xmrig | cfadb57231db888cebbcbcbb19b3ccfb9dc2272dc19b15ae229d200c2aeb07af

Analysis

max time kernel
97s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
Size

1.6MB
MD5

7a6fc1cdbf370f9d71f1e098f8cbafc0
SHA1

f3c142d7fe60b5d3779c2c53ee83059c2444624b
SHA256

cfadb57231db888cebbcbcbb19b3ccfb9dc2272dc19b15ae229d200c2aeb07af
SHA512

897f1dcf05d574e21371c050d7965209068c43d5da3322d1e369fcd9055c3724dea1566682de65174c4c1513a2cb240a2081a5f9a84864cda98431398ce932d3
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCvH3z8RMfJF5W:Lz071uv4BPMkFfdgIZohteLPD8N

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/1800-296-0x00007FF69B470000-0x00007FF69B862000-memory.dmp	xmrig
behavioral2/memory/3976-416-0x00007FF760390000-0x00007FF760782000-memory.dmp	xmrig
behavioral2/memory/2312-493-0x00007FF70A070000-0x00007FF70A462000-memory.dmp	xmrig
behavioral2/memory/4584-569-0x00007FF6A1E40000-0x00007FF6A2232000-memory.dmp	xmrig
behavioral2/memory/4580-573-0x00007FF6331A0000-0x00007FF633592000-memory.dmp	xmrig
behavioral2/memory/3356-572-0x00007FF637C40000-0x00007FF638032000-memory.dmp	xmrig
behavioral2/memory/2416-571-0x00007FF7EEDA0000-0x00007FF7EF192000-memory.dmp	xmrig
behavioral2/memory/4812-570-0x00007FF662090000-0x00007FF662482000-memory.dmp	xmrig
behavioral2/memory/4680-568-0x00007FF7DC230000-0x00007FF7DC622000-memory.dmp	xmrig
behavioral2/memory/2520-567-0x00007FF781030000-0x00007FF781422000-memory.dmp	xmrig
behavioral2/memory/216-566-0x00007FF7E0220000-0x00007FF7E0612000-memory.dmp	xmrig
behavioral2/memory/2940-488-0x00007FF659100000-0x00007FF6594F2000-memory.dmp	xmrig
behavioral2/memory/1648-372-0x00007FF6FFC90000-0x00007FF700082000-memory.dmp	xmrig
behavioral2/memory/3544-323-0x00007FF7ACC10000-0x00007FF7AD002000-memory.dmp	xmrig
behavioral2/memory/244-322-0x00007FF7B8720000-0x00007FF7B8B12000-memory.dmp	xmrig
behavioral2/memory/4848-269-0x00007FF603F00000-0x00007FF6042F2000-memory.dmp	xmrig
behavioral2/memory/3452-230-0x00007FF7A2CF0000-0x00007FF7A30E2000-memory.dmp	xmrig
behavioral2/memory/1864-196-0x00007FF7AEA20000-0x00007FF7AEE12000-memory.dmp	xmrig
behavioral2/memory/4240-149-0x00007FF7BA850000-0x00007FF7BAC42000-memory.dmp	xmrig
behavioral2/memory/1572-163-0x00007FF632490000-0x00007FF632882000-memory.dmp	xmrig
behavioral2/memory/2124-81-0x00007FF7A6720000-0x00007FF7A6B12000-memory.dmp	xmrig
behavioral2/memory/828-2703-0x00007FF64C7A0000-0x00007FF64CB92000-memory.dmp	xmrig
behavioral2/memory/3952-2705-0x00007FF711240000-0x00007FF711632000-memory.dmp	xmrig
behavioral2/memory/5004-2704-0x00007FF6BB7D0000-0x00007FF6BBBC2000-memory.dmp	xmrig
behavioral2/memory/828-2707-0x00007FF64C7A0000-0x00007FF64CB92000-memory.dmp	xmrig
behavioral2/memory/1864-2709-0x00007FF7AEA20000-0x00007FF7AEE12000-memory.dmp	xmrig
behavioral2/memory/4240-2711-0x00007FF7BA850000-0x00007FF7BAC42000-memory.dmp	xmrig
behavioral2/memory/4812-2713-0x00007FF662090000-0x00007FF662482000-memory.dmp	xmrig
behavioral2/memory/5004-2715-0x00007FF6BB7D0000-0x00007FF6BBBC2000-memory.dmp	xmrig
behavioral2/memory/3452-2717-0x00007FF7A2CF0000-0x00007FF7A30E2000-memory.dmp	xmrig
behavioral2/memory/3952-2719-0x00007FF711240000-0x00007FF711632000-memory.dmp	xmrig
behavioral2/memory/2124-2721-0x00007FF7A6720000-0x00007FF7A6B12000-memory.dmp	xmrig
behavioral2/memory/3356-2725-0x00007FF637C40000-0x00007FF638032000-memory.dmp	xmrig
behavioral2/memory/1572-2727-0x00007FF632490000-0x00007FF632882000-memory.dmp	xmrig
behavioral2/memory/4848-2731-0x00007FF603F00000-0x00007FF6042F2000-memory.dmp	xmrig
behavioral2/memory/3976-2730-0x00007FF760390000-0x00007FF760782000-memory.dmp	xmrig
behavioral2/memory/4584-2723-0x00007FF6A1E40000-0x00007FF6A2232000-memory.dmp	xmrig
behavioral2/memory/2940-2747-0x00007FF659100000-0x00007FF6594F2000-memory.dmp	xmrig
behavioral2/memory/4580-2755-0x00007FF6331A0000-0x00007FF633592000-memory.dmp	xmrig
behavioral2/memory/244-2751-0x00007FF7B8720000-0x00007FF7B8B12000-memory.dmp	xmrig
behavioral2/memory/3544-2749-0x00007FF7ACC10000-0x00007FF7AD002000-memory.dmp	xmrig
behavioral2/memory/1800-2743-0x00007FF69B470000-0x00007FF69B862000-memory.dmp	xmrig
behavioral2/memory/2520-2742-0x00007FF781030000-0x00007FF781422000-memory.dmp	xmrig
behavioral2/memory/2312-2735-0x00007FF70A070000-0x00007FF70A462000-memory.dmp	xmrig
behavioral2/memory/1648-2734-0x00007FF6FFC90000-0x00007FF700082000-memory.dmp	xmrig
behavioral2/memory/216-2746-0x00007FF7E0220000-0x00007FF7E0612000-memory.dmp	xmrig
behavioral2/memory/4680-2739-0x00007FF7DC230000-0x00007FF7DC622000-memory.dmp	xmrig
behavioral2/memory/2416-2738-0x00007FF7EEDA0000-0x00007FF7EF192000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4368	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
828	kBVmAQb.exe
4584	CpVvWOg.exe
5004	xkTCahq.exe
3952	QqnOGyP.exe
2124	KvBsodF.exe
4240	dCReZyl.exe
4812	iNcXlYK.exe
1572	AOtdjaP.exe
1864	TIlIHsj.exe
2416	DMeTXtX.exe
3452	NGROPUf.exe
4848	IeCdRxa.exe
1800	RRXgzzk.exe
3356	OwXnFYV.exe
244	rOUtxvj.exe
3544	kMEUPTn.exe
1648	BIThgas.exe
3976	WWjrckx.exe
2940	NQGZeke.exe
2312	DkiUuho.exe
216	fbbcDhS.exe
2520	LhgPLDA.exe
4680	bdFSYwo.exe
4580	ZkhvkWz.exe
1224	VPEBfTu.exe
3996	gtxIbKY.exe
1084	dKRdAGA.exe
380	OAKJIjK.exe
1544	ZxbNDQA.exe
1140	BDsPmGJ.exe
2176	jTCrodr.exe
4012	ehiUgzL.exe
824	HBXqAZb.exe
1852	vWfMIQM.exe
700	mZHPoeT.exe
3244	cjxzYPG.exe
2012	gMBTSyq.exe
368	kWfWuWh.exe
456	anuaetx.exe
4116	FgHoxzS.exe
3604	dbcsKXo.exe
1124	cZrwXia.exe
944	svWaagc.exe
5008	WowrpoQ.exe
4300	QCsIfsC.exe
4404	klcgjCU.exe
3548	ypALbug.exe
4104	Wwpktui.exe
2136	gdTaHhm.exe
2092	ebiLdFM.exe
3436	VxGtZBu.exe
2600	JnSkQEs.exe
2608	tdqoJIs.exe
2128	PyxFhrA.exe
1868	qOftoVO.exe
4216	LpbGopO.exe
4100	QbSYOxm.exe
648	VadMamn.exe
4740	BGEZeXS.exe
2472	wulwplJ.exe
4596	lYKbSqs.exe
4380	akfpjlP.exe
3136	ycjwVzq.exe
4316	owLxVTI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3768-0-0x00007FF6B63D0000-0x00007FF6B67C2000-memory.dmp	upx
behavioral2/files/0x00070000000234ef-7.dat	upx
behavioral2/files/0x00080000000234eb-5.dat	upx
behavioral2/files/0x00070000000234f1-27.dat	upx
behavioral2/files/0x00070000000234f8-64.dat	upx
behavioral2/files/0x0007000000023500-129.dat	upx
behavioral2/files/0x0007000000023510-175.dat	upx
behavioral2/memory/1800-296-0x00007FF69B470000-0x00007FF69B862000-memory.dmp	upx
behavioral2/memory/3976-416-0x00007FF760390000-0x00007FF760782000-memory.dmp	upx
behavioral2/memory/2312-493-0x00007FF70A070000-0x00007FF70A462000-memory.dmp	upx
behavioral2/memory/4584-569-0x00007FF6A1E40000-0x00007FF6A2232000-memory.dmp	upx
behavioral2/memory/4580-573-0x00007FF6331A0000-0x00007FF633592000-memory.dmp	upx
behavioral2/memory/3356-572-0x00007FF637C40000-0x00007FF638032000-memory.dmp	upx
behavioral2/memory/2416-571-0x00007FF7EEDA0000-0x00007FF7EF192000-memory.dmp	upx
behavioral2/memory/4812-570-0x00007FF662090000-0x00007FF662482000-memory.dmp	upx
behavioral2/memory/4680-568-0x00007FF7DC230000-0x00007FF7DC622000-memory.dmp	upx
behavioral2/memory/2520-567-0x00007FF781030000-0x00007FF781422000-memory.dmp	upx
behavioral2/memory/216-566-0x00007FF7E0220000-0x00007FF7E0612000-memory.dmp	upx
behavioral2/memory/2940-488-0x00007FF659100000-0x00007FF6594F2000-memory.dmp	upx
behavioral2/memory/1648-372-0x00007FF6FFC90000-0x00007FF700082000-memory.dmp	upx
behavioral2/memory/3544-323-0x00007FF7ACC10000-0x00007FF7AD002000-memory.dmp	upx
behavioral2/memory/244-322-0x00007FF7B8720000-0x00007FF7B8B12000-memory.dmp	upx
behavioral2/memory/4848-269-0x00007FF603F00000-0x00007FF6042F2000-memory.dmp	upx
behavioral2/memory/3452-230-0x00007FF7A2CF0000-0x00007FF7A30E2000-memory.dmp	upx
behavioral2/memory/1864-196-0x00007FF7AEA20000-0x00007FF7AEE12000-memory.dmp	upx
behavioral2/files/0x0007000000023504-181.dat	upx
behavioral2/files/0x0007000000023505-179.dat	upx
behavioral2/files/0x0007000000023511-178.dat	upx
behavioral2/files/0x000700000002350b-176.dat	upx
behavioral2/files/0x0007000000023509-173.dat	upx
behavioral2/files/0x000700000002350f-172.dat	upx
behavioral2/files/0x000700000002350e-171.dat	upx
behavioral2/files/0x00070000000234fd-154.dat	upx
behavioral2/files/0x00070000000234fc-152.dat	upx
behavioral2/files/0x000700000002350c-151.dat	upx
behavioral2/memory/4240-149-0x00007FF7BA850000-0x00007FF7BAC42000-memory.dmp	upx
behavioral2/files/0x000700000002350a-144.dat	upx
behavioral2/files/0x0007000000023503-139.dat	upx
behavioral2/files/0x0007000000023502-136.dat	upx
behavioral2/files/0x00070000000234fa-132.dat	upx
behavioral2/files/0x00070000000234f9-131.dat	upx
behavioral2/files/0x0007000000023508-128.dat	upx
behavioral2/files/0x0007000000023507-127.dat	upx
behavioral2/files/0x0007000000023506-125.dat	upx
behavioral2/files/0x00070000000234fe-169.dat	upx
behavioral2/files/0x000700000002350d-168.dat	upx
behavioral2/memory/1572-163-0x00007FF632490000-0x00007FF632882000-memory.dmp	upx
behavioral2/files/0x00070000000234f7-124.dat	upx
behavioral2/files/0x0007000000023501-112.dat	upx
behavioral2/files/0x00070000000234ff-104.dat	upx
behavioral2/files/0x00070000000234f5-92.dat	upx
behavioral2/files/0x00070000000234fb-84.dat	upx
behavioral2/memory/2124-81-0x00007FF7A6720000-0x00007FF7A6B12000-memory.dmp	upx
behavioral2/memory/3952-77-0x00007FF711240000-0x00007FF711632000-memory.dmp	upx
behavioral2/files/0x00070000000234f4-65.dat	upx
behavioral2/files/0x00070000000234f0-59.dat	upx
behavioral2/files/0x00080000000234ee-55.dat	upx
behavioral2/files/0x00070000000234f3-52.dat	upx
behavioral2/files/0x00070000000234f2-44.dat	upx
behavioral2/files/0x00070000000234f6-40.dat	upx
behavioral2/memory/5004-37-0x00007FF6BB7D0000-0x00007FF6BBBC2000-memory.dmp	upx
behavioral2/memory/828-31-0x00007FF64C7A0000-0x00007FF64CB92000-memory.dmp	upx
behavioral2/memory/828-2703-0x00007FF64C7A0000-0x00007FF64CB92000-memory.dmp	upx
behavioral2/memory/3952-2705-0x00007FF711240000-0x00007FF711632000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uiAabnN.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\PLmtkqq.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\TmdRZyL.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\APxeYQA.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\pKhdSXZ.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\hKHEbqg.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\HDhhLpn.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\GiNgudt.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\zYOLkJb.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\iYkHnjq.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\jIyVVZr.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\EPNdtdG.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\LAbUaNt.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\UmsFtuH.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\NPWdhed.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\ytpiMGJ.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\KjflXoV.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\fZOjwRX.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\RCEJmmN.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\QcNmYLn.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\WNRJXdQ.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\keYLvRH.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\jxsiLUh.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\qZgUUUT.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\EhWmwSR.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\cViRWVx.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\wqaTFgi.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\siZmQkB.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\hkPhirI.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\rEtwwdF.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\fDnwMHI.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\rCppCrL.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\XbBLsUa.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\SqvlPZj.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\VMUFzKH.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\rjUHnzR.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\EYuLbFA.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\RTUigca.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\HIItQnF.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\NnJkrZR.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\oxAQaIe.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\ANXdXew.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\luZoglW.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\dqPqfes.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\jJErXSY.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\FwwrTIK.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\UTSeeeB.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\BIqqzMo.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\WLnKrUR.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\VEGrcdm.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\UTgarza.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\yEpNwbo.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\cJfuixo.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\wpQbBZD.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\btIhCWQ.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\QVMKfLB.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\NBiLyrH.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\fDBeUVZ.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\UPtMtTS.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\WwCjmuk.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\aOJRdmI.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\lktzLAN.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\IyuAURz.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
File created	C:\Windows\System\qJJvwxs.exe	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4368	powershell.exe
4368	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
Token: SeLockMemoryPrivilege	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
Token: SeDebugPrivilege	4368	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 4368	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	84
PID 3768 wrote to memory of 4368	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	84
PID 3768 wrote to memory of 828	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	85
PID 3768 wrote to memory of 828	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	85
PID 3768 wrote to memory of 5004	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	86
PID 3768 wrote to memory of 5004	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	86
PID 3768 wrote to memory of 4584	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	87
PID 3768 wrote to memory of 4584	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	87
PID 3768 wrote to memory of 3952	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	88
PID 3768 wrote to memory of 3952	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	88
PID 3768 wrote to memory of 2124	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	89
PID 3768 wrote to memory of 2124	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	89
PID 3768 wrote to memory of 4240	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	90
PID 3768 wrote to memory of 4240	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	90
PID 3768 wrote to memory of 4812	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	91
PID 3768 wrote to memory of 4812	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	91
PID 3768 wrote to memory of 3452	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	92
PID 3768 wrote to memory of 3452	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	92
PID 3768 wrote to memory of 1572	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	93
PID 3768 wrote to memory of 1572	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	93
PID 3768 wrote to memory of 1864	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	94
PID 3768 wrote to memory of 1864	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	94
PID 3768 wrote to memory of 2416	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	95
PID 3768 wrote to memory of 2416	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	95
PID 3768 wrote to memory of 4848	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	96
PID 3768 wrote to memory of 4848	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	96
PID 3768 wrote to memory of 1800	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	97
PID 3768 wrote to memory of 1800	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	97
PID 3768 wrote to memory of 216	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	98
PID 3768 wrote to memory of 216	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	98
PID 3768 wrote to memory of 3356	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	99
PID 3768 wrote to memory of 3356	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	99
PID 3768 wrote to memory of 244	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	100
PID 3768 wrote to memory of 244	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	100
PID 3768 wrote to memory of 3544	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	101
PID 3768 wrote to memory of 3544	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	101
PID 3768 wrote to memory of 1648	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	102
PID 3768 wrote to memory of 1648	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	102
PID 3768 wrote to memory of 3976	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	103
PID 3768 wrote to memory of 3976	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	103
PID 3768 wrote to memory of 2940	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	104
PID 3768 wrote to memory of 2940	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	104
PID 3768 wrote to memory of 2312	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	105
PID 3768 wrote to memory of 2312	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	105
PID 3768 wrote to memory of 2520	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	106
PID 3768 wrote to memory of 2520	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	106
PID 3768 wrote to memory of 4680	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	107
PID 3768 wrote to memory of 4680	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	107
PID 3768 wrote to memory of 4580	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	108
PID 3768 wrote to memory of 4580	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	108
PID 3768 wrote to memory of 1224	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	109
PID 3768 wrote to memory of 1224	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	109
PID 3768 wrote to memory of 3996	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	110
PID 3768 wrote to memory of 3996	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	110
PID 3768 wrote to memory of 1084	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	111
PID 3768 wrote to memory of 1084	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	111
PID 3768 wrote to memory of 380	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	112
PID 3768 wrote to memory of 380	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	112
PID 3768 wrote to memory of 1544	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	113
PID 3768 wrote to memory of 1544	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	113
PID 3768 wrote to memory of 1140	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	114
PID 3768 wrote to memory of 1140	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	114
PID 3768 wrote to memory of 2176	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	115
PID 3768 wrote to memory of 2176	3768	7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe	115

C:\Users\Admin\AppData\Local\Temp\7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe
"C:\Users\Admin\AppData\Local\Temp\7a6fc1cdbf370f9d71f1e098f8cbafc0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4368
- C:\Windows\System\kBVmAQb.exe
  C:\Windows\System\kBVmAQb.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\xkTCahq.exe
  C:\Windows\System\xkTCahq.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\CpVvWOg.exe
  C:\Windows\System\CpVvWOg.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\QqnOGyP.exe
  C:\Windows\System\QqnOGyP.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\KvBsodF.exe
  C:\Windows\System\KvBsodF.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\dCReZyl.exe
  C:\Windows\System\dCReZyl.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\iNcXlYK.exe
  C:\Windows\System\iNcXlYK.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\NGROPUf.exe
  C:\Windows\System\NGROPUf.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\AOtdjaP.exe
  C:\Windows\System\AOtdjaP.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\TIlIHsj.exe
  C:\Windows\System\TIlIHsj.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\DMeTXtX.exe
  C:\Windows\System\DMeTXtX.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\IeCdRxa.exe
  C:\Windows\System\IeCdRxa.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\RRXgzzk.exe
  C:\Windows\System\RRXgzzk.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\fbbcDhS.exe
  C:\Windows\System\fbbcDhS.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\OwXnFYV.exe
  C:\Windows\System\OwXnFYV.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\rOUtxvj.exe
  C:\Windows\System\rOUtxvj.exe
  2⤵
  - Executes dropped EXE
  PID:244
- C:\Windows\System\kMEUPTn.exe
  C:\Windows\System\kMEUPTn.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\BIThgas.exe
  C:\Windows\System\BIThgas.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\WWjrckx.exe
  C:\Windows\System\WWjrckx.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\NQGZeke.exe
  C:\Windows\System\NQGZeke.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\DkiUuho.exe
  C:\Windows\System\DkiUuho.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\LhgPLDA.exe
  C:\Windows\System\LhgPLDA.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\bdFSYwo.exe
  C:\Windows\System\bdFSYwo.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\ZkhvkWz.exe
  C:\Windows\System\ZkhvkWz.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\VPEBfTu.exe
  C:\Windows\System\VPEBfTu.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\gtxIbKY.exe
  C:\Windows\System\gtxIbKY.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\dKRdAGA.exe
  C:\Windows\System\dKRdAGA.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\OAKJIjK.exe
  C:\Windows\System\OAKJIjK.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\ZxbNDQA.exe
  C:\Windows\System\ZxbNDQA.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\BDsPmGJ.exe
  C:\Windows\System\BDsPmGJ.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\jTCrodr.exe
  C:\Windows\System\jTCrodr.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\ehiUgzL.exe
  C:\Windows\System\ehiUgzL.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\HBXqAZb.exe
  C:\Windows\System\HBXqAZb.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\vWfMIQM.exe
  C:\Windows\System\vWfMIQM.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\mZHPoeT.exe
  C:\Windows\System\mZHPoeT.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\cjxzYPG.exe
  C:\Windows\System\cjxzYPG.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\gMBTSyq.exe
  C:\Windows\System\gMBTSyq.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\kWfWuWh.exe
  C:\Windows\System\kWfWuWh.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\anuaetx.exe
  C:\Windows\System\anuaetx.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\FgHoxzS.exe
  C:\Windows\System\FgHoxzS.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\dbcsKXo.exe
  C:\Windows\System\dbcsKXo.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\cZrwXia.exe
  C:\Windows\System\cZrwXia.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\svWaagc.exe
  C:\Windows\System\svWaagc.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\WowrpoQ.exe
  C:\Windows\System\WowrpoQ.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\QCsIfsC.exe
  C:\Windows\System\QCsIfsC.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\klcgjCU.exe
  C:\Windows\System\klcgjCU.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\ypALbug.exe
  C:\Windows\System\ypALbug.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\Wwpktui.exe
  C:\Windows\System\Wwpktui.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\akfpjlP.exe
  C:\Windows\System\akfpjlP.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\gdTaHhm.exe
  C:\Windows\System\gdTaHhm.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\ebiLdFM.exe
  C:\Windows\System\ebiLdFM.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\VxGtZBu.exe
  C:\Windows\System\VxGtZBu.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\JnSkQEs.exe
  C:\Windows\System\JnSkQEs.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\tdqoJIs.exe
  C:\Windows\System\tdqoJIs.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\PyxFhrA.exe
  C:\Windows\System\PyxFhrA.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\qOftoVO.exe
  C:\Windows\System\qOftoVO.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\LpbGopO.exe
  C:\Windows\System\LpbGopO.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\QbSYOxm.exe
  C:\Windows\System\QbSYOxm.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\VadMamn.exe
  C:\Windows\System\VadMamn.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\BGEZeXS.exe
  C:\Windows\System\BGEZeXS.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\wulwplJ.exe
  C:\Windows\System\wulwplJ.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\lYKbSqs.exe
  C:\Windows\System\lYKbSqs.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\ycjwVzq.exe
  C:\Windows\System\ycjwVzq.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\owLxVTI.exe
  C:\Windows\System\owLxVTI.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\FCRdJwj.exe
  C:\Windows\System\FCRdJwj.exe
  2⤵
  PID:4472
- C:\Windows\System\fFRuqYW.exe
  C:\Windows\System\fFRuqYW.exe
  2⤵
  PID:4632
- C:\Windows\System\TWeyGPx.exe
  C:\Windows\System\TWeyGPx.exe
  2⤵
  PID:4484
- C:\Windows\System\AMRgzIP.exe
  C:\Windows\System\AMRgzIP.exe
  2⤵
  PID:860
- C:\Windows\System\rJdRijy.exe
  C:\Windows\System\rJdRijy.exe
  2⤵
  PID:2272
- C:\Windows\System\xjGhRov.exe
  C:\Windows\System\xjGhRov.exe
  2⤵
  PID:2904
- C:\Windows\System\IpyvXGh.exe
  C:\Windows\System\IpyvXGh.exe
  2⤵
  PID:552
- C:\Windows\System\wVkBCWr.exe
  C:\Windows\System\wVkBCWr.exe
  2⤵
  PID:924
- C:\Windows\System\SviTfWU.exe
  C:\Windows\System\SviTfWU.exe
  2⤵
  PID:2232
- C:\Windows\System\UkohneD.exe
  C:\Windows\System\UkohneD.exe
  2⤵
  PID:1812
- C:\Windows\System\ibvIzEE.exe
  C:\Windows\System\ibvIzEE.exe
  2⤵
  PID:2356
- C:\Windows\System\NywEZXq.exe
  C:\Windows\System\NywEZXq.exe
  2⤵
  PID:3216
- C:\Windows\System\EnnXrGo.exe
  C:\Windows\System\EnnXrGo.exe
  2⤵
  PID:452
- C:\Windows\System\ceEsRSA.exe
  C:\Windows\System\ceEsRSA.exe
  2⤵
  PID:2032
- C:\Windows\System\jCdcQDr.exe
  C:\Windows\System\jCdcQDr.exe
  2⤵
  PID:2580
- C:\Windows\System\jceZyXJ.exe
  C:\Windows\System\jceZyXJ.exe
  2⤵
  PID:1408
- C:\Windows\System\ACMEaZZ.exe
  C:\Windows\System\ACMEaZZ.exe
  2⤵
  PID:2516
- C:\Windows\System\dmDOwvt.exe
  C:\Windows\System\dmDOwvt.exe
  2⤵
  PID:3208
- C:\Windows\System\GTUxjph.exe
  C:\Windows\System\GTUxjph.exe
  2⤵
  PID:1160
- C:\Windows\System\SlVqgtd.exe
  C:\Windows\System\SlVqgtd.exe
  2⤵
  PID:3080
- C:\Windows\System\FEYJTNZ.exe
  C:\Windows\System\FEYJTNZ.exe
  2⤵
  PID:3932
- C:\Windows\System\HnVmZLo.exe
  C:\Windows\System\HnVmZLo.exe
  2⤵
  PID:1624
- C:\Windows\System\eQIAUxC.exe
  C:\Windows\System\eQIAUxC.exe
  2⤵
  PID:1228
- C:\Windows\System\PwbzMps.exe
  C:\Windows\System\PwbzMps.exe
  2⤵
  PID:4640
- C:\Windows\System\zGDFSqO.exe
  C:\Windows\System\zGDFSqO.exe
  2⤵
  PID:460
- C:\Windows\System\YMHAkwW.exe
  C:\Windows\System\YMHAkwW.exe
  2⤵
  PID:4896
- C:\Windows\System\zTeUpoO.exe
  C:\Windows\System\zTeUpoO.exe
  2⤵
  PID:4460
- C:\Windows\System\HVZijop.exe
  C:\Windows\System\HVZijop.exe
  2⤵
  PID:5144
- C:\Windows\System\aeFJcCk.exe
  C:\Windows\System\aeFJcCk.exe
  2⤵
  PID:5160
- C:\Windows\System\XwKViCa.exe
  C:\Windows\System\XwKViCa.exe
  2⤵
  PID:5268
- C:\Windows\System\AmbgEKX.exe
  C:\Windows\System\AmbgEKX.exe
  2⤵
  PID:5288
- C:\Windows\System\rEtwwdF.exe
  C:\Windows\System\rEtwwdF.exe
  2⤵
  PID:5308
- C:\Windows\System\VbZAizB.exe
  C:\Windows\System\VbZAizB.exe
  2⤵
  PID:5324
- C:\Windows\System\DccALps.exe
  C:\Windows\System\DccALps.exe
  2⤵
  PID:5348
- C:\Windows\System\YAnWsRU.exe
  C:\Windows\System\YAnWsRU.exe
  2⤵
  PID:5364
- C:\Windows\System\hKHEbqg.exe
  C:\Windows\System\hKHEbqg.exe
  2⤵
  PID:5400
- C:\Windows\System\yfGCsBR.exe
  C:\Windows\System\yfGCsBR.exe
  2⤵
  PID:5416
- C:\Windows\System\VglgciJ.exe
  C:\Windows\System\VglgciJ.exe
  2⤵
  PID:5432
- C:\Windows\System\rjUHnzR.exe
  C:\Windows\System\rjUHnzR.exe
  2⤵
  PID:5456
- C:\Windows\System\LoRcDTq.exe
  C:\Windows\System\LoRcDTq.exe
  2⤵
  PID:5480
- C:\Windows\System\qzhyCfe.exe
  C:\Windows\System\qzhyCfe.exe
  2⤵
  PID:5500
- C:\Windows\System\tdrPvJw.exe
  C:\Windows\System\tdrPvJw.exe
  2⤵
  PID:5528
- C:\Windows\System\fiRynzm.exe
  C:\Windows\System\fiRynzm.exe
  2⤵
  PID:5552
- C:\Windows\System\KGmXcjI.exe
  C:\Windows\System\KGmXcjI.exe
  2⤵
  PID:5584
- C:\Windows\System\lervetp.exe
  C:\Windows\System\lervetp.exe
  2⤵
  PID:5608
- C:\Windows\System\gcRahzm.exe
  C:\Windows\System\gcRahzm.exe
  2⤵
  PID:5628
- C:\Windows\System\JZDPzbQ.exe
  C:\Windows\System\JZDPzbQ.exe
  2⤵
  PID:5704
- C:\Windows\System\uiAabnN.exe
  C:\Windows\System\uiAabnN.exe
  2⤵
  PID:5732
- C:\Windows\System\rIFwQlv.exe
  C:\Windows\System\rIFwQlv.exe
  2⤵
  PID:5748
- C:\Windows\System\dauYOMi.exe
  C:\Windows\System\dauYOMi.exe
  2⤵
  PID:5772
- C:\Windows\System\hCadDxM.exe
  C:\Windows\System\hCadDxM.exe
  2⤵
  PID:5800
- C:\Windows\System\IIypZIU.exe
  C:\Windows\System\IIypZIU.exe
  2⤵
  PID:5832
- C:\Windows\System\HSkkmUj.exe
  C:\Windows\System\HSkkmUj.exe
  2⤵
  PID:5848
- C:\Windows\System\yMFGstP.exe
  C:\Windows\System\yMFGstP.exe
  2⤵
  PID:5868
- C:\Windows\System\IEHzton.exe
  C:\Windows\System\IEHzton.exe
  2⤵
  PID:5884
- C:\Windows\System\ZQYxfny.exe
  C:\Windows\System\ZQYxfny.exe
  2⤵
  PID:5912
- C:\Windows\System\MLRGPrT.exe
  C:\Windows\System\MLRGPrT.exe
  2⤵
  PID:5928
- C:\Windows\System\AisaNYx.exe
  C:\Windows\System\AisaNYx.exe
  2⤵
  PID:5956
- C:\Windows\System\XrCKFsr.exe
  C:\Windows\System\XrCKFsr.exe
  2⤵
  PID:5976
- C:\Windows\System\lWWnhoG.exe
  C:\Windows\System\lWWnhoG.exe
  2⤵
  PID:5992
- C:\Windows\System\PhxhARJ.exe
  C:\Windows\System\PhxhARJ.exe
  2⤵
  PID:6016
- C:\Windows\System\iIICDVt.exe
  C:\Windows\System\iIICDVt.exe
  2⤵
  PID:6032
- C:\Windows\System\QFSkAip.exe
  C:\Windows\System\QFSkAip.exe
  2⤵
  PID:6048
- C:\Windows\System\JTDHamj.exe
  C:\Windows\System\JTDHamj.exe
  2⤵
  PID:6068
- C:\Windows\System\LVMKhIU.exe
  C:\Windows\System\LVMKhIU.exe
  2⤵
  PID:6084
- C:\Windows\System\QdwCQEl.exe
  C:\Windows\System\QdwCQEl.exe
  2⤵
  PID:6100
- C:\Windows\System\bSFxlVK.exe
  C:\Windows\System\bSFxlVK.exe
  2⤵
  PID:6120
- C:\Windows\System\dcVQgJH.exe
  C:\Windows\System\dcVQgJH.exe
  2⤵
  PID:1504
- C:\Windows\System\UcjSNbq.exe
  C:\Windows\System\UcjSNbq.exe
  2⤵
  PID:3232
- C:\Windows\System\ntWGdhZ.exe
  C:\Windows\System\ntWGdhZ.exe
  2⤵
  PID:4940
- C:\Windows\System\soQlkHR.exe
  C:\Windows\System\soQlkHR.exe
  2⤵
  PID:2188
- C:\Windows\System\wrVgvIq.exe
  C:\Windows\System\wrVgvIq.exe
  2⤵
  PID:5172
- C:\Windows\System\StTneqG.exe
  C:\Windows\System\StTneqG.exe
  2⤵
  PID:2596
- C:\Windows\System\oEEzVHu.exe
  C:\Windows\System\oEEzVHu.exe
  2⤵
  PID:2760
- C:\Windows\System\VgaPZIk.exe
  C:\Windows\System\VgaPZIk.exe
  2⤵
  PID:5036
- C:\Windows\System\wSaBECO.exe
  C:\Windows\System\wSaBECO.exe
  2⤵
  PID:5492
- C:\Windows\System\jKIjlOe.exe
  C:\Windows\System\jKIjlOe.exe
  2⤵
  PID:5560
- C:\Windows\System\jXJorie.exe
  C:\Windows\System\jXJorie.exe
  2⤵
  PID:5640
- C:\Windows\System\niuAGqJ.exe
  C:\Windows\System\niuAGqJ.exe
  2⤵
  PID:4892
- C:\Windows\System\fSVloVi.exe
  C:\Windows\System\fSVloVi.exe
  2⤵
  PID:4040
- C:\Windows\System\yHuhxfB.exe
  C:\Windows\System\yHuhxfB.exe
  2⤵
  PID:4056
- C:\Windows\System\ZYkTKRV.exe
  C:\Windows\System\ZYkTKRV.exe
  2⤵
  PID:2132
- C:\Windows\System\fLbMxkp.exe
  C:\Windows\System\fLbMxkp.exe
  2⤵
  PID:3404
- C:\Windows\System\SBjNFya.exe
  C:\Windows\System\SBjNFya.exe
  2⤵
  PID:5124
- C:\Windows\System\TvLfWuF.exe
  C:\Windows\System\TvLfWuF.exe
  2⤵
  PID:5168
- C:\Windows\System\ZfxsHrR.exe
  C:\Windows\System\ZfxsHrR.exe
  2⤵
  PID:5812
- C:\Windows\System\CpCUtpd.exe
  C:\Windows\System\CpCUtpd.exe
  2⤵
  PID:5860
- C:\Windows\System\lliMpag.exe
  C:\Windows\System\lliMpag.exe
  2⤵
  PID:5900
- C:\Windows\System\HzEzAdM.exe
  C:\Windows\System\HzEzAdM.exe
  2⤵
  PID:6160
- C:\Windows\System\brKcwsv.exe
  C:\Windows\System\brKcwsv.exe
  2⤵
  PID:6180
- C:\Windows\System\hEUNVbI.exe
  C:\Windows\System\hEUNVbI.exe
  2⤵
  PID:6204
- C:\Windows\System\SQXVeRt.exe
  C:\Windows\System\SQXVeRt.exe
  2⤵
  PID:6224
- C:\Windows\System\zGpSedA.exe
  C:\Windows\System\zGpSedA.exe
  2⤵
  PID:6240
- C:\Windows\System\ikLifZI.exe
  C:\Windows\System\ikLifZI.exe
  2⤵
  PID:6256
- C:\Windows\System\HDYsgnI.exe
  C:\Windows\System\HDYsgnI.exe
  2⤵
  PID:6276
- C:\Windows\System\caxNecp.exe
  C:\Windows\System\caxNecp.exe
  2⤵
  PID:6292
- C:\Windows\System\EvpARxR.exe
  C:\Windows\System\EvpARxR.exe
  2⤵
  PID:6312
- C:\Windows\System\DiVhAYe.exe
  C:\Windows\System\DiVhAYe.exe
  2⤵
  PID:6332
- C:\Windows\System\XSoliTU.exe
  C:\Windows\System\XSoliTU.exe
  2⤵
  PID:6352
- C:\Windows\System\UThkrBr.exe
  C:\Windows\System\UThkrBr.exe
  2⤵
  PID:6376
- C:\Windows\System\fNkOFmG.exe
  C:\Windows\System\fNkOFmG.exe
  2⤵
  PID:6396
- C:\Windows\System\oPbUKCP.exe
  C:\Windows\System\oPbUKCP.exe
  2⤵
  PID:6420
- C:\Windows\System\isFOxYl.exe
  C:\Windows\System\isFOxYl.exe
  2⤵
  PID:6436
- C:\Windows\System\tokXPxN.exe
  C:\Windows\System\tokXPxN.exe
  2⤵
  PID:6460
- C:\Windows\System\RRpwhSw.exe
  C:\Windows\System\RRpwhSw.exe
  2⤵
  PID:6476
- C:\Windows\System\WlPfWmB.exe
  C:\Windows\System\WlPfWmB.exe
  2⤵
  PID:6500
- C:\Windows\System\qTcOqMU.exe
  C:\Windows\System\qTcOqMU.exe
  2⤵
  PID:6520
- C:\Windows\System\QSHeQpt.exe
  C:\Windows\System\QSHeQpt.exe
  2⤵
  PID:6544
- C:\Windows\System\ynKTrZo.exe
  C:\Windows\System\ynKTrZo.exe
  2⤵
  PID:6560
- C:\Windows\System\aXpCjPh.exe
  C:\Windows\System\aXpCjPh.exe
  2⤵
  PID:6592
- C:\Windows\System\KdaaEUi.exe
  C:\Windows\System\KdaaEUi.exe
  2⤵
  PID:6608
- C:\Windows\System\yLYRKmb.exe
  C:\Windows\System\yLYRKmb.exe
  2⤵
  PID:6624
- C:\Windows\System\OdxRNsl.exe
  C:\Windows\System\OdxRNsl.exe
  2⤵
  PID:6640
- C:\Windows\System\TSySouB.exe
  C:\Windows\System\TSySouB.exe
  2⤵
  PID:6656
- C:\Windows\System\AIvUTjD.exe
  C:\Windows\System\AIvUTjD.exe
  2⤵
  PID:6672
- C:\Windows\System\ckyvIfL.exe
  C:\Windows\System\ckyvIfL.exe
  2⤵
  PID:6692
- C:\Windows\System\aBkAWfE.exe
  C:\Windows\System\aBkAWfE.exe
  2⤵
  PID:6716
- C:\Windows\System\QdmHtvS.exe
  C:\Windows\System\QdmHtvS.exe
  2⤵
  PID:6732
- C:\Windows\System\gMlFqgD.exe
  C:\Windows\System\gMlFqgD.exe
  2⤵
  PID:6756
- C:\Windows\System\tapeLrW.exe
  C:\Windows\System\tapeLrW.exe
  2⤵
  PID:6776
- C:\Windows\System\UTSeeeB.exe
  C:\Windows\System\UTSeeeB.exe
  2⤵
  PID:6796
- C:\Windows\System\PkQMJQP.exe
  C:\Windows\System\PkQMJQP.exe
  2⤵
  PID:6812
- C:\Windows\System\VjlhFBa.exe
  C:\Windows\System\VjlhFBa.exe
  2⤵
  PID:6828
- C:\Windows\System\wgEnEdG.exe
  C:\Windows\System\wgEnEdG.exe
  2⤵
  PID:6856
- C:\Windows\System\yPHVSfs.exe
  C:\Windows\System\yPHVSfs.exe
  2⤵
  PID:6872
- C:\Windows\System\IaBpgxn.exe
  C:\Windows\System\IaBpgxn.exe
  2⤵
  PID:6896
- C:\Windows\System\EbxMGFV.exe
  C:\Windows\System\EbxMGFV.exe
  2⤵
  PID:6912
- C:\Windows\System\iBQCdPW.exe
  C:\Windows\System\iBQCdPW.exe
  2⤵
  PID:7040
- C:\Windows\System\MSayWTH.exe
  C:\Windows\System\MSayWTH.exe
  2⤵
  PID:7056
- C:\Windows\System\GFQoTOT.exe
  C:\Windows\System\GFQoTOT.exe
  2⤵
  PID:7072
- C:\Windows\System\gjoBmSF.exe
  C:\Windows\System\gjoBmSF.exe
  2⤵
  PID:7088
- C:\Windows\System\CGYIGGE.exe
  C:\Windows\System\CGYIGGE.exe
  2⤵
  PID:7104
- C:\Windows\System\uONljJl.exe
  C:\Windows\System\uONljJl.exe
  2⤵
  PID:7120
- C:\Windows\System\oFKypnh.exe
  C:\Windows\System\oFKypnh.exe
  2⤵
  PID:7136
- C:\Windows\System\WQIuSxS.exe
  C:\Windows\System\WQIuSxS.exe
  2⤵
  PID:7152
- C:\Windows\System\cViRWVx.exe
  C:\Windows\System\cViRWVx.exe
  2⤵
  PID:5944
- C:\Windows\System\UpzKmlB.exe
  C:\Windows\System\UpzKmlB.exe
  2⤵
  PID:6092
- C:\Windows\System\hUFpVMI.exe
  C:\Windows\System\hUFpVMI.exe
  2⤵
  PID:3720
- C:\Windows\System\EWOpKZj.exe
  C:\Windows\System\EWOpKZj.exe
  2⤵
  PID:3156
- C:\Windows\System\pZShsQw.exe
  C:\Windows\System\pZShsQw.exe
  2⤵
  PID:212
- C:\Windows\System\BUmDVIc.exe
  C:\Windows\System\BUmDVIc.exe
  2⤵
  PID:5264
- C:\Windows\System\shJKNeq.exe
  C:\Windows\System\shJKNeq.exe
  2⤵
  PID:5300
- C:\Windows\System\dPeOthG.exe
  C:\Windows\System\dPeOthG.exe
  2⤵
  PID:5332
- C:\Windows\System\PnNOdJK.exe
  C:\Windows\System\PnNOdJK.exe
  2⤵
  PID:5372
- C:\Windows\System\CZQOsAJ.exe
  C:\Windows\System\CZQOsAJ.exe
  2⤵
  PID:5412
- C:\Windows\System\dqPqfes.exe
  C:\Windows\System\dqPqfes.exe
  2⤵
  PID:5448
- C:\Windows\System\nYrLwRP.exe
  C:\Windows\System\nYrLwRP.exe
  2⤵
  PID:5488
- C:\Windows\System\nlZrvnb.exe
  C:\Windows\System\nlZrvnb.exe
  2⤵
  PID:5540
- C:\Windows\System\amneXOk.exe
  C:\Windows\System\amneXOk.exe
  2⤵
  PID:5616
- C:\Windows\System\BNkshaH.exe
  C:\Windows\System\BNkshaH.exe
  2⤵
  PID:6128
- C:\Windows\System\lAMCuNO.exe
  C:\Windows\System\lAMCuNO.exe
  2⤵
  PID:516
- C:\Windows\System\jIyVVZr.exe
  C:\Windows\System\jIyVVZr.exe
  2⤵
  PID:1156
- C:\Windows\System\amlbLbS.exe
  C:\Windows\System\amlbLbS.exe
  2⤵
  PID:2856
- C:\Windows\System\fOuQdZX.exe
  C:\Windows\System\fOuQdZX.exe
  2⤵
  PID:1568
- C:\Windows\System\rpHqzkl.exe
  C:\Windows\System\rpHqzkl.exe
  2⤵
  PID:3860
- C:\Windows\System\ElZKEGi.exe
  C:\Windows\System\ElZKEGi.exe
  2⤵
  PID:5156
- C:\Windows\System\QWhDzNH.exe
  C:\Windows\System\QWhDzNH.exe
  2⤵
  PID:5856
- C:\Windows\System\gdcCAEf.exe
  C:\Windows\System\gdcCAEf.exe
  2⤵
  PID:6344
- C:\Windows\System\IiEHNoS.exe
  C:\Windows\System\IiEHNoS.exe
  2⤵
  PID:3188
- C:\Windows\System\ZwLSCVN.exe
  C:\Windows\System\ZwLSCVN.exe
  2⤵
  PID:6928
- C:\Windows\System\uxtvRim.exe
  C:\Windows\System\uxtvRim.exe
  2⤵
  PID:6648
- C:\Windows\System\zEQbrpk.exe
  C:\Windows\System\zEQbrpk.exe
  2⤵
  PID:6680
- C:\Windows\System\qgGBdmT.exe
  C:\Windows\System\qgGBdmT.exe
  2⤵
  PID:6752
- C:\Windows\System\RFyzefr.exe
  C:\Windows\System\RFyzefr.exe
  2⤵
  PID:6820
- C:\Windows\System\RKHDHhL.exe
  C:\Windows\System\RKHDHhL.exe
  2⤵
  PID:6868
- C:\Windows\System\WkYzMVp.exe
  C:\Windows\System\WkYzMVp.exe
  2⤵
  PID:6188
- C:\Windows\System\HDhhLpn.exe
  C:\Windows\System\HDhhLpn.exe
  2⤵
  PID:6248
- C:\Windows\System\KwUYNsj.exe
  C:\Windows\System\KwUYNsj.exe
  2⤵
  PID:6304
- C:\Windows\System\iMkIZJY.exe
  C:\Windows\System\iMkIZJY.exe
  2⤵
  PID:6348
- C:\Windows\System\WMdETdU.exe
  C:\Windows\System\WMdETdU.exe
  2⤵
  PID:6404
- C:\Windows\System\VBsncbZ.exe
  C:\Windows\System\VBsncbZ.exe
  2⤵
  PID:6472
- C:\Windows\System\MHHvImb.exe
  C:\Windows\System\MHHvImb.exe
  2⤵
  PID:6552
- C:\Windows\System\qDHfuWF.exe
  C:\Windows\System\qDHfuWF.exe
  2⤵
  PID:7176
- C:\Windows\System\OJRNhDt.exe
  C:\Windows\System\OJRNhDt.exe
  2⤵
  PID:7192
- C:\Windows\System\YbcHVVt.exe
  C:\Windows\System\YbcHVVt.exe
  2⤵
  PID:7216
- C:\Windows\System\OYAYojx.exe
  C:\Windows\System\OYAYojx.exe
  2⤵
  PID:7240
- C:\Windows\System\jgZNCfU.exe
  C:\Windows\System\jgZNCfU.exe
  2⤵
  PID:7256
- C:\Windows\System\RBjsTBQ.exe
  C:\Windows\System\RBjsTBQ.exe
  2⤵
  PID:7284
- C:\Windows\System\yiVLmuR.exe
  C:\Windows\System\yiVLmuR.exe
  2⤵
  PID:7312
- C:\Windows\System\rhEpslT.exe
  C:\Windows\System\rhEpslT.exe
  2⤵
  PID:7332
- C:\Windows\System\wMYJxLd.exe
  C:\Windows\System\wMYJxLd.exe
  2⤵
  PID:7356
- C:\Windows\System\ujzbdcj.exe
  C:\Windows\System\ujzbdcj.exe
  2⤵
  PID:7384
- C:\Windows\System\KVOIzwg.exe
  C:\Windows\System\KVOIzwg.exe
  2⤵
  PID:7400
- C:\Windows\System\NQwcORI.exe
  C:\Windows\System\NQwcORI.exe
  2⤵
  PID:7428
- C:\Windows\System\KcGQZEE.exe
  C:\Windows\System\KcGQZEE.exe
  2⤵
  PID:7444
- C:\Windows\System\zLJzsaN.exe
  C:\Windows\System\zLJzsaN.exe
  2⤵
  PID:7468
- C:\Windows\System\nMogwHZ.exe
  C:\Windows\System\nMogwHZ.exe
  2⤵
  PID:7488
- C:\Windows\System\gXdmvOU.exe
  C:\Windows\System\gXdmvOU.exe
  2⤵
  PID:7508
- C:\Windows\System\IdePqXn.exe
  C:\Windows\System\IdePqXn.exe
  2⤵
  PID:7536
- C:\Windows\System\xWtNtjb.exe
  C:\Windows\System\xWtNtjb.exe
  2⤵
  PID:7556
- C:\Windows\System\TCeWdkK.exe
  C:\Windows\System\TCeWdkK.exe
  2⤵
  PID:7580
- C:\Windows\System\wzexKRj.exe
  C:\Windows\System\wzexKRj.exe
  2⤵
  PID:7600
- C:\Windows\System\SsDQcCC.exe
  C:\Windows\System\SsDQcCC.exe
  2⤵
  PID:7624
- C:\Windows\System\QQteZlY.exe
  C:\Windows\System\QQteZlY.exe
  2⤵
  PID:7640
- C:\Windows\System\JftStsM.exe
  C:\Windows\System\JftStsM.exe
  2⤵
  PID:7668
- C:\Windows\System\oNjaIOb.exe
  C:\Windows\System\oNjaIOb.exe
  2⤵
  PID:7696
- C:\Windows\System\HPRsqIM.exe
  C:\Windows\System\HPRsqIM.exe
  2⤵
  PID:7720
- C:\Windows\System\iTEEBoi.exe
  C:\Windows\System\iTEEBoi.exe
  2⤵
  PID:7744
- C:\Windows\System\GtgisBB.exe
  C:\Windows\System\GtgisBB.exe
  2⤵
  PID:7760
- C:\Windows\System\gqBBHLG.exe
  C:\Windows\System\gqBBHLG.exe
  2⤵
  PID:7780
- C:\Windows\System\YzSHuQp.exe
  C:\Windows\System\YzSHuQp.exe
  2⤵
  PID:7800
- C:\Windows\System\uXjMbYh.exe
  C:\Windows\System\uXjMbYh.exe
  2⤵
  PID:7816
- C:\Windows\System\nLrZsdZ.exe
  C:\Windows\System\nLrZsdZ.exe
  2⤵
  PID:7832
- C:\Windows\System\ggSocFX.exe
  C:\Windows\System\ggSocFX.exe
  2⤵
  PID:7852
- C:\Windows\System\wuRMbgG.exe
  C:\Windows\System\wuRMbgG.exe
  2⤵
  PID:7868
- C:\Windows\System\ntQSHyj.exe
  C:\Windows\System\ntQSHyj.exe
  2⤵
  PID:7884
- C:\Windows\System\Fuqqvoz.exe
  C:\Windows\System\Fuqqvoz.exe
  2⤵
  PID:7904
- C:\Windows\System\PrWsHDZ.exe
  C:\Windows\System\PrWsHDZ.exe
  2⤵
  PID:7920
- C:\Windows\System\opelbFj.exe
  C:\Windows\System\opelbFj.exe
  2⤵
  PID:7940
- C:\Windows\System\RfSNloJ.exe
  C:\Windows\System\RfSNloJ.exe
  2⤵
  PID:7960
- C:\Windows\System\IPYeRbI.exe
  C:\Windows\System\IPYeRbI.exe
  2⤵
  PID:7976
- C:\Windows\System\vwtAZbC.exe
  C:\Windows\System\vwtAZbC.exe
  2⤵
  PID:7996
- C:\Windows\System\VMUFzKH.exe
  C:\Windows\System\VMUFzKH.exe
  2⤵
  PID:8016
- C:\Windows\System\DwODzNe.exe
  C:\Windows\System\DwODzNe.exe
  2⤵
  PID:8032
- C:\Windows\System\eYAPbZw.exe
  C:\Windows\System\eYAPbZw.exe
  2⤵
  PID:8052
- C:\Windows\System\ZMfbWyh.exe
  C:\Windows\System\ZMfbWyh.exe
  2⤵
  PID:8068
- C:\Windows\System\vGBKmIG.exe
  C:\Windows\System\vGBKmIG.exe
  2⤵
  PID:8088
- C:\Windows\System\PoUehIO.exe
  C:\Windows\System\PoUehIO.exe
  2⤵
  PID:8104
- C:\Windows\System\RhYTTTd.exe
  C:\Windows\System\RhYTTTd.exe
  2⤵
  PID:8120
- C:\Windows\System\EXFmDng.exe
  C:\Windows\System\EXFmDng.exe
  2⤵
  PID:8144
- C:\Windows\System\IarBaHM.exe
  C:\Windows\System\IarBaHM.exe
  2⤵
  PID:8164
- C:\Windows\System\nXUQNuT.exe
  C:\Windows\System\nXUQNuT.exe
  2⤵
  PID:8184
- C:\Windows\System\sbnsige.exe
  C:\Windows\System\sbnsige.exe
  2⤵
  PID:8212
- C:\Windows\System\yaeXpoo.exe
  C:\Windows\System\yaeXpoo.exe
  2⤵
  PID:8228
- C:\Windows\System\mgclULM.exe
  C:\Windows\System\mgclULM.exe
  2⤵
  PID:8384
- C:\Windows\System\TBEBcrw.exe
  C:\Windows\System\TBEBcrw.exe
  2⤵
  PID:8400
- C:\Windows\System\Rihaffl.exe
  C:\Windows\System\Rihaffl.exe
  2⤵
  PID:8416
- C:\Windows\System\xdSMORs.exe
  C:\Windows\System\xdSMORs.exe
  2⤵
  PID:8436
- C:\Windows\System\usoIoxz.exe
  C:\Windows\System\usoIoxz.exe
  2⤵
  PID:8452
- C:\Windows\System\tCPFPfh.exe
  C:\Windows\System\tCPFPfh.exe
  2⤵
  PID:8472
- C:\Windows\System\XPcZRFi.exe
  C:\Windows\System\XPcZRFi.exe
  2⤵
  PID:8488
- C:\Windows\System\oMiBWFI.exe
  C:\Windows\System\oMiBWFI.exe
  2⤵
  PID:8504
- C:\Windows\System\OQDfFEp.exe
  C:\Windows\System\OQDfFEp.exe
  2⤵
  PID:8520
- C:\Windows\System\PzHOmhf.exe
  C:\Windows\System\PzHOmhf.exe
  2⤵
  PID:8544
- C:\Windows\System\omGFTnV.exe
  C:\Windows\System\omGFTnV.exe
  2⤵
  PID:8560
- C:\Windows\System\quuPUEn.exe
  C:\Windows\System\quuPUEn.exe
  2⤵
  PID:8580
- C:\Windows\System\LuRYYge.exe
  C:\Windows\System\LuRYYge.exe
  2⤵
  PID:8600
- C:\Windows\System\oEXLXCq.exe
  C:\Windows\System\oEXLXCq.exe
  2⤵
  PID:8616
- C:\Windows\System\JTsXlRA.exe
  C:\Windows\System\JTsXlRA.exe
  2⤵
  PID:8640
- C:\Windows\System\eBGMLlm.exe
  C:\Windows\System\eBGMLlm.exe
  2⤵
  PID:8656
- C:\Windows\System\ykjjPOh.exe
  C:\Windows\System\ykjjPOh.exe
  2⤵
  PID:8676
- C:\Windows\System\LctAtCZ.exe
  C:\Windows\System\LctAtCZ.exe
  2⤵
  PID:8692
- C:\Windows\System\hMpfisu.exe
  C:\Windows\System\hMpfisu.exe
  2⤵
  PID:8712
- C:\Windows\System\cpawgPc.exe
  C:\Windows\System\cpawgPc.exe
  2⤵
  PID:8736
- C:\Windows\System\HuOORsZ.exe
  C:\Windows\System\HuOORsZ.exe
  2⤵
  PID:8752
- C:\Windows\System\RXqtVwg.exe
  C:\Windows\System\RXqtVwg.exe
  2⤵
  PID:8776
- C:\Windows\System\SgWvAve.exe
  C:\Windows\System\SgWvAve.exe
  2⤵
  PID:8792
- C:\Windows\System\NhTKSsO.exe
  C:\Windows\System\NhTKSsO.exe
  2⤵
  PID:8816
- C:\Windows\System\ZQVogRY.exe
  C:\Windows\System\ZQVogRY.exe
  2⤵
  PID:8840
- C:\Windows\System\rwHLIyK.exe
  C:\Windows\System\rwHLIyK.exe
  2⤵
  PID:8860
- C:\Windows\System\VkdMher.exe
  C:\Windows\System\VkdMher.exe
  2⤵
  PID:8884
- C:\Windows\System\bVdvqSf.exe
  C:\Windows\System\bVdvqSf.exe
  2⤵
  PID:8916
- C:\Windows\System\Xeyhnog.exe
  C:\Windows\System\Xeyhnog.exe
  2⤵
  PID:8944
- C:\Windows\System\DroZKJX.exe
  C:\Windows\System\DroZKJX.exe
  2⤵
  PID:8972
- C:\Windows\System\PnDGYyI.exe
  C:\Windows\System\PnDGYyI.exe
  2⤵
  PID:8996
- C:\Windows\System\JoFttwA.exe
  C:\Windows\System\JoFttwA.exe
  2⤵
  PID:9024
- C:\Windows\System\vgIJhRy.exe
  C:\Windows\System\vgIJhRy.exe
  2⤵
  PID:9048
- C:\Windows\System\iLbMyuQ.exe
  C:\Windows\System\iLbMyuQ.exe
  2⤵
  PID:9088
- C:\Windows\System\CmPnOfy.exe
  C:\Windows\System\CmPnOfy.exe
  2⤵
  PID:9116
- C:\Windows\System\gNIKiCi.exe
  C:\Windows\System\gNIKiCi.exe
  2⤵
  PID:9140
- C:\Windows\System\tkiXQJy.exe
  C:\Windows\System\tkiXQJy.exe
  2⤵
  PID:9168
- C:\Windows\System\HiOppUI.exe
  C:\Windows\System\HiOppUI.exe
  2⤵
  PID:9196
- C:\Windows\System\lgDsqaQ.exe
  C:\Windows\System\lgDsqaQ.exe
  2⤵
  PID:7064
- C:\Windows\System\Asxnmyn.exe
  C:\Windows\System\Asxnmyn.exe
  2⤵
  PID:7144
- C:\Windows\System\LrssGqb.exe
  C:\Windows\System\LrssGqb.exe
  2⤵
  PID:3388
- C:\Windows\System\jiKgzVG.exe
  C:\Windows\System\jiKgzVG.exe
  2⤵
  PID:5384
- C:\Windows\System\ykdNRuP.exe
  C:\Windows\System\ykdNRuP.exe
  2⤵
  PID:5356
- C:\Windows\System\eqhlkGj.exe
  C:\Windows\System\eqhlkGj.exe
  2⤵
  PID:6108
- C:\Windows\System\PLmtkqq.exe
  C:\Windows\System\PLmtkqq.exe
  2⤵
  PID:6668
- C:\Windows\System\IbmtNxg.exe
  C:\Windows\System\IbmtNxg.exe
  2⤵
  PID:6232
- C:\Windows\System\SjYhaqB.exe
  C:\Windows\System\SjYhaqB.exe
  2⤵
  PID:7228
- C:\Windows\System\IYkCcKX.exe
  C:\Windows\System\IYkCcKX.exe
  2⤵
  PID:7420
- C:\Windows\System\RGunmim.exe
  C:\Windows\System\RGunmim.exe
  2⤵
  PID:7848
- C:\Windows\System\xAbcybX.exe
  C:\Windows\System\xAbcybX.exe
  2⤵
  PID:9232
- C:\Windows\System\pDyfdbx.exe
  C:\Windows\System\pDyfdbx.exe
  2⤵
  PID:9248
- C:\Windows\System\Booriju.exe
  C:\Windows\System\Booriju.exe
  2⤵
  PID:9264
- C:\Windows\System\bmyswRQ.exe
  C:\Windows\System\bmyswRQ.exe
  2⤵
  PID:9284
- C:\Windows\System\XdfFOjm.exe
  C:\Windows\System\XdfFOjm.exe
  2⤵
  PID:9304
- C:\Windows\System\tJgvUoC.exe
  C:\Windows\System\tJgvUoC.exe
  2⤵
  PID:9320
- C:\Windows\System\frJOWYf.exe
  C:\Windows\System\frJOWYf.exe
  2⤵
  PID:9336
- C:\Windows\System\iQEYBiy.exe
  C:\Windows\System\iQEYBiy.exe
  2⤵
  PID:9352
- C:\Windows\System\zZScOMU.exe
  C:\Windows\System\zZScOMU.exe
  2⤵
  PID:9372
- C:\Windows\System\DwRRhkN.exe
  C:\Windows\System\DwRRhkN.exe
  2⤵
  PID:9388
- C:\Windows\System\KHBVznj.exe
  C:\Windows\System\KHBVznj.exe
  2⤵
  PID:9408
- C:\Windows\System\SZNgnbe.exe
  C:\Windows\System\SZNgnbe.exe
  2⤵
  PID:9428
- C:\Windows\System\hPztmAs.exe
  C:\Windows\System\hPztmAs.exe
  2⤵
  PID:9452
- C:\Windows\System\BxRgfkz.exe
  C:\Windows\System\BxRgfkz.exe
  2⤵
  PID:9472
- C:\Windows\System\gPluFdW.exe
  C:\Windows\System\gPluFdW.exe
  2⤵
  PID:9488
- C:\Windows\System\zByNLMr.exe
  C:\Windows\System\zByNLMr.exe
  2⤵
  PID:9516
- C:\Windows\System\LakDLXg.exe
  C:\Windows\System\LakDLXg.exe
  2⤵
  PID:9536
- C:\Windows\System\wTlALBb.exe
  C:\Windows\System\wTlALBb.exe
  2⤵
  PID:9556
- C:\Windows\System\uedcObq.exe
  C:\Windows\System\uedcObq.exe
  2⤵
  PID:9572
- C:\Windows\System\oppSfqX.exe
  C:\Windows\System\oppSfqX.exe
  2⤵
  PID:9592
- C:\Windows\System\DHyBhSd.exe
  C:\Windows\System\DHyBhSd.exe
  2⤵
  PID:9612
- C:\Windows\System\otDVHmq.exe
  C:\Windows\System\otDVHmq.exe
  2⤵
  PID:9648
- C:\Windows\System\nWgHcfk.exe
  C:\Windows\System\nWgHcfk.exe
  2⤵
  PID:9664
- C:\Windows\System\TmdRZyL.exe
  C:\Windows\System\TmdRZyL.exe
  2⤵
  PID:9680
- C:\Windows\System\AGrMADt.exe
  C:\Windows\System\AGrMADt.exe
  2⤵
  PID:9696
- C:\Windows\System\oOtPFZo.exe
  C:\Windows\System\oOtPFZo.exe
  2⤵
  PID:9712
- C:\Windows\System\LSNBoBH.exe
  C:\Windows\System\LSNBoBH.exe
  2⤵
  PID:9728
- C:\Windows\System\oNgaDYC.exe
  C:\Windows\System\oNgaDYC.exe
  2⤵
  PID:9744
- C:\Windows\System\sURwdJt.exe
  C:\Windows\System\sURwdJt.exe
  2⤵
  PID:9760
- C:\Windows\System\UFYdeVh.exe
  C:\Windows\System\UFYdeVh.exe
  2⤵
  PID:9776
- C:\Windows\System\LpZBNZC.exe
  C:\Windows\System\LpZBNZC.exe
  2⤵
  PID:9792
- C:\Windows\System\sfVgkcq.exe
  C:\Windows\System\sfVgkcq.exe
  2⤵
  PID:9808
- C:\Windows\System\FrMzRMG.exe
  C:\Windows\System\FrMzRMG.exe
  2⤵
  PID:9824
- C:\Windows\System\oZSwBqG.exe
  C:\Windows\System\oZSwBqG.exe
  2⤵
  PID:9840
- C:\Windows\System\PFbLYZH.exe
  C:\Windows\System\PFbLYZH.exe
  2⤵
  PID:9856
- C:\Windows\System\icpYzjA.exe
  C:\Windows\System\icpYzjA.exe
  2⤵
  PID:9872
- C:\Windows\System\CBNOddf.exe
  C:\Windows\System\CBNOddf.exe
  2⤵
  PID:9892
- C:\Windows\System\UEVwZqV.exe
  C:\Windows\System\UEVwZqV.exe
  2⤵
  PID:9916
- C:\Windows\System\BmYxpBP.exe
  C:\Windows\System\BmYxpBP.exe
  2⤵
  PID:9936
- C:\Windows\System\TkonTut.exe
  C:\Windows\System\TkonTut.exe
  2⤵
  PID:9952
- C:\Windows\System\jeeDbvJ.exe
  C:\Windows\System\jeeDbvJ.exe
  2⤵
  PID:9976
- C:\Windows\System\fDnwMHI.exe
  C:\Windows\System\fDnwMHI.exe
  2⤵
  PID:9996
- C:\Windows\System\gjQXhuX.exe
  C:\Windows\System\gjQXhuX.exe
  2⤵
  PID:10016
- C:\Windows\System\nrfMvGt.exe
  C:\Windows\System\nrfMvGt.exe
  2⤵
  PID:10032
- C:\Windows\System\AbXbbfJ.exe
  C:\Windows\System\AbXbbfJ.exe
  2⤵
  PID:10056
- C:\Windows\System\WePNTsX.exe
  C:\Windows\System\WePNTsX.exe
  2⤵
  PID:10072
- C:\Windows\System\yVSCfCz.exe
  C:\Windows\System\yVSCfCz.exe
  2⤵
  PID:10096
- C:\Windows\System\iejpmXo.exe
  C:\Windows\System\iejpmXo.exe
  2⤵
  PID:10116
- C:\Windows\System\VGvPkRo.exe
  C:\Windows\System\VGvPkRo.exe
  2⤵
  PID:10136
- C:\Windows\System\bRCFVwn.exe
  C:\Windows\System\bRCFVwn.exe
  2⤵
  PID:10164
- C:\Windows\System\aLhNQZP.exe
  C:\Windows\System\aLhNQZP.exe
  2⤵
  PID:10180
- C:\Windows\System\PlgnoUW.exe
  C:\Windows\System\PlgnoUW.exe
  2⤵
  PID:10204
- C:\Windows\System\azmJmQj.exe
  C:\Windows\System\azmJmQj.exe
  2⤵
  PID:10228
- C:\Windows\System\tlANgWt.exe
  C:\Windows\System\tlANgWt.exe
  2⤵
  PID:7956
- C:\Windows\System\cMPJYsP.exe
  C:\Windows\System\cMPJYsP.exe
  2⤵
  PID:7988
- C:\Windows\System\XERqqgl.exe
  C:\Windows\System\XERqqgl.exe
  2⤵
  PID:8156
- C:\Windows\System\kUyNRXN.exe
  C:\Windows\System\kUyNRXN.exe
  2⤵
  PID:6724
- C:\Windows\System\lAklPgg.exe
  C:\Windows\System\lAklPgg.exe
  2⤵
  PID:7184
- C:\Windows\System\dlnpprQ.exe
  C:\Windows\System\dlnpprQ.exe
  2⤵
  PID:7480
- C:\Windows\System\fsXLaJZ.exe
  C:\Windows\System\fsXLaJZ.exe
  2⤵
  PID:7860
- C:\Windows\System\UjPzXEg.exe
  C:\Windows\System\UjPzXEg.exe
  2⤵
  PID:9184
- C:\Windows\System\zVqvFbF.exe
  C:\Windows\System\zVqvFbF.exe
  2⤵
  PID:9036
- C:\Windows\System\MQUlXih.exe
  C:\Windows\System\MQUlXih.exe
  2⤵
  PID:8928
- C:\Windows\System\DptDiqB.exe
  C:\Windows\System\DptDiqB.exe
  2⤵
  PID:8828
- C:\Windows\System\NNFFdcb.exe
  C:\Windows\System\NNFFdcb.exe
  2⤵
  PID:8744
- C:\Windows\System\GiNgudt.exe
  C:\Windows\System\GiNgudt.exe
  2⤵
  PID:8668
- C:\Windows\System\VFPFYyP.exe
  C:\Windows\System\VFPFYyP.exe
  2⤵
  PID:8552
- C:\Windows\System\akaxbFw.exe
  C:\Windows\System\akaxbFw.exe
  2⤵
  PID:8480
- C:\Windows\System\GLMxMhQ.exe
  C:\Windows\System\GLMxMhQ.exe
  2⤵
  PID:6572
- C:\Windows\System\ikGShHK.exe
  C:\Windows\System\ikGShHK.exe
  2⤵
  PID:7892
- C:\Windows\System\taldorj.exe
  C:\Windows\System\taldorj.exe
  2⤵
  PID:8040
- C:\Windows\System\XIGdcvw.exe
  C:\Windows\System\XIGdcvw.exe
  2⤵
  PID:9480
- C:\Windows\System\bSmWOmp.exe
  C:\Windows\System\bSmWOmp.exe
  2⤵
  PID:9544
- C:\Windows\System\ucQcdWX.exe
  C:\Windows\System\ucQcdWX.exe
  2⤵
  PID:7052
- C:\Windows\System\mxHiqSY.exe
  C:\Windows\System\mxHiqSY.exe
  2⤵
  PID:7116
- C:\Windows\System\LIpPCBi.exe
  C:\Windows\System\LIpPCBi.exe
  2⤵
  PID:4972
- C:\Windows\System\htZggmC.exe
  C:\Windows\System\htZggmC.exe
  2⤵
  PID:5408
- C:\Windows\System\NoPScEA.exe
  C:\Windows\System\NoPScEA.exe
  2⤵
  PID:5624
- C:\Windows\System\dMWhHHv.exe
  C:\Windows\System\dMWhHHv.exe
  2⤵
  PID:6044
- C:\Windows\System\zDzBfAL.exe
  C:\Windows\System\zDzBfAL.exe
  2⤵
  PID:772
- C:\Windows\System\zuyvgUz.exe
  C:\Windows\System\zuyvgUz.exe
  2⤵
  PID:3132
- C:\Windows\System\zgHattD.exe
  C:\Windows\System\zgHattD.exe
  2⤵
  PID:5796
- C:\Windows\System\ZFkOWJy.exe
  C:\Windows\System\ZFkOWJy.exe
  2⤵
  PID:6788
- C:\Windows\System\WhMIMmR.exe
  C:\Windows\System\WhMIMmR.exe
  2⤵
  PID:6772
- C:\Windows\System\fAJgbQz.exe
  C:\Windows\System\fAJgbQz.exe
  2⤵
  PID:6904
- C:\Windows\System\wpQbBZD.exe
  C:\Windows\System\wpQbBZD.exe
  2⤵
  PID:6320
- C:\Windows\System\hZEtZXL.exe
  C:\Windows\System\hZEtZXL.exe
  2⤵
  PID:10312
- C:\Windows\System\PCWBugm.exe
  C:\Windows\System\PCWBugm.exe
  2⤵
  PID:10332
- C:\Windows\System\tAETnaq.exe
  C:\Windows\System\tAETnaq.exe
  2⤵
  PID:10356
- C:\Windows\System\LSleogm.exe
  C:\Windows\System\LSleogm.exe
  2⤵
  PID:10380
- C:\Windows\System\pcuCRJZ.exe
  C:\Windows\System\pcuCRJZ.exe
  2⤵
  PID:10416
- C:\Windows\System\GYEgNyF.exe
  C:\Windows\System\GYEgNyF.exe
  2⤵
  PID:10444
- C:\Windows\System\XSGrbEI.exe
  C:\Windows\System\XSGrbEI.exe
  2⤵
  PID:10468
- C:\Windows\System\tckPDxv.exe
  C:\Windows\System\tckPDxv.exe
  2⤵
  PID:10488
- C:\Windows\System\HldWdCx.exe
  C:\Windows\System\HldWdCx.exe
  2⤵
  PID:10512
- C:\Windows\System\DPakWCA.exe
  C:\Windows\System\DPakWCA.exe
  2⤵
  PID:10532
- C:\Windows\System\UddcncF.exe
  C:\Windows\System\UddcncF.exe
  2⤵
  PID:10556
- C:\Windows\System\EyfNFvR.exe
  C:\Windows\System\EyfNFvR.exe
  2⤵
  PID:10608
- C:\Windows\System\wAjMAia.exe
  C:\Windows\System\wAjMAia.exe
  2⤵
  PID:10632
- C:\Windows\System\tmxPkEa.exe
  C:\Windows\System\tmxPkEa.exe
  2⤵
  PID:10648
- C:\Windows\System\pELSGEf.exe
  C:\Windows\System\pELSGEf.exe
  2⤵
  PID:10668
- C:\Windows\System\sangzVK.exe
  C:\Windows\System\sangzVK.exe
  2⤵
  PID:10684
- C:\Windows\System\mGGVCDr.exe
  C:\Windows\System\mGGVCDr.exe
  2⤵
  PID:10700
- C:\Windows\System\rCppCrL.exe
  C:\Windows\System\rCppCrL.exe
  2⤵
  PID:10720
- C:\Windows\System\DXGcwOk.exe
  C:\Windows\System\DXGcwOk.exe
  2⤵
  PID:10736
- C:\Windows\System\CeeRCuQ.exe
  C:\Windows\System\CeeRCuQ.exe
  2⤵
  PID:10756
- C:\Windows\System\rMCihxY.exe
  C:\Windows\System\rMCihxY.exe
  2⤵
  PID:10772
- C:\Windows\System\OUuchaw.exe
  C:\Windows\System\OUuchaw.exe
  2⤵
  PID:10788
- C:\Windows\System\PLtUkJE.exe
  C:\Windows\System\PLtUkJE.exe
  2⤵
  PID:10816
- C:\Windows\System\yXqbatb.exe
  C:\Windows\System\yXqbatb.exe
  2⤵
  PID:10868
- C:\Windows\System\cKLDqRu.exe
  C:\Windows\System\cKLDqRu.exe
  2⤵
  PID:10884
- C:\Windows\System\fZOjwRX.exe
  C:\Windows\System\fZOjwRX.exe
  2⤵
  PID:10900
- C:\Windows\System\vcbLwJC.exe
  C:\Windows\System\vcbLwJC.exe
  2⤵
  PID:10948
- C:\Windows\System\wcSLKTf.exe
  C:\Windows\System\wcSLKTf.exe
  2⤵
  PID:10968
- C:\Windows\System\HDNPeFR.exe
  C:\Windows\System\HDNPeFR.exe
  2⤵
  PID:11156
- C:\Windows\System\FSAEqUy.exe
  C:\Windows\System\FSAEqUy.exe
  2⤵
  PID:11176
- C:\Windows\System\DKOLGEQ.exe
  C:\Windows\System\DKOLGEQ.exe
  2⤵
  PID:11212
- C:\Windows\System\IIpcStu.exe
  C:\Windows\System\IIpcStu.exe
  2⤵
  PID:11248
- C:\Windows\System\pNBLjiq.exe
  C:\Windows\System\pNBLjiq.exe
  2⤵
  PID:9880
- C:\Windows\System\quCgneR.exe
  C:\Windows\System\quCgneR.exe
  2⤵
  PID:9600
- C:\Windows\System\dWQGdoI.exe
  C:\Windows\System\dWQGdoI.exe
  2⤵
  PID:7588
- C:\Windows\System\RUljUln.exe
  C:\Windows\System\RUljUln.exe
  2⤵
  PID:6512
- C:\Windows\System\HycDlre.exe
  C:\Windows\System\HycDlre.exe
  2⤵
  PID:6340
- C:\Windows\System\OFyuHpc.exe
  C:\Windows\System\OFyuHpc.exe
  2⤵
  PID:11272
- C:\Windows\System\xcwrVCk.exe
  C:\Windows\System\xcwrVCk.exe
  2⤵
  PID:11308
- C:\Windows\System\dJKQUlR.exe
  C:\Windows\System\dJKQUlR.exe
  2⤵
  PID:11332
- C:\Windows\System\ZzNcUVh.exe
  C:\Windows\System\ZzNcUVh.exe
  2⤵
  PID:11368
- C:\Windows\System\saQCtWa.exe
  C:\Windows\System\saQCtWa.exe
  2⤵
  PID:11544
- C:\Windows\System\KpYGSPK.exe
  C:\Windows\System\KpYGSPK.exe
  2⤵
  PID:11564
- C:\Windows\System\opZtqUo.exe
  C:\Windows\System\opZtqUo.exe
  2⤵
  PID:11592
- C:\Windows\System\jtRpXlp.exe
  C:\Windows\System\jtRpXlp.exe
  2⤵
  PID:11616
- C:\Windows\System\ZBSqluY.exe
  C:\Windows\System\ZBSqluY.exe
  2⤵
  PID:11636
- C:\Windows\System\STrEvHe.exe
  C:\Windows\System\STrEvHe.exe
  2⤵
  PID:11660
- C:\Windows\System\FNULSlj.exe
  C:\Windows\System\FNULSlj.exe
  2⤵
  PID:11684
- C:\Windows\System\noZdckr.exe
  C:\Windows\System\noZdckr.exe
  2⤵
  PID:11712
- C:\Windows\System\elfcYrH.exe
  C:\Windows\System\elfcYrH.exe
  2⤵
  PID:11732
- C:\Windows\System\nTrRUeG.exe
  C:\Windows\System\nTrRUeG.exe
  2⤵
  PID:11752
- C:\Windows\System\YfPkjdR.exe
  C:\Windows\System\YfPkjdR.exe
  2⤵
  PID:11780
- C:\Windows\System\UkBqlKN.exe
  C:\Windows\System\UkBqlKN.exe
  2⤵
  PID:11812
- C:\Windows\System\kfCnjAl.exe
  C:\Windows\System\kfCnjAl.exe
  2⤵
  PID:11836
- C:\Windows\System\vZmqtsG.exe
  C:\Windows\System\vZmqtsG.exe
  2⤵
  PID:11860
- C:\Windows\System\GmDcBzH.exe
  C:\Windows\System\GmDcBzH.exe
  2⤵
  PID:11876
- C:\Windows\System\PkUFETs.exe
  C:\Windows\System\PkUFETs.exe
  2⤵
  PID:11896
- C:\Windows\System\OwICunM.exe
  C:\Windows\System\OwICunM.exe
  2⤵
  PID:11912
- C:\Windows\System\IfSzQjx.exe
  C:\Windows\System\IfSzQjx.exe
  2⤵
  PID:11936
- C:\Windows\System\aBCNqDD.exe
  C:\Windows\System\aBCNqDD.exe
  2⤵
  PID:11964
- C:\Windows\System\rWRAyuC.exe
  C:\Windows\System\rWRAyuC.exe
  2⤵
  PID:11984
- C:\Windows\System\QSArzPa.exe
  C:\Windows\System\QSArzPa.exe
  2⤵
  PID:12008
- C:\Windows\System\tIeCCdm.exe
  C:\Windows\System\tIeCCdm.exe
  2⤵
  PID:12032
- C:\Windows\System\luZoglW.exe
  C:\Windows\System\luZoglW.exe
  2⤵
  PID:12048
- C:\Windows\System\rvlArtO.exe
  C:\Windows\System\rvlArtO.exe
  2⤵
  PID:12072
- C:\Windows\System\oIRrWJS.exe
  C:\Windows\System\oIRrWJS.exe
  2⤵
  PID:12088
- C:\Windows\System\KaeOMgG.exe
  C:\Windows\System\KaeOMgG.exe
  2⤵
  PID:12104
- C:\Windows\System\nmGqyVb.exe
  C:\Windows\System\nmGqyVb.exe
  2⤵
  PID:12120
- C:\Windows\System\uATOhGw.exe
  C:\Windows\System\uATOhGw.exe
  2⤵
  PID:12136
- C:\Windows\System\jHlzMGP.exe
  C:\Windows\System\jHlzMGP.exe
  2⤵
  PID:12152
- C:\Windows\System\jKCguKJ.exe
  C:\Windows\System\jKCguKJ.exe
  2⤵
  PID:12168
- C:\Windows\System\pVGeocH.exe
  C:\Windows\System\pVGeocH.exe
  2⤵
  PID:12184
- C:\Windows\System\sgWgrqX.exe
  C:\Windows\System\sgWgrqX.exe
  2⤵
  PID:12200
- C:\Windows\System\BIqqzMo.exe
  C:\Windows\System\BIqqzMo.exe
  2⤵
  PID:12220
- C:\Windows\System\uTGtrpg.exe
  C:\Windows\System\uTGtrpg.exe
  2⤵
  PID:12252
- C:\Windows\System\TzazsFs.exe
  C:\Windows\System\TzazsFs.exe
  2⤵
  PID:12268
- C:\Windows\System\nErgEDD.exe
  C:\Windows\System\nErgEDD.exe
  2⤵
  PID:8856
- C:\Windows\System\InWGTzj.exe
  C:\Windows\System\InWGTzj.exe
  2⤵
  PID:10292
- C:\Windows\System\nRQkzkw.exe
  C:\Windows\System\nRQkzkw.exe
  2⤵
  PID:10324
- C:\Windows\System\SOROUvP.exe
  C:\Windows\System\SOROUvP.exe
  2⤵
  PID:10412
- C:\Windows\System\SqhdFbP.exe
  C:\Windows\System\SqhdFbP.exe
  2⤵
  PID:10476
- C:\Windows\System\aCWNBXn.exe
  C:\Windows\System\aCWNBXn.exe
  2⤵
  PID:10040
- C:\Windows\System\XwnibXW.exe
  C:\Windows\System\XwnibXW.exe
  2⤵
  PID:10088
- C:\Windows\System\spTDhPr.exe
  C:\Windows\System\spTDhPr.exe
  2⤵
  PID:10144
- C:\Windows\System\IiAPgku.exe
  C:\Windows\System\IiAPgku.exe
  2⤵
  PID:12296
- C:\Windows\System\pYpwCED.exe
  C:\Windows\System\pYpwCED.exe
  2⤵
  PID:12316
- C:\Windows\System\QNZzeeM.exe
  C:\Windows\System\QNZzeeM.exe
  2⤵
  PID:12336
- C:\Windows\System\VFYUtqZ.exe
  C:\Windows\System\VFYUtqZ.exe
  2⤵
  PID:12352
- C:\Windows\System\ymtxMpk.exe
  C:\Windows\System\ymtxMpk.exe
  2⤵
  PID:12376
- C:\Windows\System\ausIJzb.exe
  C:\Windows\System\ausIJzb.exe
  2⤵
  PID:12392
- C:\Windows\System\SiRDTjg.exe
  C:\Windows\System\SiRDTjg.exe
  2⤵
  PID:12412
- C:\Windows\System\hfPatwC.exe
  C:\Windows\System\hfPatwC.exe
  2⤵
  PID:12432
- C:\Windows\System\Wpcwsbc.exe
  C:\Windows\System\Wpcwsbc.exe
  2⤵
  PID:12448
- C:\Windows\System\TmAeeGh.exe
  C:\Windows\System\TmAeeGh.exe
  2⤵
  PID:12464
- C:\Windows\System\SixkbDR.exe
  C:\Windows\System\SixkbDR.exe
  2⤵
  PID:12484
- C:\Windows\System\JouKZwp.exe
  C:\Windows\System\JouKZwp.exe
  2⤵
  PID:12512
- C:\Windows\System\FNcLZTo.exe
  C:\Windows\System\FNcLZTo.exe
  2⤵
  PID:12528
- C:\Windows\System\qrJkPbO.exe
  C:\Windows\System\qrJkPbO.exe
  2⤵
  PID:12548
- C:\Windows\System\CYXDsee.exe
  C:\Windows\System\CYXDsee.exe
  2⤵
  PID:12564
- C:\Windows\System\NkWMvHS.exe
  C:\Windows\System\NkWMvHS.exe
  2⤵
  PID:12592
- C:\Windows\System\KdcwFUC.exe
  C:\Windows\System\KdcwFUC.exe
  2⤵
  PID:12616
- C:\Windows\System\xthltMp.exe
  C:\Windows\System\xthltMp.exe
  2⤵
  PID:12632
- C:\Windows\System\FCbaoMV.exe
  C:\Windows\System\FCbaoMV.exe
  2⤵
  PID:12656
- C:\Windows\System\xfizfiT.exe
  C:\Windows\System\xfizfiT.exe
  2⤵
  PID:12672
- C:\Windows\System\VPyQDFl.exe
  C:\Windows\System\VPyQDFl.exe
  2⤵
  PID:12692
- C:\Windows\System\vgFsNVN.exe
  C:\Windows\System\vgFsNVN.exe
  2⤵
  PID:12712
- C:\Windows\System\aVcPhHI.exe
  C:\Windows\System\aVcPhHI.exe
  2⤵
  PID:12736
- C:\Windows\System\hjTXEdq.exe
  C:\Windows\System\hjTXEdq.exe
  2⤵
  PID:12752
- C:\Windows\System\riRYlYY.exe
  C:\Windows\System\riRYlYY.exe
  2⤵
  PID:12772
- C:\Windows\System\FykrVNX.exe
  C:\Windows\System\FykrVNX.exe
  2⤵
  PID:12800
- C:\Windows\System\JpeCaAC.exe
  C:\Windows\System\JpeCaAC.exe
  2⤵
  PID:12816
- C:\Windows\System\nMdKQDp.exe
  C:\Windows\System\nMdKQDp.exe
  2⤵
  PID:12840
- C:\Windows\System\qGDpGbu.exe
  C:\Windows\System\qGDpGbu.exe
  2⤵
  PID:12864
- C:\Windows\System\HPndTPn.exe
  C:\Windows\System\HPndTPn.exe
  2⤵
  PID:12888
- C:\Windows\System\HIItQnF.exe
  C:\Windows\System\HIItQnF.exe
  2⤵
  PID:12912
- C:\Windows\System\zZQsjnJ.exe
  C:\Windows\System\zZQsjnJ.exe
  2⤵
  PID:12936
- C:\Windows\System\QRWpNxU.exe
  C:\Windows\System\QRWpNxU.exe
  2⤵
  PID:12972
- C:\Windows\System\mZkbycH.exe
  C:\Windows\System\mZkbycH.exe
  2⤵
  PID:13028
- C:\Windows\System\fuafepr.exe
  C:\Windows\System\fuafepr.exe
  2⤵
  PID:13048
- C:\Windows\System\qZnnGSv.exe
  C:\Windows\System\qZnnGSv.exe
  2⤵
  PID:13068
- C:\Windows\System\ZknBvMD.exe
  C:\Windows\System\ZknBvMD.exe
  2⤵
  PID:13088
- C:\Windows\System\qpPGmPW.exe
  C:\Windows\System\qpPGmPW.exe
  2⤵
  PID:13108
- C:\Windows\System\wqaTFgi.exe
  C:\Windows\System\wqaTFgi.exe
  2⤵
  PID:13124
- C:\Windows\System\SxpMcGO.exe
  C:\Windows\System\SxpMcGO.exe
  2⤵
  PID:13144
- C:\Windows\System\vcOjeeU.exe
  C:\Windows\System\vcOjeeU.exe
  2⤵
  PID:13160
- C:\Windows\System\WNFHIef.exe
  C:\Windows\System\WNFHIef.exe
  2⤵
  PID:13176
- C:\Windows\System\VJiqRiq.exe
  C:\Windows\System\VJiqRiq.exe
  2⤵
  PID:13192
- C:\Windows\System\lBQXuwp.exe
  C:\Windows\System\lBQXuwp.exe
  2⤵
  PID:13208
- C:\Windows\System\uVXUgkf.exe
  C:\Windows\System\uVXUgkf.exe
  2⤵
  PID:13224
- C:\Windows\System\ADUxmmL.exe
  C:\Windows\System\ADUxmmL.exe
  2⤵
  PID:13240
- C:\Windows\System\UrNukSS.exe
  C:\Windows\System\UrNukSS.exe
  2⤵
  PID:13256
- C:\Windows\System\GiYSaYU.exe
  C:\Windows\System\GiYSaYU.exe
  2⤵
  PID:13272
- C:\Windows\System\UZbMWJw.exe
  C:\Windows\System\UZbMWJw.exe
  2⤵
  PID:13288
- C:\Windows\System\pZPXGTw.exe
  C:\Windows\System\pZPXGTw.exe
  2⤵
  PID:13304
- C:\Windows\System\OctxoAb.exe
  C:\Windows\System\OctxoAb.exe
  2⤵
  PID:10548
- C:\Windows\System\abrFWiD.exe
  C:\Windows\System\abrFWiD.exe
  2⤵
  PID:10196
- C:\Windows\System\JTNOYOY.exe
  C:\Windows\System\JTNOYOY.exe
  2⤵
  PID:7452
- C:\Windows\System\RHtLFhl.exe
  C:\Windows\System\RHtLFhl.exe
  2⤵
  PID:7972
- C:\Windows\System\hhRLJxK.exe
  C:\Windows\System\hhRLJxK.exe
  2⤵
  PID:7020
- C:\Windows\System\ynSutYl.exe
  C:\Windows\System\ynSutYl.exe
  2⤵
  PID:10676
- C:\Windows\System\siZmQkB.exe
  C:\Windows\System\siZmQkB.exe
  2⤵
  PID:7552
- C:\Windows\System\fwcyoTn.exe
  C:\Windows\System\fwcyoTn.exe
  2⤵
  PID:5240
- C:\Windows\System\XPEpzDT.exe
  C:\Windows\System\XPEpzDT.exe
  2⤵
  PID:8872
- C:\Windows\System\bfNHSxG.exe
  C:\Windows\System\bfNHSxG.exe
  2⤵
  PID:8592
- C:\Windows\System\vGiaHNx.exe
  C:\Windows\System\vGiaHNx.exe
  2⤵
  PID:8408
- C:\Windows\System\KwOARXD.exe
  C:\Windows\System\KwOARXD.exe
  2⤵
  PID:7412
- C:\Windows\System\QQCEwdX.exe
  C:\Windows\System\QQCEwdX.exe
  2⤵
  PID:9396
- C:\Windows\System\bXMVqVB.exe
  C:\Windows\System\bXMVqVB.exe
  2⤵
  PID:9528
- C:\Windows\System\TSwHcjF.exe
  C:\Windows\System\TSwHcjF.exe
  2⤵
  PID:6080
- C:\Windows\System\FoeQYYN.exe
  C:\Windows\System\FoeQYYN.exe
  2⤵
  PID:6040
- C:\Windows\System\bVxBfTx.exe
  C:\Windows\System\bVxBfTx.exe
  2⤵
  PID:6888
- C:\Windows\System\eJVTQXb.exe
  C:\Windows\System\eJVTQXb.exe
  2⤵
  PID:9604
- C:\Windows\System\IyFEAfh.exe
  C:\Windows\System\IyFEAfh.exe
  2⤵
  PID:3752
- C:\Windows\System\wtdUXoU.exe
  C:\Windows\System\wtdUXoU.exe
  2⤵
  PID:8748
- C:\Windows\System\krwYrrR.exe
  C:\Windows\System\krwYrrR.exe
  2⤵
  PID:11320
- C:\Windows\System\nRtiHyd.exe
  C:\Windows\System\nRtiHyd.exe
  2⤵
  PID:11352
- C:\Windows\System\WwCjmuk.exe
  C:\Windows\System\WwCjmuk.exe
  2⤵
  PID:6456
- C:\Windows\System\SRpQdpv.exe
  C:\Windows\System\SRpQdpv.exe
  2⤵
  PID:11600
- C:\Windows\System\rEPYkao.exe
  C:\Windows\System\rEPYkao.exe
  2⤵
  PID:11668
- C:\Windows\System\oyYcTLU.exe
  C:\Windows\System\oyYcTLU.exe
  2⤵
  PID:11280
- C:\Windows\System\EPNdtdG.exe
  C:\Windows\System\EPNdtdG.exe
  2⤵
  PID:11572
- C:\Windows\System\BChWkTI.exe
  C:\Windows\System\BChWkTI.exe
  2⤵
  PID:11908
- C:\Windows\System\tWqrYjA.exe
  C:\Windows\System\tWqrYjA.exe
  2⤵
  PID:12096
- C:\Windows\System\gGWdHLF.exe
  C:\Windows\System\gGWdHLF.exe
  2⤵
  PID:10432
- C:\Windows\System\WQwmjBx.exe
  C:\Windows\System\WQwmjBx.exe
  2⤵
  PID:10068
- C:\Windows\System\kXGuylB.exe
  C:\Windows\System\kXGuylB.exe
  2⤵
  PID:12312
- C:\Windows\System\ZbaPdAX.exe
  C:\Windows\System\ZbaPdAX.exe
  2⤵
  PID:12388
- C:\Windows\System\AeBySKl.exe
  C:\Windows\System\AeBySKl.exe
  2⤵
  PID:12424
- C:\Windows\System\RpbmyDg.exe
  C:\Windows\System\RpbmyDg.exe
  2⤵
  PID:7440
- C:\Windows\System\WNRJXdQ.exe
  C:\Windows\System\WNRJXdQ.exe
  2⤵
  PID:12580
- C:\Windows\System\cwcfTmG.exe
  C:\Windows\System\cwcfTmG.exe
  2⤵
  PID:11256
- C:\Windows\System\nONJnKG.exe
  C:\Windows\System\nONJnKG.exe
  2⤵
  PID:8572
- C:\Windows\System\KdgUhRO.exe
  C:\Windows\System\KdgUhRO.exe
  2⤵
  PID:2640
- C:\Windows\System\MMiZxty.exe
  C:\Windows\System\MMiZxty.exe
  2⤵
  PID:13248
- C:\Windows\System\kXzuhcU.exe
  C:\Windows\System\kXzuhcU.exe
  2⤵
  PID:13284
- C:\Windows\System\LAbUaNt.exe
  C:\Windows\System\LAbUaNt.exe
  2⤵
  PID:10188
- C:\Windows\System\OMhFVmi.exe
  C:\Windows\System\OMhFVmi.exe
  2⤵
  PID:5468
- C:\Windows\System\mOEvzyM.exe
  C:\Windows\System\mOEvzyM.exe
  2⤵
  PID:1380
- C:\Windows\System\aUxuykt.exe
  C:\Windows\System\aUxuykt.exe
  2⤵
  PID:12132
- C:\Windows\System\hkPhirI.exe
  C:\Windows\System\hkPhirI.exe
  2⤵
  PID:10160
- C:\Windows\System\PipKNwZ.exe
  C:\Windows\System\PipKNwZ.exe
  2⤵
  PID:3600
- C:\Windows\System\SGKvukd.exe
  C:\Windows\System\SGKvukd.exe
  2⤵
  PID:2836
- C:\Windows\System\ZFrpoCi.exe
  C:\Windows\System\ZFrpoCi.exe
  2⤵
  PID:10244
- C:\Windows\System\RJpyOVl.exe
  C:\Windows\System\RJpyOVl.exe
  2⤵
  PID:11892
- C:\Windows\System\KKcYUwu.exe
  C:\Windows\System\KKcYUwu.exe
  2⤵
  PID:908
- C:\Windows\System\gGUQicY.exe
  C:\Windows\System\gGUQicY.exe
  2⤵
  PID:10616
- C:\Windows\System\KzdPNkS.exe
  C:\Windows\System\KzdPNkS.exe
  2⤵
  PID:10928
- C:\Windows\System\ioFhYLK.exe
  C:\Windows\System\ioFhYLK.exe
  2⤵
  PID:12020
- C:\Windows\System\raCycMY.exe
  C:\Windows\System\raCycMY.exe
  2⤵
  PID:12260
- C:\Windows\System\RDGZBeV.exe
  C:\Windows\System\RDGZBeV.exe
  2⤵
  PID:11128
- C:\Windows\System\wMeSKQZ.exe
  C:\Windows\System\wMeSKQZ.exe
  2⤵
  PID:12304
- C:\Windows\System\yXllglR.exe
  C:\Windows\System\yXllglR.exe
  2⤵
  PID:13104
- C:\Windows\System\wqImREF.exe
  C:\Windows\System\wqImREF.exe
  2⤵
  PID:7436
- C:\Windows\System\jgjzfBD.exe
  C:\Windows\System\jgjzfBD.exe
  2⤵
  PID:7900
- C:\Windows\System\jxsiLUh.exe
  C:\Windows\System\jxsiLUh.exe
  2⤵
  PID:12624
- C:\Windows\System\APxeYQA.exe
  C:\Windows\System\APxeYQA.exe
  2⤵
  PID:11192
- C:\Windows\System\hjsJEvd.exe
  C:\Windows\System\hjsJEvd.exe
  2⤵
  PID:12060
- C:\Windows\System\rSOoqVc.exe
  C:\Windows\System\rSOoqVc.exe
  2⤵
  PID:10768
- C:\Windows\System\tRfigrm.exe
  C:\Windows\System\tRfigrm.exe
  2⤵
  PID:6804
- C:\Windows\System\aeNWUGU.exe
  C:\Windows\System\aeNWUGU.exe
  2⤵
  PID:11044
- C:\Windows\System\MBzRfAT.exe
  C:\Windows\System\MBzRfAT.exe
  2⤵
  PID:12420
- C:\Windows\System\NpWnFFX.exe
  C:\Windows\System\NpWnFFX.exe
  2⤵
  PID:10344
- C:\Windows\System\oJsnWRW.exe
  C:\Windows\System\oJsnWRW.exe
  2⤵
  PID:11064
- C:\Windows\System\pdheYtt.exe
  C:\Windows\System\pdheYtt.exe
  2⤵
  PID:11948
- C:\Windows\System\uGiLLab.exe
  C:\Windows\System\uGiLLab.exe
  2⤵
  PID:1612
- C:\Windows\System\foMVfQx.exe
  C:\Windows\System\foMVfQx.exe
  2⤵
  PID:11672
- C:\Windows\System\mJZjPax.exe
  C:\Windows\System\mJZjPax.exe
  2⤵
  PID:12988
- C:\Windows\System\DBIPFWA.exe
  C:\Windows\System\DBIPFWA.exe
  2⤵
  PID:324
- C:\Windows\System\EPgvaXN.exe
  C:\Windows\System\EPgvaXN.exe
  2⤵
  PID:1000
- C:\Windows\System\HQzpveY.exe
  C:\Windows\System\HQzpveY.exe
  2⤵
  PID:8784
- C:\Windows\System\CbvlTNG.exe
  C:\Windows\System\CbvlTNG.exe
  2⤵
  PID:6004
- C:\Windows\System\sZPCaOi.exe
  C:\Windows\System\sZPCaOi.exe
  2⤵
  PID:10368
- C:\Windows\System\CehiBIJ.exe
  C:\Windows\System\CehiBIJ.exe
  2⤵
  PID:5248
- C:\Windows\System\sAylXGp.exe
  C:\Windows\System\sAylXGp.exe
  2⤵
  PID:10528
- C:\Windows\System\dlsZrtq.exe
  C:\Windows\System\dlsZrtq.exe
  2⤵
  PID:12144
- C:\Windows\System\SpYVGPE.exe
  C:\Windows\System\SpYVGPE.exe
  2⤵
  PID:12148
- C:\Windows\System\omjSKBk.exe
  C:\Windows\System\omjSKBk.exe
  2⤵
  PID:12116
- C:\Windows\System\JIWgrNQ.exe
  C:\Windows\System\JIWgrNQ.exe
  2⤵
  PID:13152
- C:\Windows\System\SvRlnsH.exe
  C:\Windows\System\SvRlnsH.exe
  2⤵
  PID:8116
- C:\Windows\System\FwxcLcR.exe
  C:\Windows\System\FwxcLcR.exe
  2⤵
  PID:2080
- C:\Windows\System\igtHFwL.exe
  C:\Windows\System\igtHFwL.exe
  2⤵
  PID:11728
- C:\Windows\System\mMPfNMT.exe
  C:\Windows\System\mMPfNMT.exe
  2⤵
  PID:11956
- C:\Windows\System\ydsEIZD.exe
  C:\Windows\System\ydsEIZD.exe
  2⤵
  PID:9580
- C:\Windows\System\OEAFTqJ.exe
  C:\Windows\System\OEAFTqJ.exe
  2⤵
  PID:856
- C:\Windows\System\opsvAaG.exe
  C:\Windows\System\opsvAaG.exe
  2⤵
  PID:12904
- C:\Windows\System\XkDZJEf.exe
  C:\Windows\System\XkDZJEf.exe
  2⤵
  PID:11768
- C:\Windows\System\BZZlRzl.exe
  C:\Windows\System\BZZlRzl.exe
  2⤵
  PID:1700
- C:\Windows\System\dBmpfti.exe
  C:\Windows\System\dBmpfti.exe
  2⤵
  PID:9404
- C:\Windows\System\iCRToqW.exe
  C:\Windows\System\iCRToqW.exe
  2⤵
  PID:7032
- C:\Windows\System\VbAmZhq.exe
  C:\Windows\System\VbAmZhq.exe
  2⤵
  PID:5656
- C:\Windows\System\rkOxYxd.exe
  C:\Windows\System\rkOxYxd.exe
  2⤵
  PID:9944
- C:\Windows\System\QFATQbw.exe
  C:\Windows\System\QFATQbw.exe
  2⤵
  PID:7004
- C:\Windows\System\NJJagTG.exe
  C:\Windows\System\NJJagTG.exe
  2⤵
  PID:7008
- C:\Windows\System\RwqUUhY.exe
  C:\Windows\System\RwqUUhY.exe
  2⤵
  PID:12832
- C:\Windows\System\mgIHfvj.exe
  C:\Windows\System\mgIHfvj.exe
  2⤵
  PID:4612
- C:\Windows\System\hATKKaN.exe
  C:\Windows\System\hATKKaN.exe
  2⤵
  PID:1940
- C:\Windows\System\ZdBvtlO.exe
  C:\Windows\System\ZdBvtlO.exe
  2⤵
  PID:3172
- C:\Windows\System\haQiWps.exe
  C:\Windows\System\haQiWps.exe
  2⤵
  PID:5228
- C:\Windows\System\VwFgpMO.exe
  C:\Windows\System\VwFgpMO.exe
  2⤵
  PID:6300
- C:\Windows\System\qQRNOcL.exe
  C:\Windows\System\qQRNOcL.exe
  2⤵
  PID:13264
- C:\Windows\System\gtGWEMt.exe
  C:\Windows\System\gtGWEMt.exe
  2⤵
  PID:10524
- C:\Windows\System\OvoODCM.exe
  C:\Windows\System\OvoODCM.exe
  2⤵
  PID:10052
- C:\Windows\System\oxAQaIe.exe
  C:\Windows\System\oxAQaIe.exe
  2⤵
  PID:10960
- C:\Windows\System\KBbtmet.exe
  C:\Windows\System\KBbtmet.exe
  2⤵
  PID:11804
- C:\Windows\System\pNdyYVt.exe
  C:\Windows\System\pNdyYVt.exe
  2⤵
  PID:4796
- C:\Windows\System\MCpsxFm.exe
  C:\Windows\System\MCpsxFm.exe
  2⤵
  PID:11116
- C:\Windows\System\zYOLkJb.exe
  C:\Windows\System\zYOLkJb.exe
  2⤵
  PID:13156
- C:\Windows\System\yCRMvMZ.exe
  C:\Windows\System\yCRMvMZ.exe
  2⤵
  PID:13040
- C:\Windows\System\VbZnMWs.exe
  C:\Windows\System\VbZnMWs.exe
  2⤵
  PID:10732
- C:\Windows\System\FMZuzEj.exe
  C:\Windows\System\FMZuzEj.exe
  2⤵
  PID:10828
- C:\Windows\System\UTgarza.exe
  C:\Windows\System\UTgarza.exe
  2⤵
  PID:13320
- C:\Windows\System\hdyOEBr.exe
  C:\Windows\System\hdyOEBr.exe
  2⤵
  PID:13336
- C:\Windows\System\ANXdXew.exe
  C:\Windows\System\ANXdXew.exe
  2⤵
  PID:13352
- C:\Windows\System\zkOYtky.exe
  C:\Windows\System\zkOYtky.exe
  2⤵
  PID:13368
- C:\Windows\System\SWECcsW.exe
  C:\Windows\System\SWECcsW.exe
  2⤵
  PID:13384
- C:\Windows\System\ppYvRZE.exe
  C:\Windows\System\ppYvRZE.exe
  2⤵
  PID:13448
- C:\Windows\System\QyDHeuH.exe
  C:\Windows\System\QyDHeuH.exe
  2⤵
  PID:13472
- C:\Windows\System\QPOxWly.exe
  C:\Windows\System\QPOxWly.exe
  2⤵
  PID:13500
- C:\Windows\System\HtKgOOk.exe
  C:\Windows\System\HtKgOOk.exe
  2⤵
  PID:13896
- C:\Windows\System\gNnQuUz.exe
  C:\Windows\System\gNnQuUz.exe
  2⤵
  PID:14008
- C:\Windows\System\CrljfNI.exe
  C:\Windows\System\CrljfNI.exe
  2⤵
  PID:14316
- C:\Windows\System\wIYojst.exe
  C:\Windows\System\wIYojst.exe
  2⤵
  PID:4204
- C:\Windows\System\cJfuixo.exe
  C:\Windows\System\cJfuixo.exe
  2⤵
  PID:13380
- C:\Windows\System\WxOvfJg.exe
  C:\Windows\System\WxOvfJg.exe
  2⤵
  PID:13420
- C:\Windows\System\dIWIzfI.exe
  C:\Windows\System\dIWIzfI.exe
  2⤵
  PID:13456
- C:\Windows\System\igMAdiQ.exe
  C:\Windows\System\igMAdiQ.exe
  2⤵
  PID:11960
- C:\Windows\System\sTonFgJ.exe
  C:\Windows\System\sTonFgJ.exe
  2⤵
  PID:1948
- C:\Windows\System\unlpLgN.exe
  C:\Windows\System\unlpLgN.exe
  2⤵
  PID:13712
- C:\Windows\System\fIZsBzZ.exe
  C:\Windows\System\fIZsBzZ.exe
  2⤵
  PID:13592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ujazv3ja.v3e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AOtdjaP.exe

Filesize
1.6MB

MD5
2af9bf33a40849fc9f5386f30427ca5a

SHA1
9efcb19fda3690c6eaaa7497a63d9a7ee39b8866

SHA256
ece7bf87bb169e5515de7fcf0313d4bd0bdf2944ca345e788d399f978e92bb0b

SHA512
cd1ee6caa108e0bd91c8c5d91ad326ebc7d2cc8af167fa16a584e5574bac0767add9c7891d26c29c2e57a270f46861a713ad4db20555d85eaf980cadba4e1042

Download Submit
C:\Windows\System\BDsPmGJ.exe

Filesize
1.6MB

MD5
894582224d752bd1eb7684fab0504101

SHA1
f22efc2c0a9b6e0731e620faab7b5fd9e69eac75

SHA256
f6ef973ff67cf3c9f60bc855561c2a70d075a359db4ebfe126da25936879dc4f

SHA512
33484157d1e357e05097bd6b3a9f9b7cf8ce2a04518b3153fe361616092d6b68bcf96eed2bf2c736434b564918326abe396fff93f66cb0610ae257c6a05ebb9f

Download Submit
C:\Windows\System\BIThgas.exe

Filesize
1.6MB

MD5
be91142c6b5e655b12617effeae71473

SHA1
fdbd89db63cf380ba6ec8325a25862ece1152e1c

SHA256
bb225a320babf3cd621a4f4dc31196f6c3a50a8867846acb729151eb599bd2fb

SHA512
91881c705d9a0d0319c5e9359355f587968c158d5ed3ae512f04b1a50d5a2ec18c231bb67d70ed6f8360150815200c9d706853b847789e47e26401fcf753187c

Download Submit
C:\Windows\System\CpVvWOg.exe

Filesize
1.6MB

MD5
6e7c81f8fbdaa6a9fefb7f06807cc969

SHA1
e5363bfdba2951ec2c1e4c0f2b4b13a50f91a25f

SHA256
1a1c20f8fc042d60c84957c72f1758905571231b72eec239701026dfd5295f5f

SHA512
e51cf9cab1af0ba1d681a761aae0a4b3e391bd407eb0dae18e56a27dc22c2767cc47a0967752a38676537026b119c667be7953e36baf0e9f961df44b6be25ffa

Download Submit
C:\Windows\System\DMeTXtX.exe

Filesize
1.6MB

MD5
cc86dab417969a12890940feae49a558

SHA1
4f039c2e8c831bbf051ba881be340549b1d30459

SHA256
29bab6a6a87c5a8bf898a2999a5d37754888fafaf4d162df85643bb81de37fc7

SHA512
2cd7699fcb1a2e619ccf6b534c78a6a16ac496126de50be93285f96991d785e03d6d8fe3dd23e293228e8d63133978c9d2193726f486a7ec30f4d80ad6591947

Download Submit
C:\Windows\System\DkiUuho.exe

Filesize
1.6MB

MD5
012db0563f700f660edef23ecb278182

SHA1
e4d6f603def7d7019ca5577fd08071a096926295

SHA256
b673ce168980364ae73c746c40bdb261c4c1d003d1bc7095b363d7dbe0903358

SHA512
f4d1423acd56712cb27d8eea5625c31f706edd62885dbcdeaed39cf50c6ecaa40f8605b8ef8d335db012fc3d8d66230e2189de72c80ca6b077b9adc41252629b

Download Submit
C:\Windows\System\HBXqAZb.exe

Filesize
1.6MB

MD5
b3ef1150b680e00ae458bea4567fe1be

SHA1
533b1e87f7c97bfe5b691a0668814f308c154b81

SHA256
57e2f19faa8392993da69e73eef09bfc884b81e740ea18556c69bdd8adbbfdc8

SHA512
81e488219184dceed4be94c47603e3853c1c73591aacd41cca4d44ae5b3fa0ed313ca9032fac28aedff9f962486ff85b4f2ecf912cc3e992f09d0ba433dd9980

Download Submit
C:\Windows\System\IeCdRxa.exe

Filesize
1.6MB

MD5
0eca8a08509fe1d1441399cd7b9b3ff1

SHA1
b64a0d74abdaf7312e4ca5468c667686ec278be2

SHA256
a093c42d9a766b5eb84909780dde1563105f8c91114b2d15d7297acadde66f04

SHA512
8eb360ca23804a9fed092f05dfd94640aca473df422a7d6a6b3ac6fc7c118625b218653bc1ce4cb8a66edfe9a7e577af1072c9b7a9bbbbe39ef74a0d44b9be36

Download Submit
C:\Windows\System\KvBsodF.exe

Filesize
1.6MB

MD5
ff1baecc0a1d5b9c64b275ea6bbec10e

SHA1
69206602a4adc4ace1df07b9ecdbbb0430ec5139

SHA256
8b1daa1074914f14ccf8ae7baa8928134d6f7414cced2fe518cc341c6157123d

SHA512
f418d5dac7870e63687cb9ac669dedf4ff48898486ff5588b4eef801b37b589031afdf4ecac96538d79abcccbe0c611b890024f9c4666d87c50677ad57f13533

Download Submit
C:\Windows\System\LhgPLDA.exe

Filesize
1.6MB

MD5
3b7326b3498845cc5cfed2b8a01e7023

SHA1
2a22a289faeec5139cfabd0b37673cf66b3b9c34

SHA256
eb0a3cf1320464ada0651214e34e99b33dd54eef8293961057d10ad2adfaf598

SHA512
0e5575ceb4beb5ff95d40eb2dd338a3f62510ea8df09f2d7fa5177045dd562b45c4eb62588bf7983fe4310c349efe74ce2bb65aadc5cb7e320605169b2b43540

Download Submit
C:\Windows\System\NGROPUf.exe

Filesize
1.6MB

MD5
f46b918adf45bb3059160d3e471e40df

SHA1
5b64f89cd19555b94db543aa9d04d6df6bed9313

SHA256
1ca0d053d1fdb3557216a36cd1b72dd89879ae382864443ee810e82bfbfc29d2

SHA512
66c1d812227790a2afdad7ee1a62dbf2ec6bfc48d1985d28ccf1930336bed650c422cf47d0279bcf7d67ba6e42a3b28b8713a36d75843fdcdd32a40dcc921e65

Download Submit
C:\Windows\System\NQGZeke.exe

Filesize
1.6MB

MD5
03115d79edeacdf9693af755eff96a35

SHA1
30dfbe5cc027ce3aac368227a516be38bb687dbe

SHA256
2cf1f5f0087f519837ab70c720ce4a177d75d33909f90d473dc57fc0795362d2

SHA512
4c9ba541af7584e66ed374f4ce3166f4f667cb0bd23aa505087e7581071feca6fe01f2642364374fc5b6efced9be8556afe62e817ca16db97884bea694d05c68

Download Submit
C:\Windows\System\OAKJIjK.exe

Filesize
1.6MB

MD5
0c4e0a8360940fdc17daee9013712419

SHA1
f307e6725c5bfe798de18afe623d7ee74c9a8236

SHA256
6406804171cb83c4278d2f83b7420cbdc92594e0cf690d037aaf9b608e744856

SHA512
1f040a23286dbca401107e7ae9f869dd99775e2fe1663721faf03b3a4e6982aac35b5721cd84e2f2ab30855401b38f029205fd3de0712220dc199b397a14e199

Download Submit
C:\Windows\System\OwXnFYV.exe

Filesize
1.6MB

MD5
a2821c281bf87fbc39ef5781bbf59805

SHA1
862a30a5062419a320fc0a4ef74b3f7422c51039

SHA256
cbf0f86bdd8f6b5d60669b76690a118c111d03300d1131c69c394825ba8e0222

SHA512
34747e4dfe2a3f51bd29ff93612594916f46b3d08734e7c6b962d313c2d23236cf8b9edfdb57da45466af1d95396bd524063d78dbf45db55346b2a98c7c00244

Download Submit
C:\Windows\System\QqnOGyP.exe

Filesize
1.6MB

MD5
85cd3ab751523daf490f8a23ea5b8ff6

SHA1
40d9def946046fd505bd8b2cafa5222ea2154b60

SHA256
ef24fb56c86a095132f5c7651c1a35e3038c7dc84c96e77844b8600d72a1d14a

SHA512
77cfd442d1f600e458fc31da3e0a29efd34f7c349b2015252612f66873d8a7a724a044ea01dc947097c1fb731c585efbb8cf6f12bd76e13daa94d5202c0ade9c

Download Submit
C:\Windows\System\RRXgzzk.exe

Filesize
1.6MB

MD5
cbdfd85e3dfbfdad863a93a78cfc9df1

SHA1
d67abcf57a676a5d9a469f72385423a6565c1231

SHA256
f35febdc847e9a366d7e6f6b8c0c6bc82cc19b804ee99eb68326969e2b4fd0a4

SHA512
6220e8ac6a2292a6eb7a65aac977e6ea8feeecf6337472c4698128b66701b3612569b23adcb8dac8f21ea9da0edc0963579c29b85d71666ea50e4a4f20b3b19e

Download Submit
C:\Windows\System\TIlIHsj.exe

Filesize
1.6MB

MD5
0896000b7d38cfc83309eb8b3304eb5c

SHA1
b4fb1bdf4ed0c043969b113576f537d9f1f58d66

SHA256
b0d3244da29572ef59ce09c9326c4868881825684be6f78ccdcf0469a5639575

SHA512
ece6348b6df6cae1463d8375e721329ae0d0515c7a117ffea8d373750a34834a9629dec0a2d3726979da23f450267c36ab25c2fc03cd0b33b70f4219386c04a9

Download Submit
C:\Windows\System\VPEBfTu.exe

Filesize
1.6MB

MD5
01d6762967d85c8df33141abff1a8d9e

SHA1
79e1718a243245c012a84c8165faf010a331f9af

SHA256
8f9f0987f2d577ebc7e6a7b7fcbc89e1eec0fe219cd2507987bf2731df5a09d7

SHA512
7f32173878d6ea80db9a873de34465f6b61c106fd2707882e2ed827b3c55658ed528baa5e61ba81e46ab3de9a920c9c01e54f6d65c67a7d77c0f0494c3798698

Download Submit
C:\Windows\System\WWjrckx.exe

Filesize
1.6MB

MD5
f439894eb5b55a6040656a1e44a16570

SHA1
8aa4f84fbbe9206759e4504d3ddfb2c45413e285

SHA256
88ec46ee404800a44fa9345467e24732e70b7eb1c75fcc0ca5014eacaf5680a2

SHA512
edf8272562c4ae6ea3f2bcb5788550319c6c9e427e1a10e1c81fe790bda05386bca634d643f90afb7d0d8e43b6cb8c80227b72e2d1e1461b7b16e046001b7dbe

Download Submit
C:\Windows\System\ZkhvkWz.exe

Filesize
1.6MB

MD5
ddfab78a908972446258117c02950d5d

SHA1
c3307d4e338fb8da2f6930cb7c6f1500a3cce8fd

SHA256
c6bce6240cbf3988e5a34ad8b9941aa6dc2a25a5b0a37207740d2bba15db4a7a

SHA512
498fa1cb806a1c5c31a4769c82bd7089a3234b635f9bad24d471040501e010820db049a9f47be1b4d1ee5e9592b56bf37bc202f55acfedfac66fe4068555af45

Download Submit
C:\Windows\System\ZxbNDQA.exe

Filesize
1.6MB

MD5
204e96dde0cec5530cb3903f576186e9

SHA1
2d29a4a0d0fd73991756169ed861b63688851ad1

SHA256
f4ad2db51abd4e388a7a591798f0f43c746729c7c4601f299bda123bc50969d1

SHA512
f0a8ad7256444843642634a70df866e88da512aed2dfd80c066add66ad4543a9735c58fc899183408d77afc1f3046c8e0953c96e2f94fae24da4a7a4d73251ea

Download Submit
C:\Windows\System\bdFSYwo.exe

Filesize
1.6MB

MD5
cc9af23ac53659c40fa6e2c181a5f4f8

SHA1
0c808e376dacdd0d427958f913c199ad809598a3

SHA256
9799962deb54a82b37dae174913f6751206da643d6a29a44aedbd51902a93791

SHA512
05388f05c9fec233288de6a2c247f68fdc522d1dc1df5b272e34ccce70cb23282290191216d7999a54bb14d9601e00e60fb05c2c4c480609769eedeffde079b4

Download Submit
C:\Windows\System\cjxzYPG.exe

Filesize
1.6MB

MD5
714c45e43acee7cfe8930cdc8a02d4c8

SHA1
88faaf2e0e1fa76c7783808a8b83c61aeae67cc7

SHA256
82e588879a3d0b6a1f37459d227446c7938e39821a14a879e07a1eca65bdcc58

SHA512
b088b8f819730b26fc31b7239a44781b5a1882811a552a26ceb47abe49b4212094e8fa0a7409dc83ce5d8c4a9919df2684469d20094949063d559164ab78b183

Download Submit
C:\Windows\System\dCReZyl.exe

Filesize
1.6MB

MD5
bfed827082f0d8bc73c2a45c75662eb2

SHA1
c4a91c44724cf47a4c43fcc27949c342519c736f

SHA256
b040bdcb579d00522ec8393db61e79da3b6b248f35c26bf3b09a35744eab3e5a

SHA512
c09061282f5d63c024b74f1b38602a6dd9c80d30e8a7e9bfc3d954cccc4228c1a39ff59c3725920be6921d8e71024bd0a77030359e8918356d40203b44242552

Download Submit
C:\Windows\System\dKRdAGA.exe

Filesize
1.6MB

MD5
617378abb11b74996875d8b5c3bb89ed

SHA1
9956e76b8bb0679eb8bf6f11ed84ce042fb8f647

SHA256
c51c4cd9aaedc55c959674ae3a35904738d11f9437dbc291bae4cc8bc78afb61

SHA512
0cc97e05894304058748c0850d0e8a9dd05a257e27c578a0a21846f2ed831f6d586fcf3b89e0f749b1072e9e99242f003d772f52bfa061861037cf535347dcee

Download Submit
C:\Windows\System\ehiUgzL.exe

Filesize
1.6MB

MD5
f2c9daa91bdb302e79fc8df2d18eba0e

SHA1
d4d853bfd25d4c7a4ec471b31adc2a72820c9873

SHA256
32cdf3136b38381f711658f252d15178ce979adfa4fda99d8762f27ec25f4da6

SHA512
4dfb3847b6c168afae1c972a00285191316e88aa5dc7758b09249218cc8f2741fd3c39094d4db41b0b4541f2aeda59a110285379aba5de1028cafe24cc4a7351

Download Submit
C:\Windows\System\fbbcDhS.exe

Filesize
1.6MB

MD5
3628e579d193239e6ee239835b58a506

SHA1
d047ef7c921a30b33e1108ca8cfd23ab52067c07

SHA256
1b6735fa743e82efdc50a7b4961cf5cc50e44e2ba8b66c63ac202c0064bc2ff3

SHA512
b7bc9e08197bd429958e62b503dd28ff5ed7ee1ef80294e321b3e980751ae08819bf5f5eb9d898628d0e924c5b7ea385163cca96304b04f43ec7026d44f567e8

Download Submit
C:\Windows\System\gMBTSyq.exe

Filesize
1.6MB

MD5
908606ccbe70a7834485b7a502f7809d

SHA1
9d41565cffef5560147b7e5a1da7472adfde428e

SHA256
956b34a42c432c891e6a0611991a2a9ca92089ef6e1a4bce02c3ddeffcd43a12

SHA512
41f071e43be2d34fbf3c3c79368c425abe6736d62473029efd638395d76f8adb4326ca38337d1c84da97d3264659a9490193f2cf06117a5d93a966f65d018abf

Download Submit
C:\Windows\System\gtxIbKY.exe

Filesize
1.6MB

MD5
2407b6a92b4debe71499e46b0a9eb3f6

SHA1
1f08b8c5cd7763e83311b9858b20581e44ca4a10

SHA256
a9371c59322c3b0916141e08e9e09b3750cfc84824dbb9604663ec16432959e2

SHA512
b704ddc1d3bbad85cd23a6403e779976402ae24da187f8da5a2307d1ef3e8f60a91265c6bfaebc8ce2b8ae1585b5ea76677c3faae65c9ba9b46f0cbce24bca61

Download Submit
C:\Windows\System\iNcXlYK.exe

Filesize
1.6MB

MD5
e62cd88ce95634eec771747be06f4025

SHA1
ee891982a793c66a2edeee29c6666d1c88ea053b

SHA256
c5e4122d3f10cfe5d4621852167e72e40d654c739154883b5f4ca26574ca09b2

SHA512
2090ef89cfd564d25eb9f9130a5d948b890ada98aa8e0fb145c19442bcc1c45e9227e3d7c5679e5d39f59cc78e66efef6e394fb313db6c7ba3ee95935b57e2a1

Download Submit
C:\Windows\System\jTCrodr.exe

Filesize
1.6MB

MD5
e660ebaf0f7c451f951bcb2b11c39858

SHA1
c5532b63880b3fd692bd4f1c276125bb25282d4e

SHA256
82b299821f13dc1e9bcb914ce95e19964e2b5984cc0f605eb10e9694dd92d0d5

SHA512
33874051aee2c5a769e7fcc8f5c20afe102d0ed669686ac2100e85b7fd1d21edb99d046b21c069eb874d8872508b66ef1833392ca78fe7ebc3833000ab47c646

Download Submit
C:\Windows\System\kBVmAQb.exe

Filesize
1.6MB

MD5
a7dc88dbc5163e32c8b0a8aa4fdcaa17

SHA1
aad765059d158e5ec3f763d04b07aa41758a0414

SHA256
44a9c84b8164ac3e1746d4bcb79b3300d5858a9d2974f54d995450006618c5e1

SHA512
c450df697c65b36764b75c59c732c1bc3001a7e20ed8e13e133689ce2730982ed4ad290ea0407c3604f80cdd3c3ad07cf6cd21b01b6839d49bdbf84174ed99ef

Download Submit
C:\Windows\System\kMEUPTn.exe

Filesize
1.6MB

MD5
b181a18e94949a549e54f49d426cbccb

SHA1
235d6fae1fd7781f8c4228c8283cc6d5dd5fdc43

SHA256
bd738fbb6ac2576673162ec0629850bcef8031fbce1594200dffccebceab375a

SHA512
b5447207f08227c7349fe572413bf767e3d163da987515effee7dd872a57ece85f4fcaad5f0b2699a60774eeaa7460bde597612c816a1343a174a30671401625

Download Submit
C:\Windows\System\mZHPoeT.exe

Filesize
1.6MB

MD5
a010098d967d3a43253849db822c730a

SHA1
90b1afb1f4cb9320177e9b963857d37dd4ded147

SHA256
866a6b518919358cc1f7914e8ab267194fce3e913e49f77d314493c2b61d76b6

SHA512
108fa88ad2b07381ddbaf8db36adf65313b0b5f3190c4cbcb0f05501e27dec9c1a70240486584c63cd36deb4248ee3b80eed7f89fe2754f6f654a5419b49f7db

Download Submit
C:\Windows\System\rOUtxvj.exe

Filesize
1.6MB

MD5
70f1c5e286947c590fc0908f2b6d5c01

SHA1
20054e409a4954e221f24a7c3d8cfb886e2aafef

SHA256
a883931e8c92ccd50104f84a9aa35ab70e80bb2351686bfbae631bddc0b9a0ba

SHA512
13ffb9b69fa072e8cc04b398101a8a377e54509457575b5056883b088cd4278432acfdf53dc42f4d50ba1ea7613e8bd70a3016a88dc64f3d587c3e2ee9de3831

Download Submit
C:\Windows\System\vWfMIQM.exe

Filesize
1.6MB

MD5
6803d6fcf75b9c738c9f34cc52a80835

SHA1
8ccf8c13a5894eb861c8cd8179ccd9e99ff9513c

SHA256
90df07265a0d173d1ae3e2b8e7e392431aeb95ab2f82da28fe5a68d7c3251be4

SHA512
c704964ecf23b72781a917ffec8bc078477dc6d1011114211b3c229492f7e52f2cdb2136079d4fab884b74b57f1fbdf444125f0e2934fa0a0e856bbd26f79809

Download Submit
C:\Windows\System\xkTCahq.exe

Filesize
1.6MB

MD5
6969af5edfe68e0853b4cadbf83a300c

SHA1
5059f9defef56db37b2ac6b0c2e1073d21946055

SHA256
012cf520c89a865d65f2995c7b6899a197c496f05f2097676b2538186d703bf7

SHA512
e499678d0658f979ae05838bd57828d6f8ef6c5c66278021a385adbef3a9afe1345a1dbe8a08a98dc4b3aabe02887b22c96fe66af5ab9485b6568d90f93dc25c

Download Submit
memory/216-566-0x00007FF7E0220000-0x00007FF7E0612000-memory.dmp

Filesize
3.9MB

Download
memory/216-2746-0x00007FF7E0220000-0x00007FF7E0612000-memory.dmp

Filesize
3.9MB

Download
memory/244-322-0x00007FF7B8720000-0x00007FF7B8B12000-memory.dmp

Filesize
3.9MB

Download
memory/244-2751-0x00007FF7B8720000-0x00007FF7B8B12000-memory.dmp

Filesize
3.9MB

Download
memory/828-31-0x00007FF64C7A0000-0x00007FF64CB92000-memory.dmp

Filesize
3.9MB

Download
memory/828-2703-0x00007FF64C7A0000-0x00007FF64CB92000-memory.dmp

Filesize
3.9MB

Download
memory/828-2707-0x00007FF64C7A0000-0x00007FF64CB92000-memory.dmp

Filesize
3.9MB

Download
memory/1572-163-0x00007FF632490000-0x00007FF632882000-memory.dmp

Filesize
3.9MB

Download
memory/1572-2727-0x00007FF632490000-0x00007FF632882000-memory.dmp

Filesize
3.9MB

Download
memory/1648-372-0x00007FF6FFC90000-0x00007FF700082000-memory.dmp

Filesize
3.9MB

Download
memory/1648-2734-0x00007FF6FFC90000-0x00007FF700082000-memory.dmp

Filesize
3.9MB

Download
memory/1800-296-0x00007FF69B470000-0x00007FF69B862000-memory.dmp

Filesize
3.9MB

Download
memory/1800-2743-0x00007FF69B470000-0x00007FF69B862000-memory.dmp

Filesize
3.9MB

Download
memory/1864-196-0x00007FF7AEA20000-0x00007FF7AEE12000-memory.dmp

Filesize
3.9MB

Download
memory/1864-2709-0x00007FF7AEA20000-0x00007FF7AEE12000-memory.dmp

Filesize
3.9MB

Download
memory/2124-81-0x00007FF7A6720000-0x00007FF7A6B12000-memory.dmp

Filesize
3.9MB

Download
memory/2124-2721-0x00007FF7A6720000-0x00007FF7A6B12000-memory.dmp

Filesize
3.9MB

Download
memory/2312-493-0x00007FF70A070000-0x00007FF70A462000-memory.dmp

Filesize
3.9MB

Download
memory/2312-2735-0x00007FF70A070000-0x00007FF70A462000-memory.dmp

Filesize
3.9MB

Download
memory/2416-571-0x00007FF7EEDA0000-0x00007FF7EF192000-memory.dmp

Filesize
3.9MB

Download
memory/2416-2738-0x00007FF7EEDA0000-0x00007FF7EF192000-memory.dmp

Filesize
3.9MB

Download
memory/2520-567-0x00007FF781030000-0x00007FF781422000-memory.dmp

Filesize
3.9MB

Download
memory/2520-2742-0x00007FF781030000-0x00007FF781422000-memory.dmp

Filesize
3.9MB

Download
memory/2940-488-0x00007FF659100000-0x00007FF6594F2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-2747-0x00007FF659100000-0x00007FF6594F2000-memory.dmp

Filesize
3.9MB

Download
memory/3356-572-0x00007FF637C40000-0x00007FF638032000-memory.dmp

Filesize
3.9MB

Download
memory/3356-2725-0x00007FF637C40000-0x00007FF638032000-memory.dmp

Filesize
3.9MB

Download
memory/3452-2717-0x00007FF7A2CF0000-0x00007FF7A30E2000-memory.dmp

Filesize
3.9MB

Download
memory/3452-230-0x00007FF7A2CF0000-0x00007FF7A30E2000-memory.dmp

Filesize
3.9MB

Download
memory/3544-2749-0x00007FF7ACC10000-0x00007FF7AD002000-memory.dmp

Filesize
3.9MB

Download
memory/3544-323-0x00007FF7ACC10000-0x00007FF7AD002000-memory.dmp

Filesize
3.9MB

Download
memory/3768-1-0x0000022F41370000-0x0000022F41380000-memory.dmp

Filesize
64KB

Download
memory/3768-0-0x00007FF6B63D0000-0x00007FF6B67C2000-memory.dmp

Filesize
3.9MB

Download
memory/3952-2705-0x00007FF711240000-0x00007FF711632000-memory.dmp

Filesize
3.9MB

Download
memory/3952-77-0x00007FF711240000-0x00007FF711632000-memory.dmp

Filesize
3.9MB

Download
memory/3952-2719-0x00007FF711240000-0x00007FF711632000-memory.dmp

Filesize
3.9MB

Download
memory/3976-2730-0x00007FF760390000-0x00007FF760782000-memory.dmp

Filesize
3.9MB

Download
memory/3976-416-0x00007FF760390000-0x00007FF760782000-memory.dmp

Filesize
3.9MB

Download
memory/4240-149-0x00007FF7BA850000-0x00007FF7BAC42000-memory.dmp

Filesize
3.9MB

Download
memory/4240-2711-0x00007FF7BA850000-0x00007FF7BAC42000-memory.dmp

Filesize
3.9MB

Download
memory/4580-2755-0x00007FF6331A0000-0x00007FF633592000-memory.dmp

Filesize
3.9MB

Download
memory/4580-573-0x00007FF6331A0000-0x00007FF633592000-memory.dmp

Filesize
3.9MB

Download
memory/4584-569-0x00007FF6A1E40000-0x00007FF6A2232000-memory.dmp

Filesize
3.9MB

Download
memory/4584-2723-0x00007FF6A1E40000-0x00007FF6A2232000-memory.dmp

Filesize
3.9MB

Download
memory/4680-2739-0x00007FF7DC230000-0x00007FF7DC622000-memory.dmp

Filesize
3.9MB

Download
memory/4680-568-0x00007FF7DC230000-0x00007FF7DC622000-memory.dmp

Filesize
3.9MB

Download
memory/4812-570-0x00007FF662090000-0x00007FF662482000-memory.dmp

Filesize
3.9MB

Download
memory/4812-2713-0x00007FF662090000-0x00007FF662482000-memory.dmp

Filesize
3.9MB

Download
memory/4848-2731-0x00007FF603F00000-0x00007FF6042F2000-memory.dmp

Filesize
3.9MB

Download
memory/4848-269-0x00007FF603F00000-0x00007FF6042F2000-memory.dmp

Filesize
3.9MB

Download
memory/5004-2704-0x00007FF6BB7D0000-0x00007FF6BBBC2000-memory.dmp

Filesize
3.9MB

Download
memory/5004-37-0x00007FF6BB7D0000-0x00007FF6BBBC2000-memory.dmp

Filesize
3.9MB

Download
memory/5004-2715-0x00007FF6BB7D0000-0x00007FF6BBBC2000-memory.dmp

Filesize
3.9MB

Download