xmrig | f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaac

Analysis

max time kernel
120s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
Size

989KB
MD5

a2c5a1b59becb1cda7bcd338c1e32480
SHA1

6e304f3d604dd4e826a9a076c1ccc3a30d7d36ac
SHA256

f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaac
SHA512

1f6805eec7fc09cd1a320b93a744d15cd98a9c63f5843d81b5f921e7c3f30d7cb2da2bd549d390f75c727b8c4844df1abec7967d89eb9fcd7d1b6cf0cc2191f6
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMCfZZdbXz8XYZMUyU2v:Lz071uv4BPMCiXYZI

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral2/memory/1384-246-0x00007FF68F730000-0x00007FF68FB22000-memory.dmp	xmrig
behavioral2/memory/2448-158-0x00007FF7517E0000-0x00007FF751BD2000-memory.dmp	xmrig
behavioral2/memory/1580-160-0x00007FF6FA3C0000-0x00007FF6FA7B2000-memory.dmp	xmrig
behavioral2/memory/3092-372-0x00007FF622570000-0x00007FF622962000-memory.dmp	xmrig
behavioral2/memory/2136-377-0x00007FF78B9D0000-0x00007FF78BDC2000-memory.dmp	xmrig
behavioral2/memory/1640-379-0x00007FF7464C0000-0x00007FF7468B2000-memory.dmp	xmrig
behavioral2/memory/2204-890-0x00007FF7EF890000-0x00007FF7EFC82000-memory.dmp	xmrig
behavioral2/memory/2848-737-0x00007FF67F940000-0x00007FF67FD32000-memory.dmp	xmrig
behavioral2/memory/3904-627-0x00007FF627AF0000-0x00007FF627EE2000-memory.dmp	xmrig
behavioral2/memory/3640-631-0x00007FF703930000-0x00007FF703D22000-memory.dmp	xmrig
behavioral2/memory/2376-555-0x00007FF759B70000-0x00007FF759F62000-memory.dmp	xmrig
behavioral2/memory/4324-471-0x00007FF71B470000-0x00007FF71B862000-memory.dmp	xmrig
behavioral2/memory/4436-383-0x00007FF627DD0000-0x00007FF6281C2000-memory.dmp	xmrig
behavioral2/memory/5040-382-0x00007FF674890000-0x00007FF674C82000-memory.dmp	xmrig
behavioral2/memory/2332-381-0x00007FF7301D0000-0x00007FF7305C2000-memory.dmp	xmrig
behavioral2/memory/3716-380-0x00007FF7813B0000-0x00007FF7817A2000-memory.dmp	xmrig
behavioral2/memory/4512-378-0x00007FF759EB0000-0x00007FF75A2A2000-memory.dmp	xmrig
behavioral2/memory/2492-367-0x00007FF611470000-0x00007FF611862000-memory.dmp	xmrig
behavioral2/memory/1540-2815-0x00007FF6DDE70000-0x00007FF6DE262000-memory.dmp	xmrig
behavioral2/memory/4964-2955-0x00007FF635E10000-0x00007FF636202000-memory.dmp	xmrig
behavioral2/memory/4256-3158-0x00007FF7B6060000-0x00007FF7B6452000-memory.dmp	xmrig
behavioral2/memory/1920-3155-0x00007FF6F2090000-0x00007FF6F2482000-memory.dmp	xmrig
behavioral2/memory/2492-6485-0x00007FF611470000-0x00007FF611862000-memory.dmp	xmrig
behavioral2/memory/2848-6456-0x00007FF67F940000-0x00007FF67FD32000-memory.dmp	xmrig
behavioral2/memory/2376-6533-0x00007FF759B70000-0x00007FF759F62000-memory.dmp	xmrig
behavioral2/memory/1920-7350-0x00007FF6F2090000-0x00007FF6F2482000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1696	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
5100	WtBTwRy.exe
1268	mdfRTbb.exe
3904	HiHFXhr.exe
1148	HvIakpb.exe
4964	kOGaNwO.exe
2448	qzwOlRd.exe
1580	slMMHOs.exe
1384	VzMTNId.exe
3640	htIlkAE.exe
2848	zejCnLO.exe
2492	ayqvhvi.exe
3092	iCiSgoV.exe
2136	svpXili.exe
4512	RUXwdQd.exe
1640	HMuwoZh.exe
3716	MzQproT.exe
2332	DSGXRlg.exe
5040	xaTzdXf.exe
4436	iOlMwDO.exe
1920	tLNXYWG.exe
2204	GUJniEx.exe
4256	hWUJAGv.exe
4324	yhwLUhP.exe
2376	VJwiZxL.exe
2988	TzLzjOg.exe
4020	fOVuirw.exe
4892	peLQVSG.exe
2680	roNFRff.exe
640	iXLxrUg.exe
3000	NmWBEyP.exe
2116	eUnnKIs.exe
700	GquGUHx.exe
2536	VrSplUD.exe
3988	mzXsJgt.exe
3292	jMqOTeW.exe
4472	BLaKOVs.exe
1700	VpMNRBo.exe
3416	MwQSWxd.exe
4352	XVKJjGG.exe
4652	RkaYukO.exe
5068	pwchPsa.exe
1788	qjPzaLD.exe
4732	aVfrHkR.exe
3268	flZKbjc.exe
2752	sVJYxKG.exe
4676	bdAggnZ.exe
3756	SHLFLkw.exe
4092	FSPytPT.exe
3556	uqlODbO.exe
4996	iidhnLT.exe
4036	bTWFZrT.exe
112	LTdCKBF.exe
5028	MaKAVoQ.exe
464	LxfxVUe.exe
1136	kKOGgBT.exe
2144	FZVZHAg.exe
2912	jPQrFFt.exe
1656	PJhjPwR.exe
3604	ZjvBGAp.exe
1936	UoPsRtA.exe
2476	WeHFrpI.exe
3364	rTIKIst.exe
2164	mzDTZrJ.exe
2524	exPEynU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1540-0-0x00007FF6DDE70000-0x00007FF6DE262000-memory.dmp	upx
behavioral2/files/0x0007000000023c8d-38.dat	upx
behavioral2/files/0x0007000000023c88-70.dat	upx
behavioral2/files/0x0007000000023c9b-118.dat	upx
behavioral2/files/0x0007000000023c8f-65.dat	upx
behavioral2/files/0x0007000000023c8e-64.dat	upx
behavioral2/files/0x0007000000023c98-101.dat	upx
behavioral2/memory/1148-58-0x00007FF6B6220000-0x00007FF6B6612000-memory.dmp	upx
behavioral2/files/0x0007000000023c87-46.dat	upx
behavioral2/files/0x0009000000023c83-39.dat	upx
behavioral2/memory/1268-35-0x00007FF659C40000-0x00007FF65A032000-memory.dmp	upx
behavioral2/files/0x0007000000023c8c-55.dat	upx
behavioral2/files/0x0007000000023c8b-47.dat	upx
behavioral2/files/0x0007000000023c8a-30.dat	upx
behavioral2/files/0x0007000000023c89-29.dat	upx
behavioral2/files/0x000c000000023b8e-13.dat	upx
behavioral2/memory/5100-11-0x00007FF6A20B0000-0x00007FF6A24A2000-memory.dmp	upx
behavioral2/memory/1384-246-0x00007FF68F730000-0x00007FF68FB22000-memory.dmp	upx
behavioral2/memory/2448-158-0x00007FF7517E0000-0x00007FF751BD2000-memory.dmp	upx
behavioral2/files/0x0007000000023cab-156.dat	upx
behavioral2/files/0x0007000000023ca9-152.dat	upx
behavioral2/files/0x0007000000023cb2-222.dat	upx
behavioral2/files/0x0007000000023ca6-148.dat	upx
behavioral2/files/0x0007000000023c97-145.dat	upx
behavioral2/files/0x0007000000023ca4-143.dat	upx
behavioral2/files/0x0007000000023cb1-205.dat	upx
behavioral2/files/0x0007000000023c96-199.dat	upx
behavioral2/files/0x0007000000023ca2-141.dat	upx
behavioral2/files/0x0007000000023c95-194.dat	upx
behavioral2/files/0x0007000000023c93-138.dat	upx
behavioral2/files/0x0007000000023ca0-135.dat	upx
behavioral2/files/0x0007000000023c9f-133.dat	upx
behavioral2/files/0x0007000000023caf-184.dat	upx
behavioral2/files/0x0007000000023c9e-132.dat	upx
behavioral2/files/0x0007000000023c9d-131.dat	upx
behavioral2/files/0x0007000000023c9c-122.dat	upx
behavioral2/files/0x0007000000023cac-164.dat	upx
behavioral2/memory/1580-160-0x00007FF6FA3C0000-0x00007FF6FA7B2000-memory.dmp	upx
behavioral2/memory/4964-115-0x00007FF635E10000-0x00007FF636202000-memory.dmp	upx
behavioral2/files/0x0007000000023c9a-154.dat	upx
behavioral2/files/0x0007000000023c99-113.dat	upx
behavioral2/files/0x0007000000023ca8-151.dat	upx
behavioral2/files/0x0007000000023ca5-147.dat	upx
behavioral2/files/0x0007000000023ca3-142.dat	upx
behavioral2/files/0x0007000000023ca1-140.dat	upx
behavioral2/files/0x0007000000023c94-88.dat	upx
behavioral2/files/0x0007000000023c92-83.dat	upx
behavioral2/files/0x0007000000023c91-76.dat	upx
behavioral2/files/0x0007000000023c90-75.dat	upx
behavioral2/memory/3092-372-0x00007FF622570000-0x00007FF622962000-memory.dmp	upx
behavioral2/memory/2136-377-0x00007FF78B9D0000-0x00007FF78BDC2000-memory.dmp	upx
behavioral2/memory/1640-379-0x00007FF7464C0000-0x00007FF7468B2000-memory.dmp	upx
behavioral2/memory/2204-890-0x00007FF7EF890000-0x00007FF7EFC82000-memory.dmp	upx
behavioral2/memory/2848-737-0x00007FF67F940000-0x00007FF67FD32000-memory.dmp	upx
behavioral2/memory/3904-627-0x00007FF627AF0000-0x00007FF627EE2000-memory.dmp	upx
behavioral2/memory/3640-631-0x00007FF703930000-0x00007FF703D22000-memory.dmp	upx
behavioral2/memory/2376-555-0x00007FF759B70000-0x00007FF759F62000-memory.dmp	upx
behavioral2/memory/4324-471-0x00007FF71B470000-0x00007FF71B862000-memory.dmp	upx
behavioral2/memory/4256-458-0x00007FF7B6060000-0x00007FF7B6452000-memory.dmp	upx
behavioral2/memory/1920-384-0x00007FF6F2090000-0x00007FF6F2482000-memory.dmp	upx
behavioral2/memory/4436-383-0x00007FF627DD0000-0x00007FF6281C2000-memory.dmp	upx
behavioral2/memory/5040-382-0x00007FF674890000-0x00007FF674C82000-memory.dmp	upx
behavioral2/memory/2332-381-0x00007FF7301D0000-0x00007FF7305C2000-memory.dmp	upx
behavioral2/memory/3716-380-0x00007FF7813B0000-0x00007FF7817A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\haWUttv.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\kvvfDlD.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\shTExrm.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\NSXDsUY.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\KqJqMtd.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\HqhjcvU.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\wlbKTTP.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\nGFglCH.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\fGWRzyA.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\skHPVov.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\gfJbTpR.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\FkAAwBb.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\NekPJeg.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\GNtIcXn.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\KXrIghU.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\WRFjPKq.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\gsESuMi.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\joKodiJ.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\yVQKmNe.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\DojFoSd.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\BbzHNiW.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\GbZmqCL.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\DyjGRnK.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\fzBudAe.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\tdcPhwk.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\udnpqLU.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\MAygNkW.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\ACWzAKc.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\ckqTYfy.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\JJugOLS.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\igrnpMj.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\amXFWDz.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\ltAicTM.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\kPcguGT.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\WLwVSNQ.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\TKVCgbP.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\uxXSRTX.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\DHYljBq.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\TNcEOjL.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\IkeDxXF.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\DqBLLBL.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\ipeoWhT.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\qisRoAO.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\ptugSed.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\DWeneJF.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\XDkHVzy.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\tBbfbTG.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\FNewdND.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\WPXjedM.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\vauualS.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\CiUxPtI.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\JHutQtl.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\GgJZZDM.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\RrpmApk.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\KXXxSAT.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\FKROaHn.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\MJceAkx.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\RcoJrHg.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\eHVMyYB.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\ZGqJfzD.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\JhWfTzd.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\LLNTEIi.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\CeuLvwH.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
File created	C:\Windows\System\WZsZdZh.exe	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1696	powershell.exe
1696	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
Token: SeLockMemoryPrivilege	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeCreateGlobalPrivilege	13856	dwm.exe
Token: SeChangeNotifyPrivilege	13856	dwm.exe
Token: 33	13856	dwm.exe
Token: SeIncBasePriorityPrivilege	13856	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1696	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	86
PID 1540 wrote to memory of 1696	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	86
PID 1540 wrote to memory of 5100	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	87
PID 1540 wrote to memory of 5100	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	87
PID 1540 wrote to memory of 1268	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	88
PID 1540 wrote to memory of 1268	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	88
PID 1540 wrote to memory of 3904	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	89
PID 1540 wrote to memory of 3904	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	89
PID 1540 wrote to memory of 1148	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	90
PID 1540 wrote to memory of 1148	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	90
PID 1540 wrote to memory of 4964	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	91
PID 1540 wrote to memory of 4964	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	91
PID 1540 wrote to memory of 2448	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	92
PID 1540 wrote to memory of 2448	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	92
PID 1540 wrote to memory of 1580	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	93
PID 1540 wrote to memory of 1580	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	93
PID 1540 wrote to memory of 1384	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	94
PID 1540 wrote to memory of 1384	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	94
PID 1540 wrote to memory of 3640	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	95
PID 1540 wrote to memory of 3640	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	95
PID 1540 wrote to memory of 2848	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	96
PID 1540 wrote to memory of 2848	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	96
PID 1540 wrote to memory of 2492	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	97
PID 1540 wrote to memory of 2492	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	97
PID 1540 wrote to memory of 3092	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	98
PID 1540 wrote to memory of 3092	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	98
PID 1540 wrote to memory of 2136	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	99
PID 1540 wrote to memory of 2136	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	99
PID 1540 wrote to memory of 4512	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	100
PID 1540 wrote to memory of 4512	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	100
PID 1540 wrote to memory of 4892	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	101
PID 1540 wrote to memory of 4892	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	101
PID 1540 wrote to memory of 1640	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	102
PID 1540 wrote to memory of 1640	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	102
PID 1540 wrote to memory of 3716	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	103
PID 1540 wrote to memory of 3716	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	103
PID 1540 wrote to memory of 2332	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	104
PID 1540 wrote to memory of 2332	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	104
PID 1540 wrote to memory of 5040	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	105
PID 1540 wrote to memory of 5040	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	105
PID 1540 wrote to memory of 4436	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	106
PID 1540 wrote to memory of 4436	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	106
PID 1540 wrote to memory of 1920	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	107
PID 1540 wrote to memory of 1920	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	107
PID 1540 wrote to memory of 4472	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	108
PID 1540 wrote to memory of 4472	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	108
PID 1540 wrote to memory of 2204	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	109
PID 1540 wrote to memory of 2204	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	109
PID 1540 wrote to memory of 4256	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	110
PID 1540 wrote to memory of 4256	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	110
PID 1540 wrote to memory of 4324	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	111
PID 1540 wrote to memory of 4324	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	111
PID 1540 wrote to memory of 2376	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	112
PID 1540 wrote to memory of 2376	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	112
PID 1540 wrote to memory of 2988	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	113
PID 1540 wrote to memory of 2988	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	113
PID 1540 wrote to memory of 4020	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	114
PID 1540 wrote to memory of 4020	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	114
PID 1540 wrote to memory of 2680	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	115
PID 1540 wrote to memory of 2680	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	115
PID 1540 wrote to memory of 640	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	116
PID 1540 wrote to memory of 640	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	116
PID 1540 wrote to memory of 3000	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	117
PID 1540 wrote to memory of 3000	1540	f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe	117

C:\Users\Admin\AppData\Local\Temp\f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe
"C:\Users\Admin\AppData\Local\Temp\f1146071fc349b3aeacb093c1ce0d67003c8073718700793fec2bd42949fbaacN.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\System\WtBTwRy.exe
  C:\Windows\System\WtBTwRy.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\mdfRTbb.exe
  C:\Windows\System\mdfRTbb.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\HiHFXhr.exe
  C:\Windows\System\HiHFXhr.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\HvIakpb.exe
  C:\Windows\System\HvIakpb.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\kOGaNwO.exe
  C:\Windows\System\kOGaNwO.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\qzwOlRd.exe
  C:\Windows\System\qzwOlRd.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\slMMHOs.exe
  C:\Windows\System\slMMHOs.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\VzMTNId.exe
  C:\Windows\System\VzMTNId.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\htIlkAE.exe
  C:\Windows\System\htIlkAE.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\zejCnLO.exe
  C:\Windows\System\zejCnLO.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\ayqvhvi.exe
  C:\Windows\System\ayqvhvi.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\iCiSgoV.exe
  C:\Windows\System\iCiSgoV.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\svpXili.exe
  C:\Windows\System\svpXili.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\RUXwdQd.exe
  C:\Windows\System\RUXwdQd.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\peLQVSG.exe
  C:\Windows\System\peLQVSG.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\HMuwoZh.exe
  C:\Windows\System\HMuwoZh.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\MzQproT.exe
  C:\Windows\System\MzQproT.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\DSGXRlg.exe
  C:\Windows\System\DSGXRlg.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\xaTzdXf.exe
  C:\Windows\System\xaTzdXf.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\iOlMwDO.exe
  C:\Windows\System\iOlMwDO.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\tLNXYWG.exe
  C:\Windows\System\tLNXYWG.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\BLaKOVs.exe
  C:\Windows\System\BLaKOVs.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\GUJniEx.exe
  C:\Windows\System\GUJniEx.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\hWUJAGv.exe
  C:\Windows\System\hWUJAGv.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\yhwLUhP.exe
  C:\Windows\System\yhwLUhP.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\VJwiZxL.exe
  C:\Windows\System\VJwiZxL.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\TzLzjOg.exe
  C:\Windows\System\TzLzjOg.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\fOVuirw.exe
  C:\Windows\System\fOVuirw.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\roNFRff.exe
  C:\Windows\System\roNFRff.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\iXLxrUg.exe
  C:\Windows\System\iXLxrUg.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\NmWBEyP.exe
  C:\Windows\System\NmWBEyP.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\eUnnKIs.exe
  C:\Windows\System\eUnnKIs.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\GquGUHx.exe
  C:\Windows\System\GquGUHx.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\VrSplUD.exe
  C:\Windows\System\VrSplUD.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\sVJYxKG.exe
  C:\Windows\System\sVJYxKG.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\mzXsJgt.exe
  C:\Windows\System\mzXsJgt.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\jMqOTeW.exe
  C:\Windows\System\jMqOTeW.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\bdAggnZ.exe
  C:\Windows\System\bdAggnZ.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\VpMNRBo.exe
  C:\Windows\System\VpMNRBo.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\MwQSWxd.exe
  C:\Windows\System\MwQSWxd.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\XVKJjGG.exe
  C:\Windows\System\XVKJjGG.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\RkaYukO.exe
  C:\Windows\System\RkaYukO.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\pwchPsa.exe
  C:\Windows\System\pwchPsa.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\qjPzaLD.exe
  C:\Windows\System\qjPzaLD.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\aVfrHkR.exe
  C:\Windows\System\aVfrHkR.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\flZKbjc.exe
  C:\Windows\System\flZKbjc.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\SHLFLkw.exe
  C:\Windows\System\SHLFLkw.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\FSPytPT.exe
  C:\Windows\System\FSPytPT.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\uqlODbO.exe
  C:\Windows\System\uqlODbO.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\iidhnLT.exe
  C:\Windows\System\iidhnLT.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\bTWFZrT.exe
  C:\Windows\System\bTWFZrT.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\LTdCKBF.exe
  C:\Windows\System\LTdCKBF.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\fkXmiwh.exe
  C:\Windows\System\fkXmiwh.exe
  2⤵
  PID:2200
- C:\Windows\System\MaKAVoQ.exe
  C:\Windows\System\MaKAVoQ.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\OMypkEW.exe
  C:\Windows\System\OMypkEW.exe
  2⤵
  PID:1748
- C:\Windows\System\LxfxVUe.exe
  C:\Windows\System\LxfxVUe.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\kKOGgBT.exe
  C:\Windows\System\kKOGgBT.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\FZVZHAg.exe
  C:\Windows\System\FZVZHAg.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\jPQrFFt.exe
  C:\Windows\System\jPQrFFt.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\PJhjPwR.exe
  C:\Windows\System\PJhjPwR.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\ZjvBGAp.exe
  C:\Windows\System\ZjvBGAp.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\PsKpZrU.exe
  C:\Windows\System\PsKpZrU.exe
  2⤵
  PID:972
- C:\Windows\System\UoPsRtA.exe
  C:\Windows\System\UoPsRtA.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\WeHFrpI.exe
  C:\Windows\System\WeHFrpI.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\rTIKIst.exe
  C:\Windows\System\rTIKIst.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\ZRWZQly.exe
  C:\Windows\System\ZRWZQly.exe
  2⤵
  PID:556
- C:\Windows\System\mzDTZrJ.exe
  C:\Windows\System\mzDTZrJ.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\exPEynU.exe
  C:\Windows\System\exPEynU.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\QolwrUh.exe
  C:\Windows\System\QolwrUh.exe
  2⤵
  PID:2384
- C:\Windows\System\hCmGclZ.exe
  C:\Windows\System\hCmGclZ.exe
  2⤵
  PID:4572
- C:\Windows\System\mFpHlXv.exe
  C:\Windows\System\mFpHlXv.exe
  2⤵
  PID:324
- C:\Windows\System\hrRyzMO.exe
  C:\Windows\System\hrRyzMO.exe
  2⤵
  PID:2436
- C:\Windows\System\PQjRyku.exe
  C:\Windows\System\PQjRyku.exe
  2⤵
  PID:5080
- C:\Windows\System\wDvxAeZ.exe
  C:\Windows\System\wDvxAeZ.exe
  2⤵
  PID:4404
- C:\Windows\System\PmepHIE.exe
  C:\Windows\System\PmepHIE.exe
  2⤵
  PID:1864
- C:\Windows\System\iqBSIpx.exe
  C:\Windows\System\iqBSIpx.exe
  2⤵
  PID:4852
- C:\Windows\System\ULWNSDz.exe
  C:\Windows\System\ULWNSDz.exe
  2⤵
  PID:1168
- C:\Windows\System\ozVsmol.exe
  C:\Windows\System\ozVsmol.exe
  2⤵
  PID:3496
- C:\Windows\System\nhLqTHE.exe
  C:\Windows\System\nhLqTHE.exe
  2⤵
  PID:1972
- C:\Windows\System\rCldWLc.exe
  C:\Windows\System\rCldWLc.exe
  2⤵
  PID:2312
- C:\Windows\System\MiKoIcr.exe
  C:\Windows\System\MiKoIcr.exe
  2⤵
  PID:2444
- C:\Windows\System\HvOcOEa.exe
  C:\Windows\System\HvOcOEa.exe
  2⤵
  PID:2156
- C:\Windows\System\nPHLlNn.exe
  C:\Windows\System\nPHLlNn.exe
  2⤵
  PID:1504
- C:\Windows\System\dCAcmoq.exe
  C:\Windows\System\dCAcmoq.exe
  2⤵
  PID:4672
- C:\Windows\System\elgMsfI.exe
  C:\Windows\System\elgMsfI.exe
  2⤵
  PID:3748
- C:\Windows\System\HvuSmFi.exe
  C:\Windows\System\HvuSmFi.exe
  2⤵
  PID:4104
- C:\Windows\System\kZSfGMT.exe
  C:\Windows\System\kZSfGMT.exe
  2⤵
  PID:1140
- C:\Windows\System\eYWcFkU.exe
  C:\Windows\System\eYWcFkU.exe
  2⤵
  PID:1352
- C:\Windows\System\sqEnUfU.exe
  C:\Windows\System\sqEnUfU.exe
  2⤵
  PID:5136
- C:\Windows\System\IdSPCqa.exe
  C:\Windows\System\IdSPCqa.exe
  2⤵
  PID:5160
- C:\Windows\System\ZtOvSiS.exe
  C:\Windows\System\ZtOvSiS.exe
  2⤵
  PID:5176
- C:\Windows\System\VIQnheH.exe
  C:\Windows\System\VIQnheH.exe
  2⤵
  PID:5204
- C:\Windows\System\tQwTwDA.exe
  C:\Windows\System\tQwTwDA.exe
  2⤵
  PID:5220
- C:\Windows\System\RANxVxO.exe
  C:\Windows\System\RANxVxO.exe
  2⤵
  PID:5244
- C:\Windows\System\oVJHPUe.exe
  C:\Windows\System\oVJHPUe.exe
  2⤵
  PID:5264
- C:\Windows\System\KOysTit.exe
  C:\Windows\System\KOysTit.exe
  2⤵
  PID:5280
- C:\Windows\System\ufcuYqU.exe
  C:\Windows\System\ufcuYqU.exe
  2⤵
  PID:5308
- C:\Windows\System\NLyAjeI.exe
  C:\Windows\System\NLyAjeI.exe
  2⤵
  PID:5324
- C:\Windows\System\XOJUtlK.exe
  C:\Windows\System\XOJUtlK.exe
  2⤵
  PID:5356
- C:\Windows\System\MDZXMar.exe
  C:\Windows\System\MDZXMar.exe
  2⤵
  PID:5376
- C:\Windows\System\tvnIUBt.exe
  C:\Windows\System\tvnIUBt.exe
  2⤵
  PID:5396
- C:\Windows\System\lLtqEmK.exe
  C:\Windows\System\lLtqEmK.exe
  2⤵
  PID:5412
- C:\Windows\System\YabEMxq.exe
  C:\Windows\System\YabEMxq.exe
  2⤵
  PID:5440
- C:\Windows\System\oFxntqw.exe
  C:\Windows\System\oFxntqw.exe
  2⤵
  PID:5456
- C:\Windows\System\aMXczgw.exe
  C:\Windows\System\aMXczgw.exe
  2⤵
  PID:5476
- C:\Windows\System\NnAfWuE.exe
  C:\Windows\System\NnAfWuE.exe
  2⤵
  PID:5492
- C:\Windows\System\cSDIMIz.exe
  C:\Windows\System\cSDIMIz.exe
  2⤵
  PID:5516
- C:\Windows\System\SUYGZqP.exe
  C:\Windows\System\SUYGZqP.exe
  2⤵
  PID:5540
- C:\Windows\System\jclywjI.exe
  C:\Windows\System\jclywjI.exe
  2⤵
  PID:5560
- C:\Windows\System\cRYdaZD.exe
  C:\Windows\System\cRYdaZD.exe
  2⤵
  PID:5580
- C:\Windows\System\DoLQdoS.exe
  C:\Windows\System\DoLQdoS.exe
  2⤵
  PID:5600
- C:\Windows\System\riIUTkp.exe
  C:\Windows\System\riIUTkp.exe
  2⤵
  PID:5624
- C:\Windows\System\SPuKDjW.exe
  C:\Windows\System\SPuKDjW.exe
  2⤵
  PID:5640
- C:\Windows\System\aTxAtDr.exe
  C:\Windows\System\aTxAtDr.exe
  2⤵
  PID:5656
- C:\Windows\System\VsaTaBA.exe
  C:\Windows\System\VsaTaBA.exe
  2⤵
  PID:5680
- C:\Windows\System\aqUKgpl.exe
  C:\Windows\System\aqUKgpl.exe
  2⤵
  PID:5696
- C:\Windows\System\lTxjCsT.exe
  C:\Windows\System\lTxjCsT.exe
  2⤵
  PID:5712
- C:\Windows\System\WlqdWIn.exe
  C:\Windows\System\WlqdWIn.exe
  2⤵
  PID:5748
- C:\Windows\System\kbtBJBy.exe
  C:\Windows\System\kbtBJBy.exe
  2⤵
  PID:5772
- C:\Windows\System\dSSzLfl.exe
  C:\Windows\System\dSSzLfl.exe
  2⤵
  PID:5788
- C:\Windows\System\EznSXpH.exe
  C:\Windows\System\EznSXpH.exe
  2⤵
  PID:5808
- C:\Windows\System\CrCubof.exe
  C:\Windows\System\CrCubof.exe
  2⤵
  PID:5832
- C:\Windows\System\EHBbmIO.exe
  C:\Windows\System\EHBbmIO.exe
  2⤵
  PID:5852
- C:\Windows\System\DbBOfVT.exe
  C:\Windows\System\DbBOfVT.exe
  2⤵
  PID:5872
- C:\Windows\System\QQyBPUs.exe
  C:\Windows\System\QQyBPUs.exe
  2⤵
  PID:5892
- C:\Windows\System\TtZoJTI.exe
  C:\Windows\System\TtZoJTI.exe
  2⤵
  PID:5908
- C:\Windows\System\HqhjcvU.exe
  C:\Windows\System\HqhjcvU.exe
  2⤵
  PID:5924
- C:\Windows\System\wtIGcil.exe
  C:\Windows\System\wtIGcil.exe
  2⤵
  PID:5944
- C:\Windows\System\nqZkwfU.exe
  C:\Windows\System\nqZkwfU.exe
  2⤵
  PID:5960
- C:\Windows\System\IBinsAA.exe
  C:\Windows\System\IBinsAA.exe
  2⤵
  PID:5980
- C:\Windows\System\RdQRWTu.exe
  C:\Windows\System\RdQRWTu.exe
  2⤵
  PID:5036
- C:\Windows\System\HMVkNxO.exe
  C:\Windows\System\HMVkNxO.exe
  2⤵
  PID:1804
- C:\Windows\System\JpFXjSr.exe
  C:\Windows\System\JpFXjSr.exe
  2⤵
  PID:3980
- C:\Windows\System\XfnEnUH.exe
  C:\Windows\System\XfnEnUH.exe
  2⤵
  PID:5148
- C:\Windows\System\Cixmvpg.exe
  C:\Windows\System\Cixmvpg.exe
  2⤵
  PID:5196
- C:\Windows\System\JUPujeX.exe
  C:\Windows\System\JUPujeX.exe
  2⤵
  PID:5216
- C:\Windows\System\kRWjgZy.exe
  C:\Windows\System\kRWjgZy.exe
  2⤵
  PID:5256
- C:\Windows\System\CcnKffX.exe
  C:\Windows\System\CcnKffX.exe
  2⤵
  PID:5344
- C:\Windows\System\DRLErfk.exe
  C:\Windows\System\DRLErfk.exe
  2⤵
  PID:5404
- C:\Windows\System\TccwkRH.exe
  C:\Windows\System\TccwkRH.exe
  2⤵
  PID:5428
- C:\Windows\System\SqdbADr.exe
  C:\Windows\System\SqdbADr.exe
  2⤵
  PID:5468
- C:\Windows\System\GUCmPzC.exe
  C:\Windows\System\GUCmPzC.exe
  2⤵
  PID:5504
- C:\Windows\System\SBartEH.exe
  C:\Windows\System\SBartEH.exe
  2⤵
  PID:5592
- C:\Windows\System\LnocTmG.exe
  C:\Windows\System\LnocTmG.exe
  2⤵
  PID:5636
- C:\Windows\System\quSlhQr.exe
  C:\Windows\System\quSlhQr.exe
  2⤵
  PID:6348
- C:\Windows\System\LgvWxYw.exe
  C:\Windows\System\LgvWxYw.exe
  2⤵
  PID:6364
- C:\Windows\System\ZWnIckq.exe
  C:\Windows\System\ZWnIckq.exe
  2⤵
  PID:6384
- C:\Windows\System\KArabhL.exe
  C:\Windows\System\KArabhL.exe
  2⤵
  PID:6400
- C:\Windows\System\SmIiHal.exe
  C:\Windows\System\SmIiHal.exe
  2⤵
  PID:6416
- C:\Windows\System\roqxXZl.exe
  C:\Windows\System\roqxXZl.exe
  2⤵
  PID:6436
- C:\Windows\System\MwGeqjm.exe
  C:\Windows\System\MwGeqjm.exe
  2⤵
  PID:6460
- C:\Windows\System\zheYcLt.exe
  C:\Windows\System\zheYcLt.exe
  2⤵
  PID:6476
- C:\Windows\System\wUayEFu.exe
  C:\Windows\System\wUayEFu.exe
  2⤵
  PID:6496
- C:\Windows\System\wwRkGtV.exe
  C:\Windows\System\wwRkGtV.exe
  2⤵
  PID:6516
- C:\Windows\System\IqZfSTn.exe
  C:\Windows\System\IqZfSTn.exe
  2⤵
  PID:6536
- C:\Windows\System\Svmarps.exe
  C:\Windows\System\Svmarps.exe
  2⤵
  PID:6552
- C:\Windows\System\AhMxKII.exe
  C:\Windows\System\AhMxKII.exe
  2⤵
  PID:6572
- C:\Windows\System\qaakAzO.exe
  C:\Windows\System\qaakAzO.exe
  2⤵
  PID:6600
- C:\Windows\System\iSPXGSe.exe
  C:\Windows\System\iSPXGSe.exe
  2⤵
  PID:6616
- C:\Windows\System\iLGBmqi.exe
  C:\Windows\System\iLGBmqi.exe
  2⤵
  PID:6648
- C:\Windows\System\RVxBTlc.exe
  C:\Windows\System\RVxBTlc.exe
  2⤵
  PID:6664
- C:\Windows\System\YKSMTGk.exe
  C:\Windows\System\YKSMTGk.exe
  2⤵
  PID:6684
- C:\Windows\System\afvpHxx.exe
  C:\Windows\System\afvpHxx.exe
  2⤵
  PID:6700
- C:\Windows\System\TdGQKTl.exe
  C:\Windows\System\TdGQKTl.exe
  2⤵
  PID:6720
- C:\Windows\System\THVPzWf.exe
  C:\Windows\System\THVPzWf.exe
  2⤵
  PID:6736
- C:\Windows\System\KzaKnVA.exe
  C:\Windows\System\KzaKnVA.exe
  2⤵
  PID:6760
- C:\Windows\System\pMoRAEZ.exe
  C:\Windows\System\pMoRAEZ.exe
  2⤵
  PID:6776
- C:\Windows\System\NZTVJhf.exe
  C:\Windows\System\NZTVJhf.exe
  2⤵
  PID:6792
- C:\Windows\System\wGopPWS.exe
  C:\Windows\System\wGopPWS.exe
  2⤵
  PID:6808
- C:\Windows\System\UGjssxZ.exe
  C:\Windows\System\UGjssxZ.exe
  2⤵
  PID:6828
- C:\Windows\System\KouvvZv.exe
  C:\Windows\System\KouvvZv.exe
  2⤵
  PID:6844
- C:\Windows\System\gCUkXcD.exe
  C:\Windows\System\gCUkXcD.exe
  2⤵
  PID:6860
- C:\Windows\System\MoxHTIC.exe
  C:\Windows\System\MoxHTIC.exe
  2⤵
  PID:6880
- C:\Windows\System\OvPLYOO.exe
  C:\Windows\System\OvPLYOO.exe
  2⤵
  PID:6900
- C:\Windows\System\BcNzXRm.exe
  C:\Windows\System\BcNzXRm.exe
  2⤵
  PID:6960
- C:\Windows\System\ppGLXuS.exe
  C:\Windows\System\ppGLXuS.exe
  2⤵
  PID:6976
- C:\Windows\System\XKKpcPz.exe
  C:\Windows\System\XKKpcPz.exe
  2⤵
  PID:6992
- C:\Windows\System\WjHYBwX.exe
  C:\Windows\System\WjHYBwX.exe
  2⤵
  PID:7012
- C:\Windows\System\gHTqexF.exe
  C:\Windows\System\gHTqexF.exe
  2⤵
  PID:7036
- C:\Windows\System\SuWNBSz.exe
  C:\Windows\System\SuWNBSz.exe
  2⤵
  PID:7056
- C:\Windows\System\cHoWDBj.exe
  C:\Windows\System\cHoWDBj.exe
  2⤵
  PID:7076
- C:\Windows\System\dJFNWky.exe
  C:\Windows\System\dJFNWky.exe
  2⤵
  PID:7092
- C:\Windows\System\FeWnPuj.exe
  C:\Windows\System\FeWnPuj.exe
  2⤵
  PID:7112
- C:\Windows\System\GcGtkUv.exe
  C:\Windows\System\GcGtkUv.exe
  2⤵
  PID:7128
- C:\Windows\System\VirMJpw.exe
  C:\Windows\System\VirMJpw.exe
  2⤵
  PID:7144
- C:\Windows\System\gTDEKCt.exe
  C:\Windows\System\gTDEKCt.exe
  2⤵
  PID:812
- C:\Windows\System\prjTqgX.exe
  C:\Windows\System\prjTqgX.exe
  2⤵
  PID:264
- C:\Windows\System\QTRJwxi.exe
  C:\Windows\System\QTRJwxi.exe
  2⤵
  PID:6356
- C:\Windows\System\ajzemKG.exe
  C:\Windows\System\ajzemKG.exe
  2⤵
  PID:6492
- C:\Windows\System\poHOqOK.exe
  C:\Windows\System\poHOqOK.exe
  2⤵
  PID:6584
- C:\Windows\System\LifNXsh.exe
  C:\Windows\System\LifNXsh.exe
  2⤵
  PID:6612
- C:\Windows\System\Ckjrudh.exe
  C:\Windows\System\Ckjrudh.exe
  2⤵
  PID:4548
- C:\Windows\System\BzyYnmp.exe
  C:\Windows\System\BzyYnmp.exe
  2⤵
  PID:2620
- C:\Windows\System\wcLJKhC.exe
  C:\Windows\System\wcLJKhC.exe
  2⤵
  PID:6676
- C:\Windows\System\kBPYVEW.exe
  C:\Windows\System\kBPYVEW.exe
  2⤵
  PID:6744
- C:\Windows\System\utObQSx.exe
  C:\Windows\System\utObQSx.exe
  2⤵
  PID:3468
- C:\Windows\System\BzWmVWh.exe
  C:\Windows\System\BzWmVWh.exe
  2⤵
  PID:5228
- C:\Windows\System\WGXWTDa.exe
  C:\Windows\System\WGXWTDa.exe
  2⤵
  PID:6784
- C:\Windows\System\ptcHsCG.exe
  C:\Windows\System\ptcHsCG.exe
  2⤵
  PID:6816
- C:\Windows\System\KomaxuD.exe
  C:\Windows\System\KomaxuD.exe
  2⤵
  PID:6876
- C:\Windows\System\XXAsagb.exe
  C:\Windows\System\XXAsagb.exe
  2⤵
  PID:7180
- C:\Windows\System\YpVakpI.exe
  C:\Windows\System\YpVakpI.exe
  2⤵
  PID:7196
- C:\Windows\System\ptholLT.exe
  C:\Windows\System\ptholLT.exe
  2⤵
  PID:7220
- C:\Windows\System\inNRNei.exe
  C:\Windows\System\inNRNei.exe
  2⤵
  PID:7236
- C:\Windows\System\rNpWUpb.exe
  C:\Windows\System\rNpWUpb.exe
  2⤵
  PID:7252
- C:\Windows\System\OCGfTyA.exe
  C:\Windows\System\OCGfTyA.exe
  2⤵
  PID:7268
- C:\Windows\System\rfMbnoz.exe
  C:\Windows\System\rfMbnoz.exe
  2⤵
  PID:7284
- C:\Windows\System\gwBGWXT.exe
  C:\Windows\System\gwBGWXT.exe
  2⤵
  PID:7300
- C:\Windows\System\nwqRKMF.exe
  C:\Windows\System\nwqRKMF.exe
  2⤵
  PID:7336
- C:\Windows\System\EUCkGCm.exe
  C:\Windows\System\EUCkGCm.exe
  2⤵
  PID:7352
- C:\Windows\System\seZlopo.exe
  C:\Windows\System\seZlopo.exe
  2⤵
  PID:7368
- C:\Windows\System\avRehVS.exe
  C:\Windows\System\avRehVS.exe
  2⤵
  PID:7392
- C:\Windows\System\iEdJgGN.exe
  C:\Windows\System\iEdJgGN.exe
  2⤵
  PID:7408
- C:\Windows\System\ePtKfZW.exe
  C:\Windows\System\ePtKfZW.exe
  2⤵
  PID:7432
- C:\Windows\System\WpFIeKu.exe
  C:\Windows\System\WpFIeKu.exe
  2⤵
  PID:7448
- C:\Windows\System\NiaJKZE.exe
  C:\Windows\System\NiaJKZE.exe
  2⤵
  PID:7468
- C:\Windows\System\mHkrYHl.exe
  C:\Windows\System\mHkrYHl.exe
  2⤵
  PID:7484
- C:\Windows\System\HaUazur.exe
  C:\Windows\System\HaUazur.exe
  2⤵
  PID:7504
- C:\Windows\System\LMKDlyX.exe
  C:\Windows\System\LMKDlyX.exe
  2⤵
  PID:7524
- C:\Windows\System\VELPWrt.exe
  C:\Windows\System\VELPWrt.exe
  2⤵
  PID:7540
- C:\Windows\System\mwdYqbA.exe
  C:\Windows\System\mwdYqbA.exe
  2⤵
  PID:7564
- C:\Windows\System\JmCqzgu.exe
  C:\Windows\System\JmCqzgu.exe
  2⤵
  PID:7580
- C:\Windows\System\isgyRrb.exe
  C:\Windows\System\isgyRrb.exe
  2⤵
  PID:7604
- C:\Windows\System\GwXLbTG.exe
  C:\Windows\System\GwXLbTG.exe
  2⤵
  PID:7620
- C:\Windows\System\KtVSQnZ.exe
  C:\Windows\System\KtVSQnZ.exe
  2⤵
  PID:7640
- C:\Windows\System\PiwkuQn.exe
  C:\Windows\System\PiwkuQn.exe
  2⤵
  PID:7660
- C:\Windows\System\STSPLXa.exe
  C:\Windows\System\STSPLXa.exe
  2⤵
  PID:7676
- C:\Windows\System\hFvABlt.exe
  C:\Windows\System\hFvABlt.exe
  2⤵
  PID:7700
- C:\Windows\System\mmNPhxE.exe
  C:\Windows\System\mmNPhxE.exe
  2⤵
  PID:7720
- C:\Windows\System\dMGQnsU.exe
  C:\Windows\System\dMGQnsU.exe
  2⤵
  PID:7756
- C:\Windows\System\tQRGgHd.exe
  C:\Windows\System\tQRGgHd.exe
  2⤵
  PID:7784
- C:\Windows\System\ZFPwEaQ.exe
  C:\Windows\System\ZFPwEaQ.exe
  2⤵
  PID:7800
- C:\Windows\System\MJHRjkV.exe
  C:\Windows\System\MJHRjkV.exe
  2⤵
  PID:7820
- C:\Windows\System\oVLlMWO.exe
  C:\Windows\System\oVLlMWO.exe
  2⤵
  PID:7844
- C:\Windows\System\uZbjkRC.exe
  C:\Windows\System\uZbjkRC.exe
  2⤵
  PID:7860
- C:\Windows\System\JOrwyOR.exe
  C:\Windows\System\JOrwyOR.exe
  2⤵
  PID:7880
- C:\Windows\System\JuxYQWX.exe
  C:\Windows\System\JuxYQWX.exe
  2⤵
  PID:7896
- C:\Windows\System\bCtLHzX.exe
  C:\Windows\System\bCtLHzX.exe
  2⤵
  PID:7912
- C:\Windows\System\RQXbhFv.exe
  C:\Windows\System\RQXbhFv.exe
  2⤵
  PID:7928
- C:\Windows\System\nkKKplf.exe
  C:\Windows\System\nkKKplf.exe
  2⤵
  PID:7944
- C:\Windows\System\SWdqdya.exe
  C:\Windows\System\SWdqdya.exe
  2⤵
  PID:7960
- C:\Windows\System\HjeRPjd.exe
  C:\Windows\System\HjeRPjd.exe
  2⤵
  PID:7980
- C:\Windows\System\SfliYPQ.exe
  C:\Windows\System\SfliYPQ.exe
  2⤵
  PID:7996
- C:\Windows\System\lhLfLCK.exe
  C:\Windows\System\lhLfLCK.exe
  2⤵
  PID:8016
- C:\Windows\System\OxEIfYz.exe
  C:\Windows\System\OxEIfYz.exe
  2⤵
  PID:8036
- C:\Windows\System\iGQPXAz.exe
  C:\Windows\System\iGQPXAz.exe
  2⤵
  PID:8056
- C:\Windows\System\wcncdLq.exe
  C:\Windows\System\wcncdLq.exe
  2⤵
  PID:8072
- C:\Windows\System\IZycOmE.exe
  C:\Windows\System\IZycOmE.exe
  2⤵
  PID:8092
- C:\Windows\System\kTGxLMd.exe
  C:\Windows\System\kTGxLMd.exe
  2⤵
  PID:8108
- C:\Windows\System\egVuiJy.exe
  C:\Windows\System\egVuiJy.exe
  2⤵
  PID:8128
- C:\Windows\System\jOqIrpv.exe
  C:\Windows\System\jOqIrpv.exe
  2⤵
  PID:8144
- C:\Windows\System\ktgiopZ.exe
  C:\Windows\System\ktgiopZ.exe
  2⤵
  PID:8164
- C:\Windows\System\QbJPbOj.exe
  C:\Windows\System\QbJPbOj.exe
  2⤵
  PID:8188
- C:\Windows\System\GRVPHRu.exe
  C:\Windows\System\GRVPHRu.exe
  2⤵
  PID:6128
- C:\Windows\System\rvLeWJy.exe
  C:\Windows\System\rvLeWJy.exe
  2⤵
  PID:952
- C:\Windows\System\BzCGylc.exe
  C:\Windows\System\BzCGylc.exe
  2⤵
  PID:4180
- C:\Windows\System\wKivwwi.exe
  C:\Windows\System\wKivwwi.exe
  2⤵
  PID:6660
- C:\Windows\System\bvdTdzy.exe
  C:\Windows\System\bvdTdzy.exe
  2⤵
  PID:6800
- C:\Windows\System\EeOcuXx.exe
  C:\Windows\System\EeOcuXx.exe
  2⤵
  PID:5556
- C:\Windows\System\TQCRjvl.exe
  C:\Windows\System\TQCRjvl.exe
  2⤵
  PID:5664
- C:\Windows\System\uLQuSDt.exe
  C:\Windows\System\uLQuSDt.exe
  2⤵
  PID:2852
- C:\Windows\System\wKOGKZK.exe
  C:\Windows\System\wKOGKZK.exe
  2⤵
  PID:6836
- C:\Windows\System\BSTqmak.exe
  C:\Windows\System\BSTqmak.exe
  2⤵
  PID:4680
- C:\Windows\System\SIePNoS.exe
  C:\Windows\System\SIePNoS.exe
  2⤵
  PID:3948
- C:\Windows\System\UzNzVAJ.exe
  C:\Windows\System\UzNzVAJ.exe
  2⤵
  PID:6716
- C:\Windows\System\BRnMLRQ.exe
  C:\Windows\System\BRnMLRQ.exe
  2⤵
  PID:5144
- C:\Windows\System\iIlcxpi.exe
  C:\Windows\System\iIlcxpi.exe
  2⤵
  PID:5500
- C:\Windows\System\ccyddtu.exe
  C:\Windows\System\ccyddtu.exe
  2⤵
  PID:5296
- C:\Windows\System\cripXMq.exe
  C:\Windows\System\cripXMq.exe
  2⤵
  PID:5272
- C:\Windows\System\HXWLMVE.exe
  C:\Windows\System\HXWLMVE.exe
  2⤵
  PID:5168
- C:\Windows\System\rTmhyzo.exe
  C:\Windows\System\rTmhyzo.exe
  2⤵
  PID:7208
- C:\Windows\System\sUvmjJv.exe
  C:\Windows\System\sUvmjJv.exe
  2⤵
  PID:7232
- C:\Windows\System\ljUnDjA.exe
  C:\Windows\System\ljUnDjA.exe
  2⤵
  PID:6412
- C:\Windows\System\QwljtmO.exe
  C:\Windows\System\QwljtmO.exe
  2⤵
  PID:6424
- C:\Windows\System\yhQHTXt.exe
  C:\Windows\System\yhQHTXt.exe
  2⤵
  PID:6468
- C:\Windows\System\XQxBPFJ.exe
  C:\Windows\System\XQxBPFJ.exe
  2⤵
  PID:6560
- C:\Windows\System\zoYEznd.exe
  C:\Windows\System\zoYEznd.exe
  2⤵
  PID:7024
- C:\Windows\System\SvjpklD.exe
  C:\Windows\System\SvjpklD.exe
  2⤵
  PID:7420
- C:\Windows\System\KzLEawX.exe
  C:\Windows\System\KzLEawX.exe
  2⤵
  PID:7440
- C:\Windows\System\nTTmdrD.exe
  C:\Windows\System\nTTmdrD.exe
  2⤵
  PID:7548
- C:\Windows\System\nkVjhZZ.exe
  C:\Windows\System\nkVjhZZ.exe
  2⤵
  PID:7152
- C:\Windows\System\nAtRXso.exe
  C:\Windows\System\nAtRXso.exe
  2⤵
  PID:7160
- C:\Windows\System\TVXJtKm.exe
  C:\Windows\System\TVXJtKm.exe
  2⤵
  PID:8200
- C:\Windows\System\qmAYYYf.exe
  C:\Windows\System\qmAYYYf.exe
  2⤵
  PID:8224
- C:\Windows\System\YErDwgC.exe
  C:\Windows\System\YErDwgC.exe
  2⤵
  PID:8240
- C:\Windows\System\DflCGUE.exe
  C:\Windows\System\DflCGUE.exe
  2⤵
  PID:8256
- C:\Windows\System\gZoQYHy.exe
  C:\Windows\System\gZoQYHy.exe
  2⤵
  PID:8272
- C:\Windows\System\WUpebCl.exe
  C:\Windows\System\WUpebCl.exe
  2⤵
  PID:8296
- C:\Windows\System\pjxugNs.exe
  C:\Windows\System\pjxugNs.exe
  2⤵
  PID:8316
- C:\Windows\System\nVDlvLx.exe
  C:\Windows\System\nVDlvLx.exe
  2⤵
  PID:8336
- C:\Windows\System\xceRdDv.exe
  C:\Windows\System\xceRdDv.exe
  2⤵
  PID:8356
- C:\Windows\System\NGCbsaC.exe
  C:\Windows\System\NGCbsaC.exe
  2⤵
  PID:8376
- C:\Windows\System\Asijoxc.exe
  C:\Windows\System\Asijoxc.exe
  2⤵
  PID:8396
- C:\Windows\System\FTkqCOg.exe
  C:\Windows\System\FTkqCOg.exe
  2⤵
  PID:8412
- C:\Windows\System\bahkghv.exe
  C:\Windows\System\bahkghv.exe
  2⤵
  PID:8432
- C:\Windows\System\SdPgFgZ.exe
  C:\Windows\System\SdPgFgZ.exe
  2⤵
  PID:8452
- C:\Windows\System\OZuIfpi.exe
  C:\Windows\System\OZuIfpi.exe
  2⤵
  PID:8468
- C:\Windows\System\cLMPeNW.exe
  C:\Windows\System\cLMPeNW.exe
  2⤵
  PID:8488
- C:\Windows\System\FShLrBM.exe
  C:\Windows\System\FShLrBM.exe
  2⤵
  PID:8508
- C:\Windows\System\vgdjQML.exe
  C:\Windows\System\vgdjQML.exe
  2⤵
  PID:8532
- C:\Windows\System\bUrSQev.exe
  C:\Windows\System\bUrSQev.exe
  2⤵
  PID:8556
- C:\Windows\System\aDdKeUV.exe
  C:\Windows\System\aDdKeUV.exe
  2⤵
  PID:8576
- C:\Windows\System\QngTAkI.exe
  C:\Windows\System\QngTAkI.exe
  2⤵
  PID:8592
- C:\Windows\System\yOaahDr.exe
  C:\Windows\System\yOaahDr.exe
  2⤵
  PID:8612
- C:\Windows\System\QZniGJR.exe
  C:\Windows\System\QZniGJR.exe
  2⤵
  PID:8628
- C:\Windows\System\XTWCnYP.exe
  C:\Windows\System\XTWCnYP.exe
  2⤵
  PID:8652
- C:\Windows\System\AKZaTCn.exe
  C:\Windows\System\AKZaTCn.exe
  2⤵
  PID:8668
- C:\Windows\System\xsHcJqu.exe
  C:\Windows\System\xsHcJqu.exe
  2⤵
  PID:8688
- C:\Windows\System\RQNkZwe.exe
  C:\Windows\System\RQNkZwe.exe
  2⤵
  PID:8708
- C:\Windows\System\dOlskzF.exe
  C:\Windows\System\dOlskzF.exe
  2⤵
  PID:8728
- C:\Windows\System\CWmjDTt.exe
  C:\Windows\System\CWmjDTt.exe
  2⤵
  PID:8744
- C:\Windows\System\JJgoXWl.exe
  C:\Windows\System\JJgoXWl.exe
  2⤵
  PID:8764
- C:\Windows\System\mBMwBow.exe
  C:\Windows\System\mBMwBow.exe
  2⤵
  PID:8788
- C:\Windows\System\koNdxaz.exe
  C:\Windows\System\koNdxaz.exe
  2⤵
  PID:8804
- C:\Windows\System\sBqpDYe.exe
  C:\Windows\System\sBqpDYe.exe
  2⤵
  PID:8864
- C:\Windows\System\vsORpdi.exe
  C:\Windows\System\vsORpdi.exe
  2⤵
  PID:8880
- C:\Windows\System\WyctGYr.exe
  C:\Windows\System\WyctGYr.exe
  2⤵
  PID:8904
- C:\Windows\System\cXOHoHS.exe
  C:\Windows\System\cXOHoHS.exe
  2⤵
  PID:8920
- C:\Windows\System\oiTtyuF.exe
  C:\Windows\System\oiTtyuF.exe
  2⤵
  PID:8948
- C:\Windows\System\fpntlaH.exe
  C:\Windows\System\fpntlaH.exe
  2⤵
  PID:8964
- C:\Windows\System\CXZMgWx.exe
  C:\Windows\System\CXZMgWx.exe
  2⤵
  PID:8980
- C:\Windows\System\LmNOrjG.exe
  C:\Windows\System\LmNOrjG.exe
  2⤵
  PID:9000
- C:\Windows\System\HBHtiQk.exe
  C:\Windows\System\HBHtiQk.exe
  2⤵
  PID:9020
- C:\Windows\System\SUJZxcu.exe
  C:\Windows\System\SUJZxcu.exe
  2⤵
  PID:9036
- C:\Windows\System\CEvrwiJ.exe
  C:\Windows\System\CEvrwiJ.exe
  2⤵
  PID:9060
- C:\Windows\System\EAYUKvj.exe
  C:\Windows\System\EAYUKvj.exe
  2⤵
  PID:9076
- C:\Windows\System\McsYQys.exe
  C:\Windows\System\McsYQys.exe
  2⤵
  PID:9104
- C:\Windows\System\jHzFDbQ.exe
  C:\Windows\System\jHzFDbQ.exe
  2⤵
  PID:9120
- C:\Windows\System\HEBxrrk.exe
  C:\Windows\System\HEBxrrk.exe
  2⤵
  PID:9140
- C:\Windows\System\TpXypGL.exe
  C:\Windows\System\TpXypGL.exe
  2⤵
  PID:9156
- C:\Windows\System\TPpVXRz.exe
  C:\Windows\System\TPpVXRz.exe
  2⤵
  PID:9172
- C:\Windows\System\LbFXaJU.exe
  C:\Windows\System\LbFXaJU.exe
  2⤵
  PID:9188
- C:\Windows\System\iJQlfFr.exe
  C:\Windows\System\iJQlfFr.exe
  2⤵
  PID:9208
- C:\Windows\System\PkYVpHY.exe
  C:\Windows\System\PkYVpHY.exe
  2⤵
  PID:6636
- C:\Windows\System\hAfJMTj.exe
  C:\Windows\System\hAfJMTj.exe
  2⤵
  PID:7876
- C:\Windows\System\ooaWape.exe
  C:\Windows\System\ooaWape.exe
  2⤵
  PID:3024
- C:\Windows\System\aIOhkmg.exe
  C:\Windows\System\aIOhkmg.exe
  2⤵
  PID:8068
- C:\Windows\System\BUeSeTt.exe
  C:\Windows\System\BUeSeTt.exe
  2⤵
  PID:8100
- C:\Windows\System\pwMusbu.exe
  C:\Windows\System\pwMusbu.exe
  2⤵
  PID:8176
- C:\Windows\System\HeJnpNe.exe
  C:\Windows\System\HeJnpNe.exe
  2⤵
  PID:7228
- C:\Windows\System\QVTYETf.exe
  C:\Windows\System\QVTYETf.exe
  2⤵
  PID:6932
- C:\Windows\System\MFQbVgx.exe
  C:\Windows\System\MFQbVgx.exe
  2⤵
  PID:6136
- C:\Windows\System\AXsDKjR.exe
  C:\Windows\System\AXsDKjR.exe
  2⤵
  PID:6972
- C:\Windows\System\snmQvYV.exe
  C:\Windows\System\snmQvYV.exe
  2⤵
  PID:5524
- C:\Windows\System\hvFWNez.exe
  C:\Windows\System\hvFWNez.exe
  2⤵
  PID:7348
- C:\Windows\System\bCoQNkE.exe
  C:\Windows\System\bCoQNkE.exe
  2⤵
  PID:6872
- C:\Windows\System\uNSeoQB.exe
  C:\Windows\System\uNSeoQB.exe
  2⤵
  PID:5156
- C:\Windows\System\VCzfrCX.exe
  C:\Windows\System\VCzfrCX.exe
  2⤵
  PID:5732
- C:\Windows\System\PTPHwiM.exe
  C:\Windows\System\PTPHwiM.exe
  2⤵
  PID:5572
- C:\Windows\System\yubdVJf.exe
  C:\Windows\System\yubdVJf.exe
  2⤵
  PID:6396
- C:\Windows\System\FKcsMYt.exe
  C:\Windows\System\FKcsMYt.exe
  2⤵
  PID:6512
- C:\Windows\System\fwpFZKD.exe
  C:\Windows\System\fwpFZKD.exe
  2⤵
  PID:9220
- C:\Windows\System\uiDlQDb.exe
  C:\Windows\System\uiDlQDb.exe
  2⤵
  PID:9240
- C:\Windows\System\yzvTOsG.exe
  C:\Windows\System\yzvTOsG.exe
  2⤵
  PID:9260
- C:\Windows\System\VvMLNBD.exe
  C:\Windows\System\VvMLNBD.exe
  2⤵
  PID:9280
- C:\Windows\System\UJxRfyE.exe
  C:\Windows\System\UJxRfyE.exe
  2⤵
  PID:9304
- C:\Windows\System\XGoAWLz.exe
  C:\Windows\System\XGoAWLz.exe
  2⤵
  PID:9320
- C:\Windows\System\UgWCSoG.exe
  C:\Windows\System\UgWCSoG.exe
  2⤵
  PID:9340
- C:\Windows\System\yFoSorJ.exe
  C:\Windows\System\yFoSorJ.exe
  2⤵
  PID:9360
- C:\Windows\System\igxshIc.exe
  C:\Windows\System\igxshIc.exe
  2⤵
  PID:9384
- C:\Windows\System\WAblAao.exe
  C:\Windows\System\WAblAao.exe
  2⤵
  PID:9412
- C:\Windows\System\YlLNDpg.exe
  C:\Windows\System\YlLNDpg.exe
  2⤵
  PID:9428
- C:\Windows\System\sSJYhoB.exe
  C:\Windows\System\sSJYhoB.exe
  2⤵
  PID:9452
- C:\Windows\System\UXDdflT.exe
  C:\Windows\System\UXDdflT.exe
  2⤵
  PID:9468
- C:\Windows\System\wCOkBkm.exe
  C:\Windows\System\wCOkBkm.exe
  2⤵
  PID:9488
- C:\Windows\System\zypDVEY.exe
  C:\Windows\System\zypDVEY.exe
  2⤵
  PID:9508
- C:\Windows\System\xnRxOnr.exe
  C:\Windows\System\xnRxOnr.exe
  2⤵
  PID:9524
- C:\Windows\System\AMoqLty.exe
  C:\Windows\System\AMoqLty.exe
  2⤵
  PID:9548
- C:\Windows\System\XAlAAYe.exe
  C:\Windows\System\XAlAAYe.exe
  2⤵
  PID:9564
- C:\Windows\System\kqoXyig.exe
  C:\Windows\System\kqoXyig.exe
  2⤵
  PID:9592
- C:\Windows\System\XMFHtfl.exe
  C:\Windows\System\XMFHtfl.exe
  2⤵
  PID:9608
- C:\Windows\System\USPTThD.exe
  C:\Windows\System\USPTThD.exe
  2⤵
  PID:9624
- C:\Windows\System\garAdCs.exe
  C:\Windows\System\garAdCs.exe
  2⤵
  PID:9648
- C:\Windows\System\DjKPYqo.exe
  C:\Windows\System\DjKPYqo.exe
  2⤵
  PID:9664
- C:\Windows\System\JDNdhvu.exe
  C:\Windows\System\JDNdhvu.exe
  2⤵
  PID:9688
- C:\Windows\System\HxzMabs.exe
  C:\Windows\System\HxzMabs.exe
  2⤵
  PID:9712
- C:\Windows\System\hUKOAjU.exe
  C:\Windows\System\hUKOAjU.exe
  2⤵
  PID:9740
- C:\Windows\System\SzGJKVK.exe
  C:\Windows\System\SzGJKVK.exe
  2⤵
  PID:9756
- C:\Windows\System\pjsoxxY.exe
  C:\Windows\System\pjsoxxY.exe
  2⤵
  PID:9780
- C:\Windows\System\vFLsKEQ.exe
  C:\Windows\System\vFLsKEQ.exe
  2⤵
  PID:9796
- C:\Windows\System\pBIbzDa.exe
  C:\Windows\System\pBIbzDa.exe
  2⤵
  PID:9816
- C:\Windows\System\lftJVZv.exe
  C:\Windows\System\lftJVZv.exe
  2⤵
  PID:9832
- C:\Windows\System\PauGRqa.exe
  C:\Windows\System\PauGRqa.exe
  2⤵
  PID:9852
- C:\Windows\System\eztkmqc.exe
  C:\Windows\System\eztkmqc.exe
  2⤵
  PID:9868
- C:\Windows\System\rZDQgUV.exe
  C:\Windows\System\rZDQgUV.exe
  2⤵
  PID:9888
- C:\Windows\System\CkZaPVt.exe
  C:\Windows\System\CkZaPVt.exe
  2⤵
  PID:9908
- C:\Windows\System\fNNmnym.exe
  C:\Windows\System\fNNmnym.exe
  2⤵
  PID:9932
- C:\Windows\System\birUVoh.exe
  C:\Windows\System\birUVoh.exe
  2⤵
  PID:9952
- C:\Windows\System\jMrEBfE.exe
  C:\Windows\System\jMrEBfE.exe
  2⤵
  PID:9968
- C:\Windows\System\GrOFiVZ.exe
  C:\Windows\System\GrOFiVZ.exe
  2⤵
  PID:9984
- C:\Windows\System\NoVdbex.exe
  C:\Windows\System\NoVdbex.exe
  2⤵
  PID:10004
- C:\Windows\System\kqmArcl.exe
  C:\Windows\System\kqmArcl.exe
  2⤵
  PID:10020
- C:\Windows\System\UHQSWOd.exe
  C:\Windows\System\UHQSWOd.exe
  2⤵
  PID:10036
- C:\Windows\System\VNQdwJa.exe
  C:\Windows\System\VNQdwJa.exe
  2⤵
  PID:10060
- C:\Windows\System\UpruIOc.exe
  C:\Windows\System\UpruIOc.exe
  2⤵
  PID:10080
- C:\Windows\System\BTQgboS.exe
  C:\Windows\System\BTQgboS.exe
  2⤵
  PID:10100
- C:\Windows\System\bLrqaHE.exe
  C:\Windows\System\bLrqaHE.exe
  2⤵
  PID:10124
- C:\Windows\System\NAGqDdO.exe
  C:\Windows\System\NAGqDdO.exe
  2⤵
  PID:10140
- C:\Windows\System\ZLCpGSe.exe
  C:\Windows\System\ZLCpGSe.exe
  2⤵
  PID:10156
- C:\Windows\System\VUbbPvB.exe
  C:\Windows\System\VUbbPvB.exe
  2⤵
  PID:10188
- C:\Windows\System\gmjARcZ.exe
  C:\Windows\System\gmjARcZ.exe
  2⤵
  PID:10204
- C:\Windows\System\uPouGWk.exe
  C:\Windows\System\uPouGWk.exe
  2⤵
  PID:10220
- C:\Windows\System\LTRBnRF.exe
  C:\Windows\System\LTRBnRF.exe
  2⤵
  PID:10236
- C:\Windows\System\UasYLQv.exe
  C:\Windows\System\UasYLQv.exe
  2⤵
  PID:7668
- C:\Windows\System\hooUfsB.exe
  C:\Windows\System\hooUfsB.exe
  2⤵
  PID:7696
- C:\Windows\System\BlQwyiB.exe
  C:\Windows\System\BlQwyiB.exe
  2⤵
  PID:8284
- C:\Windows\System\cwtIacY.exe
  C:\Windows\System\cwtIacY.exe
  2⤵
  PID:6548
- C:\Windows\System\SndPfCi.exe
  C:\Windows\System\SndPfCi.exe
  2⤵
  PID:3264
- C:\Windows\System\WAorOWh.exe
  C:\Windows\System\WAorOWh.exe
  2⤵
  PID:7852
- C:\Windows\System\HXHgNxj.exe
  C:\Windows\System\HXHgNxj.exe
  2⤵
  PID:8424
- C:\Windows\System\dpmBRoK.exe
  C:\Windows\System\dpmBRoK.exe
  2⤵
  PID:8484
- C:\Windows\System\rcOgeDn.exe
  C:\Windows\System\rcOgeDn.exe
  2⤵
  PID:8568
- C:\Windows\System\lNjYKKp.exe
  C:\Windows\System\lNjYKKp.exe
  2⤵
  PID:8664
- C:\Windows\System\QnpyUQP.exe
  C:\Windows\System\QnpyUQP.exe
  2⤵
  PID:8032
- C:\Windows\System\zeyLLQe.exe
  C:\Windows\System\zeyLLQe.exe
  2⤵
  PID:8084
- C:\Windows\System\XYNtAJA.exe
  C:\Windows\System\XYNtAJA.exe
  2⤵
  PID:8160
- C:\Windows\System\JPZWIEH.exe
  C:\Windows\System\JPZWIEH.exe
  2⤵
  PID:8184
- C:\Windows\System\uNYFfOa.exe
  C:\Windows\System\uNYFfOa.exe
  2⤵
  PID:10256
- C:\Windows\System\pPGHcsf.exe
  C:\Windows\System\pPGHcsf.exe
  2⤵
  PID:10276
- C:\Windows\System\wCbJymP.exe
  C:\Windows\System\wCbJymP.exe
  2⤵
  PID:10292
- C:\Windows\System\yYzutuS.exe
  C:\Windows\System\yYzutuS.exe
  2⤵
  PID:10316
- C:\Windows\System\ZSvYCGx.exe
  C:\Windows\System\ZSvYCGx.exe
  2⤵
  PID:10332
- C:\Windows\System\sGOekFl.exe
  C:\Windows\System\sGOekFl.exe
  2⤵
  PID:10356
- C:\Windows\System\zbktuOv.exe
  C:\Windows\System\zbktuOv.exe
  2⤵
  PID:10376
- C:\Windows\System\kkMZtzP.exe
  C:\Windows\System\kkMZtzP.exe
  2⤵
  PID:10396
- C:\Windows\System\gaiUFba.exe
  C:\Windows\System\gaiUFba.exe
  2⤵
  PID:10412
- C:\Windows\System\QmtmEYJ.exe
  C:\Windows\System\QmtmEYJ.exe
  2⤵
  PID:10440
- C:\Windows\System\LwvByuo.exe
  C:\Windows\System\LwvByuo.exe
  2⤵
  PID:10456
- C:\Windows\System\ywljtXJ.exe
  C:\Windows\System\ywljtXJ.exe
  2⤵
  PID:10492
- C:\Windows\System\qmlAZTM.exe
  C:\Windows\System\qmlAZTM.exe
  2⤵
  PID:10512
- C:\Windows\System\IpARVWr.exe
  C:\Windows\System\IpARVWr.exe
  2⤵
  PID:10536
- C:\Windows\System\jNXLfOz.exe
  C:\Windows\System\jNXLfOz.exe
  2⤵
  PID:10556
- C:\Windows\System\lytJleX.exe
  C:\Windows\System\lytJleX.exe
  2⤵
  PID:10572
- C:\Windows\System\xdKuuWU.exe
  C:\Windows\System\xdKuuWU.exe
  2⤵
  PID:10592
- C:\Windows\System\qPPgFxK.exe
  C:\Windows\System\qPPgFxK.exe
  2⤵
  PID:10608
- C:\Windows\System\NVltRxy.exe
  C:\Windows\System\NVltRxy.exe
  2⤵
  PID:10624
- C:\Windows\System\TwCpESF.exe
  C:\Windows\System\TwCpESF.exe
  2⤵
  PID:10644
- C:\Windows\System\OVqipoM.exe
  C:\Windows\System\OVqipoM.exe
  2⤵
  PID:10664
- C:\Windows\System\ytHSQvQ.exe
  C:\Windows\System\ytHSQvQ.exe
  2⤵
  PID:10684
- C:\Windows\System\VlQRuGb.exe
  C:\Windows\System\VlQRuGb.exe
  2⤵
  PID:10708
- C:\Windows\System\nKeCPZh.exe
  C:\Windows\System\nKeCPZh.exe
  2⤵
  PID:10728
- C:\Windows\System\MLDxBtB.exe
  C:\Windows\System\MLDxBtB.exe
  2⤵
  PID:10748
- C:\Windows\System\PhmihkV.exe
  C:\Windows\System\PhmihkV.exe
  2⤵
  PID:10764
- C:\Windows\System\xLLdPfo.exe
  C:\Windows\System\xLLdPfo.exe
  2⤵
  PID:10796
- C:\Windows\System\ggleusk.exe
  C:\Windows\System\ggleusk.exe
  2⤵
  PID:10820
- C:\Windows\System\zNkmOjC.exe
  C:\Windows\System\zNkmOjC.exe
  2⤵
  PID:10836
- C:\Windows\System\lwEPpxf.exe
  C:\Windows\System\lwEPpxf.exe
  2⤵
  PID:10860
- C:\Windows\System\kcUJhDB.exe
  C:\Windows\System\kcUJhDB.exe
  2⤵
  PID:10880
- C:\Windows\System\JxBXRxi.exe
  C:\Windows\System\JxBXRxi.exe
  2⤵
  PID:10900
- C:\Windows\System\SWvbVIO.exe
  C:\Windows\System\SWvbVIO.exe
  2⤵
  PID:10920
- C:\Windows\System\mgMzDau.exe
  C:\Windows\System\mgMzDau.exe
  2⤵
  PID:10944
- C:\Windows\System\SlsBIIF.exe
  C:\Windows\System\SlsBIIF.exe
  2⤵
  PID:10964
- C:\Windows\System\osZCElC.exe
  C:\Windows\System\osZCElC.exe
  2⤵
  PID:10980
- C:\Windows\System\akKtOXJ.exe
  C:\Windows\System\akKtOXJ.exe
  2⤵
  PID:11000
- C:\Windows\System\gCUQJSU.exe
  C:\Windows\System\gCUQJSU.exe
  2⤵
  PID:11020
- C:\Windows\System\FlpfdKG.exe
  C:\Windows\System\FlpfdKG.exe
  2⤵
  PID:11040
- C:\Windows\System\fEzxUYK.exe
  C:\Windows\System\fEzxUYK.exe
  2⤵
  PID:11068
- C:\Windows\System\LQmYSWT.exe
  C:\Windows\System\LQmYSWT.exe
  2⤵
  PID:11088
- C:\Windows\System\mPqUuJs.exe
  C:\Windows\System\mPqUuJs.exe
  2⤵
  PID:11108
- C:\Windows\System\dZCsADC.exe
  C:\Windows\System\dZCsADC.exe
  2⤵
  PID:11128
- C:\Windows\System\tRcnfsU.exe
  C:\Windows\System\tRcnfsU.exe
  2⤵
  PID:11144
- C:\Windows\System\iAipkDZ.exe
  C:\Windows\System\iAipkDZ.exe
  2⤵
  PID:11164
- C:\Windows\System\PURHJFf.exe
  C:\Windows\System\PURHJFf.exe
  2⤵
  PID:11184
- C:\Windows\System\OfkUrWW.exe
  C:\Windows\System\OfkUrWW.exe
  2⤵
  PID:11208
- C:\Windows\System\NKfrHyU.exe
  C:\Windows\System\NKfrHyU.exe
  2⤵
  PID:11228
- C:\Windows\System\uybXQnx.exe
  C:\Windows\System\uybXQnx.exe
  2⤵
  PID:11248
- C:\Windows\System\apvBcko.exe
  C:\Windows\System\apvBcko.exe
  2⤵
  PID:7244
- C:\Windows\System\kwyXVnK.exe
  C:\Windows\System\kwyXVnK.exe
  2⤵
  PID:7280
- C:\Windows\System\GMuBweh.exe
  C:\Windows\System\GMuBweh.exe
  2⤵
  PID:7364
- C:\Windows\System\cDTgHJR.exe
  C:\Windows\System\cDTgHJR.exe
  2⤵
  PID:9152
- C:\Windows\System\vDUYieV.exe
  C:\Windows\System\vDUYieV.exe
  2⤵
  PID:8064
- C:\Windows\System\gPyutSO.exe
  C:\Windows\System\gPyutSO.exe
  2⤵
  PID:6928
- C:\Windows\System\JeCfLHx.exe
  C:\Windows\System\JeCfLHx.exe
  2⤵
  PID:6944
- C:\Windows\System\XVvUzMt.exe
  C:\Windows\System\XVvUzMt.exe
  2⤵
  PID:7476
- C:\Windows\System\RxPkcxn.exe
  C:\Windows\System\RxPkcxn.exe
  2⤵
  PID:6672
- C:\Windows\System\CfoMFXZ.exe
  C:\Windows\System\CfoMFXZ.exe
  2⤵
  PID:7572
- C:\Windows\System\ccxaWEI.exe
  C:\Windows\System\ccxaWEI.exe
  2⤵
  PID:9296
- C:\Windows\System\TxNGIUs.exe
  C:\Windows\System\TxNGIUs.exe
  2⤵
  PID:7120
- C:\Windows\System\IzwpXjs.exe
  C:\Windows\System\IzwpXjs.exe
  2⤵
  PID:7600
- C:\Windows\System\MLbSeEI.exe
  C:\Windows\System\MLbSeEI.exe
  2⤵
  PID:8196
- C:\Windows\System\WmumRxR.exe
  C:\Windows\System\WmumRxR.exe
  2⤵
  PID:9504
- C:\Windows\System\OPqMaKm.exe
  C:\Windows\System\OPqMaKm.exe
  2⤵
  PID:9520
- C:\Windows\System\QuqLcZJ.exe
  C:\Windows\System\QuqLcZJ.exe
  2⤵
  PID:11268
- C:\Windows\System\CQkAlij.exe
  C:\Windows\System\CQkAlij.exe
  2⤵
  PID:11292
- C:\Windows\System\hOzIHrX.exe
  C:\Windows\System\hOzIHrX.exe
  2⤵
  PID:11308
- C:\Windows\System\dKvJOvF.exe
  C:\Windows\System\dKvJOvF.exe
  2⤵
  PID:11324
- C:\Windows\System\AsjRhSG.exe
  C:\Windows\System\AsjRhSG.exe
  2⤵
  PID:11344
- C:\Windows\System\sxYapdV.exe
  C:\Windows\System\sxYapdV.exe
  2⤵
  PID:11364
- C:\Windows\System\kxUcxvf.exe
  C:\Windows\System\kxUcxvf.exe
  2⤵
  PID:11388
- C:\Windows\System\UfbEiiT.exe
  C:\Windows\System\UfbEiiT.exe
  2⤵
  PID:11416
- C:\Windows\System\DiWgGWd.exe
  C:\Windows\System\DiWgGWd.exe
  2⤵
  PID:11432
- C:\Windows\System\oTOIBGm.exe
  C:\Windows\System\oTOIBGm.exe
  2⤵
  PID:11452
- C:\Windows\System\IluiTkT.exe
  C:\Windows\System\IluiTkT.exe
  2⤵
  PID:11476
- C:\Windows\System\bUfukni.exe
  C:\Windows\System\bUfukni.exe
  2⤵
  PID:11496
- C:\Windows\System\VQOVLts.exe
  C:\Windows\System\VQOVLts.exe
  2⤵
  PID:11516
- C:\Windows\System\ejflusA.exe
  C:\Windows\System\ejflusA.exe
  2⤵
  PID:11540
- C:\Windows\System\xNBZDAm.exe
  C:\Windows\System\xNBZDAm.exe
  2⤵
  PID:11560
- C:\Windows\System\GUCJtjb.exe
  C:\Windows\System\GUCJtjb.exe
  2⤵
  PID:11584
- C:\Windows\System\tZWGLJG.exe
  C:\Windows\System\tZWGLJG.exe
  2⤵
  PID:11600
- C:\Windows\System\klTVTfV.exe
  C:\Windows\System\klTVTfV.exe
  2⤵
  PID:11624
- C:\Windows\System\SpOisUV.exe
  C:\Windows\System\SpOisUV.exe
  2⤵
  PID:11640
- C:\Windows\System\EdRivbd.exe
  C:\Windows\System\EdRivbd.exe
  2⤵
  PID:11660
- C:\Windows\System\OhkpiWf.exe
  C:\Windows\System\OhkpiWf.exe
  2⤵
  PID:11676
- C:\Windows\System\fcRihKg.exe
  C:\Windows\System\fcRihKg.exe
  2⤵
  PID:11696
- C:\Windows\System\vxOyhHo.exe
  C:\Windows\System\vxOyhHo.exe
  2⤵
  PID:11712
- C:\Windows\System\KVWxbzr.exe
  C:\Windows\System\KVWxbzr.exe
  2⤵
  PID:11732
- C:\Windows\System\cCuqvcR.exe
  C:\Windows\System\cCuqvcR.exe
  2⤵
  PID:11748
- C:\Windows\System\afbIIts.exe
  C:\Windows\System\afbIIts.exe
  2⤵
  PID:11768
- C:\Windows\System\qqzCzmJ.exe
  C:\Windows\System\qqzCzmJ.exe
  2⤵
  PID:11788
- C:\Windows\System\EkitAsp.exe
  C:\Windows\System\EkitAsp.exe
  2⤵
  PID:11804
- C:\Windows\System\sctCxtJ.exe
  C:\Windows\System\sctCxtJ.exe
  2⤵
  PID:11828
- C:\Windows\System\XZVpuld.exe
  C:\Windows\System\XZVpuld.exe
  2⤵
  PID:11848
- C:\Windows\System\NipElCA.exe
  C:\Windows\System\NipElCA.exe
  2⤵
  PID:11864
- C:\Windows\System\yAKgFZr.exe
  C:\Windows\System\yAKgFZr.exe
  2⤵
  PID:11884
- C:\Windows\System\SHwFUUu.exe
  C:\Windows\System\SHwFUUu.exe
  2⤵
  PID:11900
- C:\Windows\System\wWNdfQF.exe
  C:\Windows\System\wWNdfQF.exe
  2⤵
  PID:11916
- C:\Windows\System\BbYghJX.exe
  C:\Windows\System\BbYghJX.exe
  2⤵
  PID:11932
- C:\Windows\System\dnmUOEl.exe
  C:\Windows\System\dnmUOEl.exe
  2⤵
  PID:11948
- C:\Windows\System\pRrSclr.exe
  C:\Windows\System\pRrSclr.exe
  2⤵
  PID:11964
- C:\Windows\System\yTqCWKV.exe
  C:\Windows\System\yTqCWKV.exe
  2⤵
  PID:11980
- C:\Windows\System\kmMHLSE.exe
  C:\Windows\System\kmMHLSE.exe
  2⤵
  PID:12000
- C:\Windows\System\inZMKko.exe
  C:\Windows\System\inZMKko.exe
  2⤵
  PID:12020
- C:\Windows\System\YYeXLaj.exe
  C:\Windows\System\YYeXLaj.exe
  2⤵
  PID:12040
- C:\Windows\System\jIXSdVS.exe
  C:\Windows\System\jIXSdVS.exe
  2⤵
  PID:12060
- C:\Windows\System\DuBpCdU.exe
  C:\Windows\System\DuBpCdU.exe
  2⤵
  PID:12080
- C:\Windows\System\YvOzZAE.exe
  C:\Windows\System\YvOzZAE.exe
  2⤵
  PID:12096
- C:\Windows\System\TCfbknE.exe
  C:\Windows\System\TCfbknE.exe
  2⤵
  PID:12116
- C:\Windows\System\miuOQXH.exe
  C:\Windows\System\miuOQXH.exe
  2⤵
  PID:12152
- C:\Windows\System\wkOEBoL.exe
  C:\Windows\System\wkOEBoL.exe
  2⤵
  PID:12172
- C:\Windows\System\LQXcDhO.exe
  C:\Windows\System\LQXcDhO.exe
  2⤵
  PID:12192
- C:\Windows\System\ZyrRbpx.exe
  C:\Windows\System\ZyrRbpx.exe
  2⤵
  PID:12212
- C:\Windows\System\mMckYFS.exe
  C:\Windows\System\mMckYFS.exe
  2⤵
  PID:12236
- C:\Windows\System\XLtfXWp.exe
  C:\Windows\System\XLtfXWp.exe
  2⤵
  PID:12252
- C:\Windows\System\IyyigGX.exe
  C:\Windows\System\IyyigGX.exe
  2⤵
  PID:12272
- C:\Windows\System\bQvnfDO.exe
  C:\Windows\System\bQvnfDO.exe
  2⤵
  PID:9604
- C:\Windows\System\OmoGpPZ.exe
  C:\Windows\System\OmoGpPZ.exe
  2⤵
  PID:9684
- C:\Windows\System\CqfeTOC.exe
  C:\Windows\System\CqfeTOC.exe
  2⤵
  PID:7748
- C:\Windows\System\gNxhnpa.exe
  C:\Windows\System\gNxhnpa.exe
  2⤵
  PID:7792
- C:\Windows\System\tNqQxsL.exe
  C:\Windows\System\tNqQxsL.exe
  2⤵
  PID:7816
- C:\Windows\System\McEHIks.exe
  C:\Windows\System\McEHIks.exe
  2⤵
  PID:7892
- C:\Windows\System\jmMgdfX.exe
  C:\Windows\System\jmMgdfX.exe
  2⤵
  PID:9828
- C:\Windows\System\RhBhbPe.exe
  C:\Windows\System\RhBhbPe.exe
  2⤵
  PID:9880
- C:\Windows\System\WpFdWOn.exe
  C:\Windows\System\WpFdWOn.exe
  2⤵
  PID:8448
- C:\Windows\System\pWGLiCL.exe
  C:\Windows\System\pWGLiCL.exe
  2⤵
  PID:8520
- C:\Windows\System\uqaRNiM.exe
  C:\Windows\System\uqaRNiM.exe
  2⤵
  PID:7952
- C:\Windows\System\awlDDME.exe
  C:\Windows\System\awlDDME.exe
  2⤵
  PID:7992
- C:\Windows\System\AgeXzXC.exe
  C:\Windows\System\AgeXzXC.exe
  2⤵
  PID:8552
- C:\Windows\System\LccRVWE.exe
  C:\Windows\System\LccRVWE.exe
  2⤵
  PID:8584
- C:\Windows\System\ELsTvSE.exe
  C:\Windows\System\ELsTvSE.exe
  2⤵
  PID:8620
- C:\Windows\System\WTrRmwm.exe
  C:\Windows\System\WTrRmwm.exe
  2⤵
  PID:10116
- C:\Windows\System\yIIWprX.exe
  C:\Windows\System\yIIWprX.exe
  2⤵
  PID:10228
- C:\Windows\System\ZflonGW.exe
  C:\Windows\System\ZflonGW.exe
  2⤵
  PID:8736
- C:\Windows\System\PkbVquo.exe
  C:\Windows\System\PkbVquo.exe
  2⤵
  PID:12292
- C:\Windows\System\gHNwFMo.exe
  C:\Windows\System\gHNwFMo.exe
  2⤵
  PID:12312
- C:\Windows\System\LtNXiFH.exe
  C:\Windows\System\LtNXiFH.exe
  2⤵
  PID:12332
- C:\Windows\System\DjRJwmF.exe
  C:\Windows\System\DjRJwmF.exe
  2⤵
  PID:12348
- C:\Windows\System\uGFnfvD.exe
  C:\Windows\System\uGFnfvD.exe
  2⤵
  PID:12368
- C:\Windows\System\nXEosSw.exe
  C:\Windows\System\nXEosSw.exe
  2⤵
  PID:12388
- C:\Windows\System\shMTqbO.exe
  C:\Windows\System\shMTqbO.exe
  2⤵
  PID:12412
- C:\Windows\System\QLMPqYl.exe
  C:\Windows\System\QLMPqYl.exe
  2⤵
  PID:12432
- C:\Windows\System\vNQrMea.exe
  C:\Windows\System\vNQrMea.exe
  2⤵
  PID:12452
- C:\Windows\System\fyasiOa.exe
  C:\Windows\System\fyasiOa.exe
  2⤵
  PID:12472
- C:\Windows\System\MCqFIrN.exe
  C:\Windows\System\MCqFIrN.exe
  2⤵
  PID:12492
- C:\Windows\System\hbAUuya.exe
  C:\Windows\System\hbAUuya.exe
  2⤵
  PID:12512
- C:\Windows\System\JyYEqHZ.exe
  C:\Windows\System\JyYEqHZ.exe
  2⤵
  PID:12528
- C:\Windows\System\UDHKccn.exe
  C:\Windows\System\UDHKccn.exe
  2⤵
  PID:12544
- C:\Windows\System\IrcDJUH.exe
  C:\Windows\System\IrcDJUH.exe
  2⤵
  PID:12564
- C:\Windows\System\hHPEWZl.exe
  C:\Windows\System\hHPEWZl.exe
  2⤵
  PID:12592
- C:\Windows\System\dxVIUhH.exe
  C:\Windows\System\dxVIUhH.exe
  2⤵
  PID:12612
- C:\Windows\System\sUmHCWw.exe
  C:\Windows\System\sUmHCWw.exe
  2⤵
  PID:12628
- C:\Windows\System\WQnizyU.exe
  C:\Windows\System\WQnizyU.exe
  2⤵
  PID:12644
- C:\Windows\System\IhVipft.exe
  C:\Windows\System\IhVipft.exe
  2⤵
  PID:12660
- C:\Windows\System\RHbOPOq.exe
  C:\Windows\System\RHbOPOq.exe
  2⤵
  PID:12676
- C:\Windows\System\PVQvVhm.exe
  C:\Windows\System\PVQvVhm.exe
  2⤵
  PID:12692
- C:\Windows\System\GSSrEEZ.exe
  C:\Windows\System\GSSrEEZ.exe
  2⤵
  PID:12716
- C:\Windows\System\OumnptU.exe
  C:\Windows\System\OumnptU.exe
  2⤵
  PID:12732
- C:\Windows\System\AtsQSOo.exe
  C:\Windows\System\AtsQSOo.exe
  2⤵
  PID:12752
- C:\Windows\System\itmGgTE.exe
  C:\Windows\System\itmGgTE.exe
  2⤵
  PID:12772
- C:\Windows\System\aVlgwTZ.exe
  C:\Windows\System\aVlgwTZ.exe
  2⤵
  PID:12792
- C:\Windows\System\jRswOTj.exe
  C:\Windows\System\jRswOTj.exe
  2⤵
  PID:12812
- C:\Windows\System\GCrskmH.exe
  C:\Windows\System\GCrskmH.exe
  2⤵
  PID:12832
- C:\Windows\System\RbRFzYP.exe
  C:\Windows\System\RbRFzYP.exe
  2⤵
  PID:12848
- C:\Windows\System\oqJPKLf.exe
  C:\Windows\System\oqJPKLf.exe
  2⤵
  PID:12872
- C:\Windows\System\rxPnNkk.exe
  C:\Windows\System\rxPnNkk.exe
  2⤵
  PID:12892
- C:\Windows\System\IqxXqsM.exe
  C:\Windows\System\IqxXqsM.exe
  2⤵
  PID:12912
- C:\Windows\System\cdWIvIH.exe
  C:\Windows\System\cdWIvIH.exe
  2⤵
  PID:12932
- C:\Windows\System\pZnOWQR.exe
  C:\Windows\System\pZnOWQR.exe
  2⤵
  PID:12948
- C:\Windows\System\PlcrGrU.exe
  C:\Windows\System\PlcrGrU.exe
  2⤵
  PID:12972
- C:\Windows\System\ZSYjHlG.exe
  C:\Windows\System\ZSYjHlG.exe
  2⤵
  PID:12992
- C:\Windows\System\UDRQvhd.exe
  C:\Windows\System\UDRQvhd.exe
  2⤵
  PID:13008
- C:\Windows\System\FWsbzRD.exe
  C:\Windows\System\FWsbzRD.exe
  2⤵
  PID:13024
- C:\Windows\System\LdeZMia.exe
  C:\Windows\System\LdeZMia.exe
  2⤵
  PID:13052
- C:\Windows\System\pwxfqVo.exe
  C:\Windows\System\pwxfqVo.exe
  2⤵
  PID:13072
- C:\Windows\System\hSsCBRy.exe
  C:\Windows\System\hSsCBRy.exe
  2⤵
  PID:13088
- C:\Windows\System\YQPeoAq.exe
  C:\Windows\System\YQPeoAq.exe
  2⤵
  PID:13116
- C:\Windows\System\rRMRmAv.exe
  C:\Windows\System\rRMRmAv.exe
  2⤵
  PID:13136
- C:\Windows\System\IqpRdss.exe
  C:\Windows\System\IqpRdss.exe
  2⤵
  PID:13152
- C:\Windows\System\bOTixka.exe
  C:\Windows\System\bOTixka.exe
  2⤵
  PID:13180
- C:\Windows\System\WGQUzjF.exe
  C:\Windows\System\WGQUzjF.exe
  2⤵
  PID:13204
- C:\Windows\System\MhnyzGY.exe
  C:\Windows\System\MhnyzGY.exe
  2⤵
  PID:13220
- C:\Windows\System\PrqkrpP.exe
  C:\Windows\System\PrqkrpP.exe
  2⤵
  PID:7248
- C:\Windows\System\eZjtYmf.exe
  C:\Windows\System\eZjtYmf.exe
  2⤵
  PID:9536
- C:\Windows\System\EfpAaLz.exe
  C:\Windows\System\EfpAaLz.exe
  2⤵
  PID:8704
- C:\Windows\System\ifitBug.exe
  C:\Windows\System\ifitBug.exe
  2⤵
  PID:7840
- C:\Windows\System\dXCALhX.exe
  C:\Windows\System\dXCALhX.exe
  2⤵
  PID:4244
- C:\Windows\System\dHFMBZX.exe
  C:\Windows\System\dHFMBZX.exe
  2⤵
  PID:8328
- C:\Windows\System\HWkwXTZ.exe
  C:\Windows\System\HWkwXTZ.exe
  2⤵
  PID:11572
- C:\Windows\System\cvmeKWR.exe
  C:\Windows\System\cvmeKWR.exe
  2⤵
  PID:8352
- C:\Windows\System\nqksKoN.exe
  C:\Windows\System\nqksKoN.exe
  2⤵
  PID:11800
- C:\Windows\System\CbIOquW.exe
  C:\Windows\System\CbIOquW.exe
  2⤵
  PID:10372
- C:\Windows\System\cTetkQq.exe
  C:\Windows\System\cTetkQq.exe
  2⤵
  PID:11756
- C:\Windows\System\vfNlyPp.exe
  C:\Windows\System\vfNlyPp.exe
  2⤵
  PID:13292
- C:\Windows\System\lpqfSRw.exe
  C:\Windows\System\lpqfSRw.exe
  2⤵
  PID:1624
- C:\Windows\System\TuBWPHz.exe
  C:\Windows\System\TuBWPHz.exe
  2⤵
  PID:7808
- C:\Windows\System\SzGTojn.exe
  C:\Windows\System\SzGTojn.exe
  2⤵
  PID:13196
- C:\Windows\System\PjBzvqZ.exe
  C:\Windows\System\PjBzvqZ.exe
  2⤵
  PID:10956
- C:\Windows\System\fQiMiyZ.exe
  C:\Windows\System\fQiMiyZ.exe
  2⤵
  PID:2708
- C:\Windows\System\lESVQoh.exe
  C:\Windows\System\lESVQoh.exe
  2⤵
  PID:13284
- C:\Windows\System\GXtsTmS.exe
  C:\Windows\System\GXtsTmS.exe
  2⤵
  PID:8088
- C:\Windows\System\pzFdLCh.exe
  C:\Windows\System\pzFdLCh.exe
  2⤵
  PID:8752
- C:\Windows\System\OpPNIaZ.exe
  C:\Windows\System\OpPNIaZ.exe
  2⤵
  PID:13060
- C:\Windows\System\gTGVImp.exe
  C:\Windows\System\gTGVImp.exe
  2⤵
  PID:10272
- C:\Windows\System\SPLyMpf.exe
  C:\Windows\System\SPLyMpf.exe
  2⤵
  PID:10328
- C:\Windows\System\NhjOIkM.exe
  C:\Windows\System\NhjOIkM.exe
  2⤵
  PID:7108
- C:\Windows\System\PkPyEBa.exe
  C:\Windows\System\PkPyEBa.exe
  2⤵
  PID:7296
- C:\Windows\System\EhcePYd.exe
  C:\Windows\System\EhcePYd.exe
  2⤵
  PID:10744
- C:\Windows\System\PXtISUA.exe
  C:\Windows\System\PXtISUA.exe
  2⤵
  PID:13144
- C:\Windows\System\QEtIMLF.exe
  C:\Windows\System\QEtIMLF.exe
  2⤵
  PID:12144
- C:\Windows\System\AgBbILM.exe
  C:\Windows\System\AgBbILM.exe
  2⤵
  PID:7084
- C:\Windows\System\rSvRrWY.exe
  C:\Windows\System\rSvRrWY.exe
  2⤵
  PID:5252
- C:\Windows\System\vnymqeN.exe
  C:\Windows\System\vnymqeN.exe
  2⤵
  PID:6608
- C:\Windows\System\CfTauJc.exe
  C:\Windows\System\CfTauJc.exe
  2⤵
  PID:2124
- C:\Windows\System\LUxwqMf.exe
  C:\Windows\System\LUxwqMf.exe
  2⤵
  PID:12724
- C:\Windows\System\uqxmJvg.exe
  C:\Windows\System\uqxmJvg.exe
  2⤵
  PID:12788
- C:\Windows\System\NSZElKt.exe
  C:\Windows\System\NSZElKt.exe
  2⤵
  PID:12944
- C:\Windows\System\NOtUVUE.exe
  C:\Windows\System\NOtUVUE.exe
  2⤵
  PID:9580
- C:\Windows\System\AlvUNwE.exe
  C:\Windows\System\AlvUNwE.exe
  2⤵
  PID:11396
- C:\Windows\System\UyklOmm.exe
  C:\Windows\System\UyklOmm.exe
  2⤵
  PID:9824
- C:\Windows\System\QNxIwKk.exe
  C:\Windows\System\QNxIwKk.exe
  2⤵
  PID:11776
- C:\Windows\System\gJAEeFx.exe
  C:\Windows\System\gJAEeFx.exe
  2⤵
  PID:9964
- C:\Windows\System\SDhzvjw.exe
  C:\Windows\System\SDhzvjw.exe
  2⤵
  PID:11840
- C:\Windows\System\ELAFHXP.exe
  C:\Windows\System\ELAFHXP.exe
  2⤵
  PID:10184
- C:\Windows\System\PsERyad.exe
  C:\Windows\System\PsERyad.exe
  2⤵
  PID:12364
- C:\Windows\System\npDVLob.exe
  C:\Windows\System\npDVLob.exe
  2⤵
  PID:10564
- C:\Windows\System\WOsYQUd.exe
  C:\Windows\System\WOsYQUd.exe
  2⤵
  PID:10872
- C:\Windows\System\whofsyJ.exe
  C:\Windows\System\whofsyJ.exe
  2⤵
  PID:9044
- C:\Windows\System\ImSRysf.exe
  C:\Windows\System\ImSRysf.exe
  2⤵
  PID:8232
- C:\Windows\System\PyJbyOd.exe
  C:\Windows\System\PyJbyOd.exe
  2⤵
  PID:12900
- C:\Windows\System\wPgCtqd.exe
  C:\Windows\System\wPgCtqd.exe
  2⤵
  PID:13320
- C:\Windows\System\SFDOlmR.exe
  C:\Windows\System\SFDOlmR.exe
  2⤵
  PID:13336
- C:\Windows\System\BcaAzSk.exe
  C:\Windows\System\BcaAzSk.exe
  2⤵
  PID:13356
- C:\Windows\System\JTZuAgt.exe
  C:\Windows\System\JTZuAgt.exe
  2⤵
  PID:13372
- C:\Windows\System\LHIzgPm.exe
  C:\Windows\System\LHIzgPm.exe
  2⤵
  PID:13388
- C:\Windows\System\DmrkMOA.exe
  C:\Windows\System\DmrkMOA.exe
  2⤵
  PID:13408
- C:\Windows\System\VhzBiGh.exe
  C:\Windows\System\VhzBiGh.exe
  2⤵
  PID:13424
- C:\Windows\System\vOjCuCu.exe
  C:\Windows\System\vOjCuCu.exe
  2⤵
  PID:13452
- C:\Windows\System\CvQNyCd.exe
  C:\Windows\System\CvQNyCd.exe
  2⤵
  PID:13468
- C:\Windows\System\ibSWIbN.exe
  C:\Windows\System\ibSWIbN.exe
  2⤵
  PID:13488
- C:\Windows\System\sXiTOoR.exe
  C:\Windows\System\sXiTOoR.exe
  2⤵
  PID:13504
- C:\Windows\System\EdhdNjn.exe
  C:\Windows\System\EdhdNjn.exe
  2⤵
  PID:13528
- C:\Windows\System\ePeeLHI.exe
  C:\Windows\System\ePeeLHI.exe
  2⤵
  PID:13544
- C:\Windows\System\SpklxfU.exe
  C:\Windows\System\SpklxfU.exe
  2⤵
  PID:13560
- C:\Windows\System\DAsGRkH.exe
  C:\Windows\System\DAsGRkH.exe
  2⤵
  PID:13580
- C:\Windows\System\JjWfPYF.exe
  C:\Windows\System\JjWfPYF.exe
  2⤵
  PID:13636
- C:\Windows\System\iYckwbi.exe
  C:\Windows\System\iYckwbi.exe
  2⤵
  PID:13652
- C:\Windows\System\bhzWNFt.exe
  C:\Windows\System\bhzWNFt.exe
  2⤵
  PID:13804
- C:\Windows\System\eAVgnSm.exe
  C:\Windows\System\eAVgnSm.exe
  2⤵
  PID:13824
- C:\Windows\System\Uurmsln.exe
  C:\Windows\System\Uurmsln.exe
  2⤵
  PID:13844
- C:\Windows\System\YFgeNgN.exe
  C:\Windows\System\YFgeNgN.exe
  2⤵
  PID:13864
- C:\Windows\System\FhLzJen.exe
  C:\Windows\System\FhLzJen.exe
  2⤵
  PID:13880
- C:\Windows\System\ddocnMa.exe
  C:\Windows\System\ddocnMa.exe
  2⤵
  PID:13896
- C:\Windows\System\INKNNSS.exe
  C:\Windows\System\INKNNSS.exe
  2⤵
  PID:13912
- C:\Windows\System\wuHLNiW.exe
  C:\Windows\System\wuHLNiW.exe
  2⤵
  PID:13928
- C:\Windows\System\DZUIXrE.exe
  C:\Windows\System\DZUIXrE.exe
  2⤵
  PID:13944
- C:\Windows\System\XWGoXRc.exe
  C:\Windows\System\XWGoXRc.exe
  2⤵
  PID:13960
- C:\Windows\System\AtgBSeL.exe
  C:\Windows\System\AtgBSeL.exe
  2⤵
  PID:13976
- C:\Windows\System\AelyAny.exe
  C:\Windows\System\AelyAny.exe
  2⤵
  PID:13992
- C:\Windows\System\vpbnoka.exe
  C:\Windows\System\vpbnoka.exe
  2⤵
  PID:10504
- C:\Windows\System\MtDLMTK.exe
  C:\Windows\System\MtDLMTK.exe
  2⤵
  PID:13400
- C:\Windows\System\baZYOeU.exe
  C:\Windows\System\baZYOeU.exe
  2⤵
  PID:2212
- C:\Windows\System\vbCCWEt.exe
  C:\Windows\System\vbCCWEt.exe
  2⤵
  PID:13232
- C:\Windows\System\VPDqrYy.exe
  C:\Windows\System\VPDqrYy.exe
  2⤵
  PID:10012
- C:\Windows\System\ZVrPTGM.exe
  C:\Windows\System\ZVrPTGM.exe
  2⤵
  PID:10300
- C:\Windows\System\SGfLbCa.exe
  C:\Windows\System\SGfLbCa.exe
  2⤵
  PID:13316
- C:\Windows\System\kqtgKdu.exe
  C:\Windows\System\kqtgKdu.exe
  2⤵
  PID:13436
- C:\Windows\System\LGICKTW.exe
  C:\Windows\System\LGICKTW.exe
  2⤵
  PID:13500
- C:\Windows\System\uNnCnuK.exe
  C:\Windows\System\uNnCnuK.exe
  2⤵
  PID:13552
- C:\Windows\System\ZLRjuPR.exe
  C:\Windows\System\ZLRjuPR.exe
  2⤵
  PID:13592
- C:\Windows\System\Unesxgh.exe
  C:\Windows\System\Unesxgh.exe
  2⤵
  PID:13648
- C:\Windows\System\NucPcse.exe
  C:\Windows\System\NucPcse.exe
  2⤵
  PID:13684
- C:\Windows\System\aSSSlNS.exe
  C:\Windows\System\aSSSlNS.exe
  2⤵
  PID:13752
- C:\Windows\System\zVsXVPv.exe
  C:\Windows\System\zVsXVPv.exe
  2⤵
  PID:13784
- C:\Windows\System\MmiIZCb.exe
  C:\Windows\System\MmiIZCb.exe
  2⤵
  PID:13840
- C:\Windows\System\vSKSrcM.exe
  C:\Windows\System\vSKSrcM.exe
  2⤵
  PID:13892
- C:\Windows\System\TJnCPdt.exe
  C:\Windows\System\TJnCPdt.exe
  2⤵
  PID:13924
- C:\Windows\System\EnyExme.exe
  C:\Windows\System\EnyExme.exe
  2⤵
  PID:13988
- C:\Windows\System\FHTDFwn.exe
  C:\Windows\System\FHTDFwn.exe
  2⤵
  PID:14068
- C:\Windows\System\MaGbCSw.exe
  C:\Windows\System\MaGbCSw.exe
  2⤵
  PID:14020
- C:\Windows\System\OrUwUSg.exe
  C:\Windows\System\OrUwUSg.exe
  2⤵
  PID:14036
- C:\Windows\System\pRzmwVf.exe
  C:\Windows\System\pRzmwVf.exe
  2⤵
  PID:14112
- C:\Windows\System\SapvVNh.exe
  C:\Windows\System\SapvVNh.exe
  2⤵
  PID:14208
- C:\Windows\System\ynhVVrF.exe
  C:\Windows\System\ynhVVrF.exe
  2⤵
  PID:14332
- C:\Windows\System\jlgjQfx.exe
  C:\Windows\System\jlgjQfx.exe
  2⤵
  PID:7400
- C:\Windows\System\tJJUHTB.exe
  C:\Windows\System\tJJUHTB.exe
  2⤵
  PID:14272
- C:\Windows\System\ZbWEnEf.exe
  C:\Windows\System\ZbWEnEf.exe
  2⤵
  PID:2596
- C:\Windows\System\njQgJfn.exe
  C:\Windows\System\njQgJfn.exe
  2⤵
  PID:13440
- C:\Windows\System\ybIbDAU.exe
  C:\Windows\System\ybIbDAU.exe
  2⤵
  PID:8480
- C:\Windows\System\ZOonfXD.exe
  C:\Windows\System\ZOonfXD.exe
  2⤵
  PID:11124
- C:\Windows\System\ugSTTzN.exe
  C:\Windows\System\ugSTTzN.exe
  2⤵
  PID:11656
- C:\Windows\System\VDmqRhF.exe
  C:\Windows\System\VDmqRhF.exe
  2⤵
  PID:6124
- C:\Windows\System\OFrBNfp.exe
  C:\Windows\System\OFrBNfp.exe
  2⤵
  PID:11924
- C:\Windows\System\mOGiosy.exe
  C:\Windows\System\mOGiosy.exe
  2⤵
  PID:11780
- C:\Windows\System\OjPHnUb.exe
  C:\Windows\System\OjPHnUb.exe
  2⤵
  PID:3248
- C:\Windows\System\kXqzTRB.exe
  C:\Windows\System\kXqzTRB.exe
  2⤵
  PID:13568
- C:\Windows\System\hOHCsjd.exe
  C:\Windows\System\hOHCsjd.exe
  2⤵
  PID:6708
- C:\Windows\System\JLRNjNe.exe
  C:\Windows\System\JLRNjNe.exe
  2⤵
  PID:10252
- C:\Windows\System\SKVNqAr.exe
  C:\Windows\System\SKVNqAr.exe
  2⤵
  PID:11196
- C:\Windows\System\FmUIXDz.exe
  C:\Windows\System\FmUIXDz.exe
  2⤵
  PID:12408
- C:\Windows\System\MxmrSlG.exe
  C:\Windows\System\MxmrSlG.exe
  2⤵
  PID:8216
- C:\Windows\System\GQlUAcm.exe
  C:\Windows\System\GQlUAcm.exe
  2⤵
  PID:4736
- C:\Windows\System\aqxBsQs.exe
  C:\Windows\System\aqxBsQs.exe
  2⤵
  PID:14116
- C:\Windows\System\dZqKNIH.exe
  C:\Windows\System\dZqKNIH.exe
  2⤵
  PID:11568
- C:\Windows\System\MZDmYjB.exe
  C:\Windows\System\MZDmYjB.exe
  2⤵
  PID:14128
- C:\Windows\System\blaFMsL.exe
  C:\Windows\System\blaFMsL.exe
  2⤵
  PID:9992
- C:\Windows\System\xSfEpTk.exe
  C:\Windows\System\xSfEpTk.exe
  2⤵
  PID:3108
- C:\Windows\System\UfpOiZM.exe
  C:\Windows\System\UfpOiZM.exe
  2⤵
  PID:13680
- C:\Windows\System\TNDnpqb.exe
  C:\Windows\System\TNDnpqb.exe
  2⤵
  PID:13732
- C:\Windows\System\eDZOWVL.exe
  C:\Windows\System\eDZOWVL.exe
  2⤵
  PID:1524
- C:\Windows\System\xUebjat.exe
  C:\Windows\System\xUebjat.exe
  2⤵
  PID:14180
- C:\Windows\System\AZIdUZa.exe
  C:\Windows\System\AZIdUZa.exe
  2⤵
  PID:2432
- C:\Windows\System\zojLlcx.exe
  C:\Windows\System\zojLlcx.exe
  2⤵
  PID:11304
- C:\Windows\System\BtkGrWy.exe
  C:\Windows\System\BtkGrWy.exe
  2⤵
  PID:14292
- C:\Windows\System\ziHEOeP.exe
  C:\Windows\System\ziHEOeP.exe
  2⤵
  PID:14196
- C:\Windows\System\uMrYnzo.exe
  C:\Windows\System\uMrYnzo.exe
  2⤵
  PID:6956
- C:\Windows\System\UNDuODM.exe
  C:\Windows\System\UNDuODM.exe
  2⤵
  PID:13600
- C:\Windows\System\rUQFEtZ.exe
  C:\Windows\System\rUQFEtZ.exe
  2⤵
  PID:13396
- C:\Windows\System\KyknbRv.exe
  C:\Windows\System\KyknbRv.exe
  2⤵
  PID:9904
- C:\Windows\System\lsMFpeg.exe
  C:\Windows\System\lsMFpeg.exe
  2⤵
  PID:13352
- C:\Windows\System\dRxnyzc.exe
  C:\Windows\System\dRxnyzc.exe
  2⤵
  PID:14204
- C:\Windows\System\KztExxc.exe
  C:\Windows\System\KztExxc.exe
  2⤵
  PID:11972
- C:\Windows\System\adEFPPf.exe
  C:\Windows\System\adEFPPf.exe
  2⤵
  PID:1832
- C:\Windows\System\ifTgBuo.exe
  C:\Windows\System\ifTgBuo.exe
  2⤵
  PID:11940
- C:\Windows\System\MFwkebo.exe
  C:\Windows\System\MFwkebo.exe
  2⤵
  PID:13576
- C:\Windows\System\CbdsXAB.exe
  C:\Windows\System\CbdsXAB.exe
  2⤵
  PID:10584
- C:\Windows\System\nOubnOE.exe
  C:\Windows\System\nOubnOE.exe
  2⤵
  PID:10288
- C:\Windows\System\wbAyOIO.exe
  C:\Windows\System\wbAyOIO.exe
  2⤵
  PID:13972
- C:\Windows\System\DqqQULI.exe
  C:\Windows\System\DqqQULI.exe
  2⤵
  PID:14056
- C:\Windows\System\yuktniL.exe
  C:\Windows\System\yuktniL.exe
  2⤵
  PID:11200
- C:\Windows\System\WXAThoG.exe
  C:\Windows\System\WXAThoG.exe
  2⤵
  PID:9960
- C:\Windows\System\oUcXzRN.exe
  C:\Windows\System\oUcXzRN.exe
  2⤵
  PID:13420
- C:\Windows\System\hLTgtTE.exe
  C:\Windows\System\hLTgtTE.exe
  2⤵
  PID:9056
- C:\Windows\System\BPlNAtl.exe
  C:\Windows\System\BPlNAtl.exe
  2⤵
  PID:14016
- C:\Windows\System\puzuiQC.exe
  C:\Windows\System\puzuiQC.exe
  2⤵
  PID:5552
- C:\Windows\System\aWEXgxN.exe
  C:\Windows\System\aWEXgxN.exe
  2⤵
  PID:11160
- C:\Windows\System\CNmqiLs.exe
  C:\Windows\System\CNmqiLs.exe
  2⤵
  PID:1428
- C:\Windows\System\urnlJdl.exe
  C:\Windows\System\urnlJdl.exe
  2⤵
  PID:13816
- C:\Windows\System\SLeJcrM.exe
  C:\Windows\System\SLeJcrM.exe
  2⤵
  PID:13448
- C:\Windows\System\cRCpYCw.exe
  C:\Windows\System\cRCpYCw.exe
  2⤵
  PID:6104
- C:\Windows\System\YlzRLhb.exe
  C:\Windows\System\YlzRLhb.exe
  2⤵
  PID:12672
- C:\Windows\System\xtWBUoh.exe
  C:\Windows\System\xtWBUoh.exe
  2⤵
  PID:13496
- C:\Windows\System\jQcrDxC.exe
  C:\Windows\System\jQcrDxC.exe
  2⤵
  PID:13708
- C:\Windows\System\MgLbJKs.exe
  C:\Windows\System\MgLbJKs.exe
  2⤵
  PID:13588
- C:\Windows\System\kmsZawL.exe
  C:\Windows\System\kmsZawL.exe
  2⤵
  PID:5352
- C:\Windows\System\pUYaDOJ.exe
  C:\Windows\System\pUYaDOJ.exe
  2⤵
  PID:12688
- C:\Windows\System\VaQICru.exe
  C:\Windows\System\VaQICru.exe
  2⤵
  PID:9844
- C:\Windows\System\fyMtHIR.exe
  C:\Windows\System\fyMtHIR.exe
  2⤵
  PID:11012
- C:\Windows\System\WIZewjy.exe
  C:\Windows\System\WIZewjy.exe
  2⤵
  PID:2712
- C:\Windows\System\qvHMord.exe
  C:\Windows\System\qvHMord.exe
  2⤵
  PID:12088
- C:\Windows\System\byqgvwW.exe
  C:\Windows\System\byqgvwW.exe
  2⤵
  PID:4656
- C:\Windows\System\qIapbaN.exe
  C:\Windows\System\qIapbaN.exe
  2⤵
  PID:10428
- C:\Windows\System\WrbVUql.exe
  C:\Windows\System\WrbVUql.exe
  2⤵
  PID:392
- C:\Windows\System\QqbuKsA.exe
  C:\Windows\System\QqbuKsA.exe
  2⤵
  PID:2496
- C:\Windows\System\byFrHrk.exe
  C:\Windows\System\byFrHrk.exe
  2⤵
  PID:11908
- C:\Windows\System\lEvGvDZ.exe
  C:\Windows\System\lEvGvDZ.exe
  2⤵
  PID:5448
- C:\Windows\System\uvLwngY.exe
  C:\Windows\System\uvLwngY.exe
  2⤵
  PID:13772
- C:\Windows\System\HfnJHUp.exe
  C:\Windows\System\HfnJHUp.exe
  2⤵
  PID:13644
- C:\Windows\System\gJXJCAY.exe
  C:\Windows\System\gJXJCAY.exe
  2⤵
  PID:14084
- C:\Windows\System\liryBFv.exe
  C:\Windows\System\liryBFv.exe
  2⤵
  PID:1716
- C:\Windows\System\yOSMWZJ.exe
  C:\Windows\System\yOSMWZJ.exe
  2⤵
  PID:1288
- C:\Windows\System\jOVaJYX.exe
  C:\Windows\System\jOVaJYX.exe
  2⤵
  PID:3880
- C:\Windows\System\qEJoRbV.exe
  C:\Windows\System\qEJoRbV.exe
  2⤵
  PID:1208
- C:\Windows\System\sxGrpTI.exe
  C:\Windows\System\sxGrpTI.exe
  2⤵
  PID:1604
- C:\Windows\System\fBkaxfx.exe
  C:\Windows\System\fBkaxfx.exe
  2⤵
  PID:6096
- C:\Windows\System\pjTntZq.exe
  C:\Windows\System\pjTntZq.exe
  2⤵
  PID:4100
- C:\Windows\System\faEarUm.exe
  C:\Windows\System\faEarUm.exe
  2⤵
  PID:14004
- C:\Windows\System\rxWZTtE.exe
  C:\Windows\System\rxWZTtE.exe
  2⤵
  PID:14348
- C:\Windows\System\ZahFZbi.exe
  C:\Windows\System\ZahFZbi.exe
  2⤵
  PID:14384
- C:\Windows\System\nSbKEUY.exe
  C:\Windows\System\nSbKEUY.exe
  2⤵
  PID:14404
- C:\Windows\System\wQiJwhD.exe
  C:\Windows\System\wQiJwhD.exe
  2⤵
  PID:14480
- C:\Windows\System\WwPrpUa.exe
  C:\Windows\System\WwPrpUa.exe
  2⤵
  PID:14500
- C:\Windows\System\KDWDuTo.exe
  C:\Windows\System\KDWDuTo.exe
  2⤵
  PID:14516
- C:\Windows\System\LZhGGxn.exe
  C:\Windows\System\LZhGGxn.exe
  2⤵
  PID:14536
- C:\Windows\System\cSRWnGX.exe
  C:\Windows\System\cSRWnGX.exe
  2⤵
  PID:14764
- C:\Windows\System\buECsjo.exe
  C:\Windows\System\buECsjo.exe
  2⤵
  PID:14788
- C:\Windows\System\PPPqwEG.exe
  C:\Windows\System\PPPqwEG.exe
  2⤵
  PID:14804
- C:\Windows\System\vlTQbYT.exe
  C:\Windows\System\vlTQbYT.exe
  2⤵
  PID:14824
- C:\Windows\System\eYNCvEz.exe
  C:\Windows\System\eYNCvEz.exe
  2⤵
  PID:14844
- C:\Windows\System\uHyWYLu.exe
  C:\Windows\System\uHyWYLu.exe
  2⤵
  PID:14864
- C:\Windows\System\gWPmnZv.exe
  C:\Windows\System\gWPmnZv.exe
  2⤵
  PID:14880
- C:\Windows\System\IDsnCZf.exe
  C:\Windows\System\IDsnCZf.exe
  2⤵
  PID:15064
- C:\Windows\System\fUwWTCE.exe
  C:\Windows\System\fUwWTCE.exe
  2⤵
  PID:15096
- C:\Windows\System\nVlSNgP.exe
  C:\Windows\System\nVlSNgP.exe
  2⤵
  PID:15116
- C:\Windows\System\wZQkzJN.exe
  C:\Windows\System\wZQkzJN.exe
  2⤵
  PID:6756
- C:\Windows\System\jHJazaB.exe
  C:\Windows\System\jHJazaB.exe
  2⤵
  PID:14360
- C:\Windows\System\wKBXkbt.exe
  C:\Windows\System\wKBXkbt.exe
  2⤵
  PID:14508
- C:\Windows\System\dtXnYsZ.exe
  C:\Windows\System\dtXnYsZ.exe
  2⤵
  PID:4384
- C:\Windows\System\OmjSPNv.exe
  C:\Windows\System\OmjSPNv.exe
  2⤵
  PID:14592
- C:\Windows\System\vqhMJhT.exe
  C:\Windows\System\vqhMJhT.exe
  2⤵
  PID:14640
- C:\Windows\System\SAZlJTC.exe
  C:\Windows\System\SAZlJTC.exe
  2⤵
  PID:14988
- C:\Windows\System\pQQEUkL.exe
  C:\Windows\System\pQQEUkL.exe
  2⤵
  PID:15220
- C:\Windows\System\SAzNvnD.exe
  C:\Windows\System\SAzNvnD.exe
  2⤵
  PID:15356
- C:\Windows\System\nbXQnbE.exe
  C:\Windows\System\nbXQnbE.exe
  2⤵
  PID:14572
- C:\Windows\System\KLEjaMW.exe
  C:\Windows\System\KLEjaMW.exe
  2⤵
  PID:14676
- C:\Windows\System\xVqtDWC.exe
  C:\Windows\System\xVqtDWC.exe
  2⤵
  PID:14892
- C:\Windows\System\DhWWOZC.exe
  C:\Windows\System\DhWWOZC.exe
  2⤵
  PID:14856
- C:\Windows\System\KwWIhmd.exe
  C:\Windows\System\KwWIhmd.exe
  2⤵
  PID:2380
- C:\Windows\System\cBOLZFl.exe
  C:\Windows\System\cBOLZFl.exe
  2⤵
  PID:14976
- C:\Windows\System\okFRBhC.exe
  C:\Windows\System\okFRBhC.exe
  2⤵
  PID:15136
- C:\Windows\System\OxTimiD.exe
  C:\Windows\System\OxTimiD.exe
  2⤵
  PID:15216
- C:\Windows\System\BDWosqn.exe
  C:\Windows\System\BDWosqn.exe
  2⤵
  PID:14440
- C:\Windows\System\HTMoWDm.exe
  C:\Windows\System\HTMoWDm.exe
  2⤵
  PID:14644
- C:\Windows\System\rzucaHp.exe
  C:\Windows\System\rzucaHp.exe
  2⤵
  PID:3412
- C:\Windows\System\kwASwBe.exe
  C:\Windows\System\kwASwBe.exe
  2⤵
  PID:3972
- C:\Windows\System\TmNjIBt.exe
  C:\Windows\System\TmNjIBt.exe
  2⤵
  PID:4748
- C:\Windows\System\qyHhPDL.exe
  C:\Windows\System\qyHhPDL.exe
  2⤵
  PID:15084
- C:\Windows\System\aFuPPEi.exe
  C:\Windows\System\aFuPPEi.exe
  2⤵
  PID:15072
- C:\Windows\System\btAaoOA.exe
  C:\Windows\System\btAaoOA.exe
  2⤵
  PID:468
- C:\Windows\System\BgztcbE.exe
  C:\Windows\System\BgztcbE.exe
  2⤵
  PID:15232
- C:\Windows\System\WvRdyHp.exe
  C:\Windows\System\WvRdyHp.exe
  2⤵
  PID:15328
- C:\Windows\System\oTenyVB.exe
  C:\Windows\System\oTenyVB.exe
  2⤵
  PID:2284
- C:\Windows\System\sXUqkVP.exe
  C:\Windows\System\sXUqkVP.exe
  2⤵
  PID:3760
- C:\Windows\System\DOQTFTG.exe
  C:\Windows\System\DOQTFTG.exe
  2⤵
  PID:14364
- C:\Windows\System\xxYfeVw.exe
  C:\Windows\System\xxYfeVw.exe
  2⤵
  PID:14396
- C:\Windows\System\GJjdSJz.exe
  C:\Windows\System\GJjdSJz.exe
  2⤵
  PID:13720
- C:\Windows\System\ptCQOLD.exe
  C:\Windows\System\ptCQOLD.exe
  2⤵
  PID:14576
- C:\Windows\System\VMofzEu.exe
  C:\Windows\System\VMofzEu.exe
  2⤵
  PID:14712
- C:\Windows\System\zeJZmEy.exe
  C:\Windows\System\zeJZmEy.exe
  2⤵
  PID:15092
- C:\Windows\System\hikPVyI.exe
  C:\Windows\System\hikPVyI.exe
  2⤵
  PID:6044
- C:\Windows\System\tvJEqWO.exe
  C:\Windows\System\tvJEqWO.exe
  2⤵
  PID:15344
- C:\Windows\System\JOxZUpc.exe
  C:\Windows\System\JOxZUpc.exe
  2⤵
  PID:2880
- C:\Windows\System\RFIBMML.exe
  C:\Windows\System\RFIBMML.exe
  2⤵
  PID:752
- C:\Windows\System\YHERGER.exe
  C:\Windows\System\YHERGER.exe
  2⤵
  PID:6004
- C:\Windows\System\OqrvhIB.exe
  C:\Windows\System\OqrvhIB.exe
  2⤵
  PID:15128
- C:\Windows\System\zfkOaIy.exe
  C:\Windows\System\zfkOaIy.exe
  2⤵
  PID:6852
- C:\Windows\System\sDRvgCY.exe
  C:\Windows\System\sDRvgCY.exe
  2⤵
  PID:412
- C:\Windows\System\zhxDZkP.exe
  C:\Windows\System\zhxDZkP.exe
  2⤵
  PID:5088
- C:\Windows\System\XHhEged.exe
  C:\Windows\System\XHhEged.exe
  2⤵
  PID:5616
- C:\Windows\System\lkjMHZC.exe
  C:\Windows\System\lkjMHZC.exe
  2⤵
  PID:6084
- C:\Windows\System\DNgWhZi.exe
  C:\Windows\System\DNgWhZi.exe
  2⤵
  PID:3824
- C:\Windows\System\mhtBlGz.exe
  C:\Windows\System\mhtBlGz.exe
  2⤵
  PID:15204
- C:\Windows\System\bjQtukz.exe
  C:\Windows\System\bjQtukz.exe
  2⤵
  PID:4816
- C:\Windows\System\tAPepEA.exe
  C:\Windows\System\tAPepEA.exe
  2⤵
  PID:14616
- C:\Windows\System\lEcBszp.exe
  C:\Windows\System\lEcBszp.exe
  2⤵
  PID:14568
- C:\Windows\System\pHkEtVY.exe
  C:\Windows\System\pHkEtVY.exe
  2⤵
  PID:6012
- C:\Windows\System\McVQsrC.exe
  C:\Windows\System\McVQsrC.exe
  2⤵
  PID:3152
- C:\Windows\System\BKVzCzc.exe
  C:\Windows\System\BKVzCzc.exe
  2⤵
  PID:5904
- C:\Windows\System\MMgMGUU.exe
  C:\Windows\System\MMgMGUU.exe
  2⤵
  PID:3516
- C:\Windows\System\RjWAXxn.exe
  C:\Windows\System\RjWAXxn.exe
  2⤵
  PID:15168
- C:\Windows\System\YLPchWr.exe
  C:\Windows\System\YLPchWr.exe
  2⤵
  PID:14888
- C:\Windows\System\LrDQQyz.exe
  C:\Windows\System\LrDQQyz.exe
  2⤵
  PID:6020
- C:\Windows\System\dtdVUPg.exe
  C:\Windows\System\dtdVUPg.exe
  2⤵
  PID:2688
- C:\Windows\System\UvpfrtQ.exe
  C:\Windows\System\UvpfrtQ.exe
  2⤵
  PID:14860
- C:\Windows\System\XzKwLmf.exe
  C:\Windows\System\XzKwLmf.exe
  2⤵
  PID:1188
- C:\Windows\System\ydDqvKl.exe
  C:\Windows\System\ydDqvKl.exe
  2⤵
  PID:5304
- C:\Windows\System\DZbJbed.exe
  C:\Windows\System\DZbJbed.exe
  2⤵
  PID:5000
- C:\Windows\System\nmBCTWi.exe
  C:\Windows\System\nmBCTWi.exe
  2⤵
  PID:14708
- C:\Windows\System\cVHrvaT.exe
  C:\Windows\System\cVHrvaT.exe
  2⤵
  PID:636
- C:\Windows\System\BjVXxDb.exe
  C:\Windows\System\BjVXxDb.exe
  2⤵
  PID:6056
- C:\Windows\System\nnIabBC.exe
  C:\Windows\System\nnIabBC.exe
  2⤵
  PID:14916
- C:\Windows\System\JQPreoN.exe
  C:\Windows\System\JQPreoN.exe
  2⤵
  PID:6324
- C:\Windows\System\kLDZTOp.exe
  C:\Windows\System\kLDZTOp.exe
  2⤵
  PID:14512
- C:\Windows\System\Ezfwnul.exe
  C:\Windows\System\Ezfwnul.exe
  2⤵
  PID:4688
- C:\Windows\System\FnKFqSE.exe
  C:\Windows\System\FnKFqSE.exe
  2⤵
  PID:15032
- C:\Windows\System\jUsSlds.exe
  C:\Windows\System\jUsSlds.exe
  2⤵
  PID:6272
- C:\Windows\System\TxICkwh.exe
  C:\Windows\System\TxICkwh.exe
  2⤵
  PID:2280
- C:\Windows\System\bRVQOKA.exe
  C:\Windows\System\bRVQOKA.exe
  2⤵
  PID:7780
- C:\Windows\System\aYwxCRm.exe
  C:\Windows\System\aYwxCRm.exe
  2⤵
  PID:7456
- C:\Windows\System\cepZGQF.exe
  C:\Windows\System\cepZGQF.exe
  2⤵
  PID:15200
- C:\Windows\System\GVSQxLc.exe
  C:\Windows\System\GVSQxLc.exe
  2⤵
  PID:7836
- C:\Windows\System\WaSIxSC.exe
  C:\Windows\System\WaSIxSC.exe
  2⤵
  PID:7216
- C:\Windows\System\bOxdzvt.exe
  C:\Windows\System\bOxdzvt.exe
  2⤵
  PID:2192
- C:\Windows\System\vupjtyl.exe
  C:\Windows\System\vupjtyl.exe
  2⤵
  PID:8852
- C:\Windows\System\uMvgNQq.exe
  C:\Windows\System\uMvgNQq.exe
  2⤵
  PID:3344
- C:\Windows\System\GIFWeqs.exe
  C:\Windows\System\GIFWeqs.exe
  2⤵
  PID:14212
- C:\Windows\System\nvpMjkd.exe
  C:\Windows\System\nvpMjkd.exe
  2⤵
  PID:15272
- C:\Windows\System\ieLEMQH.exe
  C:\Windows\System\ieLEMQH.exe
  2⤵
  PID:15132
- C:\Windows\System\JCokvyn.exe
  C:\Windows\System\JCokvyn.exe
  2⤵
  PID:10484
- C:\Windows\System\vGQMTGk.exe
  C:\Windows\System\vGQMTGk.exe
  2⤵
  PID:7192
- C:\Windows\System\DTnOqbR.exe
  C:\Windows\System\DTnOqbR.exe
  2⤵
  PID:9196
- C:\Windows\System\nPoLxZe.exe
  C:\Windows\System\nPoLxZe.exe
  2⤵
  PID:9292
- C:\Windows\System\fkeACuV.exe
  C:\Windows\System\fkeACuV.exe
  2⤵
  PID:5848
- C:\Windows\System\PcWFOAG.exe
  C:\Windows\System\PcWFOAG.exe
  2⤵
  PID:6300
- C:\Windows\System\PueDeCj.exe
  C:\Windows\System\PueDeCj.exe
  2⤵
  PID:14696
- C:\Windows\System\PoUQSBV.exe
  C:\Windows\System\PoUQSBV.exe
  2⤵
  PID:12760
- C:\Windows\System\NOyqhuk.exe
  C:\Windows\System\NOyqhuk.exe
  2⤵
  PID:3924
- C:\Windows\System\dbHAQpp.exe
  C:\Windows\System\dbHAQpp.exe
  2⤵
  PID:2276
- C:\Windows\System\kWhCqWd.exe
  C:\Windows\System\kWhCqWd.exe
  2⤵
  PID:7596
- C:\Windows\System\SXkgdRi.exe
  C:\Windows\System\SXkgdRi.exe
  2⤵
  PID:8288
- C:\Windows\System\nVPSFOh.exe
  C:\Windows\System\nVPSFOh.exe
  2⤵
  PID:12132
- C:\Windows\System\JPyFGvt.exe
  C:\Windows\System\JPyFGvt.exe
  2⤵
  PID:5780
- C:\Windows\System\OZCGTBv.exe
  C:\Windows\System\OZCGTBv.exe
  2⤵
  PID:936
- C:\Windows\System\PfeHQyY.exe
  C:\Windows\System\PfeHQyY.exe
  2⤵
  PID:4648
- C:\Windows\System\qJuxzfx.exe
  C:\Windows\System\qJuxzfx.exe
  2⤵
  PID:12580
- C:\Windows\System\eDvjmHr.exe
  C:\Windows\System\eDvjmHr.exe
  2⤵
  PID:11140
- C:\Windows\System\NfeLxuh.exe
  C:\Windows\System\NfeLxuh.exe
  2⤵
  PID:6504
- C:\Windows\System\eqFuWIH.exe
  C:\Windows\System\eqFuWIH.exe
  2⤵
  PID:11216
- C:\Windows\System\QOGAhtK.exe
  C:\Windows\System\QOGAhtK.exe
  2⤵
  PID:3876
- C:\Windows\System\tpepplJ.exe
  C:\Windows\System\tpepplJ.exe
  2⤵
  PID:8496
- C:\Windows\System\PYczYZJ.exe
  C:\Windows\System\PYczYZJ.exe
  2⤵
  PID:9920
- C:\Windows\System\KHtNkmj.exe
  C:\Windows\System\KHtNkmj.exe
  2⤵
  PID:14660
- C:\Windows\System\hEhSmZN.exe
  C:\Windows\System\hEhSmZN.exe
  2⤵
  PID:3864
- C:\Windows\System\RSWBHsu.exe
  C:\Windows\System\RSWBHsu.exe
  2⤵
  PID:10936
- C:\Windows\System\HXKkTUh.exe
  C:\Windows\System\HXKkTUh.exe
  2⤵
  PID:11492
- C:\Windows\System\iOnRWWR.exe
  C:\Windows\System\iOnRWWR.exe
  2⤵
  PID:6912
- C:\Windows\System\bJdyuat.exe
  C:\Windows\System\bJdyuat.exe
  2⤵
  PID:10072
- C:\Windows\System\XMKgXrS.exe
  C:\Windows\System\XMKgXrS.exe
  2⤵
  PID:9588
- C:\Windows\System\ULsbTXm.exe
  C:\Windows\System\ULsbTXm.exe
  2⤵
  PID:6028
- C:\Windows\System\JUopCPA.exe
  C:\Windows\System\JUopCPA.exe
  2⤵
  PID:5828
- C:\Windows\System\IOTjnXJ.exe
  C:\Windows\System\IOTjnXJ.exe
  2⤵
  PID:7776
- C:\Windows\System\ISgGNgD.exe
  C:\Windows\System\ISgGNgD.exe
  2⤵
  PID:12304
- C:\Windows\System\NZZgVON.exe
  C:\Windows\System\NZZgVON.exe
  2⤵
  PID:14368
- C:\Windows\System\hqEfwtU.exe
  C:\Windows\System\hqEfwtU.exe
  2⤵
  PID:13300
- C:\Windows\System\QKcheWf.exe
  C:\Windows\System\QKcheWf.exe
  2⤵
  PID:15180
- C:\Windows\System\NxNjTwm.exe
  C:\Windows\System\NxNjTwm.exe
  2⤵
  PID:8816
- C:\Windows\System\fLgWpWA.exe
  C:\Windows\System\fLgWpWA.exe
  2⤵
  PID:11824
- C:\Windows\System\RcsFUzP.exe
  C:\Windows\System\RcsFUzP.exe
  2⤵
  PID:7124
- C:\Windows\System\nSSlrdm.exe
  C:\Windows\System\nSSlrdm.exe
  2⤵
  PID:6328
- C:\Windows\System\MuFmVmT.exe
  C:\Windows\System\MuFmVmT.exe
  2⤵
  PID:8684
- C:\Windows\System\taMCiTA.exe
  C:\Windows\System\taMCiTA.exe
  2⤵
  PID:11764
- C:\Windows\System\kBUgXkw.exe
  C:\Windows\System\kBUgXkw.exe
  2⤵
  PID:11812
- C:\Windows\System\aUkYOrz.exe
  C:\Windows\System\aUkYOrz.exe
  2⤵
  PID:3908
- C:\Windows\System\xoNoEqJ.exe
  C:\Windows\System\xoNoEqJ.exe
  2⤵
  PID:9848
- C:\Windows\System\FDknSrY.exe
  C:\Windows\System\FDknSrY.exe
  2⤵
  PID:8476
- C:\Windows\System\OnUslhb.exe
  C:\Windows\System\OnUslhb.exe
  2⤵
  PID:9380
- C:\Windows\System\oFrflxY.exe
  C:\Windows\System\oFrflxY.exe
  2⤵
  PID:10736
- C:\Windows\System\soEsMLL.exe
  C:\Windows\System\soEsMLL.exe
  2⤵
  PID:10676
- C:\Windows\System\gtSMIKv.exe
  C:\Windows\System\gtSMIKv.exe
  2⤵
  PID:12440
- C:\Windows\System\XHGimtu.exe
  C:\Windows\System\XHGimtu.exe
  2⤵
  PID:12488
- C:\Windows\System\abdRUdu.exe
  C:\Windows\System\abdRUdu.exe
  2⤵
  PID:4544
- C:\Windows\System\oAkxJEt.exe
  C:\Windows\System\oAkxJEt.exe
  2⤵
  PID:12508
- C:\Windows\System\iizHjrD.exe
  C:\Windows\System\iizHjrD.exe
  2⤵
  PID:7136
- C:\Windows\System\PYXaTSo.exe
  C:\Windows\System\PYXaTSo.exe
  2⤵
  PID:7828
- C:\Windows\System\LyYvCLa.exe
  C:\Windows\System\LyYvCLa.exe
  2⤵
  PID:13000
- C:\Windows\System\pcpwgxv.exe
  C:\Windows\System\pcpwgxv.exe
  2⤵
  PID:11508
- C:\Windows\System\xqHJpBN.exe
  C:\Windows\System\xqHJpBN.exe
  2⤵
  PID:1984
- C:\Windows\System\TZcRhnQ.exe
  C:\Windows\System\TZcRhnQ.exe
  2⤵
  PID:9136
- C:\Windows\System\gjVIhbQ.exe
  C:\Windows\System\gjVIhbQ.exe
  2⤵
  PID:11524
- C:\Windows\System\GXWuqGw.exe
  C:\Windows\System\GXWuqGw.exe
  2⤵
  PID:11976
- C:\Windows\System\eeExknC.exe
  C:\Windows\System\eeExknC.exe
  2⤵
  PID:12860
- C:\Windows\System\ISGVJpb.exe
  C:\Windows\System\ISGVJpb.exe
  2⤵
  PID:12232
- C:\Windows\System\irThLDq.exe
  C:\Windows\System\irThLDq.exe
  2⤵
  PID:60
- C:\Windows\System\ARsGyfm.exe
  C:\Windows\System\ARsGyfm.exe
  2⤵
  PID:13248
- C:\Windows\System\szivaHs.exe
  C:\Windows\System\szivaHs.exe
  2⤵
  PID:13256
- C:\Windows\System\taWGoaT.exe
  C:\Windows\System\taWGoaT.exe
  2⤵
  PID:4372
- C:\Windows\System\UuiUcNw.exe
  C:\Windows\System\UuiUcNw.exe
  2⤵
  PID:11836
- C:\Windows\System\iVfdwHa.exe
  C:\Windows\System\iVfdwHa.exe
  2⤵
  PID:852
- C:\Windows\System\kacDMBL.exe
  C:\Windows\System\kacDMBL.exe
  2⤵
  PID:12880
- C:\Windows\System\eOsNzhS.exe
  C:\Windows\System\eOsNzhS.exe
  2⤵
  PID:9732
- C:\Windows\System\toEheQe.exe
  C:\Windows\System\toEheQe.exe
  2⤵
  PID:8332
- C:\Windows\System\fAXUyRv.exe
  C:\Windows\System\fAXUyRv.exe
  2⤵
  PID:12280
- C:\Windows\System\rhFPyzA.exe
  C:\Windows\System\rhFPyzA.exe
  2⤵
  PID:8772
- C:\Windows\System\mFBEVHv.exe
  C:\Windows\System\mFBEVHv.exe
  2⤵
  PID:12552
- C:\Windows\System\vpRREhf.exe
  C:\Windows\System\vpRREhf.exe
  2⤵
  PID:5800
- C:\Windows\System\YNYEmxl.exe
  C:\Windows\System\YNYEmxl.exe
  2⤵
  PID:14192
- C:\Windows\System\hJmTJkl.exe
  C:\Windows\System\hJmTJkl.exe
  2⤵
  PID:11056
- C:\Windows\System\HlqTVwV.exe
  C:\Windows\System\HlqTVwV.exe
  2⤵
  PID:3052
- C:\Windows\System\mPmfrEe.exe
  C:\Windows\System\mPmfrEe.exe
  2⤵
  PID:13036
- C:\Windows\System\fqtROiL.exe
  C:\Windows\System\fqtROiL.exe
  2⤵
  PID:5900
- C:\Windows\System\TWXjCgG.exe
  C:\Windows\System\TWXjCgG.exe
  2⤵
  PID:2872
- C:\Windows\System\jJHbJsp.exe
  C:\Windows\System\jJHbJsp.exe
  2⤵
  PID:1508
- C:\Windows\System\gjSDLej.exe
  C:\Windows\System\gjSDLej.exe
  2⤵
  PID:4632
- C:\Windows\System\QsUTfYH.exe
  C:\Windows\System\QsUTfYH.exe
  2⤵
  PID:13188
- C:\Windows\System\HMJXJiR.exe
  C:\Windows\System\HMJXJiR.exe
  2⤵
  PID:228
- C:\Windows\System\gScXYmM.exe
  C:\Windows\System\gScXYmM.exe
  2⤵
  PID:2264
- C:\Windows\System\mrNDsQS.exe
  C:\Windows\System\mrNDsQS.exe
  2⤵
  PID:2388
- C:\Windows\System\UXAKrzL.exe
  C:\Windows\System\UXAKrzL.exe
  2⤵
  PID:14316
- C:\Windows\System\ddPsKrh.exe
  C:\Windows\System\ddPsKrh.exe
  2⤵
  PID:4948
- C:\Windows\System\pHMBCiD.exe
  C:\Windows\System\pHMBCiD.exe
  2⤵
  PID:9944
- C:\Windows\System\LlgEeHV.exe
  C:\Windows\System\LlgEeHV.exe
  2⤵
  PID:3004
- C:\Windows\System\PJhOLhx.exe
  C:\Windows\System\PJhOLhx.exe
  2⤵
  PID:10284
- C:\Windows\System\JKOgLUg.exe
  C:\Windows\System\JKOgLUg.exe
  2⤵
  PID:10436
- C:\Windows\System\PrmiQEs.exe
  C:\Windows\System\PrmiQEs.exe
  2⤵
  PID:12168
- C:\Windows\System\vcWkJBh.exe
  C:\Windows\System\vcWkJBh.exe
  2⤵
  PID:13712
- C:\Windows\System\AiNdPPj.exe
  C:\Windows\System\AiNdPPj.exe
  2⤵
  PID:3672
- C:\Windows\System\BFOWlUy.exe
  C:\Windows\System\BFOWlUy.exe
  2⤵
  PID:2020
- C:\Windows\System\MppLGgG.exe
  C:\Windows\System\MppLGgG.exe
  2⤵
  PID:10680
- C:\Windows\System\Bsbtxhm.exe
  C:\Windows\System\Bsbtxhm.exe
  2⤵
  PID:1016
- C:\Windows\System\WOuwvUb.exe
  C:\Windows\System\WOuwvUb.exe
  2⤵
  PID:10580
- C:\Windows\System\gSUpAvG.exe
  C:\Windows\System\gSUpAvG.exe
  2⤵
  PID:9092
- C:\Windows\System\bDkLJhW.exe
  C:\Windows\System\bDkLJhW.exe
  2⤵
  PID:3444
- C:\Windows\System\WuuvAHo.exe
  C:\Windows\System\WuuvAHo.exe
  2⤵
  PID:11380
- C:\Windows\System\PabSZGh.exe
  C:\Windows\System\PabSZGh.exe
  2⤵
  PID:10500
- C:\Windows\System\ptfrvQv.exe
  C:\Windows\System\ptfrvQv.exe
  2⤵
  PID:15140
- C:\Windows\System\ktnTMRc.exe
  C:\Windows\System\ktnTMRc.exe
  2⤵
  PID:14296
- C:\Windows\System\kVLUdcf.exe
  C:\Windows\System\kVLUdcf.exe
  2⤵
  PID:15228
- C:\Windows\System\HgIqTrU.exe
  C:\Windows\System\HgIqTrU.exe
  2⤵
  PID:10028
- C:\Windows\System\ZngtCvS.exe
  C:\Windows\System\ZngtCvS.exe
  2⤵
  PID:8024
- C:\Windows\System\zgzwbXg.exe
  C:\Windows\System\zgzwbXg.exe
  2⤵
  PID:11236
- C:\Windows\System\qYuCjDS.exe
  C:\Windows\System\qYuCjDS.exe
  2⤵
  PID:5108
- C:\Windows\System\cMfLjMd.exe
  C:\Windows\System\cMfLjMd.exe
  2⤵
  PID:1940
- C:\Windows\System\EJsCYWC.exe
  C:\Windows\System\EJsCYWC.exe
  2⤵
  PID:7904
- C:\Windows\System\WHEvwLx.exe
  C:\Windows\System\WHEvwLx.exe
  2⤵
  PID:8640
- C:\Windows\System\bzJsORe.exe
  C:\Windows\System\bzJsORe.exe
  2⤵
  PID:10108
- C:\Windows\System\NOSnBwn.exe
  C:\Windows\System\NOSnBwn.exe
  2⤵
  PID:12920
- C:\Windows\System\CxOiBjm.exe
  C:\Windows\System\CxOiBjm.exe
  2⤵
  PID:8504
- C:\Windows\System\iNvRWRb.exe
  C:\Windows\System\iNvRWRb.exe
  2⤵
  PID:5744
- C:\Windows\System\CwhjEii.exe
  C:\Windows\System\CwhjEii.exe
  2⤵
  PID:8800
- C:\Windows\System\VEvsBkj.exe
  C:\Windows\System\VEvsBkj.exe
  2⤵
  PID:2096
- C:\Windows\System\zrCUeok.exe
  C:\Windows\System\zrCUeok.exe
  2⤵
  PID:5972
- C:\Windows\System\ddDwJGB.exe
  C:\Windows\System\ddDwJGB.exe
  2⤵
  PID:14724
- C:\Windows\System\joKodiJ.exe
  C:\Windows\System\joKodiJ.exe
  2⤵
  PID:7480
- C:\Windows\System\BKbKTfa.exe
  C:\Windows\System\BKbKTfa.exe
  2⤵
  PID:13760
- C:\Windows\System\ggaSDZA.exe
  C:\Windows\System\ggaSDZA.exe
  2⤵
  PID:13628
- C:\Windows\System\yDPyRtn.exe
  C:\Windows\System\yDPyRtn.exe
  2⤵
  PID:13920
- C:\Windows\System\WsJXfen.exe
  C:\Windows\System\WsJXfen.exe
  2⤵
  PID:13888
- C:\Windows\System\CeuLgUE.exe
  C:\Windows\System\CeuLgUE.exe
  2⤵
  PID:5736
- C:\Windows\System\LVECNTL.exe
  C:\Windows\System\LVECNTL.exe
  2⤵
  PID:13344
- C:\Windows\System\JxnvIKy.exe
  C:\Windows\System\JxnvIKy.exe
  2⤵
  PID:6924
- C:\Windows\System\ZXovURc.exe
  C:\Windows\System\ZXovURc.exe
  2⤵
  PID:9516

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 12096 -ip 12096
1⤵
PID:13600

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13856

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5plepthh.c3k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BLaKOVs.exe

Filesize
995KB

MD5
d3d1f8ae46ced996b7ccbf9b25c6cb11

SHA1
40cb1a4b559ce2cf1d5bba0f8941abdf915d6f4d

SHA256
bdfe6f0e19c850bae194b5d4d53545eb53482d1364eab24ff026c4fea79f5265

SHA512
d5fac26d8ff99aaf3593f802d35198592f8cc5af44ee341ee99a9eb3d315ccd4acae34ee7cf76e191157d56ee3c12e5f131e03a8ca09ae0f480c47b02409835f

Download Submit
C:\Windows\System\DSGXRlg.exe

Filesize
994KB

MD5
d081306ac76f57c343255e460a2abd5e

SHA1
9ee2372fb377a9878b4c602e003aa787cf029120

SHA256
67f9b356cd27e147022f0f60cd01c5e305f1a99729c55c5b2470c20ecdec2183

SHA512
ba61148333fed3459c41d9a670a3d6b440dc36cb2eb36dedc9687a6c11ef14553b74ea52cb2bd38243edc5eba76ecccf9519f386a5856c0f86e78ae05cd76e0f

Download Submit
C:\Windows\System\GUJniEx.exe

Filesize
995KB

MD5
9dc128a9fb5d55fc2301676fbb4c6379

SHA1
aa1b99f4b4ca616659f8b6305bb5091c2f1acde9

SHA256
10ce74b8a23e6e3d8c2e042d0b44d3287ee8c433b4fad7f5fa1bc93b6f7be6ee

SHA512
a24245e732efc05601da12c80d62e4c3460af3514b2e7c8d97774cbbff530a965c152b5a29e07562030a191d9aa98f16ab4ed3e2359944a0369cc268ece37250

Download Submit
C:\Windows\System\GquGUHx.exe

Filesize
997KB

MD5
cada98dedb2318f5860d2762abc28367

SHA1
fe0f9ea1ba17b169c0fd67839753199c540ca0b2

SHA256
65c623b2e5bb3fb58fdbcd9c3226b4706ddcec3d470cea9eab11fa799c63edab

SHA512
42f86a98a28da1e0593d9fb8a38f3b8ce328a9bd72b4f3de9628440c16af30d64edfa7b68e7232b15e010de4afdafe67333fa1a27e26ca12456339b0afa580bb

Download Submit
C:\Windows\System\HMuwoZh.exe

Filesize
993KB

MD5
03333ada950038750b794fa13e9b2e8e

SHA1
de08e0e50c638ec706153644ca6b1d8c589fb362

SHA256
0d4b7f1e07d6c9977bdecc75a9b9501b10e1272f96baebb3bf6a8109ffb2c713

SHA512
ebe675c02789dd0b739b0c011817b9e005525b235b7fa2c0a7ffc0692483213c72b9ef35939f43a75daf011b560eec4a394acfed75c212e382467d8b55c0aa04

Download Submit
C:\Windows\System\HiHFXhr.exe

Filesize
990KB

MD5
f03ebe49155fea8a0fc2c80aeb3bfca5

SHA1
f6419bed85536e6f32d0d3a289284b5a8fb6fa5f

SHA256
c3d947485094eaef71438321611298c3f3629fb15de6419f973a06aca9179011

SHA512
d40534e44f4e17425063dc0fd81e7a5a4fd5d6b4cc1923eaf22756d90314448b9814c1c490944e0a9beb453d10cd659540275b67133af850c90f26f9f10a0d33

Download Submit
C:\Windows\System\HvIakpb.exe

Filesize
990KB

MD5
9540e12fef10eb4261efcb91c126ba02

SHA1
e9ae88756f0a5735dbdb41e2dea4654b0628fbff

SHA256
25302bc8d43233ae6df4a0e2b098d097d293a4aecef74e4c8b85d2b030a27df5

SHA512
080b2f8efb9776bc042468b1bae2da115276b86dfe943add97feab9900903f0388cb111e6741b820c1f9d8c95af4b0b4532351f4240de396f04af34e713300b4

Download Submit
C:\Windows\System\MwQSWxd.exe

Filesize
999KB

MD5
0e92b1ab3425997035b16589e5f99058

SHA1
93a00987cb381561a9a9f4d058182e312756ff31

SHA256
15a9250eb66236199f98313a94403a5996f638b440d30226e1d5ee0e283dc307

SHA512
51da5ac37818315d4a6bb0ffee5ba7a0d1028da5c0c839bbb597998630f05f055c2771fa53b9ede71068f04017538c5b311c54e5d45ee6d2f8371e3cb0415a5e

Download Submit
C:\Windows\System\MzQproT.exe

Filesize
993KB

MD5
f2396e6051192b0ea60fca34322405f5

SHA1
ad19228bcd054236e9cc00e66153823dfd9d8901

SHA256
7924953ee36cb7aeeeca1b6bae829f66e607abcfb68d0ed8f75c2c7e4f07975f

SHA512
8c2b79f01ee6748dcba2561755adc333d70f1cf398fc2d5ab5e30ee053171dd3b8ed10cd0c5a303dc081209eb8ec9cc1b837498588a36ec8964dce291c77c003

Download Submit
C:\Windows\System\NmWBEyP.exe

Filesize
997KB

MD5
d205c2edf78517a514e4077276276e23

SHA1
ba1775d5d5e3f171cebfa9b889d8d9eca0647737

SHA256
688d6d9ea1728065c40f78ff02a369a4362e04811d18cae6dfa9d6103d29d69a

SHA512
e47186460d4f5518ef63e9bcaf59ed3895985bd4cd9f743bfadf36849ae4417abb83bb0da7d5249edee1c81ad08db6b4b55c99ee7e9699c3733b27a0238917df

Download Submit
C:\Windows\System\RUXwdQd.exe

Filesize
993KB

MD5
d43989db804285c674ab9f60653ab332

SHA1
625f24eb4cdf14b14f6058e760138fb3e06393fe

SHA256
580054b5f9d1274bb7ab27a78c79e9b130bef8bb72b60d39996ba555ce27affc

SHA512
8324f74d3e17f90f96c1bce5b58df9e6c5ad0048c5892a2d5061e7559b2dd5ccf5a063d665d400bd210420aa5ad31e877a0019435d224e0cd2be3c70ad69d825

Download Submit
C:\Windows\System\RkaYukO.exe

Filesize
1000KB

MD5
ed26ae657bf5be76bedfd607f8d6b08b

SHA1
edfafc87750d5110606abccda1fd24bf49dd4d2a

SHA256
afd272a698caa4ce766c2c889fb9aed5e286809ff46982530bdbca9a7b081694

SHA512
68ae93118726bc52efc9de31ce746d968053008d0678a4ea0a422aff13a2716f045ad3fc33454f3d6084f8e25ae6b03b74dedf47b252ebbd93d0f7d74b106b8c

Download Submit
C:\Windows\System\TzLzjOg.exe

Filesize
996KB

MD5
cbb4b0b2afe2a018c2dde3dec44ce1b2

SHA1
b5c71c25d18005655a96a66c4afe43489e896394

SHA256
2d1135a4a078ed0161c4ec960362c0ba555907877caa97a05e4791ed90fc5d23

SHA512
355edaa90f22e95cba6be0daa4790de8fa31960105016d923feae1f2d932a908b5e2397f2bb4a320f9af5ad46d6374e45510ecd238e88ab357dabf76c6fbf8be

Download Submit
C:\Windows\System\VJwiZxL.exe

Filesize
996KB

MD5
e491d8df296da9851271ebf35d0c95b0

SHA1
b2e9a99aaedbc727569f6c9938d16b241427b1de

SHA256
c3c357a12e15f0b4c627bf92f0708172c0127117473e4fa18952426d8fe4f881

SHA512
94db25e67ab1161cbcccf544e3326cc17f9c450b35f4c1f1542fc7d07484499142b9e07126185e2c526b64b18ec42b82fc049ba7813074abbdce3944805beb1f

Download Submit
C:\Windows\System\VpMNRBo.exe

Filesize
999KB

MD5
556f8f6489404140f3eeebde7995688b

SHA1
9af56dd296a4602c2edd3d00bf5a77c2a770de41

SHA256
a99b1aa8f0bc64d08039d224803ebdbaef938257ae85d945c135ae5f3eef2ae2

SHA512
08baf096a7fac15af2b0b9c21e3cb33ef0346ea887084c0ecd724351b955c23e71e716f3992eb2a1ccf56091f9b60573a3134fecdc5f1c864bc77de211da21cc

Download Submit
C:\Windows\System\VrSplUD.exe

Filesize
998KB

MD5
c2aadcdd552bb2fefacc5c57419133c5

SHA1
7866dbf54bec00f3a2d9098d287d356f93f18b31

SHA256
a95a581fb21c990e0c3af3952419dbe6bcdc9ea8cf6f912ba54b4d7f1a762889

SHA512
a231a5f74c91f5f35068acfd49f8951e06fb3e01fe72f9c95a66e3c27f85f4a37ae8c6ec9785b9fbc0fbe181ffe744e9c05c60889de5daeb14d9359a1d70565f

Download Submit
C:\Windows\System\VzMTNId.exe

Filesize
991KB

MD5
63da647b8eef514849e58ba81ae950ef

SHA1
e933fddabbbc4de3cf85e584726304550ce9076f

SHA256
b305e98950ae3fb88e17a4239bb8f1a39cbbf685eff6c757282f55971ecb599c

SHA512
c15e8869df03e3f07ef41cf3f2af99eb5cc3ceb6c8598677c7de04b84b019d2178000d332754dde07ed52d029b6aeb6e389f2de5d11e3758030fabcc60a61d95

Download Submit
C:\Windows\System\WtBTwRy.exe

Filesize
989KB

MD5
6d4c8a1a791567ef57b3c85a559bc949

SHA1
2d48514ff9abc872495956922154a6c9dbe56403

SHA256
3de1ffe6a4996c9247063257306884aa855fdf63ba99d84225af155ef419fb6e

SHA512
a5ff140e1d28d394dfabb972bc013ebe4e8719b974f349fd16a0c51b37d1c7ef593151dcf227d6cf92bc8f6c36348594c212095b62052ac7cfd4a772d154cff4

Download Submit
C:\Windows\System\XVKJjGG.exe

Filesize
999KB

MD5
fa671d32d62626df3729ab6ce08db24a

SHA1
435cf7a281dadbb7b4c1ca65e653e941af930a41

SHA256
df5ccf03b74355172413145a86ca5bfed7fcb1a73a49403d476260ae3a17fa56

SHA512
84553303f749c71f7d1ca5eeec94e4e8cf3dc62d5557f60f7ca9fd4e0451c78618c639948ae4adc5e884ef04eb4bb6374b137c2cd0370b803e5fd70f48f665d0

Download Submit
C:\Windows\System\aVfrHkR.exe

Filesize
1000KB

MD5
c4b1a6ed88406d912be1bcad4717d57e

SHA1
368051ff567218eeb1c01b5e5320a0e2c58ff07d

SHA256
f61287acc8d6fc9f079e96b852b0068d509b984c5fdfe61d9a81ee7dd47c1b8c

SHA512
b6952597c5209ecf59eaf47a2256b64d96a1ebf12a595bfdab08c226036d8f393f3a92ed30b08275e391c4dba4a4f283531564cdea479f3bae46d6252345c12d

Download Submit
C:\Windows\System\ayqvhvi.exe

Filesize
992KB

MD5
40e463b30d401e8c446a454c5b559078

SHA1
691c61e03e06f4acd13547a9c839b631c9a4b66e

SHA256
366562688284b8e1814e37c98ab090efa1aa46f8881b3cb3b7742185762409f0

SHA512
1e6db9d67b24e45d7252b2913e88aa22bf670982e07bb7604292c801d065efae398668d973288ffc7db11dc777e8a52ea1e4145acc2217cdbdb4495ebb75765b

Download Submit
C:\Windows\System\eUnnKIs.exe

Filesize
997KB

MD5
43c42af3070187d7c9d607d4f2d64f56

SHA1
de5fa1f5a282b7f82bb6ef6458041a5c48e53682

SHA256
6a4698f9060a8cfa5b555b0d81174e983b30349d453529c7227d45059903109b

SHA512
1dae4444b4180daa55a72702daa4457be4dd51d7ed9f8de1f4cf4351f20cbe608894a5c441ed5d3b05778f2093d5fbd1f23d7537ce67e35dc2f899b2e5a6a621

Download Submit
C:\Windows\System\fOVuirw.exe

Filesize
996KB

MD5
c02eb7e27b42be4eadb0dd79a05767e6

SHA1
46ded3f9e89e03596bc135f3c68b79034b1281cb

SHA256
ab241d01a29480de529d9f00a02ea06cd8676ab73c508d1fe1d19d59a1791e3c

SHA512
990748e1f9ea9c01e11963e209bcdda0e2b5f61091958494eeaf741637f1e3085658cf28c7d216aad5dc4f2f8a31956bc427352d28977a4659b9054760313e6b

Download Submit
C:\Windows\System\flZKbjc.exe

Filesize
1001KB

MD5
3f7876e218c3a22ff0b7c5aeb52dc10c

SHA1
1a42ca8fb4728f0ecc8d36ff9103d144f73eabad

SHA256
d4aec586a8e4da113ae6554e698c6438dc350ae64bb93289c0276db85b66be2c

SHA512
49a1e7a8a35a06ecbf5ee3d236d253f57b5488d8241a2b23b76d6ea413657e25111bb009f51dfdb3c40a6019022fafb5e6db44385f018d3abaa953118c3b3bfe

Download Submit
C:\Windows\System\hWUJAGv.exe

Filesize
995KB

MD5
a07c13421a4c66664ffe6d70aa9e7a9c

SHA1
fc42a0945f5b6fdefc495371a37da084e5db7d16

SHA256
64cf19d8fe699a615f3dbcbd6541847fe2324053d712f3663f51708367953fdd

SHA512
a8ed3fc8f6dafc0dd64970d2502ce1ecabdc9a966706f3ae3387a70de349e7aa32dbbe937824ed6c50c2bd3eb64cec6f21d2cddb3611165efa77a06e0f5fc6c6

Download Submit
C:\Windows\System\htIlkAE.exe

Filesize
991KB

MD5
77592c6622a5ed5a07b22090dd3228b3

SHA1
58da06adf876f41bda1604626e48d4a642e6520f

SHA256
17fbb1861c02bc1dc0da6b5e0fde66b2d0ff28ca25959f23bf455e15b3e7649b

SHA512
2c8bd5915c42e24ecdae7bb3f94736e021999844806eb141eb1c7a15e661cbc6acbc0e7083499650a55b8ed333c0649513a559dfeb78af09f5d39c3791aa9157

Download Submit
C:\Windows\System\iCiSgoV.exe

Filesize
992KB

MD5
e4a7ac282149bf748c69a98e9eeb9040

SHA1
25970433561385281811cb60b3153f135eb60327

SHA256
a129548c40544c9678fa7ec6b19e18dbd2cf0bbc672d28a41430f25de9816d85

SHA512
538d66b94c3c3a4ce6bda9c540a87e9a4dc859b29a03f11c070c6ef22a6300a47f2c2593762f7466624dd7487908078d31f9743ee7692c2090c315fef730d5a0

Download Submit
C:\Windows\System\iOlMwDO.exe

Filesize
994KB

MD5
f8002ceb54647fcfaf6344eec81b6549

SHA1
412a2974d158d9e2cdf1320d4f62d482dc7fe4f7

SHA256
a081700372fda997392a60299214976f883ffcb1d89a8352192c6d88ae6b306e

SHA512
e1e719eefda83439e74a24caf2f6b5f87cf0d5477d98ea5be8fa68f51d35d0aeb39b329627d952299a3425cc80f6d8fa765464be09f6b7fe556283cd8131a5ab

Download Submit
C:\Windows\System\iXLxrUg.exe

Filesize
997KB

MD5
931cfda04818df670f1eca15429967f4

SHA1
0c9665ee48ab8fe22fc1e1632000fb70510b925e

SHA256
7e5b2561017aa0e01695aaa5672b40d62b9542b1ee17e8763819b8b98a6b8d80

SHA512
f6acf48d2f747590a68eda33fbb15b1109ceee40b0b660c0b5ed8b90af7d8d2c36f69a8f95abeb5a28d864ee017c55ecc5127e8326da71965c5769ecb2c171d9

Download Submit
C:\Windows\System\jLOWkkT.exe

Filesize
18B

MD5
9915174ec8de52a903dc2a8321766050

SHA1
46f420a978a90e0e6c66020af33b46078ec1ee20

SHA256
2948eb44e6c0c6bb9bd9cb705a00aa071a3bec5c145017693874751274ee1acc

SHA512
fe3b3fcc90d12448026c2250cfa6e5d560ddb1b16cdce2aaf9fe3d3c94126a9002b6beed0c6420533693860b453c87b4424d80a5e7f86024137a7d74af1ce5ed

Download Submit
C:\Windows\System\jMqOTeW.exe

Filesize
998KB

MD5
4d96930d6d6c9c76c11b875c7465b88e

SHA1
b43b63f174fbc61514121fe45c4600d1732a5caf

SHA256
205baee1b8817bc0f5d3d4414fb7c3526d6a8acf3fd55e8413603e2ad297cee0

SHA512
070fa6f4f5d96a4fe8925f4fca6fccc9d39efce220e30cb69a8849c2636b3a333fb72762a86add125b49be6ecad823d4d5922380ac98802feee6ddff2c7d7d66

Download Submit
C:\Windows\System\kOGaNwO.exe

Filesize
990KB

MD5
92562786dd63f9f4eeb54bb602daf216

SHA1
3483ccbc3465adeba17299401b9e8aa8b914eb24

SHA256
cb5f5b1160aca40cc19ddc0ed2a0a040c9c20f91e8d50f2767464783f52660c5

SHA512
03f193a15a657760f7fb378d0a1d0cdfa9a8db92b1cabb988bf681ac3bf48436bbf3fa1307cbe548e8934f3807229ba9f6f615c5dca2ff107cc629b7a124394c

Download Submit
C:\Windows\System\mdfRTbb.exe

Filesize
990KB

MD5
a7a0b749e55c290d4cb7ea2b2ad26aec

SHA1
e5ac3dd4d96b0028d5200a43f175a8d725d68b68

SHA256
413c97ae69b06a7cf59cf20508a5a4d1d622cc5741d10649312d2bc2377790cb

SHA512
873a959048bc57574f3202ddebf8fc47a47e87f4ad5d0e34ca2bda7c913c312b06080cc9825f548d03f2c3dc04c34227ebb85a39dded24169d787c38578522ee

Download Submit
C:\Windows\System\mzXsJgt.exe

Filesize
998KB

MD5
9e43a540053844810845474acf0558d4

SHA1
7362210215bed14251d7a57da6090312a333d296

SHA256
d1d344dc3828bbcba051ae89c675350d8c8e091ef678afb7679e2b9f41f627ac

SHA512
fc1775444d3b6170ffc86ff1fda31b2488bfd6859df26dc4164db45a29f786964fe782668ab55c2aaf282f47d49c6ea33db59e653bc1a86f54a5dca8dba31970

Download Submit
C:\Windows\System\peLQVSG.exe

Filesize
993KB

MD5
5287f4b82abc91c5d2f281c51c1e042f

SHA1
7bccfcfc67c5a8b108309277b42cc74841f75d5b

SHA256
e70ad2d3f37bb975eb667add4daba3ec2c918bb94d4947e23b8cd48419c2f0ef

SHA512
61e49effda44b38b34f9ee38b622bc205f37a5918a96ff37319cf929b7a6da52d70ac50ed904368812c0b9722976ea9be5cdead740ef9e38ef2e7d5de13e1625

Download Submit
C:\Windows\System\pwchPsa.exe

Filesize
1000KB

MD5
68e3292faa9561320124f111a25f2228

SHA1
91e6c33afa87ef70e764b3aa46de5cf45a14159a

SHA256
ae74f4a696cbf53a820f5b3592ed43f8439989c3d28b8c1655f110aa239c7886

SHA512
39e8da8e9988c135bfd9fb10703778bf97b2383481de2cabce2beda9816e5c8afa4abda919af5842b512da1f6b9338b94071725089c5f04f70843016e9c102a3

Download Submit
C:\Windows\System\qjPzaLD.exe

Filesize
1000KB

MD5
d7198f898100c474d873eb9e85371aea

SHA1
8719e0feda786ee6ed7ff1f2480670b63c688b37

SHA256
9aca64259b3f4392a69ed19d17d6fd08a3a801b2667a2c7eeccbb3ae89413249

SHA512
69653705274d65d85eecc810ee2419148ebe59c3773c3132b2c27b475ee2329bef06d3cdb956500b639b12a6ca7a6b296e595bb43bba6f86fc0fe9dd145e07bd

Download Submit
C:\Windows\System\qzwOlRd.exe

Filesize
991KB

MD5
581bb6698f96a283754210ef629ef2a2

SHA1
0b0867755f703875cec99d8310adbf9ff56cc1cb

SHA256
a10d98bd4117794afcdd8d268052232b17929fa4d5a42d5f98a084d2d5d6c1d9

SHA512
6278e199a867d0fc5a86fc96730a970c794b91055f14c430cc6cc542896807df811d8be91c65df7770c6aa986e5b006e84646fbdb3677f5dc173f53397ea4701

Download Submit
C:\Windows\System\roNFRff.exe

Filesize
996KB

MD5
fed8f9042d0d1de9fd7d2ce23fe1d52e

SHA1
62c582c4da9f3d4ad2fdf7bef13bc3d701995c75

SHA256
f15e1314e66a3f1bdb0fd9b4cdc186670172087285caef03c7a89c714c86c8fc

SHA512
a6506108d2deecf6196ae01e029992a597139a4a027948cc6e6056002ca314834c820865870b47474fb15798a1df98ed4958b83a2770a423f0689af5d83bb562

Download Submit
C:\Windows\System\slMMHOs.exe

Filesize
991KB

MD5
d39bae4cff6b9ae31732a9f50f50eeab

SHA1
d5fcb614b486f69f0bfd22ed302743923b36b2b8

SHA256
5339292111ce7a53fe1d520176208f965965154c7dccead7a2a7fddecdeaf169

SHA512
067781f52945ccd71d06151e5e47617e0473574322597af3639f6703b5aa2169d219c81e306bec38b2732ee631d640ce4191fb0e27a466c1ab2fde00c9b03bdf

Download Submit
C:\Windows\System\svpXili.exe

Filesize
992KB

MD5
0695080c6ae91bf4500ae17f392ed621

SHA1
a0ca4444c9d469fedd93fb9b342a512377c1ba5c

SHA256
a422a5db9eebd650cba97947160f468f67f21a8a4326c4f5660616358e38e3a1

SHA512
cc488b06ff7ed7a65d28d361aa0205a9c3545e9d534df9700d5e68951b8578f5ec8ad6e2aa646da4b10d59a45e324f278f1478c948a5fd0046e8863e31cc9bee

Download Submit
C:\Windows\System\tLNXYWG.exe

Filesize
994KB

MD5
e5a56b530b1121ecda698b295a922600

SHA1
6861902e70c9a3be6cb1293f3feae83899f62e5c

SHA256
a9234887a0ec3fd80918377be74ed2d53e320d36debf3204dfec36715829856f

SHA512
76bc073671ac549ac976beb6316c7e06f31f618704863c8291ed461efa35b272b8dceaecba9d76c31d39f52bad59e07eed3c388cbe4d9d33b1f4c0ff9598554c

Download Submit
C:\Windows\System\xaTzdXf.exe

Filesize
994KB

MD5
d8b0399c38c3fcc8d007c1a9b5a738fb

SHA1
31082c3db8167992eaa734c20df800458ce19c85

SHA256
fa5ebacc04c92a74a4c53b779f65b57e2a1736e6540e5f5f20d3444cdb55aff2

SHA512
8f27e3003a8b686b1a4e49a5d74c2766a43d9e3049616fa077f4ecbe843c0ff964bf087b9266745f87b31226fd2be7567226cd344c9a40683a18b7471ffed86e

Download Submit
C:\Windows\System\yhwLUhP.exe

Filesize
995KB

MD5
6a536915278e771299c8f1810753e401

SHA1
aa3f06b10e3829f5b9c73c90250e86cd010636b6

SHA256
c63dcb0b5a15857db052a7dedaeea3b4e5f3e507ef307f5212975740ce5c7a4e

SHA512
67169e918884b520b373718dfde46fbf7dbc33433364622ccdc43840590f2f586af6a8767a993d23a0b4dd3c94b010f7055ab7adeec4b9606b7db02d989bfbbb

Download Submit
C:\Windows\System\zejCnLO.exe

Filesize
992KB

MD5
5acbe03cebe2eb24332d40f0d3832456

SHA1
db36caf6990a8ecbe6448459a3e80f7b8b144e10

SHA256
20235e78974bf184dcc56c8bcfadc28d8f7e68eea0c97066bbcabb22ad3799d7

SHA512
2c702f552538ca04f3f00e567ae379d96177e93d49ecac0524b1702df94bd0ca517da33796f9e8139af0d569f937f32bb6fd3ba663bfa8202b8e582bd8e72bf4

Download Submit
memory/1148-58-0x00007FF6B6220000-0x00007FF6B6612000-memory.dmp

Filesize
3.9MB

Download
memory/1268-35-0x00007FF659C40000-0x00007FF65A032000-memory.dmp

Filesize
3.9MB

Download
memory/1384-246-0x00007FF68F730000-0x00007FF68FB22000-memory.dmp

Filesize
3.9MB

Download
memory/1540-1-0x000001E7014C0000-0x000001E7014D0000-memory.dmp

Filesize
64KB

Download
memory/1540-0-0x00007FF6DDE70000-0x00007FF6DE262000-memory.dmp

Filesize
3.9MB

Download
memory/1540-2815-0x00007FF6DDE70000-0x00007FF6DE262000-memory.dmp

Filesize
3.9MB

Download
memory/1580-160-0x00007FF6FA3C0000-0x00007FF6FA7B2000-memory.dmp

Filesize
3.9MB

Download
memory/1640-379-0x00007FF7464C0000-0x00007FF7468B2000-memory.dmp

Filesize
3.9MB

Download
memory/1696-12-0x00007FF909893000-0x00007FF909895000-memory.dmp

Filesize
8KB

Download
memory/1696-473-0x00000244709A0000-0x00000244709C2000-memory.dmp

Filesize
136KB

Download
memory/1920-3155-0x00007FF6F2090000-0x00007FF6F2482000-memory.dmp

Filesize
3.9MB

Download
memory/1920-7350-0x00007FF6F2090000-0x00007FF6F2482000-memory.dmp

Filesize
3.9MB

Download
memory/1920-384-0x00007FF6F2090000-0x00007FF6F2482000-memory.dmp

Filesize
3.9MB

Download
memory/2136-377-0x00007FF78B9D0000-0x00007FF78BDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-890-0x00007FF7EF890000-0x00007FF7EFC82000-memory.dmp

Filesize
3.9MB

Download
memory/2332-381-0x00007FF7301D0000-0x00007FF7305C2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-555-0x00007FF759B70000-0x00007FF759F62000-memory.dmp

Filesize
3.9MB

Download
memory/2376-6533-0x00007FF759B70000-0x00007FF759F62000-memory.dmp

Filesize
3.9MB

Download
memory/2448-158-0x00007FF7517E0000-0x00007FF751BD2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-367-0x00007FF611470000-0x00007FF611862000-memory.dmp

Filesize
3.9MB

Download
memory/2492-6485-0x00007FF611470000-0x00007FF611862000-memory.dmp

Filesize
3.9MB

Download
memory/2848-6456-0x00007FF67F940000-0x00007FF67FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2848-737-0x00007FF67F940000-0x00007FF67FD32000-memory.dmp

Filesize
3.9MB

Download
memory/3092-372-0x00007FF622570000-0x00007FF622962000-memory.dmp

Filesize
3.9MB

Download
memory/3640-631-0x00007FF703930000-0x00007FF703D22000-memory.dmp

Filesize
3.9MB

Download
memory/3716-380-0x00007FF7813B0000-0x00007FF7817A2000-memory.dmp

Filesize
3.9MB

Download
memory/3904-627-0x00007FF627AF0000-0x00007FF627EE2000-memory.dmp

Filesize
3.9MB

Download
memory/4256-458-0x00007FF7B6060000-0x00007FF7B6452000-memory.dmp

Filesize
3.9MB

Download
memory/4256-3158-0x00007FF7B6060000-0x00007FF7B6452000-memory.dmp

Filesize
3.9MB

Download
memory/4324-471-0x00007FF71B470000-0x00007FF71B862000-memory.dmp

Filesize
3.9MB

Download
memory/4436-383-0x00007FF627DD0000-0x00007FF6281C2000-memory.dmp

Filesize
3.9MB

Download
memory/4512-378-0x00007FF759EB0000-0x00007FF75A2A2000-memory.dmp

Filesize
3.9MB

Download
memory/4964-2955-0x00007FF635E10000-0x00007FF636202000-memory.dmp

Filesize
3.9MB

Download
memory/4964-115-0x00007FF635E10000-0x00007FF636202000-memory.dmp

Filesize
3.9MB

Download
memory/5040-382-0x00007FF674890000-0x00007FF674C82000-memory.dmp

Filesize
3.9MB

Download
memory/5100-11-0x00007FF6A20B0000-0x00007FF6A24A2000-memory.dmp

Filesize
3.9MB

Download