xmrig | 8acda3d83fdf853a2911a2557a9a16a29d26d8b58cc6643518343f3c0793ef20

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 12:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
Size

2.2MB
MD5

09c4785e35b336cc95b697d5b90d8375
SHA1

d9b9a042b9b0ead6b801e453c41577da21a9a84c
SHA256

8acda3d83fdf853a2911a2557a9a16a29d26d8b58cc6643518343f3c0793ef20
SHA512

150e06d46a37c235d23b1c5a8683ed632635ec5e6a2d7bbf0807f2260aa97200b9b88b89eb3aad14be8a2f5985c79d4cf6f795536d1effacbc8fe43800cbf054
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfo:NABb

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/memory/3212-395-0x00007FF6C6720000-0x00007FF6C6B12000-memory.dmp	xmrig
behavioral2/memory/352-421-0x00007FF65DE00000-0x00007FF65E1F2000-memory.dmp	xmrig
behavioral2/memory/4972-428-0x00007FF605B90000-0x00007FF605F82000-memory.dmp	xmrig
behavioral2/memory/1340-430-0x00007FF785360000-0x00007FF785752000-memory.dmp	xmrig
behavioral2/memory/2996-429-0x00007FF7B1680000-0x00007FF7B1A72000-memory.dmp	xmrig
behavioral2/memory/1944-427-0x00007FF7E2FC0000-0x00007FF7E33B2000-memory.dmp	xmrig
behavioral2/memory/3192-426-0x00007FF6022D0000-0x00007FF6026C2000-memory.dmp	xmrig
behavioral2/memory/2924-425-0x00007FF73DBE0000-0x00007FF73DFD2000-memory.dmp	xmrig
behavioral2/memory/472-424-0x00007FF635220000-0x00007FF635612000-memory.dmp	xmrig
behavioral2/memory/4600-423-0x00007FF6BE4D0000-0x00007FF6BE8C2000-memory.dmp	xmrig
behavioral2/memory/1856-422-0x00007FF7CA5C0000-0x00007FF7CA9B2000-memory.dmp	xmrig
behavioral2/memory/1044-420-0x00007FF737490000-0x00007FF737882000-memory.dmp	xmrig
behavioral2/memory/3860-419-0x00007FF643F10000-0x00007FF644302000-memory.dmp	xmrig
behavioral2/memory/3600-336-0x00007FF635380000-0x00007FF635772000-memory.dmp	xmrig
behavioral2/memory/912-333-0x00007FF719CE0000-0x00007FF71A0D2000-memory.dmp	xmrig
behavioral2/memory/4548-290-0x00007FF7E4250000-0x00007FF7E4642000-memory.dmp	xmrig
behavioral2/memory/2804-259-0x00007FF77E760000-0x00007FF77EB52000-memory.dmp	xmrig
behavioral2/memory/3248-221-0x00007FF7A40A0000-0x00007FF7A4492000-memory.dmp	xmrig
behavioral2/memory/552-227-0x00007FF74CDA0000-0x00007FF74D192000-memory.dmp	xmrig
behavioral2/memory/3140-133-0x00007FF7D77E0000-0x00007FF7D7BD2000-memory.dmp	xmrig
behavioral2/memory/4788-129-0x00007FF758640000-0x00007FF758A32000-memory.dmp	xmrig
behavioral2/memory/3140-4789-0x00007FF7D77E0000-0x00007FF7D7BD2000-memory.dmp	xmrig
behavioral2/memory/4788-4815-0x00007FF758640000-0x00007FF758A32000-memory.dmp	xmrig
behavioral2/memory/552-4838-0x00007FF74CDA0000-0x00007FF74D192000-memory.dmp	xmrig
behavioral2/memory/3212-4917-0x00007FF6C6720000-0x00007FF6C6B12000-memory.dmp	xmrig
behavioral2/memory/472-4940-0x00007FF635220000-0x00007FF635612000-memory.dmp	xmrig
behavioral2/memory/352-4982-0x00007FF65DE00000-0x00007FF65E1F2000-memory.dmp	xmrig
behavioral2/memory/4600-5001-0x00007FF6BE4D0000-0x00007FF6BE8C2000-memory.dmp	xmrig
behavioral2/memory/2924-4995-0x00007FF73DBE0000-0x00007FF73DFD2000-memory.dmp	xmrig
behavioral2/memory/3192-4984-0x00007FF6022D0000-0x00007FF6026C2000-memory.dmp	xmrig
behavioral2/memory/1340-4990-0x00007FF785360000-0x00007FF785752000-memory.dmp	xmrig
behavioral2/memory/1856-4967-0x00007FF7CA5C0000-0x00007FF7CA9B2000-memory.dmp	xmrig
behavioral2/memory/3600-4910-0x00007FF635380000-0x00007FF635772000-memory.dmp	xmrig
behavioral2/memory/3688-5391-0x00007FF66F860000-0x00007FF66FC52000-memory.dmp	xmrig
behavioral2/memory/1944-5062-0x00007FF7E2FC0000-0x00007FF7E33B2000-memory.dmp	xmrig
behavioral2/memory/4972-5053-0x00007FF605B90000-0x00007FF605F82000-memory.dmp	xmrig
behavioral2/memory/1044-4869-0x00007FF737490000-0x00007FF737882000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2996	AYXuxAN.exe
4788	CILEaUg.exe
3140	mnZLbmt.exe
3248	KQWUTLu.exe
552	PChYUPa.exe
2804	vvOomgt.exe
4548	OrIvEVi.exe
912	mGTUQRn.exe
3600	lMuJYQr.exe
3212	LrXDVbG.exe
3860	fHYiiaC.exe
1044	mjyfuZt.exe
352	mPOejwR.exe
1856	icCvUEM.exe
4600	wtROeLL.exe
472	gjIRZob.exe
1340	QqYMDrG.exe
2924	lQBtHrt.exe
3192	TaapdIf.exe
1944	vLyJFqD.exe
4972	cyXvvgf.exe
1408	mzTKHUa.exe
4460	MuwYegx.exe
4288	QGCdbTV.exe
5044	axzEfdA.exe
816	SNAvtMp.exe
2096	qiohfVe.exe
4768	yhUFmkU.exe
4764	QOjSYdu.exe
2188	KgSfokk.exe
776	BYLqeZe.exe
3000	LEtejVK.exe
1288	WhGeMga.exe
2168	OSlHrIi.exe
2524	DIsyImm.exe
2920	pJSkRRB.exe
2948	vCerEIL.exe
5100	oAeKqRD.exe
2492	BaCLSwS.exe
3620	hYOGclC.exe
4336	rCWkVXc.exe
3544	ZPFbvGv.exe
2404	AbobHdh.exe
4592	iBhhtek.exe
3516	cTnFIMY.exe
4356	aVoIFUg.exe
2952	MUuAznl.exe
1068	MKISuZR.exe
5032	GyHQGGK.exe
4624	VUdVPdK.exe
3728	SaMldWB.exe
3384	NFSILOe.exe
4552	QnKPtUe.exe
4264	EtNjliQ.exe
2220	FeiCNJT.exe
3392	aFSffxj.exe
4292	CSrQmDz.exe
4428	BTeLDId.exe
4852	EfGcBmm.exe
668	obKDcdF.exe
2420	KhyIKGk.exe
4456	HaTcZPZ.exe
2552	LuTCxjF.exe
4940	jUxugzZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3688-0-0x00007FF66F860000-0x00007FF66FC52000-memory.dmp	upx
behavioral2/files/0x000a000000023b89-6.dat	upx
behavioral2/files/0x000a000000023b88-14.dat	upx
behavioral2/files/0x000c000000023b80-10.dat	upx
behavioral2/files/0x000a000000023b8b-18.dat	upx
behavioral2/files/0x000a000000023b93-51.dat	upx
behavioral2/files/0x000a000000023b95-68.dat	upx
behavioral2/files/0x000a000000023ba6-146.dat	upx
behavioral2/files/0x000a000000023bac-194.dat	upx
behavioral2/memory/3212-395-0x00007FF6C6720000-0x00007FF6C6B12000-memory.dmp	upx
behavioral2/memory/352-421-0x00007FF65DE00000-0x00007FF65E1F2000-memory.dmp	upx
behavioral2/memory/4972-428-0x00007FF605B90000-0x00007FF605F82000-memory.dmp	upx
behavioral2/memory/1340-430-0x00007FF785360000-0x00007FF785752000-memory.dmp	upx
behavioral2/memory/2996-429-0x00007FF7B1680000-0x00007FF7B1A72000-memory.dmp	upx
behavioral2/memory/1944-427-0x00007FF7E2FC0000-0x00007FF7E33B2000-memory.dmp	upx
behavioral2/memory/3192-426-0x00007FF6022D0000-0x00007FF6026C2000-memory.dmp	upx
behavioral2/memory/2924-425-0x00007FF73DBE0000-0x00007FF73DFD2000-memory.dmp	upx
behavioral2/memory/472-424-0x00007FF635220000-0x00007FF635612000-memory.dmp	upx
behavioral2/memory/4600-423-0x00007FF6BE4D0000-0x00007FF6BE8C2000-memory.dmp	upx
behavioral2/memory/1856-422-0x00007FF7CA5C0000-0x00007FF7CA9B2000-memory.dmp	upx
behavioral2/memory/1044-420-0x00007FF737490000-0x00007FF737882000-memory.dmp	upx
behavioral2/memory/3860-419-0x00007FF643F10000-0x00007FF644302000-memory.dmp	upx
behavioral2/memory/3600-336-0x00007FF635380000-0x00007FF635772000-memory.dmp	upx
behavioral2/memory/912-333-0x00007FF719CE0000-0x00007FF71A0D2000-memory.dmp	upx
behavioral2/memory/4548-290-0x00007FF7E4250000-0x00007FF7E4642000-memory.dmp	upx
behavioral2/memory/2804-259-0x00007FF77E760000-0x00007FF77EB52000-memory.dmp	upx
behavioral2/memory/3248-221-0x00007FF7A40A0000-0x00007FF7A4492000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-198.dat	upx
behavioral2/files/0x000a000000023ba3-191.dat	upx
behavioral2/files/0x000a000000023b98-180.dat	upx
behavioral2/files/0x000a000000023b97-174.dat	upx
behavioral2/memory/552-227-0x00007FF74CDA0000-0x00007FF74D192000-memory.dmp	upx
behavioral2/files/0x000a000000023bab-167.dat	upx
behavioral2/files/0x000a000000023baa-160.dat	upx
behavioral2/files/0x000a000000023ba9-155.dat	upx
behavioral2/files/0x000c000000023b85-208.dat	upx
behavioral2/files/0x000a000000023b9b-205.dat	upx
behavioral2/files/0x000a000000023b9a-202.dat	upx
behavioral2/files/0x000a000000023ba8-150.dat	upx
behavioral2/files/0x000a000000023ba7-147.dat	upx
behavioral2/files/0x000a000000023ba2-140.dat	upx
behavioral2/files/0x000a000000023b92-138.dat	upx
behavioral2/files/0x000a000000023ba1-173.dat	upx
behavioral2/memory/3140-133-0x00007FF7D77E0000-0x00007FF7D7BD2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-132.dat	upx
behavioral2/memory/4788-129-0x00007FF758640000-0x00007FF758A32000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-125.dat	upx
behavioral2/files/0x000a000000023b96-123.dat	upx
behavioral2/files/0x000a000000023b9e-122.dat	upx
behavioral2/files/0x000a000000023b9d-121.dat	upx
behavioral2/files/0x000a000000023b9c-120.dat	upx
behavioral2/files/0x000a000000023b99-99.dat	upx
behavioral2/files/0x000a000000023b91-95.dat	upx
behavioral2/files/0x000a000000023b90-88.dat	upx
behavioral2/files/0x000a000000023b94-128.dat	upx
behavioral2/files/0x000a000000023b8f-72.dat	upx
behavioral2/files/0x000a000000023b8e-69.dat	upx
behavioral2/files/0x000a000000023b92-65.dat	upx
behavioral2/files/0x000a000000023b8d-58.dat	upx
behavioral2/files/0x000a000000023b8c-54.dat	upx
behavioral2/files/0x000a000000023b8a-46.dat	upx
behavioral2/memory/3140-4789-0x00007FF7D77E0000-0x00007FF7D7BD2000-memory.dmp	upx
behavioral2/memory/4788-4815-0x00007FF758640000-0x00007FF758A32000-memory.dmp	upx
behavioral2/memory/552-4838-0x00007FF74CDA0000-0x00007FF74D192000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zxuseXj.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\lBkBKmg.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\ByCXnTF.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\xtKdfXN.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\DQqCGei.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\NOZGCsh.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\SlVSqeo.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\VhsUcWs.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\EezgNjU.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\CNceasr.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\OORPZRo.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\BvIHkMf.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\loyQAPK.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\Ysmqipb.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\LhQWezo.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\OKzvKKv.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\IQxLNuR.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\XxeqOCw.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\OmBxVEV.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\qMgPyuN.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\YNLQbQR.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\UUnHOaQ.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\RzTSWBC.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\kHbvZlz.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\rRCPDsr.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\AmpLtcD.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\AEAsACB.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\QTEPGJP.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\rPDkqWe.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\YsudcoC.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\yIciKde.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\mPOejwR.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\gXcNHhs.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\Faksysr.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\xmyoIqn.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\xiLvLsK.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\PChYUPa.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\lMuJYQr.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\TueyBaD.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\mnzmpVv.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\iJIWlPp.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\zKaowWD.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\YdrEVvO.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\qAUKHje.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\TdxWhpp.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\FOLrOeM.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\EovJzbw.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\AtsarSY.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\QGVjiFY.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\SzaKZAX.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\GGXnfnH.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\aNMnDYk.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\ejWTrLS.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\KITxwHo.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\pkjBKXb.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\UTCvYqS.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\zOilyAt.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\YQnWpVo.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\njRpaLo.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\rOSndKU.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\nJeLyPc.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\kupPaEz.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\xuLhTmW.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\vfjxYUh.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3116	powershell.exe
3116	powershell.exe
3116	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	powershell.exe
Token: SeLockMemoryPrivilege	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	16636	Process not Found
Token: SeChangeNotifyPrivilege	16636	Process not Found
Token: 33	16636	Process not Found
Token: SeIncBasePriorityPrivilege	16636	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 3116	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	85
PID 3688 wrote to memory of 3116	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	85
PID 3688 wrote to memory of 4788	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	86
PID 3688 wrote to memory of 4788	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	86
PID 3688 wrote to memory of 2996	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	87
PID 3688 wrote to memory of 2996	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	87
PID 3688 wrote to memory of 3140	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	88
PID 3688 wrote to memory of 3140	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	88
PID 3688 wrote to memory of 552	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	89
PID 3688 wrote to memory of 552	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	89
PID 3688 wrote to memory of 3248	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	90
PID 3688 wrote to memory of 3248	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	90
PID 3688 wrote to memory of 2804	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	91
PID 3688 wrote to memory of 2804	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	91
PID 3688 wrote to memory of 4548	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	92
PID 3688 wrote to memory of 4548	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	92
PID 3688 wrote to memory of 912	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	93
PID 3688 wrote to memory of 912	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	93
PID 3688 wrote to memory of 3600	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	94
PID 3688 wrote to memory of 3600	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	94
PID 3688 wrote to memory of 3212	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	95
PID 3688 wrote to memory of 3212	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	95
PID 3688 wrote to memory of 3860	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	96
PID 3688 wrote to memory of 3860	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	96
PID 3688 wrote to memory of 1856	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	97
PID 3688 wrote to memory of 1856	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	97
PID 3688 wrote to memory of 1044	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	98
PID 3688 wrote to memory of 1044	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	98
PID 3688 wrote to memory of 352	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	99
PID 3688 wrote to memory of 352	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	99
PID 3688 wrote to memory of 4600	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	100
PID 3688 wrote to memory of 4600	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	100
PID 3688 wrote to memory of 472	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	101
PID 3688 wrote to memory of 472	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	101
PID 3688 wrote to memory of 1340	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	102
PID 3688 wrote to memory of 1340	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	102
PID 3688 wrote to memory of 2924	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	103
PID 3688 wrote to memory of 2924	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	103
PID 3688 wrote to memory of 3192	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	104
PID 3688 wrote to memory of 3192	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	104
PID 3688 wrote to memory of 1944	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	105
PID 3688 wrote to memory of 1944	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	105
PID 3688 wrote to memory of 4972	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	106
PID 3688 wrote to memory of 4972	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	106
PID 3688 wrote to memory of 1408	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	107
PID 3688 wrote to memory of 1408	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	107
PID 3688 wrote to memory of 4460	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	108
PID 3688 wrote to memory of 4460	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	108
PID 3688 wrote to memory of 4288	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	109
PID 3688 wrote to memory of 4288	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	109
PID 3688 wrote to memory of 5044	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	110
PID 3688 wrote to memory of 5044	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	110
PID 3688 wrote to memory of 816	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	111
PID 3688 wrote to memory of 816	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	111
PID 3688 wrote to memory of 2096	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	112
PID 3688 wrote to memory of 2096	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	112
PID 3688 wrote to memory of 4768	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	113
PID 3688 wrote to memory of 4768	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	113
PID 3688 wrote to memory of 4764	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	114
PID 3688 wrote to memory of 4764	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	114
PID 3688 wrote to memory of 2188	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	115
PID 3688 wrote to memory of 2188	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	115
PID 3688 wrote to memory of 776	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	116
PID 3688 wrote to memory of 776	3688	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3116
- C:\Windows\System\CILEaUg.exe
  C:\Windows\System\CILEaUg.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\AYXuxAN.exe
  C:\Windows\System\AYXuxAN.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\mnZLbmt.exe
  C:\Windows\System\mnZLbmt.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\PChYUPa.exe
  C:\Windows\System\PChYUPa.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\KQWUTLu.exe
  C:\Windows\System\KQWUTLu.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\vvOomgt.exe
  C:\Windows\System\vvOomgt.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\OrIvEVi.exe
  C:\Windows\System\OrIvEVi.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\mGTUQRn.exe
  C:\Windows\System\mGTUQRn.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\lMuJYQr.exe
  C:\Windows\System\lMuJYQr.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\LrXDVbG.exe
  C:\Windows\System\LrXDVbG.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\fHYiiaC.exe
  C:\Windows\System\fHYiiaC.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\icCvUEM.exe
  C:\Windows\System\icCvUEM.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\mjyfuZt.exe
  C:\Windows\System\mjyfuZt.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\mPOejwR.exe
  C:\Windows\System\mPOejwR.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\wtROeLL.exe
  C:\Windows\System\wtROeLL.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\gjIRZob.exe
  C:\Windows\System\gjIRZob.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\QqYMDrG.exe
  C:\Windows\System\QqYMDrG.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\lQBtHrt.exe
  C:\Windows\System\lQBtHrt.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\TaapdIf.exe
  C:\Windows\System\TaapdIf.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\vLyJFqD.exe
  C:\Windows\System\vLyJFqD.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\cyXvvgf.exe
  C:\Windows\System\cyXvvgf.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\mzTKHUa.exe
  C:\Windows\System\mzTKHUa.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\MuwYegx.exe
  C:\Windows\System\MuwYegx.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\QGCdbTV.exe
  C:\Windows\System\QGCdbTV.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\axzEfdA.exe
  C:\Windows\System\axzEfdA.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\SNAvtMp.exe
  C:\Windows\System\SNAvtMp.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\qiohfVe.exe
  C:\Windows\System\qiohfVe.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\yhUFmkU.exe
  C:\Windows\System\yhUFmkU.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\QOjSYdu.exe
  C:\Windows\System\QOjSYdu.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\KgSfokk.exe
  C:\Windows\System\KgSfokk.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\BYLqeZe.exe
  C:\Windows\System\BYLqeZe.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\LEtejVK.exe
  C:\Windows\System\LEtejVK.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\WhGeMga.exe
  C:\Windows\System\WhGeMga.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\OSlHrIi.exe
  C:\Windows\System\OSlHrIi.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\DIsyImm.exe
  C:\Windows\System\DIsyImm.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\pJSkRRB.exe
  C:\Windows\System\pJSkRRB.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\vCerEIL.exe
  C:\Windows\System\vCerEIL.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\oAeKqRD.exe
  C:\Windows\System\oAeKqRD.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\BaCLSwS.exe
  C:\Windows\System\BaCLSwS.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\hYOGclC.exe
  C:\Windows\System\hYOGclC.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\rCWkVXc.exe
  C:\Windows\System\rCWkVXc.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\ZPFbvGv.exe
  C:\Windows\System\ZPFbvGv.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\AbobHdh.exe
  C:\Windows\System\AbobHdh.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\iBhhtek.exe
  C:\Windows\System\iBhhtek.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\cTnFIMY.exe
  C:\Windows\System\cTnFIMY.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\aVoIFUg.exe
  C:\Windows\System\aVoIFUg.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\MUuAznl.exe
  C:\Windows\System\MUuAznl.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\MKISuZR.exe
  C:\Windows\System\MKISuZR.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\GyHQGGK.exe
  C:\Windows\System\GyHQGGK.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\VUdVPdK.exe
  C:\Windows\System\VUdVPdK.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\SaMldWB.exe
  C:\Windows\System\SaMldWB.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\HaTcZPZ.exe
  C:\Windows\System\HaTcZPZ.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\NFSILOe.exe
  C:\Windows\System\NFSILOe.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\QnKPtUe.exe
  C:\Windows\System\QnKPtUe.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\EtNjliQ.exe
  C:\Windows\System\EtNjliQ.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\FeiCNJT.exe
  C:\Windows\System\FeiCNJT.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\aFSffxj.exe
  C:\Windows\System\aFSffxj.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\CSrQmDz.exe
  C:\Windows\System\CSrQmDz.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\BTeLDId.exe
  C:\Windows\System\BTeLDId.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\EfGcBmm.exe
  C:\Windows\System\EfGcBmm.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\obKDcdF.exe
  C:\Windows\System\obKDcdF.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\KhyIKGk.exe
  C:\Windows\System\KhyIKGk.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\LuTCxjF.exe
  C:\Windows\System\LuTCxjF.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\jUxugzZ.exe
  C:\Windows\System\jUxugzZ.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\mZGWaec.exe
  C:\Windows\System\mZGWaec.exe
  2⤵
  PID:4512
- C:\Windows\System\ksHcKlr.exe
  C:\Windows\System\ksHcKlr.exe
  2⤵
  PID:3628
- C:\Windows\System\oSjFmCo.exe
  C:\Windows\System\oSjFmCo.exe
  2⤵
  PID:4464
- C:\Windows\System\PmKAWQg.exe
  C:\Windows\System\PmKAWQg.exe
  2⤵
  PID:4476
- C:\Windows\System\oHtceIw.exe
  C:\Windows\System\oHtceIw.exe
  2⤵
  PID:2436
- C:\Windows\System\xrGCXcK.exe
  C:\Windows\System\xrGCXcK.exe
  2⤵
  PID:4804
- C:\Windows\System\UrknxUl.exe
  C:\Windows\System\UrknxUl.exe
  2⤵
  PID:3416
- C:\Windows\System\LeeeTQY.exe
  C:\Windows\System\LeeeTQY.exe
  2⤵
  PID:1840
- C:\Windows\System\OVWoRNv.exe
  C:\Windows\System\OVWoRNv.exe
  2⤵
  PID:2664
- C:\Windows\System\AaXnjma.exe
  C:\Windows\System\AaXnjma.exe
  2⤵
  PID:1624
- C:\Windows\System\NczqVvc.exe
  C:\Windows\System\NczqVvc.exe
  2⤵
  PID:3204
- C:\Windows\System\traDSMf.exe
  C:\Windows\System\traDSMf.exe
  2⤵
  PID:3228
- C:\Windows\System\yfFTUSJ.exe
  C:\Windows\System\yfFTUSJ.exe
  2⤵
  PID:628
- C:\Windows\System\DOXUAaI.exe
  C:\Windows\System\DOXUAaI.exe
  2⤵
  PID:5124
- C:\Windows\System\CkspLiU.exe
  C:\Windows\System\CkspLiU.exe
  2⤵
  PID:5152
- C:\Windows\System\mbqbRnV.exe
  C:\Windows\System\mbqbRnV.exe
  2⤵
  PID:5172
- C:\Windows\System\iPQglws.exe
  C:\Windows\System\iPQglws.exe
  2⤵
  PID:5228
- C:\Windows\System\DbjbqBJ.exe
  C:\Windows\System\DbjbqBJ.exe
  2⤵
  PID:5256
- C:\Windows\System\FtgvsCW.exe
  C:\Windows\System\FtgvsCW.exe
  2⤵
  PID:5272
- C:\Windows\System\ixWdPrx.exe
  C:\Windows\System\ixWdPrx.exe
  2⤵
  PID:5332
- C:\Windows\System\nSySrwK.exe
  C:\Windows\System\nSySrwK.exe
  2⤵
  PID:5372
- C:\Windows\System\BvAbSTc.exe
  C:\Windows\System\BvAbSTc.exe
  2⤵
  PID:5396
- C:\Windows\System\JgGopWG.exe
  C:\Windows\System\JgGopWG.exe
  2⤵
  PID:5420
- C:\Windows\System\LEuDEzK.exe
  C:\Windows\System\LEuDEzK.exe
  2⤵
  PID:5448
- C:\Windows\System\ZytCnWZ.exe
  C:\Windows\System\ZytCnWZ.exe
  2⤵
  PID:5468
- C:\Windows\System\qPGMvho.exe
  C:\Windows\System\qPGMvho.exe
  2⤵
  PID:5488
- C:\Windows\System\OOdGtsG.exe
  C:\Windows\System\OOdGtsG.exe
  2⤵
  PID:5504
- C:\Windows\System\fpRsvDt.exe
  C:\Windows\System\fpRsvDt.exe
  2⤵
  PID:5524
- C:\Windows\System\bYLnErr.exe
  C:\Windows\System\bYLnErr.exe
  2⤵
  PID:5548
- C:\Windows\System\accUohO.exe
  C:\Windows\System\accUohO.exe
  2⤵
  PID:5568
- C:\Windows\System\orjvUXI.exe
  C:\Windows\System\orjvUXI.exe
  2⤵
  PID:5592
- C:\Windows\System\iNnoZIk.exe
  C:\Windows\System\iNnoZIk.exe
  2⤵
  PID:5612
- C:\Windows\System\zshDphT.exe
  C:\Windows\System\zshDphT.exe
  2⤵
  PID:5636
- C:\Windows\System\fQCUHxh.exe
  C:\Windows\System\fQCUHxh.exe
  2⤵
  PID:5652
- C:\Windows\System\KpSwmmi.exe
  C:\Windows\System\KpSwmmi.exe
  2⤵
  PID:5680
- C:\Windows\System\RSCqNYU.exe
  C:\Windows\System\RSCqNYU.exe
  2⤵
  PID:5704
- C:\Windows\System\YRscsOt.exe
  C:\Windows\System\YRscsOt.exe
  2⤵
  PID:5740
- C:\Windows\System\aSmjRQN.exe
  C:\Windows\System\aSmjRQN.exe
  2⤵
  PID:5764
- C:\Windows\System\vLYHrvr.exe
  C:\Windows\System\vLYHrvr.exe
  2⤵
  PID:5792
- C:\Windows\System\AyxPJog.exe
  C:\Windows\System\AyxPJog.exe
  2⤵
  PID:5812
- C:\Windows\System\vHYvOZa.exe
  C:\Windows\System\vHYvOZa.exe
  2⤵
  PID:5828
- C:\Windows\System\uDvPWjG.exe
  C:\Windows\System\uDvPWjG.exe
  2⤵
  PID:5848
- C:\Windows\System\xxxYScC.exe
  C:\Windows\System\xxxYScC.exe
  2⤵
  PID:5872
- C:\Windows\System\rbOhSKR.exe
  C:\Windows\System\rbOhSKR.exe
  2⤵
  PID:5896
- C:\Windows\System\ShuZscG.exe
  C:\Windows\System\ShuZscG.exe
  2⤵
  PID:5920
- C:\Windows\System\younquW.exe
  C:\Windows\System\younquW.exe
  2⤵
  PID:5940
- C:\Windows\System\mAFmFhV.exe
  C:\Windows\System\mAFmFhV.exe
  2⤵
  PID:5960
- C:\Windows\System\XvQpvWK.exe
  C:\Windows\System\XvQpvWK.exe
  2⤵
  PID:6024
- C:\Windows\System\kQTLGdk.exe
  C:\Windows\System\kQTLGdk.exe
  2⤵
  PID:6040
- C:\Windows\System\gBnmlWa.exe
  C:\Windows\System\gBnmlWa.exe
  2⤵
  PID:6068
- C:\Windows\System\WvJRTUV.exe
  C:\Windows\System\WvJRTUV.exe
  2⤵
  PID:6088
- C:\Windows\System\bhWOQXj.exe
  C:\Windows\System\bhWOQXj.exe
  2⤵
  PID:6108
- C:\Windows\System\IRLpUPA.exe
  C:\Windows\System\IRLpUPA.exe
  2⤵
  PID:6132
- C:\Windows\System\sFyeqpt.exe
  C:\Windows\System\sFyeqpt.exe
  2⤵
  PID:1700
- C:\Windows\System\gyUnQcA.exe
  C:\Windows\System\gyUnQcA.exe
  2⤵
  PID:5040
- C:\Windows\System\mHukVpe.exe
  C:\Windows\System\mHukVpe.exe
  2⤵
  PID:3156
- C:\Windows\System\cquWPOn.exe
  C:\Windows\System\cquWPOn.exe
  2⤵
  PID:4912
- C:\Windows\System\mBwSpeM.exe
  C:\Windows\System\mBwSpeM.exe
  2⤵
  PID:2628
- C:\Windows\System\wcZmStt.exe
  C:\Windows\System\wcZmStt.exe
  2⤵
  PID:3484
- C:\Windows\System\jOFrGFp.exe
  C:\Windows\System\jOFrGFp.exe
  2⤵
  PID:848
- C:\Windows\System\EMinzeU.exe
  C:\Windows\System\EMinzeU.exe
  2⤵
  PID:4692
- C:\Windows\System\tcFFfEQ.exe
  C:\Windows\System\tcFFfEQ.exe
  2⤵
  PID:5140
- C:\Windows\System\fuGCZnr.exe
  C:\Windows\System\fuGCZnr.exe
  2⤵
  PID:5288
- C:\Windows\System\SSlsPHm.exe
  C:\Windows\System\SSlsPHm.exe
  2⤵
  PID:5340
- C:\Windows\System\cVEwVFZ.exe
  C:\Windows\System\cVEwVFZ.exe
  2⤵
  PID:5428
- C:\Windows\System\EqtftBo.exe
  C:\Windows\System\EqtftBo.exe
  2⤵
  PID:5460
- C:\Windows\System\ZqGuOZZ.exe
  C:\Windows\System\ZqGuOZZ.exe
  2⤵
  PID:5512
- C:\Windows\System\UJiYwOf.exe
  C:\Windows\System\UJiYwOf.exe
  2⤵
  PID:5540
- C:\Windows\System\lHNeWrl.exe
  C:\Windows\System\lHNeWrl.exe
  2⤵
  PID:5672
- C:\Windows\System\PLlhUpQ.exe
  C:\Windows\System\PLlhUpQ.exe
  2⤵
  PID:5732
- C:\Windows\System\NnSgJnU.exe
  C:\Windows\System\NnSgJnU.exe
  2⤵
  PID:5784
- C:\Windows\System\UeqSnWa.exe
  C:\Windows\System\UeqSnWa.exe
  2⤵
  PID:5824
- C:\Windows\System\pARjKfr.exe
  C:\Windows\System\pARjKfr.exe
  2⤵
  PID:5868
- C:\Windows\System\yWscwhU.exe
  C:\Windows\System\yWscwhU.exe
  2⤵
  PID:5928
- C:\Windows\System\BqSMZww.exe
  C:\Windows\System\BqSMZww.exe
  2⤵
  PID:5968
- C:\Windows\System\hBUEXwP.exe
  C:\Windows\System\hBUEXwP.exe
  2⤵
  PID:6100
- C:\Windows\System\OAIiXmj.exe
  C:\Windows\System\OAIiXmj.exe
  2⤵
  PID:2208
- C:\Windows\System\aFaHKdx.exe
  C:\Windows\System\aFaHKdx.exe
  2⤵
  PID:4944
- C:\Windows\System\xtKdfXN.exe
  C:\Windows\System\xtKdfXN.exe
  2⤵
  PID:5084
- C:\Windows\System\NkgLrht.exe
  C:\Windows\System\NkgLrht.exe
  2⤵
  PID:1120
- C:\Windows\System\MLvoqpG.exe
  C:\Windows\System\MLvoqpG.exe
  2⤵
  PID:4744
- C:\Windows\System\QHRPbyP.exe
  C:\Windows\System\QHRPbyP.exe
  2⤵
  PID:484
- C:\Windows\System\ellqlEj.exe
  C:\Windows\System\ellqlEj.exe
  2⤵
  PID:6160
- C:\Windows\System\TSspxWz.exe
  C:\Windows\System\TSspxWz.exe
  2⤵
  PID:6176
- C:\Windows\System\eXRERHD.exe
  C:\Windows\System\eXRERHD.exe
  2⤵
  PID:6192
- C:\Windows\System\hrzkEOU.exe
  C:\Windows\System\hrzkEOU.exe
  2⤵
  PID:6208
- C:\Windows\System\gYCslRH.exe
  C:\Windows\System\gYCslRH.exe
  2⤵
  PID:6224
- C:\Windows\System\STzYHWv.exe
  C:\Windows\System\STzYHWv.exe
  2⤵
  PID:6240
- C:\Windows\System\nXZtGrs.exe
  C:\Windows\System\nXZtGrs.exe
  2⤵
  PID:6260
- C:\Windows\System\izVHnhs.exe
  C:\Windows\System\izVHnhs.exe
  2⤵
  PID:6276
- C:\Windows\System\lsryNbR.exe
  C:\Windows\System\lsryNbR.exe
  2⤵
  PID:6300
- C:\Windows\System\iUFruaj.exe
  C:\Windows\System\iUFruaj.exe
  2⤵
  PID:6316
- C:\Windows\System\ccQeBvk.exe
  C:\Windows\System\ccQeBvk.exe
  2⤵
  PID:6340
- C:\Windows\System\jzNWlLB.exe
  C:\Windows\System\jzNWlLB.exe
  2⤵
  PID:6360
- C:\Windows\System\yoBJqhy.exe
  C:\Windows\System\yoBJqhy.exe
  2⤵
  PID:6380
- C:\Windows\System\qHuPQNk.exe
  C:\Windows\System\qHuPQNk.exe
  2⤵
  PID:6404
- C:\Windows\System\lxKHamM.exe
  C:\Windows\System\lxKHamM.exe
  2⤵
  PID:6424
- C:\Windows\System\xAcrERP.exe
  C:\Windows\System\xAcrERP.exe
  2⤵
  PID:6444
- C:\Windows\System\mslcNFd.exe
  C:\Windows\System\mslcNFd.exe
  2⤵
  PID:6468
- C:\Windows\System\UTZEMVP.exe
  C:\Windows\System\UTZEMVP.exe
  2⤵
  PID:6492
- C:\Windows\System\exRfFjs.exe
  C:\Windows\System\exRfFjs.exe
  2⤵
  PID:6508
- C:\Windows\System\NrgcorA.exe
  C:\Windows\System\NrgcorA.exe
  2⤵
  PID:6532
- C:\Windows\System\qiLsrEt.exe
  C:\Windows\System\qiLsrEt.exe
  2⤵
  PID:6556
- C:\Windows\System\DOlzhCs.exe
  C:\Windows\System\DOlzhCs.exe
  2⤵
  PID:6580
- C:\Windows\System\weIyPLl.exe
  C:\Windows\System\weIyPLl.exe
  2⤵
  PID:6600
- C:\Windows\System\HUOuYvn.exe
  C:\Windows\System\HUOuYvn.exe
  2⤵
  PID:6620
- C:\Windows\System\VUXTDqa.exe
  C:\Windows\System\VUXTDqa.exe
  2⤵
  PID:6636
- C:\Windows\System\apuurPf.exe
  C:\Windows\System\apuurPf.exe
  2⤵
  PID:6660
- C:\Windows\System\HlKqSQy.exe
  C:\Windows\System\HlKqSQy.exe
  2⤵
  PID:6684
- C:\Windows\System\cNmpAqZ.exe
  C:\Windows\System\cNmpAqZ.exe
  2⤵
  PID:6708
- C:\Windows\System\DDlTHAa.exe
  C:\Windows\System\DDlTHAa.exe
  2⤵
  PID:6724
- C:\Windows\System\VIJaadp.exe
  C:\Windows\System\VIJaadp.exe
  2⤵
  PID:6748
- C:\Windows\System\fytdpJy.exe
  C:\Windows\System\fytdpJy.exe
  2⤵
  PID:6772
- C:\Windows\System\DrmqlbC.exe
  C:\Windows\System\DrmqlbC.exe
  2⤵
  PID:6800
- C:\Windows\System\dOjknKb.exe
  C:\Windows\System\dOjknKb.exe
  2⤵
  PID:6868
- C:\Windows\System\xgUIgkR.exe
  C:\Windows\System\xgUIgkR.exe
  2⤵
  PID:6884
- C:\Windows\System\uTRzvQk.exe
  C:\Windows\System\uTRzvQk.exe
  2⤵
  PID:6904
- C:\Windows\System\cOxNuLZ.exe
  C:\Windows\System\cOxNuLZ.exe
  2⤵
  PID:6928
- C:\Windows\System\NWpLjUs.exe
  C:\Windows\System\NWpLjUs.exe
  2⤵
  PID:6952
- C:\Windows\System\TEsQPfE.exe
  C:\Windows\System\TEsQPfE.exe
  2⤵
  PID:6976
- C:\Windows\System\AKsYCwk.exe
  C:\Windows\System\AKsYCwk.exe
  2⤵
  PID:6992
- C:\Windows\System\qBleVME.exe
  C:\Windows\System\qBleVME.exe
  2⤵
  PID:7012
- C:\Windows\System\ciFbSBj.exe
  C:\Windows\System\ciFbSBj.exe
  2⤵
  PID:7040
- C:\Windows\System\hdyCtee.exe
  C:\Windows\System\hdyCtee.exe
  2⤵
  PID:7064
- C:\Windows\System\vyPpnGa.exe
  C:\Windows\System\vyPpnGa.exe
  2⤵
  PID:7084
- C:\Windows\System\ljfLXTZ.exe
  C:\Windows\System\ljfLXTZ.exe
  2⤵
  PID:5588
- C:\Windows\System\FdEJVVF.exe
  C:\Windows\System\FdEJVVF.exe
  2⤵
  PID:5892
- C:\Windows\System\BJShjiu.exe
  C:\Windows\System\BJShjiu.exe
  2⤵
  PID:6048
- C:\Windows\System\XBJrEhf.exe
  C:\Windows\System\XBJrEhf.exe
  2⤵
  PID:6596
- C:\Windows\System\vQvZpBv.exe
  C:\Windows\System\vQvZpBv.exe
  2⤵
  PID:6720
- C:\Windows\System\nHJFNsJ.exe
  C:\Windows\System\nHJFNsJ.exe
  2⤵
  PID:6008
- C:\Windows\System\TAJERlz.exe
  C:\Windows\System\TAJERlz.exe
  2⤵
  PID:5312
- C:\Windows\System\CjRSkpY.exe
  C:\Windows\System\CjRSkpY.exe
  2⤵
  PID:5776
- C:\Windows\System\zmLwEPn.exe
  C:\Windows\System\zmLwEPn.exe
  2⤵
  PID:7172
- C:\Windows\System\GXfFpQM.exe
  C:\Windows\System\GXfFpQM.exe
  2⤵
  PID:7188
- C:\Windows\System\xQOFFnI.exe
  C:\Windows\System\xQOFFnI.exe
  2⤵
  PID:7212
- C:\Windows\System\hnbjemg.exe
  C:\Windows\System\hnbjemg.exe
  2⤵
  PID:7232
- C:\Windows\System\ugdYSXR.exe
  C:\Windows\System\ugdYSXR.exe
  2⤵
  PID:7248
- C:\Windows\System\muDAGEn.exe
  C:\Windows\System\muDAGEn.exe
  2⤵
  PID:7264
- C:\Windows\System\XfRojab.exe
  C:\Windows\System\XfRojab.exe
  2⤵
  PID:7280
- C:\Windows\System\VWgyPxZ.exe
  C:\Windows\System\VWgyPxZ.exe
  2⤵
  PID:7300
- C:\Windows\System\XmvmndO.exe
  C:\Windows\System\XmvmndO.exe
  2⤵
  PID:7316
- C:\Windows\System\DyaMqdq.exe
  C:\Windows\System\DyaMqdq.exe
  2⤵
  PID:7336
- C:\Windows\System\KyDFrmP.exe
  C:\Windows\System\KyDFrmP.exe
  2⤵
  PID:7352
- C:\Windows\System\tyIhGIg.exe
  C:\Windows\System\tyIhGIg.exe
  2⤵
  PID:7372
- C:\Windows\System\trgSqeo.exe
  C:\Windows\System\trgSqeo.exe
  2⤵
  PID:7388
- C:\Windows\System\jyYvoZP.exe
  C:\Windows\System\jyYvoZP.exe
  2⤵
  PID:7412
- C:\Windows\System\xGhdKlB.exe
  C:\Windows\System\xGhdKlB.exe
  2⤵
  PID:7436
- C:\Windows\System\MVuLEpr.exe
  C:\Windows\System\MVuLEpr.exe
  2⤵
  PID:7456
- C:\Windows\System\bxFNTbk.exe
  C:\Windows\System\bxFNTbk.exe
  2⤵
  PID:7476
- C:\Windows\System\sIVgLZh.exe
  C:\Windows\System\sIVgLZh.exe
  2⤵
  PID:7500
- C:\Windows\System\YfUjggS.exe
  C:\Windows\System\YfUjggS.exe
  2⤵
  PID:7524
- C:\Windows\System\mfRTexr.exe
  C:\Windows\System\mfRTexr.exe
  2⤵
  PID:7540
- C:\Windows\System\GoAcshw.exe
  C:\Windows\System\GoAcshw.exe
  2⤵
  PID:7564
- C:\Windows\System\ADhgNpv.exe
  C:\Windows\System\ADhgNpv.exe
  2⤵
  PID:7616
- C:\Windows\System\CWAPCHF.exe
  C:\Windows\System\CWAPCHF.exe
  2⤵
  PID:7632
- C:\Windows\System\igFLsPP.exe
  C:\Windows\System\igFLsPP.exe
  2⤵
  PID:7656
- C:\Windows\System\KZIgJrg.exe
  C:\Windows\System\KZIgJrg.exe
  2⤵
  PID:7680
- C:\Windows\System\kpKzUdQ.exe
  C:\Windows\System\kpKzUdQ.exe
  2⤵
  PID:7704
- C:\Windows\System\EzFBhak.exe
  C:\Windows\System\EzFBhak.exe
  2⤵
  PID:7728
- C:\Windows\System\ByGkHFG.exe
  C:\Windows\System\ByGkHFG.exe
  2⤵
  PID:7856
- C:\Windows\System\RJSHPcD.exe
  C:\Windows\System\RJSHPcD.exe
  2⤵
  PID:7880
- C:\Windows\System\NohiSqa.exe
  C:\Windows\System\NohiSqa.exe
  2⤵
  PID:7912
- C:\Windows\System\LnviDbH.exe
  C:\Windows\System\LnviDbH.exe
  2⤵
  PID:7988
- C:\Windows\System\XCYcoHH.exe
  C:\Windows\System\XCYcoHH.exe
  2⤵
  PID:8008
- C:\Windows\System\yTlpyIb.exe
  C:\Windows\System\yTlpyIb.exe
  2⤵
  PID:8028
- C:\Windows\System\KBaxHNv.exe
  C:\Windows\System\KBaxHNv.exe
  2⤵
  PID:8048
- C:\Windows\System\hmyABvf.exe
  C:\Windows\System\hmyABvf.exe
  2⤵
  PID:8064
- C:\Windows\System\EovJzbw.exe
  C:\Windows\System\EovJzbw.exe
  2⤵
  PID:8080
- C:\Windows\System\PqRbiGL.exe
  C:\Windows\System\PqRbiGL.exe
  2⤵
  PID:8096
- C:\Windows\System\CgZcRcc.exe
  C:\Windows\System\CgZcRcc.exe
  2⤵
  PID:8116
- C:\Windows\System\LGUCHFy.exe
  C:\Windows\System\LGUCHFy.exe
  2⤵
  PID:8140
- C:\Windows\System\lxGuFWc.exe
  C:\Windows\System\lxGuFWc.exe
  2⤵
  PID:8156
- C:\Windows\System\wKRoNqk.exe
  C:\Windows\System\wKRoNqk.exe
  2⤵
  PID:8180
- C:\Windows\System\puNFRQc.exe
  C:\Windows\System\puNFRQc.exe
  2⤵
  PID:4588
- C:\Windows\System\GDjBqgT.exe
  C:\Windows\System\GDjBqgT.exe
  2⤵
  PID:2900
- C:\Windows\System\RDxMjSt.exe
  C:\Windows\System\RDxMjSt.exe
  2⤵
  PID:6184
- C:\Windows\System\OPNnKPc.exe
  C:\Windows\System\OPNnKPc.exe
  2⤵
  PID:6232
- C:\Windows\System\EGygcew.exe
  C:\Windows\System\EGygcew.exe
  2⤵
  PID:6272
- C:\Windows\System\AtsarSY.exe
  C:\Windows\System\AtsarSY.exe
  2⤵
  PID:6312
- C:\Windows\System\EGEgXMk.exe
  C:\Windows\System\EGEgXMk.exe
  2⤵
  PID:6352
- C:\Windows\System\HWbgOSZ.exe
  C:\Windows\System\HWbgOSZ.exe
  2⤵
  PID:6400
- C:\Windows\System\QGVjiFY.exe
  C:\Windows\System\QGVjiFY.exe
  2⤵
  PID:6452
- C:\Windows\System\DHdCClJ.exe
  C:\Windows\System\DHdCClJ.exe
  2⤵
  PID:6500
- C:\Windows\System\iJIWlPp.exe
  C:\Windows\System\iJIWlPp.exe
  2⤵
  PID:6528
- C:\Windows\System\VzHZvBj.exe
  C:\Windows\System\VzHZvBj.exe
  2⤵
  PID:6732
- C:\Windows\System\DFepUYk.exe
  C:\Windows\System\DFepUYk.exe
  2⤵
  PID:6764
- C:\Windows\System\gPSFBHe.exe
  C:\Windows\System\gPSFBHe.exe
  2⤵
  PID:6792
- C:\Windows\System\jFxiQqm.exe
  C:\Windows\System\jFxiQqm.exe
  2⤵
  PID:7380
- C:\Windows\System\bljVfDn.exe
  C:\Windows\System\bljVfDn.exe
  2⤵
  PID:8208
- C:\Windows\System\cPohcDg.exe
  C:\Windows\System\cPohcDg.exe
  2⤵
  PID:8224
- C:\Windows\System\LNwDUUF.exe
  C:\Windows\System\LNwDUUF.exe
  2⤵
  PID:8240
- C:\Windows\System\DDQWubt.exe
  C:\Windows\System\DDQWubt.exe
  2⤵
  PID:8256
- C:\Windows\System\lgNROno.exe
  C:\Windows\System\lgNROno.exe
  2⤵
  PID:8272
- C:\Windows\System\XJVugVM.exe
  C:\Windows\System\XJVugVM.exe
  2⤵
  PID:8296
- C:\Windows\System\oZSsuKz.exe
  C:\Windows\System\oZSsuKz.exe
  2⤵
  PID:8312
- C:\Windows\System\LlWNQbi.exe
  C:\Windows\System\LlWNQbi.exe
  2⤵
  PID:8340
- C:\Windows\System\tHbrMyH.exe
  C:\Windows\System\tHbrMyH.exe
  2⤵
  PID:8364
- C:\Windows\System\yRraQOB.exe
  C:\Windows\System\yRraQOB.exe
  2⤵
  PID:8388
- C:\Windows\System\ZTTWFQU.exe
  C:\Windows\System\ZTTWFQU.exe
  2⤵
  PID:8408
- C:\Windows\System\gJUeWKd.exe
  C:\Windows\System\gJUeWKd.exe
  2⤵
  PID:8436
- C:\Windows\System\nuryVTs.exe
  C:\Windows\System\nuryVTs.exe
  2⤵
  PID:8456
- C:\Windows\System\SaDbtWN.exe
  C:\Windows\System\SaDbtWN.exe
  2⤵
  PID:8484
- C:\Windows\System\HAFMHxA.exe
  C:\Windows\System\HAFMHxA.exe
  2⤵
  PID:8508
- C:\Windows\System\gawtZDt.exe
  C:\Windows\System\gawtZDt.exe
  2⤵
  PID:8532
- C:\Windows\System\FKLRcWc.exe
  C:\Windows\System\FKLRcWc.exe
  2⤵
  PID:8552
- C:\Windows\System\JatoWzA.exe
  C:\Windows\System\JatoWzA.exe
  2⤵
  PID:8624
- C:\Windows\System\QmTNgGI.exe
  C:\Windows\System\QmTNgGI.exe
  2⤵
  PID:8648
- C:\Windows\System\rAYSHDM.exe
  C:\Windows\System\rAYSHDM.exe
  2⤵
  PID:8664
- C:\Windows\System\KJIGWtH.exe
  C:\Windows\System\KJIGWtH.exe
  2⤵
  PID:8680
- C:\Windows\System\AVfnEll.exe
  C:\Windows\System\AVfnEll.exe
  2⤵
  PID:8696
- C:\Windows\System\dhhFPuF.exe
  C:\Windows\System\dhhFPuF.exe
  2⤵
  PID:8720
- C:\Windows\System\OwnFhrK.exe
  C:\Windows\System\OwnFhrK.exe
  2⤵
  PID:8740
- C:\Windows\System\ebKqZgM.exe
  C:\Windows\System\ebKqZgM.exe
  2⤵
  PID:8768
- C:\Windows\System\ubjkquc.exe
  C:\Windows\System\ubjkquc.exe
  2⤵
  PID:8792
- C:\Windows\System\isfYCxw.exe
  C:\Windows\System\isfYCxw.exe
  2⤵
  PID:8812
- C:\Windows\System\yZXiZxz.exe
  C:\Windows\System\yZXiZxz.exe
  2⤵
  PID:8828
- C:\Windows\System\JqMQHLy.exe
  C:\Windows\System\JqMQHLy.exe
  2⤵
  PID:8844
- C:\Windows\System\LyEUcVr.exe
  C:\Windows\System\LyEUcVr.exe
  2⤵
  PID:8860
- C:\Windows\System\kohilKw.exe
  C:\Windows\System\kohilKw.exe
  2⤵
  PID:8880
- C:\Windows\System\jKOCMmA.exe
  C:\Windows\System\jKOCMmA.exe
  2⤵
  PID:8904
- C:\Windows\System\HueeEXM.exe
  C:\Windows\System\HueeEXM.exe
  2⤵
  PID:8924
- C:\Windows\System\oYJMNGY.exe
  C:\Windows\System\oYJMNGY.exe
  2⤵
  PID:8944
- C:\Windows\System\znFgUqp.exe
  C:\Windows\System\znFgUqp.exe
  2⤵
  PID:8968
- C:\Windows\System\amtJjdo.exe
  C:\Windows\System\amtJjdo.exe
  2⤵
  PID:8996
- C:\Windows\System\qARSvue.exe
  C:\Windows\System\qARSvue.exe
  2⤵
  PID:9012
- C:\Windows\System\rIJeUDy.exe
  C:\Windows\System\rIJeUDy.exe
  2⤵
  PID:9036
- C:\Windows\System\NmQkuaf.exe
  C:\Windows\System\NmQkuaf.exe
  2⤵
  PID:9060
- C:\Windows\System\olzEMiI.exe
  C:\Windows\System\olzEMiI.exe
  2⤵
  PID:9084
- C:\Windows\System\lqczYar.exe
  C:\Windows\System\lqczYar.exe
  2⤵
  PID:9108
- C:\Windows\System\tnvGSnC.exe
  C:\Windows\System\tnvGSnC.exe
  2⤵
  PID:9132
- C:\Windows\System\brfcIbo.exe
  C:\Windows\System\brfcIbo.exe
  2⤵
  PID:9168
- C:\Windows\System\lWNZrsA.exe
  C:\Windows\System\lWNZrsA.exe
  2⤵
  PID:9192
- C:\Windows\System\slVCHdC.exe
  C:\Windows\System\slVCHdC.exe
  2⤵
  PID:9212
- C:\Windows\System\BxQYRMd.exe
  C:\Windows\System\BxQYRMd.exe
  2⤵
  PID:7076
- C:\Windows\System\GjBXTdR.exe
  C:\Windows\System\GjBXTdR.exe
  2⤵
  PID:7004
- C:\Windows\System\dDrkuYG.exe
  C:\Windows\System\dDrkuYG.exe
  2⤵
  PID:6960
- C:\Windows\System\tmXTREF.exe
  C:\Windows\System\tmXTREF.exe
  2⤵
  PID:6912
- C:\Windows\System\NTLfuuq.exe
  C:\Windows\System\NTLfuuq.exe
  2⤵
  PID:6864
- C:\Windows\System\bfFWIBn.exe
  C:\Windows\System\bfFWIBn.exe
  2⤵
  PID:5500
- C:\Windows\System\AGFLlId.exe
  C:\Windows\System\AGFLlId.exe
  2⤵
  PID:5208
- C:\Windows\System\ADZLZeZ.exe
  C:\Windows\System\ADZLZeZ.exe
  2⤵
  PID:5748
- C:\Windows\System\fbZjLmY.exe
  C:\Windows\System\fbZjLmY.exe
  2⤵
  PID:7196
- C:\Windows\System\VufkGNU.exe
  C:\Windows\System\VufkGNU.exe
  2⤵
  PID:7396
- C:\Windows\System\JFLrBLh.exe
  C:\Windows\System\JFLrBLh.exe
  2⤵
  PID:7424
- C:\Windows\System\XBbfquK.exe
  C:\Windows\System\XBbfquK.exe
  2⤵
  PID:7468
- C:\Windows\System\hsUXgCe.exe
  C:\Windows\System\hsUXgCe.exe
  2⤵
  PID:7492
- C:\Windows\System\fuoWPGs.exe
  C:\Windows\System\fuoWPGs.exe
  2⤵
  PID:7536
- C:\Windows\System\GkohEXb.exe
  C:\Windows\System\GkohEXb.exe
  2⤵
  PID:7576
- C:\Windows\System\VNVpHJc.exe
  C:\Windows\System\VNVpHJc.exe
  2⤵
  PID:7624
- C:\Windows\System\OKLXDnE.exe
  C:\Windows\System\OKLXDnE.exe
  2⤵
  PID:7672
- C:\Windows\System\RAtlvik.exe
  C:\Windows\System\RAtlvik.exe
  2⤵
  PID:7724
- C:\Windows\System\JxzogkN.exe
  C:\Windows\System\JxzogkN.exe
  2⤵
  PID:7844
- C:\Windows\System\vhLrWwJ.exe
  C:\Windows\System\vhLrWwJ.exe
  2⤵
  PID:8428
- C:\Windows\System\BETxfzQ.exe
  C:\Windows\System\BETxfzQ.exe
  2⤵
  PID:7900
- C:\Windows\System\iaOkcOC.exe
  C:\Windows\System\iaOkcOC.exe
  2⤵
  PID:7872
- C:\Windows\System\KgahgNM.exe
  C:\Windows\System\KgahgNM.exe
  2⤵
  PID:8504
- C:\Windows\System\rZoPVNx.exe
  C:\Windows\System\rZoPVNx.exe
  2⤵
  PID:6780
- C:\Windows\System\IdtdCNR.exe
  C:\Windows\System\IdtdCNR.exe
  2⤵
  PID:6464
- C:\Windows\System\yyFBjDg.exe
  C:\Windows\System\yyFBjDg.exe
  2⤵
  PID:6372
- C:\Windows\System\AgvpNTe.exe
  C:\Windows\System\AgvpNTe.exe
  2⤵
  PID:6296
- C:\Windows\System\poqTcbr.exe
  C:\Windows\System\poqTcbr.exe
  2⤵
  PID:6216
- C:\Windows\System\DuCLHRy.exe
  C:\Windows\System\DuCLHRy.exe
  2⤵
  PID:4752
- C:\Windows\System\hDVEOjT.exe
  C:\Windows\System\hDVEOjT.exe
  2⤵
  PID:8188
- C:\Windows\System\zavmCoY.exe
  C:\Windows\System\zavmCoY.exe
  2⤵
  PID:8152
- C:\Windows\System\CClGTXa.exe
  C:\Windows\System\CClGTXa.exe
  2⤵
  PID:8108
- C:\Windows\System\RkdXKBh.exe
  C:\Windows\System\RkdXKBh.exe
  2⤵
  PID:8056
- C:\Windows\System\MLLBnVu.exe
  C:\Windows\System\MLLBnVu.exe
  2⤵
  PID:7984
- C:\Windows\System\PuaeBVr.exe
  C:\Windows\System\PuaeBVr.exe
  2⤵
  PID:8856
- C:\Windows\System\dWOAMMa.exe
  C:\Windows\System\dWOAMMa.exe
  2⤵
  PID:8952
- C:\Windows\System\OZzQRjz.exe
  C:\Windows\System\OZzQRjz.exe
  2⤵
  PID:9028
- C:\Windows\System\FWovzpY.exe
  C:\Windows\System\FWovzpY.exe
  2⤵
  PID:9224
- C:\Windows\System\HNbTCEU.exe
  C:\Windows\System\HNbTCEU.exe
  2⤵
  PID:9252
- C:\Windows\System\KIEVnUF.exe
  C:\Windows\System\KIEVnUF.exe
  2⤵
  PID:9272
- C:\Windows\System\gVuIqQm.exe
  C:\Windows\System\gVuIqQm.exe
  2⤵
  PID:9300
- C:\Windows\System\nQjqrgp.exe
  C:\Windows\System\nQjqrgp.exe
  2⤵
  PID:9320
- C:\Windows\System\bBQdQXj.exe
  C:\Windows\System\bBQdQXj.exe
  2⤵
  PID:9360
- C:\Windows\System\XMtLGve.exe
  C:\Windows\System\XMtLGve.exe
  2⤵
  PID:9380
- C:\Windows\System\ldLooJY.exe
  C:\Windows\System\ldLooJY.exe
  2⤵
  PID:9396
- C:\Windows\System\sOFoVCw.exe
  C:\Windows\System\sOFoVCw.exe
  2⤵
  PID:9428
- C:\Windows\System\cnLMHGr.exe
  C:\Windows\System\cnLMHGr.exe
  2⤵
  PID:9448
- C:\Windows\System\oRFVgdy.exe
  C:\Windows\System\oRFVgdy.exe
  2⤵
  PID:9476
- C:\Windows\System\SnTSQdi.exe
  C:\Windows\System\SnTSQdi.exe
  2⤵
  PID:9496
- C:\Windows\System\wENeQdM.exe
  C:\Windows\System\wENeQdM.exe
  2⤵
  PID:9512
- C:\Windows\System\fEhoKwI.exe
  C:\Windows\System\fEhoKwI.exe
  2⤵
  PID:9532
- C:\Windows\System\qKKAoVx.exe
  C:\Windows\System\qKKAoVx.exe
  2⤵
  PID:9552
- C:\Windows\System\SDQyadk.exe
  C:\Windows\System\SDQyadk.exe
  2⤵
  PID:9576
- C:\Windows\System\VtaygpO.exe
  C:\Windows\System\VtaygpO.exe
  2⤵
  PID:9596
- C:\Windows\System\RpCWaqI.exe
  C:\Windows\System\RpCWaqI.exe
  2⤵
  PID:9624
- C:\Windows\System\OjgwVbY.exe
  C:\Windows\System\OjgwVbY.exe
  2⤵
  PID:9648
- C:\Windows\System\heegcnU.exe
  C:\Windows\System\heegcnU.exe
  2⤵
  PID:9672
- C:\Windows\System\ckjCNOk.exe
  C:\Windows\System\ckjCNOk.exe
  2⤵
  PID:9696
- C:\Windows\System\kgSVKIY.exe
  C:\Windows\System\kgSVKIY.exe
  2⤵
  PID:9804
- C:\Windows\System\xlfAZdr.exe
  C:\Windows\System\xlfAZdr.exe
  2⤵
  PID:9832
- C:\Windows\System\ofHnxTq.exe
  C:\Windows\System\ofHnxTq.exe
  2⤵
  PID:9852
- C:\Windows\System\ZyhygOk.exe
  C:\Windows\System\ZyhygOk.exe
  2⤵
  PID:9876
- C:\Windows\System\vnJBrSY.exe
  C:\Windows\System\vnJBrSY.exe
  2⤵
  PID:9904
- C:\Windows\System\rBKXVOP.exe
  C:\Windows\System\rBKXVOP.exe
  2⤵
  PID:9928
- C:\Windows\System\VDsJHAZ.exe
  C:\Windows\System\VDsJHAZ.exe
  2⤵
  PID:9948
- C:\Windows\System\auRHjdx.exe
  C:\Windows\System\auRHjdx.exe
  2⤵
  PID:9976
- C:\Windows\System\WOEsFtx.exe
  C:\Windows\System\WOEsFtx.exe
  2⤵
  PID:9992
- C:\Windows\System\wxfqlnV.exe
  C:\Windows\System\wxfqlnV.exe
  2⤵
  PID:10016
- C:\Windows\System\eoopeot.exe
  C:\Windows\System\eoopeot.exe
  2⤵
  PID:10036
- C:\Windows\System\kUshYaz.exe
  C:\Windows\System\kUshYaz.exe
  2⤵
  PID:10056
- C:\Windows\System\sBSCLIZ.exe
  C:\Windows\System\sBSCLIZ.exe
  2⤵
  PID:10080
- C:\Windows\System\GlCURoQ.exe
  C:\Windows\System\GlCURoQ.exe
  2⤵
  PID:10100
- C:\Windows\System\VFBzYBS.exe
  C:\Windows\System\VFBzYBS.exe
  2⤵
  PID:10120
- C:\Windows\System\TitCsyk.exe
  C:\Windows\System\TitCsyk.exe
  2⤵
  PID:10140
- C:\Windows\System\XOfghZi.exe
  C:\Windows\System\XOfghZi.exe
  2⤵
  PID:10156
- C:\Windows\System\RPaHZPj.exe
  C:\Windows\System\RPaHZPj.exe
  2⤵
  PID:10184
- C:\Windows\System\LyaDGFD.exe
  C:\Windows\System\LyaDGFD.exe
  2⤵
  PID:10208
- C:\Windows\System\qnHRNtR.exe
  C:\Windows\System\qnHRNtR.exe
  2⤵
  PID:10236
- C:\Windows\System\vhaIeZy.exe
  C:\Windows\System\vhaIeZy.exe
  2⤵
  PID:6988
- C:\Windows\System\nwYEVgs.exe
  C:\Windows\System\nwYEVgs.exe
  2⤵
  PID:6880
- C:\Windows\System\ULleMYC.exe
  C:\Windows\System\ULleMYC.exe
  2⤵
  PID:8548
- C:\Windows\System\ccutSOa.exe
  C:\Windows\System\ccutSOa.exe
  2⤵
  PID:8196
- C:\Windows\System\wXBRBOz.exe
  C:\Windows\System\wXBRBOz.exe
  2⤵
  PID:8236
- C:\Windows\System\Yxwtpqs.exe
  C:\Windows\System\Yxwtpqs.exe
  2⤵
  PID:8304
- C:\Windows\System\wFolykc.exe
  C:\Windows\System\wFolykc.exe
  2⤵
  PID:8328
- C:\Windows\System\nIxDhry.exe
  C:\Windows\System\nIxDhry.exe
  2⤵
  PID:7740
- C:\Windows\System\SBWgeVv.exe
  C:\Windows\System\SBWgeVv.exe
  2⤵
  PID:7600
- C:\Windows\System\hvIsaCo.exe
  C:\Windows\System\hvIsaCo.exe
  2⤵
  PID:7848
- C:\Windows\System\gtiCZhJ.exe
  C:\Windows\System\gtiCZhJ.exe
  2⤵
  PID:8348
- C:\Windows\System\WtAVjeR.exe
  C:\Windows\System\WtAVjeR.exe
  2⤵
  PID:6252
- C:\Windows\System\otlcEbR.exe
  C:\Windows\System\otlcEbR.exe
  2⤵
  PID:1532
- C:\Windows\System\WsjKDoH.exe
  C:\Windows\System\WsjKDoH.exe
  2⤵
  PID:8128
- C:\Windows\System\tDXAiBk.exe
  C:\Windows\System\tDXAiBk.exe
  2⤵
  PID:9004
- C:\Windows\System\YsDtpmk.exe
  C:\Windows\System\YsDtpmk.exe
  2⤵
  PID:9044
- C:\Windows\System\RPMiFiu.exe
  C:\Windows\System\RPMiFiu.exe
  2⤵
  PID:9092
- C:\Windows\System\WjIRRKK.exe
  C:\Windows\System\WjIRRKK.exe
  2⤵
  PID:8976
- C:\Windows\System\UrbGpiA.exe
  C:\Windows\System\UrbGpiA.exe
  2⤵
  PID:9240
- C:\Windows\System\DWcBTeY.exe
  C:\Windows\System\DWcBTeY.exe
  2⤵
  PID:9208
- C:\Windows\System\VgDZKdQ.exe
  C:\Windows\System\VgDZKdQ.exe
  2⤵
  PID:9488
- C:\Windows\System\vBQzMkF.exe
  C:\Windows\System\vBQzMkF.exe
  2⤵
  PID:8476
- C:\Windows\System\kTvcXca.exe
  C:\Windows\System\kTvcXca.exe
  2⤵
  PID:9644
- C:\Windows\System\KAdszcf.exe
  C:\Windows\System\KAdszcf.exe
  2⤵
  PID:10244
- C:\Windows\System\sSYkGyl.exe
  C:\Windows\System\sSYkGyl.exe
  2⤵
  PID:10268
- C:\Windows\System\CFtWPCm.exe
  C:\Windows\System\CFtWPCm.exe
  2⤵
  PID:10292
- C:\Windows\System\IJzotrp.exe
  C:\Windows\System\IJzotrp.exe
  2⤵
  PID:10316
- C:\Windows\System\WJUeAft.exe
  C:\Windows\System\WJUeAft.exe
  2⤵
  PID:10340
- C:\Windows\System\YuKPcXD.exe
  C:\Windows\System\YuKPcXD.exe
  2⤵
  PID:10364
- C:\Windows\System\lbjBXrX.exe
  C:\Windows\System\lbjBXrX.exe
  2⤵
  PID:10432
- C:\Windows\System\LvZMmUA.exe
  C:\Windows\System\LvZMmUA.exe
  2⤵
  PID:10460
- C:\Windows\System\BiJBfFL.exe
  C:\Windows\System\BiJBfFL.exe
  2⤵
  PID:10484
- C:\Windows\System\EIbDtYk.exe
  C:\Windows\System\EIbDtYk.exe
  2⤵
  PID:10504
- C:\Windows\System\exORKuh.exe
  C:\Windows\System\exORKuh.exe
  2⤵
  PID:10528
- C:\Windows\System\IGXemow.exe
  C:\Windows\System\IGXemow.exe
  2⤵
  PID:10548
- C:\Windows\System\xwwJyBt.exe
  C:\Windows\System\xwwJyBt.exe
  2⤵
  PID:10568
- C:\Windows\System\DEYHKpD.exe
  C:\Windows\System\DEYHKpD.exe
  2⤵
  PID:10592
- C:\Windows\System\yKtGrQe.exe
  C:\Windows\System\yKtGrQe.exe
  2⤵
  PID:10612
- C:\Windows\System\WxMkykw.exe
  C:\Windows\System\WxMkykw.exe
  2⤵
  PID:10640
- C:\Windows\System\uIfGKLt.exe
  C:\Windows\System\uIfGKLt.exe
  2⤵
  PID:10664
- C:\Windows\System\uACfeMP.exe
  C:\Windows\System\uACfeMP.exe
  2⤵
  PID:10684
- C:\Windows\System\OAgfZcA.exe
  C:\Windows\System\OAgfZcA.exe
  2⤵
  PID:10700
- C:\Windows\System\nxnsCae.exe
  C:\Windows\System\nxnsCae.exe
  2⤵
  PID:10724
- C:\Windows\System\FlgBLTK.exe
  C:\Windows\System\FlgBLTK.exe
  2⤵
  PID:10748
- C:\Windows\System\cBrxqJy.exe
  C:\Windows\System\cBrxqJy.exe
  2⤵
  PID:10772
- C:\Windows\System\XbDJeRE.exe
  C:\Windows\System\XbDJeRE.exe
  2⤵
  PID:10796
- C:\Windows\System\erZRDIO.exe
  C:\Windows\System\erZRDIO.exe
  2⤵
  PID:10816
- C:\Windows\System\uFfqyQT.exe
  C:\Windows\System\uFfqyQT.exe
  2⤵
  PID:10832
- C:\Windows\System\szIkSdp.exe
  C:\Windows\System\szIkSdp.exe
  2⤵
  PID:10856
- C:\Windows\System\HXcSEfT.exe
  C:\Windows\System\HXcSEfT.exe
  2⤵
  PID:10876
- C:\Windows\System\EDsFmyT.exe
  C:\Windows\System\EDsFmyT.exe
  2⤵
  PID:10896
- C:\Windows\System\fYXQmva.exe
  C:\Windows\System\fYXQmva.exe
  2⤵
  PID:10916
- C:\Windows\System\OOzSxJE.exe
  C:\Windows\System\OOzSxJE.exe
  2⤵
  PID:10940
- C:\Windows\System\coVetnb.exe
  C:\Windows\System\coVetnb.exe
  2⤵
  PID:10976
- C:\Windows\System\FfIPjwt.exe
  C:\Windows\System\FfIPjwt.exe
  2⤵
  PID:10996
- C:\Windows\System\BGPnFCE.exe
  C:\Windows\System\BGPnFCE.exe
  2⤵
  PID:11024
- C:\Windows\System\GPrdkMe.exe
  C:\Windows\System\GPrdkMe.exe
  2⤵
  PID:11048
- C:\Windows\System\ocvcfJa.exe
  C:\Windows\System\ocvcfJa.exe
  2⤵
  PID:11068
- C:\Windows\System\qlCKWTP.exe
  C:\Windows\System\qlCKWTP.exe
  2⤵
  PID:11092
- C:\Windows\System\bhRRiXh.exe
  C:\Windows\System\bhRRiXh.exe
  2⤵
  PID:11108
- C:\Windows\System\TIfjSet.exe
  C:\Windows\System\TIfjSet.exe
  2⤵
  PID:11128
- C:\Windows\System\AQHKAKq.exe
  C:\Windows\System\AQHKAKq.exe
  2⤵
  PID:11144
- C:\Windows\System\fbOPLdC.exe
  C:\Windows\System\fbOPLdC.exe
  2⤵
  PID:11164
- C:\Windows\System\ORPNSlO.exe
  C:\Windows\System\ORPNSlO.exe
  2⤵
  PID:11180
- C:\Windows\System\FaCOozJ.exe
  C:\Windows\System\FaCOozJ.exe
  2⤵
  PID:11204
- C:\Windows\System\tRvVESG.exe
  C:\Windows\System\tRvVESG.exe
  2⤵
  PID:11224
- C:\Windows\System\WeLjTxP.exe
  C:\Windows\System\WeLjTxP.exe
  2⤵
  PID:11252
- C:\Windows\System\MPyMQjY.exe
  C:\Windows\System\MPyMQjY.exe
  2⤵
  PID:8608
- C:\Windows\System\StofDXz.exe
  C:\Windows\System\StofDXz.exe
  2⤵
  PID:8640
- C:\Windows\System\TMlPwVb.exe
  C:\Windows\System\TMlPwVb.exe
  2⤵
  PID:8756
- C:\Windows\System\IMAVAuw.exe
  C:\Windows\System\IMAVAuw.exe
  2⤵
  PID:7520
- C:\Windows\System\lrAkbiA.exe
  C:\Windows\System\lrAkbiA.exe
  2⤵
  PID:8448
- C:\Windows\System\nBlzzqP.exe
  C:\Windows\System\nBlzzqP.exe
  2⤵
  PID:9924
- C:\Windows\System\XOUCZCh.exe
  C:\Windows\System\XOUCZCh.exe
  2⤵
  PID:6476
- C:\Windows\System\DjkNVbr.exe
  C:\Windows\System\DjkNVbr.exe
  2⤵
  PID:9984
- C:\Windows\System\QEdqnqX.exe
  C:\Windows\System\QEdqnqX.exe
  2⤵
  PID:6168
- C:\Windows\System\EaAUEKj.exe
  C:\Windows\System\EaAUEKj.exe
  2⤵
  PID:10092
- C:\Windows\System\JozOKDR.exe
  C:\Windows\System\JozOKDR.exe
  2⤵
  PID:9052
- C:\Windows\System\WSuRNqH.exe
  C:\Windows\System\WSuRNqH.exe
  2⤵
  PID:8820
- C:\Windows\System\bemEGgI.exe
  C:\Windows\System\bemEGgI.exe
  2⤵
  PID:9220
- C:\Windows\System\cWkpcam.exe
  C:\Windows\System\cWkpcam.exe
  2⤵
  PID:9268
- C:\Windows\System\NJoxWcK.exe
  C:\Windows\System\NJoxWcK.exe
  2⤵
  PID:10224
- C:\Windows\System\zbhzhOW.exe
  C:\Windows\System\zbhzhOW.exe
  2⤵
  PID:6972
- C:\Windows\System\ngEaaIj.exe
  C:\Windows\System\ngEaaIj.exe
  2⤵
  PID:9392
- C:\Windows\System\PKWaxlw.exe
  C:\Windows\System\PKWaxlw.exe
  2⤵
  PID:9468
- C:\Windows\System\CiQWopZ.exe
  C:\Windows\System\CiQWopZ.exe
  2⤵
  PID:9560
- C:\Windows\System\cEKktHG.exe
  C:\Windows\System\cEKktHG.exe
  2⤵
  PID:7472
- C:\Windows\System\CuWytRQ.exe
  C:\Windows\System\CuWytRQ.exe
  2⤵
  PID:8524
- C:\Windows\System\PtohhFG.exe
  C:\Windows\System\PtohhFG.exe
  2⤵
  PID:5368
- C:\Windows\System\hKjsMyd.exe
  C:\Windows\System\hKjsMyd.exe
  2⤵
  PID:9032
- C:\Windows\System\kbHKyUM.exe
  C:\Windows\System\kbHKyUM.exe
  2⤵
  PID:9284
- C:\Windows\System\DacrXbe.exe
  C:\Windows\System\DacrXbe.exe
  2⤵
  PID:7260
- C:\Windows\System\dVVHGtB.exe
  C:\Windows\System\dVVHGtB.exe
  2⤵
  PID:10372
- C:\Windows\System\KmEyAIy.exe
  C:\Windows\System\KmEyAIy.exe
  2⤵
  PID:2660
- C:\Windows\System\tfPlrpR.exe
  C:\Windows\System\tfPlrpR.exe
  2⤵
  PID:7452
- C:\Windows\System\KyNlaYR.exe
  C:\Windows\System\KyNlaYR.exe
  2⤵
  PID:7608
- C:\Windows\System\GZZaDbC.exe
  C:\Windows\System\GZZaDbC.exe
  2⤵
  PID:7448
- C:\Windows\System\UygbeNb.exe
  C:\Windows\System\UygbeNb.exe
  2⤵
  PID:10492
- C:\Windows\System\KFwouiQ.exe
  C:\Windows\System\KFwouiQ.exe
  2⤵
  PID:10540
- C:\Windows\System\kiZFUTS.exe
  C:\Windows\System\kiZFUTS.exe
  2⤵
  PID:10620
- C:\Windows\System\jVXVAep.exe
  C:\Windows\System\jVXVAep.exe
  2⤵
  PID:10692
- C:\Windows\System\npHVdLU.exe
  C:\Windows\System\npHVdLU.exe
  2⤵
  PID:11280
- C:\Windows\System\XOQSmMB.exe
  C:\Windows\System\XOQSmMB.exe
  2⤵
  PID:11304
- C:\Windows\System\zLpgxUf.exe
  C:\Windows\System\zLpgxUf.exe
  2⤵
  PID:11320
- C:\Windows\System\FlUwtUw.exe
  C:\Windows\System\FlUwtUw.exe
  2⤵
  PID:11340
- C:\Windows\System\lxBYmTL.exe
  C:\Windows\System\lxBYmTL.exe
  2⤵
  PID:11360
- C:\Windows\System\tlhiCQa.exe
  C:\Windows\System\tlhiCQa.exe
  2⤵
  PID:11376
- C:\Windows\System\nuFbwmc.exe
  C:\Windows\System\nuFbwmc.exe
  2⤵
  PID:11392
- C:\Windows\System\DPguTKX.exe
  C:\Windows\System\DPguTKX.exe
  2⤵
  PID:11412
- C:\Windows\System\bryvrWS.exe
  C:\Windows\System\bryvrWS.exe
  2⤵
  PID:11432
- C:\Windows\System\VrSiCaz.exe
  C:\Windows\System\VrSiCaz.exe
  2⤵
  PID:11456
- C:\Windows\System\HaPotOs.exe
  C:\Windows\System\HaPotOs.exe
  2⤵
  PID:11476
- C:\Windows\System\JCpUIhP.exe
  C:\Windows\System\JCpUIhP.exe
  2⤵
  PID:11500
- C:\Windows\System\qpWUmuS.exe
  C:\Windows\System\qpWUmuS.exe
  2⤵
  PID:11524
- C:\Windows\System\CLNDfAQ.exe
  C:\Windows\System\CLNDfAQ.exe
  2⤵
  PID:11552
- C:\Windows\System\LWcBpSr.exe
  C:\Windows\System\LWcBpSr.exe
  2⤵
  PID:11572
- C:\Windows\System\WkJSXcd.exe
  C:\Windows\System\WkJSXcd.exe
  2⤵
  PID:11600
- C:\Windows\System\ytHpxAB.exe
  C:\Windows\System\ytHpxAB.exe
  2⤵
  PID:11620
- C:\Windows\System\pCiZvJB.exe
  C:\Windows\System\pCiZvJB.exe
  2⤵
  PID:11640
- C:\Windows\System\RdfSYtN.exe
  C:\Windows\System\RdfSYtN.exe
  2⤵
  PID:11664
- C:\Windows\System\aQaAVKE.exe
  C:\Windows\System\aQaAVKE.exe
  2⤵
  PID:11688
- C:\Windows\System\RkNaDpC.exe
  C:\Windows\System\RkNaDpC.exe
  2⤵
  PID:11708
- C:\Windows\System\cVrDiEb.exe
  C:\Windows\System\cVrDiEb.exe
  2⤵
  PID:11728
- C:\Windows\System\JjIrAqO.exe
  C:\Windows\System\JjIrAqO.exe
  2⤵
  PID:11748
- C:\Windows\System\kvQcxeX.exe
  C:\Windows\System\kvQcxeX.exe
  2⤵
  PID:11772
- C:\Windows\System\RFTKLhg.exe
  C:\Windows\System\RFTKLhg.exe
  2⤵
  PID:11808
- C:\Windows\System\pfYgQmF.exe
  C:\Windows\System\pfYgQmF.exe
  2⤵
  PID:11832
- C:\Windows\System\UsjgDTZ.exe
  C:\Windows\System\UsjgDTZ.exe
  2⤵
  PID:11856
- C:\Windows\System\ZJJpmLB.exe
  C:\Windows\System\ZJJpmLB.exe
  2⤵
  PID:11884
- C:\Windows\System\vXkEIwo.exe
  C:\Windows\System\vXkEIwo.exe
  2⤵
  PID:11904
- C:\Windows\System\nmGSzkL.exe
  C:\Windows\System\nmGSzkL.exe
  2⤵
  PID:11928
- C:\Windows\System\NipsSVA.exe
  C:\Windows\System\NipsSVA.exe
  2⤵
  PID:11948
- C:\Windows\System\stoQnLF.exe
  C:\Windows\System\stoQnLF.exe
  2⤵
  PID:11972
- C:\Windows\System\LeImCuY.exe
  C:\Windows\System\LeImCuY.exe
  2⤵
  PID:11996
- C:\Windows\System\yXzVytm.exe
  C:\Windows\System\yXzVytm.exe
  2⤵
  PID:12016
- C:\Windows\System\mgYjEBB.exe
  C:\Windows\System\mgYjEBB.exe
  2⤵
  PID:12032
- C:\Windows\System\CEzeoTE.exe
  C:\Windows\System\CEzeoTE.exe
  2⤵
  PID:12052
- C:\Windows\System\QatWZdi.exe
  C:\Windows\System\QatWZdi.exe
  2⤵
  PID:12072
- C:\Windows\System\zBvnUhs.exe
  C:\Windows\System\zBvnUhs.exe
  2⤵
  PID:12088
- C:\Windows\System\reEurjK.exe
  C:\Windows\System\reEurjK.exe
  2⤵
  PID:12104
- C:\Windows\System\vkXvSMn.exe
  C:\Windows\System\vkXvSMn.exe
  2⤵
  PID:12120
- C:\Windows\System\VKKlBzL.exe
  C:\Windows\System\VKKlBzL.exe
  2⤵
  PID:12136
- C:\Windows\System\AZJnrRO.exe
  C:\Windows\System\AZJnrRO.exe
  2⤵
  PID:12152
- C:\Windows\System\aWlRIBP.exe
  C:\Windows\System\aWlRIBP.exe
  2⤵
  PID:12176
- C:\Windows\System\wJbFzTa.exe
  C:\Windows\System\wJbFzTa.exe
  2⤵
  PID:12196
- C:\Windows\System\swYHYFb.exe
  C:\Windows\System\swYHYFb.exe
  2⤵
  PID:12224
- C:\Windows\System\SooGOJq.exe
  C:\Windows\System\SooGOJq.exe
  2⤵
  PID:12248
- C:\Windows\System\uheDEse.exe
  C:\Windows\System\uheDEse.exe
  2⤵
  PID:12272
- C:\Windows\System\VipdKPj.exe
  C:\Windows\System\VipdKPj.exe
  2⤵
  PID:10172
- C:\Windows\System\fvDmLit.exe
  C:\Windows\System\fvDmLit.exe
  2⤵
  PID:11040
- C:\Windows\System\ldPwLOX.exe
  C:\Windows\System\ldPwLOX.exe
  2⤵
  PID:11084
- C:\Windows\System\euRDZqn.exe
  C:\Windows\System\euRDZqn.exe
  2⤵
  PID:11100
- C:\Windows\System\YASmQxQ.exe
  C:\Windows\System\YASmQxQ.exe
  2⤵
  PID:8960
- C:\Windows\System\cERdmub.exe
  C:\Windows\System\cERdmub.exe
  2⤵
  PID:2340
- C:\Windows\System\LytSBRI.exe
  C:\Windows\System\LytSBRI.exe
  2⤵
  PID:4908
- C:\Windows\System\KCKzjoY.exe
  C:\Windows\System\KCKzjoY.exe
  2⤵
  PID:9680
- C:\Windows\System\BYgqWvW.exe
  C:\Windows\System\BYgqWvW.exe
  2⤵
  PID:9748
- C:\Windows\System\rgPMROd.exe
  C:\Windows\System\rgPMROd.exe
  2⤵
  PID:9812
- C:\Windows\System\WCvtwKK.exe
  C:\Windows\System\WCvtwKK.exe
  2⤵
  PID:8320
- C:\Windows\System\jsZGuRt.exe
  C:\Windows\System\jsZGuRt.exe
  2⤵
  PID:10520
- C:\Windows\System\tIdBRHg.exe
  C:\Windows\System\tIdBRHg.exe
  2⤵
  PID:12296
- C:\Windows\System\WoibbcI.exe
  C:\Windows\System\WoibbcI.exe
  2⤵
  PID:12316
- C:\Windows\System\vRdxXjn.exe
  C:\Windows\System\vRdxXjn.exe
  2⤵
  PID:12340
- C:\Windows\System\QkFtyJP.exe
  C:\Windows\System\QkFtyJP.exe
  2⤵
  PID:12364
- C:\Windows\System\zTUZrtV.exe
  C:\Windows\System\zTUZrtV.exe
  2⤵
  PID:12384
- C:\Windows\System\SKrrHke.exe
  C:\Windows\System\SKrrHke.exe
  2⤵
  PID:12416
- C:\Windows\System\yCuFCyv.exe
  C:\Windows\System\yCuFCyv.exe
  2⤵
  PID:12440
- C:\Windows\System\sEHkaxz.exe
  C:\Windows\System\sEHkaxz.exe
  2⤵
  PID:12460
- C:\Windows\System\FRGlEgR.exe
  C:\Windows\System\FRGlEgR.exe
  2⤵
  PID:12484
- C:\Windows\System\AUaMNKV.exe
  C:\Windows\System\AUaMNKV.exe
  2⤵
  PID:12512
- C:\Windows\System\CXAfPGQ.exe
  C:\Windows\System\CXAfPGQ.exe
  2⤵
  PID:12544
- C:\Windows\System\fxYCONH.exe
  C:\Windows\System\fxYCONH.exe
  2⤵
  PID:12564
- C:\Windows\System\aClKydP.exe
  C:\Windows\System\aClKydP.exe
  2⤵
  PID:12592
- C:\Windows\System\gXcNHhs.exe
  C:\Windows\System\gXcNHhs.exe
  2⤵
  PID:12616
- C:\Windows\System\ydKIkNN.exe
  C:\Windows\System\ydKIkNN.exe
  2⤵
  PID:12644
- C:\Windows\System\cAqESWY.exe
  C:\Windows\System\cAqESWY.exe
  2⤵
  PID:12672
- C:\Windows\System\tISUPHK.exe
  C:\Windows\System\tISUPHK.exe
  2⤵
  PID:12716
- C:\Windows\System\UVMDhdH.exe
  C:\Windows\System\UVMDhdH.exe
  2⤵
  PID:12732
- C:\Windows\System\xNjvmBo.exe
  C:\Windows\System\xNjvmBo.exe
  2⤵
  PID:12756
- C:\Windows\System\IeTGYad.exe
  C:\Windows\System\IeTGYad.exe
  2⤵
  PID:12784
- C:\Windows\System\xKNkuKt.exe
  C:\Windows\System\xKNkuKt.exe
  2⤵
  PID:12816
- C:\Windows\System\iGvUMTH.exe
  C:\Windows\System\iGvUMTH.exe
  2⤵
  PID:12844
- C:\Windows\System\UMCfmaS.exe
  C:\Windows\System\UMCfmaS.exe
  2⤵
  PID:12884
- C:\Windows\System\xpfUkPY.exe
  C:\Windows\System\xpfUkPY.exe
  2⤵
  PID:12912
- C:\Windows\System\AZELawi.exe
  C:\Windows\System\AZELawi.exe
  2⤵
  PID:12936
- C:\Windows\System\OVDOFJy.exe
  C:\Windows\System\OVDOFJy.exe
  2⤵
  PID:12960
- C:\Windows\System\JrdOzkF.exe
  C:\Windows\System\JrdOzkF.exe
  2⤵
  PID:12996
- C:\Windows\System\VhaKFuo.exe
  C:\Windows\System\VhaKFuo.exe
  2⤵
  PID:13016
- C:\Windows\System\swewFtH.exe
  C:\Windows\System\swewFtH.exe
  2⤵
  PID:13044
- C:\Windows\System\MZtKRCc.exe
  C:\Windows\System\MZtKRCc.exe
  2⤵
  PID:13064
- C:\Windows\System\sWacRlZ.exe
  C:\Windows\System\sWacRlZ.exe
  2⤵
  PID:13092
- C:\Windows\System\jQkYnMa.exe
  C:\Windows\System\jQkYnMa.exe
  2⤵
  PID:13116
- C:\Windows\System\fkLsDXa.exe
  C:\Windows\System\fkLsDXa.exe
  2⤵
  PID:13140
- C:\Windows\System\hSMVvMP.exe
  C:\Windows\System\hSMVvMP.exe
  2⤵
  PID:13168
- C:\Windows\System\FHOAlbB.exe
  C:\Windows\System\FHOAlbB.exe
  2⤵
  PID:13188
- C:\Windows\System\VjygLAI.exe
  C:\Windows\System\VjygLAI.exe
  2⤵
  PID:13212
- C:\Windows\System\ZVpfdin.exe
  C:\Windows\System\ZVpfdin.exe
  2⤵
  PID:13232
- C:\Windows\System\BkiUUrg.exe
  C:\Windows\System\BkiUUrg.exe
  2⤵
  PID:13256
- C:\Windows\System\yEMhDNM.exe
  C:\Windows\System\yEMhDNM.exe
  2⤵
  PID:13284
- C:\Windows\System\upJURTF.exe
  C:\Windows\System\upJURTF.exe
  2⤵
  PID:13308
- C:\Windows\System\vKQBUqm.exe
  C:\Windows\System\vKQBUqm.exe
  2⤵
  PID:9972
- C:\Windows\System\xvrVzPk.exe
  C:\Windows\System\xvrVzPk.exe
  2⤵
  PID:10068
- C:\Windows\System\WNuajmA.exe
  C:\Windows\System\WNuajmA.exe
  2⤵
  PID:10744
- C:\Windows\System\oTvHSNp.exe
  C:\Windows\System\oTvHSNp.exe
  2⤵
  PID:10648
- C:\Windows\System\WcHcaVy.exe
  C:\Windows\System\WcHcaVy.exe
  2⤵
  PID:10788
- C:\Windows\System\jfrNfgt.exe
  C:\Windows\System\jfrNfgt.exe
  2⤵
  PID:11444
- C:\Windows\System\XPqRYga.exe
  C:\Windows\System\XPqRYga.exe
  2⤵
  PID:11648
- C:\Windows\System\tbLTovK.exe
  C:\Windows\System\tbLTovK.exe
  2⤵
  PID:7664
- C:\Windows\System\qaYoWUb.exe
  C:\Windows\System\qaYoWUb.exe
  2⤵
  PID:11300
- C:\Windows\System\RwWKHgm.exe
  C:\Windows\System\RwWKHgm.exe
  2⤵
  PID:11368
- C:\Windows\System\pkboMEo.exe
  C:\Windows\System\pkboMEo.exe
  2⤵
  PID:11404
- C:\Windows\System\KAdsWND.exe
  C:\Windows\System\KAdsWND.exe
  2⤵
  PID:11492
- C:\Windows\System\btfjwPc.exe
  C:\Windows\System\btfjwPc.exe
  2⤵
  PID:11544
- C:\Windows\System\DYWrDXj.exe
  C:\Windows\System\DYWrDXj.exe
  2⤵
  PID:11596
- C:\Windows\System\LfOlrdC.exe
  C:\Windows\System\LfOlrdC.exe
  2⤵
  PID:11756
- C:\Windows\System\WyWqoGg.exe
  C:\Windows\System\WyWqoGg.exe
  2⤵
  PID:12932
- C:\Windows\System\gnCtczD.exe
  C:\Windows\System\gnCtczD.exe
  2⤵
  PID:11980
- C:\Windows\System\zdgtCuw.exe
  C:\Windows\System\zdgtCuw.exe
  2⤵
  PID:12012
- C:\Windows\System\aGvPxgG.exe
  C:\Windows\System\aGvPxgG.exe
  2⤵
  PID:12084
- C:\Windows\System\uAVtjAq.exe
  C:\Windows\System\uAVtjAq.exe
  2⤵
  PID:12116
- C:\Windows\System\LXNIlUG.exe
  C:\Windows\System\LXNIlUG.exe
  2⤵
  PID:12164
- C:\Windows\System\KpUVxfR.exe
  C:\Windows\System\KpUVxfR.exe
  2⤵
  PID:9544
- C:\Windows\System\QnLDObs.exe
  C:\Windows\System\QnLDObs.exe
  2⤵
  PID:11104
- C:\Windows\System\OPdFxnk.exe
  C:\Windows\System\OPdFxnk.exe
  2⤵
  PID:12348
- C:\Windows\System\mYuwJvN.exe
  C:\Windows\System\mYuwJvN.exe
  2⤵
  PID:12392
- C:\Windows\System\GKwizbH.exe
  C:\Windows\System\GKwizbH.exe
  2⤵
  PID:13136
- C:\Windows\System\lHGxtlO.exe
  C:\Windows\System\lHGxtlO.exe
  2⤵
  PID:7100
- C:\Windows\System\joWyDSV.exe
  C:\Windows\System\joWyDSV.exe
  2⤵
  PID:2316
- C:\Windows\System\CghotAR.exe
  C:\Windows\System\CghotAR.exe
  2⤵
  PID:8588
- C:\Windows\System\vnQIlzk.exe
  C:\Windows\System\vnQIlzk.exe
  2⤵
  PID:10332
- C:\Windows\System\aEqyFFP.exe
  C:\Windows\System\aEqyFFP.exe
  2⤵
  PID:10608
- C:\Windows\System\OUXkTho.exe
  C:\Windows\System\OUXkTho.exe
  2⤵
  PID:11388
- C:\Windows\System\HAOGPKY.exe
  C:\Windows\System\HAOGPKY.exe
  2⤵
  PID:7364
- C:\Windows\System\jPJBqKO.exe
  C:\Windows\System\jPJBqKO.exe
  2⤵
  PID:11288
- C:\Windows\System\FILZEnV.exe
  C:\Windows\System\FILZEnV.exe
  2⤵
  PID:12100
- C:\Windows\System\knhLYRD.exe
  C:\Windows\System\knhLYRD.exe
  2⤵
  PID:10960
- C:\Windows\System\fEYnnPQ.exe
  C:\Windows\System\fEYnnPQ.exe
  2⤵
  PID:9712
- C:\Windows\System\zOxMpDR.exe
  C:\Windows\System\zOxMpDR.exe
  2⤵
  PID:11220
- C:\Windows\System\iyVSnGS.exe
  C:\Windows\System\iyVSnGS.exe
  2⤵
  PID:12520
- C:\Windows\System\DFzGVaq.exe
  C:\Windows\System\DFzGVaq.exe
  2⤵
  PID:11328
- C:\Windows\System\vlONwfh.exe
  C:\Windows\System\vlONwfh.exe
  2⤵
  PID:12456
- C:\Windows\System\SyBuADu.exe
  C:\Windows\System\SyBuADu.exe
  2⤵
  PID:12408
- C:\Windows\System\GdQZopN.exe
  C:\Windows\System\GdQZopN.exe
  2⤵
  PID:4520
- C:\Windows\System\TwqOxvS.exe
  C:\Windows\System\TwqOxvS.exe
  2⤵
  PID:9316
- C:\Windows\System\jaDQrnj.exe
  C:\Windows\System\jaDQrnj.exe
  2⤵
  PID:10256
- C:\Windows\System\jZSJIXR.exe
  C:\Windows\System\jZSJIXR.exe
  2⤵
  PID:10280
- C:\Windows\System\YhGVCAS.exe
  C:\Windows\System\YhGVCAS.exe
  2⤵
  PID:11136
- C:\Windows\System\PHhaMry.exe
  C:\Windows\System\PHhaMry.exe
  2⤵
  PID:1876
- C:\Windows\System\UemabfL.exe
  C:\Windows\System\UemabfL.exe
  2⤵
  PID:10764
- C:\Windows\System\GTJUnPZ.exe
  C:\Windows\System\GTJUnPZ.exe
  2⤵
  PID:12148
- C:\Windows\System\OETGdAh.exe
  C:\Windows\System\OETGdAh.exe
  2⤵
  PID:12804
- C:\Windows\System\WjEjmVb.exe
  C:\Windows\System\WjEjmVb.exe
  2⤵
  PID:9416
- C:\Windows\System\YBadfOM.exe
  C:\Windows\System\YBadfOM.exe
  2⤵
  PID:2968
- C:\Windows\System\aqEnrou.exe
  C:\Windows\System\aqEnrou.exe
  2⤵
  PID:10452
- C:\Windows\System\CXnpzdR.exe
  C:\Windows\System\CXnpzdR.exe
  2⤵
  PID:11724
- C:\Windows\System\bbjAWUp.exe
  C:\Windows\System\bbjAWUp.exe
  2⤵
  PID:12360
- C:\Windows\System\rxWGuVB.exe
  C:\Windows\System\rxWGuVB.exe
  2⤵
  PID:236
- C:\Windows\System\DAiabeM.exe
  C:\Windows\System\DAiabeM.exe
  2⤵
  PID:11768
- C:\Windows\System\tDNmiTP.exe
  C:\Windows\System\tDNmiTP.exe
  2⤵
  PID:13276
- C:\Windows\System\AoYXDcL.exe
  C:\Windows\System\AoYXDcL.exe
  2⤵
  PID:1524
- C:\Windows\System\ckfrbIT.exe
  C:\Windows\System\ckfrbIT.exe
  2⤵
  PID:12988
- C:\Windows\System\AslQgLe.exe
  C:\Windows\System\AslQgLe.exe
  2⤵
  PID:1612
- C:\Windows\System\zfDZxkk.exe
  C:\Windows\System\zfDZxkk.exe
  2⤵
  PID:12904
- C:\Windows\System\eGcbDdI.exe
  C:\Windows\System\eGcbDdI.exe
  2⤵
  PID:11780
- C:\Windows\System\yBVyFup.exe
  C:\Windows\System\yBVyFup.exe
  2⤵
  PID:5760
- C:\Windows\System\PIoDwNi.exe
  C:\Windows\System\PIoDwNi.exe
  2⤵
  PID:3932
- C:\Windows\System\BdeFZHH.exe
  C:\Windows\System\BdeFZHH.exe
  2⤵
  PID:1220
- C:\Windows\System\otSpFUb.exe
  C:\Windows\System\otSpFUb.exe
  2⤵
  PID:5904
- C:\Windows\System\YBTmxFt.exe
  C:\Windows\System\YBTmxFt.exe
  2⤵
  PID:2088
- C:\Windows\System\ZgeVnst.exe
  C:\Windows\System\ZgeVnst.exe
  2⤵
  PID:2392
- C:\Windows\System\PhHXhPm.exe
  C:\Windows\System\PhHXhPm.exe
  2⤵
  PID:7080
- C:\Windows\System\yrsPTbx.exe
  C:\Windows\System\yrsPTbx.exe
  2⤵
  PID:4272
- C:\Windows\System\BbFWyPs.exe
  C:\Windows\System\BbFWyPs.exe
  2⤵
  PID:2704
- C:\Windows\System\SfmcJME.exe
  C:\Windows\System\SfmcJME.exe
  2⤵
  PID:12556
- C:\Windows\System\okWawkT.exe
  C:\Windows\System\okWawkT.exe
  2⤵
  PID:11212
- C:\Windows\System\DtZtwJn.exe
  C:\Windows\System\DtZtwJn.exe
  2⤵
  PID:4168
- C:\Windows\System\FPtcxWx.exe
  C:\Windows\System\FPtcxWx.exe
  2⤵
  PID:10304
- C:\Windows\System\LBbODbv.exe
  C:\Windows\System\LBbODbv.exe
  2⤵
  PID:8464
- C:\Windows\System\AkzpbYT.exe
  C:\Windows\System\AkzpbYT.exe
  2⤵
  PID:13176
- C:\Windows\System\hLhwsYo.exe
  C:\Windows\System\hLhwsYo.exe
  2⤵
  PID:13008
- C:\Windows\System\WXNYfph.exe
  C:\Windows\System\WXNYfph.exe
  2⤵
  PID:13124
- C:\Windows\System\rnEqarS.exe
  C:\Windows\System\rnEqarS.exe
  2⤵
  PID:12240
- C:\Windows\System\nIMIIsX.exe
  C:\Windows\System\nIMIIsX.exe
  2⤵
  PID:10300
- C:\Windows\System\MlvsbAk.exe
  C:\Windows\System\MlvsbAk.exe
  2⤵
  PID:10440
- C:\Windows\System\RqynzDH.exe
  C:\Windows\System\RqynzDH.exe
  2⤵
  PID:12188
- C:\Windows\System\vGWiNTP.exe
  C:\Windows\System\vGWiNTP.exe
  2⤵
  PID:3864
- C:\Windows\System\DRBIkxq.exe
  C:\Windows\System\DRBIkxq.exe
  2⤵
  PID:7244
- C:\Windows\System\JxDtnpL.exe
  C:\Windows\System\JxDtnpL.exe
  2⤵
  PID:12356
- C:\Windows\System\qWQKcKn.exe
  C:\Windows\System\qWQKcKn.exe
  2⤵
  PID:468
- C:\Windows\System\znekQof.exe
  C:\Windows\System\znekQof.exe
  2⤵
  PID:11580
- C:\Windows\System\lJdaTgB.exe
  C:\Windows\System\lJdaTgB.exe
  2⤵
  PID:12832
- C:\Windows\System\yvbvYUn.exe
  C:\Windows\System\yvbvYUn.exe
  2⤵
  PID:11676
- C:\Windows\System\ZCZsvMc.exe
  C:\Windows\System\ZCZsvMc.exe
  2⤵
  PID:13384
- C:\Windows\System\eGXidTd.exe
  C:\Windows\System\eGXidTd.exe
  2⤵
  PID:13496
- C:\Windows\System\HNQFQHO.exe
  C:\Windows\System\HNQFQHO.exe
  2⤵
  PID:13512
- C:\Windows\System\MPHBxUA.exe
  C:\Windows\System\MPHBxUA.exe
  2⤵
  PID:13544
- C:\Windows\System\myKeGBf.exe
  C:\Windows\System\myKeGBf.exe
  2⤵
  PID:13580
- C:\Windows\System\RbDoYCO.exe
  C:\Windows\System\RbDoYCO.exe
  2⤵
  PID:13600
- C:\Windows\System\yOUMWRU.exe
  C:\Windows\System\yOUMWRU.exe
  2⤵
  PID:13620
- C:\Windows\System\KbZXUVJ.exe
  C:\Windows\System\KbZXUVJ.exe
  2⤵
  PID:13644
- C:\Windows\System\tIKeLVf.exe
  C:\Windows\System\tIKeLVf.exe
  2⤵
  PID:13664
- C:\Windows\System\RsDPtpD.exe
  C:\Windows\System\RsDPtpD.exe
  2⤵
  PID:13692
- C:\Windows\System\TZhmGSW.exe
  C:\Windows\System\TZhmGSW.exe
  2⤵
  PID:13712
- C:\Windows\System\bfZMBqw.exe
  C:\Windows\System\bfZMBqw.exe
  2⤵
  PID:13736
- C:\Windows\System\CPQjdFy.exe
  C:\Windows\System\CPQjdFy.exe
  2⤵
  PID:13760
- C:\Windows\System\xZsyWkv.exe
  C:\Windows\System\xZsyWkv.exe
  2⤵
  PID:13780
- C:\Windows\System\pVDmVSo.exe
  C:\Windows\System\pVDmVSo.exe
  2⤵
  PID:13796
- C:\Windows\System\FxuLgtu.exe
  C:\Windows\System\FxuLgtu.exe
  2⤵
  PID:13820
- C:\Windows\System\ECQJrrM.exe
  C:\Windows\System\ECQJrrM.exe
  2⤵
  PID:13840
- C:\Windows\System\mIaiPWY.exe
  C:\Windows\System\mIaiPWY.exe
  2⤵
  PID:14008
- C:\Windows\System\CPFcHlN.exe
  C:\Windows\System\CPFcHlN.exe
  2⤵
  PID:3288
- C:\Windows\System\eQrVMyy.exe
  C:\Windows\System\eQrVMyy.exe
  2⤵
  PID:7832
- C:\Windows\System\blIDorS.exe
  C:\Windows\System\blIDorS.exe
  2⤵
  PID:13576
- C:\Windows\System\GPKBVuo.exe
  C:\Windows\System\GPKBVuo.exe
  2⤵
  PID:13752
- C:\Windows\System\xHIaGyX.exe
  C:\Windows\System\xHIaGyX.exe
  2⤵
  PID:13768
- C:\Windows\System\sdgwfqR.exe
  C:\Windows\System\sdgwfqR.exe
  2⤵
  PID:13808
- C:\Windows\System\JRcLBtE.exe
  C:\Windows\System\JRcLBtE.exe
  2⤵
  PID:13936
- C:\Windows\System\AVRLUZj.exe
  C:\Windows\System\AVRLUZj.exe
  2⤵
  PID:13948
- C:\Windows\System\xjOhCDt.exe
  C:\Windows\System\xjOhCDt.exe
  2⤵
  PID:14076
- C:\Windows\System\OnUECyI.exe
  C:\Windows\System\OnUECyI.exe
  2⤵
  PID:14096
- C:\Windows\System\oZrsEdA.exe
  C:\Windows\System\oZrsEdA.exe
  2⤵
  PID:14156
- C:\Windows\System\cQxPhgw.exe
  C:\Windows\System\cQxPhgw.exe
  2⤵
  PID:14192
- C:\Windows\System\JNVcfXr.exe
  C:\Windows\System\JNVcfXr.exe
  2⤵
  PID:14220
- C:\Windows\System\eqwdmDs.exe
  C:\Windows\System\eqwdmDs.exe
  2⤵
  PID:14324
- C:\Windows\System\qIBoynY.exe
  C:\Windows\System\qIBoynY.exe
  2⤵
  PID:2300
- C:\Windows\System\HlXbFCt.exe
  C:\Windows\System\HlXbFCt.exe
  2⤵
  PID:13184
- C:\Windows\System\YvMykSq.exe
  C:\Windows\System\YvMykSq.exe
  2⤵
  PID:13708
- C:\Windows\System\pgMgwbo.exe
  C:\Windows\System\pgMgwbo.exe
  2⤵
  PID:13892
- C:\Windows\System\OJxELLk.exe
  C:\Windows\System\OJxELLk.exe
  2⤵
  PID:5024
- C:\Windows\System\CNHYSum.exe
  C:\Windows\System\CNHYSum.exe
  2⤵
  PID:13904
- C:\Windows\System\UoiirXs.exe
  C:\Windows\System\UoiirXs.exe
  2⤵
  PID:14064
- C:\Windows\System\MMSGzYh.exe
  C:\Windows\System\MMSGzYh.exe
  2⤵
  PID:4004
- C:\Windows\System\QgBAKPA.exe
  C:\Windows\System\QgBAKPA.exe
  2⤵
  PID:14004
- C:\Windows\System\EJjlDnI.exe
  C:\Windows\System\EJjlDnI.exe
  2⤵
  PID:14100
- C:\Windows\System\VTcuWXs.exe
  C:\Windows\System\VTcuWXs.exe
  2⤵
  PID:120
- C:\Windows\System\IQeLRFB.exe
  C:\Windows\System\IQeLRFB.exe
  2⤵
  PID:14240
- C:\Windows\System\VavJJFX.exe
  C:\Windows\System\VavJJFX.exe
  2⤵
  PID:14148
- C:\Windows\System\vFRdyOg.exe
  C:\Windows\System\vFRdyOg.exe
  2⤵
  PID:14196
- C:\Windows\System\tuLDyEZ.exe
  C:\Windows\System\tuLDyEZ.exe
  2⤵
  PID:11064
- C:\Windows\System\ORarnkV.exe
  C:\Windows\System\ORarnkV.exe
  2⤵
  PID:14292
- C:\Windows\System\WJnnFHT.exe
  C:\Windows\System\WJnnFHT.exe
  2⤵
  PID:4936
- C:\Windows\System\bqKxSod.exe
  C:\Windows\System\bqKxSod.exe
  2⤵
  PID:14280
- C:\Windows\System\oKHUxIZ.exe
  C:\Windows\System\oKHUxIZ.exe
  2⤵
  PID:13348
- C:\Windows\System\ZZWNSai.exe
  C:\Windows\System\ZZWNSai.exe
  2⤵
  PID:3772
- C:\Windows\System\wEGXCuk.exe
  C:\Windows\System\wEGXCuk.exe
  2⤵
  PID:13612
- C:\Windows\System\qddzzeq.exe
  C:\Windows\System\qddzzeq.exe
  2⤵
  PID:3268
- C:\Windows\System\vBpvsQg.exe
  C:\Windows\System\vBpvsQg.exe
  2⤵
  PID:14060
- C:\Windows\System\MyXrUaE.exe
  C:\Windows\System\MyXrUaE.exe
  2⤵
  PID:13788
- C:\Windows\System\WkmtObI.exe
  C:\Windows\System\WkmtObI.exe
  2⤵
  PID:13960
- C:\Windows\System\zBgjPgI.exe
  C:\Windows\System\zBgjPgI.exe
  2⤵
  PID:13616
- C:\Windows\System\ATqwcGq.exe
  C:\Windows\System\ATqwcGq.exe
  2⤵
  PID:13880
- C:\Windows\System\INNLAKA.exe
  C:\Windows\System\INNLAKA.exe
  2⤵
  PID:14172
- C:\Windows\System\aXwxFlo.exe
  C:\Windows\System\aXwxFlo.exe
  2⤵
  PID:1488
- C:\Windows\System\WlaNSas.exe
  C:\Windows\System\WlaNSas.exe
  2⤵
  PID:1824
- C:\Windows\System\bJoQTSD.exe
  C:\Windows\System\bJoQTSD.exe
  2⤵
  PID:684
- C:\Windows\System\geVvwGF.exe
  C:\Windows\System\geVvwGF.exe
  2⤵
  PID:14312
- C:\Windows\System\vgBRSMO.exe
  C:\Windows\System\vgBRSMO.exe
  2⤵
  PID:14316
- C:\Windows\System\PRfiYOc.exe
  C:\Windows\System\PRfiYOc.exe
  2⤵
  PID:13460
- C:\Windows\System\PsfxqsG.exe
  C:\Windows\System\PsfxqsG.exe
  2⤵
  PID:784
- C:\Windows\System\oUTNOKo.exe
  C:\Windows\System\oUTNOKo.exe
  2⤵
  PID:13448
- C:\Windows\System\gjBBljQ.exe
  C:\Windows\System\gjBBljQ.exe
  2⤵
  PID:4364
- C:\Windows\System\iQiOjhJ.exe
  C:\Windows\System\iQiOjhJ.exe
  2⤵
  PID:2872
- C:\Windows\System\GFqXHRf.exe
  C:\Windows\System\GFqXHRf.exe
  2⤵
  PID:2472
- C:\Windows\System\tjKTnKU.exe
  C:\Windows\System\tjKTnKU.exe
  2⤵
  PID:3468
- C:\Windows\System\zpYSyzj.exe
  C:\Windows\System\zpYSyzj.exe
  2⤵
  PID:13444
- C:\Windows\System\nJdtkKc.exe
  C:\Windows\System\nJdtkKc.exe
  2⤵
  PID:5184
- C:\Windows\System\smTVxik.exe
  C:\Windows\System\smTVxik.exe
  2⤵
  PID:3396
- C:\Windows\System\iodOrzt.exe
  C:\Windows\System\iodOrzt.exe
  2⤵
  PID:3664
- C:\Windows\System\VTyWGAz.exe
  C:\Windows\System\VTyWGAz.exe
  2⤵
  PID:1316
- C:\Windows\System\XaetXLR.exe
  C:\Windows\System\XaetXLR.exe
  2⤵
  PID:13968
- C:\Windows\System\IQdsJxd.exe
  C:\Windows\System\IQdsJxd.exe
  2⤵
  PID:4596
- C:\Windows\System\mPdQhOB.exe
  C:\Windows\System\mPdQhOB.exe
  2⤵
  PID:4448
- C:\Windows\System\qVAoBGl.exe
  C:\Windows\System\qVAoBGl.exe
  2⤵
  PID:5404
- C:\Windows\System\kWfDqMR.exe
  C:\Windows\System\kWfDqMR.exe
  2⤵
  PID:1760
- C:\Windows\System\qeHMfPI.exe
  C:\Windows\System\qeHMfPI.exe
  2⤵
  PID:14256
- C:\Windows\System\tkrSPky.exe
  C:\Windows\System\tkrSPky.exe
  2⤵
  PID:3596
- C:\Windows\System\QzRaEjr.exe
  C:\Windows\System\QzRaEjr.exe
  2⤵
  PID:3328
- C:\Windows\System\KEkQRTq.exe
  C:\Windows\System\KEkQRTq.exe
  2⤵
  PID:4876
- C:\Windows\System\ToFNIWh.exe
  C:\Windows\System\ToFNIWh.exe
  2⤵
  PID:14092
- C:\Windows\System\IANrQqh.exe
  C:\Windows\System\IANrQqh.exe
  2⤵
  PID:384
- C:\Windows\System\PSGLeSA.exe
  C:\Windows\System\PSGLeSA.exe
  2⤵
  PID:5316
- C:\Windows\System\rlRnFdk.exe
  C:\Windows\System\rlRnFdk.exe
  2⤵
  PID:13396
- C:\Windows\System\OdeGdJs.exe
  C:\Windows\System\OdeGdJs.exe
  2⤵
  PID:5464
- C:\Windows\System\thimQWo.exe
  C:\Windows\System\thimQWo.exe
  2⤵
  PID:4184
- C:\Windows\System\EPskCOj.exe
  C:\Windows\System\EPskCOj.exe
  2⤵
  PID:5020
- C:\Windows\System\CwRVkFu.exe
  C:\Windows\System\CwRVkFu.exe
  2⤵
  PID:3444
- C:\Windows\System\SKlXxLB.exe
  C:\Windows\System\SKlXxLB.exe
  2⤵
  PID:13628
- C:\Windows\System\kiwUMag.exe
  C:\Windows\System\kiwUMag.exe
  2⤵
  PID:5972
- C:\Windows\System\KDxrrkF.exe
  C:\Windows\System\KDxrrkF.exe
  2⤵
  PID:14300
- C:\Windows\System\eMteiXc.exe
  C:\Windows\System\eMteiXc.exe
  2⤵
  PID:6096
- C:\Windows\System\IiUDUox.exe
  C:\Windows\System\IiUDUox.exe
  2⤵
  PID:13556
- C:\Windows\System\JNppAwm.exe
  C:\Windows\System\JNppAwm.exe
  2⤵
  PID:2484
- C:\Windows\System\tIMhLnO.exe
  C:\Windows\System\tIMhLnO.exe
  2⤵
  PID:5676
- C:\Windows\System\cxkSJFs.exe
  C:\Windows\System\cxkSJFs.exe
  2⤵
  PID:4328
- C:\Windows\System\dxRcwQF.exe
  C:\Windows\System\dxRcwQF.exe
  2⤵
  PID:5576
- C:\Windows\System\kRExQNN.exe
  C:\Windows\System\kRExQNN.exe
  2⤵
  PID:14068
- C:\Windows\System\QDPHNNd.exe
  C:\Windows\System\QDPHNNd.exe
  2⤵
  PID:14348
- C:\Windows\System\hlSYKKL.exe
  C:\Windows\System\hlSYKKL.exe
  2⤵
  PID:14384
- C:\Windows\System\fuzOUHA.exe
  C:\Windows\System\fuzOUHA.exe
  2⤵
  PID:14432
- C:\Windows\System\lYtVnkb.exe
  C:\Windows\System\lYtVnkb.exe
  2⤵
  PID:14448
- C:\Windows\System\lSNNsFZ.exe
  C:\Windows\System\lSNNsFZ.exe
  2⤵
  PID:14544
- C:\Windows\System\qEqJdWr.exe
  C:\Windows\System\qEqJdWr.exe
  2⤵
  PID:14572
- C:\Windows\System\bdcZKeA.exe
  C:\Windows\System\bdcZKeA.exe
  2⤵
  PID:14664
- C:\Windows\System\FIOUgrE.exe
  C:\Windows\System\FIOUgrE.exe
  2⤵
  PID:14716
- C:\Windows\System\wDdXMaO.exe
  C:\Windows\System\wDdXMaO.exe
  2⤵
  PID:14744
- C:\Windows\System\IGWfpym.exe
  C:\Windows\System\IGWfpym.exe
  2⤵
  PID:14764
- C:\Windows\System\HsCOnfi.exe
  C:\Windows\System\HsCOnfi.exe
  2⤵
  PID:14792
- C:\Windows\System\lKiwUHI.exe
  C:\Windows\System\lKiwUHI.exe
  2⤵
  PID:14828
- C:\Windows\System\gSbPAzC.exe
  C:\Windows\System\gSbPAzC.exe
  2⤵
  PID:14864
- C:\Windows\System\coYqHkN.exe
  C:\Windows\System\coYqHkN.exe
  2⤵
  PID:14892
- C:\Windows\System\wizAybf.exe
  C:\Windows\System\wizAybf.exe
  2⤵
  PID:14916
- C:\Windows\System\qMorsrm.exe
  C:\Windows\System\qMorsrm.exe
  2⤵
  PID:14944
- C:\Windows\System\NsErcVJ.exe
  C:\Windows\System\NsErcVJ.exe
  2⤵
  PID:14968
- C:\Windows\System\rBKdEXP.exe
  C:\Windows\System\rBKdEXP.exe
  2⤵
  PID:15008
- C:\Windows\System\uFOqqvC.exe
  C:\Windows\System\uFOqqvC.exe
  2⤵
  PID:15040
- C:\Windows\System\yMoTbtQ.exe
  C:\Windows\System\yMoTbtQ.exe
  2⤵
  PID:15076
- C:\Windows\System\QlAhZGu.exe
  C:\Windows\System\QlAhZGu.exe
  2⤵
  PID:15100
- C:\Windows\System\uUUmalT.exe
  C:\Windows\System\uUUmalT.exe
  2⤵
  PID:15128
- C:\Windows\System\rkbYMJF.exe
  C:\Windows\System\rkbYMJF.exe
  2⤵
  PID:15180
- C:\Windows\System\gKsTqpn.exe
  C:\Windows\System\gKsTqpn.exe
  2⤵
  PID:15224
- C:\Windows\System\AsgwTTc.exe
  C:\Windows\System\AsgwTTc.exe
  2⤵
  PID:15272
- C:\Windows\System\GXZchst.exe
  C:\Windows\System\GXZchst.exe
  2⤵
  PID:15292
- C:\Windows\System\wGafCem.exe
  C:\Windows\System\wGafCem.exe
  2⤵
  PID:15320
- C:\Windows\System\iNmQEOa.exe
  C:\Windows\System\iNmQEOa.exe
  2⤵
  PID:15352
- C:\Windows\System\manWrRu.exe
  C:\Windows\System\manWrRu.exe
  2⤵
  PID:1080
- C:\Windows\System\WJEdHhF.exe
  C:\Windows\System\WJEdHhF.exe
  2⤵
  PID:3768
- C:\Windows\System\bhHZhpL.exe
  C:\Windows\System\bhHZhpL.exe
  2⤵
  PID:13896
- C:\Windows\System\lgpbblw.exe
  C:\Windows\System\lgpbblw.exe
  2⤵
  PID:5416
- C:\Windows\System\nPMJfJL.exe
  C:\Windows\System\nPMJfJL.exe
  2⤵
  PID:12144
- C:\Windows\System\emilvXw.exe
  C:\Windows\System\emilvXw.exe
  2⤵
  PID:2164
- C:\Windows\System\NEHfTnV.exe
  C:\Windows\System\NEHfTnV.exe
  2⤵
  PID:640
- C:\Windows\System\xBZAqIq.exe
  C:\Windows\System\xBZAqIq.exe
  2⤵
  PID:13856
- C:\Windows\System\ZQlhzze.exe
  C:\Windows\System\ZQlhzze.exe
  2⤵
  PID:2148
- C:\Windows\System\Gbzqstu.exe
  C:\Windows\System\Gbzqstu.exe
  2⤵
  PID:14480
- C:\Windows\System\kxKtkEg.exe
  C:\Windows\System\kxKtkEg.exe
  2⤵
  PID:4880
- C:\Windows\System\ygWTzkA.exe
  C:\Windows\System\ygWTzkA.exe
  2⤵
  PID:14332
- C:\Windows\System\HZZQQYt.exe
  C:\Windows\System\HZZQQYt.exe
  2⤵
  PID:1772
- C:\Windows\System\rlvcdmr.exe
  C:\Windows\System\rlvcdmr.exe
  2⤵
  PID:14476
- C:\Windows\System\eAuArvF.exe
  C:\Windows\System\eAuArvF.exe
  2⤵
  PID:14508
- C:\Windows\System\ZPGROBf.exe
  C:\Windows\System\ZPGROBf.exe
  2⤵
  PID:14360
- C:\Windows\System\AZHaABB.exe
  C:\Windows\System\AZHaABB.exe
  2⤵
  PID:14416
- C:\Windows\System\lWRFSmj.exe
  C:\Windows\System\lWRFSmj.exe
  2⤵
  PID:14560
- C:\Windows\System\BGYEwue.exe
  C:\Windows\System\BGYEwue.exe
  2⤵
  PID:14588
- C:\Windows\System\znpVQgG.exe
  C:\Windows\System\znpVQgG.exe
  2⤵
  PID:6832
- C:\Windows\System\KsGxpkm.exe
  C:\Windows\System\KsGxpkm.exe
  2⤵
  PID:6544
- C:\Windows\System\XJKuLst.exe
  C:\Windows\System\XJKuLst.exe
  2⤵
  PID:14772
- C:\Windows\System\fUEdarZ.exe
  C:\Windows\System\fUEdarZ.exe
  2⤵
  PID:14856
- C:\Windows\System\aWBlPZl.exe
  C:\Windows\System\aWBlPZl.exe
  2⤵
  PID:7032
- C:\Windows\System\bCTHVSG.exe
  C:\Windows\System\bCTHVSG.exe
  2⤵
  PID:14960
- C:\Windows\System\nEYdwIs.exe
  C:\Windows\System\nEYdwIs.exe
  2⤵
  PID:14836
- C:\Windows\System\dTAzNHQ.exe
  C:\Windows\System\dTAzNHQ.exe
  2⤵
  PID:7092
- C:\Windows\System\gmNkPLX.exe
  C:\Windows\System\gmNkPLX.exe
  2⤵
  PID:14152
- C:\Windows\System\GYKnYAl.exe
  C:\Windows\System\GYKnYAl.exe
  2⤵
  PID:14940
- C:\Windows\System\umMOJcZ.exe
  C:\Windows\System\umMOJcZ.exe
  2⤵
  PID:6860
- C:\Windows\System\pWOgrLE.exe
  C:\Windows\System\pWOgrLE.exe
  2⤵
  PID:15056
- C:\Windows\System\nBQAsjF.exe
  C:\Windows\System\nBQAsjF.exe
  2⤵
  PID:15032
- C:\Windows\System\cbzZxHZ.exe
  C:\Windows\System\cbzZxHZ.exe
  2⤵
  PID:15048
- C:\Windows\System\nSrFgaR.exe
  C:\Windows\System\nSrFgaR.exe
  2⤵
  PID:7588
- C:\Windows\System\ebQbGre.exe
  C:\Windows\System\ebQbGre.exe
  2⤵
  PID:15168
- C:\Windows\System\vCJbHnG.exe
  C:\Windows\System\vCJbHnG.exe
  2⤵
  PID:5916
- C:\Windows\System\MXRTLpn.exe
  C:\Windows\System\MXRTLpn.exe
  2⤵
  PID:15264
- C:\Windows\System\QgADqvx.exe
  C:\Windows\System\QgADqvx.exe
  2⤵
  PID:7148
- C:\Windows\System\dFEBzrX.exe
  C:\Windows\System\dFEBzrX.exe
  2⤵
  PID:2276
- C:\Windows\System\hjhXVfO.exe
  C:\Windows\System\hjhXVfO.exe
  2⤵
  PID:5608
- C:\Windows\System\eITdkAR.exe
  C:\Windows\System\eITdkAR.exe
  2⤵
  PID:7812
- C:\Windows\System\RNwkCHo.exe
  C:\Windows\System\RNwkCHo.exe
  2⤵
  PID:1308
- C:\Windows\System\dCJabQl.exe
  C:\Windows\System\dCJabQl.exe
  2⤵
  PID:548
- C:\Windows\System\mCWZGaJ.exe
  C:\Windows\System\mCWZGaJ.exe
  2⤵
  PID:5412
- C:\Windows\System\BkSiJWG.exe
  C:\Windows\System\BkSiJWG.exe
  2⤵
  PID:8912
- C:\Windows\System\iRSFlXz.exe
  C:\Windows\System\iRSFlXz.exe
  2⤵
  PID:4384
- C:\Windows\System\ZDXWfNV.exe
  C:\Windows\System\ZDXWfNV.exe
  2⤵
  PID:7552
- C:\Windows\System\hhyAzZM.exe
  C:\Windows\System\hhyAzZM.exe
  2⤵
  PID:7948
- C:\Windows\System\PDAHnMB.exe
  C:\Windows\System\PDAHnMB.exe
  2⤵
  PID:4368
- C:\Windows\System\HyHJucm.exe
  C:\Windows\System\HyHJucm.exe
  2⤵
  PID:6520
- C:\Windows\System\hRQMhHN.exe
  C:\Windows\System\hRQMhHN.exe
  2⤵
  PID:6104
- C:\Windows\System\evmaDZp.exe
  C:\Windows\System\evmaDZp.exe
  2⤵
  PID:7156
- C:\Windows\System\ruCBrTC.exe
  C:\Windows\System\ruCBrTC.exe
  2⤵
  PID:6968
- C:\Windows\System\omooLge.exe
  C:\Windows\System\omooLge.exe
  2⤵
  PID:7160
- C:\Windows\System\QWvbhdp.exe
  C:\Windows\System\QWvbhdp.exe
  2⤵
  PID:5532
- C:\Windows\System\BEDJfEj.exe
  C:\Windows\System\BEDJfEj.exe
  2⤵
  PID:14900
- C:\Windows\System\OeIhfUt.exe
  C:\Windows\System\OeIhfUt.exe
  2⤵
  PID:14760
- C:\Windows\System\ZGjqbmx.exe
  C:\Windows\System\ZGjqbmx.exe
  2⤵
  PID:14800
- C:\Windows\System\wpcxIGD.exe
  C:\Windows\System\wpcxIGD.exe
  2⤵
  PID:14888
- C:\Windows\System\KmImqAr.exe
  C:\Windows\System\KmImqAr.exe
  2⤵
  PID:15024
- C:\Windows\System\KbbVcfy.exe
  C:\Windows\System\KbbVcfy.exe
  2⤵
  PID:5884
- C:\Windows\System\BSsOQMR.exe
  C:\Windows\System\BSsOQMR.exe
  2⤵
  PID:6644
- C:\Windows\System\hPECWBa.exe
  C:\Windows\System\hPECWBa.exe
  2⤵
  PID:15288
- C:\Windows\System\hYyQmOC.exe
  C:\Windows\System\hYyQmOC.exe
  2⤵
  PID:6632
- C:\Windows\System\txeNUUP.exe
  C:\Windows\System\txeNUUP.exe
  2⤵
  PID:15160
- C:\Windows\System\OZBFvJU.exe
  C:\Windows\System\OZBFvJU.exe
  2⤵
  PID:6256
- C:\Windows\System\qrjAByw.exe
  C:\Windows\System\qrjAByw.exe
  2⤵
  PID:13884
- C:\Windows\System\GUKvQum.exe
  C:\Windows\System\GUKvQum.exe
  2⤵
  PID:800
- C:\Windows\System\HTZCFEo.exe
  C:\Windows\System\HTZCFEo.exe
  2⤵
  PID:15140
- C:\Windows\System\ZkoTUMf.exe
  C:\Windows\System\ZkoTUMf.exe
  2⤵
  PID:4352
- C:\Windows\System\eerFZpz.exe
  C:\Windows\System\eerFZpz.exe
  2⤵
  PID:5408
- C:\Windows\System\SbjhUJw.exe
  C:\Windows\System\SbjhUJw.exe
  2⤵
  PID:5604
- C:\Windows\System\pSsKHZr.exe
  C:\Windows\System\pSsKHZr.exe
  2⤵
  PID:14536
- C:\Windows\System\jMWazsj.exe
  C:\Windows\System\jMWazsj.exe
  2⤵
  PID:2544
- C:\Windows\System\yZtkBYM.exe
  C:\Windows\System\yZtkBYM.exe
  2⤵
  PID:7944
- C:\Windows\System\RCfmEBu.exe
  C:\Windows\System\RCfmEBu.exe
  2⤵
  PID:14368
- C:\Windows\System\vQvSNnb.exe
  C:\Windows\System\vQvSNnb.exe
  2⤵
  PID:8752
- C:\Windows\System\BrjBXrx.exe
  C:\Windows\System\BrjBXrx.exe
  2⤵
  PID:8764
- C:\Windows\System\QGSrFSv.exe
  C:\Windows\System\QGSrFSv.exe
  2⤵
  PID:8600
- C:\Windows\System\IccLxKx.exe
  C:\Windows\System\IccLxKx.exe
  2⤵
  PID:8612
- C:\Windows\System\BuSHfMD.exe
  C:\Windows\System\BuSHfMD.exe
  2⤵
  PID:5712
- C:\Windows\System\QzGShxH.exe
  C:\Windows\System\QzGShxH.exe
  2⤵
  PID:6848
- C:\Windows\System\YtJdtzo.exe
  C:\Windows\System\YtJdtzo.exe
  2⤵
  PID:14812
- C:\Windows\System\TprUZaF.exe
  C:\Windows\System\TprUZaF.exe
  2⤵
  PID:7008
- C:\Windows\System\BNUknSQ.exe
  C:\Windows\System\BNUknSQ.exe
  2⤵
  PID:8468
- C:\Windows\System\SPtbkHX.exe
  C:\Windows\System\SPtbkHX.exe
  2⤵
  PID:14780
- C:\Windows\System\UamgBTF.exe
  C:\Windows\System\UamgBTF.exe
  2⤵
  PID:5644
- C:\Windows\System\iSIUOCl.exe
  C:\Windows\System\iSIUOCl.exe
  2⤵
  PID:9048
- C:\Windows\System\aGaXptF.exe
  C:\Windows\System\aGaXptF.exe
  2⤵
  PID:14872
- C:\Windows\System\oeohDiP.exe
  C:\Windows\System\oeohDiP.exe
  2⤵
  PID:15300
- C:\Windows\System\VHvTiOB.exe
  C:\Windows\System\VHvTiOB.exe
  2⤵
  PID:14924
- C:\Windows\System\vcGXqHt.exe
  C:\Windows\System\vcGXqHt.exe
  2⤵
  PID:3260
- C:\Windows\System\lMaQxMh.exe
  C:\Windows\System\lMaQxMh.exe
  2⤵
  PID:7928
- C:\Windows\System\airVErr.exe
  C:\Windows\System\airVErr.exe
  2⤵
  PID:14532
- C:\Windows\System\qRKrbWC.exe
  C:\Windows\System\qRKrbWC.exe
  2⤵
  PID:9784
- C:\Windows\System\FYwDTKh.exe
  C:\Windows\System\FYwDTKh.exe
  2⤵
  PID:8336
- C:\Windows\System\ZsRzfDK.exe
  C:\Windows\System\ZsRzfDK.exe
  2⤵
  PID:7908
- C:\Windows\System\AaNMSxk.exe
  C:\Windows\System\AaNMSxk.exe
  2⤵
  PID:7256
- C:\Windows\System\JcKhPxW.exe
  C:\Windows\System\JcKhPxW.exe
  2⤵
  PID:3240
- C:\Windows\System\kmzAHNL.exe
  C:\Windows\System\kmzAHNL.exe
  2⤵
  PID:9956
- C:\Windows\System\ZoXPHld.exe
  C:\Windows\System\ZoXPHld.exe
  2⤵
  PID:13344
- C:\Windows\System\BFhamJm.exe
  C:\Windows\System\BFhamJm.exe
  2⤵
  PID:8992
- C:\Windows\System\eJyGxXM.exe
  C:\Windows\System\eJyGxXM.exe
  2⤵
  PID:7768
- C:\Windows\System\gmqmgtu.exe
  C:\Windows\System\gmqmgtu.exe
  2⤵
  PID:8728
- C:\Windows\System\HDSbyBi.exe
  C:\Windows\System\HDSbyBi.exe
  2⤵
  PID:10168
- C:\Windows\System\zlGXYei.exe
  C:\Windows\System\zlGXYei.exe
  2⤵
  PID:7272
- C:\Windows\System\fgmFJoh.exe
  C:\Windows\System\fgmFJoh.exe
  2⤵
  PID:15084
- C:\Windows\System\JfhHNvG.exe
  C:\Windows\System\JfhHNvG.exe
  2⤵
  PID:9604
- C:\Windows\System\zflmOaH.exe
  C:\Windows\System\zflmOaH.exe
  2⤵
  PID:9328
- C:\Windows\System\OqCHuwx.exe
  C:\Windows\System\OqCHuwx.exe
  2⤵
  PID:8788
- C:\Windows\System\TAtcSpI.exe
  C:\Windows\System\TAtcSpI.exe
  2⤵
  PID:9072
- C:\Windows\System\rWFQKUy.exe
  C:\Windows\System\rWFQKUy.exe
  2⤵
  PID:8216
- C:\Windows\System\jpQHQUQ.exe
  C:\Windows\System\jpQHQUQ.exe
  2⤵
  PID:9960
- C:\Windows\System\aLAMZCY.exe
  C:\Windows\System\aLAMZCY.exe
  2⤵
  PID:14276
- C:\Windows\System\jsxdBuA.exe
  C:\Windows\System\jsxdBuA.exe
  2⤵
  PID:13684
- C:\Windows\System\nRUXDCJ.exe
  C:\Windows\System\nRUXDCJ.exe
  2⤵
  PID:564
- C:\Windows\System\LjjHKek.exe
  C:\Windows\System\LjjHKek.exe
  2⤵
  PID:10132
- C:\Windows\System\xbVERtc.exe
  C:\Windows\System\xbVERtc.exe
  2⤵
  PID:7696
- C:\Windows\System\tnvMpwT.exe
  C:\Windows\System\tnvMpwT.exe
  2⤵
  PID:9772
- C:\Windows\System\GMwxEwp.exe
  C:\Windows\System\GMwxEwp.exe
  2⤵
  PID:10396
- C:\Windows\System\SVYzDoS.exe
  C:\Windows\System\SVYzDoS.exe
  2⤵
  PID:7152
- C:\Windows\System\EgGBtUM.exe
  C:\Windows\System\EgGBtUM.exe
  2⤵
  PID:10428
- C:\Windows\System\vzWCZGQ.exe
  C:\Windows\System\vzWCZGQ.exe
  2⤵
  PID:7996
- C:\Windows\System\UuITbHm.exe
  C:\Windows\System\UuITbHm.exe
  2⤵
  PID:10556
- C:\Windows\System\PDOKZFp.exe
  C:\Windows\System\PDOKZFp.exe
  2⤵
  PID:11008
- C:\Windows\System\geWqkDp.exe
  C:\Windows\System\geWqkDp.exe
  2⤵
  PID:10228
- C:\Windows\System\AXfQRWA.exe
  C:\Windows\System\AXfQRWA.exe
  2⤵
  PID:11080
- C:\Windows\System\GqXsfIE.exe
  C:\Windows\System\GqXsfIE.exe
  2⤵
  PID:10204
- C:\Windows\System\zlRqats.exe
  C:\Windows\System\zlRqats.exe
  2⤵
  PID:6052
- C:\Windows\System\yicuSeY.exe
  C:\Windows\System\yicuSeY.exe
  2⤵
  PID:11060
- C:\Windows\System\JKsXjAM.exe
  C:\Windows\System\JKsXjAM.exe
  2⤵
  PID:14364
- C:\Windows\System\lqlgSXK.exe
  C:\Windows\System\lqlgSXK.exe
  2⤵
  PID:5980
- C:\Windows\System\RsXUGYE.exe
  C:\Windows\System\RsXUGYE.exe
  2⤵
  PID:11236
- C:\Windows\System\uTadRKk.exe
  C:\Windows\System\uTadRKk.exe
  2⤵
  PID:9752
- C:\Windows\System\tEpapZO.exe
  C:\Windows\System\tEpapZO.exe
  2⤵
  PID:9412
- C:\Windows\System\LfhbyzQ.exe
  C:\Windows\System\LfhbyzQ.exe
  2⤵
  PID:9340
- C:\Windows\System\XkWkgSN.exe
  C:\Windows\System\XkWkgSN.exe
  2⤵
  PID:10444
- C:\Windows\System\DaLBaPF.exe
  C:\Windows\System\DaLBaPF.exe
  2⤵
  PID:10352
- C:\Windows\System\yaOBjoU.exe
  C:\Windows\System\yaOBjoU.exe
  2⤵
  PID:10720
- C:\Windows\System\lXZHLbj.exe
  C:\Windows\System\lXZHLbj.exe
  2⤵
  PID:7060
- C:\Windows\System\VlmqeJY.exe
  C:\Windows\System\VlmqeJY.exe
  2⤵
  PID:7516
- C:\Windows\System\tNFfyDw.exe
  C:\Windows\System\tNFfyDw.exe
  2⤵
  PID:8356
- C:\Windows\System\BtThxly.exe
  C:\Windows\System\BtThxly.exe
  2⤵
  PID:4900
- C:\Windows\System\DycHsrC.exe
  C:\Windows\System\DycHsrC.exe
  2⤵
  PID:7712
- C:\Windows\System\rjKMeqf.exe
  C:\Windows\System\rjKMeqf.exe
  2⤵
  PID:10708
- C:\Windows\System\XyrIcYq.exe
  C:\Windows\System\XyrIcYq.exe
  2⤵
  PID:8716
- C:\Windows\System\NNkRczd.exe
  C:\Windows\System\NNkRczd.exe
  2⤵
  PID:9472
- C:\Windows\System\BVGleHZ.exe
  C:\Windows\System\BVGleHZ.exe
  2⤵
  PID:11920
- C:\Windows\System\mBSZEem.exe
  C:\Windows\System\mBSZEem.exe
  2⤵
  PID:11016
- C:\Windows\System\DUAjRDz.exe
  C:\Windows\System\DUAjRDz.exe
  2⤵
  PID:9732
- C:\Windows\System\yesNHCR.exe
  C:\Windows\System\yesNHCR.exe
  2⤵
  PID:11088
- C:\Windows\System\bdoZxtl.exe
  C:\Windows\System\bdoZxtl.exe
  2⤵
  PID:14672
- C:\Windows\System\RxmtjUy.exe
  C:\Windows\System\RxmtjUy.exe
  2⤵
  PID:8252
- C:\Windows\System\DMRHebb.exe
  C:\Windows\System\DMRHebb.exe
  2⤵
  PID:12220
- C:\Windows\System\KETtKGO.exe
  C:\Windows\System\KETtKGO.exe
  2⤵
  PID:6388
- C:\Windows\System\SqtBNHr.exe
  C:\Windows\System\SqtBNHr.exe
  2⤵
  PID:10032
- C:\Windows\System\ivawdCC.exe
  C:\Windows\System\ivawdCC.exe
  2⤵
  PID:9264
- C:\Windows\System\SrtOiba.exe
  C:\Windows\System\SrtOiba.exe
  2⤵
  PID:8932
- C:\Windows\System\ycoGENo.exe
  C:\Windows\System\ycoGENo.exe
  2⤵
  PID:7592
- C:\Windows\System\CFyEIAH.exe
  C:\Windows\System\CFyEIAH.exe
  2⤵
  PID:6704
- C:\Windows\System\KoqSbDE.exe
  C:\Windows\System\KoqSbDE.exe
  2⤵
  PID:8840
- C:\Windows\System\tlBsfTi.exe
  C:\Windows\System\tlBsfTi.exe
  2⤵
  PID:12436
- C:\Windows\System\pAbLJua.exe
  C:\Windows\System\pAbLJua.exe
  2⤵
  PID:7652
- C:\Windows\System\bEfATkF.exe
  C:\Windows\System\bEfATkF.exe
  2⤵
  PID:10500
- C:\Windows\System\IwrIbOp.exe
  C:\Windows\System\IwrIbOp.exe
  2⤵
  PID:6936
- C:\Windows\System\QtqNNJi.exe
  C:\Windows\System\QtqNNJi.exe
  2⤵
  PID:4984
- C:\Windows\System\ADrssOc.exe
  C:\Windows\System\ADrssOc.exe
  2⤵
  PID:10784
- C:\Windows\System\XVqvvJz.exe
  C:\Windows\System\XVqvvJz.exe
  2⤵
  PID:8748
- C:\Windows\System\mkHnIVb.exe
  C:\Windows\System\mkHnIVb.exe
  2⤵
  PID:7332
- C:\Windows\System\MdMCdEr.exe
  C:\Windows\System\MdMCdEr.exe
  2⤵
  PID:11512
- C:\Windows\System\WyWCDKv.exe
  C:\Windows\System\WyWCDKv.exe
  2⤵
  PID:12700
- C:\Windows\System\vharwxG.exe
  C:\Windows\System\vharwxG.exe
  2⤵
  PID:12780
- C:\Windows\System\jsxOoYC.exe
  C:\Windows\System\jsxOoYC.exe
  2⤵
  PID:13552
- C:\Windows\System\QiGPpzi.exe
  C:\Windows\System\QiGPpzi.exe
  2⤵
  PID:9716
- C:\Windows\System\iKzoHaG.exe
  C:\Windows\System\iKzoHaG.exe
  2⤵
  PID:11488
- C:\Windows\System\yExtKVB.exe
  C:\Windows\System\yExtKVB.exe
  2⤵
  PID:12852
- C:\Windows\System\fJMocaS.exe
  C:\Windows\System\fJMocaS.exe
  2⤵
  PID:10468
- C:\Windows\System\FwZXHoC.exe
  C:\Windows\System\FwZXHoC.exe
  2⤵
  PID:12688
- C:\Windows\System\nLaBMdt.exe
  C:\Windows\System\nLaBMdt.exe
  2⤵
  PID:13076
- C:\Windows\System\lhFVtaY.exe
  C:\Windows\System\lhFVtaY.exe
  2⤵
  PID:11736
- C:\Windows\System\sEAQBjC.exe
  C:\Windows\System\sEAQBjC.exe
  2⤵
  PID:9548
- C:\Windows\System\ntYCwxr.exe
  C:\Windows\System\ntYCwxr.exe
  2⤵
  PID:15372
- C:\Windows\System\WoLbvwi.exe
  C:\Windows\System\WoLbvwi.exe
  2⤵
  PID:15404
- C:\Windows\System\hxDKrnV.exe
  C:\Windows\System\hxDKrnV.exe
  2⤵
  PID:15436
- C:\Windows\System\pfwexHC.exe
  C:\Windows\System\pfwexHC.exe
  2⤵
  PID:15472
- C:\Windows\System\JAjSqFQ.exe
  C:\Windows\System\JAjSqFQ.exe
  2⤵
  PID:15512
- C:\Windows\System\WmmoSJp.exe
  C:\Windows\System\WmmoSJp.exe
  2⤵
  PID:15612
- C:\Windows\System\NPKciDg.exe
  C:\Windows\System\NPKciDg.exe
  2⤵
  PID:15640
- C:\Windows\System\qKhyvTA.exe
  C:\Windows\System\qKhyvTA.exe
  2⤵
  PID:15672
- C:\Windows\System\RwkRaNs.exe
  C:\Windows\System\RwkRaNs.exe
  2⤵
  PID:15696
- C:\Windows\System\JjlgQAs.exe
  C:\Windows\System\JjlgQAs.exe
  2⤵
  PID:15804
- C:\Windows\System\uDGGfer.exe
  C:\Windows\System\uDGGfer.exe
  2⤵
  PID:15828
- C:\Windows\System\sBheWSS.exe
  C:\Windows\System\sBheWSS.exe
  2⤵
  PID:15856
- C:\Windows\System\PmPqAtN.exe
  C:\Windows\System\PmPqAtN.exe
  2⤵
  PID:15884
- C:\Windows\System\HSHuhXW.exe
  C:\Windows\System\HSHuhXW.exe
  2⤵
  PID:15924
- C:\Windows\System\GvFkiSg.exe
  C:\Windows\System\GvFkiSg.exe
  2⤵
  PID:15964
- C:\Windows\System\jjLqWLX.exe
  C:\Windows\System\jjLqWLX.exe
  2⤵
  PID:15992
- C:\Windows\System\KiKpuNk.exe
  C:\Windows\System\KiKpuNk.exe
  2⤵
  PID:16024
- C:\Windows\System\TDFVkOC.exe
  C:\Windows\System\TDFVkOC.exe
  2⤵
  PID:16072
- C:\Windows\System\mUIWntZ.exe
  C:\Windows\System\mUIWntZ.exe
  2⤵
  PID:16092
- C:\Windows\System\okHXxGP.exe
  C:\Windows\System\okHXxGP.exe
  2⤵
  PID:16112
- C:\Windows\System\jNVriVz.exe
  C:\Windows\System\jNVriVz.exe
  2⤵
  PID:16140
- C:\Windows\System\bBuNLZe.exe
  C:\Windows\System\bBuNLZe.exe
  2⤵
  PID:16160
- C:\Windows\System\jKvYLrT.exe
  C:\Windows\System\jKvYLrT.exe
  2⤵
  PID:16188
- C:\Windows\System\aTVABKv.exe
  C:\Windows\System\aTVABKv.exe
  2⤵
  PID:16216
- C:\Windows\System\rNXLdrk.exe
  C:\Windows\System\rNXLdrk.exe
  2⤵
  PID:16240
- C:\Windows\System\iJERJlx.exe
  C:\Windows\System\iJERJlx.exe
  2⤵
  PID:16272
- C:\Windows\System\lIdcjQw.exe
  C:\Windows\System\lIdcjQw.exe
  2⤵
  PID:16300
- C:\Windows\System\jPIOaJc.exe
  C:\Windows\System\jPIOaJc.exe
  2⤵
  PID:16340
- C:\Windows\System\SviQHvn.exe
  C:\Windows\System\SviQHvn.exe
  2⤵
  PID:16372
- C:\Windows\System\IDHdrXA.exe
  C:\Windows\System\IDHdrXA.exe
  2⤵
  PID:11820
- C:\Windows\System\QkLFAmy.exe
  C:\Windows\System\QkLFAmy.exe
  2⤵
  PID:12880
- C:\Windows\System\tQwqDIi.exe
  C:\Windows\System\tQwqDIi.exe
  2⤵
  PID:12972
- C:\Windows\System\KEmEaiC.exe
  C:\Windows\System\KEmEaiC.exe
  2⤵
  PID:12840
- C:\Windows\System\nRumGkY.exe
  C:\Windows\System\nRumGkY.exe
  2⤵
  PID:13272
- C:\Windows\System\HQlMaba.exe
  C:\Windows\System\HQlMaba.exe
  2⤵
  PID:12160
- C:\Windows\System\exTahLz.exe
  C:\Windows\System\exTahLz.exe
  2⤵
  PID:15540
- C:\Windows\System\SIDYiEl.exe
  C:\Windows\System\SIDYiEl.exe
  2⤵
  PID:15564
- C:\Windows\System\JpGBpbL.exe
  C:\Windows\System\JpGBpbL.exe
  2⤵
  PID:10992
- C:\Windows\System\zMOPgpR.exe
  C:\Windows\System\zMOPgpR.exe
  2⤵
  PID:15584
- C:\Windows\System\iHwqtyx.exe
  C:\Windows\System\iHwqtyx.exe
  2⤵
  PID:15636
- C:\Windows\System\tAMZQpw.exe
  C:\Windows\System\tAMZQpw.exe
  2⤵
  PID:12868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x2fs4pvm.dhv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AYXuxAN.exe

Filesize
2.2MB

MD5
7c5a89016aec11d3f694f40b872cd743

SHA1
30a53e660c2afcf146892c6599bb3d44468b3cae

SHA256
78cc713e2c2df5cf802362152340ddba0de247160b4f18867b321b53685e84e7

SHA512
ed66f7c2017eadbafbde37f2ff9167e9399dc8f068c869fe97249ef2026dc8c6e352c4661a4d0cb2903980080e1b5c3b310570c9434167bf272139dd7771421b

Download Submit
C:\Windows\System\BYLqeZe.exe

Filesize
2.2MB

MD5
f38b06a9ef93bcc1e52d83d328bbff69

SHA1
64ca3a9af7571cf37f105623468bf1e3a2a85be8

SHA256
8e417e54464bcd37491b72f44ea3bfc271539fac765be9fe40ed737da885c542

SHA512
8e22954056cb245484fa54437d99087b93b75a57c53bd1fe6014b3073508e9aae3de73968c04a55d1d704a62b8c7e8464bd150d82df45d1f6205454f386ef3af

Download Submit
C:\Windows\System\CILEaUg.exe

Filesize
2.2MB

MD5
01f6a94ca5fa9df1ec7710517ebe68f8

SHA1
3ef698dbd257cfc4e542c3e71685c9d9bcfbd90a

SHA256
26528f7ee1aaf4b066b10499907c2acb666c359cfe77b63634bb201ca1f5aa2c

SHA512
b0afa9a732700e156de5335570d3c008979b794ec5faaf3c946d2c764ad9c033fefe8745b54ea84b6cb49eee077ab26656cb709a1178116d5b9407030f1f72b3

Download Submit
C:\Windows\System\CmHWuYF.exe

Filesize
18B

MD5
35bde48c57b79a5e0ea0718733e62371

SHA1
41d2e344c30d7af2c472ba7a6ded43f0a9d6d4c2

SHA256
407b155a736cda52f1eb2b18d7fea9e028f3f4f796230535df591f3124a679c0

SHA512
a6c519b6e0f42a0f961fc4c0161e01dfb018e01d40d6b50a2a61a6cfeffa9e0fa78a3d1bb24269ec827e815cd0942de8d545ba7f93aa13de1bab78f87b543dba

Download Submit
C:\Windows\System\DIsyImm.exe

Filesize
2.2MB

MD5
992b40db801f333d9f34b6a4c36c28f1

SHA1
4fdc58a41e91286b24645f812213896d180f60d0

SHA256
612167e8626dcaa834d8ec56925149c38a31acdc148593f960096c211fc300ce

SHA512
fd98a8ba2bdcc4c125f65dcdc72bc9f6accffa1a42da1f64a422bc7928b9b9bb7232f234e626c09060f12e029b30fc9f2619d7f90f52c2460dce8c5e026379db

Download Submit
C:\Windows\System\KQWUTLu.exe

Filesize
2.2MB

MD5
0c2a5515ae7f830ee2cdbc0c8d458998

SHA1
f63cd6af2b9a649c0075200d0e4837d73cf7ccd7

SHA256
1224591a07b1c0b982352afa858c06b41f584a729a6493a6c0feb03a0299258e

SHA512
07b4daeeb4cc6d4e4947873ad8442ddd445acef3895504de173a777abc261ae21ea24c985c5a5817ab47fbbd176d17cbc80f35c34596869a1eeb52d7181d44e4

Download Submit
C:\Windows\System\KgSfokk.exe

Filesize
2.2MB

MD5
d855d1c1d999e60fdf1b2084bcff38d5

SHA1
ec1c445f137f7fcdaabee2bcc62d8f676146b9f5

SHA256
be3e69921ae572add4f54798f4c015ba2661cfe8515968167e8965bf19c709ad

SHA512
9e2352925deed08757793a92a9952ba3e343e6dc2f684799981ed62fa2cd74ca087baa086045d359b731aa1ea85737bf38dc079dc1a92a8271f3c1e204065e43

Download Submit
C:\Windows\System\LEtejVK.exe

Filesize
2.2MB

MD5
a22ca553f70383aa96103982293b9465

SHA1
0e267eca904264cd31c8587142f6d19371444abb

SHA256
433acfc51a5dd05522a1c97a9835a406c872fde15005559801962d108cfe29bb

SHA512
4f577a9af08490fe8c2d6b7c336208d4cdbee1306a564994b914a19158150e6c2effda0d777cb7ebb8b161c5dd9fd9855b1f84935e4bc8627cce1dce9bb25f43

Download Submit
C:\Windows\System\LrXDVbG.exe

Filesize
2.2MB

MD5
d77d17ebacbf63101e477be98675b311

SHA1
f2fe4a18042fb1fd5d8cf126ae148cf41665de37

SHA256
f9eb6501dd89b65c1af7dc081485c41ce25e3fe5808716a51cc67a91c8a76d39

SHA512
ca6421dbd4db468761574eb2cc4a6aa2c3189d65c7ec8c97b1c41caf3dede9e6fabfad32f1d6bc4bfc8677826691ea104c3df5a98b189ff5ec6aa7806607e2a1

Download Submit
C:\Windows\System\MuwYegx.exe

Filesize
2.2MB

MD5
f9fe79b7cec77819c2e12498b3e61d87

SHA1
6c1908364ee90d182273b66e308a0512a76e4803

SHA256
1f523874154aac194eaa03403de388a9cf457181d18e152ad45d2733c6080341

SHA512
34808fe01cced14620553babc43ac595356dc83b9cf74c369de205d0084b2f19e020cdc45017802c01d429ceae6be167ccc77c8117948adf20bf5c9217ca42d8

Download Submit
C:\Windows\System\OSlHrIi.exe

Filesize
2.2MB

MD5
3dd61fef58dd1fdd5fb77e4f5c57909f

SHA1
bad7ceba7fb66b9cb41e8e6bbaec2a120abd729c

SHA256
af3991b57accf9a7bcba77651058b5be4995e79e39fd3f01f66ed7e3d3a91f88

SHA512
36a6b4d2372e80d5e1a4666694af4597b646285876aa610112c3bb8922f4f04436bad0b39c2f572a5cf3cff20e8e6ac85a1a0ad07ff47970ac724e5bf23106bf

Download Submit
C:\Windows\System\OrIvEVi.exe

Filesize
2.2MB

MD5
76cd2674440f6c028e41502d2a5e2b59

SHA1
63cf7f3d48a45c0bd8e82111c55d6788ec209b85

SHA256
1e6082ceef505850d3edc46f314310c8c5d2e5cd5860f21324473fa71df7150e

SHA512
d78035aebe993fc021a30da4bc3fe10e694ab6319a8ea04c4e7fbfe88fa93a7b9fde0c56d4491a6e6733337d6e87d1f868bac8025ff6b37db370f4fdaa6e9482

Download Submit
C:\Windows\System\PChYUPa.exe

Filesize
2.2MB

MD5
c84a88df3fb64030a23812514ceeb8b1

SHA1
db8b2ed656f48182c26f1a0a7228bdc09c211eae

SHA256
bc861c3f8e0ce5acd6ac4fbc4749bbb2d63e4e16f9d7825d2147f3b559f44e47

SHA512
528eca0e329597c9cd4a513c6f89a34d2f5feb0ec272cec4a771ef5b40fedfe2f736d5e2374835a8366ee5198b14aaa9f78396717b2bb0a3958568a938b64b60

Download Submit
C:\Windows\System\QGCdbTV.exe

Filesize
2.2MB

MD5
c8d33cd7ad13e0cf1605995d0890a956

SHA1
2fdb7a611712063516c4d60ce27fd7ada231e16d

SHA256
1c61eb5ee1d8d328bd3d0f5064be6d158ffe282d9536296e7e235e44604c08ba

SHA512
bd33e344ee91878b8524bd3b7cf84abb14f1755ac0675ec457edf293841452e56450bc485be3b7aca76db8c3d4b05354a9a6f2645737f7b80692b0626f4948a7

Download Submit
C:\Windows\System\QOjSYdu.exe

Filesize
2.2MB

MD5
7ff5f0bd080fbd436df87d4b98008667

SHA1
8af91d948a96840bae755d5b67229edb347402f2

SHA256
5c86e49952ea21ad5398ae1e38d426c4a813a93603ec9617fc8aa0c2efbb2705

SHA512
7a17c1820482278ea37503e6f249cc5b2d463b3632a430c48b6f177ba7d6194f3fdceab0345fa152ed118f116368e2e7c5f64ee202ca093c0806393795ca7a16

Download Submit
C:\Windows\System\QqYMDrG.exe

Filesize
2.2MB

MD5
fcabdb87eadb96825757a32faea30c70

SHA1
0c2640190a23048eb6add952a91b4319748b5918

SHA256
f180f77b596f21012772c28f8cb11dc6da291a885b899b32798045a07998607b

SHA512
cc4a3f6b60a588ed52f72dfedc1e222731a2777bcb05a3f97a37870f420adb5cf056ecf53b60e771721265bd0b715170eaa2352b2405dc384eaf811b7970faed

Download Submit
C:\Windows\System\SNAvtMp.exe

Filesize
2.2MB

MD5
091e427fbebb2be30538200d1855e3cb

SHA1
973b194c74673359bab018ae96dbd4b91d8222d9

SHA256
4b8e625c3e63515853e6be501ab28c78507761822d8a5903166d6a5b524d3c18

SHA512
6f2ef3267e2b4b6194934d671e056d3ae6cdbcbfd37e5fdf41a0faa586bbd4811475d7c67f66e051f44e905f8c8e1f638155718cfedd8fa54ee20399586f0431

Download Submit
C:\Windows\System\TaapdIf.exe

Filesize
2.2MB

MD5
40f74a757b07ec353d636ceacc290509

SHA1
5c332e8c1eefaf13da6191abbb159847ecba7398

SHA256
61808c48b4f3dcc82c595b150f1dc8a5951efd2651bba3f66add757147187039

SHA512
2c08d1bed3858084bf0a170e144a70e868af7fe8b4b650e380ca9df6f1da9dac108d2f43f307acae7de14b67d5e125d37062d03639ec93981991d30a3cc5586a

Download Submit
C:\Windows\System\UYhDsYG.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\WhGeMga.exe

Filesize
2.2MB

MD5
791545f5f0499bc95058815b30a14344

SHA1
65e9edf35fe8c023be2215d82f48fbe1be851a31

SHA256
7ad08d35755517a00cb2d128e6a818d73ee5c588141060f32ad0803f7a26d1c7

SHA512
6afca9b155f5c0197a92f94bc68b2b7b338e171b3d809a71d650539a3f3aec3d1ea843b0cbe244e2b65f4091566df7da79c3f768b299aeddad297619ea1789f9

Download Submit
C:\Windows\System\axzEfdA.exe

Filesize
2.2MB

MD5
fe8bb3ae32e69fd00bfdcb29b6dee693

SHA1
ee6a49406e0d7ab1598d19e92274423609dc2c1c

SHA256
327429344c62c31c10929101c0b1ebe13550b7d73f2275fd0718ec86fe5cc4a3

SHA512
9a65566a529e466504ece38ab2059eed8a5e06212fcfc621d755af234e1180df0dc159fd925595baa9de6cdd7788d8b1eb0a6b5985e219ffb76af4a20ad3d7f4

Download Submit
C:\Windows\System\cyXvvgf.exe

Filesize
2.2MB

MD5
4c29520c5d43d11d875b5ebf11b1934a

SHA1
a3e2940bc2afc8bdfbf20f5a313c33fa295cee10

SHA256
e6369fac35f2b599579d244002f5287aa26c40608132bd5ae11424f655fdd87c

SHA512
9132e348df9355073910c85a9705938508c9b6fdb78d1cfa159b7e3b9b02dbfdd94e1bae36d1308048930a203dbafe6d688c0e3fe99ca7381fa70ec2f787c9cb

Download Submit
C:\Windows\System\fHYiiaC.exe

Filesize
2.2MB

MD5
788af58ed744a40eff23031776253c61

SHA1
6610bd8c36cf07b20619bc072234055512eb6364

SHA256
dc17e067797a42d6cd002aaf95e866c90273c84b9c769c2ab7325cdbd83d6c88

SHA512
d6c75648a37929604e45dd2fceede9e633d02f2a8502e955c5780e8db29324ba54ca6b885270d99288c6441c94bc05f7216ef12a3aaf2ac91db241a02e2cf1ac

Download Submit
C:\Windows\System\gjIRZob.exe

Filesize
2.2MB

MD5
dc61572b4c80b00e391ba8c8a0781012

SHA1
70d24439ba44445a19fb1749b191a1df95047157

SHA256
a39b8d28da348c190765df9619abc7e80e36012c116cf29fb330ab63c542bccf

SHA512
f0dd006047130c5df314a3fa69783a273a94781decf1d5c3eaf3a9f5d4f1f17b5e4e6e9be666ff2f0c6887478939527df7c3697b39fa22b8346445ec06eeee41

Download Submit
C:\Windows\System\icCvUEM.exe

Filesize
1.4MB

MD5
0736effa5a1a724e6039e222dfdd12d5

SHA1
ad137d58a0a93ab76ed3cfcbf555986eb129eec7

SHA256
037a31c459d721fc0ca1bdd7231316d951a4f82b57ebe57571ad0746c859f4d0

SHA512
d9b3c138abaf957855bc4c53db50a0e3381968a1806b0e306a4c16e0d30ba53a2a23f8a3c09c876a4ea9acfc67250537894690ef95bf210d1181b25fe32789ce

Download Submit
C:\Windows\System\icCvUEM.exe

Filesize
2.2MB

MD5
4ee5333e9a45798368d9b33e056fbe25

SHA1
5b24c4f1fa22354be99ec8103e4f6621b7816a09

SHA256
52712be60393f961d331a97c696104c43c5f625f1a3fc78e20152ebc882a26af

SHA512
43feff34e60fc2bd1ce391c34e62fd2375ac66f41fdbafb895f5e18c56c14cc92261886e10401005288f3841e9583ec6c466f892f10619c0143fc9d2f7d7d563

Download Submit
C:\Windows\System\lMuJYQr.exe

Filesize
2.2MB

MD5
56b91cc32ff142ab49e69478ca4585b9

SHA1
97a135852140092de5280a63d7294ef532f28385

SHA256
f7439d0c44a7544ad6e89c748b49061d49196350c5858d7ae209449181b519f1

SHA512
70e5defd855f2e291ba459f798181ec3f6a9aadd452397db8972426addd1cb4a321a0e01e3a31c043373648745e275a5365762573df137bb6882baa6a31a74a0

Download Submit
C:\Windows\System\lQBtHrt.exe

Filesize
2.2MB

MD5
7f3cbe35cec8b1de6cecddc6591d9d24

SHA1
287df06dbb3531e9a46f0cd81bdb21395bb9759f

SHA256
4ef2a42cf051ae625df2842d3f6407824c4283eb65f2c6d54d1165d4d966c529

SHA512
e8fcafbefd186b15608e8dd0da8324447810ce4a0fe7dc02df6485a23ef0ab5b38a20f0c5e22fa7cf9f645922befb7eea0e6ff91cb3f68ce7811244323b4af43

Download Submit
C:\Windows\System\mGTUQRn.exe

Filesize
2.2MB

MD5
0d96f3cec50bf5cafff9e263604d8aac

SHA1
7a76499fe0c74c9f8e7bfc6a65fe65ba33ea155b

SHA256
0050ba1bec04e6dbb731c9faa59b0fb3f075cde8e807dbe17a5f08c1dc194dd0

SHA512
282f617fe720d799305b6cbabb931ab4a7b03d608bc6f848b35b1bde31e85cdc4e0ceeaf78dbc94a301a0b3a04bf6bb2ddb481680a02e3dd921d02a19a7f4da7

Download Submit
C:\Windows\System\mPOejwR.exe

Filesize
2.2MB

MD5
2f55ef5ca82464e655737293e5dd8ed0

SHA1
eede1574eb14aeee9d29aa78d0033b238ab74d6f

SHA256
2e7d22c6b658d1a88dbf651689d344e56728891e61a61b7cb499a4af428db6c9

SHA512
ab587d79565b8c9b084959d80c94b6399a1358618fae2d24e4187fa568f48115f14f8db1f92b4e9fb190006feb8e62d317f0634464fc6f5a0ba37f1bc168a58e

Download Submit
C:\Windows\System\mjyfuZt.exe

Filesize
2.2MB

MD5
380d7442a3ec43248d85dc4e69f99304

SHA1
86ff040817f89eb0fa3593c2ff5d44e222cd7880

SHA256
c6ca345a51cc002502a9879a6fa469ce34fe1c89ca377eeb7f95b024302b8076

SHA512
450f079d61483ffd84cd6c90c321009485e5f13a3871f43f95b39b77956fc161c9ab49793ce6147db9a43ebf8c17b2eef0856515df5541244855b4c3aa5a4e98

Download Submit
C:\Windows\System\mnZLbmt.exe

Filesize
2.2MB

MD5
5095555d21f3d37d32da2db292d1364b

SHA1
395a7a355b8bf7dde1981a484af7d37a1471bf72

SHA256
6801593e1c48f9ad4885c4b768b523093fc18ffffafa4f0906cdba7d9f82b631

SHA512
28a5b33e8578c0885175f4f8160da3ec7d60d4194f5284c2daf170db653f22eb3eec03335abf532455b35088ad9b5f73500bbb366c7a6d14aeea448678be671b

Download Submit
C:\Windows\System\mzTKHUa.exe

Filesize
2.2MB

MD5
d10e77763eb35282c516e6d96ed963f4

SHA1
d1e68a61ac030bd35bf6ae1b9a3792337ca84917

SHA256
8f44c6ad6b4cd7b10f4dc4b1aa191933dfad8b48a24627cca1c3715d73b6c2d8

SHA512
97dda031da25d824149ebf545c0bce0fa8b7cbdd34bdabb00079c1912da701a5417b4d94e433d554e88e28177298793ae861c78f409c48317842e1d64a685a0b

Download Submit
C:\Windows\System\oAeKqRD.exe

Filesize
2.2MB

MD5
1b90466cacde5ac5bf81686c73eead9b

SHA1
b6b65d59ab4e086109a2a41ce3fa83dca8f79894

SHA256
ce27fe0e8ff3a52dab460176078fb3ec17f46385ab2f08421596859a8a9dbcf0

SHA512
c8fc4ba53b5cdf9d365a3041a88c208ae81cd11ad2932bbc2c975caf7b1aab676b01e10d881b7942264055d965dec6272c49758df86c0dcd63268ae6067aa90f

Download Submit
C:\Windows\System\pJSkRRB.exe

Filesize
2.2MB

MD5
a54e9812458c48ed198753ed841d6712

SHA1
7bdb3dda2699393b3688fc6691355bb7812a1d1c

SHA256
a26dc504b57521291f0c3d9767c80190626dc85022e23130d4fe1ad6c21bbe5d

SHA512
3a161e07059e4db3231b289328ce799a3cbd05f9c8d7e9453806acff9ca80fbdf3440d145398ba9367fe7fb20418c0eff72dbc51d96a8ea2df1d62122cf06918

Download Submit
C:\Windows\System\qiohfVe.exe

Filesize
2.2MB

MD5
2e6d6f720982177853d5156ad40f1159

SHA1
0941ae7933e0b1890e952724396a90031451a6ff

SHA256
ea42d61b1216aef02763694fb6195325c666f91c6bda0e09e543bfabaf20c07a

SHA512
18cf740cc81144ab8e1c5bd4e290f70a42be7a74dd53ddeb0d4bbfecd71d842db1dd9d39d034fc802cab08f4379d2472b92356d39e8aba8e2c54ee9918475f04

Download Submit
C:\Windows\System\vCerEIL.exe

Filesize
2.2MB

MD5
ac97309cad846f2e71706d8a785b5ce6

SHA1
166895e205d0f649bc4ae119c23a75ff6c28a536

SHA256
ed22a85babbedb7b17489b13ead77900c080e82522ecd1623f7d7cab44bfa6ba

SHA512
76e63cd6766197337f95d19c46e0e012997b94f018996f3594e107e05a380506bf124c8f62feed14cbb30204a62372f750a185a3242de4e94b4116ace056f961

Download Submit
C:\Windows\System\vLyJFqD.exe

Filesize
2.2MB

MD5
1ea49db4e55ac7bc1974bbf77e74f80d

SHA1
e84819220ffe79faac894c4ac876d5087a410a38

SHA256
63e716cca1b2717f199ca6d5d798fc64c1c791643531150b8cd845bb31085811

SHA512
a52edbe22d32786aca1bc8c20202c5c738853b457708c7f3738fd17a79967a820bc55f018627fc714fe591034b5fb277e9f2ac95c06c1e79141f78afadedeb09

Download Submit
C:\Windows\System\vvOomgt.exe

Filesize
2.2MB

MD5
d96b16c64e547ab04401a96ad31ba7b8

SHA1
18790d008462e4015d7fad323367642a8abf9fbe

SHA256
803bdc15f1a3dba057bc55fc6b60af543ef75ccc74add633d1f9096b48297935

SHA512
57cc7b74fe30fe64204d669342ae06f6972c864094eb3dd10d63c905828cb361face7c117c076439b228c4d9c7ef870bbb647b4ab371ee707c05e66bab77efe8

Download Submit
C:\Windows\System\wtROeLL.exe

Filesize
2.2MB

MD5
b36528c25c09edf567448c0a6ca26af1

SHA1
ef8b7b5a7352689c4c8fbd35fd90c5a85a924857

SHA256
b4c326bcf1f695d41a5510693fd82376b4793bf3039cf197abfc166ef5e36767

SHA512
2c68fca141641a3b6413d9200e496cfa463be090a5e1e512b6a265be081925753cce61fd64ef6fc87b6fafeef501c9bce4fc95a1db54ca1df8e2b2a74e7bcd7b

Download Submit
C:\Windows\System\yhUFmkU.exe

Filesize
2.2MB

MD5
d295ae6d03d8577c728549b421a37dd0

SHA1
910f3ca12d665f1736b76ba7d908f6e1a603a796

SHA256
b0cb9c16e1f8d48174e9d2415c6aa0e7bb452c9526917761fff45d438fd70044

SHA512
f425809d2841a9ffb9da90175feab351725a365c5d676eb50857ad3e83fbcc2384d682eff27c6dbb1519965a126b3287e4a7df5e138d718407602be1d0bcc2b7

Download Submit
memory/352-421-0x00007FF65DE00000-0x00007FF65E1F2000-memory.dmp

Filesize
3.9MB

Download
memory/352-4982-0x00007FF65DE00000-0x00007FF65E1F2000-memory.dmp

Filesize
3.9MB

Download
memory/472-4940-0x00007FF635220000-0x00007FF635612000-memory.dmp

Filesize
3.9MB

Download
memory/472-424-0x00007FF635220000-0x00007FF635612000-memory.dmp

Filesize
3.9MB

Download
memory/552-227-0x00007FF74CDA0000-0x00007FF74D192000-memory.dmp

Filesize
3.9MB

Download
memory/552-4838-0x00007FF74CDA0000-0x00007FF74D192000-memory.dmp

Filesize
3.9MB

Download
memory/912-333-0x00007FF719CE0000-0x00007FF71A0D2000-memory.dmp

Filesize
3.9MB

Download
memory/1044-420-0x00007FF737490000-0x00007FF737882000-memory.dmp

Filesize
3.9MB

Download
memory/1044-4869-0x00007FF737490000-0x00007FF737882000-memory.dmp

Filesize
3.9MB

Download
memory/1340-430-0x00007FF785360000-0x00007FF785752000-memory.dmp

Filesize
3.9MB

Download
memory/1340-4990-0x00007FF785360000-0x00007FF785752000-memory.dmp

Filesize
3.9MB

Download
memory/1856-422-0x00007FF7CA5C0000-0x00007FF7CA9B2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-4967-0x00007FF7CA5C0000-0x00007FF7CA9B2000-memory.dmp

Filesize
3.9MB

Download
memory/1944-5062-0x00007FF7E2FC0000-0x00007FF7E33B2000-memory.dmp

Filesize
3.9MB

Download
memory/1944-427-0x00007FF7E2FC0000-0x00007FF7E33B2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-259-0x00007FF77E760000-0x00007FF77EB52000-memory.dmp

Filesize
3.9MB

Download
memory/2924-4995-0x00007FF73DBE0000-0x00007FF73DFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-425-0x00007FF73DBE0000-0x00007FF73DFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-429-0x00007FF7B1680000-0x00007FF7B1A72000-memory.dmp

Filesize
3.9MB

Download
memory/3116-82-0x00007FFE009D0000-0x00007FFE01491000-memory.dmp

Filesize
10.8MB

Download
memory/3116-84-0x0000027DBECC0000-0x0000027DBECD0000-memory.dmp

Filesize
64KB

Download
memory/3116-107-0x0000027DBEE90000-0x0000027DBEEB2000-memory.dmp

Filesize
136KB

Download
memory/3140-133-0x00007FF7D77E0000-0x00007FF7D7BD2000-memory.dmp

Filesize
3.9MB

Download
memory/3140-4789-0x00007FF7D77E0000-0x00007FF7D7BD2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-426-0x00007FF6022D0000-0x00007FF6026C2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-4984-0x00007FF6022D0000-0x00007FF6026C2000-memory.dmp

Filesize
3.9MB

Download
memory/3212-4917-0x00007FF6C6720000-0x00007FF6C6B12000-memory.dmp

Filesize
3.9MB

Download
memory/3212-395-0x00007FF6C6720000-0x00007FF6C6B12000-memory.dmp

Filesize
3.9MB

Download
memory/3248-221-0x00007FF7A40A0000-0x00007FF7A4492000-memory.dmp

Filesize
3.9MB

Download
memory/3600-4910-0x00007FF635380000-0x00007FF635772000-memory.dmp

Filesize
3.9MB

Download
memory/3600-336-0x00007FF635380000-0x00007FF635772000-memory.dmp

Filesize
3.9MB

Download
memory/3688-5391-0x00007FF66F860000-0x00007FF66FC52000-memory.dmp

Filesize
3.9MB

Download
memory/3688-0-0x00007FF66F860000-0x00007FF66FC52000-memory.dmp

Filesize
3.9MB

Download
memory/3688-1-0x0000015BE81D0000-0x0000015BE81E0000-memory.dmp

Filesize
64KB

Download
memory/3860-419-0x00007FF643F10000-0x00007FF644302000-memory.dmp

Filesize
3.9MB

Download
memory/4548-290-0x00007FF7E4250000-0x00007FF7E4642000-memory.dmp

Filesize
3.9MB

Download
memory/4600-423-0x00007FF6BE4D0000-0x00007FF6BE8C2000-memory.dmp

Filesize
3.9MB

Download
memory/4600-5001-0x00007FF6BE4D0000-0x00007FF6BE8C2000-memory.dmp

Filesize
3.9MB

Download
memory/4788-129-0x00007FF758640000-0x00007FF758A32000-memory.dmp

Filesize
3.9MB

Download
memory/4788-4815-0x00007FF758640000-0x00007FF758A32000-memory.dmp

Filesize
3.9MB

Download
memory/4972-5053-0x00007FF605B90000-0x00007FF605F82000-memory.dmp

Filesize
3.9MB

Download
memory/4972-428-0x00007FF605B90000-0x00007FF605F82000-memory.dmp

Filesize
3.9MB

Download