xmrig | a45af8880a17472cf80d6f467376abca33119a160d83dd2a43026d5a93d7bee3

Analysis

max time kernel
91s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e2aecdcc6de98e60368511c5309a5f0N.exe
Size

1.6MB
MD5

3e2aecdcc6de98e60368511c5309a5f0
SHA1

c6aac7769f52ceb7abb406ba1b94480353902049
SHA256

a45af8880a17472cf80d6f467376abca33119a160d83dd2a43026d5a93d7bee3
SHA512

75d488b76962fd3197a30f61858ba7fa3a210efcafa7ea4d3c20053f17dc87dc149b3749f88344c67b74e124eedb88e85560f7dc2f198ef49fd58a87cb87c02d
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTmo6OZXbPbPIMUQzdXMKA3up:Lz071uv4BPMkiFGlvETbzWq

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/2536-443-0x00007FF6F6220000-0x00007FF6F6612000-memory.dmp	xmrig
behavioral2/memory/3360-530-0x00007FF6B0410000-0x00007FF6B0802000-memory.dmp	xmrig
behavioral2/memory/3392-580-0x00007FF6F0D10000-0x00007FF6F1102000-memory.dmp	xmrig
behavioral2/memory/1560-586-0x00007FF7109A0000-0x00007FF710D92000-memory.dmp	xmrig
behavioral2/memory/2656-591-0x00007FF607880000-0x00007FF607C72000-memory.dmp	xmrig
behavioral2/memory/4316-2078-0x00007FF77C390000-0x00007FF77C782000-memory.dmp	xmrig
behavioral2/memory/4756-2076-0x00007FF757FA0000-0x00007FF758392000-memory.dmp	xmrig
behavioral2/memory/1944-2323-0x00007FF6C2E20000-0x00007FF6C3212000-memory.dmp	xmrig
behavioral2/memory/4936-590-0x00007FF750000000-0x00007FF7503F2000-memory.dmp	xmrig
behavioral2/memory/1108-589-0x00007FF6D3510000-0x00007FF6D3902000-memory.dmp	xmrig
behavioral2/memory/3852-588-0x00007FF671770000-0x00007FF671B62000-memory.dmp	xmrig
behavioral2/memory/772-587-0x00007FF69FCE0000-0x00007FF6A00D2000-memory.dmp	xmrig
behavioral2/memory/4604-585-0x00007FF607910000-0x00007FF607D02000-memory.dmp	xmrig
behavioral2/memory/4560-584-0x00007FF730510000-0x00007FF730902000-memory.dmp	xmrig
behavioral2/memory/2888-583-0x00007FF7DBB00000-0x00007FF7DBEF2000-memory.dmp	xmrig
behavioral2/memory/4672-582-0x00007FF62E390000-0x00007FF62E782000-memory.dmp	xmrig
behavioral2/memory/748-581-0x00007FF65F830000-0x00007FF65FC22000-memory.dmp	xmrig
behavioral2/memory/752-579-0x00007FF7A0F30000-0x00007FF7A1322000-memory.dmp	xmrig
behavioral2/memory/1124-578-0x00007FF64A9A0000-0x00007FF64AD92000-memory.dmp	xmrig
behavioral2/memory/3608-577-0x00007FF6A06F0000-0x00007FF6A0AE2000-memory.dmp	xmrig
behavioral2/memory/4852-440-0x00007FF786B80000-0x00007FF786F72000-memory.dmp	xmrig
behavioral2/memory/1292-330-0x00007FF794AC0000-0x00007FF794EB2000-memory.dmp	xmrig
behavioral2/memory/3924-292-0x00007FF72FA90000-0x00007FF72FE82000-memory.dmp	xmrig
behavioral2/memory/1128-243-0x00007FF743720000-0x00007FF743B12000-memory.dmp	xmrig
behavioral2/memory/4728-205-0x00007FF6A7FC0000-0x00007FF6A83B2000-memory.dmp	xmrig
behavioral2/memory/4316-3355-0x00007FF77C390000-0x00007FF77C782000-memory.dmp	xmrig
behavioral2/memory/1944-3357-0x00007FF6C2E20000-0x00007FF6C3212000-memory.dmp	xmrig
behavioral2/memory/4936-3359-0x00007FF750000000-0x00007FF7503F2000-memory.dmp	xmrig
behavioral2/memory/1108-3361-0x00007FF6D3510000-0x00007FF6D3902000-memory.dmp	xmrig
behavioral2/memory/3924-3378-0x00007FF72FA90000-0x00007FF72FE82000-memory.dmp	xmrig
behavioral2/memory/1124-3395-0x00007FF64A9A0000-0x00007FF64AD92000-memory.dmp	xmrig
behavioral2/memory/1292-3397-0x00007FF794AC0000-0x00007FF794EB2000-memory.dmp	xmrig
behavioral2/memory/1128-3393-0x00007FF743720000-0x00007FF743B12000-memory.dmp	xmrig
behavioral2/memory/3360-3399-0x00007FF6B0410000-0x00007FF6B0802000-memory.dmp	xmrig
behavioral2/memory/3608-3401-0x00007FF6A06F0000-0x00007FF6A0AE2000-memory.dmp	xmrig
behavioral2/memory/4672-3403-0x00007FF62E390000-0x00007FF62E782000-memory.dmp	xmrig
behavioral2/memory/2888-3405-0x00007FF7DBB00000-0x00007FF7DBEF2000-memory.dmp	xmrig
behavioral2/memory/4852-3392-0x00007FF786B80000-0x00007FF786F72000-memory.dmp	xmrig
behavioral2/memory/2536-3389-0x00007FF6F6220000-0x00007FF6F6612000-memory.dmp	xmrig
behavioral2/memory/4728-3386-0x00007FF6A7FC0000-0x00007FF6A83B2000-memory.dmp	xmrig
behavioral2/memory/1560-3410-0x00007FF7109A0000-0x00007FF710D92000-memory.dmp	xmrig
behavioral2/memory/3852-3408-0x00007FF671770000-0x00007FF671B62000-memory.dmp	xmrig
behavioral2/memory/4560-3413-0x00007FF730510000-0x00007FF730902000-memory.dmp	xmrig
behavioral2/memory/772-3422-0x00007FF69FCE0000-0x00007FF6A00D2000-memory.dmp	xmrig
behavioral2/memory/2656-3457-0x00007FF607880000-0x00007FF607C72000-memory.dmp	xmrig
behavioral2/memory/4604-3458-0x00007FF607910000-0x00007FF607D02000-memory.dmp	xmrig
behavioral2/memory/748-3418-0x00007FF65F830000-0x00007FF65FC22000-memory.dmp	xmrig
behavioral2/memory/3392-3417-0x00007FF6F0D10000-0x00007FF6F1102000-memory.dmp	xmrig
behavioral2/memory/752-3420-0x00007FF7A0F30000-0x00007FF7A1322000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4912	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4316	WnHJPKo.exe
1944	TjvOBoI.exe
1108	xjsPItg.exe
4936	dBrhtQi.exe
4728	ecFFOGt.exe
1128	efQJmIx.exe
3924	Ssjjwmo.exe
1292	ceOHWRb.exe
4852	PrprEaV.exe
2536	NZbCsky.exe
3360	nloipiq.exe
3608	FRCbTPB.exe
1124	BsgSGPP.exe
752	zjDiYaz.exe
3392	TjxULHp.exe
748	LzlrcrH.exe
4672	vjhNTem.exe
2888	SDTxstG.exe
4560	uvQClhI.exe
2656	ZwXosvu.exe
4604	BQpiydM.exe
1560	zHIwlIN.exe
772	WgIIdQA.exe
3852	vKmQaGm.exe
1604	FVpAVJK.exe
4840	wBvObnv.exe
4896	tXqIQUS.exe
1844	vKiiLiO.exe
1068	fTEgQTR.exe
4564	qwLkMqg.exe
3860	ARTmOsa.exe
4744	rAReVvo.exe
3412	LNegllN.exe
2300	LLeZdAj.exe
5052	ruGaqwn.exe
5008	OkiVVEB.exe
1776	SfvEvcv.exe
1036	yAUugna.exe
1316	yxGWteY.exe
1876	tGxnKVZ.exe
1384	Pebgljw.exe
1464	NSYZKxd.exe
448	udVyDjQ.exe
4364	aSoARPd.exe
3428	dcZebvq.exe
692	voWkhrH.exe
5112	DiCSHfS.exe
2936	CzWVtnF.exe
2132	ZYfCXJc.exe
2180	sAKNmqS.exe
4836	ihvatoP.exe
1752	UwmILXY.exe
5020	DAfPyiz.exe
4076	dwoHXFi.exe
4588	ewWogwZ.exe
3116	AITUxYJ.exe
1404	eigDUNF.exe
4256	yAEMiJt.exe
636	FQDhNdi.exe
2692	zvOMpVQ.exe
1484	gTglDFj.exe
1328	MvjqDit.exe
3020	tmJYxpG.exe
396	AKNncml.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4756-0-0x00007FF757FA0000-0x00007FF758392000-memory.dmp	upx
behavioral2/files/0x0009000000023476-6.dat	upx
behavioral2/files/0x0007000000023482-12.dat	upx
behavioral2/memory/4316-10-0x00007FF77C390000-0x00007FF77C782000-memory.dmp	upx
behavioral2/memory/1944-22-0x00007FF6C2E20000-0x00007FF6C3212000-memory.dmp	upx
behavioral2/files/0x0007000000023484-30.dat	upx
behavioral2/files/0x0007000000023487-42.dat	upx
behavioral2/files/0x0007000000023486-59.dat	upx
behavioral2/files/0x0007000000023490-85.dat	upx
behavioral2/files/0x0007000000023492-112.dat	upx
behavioral2/files/0x0007000000023493-135.dat	upx
behavioral2/memory/2536-443-0x00007FF6F6220000-0x00007FF6F6612000-memory.dmp	upx
behavioral2/memory/3360-530-0x00007FF6B0410000-0x00007FF6B0802000-memory.dmp	upx
behavioral2/memory/3392-580-0x00007FF6F0D10000-0x00007FF6F1102000-memory.dmp	upx
behavioral2/memory/1560-586-0x00007FF7109A0000-0x00007FF710D92000-memory.dmp	upx
behavioral2/memory/2656-591-0x00007FF607880000-0x00007FF607C72000-memory.dmp	upx
behavioral2/memory/4316-2078-0x00007FF77C390000-0x00007FF77C782000-memory.dmp	upx
behavioral2/memory/4756-2076-0x00007FF757FA0000-0x00007FF758392000-memory.dmp	upx
behavioral2/memory/1944-2323-0x00007FF6C2E20000-0x00007FF6C3212000-memory.dmp	upx
behavioral2/memory/4936-590-0x00007FF750000000-0x00007FF7503F2000-memory.dmp	upx
behavioral2/memory/1108-589-0x00007FF6D3510000-0x00007FF6D3902000-memory.dmp	upx
behavioral2/memory/3852-588-0x00007FF671770000-0x00007FF671B62000-memory.dmp	upx
behavioral2/memory/772-587-0x00007FF69FCE0000-0x00007FF6A00D2000-memory.dmp	upx
behavioral2/memory/4604-585-0x00007FF607910000-0x00007FF607D02000-memory.dmp	upx
behavioral2/memory/4560-584-0x00007FF730510000-0x00007FF730902000-memory.dmp	upx
behavioral2/memory/2888-583-0x00007FF7DBB00000-0x00007FF7DBEF2000-memory.dmp	upx
behavioral2/memory/4672-582-0x00007FF62E390000-0x00007FF62E782000-memory.dmp	upx
behavioral2/memory/748-581-0x00007FF65F830000-0x00007FF65FC22000-memory.dmp	upx
behavioral2/memory/752-579-0x00007FF7A0F30000-0x00007FF7A1322000-memory.dmp	upx
behavioral2/memory/1124-578-0x00007FF64A9A0000-0x00007FF64AD92000-memory.dmp	upx
behavioral2/memory/3608-577-0x00007FF6A06F0000-0x00007FF6A0AE2000-memory.dmp	upx
behavioral2/memory/4852-440-0x00007FF786B80000-0x00007FF786F72000-memory.dmp	upx
behavioral2/memory/1292-330-0x00007FF794AC0000-0x00007FF794EB2000-memory.dmp	upx
behavioral2/memory/3924-292-0x00007FF72FA90000-0x00007FF72FE82000-memory.dmp	upx
behavioral2/memory/1128-243-0x00007FF743720000-0x00007FF743B12000-memory.dmp	upx
behavioral2/files/0x0007000000023497-163.dat	upx
behavioral2/files/0x0009000000023477-211.dat	upx
behavioral2/memory/4728-205-0x00007FF6A7FC0000-0x00007FF6A83B2000-memory.dmp	upx
behavioral2/files/0x00070000000234a4-196.dat	upx
behavioral2/files/0x00070000000234a3-190.dat	upx
behavioral2/files/0x0007000000023495-189.dat	upx
behavioral2/files/0x00070000000234a2-187.dat	upx
behavioral2/files/0x0007000000023498-172.dat	upx
behavioral2/files/0x00070000000234a1-169.dat	upx
behavioral2/files/0x000700000002349f-164.dat	upx
behavioral2/files/0x00070000000234a0-162.dat	upx
behavioral2/files/0x000700000002349e-158.dat	upx
behavioral2/files/0x0007000000023496-156.dat	upx
behavioral2/files/0x000700000002349b-152.dat	upx
behavioral2/files/0x000700000002349d-151.dat	upx
behavioral2/files/0x00070000000234a6-208.dat	upx
behavioral2/files/0x000700000002348f-126.dat	upx
behavioral2/files/0x000700000002349c-124.dat	upx
behavioral2/files/0x000700000002348e-121.dat	upx
behavioral2/files/0x000700000002349a-118.dat	upx
behavioral2/files/0x0007000000023499-117.dat	upx
behavioral2/files/0x000700000002348c-104.dat	upx
behavioral2/files/0x000700000002348b-101.dat	upx
behavioral2/files/0x0007000000023491-92.dat	upx
behavioral2/files/0x0007000000023494-115.dat	upx
behavioral2/files/0x0007000000023488-86.dat	upx
behavioral2/files/0x000700000002348d-68.dat	upx
behavioral2/files/0x000700000002348a-53.dat	upx
behavioral2/files/0x0007000000023489-75.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AKNncml.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\eywrYVc.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\swcdnRH.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\JkwgGvZ.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\IpLjMSD.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\XScoXOY.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\VGPjvPd.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\PXuPavR.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\EVfYlBg.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\NpmwpLb.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\cnQOKkZ.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\qvfgkSx.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\QHFrGUB.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\wekUqBI.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\dwoHXFi.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\ZIibpoM.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\MmnrxPU.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\wJRxrmx.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\ehBByey.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\vmxwQkv.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\jdpAMLa.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\QgkpkKk.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\iIJESeA.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\witYgtp.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\GaZYRfx.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\EekFDeX.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\GStKydZ.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\PRUNVXQ.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\aaELzBL.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\NyjNdtL.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\Wdsabyo.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\TbZceGL.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\QRKrlkI.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\IstfUIa.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\JkljgzY.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\WMIyZBn.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\xqbmESG.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\XwWjAFK.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\efQJmIx.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\DiCSHfS.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\GDmtlSM.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\IODBozC.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\whjBsVh.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\JBOZWQn.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\pjXPTib.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\BnqaRxy.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\xpQHTjp.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\YfndPgZ.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\QGjFRUu.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\tWvxvGH.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\JFMYucS.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\LZsoYON.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\pyjggUz.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\FlJQRKu.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\kBfXafK.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\CDpFutS.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\cSqJedN.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\hdrjFee.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\ZMrZntr.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\vHAyiFd.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\SHUcZgM.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\hfPzNiQ.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\umixtaw.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe
File created	C:\Windows\System\cynLLCw.exe	3e2aecdcc6de98e60368511c5309a5f0N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4912	powershell.exe
4912	powershell.exe
4912	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe
Token: SeLockMemoryPrivilege	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeCreateGlobalPrivilege	2852	dwm.exe
Token: SeChangeNotifyPrivilege	2852	dwm.exe
Token: 33	2852	dwm.exe
Token: SeIncBasePriorityPrivilege	2852	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4912	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	85
PID 4756 wrote to memory of 4912	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	85
PID 4756 wrote to memory of 4316	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	86
PID 4756 wrote to memory of 4316	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	86
PID 4756 wrote to memory of 1944	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	87
PID 4756 wrote to memory of 1944	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	87
PID 4756 wrote to memory of 1108	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	88
PID 4756 wrote to memory of 1108	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	88
PID 4756 wrote to memory of 4728	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	89
PID 4756 wrote to memory of 4728	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	89
PID 4756 wrote to memory of 4936	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	90
PID 4756 wrote to memory of 4936	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	90
PID 4756 wrote to memory of 1128	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	91
PID 4756 wrote to memory of 1128	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	91
PID 4756 wrote to memory of 3924	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	92
PID 4756 wrote to memory of 3924	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	92
PID 4756 wrote to memory of 1292	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	93
PID 4756 wrote to memory of 1292	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	93
PID 4756 wrote to memory of 4852	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	94
PID 4756 wrote to memory of 4852	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	94
PID 4756 wrote to memory of 2536	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	95
PID 4756 wrote to memory of 2536	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	95
PID 4756 wrote to memory of 3360	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	96
PID 4756 wrote to memory of 3360	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	96
PID 4756 wrote to memory of 3608	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	97
PID 4756 wrote to memory of 3608	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	97
PID 4756 wrote to memory of 1124	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	98
PID 4756 wrote to memory of 1124	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	98
PID 4756 wrote to memory of 752	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	99
PID 4756 wrote to memory of 752	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	99
PID 4756 wrote to memory of 3392	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	100
PID 4756 wrote to memory of 3392	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	100
PID 4756 wrote to memory of 748	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	101
PID 4756 wrote to memory of 748	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	101
PID 4756 wrote to memory of 4672	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	102
PID 4756 wrote to memory of 4672	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	102
PID 4756 wrote to memory of 2888	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	103
PID 4756 wrote to memory of 2888	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	103
PID 4756 wrote to memory of 4560	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	104
PID 4756 wrote to memory of 4560	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	104
PID 4756 wrote to memory of 772	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	105
PID 4756 wrote to memory of 772	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	105
PID 4756 wrote to memory of 3852	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	106
PID 4756 wrote to memory of 3852	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	106
PID 4756 wrote to memory of 2656	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	107
PID 4756 wrote to memory of 2656	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	107
PID 4756 wrote to memory of 4604	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	108
PID 4756 wrote to memory of 4604	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	108
PID 4756 wrote to memory of 1560	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	109
PID 4756 wrote to memory of 1560	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	109
PID 4756 wrote to memory of 1604	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	110
PID 4756 wrote to memory of 1604	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	110
PID 4756 wrote to memory of 4840	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	111
PID 4756 wrote to memory of 4840	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	111
PID 4756 wrote to memory of 4896	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	112
PID 4756 wrote to memory of 4896	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	112
PID 4756 wrote to memory of 1844	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	113
PID 4756 wrote to memory of 1844	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	113
PID 4756 wrote to memory of 1068	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	114
PID 4756 wrote to memory of 1068	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	114
PID 4756 wrote to memory of 4564	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	115
PID 4756 wrote to memory of 4564	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	115
PID 4756 wrote to memory of 3860	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	116
PID 4756 wrote to memory of 3860	4756	3e2aecdcc6de98e60368511c5309a5f0N.exe	116

C:\Users\Admin\AppData\Local\Temp\3e2aecdcc6de98e60368511c5309a5f0N.exe
"C:\Users\Admin\AppData\Local\Temp\3e2aecdcc6de98e60368511c5309a5f0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Windows\System\WnHJPKo.exe
  C:\Windows\System\WnHJPKo.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\TjvOBoI.exe
  C:\Windows\System\TjvOBoI.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\xjsPItg.exe
  C:\Windows\System\xjsPItg.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\ecFFOGt.exe
  C:\Windows\System\ecFFOGt.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\dBrhtQi.exe
  C:\Windows\System\dBrhtQi.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\efQJmIx.exe
  C:\Windows\System\efQJmIx.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\Ssjjwmo.exe
  C:\Windows\System\Ssjjwmo.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\ceOHWRb.exe
  C:\Windows\System\ceOHWRb.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\PrprEaV.exe
  C:\Windows\System\PrprEaV.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\NZbCsky.exe
  C:\Windows\System\NZbCsky.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\nloipiq.exe
  C:\Windows\System\nloipiq.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\FRCbTPB.exe
  C:\Windows\System\FRCbTPB.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\BsgSGPP.exe
  C:\Windows\System\BsgSGPP.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\zjDiYaz.exe
  C:\Windows\System\zjDiYaz.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\TjxULHp.exe
  C:\Windows\System\TjxULHp.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\LzlrcrH.exe
  C:\Windows\System\LzlrcrH.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\vjhNTem.exe
  C:\Windows\System\vjhNTem.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\SDTxstG.exe
  C:\Windows\System\SDTxstG.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\uvQClhI.exe
  C:\Windows\System\uvQClhI.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\WgIIdQA.exe
  C:\Windows\System\WgIIdQA.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\vKmQaGm.exe
  C:\Windows\System\vKmQaGm.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\ZwXosvu.exe
  C:\Windows\System\ZwXosvu.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\BQpiydM.exe
  C:\Windows\System\BQpiydM.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\zHIwlIN.exe
  C:\Windows\System\zHIwlIN.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\FVpAVJK.exe
  C:\Windows\System\FVpAVJK.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\wBvObnv.exe
  C:\Windows\System\wBvObnv.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\tXqIQUS.exe
  C:\Windows\System\tXqIQUS.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\vKiiLiO.exe
  C:\Windows\System\vKiiLiO.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\fTEgQTR.exe
  C:\Windows\System\fTEgQTR.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\qwLkMqg.exe
  C:\Windows\System\qwLkMqg.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\ARTmOsa.exe
  C:\Windows\System\ARTmOsa.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\rAReVvo.exe
  C:\Windows\System\rAReVvo.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\LNegllN.exe
  C:\Windows\System\LNegllN.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\LLeZdAj.exe
  C:\Windows\System\LLeZdAj.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\ruGaqwn.exe
  C:\Windows\System\ruGaqwn.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\OkiVVEB.exe
  C:\Windows\System\OkiVVEB.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\voWkhrH.exe
  C:\Windows\System\voWkhrH.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\SfvEvcv.exe
  C:\Windows\System\SfvEvcv.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\ihvatoP.exe
  C:\Windows\System\ihvatoP.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\yAUugna.exe
  C:\Windows\System\yAUugna.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\UwmILXY.exe
  C:\Windows\System\UwmILXY.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\dwoHXFi.exe
  C:\Windows\System\dwoHXFi.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\yxGWteY.exe
  C:\Windows\System\yxGWteY.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\tGxnKVZ.exe
  C:\Windows\System\tGxnKVZ.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\Pebgljw.exe
  C:\Windows\System\Pebgljw.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\NSYZKxd.exe
  C:\Windows\System\NSYZKxd.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\udVyDjQ.exe
  C:\Windows\System\udVyDjQ.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\aSoARPd.exe
  C:\Windows\System\aSoARPd.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\dcZebvq.exe
  C:\Windows\System\dcZebvq.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\DiCSHfS.exe
  C:\Windows\System\DiCSHfS.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\CzWVtnF.exe
  C:\Windows\System\CzWVtnF.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\ZYfCXJc.exe
  C:\Windows\System\ZYfCXJc.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\sAKNmqS.exe
  C:\Windows\System\sAKNmqS.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\DAfPyiz.exe
  C:\Windows\System\DAfPyiz.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\JkljgzY.exe
  C:\Windows\System\JkljgzY.exe
  2⤵
  PID:4420
- C:\Windows\System\ewWogwZ.exe
  C:\Windows\System\ewWogwZ.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\AITUxYJ.exe
  C:\Windows\System\AITUxYJ.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\eigDUNF.exe
  C:\Windows\System\eigDUNF.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\yAEMiJt.exe
  C:\Windows\System\yAEMiJt.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\FQDhNdi.exe
  C:\Windows\System\FQDhNdi.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\zvOMpVQ.exe
  C:\Windows\System\zvOMpVQ.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\gTglDFj.exe
  C:\Windows\System\gTglDFj.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\MvjqDit.exe
  C:\Windows\System\MvjqDit.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\tmJYxpG.exe
  C:\Windows\System\tmJYxpG.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\AKNncml.exe
  C:\Windows\System\AKNncml.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\yapxrFm.exe
  C:\Windows\System\yapxrFm.exe
  2⤵
  PID:4308
- C:\Windows\System\WVHukzd.exe
  C:\Windows\System\WVHukzd.exe
  2⤵
  PID:4128
- C:\Windows\System\ZIibpoM.exe
  C:\Windows\System\ZIibpoM.exe
  2⤵
  PID:2464
- C:\Windows\System\YUDvpGY.exe
  C:\Windows\System\YUDvpGY.exe
  2⤵
  PID:1084
- C:\Windows\System\LLhVMPp.exe
  C:\Windows\System\LLhVMPp.exe
  2⤵
  PID:3352
- C:\Windows\System\OQqraUI.exe
  C:\Windows\System\OQqraUI.exe
  2⤵
  PID:1736
- C:\Windows\System\rvEABZy.exe
  C:\Windows\System\rvEABZy.exe
  2⤵
  PID:2952
- C:\Windows\System\iaCNWlP.exe
  C:\Windows\System\iaCNWlP.exe
  2⤵
  PID:3652
- C:\Windows\System\SDiewgv.exe
  C:\Windows\System\SDiewgv.exe
  2⤵
  PID:4704
- C:\Windows\System\nDiSorM.exe
  C:\Windows\System\nDiSorM.exe
  2⤵
  PID:4776
- C:\Windows\System\YVzUtcb.exe
  C:\Windows\System\YVzUtcb.exe
  2⤵
  PID:4152
- C:\Windows\System\euJHRrV.exe
  C:\Windows\System\euJHRrV.exe
  2⤵
  PID:5132
- C:\Windows\System\ceGJWAn.exe
  C:\Windows\System\ceGJWAn.exe
  2⤵
  PID:5148
- C:\Windows\System\vNxatPx.exe
  C:\Windows\System\vNxatPx.exe
  2⤵
  PID:5168
- C:\Windows\System\ipkrIqJ.exe
  C:\Windows\System\ipkrIqJ.exe
  2⤵
  PID:5188
- C:\Windows\System\hnTrdZf.exe
  C:\Windows\System\hnTrdZf.exe
  2⤵
  PID:5212
- C:\Windows\System\jCqykUd.exe
  C:\Windows\System\jCqykUd.exe
  2⤵
  PID:5248
- C:\Windows\System\asCCUMQ.exe
  C:\Windows\System\asCCUMQ.exe
  2⤵
  PID:5264
- C:\Windows\System\JrfIkcW.exe
  C:\Windows\System\JrfIkcW.exe
  2⤵
  PID:5280
- C:\Windows\System\TBGbQKE.exe
  C:\Windows\System\TBGbQKE.exe
  2⤵
  PID:5308
- C:\Windows\System\nuUrnWe.exe
  C:\Windows\System\nuUrnWe.exe
  2⤵
  PID:5332
- C:\Windows\System\XyBrfQi.exe
  C:\Windows\System\XyBrfQi.exe
  2⤵
  PID:5356
- C:\Windows\System\WInaZeF.exe
  C:\Windows\System\WInaZeF.exe
  2⤵
  PID:5376
- C:\Windows\System\OTvqZdm.exe
  C:\Windows\System\OTvqZdm.exe
  2⤵
  PID:5404
- C:\Windows\System\bQTcOOK.exe
  C:\Windows\System\bQTcOOK.exe
  2⤵
  PID:5424
- C:\Windows\System\jRurFIF.exe
  C:\Windows\System\jRurFIF.exe
  2⤵
  PID:5448
- C:\Windows\System\LUgrkQm.exe
  C:\Windows\System\LUgrkQm.exe
  2⤵
  PID:5496
- C:\Windows\System\JcNbhxQ.exe
  C:\Windows\System\JcNbhxQ.exe
  2⤵
  PID:5512
- C:\Windows\System\yajXohh.exe
  C:\Windows\System\yajXohh.exe
  2⤵
  PID:5532
- C:\Windows\System\VlSIpbP.exe
  C:\Windows\System\VlSIpbP.exe
  2⤵
  PID:5568
- C:\Windows\System\iVXmqcz.exe
  C:\Windows\System\iVXmqcz.exe
  2⤵
  PID:5584
- C:\Windows\System\NQnbaVx.exe
  C:\Windows\System\NQnbaVx.exe
  2⤵
  PID:5612
- C:\Windows\System\CHXmZQJ.exe
  C:\Windows\System\CHXmZQJ.exe
  2⤵
  PID:5632
- C:\Windows\System\MCUonED.exe
  C:\Windows\System\MCUonED.exe
  2⤵
  PID:5656
- C:\Windows\System\pJVoBjw.exe
  C:\Windows\System\pJVoBjw.exe
  2⤵
  PID:5676
- C:\Windows\System\ZTfueWE.exe
  C:\Windows\System\ZTfueWE.exe
  2⤵
  PID:5692
- C:\Windows\System\Tbrhlta.exe
  C:\Windows\System\Tbrhlta.exe
  2⤵
  PID:5724
- C:\Windows\System\IbbpKxd.exe
  C:\Windows\System\IbbpKxd.exe
  2⤵
  PID:5744
- C:\Windows\System\ZfqJtdJ.exe
  C:\Windows\System\ZfqJtdJ.exe
  2⤵
  PID:5764
- C:\Windows\System\tWvxvGH.exe
  C:\Windows\System\tWvxvGH.exe
  2⤵
  PID:5788
- C:\Windows\System\cComnJV.exe
  C:\Windows\System\cComnJV.exe
  2⤵
  PID:5804
- C:\Windows\System\syBWzPX.exe
  C:\Windows\System\syBWzPX.exe
  2⤵
  PID:5824
- C:\Windows\System\dECfryI.exe
  C:\Windows\System\dECfryI.exe
  2⤵
  PID:5844
- C:\Windows\System\FxvPaxa.exe
  C:\Windows\System\FxvPaxa.exe
  2⤵
  PID:5864
- C:\Windows\System\QYfnvPi.exe
  C:\Windows\System\QYfnvPi.exe
  2⤵
  PID:5880
- C:\Windows\System\JDrBNMr.exe
  C:\Windows\System\JDrBNMr.exe
  2⤵
  PID:5896
- C:\Windows\System\kQQrtIK.exe
  C:\Windows\System\kQQrtIK.exe
  2⤵
  PID:5916
- C:\Windows\System\gVCdqMD.exe
  C:\Windows\System\gVCdqMD.exe
  2⤵
  PID:5936
- C:\Windows\System\caDxVlO.exe
  C:\Windows\System\caDxVlO.exe
  2⤵
  PID:5956
- C:\Windows\System\vVHqKAR.exe
  C:\Windows\System\vVHqKAR.exe
  2⤵
  PID:5980
- C:\Windows\System\LkQjjzS.exe
  C:\Windows\System\LkQjjzS.exe
  2⤵
  PID:5996
- C:\Windows\System\HeWEXPj.exe
  C:\Windows\System\HeWEXPj.exe
  2⤵
  PID:6020
- C:\Windows\System\hCGsimv.exe
  C:\Windows\System\hCGsimv.exe
  2⤵
  PID:6036
- C:\Windows\System\VRlOLRs.exe
  C:\Windows\System\VRlOLRs.exe
  2⤵
  PID:6060
- C:\Windows\System\PegRfFi.exe
  C:\Windows\System\PegRfFi.exe
  2⤵
  PID:6080
- C:\Windows\System\vApBgHu.exe
  C:\Windows\System\vApBgHu.exe
  2⤵
  PID:6100
- C:\Windows\System\nNWtvQr.exe
  C:\Windows\System\nNWtvQr.exe
  2⤵
  PID:6120
- C:\Windows\System\aaELzBL.exe
  C:\Windows\System\aaELzBL.exe
  2⤵
  PID:6140
- C:\Windows\System\HBumsuD.exe
  C:\Windows\System\HBumsuD.exe
  2⤵
  PID:4972
- C:\Windows\System\qanicij.exe
  C:\Windows\System\qanicij.exe
  2⤵
  PID:1240
- C:\Windows\System\mUUXKHu.exe
  C:\Windows\System\mUUXKHu.exe
  2⤵
  PID:2924
- C:\Windows\System\tDBwPTI.exe
  C:\Windows\System\tDBwPTI.exe
  2⤵
  PID:1788
- C:\Windows\System\PjBkKzz.exe
  C:\Windows\System\PjBkKzz.exe
  2⤵
  PID:4964
- C:\Windows\System\hOoHqIp.exe
  C:\Windows\System\hOoHqIp.exe
  2⤵
  PID:1656
- C:\Windows\System\jLFwhDN.exe
  C:\Windows\System\jLFwhDN.exe
  2⤵
  PID:5124
- C:\Windows\System\MjdOHGW.exe
  C:\Windows\System\MjdOHGW.exe
  2⤵
  PID:792
- C:\Windows\System\hqHXGNr.exe
  C:\Windows\System\hqHXGNr.exe
  2⤵
  PID:3084
- C:\Windows\System\RPZxKyj.exe
  C:\Windows\System\RPZxKyj.exe
  2⤵
  PID:3816
- C:\Windows\System\MIXfTpP.exe
  C:\Windows\System\MIXfTpP.exe
  2⤵
  PID:4328
- C:\Windows\System\ihRlSJn.exe
  C:\Windows\System\ihRlSJn.exe
  2⤵
  PID:5140
- C:\Windows\System\mMlxrFT.exe
  C:\Windows\System\mMlxrFT.exe
  2⤵
  PID:5412
- C:\Windows\System\wbgAmSc.exe
  C:\Windows\System\wbgAmSc.exe
  2⤵
  PID:2328
- C:\Windows\System\whjBsVh.exe
  C:\Windows\System\whjBsVh.exe
  2⤵
  PID:2188
- C:\Windows\System\EIWuGkG.exe
  C:\Windows\System\EIWuGkG.exe
  2⤵
  PID:2308
- C:\Windows\System\iLEfopM.exe
  C:\Windows\System\iLEfopM.exe
  2⤵
  PID:2600
- C:\Windows\System\djFNQxI.exe
  C:\Windows\System\djFNQxI.exe
  2⤵
  PID:4368
- C:\Windows\System\lfBVBlF.exe
  C:\Windows\System\lfBVBlF.exe
  2⤵
  PID:5260
- C:\Windows\System\yQdxkiH.exe
  C:\Windows\System\yQdxkiH.exe
  2⤵
  PID:2624
- C:\Windows\System\bPFCgnk.exe
  C:\Windows\System\bPFCgnk.exe
  2⤵
  PID:5628
- C:\Windows\System\woSDpDs.exe
  C:\Windows\System\woSDpDs.exe
  2⤵
  PID:1572
- C:\Windows\System\VTbPEZJ.exe
  C:\Windows\System\VTbPEZJ.exe
  2⤵
  PID:5704
- C:\Windows\System\LPKivjo.exe
  C:\Windows\System\LPKivjo.exe
  2⤵
  PID:6152
- C:\Windows\System\bEGqIvv.exe
  C:\Windows\System\bEGqIvv.exe
  2⤵
  PID:6176
- C:\Windows\System\MmnrxPU.exe
  C:\Windows\System\MmnrxPU.exe
  2⤵
  PID:6196
- C:\Windows\System\YUGdzYZ.exe
  C:\Windows\System\YUGdzYZ.exe
  2⤵
  PID:6220
- C:\Windows\System\pNOipCv.exe
  C:\Windows\System\pNOipCv.exe
  2⤵
  PID:6244
- C:\Windows\System\cYZCVBX.exe
  C:\Windows\System\cYZCVBX.exe
  2⤵
  PID:6260
- C:\Windows\System\TBmyLUY.exe
  C:\Windows\System\TBmyLUY.exe
  2⤵
  PID:6280
- C:\Windows\System\LreCYDi.exe
  C:\Windows\System\LreCYDi.exe
  2⤵
  PID:6296
- C:\Windows\System\XDrynAC.exe
  C:\Windows\System\XDrynAC.exe
  2⤵
  PID:6328
- C:\Windows\System\fwjnmph.exe
  C:\Windows\System\fwjnmph.exe
  2⤵
  PID:6348
- C:\Windows\System\lVKHNRt.exe
  C:\Windows\System\lVKHNRt.exe
  2⤵
  PID:6372
- C:\Windows\System\ElnIiDl.exe
  C:\Windows\System\ElnIiDl.exe
  2⤵
  PID:6392
- C:\Windows\System\JhjLFCW.exe
  C:\Windows\System\JhjLFCW.exe
  2⤵
  PID:6412
- C:\Windows\System\DCsiauy.exe
  C:\Windows\System\DCsiauy.exe
  2⤵
  PID:6432
- C:\Windows\System\eIElBBs.exe
  C:\Windows\System\eIElBBs.exe
  2⤵
  PID:6456
- C:\Windows\System\ImLaRVU.exe
  C:\Windows\System\ImLaRVU.exe
  2⤵
  PID:6480
- C:\Windows\System\YOlWcqJ.exe
  C:\Windows\System\YOlWcqJ.exe
  2⤵
  PID:6508
- C:\Windows\System\UTohDiF.exe
  C:\Windows\System\UTohDiF.exe
  2⤵
  PID:6524
- C:\Windows\System\wtWIOHN.exe
  C:\Windows\System\wtWIOHN.exe
  2⤵
  PID:6552
- C:\Windows\System\EVfYlBg.exe
  C:\Windows\System\EVfYlBg.exe
  2⤵
  PID:6576
- C:\Windows\System\ODWGFCV.exe
  C:\Windows\System\ODWGFCV.exe
  2⤵
  PID:6596
- C:\Windows\System\WFKYpYa.exe
  C:\Windows\System\WFKYpYa.exe
  2⤵
  PID:6612
- C:\Windows\System\VFBDKrd.exe
  C:\Windows\System\VFBDKrd.exe
  2⤵
  PID:6636
- C:\Windows\System\BnPqSzC.exe
  C:\Windows\System\BnPqSzC.exe
  2⤵
  PID:6704
- C:\Windows\System\svyKNtY.exe
  C:\Windows\System\svyKNtY.exe
  2⤵
  PID:6732
- C:\Windows\System\xwottZq.exe
  C:\Windows\System\xwottZq.exe
  2⤵
  PID:6752
- C:\Windows\System\MbCXSJq.exe
  C:\Windows\System\MbCXSJq.exe
  2⤵
  PID:6768
- C:\Windows\System\PjnrNLC.exe
  C:\Windows\System\PjnrNLC.exe
  2⤵
  PID:6792
- C:\Windows\System\czhaGAI.exe
  C:\Windows\System\czhaGAI.exe
  2⤵
  PID:6820
- C:\Windows\System\bhXbhVH.exe
  C:\Windows\System\bhXbhVH.exe
  2⤵
  PID:6840
- C:\Windows\System\myfNyvG.exe
  C:\Windows\System\myfNyvG.exe
  2⤵
  PID:6856
- C:\Windows\System\rFsTOkm.exe
  C:\Windows\System\rFsTOkm.exe
  2⤵
  PID:6872
- C:\Windows\System\KOTwney.exe
  C:\Windows\System\KOTwney.exe
  2⤵
  PID:6892
- C:\Windows\System\NGmNULK.exe
  C:\Windows\System\NGmNULK.exe
  2⤵
  PID:6912
- C:\Windows\System\OfFLwhR.exe
  C:\Windows\System\OfFLwhR.exe
  2⤵
  PID:6928
- C:\Windows\System\mNLXTiV.exe
  C:\Windows\System\mNLXTiV.exe
  2⤵
  PID:6948
- C:\Windows\System\NfCcIqm.exe
  C:\Windows\System\NfCcIqm.exe
  2⤵
  PID:6976
- C:\Windows\System\ZUZnhWU.exe
  C:\Windows\System\ZUZnhWU.exe
  2⤵
  PID:6992
- C:\Windows\System\KNgUlCO.exe
  C:\Windows\System\KNgUlCO.exe
  2⤵
  PID:7016
- C:\Windows\System\famsRKt.exe
  C:\Windows\System\famsRKt.exe
  2⤵
  PID:7036
- C:\Windows\System\BjHqMOa.exe
  C:\Windows\System\BjHqMOa.exe
  2⤵
  PID:7060
- C:\Windows\System\FYwARLT.exe
  C:\Windows\System\FYwARLT.exe
  2⤵
  PID:7080
- C:\Windows\System\fBDfyYw.exe
  C:\Windows\System\fBDfyYw.exe
  2⤵
  PID:7100
- C:\Windows\System\atJTqFr.exe
  C:\Windows\System\atJTqFr.exe
  2⤵
  PID:7124
- C:\Windows\System\gAcMoLH.exe
  C:\Windows\System\gAcMoLH.exe
  2⤵
  PID:7144
- C:\Windows\System\varMSOU.exe
  C:\Windows\System\varMSOU.exe
  2⤵
  PID:5756
- C:\Windows\System\qnfBtFf.exe
  C:\Windows\System\qnfBtFf.exe
  2⤵
  PID:4476
- C:\Windows\System\VMMWeDM.exe
  C:\Windows\System\VMMWeDM.exe
  2⤵
  PID:5144
- C:\Windows\System\wLNOymM.exe
  C:\Windows\System\wLNOymM.exe
  2⤵
  PID:1412
- C:\Windows\System\AMkqQqM.exe
  C:\Windows\System\AMkqQqM.exe
  2⤵
  PID:6004
- C:\Windows\System\PJSDCDP.exe
  C:\Windows\System\PJSDCDP.exe
  2⤵
  PID:6044
- C:\Windows\System\IuWUbDI.exe
  C:\Windows\System\IuWUbDI.exe
  2⤵
  PID:5348
- C:\Windows\System\NrdBjNJ.exe
  C:\Windows\System\NrdBjNJ.exe
  2⤵
  PID:5648
- C:\Windows\System\IzcqZrr.exe
  C:\Windows\System\IzcqZrr.exe
  2⤵
  PID:3092
- C:\Windows\System\fQuencv.exe
  C:\Windows\System\fQuencv.exe
  2⤵
  PID:5388
- C:\Windows\System\DBvcHvw.exe
  C:\Windows\System\DBvcHvw.exe
  2⤵
  PID:6164
- C:\Windows\System\nANqUrp.exe
  C:\Windows\System\nANqUrp.exe
  2⤵
  PID:5420
- C:\Windows\System\jdyVmEE.exe
  C:\Windows\System\jdyVmEE.exe
  2⤵
  PID:5852
- C:\Windows\System\JbvCCHA.exe
  C:\Windows\System\JbvCCHA.exe
  2⤵
  PID:5872
- C:\Windows\System\SlBsCJC.exe
  C:\Windows\System\SlBsCJC.exe
  2⤵
  PID:6096
- C:\Windows\System\QtujtvA.exe
  C:\Windows\System\QtujtvA.exe
  2⤵
  PID:5476
- C:\Windows\System\RPNBfto.exe
  C:\Windows\System\RPNBfto.exe
  2⤵
  PID:5508
- C:\Windows\System\mfGgiou.exe
  C:\Windows\System\mfGgiou.exe
  2⤵
  PID:5544
- C:\Windows\System\cwyLvKx.exe
  C:\Windows\System\cwyLvKx.exe
  2⤵
  PID:5592
- C:\Windows\System\vehuWMh.exe
  C:\Windows\System\vehuWMh.exe
  2⤵
  PID:5624
- C:\Windows\System\NqOmKdH.exe
  C:\Windows\System\NqOmKdH.exe
  2⤵
  PID:5720
- C:\Windows\System\aLcGCFo.exe
  C:\Windows\System\aLcGCFo.exe
  2⤵
  PID:5800
- C:\Windows\System\OIsRKZm.exe
  C:\Windows\System\OIsRKZm.exe
  2⤵
  PID:6288
- C:\Windows\System\qKbPtvy.exe
  C:\Windows\System\qKbPtvy.exe
  2⤵
  PID:5912
- C:\Windows\System\ardxlcx.exe
  C:\Windows\System\ardxlcx.exe
  2⤵
  PID:5964
- C:\Windows\System\vJZQWNV.exe
  C:\Windows\System\vJZQWNV.exe
  2⤵
  PID:1324
- C:\Windows\System\FIEZuUH.exe
  C:\Windows\System\FIEZuUH.exe
  2⤵
  PID:3124
- C:\Windows\System\kDEFrGH.exe
  C:\Windows\System\kDEFrGH.exe
  2⤵
  PID:6400
- C:\Windows\System\nReRuNm.exe
  C:\Windows\System\nReRuNm.exe
  2⤵
  PID:6452
- C:\Windows\System\rdFOxeR.exe
  C:\Windows\System\rdFOxeR.exe
  2⤵
  PID:6520
- C:\Windows\System\DldMmko.exe
  C:\Windows\System\DldMmko.exe
  2⤵
  PID:6568
- C:\Windows\System\gbYcQPH.exe
  C:\Windows\System\gbYcQPH.exe
  2⤵
  PID:6604
- C:\Windows\System\OFIjWqK.exe
  C:\Windows\System\OFIjWqK.exe
  2⤵
  PID:6720
- C:\Windows\System\repEmwa.exe
  C:\Windows\System\repEmwa.exe
  2⤵
  PID:6744
- C:\Windows\System\rNRXAOk.exe
  C:\Windows\System\rNRXAOk.exe
  2⤵
  PID:6788
- C:\Windows\System\ssBTVgT.exe
  C:\Windows\System\ssBTVgT.exe
  2⤵
  PID:6836
- C:\Windows\System\bCwpGsN.exe
  C:\Windows\System\bCwpGsN.exe
  2⤵
  PID:6888
- C:\Windows\System\lfcuRQf.exe
  C:\Windows\System\lfcuRQf.exe
  2⤵
  PID:6944
- C:\Windows\System\kkYCSoM.exe
  C:\Windows\System\kkYCSoM.exe
  2⤵
  PID:7008
- C:\Windows\System\bPPaFGI.exe
  C:\Windows\System\bPPaFGI.exe
  2⤵
  PID:7076
- C:\Windows\System\cedfdIP.exe
  C:\Windows\System\cedfdIP.exe
  2⤵
  PID:7140
- C:\Windows\System\JFMYucS.exe
  C:\Windows\System\JFMYucS.exe
  2⤵
  PID:5780
- C:\Windows\System\jrIpBKb.exe
  C:\Windows\System\jrIpBKb.exe
  2⤵
  PID:6032
- C:\Windows\System\eiqOnAt.exe
  C:\Windows\System\eiqOnAt.exe
  2⤵
  PID:7176
- C:\Windows\System\VNWpKwz.exe
  C:\Windows\System\VNWpKwz.exe
  2⤵
  PID:7200
- C:\Windows\System\RFUWuyO.exe
  C:\Windows\System\RFUWuyO.exe
  2⤵
  PID:7224
- C:\Windows\System\ykYpBzE.exe
  C:\Windows\System\ykYpBzE.exe
  2⤵
  PID:7240
- C:\Windows\System\fJQlTwF.exe
  C:\Windows\System\fJQlTwF.exe
  2⤵
  PID:7260
- C:\Windows\System\VVQacYx.exe
  C:\Windows\System\VVQacYx.exe
  2⤵
  PID:7288
- C:\Windows\System\cxdgQCk.exe
  C:\Windows\System\cxdgQCk.exe
  2⤵
  PID:7312
- C:\Windows\System\IHnurcC.exe
  C:\Windows\System\IHnurcC.exe
  2⤵
  PID:7336
- C:\Windows\System\yyRyIhL.exe
  C:\Windows\System\yyRyIhL.exe
  2⤵
  PID:7360
- C:\Windows\System\zkAqarB.exe
  C:\Windows\System\zkAqarB.exe
  2⤵
  PID:7380
- C:\Windows\System\YfPrJzv.exe
  C:\Windows\System\YfPrJzv.exe
  2⤵
  PID:7404
- C:\Windows\System\XpHkaFe.exe
  C:\Windows\System\XpHkaFe.exe
  2⤵
  PID:7424
- C:\Windows\System\UuAUvDb.exe
  C:\Windows\System\UuAUvDb.exe
  2⤵
  PID:7440
- C:\Windows\System\IdksHEe.exe
  C:\Windows\System\IdksHEe.exe
  2⤵
  PID:7468
- C:\Windows\System\MgYqjfo.exe
  C:\Windows\System\MgYqjfo.exe
  2⤵
  PID:7496
- C:\Windows\System\YPpqzss.exe
  C:\Windows\System\YPpqzss.exe
  2⤵
  PID:7512
- C:\Windows\System\pMpWNRR.exe
  C:\Windows\System\pMpWNRR.exe
  2⤵
  PID:7536
- C:\Windows\System\KbcVAqJ.exe
  C:\Windows\System\KbcVAqJ.exe
  2⤵
  PID:7556
- C:\Windows\System\tiJxAnV.exe
  C:\Windows\System\tiJxAnV.exe
  2⤵
  PID:7580
- C:\Windows\System\nMbCxBz.exe
  C:\Windows\System\nMbCxBz.exe
  2⤵
  PID:7604
- C:\Windows\System\cynLLCw.exe
  C:\Windows\System\cynLLCw.exe
  2⤵
  PID:7624
- C:\Windows\System\oBEBeqC.exe
  C:\Windows\System\oBEBeqC.exe
  2⤵
  PID:7652
- C:\Windows\System\Ltjlbmw.exe
  C:\Windows\System\Ltjlbmw.exe
  2⤵
  PID:7672
- C:\Windows\System\BYmRnzM.exe
  C:\Windows\System\BYmRnzM.exe
  2⤵
  PID:7700
- C:\Windows\System\VvEucAr.exe
  C:\Windows\System\VvEucAr.exe
  2⤵
  PID:7716
- C:\Windows\System\iYzecRb.exe
  C:\Windows\System\iYzecRb.exe
  2⤵
  PID:7740
- C:\Windows\System\zKdNBNP.exe
  C:\Windows\System\zKdNBNP.exe
  2⤵
  PID:7764
- C:\Windows\System\wmtKWDA.exe
  C:\Windows\System\wmtKWDA.exe
  2⤵
  PID:7784
- C:\Windows\System\UTWkWcW.exe
  C:\Windows\System\UTWkWcW.exe
  2⤵
  PID:7816
- C:\Windows\System\LNbYfBx.exe
  C:\Windows\System\LNbYfBx.exe
  2⤵
  PID:7840
- C:\Windows\System\BHVCGQJ.exe
  C:\Windows\System\BHVCGQJ.exe
  2⤵
  PID:7860
- C:\Windows\System\NpmwpLb.exe
  C:\Windows\System\NpmwpLb.exe
  2⤵
  PID:7884
- C:\Windows\System\czyOuWI.exe
  C:\Windows\System\czyOuWI.exe
  2⤵
  PID:7908
- C:\Windows\System\FlJQRKu.exe
  C:\Windows\System\FlJQRKu.exe
  2⤵
  PID:7928
- C:\Windows\System\XScoXOY.exe
  C:\Windows\System\XScoXOY.exe
  2⤵
  PID:7948
- C:\Windows\System\OsOJVFa.exe
  C:\Windows\System\OsOJVFa.exe
  2⤵
  PID:7964
- C:\Windows\System\vWEbMMD.exe
  C:\Windows\System\vWEbMMD.exe
  2⤵
  PID:7980
- C:\Windows\System\hvsJGsE.exe
  C:\Windows\System\hvsJGsE.exe
  2⤵
  PID:7996
- C:\Windows\System\oOKQBEk.exe
  C:\Windows\System\oOKQBEk.exe
  2⤵
  PID:8016
- C:\Windows\System\RwYkCJu.exe
  C:\Windows\System\RwYkCJu.exe
  2⤵
  PID:8032
- C:\Windows\System\gnbusxX.exe
  C:\Windows\System\gnbusxX.exe
  2⤵
  PID:8052
- C:\Windows\System\bdbkVKN.exe
  C:\Windows\System\bdbkVKN.exe
  2⤵
  PID:8068
- C:\Windows\System\bjLZqkY.exe
  C:\Windows\System\bjLZqkY.exe
  2⤵
  PID:8088
- C:\Windows\System\nJIXpOv.exe
  C:\Windows\System\nJIXpOv.exe
  2⤵
  PID:8108
- C:\Windows\System\HDNmeno.exe
  C:\Windows\System\HDNmeno.exe
  2⤵
  PID:8124
- C:\Windows\System\XNfEhdL.exe
  C:\Windows\System\XNfEhdL.exe
  2⤵
  PID:8144
- C:\Windows\System\PWtxcSR.exe
  C:\Windows\System\PWtxcSR.exe
  2⤵
  PID:8164
- C:\Windows\System\RowPETJ.exe
  C:\Windows\System\RowPETJ.exe
  2⤵
  PID:8180
- C:\Windows\System\DbPYoto.exe
  C:\Windows\System\DbPYoto.exe
  2⤵
  PID:8204
- C:\Windows\System\GOCxjQy.exe
  C:\Windows\System\GOCxjQy.exe
  2⤵
  PID:8220
- C:\Windows\System\OACaxPH.exe
  C:\Windows\System\OACaxPH.exe
  2⤵
  PID:8244
- C:\Windows\System\dOfNfwN.exe
  C:\Windows\System\dOfNfwN.exe
  2⤵
  PID:8264
- C:\Windows\System\vmxwQkv.exe
  C:\Windows\System\vmxwQkv.exe
  2⤵
  PID:8280
- C:\Windows\System\afCDiCi.exe
  C:\Windows\System\afCDiCi.exe
  2⤵
  PID:8304
- C:\Windows\System\fRshEiC.exe
  C:\Windows\System\fRshEiC.exe
  2⤵
  PID:8320
- C:\Windows\System\IyOYfaw.exe
  C:\Windows\System\IyOYfaw.exe
  2⤵
  PID:8344
- C:\Windows\System\HRDStIC.exe
  C:\Windows\System\HRDStIC.exe
  2⤵
  PID:8360
- C:\Windows\System\BaFGLFs.exe
  C:\Windows\System\BaFGLFs.exe
  2⤵
  PID:8380
- C:\Windows\System\EnVlJfe.exe
  C:\Windows\System\EnVlJfe.exe
  2⤵
  PID:8612
- C:\Windows\System\QAVZFuP.exe
  C:\Windows\System\QAVZFuP.exe
  2⤵
  PID:8628
- C:\Windows\System\YxofHhK.exe
  C:\Windows\System\YxofHhK.exe
  2⤵
  PID:8644
- C:\Windows\System\cOWPkmg.exe
  C:\Windows\System\cOWPkmg.exe
  2⤵
  PID:8660
- C:\Windows\System\VGPjvPd.exe
  C:\Windows\System\VGPjvPd.exe
  2⤵
  PID:8676
- C:\Windows\System\PeMZYOE.exe
  C:\Windows\System\PeMZYOE.exe
  2⤵
  PID:8696
- C:\Windows\System\NFtrJZi.exe
  C:\Windows\System\NFtrJZi.exe
  2⤵
  PID:8716
- C:\Windows\System\QcZkrub.exe
  C:\Windows\System\QcZkrub.exe
  2⤵
  PID:8736
- C:\Windows\System\AugSCsq.exe
  C:\Windows\System\AugSCsq.exe
  2⤵
  PID:8756
- C:\Windows\System\wJRxrmx.exe
  C:\Windows\System\wJRxrmx.exe
  2⤵
  PID:8780
- C:\Windows\System\xnUSHaw.exe
  C:\Windows\System\xnUSHaw.exe
  2⤵
  PID:8796
- C:\Windows\System\XUAyyvM.exe
  C:\Windows\System\XUAyyvM.exe
  2⤵
  PID:8812
- C:\Windows\System\JdENDQh.exe
  C:\Windows\System\JdENDQh.exe
  2⤵
  PID:8836
- C:\Windows\System\ydIpcZE.exe
  C:\Windows\System\ydIpcZE.exe
  2⤵
  PID:8856
- C:\Windows\System\klqREtZ.exe
  C:\Windows\System\klqREtZ.exe
  2⤵
  PID:8872
- C:\Windows\System\QQfajtS.exe
  C:\Windows\System\QQfajtS.exe
  2⤵
  PID:8892
- C:\Windows\System\PCneZve.exe
  C:\Windows\System\PCneZve.exe
  2⤵
  PID:8912
- C:\Windows\System\MjJvPTF.exe
  C:\Windows\System\MjJvPTF.exe
  2⤵
  PID:8928
- C:\Windows\System\LuqWDLq.exe
  C:\Windows\System\LuqWDLq.exe
  2⤵
  PID:8948
- C:\Windows\System\GdqxoYk.exe
  C:\Windows\System\GdqxoYk.exe
  2⤵
  PID:8968
- C:\Windows\System\pnMpjIB.exe
  C:\Windows\System\pnMpjIB.exe
  2⤵
  PID:8988
- C:\Windows\System\iTyNgLc.exe
  C:\Windows\System\iTyNgLc.exe
  2⤵
  PID:9008
- C:\Windows\System\DDllFcY.exe
  C:\Windows\System\DDllFcY.exe
  2⤵
  PID:9024
- C:\Windows\System\vTIMkJu.exe
  C:\Windows\System\vTIMkJu.exe
  2⤵
  PID:9040
- C:\Windows\System\pmiKBvn.exe
  C:\Windows\System\pmiKBvn.exe
  2⤵
  PID:9064
- C:\Windows\System\KfVGlRC.exe
  C:\Windows\System\KfVGlRC.exe
  2⤵
  PID:9092
- C:\Windows\System\DqProYz.exe
  C:\Windows\System\DqProYz.exe
  2⤵
  PID:9120
- C:\Windows\System\gfQmurV.exe
  C:\Windows\System\gfQmurV.exe
  2⤵
  PID:9144
- C:\Windows\System\oVcomZA.exe
  C:\Windows\System\oVcomZA.exe
  2⤵
  PID:9168
- C:\Windows\System\qDqYQBg.exe
  C:\Windows\System\qDqYQBg.exe
  2⤵
  PID:9192
- C:\Windows\System\MOtCuWm.exe
  C:\Windows\System\MOtCuWm.exe
  2⤵
  PID:2680
- C:\Windows\System\ENSVifN.exe
  C:\Windows\System\ENSVifN.exe
  2⤵
  PID:7072
- C:\Windows\System\oyrMgoQ.exe
  C:\Windows\System\oyrMgoQ.exe
  2⤵
  PID:6648
- C:\Windows\System\oXgPGrK.exe
  C:\Windows\System\oXgPGrK.exe
  2⤵
  PID:7184
- C:\Windows\System\jjnAjHx.exe
  C:\Windows\System\jjnAjHx.exe
  2⤵
  PID:7216
- C:\Windows\System\znfNcRX.exe
  C:\Windows\System\znfNcRX.exe
  2⤵
  PID:7636
- C:\Windows\System\mWJUKfm.exe
  C:\Windows\System\mWJUKfm.exe
  2⤵
  PID:9244
- C:\Windows\System\UbzwUnn.exe
  C:\Windows\System\UbzwUnn.exe
  2⤵
  PID:9268
- C:\Windows\System\WduPjrA.exe
  C:\Windows\System\WduPjrA.exe
  2⤵
  PID:9308
- C:\Windows\System\yaUWVgK.exe
  C:\Windows\System\yaUWVgK.exe
  2⤵
  PID:9324
- C:\Windows\System\CAQRRXh.exe
  C:\Windows\System\CAQRRXh.exe
  2⤵
  PID:9348
- C:\Windows\System\KgsYdfA.exe
  C:\Windows\System\KgsYdfA.exe
  2⤵
  PID:9368
- C:\Windows\System\JpuBoNZ.exe
  C:\Windows\System\JpuBoNZ.exe
  2⤵
  PID:9388
- C:\Windows\System\fiZlYpZ.exe
  C:\Windows\System\fiZlYpZ.exe
  2⤵
  PID:9416
- C:\Windows\System\pTvixQQ.exe
  C:\Windows\System\pTvixQQ.exe
  2⤵
  PID:9432
- C:\Windows\System\YyZhNdI.exe
  C:\Windows\System\YyZhNdI.exe
  2⤵
  PID:9452
- C:\Windows\System\CobWSIF.exe
  C:\Windows\System\CobWSIF.exe
  2⤵
  PID:9472
- C:\Windows\System\kRYkyyu.exe
  C:\Windows\System\kRYkyyu.exe
  2⤵
  PID:9488
- C:\Windows\System\BqFtihV.exe
  C:\Windows\System\BqFtihV.exe
  2⤵
  PID:9508
- C:\Windows\System\bvnvzJF.exe
  C:\Windows\System\bvnvzJF.exe
  2⤵
  PID:9528
- C:\Windows\System\EqPDVqZ.exe
  C:\Windows\System\EqPDVqZ.exe
  2⤵
  PID:9584
- C:\Windows\System\ZLZwIse.exe
  C:\Windows\System\ZLZwIse.exe
  2⤵
  PID:9600
- C:\Windows\System\jcCjqOz.exe
  C:\Windows\System\jcCjqOz.exe
  2⤵
  PID:9616
- C:\Windows\System\KMTqZDP.exe
  C:\Windows\System\KMTqZDP.exe
  2⤵
  PID:9632
- C:\Windows\System\EOtwIBa.exe
  C:\Windows\System\EOtwIBa.exe
  2⤵
  PID:9648
- C:\Windows\System\RtCLeGs.exe
  C:\Windows\System\RtCLeGs.exe
  2⤵
  PID:9664
- C:\Windows\System\zKvSweN.exe
  C:\Windows\System\zKvSweN.exe
  2⤵
  PID:9680
- C:\Windows\System\HgqNGXh.exe
  C:\Windows\System\HgqNGXh.exe
  2⤵
  PID:9696
- C:\Windows\System\CWQdtga.exe
  C:\Windows\System\CWQdtga.exe
  2⤵
  PID:9712
- C:\Windows\System\gZDsdHX.exe
  C:\Windows\System\gZDsdHX.exe
  2⤵
  PID:9728
- C:\Windows\System\oZTRgHh.exe
  C:\Windows\System\oZTRgHh.exe
  2⤵
  PID:9744
- C:\Windows\System\GDRZtyJ.exe
  C:\Windows\System\GDRZtyJ.exe
  2⤵
  PID:9760
- C:\Windows\System\jyoklVB.exe
  C:\Windows\System\jyoklVB.exe
  2⤵
  PID:9776
- C:\Windows\System\HwKGtVS.exe
  C:\Windows\System\HwKGtVS.exe
  2⤵
  PID:9792
- C:\Windows\System\wbsjAal.exe
  C:\Windows\System\wbsjAal.exe
  2⤵
  PID:9808
- C:\Windows\System\rNLvqnw.exe
  C:\Windows\System\rNLvqnw.exe
  2⤵
  PID:9824
- C:\Windows\System\RktjyPa.exe
  C:\Windows\System\RktjyPa.exe
  2⤵
  PID:9840
- C:\Windows\System\VpWuHAP.exe
  C:\Windows\System\VpWuHAP.exe
  2⤵
  PID:9856
- C:\Windows\System\JcXQmuD.exe
  C:\Windows\System\JcXQmuD.exe
  2⤵
  PID:9872
- C:\Windows\System\VMuxOrW.exe
  C:\Windows\System\VMuxOrW.exe
  2⤵
  PID:9888
- C:\Windows\System\CfiPOOF.exe
  C:\Windows\System\CfiPOOF.exe
  2⤵
  PID:9904
- C:\Windows\System\ODlxPQF.exe
  C:\Windows\System\ODlxPQF.exe
  2⤵
  PID:9920
- C:\Windows\System\YajyBXb.exe
  C:\Windows\System\YajyBXb.exe
  2⤵
  PID:9936
- C:\Windows\System\pYnPOgA.exe
  C:\Windows\System\pYnPOgA.exe
  2⤵
  PID:9956
- C:\Windows\System\KKJRAQN.exe
  C:\Windows\System\KKJRAQN.exe
  2⤵
  PID:9976
- C:\Windows\System\sLGBIAH.exe
  C:\Windows\System\sLGBIAH.exe
  2⤵
  PID:9992
- C:\Windows\System\aKXohpd.exe
  C:\Windows\System\aKXohpd.exe
  2⤵
  PID:10008
- C:\Windows\System\hZYEQYi.exe
  C:\Windows\System\hZYEQYi.exe
  2⤵
  PID:10032
- C:\Windows\System\nkVzbKk.exe
  C:\Windows\System\nkVzbKk.exe
  2⤵
  PID:10056
- C:\Windows\System\FoezNzv.exe
  C:\Windows\System\FoezNzv.exe
  2⤵
  PID:10072
- C:\Windows\System\cRaRZUK.exe
  C:\Windows\System\cRaRZUK.exe
  2⤵
  PID:10092
- C:\Windows\System\UpfoFoX.exe
  C:\Windows\System\UpfoFoX.exe
  2⤵
  PID:10108
- C:\Windows\System\FXZbpZs.exe
  C:\Windows\System\FXZbpZs.exe
  2⤵
  PID:10128
- C:\Windows\System\UPPLVNE.exe
  C:\Windows\System\UPPLVNE.exe
  2⤵
  PID:10160
- C:\Windows\System\vMBjhPE.exe
  C:\Windows\System\vMBjhPE.exe
  2⤵
  PID:10176
- C:\Windows\System\eKToFDM.exe
  C:\Windows\System\eKToFDM.exe
  2⤵
  PID:10196
- C:\Windows\System\SJAkhVF.exe
  C:\Windows\System\SJAkhVF.exe
  2⤵
  PID:10220
- C:\Windows\System\EZBGGzS.exe
  C:\Windows\System\EZBGGzS.exe
  2⤵
  PID:7664
- C:\Windows\System\TKNgCAF.exe
  C:\Windows\System\TKNgCAF.exe
  2⤵
  PID:7692
- C:\Windows\System\KIEFOAH.exe
  C:\Windows\System\KIEFOAH.exe
  2⤵
  PID:7752
- C:\Windows\System\ljsqqOB.exe
  C:\Windows\System\ljsqqOB.exe
  2⤵
  PID:7972
- C:\Windows\System\EcWGBRQ.exe
  C:\Windows\System\EcWGBRQ.exe
  2⤵
  PID:6540
- C:\Windows\System\wFRJWUC.exe
  C:\Windows\System\wFRJWUC.exe
  2⤵
  PID:7796
- C:\Windows\System\SltPskp.exe
  C:\Windows\System\SltPskp.exe
  2⤵
  PID:8160
- C:\Windows\System\dEJiMqx.exe
  C:\Windows\System\dEJiMqx.exe
  2⤵
  PID:8228
- C:\Windows\System\WfJGldO.exe
  C:\Windows\System\WfJGldO.exe
  2⤵
  PID:8356
- C:\Windows\System\Dmsyfhy.exe
  C:\Windows\System\Dmsyfhy.exe
  2⤵
  PID:1284
- C:\Windows\System\fUttrGD.exe
  C:\Windows\System\fUttrGD.exe
  2⤵
  PID:2432
- C:\Windows\System\NIRjBUf.exe
  C:\Windows\System\NIRjBUf.exe
  2⤵
  PID:10264
- C:\Windows\System\GkTntip.exe
  C:\Windows\System\GkTntip.exe
  2⤵
  PID:10288
- C:\Windows\System\wrZsUBN.exe
  C:\Windows\System\wrZsUBN.exe
  2⤵
  PID:10304
- C:\Windows\System\YVTEeNT.exe
  C:\Windows\System\YVTEeNT.exe
  2⤵
  PID:10332
- C:\Windows\System\muVfwJQ.exe
  C:\Windows\System\muVfwJQ.exe
  2⤵
  PID:10348
- C:\Windows\System\OroFwNa.exe
  C:\Windows\System\OroFwNa.exe
  2⤵
  PID:10372
- C:\Windows\System\fWubSZG.exe
  C:\Windows\System\fWubSZG.exe
  2⤵
  PID:10396
- C:\Windows\System\hlWRzBJ.exe
  C:\Windows\System\hlWRzBJ.exe
  2⤵
  PID:10412
- C:\Windows\System\OVAiCkq.exe
  C:\Windows\System\OVAiCkq.exe
  2⤵
  PID:10432
- C:\Windows\System\qzpcWSe.exe
  C:\Windows\System\qzpcWSe.exe
  2⤵
  PID:10496
- C:\Windows\System\OwkHLWP.exe
  C:\Windows\System\OwkHLWP.exe
  2⤵
  PID:10512
- C:\Windows\System\VwBmnuO.exe
  C:\Windows\System\VwBmnuO.exe
  2⤵
  PID:10528
- C:\Windows\System\qgJecUA.exe
  C:\Windows\System\qgJecUA.exe
  2⤵
  PID:10544
- C:\Windows\System\UaRqFNF.exe
  C:\Windows\System\UaRqFNF.exe
  2⤵
  PID:10560
- C:\Windows\System\EURsOiv.exe
  C:\Windows\System\EURsOiv.exe
  2⤵
  PID:10584
- C:\Windows\System\vOUFtwP.exe
  C:\Windows\System\vOUFtwP.exe
  2⤵
  PID:10600
- C:\Windows\System\wiGCilk.exe
  C:\Windows\System\wiGCilk.exe
  2⤵
  PID:10624
- C:\Windows\System\QblPPnu.exe
  C:\Windows\System\QblPPnu.exe
  2⤵
  PID:10648
- C:\Windows\System\CzPIPSg.exe
  C:\Windows\System\CzPIPSg.exe
  2⤵
  PID:10664
- C:\Windows\System\tehxCgl.exe
  C:\Windows\System\tehxCgl.exe
  2⤵
  PID:10688
- C:\Windows\System\KEBvMnB.exe
  C:\Windows\System\KEBvMnB.exe
  2⤵
  PID:10708
- C:\Windows\System\fiYcnUV.exe
  C:\Windows\System\fiYcnUV.exe
  2⤵
  PID:10728
- C:\Windows\System\ZbaCfer.exe
  C:\Windows\System\ZbaCfer.exe
  2⤵
  PID:10752
- C:\Windows\System\YIlWWeD.exe
  C:\Windows\System\YIlWWeD.exe
  2⤵
  PID:10772
- C:\Windows\System\AvPBoLM.exe
  C:\Windows\System\AvPBoLM.exe
  2⤵
  PID:10792
- C:\Windows\System\YdjRAWg.exe
  C:\Windows\System\YdjRAWg.exe
  2⤵
  PID:10816
- C:\Windows\System\LaKjFwu.exe
  C:\Windows\System\LaKjFwu.exe
  2⤵
  PID:10832
- C:\Windows\System\inTanzi.exe
  C:\Windows\System\inTanzi.exe
  2⤵
  PID:10856
- C:\Windows\System\AKfuQEt.exe
  C:\Windows\System\AKfuQEt.exe
  2⤵
  PID:10872
- C:\Windows\System\hOMsmQG.exe
  C:\Windows\System\hOMsmQG.exe
  2⤵
  PID:10896
- C:\Windows\System\OqqWyTF.exe
  C:\Windows\System\OqqWyTF.exe
  2⤵
  PID:10916
- C:\Windows\System\KAtuwMg.exe
  C:\Windows\System\KAtuwMg.exe
  2⤵
  PID:10932
- C:\Windows\System\hszBcYB.exe
  C:\Windows\System\hszBcYB.exe
  2⤵
  PID:10960
- C:\Windows\System\ILtyCoG.exe
  C:\Windows\System\ILtyCoG.exe
  2⤵
  PID:10980
- C:\Windows\System\YLTnDEU.exe
  C:\Windows\System\YLTnDEU.exe
  2⤵
  PID:11000
- C:\Windows\System\AeAtAFx.exe
  C:\Windows\System\AeAtAFx.exe
  2⤵
  PID:11024
- C:\Windows\System\JDCYGFr.exe
  C:\Windows\System\JDCYGFr.exe
  2⤵
  PID:11044
- C:\Windows\System\BPhcMYh.exe
  C:\Windows\System\BPhcMYh.exe
  2⤵
  PID:11064
- C:\Windows\System\eBtSDzV.exe
  C:\Windows\System\eBtSDzV.exe
  2⤵
  PID:11084
- C:\Windows\System\TzBvjdy.exe
  C:\Windows\System\TzBvjdy.exe
  2⤵
  PID:11108
- C:\Windows\System\kfeWmZp.exe
  C:\Windows\System\kfeWmZp.exe
  2⤵
  PID:11128
- C:\Windows\System\KIklWuK.exe
  C:\Windows\System\KIklWuK.exe
  2⤵
  PID:11148
- C:\Windows\System\HpPSzVD.exe
  C:\Windows\System\HpPSzVD.exe
  2⤵
  PID:11172
- C:\Windows\System\LZfbIYY.exe
  C:\Windows\System\LZfbIYY.exe
  2⤵
  PID:11192
- C:\Windows\System\sBvNDxD.exe
  C:\Windows\System\sBvNDxD.exe
  2⤵
  PID:11216
- C:\Windows\System\CauOgop.exe
  C:\Windows\System\CauOgop.exe
  2⤵
  PID:11236
- C:\Windows\System\WeExEaS.exe
  C:\Windows\System\WeExEaS.exe
  2⤵
  PID:11256
- C:\Windows\System\MpKLlEQ.exe
  C:\Windows\System\MpKLlEQ.exe
  2⤵
  PID:6148
- C:\Windows\System\PCEBlrx.exe
  C:\Windows\System\PCEBlrx.exe
  2⤵
  PID:6256
- C:\Windows\System\xyGQZio.exe
  C:\Windows\System\xyGQZio.exe
  2⤵
  PID:6116
- C:\Windows\System\EdjTICj.exe
  C:\Windows\System\EdjTICj.exe
  2⤵
  PID:5576
- C:\Windows\System\MYmfKxN.exe
  C:\Windows\System\MYmfKxN.exe
  2⤵
  PID:5668
- C:\Windows\System\nPusZnq.exe
  C:\Windows\System\nPusZnq.exe
  2⤵
  PID:5892
- C:\Windows\System\EsatdcU.exe
  C:\Windows\System\EsatdcU.exe
  2⤵
  PID:4516
- C:\Windows\System\itImvPs.exe
  C:\Windows\System\itImvPs.exe
  2⤵
  PID:6688
- C:\Windows\System\RScyZRj.exe
  C:\Windows\System\RScyZRj.exe
  2⤵
  PID:5976
- C:\Windows\System\cIdfKba.exe
  C:\Windows\System\cIdfKba.exe
  2⤵
  PID:6632
- C:\Windows\System\jMvPEEQ.exe
  C:\Windows\System\jMvPEEQ.exe
  2⤵
  PID:6924
- C:\Windows\System\bOLPkmL.exe
  C:\Windows\System\bOLPkmL.exe
  2⤵
  PID:7068
- C:\Windows\System\KTqewEr.exe
  C:\Windows\System\KTqewEr.exe
  2⤵
  PID:7172
- C:\Windows\System\wSsrVHe.exe
  C:\Windows\System\wSsrVHe.exe
  2⤵
  PID:7304
- C:\Windows\System\oaCACal.exe
  C:\Windows\System\oaCACal.exe
  2⤵
  PID:7352
- C:\Windows\System\kELBtGw.exe
  C:\Windows\System\kELBtGw.exe
  2⤵
  PID:7392
- C:\Windows\System\KzpOakq.exe
  C:\Windows\System\KzpOakq.exe
  2⤵
  PID:7420
- C:\Windows\System\fvkwdJT.exe
  C:\Windows\System\fvkwdJT.exe
  2⤵
  PID:7460
- C:\Windows\System\NYkYdIk.exe
  C:\Windows\System\NYkYdIk.exe
  2⤵
  PID:7504
- C:\Windows\System\UhFGsTn.exe
  C:\Windows\System\UhFGsTn.exe
  2⤵
  PID:7552
- C:\Windows\System\WGFofMM.exe
  C:\Windows\System\WGFofMM.exe
  2⤵
  PID:7596
- C:\Windows\System\PbSQcUm.exe
  C:\Windows\System\PbSQcUm.exe
  2⤵
  PID:7804
- C:\Windows\System\eywrYVc.exe
  C:\Windows\System\eywrYVc.exe
  2⤵
  PID:7848
- C:\Windows\System\uObNuHY.exe
  C:\Windows\System\uObNuHY.exe
  2⤵
  PID:7896
- C:\Windows\System\BrpgPNU.exe
  C:\Windows\System\BrpgPNU.exe
  2⤵
  PID:7956
- C:\Windows\System\riEslyK.exe
  C:\Windows\System\riEslyK.exe
  2⤵
  PID:9704
- C:\Windows\System\vYPoMBk.exe
  C:\Windows\System\vYPoMBk.exe
  2⤵
  PID:8028
- C:\Windows\System\eDaFqgw.exe
  C:\Windows\System\eDaFqgw.exe
  2⤵
  PID:8084
- C:\Windows\System\zKLcRgp.exe
  C:\Windows\System\zKLcRgp.exe
  2⤵
  PID:9836
- C:\Windows\System\QrDnFto.exe
  C:\Windows\System\QrDnFto.exe
  2⤵
  PID:9948
- C:\Windows\System\xxUfBwH.exe
  C:\Windows\System\xxUfBwH.exe
  2⤵
  PID:8260
- C:\Windows\System\FNkMpJh.exe
  C:\Windows\System\FNkMpJh.exe
  2⤵
  PID:10052
- C:\Windows\System\LKRhSaf.exe
  C:\Windows\System\LKRhSaf.exe
  2⤵
  PID:7776
- C:\Windows\System\szybROG.exe
  C:\Windows\System\szybROG.exe
  2⤵
  PID:11284
- C:\Windows\System\uTDnhfu.exe
  C:\Windows\System\uTDnhfu.exe
  2⤵
  PID:11312
- C:\Windows\System\hLVvRcE.exe
  C:\Windows\System\hLVvRcE.exe
  2⤵
  PID:11332
- C:\Windows\System\iIJESeA.exe
  C:\Windows\System\iIJESeA.exe
  2⤵
  PID:11352
- C:\Windows\System\iGsnzlM.exe
  C:\Windows\System\iGsnzlM.exe
  2⤵
  PID:11380
- C:\Windows\System\JbBuNUo.exe
  C:\Windows\System\JbBuNUo.exe
  2⤵
  PID:11396
- C:\Windows\System\pffqeDq.exe
  C:\Windows\System\pffqeDq.exe
  2⤵
  PID:11412
- C:\Windows\System\pkheUXs.exe
  C:\Windows\System\pkheUXs.exe
  2⤵
  PID:11428
- C:\Windows\System\bqufRps.exe
  C:\Windows\System\bqufRps.exe
  2⤵
  PID:11444
- C:\Windows\System\ZZBSHWv.exe
  C:\Windows\System\ZZBSHWv.exe
  2⤵
  PID:11464
- C:\Windows\System\fszPIXK.exe
  C:\Windows\System\fszPIXK.exe
  2⤵
  PID:11488
- C:\Windows\System\fikMdGg.exe
  C:\Windows\System\fikMdGg.exe
  2⤵
  PID:11512
- C:\Windows\System\DtJVHvq.exe
  C:\Windows\System\DtJVHvq.exe
  2⤵
  PID:11624
- C:\Windows\System\auuAvSU.exe
  C:\Windows\System\auuAvSU.exe
  2⤵
  PID:11648
- C:\Windows\System\xYvVMVK.exe
  C:\Windows\System\xYvVMVK.exe
  2⤵
  PID:11672
- C:\Windows\System\RvtgIXL.exe
  C:\Windows\System\RvtgIXL.exe
  2⤵
  PID:11696
- C:\Windows\System\JBOZWQn.exe
  C:\Windows\System\JBOZWQn.exe
  2⤵
  PID:11712
- C:\Windows\System\VlWmMMZ.exe
  C:\Windows\System\VlWmMMZ.exe
  2⤵
  PID:11736
- C:\Windows\System\yEgRyZr.exe
  C:\Windows\System\yEgRyZr.exe
  2⤵
  PID:11764
- C:\Windows\System\xCfpxIk.exe
  C:\Windows\System\xCfpxIk.exe
  2⤵
  PID:11780
- C:\Windows\System\ZTlsakr.exe
  C:\Windows\System\ZTlsakr.exe
  2⤵
  PID:11804
- C:\Windows\System\DFyMDrg.exe
  C:\Windows\System\DFyMDrg.exe
  2⤵
  PID:11872
- C:\Windows\System\CXJqaRr.exe
  C:\Windows\System\CXJqaRr.exe
  2⤵
  PID:11888
- C:\Windows\System\fsEVhRn.exe
  C:\Windows\System\fsEVhRn.exe
  2⤵
  PID:11908
- C:\Windows\System\dIDSqZQ.exe
  C:\Windows\System\dIDSqZQ.exe
  2⤵
  PID:11928
- C:\Windows\System\dBMtwZb.exe
  C:\Windows\System\dBMtwZb.exe
  2⤵
  PID:11944
- C:\Windows\System\sMjdsEc.exe
  C:\Windows\System\sMjdsEc.exe
  2⤵
  PID:11964
- C:\Windows\System\engLssE.exe
  C:\Windows\System\engLssE.exe
  2⤵
  PID:11980
- C:\Windows\System\LqYoioT.exe
  C:\Windows\System\LqYoioT.exe
  2⤵
  PID:12004
- C:\Windows\System\uBTwFkb.exe
  C:\Windows\System\uBTwFkb.exe
  2⤵
  PID:12024
- C:\Windows\System\ivMpbGS.exe
  C:\Windows\System\ivMpbGS.exe
  2⤵
  PID:12048
- C:\Windows\System\MRxcSkr.exe
  C:\Windows\System\MRxcSkr.exe
  2⤵
  PID:12072
- C:\Windows\System\lVAVaEA.exe
  C:\Windows\System\lVAVaEA.exe
  2⤵
  PID:12092
- C:\Windows\System\vHAyiFd.exe
  C:\Windows\System\vHAyiFd.exe
  2⤵
  PID:12116
- C:\Windows\System\UIBBdUH.exe
  C:\Windows\System\UIBBdUH.exe
  2⤵
  PID:12140
- C:\Windows\System\jyzGWTn.exe
  C:\Windows\System\jyzGWTn.exe
  2⤵
  PID:12160
- C:\Windows\System\yYeEIyo.exe
  C:\Windows\System\yYeEIyo.exe
  2⤵
  PID:12184
- C:\Windows\System\cnQOKkZ.exe
  C:\Windows\System\cnQOKkZ.exe
  2⤵
  PID:12204
- C:\Windows\System\XrQQTTv.exe
  C:\Windows\System\XrQQTTv.exe
  2⤵
  PID:12228
- C:\Windows\System\wdcEKqZ.exe
  C:\Windows\System\wdcEKqZ.exe
  2⤵
  PID:12248
- C:\Windows\System\JDziYmZ.exe
  C:\Windows\System\JDziYmZ.exe
  2⤵
  PID:12272
- C:\Windows\System\rcGQWwI.exe
  C:\Windows\System\rcGQWwI.exe
  2⤵
  PID:8328
- C:\Windows\System\jdpAMLa.exe
  C:\Windows\System\jdpAMLa.exe
  2⤵
  PID:10248
- C:\Windows\System\JPmWXRq.exe
  C:\Windows\System\JPmWXRq.exe
  2⤵
  PID:10344
- C:\Windows\System\QuFbSMz.exe
  C:\Windows\System\QuFbSMz.exe
  2⤵
  PID:10444
- C:\Windows\System\BqaZpJT.exe
  C:\Windows\System\BqaZpJT.exe
  2⤵
  PID:3328
- C:\Windows\System\yWNwrNX.exe
  C:\Windows\System\yWNwrNX.exe
  2⤵
  PID:8624
- C:\Windows\System\IbfBDxY.exe
  C:\Windows\System\IbfBDxY.exe
  2⤵
  PID:8692
- C:\Windows\System\dDfDnxy.exe
  C:\Windows\System\dDfDnxy.exe
  2⤵
  PID:8744
- C:\Windows\System\PrxSpEE.exe
  C:\Windows\System\PrxSpEE.exe
  2⤵
  PID:8792
- C:\Windows\System\lQHHlEk.exe
  C:\Windows\System\lQHHlEk.exe
  2⤵
  PID:8832
- C:\Windows\System\qWeQIIq.exe
  C:\Windows\System\qWeQIIq.exe
  2⤵
  PID:8888
- C:\Windows\System\OSOpMNT.exe
  C:\Windows\System\OSOpMNT.exe
  2⤵
  PID:8944
- C:\Windows\System\GGiHBMM.exe
  C:\Windows\System\GGiHBMM.exe
  2⤵
  PID:9292
- C:\Windows\System\yuazWzD.exe
  C:\Windows\System\yuazWzD.exe
  2⤵
  PID:5180
- C:\Windows\System\bGYegdG.exe
  C:\Windows\System\bGYegdG.exe
  2⤵
  PID:9164
- C:\Windows\System\sooACgU.exe
  C:\Windows\System\sooACgU.exe
  2⤵
  PID:9036
- C:\Windows\System\NUMINYT.exe
  C:\Windows\System\NUMINYT.exe
  2⤵
  PID:8312
- C:\Windows\System\HbdtAdU.exe
  C:\Windows\System\HbdtAdU.exe
  2⤵
  PID:8636
- C:\Windows\System\bKwhCEc.exe
  C:\Windows\System\bKwhCEc.exe
  2⤵
  PID:8708
- C:\Windows\System\IRjvifQ.exe
  C:\Windows\System\IRjvifQ.exe
  2⤵
  PID:8788
- C:\Windows\System\tkfpfBc.exe
  C:\Windows\System\tkfpfBc.exe
  2⤵
  PID:8864
- C:\Windows\System\wlxQARM.exe
  C:\Windows\System\wlxQARM.exe
  2⤵
  PID:8936
- C:\Windows\System\ebzcUTZ.exe
  C:\Windows\System\ebzcUTZ.exe
  2⤵
  PID:9016
- C:\Windows\System\rpGncDL.exe
  C:\Windows\System\rpGncDL.exe
  2⤵
  PID:9108
- C:\Windows\System\xOUPPpL.exe
  C:\Windows\System\xOUPPpL.exe
  2⤵
  PID:9208
- C:\Windows\System\vcocdtK.exe
  C:\Windows\System\vcocdtK.exe
  2⤵
  PID:9224
- C:\Windows\System\whMnCtE.exe
  C:\Windows\System\whMnCtE.exe
  2⤵
  PID:9340
- C:\Windows\System\XKNjaBk.exe
  C:\Windows\System\XKNjaBk.exe
  2⤵
  PID:9460
- C:\Windows\System\LlsaJsn.exe
  C:\Windows\System\LlsaJsn.exe
  2⤵
  PID:9540
- C:\Windows\System\LbjuYBq.exe
  C:\Windows\System\LbjuYBq.exe
  2⤵
  PID:9468
- C:\Windows\System\amxkcIs.exe
  C:\Windows\System\amxkcIs.exe
  2⤵
  PID:9428
- C:\Windows\System\ERuHHyD.exe
  C:\Windows\System\ERuHHyD.exe
  2⤵
  PID:9364
- C:\Windows\System\ooSftHx.exe
  C:\Windows\System\ooSftHx.exe
  2⤵
  PID:8212
- C:\Windows\System\ezfdRGh.exe
  C:\Windows\System\ezfdRGh.exe
  2⤵
  PID:8116
- C:\Windows\System\ewIxSNH.exe
  C:\Windows\System\ewIxSNH.exe
  2⤵
  PID:10580
- C:\Windows\System\MDiHWDT.exe
  C:\Windows\System\MDiHWDT.exe
  2⤵
  PID:10672
- C:\Windows\System\zPyiHwu.exe
  C:\Windows\System\zPyiHwu.exe
  2⤵
  PID:10760
- C:\Windows\System\fFqLOgr.exe
  C:\Windows\System\fFqLOgr.exe
  2⤵
  PID:8152
- C:\Windows\System\bItYauA.exe
  C:\Windows\System\bItYauA.exe
  2⤵
  PID:11160
- C:\Windows\System\IYaHHPX.exe
  C:\Windows\System\IYaHHPX.exe
  2⤵
  PID:10632
- C:\Windows\System\LZCWaCJ.exe
  C:\Windows\System\LZCWaCJ.exe
  2⤵
  PID:10824
- C:\Windows\System\RpqMCWJ.exe
  C:\Windows\System\RpqMCWJ.exe
  2⤵
  PID:5796
- C:\Windows\System\clebgVX.exe
  C:\Windows\System\clebgVX.exe
  2⤵
  PID:8980
- C:\Windows\System\FfjXCBq.exe
  C:\Windows\System\FfjXCBq.exe
  2⤵
  PID:12696
- C:\Windows\System\PIqTzuI.exe
  C:\Windows\System\PIqTzuI.exe
  2⤵
  PID:10720
- C:\Windows\System\ihPHdJd.exe
  C:\Windows\System\ihPHdJd.exe
  2⤵
  PID:12268
- C:\Windows\System\DpYYiHJ.exe
  C:\Windows\System\DpYYiHJ.exe
  2⤵
  PID:10928
- C:\Windows\System\SfBmJJO.exe
  C:\Windows\System\SfBmJJO.exe
  2⤵
  PID:11052
- C:\Windows\System\kRCNSCm.exe
  C:\Windows\System\kRCNSCm.exe
  2⤵
  PID:6236
- C:\Windows\System\aZdkyiK.exe
  C:\Windows\System\aZdkyiK.exe
  2⤵
  PID:4876
- C:\Windows\System\HSBVgxf.exe
  C:\Windows\System\HSBVgxf.exe
  2⤵
  PID:8104
- C:\Windows\System\YdxFoND.exe
  C:\Windows\System\YdxFoND.exe
  2⤵
  PID:5232
- C:\Windows\System\OIMDHyD.exe
  C:\Windows\System\OIMDHyD.exe
  2⤵
  PID:7880
- C:\Windows\System\PHsoLCl.exe
  C:\Windows\System\PHsoLCl.exe
  2⤵
  PID:11640
- C:\Windows\System\phSBkNB.exe
  C:\Windows\System\phSBkNB.exe
  2⤵
  PID:8776
- C:\Windows\System\xBimzHE.exe
  C:\Windows\System\xBimzHE.exe
  2⤵
  PID:12088
- C:\Windows\System\LMiwyax.exe
  C:\Windows\System\LMiwyax.exe
  2⤵
  PID:8748
- C:\Windows\System\aiboEmR.exe
  C:\Windows\System\aiboEmR.exe
  2⤵
  PID:11544
- C:\Windows\System\TkxoFMs.exe
  C:\Windows\System\TkxoFMs.exe
  2⤵
  PID:12976
- C:\Windows\System\hwMvGkS.exe
  C:\Windows\System\hwMvGkS.exe
  2⤵
  PID:7592
- C:\Windows\System\SFIfGBJ.exe
  C:\Windows\System\SFIfGBJ.exe
  2⤵
  PID:9740
- C:\Windows\System\ziIOZFw.exe
  C:\Windows\System\ziIOZFw.exe
  2⤵
  PID:12940
- C:\Windows\System\exyZkQY.exe
  C:\Windows\System\exyZkQY.exe
  2⤵
  PID:1140
- C:\Windows\System\bEBbLTb.exe
  C:\Windows\System\bEBbLTb.exe
  2⤵
  PID:11852
- C:\Windows\System\CvpWrsj.exe
  C:\Windows\System\CvpWrsj.exe
  2⤵
  PID:4620
- C:\Windows\System\EkXDDIu.exe
  C:\Windows\System\EkXDDIu.exe
  2⤵
  PID:2728
- C:\Windows\System\fvfcltM.exe
  C:\Windows\System\fvfcltM.exe
  2⤵
  PID:13260
- C:\Windows\System\IBqnerD.exe
  C:\Windows\System\IBqnerD.exe
  2⤵
  PID:3040
- C:\Windows\System\Wdsabyo.exe
  C:\Windows\System\Wdsabyo.exe
  2⤵
  PID:9576
- C:\Windows\System\YUVHooX.exe
  C:\Windows\System\YUVHooX.exe
  2⤵
  PID:11424
- C:\Windows\System\cyJxpVx.exe
  C:\Windows\System\cyJxpVx.exe
  2⤵
  PID:1704
- C:\Windows\System\ldzchUX.exe
  C:\Windows\System\ldzchUX.exe
  2⤵
  PID:10212
- C:\Windows\System\BYrjCgr.exe
  C:\Windows\System\BYrjCgr.exe
  2⤵
  PID:4900
- C:\Windows\System\MXGmiKT.exe
  C:\Windows\System\MXGmiKT.exe
  2⤵
  PID:6664
- C:\Windows\System\RbMatSU.exe
  C:\Windows\System\RbMatSU.exe
  2⤵
  PID:8140
- C:\Windows\System\yTBoYPL.exe
  C:\Windows\System\yTBoYPL.exe
  2⤵
  PID:9880
- C:\Windows\System\CrHzPBc.exe
  C:\Windows\System\CrHzPBc.exe
  2⤵
  PID:2708
- C:\Windows\System\AjsKBZj.exe
  C:\Windows\System\AjsKBZj.exe
  2⤵
  PID:7524
- C:\Windows\System\zSetIOz.exe
  C:\Windows\System\zSetIOz.exe
  2⤵
  PID:10680
- C:\Windows\System\szCUmjA.exe
  C:\Windows\System\szCUmjA.exe
  2⤵
  PID:3928
- C:\Windows\System\doRqOUc.exe
  C:\Windows\System\doRqOUc.exe
  2⤵
  PID:10116
- C:\Windows\System\KPpcTij.exe
  C:\Windows\System\KPpcTij.exe
  2⤵
  PID:12328
- C:\Windows\System\bftrENf.exe
  C:\Windows\System\bftrENf.exe
  2⤵
  PID:11656
- C:\Windows\System\WnlJxDg.exe
  C:\Windows\System\WnlJxDg.exe
  2⤵
  PID:12720
- C:\Windows\System\MkqsDzE.exe
  C:\Windows\System\MkqsDzE.exe
  2⤵
  PID:11620
- C:\Windows\System\xMorPvz.exe
  C:\Windows\System\xMorPvz.exe
  2⤵
  PID:11452
- C:\Windows\System\rhoTWkp.exe
  C:\Windows\System\rhoTWkp.exe
  2⤵
  PID:12040
- C:\Windows\System\bdVIllC.exe
  C:\Windows\System\bdVIllC.exe
  2⤵
  PID:11692
- C:\Windows\System\BMuHwbq.exe
  C:\Windows\System\BMuHwbq.exe
  2⤵
  PID:3640
- C:\Windows\System\dUuViSL.exe
  C:\Windows\System\dUuViSL.exe
  2⤵
  PID:13268
- C:\Windows\System\YyDcKAv.exe
  C:\Windows\System\YyDcKAv.exe
  2⤵
  PID:13224
- C:\Windows\System\PXuPavR.exe
  C:\Windows\System\PXuPavR.exe
  2⤵
  PID:9912
- C:\Windows\System\YcORyND.exe
  C:\Windows\System\YcORyND.exe
  2⤵
  PID:7548
- C:\Windows\System\ulWKWel.exe
  C:\Windows\System\ulWKWel.exe
  2⤵
  PID:12740
- C:\Windows\System\OyIsilV.exe
  C:\Windows\System\OyIsilV.exe
  2⤵
  PID:8620
- C:\Windows\System\fplIddA.exe
  C:\Windows\System\fplIddA.exe
  2⤵
  PID:3036
- C:\Windows\System\uPmlsjD.exe
  C:\Windows\System\uPmlsjD.exe
  2⤵
  PID:3884
- C:\Windows\System\lAJWbAL.exe
  C:\Windows\System\lAJWbAL.exe
  2⤵
  PID:2768
- C:\Windows\System\FWCwAjV.exe
  C:\Windows\System\FWCwAjV.exe
  2⤵
  PID:10744
- C:\Windows\System\JBrCTOE.exe
  C:\Windows\System\JBrCTOE.exe
  2⤵
  PID:12848
- C:\Windows\System\bOhePZI.exe
  C:\Windows\System\bOhePZI.exe
  2⤵
  PID:11828
- C:\Windows\System\swlCHTO.exe
  C:\Windows\System\swlCHTO.exe
  2⤵
  PID:10748
- C:\Windows\System\zNaRPqG.exe
  C:\Windows\System\zNaRPqG.exe
  2⤵
  PID:8372
- C:\Windows\System\CnsDLjE.exe
  C:\Windows\System\CnsDLjE.exe
  2⤵
  PID:8844
- C:\Windows\System\yMohRZW.exe
  C:\Windows\System\yMohRZW.exe
  2⤵
  PID:10140
- C:\Windows\System\Hvlswno.exe
  C:\Windows\System\Hvlswno.exe
  2⤵
  PID:8048
- C:\Windows\System\snSCsXu.exe
  C:\Windows\System\snSCsXu.exe
  2⤵
  PID:12756
- C:\Windows\System\iHIglCj.exe
  C:\Windows\System\iHIglCj.exe
  2⤵
  PID:13040
- C:\Windows\System\hVjQZCb.exe
  C:\Windows\System\hVjQZCb.exe
  2⤵
  PID:12660
- C:\Windows\System\lKfBatp.exe
  C:\Windows\System\lKfBatp.exe
  2⤵
  PID:7412
- C:\Windows\System\RYuRvNE.exe
  C:\Windows\System\RYuRvNE.exe
  2⤵
  PID:2228
- C:\Windows\System\aavdaeW.exe
  C:\Windows\System\aavdaeW.exe
  2⤵
  PID:12296
- C:\Windows\System\kyqucZz.exe
  C:\Windows\System\kyqucZz.exe
  2⤵
  PID:8252
- C:\Windows\System\OkZOVoZ.exe
  C:\Windows\System\OkZOVoZ.exe
  2⤵
  PID:12808
- C:\Windows\System\gKulBtQ.exe
  C:\Windows\System\gKulBtQ.exe
  2⤵
  PID:8040
- C:\Windows\System\dVUJlEb.exe
  C:\Windows\System\dVUJlEb.exe
  2⤵
  PID:2164
- C:\Windows\System\RazsjSn.exe
  C:\Windows\System\RazsjSn.exe
  2⤵
  PID:9644
- C:\Windows\System\fHKjwcs.exe
  C:\Windows\System\fHKjwcs.exe
  2⤵
  PID:11276
- C:\Windows\System\MBVwfSK.exe
  C:\Windows\System\MBVwfSK.exe
  2⤵
  PID:12924
- C:\Windows\System\AMtQwnp.exe
  C:\Windows\System\AMtQwnp.exe
  2⤵
  PID:5640
- C:\Windows\System\RqXiAXt.exe
  C:\Windows\System\RqXiAXt.exe
  2⤵
  PID:4864
- C:\Windows\System\wgdkYTV.exe
  C:\Windows\System\wgdkYTV.exe
  2⤵
  PID:4884
- C:\Windows\System\cYqejuf.exe
  C:\Windows\System\cYqejuf.exe
  2⤵
  PID:6476
- C:\Windows\System\vFENRBM.exe
  C:\Windows\System\vFENRBM.exe
  2⤵
  PID:12348
- C:\Windows\System\WEqZutf.exe
  C:\Windows\System\WEqZutf.exe
  2⤵
  PID:2816
- C:\Windows\System\WOcAAMC.exe
  C:\Windows\System\WOcAAMC.exe
  2⤵
  PID:4340
- C:\Windows\System\aAybqai.exe
  C:\Windows\System\aAybqai.exe
  2⤵
  PID:5272
- C:\Windows\System\iFPiaQX.exe
  C:\Windows\System\iFPiaQX.exe
  2⤵
  PID:9240
- C:\Windows\System\UyaPYzS.exe
  C:\Windows\System\UyaPYzS.exe
  2⤵
  PID:5276
- C:\Windows\System\HPzqNMA.exe
  C:\Windows\System\HPzqNMA.exe
  2⤵
  PID:12672
- C:\Windows\System\XfALajQ.exe
  C:\Windows\System\XfALajQ.exe
  2⤵
  PID:7748
- C:\Windows\System\RJQsXam.exe
  C:\Windows\System\RJQsXam.exe
  2⤵
  PID:5528
- C:\Windows\System\glCHHNg.exe
  C:\Windows\System\glCHHNg.exe
  2⤵
  PID:5220
- C:\Windows\System\wqKQYeB.exe
  C:\Windows\System\wqKQYeB.exe
  2⤵
  PID:5224
- C:\Windows\System\sOCkdVa.exe
  C:\Windows\System\sOCkdVa.exe
  2⤵
  PID:1188
- C:\Windows\System\IPTNVKs.exe
  C:\Windows\System\IPTNVKs.exe
  2⤵
  PID:1228
- C:\Windows\System\IlfJEfw.exe
  C:\Windows\System\IlfJEfw.exe
  2⤵
  PID:2380
- C:\Windows\System\PVJlCHA.exe
  C:\Windows\System\PVJlCHA.exe
  2⤵
  PID:1720
- C:\Windows\System\tFemSsf.exe
  C:\Windows\System\tFemSsf.exe
  2⤵
  PID:4072
- C:\Windows\System\SyQcKjR.exe
  C:\Windows\System\SyQcKjR.exe
  2⤵
  PID:13484
- C:\Windows\System\VLuctJz.exe
  C:\Windows\System\VLuctJz.exe
  2⤵
  PID:13620
- C:\Windows\System\mnIeudw.exe
  C:\Windows\System\mnIeudw.exe
  2⤵
  PID:13636
- C:\Windows\System\kiqOgVY.exe
  C:\Windows\System\kiqOgVY.exe
  2⤵
  PID:13652
- C:\Windows\System\tNYNIze.exe
  C:\Windows\System\tNYNIze.exe
  2⤵
  PID:13672
- C:\Windows\System\cLgTyjg.exe
  C:\Windows\System\cLgTyjg.exe
  2⤵
  PID:13692
- C:\Windows\System\WDYIjjZ.exe
  C:\Windows\System\WDYIjjZ.exe
  2⤵
  PID:13708
- C:\Windows\System\MbjbCJU.exe
  C:\Windows\System\MbjbCJU.exe
  2⤵
  PID:13724
- C:\Windows\System\cmsLsTd.exe
  C:\Windows\System\cmsLsTd.exe
  2⤵
  PID:13740
- C:\Windows\System\oOgqiWa.exe
  C:\Windows\System\oOgqiWa.exe
  2⤵
  PID:13768
- C:\Windows\System\sPqPFdt.exe
  C:\Windows\System\sPqPFdt.exe
  2⤵
  PID:13788
- C:\Windows\System\CDpFutS.exe
  C:\Windows\System\CDpFutS.exe
  2⤵
  PID:13808
- C:\Windows\System\RtohDwf.exe
  C:\Windows\System\RtohDwf.exe
  2⤵
  PID:13828
- C:\Windows\System\VReMHST.exe
  C:\Windows\System\VReMHST.exe
  2⤵
  PID:13848
- C:\Windows\System\VWubPsw.exe
  C:\Windows\System\VWubPsw.exe
  2⤵
  PID:13872
- C:\Windows\System\yZPOWcn.exe
  C:\Windows\System\yZPOWcn.exe
  2⤵
  PID:13888
- C:\Windows\System\fqwygVV.exe
  C:\Windows\System\fqwygVV.exe
  2⤵
  PID:13904
- C:\Windows\System\XKqZBQJ.exe
  C:\Windows\System\XKqZBQJ.exe
  2⤵
  PID:13924
- C:\Windows\System\iaPRfbs.exe
  C:\Windows\System\iaPRfbs.exe
  2⤵
  PID:13944
- C:\Windows\System\hzyljnf.exe
  C:\Windows\System\hzyljnf.exe
  2⤵
  PID:13964
- C:\Windows\System\nqUfvwX.exe
  C:\Windows\System\nqUfvwX.exe
  2⤵
  PID:13980
- C:\Windows\System\ixLRjDr.exe
  C:\Windows\System\ixLRjDr.exe
  2⤵
  PID:14004
- C:\Windows\System\FwtsDtc.exe
  C:\Windows\System\FwtsDtc.exe
  2⤵
  PID:14072
- C:\Windows\System\kTfXUUW.exe
  C:\Windows\System\kTfXUUW.exe
  2⤵
  PID:14088
- C:\Windows\System\CvdiIGc.exe
  C:\Windows\System\CvdiIGc.exe
  2⤵
  PID:14104
- C:\Windows\System\YhPCLRm.exe
  C:\Windows\System\YhPCLRm.exe
  2⤵
  PID:14120
- C:\Windows\System\BmgdeYP.exe
  C:\Windows\System\BmgdeYP.exe
  2⤵
  PID:14280
- C:\Windows\System\ObZLdIy.exe
  C:\Windows\System\ObZLdIy.exe
  2⤵
  PID:14320
- C:\Windows\System\DyAuBCL.exe
  C:\Windows\System\DyAuBCL.exe
  2⤵
  PID:13584
- C:\Windows\System\pAgIGAY.exe
  C:\Windows\System\pAgIGAY.exe
  2⤵
  PID:13764
- C:\Windows\System\KfqTeWq.exe
  C:\Windows\System\KfqTeWq.exe
  2⤵
  PID:13840
- C:\Windows\System\VwcSNjG.exe
  C:\Windows\System\VwcSNjG.exe
  2⤵
  PID:13776
- C:\Windows\System\gDNzHir.exe
  C:\Windows\System\gDNzHir.exe
  2⤵
  PID:13816
- C:\Windows\System\DNLxDWg.exe
  C:\Windows\System\DNLxDWg.exe
  2⤵
  PID:14048
- C:\Windows\System\RiPcfsh.exe
  C:\Windows\System\RiPcfsh.exe
  2⤵
  PID:14240
- C:\Windows\System\RNwJWfU.exe
  C:\Windows\System\RNwJWfU.exe
  2⤵
  PID:14264
- C:\Windows\System\IBKXGpx.exe
  C:\Windows\System\IBKXGpx.exe
  2⤵
  PID:13572
- C:\Windows\System\njaWJwQ.exe
  C:\Windows\System\njaWJwQ.exe
  2⤵
  PID:13336
- C:\Windows\System\CvBrdIr.exe
  C:\Windows\System\CvBrdIr.exe
  2⤵
  PID:13600
- C:\Windows\System\zrCxHnG.exe
  C:\Windows\System\zrCxHnG.exe
  2⤵
  PID:13568

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rmgn2vuu.xib.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ARTmOsa.exe

Filesize
1.6MB

MD5
728638c5e39168afb2baeb1fc6fa0041

SHA1
a1821e374b3a74d6c4f192cedcdafd557e4355d9

SHA256
6495d035ff2a2eee265ceece8227ae82a142c0e6bf0039dfd62476affc20849b

SHA512
3c140a9a25cf20b9d38bcb7c677c192c027595a3fcd27f4fa2871a645671d0a21d67ce11bc500b04f760ecd681645acd370c186b773aedf5a023dcb04bdb8376

Download Submit
C:\Windows\System\BQpiydM.exe

Filesize
1.6MB

MD5
e92f62387d337c7e12eab2e6882bf123

SHA1
c6ec6f421eb901ac679d47662d10b00bbf2528d0

SHA256
f0f59930a30063db7eb9872d2d4162b7bed8e7d4332e956a20a5b1941516a6b5

SHA512
d01177fb41ae97a1b733877fa6d72fa7cc479cc8b8ed3879afb7451427f09296109f3a73b233e9e1520bf7e477f03c1fddeae082918ce3031dd1c3c7c0360bbb

Download Submit
C:\Windows\System\BsgSGPP.exe

Filesize
1.6MB

MD5
0004f2701f74ab4d0b65361216d447fd

SHA1
96e0108fa2d1a350e6a49f2b636e928a8e6b0fa9

SHA256
12d33db1d32b92f288be0a1fb979a0de6a6749f099734825c01f329e119b585f

SHA512
46adcc303c3d8d5571e0d0f1a612745f6f1c0246b594fa05887235621ce0e800bf39f3fbb3ca85227fa19d38ea5c37691a3e01a3cbf55196d35bb97ec38b0415

Download Submit
C:\Windows\System\FRCbTPB.exe

Filesize
1.6MB

MD5
fb18f8205e73e29e3ff86f6cfea20b0e

SHA1
6456e83f65a83380dcd6267567f7d8d6d60c4e33

SHA256
a2fcd04293a0139df89283eb1b4f4f5b6647626ba85378660244557ef41636ef

SHA512
1ff23eb090555b040d814f97073b972696926d8df00202bb6c06f4503688a96189751beaf3aaa45c9c1aee1b730d3f962b4c9a0fb26ef3c68c6bc722e5d9749d

Download Submit
C:\Windows\System\FVpAVJK.exe

Filesize
1.6MB

MD5
cc1815ee7484186fbb2d9ebdcac60769

SHA1
23f139f360dc1c95062d81ea4949a509f58a2e08

SHA256
cc651810391c0e8a33986498e5d4ce7e2eabc64fd03484ef0f3956deaa172f0c

SHA512
e1c002af1b6e9c5f648cea100f00d9dc94ee1fc30136b4943ec90ecd09b8eee86e7b6c37e001b9f4643d893abf2b87b5271a9ded93065bbb0e18b885884c5f58

Download Submit
C:\Windows\System\LLeZdAj.exe

Filesize
1.6MB

MD5
c4bdf77ba4b8ba9a1fd9d856e2725c85

SHA1
a2222cfeb975d3680313bc5015fc7b75417a4676

SHA256
4a7d8eab0a7dd95d3a9598924b08beeed197b7a025a356f2acb8f3c4ec6527ab

SHA512
c691f5f1dcdb2e7ab43702b31345183853730caccd87cc7a697e5dfbf07b6d9e0ec56fede07dd2528d64f566985c4c2910f132dc97b7eee39d6c0d382eec4325

Download Submit
C:\Windows\System\LNegllN.exe

Filesize
1.6MB

MD5
1b44ff49b52af181ef624524ce406eb2

SHA1
e09ef18e9d655268afbbb2b03f69c13e6bc11837

SHA256
0d52fb1ee2cfd966f531af1b9db1a18de1e424c4fe7e29b94230000d697d7c1f

SHA512
2c7e58a5fc055c5ebd94c856b1bad7b2250d89db012f6fe766492520548119ea4f8d88241f67a18ddbbca46a2cb59737cc76804a646ae44a4c3166c0c816d369

Download Submit
C:\Windows\System\LzlrcrH.exe

Filesize
1.6MB

MD5
782406bd95e74a87ee24195c8b2e488f

SHA1
71cec8aed682522b1f0ea2df636a047019d4f3dd

SHA256
11430e54be538b448cbe9a3f004148714b0be2468dd03cb7bc3e8e66cab08e22

SHA512
f6cb802133e0837bf96ea3a585b5869d441a67e41d5efa9bedc5b681b30088d2c99c52e7f8ff233f4062e53ee3e9dc627219b85c396541a66de36c7778862c39

Download Submit
C:\Windows\System\NZbCsky.exe

Filesize
1.6MB

MD5
8b13838fcb5c625ee39f174b2db71d98

SHA1
230d7c191093f824f32f9ecc5bba8f3d51859119

SHA256
b781a16fb78420042aa1740392af11b3cb23de76cadfd6ef2e25eb68e48f1f82

SHA512
b40060b9e531f3bb446e4f88723501940c8e92a25957841692ed0284d55f1723b5ea89bcc66809961ead7c4b95fb892b00939bcd33182ec0136ab0292249206d

Download Submit
C:\Windows\System\OkiVVEB.exe

Filesize
1.6MB

MD5
14d6865f6060dd3b3a1c86db73f3941e

SHA1
6eb3e75a42a8292d808ad1a634e9061da14f27cc

SHA256
02553c98073b59d3ebf04c09ee18acb34ee670bb70e81b458e85c31627de5182

SHA512
518a5ebbc63d224c07f34f547be8a99fe3ceb780d340725c7e493587b4410b0eba6cb8287af6783fe3aced892655489d7e310e8199e7afd17b8853a84a00025a

Download Submit
C:\Windows\System\PrprEaV.exe

Filesize
1.6MB

MD5
707c9a708e331dd0527a0803de08e62a

SHA1
9c78bc7d777e6564f9339dd593c2a2d0280eaf65

SHA256
5646e5c1660e47b60892526ebe6c48f3f2bc90af5568006366923a2e70da165d

SHA512
f214dd1fde453ed18043a4e4f60734b5a24c501ddcfa44f20cf06162a169d7bef31decfcab21b8466450fe00c1460af76e9feaf5dc09edd0ea8c8a8ffe9364f8

Download Submit
C:\Windows\System\SDTxstG.exe

Filesize
1.6MB

MD5
b217aa711c40c5f115a5ce4661b443d9

SHA1
fbc4ba7b3f4c176108518e8a695ffc7d2378b8db

SHA256
d20500958f8ca7fc336593b89e51b100ff40ecc3ac8c94659f7e7e92dcf03594

SHA512
8bf12d31c286c959b815b70585318c94af4554e04412e30caf42a956551ca67e9f9e60703386c001532474ba3c409e30d254d3621d8424fc50a0dfdc81d10cda

Download Submit
C:\Windows\System\SfvEvcv.exe

Filesize
1.6MB

MD5
ff5a94900128bdd3c24a8d4547d9460f

SHA1
c5604e1356eaee6e3edf7fb4a0eebd1d92307ecd

SHA256
ce4ffcee7ad9760290065d2752974593f893a190fa842494fad98dc9135ada8d

SHA512
92540707ccf84c471c83746632550dfa9cbe3f3aa7ed6fc496b6d0b10c43b48cdaed517beafe9709b56e83eedd24b51010f4f08e60179ed24a265f84e6878c16

Download Submit
C:\Windows\System\Ssjjwmo.exe

Filesize
1.6MB

MD5
ff859a66b06990e365045c7af1a7e9e0

SHA1
5c36bbf4a0d4096e67f2080b8aa239df206071f3

SHA256
797401a15b93e2ce0bcf415245ead8ec7db12740528a1c8d2d75b8ed1bda2dbf

SHA512
0e64de4a0ee28f56a209db1fac3c3fcd445562d5650e60a2b1a11561a17d00b081b49c7c4526f6f518b14b62b8a4610545272bf68467b894402040e26b483316

Download Submit
C:\Windows\System\TjvOBoI.exe

Filesize
1.6MB

MD5
dbbdf16701ee9c75577ec3174f9b22d8

SHA1
8058857486a499a34440d25769bb95b3fd06762c

SHA256
232f866d862a17e15515c73a0e6cb8fb6cb68bc7af059553e25e1afec7bf48fe

SHA512
0e40d974fb97a9d577050ec57032fec7774a62cba0c75dcab58927cbabf1408ccfd3524bd1d099df262697f1b83cf970df469e3f64cbc4b7dccd29466d328525

Download Submit
C:\Windows\System\TjxULHp.exe

Filesize
1.6MB

MD5
b3101b2c0a2cb8a8102aa062b6061193

SHA1
c671e6ddb2726699928b9e9efd9e14706a9f036d

SHA256
ff72dd2360aff086c535574a49f107b2ffefb222bd8eb315945928d4a15b8921

SHA512
2fb075bcb2297f064353a2ebf7f4d218fee72b8e8728a6dc480be1bc5cb43ed4c9b728039818f60ef47bf3e7bdd0452bb03969ffa7c212cca86b17144cb08fb7

Download Submit
C:\Windows\System\WgIIdQA.exe

Filesize
1.6MB

MD5
ccdea22733cc0f086ed0cf77d585d2be

SHA1
cf75329b090fa50a0b2f7993972169409485734a

SHA256
021efe62b0a13f936b7657a2b6326992bcafeae5d8a36f858fdaf754c4ff1b07

SHA512
40dc3986d5c531f252201666f2ab54b2a4d63921cac246162cae2685dc15108c3cd401ffb8f7922d2d38fe323149c940e3314a118eaae8ffbf4fa28ddbfce41f

Download Submit
C:\Windows\System\WnHJPKo.exe

Filesize
1.6MB

MD5
d686b830447e39de08a2c23536205cf0

SHA1
5b20b040430b54ed63f19087683752c46f660073

SHA256
9b992b84fe08aba737674f43dbc0950d717021b2b1671bcbd449e002a8c6ae9a

SHA512
f079ad2c49f78892e72e2d3bdd6133d145baee7cf3c46308221344b146b3af39fe2cf58b12bc76de3c998bb63457f6b82940dedd890585d60c5f32e7fba99568

Download Submit
C:\Windows\System\ZwXosvu.exe

Filesize
1.6MB

MD5
6a985cb2ac2ffa2e5bc88b6baf5fe4c0

SHA1
1896e7be395690f06ca4103faa47cdf552877e1e

SHA256
f4cdaf43f92d5216e4af184c8417925fcedc75023adc0da59b3a6974f56e0283

SHA512
6b0f959f2547e83e5c1616ff9395845b1bccd6cc0494114a544088a3ce0fa02cebbbb50e5e837ec7b433959e8de07a8df92ad4d321da28320b3240ae3c90cdbc

Download Submit
C:\Windows\System\ceOHWRb.exe

Filesize
1.6MB

MD5
b50778d5ee596b33f8f05f2225d6526c

SHA1
3f44c9979c35549e6aad31977c1236bd385667a7

SHA256
1e4b417f3f21ed2582e2b299bccecacf06f2e9ff041b8ced55ffc93f64636f07

SHA512
705de6d9a6ef3cba4f4091c4882d3f3d3aff8c6f6739fdd24b7f4f1552b2f322386f19b2d11f88868283d69891b1410559433f91bfd003ff57b4d94841f0a05b

Download Submit
C:\Windows\System\dBrhtQi.exe

Filesize
1.6MB

MD5
df026ed9e187f9a1b67313cc40e161df

SHA1
476517a5247ceb395968b301c5c2aaa4ca7120e5

SHA256
9909db45efccc58f31184bce77b30d8f6e8d0f8ee4e0f1e2a4a21b65cbe8201e

SHA512
5c18a228d321e81f14ab7c84ec200ec4c55c45898314a766d4e8829add88b60928d781dd42da0f22d43a7e88db5e13c3014fa5340649bf740b51acecba2302ca

Download Submit
C:\Windows\System\ecFFOGt.exe

Filesize
1.6MB

MD5
802c85694d3c5a75d5e024dfc6ea0bb6

SHA1
d669c9ff791c3d97efc9621a90579e365286bd0c

SHA256
3fcaa6e4818d2142e91be6fb202ababe79275b0b66c3da00ec527abaa7069583

SHA512
52f999f402f68f8c45f7b5c49bd1474c10828de68e51047aa6ae812bad00407f4431ffe175721be16a8f7f7d467644127c3346fc0c1e817665fd8493333510e1

Download Submit
C:\Windows\System\efQJmIx.exe

Filesize
1.6MB

MD5
831387e615266f4975c88cf9e1c50b73

SHA1
44fc9806235bfdabe3d66be7febf5f11e55c1415

SHA256
df76c5a4838c71c53f0f094df544c74748e0e2d6003f0d792468d1bbc0509c02

SHA512
abacbf8ed42417a8ff4f1b722daf12085cbaf9a83b94f5e436b365cb074296a78156648ec7abc54879322bd95283aa34397107a58edee6c82affa598736ebb6c

Download Submit
C:\Windows\System\fTEgQTR.exe

Filesize
1.6MB

MD5
0bec727e4b47cde07691d502459edb5b

SHA1
162e2ac82d8b703490dd05f54c68c82e379d8842

SHA256
f4f244e0941b61cc6f9936fd4800046dd4cd46b4d40583ab8be9fece44c8bf3e

SHA512
b712dfa9b12e1f8904eebb21981918c89f84ec0cf4647d7ab213c9d8e2e48e7da8f7ce1f56648d00d9a1e5ab799ef82cf8bdd10050d2af4d0f482b9f883c9ad8

Download Submit
C:\Windows\System\gmwRPvq.exe

Filesize
18B

MD5
90cc8a9ba43b0445c09133a8ad5a4344

SHA1
8c9caa4b0361dee0057b8af76b4b40588f028105

SHA256
ebda111caaa22bc3cf246f369967cd1970b81931672957409e64bbf9553c625c

SHA512
f29975fce97f9633e3946d599e2ec21ffeeef2b5b296303b55ec62d5cb1907c1b6188646121e8e7c7076ee7a20855b896498133380dafcd815f5c9819927466b

Download Submit
C:\Windows\System\nloipiq.exe

Filesize
1.6MB

MD5
cd61870944728d16574a2f7fd5e7b8cc

SHA1
1db04af15ce47a02b3f43256abe546f815b9b6b9

SHA256
849d11a316bd65b98b873ecf17a1e053334f980e445985a595e129c54420de5d

SHA512
bf72d475bbc8927181182f116cf9c7bfd0d2917ed4e33e91291c30814bfb1345a8cf3005967e5ed14f1345a8d0cb2fd77374bb1cb545e181e90d48a9bb2ed842

Download Submit
C:\Windows\System\nxbimsp.exe

Filesize
8B

MD5
451cfa3088797a5759ea7abf906e1ccf

SHA1
eeaf2fd2f001ed5a41ce1efebd82f3fc28a520be

SHA256
5af3a1341f496326df1524541aced67d93fdd0a1fdbeea5fbba587fa5eb07a36

SHA512
bd445dbd05fbe2a6973d61447ab875240d6c79b3f30588d7a435d220b1181e8ac50e19a9616fe10e43f12e3e6f4cb3e9d3c38f5188e762af12be986ddff06b28

Download Submit
C:\Windows\System\qwLkMqg.exe

Filesize
1.6MB

MD5
c82a58290eeba092457247fc0d2d84ab

SHA1
02d8d3cc06e2c32e31237a4b3ad833f2de337efa

SHA256
de4129a64c638462f7779de3f3617a51fe080c9d4f08d0da5c8b47bea1152be0

SHA512
fee23201daf3858d3eda6bbe6e06bec778e455879073f3f53f90f69b3592b81a20b07ef6a5b98bb95d9642e339ffb8e394f74c86f9deec1482707ff257594145

Download Submit
C:\Windows\System\rAReVvo.exe

Filesize
1.6MB

MD5
f205b52102e29664b6689ec2489bdeb1

SHA1
0666bfac54dac8d61acd4de0d5727a901081d195

SHA256
2e6571751b493269df7fefc6abea39626446f72d071ddca44808b522d09fd7d2

SHA512
445dd7b34d4882fd4b8df0325c25d799df3a400a6da50fe8a9be67cc2afa56fe329974fc8e3455631de1d4b19acb083de9dd89cbf71f3893fac720d1ba10b5d0

Download Submit
C:\Windows\System\ruGaqwn.exe

Filesize
1.6MB

MD5
1a8ddb330a8a02744dac68450d6e0ac6

SHA1
c923b1f197c17eb6b300725192a7efab1a1ec3c2

SHA256
53c283ffe17cb27aad198e6fd0045f7d0af42e09e4f5f9ca138566d5caa5789f

SHA512
72cc4a67ac170e87fbd707508211b7950c96c4ffa2605374412a7307ffe5029eda8b1b88513c718139f9f2522c28f7464f7909b988f20b4c4c21c2d338ea891b

Download Submit
C:\Windows\System\tXqIQUS.exe

Filesize
1.6MB

MD5
2b5a086284bd4ebe7cd7d26edf4c3c4c

SHA1
9cabefbdd6d8ed7aa2e3833c4610194db551cdfd

SHA256
e86e2dbb8b505afe486f6fb9abcbb0aad64b04d28e600b64b580e167767d942b

SHA512
d420c4526ff8b2806cc111cefc1b6be29c5bb2e7dc21d73c07e734c07cdf3dd11c883bda3a4d20ebe7ecdc1380bfcb0f8755759fabaeb1a2bbfdf75c5b23e5b7

Download Submit
C:\Windows\System\uvQClhI.exe

Filesize
1.6MB

MD5
e83e1e341d7b302b625766763f6673a7

SHA1
df8bff959555635fa3a220c63145b0ae998d58ff

SHA256
20f85bf782d53d9da99ee2e01cef5f345c631b39ac6ec7f4aba661bb1a0136f6

SHA512
76865ebae6df63409db8581f0059d87d1cda87a000eb568af92c5d720c647e83d564a24d3b54116f3800cd4f226efd43697e5546f6b32e928e19eda9183a05e1

Download Submit
C:\Windows\System\vKiiLiO.exe

Filesize
1.6MB

MD5
cebe9541dba5596c34eedb300ea3a6ea

SHA1
a07451aa4b7bcec03c9b327ac42dd213b3ff59f7

SHA256
9e40a90e8d5a24dd622f74772cdfedea26dfde01ca24162bdacd3c09e44c873a

SHA512
3959a3940a2cc5513486c9a59a220b73ac96c8b8906306354382eba3e7e0d18833d0626a82a67d665ef9a4766cfd33703ebdac557d398a95924f11c35d609cc3

Download Submit
C:\Windows\System\vKmQaGm.exe

Filesize
1.6MB

MD5
7d89887939bcb22fd1af1d97052e95e6

SHA1
8f634fc59138bd2f304a5398bebae35871c857d5

SHA256
2918d6bbe9384caa6be712c7c52513211cec560ecd8ad70e343d18e93c603479

SHA512
b377b97cf91e9f931fb490d981dbbdd4b7d4d28825cdb22fd3a9e6eef020f98e2e1cc6d16e54776dc637e87398e81880981a9675b84b4cf6de23bd5d662504e9

Download Submit
C:\Windows\System\vjhNTem.exe

Filesize
1.6MB

MD5
a36275c61f032e5acd172ea93ebfe58d

SHA1
42ee1597fdce1f1c1732a2f12068105f5217713b

SHA256
947edcb37342fb96ebb4dc8dd011e4d7edf0bfd3a9da0241e8f7b2c4df1b5f90

SHA512
5474dd2e9e171f9a2f689fd5953df72347cbc2ff52a734dc4a92d35c6b78b3223694a98eb693cd905a9cfc6ab13cf8723f66748c9a60aa7dce822664961983ac

Download Submit
C:\Windows\System\wBvObnv.exe

Filesize
1.6MB

MD5
635b18053677a9eeaf3273114eddc06a

SHA1
d3d79bc3a290f9565d6debe3a97c7414afe78857

SHA256
3fb012489ea68c027d1818b1e2228fe840960ed6e5443dc8582f27243cd76c04

SHA512
4d4b612d304d349bb15cc504587bfd67be96497d36bf040771a331db494e3694033bd3437c2f0638a82f3c791dd2ccb6919af6140d6344a8737f652c63cecae8

Download Submit
C:\Windows\System\xjsPItg.exe

Filesize
1.6MB

MD5
83475d4be86395353dfa1121476284db

SHA1
12631a0bd2f88fde0b2667c672ef73403e244a85

SHA256
9cfc131bef975de6c974668e70c925afe88d12f3e3f3ee9bc804d86a52d17c67

SHA512
1752eab55c87c09bed88d54ae6f083e9fea6b5e093ed1adcf137cd1dcbe8656e448268ec20ba0bb0114a98bcc000c81def83bdf4f15e1acbbcc01d8990eef0d0

Download Submit
C:\Windows\System\yAUugna.exe

Filesize
1.6MB

MD5
f902a2cdcfb7b4880f1512126bc0e98a

SHA1
547f2cd988a30944026567952c6fc65cecafa0c2

SHA256
0241402f9c438b0a92c3e5a7d3accb2e14ab32985b87fb5ac4369bf9364e598c

SHA512
9c11e8b723a7c7aeb6a02b79e455595ab62a7a0cc864d1ab69acf347cb17b8fcc7f135a0a0250aaf6824253238cabaa37190bb57cf28687ef1205edc1ecadd8b

Download Submit
C:\Windows\System\zHIwlIN.exe

Filesize
1.6MB

MD5
d4dda53e93e928ee0f6863e4c2685735

SHA1
3aa379fc87cb885745d2f57a709046f5f00e1b87

SHA256
bc3b70ae62543b7f2030b151060be857b3c62e040555e75971a791c1f2fd3431

SHA512
2f9bf75889a63ffb536e77367004c4dea6d4344d60b7dc048a2be93b7a5927d4700923ed9cfefd7d8351cbb9a65c87efa27c5b70e98738f62b947a0e89be5408

Download Submit
C:\Windows\System\zjDiYaz.exe

Filesize
1.6MB

MD5
ed26b06bc1c89029b92f48e9bff722af

SHA1
5c4cedf4310cc4636007e04c50ce330f8b597176

SHA256
d0a67bcfc01a40a3874a849d02381110f6db3e1ad1be26774f8f89558d20d33c

SHA512
bcff1c2c3683f8f2facaf828d1968e9c451a1ab1b559c4cd924287bd39386841c174252f9b27249179bdf40d3135f5d1283ce5441d755ef81565d54aeed648ba

Download Submit
memory/748-3418-0x00007FF65F830000-0x00007FF65FC22000-memory.dmp

Filesize
3.9MB

Download
memory/748-581-0x00007FF65F830000-0x00007FF65FC22000-memory.dmp

Filesize
3.9MB

Download
memory/752-579-0x00007FF7A0F30000-0x00007FF7A1322000-memory.dmp

Filesize
3.9MB

Download
memory/752-3420-0x00007FF7A0F30000-0x00007FF7A1322000-memory.dmp

Filesize
3.9MB

Download
memory/772-3422-0x00007FF69FCE0000-0x00007FF6A00D2000-memory.dmp

Filesize
3.9MB

Download
memory/772-587-0x00007FF69FCE0000-0x00007FF6A00D2000-memory.dmp

Filesize
3.9MB

Download
memory/1108-3361-0x00007FF6D3510000-0x00007FF6D3902000-memory.dmp

Filesize
3.9MB

Download
memory/1108-589-0x00007FF6D3510000-0x00007FF6D3902000-memory.dmp

Filesize
3.9MB

Download
memory/1124-3395-0x00007FF64A9A0000-0x00007FF64AD92000-memory.dmp

Filesize
3.9MB

Download
memory/1124-578-0x00007FF64A9A0000-0x00007FF64AD92000-memory.dmp

Filesize
3.9MB

Download
memory/1128-3393-0x00007FF743720000-0x00007FF743B12000-memory.dmp

Filesize
3.9MB

Download
memory/1128-243-0x00007FF743720000-0x00007FF743B12000-memory.dmp

Filesize
3.9MB

Download
memory/1292-330-0x00007FF794AC0000-0x00007FF794EB2000-memory.dmp

Filesize
3.9MB

Download
memory/1292-3397-0x00007FF794AC0000-0x00007FF794EB2000-memory.dmp

Filesize
3.9MB

Download
memory/1560-3410-0x00007FF7109A0000-0x00007FF710D92000-memory.dmp

Filesize
3.9MB

Download
memory/1560-586-0x00007FF7109A0000-0x00007FF710D92000-memory.dmp

Filesize
3.9MB

Download
memory/1944-2323-0x00007FF6C2E20000-0x00007FF6C3212000-memory.dmp

Filesize
3.9MB

Download
memory/1944-3357-0x00007FF6C2E20000-0x00007FF6C3212000-memory.dmp

Filesize
3.9MB

Download
memory/1944-22-0x00007FF6C2E20000-0x00007FF6C3212000-memory.dmp

Filesize
3.9MB

Download
memory/2536-3389-0x00007FF6F6220000-0x00007FF6F6612000-memory.dmp

Filesize
3.9MB

Download
memory/2536-443-0x00007FF6F6220000-0x00007FF6F6612000-memory.dmp

Filesize
3.9MB

Download
memory/2656-3457-0x00007FF607880000-0x00007FF607C72000-memory.dmp

Filesize
3.9MB

Download
memory/2656-591-0x00007FF607880000-0x00007FF607C72000-memory.dmp

Filesize
3.9MB

Download
memory/2888-3405-0x00007FF7DBB00000-0x00007FF7DBEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-583-0x00007FF7DBB00000-0x00007FF7DBEF2000-memory.dmp

Filesize
3.9MB

Download
memory/3360-3399-0x00007FF6B0410000-0x00007FF6B0802000-memory.dmp

Filesize
3.9MB

Download
memory/3360-530-0x00007FF6B0410000-0x00007FF6B0802000-memory.dmp

Filesize
3.9MB

Download
memory/3392-3417-0x00007FF6F0D10000-0x00007FF6F1102000-memory.dmp

Filesize
3.9MB

Download
memory/3392-580-0x00007FF6F0D10000-0x00007FF6F1102000-memory.dmp

Filesize
3.9MB

Download
memory/3608-577-0x00007FF6A06F0000-0x00007FF6A0AE2000-memory.dmp

Filesize
3.9MB

Download
memory/3608-3401-0x00007FF6A06F0000-0x00007FF6A0AE2000-memory.dmp

Filesize
3.9MB

Download
memory/3852-3408-0x00007FF671770000-0x00007FF671B62000-memory.dmp

Filesize
3.9MB

Download
memory/3852-588-0x00007FF671770000-0x00007FF671B62000-memory.dmp

Filesize
3.9MB

Download
memory/3924-3378-0x00007FF72FA90000-0x00007FF72FE82000-memory.dmp

Filesize
3.9MB

Download
memory/3924-292-0x00007FF72FA90000-0x00007FF72FE82000-memory.dmp

Filesize
3.9MB

Download
memory/4316-2078-0x00007FF77C390000-0x00007FF77C782000-memory.dmp

Filesize
3.9MB

Download
memory/4316-3355-0x00007FF77C390000-0x00007FF77C782000-memory.dmp

Filesize
3.9MB

Download
memory/4316-10-0x00007FF77C390000-0x00007FF77C782000-memory.dmp

Filesize
3.9MB

Download
memory/4560-3413-0x00007FF730510000-0x00007FF730902000-memory.dmp

Filesize
3.9MB

Download
memory/4560-584-0x00007FF730510000-0x00007FF730902000-memory.dmp

Filesize
3.9MB

Download
memory/4604-585-0x00007FF607910000-0x00007FF607D02000-memory.dmp

Filesize
3.9MB

Download
memory/4604-3458-0x00007FF607910000-0x00007FF607D02000-memory.dmp

Filesize
3.9MB

Download
memory/4672-582-0x00007FF62E390000-0x00007FF62E782000-memory.dmp

Filesize
3.9MB

Download
memory/4672-3403-0x00007FF62E390000-0x00007FF62E782000-memory.dmp

Filesize
3.9MB

Download
memory/4728-3386-0x00007FF6A7FC0000-0x00007FF6A83B2000-memory.dmp

Filesize
3.9MB

Download
memory/4728-205-0x00007FF6A7FC0000-0x00007FF6A83B2000-memory.dmp

Filesize
3.9MB

Download
memory/4756-0-0x00007FF757FA0000-0x00007FF758392000-memory.dmp

Filesize
3.9MB

Download
memory/4756-1-0x0000025238740000-0x0000025238750000-memory.dmp

Filesize
64KB

Download
memory/4756-2076-0x00007FF757FA0000-0x00007FF758392000-memory.dmp

Filesize
3.9MB

Download
memory/4852-3392-0x00007FF786B80000-0x00007FF786F72000-memory.dmp

Filesize
3.9MB

Download
memory/4852-440-0x00007FF786B80000-0x00007FF786F72000-memory.dmp

Filesize
3.9MB

Download
memory/4912-98-0x00007FF855C20000-0x00007FF8566E1000-memory.dmp

Filesize
10.8MB

Download
memory/4912-212-0x0000029209D80000-0x0000029209DA2000-memory.dmp

Filesize
136KB

Download
memory/4912-148-0x00007FF855C20000-0x00007FF8566E1000-memory.dmp

Filesize
10.8MB

Download
memory/4912-11-0x00007FF855C23000-0x00007FF855C25000-memory.dmp

Filesize
8KB

Download
memory/4912-2088-0x00007FF855C20000-0x00007FF8566E1000-memory.dmp

Filesize
10.8MB

Download
memory/4936-3359-0x00007FF750000000-0x00007FF7503F2000-memory.dmp

Filesize
3.9MB

Download
memory/4936-590-0x00007FF750000000-0x00007FF7503F2000-memory.dmp

Filesize
3.9MB

Download