xmrig | 5b1ba7c4a72003ab4e8bb43c696fe51ddbdaa6bb265c76a6e4d5a903f2394e56

Analysis

max time kernel
95s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4232f8d9772e1bfe669e461a7e34ca50N.exe
Size

1.4MB
MD5

4232f8d9772e1bfe669e461a7e34ca50
SHA1

5021f2b16523b574ded1c0571071878c23c94d79
SHA256

5b1ba7c4a72003ab4e8bb43c696fe51ddbdaa6bb265c76a6e4d5a903f2394e56
SHA512

a2732a5face0f305b4e589ce3a82aac9c3909bde7cc7a932768a295b93a0e564af2f64041934e1c3f257b88f43c2f604ebe3a97f14f5a38654e29515613516b3
SSDEEP

24576:RVIl/WDGCi7/qkat6Q5aILMCfmARvKYYwdy2VlmNCQgIT0rKiU8x5EI/Vh:ROdWCCi7/raZ5aIwC+Ax4ErWThizE0Vh

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 56 IoCs

miner

resource	yara_rule
behavioral2/memory/2924-471-0x00007FF6C8560000-0x00007FF6C88B1000-memory.dmp	xmrig
behavioral2/memory/2768-470-0x00007FF6B94F0000-0x00007FF6B9841000-memory.dmp	xmrig
behavioral2/memory/672-473-0x00007FF6E2E00000-0x00007FF6E3151000-memory.dmp	xmrig
behavioral2/memory/2284-472-0x00007FF78CC80000-0x00007FF78CFD1000-memory.dmp	xmrig
behavioral2/memory/212-532-0x00007FF729AE0000-0x00007FF729E31000-memory.dmp	xmrig
behavioral2/memory/2812-528-0x00007FF7360A0000-0x00007FF7363F1000-memory.dmp	xmrig
behavioral2/memory/1688-504-0x00007FF6D42A0000-0x00007FF6D45F1000-memory.dmp	xmrig
behavioral2/memory/628-608-0x00007FF690680000-0x00007FF6909D1000-memory.dmp	xmrig
behavioral2/memory/3240-603-0x00007FF70F7F0000-0x00007FF70FB41000-memory.dmp	xmrig
behavioral2/memory/3276-853-0x00007FF776410000-0x00007FF776761000-memory.dmp	xmrig
behavioral2/memory/3696-958-0x00007FF7CDA60000-0x00007FF7CDDB1000-memory.dmp	xmrig
behavioral2/memory/860-848-0x00007FF7A01D0000-0x00007FF7A0521000-memory.dmp	xmrig
behavioral2/memory/3264-1664-0x00007FF6114A0000-0x00007FF6117F1000-memory.dmp	xmrig
behavioral2/memory/1324-1401-0x00007FF69FF20000-0x00007FF6A0271000-memory.dmp	xmrig
behavioral2/memory/4856-1153-0x00007FF601D90000-0x00007FF6020E1000-memory.dmp	xmrig
behavioral2/memory/2456-1149-0x00007FF63AF80000-0x00007FF63B2D1000-memory.dmp	xmrig
behavioral2/memory/3080-1147-0x00007FF7D1C30000-0x00007FF7D1F81000-memory.dmp	xmrig
behavioral2/memory/1728-745-0x00007FF6F93D0000-0x00007FF6F9721000-memory.dmp	xmrig
behavioral2/memory/780-655-0x00007FF78A9F0000-0x00007FF78AD41000-memory.dmp	xmrig
behavioral2/memory/1604-565-0x00007FF6C51C0000-0x00007FF6C5511000-memory.dmp	xmrig
behavioral2/memory/2028-499-0x00007FF622E00000-0x00007FF623151000-memory.dmp	xmrig
behavioral2/memory/1852-488-0x00007FF7ED250000-0x00007FF7ED5A1000-memory.dmp	xmrig
behavioral2/memory/3300-2177-0x00007FF795E60000-0x00007FF7961B1000-memory.dmp	xmrig
behavioral2/memory/4228-2246-0x00007FF7435A0000-0x00007FF7438F1000-memory.dmp	xmrig
behavioral2/memory/1984-2247-0x00007FF7DB7B0000-0x00007FF7DBB01000-memory.dmp	xmrig
behavioral2/memory/224-2248-0x00007FF7048F0000-0x00007FF704C41000-memory.dmp	xmrig
behavioral2/memory/1832-2249-0x00007FF73AB40000-0x00007FF73AE91000-memory.dmp	xmrig
behavioral2/memory/4304-2250-0x00007FF667CB0000-0x00007FF668001000-memory.dmp	xmrig
behavioral2/memory/4228-2252-0x00007FF7435A0000-0x00007FF7438F1000-memory.dmp	xmrig
behavioral2/memory/224-2255-0x00007FF7048F0000-0x00007FF704C41000-memory.dmp	xmrig
behavioral2/memory/1832-2256-0x00007FF73AB40000-0x00007FF73AE91000-memory.dmp	xmrig
behavioral2/memory/2924-2259-0x00007FF6C8560000-0x00007FF6C88B1000-memory.dmp	xmrig
behavioral2/memory/1984-2274-0x00007FF7DB7B0000-0x00007FF7DBB01000-memory.dmp	xmrig
behavioral2/memory/1688-2276-0x00007FF6D42A0000-0x00007FF6D45F1000-memory.dmp	xmrig
behavioral2/memory/212-2280-0x00007FF729AE0000-0x00007FF729E31000-memory.dmp	xmrig
behavioral2/memory/3240-2282-0x00007FF70F7F0000-0x00007FF70FB41000-memory.dmp	xmrig
behavioral2/memory/628-2284-0x00007FF690680000-0x00007FF6909D1000-memory.dmp	xmrig
behavioral2/memory/1604-2278-0x00007FF6C51C0000-0x00007FF6C5511000-memory.dmp	xmrig
behavioral2/memory/4304-2273-0x00007FF667CB0000-0x00007FF668001000-memory.dmp	xmrig
behavioral2/memory/2768-2271-0x00007FF6B94F0000-0x00007FF6B9841000-memory.dmp	xmrig
behavioral2/memory/2284-2268-0x00007FF78CC80000-0x00007FF78CFD1000-memory.dmp	xmrig
behavioral2/memory/672-2267-0x00007FF6E2E00000-0x00007FF6E3151000-memory.dmp	xmrig
behavioral2/memory/2028-2263-0x00007FF622E00000-0x00007FF623151000-memory.dmp	xmrig
behavioral2/memory/2812-2261-0x00007FF7360A0000-0x00007FF7363F1000-memory.dmp	xmrig
behavioral2/memory/1852-2265-0x00007FF7ED250000-0x00007FF7ED5A1000-memory.dmp	xmrig
behavioral2/memory/860-2309-0x00007FF7A01D0000-0x00007FF7A0521000-memory.dmp	xmrig
behavioral2/memory/1728-2307-0x00007FF6F93D0000-0x00007FF6F9721000-memory.dmp	xmrig
behavioral2/memory/4760-2305-0x00007FF76B680000-0x00007FF76B9D1000-memory.dmp	xmrig
behavioral2/memory/4856-2300-0x00007FF601D90000-0x00007FF6020E1000-memory.dmp	xmrig
behavioral2/memory/1324-2299-0x00007FF69FF20000-0x00007FF6A0271000-memory.dmp	xmrig
behavioral2/memory/3696-2296-0x00007FF7CDA60000-0x00007FF7CDDB1000-memory.dmp	xmrig
behavioral2/memory/3276-2292-0x00007FF776410000-0x00007FF776761000-memory.dmp	xmrig
behavioral2/memory/3080-2290-0x00007FF7D1C30000-0x00007FF7D1F81000-memory.dmp	xmrig
behavioral2/memory/3264-2303-0x00007FF6114A0000-0x00007FF6117F1000-memory.dmp	xmrig
behavioral2/memory/2456-2295-0x00007FF63AF80000-0x00007FF63B2D1000-memory.dmp	xmrig
behavioral2/memory/780-2316-0x00007FF78A9F0000-0x00007FF78AD41000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4228	wYGOAmd.exe
224	ZWliTTi.exe
1832	ntwvAnw.exe
1984	LKshwLq.exe
4304	UwpAftt.exe
2768	iByKsWJ.exe
2924	JsvfefD.exe
2284	gwyrNgQ.exe
672	mtxUHIa.exe
1852	PkBAVod.exe
2028	xXVwWld.exe
1688	fjuSQMu.exe
2812	grhJRsr.exe
212	QxudBQh.exe
1604	wvuEmcO.exe
3240	XyIrSdM.exe
628	yHUpzti.exe
780	fUlPqPE.exe
1728	QairzCj.exe
860	kpiZIIc.exe
3276	lZMwxQC.exe
3696	cQyEsCt.exe
3080	AjOyWAl.exe
2456	vuYEDNt.exe
4856	CRqjtUp.exe
1324	igkJtPZ.exe
3264	fDOQufg.exe
4760	zXeTfTG.exe
3540	wNLuPMy.exe
924	XgtgVMg.exe
4984	MUdtZjM.exe
516	MSaaQvb.exe
644	Qdlkqhq.exe
3884	TglQnck.exe
3704	jrfQpHn.exe
2900	zmxhsRo.exe
4204	JibphBb.exe
4564	StuOJjr.exe
2784	lsfkNOn.exe
1600	npQTGGX.exe
932	zFABhOr.exe
4988	LnGRRPD.exe
548	xQUXcHx.exe
4396	rKZbDhk.exe
4752	uGuZNSp.exe
3032	YixNqjS.exe
4672	fOdZbtN.exe
216	yPBdENH.exe
1072	TEQILkD.exe
4764	mMdMgVI.exe
4484	GeGlSRh.exe
3324	tOlbXMX.exe
2528	QRVRqLj.exe
4884	kUGoExb.exe
2192	RvDyIHr.exe
4012	YjoOccY.exe
4344	XnNZcYp.exe
3592	Htjqqcg.exe
5076	gqEvJHe.exe
3272	XfstSzo.exe
312	dpFtenk.exe
3296	kAWmELi.exe
368	QjIHLGC.exe
3520	xGHwJnR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3300-0-0x00007FF795E60000-0x00007FF7961B1000-memory.dmp	upx
behavioral2/files/0x0009000000023489-4.dat	upx
behavioral2/files/0x00080000000234e3-16.dat	upx
behavioral2/memory/1984-30-0x00007FF7DB7B0000-0x00007FF7DBB01000-memory.dmp	upx
behavioral2/files/0x00070000000234ea-39.dat	upx
behavioral2/files/0x00070000000234ef-64.dat	upx
behavioral2/files/0x00070000000234f3-84.dat	upx
behavioral2/files/0x00070000000234f6-93.dat	upx
behavioral2/files/0x00070000000234fc-131.dat	upx
behavioral2/memory/2924-471-0x00007FF6C8560000-0x00007FF6C88B1000-memory.dmp	upx
behavioral2/memory/2768-470-0x00007FF6B94F0000-0x00007FF6B9841000-memory.dmp	upx
behavioral2/memory/672-473-0x00007FF6E2E00000-0x00007FF6E3151000-memory.dmp	upx
behavioral2/memory/2284-472-0x00007FF78CC80000-0x00007FF78CFD1000-memory.dmp	upx
behavioral2/memory/212-532-0x00007FF729AE0000-0x00007FF729E31000-memory.dmp	upx
behavioral2/memory/2812-528-0x00007FF7360A0000-0x00007FF7363F1000-memory.dmp	upx
behavioral2/memory/1688-504-0x00007FF6D42A0000-0x00007FF6D45F1000-memory.dmp	upx
behavioral2/memory/628-608-0x00007FF690680000-0x00007FF6909D1000-memory.dmp	upx
behavioral2/memory/3240-603-0x00007FF70F7F0000-0x00007FF70FB41000-memory.dmp	upx
behavioral2/memory/3276-853-0x00007FF776410000-0x00007FF776761000-memory.dmp	upx
behavioral2/memory/3696-958-0x00007FF7CDA60000-0x00007FF7CDDB1000-memory.dmp	upx
behavioral2/memory/860-848-0x00007FF7A01D0000-0x00007FF7A0521000-memory.dmp	upx
behavioral2/memory/3264-1664-0x00007FF6114A0000-0x00007FF6117F1000-memory.dmp	upx
behavioral2/memory/1324-1401-0x00007FF69FF20000-0x00007FF6A0271000-memory.dmp	upx
behavioral2/memory/4856-1153-0x00007FF601D90000-0x00007FF6020E1000-memory.dmp	upx
behavioral2/memory/2456-1149-0x00007FF63AF80000-0x00007FF63B2D1000-memory.dmp	upx
behavioral2/memory/3080-1147-0x00007FF7D1C30000-0x00007FF7D1F81000-memory.dmp	upx
behavioral2/memory/1728-745-0x00007FF6F93D0000-0x00007FF6F9721000-memory.dmp	upx
behavioral2/memory/780-655-0x00007FF78A9F0000-0x00007FF78AD41000-memory.dmp	upx
behavioral2/memory/1604-565-0x00007FF6C51C0000-0x00007FF6C5511000-memory.dmp	upx
behavioral2/memory/2028-499-0x00007FF622E00000-0x00007FF623151000-memory.dmp	upx
behavioral2/memory/1852-488-0x00007FF7ED250000-0x00007FF7ED5A1000-memory.dmp	upx
behavioral2/files/0x0007000000023505-168.dat	upx
behavioral2/files/0x0007000000023503-166.dat	upx
behavioral2/files/0x0007000000023504-163.dat	upx
behavioral2/files/0x0007000000023502-161.dat	upx
behavioral2/files/0x0007000000023501-156.dat	upx
behavioral2/files/0x0007000000023500-151.dat	upx
behavioral2/files/0x00070000000234ff-146.dat	upx
behavioral2/files/0x00070000000234fe-141.dat	upx
behavioral2/files/0x00070000000234fd-136.dat	upx
behavioral2/files/0x00070000000234fb-126.dat	upx
behavioral2/files/0x00070000000234fa-119.dat	upx
behavioral2/files/0x00070000000234f9-114.dat	upx
behavioral2/files/0x00070000000234f8-108.dat	upx
behavioral2/files/0x00070000000234f7-104.dat	upx
behavioral2/files/0x00070000000234f5-96.dat	upx
behavioral2/files/0x00070000000234f4-91.dat	upx
behavioral2/files/0x00070000000234f2-79.dat	upx
behavioral2/files/0x00070000000234f1-74.dat	upx
behavioral2/files/0x00070000000234f0-68.dat	upx
behavioral2/files/0x00070000000234ee-58.dat	upx
behavioral2/files/0x00070000000234ed-54.dat	upx
behavioral2/files/0x00070000000234ec-46.dat	upx
behavioral2/files/0x00070000000234eb-41.dat	upx
behavioral2/files/0x00070000000234e9-36.dat	upx
behavioral2/memory/4304-32-0x00007FF667CB0000-0x00007FF668001000-memory.dmp	upx
behavioral2/memory/1832-23-0x00007FF73AB40000-0x00007FF73AE91000-memory.dmp	upx
behavioral2/memory/224-21-0x00007FF7048F0000-0x00007FF704C41000-memory.dmp	upx
behavioral2/files/0x00070000000234e7-20.dat	upx
behavioral2/files/0x00070000000234e8-26.dat	upx
behavioral2/memory/4228-11-0x00007FF7435A0000-0x00007FF7438F1000-memory.dmp	upx
behavioral2/memory/3300-2177-0x00007FF795E60000-0x00007FF7961B1000-memory.dmp	upx
behavioral2/memory/4228-2246-0x00007FF7435A0000-0x00007FF7438F1000-memory.dmp	upx
behavioral2/memory/1984-2247-0x00007FF7DB7B0000-0x00007FF7DBB01000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WVqrgcZ.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\xJQPDuz.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\wKLAGNl.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\TmGKXJt.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\mwBNTfN.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\fljMvgl.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\RRkOAwV.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\tRPAiLy.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\OqQAqcs.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\LEmsqJI.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\DEHnqas.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\SiTtRcA.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\zXHQrwO.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\cVvoHmo.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\ZjyIJsp.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\ZbOkqnH.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\QlrfEGf.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\baxWnlE.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\bJBdwda.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\vXETlDY.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\zNGMKiu.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\RKFRGgA.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\YkzfKEp.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\rXPCJCv.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\wUsKOoN.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\XSnlmWw.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\LplroqZ.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\LKshwLq.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\jUksRgo.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\ogoTyQW.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\AMpqFoA.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\JGysWxd.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\YyMVsBm.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\QciAwbh.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\Kcmlbpf.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\VWlWeEj.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\NeuidKn.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\kAWmELi.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\cExDnnj.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\kecDqGG.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\GOzJFQU.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\QxudBQh.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\RvDyIHr.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\aXigAcv.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\KuLuHDP.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\DNstVjI.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\DbXsmGH.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\FDLeDyC.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\rKZbDhk.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\KlJdLpB.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\STUxCqa.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\kyXTSGc.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\SqwoRqM.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\nXHRhnu.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\lMuhiSo.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\fsIRJxG.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\sewPUSY.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\LnGRRPD.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\lIDkoBN.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\pqkjnsu.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\sPaiVnj.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\Cqffpah.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\yuXLMXd.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe
File created	C:\Windows\System\nyhxBdv.exe	4232f8d9772e1bfe669e461a7e34ca50N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 4228	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	84
PID 3300 wrote to memory of 4228	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	84
PID 3300 wrote to memory of 1832	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	85
PID 3300 wrote to memory of 1832	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	85
PID 3300 wrote to memory of 224	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	86
PID 3300 wrote to memory of 224	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	86
PID 3300 wrote to memory of 1984	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	87
PID 3300 wrote to memory of 1984	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	87
PID 3300 wrote to memory of 4304	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	88
PID 3300 wrote to memory of 4304	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	88
PID 3300 wrote to memory of 2768	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	89
PID 3300 wrote to memory of 2768	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	89
PID 3300 wrote to memory of 2924	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	90
PID 3300 wrote to memory of 2924	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	90
PID 3300 wrote to memory of 2284	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	91
PID 3300 wrote to memory of 2284	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	91
PID 3300 wrote to memory of 672	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	92
PID 3300 wrote to memory of 672	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	92
PID 3300 wrote to memory of 1852	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	93
PID 3300 wrote to memory of 1852	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	93
PID 3300 wrote to memory of 2028	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	94
PID 3300 wrote to memory of 2028	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	94
PID 3300 wrote to memory of 1688	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	95
PID 3300 wrote to memory of 1688	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	95
PID 3300 wrote to memory of 2812	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	96
PID 3300 wrote to memory of 2812	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	96
PID 3300 wrote to memory of 212	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	97
PID 3300 wrote to memory of 212	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	97
PID 3300 wrote to memory of 1604	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	98
PID 3300 wrote to memory of 1604	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	98
PID 3300 wrote to memory of 3240	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	99
PID 3300 wrote to memory of 3240	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	99
PID 3300 wrote to memory of 628	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	100
PID 3300 wrote to memory of 628	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	100
PID 3300 wrote to memory of 780	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	101
PID 3300 wrote to memory of 780	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	101
PID 3300 wrote to memory of 1728	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	102
PID 3300 wrote to memory of 1728	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	102
PID 3300 wrote to memory of 860	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	103
PID 3300 wrote to memory of 860	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	103
PID 3300 wrote to memory of 3276	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	104
PID 3300 wrote to memory of 3276	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	104
PID 3300 wrote to memory of 3696	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	105
PID 3300 wrote to memory of 3696	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	105
PID 3300 wrote to memory of 3080	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	106
PID 3300 wrote to memory of 3080	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	106
PID 3300 wrote to memory of 2456	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	107
PID 3300 wrote to memory of 2456	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	107
PID 3300 wrote to memory of 4856	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	108
PID 3300 wrote to memory of 4856	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	108
PID 3300 wrote to memory of 1324	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	109
PID 3300 wrote to memory of 1324	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	109
PID 3300 wrote to memory of 3264	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	110
PID 3300 wrote to memory of 3264	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	110
PID 3300 wrote to memory of 4760	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	111
PID 3300 wrote to memory of 4760	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	111
PID 3300 wrote to memory of 3540	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	112
PID 3300 wrote to memory of 3540	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	112
PID 3300 wrote to memory of 924	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	113
PID 3300 wrote to memory of 924	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	113
PID 3300 wrote to memory of 4984	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	114
PID 3300 wrote to memory of 4984	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	114
PID 3300 wrote to memory of 516	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	115
PID 3300 wrote to memory of 516	3300	4232f8d9772e1bfe669e461a7e34ca50N.exe	115

C:\Users\Admin\AppData\Local\Temp\4232f8d9772e1bfe669e461a7e34ca50N.exe
"C:\Users\Admin\AppData\Local\Temp\4232f8d9772e1bfe669e461a7e34ca50N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\System\wYGOAmd.exe
  C:\Windows\System\wYGOAmd.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\ntwvAnw.exe
  C:\Windows\System\ntwvAnw.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\ZWliTTi.exe
  C:\Windows\System\ZWliTTi.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\LKshwLq.exe
  C:\Windows\System\LKshwLq.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\UwpAftt.exe
  C:\Windows\System\UwpAftt.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\iByKsWJ.exe
  C:\Windows\System\iByKsWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\JsvfefD.exe
  C:\Windows\System\JsvfefD.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\gwyrNgQ.exe
  C:\Windows\System\gwyrNgQ.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\mtxUHIa.exe
  C:\Windows\System\mtxUHIa.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\PkBAVod.exe
  C:\Windows\System\PkBAVod.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\xXVwWld.exe
  C:\Windows\System\xXVwWld.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\fjuSQMu.exe
  C:\Windows\System\fjuSQMu.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\grhJRsr.exe
  C:\Windows\System\grhJRsr.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\QxudBQh.exe
  C:\Windows\System\QxudBQh.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\wvuEmcO.exe
  C:\Windows\System\wvuEmcO.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\XyIrSdM.exe
  C:\Windows\System\XyIrSdM.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\yHUpzti.exe
  C:\Windows\System\yHUpzti.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\fUlPqPE.exe
  C:\Windows\System\fUlPqPE.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\QairzCj.exe
  C:\Windows\System\QairzCj.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\kpiZIIc.exe
  C:\Windows\System\kpiZIIc.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\lZMwxQC.exe
  C:\Windows\System\lZMwxQC.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\cQyEsCt.exe
  C:\Windows\System\cQyEsCt.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\AjOyWAl.exe
  C:\Windows\System\AjOyWAl.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\vuYEDNt.exe
  C:\Windows\System\vuYEDNt.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\CRqjtUp.exe
  C:\Windows\System\CRqjtUp.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\igkJtPZ.exe
  C:\Windows\System\igkJtPZ.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\fDOQufg.exe
  C:\Windows\System\fDOQufg.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\zXeTfTG.exe
  C:\Windows\System\zXeTfTG.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\wNLuPMy.exe
  C:\Windows\System\wNLuPMy.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\XgtgVMg.exe
  C:\Windows\System\XgtgVMg.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\MUdtZjM.exe
  C:\Windows\System\MUdtZjM.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\MSaaQvb.exe
  C:\Windows\System\MSaaQvb.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\Qdlkqhq.exe
  C:\Windows\System\Qdlkqhq.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\TglQnck.exe
  C:\Windows\System\TglQnck.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\jrfQpHn.exe
  C:\Windows\System\jrfQpHn.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\zmxhsRo.exe
  C:\Windows\System\zmxhsRo.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\JibphBb.exe
  C:\Windows\System\JibphBb.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\StuOJjr.exe
  C:\Windows\System\StuOJjr.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\lsfkNOn.exe
  C:\Windows\System\lsfkNOn.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\npQTGGX.exe
  C:\Windows\System\npQTGGX.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\zFABhOr.exe
  C:\Windows\System\zFABhOr.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\LnGRRPD.exe
  C:\Windows\System\LnGRRPD.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\xQUXcHx.exe
  C:\Windows\System\xQUXcHx.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\rKZbDhk.exe
  C:\Windows\System\rKZbDhk.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\uGuZNSp.exe
  C:\Windows\System\uGuZNSp.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\YixNqjS.exe
  C:\Windows\System\YixNqjS.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\fOdZbtN.exe
  C:\Windows\System\fOdZbtN.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\yPBdENH.exe
  C:\Windows\System\yPBdENH.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\TEQILkD.exe
  C:\Windows\System\TEQILkD.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\mMdMgVI.exe
  C:\Windows\System\mMdMgVI.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\GeGlSRh.exe
  C:\Windows\System\GeGlSRh.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\tOlbXMX.exe
  C:\Windows\System\tOlbXMX.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\QRVRqLj.exe
  C:\Windows\System\QRVRqLj.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\kUGoExb.exe
  C:\Windows\System\kUGoExb.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\RvDyIHr.exe
  C:\Windows\System\RvDyIHr.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\YjoOccY.exe
  C:\Windows\System\YjoOccY.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\XnNZcYp.exe
  C:\Windows\System\XnNZcYp.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\Htjqqcg.exe
  C:\Windows\System\Htjqqcg.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\gqEvJHe.exe
  C:\Windows\System\gqEvJHe.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\XfstSzo.exe
  C:\Windows\System\XfstSzo.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\dpFtenk.exe
  C:\Windows\System\dpFtenk.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\kAWmELi.exe
  C:\Windows\System\kAWmELi.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\QjIHLGC.exe
  C:\Windows\System\QjIHLGC.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\xGHwJnR.exe
  C:\Windows\System\xGHwJnR.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\IcLtiit.exe
  C:\Windows\System\IcLtiit.exe
  2⤵
  PID:1712
- C:\Windows\System\SiTtRcA.exe
  C:\Windows\System\SiTtRcA.exe
  2⤵
  PID:3928
- C:\Windows\System\bQTcQDh.exe
  C:\Windows\System\bQTcQDh.exe
  2⤵
  PID:2608
- C:\Windows\System\eYawqvj.exe
  C:\Windows\System\eYawqvj.exe
  2⤵
  PID:4056
- C:\Windows\System\rryAmrA.exe
  C:\Windows\System\rryAmrA.exe
  2⤵
  PID:3924
- C:\Windows\System\ortwIkO.exe
  C:\Windows\System\ortwIkO.exe
  2⤵
  PID:2156
- C:\Windows\System\SfNBMUB.exe
  C:\Windows\System\SfNBMUB.exe
  2⤵
  PID:916
- C:\Windows\System\zyHUudh.exe
  C:\Windows\System\zyHUudh.exe
  2⤵
  PID:4860
- C:\Windows\System\tpkBmJf.exe
  C:\Windows\System\tpkBmJf.exe
  2⤵
  PID:3940
- C:\Windows\System\WaVWNrW.exe
  C:\Windows\System\WaVWNrW.exe
  2⤵
  PID:1488
- C:\Windows\System\jUksRgo.exe
  C:\Windows\System\jUksRgo.exe
  2⤵
  PID:1176
- C:\Windows\System\tHOJemY.exe
  C:\Windows\System\tHOJemY.exe
  2⤵
  PID:4540
- C:\Windows\System\qHNTAsY.exe
  C:\Windows\System\qHNTAsY.exe
  2⤵
  PID:3016
- C:\Windows\System\gqtwpii.exe
  C:\Windows\System\gqtwpii.exe
  2⤵
  PID:5092
- C:\Windows\System\LdNWHIL.exe
  C:\Windows\System\LdNWHIL.exe
  2⤵
  PID:4920
- C:\Windows\System\cExDnnj.exe
  C:\Windows\System\cExDnnj.exe
  2⤵
  PID:1584
- C:\Windows\System\GzxnzJV.exe
  C:\Windows\System\GzxnzJV.exe
  2⤵
  PID:2292
- C:\Windows\System\wCaBkFu.exe
  C:\Windows\System\wCaBkFu.exe
  2⤵
  PID:4388
- C:\Windows\System\mXajuee.exe
  C:\Windows\System\mXajuee.exe
  2⤵
  PID:3196
- C:\Windows\System\QlWJGeN.exe
  C:\Windows\System\QlWJGeN.exe
  2⤵
  PID:3748
- C:\Windows\System\hPyrYuN.exe
  C:\Windows\System\hPyrYuN.exe
  2⤵
  PID:4492
- C:\Windows\System\KlJdLpB.exe
  C:\Windows\System\KlJdLpB.exe
  2⤵
  PID:4336
- C:\Windows\System\anipsHz.exe
  C:\Windows\System\anipsHz.exe
  2⤵
  PID:5148
- C:\Windows\System\gkxciyz.exe
  C:\Windows\System\gkxciyz.exe
  2⤵
  PID:5168
- C:\Windows\System\eOixUiO.exe
  C:\Windows\System\eOixUiO.exe
  2⤵
  PID:5192
- C:\Windows\System\VwLheDX.exe
  C:\Windows\System\VwLheDX.exe
  2⤵
  PID:5220
- C:\Windows\System\oNJlKot.exe
  C:\Windows\System\oNJlKot.exe
  2⤵
  PID:5240
- C:\Windows\System\ykCahnQ.exe
  C:\Windows\System\ykCahnQ.exe
  2⤵
  PID:5268
- C:\Windows\System\RWKUnwI.exe
  C:\Windows\System\RWKUnwI.exe
  2⤵
  PID:5296
- C:\Windows\System\QqmScYF.exe
  C:\Windows\System\QqmScYF.exe
  2⤵
  PID:5324
- C:\Windows\System\jOvzInH.exe
  C:\Windows\System\jOvzInH.exe
  2⤵
  PID:5352
- C:\Windows\System\fsIRJxG.exe
  C:\Windows\System\fsIRJxG.exe
  2⤵
  PID:5380
- C:\Windows\System\mGMcgXm.exe
  C:\Windows\System\mGMcgXm.exe
  2⤵
  PID:5408
- C:\Windows\System\lIDkoBN.exe
  C:\Windows\System\lIDkoBN.exe
  2⤵
  PID:5436
- C:\Windows\System\MYhwKvX.exe
  C:\Windows\System\MYhwKvX.exe
  2⤵
  PID:5464
- C:\Windows\System\YpKxVIk.exe
  C:\Windows\System\YpKxVIk.exe
  2⤵
  PID:5492
- C:\Windows\System\VmNlqBs.exe
  C:\Windows\System\VmNlqBs.exe
  2⤵
  PID:5520
- C:\Windows\System\NgfEAwU.exe
  C:\Windows\System\NgfEAwU.exe
  2⤵
  PID:5548
- C:\Windows\System\aXigAcv.exe
  C:\Windows\System\aXigAcv.exe
  2⤵
  PID:5576
- C:\Windows\System\xBSFAaF.exe
  C:\Windows\System\xBSFAaF.exe
  2⤵
  PID:5604
- C:\Windows\System\vtkdecu.exe
  C:\Windows\System\vtkdecu.exe
  2⤵
  PID:5632
- C:\Windows\System\gajLCDu.exe
  C:\Windows\System\gajLCDu.exe
  2⤵
  PID:5660
- C:\Windows\System\liRbVYa.exe
  C:\Windows\System\liRbVYa.exe
  2⤵
  PID:5688
- C:\Windows\System\RKFRGgA.exe
  C:\Windows\System\RKFRGgA.exe
  2⤵
  PID:5716
- C:\Windows\System\bEyAcyD.exe
  C:\Windows\System\bEyAcyD.exe
  2⤵
  PID:5744
- C:\Windows\System\wDZuDxN.exe
  C:\Windows\System\wDZuDxN.exe
  2⤵
  PID:5776
- C:\Windows\System\wtCIvIZ.exe
  C:\Windows\System\wtCIvIZ.exe
  2⤵
  PID:5800
- C:\Windows\System\gqvhTRc.exe
  C:\Windows\System\gqvhTRc.exe
  2⤵
  PID:5828
- C:\Windows\System\pqkjnsu.exe
  C:\Windows\System\pqkjnsu.exe
  2⤵
  PID:5852
- C:\Windows\System\yNOXOvq.exe
  C:\Windows\System\yNOXOvq.exe
  2⤵
  PID:5880
- C:\Windows\System\zNBzhdw.exe
  C:\Windows\System\zNBzhdw.exe
  2⤵
  PID:5912
- C:\Windows\System\gAIcBxw.exe
  C:\Windows\System\gAIcBxw.exe
  2⤵
  PID:5940
- C:\Windows\System\ZgVIPvA.exe
  C:\Windows\System\ZgVIPvA.exe
  2⤵
  PID:5964
- C:\Windows\System\wHQJVae.exe
  C:\Windows\System\wHQJVae.exe
  2⤵
  PID:5996
- C:\Windows\System\XPkXmzO.exe
  C:\Windows\System\XPkXmzO.exe
  2⤵
  PID:6024
- C:\Windows\System\gRgsrBv.exe
  C:\Windows\System\gRgsrBv.exe
  2⤵
  PID:6048
- C:\Windows\System\HAalQzw.exe
  C:\Windows\System\HAalQzw.exe
  2⤵
  PID:6080
- C:\Windows\System\neUROlG.exe
  C:\Windows\System\neUROlG.exe
  2⤵
  PID:6108
- C:\Windows\System\vMErAKq.exe
  C:\Windows\System\vMErAKq.exe
  2⤵
  PID:6136
- C:\Windows\System\tItvuPH.exe
  C:\Windows\System\tItvuPH.exe
  2⤵
  PID:3280
- C:\Windows\System\owLXOMX.exe
  C:\Windows\System\owLXOMX.exe
  2⤵
  PID:1940
- C:\Windows\System\yuXLMXd.exe
  C:\Windows\System\yuXLMXd.exe
  2⤵
  PID:1844
- C:\Windows\System\pHKVedN.exe
  C:\Windows\System\pHKVedN.exe
  2⤵
  PID:2376
- C:\Windows\System\lxunsSD.exe
  C:\Windows\System\lxunsSD.exe
  2⤵
  PID:5140
- C:\Windows\System\XoxJmYJ.exe
  C:\Windows\System\XoxJmYJ.exe
  2⤵
  PID:5188
- C:\Windows\System\qashLNS.exe
  C:\Windows\System\qashLNS.exe
  2⤵
  PID:5232
- C:\Windows\System\uvpawvB.exe
  C:\Windows\System\uvpawvB.exe
  2⤵
  PID:5308
- C:\Windows\System\RaFkqAL.exe
  C:\Windows\System\RaFkqAL.exe
  2⤵
  PID:5368
- C:\Windows\System\UrhvxNX.exe
  C:\Windows\System\UrhvxNX.exe
  2⤵
  PID:5424
- C:\Windows\System\dQJaSQL.exe
  C:\Windows\System\dQJaSQL.exe
  2⤵
  PID:5484
- C:\Windows\System\DWZQQKl.exe
  C:\Windows\System\DWZQQKl.exe
  2⤵
  PID:5648
- C:\Windows\System\DqoHAKX.exe
  C:\Windows\System\DqoHAKX.exe
  2⤵
  PID:5676
- C:\Windows\System\glMgDbg.exe
  C:\Windows\System\glMgDbg.exe
  2⤵
  PID:5712
- C:\Windows\System\YywIdVs.exe
  C:\Windows\System\YywIdVs.exe
  2⤵
  PID:5736
- C:\Windows\System\zaWEnzk.exe
  C:\Windows\System\zaWEnzk.exe
  2⤵
  PID:5784
- C:\Windows\System\LjCNnBg.exe
  C:\Windows\System\LjCNnBg.exe
  2⤵
  PID:5816
- C:\Windows\System\aZxPwHz.exe
  C:\Windows\System\aZxPwHz.exe
  2⤵
  PID:5840
- C:\Windows\System\wLGbPOP.exe
  C:\Windows\System\wLGbPOP.exe
  2⤵
  PID:5872
- C:\Windows\System\KDtlmdL.exe
  C:\Windows\System\KDtlmdL.exe
  2⤵
  PID:5932
- C:\Windows\System\fMMjhED.exe
  C:\Windows\System\fMMjhED.exe
  2⤵
  PID:5980
- C:\Windows\System\FawCqvP.exe
  C:\Windows\System\FawCqvP.exe
  2⤵
  PID:6012
- C:\Windows\System\fheVzGl.exe
  C:\Windows\System\fheVzGl.exe
  2⤵
  PID:3416
- C:\Windows\System\OhgqyhJ.exe
  C:\Windows\System\OhgqyhJ.exe
  2⤵
  PID:3212
- C:\Windows\System\tsDmLVi.exe
  C:\Windows\System\tsDmLVi.exe
  2⤵
  PID:6100
- C:\Windows\System\TqYtnwx.exe
  C:\Windows\System\TqYtnwx.exe
  2⤵
  PID:624
- C:\Windows\System\baxWnlE.exe
  C:\Windows\System\baxWnlE.exe
  2⤵
  PID:2304
- C:\Windows\System\EDHsPLH.exe
  C:\Windows\System\EDHsPLH.exe
  2⤵
  PID:512
- C:\Windows\System\nskbgQj.exe
  C:\Windows\System\nskbgQj.exe
  2⤵
  PID:776
- C:\Windows\System\LPjTxrm.exe
  C:\Windows\System\LPjTxrm.exe
  2⤵
  PID:2232
- C:\Windows\System\OmunAbk.exe
  C:\Windows\System\OmunAbk.exe
  2⤵
  PID:5136
- C:\Windows\System\EYHtTxb.exe
  C:\Windows\System\EYHtTxb.exe
  2⤵
  PID:5048
- C:\Windows\System\FQAWVAI.exe
  C:\Windows\System\FQAWVAI.exe
  2⤵
  PID:888
- C:\Windows\System\kMYPEFE.exe
  C:\Windows\System\kMYPEFE.exe
  2⤵
  PID:5336
- C:\Windows\System\hckqNJl.exe
  C:\Windows\System\hckqNJl.exe
  2⤵
  PID:5284
- C:\Windows\System\iLIxJdq.exe
  C:\Windows\System\iLIxJdq.exe
  2⤵
  PID:1908
- C:\Windows\System\kAZTqGm.exe
  C:\Windows\System\kAZTqGm.exe
  2⤵
  PID:4328
- C:\Windows\System\QcVtnEF.exe
  C:\Windows\System\QcVtnEF.exe
  2⤵
  PID:5504
- C:\Windows\System\VCwmepL.exe
  C:\Windows\System\VCwmepL.exe
  2⤵
  PID:3720
- C:\Windows\System\KuLuHDP.exe
  C:\Windows\System\KuLuHDP.exe
  2⤵
  PID:320
- C:\Windows\System\cpHJAbI.exe
  C:\Windows\System\cpHJAbI.exe
  2⤵
  PID:1956
- C:\Windows\System\zXHQrwO.exe
  C:\Windows\System\zXHQrwO.exe
  2⤵
  PID:4536
- C:\Windows\System\sPaiVnj.exe
  C:\Windows\System\sPaiVnj.exe
  2⤵
  PID:3872
- C:\Windows\System\XCXNRDZ.exe
  C:\Windows\System\XCXNRDZ.exe
  2⤵
  PID:5868
- C:\Windows\System\RwqyGLI.exe
  C:\Windows\System\RwqyGLI.exe
  2⤵
  PID:5180
- C:\Windows\System\ulUawXI.exe
  C:\Windows\System\ulUawXI.exe
  2⤵
  PID:6164
- C:\Windows\System\fXzYwrm.exe
  C:\Windows\System\fXzYwrm.exe
  2⤵
  PID:6184
- C:\Windows\System\iEtiNlR.exe
  C:\Windows\System\iEtiNlR.exe
  2⤵
  PID:6200
- C:\Windows\System\HWeTIdW.exe
  C:\Windows\System\HWeTIdW.exe
  2⤵
  PID:6216
- C:\Windows\System\bJBdwda.exe
  C:\Windows\System\bJBdwda.exe
  2⤵
  PID:6236
- C:\Windows\System\AnLTieD.exe
  C:\Windows\System\AnLTieD.exe
  2⤵
  PID:6252
- C:\Windows\System\ptwblEU.exe
  C:\Windows\System\ptwblEU.exe
  2⤵
  PID:6272
- C:\Windows\System\YbQIrsv.exe
  C:\Windows\System\YbQIrsv.exe
  2⤵
  PID:6296
- C:\Windows\System\XrtWpNX.exe
  C:\Windows\System\XrtWpNX.exe
  2⤵
  PID:6312
- C:\Windows\System\gLqhlgV.exe
  C:\Windows\System\gLqhlgV.exe
  2⤵
  PID:6336
- C:\Windows\System\emzDlnw.exe
  C:\Windows\System\emzDlnw.exe
  2⤵
  PID:6360
- C:\Windows\System\DNstVjI.exe
  C:\Windows\System\DNstVjI.exe
  2⤵
  PID:6392
- C:\Windows\System\YttBkSG.exe
  C:\Windows\System\YttBkSG.exe
  2⤵
  PID:6412
- C:\Windows\System\DiPutNN.exe
  C:\Windows\System\DiPutNN.exe
  2⤵
  PID:6432
- C:\Windows\System\tHGkrXA.exe
  C:\Windows\System\tHGkrXA.exe
  2⤵
  PID:6448
- C:\Windows\System\DbXsmGH.exe
  C:\Windows\System\DbXsmGH.exe
  2⤵
  PID:6464
- C:\Windows\System\oBQeaIO.exe
  C:\Windows\System\oBQeaIO.exe
  2⤵
  PID:6484
- C:\Windows\System\aQQSqTB.exe
  C:\Windows\System\aQQSqTB.exe
  2⤵
  PID:6500
- C:\Windows\System\ogoTyQW.exe
  C:\Windows\System\ogoTyQW.exe
  2⤵
  PID:6516
- C:\Windows\System\MBUtvdZ.exe
  C:\Windows\System\MBUtvdZ.exe
  2⤵
  PID:6536
- C:\Windows\System\CZxgrwD.exe
  C:\Windows\System\CZxgrwD.exe
  2⤵
  PID:6556
- C:\Windows\System\DvStDBP.exe
  C:\Windows\System\DvStDBP.exe
  2⤵
  PID:6572
- C:\Windows\System\uCszOCw.exe
  C:\Windows\System\uCszOCw.exe
  2⤵
  PID:6592
- C:\Windows\System\vlxAUpi.exe
  C:\Windows\System\vlxAUpi.exe
  2⤵
  PID:6616
- C:\Windows\System\PvQehff.exe
  C:\Windows\System\PvQehff.exe
  2⤵
  PID:6636
- C:\Windows\System\FbFRRJk.exe
  C:\Windows\System\FbFRRJk.exe
  2⤵
  PID:6652
- C:\Windows\System\ElWZZDi.exe
  C:\Windows\System\ElWZZDi.exe
  2⤵
  PID:6676
- C:\Windows\System\DjJIQvj.exe
  C:\Windows\System\DjJIQvj.exe
  2⤵
  PID:6696
- C:\Windows\System\exAFUyE.exe
  C:\Windows\System\exAFUyE.exe
  2⤵
  PID:6720
- C:\Windows\System\zNWgmVa.exe
  C:\Windows\System\zNWgmVa.exe
  2⤵
  PID:6744
- C:\Windows\System\ZciMWPh.exe
  C:\Windows\System\ZciMWPh.exe
  2⤵
  PID:6764
- C:\Windows\System\STUxCqa.exe
  C:\Windows\System\STUxCqa.exe
  2⤵
  PID:6780
- C:\Windows\System\oVtnvAT.exe
  C:\Windows\System\oVtnvAT.exe
  2⤵
  PID:6808
- C:\Windows\System\cYJQdyb.exe
  C:\Windows\System\cYJQdyb.exe
  2⤵
  PID:6828
- C:\Windows\System\puECWZV.exe
  C:\Windows\System\puECWZV.exe
  2⤵
  PID:6844
- C:\Windows\System\RWYBxWY.exe
  C:\Windows\System\RWYBxWY.exe
  2⤵
  PID:6868
- C:\Windows\System\twjOwOS.exe
  C:\Windows\System\twjOwOS.exe
  2⤵
  PID:6884
- C:\Windows\System\YIovHHy.exe
  C:\Windows\System\YIovHHy.exe
  2⤵
  PID:6908
- C:\Windows\System\lcFNjFW.exe
  C:\Windows\System\lcFNjFW.exe
  2⤵
  PID:6932
- C:\Windows\System\gCmdusw.exe
  C:\Windows\System\gCmdusw.exe
  2⤵
  PID:6948
- C:\Windows\System\FNzunPA.exe
  C:\Windows\System\FNzunPA.exe
  2⤵
  PID:6964
- C:\Windows\System\lbusRUx.exe
  C:\Windows\System\lbusRUx.exe
  2⤵
  PID:6984
- C:\Windows\System\NoGYSIB.exe
  C:\Windows\System\NoGYSIB.exe
  2⤵
  PID:7004
- C:\Windows\System\WnmQGva.exe
  C:\Windows\System\WnmQGva.exe
  2⤵
  PID:7020
- C:\Windows\System\gkQpqBa.exe
  C:\Windows\System\gkQpqBa.exe
  2⤵
  PID:7044
- C:\Windows\System\JLyrSHu.exe
  C:\Windows\System\JLyrSHu.exe
  2⤵
  PID:7068
- C:\Windows\System\LalbxoH.exe
  C:\Windows\System\LalbxoH.exe
  2⤵
  PID:7092
- C:\Windows\System\gWHwHdL.exe
  C:\Windows\System\gWHwHdL.exe
  2⤵
  PID:7108
- C:\Windows\System\TEOiYgi.exe
  C:\Windows\System\TEOiYgi.exe
  2⤵
  PID:7128
- C:\Windows\System\iBHHyOp.exe
  C:\Windows\System\iBHHyOp.exe
  2⤵
  PID:7148
- C:\Windows\System\StYIjxb.exe
  C:\Windows\System\StYIjxb.exe
  2⤵
  PID:456
- C:\Windows\System\oNXybWE.exe
  C:\Windows\System\oNXybWE.exe
  2⤵
  PID:2248
- C:\Windows\System\BECeRZx.exe
  C:\Windows\System\BECeRZx.exe
  2⤵
  PID:6040
- C:\Windows\System\GdrORAF.exe
  C:\Windows\System\GdrORAF.exe
  2⤵
  PID:2808
- C:\Windows\System\BIFMhVH.exe
  C:\Windows\System\BIFMhVH.exe
  2⤵
  PID:6180
- C:\Windows\System\aRSMsWo.exe
  C:\Windows\System\aRSMsWo.exe
  2⤵
  PID:2196
- C:\Windows\System\xJLKciP.exe
  C:\Windows\System\xJLKciP.exe
  2⤵
  PID:2736
- C:\Windows\System\TycmwFy.exe
  C:\Windows\System\TycmwFy.exe
  2⤵
  PID:744
- C:\Windows\System\bWnPEbh.exe
  C:\Windows\System\bWnPEbh.exe
  2⤵
  PID:2600
- C:\Windows\System\lsSROBz.exe
  C:\Windows\System\lsSROBz.exe
  2⤵
  PID:5164
- C:\Windows\System\PpzZgPp.exe
  C:\Windows\System\PpzZgPp.exe
  2⤵
  PID:6424
- C:\Windows\System\cyNNkDq.exe
  C:\Windows\System\cyNNkDq.exe
  2⤵
  PID:6212
- C:\Windows\System\dEMbIgO.exe
  C:\Windows\System\dEMbIgO.exe
  2⤵
  PID:6612
- C:\Windows\System\HQtNwrv.exe
  C:\Windows\System\HQtNwrv.exe
  2⤵
  PID:6308
- C:\Windows\System\WVqrgcZ.exe
  C:\Windows\System\WVqrgcZ.exe
  2⤵
  PID:6332
- C:\Windows\System\kyXTSGc.exe
  C:\Windows\System\kyXTSGc.exe
  2⤵
  PID:6352
- C:\Windows\System\pJoXaxQ.exe
  C:\Windows\System\pJoXaxQ.exe
  2⤵
  PID:4076
- C:\Windows\System\xtwZQrT.exe
  C:\Windows\System\xtwZQrT.exe
  2⤵
  PID:6880
- C:\Windows\System\EzbNwka.exe
  C:\Windows\System\EzbNwka.exe
  2⤵
  PID:6900
- C:\Windows\System\okRCrMw.exe
  C:\Windows\System\okRCrMw.exe
  2⤵
  PID:7176
- C:\Windows\System\qcgHRKz.exe
  C:\Windows\System\qcgHRKz.exe
  2⤵
  PID:7196
- C:\Windows\System\vZQtHKr.exe
  C:\Windows\System\vZQtHKr.exe
  2⤵
  PID:7212
- C:\Windows\System\FITrJLU.exe
  C:\Windows\System\FITrJLU.exe
  2⤵
  PID:7236
- C:\Windows\System\FjpNQBG.exe
  C:\Windows\System\FjpNQBG.exe
  2⤵
  PID:7260
- C:\Windows\System\LwZydKx.exe
  C:\Windows\System\LwZydKx.exe
  2⤵
  PID:7280
- C:\Windows\System\mSFrTDI.exe
  C:\Windows\System\mSFrTDI.exe
  2⤵
  PID:7296
- C:\Windows\System\yrPVFVe.exe
  C:\Windows\System\yrPVFVe.exe
  2⤵
  PID:7316
- C:\Windows\System\jBTAOGf.exe
  C:\Windows\System\jBTAOGf.exe
  2⤵
  PID:7336
- C:\Windows\System\oyleJOd.exe
  C:\Windows\System\oyleJOd.exe
  2⤵
  PID:7352
- C:\Windows\System\zYpbFHA.exe
  C:\Windows\System\zYpbFHA.exe
  2⤵
  PID:7372
- C:\Windows\System\tRPAiLy.exe
  C:\Windows\System\tRPAiLy.exe
  2⤵
  PID:7392
- C:\Windows\System\iFjiWgw.exe
  C:\Windows\System\iFjiWgw.exe
  2⤵
  PID:7412
- C:\Windows\System\mWnVxno.exe
  C:\Windows\System\mWnVxno.exe
  2⤵
  PID:7432
- C:\Windows\System\QpvjSMS.exe
  C:\Windows\System\QpvjSMS.exe
  2⤵
  PID:7452
- C:\Windows\System\mLeMIvR.exe
  C:\Windows\System\mLeMIvR.exe
  2⤵
  PID:7476
- C:\Windows\System\UxOnENv.exe
  C:\Windows\System\UxOnENv.exe
  2⤵
  PID:7492
- C:\Windows\System\LJIXVEl.exe
  C:\Windows\System\LJIXVEl.exe
  2⤵
  PID:7520
- C:\Windows\System\TrbIXXi.exe
  C:\Windows\System\TrbIXXi.exe
  2⤵
  PID:7536
- C:\Windows\System\vxRDJEF.exe
  C:\Windows\System\vxRDJEF.exe
  2⤵
  PID:7556
- C:\Windows\System\GFBWHBo.exe
  C:\Windows\System\GFBWHBo.exe
  2⤵
  PID:7572
- C:\Windows\System\AwWsqXY.exe
  C:\Windows\System\AwWsqXY.exe
  2⤵
  PID:7596
- C:\Windows\System\WDzhhrh.exe
  C:\Windows\System\WDzhhrh.exe
  2⤵
  PID:7616
- C:\Windows\System\bQOKXfu.exe
  C:\Windows\System\bQOKXfu.exe
  2⤵
  PID:7636
- C:\Windows\System\gVQDgkZ.exe
  C:\Windows\System\gVQDgkZ.exe
  2⤵
  PID:7652
- C:\Windows\System\OqQAqcs.exe
  C:\Windows\System\OqQAqcs.exe
  2⤵
  PID:7668
- C:\Windows\System\rCHCYRj.exe
  C:\Windows\System\rCHCYRj.exe
  2⤵
  PID:7688
- C:\Windows\System\QgDTQCO.exe
  C:\Windows\System\QgDTQCO.exe
  2⤵
  PID:7708
- C:\Windows\System\WkKKFXD.exe
  C:\Windows\System\WkKKFXD.exe
  2⤵
  PID:7724
- C:\Windows\System\ajRiBob.exe
  C:\Windows\System\ajRiBob.exe
  2⤵
  PID:7740
- C:\Windows\System\HFXmiRb.exe
  C:\Windows\System\HFXmiRb.exe
  2⤵
  PID:7764
- C:\Windows\System\JJVbEhj.exe
  C:\Windows\System\JJVbEhj.exe
  2⤵
  PID:7784
- C:\Windows\System\BYPrRqB.exe
  C:\Windows\System\BYPrRqB.exe
  2⤵
  PID:7804
- C:\Windows\System\ZJbqLRw.exe
  C:\Windows\System\ZJbqLRw.exe
  2⤵
  PID:7828
- C:\Windows\System\ItwJsVS.exe
  C:\Windows\System\ItwJsVS.exe
  2⤵
  PID:7852
- C:\Windows\System\BAcrKJw.exe
  C:\Windows\System\BAcrKJw.exe
  2⤵
  PID:7872
- C:\Windows\System\ECkWEEJ.exe
  C:\Windows\System\ECkWEEJ.exe
  2⤵
  PID:7896
- C:\Windows\System\xSPkGin.exe
  C:\Windows\System\xSPkGin.exe
  2⤵
  PID:7924
- C:\Windows\System\TmGKXJt.exe
  C:\Windows\System\TmGKXJt.exe
  2⤵
  PID:7944
- C:\Windows\System\SqwoRqM.exe
  C:\Windows\System\SqwoRqM.exe
  2⤵
  PID:7964
- C:\Windows\System\enAebCn.exe
  C:\Windows\System\enAebCn.exe
  2⤵
  PID:7988
- C:\Windows\System\dNBAQMq.exe
  C:\Windows\System\dNBAQMq.exe
  2⤵
  PID:8008
- C:\Windows\System\ThNpCld.exe
  C:\Windows\System\ThNpCld.exe
  2⤵
  PID:8024
- C:\Windows\System\AMpqFoA.exe
  C:\Windows\System\AMpqFoA.exe
  2⤵
  PID:8048
- C:\Windows\System\LOsmgNn.exe
  C:\Windows\System\LOsmgNn.exe
  2⤵
  PID:8072
- C:\Windows\System\CwdhYdT.exe
  C:\Windows\System\CwdhYdT.exe
  2⤵
  PID:8088
- C:\Windows\System\jYLzcPL.exe
  C:\Windows\System\jYLzcPL.exe
  2⤵
  PID:8112
- C:\Windows\System\YhCbWIn.exe
  C:\Windows\System\YhCbWIn.exe
  2⤵
  PID:8136
- C:\Windows\System\kybGfEf.exe
  C:\Windows\System\kybGfEf.exe
  2⤵
  PID:8156
- C:\Windows\System\cVvoHmo.exe
  C:\Windows\System\cVvoHmo.exe
  2⤵
  PID:8176
- C:\Windows\System\TbZnujr.exe
  C:\Windows\System\TbZnujr.exe
  2⤵
  PID:6228
- C:\Windows\System\bhijsek.exe
  C:\Windows\System\bhijsek.exe
  2⤵
  PID:6568
- C:\Windows\System\bMctShy.exe
  C:\Windows\System\bMctShy.exe
  2⤵
  PID:7012
- C:\Windows\System\ycrLxiQ.exe
  C:\Windows\System\ycrLxiQ.exe
  2⤵
  PID:7040
- C:\Windows\System\iaCPJUJ.exe
  C:\Windows\System\iaCPJUJ.exe
  2⤵
  PID:7076
- C:\Windows\System\VOPsyqK.exe
  C:\Windows\System\VOPsyqK.exe
  2⤵
  PID:5704
- C:\Windows\System\kEeIdFB.exe
  C:\Windows\System\kEeIdFB.exe
  2⤵
  PID:6760
- C:\Windows\System\uCbNxfb.exe
  C:\Windows\System\uCbNxfb.exe
  2⤵
  PID:6404
- C:\Windows\System\fhszmOh.exe
  C:\Windows\System\fhszmOh.exe
  2⤵
  PID:6172
- C:\Windows\System\mwBNTfN.exe
  C:\Windows\System\mwBNTfN.exe
  2⤵
  PID:6512
- C:\Windows\System\nyhxBdv.exe
  C:\Windows\System\nyhxBdv.exe
  2⤵
  PID:7364
- C:\Windows\System\vjqjPJh.exe
  C:\Windows\System\vjqjPJh.exe
  2⤵
  PID:7488
- C:\Windows\System\vvAAyWE.exe
  C:\Windows\System\vvAAyWE.exe
  2⤵
  PID:7164
- C:\Windows\System\QfcEwKU.exe
  C:\Windows\System\QfcEwKU.exe
  2⤵
  PID:6688
- C:\Windows\System\lgNwiog.exe
  C:\Windows\System\lgNwiog.exe
  2⤵
  PID:8208
- C:\Windows\System\AuwQruw.exe
  C:\Windows\System\AuwQruw.exe
  2⤵
  PID:8224
- C:\Windows\System\XFnxiwM.exe
  C:\Windows\System\XFnxiwM.exe
  2⤵
  PID:8244
- C:\Windows\System\HgmrrfA.exe
  C:\Windows\System\HgmrrfA.exe
  2⤵
  PID:8264
- C:\Windows\System\DNLQPqP.exe
  C:\Windows\System\DNLQPqP.exe
  2⤵
  PID:8280
- C:\Windows\System\jsZblAT.exe
  C:\Windows\System\jsZblAT.exe
  2⤵
  PID:8312
- C:\Windows\System\hiYJDdn.exe
  C:\Windows\System\hiYJDdn.exe
  2⤵
  PID:8332
- C:\Windows\System\Zfozzoz.exe
  C:\Windows\System\Zfozzoz.exe
  2⤵
  PID:8352
- C:\Windows\System\bXAHmAs.exe
  C:\Windows\System\bXAHmAs.exe
  2⤵
  PID:8380
- C:\Windows\System\iBJdGaZ.exe
  C:\Windows\System\iBJdGaZ.exe
  2⤵
  PID:8400
- C:\Windows\System\peyZobS.exe
  C:\Windows\System\peyZobS.exe
  2⤵
  PID:8416
- C:\Windows\System\BNXCMnC.exe
  C:\Windows\System\BNXCMnC.exe
  2⤵
  PID:8436
- C:\Windows\System\JGysWxd.exe
  C:\Windows\System\JGysWxd.exe
  2⤵
  PID:8460
- C:\Windows\System\LeZZAhT.exe
  C:\Windows\System\LeZZAhT.exe
  2⤵
  PID:8480
- C:\Windows\System\PswfUhm.exe
  C:\Windows\System\PswfUhm.exe
  2⤵
  PID:8500
- C:\Windows\System\gEmTRnn.exe
  C:\Windows\System\gEmTRnn.exe
  2⤵
  PID:8544
- C:\Windows\System\mFHWeWr.exe
  C:\Windows\System\mFHWeWr.exe
  2⤵
  PID:8560
- C:\Windows\System\YAtbyop.exe
  C:\Windows\System\YAtbyop.exe
  2⤵
  PID:8576
- C:\Windows\System\NOwfPBH.exe
  C:\Windows\System\NOwfPBH.exe
  2⤵
  PID:8592
- C:\Windows\System\vIyFQHh.exe
  C:\Windows\System\vIyFQHh.exe
  2⤵
  PID:8616
- C:\Windows\System\Fpovxpx.exe
  C:\Windows\System\Fpovxpx.exe
  2⤵
  PID:8640
- C:\Windows\System\mkBVvuo.exe
  C:\Windows\System\mkBVvuo.exe
  2⤵
  PID:8656
- C:\Windows\System\dstzzNK.exe
  C:\Windows\System\dstzzNK.exe
  2⤵
  PID:8672
- C:\Windows\System\PtQZPEd.exe
  C:\Windows\System\PtQZPEd.exe
  2⤵
  PID:8688
- C:\Windows\System\KVzLMJW.exe
  C:\Windows\System\KVzLMJW.exe
  2⤵
  PID:8712
- C:\Windows\System\MYYEtwW.exe
  C:\Windows\System\MYYEtwW.exe
  2⤵
  PID:8732
- C:\Windows\System\iKFtWtM.exe
  C:\Windows\System\iKFtWtM.exe
  2⤵
  PID:8752
- C:\Windows\System\kTzjYtI.exe
  C:\Windows\System\kTzjYtI.exe
  2⤵
  PID:8776
- C:\Windows\System\ClLjtsQ.exe
  C:\Windows\System\ClLjtsQ.exe
  2⤵
  PID:8800
- C:\Windows\System\YyMVsBm.exe
  C:\Windows\System\YyMVsBm.exe
  2⤵
  PID:8816
- C:\Windows\System\Kwnotit.exe
  C:\Windows\System\Kwnotit.exe
  2⤵
  PID:8840
- C:\Windows\System\QciAwbh.exe
  C:\Windows\System\QciAwbh.exe
  2⤵
  PID:8860
- C:\Windows\System\dsXkWOT.exe
  C:\Windows\System\dsXkWOT.exe
  2⤵
  PID:8876
- C:\Windows\System\gxPLgYp.exe
  C:\Windows\System\gxPLgYp.exe
  2⤵
  PID:8892
- C:\Windows\System\dyJkyhe.exe
  C:\Windows\System\dyJkyhe.exe
  2⤵
  PID:8912
- C:\Windows\System\tCGkPMg.exe
  C:\Windows\System\tCGkPMg.exe
  2⤵
  PID:8932
- C:\Windows\System\eCmKzNo.exe
  C:\Windows\System\eCmKzNo.exe
  2⤵
  PID:8948
- C:\Windows\System\YkzfKEp.exe
  C:\Windows\System\YkzfKEp.exe
  2⤵
  PID:8972
- C:\Windows\System\gMDZWOU.exe
  C:\Windows\System\gMDZWOU.exe
  2⤵
  PID:8988
- C:\Windows\System\rXPCJCv.exe
  C:\Windows\System\rXPCJCv.exe
  2⤵
  PID:9012
- C:\Windows\System\QbUgBzI.exe
  C:\Windows\System\QbUgBzI.exe
  2⤵
  PID:9028
- C:\Windows\System\UoxJaFj.exe
  C:\Windows\System\UoxJaFj.exe
  2⤵
  PID:9056
- C:\Windows\System\BKqPJtM.exe
  C:\Windows\System\BKqPJtM.exe
  2⤵
  PID:9076
- C:\Windows\System\pMSzgpa.exe
  C:\Windows\System\pMSzgpa.exe
  2⤵
  PID:9100
- C:\Windows\System\zZMkXEH.exe
  C:\Windows\System\zZMkXEH.exe
  2⤵
  PID:9120
- C:\Windows\System\wgYdhRh.exe
  C:\Windows\System\wgYdhRh.exe
  2⤵
  PID:9140
- C:\Windows\System\vERVCQx.exe
  C:\Windows\System\vERVCQx.exe
  2⤵
  PID:9160
- C:\Windows\System\lUKHzHe.exe
  C:\Windows\System\lUKHzHe.exe
  2⤵
  PID:9180
- C:\Windows\System\GTxjPeZ.exe
  C:\Windows\System\GTxjPeZ.exe
  2⤵
  PID:9200
- C:\Windows\System\AdSsbdE.exe
  C:\Windows\System\AdSsbdE.exe
  2⤵
  PID:6716
- C:\Windows\System\GgXJMXy.exe
  C:\Windows\System\GgXJMXy.exe
  2⤵
  PID:7628
- C:\Windows\System\ixmGivk.exe
  C:\Windows\System\ixmGivk.exe
  2⤵
  PID:7664
- C:\Windows\System\dSmPcIM.exe
  C:\Windows\System\dSmPcIM.exe
  2⤵
  PID:4896
- C:\Windows\System\LDRmyZE.exe
  C:\Windows\System\LDRmyZE.exe
  2⤵
  PID:6796
- C:\Windows\System\bcQhTZO.exe
  C:\Windows\System\bcQhTZO.exe
  2⤵
  PID:6916
- C:\Windows\System\VgVzPYX.exe
  C:\Windows\System\VgVzPYX.exe
  2⤵
  PID:7932
- C:\Windows\System\gGEANQq.exe
  C:\Windows\System\gGEANQq.exe
  2⤵
  PID:6940
- C:\Windows\System\MUjUFXW.exe
  C:\Windows\System\MUjUFXW.exe
  2⤵
  PID:6992
- C:\Windows\System\pBeMkxH.exe
  C:\Windows\System\pBeMkxH.exe
  2⤵
  PID:8032
- C:\Windows\System\xPVcwgB.exe
  C:\Windows\System\xPVcwgB.exe
  2⤵
  PID:7332
- C:\Windows\System\MMfJLUS.exe
  C:\Windows\System\MMfJLUS.exe
  2⤵
  PID:7368
- C:\Windows\System\erbxEJy.exe
  C:\Windows\System\erbxEJy.exe
  2⤵
  PID:7384
- C:\Windows\System\ySYUGDY.exe
  C:\Windows\System\ySYUGDY.exe
  2⤵
  PID:7408
- C:\Windows\System\xEVmIMS.exe
  C:\Windows\System\xEVmIMS.exe
  2⤵
  PID:7472
- C:\Windows\System\hHGoAtM.exe
  C:\Windows\System\hHGoAtM.exe
  2⤵
  PID:7140
- C:\Windows\System\dxSdULt.exe
  C:\Windows\System\dxSdULt.exe
  2⤵
  PID:7324
- C:\Windows\System\iDdniCG.exe
  C:\Windows\System\iDdniCG.exe
  2⤵
  PID:7464
- C:\Windows\System\tADhPpf.exe
  C:\Windows\System\tADhPpf.exe
  2⤵
  PID:6128
- C:\Windows\System\kpRxiWm.exe
  C:\Windows\System\kpRxiWm.exe
  2⤵
  PID:8200
- C:\Windows\System\kecDqGG.exe
  C:\Windows\System\kecDqGG.exe
  2⤵
  PID:7680
- C:\Windows\System\syXsNEg.exe
  C:\Windows\System\syXsNEg.exe
  2⤵
  PID:8276
- C:\Windows\System\fklsEek.exe
  C:\Windows\System\fklsEek.exe
  2⤵
  PID:9220
- C:\Windows\System\DtOScsA.exe
  C:\Windows\System\DtOScsA.exe
  2⤵
  PID:9236
- C:\Windows\System\ZjyIJsp.exe
  C:\Windows\System\ZjyIJsp.exe
  2⤵
  PID:9260
- C:\Windows\System\OqbBfTm.exe
  C:\Windows\System\OqbBfTm.exe
  2⤵
  PID:9280
- C:\Windows\System\ixEVgpS.exe
  C:\Windows\System\ixEVgpS.exe
  2⤵
  PID:9300
- C:\Windows\System\eerFmCz.exe
  C:\Windows\System\eerFmCz.exe
  2⤵
  PID:9320
- C:\Windows\System\LbiMnKH.exe
  C:\Windows\System\LbiMnKH.exe
  2⤵
  PID:9336
- C:\Windows\System\afSPnIu.exe
  C:\Windows\System\afSPnIu.exe
  2⤵
  PID:9352
- C:\Windows\System\hVlQqGr.exe
  C:\Windows\System\hVlQqGr.exe
  2⤵
  PID:9376
- C:\Windows\System\Litqndf.exe
  C:\Windows\System\Litqndf.exe
  2⤵
  PID:9396
- C:\Windows\System\Cqffpah.exe
  C:\Windows\System\Cqffpah.exe
  2⤵
  PID:9420
- C:\Windows\System\dcwMXrp.exe
  C:\Windows\System\dcwMXrp.exe
  2⤵
  PID:9436
- C:\Windows\System\vOxQBDd.exe
  C:\Windows\System\vOxQBDd.exe
  2⤵
  PID:9456
- C:\Windows\System\CbCyrcj.exe
  C:\Windows\System\CbCyrcj.exe
  2⤵
  PID:9476
- C:\Windows\System\GOzJFQU.exe
  C:\Windows\System\GOzJFQU.exe
  2⤵
  PID:9500
- C:\Windows\System\VkFFclj.exe
  C:\Windows\System\VkFFclj.exe
  2⤵
  PID:9524
- C:\Windows\System\wUsKOoN.exe
  C:\Windows\System\wUsKOoN.exe
  2⤵
  PID:9544
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 9544 -s 248
    3⤵
    PID:9496
- C:\Windows\System\odEjTbX.exe
  C:\Windows\System\odEjTbX.exe
  2⤵
  PID:9572
- C:\Windows\System\amMmtRT.exe
  C:\Windows\System\amMmtRT.exe
  2⤵
  PID:9592
- C:\Windows\System\HAWXEwf.exe
  C:\Windows\System\HAWXEwf.exe
  2⤵
  PID:9612
- C:\Windows\System\fmnUWWx.exe
  C:\Windows\System\fmnUWWx.exe
  2⤵
  PID:9632
- C:\Windows\System\EMGnSEy.exe
  C:\Windows\System\EMGnSEy.exe
  2⤵
  PID:9660
- C:\Windows\System\BWXvbXe.exe
  C:\Windows\System\BWXvbXe.exe
  2⤵
  PID:9680
- C:\Windows\System\wKIGCAP.exe
  C:\Windows\System\wKIGCAP.exe
  2⤵
  PID:9696
- C:\Windows\System\FQJGcNz.exe
  C:\Windows\System\FQJGcNz.exe
  2⤵
  PID:9720
- C:\Windows\System\izYGIxU.exe
  C:\Windows\System\izYGIxU.exe
  2⤵
  PID:9744
- C:\Windows\System\fljMvgl.exe
  C:\Windows\System\fljMvgl.exe
  2⤵
  PID:9764
- C:\Windows\System\FhpCcgD.exe
  C:\Windows\System\FhpCcgD.exe
  2⤵
  PID:9808
- C:\Windows\System\VEpyzUy.exe
  C:\Windows\System\VEpyzUy.exe
  2⤵
  PID:9828
- C:\Windows\System\aonVHpv.exe
  C:\Windows\System\aonVHpv.exe
  2⤵
  PID:9856
- C:\Windows\System\sZyoHql.exe
  C:\Windows\System\sZyoHql.exe
  2⤵
  PID:9872
- C:\Windows\System\lixMbwh.exe
  C:\Windows\System\lixMbwh.exe
  2⤵
  PID:9888
- C:\Windows\System\mNhacGj.exe
  C:\Windows\System\mNhacGj.exe
  2⤵
  PID:9904
- C:\Windows\System\OHhQuqH.exe
  C:\Windows\System\OHhQuqH.exe
  2⤵
  PID:9920
- C:\Windows\System\XKLCSXU.exe
  C:\Windows\System\XKLCSXU.exe
  2⤵
  PID:9936
- C:\Windows\System\tNaVExI.exe
  C:\Windows\System\tNaVExI.exe
  2⤵
  PID:9952
- C:\Windows\System\ygIEBXO.exe
  C:\Windows\System\ygIEBXO.exe
  2⤵
  PID:9972
- C:\Windows\System\lpvghaT.exe
  C:\Windows\System\lpvghaT.exe
  2⤵
  PID:9992
- C:\Windows\System\MOjjOsf.exe
  C:\Windows\System\MOjjOsf.exe
  2⤵
  PID:10012
- C:\Windows\System\GHXrzsi.exe
  C:\Windows\System\GHXrzsi.exe
  2⤵
  PID:10028
- C:\Windows\System\wggJoOe.exe
  C:\Windows\System\wggJoOe.exe
  2⤵
  PID:10048
- C:\Windows\System\nLLBsat.exe
  C:\Windows\System\nLLBsat.exe
  2⤵
  PID:10072
- C:\Windows\System\TpTNJCv.exe
  C:\Windows\System\TpTNJCv.exe
  2⤵
  PID:10088
- C:\Windows\System\gSlxKOT.exe
  C:\Windows\System\gSlxKOT.exe
  2⤵
  PID:10112
- C:\Windows\System\AhzMhrb.exe
  C:\Windows\System\AhzMhrb.exe
  2⤵
  PID:10132
- C:\Windows\System\ZTcAqDy.exe
  C:\Windows\System\ZTcAqDy.exe
  2⤵
  PID:10152
- C:\Windows\System\zYvXrbd.exe
  C:\Windows\System\zYvXrbd.exe
  2⤵
  PID:10168
- C:\Windows\System\leSzCrG.exe
  C:\Windows\System\leSzCrG.exe
  2⤵
  PID:10188
- C:\Windows\System\LTjUUmu.exe
  C:\Windows\System\LTjUUmu.exe
  2⤵
  PID:10208
- C:\Windows\System\QrLFKZa.exe
  C:\Windows\System\QrLFKZa.exe
  2⤵
  PID:10228
- C:\Windows\System\NFEQGFB.exe
  C:\Windows\System\NFEQGFB.exe
  2⤵
  PID:7752
- C:\Windows\System\hKSnycS.exe
  C:\Windows\System\hKSnycS.exe
  2⤵
  PID:6328
- C:\Windows\System\BFuXiez.exe
  C:\Windows\System\BFuXiez.exe
  2⤵
  PID:7848
- C:\Windows\System\PUkgdKz.exe
  C:\Windows\System\PUkgdKz.exe
  2⤵
  PID:6740
- C:\Windows\System\MEYXZgN.exe
  C:\Windows\System\MEYXZgN.exe
  2⤵
  PID:8424
- C:\Windows\System\EIKlsie.exe
  C:\Windows\System\EIKlsie.exe
  2⤵
  PID:8452
- C:\Windows\System\xHIGked.exe
  C:\Windows\System\xHIGked.exe
  2⤵
  PID:7268
- C:\Windows\System\aDbgToO.exe
  C:\Windows\System\aDbgToO.exe
  2⤵
  PID:7304
- C:\Windows\System\fKRfiWd.exe
  C:\Windows\System\fKRfiWd.exe
  2⤵
  PID:8764
- C:\Windows\System\uaXdaIN.exe
  C:\Windows\System\uaXdaIN.exe
  2⤵
  PID:8824
- C:\Windows\System\bgcTuVR.exe
  C:\Windows\System\bgcTuVR.exe
  2⤵
  PID:8996
- C:\Windows\System\nelJdym.exe
  C:\Windows\System\nelJdym.exe
  2⤵
  PID:9044
- C:\Windows\System\AxPyOja.exe
  C:\Windows\System\AxPyOja.exe
  2⤵
  PID:7120
- C:\Windows\System\TWwUptR.exe
  C:\Windows\System\TWwUptR.exe
  2⤵
  PID:7428
- C:\Windows\System\rzcgCQT.exe
  C:\Windows\System\rzcgCQT.exe
  2⤵
  PID:7644
- C:\Windows\System\zKVicxD.exe
  C:\Windows\System\zKVicxD.exe
  2⤵
  PID:7580
- C:\Windows\System\UJMsOTD.exe
  C:\Windows\System\UJMsOTD.exe
  2⤵
  PID:7696
- C:\Windows\System\ZbOkqnH.exe
  C:\Windows\System\ZbOkqnH.exe
  2⤵
  PID:7608
- C:\Windows\System\nhCwrkk.exe
  C:\Windows\System\nhCwrkk.exe
  2⤵
  PID:10264
- C:\Windows\System\cTstXiS.exe
  C:\Windows\System\cTstXiS.exe
  2⤵
  PID:10280
- C:\Windows\System\AKCemHM.exe
  C:\Windows\System\AKCemHM.exe
  2⤵
  PID:10304
- C:\Windows\System\CKpvJkQ.exe
  C:\Windows\System\CKpvJkQ.exe
  2⤵
  PID:10324
- C:\Windows\System\bFrEMQw.exe
  C:\Windows\System\bFrEMQw.exe
  2⤵
  PID:10344
- C:\Windows\System\NGAWihR.exe
  C:\Windows\System\NGAWihR.exe
  2⤵
  PID:10364
- C:\Windows\System\LEmsqJI.exe
  C:\Windows\System\LEmsqJI.exe
  2⤵
  PID:10384
- C:\Windows\System\zCbUrAF.exe
  C:\Windows\System\zCbUrAF.exe
  2⤵
  PID:10408
- C:\Windows\System\LfxvwJI.exe
  C:\Windows\System\LfxvwJI.exe
  2⤵
  PID:10428
- C:\Windows\System\qrvUJfO.exe
  C:\Windows\System\qrvUJfO.exe
  2⤵
  PID:10452
- C:\Windows\System\AaRrOPW.exe
  C:\Windows\System\AaRrOPW.exe
  2⤵
  PID:10472
- C:\Windows\System\QbWwCez.exe
  C:\Windows\System\QbWwCez.exe
  2⤵
  PID:10492
- C:\Windows\System\TVnPqEm.exe
  C:\Windows\System\TVnPqEm.exe
  2⤵
  PID:10508
- C:\Windows\System\yYRcHXn.exe
  C:\Windows\System\yYRcHXn.exe
  2⤵
  PID:10536
- C:\Windows\System\vbNwcEc.exe
  C:\Windows\System\vbNwcEc.exe
  2⤵
  PID:10556
- C:\Windows\System\qouHeST.exe
  C:\Windows\System\qouHeST.exe
  2⤵
  PID:10576
- C:\Windows\System\cYdZKBB.exe
  C:\Windows\System\cYdZKBB.exe
  2⤵
  PID:10596
- C:\Windows\System\xAwxWsi.exe
  C:\Windows\System\xAwxWsi.exe
  2⤵
  PID:10620
- C:\Windows\System\XkpYqMk.exe
  C:\Windows\System\XkpYqMk.exe
  2⤵
  PID:10640
- C:\Windows\System\voOhevz.exe
  C:\Windows\System\voOhevz.exe
  2⤵
  PID:10660
- C:\Windows\System\MWNgJeI.exe
  C:\Windows\System\MWNgJeI.exe
  2⤵
  PID:10684
- C:\Windows\System\LODIlQg.exe
  C:\Windows\System\LODIlQg.exe
  2⤵
  PID:10708
- C:\Windows\System\jRoXhyl.exe
  C:\Windows\System\jRoXhyl.exe
  2⤵
  PID:10732
- C:\Windows\System\PlkHewA.exe
  C:\Windows\System\PlkHewA.exe
  2⤵
  PID:10748
- C:\Windows\System\alpUEyE.exe
  C:\Windows\System\alpUEyE.exe
  2⤵
  PID:10768
- C:\Windows\System\XETiuNb.exe
  C:\Windows\System\XETiuNb.exe
  2⤵
  PID:10788
- C:\Windows\System\jfkInzO.exe
  C:\Windows\System\jfkInzO.exe
  2⤵
  PID:10812
- C:\Windows\System\qnYIqEO.exe
  C:\Windows\System\qnYIqEO.exe
  2⤵
  PID:10832
- C:\Windows\System\PNqRICJ.exe
  C:\Windows\System\PNqRICJ.exe
  2⤵
  PID:10852
- C:\Windows\System\EqqQZCG.exe
  C:\Windows\System\EqqQZCG.exe
  2⤵
  PID:10884
- C:\Windows\System\VkKUsbN.exe
  C:\Windows\System\VkKUsbN.exe
  2⤵
  PID:10904
- C:\Windows\System\WFxVIZd.exe
  C:\Windows\System\WFxVIZd.exe
  2⤵
  PID:10920
- C:\Windows\System\nXHRhnu.exe
  C:\Windows\System\nXHRhnu.exe
  2⤵
  PID:10940
- C:\Windows\System\BndbYkp.exe
  C:\Windows\System\BndbYkp.exe
  2⤵
  PID:10964
- C:\Windows\System\aWtwvLf.exe
  C:\Windows\System\aWtwvLf.exe
  2⤵
  PID:10984
- C:\Windows\System\GhHiqNu.exe
  C:\Windows\System\GhHiqNu.exe
  2⤵
  PID:11004
- C:\Windows\System\ZXmWNsD.exe
  C:\Windows\System\ZXmWNsD.exe
  2⤵
  PID:11028
- C:\Windows\System\JHzIhzx.exe
  C:\Windows\System\JHzIhzx.exe
  2⤵
  PID:11052
- C:\Windows\System\ndhitYG.exe
  C:\Windows\System\ndhitYG.exe
  2⤵
  PID:11072
- C:\Windows\System\bZiEgtF.exe
  C:\Windows\System\bZiEgtF.exe
  2⤵
  PID:11088
- C:\Windows\System\egpYbHy.exe
  C:\Windows\System\egpYbHy.exe
  2⤵
  PID:11108
- C:\Windows\System\gZtjYyq.exe
  C:\Windows\System\gZtjYyq.exe
  2⤵
  PID:11124
- C:\Windows\System\UHMGVqX.exe
  C:\Windows\System\UHMGVqX.exe
  2⤵
  PID:11144
- C:\Windows\System\KzxvAcx.exe
  C:\Windows\System\KzxvAcx.exe
  2⤵
  PID:11160
- C:\Windows\System\gwQLeUR.exe
  C:\Windows\System\gwQLeUR.exe
  2⤵
  PID:11176
- C:\Windows\System\sMLmyEW.exe
  C:\Windows\System\sMLmyEW.exe
  2⤵
  PID:11192
- C:\Windows\System\TKWoCBX.exe
  C:\Windows\System\TKWoCBX.exe
  2⤵
  PID:11208
- C:\Windows\System\vAmcUKG.exe
  C:\Windows\System\vAmcUKG.exe
  2⤵
  PID:11228
- C:\Windows\System\yzcDnFN.exe
  C:\Windows\System\yzcDnFN.exe
  2⤵
  PID:11244
- C:\Windows\System\RRkOAwV.exe
  C:\Windows\System\RRkOAwV.exe
  2⤵
  PID:11260
- C:\Windows\System\cLommzx.exe
  C:\Windows\System\cLommzx.exe
  2⤵
  PID:7136
- C:\Windows\System\LtlaArM.exe
  C:\Windows\System\LtlaArM.exe
  2⤵
  PID:8232
- C:\Windows\System\vwbcpHG.exe
  C:\Windows\System\vwbcpHG.exe
  2⤵
  PID:5344
- C:\Windows\System\vRyIlJg.exe
  C:\Windows\System\vRyIlJg.exe
  2⤵
  PID:9252
- C:\Windows\System\okxinXE.exe
  C:\Windows\System\okxinXE.exe
  2⤵
  PID:7776
- C:\Windows\System\FvrgGdZ.exe
  C:\Windows\System\FvrgGdZ.exe
  2⤵
  PID:9344
- C:\Windows\System\NrPNGOC.exe
  C:\Windows\System\NrPNGOC.exe
  2⤵
  PID:9444
- C:\Windows\System\ssdcodb.exe
  C:\Windows\System\ssdcodb.exe
  2⤵
  PID:7912
- C:\Windows\System\GGtDSIE.exe
  C:\Windows\System\GGtDSIE.exe
  2⤵
  PID:7956
- C:\Windows\System\HdFYHvF.exe
  C:\Windows\System\HdFYHvF.exe
  2⤵
  PID:9628
- C:\Windows\System\VXrOrtv.exe
  C:\Windows\System\VXrOrtv.exe
  2⤵
  PID:8492
- C:\Windows\System\TTFGqwZ.exe
  C:\Windows\System\TTFGqwZ.exe
  2⤵
  PID:9836
- C:\Windows\System\LXLcdAN.exe
  C:\Windows\System\LXLcdAN.exe
  2⤵
  PID:8668
- C:\Windows\System\KOhFxiY.exe
  C:\Windows\System\KOhFxiY.exe
  2⤵
  PID:8068
- C:\Windows\System\kwaoDdh.exe
  C:\Windows\System\kwaoDdh.exe
  2⤵
  PID:8168
- C:\Windows\System\xJQPDuz.exe
  C:\Windows\System\xJQPDuz.exe
  2⤵
  PID:8796
- C:\Windows\System\TOWepMj.exe
  C:\Windows\System\TOWepMj.exe
  2⤵
  PID:11272
- C:\Windows\System\ShlENeW.exe
  C:\Windows\System\ShlENeW.exe
  2⤵
  PID:11292
- C:\Windows\System\vGxeJyK.exe
  C:\Windows\System\vGxeJyK.exe
  2⤵
  PID:11312
- C:\Windows\System\nCcfTba.exe
  C:\Windows\System\nCcfTba.exe
  2⤵
  PID:11332
- C:\Windows\System\JhiqRue.exe
  C:\Windows\System\JhiqRue.exe
  2⤵
  PID:11348
- C:\Windows\System\DLhejZV.exe
  C:\Windows\System\DLhejZV.exe
  2⤵
  PID:11364
- C:\Windows\System\YUZXVdO.exe
  C:\Windows\System\YUZXVdO.exe
  2⤵
  PID:11384
- C:\Windows\System\zYswbVq.exe
  C:\Windows\System\zYswbVq.exe
  2⤵
  PID:11408
- C:\Windows\System\tXdwcNQ.exe
  C:\Windows\System\tXdwcNQ.exe
  2⤵
  PID:11428
- C:\Windows\System\viozTRG.exe
  C:\Windows\System\viozTRG.exe
  2⤵
  PID:11444
- C:\Windows\System\VniKNPQ.exe
  C:\Windows\System\VniKNPQ.exe
  2⤵
  PID:11484
- C:\Windows\System\oPIOGIm.exe
  C:\Windows\System\oPIOGIm.exe
  2⤵
  PID:11516
- C:\Windows\System\NLgmMEL.exe
  C:\Windows\System\NLgmMEL.exe
  2⤵
  PID:11560
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 11560 -s 248
    3⤵
    PID:11684
- C:\Windows\System\kNSexgY.exe
  C:\Windows\System\kNSexgY.exe
  2⤵
  PID:11588
- C:\Windows\System\sewPUSY.exe
  C:\Windows\System\sewPUSY.exe
  2⤵
  PID:11608
- C:\Windows\System\DWCGDwa.exe
  C:\Windows\System\DWCGDwa.exe
  2⤵
  PID:11628
- C:\Windows\System\cgaDNMC.exe
  C:\Windows\System\cgaDNMC.exe
  2⤵
  PID:11648
- C:\Windows\System\VlmMnZe.exe
  C:\Windows\System\VlmMnZe.exe
  2⤵
  PID:11672
- C:\Windows\System\NFXMdvd.exe
  C:\Windows\System\NFXMdvd.exe
  2⤵
  PID:11696
- C:\Windows\System\UNuzfiT.exe
  C:\Windows\System\UNuzfiT.exe
  2⤵
  PID:11712
- C:\Windows\System\nIbOVBv.exe
  C:\Windows\System\nIbOVBv.exe
  2⤵
  PID:11732
- C:\Windows\System\KPKiMjn.exe
  C:\Windows\System\KPKiMjn.exe
  2⤵
  PID:11748
- C:\Windows\System\WmunciB.exe
  C:\Windows\System\WmunciB.exe
  2⤵
  PID:11972
- C:\Windows\System\jmOuFMF.exe
  C:\Windows\System\jmOuFMF.exe
  2⤵
  PID:11988
- C:\Windows\System\ELJLUAw.exe
  C:\Windows\System\ELJLUAw.exe
  2⤵
  PID:12004
- C:\Windows\System\QssNYNd.exe
  C:\Windows\System\QssNYNd.exe
  2⤵
  PID:12032
- C:\Windows\System\umfLMhv.exe
  C:\Windows\System\umfLMhv.exe
  2⤵
  PID:12048
- C:\Windows\System\XtNxvEg.exe
  C:\Windows\System\XtNxvEg.exe
  2⤵
  PID:12064
- C:\Windows\System\AOJvpVg.exe
  C:\Windows\System\AOJvpVg.exe
  2⤵
  PID:12080
- C:\Windows\System\eyjcDQv.exe
  C:\Windows\System\eyjcDQv.exe
  2⤵
  PID:12096
- C:\Windows\System\wKLAGNl.exe
  C:\Windows\System\wKLAGNl.exe
  2⤵
  PID:12112
- C:\Windows\System\XSnlmWw.exe
  C:\Windows\System\XSnlmWw.exe
  2⤵
  PID:12128
- C:\Windows\System\fTxwdms.exe
  C:\Windows\System\fTxwdms.exe
  2⤵
  PID:12144
- C:\Windows\System\yAnWPgt.exe
  C:\Windows\System\yAnWPgt.exe
  2⤵
  PID:12160
- C:\Windows\System\FDLeDyC.exe
  C:\Windows\System\FDLeDyC.exe
  2⤵
  PID:12180
- C:\Windows\System\jPgrzeI.exe
  C:\Windows\System\jPgrzeI.exe
  2⤵
  PID:12200
- C:\Windows\System\usbsXLP.exe
  C:\Windows\System\usbsXLP.exe
  2⤵
  PID:12216
- C:\Windows\System\cGeyqEA.exe
  C:\Windows\System\cGeyqEA.exe
  2⤵
  PID:12236
- C:\Windows\System\FvBYbhM.exe
  C:\Windows\System\FvBYbhM.exe
  2⤵
  PID:12256
- C:\Windows\System\UldAXED.exe
  C:\Windows\System\UldAXED.exe
  2⤵
  PID:12276
- C:\Windows\System\LTUNyLG.exe
  C:\Windows\System\LTUNyLG.exe
  2⤵
  PID:10040
- C:\Windows\System\EICeIdQ.exe
  C:\Windows\System\EICeIdQ.exe
  2⤵
  PID:10100
- C:\Windows\System\SXAaApq.exe
  C:\Windows\System\SXAaApq.exe
  2⤵
  PID:10124
- C:\Windows\System\AhgoDkY.exe
  C:\Windows\System\AhgoDkY.exe
  2⤵
  PID:10160
- C:\Windows\System\ZqBBIqY.exe
  C:\Windows\System\ZqBBIqY.exe
  2⤵
  PID:10216
- C:\Windows\System\UIlBHMo.exe
  C:\Windows\System\UIlBHMo.exe
  2⤵
  PID:7756
- C:\Windows\System\SZALnju.exe
  C:\Windows\System\SZALnju.exe
  2⤵
  PID:9176
- C:\Windows\System\cEviflY.exe
  C:\Windows\System\cEviflY.exe
  2⤵
  PID:9196
- C:\Windows\System\Kcmlbpf.exe
  C:\Windows\System\Kcmlbpf.exe
  2⤵
  PID:7424
- C:\Windows\System\CWNPTFJ.exe
  C:\Windows\System\CWNPTFJ.exe
  2⤵
  PID:6924
- C:\Windows\System\PmUmtYk.exe
  C:\Windows\System\PmUmtYk.exe
  2⤵
  PID:10276
- C:\Windows\System\soauQzd.exe
  C:\Windows\System\soauQzd.exe
  2⤵
  PID:8144
- C:\Windows\System\qhWdqtG.exe
  C:\Windows\System\qhWdqtG.exe
  2⤵
  PID:10392
- C:\Windows\System\aCPTfpX.exe
  C:\Windows\System\aCPTfpX.exe
  2⤵
  PID:10464
- C:\Windows\System\AKSVBof.exe
  C:\Windows\System\AKSVBof.exe
  2⤵
  PID:8288
- C:\Windows\System\TxUtMhR.exe
  C:\Windows\System\TxUtMhR.exe
  2⤵
  PID:10648
- C:\Windows\System\aFpvfVC.exe
  C:\Windows\System\aFpvfVC.exe
  2⤵
  PID:8304
- C:\Windows\System\iQMWswh.exe
  C:\Windows\System\iQMWswh.exe
  2⤵
  PID:8408
- C:\Windows\System\NCtnFqY.exe
  C:\Windows\System\NCtnFqY.exe
  2⤵
  PID:8508
- C:\Windows\System\jATXHFS.exe
  C:\Windows\System\jATXHFS.exe
  2⤵
  PID:10288
- C:\Windows\System\uUIdDqO.exe
  C:\Windows\System\uUIdDqO.exe
  2⤵
  PID:10376
- C:\Windows\System\BKHddpf.exe
  C:\Windows\System\BKHddpf.exe
  2⤵
  PID:10460
- C:\Windows\System\KGyBKMe.exe
  C:\Windows\System\KGyBKMe.exe
  2⤵
  PID:9072
- C:\Windows\System\VxaMgJo.exe
  C:\Windows\System\VxaMgJo.exe
  2⤵
  PID:10500
- C:\Windows\System\VcQexIK.exe
  C:\Windows\System\VcQexIK.exe
  2⤵
  PID:10608
- C:\Windows\System\tHeWTKP.exe
  C:\Windows\System\tHeWTKP.exe
  2⤵
  PID:10716
- C:\Windows\System\WFZXzAl.exe
  C:\Windows\System\WFZXzAl.exe
  2⤵
  PID:10824
- C:\Windows\System\Bhhcnvv.exe
  C:\Windows\System\Bhhcnvv.exe
  2⤵
  PID:10956
- C:\Windows\System\HicQDEW.exe
  C:\Windows\System\HicQDEW.exe
  2⤵
  PID:11060
- C:\Windows\System\aNjDoiL.exe
  C:\Windows\System\aNjDoiL.exe
  2⤵
  PID:7208
- C:\Windows\System\QlrfEGf.exe
  C:\Windows\System\QlrfEGf.exe
  2⤵
  PID:8588
- C:\Windows\System\bibTKHL.exe
  C:\Windows\System\bibTKHL.exe
  2⤵
  PID:8628
- C:\Windows\System\XihAVmE.exe
  C:\Windows\System\XihAVmE.exe
  2⤵
  PID:9884
- C:\Windows\System\fFDkOpc.exe
  C:\Windows\System\fFDkOpc.exe
  2⤵
  PID:8652
- C:\Windows\System\QmvHteY.exe
  C:\Windows\System\QmvHteY.exe
  2⤵
  PID:8696
- C:\Windows\System\XKMYLLk.exe
  C:\Windows\System\XKMYLLk.exe
  2⤵
  PID:9428
- C:\Windows\System\HXsmHaa.exe
  C:\Windows\System\HXsmHaa.exe
  2⤵
  PID:8748
- C:\Windows\System\HcVwjCu.exe
  C:\Windows\System\HcVwjCu.exe
  2⤵
  PID:12308
- C:\Windows\System\kgsmkQK.exe
  C:\Windows\System\kgsmkQK.exe
  2⤵
  PID:12336
- C:\Windows\System\wqSiwbM.exe
  C:\Windows\System\wqSiwbM.exe
  2⤵
  PID:12360
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 12360 -s 252
    3⤵
    PID:8724
- C:\Windows\System\jSLIddC.exe
  C:\Windows\System\jSLIddC.exe
  2⤵
  PID:12376
- C:\Windows\System\ciicrIl.exe
  C:\Windows\System\ciicrIl.exe
  2⤵
  PID:12404
- C:\Windows\System\sCkWaon.exe
  C:\Windows\System\sCkWaon.exe
  2⤵
  PID:12428
- C:\Windows\System\drfrwJp.exe
  C:\Windows\System\drfrwJp.exe
  2⤵
  PID:12444
- C:\Windows\System\rvWpLqN.exe
  C:\Windows\System\rvWpLqN.exe
  2⤵
  PID:12464
- C:\Windows\System\hGvISJT.exe
  C:\Windows\System\hGvISJT.exe
  2⤵
  PID:12488
- C:\Windows\System\nbAvtcl.exe
  C:\Windows\System\nbAvtcl.exe
  2⤵
  PID:12512
- C:\Windows\System\eNVdpPr.exe
  C:\Windows\System\eNVdpPr.exe
  2⤵
  PID:12532
- C:\Windows\System\LMaUosT.exe
  C:\Windows\System\LMaUosT.exe
  2⤵
  PID:12556
- C:\Windows\System\RZSqLsk.exe
  C:\Windows\System\RZSqLsk.exe
  2⤵
  PID:12576
- C:\Windows\System\PhivrUr.exe
  C:\Windows\System\PhivrUr.exe
  2⤵
  PID:12596
- C:\Windows\System\VMpWOPx.exe
  C:\Windows\System\VMpWOPx.exe
  2⤵
  PID:12620
- C:\Windows\System\jfiCfke.exe
  C:\Windows\System\jfiCfke.exe
  2⤵
  PID:12640
- C:\Windows\System\siABvmn.exe
  C:\Windows\System\siABvmn.exe
  2⤵
  PID:12660
- C:\Windows\System\tUsDqlX.exe
  C:\Windows\System\tUsDqlX.exe
  2⤵
  PID:12680
- C:\Windows\System\THvtRTk.exe
  C:\Windows\System\THvtRTk.exe
  2⤵
  PID:12700
- C:\Windows\System\pSmPaYO.exe
  C:\Windows\System\pSmPaYO.exe
  2⤵
  PID:12720
- C:\Windows\System\VWlWeEj.exe
  C:\Windows\System\VWlWeEj.exe
  2⤵
  PID:12736
- C:\Windows\System\PIPAJcp.exe
  C:\Windows\System\PIPAJcp.exe
  2⤵
  PID:12752
- C:\Windows\System\NqBubyu.exe
  C:\Windows\System\NqBubyu.exe
  2⤵
  PID:12768
- C:\Windows\System\iTbLQZU.exe
  C:\Windows\System\iTbLQZU.exe
  2⤵
  PID:12784
- C:\Windows\System\wNVKYTl.exe
  C:\Windows\System\wNVKYTl.exe
  2⤵
  PID:12800
- C:\Windows\System\bCdFSpw.exe
  C:\Windows\System\bCdFSpw.exe
  2⤵
  PID:12816
- C:\Windows\System\DrIlFmw.exe
  C:\Windows\System\DrIlFmw.exe
  2⤵
  PID:12832
- C:\Windows\System\FVzWQZu.exe
  C:\Windows\System\FVzWQZu.exe
  2⤵
  PID:12848
- C:\Windows\System\BNMLyhN.exe
  C:\Windows\System\BNMLyhN.exe
  2⤵
  PID:12864
- C:\Windows\System\DEHnqas.exe
  C:\Windows\System\DEHnqas.exe
  2⤵
  PID:12880
- C:\Windows\System\gKGizKm.exe
  C:\Windows\System\gKGizKm.exe
  2⤵
  PID:12896
- C:\Windows\System\QiRLThs.exe
  C:\Windows\System\QiRLThs.exe
  2⤵
  PID:12912
- C:\Windows\System\iOUoemH.exe
  C:\Windows\System\iOUoemH.exe
  2⤵
  PID:12928
- C:\Windows\System\uqAgYxp.exe
  C:\Windows\System\uqAgYxp.exe
  2⤵
  PID:12944
- C:\Windows\System\aUdBRaV.exe
  C:\Windows\System\aUdBRaV.exe
  2⤵
  PID:12960
- C:\Windows\System\qyYadLV.exe
  C:\Windows\System\qyYadLV.exe
  2⤵
  PID:12980
- C:\Windows\System\JzSOXtu.exe
  C:\Windows\System\JzSOXtu.exe
  2⤵
  PID:13032
- C:\Windows\System\eSRmKwD.exe
  C:\Windows\System\eSRmKwD.exe
  2⤵
  PID:13048
- C:\Windows\System\dKAXend.exe
  C:\Windows\System\dKAXend.exe
  2⤵
  PID:13076
- C:\Windows\System\geoFzoU.exe
  C:\Windows\System\geoFzoU.exe
  2⤵
  PID:13096
- C:\Windows\System\tOGAjOR.exe
  C:\Windows\System\tOGAjOR.exe
  2⤵
  PID:13116
- C:\Windows\System\ndLhhtG.exe
  C:\Windows\System\ndLhhtG.exe
  2⤵
  PID:13136
- C:\Windows\System\smxlHjI.exe
  C:\Windows\System\smxlHjI.exe
  2⤵
  PID:13152
- C:\Windows\System\YBBmctm.exe
  C:\Windows\System\YBBmctm.exe
  2⤵
  PID:13168
- C:\Windows\System\mrcbSZj.exe
  C:\Windows\System\mrcbSZj.exe
  2⤵
  PID:13184
- C:\Windows\System\nRWzjjH.exe
  C:\Windows\System\nRWzjjH.exe
  2⤵
  PID:13200
- C:\Windows\System\gUpVJnv.exe
  C:\Windows\System\gUpVJnv.exe
  2⤵
  PID:13216
- C:\Windows\System\txdzafq.exe
  C:\Windows\System\txdzafq.exe
  2⤵
  PID:13232
- C:\Windows\System\WZAodwP.exe
  C:\Windows\System\WZAodwP.exe
  2⤵
  PID:13256
- C:\Windows\System\PgIOyUB.exe
  C:\Windows\System\PgIOyUB.exe
  2⤵
  PID:13276
- C:\Windows\System\ancsNgT.exe
  C:\Windows\System\ancsNgT.exe
  2⤵
  PID:13300
- C:\Windows\System\gsyHgUf.exe
  C:\Windows\System\gsyHgUf.exe
  2⤵
  PID:9944
- C:\Windows\System\pQkRHnz.exe
  C:\Windows\System\pQkRHnz.exe
  2⤵
  PID:8812
- C:\Windows\System\LplroqZ.exe
  C:\Windows\System\LplroqZ.exe
  2⤵
  PID:8836
- C:\Windows\System\nIwmQYv.exe
  C:\Windows\System\nIwmQYv.exe
  2⤵
  PID:8868
- C:\Windows\System\tzafKsv.exe
  C:\Windows\System\tzafKsv.exe
  2⤵
  PID:11392
- C:\Windows\System\aAczACe.exe
  C:\Windows\System\aAczACe.exe
  2⤵
  PID:11544
- C:\Windows\System\dmLdJkz.exe
  C:\Windows\System\dmLdJkz.exe
  2⤵
  PID:11640
- C:\Windows\System\ZvCBYFi.exe
  C:\Windows\System\ZvCBYFi.exe
  2⤵
  PID:9128
- C:\Windows\System\AfcWnnp.exe
  C:\Windows\System\AfcWnnp.exe
  2⤵
  PID:7892
- C:\Windows\System\rffgPTV.exe
  C:\Windows\System\rffgPTV.exe
  2⤵
  PID:7292
- C:\Windows\System\ubsTltI.exe
  C:\Windows\System\ubsTltI.exe
  2⤵
  PID:13320
- C:\Windows\System\lAcXdkq.exe
  C:\Windows\System\lAcXdkq.exe
  2⤵
  PID:13340
- C:\Windows\System\GzZpcaP.exe
  C:\Windows\System\GzZpcaP.exe
  2⤵
  PID:13360
- C:\Windows\System\tRecaAt.exe
  C:\Windows\System\tRecaAt.exe
  2⤵
  PID:13376
- C:\Windows\System\BJtCuTH.exe
  C:\Windows\System\BJtCuTH.exe
  2⤵
  PID:13396
- C:\Windows\System\XjCEsGn.exe
  C:\Windows\System\XjCEsGn.exe
  2⤵
  PID:13416
- C:\Windows\System\NVCZksX.exe
  C:\Windows\System\NVCZksX.exe
  2⤵
  PID:13448
- C:\Windows\System\PXMFwor.exe
  C:\Windows\System\PXMFwor.exe
  2⤵
  PID:13476
- C:\Windows\System\NxIEmBe.exe
  C:\Windows\System\NxIEmBe.exe
  2⤵
  PID:13508
- C:\Windows\System\GNhLrGr.exe
  C:\Windows\System\GNhLrGr.exe
  2⤵
  PID:13528
- C:\Windows\System\eqrRXAq.exe
  C:\Windows\System\eqrRXAq.exe
  2⤵
  PID:13552
- C:\Windows\System\ZnrUpvc.exe
  C:\Windows\System\ZnrUpvc.exe
  2⤵
  PID:13576
- C:\Windows\System\vXETlDY.exe
  C:\Windows\System\vXETlDY.exe
  2⤵
  PID:13604
- C:\Windows\System\GFaOkmH.exe
  C:\Windows\System\GFaOkmH.exe
  2⤵
  PID:13628
- C:\Windows\System\AbNAlgr.exe
  C:\Windows\System\AbNAlgr.exe
  2⤵
  PID:13648
- C:\Windows\System\rlAgxYq.exe
  C:\Windows\System\rlAgxYq.exe
  2⤵
  PID:13672
- C:\Windows\System\eChmLTA.exe
  C:\Windows\System\eChmLTA.exe
  2⤵
  PID:13696
- C:\Windows\System\fCSEHpV.exe
  C:\Windows\System\fCSEHpV.exe
  2⤵
  PID:13724
- C:\Windows\System\ncVSIRA.exe
  C:\Windows\System\ncVSIRA.exe
  2⤵
  PID:13752
- C:\Windows\System\pzRBnVn.exe
  C:\Windows\System\pzRBnVn.exe
  2⤵
  PID:13776
- C:\Windows\System\nWqqEeQ.exe
  C:\Windows\System\nWqqEeQ.exe
  2⤵
  PID:13812
- C:\Windows\System\piTAAAV.exe
  C:\Windows\System\piTAAAV.exe
  2⤵
  PID:13836
- C:\Windows\System\eKlYUOl.exe
  C:\Windows\System\eKlYUOl.exe
  2⤵
  PID:13872
- C:\Windows\System\dDMzHaF.exe
  C:\Windows\System\dDMzHaF.exe
  2⤵
  PID:13900
- C:\Windows\System\GDiRuNu.exe
  C:\Windows\System\GDiRuNu.exe
  2⤵
  PID:13928
- C:\Windows\System\PBVHekM.exe
  C:\Windows\System\PBVHekM.exe
  2⤵
  PID:13956
- C:\Windows\System\eOESaYH.exe
  C:\Windows\System\eOESaYH.exe
  2⤵
  PID:13976
- C:\Windows\System\KeHFPhC.exe
  C:\Windows\System\KeHFPhC.exe
  2⤵
  PID:14008
- C:\Windows\System\iEryufs.exe
  C:\Windows\System\iEryufs.exe
  2⤵
  PID:14028
- C:\Windows\System\IamIAkT.exe
  C:\Windows\System\IamIAkT.exe
  2⤵
  PID:14052
- C:\Windows\System\lMuhiSo.exe
  C:\Windows\System\lMuhiSo.exe
  2⤵
  PID:14076
- C:\Windows\System\zNGMKiu.exe
  C:\Windows\System\zNGMKiu.exe
  2⤵
  PID:14100
- C:\Windows\System\umGOISX.exe
  C:\Windows\System\umGOISX.exe
  2⤵
  PID:14116
- C:\Windows\System\NeuidKn.exe
  C:\Windows\System\NeuidKn.exe
  2⤵
  PID:14148
- C:\Windows\System\aOflSpI.exe
  C:\Windows\System\aOflSpI.exe
  2⤵
  PID:14164
- C:\Windows\System\vptNcfS.exe
  C:\Windows\System\vptNcfS.exe
  2⤵
  PID:14188
- C:\Windows\System\LXKmHug.exe
  C:\Windows\System\LXKmHug.exe
  2⤵
  PID:14212
- C:\Windows\System\aqumMzq.exe
  C:\Windows\System\aqumMzq.exe
  2⤵
  PID:14228
- C:\Windows\System\ICtFGhs.exe
  C:\Windows\System\ICtFGhs.exe
  2⤵
  PID:14252
- C:\Windows\System\AMwBuWp.exe
  C:\Windows\System\AMwBuWp.exe
  2⤵
  PID:14276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AjOyWAl.exe

Filesize
1.4MB

MD5
5fd52d54894bb59153375ea8a19a7fb9

SHA1
d54c45da4a5718459ae3845488e527f4de4750c8

SHA256
be621d108be166a55a1eca381bed02412b9f1aa76b6f48ddc1d1ba55194bf905

SHA512
62cc078af574573dec2ddf9c1b45e32699cb61c7879f10eea4651cd036a84df6b761de7cadb36850acc6ade649ba58dc234add9e94677e574847ff039108bc49

Download Submit
C:\Windows\System\CRqjtUp.exe

Filesize
1.4MB

MD5
415dc4bdc948765aa57a94d60876f8a8

SHA1
f2027b791816529c6ae219b6e46aaa92d6a59ddc

SHA256
f4cdc66cc29e17c48aadd860dabfe643dcd2a9212bdc9cca9a20aabc3b2e2b3a

SHA512
d50824d6d026b7bc830e798ff5dab006b1243f87e1bba5df89510403ce6706e2c71ed9b102cc3e4e4f32974edf00697fd143c39146a740df7e58433d28f3c570

Download Submit
C:\Windows\System\JsvfefD.exe

Filesize
1.4MB

MD5
a0487cc9a2ade0bfa1bace49868ff382

SHA1
3ab016c5f5b726b8c3ec652967f86c848f5677b3

SHA256
7d83c10c48fedcb729bc5bce1436f08b1fc4367af8458afa005cf108786aa1d1

SHA512
8fd5cf83b854f681695828c063c49460f9df905b37906b019873bc03fe13547a64ffe890929cc08365c0ad0bcfe95d6255471871e2fdf2d964c64e88c02bc028

Download Submit
C:\Windows\System\LKshwLq.exe

Filesize
1.4MB

MD5
81c3e33832e735ea1774d3827fb0ee97

SHA1
6f2c513cc66740e53102871e3a1eb212ed580ac6

SHA256
ac9efe7832907c88f8b0012ace846a1cb39ab400ded4b4c07b902b5ad9653f21

SHA512
47804e5c2cb14d7f68c9afc015a1c4aed9d5d3bbe1fa7d5d71b5f6b6a09d67884b6f92a83b405d518a1090fc69c24088e66cd6b57c3351a07fdcdc0485ce2b67

Download Submit
C:\Windows\System\MSaaQvb.exe

Filesize
1.4MB

MD5
0b3f68f00584a010e7c83df6d31cc3dd

SHA1
7886844d1e86732cec51be719b1b3173dacc4337

SHA256
b29c823c0502fce972b2d2667c0ae4b7d67cd2f8e18ebde774aa280856417ad4

SHA512
fbcd068119565b1c04d333d791678f79ea3683b8963d6c340f888389a988ee7545151796c3e48eef10499d3a775bea7387207633c1433938ab3c29d058c57f04

Download Submit
C:\Windows\System\MUdtZjM.exe

Filesize
1.4MB

MD5
79e151d7c491bc1ee169044dce752589

SHA1
2cd777ececb09d7a4956a588fb8a6dcfc6f61751

SHA256
ee9873b90a01686f6ffd233e9e7feea74154bb4d32313a8a3a71350f87c82bf0

SHA512
4dc75e4b9b40196cfd47a317337a5e2d56eab73ab12b40fded5f14ba4a9b17f3956bc0671466a26d876a2345811a18bf5309d2fd1b69b6b06cd7b42075e475e0

Download Submit
C:\Windows\System\PkBAVod.exe

Filesize
1.4MB

MD5
9ac2b1bb9fd6e33b9e9557af67ff4a63

SHA1
0dab6db44ec3b4ff6cd71f9f9599255b1a474433

SHA256
7b16fad074ad5393103c0857054fc0dd99493abde4a0e46a3bf190d9dcaf92cc

SHA512
10515e525f0ced925cc89c172dfe1aa8b378f5b0535aec86b1e47fa115a9766de57a9e392639f1cf0ee35f9182b6f60e0405671464386f455d820896787a9264

Download Submit
C:\Windows\System\QairzCj.exe

Filesize
1.4MB

MD5
74ce72d954cf5d466bdcd767b4c9c428

SHA1
45f2fd6b92e7e2b5bc48f0e40a4f3cedb520de33

SHA256
b87ee9f5277435905721707f927759c6d867fb27b3035a990ec5230ecb8bea46

SHA512
b0de1a5e766c4c5d4a61ba3d8041ef626c410673d49a4e67ef5618379e857915e6d3962427cd7f5a5854e41ce4bbed95431ea18bc82e519102a86d53a496b1c4

Download Submit
C:\Windows\System\Qdlkqhq.exe

Filesize
1.4MB

MD5
4bb64fe1b2c91e42f3f5fd24efc6085f

SHA1
733e0623e60e2d38d044f2e34df1014bef6a504e

SHA256
17e3b3f356212e712d938227c9335b1af669089791c564ea646fbab11beea9a2

SHA512
d16f33350f6297079e154f4c03581d989cd3962cad5a6cf02364afa977214d5024bccd36e23b1ce341e28aab8827c56df40256a0547e827d94dea7db6ff230d8

Download Submit
C:\Windows\System\QxudBQh.exe

Filesize
1.4MB

MD5
c7656c708ae976c5c0f3159eb4d376bf

SHA1
b24f8cb780e753cbeb92c8aa016ddc17eb4840a1

SHA256
75e8db0c3d217185eacd889450d5d40c6d5ce4e55de213defbb61beaf3af8deb

SHA512
7e331165c1c4a5be0fdba35238fe5296e49e154b9d1491f6d7ad94247b0a3ec593fbdc86cf538aea3e8b5278a5f38b973ccedd288b93fa25f1d3a3327ab2f690

Download Submit
C:\Windows\System\UwpAftt.exe

Filesize
1.4MB

MD5
439ba0b7e8908d5c89b9ebc1c3f5a072

SHA1
970af40f2ed6b1527805436ab33d09f394e978c4

SHA256
7997755fcb8346d0d324c18ad1cc686676b9004eedd145cb54898b6f693201f3

SHA512
9b7517765bd6aefa91c199744d3d368b916f09eba6115b71254431ac938e0b259b8764050b75b14ff333debfc215de302d75d89d5f64d71d1f3b5d0ceadd437a

Download Submit
C:\Windows\System\XgtgVMg.exe

Filesize
1.4MB

MD5
30dd79adb8d3346c8c23d31dd17ba327

SHA1
43b16ab1e88da8d17c938858b77d609acff842a1

SHA256
2f5cf1e3f2bae1dc74bb64fc52f69dcb5585325c91bc30c88d44d2b56caa9b92

SHA512
8b375858dd3db919dd9b802a24b883fcc060b08a73253baa33a0b686ed4c8b3ecd68705c23de2794fb177ca885c2a121a73ea4c6585c904381456b5cb7a863b1

Download Submit
C:\Windows\System\XyIrSdM.exe

Filesize
1.4MB

MD5
05013469dea69d8be4e21d8643a4be7b

SHA1
860da9e6bbc5f935d4ffca7287fc357e8af42768

SHA256
3a61e5bf2560ac0ac616158a13e09d261f240e5f4fdec976f9fd7ebb5ed9216c

SHA512
8c454ce74ff1e64c281f33ffc86164efd190009052806d1aeb4063264838a88eb59dba546f67c576cc7a4b5f704b80838368c254c34665802c9004e9f4f06898

Download Submit
C:\Windows\System\ZWliTTi.exe

Filesize
1.4MB

MD5
c0da6ea80ffd1222642dffbdf4927813

SHA1
5b786cced710c1cf5c7c0ec499da2dd5a52365f7

SHA256
d9487f215856b5712bd0705fa5f26fa9090908719c5178d5c4ea156cb3afaac3

SHA512
4e13ca7d94e77cc767a82a8266a5f74f6ab373e78cea4b1f9a68613494637f789028ffdf77028a0a5443974d027b65d46bce382ed7b170e5db00a096894a9897

Download Submit
C:\Windows\System\cQyEsCt.exe

Filesize
1.4MB

MD5
4d91363ae9f7b419ef697394ff45e8a6

SHA1
5e794ee5a74605404d1b1c5261703a46271b0185

SHA256
c275eedabb4d0463dfd1b1d6433e282d52fecd314886e53002b3c815385a1bdb

SHA512
9b473de5a68b19e0c286b2c023a997a636646f442bae3cb37a5c9e62a60001579c9743b358ae00dcede6ff2d989081bdc7f7b1001c07c31247fa2610995fef56

Download Submit
C:\Windows\System\fDOQufg.exe

Filesize
1.4MB

MD5
1224da28088b57e97a53c90152077b18

SHA1
e86f7fb224da382bf5b7c2a19f40c4c37889110d

SHA256
a698e9bbb46faf0857c63df0f6fbee52cbc4b42082b70494d3ed1c544e6311aa

SHA512
08724092124ea3465600291b05b8eff1da49d42e791303ca96dc09391ed50b6b8f6f613fbf30de6c1411003a9f14915d9489b7b2de91d37343e2fe1453b664d5

Download Submit
C:\Windows\System\fUlPqPE.exe

Filesize
1.4MB

MD5
3f2b125d614a2832c40a78245f506184

SHA1
271ded02677f782246582a439e2f460bb4412e2d

SHA256
f413c0f33a631373e44c4ad1adc63fe42c25895dbe04cf9722aa7af6ce62ba73

SHA512
1ff4883808363471d3c92d248e68ff9c479e83eabe6d1e462948eb96a399f65466fb2a164bb8ffd72b7eaceb1eaa18ff8f602d263f3ad72922dffe286365239d

Download Submit
C:\Windows\System\fjuSQMu.exe

Filesize
1.4MB

MD5
a94d2c51d2a13b0e1c8ddc10fe7ea7eb

SHA1
fb4c5380a4267cf853156100b1be7cdadcb0ea4f

SHA256
f9c6f5e542d473136ac1e5e922874fa14bea8e378d9e7bdf24180c10d0fb1e84

SHA512
967e862ff3fa9e04225118d97c7de63b4e85b1d02d3b4eb243156020c61e216954737a4ed28932d3835e9b8b79b7ed4f93e3ee9ace4182bc0b9fb5bbcec57783

Download Submit
C:\Windows\System\grhJRsr.exe

Filesize
1.4MB

MD5
199ba3a7ccc798146377699e651dc07b

SHA1
090b746a6ab6d9837984f61496bcb27990881ff0

SHA256
5ebd41a563046c64de6b18404c11a9e91b581f8265e3d844ebe2fae27891ae6c

SHA512
d938c1fb69c730b61b714150cba3ef09fa2005bdfc234e1751d3e68b708223d6f4de24ea41d72ce7a9c3e36319bcb8819e2acbb5d9266dc2cf2c413601d96980

Download Submit
C:\Windows\System\gwyrNgQ.exe

Filesize
1.4MB

MD5
e960c86efb24e2d004835b6f31c8ad7d

SHA1
72be6833d0e5edf17be066ffa0128eaeda5fe7dc

SHA256
e05c7647cb4e8e5a1d884c75d83894f1cb5e00bc7c7ae385b07fad269a5e93a5

SHA512
567440bbbd5bfda762a75c63dd1d7cc62a72d1b7fa957b0b014467a5adade1a149d3573c96946e5d8228753abc4f03862791d8f75c1d994475f2fe52ad842bd2

Download Submit
C:\Windows\System\iByKsWJ.exe

Filesize
1.4MB

MD5
4f0e46af26963469fce21b438e933cd9

SHA1
834069e1e56359c7948a9169321bf7f9c2f66e4d

SHA256
7c75365a5ac58a01e2a6155740aef55fafd8c9f082bea70e40bcd484b0979ea6

SHA512
eb8d8fb46cb8ac6926a9ac8f264b6467eed12c092775e3ec5a17c9e24759aa51b7a14a27919fbab713c22620f509f7593b592ec4bf07d30c184c201274ca312e

Download Submit
C:\Windows\System\igkJtPZ.exe

Filesize
1.4MB

MD5
288f480e7da5face9c8f2b9147fe0902

SHA1
81c12303fe2e2a81a11ae44367ab399d535f081f

SHA256
5d6eeea79843423330f9b09729eae1a8461955152364325f8b81ee2c797ab389

SHA512
64a96a7656537c911a67f9cda558cf4694684a17411c8223a12f5fcce4cbf8091a2e5b711fbf6b25678a1697d9ecc6ddb1d2eda29bd9181e8d2154e0b47923f4

Download Submit
C:\Windows\System\kpiZIIc.exe

Filesize
1.4MB

MD5
008492df9ec16e20f76c08ca3de02327

SHA1
3b5639c96b25b6319b24f9891393ad30b3d0f853

SHA256
4cf40c1c2f3eed9be6f6adcaea66383bef1011e6f6b6bccbe3e866d85873fdc8

SHA512
65959bd82fb73005f58af80ad5e10b0f8c6b2d0c30d8768e3caca9cf0ef70dfa261ff9651a5367d375b0bcc9eb961517ef19bb363c00d5a1e19c0519c0776fb9

Download Submit
C:\Windows\System\lZMwxQC.exe

Filesize
1.4MB

MD5
b89356e19ebf0f9ae5fe9c0870d18cca

SHA1
ef78573d7041011f5d78ffa601e026ad07bf76a4

SHA256
193b28049317dd0be58edd7fda24a96c8bcc315a8c0399489bb540101f8fd9a4

SHA512
821f4671f1f4d3a4b3c92f9ca40f6ef5113bd9fb764b3b88a837aa15731f098ac40048c424e99b831e6f831b5590e2c5c9268bfe393bfaba43669a8cad283324

Download Submit
C:\Windows\System\mtxUHIa.exe

Filesize
1.4MB

MD5
aeffd1c5925a5d3af16e593184906af9

SHA1
2c2c3998919cf4e243503e0547d74cab826caecb

SHA256
bdd79114b38ec883be2e7788e78fb96755e009cf8daa037ad3934c6353e598dc

SHA512
74aea5376682f98364aed30fd8114833f155865552a5c3daa6e9a27711d407eec94b37449c1157a7568bc35bea34415fbd570ce5622810bd0232c712cc589cce

Download Submit
C:\Windows\System\ntwvAnw.exe

Filesize
1.4MB

MD5
9696b6348bb50ac61187742284314d13

SHA1
a3451531f32b6a76d5660bdd17f6166e29468a60

SHA256
eb3404cb945575d4b4196a38b9c13824724b8e2b9fcee0757b92b4643901c42c

SHA512
5699f14f47a419c3832db783634a36e566f5474267dc705c708eff79397a815798bc0e1e48a5b6f0d863064f096560509cc7ce0f1c1b22526422ebb578369aac

Download Submit
C:\Windows\System\vuYEDNt.exe

Filesize
1.4MB

MD5
60b9c9ae7a69a1a0cb4973ada002688f

SHA1
87713b7982b517f3c6514434110602505adbca26

SHA256
8513717e48327e67a6a7f42708617a7ba657e2cb713a87f935a9a489d0abcb0a

SHA512
ffaeae30a3e1cb20722c038e228377e2f0f6384789c6039c347890cd1cac9296d5b241ca95796071e2849575967c9c6888ac50ac50538e68ffe280bb63b512d1

Download Submit
C:\Windows\System\wNLuPMy.exe

Filesize
1.4MB

MD5
0800ddc0f11b276656e66745b5ab3604

SHA1
b2562a5e5feeac4ef4c7bfae2c64ad19e2702638

SHA256
7a08cbc20a86dcaf03450a18728687413fc4b9e30d7fe80eb7f0f57005843039

SHA512
49440497abaa563e7a17f502b4604a30746bf964f7d8b9edee2c5878f11a1ad1239e391d60ff5ed1e9c1e333633e9fc4f4fe59ea332d4bbf77f989513c5706cb

Download Submit
C:\Windows\System\wYGOAmd.exe

Filesize
1.4MB

MD5
fd78883bc301195f8f5879bd1a71bb0f

SHA1
df80afed9b6f370c8226575e0ced5831b8e7f32d

SHA256
f945b32f45a8b994354ec0e37e7f717ca1349666cdd676355e0e2bfa5f6ffcc2

SHA512
efed1f812fcd5a44b5b6fe3ea647de36990fac63a03187dc47ddb74e7d539dbbfcff2447229f76a020a805b8188c5bf016ab0c0b14b07dfd946b2ca11795a1fe

Download Submit
C:\Windows\System\wvuEmcO.exe

Filesize
1.4MB

MD5
496de449455c72cc5aff60bcf6ff023a

SHA1
14e10f249af8c147e9f7f102997ba06c1147a5cc

SHA256
1a9c737e731d03e4aa3d680f7e5964d060fd00a50e78a6a5d23fcc18b148e5a4

SHA512
639dd1ad693878afb2f9d1b2fc60814e75d938a3a08376b7d3e00b9f2fece9c8a1dbcaf85c0e8b62c0fe38e0c3eb62004c7beb65932e86cf3455c56872702e3f

Download Submit
C:\Windows\System\xXVwWld.exe

Filesize
1.4MB

MD5
24715fdcda3c072cf5a7fbdb7fd6bc13

SHA1
9ff8b6840ab77376c1190703f0696ca28a0b550f

SHA256
6afefd389bb105ea1d80b4367e8360f0f4052d8130d1e0e56a74423741b71710

SHA512
b709d8feb2d923904bc01463630ed50f79a2667d37dbbeab1897b711fc33fc0378da62c359021b258abc031e7d57431400333a0053d8aa50278847290e802440

Download Submit
C:\Windows\System\yHUpzti.exe

Filesize
1.4MB

MD5
137ff513710c907a12502cf3a960baa1

SHA1
33ac92683b8830b69ad121166e0f1846eb8fb243

SHA256
40a9be5ec7fbd5195217c2d2902acf66049a0a70890509ae6e8e4d23a315d8f3

SHA512
aded9d7cbcf15078a8416d89c22b980fbc0f8ab09289b2dbadde15ed4bfd361f8385effca4df6bcced1bfb72a089fac55c8647214130766cf572ea1175560f1f

Download Submit
C:\Windows\System\zXeTfTG.exe

Filesize
1.4MB

MD5
66cfc6b0b0bfe025fb78a3edb82cb87e

SHA1
9c4923eeb7aac9a8c51dea59371116f6cfbd6553

SHA256
ed1a9da638d1bf83ce55240d967932440ef630b82583d850bfaea63abaa84823

SHA512
7221fad406225f8d4caa11c4a488376029f165b55d7bfc0ff662801103fbb0041bf0bae97cc1fbba6ee602f54e1a5ecf13a415e232a06066b4c4182b9e436e24

Download Submit
memory/212-2280-0x00007FF729AE0000-0x00007FF729E31000-memory.dmp

Filesize
3.3MB

Download
memory/212-532-0x00007FF729AE0000-0x00007FF729E31000-memory.dmp

Filesize
3.3MB

Download
memory/224-2248-0x00007FF7048F0000-0x00007FF704C41000-memory.dmp

Filesize
3.3MB

Download
memory/224-2255-0x00007FF7048F0000-0x00007FF704C41000-memory.dmp

Filesize
3.3MB

Download
memory/224-21-0x00007FF7048F0000-0x00007FF704C41000-memory.dmp

Filesize
3.3MB

Download
memory/628-2284-0x00007FF690680000-0x00007FF6909D1000-memory.dmp

Filesize
3.3MB

Download
memory/628-608-0x00007FF690680000-0x00007FF6909D1000-memory.dmp

Filesize
3.3MB

Download
memory/672-2267-0x00007FF6E2E00000-0x00007FF6E3151000-memory.dmp

Filesize
3.3MB

Download
memory/672-473-0x00007FF6E2E00000-0x00007FF6E3151000-memory.dmp

Filesize
3.3MB

Download
memory/780-2316-0x00007FF78A9F0000-0x00007FF78AD41000-memory.dmp

Filesize
3.3MB

Download
memory/780-655-0x00007FF78A9F0000-0x00007FF78AD41000-memory.dmp

Filesize
3.3MB

Download
memory/860-848-0x00007FF7A01D0000-0x00007FF7A0521000-memory.dmp

Filesize
3.3MB

Download
memory/860-2309-0x00007FF7A01D0000-0x00007FF7A0521000-memory.dmp

Filesize
3.3MB

Download
memory/1324-1401-0x00007FF69FF20000-0x00007FF6A0271000-memory.dmp

Filesize
3.3MB

Download
memory/1324-2299-0x00007FF69FF20000-0x00007FF6A0271000-memory.dmp

Filesize
3.3MB

Download
memory/1604-2278-0x00007FF6C51C0000-0x00007FF6C5511000-memory.dmp

Filesize
3.3MB

Download
memory/1604-565-0x00007FF6C51C0000-0x00007FF6C5511000-memory.dmp

Filesize
3.3MB

Download
memory/1688-2276-0x00007FF6D42A0000-0x00007FF6D45F1000-memory.dmp

Filesize
3.3MB

Download
memory/1688-504-0x00007FF6D42A0000-0x00007FF6D45F1000-memory.dmp

Filesize
3.3MB

Download
memory/1728-745-0x00007FF6F93D0000-0x00007FF6F9721000-memory.dmp

Filesize
3.3MB

Download
memory/1728-2307-0x00007FF6F93D0000-0x00007FF6F9721000-memory.dmp

Filesize
3.3MB

Download
memory/1832-2249-0x00007FF73AB40000-0x00007FF73AE91000-memory.dmp

Filesize
3.3MB

Download
memory/1832-23-0x00007FF73AB40000-0x00007FF73AE91000-memory.dmp

Filesize
3.3MB

Download
memory/1832-2256-0x00007FF73AB40000-0x00007FF73AE91000-memory.dmp

Filesize
3.3MB

Download
memory/1852-2265-0x00007FF7ED250000-0x00007FF7ED5A1000-memory.dmp

Filesize
3.3MB

Download
memory/1852-488-0x00007FF7ED250000-0x00007FF7ED5A1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-2274-0x00007FF7DB7B0000-0x00007FF7DBB01000-memory.dmp

Filesize
3.3MB

Download
memory/1984-30-0x00007FF7DB7B0000-0x00007FF7DBB01000-memory.dmp

Filesize
3.3MB

Download
memory/1984-2247-0x00007FF7DB7B0000-0x00007FF7DBB01000-memory.dmp

Filesize
3.3MB

Download
memory/2028-2263-0x00007FF622E00000-0x00007FF623151000-memory.dmp

Filesize
3.3MB

Download
memory/2028-499-0x00007FF622E00000-0x00007FF623151000-memory.dmp

Filesize
3.3MB

Download
memory/2284-2268-0x00007FF78CC80000-0x00007FF78CFD1000-memory.dmp

Filesize
3.3MB

Download
memory/2284-472-0x00007FF78CC80000-0x00007FF78CFD1000-memory.dmp

Filesize
3.3MB

Download
memory/2456-2295-0x00007FF63AF80000-0x00007FF63B2D1000-memory.dmp

Filesize
3.3MB

Download
memory/2456-1149-0x00007FF63AF80000-0x00007FF63B2D1000-memory.dmp

Filesize
3.3MB

Download
memory/2768-2271-0x00007FF6B94F0000-0x00007FF6B9841000-memory.dmp

Filesize
3.3MB

Download
memory/2768-470-0x00007FF6B94F0000-0x00007FF6B9841000-memory.dmp

Filesize
3.3MB

Download
memory/2812-2261-0x00007FF7360A0000-0x00007FF7363F1000-memory.dmp

Filesize
3.3MB

Download
memory/2812-528-0x00007FF7360A0000-0x00007FF7363F1000-memory.dmp

Filesize
3.3MB

Download
memory/2924-2259-0x00007FF6C8560000-0x00007FF6C88B1000-memory.dmp

Filesize
3.3MB

Download
memory/2924-471-0x00007FF6C8560000-0x00007FF6C88B1000-memory.dmp

Filesize
3.3MB

Download
memory/3080-1147-0x00007FF7D1C30000-0x00007FF7D1F81000-memory.dmp

Filesize
3.3MB

Download
memory/3080-2290-0x00007FF7D1C30000-0x00007FF7D1F81000-memory.dmp

Filesize
3.3MB

Download
memory/3240-2282-0x00007FF70F7F0000-0x00007FF70FB41000-memory.dmp

Filesize
3.3MB

Download
memory/3240-603-0x00007FF70F7F0000-0x00007FF70FB41000-memory.dmp

Filesize
3.3MB

Download
memory/3264-1664-0x00007FF6114A0000-0x00007FF6117F1000-memory.dmp

Filesize
3.3MB

Download
memory/3264-2303-0x00007FF6114A0000-0x00007FF6117F1000-memory.dmp

Filesize
3.3MB

Download
memory/3276-2292-0x00007FF776410000-0x00007FF776761000-memory.dmp

Filesize
3.3MB

Download
memory/3276-853-0x00007FF776410000-0x00007FF776761000-memory.dmp

Filesize
3.3MB

Download
memory/3300-1-0x00000177B18B0000-0x00000177B18C0000-memory.dmp

Filesize
64KB

Download
memory/3300-0-0x00007FF795E60000-0x00007FF7961B1000-memory.dmp

Filesize
3.3MB

Download
memory/3300-2177-0x00007FF795E60000-0x00007FF7961B1000-memory.dmp

Filesize
3.3MB

Download
memory/3696-958-0x00007FF7CDA60000-0x00007FF7CDDB1000-memory.dmp

Filesize
3.3MB

Download
memory/3696-2296-0x00007FF7CDA60000-0x00007FF7CDDB1000-memory.dmp

Filesize
3.3MB

Download
memory/4228-2252-0x00007FF7435A0000-0x00007FF7438F1000-memory.dmp

Filesize
3.3MB

Download
memory/4228-2246-0x00007FF7435A0000-0x00007FF7438F1000-memory.dmp

Filesize
3.3MB

Download
memory/4228-11-0x00007FF7435A0000-0x00007FF7438F1000-memory.dmp

Filesize
3.3MB

Download
memory/4304-2273-0x00007FF667CB0000-0x00007FF668001000-memory.dmp

Filesize
3.3MB

Download
memory/4304-32-0x00007FF667CB0000-0x00007FF668001000-memory.dmp

Filesize
3.3MB

Download
memory/4304-2250-0x00007FF667CB0000-0x00007FF668001000-memory.dmp

Filesize
3.3MB

Download
memory/4760-2305-0x00007FF76B680000-0x00007FF76B9D1000-memory.dmp

Filesize
3.3MB

Download
memory/4856-2300-0x00007FF601D90000-0x00007FF6020E1000-memory.dmp

Filesize
3.3MB

Download
memory/4856-1153-0x00007FF601D90000-0x00007FF6020E1000-memory.dmp

Filesize
3.3MB

Download