xmrig | 51d3a97f8438a3cd1f81b6c2283edd104334cdbda655a6b454cb637249391f55

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bb2301b7a09e4619b9ede0deb4e3dc90N.exe
Size

2.1MB
MD5

bb2301b7a09e4619b9ede0deb4e3dc90
SHA1

d5aa160b17df7d58ccfd924a977a05f1178fe365
SHA256

51d3a97f8438a3cd1f81b6c2283edd104334cdbda655a6b454cb637249391f55
SHA512

d223704fc8dbcff3919031bc14fbc71873afa64d8ba8e0754a4b18b02f842adf9f111d1c7e28ad7ab09254a00b0d5f8a5fa367cf2de9ed19583733019502d8b6
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMc1UY:NABC

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/796-404-0x00007FF737DD0000-0x00007FF7381C2000-memory.dmp	xmrig
behavioral2/memory/968-470-0x00007FF662E40000-0x00007FF663232000-memory.dmp	xmrig
behavioral2/memory/2632-495-0x00007FF62AD20000-0x00007FF62B112000-memory.dmp	xmrig
behavioral2/memory/5104-528-0x00007FF7B7B40000-0x00007FF7B7F32000-memory.dmp	xmrig
behavioral2/memory/864-493-0x00007FF609270000-0x00007FF609662000-memory.dmp	xmrig
behavioral2/memory/640-492-0x00007FF7CED00000-0x00007FF7CF0F2000-memory.dmp	xmrig
behavioral2/memory/4836-491-0x00007FF73E880000-0x00007FF73EC72000-memory.dmp	xmrig
behavioral2/memory/3880-490-0x00007FF67BF40000-0x00007FF67C332000-memory.dmp	xmrig
behavioral2/memory/4432-489-0x00007FF7A6930000-0x00007FF7A6D22000-memory.dmp	xmrig
behavioral2/memory/4556-469-0x00007FF781980000-0x00007FF781D72000-memory.dmp	xmrig
behavioral2/memory/2644-356-0x00007FF780510000-0x00007FF780902000-memory.dmp	xmrig
behavioral2/memory/4536-321-0x00007FF723320000-0x00007FF723712000-memory.dmp	xmrig
behavioral2/memory/4896-255-0x00007FF6DF540000-0x00007FF6DF932000-memory.dmp	xmrig
behavioral2/memory/1048-254-0x00007FF719210000-0x00007FF719602000-memory.dmp	xmrig
behavioral2/memory/1240-238-0x00007FF6CDB90000-0x00007FF6CDF82000-memory.dmp	xmrig
behavioral2/memory/4376-237-0x00007FF6E5550000-0x00007FF6E5942000-memory.dmp	xmrig
behavioral2/memory/2640-227-0x00007FF6B62A0000-0x00007FF6B6692000-memory.dmp	xmrig
behavioral2/memory/2628-198-0x00007FF719210000-0x00007FF719602000-memory.dmp	xmrig
behavioral2/memory/3724-129-0x00007FF635EE0000-0x00007FF6362D2000-memory.dmp	xmrig
behavioral2/memory/3640-123-0x00007FF617D50000-0x00007FF618142000-memory.dmp	xmrig
behavioral2/memory/4408-87-0x00007FF715560000-0x00007FF715952000-memory.dmp	xmrig
behavioral2/memory/3928-3812-0x00007FF76D4C0000-0x00007FF76D8B2000-memory.dmp	xmrig
behavioral2/memory/5064-3814-0x00007FF752960000-0x00007FF752D52000-memory.dmp	xmrig
behavioral2/memory/3504-3816-0x00007FF6C9E40000-0x00007FF6CA232000-memory.dmp	xmrig
behavioral2/memory/4408-3818-0x00007FF715560000-0x00007FF715952000-memory.dmp	xmrig
behavioral2/memory/1048-3820-0x00007FF719210000-0x00007FF719602000-memory.dmp	xmrig
behavioral2/memory/3640-3827-0x00007FF617D50000-0x00007FF618142000-memory.dmp	xmrig
behavioral2/memory/3724-3828-0x00007FF635EE0000-0x00007FF6362D2000-memory.dmp	xmrig
behavioral2/memory/5104-3834-0x00007FF7B7B40000-0x00007FF7B7F32000-memory.dmp	xmrig
behavioral2/memory/2640-3833-0x00007FF6B62A0000-0x00007FF6B6692000-memory.dmp	xmrig
behavioral2/memory/4376-3838-0x00007FF6E5550000-0x00007FF6E5942000-memory.dmp	xmrig
behavioral2/memory/4896-3840-0x00007FF6DF540000-0x00007FF6DF932000-memory.dmp	xmrig
behavioral2/memory/1240-3836-0x00007FF6CDB90000-0x00007FF6CDF82000-memory.dmp	xmrig
behavioral2/memory/2628-3830-0x00007FF719210000-0x00007FF719602000-memory.dmp	xmrig
behavioral2/memory/4536-3825-0x00007FF723320000-0x00007FF723712000-memory.dmp	xmrig
behavioral2/memory/2632-3823-0x00007FF62AD20000-0x00007FF62B112000-memory.dmp	xmrig
behavioral2/memory/796-3872-0x00007FF737DD0000-0x00007FF7381C2000-memory.dmp	xmrig
behavioral2/memory/968-3870-0x00007FF662E40000-0x00007FF663232000-memory.dmp	xmrig
behavioral2/memory/4836-3869-0x00007FF73E880000-0x00007FF73EC72000-memory.dmp	xmrig
behavioral2/memory/4556-3866-0x00007FF781980000-0x00007FF781D72000-memory.dmp	xmrig
behavioral2/memory/640-3862-0x00007FF7CED00000-0x00007FF7CF0F2000-memory.dmp	xmrig
behavioral2/memory/3880-3860-0x00007FF67BF40000-0x00007FF67C332000-memory.dmp	xmrig
behavioral2/memory/4432-3856-0x00007FF7A6930000-0x00007FF7A6D22000-memory.dmp	xmrig
behavioral2/memory/2644-3865-0x00007FF780510000-0x00007FF780902000-memory.dmp	xmrig
behavioral2/memory/864-3858-0x00007FF609270000-0x00007FF609662000-memory.dmp	xmrig

Blocklisted process makes network request 17 IoCs

flow	pid	Process
9	1028	powershell.exe
11	1028	powershell.exe
13	1028	powershell.exe
14	1028	powershell.exe
16	1028	powershell.exe
20	1028	powershell.exe
21	1028	powershell.exe
22	1028	powershell.exe
23	1028	powershell.exe
24	1028	powershell.exe
25	1028	powershell.exe
26	1028	powershell.exe
27	1028	powershell.exe
28	1028	powershell.exe
29	1028	powershell.exe
30	1028	powershell.exe
31	1028	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1028	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3928	xyiDujF.exe
5064	YvNCHsB.exe
3504	GUikREW.exe
4408	TJYCNBX.exe
3640	YWMqBPE.exe
2632	bWeVWUY.exe
3724	JYxQMWR.exe
2628	JJYpGKz.exe
2640	tKRQOdh.exe
4376	qANCEjl.exe
1240	mHlltcH.exe
1048	ilkowKr.exe
4896	WqQXRKP.exe
4536	PBYVrZi.exe
2644	JaUMadH.exe
796	UlOgGPk.exe
4556	DJwQNMO.exe
968	DAoocVe.exe
5104	kCcTXAf.exe
4432	vQCeEjq.exe
3880	lJYZVmJ.exe
4836	xkexACw.exe
640	ddKDSXn.exe
864	AZLzXiP.exe
4832	xjszjqt.exe
3572	BjlhCjB.exe
5068	wtkjCGj.exe
2648	cftTXYN.exe
3044	BGcXFaY.exe
4196	huCNWVX.exe
2828	MHtmDzz.exe
4312	RdMNPWi.exe
1552	ihhzwEW.exe
1768	VYTaUpp.exe
4580	UgyqtPn.exe
1180	vIexHSr.exe
1376	QBJQIDy.exe
4912	RZchemb.exe
2536	NxqxTQO.exe
4288	KjxkbMe.exe
4060	iPhCaiz.exe
2120	eoKOJvw.exe
3972	rvwzGDq.exe
4328	aQhcDMW.exe
860	McomCBL.exe
4260	JhdIhMq.exe
464	NEnpnAs.exe
1400	bCAVhZW.exe
4100	VDquXfc.exe
3104	AJppZeW.exe
1380	hmRoKPr.exe
3316	TbvYwyK.exe
3544	TuOJGzj.exe
3268	tMDfaZx.exe
2860	AHjVHZg.exe
4484	MVIeSUc.exe
4268	hZkIcvU.exe
3124	gmwcnCl.exe
2292	biWLIGV.exe
3912	FMcmtBw.exe
3448	lwKYVBP.exe
1712	TQPHQQw.exe
2000	KghOdQT.exe
2844	FVhfPcO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2756-0-0x00007FF7D67C0000-0x00007FF7D6BB2000-memory.dmp	upx
behavioral2/files/0x000700000002346e-7.dat	upx
behavioral2/files/0x000900000002340e-8.dat	upx
behavioral2/files/0x000700000002347c-81.dat	upx
behavioral2/files/0x0007000000023481-116.dat	upx
behavioral2/memory/796-404-0x00007FF737DD0000-0x00007FF7381C2000-memory.dmp	upx
behavioral2/memory/968-470-0x00007FF662E40000-0x00007FF663232000-memory.dmp	upx
behavioral2/memory/2632-495-0x00007FF62AD20000-0x00007FF62B112000-memory.dmp	upx
behavioral2/memory/5104-528-0x00007FF7B7B40000-0x00007FF7B7F32000-memory.dmp	upx
behavioral2/memory/864-493-0x00007FF609270000-0x00007FF609662000-memory.dmp	upx
behavioral2/memory/640-492-0x00007FF7CED00000-0x00007FF7CF0F2000-memory.dmp	upx
behavioral2/memory/4836-491-0x00007FF73E880000-0x00007FF73EC72000-memory.dmp	upx
behavioral2/memory/3880-490-0x00007FF67BF40000-0x00007FF67C332000-memory.dmp	upx
behavioral2/memory/4432-489-0x00007FF7A6930000-0x00007FF7A6D22000-memory.dmp	upx
behavioral2/memory/4556-469-0x00007FF781980000-0x00007FF781D72000-memory.dmp	upx
behavioral2/memory/2644-356-0x00007FF780510000-0x00007FF780902000-memory.dmp	upx
behavioral2/memory/4536-321-0x00007FF723320000-0x00007FF723712000-memory.dmp	upx
behavioral2/memory/4896-255-0x00007FF6DF540000-0x00007FF6DF932000-memory.dmp	upx
behavioral2/memory/1048-254-0x00007FF719210000-0x00007FF719602000-memory.dmp	upx
behavioral2/memory/1240-238-0x00007FF6CDB90000-0x00007FF6CDF82000-memory.dmp	upx
behavioral2/memory/4376-237-0x00007FF6E5550000-0x00007FF6E5942000-memory.dmp	upx
behavioral2/memory/2640-227-0x00007FF6B62A0000-0x00007FF6B6692000-memory.dmp	upx
behavioral2/memory/2628-198-0x00007FF719210000-0x00007FF719602000-memory.dmp	upx
behavioral2/files/0x000800000002346a-196.dat	upx
behavioral2/files/0x0007000000023489-191.dat	upx
behavioral2/files/0x0007000000023483-188.dat	upx
behavioral2/files/0x0007000000023482-185.dat	upx
behavioral2/files/0x0007000000023490-183.dat	upx
behavioral2/files/0x0007000000023480-180.dat	upx
behavioral2/files/0x000700000002348f-175.dat	upx
behavioral2/files/0x000700000002348e-173.dat	upx
behavioral2/files/0x0007000000023487-170.dat	upx
behavioral2/files/0x000700000002347f-167.dat	upx
behavioral2/files/0x0007000000023484-160.dat	upx
behavioral2/files/0x000700000002348c-150.dat	upx
behavioral2/files/0x000700000002348b-149.dat	upx
behavioral2/files/0x0007000000023491-195.dat	upx
behavioral2/files/0x000700000002347d-142.dat	upx
behavioral2/files/0x0007000000023488-141.dat	upx
behavioral2/files/0x000700000002347b-137.dat	upx
behavioral2/files/0x0007000000023486-163.dat	upx
behavioral2/files/0x0007000000023476-131.dat	upx
behavioral2/files/0x0007000000023485-130.dat	upx
behavioral2/memory/3724-129-0x00007FF635EE0000-0x00007FF6362D2000-memory.dmp	upx
behavioral2/memory/3640-123-0x00007FF617D50000-0x00007FF618142000-memory.dmp	upx
behavioral2/files/0x000700000002348a-148.dat	upx
behavioral2/files/0x0007000000023479-112.dat	upx
behavioral2/files/0x0007000000023473-110.dat	upx
behavioral2/files/0x0007000000023477-106.dat	upx
behavioral2/files/0x000700000002347e-99.dat	upx
behavioral2/memory/4408-87-0x00007FF715560000-0x00007FF715952000-memory.dmp	upx
behavioral2/files/0x0007000000023471-84.dat	upx
behavioral2/files/0x000700000002347a-71.dat	upx
behavioral2/files/0x0007000000023472-70.dat	upx
behavioral2/files/0x0007000000023475-94.dat	upx
behavioral2/files/0x0007000000023470-65.dat	upx
behavioral2/files/0x0007000000023474-63.dat	upx
behavioral2/files/0x0007000000023478-56.dat	upx
behavioral2/memory/3504-51-0x00007FF6C9E40000-0x00007FF6CA232000-memory.dmp	upx
behavioral2/memory/5064-33-0x00007FF752960000-0x00007FF752D52000-memory.dmp	upx
behavioral2/files/0x000700000002346f-32.dat	upx
behavioral2/files/0x000700000002346d-18.dat	upx
behavioral2/memory/3928-11-0x00007FF76D4C0000-0x00007FF76D8B2000-memory.dmp	upx
behavioral2/memory/3928-3812-0x00007FF76D4C0000-0x00007FF76D8B2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gytjCJf.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\jZhAtnO.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\EBDrHSm.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\BqOMYbF.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\rTBMSya.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\jpAscAv.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\CKUsqly.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\XooBaNf.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\LKOFaTS.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\MMcRUog.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\byioOWm.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\HARRxKn.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\oGLpJRQ.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\WEknRLb.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\fAYXcZx.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\wneJUon.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\CoQdXiB.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\QZvaQNe.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\vMMOIlP.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\XFsbwha.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\bGiNyMI.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\PSqVWHw.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\YKRFGaG.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\KIBOCcA.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\wwXfkrY.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\NGESgNV.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\sTydhkA.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\NhoITXA.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\mHlltcH.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\NrhHhhZ.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\hyfjCuf.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\XMibnAB.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\iBGQgRy.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\BBLAKtP.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\uHeSvvf.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\wMPgIpX.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\pTMgObO.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\khjTgHF.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\JYcIieQ.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\KHuQKhU.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\NZtcJrg.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\tSdWaXT.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\mYkEaOL.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\buauxAe.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\wBToTBh.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\wywqxDG.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\tZcirGT.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\jyqUKaf.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\lgchbXl.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\CjZyJgI.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\PljyPjm.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\RaWiwLT.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\NbCrXfA.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\wtkjCGj.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\VusQYnA.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\cvpJgVP.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\loDZKOF.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\KZhcTdt.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\yNCFbzf.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\kpIHjLY.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\nZyaaAG.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\HQinbDg.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\yDVZxGY.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
File created	C:\Windows\System\xPfsZvt.exe	bb2301b7a09e4619b9ede0deb4e3dc90N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
Token: SeLockMemoryPrivilege	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe
Token: SeDebugPrivilege	1028	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1028	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	85
PID 2756 wrote to memory of 1028	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	85
PID 2756 wrote to memory of 3928	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	86
PID 2756 wrote to memory of 3928	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	86
PID 2756 wrote to memory of 5064	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	87
PID 2756 wrote to memory of 5064	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	87
PID 2756 wrote to memory of 3504	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	88
PID 2756 wrote to memory of 3504	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	88
PID 2756 wrote to memory of 4408	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	89
PID 2756 wrote to memory of 4408	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	89
PID 2756 wrote to memory of 3640	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	90
PID 2756 wrote to memory of 3640	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	90
PID 2756 wrote to memory of 2628	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	91
PID 2756 wrote to memory of 2628	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	91
PID 2756 wrote to memory of 2632	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	92
PID 2756 wrote to memory of 2632	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	92
PID 2756 wrote to memory of 4376	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	93
PID 2756 wrote to memory of 4376	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	93
PID 2756 wrote to memory of 3724	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	94
PID 2756 wrote to memory of 3724	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	94
PID 2756 wrote to memory of 2640	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	95
PID 2756 wrote to memory of 2640	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	95
PID 2756 wrote to memory of 2644	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	96
PID 2756 wrote to memory of 2644	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	96
PID 2756 wrote to memory of 1240	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	97
PID 2756 wrote to memory of 1240	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	97
PID 2756 wrote to memory of 1048	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	98
PID 2756 wrote to memory of 1048	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	98
PID 2756 wrote to memory of 4896	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	99
PID 2756 wrote to memory of 4896	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	99
PID 2756 wrote to memory of 4536	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	100
PID 2756 wrote to memory of 4536	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	100
PID 2756 wrote to memory of 796	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	101
PID 2756 wrote to memory of 796	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	101
PID 2756 wrote to memory of 4556	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	102
PID 2756 wrote to memory of 4556	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	102
PID 2756 wrote to memory of 968	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	103
PID 2756 wrote to memory of 968	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	103
PID 2756 wrote to memory of 5104	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	104
PID 2756 wrote to memory of 5104	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	104
PID 2756 wrote to memory of 4432	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	105
PID 2756 wrote to memory of 4432	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	105
PID 2756 wrote to memory of 3880	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	106
PID 2756 wrote to memory of 3880	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	106
PID 2756 wrote to memory of 4836	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	107
PID 2756 wrote to memory of 4836	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	107
PID 2756 wrote to memory of 640	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	108
PID 2756 wrote to memory of 640	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	108
PID 2756 wrote to memory of 864	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	109
PID 2756 wrote to memory of 864	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	109
PID 2756 wrote to memory of 4312	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	110
PID 2756 wrote to memory of 4312	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	110
PID 2756 wrote to memory of 4832	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	111
PID 2756 wrote to memory of 4832	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	111
PID 2756 wrote to memory of 1552	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	112
PID 2756 wrote to memory of 1552	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	112
PID 2756 wrote to memory of 3572	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	113
PID 2756 wrote to memory of 3572	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	113
PID 2756 wrote to memory of 5068	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	114
PID 2756 wrote to memory of 5068	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	114
PID 2756 wrote to memory of 2648	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	115
PID 2756 wrote to memory of 2648	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	115
PID 2756 wrote to memory of 3044	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	116
PID 2756 wrote to memory of 3044	2756	bb2301b7a09e4619b9ede0deb4e3dc90N.exe	116

C:\Users\Admin\AppData\Local\Temp\bb2301b7a09e4619b9ede0deb4e3dc90N.exe
"C:\Users\Admin\AppData\Local\Temp\bb2301b7a09e4619b9ede0deb4e3dc90N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1028
- C:\Windows\System\xyiDujF.exe
  C:\Windows\System\xyiDujF.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\YvNCHsB.exe
  C:\Windows\System\YvNCHsB.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\GUikREW.exe
  C:\Windows\System\GUikREW.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\TJYCNBX.exe
  C:\Windows\System\TJYCNBX.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\YWMqBPE.exe
  C:\Windows\System\YWMqBPE.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\JJYpGKz.exe
  C:\Windows\System\JJYpGKz.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\bWeVWUY.exe
  C:\Windows\System\bWeVWUY.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\qANCEjl.exe
  C:\Windows\System\qANCEjl.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\JYxQMWR.exe
  C:\Windows\System\JYxQMWR.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\tKRQOdh.exe
  C:\Windows\System\tKRQOdh.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\JaUMadH.exe
  C:\Windows\System\JaUMadH.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\mHlltcH.exe
  C:\Windows\System\mHlltcH.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\ilkowKr.exe
  C:\Windows\System\ilkowKr.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\WqQXRKP.exe
  C:\Windows\System\WqQXRKP.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\PBYVrZi.exe
  C:\Windows\System\PBYVrZi.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\UlOgGPk.exe
  C:\Windows\System\UlOgGPk.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\DJwQNMO.exe
  C:\Windows\System\DJwQNMO.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\DAoocVe.exe
  C:\Windows\System\DAoocVe.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\kCcTXAf.exe
  C:\Windows\System\kCcTXAf.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\vQCeEjq.exe
  C:\Windows\System\vQCeEjq.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\lJYZVmJ.exe
  C:\Windows\System\lJYZVmJ.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\xkexACw.exe
  C:\Windows\System\xkexACw.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\ddKDSXn.exe
  C:\Windows\System\ddKDSXn.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\AZLzXiP.exe
  C:\Windows\System\AZLzXiP.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\RdMNPWi.exe
  C:\Windows\System\RdMNPWi.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\xjszjqt.exe
  C:\Windows\System\xjszjqt.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\ihhzwEW.exe
  C:\Windows\System\ihhzwEW.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\BjlhCjB.exe
  C:\Windows\System\BjlhCjB.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\wtkjCGj.exe
  C:\Windows\System\wtkjCGj.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\cftTXYN.exe
  C:\Windows\System\cftTXYN.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\BGcXFaY.exe
  C:\Windows\System\BGcXFaY.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\huCNWVX.exe
  C:\Windows\System\huCNWVX.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\MHtmDzz.exe
  C:\Windows\System\MHtmDzz.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\eoKOJvw.exe
  C:\Windows\System\eoKOJvw.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\VYTaUpp.exe
  C:\Windows\System\VYTaUpp.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\UgyqtPn.exe
  C:\Windows\System\UgyqtPn.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\vIexHSr.exe
  C:\Windows\System\vIexHSr.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\QBJQIDy.exe
  C:\Windows\System\QBJQIDy.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\RZchemb.exe
  C:\Windows\System\RZchemb.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\NxqxTQO.exe
  C:\Windows\System\NxqxTQO.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\KjxkbMe.exe
  C:\Windows\System\KjxkbMe.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\iPhCaiz.exe
  C:\Windows\System\iPhCaiz.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\AJppZeW.exe
  C:\Windows\System\AJppZeW.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\rvwzGDq.exe
  C:\Windows\System\rvwzGDq.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\aQhcDMW.exe
  C:\Windows\System\aQhcDMW.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\McomCBL.exe
  C:\Windows\System\McomCBL.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\JhdIhMq.exe
  C:\Windows\System\JhdIhMq.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\tMDfaZx.exe
  C:\Windows\System\tMDfaZx.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\NEnpnAs.exe
  C:\Windows\System\NEnpnAs.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\bCAVhZW.exe
  C:\Windows\System\bCAVhZW.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\VDquXfc.exe
  C:\Windows\System\VDquXfc.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\hmRoKPr.exe
  C:\Windows\System\hmRoKPr.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\TbvYwyK.exe
  C:\Windows\System\TbvYwyK.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\TuOJGzj.exe
  C:\Windows\System\TuOJGzj.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\AHjVHZg.exe
  C:\Windows\System\AHjVHZg.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\MVIeSUc.exe
  C:\Windows\System\MVIeSUc.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\hZkIcvU.exe
  C:\Windows\System\hZkIcvU.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\gmwcnCl.exe
  C:\Windows\System\gmwcnCl.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\biWLIGV.exe
  C:\Windows\System\biWLIGV.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\FMcmtBw.exe
  C:\Windows\System\FMcmtBw.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\lwKYVBP.exe
  C:\Windows\System\lwKYVBP.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\TQPHQQw.exe
  C:\Windows\System\TQPHQQw.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\KghOdQT.exe
  C:\Windows\System\KghOdQT.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\FVhfPcO.exe
  C:\Windows\System\FVhfPcO.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\XakYHTG.exe
  C:\Windows\System\XakYHTG.exe
  2⤵
  PID:2764
- C:\Windows\System\MGPMqmB.exe
  C:\Windows\System\MGPMqmB.exe
  2⤵
  PID:1312
- C:\Windows\System\TGahUaS.exe
  C:\Windows\System\TGahUaS.exe
  2⤵
  PID:4920
- C:\Windows\System\AhlVdSE.exe
  C:\Windows\System\AhlVdSE.exe
  2⤵
  PID:1832
- C:\Windows\System\wDUUZED.exe
  C:\Windows\System\wDUUZED.exe
  2⤵
  PID:2504
- C:\Windows\System\iXqigMX.exe
  C:\Windows\System\iXqigMX.exe
  2⤵
  PID:1176
- C:\Windows\System\MGazCDp.exe
  C:\Windows\System\MGazCDp.exe
  2⤵
  PID:1864
- C:\Windows\System\mQbAoWS.exe
  C:\Windows\System\mQbAoWS.exe
  2⤵
  PID:1136
- C:\Windows\System\IlzEUVq.exe
  C:\Windows\System\IlzEUVq.exe
  2⤵
  PID:1064
- C:\Windows\System\IdrHfvU.exe
  C:\Windows\System\IdrHfvU.exe
  2⤵
  PID:2044
- C:\Windows\System\uLldMiJ.exe
  C:\Windows\System\uLldMiJ.exe
  2⤵
  PID:888
- C:\Windows\System\pYTKtrJ.exe
  C:\Windows\System\pYTKtrJ.exe
  2⤵
  PID:3376
- C:\Windows\System\RfnVFqK.exe
  C:\Windows\System\RfnVFqK.exe
  2⤵
  PID:2412
- C:\Windows\System\CdpBhWh.exe
  C:\Windows\System\CdpBhWh.exe
  2⤵
  PID:4812
- C:\Windows\System\ftkrgVU.exe
  C:\Windows\System\ftkrgVU.exe
  2⤵
  PID:1184
- C:\Windows\System\PFrMXHI.exe
  C:\Windows\System\PFrMXHI.exe
  2⤵
  PID:1248
- C:\Windows\System\gEYWvmB.exe
  C:\Windows\System\gEYWvmB.exe
  2⤵
  PID:5124
- C:\Windows\System\ISkUsro.exe
  C:\Windows\System\ISkUsro.exe
  2⤵
  PID:5144
- C:\Windows\System\IEfhBBU.exe
  C:\Windows\System\IEfhBBU.exe
  2⤵
  PID:5164
- C:\Windows\System\DNjPGZf.exe
  C:\Windows\System\DNjPGZf.exe
  2⤵
  PID:5188
- C:\Windows\System\FLUhZiq.exe
  C:\Windows\System\FLUhZiq.exe
  2⤵
  PID:5212
- C:\Windows\System\JSFamKN.exe
  C:\Windows\System\JSFamKN.exe
  2⤵
  PID:5232
- C:\Windows\System\otgWgmm.exe
  C:\Windows\System\otgWgmm.exe
  2⤵
  PID:5252
- C:\Windows\System\wTyfFhu.exe
  C:\Windows\System\wTyfFhu.exe
  2⤵
  PID:5280
- C:\Windows\System\QHoRRgW.exe
  C:\Windows\System\QHoRRgW.exe
  2⤵
  PID:5296
- C:\Windows\System\BRkWRFd.exe
  C:\Windows\System\BRkWRFd.exe
  2⤵
  PID:5312
- C:\Windows\System\ZIpIsUC.exe
  C:\Windows\System\ZIpIsUC.exe
  2⤵
  PID:5332
- C:\Windows\System\xVpeoeS.exe
  C:\Windows\System\xVpeoeS.exe
  2⤵
  PID:5360
- C:\Windows\System\UJyjRql.exe
  C:\Windows\System\UJyjRql.exe
  2⤵
  PID:5376
- C:\Windows\System\FeoqMnu.exe
  C:\Windows\System\FeoqMnu.exe
  2⤵
  PID:5396
- C:\Windows\System\ygSEPQU.exe
  C:\Windows\System\ygSEPQU.exe
  2⤵
  PID:5424
- C:\Windows\System\nXoCjZc.exe
  C:\Windows\System\nXoCjZc.exe
  2⤵
  PID:5448
- C:\Windows\System\wYQhDZV.exe
  C:\Windows\System\wYQhDZV.exe
  2⤵
  PID:5472
- C:\Windows\System\VuNjkYr.exe
  C:\Windows\System\VuNjkYr.exe
  2⤵
  PID:5496
- C:\Windows\System\pNtBwnI.exe
  C:\Windows\System\pNtBwnI.exe
  2⤵
  PID:5520
- C:\Windows\System\bpUXYLO.exe
  C:\Windows\System\bpUXYLO.exe
  2⤵
  PID:5536
- C:\Windows\System\gZFQxUD.exe
  C:\Windows\System\gZFQxUD.exe
  2⤵
  PID:5564
- C:\Windows\System\KQkrBzv.exe
  C:\Windows\System\KQkrBzv.exe
  2⤵
  PID:5580
- C:\Windows\System\yAiPMBr.exe
  C:\Windows\System\yAiPMBr.exe
  2⤵
  PID:5604
- C:\Windows\System\kDelTux.exe
  C:\Windows\System\kDelTux.exe
  2⤵
  PID:5624
- C:\Windows\System\ZPeHBgn.exe
  C:\Windows\System\ZPeHBgn.exe
  2⤵
  PID:5640
- C:\Windows\System\qNyeNNs.exe
  C:\Windows\System\qNyeNNs.exe
  2⤵
  PID:5664
- C:\Windows\System\vdifylc.exe
  C:\Windows\System\vdifylc.exe
  2⤵
  PID:5688
- C:\Windows\System\qfNDfjI.exe
  C:\Windows\System\qfNDfjI.exe
  2⤵
  PID:5704
- C:\Windows\System\lMSMRDQ.exe
  C:\Windows\System\lMSMRDQ.exe
  2⤵
  PID:5724
- C:\Windows\System\lmDEgdM.exe
  C:\Windows\System\lmDEgdM.exe
  2⤵
  PID:5744
- C:\Windows\System\ztHbuqq.exe
  C:\Windows\System\ztHbuqq.exe
  2⤵
  PID:5772
- C:\Windows\System\tkMHmSK.exe
  C:\Windows\System\tkMHmSK.exe
  2⤵
  PID:5788
- C:\Windows\System\VRPwgIh.exe
  C:\Windows\System\VRPwgIh.exe
  2⤵
  PID:5804
- C:\Windows\System\GyKoCez.exe
  C:\Windows\System\GyKoCez.exe
  2⤵
  PID:5828
- C:\Windows\System\IkYWyvz.exe
  C:\Windows\System\IkYWyvz.exe
  2⤵
  PID:5844
- C:\Windows\System\uVLrkSi.exe
  C:\Windows\System\uVLrkSi.exe
  2⤵
  PID:5868
- C:\Windows\System\zBfkjHE.exe
  C:\Windows\System\zBfkjHE.exe
  2⤵
  PID:5888
- C:\Windows\System\FFLPAJm.exe
  C:\Windows\System\FFLPAJm.exe
  2⤵
  PID:5912
- C:\Windows\System\wbHLeov.exe
  C:\Windows\System\wbHLeov.exe
  2⤵
  PID:5928
- C:\Windows\System\opSRLyp.exe
  C:\Windows\System\opSRLyp.exe
  2⤵
  PID:5944
- C:\Windows\System\JyPcIhf.exe
  C:\Windows\System\JyPcIhf.exe
  2⤵
  PID:5960
- C:\Windows\System\qzcHoaR.exe
  C:\Windows\System\qzcHoaR.exe
  2⤵
  PID:5976
- C:\Windows\System\TZFQiSu.exe
  C:\Windows\System\TZFQiSu.exe
  2⤵
  PID:5996
- C:\Windows\System\KJUDIIt.exe
  C:\Windows\System\KJUDIIt.exe
  2⤵
  PID:6012
- C:\Windows\System\EmVuIIs.exe
  C:\Windows\System\EmVuIIs.exe
  2⤵
  PID:6048
- C:\Windows\System\tmMOffc.exe
  C:\Windows\System\tmMOffc.exe
  2⤵
  PID:6076
- C:\Windows\System\ZEIhuVZ.exe
  C:\Windows\System\ZEIhuVZ.exe
  2⤵
  PID:6100
- C:\Windows\System\MKnRmpk.exe
  C:\Windows\System\MKnRmpk.exe
  2⤵
  PID:6120
- C:\Windows\System\dwINDQu.exe
  C:\Windows\System\dwINDQu.exe
  2⤵
  PID:3868
- C:\Windows\System\GCMTCiq.exe
  C:\Windows\System\GCMTCiq.exe
  2⤵
  PID:2744
- C:\Windows\System\KQxDwqL.exe
  C:\Windows\System\KQxDwqL.exe
  2⤵
  PID:3596
- C:\Windows\System\OQgsvMc.exe
  C:\Windows\System\OQgsvMc.exe
  2⤵
  PID:2868
- C:\Windows\System\XsbMVDk.exe
  C:\Windows\System\XsbMVDk.exe
  2⤵
  PID:4608
- C:\Windows\System\jEOmJvV.exe
  C:\Windows\System\jEOmJvV.exe
  2⤵
  PID:2604
- C:\Windows\System\fnbMlTF.exe
  C:\Windows\System\fnbMlTF.exe
  2⤵
  PID:2492
- C:\Windows\System\IAInpIw.exe
  C:\Windows\System\IAInpIw.exe
  2⤵
  PID:1644
- C:\Windows\System\DtWiDsu.exe
  C:\Windows\System\DtWiDsu.exe
  2⤵
  PID:2028
- C:\Windows\System\VcIDMDy.exe
  C:\Windows\System\VcIDMDy.exe
  2⤵
  PID:4992
- C:\Windows\System\SAqkbKs.exe
  C:\Windows\System\SAqkbKs.exe
  2⤵
  PID:5356
- C:\Windows\System\CXvWsrC.exe
  C:\Windows\System\CXvWsrC.exe
  2⤵
  PID:5372
- C:\Windows\System\zaTsQkI.exe
  C:\Windows\System\zaTsQkI.exe
  2⤵
  PID:2600
- C:\Windows\System\zaLWTSi.exe
  C:\Windows\System\zaLWTSi.exe
  2⤵
  PID:3404
- C:\Windows\System\NCbMMiO.exe
  C:\Windows\System\NCbMMiO.exe
  2⤵
  PID:5156
- C:\Windows\System\MNTxJua.exe
  C:\Windows\System\MNTxJua.exe
  2⤵
  PID:5184
- C:\Windows\System\qGFmTNI.exe
  C:\Windows\System\qGFmTNI.exe
  2⤵
  PID:5552
- C:\Windows\System\PkreFTU.exe
  C:\Windows\System\PkreFTU.exe
  2⤵
  PID:5052
- C:\Windows\System\CKLXpjV.exe
  C:\Windows\System\CKLXpjV.exe
  2⤵
  PID:1800
- C:\Windows\System\fVlMvDD.exe
  C:\Windows\System\fVlMvDD.exe
  2⤵
  PID:5388
- C:\Windows\System\jhAZdtc.exe
  C:\Windows\System\jhAZdtc.exe
  2⤵
  PID:596
- C:\Windows\System\bWCKnTi.exe
  C:\Windows\System\bWCKnTi.exe
  2⤵
  PID:6896
- C:\Windows\System\vAIIJcS.exe
  C:\Windows\System\vAIIJcS.exe
  2⤵
  PID:7104
- C:\Windows\System\EtKcLnm.exe
  C:\Windows\System\EtKcLnm.exe
  2⤵
  PID:7136
- C:\Windows\System\AbpsRed.exe
  C:\Windows\System\AbpsRed.exe
  2⤵
  PID:7156
- C:\Windows\System\lmIlVTp.exe
  C:\Windows\System\lmIlVTp.exe
  2⤵
  PID:5900
- C:\Windows\System\WkkOhpR.exe
  C:\Windows\System\WkkOhpR.exe
  2⤵
  PID:5592
- C:\Windows\System\XFsbwha.exe
  C:\Windows\System\XFsbwha.exe
  2⤵
  PID:5656
- C:\Windows\System\aazcxsF.exe
  C:\Windows\System\aazcxsF.exe
  2⤵
  PID:5796
- C:\Windows\System\LgAPYeG.exe
  C:\Windows\System\LgAPYeG.exe
  2⤵
  PID:5836
- C:\Windows\System\jVCloyE.exe
  C:\Windows\System\jVCloyE.exe
  2⤵
  PID:5936
- C:\Windows\System\kNyFhfj.exe
  C:\Windows\System\kNyFhfj.exe
  2⤵
  PID:6008
- C:\Windows\System\kHBAvMo.exe
  C:\Windows\System\kHBAvMo.exe
  2⤵
  PID:6116
- C:\Windows\System\LogZETj.exe
  C:\Windows\System\LogZETj.exe
  2⤵
  PID:396
- C:\Windows\System\HVmqMqI.exe
  C:\Windows\System\HVmqMqI.exe
  2⤵
  PID:3604
- C:\Windows\System\XYofpaA.exe
  C:\Windows\System\XYofpaA.exe
  2⤵
  PID:3884
- C:\Windows\System\gjYQQEZ.exe
  C:\Windows\System\gjYQQEZ.exe
  2⤵
  PID:2172
- C:\Windows\System\yychUfw.exe
  C:\Windows\System\yychUfw.exe
  2⤵
  PID:5720
- C:\Windows\System\ZJWYgpj.exe
  C:\Windows\System\ZJWYgpj.exe
  2⤵
  PID:1856
- C:\Windows\System\itFTkWe.exe
  C:\Windows\System\itFTkWe.exe
  2⤵
  PID:6184
- C:\Windows\System\QmwBdnH.exe
  C:\Windows\System\QmwBdnH.exe
  2⤵
  PID:6112
- C:\Windows\System\tYzCAyS.exe
  C:\Windows\System\tYzCAyS.exe
  2⤵
  PID:2664
- C:\Windows\System\EuqqTaI.exe
  C:\Windows\System\EuqqTaI.exe
  2⤵
  PID:5180
- C:\Windows\System\PpUCrnJ.exe
  C:\Windows\System\PpUCrnJ.exe
  2⤵
  PID:4012
- C:\Windows\System\GhsRrAo.exe
  C:\Windows\System\GhsRrAo.exe
  2⤵
  PID:5392
- C:\Windows\System\SSwkPFK.exe
  C:\Windows\System\SSwkPFK.exe
  2⤵
  PID:6508
- C:\Windows\System\zreVpUV.exe
  C:\Windows\System\zreVpUV.exe
  2⤵
  PID:6624
- C:\Windows\System\HJVpOec.exe
  C:\Windows\System\HJVpOec.exe
  2⤵
  PID:6420
- C:\Windows\System\ZYNeIBF.exe
  C:\Windows\System\ZYNeIBF.exe
  2⤵
  PID:6448
- C:\Windows\System\xGzEPyN.exe
  C:\Windows\System\xGzEPyN.exe
  2⤵
  PID:6492
- C:\Windows\System\RYlDRNf.exe
  C:\Windows\System\RYlDRNf.exe
  2⤵
  PID:6544
- C:\Windows\System\MeShjyw.exe
  C:\Windows\System\MeShjyw.exe
  2⤵
  PID:6596
- C:\Windows\System\fbvFtnL.exe
  C:\Windows\System\fbvFtnL.exe
  2⤵
  PID:6764
- C:\Windows\System\ZToZgnJ.exe
  C:\Windows\System\ZToZgnJ.exe
  2⤵
  PID:6792
- C:\Windows\System\LcmhAyO.exe
  C:\Windows\System\LcmhAyO.exe
  2⤵
  PID:4412
- C:\Windows\System\DxHJqrF.exe
  C:\Windows\System\DxHJqrF.exe
  2⤵
  PID:4944
- C:\Windows\System\tWbyaQS.exe
  C:\Windows\System\tWbyaQS.exe
  2⤵
  PID:6944
- C:\Windows\System\itwPhRG.exe
  C:\Windows\System\itwPhRG.exe
  2⤵
  PID:4036
- C:\Windows\System\KVFiKlh.exe
  C:\Windows\System\KVFiKlh.exe
  2⤵
  PID:4552
- C:\Windows\System\rgNjtjJ.exe
  C:\Windows\System\rgNjtjJ.exe
  2⤵
  PID:1008
- C:\Windows\System\utkiUpa.exe
  C:\Windows\System\utkiUpa.exe
  2⤵
  PID:2020
- C:\Windows\System\zfYPlmF.exe
  C:\Windows\System\zfYPlmF.exe
  2⤵
  PID:1464
- C:\Windows\System\gytjCJf.exe
  C:\Windows\System\gytjCJf.exe
  2⤵
  PID:2876
- C:\Windows\System\WDwMvcz.exe
  C:\Windows\System\WDwMvcz.exe
  2⤵
  PID:4576
- C:\Windows\System\zhulmxW.exe
  C:\Windows\System\zhulmxW.exe
  2⤵
  PID:4908
- C:\Windows\System\XvJTPcN.exe
  C:\Windows\System\XvJTPcN.exe
  2⤵
  PID:1068
- C:\Windows\System\APUulZG.exe
  C:\Windows\System\APUulZG.exe
  2⤵
  PID:3888
- C:\Windows\System\cMpdHSs.exe
  C:\Windows\System\cMpdHSs.exe
  2⤵
  PID:6616
- C:\Windows\System\MlBIqEy.exe
  C:\Windows\System\MlBIqEy.exe
  2⤵
  PID:2960
- C:\Windows\System\gmvaIls.exe
  C:\Windows\System\gmvaIls.exe
  2⤵
  PID:7072
- C:\Windows\System\KHttTuJ.exe
  C:\Windows\System\KHttTuJ.exe
  2⤵
  PID:5408
- C:\Windows\System\pIxfWDH.exe
  C:\Windows\System\pIxfWDH.exe
  2⤵
  PID:6288
- C:\Windows\System\uvrQhoe.exe
  C:\Windows\System\uvrQhoe.exe
  2⤵
  PID:7088
- C:\Windows\System\ePRYmNJ.exe
  C:\Windows\System\ePRYmNJ.exe
  2⤵
  PID:7148
- C:\Windows\System\FkWgSIg.exe
  C:\Windows\System\FkWgSIg.exe
  2⤵
  PID:7124
- C:\Windows\System\mAggNzQ.exe
  C:\Windows\System\mAggNzQ.exe
  2⤵
  PID:5504
- C:\Windows\System\cMBMrAP.exe
  C:\Windows\System\cMBMrAP.exe
  2⤵
  PID:1232
- C:\Windows\System\tdDiUWP.exe
  C:\Windows\System\tdDiUWP.exe
  2⤵
  PID:5736
- C:\Windows\System\edTcfmg.exe
  C:\Windows\System\edTcfmg.exe
  2⤵
  PID:5820
- C:\Windows\System\kGEwbnZ.exe
  C:\Windows\System\kGEwbnZ.exe
  2⤵
  PID:6088
- C:\Windows\System\FyUWDUm.exe
  C:\Windows\System\FyUWDUm.exe
  2⤵
  PID:5304
- C:\Windows\System\JTCFTOG.exe
  C:\Windows\System\JTCFTOG.exe
  2⤵
  PID:1628
- C:\Windows\System\uVCTQBJ.exe
  C:\Windows\System\uVCTQBJ.exe
  2⤵
  PID:5616
- C:\Windows\System\nvxrSRv.exe
  C:\Windows\System\nvxrSRv.exe
  2⤵
  PID:6292
- C:\Windows\System\sPYrbqI.exe
  C:\Windows\System\sPYrbqI.exe
  2⤵
  PID:6084
- C:\Windows\System\cwVFTnq.exe
  C:\Windows\System\cwVFTnq.exe
  2⤵
  PID:432
- C:\Windows\System\HothIbw.exe
  C:\Windows\System\HothIbw.exe
  2⤵
  PID:5572
- C:\Windows\System\pTNyhvs.exe
  C:\Windows\System\pTNyhvs.exe
  2⤵
  PID:6784
- C:\Windows\System\dWhyFNM.exe
  C:\Windows\System\dWhyFNM.exe
  2⤵
  PID:6772
- C:\Windows\System\ygglRCM.exe
  C:\Windows\System\ygglRCM.exe
  2⤵
  PID:3900
- C:\Windows\System\GgbhLxh.exe
  C:\Windows\System\GgbhLxh.exe
  2⤵
  PID:1932
- C:\Windows\System\piEKjIi.exe
  C:\Windows\System\piEKjIi.exe
  2⤵
  PID:4084
- C:\Windows\System\MOUnNEe.exe
  C:\Windows\System\MOUnNEe.exe
  2⤵
  PID:3684
- C:\Windows\System\SkecvZr.exe
  C:\Windows\System\SkecvZr.exe
  2⤵
  PID:3200
- C:\Windows\System\FgsJEdH.exe
  C:\Windows\System\FgsJEdH.exe
  2⤵
  PID:5756
- C:\Windows\System\LiTQvYw.exe
  C:\Windows\System\LiTQvYw.exe
  2⤵
  PID:116
- C:\Windows\System\xojtJPG.exe
  C:\Windows\System\xojtJPG.exe
  2⤵
  PID:7176
- C:\Windows\System\TurzZdd.exe
  C:\Windows\System\TurzZdd.exe
  2⤵
  PID:7200
- C:\Windows\System\hCjcdfy.exe
  C:\Windows\System\hCjcdfy.exe
  2⤵
  PID:7224
- C:\Windows\System\AGFWxiO.exe
  C:\Windows\System\AGFWxiO.exe
  2⤵
  PID:7260
- C:\Windows\System\acHFjPE.exe
  C:\Windows\System\acHFjPE.exe
  2⤵
  PID:7284
- C:\Windows\System\aCCiHEw.exe
  C:\Windows\System\aCCiHEw.exe
  2⤵
  PID:7312
- C:\Windows\System\ocUrTQf.exe
  C:\Windows\System\ocUrTQf.exe
  2⤵
  PID:7360
- C:\Windows\System\mvIeCRM.exe
  C:\Windows\System\mvIeCRM.exe
  2⤵
  PID:7380
- C:\Windows\System\wXAOsvG.exe
  C:\Windows\System\wXAOsvG.exe
  2⤵
  PID:7408
- C:\Windows\System\fvEcoNi.exe
  C:\Windows\System\fvEcoNi.exe
  2⤵
  PID:7432
- C:\Windows\System\MXOGZtt.exe
  C:\Windows\System\MXOGZtt.exe
  2⤵
  PID:7452
- C:\Windows\System\oJcANoG.exe
  C:\Windows\System\oJcANoG.exe
  2⤵
  PID:7472
- C:\Windows\System\uZMcOra.exe
  C:\Windows\System\uZMcOra.exe
  2⤵
  PID:7496
- C:\Windows\System\TMzwCND.exe
  C:\Windows\System\TMzwCND.exe
  2⤵
  PID:7516
- C:\Windows\System\DMfHnrF.exe
  C:\Windows\System\DMfHnrF.exe
  2⤵
  PID:7536
- C:\Windows\System\ARZIicw.exe
  C:\Windows\System\ARZIicw.exe
  2⤵
  PID:7560
- C:\Windows\System\itdzzKF.exe
  C:\Windows\System\itdzzKF.exe
  2⤵
  PID:7584
- C:\Windows\System\GCUtRIy.exe
  C:\Windows\System\GCUtRIy.exe
  2⤵
  PID:7608
- C:\Windows\System\NxlNaxq.exe
  C:\Windows\System\NxlNaxq.exe
  2⤵
  PID:7624
- C:\Windows\System\DETOKix.exe
  C:\Windows\System\DETOKix.exe
  2⤵
  PID:7648
- C:\Windows\System\NGColNb.exe
  C:\Windows\System\NGColNb.exe
  2⤵
  PID:7672
- C:\Windows\System\RKMufCb.exe
  C:\Windows\System\RKMufCb.exe
  2⤵
  PID:7692
- C:\Windows\System\UcatVdI.exe
  C:\Windows\System\UcatVdI.exe
  2⤵
  PID:7716
- C:\Windows\System\UWEiJaa.exe
  C:\Windows\System\UWEiJaa.exe
  2⤵
  PID:7740
- C:\Windows\System\qzSoyah.exe
  C:\Windows\System\qzSoyah.exe
  2⤵
  PID:7756
- C:\Windows\System\JvbUvKC.exe
  C:\Windows\System\JvbUvKC.exe
  2⤵
  PID:7792
- C:\Windows\System\vFwOmRK.exe
  C:\Windows\System\vFwOmRK.exe
  2⤵
  PID:7812
- C:\Windows\System\WpkKZGd.exe
  C:\Windows\System\WpkKZGd.exe
  2⤵
  PID:7844
- C:\Windows\System\HXrPIli.exe
  C:\Windows\System\HXrPIli.exe
  2⤵
  PID:7876
- C:\Windows\System\iiFvFhY.exe
  C:\Windows\System\iiFvFhY.exe
  2⤵
  PID:7904
- C:\Windows\System\oGLpJRQ.exe
  C:\Windows\System\oGLpJRQ.exe
  2⤵
  PID:7924
- C:\Windows\System\jhJdXCl.exe
  C:\Windows\System\jhJdXCl.exe
  2⤵
  PID:7952
- C:\Windows\System\XvxArqW.exe
  C:\Windows\System\XvxArqW.exe
  2⤵
  PID:7972
- C:\Windows\System\bfytsQq.exe
  C:\Windows\System\bfytsQq.exe
  2⤵
  PID:7992
- C:\Windows\System\lRXXGWX.exe
  C:\Windows\System\lRXXGWX.exe
  2⤵
  PID:8012
- C:\Windows\System\HmPimwE.exe
  C:\Windows\System\HmPimwE.exe
  2⤵
  PID:8040
- C:\Windows\System\gPYGUQS.exe
  C:\Windows\System\gPYGUQS.exe
  2⤵
  PID:8068
- C:\Windows\System\qLGMlni.exe
  C:\Windows\System\qLGMlni.exe
  2⤵
  PID:8092
- C:\Windows\System\NNysHiB.exe
  C:\Windows\System\NNysHiB.exe
  2⤵
  PID:8112
- C:\Windows\System\VtyskQI.exe
  C:\Windows\System\VtyskQI.exe
  2⤵
  PID:8132
- C:\Windows\System\yDWhpwp.exe
  C:\Windows\System\yDWhpwp.exe
  2⤵
  PID:8156
- C:\Windows\System\EqlWYJh.exe
  C:\Windows\System\EqlWYJh.exe
  2⤵
  PID:8176
- C:\Windows\System\KhqsncK.exe
  C:\Windows\System\KhqsncK.exe
  2⤵
  PID:3688
- C:\Windows\System\kgUmsIA.exe
  C:\Windows\System\kgUmsIA.exe
  2⤵
  PID:3508
- C:\Windows\System\DjcZmOT.exe
  C:\Windows\System\DjcZmOT.exe
  2⤵
  PID:3656
- C:\Windows\System\zLoBIOo.exe
  C:\Windows\System\zLoBIOo.exe
  2⤵
  PID:6580
- C:\Windows\System\xbVzUGN.exe
  C:\Windows\System\xbVzUGN.exe
  2⤵
  PID:4456
- C:\Windows\System\aGwbaat.exe
  C:\Windows\System\aGwbaat.exe
  2⤵
  PID:7092
- C:\Windows\System\hEghQvD.exe
  C:\Windows\System\hEghQvD.exe
  2⤵
  PID:5920
- C:\Windows\System\dphcNLB.exe
  C:\Windows\System\dphcNLB.exe
  2⤵
  PID:2840
- C:\Windows\System\iPwXNQO.exe
  C:\Windows\System\iPwXNQO.exe
  2⤵
  PID:6072
- C:\Windows\System\MPLGAzS.exe
  C:\Windows\System\MPLGAzS.exe
  2⤵
  PID:7300
- C:\Windows\System\LCjadhV.exe
  C:\Windows\System\LCjadhV.exe
  2⤵
  PID:5412
- C:\Windows\System\jERwZXq.exe
  C:\Windows\System\jERwZXq.exe
  2⤵
  PID:6920
- C:\Windows\System\MHcdGxv.exe
  C:\Windows\System\MHcdGxv.exe
  2⤵
  PID:5652
- C:\Windows\System\SVkqYdU.exe
  C:\Windows\System\SVkqYdU.exe
  2⤵
  PID:7508
- C:\Windows\System\eWWQHMy.exe
  C:\Windows\System\eWWQHMy.exe
  2⤵
  PID:7572
- C:\Windows\System\zqbjVww.exe
  C:\Windows\System\zqbjVww.exe
  2⤵
  PID:368
- C:\Windows\System\hgmxZSG.exe
  C:\Windows\System\hgmxZSG.exe
  2⤵
  PID:6608
- C:\Windows\System\nGxFQvC.exe
  C:\Windows\System\nGxFQvC.exe
  2⤵
  PID:2228
- C:\Windows\System\YjEKBLx.exe
  C:\Windows\System\YjEKBLx.exe
  2⤵
  PID:7768
- C:\Windows\System\BJaUVwO.exe
  C:\Windows\System\BJaUVwO.exe
  2⤵
  PID:7332
- C:\Windows\System\XprTabu.exe
  C:\Windows\System\XprTabu.exe
  2⤵
  PID:7388
- C:\Windows\System\hUUliWy.exe
  C:\Windows\System\hUUliWy.exe
  2⤵
  PID:7896
- C:\Windows\System\zMLSRqn.exe
  C:\Windows\System\zMLSRqn.exe
  2⤵
  PID:7468
- C:\Windows\System\OdCQLUZ.exe
  C:\Windows\System\OdCQLUZ.exe
  2⤵
  PID:8004
- C:\Windows\System\dyDHzvp.exe
  C:\Windows\System\dyDHzvp.exe
  2⤵
  PID:8060
- C:\Windows\System\RVhEXmT.exe
  C:\Windows\System\RVhEXmT.exe
  2⤵
  PID:8100
- C:\Windows\System\XpBTLzh.exe
  C:\Windows\System\XpBTLzh.exe
  2⤵
  PID:8172
- C:\Windows\System\iYSCIcc.exe
  C:\Windows\System\iYSCIcc.exe
  2⤵
  PID:5956
- C:\Windows\System\UlnmtIq.exe
  C:\Windows\System\UlnmtIq.exe
  2⤵
  PID:7764
- C:\Windows\System\RhHJMVA.exe
  C:\Windows\System\RhHJMVA.exe
  2⤵
  PID:632
- C:\Windows\System\tyxbeTa.exe
  C:\Windows\System\tyxbeTa.exe
  2⤵
  PID:7872
- C:\Windows\System\PKsjRCz.exe
  C:\Windows\System\PKsjRCz.exe
  2⤵
  PID:8216
- C:\Windows\System\XMyfDKA.exe
  C:\Windows\System\XMyfDKA.exe
  2⤵
  PID:8232
- C:\Windows\System\yMmuyYv.exe
  C:\Windows\System\yMmuyYv.exe
  2⤵
  PID:8268
- C:\Windows\System\UaJruIi.exe
  C:\Windows\System\UaJruIi.exe
  2⤵
  PID:8288
- C:\Windows\System\OZrLrCr.exe
  C:\Windows\System\OZrLrCr.exe
  2⤵
  PID:8308
- C:\Windows\System\nGyQohc.exe
  C:\Windows\System\nGyQohc.exe
  2⤵
  PID:8336
- C:\Windows\System\selEzsl.exe
  C:\Windows\System\selEzsl.exe
  2⤵
  PID:8360
- C:\Windows\System\cEaUkTd.exe
  C:\Windows\System\cEaUkTd.exe
  2⤵
  PID:8396
- C:\Windows\System\yPQDvsM.exe
  C:\Windows\System\yPQDvsM.exe
  2⤵
  PID:8412
- C:\Windows\System\ExqleQC.exe
  C:\Windows\System\ExqleQC.exe
  2⤵
  PID:8448
- C:\Windows\System\nlZyzOf.exe
  C:\Windows\System\nlZyzOf.exe
  2⤵
  PID:8480
- C:\Windows\System\WMZbZpW.exe
  C:\Windows\System\WMZbZpW.exe
  2⤵
  PID:8508
- C:\Windows\System\mjZWZUt.exe
  C:\Windows\System\mjZWZUt.exe
  2⤵
  PID:8528
- C:\Windows\System\pRDpMcv.exe
  C:\Windows\System\pRDpMcv.exe
  2⤵
  PID:8544
- C:\Windows\System\PesMMrE.exe
  C:\Windows\System\PesMMrE.exe
  2⤵
  PID:8572
- C:\Windows\System\kDhNixT.exe
  C:\Windows\System\kDhNixT.exe
  2⤵
  PID:8604
- C:\Windows\System\beLKqFD.exe
  C:\Windows\System\beLKqFD.exe
  2⤵
  PID:8620
- C:\Windows\System\ANmKOkZ.exe
  C:\Windows\System\ANmKOkZ.exe
  2⤵
  PID:8648
- C:\Windows\System\xsEMQqN.exe
  C:\Windows\System\xsEMQqN.exe
  2⤵
  PID:8684
- C:\Windows\System\uylMFbo.exe
  C:\Windows\System\uylMFbo.exe
  2⤵
  PID:8708
- C:\Windows\System\KfrXzog.exe
  C:\Windows\System\KfrXzog.exe
  2⤵
  PID:8732
- C:\Windows\System\loDZKOF.exe
  C:\Windows\System\loDZKOF.exe
  2⤵
  PID:8752
- C:\Windows\System\GaGuRxj.exe
  C:\Windows\System\GaGuRxj.exe
  2⤵
  PID:8772
- C:\Windows\System\TANHLLp.exe
  C:\Windows\System\TANHLLp.exe
  2⤵
  PID:8804
- C:\Windows\System\ZPCrmTI.exe
  C:\Windows\System\ZPCrmTI.exe
  2⤵
  PID:8828
- C:\Windows\System\cUhcwUx.exe
  C:\Windows\System\cUhcwUx.exe
  2⤵
  PID:8852
- C:\Windows\System\DnbaYaz.exe
  C:\Windows\System\DnbaYaz.exe
  2⤵
  PID:8872
- C:\Windows\System\OQypeNg.exe
  C:\Windows\System\OQypeNg.exe
  2⤵
  PID:8892
- C:\Windows\System\pGjCOao.exe
  C:\Windows\System\pGjCOao.exe
  2⤵
  PID:8916
- C:\Windows\System\xyAbyeM.exe
  C:\Windows\System\xyAbyeM.exe
  2⤵
  PID:8936
- C:\Windows\System\ftnSjkX.exe
  C:\Windows\System\ftnSjkX.exe
  2⤵
  PID:8956
- C:\Windows\System\DtiNcXQ.exe
  C:\Windows\System\DtiNcXQ.exe
  2⤵
  PID:8980
- C:\Windows\System\WBtybAw.exe
  C:\Windows\System\WBtybAw.exe
  2⤵
  PID:9004
- C:\Windows\System\COeuTzm.exe
  C:\Windows\System\COeuTzm.exe
  2⤵
  PID:9024
- C:\Windows\System\itwrnoh.exe
  C:\Windows\System\itwrnoh.exe
  2⤵
  PID:9044
- C:\Windows\System\VqSzGCh.exe
  C:\Windows\System\VqSzGCh.exe
  2⤵
  PID:9068
- C:\Windows\System\hWroCfd.exe
  C:\Windows\System\hWroCfd.exe
  2⤵
  PID:9092
- C:\Windows\System\TjolMHC.exe
  C:\Windows\System\TjolMHC.exe
  2⤵
  PID:9112
- C:\Windows\System\nnroGTc.exe
  C:\Windows\System\nnroGTc.exe
  2⤵
  PID:9136
- C:\Windows\System\ZczbZGJ.exe
  C:\Windows\System\ZczbZGJ.exe
  2⤵
  PID:9160
- C:\Windows\System\kfHhcai.exe
  C:\Windows\System\kfHhcai.exe
  2⤵
  PID:9184
- C:\Windows\System\cyWZCZl.exe
  C:\Windows\System\cyWZCZl.exe
  2⤵
  PID:9212
- C:\Windows\System\mtmLchu.exe
  C:\Windows\System\mtmLchu.exe
  2⤵
  PID:2376
- C:\Windows\System\NUCaXis.exe
  C:\Windows\System\NUCaXis.exe
  2⤵
  PID:7544
- C:\Windows\System\ijzpygC.exe
  C:\Windows\System\ijzpygC.exe
  2⤵
  PID:7444
- C:\Windows\System\RjoZCUZ.exe
  C:\Windows\System\RjoZCUZ.exe
  2⤵
  PID:8104
- C:\Windows\System\dUiCIJx.exe
  C:\Windows\System\dUiCIJx.exe
  2⤵
  PID:8124
- C:\Windows\System\kNUdzGk.exe
  C:\Windows\System\kNUdzGk.exe
  2⤵
  PID:7424
- C:\Windows\System\mhyKGMa.exe
  C:\Windows\System\mhyKGMa.exe
  2⤵
  PID:7620
- C:\Windows\System\PsJGUel.exe
  C:\Windows\System\PsJGUel.exe
  2⤵
  PID:8168
- C:\Windows\System\WFRjoWV.exe
  C:\Windows\System\WFRjoWV.exe
  2⤵
  PID:5140
- C:\Windows\System\uAYuXge.exe
  C:\Windows\System\uAYuXge.exe
  2⤵
  PID:7788
- C:\Windows\System\ltYXVwC.exe
  C:\Windows\System\ltYXVwC.exe
  2⤵
  PID:7400
- C:\Windows\System\CtMxmup.exe
  C:\Windows\System\CtMxmup.exe
  2⤵
  PID:2068
- C:\Windows\System\KhkDmnp.exe
  C:\Windows\System\KhkDmnp.exe
  2⤵
  PID:6224
- C:\Windows\System\NGESgNV.exe
  C:\Windows\System\NGESgNV.exe
  2⤵
  PID:8372
- C:\Windows\System\czQBddi.exe
  C:\Windows\System\czQBddi.exe
  2⤵
  PID:8456
- C:\Windows\System\vLYLNVi.exe
  C:\Windows\System\vLYLNVi.exe
  2⤵
  PID:4504
- C:\Windows\System\vzxeJSU.exe
  C:\Windows\System\vzxeJSU.exe
  2⤵
  PID:7856
- C:\Windows\System\zzayQmL.exe
  C:\Windows\System\zzayQmL.exe
  2⤵
  PID:6800
- C:\Windows\System\vwIxzpk.exe
  C:\Windows\System\vwIxzpk.exe
  2⤵
  PID:8148
- C:\Windows\System\EQggNUl.exe
  C:\Windows\System\EQggNUl.exe
  2⤵
  PID:8264
- C:\Windows\System\jIlWvEm.exe
  C:\Windows\System\jIlWvEm.exe
  2⤵
  PID:8300
- C:\Windows\System\GfcaKil.exe
  C:\Windows\System\GfcaKil.exe
  2⤵
  PID:6808
- C:\Windows\System\excXiuK.exe
  C:\Windows\System\excXiuK.exe
  2⤵
  PID:8788
- C:\Windows\System\wBteKSA.exe
  C:\Windows\System\wBteKSA.exe
  2⤵
  PID:9224
- C:\Windows\System\IhyfSIb.exe
  C:\Windows\System\IhyfSIb.exe
  2⤵
  PID:9252
- C:\Windows\System\WTcgrfS.exe
  C:\Windows\System\WTcgrfS.exe
  2⤵
  PID:9272
- C:\Windows\System\FrZhnyM.exe
  C:\Windows\System\FrZhnyM.exe
  2⤵
  PID:9292
- C:\Windows\System\lrurDQW.exe
  C:\Windows\System\lrurDQW.exe
  2⤵
  PID:9316
- C:\Windows\System\WOMKtWQ.exe
  C:\Windows\System\WOMKtWQ.exe
  2⤵
  PID:9340
- C:\Windows\System\bJxTcAM.exe
  C:\Windows\System\bJxTcAM.exe
  2⤵
  PID:9368
- C:\Windows\System\ArgXiaP.exe
  C:\Windows\System\ArgXiaP.exe
  2⤵
  PID:9392
- C:\Windows\System\ZSqxUcb.exe
  C:\Windows\System\ZSqxUcb.exe
  2⤵
  PID:9408
- C:\Windows\System\nRxhHmD.exe
  C:\Windows\System\nRxhHmD.exe
  2⤵
  PID:9436
- C:\Windows\System\pTMgObO.exe
  C:\Windows\System\pTMgObO.exe
  2⤵
  PID:9460
- C:\Windows\System\jzoRdvW.exe
  C:\Windows\System\jzoRdvW.exe
  2⤵
  PID:9492
- C:\Windows\System\utDkKHQ.exe
  C:\Windows\System\utDkKHQ.exe
  2⤵
  PID:9516
- C:\Windows\System\eqozICI.exe
  C:\Windows\System\eqozICI.exe
  2⤵
  PID:9540
- C:\Windows\System\aYHOrMZ.exe
  C:\Windows\System\aYHOrMZ.exe
  2⤵
  PID:9572
- C:\Windows\System\TAdCWiZ.exe
  C:\Windows\System\TAdCWiZ.exe
  2⤵
  PID:9592
- C:\Windows\System\KZhcTdt.exe
  C:\Windows\System\KZhcTdt.exe
  2⤵
  PID:9624
- C:\Windows\System\cJuGVpc.exe
  C:\Windows\System\cJuGVpc.exe
  2⤵
  PID:9640
- C:\Windows\System\EdLDDqH.exe
  C:\Windows\System\EdLDDqH.exe
  2⤵
  PID:9664
- C:\Windows\System\KGsaVsP.exe
  C:\Windows\System\KGsaVsP.exe
  2⤵
  PID:9684
- C:\Windows\System\GcVwyXG.exe
  C:\Windows\System\GcVwyXG.exe
  2⤵
  PID:9708
- C:\Windows\System\ssiZbTM.exe
  C:\Windows\System\ssiZbTM.exe
  2⤵
  PID:9732
- C:\Windows\System\TesEBUJ.exe
  C:\Windows\System\TesEBUJ.exe
  2⤵
  PID:9760
- C:\Windows\System\KAGjEjg.exe
  C:\Windows\System\KAGjEjg.exe
  2⤵
  PID:9780
- C:\Windows\System\WjPHLNJ.exe
  C:\Windows\System\WjPHLNJ.exe
  2⤵
  PID:9804
- C:\Windows\System\LNotNAe.exe
  C:\Windows\System\LNotNAe.exe
  2⤵
  PID:9828
- C:\Windows\System\fOzwdZz.exe
  C:\Windows\System\fOzwdZz.exe
  2⤵
  PID:9860
- C:\Windows\System\NrhHhhZ.exe
  C:\Windows\System\NrhHhhZ.exe
  2⤵
  PID:9884
- C:\Windows\System\KILgjmq.exe
  C:\Windows\System\KILgjmq.exe
  2⤵
  PID:9908
- C:\Windows\System\wqzVyZw.exe
  C:\Windows\System\wqzVyZw.exe
  2⤵
  PID:9932
- C:\Windows\System\FFMoRrr.exe
  C:\Windows\System\FFMoRrr.exe
  2⤵
  PID:9956
- C:\Windows\System\uAtuXYY.exe
  C:\Windows\System\uAtuXYY.exe
  2⤵
  PID:9980
- C:\Windows\System\cTFtxbX.exe
  C:\Windows\System\cTFtxbX.exe
  2⤵
  PID:10008
- C:\Windows\System\AFnjgVt.exe
  C:\Windows\System\AFnjgVt.exe
  2⤵
  PID:10028
- C:\Windows\System\OBsizAp.exe
  C:\Windows\System\OBsizAp.exe
  2⤵
  PID:10060
- C:\Windows\System\lgchbXl.exe
  C:\Windows\System\lgchbXl.exe
  2⤵
  PID:10080
- C:\Windows\System\nsKerAq.exe
  C:\Windows\System\nsKerAq.exe
  2⤵
  PID:10108
- C:\Windows\System\CQnmWis.exe
  C:\Windows\System\CQnmWis.exe
  2⤵
  PID:10140
- C:\Windows\System\uqqokpG.exe
  C:\Windows\System\uqqokpG.exe
  2⤵
  PID:10172
- C:\Windows\System\iSlXbPo.exe
  C:\Windows\System\iSlXbPo.exe
  2⤵
  PID:10200
- C:\Windows\System\QpUIAQF.exe
  C:\Windows\System\QpUIAQF.exe
  2⤵
  PID:10220
- C:\Windows\System\dlXAPTI.exe
  C:\Windows\System\dlXAPTI.exe
  2⤵
  PID:10236
- C:\Windows\System\JvojCBR.exe
  C:\Windows\System\JvojCBR.exe
  2⤵
  PID:8868
- C:\Windows\System\dbLumpd.exe
  C:\Windows\System\dbLumpd.exe
  2⤵
  PID:8492
- C:\Windows\System\vGKzCDm.exe
  C:\Windows\System\vGKzCDm.exe
  2⤵
  PID:8560
- C:\Windows\System\OSYQdDg.exe
  C:\Windows\System\OSYQdDg.exe
  2⤵
  PID:8244
- C:\Windows\System\HKJAiNm.exe
  C:\Windows\System\HKJAiNm.exe
  2⤵
  PID:9192
- C:\Windows\System\wjpGQql.exe
  C:\Windows\System\wjpGQql.exe
  2⤵
  PID:8636
- C:\Windows\System\rwPpUge.exe
  C:\Windows\System\rwPpUge.exe
  2⤵
  PID:7528
- C:\Windows\System\aFVEHiw.exe
  C:\Windows\System\aFVEHiw.exe
  2⤵
  PID:8700
- C:\Windows\System\DdUYtyA.exe
  C:\Windows\System\DdUYtyA.exe
  2⤵
  PID:8152
- C:\Windows\System\pgPafHx.exe
  C:\Windows\System\pgPafHx.exe
  2⤵
  PID:8716
- C:\Windows\System\OOrGqkH.exe
  C:\Windows\System\OOrGqkH.exe
  2⤵
  PID:7968
- C:\Windows\System\FzYCupn.exe
  C:\Windows\System\FzYCupn.exe
  2⤵
  PID:8080
- C:\Windows\System\chsxeQF.exe
  C:\Windows\System\chsxeQF.exe
  2⤵
  PID:8260
- C:\Windows\System\MWiPLFg.exe
  C:\Windows\System\MWiPLFg.exe
  2⤵
  PID:8324
- C:\Windows\System\NMvIQZZ.exe
  C:\Windows\System\NMvIQZZ.exe
  2⤵
  PID:9300
- C:\Windows\System\ivEnkXF.exe
  C:\Windows\System\ivEnkXF.exe
  2⤵
  PID:8948
- C:\Windows\System\tZAHtLE.exe
  C:\Windows\System\tZAHtLE.exe
  2⤵
  PID:9016
- C:\Windows\System\FyfcGWz.exe
  C:\Windows\System\FyfcGWz.exe
  2⤵
  PID:9696
- C:\Windows\System\FtCWMAM.exe
  C:\Windows\System\FtCWMAM.exe
  2⤵
  PID:9740
- C:\Windows\System\LCvATVd.exe
  C:\Windows\System\LCvATVd.exe
  2⤵
  PID:9064
- C:\Windows\System\kXldJqH.exe
  C:\Windows\System\kXldJqH.exe
  2⤵
  PID:9788
- C:\Windows\System\XdXwwXv.exe
  C:\Windows\System\XdXwwXv.exe
  2⤵
  PID:9132
- C:\Windows\System\QCotSPn.exe
  C:\Windows\System\QCotSPn.exe
  2⤵
  PID:9900
- C:\Windows\System\zTPuwRj.exe
  C:\Windows\System\zTPuwRj.exe
  2⤵
  PID:7700
- C:\Windows\System\xgguMYd.exe
  C:\Windows\System\xgguMYd.exe
  2⤵
  PID:10124
- C:\Windows\System\kIUmZjw.exe
  C:\Windows\System\kIUmZjw.exe
  2⤵
  PID:10208
- C:\Windows\System\PuIyhOh.exe
  C:\Windows\System\PuIyhOh.exe
  2⤵
  PID:8884
- C:\Windows\System\DzDkrCl.exe
  C:\Windows\System\DzDkrCl.exe
  2⤵
  PID:8932
- C:\Windows\System\ikqCChq.exe
  C:\Windows\System\ikqCChq.exe
  2⤵
  PID:9156
- C:\Windows\System\dQErueI.exe
  C:\Windows\System\dQErueI.exe
  2⤵
  PID:7944
- C:\Windows\System\ZDSPmmW.exe
  C:\Windows\System\ZDSPmmW.exe
  2⤵
  PID:9972
- C:\Windows\System\cCDUBDs.exe
  C:\Windows\System\cCDUBDs.exe
  2⤵
  PID:10000
- C:\Windows\System\nFKVjgD.exe
  C:\Windows\System\nFKVjgD.exe
  2⤵
  PID:10036
- C:\Windows\System\xFcPEuP.exe
  C:\Windows\System\xFcPEuP.exe
  2⤵
  PID:7752
- C:\Windows\System\gnvumyu.exe
  C:\Windows\System\gnvumyu.exe
  2⤵
  PID:10372
- C:\Windows\System\jLYLhbW.exe
  C:\Windows\System\jLYLhbW.exe
  2⤵
  PID:10396
- C:\Windows\System\lISpUXa.exe
  C:\Windows\System\lISpUXa.exe
  2⤵
  PID:10420
- C:\Windows\System\XOAeyZJ.exe
  C:\Windows\System\XOAeyZJ.exe
  2⤵
  PID:10440
- C:\Windows\System\sFfPlQi.exe
  C:\Windows\System\sFfPlQi.exe
  2⤵
  PID:10460
- C:\Windows\System\AoGGBNW.exe
  C:\Windows\System\AoGGBNW.exe
  2⤵
  PID:10484
- C:\Windows\System\cMIvFok.exe
  C:\Windows\System\cMIvFok.exe
  2⤵
  PID:10508
- C:\Windows\System\jrRANDy.exe
  C:\Windows\System\jrRANDy.exe
  2⤵
  PID:10528
- C:\Windows\System\wmEXxza.exe
  C:\Windows\System\wmEXxza.exe
  2⤵
  PID:10584
- C:\Windows\System\hGCQtjq.exe
  C:\Windows\System\hGCQtjq.exe
  2⤵
  PID:10616
- C:\Windows\System\dvwcCRD.exe
  C:\Windows\System\dvwcCRD.exe
  2⤵
  PID:10636
- C:\Windows\System\aQqsvee.exe
  C:\Windows\System\aQqsvee.exe
  2⤵
  PID:10664
- C:\Windows\System\HuZbOsO.exe
  C:\Windows\System\HuZbOsO.exe
  2⤵
  PID:10692
- C:\Windows\System\cCfroyM.exe
  C:\Windows\System\cCfroyM.exe
  2⤵
  PID:10716
- C:\Windows\System\uYQpBjI.exe
  C:\Windows\System\uYQpBjI.exe
  2⤵
  PID:10744
- C:\Windows\System\VfhTCUW.exe
  C:\Windows\System\VfhTCUW.exe
  2⤵
  PID:10764
- C:\Windows\System\rIVNvih.exe
  C:\Windows\System\rIVNvih.exe
  2⤵
  PID:10788
- C:\Windows\System\oWqeOBi.exe
  C:\Windows\System\oWqeOBi.exe
  2⤵
  PID:10812
- C:\Windows\System\nfTixnl.exe
  C:\Windows\System\nfTixnl.exe
  2⤵
  PID:10836
- C:\Windows\System\pAMIrLR.exe
  C:\Windows\System\pAMIrLR.exe
  2⤵
  PID:10860
- C:\Windows\System\ZRLazVa.exe
  C:\Windows\System\ZRLazVa.exe
  2⤵
  PID:10880
- C:\Windows\System\nfjDIBF.exe
  C:\Windows\System\nfjDIBF.exe
  2⤵
  PID:10904
- C:\Windows\System\NANvAMj.exe
  C:\Windows\System\NANvAMj.exe
  2⤵
  PID:10928
- C:\Windows\System\YDuirYc.exe
  C:\Windows\System\YDuirYc.exe
  2⤵
  PID:10956
- C:\Windows\System\PooTQYG.exe
  C:\Windows\System\PooTQYG.exe
  2⤵
  PID:10992
- C:\Windows\System\NFtFePN.exe
  C:\Windows\System\NFtFePN.exe
  2⤵
  PID:11020
- C:\Windows\System\bzwFmwa.exe
  C:\Windows\System\bzwFmwa.exe
  2⤵
  PID:11048
- C:\Windows\System\udemrqw.exe
  C:\Windows\System\udemrqw.exe
  2⤵
  PID:11080
- C:\Windows\System\vIusGaz.exe
  C:\Windows\System\vIusGaz.exe
  2⤵
  PID:11104
- C:\Windows\System\gjKYthf.exe
  C:\Windows\System\gjKYthf.exe
  2⤵
  PID:11124
- C:\Windows\System\FquumXj.exe
  C:\Windows\System\FquumXj.exe
  2⤵
  PID:11152
- C:\Windows\System\mScVQKI.exe
  C:\Windows\System\mScVQKI.exe
  2⤵
  PID:11176
- C:\Windows\System\qjWtvGf.exe
  C:\Windows\System\qjWtvGf.exe
  2⤵
  PID:11200
- C:\Windows\System\PdBzKbZ.exe
  C:\Windows\System\PdBzKbZ.exe
  2⤵
  PID:11224
- C:\Windows\System\WovTYEf.exe
  C:\Windows\System\WovTYEf.exe
  2⤵
  PID:11240
- C:\Windows\System\EBDrHSm.exe
  C:\Windows\System\EBDrHSm.exe
  2⤵
  PID:10212
- C:\Windows\System\WYQoMER.exe
  C:\Windows\System\WYQoMER.exe
  2⤵
  PID:9384
- C:\Windows\System\SfkogqH.exe
  C:\Windows\System\SfkogqH.exe
  2⤵
  PID:9448
- C:\Windows\System\PCjCTTk.exe
  C:\Windows\System\PCjCTTk.exe
  2⤵
  PID:9480
- C:\Windows\System\WEknRLb.exe
  C:\Windows\System\WEknRLb.exe
  2⤵
  PID:8252
- C:\Windows\System\GlTfvnp.exe
  C:\Windows\System\GlTfvnp.exe
  2⤵
  PID:8764
- C:\Windows\System\TRIOPim.exe
  C:\Windows\System\TRIOPim.exe
  2⤵
  PID:9820
- C:\Windows\System\EHsfmfS.exe
  C:\Windows\System\EHsfmfS.exe
  2⤵
  PID:9672
- C:\Windows\System\PczKLPR.exe
  C:\Windows\System\PczKLPR.exe
  2⤵
  PID:7244
- C:\Windows\System\khjTgHF.exe
  C:\Windows\System\khjTgHF.exe
  2⤵
  PID:5432
- C:\Windows\System\pYbeTzh.exe
  C:\Windows\System\pYbeTzh.exe
  2⤵
  PID:7328
- C:\Windows\System\WrpsDiB.exe
  C:\Windows\System\WrpsDiB.exe
  2⤵
  PID:10272
- C:\Windows\System\cSLtuHe.exe
  C:\Windows\System\cSLtuHe.exe
  2⤵
  PID:10312
- C:\Windows\System\nZyaaAG.exe
  C:\Windows\System\nZyaaAG.exe
  2⤵
  PID:9204
- C:\Windows\System\qpJzPvi.exe
  C:\Windows\System\qpJzPvi.exe
  2⤵
  PID:11280
- C:\Windows\System\aYzyfnB.exe
  C:\Windows\System\aYzyfnB.exe
  2⤵
  PID:11296
- C:\Windows\System\TkiCHfO.exe
  C:\Windows\System\TkiCHfO.exe
  2⤵
  PID:11312
- C:\Windows\System\qjDeGaa.exe
  C:\Windows\System\qjDeGaa.exe
  2⤵
  PID:11332
- C:\Windows\System\Ssudtyq.exe
  C:\Windows\System\Ssudtyq.exe
  2⤵
  PID:11352
- C:\Windows\System\kpLVRMZ.exe
  C:\Windows\System\kpLVRMZ.exe
  2⤵
  PID:11380
- C:\Windows\System\JbWSSPX.exe
  C:\Windows\System\JbWSSPX.exe
  2⤵
  PID:11396
- C:\Windows\System\pTjkNha.exe
  C:\Windows\System\pTjkNha.exe
  2⤵
  PID:11420
- C:\Windows\System\XgqvHBU.exe
  C:\Windows\System\XgqvHBU.exe
  2⤵
  PID:11448
- C:\Windows\System\xOUsDGt.exe
  C:\Windows\System\xOUsDGt.exe
  2⤵
  PID:11472
- C:\Windows\System\JYLJDQn.exe
  C:\Windows\System\JYLJDQn.exe
  2⤵
  PID:11492
- C:\Windows\System\vcRlwnj.exe
  C:\Windows\System\vcRlwnj.exe
  2⤵
  PID:11512
- C:\Windows\System\llahKro.exe
  C:\Windows\System\llahKro.exe
  2⤵
  PID:11540
- C:\Windows\System\noYABmG.exe
  C:\Windows\System\noYABmG.exe
  2⤵
  PID:11584
- C:\Windows\System\DwfIKBM.exe
  C:\Windows\System\DwfIKBM.exe
  2⤵
  PID:11604
- C:\Windows\System\PryPNRH.exe
  C:\Windows\System\PryPNRH.exe
  2⤵
  PID:11624
- C:\Windows\System\ykzAeTh.exe
  C:\Windows\System\ykzAeTh.exe
  2⤵
  PID:11644
- C:\Windows\System\pyDrDCH.exe
  C:\Windows\System\pyDrDCH.exe
  2⤵
  PID:11676
- C:\Windows\System\UZqwLqf.exe
  C:\Windows\System\UZqwLqf.exe
  2⤵
  PID:11728
- C:\Windows\System\MhMzsJF.exe
  C:\Windows\System\MhMzsJF.exe
  2⤵
  PID:11744
- C:\Windows\System\NWzGsEB.exe
  C:\Windows\System\NWzGsEB.exe
  2⤵
  PID:11764
- C:\Windows\System\crltskj.exe
  C:\Windows\System\crltskj.exe
  2⤵
  PID:11792
- C:\Windows\System\wuJhbnU.exe
  C:\Windows\System\wuJhbnU.exe
  2⤵
  PID:11816
- C:\Windows\System\TfxFqAN.exe
  C:\Windows\System\TfxFqAN.exe
  2⤵
  PID:11840
- C:\Windows\System\IIyZIgK.exe
  C:\Windows\System\IIyZIgK.exe
  2⤵
  PID:11856
- C:\Windows\System\GSVUSGl.exe
  C:\Windows\System\GSVUSGl.exe
  2⤵
  PID:11876
- C:\Windows\System\wBBamjJ.exe
  C:\Windows\System\wBBamjJ.exe
  2⤵
  PID:11896
- C:\Windows\System\WlakCJq.exe
  C:\Windows\System\WlakCJq.exe
  2⤵
  PID:11924
- C:\Windows\System\lZEklde.exe
  C:\Windows\System\lZEklde.exe
  2⤵
  PID:11944
- C:\Windows\System\RRRIdDj.exe
  C:\Windows\System\RRRIdDj.exe
  2⤵
  PID:11968
- C:\Windows\System\xsWWCTv.exe
  C:\Windows\System\xsWWCTv.exe
  2⤵
  PID:11988
- C:\Windows\System\hjQxSKj.exe
  C:\Windows\System\hjQxSKj.exe
  2⤵
  PID:12012
- C:\Windows\System\eDKIHXi.exe
  C:\Windows\System\eDKIHXi.exe
  2⤵
  PID:12032
- C:\Windows\System\lksvocn.exe
  C:\Windows\System\lksvocn.exe
  2⤵
  PID:12056
- C:\Windows\System\qHfvwos.exe
  C:\Windows\System\qHfvwos.exe
  2⤵
  PID:12080
- C:\Windows\System\xqabBKj.exe
  C:\Windows\System\xqabBKj.exe
  2⤵
  PID:12108
- C:\Windows\System\nLpNyCo.exe
  C:\Windows\System\nLpNyCo.exe
  2⤵
  PID:12128
- C:\Windows\System\jzmIGHm.exe
  C:\Windows\System\jzmIGHm.exe
  2⤵
  PID:12156
- C:\Windows\System\RxCihJs.exe
  C:\Windows\System\RxCihJs.exe
  2⤵
  PID:12188
- C:\Windows\System\cuFqMtS.exe
  C:\Windows\System\cuFqMtS.exe
  2⤵
  PID:12208
- C:\Windows\System\tGMhonE.exe
  C:\Windows\System\tGMhonE.exe
  2⤵
  PID:12228
- C:\Windows\System\VBPYaIa.exe
  C:\Windows\System\VBPYaIa.exe
  2⤵
  PID:12252
- C:\Windows\System\RDvLgrW.exe
  C:\Windows\System\RDvLgrW.exe
  2⤵
  PID:12276
- C:\Windows\System\hTXRltr.exe
  C:\Windows\System\hTXRltr.exe
  2⤵
  PID:8696
- C:\Windows\System\jkazBch.exe
  C:\Windows\System\jkazBch.exe
  2⤵
  PID:10416
- C:\Windows\System\zRsROCr.exe
  C:\Windows\System\zRsROCr.exe
  2⤵
  PID:10152
- C:\Windows\System\KnrAZzv.exe
  C:\Windows\System\KnrAZzv.exe
  2⤵
  PID:10536
- C:\Windows\System\RqXBQNA.exe
  C:\Windows\System\RqXBQNA.exe
  2⤵
  PID:10560
- C:\Windows\System\CoXrTmb.exe
  C:\Windows\System\CoXrTmb.exe
  2⤵
  PID:10648
- C:\Windows\System\eBqZZYU.exe
  C:\Windows\System\eBqZZYU.exe
  2⤵
  PID:9332
- C:\Windows\System\vMYFOhY.exe
  C:\Windows\System\vMYFOhY.exe
  2⤵
  PID:10760
- C:\Windows\System\btuRFWp.exe
  C:\Windows\System\btuRFWp.exe
  2⤵
  PID:10828
- C:\Windows\System\fAYXcZx.exe
  C:\Windows\System\fAYXcZx.exe
  2⤵
  PID:9612
- C:\Windows\System\uXqqGKh.exe
  C:\Windows\System\uXqqGKh.exe
  2⤵
  PID:9724
- C:\Windows\System\cCCoxPB.exe
  C:\Windows\System\cCCoxPB.exe
  2⤵
  PID:9776
- C:\Windows\System\bXgSEKv.exe
  C:\Windows\System\bXgSEKv.exe
  2⤵
  PID:8436
- C:\Windows\System\rvkIxNq.exe
  C:\Windows\System\rvkIxNq.exe
  2⤵
  PID:9416
- C:\Windows\System\czHEdbq.exe
  C:\Windows\System\czHEdbq.exe
  2⤵
  PID:9600
- C:\Windows\System\BbArSCP.exe
  C:\Windows\System\BbArSCP.exe
  2⤵
  PID:11160
- C:\Windows\System\jqiGgHz.exe
  C:\Windows\System\jqiGgHz.exe
  2⤵
  PID:11192
- C:\Windows\System\BoFhUoN.exe
  C:\Windows\System\BoFhUoN.exe
  2⤵
  PID:11260
- C:\Windows\System\KEJnWfF.exe
  C:\Windows\System\KEJnWfF.exe
  2⤵
  PID:9468
- C:\Windows\System\PMeKaYo.exe
  C:\Windows\System\PMeKaYo.exe
  2⤵
  PID:9924
- C:\Windows\System\VWAVGQg.exe
  C:\Windows\System\VWAVGQg.exe
  2⤵
  PID:8800
- C:\Windows\System\UkyDYUF.exe
  C:\Windows\System\UkyDYUF.exe
  2⤵
  PID:7344
- C:\Windows\System\ZfnvrXT.exe
  C:\Windows\System\ZfnvrXT.exe
  2⤵
  PID:11304
- C:\Windows\System\CUJqyFW.exe
  C:\Windows\System\CUJqyFW.exe
  2⤵
  PID:11360
- C:\Windows\System\DhRYjEA.exe
  C:\Windows\System\DhRYjEA.exe
  2⤵
  PID:7016
- C:\Windows\System\aDvvpid.exe
  C:\Windows\System\aDvvpid.exe
  2⤵
  PID:10432
- C:\Windows\System\VGSJgtb.exe
  C:\Windows\System\VGSJgtb.exe
  2⤵
  PID:10572
- C:\Windows\System\JAkZJkK.exe
  C:\Windows\System\JAkZJkK.exe
  2⤵
  PID:12296
- C:\Windows\System\Yuwthgo.exe
  C:\Windows\System\Yuwthgo.exe
  2⤵
  PID:12320
- C:\Windows\System\ZNUwKFw.exe
  C:\Windows\System\ZNUwKFw.exe
  2⤵
  PID:12344
- C:\Windows\System\mFklvAr.exe
  C:\Windows\System\mFklvAr.exe
  2⤵
  PID:12368
- C:\Windows\System\TNaUQwD.exe
  C:\Windows\System\TNaUQwD.exe
  2⤵
  PID:12392
- C:\Windows\System\ARUpAWN.exe
  C:\Windows\System\ARUpAWN.exe
  2⤵
  PID:12420
- C:\Windows\System\rTbKGgM.exe
  C:\Windows\System\rTbKGgM.exe
  2⤵
  PID:12452
- C:\Windows\System\qTegcvD.exe
  C:\Windows\System\qTegcvD.exe
  2⤵
  PID:12472
- C:\Windows\System\bGiNyMI.exe
  C:\Windows\System\bGiNyMI.exe
  2⤵
  PID:12504
- C:\Windows\System\rZiPvQw.exe
  C:\Windows\System\rZiPvQw.exe
  2⤵
  PID:12524
- C:\Windows\System\tBevQYe.exe
  C:\Windows\System\tBevQYe.exe
  2⤵
  PID:12548
- C:\Windows\System\NKNppFs.exe
  C:\Windows\System\NKNppFs.exe
  2⤵
  PID:12572
- C:\Windows\System\oHLaERq.exe
  C:\Windows\System\oHLaERq.exe
  2⤵
  PID:12600
- C:\Windows\System\rCdcrYS.exe
  C:\Windows\System\rCdcrYS.exe
  2⤵
  PID:12624
- C:\Windows\System\qpGMtAv.exe
  C:\Windows\System\qpGMtAv.exe
  2⤵
  PID:12644
- C:\Windows\System\pCiDPun.exe
  C:\Windows\System\pCiDPun.exe
  2⤵
  PID:12672
- C:\Windows\System\aAeplvm.exe
  C:\Windows\System\aAeplvm.exe
  2⤵
  PID:12692
- C:\Windows\System\uukyKNN.exe
  C:\Windows\System\uukyKNN.exe
  2⤵
  PID:12712
- C:\Windows\System\yOdrAJD.exe
  C:\Windows\System\yOdrAJD.exe
  2⤵
  PID:12740
- C:\Windows\System\NjZrIYf.exe
  C:\Windows\System\NjZrIYf.exe
  2⤵
  PID:12764
- C:\Windows\System\RaMRfmS.exe
  C:\Windows\System\RaMRfmS.exe
  2⤵
  PID:12780
- C:\Windows\System\fwzuyIW.exe
  C:\Windows\System\fwzuyIW.exe
  2⤵
  PID:12804
- C:\Windows\System\PSqVWHw.exe
  C:\Windows\System\PSqVWHw.exe
  2⤵
  PID:12828
- C:\Windows\System\pwVvqtH.exe
  C:\Windows\System\pwVvqtH.exe
  2⤵
  PID:12856
- C:\Windows\System\rXZEdWT.exe
  C:\Windows\System\rXZEdWT.exe
  2⤵
  PID:12880
- C:\Windows\System\QnAUAio.exe
  C:\Windows\System\QnAUAio.exe
  2⤵
  PID:12900
- C:\Windows\System\mPKhliZ.exe
  C:\Windows\System\mPKhliZ.exe
  2⤵
  PID:12556
- C:\Windows\System\RbzbZrL.exe
  C:\Windows\System\RbzbZrL.exe
  2⤵
  PID:12612
- C:\Windows\System\hNfdLpZ.exe
  C:\Windows\System\hNfdLpZ.exe
  2⤵
  PID:12684
- C:\Windows\System\GpWXABm.exe
  C:\Windows\System\GpWXABm.exe
  2⤵
  PID:11872
- C:\Windows\System\GPjIBsJ.exe
  C:\Windows\System\GPjIBsJ.exe
  2⤵
  PID:12788
- C:\Windows\System\VKMUZUA.exe
  C:\Windows\System\VKMUZUA.exe
  2⤵
  PID:12836
- C:\Windows\System\YKRFGaG.exe
  C:\Windows\System\YKRFGaG.exe
  2⤵
  PID:11120
- C:\Windows\System\ByxVpfp.exe
  C:\Windows\System\ByxVpfp.exe
  2⤵
  PID:12896
- C:\Windows\System\owWkiHO.exe
  C:\Windows\System\owWkiHO.exe
  2⤵
  PID:12928
- C:\Windows\System\zZgiXvG.exe
  C:\Windows\System\zZgiXvG.exe
  2⤵
  PID:10264
- C:\Windows\System\yNujnOn.exe
  C:\Windows\System\yNujnOn.exe
  2⤵
  PID:13196
- C:\Windows\System\PoyEOAI.exe
  C:\Windows\System\PoyEOAI.exe
  2⤵
  PID:11852
- C:\Windows\System\NYVnqeE.exe
  C:\Windows\System\NYVnqeE.exe
  2⤵
  PID:12116
- C:\Windows\System\CcBffDJ.exe
  C:\Windows\System\CcBffDJ.exe
  2⤵
  PID:10672
- C:\Windows\System\FaZNJFq.exe
  C:\Windows\System\FaZNJFq.exe
  2⤵
  PID:10868
- C:\Windows\System\TBOTFCc.exe
  C:\Windows\System\TBOTFCc.exe
  2⤵
  PID:10356
- C:\Windows\System\jZhAtnO.exe
  C:\Windows\System\jZhAtnO.exe
  2⤵
  PID:12968
- C:\Windows\System\EZpjjgk.exe
  C:\Windows\System\EZpjjgk.exe
  2⤵
  PID:12996
- C:\Windows\System\DpTdptU.exe
  C:\Windows\System\DpTdptU.exe
  2⤵
  PID:13032
- C:\Windows\System\fIGhfzS.exe
  C:\Windows\System\fIGhfzS.exe
  2⤵
  PID:13304
- C:\Windows\System\MAAEDvI.exe
  C:\Windows\System\MAAEDvI.exe
  2⤵
  PID:13124
- C:\Windows\System\mcHuDBa.exe
  C:\Windows\System\mcHuDBa.exe
  2⤵
  PID:10844
- C:\Windows\System\lDZrWPu.exe
  C:\Windows\System\lDZrWPu.exe
  2⤵
  PID:10964
- C:\Windows\System\EGghmuO.exe
  C:\Windows\System\EGghmuO.exe
  2⤵
  PID:11720
- C:\Windows\System\brnBJrS.exe
  C:\Windows\System\brnBJrS.exe
  2⤵
  PID:8228
- C:\Windows\System\PJPcPpq.exe
  C:\Windows\System\PJPcPpq.exe
  2⤵
  PID:11848
- C:\Windows\System\qjqcgbT.exe
  C:\Windows\System\qjqcgbT.exe
  2⤵
  PID:12024
- C:\Windows\System\cUUqhlC.exe
  C:\Windows\System\cUUqhlC.exe
  2⤵
  PID:10304
- C:\Windows\System\XfwPLlS.exe
  C:\Windows\System\XfwPLlS.exe
  2⤵
  PID:6140
- C:\Windows\System\WdveJdS.exe
  C:\Windows\System\WdveJdS.exe
  2⤵
  PID:12248
- C:\Windows\System\cGAUVWr.exe
  C:\Windows\System\cGAUVWr.exe
  2⤵
  PID:9120
- C:\Windows\System\LVJfHcD.exe
  C:\Windows\System\LVJfHcD.exe
  2⤵
  PID:10348
- C:\Windows\System\eifowVP.exe
  C:\Windows\System\eifowVP.exe
  2⤵
  PID:11552
- C:\Windows\System\zOIOdHg.exe
  C:\Windows\System\zOIOdHg.exe
  2⤵
  PID:9772
- C:\Windows\System\lbHHtwA.exe
  C:\Windows\System\lbHHtwA.exe
  2⤵
  PID:12340
- C:\Windows\System\ceKamWM.exe
  C:\Windows\System\ceKamWM.exe
  2⤵
  PID:12204
- C:\Windows\System\qznHWio.exe
  C:\Windows\System\qznHWio.exe
  2⤵
  PID:7416
- C:\Windows\System\DBciVHl.exe
  C:\Windows\System\DBciVHl.exe
  2⤵
  PID:10476
- C:\Windows\System\QiCXpNf.exe
  C:\Windows\System\QiCXpNf.exe
  2⤵
  PID:10936
- C:\Windows\System\XoaejMb.exe
  C:\Windows\System\XoaejMb.exe
  2⤵
  PID:11808
- C:\Windows\System\GhvZApF.exe
  C:\Windows\System\GhvZApF.exe
  2⤵
  PID:12428
- C:\Windows\System\XBVHgeY.exe
  C:\Windows\System\XBVHgeY.exe
  2⤵
  PID:12444
- C:\Windows\System\MYXXOoL.exe
  C:\Windows\System\MYXXOoL.exe
  2⤵
  PID:12532
- C:\Windows\System\DSJNHLM.exe
  C:\Windows\System\DSJNHLM.exe
  2⤵
  PID:6912
- C:\Windows\System\rZqSXkh.exe
  C:\Windows\System\rZqSXkh.exe
  2⤵
  PID:12720
- C:\Windows\System\FiGZMqB.exe
  C:\Windows\System\FiGZMqB.exe
  2⤵
  PID:12752
- C:\Windows\System\sZNQsMT.exe
  C:\Windows\System\sZNQsMT.exe
  2⤵
  PID:9176
- C:\Windows\System\OXJBpiV.exe
  C:\Windows\System\OXJBpiV.exe
  2⤵
  PID:12136
- C:\Windows\System\xlaBMUT.exe
  C:\Windows\System\xlaBMUT.exe
  2⤵
  PID:12848
- C:\Windows\System\xXsWsgT.exe
  C:\Windows\System\xXsWsgT.exe
  2⤵
  PID:12988
- C:\Windows\System\iWGfRUS.exe
  C:\Windows\System\iWGfRUS.exe
  2⤵
  PID:12964
- C:\Windows\System\xNPWcEJ.exe
  C:\Windows\System\xNPWcEJ.exe
  2⤵
  PID:8768
- C:\Windows\System\KRcrYDb.exe
  C:\Windows\System\KRcrYDb.exe
  2⤵
  PID:12980
- C:\Windows\System\kIrwBav.exe
  C:\Windows\System\kIrwBav.exe
  2⤵
  PID:11936
- C:\Windows\System\sCqkJAi.exe
  C:\Windows\System\sCqkJAi.exe
  2⤵
  PID:12260
- C:\Windows\System\jLsJCrH.exe
  C:\Windows\System\jLsJCrH.exe
  2⤵
  PID:13088
- C:\Windows\System\lZuwCfr.exe
  C:\Windows\System\lZuwCfr.exe
  2⤵
  PID:10832
- C:\Windows\System\FtQWQRE.exe
  C:\Windows\System\FtQWQRE.exe
  2⤵
  PID:10872
- C:\Windows\System\xhjzjCw.exe
  C:\Windows\System\xhjzjCw.exe
  2⤵
  PID:11956
- C:\Windows\System\xFtwSMI.exe
  C:\Windows\System\xFtwSMI.exe
  2⤵
  PID:11392
- C:\Windows\System\fjSpFif.exe
  C:\Windows\System\fjSpFif.exe
  2⤵
  PID:11740
- C:\Windows\System\tPBBAND.exe
  C:\Windows\System\tPBBAND.exe
  2⤵
  PID:8972
- C:\Windows\System\SmawtEM.exe
  C:\Windows\System\SmawtEM.exe
  2⤵
  PID:10628
- C:\Windows\System\NgDmqeO.exe
  C:\Windows\System\NgDmqeO.exe
  2⤵
  PID:11804
- C:\Windows\System\MEZdotc.exe
  C:\Windows\System\MEZdotc.exe
  2⤵
  PID:13320
- C:\Windows\System\nxZWAeS.exe
  C:\Windows\System\nxZWAeS.exe
  2⤵
  PID:13340
- C:\Windows\System\QTLbTix.exe
  C:\Windows\System\QTLbTix.exe
  2⤵
  PID:13364
- C:\Windows\System\hGOhXDP.exe
  C:\Windows\System\hGOhXDP.exe
  2⤵
  PID:13384
- C:\Windows\System\jRMQwrx.exe
  C:\Windows\System\jRMQwrx.exe
  2⤵
  PID:13412
- C:\Windows\System\fzhwuwO.exe
  C:\Windows\System\fzhwuwO.exe
  2⤵
  PID:13436
- C:\Windows\System\Encwlol.exe
  C:\Windows\System\Encwlol.exe
  2⤵
  PID:14024
- C:\Windows\System\VnpFPVZ.exe
  C:\Windows\System\VnpFPVZ.exe
  2⤵
  PID:14068
- C:\Windows\System\oCSevVl.exe
  C:\Windows\System\oCSevVl.exe
  2⤵
  PID:14100
- C:\Windows\System\llbhreB.exe
  C:\Windows\System\llbhreB.exe
  2⤵
  PID:14136
- C:\Windows\System\lnOxYse.exe
  C:\Windows\System\lnOxYse.exe
  2⤵
  PID:14156
- C:\Windows\System\sTydhkA.exe
  C:\Windows\System\sTydhkA.exe
  2⤵
  PID:14176
- C:\Windows\System\ejUbWWH.exe
  C:\Windows\System\ejUbWWH.exe
  2⤵
  PID:14204
- C:\Windows\System\SzkuYLz.exe
  C:\Windows\System\SzkuYLz.exe
  2⤵
  PID:14220
- C:\Windows\System\YCutBTV.exe
  C:\Windows\System\YCutBTV.exe
  2⤵
  PID:14240
- C:\Windows\System\MuAyIEy.exe
  C:\Windows\System\MuAyIEy.exe
  2⤵
  PID:14256
- C:\Windows\System\jgLogRT.exe
  C:\Windows\System\jgLogRT.exe
  2⤵
  PID:14280
- C:\Windows\System\eZpWGJu.exe
  C:\Windows\System\eZpWGJu.exe
  2⤵
  PID:12468
- C:\Windows\System\ZElDlNG.exe
  C:\Windows\System\ZElDlNG.exe
  2⤵
  PID:9988
- C:\Windows\System\ROsAsHO.exe
  C:\Windows\System\ROsAsHO.exe
  2⤵
  PID:13508
- C:\Windows\System\qVzQIGq.exe
  C:\Windows\System\qVzQIGq.exe
  2⤵
  PID:12268
- C:\Windows\System\jicJGiW.exe
  C:\Windows\System\jicJGiW.exe
  2⤵
  PID:13664
- C:\Windows\System\VZxQlTK.exe
  C:\Windows\System\VZxQlTK.exe
  2⤵
  PID:13112
- C:\Windows\System\oJGVMgy.exe
  C:\Windows\System\oJGVMgy.exe
  2⤵
  PID:8924
- C:\Windows\System\XIrGlBT.exe
  C:\Windows\System\XIrGlBT.exe
  2⤵
  PID:8664
- C:\Windows\System\FCTFBNw.exe
  C:\Windows\System\FCTFBNw.exe
  2⤵
  PID:12272
- C:\Windows\System\FYYXEYt.exe
  C:\Windows\System\FYYXEYt.exe
  2⤵
  PID:13392
- C:\Windows\System\frtAUys.exe
  C:\Windows\System\frtAUys.exe
  2⤵
  PID:13052
- C:\Windows\System\isHtfcE.exe
  C:\Windows\System\isHtfcE.exe
  2⤵
  PID:13692
- C:\Windows\System\tHOgQuz.exe
  C:\Windows\System\tHOgQuz.exe
  2⤵
  PID:12220
- C:\Windows\System\swJqjEo.exe
  C:\Windows\System\swJqjEo.exe
  2⤵
  PID:13660
- C:\Windows\System\UNPcllJ.exe
  C:\Windows\System\UNPcllJ.exe
  2⤵
  PID:13676
- C:\Windows\System\QxrvqxJ.exe
  C:\Windows\System\QxrvqxJ.exe
  2⤵
  PID:3736
- C:\Windows\System\tSKfuqm.exe
  C:\Windows\System\tSKfuqm.exe
  2⤵
  PID:11320
- C:\Windows\System\SIyjLap.exe
  C:\Windows\System\SIyjLap.exe
  2⤵
  PID:13820
- C:\Windows\System\Ancrbuc.exe
  C:\Windows\System\Ancrbuc.exe
  2⤵
  PID:13808
- C:\Windows\System\byioOWm.exe
  C:\Windows\System\byioOWm.exe
  2⤵
  PID:13580
- C:\Windows\System\CnGwKAg.exe
  C:\Windows\System\CnGwKAg.exe
  2⤵
  PID:13856
- C:\Windows\System\fEvACpC.exe
  C:\Windows\System\fEvACpC.exe
  2⤵
  PID:2256

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 484 -p 9204 -ip 9204
1⤵
PID:10628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qgookdqt.ocr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AZLzXiP.exe

Filesize
2.2MB

MD5
ed03c7cc7f3f202d6348204ae23b7eb1

SHA1
bf3ac927b8209940ab47956b501ecf320978546d

SHA256
ea6c6f1b1314ec510ec52af275ae27f967a4d243c63e2e312e45c8953e954db2

SHA512
46d7ab7b4f52620690c3ef21c9347cdaeccc8801d010fabb2534b09d19bd1b2646ffced031f9258a5fa9fde972b93140fe6118fbc6384fbaa8e2a1ec46be5b05

Download Submit
C:\Windows\System\BGcXFaY.exe

Filesize
2.2MB

MD5
cfada0ecd904e7a7de4d667b66e679a8

SHA1
7b0e8406ae91bbc61631b6d8c5e220d273a942af

SHA256
97e34b334e87d81c99fe624977c4c8a4d31427043f552a331d46a74e38cc4893

SHA512
2d657be66557f936657c34d9b6c9b0ab5fb9029f2f7220614b689a2d80ff21341b294e016fb2718d041e55daf3f99faec9ae3b4932317211dc899dc8e2791710

Download Submit
C:\Windows\System\BjlhCjB.exe

Filesize
2.2MB

MD5
4e2cce238197420212f96005ce19d0a9

SHA1
475da0e09954112fdecb070f43e068a03c34fe5f

SHA256
0931be550f7caa7fa0674567120ae0d47a2ea39267bafe61078cb09cdf144df6

SHA512
e7b11740dad54ba53f848247e4758bdfdf7a4cea16526691a214a86090f753a3eddf0758a106657fdfb09d1353aa256f203deb8733478f1fb5fbc19ee56f2e36

Download Submit
C:\Windows\System\DAoocVe.exe

Filesize
2.1MB

MD5
f25ff32f8506cf72acf221f633081205

SHA1
c559f54ece872add4fba446681a5bd5316eea020

SHA256
67b620338fd259ae4b3b565cca197d3ec3f6a976e6fddc3b3c9e48efc67fe4a4

SHA512
47b1eeb987b4a688f012b41ded6653f7b1824e1198d1b31f849a440fef51935da443a92412f3c4d9f264d9cde60072081b67dad9f0aed5c249cc345996ac8b04

Download Submit
C:\Windows\System\DJwQNMO.exe

Filesize
2.1MB

MD5
a19eea4fe6bd1e185ced49ccc8a85a44

SHA1
6e27712835ef635eafe2469470597280f05426da

SHA256
ad98291c4f8cd0691097abf87bff3ca29dca51867e9c418019c0e7590610cbb0

SHA512
20d8df38010e3698b4fc8458dd569087b0c1dcedc8fb3c7d7007bb3a7d9a2d7e465cad55512795fccaaace6f7ea5642eb806e4b24456065fa9ff0681452ad93c

Download Submit
C:\Windows\System\GUikREW.exe

Filesize
2.1MB

MD5
78c86aa3ff29f43e0dbc50fdaeee95fc

SHA1
ec2d8ccbee3bbda831847028ff32722977b945f2

SHA256
a0d25b68f813a6206591859838e473ed76cd48ca7f8c5d2a5ea5e3ce2dcd6843

SHA512
002e05584aac78f95c276476411aa53de17bba2a2d764a27f54d37ceced85affc47854472824b6fc18cad3900f8d1cb2db24462af8d45cf78d83ce014862d519

Download Submit
C:\Windows\System\JJYpGKz.exe

Filesize
2.1MB

MD5
fd432357c93e911804275dfec5617d72

SHA1
940dfdc05c449d377bba46317256b8d595bb02e1

SHA256
7856349b6978eefcd3ad18e6ecbe71a7a6292211c65ba7d81a90dadb79878422

SHA512
935ce8a25544e372b47bd1fb08422c0231ed794cf6a14c215435ce27e873f16f78b75b9598187a5fb24b4d5ee1dd962a6ffef9f8e39a69531aa43a79fbe78e4b

Download Submit
C:\Windows\System\JYxQMWR.exe

Filesize
2.1MB

MD5
92d27e520f617dbb7f3aaaf9147fae51

SHA1
95dab815d146a281c3a6c7c6818928900abca061

SHA256
87d539d3bde4e8fbe5bbd2c9a8cb9b85b7bb7de73cf608a820013e68dafc8a0a

SHA512
6350890228cb67b0a711383a1385a3d63c201374d29e1849d2a4be002331432032056a6318d5df19e7a716b985b87db0264587ad4e85da948e2040961c0af55c

Download Submit
C:\Windows\System\JaUMadH.exe

Filesize
2.1MB

MD5
840758cb5e6ecd645f51c319fbc46199

SHA1
c0538afca4a4b3cba76b024ecb00fa45c65ad80c

SHA256
0cffa074cf24972c0510b8ffce26bd89a155d3dd3ad4d770e7bfbdd2bcaabe0f

SHA512
2a356f5de91cae25406aa7250ef2660fc3dee923437aeeaacdcea9291e1f3beff73033d4f7e31d1109bdfce37adb807f778c9f8db06714daa0ba4f9d7c8b567f

Download Submit
C:\Windows\System\MHtmDzz.exe

Filesize
2.2MB

MD5
a10c0c53cafcbbfa80131ec851e58e26

SHA1
6c155a039ee11cfb124821ecef5db41486461dea

SHA256
e914c818e34208980cb54bf249eb1ba964a0ba73c8a254b1709ee353b894003c

SHA512
8f10347829044df3785641722dd590320d7d6efd32ba405dcdcdb5ff51f5575a464ea84ddc3faeaf69c46edcac6a1937eddb819064321d77ff29eebf9393dc5b

Download Submit
C:\Windows\System\MUIYuBD.exe

Filesize
18B

MD5
b0ce6cfd7adfa2a2ac8258485a5cb279

SHA1
7b40a580431de17fbac688fb86de9bd5a156cd21

SHA256
bd650a2baf71609d723ebd75e0c6c938067406e57d5e80cec86bd9162ab5b10c

SHA512
107fc307e13b0ac2fdfd2a988662ef1274a95d78ff717c971632ef49ca9c9ef1a3e2bfaf20cde619c9ddc0ce2412de1ca0af65582b8a143eef4fd273e3c869f6

Download Submit
C:\Windows\System\PBYVrZi.exe

Filesize
2.1MB

MD5
9f2215d4aa9eb69c1eb997cdb44fb017

SHA1
789968f5eaa5ccda54415ab0767d1e94789af6d3

SHA256
ca2cbda6ddd989e16af5b789cd694eb8fbe883ac63b8ae0fcb601ceb439fe94d

SHA512
06b9f2972da7a42acf1b55fd6f01324694cdf531db00af03ed9b35050c05d87d4eeef1dc67d829c48926a44093f589f72df18c2798f91b1205744f2d2132aca0

Download Submit
C:\Windows\System\QBJQIDy.exe

Filesize
2.2MB

MD5
c1615c28884c14ea4567ef006a3e4909

SHA1
4be56137e3e8db5ad2aa3df461a152cbb8251214

SHA256
2b91473be9fa3fc9207a285feb4303683148e05f6e8f4510d6fdfb60728178e9

SHA512
bd2bf0f09ca41168cc9c860c765ecbf456c067f72c64ae226106650410b3886068852a82dc7487739ca3377e22fee176072c5814717dbe7c9dcd75b37822db30

Download Submit
C:\Windows\System\RZchemb.exe

Filesize
2.2MB

MD5
d7deb486637f8d491d00f610d688f818

SHA1
dc0f81131e6a0fec49548e7c876890b7c7608c40

SHA256
bcc7a338b95d68caccab1c1c7beb3934692731f201d3695d611ff2d365241772

SHA512
32cae2c46f5eb1f1a0d1f1eb9e8eee6b49225303f41ba440a6bd40a48df1199073ef0ebc54d27fbf78b10cbca923a64946dbc48a9b26dc8410d93346e22f5c28

Download Submit
C:\Windows\System\RdMNPWi.exe

Filesize
2.2MB

MD5
f935221a6328cd6f8570fe96aeba3b5b

SHA1
cc1db4587cb3fe4c90894c4fa6a9874e98569ff3

SHA256
90eafa64b0d1e697b414e1bdb38125a0fdeba7f0de5b6817b415d46a352e23fd

SHA512
a39f2a99199c068427a02d9592271257c72a9a5f7965dde4002273a3c390e6c33b9c24cdbbe1a2ffc03bbe6fc326e5f6ae7e8083fc9e97fb034acc77c7a3bd1f

Download Submit
C:\Windows\System\TJYCNBX.exe

Filesize
2.1MB

MD5
6483bb42387b7a76c97c29a91b1c2eef

SHA1
abee48f4f5ebb1652e864d0767bf40ae18edc124

SHA256
9fcac8d8aa511c24b2f4460b7b56f8e8d0a06f8f70efabc4cd19d63622a62df1

SHA512
ea202b23ab7715d98a682187511d3e7a400bd6bbc1a47f24930784cfac37aeafb5e3b342b1bcfef9001ffb0c4aeab7ab9957897d3abbce5298219b700c6e2ca7

Download Submit
C:\Windows\System\UgyqtPn.exe

Filesize
2.2MB

MD5
d2cd9b3eb3f07c3828548d0f53473773

SHA1
6668712e32d1ebcedb0831425bd34409e9d7927b

SHA256
fac793689791ab5ebfa20ab7bd75c13346a665552e6636720468fd05dd5a7739

SHA512
7b6ee22bf100f4c6fc65a3ecc3ce93c8801da04021fd9f377aaa56ff33aa67525c65fd5177820c9ddb8aa00f180e796e92cf90561714f21b50a44c9cb1f6af9a

Download Submit
C:\Windows\System\UlOgGPk.exe

Filesize
2.1MB

MD5
93d393f44c11bf5b50df30e68c8bf8d4

SHA1
dfc69a4016fb81351a13aa712e4fcdc9eafaa06e

SHA256
5149977cdb0c56725a24bd3ddddb7370e4cf826dfc80b835eb4a40bb949b9dc4

SHA512
d58ccfacc1029020f6210ccc53b5b249ecc2026512392020ad037dd6d144e559d81316ef643e05d947302f76201715822b0a069e5807b7c5c32dc82d6f402c72

Download Submit
C:\Windows\System\VYTaUpp.exe

Filesize
2.2MB

MD5
60f37571ec1cf67ef0b5762f14f3f661

SHA1
8cb68eb6e4fa020eb1e855778be901403e325e56

SHA256
83750602bad28a8bbbbb5db8bf0149c9d2ca860f7c08f47e3734e4afb75ac1d9

SHA512
888f702b8c323df3024b2fada00dc08858ecc1bba0142524f133c68f3e1186383759e9db0f37606a15a255274a62f31e2827894d6a03082f28111286dccac8f2

Download Submit
C:\Windows\System\WqQXRKP.exe

Filesize
2.1MB

MD5
90885244710c63a509f83afb951ba92e

SHA1
45f10137ca3c915df01e27d1b08680c3cc750343

SHA256
78a79dfe2ac9aca44aed95f6b39b312d757318925a54da34df5070342d1b6002

SHA512
1ffcc9e8dd1b70956c166a7707425d32b2577a782b949238b3ed0281898ce322869ae7d6bc73d0ffb476aaab9dce62816ccdfe96f79cc012a929aa2dc5353658

Download Submit
C:\Windows\System\YWMqBPE.exe

Filesize
2.1MB

MD5
4a3db64d58e046311ae10f24d47df98a

SHA1
502d6869256dfcf31b69b7ac8ded6b78835346b8

SHA256
82f4358703927a398c73801054666b3ea7059483dfc1296c2889b2010daafd2d

SHA512
7ac6afecd8cbeb20000a16ebd63b913fe6737c5d2e12754f19e65cf02a2617135af3e7f8d30eb287af04b854e92c76df37f089e6c252f94178f3cfbbbcbbad76

Download Submit
C:\Windows\System\YvNCHsB.exe

Filesize
2.1MB

MD5
1bf7b14a402535aed10ba23617e6171c

SHA1
b1d4e608d559d6653a59513a7fd932076dd46c0a

SHA256
01137ca780386f7eb2f34299588f0dcc6e32aaba1d50df22db28e71ffdafd297

SHA512
d235e80696158d414e533b7110b16c36fec7f8fce35ae26d25427f5bfaa12618bad7b0f2ffc59fc30ab882a2cd86b9962b2611dab268cc9702f09cc1f297c158

Download Submit
C:\Windows\System\bWeVWUY.exe

Filesize
2.1MB

MD5
36002ce36265cbbc74cf70e2f27ba35e

SHA1
d2a1069787f9c02b14e02245b23ac3cb033f80cb

SHA256
44e20a6ded04c9dd72720feb8007ffe46ae45f2e7f58a3affeabde85f89ad593

SHA512
3e5a2e6c3b94c2005a4e7b86d0ff8967d007dd2e9328f4497f08d1743c87e31a2061e8cfb344c8a136bcf55ddaabcd520107118b72373792ef2bb36955007447

Download Submit
C:\Windows\System\cftTXYN.exe

Filesize
2.2MB

MD5
7d4f9fac1d7ad8d654c27de75e054032

SHA1
38580a23e6aef72860ba4db5ea1463735e62a9dc

SHA256
ae10abf0b930751376d44a40b11be023ad226955d503dff5616fb00786325d06

SHA512
d871a138c820468ed40e6cb6db9ac97b62feba3d4dcde270abee08482df99315d2a206cb2575650aa504586c3258bd4af8e322d3522b7bb0e4ca118c22a2bc2b

Download Submit
C:\Windows\System\ddKDSXn.exe

Filesize
2.2MB

MD5
280a21d7ccf5115c50f1c581cf314acb

SHA1
176ab912d4a82e8046c3042f4541717113686a9f

SHA256
73b0f24ca12014cd9a0d9ec3b0f6cd08fb990e792ae20195ef743fef59919ecd

SHA512
f67b884865b8c59878a192e4183beb622b516fcf6ce686cc94e0994672be17e01c3dbae69b6eaf6970606500a3b50a681b1ee42ecfba09a7293f151b5e0c7b80

Download Submit
C:\Windows\System\huCNWVX.exe

Filesize
2.2MB

MD5
68fe1fb600b6a3f93a57c665b92c36ee

SHA1
27e9a53316e1ffeaa8f2f4601e4c220ea410ef76

SHA256
e1d5834a15cd7880f709eb5ba6da6b1bc9536694b12a4e9ad2f901d46e25d44f

SHA512
e4687b7ca6a46f6870433ab27405f11884b34043ac179f52f1e1c7c5fdba8bd35688a84323b0c73734525669ad0be257e91ce015766ee851de587f7807084db4

Download Submit
C:\Windows\System\ihhzwEW.exe

Filesize
2.2MB

MD5
132c9b8978fb1a46f049ff6dcc454328

SHA1
02c1f3a98f591bd2c82ce88c5fbab6e577567e28

SHA256
f61f17396292b583707445e08f30498793591c83e33b8e45b013edccb5e41ee9

SHA512
2a908c53cacbab4d454ae20883afab2a62dbca8f8f00ef67c1621e3ec43f57a0ebc7a6ffe1738a08c2fadb04bf12a503ca2d2f62e7e91fcc8dd44697728df440

Download Submit
C:\Windows\System\ilkowKr.exe

Filesize
2.1MB

MD5
b0811aab2c8b97f30ac8a8652dbf78e4

SHA1
8fc6a01d33b85bdffe04b894b32ad9f16ee9c538

SHA256
6ebf4a3acfa9466dcbee3ebd6f23fecea756e66ad3272b47659b783f3d537a98

SHA512
19e5be2d3becdb1904907fcd4142dc2f178525921492c6236ba9bfb025805cfc035882a336df20035f750fbd8df1b44bb4b595f0ab96036b9d03826474039ae3

Download Submit
C:\Windows\System\jBqXOkK.exe

Filesize
8B

MD5
ce98e4fb0d1b3e55b413072afff0d9b0

SHA1
ea92124ca4b7f582ca9bded1d03be27e59b4ea59

SHA256
ff9bed5abd6e63c0617526102c0f954cef8653d22647e6d0cc15dd6455af1a78

SHA512
b03d5e8e2563e87b69e649ee452bd2c1714db6cee8c57a2d9c80350a9bfea4a14df4deeed12085a7535561f33b8025c13820b94443ecdbd732b098776b2234a9

Download Submit
C:\Windows\System\kCcTXAf.exe

Filesize
2.1MB

MD5
47bb93c695843e20ef5d72aa9a73eedb

SHA1
1b13ba73c6179c5239141309266b1be00ec1d8c2

SHA256
294ffdfd5a568facb04e8be4f39778fc4f32215f8b49ab597a4da6d0d91d8b61

SHA512
39c4dfa01959770ab41de413d1809185fbb9c059d6cdb5ade564854b404d3b80ad216e88e28da998b104dec111aa68af93d8e2ebc2a85bb684dd350e0ab59036

Download Submit
C:\Windows\System\lJYZVmJ.exe

Filesize
2.1MB

MD5
e0daa082941cdf8c024928a5e9b42d50

SHA1
f0d84f844392ca2b50a8014d4fde11ddd3a007fb

SHA256
5ae80d9249da45e70aade5ed84794cad7301b090bf4eae01cc6a89906cd869de

SHA512
4e43bfeed2329180415e390a8ee649b82ab21814bb8f1010191dfe69b04c3f8a499fe702b387de368653890a5943abb463b13da4a3834dfd26ec45fc042d013a

Download Submit
C:\Windows\System\mHlltcH.exe

Filesize
2.1MB

MD5
30817cfe49e65d5aefab9332136304b5

SHA1
dfac8f81ec306b637d8fe9f865208c5d05b905fa

SHA256
ebbb2830aed0d9f07ef783f06bed38e20483eeb1b6f6473de050b49d176191f7

SHA512
f61ef1df9ea7eabf523e1e63d85cc81093f90b46244228766f5556b9b3090fac950d50d4714ce446362f1bdc96f803e64ea9efb7382832a89f8560bca8ce5e5a

Download Submit
C:\Windows\System\qANCEjl.exe

Filesize
2.1MB

MD5
56fb494106a8dca6a2856c695f230c80

SHA1
5528061eb5d01090fd1bfe699d8f03ee404f8487

SHA256
d3f1719d4dda25532931dc731f9d08f0ffab292d63d4d88926df383d898915bb

SHA512
c8533763e970920865eea295df9f7675b3c9c48abeaab22a67129d0e011d708ea894f204eb722475e7871642610547f7601ae827201df022fb130d9652dc2e29

Download Submit
C:\Windows\System\tKRQOdh.exe

Filesize
2.1MB

MD5
bf412a84855d97df771955b55e41d15e

SHA1
09b58930dfecbfddbd43a9048bf0b3d3c623001c

SHA256
66eef7feb7ae7e31d02b26a294c087d8a82f7c9feb28fa4f8a544e6428322ce8

SHA512
decd1777f4d26f9632ac9355848189f14ce0799f171753029f5d228f59bdc4ee29297f14daeb25d915c5624f55cce26390caadb2244c14efbbc89e1dc74a6165

Download Submit
C:\Windows\System\vIexHSr.exe

Filesize
2.2MB

MD5
8640035b8280825e187d263b49264fbc

SHA1
ae98041b548a8ffc19d97400f76d7a936023247e

SHA256
e00a1cbc0d426a693bce37e2c35533775eba24df9374ce0739d8c062b0c92f89

SHA512
ee9541301de7f3976453e6011d25b4a02858bf20abb7f3e799bbe642ba9e1010f4ff33872fd85e7eec4773463262abe224348907f9394e3f776dda174c8a22c6

Download Submit
C:\Windows\System\vQCeEjq.exe

Filesize
2.1MB

MD5
351432b50bb7f67e9e8cafcfb0001b9e

SHA1
245fbc76316e59c36c90221d8e050f579a6643ee

SHA256
3ac9fbdd195a7a7c4a76eb541b6040992bb54434c7a678b3bc545349ee859a66

SHA512
ffd7a3d6246756bd9134c859229b487eacc82b268eb03c40bf8b64cecee6705a216ef972ea333921a88b9abd07c85d36b74ca4e0fc8103d8eda3131e48ed5f21

Download Submit
C:\Windows\System\wtkjCGj.exe

Filesize
2.2MB

MD5
16e4dbafafce2498fa762c11274f4d51

SHA1
49367b87ac076878a6ed4c915660e9464b93c31b

SHA256
b40eb98dc4773cea8033690a927b2958699de7c2bd63c43f407379148531bee3

SHA512
6e93dff87babf3b655eb946af73c7bc9e41f021371098855da24eaec9a1d098ea421d66646511f60c43470c2c8a677c703924d1caafff7b1b7d2f28c61889ce6

Download Submit
C:\Windows\System\xjszjqt.exe

Filesize
2.2MB

MD5
2db00a42c2470a1125cbccb233d8e03d

SHA1
98d11063a4b6b21e562c1d51c6892a671dfe76ca

SHA256
3b87ea839ac313eed81f2b71d077c88624f72edfc8a3bd6a90be92e2a2244e60

SHA512
008ec88586747d9bcdb073052c104f6b6a1a848c80f5e1e57db06336369bf026d7d601f40ea3cfca70f2a9108e74202081e5f673e9ff0bac4fa5f32dd8f10ca4

Download Submit
C:\Windows\System\xkexACw.exe

Filesize
2.1MB

MD5
77e82d0b5d929d84b90aceec34db74d4

SHA1
ee7c28507ce2bf58de82eadac1f4ff2dbabcb4be

SHA256
7e2961b133b0eef35cc9eaa7aef1a732fe1d6174e9cf9398e9d85b29cf0e8457

SHA512
9d7b534b1edd0a3979814a2b46660b871b40d2d7c5be0b85335a6ace53d93d49c64e0b0f01f9eb67571ac27a315bde76f4cb17cdbf1a039ca6d140744fcffc24

Download Submit
C:\Windows\System\xyiDujF.exe

Filesize
2.1MB

MD5
5c2bf557f7ec0b14ede21dfc4e0c8c30

SHA1
78ee2500f5c1eb74345c50969669d80753ed3db7

SHA256
dae3f5b36e400bcf3a07f8fcbecc69a7f4538189e2366fa1c7cd0f36d71e8eb7

SHA512
fb3c60d262aa20fb6405da3b073a9a83008ce69a33d37c5257728ba09976709d9932f4b756280c75fc68460e85f7b057f13459301d1d46abd9b098b56aeaca0d

Download Submit
memory/640-492-0x00007FF7CED00000-0x00007FF7CF0F2000-memory.dmp

Filesize
3.9MB

Download
memory/640-3862-0x00007FF7CED00000-0x00007FF7CF0F2000-memory.dmp

Filesize
3.9MB

Download
memory/796-3872-0x00007FF737DD0000-0x00007FF7381C2000-memory.dmp

Filesize
3.9MB

Download
memory/796-404-0x00007FF737DD0000-0x00007FF7381C2000-memory.dmp

Filesize
3.9MB

Download
memory/864-493-0x00007FF609270000-0x00007FF609662000-memory.dmp

Filesize
3.9MB

Download
memory/864-3858-0x00007FF609270000-0x00007FF609662000-memory.dmp

Filesize
3.9MB

Download
memory/968-470-0x00007FF662E40000-0x00007FF663232000-memory.dmp

Filesize
3.9MB

Download
memory/968-3870-0x00007FF662E40000-0x00007FF663232000-memory.dmp

Filesize
3.9MB

Download
memory/1028-494-0x00007FFCAC613000-0x00007FFCAC615000-memory.dmp

Filesize
8KB

Download
memory/1028-496-0x00007FFCAC610000-0x00007FFCAD0D1000-memory.dmp

Filesize
10.8MB

Download
memory/1028-88-0x000001C671E30000-0x000001C671E40000-memory.dmp

Filesize
64KB

Download
memory/1028-274-0x000001C674560000-0x000001C674582000-memory.dmp

Filesize
136KB

Download
memory/1028-554-0x000001C6752A0000-0x000001C675A46000-memory.dmp

Filesize
7.6MB

Download
memory/1048-254-0x00007FF719210000-0x00007FF719602000-memory.dmp

Filesize
3.9MB

Download
memory/1048-3820-0x00007FF719210000-0x00007FF719602000-memory.dmp

Filesize
3.9MB

Download
memory/1240-3836-0x00007FF6CDB90000-0x00007FF6CDF82000-memory.dmp

Filesize
3.9MB

Download
memory/1240-238-0x00007FF6CDB90000-0x00007FF6CDF82000-memory.dmp

Filesize
3.9MB

Download
memory/2628-3830-0x00007FF719210000-0x00007FF719602000-memory.dmp

Filesize
3.9MB

Download
memory/2628-198-0x00007FF719210000-0x00007FF719602000-memory.dmp

Filesize
3.9MB

Download
memory/2632-495-0x00007FF62AD20000-0x00007FF62B112000-memory.dmp

Filesize
3.9MB

Download
memory/2632-3823-0x00007FF62AD20000-0x00007FF62B112000-memory.dmp

Filesize
3.9MB

Download
memory/2640-227-0x00007FF6B62A0000-0x00007FF6B6692000-memory.dmp

Filesize
3.9MB

Download
memory/2640-3833-0x00007FF6B62A0000-0x00007FF6B6692000-memory.dmp

Filesize
3.9MB

Download
memory/2644-356-0x00007FF780510000-0x00007FF780902000-memory.dmp

Filesize
3.9MB

Download
memory/2644-3865-0x00007FF780510000-0x00007FF780902000-memory.dmp

Filesize
3.9MB

Download
memory/2756-1-0x0000027F56FF0000-0x0000027F57000000-memory.dmp

Filesize
64KB

Download
memory/2756-0-0x00007FF7D67C0000-0x00007FF7D6BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3504-3816-0x00007FF6C9E40000-0x00007FF6CA232000-memory.dmp

Filesize
3.9MB

Download
memory/3504-51-0x00007FF6C9E40000-0x00007FF6CA232000-memory.dmp

Filesize
3.9MB

Download
memory/3640-3827-0x00007FF617D50000-0x00007FF618142000-memory.dmp

Filesize
3.9MB

Download
memory/3640-123-0x00007FF617D50000-0x00007FF618142000-memory.dmp

Filesize
3.9MB

Download
memory/3724-3828-0x00007FF635EE0000-0x00007FF6362D2000-memory.dmp

Filesize
3.9MB

Download
memory/3724-129-0x00007FF635EE0000-0x00007FF6362D2000-memory.dmp

Filesize
3.9MB

Download
memory/3880-490-0x00007FF67BF40000-0x00007FF67C332000-memory.dmp

Filesize
3.9MB

Download
memory/3880-3860-0x00007FF67BF40000-0x00007FF67C332000-memory.dmp

Filesize
3.9MB

Download
memory/3928-11-0x00007FF76D4C0000-0x00007FF76D8B2000-memory.dmp

Filesize
3.9MB

Download
memory/3928-3812-0x00007FF76D4C0000-0x00007FF76D8B2000-memory.dmp

Filesize
3.9MB

Download
memory/4376-237-0x00007FF6E5550000-0x00007FF6E5942000-memory.dmp

Filesize
3.9MB

Download
memory/4376-3838-0x00007FF6E5550000-0x00007FF6E5942000-memory.dmp

Filesize
3.9MB

Download
memory/4408-3818-0x00007FF715560000-0x00007FF715952000-memory.dmp

Filesize
3.9MB

Download
memory/4408-87-0x00007FF715560000-0x00007FF715952000-memory.dmp

Filesize
3.9MB

Download
memory/4432-3856-0x00007FF7A6930000-0x00007FF7A6D22000-memory.dmp

Filesize
3.9MB

Download
memory/4432-489-0x00007FF7A6930000-0x00007FF7A6D22000-memory.dmp

Filesize
3.9MB

Download
memory/4536-321-0x00007FF723320000-0x00007FF723712000-memory.dmp

Filesize
3.9MB

Download
memory/4536-3825-0x00007FF723320000-0x00007FF723712000-memory.dmp

Filesize
3.9MB

Download
memory/4556-3866-0x00007FF781980000-0x00007FF781D72000-memory.dmp

Filesize
3.9MB

Download
memory/4556-469-0x00007FF781980000-0x00007FF781D72000-memory.dmp

Filesize
3.9MB

Download
memory/4836-491-0x00007FF73E880000-0x00007FF73EC72000-memory.dmp

Filesize
3.9MB

Download
memory/4836-3869-0x00007FF73E880000-0x00007FF73EC72000-memory.dmp

Filesize
3.9MB

Download
memory/4896-255-0x00007FF6DF540000-0x00007FF6DF932000-memory.dmp

Filesize
3.9MB

Download
memory/4896-3840-0x00007FF6DF540000-0x00007FF6DF932000-memory.dmp

Filesize
3.9MB

Download
memory/5064-33-0x00007FF752960000-0x00007FF752D52000-memory.dmp

Filesize
3.9MB

Download
memory/5064-3814-0x00007FF752960000-0x00007FF752D52000-memory.dmp

Filesize
3.9MB

Download
memory/5104-528-0x00007FF7B7B40000-0x00007FF7B7F32000-memory.dmp

Filesize
3.9MB

Download
memory/5104-3834-0x00007FF7B7B40000-0x00007FF7B7F32000-memory.dmp

Filesize
3.9MB

Download