xmrig | f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
Size

1.9MB
MD5

660b733f929154c39eacc91738f52780
SHA1

5a1d2270bd45cf4328b58d2d931115461d5925ec
SHA256

f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225
SHA512

1b04e8d245f00cfcc5829092a4c973d607d086cf84d912f5783d3eff54115958f7a3e5882f024862ecaf25bfe7e504bcfa3fe4fdefcb59596652b0e16d6554c0
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pz32Y5ixA3z:NABD

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/5032-461-0x00007FF7129A0000-0x00007FF712D92000-memory.dmp	xmrig
behavioral2/memory/2680-546-0x00007FF759680000-0x00007FF759A72000-memory.dmp	xmrig
behavioral2/memory/4204-615-0x00007FF61DF20000-0x00007FF61E312000-memory.dmp	xmrig
behavioral2/memory/2352-2127-0x00007FF7E2F20000-0x00007FF7E3312000-memory.dmp	xmrig
behavioral2/memory/4840-1995-0x00007FF62D570000-0x00007FF62D962000-memory.dmp	xmrig
behavioral2/memory/2076-2326-0x00007FF65E760000-0x00007FF65EB52000-memory.dmp	xmrig
behavioral2/memory/2296-2279-0x00007FF655C60000-0x00007FF656052000-memory.dmp	xmrig
behavioral2/memory/2936-619-0x00007FF7CDDD0000-0x00007FF7CE1C2000-memory.dmp	xmrig
behavioral2/memory/3016-618-0x00007FF74A390000-0x00007FF74A782000-memory.dmp	xmrig
behavioral2/memory/3576-617-0x00007FF722530000-0x00007FF722922000-memory.dmp	xmrig
behavioral2/memory/2592-616-0x00007FF64F500000-0x00007FF64F8F2000-memory.dmp	xmrig
behavioral2/memory/4724-614-0x00007FF772660000-0x00007FF772A52000-memory.dmp	xmrig
behavioral2/memory/4916-613-0x00007FF7D0440000-0x00007FF7D0832000-memory.dmp	xmrig
behavioral2/memory/4992-612-0x00007FF66E860000-0x00007FF66EC52000-memory.dmp	xmrig
behavioral2/memory/4428-611-0x00007FF7DE180000-0x00007FF7DE572000-memory.dmp	xmrig
behavioral2/memory/2056-610-0x00007FF7C0520000-0x00007FF7C0912000-memory.dmp	xmrig
behavioral2/memory/4716-609-0x00007FF625530000-0x00007FF625922000-memory.dmp	xmrig
behavioral2/memory/2132-332-0x00007FF734710000-0x00007FF734B02000-memory.dmp	xmrig
behavioral2/memory/1632-243-0x00007FF60FBB0000-0x00007FF60FFA2000-memory.dmp	xmrig
behavioral2/memory/1140-49-0x00007FF7D1690000-0x00007FF7D1A82000-memory.dmp	xmrig
behavioral2/memory/208-48-0x00007FF7A7A70000-0x00007FF7A7E62000-memory.dmp	xmrig
behavioral2/memory/212-43-0x00007FF6240E0000-0x00007FF6244D2000-memory.dmp	xmrig
behavioral2/memory/3996-41-0x00007FF663A90000-0x00007FF663E82000-memory.dmp	xmrig
behavioral2/memory/2352-4156-0x00007FF7E2F20000-0x00007FF7E3312000-memory.dmp	xmrig
behavioral2/memory/208-4158-0x00007FF7A7A70000-0x00007FF7A7E62000-memory.dmp	xmrig
behavioral2/memory/3996-4162-0x00007FF663A90000-0x00007FF663E82000-memory.dmp	xmrig
behavioral2/memory/2032-4161-0x00007FF7CB870000-0x00007FF7CBC62000-memory.dmp	xmrig
behavioral2/memory/212-4164-0x00007FF6240E0000-0x00007FF6244D2000-memory.dmp	xmrig
behavioral2/memory/1140-4166-0x00007FF7D1690000-0x00007FF7D1A82000-memory.dmp	xmrig
behavioral2/memory/2296-4168-0x00007FF655C60000-0x00007FF656052000-memory.dmp	xmrig
behavioral2/memory/2076-4180-0x00007FF65E760000-0x00007FF65EB52000-memory.dmp	xmrig
behavioral2/memory/1632-4182-0x00007FF60FBB0000-0x00007FF60FFA2000-memory.dmp	xmrig
behavioral2/memory/2504-4186-0x00007FF768720000-0x00007FF768B12000-memory.dmp	xmrig
behavioral2/memory/2132-4187-0x00007FF734710000-0x00007FF734B02000-memory.dmp	xmrig
behavioral2/memory/3016-4190-0x00007FF74A390000-0x00007FF74A782000-memory.dmp	xmrig
behavioral2/memory/4716-4219-0x00007FF625530000-0x00007FF625922000-memory.dmp	xmrig
behavioral2/memory/2056-4218-0x00007FF7C0520000-0x00007FF7C0912000-memory.dmp	xmrig
behavioral2/memory/5032-4207-0x00007FF7129A0000-0x00007FF712D92000-memory.dmp	xmrig
behavioral2/memory/4428-4216-0x00007FF7DE180000-0x00007FF7DE572000-memory.dmp	xmrig
behavioral2/memory/2680-4205-0x00007FF759680000-0x00007FF759A72000-memory.dmp	xmrig
behavioral2/memory/4724-4248-0x00007FF772660000-0x00007FF772A52000-memory.dmp	xmrig
behavioral2/memory/3576-4266-0x00007FF722530000-0x00007FF722922000-memory.dmp	xmrig
behavioral2/memory/2592-4273-0x00007FF64F500000-0x00007FF64F8F2000-memory.dmp	xmrig
behavioral2/memory/2936-4272-0x00007FF7CDDD0000-0x00007FF7CE1C2000-memory.dmp	xmrig
behavioral2/memory/4204-4242-0x00007FF61DF20000-0x00007FF61E312000-memory.dmp	xmrig
behavioral2/memory/4916-4241-0x00007FF7D0440000-0x00007FF7D0832000-memory.dmp	xmrig
behavioral2/memory/4992-4295-0x00007FF66E860000-0x00007FF66EC52000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
448	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2352	dloLgZb.exe
2032	SWrBkgV.exe
2296	NmnEbNm.exe
3996	MOtDDOR.exe
208	zfgSVJN.exe
1140	CJyvGDr.exe
212	MyjfjBo.exe
2076	IiEsloV.exe
2504	DxSlYHR.exe
1632	tBskZiT.exe
2132	dviEIgl.exe
5032	WhFwmyj.exe
2680	EMnseCQ.exe
4716	NLLIyqs.exe
2056	xVhnitr.exe
4428	ZcIGFWR.exe
4992	rYzkFfo.exe
4916	EzeXIdp.exe
4724	pqRkSIF.exe
4204	deVcphZ.exe
2592	mPbULGS.exe
3576	bVsbCkj.exe
3016	PMyarXh.exe
2936	glLmdDC.exe
2700	KaJuJLz.exe
5000	LjIFQtO.exe
3108	fdMYzXI.exe
4744	daaANCD.exe
3916	evaptaB.exe
992	hhzZyUz.exe
464	CGBXgQm.exe
1164	ihMxvnA.exe
2756	RZJbmoc.exe
2064	PHUwqhj.exe
536	cYtKvsp.exe
440	KIHOlWv.exe
1480	CIXVoUe.exe
4308	xVzXhDp.exe
3468	iccrtSN.exe
3664	VffgPSo.exe
1552	cDnMpTI.exe
2584	IiThthM.exe
3080	ngtMDXR.exe
2616	KzdZKkV.exe
4636	BPVqGZx.exe
2324	VKSPWQD.exe
4440	uTaxCfX.exe
3512	CtVOdTY.exe
2180	ETKChnH.exe
2520	asFirlK.exe
4452	bBmAdvJ.exe
3644	SoyqkyK.exe
4240	eGIaqGK.exe
4332	pzBzyoa.exe
1504	sXgXIxE.exe
4740	ebopNuO.exe
2004	SXZJuMO.exe
1020	GyPfPjN.exe
3112	VavtGZL.exe
4100	dOGCRGi.exe
3000	AMTsZgC.exe
3912	sQLjshB.exe
3020	hWnShdY.exe
3456	ZPmMfoq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4840-0-0x00007FF62D570000-0x00007FF62D962000-memory.dmp	upx
behavioral2/files/0x00070000000234ad-8.dat	upx
behavioral2/memory/2352-6-0x00007FF7E2F20000-0x00007FF7E3312000-memory.dmp	upx
behavioral2/files/0x00080000000234a8-4.dat	upx
behavioral2/files/0x00070000000234ae-22.dat	upx
behavioral2/files/0x00070000000234b1-38.dat	upx
behavioral2/files/0x00070000000234b0-44.dat	upx
behavioral2/files/0x00070000000234dd-200.dat	upx
behavioral2/memory/5032-461-0x00007FF7129A0000-0x00007FF712D92000-memory.dmp	upx
behavioral2/memory/2680-546-0x00007FF759680000-0x00007FF759A72000-memory.dmp	upx
behavioral2/memory/4204-615-0x00007FF61DF20000-0x00007FF61E312000-memory.dmp	upx
behavioral2/memory/2352-2127-0x00007FF7E2F20000-0x00007FF7E3312000-memory.dmp	upx
behavioral2/memory/4840-1995-0x00007FF62D570000-0x00007FF62D962000-memory.dmp	upx
behavioral2/memory/2076-2326-0x00007FF65E760000-0x00007FF65EB52000-memory.dmp	upx
behavioral2/memory/2296-2279-0x00007FF655C60000-0x00007FF656052000-memory.dmp	upx
behavioral2/memory/2936-619-0x00007FF7CDDD0000-0x00007FF7CE1C2000-memory.dmp	upx
behavioral2/memory/3016-618-0x00007FF74A390000-0x00007FF74A782000-memory.dmp	upx
behavioral2/memory/3576-617-0x00007FF722530000-0x00007FF722922000-memory.dmp	upx
behavioral2/memory/2592-616-0x00007FF64F500000-0x00007FF64F8F2000-memory.dmp	upx
behavioral2/memory/4724-614-0x00007FF772660000-0x00007FF772A52000-memory.dmp	upx
behavioral2/memory/4916-613-0x00007FF7D0440000-0x00007FF7D0832000-memory.dmp	upx
behavioral2/memory/4992-612-0x00007FF66E860000-0x00007FF66EC52000-memory.dmp	upx
behavioral2/memory/4428-611-0x00007FF7DE180000-0x00007FF7DE572000-memory.dmp	upx
behavioral2/memory/2056-610-0x00007FF7C0520000-0x00007FF7C0912000-memory.dmp	upx
behavioral2/memory/4716-609-0x00007FF625530000-0x00007FF625922000-memory.dmp	upx
behavioral2/memory/2132-332-0x00007FF734710000-0x00007FF734B02000-memory.dmp	upx
behavioral2/memory/1632-243-0x00007FF60FBB0000-0x00007FF60FFA2000-memory.dmp	upx
behavioral2/memory/2504-207-0x00007FF768720000-0x00007FF768B12000-memory.dmp	upx
behavioral2/files/0x00070000000234df-202.dat	upx
behavioral2/files/0x00070000000234de-201.dat	upx
behavioral2/files/0x00070000000234dc-199.dat	upx
behavioral2/files/0x00070000000234db-198.dat	upx
behavioral2/files/0x00070000000234da-197.dat	upx
behavioral2/files/0x00070000000234d9-195.dat	upx
behavioral2/files/0x00070000000234d8-193.dat	upx
behavioral2/files/0x00070000000234d3-186.dat	upx
behavioral2/files/0x00070000000234d4-185.dat	upx
behavioral2/files/0x00070000000234c1-181.dat	upx
behavioral2/files/0x00070000000234d2-180.dat	upx
behavioral2/files/0x00070000000234d1-179.dat	upx
behavioral2/files/0x00070000000234d0-178.dat	upx
behavioral2/files/0x00070000000234cf-177.dat	upx
behavioral2/files/0x00070000000234ce-176.dat	upx
behavioral2/files/0x00070000000234cd-175.dat	upx
behavioral2/files/0x00070000000234cc-174.dat	upx
behavioral2/files/0x00070000000234cb-173.dat	upx
behavioral2/files/0x00070000000234ca-172.dat	upx
behavioral2/files/0x00070000000234c9-171.dat	upx
behavioral2/files/0x00070000000234c8-170.dat	upx
behavioral2/files/0x00070000000234c7-169.dat	upx
behavioral2/files/0x00070000000234c6-168.dat	upx
behavioral2/files/0x00070000000234c5-167.dat	upx
behavioral2/files/0x00070000000234c4-166.dat	upx
behavioral2/files/0x00070000000234c3-165.dat	upx
behavioral2/files/0x00070000000234c2-164.dat	upx
behavioral2/files/0x00070000000234c0-162.dat	upx
behavioral2/files/0x00070000000234b9-153.dat	upx
behavioral2/files/0x00070000000234b7-150.dat	upx
behavioral2/files/0x00070000000234b6-149.dat	upx
behavioral2/files/0x00070000000234b4-145.dat	upx
behavioral2/files/0x00070000000234b5-143.dat	upx
behavioral2/files/0x00070000000234b3-140.dat	upx
behavioral2/files/0x00070000000234d7-192.dat	upx
behavioral2/files/0x00070000000234d6-190.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fDdsjGv.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\rwDkLDT.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\rGVUBqG.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\SILBnrs.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\VrdvNEK.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\rxiEaoP.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\exuJSor.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\oWuFhUH.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\emPokwz.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\KvXViPn.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\EsvktIQ.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\UsBAfnQ.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\pkpfeEc.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\USjPqjW.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\eigrhnK.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\nohEJwv.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\hRnYDgT.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\tweLQXG.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\YwfcuFu.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\GaasEUQ.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\ljBokmB.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\RfwBhcn.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\jumGQQv.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\ZhwMwCW.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\DgFThyQ.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\LQRfudm.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\xfCeLOf.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\VdWctgd.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\FtHMJoW.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\fhZysbg.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\cpWMeAo.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\qxljubC.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\zjjJaUJ.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\qnVcifs.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\eSBJSpt.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\TLYsrYy.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\ACvfyxR.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\hEPlliN.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\IgxEuwE.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\phbEQSM.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\aPqUUeg.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\RfFHHUv.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\kiBvmkG.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\HRQPwgm.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\zBMcDLb.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\tHhmlfG.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\QVoWkkS.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\TfCmXkF.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\COpyxZl.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\ABiiakB.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\LbzpkQe.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\LksXfvZ.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\OvvMUyU.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\LBiRNJY.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\fWYtvPG.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\yjsDIKr.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\SvqkNUx.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\bUoQaPU.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\IueJKpg.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\gEhxJhF.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\sbGysbO.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\TXtIEUn.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\uOraDor.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
File created	C:\Windows\System\dAwrTBy.exe	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
Token: SeLockMemoryPrivilege	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeCreateGlobalPrivilege	13752	dwm.exe
Token: SeChangeNotifyPrivilege	13752	dwm.exe
Token: 33	13752	dwm.exe
Token: SeIncBasePriorityPrivilege	13752	dwm.exe
Token: SeCreateGlobalPrivilege	10536	dwm.exe
Token: SeChangeNotifyPrivilege	10536	dwm.exe
Token: 33	10536	dwm.exe
Token: SeIncBasePriorityPrivilege	10536	dwm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4048	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 448	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	83
PID 4840 wrote to memory of 448	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	83
PID 4840 wrote to memory of 2352	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	84
PID 4840 wrote to memory of 2352	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	84
PID 4840 wrote to memory of 2032	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	85
PID 4840 wrote to memory of 2032	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	85
PID 4840 wrote to memory of 2296	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	86
PID 4840 wrote to memory of 2296	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	86
PID 4840 wrote to memory of 3996	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	87
PID 4840 wrote to memory of 3996	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	87
PID 4840 wrote to memory of 208	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	88
PID 4840 wrote to memory of 208	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	88
PID 4840 wrote to memory of 1140	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	89
PID 4840 wrote to memory of 1140	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	89
PID 4840 wrote to memory of 2076	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	90
PID 4840 wrote to memory of 2076	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	90
PID 4840 wrote to memory of 212	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	91
PID 4840 wrote to memory of 212	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	91
PID 4840 wrote to memory of 2504	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	92
PID 4840 wrote to memory of 2504	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	92
PID 4840 wrote to memory of 1632	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	93
PID 4840 wrote to memory of 1632	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	93
PID 4840 wrote to memory of 2132	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	94
PID 4840 wrote to memory of 2132	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	94
PID 4840 wrote to memory of 5032	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	95
PID 4840 wrote to memory of 5032	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	95
PID 4840 wrote to memory of 2680	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	96
PID 4840 wrote to memory of 2680	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	96
PID 4840 wrote to memory of 4716	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	97
PID 4840 wrote to memory of 4716	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	97
PID 4840 wrote to memory of 2056	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	98
PID 4840 wrote to memory of 2056	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	98
PID 4840 wrote to memory of 4428	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	99
PID 4840 wrote to memory of 4428	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	99
PID 4840 wrote to memory of 4992	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	100
PID 4840 wrote to memory of 4992	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	100
PID 4840 wrote to memory of 4916	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	101
PID 4840 wrote to memory of 4916	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	101
PID 4840 wrote to memory of 4724	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	102
PID 4840 wrote to memory of 4724	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	102
PID 4840 wrote to memory of 4204	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	103
PID 4840 wrote to memory of 4204	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	103
PID 4840 wrote to memory of 2592	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	104
PID 4840 wrote to memory of 2592	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	104
PID 4840 wrote to memory of 3576	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	105
PID 4840 wrote to memory of 3576	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	105
PID 4840 wrote to memory of 3016	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	106
PID 4840 wrote to memory of 3016	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	106
PID 4840 wrote to memory of 2936	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	107
PID 4840 wrote to memory of 2936	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	107
PID 4840 wrote to memory of 2700	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	108
PID 4840 wrote to memory of 2700	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	108
PID 4840 wrote to memory of 5000	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	109
PID 4840 wrote to memory of 5000	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	109
PID 4840 wrote to memory of 3108	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	110
PID 4840 wrote to memory of 3108	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	110
PID 4840 wrote to memory of 4744	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	111
PID 4840 wrote to memory of 4744	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	111
PID 4840 wrote to memory of 3916	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	112
PID 4840 wrote to memory of 3916	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	112
PID 4840 wrote to memory of 992	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	113
PID 4840 wrote to memory of 992	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	113
PID 4840 wrote to memory of 464	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	114
PID 4840 wrote to memory of 464	4840	f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe	114

C:\Users\Admin\AppData\Local\Temp\f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe
"C:\Users\Admin\AppData\Local\Temp\f8620d596845eb611f2f3dc9b88b93f037b4872e3763b99c8bd4a0648d5fc225N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:448
- C:\Windows\System\dloLgZb.exe
  C:\Windows\System\dloLgZb.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\SWrBkgV.exe
  C:\Windows\System\SWrBkgV.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\NmnEbNm.exe
  C:\Windows\System\NmnEbNm.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\MOtDDOR.exe
  C:\Windows\System\MOtDDOR.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\zfgSVJN.exe
  C:\Windows\System\zfgSVJN.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\CJyvGDr.exe
  C:\Windows\System\CJyvGDr.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\IiEsloV.exe
  C:\Windows\System\IiEsloV.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\MyjfjBo.exe
  C:\Windows\System\MyjfjBo.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\DxSlYHR.exe
  C:\Windows\System\DxSlYHR.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\tBskZiT.exe
  C:\Windows\System\tBskZiT.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\dviEIgl.exe
  C:\Windows\System\dviEIgl.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\WhFwmyj.exe
  C:\Windows\System\WhFwmyj.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\EMnseCQ.exe
  C:\Windows\System\EMnseCQ.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\NLLIyqs.exe
  C:\Windows\System\NLLIyqs.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\xVhnitr.exe
  C:\Windows\System\xVhnitr.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\ZcIGFWR.exe
  C:\Windows\System\ZcIGFWR.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\rYzkFfo.exe
  C:\Windows\System\rYzkFfo.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\EzeXIdp.exe
  C:\Windows\System\EzeXIdp.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\pqRkSIF.exe
  C:\Windows\System\pqRkSIF.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\deVcphZ.exe
  C:\Windows\System\deVcphZ.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\mPbULGS.exe
  C:\Windows\System\mPbULGS.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\bVsbCkj.exe
  C:\Windows\System\bVsbCkj.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\PMyarXh.exe
  C:\Windows\System\PMyarXh.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\glLmdDC.exe
  C:\Windows\System\glLmdDC.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\KaJuJLz.exe
  C:\Windows\System\KaJuJLz.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\LjIFQtO.exe
  C:\Windows\System\LjIFQtO.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\fdMYzXI.exe
  C:\Windows\System\fdMYzXI.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\daaANCD.exe
  C:\Windows\System\daaANCD.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\evaptaB.exe
  C:\Windows\System\evaptaB.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\hhzZyUz.exe
  C:\Windows\System\hhzZyUz.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\CGBXgQm.exe
  C:\Windows\System\CGBXgQm.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\ihMxvnA.exe
  C:\Windows\System\ihMxvnA.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\RZJbmoc.exe
  C:\Windows\System\RZJbmoc.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\PHUwqhj.exe
  C:\Windows\System\PHUwqhj.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\cYtKvsp.exe
  C:\Windows\System\cYtKvsp.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\KIHOlWv.exe
  C:\Windows\System\KIHOlWv.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\CIXVoUe.exe
  C:\Windows\System\CIXVoUe.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\xVzXhDp.exe
  C:\Windows\System\xVzXhDp.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\iccrtSN.exe
  C:\Windows\System\iccrtSN.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\VffgPSo.exe
  C:\Windows\System\VffgPSo.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\cDnMpTI.exe
  C:\Windows\System\cDnMpTI.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\IiThthM.exe
  C:\Windows\System\IiThthM.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\ngtMDXR.exe
  C:\Windows\System\ngtMDXR.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\KzdZKkV.exe
  C:\Windows\System\KzdZKkV.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\BPVqGZx.exe
  C:\Windows\System\BPVqGZx.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\VKSPWQD.exe
  C:\Windows\System\VKSPWQD.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\uTaxCfX.exe
  C:\Windows\System\uTaxCfX.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\CtVOdTY.exe
  C:\Windows\System\CtVOdTY.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\ETKChnH.exe
  C:\Windows\System\ETKChnH.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\asFirlK.exe
  C:\Windows\System\asFirlK.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\bBmAdvJ.exe
  C:\Windows\System\bBmAdvJ.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\SoyqkyK.exe
  C:\Windows\System\SoyqkyK.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\eGIaqGK.exe
  C:\Windows\System\eGIaqGK.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\pzBzyoa.exe
  C:\Windows\System\pzBzyoa.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\sXgXIxE.exe
  C:\Windows\System\sXgXIxE.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\ebopNuO.exe
  C:\Windows\System\ebopNuO.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\SXZJuMO.exe
  C:\Windows\System\SXZJuMO.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\GyPfPjN.exe
  C:\Windows\System\GyPfPjN.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\VavtGZL.exe
  C:\Windows\System\VavtGZL.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\dOGCRGi.exe
  C:\Windows\System\dOGCRGi.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\AMTsZgC.exe
  C:\Windows\System\AMTsZgC.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\sQLjshB.exe
  C:\Windows\System\sQLjshB.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\hWnShdY.exe
  C:\Windows\System\hWnShdY.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\ZPmMfoq.exe
  C:\Windows\System\ZPmMfoq.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\ZfuXwue.exe
  C:\Windows\System\ZfuXwue.exe
  2⤵
  PID:1824
- C:\Windows\System\KqeOCMB.exe
  C:\Windows\System\KqeOCMB.exe
  2⤵
  PID:4416
- C:\Windows\System\nEtjyWo.exe
  C:\Windows\System\nEtjyWo.exe
  2⤵
  PID:4212
- C:\Windows\System\VEtUiIP.exe
  C:\Windows\System\VEtUiIP.exe
  2⤵
  PID:4284
- C:\Windows\System\guLnrVL.exe
  C:\Windows\System\guLnrVL.exe
  2⤵
  PID:2688
- C:\Windows\System\uDKJDQn.exe
  C:\Windows\System\uDKJDQn.exe
  2⤵
  PID:4496
- C:\Windows\System\UkDjfSK.exe
  C:\Windows\System\UkDjfSK.exe
  2⤵
  PID:4860
- C:\Windows\System\EoZnnrv.exe
  C:\Windows\System\EoZnnrv.exe
  2⤵
  PID:2828
- C:\Windows\System\CXQODqB.exe
  C:\Windows\System\CXQODqB.exe
  2⤵
  PID:4616
- C:\Windows\System\gvEewDd.exe
  C:\Windows\System\gvEewDd.exe
  2⤵
  PID:4008
- C:\Windows\System\VioOrnR.exe
  C:\Windows\System\VioOrnR.exe
  2⤵
  PID:3988
- C:\Windows\System\ZdgkJAc.exe
  C:\Windows\System\ZdgkJAc.exe
  2⤵
  PID:2444
- C:\Windows\System\BVNfkLa.exe
  C:\Windows\System\BVNfkLa.exe
  2⤵
  PID:3832
- C:\Windows\System\PgNObBQ.exe
  C:\Windows\System\PgNObBQ.exe
  2⤵
  PID:4364
- C:\Windows\System\CtJArML.exe
  C:\Windows\System\CtJArML.exe
  2⤵
  PID:4780
- C:\Windows\System\okxGfHU.exe
  C:\Windows\System\okxGfHU.exe
  2⤵
  PID:4340
- C:\Windows\System\dBBkOfC.exe
  C:\Windows\System\dBBkOfC.exe
  2⤵
  PID:5064
- C:\Windows\System\xOsMhZK.exe
  C:\Windows\System\xOsMhZK.exe
  2⤵
  PID:2884
- C:\Windows\System\SNDeaWW.exe
  C:\Windows\System\SNDeaWW.exe
  2⤵
  PID:1076
- C:\Windows\System\OSnkdUD.exe
  C:\Windows\System\OSnkdUD.exe
  2⤵
  PID:1744
- C:\Windows\System\yMMIDpn.exe
  C:\Windows\System\yMMIDpn.exe
  2⤵
  PID:4228
- C:\Windows\System\RtPlmQa.exe
  C:\Windows\System\RtPlmQa.exe
  2⤵
  PID:4988
- C:\Windows\System\KluFmeO.exe
  C:\Windows\System\KluFmeO.exe
  2⤵
  PID:4084
- C:\Windows\System\oifaYEe.exe
  C:\Windows\System\oifaYEe.exe
  2⤵
  PID:5008
- C:\Windows\System\nAnrhmm.exe
  C:\Windows\System\nAnrhmm.exe
  2⤵
  PID:64
- C:\Windows\System\bpnHbyK.exe
  C:\Windows\System\bpnHbyK.exe
  2⤵
  PID:1424
- C:\Windows\System\cHJrLbC.exe
  C:\Windows\System\cHJrLbC.exe
  2⤵
  PID:2448
- C:\Windows\System\DGqUyQo.exe
  C:\Windows\System\DGqUyQo.exe
  2⤵
  PID:3192
- C:\Windows\System\gpvQyiA.exe
  C:\Windows\System\gpvQyiA.exe
  2⤵
  PID:3012
- C:\Windows\System\qJSYIjP.exe
  C:\Windows\System\qJSYIjP.exe
  2⤵
  PID:3248
- C:\Windows\System\MhloqxZ.exe
  C:\Windows\System\MhloqxZ.exe
  2⤵
  PID:3724
- C:\Windows\System\FnCBsbj.exe
  C:\Windows\System\FnCBsbj.exe
  2⤵
  PID:4896
- C:\Windows\System\bCBtuBq.exe
  C:\Windows\System\bCBtuBq.exe
  2⤵
  PID:3652
- C:\Windows\System\GDeLcSH.exe
  C:\Windows\System\GDeLcSH.exe
  2⤵
  PID:2664
- C:\Windows\System\SjtAyiH.exe
  C:\Windows\System\SjtAyiH.exe
  2⤵
  PID:760
- C:\Windows\System\cehSSQY.exe
  C:\Windows\System\cehSSQY.exe
  2⤵
  PID:3448
- C:\Windows\System\wtoXgfW.exe
  C:\Windows\System\wtoXgfW.exe
  2⤵
  PID:1092
- C:\Windows\System\jmonEcU.exe
  C:\Windows\System\jmonEcU.exe
  2⤵
  PID:5096
- C:\Windows\System\yUTtvPc.exe
  C:\Windows\System\yUTtvPc.exe
  2⤵
  PID:3956
- C:\Windows\System\QpIHSpX.exe
  C:\Windows\System\QpIHSpX.exe
  2⤵
  PID:3540
- C:\Windows\System\WPhEAId.exe
  C:\Windows\System\WPhEAId.exe
  2⤵
  PID:5044
- C:\Windows\System\LLAXVgg.exe
  C:\Windows\System\LLAXVgg.exe
  2⤵
  PID:2280
- C:\Windows\System\IRXKBxX.exe
  C:\Windows\System\IRXKBxX.exe
  2⤵
  PID:1808
- C:\Windows\System\Iocdjwo.exe
  C:\Windows\System\Iocdjwo.exe
  2⤵
  PID:1456
- C:\Windows\System\dWPDgXz.exe
  C:\Windows\System\dWPDgXz.exe
  2⤵
  PID:1696
- C:\Windows\System\HIpJgwQ.exe
  C:\Windows\System\HIpJgwQ.exe
  2⤵
  PID:4528
- C:\Windows\System\paBICmj.exe
  C:\Windows\System\paBICmj.exe
  2⤵
  PID:4136
- C:\Windows\System\arPXBQh.exe
  C:\Windows\System\arPXBQh.exe
  2⤵
  PID:5144
- C:\Windows\System\UXGzwfI.exe
  C:\Windows\System\UXGzwfI.exe
  2⤵
  PID:5172
- C:\Windows\System\xoGaLeX.exe
  C:\Windows\System\xoGaLeX.exe
  2⤵
  PID:5200
- C:\Windows\System\iFTgcre.exe
  C:\Windows\System\iFTgcre.exe
  2⤵
  PID:5216
- C:\Windows\System\UPizgOL.exe
  C:\Windows\System\UPizgOL.exe
  2⤵
  PID:5244
- C:\Windows\System\DKuLXXJ.exe
  C:\Windows\System\DKuLXXJ.exe
  2⤵
  PID:5268
- C:\Windows\System\ECrEdQM.exe
  C:\Windows\System\ECrEdQM.exe
  2⤵
  PID:5288
- C:\Windows\System\GysKbai.exe
  C:\Windows\System\GysKbai.exe
  2⤵
  PID:5312
- C:\Windows\System\tUAAENa.exe
  C:\Windows\System\tUAAENa.exe
  2⤵
  PID:5328
- C:\Windows\System\IaInmJa.exe
  C:\Windows\System\IaInmJa.exe
  2⤵
  PID:5352
- C:\Windows\System\OXgzkfj.exe
  C:\Windows\System\OXgzkfj.exe
  2⤵
  PID:5368
- C:\Windows\System\XrmxzAb.exe
  C:\Windows\System\XrmxzAb.exe
  2⤵
  PID:5392
- C:\Windows\System\CDibDyl.exe
  C:\Windows\System\CDibDyl.exe
  2⤵
  PID:5408
- C:\Windows\System\cpnBWdx.exe
  C:\Windows\System\cpnBWdx.exe
  2⤵
  PID:5432
- C:\Windows\System\kWfWDCG.exe
  C:\Windows\System\kWfWDCG.exe
  2⤵
  PID:5448
- C:\Windows\System\tweFZQa.exe
  C:\Windows\System\tweFZQa.exe
  2⤵
  PID:5472
- C:\Windows\System\UPJcNwf.exe
  C:\Windows\System\UPJcNwf.exe
  2⤵
  PID:5496
- C:\Windows\System\lMcuGzf.exe
  C:\Windows\System\lMcuGzf.exe
  2⤵
  PID:5512
- C:\Windows\System\ArHsrid.exe
  C:\Windows\System\ArHsrid.exe
  2⤵
  PID:5536
- C:\Windows\System\PzkEQdq.exe
  C:\Windows\System\PzkEQdq.exe
  2⤵
  PID:5560
- C:\Windows\System\pJhSaXq.exe
  C:\Windows\System\pJhSaXq.exe
  2⤵
  PID:5576
- C:\Windows\System\autVhzk.exe
  C:\Windows\System\autVhzk.exe
  2⤵
  PID:5600
- C:\Windows\System\VWOrgSy.exe
  C:\Windows\System\VWOrgSy.exe
  2⤵
  PID:5628
- C:\Windows\System\EsJBJNK.exe
  C:\Windows\System\EsJBJNK.exe
  2⤵
  PID:5648
- C:\Windows\System\FXBkyDG.exe
  C:\Windows\System\FXBkyDG.exe
  2⤵
  PID:5664
- C:\Windows\System\kcaSamj.exe
  C:\Windows\System\kcaSamj.exe
  2⤵
  PID:5688
- C:\Windows\System\XyGBmCA.exe
  C:\Windows\System\XyGBmCA.exe
  2⤵
  PID:5708
- C:\Windows\System\GFEpqhF.exe
  C:\Windows\System\GFEpqhF.exe
  2⤵
  PID:5724
- C:\Windows\System\MYTHumE.exe
  C:\Windows\System\MYTHumE.exe
  2⤵
  PID:5748
- C:\Windows\System\oQyiRWc.exe
  C:\Windows\System\oQyiRWc.exe
  2⤵
  PID:5772
- C:\Windows\System\YfosNIy.exe
  C:\Windows\System\YfosNIy.exe
  2⤵
  PID:5788
- C:\Windows\System\SridaPW.exe
  C:\Windows\System\SridaPW.exe
  2⤵
  PID:5812
- C:\Windows\System\MkjgZUX.exe
  C:\Windows\System\MkjgZUX.exe
  2⤵
  PID:5828
- C:\Windows\System\aYcMYnx.exe
  C:\Windows\System\aYcMYnx.exe
  2⤵
  PID:5852
- C:\Windows\System\PyTCBLT.exe
  C:\Windows\System\PyTCBLT.exe
  2⤵
  PID:5876
- C:\Windows\System\YyPtCbw.exe
  C:\Windows\System\YyPtCbw.exe
  2⤵
  PID:5892
- C:\Windows\System\RfFHHUv.exe
  C:\Windows\System\RfFHHUv.exe
  2⤵
  PID:5920
- C:\Windows\System\kWCGeWN.exe
  C:\Windows\System\kWCGeWN.exe
  2⤵
  PID:5952
- C:\Windows\System\CLXXsZe.exe
  C:\Windows\System\CLXXsZe.exe
  2⤵
  PID:5980
- C:\Windows\System\wNOQVxp.exe
  C:\Windows\System\wNOQVxp.exe
  2⤵
  PID:6004
- C:\Windows\System\FMSUicT.exe
  C:\Windows\System\FMSUicT.exe
  2⤵
  PID:6024
- C:\Windows\System\UAncqZz.exe
  C:\Windows\System\UAncqZz.exe
  2⤵
  PID:6056
- C:\Windows\System\DNhYVOz.exe
  C:\Windows\System\DNhYVOz.exe
  2⤵
  PID:6072
- C:\Windows\System\nehTCJt.exe
  C:\Windows\System\nehTCJt.exe
  2⤵
  PID:6096
- C:\Windows\System\oQbxknY.exe
  C:\Windows\System\oQbxknY.exe
  2⤵
  PID:6112
- C:\Windows\System\zynIpJE.exe
  C:\Windows\System\zynIpJE.exe
  2⤵
  PID:6132
- C:\Windows\System\urWPwqd.exe
  C:\Windows\System\urWPwqd.exe
  2⤵
  PID:2252
- C:\Windows\System\yKKRIkC.exe
  C:\Windows\System\yKKRIkC.exe
  2⤵
  PID:3640
- C:\Windows\System\BxOKjOq.exe
  C:\Windows\System\BxOKjOq.exe
  2⤵
  PID:2396
- C:\Windows\System\DDGiqXe.exe
  C:\Windows\System\DDGiqXe.exe
  2⤵
  PID:4424
- C:\Windows\System\CEiswmL.exe
  C:\Windows\System\CEiswmL.exe
  2⤵
  PID:4484
- C:\Windows\System\sWMIMTe.exe
  C:\Windows\System\sWMIMTe.exe
  2⤵
  PID:2928
- C:\Windows\System\OWTRMbm.exe
  C:\Windows\System\OWTRMbm.exe
  2⤵
  PID:5104
- C:\Windows\System\TfCmXkF.exe
  C:\Windows\System\TfCmXkF.exe
  2⤵
  PID:1784
- C:\Windows\System\gdyXfap.exe
  C:\Windows\System\gdyXfap.exe
  2⤵
  PID:5140
- C:\Windows\System\BhGvigQ.exe
  C:\Windows\System\BhGvigQ.exe
  2⤵
  PID:6156
- C:\Windows\System\DADjtaG.exe
  C:\Windows\System\DADjtaG.exe
  2⤵
  PID:6176
- C:\Windows\System\IdHMViM.exe
  C:\Windows\System\IdHMViM.exe
  2⤵
  PID:6192
- C:\Windows\System\jRLDlPc.exe
  C:\Windows\System\jRLDlPc.exe
  2⤵
  PID:6216
- C:\Windows\System\aCEmZGG.exe
  C:\Windows\System\aCEmZGG.exe
  2⤵
  PID:6236
- C:\Windows\System\iIcwoBp.exe
  C:\Windows\System\iIcwoBp.exe
  2⤵
  PID:6260
- C:\Windows\System\GEDpUsd.exe
  C:\Windows\System\GEDpUsd.exe
  2⤵
  PID:6284
- C:\Windows\System\vszLWCD.exe
  C:\Windows\System\vszLWCD.exe
  2⤵
  PID:6364
- C:\Windows\System\esnPbVo.exe
  C:\Windows\System\esnPbVo.exe
  2⤵
  PID:6384
- C:\Windows\System\PFKqQvh.exe
  C:\Windows\System\PFKqQvh.exe
  2⤵
  PID:6408
- C:\Windows\System\elqhVkW.exe
  C:\Windows\System\elqhVkW.exe
  2⤵
  PID:6432
- C:\Windows\System\WcMwyVw.exe
  C:\Windows\System\WcMwyVw.exe
  2⤵
  PID:6456
- C:\Windows\System\nuCifFA.exe
  C:\Windows\System\nuCifFA.exe
  2⤵
  PID:6476
- C:\Windows\System\OgSUMOW.exe
  C:\Windows\System\OgSUMOW.exe
  2⤵
  PID:6504
- C:\Windows\System\RqeNAQF.exe
  C:\Windows\System\RqeNAQF.exe
  2⤵
  PID:6524
- C:\Windows\System\DgFThyQ.exe
  C:\Windows\System\DgFThyQ.exe
  2⤵
  PID:6556
- C:\Windows\System\sYwBADu.exe
  C:\Windows\System\sYwBADu.exe
  2⤵
  PID:6584
- C:\Windows\System\ZutgtmT.exe
  C:\Windows\System\ZutgtmT.exe
  2⤵
  PID:6604
- C:\Windows\System\MAbYgrF.exe
  C:\Windows\System\MAbYgrF.exe
  2⤵
  PID:6624
- C:\Windows\System\vgGsnOF.exe
  C:\Windows\System\vgGsnOF.exe
  2⤵
  PID:6648
- C:\Windows\System\WZuWAxr.exe
  C:\Windows\System\WZuWAxr.exe
  2⤵
  PID:6668
- C:\Windows\System\TbfTCfl.exe
  C:\Windows\System\TbfTCfl.exe
  2⤵
  PID:6696
- C:\Windows\System\ObiMNyo.exe
  C:\Windows\System\ObiMNyo.exe
  2⤵
  PID:6720
- C:\Windows\System\bunVPbx.exe
  C:\Windows\System\bunVPbx.exe
  2⤵
  PID:6736
- C:\Windows\System\UFdTeaz.exe
  C:\Windows\System\UFdTeaz.exe
  2⤵
  PID:6752
- C:\Windows\System\wYDKWqE.exe
  C:\Windows\System\wYDKWqE.exe
  2⤵
  PID:6776
- C:\Windows\System\jnedtta.exe
  C:\Windows\System\jnedtta.exe
  2⤵
  PID:6800
- C:\Windows\System\PcSYzAN.exe
  C:\Windows\System\PcSYzAN.exe
  2⤵
  PID:6820
- C:\Windows\System\QfZSqnl.exe
  C:\Windows\System\QfZSqnl.exe
  2⤵
  PID:6840
- C:\Windows\System\AhFveWw.exe
  C:\Windows\System\AhFveWw.exe
  2⤵
  PID:6864
- C:\Windows\System\SKIdRAG.exe
  C:\Windows\System\SKIdRAG.exe
  2⤵
  PID:6880
- C:\Windows\System\XRateMG.exe
  C:\Windows\System\XRateMG.exe
  2⤵
  PID:6904
- C:\Windows\System\GPwKBdH.exe
  C:\Windows\System\GPwKBdH.exe
  2⤵
  PID:6924
- C:\Windows\System\bKDHIuR.exe
  C:\Windows\System\bKDHIuR.exe
  2⤵
  PID:6948
- C:\Windows\System\RAcWrKP.exe
  C:\Windows\System\RAcWrKP.exe
  2⤵
  PID:6972
- C:\Windows\System\AWrpDYW.exe
  C:\Windows\System\AWrpDYW.exe
  2⤵
  PID:6992
- C:\Windows\System\QcxKtZt.exe
  C:\Windows\System\QcxKtZt.exe
  2⤵
  PID:7016
- C:\Windows\System\pxzLdFf.exe
  C:\Windows\System\pxzLdFf.exe
  2⤵
  PID:7036
- C:\Windows\System\UPtsRkb.exe
  C:\Windows\System\UPtsRkb.exe
  2⤵
  PID:7052
- C:\Windows\System\scLdUXz.exe
  C:\Windows\System\scLdUXz.exe
  2⤵
  PID:7068
- C:\Windows\System\xoiuRTm.exe
  C:\Windows\System\xoiuRTm.exe
  2⤵
  PID:7084
- C:\Windows\System\StcAKjl.exe
  C:\Windows\System\StcAKjl.exe
  2⤵
  PID:7124
- C:\Windows\System\eGKLDAj.exe
  C:\Windows\System\eGKLDAj.exe
  2⤵
  PID:7152
- C:\Windows\System\aDxmoUA.exe
  C:\Windows\System\aDxmoUA.exe
  2⤵
  PID:4348
- C:\Windows\System\TCZJIzJ.exe
  C:\Windows\System\TCZJIzJ.exe
  2⤵
  PID:3116
- C:\Windows\System\wcseyER.exe
  C:\Windows\System\wcseyER.exe
  2⤵
  PID:5296
- C:\Windows\System\bBcNZZC.exe
  C:\Windows\System\bBcNZZC.exe
  2⤵
  PID:5360
- C:\Windows\System\CEXRnCZ.exe
  C:\Windows\System\CEXRnCZ.exe
  2⤵
  PID:5676
- C:\Windows\System\ZoKSidq.exe
  C:\Windows\System\ZoKSidq.exe
  2⤵
  PID:5804
- C:\Windows\System\zmaojaz.exe
  C:\Windows\System\zmaojaz.exe
  2⤵
  PID:5860
- C:\Windows\System\oXixguL.exe
  C:\Windows\System\oXixguL.exe
  2⤵
  PID:5112
- C:\Windows\System\VZBWygr.exe
  C:\Windows\System\VZBWygr.exe
  2⤵
  PID:6032
- C:\Windows\System\WGmmwGT.exe
  C:\Windows\System\WGmmwGT.exe
  2⤵
  PID:6088
- C:\Windows\System\oVHJoyZ.exe
  C:\Windows\System\oVHJoyZ.exe
  2⤵
  PID:5968
- C:\Windows\System\vNkegTH.exe
  C:\Windows\System\vNkegTH.exe
  2⤵
  PID:5996
- C:\Windows\System\YpGlAax.exe
  C:\Windows\System\YpGlAax.exe
  2⤵
  PID:6068
- C:\Windows\System\TuuJsPN.exe
  C:\Windows\System\TuuJsPN.exe
  2⤵
  PID:6764
- C:\Windows\System\ickJeEZ.exe
  C:\Windows\System\ickJeEZ.exe
  2⤵
  PID:6816
- C:\Windows\System\TtCjvVI.exe
  C:\Windows\System\TtCjvVI.exe
  2⤵
  PID:6856
- C:\Windows\System\LegvYYb.exe
  C:\Windows\System\LegvYYb.exe
  2⤵
  PID:6916
- C:\Windows\System\IKANRaI.exe
  C:\Windows\System\IKANRaI.exe
  2⤵
  PID:6956
- C:\Windows\System\LCOHMTH.exe
  C:\Windows\System\LCOHMTH.exe
  2⤵
  PID:7008
- C:\Windows\System\jOnzJJN.exe
  C:\Windows\System\jOnzJJN.exe
  2⤵
  PID:7060
- C:\Windows\System\HDoqAld.exe
  C:\Windows\System\HDoqAld.exe
  2⤵
  PID:7096
- C:\Windows\System\veFsCur.exe
  C:\Windows\System\veFsCur.exe
  2⤵
  PID:5236
- C:\Windows\System\IHIlPeC.exe
  C:\Windows\System\IHIlPeC.exe
  2⤵
  PID:5308
- C:\Windows\System\kxFAupZ.exe
  C:\Windows\System\kxFAupZ.exe
  2⤵
  PID:5796
- C:\Windows\System\QPpkcIx.exe
  C:\Windows\System\QPpkcIx.exe
  2⤵
  PID:4720
- C:\Windows\System\xsbsBZY.exe
  C:\Windows\System\xsbsBZY.exe
  2⤵
  PID:4516
- C:\Windows\System\DvrvXPc.exe
  C:\Windows\System\DvrvXPc.exe
  2⤵
  PID:7188
- C:\Windows\System\BMhKIzY.exe
  C:\Windows\System\BMhKIzY.exe
  2⤵
  PID:7204
- C:\Windows\System\rDWsSQV.exe
  C:\Windows\System\rDWsSQV.exe
  2⤵
  PID:7224
- C:\Windows\System\fBiNxZE.exe
  C:\Windows\System\fBiNxZE.exe
  2⤵
  PID:7244
- C:\Windows\System\JxIurdr.exe
  C:\Windows\System\JxIurdr.exe
  2⤵
  PID:7264
- C:\Windows\System\MXXqHhT.exe
  C:\Windows\System\MXXqHhT.exe
  2⤵
  PID:7280
- C:\Windows\System\ntVPxvO.exe
  C:\Windows\System\ntVPxvO.exe
  2⤵
  PID:7300
- C:\Windows\System\xTraxSl.exe
  C:\Windows\System\xTraxSl.exe
  2⤵
  PID:7320
- C:\Windows\System\mAuJmDM.exe
  C:\Windows\System\mAuJmDM.exe
  2⤵
  PID:7340
- C:\Windows\System\gvYhczV.exe
  C:\Windows\System\gvYhczV.exe
  2⤵
  PID:7356
- C:\Windows\System\JoDzCfi.exe
  C:\Windows\System\JoDzCfi.exe
  2⤵
  PID:7376
- C:\Windows\System\ZkwnNFA.exe
  C:\Windows\System\ZkwnNFA.exe
  2⤵
  PID:7396
- C:\Windows\System\KZFfiZH.exe
  C:\Windows\System\KZFfiZH.exe
  2⤵
  PID:7416
- C:\Windows\System\fsyESaV.exe
  C:\Windows\System\fsyESaV.exe
  2⤵
  PID:7432
- C:\Windows\System\GCrvGkE.exe
  C:\Windows\System\GCrvGkE.exe
  2⤵
  PID:7468
- C:\Windows\System\zXENjtM.exe
  C:\Windows\System\zXENjtM.exe
  2⤵
  PID:7484
- C:\Windows\System\nNjjGEU.exe
  C:\Windows\System\nNjjGEU.exe
  2⤵
  PID:7500
- C:\Windows\System\hKypTlQ.exe
  C:\Windows\System\hKypTlQ.exe
  2⤵
  PID:7516
- C:\Windows\System\FcWXcee.exe
  C:\Windows\System\FcWXcee.exe
  2⤵
  PID:7532
- C:\Windows\System\fQvdVix.exe
  C:\Windows\System\fQvdVix.exe
  2⤵
  PID:7556
- C:\Windows\System\ZmGSGDV.exe
  C:\Windows\System\ZmGSGDV.exe
  2⤵
  PID:7576
- C:\Windows\System\IRpsdDj.exe
  C:\Windows\System\IRpsdDj.exe
  2⤵
  PID:7908
- C:\Windows\System\zSAdGzh.exe
  C:\Windows\System\zSAdGzh.exe
  2⤵
  PID:7924
- C:\Windows\System\qLhSmgg.exe
  C:\Windows\System\qLhSmgg.exe
  2⤵
  PID:7944
- C:\Windows\System\GApfwGb.exe
  C:\Windows\System\GApfwGb.exe
  2⤵
  PID:7960
- C:\Windows\System\KbmLlXk.exe
  C:\Windows\System\KbmLlXk.exe
  2⤵
  PID:7976
- C:\Windows\System\haKuKPN.exe
  C:\Windows\System\haKuKPN.exe
  2⤵
  PID:8000
- C:\Windows\System\QZYEWVL.exe
  C:\Windows\System\QZYEWVL.exe
  2⤵
  PID:8020
- C:\Windows\System\uZUgFzg.exe
  C:\Windows\System\uZUgFzg.exe
  2⤵
  PID:8036
- C:\Windows\System\pqiaBLZ.exe
  C:\Windows\System\pqiaBLZ.exe
  2⤵
  PID:8060
- C:\Windows\System\taRYQAw.exe
  C:\Windows\System\taRYQAw.exe
  2⤵
  PID:8080
- C:\Windows\System\AANwWTG.exe
  C:\Windows\System\AANwWTG.exe
  2⤵
  PID:8096
- C:\Windows\System\thitcpf.exe
  C:\Windows\System\thitcpf.exe
  2⤵
  PID:8120
- C:\Windows\System\VzabdpR.exe
  C:\Windows\System\VzabdpR.exe
  2⤵
  PID:8140
- C:\Windows\System\jItqMEt.exe
  C:\Windows\System\jItqMEt.exe
  2⤵
  PID:8160
- C:\Windows\System\bMndiIJ.exe
  C:\Windows\System\bMndiIJ.exe
  2⤵
  PID:8180
- C:\Windows\System\QTjxSoR.exe
  C:\Windows\System\QTjxSoR.exe
  2⤵
  PID:5660
- C:\Windows\System\xHhFrWi.exe
  C:\Windows\System\xHhFrWi.exe
  2⤵
  PID:8212
- C:\Windows\System\SohMmvp.exe
  C:\Windows\System\SohMmvp.exe
  2⤵
  PID:8236
- C:\Windows\System\rwlIxZn.exe
  C:\Windows\System\rwlIxZn.exe
  2⤵
  PID:8252
- C:\Windows\System\fnyciVW.exe
  C:\Windows\System\fnyciVW.exe
  2⤵
  PID:8272
- C:\Windows\System\HkvKyTk.exe
  C:\Windows\System\HkvKyTk.exe
  2⤵
  PID:8296
- C:\Windows\System\mkHWOJO.exe
  C:\Windows\System\mkHWOJO.exe
  2⤵
  PID:8316
- C:\Windows\System\yOyIsBR.exe
  C:\Windows\System\yOyIsBR.exe
  2⤵
  PID:8332
- C:\Windows\System\PtdpHfv.exe
  C:\Windows\System\PtdpHfv.exe
  2⤵
  PID:8356
- C:\Windows\System\fVVKzHw.exe
  C:\Windows\System\fVVKzHw.exe
  2⤵
  PID:8372
- C:\Windows\System\kZqSeRX.exe
  C:\Windows\System\kZqSeRX.exe
  2⤵
  PID:8396
- C:\Windows\System\fieFJtR.exe
  C:\Windows\System\fieFJtR.exe
  2⤵
  PID:8428
- C:\Windows\System\XBIUoOd.exe
  C:\Windows\System\XBIUoOd.exe
  2⤵
  PID:8472
- C:\Windows\System\UvghWLT.exe
  C:\Windows\System\UvghWLT.exe
  2⤵
  PID:8492
- C:\Windows\System\ScRnKyz.exe
  C:\Windows\System\ScRnKyz.exe
  2⤵
  PID:8632
- C:\Windows\System\LALNpXC.exe
  C:\Windows\System\LALNpXC.exe
  2⤵
  PID:8648
- C:\Windows\System\zUEWoUo.exe
  C:\Windows\System\zUEWoUo.exe
  2⤵
  PID:8672
- C:\Windows\System\GmvUmgQ.exe
  C:\Windows\System\GmvUmgQ.exe
  2⤵
  PID:8692
- C:\Windows\System\RgNTPVz.exe
  C:\Windows\System\RgNTPVz.exe
  2⤵
  PID:8712
- C:\Windows\System\szDbVgP.exe
  C:\Windows\System\szDbVgP.exe
  2⤵
  PID:8732
- C:\Windows\System\DPYiQXy.exe
  C:\Windows\System\DPYiQXy.exe
  2⤵
  PID:8752
- C:\Windows\System\ERpJqQt.exe
  C:\Windows\System\ERpJqQt.exe
  2⤵
  PID:8772
- C:\Windows\System\qXqJykK.exe
  C:\Windows\System\qXqJykK.exe
  2⤵
  PID:8792
- C:\Windows\System\cJIpHNI.exe
  C:\Windows\System\cJIpHNI.exe
  2⤵
  PID:8812
- C:\Windows\System\yMHBcRh.exe
  C:\Windows\System\yMHBcRh.exe
  2⤵
  PID:8832
- C:\Windows\System\UhgDMMk.exe
  C:\Windows\System\UhgDMMk.exe
  2⤵
  PID:8848
- C:\Windows\System\rNEEKwJ.exe
  C:\Windows\System\rNEEKwJ.exe
  2⤵
  PID:8868
- C:\Windows\System\BGcfczq.exe
  C:\Windows\System\BGcfczq.exe
  2⤵
  PID:8884
- C:\Windows\System\LEnazpW.exe
  C:\Windows\System\LEnazpW.exe
  2⤵
  PID:8900
- C:\Windows\System\IQRMzVn.exe
  C:\Windows\System\IQRMzVn.exe
  2⤵
  PID:8916
- C:\Windows\System\dJFNvSY.exe
  C:\Windows\System\dJFNvSY.exe
  2⤵
  PID:8936
- C:\Windows\System\nQBLYCy.exe
  C:\Windows\System\nQBLYCy.exe
  2⤵
  PID:8956
- C:\Windows\System\AEYcAKs.exe
  C:\Windows\System\AEYcAKs.exe
  2⤵
  PID:8972
- C:\Windows\System\tPoWtzN.exe
  C:\Windows\System\tPoWtzN.exe
  2⤵
  PID:8988
- C:\Windows\System\qXkvioj.exe
  C:\Windows\System\qXkvioj.exe
  2⤵
  PID:9004
- C:\Windows\System\gxivCKL.exe
  C:\Windows\System\gxivCKL.exe
  2⤵
  PID:9020
- C:\Windows\System\WWvhkcD.exe
  C:\Windows\System\WWvhkcD.exe
  2⤵
  PID:9036
- C:\Windows\System\ZwozTcV.exe
  C:\Windows\System\ZwozTcV.exe
  2⤵
  PID:9052
- C:\Windows\System\BUBSgOC.exe
  C:\Windows\System\BUBSgOC.exe
  2⤵
  PID:9068
- C:\Windows\System\omkdoch.exe
  C:\Windows\System\omkdoch.exe
  2⤵
  PID:9084
- C:\Windows\System\kUTrRgX.exe
  C:\Windows\System\kUTrRgX.exe
  2⤵
  PID:9116
- C:\Windows\System\aXSpipQ.exe
  C:\Windows\System\aXSpipQ.exe
  2⤵
  PID:9132
- C:\Windows\System\BhCnXAG.exe
  C:\Windows\System\BhCnXAG.exe
  2⤵
  PID:9152
- C:\Windows\System\EdRyigo.exe
  C:\Windows\System\EdRyigo.exe
  2⤵
  PID:9172
- C:\Windows\System\NeMWbnB.exe
  C:\Windows\System\NeMWbnB.exe
  2⤵
  PID:9192
- C:\Windows\System\IZtzVmc.exe
  C:\Windows\System\IZtzVmc.exe
  2⤵
  PID:9212
- C:\Windows\System\rtOZyct.exe
  C:\Windows\System\rtOZyct.exe
  2⤵
  PID:6040
- C:\Windows\System\YKqfIiR.exe
  C:\Windows\System\YKqfIiR.exe
  2⤵
  PID:1452
- C:\Windows\System\kcjfiie.exe
  C:\Windows\System\kcjfiie.exe
  2⤵
  PID:6900
- C:\Windows\System\RCIzeWe.exe
  C:\Windows\System\RCIzeWe.exe
  2⤵
  PID:7160
- C:\Windows\System\bBjspGB.exe
  C:\Windows\System\bBjspGB.exe
  2⤵
  PID:1920
- C:\Windows\System\BsisGPG.exe
  C:\Windows\System\BsisGPG.exe
  2⤵
  PID:7180
- C:\Windows\System\oFCDveJ.exe
  C:\Windows\System\oFCDveJ.exe
  2⤵
  PID:7256
- C:\Windows\System\QFZSIBq.exe
  C:\Windows\System\QFZSIBq.exe
  2⤵
  PID:7296
- C:\Windows\System\lSOvGfp.exe
  C:\Windows\System\lSOvGfp.exe
  2⤵
  PID:7328
- C:\Windows\System\IyHZTeF.exe
  C:\Windows\System\IyHZTeF.exe
  2⤵
  PID:7372
- C:\Windows\System\GueWafo.exe
  C:\Windows\System\GueWafo.exe
  2⤵
  PID:7368
- C:\Windows\System\MaBNYsx.exe
  C:\Windows\System\MaBNYsx.exe
  2⤵
  PID:7496
- C:\Windows\System\QfNQTDD.exe
  C:\Windows\System\QfNQTDD.exe
  2⤵
  PID:8460
- C:\Windows\System\kZIsCdO.exe
  C:\Windows\System\kZIsCdO.exe
  2⤵
  PID:8668
- C:\Windows\System\twesMxx.exe
  C:\Windows\System\twesMxx.exe
  2⤵
  PID:6876
- C:\Windows\System\fjOETIw.exe
  C:\Windows\System\fjOETIw.exe
  2⤵
  PID:8728
- C:\Windows\System\hTYryFm.exe
  C:\Windows\System\hTYryFm.exe
  2⤵
  PID:8788
- C:\Windows\System\hDQVopa.exe
  C:\Windows\System\hDQVopa.exe
  2⤵
  PID:7132
- C:\Windows\System\QVwgFYI.exe
  C:\Windows\System\QVwgFYI.exe
  2⤵
  PID:8864
- C:\Windows\System\TeLglUo.exe
  C:\Windows\System\TeLglUo.exe
  2⤵
  PID:1420
- C:\Windows\System\zGzwrNv.exe
  C:\Windows\System\zGzwrNv.exe
  2⤵
  PID:8948
- C:\Windows\System\JOTweOB.exe
  C:\Windows\System\JOTweOB.exe
  2⤵
  PID:7448
- C:\Windows\System\QBBSEns.exe
  C:\Windows\System\QBBSEns.exe
  2⤵
  PID:7480
- C:\Windows\System\rLMdPAO.exe
  C:\Windows\System\rLMdPAO.exe
  2⤵
  PID:5548
- C:\Windows\System\wjoDvLy.exe
  C:\Windows\System\wjoDvLy.exe
  2⤵
  PID:5584
- C:\Windows\System\NSWaEmn.exe
  C:\Windows\System\NSWaEmn.exe
  2⤵
  PID:5656
- C:\Windows\System\MBOQOjQ.exe
  C:\Windows\System\MBOQOjQ.exe
  2⤵
  PID:5888
- C:\Windows\System\NOxObUQ.exe
  C:\Windows\System\NOxObUQ.exe
  2⤵
  PID:7136
- C:\Windows\System\UmCXBNA.exe
  C:\Windows\System\UmCXBNA.exe
  2⤵
  PID:6540
- C:\Windows\System\NHbjJPA.exe
  C:\Windows\System\NHbjJPA.exe
  2⤵
  PID:6244
- C:\Windows\System\mnwYCun.exe
  C:\Windows\System\mnwYCun.exe
  2⤵
  PID:6620
- C:\Windows\System\CTeCQyC.exe
  C:\Windows\System\CTeCQyC.exe
  2⤵
  PID:6708
- C:\Windows\System\vjpkRnP.exe
  C:\Windows\System\vjpkRnP.exe
  2⤵
  PID:9060
- C:\Windows\System\WZUgLfm.exe
  C:\Windows\System\WZUgLfm.exe
  2⤵
  PID:8704
- C:\Windows\System\GcncVvX.exe
  C:\Windows\System\GcncVvX.exe
  2⤵
  PID:6896
- C:\Windows\System\lyAAivC.exe
  C:\Windows\System\lyAAivC.exe
  2⤵
  PID:7212
- C:\Windows\System\RHfBxFk.exe
  C:\Windows\System\RHfBxFk.exe
  2⤵
  PID:7272
- C:\Windows\System\yoDIJNa.exe
  C:\Windows\System\yoDIJNa.exe
  2⤵
  PID:9232
- C:\Windows\System\aIvUKsP.exe
  C:\Windows\System\aIvUKsP.exe
  2⤵
  PID:9256
- C:\Windows\System\eZapWtV.exe
  C:\Windows\System\eZapWtV.exe
  2⤵
  PID:9280
- C:\Windows\System\pewcSwK.exe
  C:\Windows\System\pewcSwK.exe
  2⤵
  PID:9300
- C:\Windows\System\wTTSiMP.exe
  C:\Windows\System\wTTSiMP.exe
  2⤵
  PID:9320
- C:\Windows\System\RgVGweA.exe
  C:\Windows\System\RgVGweA.exe
  2⤵
  PID:9344
- C:\Windows\System\DXuiMAt.exe
  C:\Windows\System\DXuiMAt.exe
  2⤵
  PID:9368
- C:\Windows\System\mNyUvyq.exe
  C:\Windows\System\mNyUvyq.exe
  2⤵
  PID:9396
- C:\Windows\System\GZjkisN.exe
  C:\Windows\System\GZjkisN.exe
  2⤵
  PID:9416
- C:\Windows\System\rMzocPZ.exe
  C:\Windows\System\rMzocPZ.exe
  2⤵
  PID:9436
- C:\Windows\System\tRoHNSB.exe
  C:\Windows\System\tRoHNSB.exe
  2⤵
  PID:9460
- C:\Windows\System\HJMlReq.exe
  C:\Windows\System\HJMlReq.exe
  2⤵
  PID:9484
- C:\Windows\System\qCAwsoK.exe
  C:\Windows\System\qCAwsoK.exe
  2⤵
  PID:9504
- C:\Windows\System\cVyENal.exe
  C:\Windows\System\cVyENal.exe
  2⤵
  PID:9524
- C:\Windows\System\dVwGlNu.exe
  C:\Windows\System\dVwGlNu.exe
  2⤵
  PID:9540
- C:\Windows\System\KZFeDjU.exe
  C:\Windows\System\KZFeDjU.exe
  2⤵
  PID:9600
- C:\Windows\System\kHLGegF.exe
  C:\Windows\System\kHLGegF.exe
  2⤵
  PID:9620
- C:\Windows\System\FvDlAeg.exe
  C:\Windows\System\FvDlAeg.exe
  2⤵
  PID:9636
- C:\Windows\System\qWeTlgF.exe
  C:\Windows\System\qWeTlgF.exe
  2⤵
  PID:9656
- C:\Windows\System\tBzwAdR.exe
  C:\Windows\System\tBzwAdR.exe
  2⤵
  PID:9676
- C:\Windows\System\IwozITn.exe
  C:\Windows\System\IwozITn.exe
  2⤵
  PID:9696
- C:\Windows\System\HcTcgtI.exe
  C:\Windows\System\HcTcgtI.exe
  2⤵
  PID:9724
- C:\Windows\System\XZdpThd.exe
  C:\Windows\System\XZdpThd.exe
  2⤵
  PID:9740
- C:\Windows\System\ShrGYvB.exe
  C:\Windows\System\ShrGYvB.exe
  2⤵
  PID:9768
- C:\Windows\System\OsEQLlt.exe
  C:\Windows\System\OsEQLlt.exe
  2⤵
  PID:9784
- C:\Windows\System\rmlRZdA.exe
  C:\Windows\System\rmlRZdA.exe
  2⤵
  PID:9804
- C:\Windows\System\thyvmfv.exe
  C:\Windows\System\thyvmfv.exe
  2⤵
  PID:9828
- C:\Windows\System\vVaeSgS.exe
  C:\Windows\System\vVaeSgS.exe
  2⤵
  PID:9844
- C:\Windows\System\BXFUxiI.exe
  C:\Windows\System\BXFUxiI.exe
  2⤵
  PID:9868
- C:\Windows\System\nuLWssH.exe
  C:\Windows\System\nuLWssH.exe
  2⤵
  PID:9892
- C:\Windows\System\hhypQGY.exe
  C:\Windows\System\hhypQGY.exe
  2⤵
  PID:9924
- C:\Windows\System\SopRSzu.exe
  C:\Windows\System\SopRSzu.exe
  2⤵
  PID:9940
- C:\Windows\System\eiuLJVt.exe
  C:\Windows\System\eiuLJVt.exe
  2⤵
  PID:9960
- C:\Windows\System\kEKXbvZ.exe
  C:\Windows\System\kEKXbvZ.exe
  2⤵
  PID:9984
- C:\Windows\System\fDnnGiU.exe
  C:\Windows\System\fDnnGiU.exe
  2⤵
  PID:10008
- C:\Windows\System\pYioczM.exe
  C:\Windows\System\pYioczM.exe
  2⤵
  PID:10036
- C:\Windows\System\sJeFyfV.exe
  C:\Windows\System\sJeFyfV.exe
  2⤵
  PID:10060
- C:\Windows\System\wvHupCL.exe
  C:\Windows\System\wvHupCL.exe
  2⤵
  PID:10092
- C:\Windows\System\jmjHIKI.exe
  C:\Windows\System\jmjHIKI.exe
  2⤵
  PID:10120
- C:\Windows\System\cZUdWAi.exe
  C:\Windows\System\cZUdWAi.exe
  2⤵
  PID:10140
- C:\Windows\System\uiMqixf.exe
  C:\Windows\System\uiMqixf.exe
  2⤵
  PID:10156
- C:\Windows\System\YZiCueC.exe
  C:\Windows\System\YZiCueC.exe
  2⤵
  PID:10172
- C:\Windows\System\SwTiFin.exe
  C:\Windows\System\SwTiFin.exe
  2⤵
  PID:10188
- C:\Windows\System\vtvbRSl.exe
  C:\Windows\System\vtvbRSl.exe
  2⤵
  PID:10204
- C:\Windows\System\BwhUuTJ.exe
  C:\Windows\System\BwhUuTJ.exe
  2⤵
  PID:10228
- C:\Windows\System\lgPQDHr.exe
  C:\Windows\System\lgPQDHr.exe
  2⤵
  PID:7364
- C:\Windows\System\lkOiXfY.exe
  C:\Windows\System\lkOiXfY.exe
  2⤵
  PID:7492
- C:\Windows\System\xAbVjKo.exe
  C:\Windows\System\xAbVjKo.exe
  2⤵
  PID:8464
- C:\Windows\System\wZHVWuH.exe
  C:\Windows\System\wZHVWuH.exe
  2⤵
  PID:7528
- C:\Windows\System\QBjIixk.exe
  C:\Windows\System\QBjIixk.exe
  2⤵
  PID:4800
- C:\Windows\System\lMPdSkk.exe
  C:\Windows\System\lMPdSkk.exe
  2⤵
  PID:7588
- C:\Windows\System\GogjFTL.exe
  C:\Windows\System\GogjFTL.exe
  2⤵
  PID:10256
- C:\Windows\System\olaIYQq.exe
  C:\Windows\System\olaIYQq.exe
  2⤵
  PID:10276
- C:\Windows\System\RZFEMFI.exe
  C:\Windows\System\RZFEMFI.exe
  2⤵
  PID:10364
- C:\Windows\System\GAAFtiC.exe
  C:\Windows\System\GAAFtiC.exe
  2⤵
  PID:10388
- C:\Windows\System\WwNeIbx.exe
  C:\Windows\System\WwNeIbx.exe
  2⤵
  PID:10408
- C:\Windows\System\QZHaAYL.exe
  C:\Windows\System\QZHaAYL.exe
  2⤵
  PID:10428
- C:\Windows\System\bApntMv.exe
  C:\Windows\System\bApntMv.exe
  2⤵
  PID:10452
- C:\Windows\System\ubyxoES.exe
  C:\Windows\System\ubyxoES.exe
  2⤵
  PID:10476
- C:\Windows\System\rUlmpZB.exe
  C:\Windows\System\rUlmpZB.exe
  2⤵
  PID:10504
- C:\Windows\System\MJlDiQY.exe
  C:\Windows\System\MJlDiQY.exe
  2⤵
  PID:10528
- C:\Windows\System\nhzYVcG.exe
  C:\Windows\System\nhzYVcG.exe
  2⤵
  PID:10548
- C:\Windows\System\KlMomvz.exe
  C:\Windows\System\KlMomvz.exe
  2⤵
  PID:10568
- C:\Windows\System\hvEsKDY.exe
  C:\Windows\System\hvEsKDY.exe
  2⤵
  PID:10592
- C:\Windows\System\teSKLgF.exe
  C:\Windows\System\teSKLgF.exe
  2⤵
  PID:10616
- C:\Windows\System\ErFxEpO.exe
  C:\Windows\System\ErFxEpO.exe
  2⤵
  PID:10640
- C:\Windows\System\xGhXmxd.exe
  C:\Windows\System\xGhXmxd.exe
  2⤵
  PID:10660
- C:\Windows\System\KcjnGwM.exe
  C:\Windows\System\KcjnGwM.exe
  2⤵
  PID:10680
- C:\Windows\System\EHvWVkM.exe
  C:\Windows\System\EHvWVkM.exe
  2⤵
  PID:10708
- C:\Windows\System\hWgcLeg.exe
  C:\Windows\System\hWgcLeg.exe
  2⤵
  PID:10732
- C:\Windows\System\dzlNJcx.exe
  C:\Windows\System\dzlNJcx.exe
  2⤵
  PID:10748
- C:\Windows\System\jdVvvbH.exe
  C:\Windows\System\jdVvvbH.exe
  2⤵
  PID:10780
- C:\Windows\System\MdhKnrI.exe
  C:\Windows\System\MdhKnrI.exe
  2⤵
  PID:10796
- C:\Windows\System\pDHaWbr.exe
  C:\Windows\System\pDHaWbr.exe
  2⤵
  PID:10984
- C:\Windows\System\DSwseVw.exe
  C:\Windows\System\DSwseVw.exe
  2⤵
  PID:11000
- C:\Windows\System\cYXNYOi.exe
  C:\Windows\System\cYXNYOi.exe
  2⤵
  PID:11016
- C:\Windows\System\gCjdKOo.exe
  C:\Windows\System\gCjdKOo.exe
  2⤵
  PID:11036
- C:\Windows\System\CWSpdIG.exe
  C:\Windows\System\CWSpdIG.exe
  2⤵
  PID:11052
- C:\Windows\System\sGdWHRd.exe
  C:\Windows\System\sGdWHRd.exe
  2⤵
  PID:11068
- C:\Windows\System\KTQVHty.exe
  C:\Windows\System\KTQVHty.exe
  2⤵
  PID:11084
- C:\Windows\System\ZSbWFVf.exe
  C:\Windows\System\ZSbWFVf.exe
  2⤵
  PID:11104
- C:\Windows\System\LvkIxto.exe
  C:\Windows\System\LvkIxto.exe
  2⤵
  PID:11124
- C:\Windows\System\RhjAWLR.exe
  C:\Windows\System\RhjAWLR.exe
  2⤵
  PID:11144
- C:\Windows\System\EeCbwBl.exe
  C:\Windows\System\EeCbwBl.exe
  2⤵
  PID:11172
- C:\Windows\System\GYhsQjE.exe
  C:\Windows\System\GYhsQjE.exe
  2⤵
  PID:11196
- C:\Windows\System\nwRnWwc.exe
  C:\Windows\System\nwRnWwc.exe
  2⤵
  PID:11224
- C:\Windows\System\sxRAlls.exe
  C:\Windows\System\sxRAlls.exe
  2⤵
  PID:11252
- C:\Windows\System\IpGVoVE.exe
  C:\Windows\System\IpGVoVE.exe
  2⤵
  PID:8412
- C:\Windows\System\CIFswNa.exe
  C:\Windows\System\CIFswNa.exe
  2⤵
  PID:8188
- C:\Windows\System\VMyYNBh.exe
  C:\Windows\System\VMyYNBh.exe
  2⤵
  PID:8152
- C:\Windows\System\zOVgSpX.exe
  C:\Windows\System\zOVgSpX.exe
  2⤵
  PID:8112
- C:\Windows\System\TYLHWkx.exe
  C:\Windows\System\TYLHWkx.exe
  2⤵
  PID:8076
- C:\Windows\System\tCldfQF.exe
  C:\Windows\System\tCldfQF.exe
  2⤵
  PID:8044
- C:\Windows\System\QCATClF.exe
  C:\Windows\System\QCATClF.exe
  2⤵
  PID:7996
- C:\Windows\System\MzpGkmn.exe
  C:\Windows\System\MzpGkmn.exe
  2⤵
  PID:7968
- C:\Windows\System\pEtLPuq.exe
  C:\Windows\System\pEtLPuq.exe
  2⤵
  PID:7920
- C:\Windows\System\fIoELFc.exe
  C:\Windows\System\fIoELFc.exe
  2⤵
  PID:7444
- C:\Windows\System\EmXPIhr.exe
  C:\Windows\System\EmXPIhr.exe
  2⤵
  PID:5608
- C:\Windows\System\GmrJjqa.exe
  C:\Windows\System\GmrJjqa.exe
  2⤵
  PID:5740
- C:\Windows\System\cxLYnMN.exe
  C:\Windows\System\cxLYnMN.exe
  2⤵
  PID:8844
- C:\Windows\System\TSypPFg.exe
  C:\Windows\System\TSypPFg.exe
  2⤵
  PID:6660
- C:\Windows\System\XkhwUPn.exe
  C:\Windows\System\XkhwUPn.exe
  2⤵
  PID:7216
- C:\Windows\System\wEiaapo.exe
  C:\Windows\System\wEiaapo.exe
  2⤵
  PID:9248
- C:\Windows\System\lLxVzNB.exe
  C:\Windows\System\lLxVzNB.exe
  2⤵
  PID:9296
- C:\Windows\System\lNWRkPg.exe
  C:\Windows\System\lNWRkPg.exe
  2⤵
  PID:9356
- C:\Windows\System\mRufkgk.exe
  C:\Windows\System\mRufkgk.exe
  2⤵
  PID:8944
- C:\Windows\System\yqTeRSe.exe
  C:\Windows\System\yqTeRSe.exe
  2⤵
  PID:9432
- C:\Windows\System\vFjHUga.exe
  C:\Windows\System\vFjHUga.exe
  2⤵
  PID:9476
- C:\Windows\System\tUDrGJL.exe
  C:\Windows\System\tUDrGJL.exe
  2⤵
  PID:9532
- C:\Windows\System\TPQqxIz.exe
  C:\Windows\System\TPQqxIz.exe
  2⤵
  PID:9012
- C:\Windows\System\OABrbaG.exe
  C:\Windows\System\OABrbaG.exe
  2⤵
  PID:9044
- C:\Windows\System\JztvGla.exe
  C:\Windows\System\JztvGla.exe
  2⤵
  PID:7552
- C:\Windows\System\joKJcUV.exe
  C:\Windows\System\joKJcUV.exe
  2⤵
  PID:10272
- C:\Windows\System\QICJyIT.exe
  C:\Windows\System\QICJyIT.exe
  2⤵
  PID:9112
- C:\Windows\System\pNJfVOL.exe
  C:\Windows\System\pNJfVOL.exe
  2⤵
  PID:9148
- C:\Windows\System\ePknobG.exe
  C:\Windows\System\ePknobG.exe
  2⤵
  PID:9204
- C:\Windows\System\ZqjtJqk.exe
  C:\Windows\System\ZqjtJqk.exe
  2⤵
  PID:552
- C:\Windows\System\UGSCWah.exe
  C:\Windows\System\UGSCWah.exe
  2⤵
  PID:10424
- C:\Windows\System\WGUZXdq.exe
  C:\Windows\System\WGUZXdq.exe
  2⤵
  PID:6964
- C:\Windows\System\kDRbRcC.exe
  C:\Windows\System\kDRbRcC.exe
  2⤵
  PID:6600
- C:\Windows\System\MHVXbDx.exe
  C:\Windows\System\MHVXbDx.exe
  2⤵
  PID:6732
- C:\Windows\System\oXqtFxZ.exe
  C:\Windows\System\oXqtFxZ.exe
  2⤵
  PID:8748
- C:\Windows\System\KkIpnkW.exe
  C:\Windows\System\KkIpnkW.exe
  2⤵
  PID:10672
- C:\Windows\System\OUKiCsm.exe
  C:\Windows\System\OUKiCsm.exe
  2⤵
  PID:9364
- C:\Windows\System\isvSrez.exe
  C:\Windows\System\isvSrez.exe
  2⤵
  PID:10772
- C:\Windows\System\gbGVoom.exe
  C:\Windows\System\gbGVoom.exe
  2⤵
  PID:9512
- C:\Windows\System\imhsEMx.exe
  C:\Windows\System\imhsEMx.exe
  2⤵
  PID:4928
- C:\Windows\System\zjjJaUJ.exe
  C:\Windows\System\zjjJaUJ.exe
  2⤵
  PID:11272
- C:\Windows\System\JwraJyU.exe
  C:\Windows\System\JwraJyU.exe
  2⤵
  PID:11292
- C:\Windows\System\JQsrszb.exe
  C:\Windows\System\JQsrszb.exe
  2⤵
  PID:11316
- C:\Windows\System\SrKKQUa.exe
  C:\Windows\System\SrKKQUa.exe
  2⤵
  PID:11332
- C:\Windows\System\yIphDmA.exe
  C:\Windows\System\yIphDmA.exe
  2⤵
  PID:11356
- C:\Windows\System\WGmSmsX.exe
  C:\Windows\System\WGmSmsX.exe
  2⤵
  PID:11376
- C:\Windows\System\mfCRVZw.exe
  C:\Windows\System\mfCRVZw.exe
  2⤵
  PID:11396
- C:\Windows\System\WDXbrRm.exe
  C:\Windows\System\WDXbrRm.exe
  2⤵
  PID:11416
- C:\Windows\System\YlvbCqY.exe
  C:\Windows\System\YlvbCqY.exe
  2⤵
  PID:11436
- C:\Windows\System\TNcavlv.exe
  C:\Windows\System\TNcavlv.exe
  2⤵
  PID:11456
- C:\Windows\System\qsXjZPD.exe
  C:\Windows\System\qsXjZPD.exe
  2⤵
  PID:11620
- C:\Windows\System\NIHvSHv.exe
  C:\Windows\System\NIHvSHv.exe
  2⤵
  PID:11648
- C:\Windows\System\ktmlxiA.exe
  C:\Windows\System\ktmlxiA.exe
  2⤵
  PID:11664
- C:\Windows\System\lhjOAxN.exe
  C:\Windows\System\lhjOAxN.exe
  2⤵
  PID:11684
- C:\Windows\System\EwQEQwY.exe
  C:\Windows\System\EwQEQwY.exe
  2⤵
  PID:11704
- C:\Windows\System\iKKmloC.exe
  C:\Windows\System\iKKmloC.exe
  2⤵
  PID:11724
- C:\Windows\System\cbyLmes.exe
  C:\Windows\System\cbyLmes.exe
  2⤵
  PID:11744
- C:\Windows\System\LqkEDMd.exe
  C:\Windows\System\LqkEDMd.exe
  2⤵
  PID:11764
- C:\Windows\System\MRRILku.exe
  C:\Windows\System\MRRILku.exe
  2⤵
  PID:11784
- C:\Windows\System\hchnfkN.exe
  C:\Windows\System\hchnfkN.exe
  2⤵
  PID:11804
- C:\Windows\System\bJoxiFr.exe
  C:\Windows\System\bJoxiFr.exe
  2⤵
  PID:11824
- C:\Windows\System\jvtdysL.exe
  C:\Windows\System\jvtdysL.exe
  2⤵
  PID:11840
- C:\Windows\System\BVhgHTR.exe
  C:\Windows\System\BVhgHTR.exe
  2⤵
  PID:11856
- C:\Windows\System\oQNnUmp.exe
  C:\Windows\System\oQNnUmp.exe
  2⤵
  PID:11872
- C:\Windows\System\fJgnbBb.exe
  C:\Windows\System\fJgnbBb.exe
  2⤵
  PID:11888
- C:\Windows\System\rlwmcoi.exe
  C:\Windows\System\rlwmcoi.exe
  2⤵
  PID:11904
- C:\Windows\System\dpfqlRs.exe
  C:\Windows\System\dpfqlRs.exe
  2⤵
  PID:11920
- C:\Windows\System\iLSAhrH.exe
  C:\Windows\System\iLSAhrH.exe
  2⤵
  PID:11936
- C:\Windows\System\iNzogwr.exe
  C:\Windows\System\iNzogwr.exe
  2⤵
  PID:11952
- C:\Windows\System\vTEmGWo.exe
  C:\Windows\System\vTEmGWo.exe
  2⤵
  PID:11968
- C:\Windows\System\GVMpONi.exe
  C:\Windows\System\GVMpONi.exe
  2⤵
  PID:11984
- C:\Windows\System\OfEEwTF.exe
  C:\Windows\System\OfEEwTF.exe
  2⤵
  PID:12000
- C:\Windows\System\JtDbXJL.exe
  C:\Windows\System\JtDbXJL.exe
  2⤵
  PID:12048
- C:\Windows\System\iLMqcdb.exe
  C:\Windows\System\iLMqcdb.exe
  2⤵
  PID:12068
- C:\Windows\System\bzsSDgs.exe
  C:\Windows\System\bzsSDgs.exe
  2⤵
  PID:12084
- C:\Windows\System\MBJtzAo.exe
  C:\Windows\System\MBJtzAo.exe
  2⤵
  PID:12104
- C:\Windows\System\qNfsbBg.exe
  C:\Windows\System\qNfsbBg.exe
  2⤵
  PID:12120
- C:\Windows\System\RrpxkgU.exe
  C:\Windows\System\RrpxkgU.exe
  2⤵
  PID:12136
- C:\Windows\System\aXGvePj.exe
  C:\Windows\System\aXGvePj.exe
  2⤵
  PID:12160
- C:\Windows\System\VYtskYr.exe
  C:\Windows\System\VYtskYr.exe
  2⤵
  PID:12188
- C:\Windows\System\rewuAjo.exe
  C:\Windows\System\rewuAjo.exe
  2⤵
  PID:12204
- C:\Windows\System\lvzWudB.exe
  C:\Windows\System\lvzWudB.exe
  2⤵
  PID:12224
- C:\Windows\System\vwuVYyd.exe
  C:\Windows\System\vwuVYyd.exe
  2⤵
  PID:12244
- C:\Windows\System\sQIfxlt.exe
  C:\Windows\System\sQIfxlt.exe
  2⤵
  PID:12264
- C:\Windows\System\ngOPVfR.exe
  C:\Windows\System\ngOPVfR.exe
  2⤵
  PID:12284
- C:\Windows\System\biYtYIi.exe
  C:\Windows\System\biYtYIi.exe
  2⤵
  PID:2524
- C:\Windows\System\CrrKJsS.exe
  C:\Windows\System\CrrKJsS.exe
  2⤵
  PID:8304
- C:\Windows\System\JUYtcXC.exe
  C:\Windows\System\JUYtcXC.exe
  2⤵
  PID:8684
- C:\Windows\System\xHKEdPQ.exe
  C:\Windows\System\xHKEdPQ.exe
  2⤵
  PID:7044
- C:\Windows\System\EcqpGBf.exe
  C:\Windows\System\EcqpGBf.exe
  2⤵
  PID:8824
- C:\Windows\System\adhKOkY.exe
  C:\Windows\System\adhKOkY.exe
  2⤵
  PID:5912
- C:\Windows\System\NaZjnjN.exe
  C:\Windows\System\NaZjnjN.exe
  2⤵
  PID:8116
- C:\Windows\System\mKVPZbs.exe
  C:\Windows\System\mKVPZbs.exe
  2⤵
  PID:8048
- C:\Windows\System\WKopsdo.exe
  C:\Windows\System\WKopsdo.exe
  2⤵
  PID:6828
- C:\Windows\System\EPKWbCm.exe
  C:\Windows\System\EPKWbCm.exe
  2⤵
  PID:6980
- C:\Windows\System\WuUMfRs.exe
  C:\Windows\System\WuUMfRs.exe
  2⤵
  PID:12308
- C:\Windows\System\LyfFisr.exe
  C:\Windows\System\LyfFisr.exe
  2⤵
  PID:12328
- C:\Windows\System\tuhNcBc.exe
  C:\Windows\System\tuhNcBc.exe
  2⤵
  PID:12348
- C:\Windows\System\wxHjmUJ.exe
  C:\Windows\System\wxHjmUJ.exe
  2⤵
  PID:12368
- C:\Windows\System\cdELaLy.exe
  C:\Windows\System\cdELaLy.exe
  2⤵
  PID:12392
- C:\Windows\System\dGuTczZ.exe
  C:\Windows\System\dGuTczZ.exe
  2⤵
  PID:12424
- C:\Windows\System\aBIwIwF.exe
  C:\Windows\System\aBIwIwF.exe
  2⤵
  PID:12444
- C:\Windows\System\GlHcynd.exe
  C:\Windows\System\GlHcynd.exe
  2⤵
  PID:12464
- C:\Windows\System\KGrngNG.exe
  C:\Windows\System\KGrngNG.exe
  2⤵
  PID:12488
- C:\Windows\System\eUMcFYW.exe
  C:\Windows\System\eUMcFYW.exe
  2⤵
  PID:12512
- C:\Windows\System\SrOzVKX.exe
  C:\Windows\System\SrOzVKX.exe
  2⤵
  PID:12536
- C:\Windows\System\CwbbdWC.exe
  C:\Windows\System\CwbbdWC.exe
  2⤵
  PID:12556
- C:\Windows\System\LQRfudm.exe
  C:\Windows\System\LQRfudm.exe
  2⤵
  PID:12576
- C:\Windows\System\KnQuGTG.exe
  C:\Windows\System\KnQuGTG.exe
  2⤵
  PID:12600
- C:\Windows\System\gAGmUdl.exe
  C:\Windows\System\gAGmUdl.exe
  2⤵
  PID:12620
- C:\Windows\System\UuuDHeM.exe
  C:\Windows\System\UuuDHeM.exe
  2⤵
  PID:12644
- C:\Windows\System\aBGBSmK.exe
  C:\Windows\System\aBGBSmK.exe
  2⤵
  PID:12664
- C:\Windows\System\reThZwl.exe
  C:\Windows\System\reThZwl.exe
  2⤵
  PID:12688
- C:\Windows\System\ouuUmGq.exe
  C:\Windows\System\ouuUmGq.exe
  2⤵
  PID:12712
- C:\Windows\System\rMDcBvM.exe
  C:\Windows\System\rMDcBvM.exe
  2⤵
  PID:12732
- C:\Windows\System\VnTPuve.exe
  C:\Windows\System\VnTPuve.exe
  2⤵
  PID:12752
- C:\Windows\System\bJawuDA.exe
  C:\Windows\System\bJawuDA.exe
  2⤵
  PID:12776
- C:\Windows\System\dLyCQMb.exe
  C:\Windows\System\dLyCQMb.exe
  2⤵
  PID:12792
- C:\Windows\System\ECVAKsV.exe
  C:\Windows\System\ECVAKsV.exe
  2⤵
  PID:12824
- C:\Windows\System\otXRwVt.exe
  C:\Windows\System\otXRwVt.exe
  2⤵
  PID:12840
- C:\Windows\System\ArhaYJS.exe
  C:\Windows\System\ArhaYJS.exe
  2⤵
  PID:12864
- C:\Windows\System\OmUoZeb.exe
  C:\Windows\System\OmUoZeb.exe
  2⤵
  PID:12892
- C:\Windows\System\IeyCasq.exe
  C:\Windows\System\IeyCasq.exe
  2⤵
  PID:12912
- C:\Windows\System\yQeXmAW.exe
  C:\Windows\System\yQeXmAW.exe
  2⤵
  PID:12936
- C:\Windows\System\YSLadCs.exe
  C:\Windows\System\YSLadCs.exe
  2⤵
  PID:12956
- C:\Windows\System\XYeZihQ.exe
  C:\Windows\System\XYeZihQ.exe
  2⤵
  PID:12976
- C:\Windows\System\jnUWMvi.exe
  C:\Windows\System\jnUWMvi.exe
  2⤵
  PID:12992
- C:\Windows\System\PhlWYko.exe
  C:\Windows\System\PhlWYko.exe
  2⤵
  PID:13008
- C:\Windows\System\rHPWGYe.exe
  C:\Windows\System\rHPWGYe.exe
  2⤵
  PID:13032
- C:\Windows\System\sSpRbRP.exe
  C:\Windows\System\sSpRbRP.exe
  2⤵
  PID:13048
- C:\Windows\System\EksUrmh.exe
  C:\Windows\System\EksUrmh.exe
  2⤵
  PID:13076
- C:\Windows\System\jshsXHs.exe
  C:\Windows\System\jshsXHs.exe
  2⤵
  PID:13096
- C:\Windows\System\EoTMmyj.exe
  C:\Windows\System\EoTMmyj.exe
  2⤵
  PID:13124
- C:\Windows\System\mQDiGgh.exe
  C:\Windows\System\mQDiGgh.exe
  2⤵
  PID:13140
- C:\Windows\System\ZKulCyc.exe
  C:\Windows\System\ZKulCyc.exe
  2⤵
  PID:13168
- C:\Windows\System\PGwpqVp.exe
  C:\Windows\System\PGwpqVp.exe
  2⤵
  PID:13184
- C:\Windows\System\SebQKGg.exe
  C:\Windows\System\SebQKGg.exe
  2⤵
  PID:13200
- C:\Windows\System\SqsYGxG.exe
  C:\Windows\System\SqsYGxG.exe
  2⤵
  PID:9612
- C:\Windows\System\XPdfTlr.exe
  C:\Windows\System\XPdfTlr.exe
  2⤵
  PID:9632
- C:\Windows\System\sRHPnrq.exe
  C:\Windows\System\sRHPnrq.exe
  2⤵
  PID:9648
- C:\Windows\System\MeNbYPL.exe
  C:\Windows\System\MeNbYPL.exe
  2⤵
  PID:11180
- C:\Windows\System\zWygrWf.exe
  C:\Windows\System\zWygrWf.exe
  2⤵
  PID:11836
- C:\Windows\System\WFHoxdv.exe
  C:\Windows\System\WFHoxdv.exe
  2⤵
  PID:11880
- C:\Windows\System\JCKKwhf.exe
  C:\Windows\System\JCKKwhf.exe
  2⤵
  PID:11912
- C:\Windows\System\BSdAZcz.exe
  C:\Windows\System\BSdAZcz.exe
  2⤵
  PID:4040
- C:\Windows\System\ihGkflW.exe
  C:\Windows\System\ihGkflW.exe
  2⤵
  PID:8820
- C:\Windows\System\CTbkXBb.exe
  C:\Windows\System\CTbkXBb.exe
  2⤵
  PID:12472
- C:\Windows\System\iRGvecj.exe
  C:\Windows\System\iRGvecj.exe
  2⤵
  PID:12612
- C:\Windows\System\vIvAEGY.exe
  C:\Windows\System\vIvAEGY.exe
  2⤵
  PID:12680
- C:\Windows\System\tobluai.exe
  C:\Windows\System\tobluai.exe
  2⤵
  PID:12832
- C:\Windows\System\gdCfRKb.exe
  C:\Windows\System\gdCfRKb.exe
  2⤵
  PID:12908
- C:\Windows\System\cRJVxIx.exe
  C:\Windows\System\cRJVxIx.exe
  2⤵
  PID:12968
- C:\Windows\System\HCTKMCK.exe
  C:\Windows\System\HCTKMCK.exe
  2⤵
  PID:13000
- C:\Windows\System\TAYYmPN.exe
  C:\Windows\System\TAYYmPN.exe
  2⤵
  PID:13064
- C:\Windows\System\soJwQmX.exe
  C:\Windows\System\soJwQmX.exe
  2⤵
  PID:13152
- C:\Windows\System\KVkmvPp.exe
  C:\Windows\System\KVkmvPp.exe
  2⤵
  PID:13192
- C:\Windows\System\EPrgvfS.exe
  C:\Windows\System\EPrgvfS.exe
  2⤵
  PID:13216
- C:\Windows\System\UCiiGLW.exe
  C:\Windows\System\UCiiGLW.exe
  2⤵
  PID:13232
- C:\Windows\System\LQEkpGb.exe
  C:\Windows\System\LQEkpGb.exe
  2⤵
  PID:13264
- C:\Windows\System\IuGiFaz.exe
  C:\Windows\System\IuGiFaz.exe
  2⤵
  PID:12496
- C:\Windows\System\evUkWGp.exe
  C:\Windows\System\evUkWGp.exe
  2⤵
  PID:9968
- C:\Windows\System\JGteUlf.exe
  C:\Windows\System\JGteUlf.exe
  2⤵
  PID:11048
- C:\Windows\System\JPcyDcP.exe
  C:\Windows\System\JPcyDcP.exe
  2⤵
  PID:11136
- C:\Windows\System\bUXogGS.exe
  C:\Windows\System\bUXogGS.exe
  2⤵
  PID:9756
- C:\Windows\System\KVpvgFB.exe
  C:\Windows\System\KVpvgFB.exe
  2⤵
  PID:11244
- C:\Windows\System\fNmVxgh.exe
  C:\Windows\System\fNmVxgh.exe
  2⤵
  PID:10992
- C:\Windows\System\UmfqURE.exe
  C:\Windows\System\UmfqURE.exe
  2⤵
  PID:11044
- C:\Windows\System\NyQXKPk.exe
  C:\Windows\System\NyQXKPk.exe
  2⤵
  PID:8364
- C:\Windows\System\HoQuuiF.exe
  C:\Windows\System\HoQuuiF.exe
  2⤵
  PID:11740
- C:\Windows\System\erkbXbG.exe
  C:\Windows\System\erkbXbG.exe
  2⤵
  PID:8168
- C:\Windows\System\jkowJTe.exe
  C:\Windows\System\jkowJTe.exe
  2⤵
  PID:8208
- C:\Windows\System\LhnOyVE.exe
  C:\Windows\System\LhnOyVE.exe
  2⤵
  PID:8260
- C:\Windows\System\hrNPyCu.exe
  C:\Windows\System\hrNPyCu.exe
  2⤵
  PID:9796
- C:\Windows\System\foQaskV.exe
  C:\Windows\System\foQaskV.exe
  2⤵
  PID:12704
- C:\Windows\System\keaZLPq.exe
  C:\Windows\System\keaZLPq.exe
  2⤵
  PID:12096
- C:\Windows\System\ECrWYJA.exe
  C:\Windows\System\ECrWYJA.exe
  2⤵
  PID:9932
- C:\Windows\System\fDpBeRP.exe
  C:\Windows\System\fDpBeRP.exe
  2⤵
  PID:9428
- C:\Windows\System\eFrvqbQ.exe
  C:\Windows\System\eFrvqbQ.exe
  2⤵
  PID:12984
- C:\Windows\System\FxbNmkb.exe
  C:\Windows\System\FxbNmkb.exe
  2⤵
  PID:12928
- C:\Windows\System\gOwrsbq.exe
  C:\Windows\System\gOwrsbq.exe
  2⤵
  PID:5988
- C:\Windows\System\rxPqUkg.exe
  C:\Windows\System\rxPqUkg.exe
  2⤵
  PID:11260
- C:\Windows\System\rMhbctL.exe
  C:\Windows\System\rMhbctL.exe
  2⤵
  PID:11820
- C:\Windows\System\hGFzOrx.exe
  C:\Windows\System\hGFzOrx.exe
  2⤵
  PID:11012
- C:\Windows\System\WABdqhE.exe
  C:\Windows\System\WABdqhE.exe
  2⤵
  PID:8204
- C:\Windows\System\GCAsRcg.exe
  C:\Windows\System\GCAsRcg.exe
  2⤵
  PID:8264
- C:\Windows\System\GPWBIxY.exe
  C:\Windows\System\GPWBIxY.exe
  2⤵
  PID:60
- C:\Windows\System\TkroAAn.exe
  C:\Windows\System\TkroAAn.exe
  2⤵
  PID:11948
- C:\Windows\System\yYysGHH.exe
  C:\Windows\System\yYysGHH.exe
  2⤵
  PID:11900
- C:\Windows\System\TaWOuKT.exe
  C:\Windows\System\TaWOuKT.exe
  2⤵
  PID:4536
- C:\Windows\System\ffkiXSI.exe
  C:\Windows\System\ffkiXSI.exe
  2⤵
  PID:12700
- C:\Windows\System\aXiCLmT.exe
  C:\Windows\System\aXiCLmT.exe
  2⤵
  PID:2648
- C:\Windows\System\mrBpHrE.exe
  C:\Windows\System\mrBpHrE.exe
  2⤵
  PID:12988
- C:\Windows\System\YAiKXJF.exe
  C:\Windows\System\YAiKXJF.exe
  2⤵
  PID:2248
- C:\Windows\System\PyiXiUT.exe
  C:\Windows\System\PyiXiUT.exe
  2⤵
  PID:11928
- C:\Windows\System\IyRmYBg.exe
  C:\Windows\System\IyRmYBg.exe
  2⤵
  PID:13244
- C:\Windows\System\FxxZyyn.exe
  C:\Windows\System\FxxZyyn.exe
  2⤵
  PID:2892
- C:\Windows\System\UBMKVrH.exe
  C:\Windows\System\UBMKVrH.exe
  2⤵
  PID:1240
- C:\Windows\System\oWhTyWg.exe
  C:\Windows\System\oWhTyWg.exe
  2⤵
  PID:2060
- C:\Windows\System\rREnuVA.exe
  C:\Windows\System\rREnuVA.exe
  2⤵
  PID:916
- C:\Windows\System\ZnxIGZq.exe
  C:\Windows\System\ZnxIGZq.exe
  2⤵
  PID:5364
- C:\Windows\System\exytAuO.exe
  C:\Windows\System\exytAuO.exe
  2⤵
  PID:6848
- C:\Windows\System\POcSeJq.exe
  C:\Windows\System\POcSeJq.exe
  2⤵
  PID:6248
- C:\Windows\System\mHgEZdR.exe
  C:\Windows\System\mHgEZdR.exe
  2⤵
  PID:9588
- C:\Windows\System\GMIemdn.exe
  C:\Windows\System\GMIemdn.exe
  2⤵
  PID:12212
- C:\Windows\System\xbkqjgf.exe
  C:\Windows\System\xbkqjgf.exe
  2⤵
  PID:12572
- C:\Windows\System\HYbXkFA.exe
  C:\Windows\System\HYbXkFA.exe
  2⤵
  PID:9780
- C:\Windows\System\zSkkdBM.exe
  C:\Windows\System\zSkkdBM.exe
  2⤵
  PID:13328
- C:\Windows\System\CwqDrew.exe
  C:\Windows\System\CwqDrew.exe
  2⤵
  PID:13356
- C:\Windows\System\JXIeEQF.exe
  C:\Windows\System\JXIeEQF.exe
  2⤵
  PID:13540
- C:\Windows\System\WquPOZF.exe
  C:\Windows\System\WquPOZF.exe
  2⤵
  PID:13556
- C:\Windows\System\bhFrfHT.exe
  C:\Windows\System\bhFrfHT.exe
  2⤵
  PID:13580
- C:\Windows\System\JcFwLIu.exe
  C:\Windows\System\JcFwLIu.exe
  2⤵
  PID:13760
- C:\Windows\System\pjrgVkg.exe
  C:\Windows\System\pjrgVkg.exe
  2⤵
  PID:13776
- C:\Windows\System\ymfNfLs.exe
  C:\Windows\System\ymfNfLs.exe
  2⤵
  PID:13972
- C:\Windows\System\KoRTVzK.exe
  C:\Windows\System\KoRTVzK.exe
  2⤵
  PID:13988
- C:\Windows\System\IbiVWzG.exe
  C:\Windows\System\IbiVWzG.exe
  2⤵
  PID:14008
- C:\Windows\System\QvuVVGc.exe
  C:\Windows\System\QvuVVGc.exe
  2⤵
  PID:14028
- C:\Windows\System\VeBYbrp.exe
  C:\Windows\System\VeBYbrp.exe
  2⤵
  PID:14048
- C:\Windows\System\YSiyAOz.exe
  C:\Windows\System\YSiyAOz.exe
  2⤵
  PID:14064
- C:\Windows\System\vHVHkqF.exe
  C:\Windows\System\vHVHkqF.exe
  2⤵
  PID:14080
- C:\Windows\System\LAKWHtj.exe
  C:\Windows\System\LAKWHtj.exe
  2⤵
  PID:14100
- C:\Windows\System\QchVXLV.exe
  C:\Windows\System\QchVXLV.exe
  2⤵
  PID:14128
- C:\Windows\System\pjPTAwh.exe
  C:\Windows\System\pjPTAwh.exe
  2⤵
  PID:9860
- C:\Windows\System\jgybxje.exe
  C:\Windows\System\jgybxje.exe
  2⤵
  PID:11868
- C:\Windows\System\derqhUr.exe
  C:\Windows\System\derqhUr.exe
  2⤵
  PID:10980
- C:\Windows\System\HZsDqsO.exe
  C:\Windows\System\HZsDqsO.exe
  2⤵
  PID:11216
- C:\Windows\System\tgWSDvj.exe
  C:\Windows\System\tgWSDvj.exe
  2⤵
  PID:3064
- C:\Windows\System\kkcvDLx.exe
  C:\Windows\System\kkcvDLx.exe
  2⤵
  PID:13016
- C:\Windows\System\btfHdFc.exe
  C:\Windows\System\btfHdFc.exe
  2⤵
  PID:13344
- C:\Windows\System\bpaylvW.exe
  C:\Windows\System\bpaylvW.exe
  2⤵
  PID:13704
- C:\Windows\System\luEwGYS.exe
  C:\Windows\System\luEwGYS.exe
  2⤵
  PID:13504
- C:\Windows\System\dUlCLiC.exe
  C:\Windows\System\dUlCLiC.exe
  2⤵
  PID:13588
- C:\Windows\System\rUyAIFI.exe
  C:\Windows\System\rUyAIFI.exe
  2⤵
  PID:13676
- C:\Windows\System\bvasIrG.exe
  C:\Windows\System\bvasIrG.exe
  2⤵
  PID:13720
- C:\Windows\System\DYxEYRK.exe
  C:\Windows\System\DYxEYRK.exe
  2⤵
  PID:13736
- C:\Windows\System\JrxCMHc.exe
  C:\Windows\System\JrxCMHc.exe
  2⤵
  PID:13784
- C:\Windows\System\lJyCsFf.exe
  C:\Windows\System\lJyCsFf.exe
  2⤵
  PID:13924
- C:\Windows\System\sZWoYmD.exe
  C:\Windows\System\sZWoYmD.exe
  2⤵
  PID:13912
- C:\Windows\System\pWwghQq.exe
  C:\Windows\System\pWwghQq.exe
  2⤵
  PID:13936
- C:\Windows\System\imnuqiu.exe
  C:\Windows\System\imnuqiu.exe
  2⤵
  PID:14024
- C:\Windows\System\ggmjpFE.exe
  C:\Windows\System\ggmjpFE.exe
  2⤵
  PID:13980
- C:\Windows\System\mWDeruG.exe
  C:\Windows\System\mWDeruG.exe
  2⤵
  PID:14016
- C:\Windows\System\nmpTEoh.exe
  C:\Windows\System\nmpTEoh.exe
  2⤵
  PID:14116
- C:\Windows\System\Tjikeje.exe
  C:\Windows\System\Tjikeje.exe
  2⤵
  PID:14148
- C:\Windows\System\kBnjdKt.exe
  C:\Windows\System\kBnjdKt.exe
  2⤵
  PID:14220
- C:\Windows\System\UsBAfnQ.exe
  C:\Windows\System\UsBAfnQ.exe
  2⤵
  PID:14264
- C:\Windows\System\xASSFsk.exe
  C:\Windows\System\xASSFsk.exe
  2⤵
  PID:13336
- C:\Windows\System\fZCmakC.exe
  C:\Windows\System\fZCmakC.exe
  2⤵
  PID:14320
- C:\Windows\System\GaAwVAt.exe
  C:\Windows\System\GaAwVAt.exe
  2⤵
  PID:11092
- C:\Windows\System\dvievvr.exe
  C:\Windows\System\dvievvr.exe
  2⤵
  PID:11980
- C:\Windows\System\EgyflzY.exe
  C:\Windows\System\EgyflzY.exe
  2⤵
  PID:13420
- C:\Windows\System\YOdnCBI.exe
  C:\Windows\System\YOdnCBI.exe
  2⤵
  PID:13484
- C:\Windows\System\MOGLChS.exe
  C:\Windows\System\MOGLChS.exe
  2⤵
  PID:13520
- C:\Windows\System\lwjcgpV.exe
  C:\Windows\System\lwjcgpV.exe
  2⤵
  PID:13648
- C:\Windows\System\lPEHeRQ.exe
  C:\Windows\System\lPEHeRQ.exe
  2⤵
  PID:13920
- C:\Windows\System\ImAiXzD.exe
  C:\Windows\System\ImAiXzD.exe
  2⤵
  PID:14120
- C:\Windows\System\OTaFMuH.exe
  C:\Windows\System\OTaFMuH.exe
  2⤵
  PID:14152
- C:\Windows\System\QNvWJuV.exe
  C:\Windows\System\QNvWJuV.exe
  2⤵
  PID:14272
- C:\Windows\System\YMpdAsD.exe
  C:\Windows\System\YMpdAsD.exe
  2⤵
  PID:4320
- C:\Windows\System\fUPUfcP.exe
  C:\Windows\System\fUPUfcP.exe
  2⤵
  PID:1680
- C:\Windows\System\dwuLKlO.exe
  C:\Windows\System\dwuLKlO.exe
  2⤵
  PID:748
- C:\Windows\System\YspwdzK.exe
  C:\Windows\System\YspwdzK.exe
  2⤵
  PID:8232
- C:\Windows\System\XdVvNMA.exe
  C:\Windows\System\XdVvNMA.exe
  2⤵
  PID:13740
- C:\Windows\System\IVMdSza.exe
  C:\Windows\System\IVMdSza.exe
  2⤵
  PID:13524
- C:\Windows\System\hxoyyfl.exe
  C:\Windows\System\hxoyyfl.exe
  2⤵
  PID:9144
- C:\Windows\System\wPEHQCf.exe
  C:\Windows\System\wPEHQCf.exe
  2⤵
  PID:1548
- C:\Windows\System\FVvtlYE.exe
  C:\Windows\System\FVvtlYE.exe
  2⤵
  PID:13444
- C:\Windows\System\IDBNhaB.exe
  C:\Windows\System\IDBNhaB.exe
  2⤵
  PID:4836
- C:\Windows\System\SOWucbz.exe
  C:\Windows\System\SOWucbz.exe
  2⤵
  PID:13340
- C:\Windows\System\joBcyoK.exe
  C:\Windows\System\joBcyoK.exe
  2⤵
  PID:4112
- C:\Windows\System\ZHtzehK.exe
  C:\Windows\System\ZHtzehK.exe
  2⤵
  PID:2488
- C:\Windows\System\tWIZlNT.exe
  C:\Windows\System\tWIZlNT.exe
  2⤵
  PID:1232
- C:\Windows\System\JAERnRf.exe
  C:\Windows\System\JAERnRf.exe
  2⤵
  PID:1568
- C:\Windows\System\VANHyER.exe
  C:\Windows\System\VANHyER.exe
  2⤵
  PID:12364
- C:\Windows\System\nTURjJZ.exe
  C:\Windows\System\nTURjJZ.exe
  2⤵
  PID:14112
- C:\Windows\System\pVCOabH.exe
  C:\Windows\System\pVCOabH.exe
  2⤵
  PID:2400
- C:\Windows\System\ilQJWJn.exe
  C:\Windows\System\ilQJWJn.exe
  2⤵
  PID:14304
- C:\Windows\System\dHEHLfT.exe
  C:\Windows\System\dHEHLfT.exe
  2⤵
  PID:1936

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:13752

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:10536

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:4048

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2728

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_53uhcugz.rol.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BPVqGZx.exe

Filesize
2.0MB

MD5
2dc5dfa9a049a359ca5b622d3292ee49

SHA1
37b80ebb0c3ae5c1a126ef2ff09371acdc4bd8c7

SHA256
f673edb761aea53e1649f8dccafc88fa92726ae751814a616e62f80e3e7d5a51

SHA512
9e61aff81ccffbe99651526380fdb0281ec6761b27bd1db5a94d9812b2921568bfc17f24b6b57b6aea4dba16a2843fa214b0fe6fcbe25408b12d5e35895b586c

Download Submit
C:\Windows\System\CGBXgQm.exe

Filesize
1.9MB

MD5
487b1b6c13ec7837fa703747409eb3cf

SHA1
5db15bd5b82579660d193b61cc81b1afe1d61572

SHA256
118111eec7e214625cd81dc775a708374b5aae06f9c3a6a27cfa37c312a0f043

SHA512
dcc56642f9b321f3a5ce3ef494a33754fd086fe300fade2e33b814d9e195f49dc890b397b4cbe950de8d5c29a911790930881dc68e14ed586da5f9cbacfa2856

Download Submit
C:\Windows\System\CIXVoUe.exe

Filesize
2.0MB

MD5
88e187390855aa3ed835090160aa1677

SHA1
be8fe3423a3d75f78659d447c2f6845d5b27e839

SHA256
c349d20149f2d8ca2779dd0375c942113695ea7c983cf109f36f1f658b18414b

SHA512
a0c5ea218ed9acda9f55b5de219c2749605bc8fa84610f264991d69509fbc07af4ccbf980edd6d65091a92ec9fc80a80a3b548e36ab4b6034cad33b45277e265

Download Submit
C:\Windows\System\CJyvGDr.exe

Filesize
1.9MB

MD5
131d4c71ac38285748f3d0e732bfa5d3

SHA1
22c0f6dc33440aa1d0a0acc07fc9bf41adf68538

SHA256
50b0a7e717f49c3fe92954f93e6b89be55183c9fcf52b67e58f6f45f9aa06eed

SHA512
a9d954a1ca51a9e004713b0ffb33aa9b4a5585cde14826b6367d9b9e18a06be01fa29ec49eba47248af0611424e6bdafb34e592c9d25a8f6e77841cfe96f2aa1

Download Submit
C:\Windows\System\CtVOdTY.exe

Filesize
2.0MB

MD5
665a6dd9c02fd32164b1c2fc7106fd8c

SHA1
057c3a1ff5cf6e5e61234050773e19cbdf6f3f5d

SHA256
c06a2ebb4d38487fafa6f048dc50e718e14c7f655857350a0d2ba7b0afe75c87

SHA512
4e6f60fbc3b8bfdde2b16de7d9f21eafb24d26f7667b852543cf18598737a4119d492ac26a6ec00f1dd6e2e849e57f934c2a10019d9e56c41baab479300ea430

Download Submit
C:\Windows\System\DxSlYHR.exe

Filesize
1.9MB

MD5
a778cd614dadce1437864e439efe9aa4

SHA1
f71e0306492846abf6c97abe949b5bdf22f35923

SHA256
8ee7f1ba398cb2e65a051f538ee64090aee0bf8503b90994c68a3076cc4ce5d9

SHA512
c5ab8269f69623984e714df4be0d601cd7c8b045d454c3c606dc0d3055a310cb1abb160897a0d2a6b70d9f3aea6a5eb191820b2d4bd8f2aa554fb93c9bc6cc10

Download Submit
C:\Windows\System\EMnseCQ.exe

Filesize
1.9MB

MD5
a10664ffd13d32a19bbbc848059baaee

SHA1
d91eebdc6b20381b28e3a5c10b3686ea0561307a

SHA256
6a25d37e6ccff308fe96ec0a06b3ca9948c9cf4d9b29c53b009d6c6d5a374727

SHA512
b7146861fb481a7312f56d341f47cb677d1d1c2f6b39a37b22ef63e0945cad83bb7a5a2e05dcebc39c4afe7dace0fe4168bdb34c01f217bfd90c5645001e10da

Download Submit
C:\Windows\System\ETKChnH.exe

Filesize
2.0MB

MD5
597f83ef79ab32f501d94e738bfab454

SHA1
f5630f5d23bcbf6d5e1176b678222cd43e0a8853

SHA256
28fa9d8eb987dd094117e3817ff7551170da4c9519b0f1f8e0de8023ab4f58c2

SHA512
9d1b3dd2229527445acb45cc8637ef4f02ec0aa079fbe1c56b4a23fb2e4e152b7487b5be559926d23dcb6b1f5dea04f95de4cef1d7027e7ff03110e4be4771c9

Download Submit
C:\Windows\System\EzeXIdp.exe

Filesize
1.9MB

MD5
9c40c0f0358fa7428db18230dec3ff19

SHA1
2ad24ad903a054c81597733aa4193e985a765915

SHA256
f6077e1fd99a8a3440d934ae446b9f4577d8b9b3463e326184f9d27443199966

SHA512
3eb04b55516468d3d3764e0840e257eced9e95cbede8503501a7fc246592aea12c21ea2ac017ab81073b8c30db457c4a39b37fc2ac8aaac3dc801cf96ab8309c

Download Submit
C:\Windows\System\IiEsloV.exe

Filesize
1.9MB

MD5
58046da05f2581aac4183087ca1e180c

SHA1
40b3eedc2aa201028b03e536e2a6466e627f1faf

SHA256
5bb4d5748674093952c3b2a07baa73786daef7f5b0706122994c8140262c49d0

SHA512
7e9674840689a6f577e685eb39c9be9dced3bcab9197efd1bd22d15c45acc767e9ed1e50a071405eb7239d9831990f5c3029b681243a292dcbdaf854f0cfed7d

Download Submit
C:\Windows\System\IiThthM.exe

Filesize
2.0MB

MD5
86ceb32b72aa1e7d2218170189d55da3

SHA1
c662cdf455414a38444290cb760c3463d43e50a9

SHA256
079c5eb01aea4a413494133fab28dd015ae6d915bf9642b5e48b4bc2ab5685cb

SHA512
2870c8b82a016d3dd48918add033bd264551d73c5ca483fe41e3916e153262698873313c18dc66a2d40c87bae4663c2163f48f4e5841b91bfa70f9d191522db1

Download Submit
C:\Windows\System\KIHOlWv.exe

Filesize
2.0MB

MD5
872bd967f1284d0d5691cf47fa36e55b

SHA1
56ae75769a76aeecb4ac30bb21104e393d886d7a

SHA256
a506818046ad6fb60fab5f56e338514d239b4c985134572b638e90996d225328

SHA512
e7aaacfabbfdbf0abff23f385f4370e731c5b42e0d6bf5242914812aca421d847f8d762f594ca03450332941fc5ac35fcc3b0ed89755e46c016174bc35dc351f

Download Submit
C:\Windows\System\KaJuJLz.exe

Filesize
1.9MB

MD5
934dd1d6e951e212b05d1663987265db

SHA1
4e4185f9229d67548d5b9d9a2b3a2e30bc6bf3f6

SHA256
9d44bf9ccf929b4491d48ce308d6af2e78a6b678b1ec5d051e97b66e543a54d0

SHA512
296fa9f33894fc552015eb0ed87c6c92c54e16ccd2f8f3dbacf73ec29c12f8e25191e4592e788bbac565dfd4e221a6b1d730c990da61e778d4a35f0f3cef0fe3

Download Submit
C:\Windows\System\KzdZKkV.exe

Filesize
2.0MB

MD5
e479c7e5023c543ab7720a9c7a40878d

SHA1
900d8abd4b861980d38f586b722e2aac657428b2

SHA256
6ba12389d053c8b870423d996243d77a01afdb98f1644020421d1532de6e123d

SHA512
9eba899093178fcca0bff5e76a894e4a108a9c737dff3b317f27958255efbf71b72777883d56c197acc60077fa461fd80546cf708b8eb4808cfc02610dc4dfa8

Download Submit
C:\Windows\System\LjIFQtO.exe

Filesize
1.9MB

MD5
1a680be64001eb998d635074e5a9a6df

SHA1
5a703e7a8eb9a3aca2b70b234c50013169be4d9e

SHA256
13760d555edf9c02ae0a24fbbfe2f09e3b42a679e6dde24ed0d86452f2a3e2af

SHA512
9ed3b1981944727fe8a241ae29706cabacd09e6c8d88d0446e788cf42a5fbefef415cec7ee6bf7d7e4bd09da6ecab9054d71145076fe099a1b07a8804cb5c88c

Download Submit
C:\Windows\System\MOtDDOR.exe

Filesize
1.9MB

MD5
764e0dd89beb27bac3582d5770a9d029

SHA1
c29bf2af990f99e9b0a612dc92d6e7e2de8cc83d

SHA256
8ed283cb62597c089a214205564ffd8525130aa22e1c21f9eaaa342435e390fd

SHA512
6f8433710feb5321a4e0ecae65c79275411f2174f6a4a95457e46addba5f87a020653661d0bdd24174a9b99d8ff7333dde7f655151cdbc57d4ebd435e5f7d2ce

Download Submit
C:\Windows\System\MyjfjBo.exe

Filesize
1.9MB

MD5
87025f8ec62be8e4f14f8645716958c1

SHA1
43bd93dc25fc4ec1f6c6b7a41df750211de53b6b

SHA256
3ca7a410cca814dc8d1e7971ee067746b43653019aba47924ef09ebe110388c9

SHA512
afd9d0028732df39b6659cfd8d92b06358ffd8b34c0a680c86c1892292b838b991160dd2e000b429c0bd08114273c01a8d426c6aad140aaf6fad9cd33357495c

Download Submit
C:\Windows\System\NLLIyqs.exe

Filesize
1.9MB

MD5
e7430da8f1f5c59ea05c3f3e9dc76670

SHA1
523fb86b92fecd1b3cccc32b35dfaacc23c4eac7

SHA256
7824a930f72d000051097b932f74fdfb5b662697ea1b2608b198c71013a70b54

SHA512
9d24295113b3d0db984ec48e07befdd7f5e3f8bbf8ad4f18027a090b16eab7d6943da091570fd0ef9ebdce8ef0818ddb1d1d8d686f7f56ad41d7af06915731ae

Download Submit
C:\Windows\System\NmnEbNm.exe

Filesize
1.9MB

MD5
6c439a449562cb2a82998ba3c485480e

SHA1
3b45831ddac335a837dfbcee339a7d530842d037

SHA256
ea040073f0648b034a6198a65a1c0b1ae91cf58031fe9d81ac046d4cf46643c0

SHA512
aab8f941f66b75a9ad9d6985835540ee2c62334d82a193a2c380779940c7bbf58d6944406ff3b4aa3e535835b145f3d04686f9897210852fe17a699059aee800

Download Submit
C:\Windows\System\PHUwqhj.exe

Filesize
1.9MB

MD5
36db3af5d3edf0b2842c0596c1ba2c47

SHA1
b63be0864e855a85d33a5dab3bced2b024f5b69f

SHA256
59809c05ba7412a5322f9020ba5580e4651e6fa794d153e7fc482cd123a3d060

SHA512
c1d5ba80483cbfddeea94a1159fc65fd427228d485894bb839fa82c145c4542605d0c610749774786e5fdb462487a26337e8ef8e8ffda817a07f87ff2d4ab9e3

Download Submit
C:\Windows\System\PMyarXh.exe

Filesize
1.9MB

MD5
dc1cc33a412b1d3ba26dbb1eb8d101d2

SHA1
a459189923e8526c0892bd81038ac09daa4ef69b

SHA256
2919e9ce1b5949b999033d78dc35cc6d306a29deba596edefe3327a622f74ed8

SHA512
aa487c80f0f86b1ab392962c7cf989d421698d69c294a85e8169ba9f90e1c8498ad74bc66948688022c23d07f7d5414fdbde5d0ca3a1dc22bdfaffc453c4adbd

Download Submit
C:\Windows\System\RJynmwQ.exe

Filesize
8B

MD5
f6061fc6a7c99ae821a125be5d34b682

SHA1
cd62deeb3efa237b04e342e9238578fd370ae14d

SHA256
700c9a719b011e50437e2fa1d083a87e3381f4f178b8b9f9899f4bbf7503df60

SHA512
cc6b78f85499cc18661ced0cca34cc6f25b4f82783646930e95bb966639561cabaf13feff5c13c58aa77b6804729d0ec64978f44b9a573d37b44aa1603320b3d

Download Submit
C:\Windows\System\RZJbmoc.exe

Filesize
1.9MB

MD5
3919bfff1ceabbb57a9d7149ee7146b9

SHA1
15918ca6b518723701b06caf2b301d0f4a1ef173

SHA256
bb143db9fb2aec004b461ddffc2f506ef33a04345b77f8d28ce16e1a1af3977d

SHA512
af203d56064ee1fb1ddf5eacc2e0326cc6106e674dee71e37d59b24f98aea2aec8620531aca978937e709203022c836ecf0ef60a8621685ccf63733c47571bc4

Download Submit
C:\Windows\System\SWrBkgV.exe

Filesize
1.9MB

MD5
d83672e8106b0f6102b548ab0ef044b5

SHA1
2013c85a33ff138d506ef7f9247d43f3a5b4d322

SHA256
4f24525d2eb574fc4c89c4a623f8172939b795bf13fd505d80ec12247df34d12

SHA512
49bf46ef837331528a2fca0b55ac04389d31bf5a98e2938aa00aadd168c57b4fd95d6bfed2f6f6d844407eed3d84926a8ef0f068dddcf184489f1439a720c0dc

Download Submit
C:\Windows\System\SoyqkyK.exe

Filesize
2.0MB

MD5
d333d739477e8093af89d892f8532758

SHA1
d88b44df78c05c3f693ced7c25643941081faa98

SHA256
902b63a9ddb16dd10f83c3ef87ee0128abcf3aa0b894208b3a662fa34437dc88

SHA512
063e007e119e6af0df55d4449df7d76421917951a99e1b98f87f5f3ce400fbf5ed807a09ad940efb3ad69725250e8c688aac37fea3368724fea1829c326465ed

Download Submit
C:\Windows\System\VKSPWQD.exe

Filesize
2.0MB

MD5
6b7b1a7d15223eb4a1ac7d9cca9f27a8

SHA1
cba1cd00d1a6163edfff9a151efb97b9f5fb69e2

SHA256
9fdf0375575c66947c8e4a4a4fda1b44cfa4b150c14dd1d5db3b844f308bbfe2

SHA512
0c4efd9eafa412331b646f08c45dff2ba98e77ade5aaef83a016a27c2466af33364408ad566cd093f385b2431db54784dd7738903af51ba6d93d11dd43a3904a

Download Submit
C:\Windows\System\VffgPSo.exe

Filesize
2.0MB

MD5
58bca901f1024575badab5c3c8bdb70b

SHA1
1dfa83ab77ccad774712cb29ed920e4883f5b36c

SHA256
c031c872b13bdcc558400f4a85f97175549a9b979be4cc11578ab8428ff656ea

SHA512
db1bb3c8a58264a69bd5a4e3e86bae26d513a9d161dddf691b726a3625d4fa44db83550d45dbfbad285584af81174ee02751a61764cc7810543490e1e1285361

Download Submit
C:\Windows\System\WhFwmyj.exe

Filesize
1.9MB

MD5
b9215458d5ff396ed3e1cfab3f4c66ca

SHA1
47b9b00f1c9fc6abbc91bd83a2cce3d88099dbec

SHA256
195ad409e98f411d65a07920a897f888dc3c97ad0441bcf07a4c7d667704584e

SHA512
1b574e61b6139fb135554afeaaae6ae1072ab478e35674f7d27c823f496526a0b80db83768b907f6f0cd9fac57002d9b97e1e7d68cc103a1bc17f967b4a7e0cb

Download Submit
C:\Windows\System\ZcIGFWR.exe

Filesize
1.9MB

MD5
2bbe6fff03862dd121f06d49e4ef47d9

SHA1
1cfe1bd4eced5a03284d9953d441b10d2df402f0

SHA256
35fd215f899b004214ed54d5139ead97735a00a5869f456ac3b4344e64a5d8c8

SHA512
9aba0919fd59a02938b00b10a4795059b7695316f2b4d6eb8571eb3a560b7873818d5a748423d3fef96391779e0a1683f6ecb6d180b4d73ee9eebdb6b52ef267

Download Submit
C:\Windows\System\asFirlK.exe

Filesize
2.0MB

MD5
3f2ff535e56cfe8ae64dcb26ab3bbe07

SHA1
b673bc899de3365c7b9b331d75af3d0702702c52

SHA256
e503868e09e8e84753fc21b72b4ad053ff2cb21b5f46c6c752fb5d5ed6e3579d

SHA512
c3f2b750ecf40a2f72f78bd99344c8ac61fb935c30e4da8280e97352bd8ac2f22a665ec49385525f493a6d27ab26d358cb5d7dc37c9174a4de6a8e1ddabd8bec

Download Submit
C:\Windows\System\bBmAdvJ.exe

Filesize
2.0MB

MD5
81ceb7dced221dc8a52c54b5b0edbc09

SHA1
6b22c6eb1079dec229d93884b8995a10c8e28f74

SHA256
f8fe5d22d47b6d3e53bf047549a44221689a4f49e1a64d830f3f7cc343f3211f

SHA512
965e84e41ea4b969e5ce85e28184b429b065ab4cfd4481c5fbe9fc65b143f58e7927afd7e00d7fcad94d2c8c5ba9eafcd6588dc4390b9c3b20a312450e4bbf64

Download Submit
C:\Windows\System\bVsbCkj.exe

Filesize
1.9MB

MD5
44017dc2eca401caf9e3c3755d652fe4

SHA1
1ea155954d559b2ec1d5378736a92b8256292eb5

SHA256
dee76b28349c957986dbd0d69ccf7ba1de5724f96b5cea620b8853cdb65ffe02

SHA512
fd82ba08cc2e5d40abf18d2a056420b0ea8ca8aed56eda7f855c5a750b0a59de41a0413bf2911a11c98398f8aa9bb5c08d6959d1951066ea86d986f5e3556eb5

Download Submit
C:\Windows\System\cDnMpTI.exe

Filesize
2.0MB

MD5
e0919418d432ad41d662d8b8cb1cf15d

SHA1
f1f1e24b8aeae4dd78cdb87ccf2a317dd34e15c9

SHA256
a13b7740cc4edbbf0cacae0d7d6528bdc110236b7a58a676fc974a40a2293984

SHA512
4c346cc4983b2bcd9ef8b9147e20c1503aea934e7088504072553835ee97097c6ffbd5661ca902ef910a111c83d7ea374994ecc15afde16ed0bc81129652e0f6

Download Submit
C:\Windows\System\cYtKvsp.exe

Filesize
1.9MB

MD5
00f641b28de96f164728c693138569f0

SHA1
8dfa209ac7bf224c0939cb8f08cec021d00b273b

SHA256
7594374a740d61970e03f9507ad5c54dc1371031110ff9d5fcb29c04fbb2be79

SHA512
d3a65fef919de538c895cb2f18ba8743b8959df9f3ecaefcb9d647b8c58288f2ba8a5e6145e49c25cab77f7576578772c95fc7c462e5773d0841c66d17135b99

Download Submit
C:\Windows\System\daaANCD.exe

Filesize
1.9MB

MD5
5d6afd72bc6c3bc18ebc0d742683a326

SHA1
9d71c1e1fdfb0fcda3eb210365229d679eb4f37b

SHA256
a4cd23d973b4600ff1b109dc0cc8c9f812e210849463f2b09cf58166e352f280

SHA512
e68f5caf70662646b040662e6f084d249427bf94fb19688575f04c68dfe4d19deea1e5c8b825b74134649ba0bca6ac7e7abdd6c92b30875467a2dec5b2690ea5

Download Submit
C:\Windows\System\deVcphZ.exe

Filesize
1.9MB

MD5
845527b6c1b5d46dea52e9f7d0e419cf

SHA1
3e97815cc1f222958274c765c8d2f1bd20fa476f

SHA256
365dda1ecdae8357dda8a797ea968a23b6eb106a0e69d9ab62f90624cf449374

SHA512
dda9ad41c95f1a90915e11c38eeb9c1835ffb93f3cb0d59133178e1da14197c055bda6b70bf1eec80f94467a91682d8549b13e1e5d7cde6d700c2763e658438d

Download Submit
C:\Windows\System\dloLgZb.exe

Filesize
1.9MB

MD5
84989206853e9b9de9a1a9808ea05ea6

SHA1
de12d95c3ef2988ca28dbe8bf53d05fc5cc6fcfa

SHA256
132055c3b50c0ab32394555865b7d8e6ec473b6dc14231d6d60425ff883b47b4

SHA512
aca1e377ecd06cae6d00b8d122b223f76267be8b02bf577419f24010ac33eec3e853b8ff37c7b6ad08152fc217f24efa2011958e3e5472ebc881f217eff6d526

Download Submit
C:\Windows\System\dviEIgl.exe

Filesize
1.9MB

MD5
02f3f49a1b880c91135ca6a27e300a0d

SHA1
f6e2967136fa551d150a7e89bf703cdfff5c1d51

SHA256
9a780f9f5642242b0fad67417ec7873585dc0f7216014bcd5836732cbc631c3c

SHA512
c961b9fb0567b76c9dc3a03e319832dbfb890f5edbf015e7e0d92270f41990d49a02e21a433a965ab1f67a9fef74ea7191b71cf6e9f0067b90c87ed4f37ae531

Download Submit
C:\Windows\System\eGIaqGK.exe

Filesize
2.0MB

MD5
58821bdcb6c96021ab22d31779b72f24

SHA1
47af4c288c24ebb1dabdd062af7f89f14d6503b5

SHA256
48a1b1d97dec19309b9603ac919eaaec3808ef6bd380a0958e355e78f9534032

SHA512
029ca7075aa470a7be9539da68d31f065ea601c456602330dcc7b322930e9798c2d6af01994746ef43a75bd9e45448bdb574970c807acfdc2a4625351a35e270

Download Submit
C:\Windows\System\evaptaB.exe

Filesize
1.9MB

MD5
d62fef70bc82fd9a6ef8114d18eddd4c

SHA1
3ebf279bb7d78ac5f17502b4c752dc2bc5b69403

SHA256
40561cb46d29cb8a8aec439e65e9c738bc51d0e4b51d6144d95630b8f985e3f9

SHA512
a6698203b9368303d6200851e4a5952012dc891dc5b23cfdfa77c69e70239d21c419e312756fd4da19422f2cdf478ef5744750df4725a32bd7da0e7bb4684e30

Download Submit
C:\Windows\System\fdMYzXI.exe

Filesize
1.9MB

MD5
4419f26fad074cc802935442925e8c80

SHA1
06b58e47318e065d2a6dd2aad3b28db08fc8dbef

SHA256
738a3785a7693f2b77959d559c6c75ca17c47f2f9cb1eae81cf87d901c0a3e11

SHA512
24e167a4f5eeb326a50cdd6bd374a831b46983a863b18d166e79a73c5f441f84554d8186ac0b0063e790f6a04432bffa19f5474f7e640fb0644597af16169bb2

Download Submit
C:\Windows\System\glLmdDC.exe

Filesize
1.9MB

MD5
d0141ce50f6b332c80902e1b82b73459

SHA1
97cbc8e5fcf6027a7378c7a131527190fae20078

SHA256
2fb2ec78fda7251a5fccc88cd239a2c2e20e7d6bf06abfd37cb600361a0b9450

SHA512
68d7515bbbcb58627d2b3fee3d4547f58f55a2ad494be9b8480a77bb4a1bc118dbdfcd25a17a863b4188169641989ea776d6c197376cb54a01636ee82e97b34c

Download Submit
C:\Windows\System\hhzZyUz.exe

Filesize
1.9MB

MD5
a08cbd1174ddf6ea3c9b5b9f3d1c8b80

SHA1
13b0042bd808b49b8d4d0ba48399f8de39851776

SHA256
1195deda2759af8c8008fd03ac876aad55e9b16773db847c74f6c270c753fbf5

SHA512
ef4f901762620a6f6b77d0f7eb9814118eec396042bef24566504d683aac555ea6b6ff5a3b0acbafbf925d1b2fe547c8ad314170623abed3d59c8d3968507335

Download Submit
C:\Windows\System\iccrtSN.exe

Filesize
2.0MB

MD5
29513d66d48b2ab4f063316333434ac2

SHA1
7f44d2711e4c65579fbaef993bfa2eb7a5507130

SHA256
e1777e5e7fd879051b19b1107e6e53b1ba05088795170266edc6773d08814db7

SHA512
f684528d3662ac6e01137a1b0a394b8c84f827a4d01df80b3683ea2ebe644d0112eb1d8835b03b68528a9d33aba795bf9d0ebe31608d60ec18f19e20db66835e

Download Submit
C:\Windows\System\ihMxvnA.exe

Filesize
1.9MB

MD5
d5783749462e54b894383fb406cb1ca5

SHA1
55062e7506826e43beeaea6ec6439d9b99fdd9c0

SHA256
db5111f495cc9fe02aa54933f372f63f64e1e65445ed709ba366e4885effde68

SHA512
dcbb838f85adff86e902f870d7cc829f5d9da898f359150fe6486a769c60dcceec5c425e761494696a15f4436f1d208c5aa0c11455505651211a75c6de51a210

Download Submit
C:\Windows\System\mPbULGS.exe

Filesize
1.9MB

MD5
762f2381efab20c3788ac34a294b1830

SHA1
4f32907b05880f9533518a38cb44f216072081db

SHA256
f8f2f46479e94caa01ad44b2c6746f2fc04b4a0af9d12648d4b24f15159d19fc

SHA512
e2e36e97fe49f48326e4e9ae9601d55cca5765ac0c2cc905ed1219b848e1188a867b350a84396f6ab8e1086e6d032c5415712819a8340345c4860f1b34fb0622

Download Submit
C:\Windows\System\ngtMDXR.exe

Filesize
2.0MB

MD5
c51e4d45e753586d3f9f79895572c411

SHA1
201157c1ea9bdcce5c03abb1c6153ad0553f3ac9

SHA256
653d3b04c98ec2fc44a7748758a1bf6e2cdcd02c8630d7d312e42c9b2b23dcc5

SHA512
825161b73f9fc08ba93ff4074e97d3854031c9e9f68cda0a7277c06a275306cc9e47d6eaea440dd050d2fcf25ae147d2ff3d0767183884dc451b746dc2bacad3

Download Submit
C:\Windows\System\pqRkSIF.exe

Filesize
1.9MB

MD5
05ab7738bc162559723b936745756c2e

SHA1
a517db81cc042e1b511e23f282e42f3ad65739f4

SHA256
49c0d4bc8d81ab46c9ca93580008a0e38390d31aae04e6528b626a7d4e982afb

SHA512
4f7cf3c31f7d5f205bc6e0e4a1aec8003fa67c4c75bd3c1d328ad81d925ea8ef7c957a29b666fab0a913f9ec16f29cb4c7c29503ac25c2e3be6ff64ed8ea3910

Download Submit
C:\Windows\System\rYzkFfo.exe

Filesize
1.9MB

MD5
47c1cccb08f0d5da6a8bbc95d7203168

SHA1
2665966e2d66b2b5e626a4a12b028c4112bd1040

SHA256
56fbf61a50969ee30ca41c0ad092667f9c6df6c13d4d871cd681ae8f80b25dda

SHA512
e6127201f4d01c8222ceb7a31485dc79f450d023823fee41faf84ce6c802b63842b953ad2a082d943cc77a44e1abc64a5dae624765dc4cf39899fec196de799a

Download Submit
C:\Windows\System\tBskZiT.exe

Filesize
1.9MB

MD5
54577e6694a88f3348b8f6c15b78c8f4

SHA1
edf1f0b03f6725b4fe3b67240edb242db86e25ff

SHA256
2f4a29ac1358f0741e8849a9c5f8fd84d07e9f74db24e91fc693f2e7235e0710

SHA512
e8863b8b02375b991676ba61913e24562dd41e21e8ec1316116bd2032f355ffc30b5ea47e8253d1ec078ee7a6e83901900400ef99dc50942a250d2378ac1528d

Download Submit
C:\Windows\System\uTaxCfX.exe

Filesize
2.0MB

MD5
3761b0ac3862545b9ed153eb7884a81d

SHA1
fbd71883d2551f0f26d29fb38be45bcf8cc65da0

SHA256
ebedf4de8188a11496facdd03b299aad6fb8be30b18b06be499b8f3e94403350

SHA512
7d59fcd9b8e9219b6f8b8d7aab76c46b7582da55d21d95293ffa524d79f67b448fe91dc85c98e2af4f9077df2122ce90e76c624606360924ab028e6312ad02a5

Download Submit
C:\Windows\System\xVhnitr.exe

Filesize
1.9MB

MD5
593ce956d7bad50dc1205c903378469f

SHA1
baab9ff8d13d62672fddb90cb0d0c40bbf1cb943

SHA256
c17de3f4833991814ead003864374e496cb367a8aaf3d4065e1318d6120ef694

SHA512
c7ddcbc2362bde5daf8f3d4e6684bfee755e4c758d75145a9c1dce18dd938be9a4692d346a0f135c3f080fe69dbc62c0bcba2b7761b20d6e147dd74d2a6b88fb

Download Submit
C:\Windows\System\xVzXhDp.exe

Filesize
2.0MB

MD5
60d9890868f6c99c86262aedcf05f0ac

SHA1
6c816376a983acd38a79b782cdaff59d94026c98

SHA256
69d6a7e4b8675851fed3c396fe87dd1c07d4414bf13eca2e7f826bb90c2c4033

SHA512
3a94ca294010613182d04cab1e23f76d13b086fb64e01b74c39f8aae1cc38276675ae7cef904a08d403f0e69d15318459874729f9c11e60f649299e203a374bc

Download Submit
C:\Windows\System\zfgSVJN.exe

Filesize
1.9MB

MD5
0363488e9e91515a28e79e7a3dec4079

SHA1
5709a941dfe3c7b72796f20969b0c68662432eda

SHA256
13854382e92dc51449521ff9d5d5a0bce8f8233ae1b40ec5a9c97aa408f33c68

SHA512
e22a903fd251298acbd9703fc54686c1a62f6ca4675be47fbaa7a31ee5cbb765267f755637ec56ec92cffd1766a741d471746527683df7437f8fe1d5c3119b32

Download Submit
memory/208-4158-0x00007FF7A7A70000-0x00007FF7A7E62000-memory.dmp

Filesize
3.9MB

Download
memory/208-48-0x00007FF7A7A70000-0x00007FF7A7E62000-memory.dmp

Filesize
3.9MB

Download
memory/212-4164-0x00007FF6240E0000-0x00007FF6244D2000-memory.dmp

Filesize
3.9MB

Download
memory/212-43-0x00007FF6240E0000-0x00007FF6244D2000-memory.dmp

Filesize
3.9MB

Download
memory/448-968-0x0000020BFF050000-0x0000020BFF072000-memory.dmp

Filesize
136KB

Download
memory/1140-4166-0x00007FF7D1690000-0x00007FF7D1A82000-memory.dmp

Filesize
3.9MB

Download
memory/1140-49-0x00007FF7D1690000-0x00007FF7D1A82000-memory.dmp

Filesize
3.9MB

Download
memory/1632-243-0x00007FF60FBB0000-0x00007FF60FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-4182-0x00007FF60FBB0000-0x00007FF60FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-4161-0x00007FF7CB870000-0x00007FF7CBC62000-memory.dmp

Filesize
3.9MB

Download
memory/2032-30-0x00007FF7CB870000-0x00007FF7CBC62000-memory.dmp

Filesize
3.9MB

Download
memory/2056-4218-0x00007FF7C0520000-0x00007FF7C0912000-memory.dmp

Filesize
3.9MB

Download
memory/2056-610-0x00007FF7C0520000-0x00007FF7C0912000-memory.dmp

Filesize
3.9MB

Download
memory/2076-4180-0x00007FF65E760000-0x00007FF65EB52000-memory.dmp

Filesize
3.9MB

Download
memory/2076-2326-0x00007FF65E760000-0x00007FF65EB52000-memory.dmp

Filesize
3.9MB

Download
memory/2076-46-0x00007FF65E760000-0x00007FF65EB52000-memory.dmp

Filesize
3.9MB

Download
memory/2132-4187-0x00007FF734710000-0x00007FF734B02000-memory.dmp

Filesize
3.9MB

Download
memory/2132-332-0x00007FF734710000-0x00007FF734B02000-memory.dmp

Filesize
3.9MB

Download
memory/2296-4168-0x00007FF655C60000-0x00007FF656052000-memory.dmp

Filesize
3.9MB

Download
memory/2296-2279-0x00007FF655C60000-0x00007FF656052000-memory.dmp

Filesize
3.9MB

Download
memory/2296-31-0x00007FF655C60000-0x00007FF656052000-memory.dmp

Filesize
3.9MB

Download
memory/2352-4156-0x00007FF7E2F20000-0x00007FF7E3312000-memory.dmp

Filesize
3.9MB

Download
memory/2352-2127-0x00007FF7E2F20000-0x00007FF7E3312000-memory.dmp

Filesize
3.9MB

Download
memory/2352-6-0x00007FF7E2F20000-0x00007FF7E3312000-memory.dmp

Filesize
3.9MB

Download
memory/2504-4186-0x00007FF768720000-0x00007FF768B12000-memory.dmp

Filesize
3.9MB

Download
memory/2504-207-0x00007FF768720000-0x00007FF768B12000-memory.dmp

Filesize
3.9MB

Download
memory/2592-4273-0x00007FF64F500000-0x00007FF64F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-616-0x00007FF64F500000-0x00007FF64F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-546-0x00007FF759680000-0x00007FF759A72000-memory.dmp

Filesize
3.9MB

Download
memory/2680-4205-0x00007FF759680000-0x00007FF759A72000-memory.dmp

Filesize
3.9MB

Download
memory/2936-619-0x00007FF7CDDD0000-0x00007FF7CE1C2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-4272-0x00007FF7CDDD0000-0x00007FF7CE1C2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-4190-0x00007FF74A390000-0x00007FF74A782000-memory.dmp

Filesize
3.9MB

Download
memory/3016-618-0x00007FF74A390000-0x00007FF74A782000-memory.dmp

Filesize
3.9MB

Download
memory/3576-4266-0x00007FF722530000-0x00007FF722922000-memory.dmp

Filesize
3.9MB

Download
memory/3576-617-0x00007FF722530000-0x00007FF722922000-memory.dmp

Filesize
3.9MB

Download
memory/3996-4162-0x00007FF663A90000-0x00007FF663E82000-memory.dmp

Filesize
3.9MB

Download
memory/3996-41-0x00007FF663A90000-0x00007FF663E82000-memory.dmp

Filesize
3.9MB

Download
memory/4204-615-0x00007FF61DF20000-0x00007FF61E312000-memory.dmp

Filesize
3.9MB

Download
memory/4204-4242-0x00007FF61DF20000-0x00007FF61E312000-memory.dmp

Filesize
3.9MB

Download
memory/4428-611-0x00007FF7DE180000-0x00007FF7DE572000-memory.dmp

Filesize
3.9MB

Download
memory/4428-4216-0x00007FF7DE180000-0x00007FF7DE572000-memory.dmp

Filesize
3.9MB

Download
memory/4716-4219-0x00007FF625530000-0x00007FF625922000-memory.dmp

Filesize
3.9MB

Download
memory/4716-609-0x00007FF625530000-0x00007FF625922000-memory.dmp

Filesize
3.9MB

Download
memory/4724-614-0x00007FF772660000-0x00007FF772A52000-memory.dmp

Filesize
3.9MB

Download
memory/4724-4248-0x00007FF772660000-0x00007FF772A52000-memory.dmp

Filesize
3.9MB

Download
memory/4840-1-0x0000018D49E50000-0x0000018D49E60000-memory.dmp

Filesize
64KB

Download
memory/4840-0-0x00007FF62D570000-0x00007FF62D962000-memory.dmp

Filesize
3.9MB

Download
memory/4840-1995-0x00007FF62D570000-0x00007FF62D962000-memory.dmp

Filesize
3.9MB

Download
memory/4916-613-0x00007FF7D0440000-0x00007FF7D0832000-memory.dmp

Filesize
3.9MB

Download
memory/4916-4241-0x00007FF7D0440000-0x00007FF7D0832000-memory.dmp

Filesize
3.9MB

Download
memory/4992-612-0x00007FF66E860000-0x00007FF66EC52000-memory.dmp

Filesize
3.9MB

Download
memory/4992-4295-0x00007FF66E860000-0x00007FF66EC52000-memory.dmp

Filesize
3.9MB

Download
memory/5032-4207-0x00007FF7129A0000-0x00007FF712D92000-memory.dmp

Filesize
3.9MB

Download
memory/5032-461-0x00007FF7129A0000-0x00007FF712D92000-memory.dmp

Filesize
3.9MB

Download