xmrig | b7d2ba245679aee34b115ebd8b721d8f6fb3b153fc792b93c480b933370ef061

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
Size

1.5MB
MD5

01ac27cf02bdcd3321f3eada6b20b214
SHA1

5fcd46eb3085f180d629f2f49e95fc8c887d64d4
SHA256

b7d2ba245679aee34b115ebd8b721d8f6fb3b153fc792b93c480b933370ef061
SHA512

56279085894fb4ba72b68817a5d38d60cca4f497a87286d1292c770220b6be6930cd0212cb9fa85d753dd5ceb0fafd8c6f79e0f6b1e69a6b07aa7fea17580ac3
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VxjzSRLgxc2x:Lz071uv4BPMkibTIA5CJKxG

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral2/memory/1224-39-0x00007FF610810000-0x00007FF610C02000-memory.dmp	xmrig
behavioral2/memory/3900-169-0x00007FF7BC8F0000-0x00007FF7BCCE2000-memory.dmp	xmrig
behavioral2/memory/4880-168-0x00007FF75F810000-0x00007FF75FC02000-memory.dmp	xmrig
behavioral2/memory/3788-155-0x00007FF78DBF0000-0x00007FF78DFE2000-memory.dmp	xmrig
behavioral2/memory/4928-154-0x00007FF7F7A90000-0x00007FF7F7E82000-memory.dmp	xmrig
behavioral2/memory/3440-141-0x00007FF6DFEB0000-0x00007FF6E02A2000-memory.dmp	xmrig
behavioral2/memory/4452-100-0x00007FF64BD20000-0x00007FF64C112000-memory.dmp	xmrig
behavioral2/memory/3028-96-0x00007FF7A5830000-0x00007FF7A5C22000-memory.dmp	xmrig
behavioral2/memory/4228-92-0x00007FF60E0B0000-0x00007FF60E4A2000-memory.dmp	xmrig
behavioral2/memory/828-89-0x00007FF7201D0000-0x00007FF7205C2000-memory.dmp	xmrig
behavioral2/memory/4552-79-0x00007FF7938A0000-0x00007FF793C92000-memory.dmp	xmrig
behavioral2/memory/664-75-0x00007FF71BEF0000-0x00007FF71C2E2000-memory.dmp	xmrig
behavioral2/memory/3788-25-0x00007FF78DBF0000-0x00007FF78DFE2000-memory.dmp	xmrig
behavioral2/memory/1224-1383-0x00007FF610810000-0x00007FF610C02000-memory.dmp	xmrig
behavioral2/memory/664-2016-0x00007FF71BEF0000-0x00007FF71C2E2000-memory.dmp	xmrig
behavioral2/memory/1348-2013-0x00007FF6B0A60000-0x00007FF6B0E52000-memory.dmp	xmrig
behavioral2/memory/5000-2022-0x00007FF673020000-0x00007FF673412000-memory.dmp	xmrig
behavioral2/memory/4540-2554-0x00007FF685D60000-0x00007FF686152000-memory.dmp	xmrig
behavioral2/memory/1244-2555-0x00007FF76C040000-0x00007FF76C432000-memory.dmp	xmrig
behavioral2/memory/1824-2556-0x00007FF760680000-0x00007FF760A72000-memory.dmp	xmrig
behavioral2/memory/1940-3317-0x00007FF7E8690000-0x00007FF7E8A82000-memory.dmp	xmrig
behavioral2/memory/4544-4053-0x00007FF62B7D0000-0x00007FF62BBC2000-memory.dmp	xmrig
behavioral2/memory/3900-5727-0x00007FF7BC8F0000-0x00007FF7BCCE2000-memory.dmp	xmrig
behavioral2/memory/664-5793-0x00007FF71BEF0000-0x00007FF71C2E2000-memory.dmp	xmrig
behavioral2/memory/2324-5852-0x00007FF7CC2A0000-0x00007FF7CC692000-memory.dmp	xmrig
behavioral2/memory/828-5857-0x00007FF7201D0000-0x00007FF7205C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4928	CRpkebd.exe
3788	VgKdMxo.exe
4880	uEnZAqp.exe
3900	SBzJxbt.exe
1224	RtxploK.exe
2196	lXJmPcC.exe
4228	snUiYfd.exe
1348	cutlmrM.exe
3028	HzbsEsG.exe
664	AyxcMSq.exe
4552	tTQutuI.exe
4452	OZZCeYu.exe
5000	FFSGMAE.exe
2324	kmUdGrs.exe
828	SNYnIvI.exe
4540	AItwFTB.exe
1244	pjTsdOH.exe
1824	YJjgWxu.exe
4480	kkqIhWw.exe
1940	lyWNGxn.exe
1780	SWyRbzs.exe
4544	tvhaMgz.exe
3312	obiOVsx.exe
3332	NNYrzfh.exe
2268	KmpWhBO.exe
4784	dNdesfB.exe
1580	tWHNOSd.exe
772	ElIwVAM.exe
3572	wOFeomi.exe
4028	GTAqwSL.exe
4036	GuLMzao.exe
4580	whMGeXg.exe
1852	XjlOiAY.exe
2900	gmbEKcs.exe
3396	RuirnIz.exe
4600	CsnCvJO.exe
3912	UjKsNtU.exe
3416	rvgbTii.exe
1276	TUYCCHR.exe
4980	spEIdwm.exe
3692	chInsMD.exe
432	LbhWtCC.exe
2236	vabNvjB.exe
1508	iwQsDiX.exe
3612	NuPITAB.exe
3300	shJHfMr.exe
2120	XDDnEBo.exe
4956	pkCECyP.exe
4272	bNQzbiq.exe
2024	YWomqjP.exe
1972	ZhRCYEx.exe
3752	EyUECLR.exe
2892	EqjCGdG.exe
3080	EiiIqBP.exe
4368	wzmwjPk.exe
1944	PDrgbOV.exe
2548	gmUoUrH.exe
636	KoMYiED.exe
1564	OlmUnnE.exe
4840	yeMlBIZ.exe
392	GJGfhxt.exe
1180	WWlCROt.exe
4492	JTzghXw.exe
2012	psNgjMt.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3440-0-0x00007FF6DFEB0000-0x00007FF6E02A2000-memory.dmp	upx
behavioral2/files/0x000c000000023b44-5.dat	upx
behavioral2/files/0x000a000000023ba8-9.dat	upx
behavioral2/files/0x000a000000023ba9-19.dat	upx
behavioral2/files/0x000a000000023baa-30.dat	upx
behavioral2/memory/1224-39-0x00007FF610810000-0x00007FF610C02000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-41.dat	upx
behavioral2/files/0x000a000000023bab-46.dat	upx
behavioral2/files/0x000a000000023bac-52.dat	upx
behavioral2/files/0x000a000000023bae-61.dat	upx
behavioral2/files/0x000a000000023bb1-65.dat	upx
behavioral2/files/0x000a000000023bb3-77.dat	upx
behavioral2/memory/5000-82-0x00007FF673020000-0x00007FF673412000-memory.dmp	upx
behavioral2/files/0x000b000000023ba5-117.dat	upx
behavioral2/memory/4480-128-0x00007FF745BE0000-0x00007FF745FD2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbb-149.dat	upx
behavioral2/files/0x000a000000023bbd-163.dat	upx
behavioral2/files/0x000a000000023bc0-177.dat	upx
behavioral2/files/0x000a000000023bc4-197.dat	upx
behavioral2/files/0x000a000000023bc5-202.dat	upx
behavioral2/files/0x000a000000023bc3-200.dat	upx
behavioral2/files/0x000a000000023bc2-195.dat	upx
behavioral2/files/0x000a000000023bc1-190.dat	upx
behavioral2/files/0x000a000000023bbf-180.dat	upx
behavioral2/files/0x000b000000023bb8-175.dat	upx
behavioral2/files/0x000a000000023bbe-170.dat	upx
behavioral2/memory/3900-169-0x00007FF7BC8F0000-0x00007FF7BCCE2000-memory.dmp	upx
behavioral2/memory/4880-168-0x00007FF75F810000-0x00007FF75FC02000-memory.dmp	upx
behavioral2/memory/3332-162-0x00007FF777B70000-0x00007FF777F62000-memory.dmp	upx
behavioral2/files/0x000a000000023bbc-157.dat	upx
behavioral2/memory/3312-156-0x00007FF683270000-0x00007FF683662000-memory.dmp	upx
behavioral2/memory/3788-155-0x00007FF78DBF0000-0x00007FF78DFE2000-memory.dmp	upx
behavioral2/memory/4928-154-0x00007FF7F7A90000-0x00007FF7F7E82000-memory.dmp	upx
behavioral2/memory/4544-148-0x00007FF62B7D0000-0x00007FF62BBC2000-memory.dmp	upx
behavioral2/files/0x000b000000023bb9-143.dat	upx
behavioral2/memory/1780-142-0x00007FF6230A0000-0x00007FF623492000-memory.dmp	upx
behavioral2/memory/3440-141-0x00007FF6DFEB0000-0x00007FF6E02A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-136.dat	upx
behavioral2/memory/1940-135-0x00007FF7E8690000-0x00007FF7E8A82000-memory.dmp	upx
behavioral2/files/0x0031000000023bb7-130.dat	upx
behavioral2/files/0x0031000000023bb6-123.dat	upx
behavioral2/memory/1824-122-0x00007FF760680000-0x00007FF760A72000-memory.dmp	upx
behavioral2/memory/1244-116-0x00007FF76C040000-0x00007FF76C432000-memory.dmp	upx
behavioral2/memory/4540-115-0x00007FF685D60000-0x00007FF686152000-memory.dmp	upx
behavioral2/files/0x0031000000023bb5-110.dat	upx
behavioral2/memory/4452-100-0x00007FF64BD20000-0x00007FF64C112000-memory.dmp	upx
behavioral2/memory/3028-96-0x00007FF7A5830000-0x00007FF7A5C22000-memory.dmp	upx
behavioral2/memory/4228-92-0x00007FF60E0B0000-0x00007FF60E4A2000-memory.dmp	upx
behavioral2/memory/828-89-0x00007FF7201D0000-0x00007FF7205C2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb4-86.dat	upx
behavioral2/memory/2324-83-0x00007FF7CC2A0000-0x00007FF7CC692000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-80.dat	upx
behavioral2/memory/4552-79-0x00007FF7938A0000-0x00007FF793C92000-memory.dmp	upx
behavioral2/memory/664-75-0x00007FF71BEF0000-0x00007FF71C2E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-69.dat	upx
behavioral2/memory/1348-59-0x00007FF6B0A60000-0x00007FF6B0E52000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-57.dat	upx
behavioral2/memory/2196-44-0x00007FF791300000-0x00007FF7916F2000-memory.dmp	upx
behavioral2/memory/3900-34-0x00007FF7BC8F0000-0x00007FF7BCCE2000-memory.dmp	upx
behavioral2/memory/4880-26-0x00007FF75F810000-0x00007FF75FC02000-memory.dmp	upx
behavioral2/memory/3788-25-0x00007FF78DBF0000-0x00007FF78DFE2000-memory.dmp	upx
behavioral2/files/0x000b000000023ba4-15.dat	upx
behavioral2/memory/4928-6-0x00007FF7F7A90000-0x00007FF7F7E82000-memory.dmp	upx
behavioral2/memory/1224-1383-0x00007FF610810000-0x00007FF610C02000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fSreckB.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\gKedTSK.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\wilPCJH.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\SuxgCWe.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\ibHLUUJ.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\TOmyobo.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\oJZeIJG.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\bcLHFrP.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\ZCrZAYs.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\hFmdYVi.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\LQgdKeE.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\CXKyMXa.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\ScKUoLK.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\EijHsMe.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\dJRiFif.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\bCVKbhO.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\EyZckKm.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\IYixNDi.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\gVMVYrY.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\dwQbBUu.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\DGLUSwv.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\EKdaaQL.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\wRikNAP.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\XGFgmTp.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\fsTcyqJ.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\ukTJFMV.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\xJkkUOZ.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\nrbGvxG.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\MdbMwiA.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\WRkORnK.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\VoLXLlz.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\zYJRZgZ.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\yKfhJQt.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\BbiDkwN.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\IvgOaOf.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\IyDGXfS.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\XEWqsIz.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\bjcvZJF.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\vvAIhnC.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\EtHSjwi.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\PzMDYHh.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\iZiSkXz.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\plUSDBH.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\wyvuWUy.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\SKriTtR.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\iPMHHYK.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\mCIIhwe.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\nixvTgD.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\MQEumqb.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\zveNcji.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\kPzsqfV.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\fwprtzj.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\tSCiycY.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\JXyeuTl.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\UvVoThj.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\FgqGjkp.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\yhxoHLK.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\VBTaYsj.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\ULjlUCo.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\gwMwibr.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\VvpFSYR.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\LRwEiqM.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\ndxqMYn.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\EYDECaF.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2436	powershell.exe
2436	powershell.exe
2436	powershell.exe
2436	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeCreateGlobalPrivilege	12720	dwm.exe
Token: SeChangeNotifyPrivilege	12720	dwm.exe
Token: 33	12720	dwm.exe
Token: SeIncBasePriorityPrivilege	12720	dwm.exe
Token: SeCreateGlobalPrivilege	13548	dwm.exe
Token: SeChangeNotifyPrivilege	13548	dwm.exe
Token: 33	13548	dwm.exe
Token: SeIncBasePriorityPrivilege	13548	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 2436	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	85
PID 3440 wrote to memory of 2436	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	85
PID 3440 wrote to memory of 4928	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	86
PID 3440 wrote to memory of 4928	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	86
PID 3440 wrote to memory of 3788	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	87
PID 3440 wrote to memory of 3788	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	87
PID 3440 wrote to memory of 4880	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	88
PID 3440 wrote to memory of 4880	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	88
PID 3440 wrote to memory of 3900	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	89
PID 3440 wrote to memory of 3900	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	89
PID 3440 wrote to memory of 1224	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	90
PID 3440 wrote to memory of 1224	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	90
PID 3440 wrote to memory of 2196	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	91
PID 3440 wrote to memory of 2196	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	91
PID 3440 wrote to memory of 4228	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	92
PID 3440 wrote to memory of 4228	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	92
PID 3440 wrote to memory of 1348	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	93
PID 3440 wrote to memory of 1348	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	93
PID 3440 wrote to memory of 3028	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	94
PID 3440 wrote to memory of 3028	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	94
PID 3440 wrote to memory of 664	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	95
PID 3440 wrote to memory of 664	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	95
PID 3440 wrote to memory of 4552	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	96
PID 3440 wrote to memory of 4552	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	96
PID 3440 wrote to memory of 4452	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	97
PID 3440 wrote to memory of 4452	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	97
PID 3440 wrote to memory of 5000	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	98
PID 3440 wrote to memory of 5000	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	98
PID 3440 wrote to memory of 2324	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	99
PID 3440 wrote to memory of 2324	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	99
PID 3440 wrote to memory of 828	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	100
PID 3440 wrote to memory of 828	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	100
PID 3440 wrote to memory of 4540	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	101
PID 3440 wrote to memory of 4540	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	101
PID 3440 wrote to memory of 1244	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	102
PID 3440 wrote to memory of 1244	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	102
PID 3440 wrote to memory of 1824	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	103
PID 3440 wrote to memory of 1824	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	103
PID 3440 wrote to memory of 4480	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	104
PID 3440 wrote to memory of 4480	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	104
PID 3440 wrote to memory of 1940	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	105
PID 3440 wrote to memory of 1940	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	105
PID 3440 wrote to memory of 1780	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	106
PID 3440 wrote to memory of 1780	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	106
PID 3440 wrote to memory of 4544	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	107
PID 3440 wrote to memory of 4544	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	107
PID 3440 wrote to memory of 3312	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	108
PID 3440 wrote to memory of 3312	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	108
PID 3440 wrote to memory of 3332	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	109
PID 3440 wrote to memory of 3332	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	109
PID 3440 wrote to memory of 2268	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	110
PID 3440 wrote to memory of 2268	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	110
PID 3440 wrote to memory of 4784	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	111
PID 3440 wrote to memory of 4784	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	111
PID 3440 wrote to memory of 1580	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	112
PID 3440 wrote to memory of 1580	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	112
PID 3440 wrote to memory of 772	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	113
PID 3440 wrote to memory of 772	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	113
PID 3440 wrote to memory of 3572	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	114
PID 3440 wrote to memory of 3572	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	114
PID 3440 wrote to memory of 4028	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	115
PID 3440 wrote to memory of 4028	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	115
PID 3440 wrote to memory of 4036	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	116
PID 3440 wrote to memory of 4036	3440	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- C:\Windows\System\CRpkebd.exe
  C:\Windows\System\CRpkebd.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\VgKdMxo.exe
  C:\Windows\System\VgKdMxo.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\uEnZAqp.exe
  C:\Windows\System\uEnZAqp.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\SBzJxbt.exe
  C:\Windows\System\SBzJxbt.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\RtxploK.exe
  C:\Windows\System\RtxploK.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\lXJmPcC.exe
  C:\Windows\System\lXJmPcC.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\snUiYfd.exe
  C:\Windows\System\snUiYfd.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\cutlmrM.exe
  C:\Windows\System\cutlmrM.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\HzbsEsG.exe
  C:\Windows\System\HzbsEsG.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\AyxcMSq.exe
  C:\Windows\System\AyxcMSq.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\tTQutuI.exe
  C:\Windows\System\tTQutuI.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\OZZCeYu.exe
  C:\Windows\System\OZZCeYu.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\FFSGMAE.exe
  C:\Windows\System\FFSGMAE.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\kmUdGrs.exe
  C:\Windows\System\kmUdGrs.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\SNYnIvI.exe
  C:\Windows\System\SNYnIvI.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\AItwFTB.exe
  C:\Windows\System\AItwFTB.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\pjTsdOH.exe
  C:\Windows\System\pjTsdOH.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\YJjgWxu.exe
  C:\Windows\System\YJjgWxu.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\kkqIhWw.exe
  C:\Windows\System\kkqIhWw.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\lyWNGxn.exe
  C:\Windows\System\lyWNGxn.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\SWyRbzs.exe
  C:\Windows\System\SWyRbzs.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\tvhaMgz.exe
  C:\Windows\System\tvhaMgz.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\obiOVsx.exe
  C:\Windows\System\obiOVsx.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\NNYrzfh.exe
  C:\Windows\System\NNYrzfh.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\KmpWhBO.exe
  C:\Windows\System\KmpWhBO.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\dNdesfB.exe
  C:\Windows\System\dNdesfB.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\tWHNOSd.exe
  C:\Windows\System\tWHNOSd.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\ElIwVAM.exe
  C:\Windows\System\ElIwVAM.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\wOFeomi.exe
  C:\Windows\System\wOFeomi.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\GTAqwSL.exe
  C:\Windows\System\GTAqwSL.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\GuLMzao.exe
  C:\Windows\System\GuLMzao.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\whMGeXg.exe
  C:\Windows\System\whMGeXg.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\XjlOiAY.exe
  C:\Windows\System\XjlOiAY.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\gmbEKcs.exe
  C:\Windows\System\gmbEKcs.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\RuirnIz.exe
  C:\Windows\System\RuirnIz.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\CsnCvJO.exe
  C:\Windows\System\CsnCvJO.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\UjKsNtU.exe
  C:\Windows\System\UjKsNtU.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\rvgbTii.exe
  C:\Windows\System\rvgbTii.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\TUYCCHR.exe
  C:\Windows\System\TUYCCHR.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\spEIdwm.exe
  C:\Windows\System\spEIdwm.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\chInsMD.exe
  C:\Windows\System\chInsMD.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\LbhWtCC.exe
  C:\Windows\System\LbhWtCC.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\vabNvjB.exe
  C:\Windows\System\vabNvjB.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\iwQsDiX.exe
  C:\Windows\System\iwQsDiX.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\NuPITAB.exe
  C:\Windows\System\NuPITAB.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\shJHfMr.exe
  C:\Windows\System\shJHfMr.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\XDDnEBo.exe
  C:\Windows\System\XDDnEBo.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\pkCECyP.exe
  C:\Windows\System\pkCECyP.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\bNQzbiq.exe
  C:\Windows\System\bNQzbiq.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\YWomqjP.exe
  C:\Windows\System\YWomqjP.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\ZhRCYEx.exe
  C:\Windows\System\ZhRCYEx.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\EyUECLR.exe
  C:\Windows\System\EyUECLR.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\EqjCGdG.exe
  C:\Windows\System\EqjCGdG.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\EiiIqBP.exe
  C:\Windows\System\EiiIqBP.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\wzmwjPk.exe
  C:\Windows\System\wzmwjPk.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\PDrgbOV.exe
  C:\Windows\System\PDrgbOV.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\gmUoUrH.exe
  C:\Windows\System\gmUoUrH.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\KoMYiED.exe
  C:\Windows\System\KoMYiED.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\OlmUnnE.exe
  C:\Windows\System\OlmUnnE.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\yeMlBIZ.exe
  C:\Windows\System\yeMlBIZ.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\GJGfhxt.exe
  C:\Windows\System\GJGfhxt.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\WWlCROt.exe
  C:\Windows\System\WWlCROt.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\JTzghXw.exe
  C:\Windows\System\JTzghXw.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\psNgjMt.exe
  C:\Windows\System\psNgjMt.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\zqwTCYv.exe
  C:\Windows\System\zqwTCYv.exe
  2⤵
  PID:5144
- C:\Windows\System\ziMNZlj.exe
  C:\Windows\System\ziMNZlj.exe
  2⤵
  PID:5172
- C:\Windows\System\EaNDYUJ.exe
  C:\Windows\System\EaNDYUJ.exe
  2⤵
  PID:5200
- C:\Windows\System\iPfvFbL.exe
  C:\Windows\System\iPfvFbL.exe
  2⤵
  PID:5232
- C:\Windows\System\nvSHNRy.exe
  C:\Windows\System\nvSHNRy.exe
  2⤵
  PID:5260
- C:\Windows\System\BjnjnnC.exe
  C:\Windows\System\BjnjnnC.exe
  2⤵
  PID:5288
- C:\Windows\System\NTCozhw.exe
  C:\Windows\System\NTCozhw.exe
  2⤵
  PID:5316
- C:\Windows\System\nlWqeUe.exe
  C:\Windows\System\nlWqeUe.exe
  2⤵
  PID:5340
- C:\Windows\System\StBVGJB.exe
  C:\Windows\System\StBVGJB.exe
  2⤵
  PID:5372
- C:\Windows\System\TEdlnlo.exe
  C:\Windows\System\TEdlnlo.exe
  2⤵
  PID:5400
- C:\Windows\System\mZJYpLh.exe
  C:\Windows\System\mZJYpLh.exe
  2⤵
  PID:5432
- C:\Windows\System\ZvhHhqn.exe
  C:\Windows\System\ZvhHhqn.exe
  2⤵
  PID:5456
- C:\Windows\System\mpkkCin.exe
  C:\Windows\System\mpkkCin.exe
  2⤵
  PID:5488
- C:\Windows\System\cVLpOcI.exe
  C:\Windows\System\cVLpOcI.exe
  2⤵
  PID:5512
- C:\Windows\System\TUbfzXj.exe
  C:\Windows\System\TUbfzXj.exe
  2⤵
  PID:5540
- C:\Windows\System\HkPPakW.exe
  C:\Windows\System\HkPPakW.exe
  2⤵
  PID:5568
- C:\Windows\System\rFPamvm.exe
  C:\Windows\System\rFPamvm.exe
  2⤵
  PID:5596
- C:\Windows\System\LMyqxgq.exe
  C:\Windows\System\LMyqxgq.exe
  2⤵
  PID:5624
- C:\Windows\System\ZsDOexb.exe
  C:\Windows\System\ZsDOexb.exe
  2⤵
  PID:5652
- C:\Windows\System\soowpqo.exe
  C:\Windows\System\soowpqo.exe
  2⤵
  PID:5680
- C:\Windows\System\MfCwLpw.exe
  C:\Windows\System\MfCwLpw.exe
  2⤵
  PID:5708
- C:\Windows\System\dcjDmXs.exe
  C:\Windows\System\dcjDmXs.exe
  2⤵
  PID:5736
- C:\Windows\System\MRJtLjT.exe
  C:\Windows\System\MRJtLjT.exe
  2⤵
  PID:5764
- C:\Windows\System\OIlWMjw.exe
  C:\Windows\System\OIlWMjw.exe
  2⤵
  PID:5788
- C:\Windows\System\utEAZLz.exe
  C:\Windows\System\utEAZLz.exe
  2⤵
  PID:5820
- C:\Windows\System\esWCZed.exe
  C:\Windows\System\esWCZed.exe
  2⤵
  PID:5848
- C:\Windows\System\gFNqViY.exe
  C:\Windows\System\gFNqViY.exe
  2⤵
  PID:5876
- C:\Windows\System\tpEGXkD.exe
  C:\Windows\System\tpEGXkD.exe
  2⤵
  PID:5904
- C:\Windows\System\mtYKovT.exe
  C:\Windows\System\mtYKovT.exe
  2⤵
  PID:5932
- C:\Windows\System\wopvXId.exe
  C:\Windows\System\wopvXId.exe
  2⤵
  PID:5960
- C:\Windows\System\AluDjaM.exe
  C:\Windows\System\AluDjaM.exe
  2⤵
  PID:5988
- C:\Windows\System\xgxuPNV.exe
  C:\Windows\System\xgxuPNV.exe
  2⤵
  PID:6020
- C:\Windows\System\otHNiHm.exe
  C:\Windows\System\otHNiHm.exe
  2⤵
  PID:6052
- C:\Windows\System\aqZPNAv.exe
  C:\Windows\System\aqZPNAv.exe
  2⤵
  PID:6072
- C:\Windows\System\MewfuNr.exe
  C:\Windows\System\MewfuNr.exe
  2⤵
  PID:6100
- C:\Windows\System\mjhZADs.exe
  C:\Windows\System\mjhZADs.exe
  2⤵
  PID:6124
- C:\Windows\System\ZgIPZWG.exe
  C:\Windows\System\ZgIPZWG.exe
  2⤵
  PID:2940
- C:\Windows\System\ufQuYXu.exe
  C:\Windows\System\ufQuYXu.exe
  2⤵
  PID:2904
- C:\Windows\System\HyOUEFa.exe
  C:\Windows\System\HyOUEFa.exe
  2⤵
  PID:2528
- C:\Windows\System\MBxnOoQ.exe
  C:\Windows\System\MBxnOoQ.exe
  2⤵
  PID:2220
- C:\Windows\System\sJfIMJI.exe
  C:\Windows\System\sJfIMJI.exe
  2⤵
  PID:1784
- C:\Windows\System\ZRaLHHW.exe
  C:\Windows\System\ZRaLHHW.exe
  2⤵
  PID:1444
- C:\Windows\System\vHVveEA.exe
  C:\Windows\System\vHVveEA.exe
  2⤵
  PID:5164
- C:\Windows\System\vMoYZRK.exe
  C:\Windows\System\vMoYZRK.exe
  2⤵
  PID:4136
- C:\Windows\System\ykBcnhB.exe
  C:\Windows\System\ykBcnhB.exe
  2⤵
  PID:5300
- C:\Windows\System\KTGubxt.exe
  C:\Windows\System\KTGubxt.exe
  2⤵
  PID:5360
- C:\Windows\System\QmIAgav.exe
  C:\Windows\System\QmIAgav.exe
  2⤵
  PID:1612
- C:\Windows\System\kjlrfsC.exe
  C:\Windows\System\kjlrfsC.exe
  2⤵
  PID:5468
- C:\Windows\System\REmyJdM.exe
  C:\Windows\System\REmyJdM.exe
  2⤵
  PID:5528
- C:\Windows\System\kyuKrRL.exe
  C:\Windows\System\kyuKrRL.exe
  2⤵
  PID:5584
- C:\Windows\System\DQuKnlM.exe
  C:\Windows\System\DQuKnlM.exe
  2⤵
  PID:5648
- C:\Windows\System\fgYNOWF.exe
  C:\Windows\System\fgYNOWF.exe
  2⤵
  PID:5720
- C:\Windows\System\urNtDTs.exe
  C:\Windows\System\urNtDTs.exe
  2⤵
  PID:5780
- C:\Windows\System\FoqvQuT.exe
  C:\Windows\System\FoqvQuT.exe
  2⤵
  PID:5832
- C:\Windows\System\NkpiUiT.exe
  C:\Windows\System\NkpiUiT.exe
  2⤵
  PID:5892
- C:\Windows\System\QfftKUE.exe
  C:\Windows\System\QfftKUE.exe
  2⤵
  PID:5952
- C:\Windows\System\SsDhGUy.exe
  C:\Windows\System\SsDhGUy.exe
  2⤵
  PID:6000
- C:\Windows\System\OWbAgMC.exe
  C:\Windows\System\OWbAgMC.exe
  2⤵
  PID:6068
- C:\Windows\System\kwNuuvV.exe
  C:\Windows\System\kwNuuvV.exe
  2⤵
  PID:6140
- C:\Windows\System\VNhqNnt.exe
  C:\Windows\System\VNhqNnt.exe
  2⤵
  PID:2720
- C:\Windows\System\sPckCYm.exe
  C:\Windows\System\sPckCYm.exe
  2⤵
  PID:4912
- C:\Windows\System\BmeWPwk.exe
  C:\Windows\System\BmeWPwk.exe
  2⤵
  PID:1756
- C:\Windows\System\eEgRWgH.exe
  C:\Windows\System\eEgRWgH.exe
  2⤵
  PID:5132
- C:\Windows\System\gGMcsDw.exe
  C:\Windows\System\gGMcsDw.exe
  2⤵
  PID:5276
- C:\Windows\System\oQkjzJQ.exe
  C:\Windows\System\oQkjzJQ.exe
  2⤵
  PID:4984
- C:\Windows\System\eIRxdEe.exe
  C:\Windows\System\eIRxdEe.exe
  2⤵
  PID:3996
- C:\Windows\System\MIqplvl.exe
  C:\Windows\System\MIqplvl.exe
  2⤵
  PID:5636
- C:\Windows\System\GOKzqJU.exe
  C:\Windows\System\GOKzqJU.exe
  2⤵
  PID:5752
- C:\Windows\System\rgtaJHS.exe
  C:\Windows\System\rgtaJHS.exe
  2⤵
  PID:5864
- C:\Windows\System\IYdjBdJ.exe
  C:\Windows\System\IYdjBdJ.exe
  2⤵
  PID:4472
- C:\Windows\System\yBhtoHH.exe
  C:\Windows\System\yBhtoHH.exe
  2⤵
  PID:4916
- C:\Windows\System\PLZTFuB.exe
  C:\Windows\System\PLZTFuB.exe
  2⤵
  PID:4520
- C:\Windows\System\MnYNkxH.exe
  C:\Windows\System\MnYNkxH.exe
  2⤵
  PID:4604
- C:\Windows\System\sRnmhKa.exe
  C:\Windows\System\sRnmhKa.exe
  2⤵
  PID:5496
- C:\Windows\System\waAOApq.exe
  C:\Windows\System\waAOApq.exe
  2⤵
  PID:6152
- C:\Windows\System\kSRyxgn.exe
  C:\Windows\System\kSRyxgn.exe
  2⤵
  PID:6172
- C:\Windows\System\HlhtoVv.exe
  C:\Windows\System\HlhtoVv.exe
  2⤵
  PID:6200
- C:\Windows\System\cpQvhlj.exe
  C:\Windows\System\cpQvhlj.exe
  2⤵
  PID:6216
- C:\Windows\System\bPWNYas.exe
  C:\Windows\System\bPWNYas.exe
  2⤵
  PID:6244
- C:\Windows\System\JfjKqnI.exe
  C:\Windows\System\JfjKqnI.exe
  2⤵
  PID:6268
- C:\Windows\System\wlnShgM.exe
  C:\Windows\System\wlnShgM.exe
  2⤵
  PID:6296
- C:\Windows\System\ntwVXZv.exe
  C:\Windows\System\ntwVXZv.exe
  2⤵
  PID:6324
- C:\Windows\System\UkusOUn.exe
  C:\Windows\System\UkusOUn.exe
  2⤵
  PID:6352
- C:\Windows\System\neiWqjA.exe
  C:\Windows\System\neiWqjA.exe
  2⤵
  PID:6380
- C:\Windows\System\MmJQUoB.exe
  C:\Windows\System\MmJQUoB.exe
  2⤵
  PID:6408
- C:\Windows\System\meWPdho.exe
  C:\Windows\System\meWPdho.exe
  2⤵
  PID:6436
- C:\Windows\System\vRlmeJj.exe
  C:\Windows\System\vRlmeJj.exe
  2⤵
  PID:6456
- C:\Windows\System\oGxNNfA.exe
  C:\Windows\System\oGxNNfA.exe
  2⤵
  PID:6492
- C:\Windows\System\mOIkabT.exe
  C:\Windows\System\mOIkabT.exe
  2⤵
  PID:6520
- C:\Windows\System\NKiaumK.exe
  C:\Windows\System\NKiaumK.exe
  2⤵
  PID:6552
- C:\Windows\System\NvWTMvI.exe
  C:\Windows\System\NvWTMvI.exe
  2⤵
  PID:6576
- C:\Windows\System\GieBGrg.exe
  C:\Windows\System\GieBGrg.exe
  2⤵
  PID:6604
- C:\Windows\System\lEaFokA.exe
  C:\Windows\System\lEaFokA.exe
  2⤵
  PID:6632
- C:\Windows\System\yTGCTOW.exe
  C:\Windows\System\yTGCTOW.exe
  2⤵
  PID:6660
- C:\Windows\System\JiNFxBy.exe
  C:\Windows\System\JiNFxBy.exe
  2⤵
  PID:6688
- C:\Windows\System\yeZqtxr.exe
  C:\Windows\System\yeZqtxr.exe
  2⤵
  PID:6716
- C:\Windows\System\kfhfVNa.exe
  C:\Windows\System\kfhfVNa.exe
  2⤵
  PID:6744
- C:\Windows\System\yphFXkO.exe
  C:\Windows\System\yphFXkO.exe
  2⤵
  PID:6772
- C:\Windows\System\IZonIPQ.exe
  C:\Windows\System\IZonIPQ.exe
  2⤵
  PID:6800
- C:\Windows\System\uTzmePw.exe
  C:\Windows\System\uTzmePw.exe
  2⤵
  PID:6832
- C:\Windows\System\kRFVgBt.exe
  C:\Windows\System\kRFVgBt.exe
  2⤵
  PID:6860
- C:\Windows\System\aBJPWrQ.exe
  C:\Windows\System\aBJPWrQ.exe
  2⤵
  PID:6888
- C:\Windows\System\FqVXQKy.exe
  C:\Windows\System\FqVXQKy.exe
  2⤵
  PID:6972
- C:\Windows\System\lRvKPoz.exe
  C:\Windows\System\lRvKPoz.exe
  2⤵
  PID:7048
- C:\Windows\System\UeirSlT.exe
  C:\Windows\System\UeirSlT.exe
  2⤵
  PID:7064
- C:\Windows\System\VVFohAU.exe
  C:\Windows\System\VVFohAU.exe
  2⤵
  PID:7096
- C:\Windows\System\goedGis.exe
  C:\Windows\System\goedGis.exe
  2⤵
  PID:7128
- C:\Windows\System\ACASpue.exe
  C:\Windows\System\ACASpue.exe
  2⤵
  PID:7148
- C:\Windows\System\pkdnKPW.exe
  C:\Windows\System\pkdnKPW.exe
  2⤵
  PID:5808
- C:\Windows\System\biiAAla.exe
  C:\Windows\System\biiAAla.exe
  2⤵
  PID:5976
- C:\Windows\System\YXKnlOv.exe
  C:\Windows\System\YXKnlOv.exe
  2⤵
  PID:2828
- C:\Windows\System\sCqKDcW.exe
  C:\Windows\System\sCqKDcW.exe
  2⤵
  PID:5388
- C:\Windows\System\GcBfonV.exe
  C:\Windows\System\GcBfonV.exe
  2⤵
  PID:5696
- C:\Windows\System\pZrHHAc.exe
  C:\Windows\System\pZrHHAc.exe
  2⤵
  PID:6188
- C:\Windows\System\TlsapTA.exe
  C:\Windows\System\TlsapTA.exe
  2⤵
  PID:6256
- C:\Windows\System\CngzYdc.exe
  C:\Windows\System\CngzYdc.exe
  2⤵
  PID:6284
- C:\Windows\System\huWMDvT.exe
  C:\Windows\System\huWMDvT.exe
  2⤵
  PID:2664
- C:\Windows\System\ZfjvMxu.exe
  C:\Windows\System\ZfjvMxu.exe
  2⤵
  PID:2520
- C:\Windows\System\ySZGugM.exe
  C:\Windows\System\ySZGugM.exe
  2⤵
  PID:4752
- C:\Windows\System\zTLeJrx.exe
  C:\Windows\System\zTLeJrx.exe
  2⤵
  PID:4040
- C:\Windows\System\UIodSNW.exe
  C:\Windows\System\UIodSNW.exe
  2⤵
  PID:6508
- C:\Windows\System\gYIkhhp.exe
  C:\Windows\System\gYIkhhp.exe
  2⤵
  PID:6564
- C:\Windows\System\gBgrMhf.exe
  C:\Windows\System\gBgrMhf.exe
  2⤵
  PID:6596
- C:\Windows\System\fdjwnWo.exe
  C:\Windows\System\fdjwnWo.exe
  2⤵
  PID:6652
- C:\Windows\System\InNicEc.exe
  C:\Windows\System\InNicEc.exe
  2⤵
  PID:6736
- C:\Windows\System\FnwIbmO.exe
  C:\Windows\System\FnwIbmO.exe
  2⤵
  PID:6768
- C:\Windows\System\bdGUdMc.exe
  C:\Windows\System\bdGUdMc.exe
  2⤵
  PID:6824
- C:\Windows\System\UkRgxgR.exe
  C:\Windows\System\UkRgxgR.exe
  2⤵
  PID:6852
- C:\Windows\System\wzNFmtP.exe
  C:\Windows\System\wzNFmtP.exe
  2⤵
  PID:6960
- C:\Windows\System\ntFadXW.exe
  C:\Windows\System\ntFadXW.exe
  2⤵
  PID:1400
- C:\Windows\System\NtZXxwi.exe
  C:\Windows\System\NtZXxwi.exe
  2⤵
  PID:7076
- C:\Windows\System\aLbFGbM.exe
  C:\Windows\System\aLbFGbM.exe
  2⤵
  PID:7084
- C:\Windows\System\wszwMqv.exe
  C:\Windows\System\wszwMqv.exe
  2⤵
  PID:7164
- C:\Windows\System\PCUlsfu.exe
  C:\Windows\System\PCUlsfu.exe
  2⤵
  PID:4456
- C:\Windows\System\rvcrrPQ.exe
  C:\Windows\System\rvcrrPQ.exe
  2⤵
  PID:1996
- C:\Windows\System\hgbAsSY.exe
  C:\Windows\System\hgbAsSY.exe
  2⤵
  PID:4848
- C:\Windows\System\BbkDtYA.exe
  C:\Windows\System\BbkDtYA.exe
  2⤵
  PID:6184
- C:\Windows\System\nZgkbkK.exe
  C:\Windows\System\nZgkbkK.exe
  2⤵
  PID:448
- C:\Windows\System\MjmYrMU.exe
  C:\Windows\System\MjmYrMU.exe
  2⤵
  PID:6232
- C:\Windows\System\iOejLdt.exe
  C:\Windows\System\iOejLdt.exe
  2⤵
  PID:3904
- C:\Windows\System\bvxjZWw.exe
  C:\Windows\System\bvxjZWw.exe
  2⤵
  PID:2620
- C:\Windows\System\vXxQAZp.exe
  C:\Windows\System\vXxQAZp.exe
  2⤵
  PID:4768
- C:\Windows\System\joKdqIM.exe
  C:\Windows\System\joKdqIM.exe
  2⤵
  PID:6484
- C:\Windows\System\wpyNijC.exe
  C:\Windows\System\wpyNijC.exe
  2⤵
  PID:976
- C:\Windows\System\KNEIZDI.exe
  C:\Windows\System\KNEIZDI.exe
  2⤵
  PID:2396
- C:\Windows\System\aRMvxaM.exe
  C:\Windows\System\aRMvxaM.exe
  2⤵
  PID:6112
- C:\Windows\System\QHEaqNL.exe
  C:\Windows\System\QHEaqNL.exe
  2⤵
  PID:804
- C:\Windows\System\GaAqYnu.exe
  C:\Windows\System\GaAqYnu.exe
  2⤵
  PID:2364
- C:\Windows\System\OpznctK.exe
  C:\Windows\System\OpznctK.exe
  2⤵
  PID:1624
- C:\Windows\System\CidQeeW.exe
  C:\Windows\System\CidQeeW.exe
  2⤵
  PID:6992
- C:\Windows\System\ZNlFDyy.exe
  C:\Windows\System\ZNlFDyy.exe
  2⤵
  PID:6432
- C:\Windows\System\nyQsaNR.exe
  C:\Windows\System\nyQsaNR.exe
  2⤵
  PID:6816
- C:\Windows\System\poRXZkZ.exe
  C:\Windows\System\poRXZkZ.exe
  2⤵
  PID:7172
- C:\Windows\System\WfcWnYs.exe
  C:\Windows\System\WfcWnYs.exe
  2⤵
  PID:7196
- C:\Windows\System\kjOFmBk.exe
  C:\Windows\System\kjOFmBk.exe
  2⤵
  PID:7216
- C:\Windows\System\GpEvCpY.exe
  C:\Windows\System\GpEvCpY.exe
  2⤵
  PID:7236
- C:\Windows\System\GfqVvvS.exe
  C:\Windows\System\GfqVvvS.exe
  2⤵
  PID:7256
- C:\Windows\System\PbQTNbp.exe
  C:\Windows\System\PbQTNbp.exe
  2⤵
  PID:7296
- C:\Windows\System\utWRwDH.exe
  C:\Windows\System\utWRwDH.exe
  2⤵
  PID:7316
- C:\Windows\System\KrUWpOV.exe
  C:\Windows\System\KrUWpOV.exe
  2⤵
  PID:7344
- C:\Windows\System\wvUfsHd.exe
  C:\Windows\System\wvUfsHd.exe
  2⤵
  PID:7368
- C:\Windows\System\ErcwZWn.exe
  C:\Windows\System\ErcwZWn.exe
  2⤵
  PID:7392
- C:\Windows\System\WsnIemZ.exe
  C:\Windows\System\WsnIemZ.exe
  2⤵
  PID:7432
- C:\Windows\System\uPCSaHX.exe
  C:\Windows\System\uPCSaHX.exe
  2⤵
  PID:7472
- C:\Windows\System\sBAcjMw.exe
  C:\Windows\System\sBAcjMw.exe
  2⤵
  PID:7496
- C:\Windows\System\pMjWqKB.exe
  C:\Windows\System\pMjWqKB.exe
  2⤵
  PID:7512
- C:\Windows\System\YDdZuqp.exe
  C:\Windows\System\YDdZuqp.exe
  2⤵
  PID:7540
- C:\Windows\System\gUFxXuj.exe
  C:\Windows\System\gUFxXuj.exe
  2⤵
  PID:7556
- C:\Windows\System\LZeIxrF.exe
  C:\Windows\System\LZeIxrF.exe
  2⤵
  PID:7580
- C:\Windows\System\mZLpTzp.exe
  C:\Windows\System\mZLpTzp.exe
  2⤵
  PID:7604
- C:\Windows\System\PnVQBlQ.exe
  C:\Windows\System\PnVQBlQ.exe
  2⤵
  PID:7648
- C:\Windows\System\sBxilDy.exe
  C:\Windows\System\sBxilDy.exe
  2⤵
  PID:7668
- C:\Windows\System\FIIPFSz.exe
  C:\Windows\System\FIIPFSz.exe
  2⤵
  PID:7684
- C:\Windows\System\kOogCJB.exe
  C:\Windows\System\kOogCJB.exe
  2⤵
  PID:7708
- C:\Windows\System\QMsMMCj.exe
  C:\Windows\System\QMsMMCj.exe
  2⤵
  PID:7724
- C:\Windows\System\uEOmPIn.exe
  C:\Windows\System\uEOmPIn.exe
  2⤵
  PID:7748
- C:\Windows\System\nFQCVcM.exe
  C:\Windows\System\nFQCVcM.exe
  2⤵
  PID:7804
- C:\Windows\System\xPLzToC.exe
  C:\Windows\System\xPLzToC.exe
  2⤵
  PID:7820
- C:\Windows\System\kZyqOGV.exe
  C:\Windows\System\kZyqOGV.exe
  2⤵
  PID:7880
- C:\Windows\System\sXpwfei.exe
  C:\Windows\System\sXpwfei.exe
  2⤵
  PID:7900
- C:\Windows\System\VgRUnMa.exe
  C:\Windows\System\VgRUnMa.exe
  2⤵
  PID:7928
- C:\Windows\System\xnhKKIc.exe
  C:\Windows\System\xnhKKIc.exe
  2⤵
  PID:7944
- C:\Windows\System\aqKYCFw.exe
  C:\Windows\System\aqKYCFw.exe
  2⤵
  PID:7988
- C:\Windows\System\kpdHoQG.exe
  C:\Windows\System\kpdHoQG.exe
  2⤵
  PID:8012
- C:\Windows\System\KsJCQMy.exe
  C:\Windows\System\KsJCQMy.exe
  2⤵
  PID:8032
- C:\Windows\System\IIfZZTB.exe
  C:\Windows\System\IIfZZTB.exe
  2⤵
  PID:8056
- C:\Windows\System\daNlCki.exe
  C:\Windows\System\daNlCki.exe
  2⤵
  PID:8100
- C:\Windows\System\eSVdLjt.exe
  C:\Windows\System\eSVdLjt.exe
  2⤵
  PID:8128
- C:\Windows\System\SnREFie.exe
  C:\Windows\System\SnREFie.exe
  2⤵
  PID:8152
- C:\Windows\System\giLQEiH.exe
  C:\Windows\System\giLQEiH.exe
  2⤵
  PID:8172
- C:\Windows\System\EANQxwx.exe
  C:\Windows\System\EANQxwx.exe
  2⤵
  PID:7212
- C:\Windows\System\XMxQexJ.exe
  C:\Windows\System\XMxQexJ.exe
  2⤵
  PID:7248
- C:\Windows\System\EsWKrDm.exe
  C:\Windows\System\EsWKrDm.exe
  2⤵
  PID:7292
- C:\Windows\System\eYPqhbb.exe
  C:\Windows\System\eYPqhbb.exe
  2⤵
  PID:7324
- C:\Windows\System\sVDVgZg.exe
  C:\Windows\System\sVDVgZg.exe
  2⤵
  PID:7380
- C:\Windows\System\GwMZKkC.exe
  C:\Windows\System\GwMZKkC.exe
  2⤵
  PID:7456
- C:\Windows\System\nTMTSPw.exe
  C:\Windows\System\nTMTSPw.exe
  2⤵
  PID:7508
- C:\Windows\System\uhomdPv.exe
  C:\Windows\System\uhomdPv.exe
  2⤵
  PID:7572
- C:\Windows\System\UzYUHHE.exe
  C:\Windows\System\UzYUHHE.exe
  2⤵
  PID:7680
- C:\Windows\System\ZoEZiuk.exe
  C:\Windows\System\ZoEZiuk.exe
  2⤵
  PID:7636
- C:\Windows\System\aAgAjfX.exe
  C:\Windows\System\aAgAjfX.exe
  2⤵
  PID:7692
- C:\Windows\System\HBvNYMK.exe
  C:\Windows\System\HBvNYMK.exe
  2⤵
  PID:7876
- C:\Windows\System\iOfHikD.exe
  C:\Windows\System\iOfHikD.exe
  2⤵
  PID:7940
- C:\Windows\System\AXbvHqu.exe
  C:\Windows\System\AXbvHqu.exe
  2⤵
  PID:8040
- C:\Windows\System\gMPFCwW.exe
  C:\Windows\System\gMPFCwW.exe
  2⤵
  PID:8092
- C:\Windows\System\GuCvWot.exe
  C:\Windows\System\GuCvWot.exe
  2⤵
  PID:7188
- C:\Windows\System\amDXxJX.exe
  C:\Windows\System\amDXxJX.exe
  2⤵
  PID:7356
- C:\Windows\System\ZqvgGTt.exe
  C:\Windows\System\ZqvgGTt.exe
  2⤵
  PID:7312
- C:\Windows\System\DLtYTaT.exe
  C:\Windows\System\DLtYTaT.exe
  2⤵
  PID:7460
- C:\Windows\System\GpPCTlu.exe
  C:\Windows\System\GpPCTlu.exe
  2⤵
  PID:7620
- C:\Windows\System\PYtpaTw.exe
  C:\Windows\System\PYtpaTw.exe
  2⤵
  PID:7856
- C:\Windows\System\AXDTJyz.exe
  C:\Windows\System\AXDTJyz.exe
  2⤵
  PID:8084
- C:\Windows\System\enfzzuE.exe
  C:\Windows\System\enfzzuE.exe
  2⤵
  PID:7340
- C:\Windows\System\JiBssWH.exe
  C:\Windows\System\JiBssWH.exe
  2⤵
  PID:7280
- C:\Windows\System\UjTuSnb.exe
  C:\Windows\System\UjTuSnb.exe
  2⤵
  PID:8160
- C:\Windows\System\kaiXycu.exe
  C:\Windows\System\kaiXycu.exe
  2⤵
  PID:7732
- C:\Windows\System\xDCcVDC.exe
  C:\Windows\System\xDCcVDC.exe
  2⤵
  PID:8196
- C:\Windows\System\JrVLruq.exe
  C:\Windows\System\JrVLruq.exe
  2⤵
  PID:8220
- C:\Windows\System\YkUWEgV.exe
  C:\Windows\System\YkUWEgV.exe
  2⤵
  PID:8236
- C:\Windows\System\momjsim.exe
  C:\Windows\System\momjsim.exe
  2⤵
  PID:8256
- C:\Windows\System\oQFVKXN.exe
  C:\Windows\System\oQFVKXN.exe
  2⤵
  PID:8284
- C:\Windows\System\kwreJLv.exe
  C:\Windows\System\kwreJLv.exe
  2⤵
  PID:8308
- C:\Windows\System\SEjySoy.exe
  C:\Windows\System\SEjySoy.exe
  2⤵
  PID:8324
- C:\Windows\System\vXVrWwE.exe
  C:\Windows\System\vXVrWwE.exe
  2⤵
  PID:8368
- C:\Windows\System\IocIyva.exe
  C:\Windows\System\IocIyva.exe
  2⤵
  PID:8396
- C:\Windows\System\IYemqFo.exe
  C:\Windows\System\IYemqFo.exe
  2⤵
  PID:8416
- C:\Windows\System\GWAMwOH.exe
  C:\Windows\System\GWAMwOH.exe
  2⤵
  PID:8432
- C:\Windows\System\ZJxfjRh.exe
  C:\Windows\System\ZJxfjRh.exe
  2⤵
  PID:8460
- C:\Windows\System\iHGSahM.exe
  C:\Windows\System\iHGSahM.exe
  2⤵
  PID:8476
- C:\Windows\System\nvVvArI.exe
  C:\Windows\System\nvVvArI.exe
  2⤵
  PID:8516
- C:\Windows\System\GRRNppW.exe
  C:\Windows\System\GRRNppW.exe
  2⤵
  PID:8540
- C:\Windows\System\Vphwfxb.exe
  C:\Windows\System\Vphwfxb.exe
  2⤵
  PID:8596
- C:\Windows\System\yoSDClh.exe
  C:\Windows\System\yoSDClh.exe
  2⤵
  PID:8640
- C:\Windows\System\BoojwnH.exe
  C:\Windows\System\BoojwnH.exe
  2⤵
  PID:8680
- C:\Windows\System\USjCDGt.exe
  C:\Windows\System\USjCDGt.exe
  2⤵
  PID:8700
- C:\Windows\System\YlPFYrE.exe
  C:\Windows\System\YlPFYrE.exe
  2⤵
  PID:8720
- C:\Windows\System\vrWzIeJ.exe
  C:\Windows\System\vrWzIeJ.exe
  2⤵
  PID:8740
- C:\Windows\System\djhNTDi.exe
  C:\Windows\System\djhNTDi.exe
  2⤵
  PID:8764
- C:\Windows\System\jCXDRdN.exe
  C:\Windows\System\jCXDRdN.exe
  2⤵
  PID:8780
- C:\Windows\System\dRNRedk.exe
  C:\Windows\System\dRNRedk.exe
  2⤵
  PID:8808
- C:\Windows\System\QDkbkMi.exe
  C:\Windows\System\QDkbkMi.exe
  2⤵
  PID:8828
- C:\Windows\System\ZMBkWpo.exe
  C:\Windows\System\ZMBkWpo.exe
  2⤵
  PID:8864
- C:\Windows\System\fpKecnm.exe
  C:\Windows\System\fpKecnm.exe
  2⤵
  PID:8888
- C:\Windows\System\mQbfESm.exe
  C:\Windows\System\mQbfESm.exe
  2⤵
  PID:8908
- C:\Windows\System\EWiwiyi.exe
  C:\Windows\System\EWiwiyi.exe
  2⤵
  PID:8944
- C:\Windows\System\sorzRdM.exe
  C:\Windows\System\sorzRdM.exe
  2⤵
  PID:8964
- C:\Windows\System\aqDwDor.exe
  C:\Windows\System\aqDwDor.exe
  2⤵
  PID:9036
- C:\Windows\System\qHGgmhH.exe
  C:\Windows\System\qHGgmhH.exe
  2⤵
  PID:9056
- C:\Windows\System\OeqWDfE.exe
  C:\Windows\System\OeqWDfE.exe
  2⤵
  PID:9100
- C:\Windows\System\pcClJON.exe
  C:\Windows\System\pcClJON.exe
  2⤵
  PID:9140
- C:\Windows\System\cRwyPDx.exe
  C:\Windows\System\cRwyPDx.exe
  2⤵
  PID:9164
- C:\Windows\System\zscYUYh.exe
  C:\Windows\System\zscYUYh.exe
  2⤵
  PID:9184
- C:\Windows\System\hpTWKEd.exe
  C:\Windows\System\hpTWKEd.exe
  2⤵
  PID:8212
- C:\Windows\System\GpqCKZm.exe
  C:\Windows\System\GpqCKZm.exe
  2⤵
  PID:8228
- C:\Windows\System\QYsLjaH.exe
  C:\Windows\System\QYsLjaH.exe
  2⤵
  PID:8248
- C:\Windows\System\DEThOMD.exe
  C:\Windows\System\DEThOMD.exe
  2⤵
  PID:8380
- C:\Windows\System\EVANBJe.exe
  C:\Windows\System\EVANBJe.exe
  2⤵
  PID:8488
- C:\Windows\System\WDozdkQ.exe
  C:\Windows\System\WDozdkQ.exe
  2⤵
  PID:8468
- C:\Windows\System\QVgMkES.exe
  C:\Windows\System\QVgMkES.exe
  2⤵
  PID:8512
- C:\Windows\System\QTKjBVz.exe
  C:\Windows\System\QTKjBVz.exe
  2⤵
  PID:8568
- C:\Windows\System\YCjuxUf.exe
  C:\Windows\System\YCjuxUf.exe
  2⤵
  PID:8660
- C:\Windows\System\oORgQDq.exe
  C:\Windows\System\oORgQDq.exe
  2⤵
  PID:8736
- C:\Windows\System\rLZDtSW.exe
  C:\Windows\System\rLZDtSW.exe
  2⤵
  PID:8824
- C:\Windows\System\LwUOkwV.exe
  C:\Windows\System\LwUOkwV.exe
  2⤵
  PID:8880
- C:\Windows\System\jutyCQF.exe
  C:\Windows\System\jutyCQF.exe
  2⤵
  PID:8900
- C:\Windows\System\IndOpQK.exe
  C:\Windows\System\IndOpQK.exe
  2⤵
  PID:9024
- C:\Windows\System\xsSapdS.exe
  C:\Windows\System\xsSapdS.exe
  2⤵
  PID:9048
- C:\Windows\System\eKFgItd.exe
  C:\Windows\System\eKFgItd.exe
  2⤵
  PID:9092
- C:\Windows\System\ShEXXuU.exe
  C:\Windows\System\ShEXXuU.exe
  2⤵
  PID:9124
- C:\Windows\System\FxhTNqs.exe
  C:\Windows\System\FxhTNqs.exe
  2⤵
  PID:9172
- C:\Windows\System\VlccjOl.exe
  C:\Windows\System\VlccjOl.exe
  2⤵
  PID:8292
- C:\Windows\System\nnLoVlU.exe
  C:\Windows\System\nnLoVlU.exe
  2⤵
  PID:8332
- C:\Windows\System\jebuPPA.exe
  C:\Windows\System\jebuPPA.exe
  2⤵
  PID:8456
- C:\Windows\System\jfZxwso.exe
  C:\Windows\System\jfZxwso.exe
  2⤵
  PID:8632
- C:\Windows\System\uekLxGK.exe
  C:\Windows\System\uekLxGK.exe
  2⤵
  PID:8956
- C:\Windows\System\usjLXEa.exe
  C:\Windows\System\usjLXEa.exe
  2⤵
  PID:9128
- C:\Windows\System\HlOzDhS.exe
  C:\Windows\System\HlOzDhS.exe
  2⤵
  PID:8252
- C:\Windows\System\dQaqoaq.exe
  C:\Windows\System\dQaqoaq.exe
  2⤵
  PID:8508
- C:\Windows\System\OWwOqCz.exe
  C:\Windows\System\OWwOqCz.exe
  2⤵
  PID:8712
- C:\Windows\System\LeeymAw.exe
  C:\Windows\System\LeeymAw.exe
  2⤵
  PID:9220
- C:\Windows\System\jscOHJl.exe
  C:\Windows\System\jscOHJl.exe
  2⤵
  PID:9236
- C:\Windows\System\JzNLLCk.exe
  C:\Windows\System\JzNLLCk.exe
  2⤵
  PID:9264
- C:\Windows\System\CTpIxVC.exe
  C:\Windows\System\CTpIxVC.exe
  2⤵
  PID:9292
- C:\Windows\System\Kxhdwqv.exe
  C:\Windows\System\Kxhdwqv.exe
  2⤵
  PID:9312
- C:\Windows\System\koelUoU.exe
  C:\Windows\System\koelUoU.exe
  2⤵
  PID:9332
- C:\Windows\System\gmjYLGg.exe
  C:\Windows\System\gmjYLGg.exe
  2⤵
  PID:9352
- C:\Windows\System\SMMGQoo.exe
  C:\Windows\System\SMMGQoo.exe
  2⤵
  PID:9372
- C:\Windows\System\mOsbuUI.exe
  C:\Windows\System\mOsbuUI.exe
  2⤵
  PID:9392
- C:\Windows\System\suAshmC.exe
  C:\Windows\System\suAshmC.exe
  2⤵
  PID:9440
- C:\Windows\System\FhGdsNp.exe
  C:\Windows\System\FhGdsNp.exe
  2⤵
  PID:9548
- C:\Windows\System\DTEwtHu.exe
  C:\Windows\System\DTEwtHu.exe
  2⤵
  PID:9564
- C:\Windows\System\QxlenjR.exe
  C:\Windows\System\QxlenjR.exe
  2⤵
  PID:9592
- C:\Windows\System\dZLtAjl.exe
  C:\Windows\System\dZLtAjl.exe
  2⤵
  PID:9608
- C:\Windows\System\lMjLExj.exe
  C:\Windows\System\lMjLExj.exe
  2⤵
  PID:9652
- C:\Windows\System\MMqfBoh.exe
  C:\Windows\System\MMqfBoh.exe
  2⤵
  PID:9684
- C:\Windows\System\rqknTuE.exe
  C:\Windows\System\rqknTuE.exe
  2⤵
  PID:9708
- C:\Windows\System\RwzwAvZ.exe
  C:\Windows\System\RwzwAvZ.exe
  2⤵
  PID:9728
- C:\Windows\System\tWTcBcm.exe
  C:\Windows\System\tWTcBcm.exe
  2⤵
  PID:9752
- C:\Windows\System\yAXRGwG.exe
  C:\Windows\System\yAXRGwG.exe
  2⤵
  PID:9788
- C:\Windows\System\bSJZMlt.exe
  C:\Windows\System\bSJZMlt.exe
  2⤵
  PID:9812
- C:\Windows\System\SxSziMj.exe
  C:\Windows\System\SxSziMj.exe
  2⤵
  PID:9840
- C:\Windows\System\ZNwdZhe.exe
  C:\Windows\System\ZNwdZhe.exe
  2⤵
  PID:9856
- C:\Windows\System\ymTVjHa.exe
  C:\Windows\System\ymTVjHa.exe
  2⤵
  PID:9884
- C:\Windows\System\GZedNwa.exe
  C:\Windows\System\GZedNwa.exe
  2⤵
  PID:9900
- C:\Windows\System\cvkKgzD.exe
  C:\Windows\System\cvkKgzD.exe
  2⤵
  PID:9920
- C:\Windows\System\EsuZhvi.exe
  C:\Windows\System\EsuZhvi.exe
  2⤵
  PID:9980
- C:\Windows\System\MrFvxEQ.exe
  C:\Windows\System\MrFvxEQ.exe
  2⤵
  PID:9996
- C:\Windows\System\gPhgjml.exe
  C:\Windows\System\gPhgjml.exe
  2⤵
  PID:10044
- C:\Windows\System\QfaDRuH.exe
  C:\Windows\System\QfaDRuH.exe
  2⤵
  PID:10068
- C:\Windows\System\vKatyeT.exe
  C:\Windows\System\vKatyeT.exe
  2⤵
  PID:10092
- C:\Windows\System\OYBnacE.exe
  C:\Windows\System\OYBnacE.exe
  2⤵
  PID:10116
- C:\Windows\System\RbVFrvx.exe
  C:\Windows\System\RbVFrvx.exe
  2⤵
  PID:10136
- C:\Windows\System\DpQEgtN.exe
  C:\Windows\System\DpQEgtN.exe
  2⤵
  PID:10164
- C:\Windows\System\IzfOhKv.exe
  C:\Windows\System\IzfOhKv.exe
  2⤵
  PID:10188
- C:\Windows\System\RgjsgQI.exe
  C:\Windows\System\RgjsgQI.exe
  2⤵
  PID:10204
- C:\Windows\System\ZXDpmAr.exe
  C:\Windows\System\ZXDpmAr.exe
  2⤵
  PID:10232
- C:\Windows\System\WXMQWwl.exe
  C:\Windows\System\WXMQWwl.exe
  2⤵
  PID:8872
- C:\Windows\System\ZGdDHAY.exe
  C:\Windows\System\ZGdDHAY.exe
  2⤵
  PID:9252
- C:\Windows\System\IBEkScZ.exe
  C:\Windows\System\IBEkScZ.exe
  2⤵
  PID:9368
- C:\Windows\System\YngBmUB.exe
  C:\Windows\System\YngBmUB.exe
  2⤵
  PID:9416
- C:\Windows\System\nknipGa.exe
  C:\Windows\System\nknipGa.exe
  2⤵
  PID:9460
- C:\Windows\System\wdIEIfG.exe
  C:\Windows\System\wdIEIfG.exe
  2⤵
  PID:9576
- C:\Windows\System\KTfufUZ.exe
  C:\Windows\System\KTfufUZ.exe
  2⤵
  PID:9584
- C:\Windows\System\LDsQVQH.exe
  C:\Windows\System\LDsQVQH.exe
  2⤵
  PID:9676
- C:\Windows\System\iHhEjTG.exe
  C:\Windows\System\iHhEjTG.exe
  2⤵
  PID:9720
- C:\Windows\System\qDOEMdb.exe
  C:\Windows\System\qDOEMdb.exe
  2⤵
  PID:9776
- C:\Windows\System\nhWYtjb.exe
  C:\Windows\System\nhWYtjb.exe
  2⤵
  PID:9780
- C:\Windows\System\ymKHVvy.exe
  C:\Windows\System\ymKHVvy.exe
  2⤵
  PID:9896
- C:\Windows\System\EtGGIRN.exe
  C:\Windows\System\EtGGIRN.exe
  2⤵
  PID:9952
- C:\Windows\System\whuEWtY.exe
  C:\Windows\System\whuEWtY.exe
  2⤵
  PID:10076
- C:\Windows\System\iaoUHfq.exe
  C:\Windows\System\iaoUHfq.exe
  2⤵
  PID:10132
- C:\Windows\System\nhUPnIH.exe
  C:\Windows\System\nhUPnIH.exe
  2⤵
  PID:8276
- C:\Windows\System\XFLVzGS.exe
  C:\Windows\System\XFLVzGS.exe
  2⤵
  PID:10200
- C:\Windows\System\PGfmKsO.exe
  C:\Windows\System\PGfmKsO.exe
  2⤵
  PID:9288
- C:\Windows\System\ENmSeVZ.exe
  C:\Windows\System\ENmSeVZ.exe
  2⤵
  PID:9360
- C:\Windows\System\XyWbbZQ.exe
  C:\Windows\System\XyWbbZQ.exe
  2⤵
  PID:9604
- C:\Windows\System\HqWzMUs.exe
  C:\Windows\System\HqWzMUs.exe
  2⤵
  PID:10056
- C:\Windows\System\ftlEdVj.exe
  C:\Windows\System\ftlEdVj.exe
  2⤵
  PID:10028
- C:\Windows\System\AiayIGI.exe
  C:\Windows\System\AiayIGI.exe
  2⤵
  PID:8440
- C:\Windows\System\PjktOlp.exe
  C:\Windows\System\PjktOlp.exe
  2⤵
  PID:2924
- C:\Windows\System\qJnWZhN.exe
  C:\Windows\System\qJnWZhN.exe
  2⤵
  PID:10196
- C:\Windows\System\sHnSOMg.exe
  C:\Windows\System\sHnSOMg.exe
  2⤵
  PID:9876
- C:\Windows\System\LaznkBS.exe
  C:\Windows\System\LaznkBS.exe
  2⤵
  PID:10108
- C:\Windows\System\kQlStxD.exe
  C:\Windows\System\kQlStxD.exe
  2⤵
  PID:9132
- C:\Windows\System\ipLrXzz.exe
  C:\Windows\System\ipLrXzz.exe
  2⤵
  PID:9472
- C:\Windows\System\LlTYTGI.exe
  C:\Windows\System\LlTYTGI.exe
  2⤵
  PID:10264
- C:\Windows\System\hlNiaew.exe
  C:\Windows\System\hlNiaew.exe
  2⤵
  PID:10280
- C:\Windows\System\FXtBKRD.exe
  C:\Windows\System\FXtBKRD.exe
  2⤵
  PID:10300
- C:\Windows\System\iQuZWyU.exe
  C:\Windows\System\iQuZWyU.exe
  2⤵
  PID:10328
- C:\Windows\System\kVzfOQj.exe
  C:\Windows\System\kVzfOQj.exe
  2⤵
  PID:10436
- C:\Windows\System\ylyYFHR.exe
  C:\Windows\System\ylyYFHR.exe
  2⤵
  PID:10456
- C:\Windows\System\mFfIWIY.exe
  C:\Windows\System\mFfIWIY.exe
  2⤵
  PID:10472
- C:\Windows\System\Pxledxl.exe
  C:\Windows\System\Pxledxl.exe
  2⤵
  PID:10528
- C:\Windows\System\DYFQAOj.exe
  C:\Windows\System\DYFQAOj.exe
  2⤵
  PID:10624
- C:\Windows\System\KLrRliJ.exe
  C:\Windows\System\KLrRliJ.exe
  2⤵
  PID:10644
- C:\Windows\System\epWgMoU.exe
  C:\Windows\System\epWgMoU.exe
  2⤵
  PID:10676
- C:\Windows\System\STWoiea.exe
  C:\Windows\System\STWoiea.exe
  2⤵
  PID:10692
- C:\Windows\System\LaHANVL.exe
  C:\Windows\System\LaHANVL.exe
  2⤵
  PID:10716
- C:\Windows\System\xRYLQBn.exe
  C:\Windows\System\xRYLQBn.exe
  2⤵
  PID:10756
- C:\Windows\System\XmRWLTe.exe
  C:\Windows\System\XmRWLTe.exe
  2⤵
  PID:10776
- C:\Windows\System\TexMgTa.exe
  C:\Windows\System\TexMgTa.exe
  2⤵
  PID:10804
- C:\Windows\System\jfRKxxK.exe
  C:\Windows\System\jfRKxxK.exe
  2⤵
  PID:10824
- C:\Windows\System\SNDsYmU.exe
  C:\Windows\System\SNDsYmU.exe
  2⤵
  PID:10860
- C:\Windows\System\yIgEGPA.exe
  C:\Windows\System\yIgEGPA.exe
  2⤵
  PID:10888
- C:\Windows\System\DbZHEee.exe
  C:\Windows\System\DbZHEee.exe
  2⤵
  PID:10912
- C:\Windows\System\Jdrjomt.exe
  C:\Windows\System\Jdrjomt.exe
  2⤵
  PID:10940
- C:\Windows\System\cznojIJ.exe
  C:\Windows\System\cznojIJ.exe
  2⤵
  PID:10960
- C:\Windows\System\VwuIcIg.exe
  C:\Windows\System\VwuIcIg.exe
  2⤵
  PID:10976
- C:\Windows\System\IPlkXGP.exe
  C:\Windows\System\IPlkXGP.exe
  2⤵
  PID:10996
- C:\Windows\System\YfiKoCS.exe
  C:\Windows\System\YfiKoCS.exe
  2⤵
  PID:11012
- C:\Windows\System\alaApTq.exe
  C:\Windows\System\alaApTq.exe
  2⤵
  PID:11076
- C:\Windows\System\NyQDbNi.exe
  C:\Windows\System\NyQDbNi.exe
  2⤵
  PID:11096
- C:\Windows\System\NTZzgOw.exe
  C:\Windows\System\NTZzgOw.exe
  2⤵
  PID:11124
- C:\Windows\System\SthuFCU.exe
  C:\Windows\System\SthuFCU.exe
  2⤵
  PID:11160
- C:\Windows\System\xqwDfaM.exe
  C:\Windows\System\xqwDfaM.exe
  2⤵
  PID:11180
- C:\Windows\System\mvjThHA.exe
  C:\Windows\System\mvjThHA.exe
  2⤵
  PID:11200
- C:\Windows\System\rwzsyyg.exe
  C:\Windows\System\rwzsyyg.exe
  2⤵
  PID:11220
- C:\Windows\System\AFOycnI.exe
  C:\Windows\System\AFOycnI.exe
  2⤵
  PID:11260
- C:\Windows\System\nGnetSd.exe
  C:\Windows\System\nGnetSd.exe
  2⤵
  PID:10296
- C:\Windows\System\aUfAySU.exe
  C:\Windows\System\aUfAySU.exe
  2⤵
  PID:10384
- C:\Windows\System\EEzCKgR.exe
  C:\Windows\System\EEzCKgR.exe
  2⤵
  PID:10444
- C:\Windows\System\nXmNZVZ.exe
  C:\Windows\System\nXmNZVZ.exe
  2⤵
  PID:10416
- C:\Windows\System\bDgPYRh.exe
  C:\Windows\System\bDgPYRh.exe
  2⤵
  PID:10464
- C:\Windows\System\nVEKpdb.exe
  C:\Windows\System\nVEKpdb.exe
  2⤵
  PID:10508
- C:\Windows\System\eMCNiHM.exe
  C:\Windows\System\eMCNiHM.exe
  2⤵
  PID:10560
- C:\Windows\System\HiONCvF.exe
  C:\Windows\System\HiONCvF.exe
  2⤵
  PID:10664
- C:\Windows\System\qlhlFpR.exe
  C:\Windows\System\qlhlFpR.exe
  2⤵
  PID:10712
- C:\Windows\System\xnPCDGd.exe
  C:\Windows\System\xnPCDGd.exe
  2⤵
  PID:10748
- C:\Windows\System\yEGnUed.exe
  C:\Windows\System\yEGnUed.exe
  2⤵
  PID:10800
- C:\Windows\System\Iinbabj.exe
  C:\Windows\System\Iinbabj.exe
  2⤵
  PID:10968
- C:\Windows\System\KcfniED.exe
  C:\Windows\System\KcfniED.exe
  2⤵
  PID:10992
- C:\Windows\System\KsuNvmA.exe
  C:\Windows\System\KsuNvmA.exe
  2⤵
  PID:11004
- C:\Windows\System\oJwNLRI.exe
  C:\Windows\System\oJwNLRI.exe
  2⤵
  PID:11028
- C:\Windows\System\weRWSwR.exe
  C:\Windows\System\weRWSwR.exe
  2⤵
  PID:11132
- C:\Windows\System\VqgbcOi.exe
  C:\Windows\System\VqgbcOi.exe
  2⤵
  PID:11152
- C:\Windows\System\sOvZIZQ.exe
  C:\Windows\System\sOvZIZQ.exe
  2⤵
  PID:11188
- C:\Windows\System\VvmjXPG.exe
  C:\Windows\System\VvmjXPG.exe
  2⤵
  PID:11256
- C:\Windows\System\JQjXQsW.exe
  C:\Windows\System\JQjXQsW.exe
  2⤵
  PID:10368
- C:\Windows\System\fjBHWwj.exe
  C:\Windows\System\fjBHWwj.exe
  2⤵
  PID:10600
- C:\Windows\System\NpzvaJB.exe
  C:\Windows\System\NpzvaJB.exe
  2⤵
  PID:10636
- C:\Windows\System\LvdBrAj.exe
  C:\Windows\System\LvdBrAj.exe
  2⤵
  PID:10736
- C:\Windows\System\gmMLiLD.exe
  C:\Windows\System\gmMLiLD.exe
  2⤵
  PID:10908
- C:\Windows\System\nBXYeLj.exe
  C:\Windows\System\nBXYeLj.exe
  2⤵
  PID:10932
- C:\Windows\System\pcdVjhx.exe
  C:\Windows\System\pcdVjhx.exe
  2⤵
  PID:10272
- C:\Windows\System\CoUuUaV.exe
  C:\Windows\System\CoUuUaV.exe
  2⤵
  PID:11240
- C:\Windows\System\yetQdmh.exe
  C:\Windows\System\yetQdmh.exe
  2⤵
  PID:10796
- C:\Windows\System\YbyPUHv.exe
  C:\Windows\System\YbyPUHv.exe
  2⤵
  PID:11060
- C:\Windows\System\SdmRxnO.exe
  C:\Windows\System\SdmRxnO.exe
  2⤵
  PID:10852
- C:\Windows\System\YHuagzY.exe
  C:\Windows\System\YHuagzY.exe
  2⤵
  PID:11284
- C:\Windows\System\iWQFSgI.exe
  C:\Windows\System\iWQFSgI.exe
  2⤵
  PID:11316
- C:\Windows\System\uyXYzpS.exe
  C:\Windows\System\uyXYzpS.exe
  2⤵
  PID:11356
- C:\Windows\System\QmGPNzN.exe
  C:\Windows\System\QmGPNzN.exe
  2⤵
  PID:11380
- C:\Windows\System\VelJcuM.exe
  C:\Windows\System\VelJcuM.exe
  2⤵
  PID:11404
- C:\Windows\System\MlfVXJp.exe
  C:\Windows\System\MlfVXJp.exe
  2⤵
  PID:11440
- C:\Windows\System\xMhsbOo.exe
  C:\Windows\System\xMhsbOo.exe
  2⤵
  PID:11464
- C:\Windows\System\YeUwFex.exe
  C:\Windows\System\YeUwFex.exe
  2⤵
  PID:11484
- C:\Windows\System\uaKmQLi.exe
  C:\Windows\System\uaKmQLi.exe
  2⤵
  PID:11500
- C:\Windows\System\brefFwC.exe
  C:\Windows\System\brefFwC.exe
  2⤵
  PID:11540
- C:\Windows\System\KegyupZ.exe
  C:\Windows\System\KegyupZ.exe
  2⤵
  PID:11556
- C:\Windows\System\cqjPaMV.exe
  C:\Windows\System\cqjPaMV.exe
  2⤵
  PID:11596
- C:\Windows\System\pTAXzjs.exe
  C:\Windows\System\pTAXzjs.exe
  2⤵
  PID:11624
- C:\Windows\System\NSXEXQP.exe
  C:\Windows\System\NSXEXQP.exe
  2⤵
  PID:11672
- C:\Windows\System\eGClQyc.exe
  C:\Windows\System\eGClQyc.exe
  2⤵
  PID:11696
- C:\Windows\System\YqBmatI.exe
  C:\Windows\System\YqBmatI.exe
  2⤵
  PID:11716
- C:\Windows\System\lJPJKaz.exe
  C:\Windows\System\lJPJKaz.exe
  2⤵
  PID:11732
- C:\Windows\System\XUGUOti.exe
  C:\Windows\System\XUGUOti.exe
  2⤵
  PID:11760
- C:\Windows\System\HRdvZWz.exe
  C:\Windows\System\HRdvZWz.exe
  2⤵
  PID:11780
- C:\Windows\System\FLUkFpC.exe
  C:\Windows\System\FLUkFpC.exe
  2⤵
  PID:11804
- C:\Windows\System\GnOsaua.exe
  C:\Windows\System\GnOsaua.exe
  2⤵
  PID:11824
- C:\Windows\System\tdTXZaD.exe
  C:\Windows\System\tdTXZaD.exe
  2⤵
  PID:11844
- C:\Windows\System\bVsqIsr.exe
  C:\Windows\System\bVsqIsr.exe
  2⤵
  PID:11864
- C:\Windows\System\WSxMakD.exe
  C:\Windows\System\WSxMakD.exe
  2⤵
  PID:11892
- C:\Windows\System\sdDrmHR.exe
  C:\Windows\System\sdDrmHR.exe
  2⤵
  PID:11924
- C:\Windows\System\iSYrqzW.exe
  C:\Windows\System\iSYrqzW.exe
  2⤵
  PID:11940
- C:\Windows\System\WOicKbN.exe
  C:\Windows\System\WOicKbN.exe
  2⤵
  PID:11964
- C:\Windows\System\SjPMJOy.exe
  C:\Windows\System\SjPMJOy.exe
  2⤵
  PID:11988
- C:\Windows\System\sePnyEO.exe
  C:\Windows\System\sePnyEO.exe
  2⤵
  PID:12012
- C:\Windows\System\MOJOdGs.exe
  C:\Windows\System\MOJOdGs.exe
  2⤵
  PID:12032
- C:\Windows\System\kCrWOfH.exe
  C:\Windows\System\kCrWOfH.exe
  2⤵
  PID:12064
- C:\Windows\System\ZGEIqwA.exe
  C:\Windows\System\ZGEIqwA.exe
  2⤵
  PID:12104
- C:\Windows\System\fRvGmGH.exe
  C:\Windows\System\fRvGmGH.exe
  2⤵
  PID:12132
- C:\Windows\System\buxfTWf.exe
  C:\Windows\System\buxfTWf.exe
  2⤵
  PID:12164
- C:\Windows\System\fbTIiSS.exe
  C:\Windows\System\fbTIiSS.exe
  2⤵
  PID:12188
- C:\Windows\System\mmoxsIs.exe
  C:\Windows\System\mmoxsIs.exe
  2⤵
  PID:12220
- C:\Windows\System\oNdYBmG.exe
  C:\Windows\System\oNdYBmG.exe
  2⤵
  PID:12260
- C:\Windows\System\QyzOQeA.exe
  C:\Windows\System\QyzOQeA.exe
  2⤵
  PID:11304
- C:\Windows\System\vehUnZn.exe
  C:\Windows\System\vehUnZn.exe
  2⤵
  PID:11352
- C:\Windows\System\gGiHETP.exe
  C:\Windows\System\gGiHETP.exe
  2⤵
  PID:11396
- C:\Windows\System\BMeOdGA.exe
  C:\Windows\System\BMeOdGA.exe
  2⤵
  PID:11524
- C:\Windows\System\cmHSEzU.exe
  C:\Windows\System\cmHSEzU.exe
  2⤵
  PID:11588
- C:\Windows\System\LtCQvnR.exe
  C:\Windows\System\LtCQvnR.exe
  2⤵
  PID:11656
- C:\Windows\System\bVfDmEy.exe
  C:\Windows\System\bVfDmEy.exe
  2⤵
  PID:11704
- C:\Windows\System\oQBKuzp.exe
  C:\Windows\System\oQBKuzp.exe
  2⤵
  PID:11748
- C:\Windows\System\ByKbxUC.exe
  C:\Windows\System\ByKbxUC.exe
  2⤵
  PID:11772
- C:\Windows\System\NAuQxZJ.exe
  C:\Windows\System\NAuQxZJ.exe
  2⤵
  PID:11840
- C:\Windows\System\sEKukXj.exe
  C:\Windows\System\sEKukXj.exe
  2⤵
  PID:11984
- C:\Windows\System\gCPBHkK.exe
  C:\Windows\System\gCPBHkK.exe
  2⤵
  PID:12028
- C:\Windows\System\HGTUSQE.exe
  C:\Windows\System\HGTUSQE.exe
  2⤵
  PID:12100
- C:\Windows\System\daTayHH.exe
  C:\Windows\System\daTayHH.exe
  2⤵
  PID:12076
- C:\Windows\System\BwbhWqL.exe
  C:\Windows\System\BwbhWqL.exe
  2⤵
  PID:12144
- C:\Windows\System\UxqxuCy.exe
  C:\Windows\System\UxqxuCy.exe
  2⤵
  PID:12252
- C:\Windows\System\mXPzQAl.exe
  C:\Windows\System\mXPzQAl.exe
  2⤵
  PID:11268
- C:\Windows\System\JNsSlNh.exe
  C:\Windows\System\JNsSlNh.exe
  2⤵
  PID:10884
- C:\Windows\System\QnDvoOr.exe
  C:\Windows\System\QnDvoOr.exe
  2⤵
  PID:2604
- C:\Windows\System\vdxWkvI.exe
  C:\Windows\System\vdxWkvI.exe
  2⤵
  PID:11584
- C:\Windows\System\GCxmKSb.exe
  C:\Windows\System\GCxmKSb.exe
  2⤵
  PID:11616
- C:\Windows\System\sbOjwGW.exe
  C:\Windows\System\sbOjwGW.exe
  2⤵
  PID:11792
- C:\Windows\System\hVLMCIp.exe
  C:\Windows\System\hVLMCIp.exe
  2⤵
  PID:12008
- C:\Windows\System\oLSDeQx.exe
  C:\Windows\System\oLSDeQx.exe
  2⤵
  PID:3588
- C:\Windows\System\IAPgWSV.exe
  C:\Windows\System\IAPgWSV.exe
  2⤵
  PID:12208
- C:\Windows\System\xWxRpzb.exe
  C:\Windows\System\xWxRpzb.exe
  2⤵
  PID:11688
- C:\Windows\System\RSmtDmy.exe
  C:\Windows\System\RSmtDmy.exe
  2⤵
  PID:11912
- C:\Windows\System\RHmsTrM.exe
  C:\Windows\System\RHmsTrM.exe
  2⤵
  PID:12092
- C:\Windows\System\HvMCJbs.exe
  C:\Windows\System\HvMCJbs.exe
  2⤵
  PID:11416
- C:\Windows\System\VncmLta.exe
  C:\Windows\System\VncmLta.exe
  2⤵
  PID:12304
- C:\Windows\System\SaLTZdC.exe
  C:\Windows\System\SaLTZdC.exe
  2⤵
  PID:12336
- C:\Windows\System\CgfidWh.exe
  C:\Windows\System\CgfidWh.exe
  2⤵
  PID:12352
- C:\Windows\System\jDcMJdN.exe
  C:\Windows\System\jDcMJdN.exe
  2⤵
  PID:12392
- C:\Windows\System\woEvrrm.exe
  C:\Windows\System\woEvrrm.exe
  2⤵
  PID:12416
- C:\Windows\System\gLrhQkv.exe
  C:\Windows\System\gLrhQkv.exe
  2⤵
  PID:12480
- C:\Windows\System\cnQwYkK.exe
  C:\Windows\System\cnQwYkK.exe
  2⤵
  PID:12500
- C:\Windows\System\RpaqNEW.exe
  C:\Windows\System\RpaqNEW.exe
  2⤵
  PID:12528
- C:\Windows\System\tokjqiF.exe
  C:\Windows\System\tokjqiF.exe
  2⤵
  PID:12544
- C:\Windows\System\ipBpubB.exe
  C:\Windows\System\ipBpubB.exe
  2⤵
  PID:12564
- C:\Windows\System\eKIecAi.exe
  C:\Windows\System\eKIecAi.exe
  2⤵
  PID:12584
- C:\Windows\System\SODCQDd.exe
  C:\Windows\System\SODCQDd.exe
  2⤵
  PID:12644
- C:\Windows\System\zpkVVhc.exe
  C:\Windows\System\zpkVVhc.exe
  2⤵
  PID:12668
- C:\Windows\System\DAoZopb.exe
  C:\Windows\System\DAoZopb.exe
  2⤵
  PID:12684
- C:\Windows\System\TlGNqtW.exe
  C:\Windows\System\TlGNqtW.exe
  2⤵
  PID:12704
- C:\Windows\System\kLBKFhH.exe
  C:\Windows\System\kLBKFhH.exe
  2⤵
  PID:12732
- C:\Windows\System\SlFOaLu.exe
  C:\Windows\System\SlFOaLu.exe
  2⤵
  PID:12752
- C:\Windows\System\YgkPvlX.exe
  C:\Windows\System\YgkPvlX.exe
  2⤵
  PID:12768
- C:\Windows\System\eqKwPPG.exe
  C:\Windows\System\eqKwPPG.exe
  2⤵
  PID:12820
- C:\Windows\System\ofnZAFL.exe
  C:\Windows\System\ofnZAFL.exe
  2⤵
  PID:12840
- C:\Windows\System\EQKyTTw.exe
  C:\Windows\System\EQKyTTw.exe
  2⤵
  PID:12868
- C:\Windows\System\gkOMACv.exe
  C:\Windows\System\gkOMACv.exe
  2⤵
  PID:12916
- C:\Windows\System\LUJVjUF.exe
  C:\Windows\System\LUJVjUF.exe
  2⤵
  PID:12936
- C:\Windows\System\lnBscVK.exe
  C:\Windows\System\lnBscVK.exe
  2⤵
  PID:12972
- C:\Windows\System\oSwNxcZ.exe
  C:\Windows\System\oSwNxcZ.exe
  2⤵
  PID:12992
- C:\Windows\System\HtjwVTp.exe
  C:\Windows\System\HtjwVTp.exe
  2⤵
  PID:13016
- C:\Windows\System\tYzUAqx.exe
  C:\Windows\System\tYzUAqx.exe
  2⤵
  PID:13064
- C:\Windows\System\qPinKcn.exe
  C:\Windows\System\qPinKcn.exe
  2⤵
  PID:13096
- C:\Windows\System\brPnmYk.exe
  C:\Windows\System\brPnmYk.exe
  2⤵
  PID:13112
- C:\Windows\System\yEXOSys.exe
  C:\Windows\System\yEXOSys.exe
  2⤵
  PID:13136
- C:\Windows\System\fYfWUNH.exe
  C:\Windows\System\fYfWUNH.exe
  2⤵
  PID:13180
- C:\Windows\System\euFoilx.exe
  C:\Windows\System\euFoilx.exe
  2⤵
  PID:13208
- C:\Windows\System\MTRmSGf.exe
  C:\Windows\System\MTRmSGf.exe
  2⤵
  PID:13232
- C:\Windows\System\zMpMIZu.exe
  C:\Windows\System\zMpMIZu.exe
  2⤵
  PID:13252
- C:\Windows\System\GkingVf.exe
  C:\Windows\System\GkingVf.exe
  2⤵
  PID:13288
- C:\Windows\System\lqEoxKm.exe
  C:\Windows\System\lqEoxKm.exe
  2⤵
  PID:13308
- C:\Windows\System\JCTQLoF.exe
  C:\Windows\System\JCTQLoF.exe
  2⤵
  PID:11428
- C:\Windows\System\vuDULKL.exe
  C:\Windows\System\vuDULKL.exe
  2⤵
  PID:12316
- C:\Windows\System\POKdGkk.exe
  C:\Windows\System\POKdGkk.exe
  2⤵
  PID:12348
- C:\Windows\System\LmmzWhk.exe
  C:\Windows\System\LmmzWhk.exe
  2⤵
  PID:12408
- C:\Windows\System\etVDpGi.exe
  C:\Windows\System\etVDpGi.exe
  2⤵
  PID:12552
- C:\Windows\System\lFHuftR.exe
  C:\Windows\System\lFHuftR.exe
  2⤵
  PID:12636
- C:\Windows\System\fmHCvxa.exe
  C:\Windows\System\fmHCvxa.exe
  2⤵
  PID:12680
- C:\Windows\System\OTMWPof.exe
  C:\Windows\System\OTMWPof.exe
  2⤵
  PID:12744
- C:\Windows\System\sFVEFky.exe
  C:\Windows\System\sFVEFky.exe
  2⤵
  PID:12760
- C:\Windows\System\socEIyS.exe
  C:\Windows\System\socEIyS.exe
  2⤵
  PID:12860
- C:\Windows\System\fAqEFGK.exe
  C:\Windows\System\fAqEFGK.exe
  2⤵
  PID:12924
- C:\Windows\System\LhzSGof.exe
  C:\Windows\System\LhzSGof.exe
  2⤵
  PID:12956
- C:\Windows\System\PLkxbEJ.exe
  C:\Windows\System\PLkxbEJ.exe
  2⤵
  PID:12456
- C:\Windows\System\lKgElWM.exe
  C:\Windows\System\lKgElWM.exe
  2⤵
  PID:7116
- C:\Windows\System\eMikLDl.exe
  C:\Windows\System\eMikLDl.exe
  2⤵
  PID:12804
- C:\Windows\System\IrPoNgB.exe
  C:\Windows\System\IrPoNgB.exe
  2⤵
  PID:13176
- C:\Windows\System\FnHYnjR.exe
  C:\Windows\System\FnHYnjR.exe
  2⤵
  PID:12000
- C:\Windows\System\gmesBrV.exe
  C:\Windows\System\gmesBrV.exe
  2⤵
  PID:4212
- C:\Windows\System\gySvPSr.exe
  C:\Windows\System\gySvPSr.exe
  2⤵
  PID:12612
- C:\Windows\System\UloPmdW.exe
  C:\Windows\System\UloPmdW.exe
  2⤵
  PID:3168
- C:\Windows\System\IbQuord.exe
  C:\Windows\System\IbQuord.exe
  2⤵
  PID:12836
- C:\Windows\System\XLLeFEF.exe
  C:\Windows\System\XLLeFEF.exe
  2⤵
  PID:12968
- C:\Windows\System\UbBhCfW.exe
  C:\Windows\System\UbBhCfW.exe
  2⤵
  PID:2412
- C:\Windows\System\sIhORZp.exe
  C:\Windows\System\sIhORZp.exe
  2⤵
  PID:12904
- C:\Windows\System\CgWueAH.exe
  C:\Windows\System\CgWueAH.exe
  2⤵
  PID:12716
- C:\Windows\System\NUbHYjE.exe
  C:\Windows\System\NUbHYjE.exe
  2⤵
  PID:5216
- C:\Windows\System\MEYQqqh.exe
  C:\Windows\System\MEYQqqh.exe
  2⤵
  PID:12508
- C:\Windows\System\nkTgfKE.exe
  C:\Windows\System\nkTgfKE.exe
  2⤵
  PID:3360
- C:\Windows\System\hgxYXzT.exe
  C:\Windows\System\hgxYXzT.exe
  2⤵
  PID:1668
- C:\Windows\System\rVdhMsp.exe
  C:\Windows\System\rVdhMsp.exe
  2⤵
  PID:13008
- C:\Windows\System\VAXxGLn.exe
  C:\Windows\System\VAXxGLn.exe
  2⤵
  PID:13056
- C:\Windows\System\IktBRlf.exe
  C:\Windows\System\IktBRlf.exe
  2⤵
  PID:3632
- C:\Windows\System\OFpeVSR.exe
  C:\Windows\System\OFpeVSR.exe
  2⤵
  PID:4648
- C:\Windows\System\yRxbGXU.exe
  C:\Windows\System\yRxbGXU.exe
  2⤵
  PID:12796
- C:\Windows\System\rPTJsbP.exe
  C:\Windows\System\rPTJsbP.exe
  2⤵
  PID:1136
- C:\Windows\System\zfxAbup.exe
  C:\Windows\System\zfxAbup.exe
  2⤵
  PID:1600
- C:\Windows\System\sfhjRQH.exe
  C:\Windows\System\sfhjRQH.exe
  2⤵
  PID:4724
- C:\Windows\System\MyPHgCt.exe
  C:\Windows\System\MyPHgCt.exe
  2⤵
  PID:13324
- C:\Windows\System\MDTIBIy.exe
  C:\Windows\System\MDTIBIy.exe
  2⤵
  PID:13972
- C:\Windows\System\uOInuSJ.exe
  C:\Windows\System\uOInuSJ.exe
  2⤵
  PID:13988
- C:\Windows\System\nkagtsM.exe
  C:\Windows\System\nkagtsM.exe
  2⤵
  PID:14008
- C:\Windows\System\JCWbmUf.exe
  C:\Windows\System\JCWbmUf.exe
  2⤵
  PID:14032
- C:\Windows\System\zgBGGXT.exe
  C:\Windows\System\zgBGGXT.exe
  2⤵
  PID:14064
- C:\Windows\System\yTaiWJE.exe
  C:\Windows\System\yTaiWJE.exe
  2⤵
  PID:1524
- C:\Windows\System\ArmOxVS.exe
  C:\Windows\System\ArmOxVS.exe
  2⤵
  PID:7004
- C:\Windows\System\saFeYoT.exe
  C:\Windows\System\saFeYoT.exe
  2⤵
  PID:14084
- C:\Windows\System\rgTSWnj.exe
  C:\Windows\System\rgTSWnj.exe
  2⤵
  PID:14144
- C:\Windows\System\mVzsvKD.exe
  C:\Windows\System\mVzsvKD.exe
  2⤵
  PID:14300
- C:\Windows\System\aChBXDt.exe
  C:\Windows\System\aChBXDt.exe
  2⤵
  PID:13364
- C:\Windows\System\swqLrwK.exe
  C:\Windows\System\swqLrwK.exe
  2⤵
  PID:13380
- C:\Windows\System\MNgJqbN.exe
  C:\Windows\System\MNgJqbN.exe
  2⤵
  PID:6792
- C:\Windows\System\pCUpKVs.exe
  C:\Windows\System\pCUpKVs.exe
  2⤵
  PID:13388
- C:\Windows\System\oEPGHIS.exe
  C:\Windows\System\oEPGHIS.exe
  2⤵
  PID:13608
- C:\Windows\System\bubuJQs.exe
  C:\Windows\System\bubuJQs.exe
  2⤵
  PID:13592
- C:\Windows\System\VZwwRDv.exe
  C:\Windows\System\VZwwRDv.exe
  2⤵
  PID:13716
- C:\Windows\System\Sssajvb.exe
  C:\Windows\System\Sssajvb.exe
  2⤵
  PID:13800
- C:\Windows\System\XClJYKW.exe
  C:\Windows\System\XClJYKW.exe
  2⤵
  PID:13920
- C:\Windows\System\nbnSjti.exe
  C:\Windows\System\nbnSjti.exe
  2⤵
  PID:13940
- C:\Windows\System\fXWUhIB.exe
  C:\Windows\System\fXWUhIB.exe
  2⤵
  PID:13996
- C:\Windows\System\OTkpeqS.exe
  C:\Windows\System\OTkpeqS.exe
  2⤵
  PID:14156
- C:\Windows\System\yTTTWLK.exe
  C:\Windows\System\yTTTWLK.exe
  2⤵
  PID:14256
- C:\Windows\System\QWpHpHF.exe
  C:\Windows\System\QWpHpHF.exe
  2⤵
  PID:13344
- C:\Windows\System\bVApFhH.exe
  C:\Windows\System\bVApFhH.exe
  2⤵
  PID:13472
- C:\Windows\System\vNWOKdX.exe
  C:\Windows\System\vNWOKdX.exe
  2⤵
  PID:13560
- C:\Windows\System\XcapEff.exe
  C:\Windows\System\XcapEff.exe
  2⤵
  PID:14048
- C:\Windows\System\tdfNKan.exe
  C:\Windows\System\tdfNKan.exe
  2⤵
  PID:4276
- C:\Windows\System\DYCxflJ.exe
  C:\Windows\System\DYCxflJ.exe
  2⤵
  PID:7036
- C:\Windows\System\DAKYUyd.exe
  C:\Windows\System\DAKYUyd.exe
  2⤵
  PID:13476
- C:\Windows\System\cqTkcoK.exe
  C:\Windows\System\cqTkcoK.exe
  2⤵
  PID:13512
- C:\Windows\System\dMCgJrE.exe
  C:\Windows\System\dMCgJrE.exe
  2⤵
  PID:3236
- C:\Windows\System\WTFONnt.exe
  C:\Windows\System\WTFONnt.exe
  2⤵
  PID:4904
- C:\Windows\System\eWMnggt.exe
  C:\Windows\System\eWMnggt.exe
  2⤵
  PID:3004
- C:\Windows\System\CbxzIRC.exe
  C:\Windows\System\CbxzIRC.exe
  2⤵
  PID:2936
- C:\Windows\System\jYuBzkf.exe
  C:\Windows\System\jYuBzkf.exe
  2⤵
  PID:13572
- C:\Windows\System\jHtmMtc.exe
  C:\Windows\System\jHtmMtc.exe
  2⤵
  PID:7848
- C:\Windows\System\fPaMrPg.exe
  C:\Windows\System\fPaMrPg.exe
  2⤵
  PID:13568
- C:\Windows\System\cJArILH.exe
  C:\Windows\System\cJArILH.exe
  2⤵
  PID:13744
- C:\Windows\System\SLLPQMY.exe
  C:\Windows\System\SLLPQMY.exe
  2⤵
  PID:13844
- C:\Windows\System\IqZiVaZ.exe
  C:\Windows\System\IqZiVaZ.exe
  2⤵
  PID:13896
- C:\Windows\System\KpPYSAS.exe
  C:\Windows\System\KpPYSAS.exe
  2⤵
  PID:8732
- C:\Windows\System\tfSQTkL.exe
  C:\Windows\System\tfSQTkL.exe
  2⤵
  PID:2908
- C:\Windows\System\dVQWbZm.exe
  C:\Windows\System\dVQWbZm.exe
  2⤵
  PID:13912
- C:\Windows\System\vHEluZf.exe
  C:\Windows\System\vHEluZf.exe
  2⤵
  PID:13984
- C:\Windows\System\GFWgija.exe
  C:\Windows\System\GFWgija.exe
  2⤵
  PID:14204
- C:\Windows\System\vqcqwoa.exe
  C:\Windows\System\vqcqwoa.exe
  2⤵
  PID:14088
- C:\Windows\System\WFlrmcc.exe
  C:\Windows\System\WFlrmcc.exe
  2⤵
  PID:14116
- C:\Windows\System\xewcdDK.exe
  C:\Windows\System\xewcdDK.exe
  2⤵
  PID:14168
- C:\Windows\System\dcPPzsu.exe
  C:\Windows\System\dcPPzsu.exe
  2⤵
  PID:1764
- C:\Windows\System\cmkyjXC.exe
  C:\Windows\System\cmkyjXC.exe
  2⤵
  PID:14288
- C:\Windows\System\FeLBwzT.exe
  C:\Windows\System\FeLBwzT.exe
  2⤵
  PID:1292
- C:\Windows\System\JIWtmnY.exe
  C:\Windows\System\JIWtmnY.exe
  2⤵
  PID:9200
- C:\Windows\System\OXXwFCv.exe
  C:\Windows\System\OXXwFCv.exe
  2⤵
  PID:4512
- C:\Windows\System\RFHjUDf.exe
  C:\Windows\System\RFHjUDf.exe
  2⤵
  PID:2056
- C:\Windows\System\qsBCGvr.exe
  C:\Windows\System\qsBCGvr.exe
  2⤵
  PID:1416
- C:\Windows\System\kNtCGFD.exe
  C:\Windows\System\kNtCGFD.exe
  2⤵
  PID:13508
- C:\Windows\System\KieTrtx.exe
  C:\Windows\System\KieTrtx.exe
  2⤵
  PID:1968
- C:\Windows\System\WTuZJDJ.exe
  C:\Windows\System\WTuZJDJ.exe
  2⤵
  PID:2916
- C:\Windows\System\PPTVUDt.exe
  C:\Windows\System\PPTVUDt.exe
  2⤵
  PID:9636
- C:\Windows\System\nfbevEm.exe
  C:\Windows\System\nfbevEm.exe
  2⤵
  PID:13856
- C:\Windows\System\rVlSJvg.exe
  C:\Windows\System\rVlSJvg.exe
  2⤵
  PID:5336
- C:\Windows\System\KDqVElL.exe
  C:\Windows\System\KDqVElL.exe
  2⤵
  PID:13776
- C:\Windows\System\IIsihwX.exe
  C:\Windows\System\IIsihwX.exe
  2⤵
  PID:4772
- C:\Windows\System\SstmhNS.exe
  C:\Windows\System\SstmhNS.exe
  2⤵
  PID:4468
- C:\Windows\System\PZYcpvi.exe
  C:\Windows\System\PZYcpvi.exe
  2⤵
  PID:14172
- C:\Windows\System\jtwbVVg.exe
  C:\Windows\System\jtwbVVg.exe
  2⤵
  PID:7228
- C:\Windows\System\FvlOdcH.exe
  C:\Windows\System\FvlOdcH.exe
  2⤵
  PID:3012
- C:\Windows\System\QxgnPoi.exe
  C:\Windows\System\QxgnPoi.exe
  2⤵
  PID:13092
- C:\Windows\System\eKVOceF.exe
  C:\Windows\System\eKVOceF.exe
  2⤵
  PID:3244
- C:\Windows\System\CyrkbIA.exe
  C:\Windows\System\CyrkbIA.exe
  2⤵
  PID:9248
- C:\Windows\System\gsrfGZh.exe
  C:\Windows\System\gsrfGZh.exe
  2⤵
  PID:1620
- C:\Windows\System\rJkOhJo.exe
  C:\Windows\System\rJkOhJo.exe
  2⤵
  PID:1596
- C:\Windows\System\GTlWQmK.exe
  C:\Windows\System\GTlWQmK.exe
  2⤵
  PID:9560
- C:\Windows\System\RkbAsTW.exe
  C:\Windows\System\RkbAsTW.exe
  2⤵
  PID:7528
- C:\Windows\System\NJrdvUB.exe
  C:\Windows\System\NJrdvUB.exe
  2⤵
  PID:8804
- C:\Windows\System\uIEeRGl.exe
  C:\Windows\System\uIEeRGl.exe
  2⤵
  PID:14200
- C:\Windows\System\EwRKdBQ.exe
  C:\Windows\System\EwRKdBQ.exe
  2⤵
  PID:3528
- C:\Windows\System\DmqyoDg.exe
  C:\Windows\System\DmqyoDg.exe
  2⤵
  PID:2756
- C:\Windows\System\XkbIQao.exe
  C:\Windows\System\XkbIQao.exe
  2⤵
  PID:8584
- C:\Windows\System\HWmKtxd.exe
  C:\Windows\System\HWmKtxd.exe
  2⤵
  PID:2840
- C:\Windows\System\ZPSdAQc.exe
  C:\Windows\System\ZPSdAQc.exe
  2⤵
  PID:4044
- C:\Windows\System\XfMcUgB.exe
  C:\Windows\System\XfMcUgB.exe
  2⤵
  PID:7844
- C:\Windows\System\ySxvKMo.exe
  C:\Windows\System\ySxvKMo.exe
  2⤵
  PID:4004
- C:\Windows\System\rtLymjB.exe
  C:\Windows\System\rtLymjB.exe
  2⤵
  PID:7772
- C:\Windows\System\FbrCEPf.exe
  C:\Windows\System\FbrCEPf.exe
  2⤵
  PID:14196
- C:\Windows\System\LIFOitp.exe
  C:\Windows\System\LIFOitp.exe
  2⤵
  PID:14092
- C:\Windows\System\WSrdFzO.exe
  C:\Windows\System\WSrdFzO.exe
  2⤵
  PID:7676
- C:\Windows\System\GmFdJSo.exe
  C:\Windows\System\GmFdJSo.exe
  2⤵
  PID:2032
- C:\Windows\System\zjolatn.exe
  C:\Windows\System\zjolatn.exe
  2⤵
  PID:5620
- C:\Windows\System\wJcuUId.exe
  C:\Windows\System\wJcuUId.exe
  2⤵
  PID:13360
- C:\Windows\System\OqRTRnb.exe
  C:\Windows\System\OqRTRnb.exe
  2⤵
  PID:5240
- C:\Windows\System\mjcYsmp.exe
  C:\Windows\System\mjcYsmp.exe
  2⤵
  PID:9768
- C:\Windows\System\KGBMgtD.exe
  C:\Windows\System\KGBMgtD.exe
  2⤵
  PID:5816
- C:\Windows\System\PVEymzA.exe
  C:\Windows\System\PVEymzA.exe
  2⤵
  PID:364
- C:\Windows\System\fKbJAdt.exe
  C:\Windows\System\fKbJAdt.exe
  2⤵
  PID:5940
- C:\Windows\System\ehAIeWT.exe
  C:\Windows\System\ehAIeWT.exe
  2⤵
  PID:10572
- C:\Windows\System\CJKPqyu.exe
  C:\Windows\System\CJKPqyu.exe
  2⤵
  PID:13340
- C:\Windows\System\FCcRFQf.exe
  C:\Windows\System\FCcRFQf.exe
  2⤵
  PID:64
- C:\Windows\System\tgzqihB.exe
  C:\Windows\System\tgzqihB.exe
  2⤵
  PID:9148
- C:\Windows\System\DBuowbj.exe
  C:\Windows\System\DBuowbj.exe
  2⤵
  PID:912
- C:\Windows\System\GwauPEo.exe
  C:\Windows\System\GwauPEo.exe
  2⤵
  PID:5140
- C:\Windows\System\OjQniqH.exe
  C:\Windows\System\OjQniqH.exe
  2⤵
  PID:5632
- C:\Windows\System\ufarkEH.exe
  C:\Windows\System\ufarkEH.exe
  2⤵
  PID:3172
- C:\Windows\System\tHhRgTV.exe
  C:\Windows\System\tHhRgTV.exe
  2⤵
  PID:5256
- C:\Windows\System\suYneBp.exe
  C:\Windows\System\suYneBp.exe
  2⤵
  PID:5108
- C:\Windows\System\rCDDnoQ.exe
  C:\Windows\System\rCDDnoQ.exe
  2⤵
  PID:4844
- C:\Windows\System\eQdlzrf.exe
  C:\Windows\System\eQdlzrf.exe
  2⤵
  PID:3052
- C:\Windows\System\aJXOTgd.exe
  C:\Windows\System\aJXOTgd.exe
  2⤵
  PID:5520
- C:\Windows\System\sLARvvD.exe
  C:\Windows\System\sLARvvD.exe
  2⤵
  PID:14236
- C:\Windows\System\xQfMDgY.exe
  C:\Windows\System\xQfMDgY.exe
  2⤵
  PID:13872
- C:\Windows\System\DugEuFB.exe
  C:\Windows\System\DugEuFB.exe
  2⤵
  PID:1732
- C:\Windows\System\IPpwpXx.exe
  C:\Windows\System\IPpwpXx.exe
  2⤵
  PID:5356
- C:\Windows\System\sTCavDX.exe
  C:\Windows\System\sTCavDX.exe
  2⤵
  PID:3288
- C:\Windows\System\GAHvWhX.exe
  C:\Windows\System\GAHvWhX.exe
  2⤵
  PID:13616
- C:\Windows\System\ydhLCsF.exe
  C:\Windows\System\ydhLCsF.exe
  2⤵
  PID:5380
- C:\Windows\System\ZovzudJ.exe
  C:\Windows\System\ZovzudJ.exe
  2⤵
  PID:5948
- C:\Windows\System\ArMUCiV.exe
  C:\Windows\System\ArMUCiV.exe
  2⤵
  PID:4940
- C:\Windows\System\xVGQFLF.exe
  C:\Windows\System\xVGQFLF.exe
  2⤵
  PID:512
- C:\Windows\System\legJLfT.exe
  C:\Windows\System\legJLfT.exe
  2⤵
  PID:5056
- C:\Windows\System\NGarsQr.exe
  C:\Windows\System\NGarsQr.exe
  2⤵
  PID:8532
- C:\Windows\System\eANhijX.exe
  C:\Windows\System\eANhijX.exe
  2⤵
  PID:5252
- C:\Windows\System\gYfwEht.exe
  C:\Windows\System\gYfwEht.exe
  2⤵
  PID:13516
- C:\Windows\System\KCEgndD.exe
  C:\Windows\System\KCEgndD.exe
  2⤵
  PID:10672
- C:\Windows\System\qKJllAu.exe
  C:\Windows\System\qKJllAu.exe
  2⤵
  PID:12148
- C:\Windows\System\DalRBpk.exe
  C:\Windows\System\DalRBpk.exe
  2⤵
  PID:5692
- C:\Windows\System\KrsqLvA.exe
  C:\Windows\System\KrsqLvA.exe
  2⤵
  PID:6060
- C:\Windows\System\oMSPpBa.exe
  C:\Windows\System\oMSPpBa.exe
  2⤵
  PID:5312
- C:\Windows\System\MNCdxuC.exe
  C:\Windows\System\MNCdxuC.exe
  2⤵
  PID:5348
- C:\Windows\System\qYaZvWd.exe
  C:\Windows\System\qYaZvWd.exe
  2⤵
  PID:2564
- C:\Windows\System\JopZBmm.exe
  C:\Windows\System\JopZBmm.exe
  2⤵
  PID:6080
- C:\Windows\System\qEegWRV.exe
  C:\Windows\System\qEegWRV.exe
  2⤵
  PID:11496
- C:\Windows\System\UbHMdrn.exe
  C:\Windows\System\UbHMdrn.exe
  2⤵
  PID:5408
- C:\Windows\System\EnIsWnD.exe
  C:\Windows\System\EnIsWnD.exe
  2⤵
  PID:13928
- C:\Windows\System\AmLqTJN.exe
  C:\Windows\System\AmLqTJN.exe
  2⤵
  PID:5728
- C:\Windows\System\DQtrZBl.exe
  C:\Windows\System\DQtrZBl.exe
  2⤵
  PID:14328
- C:\Windows\System\qRDLvFk.exe
  C:\Windows\System\qRDLvFk.exe
  2⤵
  PID:6504
- C:\Windows\System\ADBCrhl.exe
  C:\Windows\System\ADBCrhl.exe
  2⤵
  PID:6584
- C:\Windows\System\iLhYDOZ.exe
  C:\Windows\System\iLhYDOZ.exe
  2⤵
  PID:13148
- C:\Windows\System\DrNhzpN.exe
  C:\Windows\System\DrNhzpN.exe
  2⤵
  PID:6672
- C:\Windows\System\HCdOxsD.exe
  C:\Windows\System\HCdOxsD.exe
  2⤵
  PID:6616
- C:\Windows\System\nVOYZpr.exe
  C:\Windows\System\nVOYZpr.exe
  2⤵
  PID:9208
- C:\Windows\System\GsybRIb.exe
  C:\Windows\System\GsybRIb.exe
  2⤵
  PID:13676
- C:\Windows\System\wqHxmyh.exe
  C:\Windows\System\wqHxmyh.exe
  2⤵
  PID:7304
- C:\Windows\System\lmDVvBV.exe
  C:\Windows\System\lmDVvBV.exe
  2⤵
  PID:14184
- C:\Windows\System\TaFNCVx.exe
  C:\Windows\System\TaFNCVx.exe
  2⤵
  PID:5896
- C:\Windows\System\liiEbYY.exe
  C:\Windows\System\liiEbYY.exe
  2⤵
  PID:5484
- C:\Windows\System\ujinLPU.exe
  C:\Windows\System\ujinLPU.exe
  2⤵
  PID:5956
- C:\Windows\System\RQNIwFQ.exe
  C:\Windows\System\RQNIwFQ.exe
  2⤵
  PID:5840
- C:\Windows\System\rUFGDJq.exe
  C:\Windows\System\rUFGDJq.exe
  2⤵
  PID:3568
- C:\Windows\System\dmyaIWq.exe
  C:\Windows\System\dmyaIWq.exe
  2⤵
  PID:12196
- C:\Windows\System\vBTWxfr.exe
  C:\Windows\System\vBTWxfr.exe
  2⤵
  PID:13244
- C:\Windows\System\LxqrqzW.exe
  C:\Windows\System\LxqrqzW.exe
  2⤵
  PID:5088
- C:\Windows\System\DhBqdqt.exe
  C:\Windows\System\DhBqdqt.exe
  2⤵
  PID:12328
- C:\Windows\System\Afsyyzf.exe
  C:\Windows\System\Afsyyzf.exe
  2⤵
  PID:12608
- C:\Windows\System\WhOKHfM.exe
  C:\Windows\System\WhOKHfM.exe
  2⤵
  PID:6828
- C:\Windows\System\zqsbEtR.exe
  C:\Windows\System\zqsbEtR.exe
  2⤵
  PID:2788
- C:\Windows\System\ZgMNiEe.exe
  C:\Windows\System\ZgMNiEe.exe
  2⤵
  PID:5748
- C:\Windows\System\MvkbLpU.exe
  C:\Windows\System\MvkbLpU.exe
  2⤵
  PID:6136
- C:\Windows\System\HNTpNVX.exe
  C:\Windows\System\HNTpNVX.exe
  2⤵
  PID:12676
- C:\Windows\System\gJzkAGa.exe
  C:\Windows\System\gJzkAGa.exe
  2⤵
  PID:5760
- C:\Windows\System\vbNhodZ.exe
  C:\Windows\System\vbNhodZ.exe
  2⤵
  PID:3660
- C:\Windows\System\QYEbPtL.exe
  C:\Windows\System\QYEbPtL.exe
  2⤵
  PID:10848
- C:\Windows\System\rzvBKxW.exe
  C:\Windows\System\rzvBKxW.exe
  2⤵
  PID:11476
- C:\Windows\System\QHncYfB.exe
  C:\Windows\System\QHncYfB.exe
  2⤵
  PID:12576
- C:\Windows\System\pnaskJD.exe
  C:\Windows\System\pnaskJD.exe
  2⤵
  PID:13944
- C:\Windows\System\GVWoTwq.exe
  C:\Windows\System\GVWoTwq.exe
  2⤵
  PID:2472
- C:\Windows\System\YWVGSsJ.exe
  C:\Windows\System\YWVGSsJ.exe
  2⤵
  PID:5980
- C:\Windows\System\ilZJufB.exe
  C:\Windows\System\ilZJufB.exe
  2⤵
  PID:11548
- C:\Windows\System\pWWMsEX.exe
  C:\Windows\System\pWWMsEX.exe
  2⤵
  PID:2452
- C:\Windows\System\dqmJuYf.exe
  C:\Windows\System\dqmJuYf.exe
  2⤵
  PID:2004
- C:\Windows\System\UUzDcEn.exe
  C:\Windows\System\UUzDcEn.exe
  2⤵
  PID:14244
- C:\Windows\System\BGGTXao.exe
  C:\Windows\System\BGGTXao.exe
  2⤵
  PID:5700
- C:\Windows\System\zWhoKav.exe
  C:\Windows\System\zWhoKav.exe
  2⤵
  PID:10424
- C:\Windows\System\ezTkvMH.exe
  C:\Windows\System\ezTkvMH.exe
  2⤵
  PID:6392
- C:\Windows\System\qIWBkzB.exe
  C:\Windows\System\qIWBkzB.exe
  2⤵
  PID:6528
- C:\Windows\System\UqDzAPa.exe
  C:\Windows\System\UqDzAPa.exe
  2⤵
  PID:9212
- C:\Windows\System\tgOcTon.exe
  C:\Windows\System\tgOcTon.exe
  2⤵
  PID:6592
- C:\Windows\System\klGzsVp.exe
  C:\Windows\System\klGzsVp.exe
  2⤵
  PID:6908
- C:\Windows\System\axJRvIB.exe
  C:\Windows\System\axJRvIB.exe
  2⤵
  PID:13164
- C:\Windows\System\qfFBhlC.exe
  C:\Windows\System\qfFBhlC.exe
  2⤵
  PID:5996
- C:\Windows\System\MRtdwFK.exe
  C:\Windows\System\MRtdwFK.exe
  2⤵
  PID:6780
- C:\Windows\System\BbcFUGq.exe
  C:\Windows\System\BbcFUGq.exe
  2⤵
  PID:7124
- C:\Windows\System\oGYlVok.exe
  C:\Windows\System\oGYlVok.exe
  2⤵
  PID:6884
- C:\Windows\System\hJzzjWp.exe
  C:\Windows\System\hJzzjWp.exe
  2⤵
  PID:4624
- C:\Windows\System\jySPJag.exe
  C:\Windows\System\jySPJag.exe
  2⤵
  PID:6016
- C:\Windows\System\PDyiCos.exe
  C:\Windows\System\PDyiCos.exe
  2⤵
  PID:652
- C:\Windows\System\ugNjMSy.exe
  C:\Windows\System\ugNjMSy.exe
  2⤵
  PID:3140
- C:\Windows\System\UphyiNB.exe
  C:\Windows\System\UphyiNB.exe
  2⤵
  PID:6196
- C:\Windows\System\JiWCDGr.exe
  C:\Windows\System\JiWCDGr.exe
  2⤵
  PID:7180
- C:\Windows\System\jrvEpNA.exe
  C:\Windows\System\jrvEpNA.exe
  2⤵
  PID:6732
- C:\Windows\System\oNTXlUq.exe
  C:\Windows\System\oNTXlUq.exe
  2⤵
  PID:4364
- C:\Windows\System\xpWrTfz.exe
  C:\Windows\System\xpWrTfz.exe
  2⤵
  PID:7272
- C:\Windows\System\bxNjluP.exe
  C:\Windows\System\bxNjluP.exe
  2⤵
  PID:4404
- C:\Windows\System\xHQeOoH.exe
  C:\Windows\System\xHQeOoH.exe
  2⤵
  PID:6944
- C:\Windows\System\fUMDwVT.exe
  C:\Windows\System\fUMDwVT.exe
  2⤵
  PID:6308
- C:\Windows\System\LMLGIzp.exe
  C:\Windows\System\LMLGIzp.exe
  2⤵
  PID:11456
- C:\Windows\System\DIgxVGO.exe
  C:\Windows\System\DIgxVGO.exe
  2⤵
  PID:7452
- C:\Windows\System\MLFUeAo.exe
  C:\Windows\System\MLFUeAo.exe
  2⤵
  PID:6876
- C:\Windows\System\ZUCJsPI.exe
  C:\Windows\System\ZUCJsPI.exe
  2⤵
  PID:6796
- C:\Windows\System\JMLwiMU.exe
  C:\Windows\System\JMLwiMU.exe
  2⤵
  PID:10244
- C:\Windows\System\lArWmkN.exe
  C:\Windows\System\lArWmkN.exe
  2⤵
  PID:5092
- C:\Windows\System\JXfWuig.exe
  C:\Windows\System\JXfWuig.exe
  2⤵
  PID:6116
- C:\Windows\System\lDcgiwJ.exe
  C:\Windows\System\lDcgiwJ.exe
  2⤵
  PID:7888
- C:\Windows\System\wZWUskQ.exe
  C:\Windows\System\wZWUskQ.exe
  2⤵
  PID:1804
- C:\Windows\System\HYKJJuT.exe
  C:\Windows\System\HYKJJuT.exe
  2⤵
  PID:6904
- C:\Windows\System\pUhujAT.exe
  C:\Windows\System\pUhujAT.exe
  2⤵
  PID:7760
- C:\Windows\System\SpZziNf.exe
  C:\Windows\System\SpZziNf.exe
  2⤵
  PID:8080
- C:\Windows\System\qlhGrgH.exe
  C:\Windows\System\qlhGrgH.exe
  2⤵
  PID:7408
- C:\Windows\System\XTvXtOs.exe
  C:\Windows\System\XTvXtOs.exe
  2⤵
  PID:13460
- C:\Windows\System\lOZlJAj.exe
  C:\Windows\System\lOZlJAj.exe
  2⤵
  PID:8000
- C:\Windows\System\LCzwZWs.exe
  C:\Windows\System\LCzwZWs.exe
  2⤵
  PID:7112
- C:\Windows\System\CDOddfi.exe
  C:\Windows\System\CDOddfi.exe
  2⤵
  PID:1500
- C:\Windows\System\PTwtyxZ.exe
  C:\Windows\System\PTwtyxZ.exe
  2⤵
  PID:6208
- C:\Windows\System\NUUhfkB.exe
  C:\Windows\System\NUUhfkB.exe
  2⤵
  PID:1696
- C:\Windows\System\HJIBdZU.exe
  C:\Windows\System\HJIBdZU.exe
  2⤵
  PID:6344
- C:\Windows\System\PPQaJoZ.exe
  C:\Windows\System\PPQaJoZ.exe
  2⤵
  PID:5920
- C:\Windows\System\HOxKTMZ.exe
  C:\Windows\System\HOxKTMZ.exe
  2⤵
  PID:552
- C:\Windows\System\huAnlbI.exe
  C:\Windows\System\huAnlbI.exe
  2⤵
  PID:8044
- C:\Windows\System\hzaxpMn.exe
  C:\Windows\System\hzaxpMn.exe
  2⤵
  PID:8180
- C:\Windows\System\SWQIKcd.exe
  C:\Windows\System\SWQIKcd.exe
  2⤵
  PID:5464
- C:\Windows\System\ynDJuSd.exe
  C:\Windows\System\ynDJuSd.exe
  2⤵
  PID:2500
- C:\Windows\System\TyWDnUB.exe
  C:\Windows\System\TyWDnUB.exe
  2⤵
  PID:216
- C:\Windows\System\CVLeqip.exe
  C:\Windows\System\CVLeqip.exe
  2⤵
  PID:8140
- C:\Windows\System\WDzVopt.exe
  C:\Windows\System\WDzVopt.exe
  2⤵
  PID:8404
- C:\Windows\System\ySdcEZY.exe
  C:\Windows\System\ySdcEZY.exe
  2⤵
  PID:716
- C:\Windows\System\ZOvchuu.exe
  C:\Windows\System\ZOvchuu.exe
  2⤵
  PID:8716
- C:\Windows\System\avTnEWm.exe
  C:\Windows\System\avTnEWm.exe
  2⤵
  PID:6728
- C:\Windows\System\PPcJjkN.exe
  C:\Windows\System\PPcJjkN.exe
  2⤵
  PID:8992
- C:\Windows\System\kfIYoYe.exe
  C:\Windows\System\kfIYoYe.exe
  2⤵
  PID:8004
- C:\Windows\System\UTVlgcZ.exe
  C:\Windows\System\UTVlgcZ.exe
  2⤵
  PID:8340
- C:\Windows\System\gOEeeGB.exe
  C:\Windows\System\gOEeeGB.exe
  2⤵
  PID:7624
- C:\Windows\System\PYWEIhj.exe
  C:\Windows\System\PYWEIhj.exe
  2⤵
  PID:9616
- C:\Windows\System\XfbYcMs.exe
  C:\Windows\System\XfbYcMs.exe
  2⤵
  PID:9572
- C:\Windows\System\KdnvrcP.exe
  C:\Windows\System\KdnvrcP.exe
  2⤵
  PID:9084
- C:\Windows\System\JhsdLgv.exe
  C:\Windows\System\JhsdLgv.exe
  2⤵
  PID:8552
- C:\Windows\System\OZjJgEW.exe
  C:\Windows\System\OZjJgEW.exe
  2⤵
  PID:7812
- C:\Windows\System\qMBDWyo.exe
  C:\Windows\System\qMBDWyo.exe
  2⤵
  PID:8996
- C:\Windows\System\fXTqWWF.exe
  C:\Windows\System\fXTqWWF.exe
  2⤵
  PID:9412
- C:\Windows\System\xuOfzjI.exe
  C:\Windows\System\xuOfzjI.exe
  2⤵
  PID:5428
- C:\Windows\System\oojCgXa.exe
  C:\Windows\System\oojCgXa.exe
  2⤵
  PID:8580
- C:\Windows\System\HrrohFS.exe
  C:\Windows\System\HrrohFS.exe
  2⤵
  PID:9020
- C:\Windows\System\KLqozcV.exe
  C:\Windows\System\KLqozcV.exe
  2⤵
  PID:8268
- C:\Windows\System\BUqSPKb.exe
  C:\Windows\System\BUqSPKb.exe
  2⤵
  PID:3000
- C:\Windows\System\JVmiCbD.exe
  C:\Windows\System\JVmiCbD.exe
  2⤵
  PID:12740
- C:\Windows\System\jwbHWuJ.exe
  C:\Windows\System\jwbHWuJ.exe
  2⤵
  PID:8608
- C:\Windows\System\OcQQPgb.exe
  C:\Windows\System\OcQQPgb.exe
  2⤵
  PID:9500
- C:\Windows\System\QgtwYht.exe
  C:\Windows\System\QgtwYht.exe
  2⤵
  PID:9476
- C:\Windows\System\QSaamEI.exe
  C:\Windows\System\QSaamEI.exe
  2⤵
  PID:8708
- C:\Windows\System\cKsLUCQ.exe
  C:\Windows\System\cKsLUCQ.exe
  2⤵
  PID:4872
- C:\Windows\System\cLeeOhJ.exe
  C:\Windows\System\cLeeOhJ.exe
  2⤵
  PID:8064
- C:\Windows\System\cbjOpSP.exe
  C:\Windows\System\cbjOpSP.exe
  2⤵
  PID:5744
- C:\Windows\System\EXNvyfA.exe
  C:\Windows\System\EXNvyfA.exe
  2⤵
  PID:9492
- C:\Windows\System\rUgbneD.exe
  C:\Windows\System\rUgbneD.exe
  2⤵
  PID:10152
- C:\Windows\System\SeqAErn.exe
  C:\Windows\System\SeqAErn.exe
  2⤵
  PID:4796
- C:\Windows\System\ZnBftrD.exe
  C:\Windows\System\ZnBftrD.exe
  2⤵
  PID:9932
- C:\Windows\System\pEIsgou.exe
  C:\Windows\System\pEIsgou.exe
  2⤵
  PID:10216
- C:\Windows\System\spbDLyf.exe
  C:\Windows\System\spbDLyf.exe
  2⤵
  PID:12712
- C:\Windows\System\PHpZzrG.exe
  C:\Windows\System\PHpZzrG.exe
  2⤵
  PID:9696
- C:\Windows\System\NvAeIFg.exe
  C:\Windows\System\NvAeIFg.exe
  2⤵
  PID:9804
- C:\Windows\System\ARGAxrQ.exe
  C:\Windows\System\ARGAxrQ.exe
  2⤵
  PID:9404
- C:\Windows\System\JMtICaF.exe
  C:\Windows\System\JMtICaF.exe
  2⤵
  PID:8980
- C:\Windows\System\wRmRqwY.exe
  C:\Windows\System\wRmRqwY.exe
  2⤵
  PID:8796
- C:\Windows\System\rOnckLn.exe
  C:\Windows\System\rOnckLn.exe
  2⤵
  PID:10184
- C:\Windows\System\zmtnEDG.exe
  C:\Windows\System\zmtnEDG.exe
  2⤵
  PID:7704
- C:\Windows\System\kSSkWfB.exe
  C:\Windows\System\kSSkWfB.exe
  2⤵
  PID:10248
- C:\Windows\System\cdvezwk.exe
  C:\Windows\System\cdvezwk.exe
  2⤵
  PID:5212
- C:\Windows\System\vuYjsCY.exe
  C:\Windows\System\vuYjsCY.exe
  2⤵
  PID:10340
- C:\Windows\System\RDeOWlR.exe
  C:\Windows\System\RDeOWlR.exe
  2⤵
  PID:10372
- C:\Windows\System\fyWszMP.exe
  C:\Windows\System\fyWszMP.exe
  2⤵
  PID:6624
- C:\Windows\System\DlkzpMH.exe
  C:\Windows\System\DlkzpMH.exe
  2⤵
  PID:8676
- C:\Windows\System\stXIena.exe
  C:\Windows\System\stXIena.exe
  2⤵
  PID:8504
- C:\Windows\System\mJGZprp.exe
  C:\Windows\System\mJGZprp.exe
  2⤵
  PID:9260
- C:\Windows\System\YDtbAEp.exe
  C:\Windows\System\YDtbAEp.exe
  2⤵
  PID:13456
- C:\Windows\System\GJRkFfr.exe
  C:\Windows\System\GJRkFfr.exe
  2⤵
  PID:10608
- C:\Windows\System\xGPreQN.exe
  C:\Windows\System\xGPreQN.exe
  2⤵
  PID:10732
- C:\Windows\System\iismnkL.exe
  C:\Windows\System\iismnkL.exe
  2⤵
  PID:3296
- C:\Windows\System\iWIIlrZ.exe
  C:\Windows\System\iWIIlrZ.exe
  2⤵
  PID:11064
- C:\Windows\System\NcHSDUk.exe
  C:\Windows\System\NcHSDUk.exe
  2⤵
  PID:6648
- C:\Windows\System\UgWpxXx.exe
  C:\Windows\System\UgWpxXx.exe
  2⤵
  PID:10936
- C:\Windows\System\kogCgct.exe
  C:\Windows\System\kogCgct.exe
  2⤵
  PID:14016
- C:\Windows\System\NZoaoxm.exe
  C:\Windows\System\NZoaoxm.exe
  2⤵
  PID:11020
- C:\Windows\System\uzZvLqo.exe
  C:\Windows\System\uzZvLqo.exe
  2⤵
  PID:9988
- C:\Windows\System\scsazyu.exe
  C:\Windows\System\scsazyu.exe
  2⤵
  PID:11244
- C:\Windows\System\vLidnQs.exe
  C:\Windows\System\vLidnQs.exe
  2⤵
  PID:9632
- C:\Windows\System\izVXhhI.exe
  C:\Windows\System\izVXhhI.exe
  2⤵
  PID:11216
- C:\Windows\System\BsXRQGz.exe
  C:\Windows\System\BsXRQGz.exe
  2⤵
  PID:9928
- C:\Windows\System\hlPWbXS.exe
  C:\Windows\System\hlPWbXS.exe
  2⤵
  PID:10356
- C:\Windows\System\hGQhxqS.exe
  C:\Windows\System\hGQhxqS.exe
  2⤵
  PID:8376
- C:\Windows\System\ctoYbCO.exe
  C:\Windows\System\ctoYbCO.exe
  2⤵
  PID:8572
- C:\Windows\System\SaRLnrl.exe
  C:\Windows\System\SaRLnrl.exe
  2⤵
  PID:9408
- C:\Windows\System\FSkkFgp.exe
  C:\Windows\System\FSkkFgp.exe
  2⤵
  PID:10380
- C:\Windows\System\tSOUpyG.exe
  C:\Windows\System\tSOUpyG.exe
  2⤵
  PID:10388
- C:\Windows\System\DFAXGZs.exe
  C:\Windows\System\DFAXGZs.exe
  2⤵
  PID:10484
- C:\Windows\System\RCuTXGz.exe
  C:\Windows\System\RCuTXGz.exe
  2⤵
  PID:10564
- C:\Windows\System\QitXYag.exe
  C:\Windows\System\QitXYag.exe
  2⤵
  PID:10612
- C:\Windows\System\sCSFdVr.exe
  C:\Windows\System\sCSFdVr.exe
  2⤵
  PID:7000
- C:\Windows\System\HGwuZoi.exe
  C:\Windows\System\HGwuZoi.exe
  2⤵
  PID:9424
- C:\Windows\System\fUIpAZS.exe
  C:\Windows\System\fUIpAZS.exe
  2⤵
  PID:11208
- C:\Windows\System\YguvyUv.exe
  C:\Windows\System\YguvyUv.exe
  2⤵
  PID:7800
- C:\Windows\System\erVufBA.exe
  C:\Windows\System\erVufBA.exe
  2⤵
  PID:7852
- C:\Windows\System\iFmpLNz.exe
  C:\Windows\System\iFmpLNz.exe
  2⤵
  PID:10708
- C:\Windows\System\hNWKpEs.exe
  C:\Windows\System\hNWKpEs.exe
  2⤵
  PID:10580
- C:\Windows\System\cAlaGmG.exe
  C:\Windows\System\cAlaGmG.exe
  2⤵
  PID:8904
- C:\Windows\System\utEUUXn.exe
  C:\Windows\System\utEUUXn.exe
  2⤵
  PID:10744
- C:\Windows\System\IYPMtjv.exe
  C:\Windows\System\IYPMtjv.exe
  2⤵
  PID:10400
- C:\Windows\System\ISpHibi.exe
  C:\Windows\System\ISpHibi.exe
  2⤵
  PID:11388
- C:\Windows\System\MYUXEAv.exe
  C:\Windows\System\MYUXEAv.exe
  2⤵
  PID:14152
- C:\Windows\System\difKHBA.exe
  C:\Windows\System\difKHBA.exe
  2⤵
  PID:10952
- C:\Windows\System\EhLLHeL.exe
  C:\Windows\System\EhLLHeL.exe
  2⤵
  PID:10376
- C:\Windows\System\UhfxUWO.exe
  C:\Windows\System\UhfxUWO.exe
  2⤵
  PID:11608
- C:\Windows\System\vsDFCKa.exe
  C:\Windows\System\vsDFCKa.exe
  2⤵
  PID:8792
- C:\Windows\System\nfBTaOb.exe
  C:\Windows\System\nfBTaOb.exe
  2⤵
  PID:11640
- C:\Windows\System\qXAXwit.exe
  C:\Windows\System\qXAXwit.exe
  2⤵
  PID:7504
- C:\Windows\System\BxTSPnc.exe
  C:\Windows\System\BxTSPnc.exe
  2⤵
  PID:9976
- C:\Windows\System\iFRArQr.exe
  C:\Windows\System\iFRArQr.exe
  2⤵
  PID:11800
- C:\Windows\System\Pnorwme.exe
  C:\Windows\System\Pnorwme.exe
  2⤵
  PID:11072
- C:\Windows\System\qbFyrcD.exe
  C:\Windows\System\qbFyrcD.exe
  2⤵
  PID:11644
- C:\Windows\System\jGxpDUQ.exe
  C:\Windows\System\jGxpDUQ.exe
  2⤵
  PID:11684
- C:\Windows\System\vsgmgru.exe
  C:\Windows\System\vsgmgru.exe
  2⤵
  PID:12268
- C:\Windows\System\BlZPrHE.exe
  C:\Windows\System\BlZPrHE.exe
  2⤵
  PID:10088
- C:\Windows\System\AQntLRB.exe
  C:\Windows\System\AQntLRB.exe
  2⤵
  PID:9940
- C:\Windows\System\rVYNJGr.exe
  C:\Windows\System\rVYNJGr.exe
  2⤵
  PID:12296
- C:\Windows\System\aupDfEs.exe
  C:\Windows\System\aupDfEs.exe
  2⤵
  PID:5608
- C:\Windows\System\EpdFbjD.exe
  C:\Windows\System\EpdFbjD.exe
  2⤵
  PID:12072
- C:\Windows\System\zwCCMGB.exe
  C:\Windows\System\zwCCMGB.exe
  2⤵
  PID:10504
- C:\Windows\System\TSRxiVM.exe
  C:\Windows\System\TSRxiVM.exe
  2⤵
  PID:12200
- C:\Windows\System\djpTFcc.exe
  C:\Windows\System\djpTFcc.exe
  2⤵
  PID:11816
- C:\Windows\System\hFZyLtO.exe
  C:\Windows\System\hFZyLtO.exe
  2⤵
  PID:10844
- C:\Windows\System\TCQkjNl.exe
  C:\Windows\System\TCQkjNl.exe
  2⤵
  PID:11436
- C:\Windows\System\mPzQlpa.exe
  C:\Windows\System\mPzQlpa.exe
  2⤵
  PID:8428
- C:\Windows\System\ZHQkDFz.exe
  C:\Windows\System\ZHQkDFz.exe
  2⤵
  PID:11432
- C:\Windows\System\xEkfeWX.exe
  C:\Windows\System\xEkfeWX.exe
  2⤵
  PID:9540
- C:\Windows\System\ncmSOgX.exe
  C:\Windows\System\ncmSOgX.exe
  2⤵
  PID:8672
- C:\Windows\System\TIbLfYk.exe
  C:\Windows\System\TIbLfYk.exe
  2⤵
  PID:10432
- C:\Windows\System\sXUgayn.exe
  C:\Windows\System\sXUgayn.exe
  2⤵
  PID:8760
- C:\Windows\System\bQteemB.exe
  C:\Windows\System\bQteemB.exe
  2⤵
  PID:12228
- C:\Windows\System\iOoClTV.exe
  C:\Windows\System\iOoClTV.exe
  2⤵
  PID:11948
- C:\Windows\System\datgXoK.exe
  C:\Windows\System\datgXoK.exe
  2⤵
  PID:11756
- C:\Windows\System\ZuRZdrm.exe
  C:\Windows\System\ZuRZdrm.exe
  2⤵
  PID:11516
- C:\Windows\System\YwelLIF.exe
  C:\Windows\System\YwelLIF.exe
  2⤵
  PID:12472
- C:\Windows\System\nqmnede.exe
  C:\Windows\System\nqmnede.exe
  2⤵
  PID:10792
- C:\Windows\System\ywYZwFK.exe
  C:\Windows\System\ywYZwFK.exe
  2⤵
  PID:12160
- C:\Windows\System\GhZUuXc.exe
  C:\Windows\System\GhZUuXc.exe
  2⤵
  PID:11312
- C:\Windows\System\wiOQqXl.exe
  C:\Windows\System\wiOQqXl.exe
  2⤵
  PID:12604
- C:\Windows\System\WnpSLDZ.exe
  C:\Windows\System\WnpSLDZ.exe
  2⤵
  PID:11728
- C:\Windows\System\rchfCsE.exe
  C:\Windows\System\rchfCsE.exe
  2⤵
  PID:6424
- C:\Windows\System\hhILtvx.exe
  C:\Windows\System\hhILtvx.exe
  2⤵
  PID:7716
- C:\Windows\System\LePZGCj.exe
  C:\Windows\System\LePZGCj.exe
  2⤵
  PID:11048
- C:\Windows\System\TNLzfgY.exe
  C:\Windows\System\TNLzfgY.exe
  2⤵
  PID:12216
- C:\Windows\System\wjbKGVh.exe
  C:\Windows\System\wjbKGVh.exe
  2⤵
  PID:12816
- C:\Windows\System\zhEvjvZ.exe
  C:\Windows\System\zhEvjvZ.exe
  2⤵
  PID:12888
- C:\Windows\System\cdLWtcP.exe
  C:\Windows\System\cdLWtcP.exe
  2⤵
  PID:9956
- C:\Windows\System\oTXFwqT.exe
  C:\Windows\System\oTXFwqT.exe
  2⤵
  PID:10596
- C:\Windows\System\gotAkJc.exe
  C:\Windows\System\gotAkJc.exe
  2⤵
  PID:10404
- C:\Windows\System\jVstWxV.exe
  C:\Windows\System\jVstWxV.exe
  2⤵
  PID:11976
- C:\Windows\System\IDiCekG.exe
  C:\Windows\System\IDiCekG.exe
  2⤵
  PID:9504
- C:\Windows\System\JHwgFBT.exe
  C:\Windows\System\JHwgFBT.exe
  2⤵
  PID:13268
- C:\Windows\System\EdarDOR.exe
  C:\Windows\System\EdarDOR.exe
  2⤵
  PID:12448
- C:\Windows\System\IBTAwhv.exe
  C:\Windows\System\IBTAwhv.exe
  2⤵
  PID:7660
- C:\Windows\System\TlBgjUc.exe
  C:\Windows\System\TlBgjUc.exe
  2⤵
  PID:7628
- C:\Windows\System\EXWShUT.exe
  C:\Windows\System\EXWShUT.exe
  2⤵
  PID:12236
- C:\Windows\System\yyXyvDM.exe
  C:\Windows\System\yyXyvDM.exe
  2⤵
  PID:11880
- C:\Windows\System\qKzahho.exe
  C:\Windows\System\qKzahho.exe
  2⤵
  PID:12660
- C:\Windows\System\eOFTnDl.exe
  C:\Windows\System\eOFTnDl.exe
  2⤵
  PID:9516
- C:\Windows\System\PTqAQJj.exe
  C:\Windows\System\PTqAQJj.exe
  2⤵
  PID:12764
- C:\Windows\System\NAFTxki.exe
  C:\Windows\System\NAFTxki.exe
  2⤵
  PID:12572
- C:\Windows\System\kRRhfkH.exe
  C:\Windows\System\kRRhfkH.exe
  2⤵
  PID:3976
- C:\Windows\System\JSoHham.exe
  C:\Windows\System\JSoHham.exe
  2⤵
  PID:12984
- C:\Windows\System\JmNioOQ.exe
  C:\Windows\System\JmNioOQ.exe
  2⤵
  PID:12848
- C:\Windows\System\aIWoIiz.exe
  C:\Windows\System\aIWoIiz.exe
  2⤵
  PID:9624
- C:\Windows\System\pwyyJwJ.exe
  C:\Windows\System\pwyyJwJ.exe
  2⤵
  PID:212
- C:\Windows\System\OMWeLDc.exe
  C:\Windows\System\OMWeLDc.exe
  2⤵
  PID:11932
- C:\Windows\System\hzOYtki.exe
  C:\Windows\System\hzOYtki.exe
  2⤵
  PID:6292
- C:\Windows\System\jLhqFDT.exe
  C:\Windows\System\jLhqFDT.exe
  2⤵
  PID:9748
- C:\Windows\System\oGLlaYf.exe
  C:\Windows\System\oGLlaYf.exe
  2⤵
  PID:11636
- C:\Windows\System\EkLdqjk.exe
  C:\Windows\System\EkLdqjk.exe
  2⤵
  PID:11172
- C:\Windows\System\FlWJyOu.exe
  C:\Windows\System\FlWJyOu.exe
  2⤵
  PID:11460
- C:\Windows\System\zJqCHKz.exe
  C:\Windows\System\zJqCHKz.exe
  2⤵
  PID:11652
- C:\Windows\System\KQKgWgN.exe
  C:\Windows\System\KQKgWgN.exe
  2⤵
  PID:11668
- C:\Windows\System\ORQiFJR.exe
  C:\Windows\System\ORQiFJR.exe
  2⤵
  PID:9088
- C:\Windows\System\QiiexAo.exe
  C:\Windows\System\QiiexAo.exe
  2⤵
  PID:11168
- C:\Windows\System\zRBXngj.exe
  C:\Windows\System\zRBXngj.exe
  2⤵
  PID:1208
- C:\Windows\System\GXorpqk.exe
  C:\Windows\System\GXorpqk.exe
  2⤵
  PID:9600
- C:\Windows\System\vtBKzIb.exe
  C:\Windows\System\vtBKzIb.exe
  2⤵
  PID:11400
- C:\Windows\System\FSpOyxb.exe
  C:\Windows\System\FSpOyxb.exe
  2⤵
  PID:13228
- C:\Windows\System\TMIxyeg.exe
  C:\Windows\System\TMIxyeg.exe
  2⤵
  PID:14356
- C:\Windows\System\MVRxaSR.exe
  C:\Windows\System\MVRxaSR.exe
  2⤵
  PID:14392
- C:\Windows\System\RrpsnHZ.exe
  C:\Windows\System\RrpsnHZ.exe
  2⤵
  PID:14424
- C:\Windows\System\tAcKfNP.exe
  C:\Windows\System\tAcKfNP.exe
  2⤵
  PID:14448
- C:\Windows\System\KAXPHQy.exe
  C:\Windows\System\KAXPHQy.exe
  2⤵
  PID:14468
- C:\Windows\System\oDQZcGp.exe
  C:\Windows\System\oDQZcGp.exe
  2⤵
  PID:14500
- C:\Windows\System\mjYBHJF.exe
  C:\Windows\System\mjYBHJF.exe
  2⤵
  PID:14528
- C:\Windows\System\mEHWyrX.exe
  C:\Windows\System\mEHWyrX.exe
  2⤵
  PID:14560
- C:\Windows\System\xwMEqro.exe
  C:\Windows\System\xwMEqro.exe
  2⤵
  PID:14580
- C:\Windows\System\CzrCDxr.exe
  C:\Windows\System\CzrCDxr.exe
  2⤵
  PID:14608
- C:\Windows\System\CWWcUgg.exe
  C:\Windows\System\CWWcUgg.exe
  2⤵
  PID:14652
- C:\Windows\System\iGSdBJb.exe
  C:\Windows\System\iGSdBJb.exe
  2⤵
  PID:14680
- C:\Windows\System\omZkJtC.exe
  C:\Windows\System\omZkJtC.exe
  2⤵
  PID:14708
- C:\Windows\System\MmYeJRJ.exe
  C:\Windows\System\MmYeJRJ.exe
  2⤵
  PID:14740
- C:\Windows\System\iXXwnYC.exe
  C:\Windows\System\iXXwnYC.exe
  2⤵
  PID:14768
- C:\Windows\System\MgRQOyy.exe
  C:\Windows\System\MgRQOyy.exe
  2⤵
  PID:14804
- C:\Windows\System\itTPoVB.exe
  C:\Windows\System\itTPoVB.exe
  2⤵
  PID:14824
- C:\Windows\System\waiwsER.exe
  C:\Windows\System\waiwsER.exe
  2⤵
  PID:14860
- C:\Windows\System\zXamyYo.exe
  C:\Windows\System\zXamyYo.exe
  2⤵
  PID:14876
- C:\Windows\System\LmzOsbc.exe
  C:\Windows\System\LmzOsbc.exe
  2⤵
  PID:14892
- C:\Windows\System\FnIpOIW.exe
  C:\Windows\System\FnIpOIW.exe
  2⤵
  PID:14908

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:12720

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:13548

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2fdwvyqa.pzh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AItwFTB.exe

Filesize
1.5MB

MD5
6dac284cdf17a3bd443587bd04c94880

SHA1
4585daca08f3d97e1c85c62936192df520e4747f

SHA256
4ad8ce8a78d8e1fc6d42c7ffe1c65d70b22b5c97dc370916ea6a8e3cd9ed2536

SHA512
ca5b8e34829d95f8db5a3eafc3710cd46ed463ceb7c7d013e7dbb652cf471a6189ba3a829251b25e36f68cb57ffadc8166ca17c94f387bfb0717ddfac82266e0

Download Submit
C:\Windows\System\AyxcMSq.exe

Filesize
1.5MB

MD5
157a89d0970e9b4b5825115b56ba2768

SHA1
537745bb24bae396dfac57844965a8d957a987fc

SHA256
2325a35d555baecbc604c48fbda87861e6a7b63acfb080ee1820193baf8f23da

SHA512
9191d2f830dbc87386095ffcea6e7ffbc27e555b7271913e7e6d4eb61e629daf391f22e733be7dbde2149ca0d872d347fb1a0b4e17b2b82c59da172c9c58fd40

Download Submit
C:\Windows\System\CRpkebd.exe

Filesize
1.5MB

MD5
8a5195ac4edb8e20cb623910a72a0b64

SHA1
66bb8f685b05f5a6c0c3be001764babe06d68116

SHA256
3517444e022b678e5f61d9c7cab9d91845df0a457ad76c98f49fed96cbea98ae

SHA512
cdbe296578160f5332645c55ffb476e346164b132a041d95f51d07f774c19bd17e8253deda32696ea700f81a64db507c9279d25429cb78a7956ad5984d55778e

Download Submit
C:\Windows\System\ElIwVAM.exe

Filesize
1.6MB

MD5
252d79321572c6785bff5e4691899e42

SHA1
1b9d07d10204ac3c503c6f2c118b65313a6b9dfd

SHA256
665d8647bde70f8a0daf556149383d8b566d57d1a4eafefd7a466862537291e4

SHA512
3c7e1afb5dc4291056700f58dafa6ca821293602c3a956da98460f6cb5a32849b4c408dd567bcb7d55e55616fbb8f3e8a005f793ab0653520ef74aae6c0ddc62

Download Submit
C:\Windows\System\FFSGMAE.exe

Filesize
1.5MB

MD5
b15963f5a816c4cf735414110155513c

SHA1
f91c1120660e4f7d5d986d139fca16e4be92af81

SHA256
579b2e76511708b246cb62978a84853fcb5adbc65860efcf0e15bd245dc09efa

SHA512
a600454039782f4949d8f95ac62fb6631042fd95379237cee3d6b2ba79d2e42c66c77412a4e171867b9ab55f141530fde09846e9eca6891a7424d50ab442b2ec

Download Submit
C:\Windows\System\GTAqwSL.exe

Filesize
1.6MB

MD5
4102e1682e67f0b6805f596d3e11056f

SHA1
77250752fd879a4884fa4511f6553a336a59e2f7

SHA256
998098692b1409ba5ffd2054f3bfd51d828810a39805884e60c5d77fb8f023ec

SHA512
596ca4a7cf4824e48c5143ccfb9f134f58365865a8660c5680672d7a8af4dec929e76b06c4d1feca9ef646ae7ab0d79e89e890095d51a237e97323cd36de21a6

Download Submit
C:\Windows\System\GuLMzao.exe

Filesize
1.6MB

MD5
c39a762e55ed74c2c921932470722905

SHA1
c8d3d848127d4be9ac5a895c3f4bf0f2e349cc8e

SHA256
6a44072bbfb5f81feb506ce46d96efd5a91ed0fc3078e4d3516dde4ee5f7b796

SHA512
c42c0dfe0c3672a8ea87dcfff9580a3ad285189b4bc8e37d245d0b06279f9fae3427f98568f1a45aa50a094a05b35a0e3f741a402eaf88d0c5d5e638501d8d9c

Download Submit
C:\Windows\System\HzbsEsG.exe

Filesize
1.5MB

MD5
da11e6113e3b0c453ec1289af4690f0c

SHA1
4f46ca20a582d139e07e40231fa01928b4c8ef26

SHA256
361b4644e91061dc470babd65707920fb0a49b40f83a01294a02a871a61f7dcc

SHA512
c67ffc897cf0d719038d41dabcc640a34edfc6d7e8bc847af50a2c979ef3e85453841aba94b2c15e5954a7d3df3b40708fa7c29e0b0d188ade0d30bad4eda760

Download Submit
C:\Windows\System\KmpWhBO.exe

Filesize
1.6MB

MD5
62763c751815d6bd1a69215812c6523f

SHA1
b84ed827ca9c470f13243b4a59500590b6c105b9

SHA256
30c5110f328345c92b5223c8755ef4daa7dfb358164e7a0b23369ade6a8cdfd6

SHA512
b16708cfef6dc6062321d7e0030f5ceeaa75056eabe01457e6e9cd3f3c381a24e2c31653481b0cce7a8ba611f807d4cd6aa305fe3539165cc88568d73a04531e

Download Submit
C:\Windows\System\NNYrzfh.exe

Filesize
1.6MB

MD5
f5fb83140632bcf6db78bc126b7abee6

SHA1
356746ff482df44c3683637c251c2177257c7574

SHA256
e1e39f60b8d7f9be2c72047da7ce46c423303cefb60942794d5f7d4fd8594632

SHA512
6903cf49c2a968b82aacf32ee2e9a896cfc24281c5ebd6cbc49d82709d2696a45386f1adf6e39a64b3374ca68895e3e50c9f7c6ff5c26f2447e10fd26bd14736

Download Submit
C:\Windows\System\OZZCeYu.exe

Filesize
1.5MB

MD5
f40785279035bb4836a975aba2f38aa8

SHA1
110a78922d24b09364a6020dfd1c8808cb564cb4

SHA256
4dbd87c559f8f01bcf988c63dfda2f9162dbc1f27494fd1f69df8e9e936fd169

SHA512
be63940893a64b9d089ad550422dc3aff883d2db29806ff1221b3e1d6ad6e51d082b7929ff969102fac84133d2edafb9a10f38839f178c7a1f1e9b56009fe70c

Download Submit
C:\Windows\System\RtxploK.exe

Filesize
1.5MB

MD5
938ab2549d79dc153eaf4ae3aea80225

SHA1
ddfbb51ae68966bc89d884f2a31bc1f25c000306

SHA256
549abf26361525f3738d19e0b693097fc90285638579172c4e231cd55f06646c

SHA512
d072dc0563666a7c5d446411ad569c4e504e27a400af22c7a351bf9abba2b5654d8ea909fc9f6fd8ac2f0515c4437d72a82e70be759ce7cafb4c7d596cfd575a

Download Submit
C:\Windows\System\SBzJxbt.exe

Filesize
1.5MB

MD5
c9f403fe9a8278211dbe9c161176bc15

SHA1
9238f34d07f37b177cb684c4e5b62994f8e02485

SHA256
b7b3037c1a1f0267beb98c846ae60f4be419f64e4b52c3657e6b7f96c09c43e7

SHA512
9e5ec1a0e92a09b7495e3111b9cd7c9d969a4c6197eed4af70334967114bfd817e75c40319a002fb96c659d9788d0ec22841cc6c4c013550ffdc2f76de69c1e6

Download Submit
C:\Windows\System\SNYnIvI.exe

Filesize
1.5MB

MD5
62b107dff56ef1e7ed90206636edc4e5

SHA1
93315b357699459194fbcb17a6c18107f9c8f125

SHA256
bb4a0ccc5217d550dec73e66c75c2a37c7251234cdde3ba496cda2ccc20a4938

SHA512
7e5cf4b55715e2e0cacd8fd510864c6711bdf666e2a9beeab1b8b5d9fdba1dd4e470fa2794296196cf540b85f203cdb82567ff81c6af9715812d814db3108028

Download Submit
C:\Windows\System\SWyRbzs.exe

Filesize
1.5MB

MD5
e3bf0756d756db9e168b0678d688bf25

SHA1
5d170cb57f949638c5b4ab6c93c651d580566d7b

SHA256
bf98ea7e4696378f086da2329d3fc9c37474875fa35c7aaa54b0ee7af91a2992

SHA512
ab020ff6bf484cd61629a8c3632898a2971e94289136270fd61f3b921a435e21aa622991b948d4742199598bd85767026d68f21a68e10cf22adcfbe73823a8fa

Download Submit
C:\Windows\System\VgKdMxo.exe

Filesize
1.5MB

MD5
c5e51d2dd62d61f6ebc5b531e729720e

SHA1
ab38fc0f658610298c45bbc9a6673fe7504c1097

SHA256
a931d09f462edddd49016486118b880f37cea1ed149c29d699ba96cf72a6b18f

SHA512
b0108de08cc8408050c75208441946466a4a8d5344ef354a00b4d30efd360361fdaad8e6a1f779c51c6807c7886cab5270f33317c31da9086df80a24bd2b6f16

Download Submit
C:\Windows\System\XcHUtjM.exe

Filesize
18B

MD5
98dbaea0a2672edce823e25a4d8bd0fe

SHA1
d09cac58408a9d9053b9d0becfa29a282f563bb8

SHA256
2d04180dbb71e06b64f51e97726eb98b2b7e2dbc8ed2da0335f09cc3e8eb655a

SHA512
feb2efbe8d617531973fca0389c760d6c816b08acfb396adbecd9f490d83d0988eecc0f8b29124400314382427cd97a66a37eefa4f8971c22dc2834a65c91cbc

Download Submit
C:\Windows\System\XjlOiAY.exe

Filesize
1.6MB

MD5
c5b31aec21c4162cdc22f14e35023598

SHA1
d2da3b3dcc0f6e3a62439523cda94d4901741bd1

SHA256
df1494e85b411d507bdf5e110319c89f805d4935e6720bd95b96035905641a85

SHA512
da438540b22e9b1557ff54a83878b1ae28351169211000488f3498e9325e83f3b6a145ec0927be8e2af7fb574a664388eb84c089dfb5a20e051f2de6f58a4ddd

Download Submit
C:\Windows\System\YJjgWxu.exe

Filesize
1.5MB

MD5
2d183190f18516956a70f1f07fcccd9b

SHA1
60023de5d4f477d4c71083f51839b6cf7e5edf1b

SHA256
5c2168da31663885ab1ed69ad924413517840a9112f75a636dcf35f138303fdf

SHA512
6d00dcfae784dcf9622c1fd557d062b7884e2caf69a08c97a1eee1f6422cfb1c05f8130753581a152ac447d3fdabd17f7fdf4c588149b50e4fb771f25dbd3ba3

Download Submit
C:\Windows\System\cutlmrM.exe

Filesize
1.5MB

MD5
dbe6da714ff4edaf6f6b14780dfd331b

SHA1
6e5b8dda18e05a01bc35e2c49d40b956365d6d9c

SHA256
0352aec9b3f87c8f3e6c3c7a846b4110e1ba28f683a40ec672ec0a403d6a7109

SHA512
efe5a04902ff133e35ac55cff33f2ca42bd27e2d6b0924fb7ce8c99313da35c17ac007ef097bfcb0578fdae8ae1921807fbf0789bc179f26ee4383d56eec00fc

Download Submit
C:\Windows\System\dNdesfB.exe

Filesize
1.6MB

MD5
5fe6f7625187ffc5dba5dbe750bf2dbd

SHA1
8016a27199c724b0c78a8522d76ba4b1df641ff2

SHA256
f7cda595dd216c157c5e4ea5bc8827a8c7b84b8a8ec0c6bf854fa886f03fa1d9

SHA512
f4835bb4614e939ecafd971006f893589060ce137712702a35544d6eeb6ed922464a140dfd0f910b99eff4328a16276b9ece65d13bde9512f3679346c1d8728f

Download Submit
C:\Windows\System\kBqfUXu.exe

Filesize
8B

MD5
2d0c2c2eeafda1eefbc846623106a651

SHA1
ebe1d12cc7355840b98bff551fa1e9b6ea05149b

SHA256
315fe12e8506c9a5679018a241c22762f38597a85e3d6906984d2cd8e0eb0749

SHA512
4747f2fca75d2722dc6b7850f1cf2e05f5ebac7e64d54a9f03247ac705b6e7fd5e4086e67fbc0da577c026e6cfc06192b9232b3f0c023c488535fb6f948376dc

Download Submit
C:\Windows\System\kkqIhWw.exe

Filesize
1.5MB

MD5
71143a19de8e4de26753a7984dffa73c

SHA1
6a5a3e6e08a69303245072a5ec29a778c7851c46

SHA256
2f90f406384406d3b1d273c84b3921bbef5b54737b86ef471362ef352c0d11af

SHA512
31eca3b581b7729bd0a5cd84ba2d0eee2d7a902aa47131991aab7946b68e1d6ab6dafa9eed1c2cf1ea50d533a4124c10d3872b5fcf587911f3e520f05ca2e98a

Download Submit
C:\Windows\System\kmUdGrs.exe

Filesize
1.5MB

MD5
a6cd8adcfd5e2369df7c48cd03de4856

SHA1
afd1f5ed66d374ea8959725d517d8f5bc017a1c7

SHA256
65d99a379ebc7a53036dae090a503c2788a99c6441080e3a330ba099675da4f7

SHA512
4712d7cc910f11c87aa44bffbac20b98050a265b67633106acc7797d144ab3c57064c917dcdf0bf579b1a6d6d9c58f87621bd5166497b097f7f6965ae4d7703c

Download Submit
C:\Windows\System\lXJmPcC.exe

Filesize
1.5MB

MD5
e9b50edc40667cc258c9aee3bb092843

SHA1
144e03678b27b134d1690276dabc8ec98a3e084d

SHA256
1209b44e09a0776c8f7826e0b980dade9ffd0015832b2c6a676576d0ef3d4860

SHA512
01ac8c82c9a8729e6ddf6a166132a5405aa9cd3a5d438a83a5287b0defd7ccc1ac2efd521e9f70b6e87b3827945a35b1b7b121aa92ecff6c9118eeea0203aab6

Download Submit
C:\Windows\System\lyWNGxn.exe

Filesize
1.5MB

MD5
ff0ef54374cf804802071024d72aed5e

SHA1
9060e3a8341723778fd2b7c703fdc599cf061c54

SHA256
fdcc8f830f1a2d01a7a646153c2134a6b6f5db06c2696b4440241ee7077193c2

SHA512
9d6b163570c800970828a2862e0d3de3a1ce1dfde9958ddc90bcc13130934f2902915295ed7d2d5c127ff936e5e6ccde7feb4d825641cc5951178d0743b167ef

Download Submit
C:\Windows\System\obiOVsx.exe

Filesize
1.6MB

MD5
625659463a5e470150bb5142893f0d30

SHA1
4609385119280ce1c715edf990dd2ec57d5bc9ec

SHA256
6ead97e235718d8508890ec564eea29d003982095fa4b037501d91105c7fb559

SHA512
7461b26939285f3f95bbf05e39259ec5f0540ba0f462f0a01065838cff97632758e5bdab8bc6ee245f1dc1c763d644d9e2606a860461152ee3d5df0d941acca4

Download Submit
C:\Windows\System\pjTsdOH.exe

Filesize
1.5MB

MD5
18de2f834115500969eb545bcd0453df

SHA1
9d7cff59c33185c5a86a7a50fffd4a189b77ed2f

SHA256
bf86bc8a98944d0a1d698ffd00db76f4ecd8ebaff475ed0003c2d7b8871757bd

SHA512
ea783bd95fba4327c998593fe08d93debf96ba395c05968aaf35eb6d26252a8277ab2a6285a5099b31864f0164c36c10d503f3f54f38a5263ec38b89bb536f0f

Download Submit
C:\Windows\System\snUiYfd.exe

Filesize
1.5MB

MD5
e2e81a2b45b164bc712d7f312723bbbf

SHA1
8ebd2e3a3579e2ffc6c1637abd10f9cbf9c9c6d5

SHA256
e305dd3e57e16a3d58b582da9358dfd31a874e3dce6ca1f52d0137040d6270bd

SHA512
a491123bc5d08fd471253e67be0c169c8a75d09b3f81d46ba4c9a8863ae3e9ad4b0b624bc3419eff28999ba5b2949d5f87653cd69898517dcadf264a41cf915a

Download Submit
C:\Windows\System\tTQutuI.exe

Filesize
1.5MB

MD5
8208e33d0263d4750ef9f75b8798ae71

SHA1
ba2f5b9ed07fd6e97e3b679d37ced195745ae121

SHA256
52c3375f49fda5baaa5c39b79f1989fd970121786156f86dccf4f7844f1d0cb4

SHA512
efbb01972501f6fc7973e96347ce1993caff6aa93e4ee6c82da96727e127169e8c03873bedbd8eccad449f74fdd9ec082a4749af000bf8a4067db30ef2aa221f

Download Submit
C:\Windows\System\tWHNOSd.exe

Filesize
1.6MB

MD5
b2f5021a7df81a0bd41a6d329cd644e1

SHA1
649e8e439627b147dd00c3a931287054a6a4b963

SHA256
e021e51df35df04b96ddae2be7d5fda9851105abdd462a868c721c4f4e8c7f43

SHA512
6d186d634b19cfbfb25693a525e7744b17d94178d87f879461d7c537b195041f9c9e9f92ca9e1cd62bc4fd57691c82bc49939bd532863bc59f508350f0625241

Download Submit
C:\Windows\System\tvhaMgz.exe

Filesize
1.6MB

MD5
d71a05808bb8ab21e2d91a59ba8f418a

SHA1
b422004b128cad52283b1c3d93e70e09ffb98986

SHA256
5d55e3e0a445a8dc7956afa5f10f75361ba8e8644c4cfd04566eea3a496cb791

SHA512
4b43dc2f0c242da36bede7c23b1181ea9894cfce4764a53dc17f4096e1bcb0a4b3c868cde3b98c2776c9e422ded6bd5895761c26289fce9213db3873cd9805da

Download Submit
C:\Windows\System\uEnZAqp.exe

Filesize
1.5MB

MD5
31141be11c1275cd08ec2c25e2a083d8

SHA1
05e1994a37e611beea5af073359ad5ff132eb087

SHA256
39aa56181a173f2d3417e789c25cff407ee6206c49fbb2cab3d45b2a16db00e0

SHA512
d0c506189f69be873251786f94eb2925c47a64f43572bc610bf6efe19bfb19f5f066ed5ed6cc2db9ee8a7eca6238409a180e35aec5c75958ee1e1ce96effdaf2

Download Submit
C:\Windows\System\wOFeomi.exe

Filesize
1.6MB

MD5
30df4a19f921426ea3934425cee9e096

SHA1
223b5f4f7a8a05bb50eb948ad1e89a78c743ac37

SHA256
5362ab70496f1aa91be8b8cc46c97086cb5162b1c50f2c4b3e47081b2b7bfe25

SHA512
12bf60a89126519b9fc73726835570e1bebe5a1c49f3aaaf13075d2042d3a50905afeb38b9d0e77513ffc9a1e6302e0b17802142ce2c50b9d38a0421322fafcc

Download Submit
C:\Windows\System\whMGeXg.exe

Filesize
1.6MB

MD5
82158c8c49267a80fd43e84d3b7b4ea0

SHA1
cfc70e7aed66fb55dfb66e9c9db6444a155de267

SHA256
4eb9b36e88c85d5ada5020f1b9fdde31b92b6f6aafb27dfa1efc565eb37247b6

SHA512
ab339fac2b783f924999e084108785acc1fcb14d3a8b2178271055032effaa028e6acadc2abca503379b6e03059327cfda0ec6820052c5fc705c7f330522da16

Download Submit
memory/664-5793-0x00007FF71BEF0000-0x00007FF71C2E2000-memory.dmp

Filesize
3.9MB

Download
memory/664-75-0x00007FF71BEF0000-0x00007FF71C2E2000-memory.dmp

Filesize
3.9MB

Download
memory/664-2016-0x00007FF71BEF0000-0x00007FF71C2E2000-memory.dmp

Filesize
3.9MB

Download
memory/828-5857-0x00007FF7201D0000-0x00007FF7205C2000-memory.dmp

Filesize
3.9MB

Download
memory/828-89-0x00007FF7201D0000-0x00007FF7205C2000-memory.dmp

Filesize
3.9MB

Download
memory/1224-39-0x00007FF610810000-0x00007FF610C02000-memory.dmp

Filesize
3.9MB

Download
memory/1224-1383-0x00007FF610810000-0x00007FF610C02000-memory.dmp

Filesize
3.9MB

Download
memory/1244-2555-0x00007FF76C040000-0x00007FF76C432000-memory.dmp

Filesize
3.9MB

Download
memory/1244-116-0x00007FF76C040000-0x00007FF76C432000-memory.dmp

Filesize
3.9MB

Download
memory/1348-2013-0x00007FF6B0A60000-0x00007FF6B0E52000-memory.dmp

Filesize
3.9MB

Download
memory/1348-59-0x00007FF6B0A60000-0x00007FF6B0E52000-memory.dmp

Filesize
3.9MB

Download
memory/1780-142-0x00007FF6230A0000-0x00007FF623492000-memory.dmp

Filesize
3.9MB

Download
memory/1824-122-0x00007FF760680000-0x00007FF760A72000-memory.dmp

Filesize
3.9MB

Download
memory/1824-2556-0x00007FF760680000-0x00007FF760A72000-memory.dmp

Filesize
3.9MB

Download
memory/1940-135-0x00007FF7E8690000-0x00007FF7E8A82000-memory.dmp

Filesize
3.9MB

Download
memory/1940-3317-0x00007FF7E8690000-0x00007FF7E8A82000-memory.dmp

Filesize
3.9MB

Download
memory/2196-44-0x00007FF791300000-0x00007FF7916F2000-memory.dmp

Filesize
3.9MB

Download
memory/2324-83-0x00007FF7CC2A0000-0x00007FF7CC692000-memory.dmp

Filesize
3.9MB

Download
memory/2324-5852-0x00007FF7CC2A0000-0x00007FF7CC692000-memory.dmp

Filesize
3.9MB

Download
memory/2436-129-0x000001BCA3C50000-0x000001BCA3C72000-memory.dmp

Filesize
136KB

Download
memory/3028-96-0x00007FF7A5830000-0x00007FF7A5C22000-memory.dmp

Filesize
3.9MB

Download
memory/3312-156-0x00007FF683270000-0x00007FF683662000-memory.dmp

Filesize
3.9MB

Download
memory/3332-162-0x00007FF777B70000-0x00007FF777F62000-memory.dmp

Filesize
3.9MB

Download
memory/3440-1-0x000002394C380000-0x000002394C390000-memory.dmp

Filesize
64KB

Download
memory/3440-0-0x00007FF6DFEB0000-0x00007FF6E02A2000-memory.dmp

Filesize
3.9MB

Download
memory/3440-141-0x00007FF6DFEB0000-0x00007FF6E02A2000-memory.dmp

Filesize
3.9MB

Download
memory/3788-25-0x00007FF78DBF0000-0x00007FF78DFE2000-memory.dmp

Filesize
3.9MB

Download
memory/3788-155-0x00007FF78DBF0000-0x00007FF78DFE2000-memory.dmp

Filesize
3.9MB

Download
memory/3900-34-0x00007FF7BC8F0000-0x00007FF7BCCE2000-memory.dmp

Filesize
3.9MB

Download
memory/3900-5727-0x00007FF7BC8F0000-0x00007FF7BCCE2000-memory.dmp

Filesize
3.9MB

Download
memory/3900-169-0x00007FF7BC8F0000-0x00007FF7BCCE2000-memory.dmp

Filesize
3.9MB

Download
memory/4228-92-0x00007FF60E0B0000-0x00007FF60E4A2000-memory.dmp

Filesize
3.9MB

Download
memory/4452-100-0x00007FF64BD20000-0x00007FF64C112000-memory.dmp

Filesize
3.9MB

Download
memory/4480-128-0x00007FF745BE0000-0x00007FF745FD2000-memory.dmp

Filesize
3.9MB

Download
memory/4540-115-0x00007FF685D60000-0x00007FF686152000-memory.dmp

Filesize
3.9MB

Download
memory/4540-2554-0x00007FF685D60000-0x00007FF686152000-memory.dmp

Filesize
3.9MB

Download
memory/4544-4053-0x00007FF62B7D0000-0x00007FF62BBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4544-148-0x00007FF62B7D0000-0x00007FF62BBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4552-79-0x00007FF7938A0000-0x00007FF793C92000-memory.dmp

Filesize
3.9MB

Download
memory/4880-168-0x00007FF75F810000-0x00007FF75FC02000-memory.dmp

Filesize
3.9MB

Download
memory/4880-26-0x00007FF75F810000-0x00007FF75FC02000-memory.dmp

Filesize
3.9MB

Download
memory/4928-154-0x00007FF7F7A90000-0x00007FF7F7E82000-memory.dmp

Filesize
3.9MB

Download
memory/4928-6-0x00007FF7F7A90000-0x00007FF7F7E82000-memory.dmp

Filesize
3.9MB

Download
memory/5000-2022-0x00007FF673020000-0x00007FF673412000-memory.dmp

Filesize
3.9MB

Download
memory/5000-82-0x00007FF673020000-0x00007FF673412000-memory.dmp

Filesize
3.9MB

Download