xmrig | 5298e2528d12c2a1ee7e372475bddc58afff27a1d9eedb7ca6e3b9320baa2e2a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
Size

1.8MB
MD5

0869471b8905e4d2b43bcf0157b2bc44
SHA1

86378962795ffe6d4903c43db7b1c091ac9c2b40
SHA256

5298e2528d12c2a1ee7e372475bddc58afff27a1d9eedb7ca6e3b9320baa2e2a
SHA512

d73e391c0934468162fc08bddd6f49490e8ffe3761d0bc9598a0dad72859b3419e23d744d86d3ebf4a5c9c27373ec18f5fe5e6dad744bfa4702188d8b8c69a3a
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrI5N:NABT

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/1044-19-0x00007FF6C24C0000-0x00007FF6C28B2000-memory.dmp	xmrig
behavioral2/memory/3504-139-0x00007FF65E3C0000-0x00007FF65E7B2000-memory.dmp	xmrig
behavioral2/memory/4436-164-0x00007FF66D900000-0x00007FF66DCF2000-memory.dmp	xmrig
behavioral2/memory/3000-329-0x00007FF7E2E40000-0x00007FF7E3232000-memory.dmp	xmrig
behavioral2/memory/3796-330-0x00007FF75ECA0000-0x00007FF75F092000-memory.dmp	xmrig
behavioral2/memory/4880-363-0x00007FF62CCE0000-0x00007FF62D0D2000-memory.dmp	xmrig
behavioral2/memory/1200-375-0x00007FF678660000-0x00007FF678A52000-memory.dmp	xmrig
behavioral2/memory/4736-374-0x00007FF7797A0000-0x00007FF779B92000-memory.dmp	xmrig
behavioral2/memory/372-373-0x00007FF674AF0000-0x00007FF674EE2000-memory.dmp	xmrig
behavioral2/memory/4428-372-0x00007FF7D6DB0000-0x00007FF7D71A2000-memory.dmp	xmrig
behavioral2/memory/4368-371-0x00007FF61F560000-0x00007FF61F952000-memory.dmp	xmrig
behavioral2/memory/1036-370-0x00007FF78B2E0000-0x00007FF78B6D2000-memory.dmp	xmrig
behavioral2/memory/2468-302-0x00007FF66D720000-0x00007FF66DB12000-memory.dmp	xmrig
behavioral2/memory/2824-296-0x00007FF692C00000-0x00007FF692FF2000-memory.dmp	xmrig
behavioral2/memory/3224-257-0x00007FF709C40000-0x00007FF70A032000-memory.dmp	xmrig
behavioral2/memory/3236-249-0x00007FF7A6330000-0x00007FF7A6722000-memory.dmp	xmrig
behavioral2/memory/4912-223-0x00007FF79FC70000-0x00007FF7A0062000-memory.dmp	xmrig
behavioral2/memory/1500-212-0x00007FF74AF10000-0x00007FF74B302000-memory.dmp	xmrig
behavioral2/memory/1192-174-0x00007FF7DA390000-0x00007FF7DA782000-memory.dmp	xmrig
behavioral2/memory/4472-53-0x00007FF779280000-0x00007FF779672000-memory.dmp	xmrig
behavioral2/memory/4700-4465-0x00007FF7F34A0000-0x00007FF7F3892000-memory.dmp	xmrig
behavioral2/memory/4804-4932-0x00007FF69F530000-0x00007FF69F922000-memory.dmp	xmrig
behavioral2/memory/1692-4935-0x00007FF6560E0000-0x00007FF6564D2000-memory.dmp	xmrig
behavioral2/memory/372-5002-0x00007FF674AF0000-0x00007FF674EE2000-memory.dmp	xmrig
behavioral2/memory/3224-5008-0x00007FF709C40000-0x00007FF70A032000-memory.dmp	xmrig
behavioral2/memory/4436-5013-0x00007FF66D900000-0x00007FF66DCF2000-memory.dmp	xmrig
behavioral2/memory/4804-5020-0x00007FF69F530000-0x00007FF69F922000-memory.dmp	xmrig
behavioral2/memory/3504-5016-0x00007FF65E3C0000-0x00007FF65E7B2000-memory.dmp	xmrig
behavioral2/memory/1192-5039-0x00007FF7DA390000-0x00007FF7DA782000-memory.dmp	xmrig
behavioral2/memory/4736-5058-0x00007FF7797A0000-0x00007FF779B92000-memory.dmp	xmrig
behavioral2/memory/1036-5072-0x00007FF78B2E0000-0x00007FF78B6D2000-memory.dmp	xmrig
behavioral2/memory/4880-5077-0x00007FF62CCE0000-0x00007FF62D0D2000-memory.dmp	xmrig
behavioral2/memory/4368-5075-0x00007FF61F560000-0x00007FF61F952000-memory.dmp	xmrig
behavioral2/memory/1200-5064-0x00007FF678660000-0x00007FF678A52000-memory.dmp	xmrig
behavioral2/memory/3796-5055-0x00007FF75ECA0000-0x00007FF75F092000-memory.dmp	xmrig
behavioral2/memory/3000-5051-0x00007FF7E2E40000-0x00007FF7E3232000-memory.dmp	xmrig
behavioral2/memory/3236-5047-0x00007FF7A6330000-0x00007FF7A6722000-memory.dmp	xmrig
behavioral2/memory/2824-5037-0x00007FF692C00000-0x00007FF692FF2000-memory.dmp	xmrig
behavioral2/memory/1500-5044-0x00007FF74AF10000-0x00007FF74B302000-memory.dmp	xmrig
behavioral2/memory/4912-5032-0x00007FF79FC70000-0x00007FF7A0062000-memory.dmp	xmrig
behavioral2/memory/2468-5093-0x00007FF66D720000-0x00007FF66DB12000-memory.dmp	xmrig
behavioral2/memory/4428-5106-0x00007FF7D6DB0000-0x00007FF7D71A2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1044	ZhXXjte.exe
4700	jbOdXiC.exe
4472	jSqWCJV.exe
4896	XiOEwPD.exe
4804	wXFlZAA.exe
372	woGDpbg.exe
1692	TnoXmvy.exe
3504	cmlGSYg.exe
4436	FznsjSl.exe
1192	bQUzvBY.exe
1500	mIXyNWF.exe
4736	zqdPQim.exe
4912	eluelRS.exe
3236	rEtmlLC.exe
3224	tKxTUZr.exe
1200	vBjOVDf.exe
2824	pyztgKK.exe
2468	ALxUCml.exe
3000	tAauSJU.exe
3796	LomXyYp.exe
4880	jiQPHce.exe
1036	EgOylCX.exe
4368	OYhhlDQ.exe
4428	sgWhXUq.exe
4300	pVXqIuz.exe
1420	HdwtUoS.exe
4032	wYzbrZN.exe
2172	eqIwfzc.exe
2300	mPPMNRB.exe
976	EViiNca.exe
1488	DanolTJ.exe
4232	xWFSlqk.exe
1820	EwdcuxM.exe
4128	qrnNrbI.exe
4636	AlRAMhM.exe
3264	ifEnGiW.exe
4812	AFJwQab.exe
1732	PaiRqOA.exe
1504	ZjZXyJq.exe
1520	FXBOwPa.exe
4352	uIroWhc.exe
4344	nklpDiK.exe
868	ICAgyye.exe
2896	kgZwgrv.exe
4044	ZBLIYwa.exe
4536	tytWVNk.exe
5040	VKAhPgg.exe
1636	aCskqnA.exe
2216	GBIxqry.exe
3476	nYmISMe.exe
4324	nUzpEFl.exe
1196	OUpeKMC.exe
4440	WRJCHwx.exe
2036	POCkeeL.exe
2164	qHSQsQD.exe
1284	kfGdaNk.exe
2404	aZdNyxN.exe
4648	acTAHkR.exe
4416	xwFCWbn.exe
4620	DxbENEy.exe
636	ySXDwuX.exe
756	kWDszRp.exe
4316	qAvNQRd.exe
3588	WJaBQfO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/464-0-0x00007FF65D4E0000-0x00007FF65D8D2000-memory.dmp	upx
behavioral2/memory/1044-19-0x00007FF6C24C0000-0x00007FF6C28B2000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-28.dat	upx
behavioral2/files/0x000a000000023b9c-59.dat	upx
behavioral2/files/0x000a000000023b9f-94.dat	upx
behavioral2/memory/3504-139-0x00007FF65E3C0000-0x00007FF65E7B2000-memory.dmp	upx
behavioral2/memory/4436-164-0x00007FF66D900000-0x00007FF66DCF2000-memory.dmp	upx
behavioral2/memory/3000-329-0x00007FF7E2E40000-0x00007FF7E3232000-memory.dmp	upx
behavioral2/memory/3796-330-0x00007FF75ECA0000-0x00007FF75F092000-memory.dmp	upx
behavioral2/memory/4880-363-0x00007FF62CCE0000-0x00007FF62D0D2000-memory.dmp	upx
behavioral2/memory/1200-375-0x00007FF678660000-0x00007FF678A52000-memory.dmp	upx
behavioral2/memory/4736-374-0x00007FF7797A0000-0x00007FF779B92000-memory.dmp	upx
behavioral2/memory/372-373-0x00007FF674AF0000-0x00007FF674EE2000-memory.dmp	upx
behavioral2/memory/4428-372-0x00007FF7D6DB0000-0x00007FF7D71A2000-memory.dmp	upx
behavioral2/memory/4368-371-0x00007FF61F560000-0x00007FF61F952000-memory.dmp	upx
behavioral2/memory/1036-370-0x00007FF78B2E0000-0x00007FF78B6D2000-memory.dmp	upx
behavioral2/memory/2468-302-0x00007FF66D720000-0x00007FF66DB12000-memory.dmp	upx
behavioral2/memory/2824-296-0x00007FF692C00000-0x00007FF692FF2000-memory.dmp	upx
behavioral2/memory/3224-257-0x00007FF709C40000-0x00007FF70A032000-memory.dmp	upx
behavioral2/memory/3236-249-0x00007FF7A6330000-0x00007FF7A6722000-memory.dmp	upx
behavioral2/memory/4912-223-0x00007FF79FC70000-0x00007FF7A0062000-memory.dmp	upx
behavioral2/memory/1500-212-0x00007FF74AF10000-0x00007FF74B302000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-190.dat	upx
behavioral2/files/0x000a000000023bae-186.dat	upx
behavioral2/files/0x000a000000023baa-183.dat	upx
behavioral2/files/0x000a000000023ba9-181.dat	upx
behavioral2/files/0x000a000000023ba8-179.dat	upx
behavioral2/files/0x000a000000023bb3-178.dat	upx
behavioral2/files/0x000a000000023bb2-176.dat	upx
behavioral2/memory/1192-174-0x00007FF7DA390000-0x00007FF7DA782000-memory.dmp	upx
behavioral2/files/0x000a000000023ba4-157.dat	upx
behavioral2/files/0x000a000000023ba3-150.dat	upx
behavioral2/files/0x000a000000023bad-149.dat	upx
behavioral2/files/0x000a000000023bac-148.dat	upx
behavioral2/files/0x000a000000023bb1-175.dat	upx
behavioral2/files/0x000a000000023b9b-142.dat	upx
behavioral2/files/0x000a000000023ba0-141.dat	upx
behavioral2/files/0x000a000000023bab-138.dat	upx
behavioral2/files/0x000a000000023ba5-162.dat	upx
behavioral2/files/0x000a000000023ba2-128.dat	upx
behavioral2/files/0x000a000000023ba1-124.dat	upx
behavioral2/files/0x000a000000023b9d-122.dat	upx
behavioral2/files/0x000a000000023b9a-119.dat	upx
behavioral2/memory/1692-114-0x00007FF6560E0000-0x00007FF6564D2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-112.dat	upx
behavioral2/files/0x000a000000023ba6-111.dat	upx
behavioral2/files/0x000a000000023b99-100.dat	upx
behavioral2/files/0x000a000000023b98-96.dat	upx
behavioral2/files/0x000a000000023b96-89.dat	upx
behavioral2/files/0x000a000000023b95-86.dat	upx
behavioral2/files/0x000a000000023b94-78.dat	upx
behavioral2/files/0x000a000000023b9e-71.dat	upx
behavioral2/memory/4804-70-0x00007FF69F530000-0x00007FF69F922000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-58.dat	upx
behavioral2/memory/4472-53-0x00007FF779280000-0x00007FF779672000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-41.dat	upx
behavioral2/memory/4896-39-0x00007FF766730000-0x00007FF766B22000-memory.dmp	upx
behavioral2/files/0x000a000000023b92-36.dat	upx
behavioral2/memory/4700-33-0x00007FF7F34A0000-0x00007FF7F3892000-memory.dmp	upx
behavioral2/files/0x000e000000023b85-24.dat	upx
behavioral2/files/0x000c000000023b34-6.dat	upx
behavioral2/memory/4700-4465-0x00007FF7F34A0000-0x00007FF7F3892000-memory.dmp	upx
behavioral2/memory/4804-4932-0x00007FF69F530000-0x00007FF69F922000-memory.dmp	upx
behavioral2/memory/1692-4935-0x00007FF6560E0000-0x00007FF6564D2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VGhRJHI.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\zBxtSTX.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\AvyJhsh.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\fhJumvy.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\katuPIH.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\PtpZrPM.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\iMxGUzi.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\xzHMZkq.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\ePjEvhq.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\DcIGsJk.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\llyzJvV.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\IhPUZVH.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\TQcbKeL.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\eewtiZv.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\CEJDmAu.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\bHpXMzd.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\fZTghFS.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\SgMZGoT.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\RXsuEyV.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\jFrKyDj.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\JIdDJcS.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\vGnUvdn.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\eDLddGR.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\yrKsPVp.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\xDnEfRl.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\aIMdzRx.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\kEPQhcW.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\LImCmde.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\iXYLcDw.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\gtDuwkn.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\iYoGWBo.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\LCCnSdF.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\fPVfQKu.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\wqahuhF.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\fXMYiaf.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\SUKJYIn.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\GjDOhwF.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\QMFunoA.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\UXaCtff.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\XYKjxoN.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\blBumLP.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\OOSfogP.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\lvbPsGx.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\paUKhAa.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\adbwEzX.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\PwBdDUI.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\OvwuujD.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\uQYFRYg.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\aAEjtwX.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\fovRhfK.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\iNIQiaw.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\nlOzJyk.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\wbEqeyY.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\JWKOCpx.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\pCSCoSK.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\RUJNzca.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\eivutwE.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\ssOFslk.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\pvwvFEf.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\NzpQblG.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\XdLcldT.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\BZvgype.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\bzBTGWl.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
File created	C:\Windows\System\sBokgXX.exe	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
Token: SeDebugPrivilege	2944	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 2944	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	86
PID 464 wrote to memory of 2944	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	86
PID 464 wrote to memory of 1044	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	87
PID 464 wrote to memory of 1044	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	87
PID 464 wrote to memory of 4700	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	88
PID 464 wrote to memory of 4700	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	88
PID 464 wrote to memory of 4472	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	89
PID 464 wrote to memory of 4472	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	89
PID 464 wrote to memory of 4896	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	90
PID 464 wrote to memory of 4896	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	90
PID 464 wrote to memory of 4804	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	91
PID 464 wrote to memory of 4804	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	91
PID 464 wrote to memory of 1692	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	92
PID 464 wrote to memory of 1692	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	92
PID 464 wrote to memory of 3504	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	93
PID 464 wrote to memory of 3504	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	93
PID 464 wrote to memory of 4436	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	94
PID 464 wrote to memory of 4436	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	94
PID 464 wrote to memory of 372	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	95
PID 464 wrote to memory of 372	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	95
PID 464 wrote to memory of 1192	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	96
PID 464 wrote to memory of 1192	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	96
PID 464 wrote to memory of 4912	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	97
PID 464 wrote to memory of 4912	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	97
PID 464 wrote to memory of 1500	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	98
PID 464 wrote to memory of 1500	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	98
PID 464 wrote to memory of 1200	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	99
PID 464 wrote to memory of 1200	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	99
PID 464 wrote to memory of 4736	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	100
PID 464 wrote to memory of 4736	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	100
PID 464 wrote to memory of 3236	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	101
PID 464 wrote to memory of 3236	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	101
PID 464 wrote to memory of 3224	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	102
PID 464 wrote to memory of 3224	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	102
PID 464 wrote to memory of 2824	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	103
PID 464 wrote to memory of 2824	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	103
PID 464 wrote to memory of 2468	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	104
PID 464 wrote to memory of 2468	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	104
PID 464 wrote to memory of 3000	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	105
PID 464 wrote to memory of 3000	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	105
PID 464 wrote to memory of 3796	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	106
PID 464 wrote to memory of 3796	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	106
PID 464 wrote to memory of 4880	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	107
PID 464 wrote to memory of 4880	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	107
PID 464 wrote to memory of 1036	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	108
PID 464 wrote to memory of 1036	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	108
PID 464 wrote to memory of 4368	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	109
PID 464 wrote to memory of 4368	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	109
PID 464 wrote to memory of 4428	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	110
PID 464 wrote to memory of 4428	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	110
PID 464 wrote to memory of 4300	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	111
PID 464 wrote to memory of 4300	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	111
PID 464 wrote to memory of 1420	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	112
PID 464 wrote to memory of 1420	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	112
PID 464 wrote to memory of 4032	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	113
PID 464 wrote to memory of 4032	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	113
PID 464 wrote to memory of 2172	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	114
PID 464 wrote to memory of 2172	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	114
PID 464 wrote to memory of 2300	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	115
PID 464 wrote to memory of 2300	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	115
PID 464 wrote to memory of 976	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	116
PID 464 wrote to memory of 976	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	116
PID 464 wrote to memory of 1488	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	117
PID 464 wrote to memory of 1488	464	0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0869471b8905e4d2b43bcf0157b2bc44_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2944" "2492" "2444" "2496" "0" "0" "2500" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3360
- C:\Windows\System\ZhXXjte.exe
  C:\Windows\System\ZhXXjte.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\jbOdXiC.exe
  C:\Windows\System\jbOdXiC.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\jSqWCJV.exe
  C:\Windows\System\jSqWCJV.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\XiOEwPD.exe
  C:\Windows\System\XiOEwPD.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\wXFlZAA.exe
  C:\Windows\System\wXFlZAA.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\TnoXmvy.exe
  C:\Windows\System\TnoXmvy.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\cmlGSYg.exe
  C:\Windows\System\cmlGSYg.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\FznsjSl.exe
  C:\Windows\System\FznsjSl.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\woGDpbg.exe
  C:\Windows\System\woGDpbg.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\bQUzvBY.exe
  C:\Windows\System\bQUzvBY.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\eluelRS.exe
  C:\Windows\System\eluelRS.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\mIXyNWF.exe
  C:\Windows\System\mIXyNWF.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\vBjOVDf.exe
  C:\Windows\System\vBjOVDf.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\zqdPQim.exe
  C:\Windows\System\zqdPQim.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\rEtmlLC.exe
  C:\Windows\System\rEtmlLC.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\tKxTUZr.exe
  C:\Windows\System\tKxTUZr.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\pyztgKK.exe
  C:\Windows\System\pyztgKK.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\ALxUCml.exe
  C:\Windows\System\ALxUCml.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\tAauSJU.exe
  C:\Windows\System\tAauSJU.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\LomXyYp.exe
  C:\Windows\System\LomXyYp.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\jiQPHce.exe
  C:\Windows\System\jiQPHce.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\EgOylCX.exe
  C:\Windows\System\EgOylCX.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\OYhhlDQ.exe
  C:\Windows\System\OYhhlDQ.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\sgWhXUq.exe
  C:\Windows\System\sgWhXUq.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\pVXqIuz.exe
  C:\Windows\System\pVXqIuz.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\HdwtUoS.exe
  C:\Windows\System\HdwtUoS.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\wYzbrZN.exe
  C:\Windows\System\wYzbrZN.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\eqIwfzc.exe
  C:\Windows\System\eqIwfzc.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\mPPMNRB.exe
  C:\Windows\System\mPPMNRB.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\EViiNca.exe
  C:\Windows\System\EViiNca.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\DanolTJ.exe
  C:\Windows\System\DanolTJ.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\xWFSlqk.exe
  C:\Windows\System\xWFSlqk.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\EwdcuxM.exe
  C:\Windows\System\EwdcuxM.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\nklpDiK.exe
  C:\Windows\System\nklpDiK.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\qrnNrbI.exe
  C:\Windows\System\qrnNrbI.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\AlRAMhM.exe
  C:\Windows\System\AlRAMhM.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\ifEnGiW.exe
  C:\Windows\System\ifEnGiW.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\AFJwQab.exe
  C:\Windows\System\AFJwQab.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\PaiRqOA.exe
  C:\Windows\System\PaiRqOA.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\GBIxqry.exe
  C:\Windows\System\GBIxqry.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\ZjZXyJq.exe
  C:\Windows\System\ZjZXyJq.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\FXBOwPa.exe
  C:\Windows\System\FXBOwPa.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\uIroWhc.exe
  C:\Windows\System\uIroWhc.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\ICAgyye.exe
  C:\Windows\System\ICAgyye.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\kgZwgrv.exe
  C:\Windows\System\kgZwgrv.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\ZBLIYwa.exe
  C:\Windows\System\ZBLIYwa.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\tytWVNk.exe
  C:\Windows\System\tytWVNk.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\VKAhPgg.exe
  C:\Windows\System\VKAhPgg.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\aCskqnA.exe
  C:\Windows\System\aCskqnA.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\nYmISMe.exe
  C:\Windows\System\nYmISMe.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\nUzpEFl.exe
  C:\Windows\System\nUzpEFl.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\OUpeKMC.exe
  C:\Windows\System\OUpeKMC.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\WRJCHwx.exe
  C:\Windows\System\WRJCHwx.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\POCkeeL.exe
  C:\Windows\System\POCkeeL.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\qHSQsQD.exe
  C:\Windows\System\qHSQsQD.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\kfGdaNk.exe
  C:\Windows\System\kfGdaNk.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\aZdNyxN.exe
  C:\Windows\System\aZdNyxN.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\acTAHkR.exe
  C:\Windows\System\acTAHkR.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\xwFCWbn.exe
  C:\Windows\System\xwFCWbn.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\DxbENEy.exe
  C:\Windows\System\DxbENEy.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\ySXDwuX.exe
  C:\Windows\System\ySXDwuX.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\kWDszRp.exe
  C:\Windows\System\kWDszRp.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\qAvNQRd.exe
  C:\Windows\System\qAvNQRd.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\WJaBQfO.exe
  C:\Windows\System\WJaBQfO.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\PRXhHER.exe
  C:\Windows\System\PRXhHER.exe
  2⤵
  PID:3512
- C:\Windows\System\ArVqrum.exe
  C:\Windows\System\ArVqrum.exe
  2⤵
  PID:4272
- C:\Windows\System\LbuslUX.exe
  C:\Windows\System\LbuslUX.exe
  2⤵
  PID:3932
- C:\Windows\System\leUJyJj.exe
  C:\Windows\System\leUJyJj.exe
  2⤵
  PID:3292
- C:\Windows\System\AQZBimo.exe
  C:\Windows\System\AQZBimo.exe
  2⤵
  PID:1080
- C:\Windows\System\EgpNEnL.exe
  C:\Windows\System\EgpNEnL.exe
  2⤵
  PID:2412
- C:\Windows\System\EDtDQBK.exe
  C:\Windows\System\EDtDQBK.exe
  2⤵
  PID:5176
- C:\Windows\System\UPWhUBS.exe
  C:\Windows\System\UPWhUBS.exe
  2⤵
  PID:5192
- C:\Windows\System\roGdGnT.exe
  C:\Windows\System\roGdGnT.exe
  2⤵
  PID:5248
- C:\Windows\System\WciSadG.exe
  C:\Windows\System\WciSadG.exe
  2⤵
  PID:5276
- C:\Windows\System\fAxDife.exe
  C:\Windows\System\fAxDife.exe
  2⤵
  PID:5300
- C:\Windows\System\UdsRkCg.exe
  C:\Windows\System\UdsRkCg.exe
  2⤵
  PID:5320
- C:\Windows\System\DksoEuf.exe
  C:\Windows\System\DksoEuf.exe
  2⤵
  PID:5344
- C:\Windows\System\zKqnelt.exe
  C:\Windows\System\zKqnelt.exe
  2⤵
  PID:5368
- C:\Windows\System\snMJyqO.exe
  C:\Windows\System\snMJyqO.exe
  2⤵
  PID:5392
- C:\Windows\System\TiVxpDT.exe
  C:\Windows\System\TiVxpDT.exe
  2⤵
  PID:5412
- C:\Windows\System\chgSzIx.exe
  C:\Windows\System\chgSzIx.exe
  2⤵
  PID:5432
- C:\Windows\System\xuXHMOe.exe
  C:\Windows\System\xuXHMOe.exe
  2⤵
  PID:5456
- C:\Windows\System\yXgnNSF.exe
  C:\Windows\System\yXgnNSF.exe
  2⤵
  PID:5588
- C:\Windows\System\zQeAlLi.exe
  C:\Windows\System\zQeAlLi.exe
  2⤵
  PID:5616
- C:\Windows\System\hiCkpUy.exe
  C:\Windows\System\hiCkpUy.exe
  2⤵
  PID:5648
- C:\Windows\System\DnsyClb.exe
  C:\Windows\System\DnsyClb.exe
  2⤵
  PID:5684
- C:\Windows\System\aFDZLAm.exe
  C:\Windows\System\aFDZLAm.exe
  2⤵
  PID:5704
- C:\Windows\System\mPdsWxA.exe
  C:\Windows\System\mPdsWxA.exe
  2⤵
  PID:5724
- C:\Windows\System\ddRDhhV.exe
  C:\Windows\System\ddRDhhV.exe
  2⤵
  PID:5760
- C:\Windows\System\qpzrZNb.exe
  C:\Windows\System\qpzrZNb.exe
  2⤵
  PID:5784
- C:\Windows\System\NTyMTzj.exe
  C:\Windows\System\NTyMTzj.exe
  2⤵
  PID:5872
- C:\Windows\System\RavRWzg.exe
  C:\Windows\System\RavRWzg.exe
  2⤵
  PID:5892
- C:\Windows\System\llLEBnb.exe
  C:\Windows\System\llLEBnb.exe
  2⤵
  PID:5908
- C:\Windows\System\KQwyXvZ.exe
  C:\Windows\System\KQwyXvZ.exe
  2⤵
  PID:5936
- C:\Windows\System\ZvGYlNY.exe
  C:\Windows\System\ZvGYlNY.exe
  2⤵
  PID:5960
- C:\Windows\System\BkztXHF.exe
  C:\Windows\System\BkztXHF.exe
  2⤵
  PID:5984
- C:\Windows\System\VrIUCAM.exe
  C:\Windows\System\VrIUCAM.exe
  2⤵
  PID:6004
- C:\Windows\System\kAYQwvr.exe
  C:\Windows\System\kAYQwvr.exe
  2⤵
  PID:6032
- C:\Windows\System\DJUAgoz.exe
  C:\Windows\System\DJUAgoz.exe
  2⤵
  PID:6048
- C:\Windows\System\FQiPWAI.exe
  C:\Windows\System\FQiPWAI.exe
  2⤵
  PID:6064
- C:\Windows\System\wSvLqrx.exe
  C:\Windows\System\wSvLqrx.exe
  2⤵
  PID:6080
- C:\Windows\System\kExrOZx.exe
  C:\Windows\System\kExrOZx.exe
  2⤵
  PID:6100
- C:\Windows\System\XAQxOJt.exe
  C:\Windows\System\XAQxOJt.exe
  2⤵
  PID:1768
- C:\Windows\System\JRwAYTg.exe
  C:\Windows\System\JRwAYTg.exe
  2⤵
  PID:4412
- C:\Windows\System\cATplfj.exe
  C:\Windows\System\cATplfj.exe
  2⤵
  PID:3740
- C:\Windows\System\KNWlmeQ.exe
  C:\Windows\System\KNWlmeQ.exe
  2⤵
  PID:1032
- C:\Windows\System\idoSeez.exe
  C:\Windows\System\idoSeez.exe
  2⤵
  PID:2624
- C:\Windows\System\bwDGPco.exe
  C:\Windows\System\bwDGPco.exe
  2⤵
  PID:5284
- C:\Windows\System\AOrFgjd.exe
  C:\Windows\System\AOrFgjd.exe
  2⤵
  PID:5236
- C:\Windows\System\CVpUENP.exe
  C:\Windows\System\CVpUENP.exe
  2⤵
  PID:5352
- C:\Windows\System\xkgqqwt.exe
  C:\Windows\System\xkgqqwt.exe
  2⤵
  PID:5384
- C:\Windows\System\NgmIbxY.exe
  C:\Windows\System\NgmIbxY.exe
  2⤵
  PID:5424
- C:\Windows\System\TzRCdNf.exe
  C:\Windows\System\TzRCdNf.exe
  2⤵
  PID:5484
- C:\Windows\System\bPwKRwx.exe
  C:\Windows\System\bPwKRwx.exe
  2⤵
  PID:5696
- C:\Windows\System\NaJZtbI.exe
  C:\Windows\System\NaJZtbI.exe
  2⤵
  PID:5792
- C:\Windows\System\KfAthvY.exe
  C:\Windows\System\KfAthvY.exe
  2⤵
  PID:5888
- C:\Windows\System\LeOPILN.exe
  C:\Windows\System\LeOPILN.exe
  2⤵
  PID:5924
- C:\Windows\System\ssctPIT.exe
  C:\Windows\System\ssctPIT.exe
  2⤵
  PID:5956
- C:\Windows\System\jVVTgHB.exe
  C:\Windows\System\jVVTgHB.exe
  2⤵
  PID:4928
- C:\Windows\System\aGdHWIw.exe
  C:\Windows\System\aGdHWIw.exe
  2⤵
  PID:6072
- C:\Windows\System\WlMJlGr.exe
  C:\Windows\System\WlMJlGr.exe
  2⤵
  PID:6040
- C:\Windows\System\rekSUoF.exe
  C:\Windows\System\rekSUoF.exe
  2⤵
  PID:4964
- C:\Windows\System\wsHLBTp.exe
  C:\Windows\System\wsHLBTp.exe
  2⤵
  PID:1464
- C:\Windows\System\siPAGqM.exe
  C:\Windows\System\siPAGqM.exe
  2⤵
  PID:4732
- C:\Windows\System\RDUdplT.exe
  C:\Windows\System\RDUdplT.exe
  2⤵
  PID:6160
- C:\Windows\System\zKfTgGO.exe
  C:\Windows\System\zKfTgGO.exe
  2⤵
  PID:6184
- C:\Windows\System\rsWvwmJ.exe
  C:\Windows\System\rsWvwmJ.exe
  2⤵
  PID:6200
- C:\Windows\System\ooOZNrn.exe
  C:\Windows\System\ooOZNrn.exe
  2⤵
  PID:6224
- C:\Windows\System\PTmfbuJ.exe
  C:\Windows\System\PTmfbuJ.exe
  2⤵
  PID:6248
- C:\Windows\System\iLxHGLE.exe
  C:\Windows\System\iLxHGLE.exe
  2⤵
  PID:6268
- C:\Windows\System\MoTiLhU.exe
  C:\Windows\System\MoTiLhU.exe
  2⤵
  PID:6356
- C:\Windows\System\VHYihUc.exe
  C:\Windows\System\VHYihUc.exe
  2⤵
  PID:6380
- C:\Windows\System\dFOtmtb.exe
  C:\Windows\System\dFOtmtb.exe
  2⤵
  PID:6444
- C:\Windows\System\wyZtKig.exe
  C:\Windows\System\wyZtKig.exe
  2⤵
  PID:6468
- C:\Windows\System\NaRKutG.exe
  C:\Windows\System\NaRKutG.exe
  2⤵
  PID:6488
- C:\Windows\System\LnSbbVt.exe
  C:\Windows\System\LnSbbVt.exe
  2⤵
  PID:6504
- C:\Windows\System\jGdunJC.exe
  C:\Windows\System\jGdunJC.exe
  2⤵
  PID:6540
- C:\Windows\System\FgxVffg.exe
  C:\Windows\System\FgxVffg.exe
  2⤵
  PID:6564
- C:\Windows\System\ZHdhKmF.exe
  C:\Windows\System\ZHdhKmF.exe
  2⤵
  PID:6584
- C:\Windows\System\cToKjCs.exe
  C:\Windows\System\cToKjCs.exe
  2⤵
  PID:6604
- C:\Windows\System\HKTrwij.exe
  C:\Windows\System\HKTrwij.exe
  2⤵
  PID:6628
- C:\Windows\System\KfxqFft.exe
  C:\Windows\System\KfxqFft.exe
  2⤵
  PID:6656
- C:\Windows\System\bwBujtP.exe
  C:\Windows\System\bwBujtP.exe
  2⤵
  PID:6672
- C:\Windows\System\hVWUYnz.exe
  C:\Windows\System\hVWUYnz.exe
  2⤵
  PID:6688
- C:\Windows\System\xhbFiKM.exe
  C:\Windows\System\xhbFiKM.exe
  2⤵
  PID:6704
- C:\Windows\System\mVGrErC.exe
  C:\Windows\System\mVGrErC.exe
  2⤵
  PID:6732
- C:\Windows\System\gRmifYC.exe
  C:\Windows\System\gRmifYC.exe
  2⤵
  PID:6788
- C:\Windows\System\WxZEVPd.exe
  C:\Windows\System\WxZEVPd.exe
  2⤵
  PID:6816
- C:\Windows\System\EpJptWN.exe
  C:\Windows\System\EpJptWN.exe
  2⤵
  PID:6832
- C:\Windows\System\DItcfjM.exe
  C:\Windows\System\DItcfjM.exe
  2⤵
  PID:6852
- C:\Windows\System\RjtftoW.exe
  C:\Windows\System\RjtftoW.exe
  2⤵
  PID:6932
- C:\Windows\System\gKYnaFh.exe
  C:\Windows\System\gKYnaFh.exe
  2⤵
  PID:6948
- C:\Windows\System\mmirvIR.exe
  C:\Windows\System\mmirvIR.exe
  2⤵
  PID:6972
- C:\Windows\System\JtWFNof.exe
  C:\Windows\System\JtWFNof.exe
  2⤵
  PID:6988
- C:\Windows\System\qBPItHl.exe
  C:\Windows\System\qBPItHl.exe
  2⤵
  PID:7012
- C:\Windows\System\uIVRiPg.exe
  C:\Windows\System\uIVRiPg.exe
  2⤵
  PID:7036
- C:\Windows\System\xmFBoLl.exe
  C:\Windows\System\xmFBoLl.exe
  2⤵
  PID:7064
- C:\Windows\System\GZRjZpx.exe
  C:\Windows\System\GZRjZpx.exe
  2⤵
  PID:7080
- C:\Windows\System\AvReNCA.exe
  C:\Windows\System\AvReNCA.exe
  2⤵
  PID:7156
- C:\Windows\System\hOvhqxZ.exe
  C:\Windows\System\hOvhqxZ.exe
  2⤵
  PID:3372
- C:\Windows\System\hETXaLZ.exe
  C:\Windows\System\hETXaLZ.exe
  2⤵
  PID:3980
- C:\Windows\System\uoUAcGz.exe
  C:\Windows\System\uoUAcGz.exe
  2⤵
  PID:1604
- C:\Windows\System\PFexryt.exe
  C:\Windows\System\PFexryt.exe
  2⤵
  PID:5184
- C:\Windows\System\ZLOVFBm.exe
  C:\Windows\System\ZLOVFBm.exe
  2⤵
  PID:5360
- C:\Windows\System\ipewlNk.exe
  C:\Windows\System\ipewlNk.exe
  2⤵
  PID:5408
- C:\Windows\System\nGJtkoT.exe
  C:\Windows\System\nGJtkoT.exe
  2⤵
  PID:6232
- C:\Windows\System\ZAlYuTo.exe
  C:\Windows\System\ZAlYuTo.exe
  2⤵
  PID:5680
- C:\Windows\System\plosNvR.exe
  C:\Windows\System\plosNvR.exe
  2⤵
  PID:5768
- C:\Windows\System\ivIhQfd.exe
  C:\Windows\System\ivIhQfd.exe
  2⤵
  PID:6456
- C:\Windows\System\DbwMmbl.exe
  C:\Windows\System\DbwMmbl.exe
  2⤵
  PID:6496
- C:\Windows\System\JBzIpMW.exe
  C:\Windows\System\JBzIpMW.exe
  2⤵
  PID:6548
- C:\Windows\System\jDMLBJq.exe
  C:\Windows\System\jDMLBJq.exe
  2⤵
  PID:6592
- C:\Windows\System\wnyKGYu.exe
  C:\Windows\System\wnyKGYu.exe
  2⤵
  PID:6680
- C:\Windows\System\OLWKAhO.exe
  C:\Windows\System\OLWKAhO.exe
  2⤵
  PID:6712
- C:\Windows\System\PkpooWG.exe
  C:\Windows\System\PkpooWG.exe
  2⤵
  PID:6980
- C:\Windows\System\NVNHWoP.exe
  C:\Windows\System\NVNHWoP.exe
  2⤵
  PID:7044
- C:\Windows\System\niILgff.exe
  C:\Windows\System\niILgff.exe
  2⤵
  PID:6800
- C:\Windows\System\wuwMCKn.exe
  C:\Windows\System\wuwMCKn.exe
  2⤵
  PID:6860
- C:\Windows\System\GgsmTGG.exe
  C:\Windows\System\GgsmTGG.exe
  2⤵
  PID:1772
- C:\Windows\System\QrnmJCb.exe
  C:\Windows\System\QrnmJCb.exe
  2⤵
  PID:2928
- C:\Windows\System\LTLlIIg.exe
  C:\Windows\System\LTLlIIg.exe
  2⤵
  PID:960
- C:\Windows\System\jgohUOc.exe
  C:\Windows\System\jgohUOc.exe
  2⤵
  PID:6152
- C:\Windows\System\vcMogxL.exe
  C:\Windows\System\vcMogxL.exe
  2⤵
  PID:6196
- C:\Windows\System\dUVlAwH.exe
  C:\Windows\System\dUVlAwH.exe
  2⤵
  PID:6276
- C:\Windows\System\pviMhjd.exe
  C:\Windows\System\pviMhjd.exe
  2⤵
  PID:6640
- C:\Windows\System\ogmdeRR.exe
  C:\Windows\System\ogmdeRR.exe
  2⤵
  PID:6340
- C:\Windows\System\kJGkaCu.exe
  C:\Windows\System\kJGkaCu.exe
  2⤵
  PID:5884
- C:\Windows\System\qtzcwnT.exe
  C:\Windows\System\qtzcwnT.exe
  2⤵
  PID:6944
- C:\Windows\System\skzIFlW.exe
  C:\Windows\System\skzIFlW.exe
  2⤵
  PID:7060
- C:\Windows\System\EgaAcWt.exe
  C:\Windows\System\EgaAcWt.exe
  2⤵
  PID:4240
- C:\Windows\System\leYHQwm.exe
  C:\Windows\System\leYHQwm.exe
  2⤵
  PID:7148
- C:\Windows\System\aUodPMT.exe
  C:\Windows\System\aUodPMT.exe
  2⤵
  PID:5660
- C:\Windows\System\lKIDjdj.exe
  C:\Windows\System\lKIDjdj.exe
  2⤵
  PID:5732
- C:\Windows\System\gqeqviy.exe
  C:\Windows\System\gqeqviy.exe
  2⤵
  PID:6560
- C:\Windows\System\ZdmhHcU.exe
  C:\Windows\System\ZdmhHcU.exe
  2⤵
  PID:6420
- C:\Windows\System\vZcxrpi.exe
  C:\Windows\System\vZcxrpi.exe
  2⤵
  PID:4668
- C:\Windows\System\BqbuQWE.exe
  C:\Windows\System\BqbuQWE.exe
  2⤵
  PID:6484
- C:\Windows\System\OyFJEdH.exe
  C:\Windows\System\OyFJEdH.exe
  2⤵
  PID:6580
- C:\Windows\System\kDwtIRT.exe
  C:\Windows\System\kDwtIRT.exe
  2⤵
  PID:1060
- C:\Windows\System\qvjBhCY.exe
  C:\Windows\System\qvjBhCY.exe
  2⤵
  PID:7032
- C:\Windows\System\tuXikoP.exe
  C:\Windows\System\tuXikoP.exe
  2⤵
  PID:3584
- C:\Windows\System\kQSCOjo.exe
  C:\Windows\System\kQSCOjo.exe
  2⤵
  PID:6908
- C:\Windows\System\yZjvsfT.exe
  C:\Windows\System\yZjvsfT.exe
  2⤵
  PID:7184
- C:\Windows\System\NzPmfWp.exe
  C:\Windows\System\NzPmfWp.exe
  2⤵
  PID:7200
- C:\Windows\System\TjzGHMO.exe
  C:\Windows\System\TjzGHMO.exe
  2⤵
  PID:7228
- C:\Windows\System\DGoYDpC.exe
  C:\Windows\System\DGoYDpC.exe
  2⤵
  PID:7252
- C:\Windows\System\xvuxNXl.exe
  C:\Windows\System\xvuxNXl.exe
  2⤵
  PID:7276
- C:\Windows\System\rQAMFVe.exe
  C:\Windows\System\rQAMFVe.exe
  2⤵
  PID:7292
- C:\Windows\System\ffarZLx.exe
  C:\Windows\System\ffarZLx.exe
  2⤵
  PID:7316
- C:\Windows\System\LvXgCZO.exe
  C:\Windows\System\LvXgCZO.exe
  2⤵
  PID:7344
- C:\Windows\System\hmKpeBV.exe
  C:\Windows\System\hmKpeBV.exe
  2⤵
  PID:7360
- C:\Windows\System\DUzPQJA.exe
  C:\Windows\System\DUzPQJA.exe
  2⤵
  PID:7380
- C:\Windows\System\eMRjURk.exe
  C:\Windows\System\eMRjURk.exe
  2⤵
  PID:7408
- C:\Windows\System\lPtcwFS.exe
  C:\Windows\System\lPtcwFS.exe
  2⤵
  PID:7424
- C:\Windows\System\SbhQXEL.exe
  C:\Windows\System\SbhQXEL.exe
  2⤵
  PID:7444
- C:\Windows\System\PMUnJGJ.exe
  C:\Windows\System\PMUnJGJ.exe
  2⤵
  PID:7468
- C:\Windows\System\iBmJsOS.exe
  C:\Windows\System\iBmJsOS.exe
  2⤵
  PID:7488
- C:\Windows\System\QkDVXcv.exe
  C:\Windows\System\QkDVXcv.exe
  2⤵
  PID:7520
- C:\Windows\System\cTMelgW.exe
  C:\Windows\System\cTMelgW.exe
  2⤵
  PID:7540
- C:\Windows\System\yQKkxOt.exe
  C:\Windows\System\yQKkxOt.exe
  2⤵
  PID:7564
- C:\Windows\System\sawLsYh.exe
  C:\Windows\System\sawLsYh.exe
  2⤵
  PID:7588
- C:\Windows\System\QnOkscD.exe
  C:\Windows\System\QnOkscD.exe
  2⤵
  PID:7604
- C:\Windows\System\OgPUybG.exe
  C:\Windows\System\OgPUybG.exe
  2⤵
  PID:7648
- C:\Windows\System\xzbiYRJ.exe
  C:\Windows\System\xzbiYRJ.exe
  2⤵
  PID:7676
- C:\Windows\System\aKgkGVr.exe
  C:\Windows\System\aKgkGVr.exe
  2⤵
  PID:7704
- C:\Windows\System\sXiEaKi.exe
  C:\Windows\System\sXiEaKi.exe
  2⤵
  PID:7720
- C:\Windows\System\smVqUNT.exe
  C:\Windows\System\smVqUNT.exe
  2⤵
  PID:7736
- C:\Windows\System\mBxBgzF.exe
  C:\Windows\System\mBxBgzF.exe
  2⤵
  PID:7756
- C:\Windows\System\VQqpONt.exe
  C:\Windows\System\VQqpONt.exe
  2⤵
  PID:7800
- C:\Windows\System\MxQRqzS.exe
  C:\Windows\System\MxQRqzS.exe
  2⤵
  PID:7816
- C:\Windows\System\phmlvpf.exe
  C:\Windows\System\phmlvpf.exe
  2⤵
  PID:7848
- C:\Windows\System\IAOAXGN.exe
  C:\Windows\System\IAOAXGN.exe
  2⤵
  PID:7876
- C:\Windows\System\pTbowkA.exe
  C:\Windows\System\pTbowkA.exe
  2⤵
  PID:7896
- C:\Windows\System\IcnREGB.exe
  C:\Windows\System\IcnREGB.exe
  2⤵
  PID:7916
- C:\Windows\System\oKDCavn.exe
  C:\Windows\System\oKDCavn.exe
  2⤵
  PID:7936
- C:\Windows\System\CEpSuPy.exe
  C:\Windows\System\CEpSuPy.exe
  2⤵
  PID:7956
- C:\Windows\System\clCvKXr.exe
  C:\Windows\System\clCvKXr.exe
  2⤵
  PID:7980
- C:\Windows\System\MjSzRxO.exe
  C:\Windows\System\MjSzRxO.exe
  2⤵
  PID:8000
- C:\Windows\System\sReRVAN.exe
  C:\Windows\System\sReRVAN.exe
  2⤵
  PID:8020
- C:\Windows\System\JqavKxe.exe
  C:\Windows\System\JqavKxe.exe
  2⤵
  PID:8044
- C:\Windows\System\hDKOfoY.exe
  C:\Windows\System\hDKOfoY.exe
  2⤵
  PID:8064
- C:\Windows\System\Bchnxxs.exe
  C:\Windows\System\Bchnxxs.exe
  2⤵
  PID:8084
- C:\Windows\System\YFFfPUb.exe
  C:\Windows\System\YFFfPUb.exe
  2⤵
  PID:8108
- C:\Windows\System\URpmAof.exe
  C:\Windows\System\URpmAof.exe
  2⤵
  PID:8128
- C:\Windows\System\kwmzFOy.exe
  C:\Windows\System\kwmzFOy.exe
  2⤵
  PID:8152
- C:\Windows\System\Vpcjlwj.exe
  C:\Windows\System\Vpcjlwj.exe
  2⤵
  PID:8176
- C:\Windows\System\VRXlJiv.exe
  C:\Windows\System\VRXlJiv.exe
  2⤵
  PID:912
- C:\Windows\System\XSmrfOk.exe
  C:\Windows\System\XSmrfOk.exe
  2⤵
  PID:6180
- C:\Windows\System\KnsaArl.exe
  C:\Windows\System\KnsaArl.exe
  2⤵
  PID:1440
- C:\Windows\System\lyNdfEE.exe
  C:\Windows\System\lyNdfEE.exe
  2⤵
  PID:6364
- C:\Windows\System\HZKuaav.exe
  C:\Windows\System\HZKuaav.exe
  2⤵
  PID:6984
- C:\Windows\System\qBdOVsX.exe
  C:\Windows\System\qBdOVsX.exe
  2⤵
  PID:5880
- C:\Windows\System\sseIivs.exe
  C:\Windows\System\sseIivs.exe
  2⤵
  PID:7008
- C:\Windows\System\vLIrhid.exe
  C:\Windows\System\vLIrhid.exe
  2⤵
  PID:6900
- C:\Windows\System\yetRVgM.exe
  C:\Windows\System\yetRVgM.exe
  2⤵
  PID:1400
- C:\Windows\System\dTXSMvy.exe
  C:\Windows\System\dTXSMvy.exe
  2⤵
  PID:6724
- C:\Windows\System\mMNGnzZ.exe
  C:\Windows\System\mMNGnzZ.exe
  2⤵
  PID:4596
- C:\Windows\System\LVMkNzD.exe
  C:\Windows\System\LVMkNzD.exe
  2⤵
  PID:5512
- C:\Windows\System\pNqFNhj.exe
  C:\Windows\System\pNqFNhj.exe
  2⤵
  PID:5380
- C:\Windows\System\MuWqmPm.exe
  C:\Windows\System\MuWqmPm.exe
  2⤵
  PID:4452
- C:\Windows\System\CLeoAll.exe
  C:\Windows\System\CLeoAll.exe
  2⤵
  PID:4728
- C:\Windows\System\moXCnbn.exe
  C:\Windows\System\moXCnbn.exe
  2⤵
  PID:6620
- C:\Windows\System\ldyFCFw.exe
  C:\Windows\System\ldyFCFw.exe
  2⤵
  PID:7244
- C:\Windows\System\iGZvUSB.exe
  C:\Windows\System\iGZvUSB.exe
  2⤵
  PID:7328
- C:\Windows\System\urIoqCd.exe
  C:\Windows\System\urIoqCd.exe
  2⤵
  PID:7356
- C:\Windows\System\sfnugMc.exe
  C:\Windows\System\sfnugMc.exe
  2⤵
  PID:7392
- C:\Windows\System\UfByIFE.exe
  C:\Windows\System\UfByIFE.exe
  2⤵
  PID:7420
- C:\Windows\System\FRitedg.exe
  C:\Windows\System\FRitedg.exe
  2⤵
  PID:7464
- C:\Windows\System\AMMKUnY.exe
  C:\Windows\System\AMMKUnY.exe
  2⤵
  PID:7808
- C:\Windows\System\ybRIyvY.exe
  C:\Windows\System\ybRIyvY.exe
  2⤵
  PID:7924
- C:\Windows\System\AzSAmhR.exe
  C:\Windows\System\AzSAmhR.exe
  2⤵
  PID:8060
- C:\Windows\System\hrTcoIb.exe
  C:\Windows\System\hrTcoIb.exe
  2⤵
  PID:7752
- C:\Windows\System\oSArAAb.exe
  C:\Windows\System\oSArAAb.exe
  2⤵
  PID:8164
- C:\Windows\System\IlENfOU.exe
  C:\Windows\System\IlENfOU.exe
  2⤵
  PID:2984
- C:\Windows\System\zrboXzI.exe
  C:\Windows\System\zrboXzI.exe
  2⤵
  PID:7728
- C:\Windows\System\SFwMgrx.exe
  C:\Windows\System\SFwMgrx.exe
  2⤵
  PID:7780
- C:\Windows\System\hmSGgyW.exe
  C:\Windows\System\hmSGgyW.exe
  2⤵
  PID:8056
- C:\Windows\System\CzdQSOF.exe
  C:\Windows\System\CzdQSOF.exe
  2⤵
  PID:7260
- C:\Windows\System\NFJrFEd.exe
  C:\Windows\System\NFJrFEd.exe
  2⤵
  PID:8200
- C:\Windows\System\diiMmpZ.exe
  C:\Windows\System\diiMmpZ.exe
  2⤵
  PID:8232
- C:\Windows\System\URtilEp.exe
  C:\Windows\System\URtilEp.exe
  2⤵
  PID:8256
- C:\Windows\System\gQJNfdV.exe
  C:\Windows\System\gQJNfdV.exe
  2⤵
  PID:8284
- C:\Windows\System\xljwwne.exe
  C:\Windows\System\xljwwne.exe
  2⤵
  PID:8316
- C:\Windows\System\jtyZYlE.exe
  C:\Windows\System\jtyZYlE.exe
  2⤵
  PID:8336
- C:\Windows\System\TSZZnDB.exe
  C:\Windows\System\TSZZnDB.exe
  2⤵
  PID:8356
- C:\Windows\System\JTVnbtt.exe
  C:\Windows\System\JTVnbtt.exe
  2⤵
  PID:8380
- C:\Windows\System\GSDsaQE.exe
  C:\Windows\System\GSDsaQE.exe
  2⤵
  PID:8412
- C:\Windows\System\pfgvYHn.exe
  C:\Windows\System\pfgvYHn.exe
  2⤵
  PID:8436
- C:\Windows\System\dedoqPi.exe
  C:\Windows\System\dedoqPi.exe
  2⤵
  PID:8460
- C:\Windows\System\rmFSSvx.exe
  C:\Windows\System\rmFSSvx.exe
  2⤵
  PID:8476
- C:\Windows\System\ZuRYDXz.exe
  C:\Windows\System\ZuRYDXz.exe
  2⤵
  PID:8508
- C:\Windows\System\lEfkeoh.exe
  C:\Windows\System\lEfkeoh.exe
  2⤵
  PID:8536
- C:\Windows\System\cmEfNOx.exe
  C:\Windows\System\cmEfNOx.exe
  2⤵
  PID:8556
- C:\Windows\System\Pxegxun.exe
  C:\Windows\System\Pxegxun.exe
  2⤵
  PID:8580
- C:\Windows\System\AoFJXKn.exe
  C:\Windows\System\AoFJXKn.exe
  2⤵
  PID:8596
- C:\Windows\System\fvlhjuM.exe
  C:\Windows\System\fvlhjuM.exe
  2⤵
  PID:8620
- C:\Windows\System\nNSWHMN.exe
  C:\Windows\System\nNSWHMN.exe
  2⤵
  PID:8640
- C:\Windows\System\mNDWFyw.exe
  C:\Windows\System\mNDWFyw.exe
  2⤵
  PID:8664
- C:\Windows\System\cNIdptQ.exe
  C:\Windows\System\cNIdptQ.exe
  2⤵
  PID:8680
- C:\Windows\System\nShQgLz.exe
  C:\Windows\System\nShQgLz.exe
  2⤵
  PID:8704
- C:\Windows\System\FSIRgHe.exe
  C:\Windows\System\FSIRgHe.exe
  2⤵
  PID:8728
- C:\Windows\System\UkpXCUy.exe
  C:\Windows\System\UkpXCUy.exe
  2⤵
  PID:8748
- C:\Windows\System\CANVflB.exe
  C:\Windows\System\CANVflB.exe
  2⤵
  PID:8772
- C:\Windows\System\xTczUvT.exe
  C:\Windows\System\xTczUvT.exe
  2⤵
  PID:8800
- C:\Windows\System\xBknuBm.exe
  C:\Windows\System\xBknuBm.exe
  2⤵
  PID:8820
- C:\Windows\System\jSjSHXo.exe
  C:\Windows\System\jSjSHXo.exe
  2⤵
  PID:8844
- C:\Windows\System\OmKtuas.exe
  C:\Windows\System\OmKtuas.exe
  2⤵
  PID:8860
- C:\Windows\System\eMukAiE.exe
  C:\Windows\System\eMukAiE.exe
  2⤵
  PID:8884
- C:\Windows\System\JUqqJmr.exe
  C:\Windows\System\JUqqJmr.exe
  2⤵
  PID:8908
- C:\Windows\System\UIDLadH.exe
  C:\Windows\System\UIDLadH.exe
  2⤵
  PID:8940
- C:\Windows\System\pvwvFEf.exe
  C:\Windows\System\pvwvFEf.exe
  2⤵
  PID:8964
- C:\Windows\System\CUEGhBp.exe
  C:\Windows\System\CUEGhBp.exe
  2⤵
  PID:8984
- C:\Windows\System\Rwxqojq.exe
  C:\Windows\System\Rwxqojq.exe
  2⤵
  PID:9020
- C:\Windows\System\vPGZCYy.exe
  C:\Windows\System\vPGZCYy.exe
  2⤵
  PID:9052
- C:\Windows\System\zRwowAu.exe
  C:\Windows\System\zRwowAu.exe
  2⤵
  PID:9076
- C:\Windows\System\ZLHefVw.exe
  C:\Windows\System\ZLHefVw.exe
  2⤵
  PID:9092
- C:\Windows\System\DsLgSDF.exe
  C:\Windows\System\DsLgSDF.exe
  2⤵
  PID:9112
- C:\Windows\System\hUlJtJC.exe
  C:\Windows\System\hUlJtJC.exe
  2⤵
  PID:9132
- C:\Windows\System\FwNHqRf.exe
  C:\Windows\System\FwNHqRf.exe
  2⤵
  PID:9156
- C:\Windows\System\rxLIjAU.exe
  C:\Windows\System\rxLIjAU.exe
  2⤵
  PID:9172
- C:\Windows\System\VSVXQYB.exe
  C:\Windows\System\VSVXQYB.exe
  2⤵
  PID:9200
- C:\Windows\System\tAUomuz.exe
  C:\Windows\System\tAUomuz.exe
  2⤵
  PID:6328
- C:\Windows\System\CBqBpLJ.exe
  C:\Windows\System\CBqBpLJ.exe
  2⤵
  PID:7076
- C:\Windows\System\eUcLxUe.exe
  C:\Windows\System\eUcLxUe.exe
  2⤵
  PID:7832
- C:\Windows\System\vbDeGZx.exe
  C:\Windows\System\vbDeGZx.exe
  2⤵
  PID:7868
- C:\Windows\System\ITlvFuI.exe
  C:\Windows\System\ITlvFuI.exe
  2⤵
  PID:7964
- C:\Windows\System\VlDpdQf.exe
  C:\Windows\System\VlDpdQf.exe
  2⤵
  PID:316
- C:\Windows\System\hVpjufW.exe
  C:\Windows\System\hVpjufW.exe
  2⤵
  PID:8092
- C:\Windows\System\wNlRvMs.exe
  C:\Windows\System\wNlRvMs.exe
  2⤵
  PID:8124
- C:\Windows\System\DiSUPLK.exe
  C:\Windows\System\DiSUPLK.exe
  2⤵
  PID:8248
- C:\Windows\System\xVJFepI.exe
  C:\Windows\System\xVJFepI.exe
  2⤵
  PID:8304
- C:\Windows\System\jAvSuvj.exe
  C:\Windows\System\jAvSuvj.exe
  2⤵
  PID:8348
- C:\Windows\System\oxWqrJN.exe
  C:\Windows\System\oxWqrJN.exe
  2⤵
  PID:824
- C:\Windows\System\PtSzgpw.exe
  C:\Windows\System\PtSzgpw.exe
  2⤵
  PID:1444
- C:\Windows\System\WIqFYSZ.exe
  C:\Windows\System\WIqFYSZ.exe
  2⤵
  PID:7304
- C:\Windows\System\oeEYuRo.exe
  C:\Windows\System\oeEYuRo.exe
  2⤵
  PID:7416
- C:\Windows\System\osiuwla.exe
  C:\Windows\System\osiuwla.exe
  2⤵
  PID:8712
- C:\Windows\System\BrPCxUS.exe
  C:\Windows\System\BrPCxUS.exe
  2⤵
  PID:8856
- C:\Windows\System\dcxdDyO.exe
  C:\Windows\System\dcxdDyO.exe
  2⤵
  PID:9228
- C:\Windows\System\jTBIgdv.exe
  C:\Windows\System\jTBIgdv.exe
  2⤵
  PID:9248
- C:\Windows\System\ccBFPha.exe
  C:\Windows\System\ccBFPha.exe
  2⤵
  PID:9264
- C:\Windows\System\UMTKzct.exe
  C:\Windows\System\UMTKzct.exe
  2⤵
  PID:9288
- C:\Windows\System\WckhMXx.exe
  C:\Windows\System\WckhMXx.exe
  2⤵
  PID:9320
- C:\Windows\System\wIYqpZH.exe
  C:\Windows\System\wIYqpZH.exe
  2⤵
  PID:9336
- C:\Windows\System\oLvyPKw.exe
  C:\Windows\System\oLvyPKw.exe
  2⤵
  PID:9352
- C:\Windows\System\fWIJVxS.exe
  C:\Windows\System\fWIJVxS.exe
  2⤵
  PID:9376
- C:\Windows\System\fzjqZLt.exe
  C:\Windows\System\fzjqZLt.exe
  2⤵
  PID:9396
- C:\Windows\System\fsFNoow.exe
  C:\Windows\System\fsFNoow.exe
  2⤵
  PID:9420
- C:\Windows\System\jCOfTko.exe
  C:\Windows\System\jCOfTko.exe
  2⤵
  PID:9440
- C:\Windows\System\YdEUliZ.exe
  C:\Windows\System\YdEUliZ.exe
  2⤵
  PID:9464
- C:\Windows\System\wOjCzkk.exe
  C:\Windows\System\wOjCzkk.exe
  2⤵
  PID:9484
- C:\Windows\System\movROaN.exe
  C:\Windows\System\movROaN.exe
  2⤵
  PID:9504
- C:\Windows\System\fcZHPoS.exe
  C:\Windows\System\fcZHPoS.exe
  2⤵
  PID:9528
- C:\Windows\System\xohjgLW.exe
  C:\Windows\System\xohjgLW.exe
  2⤵
  PID:9552
- C:\Windows\System\WCSican.exe
  C:\Windows\System\WCSican.exe
  2⤵
  PID:9576
- C:\Windows\System\ndUuFNS.exe
  C:\Windows\System\ndUuFNS.exe
  2⤵
  PID:9616
- C:\Windows\System\PMnByVJ.exe
  C:\Windows\System\PMnByVJ.exe
  2⤵
  PID:9632
- C:\Windows\System\ovMevLU.exe
  C:\Windows\System\ovMevLU.exe
  2⤵
  PID:9652
- C:\Windows\System\NpYMcjN.exe
  C:\Windows\System\NpYMcjN.exe
  2⤵
  PID:9672
- C:\Windows\System\vmpDyYG.exe
  C:\Windows\System\vmpDyYG.exe
  2⤵
  PID:9692
- C:\Windows\System\SAAqrHi.exe
  C:\Windows\System\SAAqrHi.exe
  2⤵
  PID:9712
- C:\Windows\System\jyIPjoi.exe
  C:\Windows\System\jyIPjoi.exe
  2⤵
  PID:9736
- C:\Windows\System\cdrNDLw.exe
  C:\Windows\System\cdrNDLw.exe
  2⤵
  PID:9752
- C:\Windows\System\mzkQhAZ.exe
  C:\Windows\System\mzkQhAZ.exe
  2⤵
  PID:9772
- C:\Windows\System\KmyoANx.exe
  C:\Windows\System\KmyoANx.exe
  2⤵
  PID:9792
- C:\Windows\System\OnYhqMA.exe
  C:\Windows\System\OnYhqMA.exe
  2⤵
  PID:9808
- C:\Windows\System\PggTFTG.exe
  C:\Windows\System\PggTFTG.exe
  2⤵
  PID:9824
- C:\Windows\System\SnzQxOb.exe
  C:\Windows\System\SnzQxOb.exe
  2⤵
  PID:9844
- C:\Windows\System\LBJUxFe.exe
  C:\Windows\System\LBJUxFe.exe
  2⤵
  PID:9868
- C:\Windows\System\cXCCiNf.exe
  C:\Windows\System\cXCCiNf.exe
  2⤵
  PID:9892
- C:\Windows\System\knBIPbn.exe
  C:\Windows\System\knBIPbn.exe
  2⤵
  PID:9912
- C:\Windows\System\SWaOcwu.exe
  C:\Windows\System\SWaOcwu.exe
  2⤵
  PID:9936
- C:\Windows\System\mEjiCHT.exe
  C:\Windows\System\mEjiCHT.exe
  2⤵
  PID:9956
- C:\Windows\System\uwdrUCg.exe
  C:\Windows\System\uwdrUCg.exe
  2⤵
  PID:9976
- C:\Windows\System\LfMpSxJ.exe
  C:\Windows\System\LfMpSxJ.exe
  2⤵
  PID:10000
- C:\Windows\System\oSDKSbK.exe
  C:\Windows\System\oSDKSbK.exe
  2⤵
  PID:10024
- C:\Windows\System\ivFBDav.exe
  C:\Windows\System\ivFBDav.exe
  2⤵
  PID:10044
- C:\Windows\System\gfLxrvz.exe
  C:\Windows\System\gfLxrvz.exe
  2⤵
  PID:10064
- C:\Windows\System\KICfXDh.exe
  C:\Windows\System\KICfXDh.exe
  2⤵
  PID:10088
- C:\Windows\System\pbcaMVm.exe
  C:\Windows\System\pbcaMVm.exe
  2⤵
  PID:10112
- C:\Windows\System\jwFZrwW.exe
  C:\Windows\System\jwFZrwW.exe
  2⤵
  PID:10136
- C:\Windows\System\pKRGuEx.exe
  C:\Windows\System\pKRGuEx.exe
  2⤵
  PID:10160
- C:\Windows\System\DjdvaJf.exe
  C:\Windows\System\DjdvaJf.exe
  2⤵
  PID:10184
- C:\Windows\System\hXUqEqR.exe
  C:\Windows\System\hXUqEqR.exe
  2⤵
  PID:10208
- C:\Windows\System\dXBDIOZ.exe
  C:\Windows\System\dXBDIOZ.exe
  2⤵
  PID:10224
- C:\Windows\System\HakoCGC.exe
  C:\Windows\System\HakoCGC.exe
  2⤵
  PID:8328
- C:\Windows\System\TMUtPjC.exe
  C:\Windows\System\TMUtPjC.exe
  2⤵
  PID:8392
- C:\Windows\System\zjdhIAg.exe
  C:\Windows\System\zjdhIAg.exe
  2⤵
  PID:7888
- C:\Windows\System\grEEyzU.exe
  C:\Windows\System\grEEyzU.exe
  2⤵
  PID:9164
- C:\Windows\System\wYSSgTi.exe
  C:\Windows\System\wYSSgTi.exe
  2⤵
  PID:8552
- C:\Windows\System\rSPzLTI.exe
  C:\Windows\System\rSPzLTI.exe
  2⤵
  PID:8188
- C:\Windows\System\FbRjJFW.exe
  C:\Windows\System\FbRjJFW.exe
  2⤵
  PID:8588
- C:\Windows\System\RmJJVGo.exe
  C:\Windows\System\RmJJVGo.exe
  2⤵
  PID:2592
- C:\Windows\System\fRquJog.exe
  C:\Windows\System\fRquJog.exe
  2⤵
  PID:7284
- C:\Windows\System\DWKFOPL.exe
  C:\Windows\System\DWKFOPL.exe
  2⤵
  PID:8292
- C:\Windows\System\UdsWSyA.exe
  C:\Windows\System\UdsWSyA.exe
  2⤵
  PID:3688
- C:\Windows\System\hSxztLd.exe
  C:\Windows\System\hSxztLd.exe
  2⤵
  PID:8160
- C:\Windows\System\ShadXCM.exe
  C:\Windows\System\ShadXCM.exe
  2⤵
  PID:8828
- C:\Windows\System\dgMUOLn.exe
  C:\Windows\System\dgMUOLn.exe
  2⤵
  PID:7388
- C:\Windows\System\KgReSrU.exe
  C:\Windows\System\KgReSrU.exe
  2⤵
  PID:9220
- C:\Windows\System\xqmwPdm.exe
  C:\Windows\System\xqmwPdm.exe
  2⤵
  PID:8876
- C:\Windows\System\LUqBKTn.exe
  C:\Windows\System\LUqBKTn.exe
  2⤵
  PID:8896
- C:\Windows\System\nlFmdbP.exe
  C:\Windows\System\nlFmdbP.exe
  2⤵
  PID:8396
- C:\Windows\System\KfhesDi.exe
  C:\Windows\System\KfhesDi.exe
  2⤵
  PID:8456
- C:\Windows\System\PCkBENq.exe
  C:\Windows\System\PCkBENq.exe
  2⤵
  PID:8504
- C:\Windows\System\Vopaxkr.exe
  C:\Windows\System\Vopaxkr.exe
  2⤵
  PID:632
- C:\Windows\System\hBKiWtV.exe
  C:\Windows\System\hBKiWtV.exe
  2⤵
  PID:8616
- C:\Windows\System\LdsYKXd.exe
  C:\Windows\System\LdsYKXd.exe
  2⤵
  PID:8636
- C:\Windows\System\vTtUhnw.exe
  C:\Windows\System\vTtUhnw.exe
  2⤵
  PID:9600
- C:\Windows\System\fxwelST.exe
  C:\Windows\System\fxwelST.exe
  2⤵
  PID:8076
- C:\Windows\System\ZAklzur.exe
  C:\Windows\System\ZAklzur.exe
  2⤵
  PID:4476
- C:\Windows\System\koHAAiE.exe
  C:\Windows\System\koHAAiE.exe
  2⤵
  PID:10260
- C:\Windows\System\DpwSSaO.exe
  C:\Windows\System\DpwSSaO.exe
  2⤵
  PID:10280
- C:\Windows\System\YcdEwTe.exe
  C:\Windows\System\YcdEwTe.exe
  2⤵
  PID:10304
- C:\Windows\System\YUqkQsZ.exe
  C:\Windows\System\YUqkQsZ.exe
  2⤵
  PID:10324
- C:\Windows\System\WcrjSfO.exe
  C:\Windows\System\WcrjSfO.exe
  2⤵
  PID:10348
- C:\Windows\System\bDsIHBP.exe
  C:\Windows\System\bDsIHBP.exe
  2⤵
  PID:10368
- C:\Windows\System\LiumIwr.exe
  C:\Windows\System\LiumIwr.exe
  2⤵
  PID:10388
- C:\Windows\System\LBlyLCi.exe
  C:\Windows\System\LBlyLCi.exe
  2⤵
  PID:10412
- C:\Windows\System\TfNKgFY.exe
  C:\Windows\System\TfNKgFY.exe
  2⤵
  PID:10436
- C:\Windows\System\meyQWmc.exe
  C:\Windows\System\meyQWmc.exe
  2⤵
  PID:10460
- C:\Windows\System\XXoOqRL.exe
  C:\Windows\System\XXoOqRL.exe
  2⤵
  PID:10480
- C:\Windows\System\DjJREcw.exe
  C:\Windows\System\DjJREcw.exe
  2⤵
  PID:10504
- C:\Windows\System\bwaRXTQ.exe
  C:\Windows\System\bwaRXTQ.exe
  2⤵
  PID:10532
- C:\Windows\System\ExChWnJ.exe
  C:\Windows\System\ExChWnJ.exe
  2⤵
  PID:10552
- C:\Windows\System\tWzywHU.exe
  C:\Windows\System\tWzywHU.exe
  2⤵
  PID:10576
- C:\Windows\System\fsqpqoj.exe
  C:\Windows\System\fsqpqoj.exe
  2⤵
  PID:10592
- C:\Windows\System\rUCoboE.exe
  C:\Windows\System\rUCoboE.exe
  2⤵
  PID:10608
- C:\Windows\System\mvWLGwz.exe
  C:\Windows\System\mvWLGwz.exe
  2⤵
  PID:10624
- C:\Windows\System\GoZyfar.exe
  C:\Windows\System\GoZyfar.exe
  2⤵
  PID:10648
- C:\Windows\System\pzuAjbU.exe
  C:\Windows\System\pzuAjbU.exe
  2⤵
  PID:10676
- C:\Windows\System\qXDRoAH.exe
  C:\Windows\System\qXDRoAH.exe
  2⤵
  PID:10692
- C:\Windows\System\UbBfJJa.exe
  C:\Windows\System\UbBfJJa.exe
  2⤵
  PID:10720
- C:\Windows\System\GoHGESa.exe
  C:\Windows\System\GoHGESa.exe
  2⤵
  PID:10744
- C:\Windows\System\SfZvqRq.exe
  C:\Windows\System\SfZvqRq.exe
  2⤵
  PID:10764
- C:\Windows\System\cMNlQeG.exe
  C:\Windows\System\cMNlQeG.exe
  2⤵
  PID:10788
- C:\Windows\System\XfJqeOP.exe
  C:\Windows\System\XfJqeOP.exe
  2⤵
  PID:10812
- C:\Windows\System\KWmNaaO.exe
  C:\Windows\System\KWmNaaO.exe
  2⤵
  PID:10836
- C:\Windows\System\vNUwStw.exe
  C:\Windows\System\vNUwStw.exe
  2⤵
  PID:10856
- C:\Windows\System\TbMXoht.exe
  C:\Windows\System\TbMXoht.exe
  2⤵
  PID:10880
- C:\Windows\System\WbIfbmG.exe
  C:\Windows\System\WbIfbmG.exe
  2⤵
  PID:10900
- C:\Windows\System\uHaHKiL.exe
  C:\Windows\System\uHaHKiL.exe
  2⤵
  PID:10924
- C:\Windows\System\iLmuhYz.exe
  C:\Windows\System\iLmuhYz.exe
  2⤵
  PID:10948
- C:\Windows\System\MEsACpa.exe
  C:\Windows\System\MEsACpa.exe
  2⤵
  PID:10964
- C:\Windows\System\HHEnjvh.exe
  C:\Windows\System\HHEnjvh.exe
  2⤵
  PID:10992
- C:\Windows\System\XupSHfA.exe
  C:\Windows\System\XupSHfA.exe
  2⤵
  PID:11012
- C:\Windows\System\OnIpfZx.exe
  C:\Windows\System\OnIpfZx.exe
  2⤵
  PID:11048
- C:\Windows\System\wJmUMha.exe
  C:\Windows\System\wJmUMha.exe
  2⤵
  PID:11072
- C:\Windows\System\QZPGcfP.exe
  C:\Windows\System\QZPGcfP.exe
  2⤵
  PID:11092
- C:\Windows\System\yQWJHEo.exe
  C:\Windows\System\yQWJHEo.exe
  2⤵
  PID:11112
- C:\Windows\System\cobjgAi.exe
  C:\Windows\System\cobjgAi.exe
  2⤵
  PID:11136
- C:\Windows\System\CoBrPJS.exe
  C:\Windows\System\CoBrPJS.exe
  2⤵
  PID:11160
- C:\Windows\System\ZyGIsWn.exe
  C:\Windows\System\ZyGIsWn.exe
  2⤵
  PID:11180
- C:\Windows\System\GDGvOZK.exe
  C:\Windows\System\GDGvOZK.exe
  2⤵
  PID:11208
- C:\Windows\System\yBKTixx.exe
  C:\Windows\System\yBKTixx.exe
  2⤵
  PID:11236
- C:\Windows\System\hprHjhd.exe
  C:\Windows\System\hprHjhd.exe
  2⤵
  PID:11256
- C:\Windows\System\AsDHPbB.exe
  C:\Windows\System\AsDHPbB.exe
  2⤵
  PID:7332
- C:\Windows\System\PvvYtyB.exe
  C:\Windows\System\PvvYtyB.exe
  2⤵
  PID:8768
- C:\Windows\System\lPsORqG.exe
  C:\Windows\System\lPsORqG.exe
  2⤵
  PID:8932
- C:\Windows\System\SETxtwx.exe
  C:\Windows\System\SETxtwx.exe
  2⤵
  PID:9920
- C:\Windows\System\KWpNAgN.exe
  C:\Windows\System\KWpNAgN.exe
  2⤵
  PID:9972
- C:\Windows\System\reNhKSG.exe
  C:\Windows\System\reNhKSG.exe
  2⤵
  PID:10072
- C:\Windows\System\LBxqEIF.exe
  C:\Windows\System\LBxqEIF.exe
  2⤵
  PID:9044
- C:\Windows\System\JRTDDvz.exe
  C:\Windows\System\JRTDDvz.exe
  2⤵
  PID:9088
- C:\Windows\System\AzNgrZD.exe
  C:\Windows\System\AzNgrZD.exe
  2⤵
  PID:10216
- C:\Windows\System\MxjXZAf.exe
  C:\Windows\System\MxjXZAf.exe
  2⤵
  PID:10232
- C:\Windows\System\VFZnVqz.exe
  C:\Windows\System\VFZnVqz.exe
  2⤵
  PID:8352
- C:\Windows\System\ztPLYMG.exe
  C:\Windows\System\ztPLYMG.exe
  2⤵
  PID:9456
- C:\Windows\System\CDBqrnx.exe
  C:\Windows\System\CDBqrnx.exe
  2⤵
  PID:9180
- C:\Windows\System\EUeKHpN.exe
  C:\Windows\System\EUeKHpN.exe
  2⤵
  PID:9476
- C:\Windows\System\ebLlBoj.exe
  C:\Windows\System\ebLlBoj.exe
  2⤵
  PID:8100
- C:\Windows\System\OSdPyiC.exe
  C:\Windows\System\OSdPyiC.exe
  2⤵
  PID:9660
- C:\Windows\System\fUddLky.exe
  C:\Windows\System\fUddLky.exe
  2⤵
  PID:8832
- C:\Windows\System\DXpUPUX.exe
  C:\Windows\System\DXpUPUX.exe
  2⤵
  PID:8376
- C:\Windows\System\DVfFkFo.exe
  C:\Windows\System\DVfFkFo.exe
  2⤵
  PID:9708
- C:\Windows\System\EmJBEQG.exe
  C:\Windows\System\EmJBEQG.exe
  2⤵
  PID:7208
- C:\Windows\System\iIseHyP.exe
  C:\Windows\System\iIseHyP.exe
  2⤵
  PID:10420
- C:\Windows\System\DVyLPkI.exe
  C:\Windows\System\DVyLPkI.exe
  2⤵
  PID:11280
- C:\Windows\System\XUNTJvj.exe
  C:\Windows\System\XUNTJvj.exe
  2⤵
  PID:11304
- C:\Windows\System\XXvaJRK.exe
  C:\Windows\System\XXvaJRK.exe
  2⤵
  PID:11332
- C:\Windows\System\xciMomW.exe
  C:\Windows\System\xciMomW.exe
  2⤵
  PID:11348
- C:\Windows\System\WkcxWOb.exe
  C:\Windows\System\WkcxWOb.exe
  2⤵
  PID:11368
- C:\Windows\System\UAIpdwE.exe
  C:\Windows\System\UAIpdwE.exe
  2⤵
  PID:11392
- C:\Windows\System\kHIVvGT.exe
  C:\Windows\System\kHIVvGT.exe
  2⤵
  PID:11420
- C:\Windows\System\FbrMvEN.exe
  C:\Windows\System\FbrMvEN.exe
  2⤵
  PID:11440
- C:\Windows\System\NYUVViz.exe
  C:\Windows\System\NYUVViz.exe
  2⤵
  PID:11464
- C:\Windows\System\EbqVlUb.exe
  C:\Windows\System\EbqVlUb.exe
  2⤵
  PID:11484
- C:\Windows\System\nWEEWgg.exe
  C:\Windows\System\nWEEWgg.exe
  2⤵
  PID:11504
- C:\Windows\System\Ygabaet.exe
  C:\Windows\System\Ygabaet.exe
  2⤵
  PID:11520
- C:\Windows\System\XaGdLQM.exe
  C:\Windows\System\XaGdLQM.exe
  2⤵
  PID:11548
- C:\Windows\System\fGWWLiJ.exe
  C:\Windows\System\fGWWLiJ.exe
  2⤵
  PID:11564
- C:\Windows\System\rQziVYc.exe
  C:\Windows\System\rQziVYc.exe
  2⤵
  PID:11592
- C:\Windows\System\LrDnXFA.exe
  C:\Windows\System\LrDnXFA.exe
  2⤵
  PID:11608
- C:\Windows\System\VCaJsJc.exe
  C:\Windows\System\VCaJsJc.exe
  2⤵
  PID:11628
- C:\Windows\System\mPfctAj.exe
  C:\Windows\System\mPfctAj.exe
  2⤵
  PID:11652
- C:\Windows\System\rCggpnm.exe
  C:\Windows\System\rCggpnm.exe
  2⤵
  PID:11676
- C:\Windows\System\aKIssgU.exe
  C:\Windows\System\aKIssgU.exe
  2⤵
  PID:11692
- C:\Windows\System\PtMYUIz.exe
  C:\Windows\System\PtMYUIz.exe
  2⤵
  PID:11712
- C:\Windows\System\ILRvLoH.exe
  C:\Windows\System\ILRvLoH.exe
  2⤵
  PID:11728
- C:\Windows\System\YBHYEeS.exe
  C:\Windows\System\YBHYEeS.exe
  2⤵
  PID:11744
- C:\Windows\System\UCMbIjV.exe
  C:\Windows\System\UCMbIjV.exe
  2⤵
  PID:11764
- C:\Windows\System\ImvBDrl.exe
  C:\Windows\System\ImvBDrl.exe
  2⤵
  PID:11784
- C:\Windows\System\SsSvHZQ.exe
  C:\Windows\System\SsSvHZQ.exe
  2⤵
  PID:11804
- C:\Windows\System\iTlwsSf.exe
  C:\Windows\System\iTlwsSf.exe
  2⤵
  PID:11828
- C:\Windows\System\niqPjcb.exe
  C:\Windows\System\niqPjcb.exe
  2⤵
  PID:11852
- C:\Windows\System\QDiJkke.exe
  C:\Windows\System\QDiJkke.exe
  2⤵
  PID:11872
- C:\Windows\System\OhjCpmX.exe
  C:\Windows\System\OhjCpmX.exe
  2⤵
  PID:11888
- C:\Windows\System\JfHcIBa.exe
  C:\Windows\System\JfHcIBa.exe
  2⤵
  PID:11904
- C:\Windows\System\GSENVss.exe
  C:\Windows\System\GSENVss.exe
  2⤵
  PID:11920
- C:\Windows\System\ucHgIhR.exe
  C:\Windows\System\ucHgIhR.exe
  2⤵
  PID:11952
- C:\Windows\System\PxVCsMP.exe
  C:\Windows\System\PxVCsMP.exe
  2⤵
  PID:11972
- C:\Windows\System\rmOkNvF.exe
  C:\Windows\System\rmOkNvF.exe
  2⤵
  PID:11992
- C:\Windows\System\BMZTJfS.exe
  C:\Windows\System\BMZTJfS.exe
  2⤵
  PID:12016
- C:\Windows\System\guAeyDW.exe
  C:\Windows\System\guAeyDW.exe
  2⤵
  PID:12036
- C:\Windows\System\iagFKfG.exe
  C:\Windows\System\iagFKfG.exe
  2⤵
  PID:12060
- C:\Windows\System\fPsveUC.exe
  C:\Windows\System\fPsveUC.exe
  2⤵
  PID:12080
- C:\Windows\System\SNmIprY.exe
  C:\Windows\System\SNmIprY.exe
  2⤵
  PID:12100
- C:\Windows\System\fTVfRSi.exe
  C:\Windows\System\fTVfRSi.exe
  2⤵
  PID:12120
- C:\Windows\System\UyRWBPj.exe
  C:\Windows\System\UyRWBPj.exe
  2⤵
  PID:12152
- C:\Windows\System\demEHXP.exe
  C:\Windows\System\demEHXP.exe
  2⤵
  PID:12176
- C:\Windows\System\xLhcZzo.exe
  C:\Windows\System\xLhcZzo.exe
  2⤵
  PID:12196
- C:\Windows\System\eZxTral.exe
  C:\Windows\System\eZxTral.exe
  2⤵
  PID:12216
- C:\Windows\System\vDznxrv.exe
  C:\Windows\System\vDznxrv.exe
  2⤵
  PID:12240
- C:\Windows\System\ysyCBtE.exe
  C:\Windows\System\ysyCBtE.exe
  2⤵
  PID:12260
- C:\Windows\System\DZTTqun.exe
  C:\Windows\System\DZTTqun.exe
  2⤵
  PID:12280
- C:\Windows\System\HBUcdut.exe
  C:\Windows\System\HBUcdut.exe
  2⤵
  PID:10456
- C:\Windows\System\TcmTigB.exe
  C:\Windows\System\TcmTigB.exe
  2⤵
  PID:9964
- C:\Windows\System\EfzGrNi.exe
  C:\Windows\System\EfzGrNi.exe
  2⤵
  PID:9348
- C:\Windows\System\CBUbyYt.exe
  C:\Windows\System\CBUbyYt.exe
  2⤵
  PID:10032
- C:\Windows\System\yhxDirO.exe
  C:\Windows\System\yhxDirO.exe
  2⤵
  PID:10096
- C:\Windows\System\bUaprTq.exe
  C:\Windows\System\bUaprTq.exe
  2⤵
  PID:10728
- C:\Windows\System\nIxbAdL.exe
  C:\Windows\System\nIxbAdL.exe
  2⤵
  PID:10796
- C:\Windows\System\pwDfwan.exe
  C:\Windows\System\pwDfwan.exe
  2⤵
  PID:9408
- C:\Windows\System\NbVUcQh.exe
  C:\Windows\System\NbVUcQh.exe
  2⤵
  PID:8960
- C:\Windows\System\yvbnciN.exe
  C:\Windows\System\yvbnciN.exe
  2⤵
  PID:8996
- C:\Windows\System\xOXKLYh.exe
  C:\Windows\System\xOXKLYh.exe
  2⤵
  PID:9188
- C:\Windows\System\SPlUEFl.exe
  C:\Windows\System\SPlUEFl.exe
  2⤵
  PID:7948
- C:\Windows\System\nJYqghp.exe
  C:\Windows\System\nJYqghp.exe
  2⤵
  PID:11120
- C:\Windows\System\NtuGbnA.exe
  C:\Windows\System\NtuGbnA.exe
  2⤵
  PID:12304
- C:\Windows\System\euVFABV.exe
  C:\Windows\System\euVFABV.exe
  2⤵
  PID:12320
- C:\Windows\System\aHJLKzw.exe
  C:\Windows\System\aHJLKzw.exe
  2⤵
  PID:12344
- C:\Windows\System\ADaxKob.exe
  C:\Windows\System\ADaxKob.exe
  2⤵
  PID:12364
- C:\Windows\System\jFmyyLW.exe
  C:\Windows\System\jFmyyLW.exe
  2⤵
  PID:12380
- C:\Windows\System\IiJSJxh.exe
  C:\Windows\System\IiJSJxh.exe
  2⤵
  PID:12400
- C:\Windows\System\xeMLZqp.exe
  C:\Windows\System\xeMLZqp.exe
  2⤵
  PID:12424
- C:\Windows\System\pirpLyO.exe
  C:\Windows\System\pirpLyO.exe
  2⤵
  PID:12444
- C:\Windows\System\VjlesQR.exe
  C:\Windows\System\VjlesQR.exe
  2⤵
  PID:12464
- C:\Windows\System\AxfKzlY.exe
  C:\Windows\System\AxfKzlY.exe
  2⤵
  PID:12480
- C:\Windows\System\IQZoWQu.exe
  C:\Windows\System\IQZoWQu.exe
  2⤵
  PID:12500
- C:\Windows\System\cPSmUTo.exe
  C:\Windows\System\cPSmUTo.exe
  2⤵
  PID:12532
- C:\Windows\System\nBagOcs.exe
  C:\Windows\System\nBagOcs.exe
  2⤵
  PID:12552
- C:\Windows\System\vnTYXjQ.exe
  C:\Windows\System\vnTYXjQ.exe
  2⤵
  PID:12576
- C:\Windows\System\qEhfSAq.exe
  C:\Windows\System\qEhfSAq.exe
  2⤵
  PID:12596
- C:\Windows\System\tynMknI.exe
  C:\Windows\System\tynMknI.exe
  2⤵
  PID:12616
- C:\Windows\System\zRMEfKG.exe
  C:\Windows\System\zRMEfKG.exe
  2⤵
  PID:12636
- C:\Windows\System\UxgOTrt.exe
  C:\Windows\System\UxgOTrt.exe
  2⤵
  PID:12656
- C:\Windows\System\MyJsNUM.exe
  C:\Windows\System\MyJsNUM.exe
  2⤵
  PID:12680
- C:\Windows\System\FCGcNHh.exe
  C:\Windows\System\FCGcNHh.exe
  2⤵
  PID:12704
- C:\Windows\System\FAXOvMD.exe
  C:\Windows\System\FAXOvMD.exe
  2⤵
  PID:12728
- C:\Windows\System\sauSovM.exe
  C:\Windows\System\sauSovM.exe
  2⤵
  PID:12744
- C:\Windows\System\DraFoUX.exe
  C:\Windows\System\DraFoUX.exe
  2⤵
  PID:12768
- C:\Windows\System\thjJuXI.exe
  C:\Windows\System\thjJuXI.exe
  2⤵
  PID:12792
- C:\Windows\System\TmXHWhw.exe
  C:\Windows\System\TmXHWhw.exe
  2⤵
  PID:12812
- C:\Windows\System\jDpldDc.exe
  C:\Windows\System\jDpldDc.exe
  2⤵
  PID:12832
- C:\Windows\System\ZpcsQdz.exe
  C:\Windows\System\ZpcsQdz.exe
  2⤵
  PID:12852
- C:\Windows\System\srahtad.exe
  C:\Windows\System\srahtad.exe
  2⤵
  PID:12872
- C:\Windows\System\qNosopW.exe
  C:\Windows\System\qNosopW.exe
  2⤵
  PID:12888
- C:\Windows\System\RswxTIx.exe
  C:\Windows\System\RswxTIx.exe
  2⤵
  PID:12908
- C:\Windows\System\vlfSXPs.exe
  C:\Windows\System\vlfSXPs.exe
  2⤵
  PID:12932
- C:\Windows\System\OzLwXHw.exe
  C:\Windows\System\OzLwXHw.exe
  2⤵
  PID:12956
- C:\Windows\System\yUgHLKb.exe
  C:\Windows\System\yUgHLKb.exe
  2⤵
  PID:12980
- C:\Windows\System\MHhDWUE.exe
  C:\Windows\System\MHhDWUE.exe
  2⤵
  PID:13000
- C:\Windows\System\GkpgFWm.exe
  C:\Windows\System\GkpgFWm.exe
  2⤵
  PID:13020
- C:\Windows\System\tfxpJre.exe
  C:\Windows\System\tfxpJre.exe
  2⤵
  PID:13044
- C:\Windows\System\btaiGXr.exe
  C:\Windows\System\btaiGXr.exe
  2⤵
  PID:13064
- C:\Windows\System\pTWURqA.exe
  C:\Windows\System\pTWURqA.exe
  2⤵
  PID:13084
- C:\Windows\System\QJaDGze.exe
  C:\Windows\System\QJaDGze.exe
  2⤵
  PID:13108
- C:\Windows\System\HvQQQQG.exe
  C:\Windows\System\HvQQQQG.exe
  2⤵
  PID:13128
- C:\Windows\System\DJVzjAc.exe
  C:\Windows\System\DJVzjAc.exe
  2⤵
  PID:13148
- C:\Windows\System\OkWaZoD.exe
  C:\Windows\System\OkWaZoD.exe
  2⤵
  PID:13168
- C:\Windows\System\DASkgaY.exe
  C:\Windows\System\DASkgaY.exe
  2⤵
  PID:13192
- C:\Windows\System\txniUGg.exe
  C:\Windows\System\txniUGg.exe
  2⤵
  PID:13212
- C:\Windows\System\AUGsIFb.exe
  C:\Windows\System\AUGsIFb.exe
  2⤵
  PID:13236
- C:\Windows\System\lgdSZLs.exe
  C:\Windows\System\lgdSZLs.exe
  2⤵
  PID:13272
- C:\Windows\System\oMyPTAj.exe
  C:\Windows\System\oMyPTAj.exe
  2⤵
  PID:13292
- C:\Windows\System\fvrVblJ.exe
  C:\Windows\System\fvrVblJ.exe
  2⤵
  PID:13164
- C:\Windows\System\cdihiAT.exe
  C:\Windows\System\cdihiAT.exe
  2⤵
  PID:10524
- C:\Windows\System\ISZBozI.exe
  C:\Windows\System\ISZBozI.exe
  2⤵
  PID:11216
- C:\Windows\System\IxTmPTY.exe
  C:\Windows\System\IxTmPTY.exe
  2⤵
  PID:10620
- C:\Windows\System\xcIkeOb.exe
  C:\Windows\System\xcIkeOb.exe
  2⤵
  PID:10700
- C:\Windows\System\WfdQMhU.exe
  C:\Windows\System\WfdQMhU.exe
  2⤵
  PID:10320
- C:\Windows\System\dhYLwYj.exe
  C:\Windows\System\dhYLwYj.exe
  2⤵
  PID:10364
- C:\Windows\System\eHZOLpr.exe
  C:\Windows\System\eHZOLpr.exe
  2⤵
  PID:10844
- C:\Windows\System\YGmBSSa.exe
  C:\Windows\System\YGmBSSa.exe
  2⤵
  PID:10876
- C:\Windows\System\cEWeZGh.exe
  C:\Windows\System\cEWeZGh.exe
  2⤵
  PID:11032
- C:\Windows\System\esQWJEu.exe
  C:\Windows\System\esQWJEu.exe
  2⤵
  PID:11152
- C:\Windows\System\UiSzdFs.exe
  C:\Windows\System\UiSzdFs.exe
  2⤵
  PID:8628
- C:\Windows\System\WYvLVmE.exe
  C:\Windows\System\WYvLVmE.exe
  2⤵
  PID:11604
- C:\Windows\System\ZkIloTP.exe
  C:\Windows\System\ZkIloTP.exe
  2⤵
  PID:11900
- C:\Windows\System\zVTWUpY.exe
  C:\Windows\System\zVTWUpY.exe
  2⤵
  PID:12688
- C:\Windows\System\nGatTsm.exe
  C:\Windows\System\nGatTsm.exe
  2⤵
  PID:9432
- C:\Windows\System\ZhiVSze.exe
  C:\Windows\System\ZhiVSze.exe
  2⤵
  PID:8420
- C:\Windows\System\YWGfsRl.exe
  C:\Windows\System\YWGfsRl.exe
  2⤵
  PID:11300
- C:\Windows\System\qePqNxA.exe
  C:\Windows\System\qePqNxA.exe
  2⤵
  PID:11384
- C:\Windows\System\btuzmzh.exe
  C:\Windows\System\btuzmzh.exe
  2⤵
  PID:13260
- C:\Windows\System\rLogFNz.exe
  C:\Windows\System\rLogFNz.exe
  2⤵
  PID:11624
- C:\Windows\System\tjxLBlQ.exe
  C:\Windows\System\tjxLBlQ.exe
  2⤵
  PID:11796
- C:\Windows\System\nSLOKIX.exe
  C:\Windows\System\nSLOKIX.exe
  2⤵
  PID:11820
- C:\Windows\System\XzKsnZp.exe
  C:\Windows\System\XzKsnZp.exe
  2⤵
  PID:11912
- C:\Windows\System\TxMCIxq.exe
  C:\Windows\System\TxMCIxq.exe
  2⤵
  PID:11944
- C:\Windows\System\kqgWuHU.exe
  C:\Windows\System\kqgWuHU.exe
  2⤵
  PID:11988
- C:\Windows\System\fdkravq.exe
  C:\Windows\System\fdkravq.exe
  2⤵
  PID:11060
- C:\Windows\System\DfVajVA.exe
  C:\Windows\System\DfVajVA.exe
  2⤵
  PID:11572
- C:\Windows\System\hLcDifh.exe
  C:\Windows\System\hLcDifh.exe
  2⤵
  PID:11740
- C:\Windows\System\DsVnhso.exe
  C:\Windows\System\DsVnhso.exe
  2⤵
  PID:10008
- C:\Windows\System\xkjHPZa.exe
  C:\Windows\System\xkjHPZa.exe
  2⤵
  PID:12128
- C:\Windows\System\GPxHZjW.exe
  C:\Windows\System\GPxHZjW.exe
  2⤵
  PID:10912
- C:\Windows\System\wWqPDJE.exe
  C:\Windows\System\wWqPDJE.exe
  2⤵
  PID:12188
- C:\Windows\System\ATwsCTC.exe
  C:\Windows\System\ATwsCTC.exe
  2⤵
  PID:13252
- C:\Windows\System\qbNWcre.exe
  C:\Windows\System\qbNWcre.exe
  2⤵
  PID:12996
- C:\Windows\System\EtOazmL.exe
  C:\Windows\System\EtOazmL.exe
  2⤵
  PID:12644
- C:\Windows\System\RQRJroS.exe
  C:\Windows\System\RQRJroS.exe
  2⤵
  PID:9276
- C:\Windows\System\qEDvwgR.exe
  C:\Windows\System\qEDvwgR.exe
  2⤵
  PID:9748
- C:\Windows\System\lyZGZBa.exe
  C:\Windows\System\lyZGZBa.exe
  2⤵
  PID:4716
- C:\Windows\System\IPJpNGb.exe
  C:\Windows\System\IPJpNGb.exe
  2⤵
  PID:12608
- C:\Windows\System\FYMVFlb.exe
  C:\Windows\System\FYMVFlb.exe
  2⤵
  PID:12204
- C:\Windows\System\kPpJRhm.exe
  C:\Windows\System\kPpJRhm.exe
  2⤵
  PID:9948
- C:\Windows\System\kCwaDEq.exe
  C:\Windows\System\kCwaDEq.exe
  2⤵
  PID:8784
- C:\Windows\System\JyIxeTt.exe
  C:\Windows\System\JyIxeTt.exe
  2⤵
  PID:11688
- C:\Windows\System\buoKxHF.exe
  C:\Windows\System\buoKxHF.exe
  2⤵
  PID:12372
- C:\Windows\System\pPgLIij.exe
  C:\Windows\System\pPgLIij.exe
  2⤵
  PID:11472
- C:\Windows\System\jZMxxrh.exe
  C:\Windows\System\jZMxxrh.exe
  2⤵
  PID:8720
- C:\Windows\System\mikfQmk.exe
  C:\Windows\System\mikfQmk.exe
  2⤵
  PID:10428
- C:\Windows\System\WhAqlCx.exe
  C:\Windows\System\WhAqlCx.exe
  2⤵
  PID:12236
- C:\Windows\System\ycLwhSL.exe
  C:\Windows\System\ycLwhSL.exe
  2⤵
  PID:9084
- C:\Windows\System\RaHNlIF.exe
  C:\Windows\System\RaHNlIF.exe
  2⤵
  PID:12972
- C:\Windows\System\lpqpuWT.exe
  C:\Windows\System\lpqpuWT.exe
  2⤵
  PID:9124
- C:\Windows\System\aabCXzz.exe
  C:\Windows\System\aabCXzz.exe
  2⤵
  PID:11648
- C:\Windows\System\sRJmjFO.exe
  C:\Windows\System\sRJmjFO.exe
  2⤵
  PID:11644
- C:\Windows\System\ksUoqVh.exe
  C:\Windows\System\ksUoqVh.exe
  2⤵
  PID:13008
- C:\Windows\System\vHbhOSO.exe
  C:\Windows\System\vHbhOSO.exe
  2⤵
  PID:11132
- C:\Windows\System\RjkPYhI.exe
  C:\Windows\System\RjkPYhI.exe
  2⤵
  PID:12784
- C:\Windows\System\flYuqcX.exe
  C:\Windows\System\flYuqcX.exe
  2⤵
  PID:11432
- C:\Windows\System\OIlcqur.exe
  C:\Windows\System\OIlcqur.exe
  2⤵
  PID:11036
- C:\Windows\System\jJGVmuv.exe
  C:\Windows\System\jJGVmuv.exe
  2⤵
  PID:12944
- C:\Windows\System\VprGuno.exe
  C:\Windows\System\VprGuno.exe
  2⤵
  PID:9436
- C:\Windows\System\mRYbQGy.exe
  C:\Windows\System\mRYbQGy.exe
  2⤵
  PID:6108
- C:\Windows\System\ZHlYAMR.exe
  C:\Windows\System\ZHlYAMR.exe
  2⤵
  PID:11660
- C:\Windows\System\mLrQZyQ.exe
  C:\Windows\System\mLrQZyQ.exe
  2⤵
  PID:12072
- C:\Windows\System\mKjluIH.exe
  C:\Windows\System\mKjluIH.exe
  2⤵
  PID:11936
- C:\Windows\System\qfsETzE.exe
  C:\Windows\System\qfsETzE.exe
  2⤵
  PID:11580
- C:\Windows\System\YBepNke.exe
  C:\Windows\System\YBepNke.exe
  2⤵
  PID:10872
- C:\Windows\System\vNAmFrF.exe
  C:\Windows\System\vNAmFrF.exe
  2⤵
  PID:12508
- C:\Windows\System\YJGAiRf.exe
  C:\Windows\System\YJGAiRf.exe
  2⤵
  PID:1048
- C:\Windows\System\SaZcCme.exe
  C:\Windows\System\SaZcCme.exe
  2⤵
  PID:10956
- C:\Windows\System\FXFbgHe.exe
  C:\Windows\System\FXFbgHe.exe
  2⤵
  PID:11840
- C:\Windows\System\TSBYYED.exe
  C:\Windows\System\TSBYYED.exe
  2⤵
  PID:1104
- C:\Windows\System\SYZLFpM.exe
  C:\Windows\System\SYZLFpM.exe
  2⤵
  PID:11252
- C:\Windows\System\gBJvZMf.exe
  C:\Windows\System\gBJvZMf.exe
  2⤵
  PID:12276
- C:\Windows\System\RGjmKFq.exe
  C:\Windows\System\RGjmKFq.exe
  2⤵
  PID:8756
- C:\Windows\System\MdazQaD.exe
  C:\Windows\System\MdazQaD.exe
  2⤵
  PID:11496
- C:\Windows\System\rZsSdyD.exe
  C:\Windows\System\rZsSdyD.exe
  2⤵
  PID:9496
- C:\Windows\System\uGnAAGw.exe
  C:\Windows\System\uGnAAGw.exe
  2⤵
  PID:12880
- C:\Windows\System\XqZvZBj.exe
  C:\Windows\System\XqZvZBj.exe
  2⤵
  PID:13300
- C:\Windows\System\RnzIlpO.exe
  C:\Windows\System\RnzIlpO.exe
  2⤵
  PID:7172
- C:\Windows\System\MJKAQLy.exe
  C:\Windows\System\MJKAQLy.exe
  2⤵
  PID:9932
- C:\Windows\System\QqPmOCp.exe
  C:\Windows\System\QqPmOCp.exe
  2⤵
  PID:6044
- C:\Windows\System\cKHVTWN.exe
  C:\Windows\System\cKHVTWN.exe
  2⤵
  PID:13124
- C:\Windows\System\LIHhXFF.exe
  C:\Windows\System\LIHhXFF.exe
  2⤵
  PID:12604
- C:\Windows\System\SDwxbQb.exe
  C:\Windows\System\SDwxbQb.exe
  2⤵
  PID:3532
- C:\Windows\System\wBnRAsl.exe
  C:\Windows\System\wBnRAsl.exe
  2⤵
  PID:11700
- C:\Windows\System\biwfpAX.exe
  C:\Windows\System\biwfpAX.exe
  2⤵
  PID:10688
- C:\Windows\System\VaAIJgK.exe
  C:\Windows\System\VaAIJgK.exe
  2⤵
  PID:9068
- C:\Windows\System\SUGcMld.exe
  C:\Windows\System\SUGcMld.exe
  2⤵
  PID:11884
- C:\Windows\System\zsLEqlB.exe
  C:\Windows\System\zsLEqlB.exe
  2⤵
  PID:10584
- C:\Windows\System\KbAlAZG.exe
  C:\Windows\System\KbAlAZG.exe
  2⤵
  PID:13328
- C:\Windows\System\MAlgmMg.exe
  C:\Windows\System\MAlgmMg.exe
  2⤵
  PID:13352
- C:\Windows\System\MkmTxcD.exe
  C:\Windows\System\MkmTxcD.exe
  2⤵
  PID:13376
- C:\Windows\System\LyJJZLv.exe
  C:\Windows\System\LyJJZLv.exe
  2⤵
  PID:13392
- C:\Windows\System\pQeHDtp.exe
  C:\Windows\System\pQeHDtp.exe
  2⤵
  PID:13416
- C:\Windows\System\hcnUOjq.exe
  C:\Windows\System\hcnUOjq.exe
  2⤵
  PID:13444
- C:\Windows\System\MoGsczc.exe
  C:\Windows\System\MoGsczc.exe
  2⤵
  PID:13468
- C:\Windows\System\rYLaQRr.exe
  C:\Windows\System\rYLaQRr.exe
  2⤵
  PID:13488
- C:\Windows\System\YYdLhVU.exe
  C:\Windows\System\YYdLhVU.exe
  2⤵
  PID:13512
- C:\Windows\System\idZTuVJ.exe
  C:\Windows\System\idZTuVJ.exe
  2⤵
  PID:13544
- C:\Windows\System\ZpnDXbC.exe
  C:\Windows\System\ZpnDXbC.exe
  2⤵
  PID:13560
- C:\Windows\System\oQPQeKj.exe
  C:\Windows\System\oQPQeKj.exe
  2⤵
  PID:13580
- C:\Windows\System\pQReEIK.exe
  C:\Windows\System\pQReEIK.exe
  2⤵
  PID:13604
- C:\Windows\System\ifBhkDQ.exe
  C:\Windows\System\ifBhkDQ.exe
  2⤵
  PID:13624
- C:\Windows\System\tRgDXIE.exe
  C:\Windows\System\tRgDXIE.exe
  2⤵
  PID:13660
- C:\Windows\System\fFaiTZB.exe
  C:\Windows\System\fFaiTZB.exe
  2⤵
  PID:13684
- C:\Windows\System\qlLlwex.exe
  C:\Windows\System\qlLlwex.exe
  2⤵
  PID:13704
- C:\Windows\System\IAjofUs.exe
  C:\Windows\System\IAjofUs.exe
  2⤵
  PID:13728
- C:\Windows\System\EWllHEe.exe
  C:\Windows\System\EWllHEe.exe
  2⤵
  PID:13752
- C:\Windows\System\isGGNHa.exe
  C:\Windows\System\isGGNHa.exe
  2⤵
  PID:13772
- C:\Windows\System\sIzYSqq.exe
  C:\Windows\System\sIzYSqq.exe
  2⤵
  PID:13792
- C:\Windows\System\xQFTXKN.exe
  C:\Windows\System\xQFTXKN.exe
  2⤵
  PID:13812
- C:\Windows\System\kApTkrV.exe
  C:\Windows\System\kApTkrV.exe
  2⤵
  PID:13836
- C:\Windows\System\DdnnBdw.exe
  C:\Windows\System\DdnnBdw.exe
  2⤵
  PID:13852
- C:\Windows\System\PBWZOyS.exe
  C:\Windows\System\PBWZOyS.exe
  2⤵
  PID:13876
- C:\Windows\System\bFcMFXw.exe
  C:\Windows\System\bFcMFXw.exe
  2⤵
  PID:13896
- C:\Windows\System\XBFvdqg.exe
  C:\Windows\System\XBFvdqg.exe
  2⤵
  PID:13916
- C:\Windows\System\PYQkSsU.exe
  C:\Windows\System\PYQkSsU.exe
  2⤵
  PID:13936
- C:\Windows\System\gzAXXoa.exe
  C:\Windows\System\gzAXXoa.exe
  2⤵
  PID:13956
- C:\Windows\System\GmHTqCZ.exe
  C:\Windows\System\GmHTqCZ.exe
  2⤵
  PID:13972
- C:\Windows\System\rkoWQaq.exe
  C:\Windows\System\rkoWQaq.exe
  2⤵
  PID:13988
- C:\Windows\System\PkdXWJf.exe
  C:\Windows\System\PkdXWJf.exe
  2⤵
  PID:14020
- C:\Windows\System\kyEUDie.exe
  C:\Windows\System\kyEUDie.exe
  2⤵
  PID:14040
- C:\Windows\System\TdtwRGX.exe
  C:\Windows\System\TdtwRGX.exe
  2⤵
  PID:14072
- C:\Windows\System\WlDkIah.exe
  C:\Windows\System\WlDkIah.exe
  2⤵
  PID:14100
- C:\Windows\System\qsQatPr.exe
  C:\Windows\System\qsQatPr.exe
  2⤵
  PID:14116
- C:\Windows\System\oGBtyOY.exe
  C:\Windows\System\oGBtyOY.exe
  2⤵
  PID:14296
- C:\Windows\System\OXGsRzv.exe
  C:\Windows\System\OXGsRzv.exe
  2⤵
  PID:13496
- C:\Windows\System\CZmLqSL.exe
  C:\Windows\System\CZmLqSL.exe
  2⤵
  PID:14324
- C:\Windows\System\GSxHuxo.exe
  C:\Windows\System\GSxHuxo.exe
  2⤵
  PID:14112
- C:\Windows\System\sfBbPUa.exe
  C:\Windows\System\sfBbPUa.exe
  2⤵
  PID:14208
- C:\Windows\System\JeJUibj.exe
  C:\Windows\System\JeJUibj.exe
  2⤵
  PID:13748
- C:\Windows\System\GZBpukt.exe
  C:\Windows\System\GZBpukt.exe
  2⤵
  PID:14224
- C:\Windows\System\jRhjlVh.exe
  C:\Windows\System\jRhjlVh.exe
  2⤵
  PID:14252
- C:\Windows\System\UfaGUFY.exe
  C:\Windows\System\UfaGUFY.exe
  2⤵
  PID:13932
- C:\Windows\System\oPWOTmF.exe
  C:\Windows\System\oPWOTmF.exe
  2⤵
  PID:14300
- C:\Windows\System\UlqcROh.exe
  C:\Windows\System\UlqcROh.exe
  2⤵
  PID:13632
- C:\Windows\System\pRUIJMy.exe
  C:\Windows\System\pRUIJMy.exe
  2⤵
  PID:11588
- C:\Windows\System\gPsOHUe.exe
  C:\Windows\System\gPsOHUe.exe
  2⤵
  PID:11776
- C:\Windows\System\NrjGUmf.exe
  C:\Windows\System\NrjGUmf.exe
  2⤵
  PID:10932
- C:\Windows\System\ebDUUxh.exe
  C:\Windows\System\ebDUUxh.exe
  2⤵
  PID:4424
- C:\Windows\System\uyfFpVt.exe
  C:\Windows\System\uyfFpVt.exe
  2⤵
  PID:13460
- C:\Windows\System\JxMOjpb.exe
  C:\Windows\System\JxMOjpb.exe
  2⤵
  PID:5028
- C:\Windows\System\eHhUtNj.exe
  C:\Windows\System\eHhUtNj.exe
  2⤵
  PID:13888
- C:\Windows\System\MYKDtlv.exe
  C:\Windows\System\MYKDtlv.exe
  2⤵
  PID:13208
- C:\Windows\System\nWeMDlV.exe
  C:\Windows\System\nWeMDlV.exe
  2⤵
  PID:14132
- C:\Windows\System\RgHQmyv.exe
  C:\Windows\System\RgHQmyv.exe
  2⤵
  PID:13572
- C:\Windows\System\gmgFzpe.exe
  C:\Windows\System\gmgFzpe.exe
  2⤵
  PID:14292
- C:\Windows\System\EIoATXO.exe
  C:\Windows\System\EIoATXO.exe
  2⤵
  PID:14228
- C:\Windows\System\ipcNLtq.exe
  C:\Windows\System\ipcNLtq.exe
  2⤵
  PID:10868
- C:\Windows\System\yXtBQyC.exe
  C:\Windows\System\yXtBQyC.exe
  2⤵
  PID:12112
- C:\Windows\System\aAyMxXk.exe
  C:\Windows\System\aAyMxXk.exe
  2⤵
  PID:13720
- C:\Windows\System\pTtXwmv.exe
  C:\Windows\System\pTtXwmv.exe
  2⤵
  PID:4632
- C:\Windows\System\jvbzbzl.exe
  C:\Windows\System\jvbzbzl.exe
  2⤵
  PID:14204
- C:\Windows\System\jcYqmTK.exe
  C:\Windows\System\jcYqmTK.exe
  2⤵
  PID:13828
- C:\Windows\System\tkLFuvk.exe
  C:\Windows\System\tkLFuvk.exe
  2⤵
  PID:2008
- C:\Windows\System\vfXRrMG.exe
  C:\Windows\System\vfXRrMG.exe
  2⤵
  PID:13612
- C:\Windows\System\eKlBbRt.exe
  C:\Windows\System\eKlBbRt.exe
  2⤵
  PID:4308
- C:\Windows\System\hYmSNxL.exe
  C:\Windows\System\hYmSNxL.exe
  2⤵
  PID:13848
- C:\Windows\System\stvEUCP.exe
  C:\Windows\System\stvEUCP.exe
  2⤵
  PID:14152
- C:\Windows\System\lVMRFnC.exe
  C:\Windows\System\lVMRFnC.exe
  2⤵
  PID:13452
- C:\Windows\System\AXFVIhK.exe
  C:\Windows\System\AXFVIhK.exe
  2⤵
  PID:14244
- C:\Windows\System\nODmiNr.exe
  C:\Windows\System\nODmiNr.exe
  2⤵
  PID:14080
- C:\Windows\System\BwirIes.exe
  C:\Windows\System\BwirIes.exe
  2⤵
  PID:2420
- C:\Windows\System\ZkcTxmu.exe
  C:\Windows\System\ZkcTxmu.exe
  2⤵
  PID:13552
- C:\Windows\System\FrtReHd.exe
  C:\Windows\System\FrtReHd.exe
  2⤵
  PID:14216
- C:\Windows\System\QZooLCP.exe
  C:\Windows\System\QZooLCP.exe
  2⤵
  PID:12476
- C:\Windows\System\BNnIXpv.exe
  C:\Windows\System\BNnIXpv.exe
  2⤵
  PID:13508
- C:\Windows\System\LWxSsCR.exe
  C:\Windows\System\LWxSsCR.exe
  2⤵
  PID:4552
- C:\Windows\System\xhpRSdI.exe
  C:\Windows\System\xhpRSdI.exe
  2⤵
  PID:3464
- C:\Windows\System\QcWWRqs.exe
  C:\Windows\System\QcWWRqs.exe
  2⤵
  PID:4160
- C:\Windows\System\QrVGZoa.exe
  C:\Windows\System\QrVGZoa.exe
  2⤵
  PID:7976
- C:\Windows\System\tXYvyEJ.exe
  C:\Windows\System\tXYvyEJ.exe
  2⤵
  PID:3632
- C:\Windows\System\axfQGVK.exe
  C:\Windows\System\axfQGVK.exe
  2⤵
  PID:14032
- C:\Windows\System\dTyCfwx.exe
  C:\Windows\System\dTyCfwx.exe
  2⤵
  PID:3972
- C:\Windows\System\aSrxyfF.exe
  C:\Windows\System\aSrxyfF.exe
  2⤵
  PID:13316
- C:\Windows\System\wERHPXa.exe
  C:\Windows\System\wERHPXa.exe
  2⤵
  PID:928
- C:\Windows\System\VFamCnQ.exe
  C:\Windows\System\VFamCnQ.exe
  2⤵
  PID:13040
- C:\Windows\System\mLRkevP.exe
  C:\Windows\System\mLRkevP.exe
  2⤵
  PID:4268
- C:\Windows\System\PbMRAJG.exe
  C:\Windows\System\PbMRAJG.exe
  2⤵
  PID:8488
- C:\Windows\System\hFTxNZW.exe
  C:\Windows\System\hFTxNZW.exe
  2⤵
  PID:13464
- C:\Windows\System\ZdgAtWt.exe
  C:\Windows\System\ZdgAtWt.exe
  2⤵
  PID:4120
- C:\Windows\System\doByWUO.exe
  C:\Windows\System\doByWUO.exe
  2⤵
  PID:13640
- C:\Windows\System\RycCNrE.exe
  C:\Windows\System\RycCNrE.exe
  2⤵
  PID:10808
- C:\Windows\System\TiinrIS.exe
  C:\Windows\System\TiinrIS.exe
  2⤵
  PID:4360
- C:\Windows\System\GIzOQTV.exe
  C:\Windows\System\GIzOQTV.exe
  2⤵
  PID:5744
- C:\Windows\System\kXAPALf.exe
  C:\Windows\System\kXAPALf.exe
  2⤵
  PID:6880
- C:\Windows\System\kGZAMhJ.exe
  C:\Windows\System\kGZAMhJ.exe
  2⤵
  PID:10156
- C:\Windows\System\eBbkAYc.exe
  C:\Windows\System\eBbkAYc.exe
  2⤵
  PID:13768
- C:\Windows\System\ykKhTZj.exe
  C:\Windows\System\ykKhTZj.exe
  2⤵
  PID:4456
- C:\Windows\System\CIgukMe.exe
  C:\Windows\System\CIgukMe.exe
  2⤵
  PID:12572
- C:\Windows\System\TMcRyfe.exe
  C:\Windows\System\TMcRyfe.exe
  2⤵
  PID:13636
- C:\Windows\System\DwLjDPg.exe
  C:\Windows\System\DwLjDPg.exe
  2⤵
  PID:4724
- C:\Windows\System\TagWzTd.exe
  C:\Windows\System\TagWzTd.exe
  2⤵
  PID:13388
- C:\Windows\System\lHtSwbG.exe
  C:\Windows\System\lHtSwbG.exe
  2⤵
  PID:13360
- C:\Windows\System\ciIBmzm.exe
  C:\Windows\System\ciIBmzm.exe
  2⤵
  PID:14236
- C:\Windows\System\grfvIfU.exe
  C:\Windows\System\grfvIfU.exe
  2⤵
  PID:4164
- C:\Windows\System\xsdifwD.exe
  C:\Windows\System\xsdifwD.exe
  2⤵
  PID:212
- C:\Windows\System\uYkxEIu.exe
  C:\Windows\System\uYkxEIu.exe
  2⤵
  PID:2668
- C:\Windows\System\uEEKCZJ.exe
  C:\Windows\System\uEEKCZJ.exe
  2⤵
  PID:14280
- C:\Windows\System\dpIFMxF.exe
  C:\Windows\System\dpIFMxF.exe
  2⤵
  PID:3628
- C:\Windows\System\hiuVNCY.exe
  C:\Windows\System\hiuVNCY.exe
  2⤵
  PID:3132
- C:\Windows\System\jcLzGDx.exe
  C:\Windows\System\jcLzGDx.exe
  2⤵
  PID:740
- C:\Windows\System\rOJsYro.exe
  C:\Windows\System\rOJsYro.exe
  2⤵
  PID:13484
- C:\Windows\System\TePCrZp.exe
  C:\Windows\System\TePCrZp.exe
  2⤵
  PID:8492
- C:\Windows\System\spQgZDH.exe
  C:\Windows\System\spQgZDH.exe
  2⤵
  PID:2264
- C:\Windows\System\DakfeIY.exe
  C:\Windows\System\DakfeIY.exe
  2⤵
  PID:5332
- C:\Windows\System\KpSzQjE.exe
  C:\Windows\System\KpSzQjE.exe
  2⤵
  PID:4844
- C:\Windows\System\RYxkYEy.exe
  C:\Windows\System\RYxkYEy.exe
  2⤵
  PID:4952
- C:\Windows\System\UjPaBON.exe
  C:\Windows\System\UjPaBON.exe
  2⤵
  PID:14316
- C:\Windows\System\NYQoRkR.exe
  C:\Windows\System\NYQoRkR.exe
  2⤵
  PID:5740
- C:\Windows\System\UekojfH.exe
  C:\Windows\System\UekojfH.exe
  2⤵
  PID:2504
- C:\Windows\System\LHbegjN.exe
  C:\Windows\System\LHbegjN.exe
  2⤵
  PID:4600
- C:\Windows\System\RnvtBid.exe
  C:\Windows\System\RnvtBid.exe
  2⤵
  PID:3432
- C:\Windows\System\MMcTOKs.exe
  C:\Windows\System\MMcTOKs.exe
  2⤵
  PID:14192
- C:\Windows\System\unSavbb.exe
  C:\Windows\System\unSavbb.exe
  2⤵
  PID:4968
- C:\Windows\System\oCxAMhl.exe
  C:\Windows\System\oCxAMhl.exe
  2⤵
  PID:3836
- C:\Windows\System\wTNtoUD.exe
  C:\Windows\System\wTNtoUD.exe
  2⤵
  PID:4224
- C:\Windows\System\QEfCSQR.exe
  C:\Windows\System\QEfCSQR.exe
  2⤵
  PID:8444
- C:\Windows\System\PHBkFaG.exe
  C:\Windows\System\PHBkFaG.exe
  2⤵
  PID:8276
- C:\Windows\System\wUMUPSW.exe
  C:\Windows\System\wUMUPSW.exe
  2⤵
  PID:3616
- C:\Windows\System\QVSnpqI.exe
  C:\Windows\System\QVSnpqI.exe
  2⤵
  PID:3800
- C:\Windows\System\QUKLGaA.exe
  C:\Windows\System\QUKLGaA.exe
  2⤵
  PID:3692
- C:\Windows\System\RXsuEyV.exe
  C:\Windows\System\RXsuEyV.exe
  2⤵
  PID:13412
- C:\Windows\System\XXcXCEh.exe
  C:\Windows\System\XXcXCEh.exe
  2⤵
  PID:14196
- C:\Windows\System\DOWFysJ.exe
  C:\Windows\System\DOWFysJ.exe
  2⤵
  PID:4784
- C:\Windows\System\OeZCtjA.exe
  C:\Windows\System\OeZCtjA.exe
  2⤵
  PID:13620
- C:\Windows\System\hyOdOYW.exe
  C:\Windows\System\hyOdOYW.exe
  2⤵
  PID:14128
- C:\Windows\System\KEdLlja.exe
  C:\Windows\System\KEdLlja.exe
  2⤵
  PID:3300
- C:\Windows\System\TScqbFI.exe
  C:\Windows\System\TScqbFI.exe
  2⤵
  PID:708
- C:\Windows\System\lDRBWRL.exe
  C:\Windows\System\lDRBWRL.exe
  2⤵
  PID:14352
- C:\Windows\System\tuKTwvE.exe
  C:\Windows\System\tuKTwvE.exe
  2⤵
  PID:14372
- C:\Windows\System\qDxFIrJ.exe
  C:\Windows\System\qDxFIrJ.exe
  2⤵
  PID:14400
- C:\Windows\System\jldFxRc.exe
  C:\Windows\System\jldFxRc.exe
  2⤵
  PID:14424
- C:\Windows\System\fnvMrdN.exe
  C:\Windows\System\fnvMrdN.exe
  2⤵
  PID:14444
- C:\Windows\System\qhKKSSf.exe
  C:\Windows\System\qhKKSSf.exe
  2⤵
  PID:14472
- C:\Windows\System\lmCHLIR.exe
  C:\Windows\System\lmCHLIR.exe
  2⤵
  PID:14496
- C:\Windows\System\KvmZYZc.exe
  C:\Windows\System\KvmZYZc.exe
  2⤵
  PID:14524
- C:\Windows\System\ameqydo.exe
  C:\Windows\System\ameqydo.exe
  2⤵
  PID:14544
- C:\Windows\System\nHHYEYo.exe
  C:\Windows\System\nHHYEYo.exe
  2⤵
  PID:14564
- C:\Windows\System\fJpTMJo.exe
  C:\Windows\System\fJpTMJo.exe
  2⤵
  PID:14584
- C:\Windows\System\ggmCYcO.exe
  C:\Windows\System\ggmCYcO.exe
  2⤵
  PID:14604
- C:\Windows\System\HwLoyZA.exe
  C:\Windows\System\HwLoyZA.exe
  2⤵
  PID:14620
- C:\Windows\System\eVQcefO.exe
  C:\Windows\System\eVQcefO.exe
  2⤵
  PID:14680
- C:\Windows\System\WAIMkTZ.exe
  C:\Windows\System\WAIMkTZ.exe
  2⤵
  PID:14732
- C:\Windows\System\XGlNhrT.exe
  C:\Windows\System\XGlNhrT.exe
  2⤵
  PID:14792
- C:\Windows\System\LWsQQNO.exe
  C:\Windows\System\LWsQQNO.exe
  2⤵
  PID:14876
- C:\Windows\System\nRcneKA.exe
  C:\Windows\System\nRcneKA.exe
  2⤵
  PID:14960
- C:\Windows\System\SXsKJfS.exe
  C:\Windows\System\SXsKJfS.exe
  2⤵
  PID:14988
- C:\Windows\System\HKiEPvN.exe
  C:\Windows\System\HKiEPvN.exe
  2⤵
  PID:15004
- C:\Windows\System\QqDlsgC.exe
  C:\Windows\System\QqDlsgC.exe
  2⤵
  PID:15020
- C:\Windows\System\WfKpmVo.exe
  C:\Windows\System\WfKpmVo.exe
  2⤵
  PID:15036
- C:\Windows\System\WkNLdoc.exe
  C:\Windows\System\WkNLdoc.exe
  2⤵
  PID:15052
- C:\Windows\System\uRFvtng.exe
  C:\Windows\System\uRFvtng.exe
  2⤵
  PID:15068
- C:\Windows\System\HPRjfsd.exe
  C:\Windows\System\HPRjfsd.exe
  2⤵
  PID:15084
- C:\Windows\System\zYlePCn.exe
  C:\Windows\System\zYlePCn.exe
  2⤵
  PID:15100
- C:\Windows\System\PqHgzey.exe
  C:\Windows\System\PqHgzey.exe
  2⤵
  PID:15116
- C:\Windows\System\hgrRkzc.exe
  C:\Windows\System\hgrRkzc.exe
  2⤵
  PID:15132
- C:\Windows\System\PgPXkMv.exe
  C:\Windows\System\PgPXkMv.exe
  2⤵
  PID:15148
- C:\Windows\System\uokaPQC.exe
  C:\Windows\System\uokaPQC.exe
  2⤵
  PID:15164
- C:\Windows\System\XWANvvz.exe
  C:\Windows\System\XWANvvz.exe
  2⤵
  PID:15180
- C:\Windows\System\FkdNAqT.exe
  C:\Windows\System\FkdNAqT.exe
  2⤵
  PID:15196
- C:\Windows\System\PrBIigh.exe
  C:\Windows\System\PrBIigh.exe
  2⤵
  PID:15212
- C:\Windows\System\jdswTZm.exe
  C:\Windows\System\jdswTZm.exe
  2⤵
  PID:15228
- C:\Windows\System\bLbzmUw.exe
  C:\Windows\System\bLbzmUw.exe
  2⤵
  PID:15244
- C:\Windows\System\CgRzdtI.exe
  C:\Windows\System\CgRzdtI.exe
  2⤵
  PID:15260
- C:\Windows\System\NFkZVlh.exe
  C:\Windows\System\NFkZVlh.exe
  2⤵
  PID:15276
- C:\Windows\System\bEsVXLM.exe
  C:\Windows\System\bEsVXLM.exe
  2⤵
  PID:15292
- C:\Windows\System\XZEZttS.exe
  C:\Windows\System\XZEZttS.exe
  2⤵
  PID:15308
- C:\Windows\System\PutJeVw.exe
  C:\Windows\System\PutJeVw.exe
  2⤵
  PID:15324
- C:\Windows\System\FZTGyUS.exe
  C:\Windows\System\FZTGyUS.exe
  2⤵
  PID:15340
- C:\Windows\System\LqeqEvf.exe
  C:\Windows\System\LqeqEvf.exe
  2⤵
  PID:15356
- C:\Windows\System\eKaHJnh.exe
  C:\Windows\System\eKaHJnh.exe
  2⤵
  PID:4580
- C:\Windows\System\njoMQAY.exe
  C:\Windows\System\njoMQAY.exe
  2⤵
  PID:548
- C:\Windows\System\ZPmeZwx.exe
  C:\Windows\System\ZPmeZwx.exe
  2⤵
  PID:2652
- C:\Windows\System\dciCfst.exe
  C:\Windows\System\dciCfst.exe
  2⤵
  PID:14388
- C:\Windows\System\DSMehpd.exe
  C:\Windows\System\DSMehpd.exe
  2⤵
  PID:1184
- C:\Windows\System\AXQOHdt.exe
  C:\Windows\System\AXQOHdt.exe
  2⤵
  PID:232
- C:\Windows\System\VhusjWy.exe
  C:\Windows\System\VhusjWy.exe
  2⤵
  PID:2332
- C:\Windows\System\nzNoBtu.exe
  C:\Windows\System\nzNoBtu.exe
  2⤵
  PID:14384
- C:\Windows\System\oyptXlB.exe
  C:\Windows\System\oyptXlB.exe
  2⤵
  PID:4884
- C:\Windows\System\LbAyDaE.exe
  C:\Windows\System\LbAyDaE.exe
  2⤵
  PID:4244
- C:\Windows\System\WIHtxXe.exe
  C:\Windows\System\WIHtxXe.exe
  2⤵
  PID:5080
- C:\Windows\System\fkJwoZb.exe
  C:\Windows\System\fkJwoZb.exe
  2⤵
  PID:14508
- C:\Windows\System\auFxNzV.exe
  C:\Windows\System\auFxNzV.exe
  2⤵
  PID:14556
- C:\Windows\System\DtTfaQU.exe
  C:\Windows\System\DtTfaQU.exe
  2⤵
  PID:2016
- C:\Windows\System\SEUFuUn.exe
  C:\Windows\System\SEUFuUn.exe
  2⤵
  PID:2372
- C:\Windows\System\IwWqDYO.exe
  C:\Windows\System\IwWqDYO.exe
  2⤵
  PID:14644
- C:\Windows\System\pATfbnz.exe
  C:\Windows\System\pATfbnz.exe
  2⤵
  PID:14488
- C:\Windows\System\Ldipyor.exe
  C:\Windows\System\Ldipyor.exe
  2⤵
  PID:10572
- C:\Windows\System\ygEISbj.exe
  C:\Windows\System\ygEISbj.exe
  2⤵
  PID:10644
- C:\Windows\System\LkzDyIk.exe
  C:\Windows\System\LkzDyIk.exe
  2⤵
  PID:10148
- C:\Windows\System\XuYbyug.exe
  C:\Windows\System\XuYbyug.exe
  2⤵
  PID:10196
- C:\Windows\System\WhXAyot.exe
  C:\Windows\System\WhXAyot.exe
  2⤵
  PID:10988
- C:\Windows\System\bvNZmIB.exe
  C:\Windows\System\bvNZmIB.exe
  2⤵
  PID:8196
- C:\Windows\System\rqnIali.exe
  C:\Windows\System\rqnIali.exe
  2⤵
  PID:9512
- C:\Windows\System\FjTHHir.exe
  C:\Windows\System\FjTHHir.exe
  2⤵
  PID:10268
- C:\Windows\System\zxvVmyS.exe
  C:\Windows\System\zxvVmyS.exe
  2⤵
  PID:10400
- C:\Windows\System\ThwKCzb.exe
  C:\Windows\System\ThwKCzb.exe
  2⤵
  PID:10672
- C:\Windows\System\AJOjQiH.exe
  C:\Windows\System\AJOjQiH.exe
  2⤵
  PID:10800
- C:\Windows\System\HZCdcJd.exe
  C:\Windows\System\HZCdcJd.exe
  2⤵
  PID:10940
- C:\Windows\System\BNWaqnx.exe
  C:\Windows\System\BNWaqnx.exe
  2⤵
  PID:14648
- C:\Windows\System\KQwfvBo.exe
  C:\Windows\System\KQwfvBo.exe
  2⤵
  PID:10100
- C:\Windows\System\rhAqPno.exe
  C:\Windows\System\rhAqPno.exe
  2⤵
  PID:3488
- C:\Windows\System\jksTjdR.exe
  C:\Windows\System\jksTjdR.exe
  2⤵
  PID:4520
- C:\Windows\System\JcodFrS.exe
  C:\Windows\System\JcodFrS.exe
  2⤵
  PID:5004
- C:\Windows\System\okSABrd.exe
  C:\Windows\System\okSABrd.exe
  2⤵
  PID:6136
- C:\Windows\System\IYGZvpd.exe
  C:\Windows\System\IYGZvpd.exe
  2⤵
  PID:5128
- C:\Windows\System\lIUaVQa.exe
  C:\Windows\System\lIUaVQa.exe
  2⤵
  PID:14708
- C:\Windows\System\liORpyx.exe
  C:\Windows\System\liORpyx.exe
  2⤵
  PID:5476
- C:\Windows\System\rOlTQCr.exe
  C:\Windows\System\rOlTQCr.exe
  2⤵
  PID:3096
- C:\Windows\System\udouvpN.exe
  C:\Windows\System\udouvpN.exe
  2⤵
  PID:2752
- C:\Windows\System\rfCsdrr.exe
  C:\Windows\System\rfCsdrr.exe
  2⤵
  PID:5132
- C:\Windows\System\yvBzeaL.exe
  C:\Windows\System\yvBzeaL.exe
  2⤵
  PID:5628
- C:\Windows\System\KnUuwhG.exe
  C:\Windows\System\KnUuwhG.exe
  2⤵
  PID:5920
- C:\Windows\System\IIZjTGN.exe
  C:\Windows\System\IIZjTGN.exe
  2⤵
  PID:5932
- C:\Windows\System\yXsznGG.exe
  C:\Windows\System\yXsznGG.exe
  2⤵
  PID:2492
- C:\Windows\System\msVKDAO.exe
  C:\Windows\System\msVKDAO.exe
  2⤵
  PID:14808
- C:\Windows\System\ebVzxDl.exe
  C:\Windows\System\ebVzxDl.exe
  2⤵
  PID:4572
- C:\Windows\System\vFFVlsN.exe
  C:\Windows\System\vFFVlsN.exe
  2⤵
  PID:14832
- C:\Windows\System\oomQzVN.exe
  C:\Windows\System\oomQzVN.exe
  2⤵
  PID:5388
- C:\Windows\System\OSowktV.exe
  C:\Windows\System\OSowktV.exe
  2⤵
  PID:5420
- C:\Windows\System\KUMAZHL.exe
  C:\Windows\System\KUMAZHL.exe
  2⤵
  PID:14856
- C:\Windows\System\fDnQeOE.exe
  C:\Windows\System\fDnQeOE.exe
  2⤵
  PID:14868
- C:\Windows\System\vFyYbEN.exe
  C:\Windows\System\vFyYbEN.exe
  2⤵
  PID:5672
- C:\Windows\System\BWOsVhL.exe
  C:\Windows\System\BWOsVhL.exe
  2⤵
  PID:3408
- C:\Windows\System\wLtHVJv.exe
  C:\Windows\System\wLtHVJv.exe
  2⤵
  PID:5208
- C:\Windows\System\CkKmSne.exe
  C:\Windows\System\CkKmSne.exe
  2⤵
  PID:5864
- C:\Windows\System\aBYcqKT.exe
  C:\Windows\System\aBYcqKT.exe
  2⤵
  PID:14952
- C:\Windows\System\GSZUTpA.exe
  C:\Windows\System\GSZUTpA.exe
  2⤵
  PID:5836
- C:\Windows\System\qTkAjDS.exe
  C:\Windows\System\qTkAjDS.exe
  2⤵
  PID:14996
- C:\Windows\System\WzjvMXA.exe
  C:\Windows\System\WzjvMXA.exe
  2⤵
  PID:15016
- C:\Windows\System\eWpUEir.exe
  C:\Windows\System\eWpUEir.exe
  2⤵
  PID:15044
- C:\Windows\System\GYOhxva.exe
  C:\Windows\System\GYOhxva.exe
  2⤵
  PID:14756
- C:\Windows\System\txJwczY.exe
  C:\Windows\System\txJwczY.exe
  2⤵
  PID:15128
- C:\Windows\System\NYOjqzk.exe
  C:\Windows\System\NYOjqzk.exe
  2⤵
  PID:15224
- C:\Windows\System\bIjBjDR.exe
  C:\Windows\System\bIjBjDR.exe
  2⤵
  PID:15284
- C:\Windows\System\mPmxkxs.exe
  C:\Windows\System\mPmxkxs.exe
  2⤵
  PID:14928
- C:\Windows\System\FkiCeBP.exe
  C:\Windows\System\FkiCeBP.exe
  2⤵
  PID:14744
- C:\Windows\System\jpMDhEZ.exe
  C:\Windows\System\jpMDhEZ.exe
  2⤵
  PID:14752
- C:\Windows\System\IeHzKzq.exe
  C:\Windows\System\IeHzKzq.exe
  2⤵
  PID:14788
- C:\Windows\System\MnjbDNm.exe
  C:\Windows\System\MnjbDNm.exe
  2⤵
  PID:14812
- C:\Windows\System\IGadfNr.exe
  C:\Windows\System\IGadfNr.exe
  2⤵
  PID:1204
- C:\Windows\System\TeOYsTQ.exe
  C:\Windows\System\TeOYsTQ.exe
  2⤵
  PID:4832
- C:\Windows\System\pbLnMPL.exe
  C:\Windows\System\pbLnMPL.exe
  2⤵
  PID:436
- C:\Windows\System\CjhmrZk.exe
  C:\Windows\System\CjhmrZk.exe
  2⤵
  PID:15176
- C:\Windows\System\toDUssC.exe
  C:\Windows\System\toDUssC.exe
  2⤵
  PID:15204
- C:\Windows\System\XkVsHTz.exe
  C:\Windows\System\XkVsHTz.exe
  2⤵
  PID:14740
- C:\Windows\System\aLmpfMx.exe
  C:\Windows\System\aLmpfMx.exe
  2⤵
  PID:3012
- C:\Windows\System\bSbCMbq.exe
  C:\Windows\System\bSbCMbq.exe
  2⤵
  PID:14576
- C:\Windows\System\CmMKGao.exe
  C:\Windows\System\CmMKGao.exe
  2⤵
  PID:14572
- C:\Windows\System\KNpLkHX.exe
  C:\Windows\System\KNpLkHX.exe
  2⤵
  PID:10668
- C:\Windows\System\AhoxRit.exe
  C:\Windows\System\AhoxRit.exe
  2⤵
  PID:8324
- C:\Windows\System\zkujugE.exe
  C:\Windows\System\zkujugE.exe
  2⤵
  PID:10540
- C:\Windows\System\JtFZToI.exe
  C:\Windows\System\JtFZToI.exe
  2⤵
  PID:11020
- C:\Windows\System\QtCodkn.exe
  C:\Windows\System\QtCodkn.exe
  2⤵
  PID:10656
- C:\Windows\System\pyZEikf.exe
  C:\Windows\System\pyZEikf.exe
  2⤵
  PID:5820
- C:\Windows\System\ffCyODc.exe
  C:\Windows\System\ffCyODc.exe
  2⤵
  PID:5520
- C:\Windows\System\yjcWEKy.exe
  C:\Windows\System\yjcWEKy.exe
  2⤵
  PID:5524
- C:\Windows\System\GTaGTiV.exe
  C:\Windows\System\GTaGTiV.exe
  2⤵
  PID:3852
- C:\Windows\System\DLcYMmX.exe
  C:\Windows\System\DLcYMmX.exe
  2⤵
  PID:14728
- C:\Windows\System\IVTCmZR.exe
  C:\Windows\System\IVTCmZR.exe
  2⤵
  PID:5608
- C:\Windows\System\aSSufqX.exe
  C:\Windows\System\aSSufqX.exe
  2⤵
  PID:5600
- C:\Windows\System\JPfLbXF.exe
  C:\Windows\System\JPfLbXF.exe
  2⤵
  PID:5832
- C:\Windows\System\bEIpNhB.exe
  C:\Windows\System\bEIpNhB.exe
  2⤵
  PID:432
- C:\Windows\System\jFrKyDj.exe
  C:\Windows\System\jFrKyDj.exe
  2⤵
  PID:14392
- C:\Windows\System\vrnauPw.exe
  C:\Windows\System\vrnauPw.exe
  2⤵
  PID:5240
- C:\Windows\System\wEcJlQN.exe
  C:\Windows\System\wEcJlQN.exe
  2⤵
  PID:5572
- C:\Windows\System\eBbroNg.exe
  C:\Windows\System\eBbroNg.exe
  2⤵
  PID:5364
- C:\Windows\System\rcNBBZq.exe
  C:\Windows\System\rcNBBZq.exe
  2⤵
  PID:5228
- C:\Windows\System\nflImSI.exe
  C:\Windows\System\nflImSI.exe
  2⤵
  PID:5636
- C:\Windows\System\uzcqqUu.exe
  C:\Windows\System\uzcqqUu.exe
  2⤵
  PID:14860
- C:\Windows\System\RNOBCbP.exe
  C:\Windows\System\RNOBCbP.exe
  2⤵
  PID:5296
- C:\Windows\System\TlbQgyZ.exe
  C:\Windows\System\TlbQgyZ.exe
  2⤵
  PID:5020
- C:\Windows\System\wMQvTOj.exe
  C:\Windows\System\wMQvTOj.exe
  2⤵
  PID:5992
- C:\Windows\System\biWSbyR.exe
  C:\Windows\System\biWSbyR.exe
  2⤵
  PID:920
- C:\Windows\System\EiMCbLi.exe
  C:\Windows\System\EiMCbLi.exe
  2⤵
  PID:3720
- C:\Windows\System\aGDcLEi.exe
  C:\Windows\System\aGDcLEi.exe
  2⤵
  PID:5980
- C:\Windows\System\KuuPlzN.exe
  C:\Windows\System\KuuPlzN.exe
  2⤵
  PID:6304
- C:\Windows\System\lrruYkw.exe
  C:\Windows\System\lrruYkw.exe
  2⤵
  PID:6316
- C:\Windows\System\bOiYPaU.exe
  C:\Windows\System\bOiYPaU.exe
  2⤵
  PID:6320
- C:\Windows\System\tyVSGme.exe
  C:\Windows\System\tyVSGme.exe
  2⤵
  PID:6176
- C:\Windows\System\KEqVaEd.exe
  C:\Windows\System\KEqVaEd.exe
  2⤵
  PID:15256
- C:\Windows\System\NrztxRO.exe
  C:\Windows\System\NrztxRO.exe
  2⤵
  PID:15288
- C:\Windows\System\tQFYTUL.exe
  C:\Windows\System\tQFYTUL.exe
  2⤵
  PID:15320
- C:\Windows\System\VdowjeG.exe
  C:\Windows\System\VdowjeG.exe
  2⤵
  PID:4780
- C:\Windows\System\oukEHme.exe
  C:\Windows\System\oukEHme.exe
  2⤵
  PID:6212
- C:\Windows\System\XlehtZU.exe
  C:\Windows\System\XlehtZU.exe
  2⤵
  PID:15336
- C:\Windows\System\btCwWjg.exe
  C:\Windows\System\btCwWjg.exe
  2⤵
  PID:2104
- C:\Windows\System\gcLYnJN.exe
  C:\Windows\System\gcLYnJN.exe
  2⤵
  PID:6256
- C:\Windows\System\mIeDLsg.exe
  C:\Windows\System\mIeDLsg.exe
  2⤵
  PID:14948
- C:\Windows\System\OfmZcvP.exe
  C:\Windows\System\OfmZcvP.exe
  2⤵
  PID:6308
- C:\Windows\System\Ltytggc.exe
  C:\Windows\System\Ltytggc.exe
  2⤵
  PID:8740
- C:\Windows\System\LgyDpoo.exe
  C:\Windows\System\LgyDpoo.exe
  2⤵
  PID:14820
- C:\Windows\System\zXXLrad.exe
  C:\Windows\System\zXXLrad.exe
  2⤵
  PID:14348
- C:\Windows\System\lxGyaUV.exe
  C:\Windows\System\lxGyaUV.exe
  2⤵
  PID:15080
- C:\Windows\System\SDYYWha.exe
  C:\Windows\System\SDYYWha.exe
  2⤵
  PID:6392
- C:\Windows\System\sGHVFIZ.exe
  C:\Windows\System\sGHVFIZ.exe
  2⤵
  PID:6408
- C:\Windows\System\WOyjRJq.exe
  C:\Windows\System\WOyjRJq.exe
  2⤵
  PID:6728
- C:\Windows\System\VIBBHCR.exe
  C:\Windows\System\VIBBHCR.exe
  2⤵
  PID:14552
- C:\Windows\System\PJsKmrD.exe
  C:\Windows\System\PJsKmrD.exe
  2⤵
  PID:3232
- C:\Windows\System\vDysYnM.exe
  C:\Windows\System\vDysYnM.exe
  2⤵
  PID:14668
- C:\Windows\System\QERlzGX.exe
  C:\Windows\System\QERlzGX.exe
  2⤵
  PID:3144
- C:\Windows\System\INCbYlL.exe
  C:\Windows\System\INCbYlL.exe
  2⤵
  PID:6424
- C:\Windows\System\njgJuMD.exe
  C:\Windows\System\njgJuMD.exe
  2⤵
  PID:6432
- C:\Windows\System\vMyIset.exe
  C:\Windows\System\vMyIset.exe
  2⤵
  PID:6776
- C:\Windows\System\Awowaxj.exe
  C:\Windows\System\Awowaxj.exe
  2⤵
  PID:3748
- C:\Windows\System\EBNcSIL.exe
  C:\Windows\System\EBNcSIL.exe
  2⤵
  PID:14652
- C:\Windows\System\BUmViSw.exe
  C:\Windows\System\BUmViSw.exe
  2⤵
  PID:6768
- C:\Windows\System\jowkuHo.exe
  C:\Windows\System\jowkuHo.exe
  2⤵
  PID:5480
- C:\Windows\System\HnaSouL.exe
  C:\Windows\System\HnaSouL.exe
  2⤵
  PID:3920
- C:\Windows\System\mmekrVI.exe
  C:\Windows\System\mmekrVI.exe
  2⤵
  PID:6116
- C:\Windows\System\TlUXJUB.exe
  C:\Windows\System\TlUXJUB.exe
  2⤵
  PID:3704
- C:\Windows\System\hZvJwTb.exe
  C:\Windows\System\hZvJwTb.exe
  2⤵
  PID:4644
- C:\Windows\System\ydipduS.exe
  C:\Windows\System\ydipduS.exe
  2⤵
  PID:4988
- C:\Windows\System\WQTCouF.exe
  C:\Windows\System\WQTCouF.exe
  2⤵
  PID:14828
- C:\Windows\System\WYKiBFC.exe
  C:\Windows\System\WYKiBFC.exe
  2⤵
  PID:468
- C:\Windows\System\AfMKJCy.exe
  C:\Windows\System\AfMKJCy.exe
  2⤵
  PID:2124
- C:\Windows\System\HkVhqxc.exe
  C:\Windows\System\HkVhqxc.exe
  2⤵
  PID:5156
- C:\Windows\System\gQdOyNc.exe
  C:\Windows\System\gQdOyNc.exe
  2⤵
  PID:6896
- C:\Windows\System\lWpzRol.exe
  C:\Windows\System\lWpzRol.exe
  2⤵
  PID:7104
- C:\Windows\System\gIFHOTu.exe
  C:\Windows\System\gIFHOTu.exe
  2⤵
  PID:6912
- C:\Windows\System\WwoqqHg.exe
  C:\Windows\System\WwoqqHg.exe
  2⤵
  PID:6012
- C:\Windows\System\DgeHilM.exe
  C:\Windows\System\DgeHilM.exe
  2⤵
  PID:7116
- C:\Windows\System\cteAmHh.exe
  C:\Windows\System\cteAmHh.exe
  2⤵
  PID:4696
- C:\Windows\System\NxSBojz.exe
  C:\Windows\System\NxSBojz.exe
  2⤵
  PID:1944
- C:\Windows\System\IJMjGdl.exe
  C:\Windows\System\IJMjGdl.exe
  2⤵
  PID:3872
- C:\Windows\System\GVkDrYy.exe
  C:\Windows\System\GVkDrYy.exe
  2⤵
  PID:14760
- C:\Windows\System\HIkeIbB.exe
  C:\Windows\System\HIkeIbB.exe
  2⤵
  PID:5328
- C:\Windows\System\IzsqXLj.exe
  C:\Windows\System\IzsqXLj.exe
  2⤵
  PID:14836
- C:\Windows\System\NelStwn.exe
  C:\Windows\System\NelStwn.exe
  2⤵
  PID:15304
- C:\Windows\System\zDKbNwy.exe
  C:\Windows\System\zDKbNwy.exe
  2⤵
  PID:14900
- C:\Windows\System\ntDmlip.exe
  C:\Windows\System\ntDmlip.exe
  2⤵
  PID:1648
- C:\Windows\System\bUQOddW.exe
  C:\Windows\System\bUQOddW.exe
  2⤵
  PID:1344
- C:\Windows\System\eURXIJN.exe
  C:\Windows\System\eURXIJN.exe
  2⤵
  PID:15348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:9068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aa22nk4g.xnz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ALxUCml.exe

Filesize
1.8MB

MD5
dd0507617d84af2871eb11b57e25d8c2

SHA1
e6969b38f67f6ccd550cd00ba24d7cb11d55f77a

SHA256
62bae4553e7e67f349a1297f33a6a1bc47681dbcb70afc834086760abf5e0243

SHA512
a2b4bbb4f678e329c498eca7c8fa71f7b4eab8c895ff11aa26354537c084630d143811e043b7ef3b7b651ad7748b176bb685fa849de9f935abec7a771a5de46e

Download Submit
C:\Windows\System\AlRAMhM.exe

Filesize
1.8MB

MD5
6f7bf3c005c5a147503ce83be2e5cc8c

SHA1
304d938b2f690e5460ff59a3afc9407848cba626

SHA256
d80019cc69053ca485ef1d6adf8ffc570d6d370d9e4b4a2dabc84d577793a82c

SHA512
b51d334b8818335daa6469dd9e5ccdb3a625f44065073cf7d1a8ce6eb02284648b7cbb2ce4fbb3a49bb84dd7127934b91c529f45620af3d06727c6db03ead66f

Download Submit
C:\Windows\System\DanolTJ.exe

Filesize
1.8MB

MD5
50d3d61f9e13e57ebc8026dee2dc1c80

SHA1
1716724755b8382b1ac842c972adb04fdabd4035

SHA256
d6d72beabe0dd4c3587071bbcb1f45e5816d54d9b5b1a5960b59989fb827d47c

SHA512
0df820aca88f8c5b816fe5ec689caf7970b8a0569c991e4415742c57ac6eccf45b00aa72e643eb2f5863c13f52ecb9cbc8d2e1fbee6fb03eb798850d759dfcdc

Download Submit
C:\Windows\System\EViiNca.exe

Filesize
1.8MB

MD5
1a3b709af1046118462ace372ef48320

SHA1
0a87d780bed1deda4dcbc4ee2a1ccd5cfd945007

SHA256
1482b4d1cb0e2f790e7d3be8815815dc7eb597c8e84dca7ff3d2f25b07dbb1d6

SHA512
940957b96dc2262b2e3b5a5c8bc95db8fb19dc84d6af1a3cd9e85f9aaa9fabd35487117933bbb2f4e1b52ddca9ac792d7186c63fce70bf7d9874bb417393ba07

Download Submit
C:\Windows\System\EYJPhLM.exe

Filesize
8B

MD5
b849dbcfb08ac877290add49e99178d8

SHA1
e96fe151173fd43a6d834740f52198931a388bf9

SHA256
a924546cb05e0d111a25fcb8e7f183457926abae319588a0b32ef2b05d457163

SHA512
8b4a01f83882b6e5a7d86633f11ab4b0beb94666eb64954ae2be067858515a1f39d026e62a6fa7cb4c876187b4f3fb07031095ae0126acf1cb139bd0d21d7863

Download Submit
C:\Windows\System\EgOylCX.exe

Filesize
1.8MB

MD5
3ef9713dd194b72733db88c186035401

SHA1
59bfb39ba0be5021c857a3c32abb10464340c8ba

SHA256
ab9fda1f767901dd199a1e75e6617882de4854d68bff574ddf2e43c22f1bb212

SHA512
f7c76134ba1b5bfd8353175e04c41f4a226da044d4cc24ff2e473ee3cc680a7171028c8db6a2136f6c6aac8bc52cb65ebf00021c7f88d8066f15859cc4826a9c

Download Submit
C:\Windows\System\EwdcuxM.exe

Filesize
1.8MB

MD5
cc8a9112f6b5df6c3f515b3a5ab0570f

SHA1
490c60618b82aca28118b93d6f49e84ec0e77b42

SHA256
4d6519a42b31d6b46b3b5b3c903f55f9da0809745df2c94931822cd2ce0a122a

SHA512
d3f50adf4034f3dcafddccde197651b63a0efe066b124d3782d799282f883b965f9a2fd9a257ddbcbe2309564bd52a2925e4733b8232b6168ec75c4787cf680d

Download Submit
C:\Windows\System\FznsjSl.exe

Filesize
1.8MB

MD5
09fa8d3f4a01fa240a59560cbdcee412

SHA1
f60aaf072aabc0dc4fdb9450b6c964d44809ad68

SHA256
df51186d4b2a217675dd3316e897ac2e218968f49f6571ec6070fbf622c39211

SHA512
74f5040a99a4b37644184d2b1c77ab6ca3b2f895cf6315b60c9a4b947dfc76b647bf5005d04668f3f33eef6c922b933354605d37a71ce32fe5631719b96b4fa1

Download Submit
C:\Windows\System\HdwtUoS.exe

Filesize
1.8MB

MD5
56737b7a331e329b9336daf39f0abf9d

SHA1
5f0c83ea04b1db8dbde4e9f80b5f1e17e505dcfb

SHA256
0680665eac0d3eb9a323dcc6379d49f5f12930c6cfe9121800285df739517173

SHA512
b4ca86dbf9eadbc96d8725b84456763f04d2ae9403dc711832b37c13ddae040ad392291854a7d0edb3aefb8e821a72b3e9c6cba0c47b18ee3ce221bdd3e7daae

Download Submit
C:\Windows\System\LomXyYp.exe

Filesize
1.8MB

MD5
acc167bb6a4a74d3af4b94b73fb9de47

SHA1
c67203af51fb068a91f4e12d59572c006d4dd502

SHA256
b6747d03cf0167480883eec3fa7b7b58de558efc53724cc292c5ed2293f7a0c9

SHA512
b3675c156842b6a38ef06c675f7c0c3aa701b76f465cb9bf44489af48ec9e2982eb68a9e99d11253add155201d6d529f20975d74a15b3c5c4849a953ac559ddb

Download Submit
C:\Windows\System\OYhhlDQ.exe

Filesize
1.8MB

MD5
a636801e2a4192da3a34e9472cc76257

SHA1
3132622ca1ce0e0075ca2a29bf9def53698b04cb

SHA256
2f897ddd394485d0fc68b41fe19055bff798c07047d72369aea315a0bfaccd46

SHA512
004b9c89d72fa6ce073781fb1f166bed0bac65d8e3be7d4fca1ae324e588b0c3b146f40a64ce3cfdae0810bdcbce39362d6b6b8f7d473873bc0bf0a45c8ee6e9

Download Submit
C:\Windows\System\PeXZcro.exe

Filesize
18B

MD5
9ac80bd3676a9afcd1b2b87ad503ff74

SHA1
9450a6252bf5581c786da39e335ef6daa84b2b14

SHA256
139bf5b4b00f1d1c9f3d4e09a18af03fd56e363a9ac57feac70ae54041e87fda

SHA512
226b7fdaf3841f974f5dc515ea308559528af6f1b3b8dde2492efb31cf145d9bc78df64f1a51b99bf63428b956e0222e2726ceae7a82f99d50ed082ea9487262

Download Submit
C:\Windows\System\TnoXmvy.exe

Filesize
1.8MB

MD5
372d73389f5a1593993866e13a103776

SHA1
ac9893a0bec509767ce9992a97738ff8910a5a6b

SHA256
7aa72cc09f1cdb846801eecc93293e481e07dacd332079f09c7612c5d9063892

SHA512
a292d9c6fb7e30e92b2d8d669b61bdbec783691135a40f1cbb772a22555d42e4836c825f127f18932eb6bad6b5f40cad0ffe1b91739a928b525b2422896bfd1e

Download Submit
C:\Windows\System\XiOEwPD.exe

Filesize
1.8MB

MD5
37c12f3e1a9ad217d6ee693ad761ae10

SHA1
17b72c3dc45932527db13288c2077302b93c528e

SHA256
e63dc7d2ca29887d060c5328f64862f698a349c7385e5816cff05460f908b9d5

SHA512
4447cc19b745cc733e6ab42b986332024031dc6a00a3a6ca61c6a0c20bbba5167f26a0226149cf7b1d4870bb5b30565fe0b286c39672e4152585d2fa68177712

Download Submit
C:\Windows\System\ZhXXjte.exe

Filesize
1.8MB

MD5
8a0979a0052c8180d6ecd6b14575f6e3

SHA1
e046a3b9523ef5aae9b73775ed13ed02b7ccfd6c

SHA256
ca4ff71b7e9bef7678bcbda7de5d743bb00f412d123955519023bc71da330561

SHA512
34a707a1af43166f4899807af8cf73d132f0a4aadf8d048263e3a37474299a5e88cd14acaf8ae2398fd40f23af68826aa6505c5f7937506b8ae6a8ce0fe87995

Download Submit
C:\Windows\System\bQUzvBY.exe

Filesize
1.8MB

MD5
9080fd1c27871ff2e9bb40a173dc0694

SHA1
cea3b7143d72bea495356c41122907ade3f853be

SHA256
278d4d720525ae35fe192602d20dc4a0fda2bff430b3f9972364c71a101ca2ae

SHA512
ec5eb7fec9733b5bfab179d50e960f4aa8b37cc292e9fee269ec6b98da93cf4ce742b462f710273a5a141934809d5aeb2eec3dffcbf610cdd118e722dbc37012

Download Submit
C:\Windows\System\cmlGSYg.exe

Filesize
1.8MB

MD5
748b7fa2900a154b4e67e11ace7de141

SHA1
f7c0118bd1f24948e649f25f1d78b61793584ace

SHA256
94fec3c774b5d94e191b5f902fc7977f223b7a07c61a236efd93061aaff127db

SHA512
0edbc8d85f14b6592fb6877d46c33b5d26cdd60147093d42f10fe301104dbceaedd7877894ae4a62dfd69fd30f7e3ba0077c55e0741706a2dd73ffa874864850

Download Submit
C:\Windows\System\eluelRS.exe

Filesize
1.8MB

MD5
1b8f7e0fb4f9c97eca81fbd02bb65a25

SHA1
ebb3e6ec19c5399e3acee47e1ebe50c0dd8e27b4

SHA256
7a29b9bb7b43b513b70bdbb2933af2dd0f03657289e720715c5a0cbf205e168e

SHA512
d38495bc64833f05032e84333476262524cfb0cbe85e122fccc630da400d5b3cdc4ff0569c7fc6815f5cf8bc82bd8ba068983eb39af0bb1c77ae84499c730d9e

Download Submit
C:\Windows\System\eqIwfzc.exe

Filesize
1.8MB

MD5
a3bebfc8639fa54e9198d94efd33b01d

SHA1
d2c2743e776cbbfd3c8f5cdad5afd571abc24d6d

SHA256
fbb2cb97e6570ac257bca2a0813ef5367a5366221a3f7bd453ef32d6866d66d6

SHA512
ad1990ebe1cc24799407c415781726ddf8a5d884aa8a901f6d5b806d163d7375f217d43d67ccbfd8048962f776705322a97492ca4dc7e03c3c52317278905965

Download Submit
C:\Windows\System\ifEnGiW.exe

Filesize
1.8MB

MD5
98208bcd803bc1eda28174b6f258ebfb

SHA1
e106a4563dabd3b1e344e478e630fe328321289d

SHA256
0f04927fe57768c65e5612f9bc331f9df987eacde1855a8b5f660566e243de69

SHA512
14a35ec87fba45db132e42f5d595d733f7723b885260028be91e57f05673d5758adcdeb65ef6d215617787af402bafb264033572ade4433c0a6e34d0251b0615

Download Submit
C:\Windows\System\jSqWCJV.exe

Filesize
1.8MB

MD5
25e3610731940e820d8f97d2e7e38c3a

SHA1
ebc79b37caedc9bf78323dcc8d883522efd9b573

SHA256
51f8f66c4fdb5f8d2ae408eed711c5a450b33cda125be89137c47dec40a93238

SHA512
c533f19cce4ac403962136f2f63fceb5531bad1690f2c752cdbc5e225b298d4856e15127970a936d1030a61de55022738e63c6e430447b1795f41e3785f11aaa

Download Submit
C:\Windows\System\jbOdXiC.exe

Filesize
1.8MB

MD5
25b06106b6e80f74a9b6a3ccc97ed982

SHA1
13d5b891c80f4d095e33843cd1922bfb9939c8d5

SHA256
05bdbe02868d1a424155111dc0778691992fc6d91f215f121a025551e9245772

SHA512
7351fb703493d40f09e7528565e6dc3ef995b65d05f8686ce34d95e4a3f864947af01c6c9eb142088cdb3e7102e141c753026f9fc0465decb439d3aa04a3ebf0

Download Submit
C:\Windows\System\jiQPHce.exe

Filesize
1.8MB

MD5
dbece00f961f8ca367c6277f82786ea8

SHA1
16536e9a15233f265892a98f21782ce9331af16b

SHA256
215dbdeb7e24467b68c455335607bc3ec8438fc046f3691ef210074df0c64877

SHA512
235e32781770ad496abeff456df4fd548cf4bc0b26a9a40d4772d321dcffca502dbb72d3919695ab32ca89b8955e1b8d3776136dcef4db639abce4f95062e42e

Download Submit
C:\Windows\System\mIXyNWF.exe

Filesize
1.8MB

MD5
6ad9f29d29680db8143de6270b08dc5b

SHA1
b2ebbba9707ce3bef318b30af787c8ad3854fbac

SHA256
786d98b1dd46def1aa9b1f61a1320c10f831b82e1ea0af2f038d46801a12daa6

SHA512
7f56ddf231b5527594f4daa0cfdfe9c085dc83d1f7b4c85e3143c605b1191abcebb08bf451231ea9fc6a057a9aebc8cb18198b7aa19d2d2ef9759f06bb3ab317

Download Submit
C:\Windows\System\mPPMNRB.exe

Filesize
1.8MB

MD5
eae5d18c791fe46ba633e07248fe1256

SHA1
8f7e9467a52e6a0b107c3acf6bf974cef9e965ca

SHA256
cd73852582f6af86edcdbb44661e14551b9ed31b7f15f72d21ba1bec2eda5a32

SHA512
88d4e24b99784e33a69a1a963d4f30024427ac6e1653d63029c8d519408c952217495600e33f0bbcad85c290c202476af6c3685343d957a718bc90ef0e6ea509

Download Submit
C:\Windows\System\pVXqIuz.exe

Filesize
1.8MB

MD5
5a2d96c2464a2fdf91f2566448da9d54

SHA1
e4edc03806561385cc6cfd91daff2e88641ffccd

SHA256
b7bd61e3cd31d403018510cef918209c19c246276bac5766be02eea410ce00d8

SHA512
f9b537d13bc51776e2e6b3714327ac586bac07438bf9596ea3b39776c5030954d3c1a56e9b2708b9d8c28c857a33fcc65035a57b1e0c08596b4e1ddb26723e04

Download Submit
C:\Windows\System\pyztgKK.exe

Filesize
1.8MB

MD5
fea9a360d97146797ba0cf080de87b5f

SHA1
287b85786ae8997ac6b011192763022855f6b888

SHA256
6db02133eb8ba3c97e85c682a15b3f6d9de9b41d16091d8c269fb1bfb7671dc2

SHA512
69f47b0629a62eab4d4aed52e7b248519340c1d797f44b5adb3e21cb452fd540aac987b0c15d2587b9d474f97c3d0c729631f4e4667bac16b06b4246ee163012

Download Submit
C:\Windows\System\qrnNrbI.exe

Filesize
1.8MB

MD5
e572175cb36269605034850a325b386a

SHA1
f8e002b4739fdf4fe10fd07774ab454c94fccdad

SHA256
e44452530f8ab0c1ca6b005af9b532d91d0f4221c09a0ab1e178c268407ffebb

SHA512
12e68fa8a937651b0b885924dd9de9e0519e35e1a44e8c92604a09682cdfe1bb12edb9aec2f9419c34b725ee131f574efccd0bb7ae3d5ad07fb050eddb6f1ae2

Download Submit
C:\Windows\System\rEtmlLC.exe

Filesize
1.8MB

MD5
3f4be379c6b50df318cba6298ccbf2cc

SHA1
3341d60039ce95137b676d9cfdd676d7952befaa

SHA256
d6322821860d483bfec8e5d4c610a6471af2328097e861cbaf4c136390d9d9b3

SHA512
52d8c612cd8a6dc8d2a4c307ae8dc092889394786df4506a4bb62e0a18dfed131fd76f5b42e394ecdcc9344c0b3c5de0def4e1224687991c8d2fa06898ce7404

Download Submit
C:\Windows\System\sgWhXUq.exe

Filesize
1.8MB

MD5
06e0457d8aa0030582eea39f6172062b

SHA1
bccb16d5785b0e385eff06dcbe538b6ab433b53c

SHA256
b4890fc5891cfdef2fb64d6bde871f6ce1d577c5942a9fadf240e7b5b7b19fd1

SHA512
af46fd047a507922597c7156098ca66a1d399aa7d89fb49323178f7fdd5a7f5106db9beb2bc5ae0398485f132513ce712481d76dc72e8315c33b745a66946444

Download Submit
C:\Windows\System\tAauSJU.exe

Filesize
1.8MB

MD5
dbceb1fb3b0a40db605a954461abc91b

SHA1
527319aa3666ae7c54dc5502cad9bc4444ac53f3

SHA256
116ac6ab37ef66d0b7e7f07f5029bbedff8069021facc7d73146c4abbcb19895

SHA512
4af13ba20562c1cfd0c0ada1b1f1d92f69a85019bc9bdcb6e882e4d6259857063e7aeef7826102e713776067c22b17d5503eecbe76849520e8eb7111823b4ad5

Download Submit
C:\Windows\System\tKxTUZr.exe

Filesize
1.8MB

MD5
55586550f0f41e59b245027725c86f41

SHA1
6333f0bc481c5f9452a15d7c499f29e879a92719

SHA256
56f43f8711c86f8c5664b5bc025109e98f2612bf09249a662ea4716750df6d29

SHA512
167a133e254fcbd6d99de5990e90b6ad68e3894b22a04d1e47723d6bb2856d45abb821d9077582614cca47e21eeb02866e217914b1e4cbb624b329689c5185de

Download Submit
C:\Windows\System\vBjOVDf.exe

Filesize
1.8MB

MD5
0e65db7623f422acb8eb69fbfb3d789a

SHA1
94ed519e55a81f5cfaa329a9b432d4fead620e8d

SHA256
b99d046abc2dc3253e3efd5d20253b83688d97e5506331ecaa9b5c60374023a3

SHA512
9ad679a8d674d4f5aba0f73b31d4f6493bc248a30e14208d086c05082e1f5089c03f40ae07d8ec7d873d0c455980ef3d87e9205ca23bf0e89faf393eec98145b

Download Submit
C:\Windows\System\wXFlZAA.exe

Filesize
1.8MB

MD5
3fd15d97017491bcbcedc4749f37efa4

SHA1
f1f938984aebddc26e1635a8bb3879ffd86a3b04

SHA256
12ffd09255545b0c100f6011752c3cc9d75cc3f418039dec1c56ba44d0860728

SHA512
2029eb930d04e6545104a31c82edb715535e4fca11b8d9296ad4816c68ec09d7d6ab827c8be5c7de5dd857b6e53788d4b8ea12b8194d09d37f00d7357905e896

Download Submit
C:\Windows\System\wYzbrZN.exe

Filesize
1.8MB

MD5
0d4692e9f854552cbe8c94858c09c8a8

SHA1
1b1dba29d28f8145410d51711a0ef6c22aacb4e6

SHA256
b57adf62bdfc3ff9d57ffad5911c277e6ba3b8cab6b7d4e0c67370f7bd25e8a9

SHA512
1810d06be386b2734211174e9a80fe0579f96993cc336a077cbb5a1e604caa813ca8093feb97f5a22d7a93d1d76606b9625e219414674f0cc274385efd3d3acc

Download Submit
C:\Windows\System\woGDpbg.exe

Filesize
1.8MB

MD5
012ebd4b65c601899f47631d045d0cfd

SHA1
0293ff849e120e81cfc3c0ee29ab469a1da70579

SHA256
635a06cd94801efe0c5f3b07b6a49301048de6a5712973d932b7dd497d2ce4fc

SHA512
d7bc0f9426ee3b90ca0e17267dc59275a86df1e07c412de09ad60c9fb8706fef381b7843e4a772342e16dd9df276fc4d40deec710be50735a3e882df840ce00e

Download Submit
C:\Windows\System\xWFSlqk.exe

Filesize
1.8MB

MD5
e65b9eeb8480546dad293222e722d26b

SHA1
29129a70c63117e04b67f86f623e0f21396a48a5

SHA256
ec747c94d13844f46d262d4c94b223f0314912bed58d3180b4384e28392bebdc

SHA512
f2dbe685480d41e408bf7df540f0a964b4c0454b5c244d11a6c39dd519a706640f41f9a1181139462c6128b8494319b49d7b9c6cc6d4512dd14a7d6ff1279fc6

Download Submit
C:\Windows\System\zqdPQim.exe

Filesize
1.8MB

MD5
305c7acd645fcbbac85fbc4c3632482c

SHA1
c533a7a1f183129288a10c564dc9ff6730077300

SHA256
043d072d4b6a8e07834951a06d9e9a109293ba20fa442bb44048f6846e3119f4

SHA512
75cc6a3ffc60599e625a210ab9d346a90ccd2db95fac291cdc3ede09e29f1c87fff305e523bbceaf9e67168b018fce6c97d1b12ae3aadcf35b31057de7355f1e

Download Submit
memory/372-5002-0x00007FF674AF0000-0x00007FF674EE2000-memory.dmp

Filesize
3.9MB

Download
memory/372-373-0x00007FF674AF0000-0x00007FF674EE2000-memory.dmp

Filesize
3.9MB

Download
memory/464-1-0x000002BD1A680000-0x000002BD1A690000-memory.dmp

Filesize
64KB

Download
memory/464-0-0x00007FF65D4E0000-0x00007FF65D8D2000-memory.dmp

Filesize
3.9MB

Download
memory/1036-370-0x00007FF78B2E0000-0x00007FF78B6D2000-memory.dmp

Filesize
3.9MB

Download
memory/1036-5072-0x00007FF78B2E0000-0x00007FF78B6D2000-memory.dmp

Filesize
3.9MB

Download
memory/1044-19-0x00007FF6C24C0000-0x00007FF6C28B2000-memory.dmp

Filesize
3.9MB

Download
memory/1192-174-0x00007FF7DA390000-0x00007FF7DA782000-memory.dmp

Filesize
3.9MB

Download
memory/1192-5039-0x00007FF7DA390000-0x00007FF7DA782000-memory.dmp

Filesize
3.9MB

Download
memory/1200-375-0x00007FF678660000-0x00007FF678A52000-memory.dmp

Filesize
3.9MB

Download
memory/1200-5064-0x00007FF678660000-0x00007FF678A52000-memory.dmp

Filesize
3.9MB

Download
memory/1500-5044-0x00007FF74AF10000-0x00007FF74B302000-memory.dmp

Filesize
3.9MB

Download
memory/1500-212-0x00007FF74AF10000-0x00007FF74B302000-memory.dmp

Filesize
3.9MB

Download
memory/1692-4935-0x00007FF6560E0000-0x00007FF6564D2000-memory.dmp

Filesize
3.9MB

Download
memory/1692-114-0x00007FF6560E0000-0x00007FF6564D2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-5093-0x00007FF66D720000-0x00007FF66DB12000-memory.dmp

Filesize
3.9MB

Download
memory/2468-302-0x00007FF66D720000-0x00007FF66DB12000-memory.dmp

Filesize
3.9MB

Download
memory/2824-5037-0x00007FF692C00000-0x00007FF692FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-296-0x00007FF692C00000-0x00007FF692FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-395-0x0000020D30EC0000-0x0000020D30EE2000-memory.dmp

Filesize
136KB

Download
memory/3000-329-0x00007FF7E2E40000-0x00007FF7E3232000-memory.dmp

Filesize
3.9MB

Download
memory/3000-5051-0x00007FF7E2E40000-0x00007FF7E3232000-memory.dmp

Filesize
3.9MB

Download
memory/3224-5008-0x00007FF709C40000-0x00007FF70A032000-memory.dmp

Filesize
3.9MB

Download
memory/3224-257-0x00007FF709C40000-0x00007FF70A032000-memory.dmp

Filesize
3.9MB

Download
memory/3236-249-0x00007FF7A6330000-0x00007FF7A6722000-memory.dmp

Filesize
3.9MB

Download
memory/3236-5047-0x00007FF7A6330000-0x00007FF7A6722000-memory.dmp

Filesize
3.9MB

Download
memory/3504-139-0x00007FF65E3C0000-0x00007FF65E7B2000-memory.dmp

Filesize
3.9MB

Download
memory/3504-5016-0x00007FF65E3C0000-0x00007FF65E7B2000-memory.dmp

Filesize
3.9MB

Download
memory/3796-330-0x00007FF75ECA0000-0x00007FF75F092000-memory.dmp

Filesize
3.9MB

Download
memory/3796-5055-0x00007FF75ECA0000-0x00007FF75F092000-memory.dmp

Filesize
3.9MB

Download
memory/4368-371-0x00007FF61F560000-0x00007FF61F952000-memory.dmp

Filesize
3.9MB

Download
memory/4368-5075-0x00007FF61F560000-0x00007FF61F952000-memory.dmp

Filesize
3.9MB

Download
memory/4428-372-0x00007FF7D6DB0000-0x00007FF7D71A2000-memory.dmp

Filesize
3.9MB

Download
memory/4428-5106-0x00007FF7D6DB0000-0x00007FF7D71A2000-memory.dmp

Filesize
3.9MB

Download
memory/4436-164-0x00007FF66D900000-0x00007FF66DCF2000-memory.dmp

Filesize
3.9MB

Download
memory/4436-5013-0x00007FF66D900000-0x00007FF66DCF2000-memory.dmp

Filesize
3.9MB

Download
memory/4472-53-0x00007FF779280000-0x00007FF779672000-memory.dmp

Filesize
3.9MB

Download
memory/4700-33-0x00007FF7F34A0000-0x00007FF7F3892000-memory.dmp

Filesize
3.9MB

Download
memory/4700-4465-0x00007FF7F34A0000-0x00007FF7F3892000-memory.dmp

Filesize
3.9MB

Download
memory/4736-5058-0x00007FF7797A0000-0x00007FF779B92000-memory.dmp

Filesize
3.9MB

Download
memory/4736-374-0x00007FF7797A0000-0x00007FF779B92000-memory.dmp

Filesize
3.9MB

Download
memory/4804-5020-0x00007FF69F530000-0x00007FF69F922000-memory.dmp

Filesize
3.9MB

Download
memory/4804-70-0x00007FF69F530000-0x00007FF69F922000-memory.dmp

Filesize
3.9MB

Download
memory/4804-4932-0x00007FF69F530000-0x00007FF69F922000-memory.dmp

Filesize
3.9MB

Download
memory/4880-5077-0x00007FF62CCE0000-0x00007FF62D0D2000-memory.dmp

Filesize
3.9MB

Download
memory/4880-363-0x00007FF62CCE0000-0x00007FF62D0D2000-memory.dmp

Filesize
3.9MB

Download
memory/4896-39-0x00007FF766730000-0x00007FF766B22000-memory.dmp

Filesize
3.9MB

Download
memory/4912-5032-0x00007FF79FC70000-0x00007FF7A0062000-memory.dmp

Filesize
3.9MB

Download
memory/4912-223-0x00007FF79FC70000-0x00007FF7A0062000-memory.dmp

Filesize
3.9MB

Download