xmrig | 1b2935f3d192a1824f2446714732ef17a37dda0d14b6ce5e5ae7b29ec69c2105

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
Size

1.7MB
MD5

018b0db5c583ef17b9eb692fc1ad63a3
SHA1

7768b534e31da960a021fae07787e4a7f065624a
SHA256

1b2935f3d192a1824f2446714732ef17a37dda0d14b6ce5e5ae7b29ec69c2105
SHA512

c07d239b8a71c87b0dd4df67a05ad92b6e4bba22aba2caef4e4dd321c3d088da39f63ec35d5b870b48b68bcd9a55c723a504db206b463fa745415fcc6ba986b4
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDT:NABi

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/memory/1828-238-0x00007FF7FB330000-0x00007FF7FB722000-memory.dmp	xmrig
behavioral2/memory/1008-316-0x00007FF6D82F0000-0x00007FF6D86E2000-memory.dmp	xmrig
behavioral2/memory/2308-362-0x00007FF7C78C0000-0x00007FF7C7CB2000-memory.dmp	xmrig
behavioral2/memory/1636-368-0x00007FF636470000-0x00007FF636862000-memory.dmp	xmrig
behavioral2/memory/944-367-0x00007FF79A7A0000-0x00007FF79AB92000-memory.dmp	xmrig
behavioral2/memory/4212-366-0x00007FF61C700000-0x00007FF61CAF2000-memory.dmp	xmrig
behavioral2/memory/4404-365-0x00007FF75E6A0000-0x00007FF75EA92000-memory.dmp	xmrig
behavioral2/memory/2132-364-0x00007FF677E00000-0x00007FF6781F2000-memory.dmp	xmrig
behavioral2/memory/3348-363-0x00007FF7F6D10000-0x00007FF7F7102000-memory.dmp	xmrig
behavioral2/memory/2204-359-0x00007FF7359B0000-0x00007FF735DA2000-memory.dmp	xmrig
behavioral2/memory/2568-280-0x00007FF7DE0D0000-0x00007FF7DE4C2000-memory.dmp	xmrig
behavioral2/memory/60-271-0x00007FF6F4D70000-0x00007FF6F5162000-memory.dmp	xmrig
behavioral2/memory/4884-270-0x00007FF6BDFE0000-0x00007FF6BE3D2000-memory.dmp	xmrig
behavioral2/memory/1292-216-0x00007FF66B550000-0x00007FF66B942000-memory.dmp	xmrig
behavioral2/memory/972-215-0x00007FF7073B0000-0x00007FF7077A2000-memory.dmp	xmrig
behavioral2/memory/1064-205-0x00007FF6CEFE0000-0x00007FF6CF3D2000-memory.dmp	xmrig
behavioral2/memory/976-175-0x00007FF685B30000-0x00007FF685F22000-memory.dmp	xmrig
behavioral2/memory/4168-136-0x00007FF6C4B30000-0x00007FF6C4F22000-memory.dmp	xmrig
behavioral2/memory/3532-133-0x00007FF7B9260000-0x00007FF7B9652000-memory.dmp	xmrig
behavioral2/memory/3596-101-0x00007FF75C630000-0x00007FF75CA22000-memory.dmp	xmrig
behavioral2/memory/4772-17-0x00007FF6FD2F0000-0x00007FF6FD6E2000-memory.dmp	xmrig
behavioral2/memory/1064-4875-0x00007FF6CEFE0000-0x00007FF6CF3D2000-memory.dmp	xmrig
behavioral2/memory/976-4878-0x00007FF685B30000-0x00007FF685F22000-memory.dmp	xmrig
behavioral2/memory/944-4882-0x00007FF79A7A0000-0x00007FF79AB92000-memory.dmp	xmrig
behavioral2/memory/2568-4936-0x00007FF7DE0D0000-0x00007FF7DE4C2000-memory.dmp	xmrig
behavioral2/memory/4404-4933-0x00007FF75E6A0000-0x00007FF75EA92000-memory.dmp	xmrig
behavioral2/memory/1008-4931-0x00007FF6D82F0000-0x00007FF6D86E2000-memory.dmp	xmrig
behavioral2/memory/2204-4924-0x00007FF7359B0000-0x00007FF735DA2000-memory.dmp	xmrig
behavioral2/memory/3348-4954-0x00007FF7F6D10000-0x00007FF7F7102000-memory.dmp	xmrig
behavioral2/memory/2308-4947-0x00007FF7C78C0000-0x00007FF7C7CB2000-memory.dmp	xmrig
behavioral2/memory/1636-4941-0x00007FF636470000-0x00007FF636862000-memory.dmp	xmrig
behavioral2/memory/4884-4922-0x00007FF6BDFE0000-0x00007FF6BE3D2000-memory.dmp	xmrig
behavioral2/memory/1292-4912-0x00007FF66B550000-0x00007FF66B942000-memory.dmp	xmrig
behavioral2/memory/1828-4920-0x00007FF7FB330000-0x00007FF7FB722000-memory.dmp	xmrig
behavioral2/memory/972-4894-0x00007FF7073B0000-0x00007FF7077A2000-memory.dmp	xmrig
behavioral2/memory/60-4888-0x00007FF6F4D70000-0x00007FF6F5162000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4772	mdSvqWe.exe
3596	xJfHEXZ.exe
4212	xRpXWKW.exe
3532	CuCzZXA.exe
4168	aWippGA.exe
944	rAArGxv.exe
976	LiTrtlS.exe
1064	nFWeuHB.exe
972	liUNBKr.exe
1292	EjwOtHm.exe
1828	qgNDGsb.exe
4884	RfdMkOS.exe
60	qcXWysl.exe
2568	BhLiPMq.exe
1008	NdPQoRe.exe
1636	unoIfpu.exe
2204	piPSHVh.exe
2308	iIKFXuH.exe
3348	KVGrmtC.exe
2132	XNqceGN.exe
4404	RjsipSe.exe
2384	fIoyvPL.exe
3728	USJfaiW.exe
644	mLLLkiz.exe
3604	XulUpPG.exe
1392	bZTIjhZ.exe
2876	fnmnsdv.exe
1020	VhEqEPy.exe
2388	icbPjYt.exe
1408	WAkOJpz.exe
4364	pYatkVQ.exe
2032	SEmvdmO.exe
3228	myRRzIb.exe
3052	GogfheI.exe
384	LPlmsmd.exe
3032	gLMCCqQ.exe
2932	HldeGnS.exe
2244	wBgVLYC.exe
4312	bAIbRfx.exe
4488	TFEHtRP.exe
2660	DTnjWzj.exe
1544	BPndUIc.exe
1728	SHuumMn.exe
1472	MKMzyEL.exe
2988	ZiKFcWx.exe
4380	tiBiCOR.exe
4812	ZmyORix.exe
4968	jKQexsL.exe
4980	DFciucS.exe
548	FRjmSKs.exe
1136	rprrfTA.exe
3216	ExrDnsa.exe
1588	VLYATnf.exe
4372	tPWImrT.exe
4368	taGDSej.exe
3064	xhnkIpo.exe
4912	KRjNmss.exe
2016	EEAiabD.exe
3608	fASPTzA.exe
888	PIDIfix.exe
404	DVphblK.exe
5080	szzSbTX.exe
2772	jgXleVK.exe
224	zVIiRSB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4416-0-0x00007FF761FB0000-0x00007FF7623A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-7.dat	upx
behavioral2/files/0x000c000000023b9d-11.dat	upx
behavioral2/files/0x000a000000023bb4-35.dat	upx
behavioral2/files/0x0031000000023bb7-44.dat	upx
behavioral2/files/0x000a000000023bb9-108.dat	upx
behavioral2/files/0x000a000000023bca-143.dat	upx
behavioral2/files/0x000a000000023bc9-179.dat	upx
behavioral2/memory/1828-238-0x00007FF7FB330000-0x00007FF7FB722000-memory.dmp	upx
behavioral2/memory/1008-316-0x00007FF6D82F0000-0x00007FF6D86E2000-memory.dmp	upx
behavioral2/memory/2308-362-0x00007FF7C78C0000-0x00007FF7C7CB2000-memory.dmp	upx
behavioral2/memory/1636-368-0x00007FF636470000-0x00007FF636862000-memory.dmp	upx
behavioral2/memory/944-367-0x00007FF79A7A0000-0x00007FF79AB92000-memory.dmp	upx
behavioral2/memory/4212-366-0x00007FF61C700000-0x00007FF61CAF2000-memory.dmp	upx
behavioral2/memory/4404-365-0x00007FF75E6A0000-0x00007FF75EA92000-memory.dmp	upx
behavioral2/memory/2132-364-0x00007FF677E00000-0x00007FF6781F2000-memory.dmp	upx
behavioral2/memory/3348-363-0x00007FF7F6D10000-0x00007FF7F7102000-memory.dmp	upx
behavioral2/memory/2204-359-0x00007FF7359B0000-0x00007FF735DA2000-memory.dmp	upx
behavioral2/memory/2568-280-0x00007FF7DE0D0000-0x00007FF7DE4C2000-memory.dmp	upx
behavioral2/memory/60-271-0x00007FF6F4D70000-0x00007FF6F5162000-memory.dmp	upx
behavioral2/memory/4884-270-0x00007FF6BDFE0000-0x00007FF6BE3D2000-memory.dmp	upx
behavioral2/memory/1292-216-0x00007FF66B550000-0x00007FF66B942000-memory.dmp	upx
behavioral2/memory/972-215-0x00007FF7073B0000-0x00007FF7077A2000-memory.dmp	upx
behavioral2/memory/1064-205-0x00007FF6CEFE0000-0x00007FF6CF3D2000-memory.dmp	upx
behavioral2/files/0x000c000000023b9e-193.dat	upx
behavioral2/files/0x000a000000023bd3-190.dat	upx
behavioral2/files/0x000a000000023bd0-189.dat	upx
behavioral2/files/0x000a000000023bcf-178.dat	upx
behavioral2/memory/976-175-0x00007FF685B30000-0x00007FF685F22000-memory.dmp	upx
behavioral2/files/0x000a000000023bc7-170.dat	upx
behavioral2/files/0x000a000000023bce-169.dat	upx
behavioral2/files/0x000a000000023bcd-168.dat	upx
behavioral2/files/0x000a000000023bcc-166.dat	upx
behavioral2/files/0x000a000000023bc5-163.dat	upx
behavioral2/files/0x000a000000023bcb-160.dat	upx
behavioral2/files/0x000a000000023bc0-157.dat	upx
behavioral2/files/0x000a000000023bc6-191.dat	upx
behavioral2/files/0x000a000000023bc3-182.dat	upx
behavioral2/files/0x000a000000023bbf-144.dat	upx
behavioral2/files/0x000a000000023bbd-139.dat	upx
behavioral2/memory/4168-136-0x00007FF6C4B30000-0x00007FF6C4F22000-memory.dmp	upx
behavioral2/memory/3532-133-0x00007FF7B9260000-0x00007FF7B9652000-memory.dmp	upx
behavioral2/files/0x000a000000023bc2-124.dat	upx
behavioral2/files/0x000a000000023bbc-122.dat	upx
behavioral2/files/0x000a000000023bbb-120.dat	upx
behavioral2/files/0x000a000000023bc4-119.dat	upx
behavioral2/files/0x000a000000023bba-114.dat	upx
behavioral2/files/0x000a000000023bbe-109.dat	upx
behavioral2/files/0x000a000000023bc8-138.dat	upx
behavioral2/files/0x000a000000023bc1-93.dat	upx
behavioral2/files/0x0031000000023bb8-85.dat	upx
behavioral2/memory/3596-101-0x00007FF75C630000-0x00007FF75CA22000-memory.dmp	upx
behavioral2/files/0x000a000000023bb3-69.dat	upx
behavioral2/files/0x0031000000023bb6-68.dat	upx
behavioral2/files/0x000a000000023bb5-47.dat	upx
behavioral2/files/0x000a000000023bb2-42.dat	upx
behavioral2/files/0x000a000000023bb1-28.dat	upx
behavioral2/memory/4772-17-0x00007FF6FD2F0000-0x00007FF6FD6E2000-memory.dmp	upx
behavioral2/files/0x000c000000023b52-8.dat	upx
behavioral2/memory/1064-4875-0x00007FF6CEFE0000-0x00007FF6CF3D2000-memory.dmp	upx
behavioral2/memory/976-4878-0x00007FF685B30000-0x00007FF685F22000-memory.dmp	upx
behavioral2/memory/944-4882-0x00007FF79A7A0000-0x00007FF79AB92000-memory.dmp	upx
behavioral2/memory/2568-4936-0x00007FF7DE0D0000-0x00007FF7DE4C2000-memory.dmp	upx
behavioral2/memory/4404-4933-0x00007FF75E6A0000-0x00007FF75EA92000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AiUgJTL.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\OdlJsxi.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\LpdIclC.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\jIXKwVD.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\akLSbBk.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\SkBuTfY.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\hwtyMnX.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\FOvulYg.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\myREmnS.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\WMjGdir.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\uxhrfRG.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\RqfPcRB.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\CYIwmfc.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\HFwmtXz.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\dhNFZqX.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\yvihNhb.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\jEyzoEd.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\XQgkBTn.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\uRZrkSv.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\BwnLMiQ.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\wPeWnbc.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\FCyMjVG.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\ajdZgAd.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\fYaDrAj.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\XyKGnxQ.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\iJgoRar.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\izuJpUX.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\wPsYLaJ.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\NglyVei.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\GToxwxu.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\mmyALvi.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\IAqNmCL.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\tAFqXUs.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\yWTHswl.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\KzcMynw.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\NCPotcw.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\nAnEBpJ.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\rCWQNqj.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\mCddbaA.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\OrIDRiE.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\iNmLsYQ.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\XyXLQme.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\EhssYDr.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\kYBySYS.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\YHFGbYl.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\vTQUSLt.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\OKdesmq.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\DDDoVTp.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\BQBcMpA.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\GURkbMb.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\nTdoBLe.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\bXTgRka.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\otHkArw.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\PPbYxam.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\BueTjms.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\auOCDgG.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\aTpalGJ.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\ZtEiVmo.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\tWBoccY.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\erxpWoe.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\bglrMQt.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\KHjLtQh.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\DusXPqn.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
File created	C:\Windows\System\Wpqdrqh.exe	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeLockMemoryPrivilege	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4844	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	84
PID 4416 wrote to memory of 4844	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	84
PID 4416 wrote to memory of 4772	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	85
PID 4416 wrote to memory of 4772	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	85
PID 4416 wrote to memory of 3596	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	86
PID 4416 wrote to memory of 3596	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	86
PID 4416 wrote to memory of 4212	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	87
PID 4416 wrote to memory of 4212	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	87
PID 4416 wrote to memory of 3532	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	88
PID 4416 wrote to memory of 3532	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	88
PID 4416 wrote to memory of 4168	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	89
PID 4416 wrote to memory of 4168	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	89
PID 4416 wrote to memory of 944	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	90
PID 4416 wrote to memory of 944	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	90
PID 4416 wrote to memory of 976	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	91
PID 4416 wrote to memory of 976	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	91
PID 4416 wrote to memory of 1064	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	92
PID 4416 wrote to memory of 1064	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	92
PID 4416 wrote to memory of 972	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	93
PID 4416 wrote to memory of 972	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	93
PID 4416 wrote to memory of 1292	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	94
PID 4416 wrote to memory of 1292	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	94
PID 4416 wrote to memory of 60	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	95
PID 4416 wrote to memory of 60	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	95
PID 4416 wrote to memory of 1828	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	96
PID 4416 wrote to memory of 1828	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	96
PID 4416 wrote to memory of 4884	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	97
PID 4416 wrote to memory of 4884	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	97
PID 4416 wrote to memory of 2568	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	98
PID 4416 wrote to memory of 2568	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	98
PID 4416 wrote to memory of 1008	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	99
PID 4416 wrote to memory of 1008	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	99
PID 4416 wrote to memory of 1636	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	100
PID 4416 wrote to memory of 1636	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	100
PID 4416 wrote to memory of 2204	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	101
PID 4416 wrote to memory of 2204	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	101
PID 4416 wrote to memory of 2308	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	102
PID 4416 wrote to memory of 2308	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	102
PID 4416 wrote to memory of 3348	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	103
PID 4416 wrote to memory of 3348	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	103
PID 4416 wrote to memory of 2132	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	104
PID 4416 wrote to memory of 2132	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	104
PID 4416 wrote to memory of 4404	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	105
PID 4416 wrote to memory of 4404	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	105
PID 4416 wrote to memory of 2384	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	106
PID 4416 wrote to memory of 2384	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	106
PID 4416 wrote to memory of 3728	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	107
PID 4416 wrote to memory of 3728	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	107
PID 4416 wrote to memory of 644	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	108
PID 4416 wrote to memory of 644	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	108
PID 4416 wrote to memory of 3604	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	109
PID 4416 wrote to memory of 3604	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	109
PID 4416 wrote to memory of 1392	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	110
PID 4416 wrote to memory of 1392	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	110
PID 4416 wrote to memory of 2876	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	111
PID 4416 wrote to memory of 2876	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	111
PID 4416 wrote to memory of 1020	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	112
PID 4416 wrote to memory of 1020	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	112
PID 4416 wrote to memory of 2388	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	113
PID 4416 wrote to memory of 2388	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	113
PID 4416 wrote to memory of 1408	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	114
PID 4416 wrote to memory of 1408	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	114
PID 4416 wrote to memory of 4364	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	115
PID 4416 wrote to memory of 4364	4416	018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\018b0db5c583ef17b9eb692fc1ad63a3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4844
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4844" "2524" "2456" "2528" "0" "0" "2532" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:14332
- C:\Windows\System\mdSvqWe.exe
  C:\Windows\System\mdSvqWe.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\xJfHEXZ.exe
  C:\Windows\System\xJfHEXZ.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\xRpXWKW.exe
  C:\Windows\System\xRpXWKW.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\CuCzZXA.exe
  C:\Windows\System\CuCzZXA.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\aWippGA.exe
  C:\Windows\System\aWippGA.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\rAArGxv.exe
  C:\Windows\System\rAArGxv.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\LiTrtlS.exe
  C:\Windows\System\LiTrtlS.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\nFWeuHB.exe
  C:\Windows\System\nFWeuHB.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\liUNBKr.exe
  C:\Windows\System\liUNBKr.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\EjwOtHm.exe
  C:\Windows\System\EjwOtHm.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\qcXWysl.exe
  C:\Windows\System\qcXWysl.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\qgNDGsb.exe
  C:\Windows\System\qgNDGsb.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\RfdMkOS.exe
  C:\Windows\System\RfdMkOS.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\BhLiPMq.exe
  C:\Windows\System\BhLiPMq.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\NdPQoRe.exe
  C:\Windows\System\NdPQoRe.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\unoIfpu.exe
  C:\Windows\System\unoIfpu.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\piPSHVh.exe
  C:\Windows\System\piPSHVh.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\iIKFXuH.exe
  C:\Windows\System\iIKFXuH.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\KVGrmtC.exe
  C:\Windows\System\KVGrmtC.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\XNqceGN.exe
  C:\Windows\System\XNqceGN.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\RjsipSe.exe
  C:\Windows\System\RjsipSe.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\fIoyvPL.exe
  C:\Windows\System\fIoyvPL.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\USJfaiW.exe
  C:\Windows\System\USJfaiW.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\mLLLkiz.exe
  C:\Windows\System\mLLLkiz.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\XulUpPG.exe
  C:\Windows\System\XulUpPG.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\bZTIjhZ.exe
  C:\Windows\System\bZTIjhZ.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\fnmnsdv.exe
  C:\Windows\System\fnmnsdv.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\VhEqEPy.exe
  C:\Windows\System\VhEqEPy.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\icbPjYt.exe
  C:\Windows\System\icbPjYt.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\WAkOJpz.exe
  C:\Windows\System\WAkOJpz.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\pYatkVQ.exe
  C:\Windows\System\pYatkVQ.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\SEmvdmO.exe
  C:\Windows\System\SEmvdmO.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\myRRzIb.exe
  C:\Windows\System\myRRzIb.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\GogfheI.exe
  C:\Windows\System\GogfheI.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\LPlmsmd.exe
  C:\Windows\System\LPlmsmd.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\gLMCCqQ.exe
  C:\Windows\System\gLMCCqQ.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\HldeGnS.exe
  C:\Windows\System\HldeGnS.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\wBgVLYC.exe
  C:\Windows\System\wBgVLYC.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\bAIbRfx.exe
  C:\Windows\System\bAIbRfx.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\tiBiCOR.exe
  C:\Windows\System\tiBiCOR.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\TFEHtRP.exe
  C:\Windows\System\TFEHtRP.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\DTnjWzj.exe
  C:\Windows\System\DTnjWzj.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\BPndUIc.exe
  C:\Windows\System\BPndUIc.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\SHuumMn.exe
  C:\Windows\System\SHuumMn.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\MKMzyEL.exe
  C:\Windows\System\MKMzyEL.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\ZiKFcWx.exe
  C:\Windows\System\ZiKFcWx.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\ZmyORix.exe
  C:\Windows\System\ZmyORix.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\jKQexsL.exe
  C:\Windows\System\jKQexsL.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\DFciucS.exe
  C:\Windows\System\DFciucS.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\FRjmSKs.exe
  C:\Windows\System\FRjmSKs.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\rprrfTA.exe
  C:\Windows\System\rprrfTA.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\ExrDnsa.exe
  C:\Windows\System\ExrDnsa.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\VLYATnf.exe
  C:\Windows\System\VLYATnf.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\tPWImrT.exe
  C:\Windows\System\tPWImrT.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\taGDSej.exe
  C:\Windows\System\taGDSej.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\DVphblK.exe
  C:\Windows\System\DVphblK.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\LGosXyO.exe
  C:\Windows\System\LGosXyO.exe
  2⤵
  PID:4128
- C:\Windows\System\xhnkIpo.exe
  C:\Windows\System\xhnkIpo.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\KRjNmss.exe
  C:\Windows\System\KRjNmss.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\EEAiabD.exe
  C:\Windows\System\EEAiabD.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\fASPTzA.exe
  C:\Windows\System\fASPTzA.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\PIDIfix.exe
  C:\Windows\System\PIDIfix.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\szzSbTX.exe
  C:\Windows\System\szzSbTX.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\jgXleVK.exe
  C:\Windows\System\jgXleVK.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\zVIiRSB.exe
  C:\Windows\System\zVIiRSB.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\ITiBIbp.exe
  C:\Windows\System\ITiBIbp.exe
  2⤵
  PID:4028
- C:\Windows\System\eZeTEBh.exe
  C:\Windows\System\eZeTEBh.exe
  2⤵
  PID:4876
- C:\Windows\System\sFnERoZ.exe
  C:\Windows\System\sFnERoZ.exe
  2⤵
  PID:2764
- C:\Windows\System\MjENgRf.exe
  C:\Windows\System\MjENgRf.exe
  2⤵
  PID:3732
- C:\Windows\System\RXgweuy.exe
  C:\Windows\System\RXgweuy.exe
  2⤵
  PID:540
- C:\Windows\System\HirNRQM.exe
  C:\Windows\System\HirNRQM.exe
  2⤵
  PID:3628
- C:\Windows\System\HQTzmJB.exe
  C:\Windows\System\HQTzmJB.exe
  2⤵
  PID:4044
- C:\Windows\System\ylalWEc.exe
  C:\Windows\System\ylalWEc.exe
  2⤵
  PID:448
- C:\Windows\System\NjwrfDt.exe
  C:\Windows\System\NjwrfDt.exe
  2⤵
  PID:760
- C:\Windows\System\KFXlbNa.exe
  C:\Windows\System\KFXlbNa.exe
  2⤵
  PID:3820
- C:\Windows\System\fyKrmzf.exe
  C:\Windows\System\fyKrmzf.exe
  2⤵
  PID:4852
- C:\Windows\System\hgstWca.exe
  C:\Windows\System\hgstWca.exe
  2⤵
  PID:1952
- C:\Windows\System\UhqUnGC.exe
  C:\Windows\System\UhqUnGC.exe
  2⤵
  PID:876
- C:\Windows\System\FZXqxUP.exe
  C:\Windows\System\FZXqxUP.exe
  2⤵
  PID:3492
- C:\Windows\System\rqRGxCd.exe
  C:\Windows\System\rqRGxCd.exe
  2⤵
  PID:4336
- C:\Windows\System\DojdISS.exe
  C:\Windows\System\DojdISS.exe
  2⤵
  PID:628
- C:\Windows\System\rnfqeJY.exe
  C:\Windows\System\rnfqeJY.exe
  2⤵
  PID:5140
- C:\Windows\System\bKrcEWa.exe
  C:\Windows\System\bKrcEWa.exe
  2⤵
  PID:5156
- C:\Windows\System\YhSQfjW.exe
  C:\Windows\System\YhSQfjW.exe
  2⤵
  PID:5192
- C:\Windows\System\HjywzDy.exe
  C:\Windows\System\HjywzDy.exe
  2⤵
  PID:5212
- C:\Windows\System\rZzTJsw.exe
  C:\Windows\System\rZzTJsw.exe
  2⤵
  PID:5236
- C:\Windows\System\QtfvOeG.exe
  C:\Windows\System\QtfvOeG.exe
  2⤵
  PID:5252
- C:\Windows\System\dalsTjV.exe
  C:\Windows\System\dalsTjV.exe
  2⤵
  PID:5268
- C:\Windows\System\bpROlrC.exe
  C:\Windows\System\bpROlrC.exe
  2⤵
  PID:5288
- C:\Windows\System\YfCROmo.exe
  C:\Windows\System\YfCROmo.exe
  2⤵
  PID:5304
- C:\Windows\System\jNVfaCL.exe
  C:\Windows\System\jNVfaCL.exe
  2⤵
  PID:5320
- C:\Windows\System\kCkvfPp.exe
  C:\Windows\System\kCkvfPp.exe
  2⤵
  PID:5340
- C:\Windows\System\MFwAgSi.exe
  C:\Windows\System\MFwAgSi.exe
  2⤵
  PID:5356
- C:\Windows\System\QMlxxRa.exe
  C:\Windows\System\QMlxxRa.exe
  2⤵
  PID:5380
- C:\Windows\System\HLUvnFm.exe
  C:\Windows\System\HLUvnFm.exe
  2⤵
  PID:5400
- C:\Windows\System\JWkgdxC.exe
  C:\Windows\System\JWkgdxC.exe
  2⤵
  PID:5416
- C:\Windows\System\cdnXZYD.exe
  C:\Windows\System\cdnXZYD.exe
  2⤵
  PID:5432
- C:\Windows\System\IJpFFOy.exe
  C:\Windows\System\IJpFFOy.exe
  2⤵
  PID:5448
- C:\Windows\System\qCAiFnn.exe
  C:\Windows\System\qCAiFnn.exe
  2⤵
  PID:5468
- C:\Windows\System\QEpKKqL.exe
  C:\Windows\System\QEpKKqL.exe
  2⤵
  PID:5492
- C:\Windows\System\JTGwnEZ.exe
  C:\Windows\System\JTGwnEZ.exe
  2⤵
  PID:5524
- C:\Windows\System\HDxlBMq.exe
  C:\Windows\System\HDxlBMq.exe
  2⤵
  PID:5944
- C:\Windows\System\LgxSmra.exe
  C:\Windows\System\LgxSmra.exe
  2⤵
  PID:5960
- C:\Windows\System\ogHYaFr.exe
  C:\Windows\System\ogHYaFr.exe
  2⤵
  PID:5988
- C:\Windows\System\gswMisP.exe
  C:\Windows\System\gswMisP.exe
  2⤵
  PID:6008
- C:\Windows\System\VlPCuny.exe
  C:\Windows\System\VlPCuny.exe
  2⤵
  PID:6028
- C:\Windows\System\SlzWHrg.exe
  C:\Windows\System\SlzWHrg.exe
  2⤵
  PID:6048
- C:\Windows\System\rpiKXgD.exe
  C:\Windows\System\rpiKXgD.exe
  2⤵
  PID:4104
- C:\Windows\System\vqBpgTp.exe
  C:\Windows\System\vqBpgTp.exe
  2⤵
  PID:2404
- C:\Windows\System\QHkHlms.exe
  C:\Windows\System\QHkHlms.exe
  2⤵
  PID:1468
- C:\Windows\System\XRfXQEE.exe
  C:\Windows\System\XRfXQEE.exe
  2⤵
  PID:2168
- C:\Windows\System\yyZOtjS.exe
  C:\Windows\System\yyZOtjS.exe
  2⤵
  PID:4860
- C:\Windows\System\rKLYGtM.exe
  C:\Windows\System\rKLYGtM.exe
  2⤵
  PID:1884
- C:\Windows\System\BTGrNFc.exe
  C:\Windows\System\BTGrNFc.exe
  2⤵
  PID:5168
- C:\Windows\System\PKtBtwO.exe
  C:\Windows\System\PKtBtwO.exe
  2⤵
  PID:5224
- C:\Windows\System\jbbOXjZ.exe
  C:\Windows\System\jbbOXjZ.exe
  2⤵
  PID:5276
- C:\Windows\System\IMdjmKc.exe
  C:\Windows\System\IMdjmKc.exe
  2⤵
  PID:5312
- C:\Windows\System\rqBsbUZ.exe
  C:\Windows\System\rqBsbUZ.exe
  2⤵
  PID:5352
- C:\Windows\System\kOeszQD.exe
  C:\Windows\System\kOeszQD.exe
  2⤵
  PID:5412
- C:\Windows\System\MYRpqbm.exe
  C:\Windows\System\MYRpqbm.exe
  2⤵
  PID:5456
- C:\Windows\System\jktDQvJ.exe
  C:\Windows\System\jktDQvJ.exe
  2⤵
  PID:5488
- C:\Windows\System\ncejsVn.exe
  C:\Windows\System\ncejsVn.exe
  2⤵
  PID:2824
- C:\Windows\System\GdFLRwQ.exe
  C:\Windows\System\GdFLRwQ.exe
  2⤵
  PID:5900
- C:\Windows\System\DeSEDBi.exe
  C:\Windows\System\DeSEDBi.exe
  2⤵
  PID:5928
- C:\Windows\System\pdEMkxr.exe
  C:\Windows\System\pdEMkxr.exe
  2⤵
  PID:5956
- C:\Windows\System\EdDlIrO.exe
  C:\Windows\System\EdDlIrO.exe
  2⤵
  PID:5996
- C:\Windows\System\YARswLH.exe
  C:\Windows\System\YARswLH.exe
  2⤵
  PID:6024
- C:\Windows\System\PERPkyz.exe
  C:\Windows\System\PERPkyz.exe
  2⤵
  PID:6056
- C:\Windows\System\SeqzGxO.exe
  C:\Windows\System\SeqzGxO.exe
  2⤵
  PID:6084
- C:\Windows\System\togPknV.exe
  C:\Windows\System\togPknV.exe
  2⤵
  PID:6104
- C:\Windows\System\cfqLdOt.exe
  C:\Windows\System\cfqLdOt.exe
  2⤵
  PID:6136
- C:\Windows\System\dRccsty.exe
  C:\Windows\System\dRccsty.exe
  2⤵
  PID:1368
- C:\Windows\System\naQdrYf.exe
  C:\Windows\System\naQdrYf.exe
  2⤵
  PID:3676
- C:\Windows\System\yrmWXOI.exe
  C:\Windows\System\yrmWXOI.exe
  2⤵
  PID:428
- C:\Windows\System\vrPRQaI.exe
  C:\Windows\System\vrPRQaI.exe
  2⤵
  PID:4972
- C:\Windows\System\BWixeIF.exe
  C:\Windows\System\BWixeIF.exe
  2⤵
  PID:4124
- C:\Windows\System\suUwJVX.exe
  C:\Windows\System\suUwJVX.exe
  2⤵
  PID:1572
- C:\Windows\System\czwZVxx.exe
  C:\Windows\System\czwZVxx.exe
  2⤵
  PID:772
- C:\Windows\System\TxecUDL.exe
  C:\Windows\System\TxecUDL.exe
  2⤵
  PID:2020
- C:\Windows\System\rgIAUBy.exe
  C:\Windows\System\rgIAUBy.exe
  2⤵
  PID:836
- C:\Windows\System\qEPfogV.exe
  C:\Windows\System\qEPfogV.exe
  2⤵
  PID:2376
- C:\Windows\System\lTqXmHc.exe
  C:\Windows\System\lTqXmHc.exe
  2⤵
  PID:4112
- C:\Windows\System\kzBWnaL.exe
  C:\Windows\System\kzBWnaL.exe
  2⤵
  PID:4948
- C:\Windows\System\rwulXMB.exe
  C:\Windows\System\rwulXMB.exe
  2⤵
  PID:2632
- C:\Windows\System\ZoyGzdd.exe
  C:\Windows\System\ZoyGzdd.exe
  2⤵
  PID:5136
- C:\Windows\System\PpfjIhD.exe
  C:\Windows\System\PpfjIhD.exe
  2⤵
  PID:5560
- C:\Windows\System\OTLOycO.exe
  C:\Windows\System\OTLOycO.exe
  2⤵
  PID:4148
- C:\Windows\System\FlmeGKa.exe
  C:\Windows\System\FlmeGKa.exe
  2⤵
  PID:3124
- C:\Windows\System\kWLichX.exe
  C:\Windows\System\kWLichX.exe
  2⤵
  PID:3788
- C:\Windows\System\KrVOdlM.exe
  C:\Windows\System\KrVOdlM.exe
  2⤵
  PID:5200
- C:\Windows\System\WJltrGh.exe
  C:\Windows\System\WJltrGh.exe
  2⤵
  PID:5444
- C:\Windows\System\VtOlfxM.exe
  C:\Windows\System\VtOlfxM.exe
  2⤵
  PID:5348
- C:\Windows\System\AgtzPuQ.exe
  C:\Windows\System\AgtzPuQ.exe
  2⤵
  PID:5540
- C:\Windows\System\CohjHhO.exe
  C:\Windows\System\CohjHhO.exe
  2⤵
  PID:5976
- C:\Windows\System\wrTircn.exe
  C:\Windows\System\wrTircn.exe
  2⤵
  PID:5908
- C:\Windows\System\EgkxNTL.exe
  C:\Windows\System\EgkxNTL.exe
  2⤵
  PID:6076
- C:\Windows\System\kOAAYJE.exe
  C:\Windows\System\kOAAYJE.exe
  2⤵
  PID:4952
- C:\Windows\System\AlbSHgz.exe
  C:\Windows\System\AlbSHgz.exe
  2⤵
  PID:3320
- C:\Windows\System\dHWEXYQ.exe
  C:\Windows\System\dHWEXYQ.exe
  2⤵
  PID:3096
- C:\Windows\System\FIZUphr.exe
  C:\Windows\System\FIZUphr.exe
  2⤵
  PID:5580
- C:\Windows\System\iNyCcem.exe
  C:\Windows\System\iNyCcem.exe
  2⤵
  PID:2956
- C:\Windows\System\cGgXRnk.exe
  C:\Windows\System\cGgXRnk.exe
  2⤵
  PID:4424
- C:\Windows\System\nHxPWIR.exe
  C:\Windows\System\nHxPWIR.exe
  2⤵
  PID:1608
- C:\Windows\System\XrTZLet.exe
  C:\Windows\System\XrTZLet.exe
  2⤵
  PID:5220
- C:\Windows\System\Vgyyoet.exe
  C:\Windows\System\Vgyyoet.exe
  2⤵
  PID:5920
- C:\Windows\System\SJTDdHJ.exe
  C:\Windows\System\SJTDdHJ.exe
  2⤵
  PID:6152
- C:\Windows\System\DVYHBfC.exe
  C:\Windows\System\DVYHBfC.exe
  2⤵
  PID:6176
- C:\Windows\System\NiEKCIC.exe
  C:\Windows\System\NiEKCIC.exe
  2⤵
  PID:6200
- C:\Windows\System\tVcQCTh.exe
  C:\Windows\System\tVcQCTh.exe
  2⤵
  PID:6224
- C:\Windows\System\ItKymDC.exe
  C:\Windows\System\ItKymDC.exe
  2⤵
  PID:6244
- C:\Windows\System\VXdXCMC.exe
  C:\Windows\System\VXdXCMC.exe
  2⤵
  PID:6264
- C:\Windows\System\HsyEiQG.exe
  C:\Windows\System\HsyEiQG.exe
  2⤵
  PID:6280
- C:\Windows\System\bCZrJfv.exe
  C:\Windows\System\bCZrJfv.exe
  2⤵
  PID:6304
- C:\Windows\System\duWoEJG.exe
  C:\Windows\System\duWoEJG.exe
  2⤵
  PID:6332
- C:\Windows\System\hJZjhGt.exe
  C:\Windows\System\hJZjhGt.exe
  2⤵
  PID:6348
- C:\Windows\System\SaoHEMm.exe
  C:\Windows\System\SaoHEMm.exe
  2⤵
  PID:6368
- C:\Windows\System\mFsdIUB.exe
  C:\Windows\System\mFsdIUB.exe
  2⤵
  PID:6388
- C:\Windows\System\bJWorFU.exe
  C:\Windows\System\bJWorFU.exe
  2⤵
  PID:6416
- C:\Windows\System\UiyyfTs.exe
  C:\Windows\System\UiyyfTs.exe
  2⤵
  PID:6432
- C:\Windows\System\iioQhGm.exe
  C:\Windows\System\iioQhGm.exe
  2⤵
  PID:6460
- C:\Windows\System\ylSzwDA.exe
  C:\Windows\System\ylSzwDA.exe
  2⤵
  PID:6484
- C:\Windows\System\cTMGOQl.exe
  C:\Windows\System\cTMGOQl.exe
  2⤵
  PID:6504
- C:\Windows\System\PWmGqJd.exe
  C:\Windows\System\PWmGqJd.exe
  2⤵
  PID:6536
- C:\Windows\System\rSPqlqu.exe
  C:\Windows\System\rSPqlqu.exe
  2⤵
  PID:6556
- C:\Windows\System\IAsMXoq.exe
  C:\Windows\System\IAsMXoq.exe
  2⤵
  PID:6576
- C:\Windows\System\WvbfkiO.exe
  C:\Windows\System\WvbfkiO.exe
  2⤵
  PID:6600
- C:\Windows\System\oNuwjcR.exe
  C:\Windows\System\oNuwjcR.exe
  2⤵
  PID:6624
- C:\Windows\System\uMsctiv.exe
  C:\Windows\System\uMsctiv.exe
  2⤵
  PID:6644
- C:\Windows\System\Ttqtkxb.exe
  C:\Windows\System\Ttqtkxb.exe
  2⤵
  PID:6660
- C:\Windows\System\NifnqTL.exe
  C:\Windows\System\NifnqTL.exe
  2⤵
  PID:6684
- C:\Windows\System\LvYkMhx.exe
  C:\Windows\System\LvYkMhx.exe
  2⤵
  PID:6700
- C:\Windows\System\QzdGaNQ.exe
  C:\Windows\System\QzdGaNQ.exe
  2⤵
  PID:6724
- C:\Windows\System\WQKdUDT.exe
  C:\Windows\System\WQKdUDT.exe
  2⤵
  PID:6740
- C:\Windows\System\QQdFDBh.exe
  C:\Windows\System\QQdFDBh.exe
  2⤵
  PID:6764
- C:\Windows\System\TwpoWMi.exe
  C:\Windows\System\TwpoWMi.exe
  2⤵
  PID:6780
- C:\Windows\System\pWGWEUo.exe
  C:\Windows\System\pWGWEUo.exe
  2⤵
  PID:6808
- C:\Windows\System\DdHdeRn.exe
  C:\Windows\System\DdHdeRn.exe
  2⤵
  PID:6824
- C:\Windows\System\zgUbmtg.exe
  C:\Windows\System\zgUbmtg.exe
  2⤵
  PID:6844
- C:\Windows\System\ydEQnDH.exe
  C:\Windows\System\ydEQnDH.exe
  2⤵
  PID:6868
- C:\Windows\System\EIkzSAa.exe
  C:\Windows\System\EIkzSAa.exe
  2⤵
  PID:6888
- C:\Windows\System\lLelBRF.exe
  C:\Windows\System\lLelBRF.exe
  2⤵
  PID:6912
- C:\Windows\System\IRyyOoB.exe
  C:\Windows\System\IRyyOoB.exe
  2⤵
  PID:6932
- C:\Windows\System\WMcDdCN.exe
  C:\Windows\System\WMcDdCN.exe
  2⤵
  PID:6952
- C:\Windows\System\zUjLEus.exe
  C:\Windows\System\zUjLEus.exe
  2⤵
  PID:6968
- C:\Windows\System\hHHsRhW.exe
  C:\Windows\System\hHHsRhW.exe
  2⤵
  PID:6992
- C:\Windows\System\PiLVdPJ.exe
  C:\Windows\System\PiLVdPJ.exe
  2⤵
  PID:7016
- C:\Windows\System\MifsLMd.exe
  C:\Windows\System\MifsLMd.exe
  2⤵
  PID:7032
- C:\Windows\System\AIpcpPZ.exe
  C:\Windows\System\AIpcpPZ.exe
  2⤵
  PID:7060
- C:\Windows\System\SdPZIsb.exe
  C:\Windows\System\SdPZIsb.exe
  2⤵
  PID:7080
- C:\Windows\System\TeNszKV.exe
  C:\Windows\System\TeNszKV.exe
  2⤵
  PID:7100
- C:\Windows\System\SHRrMLS.exe
  C:\Windows\System\SHRrMLS.exe
  2⤵
  PID:7124
- C:\Windows\System\aOHvWcl.exe
  C:\Windows\System\aOHvWcl.exe
  2⤵
  PID:7144
- C:\Windows\System\uJmUMEM.exe
  C:\Windows\System\uJmUMEM.exe
  2⤵
  PID:1756
- C:\Windows\System\szZUSZq.exe
  C:\Windows\System\szZUSZq.exe
  2⤵
  PID:4272
- C:\Windows\System\JWIkSRP.exe
  C:\Windows\System\JWIkSRP.exe
  2⤵
  PID:5548
- C:\Windows\System\rrJmxJr.exe
  C:\Windows\System\rrJmxJr.exe
  2⤵
  PID:5564
- C:\Windows\System\EVyFzoU.exe
  C:\Windows\System\EVyFzoU.exe
  2⤵
  PID:5476
- C:\Windows\System\OoZwhUy.exe
  C:\Windows\System\OoZwhUy.exe
  2⤵
  PID:5504
- C:\Windows\System\uXvtzLc.exe
  C:\Windows\System\uXvtzLc.exe
  2⤵
  PID:6236
- C:\Windows\System\ruBafuY.exe
  C:\Windows\System\ruBafuY.exe
  2⤵
  PID:6300
- C:\Windows\System\iWqtstW.exe
  C:\Windows\System\iWqtstW.exe
  2⤵
  PID:6360
- C:\Windows\System\JUuKuyW.exe
  C:\Windows\System\JUuKuyW.exe
  2⤵
  PID:6408
- C:\Windows\System\uQefpCw.exe
  C:\Windows\System\uQefpCw.exe
  2⤵
  PID:4816
- C:\Windows\System\cIJtoWF.exe
  C:\Windows\System\cIJtoWF.exe
  2⤵
  PID:6192
- C:\Windows\System\LOZMxYg.exe
  C:\Windows\System\LOZMxYg.exe
  2⤵
  PID:6272
- C:\Windows\System\lmWtshr.exe
  C:\Windows\System\lmWtshr.exe
  2⤵
  PID:6636
- C:\Windows\System\xMFfbvM.exe
  C:\Windows\System\xMFfbvM.exe
  2⤵
  PID:6760
- C:\Windows\System\dfhSOCl.exe
  C:\Windows\System\dfhSOCl.exe
  2⤵
  PID:6800
- C:\Windows\System\WwUQcRd.exe
  C:\Windows\System\WwUQcRd.exe
  2⤵
  PID:6216
- C:\Windows\System\ZJinLuf.exe
  C:\Windows\System\ZJinLuf.exe
  2⤵
  PID:7184
- C:\Windows\System\WsPKCaY.exe
  C:\Windows\System\WsPKCaY.exe
  2⤵
  PID:7204
- C:\Windows\System\DfPMmhB.exe
  C:\Windows\System\DfPMmhB.exe
  2⤵
  PID:7228
- C:\Windows\System\endiKAS.exe
  C:\Windows\System\endiKAS.exe
  2⤵
  PID:7244
- C:\Windows\System\KljJRJf.exe
  C:\Windows\System\KljJRJf.exe
  2⤵
  PID:7272
- C:\Windows\System\tvapsxU.exe
  C:\Windows\System\tvapsxU.exe
  2⤵
  PID:7292
- C:\Windows\System\XQfhGTP.exe
  C:\Windows\System\XQfhGTP.exe
  2⤵
  PID:7312
- C:\Windows\System\xlbcPIW.exe
  C:\Windows\System\xlbcPIW.exe
  2⤵
  PID:7332
- C:\Windows\System\fNJHBuy.exe
  C:\Windows\System\fNJHBuy.exe
  2⤵
  PID:7352
- C:\Windows\System\uCvYcLA.exe
  C:\Windows\System\uCvYcLA.exe
  2⤵
  PID:7376
- C:\Windows\System\QwusUtC.exe
  C:\Windows\System\QwusUtC.exe
  2⤵
  PID:7396
- C:\Windows\System\lkgDLWs.exe
  C:\Windows\System\lkgDLWs.exe
  2⤵
  PID:7420
- C:\Windows\System\TlyFhXF.exe
  C:\Windows\System\TlyFhXF.exe
  2⤵
  PID:7436
- C:\Windows\System\HWOgxXY.exe
  C:\Windows\System\HWOgxXY.exe
  2⤵
  PID:7464
- C:\Windows\System\VylDYoW.exe
  C:\Windows\System\VylDYoW.exe
  2⤵
  PID:7484
- C:\Windows\System\tdgTHgS.exe
  C:\Windows\System\tdgTHgS.exe
  2⤵
  PID:7508
- C:\Windows\System\ktALiXl.exe
  C:\Windows\System\ktALiXl.exe
  2⤵
  PID:7524
- C:\Windows\System\hkPvZWC.exe
  C:\Windows\System\hkPvZWC.exe
  2⤵
  PID:7548
- C:\Windows\System\oYgXPqw.exe
  C:\Windows\System\oYgXPqw.exe
  2⤵
  PID:7568
- C:\Windows\System\rqbYvrS.exe
  C:\Windows\System\rqbYvrS.exe
  2⤵
  PID:7592
- C:\Windows\System\WxzyTrK.exe
  C:\Windows\System\WxzyTrK.exe
  2⤵
  PID:7608
- C:\Windows\System\nrataeS.exe
  C:\Windows\System\nrataeS.exe
  2⤵
  PID:7632
- C:\Windows\System\BjbukHj.exe
  C:\Windows\System\BjbukHj.exe
  2⤵
  PID:7652
- C:\Windows\System\MpilklU.exe
  C:\Windows\System\MpilklU.exe
  2⤵
  PID:7672
- C:\Windows\System\BpwHGLO.exe
  C:\Windows\System\BpwHGLO.exe
  2⤵
  PID:7700
- C:\Windows\System\GWrpRXz.exe
  C:\Windows\System\GWrpRXz.exe
  2⤵
  PID:7720
- C:\Windows\System\jxElvJF.exe
  C:\Windows\System\jxElvJF.exe
  2⤵
  PID:7744
- C:\Windows\System\FQpeokm.exe
  C:\Windows\System\FQpeokm.exe
  2⤵
  PID:7764
- C:\Windows\System\QYATeUq.exe
  C:\Windows\System\QYATeUq.exe
  2⤵
  PID:7788
- C:\Windows\System\lMilifv.exe
  C:\Windows\System\lMilifv.exe
  2⤵
  PID:7816
- C:\Windows\System\mcQmtDC.exe
  C:\Windows\System\mcQmtDC.exe
  2⤵
  PID:7832
- C:\Windows\System\FGUFEzL.exe
  C:\Windows\System\FGUFEzL.exe
  2⤵
  PID:7852
- C:\Windows\System\nfvSKfH.exe
  C:\Windows\System\nfvSKfH.exe
  2⤵
  PID:7872
- C:\Windows\System\JUVwFDw.exe
  C:\Windows\System\JUVwFDw.exe
  2⤵
  PID:7892
- C:\Windows\System\BYchder.exe
  C:\Windows\System\BYchder.exe
  2⤵
  PID:7920
- C:\Windows\System\mJxkHli.exe
  C:\Windows\System\mJxkHli.exe
  2⤵
  PID:7944
- C:\Windows\System\qLrTXIC.exe
  C:\Windows\System\qLrTXIC.exe
  2⤵
  PID:7964
- C:\Windows\System\rKIfhKY.exe
  C:\Windows\System\rKIfhKY.exe
  2⤵
  PID:7984
- C:\Windows\System\CADlpaR.exe
  C:\Windows\System\CADlpaR.exe
  2⤵
  PID:8008
- C:\Windows\System\CGXyKLL.exe
  C:\Windows\System\CGXyKLL.exe
  2⤵
  PID:8032
- C:\Windows\System\QGMRjud.exe
  C:\Windows\System\QGMRjud.exe
  2⤵
  PID:8052
- C:\Windows\System\CGuhQca.exe
  C:\Windows\System\CGuhQca.exe
  2⤵
  PID:8080
- C:\Windows\System\OwWKGnW.exe
  C:\Windows\System\OwWKGnW.exe
  2⤵
  PID:8100
- C:\Windows\System\TuIjCGo.exe
  C:\Windows\System\TuIjCGo.exe
  2⤵
  PID:8120
- C:\Windows\System\GyiFAsd.exe
  C:\Windows\System\GyiFAsd.exe
  2⤵
  PID:8148
- C:\Windows\System\QnelpzQ.exe
  C:\Windows\System\QnelpzQ.exe
  2⤵
  PID:8164
- C:\Windows\System\qhJNoyW.exe
  C:\Windows\System\qhJNoyW.exe
  2⤵
  PID:8184
- C:\Windows\System\qKwGAYe.exe
  C:\Windows\System\qKwGAYe.exe
  2⤵
  PID:6940
- C:\Windows\System\LPRDJMe.exe
  C:\Windows\System\LPRDJMe.exe
  2⤵
  PID:6260
- C:\Windows\System\XcECHDH.exe
  C:\Windows\System\XcECHDH.exe
  2⤵
  PID:6552
- C:\Windows\System\iMzzMmO.exe
  C:\Windows\System\iMzzMmO.exe
  2⤵
  PID:7040
- C:\Windows\System\jjbBgND.exe
  C:\Windows\System\jjbBgND.exe
  2⤵
  PID:6584
- C:\Windows\System\XoJFyQu.exe
  C:\Windows\System\XoJFyQu.exe
  2⤵
  PID:7116
- C:\Windows\System\yDStfQi.exe
  C:\Windows\System\yDStfQi.exe
  2⤵
  PID:7156
- C:\Windows\System\VWvdoMr.exe
  C:\Windows\System\VWvdoMr.exe
  2⤵
  PID:6672
- C:\Windows\System\JJIeMet.exe
  C:\Windows\System\JJIeMet.exe
  2⤵
  PID:1992
- C:\Windows\System\pfZDfvx.exe
  C:\Windows\System\pfZDfvx.exe
  2⤵
  PID:4964
- C:\Windows\System\nGhMpkO.exe
  C:\Windows\System\nGhMpkO.exe
  2⤵
  PID:6592
- C:\Windows\System\jYLirtT.exe
  C:\Windows\System\jYLirtT.exe
  2⤵
  PID:6860
- C:\Windows\System\fIasIAc.exe
  C:\Windows\System\fIasIAc.exe
  2⤵
  PID:7216
- C:\Windows\System\wRKUOwT.exe
  C:\Windows\System\wRKUOwT.exe
  2⤵
  PID:7344
- C:\Windows\System\WwbErWr.exe
  C:\Windows\System\WwbErWr.exe
  2⤵
  PID:6984
- C:\Windows\System\PToJaYL.exe
  C:\Windows\System\PToJaYL.exe
  2⤵
  PID:7516
- C:\Windows\System\BrNmMmi.exe
  C:\Windows\System\BrNmMmi.exe
  2⤵
  PID:7584
- C:\Windows\System\faJRCog.exe
  C:\Windows\System\faJRCog.exe
  2⤵
  PID:7640
- C:\Windows\System\NcjwYwV.exe
  C:\Windows\System\NcjwYwV.exe
  2⤵
  PID:7136
- C:\Windows\System\zbtGNnx.exe
  C:\Windows\System\zbtGNnx.exe
  2⤵
  PID:7756
- C:\Windows\System\DWvSFZm.exe
  C:\Windows\System\DWvSFZm.exe
  2⤵
  PID:4420
- C:\Windows\System\gRbpIzo.exe
  C:\Windows\System\gRbpIzo.exe
  2⤵
  PID:7808
- C:\Windows\System\iPiCCsP.exe
  C:\Windows\System\iPiCCsP.exe
  2⤵
  PID:8196
- C:\Windows\System\GNxjYdr.exe
  C:\Windows\System\GNxjYdr.exe
  2⤵
  PID:8216
- C:\Windows\System\hKEOXTt.exe
  C:\Windows\System\hKEOXTt.exe
  2⤵
  PID:8236
- C:\Windows\System\MaIwfTl.exe
  C:\Windows\System\MaIwfTl.exe
  2⤵
  PID:8256
- C:\Windows\System\ClyvovH.exe
  C:\Windows\System\ClyvovH.exe
  2⤵
  PID:8276
- C:\Windows\System\DSXwroz.exe
  C:\Windows\System\DSXwroz.exe
  2⤵
  PID:8296
- C:\Windows\System\UoOEEci.exe
  C:\Windows\System\UoOEEci.exe
  2⤵
  PID:8320
- C:\Windows\System\MNcizBT.exe
  C:\Windows\System\MNcizBT.exe
  2⤵
  PID:8340
- C:\Windows\System\oFwqWQn.exe
  C:\Windows\System\oFwqWQn.exe
  2⤵
  PID:8360
- C:\Windows\System\LnXFtFY.exe
  C:\Windows\System\LnXFtFY.exe
  2⤵
  PID:8380
- C:\Windows\System\dQioJfE.exe
  C:\Windows\System\dQioJfE.exe
  2⤵
  PID:8404
- C:\Windows\System\kkkSfGT.exe
  C:\Windows\System\kkkSfGT.exe
  2⤵
  PID:8424
- C:\Windows\System\nvVebKh.exe
  C:\Windows\System\nvVebKh.exe
  2⤵
  PID:8440
- C:\Windows\System\ylwoiHe.exe
  C:\Windows\System\ylwoiHe.exe
  2⤵
  PID:8472
- C:\Windows\System\LkCNReB.exe
  C:\Windows\System\LkCNReB.exe
  2⤵
  PID:8492
- C:\Windows\System\keaiiOT.exe
  C:\Windows\System\keaiiOT.exe
  2⤵
  PID:8512
- C:\Windows\System\YIEnnNk.exe
  C:\Windows\System\YIEnnNk.exe
  2⤵
  PID:8536
- C:\Windows\System\HUzmmTx.exe
  C:\Windows\System\HUzmmTx.exe
  2⤵
  PID:8556
- C:\Windows\System\iUAqobG.exe
  C:\Windows\System\iUAqobG.exe
  2⤵
  PID:8576
- C:\Windows\System\hlKmwen.exe
  C:\Windows\System\hlKmwen.exe
  2⤵
  PID:8596
- C:\Windows\System\hfUpPAj.exe
  C:\Windows\System\hfUpPAj.exe
  2⤵
  PID:8616
- C:\Windows\System\MCmoYuc.exe
  C:\Windows\System\MCmoYuc.exe
  2⤵
  PID:8640
- C:\Windows\System\bhyddcP.exe
  C:\Windows\System\bhyddcP.exe
  2⤵
  PID:8664
- C:\Windows\System\hedmRXw.exe
  C:\Windows\System\hedmRXw.exe
  2⤵
  PID:8684
- C:\Windows\System\oceOKQl.exe
  C:\Windows\System\oceOKQl.exe
  2⤵
  PID:8708
- C:\Windows\System\WknUxFm.exe
  C:\Windows\System\WknUxFm.exe
  2⤵
  PID:8728
- C:\Windows\System\xzxlWmN.exe
  C:\Windows\System\xzxlWmN.exe
  2⤵
  PID:8748
- C:\Windows\System\vavHksl.exe
  C:\Windows\System\vavHksl.exe
  2⤵
  PID:8772
- C:\Windows\System\kgzaAfc.exe
  C:\Windows\System\kgzaAfc.exe
  2⤵
  PID:8792
- C:\Windows\System\ADEXEgF.exe
  C:\Windows\System\ADEXEgF.exe
  2⤵
  PID:8816
- C:\Windows\System\mlZVmbl.exe
  C:\Windows\System\mlZVmbl.exe
  2⤵
  PID:8840
- C:\Windows\System\VPmxYCY.exe
  C:\Windows\System\VPmxYCY.exe
  2⤵
  PID:8860
- C:\Windows\System\afPCsLn.exe
  C:\Windows\System\afPCsLn.exe
  2⤵
  PID:8880
- C:\Windows\System\qinEPaU.exe
  C:\Windows\System\qinEPaU.exe
  2⤵
  PID:8908
- C:\Windows\System\krVEuBk.exe
  C:\Windows\System\krVEuBk.exe
  2⤵
  PID:8932
- C:\Windows\System\BMmUqtb.exe
  C:\Windows\System\BMmUqtb.exe
  2⤵
  PID:8952
- C:\Windows\System\BfJLDgy.exe
  C:\Windows\System\BfJLDgy.exe
  2⤵
  PID:8972
- C:\Windows\System\ukGRecH.exe
  C:\Windows\System\ukGRecH.exe
  2⤵
  PID:8992
- C:\Windows\System\wdVypHP.exe
  C:\Windows\System\wdVypHP.exe
  2⤵
  PID:9016
- C:\Windows\System\eeBTKHB.exe
  C:\Windows\System\eeBTKHB.exe
  2⤵
  PID:9036
- C:\Windows\System\vRBraha.exe
  C:\Windows\System\vRBraha.exe
  2⤵
  PID:9060
- C:\Windows\System\GNvmEyh.exe
  C:\Windows\System\GNvmEyh.exe
  2⤵
  PID:9080
- C:\Windows\System\XfdEMpo.exe
  C:\Windows\System\XfdEMpo.exe
  2⤵
  PID:9104
- C:\Windows\System\hZRxBaG.exe
  C:\Windows\System\hZRxBaG.exe
  2⤵
  PID:9120
- C:\Windows\System\JQwCCBJ.exe
  C:\Windows\System\JQwCCBJ.exe
  2⤵
  PID:9144
- C:\Windows\System\TRgUFXv.exe
  C:\Windows\System\TRgUFXv.exe
  2⤵
  PID:9172
- C:\Windows\System\yFpwWZN.exe
  C:\Windows\System\yFpwWZN.exe
  2⤵
  PID:9192
- C:\Windows\System\WWLvOWT.exe
  C:\Windows\System\WWLvOWT.exe
  2⤵
  PID:9212
- C:\Windows\System\ceAYbto.exe
  C:\Windows\System\ceAYbto.exe
  2⤵
  PID:7956
- C:\Windows\System\LgJSyiZ.exe
  C:\Windows\System\LgJSyiZ.exe
  2⤵
  PID:7180
- C:\Windows\System\GoPjcMp.exe
  C:\Windows\System\GoPjcMp.exe
  2⤵
  PID:7240
- C:\Windows\System\sMxHpTK.exe
  C:\Windows\System\sMxHpTK.exe
  2⤵
  PID:6896
- C:\Windows\System\zNGzHQI.exe
  C:\Windows\System\zNGzHQI.exe
  2⤵
  PID:8180
- C:\Windows\System\NjQTWVN.exe
  C:\Windows\System\NjQTWVN.exe
  2⤵
  PID:7388
- C:\Windows\System\EzOaIkL.exe
  C:\Windows\System\EzOaIkL.exe
  2⤵
  PID:7360
- C:\Windows\System\YHFqZtX.exe
  C:\Windows\System\YHFqZtX.exe
  2⤵
  PID:7476
- C:\Windows\System\vnRhvHn.exe
  C:\Windows\System\vnRhvHn.exe
  2⤵
  PID:7564
- C:\Windows\System\ptbGAJZ.exe
  C:\Windows\System\ptbGAJZ.exe
  2⤵
  PID:1044
- C:\Windows\System\WSolYsI.exe
  C:\Windows\System\WSolYsI.exe
  2⤵
  PID:7668
- C:\Windows\System\xjVlfFT.exe
  C:\Windows\System\xjVlfFT.exe
  2⤵
  PID:7108
- C:\Windows\System\fATDcVw.exe
  C:\Windows\System\fATDcVw.exe
  2⤵
  PID:7004
- C:\Windows\System\cGBMYiZ.exe
  C:\Windows\System\cGBMYiZ.exe
  2⤵
  PID:7824
- C:\Windows\System\jGFUlhN.exe
  C:\Windows\System\jGFUlhN.exe
  2⤵
  PID:6020
- C:\Windows\System\drqQXTy.exe
  C:\Windows\System\drqQXTy.exe
  2⤵
  PID:6188
- C:\Windows\System\BycQUzv.exe
  C:\Windows\System\BycQUzv.exe
  2⤵
  PID:6324
- C:\Windows\System\FczsLat.exe
  C:\Windows\System\FczsLat.exe
  2⤵
  PID:8328
- C:\Windows\System\uTrIMGt.exe
  C:\Windows\System\uTrIMGt.exe
  2⤵
  PID:8356
- C:\Windows\System\wwsvvjH.exe
  C:\Windows\System\wwsvvjH.exe
  2⤵
  PID:6820
- C:\Windows\System\TsKZGWg.exe
  C:\Windows\System\TsKZGWg.exe
  2⤵
  PID:9224
- C:\Windows\System\cmfxVAB.exe
  C:\Windows\System\cmfxVAB.exe
  2⤵
  PID:9248
- C:\Windows\System\WywmCMb.exe
  C:\Windows\System\WywmCMb.exe
  2⤵
  PID:9272
- C:\Windows\System\HcBgMtd.exe
  C:\Windows\System\HcBgMtd.exe
  2⤵
  PID:9292
- C:\Windows\System\OjxMLaz.exe
  C:\Windows\System\OjxMLaz.exe
  2⤵
  PID:9312
- C:\Windows\System\VStsXVh.exe
  C:\Windows\System\VStsXVh.exe
  2⤵
  PID:9336
- C:\Windows\System\nemYqHH.exe
  C:\Windows\System\nemYqHH.exe
  2⤵
  PID:9360
- C:\Windows\System\MsFibnr.exe
  C:\Windows\System\MsFibnr.exe
  2⤵
  PID:9380
- C:\Windows\System\gbIneZv.exe
  C:\Windows\System\gbIneZv.exe
  2⤵
  PID:9400
- C:\Windows\System\GQemHCs.exe
  C:\Windows\System\GQemHCs.exe
  2⤵
  PID:9424
- C:\Windows\System\GPflcIC.exe
  C:\Windows\System\GPflcIC.exe
  2⤵
  PID:9448
- C:\Windows\System\EGXZwTQ.exe
  C:\Windows\System\EGXZwTQ.exe
  2⤵
  PID:9468
- C:\Windows\System\DZxplJz.exe
  C:\Windows\System\DZxplJz.exe
  2⤵
  PID:9488
- C:\Windows\System\hqsYxtS.exe
  C:\Windows\System\hqsYxtS.exe
  2⤵
  PID:9512
- C:\Windows\System\lRZbzig.exe
  C:\Windows\System\lRZbzig.exe
  2⤵
  PID:9540
- C:\Windows\System\ASYzPzE.exe
  C:\Windows\System\ASYzPzE.exe
  2⤵
  PID:9564
- C:\Windows\System\XNUDvAx.exe
  C:\Windows\System\XNUDvAx.exe
  2⤵
  PID:9588
- C:\Windows\System\iXSbkIP.exe
  C:\Windows\System\iXSbkIP.exe
  2⤵
  PID:9608
- C:\Windows\System\NaXjIII.exe
  C:\Windows\System\NaXjIII.exe
  2⤵
  PID:9632
- C:\Windows\System\twSkPcH.exe
  C:\Windows\System\twSkPcH.exe
  2⤵
  PID:9652
- C:\Windows\System\svkmChz.exe
  C:\Windows\System\svkmChz.exe
  2⤵
  PID:9676
- C:\Windows\System\yUDwJmA.exe
  C:\Windows\System\yUDwJmA.exe
  2⤵
  PID:9696
- C:\Windows\System\rrLxXin.exe
  C:\Windows\System\rrLxXin.exe
  2⤵
  PID:9720
- C:\Windows\System\juLTcRN.exe
  C:\Windows\System\juLTcRN.exe
  2⤵
  PID:9744
- C:\Windows\System\TVmfspP.exe
  C:\Windows\System\TVmfspP.exe
  2⤵
  PID:9760
- C:\Windows\System\wqxZvUc.exe
  C:\Windows\System\wqxZvUc.exe
  2⤵
  PID:9784
- C:\Windows\System\yGqIXJC.exe
  C:\Windows\System\yGqIXJC.exe
  2⤵
  PID:9804
- C:\Windows\System\bbITMwC.exe
  C:\Windows\System\bbITMwC.exe
  2⤵
  PID:9824
- C:\Windows\System\WfZisBq.exe
  C:\Windows\System\WfZisBq.exe
  2⤵
  PID:9844
- C:\Windows\System\JxrWMou.exe
  C:\Windows\System\JxrWMou.exe
  2⤵
  PID:9864
- C:\Windows\System\QgiSzeT.exe
  C:\Windows\System\QgiSzeT.exe
  2⤵
  PID:9888
- C:\Windows\System\RCQMKOU.exe
  C:\Windows\System\RCQMKOU.exe
  2⤵
  PID:9912
- C:\Windows\System\bpBwATo.exe
  C:\Windows\System\bpBwATo.exe
  2⤵
  PID:9928
- C:\Windows\System\MytUPDt.exe
  C:\Windows\System\MytUPDt.exe
  2⤵
  PID:9948
- C:\Windows\System\ABMoXLF.exe
  C:\Windows\System\ABMoXLF.exe
  2⤵
  PID:9972
- C:\Windows\System\nIzITjJ.exe
  C:\Windows\System\nIzITjJ.exe
  2⤵
  PID:9996
- C:\Windows\System\UWYFrXI.exe
  C:\Windows\System\UWYFrXI.exe
  2⤵
  PID:10020
- C:\Windows\System\COmRhqc.exe
  C:\Windows\System\COmRhqc.exe
  2⤵
  PID:10040
- C:\Windows\System\aKwrfkM.exe
  C:\Windows\System\aKwrfkM.exe
  2⤵
  PID:10064
- C:\Windows\System\iTKtvHk.exe
  C:\Windows\System\iTKtvHk.exe
  2⤵
  PID:10080
- C:\Windows\System\WcNpCxD.exe
  C:\Windows\System\WcNpCxD.exe
  2⤵
  PID:10104
- C:\Windows\System\moslHyb.exe
  C:\Windows\System\moslHyb.exe
  2⤵
  PID:10128
- C:\Windows\System\RFItDpi.exe
  C:\Windows\System\RFItDpi.exe
  2⤵
  PID:10152
- C:\Windows\System\LcbpTZQ.exe
  C:\Windows\System\LcbpTZQ.exe
  2⤵
  PID:10172
- C:\Windows\System\kskMSMr.exe
  C:\Windows\System\kskMSMr.exe
  2⤵
  PID:10192
- C:\Windows\System\JyjWaKJ.exe
  C:\Windows\System\JyjWaKJ.exe
  2⤵
  PID:10220
- C:\Windows\System\IRikPci.exe
  C:\Windows\System\IRikPci.exe
  2⤵
  PID:10236
- C:\Windows\System\UNqxBSx.exe
  C:\Windows\System\UNqxBSx.exe
  2⤵
  PID:7308
- C:\Windows\System\fCjcqMM.exe
  C:\Windows\System\fCjcqMM.exe
  2⤵
  PID:7404
- C:\Windows\System\cRsQYFE.exe
  C:\Windows\System\cRsQYFE.exe
  2⤵
  PID:6948
- C:\Windows\System\ozoumPN.exe
  C:\Windows\System\ozoumPN.exe
  2⤵
  PID:8676
- C:\Windows\System\WxrwnCw.exe
  C:\Windows\System\WxrwnCw.exe
  2⤵
  PID:8744
- C:\Windows\System\ziVaDNM.exe
  C:\Windows\System\ziVaDNM.exe
  2⤵
  PID:7072
- C:\Windows\System\HpbeMal.exe
  C:\Windows\System\HpbeMal.exe
  2⤵
  PID:8824
- C:\Windows\System\YrOjrmW.exe
  C:\Windows\System\YrOjrmW.exe
  2⤵
  PID:6516
- C:\Windows\System\yyVMiFM.exe
  C:\Windows\System\yyVMiFM.exe
  2⤵
  PID:7412
- C:\Windows\System\OaYppFC.exe
  C:\Windows\System\OaYppFC.exe
  2⤵
  PID:7848
- C:\Windows\System\nkorqWu.exe
  C:\Windows\System\nkorqWu.exe
  2⤵
  PID:7752
- C:\Windows\System\TDccfBO.exe
  C:\Windows\System\TDccfBO.exe
  2⤵
  PID:8212
- C:\Windows\System\PMrwRIl.exe
  C:\Windows\System\PMrwRIl.exe
  2⤵
  PID:7328
- C:\Windows\System\WAdqdIT.exe
  C:\Windows\System\WAdqdIT.exe
  2⤵
  PID:7028
- C:\Windows\System\cLmzgqm.exe
  C:\Windows\System\cLmzgqm.exe
  2⤵
  PID:8316
- C:\Windows\System\EQRDgfO.exe
  C:\Windows\System\EQRDgfO.exe
  2⤵
  PID:10248
- C:\Windows\System\MTZlkST.exe
  C:\Windows\System\MTZlkST.exe
  2⤵
  PID:10268
- C:\Windows\System\atiBZpf.exe
  C:\Windows\System\atiBZpf.exe
  2⤵
  PID:10296
- C:\Windows\System\umtGrdQ.exe
  C:\Windows\System\umtGrdQ.exe
  2⤵
  PID:10316
- C:\Windows\System\EkmjTEy.exe
  C:\Windows\System\EkmjTEy.exe
  2⤵
  PID:10344
- C:\Windows\System\neUtdiM.exe
  C:\Windows\System\neUtdiM.exe
  2⤵
  PID:10364
- C:\Windows\System\ecRaLFU.exe
  C:\Windows\System\ecRaLFU.exe
  2⤵
  PID:10388
- C:\Windows\System\uBleTth.exe
  C:\Windows\System\uBleTth.exe
  2⤵
  PID:10408
- C:\Windows\System\fXtwrYy.exe
  C:\Windows\System\fXtwrYy.exe
  2⤵
  PID:10432
- C:\Windows\System\LSelHgL.exe
  C:\Windows\System\LSelHgL.exe
  2⤵
  PID:10456
- C:\Windows\System\xAbebuQ.exe
  C:\Windows\System\xAbebuQ.exe
  2⤵
  PID:10488
- C:\Windows\System\MXqnxxI.exe
  C:\Windows\System\MXqnxxI.exe
  2⤵
  PID:10504
- C:\Windows\System\ZoEDqlx.exe
  C:\Windows\System\ZoEDqlx.exe
  2⤵
  PID:10536
- C:\Windows\System\SFnNisd.exe
  C:\Windows\System\SFnNisd.exe
  2⤵
  PID:10568
- C:\Windows\System\fcpGSKC.exe
  C:\Windows\System\fcpGSKC.exe
  2⤵
  PID:10588
- C:\Windows\System\rMRcpXi.exe
  C:\Windows\System\rMRcpXi.exe
  2⤵
  PID:10608
- C:\Windows\System\KyddCaL.exe
  C:\Windows\System\KyddCaL.exe
  2⤵
  PID:10636
- C:\Windows\System\DpnSoQa.exe
  C:\Windows\System\DpnSoQa.exe
  2⤵
  PID:10652
- C:\Windows\System\dcqAhHz.exe
  C:\Windows\System\dcqAhHz.exe
  2⤵
  PID:10672
- C:\Windows\System\eKlSoky.exe
  C:\Windows\System\eKlSoky.exe
  2⤵
  PID:10696
- C:\Windows\System\btBqRCq.exe
  C:\Windows\System\btBqRCq.exe
  2⤵
  PID:10716
- C:\Windows\System\lxFrNvG.exe
  C:\Windows\System\lxFrNvG.exe
  2⤵
  PID:10740
- C:\Windows\System\vElgxXS.exe
  C:\Windows\System\vElgxXS.exe
  2⤵
  PID:6364
- C:\Windows\System\RKYywSa.exe
  C:\Windows\System\RKYywSa.exe
  2⤵
  PID:9332
- C:\Windows\System\eOlusYt.exe
  C:\Windows\System\eOlusYt.exe
  2⤵
  PID:9356
- C:\Windows\System\agfQlQI.exe
  C:\Windows\System\agfQlQI.exe
  2⤵
  PID:9392
- C:\Windows\System\tbRyvjk.exe
  C:\Windows\System\tbRyvjk.exe
  2⤵
  PID:9484
- C:\Windows\System\ewOAhhD.exe
  C:\Windows\System\ewOAhhD.exe
  2⤵
  PID:8652
- C:\Windows\System\trrZlhv.exe
  C:\Windows\System\trrZlhv.exe
  2⤵
  PID:6380
- C:\Windows\System\lasxYwF.exe
  C:\Windows\System\lasxYwF.exe
  2⤵
  PID:8900
- C:\Windows\System\TvNyjgf.exe
  C:\Windows\System\TvNyjgf.exe
  2⤵
  PID:9896
- C:\Windows\System\zJcmdiO.exe
  C:\Windows\System\zJcmdiO.exe
  2⤵
  PID:9936
- C:\Windows\System\CjRhCTm.exe
  C:\Windows\System\CjRhCTm.exe
  2⤵
  PID:9032
- C:\Windows\System\tGjGZjU.exe
  C:\Windows\System\tGjGZjU.exe
  2⤵
  PID:10124
- C:\Windows\System\pcNHGkd.exe
  C:\Windows\System\pcNHGkd.exe
  2⤵
  PID:10208
- C:\Windows\System\PDvUXeU.exe
  C:\Windows\System\PDvUXeU.exe
  2⤵
  PID:8096
- C:\Windows\System\wDLUCHN.exe
  C:\Windows\System\wDLUCHN.exe
  2⤵
  PID:7372
- C:\Windows\System\HOYKsFW.exe
  C:\Windows\System\HOYKsFW.exe
  2⤵
  PID:8624
- C:\Windows\System\LXwDHzA.exe
  C:\Windows\System\LXwDHzA.exe
  2⤵
  PID:3644
- C:\Windows\System\dsShQdt.exe
  C:\Windows\System\dsShQdt.exe
  2⤵
  PID:7796
- C:\Windows\System\WpWlWrH.exe
  C:\Windows\System\WpWlWrH.exe
  2⤵
  PID:5440
- C:\Windows\System\TPALrPk.exe
  C:\Windows\System\TPALrPk.exe
  2⤵
  PID:9056
- C:\Windows\System\jyiJjZn.exe
  C:\Windows\System\jyiJjZn.exe
  2⤵
  PID:8248
- C:\Windows\System\jTKXYGx.exe
  C:\Windows\System\jTKXYGx.exe
  2⤵
  PID:10336
- C:\Windows\System\svvzZrx.exe
  C:\Windows\System\svvzZrx.exe
  2⤵
  PID:8412
- C:\Windows\System\RVSbLUu.exe
  C:\Windows\System\RVSbLUu.exe
  2⤵
  PID:10552
- C:\Windows\System\hFfYRDL.exe
  C:\Windows\System\hFfYRDL.exe
  2⤵
  PID:10616
- C:\Windows\System\edvznps.exe
  C:\Windows\System\edvznps.exe
  2⤵
  PID:8528
- C:\Windows\System\oxzJREn.exe
  C:\Windows\System\oxzJREn.exe
  2⤵
  PID:8700
- C:\Windows\System\TYbVbtv.exe
  C:\Windows\System\TYbVbtv.exe
  2⤵
  PID:9600
- C:\Windows\System\XwhLKyi.exe
  C:\Windows\System\XwhLKyi.exe
  2⤵
  PID:9668
- C:\Windows\System\tCOhSHc.exe
  C:\Windows\System\tCOhSHc.exe
  2⤵
  PID:8812
- C:\Windows\System\UpKhpxN.exe
  C:\Windows\System\UpKhpxN.exe
  2⤵
  PID:9732
- C:\Windows\System\ilvTIph.exe
  C:\Windows\System\ilvTIph.exe
  2⤵
  PID:6748
- C:\Windows\System\UDbLSMm.exe
  C:\Windows\System\UDbLSMm.exe
  2⤵
  PID:8928
- C:\Windows\System\cpQTZNn.exe
  C:\Windows\System\cpQTZNn.exe
  2⤵
  PID:9860
- C:\Windows\System\sQvhmud.exe
  C:\Windows\System\sQvhmud.exe
  2⤵
  PID:9964
- C:\Windows\System\XjScysE.exe
  C:\Windows\System\XjScysE.exe
  2⤵
  PID:10012
- C:\Windows\System\rRxFIIi.exe
  C:\Windows\System\rRxFIIi.exe
  2⤵
  PID:9052
- C:\Windows\System\YxyxwnI.exe
  C:\Windows\System\YxyxwnI.exe
  2⤵
  PID:10112
- C:\Windows\System\OqbiSXK.exe
  C:\Windows\System\OqbiSXK.exe
  2⤵
  PID:10188
- C:\Windows\System\fhbwDyc.exe
  C:\Windows\System\fhbwDyc.exe
  2⤵
  PID:9136
- C:\Windows\System\FUdjSCr.exe
  C:\Windows\System\FUdjSCr.exe
  2⤵
  PID:11288
- C:\Windows\System\OcicPxu.exe
  C:\Windows\System\OcicPxu.exe
  2⤵
  PID:11308
- C:\Windows\System\ZjKpDln.exe
  C:\Windows\System\ZjKpDln.exe
  2⤵
  PID:11348
- C:\Windows\System\InKsvwK.exe
  C:\Windows\System\InKsvwK.exe
  2⤵
  PID:11372
- C:\Windows\System\mDnWSWZ.exe
  C:\Windows\System\mDnWSWZ.exe
  2⤵
  PID:11388
- C:\Windows\System\zRSslTT.exe
  C:\Windows\System\zRSslTT.exe
  2⤵
  PID:11420
- C:\Windows\System\igheFnk.exe
  C:\Windows\System\igheFnk.exe
  2⤵
  PID:11444
- C:\Windows\System\OvKDuIg.exe
  C:\Windows\System\OvKDuIg.exe
  2⤵
  PID:11476
- C:\Windows\System\bYnEPGS.exe
  C:\Windows\System\bYnEPGS.exe
  2⤵
  PID:11496
- C:\Windows\System\XixmdXP.exe
  C:\Windows\System\XixmdXP.exe
  2⤵
  PID:11516
- C:\Windows\System\kcWRguO.exe
  C:\Windows\System\kcWRguO.exe
  2⤵
  PID:11544
- C:\Windows\System\CgZuewt.exe
  C:\Windows\System\CgZuewt.exe
  2⤵
  PID:11572
- C:\Windows\System\eePYKUf.exe
  C:\Windows\System\eePYKUf.exe
  2⤵
  PID:11588
- C:\Windows\System\PhGgKiM.exe
  C:\Windows\System\PhGgKiM.exe
  2⤵
  PID:11616
- C:\Windows\System\LdtvANo.exe
  C:\Windows\System\LdtvANo.exe
  2⤵
  PID:11636
- C:\Windows\System\RXhtEKU.exe
  C:\Windows\System\RXhtEKU.exe
  2⤵
  PID:11660
- C:\Windows\System\VbvEfkC.exe
  C:\Windows\System\VbvEfkC.exe
  2⤵
  PID:11684
- C:\Windows\System\AcODDAU.exe
  C:\Windows\System\AcODDAU.exe
  2⤵
  PID:11712
- C:\Windows\System\pGfywvu.exe
  C:\Windows\System\pGfywvu.exe
  2⤵
  PID:11732
- C:\Windows\System\WIqLmAk.exe
  C:\Windows\System\WIqLmAk.exe
  2⤵
  PID:11760
- C:\Windows\System\qcYCNBa.exe
  C:\Windows\System\qcYCNBa.exe
  2⤵
  PID:11788
- C:\Windows\System\YRyRIwK.exe
  C:\Windows\System\YRyRIwK.exe
  2⤵
  PID:11808
- C:\Windows\System\ZpLzTYQ.exe
  C:\Windows\System\ZpLzTYQ.exe
  2⤵
  PID:11828
- C:\Windows\System\YJWVCGl.exe
  C:\Windows\System\YJWVCGl.exe
  2⤵
  PID:11848
- C:\Windows\System\CVRRYrm.exe
  C:\Windows\System\CVRRYrm.exe
  2⤵
  PID:11876
- C:\Windows\System\ExZvkly.exe
  C:\Windows\System\ExZvkly.exe
  2⤵
  PID:11892
- C:\Windows\System\bsFuVKQ.exe
  C:\Windows\System\bsFuVKQ.exe
  2⤵
  PID:11916
- C:\Windows\System\JjhMwHJ.exe
  C:\Windows\System\JjhMwHJ.exe
  2⤵
  PID:11936
- C:\Windows\System\mLVvTsU.exe
  C:\Windows\System\mLVvTsU.exe
  2⤵
  PID:11952
- C:\Windows\System\SFRCDeb.exe
  C:\Windows\System\SFRCDeb.exe
  2⤵
  PID:11968
- C:\Windows\System\ZCoMyBq.exe
  C:\Windows\System\ZCoMyBq.exe
  2⤵
  PID:11988
- C:\Windows\System\OEIHYoN.exe
  C:\Windows\System\OEIHYoN.exe
  2⤵
  PID:12004
- C:\Windows\System\DFsyiJA.exe
  C:\Windows\System\DFsyiJA.exe
  2⤵
  PID:12024
- C:\Windows\System\ZDewNXh.exe
  C:\Windows\System\ZDewNXh.exe
  2⤵
  PID:12040
- C:\Windows\System\pijnOlJ.exe
  C:\Windows\System\pijnOlJ.exe
  2⤵
  PID:12056
- C:\Windows\System\lOXLVDG.exe
  C:\Windows\System\lOXLVDG.exe
  2⤵
  PID:12072
- C:\Windows\System\SRHoiRI.exe
  C:\Windows\System\SRHoiRI.exe
  2⤵
  PID:12088
- C:\Windows\System\MwjfWjr.exe
  C:\Windows\System\MwjfWjr.exe
  2⤵
  PID:12104
- C:\Windows\System\XhGCLtc.exe
  C:\Windows\System\XhGCLtc.exe
  2⤵
  PID:12120
- C:\Windows\System\kHvoQfs.exe
  C:\Windows\System\kHvoQfs.exe
  2⤵
  PID:12144
- C:\Windows\System\XbwlvIf.exe
  C:\Windows\System\XbwlvIf.exe
  2⤵
  PID:12164
- C:\Windows\System\EruklPc.exe
  C:\Windows\System\EruklPc.exe
  2⤵
  PID:12184
- C:\Windows\System\JLHsBks.exe
  C:\Windows\System\JLHsBks.exe
  2⤵
  PID:12208
- C:\Windows\System\sIfvgff.exe
  C:\Windows\System\sIfvgff.exe
  2⤵
  PID:12232
- C:\Windows\System\blETqbl.exe
  C:\Windows\System\blETqbl.exe
  2⤵
  PID:12256
- C:\Windows\System\sgmQdLn.exe
  C:\Windows\System\sgmQdLn.exe
  2⤵
  PID:12276
- C:\Windows\System\aBLMExO.exe
  C:\Windows\System\aBLMExO.exe
  2⤵
  PID:7260
- C:\Windows\System\hlgJWll.exe
  C:\Windows\System\hlgJWll.exe
  2⤵
  PID:7908
- C:\Windows\System\AOVgEIj.exe
  C:\Windows\System\AOVgEIj.exe
  2⤵
  PID:11152
- C:\Windows\System\zanPGUC.exe
  C:\Windows\System\zanPGUC.exe
  2⤵
  PID:5408
- C:\Windows\System\eZnLsWY.exe
  C:\Windows\System\eZnLsWY.exe
  2⤵
  PID:8376
- C:\Windows\System\JoJrSaU.exe
  C:\Windows\System\JoJrSaU.exe
  2⤵
  PID:9264
- C:\Windows\System\KyLhsEz.exe
  C:\Windows\System\KyLhsEz.exe
  2⤵
  PID:9320
- C:\Windows\System\PCeanml.exe
  C:\Windows\System\PCeanml.exe
  2⤵
  PID:10624
- C:\Windows\System\rXppCPg.exe
  C:\Windows\System\rXppCPg.exe
  2⤵
  PID:9416
- C:\Windows\System\LBKqSZP.exe
  C:\Windows\System\LBKqSZP.exe
  2⤵
  PID:10748
- C:\Windows\System\LrQgxok.exe
  C:\Windows\System\LrQgxok.exe
  2⤵
  PID:12308
- C:\Windows\System\AOlWsop.exe
  C:\Windows\System\AOlWsop.exe
  2⤵
  PID:12336
- C:\Windows\System\KjuMkrs.exe
  C:\Windows\System\KjuMkrs.exe
  2⤵
  PID:12360
- C:\Windows\System\AEQvgCH.exe
  C:\Windows\System\AEQvgCH.exe
  2⤵
  PID:12380
- C:\Windows\System\phMXJTi.exe
  C:\Windows\System\phMXJTi.exe
  2⤵
  PID:12400
- C:\Windows\System\fCaUuWe.exe
  C:\Windows\System\fCaUuWe.exe
  2⤵
  PID:12436
- C:\Windows\System\FVbLXAc.exe
  C:\Windows\System\FVbLXAc.exe
  2⤵
  PID:12456
- C:\Windows\System\QZCoYGk.exe
  C:\Windows\System\QZCoYGk.exe
  2⤵
  PID:12480
- C:\Windows\System\RlXpOZR.exe
  C:\Windows\System\RlXpOZR.exe
  2⤵
  PID:12500
- C:\Windows\System\weifvLU.exe
  C:\Windows\System\weifvLU.exe
  2⤵
  PID:12524
- C:\Windows\System\vxdTKAx.exe
  C:\Windows\System\vxdTKAx.exe
  2⤵
  PID:12552
- C:\Windows\System\MAomAWP.exe
  C:\Windows\System\MAomAWP.exe
  2⤵
  PID:12572
- C:\Windows\System\FCNSBjy.exe
  C:\Windows\System\FCNSBjy.exe
  2⤵
  PID:12604
- C:\Windows\System\UrRtiyy.exe
  C:\Windows\System\UrRtiyy.exe
  2⤵
  PID:12636
- C:\Windows\System\HtlDUBA.exe
  C:\Windows\System\HtlDUBA.exe
  2⤵
  PID:12656
- C:\Windows\System\dIGtSrg.exe
  C:\Windows\System\dIGtSrg.exe
  2⤵
  PID:12676
- C:\Windows\System\WXwCTTo.exe
  C:\Windows\System\WXwCTTo.exe
  2⤵
  PID:12696
- C:\Windows\System\LLdUEIo.exe
  C:\Windows\System\LLdUEIo.exe
  2⤵
  PID:12716
- C:\Windows\System\zfmqABH.exe
  C:\Windows\System\zfmqABH.exe
  2⤵
  PID:12740
- C:\Windows\System\pwzRWjt.exe
  C:\Windows\System\pwzRWjt.exe
  2⤵
  PID:12764
- C:\Windows\System\niPHqQF.exe
  C:\Windows\System\niPHqQF.exe
  2⤵
  PID:12796
- C:\Windows\System\EfYiiPE.exe
  C:\Windows\System\EfYiiPE.exe
  2⤵
  PID:12816
- C:\Windows\System\BsLhBgx.exe
  C:\Windows\System\BsLhBgx.exe
  2⤵
  PID:12844
- C:\Windows\System\ZpvlJqH.exe
  C:\Windows\System\ZpvlJqH.exe
  2⤵
  PID:12860
- C:\Windows\System\xhkWPPq.exe
  C:\Windows\System\xhkWPPq.exe
  2⤵
  PID:12884
- C:\Windows\System\NBVHXZp.exe
  C:\Windows\System\NBVHXZp.exe
  2⤵
  PID:12908
- C:\Windows\System\SFcPrxe.exe
  C:\Windows\System\SFcPrxe.exe
  2⤵
  PID:12932
- C:\Windows\System\AQSqHjw.exe
  C:\Windows\System\AQSqHjw.exe
  2⤵
  PID:12948
- C:\Windows\System\nCyvKXV.exe
  C:\Windows\System\nCyvKXV.exe
  2⤵
  PID:12968
- C:\Windows\System\TXylfWb.exe
  C:\Windows\System\TXylfWb.exe
  2⤵
  PID:12992
- C:\Windows\System\ynezrhw.exe
  C:\Windows\System\ynezrhw.exe
  2⤵
  PID:13012
- C:\Windows\System\UArgXaa.exe
  C:\Windows\System\UArgXaa.exe
  2⤵
  PID:13040
- C:\Windows\System\EFMWDMW.exe
  C:\Windows\System\EFMWDMW.exe
  2⤵
  PID:13060
- C:\Windows\System\ydyKWvo.exe
  C:\Windows\System\ydyKWvo.exe
  2⤵
  PID:13080
- C:\Windows\System\FmzDdWs.exe
  C:\Windows\System\FmzDdWs.exe
  2⤵
  PID:13104
- C:\Windows\System\AifltlW.exe
  C:\Windows\System\AifltlW.exe
  2⤵
  PID:13132
- C:\Windows\System\kAZGIMH.exe
  C:\Windows\System\kAZGIMH.exe
  2⤵
  PID:13152
- C:\Windows\System\DNiddNg.exe
  C:\Windows\System\DNiddNg.exe
  2⤵
  PID:13176
- C:\Windows\System\HuLqwsE.exe
  C:\Windows\System\HuLqwsE.exe
  2⤵
  PID:13196
- C:\Windows\System\gaplfSZ.exe
  C:\Windows\System\gaplfSZ.exe
  2⤵
  PID:13220
- C:\Windows\System\MbZycOG.exe
  C:\Windows\System\MbZycOG.exe
  2⤵
  PID:13240
- C:\Windows\System\PBFsufD.exe
  C:\Windows\System\PBFsufD.exe
  2⤵
  PID:13264
- C:\Windows\System\KIgOltt.exe
  C:\Windows\System\KIgOltt.exe
  2⤵
  PID:13284
- C:\Windows\System\QkzhWma.exe
  C:\Windows\System\QkzhWma.exe
  2⤵
  PID:13300
- C:\Windows\System\zWhrzyn.exe
  C:\Windows\System\zWhrzyn.exe
  2⤵
  PID:9552
- C:\Windows\System\zjRCWRv.exe
  C:\Windows\System\zjRCWRv.exe
  2⤵
  PID:9604
- C:\Windows\System\iUampvS.exe
  C:\Windows\System\iUampvS.exe
  2⤵
  PID:10784
- C:\Windows\System\eKpRwXb.exe
  C:\Windows\System\eKpRwXb.exe
  2⤵
  PID:9648
- C:\Windows\System\VhKTTWM.exe
  C:\Windows\System\VhKTTWM.exe
  2⤵
  PID:8716
- C:\Windows\System\CDjiXoG.exe
  C:\Windows\System\CDjiXoG.exe
  2⤵
  PID:8828
- C:\Windows\System\gwaPPyR.exe
  C:\Windows\System\gwaPPyR.exe
  2⤵
  PID:9756
- C:\Windows\System\BvWprxJ.exe
  C:\Windows\System\BvWprxJ.exe
  2⤵
  PID:9780
- C:\Windows\System\olzwjxK.exe
  C:\Windows\System\olzwjxK.exe
  2⤵
  PID:9796
- C:\Windows\System\sROSZqq.exe
  C:\Windows\System\sROSZqq.exe
  2⤵
  PID:8940
- C:\Windows\System\JtpxynZ.exe
  C:\Windows\System\JtpxynZ.exe
  2⤵
  PID:7096
- C:\Windows\System\mZXrwnz.exe
  C:\Windows\System\mZXrwnz.exe
  2⤵
  PID:7540
- C:\Windows\System\IKQzKhL.exe
  C:\Windows\System\IKQzKhL.exe
  2⤵
  PID:11176
- C:\Windows\System\lDaSifr.exe
  C:\Windows\System\lDaSifr.exe
  2⤵
  PID:8064
- C:\Windows\System\piVKyIJ.exe
  C:\Windows\System\piVKyIJ.exe
  2⤵
  PID:12464
- C:\Windows\System\PGsrKXS.exe
  C:\Windows\System\PGsrKXS.exe
  2⤵
  PID:8636
- C:\Windows\System\cjCOlPT.exe
  C:\Windows\System\cjCOlPT.exe
  2⤵
  PID:9000
- C:\Windows\System\bmVUPsR.exe
  C:\Windows\System\bmVUPsR.exe
  2⤵
  PID:12616
- C:\Windows\System\GgrZaam.exe
  C:\Windows\System\GgrZaam.exe
  2⤵
  PID:8088
- C:\Windows\System\hRGGAeS.exe
  C:\Windows\System\hRGGAeS.exe
  2⤵
  PID:9688
- C:\Windows\System\MOLzutJ.exe
  C:\Windows\System\MOLzutJ.exe
  2⤵
  PID:9752
- C:\Windows\System\cVTQKNT.exe
  C:\Windows\System\cVTQKNT.exe
  2⤵
  PID:11360
- C:\Windows\System\FVSwgEC.exe
  C:\Windows\System\FVSwgEC.exe
  2⤵
  PID:11428
- C:\Windows\System\uoQTMdG.exe
  C:\Windows\System\uoQTMdG.exe
  2⤵
  PID:11584
- C:\Windows\System\KaWDpma.exe
  C:\Windows\System\KaWDpma.exe
  2⤵
  PID:12136
- C:\Windows\System\QtaDyJg.exe
  C:\Windows\System\QtaDyJg.exe
  2⤵
  PID:11692
- C:\Windows\System\mDRaUVd.exe
  C:\Windows\System\mDRaUVd.exe
  2⤵
  PID:10736
- C:\Windows\System\zyRRVwJ.exe
  C:\Windows\System\zyRRVwJ.exe
  2⤵
  PID:13144
- C:\Windows\System\AfHJQUC.exe
  C:\Windows\System\AfHJQUC.exe
  2⤵
  PID:1516
- C:\Windows\System\VTCOzKe.exe
  C:\Windows\System\VTCOzKe.exe
  2⤵
  PID:920
- C:\Windows\System\NsQWCLz.exe
  C:\Windows\System\NsQWCLz.exe
  2⤵
  PID:2160
- C:\Windows\System\YhPgHqH.exe
  C:\Windows\System\YhPgHqH.exe
  2⤵
  PID:4784
- C:\Windows\System\OlCHoAT.exe
  C:\Windows\System\OlCHoAT.exe
  2⤵
  PID:13252
- C:\Windows\System\okdaeLV.exe
  C:\Windows\System\okdaeLV.exe
  2⤵
  PID:8000
- C:\Windows\System\xRMEwCn.exe
  C:\Windows\System\xRMEwCn.exe
  2⤵
  PID:8588
- C:\Windows\System\AqMHuSj.exe
  C:\Windows\System\AqMHuSj.exe
  2⤵
  PID:10232
- C:\Windows\System\SqUlwtg.exe
  C:\Windows\System\SqUlwtg.exe
  2⤵
  PID:10396
- C:\Windows\System\yGTevBI.exe
  C:\Windows\System\yGTevBI.exe
  2⤵
  PID:7264
- C:\Windows\System\hCmyOAc.exe
  C:\Windows\System\hCmyOAc.exe
  2⤵
  PID:11336
- C:\Windows\System\woVBPmF.exe
  C:\Windows\System\woVBPmF.exe
  2⤵
  PID:11700
- C:\Windows\System\fmSIqhT.exe
  C:\Windows\System\fmSIqhT.exe
  2⤵
  PID:1876
- C:\Windows\System\yEOlNnf.exe
  C:\Windows\System\yEOlNnf.exe
  2⤵
  PID:11868
- C:\Windows\System\cnPMnxv.exe
  C:\Windows\System\cnPMnxv.exe
  2⤵
  PID:11532
- C:\Windows\System\MxFXfKF.exe
  C:\Windows\System\MxFXfKF.exe
  2⤵
  PID:9180
- C:\Windows\System\KVbWNOp.exe
  C:\Windows\System\KVbWNOp.exe
  2⤵
  PID:7864
- C:\Windows\System\sKpXIvv.exe
  C:\Windows\System\sKpXIvv.exe
  2⤵
  PID:11188
- C:\Windows\System\wFvQYCY.exe
  C:\Windows\System\wFvQYCY.exe
  2⤵
  PID:10912
- C:\Windows\System\GavZykH.exe
  C:\Windows\System\GavZykH.exe
  2⤵
  PID:3500
- C:\Windows\System\IefStqh.exe
  C:\Windows\System\IefStqh.exe
  2⤵
  PID:8856
- C:\Windows\System\VlEPSVK.exe
  C:\Windows\System\VlEPSVK.exe
  2⤵
  PID:9204
- C:\Windows\System\gDxwmjH.exe
  C:\Windows\System\gDxwmjH.exe
  2⤵
  PID:3724
- C:\Windows\System\SpGUGWR.exe
  C:\Windows\System\SpGUGWR.exe
  2⤵
  PID:13020
- C:\Windows\System\rkPlUsq.exe
  C:\Windows\System\rkPlUsq.exe
  2⤵
  PID:9988
- C:\Windows\System\xUqqGrb.exe
  C:\Windows\System\xUqqGrb.exe
  2⤵
  PID:9956
- C:\Windows\System\DFsXyoJ.exe
  C:\Windows\System\DFsXyoJ.exe
  2⤵
  PID:13320
- C:\Windows\System\ypzkLkF.exe
  C:\Windows\System\ypzkLkF.exe
  2⤵
  PID:13464
- C:\Windows\System\usDTygs.exe
  C:\Windows\System\usDTygs.exe
  2⤵
  PID:13520
- C:\Windows\System\GTYqUdp.exe
  C:\Windows\System\GTYqUdp.exe
  2⤵
  PID:13564
- C:\Windows\System\MaxUNKC.exe
  C:\Windows\System\MaxUNKC.exe
  2⤵
  PID:13588
- C:\Windows\System\mItyHyG.exe
  C:\Windows\System\mItyHyG.exe
  2⤵
  PID:13844
- C:\Windows\System\DbzxzPr.exe
  C:\Windows\System\DbzxzPr.exe
  2⤵
  PID:13860
- C:\Windows\System\HgpBLlp.exe
  C:\Windows\System\HgpBLlp.exe
  2⤵
  PID:13904
- C:\Windows\System\njedJyI.exe
  C:\Windows\System\njedJyI.exe
  2⤵
  PID:13924
- C:\Windows\System\BWRtmCe.exe
  C:\Windows\System\BWRtmCe.exe
  2⤵
  PID:14116
- C:\Windows\System\ehhGCKW.exe
  C:\Windows\System\ehhGCKW.exe
  2⤵
  PID:14276
- C:\Windows\System\IqQqiTD.exe
  C:\Windows\System\IqQqiTD.exe
  2⤵
  PID:10276
- C:\Windows\System\CZMoqJx.exe
  C:\Windows\System\CZMoqJx.exe
  2⤵
  PID:13460
- C:\Windows\System\dpmsxAv.exe
  C:\Windows\System\dpmsxAv.exe
  2⤵
  PID:13352
- C:\Windows\System\GmTobNK.exe
  C:\Windows\System\GmTobNK.exe
  2⤵
  PID:13404
- C:\Windows\System\BMsLKMI.exe
  C:\Windows\System\BMsLKMI.exe
  2⤵
  PID:13664
- C:\Windows\System\rFnlHqF.exe
  C:\Windows\System\rFnlHqF.exe
  2⤵
  PID:13428
- C:\Windows\System\GFHWZJr.exe
  C:\Windows\System\GFHWZJr.exe
  2⤵
  PID:12176
- C:\Windows\System\swdYebS.exe
  C:\Windows\System\swdYebS.exe
  2⤵
  PID:13684
- C:\Windows\System\wCubvUv.exe
  C:\Windows\System\wCubvUv.exe
  2⤵
  PID:14072
- C:\Windows\System\DqFdlgV.exe
  C:\Windows\System\DqFdlgV.exe
  2⤵
  PID:14128
- C:\Windows\System\ApRqqKP.exe
  C:\Windows\System\ApRqqKP.exe
  2⤵
  PID:8272
- C:\Windows\System\SPeZpQs.exe
  C:\Windows\System\SPeZpQs.exe
  2⤵
  PID:10648
- C:\Windows\System\KyVFheT.exe
  C:\Windows\System\KyVFheT.exe
  2⤵
  PID:14228
- C:\Windows\System\fDdoNqT.exe
  C:\Windows\System\fDdoNqT.exe
  2⤵
  PID:13328
- C:\Windows\System\CVsgokg.exe
  C:\Windows\System\CVsgokg.exe
  2⤵
  PID:13372
- C:\Windows\System\EVMqnVV.exe
  C:\Windows\System\EVMqnVV.exe
  2⤵
  PID:12016
- C:\Windows\System\GJwuehl.exe
  C:\Windows\System\GJwuehl.exe
  2⤵
  PID:1156
- C:\Windows\System\zhrzfoG.exe
  C:\Windows\System\zhrzfoG.exe
  2⤵
  PID:14252
- C:\Windows\System\aDVHsBr.exe
  C:\Windows\System\aDVHsBr.exe
  2⤵
  PID:13584
- C:\Windows\System\FHsQgOW.exe
  C:\Windows\System\FHsQgOW.exe
  2⤵
  PID:13644
- C:\Windows\System\hQymiOy.exe
  C:\Windows\System\hQymiOy.exe
  2⤵
  PID:13356
- C:\Windows\System\MWptMlT.exe
  C:\Windows\System\MWptMlT.exe
  2⤵
  PID:13616
- C:\Windows\System\bPwDgSk.exe
  C:\Windows\System\bPwDgSk.exe
  2⤵
  PID:9240
- C:\Windows\System\zOkauyX.exe
  C:\Windows\System\zOkauyX.exe
  2⤵
  PID:12708
- C:\Windows\System\ZpSRSKG.exe
  C:\Windows\System\ZpSRSKG.exe
  2⤵
  PID:13672
- C:\Windows\System\ueIgFhK.exe
  C:\Windows\System\ueIgFhK.exe
  2⤵
  PID:13212
- C:\Windows\System\FFVTTiq.exe
  C:\Windows\System\FFVTTiq.exe
  2⤵
  PID:13488
- C:\Windows\System\prXjCxA.exe
  C:\Windows\System\prXjCxA.exe
  2⤵
  PID:13768
- C:\Windows\System\anOTjRd.exe
  C:\Windows\System\anOTjRd.exe
  2⤵
  PID:13500
- C:\Windows\System\mTAQGUD.exe
  C:\Windows\System\mTAQGUD.exe
  2⤵
  PID:1604
- C:\Windows\System\eSDxKwP.exe
  C:\Windows\System\eSDxKwP.exe
  2⤵
  PID:14008
- C:\Windows\System\diXENyj.exe
  C:\Windows\System\diXENyj.exe
  2⤵
  PID:14080
- C:\Windows\System\WJCvIur.exe
  C:\Windows\System\WJCvIur.exe
  2⤵
  PID:14088
- C:\Windows\System\LhqKMcF.exe
  C:\Windows\System\LhqKMcF.exe
  2⤵
  PID:13972
- C:\Windows\System\UNitUgO.exe
  C:\Windows\System\UNitUgO.exe
  2⤵
  PID:14028
- C:\Windows\System\RejUiIH.exe
  C:\Windows\System\RejUiIH.exe
  2⤵
  PID:14052
- C:\Windows\System\iMZAAcw.exe
  C:\Windows\System\iMZAAcw.exe
  2⤵
  PID:14220
- C:\Windows\System\zNCjNND.exe
  C:\Windows\System\zNCjNND.exe
  2⤵
  PID:14316
- C:\Windows\System\RPWiRQH.exe
  C:\Windows\System\RPWiRQH.exe
  2⤵
  PID:12160
- C:\Windows\System\eEZQZir.exe
  C:\Windows\System\eEZQZir.exe
  2⤵
  PID:13836
- C:\Windows\System\HMpIWMK.exe
  C:\Windows\System\HMpIWMK.exe
  2⤵
  PID:4548
- C:\Windows\System\dxkIqQr.exe
  C:\Windows\System\dxkIqQr.exe
  2⤵
  PID:5744
- C:\Windows\System\ZZuzubQ.exe
  C:\Windows\System\ZZuzubQ.exe
  2⤵
  PID:11564
- C:\Windows\System\NCfZgOK.exe
  C:\Windows\System\NCfZgOK.exe
  2⤵
  PID:5804
- C:\Windows\System\OfRZoHt.exe
  C:\Windows\System\OfRZoHt.exe
  2⤵
  PID:3876
- C:\Windows\System\lJzaLAg.exe
  C:\Windows\System\lJzaLAg.exe
  2⤵
  PID:9396
- C:\Windows\System\wbfvCnv.exe
  C:\Windows\System\wbfvCnv.exe
  2⤵
  PID:13276
- C:\Windows\System\sKauTsu.exe
  C:\Windows\System\sKauTsu.exe
  2⤵
  PID:860
- C:\Windows\System\xHnhDHa.exe
  C:\Windows\System\xHnhDHa.exe
  2⤵
  PID:12252
- C:\Windows\System\mDunbxX.exe
  C:\Windows\System\mDunbxX.exe
  2⤵
  PID:1928
- C:\Windows\System\CqjQshq.exe
  C:\Windows\System\CqjQshq.exe
  2⤵
  PID:10604
- C:\Windows\System\OBSNYlk.exe
  C:\Windows\System\OBSNYlk.exe
  2⤵
  PID:4172
- C:\Windows\System\mWaDzUU.exe
  C:\Windows\System\mWaDzUU.exe
  2⤵
  PID:13628
- C:\Windows\System\yPuAXbP.exe
  C:\Windows\System\yPuAXbP.exe
  2⤵
  PID:12536
- C:\Windows\System\skNGFvI.exe
  C:\Windows\System\skNGFvI.exe
  2⤵
  PID:10424
- C:\Windows\System\bUOngjy.exe
  C:\Windows\System\bUOngjy.exe
  2⤵
  PID:3396
- C:\Windows\System\XRGdDVg.exe
  C:\Windows\System\XRGdDVg.exe
  2⤵
  PID:3432
- C:\Windows\System\ikdHduL.exe
  C:\Windows\System\ikdHduL.exe
  2⤵
  PID:10088
- C:\Windows\System\WBwZFSD.exe
  C:\Windows\System\WBwZFSD.exe
  2⤵
  PID:13604
- C:\Windows\System\laMRyBK.exe
  C:\Windows\System\laMRyBK.exe
  2⤵
  PID:13552
- C:\Windows\System\zZYEQmq.exe
  C:\Windows\System\zZYEQmq.exe
  2⤵
  PID:13872
- C:\Windows\System\FkIVqqp.exe
  C:\Windows\System\FkIVqqp.exe
  2⤵
  PID:2892
- C:\Windows\System\UGiJUXF.exe
  C:\Windows\System\UGiJUXF.exe
  2⤵
  PID:4664
- C:\Windows\System\mnOjwhe.exe
  C:\Windows\System\mnOjwhe.exe
  2⤵
  PID:14168
- C:\Windows\System\okhVIMf.exe
  C:\Windows\System\okhVIMf.exe
  2⤵
  PID:2896
- C:\Windows\System\XJLkODI.exe
  C:\Windows\System\XJLkODI.exe
  2⤵
  PID:1600
- C:\Windows\System\nUUnJZF.exe
  C:\Windows\System\nUUnJZF.exe
  2⤵
  PID:5872
- C:\Windows\System\PdqJBdv.exe
  C:\Windows\System\PdqJBdv.exe
  2⤵
  PID:9980
- C:\Windows\System\hMCcDjT.exe
  C:\Windows\System\hMCcDjT.exe
  2⤵
  PID:14284
- C:\Windows\System\sdpSkoz.exe
  C:\Windows\System\sdpSkoz.exe
  2⤵
  PID:5876
- C:\Windows\System\LNjsort.exe
  C:\Windows\System\LNjsort.exe
  2⤵
  PID:1920
- C:\Windows\System\rKozLIo.exe
  C:\Windows\System\rKozLIo.exe
  2⤵
  PID:13936
- C:\Windows\System\cyNyeSA.exe
  C:\Windows\System\cyNyeSA.exe
  2⤵
  PID:12980
- C:\Windows\System\FttyiBC.exe
  C:\Windows\System\FttyiBC.exe
  2⤵
  PID:1868
- C:\Windows\System\oCpSLYC.exe
  C:\Windows\System\oCpSLYC.exe
  2⤵
  PID:13624
- C:\Windows\System\GdJKhPc.exe
  C:\Windows\System\GdJKhPc.exe
  2⤵
  PID:12468
- C:\Windows\System\CAAqtca.exe
  C:\Windows\System\CAAqtca.exe
  2⤵
  PID:3408
- C:\Windows\System\LnTniwB.exe
  C:\Windows\System\LnTniwB.exe
  2⤵
  PID:13472
- C:\Windows\System\HLsjfoA.exe
  C:\Windows\System\HLsjfoA.exe
  2⤵
  PID:13492
- C:\Windows\System\qSzsdvE.exe
  C:\Windows\System\qSzsdvE.exe
  2⤵
  PID:2508
- C:\Windows\System\Pwrfgza.exe
  C:\Windows\System\Pwrfgza.exe
  2⤵
  PID:13636
- C:\Windows\System\YMTpbCH.exe
  C:\Windows\System\YMTpbCH.exe
  2⤵
  PID:5044
- C:\Windows\System\XDviOaF.exe
  C:\Windows\System\XDviOaF.exe
  2⤵
  PID:592
- C:\Windows\System\RhjceWc.exe
  C:\Windows\System\RhjceWc.exe
  2⤵
  PID:2440
- C:\Windows\System\jhcFyqs.exe
  C:\Windows\System\jhcFyqs.exe
  2⤵
  PID:2124
- C:\Windows\System\wCPadyK.exe
  C:\Windows\System\wCPadyK.exe
  2⤵
  PID:14248
- C:\Windows\System\NREEtZJ.exe
  C:\Windows\System\NREEtZJ.exe
  2⤵
  PID:13884
- C:\Windows\System\xkzLGTR.exe
  C:\Windows\System\xkzLGTR.exe
  2⤵
  PID:12988
- C:\Windows\System\QccqdXg.exe
  C:\Windows\System\QccqdXg.exe
  2⤵
  PID:5092
- C:\Windows\System\HfuFVyU.exe
  C:\Windows\System\HfuFVyU.exe
  2⤵
  PID:1000
- C:\Windows\System\ZgEkkSg.exe
  C:\Windows\System\ZgEkkSg.exe
  2⤵
  PID:1896
- C:\Windows\System\GZjggGS.exe
  C:\Windows\System\GZjggGS.exe
  2⤵
  PID:4944
- C:\Windows\System\VLdOKcW.exe
  C:\Windows\System\VLdOKcW.exe
  2⤵
  PID:3308
- C:\Windows\System\eGawjAY.exe
  C:\Windows\System\eGawjAY.exe
  2⤵
  PID:4068
- C:\Windows\System\ytrwiAF.exe
  C:\Windows\System\ytrwiAF.exe
  2⤵
  PID:5888
- C:\Windows\System\vqtlOVw.exe
  C:\Windows\System\vqtlOVw.exe
  2⤵
  PID:3988
- C:\Windows\System\rgTamwz.exe
  C:\Windows\System\rgTamwz.exe
  2⤵
  PID:5376
- C:\Windows\System\LOLyagt.exe
  C:\Windows\System\LOLyagt.exe
  2⤵
  PID:14324
- C:\Windows\System\soWrSTl.exe
  C:\Windows\System\soWrSTl.exe
  2⤵
  PID:13560
- C:\Windows\System\DAIwFOC.exe
  C:\Windows\System\DAIwFOC.exe
  2⤵
  PID:5128
- C:\Windows\System\mNxMewA.exe
  C:\Windows\System\mNxMewA.exe
  2⤵
  PID:2260
- C:\Windows\System\VHSElKG.exe
  C:\Windows\System\VHSElKG.exe
  2⤵
  PID:5736
- C:\Windows\System\yYWGmiS.exe
  C:\Windows\System\yYWGmiS.exe
  2⤵
  PID:13920
- C:\Windows\System\LsksYTg.exe
  C:\Windows\System\LsksYTg.exe
  2⤵
  PID:5544
- C:\Windows\System\WwyoCiI.exe
  C:\Windows\System\WwyoCiI.exe
  2⤵
  PID:4468
- C:\Windows\System\lKyiMEJ.exe
  C:\Windows\System\lKyiMEJ.exe
  2⤵
  PID:4676
- C:\Windows\System\GSZOkoI.exe
  C:\Windows\System\GSZOkoI.exe
  2⤵
  PID:14024
- C:\Windows\System\CwwSebK.exe
  C:\Windows\System\CwwSebK.exe
  2⤵
  PID:13004
- C:\Windows\System\tRuiRDx.exe
  C:\Windows\System\tRuiRDx.exe
  2⤵
  PID:1284
- C:\Windows\System\voXGwLM.exe
  C:\Windows\System\voXGwLM.exe
  2⤵
  PID:780
- C:\Windows\System\vrDKqZA.exe
  C:\Windows\System\vrDKqZA.exe
  2⤵
  PID:5856
- C:\Windows\System\KGqgjJl.exe
  C:\Windows\System\KGqgjJl.exe
  2⤵
  PID:5180
- C:\Windows\System\EcCakvE.exe
  C:\Windows\System\EcCakvE.exe
  2⤵
  PID:5720
- C:\Windows\System\rNehQbg.exe
  C:\Windows\System\rNehQbg.exe
  2⤵
  PID:5780
- C:\Windows\System\vxHZAtw.exe
  C:\Windows\System\vxHZAtw.exe
  2⤵
  PID:5588
- C:\Windows\System\DOOPCdm.exe
  C:\Windows\System\DOOPCdm.exe
  2⤵
  PID:5532
- C:\Windows\System\dpdsFyA.exe
  C:\Windows\System\dpdsFyA.exe
  2⤵
  PID:1004
- C:\Windows\System\favQvcX.exe
  C:\Windows\System\favQvcX.exe
  2⤵
  PID:5604
- C:\Windows\System\ZIBBNht.exe
  C:\Windows\System\ZIBBNht.exe
  2⤵
  PID:5516
- C:\Windows\System\qPLznQP.exe
  C:\Windows\System\qPLznQP.exe
  2⤵
  PID:3156
- C:\Windows\System\kqqfTrS.exe
  C:\Windows\System\kqqfTrS.exe
  2⤵
  PID:5716
- C:\Windows\System\lVYPCfB.exe
  C:\Windows\System\lVYPCfB.exe
  2⤵
  PID:5776
- C:\Windows\System\bLvBaet.exe
  C:\Windows\System\bLvBaet.exe
  2⤵
  PID:5232
- C:\Windows\System\vYHExFl.exe
  C:\Windows\System\vYHExFl.exe
  2⤵
  PID:1016
- C:\Windows\System\cMVlsia.exe
  C:\Windows\System\cMVlsia.exe
  2⤵
  PID:5692
- C:\Windows\System\DfBuZjw.exe
  C:\Windows\System\DfBuZjw.exe
  2⤵
  PID:5784
- C:\Windows\System\fcCdxFn.exe
  C:\Windows\System\fcCdxFn.exe
  2⤵
  PID:5828
- C:\Windows\System\kIjeuUW.exe
  C:\Windows\System\kIjeuUW.exe
  2⤵
  PID:13608
- C:\Windows\System\fXoGOUU.exe
  C:\Windows\System\fXoGOUU.exe
  2⤵
  PID:5676
- C:\Windows\System\VnRlkqL.exe
  C:\Windows\System\VnRlkqL.exe
  2⤵
  PID:2792
- C:\Windows\System\FDvIumk.exe
  C:\Windows\System\FDvIumk.exe
  2⤵
  PID:4848
- C:\Windows\System\bshihiq.exe
  C:\Windows\System\bshihiq.exe
  2⤵
  PID:5536
- C:\Windows\System\hBlZyNW.exe
  C:\Windows\System\hBlZyNW.exe
  2⤵
  PID:5844
- C:\Windows\System\wNspoEP.exe
  C:\Windows\System\wNspoEP.exe
  2⤵
  PID:5612
- C:\Windows\System\LMgpBfI.exe
  C:\Windows\System\LMgpBfI.exe
  2⤵
  PID:5556
- C:\Windows\System\NMdcJyW.exe
  C:\Windows\System\NMdcJyW.exe
  2⤵
  PID:11816
- C:\Windows\System\kIuGXAC.exe
  C:\Windows\System\kIuGXAC.exe
  2⤵
  PID:1596
- C:\Windows\System\UtzCqKC.exe
  C:\Windows\System\UtzCqKC.exe
  2⤵
  PID:2888
- C:\Windows\System\QobaeiL.exe
  C:\Windows\System\QobaeiL.exe
  2⤵
  PID:14644
- C:\Windows\System\vrmqawr.exe
  C:\Windows\System\vrmqawr.exe
  2⤵
  PID:14664
- C:\Windows\System\mhanxky.exe
  C:\Windows\System\mhanxky.exe
  2⤵
  PID:14852
- C:\Windows\System\VJrmmnA.exe
  C:\Windows\System\VJrmmnA.exe
  2⤵
  PID:14956
- C:\Windows\System\qTwZjeP.exe
  C:\Windows\System\qTwZjeP.exe
  2⤵
  PID:14976
- C:\Windows\System\YmCrauM.exe
  C:\Windows\System\YmCrauM.exe
  2⤵
  PID:14996
- C:\Windows\System\GjgJjAJ.exe
  C:\Windows\System\GjgJjAJ.exe
  2⤵
  PID:15084
- C:\Windows\System\BQBcMpA.exe
  C:\Windows\System\BQBcMpA.exe
  2⤵
  PID:15104
- C:\Windows\System\uXzqlMc.exe
  C:\Windows\System\uXzqlMc.exe
  2⤵
  PID:15136
- C:\Windows\System\hFCKzCD.exe
  C:\Windows\System\hFCKzCD.exe
  2⤵
  PID:15156
- C:\Windows\System\trhhgnl.exe
  C:\Windows\System\trhhgnl.exe
  2⤵
  PID:15176
- C:\Windows\System\lHXdGsz.exe
  C:\Windows\System\lHXdGsz.exe
  2⤵
  PID:15256
- C:\Windows\System\bHZKsnp.exe
  C:\Windows\System\bHZKsnp.exe
  2⤵
  PID:15308
- C:\Windows\System\KlOIVQk.exe
  C:\Windows\System\KlOIVQk.exe
  2⤵
  PID:15348
- C:\Windows\System\DELCBli.exe
  C:\Windows\System\DELCBli.exe
  2⤵
  PID:5984
- C:\Windows\System\EIaSoRP.exe
  C:\Windows\System\EIaSoRP.exe
  2⤵
  PID:14172
- C:\Windows\System\ZGEClQH.exe
  C:\Windows\System\ZGEClQH.exe
  2⤵
  PID:6072
- C:\Windows\System\RVRAvTz.exe
  C:\Windows\System\RVRAvTz.exe
  2⤵
  PID:6004
- C:\Windows\System\xQvLdTR.exe
  C:\Windows\System\xQvLdTR.exe
  2⤵
  PID:14424
- C:\Windows\System\jLqJXJU.exe
  C:\Windows\System\jLqJXJU.exe
  2⤵
  PID:4440
- C:\Windows\System\ZtQFtEJ.exe
  C:\Windows\System\ZtQFtEJ.exe
  2⤵
  PID:14564
- C:\Windows\System\vwffNdz.exe
  C:\Windows\System\vwffNdz.exe
  2⤵
  PID:5576
- C:\Windows\System\fZaOWMV.exe
  C:\Windows\System\fZaOWMV.exe
  2⤵
  PID:14600
- C:\Windows\System\ZSCVHYt.exe
  C:\Windows\System\ZSCVHYt.exe
  2⤵
  PID:14624
- C:\Windows\System\VkiDeer.exe
  C:\Windows\System\VkiDeer.exe
  2⤵
  PID:14640
- C:\Windows\System\ZZaraEm.exe
  C:\Windows\System\ZZaraEm.exe
  2⤵
  PID:14660
- C:\Windows\System\NGIsgUn.exe
  C:\Windows\System\NGIsgUn.exe
  2⤵
  PID:14716
- C:\Windows\System\LqRLGFM.exe
  C:\Windows\System\LqRLGFM.exe
  2⤵
  PID:14720
- C:\Windows\System\ORcbxKo.exe
  C:\Windows\System\ORcbxKo.exe
  2⤵
  PID:14744
- C:\Windows\System\QBuhpKh.exe
  C:\Windows\System\QBuhpKh.exe
  2⤵
  PID:14780
- C:\Windows\System\pbKEiKr.exe
  C:\Windows\System\pbKEiKr.exe
  2⤵
  PID:5952
- C:\Windows\System\OaJeLtQ.exe
  C:\Windows\System\OaJeLtQ.exe
  2⤵
  PID:14804
- C:\Windows\System\BnTxltj.exe
  C:\Windows\System\BnTxltj.exe
  2⤵
  PID:14864
- C:\Windows\System\qxOUbFm.exe
  C:\Windows\System\qxOUbFm.exe
  2⤵
  PID:14860
- C:\Windows\System\uXQoktS.exe
  C:\Windows\System\uXQoktS.exe
  2⤵
  PID:15048
- C:\Windows\System\RVChaHh.exe
  C:\Windows\System\RVChaHh.exe
  2⤵
  PID:15116
- C:\Windows\System\vzSyegq.exe
  C:\Windows\System\vzSyegq.exe
  2⤵
  PID:15280
- C:\Windows\System\rhiQvIk.exe
  C:\Windows\System\rhiQvIk.exe
  2⤵
  PID:6864
- C:\Windows\System\cFUojeQ.exe
  C:\Windows\System\cFUojeQ.exe
  2⤵
  PID:14408
- C:\Windows\System\wjYIaBP.exe
  C:\Windows\System\wjYIaBP.exe
  2⤵
  PID:14436
- C:\Windows\System\gbFDsiN.exe
  C:\Windows\System\gbFDsiN.exe
  2⤵
  PID:14484
- C:\Windows\System\cOujWGd.exe
  C:\Windows\System\cOujWGd.exe
  2⤵
  PID:14460
- C:\Windows\System\xsEfDZp.exe
  C:\Windows\System\xsEfDZp.exe
  2⤵
  PID:14508
- C:\Windows\System\Dhgevgg.exe
  C:\Windows\System\Dhgevgg.exe
  2⤵
  PID:6208
- C:\Windows\System\bNrOMQx.exe
  C:\Windows\System\bNrOMQx.exe
  2⤵
  PID:14528
- C:\Windows\System\gXQKkaF.exe
  C:\Windows\System\gXQKkaF.exe
  2⤵
  PID:14544
- C:\Windows\System\kdUGvhm.exe
  C:\Windows\System\kdUGvhm.exe
  2⤵
  PID:14548
- C:\Windows\System\KRFMOHp.exe
  C:\Windows\System\KRFMOHp.exe
  2⤵
  PID:6908
- C:\Windows\System\eWVbCpc.exe
  C:\Windows\System\eWVbCpc.exe
  2⤵
  PID:2328
- C:\Windows\System\CnFWkYZ.exe
  C:\Windows\System\CnFWkYZ.exe
  2⤵
  PID:14708
- C:\Windows\System\RmNrpmE.exe
  C:\Windows\System\RmNrpmE.exe
  2⤵
  PID:14652
- C:\Windows\System\clmfJcC.exe
  C:\Windows\System\clmfJcC.exe
  2⤵
  PID:2212
- C:\Windows\System\owXxkSB.exe
  C:\Windows\System\owXxkSB.exe
  2⤵
  PID:15204
- C:\Windows\System\utfdsOt.exe
  C:\Windows\System\utfdsOt.exe
  2⤵
  PID:15012
- C:\Windows\System\ccCYENy.exe
  C:\Windows\System\ccCYENy.exe
  2⤵
  PID:6456
- C:\Windows\System\wVvmzyr.exe
  C:\Windows\System\wVvmzyr.exe
  2⤵
  PID:1508
- C:\Windows\System\lYTSDOJ.exe
  C:\Windows\System\lYTSDOJ.exe
  2⤵
  PID:15264
- C:\Windows\System\GsaiNmr.exe
  C:\Windows\System\GsaiNmr.exe
  2⤵
  PID:5260
- C:\Windows\System\hwtyMnX.exe
  C:\Windows\System\hwtyMnX.exe
  2⤵
  PID:15224
- C:\Windows\System\mSvfPJg.exe
  C:\Windows\System\mSvfPJg.exe
  2⤵
  PID:15292
- C:\Windows\System\HyNSmQd.exe
  C:\Windows\System\HyNSmQd.exe
  2⤵
  PID:7368
- C:\Windows\System\QysTHUA.exe
  C:\Windows\System\QysTHUA.exe
  2⤵
  PID:14404
- C:\Windows\System\QEfsyHh.exe
  C:\Windows\System\QEfsyHh.exe
  2⤵
  PID:8144
- C:\Windows\System\HrSUjTP.exe
  C:\Windows\System\HrSUjTP.exe
  2⤵
  PID:6668
- C:\Windows\System\yoheeig.exe
  C:\Windows\System\yoheeig.exe
  2⤵
  PID:14416
- C:\Windows\System\aMYTnal.exe
  C:\Windows\System\aMYTnal.exe
  2⤵
  PID:3540
- C:\Windows\System\siOcKpD.exe
  C:\Windows\System\siOcKpD.exe
  2⤵
  PID:6792
- C:\Windows\System\PRCLVWN.exe
  C:\Windows\System\PRCLVWN.exe
  2⤵
  PID:14608
- C:\Windows\System\ZUtUwEH.exe
  C:\Windows\System\ZUtUwEH.exe
  2⤵
  PID:3580
- C:\Windows\System\LXMmjxI.exe
  C:\Windows\System\LXMmjxI.exe
  2⤵
  PID:12392
- C:\Windows\System\PxITIkD.exe
  C:\Windows\System\PxITIkD.exe
  2⤵
  PID:14840
- C:\Windows\System\qBmdiTZ.exe
  C:\Windows\System\qBmdiTZ.exe
  2⤵
  PID:6148
- C:\Windows\System\sugMSxg.exe
  C:\Windows\System\sugMSxg.exe
  2⤵
  PID:6788
- C:\Windows\System\MygobJe.exe
  C:\Windows\System\MygobJe.exe
  2⤵
  PID:8968
- C:\Windows\System\eNUWUpw.exe
  C:\Windows\System\eNUWUpw.exe
  2⤵
  PID:9168
- C:\Windows\System\XUFmtqV.exe
  C:\Windows\System\XUFmtqV.exe
  2⤵
  PID:15100
- C:\Windows\System\eTywcZq.exe
  C:\Windows\System\eTywcZq.exe
  2⤵
  PID:6596
- C:\Windows\System\FfFxvXk.exe
  C:\Windows\System\FfFxvXk.exe
  2⤵
  PID:6852
- C:\Windows\System\KoMoTiC.exe
  C:\Windows\System\KoMoTiC.exe
  2⤵
  PID:8416
- C:\Windows\System\UrhihhO.exe
  C:\Windows\System\UrhihhO.exe
  2⤵
  PID:6320
- C:\Windows\System\eAvxSom.exe
  C:\Windows\System\eAvxSom.exe
  2⤵
  PID:8156
- C:\Windows\System\vIgrsIT.exe
  C:\Windows\System\vIgrsIT.exe
  2⤵
  PID:13788
- C:\Windows\System\XELnabT.exe
  C:\Windows\System\XELnabT.exe
  2⤵
  PID:7588
- C:\Windows\System\ggexrPr.exe
  C:\Windows\System\ggexrPr.exe
  2⤵
  PID:14344
- C:\Windows\System\KUvToGl.exe
  C:\Windows\System\KUvToGl.exe
  2⤵
  PID:7844
- C:\Windows\System\eRpOOUP.exe
  C:\Windows\System\eRpOOUP.exe
  2⤵
  PID:9536
- C:\Windows\System\nRtvWXK.exe
  C:\Windows\System\nRtvWXK.exe
  2⤵
  PID:14348
- C:\Windows\System\uLeBUmk.exe
  C:\Windows\System\uLeBUmk.exe
  2⤵
  PID:5708
- C:\Windows\System\hcyZktY.exe
  C:\Windows\System\hcyZktY.exe
  2⤵
  PID:9560
- C:\Windows\System\VUlCGey.exe
  C:\Windows\System\VUlCGey.exe
  2⤵
  PID:7416
- C:\Windows\System\SBSeBio.exe
  C:\Windows\System\SBSeBio.exe
  2⤵
  PID:14656
- C:\Windows\System\QmWrxhR.exe
  C:\Windows\System\QmWrxhR.exe
  2⤵
  PID:14620
- C:\Windows\System\ifdepYW.exe
  C:\Windows\System\ifdepYW.exe
  2⤵
  PID:14752
- C:\Windows\System\iRNDWwt.exe
  C:\Windows\System\iRNDWwt.exe
  2⤵
  PID:6680
- C:\Windows\System\JUxdawM.exe
  C:\Windows\System\JUxdawM.exe
  2⤵
  PID:5300
- C:\Windows\System\kFyRKoV.exe
  C:\Windows\System\kFyRKoV.exe
  2⤵
  PID:8980
- C:\Windows\System\vOmBOjf.exe
  C:\Windows\System\vOmBOjf.exe
  2⤵
  PID:3484
- C:\Windows\System\PbZcldp.exe
  C:\Windows\System\PbZcldp.exe
  2⤵
  PID:8460
- C:\Windows\System\wTELBIt.exe
  C:\Windows\System\wTELBIt.exe
  2⤵
  PID:9740
- C:\Windows\System\MsKsTDq.exe
  C:\Windows\System\MsKsTDq.exe
  2⤵
  PID:10016
- C:\Windows\System\JUkbpgg.exe
  C:\Windows\System\JUkbpgg.exe
  2⤵
  PID:10452
- C:\Windows\System\RGeyafB.exe
  C:\Windows\System\RGeyafB.exe
  2⤵
  PID:10464
- C:\Windows\System\dJbOsKD.exe
  C:\Windows\System\dJbOsKD.exe
  2⤵
  PID:6524
- C:\Windows\System\MEgpgQp.exe
  C:\Windows\System\MEgpgQp.exe
  2⤵
  PID:9476
- C:\Windows\System\NMpyqes.exe
  C:\Windows\System\NMpyqes.exe
  2⤵
  PID:10544
- C:\Windows\System\XALejrZ.exe
  C:\Windows\System\XALejrZ.exe
  2⤵
  PID:10764
- C:\Windows\System\IeXuiFN.exe
  C:\Windows\System\IeXuiFN.exe
  2⤵
  PID:9408
- C:\Windows\System\ZkmSdux.exe
  C:\Windows\System\ZkmSdux.exe
  2⤵
  PID:3536
- C:\Windows\System\yeLsjTy.exe
  C:\Windows\System\yeLsjTy.exe
  2⤵
  PID:8672
- C:\Windows\System\YjgboWp.exe
  C:\Windows\System\YjgboWp.exe
  2⤵
  PID:14576
- C:\Windows\System\MEBRlHk.exe
  C:\Windows\System\MEBRlHk.exe
  2⤵
  PID:7536
- C:\Windows\System\KBJNTpw.exe
  C:\Windows\System\KBJNTpw.exe
  2⤵
  PID:9620
- C:\Windows\System\vSXOcaG.exe
  C:\Windows\System\vSXOcaG.exe
  2⤵
  PID:14884
- C:\Windows\System\BUcKsVL.exe
  C:\Windows\System\BUcKsVL.exe
  2⤵
  PID:9616
- C:\Windows\System\ihZzPAe.exe
  C:\Windows\System\ihZzPAe.exe
  2⤵
  PID:7008
- C:\Windows\System\fdEGkZb.exe
  C:\Windows\System\fdEGkZb.exe
  2⤵
  PID:11004
- C:\Windows\System\QxdbwEv.exe
  C:\Windows\System\QxdbwEv.exe
  2⤵
  PID:10116
- C:\Windows\System\TMBddJE.exe
  C:\Windows\System\TMBddJE.exe
  2⤵
  PID:9984
- C:\Windows\System\NjdoKJQ.exe
  C:\Windows\System\NjdoKJQ.exe
  2⤵
  PID:8592
- C:\Windows\System\ieNBkcZ.exe
  C:\Windows\System\ieNBkcZ.exe
  2⤵
  PID:10168
- C:\Windows\System\XWmLqiY.exe
  C:\Windows\System\XWmLqiY.exe
  2⤵
  PID:8572
- C:\Windows\System\MLQBWJC.exe
  C:\Windows\System\MLQBWJC.exe
  2⤵
  PID:8108
- C:\Windows\System\pdPrIaY.exe
  C:\Windows\System\pdPrIaY.exe
  2⤵
  PID:6160
- C:\Windows\System\RxmFDVK.exe
  C:\Windows\System\RxmFDVK.exe
  2⤵
  PID:8480
- C:\Windows\System\cjfKrkL.exe
  C:\Windows\System\cjfKrkL.exe
  2⤵
  PID:15020
- C:\Windows\System\FVMVDAd.exe
  C:\Windows\System\FVMVDAd.exe
  2⤵
  PID:10620
- C:\Windows\System\xhKnWnf.exe
  C:\Windows\System\xhKnWnf.exe
  2⤵
  PID:9532
- C:\Windows\System\GkxyVNi.exe
  C:\Windows\System\GkxyVNi.exe
  2⤵
  PID:10800
- C:\Windows\System\jRsBcbW.exe
  C:\Windows\System\jRsBcbW.exe
  2⤵
  PID:5464
- C:\Windows\System\WacjAKb.exe
  C:\Windows\System\WacjAKb.exe
  2⤵
  PID:9708
- C:\Windows\System\iSmjEuR.exe
  C:\Windows\System\iSmjEuR.exe
  2⤵
  PID:10848
- C:\Windows\System\PQWaKUJ.exe
  C:\Windows\System\PQWaKUJ.exe
  2⤵
  PID:6112
- C:\Windows\System\CipeMfX.exe
  C:\Windows\System\CipeMfX.exe
  2⤵
  PID:7076
- C:\Windows\System\QgnGfKC.exe
  C:\Windows\System\QgnGfKC.exe
  2⤵
  PID:7932
- C:\Windows\System\qdMxcks.exe
  C:\Windows\System\qdMxcks.exe
  2⤵
  PID:9324
- C:\Windows\System\krQhIPn.exe
  C:\Windows\System\krQhIPn.exe
  2⤵
  PID:10548
- C:\Windows\System\RkRuQMH.exe
  C:\Windows\System\RkRuQMH.exe
  2⤵
  PID:7732
- C:\Windows\System\PBCQoBy.exe
  C:\Windows\System\PBCQoBy.exe
  2⤵
  PID:11148
- C:\Windows\System\wegobNc.exe
  C:\Windows\System\wegobNc.exe
  2⤵
  PID:11248
- C:\Windows\System\eJTQWhG.exe
  C:\Windows\System\eJTQWhG.exe
  2⤵
  PID:10420
- C:\Windows\System\sxGAIiT.exe
  C:\Windows\System\sxGAIiT.exe
  2⤵
  PID:7912
- C:\Windows\System\dGJCwsc.exe
  C:\Windows\System\dGJCwsc.exe
  2⤵
  PID:7472
- C:\Windows\System\RVambGO.exe
  C:\Windows\System\RVambGO.exe
  2⤵
  PID:10684
- C:\Windows\System\ncBCMGE.exe
  C:\Windows\System\ncBCMGE.exe
  2⤵
  PID:11180
- C:\Windows\System\Efqiqho.exe
  C:\Windows\System\Efqiqho.exe
  2⤵
  PID:7684
- C:\Windows\System\MsURKxg.exe
  C:\Windows\System\MsURKxg.exe
  2⤵
  PID:8920
- C:\Windows\System\oeWQmzS.exe
  C:\Windows\System\oeWQmzS.exe
  2⤵
  PID:6620
- C:\Windows\System\nyUkHgA.exe
  C:\Windows\System\nyUkHgA.exe
  2⤵
  PID:7884
- C:\Windows\System\TIvxCNV.exe
  C:\Windows\System\TIvxCNV.exe
  2⤵
  PID:11416
- C:\Windows\System\OJYOsrP.exe
  C:\Windows\System\OJYOsrP.exe
  2⤵
  PID:9908
- C:\Windows\System\hKIyanf.exe
  C:\Windows\System\hKIyanf.exe
  2⤵
  PID:11220
- C:\Windows\System\pKijFVB.exe
  C:\Windows\System\pKijFVB.exe
  2⤵
  PID:11984
- C:\Windows\System\XFgOhYN.exe
  C:\Windows\System\XFgOhYN.exe
  2⤵
  PID:7800
- C:\Windows\System\tHvOOCC.exe
  C:\Windows\System\tHvOOCC.exe
  2⤵
  PID:8060
- C:\Windows\System\upTePmp.exe
  C:\Windows\System\upTePmp.exe
  2⤵
  PID:6128
- C:\Windows\System\uzSUkVC.exe
  C:\Windows\System\uzSUkVC.exe
  2⤵
  PID:8396
- C:\Windows\System\LHYJGgz.exe
  C:\Windows\System\LHYJGgz.exe
  2⤵
  PID:9776
- C:\Windows\System\szNYmZD.exe
  C:\Windows\System\szNYmZD.exe
  2⤵
  PID:10032
- C:\Windows\System\qUAnDVo.exe
  C:\Windows\System\qUAnDVo.exe
  2⤵
  PID:14736
- C:\Windows\System\ryLMMCc.exe
  C:\Windows\System\ryLMMCc.exe
  2⤵
  PID:10928
- C:\Windows\System\wTTjzhc.exe
  C:\Windows\System\wTTjzhc.exe
  2⤵
  PID:12584
- C:\Windows\System\lqwCIyI.exe
  C:\Windows\System\lqwCIyI.exe
  2⤵
  PID:7236
- C:\Windows\System\NcPcGEb.exe
  C:\Windows\System\NcPcGEb.exe
  2⤵
  PID:10512
- C:\Windows\System\tLUWvgX.exe
  C:\Windows\System\tLUWvgX.exe
  2⤵
  PID:10256
- C:\Windows\System\EPEbLXW.exe
  C:\Windows\System\EPEbLXW.exe
  2⤵
  PID:8832
- C:\Windows\System\bvLOzzq.exe
  C:\Windows\System\bvLOzzq.exe
  2⤵
  PID:13076
- C:\Windows\System\YauJojB.exe
  C:\Windows\System\YauJojB.exe
  2⤵
  PID:10472
- C:\Windows\System\oUImyxB.exe
  C:\Windows\System\oUImyxB.exe
  2⤵
  PID:8680
- C:\Windows\System\purFACk.exe
  C:\Windows\System\purFACk.exe
  2⤵
  PID:11320
- C:\Windows\System\UfUtVjJ.exe
  C:\Windows\System\UfUtVjJ.exe
  2⤵
  PID:13172
- C:\Windows\System\ZhbAQdO.exe
  C:\Windows\System\ZhbAQdO.exe
  2⤵
  PID:6276
- C:\Windows\System\AqflWry.exe
  C:\Windows\System\AqflWry.exe
  2⤵
  PID:8568
- C:\Windows\System\RkPHxii.exe
  C:\Windows\System\RkPHxii.exe
  2⤵
  PID:15300
- C:\Windows\System\puwgybF.exe
  C:\Windows\System\puwgybF.exe
  2⤵
  PID:6184
- C:\Windows\System\JaHKgGK.exe
  C:\Windows\System\JaHKgGK.exe
  2⤵
  PID:11744
- C:\Windows\System\ZrBrpwM.exe
  C:\Windows\System\ZrBrpwM.exe
  2⤵
  PID:11124
- C:\Windows\System\Rrayqua.exe
  C:\Windows\System\Rrayqua.exe
  2⤵
  PID:10356
- C:\Windows\System\aruzKNn.exe
  C:\Windows\System\aruzKNn.exe
  2⤵
  PID:11672
- C:\Windows\System\DFNqFOe.exe
  C:\Windows\System\DFNqFOe.exe
  2⤵
  PID:9244
- C:\Windows\System\sBmzpMl.exe
  C:\Windows\System\sBmzpMl.exe
  2⤵
  PID:9116
- C:\Windows\System\mUBTjwd.exe
  C:\Windows\System\mUBTjwd.exe
  2⤵
  PID:11836
- C:\Windows\System\rVktrRO.exe
  C:\Windows\System\rVktrRO.exe
  2⤵
  PID:11608
- C:\Windows\System\lHHqUjh.exe
  C:\Windows\System\lHHqUjh.exe
  2⤵
  PID:9388
- C:\Windows\System\DqrJuWm.exe
  C:\Windows\System\DqrJuWm.exe
  2⤵
  PID:12420
- C:\Windows\System\TwYenSb.exe
  C:\Windows\System\TwYenSb.exe
  2⤵
  PID:9156
- C:\Windows\System\EVALOdD.exe
  C:\Windows\System\EVALOdD.exe
  2⤵
  PID:12544
- C:\Windows\System\CGwCVpg.exe
  C:\Windows\System\CGwCVpg.exe
  2⤵
  PID:12444
- C:\Windows\System\YoMsDDn.exe
  C:\Windows\System\YoMsDDn.exe
  2⤵
  PID:10376
- C:\Windows\System\aleirUK.exe
  C:\Windows\System\aleirUK.exe
  2⤵
  PID:13000
- C:\Windows\System\ozLlxpt.exe
  C:\Windows\System\ozLlxpt.exe
  2⤵
  PID:10828
- C:\Windows\System\xFUvLuz.exe
  C:\Windows\System\xFUvLuz.exe
  2⤵
  PID:10972
- C:\Windows\System\UWQPpVv.exe
  C:\Windows\System\UWQPpVv.exe
  2⤵
  PID:11100
- C:\Windows\System\vnZFClu.exe
  C:\Windows\System\vnZFClu.exe
  2⤵
  PID:13116
- C:\Windows\System\UGwBzoQ.exe
  C:\Windows\System\UGwBzoQ.exe
  2⤵
  PID:11196
- C:\Windows\System\SXKzxGb.exe
  C:\Windows\System\SXKzxGb.exe
  2⤵
  PID:5896
- C:\Windows\System\ydqNuMn.exe
  C:\Windows\System\ydqNuMn.exe
  2⤵
  PID:12804
- C:\Windows\System\pHFDKGZ.exe
  C:\Windows\System\pHFDKGZ.exe
  2⤵
  PID:8304
- C:\Windows\System\ZEvXwVg.exe
  C:\Windows\System\ZEvXwVg.exe
  2⤵
  PID:6168
- C:\Windows\System\PTxgDQW.exe
  C:\Windows\System\PTxgDQW.exe
  2⤵
  PID:7868
- C:\Windows\System\sQitDeO.exe
  C:\Windows\System\sQitDeO.exe
  2⤵
  PID:11772
- C:\Windows\System\jzBeBvH.exe
  C:\Windows\System\jzBeBvH.exe
  2⤵
  PID:10400
- C:\Windows\System\dwbiXKn.exe
  C:\Windows\System\dwbiXKn.exe
  2⤵
  PID:10936
- C:\Windows\System\knLrIqB.exe
  C:\Windows\System\knLrIqB.exe
  2⤵
  PID:7392
- C:\Windows\System\xfQhMqV.exe
  C:\Windows\System\xfQhMqV.exe
  2⤵
  PID:15216
- C:\Windows\System\IvfKoSC.exe
  C:\Windows\System\IvfKoSC.exe
  2⤵
  PID:10600
- C:\Windows\System\bWrWwIL.exe
  C:\Windows\System\bWrWwIL.exe
  2⤵
  PID:12220
- C:\Windows\System\SvBGcim.exe
  C:\Windows\System\SvBGcim.exe
  2⤵
  PID:14968
- C:\Windows\System\lYoyuBQ.exe
  C:\Windows\System\lYoyuBQ.exe
  2⤵
  PID:9008
- C:\Windows\System\DQqNZau.exe
  C:\Windows\System\DQqNZau.exe
  2⤵
  PID:10968
- C:\Windows\System\GcIHjQM.exe
  C:\Windows\System\GcIHjQM.exe
  2⤵
  PID:10140
- C:\Windows\System\SXoWzIk.exe
  C:\Windows\System\SXoWzIk.exe
  2⤵
  PID:12520
- C:\Windows\System\OMBCOBN.exe
  C:\Windows\System\OMBCOBN.exe
  2⤵
  PID:11328
- C:\Windows\System\YKaSqlU.exe
  C:\Windows\System\YKaSqlU.exe
  2⤵
  PID:6440
- C:\Windows\System\xdTXywS.exe
  C:\Windows\System\xdTXywS.exe
  2⤵
  PID:804
- C:\Windows\System\PkygUDp.exe
  C:\Windows\System\PkygUDp.exe
  2⤵
  PID:9048
- C:\Windows\System\rmGmhgU.exe
  C:\Windows\System\rmGmhgU.exe
  2⤵
  PID:12732
- C:\Windows\System\ZUJVsXI.exe
  C:\Windows\System\ZUJVsXI.exe
  2⤵
  PID:11108
- C:\Windows\System\igsRfGd.exe
  C:\Windows\System\igsRfGd.exe
  2⤵
  PID:12824
- C:\Windows\System\WkErEOS.exe
  C:\Windows\System\WkErEOS.exe
  2⤵
  PID:12964
- C:\Windows\System\FKtNaUZ.exe
  C:\Windows\System\FKtNaUZ.exe
  2⤵
  PID:12956
- C:\Windows\System\uKFpwTY.exe
  C:\Windows\System\uKFpwTY.exe
  2⤵
  PID:11192
- C:\Windows\System\IuhbSoe.exe
  C:\Windows\System\IuhbSoe.exe
  2⤵
  PID:13068
- C:\Windows\System\jUastde.exe
  C:\Windows\System\jUastde.exe
  2⤵
  PID:13184
- C:\Windows\System\cTFXAKh.exe
  C:\Windows\System\cTFXAKh.exe
  2⤵
  PID:7976
- C:\Windows\System\kpkaxvh.exe
  C:\Windows\System\kpkaxvh.exe
  2⤵
  PID:10312
- C:\Windows\System\dovghUo.exe
  C:\Windows\System\dovghUo.exe
  2⤵
  PID:11796
- C:\Windows\System\qDQLAKY.exe
  C:\Windows\System\qDQLAKY.exe
  2⤵
  PID:12900
- C:\Windows\System\aGLlXEQ.exe
  C:\Windows\System\aGLlXEQ.exe
  2⤵
  PID:9028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fvbah2k3.ohs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BhLiPMq.exe

Filesize
1.7MB

MD5
10403351a3c5be77dc0dded223cf743b

SHA1
4d2796e21f44184b941f86211258a668573025ce

SHA256
59e6855ccaf1227dca5c6d0edec961ee443aaefbb91f7d6635f438a8ed9221fb

SHA512
1441a4745b5b889c5899ed7cd789fdc52f53f98a4e9a05e3b07067204de690f08a20f64f220b75064ed245915d0eed566c80d6329e9fa547fb3de81eb3c6a643

Download Submit
C:\Windows\System\CuCzZXA.exe

Filesize
1.7MB

MD5
1c0238565a352695926c37633fd6e0d0

SHA1
57ba2891c310b2896301d55eeac3c0f387483dc4

SHA256
a20be0addecc92f39baa21f62a0d3cf6c143c753d44be5601de239740e390718

SHA512
4273cc571bffd45e1de4dbe3bac1da2cbf963e176164123b85cd8b2c67a207dd62f4d66dc3b5ea2638daf8cd2982c98b62f3cd41ba374ef7a6eb224a25d1a3f7

Download Submit
C:\Windows\System\EjwOtHm.exe

Filesize
1.7MB

MD5
a6334c865e4af8f4d71e5b6c43ae3c6d

SHA1
e9824fa484b16ec3a98fe8e1a362d07e1840fb06

SHA256
5b4c5213c6ac636bc2c8a21b462d69433a9c11e97115584905e47e62bb1d0537

SHA512
6e119bb3ad45941676f5bf60807656a1f4d7facc4a5c47b0b061975df0f63ceef367039db83c7275604fcd0be949198e2bd01b74e336dc187761ed67e6ea5b19

Download Submit
C:\Windows\System\ErxAbwT.exe

Filesize
18B

MD5
69949a16428cf7e91e16ecdbbbab0f02

SHA1
1bc1b083758681dcffdfa5fa5685d6e92b962d88

SHA256
2be943b1ef11e32fd01cd1d56d41e85e87f5cb46820e52d7de606f63654bf5da

SHA512
d5ffad16f872bbff18949218ec79dceedbbc88a99af414a13b6c7d08a90c4285a65335c6cfe31a1901e5a91add08957302ef854059054f89c6e4b91731c6b7a4

Download Submit
C:\Windows\System\GogfheI.exe

Filesize
1.7MB

MD5
4382a753861c9fa58af76eeece79d2e8

SHA1
141b7306d1f1e00d94a083bc09f1ff237eece7ba

SHA256
475ca62d961ebf58bc7f8a560807b67c7e27b706cd2f6d7ad9358883ef13b227

SHA512
c876ae865bf34183d54ec2938c73a21d2bd799a54d52377eef42695111324bd3b93edabe5196ea49a93b13d89cb7dedd51aefc4b837687d5fb06f00e18e65eaf

Download Submit
C:\Windows\System\HldeGnS.exe

Filesize
1.7MB

MD5
7b3c5988dd7daef26c1ce9560ccf6b56

SHA1
2e3b2d8bc7ec2249f449fdb615c6ee52cbdbf876

SHA256
87bc27b8012feea8eeed37890e0c037ea1d6a63b496f1a6b2faf4499d613fde6

SHA512
81fcd7663d4f351fd7a6a7c206fb021d281fb63a256af99d3202c94199774037c4de8160f4492b549fef3fc2902ff4cdce027c1ce9f68d68ee6ece8d50fd2c96

Download Submit
C:\Windows\System\IEGTrUu.exe

Filesize
8B

MD5
66d7e297b90fe34ca06f598960896d19

SHA1
0433321fa0d916440f15cdee91c3e93318197dee

SHA256
62c8848e8576ee6bb1b62b04fa3898ea9c1bff1c6df8e2421efa77ab49fa4456

SHA512
4abb742b6807bc5e9c1f07c9bd2c9a15b441e3a0f7a9715e62b9a71c659b66c03f5bdd4961bd675100bab1c61778e8b524a13e9a54f36d441aeb74ce1a0b5e73

Download Submit
C:\Windows\System\KVGrmtC.exe

Filesize
1.7MB

MD5
2d53a0f8fe7237c8254b5bd78d2cb1d9

SHA1
fdfeb31f0b44416fd784d13a52320967e3e81abd

SHA256
d918e8175054887501eb615e8c34c552b078dd96b38ffda6dcf7ba1e683b2d8c

SHA512
8d732c02c083fee0298350a9bb992530fa1edf677904d3dc66f2b177a023e33066d9d24202e6340d7e949514b73ab7fffeb3dad7bdbe04ceffd92450f4d67c46

Download Submit
C:\Windows\System\LPlmsmd.exe

Filesize
1.7MB

MD5
928d95c0f67058bcaa3f193a40c56340

SHA1
941846a54e1fb465c14ff363356d76b3fc45fcbe

SHA256
9760da02377a698839cf90de328357a07d9d4de4430c2c011c33919766ae225e

SHA512
38ce703d372d033ef77304c90b1f36816ce1d095e4c2d0bc94812d0371aba3ac2dca99c88665a9b7b523f2f8a6a1b9a075262aaec1cf77ed010791ece5da1e59

Download Submit
C:\Windows\System\LiTrtlS.exe

Filesize
1.7MB

MD5
bc307a8967583f4fc525f899d0eba0c4

SHA1
fec9c58ed512add03515701d3440dcdefe0daa01

SHA256
ebf65490a16aa2da10adc28750196acdc8c2da8e7ab4b3b011b8c219b0348105

SHA512
1a86767e2969dfff346e851dd16dc757fd07433f68496b7a765871dc97e2a0ef10e6a0a3bfe2bac03752c543e46418a465bb7166348fc0d116307a94dc7efb09

Download Submit
C:\Windows\System\NdPQoRe.exe

Filesize
1.7MB

MD5
3773644ea00a6aaf53319685829a823f

SHA1
686b1339df7593d6d30eafc8ad4a5f7ff4db18aa

SHA256
dcb3ea528b3276e78f6695927ece26415fb5872b18f2da1d7970c22574845013

SHA512
e6cb7ec281952daf1b9fb72fc24ff2f3904f55f211c866774bbf2bf7346641a8b6d6165e773f6cdeef712bbc35b1d6e9b254d205ae72a33a1f0be0e498c1de66

Download Submit
C:\Windows\System\RfdMkOS.exe

Filesize
1.7MB

MD5
2adc451cc798cb4f535774d543dc5b85

SHA1
e7cc2de56a1e9a8929f79f21ee36465dec6a111c

SHA256
71e4d22311179c53056268b50367862730160ac60fddd27457f09e0e9405d3b2

SHA512
f6acc7264b4a8b1da4a683e037a9418cbf3f69c528925e7076bf2d09fe8c8b2b1abbeb275ca07f6d8dffc2f3e7e30134922818ecad8bcc27da82855639c4efe5

Download Submit
C:\Windows\System\RjsipSe.exe

Filesize
1.7MB

MD5
6537fbd706a2352b7514231f2853f29e

SHA1
92f1dd9ffde36ef838fbb62112dcca91f0ee2df5

SHA256
36a18e41d74eafd7ef67ddb893b7170ec42759907ddeccc8f3235ff3a374f5d4

SHA512
ff5973854d17775c7610166f99ceb3804a1c004f99fb430bb2e1b89d2af3fd4d2c5db397a0e72221994ba1e288fd3f909445cec17bc37551e459ff639782b6d3

Download Submit
C:\Windows\System\SEmvdmO.exe

Filesize
1.7MB

MD5
06bb399fc676842cc97bd1c6ea5cb3ca

SHA1
7d92ddfc9871a0ae8905161da6b8ac6435f94de9

SHA256
26766993c73aa8f11f1b83f3db3b40e86fe7d189cdf7b9ecf97e4d736f5045a7

SHA512
5de2bf21309020306b2ad9323f03d2091368ee8c6cb8bdbb38fb5eb3587693d13b3629823f01fe8145b3786e47c1f79a2a267f8e5d15f99ca4185ecca059f921

Download Submit
C:\Windows\System\USJfaiW.exe

Filesize
1.7MB

MD5
361dea497b25788b3604094f3f26eb2d

SHA1
195b609b183005633ae30eb3c99a1d8d315f80a1

SHA256
107a0672678c2340ab73e7239995d3b9b5860379b2b629a17b91058a909b0cda

SHA512
b8d7067a232d99622bdc28006f3f76be577071332f2d63424f206bff8c936e61d85b09fac9744fcaa2d0f704b01bc3cdf0dfc18c6f7fa4fef88ac78098b6ba52

Download Submit
C:\Windows\System\VhEqEPy.exe

Filesize
1.7MB

MD5
47937b396d37578b6257d1edc7367fea

SHA1
ccabf39250b9c061837055537e35cc19d04daf65

SHA256
47e5470e0523e85cb5f7066b57ee2d7f016efc837e6f60ae3bb91a2d410bf711

SHA512
770092050946dd247faf6ea0aec575bfbaec62244a05083868c0e960e9932dfb360d36d5ea30195a3f5a1e2140a36febaec52b168920a410ae8abf06a51ad11e

Download Submit
C:\Windows\System\WAkOJpz.exe

Filesize
1.7MB

MD5
66099205bd13e11cb551c610a2868bd1

SHA1
b15536f1cde19d6e24eb163a31af788f32f308b7

SHA256
ea635a0a99578ce4491a6be707967b1826f675c99d21f6caa0cf8117c5f37884

SHA512
0af79380fac3e0bebd2866af1345afebba1d323c4e9e45b2f62b3ded97cfec0ceee894f7b3bae9cebdfd8525cfe3b7f16ab40f46cd6421defcdfa97ca2aa4add

Download Submit
C:\Windows\System\XNqceGN.exe

Filesize
1.7MB

MD5
fa440dc6fccb66fe42e17c1a48cef02e

SHA1
6e258798b9b05bbadf586411bd1761429a14bdd9

SHA256
70f3cd9e0f86a91c3e6a5cfd7f92a6b14dfa43172c6886dc7746cc061baff02d

SHA512
6bad917508e466043b4a41da58225fcc6b8efa1913c3b6bd110a081590b187f42f689f73bbd5534a109e88b097ec6547474780452be00ce8ce5e1bdce75ca691

Download Submit
C:\Windows\System\XulUpPG.exe

Filesize
1.7MB

MD5
7058dec6716c0ad3b5442d7b3049754b

SHA1
727481b8bbe3a4d2fb8dab7e311833d73c8febe1

SHA256
dc23e82f2533d56187a12712b48fea15aed83068d1b43e604aac9e076c2849cc

SHA512
71039119f506932ad55db79d5f5301c811e13d8ba931f7e68270dd5319af85c42a584d1c9983deb4f4da2634f4e54fb3326c7f298868ed54584101a068f4c1ee

Download Submit
C:\Windows\System\aWippGA.exe

Filesize
1.7MB

MD5
04cb26ebd16100cd5dc6c0e1676e1e2c

SHA1
9e07b43d18fc538e22498115cdfb3e199f7859ac

SHA256
ae3e23e918c241657e10ca839b7f35f46f51080ac032e1e0e7d9eda265199131

SHA512
079751b52b95ad4125adec22c241cdb129aebc8c0aa8ec17a016ebb2a5d8888c17fff5fa0e0412c4a49afce1356721aaa215007571e6a819a8e13a1cb6e5abdc

Download Submit
C:\Windows\System\bZTIjhZ.exe

Filesize
1.7MB

MD5
2cfcccd10232090bce36ab7fd15c1028

SHA1
8f8086c34597b30ee03a7473c39b1868225451fc

SHA256
6e1207135445cc4118b091a3131f7ec12adc0936c548cc8553c3fbe4124b0250

SHA512
480d57a841c7786feb691d543aa006492feb0dc000e5e6d307bde470b9b215229e8f6a288ed5d0c1942ac4885ad0fdadc62c535e31e99589bf359e8e68adaf57

Download Submit
C:\Windows\System\fIoyvPL.exe

Filesize
1.7MB

MD5
723117852b488cdbc65bf28a3c1e3a3f

SHA1
0065a46138dc730cd1bf74f9aa28dfe0096af1e0

SHA256
8b5a8951561a658ffc33ea3896b77aade9ebaf2f46398c7f8413ead8c4659608

SHA512
580190ecdc3746f77527733c616a2f79d18cd8890e090ca300db3e1c83dadb11da30ca6b8cf47cd619f6b6644a8c63464c737cd70d729e14b9a24f9f5a662c48

Download Submit
C:\Windows\System\fnmnsdv.exe

Filesize
1.7MB

MD5
1b23b183998231d7b15a977c7fbdedff

SHA1
d9175032e7adb11a5546418f668a2b349b2d7fc4

SHA256
c9ab8e6abc018fd9fb12d5fc7e1eeb013f37e49d23e42e8347e72108f7bd1dd7

SHA512
c3e7c8e6f23abb40f793e35196890e773383964389140b8a832ddceb761c0b55ed3f5903be25e43106dd564c3864431c648b4af23272cfd3cc1ccf1df918c0ac

Download Submit
C:\Windows\System\gLMCCqQ.exe

Filesize
1.7MB

MD5
993add7f57088bfebde920ebe0f5a94a

SHA1
061d2a77c0eae48392389d64a269ea2c51feb11f

SHA256
c67568a574d3e947dadbe86beede5964a82a372159cea1c4480c063a20f531b6

SHA512
b61813c7caafb73146c99ddef3ceff7e7f05885954ab0cca9c24c17773503d479fe449985604096f828861a260b5be64f51fa8cda485fcd3d9c14d2547afc12c

Download Submit
C:\Windows\System\iIKFXuH.exe

Filesize
1.7MB

MD5
b46405d426e74af5354436abe998cb49

SHA1
38a2a30c0502e99e972d7be2f03e1680dc538043

SHA256
9527f8a2294a3e4cfc298128eeb4cf13d3467037208defd6baa96f8f1248ee9f

SHA512
129d6037d4dd294016a53701b694d235a114a3c61890da641267a4d6199b34022d68052f80eb94ae72d34c87cdfe7e12c6a0173913b92ca28bfffeb9aa86a106

Download Submit
C:\Windows\System\icbPjYt.exe

Filesize
1.7MB

MD5
4cc5b18f7b215460b681c62214bb9860

SHA1
18d4162d71009f16adf320a114be9bc0ceac1258

SHA256
9d74ec52464bf83a2a9f6762c2544b9f1a774302daae8c64bb9f461197731ae0

SHA512
03648dad38255f918da7695caec5124cbf8a61a0271f59f2428ed8202ccdbcd8ee7734dfe84331187e142c4279c57a421a200b4a441935660caa8258e877ef6b

Download Submit
C:\Windows\System\liUNBKr.exe

Filesize
1.7MB

MD5
ec29d82815872faf6d87e387a2c3c616

SHA1
c2eefdb96a28c79ab4ff12dc1199446ed9b6ba62

SHA256
441be6995218780ca1e8516c3ccb46d6bc79760ab9fd5f85673f1450a9465757

SHA512
3d4ef30188d524b5556e538cebb23dce10c1546676b68661182fc1f62345428e930db60fd27587893aa4cc76a81dd88e5b9901388cbd7589e2a44ae7826c433a

Download Submit
C:\Windows\System\mLLLkiz.exe

Filesize
1.7MB

MD5
337f5dc4611aba3d623c1ea7fbddbe98

SHA1
b9d4cbbbad700c5e31252e815d9a8abd8dbcaff6

SHA256
7eaace5b84e3265298252bb0d6195c13352327e18ee4dc99916985307eb457f3

SHA512
d52984ee9798ea3820a1809913587e9859ab008c11f203451d5538c0d2ff10a5e4b76233f18501f12cdc551796612f28987399b637f976bf49f5075d1a1d6c65

Download Submit
C:\Windows\System\mdSvqWe.exe

Filesize
1.7MB

MD5
663e6e7267d8180d0a688b097e49c8b5

SHA1
8415837b3f9272dd40e10cdca517a4512a1f68f1

SHA256
9f6f1eef4293ae1c563880e8fa39c9b47058455a90c7c378c107a8d1edac5850

SHA512
381e8a335a3a12fde5fb2ea9e5a5298067117cd372bb38c3bc71faa84e1dcfd3f127dfca2ca329fdd92a4f8b18c2e7f3a224da6553731ec79e93fa8864fb0acc

Download Submit
C:\Windows\System\myRRzIb.exe

Filesize
1.7MB

MD5
7dd6ddaf17a562b9fe101f8006217269

SHA1
2cf11bc048a2e255eecf7b719a82ff8b69320947

SHA256
ac600263f5264790f2334eb9831873d514fe5f32ca5f36fe4fd281893fa503d6

SHA512
1b6097c979d49b1f51b14c0d050657dc15983317236a712f9e3b413c42acbbe851ff860233950b539db03391be611b16ad9058bff1c2c73f274bb297793f8f20

Download Submit
C:\Windows\System\nFWeuHB.exe

Filesize
1.7MB

MD5
1147fd09877c362fbe569422952c71c9

SHA1
53a802600f024c0546e67459c3274ab4769d21ed

SHA256
85e8d711856e7e55902f25e83b0bee06681754c019315e6cb62a3276f29968dc

SHA512
af3f974a0d8eebfe38125e236a82e0c02b2f9d83518a7508df9f4c7cfca28c225a5a3e1cebd1a4d60bdbf25fdd68b13658c0b5d40384bf26b3ee43f0a8b4d2ed

Download Submit
C:\Windows\System\pYatkVQ.exe

Filesize
1.7MB

MD5
15bbb23bbb3af7ffe1136933fcae75ad

SHA1
e3af17b1aa288a1dccd62e8d4eb9cb2a73e545f2

SHA256
6b85e2080128410f323790a9c91bff328e862b6f5740dfa30a63a31b06c7775d

SHA512
66e6f4345d2e0d6f5c60be86616a47679fbcfed7a52fb360795082ae75b7c99a806f54ff8a6cbbef5ed2e87d0eb2d56e47e93cdf4f73a8abf3dfdcc4c3b18bed

Download Submit
C:\Windows\System\piPSHVh.exe

Filesize
1.7MB

MD5
42740389ded7ab4cd97c9a4f342f3dc9

SHA1
96f71de2b7943f2b769590cf89e5eaeea1bc0701

SHA256
70c5262c6ad1cf59bed73e1beba81e1c35b2e4031358892154c65121279f16d2

SHA512
c133757518b58df6ab240193f180ab891f7041a2441e9eae75c21b2ef5a4266e93e119bd49c46a3c8ec32e878c4c48a1085f1fac519b368438371fd7d5b4b629

Download Submit
C:\Windows\System\qcXWysl.exe

Filesize
1.7MB

MD5
e2ffe3dcc8ed30c6ac5dece3d2811893

SHA1
2193ccabdfacf83ed75f04477b1fc0ff116f4cc7

SHA256
96eb00e6a6ce211a3756744a03736e48779ecf7a6204d09b197de4cae5df3a4e

SHA512
801fb6a62fcf4b8ef9a12290b651954ecdc61364e08b06cfe05fe5b3db0b9b36f4c77bc6e2582335a97499e92f3eaec2028b8b5cdd0d695822d982decf823ab8

Download Submit
C:\Windows\System\qgNDGsb.exe

Filesize
1.7MB

MD5
4b00af23a3100d39aa30a1c5f39b57fa

SHA1
16c65c330a0593f8d789ec9e0aa6c0ea16e49b4e

SHA256
51f64e4a754f54427535e57ae5af3c1d50f3e1cebfd184ff245656bdbc7debdb

SHA512
eaa942020c12b476b740695ea547ed2ddcb01a679625eb1e1cda18e53e614eb37a312b6ee6485a9eae4a3ba3e283f71f0480944017eadd42bdbe7b41c81b4150

Download Submit
C:\Windows\System\rAArGxv.exe

Filesize
1.7MB

MD5
f551628748591d31c75d5a01415d70cb

SHA1
a675fd93cbba2aed880460781ca7cbc654ce66cc

SHA256
28a1d89a7d710c67411188a256fbbb53f5c582fba8abd1d88d4308927aabef06

SHA512
7c132a99d8274920e0af24d0bce8d5847b188cd54b8d63306932032fd5b68c0d3675d53c0bdd7f31af8fbec0dc86f8818f70c51faafc689f9a58f79aba4c71c3

Download Submit
C:\Windows\System\unoIfpu.exe

Filesize
1.7MB

MD5
0fb6bc82cd601896e8fc04444b507f5c

SHA1
2dd956fe53152e7f736b78681c6fb3b86377d7c9

SHA256
ec6a289d6a3c0e0f7ac7bc973421783763e7c5d9896c280496e2757f38e225f6

SHA512
aead0348ed5094b6aa6b19a5cffc19825ffe5d62310981abdb5a2a93ece863c5efbc0b2667be1a94ba37f53df4d1827f3eaac49711ea3fdfa19259087fa6f676

Download Submit
C:\Windows\System\xJfHEXZ.exe

Filesize
1.7MB

MD5
df6d724cdf2e22a017bbf083d0199372

SHA1
bc95a0d80a976d5e628206edb726c642139ac60a

SHA256
d8d10ab7a73637c09fc41eee0f89a44764018e8f5e9f19ed40d7e7de6ffddc92

SHA512
934b2940b10b7f1ec96dee29009a37d2b6d53c06684ff1d3c59f8d885fec2bd5d047220d0be651606cb3d45595140c22aa15bbca057c0940af4fa3a03737729e

Download Submit
C:\Windows\System\xRpXWKW.exe

Filesize
1.7MB

MD5
ad87b03a57e045cba676491f01b34ac1

SHA1
0d5ab09b3fcc2f7043b3fdeb0480fd7700620b7c

SHA256
52c524c6e0443a5bac27bd1771182fec3ab65760ea34ccc37d590471106ca919

SHA512
d14fb542a83cedad7955d457769b3f2399a1733ce52181c95e47e58982e184d1c5cb910fedc737bd37b749960519654d0f16ef22c894f83a48a3c06279074363

Download Submit
memory/60-271-0x00007FF6F4D70000-0x00007FF6F5162000-memory.dmp

Filesize
3.9MB

Download
memory/60-4888-0x00007FF6F4D70000-0x00007FF6F5162000-memory.dmp

Filesize
3.9MB

Download
memory/944-367-0x00007FF79A7A0000-0x00007FF79AB92000-memory.dmp

Filesize
3.9MB

Download
memory/944-4882-0x00007FF79A7A0000-0x00007FF79AB92000-memory.dmp

Filesize
3.9MB

Download
memory/972-4894-0x00007FF7073B0000-0x00007FF7077A2000-memory.dmp

Filesize
3.9MB

Download
memory/972-215-0x00007FF7073B0000-0x00007FF7077A2000-memory.dmp

Filesize
3.9MB

Download
memory/976-175-0x00007FF685B30000-0x00007FF685F22000-memory.dmp

Filesize
3.9MB

Download
memory/976-4878-0x00007FF685B30000-0x00007FF685F22000-memory.dmp

Filesize
3.9MB

Download
memory/1008-4931-0x00007FF6D82F0000-0x00007FF6D86E2000-memory.dmp

Filesize
3.9MB

Download
memory/1008-316-0x00007FF6D82F0000-0x00007FF6D86E2000-memory.dmp

Filesize
3.9MB

Download
memory/1064-4875-0x00007FF6CEFE0000-0x00007FF6CF3D2000-memory.dmp

Filesize
3.9MB

Download
memory/1064-205-0x00007FF6CEFE0000-0x00007FF6CF3D2000-memory.dmp

Filesize
3.9MB

Download
memory/1292-4912-0x00007FF66B550000-0x00007FF66B942000-memory.dmp

Filesize
3.9MB

Download
memory/1292-216-0x00007FF66B550000-0x00007FF66B942000-memory.dmp

Filesize
3.9MB

Download
memory/1636-4941-0x00007FF636470000-0x00007FF636862000-memory.dmp

Filesize
3.9MB

Download
memory/1636-368-0x00007FF636470000-0x00007FF636862000-memory.dmp

Filesize
3.9MB

Download
memory/1828-4920-0x00007FF7FB330000-0x00007FF7FB722000-memory.dmp

Filesize
3.9MB

Download
memory/1828-238-0x00007FF7FB330000-0x00007FF7FB722000-memory.dmp

Filesize
3.9MB

Download
memory/2132-364-0x00007FF677E00000-0x00007FF6781F2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-359-0x00007FF7359B0000-0x00007FF735DA2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-4924-0x00007FF7359B0000-0x00007FF735DA2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-4947-0x00007FF7C78C0000-0x00007FF7C7CB2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-362-0x00007FF7C78C0000-0x00007FF7C7CB2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-4936-0x00007FF7DE0D0000-0x00007FF7DE4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-280-0x00007FF7DE0D0000-0x00007FF7DE4C2000-memory.dmp

Filesize
3.9MB

Download
memory/3348-363-0x00007FF7F6D10000-0x00007FF7F7102000-memory.dmp

Filesize
3.9MB

Download
memory/3348-4954-0x00007FF7F6D10000-0x00007FF7F7102000-memory.dmp

Filesize
3.9MB

Download
memory/3532-133-0x00007FF7B9260000-0x00007FF7B9652000-memory.dmp

Filesize
3.9MB

Download
memory/3596-101-0x00007FF75C630000-0x00007FF75CA22000-memory.dmp

Filesize
3.9MB

Download
memory/4168-136-0x00007FF6C4B30000-0x00007FF6C4F22000-memory.dmp

Filesize
3.9MB

Download
memory/4212-366-0x00007FF61C700000-0x00007FF61CAF2000-memory.dmp

Filesize
3.9MB

Download
memory/4404-4933-0x00007FF75E6A0000-0x00007FF75EA92000-memory.dmp

Filesize
3.9MB

Download
memory/4404-365-0x00007FF75E6A0000-0x00007FF75EA92000-memory.dmp

Filesize
3.9MB

Download
memory/4416-0-0x00007FF761FB0000-0x00007FF7623A2000-memory.dmp

Filesize
3.9MB

Download
memory/4416-1-0x0000024287B70000-0x0000024287B80000-memory.dmp

Filesize
64KB

Download
memory/4772-17-0x00007FF6FD2F0000-0x00007FF6FD6E2000-memory.dmp

Filesize
3.9MB

Download
memory/4844-52-0x0000021EDE000000-0x0000021EDE022000-memory.dmp

Filesize
136KB

Download
memory/4844-79-0x0000021EDC680000-0x0000021EDC690000-memory.dmp

Filesize
64KB

Download
memory/4844-77-0x00007FF896300000-0x00007FF896DC1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-78-0x0000021EDC680000-0x0000021EDC690000-memory.dmp

Filesize
64KB

Download
memory/4884-4922-0x00007FF6BDFE0000-0x00007FF6BE3D2000-memory.dmp

Filesize
3.9MB

Download
memory/4884-270-0x00007FF6BDFE0000-0x00007FF6BE3D2000-memory.dmp

Filesize
3.9MB

Download