xmrig | 48675d93a1ec63f45a322ec14c5e51d0af844a8a9083adf96d7538d756a06dbf

Analysis

max time kernel
118s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8f76af61f99db2a7f62e27cd12860e0N.exe
Size

1.8MB
MD5

c8f76af61f99db2a7f62e27cd12860e0
SHA1

1a13dcff5e396568b74d97f37d81305463ea8f5f
SHA256

48675d93a1ec63f45a322ec14c5e51d0af844a8a9083adf96d7538d756a06dbf
SHA512

9ca9742f12f0c9c8ff5a8cfbde327ac22cd4b066edd8b7bcc28898326681277f346473579bf31546113e6584b2276f1572dec83c5bf703a0f53006a83eff0384
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXY21UD:NABk

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4336-340-0x00007FF62FA40000-0x00007FF62FE32000-memory.dmp	xmrig
behavioral2/memory/3996-352-0x00007FF6F2BA0000-0x00007FF6F2F92000-memory.dmp	xmrig
behavioral2/memory/4064-418-0x00007FF77F3F0000-0x00007FF77F7E2000-memory.dmp	xmrig
behavioral2/memory/4816-422-0x00007FF6BD110000-0x00007FF6BD502000-memory.dmp	xmrig
behavioral2/memory/548-500-0x00007FF677710000-0x00007FF677B02000-memory.dmp	xmrig
behavioral2/memory/2160-532-0x00007FF608330000-0x00007FF608722000-memory.dmp	xmrig
behavioral2/memory/4116-543-0x00007FF6F82A0000-0x00007FF6F8692000-memory.dmp	xmrig
behavioral2/memory/2244-499-0x00007FF7B0C50000-0x00007FF7B1042000-memory.dmp	xmrig
behavioral2/memory/3480-496-0x00007FF61D160000-0x00007FF61D552000-memory.dmp	xmrig
behavioral2/memory/2376-495-0x00007FF7BD580000-0x00007FF7BD972000-memory.dmp	xmrig
behavioral2/memory/1428-469-0x00007FF7B6BC0000-0x00007FF7B6FB2000-memory.dmp	xmrig
behavioral2/memory/3592-468-0x00007FF633030000-0x00007FF633422000-memory.dmp	xmrig
behavioral2/memory/3660-419-0x00007FF670180000-0x00007FF670572000-memory.dmp	xmrig
behavioral2/memory/928-399-0x00007FF774F70000-0x00007FF775362000-memory.dmp	xmrig
behavioral2/memory/5112-339-0x00007FF63D730000-0x00007FF63DB22000-memory.dmp	xmrig
behavioral2/memory/2604-312-0x00007FF7BB5D0000-0x00007FF7BB9C2000-memory.dmp	xmrig
behavioral2/memory/1004-279-0x00007FF731A70000-0x00007FF731E62000-memory.dmp	xmrig
behavioral2/memory/1964-254-0x00007FF60AD90000-0x00007FF60B182000-memory.dmp	xmrig
behavioral2/memory/1480-251-0x00007FF749240000-0x00007FF749632000-memory.dmp	xmrig
behavioral2/memory/2792-205-0x00007FF653A40000-0x00007FF653E32000-memory.dmp	xmrig
behavioral2/memory/1772-182-0x00007FF76DD10000-0x00007FF76E102000-memory.dmp	xmrig
behavioral2/memory/372-140-0x00007FF6E2A10000-0x00007FF6E2E02000-memory.dmp	xmrig
behavioral2/memory/528-3699-0x00007FF662670000-0x00007FF662A62000-memory.dmp	xmrig
behavioral2/memory/2772-3727-0x00007FF6B2FA0000-0x00007FF6B3392000-memory.dmp	xmrig
behavioral2/memory/2772-3732-0x00007FF6B2FA0000-0x00007FF6B3392000-memory.dmp	xmrig
behavioral2/memory/372-3734-0x00007FF6E2A10000-0x00007FF6E2E02000-memory.dmp	xmrig
behavioral2/memory/1772-3736-0x00007FF76DD10000-0x00007FF76E102000-memory.dmp	xmrig
behavioral2/memory/528-3740-0x00007FF662670000-0x00007FF662A62000-memory.dmp	xmrig
behavioral2/memory/2792-3739-0x00007FF653A40000-0x00007FF653E32000-memory.dmp	xmrig
behavioral2/memory/4064-3751-0x00007FF77F3F0000-0x00007FF77F7E2000-memory.dmp	xmrig
behavioral2/memory/1428-3764-0x00007FF7B6BC0000-0x00007FF7B6FB2000-memory.dmp	xmrig
behavioral2/memory/4816-3769-0x00007FF6BD110000-0x00007FF6BD502000-memory.dmp	xmrig
behavioral2/memory/4336-3766-0x00007FF62FA40000-0x00007FF62FE32000-memory.dmp	xmrig
behavioral2/memory/1964-3762-0x00007FF60AD90000-0x00007FF60B182000-memory.dmp	xmrig
behavioral2/memory/3592-3760-0x00007FF633030000-0x00007FF633422000-memory.dmp	xmrig
behavioral2/memory/5112-3755-0x00007FF63D730000-0x00007FF63DB22000-memory.dmp	xmrig
behavioral2/memory/928-3753-0x00007FF774F70000-0x00007FF775362000-memory.dmp	xmrig
behavioral2/memory/1480-3747-0x00007FF749240000-0x00007FF749632000-memory.dmp	xmrig
behavioral2/memory/3996-3743-0x00007FF6F2BA0000-0x00007FF6F2F92000-memory.dmp	xmrig
behavioral2/memory/4116-3759-0x00007FF6F82A0000-0x00007FF6F8692000-memory.dmp	xmrig
behavioral2/memory/1004-3757-0x00007FF731A70000-0x00007FF731E62000-memory.dmp	xmrig
behavioral2/memory/2376-3749-0x00007FF7BD580000-0x00007FF7BD972000-memory.dmp	xmrig
behavioral2/memory/2604-3745-0x00007FF7BB5D0000-0x00007FF7BB9C2000-memory.dmp	xmrig
behavioral2/memory/3480-3790-0x00007FF61D160000-0x00007FF61D552000-memory.dmp	xmrig
behavioral2/memory/2244-3781-0x00007FF7B0C50000-0x00007FF7B1042000-memory.dmp	xmrig
behavioral2/memory/2160-3778-0x00007FF608330000-0x00007FF608722000-memory.dmp	xmrig
behavioral2/memory/548-3775-0x00007FF677710000-0x00007FF677B02000-memory.dmp	xmrig
behavioral2/memory/3660-3783-0x00007FF670180000-0x00007FF670572000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4920	powershell.exe
5	4920	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4920	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
528	UkDekmH.exe
2772	CayQtYu.exe
372	ppRVFOV.exe
1772	Npcfdxr.exe
2792	GkqSJdh.exe
4116	AAmbDPE.exe
1480	atuFiEK.exe
1964	rFkxcyL.exe
1004	uLqAbZT.exe
2604	WTZGMxc.exe
5112	VjxqVkX.exe
4336	yMEUVrA.exe
3996	IygcDWP.exe
928	HILXGZF.exe
4064	gvrWYJy.exe
3660	YWhmdNq.exe
4816	qKCIiNB.exe
3592	xPwxFsp.exe
1428	iUZIQfu.exe
2376	xIxslDW.exe
3480	xdzsGvW.exe
2244	fhDpfSf.exe
548	sJpylQk.exe
2160	lnOnsWA.exe
2416	MLcHgKF.exe
2380	mMXZfey.exe
4948	CozIOLy.exe
2744	COnhSwv.exe
4556	DgZFieI.exe
1408	eEiBzrP.exe
2492	AAnhALn.exe
2332	NuhNbNi.exe
3520	FGGwNDJ.exe
3164	LLlICip.exe
436	AkvYElY.exe
4444	fWBhxeM.exe
1616	NEOXpmp.exe
1356	ZEhhXVY.exe
3820	CHaBykP.exe
3272	EGnqniC.exe
636	gPGXomi.exe
4124	LzVRvRR.exe
1808	NgXiMwq.exe
4180	SkwiIZz.exe
2560	LvvnmzL.exe
2344	uoDoefg.exe
3672	fhvgzsa.exe
2304	kFmanAs.exe
2396	HJPORSq.exe
4012	UAnWfJO.exe
1996	GdKzoag.exe
5116	whWSfHi.exe
4944	OKwwIbv.exe
3756	HovvDVe.exe
4924	QwhKhNf.exe
4956	OVKsPgH.exe
3532	BgZlWLg.exe
2312	QrucPAt.exe
384	eakwVIE.exe
4652	jFaIsSr.exe
972	OtetKqD.exe
3496	YWhTHOU.exe
2696	xibkgMS.exe
4824	jmwDLhL.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4160-0-0x00007FF677A30000-0x00007FF677E22000-memory.dmp	upx
behavioral2/files/0x000a0000000233f8-5.dat	upx
behavioral2/files/0x00070000000233fc-7.dat	upx
behavioral2/files/0x0007000000023400-31.dat	upx
behavioral2/files/0x0007000000023403-71.dat	upx
behavioral2/files/0x000700000002340d-151.dat	upx
behavioral2/files/0x0007000000023417-193.dat	upx
behavioral2/memory/4336-340-0x00007FF62FA40000-0x00007FF62FE32000-memory.dmp	upx
behavioral2/memory/3996-352-0x00007FF6F2BA0000-0x00007FF6F2F92000-memory.dmp	upx
behavioral2/memory/4064-418-0x00007FF77F3F0000-0x00007FF77F7E2000-memory.dmp	upx
behavioral2/memory/4816-422-0x00007FF6BD110000-0x00007FF6BD502000-memory.dmp	upx
behavioral2/memory/548-500-0x00007FF677710000-0x00007FF677B02000-memory.dmp	upx
behavioral2/memory/2160-532-0x00007FF608330000-0x00007FF608722000-memory.dmp	upx
behavioral2/memory/4116-543-0x00007FF6F82A0000-0x00007FF6F8692000-memory.dmp	upx
behavioral2/memory/2244-499-0x00007FF7B0C50000-0x00007FF7B1042000-memory.dmp	upx
behavioral2/memory/3480-496-0x00007FF61D160000-0x00007FF61D552000-memory.dmp	upx
behavioral2/memory/2376-495-0x00007FF7BD580000-0x00007FF7BD972000-memory.dmp	upx
behavioral2/memory/1428-469-0x00007FF7B6BC0000-0x00007FF7B6FB2000-memory.dmp	upx
behavioral2/memory/3592-468-0x00007FF633030000-0x00007FF633422000-memory.dmp	upx
behavioral2/memory/3660-419-0x00007FF670180000-0x00007FF670572000-memory.dmp	upx
behavioral2/memory/928-399-0x00007FF774F70000-0x00007FF775362000-memory.dmp	upx
behavioral2/memory/5112-339-0x00007FF63D730000-0x00007FF63DB22000-memory.dmp	upx
behavioral2/memory/2604-312-0x00007FF7BB5D0000-0x00007FF7BB9C2000-memory.dmp	upx
behavioral2/memory/1004-279-0x00007FF731A70000-0x00007FF731E62000-memory.dmp	upx
behavioral2/memory/1964-254-0x00007FF60AD90000-0x00007FF60B182000-memory.dmp	upx
behavioral2/memory/1480-251-0x00007FF749240000-0x00007FF749632000-memory.dmp	upx
behavioral2/memory/2792-205-0x00007FF653A40000-0x00007FF653E32000-memory.dmp	upx
behavioral2/files/0x0007000000023422-192.dat	upx
behavioral2/files/0x0007000000023421-187.dat	upx
behavioral2/files/0x0007000000023414-184.dat	upx
behavioral2/memory/1772-182-0x00007FF76DD10000-0x00007FF76E102000-memory.dmp	upx
behavioral2/files/0x000700000002341f-178.dat	upx
behavioral2/files/0x000700000002341d-176.dat	upx
behavioral2/files/0x000700000002341c-173.dat	upx
behavioral2/files/0x000700000002341b-172.dat	upx
behavioral2/files/0x0007000000023410-166.dat	upx
behavioral2/files/0x000700000002341a-165.dat	upx
behavioral2/files/0x0007000000023419-161.dat	upx
behavioral2/files/0x000700000002340b-156.dat	upx
behavioral2/files/0x0007000000023416-150.dat	upx
behavioral2/files/0x000700000002340a-148.dat	upx
behavioral2/files/0x0007000000023420-183.dat	upx
behavioral2/memory/372-140-0x00007FF6E2A10000-0x00007FF6E2E02000-memory.dmp	upx
behavioral2/files/0x0007000000023402-132.dat	upx
behavioral2/files/0x0007000000023413-130.dat	upx
behavioral2/files/0x0007000000023412-127.dat	upx
behavioral2/files/0x0007000000023408-126.dat	upx
behavioral2/files/0x000700000002340f-119.dat	upx
behavioral2/files/0x0007000000023405-114.dat	upx
behavioral2/files/0x0007000000023404-113.dat	upx
behavioral2/files/0x000700000002340e-110.dat	upx
behavioral2/files/0x0007000000023415-146.dat	upx
behavioral2/files/0x0007000000023409-141.dat	upx
behavioral2/files/0x000700000002340c-91.dat	upx
behavioral2/files/0x0007000000023411-122.dat	upx
behavioral2/files/0x0007000000023401-81.dat	upx
behavioral2/files/0x00070000000233ff-100.dat	upx
behavioral2/files/0x0007000000023407-88.dat	upx
behavioral2/files/0x0007000000023406-78.dat	upx
behavioral2/files/0x00070000000233fe-47.dat	upx
behavioral2/files/0x00070000000233fd-41.dat	upx
behavioral2/files/0x00080000000233fb-32.dat	upx
behavioral2/memory/2772-23-0x00007FF6B2FA0000-0x00007FF6B3392000-memory.dmp	upx
behavioral2/memory/528-11-0x00007FF662670000-0x00007FF662A62000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\COrfcPo.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\DgZFieI.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\NGeWHcI.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\IOfiCls.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\menOGqI.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\pjQsKOd.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\rFIPadc.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\JXIcEuL.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\sjwoqYZ.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\gPGXomi.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\iqhpCSz.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\qhrlZWE.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\CHaBykP.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\kxZxSKc.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\QsKDnFv.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\srPebHe.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\NupMOhk.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\aGXjUcj.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\QwWboTp.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\jSlHkxM.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\GFxovWt.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\CQolCac.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\HjDdryS.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\qbtEwdx.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\jjNsqMS.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\jFaIsSr.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\HGqIdmU.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\WDRXmEZ.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\HiijuXq.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\ISEBcDj.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\QLGlKDz.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\FLSpLXH.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\jyXbMex.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\iVipmek.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\FdowEGy.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\OSKlraj.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\BYjZtkN.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\OMDHRqq.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\IasHwGI.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\qNnxgPP.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\rDvWfwa.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\FGGwNDJ.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\cdbzjEj.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\dwKRoey.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\RBTGOpf.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\IygcDWP.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\ojJmqsY.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\mRLXNfx.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\ldHnlNI.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\obvHwiG.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\VInzpHc.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\ntJpaOW.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\wuHiWhL.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\cepjooP.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\cghvjkX.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\eXLvBXT.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\bVRVupr.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\olITlPs.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\FzKLnAO.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\kwQkqgT.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\VbNQeyN.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\qxlarcX.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\pONhEdN.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe
File created	C:\Windows\System\nXOGdsP.exe	c8f76af61f99db2a7f62e27cd12860e0N.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4920	powershell.exe
4920	powershell.exe
4920	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeLockMemoryPrivilege	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe
Token: SeLockMemoryPrivilege	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4920	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	84
PID 4160 wrote to memory of 4920	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	84
PID 4160 wrote to memory of 528	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	85
PID 4160 wrote to memory of 528	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	85
PID 4160 wrote to memory of 2772	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	86
PID 4160 wrote to memory of 2772	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	86
PID 4160 wrote to memory of 372	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	87
PID 4160 wrote to memory of 372	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	87
PID 4160 wrote to memory of 1772	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	88
PID 4160 wrote to memory of 1772	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	88
PID 4160 wrote to memory of 2792	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	89
PID 4160 wrote to memory of 2792	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	89
PID 4160 wrote to memory of 1004	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	90
PID 4160 wrote to memory of 1004	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	90
PID 4160 wrote to memory of 4116	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	91
PID 4160 wrote to memory of 4116	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	91
PID 4160 wrote to memory of 1480	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	92
PID 4160 wrote to memory of 1480	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	92
PID 4160 wrote to memory of 1964	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	93
PID 4160 wrote to memory of 1964	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	93
PID 4160 wrote to memory of 2604	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	94
PID 4160 wrote to memory of 2604	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	94
PID 4160 wrote to memory of 5112	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	95
PID 4160 wrote to memory of 5112	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	95
PID 4160 wrote to memory of 4336	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	96
PID 4160 wrote to memory of 4336	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	96
PID 4160 wrote to memory of 3996	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	97
PID 4160 wrote to memory of 3996	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	97
PID 4160 wrote to memory of 928	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	98
PID 4160 wrote to memory of 928	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	98
PID 4160 wrote to memory of 1428	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	99
PID 4160 wrote to memory of 1428	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	99
PID 4160 wrote to memory of 4064	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	100
PID 4160 wrote to memory of 4064	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	100
PID 4160 wrote to memory of 3660	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	101
PID 4160 wrote to memory of 3660	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	101
PID 4160 wrote to memory of 4816	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	102
PID 4160 wrote to memory of 4816	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	102
PID 4160 wrote to memory of 3592	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	103
PID 4160 wrote to memory of 3592	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	103
PID 4160 wrote to memory of 2376	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	104
PID 4160 wrote to memory of 2376	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	104
PID 4160 wrote to memory of 3480	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	105
PID 4160 wrote to memory of 3480	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	105
PID 4160 wrote to memory of 2244	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	106
PID 4160 wrote to memory of 2244	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	106
PID 4160 wrote to memory of 548	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	107
PID 4160 wrote to memory of 548	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	107
PID 4160 wrote to memory of 2160	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	108
PID 4160 wrote to memory of 2160	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	108
PID 4160 wrote to memory of 2416	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	109
PID 4160 wrote to memory of 2416	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	109
PID 4160 wrote to memory of 2380	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	110
PID 4160 wrote to memory of 2380	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	110
PID 4160 wrote to memory of 4948	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	111
PID 4160 wrote to memory of 4948	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	111
PID 4160 wrote to memory of 2744	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	112
PID 4160 wrote to memory of 2744	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	112
PID 4160 wrote to memory of 4556	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	113
PID 4160 wrote to memory of 4556	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	113
PID 4160 wrote to memory of 1408	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	114
PID 4160 wrote to memory of 1408	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	114
PID 4160 wrote to memory of 3272	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	115
PID 4160 wrote to memory of 3272	4160	c8f76af61f99db2a7f62e27cd12860e0N.exe	115

C:\Users\Admin\AppData\Local\Temp\c8f76af61f99db2a7f62e27cd12860e0N.exe
"C:\Users\Admin\AppData\Local\Temp\c8f76af61f99db2a7f62e27cd12860e0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4920
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4920" "2916" "2932" "2964" "0" "0" "2988" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:14040
- C:\Windows\System\UkDekmH.exe
  C:\Windows\System\UkDekmH.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\CayQtYu.exe
  C:\Windows\System\CayQtYu.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\ppRVFOV.exe
  C:\Windows\System\ppRVFOV.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\Npcfdxr.exe
  C:\Windows\System\Npcfdxr.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\GkqSJdh.exe
  C:\Windows\System\GkqSJdh.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\uLqAbZT.exe
  C:\Windows\System\uLqAbZT.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\AAmbDPE.exe
  C:\Windows\System\AAmbDPE.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\atuFiEK.exe
  C:\Windows\System\atuFiEK.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\rFkxcyL.exe
  C:\Windows\System\rFkxcyL.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\WTZGMxc.exe
  C:\Windows\System\WTZGMxc.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\VjxqVkX.exe
  C:\Windows\System\VjxqVkX.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\yMEUVrA.exe
  C:\Windows\System\yMEUVrA.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\IygcDWP.exe
  C:\Windows\System\IygcDWP.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\HILXGZF.exe
  C:\Windows\System\HILXGZF.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\iUZIQfu.exe
  C:\Windows\System\iUZIQfu.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\gvrWYJy.exe
  C:\Windows\System\gvrWYJy.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\YWhmdNq.exe
  C:\Windows\System\YWhmdNq.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\qKCIiNB.exe
  C:\Windows\System\qKCIiNB.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\xPwxFsp.exe
  C:\Windows\System\xPwxFsp.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\xIxslDW.exe
  C:\Windows\System\xIxslDW.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\xdzsGvW.exe
  C:\Windows\System\xdzsGvW.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\fhDpfSf.exe
  C:\Windows\System\fhDpfSf.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\sJpylQk.exe
  C:\Windows\System\sJpylQk.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\lnOnsWA.exe
  C:\Windows\System\lnOnsWA.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\MLcHgKF.exe
  C:\Windows\System\MLcHgKF.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\mMXZfey.exe
  C:\Windows\System\mMXZfey.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\CozIOLy.exe
  C:\Windows\System\CozIOLy.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\COnhSwv.exe
  C:\Windows\System\COnhSwv.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\DgZFieI.exe
  C:\Windows\System\DgZFieI.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\eEiBzrP.exe
  C:\Windows\System\eEiBzrP.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\EGnqniC.exe
  C:\Windows\System\EGnqniC.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\AAnhALn.exe
  C:\Windows\System\AAnhALn.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\NuhNbNi.exe
  C:\Windows\System\NuhNbNi.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\FGGwNDJ.exe
  C:\Windows\System\FGGwNDJ.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\LLlICip.exe
  C:\Windows\System\LLlICip.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\AkvYElY.exe
  C:\Windows\System\AkvYElY.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\uoDoefg.exe
  C:\Windows\System\uoDoefg.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\fWBhxeM.exe
  C:\Windows\System\fWBhxeM.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\NEOXpmp.exe
  C:\Windows\System\NEOXpmp.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\ZEhhXVY.exe
  C:\Windows\System\ZEhhXVY.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\CHaBykP.exe
  C:\Windows\System\CHaBykP.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\gPGXomi.exe
  C:\Windows\System\gPGXomi.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\LzVRvRR.exe
  C:\Windows\System\LzVRvRR.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\NgXiMwq.exe
  C:\Windows\System\NgXiMwq.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\SkwiIZz.exe
  C:\Windows\System\SkwiIZz.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\LvvnmzL.exe
  C:\Windows\System\LvvnmzL.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\fhvgzsa.exe
  C:\Windows\System\fhvgzsa.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\kFmanAs.exe
  C:\Windows\System\kFmanAs.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\HJPORSq.exe
  C:\Windows\System\HJPORSq.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\UAnWfJO.exe
  C:\Windows\System\UAnWfJO.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\GdKzoag.exe
  C:\Windows\System\GdKzoag.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\whWSfHi.exe
  C:\Windows\System\whWSfHi.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\OKwwIbv.exe
  C:\Windows\System\OKwwIbv.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\HovvDVe.exe
  C:\Windows\System\HovvDVe.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\QwhKhNf.exe
  C:\Windows\System\QwhKhNf.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\OVKsPgH.exe
  C:\Windows\System\OVKsPgH.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\BgZlWLg.exe
  C:\Windows\System\BgZlWLg.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\RugnPJp.exe
  C:\Windows\System\RugnPJp.exe
  2⤵
  PID:2328
- C:\Windows\System\QrucPAt.exe
  C:\Windows\System\QrucPAt.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\eakwVIE.exe
  C:\Windows\System\eakwVIE.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\jFaIsSr.exe
  C:\Windows\System\jFaIsSr.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\OtetKqD.exe
  C:\Windows\System\OtetKqD.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\YWhTHOU.exe
  C:\Windows\System\YWhTHOU.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\xibkgMS.exe
  C:\Windows\System\xibkgMS.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\jmwDLhL.exe
  C:\Windows\System\jmwDLhL.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\qbtEwdx.exe
  C:\Windows\System\qbtEwdx.exe
  2⤵
  PID:3680
- C:\Windows\System\qAMyypG.exe
  C:\Windows\System\qAMyypG.exe
  2⤵
  PID:2352
- C:\Windows\System\mpHGfaV.exe
  C:\Windows\System\mpHGfaV.exe
  2⤵
  PID:1440
- C:\Windows\System\NtuASPD.exe
  C:\Windows\System\NtuASPD.exe
  2⤵
  PID:432
- C:\Windows\System\nOyBDQY.exe
  C:\Windows\System\nOyBDQY.exe
  2⤵
  PID:1204
- C:\Windows\System\iwRlXTd.exe
  C:\Windows\System\iwRlXTd.exe
  2⤵
  PID:4608
- C:\Windows\System\PAAVZXJ.exe
  C:\Windows\System\PAAVZXJ.exe
  2⤵
  PID:2040
- C:\Windows\System\hqTelBz.exe
  C:\Windows\System\hqTelBz.exe
  2⤵
  PID:4440
- C:\Windows\System\QlkXtXn.exe
  C:\Windows\System\QlkXtXn.exe
  2⤵
  PID:3400
- C:\Windows\System\wcjmral.exe
  C:\Windows\System\wcjmral.exe
  2⤵
  PID:2448
- C:\Windows\System\VYGhmea.exe
  C:\Windows\System\VYGhmea.exe
  2⤵
  PID:3148
- C:\Windows\System\wUmsBLp.exe
  C:\Windows\System\wUmsBLp.exe
  2⤵
  PID:1336
- C:\Windows\System\WvxXELh.exe
  C:\Windows\System\WvxXELh.exe
  2⤵
  PID:1704
- C:\Windows\System\lNAkkcQ.exe
  C:\Windows\System\lNAkkcQ.exe
  2⤵
  PID:4536
- C:\Windows\System\BOOufSf.exe
  C:\Windows\System\BOOufSf.exe
  2⤵
  PID:872
- C:\Windows\System\WXHuJLy.exe
  C:\Windows\System\WXHuJLy.exe
  2⤵
  PID:2260
- C:\Windows\System\QSlNBxq.exe
  C:\Windows\System\QSlNBxq.exe
  2⤵
  PID:2848
- C:\Windows\System\qmxtfgb.exe
  C:\Windows\System\qmxtfgb.exe
  2⤵
  PID:2952
- C:\Windows\System\rMABYGS.exe
  C:\Windows\System\rMABYGS.exe
  2⤵
  PID:4492
- C:\Windows\System\MAiNXzr.exe
  C:\Windows\System\MAiNXzr.exe
  2⤵
  PID:724
- C:\Windows\System\XFRahwV.exe
  C:\Windows\System\XFRahwV.exe
  2⤵
  PID:4148
- C:\Windows\System\SBycwkK.exe
  C:\Windows\System\SBycwkK.exe
  2⤵
  PID:4876
- C:\Windows\System\clELQwJ.exe
  C:\Windows\System\clELQwJ.exe
  2⤵
  PID:5144
- C:\Windows\System\feFdgAh.exe
  C:\Windows\System\feFdgAh.exe
  2⤵
  PID:5168
- C:\Windows\System\HxenFpJ.exe
  C:\Windows\System\HxenFpJ.exe
  2⤵
  PID:5184
- C:\Windows\System\AoyoBpn.exe
  C:\Windows\System\AoyoBpn.exe
  2⤵
  PID:5208
- C:\Windows\System\VJzmCLa.exe
  C:\Windows\System\VJzmCLa.exe
  2⤵
  PID:5232
- C:\Windows\System\ZpMBsOl.exe
  C:\Windows\System\ZpMBsOl.exe
  2⤵
  PID:5252
- C:\Windows\System\mGOCkpx.exe
  C:\Windows\System\mGOCkpx.exe
  2⤵
  PID:5420
- C:\Windows\System\rUwRJjp.exe
  C:\Windows\System\rUwRJjp.exe
  2⤵
  PID:5548
- C:\Windows\System\GFFAKup.exe
  C:\Windows\System\GFFAKup.exe
  2⤵
  PID:5564
- C:\Windows\System\MPTDvDz.exe
  C:\Windows\System\MPTDvDz.exe
  2⤵
  PID:5580
- C:\Windows\System\zvXSGwn.exe
  C:\Windows\System\zvXSGwn.exe
  2⤵
  PID:5596
- C:\Windows\System\xKWfFth.exe
  C:\Windows\System\xKWfFth.exe
  2⤵
  PID:5612
- C:\Windows\System\CiobIeN.exe
  C:\Windows\System\CiobIeN.exe
  2⤵
  PID:5628
- C:\Windows\System\dvjyAYT.exe
  C:\Windows\System\dvjyAYT.exe
  2⤵
  PID:5644
- C:\Windows\System\ZLLbjcT.exe
  C:\Windows\System\ZLLbjcT.exe
  2⤵
  PID:5680
- C:\Windows\System\dBMIQHD.exe
  C:\Windows\System\dBMIQHD.exe
  2⤵
  PID:5708
- C:\Windows\System\fHYKdAB.exe
  C:\Windows\System\fHYKdAB.exe
  2⤵
  PID:5728
- C:\Windows\System\HPRprcq.exe
  C:\Windows\System\HPRprcq.exe
  2⤵
  PID:5768
- C:\Windows\System\iGlnVzb.exe
  C:\Windows\System\iGlnVzb.exe
  2⤵
  PID:5792
- C:\Windows\System\OxjlNRA.exe
  C:\Windows\System\OxjlNRA.exe
  2⤵
  PID:5812
- C:\Windows\System\rjUiccc.exe
  C:\Windows\System\rjUiccc.exe
  2⤵
  PID:5832
- C:\Windows\System\kJUkNac.exe
  C:\Windows\System\kJUkNac.exe
  2⤵
  PID:5860
- C:\Windows\System\ZSQqEPD.exe
  C:\Windows\System\ZSQqEPD.exe
  2⤵
  PID:5896
- C:\Windows\System\HAIxlpv.exe
  C:\Windows\System\HAIxlpv.exe
  2⤵
  PID:5920
- C:\Windows\System\MxeqzHm.exe
  C:\Windows\System\MxeqzHm.exe
  2⤵
  PID:5940
- C:\Windows\System\lcSfXzP.exe
  C:\Windows\System\lcSfXzP.exe
  2⤵
  PID:5964
- C:\Windows\System\zsoIhtW.exe
  C:\Windows\System\zsoIhtW.exe
  2⤵
  PID:5980
- C:\Windows\System\QAhYYqd.exe
  C:\Windows\System\QAhYYqd.exe
  2⤵
  PID:6004
- C:\Windows\System\GHibXgo.exe
  C:\Windows\System\GHibXgo.exe
  2⤵
  PID:6032
- C:\Windows\System\ROrpNSE.exe
  C:\Windows\System\ROrpNSE.exe
  2⤵
  PID:6052
- C:\Windows\System\PeZVXSB.exe
  C:\Windows\System\PeZVXSB.exe
  2⤵
  PID:4128
- C:\Windows\System\QUJSXJl.exe
  C:\Windows\System\QUJSXJl.exe
  2⤵
  PID:624
- C:\Windows\System\CeOypvT.exe
  C:\Windows\System\CeOypvT.exe
  2⤵
  PID:4368
- C:\Windows\System\GAJmCLY.exe
  C:\Windows\System\GAJmCLY.exe
  2⤵
  PID:1432
- C:\Windows\System\aJEAaWV.exe
  C:\Windows\System\aJEAaWV.exe
  2⤵
  PID:3156
- C:\Windows\System\CNqcjFQ.exe
  C:\Windows\System\CNqcjFQ.exe
  2⤵
  PID:4404
- C:\Windows\System\QRDIEMX.exe
  C:\Windows\System\QRDIEMX.exe
  2⤵
  PID:3152
- C:\Windows\System\iRCiVDi.exe
  C:\Windows\System\iRCiVDi.exe
  2⤵
  PID:4660
- C:\Windows\System\QcmUGRE.exe
  C:\Windows\System\QcmUGRE.exe
  2⤵
  PID:1244
- C:\Windows\System\kbQTXaF.exe
  C:\Windows\System\kbQTXaF.exe
  2⤵
  PID:3796
- C:\Windows\System\mgRijmZ.exe
  C:\Windows\System\mgRijmZ.exe
  2⤵
  PID:4484
- C:\Windows\System\fRChpra.exe
  C:\Windows\System\fRChpra.exe
  2⤵
  PID:3640
- C:\Windows\System\JXkAQyO.exe
  C:\Windows\System\JXkAQyO.exe
  2⤵
  PID:4520
- C:\Windows\System\GiQXzfW.exe
  C:\Windows\System\GiQXzfW.exe
  2⤵
  PID:1556
- C:\Windows\System\PVZblrk.exe
  C:\Windows\System\PVZblrk.exe
  2⤵
  PID:1484
- C:\Windows\System\UeGCZRs.exe
  C:\Windows\System\UeGCZRs.exe
  2⤵
  PID:5140
- C:\Windows\System\NZkbLed.exe
  C:\Windows\System\NZkbLed.exe
  2⤵
  PID:5164
- C:\Windows\System\xNecatC.exe
  C:\Windows\System\xNecatC.exe
  2⤵
  PID:5220
- C:\Windows\System\rmydmmN.exe
  C:\Windows\System\rmydmmN.exe
  2⤵
  PID:5320
- C:\Windows\System\QLYEWia.exe
  C:\Windows\System\QLYEWia.exe
  2⤵
  PID:5408
- C:\Windows\System\itXcnWx.exe
  C:\Windows\System\itXcnWx.exe
  2⤵
  PID:5484
- C:\Windows\System\vjllxZh.exe
  C:\Windows\System\vjllxZh.exe
  2⤵
  PID:6064
- C:\Windows\System\BoFMGIE.exe
  C:\Windows\System\BoFMGIE.exe
  2⤵
  PID:6156
- C:\Windows\System\EgNfEEt.exe
  C:\Windows\System\EgNfEEt.exe
  2⤵
  PID:6184
- C:\Windows\System\bXdxiQR.exe
  C:\Windows\System\bXdxiQR.exe
  2⤵
  PID:6200
- C:\Windows\System\uyqWUFf.exe
  C:\Windows\System\uyqWUFf.exe
  2⤵
  PID:6400
- C:\Windows\System\JvRqfzW.exe
  C:\Windows\System\JvRqfzW.exe
  2⤵
  PID:6428
- C:\Windows\System\xpQUknG.exe
  C:\Windows\System\xpQUknG.exe
  2⤵
  PID:6444
- C:\Windows\System\FhgktBC.exe
  C:\Windows\System\FhgktBC.exe
  2⤵
  PID:6464
- C:\Windows\System\iBWkTkn.exe
  C:\Windows\System\iBWkTkn.exe
  2⤵
  PID:6488
- C:\Windows\System\yhmHFzb.exe
  C:\Windows\System\yhmHFzb.exe
  2⤵
  PID:6516
- C:\Windows\System\DKFCZMx.exe
  C:\Windows\System\DKFCZMx.exe
  2⤵
  PID:6532
- C:\Windows\System\ALZonpC.exe
  C:\Windows\System\ALZonpC.exe
  2⤵
  PID:6548
- C:\Windows\System\yhOgBmE.exe
  C:\Windows\System\yhOgBmE.exe
  2⤵
  PID:6564
- C:\Windows\System\uFuDtPA.exe
  C:\Windows\System\uFuDtPA.exe
  2⤵
  PID:6592
- C:\Windows\System\GmxILml.exe
  C:\Windows\System\GmxILml.exe
  2⤵
  PID:6608
- C:\Windows\System\UlzMJAm.exe
  C:\Windows\System\UlzMJAm.exe
  2⤵
  PID:6628
- C:\Windows\System\NXdAZgv.exe
  C:\Windows\System\NXdAZgv.exe
  2⤵
  PID:6648
- C:\Windows\System\mQZNZIl.exe
  C:\Windows\System\mQZNZIl.exe
  2⤵
  PID:6668
- C:\Windows\System\aUKEzbY.exe
  C:\Windows\System\aUKEzbY.exe
  2⤵
  PID:6752
- C:\Windows\System\fttQoSS.exe
  C:\Windows\System\fttQoSS.exe
  2⤵
  PID:6768
- C:\Windows\System\jzHLyKE.exe
  C:\Windows\System\jzHLyKE.exe
  2⤵
  PID:6784
- C:\Windows\System\OMDHRqq.exe
  C:\Windows\System\OMDHRqq.exe
  2⤵
  PID:6800
- C:\Windows\System\MtSWjAp.exe
  C:\Windows\System\MtSWjAp.exe
  2⤵
  PID:6816
- C:\Windows\System\zGAclBm.exe
  C:\Windows\System\zGAclBm.exe
  2⤵
  PID:6832
- C:\Windows\System\DPIiwUA.exe
  C:\Windows\System\DPIiwUA.exe
  2⤵
  PID:6848
- C:\Windows\System\QpbhDJq.exe
  C:\Windows\System\QpbhDJq.exe
  2⤵
  PID:6864
- C:\Windows\System\SBzIzll.exe
  C:\Windows\System\SBzIzll.exe
  2⤵
  PID:6880
- C:\Windows\System\MsqCImT.exe
  C:\Windows\System\MsqCImT.exe
  2⤵
  PID:6900
- C:\Windows\System\Pecyrno.exe
  C:\Windows\System\Pecyrno.exe
  2⤵
  PID:6916
- C:\Windows\System\VoYgQQl.exe
  C:\Windows\System\VoYgQQl.exe
  2⤵
  PID:6932
- C:\Windows\System\NplfWnm.exe
  C:\Windows\System\NplfWnm.exe
  2⤵
  PID:6948
- C:\Windows\System\snYQQda.exe
  C:\Windows\System\snYQQda.exe
  2⤵
  PID:7000
- C:\Windows\System\UmdkIiG.exe
  C:\Windows\System\UmdkIiG.exe
  2⤵
  PID:7028
- C:\Windows\System\qMqHMfu.exe
  C:\Windows\System\qMqHMfu.exe
  2⤵
  PID:7044
- C:\Windows\System\EppBiAk.exe
  C:\Windows\System\EppBiAk.exe
  2⤵
  PID:7076
- C:\Windows\System\wSTfFRk.exe
  C:\Windows\System\wSTfFRk.exe
  2⤵
  PID:7096
- C:\Windows\System\sneoOhI.exe
  C:\Windows\System\sneoOhI.exe
  2⤵
  PID:7116
- C:\Windows\System\kAhFvGm.exe
  C:\Windows\System\kAhFvGm.exe
  2⤵
  PID:7140
- C:\Windows\System\FonhEjR.exe
  C:\Windows\System\FonhEjR.exe
  2⤵
  PID:5556
- C:\Windows\System\pONhEdN.exe
  C:\Windows\System\pONhEdN.exe
  2⤵
  PID:5588
- C:\Windows\System\uiwhmWQ.exe
  C:\Windows\System\uiwhmWQ.exe
  2⤵
  PID:5636
- C:\Windows\System\NiwOyxn.exe
  C:\Windows\System\NiwOyxn.exe
  2⤵
  PID:5688
- C:\Windows\System\PJnycBI.exe
  C:\Windows\System\PJnycBI.exe
  2⤵
  PID:5724
- C:\Windows\System\pKKbGWl.exe
  C:\Windows\System\pKKbGWl.exe
  2⤵
  PID:5764
- C:\Windows\System\qAIlgZX.exe
  C:\Windows\System\qAIlgZX.exe
  2⤵
  PID:5808
- C:\Windows\System\GyWPcGG.exe
  C:\Windows\System\GyWPcGG.exe
  2⤵
  PID:5868
- C:\Windows\System\klwksJV.exe
  C:\Windows\System\klwksJV.exe
  2⤵
  PID:5908
- C:\Windows\System\OekKebM.exe
  C:\Windows\System\OekKebM.exe
  2⤵
  PID:5932
- C:\Windows\System\GFxovWt.exe
  C:\Windows\System\GFxovWt.exe
  2⤵
  PID:5972
- C:\Windows\System\zxluLnu.exe
  C:\Windows\System\zxluLnu.exe
  2⤵
  PID:796
- C:\Windows\System\hoXGfTo.exe
  C:\Windows\System\hoXGfTo.exe
  2⤵
  PID:2868
- C:\Windows\System\vzTaqvV.exe
  C:\Windows\System\vzTaqvV.exe
  2⤵
  PID:3772
- C:\Windows\System\QgYVlIm.exe
  C:\Windows\System\QgYVlIm.exe
  2⤵
  PID:2732
- C:\Windows\System\HQLFaIH.exe
  C:\Windows\System\HQLFaIH.exe
  2⤵
  PID:640
- C:\Windows\System\AFbxZfi.exe
  C:\Windows\System\AFbxZfi.exe
  2⤵
  PID:5176
- C:\Windows\System\fqjfJTZ.exe
  C:\Windows\System\fqjfJTZ.exe
  2⤵
  PID:5392
- C:\Windows\System\lurMZXY.exe
  C:\Windows\System\lurMZXY.exe
  2⤵
  PID:5500
- C:\Windows\System\iqhpCSz.exe
  C:\Windows\System\iqhpCSz.exe
  2⤵
  PID:6164
- C:\Windows\System\ZwyMIhT.exe
  C:\Windows\System\ZwyMIhT.exe
  2⤵
  PID:6208
- C:\Windows\System\oZUYePf.exe
  C:\Windows\System\oZUYePf.exe
  2⤵
  PID:6360
- C:\Windows\System\CPypkCT.exe
  C:\Windows\System\CPypkCT.exe
  2⤵
  PID:6452
- C:\Windows\System\OmUUsXY.exe
  C:\Windows\System\OmUUsXY.exe
  2⤵
  PID:6616
- C:\Windows\System\YZDtdfe.exe
  C:\Windows\System\YZDtdfe.exe
  2⤵
  PID:6440
- C:\Windows\System\HgaEeCd.exe
  C:\Windows\System\HgaEeCd.exe
  2⤵
  PID:3128
- C:\Windows\System\gBAkFZP.exe
  C:\Windows\System\gBAkFZP.exe
  2⤵
  PID:6540
- C:\Windows\System\zYTEFAm.exe
  C:\Windows\System\zYTEFAm.exe
  2⤵
  PID:6584
- C:\Windows\System\CwfVYCA.exe
  C:\Windows\System\CwfVYCA.exe
  2⤵
  PID:6636
- C:\Windows\System\AUvJSYe.exe
  C:\Windows\System\AUvJSYe.exe
  2⤵
  PID:448
- C:\Windows\System\nzhiyEm.exe
  C:\Windows\System\nzhiyEm.exe
  2⤵
  PID:5904
- C:\Windows\System\cLdBQNI.exe
  C:\Windows\System\cLdBQNI.exe
  2⤵
  PID:5948
- C:\Windows\System\RjaLDSN.exe
  C:\Windows\System\RjaLDSN.exe
  2⤵
  PID:6764
- C:\Windows\System\ZankLqv.exe
  C:\Windows\System\ZankLqv.exe
  2⤵
  PID:7184
- C:\Windows\System\lWbaPBZ.exe
  C:\Windows\System\lWbaPBZ.exe
  2⤵
  PID:7212
- C:\Windows\System\mLtKmKk.exe
  C:\Windows\System\mLtKmKk.exe
  2⤵
  PID:7228
- C:\Windows\System\hHUiAdx.exe
  C:\Windows\System\hHUiAdx.exe
  2⤵
  PID:7252
- C:\Windows\System\LgvXokQ.exe
  C:\Windows\System\LgvXokQ.exe
  2⤵
  PID:7276
- C:\Windows\System\iSfRuea.exe
  C:\Windows\System\iSfRuea.exe
  2⤵
  PID:7292
- C:\Windows\System\igEePSh.exe
  C:\Windows\System\igEePSh.exe
  2⤵
  PID:7320
- C:\Windows\System\zzjxdeS.exe
  C:\Windows\System\zzjxdeS.exe
  2⤵
  PID:7336
- C:\Windows\System\wrvlZIm.exe
  C:\Windows\System\wrvlZIm.exe
  2⤵
  PID:7356
- C:\Windows\System\lVVIqPN.exe
  C:\Windows\System\lVVIqPN.exe
  2⤵
  PID:7380
- C:\Windows\System\IkmmWYQ.exe
  C:\Windows\System\IkmmWYQ.exe
  2⤵
  PID:7396
- C:\Windows\System\uSRGQcN.exe
  C:\Windows\System\uSRGQcN.exe
  2⤵
  PID:7420
- C:\Windows\System\hhdoIFv.exe
  C:\Windows\System\hhdoIFv.exe
  2⤵
  PID:7464
- C:\Windows\System\gvJFqsn.exe
  C:\Windows\System\gvJFqsn.exe
  2⤵
  PID:7484
- C:\Windows\System\iVGNaqp.exe
  C:\Windows\System\iVGNaqp.exe
  2⤵
  PID:7512
- C:\Windows\System\xzcKxfr.exe
  C:\Windows\System\xzcKxfr.exe
  2⤵
  PID:7528
- C:\Windows\System\bUqRpDE.exe
  C:\Windows\System\bUqRpDE.exe
  2⤵
  PID:7548
- C:\Windows\System\UfVBRox.exe
  C:\Windows\System\UfVBRox.exe
  2⤵
  PID:7600
- C:\Windows\System\zdvQSEn.exe
  C:\Windows\System\zdvQSEn.exe
  2⤵
  PID:7624
- C:\Windows\System\rFLiYSB.exe
  C:\Windows\System\rFLiYSB.exe
  2⤵
  PID:7652
- C:\Windows\System\LaHbFKe.exe
  C:\Windows\System\LaHbFKe.exe
  2⤵
  PID:7672
- C:\Windows\System\aUWZYSp.exe
  C:\Windows\System\aUWZYSp.exe
  2⤵
  PID:7688
- C:\Windows\System\RgFlkhL.exe
  C:\Windows\System\RgFlkhL.exe
  2⤵
  PID:7704
- C:\Windows\System\nPbGlRS.exe
  C:\Windows\System\nPbGlRS.exe
  2⤵
  PID:7720
- C:\Windows\System\gHnIcTj.exe
  C:\Windows\System\gHnIcTj.exe
  2⤵
  PID:7744
- C:\Windows\System\RNQKAwp.exe
  C:\Windows\System\RNQKAwp.exe
  2⤵
  PID:7772
- C:\Windows\System\OJTyiVM.exe
  C:\Windows\System\OJTyiVM.exe
  2⤵
  PID:7788
- C:\Windows\System\QcllRCZ.exe
  C:\Windows\System\QcllRCZ.exe
  2⤵
  PID:7816
- C:\Windows\System\MHMaZSQ.exe
  C:\Windows\System\MHMaZSQ.exe
  2⤵
  PID:7832
- C:\Windows\System\bnTgKju.exe
  C:\Windows\System\bnTgKju.exe
  2⤵
  PID:7856
- C:\Windows\System\uRwhtnc.exe
  C:\Windows\System\uRwhtnc.exe
  2⤵
  PID:7880
- C:\Windows\System\GcXxkFT.exe
  C:\Windows\System\GcXxkFT.exe
  2⤵
  PID:7904
- C:\Windows\System\jyXbMex.exe
  C:\Windows\System\jyXbMex.exe
  2⤵
  PID:7932
- C:\Windows\System\fOXBGfS.exe
  C:\Windows\System\fOXBGfS.exe
  2⤵
  PID:7960
- C:\Windows\System\eicXZrG.exe
  C:\Windows\System\eicXZrG.exe
  2⤵
  PID:7980
- C:\Windows\System\pvyyMMp.exe
  C:\Windows\System\pvyyMMp.exe
  2⤵
  PID:8000
- C:\Windows\System\NKFcsBs.exe
  C:\Windows\System\NKFcsBs.exe
  2⤵
  PID:8024
- C:\Windows\System\ledFBzq.exe
  C:\Windows\System\ledFBzq.exe
  2⤵
  PID:8044
- C:\Windows\System\skCIVhe.exe
  C:\Windows\System\skCIVhe.exe
  2⤵
  PID:8064
- C:\Windows\System\POpLCbF.exe
  C:\Windows\System\POpLCbF.exe
  2⤵
  PID:7060
- C:\Windows\System\duMWDKs.exe
  C:\Windows\System\duMWDKs.exe
  2⤵
  PID:5624
- C:\Windows\System\usNUIsP.exe
  C:\Windows\System\usNUIsP.exe
  2⤵
  PID:5700
- C:\Windows\System\UtMdEcB.exe
  C:\Windows\System\UtMdEcB.exe
  2⤵
  PID:5800
- C:\Windows\System\rFIPadc.exe
  C:\Windows\System\rFIPadc.exe
  2⤵
  PID:5852
- C:\Windows\System\wPfVhcz.exe
  C:\Windows\System\wPfVhcz.exe
  2⤵
  PID:5536
- C:\Windows\System\qjuovpn.exe
  C:\Windows\System\qjuovpn.exe
  2⤵
  PID:6344
- C:\Windows\System\CHeXTOP.exe
  C:\Windows\System\CHeXTOP.exe
  2⤵
  PID:6392
- C:\Windows\System\OeaSduu.exe
  C:\Windows\System\OeaSduu.exe
  2⤵
  PID:6560
- C:\Windows\System\YfvCohi.exe
  C:\Windows\System\YfvCohi.exe
  2⤵
  PID:6780
- C:\Windows\System\INWZszf.exe
  C:\Windows\System\INWZszf.exe
  2⤵
  PID:4000
- C:\Windows\System\qgDJKHK.exe
  C:\Windows\System\qgDJKHK.exe
  2⤵
  PID:2420
- C:\Windows\System\hCXVhZA.exe
  C:\Windows\System\hCXVhZA.exe
  2⤵
  PID:4144
- C:\Windows\System\tBvBMyt.exe
  C:\Windows\System\tBvBMyt.exe
  2⤵
  PID:7192
- C:\Windows\System\DmXnQKF.exe
  C:\Windows\System\DmXnQKF.exe
  2⤵
  PID:736
- C:\Windows\System\cFmDubF.exe
  C:\Windows\System\cFmDubF.exe
  2⤵
  PID:3636
- C:\Windows\System\WTtDYyJ.exe
  C:\Windows\System\WTtDYyJ.exe
  2⤵
  PID:5160
- C:\Windows\System\jBxTqzD.exe
  C:\Windows\System\jBxTqzD.exe
  2⤵
  PID:6176
- C:\Windows\System\pimPatn.exe
  C:\Windows\System\pimPatn.exe
  2⤵
  PID:6660
- C:\Windows\System\yVHJvHM.exe
  C:\Windows\System\yVHJvHM.exe
  2⤵
  PID:4592
- C:\Windows\System\DuqAZRI.exe
  C:\Windows\System\DuqAZRI.exe
  2⤵
  PID:7204
- C:\Windows\System\TlfiuHq.exe
  C:\Windows\System\TlfiuHq.exe
  2⤵
  PID:7244
- C:\Windows\System\ymDiMWy.exe
  C:\Windows\System\ymDiMWy.exe
  2⤵
  PID:7288
- C:\Windows\System\HesIikf.exe
  C:\Windows\System\HesIikf.exe
  2⤵
  PID:7344
- C:\Windows\System\WxCAQwp.exe
  C:\Windows\System\WxCAQwp.exe
  2⤵
  PID:7432
- C:\Windows\System\geXGyPP.exe
  C:\Windows\System\geXGyPP.exe
  2⤵
  PID:7492
- C:\Windows\System\DKJBdqK.exe
  C:\Windows\System\DKJBdqK.exe
  2⤵
  PID:7540
- C:\Windows\System\TNqECwd.exe
  C:\Windows\System\TNqECwd.exe
  2⤵
  PID:7592
- C:\Windows\System\yiYuQzc.exe
  C:\Windows\System\yiYuQzc.exe
  2⤵
  PID:7648
- C:\Windows\System\HjDdryS.exe
  C:\Windows\System\HjDdryS.exe
  2⤵
  PID:7700
- C:\Windows\System\owDkhqR.exe
  C:\Windows\System\owDkhqR.exe
  2⤵
  PID:7780
- C:\Windows\System\eaftOaV.exe
  C:\Windows\System\eaftOaV.exe
  2⤵
  PID:7836
- C:\Windows\System\odrzrMf.exe
  C:\Windows\System\odrzrMf.exe
  2⤵
  PID:7896
- C:\Windows\System\uwHCzBP.exe
  C:\Windows\System\uwHCzBP.exe
  2⤵
  PID:7924
- C:\Windows\System\BpFgAQN.exe
  C:\Windows\System\BpFgAQN.exe
  2⤵
  PID:7992
- C:\Windows\System\TgIMrHf.exe
  C:\Windows\System\TgIMrHf.exe
  2⤵
  PID:8040
- C:\Windows\System\iHLlVGM.exe
  C:\Windows\System\iHLlVGM.exe
  2⤵
  PID:704
- C:\Windows\System\oxUSinB.exe
  C:\Windows\System\oxUSinB.exe
  2⤵
  PID:5916
- C:\Windows\System\GfgGtQK.exe
  C:\Windows\System\GfgGtQK.exe
  2⤵
  PID:5028
- C:\Windows\System\JCMnvPC.exe
  C:\Windows\System\JCMnvPC.exe
  2⤵
  PID:3568
- C:\Windows\System\wCQpmSF.exe
  C:\Windows\System\wCQpmSF.exe
  2⤵
  PID:3396
- C:\Windows\System\GZfaamA.exe
  C:\Windows\System\GZfaamA.exe
  2⤵
  PID:4984
- C:\Windows\System\ktuPHlE.exe
  C:\Windows\System\ktuPHlE.exe
  2⤵
  PID:3188
- C:\Windows\System\ndqQDsg.exe
  C:\Windows\System\ndqQDsg.exe
  2⤵
  PID:2960
- C:\Windows\System\HnITxAT.exe
  C:\Windows\System\HnITxAT.exe
  2⤵
  PID:4516
- C:\Windows\System\IZjiYQe.exe
  C:\Windows\System\IZjiYQe.exe
  2⤵
  PID:3240
- C:\Windows\System\eXLvBXT.exe
  C:\Windows\System\eXLvBXT.exe
  2⤵
  PID:4776
- C:\Windows\System\FSFySaf.exe
  C:\Windows\System\FSFySaf.exe
  2⤵
  PID:3256
- C:\Windows\System\DhwXHNt.exe
  C:\Windows\System\DhwXHNt.exe
  2⤵
  PID:4796
- C:\Windows\System\cKjHNCC.exe
  C:\Windows\System\cKjHNCC.exe
  2⤵
  PID:8208
- C:\Windows\System\tXHhSeS.exe
  C:\Windows\System\tXHhSeS.exe
  2⤵
  PID:8232
- C:\Windows\System\zCCmoWu.exe
  C:\Windows\System\zCCmoWu.exe
  2⤵
  PID:8256
- C:\Windows\System\npKJpBJ.exe
  C:\Windows\System\npKJpBJ.exe
  2⤵
  PID:8280
- C:\Windows\System\NtfmVKF.exe
  C:\Windows\System\NtfmVKF.exe
  2⤵
  PID:8340
- C:\Windows\System\SfKmxYn.exe
  C:\Windows\System\SfKmxYn.exe
  2⤵
  PID:8396
- C:\Windows\System\MloEUQl.exe
  C:\Windows\System\MloEUQl.exe
  2⤵
  PID:8416
- C:\Windows\System\DBVPrWx.exe
  C:\Windows\System\DBVPrWx.exe
  2⤵
  PID:8436
- C:\Windows\System\QacHNwc.exe
  C:\Windows\System\QacHNwc.exe
  2⤵
  PID:8452
- C:\Windows\System\DhLFaNN.exe
  C:\Windows\System\DhLFaNN.exe
  2⤵
  PID:8468
- C:\Windows\System\gyPNOlB.exe
  C:\Windows\System\gyPNOlB.exe
  2⤵
  PID:8484
- C:\Windows\System\KjJiwZt.exe
  C:\Windows\System\KjJiwZt.exe
  2⤵
  PID:8500
- C:\Windows\System\RnbKumc.exe
  C:\Windows\System\RnbKumc.exe
  2⤵
  PID:8516
- C:\Windows\System\egnbEnQ.exe
  C:\Windows\System\egnbEnQ.exe
  2⤵
  PID:8536
- C:\Windows\System\Npuhfmt.exe
  C:\Windows\System\Npuhfmt.exe
  2⤵
  PID:8564
- C:\Windows\System\HkoQnLK.exe
  C:\Windows\System\HkoQnLK.exe
  2⤵
  PID:8580
- C:\Windows\System\IEojdFD.exe
  C:\Windows\System\IEojdFD.exe
  2⤵
  PID:8600
- C:\Windows\System\FhYHzeg.exe
  C:\Windows\System\FhYHzeg.exe
  2⤵
  PID:8616
- C:\Windows\System\ORBugwN.exe
  C:\Windows\System\ORBugwN.exe
  2⤵
  PID:8636
- C:\Windows\System\jdEHyne.exe
  C:\Windows\System\jdEHyne.exe
  2⤵
  PID:8656
- C:\Windows\System\RIUdPfk.exe
  C:\Windows\System\RIUdPfk.exe
  2⤵
  PID:8684
- C:\Windows\System\oxOiMVt.exe
  C:\Windows\System\oxOiMVt.exe
  2⤵
  PID:8708
- C:\Windows\System\NRQROxN.exe
  C:\Windows\System\NRQROxN.exe
  2⤵
  PID:8724
- C:\Windows\System\xXvyoLa.exe
  C:\Windows\System\xXvyoLa.exe
  2⤵
  PID:8752
- C:\Windows\System\dnDVHIB.exe
  C:\Windows\System\dnDVHIB.exe
  2⤵
  PID:8768
- C:\Windows\System\tfCNtwh.exe
  C:\Windows\System\tfCNtwh.exe
  2⤵
  PID:8796
- C:\Windows\System\PvjGJXR.exe
  C:\Windows\System\PvjGJXR.exe
  2⤵
  PID:8828
- C:\Windows\System\VibenVb.exe
  C:\Windows\System\VibenVb.exe
  2⤵
  PID:8852
- C:\Windows\System\SeUBVYK.exe
  C:\Windows\System\SeUBVYK.exe
  2⤵
  PID:8880
- C:\Windows\System\RVOEZMP.exe
  C:\Windows\System\RVOEZMP.exe
  2⤵
  PID:8900
- C:\Windows\System\ZXpJSNg.exe
  C:\Windows\System\ZXpJSNg.exe
  2⤵
  PID:8924
- C:\Windows\System\gGoitDx.exe
  C:\Windows\System\gGoitDx.exe
  2⤵
  PID:8940
- C:\Windows\System\uBgrwwj.exe
  C:\Windows\System\uBgrwwj.exe
  2⤵
  PID:8968
- C:\Windows\System\hJhFERu.exe
  C:\Windows\System\hJhFERu.exe
  2⤵
  PID:8992
- C:\Windows\System\qTVdYZG.exe
  C:\Windows\System\qTVdYZG.exe
  2⤵
  PID:9008
- C:\Windows\System\sKReMsT.exe
  C:\Windows\System\sKReMsT.exe
  2⤵
  PID:9024
- C:\Windows\System\zvppdcT.exe
  C:\Windows\System\zvppdcT.exe
  2⤵
  PID:9052
- C:\Windows\System\mQnptyJ.exe
  C:\Windows\System\mQnptyJ.exe
  2⤵
  PID:9076
- C:\Windows\System\crQjaDJ.exe
  C:\Windows\System\crQjaDJ.exe
  2⤵
  PID:9096
- C:\Windows\System\VNBTVAV.exe
  C:\Windows\System\VNBTVAV.exe
  2⤵
  PID:9116
- C:\Windows\System\ORXdKZs.exe
  C:\Windows\System\ORXdKZs.exe
  2⤵
  PID:9132
- C:\Windows\System\dYOzAQo.exe
  C:\Windows\System\dYOzAQo.exe
  2⤵
  PID:9148
- C:\Windows\System\FDCSphu.exe
  C:\Windows\System\FDCSphu.exe
  2⤵
  PID:9164
- C:\Windows\System\PrjaBCM.exe
  C:\Windows\System\PrjaBCM.exe
  2⤵
  PID:9188
- C:\Windows\System\XeVDGCz.exe
  C:\Windows\System\XeVDGCz.exe
  2⤵
  PID:9212
- C:\Windows\System\DihNwcD.exe
  C:\Windows\System\DihNwcD.exe
  2⤵
  PID:5760
- C:\Windows\System\FmRrzTW.exe
  C:\Windows\System\FmRrzTW.exe
  2⤵
  PID:2452
- C:\Windows\System\rLJDHeY.exe
  C:\Windows\System\rLJDHeY.exe
  2⤵
  PID:3100
- C:\Windows\System\MIDiNKP.exe
  C:\Windows\System\MIDiNKP.exe
  2⤵
  PID:4768
- C:\Windows\System\HwArPMb.exe
  C:\Windows\System\HwArPMb.exe
  2⤵
  PID:7668
- C:\Windows\System\LtFUzYK.exe
  C:\Windows\System\LtFUzYK.exe
  2⤵
  PID:2324
- C:\Windows\System\ceaHkMV.exe
  C:\Windows\System\ceaHkMV.exe
  2⤵
  PID:3720
- C:\Windows\System\MGEpswq.exe
  C:\Windows\System\MGEpswq.exe
  2⤵
  PID:1280
- C:\Windows\System\xYlggve.exe
  C:\Windows\System\xYlggve.exe
  2⤵
  PID:2556
- C:\Windows\System\kdXZCtN.exe
  C:\Windows\System\kdXZCtN.exe
  2⤵
  PID:4136
- C:\Windows\System\UtHpvKD.exe
  C:\Windows\System\UtHpvKD.exe
  2⤵
  PID:8408
- C:\Windows\System\EktOMND.exe
  C:\Windows\System\EktOMND.exe
  2⤵
  PID:8428
- C:\Windows\System\nWgtCmN.exe
  C:\Windows\System\nWgtCmN.exe
  2⤵
  PID:5476
- C:\Windows\System\JCjzgkd.exe
  C:\Windows\System\JCjzgkd.exe
  2⤵
  PID:8448
- C:\Windows\System\qZALMHj.exe
  C:\Windows\System\qZALMHj.exe
  2⤵
  PID:6524
- C:\Windows\System\KYZWvla.exe
  C:\Windows\System\KYZWvla.exe
  2⤵
  PID:6760
- C:\Windows\System\LaliAaw.exe
  C:\Windows\System\LaliAaw.exe
  2⤵
  PID:4380
- C:\Windows\System\kTxyMAp.exe
  C:\Windows\System\kTxyMAp.exe
  2⤵
  PID:4752
- C:\Windows\System\cJzBRYZ.exe
  C:\Windows\System\cJzBRYZ.exe
  2⤵
  PID:1768
- C:\Windows\System\ibKmfRn.exe
  C:\Windows\System\ibKmfRn.exe
  2⤵
  PID:5304
- C:\Windows\System\MwKnYNu.exe
  C:\Windows\System\MwKnYNu.exe
  2⤵
  PID:8596
- C:\Windows\System\mkHFpdx.exe
  C:\Windows\System\mkHFpdx.exe
  2⤵
  PID:7264
- C:\Windows\System\CBTNaNj.exe
  C:\Windows\System\CBTNaNj.exe
  2⤵
  PID:8672
- C:\Windows\System\YfEbPYB.exe
  C:\Windows\System\YfEbPYB.exe
  2⤵
  PID:7460
- C:\Windows\System\WBzBzIQ.exe
  C:\Windows\System\WBzBzIQ.exe
  2⤵
  PID:8700
- C:\Windows\System\dIzOQRn.exe
  C:\Windows\System\dIzOQRn.exe
  2⤵
  PID:3892
- C:\Windows\System\iTwbSNb.exe
  C:\Windows\System\iTwbSNb.exe
  2⤵
  PID:8888
- C:\Windows\System\gwuUTWA.exe
  C:\Windows\System\gwuUTWA.exe
  2⤵
  PID:4508
- C:\Windows\System\FLSpLXH.exe
  C:\Windows\System\FLSpLXH.exe
  2⤵
  PID:9044
- C:\Windows\System\zrzQiNU.exe
  C:\Windows\System\zrzQiNU.exe
  2⤵
  PID:8220
- C:\Windows\System\yWlSuSn.exe
  C:\Windows\System\yWlSuSn.exe
  2⤵
  PID:6304
- C:\Windows\System\mYONuSE.exe
  C:\Windows\System\mYONuSE.exe
  2⤵
  PID:7012
- C:\Windows\System\LWcieLD.exe
  C:\Windows\System\LWcieLD.exe
  2⤵
  PID:9124
- C:\Windows\System\WBvNyjJ.exe
  C:\Windows\System\WBvNyjJ.exe
  2⤵
  PID:6456
- C:\Windows\System\hOpLrVf.exe
  C:\Windows\System\hOpLrVf.exe
  2⤵
  PID:9236
- C:\Windows\System\lhdDMwE.exe
  C:\Windows\System\lhdDMwE.exe
  2⤵
  PID:9252
- C:\Windows\System\jyQmHCk.exe
  C:\Windows\System\jyQmHCk.exe
  2⤵
  PID:9268
- C:\Windows\System\MTVFQLA.exe
  C:\Windows\System\MTVFQLA.exe
  2⤵
  PID:9288
- C:\Windows\System\PXdHnqH.exe
  C:\Windows\System\PXdHnqH.exe
  2⤵
  PID:9304
- C:\Windows\System\YRwvopu.exe
  C:\Windows\System\YRwvopu.exe
  2⤵
  PID:9320
- C:\Windows\System\QNBIcnO.exe
  C:\Windows\System\QNBIcnO.exe
  2⤵
  PID:9344
- C:\Windows\System\qtTixld.exe
  C:\Windows\System\qtTixld.exe
  2⤵
  PID:9360
- C:\Windows\System\VdmKCrW.exe
  C:\Windows\System\VdmKCrW.exe
  2⤵
  PID:9384
- C:\Windows\System\JGGbQXW.exe
  C:\Windows\System\JGGbQXW.exe
  2⤵
  PID:9408
- C:\Windows\System\SXBcjie.exe
  C:\Windows\System\SXBcjie.exe
  2⤵
  PID:9428
- C:\Windows\System\hmppPOQ.exe
  C:\Windows\System\hmppPOQ.exe
  2⤵
  PID:9448
- C:\Windows\System\boMumSQ.exe
  C:\Windows\System\boMumSQ.exe
  2⤵
  PID:9476
- C:\Windows\System\tDfKqts.exe
  C:\Windows\System\tDfKqts.exe
  2⤵
  PID:9496
- C:\Windows\System\FswdkBw.exe
  C:\Windows\System\FswdkBw.exe
  2⤵
  PID:9516
- C:\Windows\System\lfjrYTd.exe
  C:\Windows\System\lfjrYTd.exe
  2⤵
  PID:9544
- C:\Windows\System\MyKwyrV.exe
  C:\Windows\System\MyKwyrV.exe
  2⤵
  PID:9560
- C:\Windows\System\QEMeGWh.exe
  C:\Windows\System\QEMeGWh.exe
  2⤵
  PID:9584
- C:\Windows\System\QTkXzzr.exe
  C:\Windows\System\QTkXzzr.exe
  2⤵
  PID:9604
- C:\Windows\System\TWVytFB.exe
  C:\Windows\System\TWVytFB.exe
  2⤵
  PID:9624
- C:\Windows\System\gdsYjQY.exe
  C:\Windows\System\gdsYjQY.exe
  2⤵
  PID:9648
- C:\Windows\System\MRZRzro.exe
  C:\Windows\System\MRZRzro.exe
  2⤵
  PID:9672
- C:\Windows\System\DIBtUJE.exe
  C:\Windows\System\DIBtUJE.exe
  2⤵
  PID:9692
- C:\Windows\System\szHxObM.exe
  C:\Windows\System\szHxObM.exe
  2⤵
  PID:9716
- C:\Windows\System\otuzNGu.exe
  C:\Windows\System\otuzNGu.exe
  2⤵
  PID:9740
- C:\Windows\System\UKqvnbw.exe
  C:\Windows\System\UKqvnbw.exe
  2⤵
  PID:9756
- C:\Windows\System\lRUMUXZ.exe
  C:\Windows\System\lRUMUXZ.exe
  2⤵
  PID:9780
- C:\Windows\System\knnbTFD.exe
  C:\Windows\System\knnbTFD.exe
  2⤵
  PID:9804
- C:\Windows\System\OkjCrhX.exe
  C:\Windows\System\OkjCrhX.exe
  2⤵
  PID:9828
- C:\Windows\System\BqBkVhJ.exe
  C:\Windows\System\BqBkVhJ.exe
  2⤵
  PID:9204
- C:\Windows\System\XRdziIC.exe
  C:\Windows\System\XRdziIC.exe
  2⤵
  PID:5888
- C:\Windows\System\fREJwoe.exe
  C:\Windows\System\fREJwoe.exe
  2⤵
  PID:7620
- C:\Windows\System\HihRKRd.exe
  C:\Windows\System\HihRKRd.exe
  2⤵
  PID:6280
- C:\Windows\System\liwqBIJ.exe
  C:\Windows\System\liwqBIJ.exe
  2⤵
  PID:7808
- C:\Windows\System\RysmPOf.exe
  C:\Windows\System\RysmPOf.exe
  2⤵
  PID:7868
- C:\Windows\System\dTzBTMG.exe
  C:\Windows\System\dTzBTMG.exe
  2⤵
  PID:7976
- C:\Windows\System\OohIIHg.exe
  C:\Windows\System\OohIIHg.exe
  2⤵
  PID:1884
- C:\Windows\System\eUXetrQ.exe
  C:\Windows\System\eUXetrQ.exe
  2⤵
  PID:744
- C:\Windows\System\hydbxJB.exe
  C:\Windows\System\hydbxJB.exe
  2⤵
  PID:7108
- C:\Windows\System\hyueWbW.exe
  C:\Windows\System\hyueWbW.exe
  2⤵
  PID:8268
- C:\Windows\System\lpTaHWN.exe
  C:\Windows\System\lpTaHWN.exe
  2⤵
  PID:6196
- C:\Windows\System\WCzHvQD.exe
  C:\Windows\System\WCzHvQD.exe
  2⤵
  PID:1836
- C:\Windows\System\OCSSqMI.exe
  C:\Windows\System\OCSSqMI.exe
  2⤵
  PID:9156
- C:\Windows\System\obvHwiG.exe
  C:\Windows\System\obvHwiG.exe
  2⤵
  PID:7008
- C:\Windows\System\kFlwjOK.exe
  C:\Windows\System\kFlwjOK.exe
  2⤵
  PID:8576
- C:\Windows\System\GEZcRpS.exe
  C:\Windows\System\GEZcRpS.exe
  2⤵
  PID:9232
- C:\Windows\System\lyiujEa.exe
  C:\Windows\System\lyiujEa.exe
  2⤵
  PID:9300
- C:\Windows\System\KHiGcet.exe
  C:\Windows\System\KHiGcet.exe
  2⤵
  PID:9336
- C:\Windows\System\zZrtVuF.exe
  C:\Windows\System\zZrtVuF.exe
  2⤵
  PID:9376
- C:\Windows\System\YvSxide.exe
  C:\Windows\System\YvSxide.exe
  2⤵
  PID:9504
- C:\Windows\System\zPhgcxY.exe
  C:\Windows\System\zPhgcxY.exe
  2⤵
  PID:8892
- C:\Windows\System\FHLdRST.exe
  C:\Windows\System\FHLdRST.exe
  2⤵
  PID:4436
- C:\Windows\System\TTEFINW.exe
  C:\Windows\System\TTEFINW.exe
  2⤵
  PID:9876
- C:\Windows\System\XBIzotK.exe
  C:\Windows\System\XBIzotK.exe
  2⤵
  PID:10248
- C:\Windows\System\wmCuUqS.exe
  C:\Windows\System\wmCuUqS.exe
  2⤵
  PID:10272
- C:\Windows\System\pBnktYw.exe
  C:\Windows\System\pBnktYw.exe
  2⤵
  PID:10292
- C:\Windows\System\ehmALbJ.exe
  C:\Windows\System\ehmALbJ.exe
  2⤵
  PID:10320
- C:\Windows\System\nogoTFr.exe
  C:\Windows\System\nogoTFr.exe
  2⤵
  PID:10348
- C:\Windows\System\sficGOK.exe
  C:\Windows\System\sficGOK.exe
  2⤵
  PID:10376
- C:\Windows\System\DBWqSQT.exe
  C:\Windows\System\DBWqSQT.exe
  2⤵
  PID:10396
- C:\Windows\System\gsFZFvq.exe
  C:\Windows\System\gsFZFvq.exe
  2⤵
  PID:10424
- C:\Windows\System\RKPbmRI.exe
  C:\Windows\System\RKPbmRI.exe
  2⤵
  PID:10444
- C:\Windows\System\pVEDgFC.exe
  C:\Windows\System\pVEDgFC.exe
  2⤵
  PID:10460
- C:\Windows\System\KrzdOsY.exe
  C:\Windows\System\KrzdOsY.exe
  2⤵
  PID:10476
- C:\Windows\System\jpdsGeE.exe
  C:\Windows\System\jpdsGeE.exe
  2⤵
  PID:10496
- C:\Windows\System\qdNbpwu.exe
  C:\Windows\System\qdNbpwu.exe
  2⤵
  PID:10520
- C:\Windows\System\YZYpEVp.exe
  C:\Windows\System\YZYpEVp.exe
  2⤵
  PID:10548
- C:\Windows\System\MNXpPYU.exe
  C:\Windows\System\MNXpPYU.exe
  2⤵
  PID:10572
- C:\Windows\System\rwKCWhh.exe
  C:\Windows\System\rwKCWhh.exe
  2⤵
  PID:10600
- C:\Windows\System\MTODdKo.exe
  C:\Windows\System\MTODdKo.exe
  2⤵
  PID:10616
- C:\Windows\System\hUuRjko.exe
  C:\Windows\System\hUuRjko.exe
  2⤵
  PID:10648
- C:\Windows\System\voqzNCL.exe
  C:\Windows\System\voqzNCL.exe
  2⤵
  PID:10664
- C:\Windows\System\ebgxsCj.exe
  C:\Windows\System\ebgxsCj.exe
  2⤵
  PID:10688
- C:\Windows\System\rXWJqnt.exe
  C:\Windows\System\rXWJqnt.exe
  2⤵
  PID:10716
- C:\Windows\System\GKxHqcM.exe
  C:\Windows\System\GKxHqcM.exe
  2⤵
  PID:10732
- C:\Windows\System\cGJWNfb.exe
  C:\Windows\System\cGJWNfb.exe
  2⤵
  PID:10756
- C:\Windows\System\lpFHPws.exe
  C:\Windows\System\lpFHPws.exe
  2⤵
  PID:10772
- C:\Windows\System\BKzQNsW.exe
  C:\Windows\System\BKzQNsW.exe
  2⤵
  PID:10800
- C:\Windows\System\exUliQu.exe
  C:\Windows\System\exUliQu.exe
  2⤵
  PID:10820
- C:\Windows\System\xieFuuE.exe
  C:\Windows\System\xieFuuE.exe
  2⤵
  PID:10852
- C:\Windows\System\NmuWSSJ.exe
  C:\Windows\System\NmuWSSJ.exe
  2⤵
  PID:10896
- C:\Windows\System\SxLcSkq.exe
  C:\Windows\System\SxLcSkq.exe
  2⤵
  PID:10916
- C:\Windows\System\ysLoDAl.exe
  C:\Windows\System\ysLoDAl.exe
  2⤵
  PID:10940
- C:\Windows\System\BprBkkP.exe
  C:\Windows\System\BprBkkP.exe
  2⤵
  PID:10964
- C:\Windows\System\vXbpoUz.exe
  C:\Windows\System\vXbpoUz.exe
  2⤵
  PID:10988
- C:\Windows\System\yYQjEFg.exe
  C:\Windows\System\yYQjEFg.exe
  2⤵
  PID:11016
- C:\Windows\System\ZwBLHvc.exe
  C:\Windows\System\ZwBLHvc.exe
  2⤵
  PID:11048
- C:\Windows\System\kyzTUoC.exe
  C:\Windows\System\kyzTUoC.exe
  2⤵
  PID:11072
- C:\Windows\System\VtNFIYC.exe
  C:\Windows\System\VtNFIYC.exe
  2⤵
  PID:11096
- C:\Windows\System\oCGVJzW.exe
  C:\Windows\System\oCGVJzW.exe
  2⤵
  PID:11120
- C:\Windows\System\RYSNRis.exe
  C:\Windows\System\RYSNRis.exe
  2⤵
  PID:11136
- C:\Windows\System\dbzVcjl.exe
  C:\Windows\System\dbzVcjl.exe
  2⤵
  PID:11160
- C:\Windows\System\lSDRbpU.exe
  C:\Windows\System\lSDRbpU.exe
  2⤵
  PID:11180
- C:\Windows\System\QOsyKTL.exe
  C:\Windows\System\QOsyKTL.exe
  2⤵
  PID:11200
- C:\Windows\System\QYoPLcN.exe
  C:\Windows\System\QYoPLcN.exe
  2⤵
  PID:11216
- C:\Windows\System\dDmnOWs.exe
  C:\Windows\System\dDmnOWs.exe
  2⤵
  PID:11240
- C:\Windows\System\stkIlIe.exe
  C:\Windows\System\stkIlIe.exe
  2⤵
  PID:11256
- C:\Windows\System\SflxiKJ.exe
  C:\Windows\System\SflxiKJ.exe
  2⤵
  PID:9112
- C:\Windows\System\SugYlkd.exe
  C:\Windows\System\SugYlkd.exe
  2⤵
  PID:8476
- C:\Windows\System\XxUUNjq.exe
  C:\Windows\System\XxUUNjq.exe
  2⤵
  PID:8648
- C:\Windows\System\yYwdBnV.exe
  C:\Windows\System\yYwdBnV.exe
  2⤵
  PID:8780
- C:\Windows\System\wuIJZpe.exe
  C:\Windows\System\wuIJZpe.exe
  2⤵
  PID:10048
- C:\Windows\System\XAXpONh.exe
  C:\Windows\System\XAXpONh.exe
  2⤵
  PID:5720
- C:\Windows\System\lqMrDpN.exe
  C:\Windows\System\lqMrDpN.exe
  2⤵
  PID:9392
- C:\Windows\System\GGJKxwz.exe
  C:\Windows\System\GGJKxwz.exe
  2⤵
  PID:9440
- C:\Windows\System\SyZOstZ.exe
  C:\Windows\System\SyZOstZ.exe
  2⤵
  PID:10160
- C:\Windows\System\fAzjwex.exe
  C:\Windows\System\fAzjwex.exe
  2⤵
  PID:9528
- C:\Windows\System\otEcvzz.exe
  C:\Windows\System\otEcvzz.exe
  2⤵
  PID:9600
- C:\Windows\System\ubePYqS.exe
  C:\Windows\System\ubePYqS.exe
  2⤵
  PID:9656
- C:\Windows\System\aMjbykK.exe
  C:\Windows\System\aMjbykK.exe
  2⤵
  PID:9748
- C:\Windows\System\UXJhBBQ.exe
  C:\Windows\System\UXJhBBQ.exe
  2⤵
  PID:3536
- C:\Windows\System\vhipFhX.exe
  C:\Windows\System\vhipFhX.exe
  2⤵
  PID:6332
- C:\Windows\System\mhODkmt.exe
  C:\Windows\System\mhODkmt.exe
  2⤵
  PID:4500
- C:\Windows\System\xidECCY.exe
  C:\Windows\System\xidECCY.exe
  2⤵
  PID:8352
- C:\Windows\System\cBwmhpo.exe
  C:\Windows\System\cBwmhpo.exe
  2⤵
  PID:9144
- C:\Windows\System\eGcKYbq.exe
  C:\Windows\System\eGcKYbq.exe
  2⤵
  PID:9316
- C:\Windows\System\DFRYvOU.exe
  C:\Windows\System\DFRYvOU.exe
  2⤵
  PID:11276
- C:\Windows\System\QNhAFsL.exe
  C:\Windows\System\QNhAFsL.exe
  2⤵
  PID:11292
- C:\Windows\System\rJDpVPz.exe
  C:\Windows\System\rJDpVPz.exe
  2⤵
  PID:11312
- C:\Windows\System\pxfyvPP.exe
  C:\Windows\System\pxfyvPP.exe
  2⤵
  PID:11328
- C:\Windows\System\cEOqkYE.exe
  C:\Windows\System\cEOqkYE.exe
  2⤵
  PID:11344
- C:\Windows\System\VzSzcYE.exe
  C:\Windows\System\VzSzcYE.exe
  2⤵
  PID:11360
- C:\Windows\System\tyuzNKg.exe
  C:\Windows\System\tyuzNKg.exe
  2⤵
  PID:11376
- C:\Windows\System\YDzxRRf.exe
  C:\Windows\System\YDzxRRf.exe
  2⤵
  PID:11408
- C:\Windows\System\LoBIpVQ.exe
  C:\Windows\System\LoBIpVQ.exe
  2⤵
  PID:11428
- C:\Windows\System\ANDWteA.exe
  C:\Windows\System\ANDWteA.exe
  2⤵
  PID:11452
- C:\Windows\System\FtlWsxF.exe
  C:\Windows\System\FtlWsxF.exe
  2⤵
  PID:11476
- C:\Windows\System\REYsLiR.exe
  C:\Windows\System\REYsLiR.exe
  2⤵
  PID:11496
- C:\Windows\System\LZqSIqN.exe
  C:\Windows\System\LZqSIqN.exe
  2⤵
  PID:11520
- C:\Windows\System\BjCWqZb.exe
  C:\Windows\System\BjCWqZb.exe
  2⤵
  PID:11540
- C:\Windows\System\taEjKyc.exe
  C:\Windows\System\taEjKyc.exe
  2⤵
  PID:11556
- C:\Windows\System\VfHjtEb.exe
  C:\Windows\System\VfHjtEb.exe
  2⤵
  PID:11588
- C:\Windows\System\twHFltt.exe
  C:\Windows\System\twHFltt.exe
  2⤵
  PID:11608
- C:\Windows\System\tBuAERO.exe
  C:\Windows\System\tBuAERO.exe
  2⤵
  PID:11628
- C:\Windows\System\ntlHGsB.exe
  C:\Windows\System\ntlHGsB.exe
  2⤵
  PID:11652
- C:\Windows\System\XyNIjLo.exe
  C:\Windows\System\XyNIjLo.exe
  2⤵
  PID:11676
- C:\Windows\System\ByTFwzP.exe
  C:\Windows\System\ByTFwzP.exe
  2⤵
  PID:11692
- C:\Windows\System\ZHuKlIz.exe
  C:\Windows\System\ZHuKlIz.exe
  2⤵
  PID:11716
- C:\Windows\System\pDNmRqE.exe
  C:\Windows\System\pDNmRqE.exe
  2⤵
  PID:11736
- C:\Windows\System\FubgJnn.exe
  C:\Windows\System\FubgJnn.exe
  2⤵
  PID:11764
- C:\Windows\System\GZyaYiB.exe
  C:\Windows\System\GZyaYiB.exe
  2⤵
  PID:11780
- C:\Windows\System\ukftcRh.exe
  C:\Windows\System\ukftcRh.exe
  2⤵
  PID:11808
- C:\Windows\System\YVtSLHE.exe
  C:\Windows\System\YVtSLHE.exe
  2⤵
  PID:11832
- C:\Windows\System\YcozdJu.exe
  C:\Windows\System\YcozdJu.exe
  2⤵
  PID:11852
- C:\Windows\System\bnwvBQS.exe
  C:\Windows\System\bnwvBQS.exe
  2⤵
  PID:11876
- C:\Windows\System\OFLnvHQ.exe
  C:\Windows\System\OFLnvHQ.exe
  2⤵
  PID:11896
- C:\Windows\System\bnGFEbi.exe
  C:\Windows\System\bnGFEbi.exe
  2⤵
  PID:11920
- C:\Windows\System\IQgNvGO.exe
  C:\Windows\System\IQgNvGO.exe
  2⤵
  PID:11940
- C:\Windows\System\ZAuaKmo.exe
  C:\Windows\System\ZAuaKmo.exe
  2⤵
  PID:11960
- C:\Windows\System\ZUsXMSV.exe
  C:\Windows\System\ZUsXMSV.exe
  2⤵
  PID:11984
- C:\Windows\System\olITlPs.exe
  C:\Windows\System\olITlPs.exe
  2⤵
  PID:12012
- C:\Windows\System\HDfxPli.exe
  C:\Windows\System\HDfxPli.exe
  2⤵
  PID:12032
- C:\Windows\System\riyAuYK.exe
  C:\Windows\System\riyAuYK.exe
  2⤵
  PID:12052
- C:\Windows\System\kISqEaW.exe
  C:\Windows\System\kISqEaW.exe
  2⤵
  PID:12072
- C:\Windows\System\AzIebCB.exe
  C:\Windows\System\AzIebCB.exe
  2⤵
  PID:12092
- C:\Windows\System\zLhpEnm.exe
  C:\Windows\System\zLhpEnm.exe
  2⤵
  PID:12108
- C:\Windows\System\WwnbYRf.exe
  C:\Windows\System\WwnbYRf.exe
  2⤵
  PID:12128
- C:\Windows\System\pzsWeoG.exe
  C:\Windows\System\pzsWeoG.exe
  2⤵
  PID:12152
- C:\Windows\System\aAUkPdE.exe
  C:\Windows\System\aAUkPdE.exe
  2⤵
  PID:12172
- C:\Windows\System\BrhAGhn.exe
  C:\Windows\System\BrhAGhn.exe
  2⤵
  PID:12196
- C:\Windows\System\qBMJbFH.exe
  C:\Windows\System\qBMJbFH.exe
  2⤵
  PID:12212
- C:\Windows\System\ZrtIgpL.exe
  C:\Windows\System\ZrtIgpL.exe
  2⤵
  PID:12240
- C:\Windows\System\KdZqLTm.exe
  C:\Windows\System\KdZqLTm.exe
  2⤵
  PID:12264
- C:\Windows\System\nIvxqIp.exe
  C:\Windows\System\nIvxqIp.exe
  2⤵
  PID:12284
- C:\Windows\System\KUkuPLZ.exe
  C:\Windows\System\KUkuPLZ.exe
  2⤵
  PID:10256
- C:\Windows\System\YNXBgtM.exe
  C:\Windows\System\YNXBgtM.exe
  2⤵
  PID:10360
- C:\Windows\System\ZDTHyMJ.exe
  C:\Windows\System\ZDTHyMJ.exe
  2⤵
  PID:9948
- C:\Windows\System\NlLzBhH.exe
  C:\Windows\System\NlLzBhH.exe
  2⤵
  PID:5216
- C:\Windows\System\WLamDUq.exe
  C:\Windows\System\WLamDUq.exe
  2⤵
  PID:10456
- C:\Windows\System\hRTudOq.exe
  C:\Windows\System\hRTudOq.exe
  2⤵
  PID:8680
- C:\Windows\System\EZpQmlN.exe
  C:\Windows\System\EZpQmlN.exe
  2⤵
  PID:10512
- C:\Windows\System\kUHzRad.exe
  C:\Windows\System\kUHzRad.exe
  2⤵
  PID:10004
- C:\Windows\System\CMbjyvF.exe
  C:\Windows\System\CMbjyvF.exe
  2⤵
  PID:8196
- C:\Windows\System\nOfxShq.exe
  C:\Windows\System\nOfxShq.exe
  2⤵
  PID:10680
- C:\Windows\System\JImkSlO.exe
  C:\Windows\System\JImkSlO.exe
  2⤵
  PID:10060
- C:\Windows\System\fOrBndg.exe
  C:\Windows\System\fOrBndg.exe
  2⤵
  PID:10768
- C:\Windows\System\OCHaTsO.exe
  C:\Windows\System\OCHaTsO.exe
  2⤵
  PID:10832
- C:\Windows\System\BLpaYDf.exe
  C:\Windows\System\BLpaYDf.exe
  2⤵
  PID:9456
- C:\Windows\System\hVzzayq.exe
  C:\Windows\System\hVzzayq.exe
  2⤵
  PID:9492
- C:\Windows\System\geLZiCM.exe
  C:\Windows\System\geLZiCM.exe
  2⤵
  PID:11084
- C:\Windows\System\LEaHrnA.exe
  C:\Windows\System\LEaHrnA.exe
  2⤵
  PID:11152
- C:\Windows\System\ehZapro.exe
  C:\Windows\System\ehZapro.exe
  2⤵
  PID:9616
- C:\Windows\System\ugPptbZ.exe
  C:\Windows\System\ugPptbZ.exe
  2⤵
  PID:11252
- C:\Windows\System\HELzTKE.exe
  C:\Windows\System\HELzTKE.exe
  2⤵
  PID:9776
- C:\Windows\System\CEoGYfO.exe
  C:\Windows\System\CEoGYfO.exe
  2⤵
  PID:6604
- C:\Windows\System\ahIyFNr.exe
  C:\Windows\System\ahIyFNr.exe
  2⤵
  PID:9840
- C:\Windows\System\JnmGGqM.exe
  C:\Windows\System\JnmGGqM.exe
  2⤵
  PID:7696
- C:\Windows\System\qyyhWNu.exe
  C:\Windows\System\qyyhWNu.exe
  2⤵
  PID:7920
- C:\Windows\System\ojJmqsY.exe
  C:\Windows\System\ojJmqsY.exe
  2⤵
  PID:9552
- C:\Windows\System\VAkempo.exe
  C:\Windows\System\VAkempo.exe
  2⤵
  PID:9708
- C:\Windows\System\CdcyAoI.exe
  C:\Windows\System\CdcyAoI.exe
  2⤵
  PID:8328
- C:\Windows\System\TAFXNNc.exe
  C:\Windows\System\TAFXNNc.exe
  2⤵
  PID:3792
- C:\Windows\System\HlyyigO.exe
  C:\Windows\System\HlyyigO.exe
  2⤵
  PID:5784
- C:\Windows\System\UIbdxrG.exe
  C:\Windows\System\UIbdxrG.exe
  2⤵
  PID:4004
- C:\Windows\System\gmhttXK.exe
  C:\Windows\System\gmhttXK.exe
  2⤵
  PID:12304
- C:\Windows\System\LSdPKnL.exe
  C:\Windows\System\LSdPKnL.exe
  2⤵
  PID:12324
- C:\Windows\System\mLdsmKY.exe
  C:\Windows\System\mLdsmKY.exe
  2⤵
  PID:12344
- C:\Windows\System\nUobnrs.exe
  C:\Windows\System\nUobnrs.exe
  2⤵
  PID:12364
- C:\Windows\System\iaBznCf.exe
  C:\Windows\System\iaBznCf.exe
  2⤵
  PID:12384
- C:\Windows\System\GCYIBou.exe
  C:\Windows\System\GCYIBou.exe
  2⤵
  PID:12404
- C:\Windows\System\IOJXgnk.exe
  C:\Windows\System\IOJXgnk.exe
  2⤵
  PID:12428
- C:\Windows\System\myewRta.exe
  C:\Windows\System\myewRta.exe
  2⤵
  PID:12448
- C:\Windows\System\rYNpXWn.exe
  C:\Windows\System\rYNpXWn.exe
  2⤵
  PID:12472
- C:\Windows\System\SbgkZqS.exe
  C:\Windows\System\SbgkZqS.exe
  2⤵
  PID:12488
- C:\Windows\System\GITObph.exe
  C:\Windows\System\GITObph.exe
  2⤵
  PID:12508
- C:\Windows\System\sQYHNez.exe
  C:\Windows\System\sQYHNez.exe
  2⤵
  PID:12528
- C:\Windows\System\vHZIIfy.exe
  C:\Windows\System\vHZIIfy.exe
  2⤵
  PID:12556
- C:\Windows\System\pMHQaBh.exe
  C:\Windows\System\pMHQaBh.exe
  2⤵
  PID:12576
- C:\Windows\System\CogtrUK.exe
  C:\Windows\System\CogtrUK.exe
  2⤵
  PID:12600
- C:\Windows\System\GcPERzp.exe
  C:\Windows\System\GcPERzp.exe
  2⤵
  PID:12616
- C:\Windows\System\ncimbed.exe
  C:\Windows\System\ncimbed.exe
  2⤵
  PID:12640
- C:\Windows\System\JJGvxaB.exe
  C:\Windows\System\JJGvxaB.exe
  2⤵
  PID:12660
- C:\Windows\System\unhiVnD.exe
  C:\Windows\System\unhiVnD.exe
  2⤵
  PID:12680
- C:\Windows\System\FuHNpAb.exe
  C:\Windows\System\FuHNpAb.exe
  2⤵
  PID:11660
- C:\Windows\System\vQbTsGx.exe
  C:\Windows\System\vQbTsGx.exe
  2⤵
  PID:11684
- C:\Windows\System\hrCYqWM.exe
  C:\Windows\System\hrCYqWM.exe
  2⤵
  PID:10864
- C:\Windows\System\BZjiUuP.exe
  C:\Windows\System\BZjiUuP.exe
  2⤵
  PID:10912
- C:\Windows\System\FZetppr.exe
  C:\Windows\System\FZetppr.exe
  2⤵
  PID:8560
- C:\Windows\System\HrRNgxn.exe
  C:\Windows\System\HrRNgxn.exe
  2⤵
  PID:12296
- C:\Windows\System\BtCLIeg.exe
  C:\Windows\System\BtCLIeg.exe
  2⤵
  PID:12340
- C:\Windows\System\XNkePtl.exe
  C:\Windows\System\XNkePtl.exe
  2⤵
  PID:9844
- C:\Windows\System\BJBmpjN.exe
  C:\Windows\System\BJBmpjN.exe
  2⤵
  PID:11572
- C:\Windows\System\oHzzCyi.exe
  C:\Windows\System\oHzzCyi.exe
  2⤵
  PID:12676
- C:\Windows\System\tEPnVBx.exe
  C:\Windows\System\tEPnVBx.exe
  2⤵
  PID:11748
- C:\Windows\System\cepjooP.exe
  C:\Windows\System\cepjooP.exe
  2⤵
  PID:10608
- C:\Windows\System\DCQaqJj.exe
  C:\Windows\System\DCQaqJj.exe
  2⤵
  PID:2456
- C:\Windows\System\qYZCzqV.exe
  C:\Windows\System\qYZCzqV.exe
  2⤵
  PID:12100
- C:\Windows\System\xTprSnT.exe
  C:\Windows\System\xTprSnT.exe
  2⤵
  PID:10984
- C:\Windows\System\dmlgeGx.exe
  C:\Windows\System\dmlgeGx.exe
  2⤵
  PID:11172
- C:\Windows\System\FGlELBh.exe
  C:\Windows\System\FGlELBh.exe
  2⤵
  PID:10392
- C:\Windows\System\jJwEGSs.exe
  C:\Windows\System\jJwEGSs.exe
  2⤵
  PID:9108
- C:\Windows\System\KnnzeQX.exe
  C:\Windows\System\KnnzeQX.exe
  2⤵
  PID:10752
- C:\Windows\System\PzuXzPw.exe
  C:\Windows\System\PzuXzPw.exe
  2⤵
  PID:12548
- C:\Windows\System\kNgXKmp.exe
  C:\Windows\System\kNgXKmp.exe
  2⤵
  PID:12612
- C:\Windows\System\UKExQpN.exe
  C:\Windows\System\UKExQpN.exe
  2⤵
  PID:11868
- C:\Windows\System\FlxMmOn.exe
  C:\Windows\System\FlxMmOn.exe
  2⤵
  PID:11956
- C:\Windows\System\WIFypqp.exe
  C:\Windows\System\WIFypqp.exe
  2⤵
  PID:12208
- C:\Windows\System\WtvMgkt.exe
  C:\Windows\System\WtvMgkt.exe
  2⤵
  PID:7352
- C:\Windows\System\pcyILNT.exe
  C:\Windows\System\pcyILNT.exe
  2⤵
  PID:10504
- C:\Windows\System\KUGlSnw.exe
  C:\Windows\System\KUGlSnw.exe
  2⤵
  PID:8200
- C:\Windows\System\OEzUKEV.exe
  C:\Windows\System\OEzUKEV.exe
  2⤵
  PID:9580
- C:\Windows\System\eznjcdq.exe
  C:\Windows\System\eznjcdq.exe
  2⤵
  PID:9796
- C:\Windows\System\QjtcNlL.exe
  C:\Windows\System\QjtcNlL.exe
  2⤵
  PID:12936
- C:\Windows\System\IzoFCyI.exe
  C:\Windows\System\IzoFCyI.exe
  2⤵
  PID:12540
- C:\Windows\System\ioImFqz.exe
  C:\Windows\System\ioImFqz.exe
  2⤵
  PID:13276
- C:\Windows\System\eVBlOHz.exe
  C:\Windows\System\eVBlOHz.exe
  2⤵
  PID:11420
- C:\Windows\System\CBzhVfC.exe
  C:\Windows\System\CBzhVfC.exe
  2⤵
  PID:11492
- C:\Windows\System\PzrbWZB.exe
  C:\Windows\System\PzrbWZB.exe
  2⤵
  PID:11620
- C:\Windows\System\srPebHe.exe
  C:\Windows\System\srPebHe.exe
  2⤵
  PID:11772
- C:\Windows\System\iMtcLiW.exe
  C:\Windows\System\iMtcLiW.exe
  2⤵
  PID:10792
- C:\Windows\System\TWxqEIF.exe
  C:\Windows\System\TWxqEIF.exe
  2⤵
  PID:12060
- C:\Windows\System\qIBPAwJ.exe
  C:\Windows\System\qIBPAwJ.exe
  2⤵
  PID:11580
- C:\Windows\System\mYIXwzj.exe
  C:\Windows\System\mYIXwzj.exe
  2⤵
  PID:10312
- C:\Windows\System\UYVCkEY.exe
  C:\Windows\System\UYVCkEY.exe
  2⤵
  PID:13288
- C:\Windows\System\SvNLeRc.exe
  C:\Windows\System\SvNLeRc.exe
  2⤵
  PID:13236
- C:\Windows\System\AokcXxH.exe
  C:\Windows\System\AokcXxH.exe
  2⤵
  PID:7524
- C:\Windows\System\jrfbQUn.exe
  C:\Windows\System\jrfbQUn.exe
  2⤵
  PID:12068
- C:\Windows\System\oMuHHaj.exe
  C:\Windows\System\oMuHHaj.exe
  2⤵
  PID:12088
- C:\Windows\System\zembpWh.exe
  C:\Windows\System\zembpWh.exe
  2⤵
  PID:9356
- C:\Windows\System\TRWDFrv.exe
  C:\Windows\System\TRWDFrv.exe
  2⤵
  PID:10012
- C:\Windows\System\HZQJvIR.exe
  C:\Windows\System\HZQJvIR.exe
  2⤵
  PID:12596
- C:\Windows\System\RoRPHDf.exe
  C:\Windows\System\RoRPHDf.exe
  2⤵
  PID:10656
- C:\Windows\System\rgqJvTr.exe
  C:\Windows\System\rgqJvTr.exe
  2⤵
  PID:10308
- C:\Windows\System\WkxYEZP.exe
  C:\Windows\System\WkxYEZP.exe
  2⤵
  PID:12940
- C:\Windows\System\mEBFOUf.exe
  C:\Windows\System\mEBFOUf.exe
  2⤵
  PID:12632
- C:\Windows\System\eFvzQBl.exe
  C:\Windows\System\eFvzQBl.exe
  2⤵
  PID:10564
- C:\Windows\System\UkXsbPF.exe
  C:\Windows\System\UkXsbPF.exe
  2⤵
  PID:5016
- C:\Windows\System\ANSDxmm.exe
  C:\Windows\System\ANSDxmm.exe
  2⤵
  PID:9772
- C:\Windows\System\wAsdBKD.exe
  C:\Windows\System\wAsdBKD.exe
  2⤵
  PID:13568
- C:\Windows\System\HMmFwgh.exe
  C:\Windows\System\HMmFwgh.exe
  2⤵
  PID:13688
- C:\Windows\System\Hugoeqj.exe
  C:\Windows\System\Hugoeqj.exe
  2⤵
  PID:14084
- C:\Windows\System\GoHSCyZ.exe
  C:\Windows\System\GoHSCyZ.exe
  2⤵
  PID:14112
- C:\Windows\System\FEqaqsL.exe
  C:\Windows\System\FEqaqsL.exe
  2⤵
  PID:12360
- C:\Windows\System\jklDNLC.exe
  C:\Windows\System\jklDNLC.exe
  2⤵
  PID:12440
- C:\Windows\System\JpYeBcE.exe
  C:\Windows\System\JpYeBcE.exe
  2⤵
  PID:11532
- C:\Windows\System\TqPeLYc.exe
  C:\Windows\System\TqPeLYc.exe
  2⤵
  PID:9416
- C:\Windows\System\bBvANEy.exe
  C:\Windows\System\bBvANEy.exe
  2⤵
  PID:13112
- C:\Windows\System\KdClFIK.exe
  C:\Windows\System\KdClFIK.exe
  2⤵
  PID:12416
- C:\Windows\System\iYWgaIQ.exe
  C:\Windows\System\iYWgaIQ.exe
  2⤵
  PID:11752
- C:\Windows\System\vNbAcGz.exe
  C:\Windows\System\vNbAcGz.exe
  2⤵
  PID:11800
- C:\Windows\System\LObwhjQ.exe
  C:\Windows\System\LObwhjQ.exe
  2⤵
  PID:11928
- C:\Windows\System\JZIupoG.exe
  C:\Windows\System\JZIupoG.exe
  2⤵
  PID:12788
- C:\Windows\System\JSHvjvu.exe
  C:\Windows\System\JSHvjvu.exe
  2⤵
  PID:13560
- C:\Windows\System\laqwaXE.exe
  C:\Windows\System\laqwaXE.exe
  2⤵
  PID:13316
- C:\Windows\System\ZCdbKgM.exe
  C:\Windows\System\ZCdbKgM.exe
  2⤵
  PID:13720
- C:\Windows\System\GzvTnyJ.exe
  C:\Windows\System\GzvTnyJ.exe
  2⤵
  PID:13616
- C:\Windows\System\StyhLBw.exe
  C:\Windows\System\StyhLBw.exe
  2⤵
  PID:13380
- C:\Windows\System\ZYHySZk.exe
  C:\Windows\System\ZYHySZk.exe
  2⤵
  PID:13832
- C:\Windows\System\OjiMYBh.exe
  C:\Windows\System\OjiMYBh.exe
  2⤵
  PID:11320
- C:\Windows\System\dtruHup.exe
  C:\Windows\System\dtruHup.exe
  2⤵
  PID:13892
- C:\Windows\System\XAzaYXe.exe
  C:\Windows\System\XAzaYXe.exe
  2⤵
  PID:3380
- C:\Windows\System\lETudQz.exe
  C:\Windows\System\lETudQz.exe
  2⤵
  PID:13800
- C:\Windows\System\xZJzXAH.exe
  C:\Windows\System\xZJzXAH.exe
  2⤵
  PID:12696
- C:\Windows\System\sclxEXS.exe
  C:\Windows\System\sclxEXS.exe
  2⤵
  PID:12456
- C:\Windows\System\ulVvveS.exe
  C:\Windows\System\ulVvveS.exe
  2⤵
  PID:9172
- C:\Windows\System\unygmZO.exe
  C:\Windows\System\unygmZO.exe
  2⤵
  PID:14328
- C:\Windows\System\czKcAyi.exe
  C:\Windows\System\czKcAyi.exe
  2⤵
  PID:10672
- C:\Windows\System\OxJRoAB.exe
  C:\Windows\System\OxJRoAB.exe
  2⤵
  PID:11788
- C:\Windows\System\BBxYKUL.exe
  C:\Windows\System\BBxYKUL.exe
  2⤵
  PID:12796
- C:\Windows\System\nEqpphk.exe
  C:\Windows\System\nEqpphk.exe
  2⤵
  PID:12844
- C:\Windows\System\znQPakA.exe
  C:\Windows\System\znQPakA.exe
  2⤵
  PID:13884
- C:\Windows\System\KQlJWJM.exe
  C:\Windows\System\KQlJWJM.exe
  2⤵
  PID:5656
- C:\Windows\System\bilKAjs.exe
  C:\Windows\System\bilKAjs.exe
  2⤵
  PID:14184
- C:\Windows\System\eFOdAAu.exe
  C:\Windows\System\eFOdAAu.exe
  2⤵
  PID:13860
- C:\Windows\System\SnBIMks.exe
  C:\Windows\System\SnBIMks.exe
  2⤵
  PID:14080
- C:\Windows\System\QpIXkrN.exe
  C:\Windows\System\QpIXkrN.exe
  2⤵
  PID:14240
- C:\Windows\System\efdwyGt.exe
  C:\Windows\System\efdwyGt.exe
  2⤵
  PID:10260
- C:\Windows\System\JsORoZr.exe
  C:\Windows\System\JsORoZr.exe
  2⤵
  PID:10712
- C:\Windows\System\kqIamjr.exe
  C:\Windows\System\kqIamjr.exe
  2⤵
  PID:14220
- C:\Windows\System\FkGYOSv.exe
  C:\Windows\System\FkGYOSv.exe
  2⤵
  PID:13968
- C:\Windows\System\BleWrWh.exe
  C:\Windows\System\BleWrWh.exe
  2⤵
  PID:12700
- C:\Windows\System\TzhTHWr.exe
  C:\Windows\System\TzhTHWr.exe
  2⤵
  PID:13176
- C:\Windows\System\LdYysVC.exe
  C:\Windows\System\LdYysVC.exe
  2⤵
  PID:10952
- C:\Windows\System\DFOFYvv.exe
  C:\Windows\System\DFOFYvv.exe
  2⤵
  PID:9000
- C:\Windows\System\CtBCyOn.exe
  C:\Windows\System\CtBCyOn.exe
  2⤵
  PID:12928
- C:\Windows\System\MVxFwFD.exe
  C:\Windows\System\MVxFwFD.exe
  2⤵
  PID:11340
- C:\Windows\System\zWokrVv.exe
  C:\Windows\System\zWokrVv.exe
  2⤵
  PID:10980
- C:\Windows\System\mWEUbHW.exe
  C:\Windows\System\mWEUbHW.exe
  2⤵
  PID:7732
- C:\Windows\System\hZgZPan.exe
  C:\Windows\System\hZgZPan.exe
  2⤵
  PID:11884
- C:\Windows\System\HduacYu.exe
  C:\Windows\System\HduacYu.exe
  2⤵
  PID:14300
- C:\Windows\System\dwQAzyR.exe
  C:\Windows\System\dwQAzyR.exe
  2⤵
  PID:13320
- C:\Windows\System\OgTUACx.exe
  C:\Windows\System\OgTUACx.exe
  2⤵
  PID:9968
- C:\Windows\System\WRWYlCp.exe
  C:\Windows\System\WRWYlCp.exe
  2⤵
  PID:10096
- C:\Windows\System\FtrEPrz.exe
  C:\Windows\System\FtrEPrz.exe
  2⤵
  PID:12692
- C:\Windows\System\ZVochNR.exe
  C:\Windows\System\ZVochNR.exe
  2⤵
  PID:10744
- C:\Windows\System\oXElYux.exe
  C:\Windows\System\oXElYux.exe
  2⤵
  PID:13912
- C:\Windows\System\sgWraPH.exe
  C:\Windows\System\sgWraPH.exe
  2⤵
  PID:13072
- C:\Windows\System\OWTcbHr.exe
  C:\Windows\System\OWTcbHr.exe
  2⤵
  PID:10684
- C:\Windows\System\ocquOxj.exe
  C:\Windows\System\ocquOxj.exe
  2⤵
  PID:13336
- C:\Windows\System\XEaczkk.exe
  C:\Windows\System\XEaczkk.exe
  2⤵
  PID:2852
- C:\Windows\System\TCGUkXK.exe
  C:\Windows\System\TCGUkXK.exe
  2⤵
  PID:11624
- C:\Windows\System\KTzxiFb.exe
  C:\Windows\System\KTzxiFb.exe
  2⤵
  PID:13528
- C:\Windows\System\eoDfekD.exe
  C:\Windows\System\eoDfekD.exe
  2⤵
  PID:9184
- C:\Windows\System\WPHlhZo.exe
  C:\Windows\System\WPHlhZo.exe
  2⤵
  PID:12764
- C:\Windows\System\KIvLVMF.exe
  C:\Windows\System\KIvLVMF.exe
  2⤵
  PID:7796
- C:\Windows\System\TRgShbB.exe
  C:\Windows\System\TRgShbB.exe
  2⤵
  PID:13396
- C:\Windows\System\VbbHxkn.exe
  C:\Windows\System\VbbHxkn.exe
  2⤵
  PID:13384
- C:\Windows\System\YBYQbYK.exe
  C:\Windows\System\YBYQbYK.exe
  2⤵
  PID:13460
- C:\Windows\System\kynGdnK.exe
  C:\Windows\System\kynGdnK.exe
  2⤵
  PID:11168
- C:\Windows\System\QRLgfsd.exe
  C:\Windows\System\QRLgfsd.exe
  2⤵
  PID:12412
- C:\Windows\System\XGNwIli.exe
  C:\Windows\System\XGNwIli.exe
  2⤵
  PID:13548
- C:\Windows\System\nZxVUrZ.exe
  C:\Windows\System\nZxVUrZ.exe
  2⤵
  PID:12856
- C:\Windows\System\YKNgwmG.exe
  C:\Windows\System\YKNgwmG.exe
  2⤵
  PID:2256
- C:\Windows\System\qTkWmCF.exe
  C:\Windows\System\qTkWmCF.exe
  2⤵
  PID:1916
- C:\Windows\System\UCErvHD.exe
  C:\Windows\System\UCErvHD.exe
  2⤵
  PID:13812
- C:\Windows\System\wKQlCwA.exe
  C:\Windows\System\wKQlCwA.exe
  2⤵
  PID:13716
- C:\Windows\System\FRhCATU.exe
  C:\Windows\System\FRhCATU.exe
  2⤵
  PID:13928
- C:\Windows\System\eTUWmRM.exe
  C:\Windows\System\eTUWmRM.exe
  2⤵
  PID:11108
- C:\Windows\System\qKKaRWG.exe
  C:\Windows\System\qKKaRWG.exe
  2⤵
  PID:13700
- C:\Windows\System\VxLRpvx.exe
  C:\Windows\System\VxLRpvx.exe
  2⤵
  PID:10032
- C:\Windows\System\uJqnBgJ.exe
  C:\Windows\System\uJqnBgJ.exe
  2⤵
  PID:12916
- C:\Windows\System\PTuqNxY.exe
  C:\Windows\System\PTuqNxY.exe
  2⤵
  PID:13552
- C:\Windows\System\QkMLLMC.exe
  C:\Windows\System\QkMLLMC.exe
  2⤵
  PID:13736
- C:\Windows\System\nAjbolY.exe
  C:\Windows\System\nAjbolY.exe
  2⤵
  PID:13684
- C:\Windows\System\VeIhEDz.exe
  C:\Windows\System\VeIhEDz.exe
  2⤵
  PID:14120
- C:\Windows\System\IYVgpxD.exe
  C:\Windows\System\IYVgpxD.exe
  2⤵
  PID:13836
- C:\Windows\System\rUqYcAf.exe
  C:\Windows\System\rUqYcAf.exe
  2⤵
  PID:14124
- C:\Windows\System\LwJzOJX.exe
  C:\Windows\System\LwJzOJX.exe
  2⤵
  PID:13948
- C:\Windows\System\zZmRagr.exe
  C:\Windows\System\zZmRagr.exe
  2⤵
  PID:13392
- C:\Windows\System\CzSuaKX.exe
  C:\Windows\System\CzSuaKX.exe
  2⤵
  PID:14016
- C:\Windows\System\CDJdZLE.exe
  C:\Windows\System\CDJdZLE.exe
  2⤵
  PID:14280
- C:\Windows\System\tnAhaNz.exe
  C:\Windows\System\tnAhaNz.exe
  2⤵
  PID:14324
- C:\Windows\System\ftZWxeP.exe
  C:\Windows\System\ftZWxeP.exe
  2⤵
  PID:12420
- C:\Windows\System\kYCodSl.exe
  C:\Windows\System\kYCodSl.exe
  2⤵
  PID:14128
- C:\Windows\System\hGRKcTq.exe
  C:\Windows\System\hGRKcTq.exe
  2⤵
  PID:10660
- C:\Windows\System\sXCwClR.exe
  C:\Windows\System\sXCwClR.exe
  2⤵
  PID:11724
- C:\Windows\System\AuZKNDe.exe
  C:\Windows\System\AuZKNDe.exe
  2⤵
  PID:11272
- C:\Windows\System\xsFBrcL.exe
  C:\Windows\System\xsFBrcL.exe
  2⤵
  PID:5124
- C:\Windows\System\UDtSuRA.exe
  C:\Windows\System\UDtSuRA.exe
  2⤵
  PID:14320
- C:\Windows\System\PCOOZyn.exe
  C:\Windows\System\PCOOZyn.exe
  2⤵
  PID:14136
- C:\Windows\System\XbAuzaM.exe
  C:\Windows\System\XbAuzaM.exe
  2⤵
  PID:3988
- C:\Windows\System\TAZlnYr.exe
  C:\Windows\System\TAZlnYr.exe
  2⤵
  PID:2724
- C:\Windows\System\Ychdpqb.exe
  C:\Windows\System\Ychdpqb.exe
  2⤵
  PID:8124
- C:\Windows\System\BDRKsuD.exe
  C:\Windows\System\BDRKsuD.exe
  2⤵
  PID:1340
- C:\Windows\System\pOaZWMw.exe
  C:\Windows\System\pOaZWMw.exe
  2⤵
  PID:7064
- C:\Windows\System\tYenVIW.exe
  C:\Windows\System\tYenVIW.exe
  2⤵
  PID:12760
- C:\Windows\System\DIJdvOL.exe
  C:\Windows\System\DIJdvOL.exe
  2⤵
  PID:13888
- C:\Windows\System\tMFwAvH.exe
  C:\Windows\System\tMFwAvH.exe
  2⤵
  PID:13012
- C:\Windows\System\cmbAvqV.exe
  C:\Windows\System\cmbAvqV.exe
  2⤵
  PID:12188
- C:\Windows\System\NtLAPqr.exe
  C:\Windows\System\NtLAPqr.exe
  2⤵
  PID:9920
- C:\Windows\System\mkpEQGQ.exe
  C:\Windows\System\mkpEQGQ.exe
  2⤵
  PID:11820
- C:\Windows\System\MrsHWvk.exe
  C:\Windows\System\MrsHWvk.exe
  2⤵
  PID:2816
- C:\Windows\System\lJqoAIK.exe
  C:\Windows\System\lJqoAIK.exe
  2⤵
  PID:9524
- C:\Windows\System\aGXjUcj.exe
  C:\Windows\System\aGXjUcj.exe
  2⤵
  PID:12352
- C:\Windows\System\yZZJigT.exe
  C:\Windows\System\yZZJigT.exe
  2⤵
  PID:5020
- C:\Windows\System\KjwCsbl.exe
  C:\Windows\System\KjwCsbl.exe
  2⤵
  PID:13824
- C:\Windows\System\TOrjQks.exe
  C:\Windows\System\TOrjQks.exe
  2⤵
  PID:13488
- C:\Windows\System\AxWNeLZ.exe
  C:\Windows\System\AxWNeLZ.exe
  2⤵
  PID:3552
- C:\Windows\System\zqxkMzI.exe
  C:\Windows\System\zqxkMzI.exe
  2⤵
  PID:13596
- C:\Windows\System\cVRfkRr.exe
  C:\Windows\System\cVRfkRr.exe
  2⤵
  PID:13324
- C:\Windows\System\XvSpqWR.exe
  C:\Windows\System\XvSpqWR.exe
  2⤵
  PID:4352
- C:\Windows\System\oEOeyVO.exe
  C:\Windows\System\oEOeyVO.exe
  2⤵
  PID:10488
- C:\Windows\System\wNFoSFl.exe
  C:\Windows\System\wNFoSFl.exe
  2⤵
  PID:13760
- C:\Windows\System\bFQjaDK.exe
  C:\Windows\System\bFQjaDK.exe
  2⤵
  PID:13592
- C:\Windows\System\cfIoavj.exe
  C:\Windows\System\cfIoavj.exe
  2⤵
  PID:13828
- C:\Windows\System\cLXcTyU.exe
  C:\Windows\System\cLXcTyU.exe
  2⤵
  PID:13524
- C:\Windows\System\MypQwmH.exe
  C:\Windows\System\MypQwmH.exe
  2⤵
  PID:13792
- C:\Windows\System\pUOBkGo.exe
  C:\Windows\System\pUOBkGo.exe
  2⤵
  PID:13988
- C:\Windows\System\njBBLuJ.exe
  C:\Windows\System\njBBLuJ.exe
  2⤵
  PID:13976
- C:\Windows\System\JuTknrq.exe
  C:\Windows\System\JuTknrq.exe
  2⤵
  PID:14064
- C:\Windows\System\JHunqyK.exe
  C:\Windows\System\JHunqyK.exe
  2⤵
  PID:9868
- C:\Windows\System\nPODExJ.exe
  C:\Windows\System\nPODExJ.exe
  2⤵
  PID:11528
- C:\Windows\System\WaohAYj.exe
  C:\Windows\System\WaohAYj.exe
  2⤵
  PID:10700
- C:\Windows\System\jQYkohf.exe
  C:\Windows\System\jQYkohf.exe
  2⤵
  PID:14276
- C:\Windows\System\FQQdRFF.exe
  C:\Windows\System\FQQdRFF.exe
  2⤵
  PID:7068
- C:\Windows\System\BMKytIp.exe
  C:\Windows\System\BMKytIp.exe
  2⤵
  PID:8152
- C:\Windows\System\GQMyyRN.exe
  C:\Windows\System\GQMyyRN.exe
  2⤵
  PID:11196
- C:\Windows\System\CTeQmYH.exe
  C:\Windows\System\CTeQmYH.exe
  2⤵
  PID:11128
- C:\Windows\System\VTHHEzO.exe
  C:\Windows\System\VTHHEzO.exe
  2⤵
  PID:11352
- C:\Windows\System\PoESEED.exe
  C:\Windows\System\PoESEED.exe
  2⤵
  PID:10936
- C:\Windows\System\KACYtNn.exe
  C:\Windows\System\KACYtNn.exe
  2⤵
  PID:13440
- C:\Windows\System\aAlUoMt.exe
  C:\Windows\System\aAlUoMt.exe
  2⤵
  PID:10432
- C:\Windows\System\IOfiCls.exe
  C:\Windows\System\IOfiCls.exe
  2⤵
  PID:2408
- C:\Windows\System\vgLZVnJ.exe
  C:\Windows\System\vgLZVnJ.exe
  2⤵
  PID:10872
- C:\Windows\System\WmigcFh.exe
  C:\Windows\System\WmigcFh.exe
  2⤵
  PID:10404
- C:\Windows\System\dhfCKDz.exe
  C:\Windows\System\dhfCKDz.exe
  2⤵
  PID:1532
- C:\Windows\System\zZbqOPg.exe
  C:\Windows\System\zZbqOPg.exe
  2⤵
  PID:12084
- C:\Windows\System\bUwxgVZ.exe
  C:\Windows\System\bUwxgVZ.exe
  2⤵
  PID:14196
- C:\Windows\System\fyjeZhR.exe
  C:\Windows\System\fyjeZhR.exe
  2⤵
  PID:14272
- C:\Windows\System\Aihiuws.exe
  C:\Windows\System\Aihiuws.exe
  2⤵
  PID:14040
- C:\Windows\System\KcRRxCg.exe
  C:\Windows\System\KcRRxCg.exe
  2⤵
  PID:14144
- C:\Windows\System\aWdYiKI.exe
  C:\Windows\System\aWdYiKI.exe
  2⤵
  PID:1184
- C:\Windows\System\wsmyVRl.exe
  C:\Windows\System\wsmyVRl.exe
  2⤵
  PID:1080
- C:\Windows\System\CYOrIph.exe
  C:\Windows\System\CYOrIph.exe
  2⤵
  PID:13144
- C:\Windows\System\SSkUHqH.exe
  C:\Windows\System\SSkUHqH.exe
  2⤵
  PID:1796
- C:\Windows\System\jgliwBN.exe
  C:\Windows\System\jgliwBN.exe
  2⤵
  PID:13624
- C:\Windows\System\nTLNLMC.exe
  C:\Windows\System\nTLNLMC.exe
  2⤵
  PID:12044
- C:\Windows\System\cUizLsr.exe
  C:\Windows\System\cUizLsr.exe
  2⤵
  PID:14160
- C:\Windows\System\yirfWiI.exe
  C:\Windows\System\yirfWiI.exe
  2⤵
  PID:11024
- C:\Windows\System\XDXBbxj.exe
  C:\Windows\System\XDXBbxj.exe
  2⤵
  PID:14224
- C:\Windows\System\CAIkLxJ.exe
  C:\Windows\System\CAIkLxJ.exe
  2⤵
  PID:13036
- C:\Windows\System\CKoTmSU.exe
  C:\Windows\System\CKoTmSU.exe
  2⤵
  PID:2284
- C:\Windows\System\QEfGzgf.exe
  C:\Windows\System\QEfGzgf.exe
  2⤵
  PID:6840
- C:\Windows\System\aZIySen.exe
  C:\Windows\System\aZIySen.exe
  2⤵
  PID:14148
- C:\Windows\System\XTrLFYA.exe
  C:\Windows\System\XTrLFYA.exe
  2⤵
  PID:1664
- C:\Windows\System\RBTGOpf.exe
  C:\Windows\System\RBTGOpf.exe
  2⤵
  PID:4856
- C:\Windows\System\zxSgNuB.exe
  C:\Windows\System\zxSgNuB.exe
  2⤵
  PID:8872
- C:\Windows\System\lrthlko.exe
  C:\Windows\System\lrthlko.exe
  2⤵
  PID:14348
- C:\Windows\System\XgcegYb.exe
  C:\Windows\System\XgcegYb.exe
  2⤵
  PID:14364
- C:\Windows\System\PgKQzaG.exe
  C:\Windows\System\PgKQzaG.exe
  2⤵
  PID:14380
- C:\Windows\System\lXdqeap.exe
  C:\Windows\System\lXdqeap.exe
  2⤵
  PID:14396
- C:\Windows\System\TWffAkJ.exe
  C:\Windows\System\TWffAkJ.exe
  2⤵
  PID:14412
- C:\Windows\System\UKsKGqZ.exe
  C:\Windows\System\UKsKGqZ.exe
  2⤵
  PID:14444
- C:\Windows\System\wmzIZqM.exe
  C:\Windows\System\wmzIZqM.exe
  2⤵
  PID:14460
- C:\Windows\System\oWKsxwf.exe
  C:\Windows\System\oWKsxwf.exe
  2⤵
  PID:14476
- C:\Windows\System\ypZLcuT.exe
  C:\Windows\System\ypZLcuT.exe
  2⤵
  PID:14492
- C:\Windows\System\GtaixMs.exe
  C:\Windows\System\GtaixMs.exe
  2⤵
  PID:14508
- C:\Windows\System\AFFTCov.exe
  C:\Windows\System\AFFTCov.exe
  2⤵
  PID:14528
- C:\Windows\System\vnszIVZ.exe
  C:\Windows\System\vnszIVZ.exe
  2⤵
  PID:14544
- C:\Windows\System\OagaUqa.exe
  C:\Windows\System\OagaUqa.exe
  2⤵
  PID:14568
- C:\Windows\System\oWycpIz.exe
  C:\Windows\System\oWycpIz.exe
  2⤵
  PID:14584
- C:\Windows\System\smSTYCI.exe
  C:\Windows\System\smSTYCI.exe
  2⤵
  PID:14604
- C:\Windows\System\xAwfQnA.exe
  C:\Windows\System\xAwfQnA.exe
  2⤵
  PID:14628
- C:\Windows\System\uytUlAz.exe
  C:\Windows\System\uytUlAz.exe
  2⤵
  PID:14648
- C:\Windows\System\OSKlraj.exe
  C:\Windows\System\OSKlraj.exe
  2⤵
  PID:14676
- C:\Windows\System\AmGbZjr.exe
  C:\Windows\System\AmGbZjr.exe
  2⤵
  PID:14696
- C:\Windows\System\wrvovwF.exe
  C:\Windows\System\wrvovwF.exe
  2⤵
  PID:14724
- C:\Windows\System\SDynhCy.exe
  C:\Windows\System\SDynhCy.exe
  2⤵
  PID:14768
- C:\Windows\System\dgeESgq.exe
  C:\Windows\System\dgeESgq.exe
  2⤵
  PID:14792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pwmcg5ek.u1t.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AAmbDPE.exe

Filesize
1.8MB

MD5
0e92247a443b325c6a4efc35c739d984

SHA1
5a1699e1c073dd1ac8342aa51d8753187a5a4460

SHA256
9295aadb302bfd074acb40d9e964fdf14aaad262cf05e4026b1656af794df4a2

SHA512
57facda68149788729876f924825039d8ae89824e61cf81b0db10a7fbe3d2bfa1fff02b0e32be4319727aa5b6783a7fe69df624c7fa49c1f8664cf9d3bb6c747

Download Submit
C:\Windows\System\AAnhALn.exe

Filesize
1.8MB

MD5
c16df8c0ed6fea25617685d612add16b

SHA1
85b8ff8a204899499a8535e5927c52ecb36f1144

SHA256
d168b150e95a3826e6b223fefb56ba7c90870a6f5632d1099ad7347296bfa4ea

SHA512
05a141c4728d68dd1a2185db0128b2081ef689ec3843bda076e7bc6c44eeef80646a9fc4f94ce46e070e0be47f48247b727b25830d4e4bb2eb8bfbdd623e839a

Download Submit
C:\Windows\System\AkvYElY.exe

Filesize
1.8MB

MD5
652c759ad031f5f2a5223e02f32348d0

SHA1
fe52c4bef6bcf54390f951514e544898d24968db

SHA256
b483fa80ce2f3e24ef92fb77ab75ae79201f2cb169373b2b6ebe32518bf72915

SHA512
389f35936d15f27bcf1b3143c2f1f3a5f4558634354ded7f54e7db13ca5cacd75e447818a73649bf779c00d6711aeffccb3c230f6ae4b44994a53e4e2e1c6b7a

Download Submit
C:\Windows\System\CHaBykP.exe

Filesize
1.8MB

MD5
3745f34e415af650259f49adf2f9504f

SHA1
6576c27caaf94f7f17b3045bfe284a516d6f4ad7

SHA256
5b03debbeb3dab85f433142ae3cb87183ee97b6c3af0c48054070e4753fd95d7

SHA512
0aecf496ece80ce24b04b28cee18a4f00f9c206c42347b9fb0726e1437d88146b5350597a5a7976883b0da5d7b1213003353b20865f487acfff00811df1026a4

Download Submit
C:\Windows\System\COnhSwv.exe

Filesize
1.8MB

MD5
a05ea17b222e48a380f634dc6a6626fa

SHA1
05c229a8a6807d8d8bda8d1988ee49178433145d

SHA256
f9d6148599c1744a49bfe787054f073d81f6db703f215c403f54d612db5b14b1

SHA512
29c3f712b3a30c70e8677f4fbaf0b4e634982e86d1041f572b1a5640be150ba795527b9d24dabc8d839db2add2de00539589ff07c83fe1c685351a8ed840bb30

Download Submit
C:\Windows\System\CayQtYu.exe

Filesize
1.8MB

MD5
904f371ef27fd1f5ae0d82f6aeb86995

SHA1
83b44a067c0112b660b03151af3abd9ae2bf82db

SHA256
8837ee00eec0f85166574cd74caa229a190d6ca7de5b2a6461230b504bc1626b

SHA512
b20a20375b920917150c7bc00497feeb5a7d24c92698965a252bbb9d33b3dbe28d224b3cfed1843aa5c967f9a65a0cf6ba97a26c9109710909eea40fba1eba2b

Download Submit
C:\Windows\System\CozIOLy.exe

Filesize
1.8MB

MD5
f1b7a070c2395a1424278516ebe78f8e

SHA1
93ced1944f30ec2e4d9a15f17e02572a4c98e1a9

SHA256
d87ed984b6d17b1d297ffe07c1ca1adb139f91d1b5a1243c6eca785c3500b280

SHA512
34b1313aa233a5d7ce86447492091fb501d3e40f7875b88f62d2119d012b0df7f5805a0571ce83419141e32cc5757bbe8fdbceb841928a135b38fd1f66a4ee05

Download Submit
C:\Windows\System\DgZFieI.exe

Filesize
1.8MB

MD5
ba8d3fd9ffcfe0c40c8039a43839f8cf

SHA1
ac97ccd24c0bfa928008896bafd2a9f7f711f938

SHA256
83810acd13324936ddc97ec4c39695c2bb8db31f68781a5600ee219e886db42d

SHA512
7d31f2fe1210d90737963a6441c742bf445f2176a2c5430f15ed866aa9136ce5556766223a6d104438f6d53ebf0faad02e96ef48179946d8c26b425a620a913b

Download Submit
C:\Windows\System\FGGwNDJ.exe

Filesize
1.8MB

MD5
bd0d90e502ba72128e61c40f241c889b

SHA1
5336c16887a839aa740dd385c1a691890d2bbb14

SHA256
31ebdb9cd8a3d648d1ec17eb04ca80c99830d46d0fd5bd222ce1201c51ffa2d5

SHA512
fa625d6f22b55fa715db24de435651ee231c64b1130e33ac8e328fa33a63d7f0d1433d8e187763bd5dc43c6c0b0e7c3f1a508488218abc97770add0aff7ccb5f

Download Submit
C:\Windows\System\GkqSJdh.exe

Filesize
1.8MB

MD5
cee6e8f576d9681348cf807e7fdda525

SHA1
9e002675ab6f3af067bae0bed4e26a2f0998c0db

SHA256
0c95c43357d463b23dc781f17a23f5d2769e0088796b48aa6eb0bd35f15f10b7

SHA512
6a384555ea4edf8c2ff241135ef52973775ae60cc68643f2f264ea0c34adab37304b7f8f4e42308289c8294ed3d3cb2a1da0fceb24c54e5c74c636bdbea9b39c

Download Submit
C:\Windows\System\HILXGZF.exe

Filesize
1.8MB

MD5
596fad5c3e0d0161bcab1cc417847055

SHA1
c04c132863d97b75e8b916977b661b5df38b0c29

SHA256
5318b09b2ace76199371b50ac6a50bf7fe0a84f449cc83700128df5ce290849e

SHA512
05ad787b694be49c5ec6eb0317a0a58ffd90d42989499a7cae5b2b11d9c531937686ad3e6c198a019c69c7318708f0e54ba82b4574bdaa36f6e3ce502748dc8e

Download Submit
C:\Windows\System\IygcDWP.exe

Filesize
1.8MB

MD5
24d636771814f9cfcda5b43be3906dc2

SHA1
8650c1b31234a73898fffe8d9c0640be7a0ae286

SHA256
caa579a52190f966371fa682543cfb77c673d5ad49b9e11179cceaf09e9912ef

SHA512
0f250a28526c674ddc7c4b85d4e0400c97f1c48a130541cdfd2ce67d597301bcecea5cd90f0923e9d6265be9afa80bcf6aa597e700b3791f623e07e56d52ec67

Download Submit
C:\Windows\System\LLlICip.exe

Filesize
1.8MB

MD5
3dc42d1c15d8a660fdf5c9007faf4360

SHA1
6a9049c0322a3b4f4f57c7288ae5d71e02c84458

SHA256
04c5d6ac495713bd1725ca3b79b701ccec7b6989942f75fb6ef40456d9c2dbf7

SHA512
5e900457d565e08794109f100a11249046f9b8d47eb8fbb5742157cb7d9c3732bf68ff5b7ed3a7b0b82718f846ccad9e03c51b92ab0e8708d47f206c0c808d22

Download Submit
C:\Windows\System\MLcHgKF.exe

Filesize
1.8MB

MD5
3e6f0dd99276139f1893c0ef491d32c0

SHA1
ac4e9660f80e56b92354a9cd020c90fd98554a98

SHA256
d1285bab9f7c963baa51b03cdc90075284f77a70c90a46a82fe8d3b6140f0b3c

SHA512
e2020875992a6366f10ae8fef1079eed630b4ed8c64f4b7a1ca65e274d7cf547318db3ed537cc77f3605a82d50955c4229ea2d1713af60c4605952129b79ab65

Download Submit
C:\Windows\System\NEOXpmp.exe

Filesize
1.8MB

MD5
0c63af4973006cdff6a8e52d9c6e942a

SHA1
9ae7127e6fc4b5346744eec2c3eec090813030ad

SHA256
999f1477429f640aff891fb79aeddfcbddc8eab54feb677d5f002096cc8f4ab2

SHA512
5158cf8cc469a373a0f1e4d8430bd28da6bc353e5678d88d5fbd47e1f97d5220b281cb21a46dcd0976af49e13b97199e2249ee2588bb920049f20006578a779d

Download Submit
C:\Windows\System\Npcfdxr.exe

Filesize
1.8MB

MD5
89532be0bad6e330fec21373021d6e0a

SHA1
88c089cb55b1a05f4986d187a2903fd8e6bc7b50

SHA256
03834c9f1921a47d7f0929ab6aec836f63d8208966e97f342c6711b06fca4c59

SHA512
6c1e369f57f85654549e7bf10fcfdb078d81dc8c178ed069670a1362297201ca86e1416ea215125f4d5cfe0dbddb9f2d4a0512b08352004abdfe1cbc674df554

Download Submit
C:\Windows\System\NuhNbNi.exe

Filesize
1.8MB

MD5
b200fb2f0586d545af7fc2f8e27eca1d

SHA1
cc2e8fc62b29a066fb0bf2f7aa8b8eb364046c8c

SHA256
409737444733c34789e683b52978feb417145d4a82fb1784b1fbb354c6a40e34

SHA512
e8513b7c16e7896e5ed6213730166bfb5c026d183cdc5d8f58fa5b3cff8f8f5a922e76f62462afcc42809e9abde3f877ea1014915af8098239af34b538a098b6

Download Submit
C:\Windows\System\UkDekmH.exe

Filesize
1.8MB

MD5
f1ee110a43a5a8ef80527b2cdce74bcc

SHA1
ac252e647ecaa6e2e98c441e914487f7c578c37e

SHA256
8cbf992b214cd9325d2dc6b3cf13259af0df7a6aaee898232b29c44c6ae5b222

SHA512
defcc550059da889a594bb3bfcbbcb94a12191e6b7fa32c2ccfaa788a0c224b6bac1da34d608c0f64a9085fa53c5021d93023e95bea5826ddeff4552e9e6236d

Download Submit
C:\Windows\System\VjxqVkX.exe

Filesize
1.8MB

MD5
0e4ea6afe9802603369f66878bec515a

SHA1
7b702596db6562b58b4c5fa430567bceea76f2a7

SHA256
43c46a19807d56825f665e31ee0161af4c583314c7bde017909800be8c71d469

SHA512
082dee21a341a985692923b35a85f80e4b1be7b9f0cb53ddaaa3b74805c81e2fa9edc1359ff07dca3b5b82b6f3a38cc1175a214571c0cbd62be3a164aa7b9fb9

Download Submit
C:\Windows\System\WTZGMxc.exe

Filesize
1.8MB

MD5
cfa3b5add42027b4a7029842703fe7c0

SHA1
105de79e65ec2d21970258f49c61e3cc8fbd6602

SHA256
a0f7e08ea8d102865a4ba38e023cb6a07c931c6fe050d21f44a4628f14205303

SHA512
7431e200b9c3f440e175841d0a21bd9ce708e93f88f76974f0ed25788a754cc67412052fdac5d25810641faba7f87679cb34b273fc55d5f151db083412a3144e

Download Submit
C:\Windows\System\YWhmdNq.exe

Filesize
1.8MB

MD5
fcac2478902c2387ca2e072d0c93c7ca

SHA1
27a07bf6dbebbdeedaad576cadd81ae5681c5c89

SHA256
e166058dd4613a72f65426c315b50b2095bfd791a0e926a6993bd2c71793e626

SHA512
10b279053f2eb89a81d8ab194a1b81185b3d93d99352605934970ba9360c34cc9bdea93a1e53889621d573c13f2b3912ab35e91152f4dcfedb6197700df1c804

Download Submit
C:\Windows\System\ZEhhXVY.exe

Filesize
1.8MB

MD5
f056046ec43fc49fa06f3b9bf8885b75

SHA1
5dc70c2c63e19a504f068bac0fd8861c2d4ff9f0

SHA256
ee6eeb7cc301c9f2e1b5515f09f2b29bcbea28a74f506a8c9d58b8efaccb7505

SHA512
9aaa01a9429a14d3e84a012bc28c066b013cd2da08ab74876317af4db9da0721fb164381aa10a674db8f8e5b4a0e01bbb0d31d90041a679ad455a35ff5a30860

Download Submit
C:\Windows\System\atuFiEK.exe

Filesize
1.8MB

MD5
ce15a6b61fa82bbc21500ab31c879a11

SHA1
3cd0f20eca922230907f12db108a4a55ba35d4b3

SHA256
498ea6bdf984ac5cf661421d59c20fccb5aeffa8aad8f993eb92ad1ea21de341

SHA512
3a161e3dfc984d540c924d2873419a3f365580997b5ebf46e56f3e4fe6d035eab7d5c7417056694dc5fb2904c94318d191e0daecb31cc65a2fc7a6ba4daa5e92

Download Submit
C:\Windows\System\eEiBzrP.exe

Filesize
1.8MB

MD5
d43de63eacf77bcc707c9b26fee01d07

SHA1
bfeb6ea59b65734982acf9500d8734d3387fcba6

SHA256
14c4654396d96a62f991de1161a1fa04a273f37dc83ed888497e03c4d59bcfad

SHA512
a8f99c37a14e3635a4e68a2906c1b8ae0e2ffac8e7d03554b374768722f607af6d651a13b262a9fa4b5cd629d0711fb5280bef4448f1d1fc5e72ae69ac5514de

Download Submit
C:\Windows\System\fWBhxeM.exe

Filesize
1.8MB

MD5
ffe73a63a3bcc1f76a0e6327673100a8

SHA1
d2ffbe58c2e508ea9f2f3928195390ffb2a178f5

SHA256
b805428cd7899e22a858e6af63f3498bc67e8e5c5324dff679f598cf4e61e05c

SHA512
a47621650e77eb24cd8827cdd9b8d0719918159b02dd660879e60052c26bbdfbc9173337c0e619521d6f7eabef6c269fe97639b3aebf4b2ecacb0700522aba56

Download Submit
C:\Windows\System\fhDpfSf.exe

Filesize
1.8MB

MD5
334df1cefa14d7ab9a4447c1cc5ed366

SHA1
da9d3bc5dcc88b35722225d4c2a4086eb7a4ffab

SHA256
68b82b3f6a70ef9f1d1993e3ee0b80906377568cedf5223c5dddcc52f0b046a8

SHA512
7350b5cfcaf2bb325d09255427b6f50d4e4c47c4152062e6e0333a7eaa733f8cf9295c2c423a0dec5c955e89b5b21317a658035c23bf8bed1df8e333a0b187d6

Download Submit
C:\Windows\System\gvrWYJy.exe

Filesize
1.8MB

MD5
ae8a13f2833bc80fcef946c7b15f46ee

SHA1
d76ff6fe2f2d6a7787419f7846f7979858223edf

SHA256
be953aaf4e29059e9d9c50f5435950d5b77ecaade6af918e3a2c0d061c88e83f

SHA512
bf1a537d566cbd4473202ebebd7fa640b393482729a31b3b89446e9aa6c4d9c38cbbb9a3a1dfb8c3812a4a691edc85d1487a6d1d80ec0747d2ba3115a1792557

Download Submit
C:\Windows\System\iUZIQfu.exe

Filesize
1.8MB

MD5
35ed60515541704f2905f988b0eeb521

SHA1
9978dd1801482227ca4aabc1fc7e2d3dadd4366b

SHA256
55c0731a4548a8d38883e345e285704dfb87070589027de6b112b96715bd3e4b

SHA512
dd4139606b6917a7efeb3f808e365573c6ef72ab7502f1a09603ebf5ff3f3e0834b7e0e93c72ead2c23563015390b87dc0921405a337a3786c22c479931dfc7c

Download Submit
C:\Windows\System\lnOnsWA.exe

Filesize
1.8MB

MD5
4fa3ea7ff6b07d089eba1718553de42b

SHA1
5fb36693bd4dca910cba80ba00813a0df894867f

SHA256
a9365e6e16c73cf6a8c3f83b6561a228a13c2ee16a720737e87cb1be7d988914

SHA512
6e93d17d36da8d6b7ebd01f261b4c3be11a358f0a0c1e8a4621016f256be5565b5fd7cfaf19a97d59513d4c3094d0740d9120c17bd0d3e928246e105e8400f04

Download Submit
C:\Windows\System\mMXZfey.exe

Filesize
1.8MB

MD5
9dfd6835f30c5c60f0b6c656665c80f5

SHA1
2540cabf4881c0782062d96b7297267076cbe798

SHA256
1a2f1c761abdd85d393d798d98c9c4a71375424d031106f635f2ca02c5d9062c

SHA512
c395bc2fc8fea8dbdf70a9caf6ec398b9fbc72a5afa6d9d29e1a3cbe45eb485571d2fbfdb1b10521a6b2c2767cb8364b5157aee9aa7797564c598a53b78d10b3

Download Submit
C:\Windows\System\oSsoULM.exe

Filesize
8B

MD5
d8f939ee099285eb5299be97436baa4d

SHA1
e982a1f84114c575869e996a9a214509ee9e0e66

SHA256
e7c262920797c23676b4311de18f70723dfd833b4d38ec2d89ac9d49b2f67690

SHA512
e31bd5edb5ca774adb6b49128eb293ef2a9394fca94c3def6901a7d4903de06386842bbd81ce1630fc901df52644e493a263be2bc59bd514aa7a1f110b251fe2

Download Submit
C:\Windows\System\ppRVFOV.exe

Filesize
1.8MB

MD5
bcc8d07b347a8fd14eb28d4ff8a3863d

SHA1
13de8194dc3bdba453afcd012d45cb77543e0e07

SHA256
dae4ed83ba1bd82acc7338bcc5b7da1860975bd4c4013679822f90f0c45d2982

SHA512
d71c343a79811fd6cdfb3e874f5092d1723c0739ef1655340212ae79958d9acf6307f92046bdeee274fdc9510055d57cd18f3c1e2cae3e5c6123ebdd4692f71b

Download Submit
C:\Windows\System\qKCIiNB.exe

Filesize
1.8MB

MD5
fed3264688319ef323167121690f2edf

SHA1
12bc323f8c66c16229c25ae248f6acd47c5e9e39

SHA256
8c12673e699fd06dfea4d0b7fb5420e0ae8dece06e033e62b500c0b0619b34ff

SHA512
9f531887ac5838f6a41fb2883bcca1e976d7cc8f3c00d50ff9d88e44c6d435e28dc08c54a286f4a3de934b957b9069e7b7b8a41cf537bdfb2921b145d3956845

Download Submit
C:\Windows\System\rFkxcyL.exe

Filesize
1.8MB

MD5
4a8004e137328b8ce2b98ea923861ced

SHA1
ad42d92b2f9fe5796b36e05fe872412e2b735408

SHA256
12fbeccc641f58881698df4879ae9db4207a524f19b5d6e18430e1131bbdd886

SHA512
717d43d7c8896c27ce3d8220de0cfb65b58cfdcecc47ddbacf99c79cee19a02139fb3831139a942241b4ef8ffd94c94ee271351acb0c87b8dd7821e01de8bf20

Download Submit
C:\Windows\System\sJpylQk.exe

Filesize
1.8MB

MD5
4b0a44fa7ae12ddf1fd567ad93166eb1

SHA1
9e75ce585c5ea084a6f06542ee95f1c931ce3305

SHA256
53964b1310bf3da4d544f3b5009437a98a8f241148983f3329261d8230db28e8

SHA512
4d03df8173ad39e8eed49b587cdcd37b0bb549e4275e8b5ff5115653642cc2a816183d15caf7231380eb559ca08bed7638798ee4501d1625b3f135b1cc83b5ec

Download Submit
C:\Windows\System\uLqAbZT.exe

Filesize
1.8MB

MD5
a6bc8efbfad632462f5c3d8965642dd8

SHA1
f68e13efdc56e2a868a89b464c41d2ac19c75a1b

SHA256
e3b671e397f79798090d339fc00cd2e6193d011cc523feb4a83a57f37d260ed4

SHA512
1121f4c2746f1243fbe25b9e7155196f12dfb758a982bd6e46e62f7424a126f1bf9846b2aba522764eb531638594b6408232bf16e1bf6e061fc8c8a3cd2a942b

Download Submit
C:\Windows\System\xIxslDW.exe

Filesize
1.8MB

MD5
54998223c943e1407fbe70a6b486c075

SHA1
c16de922a5f9ec4499efd7c553619bbdf076549b

SHA256
90876bf7df5c273961dbaad73b70dedb9d210f0d8511ff5079c396e59e50e41b

SHA512
f219ba71c13b6c1137796f20a74bba5aac9c10ae4579d11f6b0a6e0bfe0ebe2e393b8fab7edb75121f1a781510b031caeca9d86ed35ab98a1bb7a82d4e7793be

Download Submit
C:\Windows\System\xPwxFsp.exe

Filesize
1.8MB

MD5
ff52bfcc2cc408b54dcf476c3eb6c138

SHA1
5da54a96eb7cfafd33f785d9beba7101691bcdf5

SHA256
77289f93e7ffc3e265faa98eeb8440e48c104ffa695b5b4c3afc60ebd1f871e6

SHA512
ce51a9e843677973258d4738f88ab9b68ac216d1dd40a24a085a3c670d022d1a555347831862e82933267d8f5356902f7402e2c53f9f3726bfe6715c5e87cbd3

Download Submit
C:\Windows\System\xdzsGvW.exe

Filesize
1.8MB

MD5
aa025cc37c1e6b4b2e07e6fdc10033c5

SHA1
106aba293deb7c520b6c238b17e73cd7551d15c7

SHA256
2ce5b66c3cebdfe1ab459a73371b04639f810ba9ba644fbec63f0f1476a4b833

SHA512
2b80b1ba6ca028af4ae9a38b38037ffc7c314922ea6d418323a22067ee559236a249e699c0d5830385ceebfc958bb27c50b2ffdae0716f0f124be8156a934625

Download Submit
C:\Windows\System\yMEUVrA.exe

Filesize
1.8MB

MD5
177fccf61ba908444c6e230909c2f8cf

SHA1
2c39ebecea01d18032162a5d66e3091b1b448d30

SHA256
7931cf70d75259e495fcec94b4e296090d566ff60ae73e5630c743ee997e2e97

SHA512
1265ca868110fbf725b2784a6435f94a17ab5c1bad00a2cb6412ba52eae4f45962eb4c0a5136c59f8bb5d19abf8afd38ea6a69329ba0f5fb6fb94d2f64cb9db6

Download Submit
memory/372-140-0x00007FF6E2A10000-0x00007FF6E2E02000-memory.dmp

Filesize
3.9MB

Download
memory/372-3734-0x00007FF6E2A10000-0x00007FF6E2E02000-memory.dmp

Filesize
3.9MB

Download
memory/528-3699-0x00007FF662670000-0x00007FF662A62000-memory.dmp

Filesize
3.9MB

Download
memory/528-3740-0x00007FF662670000-0x00007FF662A62000-memory.dmp

Filesize
3.9MB

Download
memory/528-11-0x00007FF662670000-0x00007FF662A62000-memory.dmp

Filesize
3.9MB

Download
memory/548-3775-0x00007FF677710000-0x00007FF677B02000-memory.dmp

Filesize
3.9MB

Download
memory/548-500-0x00007FF677710000-0x00007FF677B02000-memory.dmp

Filesize
3.9MB

Download
memory/928-399-0x00007FF774F70000-0x00007FF775362000-memory.dmp

Filesize
3.9MB

Download
memory/928-3753-0x00007FF774F70000-0x00007FF775362000-memory.dmp

Filesize
3.9MB

Download
memory/1004-3757-0x00007FF731A70000-0x00007FF731E62000-memory.dmp

Filesize
3.9MB

Download
memory/1004-279-0x00007FF731A70000-0x00007FF731E62000-memory.dmp

Filesize
3.9MB

Download
memory/1428-3764-0x00007FF7B6BC0000-0x00007FF7B6FB2000-memory.dmp

Filesize
3.9MB

Download
memory/1428-469-0x00007FF7B6BC0000-0x00007FF7B6FB2000-memory.dmp

Filesize
3.9MB

Download
memory/1480-251-0x00007FF749240000-0x00007FF749632000-memory.dmp

Filesize
3.9MB

Download
memory/1480-3747-0x00007FF749240000-0x00007FF749632000-memory.dmp

Filesize
3.9MB

Download
memory/1772-182-0x00007FF76DD10000-0x00007FF76E102000-memory.dmp

Filesize
3.9MB

Download
memory/1772-3736-0x00007FF76DD10000-0x00007FF76E102000-memory.dmp

Filesize
3.9MB

Download
memory/1964-3762-0x00007FF60AD90000-0x00007FF60B182000-memory.dmp

Filesize
3.9MB

Download
memory/1964-254-0x00007FF60AD90000-0x00007FF60B182000-memory.dmp

Filesize
3.9MB

Download
memory/2160-3778-0x00007FF608330000-0x00007FF608722000-memory.dmp

Filesize
3.9MB

Download
memory/2160-532-0x00007FF608330000-0x00007FF608722000-memory.dmp

Filesize
3.9MB

Download
memory/2244-499-0x00007FF7B0C50000-0x00007FF7B1042000-memory.dmp

Filesize
3.9MB

Download
memory/2244-3781-0x00007FF7B0C50000-0x00007FF7B1042000-memory.dmp

Filesize
3.9MB

Download
memory/2376-495-0x00007FF7BD580000-0x00007FF7BD972000-memory.dmp

Filesize
3.9MB

Download
memory/2376-3749-0x00007FF7BD580000-0x00007FF7BD972000-memory.dmp

Filesize
3.9MB

Download
memory/2604-312-0x00007FF7BB5D0000-0x00007FF7BB9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-3745-0x00007FF7BB5D0000-0x00007FF7BB9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2772-23-0x00007FF6B2FA0000-0x00007FF6B3392000-memory.dmp

Filesize
3.9MB

Download
memory/2772-3727-0x00007FF6B2FA0000-0x00007FF6B3392000-memory.dmp

Filesize
3.9MB

Download
memory/2772-3732-0x00007FF6B2FA0000-0x00007FF6B3392000-memory.dmp

Filesize
3.9MB

Download
memory/2792-3739-0x00007FF653A40000-0x00007FF653E32000-memory.dmp

Filesize
3.9MB

Download
memory/2792-205-0x00007FF653A40000-0x00007FF653E32000-memory.dmp

Filesize
3.9MB

Download
memory/3480-3790-0x00007FF61D160000-0x00007FF61D552000-memory.dmp

Filesize
3.9MB

Download
memory/3480-496-0x00007FF61D160000-0x00007FF61D552000-memory.dmp

Filesize
3.9MB

Download
memory/3592-3760-0x00007FF633030000-0x00007FF633422000-memory.dmp

Filesize
3.9MB

Download
memory/3592-468-0x00007FF633030000-0x00007FF633422000-memory.dmp

Filesize
3.9MB

Download
memory/3660-419-0x00007FF670180000-0x00007FF670572000-memory.dmp

Filesize
3.9MB

Download
memory/3660-3783-0x00007FF670180000-0x00007FF670572000-memory.dmp

Filesize
3.9MB

Download
memory/3996-3743-0x00007FF6F2BA0000-0x00007FF6F2F92000-memory.dmp

Filesize
3.9MB

Download
memory/3996-352-0x00007FF6F2BA0000-0x00007FF6F2F92000-memory.dmp

Filesize
3.9MB

Download
memory/4064-3751-0x00007FF77F3F0000-0x00007FF77F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/4064-418-0x00007FF77F3F0000-0x00007FF77F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/4116-3759-0x00007FF6F82A0000-0x00007FF6F8692000-memory.dmp

Filesize
3.9MB

Download
memory/4116-543-0x00007FF6F82A0000-0x00007FF6F8692000-memory.dmp

Filesize
3.9MB

Download
memory/4160-1-0x0000025984770000-0x0000025984780000-memory.dmp

Filesize
64KB

Download
memory/4160-0-0x00007FF677A30000-0x00007FF677E22000-memory.dmp

Filesize
3.9MB

Download
memory/4336-3766-0x00007FF62FA40000-0x00007FF62FE32000-memory.dmp

Filesize
3.9MB

Download
memory/4336-340-0x00007FF62FA40000-0x00007FF62FE32000-memory.dmp

Filesize
3.9MB

Download
memory/4816-422-0x00007FF6BD110000-0x00007FF6BD502000-memory.dmp

Filesize
3.9MB

Download
memory/4816-3769-0x00007FF6BD110000-0x00007FF6BD502000-memory.dmp

Filesize
3.9MB

Download
memory/4920-1034-0x000001F344500000-0x000001F344CA6000-memory.dmp

Filesize
7.6MB

Download
memory/4920-542-0x00007FFB5CC90000-0x00007FFB5D751000-memory.dmp

Filesize
10.8MB

Download
memory/4920-97-0x00007FFB5CC90000-0x00007FFB5D751000-memory.dmp

Filesize
10.8MB

Download
memory/4920-231-0x000001F329800000-0x000001F329822000-memory.dmp

Filesize
136KB

Download
memory/4920-12-0x00007FFB5CC93000-0x00007FFB5CC95000-memory.dmp

Filesize
8KB

Download
memory/5112-3755-0x00007FF63D730000-0x00007FF63DB22000-memory.dmp

Filesize
3.9MB

Download
memory/5112-339-0x00007FF63D730000-0x00007FF63DB22000-memory.dmp

Filesize
3.9MB

Download