xmrig | 20709ca0a2bbf7b7be588faa73f5b876a7deecebd73b1625eecbb7e1e4f21bb4

Analysis

max time kernel
90s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dca88213745e0519bffd1c51ef4d8040N.exe
Size

1.6MB
MD5

dca88213745e0519bffd1c51ef4d8040
SHA1

1fe246ddab42fa48d942d88775d44cdd611fcfde
SHA256

20709ca0a2bbf7b7be588faa73f5b876a7deecebd73b1625eecbb7e1e4f21bb4
SHA512

b5ff3a58b405e162fe1c6dae1e2187976247e8f38062b0313b7c4b4346323bba1862be95986ab5301c51284f591d05b8fb803c0d993528da77221bbc92557768
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZrV5GgCzxcMfS0GcLdtzGy:Lz071uv4BPMkyW10/w16BWgac2xGE5j

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3492-368-0x00007FF659BA0000-0x00007FF659F92000-memory.dmp	xmrig
behavioral2/memory/4532-475-0x00007FF63E020000-0x00007FF63E412000-memory.dmp	xmrig
behavioral2/memory/3884-599-0x00007FF709710000-0x00007FF709B02000-memory.dmp	xmrig
behavioral2/memory/3792-616-0x00007FF774210000-0x00007FF774602000-memory.dmp	xmrig
behavioral2/memory/8-619-0x00007FF6C12B0000-0x00007FF6C16A2000-memory.dmp	xmrig
behavioral2/memory/3916-950-0x00007FF64AB20000-0x00007FF64AF12000-memory.dmp	xmrig
behavioral2/memory/5004-800-0x00007FF7ED620000-0x00007FF7EDA12000-memory.dmp	xmrig
behavioral2/memory/4924-617-0x00007FF65A760000-0x00007FF65AB52000-memory.dmp	xmrig
behavioral2/memory/2412-615-0x00007FF767490000-0x00007FF767882000-memory.dmp	xmrig
behavioral2/memory/64-614-0x00007FF7A19D0000-0x00007FF7A1DC2000-memory.dmp	xmrig
behavioral2/memory/4168-496-0x00007FF6843A0000-0x00007FF684792000-memory.dmp	xmrig
behavioral2/memory/2800-437-0x00007FF6758C0000-0x00007FF675CB2000-memory.dmp	xmrig
behavioral2/memory/324-435-0x00007FF632EA0000-0x00007FF633292000-memory.dmp	xmrig
behavioral2/memory/1840-310-0x00007FF689CD0000-0x00007FF68A0C2000-memory.dmp	xmrig
behavioral2/memory/5048-252-0x00007FF72D6C0000-0x00007FF72DAB2000-memory.dmp	xmrig
behavioral2/memory/1848-197-0x00007FF63B240000-0x00007FF63B632000-memory.dmp	xmrig
behavioral2/memory/2468-203-0x00007FF6F6D80000-0x00007FF6F7172000-memory.dmp	xmrig
behavioral2/memory/1504-156-0x00007FF6A4DF0000-0x00007FF6A51E2000-memory.dmp	xmrig
behavioral2/memory/3020-122-0x00007FF7AB730000-0x00007FF7ABB22000-memory.dmp	xmrig
behavioral2/memory/3572-117-0x00007FF7ABD80000-0x00007FF7AC172000-memory.dmp	xmrig
behavioral2/memory/2784-83-0x00007FF640AE0000-0x00007FF640ED2000-memory.dmp	xmrig
behavioral2/memory/5076-55-0x00007FF73A110000-0x00007FF73A502000-memory.dmp	xmrig
behavioral2/memory/2532-25-0x00007FF796EF0000-0x00007FF7972E2000-memory.dmp	xmrig
behavioral2/memory/4856-3881-0x00007FF668130000-0x00007FF668522000-memory.dmp	xmrig
behavioral2/memory/2532-3883-0x00007FF796EF0000-0x00007FF7972E2000-memory.dmp	xmrig
behavioral2/memory/5076-3885-0x00007FF73A110000-0x00007FF73A502000-memory.dmp	xmrig
behavioral2/memory/4856-3889-0x00007FF668130000-0x00007FF668522000-memory.dmp	xmrig
behavioral2/memory/2784-3888-0x00007FF640AE0000-0x00007FF640ED2000-memory.dmp	xmrig
behavioral2/memory/2468-3893-0x00007FF6F6D80000-0x00007FF6F7172000-memory.dmp	xmrig
behavioral2/memory/1848-3892-0x00007FF63B240000-0x00007FF63B632000-memory.dmp	xmrig
behavioral2/memory/2412-3918-0x00007FF767490000-0x00007FF767882000-memory.dmp	xmrig
behavioral2/memory/2800-3925-0x00007FF6758C0000-0x00007FF675CB2000-memory.dmp	xmrig
behavioral2/memory/64-3936-0x00007FF7A19D0000-0x00007FF7A1DC2000-memory.dmp	xmrig
behavioral2/memory/3916-3932-0x00007FF64AB20000-0x00007FF64AF12000-memory.dmp	xmrig
behavioral2/memory/1504-3921-0x00007FF6A4DF0000-0x00007FF6A51E2000-memory.dmp	xmrig
behavioral2/memory/324-3919-0x00007FF632EA0000-0x00007FF633292000-memory.dmp	xmrig
behavioral2/memory/4924-3923-0x00007FF65A760000-0x00007FF65AB52000-memory.dmp	xmrig
behavioral2/memory/3572-3911-0x00007FF7ABD80000-0x00007FF7AC172000-memory.dmp	xmrig
behavioral2/memory/5048-3906-0x00007FF72D6C0000-0x00007FF72DAB2000-memory.dmp	xmrig
behavioral2/memory/3492-3902-0x00007FF659BA0000-0x00007FF659F92000-memory.dmp	xmrig
behavioral2/memory/8-3900-0x00007FF6C12B0000-0x00007FF6C16A2000-memory.dmp	xmrig
behavioral2/memory/3020-3897-0x00007FF7AB730000-0x00007FF7ABB22000-memory.dmp	xmrig
behavioral2/memory/3884-3915-0x00007FF709710000-0x00007FF709B02000-memory.dmp	xmrig
behavioral2/memory/4168-3913-0x00007FF6843A0000-0x00007FF684792000-memory.dmp	xmrig
behavioral2/memory/3792-3910-0x00007FF774210000-0x00007FF774602000-memory.dmp	xmrig
behavioral2/memory/1840-3904-0x00007FF689CD0000-0x00007FF68A0C2000-memory.dmp	xmrig
behavioral2/memory/5004-3896-0x00007FF7ED620000-0x00007FF7EDA12000-memory.dmp	xmrig
behavioral2/memory/4532-3938-0x00007FF63E020000-0x00007FF63E412000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3724	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2532	KqclbtV.exe
4856	WcJgmMx.exe
5076	wSKWEir.exe
2784	sXGHGXX.exe
3572	nEhpXKi.exe
3020	vAmVvaU.exe
1504	wHrgwgh.exe
1848	ncCJPJa.exe
2468	hYcFovq.exe
8	JvUGLie.exe
5048	APDDNhl.exe
1840	PsPESbf.exe
3492	ODubGrQ.exe
324	KVVQBBG.exe
2800	nETblkK.exe
4532	OPukoiw.exe
5004	wFgTYui.exe
4168	PPvGkgm.exe
3884	kupKChs.exe
64	RlHcnuY.exe
2412	LdLfTlW.exe
3792	gAVaXHH.exe
4924	bbzAThb.exe
3916	SlBpPBv.exe
4492	fMbFeMV.exe
2496	NdjMcya.exe
3960	RCQoOhk.exe
5008	klgiVUF.exe
2884	keRgBjZ.exe
1856	NwmuFHe.exe
4632	zRDreaq.exe
2976	ednNwzy.exe
5096	MYZDonr.exe
2912	PgxtZFM.exe
3404	KmYfhSX.exe
1104	kCeQUgH.exe
4656	mNcVriP.exe
2476	OHyZFoy.exe
2348	VgtIztb.exe
1568	bvazdlR.exe
2636	imRqzms.exe
4836	nGUCqAp.exe
3656	tgzdEQq.exe
2268	rDRvvFW.exe
4552	xXLWNdo.exe
2240	WazyNTE.exe
5044	EgEjobz.exe
2336	yxavhMZ.exe
3588	xcpyCwU.exe
1668	ooXJYVi.exe
2144	BWlXUjf.exe
552	qgYBpjh.exe
840	gcYpYRD.exe
4496	yMBUlxC.exe
4408	CGlSUSB.exe
4364	yGLTSnv.exe
2188	SGPRjrR.exe
4840	LbkwHzZ.exe
2852	NRRDawT.exe
4824	InHClEc.exe
2184	xfaqalB.exe
1484	NwfqZFq.exe
3220	galSYDz.exe
3812	DyciWvG.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5060-0-0x00007FF72BC20000-0x00007FF72C012000-memory.dmp	upx
behavioral2/files/0x00090000000233fb-5.dat	upx
behavioral2/files/0x000700000002345f-33.dat	upx
behavioral2/files/0x0007000000023464-88.dat	upx
behavioral2/memory/3492-368-0x00007FF659BA0000-0x00007FF659F92000-memory.dmp	upx
behavioral2/memory/4532-475-0x00007FF63E020000-0x00007FF63E412000-memory.dmp	upx
behavioral2/memory/3884-599-0x00007FF709710000-0x00007FF709B02000-memory.dmp	upx
behavioral2/memory/3792-616-0x00007FF774210000-0x00007FF774602000-memory.dmp	upx
behavioral2/memory/8-619-0x00007FF6C12B0000-0x00007FF6C16A2000-memory.dmp	upx
behavioral2/memory/3916-950-0x00007FF64AB20000-0x00007FF64AF12000-memory.dmp	upx
behavioral2/memory/5004-800-0x00007FF7ED620000-0x00007FF7EDA12000-memory.dmp	upx
behavioral2/memory/4924-617-0x00007FF65A760000-0x00007FF65AB52000-memory.dmp	upx
behavioral2/memory/2412-615-0x00007FF767490000-0x00007FF767882000-memory.dmp	upx
behavioral2/memory/64-614-0x00007FF7A19D0000-0x00007FF7A1DC2000-memory.dmp	upx
behavioral2/memory/4168-496-0x00007FF6843A0000-0x00007FF684792000-memory.dmp	upx
behavioral2/memory/2800-437-0x00007FF6758C0000-0x00007FF675CB2000-memory.dmp	upx
behavioral2/memory/324-435-0x00007FF632EA0000-0x00007FF633292000-memory.dmp	upx
behavioral2/memory/1840-310-0x00007FF689CD0000-0x00007FF68A0C2000-memory.dmp	upx
behavioral2/memory/5048-252-0x00007FF72D6C0000-0x00007FF72DAB2000-memory.dmp	upx
behavioral2/memory/1848-197-0x00007FF63B240000-0x00007FF63B632000-memory.dmp	upx
behavioral2/files/0x000700000002347e-192.dat	upx
behavioral2/files/0x000700000002347a-191.dat	upx
behavioral2/files/0x0007000000023478-190.dat	upx
behavioral2/files/0x000700000002347d-185.dat	upx
behavioral2/files/0x0007000000023470-182.dat	upx
behavioral2/files/0x000700000002346f-176.dat	upx
behavioral2/files/0x0007000000023477-168.dat	upx
behavioral2/files/0x000700000002347c-167.dat	upx
behavioral2/files/0x000700000002347b-164.dat	upx
behavioral2/files/0x0007000000023469-163.dat	upx
behavioral2/files/0x0007000000023468-161.dat	upx
behavioral2/memory/2468-203-0x00007FF6F6D80000-0x00007FF6F7172000-memory.dmp	upx
behavioral2/memory/1504-156-0x00007FF6A4DF0000-0x00007FF6A51E2000-memory.dmp	upx
behavioral2/files/0x0007000000023479-150.dat	upx
behavioral2/files/0x000700000002346b-143.dat	upx
behavioral2/files/0x000700000002346e-141.dat	upx
behavioral2/files/0x0007000000023476-135.dat	upx
behavioral2/files/0x000700000002346d-132.dat	upx
behavioral2/files/0x0007000000023475-131.dat	upx
behavioral2/files/0x0007000000023467-129.dat	upx
behavioral2/files/0x0007000000023474-127.dat	upx
behavioral2/files/0x0007000000023473-126.dat	upx
behavioral2/files/0x0007000000023472-125.dat	upx
behavioral2/files/0x0007000000023471-124.dat	upx
behavioral2/files/0x000700000002346c-123.dat	upx
behavioral2/memory/3020-122-0x00007FF7AB730000-0x00007FF7ABB22000-memory.dmp	upx
behavioral2/memory/3572-117-0x00007FF7ABD80000-0x00007FF7AC172000-memory.dmp	upx
behavioral2/files/0x000700000002346a-113.dat	upx
behavioral2/files/0x0007000000023466-94.dat	upx
behavioral2/files/0x0007000000023465-90.dat	upx
behavioral2/memory/2784-83-0x00007FF640AE0000-0x00007FF640ED2000-memory.dmp	upx
behavioral2/files/0x0007000000023460-78.dat	upx
behavioral2/files/0x000700000002345e-75.dat	upx
behavioral2/files/0x0007000000023462-62.dat	upx
behavioral2/files/0x0007000000023461-61.dat	upx
behavioral2/memory/5076-55-0x00007FF73A110000-0x00007FF73A502000-memory.dmp	upx
behavioral2/memory/4856-50-0x00007FF668130000-0x00007FF668522000-memory.dmp	upx
behavioral2/files/0x0007000000023463-67.dat	upx
behavioral2/files/0x000a000000023454-45.dat	upx
behavioral2/files/0x000700000002345d-29.dat	upx
behavioral2/files/0x000700000002345c-28.dat	upx
behavioral2/memory/2532-25-0x00007FF796EF0000-0x00007FF7972E2000-memory.dmp	upx
behavioral2/memory/4856-3881-0x00007FF668130000-0x00007FF668522000-memory.dmp	upx
behavioral2/memory/2532-3883-0x00007FF796EF0000-0x00007FF7972E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gLHcbtx.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\NBMgCTH.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\FGrNrgl.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\AOieKCv.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\LspgpUp.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\ZpRdhTf.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\HDehNdC.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\bJzKtmD.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\UQjaSCu.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\BnMjLbs.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\BgGkzIG.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\kqPNrCQ.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\khCRXZi.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\mOEQcuf.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\yraaRJJ.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\ywHaXhi.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\NyuqMCX.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\aPTfVgB.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\XwfHkJY.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\oPXssIq.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\bJYctEl.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\KZHPjwy.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\KjOSgZp.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\BpmuoTS.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\POszEiC.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\GkMPsZy.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\MlZFXdz.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\thLfBpz.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\PPvMnzB.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\wJAmnxi.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\OkChtVs.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\QaNWVxW.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\QaLhIwS.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\uBRwnAc.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\ECzakaz.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\uwIhWNn.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\fbfRjAh.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\AmmjOOm.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\paUmFOU.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\JqSZkmz.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\jOZBCcZ.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\qEvrgOR.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\YPHiFSG.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\IIYMuDZ.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\EpSMNOH.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\iPvDJtP.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\gTHAuhC.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\NlRbJjA.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\DoscHIh.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\sBKFjMO.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\RzfMnAc.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\nTLyaNS.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\KYuxTOL.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\EwWfqIM.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\JpFHeMo.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\aSIjfCU.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\rILQmrL.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\xbHHwuN.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\eqCwbne.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\rOudMfP.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\IZjKugj.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\nBSJkjy.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\cwSMBYp.exe	dca88213745e0519bffd1c51ef4d8040N.exe
File created	C:\Windows\System\ePrqETd.exe	dca88213745e0519bffd1c51ef4d8040N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5060	dca88213745e0519bffd1c51ef4d8040N.exe
Token: SeLockMemoryPrivilege	5060	dca88213745e0519bffd1c51ef4d8040N.exe
Token: SeDebugPrivilege	3724	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 3724	5060	dca88213745e0519bffd1c51ef4d8040N.exe	85
PID 5060 wrote to memory of 3724	5060	dca88213745e0519bffd1c51ef4d8040N.exe	85
PID 5060 wrote to memory of 2532	5060	dca88213745e0519bffd1c51ef4d8040N.exe	86
PID 5060 wrote to memory of 2532	5060	dca88213745e0519bffd1c51ef4d8040N.exe	86
PID 5060 wrote to memory of 4856	5060	dca88213745e0519bffd1c51ef4d8040N.exe	87
PID 5060 wrote to memory of 4856	5060	dca88213745e0519bffd1c51ef4d8040N.exe	87
PID 5060 wrote to memory of 5076	5060	dca88213745e0519bffd1c51ef4d8040N.exe	88
PID 5060 wrote to memory of 5076	5060	dca88213745e0519bffd1c51ef4d8040N.exe	88
PID 5060 wrote to memory of 2784	5060	dca88213745e0519bffd1c51ef4d8040N.exe	89
PID 5060 wrote to memory of 2784	5060	dca88213745e0519bffd1c51ef4d8040N.exe	89
PID 5060 wrote to memory of 8	5060	dca88213745e0519bffd1c51ef4d8040N.exe	90
PID 5060 wrote to memory of 8	5060	dca88213745e0519bffd1c51ef4d8040N.exe	90
PID 5060 wrote to memory of 3572	5060	dca88213745e0519bffd1c51ef4d8040N.exe	91
PID 5060 wrote to memory of 3572	5060	dca88213745e0519bffd1c51ef4d8040N.exe	91
PID 5060 wrote to memory of 3020	5060	dca88213745e0519bffd1c51ef4d8040N.exe	92
PID 5060 wrote to memory of 3020	5060	dca88213745e0519bffd1c51ef4d8040N.exe	92
PID 5060 wrote to memory of 1504	5060	dca88213745e0519bffd1c51ef4d8040N.exe	93
PID 5060 wrote to memory of 1504	5060	dca88213745e0519bffd1c51ef4d8040N.exe	93
PID 5060 wrote to memory of 1848	5060	dca88213745e0519bffd1c51ef4d8040N.exe	94
PID 5060 wrote to memory of 1848	5060	dca88213745e0519bffd1c51ef4d8040N.exe	94
PID 5060 wrote to memory of 2468	5060	dca88213745e0519bffd1c51ef4d8040N.exe	95
PID 5060 wrote to memory of 2468	5060	dca88213745e0519bffd1c51ef4d8040N.exe	95
PID 5060 wrote to memory of 5048	5060	dca88213745e0519bffd1c51ef4d8040N.exe	96
PID 5060 wrote to memory of 5048	5060	dca88213745e0519bffd1c51ef4d8040N.exe	96
PID 5060 wrote to memory of 1840	5060	dca88213745e0519bffd1c51ef4d8040N.exe	97
PID 5060 wrote to memory of 1840	5060	dca88213745e0519bffd1c51ef4d8040N.exe	97
PID 5060 wrote to memory of 3492	5060	dca88213745e0519bffd1c51ef4d8040N.exe	98
PID 5060 wrote to memory of 3492	5060	dca88213745e0519bffd1c51ef4d8040N.exe	98
PID 5060 wrote to memory of 324	5060	dca88213745e0519bffd1c51ef4d8040N.exe	99
PID 5060 wrote to memory of 324	5060	dca88213745e0519bffd1c51ef4d8040N.exe	99
PID 5060 wrote to memory of 2800	5060	dca88213745e0519bffd1c51ef4d8040N.exe	100
PID 5060 wrote to memory of 2800	5060	dca88213745e0519bffd1c51ef4d8040N.exe	100
PID 5060 wrote to memory of 4532	5060	dca88213745e0519bffd1c51ef4d8040N.exe	101
PID 5060 wrote to memory of 4532	5060	dca88213745e0519bffd1c51ef4d8040N.exe	101
PID 5060 wrote to memory of 64	5060	dca88213745e0519bffd1c51ef4d8040N.exe	102
PID 5060 wrote to memory of 64	5060	dca88213745e0519bffd1c51ef4d8040N.exe	102
PID 5060 wrote to memory of 3792	5060	dca88213745e0519bffd1c51ef4d8040N.exe	103
PID 5060 wrote to memory of 3792	5060	dca88213745e0519bffd1c51ef4d8040N.exe	103
PID 5060 wrote to memory of 5004	5060	dca88213745e0519bffd1c51ef4d8040N.exe	104
PID 5060 wrote to memory of 5004	5060	dca88213745e0519bffd1c51ef4d8040N.exe	104
PID 5060 wrote to memory of 4168	5060	dca88213745e0519bffd1c51ef4d8040N.exe	105
PID 5060 wrote to memory of 4168	5060	dca88213745e0519bffd1c51ef4d8040N.exe	105
PID 5060 wrote to memory of 3884	5060	dca88213745e0519bffd1c51ef4d8040N.exe	106
PID 5060 wrote to memory of 3884	5060	dca88213745e0519bffd1c51ef4d8040N.exe	106
PID 5060 wrote to memory of 2412	5060	dca88213745e0519bffd1c51ef4d8040N.exe	107
PID 5060 wrote to memory of 2412	5060	dca88213745e0519bffd1c51ef4d8040N.exe	107
PID 5060 wrote to memory of 4924	5060	dca88213745e0519bffd1c51ef4d8040N.exe	108
PID 5060 wrote to memory of 4924	5060	dca88213745e0519bffd1c51ef4d8040N.exe	108
PID 5060 wrote to memory of 3916	5060	dca88213745e0519bffd1c51ef4d8040N.exe	109
PID 5060 wrote to memory of 3916	5060	dca88213745e0519bffd1c51ef4d8040N.exe	109
PID 5060 wrote to memory of 4492	5060	dca88213745e0519bffd1c51ef4d8040N.exe	110
PID 5060 wrote to memory of 4492	5060	dca88213745e0519bffd1c51ef4d8040N.exe	110
PID 5060 wrote to memory of 2496	5060	dca88213745e0519bffd1c51ef4d8040N.exe	111
PID 5060 wrote to memory of 2496	5060	dca88213745e0519bffd1c51ef4d8040N.exe	111
PID 5060 wrote to memory of 3960	5060	dca88213745e0519bffd1c51ef4d8040N.exe	112
PID 5060 wrote to memory of 3960	5060	dca88213745e0519bffd1c51ef4d8040N.exe	112
PID 5060 wrote to memory of 5008	5060	dca88213745e0519bffd1c51ef4d8040N.exe	113
PID 5060 wrote to memory of 5008	5060	dca88213745e0519bffd1c51ef4d8040N.exe	113
PID 5060 wrote to memory of 2884	5060	dca88213745e0519bffd1c51ef4d8040N.exe	114
PID 5060 wrote to memory of 2884	5060	dca88213745e0519bffd1c51ef4d8040N.exe	114
PID 5060 wrote to memory of 1856	5060	dca88213745e0519bffd1c51ef4d8040N.exe	115
PID 5060 wrote to memory of 1856	5060	dca88213745e0519bffd1c51ef4d8040N.exe	115
PID 5060 wrote to memory of 4632	5060	dca88213745e0519bffd1c51ef4d8040N.exe	116
PID 5060 wrote to memory of 4632	5060	dca88213745e0519bffd1c51ef4d8040N.exe	116

C:\Users\Admin\AppData\Local\Temp\dca88213745e0519bffd1c51ef4d8040N.exe
"C:\Users\Admin\AppData\Local\Temp\dca88213745e0519bffd1c51ef4d8040N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3724
- C:\Windows\System\KqclbtV.exe
  C:\Windows\System\KqclbtV.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\WcJgmMx.exe
  C:\Windows\System\WcJgmMx.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\wSKWEir.exe
  C:\Windows\System\wSKWEir.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\sXGHGXX.exe
  C:\Windows\System\sXGHGXX.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\JvUGLie.exe
  C:\Windows\System\JvUGLie.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\nEhpXKi.exe
  C:\Windows\System\nEhpXKi.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\vAmVvaU.exe
  C:\Windows\System\vAmVvaU.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\wHrgwgh.exe
  C:\Windows\System\wHrgwgh.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\ncCJPJa.exe
  C:\Windows\System\ncCJPJa.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\hYcFovq.exe
  C:\Windows\System\hYcFovq.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\APDDNhl.exe
  C:\Windows\System\APDDNhl.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\PsPESbf.exe
  C:\Windows\System\PsPESbf.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\ODubGrQ.exe
  C:\Windows\System\ODubGrQ.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\KVVQBBG.exe
  C:\Windows\System\KVVQBBG.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\nETblkK.exe
  C:\Windows\System\nETblkK.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\OPukoiw.exe
  C:\Windows\System\OPukoiw.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\RlHcnuY.exe
  C:\Windows\System\RlHcnuY.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\gAVaXHH.exe
  C:\Windows\System\gAVaXHH.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\wFgTYui.exe
  C:\Windows\System\wFgTYui.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\PPvGkgm.exe
  C:\Windows\System\PPvGkgm.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\kupKChs.exe
  C:\Windows\System\kupKChs.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\LdLfTlW.exe
  C:\Windows\System\LdLfTlW.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\bbzAThb.exe
  C:\Windows\System\bbzAThb.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\SlBpPBv.exe
  C:\Windows\System\SlBpPBv.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\fMbFeMV.exe
  C:\Windows\System\fMbFeMV.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\NdjMcya.exe
  C:\Windows\System\NdjMcya.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\RCQoOhk.exe
  C:\Windows\System\RCQoOhk.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\klgiVUF.exe
  C:\Windows\System\klgiVUF.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\keRgBjZ.exe
  C:\Windows\System\keRgBjZ.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\NwmuFHe.exe
  C:\Windows\System\NwmuFHe.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\zRDreaq.exe
  C:\Windows\System\zRDreaq.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\ednNwzy.exe
  C:\Windows\System\ednNwzy.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\MYZDonr.exe
  C:\Windows\System\MYZDonr.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\PgxtZFM.exe
  C:\Windows\System\PgxtZFM.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\KmYfhSX.exe
  C:\Windows\System\KmYfhSX.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\kCeQUgH.exe
  C:\Windows\System\kCeQUgH.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\mNcVriP.exe
  C:\Windows\System\mNcVriP.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\yxavhMZ.exe
  C:\Windows\System\yxavhMZ.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\OHyZFoy.exe
  C:\Windows\System\OHyZFoy.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\VgtIztb.exe
  C:\Windows\System\VgtIztb.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\bvazdlR.exe
  C:\Windows\System\bvazdlR.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\imRqzms.exe
  C:\Windows\System\imRqzms.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\nGUCqAp.exe
  C:\Windows\System\nGUCqAp.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\tgzdEQq.exe
  C:\Windows\System\tgzdEQq.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\rDRvvFW.exe
  C:\Windows\System\rDRvvFW.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\xXLWNdo.exe
  C:\Windows\System\xXLWNdo.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\WazyNTE.exe
  C:\Windows\System\WazyNTE.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\EgEjobz.exe
  C:\Windows\System\EgEjobz.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\xcpyCwU.exe
  C:\Windows\System\xcpyCwU.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\ooXJYVi.exe
  C:\Windows\System\ooXJYVi.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\BWlXUjf.exe
  C:\Windows\System\BWlXUjf.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\qgYBpjh.exe
  C:\Windows\System\qgYBpjh.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\IkAeSpn.exe
  C:\Windows\System\IkAeSpn.exe
  2⤵
  PID:2876
- C:\Windows\System\gcYpYRD.exe
  C:\Windows\System\gcYpYRD.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\yMBUlxC.exe
  C:\Windows\System\yMBUlxC.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\CGlSUSB.exe
  C:\Windows\System\CGlSUSB.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\yGLTSnv.exe
  C:\Windows\System\yGLTSnv.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\SGPRjrR.exe
  C:\Windows\System\SGPRjrR.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\LbkwHzZ.exe
  C:\Windows\System\LbkwHzZ.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\NRRDawT.exe
  C:\Windows\System\NRRDawT.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\InHClEc.exe
  C:\Windows\System\InHClEc.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\xfaqalB.exe
  C:\Windows\System\xfaqalB.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\NwfqZFq.exe
  C:\Windows\System\NwfqZFq.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\galSYDz.exe
  C:\Windows\System\galSYDz.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\DyciWvG.exe
  C:\Windows\System\DyciWvG.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\FWieKbp.exe
  C:\Windows\System\FWieKbp.exe
  2⤵
  PID:3452
- C:\Windows\System\uQYNoUQ.exe
  C:\Windows\System\uQYNoUQ.exe
  2⤵
  PID:2700
- C:\Windows\System\qILgwIR.exe
  C:\Windows\System\qILgwIR.exe
  2⤵
  PID:3972
- C:\Windows\System\zJrgkjN.exe
  C:\Windows\System\zJrgkjN.exe
  2⤵
  PID:3488
- C:\Windows\System\eLJEKZF.exe
  C:\Windows\System\eLJEKZF.exe
  2⤵
  PID:4556
- C:\Windows\System\UJuhvUN.exe
  C:\Windows\System\UJuhvUN.exe
  2⤵
  PID:4808
- C:\Windows\System\pBiCJFJ.exe
  C:\Windows\System\pBiCJFJ.exe
  2⤵
  PID:1760
- C:\Windows\System\SWPhVtL.exe
  C:\Windows\System\SWPhVtL.exe
  2⤵
  PID:1964
- C:\Windows\System\OvwHePE.exe
  C:\Windows\System\OvwHePE.exe
  2⤵
  PID:4784
- C:\Windows\System\auedxHd.exe
  C:\Windows\System\auedxHd.exe
  2⤵
  PID:724
- C:\Windows\System\AHfUsJC.exe
  C:\Windows\System\AHfUsJC.exe
  2⤵
  PID:5132
- C:\Windows\System\HFybiPi.exe
  C:\Windows\System\HFybiPi.exe
  2⤵
  PID:5148
- C:\Windows\System\qdKYhVZ.exe
  C:\Windows\System\qdKYhVZ.exe
  2⤵
  PID:5168
- C:\Windows\System\sdqwFKd.exe
  C:\Windows\System\sdqwFKd.exe
  2⤵
  PID:5184
- C:\Windows\System\xghwPNB.exe
  C:\Windows\System\xghwPNB.exe
  2⤵
  PID:5204
- C:\Windows\System\VdFQurU.exe
  C:\Windows\System\VdFQurU.exe
  2⤵
  PID:5220
- C:\Windows\System\zBoCGBx.exe
  C:\Windows\System\zBoCGBx.exe
  2⤵
  PID:5244
- C:\Windows\System\jfqtpTc.exe
  C:\Windows\System\jfqtpTc.exe
  2⤵
  PID:5272
- C:\Windows\System\ZngoLvs.exe
  C:\Windows\System\ZngoLvs.exe
  2⤵
  PID:5296
- C:\Windows\System\AySomLl.exe
  C:\Windows\System\AySomLl.exe
  2⤵
  PID:5320
- C:\Windows\System\kNVIown.exe
  C:\Windows\System\kNVIown.exe
  2⤵
  PID:5336
- C:\Windows\System\IeyQSfj.exe
  C:\Windows\System\IeyQSfj.exe
  2⤵
  PID:5364
- C:\Windows\System\XKyRXUF.exe
  C:\Windows\System\XKyRXUF.exe
  2⤵
  PID:5388
- C:\Windows\System\ePrqETd.exe
  C:\Windows\System\ePrqETd.exe
  2⤵
  PID:5408
- C:\Windows\System\PRHlLgg.exe
  C:\Windows\System\PRHlLgg.exe
  2⤵
  PID:5424
- C:\Windows\System\nMTxiuQ.exe
  C:\Windows\System\nMTxiuQ.exe
  2⤵
  PID:5452
- C:\Windows\System\AODSiXw.exe
  C:\Windows\System\AODSiXw.exe
  2⤵
  PID:5472
- C:\Windows\System\ckLiFhO.exe
  C:\Windows\System\ckLiFhO.exe
  2⤵
  PID:5496
- C:\Windows\System\UONjtjM.exe
  C:\Windows\System\UONjtjM.exe
  2⤵
  PID:5512
- C:\Windows\System\rfIylCM.exe
  C:\Windows\System\rfIylCM.exe
  2⤵
  PID:5532
- C:\Windows\System\vELXRPd.exe
  C:\Windows\System\vELXRPd.exe
  2⤵
  PID:5552
- C:\Windows\System\EXvEzFb.exe
  C:\Windows\System\EXvEzFb.exe
  2⤵
  PID:5588
- C:\Windows\System\GOYMOCX.exe
  C:\Windows\System\GOYMOCX.exe
  2⤵
  PID:5644
- C:\Windows\System\sMVnpif.exe
  C:\Windows\System\sMVnpif.exe
  2⤵
  PID:5668
- C:\Windows\System\FPslaur.exe
  C:\Windows\System\FPslaur.exe
  2⤵
  PID:5684
- C:\Windows\System\SaAijPr.exe
  C:\Windows\System\SaAijPr.exe
  2⤵
  PID:5708
- C:\Windows\System\bIwyUET.exe
  C:\Windows\System\bIwyUET.exe
  2⤵
  PID:5732
- C:\Windows\System\IVeKeVc.exe
  C:\Windows\System\IVeKeVc.exe
  2⤵
  PID:5752
- C:\Windows\System\CfCEVXq.exe
  C:\Windows\System\CfCEVXq.exe
  2⤵
  PID:5768
- C:\Windows\System\AKWikPy.exe
  C:\Windows\System\AKWikPy.exe
  2⤵
  PID:5792
- C:\Windows\System\NgJTNZa.exe
  C:\Windows\System\NgJTNZa.exe
  2⤵
  PID:5816
- C:\Windows\System\TTInxCT.exe
  C:\Windows\System\TTInxCT.exe
  2⤵
  PID:5836
- C:\Windows\System\jJarEoa.exe
  C:\Windows\System\jJarEoa.exe
  2⤵
  PID:5860
- C:\Windows\System\QdgxQHz.exe
  C:\Windows\System\QdgxQHz.exe
  2⤵
  PID:5876
- C:\Windows\System\twDRHAv.exe
  C:\Windows\System\twDRHAv.exe
  2⤵
  PID:5900
- C:\Windows\System\yKISZJW.exe
  C:\Windows\System\yKISZJW.exe
  2⤵
  PID:5916
- C:\Windows\System\lznjSFq.exe
  C:\Windows\System\lznjSFq.exe
  2⤵
  PID:5940
- C:\Windows\System\oQruhOq.exe
  C:\Windows\System\oQruhOq.exe
  2⤵
  PID:5956
- C:\Windows\System\KyIpkTw.exe
  C:\Windows\System\KyIpkTw.exe
  2⤵
  PID:5980
- C:\Windows\System\ENqtuOw.exe
  C:\Windows\System\ENqtuOw.exe
  2⤵
  PID:6008
- C:\Windows\System\HAyfAyJ.exe
  C:\Windows\System\HAyfAyJ.exe
  2⤵
  PID:6028
- C:\Windows\System\iDZYAOl.exe
  C:\Windows\System\iDZYAOl.exe
  2⤵
  PID:6052
- C:\Windows\System\IPIDFYP.exe
  C:\Windows\System\IPIDFYP.exe
  2⤵
  PID:6068
- C:\Windows\System\AoQCaZj.exe
  C:\Windows\System\AoQCaZj.exe
  2⤵
  PID:6084
- C:\Windows\System\ioYMRKj.exe
  C:\Windows\System\ioYMRKj.exe
  2⤵
  PID:6108
- C:\Windows\System\yjvZydf.exe
  C:\Windows\System\yjvZydf.exe
  2⤵
  PID:6128
- C:\Windows\System\RAfJBhn.exe
  C:\Windows\System\RAfJBhn.exe
  2⤵
  PID:972
- C:\Windows\System\mlXENri.exe
  C:\Windows\System\mlXENri.exe
  2⤵
  PID:3840
- C:\Windows\System\GEjZKtW.exe
  C:\Windows\System\GEjZKtW.exe
  2⤵
  PID:2304
- C:\Windows\System\XBrttkf.exe
  C:\Windows\System\XBrttkf.exe
  2⤵
  PID:2076
- C:\Windows\System\lHVhwLT.exe
  C:\Windows\System\lHVhwLT.exe
  2⤵
  PID:3032
- C:\Windows\System\vZKlfSi.exe
  C:\Windows\System\vZKlfSi.exe
  2⤵
  PID:4348
- C:\Windows\System\HQdjYOA.exe
  C:\Windows\System\HQdjYOA.exe
  2⤵
  PID:1500
- C:\Windows\System\HAKDVeA.exe
  C:\Windows\System\HAKDVeA.exe
  2⤵
  PID:3080
- C:\Windows\System\kEfqsBT.exe
  C:\Windows\System\kEfqsBT.exe
  2⤵
  PID:1844
- C:\Windows\System\YWvhxMg.exe
  C:\Windows\System\YWvhxMg.exe
  2⤵
  PID:2996
- C:\Windows\System\SBeZuTH.exe
  C:\Windows\System\SBeZuTH.exe
  2⤵
  PID:5416
- C:\Windows\System\RZoQHHy.exe
  C:\Windows\System\RZoQHHy.exe
  2⤵
  PID:5444
- C:\Windows\System\uZQeMqF.exe
  C:\Windows\System\uZQeMqF.exe
  2⤵
  PID:5544
- C:\Windows\System\PhJxGTj.exe
  C:\Windows\System\PhJxGTj.exe
  2⤵
  PID:1656
- C:\Windows\System\LhGHAZn.exe
  C:\Windows\System\LhGHAZn.exe
  2⤵
  PID:3876
- C:\Windows\System\XfnJeBk.exe
  C:\Windows\System\XfnJeBk.exe
  2⤵
  PID:2248
- C:\Windows\System\TjVoSuY.exe
  C:\Windows\System\TjVoSuY.exe
  2⤵
  PID:3120
- C:\Windows\System\opqNKcx.exe
  C:\Windows\System\opqNKcx.exe
  2⤵
  PID:5868
- C:\Windows\System\LCNEdNF.exe
  C:\Windows\System\LCNEdNF.exe
  2⤵
  PID:5952
- C:\Windows\System\fMiWIne.exe
  C:\Windows\System\fMiWIne.exe
  2⤵
  PID:5992
- C:\Windows\System\HoSNsaw.exe
  C:\Windows\System\HoSNsaw.exe
  2⤵
  PID:6396
- C:\Windows\System\jlxFskZ.exe
  C:\Windows\System\jlxFskZ.exe
  2⤵
  PID:6424
- C:\Windows\System\EenDgvx.exe
  C:\Windows\System\EenDgvx.exe
  2⤵
  PID:6440
- C:\Windows\System\eNpIclT.exe
  C:\Windows\System\eNpIclT.exe
  2⤵
  PID:6456
- C:\Windows\System\YPfDzpy.exe
  C:\Windows\System\YPfDzpy.exe
  2⤵
  PID:6496
- C:\Windows\System\SzNRUYo.exe
  C:\Windows\System\SzNRUYo.exe
  2⤵
  PID:6516
- C:\Windows\System\BOzqxiq.exe
  C:\Windows\System\BOzqxiq.exe
  2⤵
  PID:6532
- C:\Windows\System\HEvBPUs.exe
  C:\Windows\System\HEvBPUs.exe
  2⤵
  PID:6552
- C:\Windows\System\zQFauke.exe
  C:\Windows\System\zQFauke.exe
  2⤵
  PID:6572
- C:\Windows\System\KkjYlCB.exe
  C:\Windows\System\KkjYlCB.exe
  2⤵
  PID:6596
- C:\Windows\System\nJTzFRm.exe
  C:\Windows\System\nJTzFRm.exe
  2⤵
  PID:6612
- C:\Windows\System\WCKChsR.exe
  C:\Windows\System\WCKChsR.exe
  2⤵
  PID:6632
- C:\Windows\System\cNbMMyf.exe
  C:\Windows\System\cNbMMyf.exe
  2⤵
  PID:6672
- C:\Windows\System\FMiocGH.exe
  C:\Windows\System\FMiocGH.exe
  2⤵
  PID:6864
- C:\Windows\System\PGYWYye.exe
  C:\Windows\System\PGYWYye.exe
  2⤵
  PID:6888
- C:\Windows\System\nyefqmI.exe
  C:\Windows\System\nyefqmI.exe
  2⤵
  PID:6904
- C:\Windows\System\ZTIoAxq.exe
  C:\Windows\System\ZTIoAxq.exe
  2⤵
  PID:6920
- C:\Windows\System\wnNrrIa.exe
  C:\Windows\System\wnNrrIa.exe
  2⤵
  PID:6936
- C:\Windows\System\IkPyYhf.exe
  C:\Windows\System\IkPyYhf.exe
  2⤵
  PID:6952
- C:\Windows\System\eFuZmJT.exe
  C:\Windows\System\eFuZmJT.exe
  2⤵
  PID:6972
- C:\Windows\System\RpTFAiQ.exe
  C:\Windows\System\RpTFAiQ.exe
  2⤵
  PID:6992
- C:\Windows\System\WXGkXgS.exe
  C:\Windows\System\WXGkXgS.exe
  2⤵
  PID:7012
- C:\Windows\System\cLdznVE.exe
  C:\Windows\System\cLdznVE.exe
  2⤵
  PID:7028
- C:\Windows\System\FgEdkzW.exe
  C:\Windows\System\FgEdkzW.exe
  2⤵
  PID:7048
- C:\Windows\System\jqsUCRR.exe
  C:\Windows\System\jqsUCRR.exe
  2⤵
  PID:7068
- C:\Windows\System\THQobSP.exe
  C:\Windows\System\THQobSP.exe
  2⤵
  PID:7088
- C:\Windows\System\jrsyMpk.exe
  C:\Windows\System\jrsyMpk.exe
  2⤵
  PID:7108
- C:\Windows\System\axasfGQ.exe
  C:\Windows\System\axasfGQ.exe
  2⤵
  PID:7124
- C:\Windows\System\EmfiowQ.exe
  C:\Windows\System\EmfiowQ.exe
  2⤵
  PID:7144
- C:\Windows\System\iFsLJyH.exe
  C:\Windows\System\iFsLJyH.exe
  2⤵
  PID:7164
- C:\Windows\System\HFUdbWV.exe
  C:\Windows\System\HFUdbWV.exe
  2⤵
  PID:872
- C:\Windows\System\QpeNOEL.exe
  C:\Windows\System\QpeNOEL.exe
  2⤵
  PID:5160
- C:\Windows\System\TpyIEfa.exe
  C:\Windows\System\TpyIEfa.exe
  2⤵
  PID:5128
- C:\Windows\System\fiAgMLA.exe
  C:\Windows\System\fiAgMLA.exe
  2⤵
  PID:5216
- C:\Windows\System\CQqZNfj.exe
  C:\Windows\System\CQqZNfj.exe
  2⤵
  PID:5260
- C:\Windows\System\AXZOnZE.exe
  C:\Windows\System\AXZOnZE.exe
  2⤵
  PID:5292
- C:\Windows\System\PYCkmdE.exe
  C:\Windows\System\PYCkmdE.exe
  2⤵
  PID:5376
- C:\Windows\System\LibCFAo.exe
  C:\Windows\System\LibCFAo.exe
  2⤵
  PID:5480
- C:\Windows\System\KnCKSfu.exe
  C:\Windows\System\KnCKSfu.exe
  2⤵
  PID:3396
- C:\Windows\System\TYLjcvl.exe
  C:\Windows\System\TYLjcvl.exe
  2⤵
  PID:3696
- C:\Windows\System\GqioKYc.exe
  C:\Windows\System\GqioKYc.exe
  2⤵
  PID:6252
- C:\Windows\System\DYscbTE.exe
  C:\Windows\System\DYscbTE.exe
  2⤵
  PID:5596
- C:\Windows\System\GsYbgZX.exe
  C:\Windows\System\GsYbgZX.exe
  2⤵
  PID:5652
- C:\Windows\System\vnBINwQ.exe
  C:\Windows\System\vnBINwQ.exe
  2⤵
  PID:5692
- C:\Windows\System\sTXzIDg.exe
  C:\Windows\System\sTXzIDg.exe
  2⤵
  PID:5724
- C:\Windows\System\ivzSuWH.exe
  C:\Windows\System\ivzSuWH.exe
  2⤵
  PID:5800
- C:\Windows\System\KBDvJTt.exe
  C:\Windows\System\KBDvJTt.exe
  2⤵
  PID:5832
- C:\Windows\System\LIsrXDB.exe
  C:\Windows\System\LIsrXDB.exe
  2⤵
  PID:5948
- C:\Windows\System\GimAZbR.exe
  C:\Windows\System\GimAZbR.exe
  2⤵
  PID:4336
- C:\Windows\System\fdIOtgL.exe
  C:\Windows\System\fdIOtgL.exe
  2⤵
  PID:3984
- C:\Windows\System\mrxpCgX.exe
  C:\Windows\System\mrxpCgX.exe
  2⤵
  PID:6692
- C:\Windows\System\junAAyW.exe
  C:\Windows\System\junAAyW.exe
  2⤵
  PID:2364
- C:\Windows\System\bQNIzzA.exe
  C:\Windows\System\bQNIzzA.exe
  2⤵
  PID:7372
- C:\Windows\System\iqqAEBu.exe
  C:\Windows\System\iqqAEBu.exe
  2⤵
  PID:7388
- C:\Windows\System\PpEuniu.exe
  C:\Windows\System\PpEuniu.exe
  2⤵
  PID:7404
- C:\Windows\System\mRtWfTy.exe
  C:\Windows\System\mRtWfTy.exe
  2⤵
  PID:7420
- C:\Windows\System\MuOwmTa.exe
  C:\Windows\System\MuOwmTa.exe
  2⤵
  PID:7436
- C:\Windows\System\UwTlRzm.exe
  C:\Windows\System\UwTlRzm.exe
  2⤵
  PID:7452
- C:\Windows\System\YFCOMfA.exe
  C:\Windows\System\YFCOMfA.exe
  2⤵
  PID:7468
- C:\Windows\System\mXSivSe.exe
  C:\Windows\System\mXSivSe.exe
  2⤵
  PID:7484
- C:\Windows\System\QdPqwoT.exe
  C:\Windows\System\QdPqwoT.exe
  2⤵
  PID:7500
- C:\Windows\System\dujINEn.exe
  C:\Windows\System\dujINEn.exe
  2⤵
  PID:7516
- C:\Windows\System\gTHAuhC.exe
  C:\Windows\System\gTHAuhC.exe
  2⤵
  PID:7532
- C:\Windows\System\LNwjbFl.exe
  C:\Windows\System\LNwjbFl.exe
  2⤵
  PID:7548
- C:\Windows\System\azourof.exe
  C:\Windows\System\azourof.exe
  2⤵
  PID:7564
- C:\Windows\System\XAuePjK.exe
  C:\Windows\System\XAuePjK.exe
  2⤵
  PID:7580
- C:\Windows\System\zBfRKMA.exe
  C:\Windows\System\zBfRKMA.exe
  2⤵
  PID:7720
- C:\Windows\System\KfcYxEI.exe
  C:\Windows\System\KfcYxEI.exe
  2⤵
  PID:7736
- C:\Windows\System\qSjrWIy.exe
  C:\Windows\System\qSjrWIy.exe
  2⤵
  PID:7752
- C:\Windows\System\cQkfAIL.exe
  C:\Windows\System\cQkfAIL.exe
  2⤵
  PID:7768
- C:\Windows\System\jZIpHDt.exe
  C:\Windows\System\jZIpHDt.exe
  2⤵
  PID:7784
- C:\Windows\System\GXVvpsq.exe
  C:\Windows\System\GXVvpsq.exe
  2⤵
  PID:7804
- C:\Windows\System\QOpjDFZ.exe
  C:\Windows\System\QOpjDFZ.exe
  2⤵
  PID:7828
- C:\Windows\System\msDEkbW.exe
  C:\Windows\System\msDEkbW.exe
  2⤵
  PID:7848
- C:\Windows\System\TBmERay.exe
  C:\Windows\System\TBmERay.exe
  2⤵
  PID:7880
- C:\Windows\System\tAjzWZT.exe
  C:\Windows\System\tAjzWZT.exe
  2⤵
  PID:7904
- C:\Windows\System\EjcVijO.exe
  C:\Windows\System\EjcVijO.exe
  2⤵
  PID:7988
- C:\Windows\System\GxiVPBp.exe
  C:\Windows\System\GxiVPBp.exe
  2⤵
  PID:8008
- C:\Windows\System\XtgDtnp.exe
  C:\Windows\System\XtgDtnp.exe
  2⤵
  PID:8024
- C:\Windows\System\eepZYaS.exe
  C:\Windows\System\eepZYaS.exe
  2⤵
  PID:8048
- C:\Windows\System\IDZxLbB.exe
  C:\Windows\System\IDZxLbB.exe
  2⤵
  PID:8068
- C:\Windows\System\jXXbRqw.exe
  C:\Windows\System\jXXbRqw.exe
  2⤵
  PID:8088
- C:\Windows\System\NqLYZvj.exe
  C:\Windows\System\NqLYZvj.exe
  2⤵
  PID:8104
- C:\Windows\System\CPpahtv.exe
  C:\Windows\System\CPpahtv.exe
  2⤵
  PID:8188
- C:\Windows\System\rCTgdRo.exe
  C:\Windows\System\rCTgdRo.exe
  2⤵
  PID:3040
- C:\Windows\System\jvDkPeY.exe
  C:\Windows\System\jvDkPeY.exe
  2⤵
  PID:3484
- C:\Windows\System\caoUlxl.exe
  C:\Windows\System\caoUlxl.exe
  2⤵
  PID:5884
- C:\Windows\System\QHFKoGz.exe
  C:\Windows\System\QHFKoGz.exe
  2⤵
  PID:6148
- C:\Windows\System\sjzPYLY.exe
  C:\Windows\System\sjzPYLY.exe
  2⤵
  PID:7044
- C:\Windows\System\lXhygse.exe
  C:\Windows\System\lXhygse.exe
  2⤵
  PID:6628
- C:\Windows\System\oAHGVJc.exe
  C:\Windows\System\oAHGVJc.exe
  2⤵
  PID:6656
- C:\Windows\System\ZCYreqL.exe
  C:\Windows\System\ZCYreqL.exe
  2⤵
  PID:6304
- C:\Windows\System\neZwseo.exe
  C:\Windows\System\neZwseo.exe
  2⤵
  PID:6352
- C:\Windows\System\FcBEiaX.exe
  C:\Windows\System\FcBEiaX.exe
  2⤵
  PID:6432
- C:\Windows\System\NcpPyxq.exe
  C:\Windows\System\NcpPyxq.exe
  2⤵
  PID:6476
- C:\Windows\System\MuKDXsZ.exe
  C:\Windows\System\MuKDXsZ.exe
  2⤵
  PID:6512
- C:\Windows\System\LVMrtLS.exe
  C:\Windows\System\LVMrtLS.exe
  2⤵
  PID:6544
- C:\Windows\System\TMzlTzX.exe
  C:\Windows\System\TMzlTzX.exe
  2⤵
  PID:6640
- C:\Windows\System\LuCZePf.exe
  C:\Windows\System\LuCZePf.exe
  2⤵
  PID:6716
- C:\Windows\System\zJFOchL.exe
  C:\Windows\System\zJFOchL.exe
  2⤵
  PID:3536
- C:\Windows\System\AocMqiz.exe
  C:\Windows\System\AocMqiz.exe
  2⤵
  PID:5680
- C:\Windows\System\pnpGKmm.exe
  C:\Windows\System\pnpGKmm.exe
  2⤵
  PID:6988
- C:\Windows\System\DFpwkAv.exe
  C:\Windows\System\DFpwkAv.exe
  2⤵
  PID:7100
- C:\Windows\System\oVdNCPA.exe
  C:\Windows\System\oVdNCPA.exe
  2⤵
  PID:2540
- C:\Windows\System\ZzueHmF.exe
  C:\Windows\System\ZzueHmF.exe
  2⤵
  PID:6688
- C:\Windows\System\EmYugiH.exe
  C:\Windows\System\EmYugiH.exe
  2⤵
  PID:5328
- C:\Windows\System\yoAhMHu.exe
  C:\Windows\System\yoAhMHu.exe
  2⤵
  PID:7236
- C:\Windows\System\GnFKEYB.exe
  C:\Windows\System\GnFKEYB.exe
  2⤵
  PID:7264
- C:\Windows\System\anoHxrc.exe
  C:\Windows\System\anoHxrc.exe
  2⤵
  PID:7588
- C:\Windows\System\dmrqIVl.exe
  C:\Windows\System\dmrqIVl.exe
  2⤵
  PID:7692
- C:\Windows\System\PaGJEPg.exe
  C:\Windows\System\PaGJEPg.exe
  2⤵
  PID:6876
- C:\Windows\System\hsOSytK.exe
  C:\Windows\System\hsOSytK.exe
  2⤵
  PID:6916
- C:\Windows\System\xHOiiYM.exe
  C:\Windows\System\xHOiiYM.exe
  2⤵
  PID:6964
- C:\Windows\System\ptEKjnI.exe
  C:\Windows\System\ptEKjnI.exe
  2⤵
  PID:5288
- C:\Windows\System\MDuKhKY.exe
  C:\Windows\System\MDuKhKY.exe
  2⤵
  PID:4564
- C:\Windows\System\GjnuHzp.exe
  C:\Windows\System\GjnuHzp.exe
  2⤵
  PID:5780
- C:\Windows\System\xVrwcIL.exe
  C:\Windows\System\xVrwcIL.exe
  2⤵
  PID:6240
- C:\Windows\System\jLSscsL.exe
  C:\Windows\System\jLSscsL.exe
  2⤵
  PID:7872
- C:\Windows\System\uoRQErt.exe
  C:\Windows\System\uoRQErt.exe
  2⤵
  PID:7956
- C:\Windows\System\DLCeplV.exe
  C:\Windows\System\DLCeplV.exe
  2⤵
  PID:7448
- C:\Windows\System\AHuzcSf.exe
  C:\Windows\System\AHuzcSf.exe
  2⤵
  PID:7528
- C:\Windows\System\GSPNQMl.exe
  C:\Windows\System\GSPNQMl.exe
  2⤵
  PID:7592
- C:\Windows\System\tLXMaNo.exe
  C:\Windows\System\tLXMaNo.exe
  2⤵
  PID:7492
- C:\Windows\System\HeraMlx.exe
  C:\Windows\System\HeraMlx.exe
  2⤵
  PID:7428
- C:\Windows\System\xbFDwFs.exe
  C:\Windows\System\xbFDwFs.exe
  2⤵
  PID:7172
- C:\Windows\System\WEQBBMf.exe
  C:\Windows\System\WEQBBMf.exe
  2⤵
  PID:5812
- C:\Windows\System\aQiUTrG.exe
  C:\Windows\System\aQiUTrG.exe
  2⤵
  PID:5580
- C:\Windows\System\zGhPgXu.exe
  C:\Windows\System\zGhPgXu.exe
  2⤵
  PID:5400
- C:\Windows\System\vkRXGff.exe
  C:\Windows\System\vkRXGff.exe
  2⤵
  PID:4576
- C:\Windows\System\xSeHyob.exe
  C:\Windows\System\xSeHyob.exe
  2⤵
  PID:7116
- C:\Windows\System\turYGgt.exe
  C:\Windows\System\turYGgt.exe
  2⤵
  PID:7596
- C:\Windows\System\jRxdDJt.exe
  C:\Windows\System\jRxdDJt.exe
  2⤵
  PID:8040
- C:\Windows\System\LeEYmLs.exe
  C:\Windows\System\LeEYmLs.exe
  2⤵
  PID:7636
- C:\Windows\System\WCwrCrF.exe
  C:\Windows\System\WCwrCrF.exe
  2⤵
  PID:8204
- C:\Windows\System\KHhHVNB.exe
  C:\Windows\System\KHhHVNB.exe
  2⤵
  PID:8224
- C:\Windows\System\pvcESfa.exe
  C:\Windows\System\pvcESfa.exe
  2⤵
  PID:8244
- C:\Windows\System\KXXxzbY.exe
  C:\Windows\System\KXXxzbY.exe
  2⤵
  PID:8268
- C:\Windows\System\zAWkfAp.exe
  C:\Windows\System\zAWkfAp.exe
  2⤵
  PID:8288
- C:\Windows\System\fmInaNo.exe
  C:\Windows\System\fmInaNo.exe
  2⤵
  PID:8304
- C:\Windows\System\RkHTqsl.exe
  C:\Windows\System\RkHTqsl.exe
  2⤵
  PID:8324
- C:\Windows\System\VhBVGjT.exe
  C:\Windows\System\VhBVGjT.exe
  2⤵
  PID:8340
- C:\Windows\System\rHyYMHN.exe
  C:\Windows\System\rHyYMHN.exe
  2⤵
  PID:8360
- C:\Windows\System\FAWXZVl.exe
  C:\Windows\System\FAWXZVl.exe
  2⤵
  PID:8392
- C:\Windows\System\Vfxmlqi.exe
  C:\Windows\System\Vfxmlqi.exe
  2⤵
  PID:8408
- C:\Windows\System\IKEJKag.exe
  C:\Windows\System\IKEJKag.exe
  2⤵
  PID:8428
- C:\Windows\System\smdXXuE.exe
  C:\Windows\System\smdXXuE.exe
  2⤵
  PID:8452
- C:\Windows\System\FJhkbkq.exe
  C:\Windows\System\FJhkbkq.exe
  2⤵
  PID:8468
- C:\Windows\System\rzCIDzk.exe
  C:\Windows\System\rzCIDzk.exe
  2⤵
  PID:8492
- C:\Windows\System\ZfUVKTf.exe
  C:\Windows\System\ZfUVKTf.exe
  2⤵
  PID:8528
- C:\Windows\System\IRGdESU.exe
  C:\Windows\System\IRGdESU.exe
  2⤵
  PID:8552
- C:\Windows\System\BlSChHT.exe
  C:\Windows\System\BlSChHT.exe
  2⤵
  PID:8692
- C:\Windows\System\bIvRUQk.exe
  C:\Windows\System\bIvRUQk.exe
  2⤵
  PID:8712
- C:\Windows\System\Srhlxvg.exe
  C:\Windows\System\Srhlxvg.exe
  2⤵
  PID:8728
- C:\Windows\System\YTpEMkJ.exe
  C:\Windows\System\YTpEMkJ.exe
  2⤵
  PID:8748
- C:\Windows\System\xGWkgkr.exe
  C:\Windows\System\xGWkgkr.exe
  2⤵
  PID:8768
- C:\Windows\System\jnklZzq.exe
  C:\Windows\System\jnklZzq.exe
  2⤵
  PID:8788
- C:\Windows\System\pjXsOLr.exe
  C:\Windows\System\pjXsOLr.exe
  2⤵
  PID:8808
- C:\Windows\System\YgDwJtI.exe
  C:\Windows\System\YgDwJtI.exe
  2⤵
  PID:8832
- C:\Windows\System\MSAiQtX.exe
  C:\Windows\System\MSAiQtX.exe
  2⤵
  PID:8852
- C:\Windows\System\rNefMPF.exe
  C:\Windows\System\rNefMPF.exe
  2⤵
  PID:8876
- C:\Windows\System\FYwyqJj.exe
  C:\Windows\System\FYwyqJj.exe
  2⤵
  PID:8892
- C:\Windows\System\DWgSlMW.exe
  C:\Windows\System\DWgSlMW.exe
  2⤵
  PID:8912
- C:\Windows\System\DxKgxry.exe
  C:\Windows\System\DxKgxry.exe
  2⤵
  PID:8940
- C:\Windows\System\SzcjVGS.exe
  C:\Windows\System\SzcjVGS.exe
  2⤵
  PID:8956
- C:\Windows\System\VdXnXGQ.exe
  C:\Windows\System\VdXnXGQ.exe
  2⤵
  PID:8988
- C:\Windows\System\HanTxaP.exe
  C:\Windows\System\HanTxaP.exe
  2⤵
  PID:9008
- C:\Windows\System\dmLfeDF.exe
  C:\Windows\System\dmLfeDF.exe
  2⤵
  PID:9024
- C:\Windows\System\VUIhleS.exe
  C:\Windows\System\VUIhleS.exe
  2⤵
  PID:9040
- C:\Windows\System\uUKcXwv.exe
  C:\Windows\System\uUKcXwv.exe
  2⤵
  PID:9056
- C:\Windows\System\WLagQVh.exe
  C:\Windows\System\WLagQVh.exe
  2⤵
  PID:9076
- C:\Windows\System\ZNqhOAA.exe
  C:\Windows\System\ZNqhOAA.exe
  2⤵
  PID:9096
- C:\Windows\System\rJJpiyE.exe
  C:\Windows\System\rJJpiyE.exe
  2⤵
  PID:9120
- C:\Windows\System\AdShIjP.exe
  C:\Windows\System\AdShIjP.exe
  2⤵
  PID:9140
- C:\Windows\System\TTTYTen.exe
  C:\Windows\System\TTTYTen.exe
  2⤵
  PID:9160
- C:\Windows\System\pywECzF.exe
  C:\Windows\System\pywECzF.exe
  2⤵
  PID:9184
- C:\Windows\System\oWAIYmF.exe
  C:\Windows\System\oWAIYmF.exe
  2⤵
  PID:9200
- C:\Windows\System\yoNBDKA.exe
  C:\Windows\System\yoNBDKA.exe
  2⤵
  PID:7760
- C:\Windows\System\ArCqFTd.exe
  C:\Windows\System\ArCqFTd.exe
  2⤵
  PID:7780
- C:\Windows\System\zEXZmOg.exe
  C:\Windows\System\zEXZmOg.exe
  2⤵
  PID:7160
- C:\Windows\System\yrlXdFF.exe
  C:\Windows\System\yrlXdFF.exe
  2⤵
  PID:7836
- C:\Windows\System\HvmfrkB.exe
  C:\Windows\System\HvmfrkB.exe
  2⤵
  PID:7676
- C:\Windows\System\cZbLaOX.exe
  C:\Windows\System\cZbLaOX.exe
  2⤵
  PID:6948
- C:\Windows\System\eewWNJl.exe
  C:\Windows\System\eewWNJl.exe
  2⤵
  PID:7888
- C:\Windows\System\guwclDf.exe
  C:\Windows\System\guwclDf.exe
  2⤵
  PID:5720
- C:\Windows\System\VqNOhmp.exe
  C:\Windows\System\VqNOhmp.exe
  2⤵
  PID:6120
- C:\Windows\System\OLuVaWd.exe
  C:\Windows\System\OLuVaWd.exe
  2⤵
  PID:7796
- C:\Windows\System\JZwbeqO.exe
  C:\Windows\System\JZwbeqO.exe
  2⤵
  PID:9228
- C:\Windows\System\FEDXMht.exe
  C:\Windows\System\FEDXMht.exe
  2⤵
  PID:9244
- C:\Windows\System\BykyleA.exe
  C:\Windows\System\BykyleA.exe
  2⤵
  PID:9272
- C:\Windows\System\HOSXfiG.exe
  C:\Windows\System\HOSXfiG.exe
  2⤵
  PID:9288
- C:\Windows\System\CLhEPdk.exe
  C:\Windows\System\CLhEPdk.exe
  2⤵
  PID:9312
- C:\Windows\System\aJcUHUK.exe
  C:\Windows\System\aJcUHUK.exe
  2⤵
  PID:9332
- C:\Windows\System\ZhRwNDg.exe
  C:\Windows\System\ZhRwNDg.exe
  2⤵
  PID:9348
- C:\Windows\System\FQIpktt.exe
  C:\Windows\System\FQIpktt.exe
  2⤵
  PID:9604
- C:\Windows\System\PcctPTp.exe
  C:\Windows\System\PcctPTp.exe
  2⤵
  PID:9704
- C:\Windows\System\NehxQLz.exe
  C:\Windows\System\NehxQLz.exe
  2⤵
  PID:9720
- C:\Windows\System\cIxIIcM.exe
  C:\Windows\System\cIxIIcM.exe
  2⤵
  PID:9736
- C:\Windows\System\YKNZpdx.exe
  C:\Windows\System\YKNZpdx.exe
  2⤵
  PID:9752
- C:\Windows\System\XUgOvod.exe
  C:\Windows\System\XUgOvod.exe
  2⤵
  PID:9768
- C:\Windows\System\YcjbYKF.exe
  C:\Windows\System\YcjbYKF.exe
  2⤵
  PID:9784
- C:\Windows\System\tzbHnqA.exe
  C:\Windows\System\tzbHnqA.exe
  2⤵
  PID:9808
- C:\Windows\System\vvcsJGk.exe
  C:\Windows\System\vvcsJGk.exe
  2⤵
  PID:9824
- C:\Windows\System\uLoAhEx.exe
  C:\Windows\System\uLoAhEx.exe
  2⤵
  PID:9860
- C:\Windows\System\WMmwmgn.exe
  C:\Windows\System\WMmwmgn.exe
  2⤵
  PID:9876
- C:\Windows\System\dNrejnT.exe
  C:\Windows\System\dNrejnT.exe
  2⤵
  PID:9892
- C:\Windows\System\ravuWwc.exe
  C:\Windows\System\ravuWwc.exe
  2⤵
  PID:9908
- C:\Windows\System\MZPnJUq.exe
  C:\Windows\System\MZPnJUq.exe
  2⤵
  PID:9924
- C:\Windows\System\jBSFXkA.exe
  C:\Windows\System\jBSFXkA.exe
  2⤵
  PID:9940
- C:\Windows\System\xNCvYfI.exe
  C:\Windows\System\xNCvYfI.exe
  2⤵
  PID:9956
- C:\Windows\System\SANrMXw.exe
  C:\Windows\System\SANrMXw.exe
  2⤵
  PID:9972
- C:\Windows\System\NBLqjkT.exe
  C:\Windows\System\NBLqjkT.exe
  2⤵
  PID:9992
- C:\Windows\System\WnlhVGK.exe
  C:\Windows\System\WnlhVGK.exe
  2⤵
  PID:10008
- C:\Windows\System\eyaNSZM.exe
  C:\Windows\System\eyaNSZM.exe
  2⤵
  PID:10028
- C:\Windows\System\ZPNhjKP.exe
  C:\Windows\System\ZPNhjKP.exe
  2⤵
  PID:10048
- C:\Windows\System\RvPEWxx.exe
  C:\Windows\System\RvPEWxx.exe
  2⤵
  PID:10076
- C:\Windows\System\xBlXvNS.exe
  C:\Windows\System\xBlXvNS.exe
  2⤵
  PID:10096
- C:\Windows\System\KqRUCrc.exe
  C:\Windows\System\KqRUCrc.exe
  2⤵
  PID:10116
- C:\Windows\System\MivSUlZ.exe
  C:\Windows\System\MivSUlZ.exe
  2⤵
  PID:10140
- C:\Windows\System\xdJcATd.exe
  C:\Windows\System\xdJcATd.exe
  2⤵
  PID:10160
- C:\Windows\System\FSEYTNm.exe
  C:\Windows\System\FSEYTNm.exe
  2⤵
  PID:10184
- C:\Windows\System\TNPeKfc.exe
  C:\Windows\System\TNPeKfc.exe
  2⤵
  PID:10204
- C:\Windows\System\uaReebp.exe
  C:\Windows\System\uaReebp.exe
  2⤵
  PID:10224
- C:\Windows\System\JLFcXfJ.exe
  C:\Windows\System\JLFcXfJ.exe
  2⤵
  PID:8216
- C:\Windows\System\OsnpoCx.exe
  C:\Windows\System\OsnpoCx.exe
  2⤵
  PID:8300
- C:\Windows\System\IiDNiwo.exe
  C:\Windows\System\IiDNiwo.exe
  2⤵
  PID:8348
- C:\Windows\System\mjbIrSO.exe
  C:\Windows\System\mjbIrSO.exe
  2⤵
  PID:2164
- C:\Windows\System\bpjgBBj.exe
  C:\Windows\System\bpjgBBj.exe
  2⤵
  PID:5236
- C:\Windows\System\cXpHeIW.exe
  C:\Windows\System\cXpHeIW.exe
  2⤵
  PID:8116
- C:\Windows\System\yLKUWNg.exe
  C:\Windows\System\yLKUWNg.exe
  2⤵
  PID:7368
- C:\Windows\System\ZaKWRye.exe
  C:\Windows\System\ZaKWRye.exe
  2⤵
  PID:8172
- C:\Windows\System\UnHBnWw.exe
  C:\Windows\System\UnHBnWw.exe
  2⤵
  PID:316
- C:\Windows\System\hnkreMf.exe
  C:\Windows\System\hnkreMf.exe
  2⤵
  PID:4876
- C:\Windows\System\QMnlbEF.exe
  C:\Windows\System\QMnlbEF.exe
  2⤵
  PID:6624
- C:\Windows\System\uIXaALJ.exe
  C:\Windows\System\uIXaALJ.exe
  2⤵
  PID:6292
- C:\Windows\System\IYoPalo.exe
  C:\Windows\System\IYoPalo.exe
  2⤵
  PID:6620
- C:\Windows\System\NzbsIcD.exe
  C:\Windows\System\NzbsIcD.exe
  2⤵
  PID:5192
- C:\Windows\System\qngSIaA.exe
  C:\Windows\System\qngSIaA.exe
  2⤵
  PID:7004
- C:\Windows\System\mZtRVTD.exe
  C:\Windows\System\mZtRVTD.exe
  2⤵
  PID:8848
- C:\Windows\System\RVsqoAp.exe
  C:\Windows\System\RVsqoAp.exe
  2⤵
  PID:7228
- C:\Windows\System\uUncmun.exe
  C:\Windows\System\uUncmun.exe
  2⤵
  PID:8888
- C:\Windows\System\ZIrhPhE.exe
  C:\Windows\System\ZIrhPhE.exe
  2⤵
  PID:8964
- C:\Windows\System\NpUrSNr.exe
  C:\Windows\System\NpUrSNr.exe
  2⤵
  PID:9036
- C:\Windows\System\sfGqVqX.exe
  C:\Windows\System\sfGqVqX.exe
  2⤵
  PID:9128
- C:\Windows\System\UGGxixZ.exe
  C:\Windows\System\UGGxixZ.exe
  2⤵
  PID:9180
- C:\Windows\System\svebPyi.exe
  C:\Windows\System\svebPyi.exe
  2⤵
  PID:7480
- C:\Windows\System\IIYMuDZ.exe
  C:\Windows\System\IIYMuDZ.exe
  2⤵
  PID:7540
- C:\Windows\System\UTOjlAi.exe
  C:\Windows\System\UTOjlAi.exe
  2⤵
  PID:6232
- C:\Windows\System\AqTpiQf.exe
  C:\Windows\System\AqTpiQf.exe
  2⤵
  PID:8212
- C:\Windows\System\UduduPM.exe
  C:\Windows\System\UduduPM.exe
  2⤵
  PID:8384
- C:\Windows\System\HPjVbRO.exe
  C:\Windows\System\HPjVbRO.exe
  2⤵
  PID:8476
- C:\Windows\System\ZlGobDP.exe
  C:\Windows\System\ZlGobDP.exe
  2⤵
  PID:8524
- C:\Windows\System\RVmocZJ.exe
  C:\Windows\System\RVmocZJ.exe
  2⤵
  PID:8656
- C:\Windows\System\cjfLfNn.exe
  C:\Windows\System\cjfLfNn.exe
  2⤵
  PID:8724
- C:\Windows\System\fCwAPog.exe
  C:\Windows\System\fCwAPog.exe
  2⤵
  PID:8796
- C:\Windows\System\wyydTBS.exe
  C:\Windows\System\wyydTBS.exe
  2⤵
  PID:1300
- C:\Windows\System\dNPjbkV.exe
  C:\Windows\System\dNPjbkV.exe
  2⤵
  PID:4484
- C:\Windows\System\NFflnAW.exe
  C:\Windows\System\NFflnAW.exe
  2⤵
  PID:10260
- C:\Windows\System\qMNCuUv.exe
  C:\Windows\System\qMNCuUv.exe
  2⤵
  PID:10284
- C:\Windows\System\putBWuw.exe
  C:\Windows\System\putBWuw.exe
  2⤵
  PID:10620
- C:\Windows\System\lWQSMFV.exe
  C:\Windows\System\lWQSMFV.exe
  2⤵
  PID:10756
- C:\Windows\System\UCnaklg.exe
  C:\Windows\System\UCnaklg.exe
  2⤵
  PID:10820
- C:\Windows\System\JqGaiaI.exe
  C:\Windows\System\JqGaiaI.exe
  2⤵
  PID:10840
- C:\Windows\System\ZUBRAhG.exe
  C:\Windows\System\ZUBRAhG.exe
  2⤵
  PID:10864
- C:\Windows\System\uCXMPYX.exe
  C:\Windows\System\uCXMPYX.exe
  2⤵
  PID:10884
- C:\Windows\System\HHeEDGR.exe
  C:\Windows\System\HHeEDGR.exe
  2⤵
  PID:10908
- C:\Windows\System\LFUseiA.exe
  C:\Windows\System\LFUseiA.exe
  2⤵
  PID:10932
- C:\Windows\System\lLYjJuN.exe
  C:\Windows\System\lLYjJuN.exe
  2⤵
  PID:10952
- C:\Windows\System\dAnVSJa.exe
  C:\Windows\System\dAnVSJa.exe
  2⤵
  PID:10976
- C:\Windows\System\MaatKVl.exe
  C:\Windows\System\MaatKVl.exe
  2⤵
  PID:10996
- C:\Windows\System\jOZBCcZ.exe
  C:\Windows\System\jOZBCcZ.exe
  2⤵
  PID:11016
- C:\Windows\System\NinwtIr.exe
  C:\Windows\System\NinwtIr.exe
  2⤵
  PID:11040
- C:\Windows\System\UQjaSCu.exe
  C:\Windows\System\UQjaSCu.exe
  2⤵
  PID:11068
- C:\Windows\System\ByvQWQx.exe
  C:\Windows\System\ByvQWQx.exe
  2⤵
  PID:11088
- C:\Windows\System\GOHApFc.exe
  C:\Windows\System\GOHApFc.exe
  2⤵
  PID:11108
- C:\Windows\System\siRGAvA.exe
  C:\Windows\System\siRGAvA.exe
  2⤵
  PID:11128
- C:\Windows\System\XyMbymd.exe
  C:\Windows\System\XyMbymd.exe
  2⤵
  PID:11156
- C:\Windows\System\kygSXtY.exe
  C:\Windows\System\kygSXtY.exe
  2⤵
  PID:11172
- C:\Windows\System\djYDLlh.exe
  C:\Windows\System\djYDLlh.exe
  2⤵
  PID:11192
- C:\Windows\System\hXeNOBk.exe
  C:\Windows\System\hXeNOBk.exe
  2⤵
  PID:11212
- C:\Windows\System\XTkGnyg.exe
  C:\Windows\System\XTkGnyg.exe
  2⤵
  PID:11228
- C:\Windows\System\UowrfwF.exe
  C:\Windows\System\UowrfwF.exe
  2⤵
  PID:11256
- C:\Windows\System\SELtAfy.exe
  C:\Windows\System\SELtAfy.exe
  2⤵
  PID:2652
- C:\Windows\System\QCWrmFx.exe
  C:\Windows\System\QCWrmFx.exe
  2⤵
  PID:9208
- C:\Windows\System\OxVvBpu.exe
  C:\Windows\System\OxVvBpu.exe
  2⤵
  PID:8236
- C:\Windows\System\kwWOMyk.exe
  C:\Windows\System\kwWOMyk.exe
  2⤵
  PID:4008
- C:\Windows\System\AsEqpQY.exe
  C:\Windows\System\AsEqpQY.exe
  2⤵
  PID:4420
- C:\Windows\System\vkSPIhz.exe
  C:\Windows\System\vkSPIhz.exe
  2⤵
  PID:2552
- C:\Windows\System\xoYWlnb.exe
  C:\Windows\System\xoYWlnb.exe
  2⤵
  PID:8420
- C:\Windows\System\MgkEeUu.exe
  C:\Windows\System\MgkEeUu.exe
  2⤵
  PID:8500
- C:\Windows\System\CniVNeT.exe
  C:\Windows\System\CniVNeT.exe
  2⤵
  PID:8720
- C:\Windows\System\aDlPjTf.exe
  C:\Windows\System\aDlPjTf.exe
  2⤵
  PID:8820
- C:\Windows\System\jSZIKTL.exe
  C:\Windows\System\jSZIKTL.exe
  2⤵
  PID:8904
- C:\Windows\System\mCHTGgX.exe
  C:\Windows\System\mCHTGgX.exe
  2⤵
  PID:9068
- C:\Windows\System\qnWczFF.exe
  C:\Windows\System\qnWczFF.exe
  2⤵
  PID:9152
- C:\Windows\System\iaKkEzX.exe
  C:\Windows\System\iaKkEzX.exe
  2⤵
  PID:7776
- C:\Windows\System\Rssrgpq.exe
  C:\Windows\System\Rssrgpq.exe
  2⤵
  PID:8076
- C:\Windows\System\hzQXXZY.exe
  C:\Windows\System\hzQXXZY.exe
  2⤵
  PID:9340
- C:\Windows\System\LMalDRd.exe
  C:\Windows\System\LMalDRd.exe
  2⤵
  PID:7280
- C:\Windows\System\DgSjfEP.exe
  C:\Windows\System\DgSjfEP.exe
  2⤵
  PID:4688
- C:\Windows\System\djfjuAu.exe
  C:\Windows\System\djfjuAu.exe
  2⤵
  PID:9284
- C:\Windows\System\XiLAuMP.exe
  C:\Windows\System\XiLAuMP.exe
  2⤵
  PID:3388
- C:\Windows\System\MrbzTba.exe
  C:\Windows\System\MrbzTba.exe
  2⤵
  PID:6268
- C:\Windows\System\fzDBBnn.exe
  C:\Windows\System\fzDBBnn.exe
  2⤵
  PID:8280
- C:\Windows\System\XoKCnxE.exe
  C:\Windows\System\XoKCnxE.exe
  2⤵
  PID:8648
- C:\Windows\System\pLTEbdp.exe
  C:\Windows\System\pLTEbdp.exe
  2⤵
  PID:4996
- C:\Windows\System\MqsHKPm.exe
  C:\Windows\System\MqsHKPm.exe
  2⤵
  PID:7460
- C:\Windows\System\ySAhBgx.exe
  C:\Windows\System\ySAhBgx.exe
  2⤵
  PID:10176
- C:\Windows\System\TBejAFm.exe
  C:\Windows\System\TBejAFm.exe
  2⤵
  PID:7976
- C:\Windows\System\Njeyxxp.exe
  C:\Windows\System\Njeyxxp.exe
  2⤵
  PID:6340
- C:\Windows\System\Msejjcu.exe
  C:\Windows\System\Msejjcu.exe
  2⤵
  PID:9696
- C:\Windows\System\UPnZZgv.exe
  C:\Windows\System\UPnZZgv.exe
  2⤵
  PID:9712
- C:\Windows\System\YnOndQJ.exe
  C:\Windows\System\YnOndQJ.exe
  2⤵
  PID:9744
- C:\Windows\System\JXfkypH.exe
  C:\Windows\System\JXfkypH.exe
  2⤵
  PID:9764
- C:\Windows\System\urzlVtX.exe
  C:\Windows\System\urzlVtX.exe
  2⤵
  PID:11292
- C:\Windows\System\YGlEtCb.exe
  C:\Windows\System\YGlEtCb.exe
  2⤵
  PID:11308
- C:\Windows\System\CSHlgjB.exe
  C:\Windows\System\CSHlgjB.exe
  2⤵
  PID:11356
- C:\Windows\System\zpTCzgs.exe
  C:\Windows\System\zpTCzgs.exe
  2⤵
  PID:11380
- C:\Windows\System\XvLvYsV.exe
  C:\Windows\System\XvLvYsV.exe
  2⤵
  PID:11408
- C:\Windows\System\nERiyqY.exe
  C:\Windows\System\nERiyqY.exe
  2⤵
  PID:11428
- C:\Windows\System\TqaBNjK.exe
  C:\Windows\System\TqaBNjK.exe
  2⤵
  PID:11444
- C:\Windows\System\ucPCcfc.exe
  C:\Windows\System\ucPCcfc.exe
  2⤵
  PID:11464
- C:\Windows\System\lYtsEIW.exe
  C:\Windows\System\lYtsEIW.exe
  2⤵
  PID:11480
- C:\Windows\System\yCrajzN.exe
  C:\Windows\System\yCrajzN.exe
  2⤵
  PID:11512
- C:\Windows\System\TdRHppU.exe
  C:\Windows\System\TdRHppU.exe
  2⤵
  PID:11536
- C:\Windows\System\QaNWVxW.exe
  C:\Windows\System\QaNWVxW.exe
  2⤵
  PID:11556
- C:\Windows\System\SckMpSh.exe
  C:\Windows\System\SckMpSh.exe
  2⤵
  PID:11572
- C:\Windows\System\GXdMQav.exe
  C:\Windows\System\GXdMQav.exe
  2⤵
  PID:11596
- C:\Windows\System\PBrDtoP.exe
  C:\Windows\System\PBrDtoP.exe
  2⤵
  PID:11620
- C:\Windows\System\KhEmivC.exe
  C:\Windows\System\KhEmivC.exe
  2⤵
  PID:11644
- C:\Windows\System\CPWcPbs.exe
  C:\Windows\System\CPWcPbs.exe
  2⤵
  PID:11672
- C:\Windows\System\PXFgYzT.exe
  C:\Windows\System\PXFgYzT.exe
  2⤵
  PID:11688
- C:\Windows\System\iuzKKgy.exe
  C:\Windows\System\iuzKKgy.exe
  2⤵
  PID:11712
- C:\Windows\System\bwVHvKe.exe
  C:\Windows\System\bwVHvKe.exe
  2⤵
  PID:11744
- C:\Windows\System\HMHnkcx.exe
  C:\Windows\System\HMHnkcx.exe
  2⤵
  PID:11796
- C:\Windows\System\gSFhRtJ.exe
  C:\Windows\System\gSFhRtJ.exe
  2⤵
  PID:11816
- C:\Windows\System\qQBtsnG.exe
  C:\Windows\System\qQBtsnG.exe
  2⤵
  PID:11840
- C:\Windows\System\iXWNQHa.exe
  C:\Windows\System\iXWNQHa.exe
  2⤵
  PID:11864
- C:\Windows\System\XSZZCUF.exe
  C:\Windows\System\XSZZCUF.exe
  2⤵
  PID:11884
- C:\Windows\System\EIYwDBG.exe
  C:\Windows\System\EIYwDBG.exe
  2⤵
  PID:11904
- C:\Windows\System\xPVlvPk.exe
  C:\Windows\System\xPVlvPk.exe
  2⤵
  PID:11928
- C:\Windows\System\NTiOVJf.exe
  C:\Windows\System\NTiOVJf.exe
  2⤵
  PID:11956
- C:\Windows\System\BAIDGDd.exe
  C:\Windows\System\BAIDGDd.exe
  2⤵
  PID:11972
- C:\Windows\System\MfYXxRQ.exe
  C:\Windows\System\MfYXxRQ.exe
  2⤵
  PID:11992
- C:\Windows\System\RfAkAFM.exe
  C:\Windows\System\RfAkAFM.exe
  2⤵
  PID:12016
- C:\Windows\System\vtqyPzf.exe
  C:\Windows\System\vtqyPzf.exe
  2⤵
  PID:12040
- C:\Windows\System\GJPnXac.exe
  C:\Windows\System\GJPnXac.exe
  2⤵
  PID:12068
- C:\Windows\System\gfjwdmo.exe
  C:\Windows\System\gfjwdmo.exe
  2⤵
  PID:12088
- C:\Windows\System\sjKiGBT.exe
  C:\Windows\System\sjKiGBT.exe
  2⤵
  PID:12112
- C:\Windows\System\pVTADsL.exe
  C:\Windows\System\pVTADsL.exe
  2⤵
  PID:12140
- C:\Windows\System\agLMJYa.exe
  C:\Windows\System\agLMJYa.exe
  2⤵
  PID:12156
- C:\Windows\System\HHVxGNu.exe
  C:\Windows\System\HHVxGNu.exe
  2⤵
  PID:12176
- C:\Windows\System\DuSUvwP.exe
  C:\Windows\System\DuSUvwP.exe
  2⤵
  PID:12192
- C:\Windows\System\LwcDCxA.exe
  C:\Windows\System\LwcDCxA.exe
  2⤵
  PID:12208
- C:\Windows\System\UCXTLCs.exe
  C:\Windows\System\UCXTLCs.exe
  2⤵
  PID:12224
- C:\Windows\System\dtfLukN.exe
  C:\Windows\System\dtfLukN.exe
  2⤵
  PID:12240
- C:\Windows\System\vtLNPzc.exe
  C:\Windows\System\vtLNPzc.exe
  2⤵
  PID:12256
- C:\Windows\System\mCjgspI.exe
  C:\Windows\System\mCjgspI.exe
  2⤵
  PID:12272
- C:\Windows\System\vJODXHh.exe
  C:\Windows\System\vJODXHh.exe
  2⤵
  PID:10632
- C:\Windows\System\ZFzPNNf.exe
  C:\Windows\System\ZFzPNNf.exe
  2⤵
  PID:10108
- C:\Windows\System\xWFRQtD.exe
  C:\Windows\System\xWFRQtD.exe
  2⤵
  PID:5640
- C:\Windows\System\qpfGOms.exe
  C:\Windows\System\qpfGOms.exe
  2⤵
  PID:9796
- C:\Windows\System\LPsDmom.exe
  C:\Windows\System\LPsDmom.exe
  2⤵
  PID:9832
- C:\Windows\System\dsNVGXB.exe
  C:\Windows\System\dsNVGXB.exe
  2⤵
  PID:9900
- C:\Windows\System\XviCvJy.exe
  C:\Windows\System\XviCvJy.exe
  2⤵
  PID:9948
- C:\Windows\System\ELXNNdK.exe
  C:\Windows\System\ELXNNdK.exe
  2⤵
  PID:8548
- C:\Windows\System\tDVUsCf.exe
  C:\Windows\System\tDVUsCf.exe
  2⤵
  PID:10776
- C:\Windows\System\OVlozXd.exe
  C:\Windows\System\OVlozXd.exe
  2⤵
  PID:8680
- C:\Windows\System\UpyaFkj.exe
  C:\Windows\System\UpyaFkj.exe
  2⤵
  PID:7512
- C:\Windows\System\TKmvCiP.exe
  C:\Windows\System\TKmvCiP.exe
  2⤵
  PID:4596
- C:\Windows\System\YWWMnTa.exe
  C:\Windows\System\YWWMnTa.exe
  2⤵
  PID:10880
- C:\Windows\System\qvMiPSN.exe
  C:\Windows\System\qvMiPSN.exe
  2⤵
  PID:10948
- C:\Windows\System\Aysstvv.exe
  C:\Windows\System\Aysstvv.exe
  2⤵
  PID:10036
- C:\Windows\System\qFDmMub.exe
  C:\Windows\System\qFDmMub.exe
  2⤵
  PID:11096
- C:\Windows\System\UmkoicV.exe
  C:\Windows\System\UmkoicV.exe
  2⤵
  PID:11120
- C:\Windows\System\ZTSHoth.exe
  C:\Windows\System\ZTSHoth.exe
  2⤵
  PID:11220
- C:\Windows\System\DdeoJjT.exe
  C:\Windows\System\DdeoJjT.exe
  2⤵
  PID:10192
- C:\Windows\System\TAtTWgT.exe
  C:\Windows\System\TAtTWgT.exe
  2⤵
  PID:11052
- C:\Windows\System\rRSSWnp.exe
  C:\Windows\System\rRSSWnp.exe
  2⤵
  PID:8016
- C:\Windows\System\rsguqEh.exe
  C:\Windows\System\rsguqEh.exe
  2⤵
  PID:11168
- C:\Windows\System\lSvWzOv.exe
  C:\Windows\System\lSvWzOv.exe
  2⤵
  PID:8780
- C:\Windows\System\uIMXlKM.exe
  C:\Windows\System\uIMXlKM.exe
  2⤵
  PID:12316
- C:\Windows\System\maTRzEg.exe
  C:\Windows\System\maTRzEg.exe
  2⤵
  PID:12332
- C:\Windows\System\sxXiuoQ.exe
  C:\Windows\System\sxXiuoQ.exe
  2⤵
  PID:12348
- C:\Windows\System\ZwLNcxO.exe
  C:\Windows\System\ZwLNcxO.exe
  2⤵
  PID:12368
- C:\Windows\System\WmrnKOe.exe
  C:\Windows\System\WmrnKOe.exe
  2⤵
  PID:12384
- C:\Windows\System\OXPKRJy.exe
  C:\Windows\System\OXPKRJy.exe
  2⤵
  PID:12400
- C:\Windows\System\zPaOJgs.exe
  C:\Windows\System\zPaOJgs.exe
  2⤵
  PID:12440
- C:\Windows\System\fLtrcCg.exe
  C:\Windows\System\fLtrcCg.exe
  2⤵
  PID:12464
- C:\Windows\System\vHIhsAG.exe
  C:\Windows\System\vHIhsAG.exe
  2⤵
  PID:12492
- C:\Windows\System\LSPNxCh.exe
  C:\Windows\System\LSPNxCh.exe
  2⤵
  PID:12508
- C:\Windows\System\PVUPJwR.exe
  C:\Windows\System\PVUPJwR.exe
  2⤵
  PID:12524
- C:\Windows\System\FCMsMkG.exe
  C:\Windows\System\FCMsMkG.exe
  2⤵
  PID:12544
- C:\Windows\System\ibxNpOF.exe
  C:\Windows\System\ibxNpOF.exe
  2⤵
  PID:12564
- C:\Windows\System\afcRQcx.exe
  C:\Windows\System\afcRQcx.exe
  2⤵
  PID:12584
- C:\Windows\System\JQSbjHk.exe
  C:\Windows\System\JQSbjHk.exe
  2⤵
  PID:12604
- C:\Windows\System\QzxXJPu.exe
  C:\Windows\System\QzxXJPu.exe
  2⤵
  PID:12628
- C:\Windows\System\yXpbRfW.exe
  C:\Windows\System\yXpbRfW.exe
  2⤵
  PID:12652
- C:\Windows\System\GSeuLSg.exe
  C:\Windows\System\GSeuLSg.exe
  2⤵
  PID:12676
- C:\Windows\System\YVShcsL.exe
  C:\Windows\System\YVShcsL.exe
  2⤵
  PID:12696
- C:\Windows\System\jaraKDo.exe
  C:\Windows\System\jaraKDo.exe
  2⤵
  PID:12716
- C:\Windows\System\sLkeJjk.exe
  C:\Windows\System\sLkeJjk.exe
  2⤵
  PID:12740
- C:\Windows\System\yKlRmsT.exe
  C:\Windows\System\yKlRmsT.exe
  2⤵
  PID:12760
- C:\Windows\System\ijoEsDI.exe
  C:\Windows\System\ijoEsDI.exe
  2⤵
  PID:12780
- C:\Windows\System\JsMeIxs.exe
  C:\Windows\System\JsMeIxs.exe
  2⤵
  PID:12796
- C:\Windows\System\JpFHeMo.exe
  C:\Windows\System\JpFHeMo.exe
  2⤵
  PID:12812
- C:\Windows\System\hCJmhJn.exe
  C:\Windows\System\hCJmhJn.exe
  2⤵
  PID:12832
- C:\Windows\System\cykVRvo.exe
  C:\Windows\System\cykVRvo.exe
  2⤵
  PID:12852
- C:\Windows\System\ussYoUe.exe
  C:\Windows\System\ussYoUe.exe
  2⤵
  PID:12876
- C:\Windows\System\gmqpjrd.exe
  C:\Windows\System\gmqpjrd.exe
  2⤵
  PID:12904
- C:\Windows\System\cpJmqSa.exe
  C:\Windows\System\cpJmqSa.exe
  2⤵
  PID:12924
- C:\Windows\System\zqkqvmB.exe
  C:\Windows\System\zqkqvmB.exe
  2⤵
  PID:12944
- C:\Windows\System\MIRVDzs.exe
  C:\Windows\System\MIRVDzs.exe
  2⤵
  PID:12968
- C:\Windows\System\muMkHNk.exe
  C:\Windows\System\muMkHNk.exe
  2⤵
  PID:13000
- C:\Windows\System\HNrNKoK.exe
  C:\Windows\System\HNrNKoK.exe
  2⤵
  PID:13020
- C:\Windows\System\hqWcvZq.exe
  C:\Windows\System\hqWcvZq.exe
  2⤵
  PID:13040
- C:\Windows\System\RoFtUnW.exe
  C:\Windows\System\RoFtUnW.exe
  2⤵
  PID:13072
- C:\Windows\System\fkTDtPD.exe
  C:\Windows\System\fkTDtPD.exe
  2⤵
  PID:13092
- C:\Windows\System\PFqVEDq.exe
  C:\Windows\System\PFqVEDq.exe
  2⤵
  PID:13108
- C:\Windows\System\MkSuHBe.exe
  C:\Windows\System\MkSuHBe.exe
  2⤵
  PID:13128
- C:\Windows\System\SHVeWRy.exe
  C:\Windows\System\SHVeWRy.exe
  2⤵
  PID:13144
- C:\Windows\System\BXtrAVA.exe
  C:\Windows\System\BXtrAVA.exe
  2⤵
  PID:13168
- C:\Windows\System\fsDtIkV.exe
  C:\Windows\System\fsDtIkV.exe
  2⤵
  PID:13188
- C:\Windows\System\dPEGBoT.exe
  C:\Windows\System\dPEGBoT.exe
  2⤵
  PID:13208
- C:\Windows\System\EpmBmlL.exe
  C:\Windows\System\EpmBmlL.exe
  2⤵
  PID:13232
- C:\Windows\System\WWRENOA.exe
  C:\Windows\System\WWRENOA.exe
  2⤵
  PID:13256
- C:\Windows\System\PpVSFgT.exe
  C:\Windows\System\PpVSFgT.exe
  2⤵
  PID:13276
- C:\Windows\System\DGlFjJF.exe
  C:\Windows\System\DGlFjJF.exe
  2⤵
  PID:13292
- C:\Windows\System\yeExkLz.exe
  C:\Windows\System\yeExkLz.exe
  2⤵
  PID:10396
- C:\Windows\System\pBXYmlr.exe
  C:\Windows\System\pBXYmlr.exe
  2⤵
  PID:10460
- C:\Windows\System\edJfqgL.exe
  C:\Windows\System\edJfqgL.exe
  2⤵
  PID:10560
- C:\Windows\System\zpVKYsk.exe
  C:\Windows\System\zpVKYsk.exe
  2⤵
  PID:10608
- C:\Windows\System\NPDYQdV.exe
  C:\Windows\System\NPDYQdV.exe
  2⤵
  PID:11532
- C:\Windows\System\CvzrlhB.exe
  C:\Windows\System\CvzrlhB.exe
  2⤵
  PID:2232
- C:\Windows\System\JRnxXIW.exe
  C:\Windows\System\JRnxXIW.exe
  2⤵
  PID:10924
- C:\Windows\System\zlkKajX.exe
  C:\Windows\System\zlkKajX.exe
  2⤵
  PID:10964
- C:\Windows\System\whCGjfe.exe
  C:\Windows\System\whCGjfe.exe
  2⤵
  PID:12504
- C:\Windows\System\dlVWwuU.exe
  C:\Windows\System\dlVWwuU.exe
  2⤵
  PID:12324
- C:\Windows\System\KMnjUaU.exe
  C:\Windows\System\KMnjUaU.exe
  2⤵
  PID:12360
- C:\Windows\System\yKmqxXw.exe
  C:\Windows\System\yKmqxXw.exe
  2⤵
  PID:12824
- C:\Windows\System\SViTmZw.exe
  C:\Windows\System\SViTmZw.exe
  2⤵
  PID:10452
- C:\Windows\System\lxfLgMd.exe
  C:\Windows\System\lxfLgMd.exe
  2⤵
  PID:896
- C:\Windows\System\FHKLOzC.exe
  C:\Windows\System\FHKLOzC.exe
  2⤵
  PID:5040
- C:\Windows\System\sdbkBSI.exe
  C:\Windows\System\sdbkBSI.exe
  2⤵
  PID:12152
- C:\Windows\System\ZjMtKOH.exe
  C:\Windows\System\ZjMtKOH.exe
  2⤵
  PID:3296
- C:\Windows\System\IweWPfX.exe
  C:\Windows\System\IweWPfX.exe
  2⤵
  PID:11008
- C:\Windows\System\WPxZjbE.exe
  C:\Windows\System\WPxZjbE.exe
  2⤵
  PID:13060
- C:\Windows\System\uZYTapO.exe
  C:\Windows\System\uZYTapO.exe
  2⤵
  PID:13224
- C:\Windows\System\piXnkBY.exe
  C:\Windows\System\piXnkBY.exe
  2⤵
  PID:13240
- C:\Windows\System\KJTfOjk.exe
  C:\Windows\System\KJTfOjk.exe
  2⤵
  PID:11968
- C:\Windows\System\KKcCHBb.exe
  C:\Windows\System\KKcCHBb.exe
  2⤵
  PID:10616
- C:\Windows\System\vbyjoqf.exe
  C:\Windows\System\vbyjoqf.exe
  2⤵
  PID:1548
- C:\Windows\System\fBFupxN.exe
  C:\Windows\System\fBFupxN.exe
  2⤵
  PID:9868
- C:\Windows\System\szlWXGZ.exe
  C:\Windows\System\szlWXGZ.exe
  2⤵
  PID:10156
- C:\Windows\System\ptSoEKh.exe
  C:\Windows\System\ptSoEKh.exe
  2⤵
  PID:10200
- C:\Windows\System\PrWnJEW.exe
  C:\Windows\System\PrWnJEW.exe
  2⤵
  PID:12788
- C:\Windows\System\twMPdaw.exe
  C:\Windows\System\twMPdaw.exe
  2⤵
  PID:8784
- C:\Windows\System\CiVyUsg.exe
  C:\Windows\System\CiVyUsg.exe
  2⤵
  PID:13284
- C:\Windows\System\LHJfUoE.exe
  C:\Windows\System\LHJfUoE.exe
  2⤵
  PID:11708
- C:\Windows\System\WHzsupl.exe
  C:\Windows\System\WHzsupl.exe
  2⤵
  PID:4460
- C:\Windows\System\qNCSvWM.exe
  C:\Windows\System\qNCSvWM.exe
  2⤵
  PID:13120
- C:\Windows\System\POtyhKX.exe
  C:\Windows\System\POtyhKX.exe
  2⤵
  PID:12868
- C:\Windows\System\hIOyvlQ.exe
  C:\Windows\System\hIOyvlQ.exe
  2⤵
  PID:10588
- C:\Windows\System\CenABuk.exe
  C:\Windows\System\CenABuk.exe
  2⤵
  PID:6404
- C:\Windows\System\GKDszns.exe
  C:\Windows\System\GKDszns.exe
  2⤵
  PID:640
- C:\Windows\System\oaAAcCN.exe
  C:\Windows\System\oaAAcCN.exe
  2⤵
  PID:9192
- C:\Windows\System\HdtigzV.exe
  C:\Windows\System\HdtigzV.exe
  2⤵
  PID:11736
- C:\Windows\System\NiEckqm.exe
  C:\Windows\System\NiEckqm.exe
  2⤵
  PID:12540
- C:\Windows\System\YwUZpPL.exe
  C:\Windows\System\YwUZpPL.exe
  2⤵
  PID:12636
- C:\Windows\System\BHtXViF.exe
  C:\Windows\System\BHtXViF.exe
  2⤵
  PID:12860
- C:\Windows\System\XyLTtJZ.exe
  C:\Windows\System\XyLTtJZ.exe
  2⤵
  PID:12148
- C:\Windows\System\hYsaGID.exe
  C:\Windows\System\hYsaGID.exe
  2⤵
  PID:11124
- C:\Windows\System\AWyfHQi.exe
  C:\Windows\System\AWyfHQi.exe
  2⤵
  PID:8148
- C:\Windows\System\VQbakTb.exe
  C:\Windows\System\VQbakTb.exe
  2⤵
  PID:4528
- C:\Windows\System\iBcxpqy.exe
  C:\Windows\System\iBcxpqy.exe
  2⤵
  PID:12900
- C:\Windows\System\vIKhrba.exe
  C:\Windows\System\vIKhrba.exe
  2⤵
  PID:12808
- C:\Windows\System\fuEVUOk.exe
  C:\Windows\System\fuEVUOk.exe
  2⤵
  PID:12964
- C:\Windows\System\lifjPsM.exe
  C:\Windows\System\lifjPsM.exe
  2⤵
  PID:11564
- C:\Windows\System\cMTQKmz.exe
  C:\Windows\System\cMTQKmz.exe
  2⤵
  PID:12344
- C:\Windows\System\iIhrrxb.exe
  C:\Windows\System\iIhrrxb.exe
  2⤵
  PID:13088
- C:\Windows\System\DpwOZNd.exe
  C:\Windows\System\DpwOZNd.exe
  2⤵
  PID:11640
- C:\Windows\System\ELHhQUx.exe
  C:\Windows\System\ELHhQUx.exe
  2⤵
  PID:2768
- C:\Windows\System\VAkRQms.exe
  C:\Windows\System\VAkRQms.exe
  2⤵
  PID:11892
- C:\Windows\System\XYdvhIp.exe
  C:\Windows\System\XYdvhIp.exe
  2⤵
  PID:8060
- C:\Windows\System\AgIgYlX.exe
  C:\Windows\System\AgIgYlX.exe
  2⤵
  PID:1872
- C:\Windows\System\upwZiqf.exe
  C:\Windows\System\upwZiqf.exe
  2⤵
  PID:11696
- C:\Windows\System\TqYpCtN.exe
  C:\Windows\System\TqYpCtN.exe
  2⤵
  PID:2488
- C:\Windows\System\xqFDMJJ.exe
  C:\Windows\System\xqFDMJJ.exe
  2⤵
  PID:12992
- C:\Windows\System\LSayCHQ.exe
  C:\Windows\System\LSayCHQ.exe
  2⤵
  PID:11184
- C:\Windows\System\cUbclyo.exe
  C:\Windows\System\cUbclyo.exe
  2⤵
  PID:4768
- C:\Windows\System\EutzYAE.exe
  C:\Windows\System\EutzYAE.exe
  2⤵
  PID:1100
- C:\Windows\System\CcOslWa.exe
  C:\Windows\System\CcOslWa.exe
  2⤵
  PID:10244
- C:\Windows\System\xbseMsq.exe
  C:\Windows\System\xbseMsq.exe
  2⤵
  PID:13048
- C:\Windows\System\CIlnTTg.exe
  C:\Windows\System\CIlnTTg.exe
  2⤵
  PID:11208
- C:\Windows\System\QNXzlAp.exe
  C:\Windows\System\QNXzlAp.exe
  2⤵
  PID:12624
- C:\Windows\System\BQPuEsd.exe
  C:\Windows\System\BQPuEsd.exe
  2⤵
  PID:13164
- C:\Windows\System\nsFHxIa.exe
  C:\Windows\System\nsFHxIa.exe
  2⤵
  PID:12296
- C:\Windows\System\PDGtlOB.exe
  C:\Windows\System\PDGtlOB.exe
  2⤵
  PID:11520
- C:\Windows\System\jbgSCLK.exe
  C:\Windows\System\jbgSCLK.exe
  2⤵
  PID:3680
- C:\Windows\System\LnHegPU.exe
  C:\Windows\System\LnHegPU.exe
  2⤵
  PID:12048
- C:\Windows\System\sBPkQfd.exe
  C:\Windows\System\sBPkQfd.exe
  2⤵
  PID:6188
- C:\Windows\System\gUZdUxj.exe
  C:\Windows\System\gUZdUxj.exe
  2⤵
  PID:1776
- C:\Windows\System\IGvfKMC.exe
  C:\Windows\System\IGvfKMC.exe
  2⤵
  PID:7356
- C:\Windows\System\mhmcIlk.exe
  C:\Windows\System\mhmcIlk.exe
  2⤵
  PID:7352
- C:\Windows\System\CzsJsPh.exe
  C:\Windows\System\CzsJsPh.exe
  2⤵
  PID:11372
- C:\Windows\System\BTiTUCd.exe
  C:\Windows\System\BTiTUCd.exe
  2⤵
  PID:1728
- C:\Windows\System\yUkArvE.exe
  C:\Windows\System\yUkArvE.exe
  2⤵
  PID:812
- C:\Windows\System\sWhYtvc.exe
  C:\Windows\System\sWhYtvc.exe
  2⤵
  PID:10828
- C:\Windows\System\TUSaXco.exe
  C:\Windows\System\TUSaXco.exe
  2⤵
  PID:10292
- C:\Windows\System\nloraPV.exe
  C:\Windows\System\nloraPV.exe
  2⤵
  PID:11060
- C:\Windows\System\EEZWfDQ.exe
  C:\Windows\System\EEZWfDQ.exe
  2⤵
  PID:2404
- C:\Windows\System\fkPRIZp.exe
  C:\Windows\System\fkPRIZp.exe
  2⤵
  PID:3352
- C:\Windows\System\OZHVQfc.exe
  C:\Windows\System\OZHVQfc.exe
  2⤵
  PID:2300
- C:\Windows\System\HLQJSVo.exe
  C:\Windows\System\HLQJSVo.exe
  2⤵
  PID:3116
- C:\Windows\System\zBVajFt.exe
  C:\Windows\System\zBVajFt.exe
  2⤵
  PID:11740
- C:\Windows\System\xisxROt.exe
  C:\Windows\System\xisxROt.exe
  2⤵
  PID:4360
- C:\Windows\System\XwsHwoD.exe
  C:\Windows\System\XwsHwoD.exe
  2⤵
  PID:13556
- C:\Windows\System\dogTcqf.exe
  C:\Windows\System\dogTcqf.exe
  2⤵
  PID:13684
- C:\Windows\System\TxlPXZb.exe
  C:\Windows\System\TxlPXZb.exe
  2⤵
  PID:13704
- C:\Windows\System\Dbuwuhp.exe
  C:\Windows\System\Dbuwuhp.exe
  2⤵
  PID:13800
- C:\Windows\System\mOEQcuf.exe
  C:\Windows\System\mOEQcuf.exe
  2⤵
  PID:13940
- C:\Windows\System\HLAROvA.exe
  C:\Windows\System\HLAROvA.exe
  2⤵
  PID:13976
- C:\Windows\System\vufZIYE.exe
  C:\Windows\System\vufZIYE.exe
  2⤵
  PID:14076
- C:\Windows\System\TeTyAUZ.exe
  C:\Windows\System\TeTyAUZ.exe
  2⤵
  PID:14092
- C:\Windows\System\kgrlfiJ.exe
  C:\Windows\System\kgrlfiJ.exe
  2⤵
  PID:14112
- C:\Windows\System\ZtIUEio.exe
  C:\Windows\System\ZtIUEio.exe
  2⤵
  PID:14132
- C:\Windows\System\lutmiZI.exe
  C:\Windows\System\lutmiZI.exe
  2⤵
  PID:14152
- C:\Windows\System\COcCgwc.exe
  C:\Windows\System\COcCgwc.exe
  2⤵
  PID:14172
- C:\Windows\System\ffTpCep.exe
  C:\Windows\System\ffTpCep.exe
  2⤵
  PID:14192
- C:\Windows\System\OYVOjNP.exe
  C:\Windows\System\OYVOjNP.exe
  2⤵
  PID:14212
- C:\Windows\System\kSmhKjI.exe
  C:\Windows\System\kSmhKjI.exe
  2⤵
  PID:14232
- C:\Windows\System\FGbxIcK.exe
  C:\Windows\System\FGbxIcK.exe
  2⤵
  PID:10644
- C:\Windows\System\jPMdUrv.exe
  C:\Windows\System\jPMdUrv.exe
  2⤵
  PID:13032
- C:\Windows\System\lMCaDlm.exe
  C:\Windows\System\lMCaDlm.exe
  2⤵
  PID:11900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h45gknpt.okl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\APDDNhl.exe

Filesize
1.6MB

MD5
e141d8ceac9b846a87aa6f6a34389865

SHA1
dac089ddf790a720077a9e69605f2f3a922e5690

SHA256
92e0d941dfdff09c6676fc2fe66a4184a17a9f6260e2ac7d54bf09aad13d9032

SHA512
cf86227b6259d79c6a722e6331872ffcbb01af1b77874d8e1c0fdb6443f47d09726bae28aaaad1655b4dbc2345afd1fb1b4bcaf6673d5683b6f878950e4ad76c

Download Submit
C:\Windows\System\JvUGLie.exe

Filesize
1.6MB

MD5
6de7763e14e199f8b70d9041c0b4b59c

SHA1
2479dedb8b34a874adf2eaad210a5a4dc194fd71

SHA256
052bb636b38e6e1d33879d1536bdf19425d74b3c7585ee881361d7c4c09baae5

SHA512
7f1187f15d17a43ce74e02a74961de49fde7a0e49c8d64bb1886303671823eb3263e47569ce330935c771ed45eead894c7e647c659ddecf8ba1973daaa50417e

Download Submit
C:\Windows\System\KVVQBBG.exe

Filesize
1.6MB

MD5
bd4f5203e9fa15efd2209f0140ac57f5

SHA1
38deb07e663de489d266e3f9756c50c308bc41df

SHA256
fc4a7074a5a1e58ca9d89a8dc40ebc1ed0e3d662370c6e5b816ed34bb30dda0c

SHA512
80f14ba4fa7949b9c703f68873fab9905435ebafaf965e39b661574309bcd8490ff13e83dde22565cec6f980966b854939049bee0003803e8fff351090202176

Download Submit
C:\Windows\System\KmYfhSX.exe

Filesize
1.6MB

MD5
28ac7aa7703e6690f8f27d0b2d5970c2

SHA1
c12b65fe584aab185a31fffdf4dce502543b499c

SHA256
c31aa7675854d6d9b3bc339df5e4b370033b524c4b6485601be5d049acacb4cf

SHA512
743eb7556f21a301b5f25e00202dfd5bfaef69b2f20463e494aabe50587b5fa85907d5881af33198dc779ca53a048180a12766a5f582626a4f7508436fc92a7a

Download Submit
C:\Windows\System\KqclbtV.exe

Filesize
1.6MB

MD5
c3e955cc53ea5b3dae7b53de5b444804

SHA1
f059d67722eb8ee8fe4b9a8bce60f86de4225a0d

SHA256
5beb2ff56a21868995cab6a39da60c0ad1e08a34190cf01a65213d2f4e2c18c7

SHA512
e082f0b7d365912dbb552734bc92c8d9ec533a2bba8b4f5138590d012b8b8cc52498945e39cf673e7bdf9cdc63dffc526d0ee42c348ae45f37d30d1f6e01ccdf

Download Submit
C:\Windows\System\LdLfTlW.exe

Filesize
1.6MB

MD5
0c1fec4546dfee197e10e594d66ff035

SHA1
fb460c1d81a5ed40f7fbf7b6ead26328c4bb57c9

SHA256
e734d5fe0d2eb03afb1dc4768209913eb8de9ec8540a46f2a2bd9f81b1028805

SHA512
d545cf387e36eddb4c4e1b3aa65634ca39284c5f82d41630282be0390383f7936720525c7c790763c33b9f0036a6ce04cf4a274afc66b09ca03bcb2c2e6d8874

Download Submit
C:\Windows\System\MYZDonr.exe

Filesize
1.6MB

MD5
2bcfd808da994af0ebaf9ee0700b75ed

SHA1
5520dbf5bd90fbc247af243ebd4807218923397a

SHA256
7530884de60a903c68cee80816dc63e48cc1aba70df9304e1b50097087da30ef

SHA512
c6a2b56e7aa0b7a906d25e6fa8f8badb6b1b2973b8e204a50ddfd43a52657e42a011c05b56131a7992aeae304a28f78a171617b08e3da8d972e1e73572db134c

Download Submit
C:\Windows\System\NdjMcya.exe

Filesize
1.6MB

MD5
1c2b7d9567d5521c2898ff384f0888c1

SHA1
a6509b2ece4966b1e986e0e1a4771c5bc5e59921

SHA256
9f32cda14b41fb432d9cece6d5566d9b07349138eeddad29440dc30c410bbbcc

SHA512
5516bedfddd50a8fe558b7b31fbd656a2a670b27de23ec57207df856296ab2155af1fe73087f0ea9c1fb77c65a11aafb460319810c6ab5a25fe54296cbd52c63

Download Submit
C:\Windows\System\NwmuFHe.exe

Filesize
1.6MB

MD5
8136b32b69c23732a927c1083bea95b6

SHA1
e50053aabc5e33b04b6d4102db3d334838815c5f

SHA256
19789d4a544914760cc8391ae1f9863bb2bad17218abc6d8754cd29f17f19b75

SHA512
478c734eac70f2789a4c480960a22c0913857c271923bdda0c787518196e5e1d9f9e3f33324355554a86dcbbbd62ea19508cf97c415010a260e104683527a8ce

Download Submit
C:\Windows\System\ODubGrQ.exe

Filesize
1.6MB

MD5
bcb9e27a361d69396370809bfd9e66eb

SHA1
3998414198ca7baf90856118ad469a4a2903e59f

SHA256
7d2572c775435d6658bbb11424e066816ef7f909e5a9ac45f6c6d650216b0e49

SHA512
95ccfa510b1ad2c99d211b481bc0562f294b768ed52f8f0d61489c74372a298835e4a3ce79dd05d45ba39c8e74043dcc2b21c4d918c89a176c23a4238128ba45

Download Submit
C:\Windows\System\OPukoiw.exe

Filesize
1.6MB

MD5
ec9ac5d463155a75ab5112cd8844a244

SHA1
51ec0ce1cce3f79597d72dfec94ee64f611356e0

SHA256
d32757531e7a4c55eb102f3e73d45c50ee611d4364525719beec1c53236d800a

SHA512
5666fb7f866d76f0a885d789530ac4169e992a714a18a358a429a548e16fa36bbcc8418103d296e1d5ab434c5460756ead7f07d7c9e3284cf4efdd1c0290923e

Download Submit
C:\Windows\System\PPvGkgm.exe

Filesize
1.6MB

MD5
3b984264a2790b5d372e301d964b4a90

SHA1
8b315032c3f205d5c4533429f4d4dc555630eac8

SHA256
f81bf743e9ad09afe59ab548c0ac2ed895a1b9db0930368f47b595fe1dc4beee

SHA512
d0cef2cec8063c4228034b83af53cdf5719b76a41acbacadff5a0f85ddce4c375aff74c10792d1a13388a1818d730f5233d61bb4380b165f53641dc584420199

Download Submit
C:\Windows\System\PgxtZFM.exe

Filesize
1.6MB

MD5
b6307ebf4e0a605b1560163939cf9d3b

SHA1
9b1296c7de2a96b46c324a237f7c9e48e2268856

SHA256
8638d05d4e0f12510415305380dccf0936540642bfdcc5b72d9397af04dd7d21

SHA512
528e7709dd36a9e4f446d057dd25509b78719177d4fdca6e633a59b24ac85cb7c1ccb58e44b8c687e1af61e27ae80e2ef291c8f2a93e131d88df2e2ab9e1dc43

Download Submit
C:\Windows\System\PsPESbf.exe

Filesize
1.6MB

MD5
a944d7efc23ac8ffa499282967af708c

SHA1
3179555b3bcfa4e5e1505a8413815eb249e20fbb

SHA256
6035148efe1fd1c4cfbe298ca36660d883d91234061b36fcf3fb6bcbc766a295

SHA512
08916fd2a960de5069744be824bd5e49670d4932a8dbec979e619d9d8a7cef1d87d46026553bd93d4a5d481c707aafc82c9bc746624df95890031bbf6181e403

Download Submit
C:\Windows\System\RCQoOhk.exe

Filesize
1.6MB

MD5
e5cd9e0dbf21861f97fc1f89e7e31ade

SHA1
c0fb4094a18569e61cbc0799366ca89db25df6f5

SHA256
592be55f4403c834f4fd97328a8b83bd32be22fe06ad671188b1cb85db85a2e2

SHA512
7a193956fde2da74391bef8d6440df7ca25369cc02745a5a972860eb19285f65244c5aed21616a0ac70d1368ca9c29d27eb3e7c26e3be6bbb6a33b02ded00727

Download Submit
C:\Windows\System\RlHcnuY.exe

Filesize
1.6MB

MD5
69f3d28cecc26d07b445445560bbbe3c

SHA1
6ae57b1f8e305f85c2dfaf1823a91e99e5df6b70

SHA256
7c75ca3a5262e7c97e87f8a5d77b3b821a6a6a87593d7771aabdbbaed7d210de

SHA512
91ee3499920baed5bee2a8cb006581c0b74e3da7f45bd112cfbe2ffb77023bf048589beac630fe51ab94655ce76e479d92b5b07932c0d11f398b33a198e88543

Download Submit
C:\Windows\System\SlBpPBv.exe

Filesize
1.6MB

MD5
5675f7df6da0a926475e888352da60d7

SHA1
2e5b841f5a1882f687d00fe4332a492248643d88

SHA256
1c4b515510dfdac6f652d6ad4fac0f017788f7536c134f737c6b75f8501dc31a

SHA512
027e99eae35cb01792f002c30346b45e9614d37f806c2b0777cc40f2e3a31bba20a7fec8db5e62069fc9a10501ec8ecd23d95570eb3b34d4bed400cdfd6082c2

Download Submit
C:\Windows\System\WcJgmMx.exe

Filesize
1.6MB

MD5
d7f79e20354d8ab7f7f7c614529ed2ba

SHA1
c1d9801821e049711012af02e8c53fc2f944f420

SHA256
7377064444bb315d55468415f6ec01f24369604a25aac4c4ce0e3811f5419cd8

SHA512
fa46deb1a80435165ce4a94634d5b3b6d652a8133ed1afa0587536d9b39eef898a65b5abdf6db8963f0b3e83277c1f70d024384829abfbde11a8a5d0689a617b

Download Submit
C:\Windows\System\bbzAThb.exe

Filesize
1.6MB

MD5
c8d062dee484b04cfecb1383e96f616e

SHA1
57e79cda6b8d0532eca77f6112abba0414665576

SHA256
59d00d23a3fb16e180ec8db0cb66d4945e7fd24dcf52d058aeb8db05b08eafa1

SHA512
a95e00109ff72e7c190d1474ccab4efde7f4614ba6d9dd64cf310c38976b870712604220aa0277b25fb8658f0c239fa26c0eb391227c726de3ac6bd75ab2f915

Download Submit
C:\Windows\System\ednNwzy.exe

Filesize
1.6MB

MD5
27cfa1386faa7b5b4fd0025d384cf3ef

SHA1
16219b6cb9305f081ff71c0e68d254a03057713c

SHA256
1fbbbef886b278d44ee85fe647622f449f1ad9c30e9bb10e1bcbdd5c73fc38a1

SHA512
682b63e06328aec1e4d60d0d5dd52c119ac6c6aac1079eff0b8379c586002be377efafb2d231a834f04658c8291d76f6245ba926fa09104acaa0b8f5917bedc0

Download Submit
C:\Windows\System\fMbFeMV.exe

Filesize
1.6MB

MD5
177ad2e67f8bf023f83abf92c442f5c4

SHA1
6707f3cad341dd4e784f3b46f7457e41863aea7c

SHA256
93f1a61ff69450e8e512544519ac228f8535cecc289b5c20ec4410edb40a219f

SHA512
3954c95647f65affb15a7dc1173a744d28f31bca5cd9526ff913c84160d14265c2077c8f866cc4c1807fc64e92d4a7ecc39c9f66e56d66e92cbca87f0c256d7d

Download Submit
C:\Windows\System\gAVaXHH.exe

Filesize
1.6MB

MD5
e995f9153419442f84bc22370bd71e30

SHA1
c67aeedb2b38d1f0bcd4b5acfd16537922ee8a27

SHA256
e0335328c6ec6681f9abb8971d66993c854925f10518891c6e43dd45e467b142

SHA512
1235f5ae20cd40e66075480e424d4eed126e9235a5f24986b4a860182e99ba3f02c343b617267ca642d082b45c2aec5f2b715acfec469a7f3cf034eb4b074a9e

Download Submit
C:\Windows\System\hYcFovq.exe

Filesize
1.6MB

MD5
cedd8b04ad23370366da49b7537f5bf0

SHA1
8ce8d416b088e21d7ae1cb32f0e2766b0786deab

SHA256
d9ac569418362ee28416cd7b5a8c4310f208691b1640f1669e52a8466ee41c4b

SHA512
0ce55f28b1b00504417cb213b3919c809f8d0f59110de8306b47fb9aa61b94683d30f79206f3a86331b25327976506397367ce1a8db4ad41ccddb8f56446389b

Download Submit
C:\Windows\System\kCeQUgH.exe

Filesize
1.6MB

MD5
6b6e9744f72707be6921e36647c8600b

SHA1
7e6fd5c07f9a97af3741b10f79ee65f999cd9de9

SHA256
8c9522a8c1e4b21d7b8724117f36d9d0f4b53908cb0dd37eeae257cc1128f725

SHA512
5c13e48a12b1c56cdba0cb94ff044ea68aa23bc97d83f9fa83ac764c616aa50fcce0a0841241783b6f17d1fa83c15767810dab3b8d637f8f0bcad0ace245c372

Download Submit
C:\Windows\System\keRgBjZ.exe

Filesize
1.6MB

MD5
e0ed567c7cccedc4c1c6afeab03b7146

SHA1
a6833698d4442d7a4a28c80f9654ec78477d67df

SHA256
bcfed224e0c98787d54521118dff100fc3a513ddbab91060bd72e48929f5311c

SHA512
7bebd939d91376c049e262495a9f9c63216d50a38dd98b1ff99be3eb6cdc72d7f2474bcf999fac6f656167a4a7d720ef8a00e42037099e01a5152dcb372f978d

Download Submit
C:\Windows\System\klgiVUF.exe

Filesize
1.6MB

MD5
24e08561534664b36443bb8cd4124957

SHA1
39c94da693de3a7d40d75e9e6699025fcfa2e1ac

SHA256
58449f05b0949518859be67c4be4ff42d0c2619508651148bda9cec1ac62d58f

SHA512
50d582aa3fa2e9454c00457bf77995487943091cc61108295ac2ff91a0fc4840e05406ab457f04d4695b0cc9f2635330e46c0cc8df87070cdb9c9cc90ff0b674

Download Submit
C:\Windows\System\kupKChs.exe

Filesize
1.6MB

MD5
ca258d8fbf16cab1447c8f33071f7696

SHA1
5e6523dfadd70d3e115d2c501ba331f6abd5d03e

SHA256
a6f92013327ebbea9dd28098dd0391da457094ee5502ea2664b2f24a3cbd3986

SHA512
a05a9f7a0091959fbf747d9e797b943bc49bd12bbdad52f51a96f65ec1f8eb1d9ea4b96034fd3eda22b962b72d82bb40bae856011e885b08309986363dc1f379

Download Submit
C:\Windows\System\mNcVriP.exe

Filesize
1.6MB

MD5
69366f228efca88e596d01a078538178

SHA1
ce739ebf64cc6e40396217d1f0546f1e86482ab0

SHA256
dc552a9d54e7fc229f8d86c83e712f08c3c433235973a57887fe5ba9fbd258db

SHA512
3d9f14bcafa9577d0edaa9bc1dfa5f7028a45ecc71f35ed05ef4e28fa46df0203da1aa45a085ebddca5d83aa79557ad125fc09614a21c200aba4ccd2131cbae4

Download Submit
C:\Windows\System\nETblkK.exe

Filesize
1.6MB

MD5
f1e671055060fcbc416e2de11960be05

SHA1
81b2f3deb47a1344fbee0f2b3224b30d67c40065

SHA256
3eb30c3e4b99b7096eb1c2502aebacd701a5efdfd53c48a9171a977fff4868e2

SHA512
028399eb4e292660d3964a13ca697e26b560dbfc98d27cd8d42d3b4d613bc98f653ee7cb6e99f2c9a907f2b0c888f0cac1d803e8f8f5c02a8cc928a9b8463d42

Download Submit
C:\Windows\System\nEhpXKi.exe

Filesize
1.6MB

MD5
1f05067226ff3f44e7c47a4f4c27da4b

SHA1
e854d81d5a378cdda9bbf0be419901793c1df3cd

SHA256
8c2f384f2b6e8bd6259fec9f833b45b6c5a94975e990308f46a85e5d2ad2bad8

SHA512
1f5f9310f236281fddf9a914218904b4a1d8f60dcc7d1a425e22393f22690fd8f6145247b358fc827ba7ccd970dfd834b0e010d716d5ead7d4b7c857ef60c086

Download Submit
C:\Windows\System\ncCJPJa.exe

Filesize
1.6MB

MD5
50599061ec424eeb2f74aa9235c6bc5d

SHA1
493473d72f52baa39acf2a98f0a065a0d490b708

SHA256
e43b410ee88a9a8eaa76a753056ad858a0f5d93e0fdaa71952839ff310f6a772

SHA512
bd2a984e77b6247c71b644ed2892b694402b5a825ab713ea717be8c736db158bba70665790c4ef5790aa777b3d26fb6073caac3716d006f895dda00af07de5f8

Download Submit
C:\Windows\System\sXGHGXX.exe

Filesize
1.6MB

MD5
30c4e2e3bcf16d570734d23719d2274e

SHA1
e9e515628b9751974cea11f803305d5a44e3fa78

SHA256
d29d8fd98419fb466971f518e41da6bb683a89c210fda1b68de28d0e8378c19a

SHA512
748a3fb19d041b8b564ebd1fa0b6b5c86d2fd278dcc2d7989c958dc0a86029f57a68c06f3c0ba12b44fd2adc21c5fc4337c0c4245ae5b32c9c3299e5f1911e14

Download Submit
C:\Windows\System\vAmVvaU.exe

Filesize
1.6MB

MD5
8701cb533431148d0b712b2a7cf9373b

SHA1
8c1591926153a94788682f9794a1c091915217f3

SHA256
3c362082251f4188d33f8ef35216e09d9c436773f2e82ddc7324270a34a19a36

SHA512
8535741bbeda0ce20eb728b0655dda77086818d78a327319d90af7593c2ae01c89d1d5ca898bf6100cf36a34c539c5df61d748b6e18ab516ef94c1d08e4bec7e

Download Submit
C:\Windows\System\wFgTYui.exe

Filesize
1.6MB

MD5
1db235ccc625646c4df9022e397737d6

SHA1
2e73380de397202ae22c967c1da24dc2212aa3f3

SHA256
610f86cc0b72dbee4ddf399f6cb71370b09ff89c95efb414d324a53089eaa42d

SHA512
75dddc61fb5b401dfdb1bc20371c8872ac85a2c4cc580b7854e51714606a5f84cb7e996f1c2d881478dcbc8303853aa16f7deee73adeb3facb52ddc9345636f3

Download Submit
C:\Windows\System\wHrgwgh.exe

Filesize
1.6MB

MD5
e2c4f559d542c0f7bfa7fcb47e0eb7cb

SHA1
305d1984412bf77ae0577c24d674150e08bb795b

SHA256
7855372b53effef51e31553ba6d8ea31ca1642b06aac084590308e7ea80e37a2

SHA512
13501faa0b1b94abc1ed9ae53564963253e7e09b0316d57cd9ade84c9e4430d7e5b8a4baf8b88f1abf93c57b851e1861fe75ddb690359c239221c539b11eadda

Download Submit
C:\Windows\System\wSKWEir.exe

Filesize
1.6MB

MD5
5ff61a9501c1f27d3c89eb9ac58c7c5b

SHA1
da0649a8fcd4b9f98c65f1f29ee4befd73c6774e

SHA256
04f78fd5bb7db2894735a693383cabc3ad4cd57d7fa729d8a098740e7f857b7a

SHA512
d994f45ab28daf19ec84efea377d304f46b4273d54c8baca8beb2bd773641b8cc68fb58a253ccf0d25999052d0978e29c4a3c9bf7ae33c9aa94bce08cde70dc7

Download Submit
C:\Windows\System\zRDreaq.exe

Filesize
1.6MB

MD5
99d52974368f75ce4b40758367b9b542

SHA1
de5ddda3e94ad2d34387677c40a217b80aadce20

SHA256
65bdcd6cbe0ec2c0cc8790e84aeef41dd7c6cbc7183779e57177c2a806ead537

SHA512
367d5fd755538ebca20012581b12b3dfaaf22b87ebab0229d79a4ccf66a69954c21fd72facf6c02f24e575b0d4d2a0539e805d080388414614bffcb369d1622b

Download Submit
memory/8-3900-0x00007FF6C12B0000-0x00007FF6C16A2000-memory.dmp

Filesize
3.9MB

Download
memory/8-619-0x00007FF6C12B0000-0x00007FF6C16A2000-memory.dmp

Filesize
3.9MB

Download
memory/64-3936-0x00007FF7A19D0000-0x00007FF7A1DC2000-memory.dmp

Filesize
3.9MB

Download
memory/64-614-0x00007FF7A19D0000-0x00007FF7A1DC2000-memory.dmp

Filesize
3.9MB

Download
memory/324-3919-0x00007FF632EA0000-0x00007FF633292000-memory.dmp

Filesize
3.9MB

Download
memory/324-435-0x00007FF632EA0000-0x00007FF633292000-memory.dmp

Filesize
3.9MB

Download
memory/1504-3921-0x00007FF6A4DF0000-0x00007FF6A51E2000-memory.dmp

Filesize
3.9MB

Download
memory/1504-156-0x00007FF6A4DF0000-0x00007FF6A51E2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-310-0x00007FF689CD0000-0x00007FF68A0C2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-3904-0x00007FF689CD0000-0x00007FF68A0C2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-3892-0x00007FF63B240000-0x00007FF63B632000-memory.dmp

Filesize
3.9MB

Download
memory/1848-197-0x00007FF63B240000-0x00007FF63B632000-memory.dmp

Filesize
3.9MB

Download
memory/2412-3918-0x00007FF767490000-0x00007FF767882000-memory.dmp

Filesize
3.9MB

Download
memory/2412-615-0x00007FF767490000-0x00007FF767882000-memory.dmp

Filesize
3.9MB

Download
memory/2468-203-0x00007FF6F6D80000-0x00007FF6F7172000-memory.dmp

Filesize
3.9MB

Download
memory/2468-3893-0x00007FF6F6D80000-0x00007FF6F7172000-memory.dmp

Filesize
3.9MB

Download
memory/2532-3883-0x00007FF796EF0000-0x00007FF7972E2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-25-0x00007FF796EF0000-0x00007FF7972E2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-3888-0x00007FF640AE0000-0x00007FF640ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-83-0x00007FF640AE0000-0x00007FF640ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-437-0x00007FF6758C0000-0x00007FF675CB2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-3925-0x00007FF6758C0000-0x00007FF675CB2000-memory.dmp

Filesize
3.9MB

Download
memory/3020-3897-0x00007FF7AB730000-0x00007FF7ABB22000-memory.dmp

Filesize
3.9MB

Download
memory/3020-122-0x00007FF7AB730000-0x00007FF7ABB22000-memory.dmp

Filesize
3.9MB

Download
memory/3492-3902-0x00007FF659BA0000-0x00007FF659F92000-memory.dmp

Filesize
3.9MB

Download
memory/3492-368-0x00007FF659BA0000-0x00007FF659F92000-memory.dmp

Filesize
3.9MB

Download
memory/3572-117-0x00007FF7ABD80000-0x00007FF7AC172000-memory.dmp

Filesize
3.9MB

Download
memory/3572-3911-0x00007FF7ABD80000-0x00007FF7AC172000-memory.dmp

Filesize
3.9MB

Download
memory/3724-51-0x000001D1B14A0000-0x000001D1B14B0000-memory.dmp

Filesize
64KB

Download
memory/3724-2217-0x00007FFD07610000-0x00007FFD080D1000-memory.dmp

Filesize
10.8MB

Download
memory/3724-489-0x000001D1B1400000-0x000001D1B1422000-memory.dmp

Filesize
136KB

Download
memory/3724-618-0x00007FFD07613000-0x00007FFD07615000-memory.dmp

Filesize
8KB

Download
memory/3724-688-0x00007FFD07610000-0x00007FFD080D1000-memory.dmp

Filesize
10.8MB

Download
memory/3792-616-0x00007FF774210000-0x00007FF774602000-memory.dmp

Filesize
3.9MB

Download
memory/3792-3910-0x00007FF774210000-0x00007FF774602000-memory.dmp

Filesize
3.9MB

Download
memory/3884-3915-0x00007FF709710000-0x00007FF709B02000-memory.dmp

Filesize
3.9MB

Download
memory/3884-599-0x00007FF709710000-0x00007FF709B02000-memory.dmp

Filesize
3.9MB

Download
memory/3916-950-0x00007FF64AB20000-0x00007FF64AF12000-memory.dmp

Filesize
3.9MB

Download
memory/3916-3932-0x00007FF64AB20000-0x00007FF64AF12000-memory.dmp

Filesize
3.9MB

Download
memory/4168-3913-0x00007FF6843A0000-0x00007FF684792000-memory.dmp

Filesize
3.9MB

Download
memory/4168-496-0x00007FF6843A0000-0x00007FF684792000-memory.dmp

Filesize
3.9MB

Download
memory/4532-3938-0x00007FF63E020000-0x00007FF63E412000-memory.dmp

Filesize
3.9MB

Download
memory/4532-475-0x00007FF63E020000-0x00007FF63E412000-memory.dmp

Filesize
3.9MB

Download
memory/4856-3881-0x00007FF668130000-0x00007FF668522000-memory.dmp

Filesize
3.9MB

Download
memory/4856-3889-0x00007FF668130000-0x00007FF668522000-memory.dmp

Filesize
3.9MB

Download
memory/4856-50-0x00007FF668130000-0x00007FF668522000-memory.dmp

Filesize
3.9MB

Download
memory/4924-3923-0x00007FF65A760000-0x00007FF65AB52000-memory.dmp

Filesize
3.9MB

Download
memory/4924-617-0x00007FF65A760000-0x00007FF65AB52000-memory.dmp

Filesize
3.9MB

Download
memory/5004-800-0x00007FF7ED620000-0x00007FF7EDA12000-memory.dmp

Filesize
3.9MB

Download
memory/5004-3896-0x00007FF7ED620000-0x00007FF7EDA12000-memory.dmp

Filesize
3.9MB

Download
memory/5048-3906-0x00007FF72D6C0000-0x00007FF72DAB2000-memory.dmp

Filesize
3.9MB

Download
memory/5048-252-0x00007FF72D6C0000-0x00007FF72DAB2000-memory.dmp

Filesize
3.9MB

Download
memory/5060-1-0x00000258C6A60000-0x00000258C6A70000-memory.dmp

Filesize
64KB

Download
memory/5060-0-0x00007FF72BC20000-0x00007FF72C012000-memory.dmp

Filesize
3.9MB

Download
memory/5076-3885-0x00007FF73A110000-0x00007FF73A502000-memory.dmp

Filesize
3.9MB

Download
memory/5076-55-0x00007FF73A110000-0x00007FF73A502000-memory.dmp

Filesize
3.9MB

Download