NgvsPtU.exe
  C:\Windows\System\NgvsPtU.exe
  2⤵
  PID:1468
- C:\Windows\System\ktkimXB.exe
  C:\Windows\System\ktkimXB.exe
  2⤵
  PID:14912
- C:\Windows\System\nuDzwFI.exe
  C:\Windows\System\nuDzwFI.exe
  2⤵
  PID:1812
- C:\Windows\System\VxzSBjR.exe
  C:\Windows\System\VxzSBjR.exe
  2⤵
  PID:15052
- C:\Windows\System\ThlrjTI.exe
  C:\Windows\System\ThlrjTI.exe
  2⤵
  PID:15100
- C:\Windows\System\aecOCUM.exe
  C:\Windows\System\aecOCUM.exe
  2⤵
  PID:8348
- C:\Windows\System\QSVknUI.exe
  C:\Windows\System\QSVknUI.exe
  2⤵
  PID:5796
- C:\Windows\System\EVHfPlE.exe
  C:\Windows\System\EVHfPlE.exe
  2⤵
  PID:8520
- C:\Windows\System\qZUSFnk.exe
  C:\Windows\System\qZUSFnk.exe
  2⤵
  PID:8612
- C:\Windows\System\rxYLUFh.exe
  C:\Windows\System\rxYLUFh.exe
  2⤵
  PID:5956
- C:\Windows\System\SBnKGqE.exe
  C:\Windows\System\SBnKGqE.exe
  2⤵
  PID:14244
- C:\Windows\System\BmNsRHC.exe
  C:\Windows\System\BmNsRHC.exe
  2⤵
  PID:6080
- C:\Windows\System\sTgpoix.exe
  C:\Windows\System\sTgpoix.exe
  2⤵
  PID:2748
- C:\Windows\System\aMZnkmD.exe
  C:\Windows\System\aMZnkmD.exe
  2⤵
  PID:4912
- C:\Windows\System\LQGOlUj.exe
  C:\Windows\System\LQGOlUj.exe
  2⤵
  PID:5332
- C:\Windows\System\FeQACZs.exe
  C:\Windows\System\FeQACZs.exe
  2⤵
  PID:14440
- C:\Windows\System\vHauAro.exe
  C:\Windows\System\vHauAro.exe
  2⤵
  PID:2848
- C:\Windows\System\BBgcqsl.exe
  C:\Windows\System\BBgcqsl.exe
  2⤵
  PID:14492
- C:\Windows\System\ypWNQAU.exe
  C:\Windows\System\ypWNQAU.exe
  2⤵
  PID:14536
- C:\Windows\System\HMywCBu.exe
  C:\Windows\System\HMywCBu.exe
  2⤵
  PID:2364
- C:\Windows\System\mDBkoEF.exe
  C:\Windows\System\mDBkoEF.exe
  2⤵
  PID:1716
- C:\Windows\System\lYBuxbO.exe
  C:\Windows\System\lYBuxbO.exe
  2⤵
  PID:5664
- C:\Windows\System\PdjFEvR.exe
  C:\Windows\System\PdjFEvR.exe
  2⤵
  PID:14628
- C:\Windows\System\CnuqaQR.exe
  C:\Windows\System\CnuqaQR.exe
  2⤵
  PID:6000
- C:\Windows\System\umicnGG.exe
  C:\Windows\System\umicnGG.exe
  2⤵
  PID:5884
- C:\Windows\System\hZBBXKV.exe
  C:\Windows\System\hZBBXKV.exe
  2⤵
  PID:14676
- C:\Windows\System\hUumirp.exe
  C:\Windows\System\hUumirp.exe
  2⤵
  PID:5880
- C:\Windows\System\MQxcQGW.exe
  C:\Windows\System\MQxcQGW.exe
  2⤵
  PID:14692
- C:\Windows\System\oUrLRop.exe
  C:\Windows\System\oUrLRop.exe
  2⤵
  PID:5348
- C:\Windows\System\ScvSXcx.exe
  C:\Windows\System\ScvSXcx.exe
  2⤵
  PID:5044
- C:\Windows\System\HUdGRmc.exe
  C:\Windows\System\HUdGRmc.exe
  2⤵
  PID:6104
- C:\Windows\System\SXqMXHM.exe
  C:\Windows\System\SXqMXHM.exe
  2⤵
  PID:15284
- C:\Windows\System\PlARiAv.exe
  C:\Windows\System\PlARiAv.exe
  2⤵
  PID:14732
- C:\Windows\System\SBTQsBL.exe
  C:\Windows\System\SBTQsBL.exe
  2⤵
  PID:2692
- C:\Windows\System\yanSwFf.exe
  C:\Windows\System\yanSwFf.exe
  2⤵
  PID:1124
- C:\Windows\System\XhrQhdv.exe
  C:\Windows\System\XhrQhdv.exe
  2⤵
  PID:1332
- C:\Windows\System\loaPiJY.exe
  C:\Windows\System\loaPiJY.exe
  2⤵
  PID:3392

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ez1thfyv.4fm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DLgdmes.exe

Filesize
1.5MB

MD5
82f22b25bfe0b4dccbb8b9096a1357a2

SHA1
10bad8ead835db014652acd1181be52e89ff70d8

SHA256
a9f55b065c748fc0c0d3c9b6d041f991f71d74a5f3d9e1a3a78bc8540cf66d41

SHA512
09cb2004b86646190ab44c1ca7cf9ebfecd15817298d424c9cb6015b5cfd0d5f9660606847af32acdbf75f8fa54c3468bc7f623513b5b700d215dd02438b1304

Download Submit
C:\Windows\System\KHLAvqV.exe

Filesize
1.5MB

MD5
7b582e04a62f847828572ae95bd0ad48

SHA1
5e5eb2e6106840e530810fbcb1f31087e811361c

SHA256
72744e55fc4270ce55c2560cbf4d70d930722104e966c0e12b1eaa43e8059145

SHA512
21d9b40e005267a5eef9d660c2ca971d5b91bc0c0adbb65541b843a045dd2cd945e87e5d9441a207512d87c31432a8ac1320bdf4970c456fde42d5e4c80ee748

Download Submit
C:\Windows\System\KKvQkzH.exe

Filesize
1.5MB

MD5
27a588133adc74e82d013636ce0942c5

SHA1
b055a768dc7b81e63181e7689b6a80588339455e

SHA256
62933c7aa9350022a162f20ab2689dab0eb6bb6788a946702fa3affc3cc64bd7

SHA512
07e277aea07508db70be866fff58ea130fe49c9eae114db15cbcdae5217b6a5561a3a3074bb705590e60db0a0e0cc35f6a8cc1b0458c1537a35199dd2e1bbc53

Download Submit
C:\Windows\System\OnazxGq.exe

Filesize
1.5MB

MD5
3178545766a8b9ed3c07474d5d1ec8e7

SHA1
635c295d0e447f91a9320f8f0e760ea75a9f65fb

SHA256
4fda6c2c650aa4e3219288c4097843d97689352868880ddbb1429654d27b304d

SHA512
3d0759f47048ee138b837b779bcf377fef26230098150ab4b2cd08dd1cdcb861a7944e1ec9da03d74f9101852e8602b64b2e07dc05af9df6e51c5ecee6ebf3ce

Download Submit
C:\Windows\System\OramXDB.exe

Filesize
1.5MB

MD5
c55de6840ec03fd8ef579cb7cb4ece1a

SHA1
415c27cb9711915be6818d03208c1f1e5e912de4

SHA256
f033ca4ae22630cc72df52889d253a3bc48bb927dd2ae1a39620694777c899ae

SHA512
b76546c1a9e5aa575ea2638b221f83994a825ec1571bf29fae6bd6b7e7240a1475ad48a7281ffce782bdef70d0170314bfb939f625158e93f3cba2642402e9d1

Download Submit
C:\Windows\System\SKCRLzT.exe

Filesize
1.5MB

MD5
ce012aa2d51701caf617231b5c935d47

SHA1
7681fa9f5fedc2315b6572547927fa6565daf64a

SHA256
a528f6e745ef42df918dcaa48b6bc74132d43c7299fd1452c0fce98075448863

SHA512
5d439f25f1d19695933b6f3c32e8457e60654430b39fcc532d8c3e06d3da0eef076eb7124410abbda03b4591c946be9acd9cd5c8e64d07ab2a4b563ee58d77d8

Download Submit
C:\Windows\System\XjZdzUj.exe

Filesize
1.5MB

MD5
02544ea537f1bbeef7a7729eee516767

SHA1
fd61a444c8bfa1b0e28606ea7888b95c7f7de085

SHA256
cc75bbb4e55d02a2ca83f160aff49c75187be301ee79bc5689fb651850e14071

SHA512
6866a0f71357435e20e1ed895e789a46f496ba49c2cbec7590e752afb7db8536eeb2493d756d818bb9e3c99651b563aa9470e65f42348fc7bb5b6dc53427cc65

Download Submit
C:\Windows\System\XkwuWjW.exe

Filesize
1.5MB

MD5
cc3aa2b69be6eb3d5f36273b631c5343

SHA1
614b8d087db6dadc095270b82445e0481b5fe49f

SHA256
070ac60e8187a5f6ca8ef8dd89c4943a07ee9a108c74cc5247e2ecaf9bc86f18

SHA512
c1bc2b09f6ca1ec470d056d7d48fe0c929c29b09642e4c72e9f0487d79a4a875dbae189228071740106091260dc7ed600c2d9fab45be84fb88c7dbd37fdffe88

Download Submit
C:\Windows\System\YxNMMCx.exe

Filesize
1.5MB

MD5
3d67b56c89625b7513625e7b2797a131

SHA1
c72be34bb9fd3c92e44535c779cea0a8ea71057b

SHA256
86ce851e811985cf6fad1709d91947acb06a54daf06a5a99872f330e49f88a54

SHA512
379e21d72e0bbb6f61831fd1eb97734154e3548a2423ebf0124c6d2dcf6d5d16fee5d3dad13d056cf9d491c400be062d5faefcf2afd776ca7cb997818fb9518d

Download Submit
C:\Windows\System\aEgVGxW.exe

Filesize
1.5MB

MD5
68b660e3f70018d9b9f5ae16e6ad3981

SHA1
991a61d2dc49261852ce975e3c094c75bf2cc42d

SHA256
f54b036fd6b007d8f345d104e927119f2c5840f8f219c54fdd32838d81c27de1

SHA512
6c799024d1752f486d3e0282c37326bbf0b4376ade896b75b594de46563fa7cf65e285d0731aa2c5de60c19f02d1c611a53fa7d0f41450dc791e6754698b5346

Download Submit
C:\Windows\System\cniPGKK.exe

Filesize
1.5MB

MD5
9cf99a5485ea41c7c33db99d0aebcd79

SHA1
fe21fa83ecf52f3f84dcc58ec3f2b7a513f3274e

SHA256
cb498be04ba78af4841250d0a6e58dee6aa9b4c1a54d38b5f1c7dcb0e9dfd845

SHA512
e6fb54c7919335ac2adf5c72329953aa3960823f08f951c78e27ea48af1b80a173415a26202d9c79428d5e8a768e7f91181d13fc9b675d2c748c6091f46b0c08

Download Submit
C:\Windows\System\gJacllr.exe

Filesize
1.5MB

MD5
d89159603c0f08313f16aa81a9ad56da

SHA1
d08100d758e5add302f67bf58c6c87e95a9f1278

SHA256
75f48b6f0ef71586d9fb8c7579f8b5c9e9b823aec9c9d0ee7593c3b0c49a07b1

SHA512
f00dc8c6b0f1d81dd7d190de4a156b8c986db3540b5e82ab1c9b6836ae0fe08a8c587eb6548a80b3914f5efd8085b5b4a21d41fdc7d1ddd6d0e69fb4a7811df3

Download Submit
C:\Windows\System\gPBbwnZ.exe

Filesize
1.5MB

MD5
9409fc5257348fa4f812936c8bc5877f

SHA1
789dbea5ef9b7273d5a212e5408fc9cfd663ee47

SHA256
b5657b0ff472ae6aabc69c625319522a7797cc5eefc33ec42eaf322a67c99178

SHA512
639f6797c922962ea7c470cefed6c0e04a7a1a6d3e309445a77faf88b62b0517d98d5bb3e47dd96c9928cf46d27671b001efafc4eb8efef21485550bfd0118c1

Download Submit
C:\Windows\System\grZOnYL.exe

Filesize
1.5MB

MD5
5ec3e5a1baf9779e9118db691fb91577

SHA1
b737430caba32a6c07ac8611e44ff2fb7971f7ef

SHA256
2fc47f37093cbce3ece94a454ad927afc17ec2076622b5c6d24867cbc945df4a

SHA512
71f5d13843e605c5765b046188073dedbbfc012f838cbbcdcb31700501538a2622bf049e818c3228ae9c50ac11d17daa1aa4d85bd4b81847db2a4a678d6c4779

Download Submit
C:\Windows\System\hJepoRz.exe

Filesize
1.5MB

MD5
7019dbfb972669cef180582746e184f7

SHA1
8261cefe0172c6d46e54f56a27bf90cf2707d1aa

SHA256
e55104805dc1d9642a110561471336828d20951b6776d38e8befbd6a83d38c4e

SHA512
fe5c1b25ce12e2eac5bc6c31617221a9fae2b97281427ea547897dbad696cb1a74cc1af51eb1f566032b0a51dc1d944e919c02e8df729e7881edbb3f3ed0c55a

Download Submit
C:\Windows\System\iYsdHXk.exe

Filesize
1.5MB

MD5
5295d8da680f998290dd4c50d01f8f37

SHA1
ae3240ed904e899fd447539f2823b1d28b838318

SHA256
99773b9d2a961ac49809b4bdae6838e5755e40727b68d9de2f7e956a2048cd1e

SHA512
10a8b3fe4b2f5faf7ba7f1cf0964ff3c4d7b921b27dd1da194ec4632ace37a643f71c4f2325899a6623720db780e2ca18be16c55ccad74e6da1f74416bab92be

Download Submit
C:\Windows\System\ixXhDBT.exe

Filesize
1.5MB

MD5
62c1c90499f50102b82d960ccae06f9e

SHA1
c940181a27ea4da16158753ca819dac5a8595bce

SHA256
ae61fa4404f9e7963d378a83f0fb775f986122851261174426b2e243433b2cc5

SHA512
19baab8c4920422e342faa5756f7f56d7a0405d104f0e963e3175056f03c5277cd7dea64ad4b11e823db26dada0777b4994329de6ed34a76d6cc9bfbce8730db

Download Submit
C:\Windows\System\jMNcRrw.exe

Filesize
1.5MB

MD5
4d95e23fe380efd87bd46ca894e4fbc2

SHA1
90f9676172dbc5e6ac99801911757857589f9ad9

SHA256
76a931502b1873a5abd8df3b590fb1fb4a75f76278705b33e6ceb6b44a736b71

SHA512
fd716d0723d25bc7a730d3f47a3e3b0da352caf25b18c035ce5d4a0dff1a130f231ef0b49897bd2f9d81bf91d3a1db29248ed7f82aa039b466c61165b87fc146

Download Submit
C:\Windows\System\jOcWoTQ.exe

Filesize
1.5MB

MD5
d101ac026175c504391c55f7ba78a18b

SHA1
ce463c881da89b9560e2d03d9d441e86f5716fed

SHA256
02bb69e4be92eaea0f24089db594a40fb7ad204bf6a593ac2475a4385582e14a

SHA512
7f3a21f4d70aca81054270909888a2a48ba1402539ec6cafd409d0b3a432041f11631d79783736b747a8c0ab8be37ff3f4926f4b84063edc58a43b68a2fddb37

Download Submit
C:\Windows\System\lPKxgOE.exe

Filesize
1.5MB

MD5
8c76f786e8cc39a1c27f74f3a92f6ac9

SHA1
d7915c5b61946a80913ee833ffd210564fa5e133

SHA256
ec5e512c5c8180758ec8aa034c607a3fab0d8464d858735509e69c9ea3bf1925

SHA512
499b973f76382efb713cd762cda8e6cd4a5abe116adeeb13d9f122c909018a9eb6d0e53dc96a3d04be125b9ce7e5e43341cb964a878bdd51702e25e56a7bd0f7

Download Submit
C:\Windows\System\oCvuDDX.exe

Filesize
1.5MB

MD5
128011d680d0fd757844bce74e0dce2d

SHA1
f9b0e3775bb288d0fea4a1b1857ba8935bfe7f03

SHA256
54e017441f251b245e93010d8905a3c4bb920642292ac826bb838e905be70ef8

SHA512
549c0d64adab09b94c73bd93a3bfd0dea658cd0925f411bcc09e5e0f162291d6e084f6c71a4cd806a6b19e8dbec01295f1b96ce173cc3ab74b98cf5099e782ce

Download Submit
C:\Windows\System\pOuLlew.exe

Filesize
1.5MB

MD5
5eeda77dec2770a3eb6b338711e1c951

SHA1
05e19bb1f31fc7288d341cddfb233f094dc61161

SHA256
f427f172780f97f343fb76774b19af1df70f7570055b577d07557ed3c90a9356

SHA512
9f7a56e429204fc940f3da0ba8d185ccb6968915ef0e4ad468b4ccbb9635ada8e8fe2420c97b8c943f9df98ee3180cce57a9d91c5946b2ee9bae6463af1e1c21

Download Submit
C:\Windows\System\qQcWiql.exe

Filesize
1.5MB

MD5
a8b06a0faea029b1dfbcf5e0fec06726

SHA1
615f00ec2b83fb5490cade06b5e50074228f8c4f

SHA256
e3590d6874c633939e9fdad31bbd4ba72440ba5520bdce8f6e928cfac6daebb0

SHA512
5609ef97be8a0fb26eea59ac6602e82413133b6919d0f9e3c28ec0ec488330d5ef51f7812c9f409f05ef0f652ec26b3ac6826b4d2aed571a5c630ce724d7c273

Download Submit
C:\Windows\System\qbBlokQ.exe

Filesize
1.5MB

MD5
562f7378e1df06e1379e6da9f6a59436

SHA1
7bfccfef9a90819dcda3c2cdd130231ece678a28

SHA256
10da6387e87f12aac6f9a110cee5242ec032db116048dee92fdd1df76d4f01cb

SHA512
dd8263d73b55b8671fb933aea062a64e09cba839a61b8ab6a9ddb354a3687d7d2f1bb5adcf2c51758da519264c1291828c98eaf64a0fcec840cb4427106d3f3d

Download Submit
C:\Windows\System\qzDDzru.exe

Filesize
1.5MB

MD5
f85499f018b06486d1b75c9b6e54b5f5

SHA1
b3a80222a8cfda5e66fe97857482a72a55a335b9

SHA256
76bafded37c6f2a55f4b6abe04cdc3ee6ac95cddf8525357c0f9a12eb7072c1c

SHA512
f4f049f29b9528c65bc3bc6a224f783e048d070447d77ac1a6d9529e3af14ea068a1552c86125b5c5285393a803793e71fd4cd5c41c4c3e7add6f3365e85ed68

Download Submit
C:\Windows\System\rNmdrEw.exe

Filesize
1.5MB

MD5
606707c077df5a763015ba33e3076238

SHA1
99d92e46f44bc66ca96f4deadc5e6d7cfb6ef986

SHA256
ac7f7edd733dc174dda907a3e2298f22f9ebd413a484c7171c2db9b70e1a8d11

SHA512
f1a2adff3d73220260ac02cfc3a2d9dba0fa4a943c46fa01bb34ed10dca6ab06a37f4adb4c75015c8ce62655ce4e815c393f850d17aadd40141638f4020c792b

Download Submit
C:\Windows\System\rmpDRAL.exe

Filesize
1.5MB

MD5
6783a219b4b7da0522763d7a5f6c9768

SHA1
ac4cf3956ac0fcf618df1cf9910abad011aa8ecc

SHA256
222a06da26d4b8e35892c5ba3a27804b568b9f8041b1878f899d5d192e1c035c

SHA512
17c9df2ebb022a3c55d300bfd53923ee55c163c8102c77054300d4e32179213105595bd1c3378316d4884c4e825d056b63d05017b02d323155d8b1bb36d770b4

Download Submit
C:\Windows\System\sfnfsSo.exe

Filesize
1.5MB

MD5
78f3449d69616679e109eb83341fb492

SHA1
f96d5e7b801361b67e6d375d9d848fcef54f2c3e

SHA256
96aaa6fb9f57bce64919ab4b234cf6516ebeee7150148eccb623e8779b3a0331

SHA512
da0fe703e93a6ed33576f197f8b8a8707577788629589c3e195fe4beed0f57272acf062f35dd2daefb97bee7174f971e39440006aa62afaabc7467a3d3afa08d

Download Submit
C:\Windows\System\uMGLzHV.exe

Filesize
1.5MB

MD5
a03fcfa2498eebbe77c8cd9ae717b6fc

SHA1
daf15da80e39038353de7d964ffd170bf0b69ef5

SHA256
c34468a1c87e77ba62b36e811e1105e86d4eafebb0e9a26fd4a57006eeba9a5f

SHA512
67e3f19a5b68679d334dce3af8202f2d9b75171572d2b877d3d06a6cf788f901f63283f8338763b927ade44ad66492de2740c07662452c5b65a0da5b985aadcb

Download Submit
C:\Windows\System\unTrdsk.exe

Filesize
1.5MB

MD5
83900142063cddb0407da6031db4f656

SHA1
0b9f2d14715fce9b276598fad63c066522fc5dbc

SHA256
5f90c8b5cc0a1c94267833d13d27b7d10acd854fe32ec605a5911601fbdadc63

SHA512
15edffdb8b4297a8802c42c59e24bf57d75eb93758c4f5a3f31ff71ceabf7ead1c0c84e2d3f5b36089061cb6eac2b2cdcf19b52cf1b687faf8d8014dc342bf88

Download Submit
C:\Windows\System\xFnwMjh.exe

Filesize
8B

MD5
6c6a33c852f4e05ffd14cdf0dcab7779

SHA1
70449821f99925d7b8d245181569b7ac4d2ffae8

SHA256
889f3baefc9f46c7632a467db8882ec92f1f0df14da91d5a211e7484de261e45

SHA512
92e5654661ef50c470f84dbec4dcad9efdca5e4026c073f08c798af48c0b5d8107a7b2ff4d63fdb982f371e15d79e95f8a6d716a30b5c5123a7273c49d650d19

Download Submit
C:\Windows\System\yOkiYUt.exe

Filesize
1.5MB

MD5
5b6d9581ce4b2bd5d40a8f6c6922e73b

SHA1
3438dfb1bce9d14ac3238ac25f9652b14ccdfcb5

SHA256
ceb4ff0bd89b55c4aef74bedf935e5b1163dc6ed72683cdca0775ba3415b306f

SHA512
1c6ae9c924dfaaf8eb479e4200d31d1067ae6645fd55369f955a0c66c62fcacec5c3a70393cf63ed846cf87c4919912d5da68ff03466b5f4635ba728e8aca38d

Download Submit
C:\Windows\System\yXLQEZo.exe

Filesize
1.5MB

MD5
e5ef580e4448968fc16967ec1953b6a3

SHA1
198a9bfb1070faf50b9ae488f0d8139d8a2766cc

SHA256
ac1fbb2a7622225b01c75a196db51135fb91a440549257ca8b5733453d71c9e9

SHA512
781e953640e03e6e8f85efa5e4fcf3c65f1f3a9bd70298312fe5f8b16f27586f62c2af77d9066d7f1cd2b978a9a41ed29cc8a60642e6f2cb1bc9bc57c43998c8

Download Submit
C:\Windows\System\ydKbWfZ.exe

Filesize
1.5MB

MD5
d29e5d3cf116e83e1d9c5aea52de5368

SHA1
4be5400d27084a851ab74a85aa61211c440d482e

SHA256
d710937cd6ff10b8caf3f1874f3ee7985b7e029144bd0991bff7bcc353fe7227

SHA512
91a6d27d0e874aff1efd55e960005ef048002847b27fb2fa98b0cff53641c479b87a54ccbe71843e9682b9b7834633b11def0acef260ad9e9cc26709624a8e62

Download Submit
memory/548-172-0x00007FF6D2750000-0x00007FF6D2B42000-memory.dmp

Filesize
3.9MB

Download
memory/548-0-0x00007FF6D2750000-0x00007FF6D2B42000-memory.dmp

Filesize
3.9MB

Download
memory/548-1-0x000001F1BCA70000-0x000001F1BCA80000-memory.dmp

Filesize
64KB

Download
memory/1088-77-0x00007FF7E1320000-0x00007FF7E1712000-memory.dmp

Filesize
3.9MB

Download
memory/1088-2708-0x00007FF7E1320000-0x00007FF7E1712000-memory.dmp

Filesize
3.9MB

Download
memory/1624-123-0x00007FF70DAE0000-0x00007FF70DED2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-2781-0x00007FF70DAE0000-0x00007FF70DED2000-memory.dmp

Filesize
3.9MB

Download
memory/1744-2779-0x00007FF76BB00000-0x00007FF76BEF2000-memory.dmp

Filesize
3.9MB

Download
memory/1744-127-0x00007FF76BB00000-0x00007FF76BEF2000-memory.dmp

Filesize
3.9MB

Download
memory/1796-2728-0x00007FF6271A0000-0x00007FF627592000-memory.dmp

Filesize
3.9MB

Download
memory/1796-81-0x00007FF6271A0000-0x00007FF627592000-memory.dmp

Filesize
3.9MB

Download
memory/2028-2698-0x00007FF66E060000-0x00007FF66E452000-memory.dmp

Filesize
3.9MB

Download
memory/2028-60-0x00007FF66E060000-0x00007FF66E452000-memory.dmp

Filesize
3.9MB

Download
memory/2392-2828-0x00007FF7273E0000-0x00007FF7277D2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-166-0x00007FF7273E0000-0x00007FF7277D2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-2691-0x00007FF6FF730000-0x00007FF6FFB22000-memory.dmp

Filesize
3.9MB

Download
memory/2412-76-0x00007FF6FF730000-0x00007FF6FFB22000-memory.dmp

Filesize
3.9MB

Download
memory/2432-78-0x00007FF75DFF0000-0x00007FF75E3E2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-2722-0x00007FF75DFF0000-0x00007FF75E3E2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-178-0x00007FF7B2580000-0x00007FF7B2972000-memory.dmp

Filesize
3.9MB

Download
memory/2600-2832-0x00007FF7B2580000-0x00007FF7B2972000-memory.dmp

Filesize
3.9MB

Download
memory/2868-73-0x00007FF6E8AA0000-0x00007FF6E8E92000-memory.dmp

Filesize
3.9MB

Download
memory/2868-2040-0x00007FF6E8AA0000-0x00007FF6E8E92000-memory.dmp

Filesize
3.9MB

Download
memory/2868-2751-0x00007FF6E8AA0000-0x00007FF6E8E92000-memory.dmp

Filesize
3.9MB

Download
memory/3372-70-0x00007FF6E1380000-0x00007FF6E1772000-memory.dmp

Filesize
3.9MB

Download
memory/3372-2716-0x00007FF6E1380000-0x00007FF6E1772000-memory.dmp

Filesize
3.9MB

Download
memory/3480-2598-0x00007FF689030000-0x00007FF689422000-memory.dmp

Filesize
3.9MB

Download
memory/3480-142-0x00007FF689030000-0x00007FF689422000-memory.dmp

Filesize
3.9MB

Download
memory/3480-2802-0x00007FF689030000-0x00007FF689422000-memory.dmp

Filesize
3.9MB

Download
memory/3624-2507-0x00007FF6D9A70000-0x00007FF6D9E62000-memory.dmp

Filesize
3.9MB

Download
memory/3624-114-0x00007FF6D9A70000-0x00007FF6D9E62000-memory.dmp

Filesize
3.9MB

Download
memory/3656-89-0x00007FF76D2C0000-0x00007FF76D6B2000-memory.dmp

Filesize
3.9MB

Download
memory/3660-2825-0x00007FF7F3000000-0x00007FF7F33F2000-memory.dmp

Filesize
3.9MB

Download
memory/3660-154-0x00007FF7F3000000-0x00007FF7F33F2000-memory.dmp

Filesize
3.9MB

Download
memory/4128-2812-0x00007FF66A570000-0x00007FF66A962000-memory.dmp

Filesize
3.9MB

Download
memory/4128-148-0x00007FF66A570000-0x00007FF66A962000-memory.dmp

Filesize
3.9MB

Download
memory/4128-2599-0x00007FF66A570000-0x00007FF66A962000-memory.dmp

Filesize
3.9MB

Download
memory/4188-2696-0x00007FF6B23F0000-0x00007FF6B27E2000-memory.dmp

Filesize
3.9MB

Download
memory/4188-64-0x00007FF6B23F0000-0x00007FF6B27E2000-memory.dmp

Filesize
3.9MB

Download
memory/4256-68-0x00007FF6E1EE0000-0x00007FF6E22D2000-memory.dmp

Filesize
3.9MB

Download
memory/4256-2704-0x00007FF6E1EE0000-0x00007FF6E22D2000-memory.dmp

Filesize
3.9MB

Download
memory/4316-2736-0x00007FF608100000-0x00007FF6084F2000-memory.dmp

Filesize
3.9MB

Download
memory/4316-85-0x00007FF608100000-0x00007FF6084F2000-memory.dmp

Filesize
3.9MB

Download
memory/4388-442-0x0000020A23BB0000-0x0000020A24356000-memory.dmp

Filesize
7.6MB

Download
memory/4388-5-0x00007FF91CB53000-0x00007FF91CB55000-memory.dmp

Filesize
8KB

Download
memory/4388-42-0x0000020A22F80000-0x0000020A22FA2000-memory.dmp

Filesize
136KB

Download
memory/4388-56-0x00007FF91CB50000-0x00007FF91D611000-memory.dmp

Filesize
10.8MB

Download
memory/4388-26-0x00007FF91CB50000-0x00007FF91D611000-memory.dmp

Filesize
10.8MB

Download
memory/4388-2771-0x00007FF91CB50000-0x00007FF91D611000-memory.dmp

Filesize
10.8MB

Download
memory/4388-1444-0x00007FF91CB53000-0x00007FF91CB55000-memory.dmp

Filesize
8KB

Download
memory/4388-165-0x00007FF91CB50000-0x00007FF91D611000-memory.dmp

Filesize
10.8MB

Download
memory/4388-1445-0x00007FF91CB50000-0x00007FF91D611000-memory.dmp

Filesize
10.8MB

Download
memory/4460-2798-0x00007FF7BCFD0000-0x00007FF7BD3C2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-2597-0x00007FF7BCFD0000-0x00007FF7BD3C2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-131-0x00007FF7BCFD0000-0x00007FF7BD3C2000-memory.dmp

Filesize
3.9MB

Download
memory/4488-47-0x00007FF73C8E0000-0x00007FF73CCD2000-memory.dmp

Filesize
3.9MB

Download
memory/4488-2682-0x00007FF73C8E0000-0x00007FF73CCD2000-memory.dmp

Filesize
3.9MB

Download
memory/4660-113-0x00007FF65B9C0000-0x00007FF65BDB2000-memory.dmp

Filesize
3.9MB

Download
memory/4660-3543-0x00007FF65B9C0000-0x00007FF65BDB2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-96-0x00007FF60F100000-0x00007FF60F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-2769-0x00007FF60F100000-0x00007FF60F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-2501-0x00007FF60F100000-0x00007FF60F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-106-0x00007FF7968F0000-0x00007FF796CE2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-2772-0x00007FF7968F0000-0x00007FF796CE2000-memory.dmp

Filesize
3.9MB

Download